Fun box, make sure to clean up stuff to prevent spoilers at certain stages. A few hints:
Shell: view the source, check out that one file. You might not necessarily be able to totally bypass certain filtering, but you can still smuggle things inside legit files.
User: enumerate, then return to the source. Timing is everything.
Root: More standard enumeration. No need to overthink getting around filtering; this can be found with some easy manual fuzzing. There is an article out there if you search well enough on the exact vuln, posting the article is too much of a spoiler though.