How it went

1. 0
   nmap

   An nmap scan shows a login form on port 80.

2. 1
   auth.php.swp

   Gobuster finds an auth.php.swp editor swap file exposing the login logic and a new hostname.

3. 2
   auth bypass

   CVE-2019-19521 bypasses OpenBSD auth with a -schallenge username, and sshkey.php hands over Jennifer's SSH key for the user flag.

4. 3
   OpenBSD CVE

   The box is also vulnerable to CVE-2019-19520; compiling the local privilege-escalation exploit on-box gives root.