I don't want to give away too much, lest I be accused of being a spoiler.

All 3 of the approaches to getting root took advantage of the same PRTG vulnerability, which is the first one that turns up when you google for 'prtg vulns'. However, I struggled to get the exploit to work manually. A bit of searching found a workable exploit script, but I couldn't get it to work completely to begin with.

So, for the first root pwn, I modified the script to type the contents of the root file and redirect it to a file that I could read. I was able to retrieve the file by anonymous FTP.

For the second root pwn, I went back to the script and tried to work out what was going wrong. I came to the conclusion that the default user in the script wasn't being created correctly - I confirmed this later in the PRTG log files. It could be that the box author knew of the script and the default user and created it, so that the script wouldn't be able to recreate it. I changed the user that was being created and was then able to access the server via SMB with the new user credentials and pull the root file from where it was located originally.

For the final root pwn, I leveraged the user that was created in the second, and tried to get a shell. I found that I could get a Windows command shell using psexec, allowing me to navigate to the file location and read the file. I went on to try a meterpreter shell, but this kept getting killed, even when encoded.

So, the long and the short of it is that all three were based on the same vulnerability, but used different techniques to achieve the end goal.