[{"content":"-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEaSdBdhYJKwYBBAHaRw8BAQdAh2kwAXQy40gR4IWAj3gKmwqWCRsS/AIfC7il oAbkYqq0OkNlbHNvIFZpbmljaXVzIEZyYW5jbyBGZXJyZWlyYSA8Y2Vsc292aW5p Y2l1cy5mQGdtYWlsLmNvbT6ImQQTFgoAQRYhBMyanyRHMbyoZpVZMAX4+Hfrt/tt BQJpJ0F2AhsDBQkFpJZKBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEAX4 +Hfrt/ttb+UBALuCfiF13BYYbjI3N4iHM7qlK4shuvM1n15rfb+02viRAQDZ3jLe FMvENcY+qDSbCYbAMywV2w8fJ6I9CLsePWiQCrg4BGknQXYSCisGAQQBl1UBBQEB B0A7bD7Pt/oQSQqViA6+SOl6XrPdp+d+7puF3PBatiZYNAMBCAeIfgQYFgoAJhYh BMyanyRHMbyoZpVZMAX4+Hfrt/ttBQJpJ0F2AhsMBQkFpJZKAAoJEAX4+Hfrt/tt cfsBAMq1E6JH74UgijmkvcG/uBm59XSLGYTL9v79XC67ug6wAP4naFt+ifVlkDud 9mkgqFMuiUIIx0UcC6iMKr/rFrvWCg== =iMs2 -----END PGP PUBLIC KEY BLOCK----- ","date":"08 August 2026","externalUrl":null,"permalink":"/pgp-key/","section":"ViiniFX's Blog","summary":"","title":"PGP Key","type":"page"},{"content":"","date":"08 August 2026","externalUrl":null,"permalink":"/","section":"ViiniFX's Blog","summary":"","title":"ViiniFX's Blog","type":"page"},{"content":"","date":"08 August 2026","externalUrl":null,"permalink":"/posts/","section":"Posts","summary":"","title":"Posts","type":"posts"},{"content":" Good morning # It\u0026rsquo;s a nice day to be a security researcher, malware developer, or just a cybercriminal. When your job has became just plug and play your campaign, without a need to do any research, just use and abuse the work that Nightmare has done (which has been CRAZY imo).\n","date":"08 August 2026","externalUrl":null,"permalink":"/posts/rogueplanet/","section":"Posts","summary":"How NightmareEclipse managed to get a mixture of love/hate from security researchers, piss off Microsoft, make them speedrun a hotfix that make things even worse, then after the vulnerability was properly patched, NightmareEclipse shows another ace up his sleeves. Read this blog to find out about the new 0-day ShieldBreak","title":"Rogue Planet","type":"posts"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/tags/command-injection/","section":"Tags","summary":"","title":"Command-Injection","type":"tags"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/tags/exploit.education/","section":"Tags","summary":"","title":"Exploit.education","type":"tags"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/categories/hacking/","section":"Categories","summary":"","title":"Hacking","type":"categories"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/education/","section":"Learning Material","summary":"","title":"Learning Material","type":"education"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/education/nebula/","section":"Learning Material","summary":"Walkthroughs for exploit.education’s Nebula wargame — privilege escalation, one level at a time: SUID abuse, PATH hijacking, and command injection.","title":"Nebula","type":"education"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/series/nebula/","section":"Series","summary":"","title":"Nebula","type":"series"},{"content":"Following the train of thought of the past exercise, we can read in the code of the file /home/flag02/flag02 that it is reading a variable:\nasprintf(\u0026amp;buffer, \u0026#34;/bin/echo %s is cool\u0026#34;, getenv(\u0026#34;USER\u0026#34;)); printf(\u0026#34;about to call system(\\\u0026#34;%s\\\u0026#34;)\\n\u0026#34;, buffer); system(buffer); and also using it in the system() call. We can dissect the buffer:\nThe $USER variable is being called, so when you run the program, it prints:\nbecause the default is set to the username, but if we set the variable before the actual program we can see how it calls it:\nit transforms the variable into a string.\nThe buffer in the code is effectively \u0026quot;/bin/echo $USER is cool\u0026quot;, if we change the $USER variable to Hello\u0026quot;; ls\u0026quot;, the buffer can be translated to:\n\u0026#34;/bin/echo Hello\u0026#34;; ls \u0026#34;\u0026#34; so this means that the string will finish just before the echo by using the ;, thus enabling us to execute an arbitrary command echo in between the string.