KNOW IT. HACK IT.

PWN REVERSE KERNEL IoT CVE

记录漏洞挖掘与分析、二进制安全、系统安全及 CTF 相关内容。

POSTS161DOCUMENTED

CATEGORIES11SURFACES

TAGS174INDICATORS

SYSTEMONLINESIGNAL_CLEAR

// ./LATEST_TRANSMISSIONS

最近研究日志

TX_01 2026.06.09 PUBLISHED

> cat ./research/old-wine-in-a-new-bottle-lxd-group-root.log

复盘 Ubuntu Server 默认 lxd 组成员关系如何与现代 LXD 安装机制组合，重新形成一条无需输入 sudo 密码的本地提权链。

TX_02 2026.05.29 PUBLISHED

> cat ./research/race-against-the-patch-litellm.log

围绕 Pwn2Own Berlin 2026，复盘 LiteLLM 四个版本中从低权限入口到容器 RCE 的四条利用链，以及补丁推进下不断重构攻击路径的过程。

TX_03 2026.04.28 INPROGRESS

> cat ./research/CVE-2026-41651-analysis.log

TX_04 2026.03.09 DONE

> cat ./research/preempted-unlocking-xiaomi-via-two-unsanitized-strings.log

TX_05 2026.02.07 DONE

> cat ./research/pickling-the-mailbox-cve-2025-20393-cn.log

TX_06 2026.02.01 DONE

> cat ./research/how-to-patch-a-linux-kernel-bug-zh.log

TX_07 2025.12.28 INPROGRESS

> cat ./research/tp-link-wr841n-router-cve-analysis.log

TX_08 2025.07.08 DONE

> cat ./research/cve-2025-32023-redis-rce-via-out-of-bounds-write.log

TX_09 2025.07.02 INPROGRESS

> cat ./research/cve-2025-36463-sudo-chroot-elevation.log

TX_10 2025.05.19 PUBLISHED

> cat ./research/offbyone-conference-when-asus-iot-devices-play-hide-and-seek-with-security.log