SSH Client

If you're running Windows 11 — the latest version of Windows at the time of writing — then, you already have access to the Windows Terminal app. If for some reason you do not, I recommend installing it, as you really don't need Putty to complete these exercises.

Windows Terminal - Free download and install on Windows | Microsoft Store

The Windows Terminal is a modern, fast, efficient, powerful, and productive terminal application for users of command-line tools and shells like Command Prompt, PowerShell, and WSL. Its main features include multiple tabs, panes, Unicode and UTF-8 character support, a GPU accelerated text rendering engine, and custom themes, styles, and configurations. This is an open source project and we welcome community participation. To participate please visit https://github.com/microsoft/terminal

Microsoft Store - Download apps, games & more for your Windows PCMicrosoft Corporation

Also, in most recent versions of Windows, the ssh.exe client and related binaries should already be installed and ready for use. Below, I've provided some examples of the most basic SSH syntax for connecting to the challenges.

ssh username@127.0.0.1

ssh username@domain.tld

Trebek 0 -> 1

ssh -o 'StrictHostKeyChecking=no' trebek1@trebek.underthewire.tech

Trebek 1 -> 2

The password for trebek2 is the name of the script referenced in a deleted task as depicted in the event logs on the desktop.

To make efficient use of the -FilterXPath parameter, the best course of action is to search for the event ID that is generated when deleting a scheduled task.

4699(S) A scheduled task was deleted. - Windows 10

Describes security event 4699(S) A scheduled task was deleted. This event is generated every time a scheduled task is deleted.

Microsoft Learnvinaypamnani-msft

$evt = Get-WinEvent -Path .\security.evtx -FilterXPath "*[System[EventID=4699]]"

$evt.Message

$evt[-1].Message.Split("`n")

$evt[-1].Message.Split("`n")[-12]

[xml]$evt[-1].Message.Split("`n")[-12]

([xml]$evt[-1].Message.Split("`n")[-12]).Arguments.Split('\\')[-1].Split('\.')[0].ToLower()

mess_cleaner

exit

Trebek 2 -> 3

The password for trebek3 is the name of the executable associated with the C-3PO service PLUS the name of the file on the user’s desktop.

ssh trebek2@trebek.underthewire.tech

Get-CimInstance Win32_Service -Filter 'Name like "C-3PO"' | Select-Object *

(Get-CimInstance Win32_Service -Filter 'Name like "C-3PO"').PathName.Split("\\")[-1].Split("\.")[0].ToLower() + (ls -File).Name.ToLower()

droid823

exit

Trebek 3 -> 4

The password for trebek4 is the IP that the user Yoda last logged in from as depicted in the event logs on the desktop PLUS the name of the text file on the user’s desktop.

ssh trebek3@trebek.underthewire.tech

Windows Security Log Event ID 4624 - An account was successfully logged on

An account was successfully logged on

$evt = Get-WinEvent -Path .\security.evtx -FilterXPath "*[System[(EventID=4624)]] and *[EventData[Data[@Name='TargetUserName'] and (Data='Yoda')]]"

The events appear to be sorted by TimeCreated with the most recent event at the top of the list.

$evt[0].Message.Split("`n")

$evt[0].Message.Split("`n")[25].Split(':')[-1]

$evt[0].Message.Split("`n")[25].Split(':')[-1].Trim()

$evt[0].Message.Split("`n")[25].Split(':')[-1].Trim() + (ls -Exclude '*.evtx').Name.ToLower()

10.30.1.18address

exit

Trebek 4 -> 5

The password for trebek5 is the last execution date of Microsoft Access PLUS the name of the text file on the user’s desktop.

ssh trebek4@trebek.underthewire.tech

Get-ChildItem "C:\Windows\Prefetch" -Filter '*access*'

(Get-ChildItem "C:\Windows\Prefetch" -Filter '*access*').LastAccessTime.ToString('MM/dd/yyyy') + (ls -File).Name.ToLower()

01/05/2017_red

exit

Trebek 5 -> 6

The password for trebek6 is the name of the executable that is starting at 3/23/2017 8:08:53 PM via the Software Protection service as depicted in the event log on the desktop.

ssh trebek5@trebek.underthewire.tech

Google Search

Event ID 8208, 8200, or 900 - Windows Server

Discusses that you see event ID 8200, 8208, or 900 in Windows Server. Provides a resolution.

