Easy
Linux
Walla Writeup - Proving Grounds
Easy Linux box with a RaspAP panel behind basic auth. Default credentials and the CVE-2020-24572 command injection give a www-data shell, then a writable Python script runnable as root via sudo escalates to root.