$ Mail

Brunner Mifflin (Root)

IT terminal creds + sudo NOPASSWD on /usr/bin/mail. GTFOBins payload spawns a root shell for the flag.