All right, welcome back everybody. And thank you so much for supporting the DefCom community and especially the Red Team Village. And with that in the further view, I pass it back to Gabriel. Take it away. Hi to everyone. This is a little different, but yeah, this is, I'm introducing a new tool called Drop Engine. It's a malleable payload creation framework. A bit about me. We'll go on about this for too long. But my name is Gabe Ryan. I'm a Red Team operator at SpectraOps. I used to work in a place called Gotham Digital Science doing security consulting. Got my Twitter handle in mind. My LinkedIn username is actually pretty interesting. It's ms08016. So without further ado, let's just dive right into this. Let's talk about initial access payloads. So what are initial access payloads as opposed to like normal payloads? Initial access payloads are typically used to gain access to a system environment. So at the very start of your engagement, it's what you're using to essentially gain your initial foothold. They're pretty simple design. I mean, it really has one job, which is to execute an implant or a second stage payload. And then from there, you pretty much do everything. All your secondary endpoint operations happen from that point onwards. Colloquially, they're also into distroppers or shellcode runners because they run shellcode. But yeah, while initial access payloads do have a pretty simple role, there are some obstacles that you have to face when designing them. So despite the fact that it's like the performance seemingly mundane task, right, that they just load code and memory and execute it, there are some challenges to contend with. The first of which is that during the delivery phase, so what you're actually trying to get this payload onto the target machine, usually that's going to be done via spearfishing. And if that's the direction you're going, this payload is going to be exposed to signature base detections in the form of mail filters, and stuff that's scanning through the email that you're sending out. It also may be exposed to automated behavioral analysis. So automated sandboxes is essentially what they do as they take your payload. And they actually execute it in a controlled environment. The reason why they do this is that whereas if you're just looking for signatures, you're going to get these brittle signatures that are kind of easy to evade. But in this instance, if you're looking at what the program is doing while it's executing, you're actually looking at behavior, which is a little more difficult to hide. And finally, during the delivery phase, your payload is going to be downloaded and saved to disk. You have to do this without triggering your getting caught by EDR or whatever. So that's the final challenge. And then once you've done that, you have to execute your payload. So the payload is going to be executed from disk. Usually, if it's like a fishy payload or something like that. Although typically in-memory operations are a little better, when you're just one of the challenges of your initial access payload is that you can't really start that way. So you have to start from disk a lot of the time. And you have to do this without triggering anti-virus or endpoint detection or response, AKA EDR. In Windows environments, you're also going to application wipe this thing is pretty much ubiquitous if you're operating within an active director environment or to them with Windows. What this means is that you're going to have to find a way to bypass that. And that usually means relying on something called the concept of this live-off-the-land binaries and scripts or law loss. Essentially, what these are, they're just like utilities, they're binaries that come packaged with the operating system. And they're usually designed to fulfill some benign role. But you can actually, what makes them special is that they have some functionality that you can essentially leverage to do something that is useful for you as an adversary. So in this case, there are several live-off-the-land binaries and scripts that can be used to execute payloads in various interesting ways. So that's fortunate that you can rely on that. You can use that to bypass application whitelisting. The problem is that most of these pretty much restrict you to programming languages and execution methods that get filtered through the Windows Common Language Runtime or CLR. And CLR, if you're going through CLR, you have to contend with Microsoft's anti-malware scan interface or AMSI, which just examines all this stuff that's going through. So that's another obstacle that you have to do. So in a lot of ways, getting this initial payload working and running can be very challenging, despite the fact that you're trying to do something that's seemingly simple. It's almost paradoxical in that way. And finally, you should assume that your initial access payload is going to be discovered. That's just a safe assumption to make. So your payload really should be able to withstand manual analysis in the form of threat hunters, reverse engineers, and the like. So with that in mind, all these are obstacles that are insurmountable. There are ways to contend with all of this. It is a bit of a cat and mouse game, but it's something that you can get around. The problem is that successful evasion techniques do not last very long. They have a tendency to get stale. They have a relatively short shelf life. And this is because if you're doing your job right, defenders will eventually learn from what you are doing as a red teamer and write detections against whatever TTPs you're using. So those really cool new TTPs that you drop, if you're doing a job right, this will actually improve the security. And they won't work forever. If you're using the same TTPs for years and years, well, you could argue that you're not really improving the security part. Yeah, that's a whole other thing. So defenders will eventually catch up to you. And what this means is that your payloads are finite. They have a shelf life. And that's good. And specific payloads, right? So we were talking about TTPs there, right? But specific payloads that you write have an even shorter shelf life. Because at some point, someone's going to write a signature base detection for that particular assembly that you drop on an op or something like that. And that's relatively easy to do. I mean, from a relatively, right? I mean, from an average for serious perspective, what this means is that we're using payloads as likely to get you burned. So what this means is that initial access payloads are typically kind of a pain point for offensive teams. And that's because you have all these challenges that you have to overcome. And the ways that you overcome these obstacles, but the methods that you use, essentially, are not going to last. And you typically have to write them by hand, or at least modify them by hand on an engagement per engagement basis. And code reuse can be problematic. And there's a lot of moving parts. There's a lot of, I mean, despite the relatively simple purpose, if you've ever looked at the source code for doing the process hollowing and C-sharp, you'll see there's a lot of code involved. There's a lot of things that can go wrong. So there's code reuse is a problem. You have to do a lot of stuff by hand. And there's a lot of moving parts, despite the fact that you're trying to do something relatively simple, which is kind of paradoxical. So to kind of contend with this problem, I was actually just kind of like researching payloads independently. But at some point, I just had the idea to work on this new tool called Drop Engine. Essentially, the goal of Drop Engine is to address this problem by providing a malleable framework for creating shell code runners. So if you ever used like Holostrike, for example, one of the cool things that makes like Holostrike great is the fact that just about every aspect of your agent that you're placing on, that you're using on the target machines that you're operating on can be modified. You can modify traffic profiles. You can modify essentially how it's dealing with using namepipes and whatnot. Just about every aspect of its use, you can customize it in some way. And by doing that, really get a lot of use out of this one tool. So I guess the core idea was to try to do something similar with initial access payloads. And the core idea is to identify discrete payload components. So basically examine your typical payload and say, what are all the parts that you see in this payload that repeat themselves across every payload that you ever write? And identify those and turn them into modules. And as a bonus, provide built-in obfuscation encryption and symbolic substitution capabilities, which makes it easier to evade significant actions. And in the case of encryption, makes it easier to evade human analysts. By doing that, we greatly extend the shell's life of those individual payload components that we're writing. So how would something like this work? To kind of think about this, we have to talk about how payloads are built. This is actually the interesting thing about this project. This is less of a Red Team project than it is a software development project. Because we're actually not really trying to do a whole lot of crazy stuff here with the actual, the payload itself. We're just looking at kind of the abstract design pattern here. If we think about the anatomy of a payload, at their core initial access payloads are relatively simple. They involve two major steps, which we talked about below the shell code into memory you executed. A little bit of terminology that I'm gonna throw out here, from this point on, or in this presentation, we're gonna refer to the routine that performs these two actions as the executor function, just to kind of make things simple. So there are many ways of achieving shell code execution. You've got DLL injection, you can spawn a local thread. You can use process hollowing, thread execution, hijacking, all kinds of stuff. But we actually want to abstract away specific details like this. We don't really wanna focus on them quite yet, because what we're looking at is actually for more of a bigger picture. Also, something else we have to consider, we mentioned that we need to contain with application whitelisting, and that really means that we're limited to formats that can be executed by law boss, live off of land buyers and scripts. So what this means is that our initial access payload is really gonna require three basic components. And you can kind of see my diagram here on the left here. We're gonna have the shell code runner. Technically the whole entire thing is a shell code runner, but just for the sake of labeling things, we'll refer to this outer wrapper as a shell code runner. That's gonna be law boss specific. Right? You know, if it's MSPIL payload, that's gonna be like an accidental file. Basically, if it's an installUtil payload, that's gonna be a C-sharp file that's compiled into an assembly.  