Next Tuesday, Guidepoint Security is hosting yet another capture the flag event all online, totally free. Anyone can access the game and play and you absolutely should be there. I wanna see you on the scoreboard. So the game starts February 16th, next Tuesday at 8 a.m. Eastern time and it runs a whole week. It'll close on Monday, February 22nd at 5 p.m. Eastern time. The first person to solve all the challenges or to whoever gets the most points will win and take home a $100 gift card. There is one thing that I would like to emphasize though and that this capture the flag event is different than the previous ones that Guidepoint Security has put on. Yes, the challenges will range from beginner to advanced and difficulty but this time there will not be any walkthroughs for the challenges. Still have to do some critical thinking and problem solving the way that you always do as a real hacker. You can register online with the link in the description and once you're set you'll be emailed your secret passphrase to be able to log into the game, access to the VPN and you'll be off the races once next Tuesday, February 16th comes along. So I'm super excited for the game. Guidepoint Security has put out an incredible set of capture the flag events recently and I'm really looking forward to this one. I hope to see you on the scoreboard. In this video, I wanna take a look at the SkyNet room from TriHackMe. I am logged in on their website connected to the VPN and I have the room open up in my web browser here. You can see the description is a vulnerable terminator themed Linux machine. So I have joined the room and deployed the machine. I have the IP address ready here for us and we can go ahead and start to poke at this machine. I will hop over to my terminal where all the good stuff happens and I'll make a directory for SkyNet YouTube and inside of that directory I'll also make an end map folder so we can kind of store our end map scans and that logging in its own kind of custom designated location. So I'll go ahead and run end map to scan the box. I'll use tack v for verbose so that way I can see all the discovered ports as end map finds them. I'll use tack sc for default scripts, tack sv to enumerate versions, tack o capital N to output in an end map format. I'll throw it in that end map directory that I just created with the initial file name and I'll slap in the IP address or just paste that there. Now when we go ahead and run this we should see this end map running off to the races. Looks like it discovered port 445, port 139, 110, 80, 143 and port 22. Okay, so we already have a lot of good stuff to work with. I'll wait for this end map scan to finish which it just did. So I will go ahead and open up that end map scan results. We do of course see that port 22 for SSH. It is in fact a new Buntu Linux machine that we are up against. Looks like it's running Apache for the web server on that port 80 here and I can see references to Skynet repeatedly. Looks like that is the host name or the computer name of this box and it has seemingly a mail service up and running for that pop three Dovecott on port 110 there. Of course there is SMB open on port 445 so that might have some interesting shares we could look through but at this point I think we have enough to go off if we could go ahead and enumerate those web services as well as the SMB or Somba share because we won't have credentials off the bat to log in via SSH but we can go ahead and explore. So I will go ahead and start a Nikto scan along with a Go Buster scan to kind of have some enumeration going on in the background for us and I'll get started with a Go Buster scan in DIR or DIR mode with a URL specified with TACU. I'll paste in that IP address and I'll use the TACW argument to specify a word list. I will use the directory list lowercase 2.3 medium which is the default that comes with DIR Buster. So if I let that span, I should be able to go explore this manually on my own. I'll hop over to that IP address in my web browser and it looks like I'm greeted with sort of like a Skynet search engine. Looks a little bit like Google but I don't seem to go anywhere when I search anything or click any of the buttons, I'll hit control U to view the source in my web browser. You could have right clicked and selected view source but there's nothing really interesting here. Looks like this is just kind of flat HTML. I see just a CSS style sheet but of course that's gonna be static, nothing particularly useful or interesting there. So I don't know where more we could go off of with just that. It looks like we did have some interesting results from our Go Buster scan. I see slash admin slash CSS, JS config and AI. We can explore some of those. I'll go to slash admin but that looked like it got a 301 so it looks like I won't be able to access those things. CSS, same thing, JS, same thing, AI, same thing. So not a lot of headway in that direction. We should keep in mind though that we focus specifically on the HTTP service right now on port 80. There was however another port open and that was SMB. So we could explore that a little bit. Let me move down and explore with Enum for Linux. So Enum for Linux is gonna end up working like a great job to scan for SMB services. You could use something like or SMB share, sorry. You could use SMB map. You could use plenty of other tools. I like to use Enum for Linux as just kind of habit. I'll specify tack A to look for all tests or as many as it could. That's kind of just boilerplate habit at this point but I will slap in that IP address and I will also tee that out to an Enum for Linux log and I will let that cruise through and see if it can find anything interesting. Looks like it does see this Skynet target and it is a Unix server here running with Samba. Looks like it did find some shares, okay. It found print dollar sign and IPC dollar sign. Those are kind of boilerplate. You'll see those commonly. However, this Anonymous one and Miles Dyson are totally Adelaide field. Those are new and unexpected. So it looks like that is a Skynet, Anonymous share and a Miles Dyson personal share, okay. So that gives us some headway and it looks like now it's going to try enumerate users but we can start to poke at and explore these SMB shares. So you could do this kind of with your file browser. If you're using Nautilus or Thunar or whatever you could control L to get into the location bar and then type in like SMB colon slash slash to represent that SMB protocol and then you can access shares like just through your graphical user interface in your file browser. That would be fun. That would be cool. I won't do that. I will showcase the other rendition where we're just using SMB client. Ooh, actually looking back at our GoBuster scan I see that it found Squirrel Mail which is a new location that might be worthwhile for us to check out before we go look at those SMB shares. Looks like it is Squirrel Mail version 1.4.23 by the Squirrel Mail project team, okay. I am just going to open up another terminal and try and run SearchSploit on Squirrel Mail to see if it actually gets anything interesting or worthwhile from that version number. Okay, it looks like less than 1.4.22 there is remote code execution but we are on 1.4.23. So that probably won't get us a lot further. So we don't know a username and password here but we know Miles Dyson potentially might be a user. That's kind of a weird like share drive name but let's go ahead and just enumerate those shares, right? I'll go ahead and use SMB client. That anonymous share is very likely going to be something that we can access anonymously without credentials. Miles Dyson, if that's a personal share maybe that would require Miles Dyson's password but we can kind of go verify that and try that. So I will use SMB client with the IP address here and I'll specify the anonymous share. That doesn't seemingly have enough backslash characters. It's probably going to be interpreted as escape sequences. So I will wrap that in those single quotes. There we go. Now Bash would interpret it properly, right? It's gonna ask for my like workgroup slash John John being my username and password. That's totally fine. We're gonna try and log in anonymously. So I'll just hit enter here and it looks like it did connect. So if I were to LS or kind of like look around just list stuff in the current directory looks like I have an attention.text and a logs directory. So I will get that attention.text. There we go, that pulled that down and I'll move into that logs directory and also see what we have here. Log one, two, three. Okay, it looks like log one is the only thing with actual contents. Looks like everything else has a size of zero. So I'm just gonna get log one.text and that pulled that down, great. So now I can seemingly exit because there's nothing else in this share for me to look at these periods and parent directory to period just kind of refer to other folders but there's nothing else that I could really explore there. So let's go ahead and exit out of that and now let's cat that attention.text that we pulled down. It says a recent system malfunction has caused various passwords to be changed. All Skynet employees are required to change their password after seeing this. Roger, what about that log one.text?  That looks like potential passwords or like a password list, right? Random numbers at the end here all with kind of a Terminator Skynet theme, okay. Are these going to be passwords that we could maybe use to get into squirrel mail? Oh, thank you last pass. No, you don't need to save that password. Let's go back to the login page and we could try like a username Myles or Myles Dyson. Let's try, just grab this top one here. Myles, spit that in, loading. Okay, squirrel mail takes forever, which is surprising considering the name. Okay, nope, that failed. Last pass is off the races again. Let me try that Myles Dyson, spit that in. Oh, okay, that got it. So we kind of got lucky and then it was just the very, very first password. Truthfully, I would have written something to like brute force this. I will just mentally run through that if that's okay with you because I think it will just go to show really what's happening here. So whenever you have a form like this that you kind of want to brute force, yeah, you could do it with Hydra. I know a lot of people will probably give me hate because I don't like to deal with Hydra. The syntax makes my head hurt. I would just kind of whip this out in Python and that's maybe a fault of mine, but I can see that, okay, it takes a password as the input type, obviously. It takes a name and login name kind of as a password here or excuse me, as another input field and it submits it all to a form with redirect.php. So what I would do, honestly, rather than looking at that HTML code is I would just open up the developer tools. So I'll hit F12 and then I'll type in like name and password for these fields. There we go. And then this page here after Chrome goes crazy. Yeah, I know that's a bad password Chrome. This redirect.php like post request that's sent. You could go ahead and right click on that and just say, hey, copy as curl and then check this out. There is a curl to Python requests utility that does a really good job of just, okay, grabbing that syntax and then making it the Python code that you might want to use. Grabbing the cookie, grabbing the session information, grabbing the same header as the content type, user agent, et cetera, et cetera, et cetera. So that is kind of handy for what you're up against. I'll go ahead and mess with that now. Now that we have this log1.txt file, we can try like a squirrel mail brooder with a u.py. And I will just crank out user bin environment Python three. We'll have a URL. Actually, we'll just go ahead and slap in all this. We'll import requests and we will create a response object after we post to that page with the headers, the cookies, the data, et cetera, et cetera. We will need to however tweak the data because we're not just going to want to send it this static password every time. We're going to end up wanting to change the name and password as to what we're looking with. So I'll go ahead and import, I'll grab it from pprint. So I have pretty print from pprint import pprint. And let's go ahead and open that log1.txt. And I'll read everything out of it. This is super duper