Type your comment> @T13nn3s said:
Just rooted Academy. It was a great box, IMO not an easy one. Lateral movement from user1 to user2 can take a long time. Check from which group user1 is a member of and what that group is meant for, it helps me to point to the location you have to search. Check that location and you will see an interesting directory and with Google, you can learn what you have to search for and how.
If you still need a nudge, just DM!
User1 to 2 has an easy way and hard one trolling the logs can be tedious but a popular enum script will give you what you need (latest ver)