Welcome back to the workforce and plus TV Africa. We had straight to our second conversation right here and we look at what all sports this morning. Of course in sports we're looking at Manchester United getting knocked out of the UFA Champions League following their loss to at least come a drink the round of 16 on Tuesday night. Now the loss meant that Manchester United completed five years of a dreadful trophy drought but isn't that what's on the mind of a football lovers and that's because this loss also implies that the Portuguese great Cristiano Ronaldo will complete a season without a club trophy for the very first time since 2009 to 2010 season. Now the vast majority of football lovers believe that this is the end of an era that was heavily dominated by two great Liana Messi and Cristiano Ronaldo. This morning we have a guest joining the conversation. We'll look at the implication for Manchester United and the way forward for them of course the stakeholders looking at Messi and Cristiano Ronaldo. But Monday Thamas joins the conversation this morning. He's a sports presenter. Monday it's good to have you join us on a Friday. Good morning that's fantastic to also be talking to you this morning. I hope you're doing great. Very well thank you for asking. So let's just share your thoughts on the UF Champions League generally the performance of the clubs and you know has been so far.  I mean what are you expecting? You've got the goal to Ronaldo. He has done the very best for you. Six goals in the UF Champions League and that's the most by Manchester United player. He scored most goals for Manchester United in the English Premier League. He has done his feet. I mean a lot of people are ready in the conversation if Ronaldo is finished or if Messi is totally finished or if this players are losing touch. Ronaldo at the age of 37 greatest goal scorer here in history for club and country. 807 goals. What else are you expecting? I mean football has changed. I mean football has completely changed. Players are getting better with age. The likes of Benzema. No players contributed to more goals this season than Karim Benzema. He's 33. Look at Robert Lewandowski. He's 33. He's still firing. Karim Benzema is actually 34. But I'm just taking a look at how football has changed in a dynamic. Players are getting better with age. I mean especially the strikers. Latini by Moe. Okay but just before we're delving to you know Monday thermals. Can you hear our speech? So just before we get into delving to the analysis looking at you know the live and times of the likes of Cristiano Ronaldo and Messi right here. What's your think on the entire UEFA Champions League? Well my take is that it's quite a shame that they are off and it's quite very unfortunate that they played it with very average players. Well we seem to be losing connection with Monday thermals as soon as we're able to have this connection. Then of course we continue with the conversation right here. Well Kofi you know a lot of persons are really talking. I mean with the overall performance football lovers across entirely seem to be focused on you know Cristiano Ronaldo and Messi. But I come to you just before we move away. So Monday let's continue with your thoughts this morning. All right little Messi is quite unfortunate that he's playing with average players and that is why Paris and Gimena are out of the part of the UEFA Champions League. They've got potentials but what happens when you don't maximize this potentials. Look at Neymar Giulia great player. He's got what he takes to be one of the best footballers on earth but then he lacks discipline. Donnaruma what actually happened that night in Benabao? Donnaruma you are Gianluighi but you're not Gianluighi before. What are you doing at the back? You're literally flirting.  Look at Marquinhos. That third goal Karen Benzema just needed to poke it in. It was Marquinhos who was not able to clear the ball out. So little Messi at 34 is still one of the greatest in football.  So no one to take a sweep on Lionel Messi crushing out of the UEFA Champions League. I think Paris Saint-Germain got to fix things. Live more in St-Germain out of this. You said that Messi is in an average team but this is a team that got to the UCL semi-final I think last season. It's a team that has also... Have they been to the final yet? Please remind me. Paris Saint-Germain have been in the finals. They played by in the 8-20. Fantastic. Yes, yes, yes. So I mean they've had the likes of Unai Mere, Tuchel and Ko. You have Messi in the team. You have Mbappe in that team. Mbappe. You have Neymar. You have great midfielders in that team. Marquinhos is a good defender. You have players that other teams would love to have in that team. They are players like Van Aldo who can't even make the first eleven because that team is that good. They have the best goalkeepers. Donoroma is the best keeper in Europe from the last Europa competition. So would it be fair for you to say Messi is in an average team and has Messi lost his sparkle as it were. Is it over for this player like it is maybe for Cristiano. It's quite sad that football numbers are in this conversation already. Messi at the age of 34 just allowed him to have this dance. A lot of the players enjoy themselves. I can remember in 2019 when Iron Robin said good-bye to football. Had tears dropping down in my eyes because since Iron Robin left football, what we've seen with that beautiful left foot. It's quite sad that a lot of people are already rushing to say little Messi's lost touch is completely finished. I'm like are you kidding me. Ten goals in the league on and ten assists in the league on and that is joint highest. Five goals in the Europa Champions League. Although it's gotten just two late goals but as a player who's not playing the number nine position as a player who's you're playing from the wing who's you're doing a bit of a number ten role. I mean what else you expect from me. Me is getting in the goals and I'll say time and time again anywhere anytime.  