Thank you Heather, thank you so much for meeting with us today and we'll talk about the project that we're specifically working on we want to talk to you about but first if you could say your name and what I'm really excited about is your position is both you know someone with experience and now working in facility so if you could just explain that unique position that you hold sure you're an expert sure so I work at Vermont works for women I am coming up on my tenure anniversary and I've held many different positions in my 10 years but my current position is as a program manager for justice involved services I started working in the facility in 2017 and I approach this work from the lived experience aspect so I myself am a woman in long-term recovery and because when I was in active addiction I did come in contact with the legal system and so although I wasn't incarcerated at this facility I do have some experience and have overcome those barriers that you know a criminal record will impose and so I approach the work by recalling what it was like to be in the client seat and what are those services and resources that I could have used when I was in their position nice that makes you so uniquely positioned right for your work it really does because when I say I get it they know I get it and I think also when I share my story with women and I'm very open about my story we do weekly orientations for folks who are new in the facility and that's why I introduce myself to them so they know right from the beginning I have been in their seat and it's not easy and you know I have a recovery day and I have a sober day because I don't think a relapse means your recovery starts over just means your sobriety starts over because there's lots of lessons that you've learned along the way and a lot of knowledge gains that don't go away once you have those knowledge gains they're yours to keep nice nice so the project that we're working was a few projects working on but the one that we really want to dig into today is just really trying to make it real budgets being value statements so right now as you know as we know they're proposing about $90 million to spend on a new women's facility and that is one use of funds and we can still do that and also create a wider network of caring community and so you're part of that community of care you're providing services so first maybe just let's explore the services that you provide for is it reentry or is it prevention and so we provide in facility services preparing women for release and gaining those skills so that they can be successful once released and then we also provide reentry and transition services I would prefer to you know be more on the side of reintegration rather than reentry because I think reintegration is stronger than reentry and reintegration replies that there's that community aspect because you know oftentimes when there is substance use disorder to maintain your recovery you have to avoid people places and things and it's not easy to build new people places and things so oftentimes I will work with clients preparing for reentry and I will encourage them to utilize the program COSA circle of support and accountability which are through the justice and reentry centers because that program is structured in a way that three or four community volunteers are on your team and they already have networks in that community that you can now tap into just because they're on your COSA team and so that really gives you that that leg up of building new people places and things nice so thinking of all the programs that you offer and the you know let's take a it's so exciting to think vision-wise like you know strategy statements so like if you had more money like I know COSA from firsthand experience that there's not enough money to provide enough COSAs for the people that want it so we know there's you know so can you think of the different services that you already provide that could be extended if you had X amount more of money well I think COSA definitely expanding that program so that nobody was left out that wanted to have a COSA team mentoring is another way mercy Connections runs the mentoring program for women who are incarcerated and I know sometimes people have to wait for a mentor before they and I think also it's important that participants aren't just matched with the next person on the list like it has to be a really thoughtful and intentional match we do the same thing when preparing women for employment it's not about any job it's about the right job because if that woman does not feel valued in the workplace you're not going to build that loyalty and that retention that the employers looking for mm-hmm so COSAs mentoring like both of those I'm certain could use X amount more money do you have have an amount that you would I am not the finance person and so I wouldn't even know where to begin I'm coming up with a budget I just know it needs more than it's getting yes exactly and also I think you know looking at the ways the volunteers are trained because not most of the volunteers aren't going to come with that lens of lived experience so if there was integrated into the training of the volunteers maybe panels with folks who have that lived experience I'll give I'll give you a good example because I was working with a participant and she was really struggling to connect with her COSA team and so we were role-playing different aspects and she was telling me how you know she was communicating to our COSA team that she was struggling to find those activities in her community where she wasn't