That's your application entry point that's gonna call your executor function. And really everything else that gets called within your payload, but we're not gonna worry about everything else yet. It's just these three components. And then finally, you have your executor function. And this is gonna load your shell code memory, execute it, and essentially, yeah, that's the meat of this payload so far. So Drop Engine implements these basic components as base classes. Essentially what I've done is I've taken these three components and made it so you can inherit from them and derive modules from them. And what this means is that you could just write a module, and you can use any executor type you want, wrap it in a shell code runner you want, and the overall structure of the payload remains the same despite that you have a lot of different options as to how to actually implement all of this stuff. To kind of give you an example when we're talking about the structure, this is a, I ripped this direct. Well, there's supposed to be a link to this GitHub, but I guess like it's getting cropped on the bottom because it's PowerPoint and Zoom. But yeah, this is from 0x13, Steve Flores' GitHub. It's from a project called MoveKit. This is just an MS build runner, right? You have your outer wrapper, which is what we talked about here, right? And this is just your XML file. You have your payload main, which is just importing stuff and calling this executor here. And then you have your actual executor function there, your shell code inject. And this is this main, just gonna have to switch back and forth here a little bit. I'm actually gonna stop sharing for a second and then reshare from Hyper. Cool. So yeah, I mean, you're gonna see a lot of other stuff here, but if you look at the overall structure of how things are done, we have our components, have our runners, we can break them into individual discrete components like that. And we'll kind of go into more depth of this a little bit. And then of course we have our secure functions, which I don't have a whole lot of them in there quite yet, but that's okay, because so I'm gonna stop this and I'm gonna have time to share this again. Okay, there we go. And then hit from current slide. Okay. So we've identified our discrete components here, right? These items here. We also want to throw in encryption capabilities. So it's typically a good idea to leverage encryption when creating initial access to payloads for multiple reasons. Basically, you have your shell code that is gonna be executed by your shell code runner. And if it's something you don't necessarily wanna, a lot of these are gonna be like binary payloads or something like that.  So what we do is one way of hiding that for signature based checks is by encrypting it. But the other advantage of encrypting your shell code is that it makes it more difficult for human analysts to reverse engineer a payload. Remember, we need to assume that the payload is eventually gonna get caught. And when it does, we wanna make it as difficult for the reverse engineer to pick this apart as humanly possible. What this means is that our updated payload execution process is actually gonna involve a few more steps. We were going to load the encrypted payload into memory. We're going to decrypt that payload using the encryption key to obtain plain text shell code. And then finally, we're going to load that plain text shell code into memory and execute it. So the extra step here that we've added is this encryption function. So if we're gonna use encryption, this introduces yet another thing that we have to account for and that's key storage, derivation, and retrieval. When we leverage encryption to protect our shell code, essentially this is going to require us to provide our payload with one of the following. It's either going to need to be able to derive the encryption key somehow without actually storing it, right? So it's not gonna store it, but we need to be able to obtain the encryption key somehow. It needs to be able, if we can't do that, it could possibly just retrieve the encryption key from some other location. So we could provide it with that capability. Or we could just store the encryption key itself in the payload. Now, obviously this last option is not ideal because if you're storing the encryption key in the shell code and if someone in the payload, then someone compromises the payload that they can decrypt the shell code and you're kind of, you're just adding an extra step, but you're not really making it terribly difficult to pick apart. So let's talk about this first option of it, right? We mentioned the use of the first option is to derive the encryption key. One really great way of doing this is the use of environmental keying.   I think that the three most relevant projects to check out though, in terms of like prior work that's like really relevant to red teaming would definitely be, well, Ebola is the classic one, you know, job, yeah. That's, so if you look up Ebola GitHub, like that one is gonna come up really and environmental keying, that one will come up. The other one is Spotter, that one was released fairly recently, I think like in 2018 or something like that. And it pretty much does something pretty similar. And then also there's, I think like Leo Lupic has some blog posts where he talks about this and also expands off of those. But yeah, so the idea with environmental keying is that you actually derive the encryption key either entirely or in part from values in the environment. So what do we mean by this? Well, let's say that by attributes in environment, we're talking about usernames. So for example, you could use the currently logged in user that your payload is running as, as part of the encryption key, you could try to obtain the external IP address from where your shell payload is executing and use that as part of the encryption key. You could use your, make sure that you're actually on the right computer by deriving the encryption key in part by using your internal FQDN. I actually even like, you could even like use the moon phase or something like that.  One, it makes your payload very, very resistant to analysis because your encryption key is now no longer being stored in the payload. And essentially they'd have to, essentially like if you're setting encryption key to the value of the hard drive serial number, that means that you'll be able to decrypt and execute your payload on a specific machine that has that particular hard drive plugged in. But if you're an analyst and you just have a copy of this payload, unless you know what specific machine you're going after and what the serial number is, you're essentially forced to attempt to crack that encryption by guessing the value of that serial number. So it makes your payload super hard to crack and the added advantages that it's very targeted. Your shell code is only going to be decrypted on machines that match the key's specific attributes or if someone says they're brute forcing for a very, very long time. So I'm now going to set the first live demo of this over Zoom, no less, this will be interesting. All right, so I'm going to do a couple of things. First, I'm going to show you my setup that I'm using for this, because I think that's important. Just so that you all know kind of what's going on here. So I'm going to stop sharing for one second and I'm literally going to share. Well, can I do that? Okay, actually, yeah. So the first thing I have to show you, security settings on this machine that I'm using because that's actually very relevant. And you should see it. Okay, let me try sharing this again. Oh, you know what I can do? Yeah, here it is. Okay, I got it. So as you can see, I don't have cloud-delivered protection because I don't want the stuff I'm working on at the moment to get shipped off to antivirus analysis land essentially. So that started off as well as automatic sample submission. But this is a brand new Windows 10 install, have real-time protection turned on, tamper protection turned on so you can't disable it. And I also, but I do have an exclusion setup and I want to explain this really fast in case you're wondering why certain things are working. So I have one exclusion here and this is this directory demo AB include. So essentially what I'm going to be doing during these demos is I have four and I'm going to have to now switch windows that I'm sharing again. So you should see hyper right now is four terminals.  