<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>exploit &#8211; SCRT Team Blog</title>
	<atom:link href="/tag/exploit/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Thu, 12 Jan 2023 14:46:39 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>exploit &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Magento &#8211; RCE &#038; Local File Read with low privilege admin rights</title>
		<link>/2019/01/24/magento-rce-local-file-read-with-low-privilege-admin-rights/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Thu, 24 Jan 2019 17:24:03 +0000</pubDate>
				<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[web]]></category>
		<guid isPermaLink="false">/?p=2493</guid>

					<description><![CDATA[I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is a second paper which covers two vulnerabilities I discovered on Magento, a big ecommerce CMS that&#8217;s now part of Adobe Experience Cloud. These vulnerabilities have been responsibly disclosed to Magento team, and patched for Magento 2.3.0, &#8230; <a href="/2019/01/24/magento-rce-local-file-read-with-low-privilege-admin-rights/" class="more-link">Continue reading <span class="screen-reader-text">Magento &#8211; RCE &#038; Local File Read with low privilege admin rights</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Exploiting a misused C++ shared pointer on Windows 10</title>
		<link>/2017/01/27/exploiting-a-misused-c-shared-pointer-on-windows-10/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Fri, 27 Jan 2017 10:17:28 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[control flow guard]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[rop]]></category>
		<category><![CDATA[use after free]]></category>
		<category><![CDATA[windows]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=2118</guid>

					<description><![CDATA[In this post I describe a detailed solution to my &#8220;winworld&#8221; challenge from Insomni&#8217;hack CTF Teaser 2017. winworld was a x64 windows binary coded in C++11 and with most of Windows 10 built-in protections enabled, notably AppContainer (through the awesome AppJailLauncher), Control Flow Guard and the recent mitigation policies. These can quickly be verified&#160;using Process &#8230; <a href="/2017/01/27/exploiting-a-misused-c-shared-pointer-on-windows-10/" class="more-link">Continue reading <span class="screen-reader-text">Exploiting a misused C++ shared pointer on Windows 10</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack finals &#8211; SH1TTY writeup</title>
		<link>/2015/03/24/insomnihack-finals-sh1tty-writeup/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Tue, 24 Mar 2015 16:48:05 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[kernel]]></category>
		<category><![CDATA[rop]]></category>
		<guid isPermaLink="false">/?p=1429</guid>

					<description><![CDATA[This challenge wasn&#8217;t solved during the CTF, but StratumAuhuur was pretty close!The source, binary and exploit for this challenge can be found on our github&#160;here. Description: &#8220;Can you write a kernel exploit with your bare hands?&#8221;Also because our theme this year was trolling hollywood hacks, the following video from NCIS was linked:&#160;https://www.youtube.com/watch?v=u8qgehH3kEQ sh1tty was a &#8230; <a href="/2015/03/24/insomnihack-finals-sh1tty-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack finals &#8211; SH1TTY writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack finals &#8211; Jurassic Sparc writeup</title>
		<link>/2015/03/24/insomnihack-finals-jurassic-sparc-writeup/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Tue, 24 Mar 2015 16:47:39 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[buffer overflow]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[sparc]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=1427</guid>

					<description><![CDATA[This task wasn&#8217;t solved during the CTF. People must hate sparc! Find the binary, sources and exploit here! In this task you were provided a sparc&#160;server binary and a python client, which was a Tkinter GUI.&#160;The client&#160;had an automatic animation reproducing&#160;the commands that are entered in the famous Jurassic Park video : The communication is &#8230; <a href="/2015/03/24/insomnihack-finals-jurassic-sparc-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack finals &#8211; Jurassic Sparc writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack finals &#8211; smtpwn writeup</title>
		<link>/2015/03/24/insomnihack-finals-smtpwn-writeup/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Tue, 24 Mar 2015 16:47:03 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[ulimit tricks]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=1425</guid>

					<description><![CDATA[This challenge was solved by several teams during the contest, however it seems that most teams didn&#8217;t have the intended solution, so here it is 😉The source, binary and exploit for this challenge can be found on our github&#160;here!smtpwn was a very simple local SMTP service. Basically you write a message to its stdin, and &#8230; <a href="/2015/03/24/insomnihack-finals-smtpwn-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack finals &#8211; smtpwn writeup</span></a>]]></description>
		
		
		
			</item>
	</channel>
</rss>
