They told me that I couldn't have a wireless mic up here because apparently they're afraid I'm going to hack it. I don't understand. You know that you're at a very interesting conference. When you walk around and Bluetooth pops up. See, I've got a Bluetooth tool that just pops up everything that it runs into. It's almost like a denial of service sometimes. You know that you're at an interesting conference when you get names like White Witch or... Oh, here's a good one. Nut cheese. And yet I'm still amazed at the sheer numbers of people who forget to turn off their Bluetooth. Ad Defcon. But that's not why you came to hear me today. But I'm giving people a little bit of time to walk in. Hello, my name is Atlas. I like what I do and I do a lot of it. A while back I'm in a subway in DC with a friend of mine. And I forgot to ask his permission so I can't say who it was. But this friend is very well known by most of you. I guarantee it. And he is the cream of the crop in security and in the hacker arena. Well, anyway, this guy is talking to me and he says, Atlas, explain to me how buffer overflows work because I'm just a little fuzzy. I've read a little bit about it, but I just don't have it. And I told him an answer. But I thought to myself, if this guy needs a refresher course on heat buffer overflows, I think I should probably... I thought they were going to provide me music. I said, hey, there's probably a lot of other people out there that don't quite remember how they work or just never knew. And that's cool too. They're actually kind of esoteric. Clicker? No! Great. I kind of love that. Wow, this could be very interesting. There we go. It works again. So this is remedial heat buffer overflows. Basically that means I understand most of you guys are lead enough to have done this before or at least roast the subject before. So this is for you. This is a talk about how to exploit buffer overflow of vulnerability, specifically with a heap and a DL malloc heap structure in place. We don't have a lot of time. Sorry about that. In the man page for the get s function, there is an exceptional note. It says, never use get s because it is impossible to tell without knowing the data in advance how many characters get s will read. Basically, don't use get s because we're in C now. In C, you have to tell it much like assembly. This is how much room I want to give you. And get s just says, starting point. Let's just race. Looking for a zero. And you hope that it's still within your buffer. But if it's not, who cares? You get a little crash. Not a big deal. F get s also has some issues. It is a step up from get s. There's a ton of C functions that give you all sorts of beautiful, scary functionality. But the big ones are string copy, mem copy, the s scan f, or the scan f series or family of functions. One that a lot of people overlook is actually not a function in C at all. It's an assembly thing. In fact, it is the glue that makes all these functions work. And it is the move s assembly op code. Anybody heard that? Yep, a lot of you. So move s takes a parameter or a prefix, says repeat. Hey, repeat this many times. Just move from here to here. That's pretty cool. How many of you are programmers or have written C programs or Python programs or any other language? Thank you. Excellent. Big, a large amount of you.  So if I fall off, please try to leave my badge alone and my wallet. You can take... Okay, no, I'm not going to give you permission either. When you're programming, what do you use to store information? You use a variable, right? There are two types of variables in a C program. There are local variables, and those get stored on the stack. There are also dynamically allocated variables. In other words, I don't know at the time of writing how much data I'm going to need. So we set aside a huge chunk of virtual memory space and allow for a heap. Now a heap is a very low level function, but it is not operating systems specific. We'll get into that in just a second. A heap is dynamically allocated storage at whatever size you need, and it is... It can be very fun to secure. Who's heard of a stack-based buffer overflow before? In fact, who's heard of a buffer overflow at all? Show of hands? Excellent. How many of you know what it means? Thank you. Excellent. Good. These buffer overflows are beautiful. You start at one location, and you meander. You meander. That might need to be right there, so you replace it very nicely for the program so it doesn't crash. Keep going, and you overwrite something of very big value. Oftentimes this is the return pointer for your function. Heap, however, doesn't have the return pointer of the function stored in the heap. So what can I do? Can I take over a computer system using a heap buffer overflow? Well, before we get to that, I'd like to back up and say overflowing a buffer is valuable. Let me hear it, everybody. Overflowing a buffer is valuable. Why is that? Wow. Yes. Can I summarize? Because I don't remember everything you said. It was really good. But basically there are several reasons that buffer overflows are great. You can stop an entire machine, or at least a process, from running denial of service. There are several other ways that you can exploit, not meaning shell code necessarily, but exploit a computer program because of a buffer overflow. First of all, you can overwrite other variables on the heap. Now, for instance, if your program has in it, members of this group stored in this heap variable have administrative access to my tool. And you happen to buffer overflow just before that. Well, you can go, oh, yeah. Hey, that's my group, Atlas Group. Suddenly you have administrative access. You can control things you should have no business controlling. Another interesting one that's often overlooked is the ability to take a string variable, for instance, get rid of that nasty little null at the end that keeps the printf from printing more beyond that point. And instead of overwriting, you can now, with the help of a printf that very likely already exists for you, get access to read whatever comes after your buffer. So we'll call that end of string overwrites. You're overwriting the null at the end of your string. But of course, the crème de la crème, the most exciting, this is going to kill me. Hold on a second. The most exciting thing that we talk about when talking about heap buffer overflows is tinkering with in-band information. In-band management information, to be exact. It's a deliq process, and it's one that's not very well understood. So a little bit more about heap memory in particular, generically speaking. A heap is a chunk of information that is given to a process by the kernel. If the process needs more, it goes back and has a very brute force request to the kernel. Hey, I need more space. Can I have more space, please? And the kernel will say, yeah, here's a couple gig. Okay, maybe a couple mag or whatever. It's up to the program to then decide how to manage that information. How many of you have a bedroom at home? How many of you have a clean bedroom at home? Get out of here. I don't want you in my room. Why is that? Well, because many of us understand whether we're good at it or not. We understand that open space requires management. So DL Malik is an implementation of a heap management system. It was written by a guy named Doug Lee, that's the DL part. Somebody asked me about that earlier. I forget what he said, but it was really funny. Yeah, sorry, sharing my internal jokes. So Doug Lee wrote this heap management system, and he made one mistake, or maybe it was intentional. I'm not beyond guessing that. And in my line of work, I like to think along those lines. I think the people who wrote the stack, I think they were just really evil. Because who else would say, hey, start here and keep writing over the return pointer? Doug Lee and several other heap implementations, they make use of what's called in-band management data. In other words, my chunk is 101 bytes long. Do some math, make it round off so that it's stack aligned and all that beautiful stuff are aligned in some way. At the very beginning, just before what you see when you get a heap variable, the four bytes leading up to your memory space are actually a counter that says, hey, anybody looking at me, the next heap is X number of bytes ahead of me. Okay, so heap buffer overflow. Wait a minute. I want to change that one. We'll get there. In this presentation, I use the words chunk and buffer fairly interchangeably. Understand that when you're talking to somebody who hacks around in a kernel space all the time, which I don't, I spend some time there. I enjoy it, but they will say no.  