User was a pain… if you get stuck in Ha Ha part you could do two things:
- Fuzz like a boss to try some LFI that could you give you a hint.
- Enum SMB trying to find some path that gives you some idea where the files are stored.
Enjoyed root 
PM if you need hint.