Youtube daily report w Nov 24 2017

Last weeks video was about revisiting format level 0 from exploit-exercises/protostar on

a modern ubuntu system.

And we played around with it to see if we can figure out a way to exploit it, but in

the end I wasn't able to solve it.

But lucky for me a user with the name wcbowling on reddit thought it was fun too and actually

had a method to exploit it.

So let's have a look at it.

So here is wcbowlings post:

I love going back to old challenged like this :) Managed to get a fairly reliable exploit,

normally under 500 iterations.

And there is a highlevel description on how it works:

Overwrite the GOT entry for __stack_chk_fail with an address so we jump there instead.

The address can be passed in via argv, we cant use nulls but we can use blank strings

instead.

As the argv location is semi random, it takes around 500 iterations which is pretty reasonable

for 64bit

So obviously I didn't manage to figure that out, which means I didn't know something

and here is a learning opportunity for me.

So I'm not going to pretend I knew this.

For whatever reason I never noticed that __stack_chk_fail is in the global offset table.

And the reason for that might be, that I never encountered a challenge with these constraints?

We have A) a format string exploit that generally allows us to write anything anywhere B)

No libc function after the format string vuln that we could overwrite in the global offset

table And C) where we also have a buffer overflow

with a stack cookie.

So I really like this challenge now, because the solution is so clever.

So the function that is being called when the stack cookie got overwritten through a

buffer overflow is also on the global offset table.

Which means our goal is to redirect code execution to our winning message by overwrite the GOT

entry for __stack_chk_fail.

And then do a buffer overflow, to trigger that function.

To write to that global offset table entry, we have to get the address somewhere onto

the stack, so that we can use %n with the format string vulnerability.

And the issue is that it contains nullbytes which we can't pass in via the arguments.

I think the arguments are string copied onto the stack?

So we can't enter arbitrary nullbytes.

But wcbowling had a cool trick with empty strings as arguments.

Because a string ends with a nullbyte, so an empty string is just null.

I think I had a super early video to talk about the environment and arguments on the

stack, but quick recap, you have the argv[] char pointer array, so it's a list with

addresses that point to the strings.

And then you just have memory with all the strings.

And so this way you can get the address with null-bytes on to the stack.

Pretty clever, I never thought about this before.

And now you basically just have to put everything together.

Wcbowling uses pwnlib to implement the exploit, it's a very useful python library, check

it out.

And so here the magic format string is built with a large offset into the stack that hopefully

hits the addresses passed in via the arguments.

And so there are two single byte writes.

Why are only two bytes written?

well the GOT already contains an address that is almost the target address, except the last

two bytes.

So you can just reuse most of it.

Then this is being executed in a loop until the winning message is shown.

The stack has some randomized offsets, thus you have to try it a few times.

Here is the asciicinema recording by wcbowling.

By the way, if you have a problem with a challenge and you write me an email, you could use that

to record a screencast so I can actually see how you debug it and what the problem is.

So while I understand now the basic idea, I still wanted to implement it myself.

There are a few challenges that you have to solve like, what is good offset into the stack

to hit the arguments, and the alignment of the address through the arguments.

And while I was doing that and struggling with exactly those details, I had an epiphany.

And I'm sooo grateful that wcbowling shared this exploit, because it pushed me into discovering

this.

So I actually found a 100% reliable exploit for this challenge, and you can't believe

how excited that makes me.

Though I have to admit, that it might only work on my compiled binary, and for somebody

else it might not work, you will see in a second why.

So here it is.

That's all.

And when we execute it, you can see it gets into an execution loop of the winning message.

And while it looks like a simple format string vulnerability with the padding to increase

the amount of printed characters, an address and a %n or %hn to write to an address, there

are quite a few beautiful puzzle pieces here.

So the basic idea came, when I was playing around with overwriting the GOT entry for

__stack_check_fail.

wcbowling had two writes and placed the address in the arguments, which made it so unreliable.

I thought, maybe we get lucky if we place the address into our string, like I did in

the last video.

But there is one problem.

The string that is printed is coming from the arguments, which has an unpredictable

position.

But the string is formatted with sprintf into a buffer, which will have a fixed relative

position on our stack.

So basically the format string will be evaluated, so first it handles the %d with the 1640 character

padding and places it into the buffer.

Then comes the raw bytes of the address, and places it.

And then comes the format modifier to write to an address on the stack.

So now the position of this address that was just written onto the buffer is at a fixed

offset location and we always get it with 214.

Though the problem is, we can't have an arbitrary amount of bytes padding.

Because the address has to be 8byte alligned.

So we can only increase or decrease the padding in 8 byte steps.

Which affects the amounts of bytes we can write.

With %n.

It's always in these 8 steps.

So we don't have an write anything condition, but we can write something close to the wiining

address.

Now there are two challenges.

First, the stack is fairly small, and the format result is written into buffer on the

stack, so if we use too much padding, to write a large number with %n, we run out of stack

memory and get a segfault.

But wcbowling's trick has made me realize, that we can in fact increase the size of the

stack by just using more arguments.

It will add entries to the argv array and increase it.

The second problem is, that the address is only written with 3 bytes, so if the location

on the stack had other values in it, it won't work.

We need to write our address onto the stack where there was a zero, or generally a small

number before.

And here is also where the arguments help us again, because we can groom the stack,

by adding or remove entries in the argv array, so that the stack is large enough, and we

have a zero at the correct spot.

<grunt> I love it!

So now we know how to groom the stack to write to the GOT entry, but we still have the issue

that we are not sure what to write because of our multiples of 8 restrictions.

I wrote a simple python function that generates me valid exploit arguments with different

paddings and adjusts the amount of arguments and the write offset accordingly.

And I started by looking around the printing of the winning message.

So ideally we would like to write 0x670, that's 1648, but becuase of our alignment restrictions

that doesn't work.

Anyway, I was then just trying them, to see if anything interesting would come from it.

And luckily this one worked.

Let me debug this with gdb, I set a breakpoint after the sprintf, before we check the stack

cookie.

Let's look at the stack.

So this is the %d padding with spaces, to print the amount of characters we want to

write to.

And then here at the end is the target address we want to write to.

The GOT address.

We can also look now what value has been written there.

So we will jump to 0x40066b.

Let's look at the disassembly and see where that would be.

66b.

Mhmmh… wait!

That is not a valid address, this is not right?

It's in between the compare and the jump-not-equal.

Let's use x to print 3 instructions, instead of the disassemble command.

Do you see that.

WTF there are now moves, and not a cmp?

What the heck?

Welcome to intel assembler and more advanced ROP.

This kind of property was called the geometry of intel assembler, in the famous ROP paper,

but never heard anybody using that term.

Anyway, we jump in between the bytes of the intended instruction, and the CPU is dumb,

it will just read those bytes and interpret them as assembler.

And so in this case, the cmp and jne turned into two simple moves.

Which means, now there is no check for deadbeef and we run into the printf to print the winning

message.

When we single step forward now, we get into the procedure linkage table for stack_check_fail,

we jump to the GOT entry, which is our weird address into vuln, we execute the mov, and

then we call puts to print the message.

For more infomation >> Stack grooming and 100% reliable exploit for format0 - bin 0x25 - Duration: 10:44.

-------------------------------------------

Motorcycle travel to South America. Episode seven. - Duration: 36:38.

For more infomation >> Motorcycle travel to South America. Episode seven. - Duration: 36:38.

-------------------------------------------

Nova Fazer 250 2018 - Ep. 124 - Duration: 4:48.

For more infomation >> Nova Fazer 250 2018 - Ep. 124 - Duration: 4:48.

-------------------------------------------

PUBG - нубас играет стрим:))) - Duration: 1:14:37.

For more infomation >> PUBG - нубас играет стрим:))) - Duration: 1:14:37.

-------------------------------------------

【あるものを生かしてないものをつくる〜安藤忠雄〜】字幕付き - Duration: 3:30.

For more infomation >> 【あるものを生かしてないものをつくる〜安藤忠雄〜】字幕付き - Duration: 3:30.

-------------------------------------------

Suzuki Swift - Duration: 1:11.

For more infomation >> Suzuki Swift - Duration: 1:11.

-------------------------------------------

Suzuki Swift - Duration: 1:07.

For more infomation >> Suzuki Swift - Duration: 1:07.

-------------------------------------------

Morgan pronto a tornare in tv ma in Rai|Hot News 24h - Duration: 1:39.

For more infomation >> Morgan pronto a tornare in tv ma in Rai|Hot News 24h - Duration: 1:39.

-------------------------------------------

You and Me

For more infomation >> You and Me

-------------------------------------------

Vitória do Flamengo sela amizade entre Felipe Vizeu e Rhodolfo - Duration: 2:05.

For more infomation >> Vitória do Flamengo sela amizade entre Felipe Vizeu e Rhodolfo - Duration: 2:05.

-------------------------------------------

Maria De Filippi dice la sua su Cecilia e Ignazio | Gossip World - Duration: 1:53.

For more infomation >> Maria De Filippi dice la sua su Cecilia e Ignazio | Gossip World - Duration: 1:53.

-------------------------------------------

Peugeot 2008 ALLURE 1.6 E-HDI 92PK | AUTOMAAT | NAVI | LEDER | CLIMA | LMV - Duration: 0:56.

For more infomation >> Peugeot 2008 ALLURE 1.6 E-HDI 92PK | AUTOMAAT | NAVI | LEDER | CLIMA | LMV - Duration: 0:56.

-------------------------------------------

Entrega das chaves para os cliente Jairo e Aline - Duration: 0:42.

For more infomation >> Entrega das chaves para os cliente Jairo e Aline - Duration: 0:42.

-------------------------------------------

10 TRUQUES DE BELEZA QUE FUNCIONA E TODA MULHER DEVERIA CONHECER - Duration: 3:07.

For more infomation >> 10 TRUQUES DE BELEZA QUE FUNCIONA E TODA MULHER DEVERIA CONHECER - Duration: 3:07.

-------------------------------------------

Cruis'n USA - O PRIMEIRO JOGO DE CORRIDA DA MINHA VIDA | Flagamer S07E21 - Duration: 10:25.

For more infomation >> Cruis'n USA - O PRIMEIRO JOGO DE CORRIDA DA MINHA VIDA | Flagamer S07E21 - Duration: 10:25.

-------------------------------------------

Maybe There Isn't Liquid Water on Mars - Duration: 6:27.

Two years ago, the entire scientific community—including us—freaked out because researchers discovered

flowing liquid water on the surface of Mars.

But now, some scientists aren't so sure.

According to a paper published on Monday in Nature Geoscience, it might just be… sand.

Which is way less fun.

Y'know, sand is coarse... and rough.. and gets everywhere.

Since life on Earth relies on liquid water, we're always searching for it in other parts

of the solar system, in case it contains alien bacteria or can teach us more about our planet.

And thanks to previous missions, we've found that Mars has plenty of water frozen in polar

ice caps or floating around as water vapor.

But in 2015, researchers announced that they'd found liquid water trickling down hills on

Mars' surface.

Specifically, they found hydrated salts, which are just salt molecules attached to some water molecules.

And these hydrated salts created dark, flowing lines on Mars' surface called recurring

slope lineae, or RSLs.

On the off-chance life was hanging out in those RSLs, we didn't want to send the Curiosity

rover to check them out, because it's contaminated with material from Earth.

But scientists have been analyzing them with satellites.

In this new paper, they used the HiRISE satellite orbiting Mars to study the slopes of more

than 150 RSLs at 10 different sites.

They found that, on average, almost all of the RSLs ended when a hill got between 28

and 35 degrees steep.

And, according to measurements of Martian sand dunes, that's about the same angle

where flowing sand stops moving.

The scientists argue that, if the RSLs do contain liquid water, some of them should

flow past that roughly 30-degree mark.

Still, that's not the only reason they're questioning the liquid water idea.

For one, if RSLs were filled with salty water, they should be depositing dry salt piles when

the water eventually evaporates, but scientists haven't found any yet.

Also, one of the arguments for RSLs containing water is that they appear seasonally, like

water is freezing and melting.

But this team observed that sand flows can also change seasonally, based on how dust

blows around on Mars' surface.

