UnderTheWire Century is a beginner-level PowerShell training series. It seems like Linux hosts are not supported, so I’m using Windows Terminal for this.
Century 1
Challenge
The password for Century2 is the build version of the instance of PowerShell installed on this system.
NOTE:
– The format is as follows: **.*.*****.****
– Include all periods
– Be sure to look for build version and NOT PowerShell version
Solution
Enter $PSVersionTable and the build number is in the output.
Name Value
---- -----
PSVersion 5.1.14393.4583
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.4583
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1Century 2
Password
10.0.14393.4583
Challenge
The password for Century3 is the name of the built-in cmdlet that performs the wget like function within PowerShell PLUS the name of the file on the desktop.
NOTE: – If the name of the cmdlet is “get-web” and the file on the desktop is named “1234”, the password would be “get-web1234”. – The password will be lowercase no matter how it appears on the screen.
Solution
PS C:\users\century2\desktop> get-alias wget
CommandType Name Version Source
----------- ---- ------- ------
Alias wget -> Invoke-WebRequest
PS C:\users\century2\desktop> ls
Directory: C:\users\century2\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:29 AM 693 443get-alias wget feels kind of like cheating but whatever. The password for the next level is invoke-webrequest443
Century 3
Password
invoke-webrequest443
Challenge
The password for Century4 is the number of files on the desktop.
Solution
PS C:\users\century3\desktop> (ls | measure).Count
123
PS C:\users\century3\desktop> (get-childitem | measure-object).count
123Century 4
Password
123
Challenge
The password for Century5 is the name of the file within a directory on the desktop that has spaces in its name.
NOTE:
– The password will be lowercase no matter how it appears on the screen.
Solution
PS C:\users\century4\desktop> ls
Directory: C:\users\century4\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/6/2022 6:19 PM a
d----- 2/8/2022 10:35 PM Can You Open Me
PS C:\users\century4\desktop> ls '.\Can You Open Me'
Directory: C:\users\century4\desktop\Can You Open Me
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/8/2022 10:35 PM 24 5548Century 5
Password
5548
Challenge
The password for Century6 is the short name of the domain in which this system resides in PLUS the name of the file on the desktop.
NOTE: – If the short name of the domain is “blob” and the file on the desktop is named “1234”, the password would be “blob1234”. – The password will be lowercase no matter how it appears on the screen.
Solution
PS C:\users\century5\desktop> $ADSystemInfo = New-Object -ComObject "ADSystemInfo"
PS C:\users\century5\desktop> $ADSystemInfo.GetType().InvokeMember("DomainShortName", "GetProperty", $null, $ADSystemInfo, $null)
underthewire
PS C:\users\century5\desktop> ls
Directory: C:\users\century5\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:29 AM 54 3347Some of the other commands I’ve tried all require higher privileges. Only this one worked. The password is underthewire3347.
Century 6
Password
underthewire3347
Challenge
The password for Century7 is the number of folders on the desktop.
Solution
PS C:\users\century6\desktop> (ls | measure).count
197
PS C:\users\century6\desktop> (ls -attributes directory | measure).count
197Seems like nothing special had to be done to look for directories specifically.
Century 7
Password
197
Challenge
The password for Century8 is in a readme file somewhere within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.
NOTE:
– The password will be lowercase no matter how it appears on the screen.
Solution
PS C:\users\century7\desktop> cd ..
PS C:\users\century7> ls -R
Directory: C:\users\century7
Mode LastWriteTime Length Name
---- ------------- ------ ----
d-r--- 7/16/2016 1:23 PM Desktop
d-r--- 8/30/2018 3:10 AM Documents
d----- 3/29/2022 11:54 PM Downloads
d-r--- 7/16/2016 1:23 PM Favorites
d-r--- 7/16/2016 1:23 PM Links
d-r--- 7/16/2016 1:23 PM Music
d-r--- 7/16/2016 1:23 PM Pictures
d----- 7/16/2016 1:23 PM Saved Games
d-r--- 7/16/2016 1:23 PM Videos
Directory: C:\users\century7\Downloads
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/25/2022 10:18 PM 17 LineNumbers.txt
-a---- 8/30/2018 3:29 AM 7 Readme.txt
-a---- 2/12/2022 8:59 PM 2 Readme2.txt
PS C:\users\century7> cd Downloads
PS C:\users\century7\Downloads> type Readme.txt
7pointsCentury 8
Password
7points
Challenge
The password for Century9 is the number of unique entries within the file on the desktop.
Solution
PS C:\users\century8\desktop> (get-content .\unique.txt | sort-object | get-unique).count
696Get-Content’s alias is gc
Century 9
Password
696
Challenge
The password for Century10 is the 161st word within the file on the desktop.
NOTE: – The password will be lowercase no matter how it appears on the screen.
Solution
The text file has some words delimited by spaces.
PS C:\users\century9\desktop> (gc Word_File.txt) -split ' ' | select -index 160
pierid
PS C:\users\century9\desktop> -split (gc Word_File.txt) | select -index 160
pierid-Split is an operator that can either be placed before the delimited string (defaulting to whitespace as delimiter; -Split <delimited>, -Split <delimited[]>, or after the string to specify a delimiter (<delimited> -Split <delimiter>).
Century 10
Password
pierid
Challenge
The password for Century11 is the 10th and 8th word of the Windows Update service description combined PLUS the name of the file on the desktop.
