Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Analyze `/challenge/system.log`, an exported systemd journal. Exactly one log line is from the authentication service (`authd`) at `ERR` level, and that line contains the flag. Narrow it down with two `grep` passes.
Focus on a specific service's log lines
Filter to error-level (ERR) entries
Only one line is both from the target service and ERR