After about a week I have finally rooted this box!
First hard box from me, big thankyou to @3ken45 @J0hnD03 @noi for the nudges.
A few tips from me:
User: find out what the web service is, and read up on common ways to “exploit” it. There is so much info on the web - read walk-throughs and the manual online, and user is actually pretty straight forward. Do some enum to get a shell.
Root: root took me a solid 5-6 days. Look through the forum here and you’ll see that from user1, you’ll have to get to another user before you can get to root. The exploit you’ll find online for that particular version of b*** won’t work (if it did it wouldn’t be a hard rated box). You need to find another way to achieve the same as that exploit (although the exploit doesn’t work, it still has something to do with f*** u*****). Once you get user2, its just more enum and reading manuals. Don’t skim over the manuals like I did, take your time to understand how re**** works.