\nUsing that exploit we can use the command getflag and congrats, we can now proceed to the next level:\n","date":"04 April 2026","externalUrl":null,"permalink":"/education/nebula/nebula-level-02/","section":"Learning Material","summary":"Abusing an unsanitized $USER variable passed straight into system() to inject arbitrary commands and escalate to flag02.","title":"Nebula: Level 02","type":"education"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/tags/privilege-escalation/","section":"Tags","summary":"","title":"Privilege-Escalation","type":"tags"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"In operating systems, its often used a environment variable called PATH, this variable ensures that the programs have their path loaded in the memory so that you don\u0026rsquo;t have to type the full path to run it.\nFor example we have many programs in the folder /usr/bin/, these programs include echo, find, ls, and many more. So to run all of the binaries without having to type the absolute path every time, we just add the folder to the PATH: PATH=/usr/bin/, and if we have more programs on others folder, we can add it there too, using : as a way to separate them, PATH=/usr/bin:/usr/jdk.\nHowever, the catch is: PATH will always be read from the left to right, creating priorities to the first listed folders, in practice this can be also described:\nLets say we have 2 calculators binaries, but in different folder, but both folders are in the PATH: /usr/bin/calc and /bin/calc and $PATH=/usr/bin:/bin\nCalculator will be executed from the folder /usr/bin because it was set before the /bin.\nSo if we take a closer look at the C program given by the exercise:\n#include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026lt;sys/types.h\u0026gt; #include \u0026lt;stdio.h\u0026gt; int main(int argc, char **argv, char **envp) { gid_t gid; uid_t uid; gid = getegid(); uid = geteuid(); setresgid(gid, gid, gid); setresuid(uid, uid, uid); system(\u0026#34;/usr/bin/env echo and now what?\u0026#34;); } We can see that system(\u0026quot;/usr/bin/env echo and now what?\u0026quot;) checks the /usr/bin/env for the binary echo, and that file will be set by who\u0026rsquo;s running the program, so we are user level01 and our env file can be modified, therefore enabling us to exploit that program to run other binaries.\nBut that alone isn\u0026rsquo;t enough to escalate privilege, but as we learned in the previous exercise LEVEL00, the SUID sets who runs the program, so the snippet:\ngid_t gid; uid_t uid; gid = getegid(); uid = geteuid(); setresgid(gid, gid, gid); setresuid(uid, uid, uid); shows us that the program will run as the SUID set in the binary.\nand if we run stat /home/flag01/flag01 it will show in its description:\nFile: flag01 Access: (4750/-rwsr-x --- ) Uid: (998/flag01) Gid: ( 1002/ leve101) giving the insight that the file will be run as flag01.\nSo we will exploit the env by creating a exploit called echo:\necho \u0026#34;Shell exploited\u0026#34; /bin/bash and saving it in our folder /home/level01/echo and using chmod +x /home/level01/echo to enable execution for all users then abuse of the env by exporting it to PATH, and putting it before the current PATH:\nexport PATH=\u0026#34;/home/level01:$PATH\u0026#34; then we run the program\n/home/flag01/flag01 and get access:\nthen we just run getflag and go next.\n","date":"04 April 2026","externalUrl":null,"permalink":"/education/nebula/nebula-level-01/","section":"Learning Material","summary":"Hijacking the PATH environment variable to trick a SUID binary into running our own echo and popping a root shell.","title":"Nebula: Level 01","type":"education"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/tags/path-hijacking/","section":"Tags","summary":"","title":"Path-Hijacking","type":"tags"},{"content":"The goal of this level is to find a Set User ID program that will run as the \u0026ldquo;flag00\u0026rdquo; account.\nSetuid is a Unix access rights flag that allow users to run an executable with the file system permissions of the executable\u0026rsquo;s owner.\nFor example the following executable:\n$ stat /usr/bin/passwd File: /usr/bin/passwd Size: 63736 Blocks: 128 IO Block: 4096 regular file Device: 801h/2049d\tInode: 2237 Links: 1 Access: (4755/-rwsr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) will be executed as root (Uid 0), no matter what the current user is. This allows un-privileged user to change their password by editing /etc/shadow (root owner) using passwd.\nNow going back to the challenge, we can use find to search for programs that have SUID by using the flag -perm -u=s, where the flag -perm checks for the file permission bits and -u=s defines that check to SPECIAL BIT (X000), so in short the command will bring any file that has a special bit, including SUID.