Trebek 10 -> 15

Trebek 10 -> 11

The password for trebek11 is the last name of the user who enabled Oni-Wan Kenobi’s account as depicted in the event logs on the desktop PLUS the name of the file on the desktop.

Get-WinEvent -Path .\security.evtx | Where-Object -Property Message -Match 'kenobi' | Format-List

Password: ackbar2121

Trebek 11 -> 12

The password for trebek12 is the username of the user who was created on 11 May 17 at 26 minutes after the hour, as depicted in the event logs on the desktop PLUS the name of the file on the desktop.

Get-WinEvent -Path .\security.evtx | Where-Object -Property Message -Match 'user account was created' | Format-List

Password: general.hux100

Very bad way of doing it, need to figure out the cmdlet

Trebek 12 -> 13

The password for trebek13 is the username of the user who created the user Lor San Tekka as depicted in the event logs on the desktop PLUS the name of the file on the desktop.

Get-WinEvent -Path .\security.evtx | Where-Object -Property Message -Match 'tekka' | Format-List

Password: poe.dameron53

Trebek 13 -> 14

The password for trebek14 is the last name of the user who has an encoded PowerShell command in their City property PLUS the name of the file on the desktop.

Get-ADUser -Filter * -Property city | Where-Object -Property City -ne $NULL

Password: prindel3003

Trebek 14 -> 15

The password for trebek15 is the output from decoding the PowerShell code found in the account properties of the user account from the previous level PLUS the name of the file on the desktop.

$EncodedText = 'agBvAGkAbgBfAHQAaABlAF8AcgBlAGIAZQBsAHMA'
$DecodedText = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($EncodedText))
$DecodedText

Password: join_the_rebels_today