Type your comment> @MactheDice said:
In Bastion, I mounted the vhd and perused the directories. Did not find user.txt anywhere. Then I got the hashes from the SAM. Was able to crack the hash. Cannot figure out where to go from there. Can someone PM me to give a nudge.
what other ports are opened on the server? Perhaps one of them could be used for a remote connection… If that won’t work for you, PM me …