Check-LocalAdminHash & Exfiltrating All PowerShell History

The report introduces Check-LocalAdminHash, a PowerShell-based tool that uses pass-the-hash over WMI/SMB to identify systems where a local admin hash grants access and can optionally exfiltrate PSReadline console history files to a controlled web server. It details how the tool enumerates domain hosts (via PowerView), executes remote commands (via Invoke-TheHash’s WMI/SMB exec), and outlines web server setup considerations for secure file upload handling, emphasizing operational caution and potential extensibility.