I rooted host DC02 on The Virtual Hacking Labs. A bunch of ways in but following the path they lay out taught me a lot, and it was rough. I highly suggest you do everything they have to offer @vhackinglabsvirtualhackinglabs.com
I rooted host NCM01 on The Virtual Hacking Labs, don't know if it was the intended way but took me about 3 minutes total to get root @vhackinglabsvirtualhackinglabs.com
I rooted host CMS02 V2 on The Virtual Hacking Labs, that one was fun and was a lot like some of the vulnerable machines I have made on vagrant @vhackinglabsvirtualhackinglabs.com
That was fun, especially how the machines work with one another. And yes, got stable shell...
I rooted host NAS on The Virtual Hacking Labs @vhackinglabsvirtualhackinglabs.com