Rooted, this was a nice box that forced me to document and study d*********n
Foothold is the hardest part, after banging my head several times, found a working exploit. First I tested on my local machine, then I was ready to fire it up against target and got a shell.
Root was easy using common enumeration script, found a file with particular permission that can will let obtain what you seek. There are several ways to do this last part.