Still, this definitely isn't a perfect hypothesis: The researchers admitted that seasonal sand

flow happens more easily on certain dunes that are constantly replenished by new sand

blowing onto them.

And the hills where we've seen RSLs aren't all like that.

And sand can't explain the hydrated salts, either.

But there are other possibilities!

Previous studies, like one published last year in Geophysical Research Letters, have

suggested that they could be caused by carbon dioxide frost instead, which would form when

gas condenses and freezes on the surface.

So before you throw your swimsuit into your bag and put it on your Mars rocket, maybe

wait a little while until we know a little more.

But don't abandon your suitcase entirely!

Because last week, astronomers announced that they've found a new, nearby exoplanet that

might be one of the most welcoming yet.

It's called Ross 128 b, and it was spotted using HARPS, an instrument attached to a telescope

in Chile.

HARPS is one of our most successful tools for finding new worlds.

It discovers planets by measuring wobbles in stars, which suggest that something — like

a planet — is pulling on them.

And that's how we found 128 b.

This new planet orbits a red dwarf star only 11 light-years away, making it the second

closest Earth-like exoplanet we've found.

Proxima Centauri b is just about 4 light-years away.

Red dwarfs are the most common stars in the universe, and they can be great exoplanet

parents.

They're only half the size of the Sun at most, and aren't too bright or hot.

And, while some of them can give off the occasional violent burst of radiation, the star 128 b

orbits seems especially calm.

From what we know so far, Ross 128 b doesn't seem too different from Earth.

It's about the same size, and its temperature probably ranges from -60 to 20 degrees Celsius.

But since its star is so small, 128 b orbits it a lot more closely than we do the Sun — about

20 times closer.

This helps it stay nice and warm, but it also means a year there lasts a little less than

10 days.

But if you don't mind birthday cake, that's not so bad.

Right now, even though the planet seems homey, we're not sure what its atmosphere is like,

or if it has liquid water on its surface.

So that's the next thing to figure out.

But when the European Southern Observatory's Extremely Large Telescope comes online in

2024, it should be able to figure out if 128 b has any oxygen in its atmosphere.

For now, it's still the most temperate planet we've ever found around such a calm star,

so that's still pretty awesome.

And we'll be learning more about it soon.

Plus, 128 b's star is currently cruising toward our solar system, and in around 70,000

years, it'll be the closest star to Earth besides the Sun.

So if we're still around in 70,000 years, but still haven't got warp drive figured

out, at least the trip will be a little shorter if we do decide to go.

Alright, exciting announcement!

I've been telling everybody about this.

The SciShow team and I were talking about a problem that many of us have.

Often, people will ask us what we want for Christmas, or for our birthdays and we won't

know what to say because we don't care about stuff that much.

But then I was thinking: there are things that I would like to get, or that I've bought

for myself, or that people have given to me that I really love because I love the world,

I love the universe, the existence of biology...that kind of thing.

So we put together a collection of artifacts of this universe...we got a limited number

of each of those things, and we have put them up at a store called SciShow Finds.

The SciShow Finds are curated by me, they are things that I would love to get in my

stocking.

It's a very small list of just six cool things of varying price points.

I did my best to only include one science book.

It's the book that I read this year that affected me the most, it's called "What is

Life" and it makes an extremely compelling case that biology is a chemical inevitability.

Which is a really important thought for having there be life out there in the universe.

As time progresses, we're probably going to add some new finds.

And as we add new ones, they will replace the ones, so all of these products are only

around for a limited time.

You're bound to have friends or family who would love some Mars Socks, trilobite fossils,

or maybe this Space Shuttle lapel pin.

And, if not, you might just want to get them for yourself or just slide the link in if

anybody's like, "What do you want, man?"

Just be like, "SciShowFinds.com!"

And know that when you go to SciShowFinds.com or send somebody there, you're also supporting

SciShow.

So, thank you!

Thank you for doing that, in that way, and also for doing that by watching this video.

You're the best!

For more infomation >> Maybe There Isn't Liquid Water on Mars - Duration: 6:27.

-------------------------------------------

Cappella Mediterranea | Choeur de Chambre de Namur - Duration: 3:40.

For more infomation >> Cappella Mediterranea | Choeur de Chambre de Namur - Duration: 3:40.

-------------------------------------------

Nova Fazer 250 2018 - Ep. 124 - Duration: 4:48.

For more infomation >> Nova Fazer 250 2018 - Ep. 124 - Duration: 4:48.

-------------------------------------------

ETOPS - AVIÃO CRUZANDO O OCEANO - Duration: 5:42.

HI PEOPLE WELCOME ON BOARD

TODAY WE WILL TALK ABOUT ETOPS

AND WHAT IS ETOPS

IT MEANS EXTENDED OPERATIONS

AND WHAT IS IT FOR?

TO FLY A LONG DISTANCES OVER THE OCEAN

AN AUTHORIZATION IS REQUIRED

ETOPS IS THE AUTHORIZATION

IT IS FOR A TWIN-ENGINE AIRCRAFTS OR MORE

EVERYTHING IN AVIATION IS TO BE AS SAFER AS POSSIBLE

FORMERLY ONLY FOUR-ENGINE AIRCRAFTS COULD FLY OVER THE OCEAN

CROSS THE OCEAN IS WORRISOME BECAUSE

IN EMERGENCY THERE IS NO RUNWAY TO LAND

SO THEY CREATED ETOPS CLASSIFICATION

THERE ARE SOME CLASSIFICATIONS

ACCORDING TO AIRCRAFT AND AIRLINE RELIABILITY

FORMERLY THERE WAS ONLY ETOPS 120

IT MEANS THAT AN AIRCRAFT COULD CROSS THE OCEAN

SINCE THERE IS AN AIRPORT TO LAND IN 120 MINUTES FLYING

IT WAS A REASON FOR THE FLIGHT BEING LONGER

BECAUSE INSTEAD OF FLY STRAIGHT

TO GARANTEE THIS 120 MINUTES TO AN AIRPORT

IT HAD TO MAKE A DEVIATION ON THE ROUTE

TO BE NEAR (120 MINUTES) TO AN AIRPORT

WITH THE PROGRESS OF TECHNOLOGY

THE ETOPS TIME WAS INCREASING

FOR EXAMPLE, NOWADAYS WE HAVE A350

IT'S CLASSIFICATION IS ETOPS 370

THIS AIRCRAFTS CAN FLY 370 MINUTES TO AN AIRPORT

YOU CAN SEE HOW RELIABLE IT IS

IT REFLECTS IN A FASTER FLY

AND MORE SAVING

IT HELPS PASSENGERS AND THE COMPANY

FOR EXAMPLE AN NON AUTHORIZED ETOPS COMPANY

CAN FLY ONLY 60 MINUTES

IT IS A BIG DIFFERENCE

BUT IT DOESN'T MEAN THE COMPANY CAN FLY ETOPS JUST BECAUSE THE AIRCRAFT IS HOMOLOGATED

COMPANY MUST BE HOMOLOGATED ETOPS AS WELL

IT NEEDS AIRCRAFT HOMOLOGATION MORE AIRLINE HOMOLOGATION

AIRLINE MUST PROVE THAT IT CAN GUARANTEE THE SAFETY OF THE AIRCRAFT

IN TERMS OF MAINTENANCE

IT MUST TRAINEE THE CREW

THE OPERATIONAL DISPATCH

THE MAINTENANCE PEOPLE

SO EVERYTHING MUST BE DONE TO BE ABLE TO FLY ETOPS

SINCE IT IS DIFFERENT OF A NORMAL OPERATION

THE COMPANY ALSO MUST HAVE A PLAN

IN CASE OF LANDING ON THIS ALTERNATIVE

LET'S SUPPOSE THIS ALTERNATIVE IS A VERY SMALL CITY

WITH NO STRUCTURE

TO RECEIVE THE PASSENGERS

LIKE HOTEL, FOOD...

SO, COMPANY MUST HAVE A PLAN

TO ACCOMMODATE PASSENGERS

OR REMOVE THE PASSENGERS TO ANOTHER PLACE

SEND FOOD

SEND MAINTENANCE PEOLPLE

TO FIX THE AIRCRAFT

SO, IT IS NOT ONLY THE RUNWAY

TO BE CONSIDERATE AN ALTERNATE

IT MUST HAVE A PLAN

HAVE YOU ALREADY NOTICED THAT

FOR EXAMPLE A FLIGHT FROM BRAZIL

TO JOHANESBURG

THERE SOME COMPANY WITH A FASTER FLIGHT

THAN OTHERS?

THERE IS A DIFFERENCE

WITHOUT SCALE

IN A DIRECT FLIGHT

THIS IS ONE OF THE REASONS

TO A FLIGHT BE FASTER THAN OTHERS

A COMPANY CAN HAVE A HOMOLOGATION ETOPS 120

AND THE OTHER ONE HAS A 180

SO THIS ONE IS ABLE TO FLIGHT MORE STRAIGHT

WITH LESS DEVIATION

AND A FASTER FLIGHT

SO THIS IS IT

AS EVERYTHING IN AVIATION IS DONE FOR SAFETY

AND AS AVIATION IS GETTING BETTER

ETOPS IS INCREASING

I HOPE YOU LIKED IT

For more infomation >> ETOPS - AVIÃO CRUZANDO O OCEANO - Duration: 5:42.

-------------------------------------------

All-Gender Holiday Gift Guide & GIVEAWAY | Christmas 2017 - Duration: 19:53.

Hello YouTube and Welcome to the 2017 Gift Guide:

Essential Gifts for Christmas with the Mortons

So we've got lots of things from Beauty Gifts to more like Geeky Gifts,

technology gifts, [ALEX] How come you point at me when you say Geeky?

"Beauty Gifts, ah, Geeky Gifts"

*haha* as well as some consumable gifts for the minimalist in your life.

Many of these are things we've gifted each other in the past,

and a couple of other things are just things I would love to get haha

[ALEX] Likewise [ARNA] *hint hint*

Do you like our beautiful... get out of the way haha

have a look at our gorgeous little Xmas Tree

This is actually legitimately our Xmas tree as well because we live in a tiny apartment

[Alex] How long has it been up for Arna??

... October 30th I put the tree up...

So the first gift is something a little more significant

a little bit of a higher price point and something to give to someone you really really care about

[alex] a significant other [arna] yes, a significant other or a family member or a special friend,

and it is actually the watch I am wearing here:

And this video is kindly sponsored by the Peach Box who sell these Marc Bale Watches

For more infomation >> All-Gender Holiday Gift Guide & GIVEAWAY | Christmas 2017 - Duration: 19:53.

-------------------------------------------

Renata Bueno se diz favorável à limitação de geração para a cidadania - Duration: 0:33.

For more infomation >> Renata Bueno se diz favorável à limitação de geração para a cidadania - Duration: 0:33.

-------------------------------------------

Lección 1: ¿Qué es la FA y que lo causa? - Duration: 2:21.

For more infomation >> Lección 1: ¿Qué es la FA y que lo causa? - Duration: 2:21.

-------------------------------------------

Skoda Kodiaq - Duration: 1:09.

For more infomation >> Skoda Kodiaq - Duration: 1:09.

-------------------------------------------

Skoda Kodiaq - Duration: 1:08.

For more infomation >> Skoda Kodiaq - Duration: 1:08.

-------------------------------------------

Eixos (Axis) Webseries - Episode 4 - Duration: 5:30.

- Good morning.

- Hi..

- You slept with that book on you.

Actually, you pretty much passed out.

- Uhum.

- How's your bruise?

Feeling any better?

- Yeah...

Thanks.

- Stop messing with my stuff, damn it! - Sorry, sorry! Chill...

It's fine, everything's fine..

What is all that stuff for, anyway?

- Books aren't the only things that should be saved.

You're going back to the Terreiro, right?

You think I can talk to Mother Obá?

- I guess so...

I need to check on everyone as well.

- Great. Then I'll walk you there,

I'll ask Mother Obá what I need to know,

And the sooner I can back to my life, the better.

- Okay...

Thank you for the warm welcome, I guess..

- You coming?

- I'm going!

Axis

- You really going to keep looking for Igor on your own?

- Of course.

