Capture The Flag with Powershell — UnderTheWire: Century
UnderTheWire is a game where you have to find the password to the next level using Powershell commands.
STARTING OFF AND LOGGING IN
ssh century1@century.underthewire.techPassword: century1
CENTURY1
The password for Century2 is the build version of the instance of PowerShell installed on this system.
What variable holds the build version of our instance of PowerShell?
$PSVersionTable
The password is: 10.0.14393.9140
CENTURY2
The password for Century3 is the name of the built-in cmdlet that performs the wget like function within PowerShell PLUS the name of the file on the desktop.
If the name of the cmdlet is “get-web” and the file on the desktop is named “1234”, the password would be “get-web1234”.
The password will be lowercase no matter how it appears on the screen.
I know that wget is similar to Invoke.
Wget is capable of downloading files from the internet. However I cannot remember which Invoke command I should choose.
Let’s look at the built-in Invoke commands:
Get-Command Invoke-* -CommandType Cmdlet
Invoke-WebRequest seems familiar let’s use that as the first half.
We can now list what’s on the desktop:
Get-ChildItem
So the password should be: invoke-webrequest443
CENTURY3
The password for Century4 is the number of files on the desktop.
We need to count how many files are in our current directory:
(Get-ChildItem).Count
The password is: 123
CENTURY4
The password for Century5 is the name of the file within a directory on the desktop that has spaces in its name
The password will be lowercase no matter how it appears on the screen.
cd '.\Can You Open Me'Get-ChildItem
The password is: 15768
CENTURY5
The password for Century6 is the short name of the domain in which this system resides in PLUS the name of the file on the desktop.
If the short name of the domain is “blob” and the file on the desktop is named “1234”, the password would be “blob1234”.
The password will be lowercase no matter how it appears on the screen.
We can find out the domain by looking up the below environment variable:
$env:USERDOMAIN
Get-ChildItemThe password is underthewire3347
CENTURY6
The password for Century7 is the number of folders on the desktop.
Thankfully the command is the same for century3, Since there is no mix of folders and files, we can use the same command:
(Get-ChildItem).CountThe password is: 197
CENTURY7
The password for Century8 is in a readme file somewhere within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.
First we need to move up a directory:
cd ..Now we need a command that searches recursively through folders and subfolders:
Get-ChildItem *readme* -Recurse
Now we have to show the content of the file:
Get-Content C:\users\century7\Downloads\Readme.txtThe password is 7points
CENTURY8
The password for Century9 is the number of unique entries within the file on the desktop.
We can count how many lines are in the file:
(Get-Content unique.txt).Count
Now we can add the unique aspect. We can do that with the Sort-Object command:
(Get-Content unique.txt | Sort-Object -Unique).Count
Looks like everything was unique.
The password is: 696
CENTURY9
The password for Century10 is the 161st word within the file on the desktop.
The password will be lowercase no matter how it appears on the screen.
Below is the template for the command that we will use:
Get-Content .\Word_File.txt -Delimit ‘ ‘ | Select-Object -Index 160The command explained:
- Show the contents of the file and ensure each word is seperated (delimited) by a space.
- We are then going to select the 160th object in the list. This is actually the 161st object because we start counting from 0 as opposed to 1.
The password is: pierid
CENTURY10
The password for Century11 is the 10th and 8th word of the Windows Update service description combined PLUS the name of the file on the desktop.
The password will be lowercase no matter how it appears on the screen.
If the 10th and 8th word of the service description is “apple” and “juice” and the name of the file on the desktop is “88”, the password would be “applejuice88”.
Get Lumenyx’s stories in your inbox
Join Medium for free to get updates from this writer.
We need to get the service description of the Windows Update:
Get-ServiceLooks like we have found it. However it doesn’t tell us the service description:
We can get the properties and methods of objects by piping it into Get-Member.
Get-Service [ SERVICE ] | Get-MemberGet-Service wuauserv | Get-Member
Looks like we need to use Get-CimInstance Win32_Service.
