张云海 - 网络安全专家

职业生涯时间线 Career Milestones

2005年 2005

核心开发人员 Core developer

作为绿盟科技IDS/IPS主力开发人员、RCM产品线负责人。 As a core developer of NSFOCUS IDS/IPS and the person in charge of the RCM product line.

2012年 2012

核心技术人员 Core Technical Personnel

转为绿盟科技核心技术人员，担任研究员。 Served as a researcher and core technical personnel at NSFOCUS.

2014~2018

多次获得微软漏洞缓解绕过赏金(MBB)。 Multiple times awarded the Microsoft Vulnerability Mitigation Bypass bounty (MBB).

连续五年,五次获得微软漏洞缓解绕过赏金。成为唯一一位连续五年获此殊荣研究员，技术能力获得国内和国际认可。绿盟科技因此成为唯一一家连续六次获此荣誉的公司。 For five consecutive years, he has received the Microsoft Vulnerability Mitigation Bypass bounty five times, becoming the only researcher to earn this honor for five straight years, with technical capabilities recognized both domestically and internationally. As a result, NSFOCUS has become the only company to receive this distinction six times in a row.

2015

Black Hat USA 演讲 Black Hat USA Presentation

在全球顶级安全会议发表"全面绕过控制流保护"议题，获得国际认可。 Presented "Bypass Control Flow Guard Comprehensively" at the world's top security conference, gaining international recognition.

2018

天机实验室成立 Tianji Lab Establishment

绿盟科技五大实验室发布，担任天机实验室负责人(总监)。 NSFOCUS Tianji Lab was established, serving as Director of Tianji Lab.

新闻报道

2021

披露"PrintNightmare" Disclosed "PrintNightmare"

作为共同发现者之一，披露全球性重大安全漏洞，对Windows系统安全产生巨大影响。 As one of the co-discoverers, disclosed a major global security vulnerability with significant impact on Windows system security.

2022

Black Hat Asia演讲 Black Hat Asia Presentation

《Bypass CFG In Chrome》绕过谷歌Chrome V8 JavaScript引擎中的控制流保护 (CFG)。 "Bypass CFG In Chrome" - Bypassing Control Flow Guard (CFG) in Google Chrome V8 JavaScript engine.

2025-08-22

因病去世 Died of illness

云海是一位数字时代的探险者，软件世界的漏洞狩猎师。他一生简单而纯粹，将热情与智慧倾注在了技术研究里。愿云海在另一个世界能继续他的探索。 Yunhai is an explorer of the digital age, a bug hunter in the software world. His life is simple and pure, pouring his passion and wisdom into technical research. May Yunhai continue his exploration in the next world.

公开演讲 Public Presentations

Black Hat USA 2015

全面绕过控制流保护 Comprehensive Control Flow Protection Bypass

在全球顶级安全会议上展示其在操作系统核心防御机制方面的突破性研究。 Demonstrated groundbreaking research on core OS defense mechanisms at the world's premier security conference.

会议链接

Bluehat v16(2016)

如何避免实现一个对漏洞利用友好的JIT How to Avoid Implement An Exploit Friendly JIT

JIT编译引擎中的安全漏洞及反漏洞利用开发指南 Security vulnerabilities in JIT compilation engines and anti-exploitation development guidelines

会议内容

Bluehat v18(2018)

缓解措施绕过：过去、现在与未来 Mitigation Bypass: Past, Present and Future

对攻防军备竞赛的战略级宏观分析，展示其超越单个漏洞利用的思想领导力。 Strategic macro-analysis of the offensive-defensive arms race, demonstrating thought leadership beyond individual exploit techniques.

观看视频

POC 2020

在2020年利用Windows内核 Exploiting Windows Kernel in 2020

展示针对Windows内核的漏洞利用技术，证明其在内核级安全领域的精深造诣。 Demonstrated Windows kernel exploitation techniques, proving deep expertise in kernel-level security.

会议链接

POC 2021

打印机如何成为噩梦？ How Can Printers Become Nightmares?

对"PrintNightmare"漏洞进行专家级复盘，剖析补丁失败之处并提出解决方案。 Expert-level analysis of the "PrintNightmare" vulnerability, examining patch failures and proposing solutions.

会议链接

Black Hat Asia 2022

Bypass CFG In Chrome

将研究重心从微软生态扩展至浏览器安全，展示解构现代编译器级别缓解措施的方法论。 Expanded research focus from Microsoft ecosystem to browser security, demonstrating methodology for deconstructing modern compiler-level mitigations.

