Did not really care too much for initial foot hold. I liked root. Got the flag, but also got a root shell through my existing session. You can execute commands, so what could you do? The possibilities are endless…
User: The commands listed on the reference page are there for a reason, and so is the reference to another page. Find a voice that executes the single ingredient you need to perform the attack (based on what you see in the error message), and then build out the rest of the command. Look at what the reference page gives you and use it, but you can also disregard at lot that isn’t specific to the attack vector.
Root: Basic service enumeration. I believe I was able to trigger it myself, but not sure. Regardless, not a big deal because it worked pretty easily off the shelf.
Thanks to @bumika for the nudges!