peass-ng / PEASS-ng

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

Home Page:https://book.hacktricks.xyz

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Powershell history bug?

emizzz opened this issue Β· comments

Hi πŸ‘‹

regarding reading the Powershell history, why filter the results for the string "pa"?

Write-Host "=|| PowerShell Console History"
Write-Host "=|| To see all history, run this command: Get-Content (Get-PSReadlineOption).HistorySavePath"
Write-Host $(Get-Content (Get-PSReadLineOption).HistorySavePath | Select-String pa)

Is this a bug or "pa" stands for "password, "passwd", ... ?

What about using something like this?

$(Get-Content (Get-PSReadLineOption).HistorySavePath  -Tail 10)

Or maybe something that contains more than one keyword (e.g. secret, pass, pwd, ...)?

Thanks πŸ™




@RandolphConley

The reason it looks for "pa" is to not rule out the iterations of "password". This of course can generate false positives.