Blind AEN Structure: - get all 7 web flags - get user and root flags on all hosts - DC - get user and root flags on final host