So in the top left, this is just for my benefit. That's essentially, I'm trying not to anger the demo gods. So I am keeping as much of this stuff in the text file. I'm going to run the commands that are in there rather than trying to just guess. This will be relevant later. This is going to be our remote key server and you can kind of, we'll talk about that a second. This is a metasploit instance. So this is, yeah, so we're actually going to use the interpreter for this. So like every AP engine under the sun should be able to detect what we're doing essentially is what I'm trying to say. We're just using a, the payload we're going to be using is going to be a just a plain interpreter reverse HTTPS. We have to use the HTTPS because the actual unencrypted traffic will be picked up immediately. But the, so that exclusion that we're seeing we're just being difficult. I'm going to have to, it's going to be in this directory here. I'm going to exclude. And this is because we're going to be building this payload and all the payload was generated here. You know, the second I SCP that payload over onto onto my main machine, which is, which is what you're seeing in this top right terminal here. If the Federer would just do that. And I really don't want to just keep turning the fender on and off every time I have to do a demo, which is because that's just going to, I'm trying to make this goes as smoothly as possible. So the kind of compromise here is that we're going to be pulling our actual shellcode out of demo AV exclude. But when we execute it, that's not where we're going to be executing from. We're going to be executing outside of the exclusion folder. Okay. With that on the way, let's show you how we go over, let's go over how we'd make like a payload using environmental key. So, essentially the first thing we're going to do is get a list of available models, right? And just run this and these are all the different payload components we can choose from. So let's say that we want to use environmental keying. You know, we want to essentially grab let's do the FQDN because I have that written down and and the use of my current username. So like we're going to wrap the key from that. In that case, you know, we could just do this because you type on prop engine break on to new view line here. Specify that our shell code should be you know, in that if you could demo AV exclude to shell we're going to use the interface. I'm specifying this command interface. That's like literally the glue that holds everything together. You know, if you're working in C sharp you're going to use a C sharp interface. Don't worry about that too much. But we're going to say C sharp runner interface, right? And then we're going to also look at just like this encryption keys. We need an encryption key and a decryption key. So the key keys we're going to use are going to be this external X FQDN that we talked about. And notice I'm using more than one. We'll kind of go into how that works in a second. Right. It's going to use the decryption keys which is essentially these things, but we didn't C sharp because, you know, I'm just going to copy these with that there. We're then going to need to select the crypto to encrypt our shell code. So we're going to say crypto, yes, we're just going to use AES 256. That should really be named AES 256, not just AES, I should change that. And we're going to use a decryptor. So decryptor C sharp, ridge and doll AES which is corresponding decryption function that we need. Finally, for our shell code, I'm going to go ahead and use MS build because that will save me from having to compile something which will take extra time. And then we're going to need a mutator. We haven't really talked about mutators yet, but we will. But for now I'm going to say mutator. And essentially what that's going to do is going to take all the variable names and our finished output and change them to a random string. So it just makes it a little harder to signature on. And that really is, oh, we also need to specify the actual username and external FQDN that we're trying to use for our key. So I'll put my username, well as FQDN, and I'm just going to copy it from here. And hopefully this didn't update in the last time, like in the past hour or so, but I don't think it would have. And finally, oops. All right, forgot something. We need an executor function. Yeah, so we need that executor function that actually executes our shell code. And we're just going to use C-sharp virtual alec thread. So just going to make a call it virtual alec, virtual protect and all that and spawn some new thread. And we're going to make our output file example.csproj. And that's going to be our in a spilled file. Cool. Looks like your RAM didn't get any errors. If you look at our example csproj, here is an obfuscated in a spilled file. Actually, I should probably kind of show you what this is actually doing. I'm going to do mutator null, which basically install mutate anything. But yeah, so basically here are all the different components that are stacked together here, your decryption keys and your decryptor, your executor, everything else, right? And then here's your actual payload itself and payload main. Essentially, all this is just being rendered into the payload by drop engine on magically. And finally, we're going to start doing that. But I want this to be random because I don't know demo gots, I guess. So make that a random one. So now we're going to set up our handler, use exploit multi handler payload, first CTP, I'll host set L port 443, which should be correct. And I'm going to say exploit that's J to start our handler in the background. Now we're going to actually run this using as built. And there we go. Now, just to kind of case you don't believe me, like that this is actually doing something.  That was the best, whatever. Like copy of the enter nano. You know what, I'm actually deviating from the demo right now. And I think that's a bad idea. We'll get back to this if you have time. No, actually, you know what? I'm stubborn. Let's do the, yeah, if I copy MOAB, exclude empty shell, and let's just copy it up on level. We should get, or perhaps not, maybe we might have to run it to get the alert. But yeah, I'm not going to say you're tinkering with this. Let's get back to PowerPoint. Okay, from current slide. So that's our, you know, payload with basically like custom built payload with environmental keying that we literally just created in like a second. So mutator modules, right? We mentioned also that we're using, I guess not, okay. Ignore me. I could have sworn there was something else that I was supposed to talk about there. Okay. Yeah, so like the other thing, essentially what we've just done, I mean, we've said, you know, here's the executor function we want to use. Here's the shell code runner we want to use. Here's the encryption, decryption routines we want to use. And by the way, we want to drive our keys from these two specific functions and we're going to pull this stuff together and make it into a payload. And by the way, randomize all the variables in variable names in that payload and just write command and then it just does it. And then voila, you have a payload. The way that we did the actual, the changing of the variable names was using module, basically modular symbolic mutation. So drop engine supports the use of mutator modules. That, I mean, that's what they do is that they, every module that had, you know, corresponds to something that has a variable names or function names has a mutator method that gets called in the backend by whatever mutator module that you select and the mutator module then systematically goes through and takes like a list of variable names and maps them using some algorithm. The algorithm is irrelevant, it's module specific. And then when the actual, and returns back to that module, the original module, that mapping like, so like a dictionary of like, here's all your variable names and here's the stuff that we've mapped them to. And then what happens is that we render when that module gets rendered into a rendered template and that's how we're building everything. It's using change of templates. We are, a sense of what's going on is that it looks at that mapping in order to figure out what's named the variable. So this is pretty cool because it allows us to create payloads that, you know, are circumvent signature-based detections pretty easily. I only have like three supported methods in there right now, road 13, the random string, and also a simple substitution using a word list. No mutator doesn't really count because that's just, it just doesn't do anything. It's a null mutator. It's primarily there for debugging purposes. And I've kind of already demonstrated that, but if you want to just go over, you know, just once again, like with that, that looks like, you know, take this one that we just did, just print the screens that are out of the file. So for example, here's your, actually, let me use, I've got another piece of shell code that isn't so long that we can use for demos. Yeah, so, you know, here's your random strings. You know, if you wanted to use road 13, these look awful a lot like the variable names. Let's use a word list. I actually have to specify a word list when I do this. Let's use US cities. And that will, now all of your variable names are corresponded to US cities. A better use of this would just be to find like a, make a word list that actually are believable variable names. But, I don't know, this is better for doing a demo. When you go back to PowerPoint, let's move on from here. And then we just make sure, okay, cool. So, let's talk about some more keyings of the kind of techniques that we support. We talked about environmental keying, remote keying, it's also pretty neat. Essentially, instead of deriving the key from some place in your environment, you're actually going to retrieve the encryption key from some remote location, either for HTTP or HTTPS, DNS or some other communication protocol. This is actually, if you have well-designed non-attributal attack infrastructure, it actually makes this method pretty effective. You can place the key server behind a redirector and only accept requests for that key under a specific, for very specific profile traffic that's being sent to the redirector. If you want to make it even better, you can use a one-time remote key, which is a variant in which your key server, which is a server that's hosting these remote keys. By the way, you want to have one key per payload and Drop Engine does support that. So, keys should be unique to the payload that you generate. But essentially, the one-time remote key variant, once that key is successfully retrieved from the key server, it actually is deleted from the key server. So, the key server goes back into its database, just nukes the key. And what this means is that any future requests for that key are either going to be ignored by the key server or