I think the machines user flag was the fastest I’ve ever got. The nmap scan lasted longer than that. It’s a really nice entry level machine, it doesn’t get more by-the-book than that.
The privesc gets cloudy, but when you actually read the exploit you’ll see where it’s going. I was stuck for a few hours on “Connection Refused”, then I read a similar trouble googling it and all I had to do was to download the newest version of the p****.**e on their website and the whole privesc attack worked.