NOTE:
– The password will be lowercase no matter how it appears on the screen.
– If the 10th and 8th word of the service description is “apple” and “juice” and the name of the file on the desktop is “88”, the password would be “applejuice88”.
Solution
PS C:\users\century10\desktop> get-service -displayname '*pdate*'
Status Name DisplayName
------ ---- -----------
Stopped tzautoupdate Auto Time Zone Updater
Running UsoSvc Update Orchestrator Service for Win...
Stopped wuauserv Windows Update
PS C:\users\century10\desktop> get-wmiobject win32_service | ?{$_.name -like 'wuauserv'} | select Description
Description
-----------
Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able...
PS C:\users\century10\desktop> ls
Directory: C:\users\century10\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 43 110The password is windowsupdates110.
Century 11
Password
windowsupdates110
Challenge
The password for Century12 is the name of the hidden file within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.
NOTE:
– Exclude “desktop.ini”.
– The password will be lowercase no matter how it appears on the screen.
Solution
PS C:\users\century11> ls -file -recurse -hidden -erroraction ignore
Directory: C:\users\century11
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-h-- 2/17/2022 12:50 AM 262144 NTUSER.DAT
-a-hs- 8/30/2018 3:11 AM 98304 ntuser.dat.LOG1
-a-hs- 8/30/2018 3:11 AM 126976 ntuser.dat.LOG2
-a-hs- 7/12/2020 10:55 PM 65536 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TM.blf
-a-hs- 6/14/2020 4:36 AM 524288 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TMContainer00000000000000
000001.regtrans-ms
-a-hs- 7/12/2020 10:55 PM 524288 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TMContainer00000000000000
000002.regtrans-ms
---hs- 8/30/2018 3:11 AM 20 ntuser.ini
Directory: C:\users\century11\AppData\Local\Microsoft\Windows
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-h-- 8/30/2018 3:11 AM 8192 UsrClass.dat
-a-hs- 8/30/2018 3:11 AM 8192 UsrClass.dat.LOG1
-a-hs- 8/30/2018 3:11 AM 8192 UsrClass.dat.LOG2
-a-hs- 8/30/2018 3:11 AM 65536 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TM.blf
-a-hs- 8/30/2018 3:11 AM 524288 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TMContainer000000000000
00000001.regtrans-ms
-a-hs- 8/30/2018 3:11 AM 524288 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TMContainer000000000000
00000002.regtrans-ms
Directory: C:\users\century11\AppData\Local\Microsoft\Windows\WinX\Group1
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 7/16/2016 1:21 PM 75 desktop.ini
Directory: C:\users\century11\AppData\Local\Microsoft\Windows\WinX\Group2
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 7/16/2016 1:21 PM 325 desktop.ini
Directory: C:\users\century11\AppData\Local\Microsoft\Windows\WinX\Group3
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 7/16/2016 1:21 PM 948 desktop.ini
Directory: C:\users\century11\Downloads
Mode LastWriteTime Length Name
---- ------------- ------ ----
--rh-- 8/30/2018 3:34 AM 30 secret_sauceThe output would be cleaner if I stacked a bunch of where-object conditions, but this is fine for the moment.
Century 12
Password
secret_sauce
Challenge
The password for Century13 is the description of the computer designated as a Domain Controller within this domain PLUS the name of the file on the desktop.
NOTE: – The password will be lowercase no matter how it appears on the screen. – If the description “today_is” and the file on the desktop is named “_cool”, the password would be “today_is_cool”.
Solution
PS C:\users\century12\desktop> get-adcomputer -filter *
DistinguishedName : CN=UTW,OU=Domain Controllers,DC=underthewire,DC=tech
DNSHostName : utw.underthewire.tech
Enabled : True
Name : UTW
ObjectClass : computer
ObjectGUID : 5ca56844-bb73-4234-ac85-eed2d0d01a2e
SamAccountName : UTW$
SID : S-1-5-21-758131494-606461608-3556270690-1000
UserPrincipalName :
DistinguishedName : CN=192.99.167.156,CN=Computers,DC=underthewire,DC=tech
DNSHostName :
Enabled : True
Name : 192.99.167.156
ObjectClass : computer
ObjectGUID : d8247090-aa0e-456e-b9b0-a6a55f6469c5
SamAccountName : 192.99.167.156$
SID : S-1-5-21-758131494-606461608-3556270690-2182
UserPrincipalName :
PS C:\users\century12\desktop> get-adcomputer UTW -properties * | select-object name,description
name description
---- -----------
UTW i_authenticate
PS C:\users\century12\desktop> ls
Directory: C:\users\century12\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/30/2018 3:34 AM 30 _thingsThe password is i_authenticate_things.
Century 13
Password
i_authenticate_things
Challenge
The password for Century14 is the number of words within the file on the desktop.
Solution
PS C:\users\century13\desktop> (-Split (gc countmywords) | measure).count
755Century 14
Password
755
Challenge
The password for Century15 is the number of times the word “polo” appears within the file on the desktop.
NOTE:
– You should count the instances of the whole word only..
Solution
PS C:\users\century14\desktop> -Split (gc countpolos) | ?{$_ -eq 'polo'} | measure | select-object -exp count
153$_ is used because the LHS streams values and not objects. -exp is used to expand the count value in the object into a value.
Century 15
Password
153