Microsoft LearnDeland-Han

Redirecting

Seems like the event IDs we want to target are going to be:

• 900
• 16384
• 16394

$evt = Get-WinEvent -Path .\application.evtx -FilterXPath "*[System[(EventID=900)]] or *[System[(EventID=16384)]] or *[System[(EventID=16394)]]"

$evt.Where({$_.TimeCreated -eq (Get-Date '3/23/2017 8:08:53 PM')})

$evt.Where({$_.TimeCreated -eq (Get-Date '3/23/2017 8:08:53 PM')}).Message.Split("`n")[-1].Split('=')[1].Split('\.')[0]

wlms

exit

Trebek 6 -> 7

The password for trebek7 is the total number of DLLs within the “C:\program files\adobe\” folder and it’s subfolders PLUS the name of the file on the desktop.

ssh trebek6@trebek.underthewire.tech

(Get-ChildItem -Recurse -Filter '*.dll' 'C:\program files\adobe\').Count.ToString() + (ls -File).Name.ToLower()

40_reader

exit

Trebek 7 -> 8

The password for trebek8 is the name of the program set to run prior to login if sticky keys are activated PLUS the name of the file on the desktop.

ssh trebek7@trebek.underthewire.tech

Get-Item 'HKCU:\Control Panel\Accessibility\StickyKeys'

Get-Item 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe' | Get-ItemProperty

(Get-Item 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe' | Get-ItemProperty).Debugger.Split("\.")[0] + (ls -File).Name.ToString()

han_solo99

exit

Trebek 8 -> 9

The password for trebek9 the first 8 bytes of the file located on the desktop. Combine the answer together with NO spaces.

ssh trebek8@trebek.underthewire.tech

-join[System.IO.File]::ReadAllBytes((ls .\Clone_Trooper_data.pdf).FullName)[0..7]

779014403000

exit

Trebek 9 -> 10

The password for trebek10 is the name of the potentially rogue share on the system PLUS the name of the file on the desktop.

ssh trebek9@trebek.underthewire.tech

Get-SmbShare

(Get-SmbShare -Name 'shoretroopers$').Name.ToLower() + (ls -File).Name.ToLower()

shoretroopers$_hiding

exit

Trebek 10 -> 11

The password for trebek11 is the last name of the user who enabled Obi-Wan Kenobi’s account as depicted in the event logs on the desktop PLUS the name of the file on the desktop.

ssh trebek10@trebek.underthewire.tech

4722(S) A user account was enabled. - Windows 10

Describes security event 4722(S) A user account was enabled. This event is generated when a user or computer object is enabled.

Microsoft Learnvinaypamnani-msft

$evt = Get-WinEvent -Path .\security.evtx -FilterXPath "*[System[EventID=4722]]"

$evt.Where({$_.Message -like '*obi*'})

$evt.Where({$_.Message -like '*obi*'}).Message.Split("`n")[4]

$evt.Where({$_.Message -like '*obi*'}).Message.Split("`n")[4].Split(":")[1].Trim().Split("\.")[1]

$evt.Where({$_.Message -like '*obi*'}).Message.Split("`n")[4].Split(":")[1].Trim().Split("\.")[1].ToLower() + (ls -Exclude '*.evtx').Name.ToLower()

ackbar2121

exit

Trebek 11 -> 12

The password for trebek12 is the username of the user who was created on 11 May 17 at 26 minutes after the hour, as depicted in the event logs on the desktop PLUS the name of the file on the desktop.

ssh trebek11@trebek.underthewire.tech

4720(S) A user account was created. - Windows 10

Describes security event 4720(S) A user account was created. This event is generated a user object is created.

