I have a question about the poison box as well!
I owned the user pretty easily. After that I start enumerating through the box looking for interesting things.
I have found interesting things, however I feel like the most interesting things are not the intention of the artist of this box and were introduced by attackers before me.
I want to make sure that I am owning the box the way the creator intended and not just by using exploits other people dropped on the box.
Anyone mind dropping me some cryptic tip about the next step just so I know I am on the right track and not following an already developed vector by another attacker?