Priv esc using /usr/bin/passwd

I am actually in pwk lab as well right now. Started it this month