- It's just not very common around here. Living alone. - I get by.

- Over at the Terreiro, we're always in bands.

We move around every once in a while, but we always stick together.

It's a big family, you know, we always support each other, help each other..

- I don't know if I could.

- Yeah, but now...

With how things are getting worse, maybe you should come over sometimes.

So you can hang with us, you know.

- Maybe, some time. You know.

- Come on, let's go.

- Inês, something's not right here...

- Mother Obá?

Zé? Juciara? - Inês, something's off!

- Zé?

Someone home? - Inês!

- Inês... - They...

No...

No.

It can't be... They wouldn't...

Not all of them...

- Inês... - I can't...

- We're going to find them, alright? - I can't...

- We are going to find them.

We're going to find them, Chico, Igor...

We're going to get everyone back.

- I should have been here, I could have saved them!

- Neither you nor I could have helped, you know that.

Come on...

For more infomation >> Eixos (Axis) Webseries - Episode 4 - Duration: 5:30.

-------------------------------------------

VW Lupo - Duration: 1:04.

For more infomation >> VW Lupo - Duration: 1:04.

-------------------------------------------

Hyundai Tucson - Duration: 1:09.

For more infomation >> Hyundai Tucson - Duration: 1:09.

-------------------------------------------

Hyundai Tucson - Duration: 1:10.

For more infomation >> Hyundai Tucson - Duration: 1:10.

-------------------------------------------

Hyundai Tucson - Duration: 1:01.

For more infomation >> Hyundai Tucson - Duration: 1:01.

-------------------------------------------

Featuring Musician Megan Ni...

For more infomation >> Featuring Musician Megan Ni...

-------------------------------------------

Stack grooming and 100% reliable exploit for format0 - bin 0x25 - Duration: 10:44.

Last weeks video was about revisiting format level 0 from exploit-exercises/protostar on

a modern ubuntu system.

And we played around with it to see if we can figure out a way to exploit it, but in

the end I wasn't able to solve it.

But lucky for me a user with the name wcbowling on reddit thought it was fun too and actually

had a method to exploit it.

So let's have a look at it.

So here is wcbowlings post:

I love going back to old challenged like this :) Managed to get a fairly reliable exploit,

normally under 500 iterations.

And there is a highlevel description on how it works:

Overwrite the GOT entry for __stack_chk_fail with an address so we jump there instead.

The address can be passed in via argv, we cant use nulls but we can use blank strings

instead.

As the argv location is semi random, it takes around 500 iterations which is pretty reasonable

for 64bit

So obviously I didn't manage to figure that out, which means I didn't know something

and here is a learning opportunity for me.

So I'm not going to pretend I knew this.

For whatever reason I never noticed that __stack_chk_fail is in the global offset table.

And the reason for that might be, that I never encountered a challenge with these constraints?

We have A) a format string exploit that generally allows us to write anything anywhere B)

No libc function after the format string vuln that we could overwrite in the global offset

table And C) where we also have a buffer overflow

with a stack cookie.

So I really like this challenge now, because the solution is so clever.

So the function that is being called when the stack cookie got overwritten through a

buffer overflow is also on the global offset table.

Which means our goal is to redirect code execution to our winning message by overwrite the GOT

entry for __stack_chk_fail.

And then do a buffer overflow, to trigger that function.

To write to that global offset table entry, we have to get the address somewhere onto

the stack, so that we can use %n with the format string vulnerability.

And the issue is that it contains nullbytes which we can't pass in via the arguments.

I think the arguments are string copied onto the stack?

So we can't enter arbitrary nullbytes.

But wcbowling had a cool trick with empty strings as arguments.

Because a string ends with a nullbyte, so an empty string is just null.

I think I had a super early video to talk about the environment and arguments on the

stack, but quick recap, you have the argv[] char pointer array, so it's a list with

addresses that point to the strings.

And then you just have memory with all the strings.

And so this way you can get the address with null-bytes on to the stack.

Pretty clever, I never thought about this before.

And now you basically just have to put everything together.

Wcbowling uses pwnlib to implement the exploit, it's a very useful python library, check

it out.

And so here the magic format string is built with a large offset into the stack that hopefully

hits the addresses passed in via the arguments.

And so there are two single byte writes.

Why are only two bytes written?

well the GOT already contains an address that is almost the target address, except the last

two bytes.

So you can just reuse most of it.

Then this is being executed in a loop until the winning message is shown.

The stack has some randomized offsets, thus you have to try it a few times.

Here is the asciicinema recording by wcbowling.

By the way, if you have a problem with a challenge and you write me an email, you could use that

to record a screencast so I can actually see how you debug it and what the problem is.

So while I understand now the basic idea, I still wanted to implement it myself.

There are a few challenges that you have to solve like, what is good offset into the stack

to hit the arguments, and the alignment of the address through the arguments.

And while I was doing that and struggling with exactly those details, I had an epiphany.

And I'm sooo grateful that wcbowling shared this exploit, because it pushed me into discovering

this.

So I actually found a 100% reliable exploit for this challenge, and you can't believe

how excited that makes me.

Though I have to admit, that it might only work on my compiled binary, and for somebody

else it might not work, you will see in a second why.

So here it is.

That's all.

And when we execute it, you can see it gets into an execution loop of the winning message.

And while it looks like a simple format string vulnerability with the padding to increase

the amount of printed characters, an address and a %n or %hn to write to an address, there

are quite a few beautiful puzzle pieces here.

So the basic idea came, when I was playing around with overwriting the GOT entry for

__stack_check_fail.

wcbowling had two writes and placed the address in the arguments, which made it so unreliable.

I thought, maybe we get lucky if we place the address into our string, like I did in

the last video.

But there is one problem.

The string that is printed is coming from the arguments, which has an unpredictable

position.

But the string is formatted with sprintf into a buffer, which will have a fixed relative

position on our stack.

So basically the format string will be evaluated, so first it handles the %d with the 1640 character

padding and places it into the buffer.

Then comes the raw bytes of the address, and places it.

And then comes the format modifier to write to an address on the stack.

So now the position of this address that was just written onto the buffer is at a fixed

offset location and we always get it with 214.

Though the problem is, we can't have an arbitrary amount of bytes padding.

Because the address has to be 8byte alligned.

So we can only increase or decrease the padding in 8 byte steps.

Which affects the amounts of bytes we can write.

With %n.

It's always in these 8 steps.

So we don't have an write anything condition, but we can write something close to the wiining

address.

Now there are two challenges.

First, the stack is fairly small, and the format result is written into buffer on the

stack, so if we use too much padding, to write a large number with %n, we run out of stack

memory and get a segfault.

But wcbowling's trick has made me realize, that we can in fact increase the size of the

stack by just using more arguments.

It will add entries to the argv array and increase it.

The second problem is, that the address is only written with 3 bytes, so if the location

on the stack had other values in it, it won't work.

We need to write our address onto the stack where there was a zero, or generally a small

number before.

And here is also where the arguments help us again, because we can groom the stack,

by adding or remove entries in the argv array, so that the stack is large enough, and we

have a zero at the correct spot.

<grunt> I love it!

So now we know how to groom the stack to write to the GOT entry, but we still have the issue

that we are not sure what to write because of our multiples of 8 restrictions.

I wrote a simple python function that generates me valid exploit arguments with different

paddings and adjusts the amount of arguments and the write offset accordingly.

And I started by looking around the printing of the winning message.

So ideally we would like to write 0x670, that's 1648, but becuase of our alignment restrictions

that doesn't work.

Anyway, I was then just trying them, to see if anything interesting would come from it.

And luckily this one worked.

Let me debug this with gdb, I set a breakpoint after the sprintf, before we check the stack

cookie.

Let's look at the stack.

So this is the %d padding with spaces, to print the amount of characters we want to

write to.

And then here at the end is the target address we want to write to.

The GOT address.

We can also look now what value has been written there.

So we will jump to 0x40066b.

Let's look at the disassembly and see where that would be.

66b.

Mhmmh… wait!

That is not a valid address, this is not right?

It's in between the compare and the jump-not-equal.

Let's use x to print 3 instructions, instead of the disassemble command.

Do you see that.

WTF there are now moves, and not a cmp?

What the heck?

Welcome to intel assembler and more advanced ROP.

This kind of property was called the geometry of intel assembler, in the famous ROP paper,

but never heard anybody using that term.

Anyway, we jump in between the bytes of the intended instruction, and the CPU is dumb,

it will just read those bytes and interpret them as assembler.

And so in this case, the cmp and jne turned into two simple moves.

Which means, now there is no check for deadbeef and we run into the printf to print the winning

message.

When we single step forward now, we get into the procedure linkage table for stack_check_fail,

we jump to the GOT entry, which is our weird address into vuln, we execute the mov, and

then we call puts to print the message.

For more infomation >> Stack grooming and 100% reliable exploit for format0 - bin 0x25 - Duration: 10:44.

-------------------------------------------

Motorcycle travel to South America. Episode seven. - Duration: 36:38.

For more infomation >> Motorcycle travel to South America. Episode seven. - Duration: 36:38.

-------------------------------------------

Nova Fazer 250 2018 - Ep. 124 - Duration: 4:48.

For more infomation >> Nova Fazer 250 2018 - Ep. 124 - Duration: 4:48.

-------------------------------------------

PUBG - нубас играет стрим:))) - Duration: 1:14:37.

For more infomation >> PUBG - нубас играет стрим:))) - Duration: 1:14:37.

-------------------------------------------

【あるものを生かしてないものをつくる〜安藤忠雄〜】字幕付き - Duration: 3:30.

For more infomation >> 【あるものを生かしてないものをつくる〜安藤忠雄〜】字幕付き - Duration: 3:30.

-------------------------------------------

Suzuki Swift - Duration: 1:11.

For more infomation >> Suzuki Swift - Duration: 1:11.

-------------------------------------------

Suzuki Swift - Duration: 1:07.

For more infomation >> Suzuki Swift - Duration: 1:07.

-------------------------------------------

How I Make Money Online

For more infomation >> How I Make Money Online

-------------------------------------------

Cale Hawkins - Don't Let My Ink Fade - Duration: 3:09.

I'm sitting on the edge

of an unexpected moment

an outlier

a shiver in time

a twist of irony

in this biography

don't know where I'll be

in the next line

stay with me in this place

I don't want to be erased

please don't let my ink fade

I grew up inside my head

it was safer to escape there

from hostile worlds

in troubling times

now I'm left to face

a mass of empty space

have I wound up on the last page?

get me out of this place

I don't want to be erased

please don't let my ink fade

Oh, remain

I hope you stay

I hope you stay

remain

a shot away

I hope you stay

Stay with me (I hope you stay)

I hope you stay

For more infomation >> Cale Hawkins - Don't Let My Ink Fade - Duration: 3:09.

-------------------------------------------

Maybe There Isn't Liquid Water on Mars - Duration: 6:27.

Two years ago, the entire scientific community—including us—freaked out because researchers discovered

flowing liquid water on the surface of Mars.

But now, some scientists aren't so sure.

According to a paper published on Monday in Nature Geoscience, it might just be… sand.

Which is way less fun.

Y'know, sand is coarse... and rough.. and gets everywhere.

Since life on Earth relies on liquid water, we're always searching for it in other parts

of the solar system, in case it contains alien bacteria or can teach us more about our planet.

And thanks to previous missions, we've found that Mars has plenty of water frozen in polar

ice caps or floating around as water vapor.

But in 2015, researchers announced that they'd found liquid water trickling down hills on

Mars' surface.

Specifically, they found hydrated salts, which are just salt molecules attached to some water molecules.

And these hydrated salts created dark, flowing lines on Mars' surface called recurring

slope lineae, or RSLs.

On the off-chance life was hanging out in those RSLs, we didn't want to send the Curiosity

rover to check them out, because it's contaminated with material from Earth.

But scientists have been analyzing them with satellites.

In this new paper, they used the HiRISE satellite orbiting Mars to study the slopes of more

than 150 RSLs at 10 different sites.

They found that, on average, almost all of the RSLs ended when a hill got between 28

and 35 degrees steep.

And, according to measurements of Martian sand dunes, that's about the same angle

where flowing sand stops moving.

