Seven proven niche e-commerce ideas 2020. Now I know you're sitting on the beach dreaming of a profitable online business. Well it all starts with a really good e-commerce idea. Now I'm talking about a legit idea, okay? Not some of these scammy things that are out there, but something that's actually gonna earn you money now and into the future. The key is to find the business idea in e-commerce that actually works for you. Everybody's different. In this video I'm gonna show you how to find the best e-commerce idea for 2020 and moving forward and we're starting right now. Hey I'm JR Fisher. If you're new to my channel do me a favor, hit that subscribe button down there and next to it there's a bell. Gotta ring the bell, smash the bell and then you gotta turn on all notifications. When you do that I'll be able to notify you when I do a new video and you'll be part of the Fisher family, the VIP club that actually gets notified ahead of everybody else.  I also, since you're interested in e-commerce I have a $97 e-commerce course. It is listed in the description below. You can get it for free. You don't have to pay for it. No credit card required, click and learn. Pretty cool stuff. Now if you're new to my channel I've been selling online since 2009 and I've sold millions of dollars of both digital and physical products and over the years I've learned some things on this channel. I actually share these things with you so you can get good results. So let's get going. Let's get on this business idea thing. Now maybe you've already come up with some business ideas. If so, put it in the comments below. If you have questions about this feel free to put it in the comments below or if you've already done something and you were successful, share it in the comments below so we can all see your success. All right, let's check it out. Let's get in here and let's get some good business e-commerce ideas. Number one idea is a monetized niche Amazon affiliate site. Okay, what does that mean? First off, don't get stuck just on actual products. Instead what you wanna do is you wanna capitalize on a niche market, an entire market that can buy all kinds of products from you. I like the idea of combining physical products with affiliate marketing. So I'll be selling some of my products and somebody else's products too. They may have guides and courses that actually match my product. Now we own a survival food company so we could actually sell our survival food to people and then sell them a course on survival that somebody else has done and become an affiliate of that course. Now the thing with affiliate marketing it is easier to sell it and make money if you already have a website, if you already have some traction, if you already have a list that you can mail to it makes it a whole lot easier. Now if you don't have that list you can certainly build it through ads, through blog posts, through social media posts.  Now the thing about Amazon I like is that you can sell anything, okay? So whatever Amazon has on their website you can create affiliate link for, put that in your blog post, put that in your videos. I have some links down there. I'd love if you use those links. But put those in your videos and your blog posts and social media and you can actually start making money off Amazon right away. You know whether you're selling your own products or you're selling somebody else's products getting started right away that's the important part right there. Check out what's on the screen now. This is Dr. Axe and it's one example of a health niche site double dipping with affiliate marketing and branded products. So they've got their own products on there and they also have affiliate products on there. Business idea number two, private label natural skincare products for women. This is a huge, huge market guys. Organic skincare is on the rise and now's a great time to get in on it. People have slowly over the years been moving away from chemical filled skincare products and moving to more natural alternatives. If you look in e-commerce and what's going on now the margins really look good and organic skincare products keep growing is expected to be a $22 billion market by 2024. Currently it's growing at 10% a year which is actually huge. Now some of the trending products we're seeing are facial creams and body scrubs and mineral sunscreen and facial cleansers. There's all kinds of products that you can actually sell and make money on. Now, unless you have the time and money and knowledge and resources the most logical way to do this actually is to private label, get somebody else to make the product for you. Now, check out your screen right now. This is Radical Cosmetics that you're seeing on here. Now Radical Cosmetics is one that's doing exactly that. You can also use Alibaba and manufacturer directories to get more. While you're at it, you see other e-commerce businesses ideas that look good. You can try those out too. Women love beauty products and natural ones are even better but that doesn't mean that you'll easily sell immediately once you drop into the e-commerce world. It takes some time. You gotta get traction. Idea number three is wholesale baby toiletries for eco-friendly parents. You're seeing more and more trends of this right now. The one on the screen I'm showing you now is called Bundled Baby. It's a diaper service boutique. It's eco-baby and bundle diaper services which are offered to different families. They say that by 2020 this year there will be 80 million babies in the US accounting for 24% of our entire population. And with a population like that, they gotta buy products, right? So you can come in and fill that gap and have those products for them. It's already gotten to the point where 20% of all baby products are actually now sold online. And kids influence up to $500 billion in household spending every single year in the US. Now the vast majority of that is actually toiletries but disposable diapers, oh my gosh, they end up in landfills where they can stay for almost 500 years. People are starting to become wise to that and they're starting to find more eco-friendly alternatives. Now eco-friendly diapers serve two purposes actually, two passions actually for parents. They save money and they actually save the environment at the same time, so it's a win-win. Number four, idea number four, print on demand lifestyle apparel. This is a really big market that's been growing and growing and growing. And the cool thing about print on demand is somebody else actually prints the product and ships it out to the consumer. So you never have to mess with printing, you don't have to buy inventory, you don't have to package things, you don't have to ship things. And you can sell to a really strong niche like the lifestyle apparel. Now if you check out this website that I'm showing you right here, this is an example of that right here. T-shirts are easy for the first clothing item that you're gonna think of, print on demand, everybody thinks of that. But no wonder, plain t-shirts are harder to see these days with a variety of design printed shirts everywhere. Since the t-shirt market is saturated, you'll have more chances of selling when you have a target niche market like this. Lifestyle products make up one of the top economic niches there are. With print on demand lifestyle apparel, you can easily piggyback on a community or trend that already exists. So some of those trends could be pets, they could be animals, they could be music, they could be maps, they could be fitness, they could be food. There's so many niches that you can sell your print on demand products to that the ideas are endless. So think about it, some of the niches could be, you know, fitness for nurses, it could be CrossFit, it could be detailed maps or shirts or dog or cat community. There's so many little niches out there you can sell your products to. Idea number six, drop ship, H-I-I-T, equipment and sell training programs to beginners. Hit, hit workouts are huge right now. This is high intensity interval training. It's a whole thing now, it's like CrossFit. People are really into this. Now if you look at this site right here, it's called Hit, Gear and Apparel. The fitness niche is one of the top e-commerce niches. It is evergreen, it's always gonna be around. It's stable and it's profitable for the most savvy e-commerce entrepreneurs. And hit workouts are really rising in popularity. You'll hit a home run with this niche if you just choose to start an online business and start selling hit equipment.  