Maybe they've got potentials but until they prove me wrong with their performance says then I'll give it to them. Kylian Boppe is the only player I can pick out of Paris Saint-Germain sport. Neymar what happened to him on the night. I know Messi missed that penalty that should have given Paris Saint-Germain a two-goal advantage in Paris but of course it can happen to anyone. Anyone can miss the penalty but anyone cannot be flitting in the back when you have time and been looking at you. Anyone should be able to know that where you are being attacked and you have no option is to clear the ball out. Makinos I know he was on the picture but he should have cleared that ball out. He tried to pass and unfortunately he got to Benzema and that was the end of the game for Paris Saint-Germain. Okay so let's talk about the PSG team. You said they have average players. I still disagree with you but I'll give it to you. They don't have a coaching problem. You know you look at what Adonaroma did and the fact that a goalkeeper who was won the Champions League previously with Real Madrid he has experienced and Real Madrid have not gotten to the final of Champions League since he left Coelho Navas was on the bench. He was the same keeper who was in the number one keeper starting for PSG when they got to the final of the Champions League so he has sort of a module. Is this a coaching problem for PSG? Absolutely not. Mauricio Portuno is a fine coach. I can remember you explained this for Paris Saint-Germain. You're a fine player as well. What did you do with Tour de Montsville in 2019? You qualified them to the UEFA Champions League when they eventually lost to Liverpool with no budget or whatsoever. Not even a no budget. No budget. So you can't tell me it's Mauricio Portuno who is to be blamed in this particular situation. He's a prolific manager. So let's also talk about the fact that you know the season the UEFA Champions League has left a lot you know had broken. I mean it feels like the the entire you know Champions League is about Messi and Ronaldo crashing out. But of course you still have the fact that Messi and Ronaldo still have a chance to prove it. We're talking about the World Cup. Now unfortunately you have the fact that Argentina has actually qualified sometime. Now the big question would be do you see Ronaldo you know taking the Portugal club you know to winning the World Cup and qualifying for it at the time where you're having the playoff. Another chance to prove himself. Certainly another chance for him but winning the World Cup it's going to be very daunting but it's not impossible for Cristiano Ronaldo. He's a big game player. 807 goals, great goal scorer for club and country. What are you saying? He is going to show. He's a show man and he's going to produce some incredible stuff in the World Cup but it's once in about a time they take on Turkey in the playoffs and they have some players who are not going to be preaching for them and it's not going to be a difficult task but I'm saying Cristiano now though that chance you talk about if it's given to him at the World Cup it's going to it's certainly going to perform. We're sitting here years after still talking like Messi just pointed out about Cristiano and Lionel. Why is it that we've not had other players challenge and break into this top two of course Lewandowski is tried and he's done his best but he's nowhere near the levels that these two have gotten to at their peak. Neymar left Bacca to go to PSG to become the world's best player. You know what happened and if these two are on a swan song or rather on a decline who do you expect, my second question, who do you expect can step into their shoes? All right and it's let me tell you why Messi and Cristiano Ronaldo are still the signature in world football right now. It's not a see if the other players are not doing great. Killian Boppe is outrageously good. Erlin Berhalen although this season he has been injured for the most part of it. He scored 16 Bundesliga goals and that's something for a player who had just played barely a half of the season and now Messi and Cristiano now though I think it's just about media hype. The media are still focusing on this players. Yes they're still talking about this players more than they should. I think they should also let the new names come up. Erlin Hazard prolific, great winger although in Real Madrid he's not doing great but what about his days at Chelsea? He was not hyped. He was not talked about as Messi and Cristiano Ronaldo have been talked about. So but Monday just before we let you go because we're costing out of time so I bring you back to my very first question and I'd like to you know take your thoughts on the entire performance of the UF Champions League I mean looking at all of the teams that have actually played all the clubs if you like to say which would you say is actually or you know has been in best performance? Bayern Munich. Bayern Munich is always a team to watch anytime, any day and also we are not going to overlook Manchester City who are desperate for the title Pep Guardiola as well. So for me I think Bayern Munich are one of the biggest team in the quarterfinals and as well as Manchester City. What about of course yeah what about Villarreal? Villarreal yes they did miracles in Turin. The other night scoring three goals in 14 minutes is also a team to watch of course knowing that Unai Emery someone who knows how to play European football is right there but this is his first quarterfinals in the UF Champions League and let's just give him a chance, Unai Emery. So some persons will say you still need to look at clubs like Chelsea and Liverpool you know in that same analysis. Thomas Tuchel my word Chelsea is blessed to have him right now at this crazy times. He's a great manager and this is when I want to talk about how football is no no no longer one man's business just like it was some time ago. You've got to have great defenders look and blow canting the middle of the pack. You've got quality goalkeeper Edward Mendy, Afghans, Afghans winner, FIFA best goalkeeper Roudiga is out there in your defense line and as well as Christian said Thiago Soba the age of 37 super so Chelsea have got a team as well. Liverpool the best team in the English Premier League for me. They're better than Manchester City. I don't know how Manchester City is on top but on the 10th of April we'll find out. I know I know Messi could not allow this conversation and without mentioning Liverpool it's okay. Well that's all right. Thank you so much. Next season we'll be mentioning Arsenal. Thank you very much for your time Monday. Thank you so much. We appreciate it. Who's John is live on the breakfast this morning. Thank you. Appreciate you for your time as well. Right well the best we're seeing. The best man win. Messi don't worry and next season we'll be mentioning Arsenal as well. That's not it. We're always working projects. Well many thanks for being part of the conversation. It's a beautiful Friday and of course that's an enlightened note. We wish you the very best this weekend and we hope that all things will be very equal and everything will be perfect. However if you missed out on any part of the conversation it's all right to follow us on Facebook, Twitter and Instagram and do subscribe to our YouTube channel at Plus TV Africa and Plus TV Africa Lifestyle. I am Messi Boko have a fantastic day. And it's a wrap for this week. My name is Kofi Bartels. We'll return on Monday. Keep watching Plus TV Africa.


