Markup
A MegaShopping web app accepts weak default credentials and parses user-supplied XML without protection, so an XXE payload reads arbitrary files from the host — including Daniel's SSH private key, which gives a foothold over SSH. A scheduled batch script, job.bat, is world-writable, so overwriting it with a netcat reverse-shell command and waiting for the task to fire returns a shell as Administrator.