After enumerating for 2 hours, I realised I already had the user flag and hadn’t noticed. I’m currently stuck in a rabbit hole I think, trying an exploit which seems to be the one but I can’t get into the port I need.
Edit: Rooted, fun box.
User: Find the right tool, get your hashes
Root: Take the dog for a walk, but you might find something that will do the whole job for you. Once you find the treasure, pass it on.