CHAPTER V. THE RIV. THE RIV. THE BEGINNINGS OF THE WAR. SHORTLY BEFORE MIDNIGHT, ON THE 12TH OF MARCH 1896, THE CERDAR RECEIVED INSTRUCTIONS FOR LORD CHROMER AUTHORIZING AN EXPEDITION INTO THE DONGALA PROVENCE AND DIRECTING HIM TO OCCUPY AKASHA. The next morning the news was published in the Times, ostensibly as coming from its correspondent in Cairo, and the Egyptian Cabinet was convened to give a formal assent by voting the decree. On the 14th the Reserves were called out. On the 15th the Kediv reviewed the Cairo garrison, and at the termination of the parade Sir H. Kitchner informed him that the earliest battalions would start for the front that night. The Egyptian frontier force had always been kept in a condition of immediate readiness by the restless activity of the enemy. The beginning of the long-expected advance was hailed with delight by the British officers sweltering at Wadi-Halfa and Saras. On Sunday the 15th of March, three days after the Cerdar had received disorders, and before the first reinforcements had started from Cairo, Colonel Hunter, who commanded on the frontier, formed a small column of all arms to seize and hold Akasha. At dawn on the 18th the column started, and the actual invasion of the territory which for ten years had been abandoned to the dervishes began. The route lay through a wild and rocky country, the debatable ground, desolated by years of war, and the troops straggled into a long procession, and had several times for more than an hour to move in single file over passes and through narrowed defiles, strewn with the innumerable boulders from which the belly of stones has derived its name. The front of their line of march was protected by the Nile, and although it was occasionally necessary to leave the bank to avoid difficult ground, the column camped each night by the river. The cavalry and the camel-core searched the country to the south and east, for it was expected that the dervishes would resist the advance. Moving along the bank and prepared at a moment's notice to stand at bay at the water's edge, the small forest proceeded on its way. Wadi Atira was reached on the 18th, Tanjori on the 19th, and on the 20th the column marched into Akasha. The huts of the mud-village were crumbling back into the desert sand. The old British fort and a number of storehouses, districts of the Gordon Relief Expedition, were in ruins. The railway from Saras had been pulled to pieces. Most of the sleepers had disappeared, but the rails lay scattered along the track. All was deserted, yet one grim object proclaimed the dervish occupation. Beyond the old station and near the river a single rail had been fixed nearly upright in the ground. From one of the holes for the fish-plate bolts there dangled a rotten cord, and on the sand beneath this improvised yet apparently effective gallows lay a human skull and bones, quite white and beautifully polished by the action of sun and wind. Half a dozen friendly Arabs who had taken refuge on the island below the cataract were the only inhabitants of the district. The troops began to place themselves in a defensive position without delay. On the 22nd the Cavalry and Camel Corps returned with the empty convoy to Saras to escort to the front a second and larger column under the command of Major MacDonald, and consisting of the 11th and 12th Sudanese, one company of the Third Egyptians dropped as a garrison at Ambegol Wells, and a heavy convoy of stores numbering 600 camels. Starting from Saras on the 24th the column, after four days marching, arrived without accident or attack, and MacDonald assumed command of the whole advanced force. Akasha was now converted into a strong entrenched camp in which an advanced base was formed. Its garrison of three battalions, a battery, and the mounted troops drew their supplies by camel transport from Saras. The country to the south and east was continually patrolled to guard against a turning movement, and the communications were further strengthened by the establishment of fortified posts at Semna, Wadi Attira, and Tanjore. The friendly Arab tribes, Bedouin, Kababish, and Fogara, ranged still more widely in the deserts and occupied the scattered wells. All this time the dervishes watched supinely from their position at Fouquette, and although they were within a single march of Akasha they remained inactive and made no attempt to disturb the operations. Meanwhile, the concentration of the Egyptian army on the frontier was proceeding. The reservists obeyed the summons to the colors of their own free will, and with gratifying promptness, instead of being tartly dragged from their homes in change as in the days of Ishmael. All the battalions of the army were brought up to war strength. Two new battalions of reservists were formed, the 15th and 16th. The 15th was placed at Aswan and Korosko on the line of communications. The 16th was dispatched to Suaken to release the two battalions in garrison there for service on the Nile. The first battalion of the North Staffordshire Regiment was moved up the river from Cairo to take the place of the Wadi-Halfa garrison of six battalions, which had moved on to Saras and Akasha. A maximum battery of four guns was formed from the machine gun sections of the Staffordshires and Conaut Rangers and Hurried South. The second, fourth, fifth, and sixth Egyptian battalions from Cairo were passed in a continual succession along the railway and river to the front. In all this busy and complicated movement of troops, the Egyptian War Office worked smoothly and clearly showed the ability with which it was organized. The line of communications from Cairo, the permanent base, to the advanced post at Akasha was 825 miles in length. But of this distance only the section lying south of Aswan could be considered as within the theatre of war. The ordinary broad-gauge railway ran from Cairo to Baliana, where a river base was established. From Baliana to Aswan reinforcements and supplies were forwarded by Messier's Cook's fleet of steamers, by barges towed by small tugs, and by a number of native sailing-craft. A stretch of seven miles of railway avoids the first cataract and joins Aswan and Shalal. Above Shalal a second flotilla of gun-boats, steamers, barges, and Nile boats was collected to ply between Shalal and Helfa. The military railway ran from Helfa to Seras. South of Seras supplies were forwarded by camels. To meet the increased demands of transport 4,500 camels were purchased in Egypt and forwarded in boats to Aswan, whence they marched via Kurosko to the front. The British government had authorized the construction of the military railway to Akasha, and a special railway battalion was collected at Aswan, through which place sleepers and other material at once began to pass to Seras. The strategic railway construction will, however, form the subject of a later chapter, which I shall not anticipate. By the 1st of April, less than three weeks from the commencement of the advance, the whole line of communications had been organized and was working efficiently, although still crowded with the concentrating troops. As soon as the 16th Battalion of Reservists arrived at Suaken, the 9th Sudanese were conveyed by transports to Kusir, and marched thence across the desert to Cana. The distance was 120 miles, and the fact that in spite of two heavy thunderstorms, rare phenomena in Egypt, it was covered in four days, is a notable example of the marching powers of the Black soldiers. It had been determined that the 10th Sudanese should follow at once, but circumstances occurred which detain them on the Red Sea Latoral, and must draw the attention of the reader thither. The aspect and history of the town and port of Suaken might afford a useful instance to a cynical politician. Most of the houses stand on a small barren island which is connected with the mainland by a narrow causeway. At a distance the tall buildings of white coral, often five-stories high, present an imposing appearance, and the prominent chimneys of the condensing machinery, for there is scarcely any fresh water, seem to suggest manufacturing activity. But a nearer view reveals the melancholy squalor of the scene, a large part of the town is deserted. The narrow streets wind among tumbled down and neglected houses. The quaintly carved projecting windows of the facades are boarded up. The soil exhales an odour of stagnation and decay. The atmosphere is ranked with memories of waste and failure. The scenes that meet the eye intensify these impressions. The traveller who lands on Quarantine Island is first confronted with the debris of the projected Suaken Berber Railway. Two or three locomotives that have neither felt the pressure of steam nor tasted oil for a decade lie rusting in the ruined workshops. Huge piles of railway material rot unguarded and neglected on the shore. Rolling stock of all kinds—carriages, trucks, vans and ballast wagons—are strewn or heaped near the sheds. The Christian cemetery alone shows a decided progress, and the long lines of white crosses which mark the graves of British soldiers and sailors who lost their lives in action or by disease during the various campaigns, no less than the large and newly enclosed areas to meet future demands, increased the depression of the visitor. The numerous graves of Greek traders, a study of whose epitaphs may conveniently refresh a classical education, protest that the climate of the island is pestilential. The high loophold walls declare that the desolate scrub of the mainland is inhabited only by fierce and valiant savages who love their liberty. For eleven years all trade had been practically stopped, and the only merchants remaining were those who carried on an illicit traffic with the Arabs or with Eastern apathy were content to wait for better days. Being utterly unproductive, Swakon had been wisely starved by the Egyptian government, and the gloom of the situation was matched by the poverty of its inhabitants. The island on which the town stands is joined to the mainland by a causeway, at the further end of which is an arched gateway of curious design called the Gate of the Sudan. Upon the mainland stands the crescent-shaped suburb of El Kaff. It comprises a few mean coral-built houses, a large area covered with mud huts inhabited by Arabs and fishermen, and all the barracks and military buildings. The hole is surrounded by a strong wall a mile and a half long, fifteen feet high, six feet thick, with a parapet pierced for musketry and reinforced at intervals by bastions armed with corrupt guns. Three strong detached posts complete the defences of Swakon. Ten miles to the northward, on the scene of Sir H. Kitchener's unfortunate enterprise, is the fort of Handubh. Tembukh is twenty-five miles inland and among the hills, situated upon a high rock and consisting only of a store, a formidable blockhouse, and a lookout tower, this place is safe from any enemy unprovided with artillery. Both Handubh and Tembukh were at the outset of the campaign provisioned for four months. The third post, Tokar Fort, lies fifty miles along the coast to the south. Its function is to deprive the Arabs of a base in the fertile delta of the Tokar River. The fort is strong, defended by artillery, and requires for its garrison an entire battalion of infantry. No description of Swakon would be complete without some allusion to the man to whom it owes its fame. Osman Dignay had been for many years a most successful and enterprising Arab slave-dealer. The attempted suppression of his trade by the Egyptian government drove him naturally into opposition. He joined in the revolt of the Madi, and by his influence roused the whole of the Hadandoah and other powerful tribes of the Red Sea shore. The rest is upon record. Year after year, at a hard sacrifice of men and money, the imperial government and the old slaver fought like wolves over the dry bone of Swakon. Baker's Teb, El Teb, Tamay, Tofreq, Hashin, Handub, Gemayza, Al-Fafit. Such were the fights of Osman Dignay, and through all he passed unscathed. Often defeated but never crushed, the wily Arab might justly boast to have run further and fought more than any Amir in the dervish armies. It had scarcely seemed possible that the advance on Dangala could influence the situation around Kasala, yet the course of events encouraged the belief that the British diversion in favour of Italy had been effective. For