How it went

1. 0
   nmap

   nmap shows SSH and HTTPS; a public Gitea repo leaks the whole Docker architecture and source.

2. 1
   Cypher inj

   An unsanitized Cypher query on /api/products is UNION-injectable, leaking the registration key and resetting the admin password.

3. 2
   Kafka RCE

   A passkey-gated debug endpoint does raw-TCP SSRF; a hand-built Kafka Produce message reaches a consumer that runs it as bash, giving RCE in the dns container.

4. 3
   MITM phish

   Anonymous FTP gives the root CA; a forged wildcard cert, poisoned dnsmasq, and an MITM page capture tom_summers's Gitea password.

5. 4
   tom_summers

   tom_summers's password logs in for the user flag; a world-readable Xvfb framebuffer screenshots a password for tom_summers_admin.

6. 5
   rebecca

   A sudo strace race on docker login leaks rebecca_smith's reused Docker Hub password.

7. 6
   ash_winter

   Snooping a cleanup job's process arguments leaks ash_winter's FreeIPA password.

8. 7
   DCSync

   ash_winter's IPA role joins the sysadmins group, adds an ALL sudo rule, and restarts SSSD to load it, giving root.