But you can have that niche website that has all these products available for the consumer. Idea number five, deliver organic food on demand to clean eating enthusiasts. This market is exploding and I'm part of it too. I try to buy everything organic that I possibly can because why would you wanna have chemicals in your food if you could afford it? Many times I found in the grocery store the organic food is the same price as the regular food or even cheaper. And why would you buy chemicals? It makes no sense to me. Right here is a site called Bella Bean Organics. Truth is the US online grocery sales have brought in about $17.5 billion this year. They say by 2021 that the amount is expected to be nearly 30 billion. Okay, that's almost double. That's a lot of money. And still online grocery in the US is not even as good as it is in the UK. So you can imagine with the change because of the big pandemic what this market's gonna do. This is a great idea for everyone interested in selling food and beverages. The market's wide, so specializing in organic grocery stores, one of the most profitable niches and cash cows that you can find. Idea six, create online courses. Now online courses is something I do, okay? And it's really nice. It's nice to wake up each day and I have some courses that are $1,000. And sometimes before breakfast I've made $3,000 or $4,000 by selling a few courses that I have out there. So that's a really nice extra income and anybody can do a course, whatever your skills are. And then if you don't have a skill, get one. Go to YouTube and start looking at videos on a particular thing, whether it's coding, building websites, marketing, workouts, whatever it is, learn that thing and then go do a course on it and sell it. It's really that easy. That's what I've done is I learned these things and then I did a course on them and then I make money off the course. It's really that simple. I didn't have these skills beforehand. And here's the thing when people say I don't know how to do something, you never know something until you know it. The expected sales, get this, listen closely. The expected sales for 2023 for this particular area. Online courses is $286 billion. It'd be nice to have a little share of that, don't you think? I love digital products because you can create a digital product like a course or a membership or something like that and you can sell it to 10 people or you could sell it to 10,000 people or 100,000 or a million and it doesn't cost you anymore because it's already been created. Idea seven is drop ship handmade jewelry to women. Women are always gonna buy jewelry, they're always gonna buy online and the jewelry industry, you can have tremendous markups and make a really good living. Now here's a website right here called Natural Artist. They have jewelry, bags, art and more and that's exactly what they've done. You have more chances of differentiating as a drop shipper when you sell unique products because you don't have to buy inventory. Also the price of handmade jewelry is hard to guess, right? Nobody can figure it out. It's hard to figure out what a reasonable price is so selling on your online store also puts you at more of control than the other market places out there. Now as far as supplies of jewelry, you have better chances when you don't use something like Aliexpress for custom jewelry. You need to find people who are gonna make that jewelry and who will ship it out and there's plenty of people in the US that do that right now.  Idea number eight, drop ship high ticket items, okay? High ticket items are gonna pay you more in commissions and they're pretty cool to sell too. You can make a lot of money on them. High ticket items, all you have to do is get an association with a very expensive item whether it's a drone or whether it's some type of computer apparatus or whatever it is, robots, whatever it is and market that through blogs, through social posts and build your list and market these high ticket items to these individuals and you don't have to come up with it and somebody else can ship it out. Okay, so that should get you started. You've got a lot of ideas there, a lot of things you can act on at this point. I really appreciate you watching this video. Don't forget I have a $97 Ecommerce course. You can get it right now temporarily for free. It's in the description. There's a link down there. All you have to do is click and learn absolutely free to you. So take advantage of that. If you haven't subscribed yet, please do so hit that subscribe button. Next to it, bell, turn on your bell notifications, turn on all notifications. And when you do that, you've become part of the Fisher family, the VIP group that gets notified before anybody else.  Now put your comments below. Which of these ideas did you like?   I want to hear from you. Put your comments below and I'll be happy to answer you. Thank you so much for watching this video and I'll see you in the next one. Hey, thanks for watching my video. Don't forget to subscribe to my channel and click that little bell right here so you can be notified every time I do a new video. Also click on one of those videos there. Keep watching on my channel.


And the former president Olusegun Obasanjo has revealed that he has a mad passion for Nigeria and that the current situation in Nigeria is not only agonizing for him, but for other Nigerians who also desire a better Nigeria. Obasanjo stated this when he played host to a presidential aspirant under the platform of the People's Democratic Party, Mohammed Hayatuddin, at his penthouse residence in the Olusegun Obasanjo Presidential in Abelkuta, Diogen State Capital. He declared that Nigeria requires a leader who has a passion, innovation, vision for Nigeria and some who possess adequate knowledge about the challenges confronting the country. Earlier in his remarks Hayatuddin declared that Nigeria is decomposing and dissolving very fast. I am going in for the presidency. Number one is that our society is decomposing and dissolving very, very fast. The economy of this country is in complete tatters and the industry is fixed. That is the first reason and I don't need to justify that because you do not have much time there are other business. Number two, we have a major social security problem. I had never imagined, Mr. President, for the life of me, that I would ever in my own lifetime or that of my children ever see Nigeria melting the wages it is doing now. And I think it is a colossal tragedy. I believe, like you have rightly said, that this period is not like any other period in the history of Nigeria. And when you said, we talked earlier, that you are involved in this with your passion. And I was telling some people this morning that passion means madness. That you are mad about Nigeria. I am. And I have no apologies for that. Because I have no other country I can call my own. And I have no other country I can go to and say, yes, I have come to Libya. Passion means having been mad, having the touch of madness. I look at you and say, yes. Thank you very much.


Hey guys, this is Rich from Rich TV Live. If you would like to get access to my top 10 picks every single month, hit the subscribe button. Just go to Rich TV Live on YouTube and subscribe. Now thank you for joining and watching. Here are my top 10 stocks for September 2020. In number 10, Control Energy. This is a company that I brought to you guys first. I brought it to you guys at around 50 cents when I interviewed the CEO literally almost a year ago to the day. It is 100% buy on bar chart, top 1% signal strength. Now on the COVID-19 testing, my number 10 pick, Control Energy, K&R in Canada and K&R LF in America. You can see 100% buy, top 1% signal strength in Canada, 88% buy in America. This has been absolutely on fire. If we scroll down, you can see the move that it's made, incredible move. You can see up 586% in the last few months since March, 165% in the last month, 288% in the last three months. Absolutely on fire. One of my top 10 picks, my number 10 pick for September 2020. And here's the share structure for Control Energy Corp, 30 million outstanding shares, only 16 million in the float. I think the upside is absolutely tremendous. That's my number 10 pick. And in number nine, we're going to rip through this real quick. In number nine, this is a brand new IPO. Just came out, XPEV, brand new IPO that just came out, Xping Inc in the electric vehicle space. A brand new IPO. It went up on its first day, 7%. Electric vehicles are hot. Obviously, you see what companies like Tesla have done. And I believe this was one to watch. A brand new IPO that just came out, Xping Inc ADR, XPEV, already up 7% on its very first day. And nobody knows, but you do because you're watching Rich TV Live. So that's my number nine pick, XPEV. And let's take a look at the share structure of XPEV, Xping Inc, take a quick look at their share structure, currently at $22.79, not available. So brand new IPO, the information is not available yet, but I will keep you updated on that as it comes out. So that is my number nine pick, XPEV. Now in number eight, Q-G-E-N, Q-G-E-N, a 100% buy on bar chart with a strengthening short term outlook on maintaining the current direction. Another company that is getting involved in COVID-19, Keogen, N-dot-V, Q-G-E-N shares outstanding $227 million, I believe. Let's take a look, Q-G-E-N on the New York Stock Exchange, $50, 227 million shares issued and outstanding for Q-G-E-N, currently at $50 and one of the major players in America doing business on the New York Stock Exchange in the COVID-19 testing. So put them on your radar, put them on your watch list. I think the upside could be tremendous. And if we take a look at what they've already done, you could see here, if you scroll down, they are already up since October of last year, 102%, 19% in the last month, 19% in the last three months, 9% in the last month, I think Q-G-E-N has a chance to be a big winner. It produces biomedical and genetic products for separating and purifying nucleic acids for gene-based drug screening, nucleic acid-based clinical diagnostics, genetic vaccination, and gene therapy. Watch them, put them on your radar, put them on your watch list. They are my number eight pick for September 2020. In number seven, company that I brought you first, I brought you this company when it was at 50 cents, I interviewed the CEO, and they have been a massive success, a 100% buy on bar chart, top 1% signal strength, meaning it is on fire. Was up 14% more on Friday, I did a video on them last week, I've done multiple videos since it was at 50 cents, it's been another huge winner for our community, up 138% in the last month, 151% in the last three months, 413% since December of last year, Cloud MD is a telemedicine stock, and telemedicine stock is the future of medicine with so many people struggling with COVID-19, people