return some kind of junk data, or you could even, at that point, respond to that kind of request by returning a redirect. So, you could do what a redirect would do and redirect that request to something innocuous, like, you know, like remotely hosted jQuery or something. Like, look, it's not just jQuery, right? But, so, I mean, there are some obvious advantages to doing key in this way. It's very resistant to analysis. The encryption key is not stored on the payload file. And it's hopefully being protected in transit using TLS. It's also less targeted, right? You know, well, highly targeted payloads are good in a lot of cases. Sometimes they're not. Sometimes you don't just want to attack the computer of that one person that has that particular hard drive or username. So, that would be one, a little more breadth. And in this case, you don't have to limit your scope. I mean, you should limit your scope regardless, but I guess what I'm saying is like, the scope isn't, you know, implicitly limited by your key mechanism at this point. So, I'll show you how this works and it drop-ends really fast. And I'm gonna go back to my screen here or go back to Hyper. And so, in the bottom left, we have this, what looks like a Plascap, it is. It's a really, really basic. I honestly did put a whole lot of time into this because, you know, I was just trying to get the perfect concept out the door, but this is our remote one-time key server. And what we're gonna do here is get a very similar payload to what we just did, right? So, we're gonna grab this. And this is, you know, as you can see here, well, it's just RAM. But what we just did, we created a shellcode using our M2 shell, like our server shell that's in that M2 shell.bin file. It's pretty much the same attributes we used last time. The difference here is we actually added some key and components. We added a new key here, which you can see right here. It's the E-key one-time remote HTTP and the corresponding decryption key, which is their D-key remote C-sharp OTK HTTP. And essentially what this is doing is it's just providing functions that will attempt to reach out to this server right here that is running in the bottom left to retrieve this encryption key. And it's gonna use that by using a specific identifier since you need to your implant. So that, you know, essentially what this guy down here is gonna do is look in the database to see if that identifier exists. And if it does, it's gonna respond with the decryption key and send it back to our payload. And then, you know, it'll be deleted from the database. So if subsequent requests just won't be honored. So let's run that really fast. We just kind of crop the bottom left here. Make sure we don't have any stragglers either in our sessions or, oh, okay, cool. So we're gonna run our handler and we gotta rebuild this really fast just to make sure everything looks up to snuff. It does. And we're gonna call it in miss build once again. And there we go. And you'll notice here, this traffic showed up in the Flask app and that is our server going back. That is our payload retrieving the key, right?  And the reason why I'm doing that is I wanna show you what happens when we, so we've already retrieved that remote key. So what we're gonna do now is we're going to just kind of demonstrate. If we happen to curl for that same value, right? Let's say we do a curl request to 127, as it's running on mobile, so we can just do this. HTTP, one slash slash, we're not using SSL at the moment.  We'd actually need the implant ID, wouldn't we? Oh, no, here it is. Yeah, let's grab this implant ID right from here. Cool, so we have everything we need to make this work. And you'll see that we don't actually get a response this time because it's just, it's been cleared. All right, so back to our PowerPoint. We've got about 20 minutes left. Open this up for chat phone about 10. Let's go back here, press slide. So one thing I'll notice is that we're, is that we're actually using multiple encryption keys here or it seems like it, right? Because we're specifying these different key types and combining them to create a final encryption key. We're doing this using something that I like to call key stacking, which is the practice, and this is just a, key stacking is just like a label. I'm sure this has been done before like at any times because it's really not that complicated. Like it's pretty simple in practice and we'll see that in a minute, but essentially key stacking is the practice of combining the results of multiple key methods to create single combined keys. So for example, let's say we have one key that's comprised of four parts, the hard drive serial number, external IP address, a not stored in the payload file. So it's stored component and also one time key that is retrieved over HTTPS. Well, in that point, we essentially would just make four method calls of it, our payload, to four different key derivation functions can catnate the results together. And by doing that, we'd have one encryption key that was derived from all these different sources. So one advantage of doing this to give us a little more security is that it's difficult to compromise. This advantage is kind of complicated. If you do this by hand, like it's adding more moving parts to the equation. But once again, since we're using a framework, it makes it a little less complicated. Essentially what makes this possible is that with the actual architecture that we saw at the very beginning, it has been updated a little bit. So remember originally we just had that shellcode runner and a payload main in there and an executor function. In this case, we still have our shellcode runner. It's our outermost wrapper. That's our LulzBoss specific script that contains the encapsulates everything. But we also have our payload main. And within that, we now have, you see here, we all have all these d-key functions. So we have a d-key one, d-key two, all the way through d-key n. It's an arbitrary number of d-key functions. And essentially the way that this works is that, you know, each key part is extracted from each of these key derivation functions and passed to the decryptor function along with the encrypt the shellcode that combined or stacked key is then used to get the plaintext shellcode as passed to the executor. So, you know, really this, it's not too bad, you know. And we just did, we already went over key stacking. So let's talk about pre-models and post-models. And I included the cookie monster here because like who doesn't like the cookie monster? Like really, so what are pre-models and post-models? Essentially, this is a concept. I mean, there's often, often when you're executing that initial access payload, right, that does shellcode within your shellcode runner. There are things that you want to do first before you actually start trying to execute your shellcode. You know, for one thing, you might want to perform sandbox checks. You know, like if you're trying to see if you're in one of those automated sandboxes, you might not want to, you might want to check for some known attributes of the sandboxes such as certain file paths or, you know, number of CPUs or what have you to actually see if you're in, you know, like a quote unquote real environment or in a sandbox. Also, we mentioned that this is likely going to be going through the CLR. So you might want to try to bypass AMSI. And that's something that you might want to try to do before you execute your shellcode. So a pre-module is hard to do.  So what Drop Engine lets you do is you can specify, you know, any number of pre-modules that you want. And these will just get run before everything else does. You know, so for example, if you want to run a sandbox check in AMSI bypass, you pass those both to Drop Engine as pre-modules. They then get executed. And then once they finish executing, and they are executed in the order that you specify them by the way, which is pretty cool. You actually control which order they execute in. But once they finish executing, then we execute the rest of your shellcode here. So, you know, post-modules, they're pretty much the opposite thing instead of being prepended to the beginning of the payload, we append them to the end of the payload. So that's useful for if there's something that you want to do after your shellcode terminates.  And both pre-modules and post-modules should be completely modular and mutable, just like the rest of the payload's components. So you can mangle all the string names and variable names however you want. And so if we're gonna demo process of adding pre-modules, here's how you do it. Make this a super fast one. So for example here, you can see if we want to create a payload that, you know, let's say we want to run an empty sandbox check for, you know, say like, you know, check to see if we're in a sandbox by checking the minimum number of USBs that have ever been installed, you know, if you, let's say we look for also file paths that can be led us to being a fan, that were in a sandbox. So we do a file path, path-based sandbox check. And then finally we want to execute a SCAM, AMG bypass for the AMG scan buffer bypass. We can just, you know, append these here as pre-modules. And oops. It's okay. Should be M2 shell, not shell. Go just like this. And essentially, actually if you're curious what this looks like, I'm not actually going to say this. I'm just going to switch with the screen. So yeah, that's what I want to do. And then I'm going to use that, that really, really small shell code that I showed you earlier, that's easier to read. Should not be from the exclusion folder, because that small shell code is not in the exclusion folder.  