Great and funny box!
FOOTHOLD: Burp, exiftool and curl will help you. After, a strong reverse shell is necessary.
USER: An interesting service is running, not reachable before… And think easy way!
ROOT: suid3num, strings or pspy64, and find the right “path”!