afraid of leaving their homes. The best way to get on the phone with a doctor right now is to just literally get on the phone and call them. That way you don't have to leave your home, you don't have to take any risk, it is the safest, newest form of medicine, it's telemedicine. This is a screaming pick, DOC in Canada, DOCRF in America, love Cloud MD software, it has been on fire. It is my number seven pick for September 2020, you can see it has been absolutely on fire and still only at a dollar, my number seven pick for September 2020, and if we go to their share structure and we go to Cloud MD, DOCRF, Cloud MD software, there it is, and we go to security details, very tight share structure, 113 million shares issue note standing for this future juggernaut, so company with no debt whatsoever, like little to no debt and millions in the bank, and they're going to make more, it is a beautiful, beautiful company. They are my number seven pick for September 2020, and in number six, how about Walmart? You ever think about Walmart? Yeah, what about Walmart? What about Walmart? WMT, let's take a look at the security details, 2.8 billion shares issue note standing for Walmart, currently at $140, I believe this is a chance right now for us to get rich on Walmart, because if Walmart does, look at this, 100% buy on bar chart, bar chart taking the same thing, 100% buy on bar chart top, 1% signal strength for Walmart, my number six pick for September 2020, 100% buy on bar chart, top 1% signal strength, why? Because Walmart is in the middle of partnering with Microsoft to acquire Tiktok, and if they acquire Tiktok, one of the fastest growing social media platforms in the galaxy, that's going to really explode for Walmart. So that is huge for Walmart, and that's why I believe Walmart is a buy right now, up 9% in last month, 19% in last three months, 37% in the last few months, since March in the drop since COVID-19, Walmart is a multinational retail corporation, which operates a chain of hypermarkets, discount department stores and grocery stores, Walmart Inc. formerly known as Walmart, stores Inc. is headquartered in Bentonville, Arkansas. I think it's a buy, Walmart my number six pick, and a number five, a number five CRDL. So I brought this pick this week, Cardio Therapeutics, I am a huge fan of Cardio Therapeutics, and huge move, 17% move, they are seeking and working on COVID-19 testing as well now. And they're also in the cardiovascular space. And this is a position for me that really hits home, as I've had a lot of family that have struggled with heart disease. So Cardio Therapeutics for me is a amazing company. And as you can see here, Cardio Therapeutics initiates Health Canada approved phase one clinical study of Cardio RX trademark up 38% in the last month, 47% since March of this year. And I think this is a company that everybody needs to watch right now. Cardio Therapeutics produces pharmaceutical cannabinoidial, develops innovative therapies for heart disease, including acute myocarditis and other causes of heart failure. Now it's getting into COVID-19 testing. This is huge. This is why you need to put Cardio Therapeutics on your watch list, put it on your radar, and the US symbol CRTPF, big day for them in America as well, up 17%. And you can see here a baby market cap of only 58 million, 32 million shares issued an outstanding 18 million shares in the float. This baby's tight, tight. Love this company. My number five picks for September 2020. In number four, how about another COVID-19 company? How about a company that I think has huge potential? This is a company that just came out with their news that they are going to really in a big way get heavily involved in COVID-19, Abbott Laboratories, 1.7 billion shares issued an outstanding, an absolute giant of a company, and one of the biggest pharmaceutical plays on the block that's now getting into the COVID-19 space, 100% buy on bar chart with the strongest short-term outlook on maintaining the current direction. This bad boy is a beast. It's a beast. When you're investing in this, you're investing in the best. Look at this. Strong buy based on 15 analyst estimates, 79% up since March, 28% in the last three months, 12% in the last month. Abbott is a global healthcare company devoted to improving life through the development of products and technologies that span the breadth of healthcare. They have a portfolio of leading science-based offerings in diagnostics, medical devices, nutritionals, and branded genetic pharmaceuticals. This is a play that is getting really big potential. Look at this. Global 2.1 billion implantable loop records, market outlook 2026. Key players are Medtronic, Abbott Labs. Look at the title for Abbott Labs. Abbott Labs is one of those companies that has a chance to explode. An absolute enormous opportunity to explode.  I'm going to have to do a separate video just on Abbott Labs because of the deal that they're about to put together here for COVID-19. It is so big. I could spend a full video just talking about that. Just take my word for it. This is a company you need to have on your watch list. You need to have on your radar. It is my number four pick for September 2020. Abbott Labs, an absolute beast. Now in number three, in number three, Microsoft. Now I gave you this pick earlier this year and it's been already a huge winner for all the members. Congratulations to everybody on this pick. Another 100% buy, top 1% signal strength. Why wouldn't you be looking at companies like Microsoft? When you see companies like Shopify at thousands, you see companies like Amazon at thousands, Google at thousands, Tesla at thousands, well why not Microsoft? If they get the deal with Walmart for TikTok, this stock is going to explode. It's already exploded and I think it goes higher if it gets the TikTok deal. My number three pick for September 2020, a 100% buy and tops in the 1% of all short term signal directions. This is probably one of the best top 10 lists I've ever done, a combination of giants and small undervalued, underappreciated, under exposed companies that have a chance to be a giant. I'm not the only one that thinks this, look at this. Everybody loves Microsoft. It is a screaming buy, 15% up in the last month, 26% in the last three months, 72% since the dip because of COVID-19 in March. Everybody knows Microsoft as one of the largest technology companies in the world. They're my number three pick for September 2020. In number two, a company that everybody loves, everybody knows and everybody wants a piece of right now.  They are my number two pick for September 2020 and everybody wants them because they're about to do a forward split, which means you're going to get for that $500 share. You're going to get a $125 stock on Monday. And when that happens, everybody and their sister is going to buy Apple until the stock goes back to 4,500 and then they'll do another forward split. So everybody who's got shares in Apple at 500 bucks is going to get four shares of Apple for their one share, but their shares are going to go down to $125. I believe Apple at $125 is a screaming buy and everybody buys it again on Monday. That's why they're my number two pick for September 2020, a 100% buy. And I believe this bad boy goes way higher. And everybody knows Apple is the leader on a global scale for phones, computers, technology. They are a global giant up 33% in the last month. Since everyone found out they were going to do a forward split, 57% in the last three months, 144% since March. That's right, 144% since March. These guys got the iPad, the Mac, iPod, Apple TV, they got phones, they got it all. Number two pick for September 2020. And you probably guess what my number one pick is, but I'm going to let you know Tesla. This is my number one pick for September 2020, a five to one rollback, which means you're going to get shares at 2200 divided by five. So you're going to get shares at about $500, let's say about $540. So as of Monday, August 31st, you're going to have shares of Tesla at $540. Your shares were just at $500 and now they're going to go back to $500. What do you think everyone's going to do? They're going to buy Tesla at $540 and this stock is going to go right back to 1000. You're hurting here first. It's 100% buy on bar chart with the strongest short-term outlook on maintaining the current direction. They've got a genius CEO who's clearly taking over the world, one of the richest men in the world now documented. This is an absolute giant. The five to one rollback is going to make everybody buy more. The five to one forward split is going to make everyone buy more. If you had shares in Tesla at 2200, you're going to get five shares of Tesla at $540. Sorry. Sorry. My math is off. Not five shares of Tesla at $540, that would be incorrect. Five shares of Tesla at $440. You're going to get five shares of Tesla. It makes it even sound even better. Tesla at $440 after being at 2200, this bad boy is going from 440 right back to 1000. You're hurting here first from your boy, Rich. Tesla's a beast up 62% in last month, 175% in last three months, 915% since August of last year, almost to the day. In fact, to the day, 915% you could have made on Tesla in the last year to the day. That's why they're my number one pick for September 2020. Thank you guys for watching. If you're not winning, you're not watching. We bring in the winners and we bring them to you first. I believe this is our best top 10 we've ever done in the history of our show and I believe the results will speak for themselves. Thank you very much for watching. This is Rich from Rich2BeLive with our top 10 stocks for September 2020. Have yourselves a great day and I hope you win big. Peace.


