<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Pentest &#8211; SCRT Team Blog</title>
	<atom:link href="/category/pentest/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Mon, 02 Feb 2026 13:30:52 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>Pentest &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Blinding EDRs: A deep dive into WFP manipulation</title>
		<link>/2025/08/25/blinding-edrs-a-deep-dive-into-wfp-manipulation/</link>
		
		<dc:creator><![CDATA[Florian Audon]]></dc:creator>
		<pubDate>Mon, 25 Aug 2025 08:22:56 +0000</pubDate>
				<category><![CDATA[Pentest]]></category>
		<category><![CDATA[Research]]></category>
		<guid isPermaLink="false">/?p=7176</guid>

					<description><![CDATA[This article complements existing research referenced in the Further Reading section. Endpoint Detection and Response (EDR) solutions are essential to modern defensive architectures. Their abilities to monitor, block, and respond to threats are important for containment and remediation. However, like all complex systems, EDRs rely on components that can be turned against them. One of &#8230; <a href="/2025/08/25/blinding-edrs-a-deep-dive-into-wfp-manipulation/" class="more-link">Continue reading <span class="screen-reader-text">Blinding EDRs: A deep dive into WFP manipulation</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Hijacking the Windows &#8220;MareBackup&#8221; Scheduled Task for Privilege Escalation</title>
		<link>/2025/05/20/hijacking-the-windows-marebackup-scheduled-task-for-privilege-escalation/</link>
		
		<dc:creator><![CDATA[Clément Labro]]></dc:creator>
		<pubDate>Tue, 20 May 2025 09:26:14 +0000</pubDate>
				<category><![CDATA[Exploit]]></category>
		<category><![CDATA[Pentest]]></category>
		<guid isPermaLink="false">/?p=7033</guid>

					<description><![CDATA[The built-in &#8220;MareBackup&#8221; scheduled task is susceptible to a trivial executable search order hijacking, which can be abused by a low-privileged user to gain SYSTEM privileges whenever a vulnerable folder is prepended to the system&#8217;s PATH environment variable (instead of being appended). As I was working on a semi-automated research project on an unrelated subject, &#8230; <a href="/2025/05/20/hijacking-the-windows-marebackup-scheduled-task-for-privilege-escalation/" class="more-link">Continue reading <span class="screen-reader-text">Hijacking the Windows &#8220;MareBackup&#8221; Scheduled Task for Privilege Escalation</span></a>]]></description>
		
		
		<enclosure url="/wp-content/uploads/2025/05/poc_compressed.webm" length="609694" type="video/webm" />

			</item>
		<item>
		<title>Reinventing PowerShell in C/C++</title>
		<link>/2025/02/18/reinventing-powershell-in-c-c/</link>
		
		<dc:creator><![CDATA[Clément Labro]]></dc:creator>
		<pubDate>Tue, 18 Feb 2025 08:16:47 +0000</pubDate>
				<category><![CDATA[Pentest]]></category>
		<guid isPermaLink="false">/?p=6726</guid>

					<description><![CDATA[I like PowerShell, I like it a lot! I like its versatility, its ease of use, its integration with the Windows operating system, but it also has a few features, such as AMSI, CLM, and other logging capabilities, that slow it down. You know, I&#8217;m thinking about the performance gain here. I believe my scripts &#8230; <a href="/2025/02/18/reinventing-powershell-in-c-c/" class="more-link">Continue reading <span class="screen-reader-text">Reinventing PowerShell in C/C++</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Exploiting stale ADIDNS entries</title>
		<link>/2023/09/25/exploiting-stale-adidns-entries/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Mon, 25 Sep 2023 09:46:07 +0000</pubDate>
				<category><![CDATA[Pentest]]></category>
		<category><![CDATA[Research]]></category>
		<guid isPermaLink="false">/?p=4365</guid>

					<description><![CDATA[The correct IP address is sometimes all you need to exploit a remote target. Background I realise this article will not help me with my colleagues who believe I just happen to get lucky on every assessment I’m on. Nevertheless, during a recent internal pentest, our first objective was to attempt to bypass the Network &#8230; <a href="/2023/09/25/exploiting-stale-adidns-entries/" class="more-link">Continue reading <span class="screen-reader-text">Exploiting stale ADIDNS entries</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Apache Solr 8.3.1 RCE from exposed administration interface</title>
		<link>/2023/05/01/solr-rce-from-exposed-administration-interface/</link>
		
		<dc:creator><![CDATA[Nicolas Brunner]]></dc:creator>
		<pubDate>Mon, 01 May 2023 07:41:54 +0000</pubDate>
				<category><![CDATA[Exploit]]></category>
		<category><![CDATA[Pentest]]></category>
		<category><![CDATA[RCE]]></category>
		<category><![CDATA[Solr]]></category>
		<guid isPermaLink="false">/?p=2803</guid>

