I'm a SOC analyst from Perth, Western Australia and graduate from Edith Cowan University. I love cybersecurity and software development, both interests I channel for reverse engineering and exploit development. I'm a big supporter of open source software, so most of my projects outside of work are available here. I believe software and cybersecurity should be accessible to all, I enjoy the opportunity to educate and learn from others in the field and I'm always down for a CTF, so I'm an active participant in the community here in Perth. If you see me around say hi!
I also have a blog where you can see writeups of the stuff I do.
PublicPasswd is an exploit chain which uses CVE-2026-46333 to get a read-only file descriptor for /etc/shadow, and then CVE-2026-31431 (CopyFail) to write to it. The tool dumps the hashes of all users who have a password on the system, and allows changing any other user's password without authentication or elevation to root. Can be run as any user and requires no special permissions.
RootRemover is a method of using CVE-2026-31431 (CopyFail) to temporarily remove the root password of a host, allowing for easy passwordless elevation. It's a modification of rootsecdev's version which sets your UID to 0 upon a fresh login (requiring the current user's password). Both of these differ to the original PoC in that they should work on any architecture and aren't dependent on modifying SUID binaries.
A Python library to for controlling Roku TV devices on the same network as you, regardless whether the regular ECP API is enabled in settings. This was developed by reverse engineering ECP2, the protocol Roku TVs use to communicate with the mobile app and can search the network for TVs to interface with.
An alternative commandline spoofing proof-of-concept. Invisirun uses NtCreateUserProcess to pad the Commandline property of the PEB with null characters, aiming to avoid detection by trailing spaces/other characters.
LunaJuice is an experimental tool created during an internship to monitor and log the activities of suspicious Windows processes. It can be injected by normal users or administrators (to work on any non-protected process) and hosts a local RPC server to query and change configuration. Its goal is to be easily integrated into defensive workflows and be highly customisable to the user's needs.
github-stats-extended by stats-organization, originally by anuraghazra.
If it's about a specific project, there's probably a place for it in the README, but otherwise you can email me at me@miela.dev or contact me on Discord @st4rburn.. While you're here, you should check out my blog!