Cobalt Meridian
A cargo logistics company runs an internal "Operations Console" whose panels load a bit too loosely; log in with the employee account provided and see what else the console will reveal for you. You can find the flag at /app/local.txt Credentials: administrator : Cobalt_Meridian_26 To solve the panel you can also use the lfi_force tool from my GitHub repo — https://github.com/morulopez/lfi_force — to brute-force the right LFI path combinations and read files from the system.
# 1. Extract the archive you just downloaded — on your own box, not a server.
you@host:~$ unzip cobalt-meridian.zip && cd cobalt-meridian
# 2. Boot the vulnerable machine. It prints the IP it was assigned.
you@host:~$ sudo bash deploy.sh cobalt-meridian.tar
# 3. Point your tools at that IP. Ctrl+C here tears it back down when you're done.
Submit flags
Log in to submit flags and track your progress.