UnderTheWire Cyborg Guide

Previous Level Guide: Cyborg Level 12 → 13

Access

SSH: ssh cyborg13@cyborg.underthewire.tech -p 22

Password: ywa6_heart

Info

The password cyborg14 is the number of days the refresh interval is set to for DNS aging for the underthewire.tech zone PLUS the name of the file on the desktop.

NOTE:
– If the days are set to “08:00:00:00” and the file on the desktop is called “_tuesday”, then the password is “8_tuesday”.
– The password will be lowercase no matter how it appears on the screen.

▼ HINT:
WMI or cmdlets… choices, choices.

Theory

To get the password, we need to find how many days of DNS aging the refresh interval has. So to find this, there's a command that matches this perfectly, dns server zone aging. The command is just to find the DNS aging of a zone, in our case, this is the UnderTheWire domain, so all we have to do is search for the domain in this command and that should be it. Also let's not forget to view the name of the file for the second half of the password:

dir
Get-DnsServerZoneAging -Name 'underthewire.tech'

Solution

Now that we are in the shell, first let's just get the name of the file in the desktop:

PS C:\users\cyborg13\desktop> dir


    Directory: C:\users\cyborg13\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018  10:45 AM              0 _days

Now let's enter that other command to get the DNS aging:

PS C:\users\cyborg13\desktop> Get-DnsServerZoneAging -Name 'underthewire.tech'


ZoneName             : underthewire.tech
AgingEnabled         : True
AvailForScavengeTime : 9/21/2018 10:00:00 AM
RefreshInterval      : 22.00:00:00
NoRefreshInterval    : 7.00:00:00
ScavengeServers      :

It seems like 22 days, but between all those zeros, dots, and colons, I really don't know what it is. So let's expand the refresh interval property:

PS C:\users\cyborg13\desktop> (Get-DnsServerZoneAging -Name 'underthewire.tech').RefreshInterval


Days              : 22
Hours             : 0
Minutes           : 0
Seconds           : 0
Milliseconds      : 0
Ticks             : 19008000000000
TotalDays         : 22
TotalHours        : 528
TotalMinutes      : 31680
TotalSeconds      : 1900800
TotalMilliseconds : 1900800000

Okay, perfect. Now that we know the amount of days for sure, we can join it with the name of the file, and we get this:

22_days

And that's the password! Now we should be good to go to the next level.