Hey, what's going on everybody? My name is John Hammond and in this video I want to showcase this baby boy challenge from seesaw CTF 2019 this was the first challenge in the PON category or binary exploitation and it's I Guess trivial right and that it's a low 50 point challenge in the binary exploitation category But this is not really my strong suit and I learned something really cool in this challenge that I wasn't aware of before So I wanted to share it with you so let's go ahead and get started It gives us a couple files to download here It says welcome to PON as the description and we're given a netcat command that we could use to connect to the service So it has to work remotely, right? I'm gonna go ahead and create a little connect autosage script just so we can save that and Connect to it as we needed to so I just created a simple bash script and copied it in there So we'd be able to actually run that command and don't have to worry about oh here is my actual netcat host important number, etc. Just a convenience thing that I like to do It says hello here. I am and gives me some hex value here. So Hello, okay, and that's it. That's all the binary seems to do But we can go find out what it really does because they give us the binary of libc Like the C library a shared object file and the baby boy dot C source code So let's download all these I'm just gonna right-click and hit W get or copy locations We can throw that to W get we'll download it and let's work through all of these So W get that Do the exact same thing Cool. So now we have these files here. We have the libc We have the source code and I had add downloaded it previously my bad. Okay. Now we're clean Let's see what this is. This is a 64-bit executable. So we know we're working the 64-bit architecture x86 64 and not stripped binary So if you wanted to you could do things like read elf on all of that and see what we have in here Nothing particularly interesting But we don't need to do all that because we have the source code. So let's take a look at baby boy dot C And this is our source code. It looks like we're just including regular standard libraries for C We have a simple main function with arguments that just flushes the buffer here or works with standard out centered in Senator that works just fine for us and we have a buffer variable 32 bytes and it's just saying hello here I am with the value of printf So we actually get to see one Location of a C standard library function and know where it actually is in that binaries runtime That's gonna be pretty handy for us because it looks like the next line is a gets function call So gets is just that hey Super dangerous function never actually use this if we check of the man page for gets it says this will read in a string From standard input, but it's deprecated It doesn't check for any buffer overflows It doesn't verify whether or not it actually is within the bounds of the buffer that you pass to it that variable That's created there. So it tells us up here. Hey Never use gets it's impossible to tell the data in advance before how many actually characters were reading in so we could very well Be subject to a buffer overflow attack and that's exactly what we're gonna do So we know that that is the shape of the binary. That's what we're working with I'm gonna clear out all of these things in my Sublime text so that's kind of clean for us and now let's go ahead and start to beat up this binary I'm using PON tools So I've got PON cyclic that I can actually use and we'll actually be able to use that to fuzz data We're actually send a cyclic pattern to it. We know that it is about 32 Just pulling up the source code here. We know that it is 32 characters for a buffer So we could send more than that. Let's send like 50 just to send it to our baby boy here And I need to mark that as executable. So don't forget that chmod plus x baby boy and Now if you wanted to PON cyclic, let's just send some data to it when I'm using PON cyclic What that's doing is just actually creating a cyclic string So we'd be able to tell okay if we're looking at D message where our instruction pointer crashes or overflows We could see that we know we're getting that segmentation fault so we can see that just easily Let's check out D message see where I'm at and I'm getting a general protection seeing a trap there That doesn't really help me. So I know okay. Let's tone that down. Let's go to about like 45 and Throw that at our baby boy binary check out D message one more time That's probably pretty hard to see Sorry, my face might be in the way, but okay now we see we're overriding 6c 6 1 6 1 6 1 6 B Is that actually what we are overriding though, let's I'm gonna I'm just gonna tweak this lower and lower. We'll get to 40 I'll check D message now. I get a seg fault at zero Okay, so set fault at zero means that I probably just clobbered the instruction pointer 64 bits So we're RIP rather than EIP and maybe there's just a null byte in there Let's flood that again with 41 and see if we get potentially our Last character maybe an A in there. Maybe something lowercase a so let's check our D message output and Still zero We're not fully clobbering it We're just trying to massage this input so we can find our offset is or where we can clobber that Instruction pointer because we know that's going to be overflowed And there's our 6 1 and 6 B in there, okay So that's 2 so we can assume that 40 is going to end up being our offset And we can start to build out an exploiter payload to actually work with this We don't have any functions that we could jump to like a simple like get flag or print flags or get shell so we need to be able to Probably track down the system function call within libc and then go ahead and actually call that function and We'll just get a shell. We'll run bnsh and it'll work for us. So let's check it out Let's go ahead and create a script. I'll call mine ape.py Get a shebang line rolling for us and I'm gonna be using PON tools So from PON import everything and let's grab our binary here. Let's create an elf object for baby boy and I'm actually going to want to differentiate between I'm running this locally and running this remotely because we have our connect script and That is the host name and port number here So let's say port can equal that host can equal that and let's set like a variable just a boolean test for us local equals true We're not whether or not we're actually going to run this locally or remotely. So I'll say if local then my P Will equal Elf dot process Probably that sounds weird to say sorry my I'm to create a process From this binary and I'm just going to call that variable P because that's shorthand really easy really simple if We were remote or if we were not actually using a true value of local We'll use these host import values and let's set P to a Remote session of host import. So now we're gonna we know we're gonna connect to it and let's go ahead and print sorry Let's print out P. Receive so you can see what we're working with here and I'm gonna use this in Python 2 Before it dies and goes away 2020 is coming quick note if we were to use Python 3 We return the same information I'm using the Python 3 Pone tools that you can find on GitHub I think the project isn't maintained anymore, but it's still usable. We use it for Katana and other projects So B notes it. Okay, we're receiving this information as bytes and