Easy
Windows
Kevin Writeup - Proving Grounds
Easy Windows box where default admin:admin credentials expose HP Power Manager 4.2, and its pre-auth buffer overflow (CVE-2009-2685) gives a SYSTEM shell directly.