Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

Analyze a prerecorded offline routing topology without creating routes, tunnels, proxies, or remote services. Recover the flag from the internal-service response payload.
Inspect artifacts/pivot/topology.json
Find internal_service_payload_b64
Base64-decode the value