# 14. Capture the User Flag



## Flag #1 :&#x20;

To read the flag from the sysadmin's desktop using **evil-winrm**, run this command after you're inside the WinRM session:

```bash
type C:\Users\sysadmin\Desktop\user.txt
```

&#x20;

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Fik1Pt9iA9Dai6wrLjQYg%2Fimage.png?alt=media&#x26;token=f47e5b66-915f-4fb3-832d-76465c396427" alt=""><figcaption></figcaption></figure>

Submit the contents of `user.txt`  ⇒ <mark style="color:red;">01c920617c6470cdf46ba5861ce701c2</mark>



## Flag #2:&#x20;

Read the final flag from administrator’s desktop indicating full system compromise.

```bash
type C:\Users\Administrator\Desktop\root.txt
```

Submit the contents of `root.txt` ⇒ <mark style="color:red;">79bf6f60850f10211c290be19ccf8b95</mark>





