@galile0

⬡ Hall of Fame

Joined 2026-04-23·43 days deployed

Global Rank
#5
of 633
My Certs
Operative Level27
2,680 XP to Level 28
20 / 2,700 XP this level1%
Points
35,120
Levels Solved
55
First Bloods
23
Security Score
305

Track Mastery

Ghost23 / 23★ Ghost Operative
Phantom32 / 32★ Phantom Operative
Specter0 / 140%

Trophy Case

Ghost Graduate
Phantom Operative
Specter Analyst
Specter Sovereign
First Blood×23
Track Complete×2
Ghost Top 10
Phantom Top 10
Specter Top 10
Specter Mystery — Solved

Speedruns

TrackTimeStatus
Ghost01:43:39—
Phantom60:10:03—

Security Contributions(305 score · 14 credits · separate from track points)

L30 su -s /bin/bash phantom30 bypasses the ephemeral redirectHigh+25
architectural bypass / ephemeral-shell circumventionbreachlab-phantom#712026-04-26
L28 /tmp/heist.flag persists across players on shared mgmt hostHigh+25
shared-host residue / chain-integrity bypassbreachlab-phantom#712026-04-26
L21/L22/L23 oracle HMAC missing in container-escape emulatorsHigh+25
oracle HMAC drift / silent emulator regressionbreachlab-phantom#692026-04-26
L20 history-residue free-flag bypassHigh+25
shared-account history residue / free-flag bypassbreachlab-phantom#682026-04-25
L17 Internal Hunt canonical solve broken — StrictModes + pam_unix lstchgHigh+20
2026-04-24
SUID-verify priv-esc via /etc/ld.so.preload + BASH_ENVCritical+30
2026-04-24
phantom-deep oracle stale-token UX gapLow+5
2026-04-24
L19 ops shell exposes L31 graduation targetMedium+10
2026-04-24
canonical-flags.ts leaked all track flags in public repoCritical+30
2026-04-24
mgmt container /opt/*.py world-readable exposes flag pipelineMedium+10
2026-04-24
L15 clean_flag is literal submit flagHigh+20
2026-04-24
history-clear bypass defeats verify-shadow LOUD regexHigh+20
2026-04-24
LD_PRELOAD on curl intercepts oracle token — cross-level forgeCritical+30
2026-04-24
L12 NOPASSWD:ALL universal skip vectorCritical+30
Class 17phantom#502026-04-24