Rooted.
Having binary exploitation usually makes me give the box an automatic like, however the rest of this box is pretty bad; I can now see why this box has such bad ratings now.
For user: The source is your friend. Once you get it, remember why this box is rated easy: You don’t need to go through the entire ret2libc-leak-calculate process. If system’s provided to you, but you don’t have the shell string, maybe it’s possible to provide one yourself?
For root: Just using k***2j won’t work. One of the images needs to be used in conjunction with it.
Thanks to @snowscan and @xdaem00n for your help!