Nebula on ViiniFX's Bloghttps://blog.franco.ie/education/nebula/Recent content in Nebula on ViiniFX's BlogHugo -- gohugo.ioen© 2026Mon, 13 Apr 2026 18:20:00 +0100Nebula: Level 02https://blog.franco.ie/education/nebula/nebula-level-02/Mon, 13 Apr 2026 18:20:00 +0100https://blog.franco.ie/education/nebula/nebula-level-02/Abusing an unsanitized <strong>$USER</strong> variable passed straight into <code>system()</code> to inject arbitrary commands and escalate to <code>flag02</code>.Nebula: Level 01https://blog.franco.ie/education/nebula/nebula-level-01/Mon, 13 Apr 2026 18:10:00 +0100https://blog.franco.ie/education/nebula/nebula-level-01/Hijacking the <strong>PATH</strong> environment variable to trick a SUID binary into running our own <code>echo</code> and popping a root shell.Nebula: Level 00https://blog.franco.ie/education/nebula/nebula-level-00/Mon, 13 Apr 2026 18:00:00 +0100https://blog.franco.ie/education/nebula/nebula-level-00/Finding a <strong>SUID</strong> binary owned by <code>flag00</code> and abusing it to escalate privileges on exploit.education&rsquo;s Nebula VM.