SSH Client

If you're running Windows 11 — the latest version of Windows at the time of writing — then, you already have access to the Windows Terminal app. If for some reason you do not, I recommend installing it, as you really don't need Putty to complete these exercises.

Windows Terminal - Free download and install on Windows | Microsoft Store

The Windows Terminal is a modern, fast, efficient, powerful, and productive terminal application for users of command-line tools and shells like Command Prompt, PowerShell, and WSL. Its main features include multiple tabs, panes, Unicode and UTF-8 character support, a GPU accelerated text rendering engine, and custom themes, styles, and configurations. This is an open source project and we welcome community participation. To participate please visit https://github.com/microsoft/terminal

Microsoft Store - Download apps, games & more for your Windows PCMicrosoft Corporation

Also, in most recent versions of Windows, the ssh.exe client and related binaries should already be installed and ready for use. Below, I've provided some examples of the most basic SSH syntax for connecting to the challenges.

ssh username@127.0.0.1

ssh username@domain.tld

Oracle 0 -> 1

ssh -o 'StrictHostKeyChecking=no' oracle1@oracle.underthewire.tech

Oracle 1 -> 2

The password for oracle2 is the timezone in which this system is set to.

Get-TimeZone

(Get-TimeZone).Id.ToLower()

utc

exit

Oracle 2 -> 3

The password for oracle3 is the last five digits of the MD5 hash, from the hashes of files on the desktop that appears twice.

ssh oracle2@oracle.underthewire.tech

Get-ChildItem -File | Get-FileHash -Algorithm MD5 | Sort-Object Hash

# Sort and store all MD5 hashes in a variable
$allHashes = Get-ChildItem -File | 
  Get-FileHash -Algorithm MD5 | 
  Sort-Object Hash | 
  Select-Object -ExpandProperty Hash

# Pipe to Where-Object
# Get the current index o
$allHashes | Where-Object {$allHashes[$($allHashes.IndexOf($_))] -eq $allHashes[$($allHashes.IndexOf($_) + 1)]}

# Store the duplicate hashes in a variable
$duplicates = $allHashes | Where-Object {$allHashes[$($allHashes.IndexOf($_))] -eq $allHashes[$($allHashes.IndexOf($_) + 1)]}
# Select one of the two matches
$firstMatch = $duplicates[0]
# Output the last 5 characters to lowercase
$firstMatch.Substring(($firstMatch.Length - 5), 5).ToLower()

$allHashes = Get-ChildItem -File | Get-FileHash -Algorithm MD5 | Sort-Object Hash | Select-Object -ExpandProperty Hash ; $allHashes = Get-ChildItem -File | Get-FileHash -Algorithm MD5 | Sort-Object Hash | Select-Object -ExpandProperty Hash ; $duplicates = $allHashes | Where-Object {$allHashes[$($allHashes.IndexOf($_))] -eq $allHashes[$($allHashes.IndexOf($_) + 1)]} ; $firstMatch = $duplicates[0] ; $firstMatch.Substring(($firstMatch.Length - 5), 5).ToLower()

2f5c4

exit

Oracle 3 -> 4

The password for oracle4 is the date that the system logs were last wiped as depicted in the event logs on the desktop.

ssh oracle3@oracle.underthewire.tech

Get-WinEvent -Path .\Oracle3_Security.evtx

Get-WinEvent -Path .\Oracle3_Security.evtx | Where-Object {$_.Message -like '*clear*'}

(Get-WinEvent -Path .\Oracle3_Security.evtx | Where-Object {$_.Message -like '*clear*'}).TimeCreated.ToString('MM/dd/yyyy')

05/09/2017

exit

Oracle 4 -> 5

The password for oracle5 is the name of the GPO that was last created PLUS the name of the file on the user’s desktop.

ssh oracle4@oracle.underthewire.tech

Get-GPO -All

Get-GPO -All | Sort-Object CreationTime -Descending | Select-Object -First 1

(Get-GPO -All | Sort-Object CreationTime -Descending | Select-Object -First 1).DisplayName.ToLower() + (ls -File).Name.ToLower()

alpha83

exit

Oracle 5 -> 6

The password for oracle6 is the name of the GPO that contains a description of “I_AM_GROOT” PLUS the name of the file on the user’s desktop.

ssh oracle5@oracle.underthewire.tech

Get-GPO -All | Where-Object {$_.Description -eq 'I_AM_GROOT'}

(Get-GPO -All | Where-Object {$_.Description -eq 'I_AM_GROOT'}).DisplayName.ToLower() + (ls -File).Name.ToLower()

charlie1337

exit

Oracle 6 -> 7

The password for oracle7 is the name of the OU that doesn’t have a GPO linked to it PLUS the name of the file on the user’s desktop.

ssh oracle6@oracle.underthewire.tech

Get-ADOrganizationalUnit -Filter 'Name -notlike "Groups"' -Properties * | Get-Member

(Get-ADOrganizationalUnit -Filter 'Name -notlike "Groups"' -Properties * | Where-Object {-not $_.gPLink}).Name

