Haystack

I got the user but the root is hard.
I waste the last 5 hours to look around what is running as root.
Listed all folder to find any interesting things but no success…

Should i use SSH tunneling for access some port listening only on localhost ?