What's popping people welcome to another video if you guys are new to the channel Please hit that subscribe button hit the notification bell also hit the like button if you guys have been enjoying the content Drop some comments down below and what videos you guys want to see next to but anyways We are actually kayak fishing today as you guys can tell I got the kayak trailer out gonna be whipping the bonafide SS 127 Today I've been rigging up some rods getting some stuff ready. We're at this beautiful lake as you guys can tell right here It is just a beautiful area. We've actually filmed a few videos out here before the last time that we came It was really tough. I only caught one fish and it was like four pounds So we're gonna be trying it today. I got a couple baits rigged on that I think are gonna be the key for today It is extremely hot. Let me tell you guys. It's like 90 It's in the 90s today. It's super hot, but um, we're gonna try our best to get out here and catch some fish I'm just like sweating and just it's really bad But anyways, we got the kayak out. It is a mess We got some baits laying around we're gonna be rigging up a few rods getting out there and trying to Catch some big fish, but yeah for you guys wondering. This is the SS 127. I saw a lot of comments in the last one Well, let's go ahead and go around.  So I got a shaky head We got the new six cents frog which you guys saw in the last episode that thing is freaking hot We only ended up catching one fish on it the bite was really tough But you know this thing ran super well and I'm excited about it today. There's a lot of grass along the bank I think we could get a really big bite on this. There's not really any wind today It's perfect for a kayak fishing I don't like going out in the kayaks when it's super windy because it can get really bad and your kayak can be turning circles It's just a catastrophe But we got a frog shaky head Then we got a fluke on this rod just a weightless ewg hook we could put a senko on it as well That's on the mock smash And then lastly we got a divine swim jig right here And this is actually my juice color you guys already know the white and chartreuse is just saucy You got the little chartreuse swim bait with the blue on top. I think fits perfectly. This is actually on my mock too I just put a new line on this. So that's fantastic. I don't know if we're going to be using this a lot today There is a lot of grass in this lake But what I will say is that there's not much wind today I don't know how active these fish are going to be the pressure is a little bit high today So like I said, I'm just curious. I think the shaky head is going to kill it Maybe a frog bite would be you know stellar as well. I know the fluke could get much too I think that'd be a great little option But these are the rods we're going to go ahead and load them up in the kayak Or actually we're going to set them down Let's not lay them down right there for right now We got to get the kayaks off the trailer So we're going to go ahead and do that first Get them in the water and go catch some big fish You guys better stay tuned hit the like button if you guys want to see some more kayak content Let's get it. All right. So we got a kayak down here. This is a lot of I don't know you kayak anglers already know you This is exercise. I will tell you man you dragging these kayaks down the places This can be a dang exercise and this kayak is really heavy. I just have a bunch of stuff in it It's freaking this is a lot more work than you think especially when it's 95 degrees outside Come on There she goes We are off we are for liftoff and I want to show you guys this too Super crystal clear water in here. You can see down probably visibility is around 10 to 15 foot I ain't even just saying that gets to around 20 foot out here Visibility is insane a lot of grass. I'm really impressed With this place with the visibility. It is so clear. You can see right to the bottom All right guys, it's about time to get this started I'm already sweating bullets.  This is the thing of kayak fishing It like I don't like a lot of wind when kayak fishing and today is the perfect example of that It is dead calm, but let me tell you when it's 95 degrees outside. It is uh It's a little brutal.  I every time like it's cold and it's in the winter I'm like man. I don't care how hot it is. I just wish it was hot outside And now this is like the first Brutally hot day that I've been outside And I'm not really enjoying it. I'm not gonna lie There's some fish chasing bait out there. You see that? bait ball Guys, I just saw some bait. All right, we're gonna throw this swim jig out here. It's actually really deep She's like the only moving bait I have right now. I have that fluke But it has a tail bitten off it. I gotta put another one on But I saw a bunch of bait right here Imagine just getting slammed by a giant right away. That would just be That would be awesome. Let me tell you I don't know if that's gonna happen today, but that would sure be a little present one Look how clear this water is crazy Now we got a little bit of wind.  Look at my arms. I'm I'm already sweating bull this out here This is a glimmer blue fluke The reason I'm using this one instead of like a straight white is because it is really sunny today And I feel like this color could get the job done. It's like a pearl, but it has like a blue Tint to it and it's got a lot of black flakes in it And this this color right here could could smoke some I will say that they're not buying this one I'll put on the regular white, but I just think with the sun today and how it's blaring down That's going to be money. The main reason I'm putting on this fluke too is I've just seen a bunch of bait popping You know, I just I just see a ton of bait popping I see a lot off-shoulder too, which is interesting where I have to throw it around with that But I think they'll munch this fluke Oh, no Oh, no, he came off again What? He broke me off. That was a freaking big and He's right there. Look at him. He's like three pounds But no freak just happened guys. I have not had a bite this whole time And then all of a sudden I just had one hammer me I hooked him. He never had it He ate it again. I hooked him. He never had it and then he ate it again and he just broke me off That's so weird. Wow. It's a good fish too All right, we're back in business now guys that Kind of upsets me because I was the first fish today to do that too I haven't retied this since the yachty trip. So maybe that's why I must have just had a ferry and I should have retied it But that fish ate it three freaking times. That was weird. I don't understand why he wouldn't get hooked It was a pretty good fish. I saw him. He felt big and then I saw him swim right under the boat. He's like three pounds I shouldn't keep on covering water. Maybe we can get on this bite. I was waiting to get that bite I was casting it for a while and I was like, this just seems like it would be the money on this grass Especially with all the bait that I see sure enough finally got bit Oh my gosh, he came off He ate it like a top water Oh my gosh, what?  That was so cool though I just popped this thing over that grass. He came up and just munched exactly how he should have There he is. Oh, yeah It's a diesel one too. It's like a two number Oh, yeah, look at that fish. This might be the same one. It could be a different one though.  She ain't even two pounds. She about a pound and a half though Pretty beautiful fish with the markings on this thing. All right guys first fish today.  Catch another one All right guys, we uh, just got that first fish. Sorry my gopher died literally right when I landed it, but Seems to be some fish on this grass right here. We got this shady Shady little spot right here on the edge of this grass looks amazing and as you guys can tell it's kind of flooded It's like it's flooded up in the grass So I bet we could cast this up there. You know what we should throw right there is the frog Or could hop this fluke across it Oh man That just looks money. I swear there's fish up there. I think of this prawn real quick on the shaky Slow down a little bit more. There's fish up there. What's up? Oh One just hit me. I watched my fluke dart to the left He didn't eat it. He just hit it.  