Write-up for Century
Century 0 -> 1
Obtain credentials from the #StartHere channel on their Slack, connect to the server via SSH. You will need an SSH client such as Putty. The host that you will be connecting to is century.underthewire.tech, on port 22.
login as: century1
century1@century.underthewire.tech password: #century1
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Under the Wire... PowerShell Training for the People!
PS C:\users\century1\desktop>Century 1 -> 2
The password for Century2 is the build version of the instance of PowerShell installed on this system.
PS C:\users\century1\desktop> $PSVersionTable
Name Value
---- -----
PSVersion 5.1.14393.5127
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.5127
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1Century 2 -> 3
The password for Century3 is the name of the built-in cmdlet that performs the wget like function within PowerShell PLUS the name of the file on the desktop.
PS C:\users\century2\desktop> Get-alias
CommandType Name Version Source
----------- ---- ------- ------
...
Alias swmi -> Set-WmiInstance
Alias tee -> Tee-Object
Alias trcm -> Trace-Command
Alias type -> Get-Content
Alias wget -> Invoke-WebRequest
Alias where -> Where-Object
Alias wjb -> Wait-Job
Alias write -> Write-Output
PS C:\users\century2\desktop> Get-ChildItem
Directory: C:\users\century2\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:29 AM 693 443Century 3 -> 4
The password for Century4 is the number of files on the desktop.
PS C:\users\century3\desktop> (Get-ChildItem).count
123Century 4 -> 5
The password for Century5 is the name of the file within a directory on the desktop that has spaces in its name.
PS C:\users\century4\desktop> Get-ChildItem
Directory: C:\users\century4\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/6/2022 6:19 PM a
d----- 6/23/2022 10:30 PM Can You Open Me
d----- 2/8/2022 10:35 PM Open.txt
-a---- 6/17/2022 1:19 AM 0 FolderList
PS C:\users\century4\desktop> Set-Location "Can You Open Me"
PS C:\users\century4\desktop\Can You Open Me> Get-ChildItem
Directory: C:\users\century4\desktop\Can You Open Me
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/23/2022 10:24 PM 24 49125
PS C:\users\century4\desktop\Can You Open Me> Get-Content 49125
Great Work! Keep it up.Century 5 -> 6
The password for Century6 is the short name of the domain in which this system resides in PLUS the name of the file on the desktop.
PS C:\users\century5\desktop> Get-WmiObject
cmdlet Get-WmiObject at command pipeline position 1
Supply values for the following parameters:
Class: Win32_NTDomain
ClientSiteName : Default-First-Site-Name
DcSiteName : Default-First-Site-Name
Description : underthewire
DnsForestName : underthewire.tech
DomainControllerAddress : \\192.99.167.156
DomainControllerName : \\UTW
DomainName : underthewire
Roles :
Status : OK
PS C:\users\century5\desktop> Get-ChildItem
Directory: C:\users\century5\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:29 AM 54 3347Century 6 -> 7
The password for Century7 is the number of folders on the desktop.
PS C:\users\century6\desktop> (Get-ChildItem -Directory).count
197Century 7 -> 8
The password for Century8 is in a readme file somewhere within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.
PS C:\users\century7\Desktop> Set-Location ..
PS C:\users\century7> Get-ChildItem -Path "C:\users\century7" -Recurse -File -Fi
lter "*read*"
Directory: C:\users\century7\Downloads
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:29 AM 7 Readme.txt
-a---- 2/12/2022 8:59 PM 2 Readme2.txt
PS C:\users\century7> Get-Content C:\users\century7\Downloads\readme.txt
7pointsCentury 8 -> 9
The password for Century9 is the number of unique entries within the file on the desktop.
PS C:\users\century8\desktop> Get-ChildItem
Directory: C:\users\century8\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:33 AM 15858 unique.txt
PS C:\users\century8\desktop> (Get-Content unique.txt | Sort-Object | Get-Unique).count
696Century 9 -> 10
The password for Century10 is the 161st word within the file on the desktop.
PS C:\users\century9\desktop> Get-ChildItem
Directory: C:\users\century9\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 2131 Word_File.txt
PS C:\users\century9\desktop> Get-Content -Raw .\Word_File.txt
larceny epibole ...
...
... overclement pursive
PS C:\users\century9\desktop> (Get-Content -Raw .\Word_File.txt).split(" ")
larceny
epibole
...
overclement
pursive
PS C:\users\century9\desktop> (Get-Content -Raw .\Word_File.txt).split(" ")[160]
pieridCentury 10 -> 11
The password for Century11 is the 10th and 8th word of the Windows Update service description combined PLUS the name of the file on the desktop.