The scientists argue that, if the RSLs do contain liquid water, some of them should

flow past that roughly 30-degree mark.

Still, that's not the only reason they're questioning the liquid water idea.

For one, if RSLs were filled with salty water, they should be depositing dry salt piles when

the water eventually evaporates, but scientists haven't found any yet.

Also, one of the arguments for RSLs containing water is that they appear seasonally, like

water is freezing and melting.

But this team observed that sand flows can also change seasonally, based on how dust

blows around on Mars' surface.

Still, this definitely isn't a perfect hypothesis: The researchers admitted that seasonal sand

flow happens more easily on certain dunes that are constantly replenished by new sand

blowing onto them.

And the hills where we've seen RSLs aren't all like that.

And sand can't explain the hydrated salts, either.

But there are other possibilities!

Previous studies, like one published last year in Geophysical Research Letters, have

suggested that they could be caused by carbon dioxide frost instead, which would form when

gas condenses and freezes on the surface.

So before you throw your swimsuit into your bag and put it on your Mars rocket, maybe

wait a little while until we know a little more.

But don't abandon your suitcase entirely!

Because last week, astronomers announced that they've found a new, nearby exoplanet that

might be one of the most welcoming yet.

It's called Ross 128 b, and it was spotted using HARPS, an instrument attached to a telescope

in Chile.

HARPS is one of our most successful tools for finding new worlds.

It discovers planets by measuring wobbles in stars, which suggest that something — like

a planet — is pulling on them.

And that's how we found 128 b.

This new planet orbits a red dwarf star only 11 light-years away, making it the second

closest Earth-like exoplanet we've found.

Proxima Centauri b is just about 4 light-years away.

Red dwarfs are the most common stars in the universe, and they can be great exoplanet

parents.

They're only half the size of the Sun at most, and aren't too bright or hot.

And, while some of them can give off the occasional violent burst of radiation, the star 128 b

orbits seems especially calm.

From what we know so far, Ross 128 b doesn't seem too different from Earth.

It's about the same size, and its temperature probably ranges from -60 to 20 degrees Celsius.

But since its star is so small, 128 b orbits it a lot more closely than we do the Sun — about

20 times closer.

This helps it stay nice and warm, but it also means a year there lasts a little less than

10 days.

But if you don't mind birthday cake, that's not so bad.

Right now, even though the planet seems homey, we're not sure what its atmosphere is like,

or if it has liquid water on its surface.

So that's the next thing to figure out.

But when the European Southern Observatory's Extremely Large Telescope comes online in

2024, it should be able to figure out if 128 b has any oxygen in its atmosphere.

For now, it's still the most temperate planet we've ever found around such a calm star,

so that's still pretty awesome.

And we'll be learning more about it soon.

Plus, 128 b's star is currently cruising toward our solar system, and in around 70,000

years, it'll be the closest star to Earth besides the Sun.

So if we're still around in 70,000 years, but still haven't got warp drive figured

out, at least the trip will be a little shorter if we do decide to go.

Alright, exciting announcement!

I've been telling everybody about this.

The SciShow team and I were talking about a problem that many of us have.

Often, people will ask us what we want for Christmas, or for our birthdays and we won't

know what to say because we don't care about stuff that much.

But then I was thinking: there are things that I would like to get, or that I've bought

for myself, or that people have given to me that I really love because I love the world,

I love the universe, the existence of biology...that kind of thing.

So we put together a collection of artifacts of this universe...we got a limited number

of each of those things, and we have put them up at a store called SciShow Finds.

The SciShow Finds are curated by me, they are things that I would love to get in my

stocking.

It's a very small list of just six cool things of varying price points.

I did my best to only include one science book.

It's the book that I read this year that affected me the most, it's called "What is

Life" and it makes an extremely compelling case that biology is a chemical inevitability.

Which is a really important thought for having there be life out there in the universe.

As time progresses, we're probably going to add some new finds.

And as we add new ones, they will replace the ones, so all of these products are only

around for a limited time.

You're bound to have friends or family who would love some Mars Socks, trilobite fossils,

or maybe this Space Shuttle lapel pin.

And, if not, you might just want to get them for yourself or just slide the link in if

anybody's like, "What do you want, man?"

Just be like, "SciShowFinds.com!"

And know that when you go to SciShowFinds.com or send somebody there, you're also supporting

SciShow.

So, thank you!

Thank you for doing that, in that way, and also for doing that by watching this video.

You're the best!

For more infomation >> Maybe There Isn't Liquid Water on Mars - Duration: 6:27.

-------------------------------------------

Anet E10 3D Printer (Transporter Accident) - Duration: 7:18.

Ok I've got another 3D printer here.

I've also got a massive hole in the floor of the studio.

My foot went through some floorboards and I discovered there was wet rot.

But the show must go on.

Crinkled edge there.

I'm kinda preferring plastic at the moment especially compared to the wood which is prone

to fungus.

I'll put this back over here.

A few things have changed in the workshop...

I've had to get rid of a lot of things, and also lift things off the floor to make

space to treat the area and replace the floorboards.

It's couldn't have come at a worse time.

So this printer comes in two assembled parts and is a massive improvement to the Anet A8

– you fasten two larger machine screw through the base section into aluminium of the top

section, and then secure the machine screws on the side through the fitted brackets.

It's really simple.

The foot print isn't that much bigger than the Tevo Tarantula, but the bed size has increased.

Got to be careful not the drop anything into the excavation.

It is worth mentioning they have achieved this by pushing the linear guide block closer

together.

This will probably have an effect on the print speed and artefacting – as the metal bracket

that the heat bed fits onto isn't supported from the exterminates so it won't be as

rigid.

I did notice a simple metal belt tensioning bracket on the machine which I guess is useful

– but my anycubic i3 mega doesn't have one and that's my favourite printer so far.

It's nice to see the electronics in an enclosure, with a switch but it looks like the same old

stuff from the Anet A8 which I'm not really a fan off.

The PSU is earthed which is the main thing and everything seems fitted but with this

price range of machines I would always check.

The external wiring is very simple as everything is labelling, and you don't have to do any

soldering but the connections for the limit switches feel a bit flimsy.

They just push fit onto the prongs and are then covered by a little plastic to prevent

them shorting.

I'm guessing with the heat sensor, should probably put a little thermal paste or something

in there.

A lot of this is going to need to be cable tied down, just so you don't accidentally

pull something out.

At the moment you can buy the Anycubic i3 Mega with a 1kg spool of PLA for about 270

whie the E10 is being sold for 65 pounds les, but without the filament so it's more like

a £45 difference depending on where you get your filament from.

I would suggest just savings a little extra money and going for the Mega as I've been

printing stuff on that for well over a month now and it's actually really impressive.

Ok I'm going to turn it on... sounds like an error message.

I'm currently working designing and making a 3D printed rotary slit-scan cameras and

well you can see results in this video...

I don't think I could have done that with the Anet A8, or the Tevo, and I would have

got board of this printer pretty quickly.

Ok here goes.

Home!

It feels like the panel behind here is a bit far back.

It's actually rubbing on the chassis.

Wait I've just noticed you even get a ruler.

For obviously measuring the z on either side.

For the sake of a fair review, which I guess this is not.

You get two little packets of PLA and a manual which is rare.

They are evolving very quickly.

3D printed end cap for the extrusion is really nice.

The machine is easy to assemble and well I better print something just so I can say I've

used it.

Some people like to print a benchy, others like the test cube but I think I'm going

to print the most horrible thing I can find on thingiverse...

Antler Piggy!

Ok I should mention something annoying about

levelling this machine.

And that is the display quickly resets back to the start or home display after you've

clicked to move an axis.

It's really annoying - it just doesn't stay on the axis moving menu for long enough.

In the end I preheated the machine and turned the controller off and moved the bed around

by hand levelling each corner.

Also the nozzle takes a lot longer to heat up.

Mine plateaued at 207 C and stayed there for 15 minutes before I gave up and changed the

filament heating settings in repetiere host.

Even then I noticed temporarily covering the fan which cools the heating element sped up

the process - not how you should use the machine I think.

As with the Anet A8, because again these are many of the same components, you have to be

careful get the filament all the way into the heated nozzle.

My stepper was clicking...

and I ended up pulling the PTFE tubing out,

cutting a wedge into the end of the PLA and then physically push that down into the nozzle

before pressing the PTFE tubing back.

So I just used the same printer settings as I use with the AnyCubic i3 Mega but I reduced

the print speed to 40 mm/s for the Anet E10 – I've managed to get decent prints coming

out at 80mm/s with the Mega.

So to recap – if you are really on a budget and want larger bed capacity maybe go for

this one, but for a little extra, you get 1kg of filament, a filament sensor and a much

better print bed, and a much more rigid machine so I would still suggest the Anycubic i3 Mega

over this machine, anyday.

Anycubic i3 megaaaaa.

I'm going to make a top 10 blog post so as I get new machines or try new 3D printers

out I'll list them in order of preference and the link to that will be in the description.

It will probably change over time so take it with a pinch of salt and check back regularly

if you are interested in what I think of different machines.

Butt looks good.

For more infomation >> Anet E10 3D Printer (Transporter Accident) - Duration: 7:18.

-------------------------------------------

PUBG - нубас играет стрим:))) - Duration: 1:14:37.

For more infomation >> PUBG - нубас играет стрим:))) - Duration: 1:14:37.

-------------------------------------------

The Most Emotional Movies Of All Time - Duration: 5:02.

We've all lost it at one point or another during an emotional film.

Sometimes, in just about any movie, all it takes is a well-timed moment or a single line,

and bam — waterworks.

But the scenes in these movies in particular crank the sadness up to 11, leaving the audience

practically swimming by the time the credits roll.

Clear your throat, because we're about to put a lump in it with the most emotional movies

of all time.

Interstellar

If you've caught Christopher Nolan's space epic Interstellar, you'll know what's coming

next.

This story of headstrong astronaut Joseph Cooper, played by Matthew McConaughey, isn't

one you'd anticipate to have you bawling like a baby, but oh, it absolutely does.

With Earth facing extinction, Cooper and the crew of the spaceship Endurance head out in

an attempt to find a suitable planet to colonize.

But after getting stranded on one planet for decades of relative time, Cooper arrives back

on the Endurance to years' worth of messages from his children, Murphy and Tom.

They were just kids when he left Earth, but they're now adults.

Compound this with McConaughey's gripping performance, and this scene leaves you decidedly

not "alright, alright, alright."

Guardians of the Galaxy

For all its high-throttle space action and hilarious one-liners, Guardians of the Galaxy

still managed to deliver a rich, emotional story and a couple moments that just broke

the tear bank completely.

One of the most heartfelt parts of the movie comes right in the opening scene, which sees

young Peter Quill with his mother on her deathbed.

It's bad enough when Peter refuses to take her hand seconds before she flatlines.

But let's face it — we all lost it when Peter's grandfather has to pull him screaming

from the room.

"No."

"No!"

Geez, not even five minutes into the movie, and you're already sobbing into your Milk

Duds.

The Green Mile

Adapted from the 1996 Stephen King novel, The Green Mile seems like a dark film on the

surface, but what lies below is a web of relationships that will tug at your heartstrings.

The most touching of all?

John Coffey, played by the late Michael Clarke Duncan, and Paul Edgecomb, played by Tom Hanks,

who form an unusual alliance at Cold Mountain Penitentiary, where John is awaiting execution

for a crime he didn't commit.

While The Green Mile has plenty of emotional moments, one in particular gets the tears

flowing every time.

Even though he's an innocent man, John confides in Paul that he wants to die, because the

world is too cruel a place for him to live.

Moments before John is killed, Paul steps forward to shake his hand, a subtle reminder

that their bond was true, and a thank you for sending him onward.

The Imitation Game

This historical drama brings light to one of Britain's most brilliant minds: Alan Turing,

the mathematician who became famous for his efforts to crack the code on the German Enigma

machines during World War II.

Despite his achievements, Turing was subject to extreme ridicule by the United Kingdom's

legal system following the discovery that he was in a same-sex relationship with a young

man.

The Imitation Game depicts this arresting account of discrimination very well, but the

tipping point comes near the end.

