finding credentials in .msi files with msiexec

orca is a very useful graphical tool for exploring installers in a similar way.

"You can pull files out of a .msi? I thought it was like an executable."

A quite worrying thing about this story is that the other party may be of the mistaken belief that embedding credentials would somehow have been okay if it were an executable.

One reassuring aspect, though, is that there was a proper security team in place and that the author reported it to them so it could be handled properly.