Solve Find powershell history in /[root]/Users/emplo/AppData/Roaming/Microsoft/Windows/Powershell/PSReadLine go to pastebin wctf{p3rh4ps_h3_h4D_s1MpLy_m1553D_4_mEm0} Writeups: Author Writeup - Coming Soon https://chrootcommit.github.io/WolvCtf2023#compromised https://github.com/Nambers/ctf-writeups/tree/main/WolvCTF-2023/Forensics-Employee_427Compromised-Easy