Zero-Day-Legacy

🎓 Graduation Project — Ajloun National University (ANU)
Faculty of IT · Cybersecurity and Cloud Computing · Academic Year 2026
🏆 Highest Grade in the University: 97%

📖 Overview

Zero-Day Legacy is a realistic, intentionally vulnerable Boot-to-Root CTF (Capture The Flag) lab machine built as a graduation project at Ajloun National University. It simulates a complete hospital management system — Royal Health Hospital — containing a full real-world attack chain across multiple vulnerability classes.

The attacker plays the role of a patient who cannot afford a hospital bill and decides to hack the system from within the internal network. Starting with basic reconnaissance, the attacker must chain 17 steps from initial web access to full root compromise — mirroring a real-world penetration test.

⚠️ This machine is intentionally vulnerable for cybersecurity education. All vulnerabilities are by design. Run only in an isolated local network. Never deploy on a public-facing server.

⬇️ Download the Machine

Setup in 3 Steps

# 1. Import into VirtualBox
File → Import Appliance → select the .ova file
# 2. Set Network Adapter
Settings → Network → Adapter 1 → Bridged Adapter
# 3. Discover the machine IP from Kali Linux
sudo netdiscover

🎯 Attack Scenario

A patient at Royal Health Hospital receives an invoice he cannot afford.
He's connected to the hospital's internal network and decides to hack the system.
From there — the clock is ticking.

🛠️ Technology Stack

🖥️ VM Specifications

OS:          Ubuntu Server 20.04.6 LTS — kernel 5.4.x (vulnerable to CVE-2021-3493)
vCPU:        1
RAM:         1 GB
Storage:     2 GB
Network:     Bridged Adapter — gets real IP from local router
Services:    Apache (80) · OpenSSH (22) · MySQL (3306 — local only)
Bilingual:   Arabic + English on all pages

📁 Documentation

👥 Development Team

🏆 Academic Achievement

╔═══════════════════════════════════════════════════════════╗
║       🏆  HIGHEST GRADE IN THE UNIVERSITY: 97%           ║
║                                                           ║
║    Ajloun National University — Graduation Project        ║
║    Faculty of IT — Cybersecurity & Cloud Computing        ║
║    Academic Year: 2025–2026                               ║
╚═══════════════════════════════════════════════════════════╝

⚖️ Ethical & Legal Disclaimer

This project was developed exclusively for academic and educational purposes at Ajloun National University.

• All vulnerabilities are intentional and controlled by design
• Run only in an isolated VirtualBox environment on a local network
• NEVER deploy on a public internet-facing server
• All patient data is fictional and generated for the CTF
• By using this machine, you agree to use it only in authorized, controlled environments for educational purposes