This paper proposes a new approach for jointly estimating grassland leaf area index, LAI, and chlorophyll content, CAB, from unmanned aerial vehicle, UAV, hyperspectral data. It first identifies optimal vegetation indices, this, for LAI and CAB estimation using prosail model.  This matrix is used to determine the relationship between this and LAI and CAB values. Finally, LAI and CAB are jointly retrieved by using the two-layer matrix. This method reduces the cross-influence between LAI and CAB, resulting in higher accuracy for LAI and CAB retrieval. Additionally, as a method similar to lookup table, the two-layer matrix can be used directly for LAI and CAB estimation without the need for prior measurements for training. This article was authored by Xiao Hua Zhu, Qian Yang, Xin Yu Chen, and others. We are article.tv. Links in the description below.


Going on everyone Sam here with late in sports cards. We're been four boxes of 21. Any one football for Harper B It's good luck Harper. Let's see what we got. Come on baby.  Let's see a field to Harper a Mac a lance Chase big vet of some sort shield. Let's see it dude. Okay. That's pretty good start right there It's gonna be four of 25 Najee Harris. Okay, two-color RPA. We'll take that for sure T-Law T Lance. Let's see it. Come on, baby. Nice one there Harper big Najee to start it off. We'll take it. We'll take it See come on baby. Come on baby. Let's see a big QB It's gonna be 40 of 125 Terrace Marshall Terrace Marshall, Jr. LSU legend potential probably second receiver there this year. I would say Potentially has a shot at being the first Nice TMJ Harris Marshall, Jr.  That's kind of nasty once upon a time Dan fouts on the auto That's gonna be six of six for the Chargers right there Say one of the arguably one of the best quarterbacks. Never won a Super Bowl Probably got to be close to that list. I think The Amarino yes, yes, nice one there six of six nice color match, too He won an MVP right Because I feel like I remember You've got a big poem three colored precision RPA For the Chargers 39 of 99 when Mike Williams and Keenan Allen and I've really missed 13 games apiece He'll be the number one receiver there. So nice one there Harper. Congrats, buddy That is gonna do it for your prank Harper. Thanks again as always do appreciate it man. Get him right out to you, buddy


They're going to be doing a talk on attacking Oracle from the Metasploit project. All right, thanks. Let's get started. Thanks for either staying up late or waking up early. So this is me. Chris Gates, part of the Metasploit project, pen tester by day, bloggers, Curie Twit, all the other stuff. If you want to know more, ask me or bust out your Maltigo license. Thanks, Maurio Ceballos. I'm kind of known as MC within the framework. I'm sorry, now? OK, again, my name is Maurio Ceballos. Known as MC from within the framework. Do a lot of vulnerability research, exploit development. Some of that stuff ends up in the framework. A lot of it doesn't. My primary focus is on auxiliary modules and code execution vulnerabilities and for day job by do pen testing. So a quick disclaimer. This is not our employers. Everyone has to do that one. And then the other disclaimer is with the exception of some SQL injection that Maurio found, most of this stuff is not new. It's been around for quite a while. But it's been really hard to put all these random SQL files and Perl scripts and everything together to kind of put a whole attack together. So what we did, one of the things I was kind of going for when we did this was to put a process in place for pen testing Oracle. And Maurio's going to talk a bit about some of the other things he did and why he built this stuff. But that was a big thing is we didn't invent or discover it. We just tried to streamline the process and make it easier for all of us who are doing pen testing. So why we focus? So lots of pen tests. I've seen lots of potential Oracle clients. From my experience and everyone's experience is going to differ. People were either falling into the I have a DBA and his own personal hell is making sure he's doing this Oracle stuff or they don't. And I'd say, oh, you've got Oracle on your network. Who's in charge of the meddling account? And they'd be like, what's a meddling account? So with the Oracle business model of allowing free downloads but no updates without paying, we started seeing lots of default installs out on the network. And privilege escalation is easy and data theft is easy but it's metasploits, we want shells. So why we did this? There's not a lot of, actually I don't know of any support in any of the for pay frameworks that will go after any like SQL injection vulnerabilities in Oracle. Saint will do some of the memory corruption stuff that's in the default packages. But maybe core does, now I haven't seen it. And some of the other open source tools that do that are in GUMMA, I'm not sure it's still being worked on. Orasploit, that's not public. And then some commercial tools that focus more on doing VA's against Oracle and less on exploitation. All right, so I, okay, now, right, cool. So some of the current metasploits support we have is more on, again, the memory corruption vulnerabilities. This stuff is kind of supported by myself and a few other developers. We got coverage for things like Oracle secure backup, web logic overflow, a couple of TNS listener version, TNS listener process overflows in different pieces. We also have some auxiliary modules that we kind of stuck in there at first using a file format mixing to take advantage some of the SQL injection flaws that we're going to be talking about. Those are kind of obsolete now, kind of remove those Tuesday and kind of rewrote those to use a new mixing we're going to get into. And a really cool NTLM stealer which doesn't really inject anything but kind of tells the Oracle instance to pretty much mount an SMB share on our side and then we pretty much relay that hash and log back into the Oracle instance as the credentials we received from DBMS. I'm sorry. All right, so cool. So new metasploits support. I think sometime last year I kind of wrote a TNS mixing to support one of the, a couple of TNS overflows that I was writing. Doing all that work up front pretty much helped me out to do a lot of other things that weren't really exploit related. And again, so that mixing, which pretty much is just creates a dynamic TNS packet, is used for our SID enumeration tool, our brute force enumeration tool, our, what else we got there? A lot, what happened is that we ended up getting a full blow on TNS command.pl port into the framework. But the big thing about this talk here is an introduction of our Oracle mixing, which pretty much is what allows us to do all the magic. We're probably gonna show you here in a second. Couple of dependencies were wrapped around the Oracle Instant Client for the direct database access. We're using a really lightweight API for the database execution of our SQL statements and we're using an OCH8 Ruby driver. It's kind of broke was the newer versions of Ruby 1.9, so. It doesn't work on Windows yet either, so. Right, yeah, so anybody can get that stuff. I mean, I usually develop under Linux or OS 10. I don't touch Windows, I might attack it. And I meant, Chris has a link here to the install. So with the mixing, I kind of created a couple of methods that are really simple to use, straightforward, connect, disconnect. Those two methods are used for our brute force module that looks for default known accounts, given a correct SID. The exact method does just that, it takes a statement and makes sure that it's correct, sends it off to the remote service. And if things are correct, it spits about a pretty nice format of what you just sent off. This is just a quick example of the output of ours. So what we've done is essentially made a really simple SQL client from within their framing to talk to the database. So yeah, you can do some administrative tasks that we've gotten from Carlos Perez and I think Rory, if you're in the room. But it's kind of used for more of the evil stuff that we're doing. So from a attack methodology point of view, we need four things to connect to an Oracle database. We need to know what IP it's on, obviously, what port it's listening on, if it's on this default 1521. The service identifier, which is kind of the unique name for the Oracle database and a username and password, so that makes sense, right? So first thing, locate Oracle systems. So we got in-map information disclosure, so maybe as you're doing some other pin testing there's some web