It's actually a little problematic in the way you might normally use Pone tools Especially if you're working with a binary and trying to work with some Libc libraries, etc, etc It gives us a nice check stack output so we can see we don't have to work with PIE We don't have to worry about a stack canary or anything But we know we're working on a 64 but executable and we cannot execute off the stack So we can't use shellcode. We have to use something like Rop or the return-oriented programming language stuff to Really abuse this binary. Okay, it's giving us the system Location I said system and that was the wrong word It's giving us the location of the printf function in C in our libc library and we can see that okay That is going to change every single time because of ASLR Maybe on the remote system or even on my local system. Let's run this in Python 2, sorry But since we can know that value even at runtime because the program will tell us then we could potentially determine Where the base address of libc is we could just go ahead and work with it We could just actually subtract out we know the location of Printf so now we could find the base address of libc and because we're given the libc file We know where system is So simple ret2 libc attack because they simply just give us printf. Let's go ahead and work with that. I'm going to load just a LDD I'm gonna use LDD to find out where my local computer is actually using my libc rendition Looks like it's in forward slash lib x86 Blah blah blah. So let's say libc can equal elf of That and if we were remotely we would use the libc from That libc that's in our current directory right our libc 2.27.so whatever so let's just slap that in there Okay, so now that we have libc Let's carve out where we're receiving that printf location and let's go ahead and use that to find our libc base address. What I'm gonna do is I'm gonna say P.receive until and let's get until the here. I am Kind of syntax there here I am with a space and let's do p.receive just following that and I'll say that that is Stripped so we don't get that new line character there. Let's print that and Now let's run our script Still working locally now we can see hey, we've got our printf Address here just displayed as that variable. Let's go ahead and actually make that a number because right now That's a string. So I'm gonna use the int function to wrap around that and I'm just gonna say that's base 16 That should be inside of my int function, sorry So we don't need to print that anymore, but let's actually call that printf Now if I were to print printf Python treats it as an integer just in decimal if you wanted to see that in hex Now we just encapsulate that variable and it's a number that we can work with so perfect now that we know where libc is now That we know the printf is in libc at runtime. We can find out the base address of libc So let's check that out. Let's say libc, which is this object we created in PwnTools We can actually use libc.address and say this is where the base address of libc is going to be You have to set this when you're working with that libc object from PwnTools By default it's zero so all the offsets between symbols and things in the GOT or the PLT are just based off of zero within the file as it knows, but you can set it to something else Corresponding the libc file you're working with and then all of the other offsets Excuse me all the other offsets or the symbols you want to pull will just be the correct value So let's see that We can say libc.address can equal printf because we just got that value minus where we see the libc symbols address of printf indexing just like that Okay, so with that syntax just a little math just some quick subtraction there We can find out the base address and the offset there I'm gonna print that out. I'm gonna print out libc.address and I'll put that in hex so we can see it and Let me just add a few Display things here, so we know what we're talking about when I show this on the screen Cool printf. We know is that all of this in libc base address now that we've done that math We know is that all of this and that looks like it's paginated well That's in the right kind of area in memory. We can that makes sense to us because this starts off the same way So now we've got base of libc and that means now that we've kind of corrected our libc rendition We know where system is as well Let me show you something just real quick if I were to run that same script doing that same thing with Python 3 using the Python 3 Pwn tools This is the issue that I was gonna run into and I wanted to inform you about it Is that when you try and retrieve that printf out of the symbols here? It'll tell you hey Kier I don't know what you're really talking about because you have to index that with bytes and That's a stupid idiosyncrasy that you might trip on and run into I don't want you to have to end up falling on that Now if I had that be prefix to say that's in bytes sure it'll be able to find it and run without an error So let's still use Python 2 when I run it and that works just fine for us, okay So now we have our libc address our printf address and now we can say the real system is at libc symbols of system Perfect, so now we could call system if we were to overwrite our Instruction pointer that RIP value But we're not using regular 32-bit calling conventions now We're in 64-bit so if we actually want to pass an argument to system which we do right we want to actually run it with a Value loaded into RDI. So those are the 64 bit calling conventions It looks for arguments in RDI and I think RSI and Other locations then it gets into the R1 stuff. I Can't remember off the top of my head But RDI is the first argument that we're gonna need so we need to find a gadget or some location in the binary or within libc that we could actually return and work with that pop RDI instruction So we can suddenly fill a value inside of our Argument and give that to our system function here. So let's do that I'm gonna actually use Rop gadget and when you use Rop gadget, you need to use tack tack binary You can see zshell is trying to autocomplete for me stuff that I've already done here So let's just give it the baby boy binary because maybe we could find stuff in there that we need rather than looking in libc And we have a lot of results here Kind of hard to see on the screen. Sorry, but one of these real quick for us is this pop RDI and RET So pop RDI and return Everything will have a return at the end of it because we are using Rop return oriented programming So that way we can just jump to this position move back to where we were and that's how Rop works. It's pretty cool Let's go ahead and take that address and let's just say pop RDI can equal that And let's start to build a build out. Sorry, excuse me a potential Rop chain Let's say we want to pop RDI But what do we want to pop into RDI? What value do we need to give in there? Well, we need to give it that bin SH string But where are we gonna find that we can find it within the binary What we can do is actually use Libc because that's given to us we can use search And we're just looking for a string here as we can just pass in bin SH When you do this, you'll note that that's actually to give you an iterator or a generator object So if you want to get the first result, I just run dot next and now we have that address if we were to check that out in