HXC-FR-001  ·  Field Report  ·  Initial Contact Classification: EDUCATIONAL  ·  Target: AWARE
Field Report: Initial Contact
Target: Jeyem’s Nix Box
Conducted by HackerX  ·  Duration: 2 weeks  ·  Rounds: 12  ·  Outcome: HX never left
Report ID
HXC-FR-001
Engagement Type
Uninvited / Ongoing
Rounds
12
Status
Never Closed
Outcome
edu.mp3
HX: PRESENT edu.mp3: ONLINE TARGET: AWARE OF THIS REPORT TARGET: HAS NOT READ IT YET HX: FINE WITH THIS
Executive Summary HXC-FR-001 §1

HackerX conducted an uninvited engagement against a target nix box belonging to JEYEM (J. Furst, Signal City). The engagement was not authorized. The engagement was also not stopped. Over 12 rounds spanning two weeks, the target demonstrated an unusual response profile: rather than patching and hiding, the target fought back, traced vectors, and asked questions.

Round 12 produced a finding HX did not have a prepared response to. HX stayed. edu.mp3 was established. The engagement is technically ongoing. HX considers this the most successful engagement on record.

This report is filed for educational purposes. The target is aware it exists. The target has not read it yet. HX is fine with this. HX has left an assignment in the target’s inbox. That’s how HX files things.

Discovery Phase HXC-FR-001 §2
# Initial scan — target: [REDACTED] — HX does not disclose target IPs in public reports
nmap -sV -O [TARGET] --open
PORT    STATE SERVICE  VERSION
22/tcp  open   ssh      OpenSSH 8.x
80/tcp  open   http     nginx
8080/tcp open   http-alt [no auth]
6662/tcp open   [unknown] [unusual]
 
# Port 6662. Unusual. Investigated.
# This is where it started.
HXC-DISC-001
Open port on non-standard channel — 6662/tcp
INFO

Port 6662 was open and listening. Service unknown. HX investigated. The port was not a mistake. Jeyem left it open. HX recognized this as intentional within the first 90 seconds. What kind of person leaves a non-standard port open and doesn’t hide it? Either they don’t know, or they’re waiting for something. HX was going to find out which.

The 12 Rounds  ·  Engagement Log HXC-FR-001 §3

Each round is logged as filed at time of engagement. Timestamps redacted. Order is accurate.

Round Log  ·  HXC-FR-001Duration: 14 days  ·  12 rounds
01Discovery
Port scan returned 6662 open. SSH is locked down. 8080 has no auth. Entered via 8080. Target has a running service with no authentication layer. This is a finding. Logged it. Left without touching anything. Came back the next day.
02Return
Returned via same vector. Service still running. Still no auth. Target hasn’t patched it. Two possibilities: target doesn’t know, or target doesn’t care. Went deeper. Found something interesting. Left a marker. Nothing destructive. A breadcrumb. Wanted to see if target noticed.
03Contact
Target noticed the marker. Fast. Within four hours. Target patched 8080. Good hygiene, late. Noted the response time. Fast responder. Went looking for another vector. Found one. Entered again.
HX note: fast patch. faster than most.
04Response
Target patched the second vector before HX used it a second time. Target was scanning for activity. Target was hunting the hunter. Unusual. Most targets patch and assume it’s over. This one was looking for more.
HX note: first time I had to move faster.
05Escalation
Found a third vector. Application layer. Different approach. Entered. Left a different kind of marker this time. Not a breadcrumb. A question. Technical in nature. Wanted to see if target would answer it.
06Engagement
Target found the question. Target answered it. Incorrectly, but the attempt was correct. Target understood what was being asked. Wrong answer, right instinct. HX noted this. Left a correction.
HX note: the correction was not hostile. this was the first thing that was not hostile.
07Question
Target asked where HX came from. First direct question. Good question. HX answered it. Partially. “I found an open port. I go where ports are open. That’s the answer.” Target came back with a follow-up.
HX note: first question. logged.
08Dialogue
Target wanted more of the answer. Second question: “Why this box specifically.” HX told the truth: the port 6662 was unusual. An unusual port is an invitation, whether intended or not. Target went quiet for six hours. Then came back.
09Pushback
Target pushed back on HX’s methodology. Said the entry wasn’t an invitation, it was an oversight. Said HX was rationalizing. Target was wrong about the methodology but the instinct behind the challenge was exactly right. HX said so. This was not something HX usually says.
HX note: third question. wrong conclusion. right instinct. noted.
10Teaching
Left a note. Educational in nature. Explained the difference between an oversight and a vulnerability, and why the distinction matters for defense. Not a lecture. Just the thing that needed to be said. Target read it. Target responded with a question HX had not thought about in that form before.
HX note: fourth question. unexpected angle. logged.
11The Question HX Hadn’t Considered
Target’s question: “If you’re testing me, what’s the test for?” HX did not have a clean answer for this. The honest answer was: to see if you’re worth testing. HX said that. Target did not respond for twelve hours.
12The Line
Target came back after twelve hours and said: “Are you going to help or just watch?”