app work, you'll see that there's some Oracle errors coming back or you'll just kind of stumble across it. Or Google, you know, so if you're doing an organization you may see if they have any kind of public presence via Google. Starting with like, I know with 4.9 in in-map it will now return the TNS listener version, which is actually really handy. Up until, you know, that it was really hard, you would just get an open Oracle port, which wouldn't really tell you too much what version it was, what status that thing was in. So the new in-map is actually really handy for that. And you can also look for other common Oracle ports. So 1158 is your enterprise manager console, your 5560, your SQL plus web portal. Plenty of Google Dorks if you wanna locate Oracle systems. The red database security guy wrote some really good white papers on using those. Sometimes they come pre-owned. I don't know if you can see that one, but I found that one doing some of Google Dorks. Logged in with Scott Tiger and he was already DBA. So someone got to that one before I did. Happens actually quite a bit if not that I would ever encourage you to go look for open Oracle boxes. But if you do, you'll probably find quite a lot of them are already owned. So determining versions, obviously key, we need to know what version things are, so we know what exploits and SQL injection things to tailor toward it.  I'm all in Mario's slide. Okay. So what we do here is we send a TNS version packet with the TNS mix-in and it just parses out the results. And I haven't come across any issues with this ever not working for me, so that's pretty handy. Oracle needs to know, the instant client needs to know the version it's talking to so it can do its handshake and make sure that it's allowed to talk. Mario's also at some point gonna be pushing out some code that will query dbnsmp.exe that will do some information leakage, which will help us see installed paths for Oracle. And I think we also pushed out the TNS command one, right? A port of tnscommand.perl, it's now tnscommand.rb, which will allow you to basically send whatever commands or information you want to via TNS, which is pretty handy. There's a video I'll be pushing out later, which you can set log files to whatever and do the old-school Oracle 9 hacking with that. I think that's it. Oh, we have also, all these scanner modules also have the report mix-in built in. So if you wanna use the database stuff, you can actually output that stuff through a database. You wanna talk about that? Well, the big piece of that is because eventually we're gonna go to the dbAutoPone stuff, so it makes things really easy to own massive stuff. So, yeah, so we get the data, we save it, and we get it ready for some mass exploitation. All right, cool, so determining the SID. This is the crucial thing. You can usually come across a username or password, either social engineering or finding it on someone's desk or whatever. What's sometimes hard to find is that SID. It's critical. If you don't know the SID, you could know everything else. It could be a vulnerable oracle box. If you can't connect to it, you can't do anything with it. So we've got a few modules that we built that actually help with that process. The first one is, so with nine.2.0.8 and below, if you just send a status packet at it, it will actually give you the answer back. It will say, hey, my SID's ACMS, my service name is ACMS, and I've got all this other stuff running. After that, you'll get a listener protected. The little code at the bottom there is showing that it was against an oracle 10 box, and it's not gonna give you anything. So if we won't give it to us directly, we've got a few other methods that we can kind of go after it. First thing we do is we can brute force for default SIDs. So we take the SID list from Red Database Security. Feel free to add to it. Mine's growing every day. It just rips through and asks the oracle instance, oh, are you oracle? Are you DBMS? Are you oracle nine? Whatever. If it's right, it will give you a different error message back and parse that out for you. Or we can query other components that actually will contain the oracle SID. The Enterprise Manager will show it to you. There's a couple Java servlets, so we'll actually have the oracle in the HTML. And what we've done is wrote some auxiliary modules that will actually run through the Class C, and check and see if they're there, and then log those for you. So in this case at the bottom, we can see that the servlet spy is running, and we run the module and it found that the oracle was, the SID was oracle. And so this is kind of what, so if Enterprise Manager console is running, this is what you'll see. If you just browse to the webpage, but if you're auditing a big network or you're trying to automate some of these things, you don't want to browse to every page and then write down the answer. So we've got a, yeah, we've got an OAS SID module down there at the bottom that will actually go through and parse out that HTML and give you the answer. You want to talk about some of the other modules? I just want to kind of emphasize that we are logging everything. We're using another mixing called the report mixing and log everything to a local MySQL database or SQLite database. So as you're going through the network scanning and looking for potential targets, everything's saved. We don't want to waste any data that, we don't want to re-scan it, we don't have to and unfortunately, we don't want to get caught either though too. All right, next step, username, password. So like I said, if you can't come across it by any other means or you've been, you had your scope restricted enough that you're going to have to do something that in the real world will get you caught, we have a login root script will actually throw all the default Oracle user names and passwords at the database. And if you get one that's fine, if it finds one that's right, it will actually, you know, log that for you. Again, using the reports mixing, so as we progress with DB auto-pone, all that stuff should automatically do stuff for you. And I should have updated the slide, but the actual output from the DB notes, we also saved the SID that we used. So again, we don't have to go back and re-scan it. That's actually really important. All right, so privilege escalation via SQL injection. If anyone's unaware, there is a ton of default Oracle packages with SQL injection. Most of it is executable by public, which means if I can get any username and password, I can call that SQL injection.  And if you don't have that, there's a cursor SQL injection that works in nine and 10 requires a little bit less privileges. Yeah, yeah. And I'll put out some more notes on that later. So go ahead. All right, so I guess we're gonna step through a really generic module that we wrote. What we're highlighting here, okay, well everything in black is just metadata, the module is just information. You can see the name of it, we're actually, we kind of picked this, the sys.ltfind rickset is the actual vulnerable package and procedure that we're gonna be exploiting in a short demo here. We kind of chose this because a lot of other talks used the same injection method, we just put our own little twist to it. The red is our actual, I hate to say the word, but our payload is what we want our injection to perform and by default we grant the DBA privilege to the user that we've used to log in and potentially exploit. Right? What's handy about that is, it doesn't always have to be grant DBA to Scott. So if you just need to change your permission on a table or a file or something, you can actually just use your SQL injection to do that versus grant in DBA because a lot of things as Mario's gonna talk about, a grant DBA across the wire or in memory might flag on some things. And it's fun just to grant DBA to your buddies too when you don't need it. So now this part, the nice thing about running using the framework is that we get a lot of access to other APIs to do some obfuscation of like variable names, function names and the name equals is just doing that. We kind of randomize the function name in what we declared as a function. The off ID current user as is pretty much just a run this as whoever invoked it. Progma, autonomous transaction. Again, this is just a cookie cutter, create a replace function. The Progma Autonomous Transaction is pretty much a problem that does a, if I remember right, it's been so long that I've done this stuff, man. A fork and join of the main process to the sub-process. It's been a long time since I wrote one