Facing the risk of losing his latest machine, which he named Christopher after a boy he

fell in love with in school, Turing breaks down in one of the most emotional onscreen

performances in recent years.

Toy Story 3

Pixar has a particular way of pulling at your emotions, but there was something uniquely

devastating about 2010's Toy Story 3.

Released 11 years after the second installment, Toy Story 3 had no shortage of hilarious moments

and tongue-in-cheek references, and it also came with a plotline that drove a nail straight

into its audience's heart: the gang of toys don't belong to Andy anymore, a circumstance

that leaves their fates hanging by a thread.

During the climax of the film, the whole bunch end up in an incinerator after an escape plan

goes wrong.

Of course, watching characters you were first introduced to when you were just a kid in

danger is difficult enough, but the moment the crew realizes that they're going to die

— and decide to link up hands so they can face their fate together is next-level cinematic

torture.

You had to have eyes of steel to make it through that scene without a few tears.

The NeverEnding Story

The 1984 film The NeverEnding Story bills itself as an epic fantasy, but it could also

be called a "psychological roller-coaster," because that's exactly what audiences experience

when they witness Atreyu's horse Artax sink into the Swamps of Sadness forever.

When the boy-and-horse pair are trekking through the swamps, Artax gets stuck in the mud and

is too downtrodden to carry on, so he slowly sinks to his tragic fate — and the camera

doesn't cut away, guaranteeing no one will step away dry-eyed.

Not even a Luckdragon can make up for this kind of blow to your emotions.

Good Will Hunting

The late Robin Williams' Oscar-winning performance as Professor Sean Maguire in the 1997 drama

Good Will Hunting is one of his finest — as the Academy can clearly tell you — and a

lot of that comes down to one scene.

Matt Damon's Will Hunting is speaking to Sean about being abused by his foster father, and

the moment spirals into a stunning breakthrough grounded in a single sentence that sits sincere

amongst a film that's littered with sarcastic one-liners.

"It's not your fault."

Thanks for watching!

Click the Looper icon to subscribe to our YouTube channel.

Plus check out all this cool stuff we know you'll love, too!

For more infomation >> The Most Emotional Movies Of All Time - Duration: 5:02.

-------------------------------------------

ENGLISH SLANG – 15 trendy fashion words - Duration: 11:48.

Hi, everyone.

In this lesson we're going to look at trendy fashion words.

These are words that I'm hearing used a lot now around our times, so let's have a look

through the words and learn them one-by-one so we can sound really cool and fashionable.

Let's start with: "en pointe".

If something is en pointe, it means perfect, it looks so good.

What you're wearing today, that dress, your dress is en pointe.

It's so fashionable, it's so, so hot right now.

Very similar meaning to something being "on-trend".

If we think about the word "trendy", it means fashionable.

But to say something is trendy isn't fashionable enough anymore, we have to change it and say: "on-trend".

We could also change it and say: "bang-on-trend".

If it's bang-on-trend, it's even more now, happening right this minute.

Next, if we're talking about makeup...

When I was younger we used to talk about wearing lipstick or wearing red lipstick, or a pink

lipstick, but now instead of saying the word "lipstick", it's described as: "I'm wearing

a red lip today."

And the same thing, instead of saying: "eye shadow", "Oh, I bought this eye shadow.

It's blue.

Look at it on my eyes", you don't say that because it doesn't...

Doesn't sound... Doesn't sound fashionable enough, it doesn't sound like you know about makeup.

So, what people who know about makeup say is they say: "Oh, today I'm wearing a smokey eye."

I'm not wearing a smokey eye, I haven't got anything on, but a smokey eye is when the

eye shadow looks grey or dark, and it's most often worn at night when you're going out.

You get your eye shadow these days in "palettes".

And instead of wearing just one eye shadow, like, wearing a pink eye shadow, the eye shadow

palette comes with about...

Well, as many as you want I suppose, but from 4 to 12 eye shadows, and what they do is they

put on the different eye shadows from the palette.

So, they will talk about creating the smokey eye from palette number three, or whatever.

Next is a makeup term that's been around for a few years.

This makeup term came from when the Kardashians got famous because the kind of makeup Kim

Kardashian would use was a kind of makeup that shades her face to give it a certain...

To make it look like there's more shadow on the face and a more dramatic kind of foundation,

which is done with different brushes.

It's a kind of makeup technique called "contouring".

Apparently it comes...

Apparently it's a makeup technique that's been around for ages, but before, drag queens

used to use it, men who...

Men who were still men, but dressed up as women mostly for performance and being in shows and things like that.

So it originally comes from there.

And I did experiment with contouring.

I once watched a few too many YouTube videos, and it all went terribly wrong, so moving

on from contouring.

Next we have "drugstore makeup".

In England we don't have drugstores, we have pharmacies where you go and buy your medicine,

and you can buy toiletries, but we don't have drugstores.

We have chains of drugstores, for example, Boots or Superdrug, and you can go in there

and buy makeup, but we never call those places drugstores.

Yet, when people talk about makeup now, the younger generation, they will...

They will talk about buying drugstore makeup, which means the kind of makeup that only...

Only costs you a few pounds to buy, it's not the really, really expensive makeup, and you can...

You can buy it easily, close... Close...

Close where you live.

So, drugstore makeup is the kind of makeup you can do that doesn't cost you so much money

as the really expensive brands.

So that's an American term, but it's being used a lot here now in England.

The next... The next two terms are about hair.

These are newer fashionable techniques for dying your hair, and the two words come from French.

In the English pronunciation we'd say: "balayage".

If your hair is balayaged, or the adjective, if your hair is balayaged, then it means in

the salon it cost...

It took you many hours and it cost you a lot of money for the hairdresser or the colourist

to paint on highlights on to your hair very gently, very slowly, and it comes out in the

end looking like a natural sun-kissed kind of hair, like you've just come back from holiday

and you've been in the sun for a few weeks.

So that's a trendy thing that people are doing now.

And the next hair term is: "ombr�".

When your hair has been dyed in the style of ombr�, it means that your hair fades

from one colour to another.

So, it could be that you're blonde on the top and your hair fades to brown at the bottom,

or it could be the other way around.

So, it's light to dark or dark to light for that kind of hair technique.

Now we have a "lookbook".

A lookbook is something that a YouTuber or a fashion...

A fashion blogger would put together to show their audience of all the different outfits

they're wearing Monday, Tuesday, Wednesday, Thursday, Friday, or they'd put the lookbook

together to show all the outfits that they like to wear for spring.

It could be any theme, but instead of how...

Instead of how when you would buy a magazine, and...

A fashion magazine and look through it, and there would be a theme of the outfits that

comes from that magazine, and everything that the editors decided and did all themselves

in a big team.

A lookbook is something that a person with an interest in fashion who has their own YouTube

channel or blog puts together themselves.

So you can...

You can watch their lookbook and get inspiration about what to wear from it.

Next, when somebody says: "This is my go to lip...

This is my go to lip balm", or: "This is my go to mascara", that means that it's their

favourite one, the one they like to use the most or the one that they use most often.

So, it's a fashion...

Fashion vlogger kind of word, a beauty vlogger kind of word, and instead of saying: "This

is my favourite mascara", they'll say: "This my go to mascara".

Next we've got: "haul".

A haul is when you go to a particular shop and you buy loads, and loads, and loads of

stuff there.

It could be that you go to a particular drugstore.

Boots in the UK or Superdrug in the UK, and you buy lots and lots of makeup from the same

place, that's then a haul.

Or it could be you go to a particular shop.

You went to TOPSHOP, which is a fashion chain here in the UK, and you bought so much stuff,

it was a haul.

Next we've got "dressed down".

When you're dressed down for something you didn't...

You didn't wear your best outfit, your most expensive outfit, your most formal outfit.

When you're dressed down it could be that you just went wearing jeans and a t-shirt

and trainers.

It doesn't mean that you...

That you didn't make any effort, it just means that you're...

Today you're just wearing something relaxed.

You're not trying too hard.

So, for whatever you're doing, perhaps...

Perhaps you go to work, but on Fridays you dress down.

You don't wear such formal clothes.

Now, a more...

A more common meaning for "dress down" is: "to give someone a dressing down", and it's

important to know because it has a totally different meaning.

When you give someone a dressing down, it's like you're telling them off for something.

It could be your boss dressing you down at work, telling you you didn't do something

exactly right.

But in terms of fashion and beauty, "dress down" is about what you're wearing and how

much effort you're putting into it.

And the last word here is: "date night".

This also comes from the US.

"Date night" is when you go out with your boyfriend or your boyfriend...

I don't think men use the term.

"Date night" is when you go out with your boyfriend and you go and do something together

as a couple, you go out to eat, go to the cinema, whatever it is you do together.

And when...

When you go on a date night you wear special clothes or you try and look more sexy or more

attractive than normal, so you could talk about your date night outfit.

What you're wearing on date night is the opposite kind of clothes to what you wear when you're

dressed down.

When you're dressed down, you haven't got anybody to impress, it's not important, but

on date night you want to look good.

And the last idea I want to talk about here is quite funny, it's this idea that behind

all the glamourous Instagrammers that always put pictures up of their really cool outfits

and their en pointe shoes, behind every one of those glamourous, fashionable women, there's

a boyfriend who has to take their picture, wherever they go.

If they go to a lovely, sunny beach, the boyfriend is there for hours taking hundreds of pictures

until he gets the one that looks...

Looks en pointe and looks perfect.

So, behind all these fashionable, glamourous women, always remember the "boyfriends of Instagram".

Thanks for watching, and now you can do the quiz on this lesson.

Join me again soon. Bye.

For more infomation >> ENGLISH SLANG – 15 trendy fashion words - Duration: 11:48.

-------------------------------------------

Mario and Luigi's FRACTURED Relationship! - Duration: 11:50.

Hello everybody and welcome back to one of my favorite series where I delve deep into

the relationship between two video game characters and try to determine what makes that relationship

healthy or unhealthy.

So far on our epic quest to show how fucked every fictional hero is, we've looked at

Peach and Mario, Kirito and Asuna, Amy and Sonic and a few others, but I've been saving

Mario and Luigi for a special occasion because these two already have so much analysis done

on them.

Whether you watch us, MatPat or other channels of the like, pretty much everyone has a video

about the not so brotherly bond between Mario and Luigi.

Most of those videos go over the top into how poorly Mario treats Luigi, how jealous

Luigi is of Mario and how they more likely hate each other than care for each other.

So with that being said, I don't want to make another video like that.

I want to bring you something new and different from the generic italian ex plumber hate that

you're used to.

So let's dive into the relationship between Mario and Luigi, but instead of just focusing

on the bad, let's take the bad in stride with the good and figure out why these two act

the way they do towards each other and more importantly whether this unique bond of hatred

and anger is unexplainable, or if we're missing a crucial part to the story..you uh..(shit

it's not that show)...the story you didn't already know?

First off let's take a look at the backstory of these two.

In case you weren't aware, Mario and Luigi are supposedly twins.

While this has never been completely proven, the dual stork flight they both take during

Super Mario World 2: Yoshi's Island, seems to suggest a twin birth.

Now this may not seem like an important part of the story, but it is perhaps the most overlooked

and essential point to understanding Mario and Luigi's relationship.

Twins, even fraternal twins are socially expected to be similar in abilities and personality.

There's many articles about parents of twins being worried about their children having

different abilities and one being better at something than the other.

For example, a Times article depicts the struggle a mother and father went through when finding

out that one twin was more academically gifted than the other.

These parents toiled over whether or not to put their son in an advanced learning program

while not being able to enroll their daughter because she didn't test well enough to be

accepted.

Questions like: "Will we ruin our daughter's self esteem if we enroll our son and not our

daughter?" or "are we holding our son back if we keep them enrolled in the same

program?"

Eventually they decided to enroll their son in the advanced program while their daughter

stayed in the regular program.

But those parents stressed to their kids that just because one child was enrolled in another

program doesn't make that child inherently better than the other.

It just means that, like everyone else in the world, certain people are better at certain

things.

The son happens to be better at the sciences whereas the daughter is better at the arts.

Now what does this have to do with Mario and Luigi?

