If you have DB shell on NIX01, look at the next flag name for a hint. From that user, do your basic linux enumeration, and you should get an obvious hit.