Update: root was fun (and super simple when you found all the stuff in user enum). user was a bit of a pain with so many things to look at. I enjoyed the first steps (sq*i, digging) but the web part was a bit annoying. Upside: got me to write a local shell via http script :smile: