My favourite stupid pentest trick that just keeps working: if you wait until an admin goes home or to lunch, then rdp into their machine with their username and password, a lot of the time their keepass will still be unlocked. File/Export/CSV. c:\temp\lol.csv. Exfil, del lol.csv