Lupin 1 — VulnHub CTF Walkthrough

Lupin 1 — VulnHub Walkthrough

Goal: gain root on the Lupin 1 VM (learning path: recon → web enumeration → RCE → priv-esc).
Author: Shivam Pakade
Completed on: 2025-11-08

This guide documents lab-only steps. Only apply tests to machines you own/have permission to test.

---

Table of contents

1. Lab setup
2. Discovery & Recon
3. Port & service enumeration (nmap)
4. Web enumeration & vulnerability discovery
5. Initial access — getting a shell
6. Privilege escalation to root
7. Proof & cleanup

---

Lab setup

• Attacker: Kali Linux (example IP: 192.168.120.138)
• Target: Lupin 1 VM
• Ensure host-only / NAT network and snapshots before testing.

---

Discovery & Recon

Start with network discovery to find the VM IP:

netdiscover -r 192.168.120.0/24

Example banner:

---

Port & service enumeration (nmap)

Run:

nmap -sS -sV -O -T4 192.168.120.136 -oN scans/lupin_nmap.txt

Example output:

22/tcp   open  ssh
80/tcp   open  http
631/tcp  open  ipp

---

Web enumeration & vulnerability discovery

gobuster dir -u http://192.168.120.136 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt

Discovered a secret.txt file:

Found a private key:

Cracked the password:

---

Initial access — getting a shell

Login via SSH:

ssh -i id_rsa user@192.168.120.136

Decoded cipher file:

Spawn a stable shell:

python3 -c 'import pty; pty.spawn("/bin/bash")'

---

Privilege escalation to root

sudo -l
find / -perm -4000 -type f 2>/dev/null

Escalation clue:

Root flag location:

Root flag proof:

---

Proof & cleanup

whoami
id
cat /root/root.txt

---