DAV - THM

Only one port open, so we better scan it thoroughly. A simple directory bust will reveal a directory that requires HTTP basic authentication, besides revealing the obvious service running on it. Default credentials are in place, so gaining access isn't all that difficult. In the file system shown there is a username and its hash, which are just the credentials you used to log (not sure, didn't crack the hash). With credentials for a webdav service, turn to the cadaver client. Search on Google, there is a quick guide on how to upload a file to the server using cadaver. What about uploading some php?

Once you have your shell, go get user.txt. Do the usual two-three manual checks, there is no need for an automatic tool like linPEAS here. You can use a very handy binary as any other user. Either use it to quickly grab the flag and end the challenge or take a longer way and first grab the couple of hashes available on the machine in order to crack them and obtain another user's shell. Either way, your job here is done.