You're talking about a buffer. But I will use them both. So please don't get lost in that. It worked. So for example, we make a call to malloc. This is the call basically that says, I need this many bytes. And this can be a variable. That's what's so cool about heap. So we're going to say, I want something at least 1024 in size because that's what I'm going to use of it. I don't really care if it's 1048 as long as it doesn't eat up too much memory space. So malloc goes out, says, based on these rules, I'm going to cut a chunk and give you a pointer, four bytes into the chunk because we have our management stuff there. One thing that's important to note is that malloc and its counterpart free are called so frequently that most sanity checking that you'll probably think during this presentation, why don't they just check? Most sanity checking costs too much. If you take something that's iterated thousands of times during the boot of an operating system, for example, and you add a second here, even a half a second over time, Vista doesn't boot very fast. Then again over time Vista doesn't boot very fast anyway. So I guess that doesn't matter, does it? But in the Linux world, we see that not much has been done to correct this. Some stuff has. The important part when dealing with this type of heat buffer overflow exploitation is the function called free. If we fill up a buffer and overwrite the next buffer's management information, the thing that's going to make use of that, however, is a call to free. So you've got two buffers. The second buffer has management information just past your buffer. You overwrite that, you call free and free reads that information and makes decisions based on what you've written there. That slide seems out of place, doesn't it? But I'm going to say it anyway, because back in 2004 Microsoft vulnerability was found in Microsoft core library in the parsing of JPEG files. Do you guys remember the GDI buffer overflow? Do you guys remember that it took third party person to release a tool to even help you figure out if you're vulnerable? Because everything uses this thing. Anyway, he's a good friend of mine, Tom Liston. I had to give him a shout out. So he wrote this tool. He works for Intel Guardians. Good bunch of guys, good friends of mine. The problem with learning heat buffer overflows and the reason that it's not nearly as focused on as stack based buffer overflows is that stack based buffer overflows are fairly consistent between platforms, at least among the same hardware. So you've got BSD, you've got Linux, you've got Windows and Windows and Windows and every other version of Windows. There are several implementations of a Malik system. Doug Lee, I enjoy his very much. RTL is what they call it in Windows. The BSD-PHK implementation, I hate this one. There is no in-band management and I'm having to hack a binary doing this right now. In fact, you guys have been down to CTF, right? After this, I will be running down there because my team is still in a heated struggle for first place and you guys should all come down and check it out. It's really cool. This is what good guys do to go be evil. There are also several other implementations. System 5 has their version. BSD and AIX have some, did I say BDS? That means something completely different. What's most important isn't what happens when we allocate a buffer with the Doug Lee Malik. What's really important is what happens that we never see. You see, after you free a buffer, Doug Lee says they don't need that information anymore. So you know what? I'm going to use some of it. Before, we said this guy right here just before the buffer is going to say how many bytes to the next buffer. When we free it, we're going to use several more chunks of memory to store more information. Because when you write a program, you're using a heap. Your heap chunk, you maintain that. You manage it. You have pointers to it that last throughout your program. But when you return it back, you just say, I don't need that anymore. Doug Lee then has to take care of it. So the Doug Lee Malik sticks these buffers that are unused into a doubly linked list. Anybody know what a doubly linked list is? They were kind of a pain to do back in college, but they come in very handy. So Doug Lee stuck all these suckers back into a doubly linked list. And the particular exploit that we're going to talk about today has to do with this doubly linked list. Specifically, what do you do when you have two buffers that are freed in this doubly linked list? I don't know. Well, you just leave them alone, right? They point to each other. You're cool? Uh-uh. Because on your hard drive, what happens when you've got chunks of data spread all over your hard drive? It gets slower than Vista. Did I say that? Yes.  Malik or heap implementations also have to deal with the same thing, fragmentation. So when you get two free heaps next to each other, the dog-on suckers, they got to be big. So we join them using a tool called Unlink. And Unlink is where the magic lies. So in our example, we have a buffer. Now I could have chosen 100 bytes or 104 bytes and it probably would have been prettier. I chose 101 because it proves a little bit more of how this works. And I don't know about you guys, but when I had to learn this, it wasn't about reading about it. It wasn't about the theory of how it worked because I understood that. But it was about the bits and the bytes and how it actually worked that got me to write the presentation. So if that's cool with you, I want to get into the details. 101 bytes. Malik, deal Malik, then allocates truly 112 bytes. There's a little mathematics to go into there. I wrote a question for my friend G-Mark for Hacker Jeopardy that basically took this to heart, but then I pulled it out later at the request of a friend of mine who says, dude, they're not going to know that. They haven't seen your talk yet. So I pulled it. Anyway, the idea is you call Malik, you say I need 101 bytes. You don't know that Malik needs to know that you need four more or that you don't tell Malik that you need four more than you really need. Malik adds that on. So you've got 105 bytes and then in the interest of alignment and beauty and bliss and even numbers, deal Malik then extends that to the next 8-byte boundary. What's an 8-byte boundary? Well, that's a thing in assembly that... No, no. An 8-byte boundary is, well, 8, 16. It's a multiple of 8. Nothing magic. I had to throw this slide in because a buddy of mine heard that I was giving the talk. He said, dude, you're not going to include Windows? I'm not coming. So here's for you, Lenox. If you came, I know I saw some of your friends, but I didn't see you. Anyway, Windows actually, and I won't spend much time here, Windows has a very similar idea of allocated buffers. You own them. You take care of them. You tend to them. When they are checked in, however, they are checked into an array of doubly linked lists. It's the biggest difference. There's some other details of how they work and I won't get into them. I don't want to confuse you, but I had to throw it in. So we have heap buffer that we've allocated. We've stuck in my first name. Then we have another one that includes my alias, Atlas. And then I say, huh, I don't really want to give out my first name. So I delete the first buffer and it becomes a freed buffer chunk. Melox says, I understand that you don't need this. I'm going to take care of it. I'm going to use the first eight bytes. How many bits is that? Yell it out. 64. 64 bits. I'm going to use the first 64 bits of your memory space. So you've got your memory pointer to the very first byte of what you see. The first four bytes, but the first byte you see.  The buffer in the linked list, it's been deallocated just before it. And the buffer that's been deallocated just after it. Got that? There are a couple other places within your buffer that it will write to. We won't get to that now. I have slides that actually explain that better. So when the memory is allocated, so notice this is used, this is kind of what the memory space looks like. We have a long integer, 32 bits. Then we have 101 charrs, characters. And then we have some padding at the end. Right? Right? And then we have a buffer. This is a bit closer to what you will see when looking at a freed buffer. I tried to find a good way to do this. I chose to do it in a struct type format. I do have something that I stole from Once Upon a Free. You guys heard a frack, right? I'll show that later too. I wanted to take two different approaches. But for those of you who like the struct, here it is for you. So we start out with our long. This is the length of your buffer, including all the rigmarole at the end, the padding and that. It is an even number unless the previous guy is not in use. We will say that many times. Don't worry about it. Just keep it in your head. If it's an even number, the guy before me is not in use. If it's an odd number, the guy before me is in use. So you will look through here. You will see the number 71 or 71 hex. Forgive me. But that doesn't mean that 71 hex later is where the next buffer starts. It really starts at 70 hex later. But that just means that the guy before him is in use. Then we see two longs, the previous guy, the next guy. Then the remainder of your character space. The length, again, of your buffer. I don't know why they did that. I have a feeling it was for performance sake when freeing the guy before you. But anyway, there is another copy of your length without the one. So it's always even. And then the pad size. Everybody's still with me. If you're not, raise your hand.  So as I mentioned, the magic happens in an area called unlink. It's actually a macro. Do you guys understand? Who here understands the difference between a macro and a function? And don't worry if you don't. Okay. In C programming, they allow you to do all sorts of things that help you as a developer think about the program, aside from secure coding. You write a function that you want to call over and over and it becomes something in memory, its own entity in memory that can be called from all sorts of different places. Oh yeah, from up here too. And at the end, there's a return, and hey, that return pointer that we talked about, then sends the instruction pointer back to where it came from. Most of the time, actually, there's some fuzzy stuff there that evil people like Invisigoths from Concerto do that actually don't return where it's supposed to. Anyway, then you have macros. The idea behind a macro is I want this to be exceedingly fast so it's going to be inserted in line wherever I write this. But because I know that I will dork that up. If I do it 25 times, like I'm going to have to. So I write a macro, I put the macro in, the compiler says, oh, it's a macro, and I just want to make sure that that gets replaced before compiling. Also macros are used, yes, I know macros are used for numbers that you don't want to have to call to a variable all the time. It's a performance thing. It's cool. So unlink is a macro, and the basic idea behind unlink is the guy behind me has a forward pointer, and the guy in front of me has a backward pointer. Well, I'm bowing out of this puppy, so the guy in front of me, his back pointer, should really point to this guy over here. And this guy