Got my 20 points for this fantastic and realistic box. Thanks @jkr for the work <3
User part is quite easy with the right exploit. There was mentioned a very handy Firefox extension that helped me to enumerate the needed information.
Root part was extremely tricky for me. I fell in so many rabbit holes. But thanks to the hint from @1NC39T10N i was able to get back on track. His/Her nudge is very handy if you are on a vip box.
@1NC39T10N said:
Root is tricky to find if others are not on the box IMO. Use the tool already mentioned
to monitor processes, but generate traffic to the box while this is running using the VERY
last step needed to get user. Observe the process, and consider how to leverage.
A very big shoutout to @Almadjus who helped me when i was completely stuck in the rabbit holes and remind me to double check the things.