> For the complete documentation index, see [llms.txt](https://cybertuna.gitbook.io/underthewire/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybertuna.gitbook.io/underthewire/cyborg/cyborg-5-greater-than-10.md).

# Cyborg 5 -> 10

## Cyborg 5 -> 6

The password for cyborg6 is the last name of the user who has logon hours set on their account PLUS the name of the file on the desktop.

```
Get-ADUser -Filter 'logonHours -like "*"'
Confirmation:
Get-AdUser -Filter "givenName -eq 'Benny'" -Property *
```

```
Password: rowray_timer
```

{% hint style="info" %}
Check help examples: Get-Help Get-ADUser -examples
{% endhint %}

{% hint style="info" %}
<https://docs.microsoft.com/en-us/windows/win32/adschema/a-logonhours>
{% endhint %}

## Cyborg 6 -> 7

The password for cyborg7 is the decoded text of the string within the file on the desktop.

```
$EncodedText = Get-Content .\cypher.txt
$DecodedText = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($EncodedText))
$DecodedText
```

```
Password: cybergeddon
```

{% hint style="info" %}
<https://cyberfibers.com/2017/07/base64-with-powershell/>
{% endhint %}

## Cyborg 7 -> 8

The password for cyborg8 is the executable name of a program that will start automatically when cyborg7 logs in.

```
Get-ChildItem HKCU:\Software\Microsoft\Windows\CurrentVersion\
Look for the 'run' key
```

```
Password: skynet
```

{% hint style="info" %}
Useful script: <https://devblogs.microsoft.com/scripting/how-can-i-list-all-the-items-in-the-run-key-in-the-registry/>
{% endhint %}

## Cyborg 8 -> 9

The password for cyborg9 is the Internet zone that the picture on the desktop was downloaded from.

```
Seeing the streams:
    Get-Item .\1_qs5nwlcl7f_-SwNlQvOrAw.png -stream *
Getting the contents:
    Get-Content .\1_qs5nwlcl7f_-SwNlQvOrAw.png -stream Zone.Identifier
```

```
Password: 4
```

{% hint style="info" %}
<https://davidhamann.de/2019/02/23/hidden-in-plain-sight-alternate-data-streams/>
{% endhint %}

## Cyborg 9 -> 10

&#x20;The password for cyborg10 is the first name of the user with the phone number of 876-5309 listed in Active Directory **PLUS** the name of the file on the desktop.

```
Get-AdUser -Filter 'OfficePhone -eq "876-5309"'
```

```
Password: onita99
```