Write-ups from reconnaissance to root
pentest-lab-writeups
2025
nmap
ffuf
Metasploit
John
nmapffufMetasploitJohnWhat it is
Writeups of vulnerable machines solved end to end — each a full chain from recon to root, with the commands and the decision points. The lab ran in nested QEMU/KVM virtualization on an isolated network with no route outside.
The machines
01Mr Robot · daemon → robot → root
WordPress brute-force, a PHP reverse shell through the theme editor, root through SUID nmap in interactive mode.
02Kevgir · www-data → root
Joomla CVE-2008-3681, a meterpreter session, escalation through SUID cp used to overwrite /etc/passwd.
03Empire: LupinOne · icex64 → arsene → root
Hidden paths via ffuf, Base58, SSH-key cracking, a webbrowser.py overwrite and sudo pip.
These are public VulnHub images whose solutions have long been open — the point is not the flags but the reasoning between them.