I have mixed feelings about this box. Getting a foothold was painful but at the same time introduced me to some new fuzzing tools and some very helpful nudges. To get the user, it is possible to join the dots through the various files that are discovered during enumeration but only if you are aware that the admin tool that everybody probably knows is being superseded by the one used on this box. Getting the user after that was common sense if you remember that what appears to be used for access to one part can also be used to access another which seems to be quite common across a lot of the HTB boxes.
My favourite bit undoubtedly has been the escalation to root. The sense of satisfaction of getting root was amazing. I thought I knew straight away how to get there until I realised that the permissions had been set in such a way that it wouldn’t be possible. Thanks to google and a couple of very good articles, I have a better understanding of the paths the snake takes and how you can make it go down paths that you want it to. The elevator can help with a key to ensure that things stay as needed so your exploit calls home. I wouldn’t say this was an easy box but does teach that as you gather each piece of information you need to enumerate everything again as additional bits can appear from one step to the next.
Thank you @TazWake and @killerhold for the nudges very much appreciated.