Easy
Linux
Beep Writeup - HackTheBox
Exploit LFI via Elastix/FreePBX to leak credentials, then SSH as root using default voip creds or shellshock for easy pwn.