What is vuln_hmv?
vuln_hmv is a terminal-first CLI for HackMyVM that replaces browser interaction entirely. It browses all published machines, compares them against your local VM library, resolves MEGA download links, submits flags, and shows the live leaderboard — in one unified command.
Works seamlessly as the data-source companion for mega-download-cli.
Installation
git clone https://github.com/vulnquest58/vuln_hmv.git
cd vuln_hmv
chmod +x setup.sh
./setup.sh
What setup.sh does
| Step | Action |
|---|---|
| ① | Verifies Python 3.8+ is present |
| ② | Installs requests, beautifulsoup4, rich, urllib3 via pip |
| ③ | Copies vuln_hmv.py → /usr/local/bin/vuln_hmv with sudo |
| ④ | Makes it executable and patches the shebang |
| ⑤ | Confirms the command is available in $PATH |
After install, vuln_hmv is available system-wide as a shell command.
Configuration
# Add to ~/.bashrc or ~/.zshrc
export HMV_USER=yourusername
export HMV_PASS=yourpassword
Credentials are never stored in the script — always read from environment variables.
Usage Guide
1 · List all VMs
vuln_hmv -v
╔══════════════════════════════════════════════════════════════╗
║ HackMyVM CLI Tool - Complete Edition ║
║ VMs • Challenges • Leaderboard • Labs • Submit Flags ║
╚══════════════════════════════════════════════════════════════╝
# Name Level Size Creator Status
──────────────────────────────────────────────────────────────
1 Milk Easy 1.2 GB tasiyanci ✅ Downloaded
2 Calculator Medium 2.1 GB tasiyanci 🔴 Missing
3 Nocturn Hard 3.8 GB cromiphi ⚡ To Hack
4 Quick Easy 980 MB sML 🔴 Missing
2 · List with local directory comparison
vuln_hmv -v -d /path/to/local/vms
Scans your directory for .zip / .7z files and automatically marks each VM as:
- ✅ Downloaded — archive present locally
- ⚡ To Hack — downloaded but flag not submitted
- 🔴 Missing — not yet downloaded
3 · Filter VMs
vuln_hmv -v --filter missing # only VMs not yet downloaded
vuln_hmv -v --filter easy # Easy difficulty only
vuln_hmv -v --filter tohacking # downloaded but unsolved
4 · Save MEGA links for batch download
vuln_hmv --save-links links.txt -d ~/VMs
Resolves the MEGA link for every missing machine and writes them to links.txt in the format expected by mega-download-cli:
# Milk [Easy] 1.2 GB
https://mega.nz/file/XXXXXXXX#YYYYYYY
# Quick [Easy] 980 MB
https://mega.nz/file/XXXXXXXX#YYYYYYY
5 · Submit a flag
vuln_hmv -s user.txt Milk
# ✅ CORRECT! Congratulations!
vuln_hmv -s root.txt Milk
# ✅ CORRECT! Congratulations!
6 · Leaderboard
vuln_hmv -l
Shows top 50 players with rank, username, points, and machines solved.
7 · Browse challenges
vuln_hmv -c
8 · View labs
vuln_hmv --labs
Options Reference
Mode selection (mutually exclusive):
-v, --vms List VMs with local comparison
-c, --challenges List all challenges
-l, --leaderboard Show leaderboard
--labs Show HMV Labs
-s FLAG VM Submit a flag
VM mode options:
-d DIR, --directory Local VM directory for comparison
-f, --filter all | missing | tohacking | downloaded | easy | medium | hard
--no-links Skip MEGA link resolution (faster listing)
--workers N Threads for parallel link resolution (default: 10)
--save-links [FILE] Export MEGA links of missing machines (default: links.txt)
Integration with mega-download-cli
The two tools form a complete VM acquisition pipeline:
# 1. Install both tools
git clone https://github.com/vulnquest58/vuln_hmv.git && cd vuln_hmv && ./setup.sh
git clone https://github.com/vulnquest58/mega-download-cli.git
# 2. Export links for all missing machines
vuln_hmv --save-links links.txt -d ~/VMs
# 3. Download them all via MEGA-CMD
python mega-download-cli/mega_download.py -f links.txt -d ~/VMs
# OR: download a specific machine in one command
python mega-download-cli/mega_download.py --hmv Milk -d ~/VMs
Tech Stack
| Library | Role |
|---|---|
requests |
HTTP session for HackMyVM auth and scraping |
beautifulsoup4 |
HTML parsing for VM metadata extraction |
rich |
Terminal UI — tables, panels, progress bars |
concurrent.futures |
Parallel MEGA link resolution |