Very interesting box. Definitely new concepts that we don’t often see in the CTFs. FULL of rabbit holes.
One issue; Found the user password but when I tried it at first it didn’t work so spent a couple unnecessary hours digging deeper… *bangs head… anyway, came back to things with a reset box and the password worked. Someone must have changed it for some reason that breaks my heart. haha.
Foothold -check
user- check
rooted- check
As has been said, Hacktricks will help with true root. Getting user may take longer than actual root if you don’t search properly. It’s not a place that is often seen here so think outside the box. and look at everything. rabbit holes for days…