One of the VMs used in the online CTF hosted back in September 2016 by Defcon Toronto, slightly modified to suit boot2root challenges.

Difficulty: Easy

Information: Overall 7 flags to collect, id 0 is the final step.


  • File: (ovf)
  • Date: September 2016
  • VM Type: Tested on VMware Workstation
  • Notes: If the VM was able to obtain a DHCP you will likely see the IP in the VM login prompt.
  • Networking: DHCP
  • Checksum[SHA256]: c42839feadc8077380e167af9639cfcf9ebe3ffed083c98aee1e7d453022af5d

For any issues you can shoot an email to: dolev at or DM me @dolevfarhi

d8888b. d8888b.  .d88b.  d888888b d88888b db    db .d8888.
88  `8D 88  `8D .8P  Y8. `~~88~~' 88'     88    88 88'  YP
88oodD' 88oobY' 88    88    88    88ooooo 88    88 `8bo.
88~~~   88`8b   88    88    88    88~~~~~ 88    88   `Y8b.
88      88 `88. `8b  d8'    88    88.     88b  d88 db   8D
88      88   YD  `Y88P'     YP    Y88888P ~Y8888P' `8888Y'

"A bacterium found in the intestines of animals and in the soil."

          Corporate Malware Validator.

An IT Company implemented a new malware analysis tool for their employees to scan potentially malicious files. This PoC could be a make or break for the company.

It is your task to find the bacterium.

Goal: Get root, and get flag... This VM was written in a manner that does not require wget http://exploit; gcc exploit.

NB: VMWare might complain about the .ovf specification. If this does come accross your path, click the retry button and all should be well.

MMMLAGOS is a vulnerable ponzing scheme with lot of vulnerabilities , the flags are high tech stenography Flag to be puzzled by player to solve critical challenge

twitter : @silexsecure

D0Not5top Boot2Root

This is my second public Boot2Root, It’s intended to be a little more difficult that the last one I made. That being said, it will depend on you how hard it is :D It's filled with a few little things to make the player smile.

Again there are a few “Red Herrings”, and enumeration is key.


There are 7 flags to collect, designed to get progressively more difficult to obtain


  • File: D0Not5top_3mrgnc3_v1.2.ova
  • OS: ?????
  • VM Type: VirtualBox
  • IP Address: DHCP
  • Size: 700 MB

SUPPORT Any support issues can be directed to [email protected]

Lab26: 1.1

Marius 27 Jun 2017

For a while now I've been maintaining a VM I with several vulnerable web apps already deployed:

  • bWAPP
  • Mutillidae (nowasp)
  • Web for Pentester I (from
  • DVWA
  • Django.nV
  • Google Gruyere
  • OWASP Juice Shop

The VM has Burp Suite free, chromium with a few extensions (including a proxy switcher) and sqlmap. The browser home page contains links to some exercises and walkthroughs.

User credentials:

root // password
tux // password


Hash: SHA512

Welcome to

  ___           _            ___          _
 |   \ ___ _ _ | |_____ _  _|   \ ___  __| |_____ _ _
 | |) / _ \ ' \| / / -_) || | |) / _ \/ _| / / -_) '_|
 |___/\___/_||_|_\_\___|\_, |___/\___/\__|_\_\___|_|
                             Made with <3 v.1.0 - 2017

This is my first boot2root - CTF VM. I hope you enjoy it. if you run into any issue you can find me on Twitter: @dhn_ or feel free to write me a mail to:

  • Email: [email protected]
  • GPG key: 0x2641123C
  • GPG fingerprint: 4E3444A11BB780F84B58E8ABA8DD99472641123C

Level: I think the level of this boot2root challange is hard or intermediate.

Try harder!: If you are confused or frustrated don't forget that enumeration is the key!

Thanks: Special thanks to @1nternaut for the awesome CTF VM name!

Feedback: This is my first boot2root - CTF VM, please give me feedback on how to improve!

