This was a nice box learn a lot too!!
Thanks to @MTOTH for his hints!!! it helps me a lot!
for privilege scalation all i can say its search the vuln for the app once you read about the vuln you will now what to do but dont focus too much on getting a meterpreter session like a did ?