We've managed to gain user access to the server. There seems to be some kind of intranet echo server running as root.

https://storage.googleapis.com/gctf-2020-attachments-project/163d1c31de4cff57a2933f34959eb1dd4bab5218f7b9d606fe1080957efc045d937952af82a89438661d9c588f5fb762704da4a6afd47eec5f16672557780436

echo.2020.ctfcompetition.com 1337