Finally got the user flag. Thanks @C31ibarin. Once it clicked, it wasn’t that hard (who would’ve thought).
Don’t try to upload a shell on the secret page you might’ve found - that rabbit hole leads nowhere. Think how you can use the fact it echoes everything back out to you that you give to it through the URL.
Off to root now. 