Rooted! Thanks @nasri136TH for the nudge 
Nice box but I wasted a sh*t ton of time on user1 → user2 escalation as the command that I first sent wiped clean the file I wanted to read… And it is possible to do that with all the files that belong to user2.
Anyway, a part from that nice box especially the foothold and user!
My hint for root: Don’t go too far away from home, and enum scripts did not help me. There is no need to exploit anything, just find it and try it.