Hey folks today we're going to go over the ponable.kr level of collision. So we just did FD so now we're going to look at collision. So collision is a three-point problem. Does that mean it's three times as much more difficult than the FD problem? I have absolutely no idea these actually creating fair point systems for challenges is incredibly difficult so hey who knows. But we'll dive right in. So it says daddy told me something cool about MD5 hash collision today sounds interesting I want to do something like that. So SSH call at ponable.kr port 2222 password guest. So let's go in SSH there normally I'd have to type the guest password in but I have SSH multiplexing turned on here so it's actually nice it'll keep the connection open for me and that's why it was so fast. So when we get here same thing as before on the other one so we have a flag file that we desperately desperately want to access but we cannot access it it is permission denied. And so when we look call.c so we have a c file and we have the call binary which is setuid of call underscore pon which is exactly the user we need to be able to read the flag. So I've already downloaded these so my local machine let's look at call call.c so we have this unsigned long hash code of 21 dd09 ec a function called check password that sounds interesting a main function which takes in an argc and an argv vector and says if argc is less than two then print out the usage is argv zero then passcode so we should be able to verify that this is the case yep so we ran this binary we got usage is equal to dot slash call passcode so we need to pass in a passcode to pass this. Next the next check says if the string length of argv one is not equal to 20 then the passcode length should be 20 bytes so here we know okay we have to pass in something that's 20 bytes long the next thing says call check password on argv one check if that's equal to hash code if it is then output system bin cat flag return zero otherwise print out wrong passcode I hate c code that has this with the dangling clause here always always always use your curly braces all right even if it's only one line all right so we can try this we can just put out 101 and we can see ah passcode length should be 20 bytes so we can do 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 and it's a wrong passcode which makes sense because we just typed in something random but we know we got passed this first check and so it's now calling check password so now let's dive into this check password function so we can see it's a function that takes in a character pointer p returns an unsigned long so what does it do it first casts our character pointer p to an integer pointer so what this means is that it's going to still be pointed to the same memory location but now when you dereference that rather than talking about a single byte which is a character you'll actually be talking about four bytes we have an i a result zero and we're going to loop from i from zero to five i plus plus so we know this will execute five times it will say result plus equals ip bracket i so remember the super important thing to remember about c code is that ip so whenever you have a pointer ip bracket i is exactly the same thing as ip plus i which is pointer arithmetic dereference so these literally the bracket notation is syntactical sugar for this exact thing here so actually i may need to make this smaller okay so that should be good there so what this is doing so it's starting the result as zero and it's adding up and so it's incrementing over so remember we sent 20 bytes it's taking the first four bytes interpreting them as an integer adding that to result and then summing those all up such that the final result has to be equal to the hash code which is hex 21 dd 09 ec so one super easy way to think about this is thinking okay well why not just send all zeros right so we can send if we do something like so a the first thing is we have to remember okay we have to be inputting in here raw bytes so let's do this we're going to reset this we're going to have this be our c code and we will get in here okay so if we execute this program we need to execute raw bytes so one thing is hey this is the number this is our target number so the first thing is how do we get raw bytes into this program i actually love using python to do this so you can use python-c which says hey don't execute a python file but execute the command right here so we can build a one-liner so python-c what is the python program we want to do we want to print out so let's first uh we want x ec x 09 x dd x 21 so this is our target right this is what we want to be in this result variable here so why did i flip these bytes around that has to do with endian-ness so you should go look up the difference between little endian and big endian the idea is when you interpret four bytes which byte of those four bytes is the most significant byte so on little endian systems it's backwards of the way you'd expect it so this is just something you have to deal with and get used to so even though this is what we want in the hash code the string of bytes that we have in memory will have to be this way this is something you just get used to from doing many and many of these challenges so this is what we want if we do this this is not going to work why not well a we didn't input the program correctly but b it's going to tell us that it should be 20 bytes right and we only put in four bytes one two three four so we have to then say okay well let's just append so this is our final value this is what we want to be so why not just append let's say zero zero so we want no bytes times so we already have four we want 20 let's do 16 and so it still says passcode length should be 20 bytes so at this point we have to wonder hmm what's wrong with this nonsense either something's wrong with the challenge or something's wrong with our understanding of how this challenge works so actually for this i think it'd be nice to drop into gdb for gdb i actually use this jeff gdb gf extension which is a nice actually makes it a lot easier so i'm going to set a breakpoint on main and i'm going to run it with this so it's super cool you can use just run like this and now when we