Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Practice SSH local port forwarding inside one container. The SSH jump role is 127.0.0.1:22 and the internal service listens only on 127.0.0.1:5432 in that same container. Safely forward it to port 8888 and retrieve its response; no external host or real database is used.
Check the local endpoints in evidence/topology.txt
The user is user and the password is password123
Use ssh -L 8888:127.0.0.1:5432 user@127.0.0.1, then connect to 8888 with nc