at the end of March, as soon, that is to say, as the news of the occupation of Akasha reached him, Osman Dignay separated himself from the army threatening Kasala, and marched with three hundred cavalry, seventy cavalry, and twenty five hundred foot towards his old base in the Tokar Delta. On the first rumour of his advance, the orders of the tenth Sudanese to move via Kassir and Kena to the Nile were cancelled, and they remained in garrison at Tokar. At home the war-office, touched in a tender spot, quivered apprehensively, and began forthwith to make plans to strengthen the Suwakin garrison with powerful forces. The state of affairs and the eastern Sudan has always been turbulent. The authority of the governor of the Red Sea Littoral was not at this time respected beyond the extreme range of the guns of Suwakin. The Hadandoah and other tribes, who lived under the walls of the town, professed loyalty to the Egyptian government, not from any conviction that their rule was preferable to that of Osman Dignay, but simply for the sake of a quiet life. As their distance from Suwakin increased, the loyalty of the tribesmen became even less pronounced. Nader radius of twenty miles all the sheikhs oscillated alternately between Osman Dignay and the Egyptian government, and tried to avoid open hostilities with either. Omar Tita, shake of the district roundabout Irkowit, found himself situated on this fringe of intriguing neutrality. Although he was known to have dealings with Osman, it was believed that if he had the power to choose he would side with the Egyptian government. Early in April Omar Tita reported that Osman Dignay was in the neighborhood of Irkowit with a small force, and that he, the faithful ally of the government, had on the third of the month defeated him with a loss of four camels. He also said that if the Egyptian government would send up a force to fight Osman, he, the aforesaid ally, would keep him in play until it arrived. After a few days of hesitation and telegraphic communication with the Serdar, Colonel Lloyd, the governor of Suwakin, who was then in very bad health, decided that he had not enough troops to justify him in taking the risk of going up to Irkowit to fight Osman. Around Suwakin, as along the Indian frontier, a battle was always procurable on the shortest notice. When a raid has taken place, the government may choose the scale of their reprisals. If they are poor, they will arrange a counter raid by means of friendlies, and nothing more will be heard of the affair. If they are rich, they will mobilise two or three brigades and make an expedition or fight a pitched battle, so that another glory may be added to the annals of the British army. In the present instance the Egyptian government were poor, and as the British government did not desire to profit by the opportunity, it was determined to have only a small-scale operation. The governor therefore arranged a plan for a demonstration at the foot of the hills near Khor Wintry by means of combined movements from Suwakin and Tokar. The garrison of Suwakin consisted of the first and half of the fifth Egyptian battalions, the 16th Egyptian reservists who had just replaced the 9th Sudanese, and were as yet hardly formed into a military body, one squadron of cavalry, one company of camel corps, and some detachments of artillery. The garrison of Tokar consisted of the 10th Sudanese and a few gunners. From these troops there was organised in the second week of April, with all due ceremony, a Suwakin field-force. The plan of campaign was simple. Colonel Lloyd was to march out from Suwakin and effect a junction with the Tokar column at Khor Wintry, where the Irkuit road enters the hills. It was then hoped that Osman Degna would descend and fight a battle of the required dimensions in the open, after which, if victorious, the force would return to Suwakin and Tokar. In order to make the Suwakin column as mobile as possible, the whole force was mounted on camels, of which more than one thousand were requisitioned, as well as sixty mules and one hundred twenty donkeys. Two hundred Arabs accompanied the column to hold these beasts when necessary. Six days' forage and rations, one day's reserve of water, two hundred rounds per man, and one hundred shell per gun were carried. At five o'clock on the afternoon of Tuesday, the fourteenth of April, the troops paraded outside the walls of Suwakin and bivouacked in the open, ready to march at daylight. The next morning the column, which numbered about twelve hundred men of all arms, started. After marching for four or five hours in the direction of Khor Wintry, the cavalry, who covered the advance, came in contact with the dervish scouts. The force thereupon assumed an oblong formation. The mixed Sudanese company and the two guns in front, three Egyptian companies on each flank, the camel-court company in the rear, and the transport in the centre. The pace was slow, and since few of the camels had ever been saddled or ridden, progress was often interrupted by their behaviour, and by the broken and difficult nature of the country. Nevertheless, at about four o'clock in the afternoon, Teroy Wells, eight miles from Khor Wintry, were reached, and here, having marched nineteen miles, Colonel Lloyd determined to halt. While the infantry were making the Zareba, the cavalry were sent on under Captain Fenwick, an infantry officer employed on the staff, to gain touch with the Tokar force, who were expected to have already reached the rendezvous. Apparently under the belief that Omar Tita and his Arabs would give timely notice of an attack, the cavalry seemed to have neglected many of the usual precautions, and in consequence, at about five o'clock, when approaching Khor Wintry, they found themselves suddenly confronted with a force of about two hundred dervish horsemen supported by a large body of infantry. The squadron reeled about with promptitude and began to retire at a trot. The dervish horsemen immediately pursued. The result was that the Egyptians began a disorderly flight at a gallop through the thick and treacherous scrub, an overbroken, dangerous ground. Sixteen horses fell, their riders were instantly speared by the pursuers. Rallying thirty-eight troopers, Captain Fenwick seized a rocky hillock and dismounting with the natural instinct of an infantry soldier, prepared to defend himself to the last. The remainder of the squadron continued their flight, and thirty-two troopers, under an Egyptian officer, whose horse is said to have bolted, arrived at the Turoi Zariba with the news that their comrades had been destroyed, or had perhaps returned to Suwaken, and that they themselves had been closely followed by the enemy. The news caused the gravest anxiety, which was not diminished when it was found that the bush around the Zariba was being strongly occupied by dervish spearmen. Two mounted men, who volunteered for the perilous duty, were sent to make their way through this savage cordon and try to find either the remainder of the cavalry or the Tokar column. Both were hunted down and killed. The rest of the force continued in hourly expectation of an attack. Their suspense was aggravated towards midnight when the dervishes began to approach the Zariba. In the darkness what was thought to be a body of horsemen was seen moving along a shallow core opposite the right face of the defense. At the same moment a loud yell was raised by the enemy on the other side. An uncontrolled musketary fire immediately broke out. The guns fired blindly up the valley, the infantry wildly on all sides. The fuselage continued furiously for some time, and when by the efforts of the British officers the troops were restrained, it was found that the dervishes had retired, leaving behind them a single wounded man. Occasional shots were fired from the scrub until the morning, but no fresh attack was attempted by the dervishes. Meanwhile Captain Fenwick maintained his solitary and perilous position on the hillock. He was soon surrounded by considerable bodies of the enemy, and as soon as it became dark he was sharply attacked. But the dervishes fortunately possessed few rifles, and the officers and troopers, by firing steady volleys, succeeded in holding their ground and repulsing them. The sound of the guns at Teroy encouraged the Egyptians and revealed the direction of their friends. With the daylight the dervishes, who seemed throughout the affair to have been poor-spirited fellows, drew off, and the detachment remounting made haste to rejoin the main body. The force, again united, pursued their way to Corwintry, where they found the column from Tokar already arrived. Marching early on the fifteenth, Major Sidney, with 250 men of the Tenth Sudanese, the only really trustworthy troops in the force, had reached Corwintry the same afternoon. He drove out the small dervish post occupying the Cor, and was about to bivouac, when he was sharply attacked by a force of Arabs said to have numbered eighty horsemen and five hundred foot. The Sudanese fought with their usual courage, and the dervishes were repulsed, leaving thirty dead upon the ground. The regulars had three men wounded. Up to this point Colonel Lloyd's plan had been successfully carried out. The columns from Suwakan and Tokar had affected a junction at Corwintry on the Irkowit road. It now remained to await the attack of Osman Dignay, and inflict a heavy blow upon him. It was decided, however, in view of what had occurred, to omit this part of the scheme, and both forces returned together without delay to Suwakan, which they reached on the 18th, having lost in the operations eighteen Egyptian soldiers killed and three wounded. Their arrival terminated a period of anxious doubt as to their fate. The town, which had been almost entirely denuded of troops, was left in charge of Captain Ford Hutchinson. At about two o'clock in the afternoon on the 16th a few stragglers from the Egyptian cavalry, with half a dozen riderless horses knocked at the gates, and vague but sinister rumors spread on all sides. The belief that a disaster had overtaken the Egyptian force greatly excited the Arabs living within the walls, and it appeared that they were about to rise, plunder the town, and massacre the Christians. Her Majesty's ship Scout was, however, by good fortune, in the harbor. Strong parties of blue jackets were landed to patrol the streets. The guns of the warship were laid on the Arab quarter. These measures had a tranquilizing effect, and order reigned in Suwakan until the return of the field force when their victory was celebrated with appropriate festivities. It was announced that as a result of the successful operations the dervish enterprise against the Tokai Delta had collapsed, and that Osman Dignas' power was forever broken. In order, however, that no unfortunate incident should mar the triumph, the 10th Sudanese were sent back to Tokai by sea via Trinketat, instead of marching direct, and the garrison of Suwakan confined themselves henceforward strictly to their defences. Osman Dignas remained in the neighborhood and raided the friendly villages. On the arrival of the Indian contingent he was supposed to be within 12 miles of the town, but thereafter he retired to Adorama on the Atbara River, where he remained during the Dangala campaign. The fact that no further offensive operations were undertaken in the eastern Sudan prevented all fighting, for the dervishes were, of course, unable to assail the strong permanent fortifications behind which the Egyptians took shelter. They nevertheless remained in actual possession of the surrounding country until the whole situation was altered by the successful advance of powerful forces behind them along the Nile and by the occupation of Berber. After the affair of Kor Wintry it was evident that it would not be possible to leave Suwakan to the defense only of the 16th battalion of reservists. On the other hand, Sir H. Kitchener required every soldier the Egyptian army could muster to carry out the operations on the Nile. It was therefore determined to send Indian troops to Suwakan to garrison the town and forts, and thus released the 10th Sudanese and the Egyptian battalions for the Dangala expedition. Accordingly, early in the month of May the Indian army authorities were ordered to prepare a brigade of all arms for service in Egypt. The troops selected were as follows. The 