At a VERY high level, Get-CimInstance can be used to get deeper details for the chosen class (Win32_Service in this case).
Get-CimInstance -ClassName Win32_Service -Filter "DisplayName like '[Service Display Name]'"Get-CimInstance -ClassName Win32_Service -Filter "DisplayName like 'Windows Update'"
Getting closer. This still does not display the description.
We can use the dot notation example that we did earlier, but instead of ().count, we can use ().description.
(Get-CimInstance -ClassName Win32_Service -Filter "DisplayName like 'Windows Update'").Description
Don’t forget the file name on the desktop:
So combine everything together 10th word + 8th word + file name.
The password is: windowsupdates110
CENTURY11
The password for Century12 is the name of the hidden file within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.
Exclude “desktop.ini”.
The password will be lowercase no matter how it appears on the screen.
cd ..So we’re looking for a hidden file that is within one of these directories:
Get-ChildItem -Recurse -Hidden -File
This will give us a lot of errors. We must add another flag to this command to suppress these errors:
Get-ChildItem -Recurse -Hidden -File -ErrorAction SilentlyContinue
We can make the output easier to read by piping the output into something that only shows unique names:
Get-ChildItem -Recurse -Hidden -File -ErrorAction SilentlyContinue | Select-Object -Unique Name
Password is: secret_sauce
CENTURY12
The password for Century13 is the description of the computer designated as a Domain Controller within this domain PLUS the name of the file on the desktop.
We can use Get-ADDomainController to find the name of the Domain Controller:
Get-ADDomainController
Since this command doesn’t list the description of the Domain Controller, we will have to use a different command.
If we wanted to find out the properties of an AD user we would use Get-ADUser command right?
Since the Domain Controller is a computer what command should we use? We would use Get-ADComputer.
Get-ADComputer -Identity UTW -Properties -Description
The description is i_authenticate
Now to combine it with the name of the file on the desktop:
Get-ChildItem
Password is: i_authenticate_things
CENTURY13
The password for Century14 is the number of words within the file on the desktop.
If you try to count it using the method in Century3, we will get a result of 1. This is because (Get-Content).Count counts the amount of lines in a file, and this file technically only uses 1 line:
In 1 command, we can first split the individual words to their own line, and then count the lines:
(Get-Content countmywords).Split(' ').CountThis ensures that every word that’s delimited with a space is placed onto a new line.
NOTE: This doesn’t actually put separate words onto different lines, it actually puts them into an array (“word1”, “word2”, “word3”) and then counts how many elements are in the array.
But for beginners trying to grasp this concept, thinking of it as a new line per word is fine.
Fantastic. There’s 755 words:
Password is: 755
CENTURY14
The password for Century15 is the number of times the word “polo” appears within the file on the desktop.
The file on the desktop is called countpolos and has 19482 words.
We have to find out how many times the word ‘polo’ appears in this text.
We can count how many times anything with ‘polo’ shows up:
((Get-Content .\countpolos).Split(' ') | Select-String -Pattern "polo").CountThe count is at 158 however there’s a problem…
We can use the \b regex anchor, which is used to match a word boundry. So you can match whole words instead of substrings.
We can change "polo" to “\bpolo\b”. This will look for whole words that say ‘polo’.
((Get-Content .\countpolos).Split(' ') | Select-String -Pattern "\bpolo\b").CountThe password is 153.
CENTURY15
Congratulations!You have successfully made it to the end!
Try your luck with other games brought to you by the Under The Wire team. Thanks for playing!
INDEX:
Get-ChildItem— Lists the files and folders within the current directory.Get-Content— Displays the contents of a fileGet-Service— Shows basic information about services.Get-Member— View properties and methods of objects.Sort-Object— Sorts the list.Get-CimInstance— Shows deeper meaning on Win32_Services, Win32_Processes, Win32_LogicalDrives etc.Get-ADDomainController— Finds and shows information on the domain controllers in your Active Directory environment.Select-String— The Powershell equivalent ofgrep. It searches for patterns in text.
