UnderTheWire Cyborg Guide

Previous Level Guide: Cyborg Level 8 → 9

Access

SSH: ssh cyborg9@cyborg.underthewire.tech -p 22

Password: 4

Info

The password for cyborg10 is the first name of the user with the phone number of 876-5309 listed in Active Directory PLUS the name of the file on the desktop.

NOTE:
– If the first name “chris” and the file on the desktop is called “23”, then the password is “chris23”.
– The password will be lowercase no matter how it appears on the screen.

▼ HINT:
https://learn.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2016-ps

Theory

To get the password, we'll do something like a previous level where we get every property from every user in the server and then search stuff from there because we have no clue where to find it so we get the entire database. Then we'll list out of everything in the server, just the names of the users, and if they have a phone number attached to it. Don't send this command yet, because this will list every single user in the server, and if it's a lot it might fill up our entire shell, also we still haven't searched for who has that specific phone number they gave us in the description, so we'll use select string to find the line that contains the phone number. Let's also not forget the name of the file in the desktop that we can just get by using dir. And we get these commands:

dir
Get-ADUser -Filter * -Properties * | Select-Object GivenName, *Phone | Select-String '876-5309'

Solution

Now that we are in the shell, let's run the command and see if it actually does what we theorized it'd do:

PS C:\users\cyborg9\desktop> Get-ADUser -Filter * -Properties * | Select-Object GivenName, *Phone | Select-String '876-5309'

@{GivenName=Onita; HomePhone=; MobilePhone=; OfficePhone=876-5309}

It actually worked! Now that we have the name of the person with that phone number we just need the name of the file in the desktop and that should be it:

PS C:\users\cyborg9\desktop> dir


    Directory: C:\users\cyborg9\desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        8/30/2018  10:45 AM              0 99

Now just join the two and lowercase the name, and we get this:

onita99

And that's the password! Now we should be good to go to the next level.