dirty, but I would just kind of do like a, oh, passwords is going to equal the contents of that, split on new lines, and then I'll like make it a list comprehension so I can do like x.strip for every x in that thing if there is an x there. So that way I split on new lines and absolutely make sure there are not going to be any new line characters in the contents because I've stripped them all out. And if it's an empty string, if it wasn't properly able to get a line or there was no line there, it will just go ahead and remove it with that if x. So at that point, if I were to pprint passwords, we should see all that spit out with all of our lines there. We just created a simple list grabbing everything from that and now we can work through that. So we know our username should be Myles Dyson and we could have finagled that with like Myles or Dyson or M Dyson or however you wanted to. But then we'll go ahead and loop for password in passwords. We can indent all this, go ahead and grab the response object but we'll need to change our name to our username and our password to be the variable password as that changes every time. So at that point, I'd probably wanna check like, hey, the return code. Is this actually going to give me a response status code that tells me I redirected or successfully logged in? We can try to see how that looks but I think we'll come to find out that Squirrel Mail is doing kind of weird things and that, okay, it's gonna give us a 200 every time whether or not we have the right password or not. So that's not all that helpful. Again, admittedly, this is also very, very slow. So if we wanted to really weaponize this we could probably make it threaded and maybe not have to deal with all the time it takes for Squirrel Mail to get through each of those responses. Anyway, let's go ahead and just grab the response.text and we knew when we failed to log in earlier it gives us this unknown user or password incorrect error. So I'll just go ahead and look for that string. I'll just do a simple like if unknown user or password incorrect in response.text then we know, okay, it's a bad password. So we can actually test if it's not in there. And then if that's the case, we'll go ahead and print out the password that we found and like, hey, we found it or something. Potential password found. And like, that's all we need to do. Now, obviously, because we know, oh, it's the first password because we sort of went through that manually and we just got lucky. Sure, that would really not be that helpful for us because it spits it out immediately. But if we were doing something else and it was furthered along in that word list, you could have a display out over trying this password and then, okay, we finally found this one eventually. So you could run that in the background if you wanted to. But that was it. Sorry for that fire hose tangent, but that was how I would spit ball just slapping that together in Python. Anyway, let's get back to our good friend Squirrel Mail. We will grab that correct password to log in and we'll hop over to Miles Dyson, pasting in that password there. Okay, now let's be creepy and read his emails. So he has a from Skynet at Skynet. Looks like it's a Samba password reset. Ooh, we've changed your SMB password after the system malfunction. And now we have this password that you could use. Okay, so we wanna use that maybe for his SMB share password. And then there's binary and this other thing. I'm just gonna be cheap and go to askyoutohex.com to try and see what that decodes out to. This is when you know you're legit. This is when you know you're a real hacker when you're using askyoutohex.com. Balls have zero to me, to me, to me. What? I have no idea what that is or what that's referring to. I don't know what I can, I, I, everything else. Is this like the system malfunction? Is this some terminator reference that I don't know? That's probably it. I actually haven't seen the terminator movies. Don't hate me. I'm not a real nerd. Okay, now that we have Miles Dyson's SMB password, we can go try and connect to that SMB share. We could have tried to log in anonymously earlier and maybe that would have got us somewhere. I'll use that SMB clients to this IP address. I'll slap that in. You got your stinkin' HTTP schema. I don't want that. Miles Dyson was the name, but if I just try and hit enter here, okay, yeah. We would have needed a password for that. Let's grab that. And if I try to connect with this, obviously it's thinking that I'm the work group John user, but no, I want to go ahead and be Miles Dyson. So we'll specify that as a user with that capital U. Now trying that, I don't know if that'll let me in without specifying, oh, the host name. Okay, looks like it just did. You could very well have just entered like Skynet forward slash. And that will specify the host name or a domain name if you're using like a domain user at some point. So then just slapping in that password, pacing it in. Now we are connected and it looks like we have some stuff to look at. Oh, there's a lot here. Can I make that relatively visible without obscuring what's actually happening? No, I see a lot of PDF files. And I don't know if those will be all that useful. It's like improving deep neural networks. So good luck. Natural language processing, building sequence, neural networks, et cetera. That doesn't seem all that useful. There is a directory notes though. Let's hop into notes. Ooh, and now there's more markdown files. These all look like, like a genuinely, literally a person's notes, like when they're studying for a test or something or for some course foundations, not only your dynamics. Just a bunch of markdown files. Oh, there's an important dot text. Ah, okay. Let's get that important dot text if that is seemingly important. And we can try, can I am get all these things? Yes, yes. Oh, do I have to enter Y the entire time? I genuinely don't need all these things. I'm gonna remove all those markdown files. Okay. Now we have important dot text. So let's see what's in that. Add features to beta CMS slash four, five, KRA24Z7, blah, blah, blah. That might very well be a web location or like part of a URL. I can kind of, I think so by that forward slash. Work on T80 model 101 blueprints and spend more time with my wife. Yeah, that makes sense. That math checks out. Let's see if we can access that as like a location. We can. Okay, Miles Dyson personal page. Dr. Miles Bennett Dyson was the original inventor of the neural net processor. Let me, let me, is there any links on this page? No. Okay, let's try and go buster that. I already have many, many terminals open. So let's run that same go buster with that location there. Just slapping in that path and let's run that one more time. We'll see if it gets anything interesting and then I'll keep poking around. Miles.jpg is just the picture. I don't think there'll be any like wacky steganography in that. But there's nothing else on this page. We could try like slash admin. No. Any CSS? No. Backups? No. Is there like a dot get directory or robots.txt for some weird reason? No. And go buster hasn't found anything. So what is that? Just a dead end. Did I just like find this for no reason? What do I do with this hidden page? Ooh, ooh, ooh, ooh, administrator. Okay. Let's get to administrator. Kappa CMS, use a valid username and password to gain access to the administrator. I don't wanna print that, sorry. Can I use the same credentials I had earlier? I don't think I had that saved. What was that password? Oh, I mean, we could use the one from the squirrel mail email. No. Whatever. Is this thing just like inherently vulnerable to anything? What is Kappa CMS? We could Google that, but I'll just check search sploit super quickly. So search sploit. Kappa. Ooh. Kappa CMS alert config field.php local remote file inclusion. Ooh, remote file inclusion. And it looks like it's just that thing. So let's search sploit tack M to get that in our current directory. Good. And now let's go ahead and sublime that to see what this thing is. Kappa CMS file inclusion back on 2013. This is PHP code injection. What? PHP include request URL config. An attacker might include local or remote PHP files to read non-PHP files or read non-PHP files with this vulnerability. Oh, wait. PHP code in this file will be evaluated. Non-PHP code will be embedded to the output. So it can just run PHP code. Well, that'll get us server side, like code execution, right? So all you need to do is seemingly do some like climbing the file system tree and then we end up reading its set repassword or like a location that we want. Oh, and you could do some PHP streams to get like a base 64 encoder representation. Oh, that's slick. Okay. So let's grab this. And I'm gonna throw it in another directory here because I know that we're going to need to grab the actual location of this thing. This administrator that should go to alerts alert config field. So this is the string that we want, right? With our appropriate IP address, our location for Kappa and trying to read its set repassword as little proof of concept. So let's curl that and let's see if we get anything juicy. Ooh, we do. Okay. So we just flat out read. Set repassword dope. We could read the configuration file or we could see if it actually will run PHP code. If we're using remote file inclusion, then we could just like change this to call back to us. So if I were to, what is, if I were to like try and set up my own web server and connect back to it, I could see if that will work. What is my IP address? AP, I guess 10 zero, it's this thing. 10.6.5685. So we'll slap that in. I'll listen on port like 8,000 and then I guess we'll just go for like a pock. And I should actually make that a PHP script. So let's make a directory dub, dub, dub. And now let's subble like a pock.php. We'll just include PHP tags here and then run like a system function. So I can see if I can run command execution on that target. I'll run who am I and I'll use Python tech mhtp.server to spin that up. And now that that is running over there on the side, oh goodness, we have a lot of terminals open and we really don't need them. We'll host that over there and let's see if I would run that curl command to go back to my location. Will it download that? Oh, I need to actually include the curl command. That would help. So it's gonna call back to my machine where I'm using Python to host http.server. So on port 8,000, I'm hosting a little web service and it can grab poc.php. And then theoretically, ooh, it will hit it, which it did and it would run the who am I command and we can see the output of dub, dub, dub data. So we do in fact have code execution. Okay, awesome. So let's now try to get a reversal because if we have server side code execution we can kind of control that machine. So let me, I'll just do like a simple netcat on quad eight and I will copy over the PHP reverse shell code. If you don't happen to have that lying around the PHP reverse shell code is something you can find on pentasmunkey.net. I've heard complaints that like Pentasmunkey was down earlier, oh goodness, can I just go to the site please? Oh no. Okay, that's being weird. PHP reverse shell. Okay, they have it here on GitHub. There you go. PHP reverse shell dot PHP. And this is the exact same code. All you need to do is change the IP address and port to your IP address. So I will grab again my IP address, slap that in there and quad eight is where I'm gonna have my netcat listener running. Good. So at that point, I should be able to just have it request rather than the pock dot PHP. We'll go ahead and grab that PHP reverse shell dot PHP. And then back in my terminal, I should be able to curl that location and it will invoke the PHP on the target that will call back to me theoretically.  