Thanks @TRX for this box.
Relatively easy one Both user and privesc require extensive enumeration.
Some tips (hopefully doesnt spoil much):
User: fool the webserver with the asset you are offering to him.
Root: your ‘gang’ is more powerful than you think