There's a good three pound bass right below me Oh My gosh The three pounders just swam off like this bed guys. I'm so upset about this. I just caught up really it was a really cool catch I saw so many big fish on my camera and for some reason. I wasn't recording. I'll understand I I had like a ton of three and five pounders swimming swimming under me And then this like two number just came and swam right up to me and I flipped right in front of me Eight it was such a cool cliff. I almost fell out of my kayak. Oh, man. That's so aggravating We're just going to keep fishing. I think this is going to be the good area We're going to find some good fish over here as you guys can see in the water Those are the beds right there below us We're going to come back and try to catch those bigger ones off of it But pretty too number get her right back in the water Thank you, baby That's not what you're supposed to do there she goes All right, we're going to get another one of these prawns out this if you guys are wondering this is in Green pumpkin blue gosh guys. I'm so mad. I ain't get down and go for I apologize about that I'm actually kind of upset about it because it was actually really like it was just such a cool clip like I I saw so many fish on the GoPro Yeah, that's just aggravating like almost fell in the water It's just like a whole that was just a solid clip right there That I just didn't get to capture sadly, but we're going to keep on working I think we're going to catch some more You know, we're going to rig up this prawn on the shaky head and kind of search around how we did right there And hopefully we'll find some more that are like on bed But there was two that were on one bed one of them was like five pounds One of them was about three and all of a sudden I saw that one swim out of nowhere It was like two pounds, but we're gonna keep on fishing. Yep. Yep Please eat it. Please eat it Oh, where'd she go? Right on her bed I can't believe there's still fish bed now here I did not expect that. Oh See these beds right here guys are just insane I do not think we're going to be coming outside fishing today. I know we're going to be able to find more I saw so The one I just caught I can't tell it now. I got a glare on the water If you guys notice they're off the grass too. They're not right on the edge of it. They're like oh Oh my god. I think it's a different fish That fish is very territorial Oh my god I thought he just ate me. He's chasing meat. Oh, there's two of them. I got a lot on bed over here If you want to come over. I can't believe I stumbled on we've been like fishing for a while Just to randomly stumble upon some beds with some big fish on it was just such a surprise. I was like wait But everywhere we've been fishing has been pretty deep I thought they would be done bedding in here and spawning personally So I didn't even think about coming over here to this flat. But right when we came over here, I mean just Big fish after big fish after big fish Oh my god guys guys He's looking at me.  That's a good one too. That's the best one today. Oh my god. That was so cool Oh my gosh, look at that right there Solid two number gosh Right there in the top of his mouth. He just oh my god. There's the female. There's the female right there We're gonna release this fish real quick beautiful one I'm gonna try to drop it on our head I can't believe they're locked. What in the world these fish are locked on bed This is probably gonna be the best bed fishing day I've had this year Got all these little bluegill packing up the eggs on the bed It's irritating these bass. Oh my god. My curl's all messed up, but Where'd she go? I'm about to leave this bass alone that I'm hovering over the top of uh, honestly they didn't mean to but There's two There's two really good fish Right below me. It's kind of funny. Look at this bass I don't know if you guys can see that Oh, he's about to smoke one of his bluegill He's about to smoke me There's a bass There's a bass sitting there He's looking at me. He just looked right up. Oh, what you gonna eat it right away? Yep. Yep. Yep It's a smaller one You mean where's my time squirt?  He's pretty colors on this fish though That was a little tiny one. I just saw him that bed a second ago Thank you, bud. Look at the markings on that bass.  Look at that Beautiful beautiful fish right there on that prawn. There's munch in the prawn today. I'll pop the link up on my or I'll pop the code up on my screen That prawn is black enough today pretty bass. Thank you, bud The beds that are closer to the bank. I'm not really seeing any Did you guys see that? Did you guys see that? He's right here below me. Where did you come from? Oh my god, there's another one. Oh my god So hard with this kayak. I ended up rolling up on top of these places. I got him God he was on that flat right there Through right up there He got it right on that flat. I didn't even have to see anything. I was just talking about that I came to another side of it. Holy cow. This guy's fighting The big He ain't bad One of the biggest Oh, yeah, look at that. Look at that fish That's a beautiful one Look at that right there. That prawn is smoking them guys Right here on this flat. I saw a bunch of little baitfish popping Through up there. He's running with it instantly Got him right there in the corner of the mouth. The prawn is just kicking butt. That was a good That has a beautiful fish get you right back in bud. Thank you Yo, what's up guys actually the next day and we're gonna be trying to do some fishing The kayak fishing out there was fun. It was good time But let me tell you it was so hot that I just couldn't even take it anymore Caught some good fish out there missed a few on the gopher like the gopher just wasn't recording But all on that was a really good time and I'm running low on time today But today I was like, you know what? I'm gonna go out and I want to do some bank fishing for the rest of the half of this video And see if we can end up catching some fish. So I'm excited about that. It's still blazing hot I think it's 96 out right now It is it is new for me. Let me tell you just the breathing and I'm hot, man I'm hot.  I don't complain about the heat, but it is It's been hot. So we're going to try to catch some big fish today I hope you guys stay tuned if you're new to the channel, please hit that subscribe button hit the notification bell Also hit the like button. Let's go ahead and hop in the truck and go catch some fish All right, so we just made it down to the pond. We're going to be trying this out I actually still have my fluke on from yesterday. That's where we're going to be rolling with This is like that disco blue color. I still have I have a regular pack right here Just pearl white ones, which I think it'd be better in this water anyways But we're going to go ahead and start off with this. This is all my mock smash It was exactly what we're using the day before this and uh, we're actually at the pond That they were draining. I know you guys remember this. I filmed a video out here There's two huge carp swimming right there, but I filmed the video out here and they were draining this pond Well, little did I know I talked to a few people. They weren't actually draining it They were just cutting it off and they were shortening it up and they're going to be building houses over here So they weren't eliminating the pond completely, but I can tell you they It definitely hurt the fishing in here. I will say that the water clarity is totally different Super muddy and I don't even know if we're going to be able to catch one in here But we're going to try it today. I just want to come back and and see and that's why I didn't do Do a fish rescue out here as well. I know you guys were probably wondering about that Um, so that's the reason because you know, the pond is still going to be here There was no point in us rescuing these fish out of here that that's the moral of the story So anyways, we're going to get the fishing and we're going to see if we can catch some fish in this place right here I'm really curious to see if we can get some bites Well, that was not the move one bit. Let me tell you that was not no I went out there. I went fishing for a good bit. I don't even know if I'm going to use any of that footage that place