Offensive Security: Capture The Flag 

Visit 192.168.14.15/welcome.php and, in the section prompting you to "enter your name below," input a simple script: "<script>alert</script>" to trigger an on-screen alert and obtain 'Flag 1.'

In the Linux terminal, employ the "curl -v" command to inspect the HTTP header of the rekall-about page. 'Flag 4' is located within this header information.

Access the page at 192.168.14.15/network.php. To exploit the command injection vulnerability, input "www.welcometorekall.com && cat vendors.txt" in the DNS Check field. This action will reveal 'Flag 10.'

In the Linux terminal, generate a file with a ".php" extension. Upload this file to the Memory-Planner.php page to uncover 'Flag 5.'

In the context of 'Flag,' where the user is identified as 'sshuser Alice,' establish an SSH connection to the server using 'ssh alice@192.168.13.14' with the password 'Alice.' For the privilege escalation exploit and to retrieve the flag, execute the command 'sudo -u#-1 cat /root/flag12.txt.'

Upon connecting to MSFconsole, search for Struts exploits, and employ the exploit 'multi/http/struts2_content_type_ognl' to attain a Meterpreter shell. Configure RHOSTS to 192.168.13.12. Utilize Meterpreter to download the file '/root/flagisinThisfile.7z' to your Kali machine. Unzip the file on your Kali machine using '7z x flagisinThisfile.7z,' and use the 'cat' command with the flag file to view 'Flag 10.'

Upon reviewing the port scan results, it was observed that port 21 has an open "FTP" service, allowing anonymous access. Initiating an FTP connection with the command 'ftp 172.22.117.20' and logging in as anonymous, one can retrieve 'flag3.txt' using 'get flag3.txt' and subsequently exit the FTP session. Once logged in anonymously, the downloaded 'Flag 3' can be read using the 'cat' command.

Executing Kiwi to extract cached credentials from Win10 uncovered that the administrator, ADMBob, had cached credentials. Storing the username and hashed password in 'Flag8hash.txt,' the password was successfully cracked using John, revealing it as "Changeme!" These credentials provided access to the Server2019 machine, where utilizing the PsExec module in Metasploit granted a SYSTEM shell. Within Meterpreter's command shell, the users were listed using 'net user,' and one of them, named 'flag8,' became apparent.