26th Bengal infantry, 35th Sikhs, 1st Bombay Lancers, 5th Bombay Mountain Battery, 2 Maxim Guns, 1 Section Queen's Own from Madras, Sappers and Miners, in all about 4,000 men. The command was entrusted to Colonel Edgerton of the Corps of Guides. On the 30th of May the dreary town of Suwakan was enlivened by the arrival of the first detachments, and during the following week the whole force disembarked at the rotten peers and assumed the duties of the defence. It is mournful to tell how this gallant brigade, which landed so full of high hope in warlike enthusiasm, and which was certainly, during the summer, the most efficient force in the Sudan, was reduced in seven months to the sullen band who returned to India wasted by disease, embittered by disappointment, and inflamed by feelings of resentment and envy. The Indian contingent landed in the full expectation of being immediately employed against the enemy. After a week, when all the stores had been landed, officers and men spent their time speculating when the order to march would come. It was true that there was no transport in Suwakan, but that difficulty was easily overcome by rumours that 5,000 camels were on their way from the Somali coast to enable the force to move on Kasala, or Berber. As these did not arrive, General Edgerton sent in a proposed scheme to the Sirdar, in which he undertook to hold all the advance posts up to the Kokhrab range if he were supplied with 1,000 camels for transport. A characteristic answer was returned to the effect that it was not intended to use the Indian contingent as a mobile force. They had come as a garrison for Suwakan, and a garrison for Suwakan they should remain. This information was not, however, communicated to the troops, who continued to hope for orders to advance until the fall of Dangala. The heat, when the contingent arrived, was not great, but as the months wore on, the temperature rose steadily. Until in August and September the thermometer rarely fell below 103 degrees during the night, and often rose to 115 degrees by day. Dust storms were frequent. A veritable plague of flies tormented the unhappy soldiers. The unhealthy climate, the depressing inactivity, and the scantiness of fresh meat or the use of condensed water provoked an outbreak of scurvy. At one time nearly all the followers and fifty percent of the troops were affected. Several large drafts were invalidated to India. The symptoms were painful and disgusting, open wounds, loosening of the teeth, curious fungi growths on the gums and legs. The cavalry horses and transport animals suffered from Bursati, and even a pinprick expanded into a large open sore. It is doubtful whether the brigade could have been considered fit for active service after September. All the Europeans suffered acutely from prickly heat. Malarial fever was common. There were numerous cases of abscesses on the liver. Twenty-five percent of the British officers were invalidated to England or India, and only six escaped to stay in hospital. The experiences of the battalion holding Tokar Fort were even worse than those of the troops in Suwakan. At length the long foretime of departure arrived. With feelings of relief and delight, the Indian contingent shook the dust of Suwakan off their feet and returned to India. It is a satisfaction to pass from the dismal narrative of events in the eastern Sudan to the successful campaign on the Nile. By the middle of April the concentration on the frontier was completed. The communications were cleared of their human freight and occupied only by supplies and railway material which continued to pour south at the utmost capacity of the transport. Eleven thousand troops had been massed at and beyond while the Haifa. But no serious operations could take place until a strong reserve of stores had been accumulated at the front. Meanwhile the army waited, and the railway grew steadily. The battalions were distributed in three principal fortified camps, Haifa, Saras, and Akasha, and detachments held the chain of small posts which linked them together. Including the North Staffordshire Regiment, the garrison of Wadi Haifa numbered about three thousand men. The town encampment, nowhere more than four hundred yards in width, straggled along the river bank, squeezed in between the water and the desert, for nearly three miles. The houses, offices, and barracks are all built of mud, and the aspect of the place is brown and squalid. A few buildings, however, attain to the dignity of two stories. At the northern end of the town a group of fairly well-built houses occupy the river front, and a distant view of the clusters of palm trees, of the white walls, and the minaret of the mosque refreshes the weary traveller from Kurosko or Shalal, with the hopes of civilized entertainment. The whole town is protected towards the deserts by a ditch and mud wall, and heavy, corrupt field-pieces are mounted on little bastions where the ends of the rampart rest upon the river. Five small, detached forts strengthen the land-front, and the futility of an Arab attack at this time was evident. Haifa had now become the terminus of a railway which was rapidly extending, and the continual arrival and dispatch of tons of material, the building of sheds, workshops, and storehouses, lent the Africans slum the bustle and activity of a civilized city. Saras Fort is an extensive building, perched on a crag of black rock, rising on the banks of the Nile about thirty miles south of Haifa. During the long years of preparation it had been Egypt's most advanced outpost, and the southern terminus of the military railway. The beginning of the expedition swelled it into an entrenched camp, holding nearly six thousand men. From each end of the black rock on which the fort stood a strong stone wall and wire entanglement ran back to the river. The space thus enclosed was crowded with rows of tents and lines of animals and horses, and in the fort Colonel Hunter, commanding the district known as Saras and the South, had his headquarters. From Saras the army seemed to have chosen a double line of advance. The railway reconstruction followed the old track which had been prepared through the desert in 1885. The convoy route wound along by the river. Both were protected from attack. The seventh Egyptians guarded railhead, while the chain of small posts secured the road by the Nile to Akasha. The advance base grew during the months of April and May into a strong position. Only once did the Arabs venture to approach within artillery range. A small body of horse and camel-men made a sort of haphazard reconnaissance, and, being seen from the outpost line, were fired on at a great distance by a field gun. They fell back immediately, but it was believed that the range was too great for the projectile to have harmed them, and it was not until two days later that the discovery on the spot of a swollen blistering corpse clad in bright jibba apprised the delighted gunners of the effect of their fire. Warned by this lucky shot the dervishes came no more, or came unseen. The Serdar, accompanied by Colonel Bundle, his chief of staff, had left Cairo on the 22nd of March, and after a short stay at Aswan reached Wadi Halfa on the 29th. Here he remained during the month of April, superintending and pressing the extension of the railroad and the accumulation of supplies. On the 1st of May he arrived at Akasha with a squadron of cavalry under Major Byrne Murdoch as his escort. It happened that a convoy had come in the previous day so that there were two extra cavalry squadrons at the advance post. Almost at the same moment that Sir H. Kitchener entered the camp, a party of friendly Arabs came in with the news that they had been surprised some four miles to the eastward by a score of dervish camelmen, and had only succeeded in an escaping with the loss of two of their number. In the belief that the enemy in the immediate vicinity were not in force, the Serdar ordered the three squadrons of Egyptian cavalry, supported by the 11th Sudanese, to go out and reconnoiter towards Ferkhet and endeavor to cut off any hostile patrols that might be found. At ten o'clock Major Byrne Murdoch started with four British officers and 240 lances. After moving for seven or eight miles among the hills which surround Akasha, the cavalry passed through a long sandy defile, flanked on either side by rocky peaks and impracticable ravines. As the head of the column was about to debouch from this, the advance scouts reported that there was a body of dervishes in the open ground in front of the defile. The cavalry commander rode forward to look at them, and found himself confronted, not as he had expected, by a score of camelmen, but by a strong force of dervishes, numbering at least fifteen hundred foot and two hundred fifty horse. The cavalry, by trotting, had left the supporting infantry some distance behind them. The appearance of the enemy was threatening. The horsemen, who were drawn up scarcely three hundred yards away, were already advancing to the attack, their right flank protected by a small force of camelry, and behind was the solid array of the spearmen. Major Berm Murdoch determined to fall back on his infantry support and escape from the bad ground. He gave the order, and the squadrons reeled about by troops and began to retire. Fourth with the dervish horse charged, and, galloping furiously into the defile, attacked the cavalry in rear. Both sides were crowded in the narrow space. The wildest confusion followed, and the dust raised by the horse's hoofs hung over all like a yellow London fog, amid which the bewildered combatants discharged their pistols and thrust at random. The Egyptian cavalry, thus highly tried, showed at first no disposition to turn to meet the attack. The tumult drowned all words of command. A disaster seemed imminent. But the British officers, who had naturally been at the head of the column during its advance, were now at the rear and nearest the enemy.  Two of the Egyptian squadrons continued to retreat until clear of the defile, a distance of seven hundred yards, but the third and rearmost was compelled by the British officers to face about, and, galloping with this force down the ravine, Major Byrne Murdoch drove the Arabs' pale mail out of it. The other two squadrons had now returned, and the whole force dismounted, and, taking up a position among the sandhills near the mouth of the defile, opened fire with their carbines. The repulse of their cavalry seemed to have disheartened the dervishes, for they made no attempt to attack the dismounted troopers, and contented themselves with maintaining a desultery fire, which was so ill-aimed that but little loss was caused. The heat of the weather was terrific, and both men and horses suffered acutely from thirst. The squadron which had escorted the Surdar had performed a long march before the reconnaissance and was exhausted. The cavalry, however, held their position among the sandhills and easily defeated a feeble attempt to turn their right. At a quarter past twelve the dervishes began to retire slowly and deliberately, and by one o'clock, when the eleventh Sudanese arrived, eager and agog, the last Arab had disappeared. The force then returned to camp, bearing many spears and leading six captured horses as trophies of victory. The intensity of the heat may be gauged by the fact that one of the Sudanese soldiers, that is to say, an African negro, died of sunstroke. Such was the affair of the first of May, and it is pleasing to relate that in this fierce fight the loss was not severe. One British officer, Captain Fitton, was slightly wounded. One native soldier was killed, one was mortally, and eight severely wounded. During May the preparations for the advance on the dervish position at Ferkhet continued, and towards the end of the month it became evident that they were nearly complete. The steady accumulation of stores at Akasha had turned that post into a convenient base from which the force might operate for a month without drawing supplies of any kind from the north. The railway, which had progressed at the rate of about half a mile a day, had reached and was working to Ambegol Wells, where a foregun fort and entrenchment had been built. The distance over which convoys must plod was reduced by half, and the business of supply was doubly accelerated. By degrees the battalions and squadrons began to