Rooted! Thank you @TheCyberGeek, learned a lot about a certain service.
Foothold: That service isn’t supposed to be public-facing…
User: Enumeration will give you something to use on that other service. Flag will not come until later.
Root: searchsploit
PM me if you need any help!