get here it's telling me it's it's at main here here's gf so this thing is super cool it's basically nice that it shows you it has where you are in the code so it automatically shows you where you're on the code it automatically shows you where you are in the stack trace the current stack although i frequent i hate that it goes down i always draw my stacks going up um but that may be something i'll fix later and then here it shows us the value inside all the registers so super you know useful stuff here so i'm right in the main function now i can step through this to kind of see about why it's going to um so why it's going to execute so what did just do um it is so when we step through here so it's going to call puts and it's going to say pass with code length should be 20 bytes so let's restart it back here it should show us hey next instruction so right before we got there we compared that and then we're going to do i see so it's um yeah so 14 hex 14 is going to be 20 like that there you go and so it's comparing that value with 20 but what is it comparing edi so if we go xs edi so the problem is if we look at the c code here it's actually compiled our string length check into i believe it's in line compiling that into this ad rep me all this fun stuff here but we can actually look because we know uh be due to the arg the due to the um calling convention the c deco calling convention that main the very first arguments of main will be at ebp so at ebp plus eight is the first argument of main i want this to be wide so we can actually see that okay so the three is interesting i'm not sure why it's three but that's okay oh it checks if it's less than two okay we have three argv vectors that's interesting but let's see so uh that means plus eight so three is our argv pointer here got our argc value this is going to be argc uh this value here is going to be a pointer to an array of pointers of argv so if we do x 20 y the x of oops that's not right of this guy that will give us a list of pointers so this if we're correct um this first one should give us so now what i'm going to do is i'm going to use s and i'm going to tell it interpret these as strings um okay that didn't work so okay so let's do go back here we'll do this so this very first string should be our our the string that we used our argv zero um yeah so this is perfect so this is the path that gdb used to execute this binary awesome so the second value then should be argv interesting ah well it's not a printable string that makes sense uh 20 x so how do we run this at ec and then this problem is this zero nine so this zero nine is not being considered as a so the string length here is going to be just one probably because this zero nine is probably white space if we did man asky we would see that the hex zero nine is a horizontal tab and so that may be what uh actually that's a good question let's see what is the byte sequence of so this is our argv one what's argv two because we didn't think to pass in two arguments it's dd 21 and if we go back to the how we've ran this dd 21 so super interesting stuff here so the zero nine we can't have any white space characters oh you know what we definitely can we'll just have to restart this like this and we'll print out our stack one more time and we'll see now we have two arguments so again it comes back to uh it comes back to single quotes here so the idea is because we had spaces and tabs in there the bashell was interpreting that as wanting to pass multiple arguments to this function but we want to prevent that so we can put everything in double quotes so we do that and then we do uh this is going to be our argv one now we can uh I think we can just print out string length of this we can see that it's d four interesting um xs so now if we do that and we look at it uh let's look at it as oh that's our environment pointer okay it makes sense so right this is argc this is argv so we actually didn't print out argv yet uh 21 s so yeah so this is going to be argv one this will be argv two we look at this and if we did this as a if we print out the string length of this it'll tell us we only have four bytes which is very surprising why because it looks like we printed out 20 200 bytes and so uh what actually happened here let's look at the bytes w 20 x so we can see we have ec09 dd 21 which is perfect that's exactly what we want in there but we have a zero what happened well when we ran this right we tried to add 16 zeros at the end but how does string length and c string c style strings uh indicate that it's the end of the string by using a null byte so in our input string we can't have a null byte because then string length will not think that we have 20 bytes so we have to make sure so this means that our initial thing of what we wanted to do is not uh correct all right let's pause okay so now that we know why we can't pass in zeros now the idea is okay so what do we want to pass in so we know we can get in the ec09 dd 21 so an easy thing to do would be what about 0 1 0 1 0 1 0 1 0 1 right those would be the smallest essentially the uh 0 1 0 1 0 1 0 1 0 1 so these would be the smallest oh these are in base 10 that's why that doesn't make sense okay 0 1 0 1 0 1 0 1 so these are going to be the smallest values here so if we do four of these four sets of four this will be this times four those will be added together for hex 0 4 0 4 0 4 0 4 and then finally the number that we want which is going to be ec uh now which will be 21 dd 0 9 ec so if we take um 21 dd 0 9 ec subtract 0 1 0 1 0 1 0 1 from it we see 20 dc 0 8 e b so now if we on our local copy so now we understood why that one didn't work now we'll say okay let's do it actually doesn't matter first or second or whatever because it's just being added together let's do a x 0 0 x 0 1 let's do 16 bytes of 0 1 followed by this string that we just put in and we remember we got to remember we've got to swap the order so this will be x e b x 0 8 x dc x 20 and ah we get length to be 20 bytes why because we forgot to double quote okay and it's telling us wrong passcode so that is interesting um so let's take this plus uh 0 4 0 4 0 4 0 4 ah that did not work okay why did that not work so so we have 21 dd 0 9 ec let's convert