UnderTheWire Cyborg Guide

Previous Level Guide: Cyborg Level 3 → 4

Access

SSH: ssh cyborg4@cyborg.underthewire.tech -p 22

Password: 88_objects

Info

The password for cyborg5 is the PowerShell module name with a version number of 8.9.8.9 PLUS the name of the file on the desktop.

NOTE:
– If the module name is “bob” and the file on the desktop is called “_settings”, then the password is “bob_settings”.
– The password will be lowercase no matter how it appears on the screen.

▼HINT:
List the modules…

Theory

To get the password, we'll probably need a command to search for every availble module, which is pretty easy, we can just get all modules and use the available option to only see well, the available modules and then pipe it to a command to search where the version 8.9.8.9 is, to get the name of it. Then, finally of course, dir to get the second part of the flag:

dir
Get-Module -ListAvailable | Select-String "8.9.8.9"

Solution

Firstly we'll use the dir command now that we are inside the shell:

PS C:\users\cyborg4\desktop> dir


    Directory: C:\users\cyborg4\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018  10:45 AM              0 _eggs

Now let's get the module with version number 8.9.8.9:

PS C:\users\cyborg4\desktop> Get-Module -ListAvailable | Select-String "8.9.8.9"

Okay that's weird, I just listed all the modules and it seems to work, why's it blank? I'm gonna try and use where object to search for specifically the module that has the version attribute of 8.9.8.9:

PS C:\users\cyborg4\desktop> Get-Module -ListAvailable | Where-Object { $_.Version -like "*8.9.8.9*" }


    Directory: C:\Windows\system32\WindowsPowerShell\v1.0\Modules


ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Manifest   8.9.8.9    bacon                               Get-bacon

There we go! Now we can join the amount of this with the file name from before, and we get this:

bacon_eggs

And that's the password! Now we should be good to go to the next level.