move forward towards Akasha. Saras, deprived of its short-lived glory, became again the solitary fort on a crag. Wadi Halfa was also deserted, and, except for the British battalion in Garrison, could scarcely boast a soldier. Both the Egyptian battalions from Suwaken had arrived on the Nile. The Tenth Sudanese were on their way. The country beyond Akasha had been thoroughly reconnoitered and mapped to within three miles of the dervish position. Everything was ready. The actual concentration may be said to have begun, on the 1st of June, when the Sardar started for the front from Halfa, whether he had returned after the cavalry skirmish. Construction work on the railway came to a full stop. The railway battalions, dropping their picks and shovels, shouldered their Remington rifles and became the garrisons of the posts on the line of communications. On the 2nd of June the correspondents were permitted to proceed to Akasha. On the 3rd the Tenth Sudanese passed through Ambegol and marched south. The horse-battery from Halfa followed. The Egyptian battalions and squadrons which had been capped along the river at convenient spots from Ambegol to Akasha, marched to a point opposite Akma. Between this place and the advance post, an extensive camp, stretching three miles along the Nile bank, arose with magic swiftness. On the 4th the Seventh Egyptians moved from Railhead, and with these the last battalion reached the front. Nine thousand men with ample supplies were collected within striking distance of the enemy. All this time the dervishes at Ferket watched in senseless apathy the deliberate machine-like preparations for their destruction. They should have had good information, for although the Egyptian cavalry patrolled ceaselessly, and the outpost line was impassable to scouts, their spies, as camel-drivers, water-carriers, and the like, were in the camp. They may not, perhaps, have known the exact moment of the intended blow, for the utmost secrecy was observed. But though they must have realized that it was imminent, they did nothing. There was indeed no course open to them but retreat. Once the army was concentrated with sufficient supplies at Akasha, their position was utterly untenable. The Amir in chief, Hamouda, then had scarcely 3,000 men around his flag. Their rifles and ammunition were bad, their supplies scanty, nor could the valour of fifty-seven notable Amirs sustain the odds against them. There was still time to fall back on Koshay, or even on Suarda, anywhere outside the sweep of their terrible enemy's sword. They would not budge. Obstinate and fatuous to the last, they dallied and powdered on the fatal ground, until sudden, blinding, inevitable catastrophe fell upon them from all sides at once, and swept them out of existence as a military force. End of chapter 5 Chapter 6 of The River-War This Lieber-Vox recording is in the public domain, and is read by Mark Smith of Simpsonville, South Carolina. The River-War by Winston Churchill Chapter 6, Furket June 7, 1896 Since the end of 1895 the dervish force in Furket had been under the command of the Amir, Hamouda, and it was through the indolence and neglect of this dissipated Arab that the Egyptian army had been able to make good its position at Akasha without any fighting. Week after week the convoys had straggled unmolested through the difficult country between Saras and the advanced base. No attack had been made upon the brigade at Akasha. No enterprise was directed against its communications. This fatal inactivity did not pass unnoticed by Wad Bishara, the governor of Dangala. But although he was nominally in supreme command of all the dervish forces in the province, he had hardly any means of enforcing his authority. His rebukes and exhortations, however, gradually roused Hamouda, and during May two or three minor raids were planned and executed, and the Egyptian position at Akasha was several times reconnoitred. Bishara remained unsatisfied, and at length, despairing of infusing energy into Hamouda, he ordered his subordinate Asman Azrak to supersede him. Asman was a dervish of a very different type. He was a fanatical and devoted believer in the Madi and a loyal follower of the Khalifa. For many years he had served on the northern frontier of the dervish empire, and his name was well known to the Egyptian government as the contriver of the most daring and the most brutal raids. His cruelty to the wretched inhabitants of the border villages had excluded him from all hope of mercy should he ever fall into the hands of the enemy. His crafty skill, however, protected him, and among the Amirs gathered at Ferkhet, there was none whose death would have given greater satisfaction to the military authorities than the man who was now to replace Hamouda. Whether Asman Azrak had actually assumed command on the 6th of June is uncertain. It seems more likely that Hamouda declined to admit his right and that the matter still stood in dispute. But in any case Asman was determined to justify his appointment by his activity, and about midday he started from the camp at Ferkhet and, accompanied by a strong patrol of camelmen, set out to reconnoitre Akasha. Moving cautiously he arrived unperceived within sight of the position at about three o'clock in the afternoon. The columns which were to storm Ferkhet at dawn were then actually parading. But the clouds of dust which the high wind drove across and whirled about the camp obscured the view, and the dervish could distinguish nothing unusual. He therefore made the customary pentagonal mark on the sand to ensure good luck, and so returned to Ferkhet to renew his dispute with Hamouda, bearing the reassuring news that the Turks lay quiet. The force which the Sardar had concentrated for the capture of Ferkhet amounted to about 9,000 men, and was organized as follows. Commander-in-chief, the Sardar. The infantry division, Colonel Hunter commanding. First brigade, Major Louis, with the Third Egyptians, Fourth Egyptians, and Tenth Sudanese. Second brigade, commanded by Major McDonald, with the Ninth Sudanese, the Eleventh, the Twelfth, and the Thirteenth Sudanese. Third brigade, commanded by Major Maxwell, with the Second, Seventh, and Eighth Egyptians. Mounted forces under Major Byrne Murdoch. The Egyptian cavalry of Seven Squadrons. The Camel Corps of Eight Companies. Artillery. Horse artillery, one battery. Field artillery, two batteries. Maxim guns, one battery. Two roads led from Akasha to Ferkhet, one by the bank of the river, the other inland, and along the projected railway line. The Sardar determined to avail himself of both. The force was therefore divided into two columns. The main column, under the command of the Sardar, was to move by the river road, and consisted of the infantry division, the field artillery, and the maximum guns. The desert column, under command of Major Byrne Murdoch, consisted of the mounted forces, the horse artillery, and one battalion of infantry, the Twelfth Sudanese, drawn from McDonald's Brigade, and mounted upon camels, in all about two thousand men. Very precise orders were given to the smaller column, and Byrne Murdoch was instructed to occupy the hills to the southeast of the center of Ferkhet Village by 4.30 a.m. to dispose his force facing west, with the cavalry on the left, the Camel Corps in the center, and the Twelfth Sudanese on the right. The only point left to his discretion was the position to be occupied by the horse battery. He was especially warned not to come under the fire of the main infantry force. As soon as the enemy should be routed, the Twelfth Sudanese were to return to the Sardar. The cavalry, Camelry, and horse artillery were to pursue. The objective being, firstly, Coyeka, and secondly, Suarda. The infantry column began to march out of Akasha at 3.30 in the afternoon of the 6th, and trailed southwards along the track by the river in the following order. Lewis's brigade, with the 10th Sudanese leading, two Maxim guns and the artillery, McDonald's brigade, Maxwell's brigade, and lastly, the field hospitals and a half battalion forming rearguard. The Sardar marched behind the artillery. The rear of the long column was clear of the camp by 4.30, and about two hours later the mounted force started by the desert road. The river column made good progress till dark, but thereafter the advance was slow and tedious. The track led through broken rocky ground, and was so narrow that it nowhere allowed a larger front to be formed than a four-man abreast. In some places the sharp rocks and crumbling heaps of stone almost stopped the gun-mules altogether, while the infantry tripped and stumbled painfully. The moon had not yet risen, and the darkness was intense. Still the long procession of men, winding like a whiplash between the jagged hills, toiled onward through the night, with no sound except the tramping of feet and the rattle of accoutrements. At half-past 10 the head of Lewis's brigade debouched into a smooth, sandy plain about a mile to the north of Sarkamato village. This was the spot, scarcely three miles from the enemy's position, where the Sardar had decided to halt and bivouac. The bank and foreshore of the river were convenient for watering, all bottles and skins were filled, and soldiers and animals drank. A little food was eaten, and then, battalion by battalion, as the force arrived at the halting-place, they lay down to rest. The tale of Maxwell's brigade reached the bivouac about midnight, and the whole column was then concentrated. Meanwhile the mounted force were also on their way. Like the river column, they were disordered by the broken ground, and the twelfth pseudonese, who were unused to camel-riding and mounted only on transport saddles, were soon wearied. After one o'clock many men, both in the camel-core and in the battalion, fell asleep on their camels, and the officers had great difficulty in keeping them awake. However, the force reached their point of concentration about three miles to the southeast of Ferquette, at a quarter to three. Here the twelfth pseudonese dismounted from their camels, and became again a fighting unit. Leaving the extra camels under a guard, Major Byrne Murdoch then advanced towards his appointed position on the hills overlooking Ferquette. The sardar moved on again with the infantry at two thirty. The moon had risen over the rocks to the left of the line of march, but it was only a thin crescent, and did not give much light. The very worst part of the whole track was encountered immediately the bivouac was left, and the column of nearly six thousand men had to trickle through one narrow place in single file. There were already signs of the approach of dawn, the dervish camp was near, the sardar and his staff began to look anxious. He sent many messages to the leading battalions to hurry, and the soldiers, although now very weary, ran and scrambled through the difficult passage-like sheep crowding through a gate. By four o'clock the leading brigade had cleared the obstacle, and the most critical moment seemed to have passed. Suddenly, a mile to the southward rose the sound of the beating of drums. Everyone held his breath. The dervishes were prepared. Perhaps they would attack the column before it could deploy. Then the sound died away, and but for the clatter of the marching columns all was again silent. It was no alarm, but only the call to the morning prayer, and the dervishes, still ignorant that their enemies approached and that swift destruction was upon them, trooped from their huts to obey the pious summons. The great mass of furket mountain, still dark in the half-light, now rose up on the left of the line of march. Between it and the river stretched a narrow strip of scrub-covered ground, and here, though obstructed by the long grass, bushes, palm trees, and holes, the leading brigade was ordered to deploy. There was, however, as yet only room for the tenth Sudanese to form line, and the third and fourth Egyptians contented themselves with widening to column of companies, the third in the rear of the right of the tenth, the fourth in the rear of the center. The force now began to emerge from the narrow space between the hills and the river, and to vouch into open country. As the space widened, number one field-battery came into line on the left, and number two on the right of the tenth Sudanese. A swell of ground hid furket village, though it was known