Brunner Mifflin (Root)
IT terminal creds + sudo NOPASSWD on /usr/bin/mail. GTFOBins payload spawns a root shell for the flag.
$ Boot2Root
Brunner Mifflin (User)
IDOR + broken access control in an HR web app. Manipulate a client-side role in localStorage to unlock admin access and grab the flag.