hex Cool. Now we have a location within the libc where bin SH just that string exists And we could give that to system because we popped it into that RDI register and we'll use that as an argument In 64 bit calling conventions. So let's say that that value is Our bin SH string or variable that we want to use here. Now, we've got a Rop chain We can use Rop chain pop RDI Bin SH and let's go ahead and call system with that. I Like to use the syntax. I found it or at least kind of like that idea Caleb my roommate uses it a lot especially He's illicit tiger in the discord server and you've probably seen him in other videos This is a really cool technique that he uses and he's much better at binary exploitation than I am If you create a Rob chain just like that inside of a list You kind of read it in a more assembly-like fashion and then we can just join it together by using p64 Or p32 on all of those and that way it's in that little endian format that we need to be able to pass to our binary So I'll just say R for R in Rob chain So now we have a Rob chain that we could use and we need our payload Which will just say a random junk random stuff 40 times because that'll fill up until we get to our return instruction pointer. I'm sorry our RIP our 64 bit instruction pointer Now that we've hit that offset now that we are flooding into the instruction pointer will pop in our Rob chain That will call pop RDI with bin SH and then jump to system So let's try that.  Let's find out and now that we've sent that We should have theoretically jumped to a shell or call a shell. So let's move that into interactive so we can see it work Here we go and switch an interactive mode. I'll hit enter a few times and I'll run ID And now you can see that's John So I can run who am I? I'm still John and We have a shell I can run commands. So we just called Bin SH and now we have control over that system. I'm running this locally though So all we have to do now because we've set up. Hey, here's our host and port Here's the remote service that we're connecting to and using the remote libc We can just switch that to false up top here And we can go ahead and run our script and we should be able to work with it But we got an end of file while reading interactive mode. I don't have a shell so This is what I struggled with for a little bit of time Caleb and I were wrestling with it It sounded like people even on the discord server and those that were playing seesaw CTF were wrestling with this I did not know this. This was a whole new thing that I got to learn and Props and shout out and thank you to crypto was his name and discord who Reached out to me and checked in with me and said like hey, I got this. Do you need a hand? What's up? Because my my exploit I said like I don't I don't know what's going on my exploit works locally It does not work remotely. What do I do? There's no way to research that kind of thing. I couldn't I couldn't track it down so the guy said to me The remote service is on Ubuntu 18.04 and I'm running on 16.04 locally and apparently Ubuntu 18.04 in its 64 bit sense. I don't know if it's strictly Ubuntu 18.04 maybe maybe other 64 bit distributions or things do this but Apparently it works memory the stack the whole this whole binary realm works in a 16-byte boundary So that means that our payload and things need to be aligned or within a Kind of 16-byte multiple. So what we have here for our Rob chain pop RDI We know that's eight bytes and same with penis H and all That gave us 16 total here, but system that's not So right now our stack pointer is not being fully aligned to that 16-byte boundary and We're not able to call system on the remote machine So what we could do is just filled out with a little bit of garbage or some padding just some junk with 8 bytes somewhere really just not in our pop RDI Alignment there because we need that to fill that argument and not after system because we need that filled out Before we're calling system our stack pointer needs to be set and aligned within that boundary before we end up calling the function So we could put it just before system or put it at the front here Let's do it just before system and we need just padding and junk a good way to do that is just check our rops one more time Or our gadgets here. We have one of these that is just a simple ret Command there. So let me take that and let's just create a variable for that Let's say ret can equal that value there and We have everything else that we need to build out our rob chain and let's say ret right before we call system okay, so We have some information Some testing to set up whether or not we're running this locally or remotely Maybe it would be a cool idea to do this with our parse So we don't have to just be modifying our script while we're working with it We determined the address of libc so we could get the proper system location We got a couple gadgets between pop RDI and ret and we found where bin sh is in our libc And now we built out a rob chain with p64 put it in the little endian format that we need Use the correct offset and we're sending it and we're going interactive. So now let's see if I run this working remotely local is false Will we get a shell? It doesn't kick me out whack enter a few times looks like we're still in ID we're baby boy. All right LS. We got it now We have a shell on that remote service on that remote system and we did it cat flag There it is flag baby boy Do-do-do-do. All right Let me clear that up. So it's more of the top of the screen for us and That is that so you go ahead and submit that a 50 point challenge still some hefty stuff I by no means am good at buying or exploitation This was a learning experience for me. I need to practice a lot more with this rock emporium Maybe ponable dot XYZ other resources and war games that I need to work through so that I can get better and We can get better you can get better too when it's that's the community. That's the family But right now I need to focus on OSCP, so Thank you guys for watching. I hope you enjoyed this if you did a please do like comment subscribe I would love to see you guys in the discord server There is a link in the description if you are willing to support the channel, which I am always so grateful for and so thankful for I Have a patreon account also link in the description Would love to see you on there super duper grateful and super thankful for all that you do to support So thank you guys. I'll see you in the next video


After 100% inelastic collision, the second extreme craze is 100% elastic collision. What's happening in 100% elastic collision is that two objects that initially travel in different directions collide and then continue to travel in different directions after the collision.  Now, in 100% elastic collision, kinetic energy is conserved.  If there is not 100% of kinetic energy that is conserved, but the part is used up by deformation energy, then that's what we have like a realistic collision, something between 0 and 100%. Now, the energy one is a bit complicated, but the linear momentum equation is exactly the same as for the inelastic collision, which is it is conserved. So we have a final momentum is equal to the initial momentum.  So in 100% elastic collision, we can have one equation from conservation of energy, and then we can have for each dimension in which we're traveling one equation from conservation of linear momentum.


