<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>writeup &#8211; SCRT Team Blog</title>
	<atom:link href="/tag/writeup/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Thu, 26 Mar 2026 09:17:01 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>writeup &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Insomni’Hack 2026 &#8211; Golden Payout writeup</title>
		<link>/2026/03/25/insomnihack-2026-the-golden-payout-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Wed, 25 Mar 2026 23:35:02 +0000</pubDate>
				<category><![CDATA[Analytics]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=7338</guid>

					<description><![CDATA[The challenge A massive data breach has just hit our corporate network. Highly sensitive documents have been spotted on a prominent Darknet leaking platform. Preliminary network telemetry has flagged suspicious outbound traffic originating from a specific workstation belonging to one of our DBAs. As part of the Rapid Response Investigation Team, you have been assigned &#8230; <a href="/2026/03/25/insomnihack-2026-the-golden-payout-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’Hack 2026 &#8211; Golden Payout writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni’hack 2025 – GuLosity writeup</title>
		<link>/2025/03/19/insomnihack-2025-gulosity-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Wed, 19 Mar 2025 20:43:27 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=6964</guid>

					<description><![CDATA[The challenge A malware was provided from a real DFIR case that occurred in January 2024. The final payloads were disarmed here, to allow the analysts to dissect the binary safely until they fully understand the execution chain of a reflective shellcode loader named GuLoader [which initially led to the delivery of Remcos RAT with &#8230; <a href="/2025/03/19/insomnihack-2025-gulosity-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’hack 2025 – GuLosity writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2023 CTF Teaser &#8211; DoH ! writeup</title>
		<link>/2023/04/13/insomnihack-2023-ctf-teaser-doh-writeup/</link>
		
		<dc:creator><![CDATA[qlu]]></dc:creator>
		<pubDate>Thu, 13 Apr 2023 14:26:28 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=3973</guid>

					<description><![CDATA[For this 2023 edition, i chose to focus on the DoH (DNS Over Https) protocol because it has gained popularity for attackers as a command and control (C2) communication channel for hiding DNS traffic through HTTPS rather than using the traditional DNS tunneling. In this post, i will describe in details how to solve the &#8230; <a href="/2023/04/13/insomnihack-2023-ctf-teaser-doh-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2023 CTF Teaser &#8211; DoH ! writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>winhttpd writeup: private heaps pwning on Windows</title>
		<link>/2019/01/24/private-heaps-pwning-on-windows/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Thu, 24 Jan 2019 08:52:35 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[heap]]></category>
		<category><![CDATA[pwn]]></category>
		<category><![CDATA[windows]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=2481</guid>

					<description><![CDATA[Following last week-end&#8217;s Insomni&#8217;hack teaser and popular demand, here is a detailed write-up for my winhttpd challenge, that implemented a custom multi-threaded httpd and was running on the latest version of Windows 10: This challenge is running on Windows Server 2019, Version 1809 (OS Build 17763.253). Since multi-threaded servers have obvious isolation issues for a &#8230; <a href="/2019/01/24/private-heaps-pwning-on-windows/" class="more-link">Continue reading <span class="screen-reader-text">winhttpd writeup: private heaps pwning on Windows</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Exploiting a misused C++ shared pointer on Windows 10</title>
		<link>/2017/01/27/exploiting-a-misused-c-shared-pointer-on-windows-10/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Fri, 27 Jan 2017 10:17:28 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[control flow guard]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[rop]]></category>
		<category><![CDATA[use after free]]></category>
		<category><![CDATA[windows]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=2118</guid>

					<description><![CDATA[In this post I describe a detailed solution to my &#8220;winworld&#8221; challenge from Insomni&#8217;hack CTF Teaser 2017. winworld was a x64 windows binary coded in C++11 and with most of Windows 10 built-in protections enabled, notably AppContainer (through the awesome AppJailLauncher), Control Flow Guard and the recent mitigation policies. These can quickly be verified&#160;using Process &#8230; <a href="/2017/01/27/exploiting-a-misused-c-shared-pointer-on-windows-10/" class="more-link">Continue reading <span class="screen-reader-text">Exploiting a misused C++ shared pointer on Windows 10</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack finals &#8211; Jurassic Sparc writeup</title>
		<link>/2015/03/24/insomnihack-finals-jurassic-sparc-writeup/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Tue, 24 Mar 2015 16:47:39 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[buffer overflow]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[sparc]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=1427</guid>

					<description><![CDATA[This task wasn&#8217;t solved during the CTF. People must hate sparc! Find the binary, sources and exploit here! In this task you were provided a sparc&#160;server binary and a python client, which was a Tkinter GUI.&#160;The client&#160;had an automatic animation reproducing&#160;the commands that are entered in the famous Jurassic Park video : The communication is &#8230; <a href="/2015/03/24/insomnihack-finals-jurassic-sparc-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack finals &#8211; Jurassic Sparc writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack finals &#8211; smtpwn writeup</title>
		<link>/2015/03/24/insomnihack-finals-smtpwn-writeup/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Tue, 24 Mar 2015 16:47:03 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[ulimit tricks]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=1425</guid>

					<description><![CDATA[This challenge was solved by several teams during the contest, however it seems that most teams didn&#8217;t have the intended solution, so here it is 😉The source, binary and exploit for this challenge can be found on our github&#160;here!smtpwn was a very simple local SMTP service. Basically you write a message to its stdin, and &#8230; <a href="/2015/03/24/insomnihack-finals-smtpwn-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack finals &#8211; smtpwn writeup</span></a>]]></description>
		
		
		
			</item>
	</channel>
</rss>
