Forgot to mention this box is able to be completed without a Windows attack box.
I had some issues getting Powershell Web Access to work but it was cause I was missing some simple things in the username field.
Rooted!! - Special mention to @raulcpop for the pointer! If anyone needs help my PM's are open.
Crete - Do not overthink... Play around with burp & google ;)
Olympia - Also do not overthink - Once you find the file you have everything…