For the user part: the attacker much exploit a chain of web vulnerabilities to gain code execution on the “cobble” user

For root: exploiting a vulnerable service that is running on the user’s machine .

The detailed write-up will be posted as soon as this machine is retired.