查看PPT

KCon 2021

The Achilles' Heel of CFI The Achilles' Heel of CFI

CFI是一项备受期待的缓解措施，可以有效的阻止对控制流的劫持。然而，信息安全领域也没有银弹，CFI 有着其自身固有的缺陷。本议题将介绍如何针对 CFI 的固有缺陷来突破其防御。 CFI is a highly anticipated mitigation that can effectively prevent control‑flow hijacking. However, there is no silver bullet in the field of information security, and CFI has its own inherent shortcomings. This talk will present how to exploit those inherent flaws in CFI to bypass its defenses.

会议议程议题介绍查看PPT
回忆文章：《KCon再无张云海》

KCon 2022

Where's My Session Pool? Where's My Session Pool?

微软在NT时代引入会话(Session)的概念，会话池内存(Session Pool)是一种重要的内存类型存在于内核中，众多内核漏洞和利用技术与会话池内存息息相关。Windows 11中，会话池内存却消失了。微软决定移除会话池内存有哪些原因？移除给相关内核代码带来哪些影响？会导致内核漏洞利用哪些有利条件与不利因素？ Microsoft introduced the concept of a session during the NT era. Session pool memory (Session Pool) is an important type of memory that resides in the kernel, and many kernel vulnerabilities and exploitation techniques are closely tied to the session pool. In Windows 11, however, session pool memory has disappeared. Why did Microsoft decide to remove session pool memory? What impact does its removal have on the related kernel code? Which advantages and disadvantages does this create for kernel‑exploitation scenarios?

会议议程议题介绍查看PPT

KCon 2023

SxS also stands for Specter by Side SxS also stands for Specter by Side

为了解决 DLL Hell 所导致的一系列问题，微软从Win98开始就引入了 Side-by-side assembly(SxS)技术来管理系统中的众多DLL。然而，这一技术在设计上却存在着重大的安全缺陷，任意用户都可以利用它来获得系统最高权限。本议题将回顾SxS的设计思路，分析SxS的工作机制，并在此基础之上阐述其中存在的安全缺陷，以及如何利用该缺陷来获得系统最高权限。 To address the series of problems caused by DLL Hell, Microsoft introduced the Side-by‑by assembly (SxS) technology for managing the many DLLs in the system starting with Windows 98. However, this technology has a significant security flaw in its design: any user can exploit it to obtain the highest system privileges. This talk will review the design rationale of SxS, analyze how SxS works, and on that basis explain the security vulnerability it contains and how to exploit that vulnerability to gain the highest system privileges.

会议议程议题介绍查看PPT

KCon 2024

模拟游戏消亡史 The History of Simulation Game Extinction

为便于服务进程对客户端的访问权限进行检查，微软引入了模拟(impersonation)机制，允许服务进程以其他用户的身份来执行操作。这本意是为了提高系统安全性，然而当模拟遇上另一项为了保持兼容性而引入的机制时，却构成了一个巨大的攻击面，使得任意用户都可以轻易的提升至最高权限。本议题将详细介绍这个攻击面是如何形成的，通过实例来展示五种利用这个攻击面的攻击方式。 To facilitate the service process’s checking of client access permissions, Microsoft introduced an impersonation mechanism that allows the service process to perform operations under the identity of another user. This was originally intended to enhance system security; however, when impersonation encounters another mechanism introduced for compatibility, it creates a massive attack surface that enables any user to easily elevate to the highest privileges. This talk will detail how this attack surface is formed and demonstrate five exploitation techniques that leverage it through examples.

会议议程议题介绍查看PPT

张云海老师名下的几个典型漏洞列举(CVE) Significant Vulnerabilities (CVE)

