@cumulus thanks for the tip, I was very close but over-complicating things… Got root.txt and root shell now.
@Grim120 did you manage to get root.txt? then think how you could use the same technique on other server artefacts