Recent content on HAXX.IN
Last year we (PHP HOOLIGANS) competed in Pwn2Own (ireland, 2024) once again. One of our (succesful) entries was against a little pet peeve target of mine, the CANON ImageCLASS printer. In this post I’ll walk you through the vulnerability I found and exploited.
We got the keys to decrypt those new Lexmark root filesystems, but why stop there?
Lexmark decided to frustrate vulnerability researchers last minute. Let’s have a look at their new root filesystem encryption.
Last year I (successfully) targeted the CANON Printer for Pwn2Own toronto, this year I decided to do the same. But I made a terrible mistake. The night before my flight to toronto I realized I had.. hacked the wrong printer (firmware). I scrambled to blindly port the exploit to the correct firmware image, without being able to actually test it. The exploit didn’t work during the competition.…
In this post we will exploit a memory corruption issue in AMLogic El3 code that is used by various consumer devices like the Sonos One (2nd generation) and the Lenovo Smart Clock. The goal is to get a copy of the OTP/eFUSE data and dump out the code for the application processor BootROM.
Exploiting a heap overflow in the TIPC subsystem of the Linux kernel. In this post we’ll exploit a N-day vulnerability (CVE-2021-43267) originally discovered by Max van Amerongen.
Generating numeric-only shellcode for Linux/x86. Is it possible? Alphanumeric x86 shellcode is a well-studied and documented subject. But what about only using ascii number characters (0x30-0x39)? Let’s find out!

 
 
 0 
 1 
 2 
 3 
 4 
 5 
 6 
 7 
 
 
 00 
 SVTCA 
 SVTCA 
 SPVTCA 
 SPVTCA 
 SFVTCA 
 SFVTCA 
 SPVTL 
 SPVTL 
 
 
 08 
 SFVTL 
 SFVTL 
 SPVFS 
 SFVFS 
 GPV 
 GFV 
 SFVTPV 
 ISECT 
 
 
 10 
 SRP0 
 SRP1 
 SRP2 
 SZP0 
 SZP1 
 SZP2…
Greetings, entity who happens to be interacting with this webserver. Welcome to
my small place on the web where I occasionally publish code and ramble
about computer-y things. 
 I am sometimes available for paid work (code audit, exploit dev, anything interesting). 
 business inquiries and fanmail can go to peter@haxx.in ( PGP ) 
 You can follow me on Twitter/X
Here you will find a collection of all exploit and security related code I made
public over the years. There is some even older (and even more embarassing) stuff I lost,
if you happen to still have any of it: feel free to shoot me an e-mail and I might
add it to this page. 
 
 
 limit-your-screentime.sh 
 
 An exploit for CVE-2025-23395 in GNU screen. 
 
…