> For the complete documentation index, see [llms.txt](https://rusyaidimazlan.gitbook.io/un/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rusyaidimazlan.gitbook.io/un/underthewire-century.md).

# UnderTheWire - Century

### Century 0 > 1

First, connect to century using ssh. The username and password for this level are given in the slack channel. 

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FM5VTAXZF41WQdftiw19s%2Fimage.png?alt=media\&token=243cb720-5578-4f3b-a9b5-497cdfceb301)

This level is cleared when the directory is now changed into 'C:\users\century1\desktop'

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FZNbPNrQfJBctKxgzITdb%2Fimage.png?alt=media\&token=45d5fa3d-0c96-466f-bf11-5c299cf0c605)

### Century 1 > 2

To get the password, we need to check the Powershell version detail which include the build version. So the password for century2 is '10.0.14393.4583'

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FEe2k9JHpWaFeCveQdCUD%2Fimage.png?alt=media\&token=ab9fa3f4-a13d-4889-8662-8c018900c73d)

### Century 2 > 3

The wget alternative to powershell is Invoke-WebRequest. The file name in the desktop is '443'. So, by combining the two findings will give the password 'invoke-webrequest443'.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FH0xireclCfw4MyFzFt0v%2Fimage.png?alt=media\&token=0521aad7-ad99-486c-acf5-f19037d0d52a)

### Century 3 > 4

Since the password is the number of files in the desktop, we can use Measure-Object to count the files exist.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2F4Hc7YAcuIn9q0YIYoQD3%2Fimage.png?alt=media\&token=22567d35-19cf-4139-81fd-d95cc2429db5)

### Century 4 > 5

The clue is a directory with spaces in its name. To find the directory, we can use Get-ChildItem -Directory to list out all directories. Then, we can use Where-Object to filter the name which contain spaces. From here, we found the 'Can You Open Me' directory.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FbPyRLlsXxQtM3yEUadBr%2Fimage.png?alt=media\&token=4fd5cf80-7509-48cf-af6b-7c96119e7ead)

The file name inside this directory is 5548, which is the password.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2Frl4CShnhDkSAAWAlPPvH%2Fimage.png?alt=media\&token=8f519bb1-aeb8-45d5-88ee-e0ab657afb34)

### Century 5 > 6

Since we are logged in to the system, we can use Get-ADDomain on local computer to find the name of the domain.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FNaCAgFoW1czQXs5OK0cw%2Fimage.png?alt=media\&token=9121cd2f-c02a-404c-a967-7d4c2675456a)

### Century 6 > 7

The password for the next level is the number of folders (read: directories) in the desktop. Similar to previous level, we can use Measure-Object.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FElLBN21cDErLyzKXvQOE%2Fimage.png?alt=media\&token=29cd8ae5-4d78-4a95-b883-24693683ddc3)

### Century 7 > 8

The aim of this level is to find a readme file which located in the specific directories. We can use Get-ChildItem including file extension filter. Since most of readme file is .md file, we can filter only .md file.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FBcKBEM3yYb6Wgy7etdPn%2Fimage.png?alt=media\&token=9e0f72b6-4797-49bd-8cd7-72bebf787aca)

The output shows all .md file found from the server. Only 1 file found which match the level's hint. We found a readme.md file in \Downloads directory.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FbN010ZkDsRXUp0G7gkLR%2Fimage.png?alt=media\&token=3feefaa3-8819-4498-a63c-f85893de1743)

Moving to the \Downloads directory give us 2 readme files. Reading the readme.txt shows the password for next level.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FG9goCmxGvBBkkDcy8ex8%2Fimage.png?alt=media\&token=7f3b1e23-ab15-4155-98f7-43beb76cda5a)

### Century 8 > 9

The password for this level is the number of entries in the .txt file. Opening the .txt shows the list of strings.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FDJakJ3L5jq6djpjeQhJM%2Fimage.png?alt=media\&token=63e057d4-bfb1-44f7-912c-2e274fc0f914)

To find the number of entries, we can use .length method.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FROhEFX0t6oB1LP1eKl0U%2Fimage.png?alt=media\&token=6ccc8e3f-a270-429f-9372-6b0162c2146f)

Alternatively, we can use .count method which serves similar purpose.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FNZT70EBptB4hWc9efQuN%2Fimage.png?alt=media\&token=1309843c-c93c-49a1-bf37-19aa082aae26)

### Century 9 > 10

The content in Word\_File.txt is the words displayed in one line.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FgWSJ6aZ1WcHfEWswpDVd%2Fimage.png?alt=media\&token=172aef36-0ba8-4570-b2aa-e5d4f510904c)

Use split to load each word into an array.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2Fst8Z3pD2besvpPT2kLIQ%2Fimage.png?alt=media\&token=52c17c28-00bf-43f5-a439-161660eded10)

Then return the 160th entry (-1 as the array will start at zero).