going to run into the same old people and one of the COSA team members that recommended why don't you participate in Greenup Day it was just before Greenup Day and for someone who's never experienced Greenup Day to go by themselves and sign up and volunteer I think it would have landed better if the COSA team member had said why don't we go do Greenup Day together so that there is that integration because you know just recommending Greenup Day a woman who was formerly incarcerated the way she processed that was I have just given the state seven years of my life I'm not going to go pick up garbage for the state and give them one more day but that's not the point of Greenup Day it's community building and it's that reintegration piece yeah and I can tell you in first-hand experience there's no training for the COSA's in from someone either working in facility or that's recently reintegrated from being in facility so that would be a wonderful thing yeah how do you gain like resources for programs like these so there's a number of ways to gain resources Vermont Works for Women is supported by private donor dollars we also have philanthropic grants through foundations and then there's also the state contracts so we have a contract with Department of Corrections for our in-facility work and then our reentry services as well so it's a contract obviously as with contracts things are spelled out so in our current contract like we oversee the facility worker program and it's a way for the incarcerated individual to gain work experience also give back to the facility by doing some of the work that supports maintenance of the facility and then most importantly they're gaining those work skills and they are gaining that professional reference that's current so it doesn't look like there's this big huge gap from the time they were incarcerated on the resume because Vermont Works for Women because we do you know regular evaluations and performance reviews we address you know performance issues through our accountability action plan structure so that if there are issues that are going to jeopardize employment in the community we can start addressing some of those issues so are they consistently late or do they not communicate when they've got you know conflicting appointments for their work those sorts of things so you know these women you know these women well yes right and their citivism rate I mean it's a moving target but it's like 48% ish you know in the last 10-15 years for women in Vermont so thinking about the women you know and the ones that may be coming back into facility what do they need well I can say it's not a one size fits all definitely yeah nothing is nothing is and different women need different supports I think you know the prevalence of trauma is a big issue and not not getting the trauma addressed and resolved really leads to you know repeating the same patterns when they get released I think there's a lot of all or nothing thinking thought patterns that happen in the women so like the first obstacle they you know come up against they throw their hands up and that's it throw the baby out with the bathwater it's easier just go back and I can remember when I was transitioning off of reach-up that I felt that way often it seemed like for every gain I made personally the system knocked me back three so I can remember a time where the employer was working at offered me a raise and I didn't take it right away because I wanted to see what it was going to do to my benefits and long story short couldn't happen I accepted the raise anyway because I earned it and deserved it and that raise put sixty dollar forty dollars more a month in my net income cost me a hundred dollars in benefits mm-hmm and I think you know mm-hmm with my own experience I grew up middle-class ended up in poverty due to my addiction so I knew what I was working back towards and if I struggled and wanted to throw my hands up and say forget it it's easier to go back on the system quit my job how could those people with generational experiences understand that it was greener on the other side mm-hmm and that's what drives me today mm-hmm what are ways that the state can kind of cut back on those on those barriers good question it's challenging because a lot of the money comes from federal government which have their own mandates you know so like you know I'm just thinking of you know Medicaid policy like if you're incarcerated Medicaid can't cover any of your health care or therapy needs and so even if you have an existing therapist you were you know built a relationship with on the outside when Medicaid could cover you couldn't continue that during incarceration because your counselor can't bill Medicaid for you well you couldn't have it be paid through Medicaid true right there are other ways that we could step in and provide funding to continue that right like potentially I know there's a lot of overlapping issues with contractors and contracts and who holds the contract and you know I think I think the state tries to make sure that when they do offer contracts that there's not duplication in services so that the different contractors have very specific lanes you know which can be a good thing you know because you don't want to pay four different people to do the same job and it can also have some disadvantages because if there's only that one provider and there's not that relationship building with the client it's not very client centered so how do you balance that it's it's tough I wouldn't want to make the right right well let's let's remove it and yeah I should you know