That would be why. It didn't call back and I was like weirded out because I didn't actually start the HTTP service that was hosting that PHP reverse shell. So let's run that now. Make sure our listener is up and running and we will go ahead and curl that. There we go. Saw the request in our HTTP server and have our shell callback. Okay. Let me go ahead and stabilize the shell. So I'll use, do I have Python actually? Let me, which Python? I do. All right, Python, taxi, import, PTY, PTY dot spawn. Pin bash. I should be using Ponecat for this in all honesty. STTY raw minus echo. Gosh, I haven't typed these commands in so long because I just, you've been using Ponecat. We'll export term to X term. There we go. Okay. Now we have a full shell. Ponecat is in a little bit of a development phase. We're testing new things. So I'm not using that for the moment because people are gonna be angry. Like how come it works on your computer and not on mine? So let's go into the home directory and see what we got here. We got Miles Dyson. We did land as the www data user though which isn't extremely helpful because we probably need to privilege escalate to do something better. But we wanna see if we can grab this user dot text flag or prove that we have like local command access. So let's change directory into that Miles Dyson friend here and he does have a user dot text in here. Can I read that? It is world readable. Okay. So let's just simply cat out that user dot text and there we go. We have that flag to submit. Now we sort of need to be able to privilege escalate and see what we can do to become root or this Miles Dyson user. Can I pseudo attack L? Nope. I need a password which I don't have. Let's just try and run Limpies. So I will hop over to my shared memory directory or dev shm and I am going to actually use this Python web server a little bit more but I'm just gonna copy over Limpies and put it in the same directory so that way it's still currently being served. That way I can go ahead and W get a HTTP colon slash slash of that IP address and port number for my machine and we'll go ahead and grab that Limpies.sh. Take some time to download that. Good. Now it's on the target. I can go ahead and run it and let's see if that gets any good stuff. Limpies is cruising. We'll take a break. We'll take a quick drink break to let that finish and we can start to kind of look through some of this output. Limpies is super good though because it will give us that legend or color key as to the things that are very likely a privilege escalation vector and we can start to cruise through here. Kernel version Ubuntu 16.04, old version of Pseudo. Ooh, CVE-2021-3156, am I right? Processor information and things. A lot of useful software there. We have GCC. Also have LXC, that's kind of weird for containers. A lot of processes running. Nothing extremely interesting with that for the moment. Cron jobs. Oh, there is a root Cron job. Cron hourly, Cron monthly, Cron weekly. Ooh, and there's an entry in here. Oh, every minute, root runs home miles Dyson backups backup.sh. Oh, that was in the directory and I didn't even pay attention to it. I didn't even see the thing. Well, that's gotta be useful, right? All right, let's stop Limpies and let's just go look at that home miles Dyson backups. Backups, LSTecLA. I didn't even look in share mail and backups. I was just cruising right through it. Oh yeah, backups is owned by root, that's kind of weird. It is world readable and executable though, so we can go ahead in there. It also has a backup.sagescript, which we just saw from that Cron job running every minute. Root is gonna run this script and a backup.tgz. I cannot modify that file because it's owned by root and it doesn't have right permission for me, but we can read that backup.sagescript Limpies, go away. So we'll cat that out. Looks like it just starts a bash script, right? That's all it is. And it changes directory into var www.html. So the web service and it tars, it creates a tar archive outputting to, oh, this backup.tgz every minute we saw from that Cron job and it uses an asterisk here. Ooh, that backup.tgz was created just today. So that time is different than all the others, right? So we know that that's actively being used, that Cron job is working. So with that syntax of this cat, with this backup.sagescript here that we cat it out, var www.html has all the files that are being included in this backup.tgz and it's tearing it all with a wild card. So maybe this comes from like the familiarity and just, I don't know, the exposure or some of the stuff because I play a lot of these silly games and try to get internet points that aren't real, but the asterisk and the wild card using the command line can be abused. So in var www.html, it's gonna be globbing all those files because of that asterisk, but we might be able to make that messy because we could inject quote unquote or put in place some command line arguments for the tar program. And tar can be used as a GTFO bin or some like living off the land native binary to UNIX and Linux that will escalate our privileges or do something interesting. So that's a known thing and a known technique and I'll Google that and show you that if you do tar wild card exploit. Yeah, yeah, yeah. Exploding wild card for a privilege escalation right here and I'll show you a little bit of kind of what this discusses. We'll cover wild card injection, talking a little bit about it here, wild cards, asterisk, question mark, brackets can be used as well. So here they show this example, right? They create some directories. We create a file here, file one and file two and we also name a file, tack tack help. It's weird, but we're naming a file. That file has the file name tack tack help. So when you try and cat those out, you're the same way you would as if the wild card was being interpreted.  So you can use this with other programs that are obviously going to end up being much more dangerous than simply cat or the tack tack help argument but he goes through an example where he showcases, oh hey, I have all these files in my current directory but I'm gonna make them be owned by someone else because we know the chown or chown command is gonna be used. They use tack tack reference to indicate, hey, that's actually going to change some all the other files you suggested back to a different file that is already specified. So they're using that my.php example here and that way all of those files previously owned by Raj or RHA are now going to be owned by Ignite because of that tack tack reference file. It used that myphp which was owned by Ignite and that just got sprayed to all the other files. Very cool, very neat, that's the idea but they do showcase a similar example here using tar running every minute in the cron job, running backups with an asterisk file. So that's kind of exactly what's happening. They showcase this example, they're using MSF Venom. We don't need to use MSF Venom because that's gonna take a lot more time and be more clunky than we need to but what they do is that they create a other shell script, can this thing stop? There we go, that was really annoying that it just kept, and that won't even expand.  Can I copy all this maybe? Copy, what? There we go, okay.  Our code, we have bad malicious code or whatever we want to run put into our own shell.sh script and then these arguments or these new files we're creating checkpoint action exec shale.sh. It's going to run this script that we've specified and these checkpoint action arguments are arguments to that tar program and it's gonna actually run them with this checkpoint equals one setup. So then when this tar command is actually executed and we aren't gonna run this manually we don't wanna run this ourselves because that's going to end up like running with the same privileges as our current user of dub dub dub data. We want to let root run this because root is running it every minute because we've set up these files and they're in place in the current directory that wildcard will expand them and it'll interpret them and tar will execute this stuff and that way our malicious shell.sh or whatever file name or code we wanna run it will be executed as root and that is how we can escalate our privileges. So what I will do and you guys know this kind of technique that I love I'm gonna check out bin bash. Bin bash is currently owned by root and it's just a regular binary but I love, I love and this is way too common for me I do this all the time because it's so quick and easy. Don't need to get another reverse shell don't need to spin up MSF venom. I'm gonna have root make bin bash be a set UID binary so that way I can just invoke it and become root as needed. So if I were to run bin bash right now it puts me in a sub shell like it doesn't look like anything changed but if I were to try and exit that's cause I was in a sub shell. When bin bash is a set UID binary if I invoke it with tack P I could run who am I and I would have the privileges of the user that this file is owned by, right? That's what the set UID privilege will allow us to do. Right now it isn't set UID so I'm not root but since we can weaponize and use this tar exploit or this tar wild card expansion do that that's what we'll do. So, all right. So let's simply use printf to get a shebang line in here and I'm gonna use single quotes because I know that this hashtag octothorpe is gonna be a problem for bash. So I'll specify my shebang line and I'll use a new line here and that's why I'm using printf cause I don't like to deal with it in bash or sorry in echo and then we'll go ahead and chmod plus s on bin bash. There we go. And once that is executed every minute we should see that bin bash is gonna be marked as set UID. So that way it will be executable for us and we can run as root. Then we'll go ahead and create all this all these files that are necessary for tar and we will not run this tar command on our own but we'll wait until the clock strikes a new minute and that way we should be able to run bash as needed and do our privilege escalation. So let me check this out in a linear fashion. I'll run LSTACLA bin bash. I'll check the current date and time looks like we have 46 seconds into the minute. So I have eight seconds left. We gotta be quick. We'll spit that in. Oh, actually I was wrong. We can't write currently in this backups directory. Don't forget that backup.sh is running out of CVAR www.html. All these files it's pulling are in that current directory. So we gotta hop over to that directory. Good. Now this directory is gonna be owned by www.data because it's the website directory. So if I were to check the date one last time let's check our bash set UID. It's not set UID, we got 30 seconds. So let's slap in the shell.sh. Let's create that checkpoint action and let's create this checkpoint file. Now if I were to LS, we can see all those exist. I'll check the date. We got 15 seconds left. Let's run another LSTACLA on bin bash to see if we've changed to a set UID binary. We haven't yet. We're still waiting for the minute to come through. So I'll use date one more time now we're totally past the minute and just a hot second LSTACLA bin bash. Now we should be able to see that that is a set UID binary. Perfect, okay. We've done our privilege escalation at this point and we can just invoke bash as root bin slash bash tack P. It's a set UID binary now. So I am in fact root. Very cool, very fun. That was a blast. I like seeing that tar wildcard expansion. So let's move into that root directory and let's grab that root.text. There we go. We can go ahead and submit that. And at that point, we have everything that we needed for this room. We found Miles password. We did that with a little bit of brute force sort of with that squirrel mail. We found the hidden directory by exploring those SMB shares. We saw the remote file inclusion that we could use with that Kappa CMS and that's how we got our PHP injection in. We landed as wwwdata to get kind of low privilege access and command like remote code execution, a shell that gave us our user flag and we just prevessed with that tar wildcard expansion to find the root flag. And that was that. Oh boy, this turned into a super long video.  I hope that you had just as much fun as I did. I've been screaming and recording doing this for a little bit way too long. So my voice is kind of falling apart here. But thanks so much for watching everybody. Hey, please do tune into that guide point security CTF. You can see the promo for that at the beginning of this video but I hope you enjoyed this video. I hope you're excited for more because we're gonna do a little bit more. We're gonna keep in coming and please do all those YouTube algorithm things. I'd love to see you subscribe, maybe leave me a comment, maybe like the video. I'm super duper thankful. So thanks so much everybody. That is the end of the video. I'll see you in the next one. I love you. Take care.


