```plaintext The password for Century11 is the **10th** and **8th** word of the Windows Update service description combined PLUS the name of the file on the desktop. **NOTE:** – The password will be lowercase no matter how it appears on the screen. – If the 10th and 8th word of the service description is “apple” and “juice” and the name of the file on the desktop is “88”, the password would be “applejuice88”. ``` --- `Get-Service` returns 3 columns as default: `Status, Name, and DisplayName` ```powershell PS C:\users\century10\desktop> Get-Service Status Name DisplayName ------ ---- ----------- Running ADWS Active Directory Web Services Stopped AJRouter AllJoyn Router Service Stopped ALG Application Layer Gateway Service Running Appinfo Application Information Stopped AppMgmt Application Management ... <SNIP> ``` Get-Member` cmdlet onto `Get-Service` returns all of the hidden columns ```powershell PS C:\users\century10\desktop> Get-Service | Get-Member TypeName: System.ServiceProcess.ServiceController Name MemberType Definition ---- ---------- ---------- Name AliasProperty Name = ServiceName RequiredServices AliasProperty RequiredServices = ServicesDependedOn Disposed Event System.EventHandler Disposed(System.Object, System.EventArgs) Close Method void Close() Continue Method void Continue() CreateObjRef Method System.Runtime.Remoting.ObjRef ... <SNIP> ``` I found the service name of `Windows Update` using the following command. ```powershell PS C:\users\century10\desktop> Get-Service | Where-Object { $_.DisplayName -like "*Windows Update*" } Status Name DisplayName ------ ---- ----------- Stopped UsoSvc Update Orchestrator Service for Win... Stopped wuauserv Windows Update ``` I am going to use `Get-WmiObject` and its class `win32_service` to get the `Description` of `Windows Update` because I believe `Get-Service` doesn't have the `Description` field. ```powershell PS C:\users\century10\desktop> Get-WmiObject cmdlet Get-WmiObject at command pipeline position 1 Supply values for the following parameters: Class: win32_service ExitCode : 0 Name : ADWS ProcessId : 2412 StartMode : Auto State : Running Status : OK ExitCode : 1077 Name : AJRouter ProcessId : 0 StartMode : Manual State : Stopped Status : OK ... <SNIP> ``` But `Get-WmiObject` does have Description property ```powershell PS C:\users\century10\desktop> Get-WmiObject | Get-Member cmdlet Get-WmiObject at command pipeline position 1 Supply values for the following parameters: Class: win32_service TypeName: System.Management.ManagementObject#root\cimv2\Win32_Service Name MemberType Definition ---- ---------- ---------- PSComputerName AliasProperty PSComputerName = __SERVER Change Method System.Management.ManagementBaseObject Change(System.String DisplayName, Syste... ... <SNIP> Description Property string Description {get;set;} ... <SNIP> ``` Now I got the description of "Windows Update" service. `fl` is short for `Format-List` ```powershell PS C:\users\century10\desktop> Get-WmiObject win32_service | Where-Object { $_.Name -eq 'wuauserv' } | Select-Object -Pr operty Description | fl Description : Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update Agent (WUA) API. ``` Then I split the longs sentence by whitespaces which will format one word per line and I grabbed the `10th` & `8th` word in the description. 10th word: updates 8th word: windows ```powershell PS C:\users\century10\desktop> (Get-WmiObject win32_service | Where-Object { $_.Name -eq 'wuauserv' } | Select-Object -P roperty Description) -split "\s+" | Select-Object -Index 9,7 updates Windows ``` Lastly, the name of the file on the desktop is `110` ```powershell PS C:\users\century10\desktop> ls Directory: C:\users\century10\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 8/30/2018 3:34 AM 43 110 ``` Combining all, the password should be `updateswindows110`. However, it's not! It turns out that when I try to input both index 9 and 7 at once using a comma, it returns index 7 first even though I typed index 9 before index 7. Therefore, it's not `updateswindows` but `windowsupdates` which makes more sense haha. ```powershell PS C:\users\century10\desktop> (Get-WmiObject win32_service | Where-Object { $_.Name -eq "wuauserv" } | Select-Object -P roperty Description) -split "\s+" | Select-Object -Index 9 Windows PS C:\users\century10\desktop> (Get-WmiObject win32_service | Where-Object { $_.Name -eq "wuauserv" } | Select-Object -P roperty Description) -split "\s+" | Select-Object -Index 7 updates PS C:\users\century10\desktop> (Get-WmiObject win32_service | Where-Object { $_.Name -eq "wuauserv" } | Select-Object -P roperty Description) -split "\s+" | Select-Object -Index 9,7 updates Windows ``` The password for [[Century11]] is `windowsupdates110`