CVE-2025-68670 Part 2: From Crash to RCE - The One That Fought Back (and Lost)
The first post ended with 'not a shell.' This one ends with uid=0(root) - with an asterisk. Ten context windows. A UTF-8 encoding barrier that blocks every libc address. A PLT mapping that lied. A stack alignment problem solved by a NULL pointer and a filename that shouldn't exist. The story of how a pre-auth xrdp overflow became (almost) pure-network RCE - through the most absurd gadget chain we've ever built.