So that all gets done right before you're in everything else. So once again, let's we're up on our under-spill payload. We're going to start up our handler and we created it in the last steps. I'm not going to recreate it. And you see that it runs. So everything just kind of goes swimmingly because we're out of sandbox. We go ahead and fill this and just wrap this up. We kind of did both demos at once and that's all right. And the last thing we're going to talk about is essentially how do you create drop engine modules? So the goal of the project isn't really to provide pre-bake methods for bypassing AP and EDR. It's really more, we did provide some of these big example modules but really, you know, that they're not really doing anything new or novel. And this is my design because the goal of this framework is to enable red teams to maximize the value that they get from their individual payloads by converting them into reusable modules. And if you're a defender, this is useful too because you can use this tool to quickly create large sets of sample payloads from which to build a learning strategy. So there are two types of modules that you can build, input modules and output modules. Essentially input modules are anything that's going in before it gets your payload. So your encryption functions and input module and, you know, whereas for example, your executor function is going to be an output module. This is super important. Shout out to Marcelo by Pleader for his basically like the loader that it's using to build these is heavily based off of some of the stuff he's done. So I think about input modules, they always have to correspond to one or more matching output modules, but they're really, relatively simple to implement. As you can see here, you know, what we're doing is we're just inheriting from the, we're building an encryption key module and we're just inheriting from this base class and then creating constructor, which is just kind of setting the various attributes associated with this. Although all the argument handling is up on the back end. So you just, if you want to pass command line arguments to your module, just add an add arguments function. If you've ever used our parts in Python before, it's, you could just add all these here. The parser was already initialized by one of the parent classes of your module. So you could just make calls to self.parser at argument and add all the arguments you want and that will get parsed automatically, essentially once your payload is generated. And then you have your generate routine and this is essentially, well, for encryption keys is generate, but depending on the module type we're using, you're gonna have your function that actually does stuff. Output modules, very similar, but even simpler. So the way the output modules work, this is the actual, these actually get rendered into your payload. They may potentially correspond to an input module. They may not as in the case of like an executor, for example, but it's really just a simple to your component design, you have a JINTA template and Python file that stores metadata that is passed into that JINTA template. So for example, here I've got a list of all my variables and imports and whatnot. And that gets passed to the interface and then passed back and then load into the template in however format you need it. And then here you just have the JINTA template they're using. As far as actually like creating these things go, how much time do we actually have? I won't spend too much time on this. And just a minute, if you wanna create one of these modules, aside from the stuff, I guess what we haven't really showed you is the template, but here's just an example module. It doesn't really do anything. But I see all that you have to do is just set these attributes and then you give it a list of interfaces it's compatible with. And then any input module is compatible with, give it a list of all the variables in your C-sharp file or whatever kind of file or is it really, it's not limited to C-sharp. And then also give it the name of the template and give it a function and class name in this particular instance. You have to do that. It's not very long. Then you have to create a template, right? And so literally this is the process of creating a template. And I'm actually working on automating this, but that requires essentially, you need to write something that can parse C-sharp then that's coming along, but it's not quite done yet. But for now, what you do, if you wanna actually turn just a normal C-sharp file into a template that can do understand but still by drop engine, you just find all your variables in here and just wrap them in this ginger parameter. So you just say B and then you, I use a syntax here. So we've got variable Nick, we just kind of edit it like that. And then we can do the same thing here, with variable N. Should be our only two variables there. And I just do that once again over here. So this is kind of painful for longer ones, but it's the only have to do it once in that case. And I'm working on some, some ways to automate a lot of that, check screen, PowerPoint, and that's pretty much it. I'm going to actually, this is zoom thing, so I don't really know, that's the location of the project on GitHub, if you wanna check it out, I'm gonna, I think it's supposed to be like a Q and A thing right now and I need to figure out how that works. So I'm gonna. Yeah, basically, once again, thank you so much for your time and for the presentation here, excellent presentation. So for the Q and A, you can jump into this court, it's gonna be offline, of course, it's a little bit of delay between the stream and when they can answer. And there's a lot of people actually already talking about the presentation. So. Super cool. Kudos. And for those of you also that probably just joined, please take a look at all the talks and all the activities that we have in our website. The description should be in the bottom of the stream, right? So in the description of the stream, all the links and related material. And also please join the conversation as we said in this court. So we're going to go in a little break and the next presentation will start in just a few minutes. Thank you again. Gabriel.


Intuition is often an underrated yet essential tool you can use when you're dating, escaping danger, or even to build your career. The International Association of Administrative Professionals and Office Team surveyed 3,500 administrative workers and 1,300 senior managers, and discovered that 88 percent of them make decisions based on their gut feelings. It turns out intuition is more than just magic when it makes up a good chunk of our life choices. Are you wondering what your intuitive power is? There are five types of intuition. Analytical, observant, questioning, empathetic, and adaptive. Analytical intuition involves spending a lot of time researching and gathering data before making a decision. People who identify as analysts prefer to explore every potential scenario and want to understand all the details before a judgment is made. They like to take their time and are the most thorough and precise. Therefore, haste, impulse, and recklessness are commonly avoided by them. Lawyers, for instance, are specifically trained to rely on their analytical intuition when they focus on facts and objectify to solve cases. Next, we have observant intuition, which involves gathering clues about people and scenarios. People who identify as observers are often visual learners and pick up on physical cues in their immediate surroundings. They are experts at finding visual patterns and notice subtle differences in their environment, such as a co-worker not returning their smile, or when an object goes missing. Observers tend to excel in outdoorsy and hands-on activities, such as gardening or visual thinking careers, such as art, love development, and graphic design. Then, there is questioning intuition, which involves making judgments based on real-life evidence. People who identify as questioners would rather rely on asking or surveying others directly, instead of looking up online statistics before making a decision. For example, before releasing a new video, questioners would rather directly ask their community viewers what they want to see next, instead of searching what is trending or popular today. People with questioning intuition can make excellent investigators, accountants, and financial examiners. Then we have empathetic intuition, which involves great listening skills to understand where the source of the problem lies. People who identify as empathizers withhold judgment and allow their colleagues and clients to vent. This helps them figure out what works best in their favor before making a decision. They usually work well in teams and are cooperative, considerate, and introspective. People with empathetic intuition make natural psychologists, doctors, writers, and counselors. And finally, there is adaptive intuition, which is the most common form of intuition represented to the public. Adaptive intuition is based solely on gut feelings and is used by others to help them think and react quickly in situations that require immediate action. Adapters are great at giving advice and make reliable workers because you know you can always turn to them when you're in trouble. They seem to always have a hunch on just about everything. We hope that this video helped you discover more exciting things about yourself. Which type of intuition do you identify most with? Share your thoughts with us below. To learn more about intuition, be sure to check out our video, 7 Things Highly Intuitive People Do Differently. Also, don't forget to subscribe for more content from Psych2Go and check out our Patreon. Thanks for watching!


The research field of systems biology has led to the development of network pharmacology, which is more effective for establishing a compound protein slash gene disease network and revealing the regulation principles of small molecules in a high throughput manner. This approach makes it powerful for analyzing drug combinations, especially traditional Chinese medicine, TCM, preparations. The work summarizes TCM databases and tools, focuses on several representative applications of network pharmacology for TCM research, compares the general statistics of current TCM databases, evaluates search results based on 10 famous herbs, and suggests future studies should focus on both the microbiome and TCMs to better understand and treat microbiome-related diseases. This article was authored by Ruan Zhijian, Shui Zhu, Hong Bai, and others.