over here, the guy behind me, the forward pointer should point to the guy over here. I didn't say why. Can anyone guess? Why would you use unlink? The use of unlink is actually, it has several uses in the DL Malik. The use that we will be speaking of specifically is the use of joining two adjacent buffers into one larger chunk that can be used for many more things. So you call free. Your buffer is now freed and has all the nifty little management stuff involved. But then unlink or it checks to see, hey, is this previous buffer in use? And it looks at what? It looks at that first four bytes. What's that? Exactly. It looks at that first four bytes just before your buffer. Is it even or odd? So it's even. What would we do? Would we call unlink or not? Yes. I heard the answer. Yes. You call it. Why? Because the one isn't there. It's even. It means zero, which means false. The guy before me is not in use. However, notice that this buffer, the deciding factor of whether or not I call unlink is up to me because I just overflowed the guy before him. Does that make sense? But the devil is in the details. Do pay close attention. Ooh, that really didn't show up very well on the projector. Maybe with a laser pointer, I can highlight it. How's that sound? So an in-use memory buffer, I told you that we'd go over this again. I stole this from Once Upon a Free. Give them credit because they did all this ASCII art. I modified it a little bit so it's adapted. So we've got the chunk. Starts here, previous size, 32 bits long. Of course, if it's even or odd, mean something. I'm sorry. This is before our chunk. I didn't adapt it very well, actually. I should have moved this down. This is a little confusing. I apologize. Here's where our data starts. The first four bytes is the size and that's or, bitwise or, of previous in-use. Then we have our memory. Then we have a next chunk. And again, that should be down lower. This last 32-bit integer, what does it really say? What's it mean? Previous size. Well, that's this up here. I'm sorry. This size right here minus the previous in-use. So we're good. Yuck. An unused memory buffer. Somebody who's been sent for deletion, so to speak, if you're in Detron has also, just before our buffer, we have a previous size. Then we have the size of our buffer. Then our forward link, 32-bit integer, a pointer. We'll see this in real data in a little bit. And a back pointer. Then we see the old memory. And again, we see the previous size. So we've been lost. We got a map. We kind of got an idea where we're going, right? Okay, don't show your hands. Just agree. Good. So when unlink is called, back and forward, as I'll call them. Obviously, it's bick and fid, but they are used to determine what bytes to overwrite in memory. Because in the end, that's what this is all about. It's not about, ooh, let's make this point to some other part of the link list. No, no, no, no. We want to overwrite bytes. Is that not why we're here? Yeah. Why is that? Well, because if I overwrite the right bytes, I can tell the instruction pointer where to go. And yes, that has the same meaning as when I tell you where to go.  Or as a hacker thinks, it goes into my code where it should be. So this happens whether you're collapsing backwards. So you're freeing this buffer and collapsing backwards. Or you're freeing and collapsing forwards. Unlink is called both times. Both ways are exploitable in some operating systems or some implementations. So now we've got two hands. We've got a map. Let's take some real examples here. 804.964. What type of operating system am I talking about? Somebody yell it out. What's very common with an 804? Ed, you know. No? Yeah, sure. You're just being hard. It's Linux. POSIX, Unix. You name it. They probably have an 804 or something in there. 804.964. This is actually Linux. And 804.AOE8. Oh, wait, no. Those don't look right, right? Why don't they look right? Because that's not typically where a heap lives. In fact, in our test program that we will get to in a minute, 804.AOE8 is the address of a got entry. Somebody yell out what got means? Global offset table. Global offset table. Thank you very much. Global offset table. How is it used? For exploits. Yes. Yes, I like this guy. By design, the got table is a place where relocated parts of code that you didn't have to write because they're in a shared library are placed when you start a program. So how many of you have written a program that calls a library? A lot of you. Why? Because it's just so doggone easy. Why do it again? So the loader for an operating system, and in this case Linux, says I need the SSL library. I'm going to load it up here. And because we're a PLT got type thing, we're going to stick the beginning address for this function in the global offset table. Meanwhile, I call some SSL command. Well, let's just say printf. People know printf. So I call printf, and I'm not really calling printf. Not right away. What I'm really doing, my code makes call to the PLT. Who can yell it out? Yeah. Procedure linkage table. Thank you very much. We make a call into this special area at the beginning of our program called the procedure linkage table. It then jumps to wherever your SSL library or your printf function really live. It's really easy. The loader has to just keep track of a small area. And it's called relocation. Beautiful thing. Helps us reuse code. Also a beautiful thing because if we can overwrite four bytes, we have a great place to start. At the bottom, you see an example heap buffer overflow for DL malloc. We start off with hexadecimal representation of an address and memory. Wait a minute. That looks kind of weird, doesn't it? But trust me, this is how it looks like. We are on a least significant bit first operating system. Who came up with that? I don't know. But the idea is, instead of 80496C4, we're going to start out with the C4 first because it's just cooler for some reason. C49604 and not just eight, of course. It's 08. Then we have another address placed here. What do you think these are going to end up being when we hit the free unlink mechanism? Pointers. Forward and backwards pointers, specifically. So we provide forward and backward pointers. D times 92, and I chose D for specific reasons, but basically it could be anything. Then I chose also to use a negative four. The reason is unlink doesn't care. What it cares about is that it is even and it has a couple other checklisty things that negative four is just beautiful for. So I use it twice. I use it here, and then I need a four-byte pad for this particular exploit. So I use pad zero. Hey, it works. And then I put another negative four because just before the next buffer comes what? It's length. And again, unlink doesn't care what it is. So I'm going to use negative four again. Negative four means what? Is negative four odd or even? Okay, not bitwise. Negative four is even. If you drop the negative, it's an even number. You see, you can tell it's an even number because of the C. Can you figure that out? Just kidding. So yes, it's an even number, meaning that my buffer doesn't, it's not allocated. I'll tell you why in a little bit. And then I stick the same two numbers afterwards. What do you think I'm doing? Why am I bothering to do this upfront stuff right here? Well, because I'm trying to make it so that if they free the second buffer, I win. If they free my buffer, I still win. So we have a map. We have two hands. We have a flashlight. So we've just set up memory space to make my buffer, which is in use, look like it's unused, at least for most intents and purposes. And we mentioned the got. And got is so beautiful, and it is read-write. So we like it. There are a few gotchas. Unlink doesn't just do the overwriting that we want it to do. Unlink does two things. It does one direction pointing to a new place, but it also has the real problem of going the other direction as well. So when we unlink where you've placed your shellcode, the eighth byte through the 12th byte are going to get clobbered. Yes, for you, Litas, it's 7 through 11. It's going to get clobbered. Can't help it. Sorry. This is kind of how it works. So we start out with a couple opcodes in our shellcode. If you're shellcoding, you're probably doing opcodes in any way. Except, of course, if you're using that HDMoreGuys tool, who I love. He's really awesome. Metasploit. Because metasploit is just so easy. So we do our MSF payload and dump that to whatever storage facility, a file or whatever. And we then have to precede the payload from metasploit with some of our own bytes. We stick in an EB, which is a jump to a single byte offset. Which is important, because we don't want to throw any zeros into this number. One byte. So we jump 0x... 0xE is the length. Including the opcode, it actually ends up being 0x10. Or 1-0, sorry. We'll see this. I'm trying to explain it now, because in a minute, you're going to see exactly this. We then... Oh, I see it right there. EB0EAAAAAAA We use A's just because they're easy. They also provide decent knobcodes if you have any left over. Notice I'm not just sticking in eight A's here, because eight's really what's going to get clobbered. I wanted to show you a little bit more representatively of what it's going... of the structures involved here. So I used A's. Or three sets of A's. We can do this shorter, but there we are. Now here's where the gotcha comes. And yes, I realize if you want to get up and walk out, that's okay. I'll forgive you. They fixed this in G-Lib C2.5. In fact, I think I've seen it in 2.35. By a very... Somebody very intelligent adjusted the macro so that it says, just before we do this, hey guy to my left, are you pointing at me? Okay, good. Got him all right? Good, we're set. Now we can unlink. I was hoping that by the time we got here, I would have a solution to this problem. Buddy of mine, Chris Eagle, maybe you've heard of him. Rumor has it, Chris has a way around it. We're going to talk after the con. After he's no longer my enemy, and we're friends