say right all that's convoluted bureaucratic decision-making for sure but if we know that women anyone coming out of facility going into facility where need that therapeutic help right what could we like just thinking vision-wise like what could we do I think vision-wise you know I'm really hopeful that upgrades in technology access will really open a lot of channels I know for example with through technology now and contractors we're able to do remote meetings with local providers so now they've got a face to the name they've started building that so when you get a higher ability appointment the Tuesday after your release at 2 o'clock you've already been on screen with who you're meeting with and I think that's very I think that goes a long way and I would love to see that expand I think opportunities for trainings bringing trainings in using technology I think there's a lot of areas there I would also love to see more like potentially augmented reality so there are certain things that for security reasons you know that would be dangerous to train someone and and through augmented reality I think there's a way to do some training without having the danger of say the power tools but using a plastic model wearing you know the equipment it looks like you're using a circular saw or a chop saw or a welder and I know that there are some states that are piloting and there are some companies who have developed the technology I know locally right up at Champlain College they do a lot with augmented reality and we Vermont works for women has met with them to see how can we incorporate this into you know like Rosie's girls or you know some other event that we're holding because it's a lot easier to bring a computer and some goggles than it is to bring a whole tool shed how do you think it is beneficial to the community through the broader community for these re- integration programs well I think it's really important because the majority of folks incarcerated are going to be released and who do we want coming into our community do we want someone who has been through the traditional setting of you know power control punishment or do we want someone returning who has been healed and valued and know that they've got a contribution to make to the community they're joining yes I talked about power tools let's talk about the old trailblazer trail that's one of your programs right yes so that's another you know therapeutic unwrapping is part of what is needed for all of us and also literally homes yes are needed right so I know that people are still in facility because there isn't secure housing that's true that's a that's a major barrier to release is approved housing for sure and then when they get the approved housing you know are there supports and resources in place for them to maintain the housing so they don't lose it which is a violation often which sends them back which contributes to the recidivism yeah so at one point trail was it trailblazers that was doing the building of homes was it that was out the program so it was an earlier rendition of what is now our trailblazer program and the women were at another facility that had the space but Vermont works for women led modular home where the incarcerated women were able to actually build modular homes that were then you know able to be sold and to buy materials for the next home so it was it was a great program when there's space and instructors and you know places for the houses to go where and so that was back in the old days back in the old day free my time yeah yeah and it's no longer because well the women moved facilities and especially being that where they are now at Chittenden regional the space is really limiting it just was not built for long-term capacity right right so that would be that's a funding that's a yeah I mean from from what I've learned is when Vermont shifted away from the county jail system and DOC was taking the detainers they built these smaller regional facilities to house the pre pre-trial detainees so until their their day in court happened and then there were larger facilities after sentencing but you know that was I think you know CRCF was built back in the mid 70s so things change you have new leaders they make different decisions yeah yeah well let's go on that train for a little bit like the practical needs that we all need right so housing yes so can you think of other things that we might be more aware of and trying to fund whether it's programs that help them build houses or just literal housing for reintegration I mean housing is and it's not just formally incarcerated folks it's everybody across the board so absolutely housing affordable housing supported subsidized you know I love the model of resident-owned communities if they're affordable and so like when I think about some of them some lot rents are like prohibitive plus if you've got a mortgage on top of it and so but with the resident-owned model you know there's investment every person living there has skin in the game and how they want their community to be transportation is a big issue in this state you know unless you live right here in the Burlington greater Burlington area it's challenging and when I think about you know all the appointments the women are required to attend and the buses only run at certain times I think it's very middle class to schedule an appointment with someone at one o'clock and you know get upset if they're 15 minutes late when their choice was to be 15 minutes late or 45 minutes early right right right yeah transportation yeah yeah wait I was thinking something when