CVE 标识符 CVE Identifier	漏洞类型 Vulnerability Type	漏洞影响 The vulnerability impact
CVE-2015-6128	远程代码执行 Remote Code Execution	被定性为"Windows库加载远程代码执行漏洞"。这类漏洞通常源于操作系统或应用程序在加载动态链接库（DLL）时存在缺陷，允许攻击者诱导系统从不受信任的位置加载恶意库，执行任意代码 Classified as "Windows Library Loading Remote Code Execution Vulnerability". This type of vulnerability typically stems from flaws in how operating systems or applications load dynamic link libraries (DLLs), allowing attackers to induce the system to load malicious libraries from untrusted locations and execute arbitrary code.
CVE-2015-6131	远程代码执行 Remote Code Execution	一个"媒体中心库解析远程代码执行漏洞"。该漏洞存在于Windows Media Center组件中，当其处理特制的媒体文件或库文件时可能被触发。攻击者通过构建一个媒体文件，诱使用户打开它，从而在用户系统上获得代码执行权限 A "Media Center Library Parsing Remote Code Execution Vulnerability". This vulnerability exists in the Windows Media Center component and can be triggered when processing specially crafted media files or library files. Attackers can construct a media file to entice users to open it, thereby gaining code execution privileges on the user's system.
CVE-2016-0080	远程代码执行 Remote Code Execution	微软Edge在窗口消息分发操作中错误处理异常，允许远程攻击者通过精心构造的网站绕过ASLR保护机制，亦称为“微软Edge ASLR绕过”。 Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge ASLR Bypass."
CVE-2016-0194	信息泄露 Information leakage	微软 Internet Explorer 10 和 11 允许远程攻击者通过精心构造的网站绕过文件权限并获取敏感信息，亦称为“Internet Explorer 信息泄露漏洞”。 Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass file permissions and obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
CVE-2017-11790	信息泄露 Information leakage	多个版本Windos系统的Internet Explorer存在漏洞，攻击者可利用该漏洞获取信息，进而进一步攻破用户系统，原因在于Internet Explorer处理内存中对象的方式，该漏洞又称“Internet Explorer信息泄露漏洞”。 nternet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Information Disclosure Vulnerability".
CVE-2018-8111	远程代码执行 Remote Code Execution	当Microsoft Edge错误访问内存中的对象时，存在远程代码执行漏洞，亦称为“Microsoft Edge内存损坏漏洞”。此漏洞影响Microsoft Edge。 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge.
CVE-2019-0892	Win32k权限提升漏洞 Win32k Privilege Escalation	Win32k是Windows内核模式驱动程序，负责图形用户界面（GUI）和窗口管理等核心功能。该组件中漏洞价值极高，可以直接在内核模式（Ring 0）下执行代码，这是系统最高权限。意味着攻击者可以绕过所有用户级别的安全控制 Win32k is a Windows kernel-mode driver responsible for core functions such as graphical user interface (GUI) and window management. Vulnerabilities in this component are extremely valuable as they can execute code directly in kernel mode (Ring 0), which is the highest system privilege. This means attackers can bypass all user-level security controls.
CVE-2020-14331	缓冲区溢写 Buffer Over-write	在Linux内核对VGA控制台的反转视频代码实现中发现了一个缺陷，当本地攻击者尝试调整控制台大小，调用ioctl VT_RESIZE时，会导致越界写入。该缺陷允许具有VGA控制台访问权限的本地用户使系统崩溃，可能提升其系统权限。此漏洞对数据机密性、完整性以及系统可用性的威胁最高。 A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability..
CVE-2021-1675	权限提升 Privilege Escalation	作为共同发现者之一，发现一个Windows打印后台处理程序服务（Print Spooler）中的权限提升漏洞，成为了后来引发全球性安全危机"PrintNightmare"事件的关键前奏 As one of the co-discoverers, identified a privilege escalation vulnerability in the Windows Print Spooler service, which became a key prelude to the later global security crisis known as "PrintNightmare".

荣誉与认可 Honors & Recognition

微软漏洞缓解绕过赏金 (MBB) Microsoft Mitigation Bypass Bounty (MBB)

此荣誉表彰发现并提交"绕过Windows平台级防御缓解措施的新型漏洞利用技术"的顶尖研究者。
与报告单个应用程序的漏洞相比，这项挑战的技术门槛要高得多。
绕过CFG或ASLR等系统性防御机制，意味着能使一大类漏洞的利用成为可能，影响是全局性的。
张云海凭借在该领域的持续突破，成为唯一一位连续五年获此殊荣研究员,创造了一个里程碑。
绿盟科技因此成为唯一一家连续六次获此荣誉的公司,这一成就很大程度上归功于张云海。
此外，他还曾作为季度顶级赏金猎手获得微软$15,000美元的奖励。
这代表微软官方对其工作的最高认可。张云海先生为Windows操作系统的安全性完善做出了卓越的贡献。 This honor recognizes top researchers who discover and submit "novel exploitation techniques that bypass Windows platform-level defense mitigations."
Compared to reporting individual application vulnerabilities, this challenge has a much higher technical threshold.
Bypassing systemic defense mechanisms like CFG or ASLR means enabling exploitation of a large class of vulnerabilities, with global impact.
Yunhai Zhang, through continuous breakthroughs in this field, became the only researcher to receive this honor for five consecutive years, creating a milestone.
NSFOCUS thus became the only company to receive this honor six consecutive times, largely attributed to Yunhai Zhang's contributions.
Additionally, he has received a $15,000 USD reward from Microsoft as a quarterly top bounty hunter.
This represents the highest official recognition from Microsoft for his work.

绿盟科技天机实验室张云海获Pwnie Awards 2021两项提名。

2014年首次获奖7.5万美金 2018年第5次获奖连续五年获奖累计获奖17万美金