Challenge

10.1.1.4:8888, an exposed Jupyter (Jupyter Notebook / Lab) server, vulnerable through a known CVE in that version.

Approach

A reachable Jupyter instance is effectively remote code execution by design: a notebook cell runs arbitrary Python on the host. Once in, a cell that shells out (!cat /flag.txt or similar) reads the flag directly off the box.