@xdaem00n said:
(Might be a spoiler)
Is it possible to gain access to user via the console or should I build a payload package? I have been trying both but I’m unfamiliar with it.
Nevermind
Finally owned. Quite annoying, but did learn a bunch.
i got a stable shell, found the user flag, found a certain db that gave me a couple of passwords or hashes
i played around with them a lot, i am kind of stuck
they don’t seem to work directly (testing with RunAs), they don’t seem to be hashes
this is my first windows box, so i might overlook something very obvious
please DM if you can give me a hint
FINAllllly… got root.txt thanks to @Grim120 for all the nudge and hint that lead me to the right path. This one really is a mind bender like they said. I learned a lot… PM if you need help
I found 3 hashes …but i dont know how to do with her 
…i need hint pliz
can anyone PM me for privesc? I am not really familiar with privesc on windows