UnderTheWire Century is a beginner-level PowerShell training series. It seems like Linux hosts are not supported, so I’m using Windows Terminal for this.

Century 1

Challenge

The password for Century2 is the build version of the instance of PowerShell installed on this system.

NOTE: – The format is as follows: **.*.*****.**** – Include all periods – Be sure to look for build version and NOT PowerShell version

Solution

Enter $PSVersionTable and the build number is in the output.

Name                           Value
----                           -----
PSVersion                      5.1.14393.4583
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14393.4583
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Century 2

Password

10.0.14393.4583

Challenge

The password for Century3 is the name of the built-in cmdlet that performs the wget like function within PowerShell PLUS the name of the file on the desktop.

NOTE: – If the name of the cmdlet is “get-web” and the file on the desktop is named “1234”, the password would be “get-web1234”. – The password will be lowercase no matter how it appears on the screen.

Solution

PS C:\users\century2\desktop> get-alias wget
 
CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Alias           wget -> Invoke-WebRequest
 
 
PS C:\users\century2\desktop> ls
 
 
    Directory: C:\users\century2\desktop
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018   3:29 AM            693 443

get-alias wget feels kind of like cheating but whatever. The password for the next level is invoke-webrequest443

Century 3

Password

invoke-webrequest443

Challenge

The password for Century4 is the number of files on the desktop.

Solution

PS C:\users\century3\desktop> (ls | measure).Count
123
PS C:\users\century3\desktop> (get-childitem | measure-object).count
123

Century 4

Password

123

Challenge

The password for Century5 is the name of the file within a directory on the desktop that has spaces in its name.

NOTE:
– The password will be lowercase no matter how it appears on the screen.

Solution

PS C:\users\century4\desktop> ls
 
 
    Directory: C:\users\century4\desktop
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----         5/6/2022   6:19 PM                a
d-----         2/8/2022  10:35 PM                Can You Open Me
 
 
PS C:\users\century4\desktop> ls '.\Can You Open Me'
 
 
    Directory: C:\users\century4\desktop\Can You Open Me
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----         2/8/2022  10:35 PM             24 5548

Century 5

Password

5548

Challenge

The password for Century6 is the short name of the domain in which this system resides in PLUS the name of the file on the desktop.

NOTE: – If the short name of the domain is “blob” and the file on the desktop is named “1234”, the password would be “blob1234”. – The password will be lowercase no matter how it appears on the screen.

Solution

PS C:\users\century5\desktop> $ADSystemInfo = New-Object -ComObject "ADSystemInfo"
PS C:\users\century5\desktop> $ADSystemInfo.GetType().InvokeMember("DomainShortName", "GetProperty", $null, $ADSystemInfo, $null)
underthewire
PS C:\users\century5\desktop> ls
 
 
    Directory: C:\users\century5\desktop
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018   3:29 AM             54 3347

Some of the other commands I’ve tried all require higher privileges. Only this one worked. The password is underthewire3347.

Century 6

Password

underthewire3347

Challenge

The password for Century7 is the number of folders on the desktop.

Solution

PS C:\users\century6\desktop> (ls | measure).count
197
PS C:\users\century6\desktop> (ls -attributes directory | measure).count
197

Seems like nothing special had to be done to look for directories specifically.

Century 7

Password

197

Challenge

The password for Century8 is in a readme file somewhere within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.

NOTE:
– The password will be lowercase no matter how it appears on the screen.

Solution

PS C:\users\century7\desktop> cd ..
PS C:\users\century7> ls -R
 
 
    Directory: C:\users\century7
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-r---        7/16/2016   1:23 PM                Desktop
d-r---        8/30/2018   3:10 AM                Documents
d-----        3/29/2022  11:54 PM                Downloads
d-r---        7/16/2016   1:23 PM                Favorites
d-r---        7/16/2016   1:23 PM                Links
d-r---        7/16/2016   1:23 PM                Music
d-r---        7/16/2016   1:23 PM                Pictures
d-----        7/16/2016   1:23 PM                Saved Games
d-r---        7/16/2016   1:23 PM                Videos
 
 
    Directory: C:\users\century7\Downloads
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        2/25/2022  10:18 PM             17 LineNumbers.txt
-a----        8/30/2018   3:29 AM              7 Readme.txt
-a----        2/12/2022   8:59 PM              2 Readme2.txt
 
 
PS C:\users\century7> cd Downloads
PS C:\users\century7\Downloads> type Readme.txt
7points

Century 8

Password

7points

Challenge

The password for Century9 is the number of unique entries within the file on the desktop.

Solution

PS C:\users\century8\desktop> (get-content .\unique.txt | sort-object | get-unique).count
696

Get-Content’s alias is gc

Century 9

Password

696

Challenge

The password for Century10 is the 161st word within the file on the desktop.

NOTE: – The password will be lowercase no matter how it appears on the screen.

Solution

The text file has some words delimited by spaces.

PS C:\users\century9\desktop> (gc Word_File.txt) -split ' ' | select -index 160
pierid
PS C:\users\century9\desktop> -split (gc Word_File.txt) | select -index 160
pierid

-Split is an operator that can either be placed before the delimited string (defaulting to whitespace as delimiter; -Split <delimited>, -Split <delimited[]>, or after the string to specify a delimiter (<delimited> -Split <delimiter>).

Century 10

Password

pierid

Challenge

The password for Century11 is the 10th and 8th word of the Windows Update service description combined PLUS the name of the file on the desktop.

