Overview
With the target running SSH on port 22 and having recovered the credential vK9#mX7w!Qz$2n, we test for password reuse across system users.
Reconnaissance
Looking at /etc/passwd, we see a user account named user1.
Exploitation Strategy
We log in via SSH using: ssh user1@<Target-IP> and input the password vK9#mX7w!Qz$2n. This logs us in successfully and grants us the shell for user1, where we find flag3.txt.
Solution Code
ssh user1@<Target-IP>
Password: vK9#mX7w!Qz$2n
cat flag3.txtFlag
Dynamic Flag (User 1 SSH Flag)