got user. thanks @justAhmed for steering me in the right direction when I was heading way too deep into m*******. now time to look for those easter eggs.
update: rooted. very cool box - I learned a lot.
some hints:
- foothold: previous hints are right, enumerate carefully, and save everything you find. there are quite a few steps, so each time you find something, see where it can take you. no need to get a reverse shell; a good web shell is enough.
- user: work out what you can do, and follow your nose. save what you find, there is something extra you will need later.
- root: you will find a helpful hint, but remember the constraints of the box and stay local.