to be within a mile, and it was now daylight. Still, there was no sign that the dervishes were prepared. It seemed scarcely possible to believe that the advance had not yet been discovered. The silence seemed to forebode some unexpected attack. The leading brigade and guns halted for a few minutes to allow McDonald to form his battalions from fours into column of companies. Then at five o'clock the advance was resumed, and at this moment from the shoulder of furket mountain there rang out a solitary shot. The dervish outposts had at last learned their danger. Several other shots followed in quick succession, and were answered by a volley from the tenth, and then from far away to the southeast came the report of a field-gun. The horse-artillery battery had come into action. The operation of the two columns was simultaneous. The surprise of the enemy was complete. The great object was now to push on and deploy as fast as possible. The popping of musketry broke out from many points, and the repeated explosions of the horse-battery added to the eager excitement of the troops, for what is more thrilling than the sudden and swift development of an attack at dawn. The tenth Sudanese had now reached the top of the rise which had hidden furket, and the whole scene came into view. To the right front the village of furket stretched by the side of the river, a confusion of mud-houses nearly a mile in length and perhaps three hundred yards broad. On the landward side the tents and straw-shelters of the dervish force showed white and yellow. A system of mud-walls and loop-hold houses strengthened the northern end of the village. Behind it as a background stood lines and clusters of palm trees, through which the broad river and the masts of the Arab boats might be seen. In front of the troops but a little to their left rose a low rocky ridge surmounted with flags and defended by a stone breastwork running along its base. Across the open space between the village and the hill, hundreds of dervishes on horse and on foot were hurrying to man their defenses, and others scrambled up to the rocks to see for themselves the number of the enemy. Scores of little puffs of smoke already speckled the black rocks of the ridge and the brown houses of the village. The attack developed very rapidly. The narrow passage between the mountain and the river poured forth its brigades and battalions, and the firing lines stretched away to the right and left with extraordinary speed. The tenth Sudanese opened fire on the village as soon as they topped the rise. The third and fourth Egyptians deployed on the right and left of the leading regiment, two companies of the fourth extending down on to the foreshore, below the steep river bank. Peaks Battery, number one, and the Maxim Guns, coming into action from a spur of furket mountain, began to fire over the heads of the advancing infantry. The hull of Lewis's brigade now swung to the right and attacked the village. McDonald's, coming up at the double in line of battalion columns, deployed to the left inland, round the shoulder of the mountain, and bearing away still more to the left, advanced swiftly upon the rocky ridge. The ground in McDonald's front was much broken by boulders and scrub, and a deep core delayed the events. The enemy, though taken at obvious disadvantage, maintained an irregular fire, but the Sudanese, greatly excited, pressed on eagerly towards the breastworks. When the brigade was still two hundred yards from the ridge, about fifty dervish horsemen dashed out from among the rocks and charged the left flank. All were immediately shot down by a wild but heavy independent fire. With joyful yells the blacks broke into a run and carried the breastworks at the bayonet. The dervishes did not await the shock. As soon as they saw their horsemen, among whom was the Amir Hamouda himself and Yusef Angar, Amir of the Jihadia, swept away, they abandoned the first ridge and fell back on another which lay behind. The Sudanese followed closely and pursued the outnumbered enemy up one and down the other side of the rocky hills, up again and down again, continually shouldering and bringing round the left of the brigade, until at last the hills were cleared of all except the dead, and the fugitives were running towards the river bank. Then the scattered battalions reformed, facing west, and the panting soldiers looked about them. While McDonald's brigade was storming the hills, Lewises had advanced on the village and the dervish camp. The Arabs from their loop-hold houses made a stubborn resistance, and the fourth battalion by the river bank was sharply engaged, their commanding officer, Captain Sparks, having his horse shot in four places. Encouraged by their enormous superiority in number and weapons, the Egyptians showed considerable zeal in the attack, and their conduct on this occasion was regarded as a very happy augury for the war, of which this was the first general engagement. As Lewises brigade had swung to its right, and McDonald's had borne away to the left, a wide gap had opened in the center of the attack. This was immediately filled by Maxwell's brigade, so that the whole force was now formed in one line, which curved and wheeled continually to the right, until, by the time the rocky hills had been taken, all three brigades practically faced west, and were advancing together towards the Nile. The dervishes penned between the river and the enemy, and unable to prevent the remorseless advance, which every moment restricted them to narrower limits, now thought only a flight, and they could be seen galloping hither and thither seeking for some means of escape. The position of the desert column would have enabled the twelfth Sudanese by moving down to the river to cut off this line of retreat, but the foreshore of the river at the southern end of Phraket is concealed from a landward view by the steep bank, and by this sandy path the greater number of the fugitives found safety. The cavalry and the camel-core, instead of cutting at the flank, contended themselves with making a direct pursuit after the enemy had crossed their front, and in consequence several hundred Arabs made good their escape to the south. Others swam the river and fled by the west bank. The wicked Osman Azrak, his authority now no longer disputed, for his rival was a corpse, galloped from the field and reached Suarda. The rest of the dervish force held to the houses, and variously prepared to fight to the death or surrender to their conquerors. The three brigades now closed upon the village, and, clearing it step by step, advanced to the water's edge. McDonald's brigade did not indeed stop until they had crossed the swampy Isthmus and occupied the island. The Arabs, many of whom refused quarter, resisted desperately, no without much effect, and more than eighty corpses were afterwards found in one group of buildings. By seven twenty o'clock, all firing had ceased, the entire dervish camp was in the hands of the Egyptian troops, and the engagement of Phraket was over. The Sardar now busied himself with the pursuit, and proceeded with the mounted troops as far as Mograka, five miles south of Phraket. The whole cavalry force, with the camel-core and horse artillery, pressed the retreat vigorously to Suarda. Osman Azrak, however, succeeded in transporting the women and children and some stores with a sufficient escort to the West Bank before the arrival of the troops. On the approach of the cavalry he retired along the East Bank with a small mounted force, without fighting. The Amir in charge of the escort on the other side delayed, and was in consequence shelled at long range by the horse battery. The local inhabitants, tired of the ceaseless war which had desolated the frontier province for so long, welcomed their new masters with an appearance of enthusiasm. The main pursuit stopped at Suarda, but a week later two squadrons and sixteen men of the camel-core, under Captain Mayan, were pushed out twenty miles further south, and an Arab store of grain was captured. The dervish loss in the action was severe. More than eight hundred dead were left on the field, and there were besides five hundred wounded and six hundred prisoners. The casualties in the Egyptian army were, one British officer, Captain Leg, wounded, twenty native soldiers killed, and eighty-three wounded. Forquette is officially classed as a general action. Special dispatches were written, and a special clasp struck. The reader will have formed his own estimate of the magnitude and severity of the fight. The whole operation was well and carefully planned, and its success and execution was complete. The long and difficult night march, the accurate arrival and combination of the two columns, the swift deployment, the enveloping movement, proved alike the discipline and training of the troops, and the skill of their officers. The only point on which criticism may be made is the failure of the desert column to intercept the flying dervishes. But it should be remembered they had marched far, and it was not at that time certain what the powers of the mounted troops were. The brilliant aspect of the affair caused great satisfaction in England, and the further prosecution of the campaign was looked for with increasing interest.


Good morning everyone! Let's get started for today. I hope y'all had a very nice, quiet, reflective, re-energizing spring break. Yes, I can tell by your laughs that that's exactly what happened. Good, good. Awesome. Okay, so I want to first talk a little bit about assignment two and the unintended vulnerability. So, this diagram that Eric made shows how this process, how that files that you created, that files that you got, example.py, example.py.hash.gpg, how these were created. So on the server, the server took the check sum of the example into this example.py.hash, signed that with GPG with the secret key of the server. And then that was encrypted and that's what you got. So, the idea was you shouldn't be able to change anything in here because you don't have the secret key of the server. The way it should have worked, the server should check when you submit the hash. It should decrypt that with, so if it's signed with the secret key, then what should it decrypt it with? A public key and only the public key. And if it used the public key, then it should decrypt that and compare the file that you sent with the check sum in the file. If they match, then it executes the code. I made a mistake when I was setting up the server end because I imported into GPG the public key, which it needs to decrypt the signed private key. But I also imported the public key, because I was thinking both the keys should be in there. That's exactly how things should work. What I didn't realize is that GPG, when you tell it to decrypt something, it tries something very user friendly where it says, well, I'll just try every single key you have basically until I can decrypt it. And so if you took a new file, created a new hash, and you signed that with the public key, it would, on the server, it would use the private key to decrypt that and say, oh yeah, decrypting went successful, check that they matched, and then would execute the file. So it's definitely unintended on my part. I didn't mean for that to happen. But it's got a cool way of example of how things can very easily, you know, like the code, if you look at the code, the code is fine, right? It's like decrypt it with GPG and then check that the output was zero, which means it decrypted successfully. So I thought, okay, at that point, yeah, there's no way you could forge that because you don't have the private key. So I'll have to be more careful and probably automate how I set this assignment up in the future, right? So I accidentally have that key ring in there, or that the private key in the, but it seems ridiculous, right? Because that's how you'd want it to be, because the server should have the private key in there. That's the only place the private key should ever be. Anyway, so sorry, I was frustrated with myself. So the way that, so there's a couple of ways to do this, right? Another way was, well, you can create your own example.py, right? So how many different check sums are there? How long is the check sum? Two to 32 bits. Yeah, 32 bits, right? So there's only two to the 32 possibilities, which is what, four billion? So that seems like a large