> For the complete documentation index, see [llms.txt](https://rusyaidimazlan.gitbook.io/un/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rusyaidimazlan.gitbook.io/un/underthewire-century.md).

# UnderTheWire - Century

### Century 0 > 1

First, connect to century using ssh. The username and password for this level are given in the slack channel. 

![](/files/Z5JH0n3BE0kQk1a1gycL)

This level is cleared when the directory is now changed into 'C:\users\century1\desktop'

![](/files/mlZyDASEIx3BEIfdgBpJ)

### Century 1 > 2

To get the password, we need to check the Powershell version detail which include the build version. So the password for century2 is '10.0.14393.4583'

![](/files/E6UuX732SWIqB7BWktOS)

### Century 2 > 3

The wget alternative to powershell is Invoke-WebRequest. The file name in the desktop is '443'. So, by combining the two findings will give the password 'invoke-webrequest443'.

![](/files/KlK5Y7KfYWOOgK1abiGa)

### Century 3 > 4

Since the password is the number of files in the desktop, we can use Measure-Object to count the files exist.

![](/files/120Ldt6D1KKoU52plEBe)

### Century 4 > 5

The clue is a directory with spaces in its name. To find the directory, we can use Get-ChildItem -Directory to list out all directories. Then, we can use Where-Object to filter the name which contain spaces. From here, we found the 'Can You Open Me' directory.

![](/files/1cRke1b8vQRjH27rsb7c)

The file name inside this directory is 5548, which is the password.

![](/files/cSmz7fXzLwltFzYIkUfb)

### Century 5 > 6

Since we are logged in to the system, we can use Get-ADDomain on local computer to find the name of the domain.

![](/files/cEbIfJ6TPepRpEiFZnsT)

### Century 6 > 7

The password for the next level is the number of folders (read: directories) in the desktop. Similar to previous level, we can use Measure-Object.

![](/files/zUzbfT3IUQjdrh3Ftd8n)

### Century 7 > 8

The aim of this level is to find a readme file which located in the specific directories. We can use Get-ChildItem including file extension filter. Since most of readme file is .md file, we can filter only .md file.

![](/files/JW9wmuBRV1HmCvvmJAwR)

The output shows all .md file found from the server. Only 1 file found which match the level's hint. We found a readme.md file in \Downloads directory.

![](/files/2uEtKQAGfPzeVNDQNMfY)

Moving to the \Downloads directory give us 2 readme files. Reading the readme.txt shows the password for next level.

![](/files/b1JbLTDUkegQGo82SRhJ)

### Century 8 > 9

The password for this level is the number of entries in the .txt file. Opening the .txt shows the list of strings.

![](/files/icaWKzkQ0cuNgaySPZIH)

To find the number of entries, we can use .length method.

![](/files/oPnHEo2Fdl9Lw7B8gkV8)

Alternatively, we can use .count method which serves similar purpose.

![](/files/AeQiTxYFKktE8GImuDWf)

### Century 9 > 10

The content in Word\_File.txt is the words displayed in one line.

![](/files/Bmrb7YpOA62vvvF84zQ7)

Use split to load each word into an array.

![](/files/H2n8M7KYRV2EwBXu3ruP)

Then return the 160th entry (-1 as the array will start at zero).

![](/files/ohbQIXJgnvig095WX1vm)

### Century 10 > 11

The password is included in the Windows Update service description. So, first we check the services for the computer and it returns the long list.

![](/files/vURWUcPEHNA0fS4A0Nv0)

Next, we filter out the specific term we are looking for. In this case, we search for services with the word 'update'. Here we can see the windows update named 'wuauserv'.

![](/files/yU88iwocUWNfTGRouPRB)

Try using 'select' command but it returns nothing.

![](/files/6Z4RpjGE3XeDVhYLMBiT)

Since Get-Service returns a limited set of information, we can use Get-WmiObject to get more information.

![](/files/tM5OdpXtuUrrSyXZObzY)

From the description and the file name in desktop directory, we can get the password 'windowsupdates110'.

![](/files/8CK47UG09KZsmlrFd5ML)

### Century 11 > 12

The password for century12 is a hidden file in some specific directories listed. To find the hidden file, we can use Get-ChildItem (gci) with hidden attributes parameter. Since gci will go through all directories, an error is expected. So, I make sure to include 'ErrorAction' silent to hide error output.

![](/files/1DFhA3wFgSZ3V08w3nvs)

After that, we can see the only file in the right directory that match the hint. So, the password for century12 is secret\_sauce.

![](/files/E4tdpomZJ1Tn9IdUigHl)

### Century 12 > 13

We can start with the easier task by finding out the name of the file in the desktop.

![](/files/m7YS6CZNgk6lRB6HbCkB)

Next, we can use Get-ADDomainController to find the information about the domain controller. The information include the computer name, 'UTW'.

![](/files/i7kOtJwzLpSM80SRpQ53)

From the information gained, we can use Get-ADComputer to find the information of the specific Active Directory Computer. Combining both findings, we can get the password for century13, 'i\_authenticate\_things'.

![](/files/uHqyyKO1gf6sbg6JFoBH)

### Century 13 > 14

755

![](/files/79BcQENB2E0Mf827ssCW)

### Century 14 > 15

To get the password, first we can use delimiter paramater before using findstr command to detect every word 'polo'. Counting the polo words returns the password.

![](/files/J4ss8YS8NRfAv01fx8d2)

Alternatively, we can use select-string command with pattern and allmatches parameter to find the word polo.

![](/files/CSkUd5ztI4TKUucOaVJI)

### Century 15

Using the password obtained from century14, we can log into century15 which mark the end of the Century challenge. All the best!

![](/files/zCOj71Q23zFEnMWVW7gY)