I got user flag and currently stuck as g** user. Trying to find a way to privesc but having issues seeing the path. Nudges? DMs are open if you are worried if it will be to much of a spoiler
EDIT: Never mind, i rooted it and got the flag. This box was interesting and taught me something new!