You have a single host in scope: littlejohn, belonging to Nottingham Logistics Group. It has been online and untouched for a long time, and everything you need to get in is already on the box.

Get your bearings. See what it presents to the outside and confirm whose it is before you go further.

Work from the outside in. The obvious surface is where you start, not the way in.

The surface you reached is not the only thing this host serves, and the name it answers to by default is not the interesting one.

The host is willing to tell you the name it truly answers to, if you ask the right service the right way.

What you already hold is enough to turn into something more useful.

Now you hold a name the wider world does not honour. The same host will serve what sits behind it, but only if you address it correctly.

Reach it, and find the login interface.

The server answers to more than one name on the same port.

What runs behind that name is old, and this version can be pushed into handing back the contents of files it was never meant to reveal.

Use that to look past the application itself and work out who you are really dealing with on this host.

The thing you are talking to can be made to describe itself. Read beyond the web root.

A read that returns only a handful of lines is still enough to know precisely what else is running on this host. Something scheduled is doing the rounds of the estate, and it carries what it needs to log in elsewhere in the clear.

Find that script, read it, and take the credential it leaves lying in its opening lines.

The interesting one is not a service you have met yet. Use the same vulnerability but guess the right ID.

That credential was never meant to travel, but it does. The account you already identified will take it directly.

Log in for real as that user and confirm you are standing on the host.

What greets you on the way in is the proof you were here. Nothing you could type yourself counts.