📔
UnderTheWire
  • Introduction
  • Century
    • Century 0 -> 5
    • Century 5 -> 10
    • Century 10 -> 15
  • Cyborg
    • Cyborg 0 -> 5
    • Cyborg 5 -> 10
    • Cyborg 10 -> 15
  • Groot
    • Groot 0 -> 5
    • Groot 5 -> 10
    • Groot 10 ->15
  • Oracle
    • Oracle 0 -> 5
    • Oracle 5 -> 10
    • Oracle 10 -> 15
  • Trebek
    • Trebek 0 -> 5
    • Trebek 5 -> 10
    • Trebek 10 -> 15
Powered by GitBook
On this page
  • Cyborg 5 -> 6
  • Cyborg 6 -> 7
  • Cyborg 7 -> 8
  • Cyborg 8 -> 9
  • Cyborg 9 -> 10

Was this helpful?

  1. Cyborg

Cyborg 5 -> 10

PreviousCyborg 0 -> 5NextCyborg 10 -> 15

Last updated 4 years ago

Was this helpful?

Cyborg 5 -> 6

The password for cyborg6 is the last name of the user who has logon hours set on their account PLUS the name of the file on the desktop.

Get-ADUser -Filter 'logonHours -like "*"'
Confirmation:
Get-AdUser -Filter "givenName -eq 'Benny'" -Property *
Password: rowray_timer

Check help examples: Get-Help Get-ADUser -examples

Cyborg 6 -> 7

The password for cyborg7 is the decoded text of the string within the file on the desktop.

$EncodedText = Get-Content .\cypher.txt
$DecodedText = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($EncodedText))
$DecodedText
Password: cybergeddon

Cyborg 7 -> 8

The password for cyborg8 is the executable name of a program that will start automatically when cyborg7 logs in.

Get-ChildItem HKCU:\Software\Microsoft\Windows\CurrentVersion\
Look for the 'run' key
Password: skynet

Cyborg 8 -> 9

The password for cyborg9 is the Internet zone that the picture on the desktop was downloaded from.

Seeing the streams:
    Get-Item .\1_qs5nwlcl7f_-SwNlQvOrAw.png -stream *
Getting the contents:
    Get-Content .\1_qs5nwlcl7f_-SwNlQvOrAw.png -stream Zone.Identifier
Password: 4

Cyborg 9 -> 10

The password for cyborg10 is the first name of the user with the phone number of 876-5309 listed in Active Directory PLUS the name of the file on the desktop.

Get-AdUser -Filter 'OfficePhone -eq "876-5309"'
Password: onita99

Useful script:

https://docs.microsoft.com/en-us/windows/win32/adschema/a-logonhours
https://cyberfibers.com/2017/07/base64-with-powershell/
https://devblogs.microsoft.com/scripting/how-can-i-list-all-the-items-in-the-run-key-in-the-registry/
https://davidhamann.de/2019/02/23/hidden-in-plain-sight-alternate-data-streams/