Day 20 (Task 25) PowershElF to the rescue – Advent of Cyber 2 TryHackMe

Looks like today we will be using PowerShell to discover the hidden stockings.  Let’s remote into the machine using SSH.

ssh -l mceager 10.10.178.103

when prompted enter the password of r0ckStar!

We are dropped into a Windows machine command prompt.  Since this is a PowerShell challenge run powershell.exe.  This will drop us into a PowerShell prompt.First we need to discover the hidden file within the documents folder.  We can use Get-ChildItem -Hidden to view the hidden file.  Then we can use Get-Content e1fone.txt to view the contents of the file and answer our first question.

Now let’s look on the Desktop for the next file for Elf 2.

cd ../Desktop

Get-ChildItem -Hidden

cd elf2wo

Get-ChildItem

Get-Content e70smsW10Y4k.txt

Now we need to find a hidden directory within the Windows directory.

Get-ChildItem -File -Hidden -Recurse -ErrorAction SilentlyContinue C:\Windows

Eventually we see the folder we are looking for.

Now cd into that directory.  We need to know how many words the first file contains.  We can use PowerShells’s Measure-Object to get the information we need.

Get-Content -Path 1.txt | Measure-Object -Word

Now we need to get the index located at 551 and 6991 for the file 1.txt.

(Get-Content -Path 1.txt)[551,6991]

Now we need to combine these words to find the full answer for what Elf3 wants for Christmas in file 2.txt

Select-String -Path ‘2.txt’ -Pattern ‘redryder’

I hope you learned some useful PowerShell in this post.  PowerShell is a really powerful tool used by a ton of different jobs.