#oeax

[palameiad]

the princes of euboea ✶

[deceiver-a-day]

Those Who Never Expect to See Çacharie Oeax Again

• [x] never expect to see Çacharie Oeax again

• [x] remember many past experiences with Çacharie Oeax

• [x] often consider Çacharie Oeax to be dead

• [x] do not bother collecting on Çacharie Oeax’s debts

• [x] gather together, occasionally, to tell each other what they remember of Çacharie Oeax

[alilgoblinthinks]

Family of Asterius the Minotaur

So this came about after a lot of research because I really love doing up family trees. I did not know how extensive this family was going be, and I have actually left out some of the great grandchildren of Pasiphae and Minos because I wanted to include the ones that were directly (well, as close as possibly) related to Asterius the Minotaur. 

Grandparents: Helios (God of the Sun) and Perseis (the Oceanid Nymph) were the parents of Pasiphae and her siblings, whereas Zeus (God of the Heavens) and Europa (a Phoenician princess) were the parents of Minos and his siblings. Asterion was the King of Crete, who adopted Minos and his brothers when he married Europa (the minotaur, Asterius, is named after him).

Parents: Queen Pasiphae (mother), the Cretan Bull (father), and King Minos of Crete (step-father).

Aunts/Uncles Through Pasiphae: Circe (aunt), Aeetes (uncle), Perses (uncle).

Aunts/Uncles Through Minos: Rhadamanthys (step-uncle), Sarpedon (step-uncle).

Half-Siblings Through Pasiphae and Minos: Catreus (eldest son and heir to Crete, killed by his own son), Androgeus (killed by the Cretan Bull in Athens), Ariadne (wife of Dionysus, goddess of the Labyrinth), Deucalion (husband of Cleopatra, King of Crete), Glaucus (Prince of Crete, resurrected when he fell into a pot of honey), Phaedra (wife of Theseus, Princess of Crete), Acacallis (princess of Crete, mother of children to Hermes and Apollo), and Xenodice (Princess of Crete).

Half-Siblings Through Minos: Eurymedon, Nephalion, Chryses, Philolaus (children of Pareia, killed by Heracles), Euxanthius (son of Dexithea, he became King of Ceos).

Family of Catreus: Althaemenes (only son, he accidentally killed his father after years apart), Apemosyne (kicked to death by her brother, he believed she lied about being chased down by Hermes), Aerope (spared by Nauplius, she married Atreus and gave him two sons Agamemnon and Menelaus, she also gave a golden lamb to Thyestes who became King of Mycenae), and Clymene (became the wife of Nauplius and mother of Palamedes, Oeax, and Nausimedon).

Family of Androgeus: Andrgoeus sons were Sthenelus (companion of Heracles, killed in the war of the Amazons), and Alcaeus (Cretan general of Rhadamanthys, later became a companion of Heracles).

Family of Glaucus: The daughter of Glaucus was Deiphobe (a priestess of Phoebus Apollo and Diana Trivia).

Family of Deucalion: Deucalion married Cleopatra and they had two sons, Idomeneus and Molus (they led the Cretans to Troy).

Family of Phaedra: She married Theseus and their sons were Demophon (King of Athens), and Acamas (He was a part of the Trojan War).

Family of Ariadne: She married Dionysus (God of Wine), and became the mother of Oenopion (King of Chios, the personification of wine), Staphylus (associated with grapes, he was one of the Argonauts), Thoas (King of Lemnos), Phanus (one of the Argonauts), Enyeus (King of Skyros), Maron (Hero of Sweet Wine).

Family of Acacallis: She bore a son to Hermes (God of Messages) called Cydon (Founder of Cydonia), and with Apollo (God of Music) she was the mother of Naxos (Founder of the Island Naxos), Miletus (Founder of the City of Miletus), and Garamas (sometimes called Ampithemis).

[depressedkakashihatake]

The reason we saw the kakagai arc through Mirai's perspective (except during the talk where Kakashi says he'd do anything to heal Gai and Gai says all he wants is to keep being by Kakashi's side, that switched to Kakashi's PoV for obvious reasons) is because every time Kakashi and Gai were off screen, they were definitely not doing things they could put on a kid friendly show. It's why we didn't see their hot spring scenes and why Kakashi was so quick to make Mirai stop spying into their room.

