Woo - got root.txt. Once I got a stable meterpreter session it was easy - took longer to do the nmap scan