It's going to take a little bit for that place to get back to normal I am going to say that it's not it was never really easy to catch them out there But you could usually go out and catch around three fish, you know and sometimes you could you would look into like a four plus pounder But it is destroyed. Let me tell you with all that stuff that they did around it cutting the lake in half Draining the water working all around it. It's just got this fish all messed up But not only does that have all the fish messed up. I think it killed off so many fish and that's just sad man I hate to see that. Um, I'm just glad they didn't drain it because they that's what I thought They were doing from the first place was draining it So I wanted to pretty much, you know, get the fish out of there. Um, but that's not the case, you know, they're They're just adding on to it. That's it. But um, yeah, we're going to keep on fishing We're going to try to find some new places right now and put our heads down and get to work Hopefully catch a big fish. Let's just keep her going. So we just got out to a whole new place I've only been here one other time before so I'm kind of excited about it. We caught a good amount of fish Um, it wasn't easy to get in a bite But what I will say is there's fish in here and I haven't been here in like a over a year. So Kind of excited to give it a shot and see if we can catch some fish here Got him. Oh Oh, yo, this is a decent one too. That was awesome caught him right off those rocks He hammered that sucker.  Beautiful bass right there. Look at that. Nothing big, but Beautiful fish right there. Heck yeah I thought I saw my fluke disappear And it didn't it was just the ripples in the water and right after that he actually ate it disappeared for sure that time I was like, oh We got one, but that's the quality fish for the like the size of them just like really filled out You know, he's a really fat guy. So I enjoy that.  Thank you so much, bud. Really clear water in this place too There he goes. Let's keep on going. That was awesome There he is Oh, yeah Yeah That was awesome That was awesome right there. Look at that fish Beautiful one. We're gonna slide you right on up here, bud. Been a minute since I've had another bite So that feels good right there. Let's watch that fluke disappear. That is so sweet right there They're healthy. You can tell there's doesn't seem to be a ton of them But they're a healthy little bass pretty colors on them. Thank you so much, brother and get you right back in now There he goes


Okay, let's start. My name is Alfredo Ortega. I work as an explorer writer for cross-security. This talk will read about the OpenBSD bag. If you don't understand something that I am saying, you ask me and I will repeat. Okay, this is a bag that I discovered a couple of months ago, but like more four months ago. And it's an interesting bag and the exploit is interesting, too, and got pretty much publicity, so I'm going to explain it. Okay, let's start talking about how I discovered the bag. Okay, this is the history. This is the history. I was assigned to do a research about a patch in the OpenBSD kernel, namely the number 8 patch, a reliability fix. This was, in fact, a hang of the kernel, an infinite loop in the kernel caused by fermented ICNP packets. So my boss come and told me if I could reproduce this bag. So I started to try to build a fuzzer. Do you know what the fuzzer is? It's a little program to send my former packets and try to try to break the system to reproduce the bag. So I really didn't have very much information about the bag, so the only thing that I could do is to start trying and student the patch, trying to make a couple of fermented packets and sending to an OpenBSD system, trying to make it to work, to lock in an infinite loop. So the fuzzer is a very simple program. I made it in Python. It only makes two packets from the IPv6 protocol. The IPv6 protocol is, as you know, a very new protocol. It's not very much used. And it's got a lot of bugs. I will be presenting some of these bugs. And in the end, maybe I will do some live demonstration about another vulnerabilities. I spent about two days trying to build in my former packets, thinking how I could break the system. And in the end, I, in a lucky packet, managed to practice the system. I sent it to an OpenBSD virtual machine and the OpenBSD channel just hung up. But it was not an infinite loop like the patch. What's seeing, it was a complete hang up. The system just hung up and threw a stack trace of the bug. I was thinking this really is not the same bug that I was trying to find. Maybe it's a new bug. So the thing that I did was to download the latest version of OpenBSD kernel. It was, at the time, the 4.1 OpenBSD kernel. And trying to attack against that kernel. The attacks worked anyway. So in my hands, I didn't have what is called a serial day or a new patch vulnerability. In the time I was thinking it was a Daniel service and maybe it could result in code execution. But I was not really sure about it. So I reported to my boss, my boss reported to OpenBSD team and got fixed in about two days. They were very fast and fixed the bug. But they reported as a Daniel service of a reliability fix. And I was thinking that it was not a reliability fix. It really was an explotable bug because of the stack trace. So I started researching how to exploit this bug. Let's see, why the bug was hanging in the kernel. Okay, these are, let's see, in the, in the, a lot of Unix systems, the network packets are stored in a structures named mbuffs. The mbuffs are little packets of memory of a fixed length. They are about 256 bytes long. They are ordered in a linked list in memory and they store network packets inside them. And if the network packet is, if the network packet is too big to fit inside a mbuff, the mbuff got an external memory buffer. But the failure of the kernel was that the kernel was overwriting a lot of mbuffers in the way that it's showing there. Instead of writing into the first mbuff, mbuff one, the OpenBSD kernel was overwriting a lot of, of these buffers. And not only the buffer, but the hidden information inside the buffers and the couple of pointers that link the buffers, the linked list. So when the OpenBSD system was trying to free one of these packets, it made an unlink operation. That is an unlink operation. It's a exchange of two pointers to, to free the, the node between them. And because of the pointer was overwriting with garbage, at the time was garbage, the system was hanging, was making an illegal, an illegal operation and it's totally hanging. This seemed like a very exploitable bug because when you overwrite two pointers, you, you can use a very common technique named mirror copy or, or, or forward write to when you exchange two pointers and you can control the pointers, you can manage to write four bytes of data in every, in any place of the memory. So I, I think if I am overwriting a linked list, it's sure, it's, it's almost sure that it is a exploitable bug. So I started disassembling the OpenBSD kernel to see if I could exploit the bug. Well, maybe you can, it's, it's not a show it very well, but it, here is a disassemble of the function that was hanging. The function that was hanging was a free function. I see in the down, the M, free M function was crashing. The M free M function was crashing. That is the function that's free and no, a M buff. So I disassembled this function. That is the result. I must say that the OpenBSD kernel is an open source kernel and I really did have the, the C code of the source code of the, that function, but I am really more used to see it this way, to see it in assembly, to analyze the function in assembly is, is more used to me to see it this way. The function is starting the orange block and we can see, if we could see it, maybe is that the, the package to free is stored in the register. I must clarify that this, this December is for the Pentium and 32 bits only. OpenBSD run in a lot of architectures for this exploit is only for Pentium at 32, 32 bits, sorry. And in the start, this function plays the package to be freed in the one register, in the ASI register. And then it made a lot of operation using this register of reference. The point is, the point in what the, the