Forensic

Hello,
I think I get what kind of attack it is. I wrote a Python script to recover to exfiltrated data, and I got a flag indeed, but it doesn’t validate :/
I checked though all over again and again the return value of each command, and how exactly the attack works in order to be sure how to reconstruct the puzzle.
Any hint please ? or if someone would come in PM ?