UnderTheWire Cyborg Walkthrough

UnderTheWire - Powershell Wargames
http://underthewire.tech/cyborg/cyborg.htm
The following video is a full walk through / spoilers below
Best watched in HD


ssh -p 6009 [email protected]
cyborg1

Cyborg 1 - Stat of Chris Rogers
net user Chris.Rogers /domain
Get-ADUser -Verbose -filter 'Name -eq "Rogers, Chris"' -Properties State
kansas

Cyborg 2 - A record for CYBORG713W104N and file on desktop
nslookup CYBORG713W104N + dir desktop
172.31.45.167_ipv4

Cyborg 3 - number of users in Cyborg Group + file on Desktop
Get-ADGroupMember 'Cyborg' | findstr name | Measure-Object -Line + dir desktop
88_objects

Cyborg 4 - name of the module w/ version 8.9.8.9 + file on desktop
Get-Module -ListAvailable | findstr 8.9.8.9 + dir desktop
Get-grits_eggs
grits_eggs

Cyborg 5 - last name of the user w/ logon hours + file on the desktop
Get-ADUser -properties logonhours -filter 'logonhours -like "*"' + dir desktop
rowray_timer

Cyborg 6 - decode text on desktop
get-content desktop\cypher.txt
[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("VGhlIHBhc3N3b3JkIGlzIGN5YmVyZ2VkZG9u"));
cybergeddon

Cyborg 7 - get the exe out of the Run Key for the current user
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
skynet

Cyborg 8 - Internet Zone that the photo on the desktop is from
Get-Item .\Desktop\picture1.jpg -stream zone*
type .\Desktop\picture1.jpg:Zone.Identifier
ZoneId=4
4

Cyborg 9 - first name of the user w/ phone number of 867 + file on Desktop
Get-ADUser -properties telephoneNumber -filter 'telephoneNumber -like "867*"' + dir Desktop
john72

Cyborg 10 - description of AppLocker Policy for ill_be_back.exe + file on the desktop
Get-AppLockerPolicy -Effective -xml + dir Desktop
terminated!99

Cyborg 11 - Check the IIS log and find the entry that is not Opera or Mozilla
Get-Content C:\inetpub\logs\LogFiles\W3SVC1\u_ex160413.log | Select-String -pattern "Opera" -notmatch | Select-String -pattern "Mozilla" -notmatch
spaceballs

Cyborg 12 - first for chars of full path for the service i_heard_robots + name of file on desktop
get-service | select * + dir desktop
gwmi win32_process | select *
gwmi win32_service | select *
never found it but just base 64 encode C:\ for the chars
qzpc_heart

Cyborg 13 - number of days of the refresh interval of DNS + file on the desktop
dnscmd.exe /zoneinfo underthewire.tech + dir .\Desktop
384
16_days

Cyborg 14 - DCOM app settings for ID {59B8AFA0-229E-46D9-B980-DDA2C817EC7E} + dir Desktop
Get-WMIObject Win32_DCOMApplicationSetting -Filter "AppID='{59B8AFA0-229E-46D9-B980-DDA2C817EC7E}'" + dir Desktop
propshts_objects