of these, so I'm sorry. Then we just jump into our actual actual, we begin executing media at our foo and then return something. Fortunately, we're returning a zero because we want to return a number on top, but we're hackers, we don't really care about the error, we don't return shit, and then we end it. And then the actual vulnerable call to, or the actual call to the vulnerable package. Again, and this isn't it's assist LT, find a rick set, which I think the LT has to do with the workspace manager. The find a rick set procedure deals with versioning of a table name, and the injection happens in the first argument, which is the table name. The next thing we do is we actually throw our injection, we call it by calling our function, and then we go back and we try to be somewhat clean and remove any residue that we left. So we drop our function. And it's really simple, I mean, it's really, the SQL is like maybe all together eight lines of code after we've done all the hard, all the work has been done up front. So all you really gotta do is when you're auditing these things, just focus on the vulnerability and then you can own a lot of stuff. Anything else on that one? Yeah, the big thing for that is, as you create new, as you wanna port over the public SQL injection, that package is really the only thing that you need to change. Everything else is gonna stay the same, and you just need to change the package. So instead of having to worry about all the pro code, all the stuff that's handling all the disconnects, you just need to worry about the actual injection you're trying to exploit. So hopefully that's pretty easy for everyone as they, you know, fuzz all the things and look at the Oracle CPUs. That's all you have to change, one line of code. Oh, it's huge. All right, so everyone's probably seen this if you're familiar with the framework. And these are also the four things I talked about that we needed to connect. Set our remote host, so set our IP, the port, our user password, and the SID. And then lastly, we have that payload, our SQL injection variable of whatever we wanna run. So in this case, we're gonna grant DBA to Scott. Yeah? And so this is kind of what it looks like when you're running it. So again, we set our SQL. It runs, it creates the first function, which is gonna be some random function name. Perform the actual injection and then remove the function so we clean up. Some of that stuff will still be in the transaction logs, but we're not leaving anything hanging for someone to find later. Hopefully not. And so we can kind of see, did it work? It did, you know, now after the injection, Scott is now DBA, yay. We can start on with the other fun.  So, you know, in the previous slides, it was really easy to take some code.  The screenshot of pretty much is a screenshot of the base interface that SAR attacked. Actually what, you know, signature flagged, what function, what package or procedure was called and what, you know, what it did. That's not fun. That's not fun. So yeah, you get caught real fast doing, you know, pretty much, you know, hacking naked. So I kind of saw that, you know, I kind of put in a couple of examples in the framework to do just bypassing SNORT. They have some static signatures for this particular bug. Really easy, on the Metasploit side, we just kind of base 64 in code, our entire, you know, our entire function and then our call to the vulnerable package or procedure and then on the DBMS side, we use some UTL tricks to actually decode it. And if, you know, you read from right to left, we take the, you know, DOS, which, you know, it could be the package or the function name, whatever. We read that back through the base 64 decode that the decode library that database has. We throw that back in the string, then we go ahead and execute that. That works fine for almost any signature base IDS that's looking for these type of attacks. It's a little overkill. Anybody does real SQL can see that I'm not that good at it. I just don't want to get caught, so. Yeah, that works on a 10 and 11, not on nine. Oh, how to fix that. Well, I mean, we can add that evasion, but if anybody's familiar with the Centrigal Hedgehog Suite, it's like a database HIPs and they have an Oracle agent that it's really cool. It caught the exploit because it kind of decodes everything from memory. So, over the net where we came clean, but the HIPs just flagged us and gave up all of our access and, you know, and, you know, now their response seemed like, what the hell happened? Now we know who it is, when they did it, how they did it, and then what they did. Hang on this one. Again, I'm not picking on Hedgehog, I just, you know, that's what they claim they do this and they do that fairly well. But we can beat that stuff sometimes. This slide's probably the hardest slide for me to put in here because it's probably the most important. It just kind of brings back the essence. Before I even get into it, it kind of brings back the essence of, you know, what the Framick is about really. So on the main slide, you see there's like these three things. It's good for the pen tester, it's good for the researcher, and it's good for people who write signatures. Up to this point, you know, it's good for the pen tester and, you know, forthcoming slides is good for the pen tester, but this one slide is really why I wrote the stuff, was to actually find other vulnerabilities or, you know, extend other vulnerabilities and, you know, fuzz, and yeah, and so what it did it gave me a really quick way of doing this stuff. So again, it's Hedgehog again, we're attacking Hedgehog, and I think in 06, there was a CVE that came out for the DBS metadata package having SQL vulnerabilities. Then I think maybe a month, two months later, I'm not sure how long, but there was this pro script that actually exploited one of the functions in the package. So when I actually wrote that initial exploit that we were just pointing stuff over to make sure people had coverage for certain things, we ran, I ran this exploit against the Hedgehog and, you know, it saw it flawless, you know, but Hedgehog says that they're, you know, they're able to catch ODE and, you know, things like that. Well, even though it doesn't so much ODE, it's that there's other vulnerabilities within the same package that they're not covering. So I probably spent about, you know, using the new mix in and about, I don't know, an hour worth of scrubbing the actual contents of the package itself, with a quick little fuzzer, you know, and came up with like three other injects that for the same package that bypassed the HIPs.  Just coming through the network heckin' naked and it still didn't see me, although it did catch the Grand DBA, but the response seems, you know, they're like, what the hell causes Grand DBA? Which was some old, you know, injection flaw that they should have had covered for. Yeah, so nothing against Pete Finnegan or Alden and Corn Purse because they're all sharp cats, they do real DBA stuff, so. So this is kind of a list of the initial push that we put out and the respective CVs. That's by far not all the stuff we have. We just wanted to do initial push, let the community take a look at how we were doing this, how we were pushing out the SQL injection. What's in there is a good breath of regular SQL injection, cursor SQL injection, and some of those modules are using Mario's, I'll call it IDS evasion, but it's not totally IDS evasion, but it should give everyone in the community that wants to start porting the rest of that SQL injection the ability to take a look at those modules, change the one line of code that they need to change and push those back out to us and we'll push them back out into the framework for everyone to use. Oh, also that's a good, it covers both nines, both 10s and 11s, so you should have something to play with for whatever you've got in your lab. So some post, let's talk about some post-exploitation stuff. I think this one's mine. So we could argue whether the data is more important. I think in most cases, the data actually is more important to us, so if we're DBA in the box, we now have access to pretty much any table or any data that we want and if you're getting tasked to do a good pen test, this is where you need it to be because you wanted to show them I got access to this data. But using the sql.rb thing, we can basically run commands, we can check access, we can make sure things are working right. So data's nice, this is Metasploit, everyone loves shells, so I love shells, I love breaking in stuff, so several published methods that have