kernel was breaking is making yellow is, well, you didn't can see it very well, but it is, it's exchanging the pointers here. In the block making, in the point, in the block, in the yellow, the point, the pointers of the linked list are being exchanged. And of course, the linked list was overwriting and it was trying to write in a position of memory that didn't not exist. So it worked exactly in the yellow block. So I say, okay, let's try to reach the yellow block with controller pointers. So I can write in any place of the memory. If I can write a value in any place of the memory, I can do a lot of things like make my user process root or open, I don't know, change the permission of the new process. There are not very much things that I could do, but some things it could be done and it would be exploited this way. And when I was analyzing this, I realized something. I realized that in the next block, in the block next to them, to the yellow block was a call and the referencing a pointer. It was getting a pointer from the block here in the arrow, in this part. Let's see. In this part, it's moving a value from the packet inside the eax register. And then, in the next block, it's jumping to this eax register. In fact, it's calling them. It is the same as jumping. So I could send a value here inside the packet and make that open VCD jump exactly what I want. So I can control the flow of execution. Much in a much easier way than trying to do the other trick of the yellow block, that writing in some part of the memory. It's much easier to jump to any place that I want because I could send my code and place my code or my shell code in some place of the memory and make the kernel jump it and I will get total control of the kernel. Of course, I will gain execution inside the kernel and it's not an ideal situation. The ideal situation was to gain control in a user process because kernel exploit is much difficult to do than a user exploit because in a user exploit, you got the kernel to do whatever you want. You can use the kernel to open a file or to open a connection. It's much easier. The kernel is made for that. When you do a user exploit, when only like a hundred instructions you can make the machine do what you want. It's a very small exploit. But in kernel mode, you really don't have a kernel. You don't have an operating system to make use of. So it's almost like you are your own operating system. Anyway, I was gaining execution inside the kernel and I was executing my code. So I told the open VCD people that in fact this bug was exploitable. I still didn't have the exploit. The exploit took me about a couple of weeks to make because it was a very difficult exploit and I was helped by a lot of people from coms for security. But anyway, now I am in the situation that I can't jump to any place that I want in the memory. But where I want to jump? Of course, I cannot jump to the same kernel because the same kernel is not my code. I want to jump to my code so I can overtake the system. First, I must place the code in memory in some way. While in this transparency, I marked the source code in C, the equivalent of that function. Here's the assembly and here's the part of the source code that makes the code. It's a little difficult to understand. In red, it's marked the part of the source code that jumped to the reference pointer. As you can see, it's much easier to understand in assembly than it is in C. It's a lot of micro expansions. I never will realize the bug looking only to the source code. Okay, that's better. Okay, in this drawing, you can see how the fragmented packets of ICMP v6 are placed in memory. In the right, we have the linker list of Mbuff or Mbuff chain with the corresponding headers. The headers of the Mbuff are pointer to the next Mbuff, pointer to the last Mbuff, pointer to the free function. The packets are placed in exactly that way in memory. Other places are overwriting a couple of Mbuffers or Mbuff. The arrow here, this arrow marked the exact position of where the pointer to jump is placed in memory. I must place a pointer here. This pointer will overwrite the free function inside the header. This function will call the pointer that I placed there. Here it says trampoline. You can really see it, but it says trampoline. Trampoline is a name for a position of memory that I want to jump. I want to jump to a trampoline. I put this pointer in the header of the Mbuff in exact position. You can be not even one byte disaligned. It must be exactly aligned to the pointer. Is this something very easy to do? No. Okay, let's continue. We can now jump to any place of the memory that we want. Where is the share code located? We know that the share code is located here. Here is a share code. It's placed next in the same packet. Because it's very easy to put the share code in the same packet that goes to our flow. So we got this portion of memory we got our code. The share code or the code that we want to execute. But we don't know where this is placed because the Mbuff are the dynamic, aligned places, and it could be in any place of the memory of the kernel memory. It's not in a fixed position. It will change. It will change from run to run and from kernel to kernel. But we know one thing. We know that the share code is pointed to the ASI register. The ASI register points exactly where our share code begins. Why is that? Well, because that is how the function was compiled. We remember that the packet in the beginning of the function was pointed to ASI. It was pointed here. So if the packet is pointed to ASI and we do an immediate jump to somewhere that we want, we must jump to some place memory that jumps back to the position of the ASI register. It's like a bouncing. We bounce in a point of the kernel memory that has an intrusion that jumps back to the ASI register. We must find a position of the kernel. This is the kernel. We must find a position of the kernel that got an intrusion that jumps back to the ASI register. This intrusion is a very small intrusion. They are no more than two bytes long. It's placed a thousand times in the kernel. So it's very easy to find one intrusion. It could be in any place of the kernel. It not only must be there and be executable. So we find one intrusion. It could be any. We find one intrusion that jumped to the ASI register and we simply jump there. So we jump in this intrusion. That intrusion jumps back towards shellcode and we are executing our shellcode now. We have complete control of the system. I was thinking, okay, game over. It's over, but it's not over. Because as I was seeing the kernel, you really can't do anything in kernel mode. I can't even open a file. I can't open a connection to the internet because I am running in kernel mode. And it's a very tricky, this is a really tricky part to make the exploit works in kernel mode. Because it must be like a mini-operative system. It should be. Okay. There are a lot of ways to do it, but this is the way that we implemented and this way it really works pretty fine. In kernel mode, there are not many things that you can do, but you can do very easily hook interruption. You can get the interruption table of the Pentium processor and you can hook, you can make that one interruption to zoom to you and you instead jump to the original interruption. So what I was, what I did was to hook this particular interruption, the system call, the operator system, communicate with the user process using interruption in Unix. One in Windows is similar, but in Unix, the interruption number used is always the 80 interruption. So I must hook this interruption, the 80 interruption, in the same way that they all implemented a style resident program from DOS. In DOS, there were a kind of program, maybe you remember that, that hooked the interruption, the timer interruption, or the keyboard interruption and in that way it started resident in memory. This is the same technique. By the way, we hooked the system call interruption. This is the original system call. We got a user process here. The user process make a system call, I don't know, open a file, or kernel, open an internet connection, and the kernel open the internet connection and returns to the user in the next instruction. Here is who the hook is made. The system process, the user process, jump