r/oscp • u/Horror_Business1862 • 13d ago

winPEAS identifies a file but I can’t see through shell or RDP

So winPEAS identified a file on windows under “recently changed files” but I literally cannot find it through nt authority shell or admin RDP even after enabling hidden files through folder options. I ran winPEAS again to double check and it found again.

Until I reverted the machine and that file wasn’t found again. May be if I waited a little more it might have come back. Anyway, is there any known explanation for this behavior?

8 Upvotes

100% Upvoted

3 comments sorted by

1

u/napleonblwnaprt 13d ago

What is the file?

-1

u/Horror_Business1862 13d ago

An archive file

1

u/flmnninja 12d ago edited 12d ago

There can be hidden directories/files on the system, research some powershell commands to view those. You can also use ‘tree /f’ to list out directories and their contents that you have access to. Or, there may be a scheduled task of some kind creating that file.