Rating: 4.0

tl;dr:
1. Authenticate with karaf:karaf
2. List JMX beans via /jolokia/list
3. Install your OSGi bundle with reverse shell via JMX

https://github.com/p4-team/ctf/tree/master/2019-03-23-0ctf-quals/web_osgi