Challenge

hydra cracked SSH for shifu:batman. Port 80 ran WordPress. wpscan found po:password1, and a PHP reverse shell in the Hello Dolly plugin caught a shell.

shifu could run ftp under sudo:

sudo ftp
!/bin/bash

find also had the SUID bit:

find . -exec /bin/sh -p \; -quit

Root. The home-directory flags were base64.