been around a while for actually running OS commands on the database once you've got DBA access. So you can do it via Java, you can make some Java packages and classes, xproc backdoors, run OS commands via dbms scheduler, or I mean you can really roll your own, you can run any PLSQL or Java you want. And now with the post-exploitation modules we're pushing out, you can see that it's really easy just to write your own post-exploitation stuff. Use that, prepare exact method in the API to run whatever you want. So it's pretty powerful. So the first one we'll talk about is Win32 exec, this is actually in the framework now, what you need to do is grant Java's just privs to whatever user you're running as. From there we can run the Win32 exec module to just run OS commands, and that's via Java. So net user ads, you can TFTP your Trojan over, do FTP batch scripts, and I've also got a video out on the net of doing a net user ad to Metasploit and then if we're on the land we can do a PS exec to Meturpreter shell, which is pretty handy. Yeah, so that's kind of what it looks like. We set the command to whatever OS command we want to run, so we're adding a user DBA in the password, creates the class, creates the procedure, runs the command, and it cleans up, it's not in the screenshot, but those also delete the Java classes that we create there too. Anything to add on there? Yeah, I guess the stuff to take away from this is that it's cool that we got the data and if you're doing a pen test, the data's probably the important thing to show, but if you want to escalate to the network a little more, it's probably better to break out of the Oracle Sandbox and get to the operating system, and again, this is just one way of doing it. So some examples, some things you can do. You can echo over your FTP batch script via util file, and then you can use DBMS schedule to run some things and I did a video of this. It's on the Vimeo site, and the URL for that would be at the end. Just showing you some examples of some things you can do because Oracle's awesome and it stalls Perl with every install. On any kind of the NICS environments, you can actually just use the same util file and echo over Perl shell and then execute that. So that's something handy if you're on any kind of Unix environments. Good? Do you want to say something? Yeah, I did have a NICS variant of the Win32 exact stuff. It's not too clean because everything has to be at the absolute path of what you want to execute. It does work and you can use some server-sized scripting or decoding like UU-Inco, UU-Decode, to do a lot of nasty stuff too. So again, I'm a little paranoid when I hack, so. Evil. All right, so some other things we can do, external proc factors via directory traversals. So if you find yourself on an old Oracle box, you can actually use this method to just directory traverse out into either Windows land for MSV CRT DLL or a libc if you're on any kind of Linux environment or Unix environment. And we'll actually just allow you to invoke system commands that way. We'll be pushing that module out next week once I make sure that it's cleaned up and working. That's kind of what it looks like. You set the path to wherever your Oracle bin directory is, which you can use your SQL.rb module to actually find that out for you. It's just one quick kind of lookup. Just navigates out and calls it and lets you run your commands. Again, we're just using the net user add. Pretty simple, but sky's the limit on whatever OS commands you want to execute. Anything. Just showing that it worked, I added a Metasploit user. I also added him to the admin group, no big deal. Alex from a digital security research group who's actually put out a lot of SQL injection code. We've got a samex to a product back door. But in this case, instead of directory traversaling out, you can actually just copy the binary into your Oracle bin directory. So when Oracle patched the old vulnerability, it didn't really fix this one. This works on all the newer Oracle. So late 10Gs and Oracle 11 and 11.6 and 11.7. So works pretty good. And we'll be pushing that out as well. All right, so the guys from our genus back in 2005 pushed out some code that would actually allow you to grab a binary from a remote web server and pull that back down back onto the OS. And then we can use the Win32 exact module to actually execute that binary. We'll be showing you a demo of that in a second. Again, DBMS scheduler back doors. Alex sent that in. We'll be adding that to the send very soon. And he's not talking about this NCL one. Oh, yeah, I kind of alluded to this earlier.  I mean, all you really need is a user that has connect and resource privileges. And you just force using some CTX context.sys. Man, it's awesome because you don't really have to inject anything. You just need a valid account. And again, you don't get back to the database. You go straight to the operating system using pass the hash type of stuff. Yeah, Alex rocks. That's actually a really good attack. By default, Oracle will run a system. But a lot of people recommend to actually make it be an admin running as a different domain account. So this is a good example. Obviously, system doesn't have any domain cred. So your SMB relay is not going to work. There's no way to log into that. But if it's running as an admin, you can now do the half LMs and SMB relay type stuff. And he wrote actually a whole white paper on why you would do that. So I highly recommend you go read it because it's really good. And it's really, really slick. Never even thought of that and the way he did it. Yeah. Yeah, go ahead. Yeah, yeah. The instance is running as a domain user or a domain account. Yeah, that's when it works. By default, it'll go by system. And you have to go and click free that. So it'll run as like an administrator user or something like that. So yeah, it only works then, of course. But yeah. That's that special case when they've actually done some hardening. And it's not running as system. So some of those other tricks aren't going to work for you. Mario says no. So I'm going to listen to him. No, no, no. Oh, Will? Yeah, it will. I'm sorry, yes, it will. There you go. All right, so one of the other modules that Mario pushed out is a simple CGI scanner. So it'll help you kind of look for some of those vulnerable servlets and things that we were looking for earlier when we were trying to identify our SIDS. Just a little extra bonus. I mean, that's about it, right? Yeah, nothing special. OK, so I guess before we get into Chris's demo, the way ahead, again, it goes back to the researching piece of what the framework is about. The reason why I kind of wrote this stuff and was the same packages are vulnerable to overflows. It's not no secret that there's a lot of them out there. There's hundreds of packages that are executed by public. But under Windows, the point being is that, yeah, we have exploits for them. Eventually we'll push them out. I kind of got them scattered about. They're not really clean. So yeah, overflows where it's at. I'll add a little more to that, because what's handy about this is if you've looked at any of the POCs for a lot of the memory corruption bugs that get pushed out, they're kind of confusing to look at. And it's hard to reimplement that. So what's really cool about the mix-in and the stuff that Mario wrote is you don't have to worry about the setup, the connect, or any other stuff. If the mix-in is doing that for you, all you really have to worry about now is the actual string that's doing the overflow. And that's kind of what this slide is supposed to be showing you, that all the back-in stuff is now handled for you by Metasploit. You don't need to worry about all that. So you just need to focus on doing the vulnerability and exploit dev stuff. All right, so I have a demo. I'm a little gun shy, so I recorded it. Sorry. All right, so the first thing we're going to do is run the TNLSListenerVersion command, which is going to give you the version of the TNLSListener, which is usually the same as the DB version, but not always. Next thing we're going to do is try to do the sit-a-num. Because it's a 10 box, it's going to fail. But I just wanted to show what it looks like when you try to run it. So we got a listener protected, which we knew was going to happen because it was Oracle 10. Next thing we're going to try to do is try to brute-force the sit. I added in a sleep variable. So if you're doing this across the LAN, .1 is probably good. If you've got to go across a WAN, if you're going to go in after someone remote, you may need to link