Rooted
Incredibly dissatisfying as my google search yielded some forum that discussed spoilers 
Even after completing this box, it feels like I cheated…
Anyway, it was not too hard but not too easy either.
Foothold: CVE… I thought it was too good to be true so I spent some time looking for something else. After realizing it was the CVE, it was easy. Obtained the shell manually but it was incredibly cumbersome to use so moved on to mc****. Easy
User: Found what I needed but couldn’t connect to the service. This is where I found the forum. Anyhow, I found what I was missing. ‘Buffered’ vs ‘Unbuffered’ was something I was not familiar with. Once understood, it was very straightforward
Root: Basic enum provided what I needed. Had to modify to create my own payload. Afterward, very straightforward.
PM me for nudge.