Nice environment. This was a fun box. As hints.
User
Enumerate the open ports. Especially the one that allow anybody to touch. You will find juicy credentials that you can used. Use of credentials is not every time used in cleartext so think about using them in another way. Than google the file extention that you find and then you know what to do in order to have a stable connection.
Root
In my opinion there is a sad thing that root can be obtain with a “0day”. And I call it 0day because was published in october 2018 (along with related CVE ****5) after machine release. It’s like a walk in the park with that. I admit I use it but I also admit that I will do the intended way as well( at least I know what to obtain and why but there is a long series of commands). In the end, scope is to learn mechanism and implementations.
Cheers to all and creator as well!