Hm, I got user and root flags in one go. Is that the intended way?
Fun box, I enjoyed it a lot. Thank you, @ASHacker