Curling

Alright so I have user. I’m looking at priv esc and think I need to find where i***t is called by another page and use c__l to pull in the root flag instead. I have had a look around and can’t really see where it is called. Any pointers? Am I way off?

Thanks