Hardest box I’ve done so far. Lots of research is necessary for this one >.<
User1 (easy): brush up on c********s
User2 (medium): I spent longer than I’d like to admit looking for login creds… oops. Once authenticated, the rest is google-able. Just be quick, have some tabs open.
Root (difficult): One thing to remember… as others have mentioned here, everything should be done on the the box. You’ll save a lot of potentially wasted time. Try testing locally first. Check out what permissions you have as user2. The rest is trial + error.