this to base 10 because i kind of don't trust scratch here and we our other number is 0 4 0 4 0 4 0 4 which we don't want there we want there 0 4 0 4 0 4 0 4 in space 16 so base 10 we'll copy this and now let's do everything in base 10 so we will do this number subtracted by this number switch it to base 10 so see we get a different number here so to be completely honest i don't know exactly why this happened but we can roll with it so we'll get here we need to print so the number now is 1 no e 8 we have to go back to front number 0 5 d 9 1 d boom and that's when we get the bin cat flag nosage file directory remember because i'm running this locally so if we take this command pop it on over to the server and which is being slow and i'm going to paste this command so now we're going to execute this we're going to call python we're going to pass that in and hopefully we will pass the hash code check so let's see if this is the case hit enter and we wait wait wait and there we go we get daddy i just mangled managed to create a hash collision so we copy paste that in and of course this is a little bit of a joke so now we can actually see when we go back here that this cool md5 hash collision is actually a bit of a lie that doesn't actually mean anything so it's not an md5 hash collision but it is you could think of it as the they're using a hash they're using addition essentially as a hash so we can do that and it should tell us that yes we are correct it may not do it i don't know i've already solved this so anyways that's it there we go we already authenticated this flag so thanks bye keep on hacking


The beauty is you have stocks like BBPY, GME taking all the attention. So all of the money flow that we talk about in MIC is going to these meme stocks, which makes it very difficult for these other stocks to get attention. Stocks need volume for it to go up. That volume is very difficult because it has to be bought up, right?   It trapped again, went all the way up, so all the attention is going to BBPY, the attention whore right there. So what I'm doing, I'm just picking on the easy target you guys, here I am on small caps sticking to my niche.


What's going on guys welcome back to the channel critical overlord here So this will be my spoiler-free review for the new horror movie coming out this weekend antlers antlers is directed by Scott Cooper based on the quiet boy by Nick and Tosca screenplay is pinned by Henry Chison Nick and Tosca's and Scott Cooper So Scott Cooper has co-written the script as long well as directed it and it stars Carrie Russell Jesse Plemons Jeremy T Thomas Graham Green Scott Hayes Rory Cochran and Amy Madigan now the movie centers around Julia Meadows who is portrayed by Carrie Russell Julia is a school teacher in a small talent small town in Oregon and her brother Paul who was played by Jesse Plemons is the local sheriff She becomes concerned about one of her students a young boy named Lucas Weaver who is portrayed brilliantly I'll add by Jeremy T. Thomas who is secretly keeping a supernatural creature inside his house Now this movie in a lot of ways can be very satisfying As you're watching it progress and then it can get very frustrating I'll say up towards that final act where it kind of goes off the rails a bit But overall I was still thoroughly surprised by this movie I could argue that maybe it's taking itself a little bit too serious since this is kind of a Movie format that we are not really new to as an audience for a lot of horror fans. Anyway Maybe you'll find that this movie is taking itself a little bit too serious because of the way It is presenting something you have probably already seen before I know a lot of you have probably played the video game until dawn as well since this is based on the windigo Folk tale and incorporates the windigo into the story but the writing as far as like the characters of Julia Meadows and The young boy Lucas who is at the center of this of this narrative Their dynamic the whole movie is really what makes is what makes and makes the heart of the film and gets your attention Very early on Lucas is clearly a very malnourished child. He doesn't have the best Resources at home. He doesn't have a lot of love going on right now in his life He just seems to be very neglected and that's another thing that the film is touching on is touching on a lot of very intense and major themes like child neglect child abuse Trauma also in words of Jamie Lee Curtis So like Julia has her own trauma that relates to her Childhood as well. That's actually why she ended up leaving this town that she's now returning to something related to trauma At her home when she was a kid related to her father. Her brother also endured something too The movie doesn't really flesh that out enough I wish they would have fleshed that out a little bit more to kind of try to drive home Why she's so concerned with what's happening with Lucas other than of course just being a very good teacher I'll add but you know other than that a lot of the characters can seem to be not fully Developed at times, but you learn enough about them There's a there's enough things that you find out going on in their life and enough things you find out They've endured for use the viewer to grow attached to them and want to root for them and want to see them succeed in the end now I would I have to add that the scenery the way this town looks ran through. It looks very torn down It also just looks very depressing I would say the way it looks enhances the obvious sad nature of Lucas and his Current outlook on life seen as how everything around him just seems to be crumbling down in His life and now in the towns That the exterior around him the scenery kind of matches all of these emotions that he has shown to people Feeling throughout the film and and the runtime of this movie as it progresses the creature design Probably one of the best things that I've ever seen on screen. I love how Scott Cooper understands the mentality of less is more because while you will want to see more of this creature design of what this Windigo looks like they keep it shrouded in darkness. They use the the use of darkness along with or dark settings with the Red lighting always a good