Groot 10 ->15

Groot 10 -> 11

The password for groot11 is the one word that makes the two files on the desktop different.

compare-object (get-content .\new.txt) (get-content .\old.txt)

Password: taserface

Groot 11 -> 12

The password for groot12 is within an alternate data stream (ADS) somewhere on the desktop.

 Get-Item * -stream *
 TPS_Reports04.pdf has an alternate data stream 'secret'
 Get-Content TPS_Reports04.pdf -stream secret

Password: spaceships

Groot 12 -> 13

The password for groot13 is the owner of the Nine Realms folder on the desktop.

Get-ACL '.\Nine Realms' | Select-Object Owner

Password: airwolf

Groot 13 -> 14

The password for groot14 is the name of the Registered Owner of this system as depicted in the Registry PLUS the name of the file on the desktop.

Get-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\"

Password: utw_team_ned

Groot 14 -> 15

The password for groot15 is the description of the share whose name contains “task” in it PLUS the name of the file on the desktop.

Get-SmbShare

Password: scheduled_things_8