you went to the housing oh like things like therapy do you think we need resources to support things like that absolutely because you know the majority of incarcerated folks have experienced trauma I think being incarcerated doesn't doesn't give the environment to have true healing you can build awareness you can share knowledge but that that visceral somatic healing is really challenging in that environment when they're slamming doors radios going off and those sorts of things I'm a somatic life coach and so I really tried to get folks in tune with their bodies because their bodies really will then influence their thoughts and then their behaviors and ultimately their action and so I use an example because when I first learned about somatic practices I personally made more progress in 12 weeks than I had in 12 years of CBT and I think it's you know because CBT rightly so begins with the thoughts and the behaviors but if I'm standing in front of a mirror saying affirmations and I've still got the knot in my stomach and the lump in my throat can I really believe the affirmations I'm saying so I work with people to you know become aware of their energy so now today when I say affirmations I'm able to do it with an open heart and a feeling of joy in my body with more resources what do you think what up and we only have five minutes left or it's like three minutes left what do you think Vermont works for women could expand to do well I think I'm you know being able to expand statewide is really critical and we that's one of our that's part of our strategic plan is to be able to have staff that aren't just centralized here in Chittenden County and have you know staff stationed around the state so that even though the women are incarcerated in one area they're not released to one area so how can we have that continuity of services so that if I've been working with someone while they're incarcerated it doesn't just stop when they get released or I have to switch to only serving them by phone or virtually like I'm if I could have staff to pass off to and help support that warm handoff I think it would go a lot further and just really quickly just touching on because addiction is intersecting a lot so what's the state of you know supportive care in that way recovery housing in Vermont it's really scary right now I mean Vermont has no long-term treatment the only facilities in Vermont give you two weeks maybe four at the max and my own journey was 12 times at rehab and it wasn't that rehab was any different on the 12th time it's that I was finally different and so if there's only a handful of facilities you know I always wonder what if the rule was you only get 10 trips to rehab where would I be and I think it also helps me when folks do come back it's a clean slate with me because someone afforded that clean slate to me 12 times so as someone comes back three four however many they're gonna get that exact same service for me as if it was their first time and there's no there's not even housing there's there's two four-week programs but then there isn't even housing once you are gone from two to four weeks there's there's limited you there's limited I know v4 has a handful of houses Vermont foundation of recovery there's dismiss miss yep Jenna's promise and his promise awesome to you and his promise is a great model as a matter of fact they integrated a 13-week intensive trauma program so now everyone at Jenna's promise before they even do the employment search and stuff they do 13 weeks of trauma intensive outpatient and it's an organization at I don't know much about it but I'm just like it's exciting and filling it yeah but there's also been a number who have closed to Northern Lights house closed Liberty House closed tapestry closed so I think you know sustainable funding is challenging mm-hmm I think the way the philanthropic model is set up where we a number of agencies will serve the same population and they go after the same funding so I think the way it's structured in order for us to qualify for funding it's almost like we have to cannibalize participants from other agencies to keep that funding but then that other agency which has a place like we all have a place but the way the the structure is set up to apply and then that funding is awarded mm-hmm I think needs an overhaul yes and then peer support within facility I know they're you know piloting a program I think maybe in Rutland maybe for peer support in the recovery culture yeah yeah yes so is that some that's something also that we could be expanding absolutely happening in CRCF so CRCF has the open ears program which actually a new cohort is being trained as we speak so they go through a training and learn coaching models and methods like motivational interviewing techniques and it's total confidential so what they say to the open ears coach doesn't get back to DOC or security I just think it's a great model and I would love to see that expand as well right because there's not we both know there's not enough open ear mentors there's not enough open-ears mentors and you know you have to make sure it's the right person doing the work too I mean I think I think that's extremely challenging to balance you know getting the right people to do the work who aren't going to use their position and leverage and potentially because they have their own stuff that they haven't been given the space to work through exactly yeah yeah she goes back to the therapy that you were talking and in my coaching training that I've been taking I had instructors say oftentimes as life coaches where either one step ahead or one step behind clients where working with and I think that's true for any peer model yeah all righty well I know I know we're distracted but we will continue this yeah so much other thank you I'm just starting the conversation of what more could we be doing yeah I think I think absolutely having you know expanding awareness and sharing for those who don't have direct interaction with the legal system or maybe have never had a family member with addiction issues or you know criminal history I think you know just talking and having these conversations and putting it out there universal energy will take care of the rest yeah thank you thank you absolutely thank you yeah


