How it went

1. 0
   nmap

   An nmap scan of all ports shows soccer.htb and a service on 9091.

2. 1
   tiny FM

   A /tiny file manager with default credentials allows a PHP upload for a shell as www-data.

3. 2
   WebSocket SQLi

   A soc-player subdomain queries a database over a WebSocket; blind SQL injection via a SQLmap proxy recovers player:PlayerOftheMatch2022 for an SSH login and the user flag.

4. 3
   doas dstat

   player can doas the dstat tool; a malicious Python plugin in its writable plugin dir runs as root.