again, we're going to chat. So I wrote a little vulnerable program. Actually, it's a toy, not just for this presentation. So instead of just the very bare minimum of what we need, I started out and made a five heat buffer program. And I freed them in kind of a funky way. So take a look. Can you guys see this? I'm sorry, this font doesn't show up very well on the projectors here. I'm not hearing any complaining, so I'm going to go on. So hack me.c The typical includes stuff, nothing real special, standard lib, standard IO strings. Then we have a main function. Very simple program, actually. A main function, we set aside five, array of five character pointers to, I'm sorry, yeah, character pointers. Yeah, I know. Yeah, I know. You guys are thinking, wait a minute, a buffer or an array kind of makes it so I don't have to use pointers, right? And pointers mean I don't have to use an array. But actually, we are storing the pointers themselves. So that's why there are five. We also have a loop counter. And we loop zero to five. So zero, one, two, three, four. Okay, no, not five. And we create some heat buffers using the call to calyc, or C-alloc. You've got M-alloc. You've got C-alloc. You've got several others that they all do different things. C-alloc is intended to provide multiple buffers in a row with one call. And it zeroes them out for those of you who really care. Then we do a get-ass into each buffer, starting at four and going down to zero, just to throw in an extra kink. Let us play around a little bit. And then we have two loops here that print out the contents and free our buffers. Notice I'm stepping by two, so I'm doing the even ones first and the odd ones second. Y'all with me still? I wanted to create a tool that could provide more than just a demonstration for this class. For this talk. But you can take home with you, you can play with it and have fun and learn on your own, and not have to rewrite your own program.  They're really annoying. It's like, I just want to do it. So can you give me something? Who read the Ericsson book, Hacking the Art of Exploitation? Excellent book. I love it. In fact, I like it better, and don't get me wrong. I like it better than Shell Coaters Handbook. And don't throw eggs. Shell Coaters is great. Ericsson just really understood how to say, these guys need some examples, they need some hands-on, and they needed a very explicit teaching of what's going on. And he did an exceptional job. The guys who did Shell Coaters are awesome. Some of them are my friends. I'm not picking on them. They write more depth. But Ericsson did awesome with those examples. And I keep turning that off. So hack me details. We compile this down on a Linux system using GCC. This tells you exactly what I did. We get a warning. The get us function is dangerous and should not be used.  So I get a warning. Why would a developer ignore a warning? Then I use obsdump, which is a very cool binary manipulation, a binary analysis tool for elf binaries specifically, but they do Windows too. obsdump, using the R command, gives me the global offset table. I take a look here. It looks like the free function. Its location is stored in 804.964. Notice I didn't say it's going to be loaded at 804.964. Its pointer will be stored there. This is on your CD for Defcon. So don't worry if you can't see all this. I'm going to tell you what you need to see. A clean heap memory allocation of our program, mind you, not just some ethereal thing. Here is the 32-bit integer that marks the beginning of our first buffer. And if you can read it, it says 00000071.  That's our second buffer. How many bytes between this and that? I'll take hex.  Yes, 70 hex. Pop down here a little bit, see the same thing. And a couple more. I only had so much room. So 71 means 70 hex or that with previous in use of one. 70 actually converts. If you pop up K calc, if you're using KDE like I do, it converts to 112. Wow. Everybody over here, look over here. This projector is better. I like it. I can read it. So I wrote this little exploit. Simple piece. It's in what language? Yeah, it's my latest love. Python. Import the OS module, import struct. I put in some shell code. 10 byte shell code. Anybody, is that not slick? Really, it's a lot longer. I chopped it. I create a variable called at. It says, this is where I want to overwrite. Two, this is what I want to change it to. I want to point here. And that's where my shell code ends up. I then create at. Which just converts this from a Python, a Python number into an actual byte. And I do the same thing to two.  The most important part here though is, you'll see I'm writing to one buffer here and another buffer there. That's just fluff. But then I write to the important one. I've selected one to be my buffer overflow. So I start out with an address that doesn't... No, wait a minute here. This is the shell code. Forgive me.  We then do our shell code, and we terminate it with a carriage return. We write the next buffer, and then I just selected the last one to be our buffer overflow. So we start out with... This is an example that you should have on your CD. It only focuses on collapsing. Collapsing in one direction. I've written several. They're all there. Okay, thanks. So we start out with our buffer. We do our number 4, negative 4, negative 4, and then we stick our addresses. Flush it, and we're good. This is what the stack looks like before we free. I'm sorry, the heap. So we filled up one section of heap with hex 4, 5, which is an E. We have our number negative 4. We have our pad 0. This converts pad 0 in ASCII. Negative 4. Our number minus 12. That's because you go one direction. You're going to be offset by 12 bytes because it's not just the start of the next heap that you're talking about. It's an offset from the heap. The pointer to shell code comes next, and right here we're about to clobber that spot, and our shell code starts there. Notice, got entry, 804, 834E. So this is where the... I forget what I grabbed here. Free. This is where free lives in virtual memory space. After free, we still have pointer to shell code. Still have some negative 4s, other stuff. You'll notice this used to be pad 0. It's now an address. The start of our shell code, which jumps over that crud, a couple of knob codes, and our shell code. Next call to free is going to be sent to 804AOE8. And if you look up here, 804AOE0, 8 is halfway through. It's going to point to right there. So I was going to demo it. I'm thankful that I had the slides that show what the demo is going to be, basically. Here's my Python, interactive Python, the hacking tool champions, and Netcat to port 4444. Thank you, HD. I type the ID, or I type ID, and hey, the program ID runs on the other box. Demo. Not going to get to it. Sorry, I got two minutes. I was going to demo.  Here's the bad news. I talked about it already. Somebody very intelligent said, hey, these guys aren't pointing at me. Bomb. Corrupted, double-linked list. So what do we have left? Well, we've already talked about them a bit. Variable modification. End of string termination overwrite. Or be creative. First of all, heat management is a complex thing. There are many aspects to it. We've only started to scratch the surface. There's more out there. Creativity is how we first discovered how to leverage buffer overflows. It's about getting something and then leveraging it. Pen testers. What do you do when you nail a box? You say, woo-hoo, call the client. No, you pivot. You then leverage what you have. A couple resources that don't show up at all. They are on the CD. You should click them from there or print them off. Special thanks to my creator, my family, to Intel Guardians, who are dear friends of mine. Kinshoto for giving me an opportunity to get a start. My last place. Some of my closest friends and my team. Some graffiti. Because graffiti is cool. Bodgering Wraith, Menace, Jewel. Thank you very much, guys. Some of this stuff was stolen. You need to give credit, otherwise it gets sued. Some people actually do know who I am. Thank you very much. You've been a great crowd. I enjoyed it.


Hi everyone, Joe for Jasper's Case Breaks dot com doing our last filler for that immaculate basketball break. This is, well this was, 2020, 2020 Mosaic Hobby Pack Break number 56. I can't find a pack of this anywhere in the shop. So what we're going to do instead is a very similar one. We're going to do two packs of this same year, same brand except Mosaic Hybrid. So two of these packs kind of equals a hobby pack, at least price wise. Anyway, the whole point of this is not really the break anyway, it's we're giving away those immaculate spots. Big thanks to this group for getting into it, I appreciate it, did I grab the right list? I did. And there are the teams right here, let's roll it and randomize names and teams three into three, six the hard way, one, two, three, four, five, and six. And then the other dice roll, the second dice roll will be for the giveaway, pardon. And that video is coming up in a separate video. All right, three into three, six times four, the teams one, two, three, four, five, and six. All right, so there is the first half of the list right there and second half right here. Let's print and rip. Got a nice NBA debut Tyrese Halliburton Kings edition going to Nick. All right, now let's see who's going to win those immaculate spots. Let's flip back to the list again, gather everybody's names from one through 30. And good luck. We're going to randomize that list, five into three, eight times, top 10 after eight. Good luck, one, two, three, four, five, six, seven, and eighth and final time after eight. So from 11 on down, Aaron, sorry, we'll get him next time. But sad times from 11 through 30, but happy times for the top 10. Jose is happy. So is David, Nick, Nick, Nick, Nick, John, Nick, Simon, and Nick. Nick did have a lot of spots on his side with him. There you go, after eight. Thanks everybody. I'll see you in the next video for the break, jaspyscasebreaks.com.