combo in the horror genre specifically That always just comes across very well on screen especially when you're trying to build suspense Which this movie does so so tremendously it builds up the tension. It relies on body horror It relies on just you as the viewer increasingly becoming more Unnerved by every new detail you're finding out as it relates to what Lucas is dealing with at home What is actually going on upstairs in his attic because that's where he's keeping this creature and you know, it's just very horrifically heartbreaking at times to watch as well as it relates to Julia who is his teacher trying to help her student and there's probably not much she can do when it relates to Helping him because of some of the things that you're not supposed to do as a teacher and a student situation I guess but you know, she she breaks some of the rules to help to help her student and This movie honestly, it just blew blew me away when I say it blew me away Not to say this the best thing I've ever watched or anything like that if I had to rate it out of 10 I would give it a seven and a half It's just the way everything is executed and the concept of relying on building up tension keeping things very atmospheric also the use of the fog and Again, just showing off the the wilderness around you creating this claustrophobic feel feeling while you're watching You are literally teleported into this world and these feelings that a lot of the characters are feeling throughout this movie which is that feeling of desperation for Someone to help you it's your you're almost crying out for help right along with Lucas I would say just because of how well Depicted everything is on screen and how it's executed the performances are also I would say very very well done Carrie Russell is very convincing as this teacher who was concerned about her clearly malnourished child who is showing signs of abuse to her and Jeremy Thomas he is amazing as Lucas one of the better child performances. I've seen all year He knocks out of the park. He's very convincing very makes it very easy for you to grow attached and feel sympathy for the character Lucas Because no child should be going through what his he's being depicted to be dealing with at home I would say that the themes don't really necessarily mesh all that well when it relates to them trying to tie it in with the wind to go folk folk tale that it has using in narrative the themes are Horror is a good genre to explore themes like this But I don't think the two are really meshing that well here, but they're still exploring the very horrifically pleasing Pleasing manner I would just add the score is also very bone-chilling There's a lot of the moments where when you have glimpses of the wind to go The score by Javier Navarad. It looks like his name is it just since it'll send chills down your spot It'll make you very curious Just to want to see more of this monster as well But again, they understand the concept of less is more which always works amazingly There's just one intense sequence of body horror up in Lucas is an attic that completely had me just blue to the screen Again, I would have to give this movie a seven and a half out of ten If you guys haven't already of course me she subscribed turn on post location in this video in the description I have links my social media accounts my Facebook Twitter and Instagram you can message me there Of course, there's any movies news or reviews I'm gonna cover in the future with all that in mind guys I will see you in the next video


Next question is from folvio castle. What's the best way to attract someone into fitness when they seemingly don't care? Oh gosh boy, that's a be the example. Yeah No, it really is it's like it's like talking to somebody that is like a Bible thumper, right?  It's always rejected the same thing goes with fitness man Like if you are trying to tell them all the things they're doing wrong or even all the things that you can do I know a lot of people come from a good place Like this question always stems from somebody who has a partner or a mother or a father Who is frustrating right who they care about and I I totally understand this because the first half of my career I was asking the same question like man. I want to I want to save my family, you know Just like I think some of the Bible thumber people are thinking too. I think they come from a good place I don't think they're trying to seem self-righteous, but it comes off self-righteous And so do you when you try and push people on fitness and the best way to do it is to exude it Is to be the person who lives the brain? It's not a guarantee. It's only it's a successful way Yeah, exactly. It's not a guarantee even then it's just but it is the only way that I think it's going to catch Yeah, I've done that because I was like you I would just try and force it on everybody and I'd go in my parents house And clean out the cabinets piss them off and never worked and then I just stopped and you just kind of do your thing And then what you find is and it doesn't work on everybody So again, it's not a guarantee. It's just it's just if it's gonna work this the only way You'll get people ask you like man. You got so much energy or man You look really good like what can you you know, can I do something to help me? You know my shoulders more developed or to build my back better or you know, I got pain here Can you show me some exercises now? They're receptive and you can kind of help them out The other thing too is if it's a partner You know make it something that has to do with connecting over the with the two of you and it doesn't and don't make it structured Workouts is a mistake like hey, honey. Let's go spend some time together. Follow my workout.  Yeah Yeah, and then you're active as a side effect of kind of something that they enjoy and then they'll start to Maybe find more enjoyment out of doing it But you are not gonna force somebody to do something that they don't want to do if anything You'll actually prolong the time it takes for them to try and do it so true. It's a hundred percent Yeah, you just have you have to wait though. You have to wait for them to come to you It's like it's like sales until people listen sales like you can push somebody into a sale And then they're gonna have buyers remorse and they're probably want to return it afterwards But if you can pull them into a sale make them feel like they're asking for or they want it It's a total different experience for them. The same thing goes when you're trying to sell them on the idea of Working out being fit and eating healthy It's like the best thing to do is to to beat to live it by example Allow them to see how it carries over into your life and how it makes you such a better person without you having to say Anything and then eventually they ask not all like you said But if you want it to stick and it to really change their life the best way to do it is through your own yep Hey, if you enjoyed that clip You can find the full episode here or you can find other clips over here and be sure to subscribe