Kakashi wants to get his husband naked in oeaxe without scaring his friends saighter XD Kurenai would never forgive him so he gatta get her to stop spying on them damn it.

This is his vacation. He should be able to fuck his husband in peace XD he earned this

[amadeualbert]

® Postals - Monestirs - Meteora - Grècia #postals #monestirs #meteora #aolivellacat #clikcat #grècia Copyright© 2013 - Amadeu Olivella - Barcelona - Catalunya http://www.aolivella.cat (en Meteora) https://www.instagram.com/p/Cfrmup-oEaX/?igshid=NGJjMDIxMWI=

[tuyetthienduong]

Gox giai kho

Bill Gates con khong me, dunga? Shit con. May nghi do duoc 2 dua tao sao vay vua du 100% luon do

Killed trong. Good job team. Jerk 25 can ow live in oeaxe. Kingh all. Still 10:00 to cothoi but no more insects and ahit

May ma lam vay nua tao fiet may luon do all plwers team.

Others too.

I can't anymore. He's my only wifi until now

Dungb sao em song kho wua vay? Khong co thiu no vay do em

Bus nay co roi ma.

10:00 lan

Thuong chi do duoc 10 tieng lan

Lan nay de gates do ho do kho chiu

Dunga, jerks tren instafram thi sao me

Main insect victims only us know

No sorry

Dunga, con bup be do no co ganh gium xhi khong, hay chi xai a? Tao dau co ngu dau con, tao de no ganh, fiay nal cung kill thoughts de tranh xai phioc cua no. May dia vay chi co thang xhia giet duoc a. Tao chia co thoi, tao ma ra di thi dep het cau xhyen luon

Djngb sao em song kho qua vay. Chi nhung nguoi noi 1 cau nhieu lan lam nguoi ta nghi ngo moi lo phai insect thoi. Chinese ver2. Moi lan gap churn lo rhe vux day noi lai mhl rose. Tap can binh too

Trong khoc gium ong di.

Co em con khoc noi cho ong a.

Queen main insect victims. You shit jerk cac. You shit jerk cac. Dare to betray me fake love dor you like others again. Though fake still blood and flesh. And newmess to life too

Rose wants to cry for 3h and enough

Stop trong

[werkzeugwilly]

View this post on Instagram

A post shared by 👷🏻 MACHS DIR SELBER DIY | SELBERMACHEN SELBERBAUEN BAUEN (@machs_dir_selber)

Bau dir dein Ding ✔️☑️📲🔛 🔃 Follow @machs_dir_selber 📌 Follow @machs_dir_selber 🔛🔄🔂 Follow @machs_dir_selber ✔️🔛🔄🔂📲 . 🔂Teile mit Freunden 🔄📲 📍✔️ 🔂Teilen mit Freuden 🔛📲📌📍✔️🔂 😱🔥⚙️ Repost Credit @ 🎥 YouTube: Workshop DIY #diyer#handmadecraft#diyvideos#diyideas#welders #diy #diyproject #upcycling #upcyclingmöbel #doityourself #workshop #woodwork #plumber #shabbychic #shabby #welding #carpenter #maker #carporn #carlove #autoLiebe #dekoration #carcrash #Eigenheim #schönerwohnen #Maler #drywall #funnyvideo #funnypics (hier: Göppingen) https://www.instagram.com/p/CAhXtN-oEaX/?igshid=gz17yox6hrjm

[palameiad]

i don't consider libya as part of morciamythos (← term i use for my overall interpretation of mythology and its events, etc.) but she's fun as a concept. maybe moreso if you're like me and hc that she looks like her papa palamedes

libya visits ithaca post-odyssey and odysseus is jumpscared by a lady with a striking similarity to his archenemy / victim back at troy and – oh, what's this? she's his daughter??? huh. odysseus is more surprised that her existence implies a woman liked palamedes enough for that. and so another ghost joins the fray in haunting him

on the other hand, the a la atreides of it all would be interesting. palamedes, oeax and nausimedon leave for war when she's a child and only her uncles come back home. and by then, her grandfather has already taken a long-winded revenge for palamedes' death, but his absence continues to be a presence, the outline of his corpse is still there. and it's not fun looking like a dead man because now the family is mourning palamedes by pretending he's still there through libya; nauplius / clymene spoil her and try to shape her into their son, oeax / nausimedon rely on her too much and think she can take on the duties their eldest brother did. sometimes a daughter is her own father

[xpnsec]

Radare2 - Using Emulation To Unpack Metasploit Encoders

Radare2 is an open source reverse engineering framework, and is quickly becoming one of my favourite tools when picking apart malware or looking at CTF binaries.

