Well Done!

but you could have also tried checking for 'net user' and

Fingerprinting the Internal Network and user privilege.

Dumping internal files from compromised server.