Rooted this machine.
Hints:
Initial foothold: enumerate the web app and use google
Getting a ssh session: find a user and keep asking access…
Root: ask what you are allowed to do and use that to your advantage
All in all a fun box, a little different than the usual and definitely one of the more real-life ones out there. Thanks to the creator!