Copilotfree, in-browser
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
A beginner VulnHub box built on an outdated CMS. Recon to root, honestly.
DC-1 is a small Linux VM built to teach the loop that never changes. It puts a dated content management out front, and everything flows from there: enumerate the box, fingerprint the CMS, match its version to a public , a , then escalate. No trick puzzles, just recon and attention to version numbers.
Your two objectives here: get a foothold through the CMS and read the user flag (user), then escalate to a shell and read the root flag (root).
This VM runs entirely on your own hypervisor, on an isolated lab . That is what makes attacking it legal. Keep it off any network you do not , and never point these techniques at a system you do not own.
Bring-your-own-VM boxes use proof revealed through the hints once you have genuinely completed the objective. Do the work on the target, then submit the token. Phase B hosted machines will issue real per-instance flags planted on the box.
VulnHub mirrors change over time. Open the entry linked in the setup panel, grab the current download, and verify the checksum if one is published before you import. Boot the VM on your lab network, then find it from your attacker box.
Work it yourself first. The hints are here when you are genuinely stuck, and each one costs points, so earn them.
Download the VulnHub image, import it into your hypervisor (UTM / VirtualBox / VMware), and boot it on a host-only or NAT network.
Find the target IP on your network
$sudo netdiscover -r 192.168.56.0/24