Remember, all the way back in the beginning of the semester, I introduced the concept of theory of mind. This is the capacity to impute the mental states to self and others, and to predict behavior on the basis of those states. This is according to one of the, two of the earliest psychologists who coined this term. The anthropologist, Robin Dunbar, says that having a theory of mind means being able to understand what another individual is thinking, to ascribe beliefs, desires, fears, and hopes to someone else, and to believe that they really do experience those feelings as mental states. Now, this might seem obvious, but the opposite of this would be just to look at another person as if they were a machine who just, you know, you press the right button, you'll get the right result. But people aren't like that, people are complicated. You know, I might have said something that someone misinterpreted, and I can't just assume, well, this is what I meant, so that's all that person should think. I have to realize, okay, that person doesn't know what I meant, so I have to see, how did she interpret the thing I said, or how did that correspond to something I didn't know at the time that she did, that she think I meant this when I actually meant that. It's very complicated, and it's something that we have to be able to do skillfully in order just to communicate with each other, but also in order to coordinate action, to be on the lookout for people who might be trying to cheat us, or lie to us, or something like that. But of course, to lie, you also have to understand theory of mind. You have to understand what people are thinking, what they know, what they don't know, what they believe, and if those beliefs are right, and then what they'll do under certain circumstances. And when we read, this is something psychologists and social scientists like David Comer-Kid and Manuel Castano have pointed out that when we read literary fiction, we develop that ability to use theory of mind several levels beyond what we would need to do in order to just have a conversation, or to talk about somebody who's not there. We have to understand people as their fictional people that are trying to understand other people who are trying to understand other people. So literary fiction really disrupts our expectations. It doesn't go the way we typically think things ought to go, but we also have to understand how those characters understand what's happening to them and what's going on around them. Now, a scholar who has done a lot to get literary theorists or literary critics to look at how theory of mind works in literature is a scholar named Lisa Zunschein. And she's written a book called Why We Read Fiction that tries to apply theory of mind as a tool for reading fiction. And she points out how well this works when we read 19th century and 20th century novels by Jane Austen or Virginia Woolf where people are trying to understand other people and they're trying to understand how other people understand other people and so forth. But in order to get to this, she seems to need to dismiss the use of theory of mind in older texts, in particular Beowulf. And she says that it may not be possible for the Old English poem Beowulf to embed multiple levels of intentionality. In other words, multiple levels of theory of mind. It may never be able to embed more than three levels of intentionality. In other words, that thing, when I think of what somebody else is thinking that's one level of intentionality, she says that Beowulf probably couldn't do more than three. Well, keep in mind, I first introduced this concept with Atrahasis. This is one of the oldest texts it's ever written and in order to understand how Inky gets the gods to remove the Sarupu disease and get the gods to remove the drought, Inky has to get Atrahasis to get the god Adad to unlock the bolts that are holding back the waters.  And so he's thinking about what they're thinking but to get them to think that way Atrahasis has to do this but to get Atrahasis to do that, Inky has to do this. So we have at least four levels of intentionality in a 4,000 year old work of literature. But Zunchan doesn't think that Beowulf can get beyond the third. And there's this instance when Freywaru, the daughter of Hajjulakun Waltheo is introduced. She's introduced at a time when Beowulf has already left Hrothgar. He's left Haorat. He's gone back home to the Geatland. He's talking to Hajjulak, his king and he's telling him what has happened. He's sort of giving him the news of, well yeah, I defeated Grendel and I did it this way and oh by the way, here's what's happening in the world right now because they don't have news. They don't have the internet. They don't have newspapers. So he is bringing news of what's going on there in the land of the Danes. And one thing that's going on is that there had been these wars between the Danes and the Heathabards. And the Heathabards live in this area along the coast of modern-day Germany. So the Danes are up here on the island of Zealand. The Heathabards are right here and they've been at war with each other. And this war, they've reached a truce but like any truce, it's liable to fall apart at any time. So Hrothgar gives his daughter Freywaru in marriage to the king of the Heathabards, Engeld. So these are the two enemy kings, Hrothgar and Engeld. And Hrothgar thinks, okay, we can keep this peace, make it last if Engeld marries my daughter and she can become a peace weaver. She can have an influence over Engeld and make sure that Engeld doesn't overreact to things that the Danes and Heathabards do and so he doesn't fall back into fighting.  And Beowulf is explaining this to Heijulat. So in line 1785 to 93, Hrothgar's daughter, Defroda's fair son Engeld, that maiden is sworn. This match seems meat to the Lord of the Shieldings who looks to settle his Heathabard feud. So that's what's happening in those lines. Beowulf wants Heijulat to understand that Hrothgar thinks Engeld will feel less hostile if he marries the Danish princess Freywaru or Freywaru could be a peace weaver. So we've got four levels of intentionality right now just in this description. Now it could stop there. We've got, if Beowulf was this sort of simple-minded in the poem as he is in the movies and the TV shows if we had like the action-packed CGI Beowulf, he might say that, well, I think Hrothgar's trying to set up peace but I don't think it's gonna work. I think Engeld might change his mind. Engeld might marry Freywaru and he might go to war anyway. That would be an explanation but it wouldn't be a very complex explanation. Instead, what Beowulf in the poem does is he says, yet, despite Hrothgar's plan, the best of Bride's seldom has stilled the spears of slaughter so swiftly after a sovereign was stricken. Engeld and his earls will be rankled. Watching that woman walk in their hall with high-born Danes doing her bidding, her escorts will wear ancient heirlooms. Heathabard's swords with braided blades, weapons once wielded and lost in war along with the lives of friends in the Frey. In other words, we're not just gonna send Freywaru when she marries Engeld by herself.  People who used to be fighting now they have a truce and remember when you fight this other group and you kill somebody, you take their weapons and armor and this was true in the Iliad, this true in the Aeneid, it's true now in Beowulf. So they're still wearing that armor, they're still carrying those weapons that they took from the dead Heathabards and now they're going into the Heathabard court. That could make some people angry. And specifically, Beowulf says this, I'm the ring hilts, the swords. An old ash warrior, ash being the wood in a spear, so this is an old spear warrior, will brood in his beer and bitterly pine for the stark reminders of men slain in strife. So you've got this one Heathabard who's watching this new Danish princess and her honor guard come in and they're wearing these weapons that he recognizes and he's angry and he wants to get revenge on them but he's just an old man, he can't do anything by himself. So he will grimly begin to go to young soldier testing and tempting a troubled heart. His whispered words making war evil or waking war evil and he says, this old Heathabard says to this young man, this young Heathabard, my friend, have you spotted the battle sword that your father bore in his final foray? Wearing his warm ask, wither guild fell when Foman sees the field of slaughter. Wither guild was one of these Heathabards who was leading this charge and it was cut down and this young man's father would have also been cut down as well and his sword, his priceless blade became battle plunder.  And so this old man talking to this young man pointing to this Dane who's carrying this young man's father's sword. This old man will prick and peek with pointed words time after time till the challenge is taken. The maiden's attendant is murdered and turned, blade bitten to sleep in his blood, forfeit his life for his father's feet. Another will run, knowing the road. So on both sides, oaths will be broken and afterward, Ingell's anger will grow hotter, unchecked as he chills toward his wife. So notice what's happened here. That he concludes here by saying, hence I would hold the Heathabards likely to prove unpeaceable partners for the Danes. In other words, he could just say that Hrothgar is trying to set up his daughter with Ingell so that they'll be peaceful, but I don't think it's gonna work.  Maybe they'll just start fighting again. That would be too simple. He's thinking about how this hypothetical Heathabard, this old man, is going to manipulate this other hypothetical Heathabard, this young man, whose hypothetical father was killed by the father of this hypothetical Dane who's attending Freowaru. Here's our old Heathabard. He has to figure out a way to get Ingell, the king, to turn against the Danes so that they can kill these Danes who are now there guiding Freowaru into their hall. So how does he get Ingell to turn against these Danes with whom he's got this truce? Well, he's not gonna do it directly.  