Now introducing the Fly 3 bass from Blackstar. This 3 watt mini bass amp includes two channels, clean and overdrive, sub-control to add amazing low-end. 3 inch full-range speaker producing Blackstar tones. It's battery or DC powered, MP3 stereo line in, emulated line out for silent practice or recording. Also available as a 6 watt stereo setup, perfect for PC speakers and MP3 playback.


Hi, my name is Father Mike Schmitz, and I'm a priest of the Diocese of Duluth in Minnesota. I'm going to be heading to Encounter in St. Louis in just a couple days, just a couple of weeks, and I'm incredibly excited because, one, I get to be with you guys during the whole weekend. Secondly, is because I think that Encounter in St. Louis is absolutely critical for any young adult. Not because of this, not because, like, well, I need to recreate the experience I had of Stupendville when I was in high school and do it like as in a young adult. That's not it at all. It's very, very different from that. Because in high school, yep, there was this kind of like, I needed a shot of energy.  But a lot of times, what do we find ourselves doing? We find ourselves wandering through this world, not knowing where to turn. Looking to this world for answers. And sometimes the world gives us some decent answers, and sometimes the world really misleads us. Encounter STL or St. Louis is all about trying to give young adults concrete tools, like adult tools. And adult level tools. Like actually one of the things I'm excited to do is present on a level that's just kind of the next level. And a level that's not simply limited to, OK, here's the introductory versions of Christianity or Catholicism. Although, we're going to start there, so you're not going to be lost if you feel like, well, I'm not at a certain level. That's fine. The reality is, we're going to begin at a certain place, but then we want to go deeper.  Encounter STL is all about taking help in young adults, take that next step to a deeper, more fulfilled, more profound life in Jesus Christ, rooted in Christ. Because as you know, you have bigger questions now than you probably did when you were in high school. You have bigger issues you're facing now than you probably did when you were in high school. All the things you look forward to when you're in high school and thought, well, you know, once I get to college, once I get past college, all these things will be resolved, that you're actually facing bigger, more complex, and more difficult situations in your life now than you ever have in the past. And so what Encounter STL, St. Louis, is all about is about trying to provide the tools for adult Catholics to live in an adult world. So that's one of the reasons I'm incredibly excited. If you haven't registered yet, I understand why. Because you might be suffer from optionitis. You maybe suffer from commitment phobia. And so this kind of notion of, well, maybe I'll do this. Maybe I want it's a whole weekend. I don't know if I have a whole weekend to spare. I don't want to get done on Sunday. I know how tired I was when I was in high school and I got back from Steubenville and I was exhausted and all I had to do was sleep. Now I'm an adult. I have to go to work on Monday. This is the kind of thing where it will definitely be worth it. And I invite you, please don't give into the fear. Don't give into the, you know, kind of the optionitis or commitment phobia, but just to take the step. And if you still have time to register, fantastic. If you don't have time to register for this year, please make the commitment, mark it on your calendar for next time. But why put off something that you could do now? Why put off getting the tools that will help you live your life? Now, why delay in any way or for anything? My name's Father Mike Schmitz. I just want to encourage you to get to St. Louis in a couple of weeks. Get to St. Louis in a couple of days and get to encounter St. Louis because you will encounter more than you could ever imagine. God bless.


LivePerson is a SaaS company since 1998. Our mission statement is to create meaningful connections to our customers using our reach multimedia platform. With our live engagements, SaaS service, we are able to help our customers reduce bounces from their site and increase sales. We have today 8,500 customers, 8 out of 10 from the Fortune 500. App time is a very big deal for us. This is why LivePerson for many years used only physical servers and very small footprint of VMware. 3 years ago we decided that we want to go to virtualize as much as possible. We considered our minimum requirements which were to be able to scale to thousands of VMs with commodity servers we had in place. The solution must be cost effective and we wanted to transform our infrastructure to pass style, platform as a service style. We considered a few options, Solaris zones, VMware and OpenStack were the top 3. We already had a small footprint with VMware and we knew that going with VMware is a sure bet. The only issue here was that it did not stand to 2 of our minimum requirements which were cost effective and to be able to utilize in the solution all our existing hardware which is cost related issue as well. We started small with the OpenStack, gave it to specific teams in R&D and QA. We also started small in production, deploying it only on new and small impact services such as alpha and staging. In time we built our confidence, having Puppet integrated fully in LivePerson helped a lot. It helped in provisioning new servers and services, making the adoption period smoother and the rest is history. LivePerson have today in production 1400 instances with more than 6000 cores and we continue to grow daily. OpenStack is running all of our services from some of the components up to 100% of them. Our plans and infrastructure roadmap is going with the OpenStack, utilizing new features coming our way like heat, cilometer and many more existing stuff.


The greatest entertainers in America as requested by you the men and women in the United States Armed Forces throughout the world Command performance presented this week and every week till your home from the hospitals and back from over there Frank Bingman turned off the top of another command performance Half an hour of the best for the best, that's you Loaded according to your letters to command Care of Armed Forces Radio, Los Angeles, USA Well, you guys and gals really know how to pick them for your hostess tonight is really a pip It's the beautiful talented DECA record star, the star of Radio's Club 15, Evelyn Knight Hi everybody, glad to be back once more And right off the bat, I'd like to answer those requests from Glad Sack Jolly, Gruesome Bakewell And the rest of the listeners to WVTR Tokyo with a little item labeled, The Tourion is Bonnet Mac Tavish was pipe major in the Highland Scotts Brigade And proudly led his regiment when it was unparried He loved her highland lassie and before he went away She sewed a little keepsake on the top of his beret His red dude was not the mooner, his red dude She said to a Mac Tavish man if you were true to me The Bonnet Tourion, his red dude, his red It's the first command performance business on hand Gang, here's a new face on your show, the country's newest sensation Much thank you, hi, Evie Glad to see you, Vic Say, you know, you're an awfully popular guy They tell me your records are selling like hotcakes I know, I wish they'd sell like records How's about giving us a sample of that liquid larynx? Well, I'll tell you, Evie We've got a song we'd like to do We do hope you like it, it's just written by a very great team Jerome Kern and Oscar Hammerstein The song, Why Was I Born Wonderful And I hope you like it Stars we couldn't possibly crowd into just one show And now we're going to thank to just one man One man, and how is that possible? Well, listeners have been hearing good things about He's becoming the king of the smart supper club comics I mean, of course, Arthur Blake Thanks a lot Right away I got to explain this 12 feet of hair hanging down my spine I need it in my impressions You know, Evelyn, I do Ronald Coleman, Spencer Tracy, Lionel Barrymore Clock cable Excuse me, Arthur But those guys all have close haircuts So what are you doing with all the hair, huh? Stove it in my ears, I can't stand impersonation Come to business, Arthur Suppose we fill those thousands of orders By presenting a digest version of command performance With all 8 million guest stars provided by one Arthur Blake Command performance USA The greatest entertainers in America As requested by you The men and women in the United States Armed forces throughout the world Your host tonight is Arthur Blake Yes, and here's our first guest One of the top hits on your hit parade Jimmy Stewart Well, I really shouldn't be on this command performance You see, the marine who wrote Asking me is