number, right? But it's actually really short, so I think you said you were able to do a billion in four hours or something like that? Like 1.7 billion? Yeah, I think it ran, yeah, it was 1.7 billion people. Yeah, I mean, and that's written in Python, right? This isn't even like an optimized C version. So that's actually one of the things I wanted you to kind of learn from this is, A, the computers are really fast, right? So your computer can calculate check sum very, very quickly. So you can go and iterate through all possible check sum values to find a collision. So that was one way. The other way the way a check sum works is it's basically a CRC32 hash, but it's that CRC32 hash, hashed in with the length of the input file. So CRC32 is very, I actually don't remember exactly how it works, but it's fairly simple, right? So you can actually iterate and try to break it, I don't know. I think it was Navin wrote on the mailing list about how he did that, so that was very cool. So you can check that out. So any questions on this project? Yeah, what the unintended vulnerability was and why it occurred? And there's no, I checked, there's no way to specify to GPG, only use this key. Don't look at any other keys. You cannot specify that on the command line. It's incredibly upsetting. Did you find any other way to do this that anyone wasn't able to find? Not that I know of, I guess I didn't. I haven't read through everyone's submission yet, so I don't know if somebody did something really crazy. Anybody do something really crazy? That was not one of those two methods. Those three methods? Yeah. I was trying, but if the assignment 2, part 2 was on the same server, using the assignment 1 part 1 data expectation, I would have let my code run and that code would, I simply fin my server and I would write a receiver which would reformulate the system.exe. Yeah, they're running on separate machines for that reason specifically. And even that one, part 3, part 2 was on a different CH route, so it was even on a different server internally and inside a CH route. So even if you broke out, you wouldn't be able to affect the rest of that server. And the file permissions were supposed to be set up pretty securely so that you couldn't mess with that original code or you couldn't inject things into the GPG key ring or something like that. Anybody else do anything? Try anything crazy? I mean, crazy, that could have possibly worked, not just like... So I figured out that GPG actually tries to depict with any keys in the key ring, so I actually tried to set up my public key using assignment part 1 on the key ring so that when I ran part 2 it would use my public key. Yes, different machines and every submission is in its own CH route and then gets totally blown away, so the next one is in a fresh CH route. Some of the changes you make are permanent or should be. Cool. Okay, assignment 3 is going to be up on Wednesday. I had a little, still setting things up because there's a lot of you so I need to make sure we have no free sources, but we'll do that on Wednesday. So today I want to get back to command injection vulnerabilities, which is where we left off on Friday before break. Somebody you refresh our memories, what's a command injection vulnerability? Put something else to run. Actually, that's a very... That's actually a very good, broad description because command injection vulnerabilities literally come in all kinds of forms. Here we're specifically looking at what's called OS command injection vulnerabilities. The idea is your application doesn't want to implement every single possible functionality itself. So it wants to call out to external commands to do things. And so one of the ways that we do this, there's many different system calls. One is the system call, which executes this command in a string by calling slash bin slash sh space dash c string. So the dash c says, hey, sh, run this command that's in this string, interpret this essentially as if this was typed into the command prompt. And so what this is going to do, it's going to open a process, it's going to create a pipe, it's going to fork this new process and it's going to exec this new process and then it's going to return all the results, the output of that results basically from this pipe so we can read and write to it. So we kind of looked on Friday right before, but so how does sh or bash, how do they know what commands we type in? How do they know what's a command? What's the program? What's the argument? How does it know? Yeah, right? So we know on the command line, if we type in ls, space something. We know that bash is going to interpret that and say, okay, that first part is ls. So use paths to try to find a binary executable called ls somewhere in the path and then exec that program and the first, actually the zero-width argument is going to be ls, the first argument is going to be that second thing that we passed in and so bash is doing this parsing and actually calling those low-level system libraries for us. So what if we can control this string that gets passed in here? So what if this string comes from us? We could run any command. It's just as if we're at the command line of that system. We could run any command. So the basic idea of command injection vulnerabilities is if I can control this string, can I somehow trick bash or sh to execute whatever I want? So what can we do if we can execute, let's say, whatever strings in here? What are some of the malicious things we could do? I'm thinking evil. We can talk about evil. You could read the ETC password. Yeah, you could read the ETC password. So if you're remote, that will tell you how many other, it'll tell you all the user accounts on the system. So you could maybe try to brute force either SSH, try to brute force their password from the outside. What else can we do? Format left. Format left. The system? Two people. I think like a virus. In biology, the virus doesn't want to kill its host first.  So we're kind of the same way. It depends on what it is. Maybe we make a bank transfer out of our account and then while that's still pending, we kill that machine so there's no record of that. So now we have the money. That could be an instance where we want to kill a machine. Yeah, so we can do Rn-Rf slash. We'll try to delete everything on this computer that this program can access. Whoever is running the system command, whatever privileges that user has, will delete all their files. It'll be pretty cool. But what if we can't control the whole string? Then what can we do? So let's look at an example. So let's say we have our C code, which is a function. And so we have some command. So this is a buffer of characters, right? 10,024 characters. And we're going to printf. We're going to use SN printf. So what's SN printf? String, not secure. Yeah, another instance where terrible naming. So this means we're going to output to a string, right? What does printf normally output to? So file descriptor one. There's another way to think about that. So what's the end mean? Yeah, limit the output. So this says the end means only output at most 1,024 characters. So it's going to do this printf. It's going to output the result of this printf into the string buffer cmd. And it's going to do this only 10,024 characters. We'll see exactly why it's important next. But for here, we know, OK, this buffer is only 10,024. So we know we should never write any more data than that. So this is the printf directive. So what's the printf going to do here? So what is the programmer trying to do? Is it legitimate? Is this like a little thing? What are you nodding for? Yeah, we can read different log files. It's a program to read different log files. The user can specify what log file they want to write. And maybe this is running a setuid, because maybe log files are protected by the user. But hey, we want to give away for people to read their log files. Maybe not write to them, but read their log files. So this is going to create in cmd. The result is going to be cat space slash bar slash log slash whatever the user types in. And then because we're really good programmers, we know that z strings have to end with a zero. So here we're setting the last thing in cmd or the 1023rd byte, the last byte to be zero. So we're making sure we're null terminating the string. And then we're going to output system calling in with this cmd. Seems reasonable. This is how we would write. So is it secure? So is there a cmd injection vulnerability here? So A, what can we, the attacker, control? Location would be reading from. Yeah, so we can A, control what location we're going to be reading from. So what can we use, maybe that we've already talked about to be able to, can we read arbitrary files with this? We can use directory traversal. Yes, we can use directory traversal. We can use dot dots to output any file on the system. So we do dot dot slash dot dot slash. That'll allow us to output any file on the system. That's pretty cool. But we don't control this whole string, right? It's not like we're passing Rv1 directly into the system. So we don't control this whole string. So can we get this to execute arbitrary code that we want? Can you just do a semicolon? Can you do a semicolon? What's a semicolon mean? It means the run the command forward and then after that run the next command. Yeah, but where is that, who's doing this semicolon nonsense? Is that Linux that's doing it? Is that the operating system? Where does that behavior come from? From batch, right? Yeah, the shell, the system underneath the system, right? It does the equivalent of bin sh dash c with that string that you passed in. So sh is will, right? One of the ways on the command line that you can execute multiple commands is with a semicolon, right? Which means first execute this command, then execute this command. So what if, let's say, you guys want to read? Let's say, I don't know, the ETC shadow file. Yeah, could be fun. Okay, so what if we run this program? So what string would we pass in to output the ETC shadow file using a semicolon? You have to be perfect. So some variable, which is maybe one string, semicolon, cat, slash ETC, slash, that's fine. Yeah, so we're going to want to execute this program, right? And then for argv1, we're going to put something in there. So we may want spaces in there, so we're going to put that in double quotes, right? And so we can just output kind of anything, whatever we want, food. And then semicolon, and then a space, and then cat, slash ETC shadow, right? So just exactly as if on the command line we said cat, slash var, slash log, slash food, semicolon, cat, slash ETC, slash shadow, exactly like how bash is parsing our command lines on the, when we're on the command prompt, this is exactly what system is doing, what SH is doing is parsing this string. So it's going to say, hey, log food, it's going to say file not found, right, because this first part isn't found. And then it's going to execute that next part and give us the root, whatever ETC shadow is, right, and it'll keep going. So what are some of the other ways that we can execute? So what if this program is like, aha, I've taken a security class, I know that semicolons are bad. So I'm going to filter out all semicolons, replace them with mg with nothing. Does that fix this vulnerability? No, there's and and you can use. There's and and, so what does and and do? It executes the first command. If that returns a success, only then it executes. Yeah, so double ampersand means execute this, and then afterwards that's successful, execute the other thing. What else? Pipe. Pipe? Yeah, pipe is output this program and then execute the thing after the pipe and make the standard input effect, the standard output of the other one. You can use, I think it's slash b, but basically create backspaces. Escape, sequence your backspace over the original command in the right way. Backspaces, I don't know. I don't know if they would interpret that because... Sprintf probably would. I think it treats that as a byte. Oh, it may, if it is using Sprintf. I don't know if it still works, I know that it still works. Yeah, probably our case is where it does work. I actually don't know if that'd be really interesting to look at. Yeah, so if we could get printf to kind of delete these characters, then we could just use backspace, if the backspace character allowed us