Rating:
When you connect to the server, you can find linux manual page for socat command.
If you type !cmd, you can execute arbitrary command during manual screen activated.
Type command below,
!cat /home/moar/disable_dmz.sh
Then, you can find the flag.
I used `whoami` and `cat /etc/passwd` to reveal the interesting file's path first.