So that means he's gotta get this young Heathabard to attack this Dane. In particular, it's a Dane that has his father's sword. Now the implication is, this isn't even maybe the Dane that killed his father. This is the son of the Dane that killed his father and has inherited this sword, but the sword came from this Heathabard who's not dead and he's the father of the young Heathabard. So notice, this old Heathabard has to keep in mind what Ingell's thinking, what the Danes would think under a certain situation to get them provoked. He has to provoke this young Heathabard and he does that by saying that this Dane with your father's sword thinks he's better than all the rest of us. Look how he's strutting around the hall. So he's gotta get the young man to think of his father, to think of the Dane who has the sword to kill this guy and then run so that the Danes will pursue him and then when the Danes want justice against this young Heathabard, then the Heathabard king, Ingell, is going to then turn against the Danes and then go back to fighting. Now that's a lot to keep in mind. That's a lot of levels of theory of mind right there, but remember, this is Beowulf trying to get Hygelac to understand that Ingell is gonna turn against the Danes because of this old Heathabard who's doing all this. And add to that, that Hrothgar doesn't see this coming. So remember theory of mind isn't just knowing what other people know, it's knowing what they don't know. So we have to think that this is the kind of thing that could happen, but Hrothgar is still thinking, oh, as long as Ingell marries my daughter, everything's gonna be fine. Beowulf has to get Hygelac to bypass Hrothgar, to keep in mind, here's what Hrothgar thinks, but here's why Ingell might think something different.  And of course, all this is happening in a literary text which was written by a poet who's trying to get his readers or his audience to understand that all of these things are happening. And then when we go back and read this, we know that the poet is trying to get us to think that Beowulf is trying to get Hygelac to think that the Heatha Bards, you know, on and on. So once we factor in the audience and the poet, we have 10 tiers, 10 levels of meta-representation, levels of intentionality or levels of theory of mind here.    And in order to understand that, we have to follow his thinking as he gets Hygelac to think about how King Hrothgar might not see this discontent among the soldiers, among the Heatha Bards and among the Danes that could erupt and it could erupt in this particular fashion. He sort of sets up all these dominoes and says, this is how the first domino is gonna knock down the rest of the dominoes. This is how this whole fabric of theory of mind is interlaced and you pull one thread and it's gonna pull loose everything else. So this is, I know, an extremely difficult part to sort of figure out when you're reading this, especially when you're reading it in this sort of alliteration. But keep in mind, if you take a college class in Old English and you try to learn to translate Old English, you've gotta figure out, okay, what's the subject of the sentence and what's the verb? This is one of those passages that's very difficult, but it also tells us something about people at this time. Theory of mind, understanding how other people think, understanding how entire social groups are woven together and can be unraveled and re-stitched together and sometimes with positive or negative effect, that takes a lot of social intelligence. And this is a type of text that really does push us to try to push our own social intelligence to its limits a lot of times. Now I mentioned that Wallpheo is trying to weave peace when she's there with Beowulf and Rothgar but also Rothulf, who is Rolf Krocky. We have her trying to weave peace that the audience knows. This is an allusion to the fact that something bad is going to happen. So let's look back at these lines. Look at the first line, 891. Many a mead cup, those masterful kinsmen, Rothgar and Rothulf raised in the hall, all within friends who filled Harorot, treason and treachery not yet conceived. Well, that last line lets us know that treason and treachery will, at some point, be conceived. There's going to be a problem between Rothgar and Rothulf. The poet doesn't explain this, he just expects that we already know that. Then wearing her circlet, Wallpheo walked where uncle and nephew, Rothgar and Rothulf were sitting in peace, two soldiers together, each still believing the other was loyal. So again, a little bit of theory of mine, a little bit of foreshadowing of something bad that's going to happen. Somebody's going to turn disloyal and we're not even really sure who it is at this point. But each one thinks the other is loyal. We don't have really an implication that it's Rothulf that's going to be the problem or it's Rothgar that's going to be the problem. And Wallpheo says to Rothgar, with Rothulf right there, so everybody can hear her saying this, she's trying to act as peace weaver, she's trying to maintain this friendship. She says, I know that Rothulf will honor our trust and treat these youths well, her sons, who stand to inherit the throne. If you have to leave this life before him, in other words, if Rothgar dies before Rothulf, I'm counting on Rothulf to recall our kindness. When he was a child and I'm counting on him to repay our children for the presents we gave and the pleasures we granted. In other words, I'm hoping he's not going to take over the throne and harm our children in order to do that. So she sees a problem coming. She's acting as a counselor, she's acting as a peace weaver, she's acting as somebody who sees something that maybe even Rothgar doesn't see the potential for. Rothgar believes that Rothulf is loyal, he doesn't conceive of any treason or treachery. Wallpheo does, she sees danger coming, she's trying to stop that danger hopefully before it starts. But unfortunately, as the poet sort of implies, the audience knows that unfortunately that's not gonna work out, something's going to happen. Now, this is the same guy that is Rothkraki in Rothsaga. We know he's going to become a king over Herorat or Lidar. He's going to have his champions, he's going to eventually himself be defeated. But we don't really know the difference here, we don't really know the disparity, what actually happens between the two. That all is sort of lost in the text that we've lost and we don't have to sort of fill in those gaps. But that is our connection to, between Beowulf and Rothsaga, that's one of these. We have this character in common and once we've identified that similarity, we can identify some disparities. For one thing, Rothgar is mentioned in Rothkraki's saga, his name is Rohr and he's actually king in Northumbria in Northern Britain. So there is no treachery seemingly in Rothsaga, but then again, there's a lot of time and space separating Rothsaga from Beowulf. So do they both point back to the same time period? Yes, they seem to point back to the sixth century of the common era. Do they tell exactly the same story? Well no, not exactly, there are some differences here. So we can't totally reconcile the two things. But we can see them as part of this larger tradition and that's what I'm going to talk about next time when we look at these, Rothsaga, Beowulf and the other Icelandic saga that I asked you to read, six chapters from Greta's saga, all of these being part of the Bear's Suntail or at least a descendants of that Bear's Suntail.


Hello, I'm Delia Pitts, I'm happy to be with you and introduce you to my private eye noir series, The Ross Agency Mysteries. I've written five books so far in my series and I'm very excited that the sixth book in the series, Murder Take Two, comes out in February 2022. I want to tell you a little bit about the series as I've conceived it. I think of it as aimed at readers who like hard boiled stories, but are looking for easy to love characters. And that's what you'll find in this series. You will follow the exploits of a private eye in contemporary New York City, a Harlem based detective agency is where Rook works. And he works alongside two colleagues of father and daughter duo, the Rosses who are tough, dynamic and pretty handy with a gun as well. The Ross Agency's mission in their neighborhood is to serve their hard pressed community by addressing some of the tensions, some of the disruptions and concerns that fall below the radar of the police, but are very important to the members of the community to their neighbors. So this neighborhood agency doesn't usually handle murder, but when it arises, they're ready for it. He's an army veteran. He's smart. He's savvy. He's tough. He doesn't carry a gun. And that sets him apart from a lot of your other private eyes that you might have encountered. He is very agile with his fists. He's pretty quick witted with his, his thoughts and his words, and he's a lot of fun to follow on his journey through his neighborhood, and through his learning to become a private eye. Murder Take Two is, as I mentioned, the sixth in the series, but these are written as stand-alones. So I think it's very easy for you to jump right in, even with this most recent book. Obviously, you can certainly catch up with the adventures of Rook and his friends by reading earlier books in the series. I think these are ones that will reward the reader even if you jump in at the last, the last book Murder Take Two. So I hope you take time to look into Murder Take Two and my private eye, Rook. I hope that you will look for my books at the San Francisco Public Library and be sure to check them out at your favorite local indie bookstore as well. Thank you.