He was presented back to Dominic Calvert-Lewin. Everton have got a few bodies forward here. Calvert-Lewin flicks it into the path here of cutback for Rooney! Take that, Manchester City! It had to be him. You just knew it! 200 Premier League goals for Wayne Rooney. Nine against Manchester City. And now, this one in the jersey of Everton. It came from a city mistake by a Leroy Sane. But here's Dominic Calvert-Lewin linking up with Mason Holgate and the cutback for Rooney, who beat Eddison. Rooney back in Manchester to punish the blue side of the city. Rooney for Everton. Again!


Let's start recording because now we're moving on to, now for the final module you're going to be digging in and going back to putting the skills that you've been building throughout the semester of understanding and learning web applications, sorry not web applications because we just covered that, but what we've learned about assembly, so you've been learning how to write assembly code, you've been learning how to reverse engineer programs, now we're going to start putting those pieces together to actually exploit vulnerabilities in binary applications. And first we'll start with shell coding. So fundamentally what we're going to want to be doing and where we're going is trying to answer the question, how do we trick the computer into executing some of our data as code? And we actually have already seen an example of this and we've been doing this, so when we're doing a SQL injection what are we trying to do? Like what's the goal of a SQL injection? To run, well anytime I interact with the application it's running SQL code on the server. Yeah, so specifically we trick the server into taking something that should be our data, right, because it's data that we provide to the application, so it should just be data that's stored in the database or used to query the database, but we trick the database into treating that as code as part of a SQL query, we think of a SQL query as code. Exact same thing with cross site scripting, right, cross site scripting is fundamentally you're tricking the browser into interpreting your user data as JavaScript code. This also goes into command injections are exactly the same thing, you're tricking the shell in SH into treating your user data as code. Now we're going to go, those are all kind of, I would think at a kind of a high level, now we're going to actually go down to the machine level and start thinking about at the machine level what is, how can we trick the CPU into start executing our data as code? And this goes back all the way to like the first, some of the first initial designs of computer architecture, so the, yeah, there we go. So the Von Neumann architecture, this is from 1945, which is a design of a computer system. This is kind of a fundamental difference in CPUs and computer architectures is fundamentally a Von Neumann architecture sees and stores code as data. So how does the CPU, we've been talking about data when we access things from memory, right? What's like the lowest level of information that we can access from memory? A byte, yeah, just bytes, right? It's bytes in memory. So if we ask for a byte, we get a byte. If we ask for a quad word, we get eight bytes, I think that's right. I don't know the sizes, but as for one byte, you get one byte, two bytes, you get two bytes kind of flipped around four bytes, same thing, eight bytes. And fundamentally, your instruction point or where your code, your program is going in order to start executing is exactly the same thing. So there's fundamentally no difference between code and data, right? The code that you write in assembly is compiled down to bytes that are loaded into memory. And we tell the CPUs start executing from here, but fundamentally there's absolutely no difference between the code that you write and provide that's in those bits, that those bytes in the computer's memory versus the bytes that you're storing as data. And that goes all the way back to Von Neumann architectures. Whereas Harvard was another style of architecture at the time that stored data and code separately. So here, you'd have a different memory for code and a different memory for data. Almost everything that we've been using in learning is based on the Von Neumann architecture. Does anybody have a device that is not in this list? Like on them or no of them? x86, ARM MIPS, PowerPC, Spark. Risk is definitely on there for sure. A toaster. What CPU does a toaster run? So a lot of them actually will run one of these things, usually be like a cheap MIPS processor. There definitely are use cases, I think very specific things. I haven't seen these, but they definitely do exist of these crazy architectures. And so what we're going to be talking about and focusing on is what happens if the CPU mixes up code and data? What happens if the CPU starts executing or starts executing something, but it's actually your data and