Shield - Writable directory on server

Hi,
right now I am doing the Shield Starting Point machine. After some trouble I have managed to get the root flag.
Only thing I don’t understand and I would like to ask you for advice is: How am I supposed to find out the writable directory on the server C:/inetpub/wwwroot/wordpress/wp-content/uploads.
Thank you very much for any comment.

C:\inetpub\wwwroot is the default location for websites on IIS

\wp-content\uploads is a default location for wordpress

the actual sitename directory might be different depending on the configuration (I think) but you can fuzz that or guess. or if you have a shell just look at the folder.

Type your comment> @HcKy said:

C:\inetpub\wwwroot is the default location for websites on IIS

\wp-content\uploads is a default location for wordpress

the actual sitename directory might be different depending on the configuration (I think) but you can fuzz that or guess. or if you have a shell just look at the folder.

Thank you again. So if I don’t have shell. I have to know default locations, right (or guess the directory)?

default locations and how things are commonly configured is a big part of being able to do proper enumeration and exploit things. Always a good idea to look up documentation on what you see running so you can better understand how to attack it.