UnderTheWire Cyborg Guide

Previous Level Guide: Cyborg Level 0 → 1

Access

SSH: ssh cyborg1@cyborg.underthewire.tech -p 22

Password: cyborg1

Info

The password for cyborg2 is the state that the user Chris Rogers is from as stated within Active Directory.

NOTE:
– The password will be lowercase no matter how it appears on the screen.
– “State” refers to the location within the country and NOT the “state” of the account (enabled/ disabled).

IMPORTANT:
Once you feel you have completed the Cyborg1 challenge, start a new connection to the server, and log in with the username of Cyborg2 and this password will be the answer from Cyborg1. If successful, close out the Cyborg1 connection and begin to solve the Cyborg2 challenge. This concept is repeated over and over until you reach the end of the game.


▼ HINT:
List the available modules, there may be a useful one available…

Theory

To get the password we'll use the session we entered in the previous level, and from there we could use the Get-ADUser since it's a simple way to get the info from a finding a user by filtering in the Active Directory. So we'll filter by giving the name Chris and the surname Rogers:

Get-ADUser -Filter 'GivenName -eq "Chris" -and Surname -eq "Rogers"'

Solution

Firstly we'll use the command now that we are inside the shell:

PS C:\users\cyborg1\desktop> Get-ADUser -Filter 'GivenName -eq "Chris" -and Surname -eq "Rogers"'

DistinguishedName : CN=Rogers\, Chris\ ,OU=T-65,OU=X-Wing,DC=underthewire,DC=tech
Enabled           : False
GivenName         : Chris
Name              : Rogers, Chris
ObjectClass       : user
ObjectGUID        : ee6450f8-cf70-4b1d-b902-a837839632bd
SamAccountName    : chris.rogers
SID               : S-1-5-21-758131494-606461608-3556270690-2177
Surname           : Rogers
UserPrincipalName : chris.rogers

Alright, the state doesn't seem to appear in the search, let's just include it as a property to make the search of the state mandatory:

PS C:\users\cyborg1\desktop> Get-ADUser -Filter 'GivenName -eq "Chris" -and Surname -eq "Rogers"' -Properties State

DistinguishedName : CN=Rogers\, Chris\ ,OU=T-65,OU=X-Wing,DC=underthewire,DC=tech
Enabled           : False
GivenName         : Chris
Name              : Rogers, Chris
ObjectClass       : user
ObjectGUID        : ee6450f8-cf70-4b1d-b902-a837839632bd
SamAccountName    : chris.rogers
SID               : S-1-5-21-758131494-606461608-3556270690-2177
State             : kansas
Surname           : Rogers
UserPrincipalName : chris.rogers

There we go, we got the state of that Chris Rogers user:

kansas

And that's the password! Now we should be good to go to the next level.