not code? Like one thing to think about is from everything you've learned about assembly and CPUs, does the CPU have a way of determining this? No. And this actually is a good thing. So anybody know how, so JavaScript, we looked at JavaScript, right? How does your browser execute that JavaScript? Yeah, so it has a JavaScript engine that used to be JavaScript was really slow because it would interpret each line essentially. So it'd go through and do whatever needed to get done. But as it became clear that JavaScript performance was incredibly important, they do things like what they call just in time. So JIT compilation, where they figure out, oh, we're executing this code a lot, which means it's very important, which means I'm going to take that code, compile it to x86, put it in memory, and then start executing just that code. And so now it's executing x86 instructions that are interpreting it, which is incredibly fast, and you get insane speedups. This is why JavaScript engines are so fast now, because they use all these crazy tricks. And the way they're able to do that is because of this architecture, they can dynamically create code x86 instructions at runtime and execute them. So you can think that actually gives you a lot more power. I mean, it'll enables powerful things to be able to do that in this Von Neumann architecture. So it's not something that anybody would really want to do and say, hey, let's fix this fundamental problem and tell the CPU ahead of time what's code and what's data, because we actually want these, this thing in our applications, we want to be able to do that. So this is a weird example. Okay. Anyways, the one of, sorry, I'm trying to understand what this is trying to get at, but that makes sense. Oh, I see. Okay. That's a weird example. Okay. So I guess we can execute this example. At least don't have a dojo spun up. Yeah. Okay. Cool. So I already have an example that's seen. So here's my program. Let's just run this. So we have to run it with special compilation options, which gets to some things I'll talk about. Don't tell me things are dangerous. So I'm seeing weird behavior, right? I'm running it and I'm sometimes seeing hello a and I'm sometimes seeing illegal instructions. Let's look at the code. So the code here, if we look at the main function, we have some fixed character array. So a buffer of 1024 bytes on the stack, we then call the gets function with that. So gets if you're not familiar, this does reads from standard input and puts the data wherever we send it. So it's going to put all of our input at name here. And then specifically what it's going to do gets is really bad. If you actually noticed when we were compiling here, they actually told us that should have told us tells us that the gets function is dangerous and should not be used. And if we look at the man page, that's because it reads a line from standard input into the buffer pointed by S until either a terminating new line or end of file was replaced with a null byte. No check for buffer overruns is performed. This means that it will it has no idea what size this character array is, and it will keep writing whatever the user's input is. And because you cannot know in advance how much data will be sent, this is fundamentally an insecure function. But let's look back at this. So we read in to name 1024 bytes. We then seed random based on the time this just sets up we're setting up a random based on time. And now we've say if random mod two, so what's the mod two going to do, even our odds so roughly 50% of the time, we'll do this. Otherwise, we'll do this. And so what we do here is say, hello, we call the hello function passing in name is the first parameter by two is the name one. So that's when we pass in a and we saw farewell. It said hello a and then said farewell, which was what we saw. But 50% of the time it crashed. And if we look here, it says, it passes in as name by one. And it passes in as Nate as by funk, which is the function here, the name. So what that's what that's going to do is start trying to execute code on the stack. Let's look at this in GDB. That's all right. Wait, do I not have my guy can't I can't live like this. Sorry, I need to use a I don't need to but it's way better for me to use Jeff so we can see things. Okay, so let's look at the code here, x.20 is we're going to look at instructions. I want to stop. So let's break it hello, because that's where we'll be is that function call. And then we can bring up the here, no, here code. So, so continue. What do you want to say? Blah, blah, blah. Okay, now we call hello. And we know based on the so we can step through here. What's the calling convention of x86 64? How do I know in which of these registers is which arguments? I just can't remember. I think it's RSI RDI. But is that right? Actually, or maybe RDI RSI? I was hoping someone would know. We'll look it up. Yeah, RDI RSI. So I had it backwards RDI RSI, RDX, RCX, cool. So RDI, which is name has this, which is the address of by to an RDI. Wait, I said it the wrong way. RDI, which is the first argument name is our string blah, blah, blah. RSI, the second argument, the function we're going to call is here. So if we step through this, we're setting up the function frame, doing some stuff, calling the print f. So we're calling print f and passing in this argument to blah, blah, blah. That's where we see hello space, blah, blah, blah. So we should see that up here. Hello, blah, blah, blah, blah. Then keeping going, we see a call to RDX, X five, I let's look at what this is. This is by two. So if we look back at the