to the hook that I have installed in the memory, and the hook, make something that I want, and then return to the original system call, and the system call is made and returned to the user. So the user really don't know if he don't realize that it's calling my call. It's calling the kernel, but it's not calling the kernel. It's calling my shell call in memory. Okay. So it's calling my shell call. What do we do in this situation? Okay, now we can see every system call of the system. We can see every process and every operation of all the process of the system. This is a very useful thing. So I implemented, this is the server call of the operation of the hook, the interruption hook. First, we don't want to affect any user process, because we will, in this way, we will hack the machine. We, not every user process are useful to us. Only the privileged user process are useful, the user process with a privilege of root. Because if we take over a process with no privileges, it will be very useful. We want to take over a user process with root privileges. So first, we want to see if the process calling us is root. Of course, this is a very hard thing to do, because we cannot simply get the process ID or the user's ID of the process, because again, we are in kernel mode. We must do a lot of tricks to do this. First, in user mode, you use a system call, getPID, or getProcessID. It's just simply of that. That's a system call, returns a number, a test number, says if you are root or not. But now, we must do a little magic here. We first search for this variable in the kernel memory, because the kernel can be any kernel, can be an OpenBSD3 kernel, or 4, or can be a custom compiler kernel. And this variable, the current process variable, in fact, it's an array, it's not a variable, could be any place in the memory. So we must search it. We must search through all the memories searching for patterns, for the specific patterns of memory that tell us where this variable is placed. These patterns are present in every OpenBSD version from 10 years ago, and are very easy to find. Once that we got this current process variable, we can see inside this variable, in fact, it's a structure, it's not a variable, what is the user ID of the process? So now, we got the user ID of the process. And if the user ID is zero, the process is root. And we can't take over this process. So if the process is root, we must attack this process. We know that the process has full privilege of the system, and it's much easier to execute code in user-lined or user-mode than in kernel-mode. So we got a process that is root, is calling us. We must take over this process. First, we must execute code in this process. We could just overwrite the return pointer. The return pointer of the process should be in, because we can overwrite any place in the memory. We could just overwrite the return address. But this is not a very good thing to do, because maybe this process, the process that are calling us, the binary that are calling us, is the libc. The libc is a library that is very important in the system. We can't just overwrite the libc, because the g-system will crash every process that we are using the libc. We cannot overwrite the binary. We must place our shellcode in another place. A good place to put our shellcode is the stack, because the stack is one for every process, and it's very easy to reserve memory on the stack, put our shellcode there, and execute our shellcode on the stack. But there is a problem with that approach that is this protection. This protection is a very good protection that OpenBSD got that says that no place in the memory that is writable is executable. The memory can be or writable or executable, but not bought. So that is exactly what we want to do. We want to write in the stack and execute in that place. So the OpenBSD channel will not let us to do this. We must disable this protection. This protection can be disabled, because we are kernel and we can modify every register of the painting processor, because we got complete control. So how we disable this protection? We extend the selectors. The selectors, OpenBSD implemented this protection, changing the selectors and making some selectors shorter, some selector larger. And the specific selector that is affecting that, it don't let us to execute our code in the stack is this selector, the code selector, of course. We must extend this selector. We extend this anyway. This is not very important, but this selector is very important. We must extend the code selector, or CS, to let us execute the code in the stack. This extending a selector can be made in a user process. A user process can extend selectors, because it don't have permissions to do that. But we aren't kernel, so we can extend this selector. Once that this protection is down, we simply copy the user mode in the stack and execute that. We modified the return address to the point of the stack. And when the system can restone, it will return to the stack. Instead of returning to the binary image of the process, it will return to the stack. And we execute there perfectly, because this protection is down. So now we are executing our shell code in a user process. And it's much easier to do two things in that place, like open a connection, or adding a user, writing a file, because now we are a user and we can make use of the kernel. In the end, of course, we must restore the original interruption vector, because if we don't do this, every root process will be taken over. We don't want that, because we want to take over only one process. We don't need that. We don't need to take over all the root process of the machine. So we restore or remove the hook, restore the original interruption vector. And that is, now we've got one process, the first process that are calling us, root and executing all code. This process could be anyone. It can be the send mail process, can be the Apache, I don't know who said Apache, the web server. In fact, I was seeing that every time I send the exploit, the send mail process was the first that was taken over. The send mail makes a lot of system codes, and it's root, and it's every, almost every time is the send mail process. It's the first that is attacking, but it's exploit. And if we are not root, if some other process call the kernel and yes, not root, we just continue with the original system call. And we don't know what I feed it, because we are really done, it's interested in attacking a process that is not root. Okay, this is a diagram. We've got a little problem here. There should be a line here, and a line here too. This is a map of the memory of the Pentium 32-bit processor, and the whole OpenBSD managed it. We got four gigabytes long, and the OpenBSD system reserves the first part of the memory for executing binary code here. So the only executable code can be placed here, in this small part of the memory. This could be grow a little, it is viable, can stand a little further, but only this place of the memory is executable. And this place of the memory is not executable, but it's writable. Here is the data memory, the heap and the stack. So this is the operation that we do. We extend the code selector that only reached here originally, and we extend it from two here, all the way to the world memory, so we can execute a code in this area too. We also extended the data segment just within free cost. It's not really necessary. Well, so a little last emblem, this is the implementation of the server code that I was showing. It may be a little, this gives some instruction that are not commonly used in user mode, like this one and this one, that store global description table and store local description table, because the selector are stored in these tables that the painting processor used to store the selector. So we first store the selector in some place in the memory, it can't be any place. We choose to store it in the ISP itself. This section of the code add a lot of operation used to assemble the selector, because the selectors are not continuous in memory. This assemble some place in one byte, some byte later are other parts of the selector. I don't know why this is, the Intel engineers made it that way, I don't know what it is because, but you must assemble the selector using a lot of