Let's pop in welcome back to another blog if you're new here. My name is Cara Do not forget to like comment and subscribe. So I'm gonna be real with y'all. I'm exhausted from last week I literally was traveling every single day. Well, that's what it felt like. I was traveling so much last week I went to New Orleans first for a day. Then I went to Chicago for a couple hours and then I went to my seat for a day like 17 hours So yeah, I'm just trying to get back into my routine. I'm making my my juice You know just getting back into a routine and I was getting a lot of DMs from Last week and people were like, oh my god How are you doing this? How are you traveling so much because y'all I have hopper and hopper is a free travel app And y'all they have the best and cheapest prices that you'll ever find when it comes to booking a flight Booking a hotel running a car. You name it They have the best and cheapest prices you will ever find and I'm so happy that I have the app on my phone And I'm so happy they are working with me because I genuinely use the app because y'all I'm always traveling back and forth from My hometown because I have an appointment to go to and then these one-day little quick trips that we have in so it's so Convenient for me to have this app because I want the cheapest deal because obviously I'm not Wherever I'm at for a long period of time sometimes and even if I was there for a long period of time I still want the cheapest deal. I can get okay. They have so many good features on their app girl So basically they have a color-coded calendar girl Basically, it's a calendar where it shows you the best days to book your flight Of course, I need the cheapest which is green and another thing that I really love about this app Is that they have watch a trip? So basically if I have a trip in mind that I want to go to I have yet to book it hopper will monitor that trip No, send me notifications when it's the best time to book that trip So basically the app is doing a work for you So you don't have to keep checking your phone on when you know the prices drop and stuff like that hopper literally sends you a Notification so turn your notifications on and it will literally send you the best time to book for that trip Hopper does use price prediction technology So basically it predicts the price of future future prices for travel and they're always 95% accurate girl So they know they know the T. Okay before you even know it basically like I said You'll be notified ASAP when it's the right time to buy Yes, girl This also helps the user save up to 40% off on their trip by notifying them when it's the right time to buy and Winner weight one of the best things that I love about this app is that they have price freeze You know when you're trying to plan a trip with your girls, but you're looking at the prices and you're like Oh my god, like I want to book it, but They haven't told me is we gonna go or we not gonna go But you have seen like the best price that you could possibly get and to be able to get it at that price Sucks when you miss out on a good price girl, I swear. I've been there before They will basically freeze that price that you see that you like they will freeze it But you'll be able to book when it's convenient for you So that's one thing that I love about hopper price freeze because I hate missing out on good deals Also on the app, they do have rewards and which is care cash You know accumulate rewards then you get to redeem your rewards by using it on any of your travel accommodations girl Yes, yes y'all y'all need the hopper app Especially if you love to travel and I know a lot of people are about to travel right now You'll be able to download hopper as well Click the link down below and then when you click the link and download the app and sign up You will get $10 of care cash and that's $10 on me to basically use to any hotel that you first book in the app So girl, I'm giving you $10. Okay, period. That's free money So not miss out. Make sure you click the link down below and download the app So you'll be able to get $10 of care cash rewards on me baby. Yeah, I am about to finish my green juice I have some work to do and I think later on me and Aliyah are gonna go get facials and I can't wait So I just gotta finish up some work and I'll probably check them with y'all once I get them on my work and then Yeah, and y'all are going crazy over this perfume. I just posted. I'm so happy. I told y'all about this, but it's so good It's so good But if you know, you know, make sure you follow me on Instagram, but yeah, I'll probably check them with y'all later Skin is looking good So I got my work done and y'all I was having such a good I was having such a good day But my day got kind of ruined by something but I'm not gonna bring it up because I don't want to bring it up anymore But yeah, I was gonna go get sushi Why does it keep being weird? I was gonna go get sushi, but I'm like, no, I rather just be at home It is it was hot today.  I was gonna make me some I was craving a breakfast sandwich because I've been obsessed with how I make my eggs They're so good It's just basically like I'm it but I'm going crazy over Ebony Woods y'all sold it out Let me show y'all There's two of them on the website. I think there's I think some people are getting travel sizes Basically, I wanted to wait to make the video because obviously I would have told y'all Right away what the fragrance was but I'm like, let me make a tiktok Anything for the content out of stock Y'all this and just smells so sexy like a sexy would Yeah, I'm just waiting for my food to cook And we didn't end up getting facials. We're gonna go tomorrow and y'all I just got a text from Restoration they're delivering my new couch. I have to get a new couch Let me show you up because This was pointed out when we first when I first got the couch, but I'm gonna show y'all I just never showed y'all But as you can see the pillows aren't aligned like this is higher than those two So yeah, I didn't really want that happening Because I think today this is an expensive couch and all those pillows should Align is one because that's how it's supposed to be so Yeah, bro. So they should be delivering that this week and then also my coffee table is on the way and then They're picking up the old one tomorrow Y'all is so many complications with deliveries like it's annoying and then hopefully in a couple weeks of my night See and comes so I can start Finish decorating my bedroom so that can be a vibe in here because I just want my lamps in there and stuff like that because Yeah Hey, Atlanta Hey y'all so I just got ready for bed. I ended up not going anywhere I just made a vegan pizza. It was nasty, but I just made my tea for tonight got my water Glasses going there. This is the end of my root tea y'all But I'm ready to sleep and I don't sleep on those pills. Those are my decorative pills So I keep my pillows that I sleep on Underneath my bed Yeah, girl my bed moves. Yes. Yes Why does it feel like my camera's more zoomed in than normal?   I'm gonna wake up early just in case these people come I got a long day tomorrow. So I really want to wake up early and Girl, I gotta do my closet tomorrow and I gotta do start my laundry so So, yeah, and I also need to add some stuff to my Amazon store I'll do it tomorrow. It was a good productive day. I wish one thing didn't happen Anyway, I'll talk to y'all in the morning And also we got to set up my dispersal machine Yes, that's what I'm gonna do. I'm gonna wake up early so we can set that up Today is Wednesday Warming up my water for some tea. I'm about to drink my green juice right now. I need to start my laundry Hopefully these people called me before 10 o'clock. I was supposed to go get my lashes done today, but Unfortunately, I can't because I don't know what time they're coming and that's so frustrating because Like that's such an inconvenience. I what if I have something planned And y'all not even telling me what time y'all may be or may not be coming actually, no I'm gonna start my laundry and clean up my bedroom But anyway, let's just just get this day started So The delivery service people are okay, so I'm about to go get them So So But yeah, I'm about to get ready for my day I really want to go test drive some cars today But I don't know I might wait into Friday, but I don't know probably But anyway, I'm so mad I could have went to my last appointment. I didn't know there was gonna be this late Normally they come early. I'm gonna go get some lunch with the girls Yeah, it's 1240, so I must happen to shower like I was about to do I did my laundry I did everything that I wanted to do this morning, so I feel accomplished So I need to get out the house though because I was in the house yesterday working And I want to get out the house, but today we're going to get facial So I'm already out the house, but I just want to have a lunch outside today. It's really nice outside What's the degrees? It's 91 degrees today, so I'm gonna put on a cute dress But it's supposed to rain So, yeah, let me get outside before I start raining So because I know a little better be awesome Girl, I don't know what the type of time they be on Maybe I'll crack it energy Anyways, let me go And I'll check in with y'all once I Hey My lashes with the miss anyways, I'll talk to y'all once I get dressed Hey y'all, so I got dressed I put my hair and like one of my Louis Vuitton Bandanas, it's so cute. It's kind of messy and I put like a bow in the back Yeah, I can't really see it right now, but it's cute But anyways, I'm on my way to colonial school where I think it is it's in midtown This is my first time going I always pass it though. It's right across the street from Where's across street from STK? Kinda sort of no Girl, I don't know.  