Magic

Great box.
Was stuck with privesc but finally rooted.

User: try different payloads.
Root: you need to find special tool…

Feel free to msg me for hints.