easy-volatility

After adding the provided ISF file to the correct folder in the Volatility3 installation, you can extract the bash history from the core dump with vol.py -f debian11.core linux.bash.Bash.

This gives:

PID     Process CommandTime     Command

467     bash    2023-03-05 18:21:23.000000      # 08ffea76-b232-4768-a815-3cc1c467e813

and 08ffea76-b232-4768-a815-3cc1c467e813 is the flag.