Under the wire: Trebek — Walkthrough
Trebek, by Under the wire can be found at underthewire.tech

!!! WARNING: Spoilers !!!

Trebek 1 -> 2

1
Get-WinEvent -Path .\Security.evtx -Verbose | Where-Object {$_.Id -eq 4699} | Select -ExpandProperty message
Copied!
Read the value from the or use findstr Command

Trebek 2-> 3

1
sc.exe qc C-3PO
Copied!

Trebek 3-> 4

1
Get-WinEvent -path .\Security.evtx | where {$_.id -eq 4624 -and $_.message -match “Account Name:\s+Yoda”} | select -expandproperty message
Copied!

Trebek 4-> 5

1
dir C:\windows\prefetch\MSACCESS*
Copied!

Trebek 5-> 6

1
get-childitem -path “HKLM:\Software\Microsoft\Windows\CurrentVersion\”
Copied!
Read the Run key value

Trebek 6-> 7

1
cd C:\Program Files (x86)\Adobe
2
3
Get-ChildItem *.dll -Recurse | group Extension -NoElement
Copied!

Trebek 7 -> 8

1
Get-ChildItem -Path “HKLM:\Software\Microsoft\Windows NT\Curr entVersion\Image File Execution Options”
Copied!

Trebek 8 -> 9

1
get-content -encoding Byte -totalcount 8 -path .\Clone_Trooper_ data.pdf
Copied!

Trebek 9 -> 10

1
get-WmiObject -class Win32_Share
Copied!

Trebek 10 -> 11

1
get-winevent -path .\Security.evtx | Where {$_.id -eq 4722} | Select -ExpandProperty message
Copied!

Trebek 11 -> 12

1
get-winevent -path .\Security.evtx | Where {$_.id -eq 4720} | Select -ExpandProperty message
Copied!

Trebek 12 -> 13

1
get-winevent -path .\Security.evtx | Where {$_.id -eq 4720} | Select -ExpandProperty message
Copied!

Trebek 13 -> 14

1
get-aduser -Filter * -Properties City | Select -Property Nam e,City | Select -ExpandProperty City
Copied!

Trebek 14 -> 15

1
get-aduser -Filter * -Properties City | Select -Property Nam e,City | Select -ExpandProperty City
2
3
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(“blahblah”))
Copied!

Conclusion

Special thanks to Fernando Tomlinson @Wired_Pulse for creation of this game.
Last modified 3yr ago
Copy link