Pretty easy box you just have to take your time and enumerate.
User: mess around with the web application…you might find something
Root: Find out how the web app does what does …something funny is going on in there…funny things can lead to great results