My first time playing with a RemoteApp, and it really wasn't isolated like it should be

Try harding an internal path traversal until it leaked every user's data

One little header to drop the whole firewall, then a nice chain all the way to RCE

Starting from a site that looked totally empty, and ending up with a nice RCE