How it went

1. 0
   nmap

   An nmap scan redirects to searcher.htb.

2. 1
   Searchor 2.4.0

   Searchor 2.4.0's eval-based query field injects Python for a reverse shell as svc, and the user flag.

3. 2
   system-checkup

   svc has a sudo rule on a system-checkup.py script whose docker-inspect option leaks container and Gitea credentials.

4. 3
   relative path

   A sibling script calls full-cleanup.sh by relative path, so running it from a controlled directory executes a planted script as root.