Jerry is pretty easy but provides a great example as to the dangers of default credentials
Start with an nmap scan.
Okay this looks like a web server, lets visit itSome good info here, it looks like a default webpage, use nikto and gobuster to enumerate further. With our scans running in the background, poke around the website some moreSome more good infohere I am looking for php files, note the -x option.Okay this is really bad, it looks like we can login to the server nowLook up a script for a reverse shell, here I am using the msfvenom generate java shellBrowse to the upload a file section and upload your reverse shell script, verify the new url. Visit the page to executeOur shell should connect to the target, looks like we have nt authority, very nice.Now we are free to locate the flags. use the type command and quotes to get both!
Ocelot Security 