- Jump Point Security
- Posts
- Under the Wire: Century Level 1
Under the Wire: Century Level 1
Objective
In Century Level 1, the goal is to retrieve the build version of the installed PowerShell instance. This value is used as the password to log into Century Level 2.
Important note:
You must find the build version, not the PowerShell version, and it must follow this format: **.*.*****.**** (e.g. 10.0.19041.1889)
Once found, you’ll reconnect using century2 as the username and this build version as the password.
Step 1: Connect to the Server
Use SSH to connect to the level:
Password: century1
You’ll drop into a PowerShell prompt.
Step 2: Retrieve the Build Version
This is a classic PowerShell question, one of the easiest ways to find version details is by checking $PSVersionTable
.
Run:
$PSVersionTable
And it will return a table such as:
Name Value
---- -----
PSVersion 5.1.14393.7870
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.7870
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
Here, BuildVersion
is the key value. The full version number is your answer:
10.0.14393.7870
That’s what you’ll use as the password to access the next level.
Step 3: Move on to Century Level 2
Now SSH into the next level:
When prompted for a password, enter the full build version you just found:
10.0.14393.7870
If successful, you're into Century Level 2.
What I Learned
How to quickly extract PowerShell version info
$PSVersionTable
is your go-to for internal versioning
Useful Command Recap
Command | Description |
---|---|
| Displays PowerShell version info and other environment details |
Tip
While $PSVersionTable
gives us what we need here, don’t forget that [System.Environment]::OSVersion
is another tool in our belt for getting Windows version info, and it’ll probably come in handy later.
Reply