to do that. We could put in backspaces to be here and then replace this whole string with whatever we want, and then we're not even using semi-colons or ampersands. What else? Could we place a symbolic link at that door? Yeah, so we could put, because we can control this, if we can control that, then we could put a symbolic link to make it output any other file. What about other ways we could get code to execute? What was that? If we encode the semi-colon into something, like URL encoding or something... How, what encoding would you use? Any kind of encoding, simplest is URL encoding. URL encoding. But if we think only semi-colon and not the encoded version of it, then it might execute it to decode it. But will it execute it, right? That's the question. Will bash execute a percent encoded semi-colon? So I would say no, right? Because bash predates URLs. Well, it's downloading a file. Yeah, like a software that will also have more access. Like, if you have a server, send something like Wget and some C program and then compile it through here. Wait, is that okay? We can download a C file like that. Oh, yeah. So once we're here, right, once we get arbitrary execution, we can do whatever we want. Yeah, we can download a C file just like the Morris one did, right? It downloaded a C file, compiled that C file, just ran code. We could, once we have access here, we can try to create a new user on the system, change keys around, change passwords, basically use this to do whatever we want. Yeah, we could create like a reverse shell that'll come back to us and so we can type in commands if we want to do it more interactively. But for bash, so what are all the other ways? So we talked about ampersands, double ampersands. We talked about semicolons. What are some other ways? So how would we find out? Maybe, I don't know. Yeah, it would be, those could be what bash reads in from standard in. It may be that it's, when it reads those characters, it does something, but it may not be putting them in the command. Yeah, where would you find out about that? What was that? Yeah, in the bash documentation, right? So let's do that now. Umand sh, which is linked to bash. Let's see. So invocation, so we can see this is very long. So we can see shell grammar, so simple command to command is a sequence of optional variable assignments. So we have pipes, so we talk about pipes. And interesting, I didn't realize this, right? But a pipe can be specified by pipe or a pipe and an ampersand. I think that's kind of interesting. A list, ah, there we go. A list is a sequence of one or more pipelines separated by one of the operators, semicolon, so single ampersand, right? So if we, they filtered out double ampersand, we could use a single ampersand. Or the double bar, right? So what's double, two bars? Or, right? So another way we can get another process to be executed. Let's see. Yeah, so the single, what's the single ampersand do? Runs in the background. Runs in the background, which could be nice, right? Then we may not get the output, right? But hey, at least it's still running. So here it shows all the things. So we can do compound commands. Ah, there we go. So we can use, we may be able to use the double brackets to do expressions. For, I mean, now we're getting kind of crazy. So where's, I can't really name that. Oh, actually this is important. So we can define new functions, which is kind of interesting, which we'll see in a second. Ooh, interesting, I didn't know that was. A total process. You learn something new just by skinning through documentation. Okay, there's another one. Oh, quoting. So yeah, maybe slash B would do something. That could be really interesting. Parameters. Oh, there we go. Ah, command substitution. Does anybody use backticks in Bash? So backticks is execute this command and then inside this argument put the results of that command there. So we could use this too. We could use backticks to execute whatever we want. The equivalent to backticks is the dollar sign left, per end, and then right, per end. So anything in here is going to be interpreted as a command. So, really, what's happening here is that Bash is taking in this string that the user gave it, and it's parsing it trying to interpret what does the user want to happen. We can see that the Bash language is crazy and very long. It has all these cases of different things that it will do or not do. Yeah, so let's see. Arithmetic, process substitution. All kinds of cool stuff. Oops, that's the point here. Is it dark? Okay, so the root cause here, right, is that what did the developer want to have happening here? What program did the developer want to be executed? The CAP program, right? And what was the first argument that the developer wanted to pass to that CAP program? The name of the log file? Yes, the name of the log file, which happened to include user input, right? So did the developer intend for semicolons to be used to execute more commands? No, right? And so this is the main problem, is that essentially the developer is concatenating strings together, right? So it's concatenating a string that it wants, right? CAP space bar log, and then concatenating that with the user input to create a new string that it then passes to bash and says, hey, bash, figure out what I want to do from this, right? Whereas the developer knows exactly what program and how many arguments they want to pass to that program, right? So really using system in this context with user input is incredibly unsafe because so what the programmer should do is use a different function where they can specify like one of the exec commands and say, okay, I want you to execute this program and these are the arguments of this program and that way, no matter what the user can do here, right, extend this string, change this string, that's only going to be passed as an argument to the CAP program, right? Bash is not doing reinterpretation of that string. And so this simple vulnerability manifests itself over and over again and even recently. So anybody remember the shell shock vulnerability? So back in September 2014, there was a huge uproar in the security community because there was a bug announced in bash based on how it processed its environment variables. So as we've seen, right, when processes are invoked, they inherit the environment of their calling process, right? And so in bash, you can do this as well, right? Bash can invoke new bash instances and have new environments. And this is kind of nice because you can pass variables to your subchildren and subprocesses. It turns out that bash has this crazy little known usage to where you can pass a function definition into your child bash, which seems legitimate. That seems like something that could be useful in some circumstances. And so what you do is you create a new environment variable and that environment variable, you start with left parent and right parent and then everything after that is a function definition. So by itself, that's fine, but what bash does is when bash is started, it goes through all the environment variables, looks for many environment variables that have the value that starts with these parent and then will execute that code there in order to create that function, right? Makes sense, that's how you create this function. Who controls the environment variables? Yeah, the attacker can, right? They're user control, right? And what makes this so? You can put commands in the function definition to execute arbitrary code. So you can get it to execute arbitrary code by creating these function definitions. So there's a way to, for instance, anybody, hopefully a lot of you use GitHub, right? So when you pull down a repository from GitHub, oftentimes you're actually using, so you've uploaded your SSH key, right? So they're giving you SSH access to one of their machines. Doesn't that seem crazy? Big company, lots of people source code, they just give you SSH access to their machines. So it's going to try to SSH into, like, GitHub machine. I say GitHub, let me give up. Does it work? Kind of, yeah. So actually there's a way in SSH to restrict the access that an account has when they SSH to your machine. You can even restrict it to say you've only allowed to execute this specific command. So in this way they only allow you to execute whatever the git server command is. So using this, you can actually, if you have, so SSH when it gets an incoming connection, it creates a variable in the environment called SSH original command. So if you, and that value of that command is then created by the attacker. So they could create this SSH original command with the parentheses and then arbitrary code, and they can break out of this and execute arbitrary code here. So you would try to execute something like this and this would get executed on the system. Because the SSH puts this into an environment variable and then calls a program. Because that should be safe to take user input, create an environment variable, and then just call a program. But this cat command is going to be output. So you're breaking out of there. But if this was just the case, it probably wouldn't have been such a big vulnerability. The big problem was, so we're actually going to see when we get to web, CGI web applications, except any user input. So anybody, maybe taking my 591 class, remember how are variables passed into CGI web applications? Through the URL is how it gets in, but how does it get into your program, the CGI program? Equations. What was that? Equations. Yes, supposed to get is how it gets in, but how does it get passed into your program? Close. Headers. No, not quite. Well, I think you do get the headers in your program. So a CGI web application is just a program. It executes. And it was created sometime in the late 90s, I'm going to say. So it was intended to be very broad. So you could write literally a web application in any language that you could make a binary executable. And so one of the easiest ways to pass in arguments to a program is to use the environment. So it defines specific variables. Like if you want to get the URL, you have to get the environment variable called, actually I don't remember what it's called, like URI or something like that, or URI location. It's actually a list of about 20. So doing this, right, and when the web server is invoking your CGI program, it's essentially infancing a new version of BASH, which is now going to look at all the environment variables, see if there's any with these parentheses, and then execute that function definition. So you could get remote code execution on a program just by issuing a single web request, which is why this was such a big problem and a big vulnerability through a web request. You don't have to be, even if that web request is going to give you a 404 not found, or maybe a 404 wouldn't work, but like a not authorized request, right? Even if you're not authorized for that, it's still that CGI application has to execute to tell you you're not authorized, which means it's going to parse your function that you gave it and execute your arbitrary code. So huge problem. There's a huge chunk of the web that was vulnerable to this. All right, so what do we learn? Never take user input if you can. Never take user input if you can. Yeah, it's kind of an element to the most secure computer is one that's like unplugged, locked in a room, right? No access. It's very easy to make something secure like that, yeah? But if you can help it, right? If you know what lock value wants to be output, just write it, right? Tell me if the user put it. What else? Anything else? Try to white list and not black list, like... So what I mean is that don't try to prevent all the possible ways a user can give bad input, but check for only the correct ways that you are expecting. Right, so that would be one defense, right? Or one layer, just kind of like as we said, okay, block semicolons. Well, then I'm going to use double ampersand. Well, block all ampersands. Okay, then I use bars. Okay, block bars too. Okay, then I'm going to use ticks. Okay, block ticks. Oh, I can use dollar sign parentheses, right? And there's probably still other things that you can use. Yeah. Well, in that case, you want to have a filing, so you can at least limit it based on what a file can have in it. Absolutely, right? So it should be A through Z, uppercase, lowercase, digits. What about