• Flags: 3 (local.txt, user.txt & root.txt)
  • Difficulty Level: Initial Shell (Easy) - Privileges Escalation (Intermediate)
  • Website: https://ebryx.com
  • Hint: Maybe, you hasted and left some open holes unchecked?

Literally Vulnerable is supposed to give beginners a taste of real-world scenarios and OSCP machines at the same time! It was inspired highly by the @DC series.

You're supposed to know the big three (EEEs) Enumeration, Exploitation & Escalation of pentesting to pwn the machine. The machine is supposed to be beginner-friendly and the difficulty level is Easy-Intermediate depending on your knowledge. You need to have enough information about Linux file types & permissions for privileges escalation.

Technical Information:

  • Just download, extract and load the .vmx file in VMware Workstation (tested on VMware Workstation 15.x.x)
  • The adapter is currently NAT, networking is configured for DHCP and IP will get assigned automatically


  • You can either contact me on twitter @syed__umar or linkedin (/in/syedumararfeen/) for hints!

There are three flags in the machine: local.txt, user.txt & root.txt. You're supposed to grab all three in order to completely pwn the machine. Hope you like the machine, best of luck! :)

I'll try my best to continue with the series!

Description: Have fun!

Difficulty: Beginner

Contact: @whitecr0wz


MyExpense is a deliberately vulnerable web application that allows you to train in detecting and exploiting different web vulnerabilities. Unlike a more traditional "challenge" application (which allows you to train on a single specific vulnerability), MyExpense contains a set of vulnerabilities you need to exploit to achieve the whole scenario.


You are "Samuel Lamotte" and you have just been fired by your company "Furtura Business Informatique". Unfortunately because of your hasty departure, you did not have time to validate your expense report for your last business trip, which still amounts to 750 € corresponding to a return flight to your last customer.

Fearing that your former employer may not want to reimburse you for this expense report, you decide to hack into the internal application called "MyExpense " to manage employee expense reports.

So you are in your car, in the company carpark and connected to the internal Wi-Fi (the key has still not been changed after your departure). The application is protected by username/password authentication and you hope that the administrator has not yet modified or deleted your access.

Your credentials were: samuel/fzghn4lw

Once the challenge is done, the flag will be displayed on the application while being connected with your (samuel) account.


If you need to restore the database : go to http://IP/config/setup.php

Description: Here is another one, enjoy.

Difficulty: Beginner

Contact: @whitecr0wz

Difficulty : Easy to Intermediate

Flag : 2 Flag first user And second root

Learning : Web Application | Enumeration | Password Cracking

Difficulty : Intermediate

Flag : Need to get root to read flag (root.txt)

Learning : Exploit | Web Application | Digital Forensics | Enumeration | Privilege Escalation

DHCP enabled

Welcome to Fsoft Hacking Labs !

If during boot, you notice Apache error. Please wait one minute then reboot. Labs are designed to destroy themselves when you exploit them incorrectly - Please create a snapshot of yourself.

Good luck to you as well !

Akasafe Team - FSOFT

Difficulty : Easy to Intermediate

Flag : 2 Flag first user And second root

Learning : exploit | Web Application | Enumeration | Privilege Escalation

Website : www.hackNos.com

mail : [email protected]

Level: Beginner - Intermediate

Description: Built/Tested with VirtualBox. DHCP enabled. Need to get root to read flag

WTF: 1

pwn4magic 22 Nov 2019

beginner - intermediate machine, your goal is to read /root/flag.txt.

Remember, good enumeration! VMware based, you may have problems with VB.

Tempus Fugit is a Latin phrase that roughly translated as “time flies”.

This is an hard, real life box, created by @4nqr34z and @theart42 to be used as a CTF challenge on Bsides Newcastle 23. november 2019 and released on Vulnhub the same day.

In Tempus Fugit 3, the idea is still, like in the first two challenges; to create something “out of the ordinary”.

The vm contains 5 flags. If you don’t see them, you are not looking in the right place...

Need any hints? Feel free to contact us on Twitter: @4nqr34z or @theart42


Tested both on Virtualbox and vmware

Health warning: For external use only