Your friend owns a struggling restaurant, Open Eats, and has recently made some drastic changes to cut costs.

They have migrated away from WordPress to a custom website that the head chef proudly vibe-coded from scratch. With no budget for new hardware, the website is now self-hosted on the restaurant's only tower server—which also happens to be acting as the domain controller for the business.

Concerned about the security of their setup, your friend has asked you to perform a pro-bono penetration test before disaster strikes.

You've arrived at the restaurant after closing time and plugged your laptop into the network by borrowing the Ethernet cable from the unused receipt printer.

Objective

Your objective is to assess the exposed website and internal network, identify security weaknesses, and determine whether the restaurant's infrastructure can be compromised.

Can you uncover the vulnerabilities before someone else does?