Discovery - filebuster, nmap
Restaurant Management Systems - RCE from Exploit DB
Reverse Shell connection
SO information gathering - Linpeas.sh
Lateral movement after discovering secret share path (Linpeas.sh)
Edit of .service file where user had write priv (also discovered with Linpeas.sh) to create a root shell