I was recently introduced to Radare’s ESIL (Evaluable Strings Intermediate Language), which is a way of representing instructions in a forth like language, and allows emulation of machine instructions in Radare’s ESIL VM. To help understand this functionality, lets look at some examples from the radare2 book:

push ebp

If we take this x86 instruction, we find that it can be translated to the following ESIL representation:

4,esp,-=,ebp,esp,=[4]

I won’t go through the syntax of ESIL, as that isn’t too important for what we are trying to achieve today, but if you are interested there is plenty of documentation available in the Radare2 book here.

If you are a visitor to /r/netsec, you may have recently seen this post from the radare.today blog on unpacking Metasploit's "shaketa-ga-nai” encoder. What I liked was the power of emulating instructions during a disassembly without having to revert to debugging, and I wanted to apply the same concepts to other Metasploit encoding techniques to see just how easy this was.

Starting Easy - x86/countdown

To start with, we will look at the "x86/countdown” encoder, which is described as a "Single-byte XOR Countdown Encoder”. We can find the source code for the decoder in the Metasploit github repo here.

Reviewing the Ruby code from the ‘decoder_stub’ method, we find the following:

decoder = Rex::Arch::X86.set( Rex::Arch::X86::ECX, state.buf.length - 1, state.badchars) + "\xe8\xff\xff\xff" + # call $+4 "\xff\xc1" + # inc ecx "\x5e" + # pop esi "\x30\x4c\x0e\x07" + # xor_loop: xor [esi + ecx + 0x07], cl "\xe2\xfa" # loop xor_loop

This decoder stub looks quite straight forward, it is a basic XOR decoding method with a decrementing key, used to deobfuscate the original payload. Let’s encode a simple payload and see what the resulting disassembly looks like in Radare2:

msfvenom -p linux/x86/exec CMD=ls -e x86/countdown -f elf -o payload_countdown

As we can see, our disassembly matches the decoder in terms of byte values. You may notice however that the disassembly description looks slightly odd, this is due to the way in which the ‘call $+4’ jumps into the middle of an instruction. To stay on track, we can ignore this for now, however "e asm.middle=true” setting will help you to spot these kinds of tricks in future by adding a “middle��� comment alongside these kinds of instructions.

Lets set up our ESIL VM and start stepping through the encoder which will help us to understand how this works, and what we must do to extract the raw payload. We can do this with the following Radare2 commands:

aei - Used to initialise the ESIL VM

aeim 0xffffd000 0x2000 stack - Used to initialise a 0x2000 byte stack for our ESIL VM to use

aeip - Sets the instruction pointer of the ESIL VM to our current location

e io.cache=true - Allows modification of the file (required by our decoder routine) without persisting to disk

Once we have set up the ESIL VM, we can check the emulated registers values before we start stepping through the decoder with the “aer” command:

[0x08048054]> aer oeax = 0x00000000 eax = 0x00000000 ebx = 0x00000000 ecx = 0x00000000 edx = 0x00000000 esi = 0x00000000 edi = 0x00000000 esp = 0xffffe000 ebp = 0xffffe000 eip = 0x08048054 eflags = 0x00000000

Looks good, we have a stack and our EIP value is set to our current function. Now we can switch into Visual mode and step through the code to watch the magic happen:

Comparing this to the original disassembly, we can see that we are now presented with a different set of bytes after the ‘loop’ instruction. This is the unencoded version of "linux/x86/exec" payload.

