Curling

HTB Content Machines
474

i am able to get root flag and user flag,

can someone please pm me with hints on how to get root shell. specifically commands im suppose to use. i already got the shadow file, i just now need to know how to replace it