This box appears to be looking for just the user.txt file as well as the root.txt file. It doesnt give too much info beyond that

“A new start-up has a few issues with their web server.”

Only port open is 80. So lets go!

Looks like fuel CMS is running

Gobuster is showing a few directories here

Nothing noteworthy in those directories.

Going to research Fuel CMS version 1.4 from here


Downloading and running that file we get this shell