Easy
Linux
DC-1 Writeup - Proving Grounds
Easy Linux box running a vulnerable Drupal 7 site, exploited with Drupalgeddon2 (CVE-2018-7600) for a www-data shell, then escalated to root through a SUID find binary using a GTFOBins technique.