With just under a week from Thanksgiving, the Bemidji Community Food Shelf is looking for some help stuffing a truck. Through a collaborative effort with Marketplace Foods and the Stations of Paul Bunyan Broadcasting, volunteers were on hand taking donations and grocery items to fill a large semi-trailer. The tradition of stuffing a truck goes back decades but is a crucial fundraiser for the food shelf as the holidays approach. Over the past few months, the need for food and necessities has dramatically increased. People need to know if they go buy $10, that's wonderful groceries. If they give us the $10, we can buy $20 with it. So we'll take either the food or the money. The Stuff a Truck Food Drive continues through Saturday evening. The Bemidji Community Food Shelf hopes to raise over $4,000 in donations and over 24,000 pounds of food. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


I'm Jim Grant, if you haven't heard that already. I own a digital marketing agency called Simply Creative Media. We're nine years old last month. These slides are from November so they say Global Entrepreneur Week so I'm breaking another rule and bringing in slides with somebody else's logo on them so ignore that. Any expectations about what you want to get out of security today? Anybody? Are we doing what we need to do? Any security experts in here? Yeah there's one. Should be. So so my intent is not to dig too crazy deep into security on WordPress because it's simpler than it looks. There's a lot of things you can do that if you do and their best practices and practice them regularly. You won't have an issue. There's a lot of what I consider kind of overkill and sometimes even bad advice going around about about securing WordPress websites. Why should I secure my website? Obviously you don't want it to get hacked. Confidentiality that's a big one now. You see every other day on the news somebody's data has been lost somewhere. So if you're storing any data on your website in the database even contact forms where you're collecting people's address phone number things like that you have a responsibility to keep that information confidential. Integrity. I don't think a lot of people think about that but you have a responsibility to protect people's data and also as we talk about the ways a site can be infected and what they might do that's malicious. Your integrity is on the line if people are coming to your website and getting infected or things that can happen. Inavailability.  He's always in the corner. Why does a hacker bother with me? So why does a hacker want to even hack my website? It's usually about the dollar signs. So they're either going to convert your site to put their content up there. Link injection. Links to their own sites. That could be affiliate links. It could be just links because they want traffic. All kinds of reasons they might want to link. Hacktivism. That's where you get you know hacked by ISIS or something like that where they're trying to promote their organization. Drive by downloads. That's one of those integrity things. You don't want people coming to your website and getting a bad payload from your website. Malicious redirects. Redirecting to wherever. Viagra sites is the most popular I think. Hidden pages. I run across this a lot. Do you know you have 600 extra pages on your website? No, really? Yeah, they're all Adidas tennis shoes or something. So that happens. And email spam. So a lot of people make a lot of money because they take over your email server and email from your website for a while until it gets blacklisted. But they're spamming people using your email server and your volume to promote their spam. And lately, since I'm really into cryptocurrency lately, they might even put a payload in your website to use your server to mine cryptocurrency somewhere. So it's all about the dollars usually. And a lot of it is robotic. So it's not like that guy sitting in the corner working on your website. They're usually exploiting things that are known vulnerabilities with software robots that try and log into your website.  So these are the three main areas where the weaknesses are. Leaked passwords, software vulnerabilities and your hosting. So we're just going to go through those. So leaked passwords, public Wi-Fi. Who's still working at who's working at the coffee shop a couple days a week? Yeah. Maybe more sometimes. Panera almost put a plaque on a table for me for a few years as my business location. So when you're on public Wi-Fi, if you're not connecting, this used to be a big deal when I first started doing a lot of social media. Facebook wasn't even HTTPS. And if you run an open Wi-Fi at Panera or Starbucks and logging into your Facebook, people could see you logging into your Facebook and get your username and password. So think about when you're out in public at Kauffman, wherever it is, you're potentially in the clear depending on what you're connecting to and whether it's secure. We actually had, I think it was two years ago here at WordCamp, somebody here with another conference had some malware on their machine that was bringing down the whole network because it was hammering every PC, phone, anything it could get to in the venue to see if it could find something to hack. Social engineering, this is the biggest one I see. My mother gets social engineered all the time from India to fix her windows. That's the most common way people get into your system. I literally have a friend who lost $40,000 in a cryptocurrency account because he just wasn't thinking about it one day when the people that said they were from the exchange that he was on and their email had been hacked. So they emailed as the exchange and said, hey, we need your private key for this. And he didn't even think about it, send it off and $40,000 out of his account. No time. Yeah, social engineering. Setting passwords in the clear. I maybe shouldn't even tell this story. Well, I'll use anonymous stories, but someplace we're going for a party this week at WordCamp. And I called up and talked to the venue manager and he's like, Yeah, email over your credit card information so we can put the deposit down. I'm like, Are you kidding me? So think about usually I don't make clients go through too much trouble.  That's not best case. There are actually some good websites where you can pass those securely if you're dealing with people's logins. Software vulnerabilities, plugins, even the inactive, I'm asking the expert to correct me if I'm wrong, Pippin, that's still true, right? So yeah, even if you've got, you know, when you're building a site, you're messing around experimenting with different plugins, got all 50 of Pippin's plugins on there. And you decided not to use 49 of them, remove them. Because over time, if they have a vulnerability that's discovered, they may still be able to get in. Same with themes. Also, don't leave inactive themes on your website unless you're going to keep them updated. And even then, why leave them if it's just another opportunity to encounter a vulnerability along the way. The WordPress core, we can't do a lot about that one, except report things that we find that may be wrong with the actual WordPress code itself. I will say last four or five years, it's been aside from one or two things that have come along. It's been very secure. You're hosting. So hosting can be a big deal. How many put their website on a shared hosting account? So I do I even put clients on shared hosting, depending on what they're paying. So it's not a bad thing. But and from company to company, it varies greatly, even from account to account. I'll pick on the big one on their sponsor. You take a go daddy who's been in business a long time, they have multiple platforms and legacy platforms, and they're always evolving. You may be on an old server that may not have, you know, all the latest updates, and so forth. So even the big guys. Yes, like that example, say, for example, HP 5.2, 5.4, minimal requirement is 5.6 for PHP. They will not no longer tell you no, they cannot upgrade you. They all introduce a support and they will upgrade you. If you're on your accounts, you should probably have a section. If you have a C panel, type and go daddy, or in Blue House, you should have a section called PHP tweaks. Yeah, most of the C panels now allow you to set the PHP version. Yeah. And also, if you don't know, a lot of times some of your plugins these days will have a little Mac notice and tell you, Hey, you're not on this one. And our plugin requires this. And that's when, you know, you need to reach out to your host. However, on the hosting, you have to be careful going back to passwords. We just had a hack last week at WP fixed it that we were cleaning, where everything else was, they didn't have some malware on the website. A few other things happened. But they had a section on the website where they were using the actual advanced MX records and their C panel. Somebody had pointed a wild hard domains and pointed that to be different, such as possible to do. So they were totally and it was for phishing and they massed email that it was discovered by the host that there was mass emailing going on for phishing for a sub domain. And there's wasn't even a posted on this. So we had to track down where it was coming from. It was we're like, where is this at? Where is this at? And we found it right there. So you have if you ever have something like that, you can't find it. We're looking your MX records and see what's going on. So SSL, we talked about who works from a coffee shop. So you should for your own website. And this is becoming best practice now just because Google likes it to have an SSL certificate for your website and run it encrypted. So there's two sides that coin one, everybody thinks it's really hot and important right now because Google wants it. Well, that's that's important. If you don't have a contact form or anything on your website, there's not necessarily a lot of risk of data or people putting in, you know, their phone number and getting it stolen, that kind of thing. But most, I think most hosts now, I think there's a few. I had a client on the hostgator last weekend, I don't think they were offering Let's Encrypt yet. But that's the free ones, everybody know about Let's Encrypt. So it's a consortium of companies, I think, trying to remember who led that, but large IT companies, CAA, I think, is in there and a bunch of to offer free certificates. It's going to make a comment on Let's Encrypt. It's a phenomenal service. Every now and then you might want to be careful with it, depending on what your site is, if you're running an e-commerce site, Let's Encrypt may not be your best option, only because the certificates you get don't always meet all validation requirements for really stringing e-commerce rules. We have a lot of problems with customers that use Let's Encrypt where their merchant processors say authorize.net to check out or something like that. They won't consider it valid even though it is valid. So if you're running a business, like an e-commerce service that makes money through e-commerce, spend money on your SSL certificate. If you just want an SSL certificate, Let's Encrypt is amazing. Yeah, so let's actually, I don't, yeah, I don't, maybe I took this slide out because of the time frame last time. Question? Oh, well, so I'll give you my spin on what and why too, is so there's multiple levels of SSL certificates. Basically, the Let's Encrypt certificates basically check to see if you're the owner of the domain. I know on my hosting data center that I use, every time you spin up a new account or site, they automatically the certificates there. But it takes about five hours or so for that verification to happen. And that's really the only verification that happens. So then you get up kind of the top of the chain is a company verified and you go through a whole process of proving who you are, and you go back and forth with the certificate company.  So that's very verified. And you can be sure who it is. And then as for cost, what you're paying for when you buy certificates is insurance. So when you have an e-commerce site, you know, it's a good idea to look at, you know, I'm paying $50, am I getting, you know, how much liability coverage basically comes with that certificate and so forth. That's, that's kind of what you're paying for that you don't get at all with this, let's encrypt. So yeah, I as a best practice, I don't, I didn't know that you get turned down, but I always recommend to clients that if they're doing shopping cart, that they buy a certificate. So SSLs.com is one of those places you can do that fairly inexpensively to the questions about certificates. Everybody's got one using one. Get on it. So this is just a little light. I threw in a few techie tips. This one, you know, this whole thing wasn't to be too techie, but in your WP config.php, you can add this statement for SSL admin and what that does is disables some of the admin functionality, like getting to the editor. So that if someone hacks in, well, let's say they do a simple act, they figured out your net your user ID and password, and they got in as an admin. If they can get to the editor, they can now get to all your files. So that's a way to turn that off. Use a VPN. So anybody use a VPN? Besides anything like downloading movies and stuff? Okay, we're trying to get Netflix in Europe. Yeah. Avoid shared or public computers. So I just logged in on this computer to my Google account. Yeah. Maybe not a great idea. We're all weak. Use secure passwords. So there's been some really awesome articles out lately about the latest study on, you know, that you see these published the top 50 passwords that people use and that kind of thing. But it's really interesting that now with artificial intelligence and the bots, they can amazingly guess where people will capitalize letters and things like that. So just, you know, doing caps and lowercase and even sequences and numbers and things that you think are secure. You don't know that you're actually thinking like everybody else. And the bots can figure a lot of that out. So I definitely have started recommending, even though for many years, I had the same password on everything, that you start to use a password manager, let it pick those big Harry, you know, 16 character with Perens and everything else in there, at least 12 characters long, which is more secure. 