How it went

1. 0
   nmap

   An all-ports nmap scan finds a web app and a WebSocket service on 5789.

2. 1
   WebSocket SQLi

   The WebSocket's version query is injectable; a SQLmap proxy dumps the SQLite database and credentials.

3. 2
   tkeller

   A cracked hash plus a known username logs in over SSH as tkeller for the user flag.

4. 3
   sudo PyInstaller

   tkeller can sudo a PyInstaller build script; a malicious .spec file injects a subprocess call that runs as root.