It's called pretty little tacos I heard it's a hit or miss, but we'll see and they have a whole bunch of other places where you can eat is pretty much like a a whole little hall of Restaurants and they got like boba tea. I don't really care for boba tea. I like the tea I just don't like those bubbles in the background. I mean in the bottom. That's just I don't know I don't like that stuff in my mouth Not them balls, baby, but anyway Anyways Yeah, we're going then I gotta go home and get some work done I really should have did the work first, but I'm hungry. I can't I didn't eat all day I drank my tea and then my green juice, so It's like a little messy Anyway So, yeah, it was better when it was in a house. It's starting to droop down more Okay, so this is what they look like I should have asked for I don't know what is the shell made out of But these aren't good.   That's weird. Y'all, I've been looking at this little figure thing And it's like What an eventful little afternoon Yeah, it was cute in there.  Yeah. Yeah, so I just got home and Like I said, Buku blessed me with a coffee machine, but I told him I wanted an espresso So and it makes coffee, espresso, so that okay, and I think this is a milk frother. So We don't see what is given girl. I need to pick me up Me clean in my house literally worn me out I'm sleeping and then the heat but I need to fix this too But anyway Machine is giving I really don't need it. Wait, which one do I have the weird stuff us? Oh Now order me some cute months, but some works to do after make some edits for a brand real quick and then It's only For me three o'clock. I feel like I mean, that's the beauty about getting up early y'all. It's like You elongate your days. You'd like to make the most out of your day getting up early So you have enough time to do stuff Let me know if any of y'all got an espresso and how do you like it and what? Labor's are good for Okay, y'all so it's a little later and As you can see, I got the coffee machine up. I cleaned it Put some water up in there and then this is the milk father. Yeah, why was I on YouTube looking at reviews? But anyways, well, that's normal whatever so I'm about to try to Make one so obviously it comes with this little tester thing Wants to try out, but they didn't send me the good flavors Which the girl I was watching she said vanilla custard pie is good. Yeah, but they just sent me Some basic ones. So I'm gonna try out It really doesn't matter because all coffee tastes the same to me Double espresso. Okay, so she made this with a caramel Latte, I think it is she she just basically make her Starbucks at home with the express on this personal machine And she use this one. So I'm gonna try this one.  Okay, girl. Okay, and this is gonna be iced So I'm about to Does it fit okay, yeah So then you go up like that The machine automatically dispenses the empty cup in the back, which I think is me But yeah, and then all you need to do is just press one button. I pressed it so Yeah, I gotta hold it Wait, I can smell it Maybe cuz brand new it takes a while. That's how she made her ice coffee y'all So clearly is how I'm gonna make sure it stopped dripping ice to it and obviously she just express all because Ice is gonna be added to it and also So now let's froth our milk This milk frother is not staying on top of my thing It's going under and then you hold it twice for ice Make it cold She's done. Oh, this is so much better than what I'd be making. I got this is so much better Than the McCobers that you'll be buying from target Shout out to Boku. Oh, I'm excited. Wow. Mmm. Yes, period But yeah, y'all I'm gonna make this cabinet Like where I keep that stuff so off Amazon. I'm gonna order like a a little drawer to keep The little cups in there, but this was really good and I use this Starbucks creamer pumpkin spice a lot saying Fall time is coming girl So all the fall drinks are in right now I'm gonna clean this and put it under this thing But yeah I'm pretty happy with my little machine. I just don't want this core to show Oh I needed a little pick me up cuz I was kind of spoiled you're I didn't end up taking a nap Um, yeah, so I need to go to Whole Foods and get a couple of things So that's where I'm about to go now, and I'm gonna put my hair back in that little bun thing I'm Whole Foods clothes cuz I kind of want to go to Lululemon first. I Think Whole Foods clothes at ten. So What should we find? Oh, I have so much to do. I need to get up. Let me finish this drink first and then I'm gonna go And I want to do derma plant tonight.  Hold on. Hold on. Hold on.  Yeah, so stop losing your AirPods. But anyway, I need to go. I just wanted to test that out real quick Yeah, so I just made my first Lululemon purchase They're like, oh my god, you're gonna be so hooked and y'all the girls here at the Lululemon No wonder this one was five stars before before I go to places y'all Especially here in a I'll be looking at the stars because I like good at customer service I like people who are gonna help me actually and Stuff like that and be you know helpful Yeah, the people up in there was really really nice. I Got in and out. I got what I wanted. Well, not really. There was this cute pink Top that I wanted was so cute. I wish they would have matching bottoms, but they didn't I end up getting Like this two color Leggings, I'm gonna try it on for y'all once I get home cuz I want to see I'm very curious on how This is gonna fit me anyway, so we'll see This thing is getting on my nerves But yeah, y'all this is a cute little area and this is where upbeat is I'm parked right in there parking lot I've been wanting to try having made Ones over here, but yeah, this is a cute little area. This girl. Let me talk to myself literally right next to me Yeah, but then it's just like what what what am I gonna do like I I can't help me But anyway, I Have to go to Whole Foods really quick And then I gotta get my lashes done Because I want to film two videos tomorrow, so No facials today, but that's all right business first I'm proud of myself.  I'm sorry. I'm gonna have to tell her But yeah I'm happy But this one look more Anyways, y'all I just got my lashes done And I went for a shorter length and yeah, this is not flattering my eyes But anyways, I just got done. It's called to be 1 a.m. And I just got home But I'm gonna show y'all what I got in the mail They're so small I Don't like them tomorrow. They're just a lot to get used to probably I Should have went 17. I went 16 16 What did I do 16 15 14? I Should have this 17 16 14 Anyways Yeah, whatever anyway, so I'm gonna do a little haul Real quick before I go to bed because I need to go to bed cuz I'm trying to wake up early I got some more lay lable. I don't know if y'all seen in the last log. I ran out of that candle So I had to order some more But I ended up getting two other candles and then The fragrance the spray And I'm gonna see how that smells And I'm not gonna try that So good So, yeah, I'm so happy I got this lay lables on top 26 my signature Homestead If you've been to the one hotel, that's what it's my life. The one hotel. That's where And then I got a candle and I'm just gonna set it out right here and then one in the bathroom I'm not in a race in mind. I'm kind of tired They don't really smell good. It's like a Earthy clean sand, but like I said if you stay at the one hotel before that's what that smells like But anyways, so Then I got some more hand soap cuz I ran out The salt hand soap that I use I like it and I like the handball We keep my hands very moisturized And I like that the Hand wash doesn't drive me out One for my bathroom and one for my kitchen perfection Get ready for babe prepare myself for tomorrow. So yeah, I'm gonna talk to y'all tomorrow morning and tomorrow Should be a fun day.  No, it's not Friday. It's Thursday and y'all so I just came from the gym And y'all and I put on my little leg in like blue lemon leggings and Okay, so I feel like I need Tighter fit anyways. So and I also got a shirt that I want to exchange to anyways, but girl So I wore these to the gym this morning and look at this decision already like what? These cost too much for these to be doing this like what is going on? So I posted it on my Instagram story People were like just go exchange them though replace them for free yada yada yada and I need a six in these These are eight, but I want them to be tighter, but these do feel comfortable on but Listen the stitching should not be doing that So yeah, so I'm about to hop in the shower and then I'm gonna head over to Luba limit. It's like 928 They open at 10 so I'm gonna probably do that and then give me something to eat and Then come back home and plan my content And also I need to wash my hair So But anyways, I really need to go there like right I Kind of want to take a bath real quick So I'm gonna do my hair real quick and stuff and then There are should I do it when I get back to just take a quick shower And go So I don't have the rush Cuz I really just want to get there in and out Anyway Let me get myself together and my house smells so good y'all right when I walked in Yo, this last so long Smell so good. Hey y'all. So it's a little later now Went to the store and just asked for them to exchange The ones I got yesterday and also I needed to exchange my top anyways because The top I wanted a little bigger it bit. I just wanted it to fit my whole rest area So anyways, I got some lines and I guess apparently you're not even supposed to work out in these and y'all know I really be doing intense workouts and also I was talking to the girl at the store because y'all they're so nice at that store Um, I go to the one on how will and I was telling her and she was like and I was like Yeah, apparently I guess you're not supposed to work out in them She's like yeah girl, especially like, you know, if you have thighs and stuff like that So I'm like, oh, see I didn't know that see I wasn't I didn't know or anything like that I guess there's considered yoga pants. So it's cool though. I'm gonna just you know, keep these to Lounge in or whatever, but and we'll see how this goes. So I got their lines in a 25 inch Length you little white bra like tank top So, yeah, it's super cute So anyways, it's lunchtime for me. It's about four o'clock And I also need to drop off some clothes to my mom that Doesn't fit me so she can put it in the rummage sale, but I'm getting hungry and I kind of want to make these healthy Sushi rolls with tuna so and the