hey, how you did it in Bounty?
i managed to get upload the web.config with some asp code inside i found with google. and it is possibel to open a webshell but form here i stuck only whoami and dir works, i can not browse to the folders from here. I try other asp files i found. with one of them i can browse but the merlin folder is not accessible