Zipper

Rooted but not quite clear how the privesc is working. I know what to do but would like some explanation. Can anyone pm me so I can ask a few questions how the privesc in this box is actually working?