base is the roll is made out of cucumber And I really don't like cucumber y'all But I was like I want to give it a try because I know I'm trying to eat healthy and I really did fall off just a little bit Like around this time. I went to Miami and then I was traveling a lot So I couldn't make it to the gym like consistently the days I wanted to go So I'm really trying to you know Get back on it. I've been making all my food at home. Hence. I just made Breakfast earlier breakfast break. I don't know why I say breakfast Breakfast, but when you say it fast, it's just breakfast Breakfast breakfast breakfast. I'm going to breakfast breakfast Whatever some people just you know people just pronounce things differently I don't know. I don't know breakfast I'm gonna break Break fast, I'm gonna breakfast Anyways, so I'm gonna be Cutting this into a thin into thin slices. And what is this on here? Anyway, we got to wash it off. So Let's see what this is gonna give and y'all I've really been into my tuna recipe is so good Mmm, it's so good but I'm probably gonna try and use the avocado in here and also um a Little bit of this spicy mayo is so good y'all and y'all Like spicy stuff y'all have to try this so I'm gonna put a little bit of this in there, too And then I'm gonna put to use red pepper flakes, too, but I'm not sure I want mine to be spicy Where's my pepper and then she put some ratchet in it and then she used soy sauce To dip it in so I have this stuff And I used to think that I was a well waste my time trying to figure Why are you playing games? What's this all about? But this is how they turned out taste test I'm kind of scared cuz I really don't like cucumber feel like the soy sauce and The tuna will like overpower the flavor Girl, you have to try this. Yeah, this is lit.  Wow So fire you want to come back on here and tell y'all y'all need to try this because Even if you don't like cucumbers girl, I swear to you, you don't even taste it You don't taste it as long as you hook the tuna up with the sriracha the all the spiciness I like spicy food So you won't even taste it But anyway, I just had to come back on here and tell y'all I demolished it and hopefully homegirl can add new lashes to My lashes because I need them extend those And y'all it's really sad out here how many people just want to pray on your downfall like It's sad that I want to show y'all certain things now But I feel like I can't anymore like I just can't like I just I can't do it.  So I really don't feel like using the flat iron So with a certain type of brush you can like um, what is it called? What is it called? What is it called? I'm thinking of the word Manipulate. Yes You can manipulate Your hair and make it a little bit more straighter. So you don't have to Come back and I'm gonna take a bath cuz I've really been wanting to take and I think tomorrow All my all my people is leaving. I did not know James Carter had like a whole weekend Houston I should have I should have went to James Harden weekend y'all if you're going let me know and Yeah, well, yeah, let me go to the beauty supply store so I can get started on my hair because I really What I have time to do my hair my makeup and figure out what I'm gonna wear so I'll check in with y'all later So y'all I just got dressed for my night. I just got all my skims outfit. Oh my god. I'm on one Memory, so let me make this quick so I can do these stuff but I'm on my way To the karaoke thing and I'm first in tonight. I'm think I'm gonna do a lot of cherry That's been on my mind lately. So I'm gonna do a lot of cherry mixed with the ebony woods. I Just got from Zara first Y'all I've been really into C2 I get so many compliments on this Next day and I missed my workout this morning, but that's okay because I'm about to go to stone Mountain I just want to spray. I have to go to Lululemon one more time Because I got to exchange my shirts That I got yesterday, but I have to let you go right now Super cute, and then I just got on this plane at Zara Cammy I don't want to be too hot though But these are comfortable and I'm just gonna put on my easy phones and I cannot wait To get my lashes longer y'all this I this like they don't compliment my eye I don't like it So I tried to do Maybe it's just the style of lashes like cuz these are a double D. Maybe I need to do regular D but and I'm about to put this powder Boost up hydration This is cute I'm gonna try this lime one hydrant a rapid hydrant drink hydrator Got this.  So let's go Okay girls, so we back in the car with air Girl listen. I did not know That motherfucking mountain Was that intense? Okay, so This is what I was thinking. I don't know I was like, okay Like I told you before when she was like, oh, it's like 45 minutes an hour I was like damn like, but I don't know why I didn't bring my shoes I don't know why I didn't wear shoes. So I'm like, okay I'm gonna just go to the top and see what it's about and then I'm gonna just walk to the bottom So I was literally on a verge of walking to the bottom like I was literally where people start coming up the Like almost to the end part So I was like walking down for a good I don't know 15 minutes 15 20 minutes And then um I was looking at all these people huffing and puffing from coming up the hill. I'm like, damn Like I didn't even bring my shoes and then my feet started getting slippery. Y'all this is lady right here She literally is in the bar But anyways, um Yes, sure Um, what was I finna say? Like these people all because People is coming up this hill huffing and puffing my feet getting sweaty. I'm in my forms Girl, I took a pause.  So I'm like, okay. Okay. Okay.  I'm like, oh, I'm gonna take this guy train back I'm just trying to figure out like So next time and then this heat y'all this heat is no joke the sun. No girl So I'm just like, okay, I'm gonna have to come here like early in the morning when the um sun is like not so high in the sky You know when the um, it's a little cooler I definitely want to come back and like get a workout in and start from the bottom And go to the top, but yeah, it's very relaxing though.  What did he say alpha? What did he say off of next Friday? He was like, what the cookies? If you know what I was talking about comment down below I want to go home and just make me some food So I'm just gonna do that because I've really been liking how I make my eggs So I was gonna go to um Where's I'm gonna go actually I kind of want to try to make this um Tomato bread because I like to that's what I'm gonna do. I'm gonna go get some tomatoes this bread and then So yeah, I'm gonna do that and then go home and make an egg with the tomato bread Yeah, we're uh, see you and then my my camera's overheating. So I'll talk to you once I get


Dear students, I welcome you in the course of leadership, emotional intelligence and the CN making. This is module number 201 and we are going to talk about how to help someone develop emotional intelligence. This is very important for us when we are a leader that we have to improve the emotional intelligence of the people who are associated and affiliated with us. And to improve emotional intelligence, remember one thing that the people are having a level of emotional intelligence, but at the same time, we have to understand that their emotional intelligence needs to be improved, developed and they need to have the training to get things done. It is very important to keep in mind that human interaction is a complicated phenomenon and in that human interaction, there can be many emotions of people and other things. Their relationships and matters can be of different types of identity. We have to keep in mind that the current emotional intelligence of people, the current interaction level of them, we should try to improve it. At the same time, remember another very important thing that you cannot change anyone's emotional intelligence till the person is willing to change his emotional intelligence. Because if the person is even able and not willing, it will be very difficult for you to create an emotional intelligence aspect of further improvement or further emotional intelligence. Therefore, remember that emotional intelligence in which we talk about self-awareness, self-control, empathy, motivation, social intelligence as a factor, it is also very important to have the will of people there because until they are not willing to change themselves, to improve and develop themselves, it will not be possible for you to make them emotionally further intelligent. Therefore, remember that when we talk about emotional intelligence, different aspects come before us. In which we will have to see what are the deep-rooted aspects related to emotional intelligence. And what are those deep-rooted aspects related to our future? We should train and develop them so that they can materialize their future vision. And obviously, when they think about materializing their future vision, then they would be able to come up with an idea that they should make their emotional intelligence better. Because it is about making the emotional intelligence better, it is related to people, with their stakeholders, it will be better. Another very important thing that we need to understand is basically that we need to help others to leave their current state, leave their energy and go towards change orientation. And keep in mind that in that change orientation, when they are developing towards the future, then they have to take care of what they are talking about, how to bring their empathy to the future, how to get self-aware, how to get self-control on yourself, how to find motivation in them and create it within others. And obviously, this will be possible only when they use the factor of social intelligence to have a better relationship with others and this is what we count in 4-way wins. Dear students, Remember that emotional intelligence is with everyone, but we need to make it better and better every time. And this will be possible only when we have a relationship with a trainer, with a mentor, so that they can guide us on how we can make ourselves better, emotionally intelligent demonstrators. Thank you.


