BuffEasy Windows box exploiting Gym Management Software RCE then a CloudMe buffer overflow for PrivEsc.