SSH Client

If you're running Windows 11 — the latest version of Windows at the time of writing — then, you already have access to the Windows Terminal app. If for some reason you do not, I recommend installing it, as you really don't need Putty to complete these exercises.

Windows Terminal - Free download and install on Windows | Microsoft Store

The Windows Terminal is a modern, fast, efficient, powerful, and productive terminal application for users of command-line tools and shells like Command Prompt, PowerShell, and WSL. Its main features include multiple tabs, panes, Unicode and UTF-8 character support, a GPU accelerated text rendering engine, and custom themes, styles, and configurations. This is an open source project and we welcome community participation. To participate please visit https://github.com/microsoft/terminal

Microsoft Store - Download apps, games & more for your Windows PCMicrosoft Corporation

Also, in most recent versions of Windows, the ssh.exe client and related binaries should already be installed and ready for use. Below, I've provided some examples of the most basic SSH syntax for connecting to the challenges.

ssh username@127.0.0.1

ssh username@domain.tld

Cyborg 0 -> 1

ssh -o 'StrictHostKeyChecking=no' cyborg1@cyborg.underthewire.tech

Cyborg 1 -> 2

The password for cyborg2 is the state that the user Chris Rogers is from as stated within Active Directory.

Get-ADUser -Filter 'GivenName -eq "Chris" -and Surname -eq "Rogers"' -Properties State | Select-Object State

kansas

exit

Cyborg 2 -> 3

The password for cyborg3 is the host A record IP address for CYBORG718W100N PLUS the name of the file on the desktop.

ssh cyborg2@cyborg.underthewire.tech

Resolve-DnsName 'CYBORG718W100N'

(Resolve-DnsName 'CYBORG718W100N').IPAddress.ToString() + (Get-ChildItem -File).Name

172.31.45.167_ipv4

exit

Cyborg 3 -> 4

The password for cyborg4 is the number of users in the Cyborg group within Active Directory PLUS the name of the file on the desktop.

ssh cyborg3@cyborg.underthewire.tech

Get-ADGroup -Filter 'Name -like "Cyborg"'

Get-ADGroup -Filter 'Name -like "Cyborg"' | Get-ADGroupMember

(Get-ADGroup -Filter 'Name -like "Cyborg"' | Get-ADGroupMember).Count.ToString() + (gci -File).Name

88_objects

exit

Cyborg 4 -> 5

The password for cyborg5 is the PowerShell module name with a version number of 8.9.8.9 PLUS the name of the file on the desktop.

ssh cyborg4@cyborg.underthewire.tech

Get-Module -ListAvailable | Where-Object {$_.Version -like '8.9.8.9'}

(Get-Module -ListAvailable | Where-Object {$_.Version -like '8.9.8.9'}).Name + (ls -File).Name

bacon_eggs

exit

Cyborg 5 -> 6

The password for cyborg6 is the last name of the user who has logon hours set on their account PLUS the name of the file on the desktop.

ssh cyborg5@cyborg.underthewire.tech

$allADUsers = Get-ADUser -Filter * -Properties *

$allADUsers | Get-Member -Name '*hours*'

$allADUsers | Where-Object {$_.logonHours} | Select Surname, logonHours

($allADUsers | Where-Object {$_.logonHours -and $_.Surname}).Surname.ToLower() + (ls -File).Name

rowray_timer

exit

Cyborg 6 -> 7

The password for cyborg7 is the decoded text of the string within the file on the desktop.

ssh cyborg6@cyborg.underthewire.tech

PSToolbox/Public/ps1/ConvertFrom-Base64.ps1 at master · 0xBEN/PSToolbox

PowerShell module containing a set of generally useful tools. - 0xBEN/PSToolbox

GitHub0xBEN

$base64Text = cat .\cypher.txt

$base64ToBytes = [System.Convert]::FromBase64String($base64Text)

$decodedText = [System.Text.Encoding]::UTF8.GetString($base64ToBytes)

$base64ToBytes = $base64ToBytes | Where-Object {$_ -ne 0}

cybergeddon

exit

Cyborg 7 -> 8

The password for cyborg8 is the executable name of a program that will start automatically when cyborg7 logs in.

ssh cyborg7@cyborg.underthewire.tech

Get-CimInstance Win32_StartupCommand

skynet

exit

Cyborg 8 -> 9

The password for cyborg9 is the Internet zone that the picture on the desktop was downloaded from.

ssh cyborg8@cyborg.underthewire.tech

PowerShell: Find File ... | 0xBEN | Notes

# Recursively search current user’s Downloads directory Get-ChildItem -Recurse -File ”$env:UserProf…

0xBEN | Notes

Get-ChildItem -File | ForEach-Object {

  $file = $_
  # Get all data streams of the file
  $item = Get-Item $file.FullName -Stream *
  if ($item.Stream -contains 'Zone.Identifier') {
    # If the Zone.Identifier stream is present
    # Value  Setting
    # ------------------------------
    # 0      My Computer
    # 1      Local Intranet Zone
    # 2      Trusted sites Zone
    # 3      Internet Zone
    # 4      Restricted Sites Zone
    $streamContents = Get-Content -Raw -Stream 'Zone.Identifier' $item.FileName
    $streamContents = $streamContents.Split("`n")
    $zoneId = $streamContents[1].Split('=')[1] -replace '\s'
    
    if ($zoneId -in @('1','2','3','4')) {
    
      $hostUrl = $streamContents | Where-Object {$_ -match '^HostUrl'}
      $referrerUrl = $streamContents | Where-Object {$_ -match '^ReferrerUrl'}
      if ($hostUrl) { $hostUrl = $hostUrl.Split('=')[1] }
      if ($referrerUrl) { $referrerUrl = $referrerUrl.Split('=')[1] }
     
