I saw a dump pcap file to use Wireshark. I found the fact:
So, I guess I need to connect 10.0.23.37 to use SSH and .ssh/id_rsa
- SSH connection between 10.1.0.41 and 10.0.23.37. Port number is 38574.
- 10.0.23.37 is alive via VPN.
- Download .ssh/id_rsa ;)
- See passwd: I think this is /etc/passwd. and found a user: hirsch.
$ ssh -i ./id_rsa -p 38574 firstname.lastname@example.org
Connection to 10.0.23.37 closed.
Gotcha. I got a flag.