Sherlock
Medium Linux machine with custom web app and pivot
What solving this looks like
You are given a network address on the lab VPN and nothing else. Enumerate what is listening, find the way in, and take a shell as an unprivileged user — that is the user flag. Then escalate: a misconfiguration, a vulnerable service, a credential left somewhere it should not be. Root is the second flag. Both are unique to your instance, so a flag from someone else's box will not verify against yours.
Community writeups for Sherlock unlock automatically once you have submitted the root flag yourself.
This machine runs sandboxed under gVisor on a segmented lab network. Techniques you practise here are legal against this system and against nothing else — testing a system without written authorisation is a criminal offence in most jurisdictions.