14. Capture the User Flag

Flag #1 :

To read the flag from the sysadmin's desktop using evil-winrm, run this command after you're inside the WinRM session:

type C:\Users\sysadmin\Desktop\user.txt

Submit the contents of user.txt ⇒ 01c920617c6470cdf46ba5861ce701c2

Flag #2:

Read the final flag from administrator’s desktop indicating full system compromise.

type C:\Users\Administrator\Desktop\root.txt

Submit the contents of root.txt ⇒ 79bf6f60850f10211c290be19ccf8b95