boring operations, and these two find an instruction, extend the selector, place it only a bar way in a specific place of the memory, then we must load again the selector, here is not the part that loads the selector back into the painting processor, it's not sure what it is, it's next. Okay, but we are not really finished yet. I was saying this expert is a little complex, because OpenBSD is a clever system and in the next context switch will restore the selectors. So if we are happily executing this stack, but if the process, our context switches back, the process will crash, because the protection, this protection WXRX will be enabled again and the process will crash. The execution of the checker will be detected by the operating system. So we must try to get a portion of memory that are executed that are right over and execute over forever. How we do that? We can use to, we got two options to do that, in fact we maybe got more than two options, but these are the two options that I think of. The first one is to use another system called, because I am executing a user mode, I can call any system called that I want and I call this one that is named and protect. The system called is used to give any portion of memory any permission that I want. So I just unprotect all the stack. I say to the operating system that I know I want to execute calling the stack using this. And the operating system will make the world stack executable like it was Windows 95 and will be executable forever. We now do a couple of things to fix the original process because we don't want to design my process of the web server process to crash. We wanted to make a new process and to keep the original process attack to function to work okay to work normally. So we first fork the process, make a clone of the process and now we got two process that are the same. In one of those process we fix all the stack, we fix all the things that we overwrite and continue to execute normally. So if we attack the design my process, design my process we continue to execute like if nothing was happening and the forked process will be executing our code forever. Forever in a secure position of the memory because we unprotected that memory and it's over. Now we got a root processor executing our share code. There is another way to do this that is to do another function call that is called a map or memory map. We use after-operative system to give us a special portion of memory that is not in the stack but is writable and executable. So we just copy our share code in that new portion of memory and execute from there. And in the next context switch there is nothing that can stop our execution because it's a server portion of memory. Okay and this is the end of the exploit. We are now executing got a root process executing our code in user mode. This is a sample of what is what looks like this exploit. Here is a terminal of OpenBSD executing and asking for login prompts and I'm sending here the couple of packets. Inside the share code I have inserted a break point of introduction tree. So this blue part here in fact is the debugger of the kernel debugger of OpenBSD. The ddb is called. We can see maybe you can see here that it's not hanging. The kernel has stopped it because it's a break point. It's not a crash. Here we asked the debugger to continue to execution and here the OpenBSD system is continued with normal execution but now it's hooking. Now we got all code hooking in the interruption IT. Now I would like to do a live demo of this. I hope it works. It may be not work but to make a little more interesting I'm going to do a live demo. Okay now we are launching the build machine with the OpenBSD 4 operating system and we're going to launch another build machine using the Linux operating system that will send the package to this build machine. The build machine are connected together with a host-only network. It's like a virtual network between the two build machines. Maybe we're going to have some problems with the resolution. I hope not. I think we're going to have some problem with the resolution. Coru please make the screen a little smaller because I can't see the top of the screen. I can't move the window. Okay now the top please. There you go. Let's see. In the right side is the shell code. The writing is in Python language and I want to launch the shell code in the other window here. Okay here we can see that the OpenBSD channel has stopped it because the attack works and it's stopped in a break point because inside the shell code I have a place that's a break point and we can ask the operator to continue with the execution and the channel of course will be hooked with our shell code. Now the OpenBSD channel has a hook in the interruption and it's working perfectly normal like if nothing has happened but in fact our shell code is inside the interruption vector now. Okay that was one of the live demonstration but researching about the IPv6 protocol. The IPv6 protocol is not very much used and it's active by default in a lot of operating systems and that is a receipt for a lot of failures and a lot of bugs and vulnerabilities. I will to show another ones that I have discovered as a part of my research and okay using virtual machines. So we will continue with this. This couple of vulnerabilities are for the Linux operating system. We're going to use the Ubuntu distribution is one of the most used distribution of Linux. Okay this is a Linux kernel, the latest one, the 2.6.22 kernel and it's a custom kernel this one. Okay it's a custom kernel and I will send a couple of ICMP packets to him to see how it will respond. Here we can see that this is a Linux asking for a login. Sorry I get confused that was not the attack. Okay now we can see that the Linux kernel is hanging. This is because we have sent another couple of IPv6 packets. It's another protocol but the Linux kernel you can see as it's hanging. I'm going to show one thing. Maybe you can see the lights are blinking here. This is how a Linux kernel, a Linux kernel 4x4 protection is shown with. This Linux is hung very, very few times but when it hangs it's just blinking the caps lock key. It's very strange to see the Linux kernel hanging. It is hanging sometimes. This is a Daniel of Cerberus attack and in fact it's not a Saturday so it's patched. It's patched but it's in the very latest version of the Linux that has come out a couple of weeks ago but it's not back ported. You mean maybe you have a Linux system over here. I'm going to attack a completely actualized Ubuntu system to see if they have patched this vulnerability. You can see this is a kernel 2.6 to 20 slash 16. It's the latest one. I have actualized the kernel just around 12 PM midnight and it's what's the same kernel. This is the latest kernel for Ubuntu system. We're going to launch the same packets. Great. The Ubuntu system is perfectly. But we're going to launch the first attack. There's some other attack. Oh damn. So you got there a full patch of Ubuntu system that is still half a vulnerability. All of it because the IPv6 was activated by default. So this talk is over now but I want you to say only one thing. That is if you got a unique system or a Linux system and you got IP activated and you don't use it, please deactivate it. It's pretty easy to do because you can see there are very bad people there and they can do things like this. So thank you. Do you have any questions? You can ask me now. In the ICMP packet has data part that is supposed to be replicated in the answer of the ICMP packet and I placed simply in that portion of the packet. It's a big packet like a 1000 byte long. The shell code in fact is something like, I don't know, 700 bytes. It fits perfectly in the second ICMP payload. It's in that part. I could send the exploit in a lot or in another ways like, I don't know, floating the system with shell codes. The system will place the shell code any place in the memory. Maybe you are going to fill the memory with the shell code and I can't just jump anywhere in the memory because the shell code surely will be there because if I send 10 megabytes of traffic to the OpenBSD system, it's going to put it in some way, in some place in the memory. Okay. If there's no more question, thank you very much. That's all. Thank you for coming.


