Recon

First, launch a ping to crocodile machine to identify if is a Windows Machine or a Linux Machine

The TTL is near to 64, so is a Linux Machine.

Launch a nmap scan to found the open ports on the machine:

We found Port 21 and 80 open, usually Port 21 contains FTP and 80 HTTP

Launch some basics scripts on nmap to known the service and version running on that port:

Web Page

Type the ip on a browser and look :

We found a website but nothin interesting on source code

Gobuster

gobuster dir -u http://10.1.129.15 -w /home/ewrc01/Descargas/Dictionaries/SecList/Discovery/Web-Content/directory-list-1.0.txt
-x .php -t 20`

use the follow instruction in one line to enumerate the dirs with brute force with gobuster, I'm using SecList with parameter w, we are looking for php extension files and define it with x parameter and define de threads with t parameter.

The enumeration found a admin.php file look at it:

Login page

if we try some credentials like: admin:admin, guest:guest, root:root no have effects:

FTP

Remember the scan, the machine has the port 21 open search on it:

Get the two files on the ftp server:

And print it with cat:

We found some users like admin, look the other file to found some passwords:

Flag

Try it on login page:

And congrats! here is your flag: