[daru]

For the one still struggling on the initial payload. 

I coded this semi-auto script to gain access to the machine. feel free to use (it's quick and dirty)
https://github.com/Burly0/HTB-Napper

Thanks the stupid payload drove me nuts! Script works perfectly, thanks!

[kvxlx]

I created a repository on GitHub with the improved .cs code and Python script to gain initial access to the machine. I used Invoke-PowerShellTcp.ps1 to get the reverse shell.
https://github.com/kvlx-alt/HTB-Napper-Scripts

[marc42]

I dont know what i m doing bad, i m have the user flag

i found the a.exe and the .env

I modifiy the .env to this:

ELASTICUSER=test
ELASTICPASS=12345

ELASTICURI=https://127.0.0.1:9200

but when i visit the elastic search url keeps saying me that the credentials are wrong