K a r o l L o L

Windows 11 maps the win32k desktop heap read only into every process attached to a desktop. At offset 0x100 I found a raw kernel session pool pointer that could be read directly from user mode.

With that pointer and the gSharedInfo handle table I could calculate the kernel addresses of window, menu, and class objects on the desktop.

• Readable from Low IL, AppContainer, and zero capability LPAC processes.
• No window creation is required. The mapping is already there when the process starts.
• The leaked address stays useful for the boot session and weakens KASLR for win32k objects.

CVE-2026-50416 | Full writeup and PoC here.

The site runs student Java submissions in Docker. The old runner executed them as uid=0. From a normal submission I could run shell commands, read /etc/shadow, read and overwrite backend files, and access other students' submissions. I reported it and the runner was rebuilt.

I kept testing the new setup after that. It ran as an unprivileged user with a read only root filesystem, AppArmor, seccomp, no internet access, and noexec on the writable mounts.

• Sent SIGUSR1 to the Node.js process, opened the inspector on port 9229, and connected to it over WebSocket. From there I could read and change the live Express server, inspect environment variables, and execute commands as the runner user.
• Used Java 21 FFM to call mmap and raw syscalls directly, so native code could run from memory even though the writable mounts were noexec.
• Ported CVE-2026-31431 from Python to Java FFM and used it to get uid=0 inside the hardened container.

I tried around 20 Linux kernel CVEs against later revisions of the runner and reported what still worked as the setup changed.

I found several THI SharePoint sites that had been shared with Everyone in the organization. With my normal student account I could use Microsoft Graph Search to find and download files from them.

Affected files included:

• School internship applications from minors with names, age, school, personal details, and signatures from students, parents, and teachers.
• An incomplete thesis.
• Internal HR documents.

I found 101 files across more than 14 search categories. The affected sites were visible to roughly 12,500 organization accounts instead of the small groups that actually needed access.

From 2020 to mid 2025 I spent most of my time around game cheats. I worked on several paid projects and developed and maintained one of my own.

• Reversed game updates to fix broken offsets, signatures, hooks, and changed classes or structures.
• Cracked third party cheat loaders by patching or spoofing licensing checks and working around anti tamper.
• Did a lot of x64 Windows reversing, debugging, memory work, and loader analysis in the process.

By mid 2025 I was spending more time finding and reporting software bugs than working on cheats, and eventually stopped doing cheat work.

Found a way to use Cluely's paid features without an active subscription.

The report is still open, so I am not publishing the technical details yet.

Found a revenue vulnerability in Kickbacks AI.

The report is still open, so I am holding back the technical details for now.

More coming soon... Check the Connect section to find my GitHub!