      [PSCustomObject]@{
        'ZoneId' = $zoneId
        'FileName' = $file.FullName
        'DownloadUrl' = $hostUrl
        'ReferrerUrl' = $referrerUrl
      }
      
    }
    
  }
  
} | Format-List *

4

exit

Cyborg 9 -> 10

The password for cyborg10 is the first name of the user with the phone number of 876-5309 listed in Active Directory PLUS the name of the file on the desktop.

ssh cyborg9@cyborg.underthewire.tech

$allADUsers = Get-ADUser -Filter * -Properties *

$allADUsers | Select-Object GivenName, *Phone | Select-String '876-5309'

$phoneProperties = $allADUsers | Get-Member -Name '*phone' | Select-Object -ExpandProperty Name

$phoneProperties | ForEach-Object {$phoneProp = $_ ; $allADUsers | Where-Object {$_.$phoneProp -eq '876-5309'}} | Select-Object GivenName

I'll explain this command in a series of bullet points:

• Go one-by-one — ForEach-Object — through the list of phone properties used in AD user objects:
  • HomePhone
  • MobilePhone
  • OfficePhone
• Then, use Where-Object on $allADUsers to see...
  • Is 876-5309 in the HomePhone property?
  • Is 876-5309 in the MobilePhone property?
  • Is 876-5309 in the OfficePhone property?
• If any of these are true, then the user is returned in the output
• Finally, select the user's first name

($phoneProperties | ForEach-Object {$phoneProp = $_ ; $allADUsers | Where-Object {$_.$phoneProp -eq '876-5309'}}).GivenName.ToLower() + (ls -File).Name

onita99

exit

Cyborg 10 -> 11

The password for cyborg11 is the description of the Applocker Executable deny policy for ill_be_back.exe PLUS the name of the file on the desktop.

ssh cyborg10@cyborg.underthewire.tech

Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

(Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections).Description + (ls -File).Name

terminated!99

exit

Cyborg 11 -> 12

The password for cyborg12 is located in the IIS log. The password is not Mozilla or Opera.

ssh cyborg11@cyborg.underthewire.tech

ls C:\inetpub\logs -Recurse -File | Select-Object FullName

cat C:\inetpub\logs\logfiles\w3svc1\u_ex160413.log | Where-Object {$_ -notlike '*mozilla*' -and $_ -notlike '*opera*'}

spaceballs

exit

Cyborg 12 -> 13

The password for cyborg13 is the first four characters of the base64 encoded full path to the file that started the i_heart_robots service PLUS the name of the file on the desktop.

ssh cyborg12@cyborg.underthewire.tech

Get-CimInstance win32_service -Filter 'Name like "i_heart_robots"'

-join[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes((Get-CimInstance win32_service -Filter 'Name like "i_heart_robots"').PathName)).ToLower()[0..3] + (ls -File).Name

I'll explain the one-liner in series of bullet points:

• We work our way inside-out of any brackets or enclosings
• The inner-most enclosing is (Get-CimInstance win32_service -Filter 'Name like "i_heart_robots"').PathName — so get the path to the binary started by the service
• The next enclosing is [System.Text.Encoding]::Unicode.GetBytes() which converts the PathName output to Unicode bytes
• The final enclosing is [Convert]::ToBase64String() which converts the Unicode bytes to a base64 string
• We then use the .ToLower() method on the string to convert it to lowercase and select the first four characters [0..3]
• Finally, we -join the character array back into a single string and + concatenate with the file name

ywa6_heart

exit

Cyborg 13 -> 14

The password cyborg14 is the number of days the refresh interval is set to for DNS aging for the underthewire.tech zone PLUS the name of the file on the desktop.

ssh cyborg13@cyborg.underthewire.tech

Get-Command 'Get-*Dns*'

(Get-DnsServerZoneAging -Name 'underthewire.tech').RefreshInterval.TotalDays.ToString() + (gci -File).Name

22_days

exit

Cyborg 14 -> 15

The password for cyborg15 is the caption for the DCOM application setting for application ID {59B8AFA0-229E-46D9-B980-DDA2C817EC7E} PLUS the name of the file on the desktop.

ssh cyborg14@cyborg.underthewire.tech

Get-CimClass -ClassName *dcom*

Get-CimInstance -ClassName Win32_DCOMApplication -Filter 'AppID like "%59B8AFA0-229E-46D9-B980-DDA2C817EC7E%"' | Select-Object *

(Get-CimInstance -ClassName Win32_DCOMApplication -Filter 'AppID like "%59B8AFA0-229E-46D9-B980-DDA2C817EC7E%"').Caption + (ls -File).Name

propshts_objects

exit