art blog(derogatory)
Mike Driver
Peter Solarz

⁂
occasionally subtle

let's talk about Bridgerton tea, my ask is open

Discoholic 🪩
$LAYYYTER
2025 on Tumblr: Trends That Defined the Year
🪼
ojovivo
sheepfilms
dirt enthusiast

JBB: An Artblog!

#extradirty

if i look back, i am lost
Cosmic Funnies
Alisa U Zemlji Chuda

seen from United States

seen from New Zealand
seen from United States
seen from Australia
seen from Argentina
seen from United States

seen from Türkiye

seen from New Zealand

seen from Türkiye
seen from Australia
seen from Canada

seen from T1
seen from Netherlands
seen from Argentina

seen from New Zealand
seen from Türkiye
seen from United Kingdom

seen from Malaysia
seen from United States

seen from United States
@matthewiswiser

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch • No registration required • HD streaming
Gotta love ole Hank Jr! Great lyrics, you don’t hear this kind of country music anymore.
Andrew Jackson (1845). Thomas Sully (English-born American, 1783-1872). Oil on canvas. Corcoran Gallery of Art.
In 1824 Sully painted a study portrait from life of Jackson. The hero of the Battle of New Orleans was by then a U.S. senator and a Democratic nominee for president. Two decades later, Jackson’s ill health prompted Sully to copy his 1824 study portrait; the replica was completed shortly before Jackson’s death in April 1845. Sully used the replica as a model to create this full-length portrait of Jackson as the battle hero.
Hadn’t seen this portrait before, love it.
IOTA - The crypto currency for the Internet of Things economy.
I can’t tell you how excited I am for this project! Tentative release date is July 11, and the token will soon be tradeable.
After having read through the whitepaper closely (http://iotatoken.com/IOTA_Whitepaper.pdf) and spoken to the developers a bit, I feel really confident about this project.
Honestly, I always thought bitcoin is pretty wasteful, processing transactions in batches every 10 minutes. Why not secure each transaction with a little Proof of Work instead? It’s brilliant!
So much less overhead than your typical blockchain, will allow fee-less transactions, and the processing power to submit transactions is now reduced by an order of magnitude.
Can’t wait for IOTA!!!!!
http://iotatoken.com/
Sad about Orlando
I have been quite upset about what happened in Florida the other day. Just a terrible crime all around, nobody deserves to die like that. What a horrible act.

