wkt21/vaultbreaker

VaultBreaker is an intentionally vulnerable training environment built to mimic challenges found on penetration testing platforms like Hack The Box. It is written in PHP and ships in two interchangeable formats: a Docker setup for quick deployment, and a full bootable virtual machine image for VirtualBox or VMware. The difficulty is rated easy, and the challenge spans web and Linux privilege escalation skills. The goal is to capture three flags in sequence. The first flag requires exploiting a local file inclusion bug in a document viewer to read a protected file. The second flag involves leaking the application configuration and SQLite database through that same bug, then cracking an administrator password hash to log into an admin console. The third flag asks the attacker to abuse the admin file upload feature to deploy a PHP reverse shell, then use sudo misconfiguration to gain root access and read the final flag. The repository contains the vulnerable web application, the flag files, a PHP reverse shell payload, and build scripts for generating the OVA image. Documentation includes a full worked solution and a guide for importing and networking the virtual machine. The OVA build process requires a Linux host with tools like debootstrap and QEMU utilities to construct the image from source. For instructors, the README lists every flag value, the administrator password, and console credentials. It also provides a vulnerability summary mapping each step to a corresponding Common Weakness Enumeration identifier. The intended learning path covers file inclusion, password cracking, unrestricted file upload, and sudo privilege escalation. The project is meant for educational use only. The README warns that the image is deliberately insecure and should be run in isolation, never on untrusted networks. The virtual machine allows root login over SSH for convenience, which should be hardened before broader deployment.