Well if you consider Mario and Luigi's lives, literally since their birth, or i guess since

their stork ride (way to keep it pg Nintendo), Mario and Luigi have basically done one thing

and one thing only: adventuring.

And I dunno about you, but I suck at adventuring.

Hell, most people suck at adventuring.

We can't all be Nathan Drake who can randomly find a fucking forest in the middle of France

and then find a fucking castle in the middle of the fucking forest!

It takes a very specific sort of person to drop everything and venture across multiple

worlds to be a hero.

I'm not that type of person and guess what, neither is Luigi.

You've seen how awkward he is, you've seen how scared he is.

He wasn't meant to fight monsters and save princesses.

And there's nothing wrong with that!

But his entire life has been based around the idea that this is what the mario brothers

do.

They adventure, they play the hero, they save the princess, they follow their own stereotype

to the death because it's what they are the best at.

Mario is that son who's amazing in the sciences.

He was born to do what he does.

Luigi is the daughter who prefers the arts, he has his own abilities, but they aren't

being utilized because he's doing something that doesn't play to his strengths.

I'm sure this is something you can all relate to.

How many people have siblings, or friends for you only children, who are better than

you at something?

Everyone does.

but that doesn't make your sibling a better person or more worthy of respect and love.

Yet sometimes you still feel subpar compared to your brother or sister.

Now imagine having that feeling cemented into your brain day after day year after year by

everyone around you.

Everyone in the Mushroom Kingdom loves Mario.

Everyone praises him for his heroism.

And while Mario is in the limelight, Luigi is always seen as second best, the sidekick,

the second player.

He lives in Mario's overwhelming shadow.

For years Mario has been getting his head filled with praise and glory, and over time

that can have a negative effect on a person.

Look at any celebrity that you might refer to as Dildo Douchebaggins.

Certain people, when peppered over and over with love and fame and admiration for years

on end, can let that go to their head, inflating their ego to the size of one of the Slow Mo

Guys water balloons.

Equally, in the opposite direction, if you're constantly being compared to your glorified

brother, you'd probably find your self esteem extremely fragile and low.

By understanding this, we're getting closer to understanding the issues between Mario

and Luigi.

With one brother having an ego that's too big and another having an ego that's too

small, a pretty scary power dynamic can form over the years.

Since Mario's entire ego is completely based around him being the chosen hero of the mushroom

kingdom, it would stand to reason that anyone else who could take that role from him would

be a threat to Mario.

A threat to his fame, his self esteem, his ego, everything that makes Mario who he is.

Inside, there really isn't much to Mario's personality.

He's a stoic shell of nothingness held together by his actions and what people think about

him rather than who he really is as a person.

If his actions are overshadowed and his fame is taken away Mario would basically have nothing

to define himself with.

And who's the biggest threat to overshadowing Mario?

Who's been on almost as many adventures as Mario?

Who has actually saved Mario in the past?

Luigi.

Mario sees Luigi as his greatest rival, the only threat he has to the fame and heroism

he defines himself with.

If this idea seems too exaggerated to you, perhaps a similar example will help you see

just how real this possibility is.

For my anime fans out there, let's do a quick analysis of Midoriya and Bakugo from

My Hero Academia.

For those of you that haven't seen this show, all you need to know is that the almost

everyone in this world has some sort of super power and because of that, people actually

started to have hero careers overseen by the government.

Bakugo has a fantastic ability, or quirk as they call it in the show.

He can create explosions with his body.

Midoriya was born without a quirk, but eventually gets one.

Bokugo gets overly competitive and angry with Midorya, but why?

Well, since his quirk developed in kindergarten, people have been telling him since he was

5 that he's going to be a hero, that he's going to do great things, that he's going

to save people.

Whereas people have never told Midoriya that.

He was always told someone without a quirk could never be a hero.

So as you'd imagine, Midoriya grew up with low self esteem, Bakugo grew up with a massively

over inflated ego.

And now that Midoriya is starting to grow and gain some momentum, Bokugo feels incredibly

threatened and hates Midoriya even more.

We're seeing this exact same thing with Mario and Luigi.

This isn't something I'm making up, its something that happens when a person's entire

being is based on their ego and what others have told them.

Now does this mean that Mario isn't at fault for how he feels towards his brother?

Well...yes and no.

I can't say that a person's feelings and actions aren't their own responsibility,

but Mario's upbringing has just as much to do with it.

Mario was never taught that people are created differently, that being good at one thing

doesn't make you inherently better than others.

So of course he feels superior to his brother who can't keep up with him.

And of course he's terrified of losing his edge and falling to where he sees his brother.

That gives us a pretty good idea of why Mario may not have as much brotherly love for Luigi

as Jamie has for Cersei.

Oh boy, an incest joke, I wonder how long until this video gets demonetized.

Anyway, that doesn't explain how Luigi feels about Mario.

So let's get into that!

Luigi doesn't really have anything going for him according to his own self esteem.

He feels constantly overshadowed, but he also knows that he is scared of things when Mario

isn't and he is more clumsy when Mario's steady.

These are truths about himself.

And yet, he has also saved Mario in the past.

He has played the hero.

That experience most likely makes him feel even more jealous towards Mario's fame and

heroism.

But here's the thing: jealousy, overly inflated egos, both of these things are fixable.

Jealousy is not a human emotion that everyone experiences naturally.

It's a symptom of insecurity.

People are jealous of others because they are insecure about not having what others

have.

They feel second best to whoever they are jealous of.

To fix jealousy, one must confront their insecurities and overcome them.

It's not an impossible task, I've done it many times, and when you are able to find

that insecurity and assure yourself you needn't be insecure about it, that jealousy fades.

If Luigi tried anything other than exploring and adventuring he may find that there are

plenty of things he is better at that Mario.

By finding that truth within himself, that he's not an adventurer, but he's perfectly

capable of many other things, Luigi will find his self esteem start to lift and heal.

That's why we have so many possible career options.

Everyone is made differently and can excel in different areas and no one area is better

than the rest.

If Luigi just tried something else and found something he was passionate about, that he

enjoyed, that wasn't tied to his brother, he may find that insecurity of living in Mario's

shadow disappear and his jealousy of Mario's adventuring with it.

If he could do that, we may be able to solve the issues between these two brothers.

Now Mario's inflated ego is another issue.

When I compared it to the Slo Mo Guy's giant balloons, that analogy had two parts, one

was the massiveness of the balloon, but the other is that it will eventually pop.

Mario's ego can't possibly stay inflated forever, and when it does pop he'll end

up falling into a downward spiral of depression and loneliness.

When all your friends are with you because of what you do not who you are, how can you

expect them to stick around long term?

That eventual pop may destroy Mario, but it will also give him a chance to start over,

to realize his mistakes, and hopefully, to realize that Luigi is not his enemy.

And here's the thing, that ego deflation may come from seeing Luigi happy and no longer

stuck in Mario's shadow.

The life shattering realization that Luigi actually could be better than him may throw

Mario for such a loop that he'll have to rethink every he knows about his life.

If life isn't about being better than everyone else, then what is it about?

That's the question Mario will have to answer, and if he can come to a realization then maybe

it's not too late for these brothers.

You see, if Mario blames Luigi for his ego breaking, that will turn their already rocky

relationship into something that will probably be impossible to heal.

However, if Mario is able to see the flaw in how he's lived all these years, if he

can finally understand that people are not meant to be judged against each other and

that people are all different and not inherently better than one another, then perhaps these

two brothers can heal the damage that's plagued them since their stork ride all those

years ago.

But of course, this is just my take on the Mario and Luigi relationship.

There's always more going on beneath the surface if we're willing to look a little

farther.

What do you think of my analysis?

Does it make sense to you?

Or do you think it's a bit over the top?

I might see it that way too if it wasn't for the fact that these issues between siblings

and twins in particular is so common.

Let me know what you think!

And thanks again for going through another video with me, You all who come back video

after video to see what I have to say are why we keep making videos!

And if you're new to the channel and liked what we try to do here don't forget to hit

that subscribe button and the bell notification button so you know when we upload new content!

Thanks for hanging out and I'll see you guys in a few days!

For more infomation >> Mario and Luigi's FRACTURED Relationship! - Duration: 11:50.

-------------------------------------------

Jake Paul Disses Alissa Violet In Leaked SECRET Verse Of It's Everyday Bro - Duration: 2:55.

Theres a secret version of the remix of its every day bro that exists, that includes a

verse that takes some serious shots at jakes former girlfriend, alyssa violet.

And trust me, theres a reason why he chose not to include it in the version he uploaded.

More on this today on IO.

What is good, this is inform overload, where we occasionally talk about youtube news.

By the way I'm charlotte, I'm a host here on IO.

Hit that like and subscribe as well as the bell so to become a part of the notification

squad.

Jake Paul and alissa violet dated a while back, their romance gained them both thousands

of subscribers.

Alissa lived in the team 10 house with him, and they would always collaborate on videos.

But after jake found out she cheated on him with his brother logan, he allegedly kicked

her out of the house.

Since then, the two of them are not secretive about their beef, and they often post tweets

about each other.

Like this one from alissa that says jake rhymes with snake.

Alissa is now dating Faze Banks, who you may remember also got into some serious beef with

jake paul when he accused him of assaulting his assistant.

People kind of thought at the time that jake started that drama because he was jealous

that alissa was dating faze banks.

Alright, now that you have some backstory, here's the deal.

You are probably aware by now that jake paul released a remix of his song 'its everyday

bro', this time including rapper Gucci mane.

Well according to the youtube channel Cubehub01, there are actually two versions of this remix,

and the version that no one knows about takes some serious shots at Alyssa violet.

Theres obviously the version that everyone has heard.

The lyrics of this particular verse.

So the kids at tarp, can see my life a TV show, and its every day bro and ya'll know

that house cost 7, and yo mama just stay rented.

Blahblah So that's the version everyone is familiar with.

But its clear that Jake may or may not have changed the lyrics because there is another

version of that verse.

Roll the clip.

Yep.

That is definitely jake paul, no doubt about it.

And I'm just gonna go out on a limb and say, This secret verse is 100 percent about

jakes former girlfriend Alyssa violet.

I find it super funny that jake is this mad about Alyssa cheating on him with his brother

because like didn't jake cheat on Alyssa like several times?

And he's still salty about it to this day?

No wonder he didn't put it in the version he posted.

Anyways huge shout out to cube hub for finding that version of the song.

Are you team alissa or team jake?

Write your responses in the comments below.

Hexxed – io should have more subscribers than pewdiepie.

Ramon Vargas – charlotte you can pull off a decent amy winehouse impression if you want.

Actually I can do an impeccable amy winehouse impression.

That's all for this video, if you guys would like to see more IO, check out this video

over here.

Youtuber kicked off tv show for racism and homophobia.

As always click the bell so you never miss an upload.

Later taters.

For more infomation >> Jake Paul Disses Alissa Violet In Leaked SECRET Verse Of It's Everyday Bro - Duration: 2:55.

-------------------------------------------

Motorcycle travel to South America. Episode seven. - Duration: 36:38.

For more infomation >> Motorcycle travel to South America. Episode seven. - Duration: 36:38.

-------------------------------------------

GETTING A NEW RING!? (LUCKY) | Growtopia - Duration: 10:09.

Guys I'm getting a ring!

For more infomation >> GETTING A NEW RING!? (LUCKY) | Growtopia - Duration: 10:09.

-------------------------------------------

The Cromarties | Full Episode 3: Camp Cro | USA Network - Duration: 21:36.

For more infomation >> The Cromarties | Full Episode 3: Camp Cro | USA Network - Duration: 21:36.

-------------------------------------------

Amazing Chocolate Cake Decorating Ideas - Cakes Style Tutorial - Satisfying Cakes Videos Compilation - Duration: 12:09.

Amazing Chocolate Cake Decorating Ideas

For more infomation >> Amazing Chocolate Cake Decorating Ideas - Cakes Style Tutorial - Satisfying Cakes Videos Compilation - Duration: 12:09.

-------------------------------------------

KODI Android TV Box X96 - Smart TV BOX Android Player - Duration: 3:07.