(Get-ADOrganizationalUnit -Filter 'Name -notlike "Groups"' -Properties * | Where-Object {-not $_.gPLink}).Name.ToLower() + (ls -File).Name

t-50_97

exit

Oracle 7 -> 8

The password for oracle8 is the name of the domain that a trust is built with PLUS the name of the file on the user’s desktop.

ssh oracle7@oracle.underthewire.tech

Get-ADTrust -Filter *

(Get-ADTrust -Filter *).Name.ToLower() + (ls -File).Name.ToLower()

multiverse111

exit

Oracle 8 -> 9

The password for oracle9 is the name of the file in the GET Request from www.guardian.galaxy.com within the log file on the desktop.

ssh oracle8@oracle.underthewire.tech

(cat .\logs.txt | Select-String 'guardian.galaxy.com').ToString()

(cat .\logs.txt | Select-String 'guardian.galaxy.com').ToString().Split('/')[4].Split('\.')[0].ToLower()

I'll explain in a series of bullet points:

• Using the / character as a delimiter to split on, this means any / in the string, so.
  • Index 0 would be 28
  • Index 1 would be Jul
  • Index 2 would be 1995:13:03:55 -0400] "GET
  • And so on... but we select index 4 — star-lord.gif HTTP/1.0" 200 786
• Then we split on any . in that substring and choose index 0 which is star-lord.
• We don't really need .ToLower() there, but adding it for good form to ensure we meet the requirements

star-lord

exit

Oracle 9 -> 10

The password for oracle10 is the computer name of the DNS record of the mail server listed in the UnderTheWire.tech zone PLUS the name of the file on the user’s desktop.

ssh oracle9@oracle.underthewire.tech

Get-Command Get-*dns*

Get-DnsServerResourceRecord -ZoneName 'underthewire.tech'

(Get-DnsServerResourceRecord -ZoneName 'underthewire.tech' -RRType MX).HostName.ToLower() + (ls -File).Name.ToLower()

utw_exch9229

exit

Oracle 10 -> 11

The password for oracle11 is the .biz site the user has previously navigated to.

ssh oracle10@oracle.underthewire.tech

Typed URLs Blog

Get-Item 'HKCU:\Software\Microsoft\Internet Explorer\TypedURLs'

(Get-Item 'HKCU:\Software\Microsoft\Internet Explorer\TypedURLs' | Get-ItemProperty).url6.Split('/')[2].Split('\.')[0]

yondu

exit

Oracle 11 -> 12

The password for oracle12 is the drive letter associated with the mapped drive that this user has.

ssh oracle11@oracle.underthewire.tech

Get-SmbMapping

(Get-SmbMapping).LocalPath.Split(':')[0].ToLower()

m

exit

Oracle 12 -> 13

The password for oracle13 is the IP of the system that this user has previously established a remote desktop with.

ssh oracle12@oracle.underthewire.tech

Get-ChildItem 'HKCU:\Software\Microsoft\Terminal Server Client'

Get-ChildItem 'HKCU:\Software\Microsoft\Terminal Server Client' | Get-ItemProperty | Select-Object -ExpandProperty PSChildName

192.168.2.3

exit

Oracle 13 -> 14

The password for oracle14 is the name of the user who created the Galaxy security group as depicted in the event logs on the desktop PLUS the name of the text file on the user’s desktop.

ssh oracle13@oracle.underthewire.tech

Get-WinEvent -Path .\security.evtx | Where-Object {$_.Message -like '*group*created*'}

Get-WinEvent -Path .\security.evtx | Where-Object {$_.Message -like '*group*created*'} | Select-Object -ExpandProperty Message

(((Get-WinEvent -Path .\security.evtx | Where-Object {$_.Message -like '*group*created*'}).Message[0].Split("`n") -match '^\s+Account Name*').Split(':')[1] -replace '\s').ToLower() + (ls -Exclude '*evtx').Name.ToLower()

I'll explain the command in a series of bullet points:

• Work your way inside-out from the innermost enclosure
• That would be the Get-WinEvent -Path .\security.evtx | Where-Object {$_.Message -like '*group*created*'}.
  • Then we wrap in parentheses and select the .Message property
    • Index 0 — which is the first message as identified before
    • Then .Split("`n") because we want to split the blob of text into individual lines to filter
    • Then, we -match on the Account Name line and split on : and choose index 1 — which is the username
    • Finally, we -replace '\s' to remove any whitespace
• Lastly, we concatenate + on the file name that does not end in .evtx
• And, we ensure everything is lowercase

gamora88

exit

Oracle 14 -> 15

The password for oracle15 is the name of the user who added the user Bereet to the Galaxy security group as depicted in the event logs on the desktop PLUS the name of the text file on the user’s desktop.

ssh oracle14@oracle.underthewire.tech

Get-WinEvent -Path .\security.evtx | Where-Object {$_.Message -like '*added*to*group*'}

$evt = Get-WinEvent -Path .\security.evtx | Where-Object {$_.Message -like '*added*to*group*'}

$messages = $evt.Message

$targetEvent = $messages | Where-Object {$_.Split("`n") -like '*bereet*'}

($targetEvent.Split("`n") -match '^\s+Account Name:' -notlike '*bereet*' -split ':' -replace '\s')[1].ToLower() + (ls -Exclude '*.evtx').Name.ToLower()

exit