I just got user and second user shortly after! No exploits or brute-forcing needed, just thorough enumeration!
Not sure if this is a spoiler, but going through the PayloadAllThethings windows guide will give you useful ideas. It would be nice if there was a handy transcript like this for everything…
Onto root! Feel free to PM for comments!