After far too many hours this weekend I finally managed to figure out the last step and get a copy of the root flag. I had trouble getting the original toe-hold because a mistake made me discount the solution, getting the root was a lot of trial and error on something I hadn’t touched before; I’ll be keen to see the write-ups and how much more elegant other did it.