Alain Mowat – SCRT Team Blog

HP One Agent: local privilege escalation through race condition [CVE-2026-5064]

One type of assessment we perform a lot, especially last year with Windows 10 coming to the end of its life, is what we call a workstation assessment. The goal is to identify weaknesses and vulnerabilities within a standard image or build and determine whether they can be exploited from various standpoints.

During such an assessment last year, when vulnerability research wasn’t yet fully performed by Claude, I was faced with an image which had a limited attack surface and very few additional software. One of them was HP One Agent, which I had never heard of at the time, but eventually allowed me to elevate privileges on the workstation due to a race condition and DLL side loading. Interestingly, this could have tied in quite nicely with my colleague Leon‘s research surrounding bloatware which he presented at Defcon last year.

SonicDoor – Cracking SonicWall’s SMA 500

While attempting to compare the security level of various VPN vendors, I kept falling down the path of searching for vulnerabilities instead. This blog post details the ones I discovered in SonicWall’s SMA 500, which were patched in December 2024. This post has been delayed to coincide with my talk at SecurityFest on this exact subject.

Arbitrary web root file read in Sitecore before v10.4.0 rev. 010422

As part of our continuous pentesting offering, we try to identify solutions used by multiple clients to guide our research efforts to deliver the greatest impact. That is why, recently, we spent some time searching for vulnerabilities within Sitecore to find what we initially thought to be a 0-day, but ended up having been already patched some time earlier.

Getting code execution on Veeam through CVE-2023-27532

While several blog posts have shown how to retrieve credentials through this vulnerability, we decided to dig deeper and see whether it was possible to execute arbitrary code through this issue.

Exploiting stale ADIDNS entries

The correct IP address is sometimes all you need to exploit a remote target.

Producing a POC for CVE-2022-42475 (Fortinet RCE)

Late last year a new remote code execution vulnerability was discovered in Fortinet’s SSLVPN service. Given the relative lack of information surrounding it at the time, and the fact I’d have some uninterrupted research time due to a lengthy flight, I decided to attempt to produce a POC for the vulnerability.

Internal security recommendations survey

During the first wave of Covid and most people locked up at home, I wanted to engage with my colleagues in various departments here at SCRT by having them answer a simple survey. The survey related to what actions they would recommend and prioritize in order to secure the information system of a random company, which had just received notification that a cyberattack was imminent.

Stealing user passwords through a VPN’s SSO

Last year I got this idea that I should attempt to pay for my holidays to Japan by hunting for bounties in security appliances while in the plane. A full 10 hours of uninterrupted focus on one solution seemed like it should yield interesting results. So I started reverse engineering the Firewall of a relatively common brand which has a private bug bounty. Due to this reason, I won’t be giving out the full details of the issue I discovered, but I find the vulnerability to be quite interesting and worth discussing. So I attempt to do this here without breaching any disclosure terms…

State of Pentesting 2020

To many people, pentesting (or hacking in a broader sense) is a dark art mastered by some and poorly understood by most. It has evolved quite substantially throughout the years, guided by new vulnerabilities, changing behaviours and maybe most importantly the development and release of new tools, be they offensive or defensive.

Continuous Pentesting

At SCRT, we have been performing penetration tests for nearly 20 years now and have always tried to improve our methodologies to match client expectations and deliver the most accurate and useful results from each test we undertake.