This is an unboxing of the ex 96 Android TV box from and logic but first follow

the link on this video description below because is where you will find a

campaign that is running from the good people of bang good company

so this mini PC is an Android player with a quad core a 53 CPU is a Wi-Fi HD

and 4k Kodi TV box with Android 6.0 marshmallow it packs two gigs of SD RAM

and 16 gigabytes of flash memory 2.4 gigahertz Wi-Fi standards and a few more

features that makes this a great and budget mini Android player comes with

their HDMI cable a 2 amps power adapter a very useful remote control and the

usual user manual now I'll leave you with some more pictures of the X 96

Android player but stay tuned for the next video because is where I will

review it in more detail until then stay connected see you there

For more infomation >> KODI Android TV Box X96 - Smart TV BOX Android Player - Duration: 3:07.

-------------------------------------------

All-Gender Holiday Gift Guide & GIVEAWAY | Christmas 2017 - Duration: 19:53.

Hello YouTube and Welcome to the 2017 Gift Guide:

Essential Gifts for Christmas with the Mortons

So we've got lots of things from Beauty Gifts to more like Geeky Gifts,

technology gifts, [ALEX] How come you point at me when you say Geeky?

"Beauty Gifts, ah, Geeky Gifts"

*haha* as well as some consumable gifts for the minimalist in your life.

Many of these are things we've gifted each other in the past,

and a couple of other things are just things I would love to get haha

[ALEX] Likewise [ARNA] *hint hint*

Do you like our beautiful... get out of the way haha

have a look at our gorgeous little Xmas Tree

This is actually legitimately our Xmas tree as well because we live in a tiny apartment

[Alex] How long has it been up for Arna??

... October 30th I put the tree up...

So the first gift is something a little more significant

a little bit of a higher price point and something to give to someone you really really care about

[alex] a significant other [arna] yes, a significant other or a family member or a special friend,

and it is actually the watch I am wearing here:

And this video is kindly sponsored by the Peach Box who sell these Marc Bale Watches

For more infomation >> All-Gender Holiday Gift Guide & GIVEAWAY | Christmas 2017 - Duration: 19:53.

-------------------------------------------

Stack grooming and 100% reliable exploit for format0 - bin 0x25 - Duration: 10:44.

Last weeks video was about revisiting format level 0 from exploit-exercises/protostar on

a modern ubuntu system.

And we played around with it to see if we can figure out a way to exploit it, but in

the end I wasn't able to solve it.

But lucky for me a user with the name wcbowling on reddit thought it was fun too and actually

had a method to exploit it.

So let's have a look at it.

So here is wcbowlings post:

I love going back to old challenged like this :) Managed to get a fairly reliable exploit,

normally under 500 iterations.

And there is a highlevel description on how it works:

Overwrite the GOT entry for __stack_chk_fail with an address so we jump there instead.

The address can be passed in via argv, we cant use nulls but we can use blank strings

instead.

As the argv location is semi random, it takes around 500 iterations which is pretty reasonable

for 64bit

So obviously I didn't manage to figure that out, which means I didn't know something

and here is a learning opportunity for me.

So I'm not going to pretend I knew this.

For whatever reason I never noticed that __stack_chk_fail is in the global offset table.

And the reason for that might be, that I never encountered a challenge with these constraints?

We have A) a format string exploit that generally allows us to write anything anywhere B)

No libc function after the format string vuln that we could overwrite in the global offset

table And C) where we also have a buffer overflow

with a stack cookie.

So I really like this challenge now, because the solution is so clever.

So the function that is being called when the stack cookie got overwritten through a

buffer overflow is also on the global offset table.

Which means our goal is to redirect code execution to our winning message by overwrite the GOT

entry for __stack_chk_fail.

And then do a buffer overflow, to trigger that function.

To write to that global offset table entry, we have to get the address somewhere onto

the stack, so that we can use %n with the format string vulnerability.

And the issue is that it contains nullbytes which we can't pass in via the arguments.

I think the arguments are string copied onto the stack?

So we can't enter arbitrary nullbytes.

But wcbowling had a cool trick with empty strings as arguments.

Because a string ends with a nullbyte, so an empty string is just null.

I think I had a super early video to talk about the environment and arguments on the

stack, but quick recap, you have the argv[] char pointer array, so it's a list with

addresses that point to the strings.

And then you just have memory with all the strings.

And so this way you can get the address with null-bytes on to the stack.

Pretty clever, I never thought about this before.

And now you basically just have to put everything together.

Wcbowling uses pwnlib to implement the exploit, it's a very useful python library, check

it out.

And so here the magic format string is built with a large offset into the stack that hopefully

hits the addresses passed in via the arguments.

And so there are two single byte writes.

Why are only two bytes written?

well the GOT already contains an address that is almost the target address, except the last

two bytes.

So you can just reuse most of it.

Then this is being executed in a loop until the winning message is shown.

The stack has some randomized offsets, thus you have to try it a few times.

Here is the asciicinema recording by wcbowling.

By the way, if you have a problem with a challenge and you write me an email, you could use that

to record a screencast so I can actually see how you debug it and what the problem is.

So while I understand now the basic idea, I still wanted to implement it myself.

There are a few challenges that you have to solve like, what is good offset into the stack

to hit the arguments, and the alignment of the address through the arguments.

And while I was doing that and struggling with exactly those details, I had an epiphany.

And I'm sooo grateful that wcbowling shared this exploit, because it pushed me into discovering

this.

So I actually found a 100% reliable exploit for this challenge, and you can't believe

how excited that makes me.

Though I have to admit, that it might only work on my compiled binary, and for somebody

else it might not work, you will see in a second why.

So here it is.

That's all.

And when we execute it, you can see it gets into an execution loop of the winning message.

And while it looks like a simple format string vulnerability with the padding to increase

the amount of printed characters, an address and a %n or %hn to write to an address, there

are quite a few beautiful puzzle pieces here.

So the basic idea came, when I was playing around with overwriting the GOT entry for

__stack_check_fail.

wcbowling had two writes and placed the address in the arguments, which made it so unreliable.

I thought, maybe we get lucky if we place the address into our string, like I did in

the last video.

But there is one problem.

The string that is printed is coming from the arguments, which has an unpredictable

position.

But the string is formatted with sprintf into a buffer, which will have a fixed relative

position on our stack.

So basically the format string will be evaluated, so first it handles the %d with the 1640 character

padding and places it into the buffer.

Then comes the raw bytes of the address, and places it.

And then comes the format modifier to write to an address on the stack.

So now the position of this address that was just written onto the buffer is at a fixed

offset location and we always get it with 214.

Though the problem is, we can't have an arbitrary amount of bytes padding.

Because the address has to be 8byte alligned.

So we can only increase or decrease the padding in 8 byte steps.

Which affects the amounts of bytes we can write.

With %n.

It's always in these 8 steps.

So we don't have an write anything condition, but we can write something close to the wiining

address.

Now there are two challenges.

First, the stack is fairly small, and the format result is written into buffer on the

stack, so if we use too much padding, to write a large number with %n, we run out of stack

memory and get a segfault.

But wcbowling's trick has made me realize, that we can in fact increase the size of the

stack by just using more arguments.

It will add entries to the argv array and increase it.

The second problem is, that the address is only written with 3 bytes, so if the location

on the stack had other values in it, it won't work.

We need to write our address onto the stack where there was a zero, or generally a small

number before.

And here is also where the arguments help us again, because we can groom the stack,

by adding or remove entries in the argv array, so that the stack is large enough, and we

have a zero at the correct spot.

<grunt> I love it!

So now we know how to groom the stack to write to the GOT entry, but we still have the issue

that we are not sure what to write because of our multiples of 8 restrictions.

I wrote a simple python function that generates me valid exploit arguments with different

paddings and adjusts the amount of arguments and the write offset accordingly.

And I started by looking around the printing of the winning message.

So ideally we would like to write 0x670, that's 1648, but becuase of our alignment restrictions

that doesn't work.

Anyway, I was then just trying them, to see if anything interesting would come from it.

And luckily this one worked.

Let me debug this with gdb, I set a breakpoint after the sprintf, before we check the stack

cookie.

Let's look at the stack.

So this is the %d padding with spaces, to print the amount of characters we want to

write to.

And then here at the end is the target address we want to write to.

The GOT address.

We can also look now what value has been written there.

So we will jump to 0x40066b.

Let's look at the disassembly and see where that would be.

66b.

Mhmmh… wait!

That is not a valid address, this is not right?

It's in between the compare and the jump-not-equal.

Let's use x to print 3 instructions, instead of the disassemble command.

Do you see that.

WTF there are now moves, and not a cmp?

What the heck?

Welcome to intel assembler and more advanced ROP.

This kind of property was called the geometry of intel assembler, in the famous ROP paper,

but never heard anybody using that term.

Anyway, we jump in between the bytes of the intended instruction, and the CPU is dumb,

it will just read those bytes and interpret them as assembler.

And so in this case, the cmp and jne turned into two simple moves.

Which means, now there is no check for deadbeef and we run into the printf to print the winning

message.

When we single step forward now, we get into the procedure linkage table for stack_check_fail,

we jump to the GOT entry, which is our weird address into vuln, we execute the mov, and

then we call puts to print the message.

For more infomation >> Stack grooming and 100% reliable exploit for format0 - bin 0x25 - Duration: 10:44.

-------------------------------------------

За кулисами: Золотая бутса Лео Месси - Duration: 4:13.

For more infomation >> За кулисами: Золотая бутса Лео Месси - Duration: 4:13.

-------------------------------------------

The Superior Omon「💀」Pokemon: Black 2 NUZLOCKE - Ep16 - Duration: 2:16:40.

For more infomation >> The Superior Omon「💀」Pokemon: Black 2 NUZLOCKE - Ep16 - Duration: 2:16:40.

-------------------------------------------

Smashy Smashy - Choice Chamber - Duration: 12:39.

Hi everybody, I'm Amanda the G and welcome to Choice Chamber.

I have no idea what this game is.

I bought it as part of a humble bundle a long time ago and I've never played it, so let's

play and see what this is.

Play.

Ok.

Ummmm I move.

What are you?

Oh I can jump on you!

Oh I can't get over there.

Um.

How do I- how do I use those things?

I think I have to do something with this, but I don't know what I'm supposed to do with

it.

Ok, X is attack.

Ok.

Umm.

I got a hammer!

Sweet!

'Great at turning most things into inedible pancakes.'

YAS!

I wanna smash something.

YES!

Smashy smashy!

Smashy smashy.

Smashy smashy.

Ha!

Coin is mine.

Smashy smashy.

Ooooh yes you dead.

Boo booo.

Yes, smash you.

Bye bye!

No!

Bye bye.

Turn around!

Smashy- NO.

Yes, mine, it's all mine.

Let's go.

Whom I gonna kill now?

Smashy smashy.

DEAD.

Kill you dead, kill y- ooohh.

I died.

(sad) I died!

NO!

I did not die, that didn't happen, you didn't see it, we're doin' this again.

Play.

I didn't die.

I did not die.

Oooh I still have my hammer, so that's good.

Ready?

Smashy smashy.

You dead.

That took a lot of hits for some reason.

Why?

Why can you kill me?

You're the little one.

The little one's supposed to die in one hit!

Maybe not.

Ok. (laughing) these are different rooms, that's why.

These are different rooms.

Smashy friggin' smashy!

Smash you, smash you!

And now I run away.

Annnnnnnnddddd smash you.

Smash you, smash you, run away- oh.

Come here.

Come here, bitch.

Come here, come here, come here.

Smash you!

Get ya!

Bye bye!

Give me the coin.

Bye.

Smashy.

Smashy.

You dead.

Smash you.

Ooohhh.

No!

No.

I will beat four rooms and then- no.

No.

No.

We're goin' again.

We are going again.

It didn't happen.

I am not dying.

Play.

Come 'ere. (sing-song) I'm gonna smash you all to little bits.

Gimme that coin.

I smashed you so hard I lost my headphone.

Yes, give me that coin.

I don't know what the coins do.

But I have 26 of them.

Yes.

Who'm I gonna kill now?

Oh my god giant ass blob!

No blob killed me.

Run away from the blob girl!

Oh my god it breaks into bits.

What's that?

You wanna get smashed!

