https://portal.offsec.com/machine/stapler-15769/overview

This lab is active on OffSec's Proving Grounds and is required to be password protected.

Conclusion

The initial enumeration had a lot of rabbit holes and services. I read the walkthrough and it provides a completely different guide of finding a wordpress directory -> exploiting LFI in a plugin -> gaining MySQL access -> writing a payload as root of mysql -> getting shell as www-data -> finding password in .bash_history -> priv-esc to root.

Instead, I went from ftp -> brute force another user on ftp -> password reuse for SSH -> finding password in .bash_history -> priv-esc to root. My method was way more condensed than the official writeup. It's nice to know that there were multiple pathes to root! This is likely a box I will return to and see if I can get the alternate method.