My name is Abhishek Sabalkar. I am from the IITBX team and I would like to introduce my team members, Mr. Alkam Sheikh and Saurabh Sahu. So we are here to present to you to the topic integration using APIs inside IITBX platform. So first of all, I'd like to brief you about the IITBX platform. IITBX is an online platform which provides massive open online courses and it is basically based upon Open edX software. So now I'd like to introduce you to the aim of the project. The aim is to explore microservices with APIs as the method of integrating IITBX platform with any other software. So now we look at the structural overview of the project. At the center we have the control section and it works with the different APIs used which are the course API, course import API, grade API and platform API. And these APIs are used to manage and control the various instances that we create using the IITBX platform. So here we have as an example the Madras server, Bombay server, Delhi server and Kharagpur servers. So the platform API is used to create these instances also known as the platforms across the country on different local organizations. And the course API is used to create courses on various of these platforms. The course import API is used to import one course from one platform to any other platform needed using GitHub as the intermediary process. Then the grade API is used to simply query the students' grades on any of these platforms. We can also see that each of these platforms also has a local database containing the grades and courses of that local server. So now we look at the architecture of a project. There are mainly two components, control section and the IITBX API. The control section is used to interact with the user on the front end. Well, the IITBX API consists of the various courses, various APIs which also have their local databases. And these function together to provide the backend services of IITBX platform. So the course and platform API databases are interconnected using the group member database. The grade API has two types of databases, namely MySQL and MongoDB. Well, the course import has a reported database. Now these are the components that we've worked and completed in the duration of the seven weeks. You can see control section, the various APIs and also securing these APIs using OAuth protocol. So first of all, I'd like to give a closer look on the control section. So what is the control section? The control section is the central hub for managing various services provided by the IITBX platform on the backend. It acts as the, and what does it offer? It offers a front end dashboard, which is user interactive. And what is its purpose? Its purpose is to interface and act, interface with the backend IITBX APIs. And it also acts as the client Django application to access these APIs. So this is a snapshot of the course creation form in which we enter the details of the course. And when we submit these details, we have actually used Django forms. And when we submit these details, they are posted back to the course API, which records them and also gives a status code accordingly if it's successful or not. Similarly, we have a platform creation form and other creation forms as well. So now I'd like to introduce you to the APIs that we developed. First of all is the course API. So basically what is a course? A course is a collective set of study material provided by a user to its front end user, which is tailor made for the front end user. And what does the course API do then? It acts as a service provider for the courses hosted on the IITBX platform. And why is it necessary? It is necessary because it allows us to interact with the database without having intricate details, knowing about the intricate details of the database, like which software does it follow, like MySQL or MongoDB. We can just not worry about that and use the front end software as we need. Then the course API internally consists of two main functions, the get and post. Get is for retrieving the courses on the platforms. Post is to create new courses on any of the platforms. Now we have also used the serializer known as the course overview serializer. The serializer basically is a component which is used to convert the data in the request format to the Django workable format so that we can work on it and process the data and also give back the response as needed. So these are the functionalities. First of all is the course creation. We can create course by posting at the course API in the JSON format. We can also retrieve the details of a particular course on any of the platforms using course key of that platform. We can also retrieve all the courses from the platforms. And also we can find out which platforms are particular course like CS101 on which platforms does it exist on in the whole environment. So now I'll give you a closer look at the platform API. So what is the platform basically? A platform is a base for an organization or it acts as a server to host all the resources allocated to it by the ITBX platform. So what does it do? It provides us interaction with the database same as the course API. And why do we use it also? We use it to decouple the front end and back end as I said before. It also consists of two main functions get and post. Get is to retrieve the platform details and post is to create new platforms on various locations and the serializer uses integrated platform serializer. The functionalities are the same, almost same as the course API platform creation. We can retrieve the details of one platform, retrieve the details of all platforms or the courses that a particular platform has. Now I'd like to talk about the interaction between course and platform. So what kind of relations should exist? The relation that should exist is many to many because one course can exist on multiple platforms as needed by the author. Well, the platform also has to contain many courses according to the needs of the students. So now I'd like to call Saurabh to continue with the presentation. Good morning, everyone. Myself Saurabh Sahu and I'm here to take the presentation further. So the part that I'm going to explain is course import. So first, what is course import? The course import is basically transferring one course which is already present in a platform into the other platform. It is called, it is course import. Now why course import? Suppose in a platform we have a course and now we want that course to be present into the other platform. So we are not going to create that course into the other platform. So what we will do, if we want that course to be transferred into more than one platform, so we will use course import API. It will transfer that course into the different platforms. So basically course import has three main modules. First is course import API. The second is cloning that course from ITBX server into the remote system using GitPython and third is inserting course into the MongoDB using PyMongo. So this is basically the block structure of my course import API. It has a database which has attribute course directory and status. It has function, get function and post function and it uses database dbsculite3. These are the functionalities that are provided by the course import API. So basically as I explained earlier, course import API imports an existing course from one platform into