Type your comment> @kkaz said:
Hints:
UsersUser1: Quite easy just do basic enumeration
User2: Again enumerate the hidden jewls from root directory
RootMethod1: I used DNSA**** way with D** injection this method is quite tricky and interesting
Method2: Once you get user2 creds give it to ms*t smb module and this is it. This method is piece of cake, learned from @grav3m1ndbyte thanks mate.
@kkaz I just tried method 2. Wow,just wow. How easy was that?? Thanks for the tip.