First, do the usual stuff (unlock bootloader, enable usb debugging, verify that adb and fastboot work,…)
Download TWRP bootable image from here, and boot it via fastboot:
fastboot boot /path/to/twrp-blahblah.img
TWRP will ask you for your devices password, so enter it. Then download the lastest version of SuperSU from here, and push it to the device:
adb push SR3-SuperSU..blahblah...zip /sdcard/supersu.zip
Since the bootloader verifies the signatures via dm-verify, you need to sign them. Download the ‘VerifiedBootSigner’ tool from here, and push it to the device (same command as before, just a different zip filename).
adb push VerifiedBootSigner-v3.zip /sdcard/vbs.zip
Then, using the TWRP gui on the phone, pick ‘install’, and first install the SuperSU zip (supersu.zip), and immediately after that (without rebooting, just go back after the SuperSU install is finished) install the VerifiedBootSigner (vbs.zip) package.
After doing all that, do a system reboot. My phone did another reboot (only once) on the loading screen, but after that I got a rooted system (and finally was able to install the AdAway hosts file).
If anything fails, dowload the factory image, and reinstall the system from there. If you remove the ‘-w’ flag from ‘flash-all.sh’, you can do that without losing your data.