I'm delighted to join you today in spirit, if not actually in person. Many of you will have heard me speak before, and you will know the pride and love that we as a family have for ICPP. Here we are 56 years later, and it is an honor and a privilege to be with you today. Everyone here today, I mean everybody online, and I mean everybody from the director, the academics, the administrative staff, and the students. Each and every one of you is here because of the spirit of the land. Some choose to remember my father as a man of science and a great physicist. Some choose to remember him as a Muslim world from the first Nobel laureate for the sciences. But I strongly believe and suggest he should be remembered above all else for his humanitarian work, his passion and his love for the service of humanity. As you know, Abbas Alam means servant of peace, and he certainly lived up to that name. Some of you were here in 1997, and ICPP became the Abbas Alam ICPP. We held a wonderfully moving celebration of a life and time with our father. One of the speakers was a very talented science writer, Nigel Calder, who has known my father since the early 1960s. Nigel had been introduced to physics by my father back then, and he got to know him very well. Nigel went on to edit The New Scientist, which was author of a large number of books throughout the 60s and 70s and through into the 80s. And he was a pioneer in explaining science in the most simple way to demand on the street. Nigel was one of those most respected speakers who came to Trieste in 1997. And in his address, he spoke of Abbas Alam's cosmic anger. Now, we as a family knew that father had a very quick temper. He did get angry quick, but then forgot it very quickly too. So when Nigel mentioned his anger, we were not sure where he was going with this. So we were a little uncomfortable. But Nigel went on to simply say that Abbas Alam had a deep anger that the divide between the developed and the developing world, the arrogance of the developed world, imposing their will on the developing world, an anger of the inequalities of the world simply because of an accident of birth. And yet father combined this cosmic anger, actually with a great cosmic patient, worked tirelessly to try and bridge and reduce the gap between the developed and the developing world, at least in science and technology. And if you remember that father was just 34 years old when he began this work in earnest. And it was the service of humanity, which is the essence behind the creation of ICI community. Father had a huge struggle to overcome the resistance and arrogance of the developed countries who opposed the creation of ICTP. Father persevered to keep going where many would simply have given up. And until he could not work any longer, until his physical strength had gone, yet his mind was still as flesh as ever, he was fully forced to stop working for his true love and passion, the ICTP and all that stood for and all that represented. The priority in life was the ICTP and everything that was embodied. Throughout his time, as in GSD, he had one rule. Today was divided into three, one part for administration, one part for his science, and the most important part to keep the door open for all the students and colleagues. He would literally keep an open door policy for students and colleagues to come and see him and talk to him about their work, their issues, their problems with a personal or work related. And he would be there in any way that he could to support, nurture and encourage them. Father took great interest in great pride and great responsibility. Every single person who walked through the door of the ICTP in whatever capacity or role they were there. And interestingly, not just these people, even one who came through the door, did he get to know, but he also got to know their families very well. And this was no mean feat, people with keeping time consuming challenges going. And of course, ICTP was smaller then, but somehow with a superhuman effort and the support of some amazingly committed people, Father managed to keep all these three priorities intact, but obviously at a considerable cost to himself, his health, and his family life. But that was a price he was willing to pay for such a noble cause. It was so special to him and so important that for Father it was a price worth paying. So my plea to everyone here today are all the wonderful people who are a part of ICTP and the wonderful family of ICTP. Don't just look at your time as ICTP is a job, a routine. But look at it, all these illustrious people around to precede you and are with you now. And remember that you too can play a huge role in continuing the work started by Abdul Salam. Look at the legacy and look at the role model of this great humble man. And if let me just finish on this part before I actually talk about the spirit of Salam Award. As you know, one of my father's favorite poems is by John Dunn. No man is an island of itself.  Art of the Maine. Largely watched away by the sea, Europe is the less. As if it were from Montreal, where as well as any manner by friends or slime owner. Any man's death diminishes me. I'm involved in mankind. And therefore never send to move for whom the bell tolls, it tolls for me. The spirit of Salam Award is established to remember and remind everyone of ICTP. As I said, the real reason for the existence of ICTP. It came about because of one man's vision and sacrifice. And it came about because one man was firmly committed to try to make that change and devote his life to try and help his fellow human beings. So I'm actually delighted this year to award the spirit of Salam Award to three recipients. First is Mohamed Hussam. Mohamed Hussam is a distinguished and highly influential Sudanese advocate for science in the developing world. He was an early career Sudanese mathematician. When the Salam accrued him to come to ICTP. In 1983, Salam asked him to help organize the foundation meeting that would establish the Third World Academy of Sciences. The World Academy of Sciences as it's now known. And as a recommendation of Salam, the first founding fellow appointed Hussam as the first executive director in 1985. He remained in that role for 26 years, becoming close advisor to Salam and developing twice his worldwide networks that have had a far reaching impact. I've sometimes been a long friend and collaborator of father. Father picked him as a man with a charm, intellect and flair to drive twice as it was then. It's an idea to reality. I always believed father knew that in Hussam he would have someone who could learn the art of networking, building bridges and developing communities. Hussam delivered what father needed and helped build into us into the final organization it is today. He'd worked tirelessly in the spirit of Salam to further education, science and technology for all. He's led from the front and always been willing to sacrifice himself and his comfort for much more noble cause. I know my father was very fond of us and I saw them on many occasions interacting together. It's very grateful to him for the hard work and effort he put into building the foundation of us. We are honored to award husband of spiritual Salam. Second recipient is Gregorio Medrano, a sense of Spain. Gregorio's a Spanish physicist and had a long history of collaboration with my father and was a frequent visitor to YCTP. Inspired by Hussam in 1980, he sent you a proposed creation in Spain at the center for energy studies. This would have established a triangular forum between Spain, the Islamic heritage of Spain and the Islamic world and Latin America. Unfortunately the project did not materialize due to some political changes in Spain. But Gregorio is another long-term associate and friend of under Salam. He lived and breathed the spirit of Salam and he believed that need to build bridges and build to a greater good. Whilst Gregorio was heavily influenced and inspired by father, he also followed his own path. He always kept the ethos and words of father in sight. If the center for energy studies could become reality, it would have allowed a part of the Islamic world to gain a seat at the top table of intellectual excellence and would have given Latin America a much needed boost and step up to also develop relevant expertise in excellence. This is our collective loss with the center to not materialize this time round. But we must be optimistic and believe that Gregorio's and father's dreams may still become a reality. And we are delighted to award Gregorio the spirit of Salam award. Hilda Sidera from Argentina. Hilda was a scientist in ICTP's condensed matter section and still had assignment in 2004. In addition to her scientific work, she developed ICTP's e-journal delivery service. She was allowed scientists of institutions in the least developed or low-income countries to access current scientific literature, mainly in the fields of physics and mathematics. The articles sent an email to reach individual scientists who do not have access to sufficient bandwidth to download material from the internet in a timely manner and or cannot afford to connect. It was a matter of great pressure for us to choose Hilda. Her contribution was so in the whole spirit of ICTP and father and everything that they stood for. That no person should be denied access to intellectual stimulation, reports of knowledge, and the accident of birth did not hinder their personal development. Hilda has worked tirelessly and without wanting any recognition for her work. She has worked quietly and passionately to make the delivery service a reality and ensure access for all. The platform that Hilda helps to create could well be scaled up beyond just mathematics and physics. And it would be wonderful to see this happen. In many ways, Hilda embodies the spirit of Salam and we are thrilled to award Hilda the spirit of Salam award. My deep thanks and appreciation to each and all the organisers for today's event. I do hope we meet again in person soon. And as a family, our best wishes for you all. Thank you on behalf of the whole Salam family. May God bless you all from Keith Easton. Thank you.


