> cat ./research/hitcon-2026-pwn2ownothing-when-a-kvm-full-chain-escapes-to-emptiness.log
$ ./swing --focus "vulnerability research"
# Know it then hack it!
VULNERABILITY RESEARCHER · CTF PLAYER
KNOW IT. HACK IT.
PWN
REVERSE
KERNEL
IoT
CVE
记录漏洞挖掘与分析、二进制安全、系统安全及 CTF 相关内容。
POSTS162DOCUMENTED
CATEGORIES11SURFACES
TAGS177INDICATORS
SYSTEMONLINESIGNAL_CLEAR
// ./LATEST_TRANSMISSIONS
最近研究日志
> cat ./research/old-wine-in-a-new-bottle-lxd-group-root.log
外部发表 STAR Labs ↗
Old Wine in a New Bottle: A Decade-Old lxd-Group Root, Re-Armed
复盘 Ubuntu Server 默认 lxd 组成员关系如何与现代 LXD 安装机制组合，重新形成一条无需输入 sudo 密码的本地提权链。
> cat ./research/race-against-the-patch-litellm.log
外部发表 STAR Labs ↗
Race Against The Patch: The Evolution of Four Exploit Chains in LiteLLM
围绕 Pwn2Own Berlin 2026，复盘 LiteLLM 四个版本中从低权限入口到容器 RCE 的四条利用链，以及补丁推进下不断重构攻击路径的过程。
> cat ./research/CVE-2026-41651-analysis.log
CVE-2026-41651 PackageKit TOCTOU 本地提权漏洞分析
> cat ./research/preempted-unlocking-xiaomi-via-two-unsanitized-strings.log
Preempted: From ADB Service Call to Bootloader Unlock on Xiaomi
> cat ./research/pickling-the-mailbox-cve-2025-20393-cn.log
Pickling the Mailbox: A Deep Dive into CVE-2025-20393
> cat ./research/how-to-patch-a-linux-kernel-bug-zh.log
如何给 Linux 内核提交补丁：一次真实的踩坑记录
> cat ./research/tp-link-wr841n-router-cve-analysis.log
TP-Link WR841N router CVE-2023-50224 and CVE-2025-9377
> cat ./research/cve-2025-32023-redis-rce-via-out-of-bounds-write.log
CVE-2025-32023 Redis 漏洞分析
> cat ./research/cve-2025-36463-sudo-chroot-elevation.log