Intentionally vulnerable Linux VM for pentest practice. Full chain: info-disclosure → .phtml upload-filter bypass (RCE) → credential reuse → sudo/GTFOBins privesc to root. Reproducible from source, build an x86 OVA or run natively on Apple Silicon (Lima).
file-upload penetration-testing rce web-security pentesting ctf ova lima privilege-escalation oscp gtfobins apple-silicon pentest-lab vulnerable-machine vulnerable-vm
-
Updated
Oct 28, 2026 - Shell