User shell took about 5h because for some reason I chose not to run a well known script as part of my enum4noobs process and instead checked the shares manually which resulted in unnecessary guessing of stuff related to the next step. Root took about 2h which was mostly spent reading about the concept from a number of blogs.
Thanks for the challenge!