Tested: This VM was tested with:

  • VMware Workstation 12 Pro
  • VMware Workstation 12 Player
  • VMware vSphere Hypervisor (ESXi) 6.5

Networking: DHCP service: Enabled

IP address: Automatically assign


77439cb457a03d554bec78303dc42e5d3074ff85  DonkeyDocker-disk1.vmdk
7013d6a7c151332c99c0e96d34b812e0e7ce3d57  DonkeyDocker.ovf

Looking forward to the write-ups!


Version: GnuPG v1


This Virtual machine is using ubuntu (32 bit)

Other packages used: -

  • PHP
  • Apache
  • MySQL

This virtual machine is having medium difficulty level with tricks.

One need to break into VM using web application and from there escalate privileges to gain root access

For any query ping me at

Enjoy the machine

Moria: 1.1

abatchy 29 Apr 2017
|                     Name: Moria                         |
|                       IP: Through DHCP                  |
|               Difficulty: Not easy!                     |
|                     Goal: Get root                      |
|                                                         |
| DESCRIPTION:                                            |
| Moria is NOT a beginner-oriented Boot2Root VM, it will  |
| require good enum skills and a lot of persistence.      |
|                                                         |
| VM has been tested on both VMware and VirtualBox, and   |
| gets its IP through DHCP, make sure you're on the same  |
| network.                                                |
|                                                         |
| Special thanks to @seriousblank for helping me create it|
| and @johnm and @cola for helping me test it.            |
|                                                         |
|     Link:    |
|     Size: 1.56GB                                        |
|      MD5: 2789bca41a7b8f5cc48e92c635eb83cb              |
|     SHA1: e3bddd4133320ae42ff65aec41b9f6516d33bb89      |
|                                                         |
| CONTACT:                                                |
| You can find me on NetSecFocus slack, twitter at        |
| @abatchy17 or occasionally on #vulnhub for questions.   |
|                                                         |
| PS: No Lord of The Rings knowledge is required ;)       |
|                                                         |
| -Abatchy                                                |




Welcome to Super Mario Host!

This VM is meant to be a simulation of a real world case scenario.

The goal is to find the 2 flags within the VM. Root is not enough (sorry!)

The VM can be exploited in various ways, but remember that Enumeration is the key.

The level of the challenge is Intermediate.

Thanks to vdbaan, kltdwd, mrb3n and GKNSB for testing.

Welcome to another boot2root / CTF this one is called Analougepond. The VM is set to grab a DHCP lease on boot. I've tried to mix things up a little on this one, and have used the feedback from #vulnhub to make this VM a little more challenging (I hope).

Since you're not a Teuchter, I'll offer some hints to you:

Remember TCP is not the only protocol on the Internet My challenges are never finished with root. I make you work for the flags. The intended route is NOT to use forensics or 0-days, I will not complain either way.

To consider this VM complete, you need to have obtained:

  • Troll Flag: where you normally look for them
  • Flag 1: You have it when you book Jennifer tickets to Paris on Pan Am.
  • Flag 2: It will include a final challenge to confirm you hit the jackpot.
  • Have root everywhere (this will make sense once you're in the VM)
  • User passwords
  • 2 VNC passwords

Best of luck! If you get stuck, eat some EXTRABACON

NB: Please allow 5-10 minutes or so from powering on the VM for background tasks to run before proceeding to attack.


  • v0.1b - Initial Version
  • v01.c - Fixes for flags based on feedback from mrB3n
  • v0.1d - Fixes based on shortcut to intended route
  • v0.2a - Fixes and clean up of disks for smaller OVA export
  • v0.2b - Small edit to remove copy of flag in wrong folder

SHA1SUM: D75AA2405E2DFB30C1470358EFD0767A10CF1EB1 analoguepond-0.2b.ova

Many thanks to mrB3n, Rand0mByteZ and kevinnz for testing this CTF.

A special thank you to g0tmi1k for hosting all these challenges and offering advice. A tip of the hat to mrb3n for his recent assistence.