```plaintext The password for Century12 is the name of the hidden file within the contacts, desktop, documents, downloads, favorites, music, or videos folder in the user’s profile. **NOTE:** – Exclude “desktop.ini”. – The password will be lowercase no matter how it appears on the screen. ``` --- I found two ways to solve this problem. I'm positive there are way more ways to solve this, but I found 2 as a PowerShell newbie. 1. First method: `Get-ChildItem -Path C:\Users\century11\ -File -Recurse -Hidden -ErrorAction SilentlyContinue | Where-Object { $_ -notmatch 'desktop.ini' }` 2. Second method: `Get-ChildItem -Path C:\Users\century11\ -File -Recurse -ErrorAction SilentlyContinue -Force | Where-Object { $_.Attributes -match 'Hidden'} | Where-Object { $_ -notmatch 'desktop.ini' }` The first method is a more convenient approach that uses `-Hidden` attribute to filter for hidden files. However, this feature was introduced in later versions, so it's only available in `PowerShell 7` and newer. The second method uses `-Force` parameter to include both hidden files and system files and then filter for the hidden files using the `Where-Object` cmdlet. I thought it's important to understand both methods, especially in pentesting scenarios where you can't always predict the environment you'll be working in. ```powershell PS C:\users\century11\desktop> Get-ChildItem -Path C:\Users\century11\ -File -Recurse -Hidden -ErrorAction SilentlyContinue | Where-Object { $_ -notmatch 'desktop.ini' } Directory: C:\Users\century11 Mode LastWriteTime Length Name ---- ------------- ------ ---- -a-h-- 1/23/2025 4:28 PM 262144 NTUSER.DAT -a-hs- 8/30/2018 3:11 AM 98304 ntuser.dat.LOG1 -a-hs- 8/30/2018 3:11 AM 126976 ntuser.dat.LOG2 -a-hs- 7/12/2020 10:55 PM 65536 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TM.blf -a-hs- 6/14/2020 4:36 AM 524288 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TMContainer00000000000000000001.regtran s-ms -a-hs- 7/12/2020 10:55 PM 524288 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TMContainer00000000000000000002.regtran s-ms ---hs- 8/30/2018 3:11 AM 20 ntuser.ini Directory: C:\Users\century11\AppData\Local\Microsoft\Windows Mode LastWriteTime Length Name ---- ------------- ------ ---- -a-h-- 8/30/2018 3:11 AM 8192 UsrClass.dat -a-hs- 8/30/2018 3:11 AM 8192 UsrClass.dat.LOG1 -a-hs- 8/30/2018 3:11 AM 8192 UsrClass.dat.LOG2 -a-hs- 8/30/2018 3:11 AM 65536 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TM.blf -a-hs- 8/30/2018 3:11 AM 524288 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TMContainer00000000000000000001.regtr ans-ms -a-hs- 8/30/2018 3:11 AM 524288 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TMContainer00000000000000000002.regtr ans-ms Directory: C:\Users\century11\Downloads Mode LastWriteTime Length Name ---- ------------- ------ ---- --rh-- 8/30/2018 3:34 AM 30 secret_sauce ``` ```powershell PS C:\users\century11\desktop> Get-ChildItem -Path C:\Users\century11\ -File -Recurse -ErrorAction SilentlyContinue -Force | Where-Object { $_.Attributes -match 'Hidden'} | Where-Object { $_ -notmatch 'desktop.ini' } Directory: C:\Users\century11 Mode LastWriteTime Length Name ---- ------------- ------ ---- -a-h-- 1/23/2025 4:28 PM 262144 NTUSER.DAT -a-hs- 8/30/2018 3:11 AM 98304 ntuser.dat.LOG1 -a-hs- 8/30/2018 3:11 AM 126976 ntuser.dat.LOG2 -a-hs- 7/12/2020 10:55 PM 65536 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TM.blf -a-hs- 6/14/2020 4:36 AM 524288 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TMContainer00000000000000000001.regtran s-ms -a-hs- 7/12/2020 10:55 PM 524288 NTUSER.DAT{0f893ee4-78e5-11e6-90dd-eefb07825ed9}.TMContainer00000000000000000002.regtran s-ms ---hs- 8/30/2018 3:11 AM 20 ntuser.ini Directory: C:\Users\century11\AppData\Local\Microsoft\Windows Mode LastWriteTime Length Name ---- ------------- ------ ---- -a-h-- 8/30/2018 3:11 AM 8192 UsrClass.dat -a-hs- 8/30/2018 3:11 AM 8192 UsrClass.dat.LOG1 -a-hs- 8/30/2018 3:11 AM 8192 UsrClass.dat.LOG2 -a-hs- 8/30/2018 3:11 AM 65536 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TM.blf -a-hs- 8/30/2018 3:11 AM 524288 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TMContainer00000000000000000001.regtr ans-ms -a-hs- 8/30/2018 3:11 AM 524288 UsrClass.dat{d82669b3-abff-11e8-90ee-e14c26db97e8}.TMContainer00000000000000000002.regtr ans-ms Directory: C:\Users\century11\Downloads Mode LastWriteTime Length Name ---- ------------- ------ ---- --rh-- 8/30/2018 3:34 AM 30 secret_sauce ``` The password for [[Century12]] is `secret_sauce`