\nNow joining everything, and piping errors to 2\u0026gt;/dev/null for better readability:\nfind / -perm -u=s 2\u0026gt;/dev/null OR\nfind / -perm 4000 2\u0026gt;/dev/null This is enough to find the file, but we can filter even more by using grep and passing the user flag00 as requested by the challenge.\nfind / -perm -u=s 2\u0026gt;/dev/null | grep flag00 ","date":"04 April 2026","externalUrl":null,"permalink":"/education/nebula/nebula-level-00/","section":"Learning Material","summary":"Finding a SUID binary owned by flag00 and abusing it to escalate privileges on exploit.education’s Nebula VM.","title":"Nebula: Level 00","type":"education"},{"content":"","date":"04 April 2026","externalUrl":null,"permalink":"/tags/suid/","section":"Tags","summary":"","title":"Suid","type":"tags"},{"content":"","date":"02 February 2026","externalUrl":null,"permalink":"/tags/osint/","section":"Tags","summary":"","title":"Osint","type":"tags"},{"content":" It\u0026rsquo;s easy to chase the narrative you want, not the truth. # Username/Email/IP # Username / handle reuse – search same handle on other sites; record all matches in one sheet\nLink/Name Comment Type UserSearch Cross-platform username search SaaS Holehe Email-based site registration check Software osint.rocks Automated username search SaaS BreachDirectory Breached username check SaaS Censys IP Search SaaS Shodan Internet General Search SaaS Have I been Pwned Email-based leak check SaaS MailCat Find existing email addresses Software Social Media Tools # Social graph signals \u0026gt; single posts – pull top 10 interactors and scan for repeated overlap\nLink/Name Comment Type InsE Instagram Email Extractor Chrome Plugin Castrick Connections Mapper SaaS GHunt Google Account Software Metadata # download file/photo, check EXIF or doc properties for names/emails\nLink/Name Comment Type ExifTool Read, write, edit metadata Software LeakIX Public Leak Detection/Finder SaaS Temporal \u0026amp; location patterns – log 10 most recent post times, compare to timezone map\nCross-platform redundancy # collect job titles from LinkedIn, Instagram captions, GitHub bio and compare\nLink/Name Comment Type Epieos Profile aggregation by email SaaS That’s them Reverse lookup for employment cross-check SaaS Skymem Email-based public data search SaaS Common recurring keypoints # Reuse of elements – see if matches appear elsewhere\nLink/Name Comment Type DorkSearch Pattern-based Google dorking SaaS UserSearch Keyword-based username scan SaaS Visual overlaps # match objects/backgrounds in photos, save side-by-side for reference\nLink/Name Comment Type TinEye External duplicate image detection SaaS Google Images SaaS Yandex External reverse image search SaaS Public records fill gaps # check local registry to confirm address; screenshot results with source date\nLink/Name Comment Type CriminalIP Asset/risk correlation SaaS That’s them Public records validation SaaS Social media OSINT – essential questions # What other accounts are linked? – search email/phone in reverse lookup; note matches\nLink/Name Comment Type Epieos Profile aggregation by email SaaS Holehe Email-based site registration check Software MailCat Find existing email addresses Software Who are the top interactors? # pull top 10 interactors and note overlaps in multiple posts\nLink/Name Comment Type InsE Instagram Email Extractor Chrome Plugin Which accounts are frequently co-tagged? # list all tagged accounts in last 20 posts and rank by frequency\nDo mutual connections span same domains? # tag each mutual as work, school, or hobby; see dominant group\nLink/Name Comment Type Castrick Connections Mapper SaaS FullHunt Domain Map SaaS Subdomain Finder Subdomain Mapper SaaS Are posts geotagged or show landmarks? # cross-check location tag with Google Maps Street View\nLink/Name Comment Type FOFA Geolocated asset mapping SaaS Google Maps External location verification SaaS Do timestamps show routines? # plot post times on a simple chart to find regular posting windows\nAre there employment or education cues? # collect company names, logos, school crests from images\nLink/Name Comment Type Hunter Domain Search Company role verification SaaS Netlas Organization-based discovery SaaS Do reverse-image searches find duplicates? # run top 5 profile pics through reverse image search, log matches\nLink/Name Comment Type ZoomEye Device mapping/finder SaaS Onyphe Image metadata analysis SaaS