How it went

1. 0
   nmap

   An nmap scan redirects to sneakycorp.htb.

2. 1
   SMTP phish

   A dev subdomain lists staff emails; an SMTP phishing spray captures Paul's credentials.

3. 2
   Paul's mailbox

   Paul's mailbox holds a sent email leaking the developer FTP credentials.

4. 3
   FTP webshell

   FTP write access as developer drops a PHP webshell in the webroot for www-data, and the password sus to developer.

5. 4
   PyPI package

   A cracked password for the internal PyPI server allows a malicious package upload that returns a shell and the user flag.

6. 5
   sudo pip3

   That account can sudo pip3, whose install hook runs as root.