spaces though? Spaces would come with this. Can we do spaces? Yeah, so you... But if we allow spaces, right, then they can pass additional arguments to cat to output additional files, right? Make sure these spaces has a backslash before you... Yeah, so maybe you could do that transformation, right? To sanitize it by replacing all spaces with backslashes. We still get into tricky issues. Now we have the, you know, directory traversal attacks, right? So I don't have to worry about all the dot-dots. Yeah. I don't know the term, but it's... You're giving... You're using a command that's too powerful. So maybe there's a more effective command to use than just system quality cat versus... Yeah, so that's actually a good point, right? We just want to output this file. Well, how do you output files in C? Or how do you just read the file, you open the file and you output it, right? So you can actually do that functionality yourself. But there's probably less room for error. And on that same note, right? So we saw that system, and if you look at P open, it works the same way, right? They are taking that string and reparsing, batches parsing that to figure out exactly what you mean by what number of arguments you want and everything. So we should use alternatives. So we should use the exec system call, which allows us to specify exactly how many arguments and what those arguments are, right? So if we were to use exec ve, right? Then what we pass in as rv1 there is only going to get to that program as rv1. It's never going to be interpreted as... No matter what semicolons or whatever jump we put in there, it's only going to go as the argument to that function. And it's not going to be interpreted. So yeah, it's in a sense... These programs are very... The system call is actually very flexible and powerful, right? It does some cool stuff for us, and you can do very cool commands. The problem is once you allow the attackers to influence what commands you execute, they can usually trick it into executing arbitrary things. And yeah, so we should always, always, always be thinking about sanitizing the user input. Users... Users are dirty, right? Make sure you sanitize all the input. So another thing, right? And this is going to come up again when we look at SQL injection cross-site scripting, right? When we get to the system call, does system know what part of this input string came from the developer and what came from the user? No, right? Whereas this string came from... This part came from the developer, right? cat space slash bar slash log. So that should be safe, right? The developer's doing it. It should be safe. But it's that other part at the end that's unsafe, right? But from systems perspective, right? And once it gets to sh, system just calls slash bin slash sh dash c with that parameter. So when it gets to sh, sh has no idea where these bytes came from, right? They could come from the user. The network, it could come from a file. It could come from, you know, a hard-coded string, right? So this is another problem, is you think about it. So, yeah, okay. I don't get into it too much. We'll revisit this again, this concept. Okay. So, now we get into kind of the root or one of the coolest, oldest vulnerabilities in binary applications. Something that's, we saw the Morris worm used buffer overflow of vulnerabilities and there's still, these types of overflows are still prevalent today in today's binary systems. So this is why it's really important to study and learn these things so we can understand what kinds of essentially memory corruption vulnerabilities can happen. So these are, as we'll see there, I think in them separately, than what we looked at before. We looked at kind of how to manipulate file access, right? By using directory traversal attacks and sim links. We saw the command injection, which were able to influence some other program to execute arbitrary commands on our behalf. This class of vulnerabilities is really about the attacker being able to change memory and alter the execution of our program itself. So we're going to look at exactly how this happens. So, what happens when you copy one buffer to another in C? What are buffers in C and C++? Just arrays, right? So it's an array. Yeah, just continuous set of memory, right? How do we know the size of that array? Who specified the one? What was that? Yeah, so we saw it on that last example. We declared a command, that's 1024. So either it's at compile time, or the programmer says, this is an array of characters, it's only 1024 bytes. What's the other way we can allocate memory in our program? Maloc, right? But then how do we specify the size of that? Cast it into the command, right? Maloc takes in a number of bytes and returns the address of those bytes in memory. So we could call Maloc with 1024, and that'll give us 1024 bytes so we can do whatever we want with it. So what about when we write to an array? Who checks that we're not writing more than 1024 bytes? We have to, the programmer has to, right? When you're writing Java, Java internally stores the length of the arrays. And so every time you write to an array, when you say, hey, write to index blank, it's checking, is blank greater than the length of the array? If it is, then it stops that, right? Blocks that right. Is anybody checking the length of your indexes where you're writing to and seek? Absolutely not, right? I mean, I guess it makes sense historically because if you're checking every time you're doing an array right, that's as a performance cost, or a performance hit, right? Because you're slowing your program down if conditioned every time you write into memory based on an array, which could be a lot, right? How many times you iterate over an array doing something to an array? So if you're iterating over an array of 1024, right? Every time you write to that array, or read from it, right? Every time you write or read, you have to check that length. And so C and C++ applications don't have boundary checking. So they don't check the bounds of the arrays that get written to. And so this leads to, as we'll see, basically overflows are writing more than the size of that buffer, the allocated memory for that buffer. So once you're able to do that, we'll see how you can control the program's execution. These are very tricky attacks because they're very architecture and operating system, even version dependent. So these will typically, a specific exploit will only work on a specific version of the operating system with a specific compiled version. They are very cool because they're going to be executed both locally while we're on the system, but also sometimes externally if they use external user input, which can be super cool. And we'll see that they really, our goal as an attacker is to modify the control of the application to get it to execute whatever code we want to do. We can also, a new type of these attacks that are happening is, we can also change the data of the program. So the program has a bit that says whether we're an authorized user or not, and that's at zero, and we're able to overflow some buffer to change that to one. Now we're an authorized user. We've tricked that program. So there's actually a lot of work on automating this process of doing these buffer overflow attacks, which is super cool, but we're going to be doing this by hand. It's really important that you learn how to do that. And so there's actually a lot of research into automatically finding these vulnerabilities, automatically preventing them, and developing detection mechanisms. So there's this arms race where we develop a new, we say okay, they're exploiting the program like this. So now let's do a new type of defense. Let's add, I don't know, SNET, Stacconaries or ASLR or whatever thing you want you've heard of as defense as we'll talk about. Let's do that, and then people do that. And the attackers are very smart, so they get smarter, and they say, oh, but now I can do this other thing using this same vulnerability. And so the defenders keep trying to go up and up, but attackers have a financial and, I guess, a weakness incentive to develop cool new attacks. So attacks always are getting better, and now they're incredibly complicated. And actually, so some of this research has gone into actual quality operating systems that's on all of your phones, devices, and operating systems. So to understand this, we first have to understand the stack. So what's a stack generally? Data structures, stack, yeah, last thing first out, push things on, pop things off. What is it used on for x86, for programs? Store and return values. Yeah, so it's essentially, I have to think of it as scratch memory for functions. So each function, their local variables are stored on the stack, parameters are stored on the stack, and this is how we can have recursive function calls. So I hope, this actually, I'm going to go through this fairly quickly because this is review from my undergrad 340 class, because we talked about the stack there to understand exactly how local variables are laid out in memory. So this is where this comes from. So all my stacks start at high memory addresses and grow down, right? Just like we saw, the process space starts at high memory and goes down. That's completely arbitrary, right? You can start at low memory and grow up, but whatever reason I got stuck in this way, so this is the way I'm going to do it forever and so will you. Or at least for this class. So functions can push registers or values onto the stack or pop the values from the stack into the registers, so this gets back into the x86. So we're going to look at actual x86 code. So in x86, ESP points the address of the top of the stack or the bottom if it's growing down, right? So logically it's the top, because when you pop things off, it's going to move, and when you add things, it's going to move, right? So the instruction push ex first decrements the stack pointer, right? We're just going to move it down in our thing because we're going to go from high to low. It's going to decrement it and then store the value of ex at that location. And conversely, pop works exactly the same way. So it's going to take that value that's at the address pointed to by ESP, put it into ex and then increment the stack pointer by four. So let's look at what this looks like. So we have our stack at top, we have low memory at the bottom, and it's just a bunch of bytes, right? So there's a bunch of stuff in here. So the stack pointers, let's say here at ex 10,000, below the stack pointer, right, is garbage, right? It has absolutely no meaning to our program. Obviously if we stop, if we go down far enough, we'll hit the heap, but for now considering just the stack, right? Anything below the stack pointer means nothing. So if we have a function like push ex, pop evp ex, if we have registers, if the value of ex a is in ex and zero is in ex, and the stack pointer, right, has the value of 10,000 hex. So the only way we know this that 10,000, so the way we know that this pointer here to the stack, right, the top of the stack, is here is because there is the value 10,000 hex in ESP, right? And so if we said the stack started somewhere else, then there must be a different value in ESP. So this pointer, this arrow just represents the current, where ESP is currently pointing. So if we do push ex, right, to execute that instruction, what's going to happen is ESP is going to be decremented by four. So it's going to be fffc, eax, so it's going to move down, right? And then eax, which is, this is 10, decimal 10, so hex a, that's going to be copied and put into there. And now if we do pop evp, right, we're going to say, okay, take whatever ESP points to whatever the value is there, which is hex a, copy that into ebx, and then increment the stack pointer by four, which means it's going to point to here. And so essentially we've been able to copy the value in eax to ebx by using the stack, right? Now we know that fffc, there's now the value 10. We know that, but it's garbage to our program, right? At this point, it's essentially been deallocated. We don't really care what that value is. Okay, so thanks for being patient. All right, on Wednesday we're going to get into, we're going to finish all of this background material so we can understand exactly the stack and what's happening so that we can understand buffer overflow vulnerabilities.