Nmap Output:

 

 

/backup/chat.txt

 

 

In here, we understand that the username and password are

admin:admin

 

 

When we log in we see something interesting.

 

 

/internal/admin.php

 

 

Lets run burp and foxyproxy.

 

 

We click on the export pdf link at the bottom of the site and change the url part on BURP.

 

http://10.10.151.86/internal/admin.php

 

And we get flag