UnderTheWire Cyborg Guide

Previous Level Guide: Cyborg Level 7 → 8

Access

SSH: ssh cyborg8@cyborg.underthewire.tech -p 22

Password: skynet

Info

The password for cyborg9 is the Internet zone that the picture on the desktop was downloaded from.

NOTE:
– The password will be lowercase no matter how it appears on the screen.

▼ HINT:
Alternate NTFS data streams contain valuable information. Get information for the item with appropriate parameter to solve this level.

Theory

To get the password, I guess we could just use the get item command and the info in whatever there is in the stream of the file like the hint says. Also the dir command to know the name of the file for the other command, then if it's not there in the stream info, we'll look deeper into it, although I don't really know right now so let's go enter to the shell:

dir
Get-Item file.yay -Stream *

Solution

Now that we are in the shell, first of all, look at the name of the file for the other commands:

PS C:\users\cyborg8\desktop> dir


    Directory: C:\users\cyborg8\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018  10:45 AM          60113 1_qs5nwlcl7f_-SwNlQvOrAw.png

Now that we have the file, let's see if the zone is listed on the stream:

PS C:\users\cyborg8\desktop> Get-Item 1_qs5nwlcl7f_-SwNlQvOrAw.png -Stream *


PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\users\cyborg8\desktop\1_qs5nwlcl7f_-SwNlQvOrAw.png::$DATA
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\users\cyborg8\desktop
PSChildName   : 1_qs5nwlcl7f_-SwNlQvOrAw.png::$DATA
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\users\cyborg8\desktop\1_qs5nwlcl7f_-SwNlQvOrAw.png
Stream        : :$DATA
Length        : 60113

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\users\cyborg8\desktop\1_qs5nwlcl7f_-SwNlQvOrAw.png:Zone.Identifier
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\users\cyborg8\desktop
PSChildName   : 1_qs5nwlcl7f_-SwNlQvOrAw.png:Zone.Identifier
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\users\cyborg8\desktop\1_qs5nwlcl7f_-SwNlQvOrAw.png
Stream        : Zone.Identifier
Length        : 26

Now we can check for that zone identifier, so let's try searching for it or the where object command:

PS C:\users\cyborg8\desktop> Get-Item 1_qs5nwlcl7f_-SwNlQvOrAw.png -Stream 'Zone.Identifier' | Select-String 'Zone.Identifier'

PS C:\users\cyborg8\desktop> Get-Item 1_qs5nwlcl7f_-SwNlQvOrAw.png -Stream 'Zone.Identifier' | Select-String 'ZoneIdentifier'

PS C:\users\cyborg8\desktop> Get-Item 1_qs5nwlcl7f_-SwNlQvOrAw.png -Stream 'Zone.Identifier' | Select-String 'ZoneId'

PS C:\users\cyborg8\desktop> Get-Item 1_qs5nwlcl7f_-SwNlQvOrAw.png -Stream 'Zone.Identifier' | Where-Object { $_.Zone.Identifier }

PS C:\users\cyborg8\desktop> Get-Item 1_qs5nwlcl7f_-SwNlQvOrAw.png -Stream 'Zone.Identifier' | Where-Object { $_.ZoneIdentifier }

PS C:\users\cyborg8\desktop> Get-Item 1_qs5nwlcl7f_-SwNlQvOrAw.png -Stream 'Zone.Identifier' | Where-Object { $_.ZoneId }

Okay, there's nothing there. I think we can instead get the stream inside the content, but that will print out all the raw image content, so we can divide it all by equal signs because at the end the zone id will be printed like a variable, so like zoneid = X, so we'll get the last split of this equal sign by putting the negative one for last item, and we'll get it just fine, I think:

PS C:\users\cyborg8\desktop> (Get-Item 1_qs5nwlcl7f_-SwNlQvOrAw.png -Stream * | Get-Content -Stream 'Zone.Identifier').Split('=')[-1]
4

And that's the password! Now we should be good to go to the next level.