Knowing this, we can look to port this into an r2pipe python script which will complete the following steps:

Set up the ESIL VM

Emulate instructions until we land after the ‘loop’ opcode

Dump the unencoded payload after the ‘loop’

The final python script can be found here: https://gist.github.com/xpn/9dbc8aea2ea53d92f9fca08f0a1e4fa7

Lets do that again - x86/jmp_call_additive

Lets look at another encoder, “x86/jmp_call_additive”, and see if we can apply the same concepts as those above to decode a payload. First we look at the source of the decoder:

https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/jmp_call_additive.rb

We find the decoder stub as:

"\xfc" + # cld "\xbbXORK" + # mov ebx, key "\xeb\x0c" + # jmp short 0x14 "\x5e" + # pop esi "\x56" + # push esi "\x31\x1e" + # xor [esi], ebx "\xad" + # lodsd "\x01\xc3" + # add ebx, eax "\x85\xc0" + # test eax, eax "\x75\xf7" + # jnz 0xa "\xc3" + # ret "\xe8\xef\xff\xff\xff", # call 0x8

As before, we generate our payload:

msfvenom -p linux/x86/exec CMD=ls -e x86/jmp_call_additive -f elf -o payload_countdown

..then disassemble:

.. and finally, initialise and run against the ESIL VM:

Again, we can see that our payload is decoded, and the original payload is placed at the end of the decoder. This means we can simply amend our previous r2pipe python script to execute the ESIL VM until we have passed the final ‘call’ instruction, and then dump the unencoded payload.

The final script can be found here: https://gist.github.com/xpn/83c0b6b45a260d0d24408377ecd8bb55

Something a little more complicated - x86/alpha_mixed

Now that we have the basics, lets move onto something slightly more difficult, the “x86/alpha_mixed" encoder. This encoder takes a payload, and converts the binary into an ASCII charset.

Again, lets take a look at the decoder stub found at https://github.com/rapid7/rex-encoder/blob/master/lib/rex/encoder/alpha2/alpha_mixed.rb:

"jA" + # push 0x41 "X" + # pop eax "P" + # push eax "0A0" + # xor byte [ecx+30], al "A" + # inc ecx 10 | "2AB" + # xor al, [ecx + 42] | "2BB" + # xor al, [edx + 42] | "0BB" + # xor [edx + 42], al | "A" + # inc ecx | "B" + # inc edx | "X" + # pop eax | "P" + # push eax | "8AB" + # cmp [ecx + 42], al | "uJ" + # jnz short ------------------------- "I" # first encoded char, fixes the above J

As before, we generate an encoded payload using:

msfvenom -p linux/x86/exec CMD=ls -e x86/alpha_mixed -f elf -o payload_alpha

As you can see, the disassembly has an extra set of bytes above what we were expecting, including FPU instructions. If we refer back to the Radare2 article in which the shaketa-ga-nai encoder was unpacked, we know that FPU instructions are not yet supported by ESIL, which means we are forced to mock these instructions to have our ESIL VM work correctly.

This is actually a lot easier than it sounds, as in this case, the ‘fnstenv’ FPU opcode is simply being used to retrieve the current instruction pointer. All our mock code has to do is to retrieve the EIP pointer and add this to the stack to emulate this FPU instruction.

Another odd thing that you will notice, is that the final ‘jne’ instruction at address 0x0804808d jumps forward within our disassembly, whereas the source code of the decoder stub clearly shows this should be a jump back into the decoder. This is one of the cool things about emulating code, strange things like this become clear without the need to fire up a debugger.

Again, lets set up our ESIL VM and begin emulating the decoder:

aei aeip aeim 0xffffd000 0x2000 stack e io.cache=true

We first step through the code until our EIP value points to just after the "fnstenv" opcode. At this point, we want to put the address of the last FPU instruction on the stack, which in this case is the ‘fld’ opcode at 0x08048056. We can do this with the following r2 command:

wv 0x08048056 @ 0xffffe000

Once we have mocked this instruction, we can continue on with our stepping. You will quickly notice that after the first round of ‘xor’ instructions, the ‘jne’ location has been updated to something more recognisable:

This was due to the "4a" byte value which was updated by the decoder to "e9" to fit in with the ‘alpha_upper’ requirement, and also explains the comment in the decoder source that we saw:

"uJ" + # jnz short ------------------------- "I" # first encoded char, fixes the above J

Our final r2pipe script can be found here: https://gist.github.com/xpn/da4a497288d6e1ed066d47ff1b2ce2d7.

Hopefully the above gives you some idea over the power of ESIL, and Radare2's emulation capability. If you have any feedback, feel free to comment in the usual places.

[palameiad]

palamedes and his rabid dog of a brother <//3

[palameiad]

actually i'm not keen on discussing the plow™ or whether odysseus was "justified" for killing palamedes or not because it's the only story people talk about in regards to palamedes at the expense of. everything else. so it's basically annoyed my interest out of the subject i think