PS C:\users\century10\desktop> Get-Service -DisplayName *Update*
Status Name DisplayName
------ ---- -----------
Stopped tzautoupdate Auto Time Zone Updater
Stopped UsoSvc Update Orchestrator Service for Win...
Running wuauserv Windows Update
PS C:\users\century10\desktop> Get-WmiObject win32_service | select Name,Description | Select-String wuauserv
@{Name=wuauserv; Description=Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled,
users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update
Agent (WUA) API.}
PS C:\users\century10\desktop> Get-ChildItem
Directory: C:\users\century10\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 43 110Century 11 -> 12
The password for Century12 is the name of the hidden file within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.
PS C:\users\century11\desktop> Set-Location ..
PS C:\users\century11> Get-ChildItem -Path "C:\users\century11" -Recurse -File -Hidden
Directory: C:\users\century11\Downloads
Mode LastWriteTime Length Name
---- ------------- ------ ----
--rh-- 8/30/2018 3:34 AM 30 secret_sauceCentury 12 -> 13
The password for Century13 is the description of the computer designated as a Domain Controller within this domain PLUS the name of the file on the desktop.
PS C:\users\century12\desktop> Get-ADDomainController
ComputerObjectDN : CN=UTW,OU=Domain Controllers,DC=underthewire,DC=tech
DefaultPartition : DC=underthewire,DC=tech
Domain : underthewire.tech
Enabled : True
Forest : underthewire.tech
HostName : utw.underthewire.tech
InvocationId : 09ee1897-2210-4ac9-989d-e19b4241e9c6
IPv4Address : 192.99.167.156
IPv6Address :
IsGlobalCatalog : True
IsReadOnly : False
LdapPort : 389
Name : UTW
NTDSSettingsObjectDN : CN=NTDS Settings,CN=UTW,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=
Configuration,DC=underthewire,DC=tech
OperatingSystem : Windows Server 2016 Standard
OperatingSystemHotfix :
OperatingSystemServicePack :
OperatingSystemVersion : 10.0 (14393)
OperationMasterRoles : {SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster...}
Partitions : {DC=ForestDnsZones,DC=underthewire,DC=tech,
DC=DomainDnsZones,DC=underthewire,DC=tech,
CN=Schema,CN=Configuration,DC=underthewire,DC=tech,
CN=Configuration,DC=underthewire,DC=tech...}
ServerObjectDN : CN=UTW,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=
underthewire,DC=tech
ServerObjectGuid : df17c8a3-dd76-438b-8ddf-b7ad3e624618
Site : Default-First-Site-Name
SslPort : 636
PS C:\users\century12\desktop> Get-ADComputer UTW -Properties Description
Description : i_authenticate
DistinguishedName : CN=UTW,OU=Domain Controllers,DC=underthewire,DC=tech
DNSHostName : utw.underthewire.tech
Enabled : True
Name : UTW
ObjectClass : computer
ObjectGUID : 5ca56844-bb73-4234-ac85-eed2d0d01a2e
SamAccountName : UTW$
SID : S-1-5-21-758131494-606461608-3556270690-1000
UserPrincipalName :
PS C:\users\century12\desktop> Get-ChildItem
Directory: C:\users\century12\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 30 _thingsCentury 13 -> 14
The password for Century14 is the number of words within the file on the desktop.
PS C:\users\century13\desktop> Get-ChildItem
Directory: C:\users\century13\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:38 AM 7894 countmywords
PS C:\users\century13\desktop> Get-Content countmywords | Measure-Object -Word
Lines Words Characters Property
----- ----- ---------- --------
755Century 14 -> 15
The password for Century15 is the number of times the word “polo” appears within the file on the desktop.
PS C:\users\century14\desktop> Get-ChildItem
Directory: C:\users\century14\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 11:24 PM 202900 countpolos
#First let's split the words into new lines
PS C:\users\century14\desktop> (Get-Content -Raw .\countpolos).split(" ")
#Now we find all the words that contain polo
PS C:\users\century14\desktop> ((Get-Content -Raw .\countpolos).split(" ")) | Select-String polo
#Add '^' operator before polo to find all occurrences of lines that begin with "polo"
PS C:\users\century14\desktop> (((Get-Content -Raw .\countpolos).split(" ")) | Select-String ^polo)
#count the times "polo" is repeated
PS C:\users\century14\desktop> (((Get-Content -Raw .\countpolos).split(" ")) | Select-String ^polo).count
153