handle: azqzazq1
roles:
- Security Researcher
- Red Team Engineer
- Vulnerability Analyst
- System-Level Security Specialist
focus:
- Linux / Windows privilege boundaries
- Offensive security research
- Cloud & container attack surfaces
- Root cause analysis & exploit path engineering
- Coordinated disclosure & CVE research
philosophy:
- systems are layered trust models
- assumptions fail before software does
- observation is not always realityResearch conducted on a Linux system component involving authorization logic and privilege boundary handling.
The issue was identified during advanced Red Team and system-level security research and responsibly disclosed to the vendor.
+ Research Area : Linux Authorization Logic
+ Scope : Privilege Boundary Analysis
+ Disclosure : Coordinated with Vendor
+ CVE Status : Assigned
- Technical Data : Temporarily WithheldFull technical analysis and root cause breakdown will be published after coordinated disclosure timelines are completed.
World-first technical analysis of IceWarp CVE-2025-14500, including root cause review and exploitation surface mapping.
+ Research Type : Reverse Engineering
+ Focus : Exploitation Surface Mapping
+ Output : Public Technical Analysis
+ Status : Published
A Red Team research technique focused on changing what defensive systems believe they observed.
Instead of disabling telemetry or terminating agents, this research explores runtime syscall observation and controlled data transformation using eBPF.
+ Technique : eBPF Telemetry Redaction
+ Layer : Syscall Observation Layer
+ Surface : Security Telemetry Streams
+ Model : Runtime Data Transformation
+ Principle : Observation β Reality
NORMAL TELEMETRY FLOW
process β syscall β agent β SIEM β analyst
RESEARCHED ATTACK MODEL
process β syscall β eBPF layer β agent β SIEM
ββ selective transformation
Security systems do not directly observe reality. They observe interpreted runtime data streams.
A Red Team research technique that bypasses AppArmor mandatory access control using eBPF β without disabling it, without modifying it, and without leaving a single audit log entry.
LID attaches a BPF kprobe to the kernel's file-open path and rewrites the filename in user memory before the LSM framework checks it. AppArmor enforces the wrong path. The process reads the protected file.
+ Technique : eBPF Pre-LSM Pathname Rewriting
+ Layer : Syscall Argument Manipulation
+ Surface : LSM Security Decision Input
+ Target : AppArmor (pathname-based MAC)
+ Audit Trail : Zero β denial never occurs
+ Principle : The gate was never breached. It was misdirected.
LID + SUNNYDAYBPF β COMBINED ATTACK MODEL
ββββ LID rewrites path ββββ
β β
process β syscall β LSM check β VFS β success
β
βββ SunnyDayBPF ββββββ
β
agent β SIEM β analyst sees nothing
LID bypasses the security gate. SunnyDayBPF blinds the cameras. Combined: ghost access.
First public PoC research and attack surface validation for MCP36.
+ Type : Proof of Concept
+ Focus : Attack Surface Research
+ Status : Published
Kernel-level privilege escalation research tooling and Linux exploit framework.
+ Type : Offensive Tooling
+ Focus : Kernel PrivEsc Research
+ Mode : Modular Framework
Research offensive security from the system boundary.
Not only how to exploit a bug,
but why the design allowed the bug to become exploitable.
Not only how telemetry is collected,
but why defenders trust what they observe.
github: https://github.com/azqzazq1
blog: https://mileniumsec.com