Easy
Windows
Bounty Writeup - HackTheBox
Windows IIS box exploited via malicious web.config upload for RCE, then escalated to SYSTEM using token impersonation with Metasploit.