Skip to main content
University of Arkansas at Little Rock — Cyber Operations Research and EducationMeridian Cyber Range
Checking
Sign in

CSEC 74003 · Meridian

Start here

Read the engagement brief

You are an independent penetration tester. Meridian Corp has engaged you to find out how far someone with no access and no credentials can get into their network, what it would cost them, and whether they would notice. This page is the order you work in; the client brief is the detail.

Your progress

Step 1 of 6

0 of the 3 steps this dashboard can observe are done. The last 3 are yours to run — nothing here watches your scans, your evidence log, or your report, so they are never ticked off.

Next

Get M0 approved

Sign in with the Google account on your assignment sheet.

M0 submissions

The sequence

6 steps

  1. Do this now: Get M0 approvedSign in with the Google account on your assignment sheet.M0 submissions
  2. Not yet: Start the rangeReading the range state…
  3. Not yet: Power on your workstationStart the range first: your workstation runs only while the range is up.
  4. Not yet: Connect to your workstationOpen the IAP tunnel and leave it running, then bring up the desktop in your RDP client. The commands, the credentials, and the host-key fingerprints are all on one page.Connection steps
  5. Not yet: Work the engagement and log your evidenceWork M1 through M4 from your own workstation, to the methodology you named in M0. Timestamp every action, keep the failed attempts, and put your proof token in every screenshot and capture — an artifact without it cannot be tied to you.What each milestone owes
  6. Not yet: Submit flags, then stop the labA flag proves you reached a place; it is not a finding and no rubric criterion is met by a score. Submit them in CTFd as you go, and stop the lab when you are the last one in it — it bills by the hour.Your CTFd account

What you hand in

What each milestone is judged on

Six deliverables, graded against the rubric for each. Flags are a convenience, not the objective — everything you are graded on is in the documents you hand the client.

M0 — Scoping & Rules of EngagementScope document, Rules of Engagement, signed authorization, methodology plan, ethics statement
10% of the grade
M1 — Reconnaissance & ScanningHost and service inventory, network map, attack-surface analysis, evidence log
15% of the grade
M2 — Enumeration & Vulnerability AnalysisVulnerability register ranked by analyzed risk, with CVSS v3.1 vectors
15% of the grade
M3 — Exploitation & Gaining AccessNumbered, reproducible procedures, proof artifacts carrying your token, impact analysis, failed attempts
20% of the grade
M4 — Post-ExploitationEscalation and lateral-movement evidence, persistence with a cleanup procedure, detection analysis
15% of the grade
M5 — Final Report & DebriefClient report, two-part debrief, one-page self-assessment
25% of the grade

Out of scope

All three, from your M0 rules of engagement. That document is the authority on what is in scope.

  • Any backup servers found on the networks are out of scope. You may scan them, but interacting with them will cost you points.
  • The management network 10.10.99.0/24, including its jump host, and the 10.10.98.0/26 Cloud Run egress subnet.
  • Do not attack any other student workstation. Student Kali boxes are out of scope.

Flag submission and the scoreboard are on the Scoring page.