@crash0 said:
Rooted.
Whilst the foothold and the users were a good teaching, I think the root was a bit on the CTF side of things. After many enumeration scripts returning nothing, how on Earth should that path be visible?I was out of hairs when I tried something dumb and it resulted in a good privesc blog post, tbh.
Congrats on rooting it!
I’m glad you were able to learn something about manual enumeration and finding user files 
scripts don’t have all the answers… And they’ll likely get you caught if you’re not careful with them.