I'm a bit late to the party on this one, but as the box has some interesting techniques involving XXE and a python pickle RCE vulnerability, I figured I would write it up just for my own notes.