Rooted. Not the best box here by far. It is a big mess, but maybe that’s on purpose to throw us off track or something.
User doesn’t need any hints really.
For root see what is running on the server. Google that and you’ll find multiple exploits (almost) ready to use.