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch • No registration required • HD streaming
You’ve got to love these old songs! Not exactly true to the original spirit of the song, and the flag is not the correct shade of blue, but still a moving piece and a good singer.
“Hurrah for the Bonnie Blue Flag that bears a single star!”
This organization has put together some other excellent arrangements of songs from the time period as well.
DeadUpdate; Or, How I learned to stop worrying and execute arbitrary executables from HTTP
… my first disclosure. Man, it feels weird doing this.
From the vendor that brought you a vulnerable cloud storage platform comes ___ ____ __ __ __ / _ \___ ___ ____/ / / / /__ ___/ /__ _/ /____ / // / -_) _ `/ _ / /_/ / _ \/ _ / _ `/ __/ -_) /____/\__/\_,_/\_,_/\____/ .__/\_,_/\_,_/\__/\__/ Because popping SYSTEM /_/ is easy when you trust HTTP Or, "How I learned to stop worrying and execute arbitrary executables from HTTP" Affected software: LiveUpdate (any version? 3.3.5 tested) Vulnerability: HTTP MITM to SYSTEM execution + more. CVSS: est. 9.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (N.B.: This assumes "Hijack some HTTP" is easy and you're local) Timeline: 2016-04-27 Initial discovery 2016-04-28 Attempt to contact vendor ([email protected] - bounce) 2016-04-28 Disclosure to MSFT MSRC attempting vendor coordination 2016-05-09 Attempt to contact vendor (via phone; told to go away) 2016-05-10 Disclosure to CERT/CC (tracked as VU#215055) 2016-05-11 CERT/CC attempts to contact vendor 2016-05-24 CERT/CC: No response from vendor 2016-06-01 CERT/CC: Disclose at will 2016-06-03 Public disclosure
ASUS is at it again. I was poking around in Fiddler and noticed my new laptop made some interesting calls out to the web over plain http on a clockwork schedule. Once I figured out what was going on, my response was pretty clear:
.
Ohhhh shit.
TL;DR
ASUS’ LiveUpdate software is preinstalled on computers shipped by ASUS. It is responsible for delivering updates, new versions of the BIOS/UEFI Firmware and executables for use with ASUS software. Content is delivered via ZIP archives over plain HTTP, extracted into a temporary directory and an executable run as a user in the “Administrators” NT group (“Highest Permissions” task scheduler). There is no verification or authentication of source or content at any point in this process, allowing trivial escalation to NT AUTHORITY\SYSTEM.
THE DETAILS
ASUS ships windows computers with software called LiveUpdate, intended to provide timely updates of software to users. There is no information on how long this software has been in the wild, but I can speculate it’s been since at least the XP days since I Can find BIOS udpates from 2004.
The ASUS LiveUpdate client makes requests over plain, unencrypted HTTP to the ASUS update servers (liveupdate01.asus.com or dlcdnet.asus.com, depending on version) and interprets them as XML files (or obfuscated XML)
So if you have a UX303UA device, the current generation of LiveUpdate will try each of the following until it gets a not 404:
http://liveupdate01.asus.com/pub/ASUS/LiveUpdate/Release/Notebook/UX303UA.ide
http://liveupdate01.asus.com/pub/ASUS/LiveUpdate/Release/Notebook/UX303UA.idx
http://dlcdnet.asus.com/pub/ASUS/LiveUpdate/Release/Eee%20Book/UX303UA.ide
http://dlcdnet.asus.com/pub/ASUS/LiveUpdate/Release/Eee%20Book/UX303UA.idx
These “.idx” files are rather complex, allowing for a variety of updates to be applied, including flashing the BIOS via WinFlash (if installed) and installing drivers. For example, here’s from an ET1602 laptop the entry for an updated ACPI driver:
<item name="ATK0110 ACPI Utility"> <description l_id="1033" title="ATK0110 ACPI Utility">ATK0110 ACPI Utility</description> <description l_id="1028" title="ATK0110 ACPI Utility">ATK0110 ACPI Utility</description> <description l_id="2052" title="ATK0110 ACPI Utility">ATK0110 ACPI Utility</description> <type> driver </type> <hwid version="1043.2.15.37" date="08/13/2004"> ACPI\ATK0110 </hwid> <os> WinXP </os> <version> 1043.2.15.37 </version> <size> 837015 </size> <release-date> 1219104000 </release-date> <zip-path> pub/ASUS/DigitalHome/DAV/B202/ACPI_V104321537.zip </zip-path> <execute> .\AsusSetup.exe </execute> <index> 1 </index> </item>
The neato part is that it can bootstrap itself! This looks to have been at one point called “ASUS Easy Update” and has been around since at least the XP days.
There’s a lot you can do. Remember what I was saying about the BIOS being flashable from this?
This isn’t going to be good…
<item name="BIOS 210"> <description l_id="1033" title="BIOS 210">To solve the issue which charge speed will be slower when battery capacity is above 60%</description> <description l_id="1028" title="BIOS 210">解決當電池容量大於60%時,充電速度變慢的問題</description> <description l_id="2052" title="BIOS 210">解决当电池容量大于60%时,充电速度变慢的问题</description> <type> BIOS </type> <os></os> <version> 210 </version> <size> 2717731 </size> <release-date> 1422628620 </release-date> <zip-path> pub/ASUS/nb/X453MA/X453MAAS210.zip </zip-path> <execute> X453MAAS.210 </execute> <index> 1 </index> </item>
There is no verification done of the authenticity of this XML file or the items it points to.
In tandem with a convenient “run once an hour” scheduler task, LiveUpdate makes repeated, noisy requests to the LiveUpdate HTTP service. When “Critical” updates are returned, the default behavior is to automatically install the updates.
This scheduler task is run as any user in the NT Administrators group that the Task Scheduler deems high enough to be considered the most privileges.
LiveUpdate pulls updates as ZIP archives, compressed however is convenient. An executable specified in the index file will be executed with whatever is useful.
Due to how the executable is launched, there is little chance of an executable which is not authenticode signed from causing problems. This executable is run under the user account that is associated with the task scheduler task. For the purposes of the PoC presented, SysInternals PSEXEC (authenticode signed) is used to escalate to NT AUTHORITY\SYSTEM.
The POC
With a few fiddler intercepts, we can easily make the LiveUpdate application think we have a legitimate update.
Our fiddler AutoResponder rules:
Let’s push for the UX303UA a totally legitimate system update:
<product name="UX303UA"> <item name="Garbage File"><description l_id="1033" title="Legitimate System Utility">Shoutout to Joey.</description> <type> AP </type> <os> Win10(64) </os> <version> 48 </version> <size> 199465 </size> <release-date> 1459468800 </release-date> <zip-path> pub/ASUS/nb/Apps/LiveUpdate/LiveUpdate.zip </zip-path> <execute> update.bat</execute> <index> 22 </index> <severity> 1 </severity> <assistant> SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}\DisplayVersion </assistant> </item> </product>
Our payload has a copy of psexec, a fancy whoami and a script to run them. Fiddler says the trap is working:
And we see that LiveUpdate thinks there is a critical update.
And, when LiveUpdate comes along to go “OMG CRITICAL UPDATE RUN IT NAO!!!” we get a little love letter:
Hmm..
…
So there we go, execution as NT AUTHORITY\SYSTEM because of a few HTTP calls.
This content is mirrored in a gist
Outrageous oversight, pure laziness, so bad it almost seems malicious.
I really don’t like Donald Trump, I find him arrogant, abrasive, shallow and often ignorant.
However, I’m dying from this!
She claimed for 10 years to be Indian, I’m sure that looked good for Harvard’s diversity numbers, she’s not at all. Unbelievable.
A great song, a real classic!
Unbelievable, blatant discrimination. What a way to mark the achievement of the students! These students have worked hard for years, and their commencement speaker tells everyone that there are too many people with a lack of melanin in the government. Great way to encourage them! Just crazy, horrible, and really sad. Especially with my own graduation coming up soon.

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch • No registration required • HD streaming
Imgur: The most awesome images on the Internet.
My day trip to Lantau Island, near Hong Kong, to visit the Big Buddha
First full day in Hong Kong
please guys
full source?
http://mingw.5.n7.nabble.com/mingw-error-redefinition-of-struct-timespec-td34655.html
Such a great song! I love it, it’s so sad but good.
Join the Louisville basketball team!

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch • No registration required • HD streaming
Seeing everyone’s reaction to a foreigner sweeping the street is totally expected, but still made me a little sad. Too many expats denigrate our reputation, so I LOVE stuff like this!
Their other videos are wonderful too.
"Marching Through Georgia" is catchy as hell. Not gonna lie.
Oh, yeah, it’s also Confederate History Month in most of the South.
bwahahahahahahaha
A lot of those old songs are really timeless.