VulnHub Writeups

Offline vulnerable VMs for OSCP preparation and pentesting practice

💽

VulnHub

Downloadable offline VMs — perfect for network-level pentesting, OSCP prep, and practicing without internet-connected environments.

OSCP Prep 25+ VMs Offline

Machine List

🐧

Basic_Pentesting_1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Basic_Pentesting2

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Corrosion2

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

BassamCTF

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

BORN2ROOT_2

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

CengBox

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Chill_hack

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

CK-00

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Clover_1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Cofeeaddicts

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Connect-The-Dots

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

djinn_2

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

driftingblues_7

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

doubletrouble

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Dripping_blues

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Durian

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Election

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Empire Lupin One

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

EVILBOX_ONE

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Funbox_Lunchbreaker

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Gaara

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Gigachad_vh

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

HACK ME PLEASE

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

HACKATHONCTF2

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Hackeable ll

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Hacksudo_Aliens

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Ica1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Jangow

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Jetty

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

LiterallyVulnerable

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Masashi

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

MINU_1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Momentum

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

MoneyBox

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Monitoring

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Noob

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Odin

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Photographer

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Prime_2

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

PYLINGTON

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

RootThis_1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Seppuku

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

shenron-3

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Shuriken_1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

So_simple_1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Stapler

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Sumo

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

SUNSET_DUSK

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Symfonos_1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

System_failure

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Thales

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

THOTH_TECH_1

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

unknowndevice64

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Vikings

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

ColddBoxEasy_EN

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

KB-VULN3

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Funbox_CTF_4

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

NASEF_1 LOCATING TARGET

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

NiveK

DHCP
VulnHub Challenge - Initial access vector & privilege escalation details
EasyWriteup →
🐧

Mr. Robot

DHCP
WordPress brute-force → reverse shell → SUID nmap → root
EasyWriteup →
🐧

Kioptrix Level 1

DHCP
OpenSSL 0.9.6 exploit (ptrace-kmod) · remote buffer overflow → root
EasyWriteup →
🐧

DC-1

DHCP
Drupalgeddon2 (CVE-2018-7600) → SUID find → root
EasyWriteup →
🐧

HackLAB: Vulnix

DHCP
NFS root squash bypass → SSH key injection → sudo su
MediumWriteup →
🐧

SkyTower

DHCP
SQL injection in login → SSH through proxy → multiple privesc steps
MediumWriteup →
🐧

PwnLab: init

DHCP
PHP LFI → log poisoning → file upload bypass → SUID binary privesc
HardWriteup →
🐧

Raven 2

DHCP
PHPMailer RCE (CVE-2016-10033) → MySQL UDF root exploitation
HardWriteup →