@vertering … I never tried with the user account, but with the admin it’s quite easy if you are using the well documented tools. This was a really well thought out/relevant box. One tip, whilst the box itself isn’t too hard (plenty of resources explaining this type of attack) I spent most of my time getting my tools installed/working … had issues with libraries and missing modules. Good luck all.