Easy
Linux
Doctor Writeup - HackTheBox
Exploit SSTI in Doctor's messaging app via log poisoning, gain RCE as web user, then escalate via Splunk Universal Forwarder credentials.