16 s's or three characters that of your choosing up or lowercase or numerals. 16 s's. It takes the bots longer to figure that out. Then it does a shorter, simpler password. Use different passwords everywhere. Get a password manager. Limit your admins. I can't tell you how many sites they take over for maintenance. Or they've been hacked. I do about, I don't know, a dozen sites a year that disinfect and restore. You know, and they got 30 admins in there. Or they got every admin from every web person they ever worked with. Amazing. And don't use the user ID admin. If you're using a great password, it's still secure, but admins, the first one, the bots are going to try. So they're already one step ahead. One less thing for them to guess. Last pass is probably the most popular and best. I use the Chrome browser password manager. Not the best solution, but easy.  If you are Windows, Linux, or Mac, what's the last pass? Last pass. One password is also on the other platforms at this point. Oh, there now? Oh, cool. We're not originally on like, yeah, I remember that. I was Yeah, I like the Chrome manager just because it works on my phone, my laptop, my tablet, desktop. I don't have to chase things around as long as I'm logged into Chrome, hence the vulnerability. If you leave yourself logged in somewhere, people can go into your browser and look through your password list. Which I don't think they can do with a platform like LastPass. Is that correct? That's a little harder to get in and look at your password list, right? Yeah. See, you're talking to part-time hackers here. So we're like, yeah, no, I could do that. Yeah. Matter of fact, it's on a slide somewhere here about using Two Factor. I think it's in my plug-in recommendations too. So yeah, I'm seeing a lot of that, especially I mentioned I do a lot of cryptocurrency trading and almost all those platforms use Two Factor and Google Authenticator and actually Google was pretty good when I logged in here to my Google Drive to get my presentation.  Look at your phone and then I clicked yes and my presentation came up. I didn't even have to enter anything. It's pretty cool. A tip thrown in, use Captcha on things. Use Captcha on your login. Actually, ignore the first one there, WP login recapture. I just checked it this afternoon and it hasn't been updated for like three versions of WordPress. But the login, no Captcha, recapture is simple to use. It adds, you know, the I'm not a robot. So it's one more barrier on your admin login to slow, especially robots down. You will have to, if you implement that, you'll have to go to Google and sign up for a recapture account. And you'll get a key to put in in the plug-in when you set it up. Software vulnerabilities. Update, update, update. Get on a maintenance program. Many of us have those that sell them. We'll do all those for you and fix any problems when they happen. But it's just like, I mean, if you're a Windows user, right at every Tuesday, get an update, what are most of those security updates? So all your plugins, your themes, WordPress core, they're constantly getting updates and many of them are security updates. So you should keep up with them. Don't use pirated software or suspicious free themes. So I know I get a lot of especially newbie WordPress users, they're out surfing around for free themes. If they're in the repository, you know, when you go into themes and look up through the WordPress repository, those are should generally be safe. But if you're surfing the web and Googling free themes, you may get something with a payload in it, could be plugins. Yeah, people who say, oh, I have Yoast SEO, and I'll log in immediately. I'm not doing any support until they actually either buy Yoast or get the free version. Although again, they do that's because they don't want to pay them for the premium version of Yoast. They still come for just make any sense because if you buy the plugin anyway, you practically, if you go get support, you're getting your money's worth anyway. You pay my $100 to do a few hours of support for you, or you can buy a plugin for $30 and get unlimited. There you go. Seems like a no brainer. There's also, and I don't know that any of you are doing this, but you can get most plugins because of our open source community. You probably could even get a few of Pippin's plugins on some site somewhere for $5. And there's a likelihood, maybe they're just doing it for the money, but it could have a payload in it. So it could not be Pippin's original plugin. So watch, you know, trying to save a buck and buy pirated software. Let me get your exposure by reducing plugins. Now I'm not a big fan of telling you not to run a ton of plugins on your site. If you're using them and you need them, run them. But also be aware, and when I teach about plugins, you know, I kind of talk about how to vet plugins, you know, look at the ratings, how many people are using it. So if you find a plugin out there that happens to do what you're trying to do, and for some reason it entices you, but it's got like 10 users and, you know, no ratings, and Pippin, you write plugins, it's not all coders that write plugins know anything about security. They might have written a really nice plugin that has a great big hole to your SQL database in it or something. So it's just a nature of the open source community. You've got a lot of people that have not been writing code or even taken a security course and know how to write secure code. So there's no good way to check about that, except look at reviews, watch. So my main source, in case I forget to say it later, I think I've got it in here in my plugins. But I use WordFence on all my sites and my client sites that I manage and their website is very good. They have a great blog, they keep up with constantly with everything that's going on, not just with WordPress but across the industry and identifying vulnerabilities. There was a series of plugins this over the past year, I think twice it's happened, that the plugin developers sold them to someone else who then proceeded to turn them into malware and they were still in the WordPress repository at that point. So that kind of thing, that kind of news pops up really quick on WordFence's website, security, another good one, to keep up with what's going on and watch for notifications. Removing active plugins and themes, we talked about that. I got this in here twice. Disallow file edit, true. Move your wpconfig.php. So I'm not big on moving stuff around or changing it to where your admin login is, that kind of thing because there's a limited amount of protection or advantage to doing that. But moving the wpconfig and people will argue both sides of this ardently. Which side are you on, Pippin? Call you out. Depends on the day. So wpconfig if you don't know and you're just, you know, a moderate or beginner WordPress user has stored in it the username and the password for your database. Which is where all your stuff is stored. And so if they get in the database they can destroy your site, they can steal your client information, pretty much anything they want. So there is merit to moving that where it might be more secure. That's about as deep as I will go. You'll want to kind of Google it, look up the procedure. Basically you move it up a level, which on your hosting you may not even have access to. To the parent directory. And WordPress still finds it if you do a few more settings. So there's a little machinations. So if you really want to get deep and are worried about that, I have never, I don't think I've ever run into a problem where that's happened. Except when somebody set all the file permissions on their server to to read that kind of thing. The reason I said that is because of the name we definitely can think, but also any of the other default locations or files, whether it's one of the folders such as definitely content or definitely admin or anything that while it could work great, keep in mind that the moment you do that you have changed the default behavior for WordPress. And there are a ton of plugins out there built by every level developer that may or may not know how to account for that. And the thing is with something like WordPress is there are thousands of configurations and plugin developers have a hell of a time accounting for all of those configurations. So just as a single example, we struggle constantly with easy digital downloads with people that move the locations of definitely content or the files in there because all of a sudden it breaks our ability to do file discovery or processing file downloads. So if you do it, just keep in mind that if something breaks, revert it and find out if that will break it because it's a pretty good possibility it will break something. And it's not to say that you moving it is wrong, it's just that there's a lot of plugins that don't know how to account for it. Yeah, good point. Yeah, there aren't too many, I've only done two technical things because most of the best practices that I'm discussing, if you do you're not going to have an issue. Let's see, don't use the default database prefix wp underscore just because it's known and expected and it's just one step closer as robots are iteratively trying to guess things like your database name. They wouldn't have any effective functionality anyway, but it's just a name. Right, yeah. Don't share database among multiple sites. So I've seen this happen not too often but people will have four or five WordPress websites all saving to the same database, so it's just a single point now of vulnerability. If somebody gets into your database from one of the sites they now have access and can destroy all of your sites. Yeah, well you can't, I don't think you really can't avoid it there. For each table or each one of the sites, right, but they still share a database. Yeah, but it's all in the same database. So it is possible if you really want to. Yeah, you can put multi sites in different databases but it's a little tricky. Yeah, everything about multi sites a little tricky. Is that what Carissa is talking about today? I think it might be. Honestly, you shouldn't really be on your host having multiple websites. We're going to be really about security because I feel really bad when I get a person who's head to all 10 of their websites infected on their same seed panel and 800 bytes. Yeah, well that's usually because they've got a vulnerability that's common to like a file access vulnerability where they're now getting into all the directories. So yep, and you could almost say the same thing for shared hosting in a lot of ways. So hosting, there we go, lead into that. Shared hosting has more exposure. So when you're on a shared hosting account there may be 500, a thousand other websites on the same server with you.  They do a lot of scanning, a lot of monitoring and the risk is low but it's there because you're all operating in the same space. VPS, virtual private servers, anybody run their sites on a VPS type account?  It may be on the same hardware but it's software isolated to think it's on its own machine so it doesn't communicate with other websites across the machine. So if somebody's site next to you gets hacked and it's trying to infect the other sites on a shared host, it wouldn't happen on a VPS server. Most major hosting companies, depending on the day, because I do run into streaks with certain hosts. Blue host is one lately. They have their good months and their bad months where they seem to have some vulnerabilities going around provide very secure and updated environments because it's cheaper for them not to have problems but look at their environment. So now I was talking about the earlier latest PHP, what Linux server are they running, etc. So when you get into setting up WordFence, they have a nice firewall now and it'll detect, you know, what Linux is running and set up the right firewall for you, that kind of thing. So those are important. I've got a, I'm probably shouldn't tell on clients, but I've got a client right now with a major site, large site. That's because of a large back-end application. There's written in Perl. We can't really move it and the site, the server's out of date. The Linux version's out of date. Who knows what else is out of date, but we can't really do it without rewriting the Perl application to be compliant with the latest version of Perl. So we're kind of stuck and I live in fear every day about what could happen. So I'll give away my big secret now how I avoid all hacking and vulnerabilities and problems. Run a backup. So if you take anything away today and we're going to talk about backups, if you have a backup in most cases, it is possible your site could be infected for months and you don't know it and if you don't have a really old backup you may not have a clean copy, but when the site really goes down hard you at least have a copy that you can get the site back up, disinfect it and recover. Security or status blog. So I know the hosting data center that I use, you know, they have on their Twitter and they have a website address. You can constantly look and see what the status of their servers are, whether they have any issues. Can you use a certificate? Do they offer WordPress specific hosting? So I have a lot of folks and one of our sponsors, Flywheel, environments like that where they already do all this security monitoring and hardening for you. As a matter of fact they may not even let you run things like WordFence because they're already doing that monitoring and it conflicts with the monitoring they're doing. So you can get a lot of this protection built into your hosting. Who FTPs into their site and all that to get access. So consider SSH. Don't share folders on the website. I see this a lot too. It's more of a legacy thing but people have had a website a long time and maybe they had an HTML site and then they went to WordPress and they've been storing all their pictures in a folder that's open to the public because that's where the person on staff was FTPing up photos or what have you. They may have left other folders open for access from the outside. There it is. Do you have a backup? I use backup buddy. I've used it for years. Works great. There are several good solutions. Who uses something else that they like? Yes they should be.  