Rooted this box yesterday, i liked it! Good box to learn some new tricks on.
My most valuable tip for user.txt was to check how you get your files, if they are corrupted. After that it’s just reading and executing step by step, with a little bit of searching.
For priv esc, just use the command that’s been stated here a lot. It finally worked for me, after i replicated the environment on my own windows box, and then crafted the string until it did what i wanted it to do. When you do it on your own windows box you can check for syntax errors etc. My tip: Just write your command on your windows box until it does what you want, then change the paths and copy it over to your user shell. 
If anyone needs help, feel free to PM me, i don’t spoil, just nudge you in the right direction.