Yeah that's right, SMASHY SMASHY BITCH.

Come 'ere, let me smash you.

Smash you.

Take that blob face bitch.

Go.

Smashy smashy.

Come here, come here, come here.

Smash you.

Bye bye!

Who's next?

Smash you.

Smash you.

Oh no, run away, run away.

Run away and smash you.

Smash you, smash you, run away.

Smash, smash, smash, smash, run away.

And smash, smash, smash, run away.

Smash.

Go.

Go.

Dead.

I kill you.

I kill you in yo face, bitch.

I kill you, I kill you, I kill you dead.

I smash you and I kill you and you dead.

Next.

Oh.

Fuck you blob.

Come here, bitch.

Smashy smashy, bitch.

Come here.

Come to me blob.

Come on, you know you want to.

Smash you.

Smash you, bitch.

Smash you, smash you, smash you into million bits.

Oh look at that.

Come here, come here, come here.

I want kill you.

Come here.

Goin' kill you into so many bits.

Come here, bitch.

Come here.

Come here.

Smashy, smash, smash.

THIS IS AWESOME!

LET ME KILL ALL OF THE THINGS!

Smash you in your face.

Oh what's that?

Oh damnit!

Damnit! (laughing) I was having so much fun killing things! (high pitched) one more time.

I'm gonna play one more time because I can't stop, I love this game SO MUCH!

And also I should be able to get past the frikin' hammer rounds.

So yes (laughing) let's smash some more things.

Bye bye!

You dead.

Who's next?

Who's next to DIE?

You're next to die!

Gimme dat coin.

Mine.

Oooh I'm gonna kill you, I'm gonna kill you dead.

Smash.

Smash, smash, smash your face.

I found your face and I went smash.

Boink, boink.

Run away Amanda.

Run away from the stupid thing.

Gimme that coin.

Oh well it killed me.

It's kind of irritating turning around, though.

That's the one thing that I don't like about this.

I love smashing though!

I love smashing these stupid things in their stupid faces and killing them dead!

You dead.

You dead.

You dead!

Yes, yes, yes, yes, yes.

Next room, let's go.

Oooohhhh.

I got a thingie.

I got a bow.

'Shoot stuff from afar and never have to get close to another living thing.'

YES!

Better than smashy smashy, we got shooty shooty!

YES!

Yes.

Give me those coins.

Oh did you wanna die?

Cause you just died.

Yeah.

And I'm such a fun little character.

Oooh what now?

I got a pogo jump!

YAY!

I got jumpy jump jump jump.

And I have beat my record of four rounds, so jumpy jump jump jumps.

Yes, yes, jump time.

I don't know if this was a good idea.

This seems like really harrible- terrible.

I don't like this!

I don't like the jump!

The jump is TOO MUCH!

MAKE IT STOP JUMPING OH MY GOD.

Oh my god, every where I go I'm just jumping.

I can't do it.

I can't do this.

Oh my gosh it shoots fire.

WHY THE HELL DOES IT SHOOT FIRE?!

Shoot, shoot, shoot, just friggin' shoot at 'em.

Oh my god, oh my god.

I can't control the jumps.

I don't have jump control anymore!

Alright, ok.

Ok.

These jumps can go away.

These jumps can frikin' go away.

What?

What now?

What now?

What'd I get now?

I got stronger.

Ok.

Ok, that's good.

That's good.

These are friggin' redonculous.

NO!

No bitch, no bitch, no bitch, no bitch, no bitch, no bitch, no bitch.

Amanda doesn't like it.

I kill you.

I kill you dead!

I kill you dead, I kill you dead!

You goddamn bat!

Fucking bats.

Oh what's that?

Gimme your coins.

I don't know what the coins do but I want them all.

Fuck you, fuck you.

Dead.

You dead.

Oh my god.

THIS IS TERRIFYING!

YOU CAN'T CONTROL THE JUMPING!

I can't aim for anything cause I can't control it.

What do the coins do?

I only have one heart left.

What do the coins do?

Come on.

Ok what now?

What I get?

Husky enemies.

'You can fit entirely in their mouths.

Don't let that happen.

Barely won = one room.'

What the hell?!

I don't want these.

I don't want the big ones.

I don't want the big ones.

I know I'm critical right now!

Ok?

I frikin' know I'm critical.

Oh my god, oh my god, oh my god, die, die, die, die, die, bitches, die, die.

You're gone.

You're gone.

Leave me alone.

Leave me alone I'm just a little girl!

I know I'm at critical health.

GIVE ME MORE HEALTH!

How the hell do I get more health?

Can I buy it?

I have coins!

I will give you my coins if you give me your frikin' health.

How do I get this thing?

Go, go away.

Go away, go away, go away.

No.

Leave me alone!

Leave me alone!

Leave me alone!

I don't like you.

I wanna kill this guy over here!

Oh my god, oh my god, oh my god, oh my god, oh my god.

I know time to upgrade that weapon.

Oh god!

Oh my god.

Uuuuooohhhhh.

That was a lot.

(heavy breathing) That was a lot.

Ok.

So that was a lot.

Um.

I LOVE THIS GAME!

I love this game so much!

Um.

This is so addicting.

If this was on my phone, I would never put this down.

So that's it for Choice Chamber for right now.

Let me know what you thought about this game in the comments down below and if you liked

this video, click the like button and subscribe to my channel, I make a new video every Tuesday

and Friday.

Thank you guys so much for watching.

MWAH!

THIS IS SO MUCH FUN!

For more infomation >> Smashy Smashy - Choice Chamber - Duration: 12:39.

-------------------------------------------

Ireland summary - Galway, Burren, Cliffs of Moher, Dingle, Kinsale, Dublin - Duration: 3:53.

Ireland is a small country blessed with the rich variety of wonderful sites, most famous

for its green rolling hills, history, friendly people, and Guinness.

Their brewery is the top visitor attraction in the country.

We will show you that and much more in this comprehensive look at Ireland.

We'll bring you inside prehistoric stone structures in Dingle.

We'll take a trip out to the Aran Islands by ferry, a remote place with a great many

archaeological sites, traditional culture and spectacular sea cliffs.

We will be visiting small villages along the way from Clifden to Kinsale, a southern village

with an ancient stone fort.

Our three main destinations will be Dingle, Galway and of course Dublin, capital of the

country, a great center of culture, learning and nightlife.

Dublin is a wonderful city.

But don't make the mistake when you're visiting Ireland of only going to Dublin – there's

so much more to see.

On the map we will give you a quick preview of our entire itinerary.

We took eight days to make a leisurely circuit all the way around the country.

Our first major destination is Galway and Connemara, where we stayed for three nights.

We took our ferry ride out to the main island of the Aran Islands, Inishmore, where you

can get around by horse and cart, or bicycle, or van tour.

For the entire eight days we were in the capable hands of our Irish driver and guide Martin

Woulfe, who's going to summarize the entire visit.

We left Galway City, we came out to Oranmore.

From Oranmore we came into Kinvara.

Turn right in Kinvara, and we went down through the Burren in County Clare, down to the Cliffs

of Moher.

And from the Cliffs of Moher we came down the west coast of Clare.

We came down to Liscannor.

We continued on into Lahinch.

From Lahinch we went down the west coast all the way down to Doonbeg.

We had our lunch in Kilrush.

And from Kilrush we caught our ferry across the River Shannon.

We came into North Kerry, to Tarbert.

And from Tarbert we came into Listowel.

And from Listowel we went to Tralee, and from Tralee – we stopped in Tralee.

We had a look at the gardens inTralee.

We went to Camp, Lispole and on into Dingle and the Dingle Peninsula.

We did our tour of Dingle Peninsula, Ventry, Ballyferrite.

All on the Dingle Peninsula.

And came back into Dingle, and we left Dingle.

We went to a place called Inch, the longest beach, and into Killarney.

And from Killarney we went to Macroom in County Cork.

And from Macroom we went into Cork City, and down into Kinsale.

We toured Kinsale.

We left Kinsale, and we came from Kinsale, stopped in Cashel, the great rock of Cashel.

And from Cashel we came up to Dublin.

Ending up in Dublin was a perfect way to finish the visit, because we've had a whole week

out in the west of Ireland enjoying the greenery, and the little villages, and the historic

sites.

We nd up with some big city action.

Be sure to look at our Ireland series for the complete picture that opens the door to

this magical country.

For more infomation >> Ireland summary - Galway, Burren, Cliffs of Moher, Dingle, Kinsale, Dublin - Duration: 3:53.

-------------------------------------------

New Jurassic World Hero Mashers Ankylosaurus Action Figure Dinosaur Toy Unboxing, Review - Duration: 8:07.

Oh guys it's great to see you again I'm so glad you decided to come back today

New Jurassic World Hero Mashers Ankylosaurus Action Figure Dinosaur Toy Unboxing, Review

Pinkley a sword this is another one of the hero masher sets I did a review on a

lot of these sets and there's so much fun because you could combine all of

them and make some crazy-looking dinosaurs I mean here's just a few of

them look here you got the ankylosaurus you've got the Triceratops the

Velociraptor the die more photon and then you've got the t-rex you got the

Stegosaurus see look at that how crazy looking it is how many

different parts you could put together wow this looks like a lot of fun let's

go ahead and open it up okay here's all the pieces let's go ahead and put them

together let's see here's his head and his mouth does open so it is cool so

let's snap is head on and then you've got his tail

but these ones are really fun there's so many different things you could do with

them you can make some really freaky looking dinosaurs and then we're gonna

go ahead and put his legs on this is the wrong one

see these parts have to be on the outside because you could attach

different stuff to them it's really cool

okay we got him put together let's take a closer look at him wow he looks cool

like I said he does open and close his mouth so that's really cool I was

thinking he doesn't open his mouth because his mouth looks kind of small

he's got cool teeth in a tongue it did a really good job of coloring his eyes

he's got a cool yellow and blue color scheme it almost looks like a battle

scheme then you have the Jurassic world emblem there his legs you could bring

them all the way out here and also turn them around 360 degrees the same with

all of them so he could stand up it almost he could almost use like his legs

for arms then his tail will go up and down and then you could turn it 360

degrees so his tail be good for battles too and then with the way his legs are I

believe he could stand up too you know looks like he could just turn this a

little bit more he could stand up that's cool so it's almost like he's gonna go

box somebody Wow let's get some of the other sets

late some weird-looking dinosaurs okay go big green cookie cookie cookie

cookie for me cookie cookie you up cookie okay Cookie Monster

this is not your show it's in dinosaur show okay thank you sir

I eat Tennyson no no no don't eat our dinosaur poo okay cookie cookie cookie

cookie monster go go oh you go bye okay guys here I have four of the different

sets let's go ahead and make some weird-looking dinosaurs okay first of

all I think we're gonna change out his arms maybe he'll go with the

velociraptors arms

like I said these are really easy to pull off and change and just make

whatever dinosaur you want then he could also have wings

what else how about we change out his tail if the t-rex is tail

and we could also change his legs off we can get some huge ones from the t-rex

you see him Wow you can make some really different dinosaurs look at him he looks

cool let's see what we could do is some of the other ones if you take like the

t-rex is head we'll put the head from the velociraptor on to him a big body

and tiny little head we could put the ink Leah sources legs onto him we could

put on the ankylosaurus his tail on to him look at him he's got a big body but

all his other parts and small Boyd that one looks funny let's check out how

about I'm gonna take the Velociraptor we'll put on the die mark bogans head

love to him

and then we could put on the legs from the ink Lea Soros on to him boy they've

really messed up when they modified this dinosaur what's he supposed to do then

we could take these legs and switch them out with the ones from the dimorphodon

oh boy look at him boy is he freaky looking he's got these little skinny

legs big fat arms they more put on head Wow okay let's see for the die more foot

on let's see what we could do with him we could put the t-rex his head on to

him and he could have the tail from the Velociraptor and he could have the

velociraptors rear legs

boy guys these sets are really fun there's just so many different funny

things you could do look at this guy boy that is awesome what do you guys

think boy these are some weird genetically modified dinosaurs click the

subscribe button below

also click the bell button to be notified every time I make a new video

click the boxes below for a lot more fun videos and if you want to see even more

go ahead and click the subscribe button