Nice box , spent all day struggling with user just to find out that I was using the wrong method to pass credentials I found in LDAP. Once I got a session on the box , got root in 10 minutes of enumeration BUT not through the same path as per the comments here , I think I have an unintended Priv Esc as far as I can see …