Nebula

Finding a SUID binary owned by flag00 and abusing it to escalate privileges on exploit.education’s Nebula VM.

Hijacking the PATH environment variable to trick a SUID binary into running our own echo and popping a root shell.

Abusing an unsanitized $USER variable passed straight into system() to inject arbitrary commands and escalate to flag02.