$ nmap -sV 192.168.1.0/24 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https $ sqlmap -u http://target/id=1 [*] testing connection [*] checking stability Parameter: id (GET) Type: boolean-based blind $ msfconsole -q msf6 > use exploit/ms17_010 msf6 > set RHOSTS 10.0.0.5 msf6 > exploit [*] Meterpreter session 1 $ gobuster dir -u target.com /admin [200] /login [200] /backup [403] $ nikto -h target.com + Server: Apache/2.4.18 + XSS: header not set + SQLi possible $ hydra -l admin -P rockyou.txt [22][ssh] host: 10.0.0.1 login: admin pass: password123 $ python3 reverse_shell.py Listening on 0.0.0.0:4444 Connection received $ whoami root $ id uid=0(root) gid=0

← back to portfolio

Writeups & Research

CVE research, CTF walkthroughs, bug bounty disclosures, and notes from the trenches of offensive security.

All CVE Research CTF Writeup Bug Bounty Red Teaming Tools & Techniques Penetration Testing

// TAG: ROOT (1)

CVE-2026
Linux

Advanced

★

CVE-2026-31431 Kernel Exploit Linux Privesc

CVE-2026-31431 – Copy Fail: The Linux bug that gives you root

A deep-dive into a kernel-level copy_from_user() race condition allowing unprivileged local attackers to escalate to root. …

May 2, 2026 · 12–15 min read