I managed to nab the user.txt after popping FTP and getting to HTTPS, but haven’t got a useful shell like sh or bash… seems like PHP and Node.js are tightened down from spawning one, but I’m probably missing something. Hints welcomed 
EDIT: Got the shell. If you can read certain users’ files, why not pull the files that let you login?