TL;DR

Recon

we start with rustscan, using this command:

rustscan -a $target -- -sV -sC -oN nmap.txt -oX nmap.xml

I added enpass.thm to my /etc/hosts.

…

Privilege Escalation to Root