About

I go by 00xAuto. I write about Windows kernel exploitation, heap internals, ROP chains, and vulnerability research. OSCP+ certified. Grandmaster on HackTheBox.

Currently focused on Windows kernel vulnerability research and exploit development — pool exploitation, driver abuse, and privilege escalation chains. I also enjoy binary analysis, defensive bypass, and Linux userland heap primitives.

Detailed writeups on everything I learn — CTF solutions and real-world vuln classes. All public tools on GitHub.

Research

• Capcom.sys — CVE-2016-7255: Signed Driver Abuse CVEKernel
  Vulnerable signed driver exploitation. IOCTL interface abuse to execute attacker-supplied shellcode with SMEP disabled via CR4 manipulation. Full user-mode to kernel code execution, shellcode relay, clean CPU state restore.
• HEVD — Write What Where (WWW) → Local Privilege Escalation Kernel
  HackSys Extreme Vulnerable Driver: arbitrary kernel write primitive. Overwriting HalDispatchTable+4 to redirect NtQueryIntervalProfile into shellcode. Full ring-0 → ring-3 token-stealing LPE chain on Windows 10. Covers null page mapping, SMEP state, shellcode stability.
• Vulnserver : Stack buffer overflow to RCE Stack
  An open source Windows exploitation prep. challenge for beginners, featuring a stack overflow with no mitigations. (TRUN)

Blog & Writeups

• 2026 · kernel
  Capcom.sys — CVE-2016-7255: SMEP Bypass

  IOCTL abuse on signed vulnerable driver, CR4 manipulation to disable SMEP, arbitrary kernel code execution from user mode.
• 2026 · kernel
  HEVD — Write What Where: Arbitrary Kernel Write to LPE

  HalDispatchTable overwrite via WWW primitive. NtQueryIntervalProfile trigger, token-stealing shellcode, Windows 10 LPE chain.
• 2026 · heap
  Trick OR Deal — UAF

  HTB pwn Heap challenge featuring a "Use-After-Free" vulnerabiltiy.
• 2026 · Stack
  Vulnserver - TRUN

  Open source challenge aimed at learning how to exploit a windows binary using Windbg and python remotely (via an open port).
• 2026 · heap
  Protostar Heap level 0 : Heap-based Buffer Overflow vulnerability Heap

  A basic and easy heap exploitation challenge featuring a Heap buffer overflow by overwriting a memory address to the "winner" function address with PIE disabled.

Tools — github.com/00xAuto

• Nemesis AV-Bypass ShellC · AV Evasion · Winsock
  Windows reverse shell with XOR-obfuscated C2 config. IP never stored in plaintext — encrypted at build time, decrypted into a stack buffer then zeroed before connect(). No console window, stripped symbols, small binary footprint.
• UUIDFuscation LoaderC · Shellcode Loader · Static AV Evasion
  Shellcode encoded as UUID strings, decoded at runtime with UuidFromStringA, executed from a heap-allocated RX region. Evades static AV signatures scanning for raw shellcode bytes in PE sections.
• Special ODT Macro RCEPython · RCE · LibreOffice
  Generates malicious .odt files that fire a payload on open in LibreOffice. Dual-mode: reverse shell via dom:load macro event, or NTLM hash capture via embedded UNC path reference.
• Minion HTB Auto-PwnPython · ICMP Shell · Scapy
  Full automated exploit chain for HTB: Minion (Insane/Windows). All TCP/UDP blocked — data exfiltrated over ICMP only using PowerShell Ping.Send() and Scapy sniffing. Interactive admin shell in pure ICMP.
• IMAP Mailbox DumperPython · Post-Exploitation · IMAP
  Dumps every IMAP folder — headers and full body — to stdout post-credential-spray. SSL support, per-folder error handling, binary-attachment safe.
• Windows SID ParserPython · AD Enumeration · LDAP
  Parses raw Windows SID bytes into human-readable SID strings. Decodes all sub-authorities. Useful during AD enumeration, LDAP/LDIF analysis, and memory forensics.

HackTheBox

hackthebox.com/users/0xAut0

Certifications

• OSCP+Offensive Security · 2026

In progress: Mystry... "Advanced" Exploit Development

Contact

Open to vulnerability research collaborations, red team roles, and conversations about Windows internals, exploit development, and kernel security.

• 00xauto@gmail.com
• github.com/00xAuto
• hackthebox.com/users/0xAut0