An OffSec Linux box: a Googlebot User-Agent bypass reveals an LFI, anonymous FTP upload turns it into RCE as www-data, and a SUID binary that calls whoami by relative path is PATH-hijacked to root.