This box pushed me out of my powershell comfort zone.
Foothold
There is already a wealth of information in this thread about it. Once you find the CVE and the accompanying script foothold is straight foward. Focus on the command that facilitate RCE. If your cat is not pleased use another.
User and Foot
Lots of enum but focus on things that you were not meant to see. This will contain gems that would open doors. The door in question here would have been the very first time you checked out when you started out on this box.
Once in see how you can run commands from here.
Flags are encrypted but there is a provision to be able to view the plain text version.
PM for a nudge