My hints.
User:
1º The obvious exploit is not going to work.
2º Read articles about the vulnerability, and you will find an alternative approach. There are tons of articles about it.
3º Once you do your research, remember that not all home directories fall under home.
4º Play with a client tool to get additional information.
5º Prepare your attack, and get in.
Root:
1º Go back to your initial enumeration.
2º Don’t overthink. Root is easy.
@TheCyberGeek , thank you for the box.