How it went

1. 0
   nmap

   An nmap scan shows a Git service on 8000 and a Rails blog on 8080.

2. 1
   Rails RCE

   Rails 5.2.2.1 is vulnerable to a deserialization RCE through a profile update, giving a shell and the user flag.

3. 2
   bill

   A SQL dump in /var/backups yields hashes; bill's cracks to spongebob.

4. 3
   sudo gem (2FA)

   bill can sudo gem but it needs a TOTP; a Google Authenticator seed in his home generates the code, and gem's sudo rule spawns a root shell.