What a well done box. I’ve really enjoyed this one, I don’t understand why such a low rating. So my two cents:
foothold: basic web enumeration you should always do. read what is written.
user: read the sauce. it’s a backup, may be a bit late - what may have the developer done since then?
root: basic privesc enum you should always do. if you’re lost and have no idea what to do, give yourself a time and read some privilege escalation on Linux machine on the topic. It will be clear soon.
And as always, don’t forget what’s the name of the box.