This box is easy, I struggled a bit at first but was able to root it. Looking at the source code helped so as to know how to use the exploit. I tried both unauthenticated and authenticated ways and there was really no difference on how the exploit worked. Best time to try the box is immediately after a reset.
Otherwise I’m happy to provide hints if you’re stuck.