code, we would see that we will see that we are here at by two. So this will after we go here, this will go into by two, and it will say farewell. So let's run it again. Okay, now out there on this, I guess 50% of the time. Okay, rerun. Okay, is this going to be very annoying? Okay, well, there's an easy way to fix that. And that's why I was just telling somebody else when you control the thing, you can do whatever you want. If you don't like it, change the code. Okay, compile it, GDP it, break, hello. Okay, so I'll type in CSE 365. Okay, now we're calling this function. And RDI, what we're going to output is here by one. But now let's say we've somehow tricked it into pass, we're passing in a pointer to a function that we're going to call. But that's actually the buffer that we have on the stack that we were just reading characters in. Oh, no, what? What are the odds container gets killed right in the middle? Did you do that on purpose? Now, here we are. So now we've accidentally as a programmer passed in or we've tricked it into passing in to swapping those two values. So passing in by one as our first argument and the buffer on the stack. So as we step through, we'll see the printf. So we call the printf. And if we look at the output, it will say, it definitely should say, oh, I didn't, sorry, I stepped into it. So I'm going to do fi to jump out of it, Finn. And it says hello, blah, blah, blah, blah, what's this blah, blah, blah, blah, blah. It's not it's garbage in the sense that it's not ASCII characters, but specifically what it is is it is if we go here, right, what the program is doing is it calls printf and passes as the percent s, the second argument to printf. So what's going to be interpreted as a string is actually this by one function. So if we examine this as a string, it will keep printing out these characters until it gets to a null byte. And so because it doesn't know, right? Again, these functions are very stupid, right? Printf says print me out a string, take whatever memory address I give you and just output it until you get to a zero. So let's look at the call at the call here. We call RDX and now we have this value on the stack that came from us, but it will be interpreted as instructions and will be executed. So I can step into there and I can actually see that we're actually kind of executing some stuff until we get to here, we try to dereference RSI and it blows up because that's not valid thing. And that's why we get a segmentation fault. But if it's executing some code that comes from us, do you know how to create bytes that the computer can interpret as x8664 instructions to do what you want? Yes, because you had a whole module writing assembly code, you've written a web server and assembly code, you've read code, written code, right? That's what we've been building up for because that's now at this moment you've tricked the computer into interpreting your data as code. Cool. So essentially what this is doing is it's actually jumping back to our code on the stack because that's where that buffer existed in the function and it's executing and interpreting those bytes that it got from us as code. Okay. Do you want to make it do something? Well, we'll get there in a second. Okay. And this is an incredibly old concept. So this is actually the Morris internet worm was one of the earliest, this actually took down the whole internet because there was a bug in the replication strategy of this, in the replication strategy of this worm where it was supposed to look if it was already running and if it was, it would like kill itself, but there was problems in that. So this worm would just infect machines and then get on those machines and then look for other machines and infect those machines. And there'd be so many copies of this worm running that it would slow down the machine to where it was unusable. And so it actually used a lot of different attack vectors. It's really cool to look this up. But in, in this finger D service, this use the shellcode injection, the other crazy thing is this worm was I think cross system and cross architecture compatible. So it would like had its own shellcode that it would compile for the target architecture and then go there. It was insane. And they literally had to shut down the internet. So they had to they distributed patches for the, whatever these services that were running, and they all had to like shut down their machines because if one, like, if a couple of machines were infected, those would spend so much time trying to look for other infected machines that would slow those machines down.  It gets even crazier if you look into this, the person who did this RTM, he's actually, I think a professor at MIT was or still is. And at the time he was a grad student, his dad was also I think the director of the NSA at the time. So it's like really, anyway, super interesting. So this is like a fundamental things that we're learning here. Okay. Cool. So how do we write shellcode? You actually already have a very intuitive understanding of this because you've been writing assembly code that you can turn into bytes. That's one of the key things that we've learned. So this is with the, if you go all the way back to when we were doing the assembly module, you gave the program bytes that it took and executed.  