All I have been able to do is read the flag. it’s all that is possible thru that “obvious” route anyway, if anyone of yous has gotten a root shell I’d love to hear about it (as in please provide a hint on how to get it). The usual 2cents:
User: fuzz thoroughly, brute force, then leak a hash - with something also used to abuse name resolution
Root (flag): stay where you are, the key is there