now an enemy of mine Made a foe out of him Won all his money in a crap game That's what you call making a foe the hard way Well, gosh, old jelly beans Look who's coming in now, Catherine Hepburn Hello, Jimmy, darling Is that really you? Really? I've heard such a dull conversation I'm sorry, Katie, I don't have any calla-lalays for you Oh, I'm so tired of those beastly calla-lalays I'm sick and tired of walking around with calla-lalays That's why I'm so glad to see these servicemen I'd much rather be Roman in the glomen with a yeoman I must be going now, really, I must So long, Katie Well, look who's over there now Say, isn't that film land's greatest gossip reporter Head of Hopper? Thank you and hello, everybody This is Head of Hopper bringing you the low down In the higher ups in Hollywood I attended newcomer Arthur Blake's debut last night The place was packed to the doors What celebrities, everybody who came Or who could come, stayed away The line of people waiting at the door Reached way down the street, two blocks north Clear to the Paramount Theater Come to think of it, that's the way they were facing But only way friends, more power to Arthur Blake A talented young man who rose from nothing To a state of extreme poverty Yeah, now gang, here's film land's Greatest Gossip Reporter, Loella Parsons Thank you and hello to all of you From the high looses I'm Percy Lope with Phil Spitalney's orchestra I think I'll get up on my wood-bearing soapbox Oh, my Well, look who's under the table Head of Hopper Lolli darling, I do love that polka dot dress you're wearing Thank you, Head of, but I'm not wearing a polka dot dress This is his jab this evening, gal Wonderful, darling, how did you ever get those warts lined up like that? Sweetest things, head and deer Would you like to go out to my car and breathe the exhaust pipe for a while? Darling, tell me, did your parents have any other children Or is it still one zombie to a customer? Wait a minute, girls, wait a minute, wait a minute You've got to break this shop because here comes Peter Laurie Look who else is dropping in to be on command performance Banty Davis Peter, Peter, Peter Peter, darling, I have a cigarette Davis, would you mind holding your hand still? I can't like your cigarette if you keep making circles with your hands Just a habit, darling But who else do you know that can talk to you and wipe your windshield at the same time?  Yes, Edward G. Robinson, that's me. Yeah, yeah, yeah, yeah, yeah. I'm a pretty tough guy, see? Yes, pretty tough. In that tough neighborhood I grew up in, a guy had to be tough. Had to live by your fists, always by your fists. While I was 12 years old before I knew I had fingers. Edward, you're pretty good with a gun too. Yeah, I can shoot faster than anybody alive, see? Nobody can shoot faster than me. That's why they call me, get the lead out, Robinson. Yeah. Uh, well now to put a fitting climax to this star-studded command performance, I want you to all listen to Mr. Dorothy Lamour. Dottie, the stage is all yours. Another talented group of people. Well now, thank you kindly, partner.  Oh, Arthur Blake, I didn't know you did a Western too. Oh shucks, I'm not Arthur Blake, I'm just letting my hair grow for a Western moving picture. Golly, gang, then I guess this isn't an imitation. It's really Lloyd Perriman and all the rest of the Sons of the Pioneers. Well, thank you very much. Why, yes, ma'am. Why, why Evie, my great grandfather was the first man to bring a horse from Kentucky Detectives. No kidding. You bet he did, and Kentucky made him bring it back too. Well, I guess we better get on to some music. What, uh, what have you boys cooked up for us? It's a new tune that I think has a great future. It's called The Lucky Old Son. Yes, Evie.  Oh, yeah. The roof can fall in, the dam can bust, the children can starve to death, yet through it all they remain calm and happy. Well, Sergeant, we're prepared to try and kill off such programs with a special drama about a typical perpetually happy family. The gruel joys. Tonight, we present chapter 312 of book 27,983 of our story of the philosophical gruel joy family. This chapter is entitled Shirley Temple, or John's Other Wife. Mother Grubnick's Bird Gravel Company, makers of Mother Grubnick's Pettigreed Bird Gravel, brings you the family all America adores, the gruel joys. Yes, the gruel joys, the sweetest, nicest, homeiest, philosophicalist, lovingest, sugaryest, darlingest, most not-shading family in America. But before we put on our rubber gloves and pick up the gruel joys where we left them yesterday, a word from our sponsor. As you know, our ketchish slogan used to be Mother Grubnick's Bird Gravel is the only bird gravel that contains gravel. But the other day we had an explosion in the factory and now our new motto is Mother Grubnick is the only bird gravel that contains Mother Grubnick. And now for the gruel joys. Remember yesterday when we left the gruel joys, Victor was about to hit his wife Portia with a coal shovel. Did he hit her? Yes, he did. But it was just a lover's quarrel. It might have happened in any American family that had a coal shovel. As we join them today, we find Father and Mother Gruel Joy sitting in the parlor reading. Let's listen. Oh, Victor, darling, there's a precious frown on your precious philosophical brows. What's wrong, precious? Well, I'm a bit worried about Little Herman. Don't you think precious Little Herman is too skinny? Skinny? Why, Angel? Why, this morning he pulled the stopper out of the bath sub and he slipped down the drain. Wasn't that precious of him? El Segundo, when he looked for him, he should be coming through by then. Of course, nothing ever goes wrong because in this world good people are good people and bad people are bad people and the bad people are never bad and the good people are always good. Now there's a great hunk of philosophy. Thank you. That's by Edgar A. Guest. Edgar A. Guest, the poi? No. Edgar, a guesst that divide a wee sanitarium. Well, fortune, I tell you, let's turn on the radio and get some joyous news of the happy outside world. Flash, it has just been learned today that 60 million people starved to death in Siberia. Say, did you hear that, precious? 60 million people starved to death. Yes, precious, now that they took it seriously. Another flash. Today, 49,000 people were run over by steam rollers. Isn't that precious? Another flash. Two million people drowned by a flood. Two million people. Wow. Is this that precious, precious? Yes. One final bulletin. Mother Grebniks has decided to drop their daytime program about the happiness family, the drool joys. What? Portia, this is serious. I'll tune in to great analysis. Great and... great news analysis. Yeah, great news now, analyst. Somebody who keeps up with the important developments in news. Oh. I know who you mean, Victor. Don't tune her in. I couldn't stand her at a time like this. But this is her station. Hell, let's just elope with the entire student body of Vezer College. For the male, dear R.G. I'm sorry, but Lana Flapslattles, telephone numbers and military secrets, knowing only to the members of the United States Army and Navy. You better take care of that last important matter. One moment. Portia, Portia, this must be the this must be the bulletin about whether Mother Grebniks keeps us on the air or not. Friends, I have something very important to take care of. Dads, now she's lost her place. No, I'm gonna turn that darn thing on. No, don't, don't turn it off. Why you?  You still love me, don't you? Why, of course, honey love. Her announcement might only mean the difference between life and death. A slap happy broad.    Well, I'd give a million dollars to get a divorce from her. I could get one too on the strength of her diary if I only knew where she hides her diary. Completely comfortable, Victor, darling. I bet he'd love to know where I'll hide my diary. Oh, swell. I wonder where she hides it. Uh-huh. Little does he know it's right under the cushion of this love seat. Where? Under the love seat. I thought so. I thought so, you faithless hussy. This is all the evidence I need. Take that. Now that you're shut up, I can finally turn on the radio and hear what Luella was trying to say. Marvin, are you positive? Come on, Luella. Marvin, are you sure this is it? Say, Evie, I understand you and Victor Mone have cooked up a really great closer for the show. A duet, is that right, Vic? Yep, and it's something we hope those customers around Okinawa will like. Exactly like you. Those love scenes exactly like you.  You make me- You seem to understand even dream of- And now, Evie, shall we say good night to the people? Right, Vic Mone. Why don't you tear soft? Okay. Good night, gang. Frank Bingman. Good night, guys and gals. Sons of the Pioneer. Good night to all of you from hell! Radio service, the voice of information and education.


