Other

pe1

sudo -l

pe2

find / -type f -perm -u=s 2>/dev/null

pe3

getcap -r / 2>/dev/null

pe4

cat /etc/cron*

pe5

cat /etc/doas.conf

pe6

• if any notRoot under your control can execute service as root like usr/sbin/service vsftpd restart
• then check if you can edit / update the related configuration vsftpd.service