<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>blogscrt &#8211; SCRT Team Blog</title>
	<atom:link href="/author/blogscrt/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Thu, 12 Jan 2023 14:46:39 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>blogscrt &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Magento &#8211; RCE &#038; Local File Read with low privilege admin rights</title>
		<link>/2019/01/24/magento-rce-local-file-read-with-low-privilege-admin-rights/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Thu, 24 Jan 2019 17:24:03 +0000</pubDate>
				<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[web]]></category>
		<guid isPermaLink="false">/?p=2493</guid>

					<description><![CDATA[I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is a second paper which covers two vulnerabilities I discovered on Magento, a big ecommerce CMS that&#8217;s now part of Adobe Experience Cloud. These vulnerabilities have been responsibly disclosed to Magento team, and patched for Magento 2.3.0, &#8230; <a href="/2019/01/24/magento-rce-local-file-read-with-low-privilege-admin-rights/" class="more-link">Continue reading <span class="screen-reader-text">Magento &#8211; RCE &#038; Local File Read with low privilege admin rights</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>winhttpd writeup: private heaps pwning on Windows</title>
		<link>/2019/01/24/private-heaps-pwning-on-windows/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Thu, 24 Jan 2019 08:52:35 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[heap]]></category>
		<category><![CDATA[pwn]]></category>
		<category><![CDATA[windows]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=2481</guid>

					<description><![CDATA[Following last week-end&#8217;s Insomni&#8217;hack teaser and popular demand, here is a detailed write-up for my winhttpd challenge, that implemented a custom multi-threaded httpd and was running on the latest version of Windows 10: This challenge is running on Windows Server 2019, Version 1809 (OS Build 17763.253). Since multi-threaded servers have obvious isolation issues for a &#8230; <a href="/2019/01/24/private-heaps-pwning-on-windows/" class="more-link">Continue reading <span class="screen-reader-text">winhttpd writeup: private heaps pwning on Windows</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>PHPMyAdmin multiple vulnerabilities</title>
		<link>/2018/12/14/phpmyadmin-multiple-vulnerabilities/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Fri, 14 Dec 2018 10:34:10 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=2431</guid>

					<description><![CDATA[During an assignment, I found several serious vulnerabilities in phpMyAdmin, which is an application massively used to manage MariaDB and MySQL databases.&#160;One of them potentially leads to arbitrary code execution by exploiting a Local file inclusion, while the other is a CSRF allowing any table entry to be edited. 1. Local File INCLUSION in transformation &#8230; <a href="/2018/12/14/phpmyadmin-multiple-vulnerabilities/" class="more-link">Continue reading <span class="screen-reader-text">PHPMyAdmin multiple vulnerabilities</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Remote Code Execution on a Facebook server</title>
		<link>/2018/08/24/remote-code-execution-on-a-facebook-server/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Fri, 24 Aug 2018 12:57:02 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=2419</guid>

					<description><![CDATA[I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is my first paper which covers a vulnerability I discovered on one of Facebook&#8217;s servers. While scanning an IP range that belongs to Facebook (199.201.65.0/24), I found a Sentry service hosted on 199.201.65.36, with the hostname sentryagreements.thefacebook.com. &#8230; <a href="/2018/08/24/remote-code-execution-on-a-facebook-server/" class="more-link">Continue reading <span class="screen-reader-text">Remote Code Execution on a Facebook server</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>PassFilt.dll &#8211; Complexifier sa politique de mot de passe Windows</title>
		<link>/2017/08/23/passfilt-dll-complexifier-sa-politique-de-mot-de-passe-windows/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Wed, 23 Aug 2017 08:43:53 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=2329</guid>

					<description><![CDATA[La gestion des mots de passe en entreprise est un challenge très complexe à appréhender. Les bonnes pratiques que l&#8217;on peut trouver un peu partout sont toutes d&#8217;accord pour augmenter la taille minimum d&#8217;un mot de passe tout en imposant un mélange de tous types de caractères. Ajouter à cela la nécessité de changer régulièrement &#8230; <a href="/2017/08/23/passfilt-dll-complexifier-sa-politique-de-mot-de-passe-windows/" class="more-link">Continue reading <span class="screen-reader-text">PassFilt.dll &#8211; Complexifier sa politique de mot de passe Windows</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;Hack 2017 &#8211; FPS Write-Ups</title>
		<link>/2017/06/06/fps-write-ups-for-insomnihack-2017/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Tue, 06 Jun 2017 21:51:28 +0000</pubDate>
				<category><![CDATA[Events]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=2268</guid>