Single Sign-On Authentication is required now more than ever. Nowadays, almost every website requires some sort of authentication form to access its features and content. With the number of websites and services rising, a centralized login system has become a necessity. In this video, you'll learn how Single Sign-On Authentication is implemented for the website. Single Sign-On is strictly related to the authentication part of a federated identity system. It only concerns establishing the identity of the user and then sharing that information with each sub-system that requires that data. Basically, a federated identity is a centralized or linked electronic identity and it handles a few concerns. The first one is authentication. This aspect deals with validating the user credentials and establishing the user's identity. It also handles authorization, which is related to access restrictions. Is the user allowed to check X resource or Y resource? Next, we have user attribute exchange. This aspect deals with data sharing across multiple user management systems. For instance, a field such as the user's real name might be present in multiple systems. A federated identity system prevents data duplication by linking their related attributes. Lastly, we have user management, which is related to user administration, like create, delete, and update users. A federated identity system usually provides the means for administrators and users to handle accounts across different domains and subsistence. But now let's go back to Single Sign-On. Sooner or later, web development teams face the same issue. You have developed an application at domain X and now you want your new deployment at domain Y to use the same login information that you had on domain X. In fact, you want more. You want users that are already logged in in domain X to be also logged in in domain Y. And this is really what Single Sign-On is all about. Let's take a look of how a non-Single Sign-On scenario would be like. As a user, you would browse to domainX.com where you would be required to enter your login information and be authenticated. And then your browser will then store a cookie. Then the same user browsers to domainY.com where they are also required to enter their login credentials and authenticate it. And the browser stores a cookie again. Now as you can see, the user had to enter their credentials twice and be logged in twice. The solution to this problem is to share session information across domains. However, for security reasons, browsers enforce a policy called Same Origin Policy, which dictates that cookies and any other local store data can only be accessed by its creator. And by creator, we mean the domain that initially requested that data to be saved in the first place. In other words, domainX cannot access the cookies that are stored on domainY, or vice versa. Luckily, Single Sign-On solves this issue on one way or the other by sharing session information across domains. Different Single Sign-On protocols share information in different ways. But the end concept is the same. There is a central domain where the authentication is performed and then the session is shared across different domains. For instance, the central domain can generate fine JSON web tokens, which can be encrypted using JSON web encryption. This token may then be passed to a client and used by the authentication server and any other domain. The token can be passed to the original domain via redirect. And it will contain all the necessary information required to validate the user's identity in the domain required authentication. As the token is signed, it cannot be modified by the client in any way. The way it works is that whenever a user needs to be authenticated, they are redirected to the authentication server. As users are already logged in in that domain, they can be immediately redirected to the original domain with all the necessary information and authentication token. Let's go ahead and take a look how a typical single sign-on flow would look like. A user would browse to domainx.com, which then will redirect them to the authentication server. Two things can happen in the authentication server. One, the user can be logged in for the first time, enter the credentials, and the authentication server will validate them. Or two, it's not the first time that the user is there and there is already a cookie available. Once the user is authenticated in the authentication server, they are redirected back together with a token to domainx.com. Domainx.com will then use that token to authenticate within its own domain. And it will store a cookie in the browser's local storage of domainx. Now, when the user wants to access another domain within this system, they would navigate, for example, to domainy.com. Domainy.com will then redirect the user to the authentication server, and because they have already signed in, there will be a cookie available in the browser's cookie storage. The authentication server will send a token and redirect the user back to domainy.com, which then will be used to authenticate the user in that domain. And finally, it will store a cookie in its local browser storage. If you've been doing some research about single sign-on, you've probably found out that there are multiple protocols and ways to implement it. There's OpenIDConnect, FacebookConnect, SAML, and many others. You should choose whatever is simplest for your developer efforts. For instance, SAML is really well-established in enterprise environment, so you might want to go with that. If you think you will need to integrate your development in more than one alternative, don't worry, there are already solutions available for you. In fact, Out0 has one of those solutions available. If you're already using Out0 for your development, you will know how easy it is to integrate our solution into your system. You can go ahead and take a look to our single sign-on documentation and our code samples out there. The Out0 solution works as a bridge between different single sign-on frameworks. So wherever your existing applications are using right now, using Out0 will be super easy to integrate. If you remember from the previous diagram that we talked about, basically the change in there, it would be that what we used to call the authentication server would now be Out0.  There are frameworks out there that you can use to implement single sign-on, but Out0 will make your life way more easier. Let me know what you think about this video in the comments below. Thanks for watching!