Nice box with good exploitation path.
User:
- You don’t have to login in order to go further, but if you want to login, it’s a basic challenge.
- Basic RCE, check what actions you can do there - lots of explanation about it. Just google.
- Once you have a reverse shell, enumerate everything.
Root:
- I assume there is a rabbit hole so if it’s not working, go on…
- Again basic enumeration will give you all the details you need.
- Pay attention to who you are and what you own.
Hope it’s not a spoiler.