Orange Cyberdefense Switzerland's technical blog
After discovering a weird base64 encoded format during pentest I wanted to find out what was that format and I met BinaryFormatter.
The BinaryFormatter format is internally used in a bunch of functions or can be used directly to materialize .NET objects.
Continue reading .NET serialiceptionSCRT has launched a partnership with Skybox Security to help its clients to strenghlen their risk identification and measurement capabilities.
Continue reading SCRT infrastructure division – New partnership announcementrbaced was a pwnable challenge at last week-end’s Insomni’hack Teaser, split in 2 parts: rbaced1 and rbaced2.
TL;DR: grsecurity/PaX can prevent introducing executable memory in a process or execute untrusted binaries, and make your life miserable.
Continue reading rbaced – a CTF introduction to grsecurity’s RBACLast weekend saw the year’s CTF competitions begin with our very own Insomni’hack teaser. Given some of the recent absurdities (http://weputachipinit.tumblr.com/) we decided to go with the Internet of Things as our theme this year.
Continue reading Insomni’hack 2016 teaser resultsAt the recent BlackHat Europe conference (November 10 – 13, Amsterdam) a security researcher called Ian Haken presented a very interesting, simple yet powerful attack allowing to bypass Windows (Kerberos) authentication on machines being part of a Domain.
Continue reading Bypassing TPM-based Bitlocker
Jeudi 17 septembre
09:00 – 17:00
Hôtel Best Western à Chavannes-de-Bogis
Cet été, 4 ingénieurs de l’équipe se sont rendus à Las Vegas pour les finales du concours de Capture the Flag (CTF) organisé par Legit BS à DEFCON. Ils se sont qualifiés en 10ème position avec l’équipe 0daysober.
Continue reading SCRT @ DEFCON 2015La semaine dernière, plusieurs ingénieurs de SCRT ont participé aux qualifications du CTF Defcon avec l’équipe 0daysober, qui a terminée 10ème et se qualifie donc pour la finale ! Ce post décrit deux des épreuves résolues, knockedup et heapsoffun.
Continue reading Defcon 2015 résolution heapsoffunThe challenge was delivered as a zip file (InsomniDroid.zip). The first challenge was perhaps to download it (with its 602.5 MiB). The zip file contains a single file: mmcblk0.dd. A file command gives some information:
Continue reading Insomni’hack finals – InsomniDroid Level 1 WriteupLa 7ème édition des “GS Days, Les Journées Francophones de la Sécurité de l’Information” s’est tenue ce mardi 24 mars 2015 à l’Espace St-Martin à Paris.
Continue reading GS Days 2015