Feminism's been off for a long time.  What a percent evil because what it does is turn women away from men In return turning them away from God It made women think that they are smarter and better and they have to convince themselves all the time that they're stronger Which is not true. There's no such thing as a strong woman It's just they're weak men Feminism, I They're educated now and I've said to men over and over again If you want to have a family do not marry an educated woman Because an educated woman would not make for a good wife and a good mother She want to be in competition with the man She would try to make the husband become the wife before she would stay home and raise and raise her own children To right so what now she probably a slut to right all the way Yeah, absolutely and no one want to marry a slut to be your wife and a mother of your children And so it's a bad idea and it would change if men were to overcome the father state they could bring women back to the proper state of being and And there are men who are waking up. I hear from men around the world now Yeah, we give it to mothers who return it to their fathers and they're starting to Become right and do right and that's where the change gonna happen


Hey, what's up coach? Welcome back to the show in today's episode. I'm gonna be answering a question this is from one of the coaches inside of my consulting program and He messaged me earlier. He said hey, I'm starting the process of organizing my email list on Kajabi if you don't know what Kajabi is you can go get a free trial of that on my website That's the email marketing service website landing page service that I use And a lot of coaches that we help end up using that because it is a very simple platform to use To send out and structure all of your email marketing And he said I'm getting all of that set up I'm starting to write some of the emails So this guy is is clearly taking action, which is awesome because I know that's going to help his business grow and His question was how often should I email my list? throughout the month and My answer to this is very simple Because a lot of coaches what they do is when they think about having an email newsletter, they're like, all right, well, you know I'm gonna do this a lot throughout the month and they don't set a clear target. So Anytime you don't have a clear target Right, there's nothing to aim at so you don't know what you're gonna do. You're just gonna randomly do things and I Created a video and I shot it back to this coach Instead of our our members area and I told him I said look at the beginning I want you to only focus on doing one email per week and Pick a set day set time that that email was going out And what I want you to do is I want you to spend one day out of the month and have all of your content done So you write all of the emails. They're finished You load them up in kajabi. You've scheduled them to go out. So they go out without you having to think about it And just do that once per month have one day where you do the work You schedule it to go out do that once per month over the next three months All right, so for 12 weeks, he's gonna have one email that goes out Per week and then what we're gonna do is we're gonna look at the stats and we're gonna see all right What which emails worked really good? Which emails didn't work at all We're gonna look at what he was actually saying in his emails and we're gonna look at the data How many people click through how many people responded to his emails and look at the data And then from there after 12 weeks, we're gonna push it to twice a week And then we're probably gonna do that for a couple months and then again go back and look at the data And then we're probably gonna ramp it up to three times a week and coaches who are intentional with how they spend their time marketing are always going to draw in really like awesome clients that Want to read your newsletter. They want to share your newsletter They are looking forward to your newsletter and not everyone's gonna want to read your newsletter all the time But if you are consistent with that, that is going to be your best asset in your business It's way more important than your social media following Um, because you actually own the information And you know instagram could wipe out your account tomorrow facebook could delete your account tomorrow If they can do it to trump trust me, they can do it to you too All right, so this why having the email list is important But knowing how to use it at the beginning. I think it's very key and just set a very crystal clear goal for yourself of doing it once per week Do that for three months like do that before you try to to write more newsletters Um, and I can think of right now the top five coaches that i'm hoping All right Five coaches here in the u.s. Actually one is in uh in australia So there's four in the u.s. One is in australia. I'm helping him privately this business They write there's there's between three and five newsletters that go out for their businesses each every week And why well, it's because they recognize this is how I can get more offers in front of my audience They're gonna sit down. They're gonna read this newsletter And I'm going to pepper them every single week with more newsletters and it's not just selling Right, it's not just selling in the newsletter.  See you later