Read my Write-up to Explore machine:
TL;DR;
User: Found related ports of ES File Explorer which allow us to read files from the device, Using that we found an image with SSH credentials.
Root: Found port 5555
which is adb
, Create SSH tunnel and run adb root
and then adb shell
to get a shell as a root user.