Read my Write-up to Explore machine:
User: Found related ports of ES File Explorer which allow us to read files from the device, Using that we found an image with SSH credentials.
Root: Found port
5555 which is
adb, Create SSH tunnel and run
adb root and then
adb shell to get a shell as a root user.