So that's to the next point which is backup as often as your data changes or you can afford to recover from. So if you're on a e-commerce site and you're doing you know 20 sales an hour can you afford not to back up at least every hour. How much how far back do you want to go back and try and figure out who ordered what or reconstruct your data. You know if you're a blogger the average blogger blogs with twice a year I don't know. You know maybe you need two backups a year so I know I'm guilty of that. Store off-site copies so one of the things I do for every site is store three copies one locally. Not a great idea but it's convenient because if somebody does get into your dashboard they can delete your backups because they have access through the plug-in. They actually and this is behind the push and the pull and I won't get too deep into push and pull but if you're using backup buddy for instance and you're storing I store I actually store backups to two remote places Google Drive and Amazon S3 storage. But once they're in the dashboard in the backup buddy interface they can remotely get to those also and delete those backups if they wanted to. So I also store another physical copy that's not related or connected to the site for all my websites. If you're using a C panel or care of a host that has used a C panel depending on your host you have to download it and then get rid of it otherwise all sudden you just you get you are suspended. Yeah it depends on two things how much file space they give you and sometimes but not so much with a backup unless you're storing all the discrete files how many files you can store so backup buddy does a big zip file so it's only really one one file. Schedule them automate them all the backup softwares have automation in them so if you know once a week is a great time to back up set a schedule set it and forget it you can set even the pushes to remote locations have it email you the zip file all that all that stuff. Security plug-in so here's my plug-in list you got to have those it's a WordPress convention right so there's a couple of different types of security plugins monitoring and scanning so that's just really monitoring your site against things that people might be trying and scanning it for things that have already happened to it so wp scan the google search console actually checks because if you've been infected long enough to have your site have the big red google warning that says don't visit the site it's unsecure and it's infected that's no good that takes a long time though jetpack protect security word fence they all have scanning and monitoring word fence may send too many notifications every time you do a WordPress update even it says your core files have changed and then your client gets that too because they've got an admin account and they're like what's wrong am i hacked no no we're just we're just watching defense so these plugins all have active defenses against what's going on vault press word fence i-themed security all in one wp google authenticator cleft two-factor authentication although i'm not sure that one's still somebody told me that may still not be available bulletproof security um but don't install all of them uh one your site's going to be scanning all the time it could affect the performance but they also may interact with each other poorly um find one good one i mean a couple of the top ones on their word fence i-themed security um there is let me look at my next slide yeah i've got it on the next slide another one that i'll mention uh but pick a good one um one like word fence is going to cover monitoring and defense both and word fence includes a firewall um remediation and cleanup um so we won't go through because we only have about five minutes but the depth of what to do once your site goes down has been hacked and how you recover um number one get out your backup just wipe it out and restore uh well you may not even wipe it out i i i'm such a safety nut and don't want to have to go back and reconstruct anything that i'll usually download um all the files even if they're infected the database and everything store it away do a restore just in case you got a bad backup or who knows what um you at least have something that you could clean up later the hard way um wipe the environment clean including a new database uh when you restore um usually when you restore to the existing database is going to overwrite everything but you never know um i've also run into a few situations where um the malware's left cron jobs that a week later come up and re-infect your site so you want to start from scratch um don't have a backup you're going to have to review every file or replace everything you can with new copies so uh we won't go through that process but you kind of start by replacing all the WordPress core files and looking through the directories to see for stuff that shouldn't be there um it's a pretty laborious process i'd say manually cleaning a site takes me an average of 15 hours um um i suppose if you're managing your own server maybe oscron jobs but um any comments unless you upload them to the server okay yeah um i knew we had a techie though back there he might be running his own server uh back in the day i would have done that it's too much trouble now um let's see change all your passwords and your salts again one i've had really good luck with elie anti malware security is anybody using that or tried it uh it's a plug in it's in the repository um if your site is not completely down and you can run that plug in it actually does a very good scan and remediation um you're still going to want to do some third party checks against your site again from people like security and just use three or four tools to make sure it got cleaned up uh but i've had really good luck with uh with that one cleaning stuff up i had never either i don't know what the elie is um elie anti malware security um security if you uh google security free scan they have a free scan on the web they'll scan your site it's somewhat accurate that they don't deep deep scan but it'll give you an idea if you think something's funky you know go do their free scan and see if they return a bad result um check your cron jobs questions we've still got about five minutes if you want to so it is possible that any of those external or internal will can can and maybe at times will miss a lot of for example content injections sometimes even superior will miss seo's ban so or content injections as in a line of java script that may randomly send you to some inappropriate website so sometimes in that instance you may have to check your actual content if you're not if you're not comfortable checking database for some of these things to see if it actually is there or for example checking a lot of very common header dot php of your theme and your footer dot php of your thing very very too common most common places i see for this these type of infections that are actually missed and then the third one i always look for the content exactly for those there are other ways to be where it will be in the database but you have to really find it you have to know what yeah i kind of cruised by it but um you might google and look up you know the wp scan for wordpress it's a black box tool outside of you know running it on your site that'll actually scan the site it's a little more techy to run it you got to download it install it run it but it'll do a deeper scan and a lot of the plugins well anything else the admin user number no this is the thing is it yeah so just for funsies we had a bug that yours truly was once by accident that accidentally gave we admin access to yost.com uh by clicking the internet that was pretty fun well the reason that happened is because your default user id defaults to one um well if your code is set up improperly and you have some plugs in your code and if you do some validation of numbers and you use a particular function called an absolute value what just imagine for a moment that you pass negative one to absolute value what do you get back one well if you just happen to have more bugs in your code that then says when i have a valid user id go ahead and log me in bad things happen so the problem with negative one is that if you have a bug in your code that accidentally processes a login attempt when you shoot you can actually get a login account or whatever user account is number one and so the idea behind what you're saying is change don't like just delete user id number one because if there is a bug like that then it won't happen as it's not really like it happen yeah that gets that gets on my list of obscure things that i was that i avoided in my presentation but they can happen it's kind of like changing the path of your login and stuff like that it's yeah they they're all real things i mean they can all happen but go home back up your site and uh when it goes down just restore it all right thank you thank you


Oh no they didn't people. Oh no they did not. Now if you guys haven't seen videos or posts over the past day or so, PC mods, swapping out characters, skin swapping whatever you want to call it, credit to Nexus mods and Cap Mino for bringing this to the world because it's absolutely hilarious but people. I covered switching out the joy toys for Ult Cunningham, Barber of Dorset, Judy, Panam. Oh people it's just got a whole lot crazier. It just got a whole lot crazier and I'm scared to run down there to even see. I really am because the mod I've got today people turns the male joy toy into not one other than Johnny Silverhand. There's one Johnny. How you doing mate? How you doing mate?  That's incredible. R-E-L-A-X-S. What is going on? Oh my life people. This is incredible. This is incredible. Again credit to Cap Mino and Nexus mods for these. Whoa whoa pixels. Oh he's disappeared on his back. There's Johnny smoking. Oh my this is this is uh this is kind of hard to watch. He's fully clothed though so there's uh no nudity here.  This is both weird and amazing at the same time.  I can't believe it. I'm gonna check that out too but that's amazing. That's made my day.  Where's he gone? Where's he gone? There he is. I won't find a better massage in NC Cali one or Cali two. That's incredible. Oh first I didn't mean to do that. I just want to speak to him. Follow me. Wow this is brilliant. Brilliant. Johnny, Johnny Silverhand. What? I don't know you can make noises by pressing the buttons or is that just a weird timing? Must be. Must be. This is so weird. It's gonna get weirder people because what I'm gonna do is I'm gonna have to create the game to apply over mods. There's Johnny. You have to create the game to apply over mods so I'm gonna apply the Takamura one. I see how that one goes down so I'll catch you guys back in a quick second. Okay people so we are back. Takamura. Let's see this.  Oh it's amazing. Slow down. Treat yourself to a little R-E-L-A-S. I'm garment so incredible. I'd love to be wearing them. I would love to be wearing them. Ain't no other way to live. Follow me. Wow. Great.  Oh no that could mean he's terrifying. Oh my days. No, no, no, no. I can't. I won't ever look at him the same way.  Wow that's craziness people. Again. Could it you cap me in our Nexus mods for these because they're unreal. I can't wait for them. Smasher versions I really can't. Yeah guys that's it. That's enough of that. He's slightly disturbing seeing these these these main main dudes these main main men being dilute to joy toys joy kills. Wow. It's amazing. It's incredible. It's incredible but yes people if you enjoyed the video and want to see more so someone who actually don't hate the game actually enjoys it. Let me know down below and also smash that like button. I do appreciate the support. Also if you're new around here want to see more on a daily basis be sure to subscribe. Guys thanks as always for stopping by and hopefully I will see you on that next one.