How it went

1. 0
   nmap

   An nmap scan shows a web server on port 80.

2. 1
   bank.htb

   Adding bank.htb to hosts reveals a login page and a /balance-transfer directory.

3. 2
   balance-transfer

   One account file is far smaller than the rest and leaks plaintext login credentials.

4. 3
   .htb upload

   The support page runs .htb uploads as PHP, so a renamed PHP shell gives code execution for the user flag.

5. 4
   SUID binary

   A world-executable SUID emergency binary spawns a root shell.