					<description><![CDATA[Back in 2020, during an external pentest, I stumbled upon a visible Solr administration panel. With nothing else of interest, I focused on this specific application to test what was hidden underneath. The version of Apache Solr was 8.3.1 and running on Windows. Note that this pentest was performed in 2020, way before the discovery &#8230; <a href="/2023/05/01/solr-rce-from-exposed-administration-interface/" class="more-link">Continue reading <span class="screen-reader-text">Apache Solr 8.3.1 RCE from exposed administration interface</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Bypassing LSA Protection in Userland</title>
		<link>/2021/04/22/bypassing-lsa-protection-in-userland/</link>
		
		<dc:creator><![CDATA[Clément Labro]]></dc:creator>
		<pubDate>Thu, 22 Apr 2021 12:30:33 +0000</pubDate>
				<category><![CDATA[Exploit]]></category>
		<category><![CDATA[Pentest]]></category>
		<guid isPermaLink="false">/?p=2837</guid>

					<description><![CDATA[In 2018, James Forshaw published an article in which he briefly mentioned a trick that could be used to inject arbitrary code into a PPL as an administrator. However, I feel like this post did not get the attention it deserved as it literally described a potential Userland exploit for bypassing PPL (which includes LSA &#8230; <a href="/2021/04/22/bypassing-lsa-protection-in-userland/" class="more-link">Continue reading <span class="screen-reader-text">Bypassing LSA Protection in Userland</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>State of Pentesting 2020</title>
		<link>/2020/12/28/state-of-pentesting-2020/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Mon, 28 Dec 2020 08:04:07 +0000</pubDate>
				<category><![CDATA[Pentest]]></category>
		<guid isPermaLink="false">/?p=2769</guid>

					<description><![CDATA[To many people, pentesting (or hacking in a broader sense) is a dark art mastered by some and poorly understood by most. It has evolved quite substantially throughout the years, guided by new vulnerabilities, changing behaviours and maybe most importantly the development and release of new tools, be they offensive or defensive. In this blog &#8230; <a href="/2020/12/28/state-of-pentesting-2020/" class="more-link">Continue reading <span class="screen-reader-text">State of Pentesting 2020</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Continuous Pentesting</title>
		<link>/2020/08/26/continuous-pentesting/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Wed, 26 Aug 2020 08:39:22 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Pentest]]></category>
		<guid isPermaLink="false">/?p=2757</guid>

					<description><![CDATA[At SCRT, we have been performing penetration tests for nearly 20 years now and have always tried to improve our methodologies to match client expectations and deliver the most accurate and useful results from each test we undertake. Over the last few years, Bug bounty programs have been making a name for themselves as they &#8230; <a href="/2020/08/26/continuous-pentesting/" class="more-link">Continue reading <span class="screen-reader-text">Continuous Pentesting</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Metasploit psexec resurrect</title>
		<link>/2014/06/13/metasploit-psexec-resurrect/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Fri, 13 Jun 2014 11:30:14 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Pentest]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=1385</guid>

					<description><![CDATA[What a joy ! I just received tonight this nice email from github : Meatballs1&#160;merged commit&#160;1a3b319&#160;into&#160;rapid7:master&#160;from&#160;agix:refreshed_service_payloads My 2 years old pull request to metasploit was just accepted ! Long story short Annoyed to have to chain msfencode and msfencode and msfencode to bypass anti-virus during penetration testing, we wanted to create some packers that do &#8230; <a href="/2014/06/13/metasploit-psexec-resurrect/" class="more-link">Continue reading <span class="screen-reader-text">Metasploit psexec resurrect</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Le framework metasploit &#8211; 2/2</title>
		<link>/2011/06/08/le-framework-metasploit-22/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Wed, 08 Jun 2011 10:51:42 +0000</pubDate>
				<category><![CDATA[Pentest]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[intrusion]]></category>
		<category><![CDATA[Metasploit]]></category>
		<category><![CDATA[meterpreter]]></category>
		<category><![CDATA[misc]]></category>
		<category><![CDATA[pentest]]></category>
		<guid isPermaLink="false">/?p=645</guid>

					<description><![CDATA[Ce post fait suite à la publication de la première partie de l&#8217;article sur le framework metasploit publié dans le numéro 52 du magasine MISC par Julien Bachmann et Nicolas Oberli. Attaque du LAN Mise en place d&#8217;une connexion persistante Maintenant qu&#8217;un shell est accessible sur un serveur Windows du LAN il est intéressant de &#8230; <a href="/2011/06/08/le-framework-metasploit-22/" class="more-link">Continue reading <span class="screen-reader-text">Le framework metasploit &#8211; 2/2</span></a>]]></description>
		
		
		
			</item>
	</channel>
</rss>
