https://underthewire.tech/century
The goal of this level is to log into the game.
PS C:\> ssh century1@century.underthewire.tech
century1@century.underthewire.tech's password:
Under the Wire... PowerShell Training for the People!
PS C:\users\century1\desktop>The password for Century2 is the build version of the instance of PowerShell installed on this system.
PS C:\users\century1\desktop> echo $PSVersionTable
Name Value
---- -----
PSVersion 5.1.14393.4467
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.4467
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
PS C:\users\century1\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century2@century.underthewire.tech
century2@century.underthewire.tech's password: 10.0.14393.4467
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century2\desktop>The password for Century3 is the name of the built-in cmdlet that performs the wget like function within PowerShell PLUS the name of the file on the desktop.
PS C:\users\century2\desktop> ls
Directory: C:\users\century2\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:29 AM 693 443
PS C:\users\century1\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century3@century.underthewire.tech
century3@century.underthewire.tech's password: invoke-webrequest443
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century3\desktop>The password for Century4 is the number of files on the desktop.
PS C:\users\century3\desktop> Write-Host (Get-ChildItem . | Measure-Object ).Count;
123
PS C:\users\century3\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century4@century.underthewire.tech
century4@century.underthewire.tech's password: 123The password for Century5 is the name of the file within a directory on the desktop that has spaces in its name.
PS C:\users\century4\desktop> Get-ChildItem "* *" -Recurse
Directory: C:\users\century4\desktop\Can You Open Me
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:29 AM 24 61580
PS C:\users\century4\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century5@century.underthewire.tech
century5@century.underthewire.tech's password: 61580
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century5\desktop>The password for Century6 is the short name of the domain in which this system resides in PLUS the name of the file on the desktop.
PS C:\users\century5\desktop> whoami
underthewire\century5
PS C:\users\century5\desktop> ls
Directory: C:\users\century5\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:29 AM 54 3347
PS C:\users\century5\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century6@century.underthewire.tech
century6@century.underthewire.tech's password: 3347
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century6\desktop>The password for Century7 is the number of folders on the desktop.
PS C:\users\century6\desktop> ( (Get-ChildItem -Path . -Recurse) | Where-Object { $_.PSIsContainer } ).Count
197
PS C:\users\century6\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century7@century.underthewire.tech
century7@century.underthewire.tech's password: 197
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century7\desktop>The password for Century8 is in a readme file somewhere within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.
PS C:\users\century7\desktop> Get-ChildItem -Path .. -Filter *readme* -Recurse | cat
7points
PS C:\users\century7\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century8@century.underthewire.tech
century8@century.underthewire.tech's password: 7points
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century8\desktop>The password for Century9 is the number of unique entries within the file on the desktop.
PS C:\users\century8\desktop> ls
Directory: C:\users\century8\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:33 AM 15858 unique.txt
PS C:\users\century8\desktop> ( cat .\unique.txt | Get-Unique ).Length
696
PS C:\users\century8\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century9@century.underthewire.tech
century9@century.underthewire.tech's password: 696
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century9\desktop>The password for Century10 is the 161st word within the file on the desktop.
PS C:\users\century9\desktop> ls
Directory: C:\users\century9\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 2131 Word_File.txt
PS C:\users\century9\desktop> ( cat .\Word_File.txt ).split()[160]
pierid
PS C:\users\century9\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century10@century.underthewire.tech
century10@century.underthewire.tech's password: pierid
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century10\desktop>The password for Century11 is the 10th and 8th word of the Windows Update service description combined PLUS the name of the file on the desktop.
PS C:\users\century10\desktop> ( Get-WmiObject win32_service | Where-Object {$_.Name -eq 'wuauserv'} | Select Description )
Description
-----------
Enables the detection, download, and installation of updates for Windows and other programs. If this service is disa...
PS C:\users\century10\desktop> ls
Directory: C:\users\century10\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 43 110
PS C:\users\century10\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century11@century.underthewire.tech
century11@century.underthewire.tech's password: windowsupdates110
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century11\desktop>The password for Century12 is the name of the hidden file within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.
PS C:\users\century11\desktop> Get-ChildItem -Path .. -Recurse -Hidden -ErrorAction SilentlyContinue
...
Directory: C:\users\century11\Downloads
Mode LastWriteTime Length Name
---- ------------- ------ ----
--rh-- 8/30/2018 3:34 AM 30 secret_sauce
PS C:\users\century11\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century12@century.underthewire.tech
century12@century.underthewire.tech's password: secret_sauce
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century12\desktop>The password for Century13 is the description of the computer designated as a Domain Controller within this domain PLUS the name of the file on the desktop.
PS C:\users\century12\desktop> $DC = Get-ADDomainController | Select Name
PS C:\users\century12\desktop> echo $DC
Name
----
UTW
PS C:\users\century12\desktop> Get-ADComputer -Identity $DC.Name -Properties * | Select Description
Description
-----------
i_authenticate
PS C:\users\century12\desktop> ls Directory: C:\users\century12\desktop Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 30 _things
PS C:\users\century12\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century13@century.underthewire.tech
century13@century.underthewire.tech's password: i_authenticate_things
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century13\desktop>The password for Century14 is the number of words within the file on the desktop.
PS C:\users\century13\desktop> ls
Directory: C:\users\century13\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:38 AM 7894 countmywords
PS C:\users\century13\desktop> Get-Content .\countmywords | Measure-Object -Word
Lines Words Characters Property
----- ----- ---------- --------
755
PS C:\users\century13\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh [email protected]
[email protected]'s password: 755
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century14\desktop>
The password for Century15 is the number of times the word “polo” appears within the file on the desktop.
PS C:\users\century14\desktop> ls
Directory: C:\users\century14\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 11:24 PM 202900 countpolos
PS C:\users\century14\desktop> -split ( Get-Content .\countpolos | Out-String ) | Where-Object { $_ -eq "polo" } | Measure-Object | Select-Object -exp count
153
PS C:\users\century14\desktop> exit
Connection to century.underthewire.tech closed.
PS C:\> ssh century15@century.underthewire.tech
century15@century.underthewire.tech's password: 153
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century15\desktop>