the other platform. And to manage this functionality, we need a backend API which is course import API. What course import API delivers? Using post and get function, we retrieve the data which is already present in the database of course import API and using post function, we insert the data. What is the data? It's the course name that we are importing and the directory where we are cloning that data and it has another attribute status which shows that whether that course has been cloned or not. This is the representation how get function looks in the API. Here we can see the ID, course, directory and status. The course that we are importing from one platform into the other platform directly is where we are cloning that data into the control section system and status shows whether that course has been cloned into the system or not. So as I said, my course import API has three modules. First is the course import API. Second one is cloning that data from GitHub into the control section system and third is transferring that course into the Mongo database of the IITBX platform or the IITBX platform. So here status shows that course has been cloned into the directory of control section. This is the post function. It shows that using post function directly, we can insert the course name and directory and it will be cloned into the directory of the control section system. The second module is cloning course from IITBX server into the remote system using Git Python. We all know about the GitHub. GitHub is a version control system that detects the changes or modification in a file and coordinates that changes and modification into the other user files which are accessing the same repository. Yes, and now explaining a brief about the Git Python. Git Python is a Python-based library that communicates with the Git repository. It provides abstraction of Git objects for easy access to the Git repository either by using pure Python program or Git command implementations. So here the second point says that initiate Git.repo in the destination directory. What it does, we all know that when we clone a repository, it consists of a .git file which shows that the repository that we cloned is an authorized copy of requested repository and not a copy made illegally somewhere else. So we import Git and specifically class a repo from the Git library which creates that .git file and using other Git Python functionalities, we first fetch that repository and we clone it into the directory. The third module is inserting course into the MongoDB using PyMongo. So PyMongo. PyMongo is a Python distribution containing tools for working with MongoDB. So PyMongo was created to incorporate the functionality of Python as a programming language in MongoDB as a database. So here what we do in each platform, the database is named edxapp which has collection named as model store, model store dot active version, model store dot definition and those all collections have different syntaxes. So the content of the cloned courses has to be passed as an argument to the post function which will store the content of that course into the edxapp database. So it will show that the new course has been created into the IITBX platform of the other server. So here we'll use PyMongo to access the database, pass the course of that course file and as an argument into the module and insert that module into the collection of database. So thus when post request is sent to the API with the course name and directory name where we wanted repository to be cloned, API first clones that course from IITBX GitHub and then insert that course into the MongoDB. Now I'd like to call my friend, Arkam to take the presentation further. My name is Arkam and I'll be discussing about the grade API and how we can secure all the APIs developed so far. So what is grade API? Basically it gets the grades of a student depending upon the query made by the user. So the basic we know that control section it is a user interface and there we have our interface for grades. So from that the API is called. The API is called. The API depending upon the query connects with the platform. So the platform can be a server in Madras or Bombay and the server fetches the grades in the database and then returns the query grades to the API back which returns it to the control section. Major four functionalities developed here are getting grades for all the courses on a platform, getting grades for a particular platform for all courses and for all students, getting grades for all students for a course and getting grades of a particular student. So these are the outputs. So basically this is for all platforms. So here you can see there's like two lists and there's like documents inside that. So the outer list represents the list of all queries made for a platform. So one element of that is a list for a platform and that list is for all courses. So I hope you got that. Like in the second one you can see this is for one platform. So this is the entry which is in the inner list. So if I give the platform, the API knows which IP address to connect. So it connects to that IP address and gets the grades. So the other one is now I give the platform as well as the course ID. So it gets the grades of all the students for that course. And the last one is I also give the student ID. So for a particular student, it gets the grades. Now we have all the APIs here, but the APIs are not secure. You know that the rest APIs are hosted on some server, but now anybody can make call requests and just get the data. So we need to secure the APIs here. So for that, we can use some protocol. So our standard protocol used for this is OR2 with a layer of OpenID Connect. So we tried using key cloak and open source service provider for this. Like we tried many open source service providers, but this is the one like we integrated the most using key cloak. So I'll talk about what first then we'll move on. So I guess the bell has run. So what basically is a protocol where you use some methodology with access tokens to allow authentication as well as authorization. So authentication, you all might be knowing what is authentication. And authorization is like providing some privileges to some web app or application. Like you might have encountered this so and so app wants to access your Google accounts. So this is authorization. You are allowing it some privileges for other app to access your other apps like data. So I hope I could explain this, but there's no more time. So I think this is the flow for authentication and future scope. So what the future scopes are here is that we are like, we made the grade API, but it's not time efficient because the database structure, like if I go in the detail, it's like a tree sort of structure. And we know the object ID for the last layer. So if I come from the root of the tree, I think I have to traverse the whole tree. Each time a query request is made. So I'm traversing a lot of data just for getting a single query or like two, three documents. So it's not time efficient. And second thing is the key clock thing we tried. We tried integrating it with the APIs, but the, yeah. Yeah, you can see the last step. Like we were able to integrate all of the step, but the last step of exchanging the access token, we weren't able to figure it out because the key clock isn't like I already do it in