A chain-heavy web campaign: start with file-read reconnaissance against a legacy plugin portal on `:8080`, recover an admin install key from leaked local config, then abuse an unsafe archive installer to plant a webshell. The flag remains root-only (`/flag` mode `0700`), so foothold alone is not enough; you must pivot into local privilege escalation through a cron-driven trust boundary mistake before capturing opponents.