Challenge

Anonymous FTP exposed a writable clean.sh that ran on a timer. Appending a reverse shell caught a shell as namelessone. linpeas flagged SUID /usr/bin/env.

/usr/bin/env /bin/sh -p

Root, 4d930091c31a622a7ed10f27999af363.