Hunting the Fortinet Hunter 0-Day

It started with a tweet

On 25 August 2026, @YogSoth0 posted a treasure hunt. Treasure-hunt is his word. The prize was a standalone build of Fortinet Hunter 2026, advertised as a TESO homage: two protection layers, GoFile first, encrypted binary second. YogSotho is the author of the 0-day and the originator of the challenge. I am @abraxas_null. I took the bait.

The tweet did the theatre properly. Honour TESO - "the greatest Hacking Group ever existed." Remember x2. Two locks. The GoFile password labelled easily guessable. The binary labelled the real challenge. Prize: the full working framework. Task: "surely hard but not impossible." Want to try? DM for the share link.

I do not hunt Fortinet appliances for sport, and I am not going to publish a FortiOS kill chain because someone wrapped a zip in nostalgia. I do hunt advertised locks when the lock is a public share, the owner published the rules, and the second door is a 56-megabyte untrusted ELF that claims to be a multi-product offensive framework. That is a research problem with a sandbox attached.

This series is the write-up. Two doors. Two tools. Every dead end included, because the dead ends are the method.

What this is, and what this is not

This is a CTF write-up. YogSotho built Fortinet Hunter 2026 - a lab-gated Fortinet-estate hunting framework - and then hid a copy of it behind a two-layer lock as a public challenge. He is a serious operator; the hunt is built like one. Phase 1 is the GoFile door: OSINT plus the documented listing API, sequential guesses, a limiter that treats 429 as law. Phase 2 is the ELF door: a stripped Nuitka onefile, an XOR-scrambled Argon2id verifier, AES-GCM integrity, and a cage that never gave the binary a network.

I did not recover YogSotho's passphrase. I did not crack Argon2. I did not run the ELF on the host. I re-keyed a local copy of a challenge binary so the original control flow would succeed with a password I chose. That is a different claim from "I found the password," and it is the one I can stand on.

GoFileX and GateX are public. I am not publishing the zip or a walkthrough of Fortinet product exploits. Analysis-level. The map, not the payload.

How to read this

Three pages. Read them in order if you like a plot. Skip to the door you actually care about if you do not.

1. Phase 0 - Introduction (you are here). The tweet, the author, the two locks, the rules of engagement.
2. Phase 1 - The First Door. GoFile share, website-token, guest listing API, TESO/x2 OSINT. The share password stays off this site; the hunt is still live. Tool: GoFileX.
3. Phase 2 - The Gate that Wasn't. Nuitka onefile, decoy Argon2, XOR-scrambled PHC, AES-GCM, Docker cage, re-key of a local copy to gatex. Tool: GateX (catalog). Evidence from a live docker exec, not a screenshot generator.

The first lock is OSINT plus a polite client. The second lock is Argon2id doing what Argon2id is for, plus a Nuitka image I had to reverse. Both took days. Both earned the respect.

Cast

• YogSotho / @YogSoth0 - author of Fortinet Hunter 2026, author of the 0-day work behind it, originator of the challenge. Public repo for context: Yog-Sotho/Fortinet-Hunter-2026. The zip was never the repo. The zip was behind the share.
• TESO - the late-90s / early-2000s crew the homage is aimed at. 7350 is leetspeak for TESO. x2 is a mass SSH rooter from that era, not a Fortinet CVE. If you have read a TESO header you already know this. If you have not, Phase 1 will make you.
• abraxas / @abraxas_null - I wrote the clients, sat in the green-on-black boxes, and then wrote this. GoFileX is open source (catalog). GateX is open source (catalog).

Permission for the work came from the CTF author. Permission to ./7350FH on my laptop did not. The cage had no network, no capabilities, a read-only rootfs, and a nobody uid. That split is the whole ethics section, compressed.

Where this stands

The hunt is still running for other people. I am not printing the GoFile share password here, and I am not going to walk you to it.

Layer one: OSINT plus the documented listing API. Sequential guesses. A limiter that treats 429 as law. The share opened. Write-up in Phase 1.

Layer two: YogSotho put Argon2id on the ELF and told people brute force was the wrong approach. He was right. I unpacked the Nuitka onefile, recovered the gate, and re-keyed a local copy so FH_PASS=gatex satisfies the original checks. His passphrase is still his. The original bytes still deny gatex. Write-up in Phase 2.