search
githubEdit

Powershell History File

hashtag
Within this file, we may find credentials for lateral movement

hashtag
Location

$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
PreviousPasswordsafe (psafe) credential recoveryNextUse grep to hunt for passwords

Last updated