user was super simple, managed to get the creds working (had to think like a user)… trying to find some type of special feature now…
Type your comment> @1NC39T10N said:
Got Root. The obvious app is the path forward once you get user. Keeping google the app and you will find tutorials and conversations that will give you everything needed to get this box.
- Find something juicy.
- That juicy thing doesn’t work out of the box. “Think like a user”. You’re in.
- Find a way to blindly “alert” yourself. Depending on how you do this, there may be a step 4: Utilize that famous windows service to profit (via Impacket)
PS. NO BRUTE FORCING REQUIRED. I doubt the password is even in any wordlists. Don’t waste your time and destroy the box for anyone else.
Fantastic hint. I made a mistake in not using ls -la this cost me some precious time for getting the creds.
I have user, too easy, any hint for root?
Finally rooted. The login part was probably the most annoying, because of people performing certain actions on the box.
So for a non-expert like me, any help being offered?
User was so easy I didn’t even bother with it for a while because I thought it couldn’t be that easy.
Lol …I am not getting the user …I am so dumb
is user through F** ?
EDIT :- ■■■■ GUI … used command line got it 
Type your comment> @1NC39T10N said:
Got Root. The obvious app is the path forward once you get user. Keeping google the app and you will find tutorials and conversations that will give you everything needed to get this box.
- Find something juicy.
- That juicy thing doesn’t work out of the box. “Think like a user”. You’re in.
- Find a way to blindly “alert” yourself. Depending on how you do this, there may be a step 4: Utilize that famous windows service to profit (via Impacket)
PS. NO BRUTE FORCING REQUIRED. I doubt the password is even in any wordlists. Don’t waste your time and destroy the box for anyone else.
Is the “juicy” thing through F** ?
“Think like a user” brain "think like a user "
Fun box, required some extra thinking thanks to the creator
Rooted, valuable knowledge for a Windows Machine… if you need some hint, please let me know !! Glad to Help
The issue I’m having right now is following the guidance from various google searches and posts on the web are not lining up with the box. I can find all sorts of things but none of them have moved me forward. Think I might be overthinking this whole root thing.
Rooted … Nice box …Thanks to @SmashTheBox and @1NC39T10N for the help …
Happy to give directions !! …PM me
thanks
Getting into the web-service did my head in harder than getting root did.
Fun box, completely blasted past the user flag without even thinking, didn’t realise I had it all along until just before I popped the root flag.
Really annoying though battling the password changers. A situation made all the more complicated given the way the second stage plays out, there were folk requesting password resets when the rig was working 100% fine then folk changing the password and locking everyone out. Twice the downtime, twice the attraction to VIP 
Type your comment> @bl4sph3m said:
Rooted, valuable knowledge for a Windows Machine… if you need some hint, please let me know !! Glad to Help
Hi Sir, yes please on the hint : )
@Scriptmonkey said:
Fun box, completely blasted past the user flag without even thinking, didn’t realise I had it all along until just before I popped the root flag.Really annoying though battling the password changers. A situation made all the more complicated given the way the second stage plays out, there were folk requesting password resets when the rig was working 100% fine then folk changing the password and locking everyone out. Twice the downtime, twice the attraction to VIP
People also do it on VIP - yesterday I gave up after I was logged out the umpteenth time and decided to wait some time until the password changers are done. Or until there are so many comments here in the forum that people notice you need not change the password.
If using a password change feature is so ‘tempting’ a box should maybe come with a warning - e.g. like the brute-force disclaimer a certain creator always has on his boxes.
i apologize, no-one had changed the creds, it was my mistake.
Rooted. You have to understand how a certain feature of the application works. +More research = pwnage. PM if stuck