Google Images SaaS All tools/links: # Link/Name Comment Type CyberSec Tools Tools Binary Edge Threat intelligence platform SaaS BreachDirectory Breached username check SaaS Castrick Connections Mapper SaaS Censys IP Search SaaS CriminalIP Asset/risk correlation SaaS DorkSearch Pattern-based Google dorking SaaS Epieos Profile aggregation by email SaaS ExifTool Read, write, edit metadata Software FOFA Geolocated asset mapping SaaS FullHunt Domain Map SaaS GHunt Google Account Software Google Images SaaS Google Maps External location verification SaaS Grey Noise Scan noise intelligence SaaS Have I been Pwned Email-based leak check SaaS Holehe Email-based site registration check Software Hunter Domain Search Company role verification SaaS InsE Instagram Email Extractor Chrome Plugin LeakIX Public Leak Detection/Finder SaaS MailCat Find existing email addresses Software Netlas Organization-based discovery SaaS Onyphe Image metadata analysis SaaS osint.rocks Automated username search SaaS Packet Storm News Security tools and exploits News Shodan Internet General Search SaaS Skymem Email-based public data search SaaS Subdomain Finder SaaS That’s them Reverse lookup for employment cross-check SaaS TinEye External duplicate image detection SaaS UserSearch Cross-platform username search SaaS UserSearch Keyword-based username scan SaaS VX Underground Malware Library Tools Yandex External reverse image search SaaS ZoomEye Device mapping/finder SaaS ","date":"02 February 2026","externalUrl":null,"permalink":"/useful/osint-resources/","section":"Usefuls","summary":"A curated toolbox for OSINT investigations — username/email/IP lookups, social graph mapping, metadata, and reverse-image search, organized around verification questions instead of a flat link dump.","title":"OSINT Resources","type":"useful"},{"content":"","date":"02 February 2026","externalUrl":null,"permalink":"/useful/","section":"Usefuls","summary":"","title":"Usefuls","type":"useful"},{"content":"","date":"02 February 2026","externalUrl":null,"permalink":"/tags/forums/","section":"Tags","summary":"","title":"Forums","type":"tags"},{"content":" Established # These forums have been around for a significant period of time and are considered active. These are not vouched. These forums can suffer the same fate as breached, xss, and any of the others that have been seized. ramp4u and exploit both have registration fees to join.\nCommunity PAID? Category 🌐Exploit 🧅Exploit X hacking,leaks,malware 🌐Leakbase leaks 🌐RAMP 🧅RAMP X hacking,leaks,malware 🌐BHF 🧅BHF hacking,leaks Other Forums # Community Category 🌐ASCarding fraud 🌐Black Hat Pro Tools seo 🌐BlackHat World seo 🌐BreachStars leaks,hacking 🌐Crackia leaks,hacking 🌐CrackingX leaks,hacking 🌐Crd Crew fraud 🌐CrdPro fraud 🧅CryptBB hacking 🌐Cyberforum RU leaks,hacking 🌐Cyber Nulled hacking 🌐DarkStash fraud 🌐Demon Forums hacking,leaks 🧅DamageLib hacking 🌐Darkforums leaks 🌐Enclave fraud 🌐ExeTools development 🌐EZ Carder fraud 🌐Go4Expert development 🌐Indetectables hacking 🌐LeakZone hacking 🌐LeakedBB leaks 🌐Legit Carder fraud 🌐Legit Carders fraud 🌐Lolz Forum leaks,hacking 🌐Memory Hackers hacking 🌐Niflheim hacking,fraud 🌐Noirth leaks,hacking 🌐Nsane Forums development 🌐Patched hacking, cracking 🌐Voided hacking, cracking 🌐Piratehub hacking 🌐RomHacking hacking 🌐RST Forums hacking 🌐Sinisterly hacking 🌐SEO Pirat seo 🌐SoldierX hacking 🌐SzeneBox hacking 🌐TurkHacks hacking 🌐Underc0de hacking 🌐Valid Market fraud 🌐Wilder Security hacking 🌐YouHack hacking,fraud 🌐NulledBB cracking ⚠️ Dangerous # Community Reason 🌐Nulled Owner arrested, seized. 🌐Cracked 🌐Cracked Owner arrested, seized. Live again but no effort to protect users. 🌐XSS Owner arrested, seized. Former staff have started their own community (DamageLib) 🌐Breach Forums 🌐Breach Forums Owners arrested, seized. Turned into a honeypot by French authorities. 🌐Altenens Notorious forum where owner and staff constantly scam their own users out of money. 🌐HackForums Famous honeypot forum. Blocks VPN/Tor and forces users to use a unique IP. ","date":"02 February 2026","externalUrl":null,"permalink":"/useful/hacking-forums/","section":"Usefuls","summary":"A running list of hacking, leak, and carding forums — which are established, which are just noise, and which are dangerous honeypots to avoid.","title":"Hacking Forums","type":"useful"},{"content":"","externalUrl":null,"permalink":"/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"}]