advanced

Breach: Meridian Corp

Meridian Corp hired you for a full-scope internal penetration test. You start with a single foothold on their public DMZ web server. Your objective: chain your way from the edge to Domain Admin, pivoting host-to-host as you loot credentials along the way.

scopeIsolated, authorized simulation. Every organisation, host, account and dataset in this campaign is fictional and synthetic — no real systems, customers or personal data are involved. Only the linked hacking.community labs are in scope.

0 / 5 hosts compromised +1000 XP

Each host is a real lab. Open it, solve it, and submit its flag here to compromise the host — that reveals the pivot intel and unlocks the next machine in the chain.

// difficulty curveramp

easymediumhard

Difficulty ramps up — early hosts are gentler, the final boxes are the hardest.

web-dmz-01203.0.113.10easy

Public web server (DMZ)

host 1

The customer portal exposes a search endpoint. Get a foothold and loot the database.

graded: the per-user flag (hc{…}) issued by “Classic UNION-based SQL Injection” — A search endpoint glues user input straight into a SQL query. Extract the admin flag from the `secrets` table.
then: unlocks api-internal-15

open Classic UNION-based SQL Injection

api-internal-15

Internal GraphQL API

host 2

compromise the previous host to unlock

ci-runner-07

CI/CD build runner

host 3

compromise the previous host to unlock

aws-prod

AWS production account

host 4

compromise the previous host to unlock

dc01.meridian.local

Domain Controller

host 5

compromise the previous host to unlock