This was the longest I ever took to get the user flag for a 20 point box. After all the dirbusting, getting the vulnerability to work correctly also required a fair amount of configuring and googling.
The root method is similar to that in a recent box, but with a twist - here it is related to a certain serpentine security gotcha.