How it went

1. 0
   nmap

   nmap finds SSH, a .NET WebSocket on 5000, and a Flask app on 8000.

2. 1
   Flask LFI

   The Flask page parameter is a path-traversal LFI; it reads the app source and the backend bagel.dll.

3. 2
   Newtonsoft deser

   bagel.dll deserializes with Newtonsoft TypeNameHandling.Auto, so a nested $type File object reads phil's flag, SSH key, and a DB password.

4. 3
   developer

   phil's key logs in over SSH; the DB password is reused to su to developer.

5. 4
   sudo dotnet

   developer may sudo dotnet, so dotnet fsi runs an F# one-liner as root.