Ahoy, ahoy and welcome to the channel. I'm Dr. Smerian, not a real doctor. I was holding out on recording today, it's a little bit later than I'd like, hopefully I can get the video out on time, because it's been raining all day. We are going to do dank memes from dank- dank teen. Let's open up the first one. SCP-6Kcon, tree height in meters. Hyperion, the tallest non-fictional sequoia. SCP-6000, nature stance, 300. I assume these are in meters, one would assume. 160 meters for Hyperion, 300 for nature stance, 809 for all creatures great and small, and then 9200 for the demon hector and the dread titania. Yeah, okay. Oh man, these are very, very tall trees, there's no other way to put it. The height of the trees in these SCPs are, well, maybe not for nature stance, but really for nature stance too, it sort of stretches credulity. D-class, when do I get to leave the foundation? That's the neat part, you don't. I mean, see, I don't know about this. I feel like the weird part is in the version of D-class in my head is not even really reflected on the SCP foundation wiki, which in a sense is sort of my fault, because I've written, I very rarely write D-class into my articles and when I have, I haven't really delved too much into what, I mean, because you don't. I haven't really done any tales on them either. Suppose if I wanted to make a D-class that, you know, just works at the foundation, even though they maybe can't leave. Oh, that's a whole thing, because I mean, there's a really good examination people should do on D-class. I mean, oh God, let's not get into too much.  But slave labor exists in the United States right now in the form of prisoners. D-class, no matter which way you want to cut it, are slaves. And I really, really don't like that. And it's something that I don't generally apply in my version of the SCP foundation, especially if they don't get to leave. I know this is basing itself around what the D-class are and what's socially acceptable in talking about them. But when you think about it, this is a really good, really, really good version of just exactly what D-class being slaves is. And that's a whole can of beans, also funny meme. So why did you make that dangerous piece of an ant art? How are we cool yet, remember? You know, I just want to be cool. Foundation, and how would endangering civilians with hostile art ever make you cool?  That is something that has always, always bothered me about how are we cool yet. They just don't make much sense in that they're like, we're all about the art and all about just being cool. Also, here's this art piece that kills people. Art that kills people. It's not good art. I feel like that's a pretty good statement to make. Art that kills people isn't good art. It's just a good stance, you know? Damn it, Bobby. What have I told you about putting redactions in the containment procedures? Makes me angry. Makes me so angry. Wait, is King of the Hill on adult swim? All right, fair enough. I've also noticed in the bandicam, watermark, but that's neither here than there. Register your bandicam. Come on. Damn it, Bobby. King of the Hill. I liked King of the Hill, but when I was growing up, I would have much rather, like the people who made King of the Hill stopped making Beavis and Butthead in order to make King of the Hill. And I really would have preferred to have, I mean, as funny and as good as King of the Hill is, and it is pretty funny and pretty good. I still would have preferred to have more Beavis and Butthead, I think, if you have to choose.  Containment procedures are very important for, you know, keeping yourself and the anomaly and the world sometimes safe.  What is the use of that? That tells me nothing. You might as well have no containment procedures. They call me 007. Zero written articles, zero accounts, and seven ideas about SCPs that I'll probably never write. I feel you. I've just come into possession of a cure for anomalies. They come in capsule form. For best results, they must be taken internally. Here's the handy applicator. Yeah, the GOC's solution for anomalies is kind of, what's the word I'm looking for? Simple and effective. If your only goal is to stop anomalies from existing, if your goal is to understand why they exist, that's a whole other matter, but the GOC is not about understanding. They're just about control. And in some cases, this is the best way to do that. Just ask mid-1940s Soviet Russia. Normal people, normal people is what it says. I change the light bulb, SCP authors. I have single-handedly managed the successful upgrade and deployment of new environmental illumination system with zero cost overruns and zero safety incidents. Yeah, we're guilty of that for sure. Average 001, gate guardian fan. Average of the world's gone beautiful, enjoyer. I guess people are trying to make a point. I've seen a couple of these now at this point that the world's gone beautiful is a lot of people's favorite 001. I'd say mine's still probably Kate McTerris's, which is a pretty simple one, which is just that whatever is put in the 001 slot becomes true, so someone uses it to become God, which I like. Gate guardians kind of, I would say probably one of my least favorites actually. And the world's gone beautiful is I'm pretty sure I've read it, but I'm not 100% sure because if I did read it, it was so forgettable, I don't, I mean, and I know what it's about, but the basic details of it, I just, I don't have a grasp on because I'm pretty sure I did read it. It was just for me, incredibly forgettable. So, you know, wait, I'm confused. Who's the bad guy? It's complicated. It's not. Well, I guess it is complicated. So the SAP Foundation and the Serpent's Hand are neither good nor bad guys. That's sort of the point. See, the Serpent's Hand think they're the good guys. The Foundation think they're the good guys. That's fine, but out of the universe, you should understand that neither are strictly speaking good or bad. The Serpent's Hand's probably better than the Foundation, but they're not the good guys. They're just not. Anderson Robotics, Prometheus Lab. I feel like that should be the other way around. I don't actually feel like either of those are applicable. You could have two Spider-Man's looking at each other. You could have the Spider-Man pointing meme. Anderson Robotics, Prometheus Labs, and who would the other ones be? That's a problem. You only have the two. MCND doesn't really work. Church of the Broken God doesn't quite work. The SCV Foundation doesn't really work. Yeah, no, it's just the two, but I don't think Prometheus Labs as the little brother of Anderson Robotics, which isn't exactly what this meme is portraying, but is a good interpretation of what it's portraying. The Scarlet King and the SCV Foundation. Is this the greatest power in the universe? The authors. Oh man, Loki. My dad, I posted a tweet about this. My dad was watching some clips of Loki on YouTube, and he poked his head in my room and was like, hey, did you know that that new show, Loki, is based on the SCV Foundation? And I was like, there's two, I'm of two minds when somebody says something like that. First of all, no, it's not. The ideas behind the SCV Foundation that it does share, and there's a lot that it does share with the TVA and Loki, exist to cross fiction before, they're common tropes. They don't have to be based on each other to be about roughly the same things. Secret governmental organizations, that's a stretch for the TVA, but secret governmental organizations that rule the world and rule reality is not on the whole unique to the SCV Foundation. But also then I'm like, he's definitely, it's funny that he even knows about the SCV Foundation, to be honest with you. And I don't talk about it a lot like in real life, it's not a thing anyway. Me, when the article that seems short doesn't have a five million word article hidden under a collapsible at the bottom of the page. This is, I love this. It's something that I've understood for a while and kept an eye on. It's such a great strategy because people honest to God, and this is a meme that explains it exactly that, people honest to God, look at the scroll bar or scroll down to the bottom before they start reading just to see like, what am I getting myself into? I've only got five minutes or I only want to spend five minutes on this.  But sometimes they are just short. A Polyon. I think the name of this one on the actual thing was a Polyon is just spicy Keter, which is funny though not entirely accurate. A Polyon and Keter are not quite the same thing. I've been guilty of saying that a Polyon, anytime somebody tells me that the like, I did a containment classes video a while back which covered the three main ones and a couple of secondary ones like neutralized and explained. But I didn't cover a Polyon. So every once in a while there's a comment on that video that says, how come you didn't talk about a Polyon? What does a Polyon mean? A Polyon means you spent too much time thinking about what object class that your object was. That's it. But it does have a meaning and it's different than Keter too or Spicy Keter. Anyway, that's it. Thank you very much for watching. If you enjoyed the video, scroll down and hit the subscribe button and then hit the notification bell next to that so you're notified when I upload new videos. I've been looking at my metrics and trying to follow what is, what does and doesn't help my metrics that being subscriber growth and views or just even watch time. And I think part of it is links. They moved recently, well, not recently, but a while back to make it so you could put mid-credit ads on eight minute videos. And my thinking was I'll just go down to eight minute videos to give people as much content in as short a time as possible. And YouTube won't penalize me for it because, hey, they can still put ads on it. That's their thing. They don't really promote stuff unless they can really make money off of it, which is reasonable. But I feel as though, despite the fact that they've made that change, eight minute videos don't seem to get quite as much traction as the longer stuff tends to just in general. So I'm doing longer videos, I think now. I think that's the solution, I don't, a solution. I think that may help. We will see over time. But anyway, thank you very much for watching. Hit the subscribe button, not asking. Let's just try that again. Hit the subscribe button, I'm not asking. Did that work? You think that worked? I don't know. We'll see. Which one did you like? The first one or the second one? I think there was also one earlier. Doesn't matter. And then if you really want to support the channel, head on over to patreon.com forward slash de-samaritan. Pledge at any level, like everybody here on the screen already has, including Synderiki. It was Pledge at $100. It's nice to know that I'm not alone out here. And I will see you all again on Thursday. Took me a second to remember what day it was gonna be.