UnderTheWire Century Guide

Previous Level Guide: Century Level 10 → 11

Access

SSH: ssh century11@century.underthewire.tech -p 22

Password: windowsupdates110

Info

The password for Century12 is the name of the hidden file within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile.

NOTE:
– Exclude “desktop.ini”.
– The password will be lowercase no matter how it appears on the screen.

Theory

The password we have to get is the name of a hidden file somewhere in the user's profile. What we could do is go to the user folder and search for only all the files in all folders that are hidden, while omitting all files called "desktop.ini". So for that we can use Get-ChildItem for folder files, and recurse to loop through all files inside all folders and hidden for it to just show us files that are usually hidden, and finally exclude. Also cd, to go to the user root folder since we always start in the Desktop folder:

cd ..
Get-ChildItem -Recurse -Hidden -Exclude "desktop.ini"

Solution

Now that we are in machine, let's go to the root and check out the hidden files command:

PS C:\users\century11\desktop> cd ..

PS C:\users\century11> dir


    Directory: C:\users\century11


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        9/16/2024   3:40 PM                AppData
d-r---        7/16/2016   1:23 PM                Desktop
d-----         3/8/2025   6:59 AM                Documents
d-r---        8/30/2018   3:34 AM                Downloads
d-r---        7/16/2016   1:23 PM                Favorites
d-r---        7/16/2016   1:23 PM                Links
d-r---        7/16/2016   1:23 PM                Music
d-r---        7/16/2016   1:23 PM                Pictures
d-----        7/16/2016   1:23 PM                Saved Games
d-r---        7/16/2016   1:23 PM                Videos

This doesn't seem to give us any clue of where it might be, let's try the command:

PS C:\users\century11\desktop> Get-ChildItem -Recurse -Hidden -Exclude "desktop.ini"
...
Get-ChildItem : Access to the path 'C:\users\century11\Documents\My Videos' is denied.
At line:1 char:1
+ Get-ChildItem -Recurse -Hidden -Exclude "desktop.ini"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (C:\users\century11\Documents\My Videos:String) [Get-ChildItem], UnauthorizedAccessException
    + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand


    Directory: C:\users\century11\Downloads


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
--rh--        8/30/2018   3:34 AM             30 secret_sauce


    Directory: C:\users\century11


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d--hsl        8/30/2018   3:11 AM                Local Settings
Get-ChildItem : Access to the path 'C:\users\century11\Local Settings' is denied.
...

There we go! You just gotta look through the many errors, and you'll find this:

    Directory: C:\users\century11\Downloads


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
--rh--        8/30/2018   3:34 AM             30 secret_sauce

We know this is the correct file because when you open it (you'll just use the file name as the password of the next level):

PS C:\users\century11> Get-Content Downloads/secret_sauce
Congratulations. You found it!

And that's the password! Now we should be good to go to the next level.