Using ssh://ssh03:<PASS_FROM_SSH02>@chroot01.ctf.hf, find a way to get flag located somewhere