Pearson's OSCP Notebook

PowerShell History - PSReadLine

Properties2
tagspowershell, powershell-history, psreadline, historysavepath, credential-discovery, windows, enumeration, oscp
aliasespowershell history, PSReadLine history, ConsoleHost_history.txt

1 min read

PowerShell History — PSReadLine

Ctrl+F: powershell history · PSReadLine · HistorySavePath · ConsoleHost_history.txt

Windows PowerShell (with PSReadLine) saves command history to a plaintext file per user. Admins often type passwords, connection strings, and one-liners here — always read on privesc / post-exploit.

→ Credential Discovery · Windows PrivEsc · type

📌 Find the history file path

(Get-PSReadlineOption).HistorySavePath

Example output:

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

📌 Read history

PowerShell:

(Get-PSReadlineOption).HistorySavePath
type C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
 
# Current user — dynamic path
type $Env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Get-Content (Get-PSReadlineOption).HistorySavePath

CMD:

type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type %USERPROFILE%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Other users (if readable):

type C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
dir C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt /s /b 2>nul

📌 Hunt interesting commands

Get-Content (Get-PSReadlineOption).HistorySavePath | Select-String -Pattern "pass|cred|secret|ConvertTo-SecureString|net user|invoke|download|certutil|mimikatz|runas" -CaseSensitive:$false
findstr /i "pass cred secret net user invoke certutil download" %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

📌 From Kali (remote)

# evil-winrm
*Evil-WinRM* PS> (Get-PSReadlineOption).HistorySavePath
*Evil-WinRM* PS> type $Env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
 
# CrackMapExec module
nxc smb TARGET -u user -p pass -M powershell_history

→ evil-winrm · CrackMapExec - nxc

📌 Default path pattern

C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
VariableExpands to
$Env:APPDATAC:\Users\<user>\AppData\Roaming
%APPDATA%Same (CMD)

📌 Quick cheat sheet

(Get-PSReadlineOption).HistorySavePath
type C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type $Env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Graph View

Backlinks