Discover it, enumerate it, exploit a real backdoor, and get root — entirely on your own isolated network. No CTF flag, just the mechanics.