Credential Hunting

Search for sensitive files

findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml

Finding sensitive words that user added to dictionary

gc 'C:\Users\htb-student\AppData\Local\Google\Chrome\User Data\Default\Custom Dictionary.txt' | Select-String password

Confirm powershell history save path

(Get-PSReadLineOption).HistorySavePath

Read powershell history save path

gc (Get-PSReadLineOption).HistorySavePath

Powershell one-liner to read all history files

foreach($user in ((ls C:\users).fullname)){cat "$userAppDataRoamingMicrosoftWindowsPowerShellPSReadlineConsoleHost_history.txt" -ErrorAction SilentlyContinue}