Stuck on privesc too… found timemachine and used it, but I can not escalate, stay with user privs… Please PM me.