Novareef Aquatics
A coral-restoration startup's staff portal hides a login you can slip past and an admin panel that leaks its own database - crack your way to a shell and ride a careless backup job all the way to root.
# 1. Extract the archive you just downloaded — on your own box, not a server.
you@host:~$ unzip novareef-aquatics.zip && cd novareef-aquatics
# 2. Boot the vulnerable machine. It prints the IP it was assigned.
you@host:~$ sudo bash deploy.sh novareef-aquatics.tar
# 3. Point your tools at that IP. Ctrl+C here tears it back down when you're done.
Comments (1)
Log in to join the discussion.
Solid lab for getting started — covers the basics well and the structure makes it easy to follow step by step. Good one for practicing fundamentals.
Submit flags
Log in to submit flags and track your progress.
Official writeup
Solve every flag on this lab to unlock the official writeup — no spoilers.