					<description><![CDATA[For the 10th Insomni&#8217;Hack anniversary, new hacking challenge categories were available during the CTF. They consisted of social engineering, hacking&#160;room, and a multiplayer FPS game. This article will cover several write-ups for this last category. It is a great occasion to understand quickly some basis of modern game hacking. The game was compiled with Unity &#8230; <a href="/2017/06/06/fps-write-ups-for-insomnihack-2017/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;Hack 2017 &#8211; FPS Write-Ups</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>SecureIT Valais &#8211; Workshop Buffer Overflow</title>
		<link>/2017/02/22/secureit-valais-workshop-buffer-overflow/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Wed, 22 Feb 2017 14:40:33 +0000</pubDate>
				<category><![CDATA[Events]]></category>
		<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=2173</guid>

					<description><![CDATA[La première édition de SecureIT s&#8217;est déroulée&#160;vendredi le 17 février à Sierre. L’événement organisé par l&#8217;AVPC (Association Valaisanne pour la Promotion de la Cybersécurité) en collaboration avec la HES-SO Valais-Wallis, Parti Pirate et le groupe de hackers étiques Fourchette Bombe, a rassemblé près de 300 participants. J&#8217;y ai présenté un workshop sur l&#8217;exploitation d&#8217;un Buffer &#8230; <a href="/2017/02/22/secureit-valais-workshop-buffer-overflow/" class="more-link">Continue reading <span class="screen-reader-text">SecureIT Valais &#8211; Workshop Buffer Overflow</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Exploiting a misused C++ shared pointer on Windows 10</title>
		<link>/2017/01/27/exploiting-a-misused-c-shared-pointer-on-windows-10/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Fri, 27 Jan 2017 10:17:28 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[control flow guard]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[rop]]></category>
		<category><![CDATA[use after free]]></category>
		<category><![CDATA[windows]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=2118</guid>

					<description><![CDATA[In this post I describe a detailed solution to my &#8220;winworld&#8221; challenge from Insomni&#8217;hack CTF Teaser 2017. winworld was a x64 windows binary coded in C++11 and with most of Windows 10 built-in protections enabled, notably AppContainer (through the awesome AppJailLauncher), Control Flow Guard and the recent mitigation policies. These can quickly be verified&#160;using Process &#8230; <a href="/2017/01/27/exploiting-a-misused-c-shared-pointer-on-windows-10/" class="more-link">Continue reading <span class="screen-reader-text">Exploiting a misused C++ shared pointer on Windows 10</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Joomla! Admin user creation (3.4.4 → 3.6.3)</title>
		<link>/2016/11/10/joomla-admin-user-creation-3-4-4-%e2%86%92-3-6-3/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Thu, 10 Nov 2016 09:33:03 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=2081</guid>

					<description><![CDATA[On October 25th, Joomla! was updated to version 3.6.4 to address two vulnerabilities : CVE-2016-8869 concerning registration with elevated privileges.CVE-2016-8870 concerning account creation while registration is disabled. In this post, we wanted to quickly discuss the vulnerability and its impact on vulnerable installations. Upon patch-diffing the two versions, we noticed that an entire method had &#8230; <a href="/2016/11/10/joomla-admin-user-creation-3-4-4-%e2%86%92-3-6-3/" class="more-link">Continue reading <span class="screen-reader-text">Joomla! Admin user creation (3.4.4 → 3.6.3)</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>recon 2016</title>
		<link>/2016/07/04/recon-2016/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Mon, 04 Jul 2016 10:32:05 +0000</pubDate>
				<category><![CDATA[Events]]></category>
		<category><![CDATA[conférence]]></category>
		<category><![CDATA[recon]]></category>
		<guid isPermaLink="false">/?p=2021</guid>

					<description><![CDATA[Première fois à recon et, oh waww!&#160;Assez différente des autres conférences, recon (dont le site web est recon.cx et non recon.com) est fortement orientée sur le Reverse Engineering et l&#8217;exploitation,&#160;que ce soit hardware ou software. Étalée sur 3 jours avec une seule track, la conférence est pleine&#160;de talks à la fois&#160;intéressants et hallucinants, que nous &#8230; <a href="/2016/07/04/recon-2016/" class="more-link">Continue reading <span class="screen-reader-text">recon 2016</span></a>]]></description>
		
		
		
			</item>
	</channel>
</rss>