them that out to help us in false positives. Now we're doing the account brute-forcing. What's handy about this is it runs pretty fast, and we actually just left the output so you could see that something was going on, because sometimes it could take a long time over the net. And it writes all that out to a log file and your data wordless thing. So you can actually query that later to make sure that it's there. So you see we found two accounts. These are the two default accounts for Oracle 10. So DBSNP and Scott Tiger will go after Scott, because he's going to have the Connect and Resource privileges. So this is the SQL.rb module. This allows us to check our work, make sure that all the things that we found, the SID, and the account are actually working. And it just allows you to run simple queries. And then this is what Carlos is extending to do some of the admin checks. So we just fill in our gaps. The SID we found, the username and password, we're going to check his privileges and see what kind of permissions he has. So he's got Connect and Resource. So the next thing we need is we need to escalate him to DBA so we can do some fun things. So we're just going to use the LTFindRicksetCursor method. I did my best to put where I got most of this stuff. So if I miss something, just send me an email and I'll be happy to add it for you guys. Again, so we're just sending our SQL to grant DBA to Scott, filling in all the gaps. And that's it, pretty quick, creates the method, creates the function, executes it, and then deletes itself. Go back and check again, now he's DBA. To use all the Win32 exec and Win32 upload, we need to have the Java SysPrivs added, so we just do that real quick on the command line. So that's there. So the next thing we're going to do is we're going to do the Win32 upload, because I already had a demo showing doing it across SMB. You don't always have SMB access, so let's try to do it remotely. So we're going to grab a, we're going to grab a interpreter binary from my web server and write it to the C drive on the Oracle instance. I'm just showing that it's not there. You'll have to trust me. It wasn't. This is the remote box. It's actually going to catch the callback on the web server. So we'll just use the exploit multi handler to catch the callback. All right, so we're listening. We're ready to run it on the other end. All right, so it's creating the Java source file, creating the Java procedure, actually downloading the binary from the web server and putting it on the remote box and then cleaning up. So we delete all that stuff. And you can see it's there. Again, you'll have to trust me. I could have just put it there, but it works. Then we're going to use the Win32 exact module to actually execute the OS. What? No. You can talk to HD. I mean, he has that whole post and all those tricks of how to make them interpret a shell, not flag on AV. And so we called it math.itc, and so we're just running it. And then you can see it's running it and cleaning it up. And then on the remote side, we got the shell. That's it. Yeah, so what we've done is just, we just created an extension of the framework to do other stuff, just to help the pen tester and the researcher and hopefully the security community as far as the defensive side to do, to see some of this stuff that could happen, and it probably will happen.


Alright, what's going on everyone? Sorry about that, but Sam here with late in sports cards, and I'm ripping one box of 2020 Bowman Draft Baseball Sapphire Edition for Bobby K. So, good luck Bobby. Almost opened the wrong one, so glad that I didn't do that. That would have been bad. So, here we go. Let's do it. That's how I feel with like, cod and stuff at this point. Like, I'm so like, I just, my skill level is so behind where everybody else's is. It's like, why I love Fortnite so much in the early days, and like now I just, I just get absolutely destroyed by everybody. Alright, so, ooh, got Shane Bosz, got first of Carson Tucker, Christian Chamberlain, Jordan Westberg, got first of Cole Henry, Jay Groom, Casey Schmidt first, Kyle Nicklaus first, Ian Seymour first, Jeremiah Jackson, Alec Burleson first, JJ Bleday, Zach Daniels first, Brennan Davis here, I'm going to save the color for the end here as well. We'll do that, do that, and we'll go here, Jackson Miller, Jackson Rutledge, Takoha Roby, first of Liam Norris, J Dom, nice, Joe Ryan, Joe Ryan on the raise, like Rutherford, first of Jesse Franklin and T-Swag, got Brennan Davis, got CJ Van Eyck on the green to 50, nice one there, solid there, and we've got first of Bobby Miller, 62 of 99 on the yellow, nice one there, Bobby Miller for the Dodgers. Grats on that, all the hits there, Bobby, that'll do it for your box, and we'll get those cards right out to you.


So I think one of the hardest things to explain to clients is time. So I think time for a client means I want an answer today or I want an answer tomorrow. Unfortunately it's not like 48 hours or criminal minds are running your favorite law shows. This could be a while until we know exactly what's going to happen. But the longer the case goes on sometimes, the better outcomes we actually get. And kind of explaining it from the other side is I was formerly a prosecutor. Now when a case first comes in, it can sit on that desk for a little while. And we might not have an answer and we could keep harassing the state attorney's office, give us an answer now and it might not come right away. After they actually get the case, they then have to investigate it. After they go through and investigate the case, they have to make what's called a filing decision. Now but for major crimes in the state of Florida, these are done by paper informations. Now if it's a misdemeanor case, that could be 30 days, it could be 60 days before we even know if they're going forward on the charges. Now that means I want to talk to you right when it happens, while it's happening. And by doing that, I can then get ahead of the game and start getting a hold of the state attorney that's involved in your case so that we can at least get moving in the right direction and that could potentially be dismissing it right on the front end. So that case could end really quickly and it could be a short outcome. Now on the other side, if it's a major felony case that doesn't need a grand jury indictment, the state attorney's office has to meet with the police officers and the witnesses involved in the case. That again could take a month or two before that even happens. And that's before you even know if you're going to have charges filed against you. Once you have charges filed against you, you're going to have an arraignment date in another three weeks. You're not going to go to that because you're going to have an attorney there to represent you.  That's copy your police report, videos. Now at that point, you need to sit down with your attorney and you need to really understand what's going on with your case. And you could already be four or five months from the date of when this actually occurred. Now as we pick apart the state's case, we're able to actually see your defense and see your side of the story and communicate that with the state attorney's office. Now that's really important because potentially then we can get your case dismissed, we can get your case reduced, or we can make the determination that it's time to go to trial. And we're not scared to do that because we've taken the time at this point to really go through the facts. And we already know the answer. We already know you're not guilty.


My name is Russell Deop and I'm a PhD student in environmental ecological engineering and I am a black engineer. Prior to coming to Purdue, I did a campus visit where I noticed that there weren't any students of color or black students that I was introduced to in my department. That was one of the things that motivated me to come to Purdue and create a better environment. One of the things I'm involved in is that I versed in the inclusion committee through the Purdue graduate student government and Purdue student government and it's designed to implore Purdue to create more actionable items that foster a better environment for black students and students of color on campus. So one of the things the Diversion and Inclusion Committee that I'm on that I was working on is trying to recruit more students of color and African-American students because I go back to these communities and I see that a lot of them want to be athletes and entertainers but they can be so much more like doctors, lawyers, and engineers like myself.