Hack The Box Cronos:

SMB username parameter command injection