Fun box, I usually don’t like Windows boxes but this one was a cool one, good work.
Getting user is pretty easy, can be done in like 5 minutes and even less. Check the first port and see what you can get. You don’t need to use GUI, it can be done by CLI, look for files that you cant see by default, find the right path and look for files that might look “juicy”, you will find a user name and a password, the password is outdated but it’s common sense to change it. Once you’re in the web, look for ways to inject a command, you can find it by searching on a search engine.
One thing that was upsetting me is people changing the passwords and reseting the box. But you can’t do much if someone has changed the password but reseting it. So don’t change the password, it’s not needed here. Don’t reset the box so much too, it ruins for others. I had to try different commands around 60 times (mainly because I don’t do much Windows boxes) and took me a day. It was kind of hard because I had to wait to the web page to load up 27 times in total, because of the reseting but can’t do much about it. Please don’t reset the box every five minutes but it ruins it to other people, you’re not alone here 