bytes32 private password. The keyword
privatein Solidity can be misleading: although it is meant to be "private", everything is indeed public on the blockchain. The
privateonly means "other contracts are not allowed to read it".
passwordis located in storage #1 (#0 is the state variable
locked). Grab it from the challenge contract storage: