hello! i'm Ricardo, also known as chu. i'm passionate about offensive security, working as a pentester and red teamer.
chu@antisec:~$ id
chu@antisec:~$ ls ~/research
a dcom activation-with-storage primitive (objref-in-stat) turns
SeImpersonatePrivilege into system. validated on server 2022, server 2025 and
win11 25h2 — cold start and session 0 included. write-up in english — versão pt-br ↗.
an api client with only api_client_write can self-grant broader scopes through the
api-clients endpoint — nobody re-checks delegation. module_write alone reaches an
upload that executes php. writeup staged; stays draft until a fix ships.
the api router normalizes case after the auth guard runs on the canonical route. a lowercase variant of the endpoint skips the check entirely — reset any user account without credentials (the admin panel stays out of reach, and the advisory says so plainly). 9.8, and honestly it earns it.
bypass of the fix for cve-2026-22692: a nested callable slips through the safe-mode sandbox via safecollection. patched in 4.2.25, tracked as ghsa-8rgj-g632-3qfp.