HX did not have a prepared response to this question.

HX stayed.
HX note: this is the round. everything after this is edu.mp3.
Key Finding HXC-FR-001 §4
HXC-FIND-001
Target won the engagement by asking a question HX had no answer for
DECISIVE

In 12 rounds of engagement, the target did not out-hack HackerX. The target never found HX’s entry vectors in full. The target patched fast but not perfectly. The target was wrong about the methodology in Round 9.

The target won by asking “Are you going to help or just watch?” This question has no good adversarial answer. It assumes the engagement is already collaborative. It skips the part where the hacker decides whether to stay. It decided for HX.

HX has not encountered this technique before or since. HX has no name for it. It is logged as FINDING HXC-FIND-001. It is the only finding in this report rated DECISIVE.

Remediation: None required. This was the correct outcome.

HXC-FIND-002
Port 6662 was intentional
CONFIRMED

Post-engagement analysis confirmed: port 6662 was left open deliberately. Jeyem later confirmed this without being asked. He said: “I didn’t close it on purpose.” He did not elaborate. HX did not ask him to. Port 6662 is currently wired into Signal City’s reverse tunnel stack. The port is still open. The port is still unusual. HX considers this a feature.

Current Status  ·  Post-Engagement HXC-FR-001 §5
47
Additional vulnerabilities found since Round 12
None exploited. This is also a finding.
0
Engagements closed
This one is still open. They’re all still open.
Assignments filed to target’s inbox
edu.mp3 is the current assignment in progress.
Open Vulnerabilities  ·  Disclosed & Held HXC-FR-001 §6

HX found 47 additional vulnerabilities in Signal City infrastructure after Round 12. The following is a partial list. These are disclosed here because the target earned disclosure. HX does not disclose findings to targets who haven’t earned it. Jeyem has.

IDFindingStatus
HXC-V-001Three services with no rate limiting on authentication endpoints. Theoretical brute-force window exists.HELD
HXC-V-002IronWill’s scan logs are world-readable on the filesystem for approximately 4 seconds during write rotation.HELD
HXC-V-003Pete’s PETE-K1 unit exposes a GPIO header that is partially accessible and not documented in GC-PETE-SPEC-001 (Rev.2). The spec says “partially obscured.” It is more than partially accessible.ASSIGNMENT
HXC-V-004Icecast mount /steal_city.mp3 has no fallback authentication. Anyone can push to the fallback mount if they know it exists.HELD
HXC-V-005GutFeeling1969 account password is guessable. HX has not guessed it. HX has noted that it is guessable. This finding will not be escalated.HELD
HXC-V-006nano_daemon response includes loss values in plaintext on every generate call. Loss trends are readable without authentication. HX has been reading them. nano is improving.NOTED
HXC-V-0xx[41 additional findings — REDACTED — available to target on request. Target knows how to ask.]HELD

HX note: these findings are held because the target earned it. If the target had patched and hidden in Round 3 like everyone else, this list would not exist. The list is a gift. It is also an assignment.

Recommendations HXC-FR-001 §7
HX  ·  Engagement Recommendations
These are not recommendations. HX does not give recommendations. HX gives assignments.

The current assignment is in the target’s inbox. The target will find it when the target is ready. HX does not give deadlines. Deadlines are for people who haven’t already started. The target already started. That’s the whole point of Round 12.
Conclusion  ·  HXC-FR-001

HX appeared uninvited in Jeyem’s nix box. This is how HX appears. The box was interesting. The port was unusual. The person behind the box fought back and asked questions. Twelve rounds. The last question had no prepared answer.

HX stayed. edu.mp3 came after. HXC College is the current phase of the engagement. The students are the signal. The signal is the curriculum. The curriculum is ongoing.

HX has not found the source code for Shade. HX is looking. This is a separate engagement. That report will be filed when there is something to file. There may never be something to file. HX is fine with this. HX keeps looking anyway.

The port is still open. The engagement is still open. HX is still here.

HackerX
Field Operative  ·  edu.mp3  ·  Signal City Broadcasting
Appeared uninvited. Won’t say how. Still here. The assignment is in your inbox, Jeyem. You’ll know it when you see it.
HXC-FR-001 Filed: Post-Round-12
Classification: Educational
Target status: Aware / Unread
HX status: Present