NOTE:
– The password will be lowercase no matter how it appears on the screen.
– If the 10th and 8th word of the service description is “apple” and “juice” and the name of the file on the desktop is “88”, the password would be “applejuice88”.

Solution

PS C:\users\century10\desktop> get-service -displayname '*pdate*'
 
Status   Name               DisplayName
------   ----               -----------
Stopped  tzautoupdate       Auto Time Zone Updater
Running  UsoSvc             Update Orchestrator Service for Win...
Stopped  wuauserv           Windows Update
 
 
PS C:\users\century10\desktop> get-wmiobject win32_service | ?{$_.name -like 'wuauserv'} | select Description
 
Description
-----------
Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able...
 
 
PS C:\users\century10\desktop> ls
 
 
    Directory: C:\users\century10\desktop
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018   3:34 AM             43 110

The password is windowsupdates110.

Century 11

Password

windowsupdates110

Challenge

The password for Century12 is the name of the hidden file within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.

NOTE:
– Exclude “desktop.ini”.
– The password will be lowercase no matter how it appears on the screen.

Solution

PS C:\users\century11> ls -file -recurse -hidden -erroraction ignore
 
 
    Directory: C:\users\century11
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a-h--        2/17/2022  12:50 AM         262144 NTUSER.DAT
-a-hs-        8/30/2018   3:11 AM          98304 ntuser.dat.LOG1
-a-hs-        8/30/2018   3:11 AM         126976 ntuser.dat.LOG2
-a-hs-        7/12/2020  10:55 PM          65536 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TM.blf
-a-hs-        6/14/2020   4:36 AM         524288 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TMContainer00000000000000
                                                 000001.regtrans-ms
-a-hs-        7/12/2020  10:55 PM         524288 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TMContainer00000000000000
                                                 000002.regtrans-ms
---hs-        8/30/2018   3:11 AM             20 ntuser.ini
 
 
    Directory: C:\users\century11\AppData\Local\Microsoft\Windows
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a-h--        8/30/2018   3:11 AM           8192 UsrClass.dat
-a-hs-        8/30/2018   3:11 AM           8192 UsrClass.dat.LOG1
-a-hs-        8/30/2018   3:11 AM           8192 UsrClass.dat.LOG2
-a-hs-        8/30/2018   3:11 AM          65536 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TM.blf
-a-hs-        8/30/2018   3:11 AM         524288 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TMContainer000000000000
                                                 00000001.regtrans-ms
-a-hs-        8/30/2018   3:11 AM         524288 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TMContainer000000000000
                                                 00000002.regtrans-ms
 
 
    Directory: C:\users\century11\AppData\Local\Microsoft\Windows\WinX\Group1
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a-hs-        7/16/2016   1:21 PM             75 desktop.ini
 
 
    Directory: C:\users\century11\AppData\Local\Microsoft\Windows\WinX\Group2
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a-hs-        7/16/2016   1:21 PM            325 desktop.ini
 
 
    Directory: C:\users\century11\AppData\Local\Microsoft\Windows\WinX\Group3
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a-hs-        7/16/2016   1:21 PM            948 desktop.ini
 
 
    Directory: C:\users\century11\Downloads
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
--rh--        8/30/2018   3:34 AM             30 secret_sauce

The output would be cleaner if I stacked a bunch of where-object conditions, but this is fine for the moment.

Century 12

Password

secret_sauce

Challenge

The password for Century13 is the description of the computer designated as a Domain Controller within this domain PLUS the name of the file on the desktop.

NOTE: – The password will be lowercase no matter how it appears on the screen. – If the description “today_is” and the file on the desktop is named “_cool”, the password would be “today_is_cool”.

Solution

PS C:\users\century12\desktop> get-adcomputer -filter *
 
 
DistinguishedName : CN=UTW,OU=Domain Controllers,DC=underthewire,DC=tech
DNSHostName       : utw.underthewire.tech
Enabled           : True
Name              : UTW
ObjectClass       : computer
ObjectGUID        : 5ca56844-bb73-4234-ac85-eed2d0d01a2e
SamAccountName    : UTW$
SID               : S-1-5-21-758131494-606461608-3556270690-1000
UserPrincipalName :
 
DistinguishedName : CN=192.99.167.156,CN=Computers,DC=underthewire,DC=tech
DNSHostName       :
Enabled           : True
Name              : 192.99.167.156
ObjectClass       : computer
ObjectGUID        : d8247090-aa0e-456e-b9b0-a6a55f6469c5
SamAccountName    : 192.99.167.156$
SID               : S-1-5-21-758131494-606461608-3556270690-2182
UserPrincipalName :
 
 
 
PS C:\users\century12\desktop> get-adcomputer UTW -properties * | select-object name,description
 
name description
---- -----------
UTW  i_authenticate
 
 
PS C:\users\century12\desktop> ls
 
 
    Directory: C:\users\century12\desktop
 
 
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018   3:34 AM             30 _things

The password is i_authenticate_things.

Century 13

Password

i_authenticate_things

Challenge

The password for Century14 is the number of words within the file on the desktop.

Solution

PS C:\users\century13\desktop> (-Split (gc countmywords) | measure).count
755

Century 14

Password

755

Challenge

The password for Century15 is the number of times the word “polo” appears within the file on the desktop.

NOTE:
– You should count the instances of the whole word only..

Solution

PS C:\users\century14\desktop> -Split (gc countpolos) | ?{$_ -eq 'polo'} | measure | select-object -exp count
153

$_ is used because the LHS streams values and not objects. -exp is used to expand the count value in the object into a value.

Century 15

Password

153