VulnLab: Escape
Windows kiosk-style box breaking out through RDP and Edge file-system browsing, bypassing binary restrictions by renaming executables, recovering a password from Remote Desktop Plus, and elevating UAC through the GUI.