Rooted,
I have to say very good box, never had to try VARS while doing initial recon and I’ve learn new trick, with the access and then exploit again if you do your research correctly, understand whats running on the server and how two trigger RCE it’s downhill from there. Very much a real-life pen testing skills, recon and understanding of the platform is the key. Very well down to the author.