kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741
Part 1 in a small series of posts covering the development of kernel exploit primitives, demonstrated with a few bugs in the Mediatek MT76xx wifi driver.
hyprblog
Vulnerability research, software development, and other technobabble.
Latest posts
mediatek? more like media-REKT, amirite.
A year-in-review going over 19+ bugs in Mediatek's MT76xx/MT7915 (and others) wifi chipsets I reported this year, PoCs included!
4 exploits, 1 bug: exploiting CVE-2024-20017 4 different ways
a post going over 4 exploits for CVE-2024-20017, a remotely exploitable buffer overflow in a component of the MediaTek MT7622 SDK.
chonked pt.2: exploiting cve-2023-33476 for remote code execution
second part in a two-part series going over heap overflow in MiniDLNA (CVE-2023-33476). this post provides a walkthrough of steps taken to write an exploit for this vulnerability in order to achieve remote code execution and pop a shell.
chonked pt.1: MiniDLNA 1.3.2 HTTP Chunk Parsing Heap Overflow (CVE-2023-33476) Root Cause Analysis
first part in a two-part series going over a heap overflow in MiniDLNA, a media server commonly deployed in embedded environments. this post provides a summary and root cause analysis of the vulnerability.
RAX30 Patch Diff Analysis & Nday Exploit for ZDI-23-496
patch diff analysis of the latest patches for the netgear rax30 and an nday exploit for one of them (ZDI-23-496)
nday exploit: libinput format string bug, canary leak exploit (cve-2022-1215)
a quick post on a format string bug in libinput I found last year but never got around to debugging, plus some exploit code to leak the stack canary on a default Xubuntu 20.04.4 system.
nday exploit: netgear orbi unauthenticated command injection (CVE-2020-27861)
rediscovering and developing a weaponized exploit for a command injection vulnerability in Orbi wifi systems that was reported and patched last year.
orbi hunting 0x1: crashes in soap-api
a walkthrough of my experience finding a buffer overflow, discovering a null pointer deref along the way, and eventually figuring out the bug wasn't (easily) exploitable.
orbi hunting 0x0: introduction, UART access, recon
a data dump of findings and notes taken while hunting for vulnerabilities on the Netgear Orbi.