Easy
Linux
Outdated Writeup - Proving Grounds
Easy Linux box where an mPDF HTML-to-PDF converter leaks a config file through its annotation file-read, giving SSH credentials. A localhost Webmin 1.996 is then exploited with its authenticated RCE (CVE-2022-36446), which runs as root, for a root shell.