This was an excellent machine. Thanks for the challenge. User took me about 6-7h and I had to utilize some hints from this thread to orient my approach after I found the first vulnerability.
Root took about 6h as well which should’ve been much quicker but I refused to ditch my assumptions for far too long. A good sleep and a fresh perspective showed me the error of my ways.
Thanks everybody for giving just enough hints to proceed but not spoiling any of the steps.