UnderTheWire Groot Guide

Previous Level Guide: Groot Level 7 → 8

Access

SSH: ssh groot8@groot.underthewire.tech -p 22

Password: srpapi_home

Info

The password for groot9 is the description of the firewall rule blocking MySQL PLUS the name of the file on the desktop.

NOTE:
– If the description of the rule is “blue” and the file on the desktop is named “_bob”, the password would be “blue_bob”.
– The password will be lowercase no matter how it appears on the screen.

Theory

To get the password, as the description says, we're told to find the description of whatever firewall is blocking MySQL. For that, all we have to do is get the firewall rules, and find which one has something containing MySQL. Then also of course, the dir command to get the other part of the password. And the commands are:

dir
Get-NetFirewallRule -Action Block | Where-Object {$_.DisplayName -like '*mysql*'}

Solution

Now that we are inside the shell, we can see what the second part of the command is with dir:

PS C:\users\Groot8\desktop> dir


    Directory: C:\users\Groot8\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018  10:51 AM              0 _starlord

We can now use the other command to see the description of the firewall for some reason against mysql:

PS C:\users\Groot8\desktop> Get-NetFirewallRule -Action Block | Where-Object {$_.DisplayName -like '*mysql*'}


Name                  : {8ce6b97d-5c1d-4347-a7fd-1792feb42355}
DisplayName           : MySQL
Description           : call_me
DisplayGroup          :
Group                 :
Enabled               : True
Profile               : Any
Platform              : {}
Direction             : Inbound
Action                : Block
EdgeTraversalPolicy   : Block
LooseSourceMapping    : False
LocalOnlyMapping      : False
Owner                 :
PrimaryStatus         : OK
Status                : The rule was parsed successfully from the store. (65536)
EnforcementStatus     : NotApplicable
PolicyStoreSource     : PersistentStore
PolicyStoreSourceType : Local

Okay, just grab the description and join it with the name of the file, and we get this:

call_me_starlord

And that's the password! Now we should be good to go to the next level.