Rooted both ways.
US - a certain Windows enum tool shows that you have full permissions to this item. Check the fuzzy priv esc guide on what to do to get the reverse shell. Mine only lasted long enough to copy/paste a command to print the root flag. If you have suggestions on how to stabilize this, I would love to hear them.
TV - EDB exploit doesn’t work since the pre-req is not installed on the target. Check a similar framework for tools to help with this. Once you get a pw, try using them on a high port to get admin (have you heard of the evil tool?).