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FGNGA1lvLm9u9rIgRXuqC%2Fimage.png?alt=media\&token=78b0ff7a-dda3-4b3c-8b08-474264c8ddd8)

### Century 10 > 11

The password is included in the Windows Update service description. So, first we check the services for the computer and it returns the long list.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FPApJWI4mRVSqE2upVq6t%2Fimage.png?alt=media\&token=8008df67-134e-4fad-a7f6-51a143475e2e)

Next, we filter out the specific term we are looking for. In this case, we search for services with the word 'update'. Here we can see the windows update named 'wuauserv'.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FxQ3nLa8j2pGXYOTRZau0%2Fimage.png?alt=media\&token=2ab6ab29-c2d5-4d8e-92f2-e0e2c4646073)

Try using 'select' command but it returns nothing.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FsG2jfZsjQWQrbfvAA3js%2Fimage.png?alt=media\&token=7b551639-0295-4031-ac42-a9ba3fc2e31f)

Since Get-Service returns a limited set of information, we can use Get-WmiObject to get more information.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2F0rIDJKl1xtof2zYWaFGG%2Fimage.png?alt=media\&token=d440e91d-756e-4adc-8f98-e8ae69719bee)

From the description and the file name in desktop directory, we can get the password 'windowsupdates110'.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2F2noLPeCTKsMzG2rMhiKl%2Fimage.png?alt=media\&token=1f05368f-3c3d-4298-a7fe-b99a74d67fd2)

### Century 11 > 12

The password for century12 is a hidden file in some specific directories listed. To find the hidden file, we can use Get-ChildItem (gci) with hidden attributes parameter. Since gci will go through all directories, an error is expected. So, I make sure to include 'ErrorAction' silent to hide error output.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FvuNfICrPUVi5bGD9zcdc%2Fimage.png?alt=media\&token=ff7ef5e7-9cfd-4f95-a9b7-bb1211f989cc)

After that, we can see the only file in the right directory that match the hint. So, the password for century12 is secret\_sauce.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FYNri2P3Wcu1U5Y6HGNK5%2Fimage.png?alt=media\&token=ae4b08e5-e6b4-4fad-b2e6-962a120b2836)

### Century 12 > 13

We can start with the easier task by finding out the name of the file in the desktop.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FQoLBadKMKtOGBSBOqxPT%2Fimage.png?alt=media\&token=9552c7b4-c980-4d40-bd27-52b7bde0beb2)

Next, we can use Get-ADDomainController to find the information about the domain controller. The information include the computer name, 'UTW'.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FuikQArk9Gx4sZjDqvdEc%2Fimage.png?alt=media\&token=0f5d76fc-3968-4e70-8cec-a698229367e6)

From the information gained, we can use Get-ADComputer to find the information of the specific Active Directory Computer. Combining both findings, we can get the password for century13, 'i\_authenticate\_things'.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FCXZtM7JzOs9OE354HhRG%2Fimage.png?alt=media\&token=353922a3-3a1e-4c1a-9e82-8b9ca886580d)

### Century 13 > 14

755

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FsAVCXXYsLLDnS7o5HfWV%2Fimage.png?alt=media\&token=f15c312f-12be-4328-9fa2-62148e17cf6f)

### Century 14 > 15

To get the password, first we can use delimiter paramater before using findstr command to detect every word 'polo'. Counting the polo words returns the password.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2Ft10PcUakfZdsLLDCmrU3%2Fimage.png?alt=media\&token=df912b98-7a92-4999-9acf-eb6c79e5e402)

Alternatively, we can use select-string command with pattern and allmatches parameter to find the word polo.

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FlMBxo1GwCrzZVzpESwas%2Fimage.png?alt=media\&token=c24b6beb-b827-4459-a224-91fda04ce652)

### Century 15

Using the password obtained from century14, we can log into century15 which mark the end of the Century challenge. All the best!

![](https://2008262815-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWiMKxxavwUXTWGa1fiRN%2Fuploads%2FI9Yvwnyh2P2BG2dYwfzt%2Fimage.png?alt=media\&token=c5e9622a-7917-407a-b52b-c34fbfc59513)