Microsoft Learnvinaypamnani-msft

$evt = Get-WinEvent -Path .\security.evtx -FilterXPath "*[System[EventID=4720]]"

$evt.Where({$_.TimeCreated.Day -eq 11 -and $_.TimeCreated.Minute -eq 26})

$evt.Where({$_.TimeCreated.Day -eq 11 -and $_.TimeCreated.Minute -eq 26}).Message

$evt.Where({$_.TimeCreated.Day -eq 11 -and $_.TimeCreated.Minute -eq 26}).Message.Split("`n")[10].Split(":")[1].Trim()

$evt.Where({$_.TimeCreated.Day -eq 11 -and $_.TimeCreated.Minute -eq 26}).Message.Split("`n")[10].Split(":")[1].Trim().ToLower() + (ls -Exclude '*.evtx').Name.ToLower()

general.hux100

exit

Trebek 12 -> 13

The password for trebek13 is the username of the user who created the user Lor San Tekka as depicted in the event logs on the desktop PLUS the name of the file on the desktop.

ssh trebek12@trebek.underthewire.tech

$evt = Get-WinEvent -Path .\security.evtx -FilterXPath "*[System[EventID=4720]]"

$evt.Where({$_.Message -like '*Lor*'})

$evt.Where({$_.Message -like '*Lor*'}).Message

$evt.Where({$_.Message -like '*Lor*'}).Message.Split("`n")[4]

$evt.Where({$_.Message -like '*Lor*'}).Message.Split("`n")[4].Split(":")[1].Trim().ToLower() + (ls -Exclude '*.evtx').Name.ToLower()

poe.dameron53

exit

Trebek 13 -> 14

The password for trebek14 is the last name of the user who has an encoded PowerShell command in their City property PLUS the name of the file on the desktop.

ssh trebek13@trebek.underthewire.tech

Get-ADUser -Filter * -Properties City

(Get-ADUser -Filter * -Properties City).Where({$_.City})

(Get-ADUser -Filter * -Properties City).Where({$_.City}).Surname.ToLower() + (ls -File).Name.ToLower()

prindel3003

exit

Trebek 14 -> 15

The password for trebek15 is the output from decoding the PowerShell code found in the account properties of the user account from the previous level PLUS the name of the file on the desktop.

ssh trebek14@trebek.underthewire.tech

The process to convert a base64 string back to UTF-8 data is effectively:

1. Convert the base64 string back to raw bytes
2. Encode the raw bytes as UTF-8 characters

(Get-ADUser -Filter * -Properties City).Where({$_.City}).City.ForEach({[Convert]::FromBase64String($_)})

(Get-ADUser -Filter * -Properties City).Where({$_.City}).City.ForEach({[Convert]::FromBase64String($_).Where({$_ -ne 0A})})

(Get-ADUser -Filter * -Properties City).Where({$_.City}).City.ForEach({[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($_).Where({$_ -ne 0}))}).ToLower() + (ls -File).Name.ToLower()

What we've done here is wrap the [Convert]::FromBase64String($_).Where({$_ -ne 0}) inside of [System.Text.Encoding]::UTF8.GetString()

$targetFile = Get-ChildItem -File -Path 'C:\users\trebek14\desktop'
$userWithCity = Get-ADUser -Filter * -Properties City | Where-Object {$_.City}
$base64String = $userWithCity.City
$base64ToBytes = [Convert]::FromBase64String($base64String) | Where-Object {$_ -ne 0}
$bytesToUTF8String = [System.Text.Encoding]::UTF8.GetString($base64ToBytes)
$bytesToUTF8String.ToLower() + $targetFile.Name.ToLower()

exit