Hi everyone and welcome back. If you're new, a huge welcome to you. If you want to subscribe, then subscribe and you'll get a notification when I post my videos. But if not, as always, don't worry about it. Just pop in when you can. It's fine. So today's video is all about how to survive as a newly qualified nurse when you very first start. And I hope I can give you some tips and advice to help you out. So when you first start, it is going to feel very much like you're still learning, you're still that student. So don't do what I do and forget your pen and notepad. Take a pen and notepad and write everything down, any routines down, any like medications down, computer system stuff down. Like I've filled my book with step-by-step instructions of how to do things so that I don't have to keep asking people. I can just refer to my book and then carry on. It's honest to God, it will help you out so, so much if you do this. So another tip is on your first day, know where everything is, know where your resource trolley is, know where your policies and procedures are, know where your telephone numbers is in case you need to ring, the emergency protocol, the fire safety stuff, because you never know what's going to happen on that first day. You might be newly qualified, but the patients there are still patients and the colleagues around you are still your colleagues. Things could happen and you need to know what's going to happen. So when you get there, find out. My next tip is just relax and I know it's going to be really like, oh my god, overwhelming, stressed.  It's not a race, slow and steady wins the race. You don't need to rush into everything. You don't need to get full on, get in there, stuck in, day one. Please just go as comfortable as you can go. As long as you're confident and comfortable to do things, do them. If you're not comfortable, if you haven't been shown, if you haven't been trained, please don't do them. Ask for advice, ask for training, ask for help and you'll be okay. Because at the end of the day, this is real life, it's real patience and patient safety always has to come first and we have to work within the NMC code as you know. Remind yourself that it's okay not to know something. I've been reminding myself this all week, this is my second week now as a newly qualified nurse and there's been times when I've looked at something and I was like, I literally have no idea. It feels like I've forgotten everything from the last three years and it's okay just take a deep breath, think about it logically and if you really don't know it, ask for help. There's no harm in that at all because we are still learning and it is better to ask for help, get advice than get it wrong and the patient suffers as a consequence. So please, it's okay if you don't know something, remind yourself that and that's what we've got the nice guidelines for, that's what we've got Public Health England, the World Health Organization, all of those things there as well as a backup so that we can go by evidence-based practice, research so that we can back up why we're doing it so we can rationalise why we're doing it so and you've got the team around you, you've got the nurses, doctors, pharmacists, admin, receptionists, if you don't know something one of those guys is going to know something so please go easy on yourself, it's okay and that tip leads me really nicely on to use and abuse the people around you, you've got an amazing team of pharmacy, admin, reception, even your matron, you've got healthcare assistants, you've got phlebotomists, you've got all of these people, I'm really sorry if I haven't mentioned you, housekeeping, sorry housekeeping, you've got all of these people around you that have been there for so long, they know things that you might not know, ask them whoever they are just no matter what role they're in, if you need help ask somebody and I think sometimes we forget the input that these people can have, I feel like they're so undervalued when they're absolutely amazing, every single team member I've worked with, especially in GP, they know so much is amazing so ask your teams, do not forget to introduce yourself, tell them who you are, where you've come from, all of that jazz, I find this is the best way being honest so with my patients I've been like I'm a newly qualified nurse, I'm here in practice, I hope it's okay, I can take your bloods, I can do your wounds dressings but don't worry I'm completely competent in this, I've been doing it for so many years and patients are fine with that, they love it, they're always like well you've got to learn somehow so honest to God, be honest with your patients and they will love that, they love open honest people are found, next thing is always get their name and date of birth, make sure you have got the correct patient because I haven't forgot to do this but at the very start of the consultation I haven't checked this and then sort of as I've gone in I've sort of went oh my god I'm really really sorry let me just check your date of birth that I'm speaking to the right person, check the date of birth and it was them, you're sort of you're getting into a new routine because you're newly qualified, you have to get into that routine of what you say, what you do and how you sort of do it and then once you've got into that routine it's going to flow so much nicer but get into a routine or from the start introduce yourself, get the name, get the date of birth so you know you've got the right patient, it'll just make your life so much easier I promise and you won't look silly halfway through the consultation and the next tip is it's kind of going against what I first said about take it slow and go easy but get stuck in if you are confident enough, if you are comfortable, if you're confident, be trained to do so, do it, don't sit back and let someone else do it, get stuck in and do it because the only way you are going to learn is by doing things and that's the way we learn and yeah you will absolutely make mistakes, trust me I've already made a mistake this week which luckily wasn't a life or death mistake, it was something really really simple but I felt more to provide that I'd made a mistake but this is all about learning as long as you're open, honest, reflect on it and improve and don't make the mistake again I suppose, that's absolutely fine but yeah get stuck in, make your mistakes, learn from your mistakes, reflect your mistakes and just learn and grow and I think you're just going to be amazing honestly and next I just wanted to say that if you see something you're uncomfortable with, you're not happy with, you're thinking oh why are they doing that, ask the question, if there's a safeguard and return report it, do not be too scared to report things if you see something like that out there because that's not on, we need to stop this behaviour so please report it if you're not happy with something or if you need help with something please get advice, always get advice is like the biggest tip, don't feel stupid ask lots of questions because those people around you they're all newly qualified at some stage, they were asking those same questions so please be safe and keep yourself safe and keep your patients safe. Oh and just on that safeguarding concern there is an NHS safeguarding app that you can download, the amazing Kenny who's on Twitter has shown me this I've downloaded it, it's amazing, download the app so that you know that you've got the list of numbers and emails and people to refer to if you need it but fingers crossed you will never need it but if you do they are there, they're a massive support even if you just want to question them about something, if you're not sure about something maybe the patient self-neglecting family member anything like that pick up the phone and ring someone that is your job you've seen it you need to report it and raise that concern so please protect your patients. And just some very very final last advice for you don't worry again don't worry you're newly qualified you're still learning there's that saying nursing is lifelong learning and it is every day is a learning day you will see things that you've never seen before you will do things you've never done before and you will start to think oh am I a nurse because that is how you feel I have felt that this week trust me I've seen things and I'm like how am I a nurse when I haven't seen this but if you think about the 101 conditions that are out there the 101 things that are being discovered still the 101 things updates policies guidelines changing all of the time you are never going to know at all you will there will be so many things you have not seen out there so please love yourself be kind to yourself and know that it's okay not to know something and yeah you're going to honest to God you're going to be amazing just forget those doubts and just know that you're doing amazing know that you are still newly qualified you are going to be learning still you are going to very much feel a little bit like a student until you have been working there for so many years and yeah get into your routine and you can do it with your eyes closed like some of the people that you'll be working with and don't compare yourself don't compare yourself to anybody because we're all different we all work different we all have our own ways of doing things and that's what makes us us that's what makes us unique and that is your superpower so please last note be kind to yourself don't panic about it and seek advice if you need it