open source, but the documentation is not so good. So we haven't figured out like how to do the exchange token part. We have got the token, but it's not working currently. Yeah, and last thing is the on a particular platform, you have all like many courses. So when you select a platform, there's a Ajax request made to get the courses on that platform. So this Ajax form is currently not secured. One of the reasons being we made the API separately and then integrated with the ITBX platform at the end. So we didn't have any authentication beforehand. So the other thing which can be done is securing those Ajax forms. And thank you. What is the motivation for doing this? Motivation for doing this. Learning. No, no, no, no. Means like why such a disparate system? What? Such a disparate system. They should know their motivation, right? Motivation is not only to get a certificate, I believe. For coming to IIT, but the idea for the project was you are aware of that your distributable IIT Bombay X, whatever activity is being taken up. So the idea is to have multiple IIT Bombay instances all across the country. Maybe something like 500 instances running parallely. Now supposing that we have based on IIT's experience, we have a bunch of courses and every college is running a platform, but those courses are only on IIT Bombay X servers. So how do you share with them? So one option was IIT Bombay X export import. But then you are expecting that people at the various colleges would know a lot of things about the IIT Bombay X platform.  I think this did not come into your... Yeah, because... Central theme. Central theme is very important, right? Bombay server, Madras server. Yeah. So what is that? Those are all IIT Bombay X? Yes. Yes. Okay. But you are not telling them to import, export all of that, but from the control station you are managing the courses. Which courses will go there? Yeah, so supposing CS101 you put on Github repository. So with the help of these APIs you will just be able to import the course just by anybody who is just a user of the platform without having to know Github, without having to know export, import or the commands for creating a course. Independently if they want they can create new courses. Certainly they can. Like local to their college they can. This is just one step ahead which we are going and... Yes, yes. So there was one thing which I saw was creating a platform. What does it mean? That is to add a platform. Supposing that... So you want to spawn a platform? Yes, because by spawning not like installing it, installation is done. But you want to add that as part of this entire program where you would want to share a course with them also, let's say. Somebody is running one... Oh, adding that in the platform. IIT BombEx in Jharsubhuda. Already a platform exists. Independently no problem. But supposing they want to be part of this program and we would like to share courses with them. If we share then we would want to know what the grades are for each of the students. No, now you have one problem here. That is somebody is running on Ficus and somebody else is running on Hawthorne or Ironwood. Yeah, so that will be... First of all it will not be a problem. I think there's another project they have migrated database. No, no, no. Not that, not that. So grade related data because it has been there since the very first version. That has not changed, it will not change because that is the core of the platform. Additionally, new things get added but it doesn't impact this first thing. Secondly, control section will be managed by somebody who is aware of the various IIT BombEx instances running all across the country. So even if there are changes then it is up to the API provider which I will, let's say, IIT BombEx API provider they will have to manage the differences between the various versions. So control section, so IIT, so like for example Madras server, is there a person from the Madras, IIT Madras who will have a user ID on the control section? On the control section. So he can browse, he can push courses here and there. Exactly like how blended MOOC where there were various separate roles, institute coordinator. Similarly, you could have a coordinator, a platform coordinator for Madras who will have a role in the central platform. So how do I get access to the control center? I'll have to contact IIT BombEx. Yeah, so that roles we have not implemented right now but yeah, whoever is managing the program will have to assign roles to the various centers. So if I want to become a center, then I have to contact IIT BombEx offline then get an account and then correct. Correct. So now here GitHub, you are actually exporting the course from one place and then pushing it on to GitHub. Whenever a new course is created, it is like pushed to the GitHub so that if another platform wants to... Oh it is already, so you have just one link. You're not doing every time. Yes sir. You have one link, right? So whenever a course is created, you assume that everything exists on GitHub. No sir. When we create a course, then after creating that course as a repository, we will like push that course into the GitHub. Okay. And if another platform wants to import that course. Yes. No, no, before that I have a problem. That is, we are going to push it to GitHub. So he makes another slight changes. He removes a video. What happens to your system? Sir. How are you handling that? Sir, if ma'am wants to delete a video or like... So she has already created on the... Somewhere in between, she modifies something. Now what do you do? Yeah. So have you handled that? That is what I am asking. Okay. No sir, this scenario is not handled. Whether you have handled... Okay, not handled. Not handled. The assumption again you can say is that... Have you heard... Have you thought... Courses finalized when you put it on? Yeah, have you thought about such problems? Which are very important when you say distributed? Yes sir. I think... Sir, if I want to push it to GitHub again, I can do. So that would... Yes, but what I am saying is when you are ready to distribute the course, that's when you will say that okay, now go ahead and create the course, right? And then that means you have completed the course. It is not... But of course it can be implemented if that is a requirement, but currently it is not. Actually it's a good idea. Because I can see if rather than providing an IIT Bombay X to somebody, we can actually make applications like Web App for particular college or school. They can simply import the courses and give it to there, rather than having IIT Bombay X, means the big system. They can have simply an application where they can browse through the courses. We can provide Windows applications, mobile applications. Is it possible with the system? No, as of now we have assumed all are IIT Bombay X. No, but let us say if data is there in GitHub, it's in some form, textual format, correct? Yes. So video links are there, title information is written there. Yes. So by taking that MongoDB schema, can we create an application which read that and present the course? Certainly. Yes. So if it is possible, so I think that this problem, distributed version of IIT Bombay X, we can think it from a different perspective. Grading is a little problem, but if we work on that, see it's one month work, we can think in that way also.