Took me a full day to root this machine.
Hints on this forum are really helpful, just to summarise + abit more spice:
User1: OSINT on the website, you will find usernames of EMPLOYEES for the company (just like how you would do in the real world). It’s GN*s.py will give you something to work with. If you don’t, its probably because you don’t have the correct syntax, and if you can’t manage to progress further from here, it’s probably because you’re not running the tool correctly.
User2: enum your way to the creds, read your output carefully, and as everyone has mentioned, “do something evil with e***-w****”.
Root: I******t is your friend here. Read a blog that details techniques of passing and reusing values. At this point you should have all the pieces you need to get the flag!
Drop me a PM if you need a push into the right direction.