You just didn't really know that yet. And so what we actually want to do, if we get to where we're trying to go, shell here has a very specific meaning. This is what like a hacker terminology, this is like you're trying to pop a shell means that you are trying to call execvbnsh. So that that way a shell is now running with the permissions of the target program. So for instance, on the Dojo, the programs, you know, well, actually, I think we have looked at this since, right? So we learned about setuid in the access control module. So this means that it's owned by root. So when it executes, it executes as root. And so if we can get it to execvbnsh, now we have a shell as root, and we can do whatever we want. So that is our goal as attackers. And but there are some constraints. So think about where we were here, right? Think about there's some user data on the stack. And then let's say we could we redirect control flow onto our code. One of the key things is that shellcode needs to be position independent. So it has to not matter where that code lives, because otherwise, you don't know exactly where it's going to be in memory and you can't rely on any fixed layouts. The other cool thing is you can share shellcode then is there's all these repositories of different shellcode that does different things that you can then reuse. Cool. Okay. So I have my hello, let's do shellcode.s. Oh, wait, what if I need my prefix there? Or let's do this. Actually, this is good. So if you remember what exit code 60 is, I would bet it's exit. I actually don't remember how to get all the output though. As. Oh, there we go. Look at that. The test.s eight. So, so this is like, all right. Anyways, okay, we already saw this. So test.s. This is some assembly code that probably I wrote when we were doing these assembly modules. I have no idea. This was so long ago that it's out of my brain at this point, but we're moving one into RDI 60 into rax and executing a sys call. And so using exactly what we did in the assembly modules, right, compiling that to an object file, then using object copy to copy that to a binary. I now have this binary file that's 16 bytes. So I had my hello that's reading from input from us. So by running that in, I don't get a seg fault anymore. Why? Because I'm running real x86 code, not like a string that I had of CSE 365. So let's debug it just to check. Break. Hello. And then I can run it. The cool thing is you can do redirection here inside gdb. So here I'm running it and I'm saying use this file asm.bin as the standard input run to here. Hello. I can look at my arguments. RDI is by one RSI is this I can double check x dash five, I so in examine five instructions here, shows me move one into RDI move three C into RAX sys call. I can start doing next instructions here until I get to the call.  This is somewhere on the stack. We're moving one into RDI. We're moving three C into RAX and we're calling sys call to exit with error code one. So now we've tricked this program into executing x86 64 code that we control of whatever we want. So now if we wanted to let's grab here, cool. Okay, so now I want to do exec v e. I want to call this sys call. How do I do this? Do you remember? sys call table, your friend, the sys call table. Exec v e is 59. We're so close in here. So move RAX 59 sys call. So that'll call the right one. Now I need to get so now I'll need so RDI needs to be string bin SH RSI needs to be zero and R we said it was RDX, right? RDX needs to be zero. So the zeros are easy. What's the way of zeroing out a register without using a move? XOR and our input to the program may be limited when we did gets it read up until a new line, but our input it may only get 1216 bytes that we can trick it to execute as code. So one of the reasons I use XOR here is because it's only one byte. This is what I know from experience where they're moving zero into RDX takes I think four or five bytes because they encodes the zero as like four null bytes. So that's actually if you really want to go, you're not only doing three levels of shell coding, but if you want to get into it more further and further levels add more and more restrictions to your shell code. Like you can't use certain characters. You have to do it in 10 bytes or eight bytes or what's the final one Connor? Do you remember six bytes? Six byte shell code. So it forces you to get creative and understand and be able to do those things. Okay. So I XOR RSI RDX. Now I need to get this string. So normally we did something like this, right? Was it how to dot data section? There's something like, uh, I actually can't remember how to do this. Was it ASCII? S D Z like this? Yeah, minus H. I need to give it a name. Let's make sure that compiles that's shocking. Actually work. Okay. We're not referencing it, but that's okay. Okay. So then we do that. And then we want to move into RDI. What was it like offset of been SH? Yeah, I don't know either, but try it, but then definitely look at it to make sure it makes sense. That's because of shell code. Okay, this makes sense. So why we thought that might blow up. Ah, see, I messed up. Yeah, but I think it adds the null byte at the end, which is important. Yeah, but it's saying it doesn't exist. So or it's unknown pseudo op. I could do the null byte myself. That seems silly. What was it? We'll bite ourselves. Are we crazy people? Okay, let's make sure. Okay, cool. So here's my input. So moving my offset definitely did not work. Okay, I'm gonna grep because I feel like I did this. Yeah, move offset buff. Why is it not Intel syntax? This is driving me insane. I feel like you're just this is like, I feel like I'm just dancing. Okay. So the offset of is not working. This is what I'm double checking. Is this in here? Okay, let's do something like this. Hey, there we go. Okay. So load effective address. So calculating the current instruction pointer, plus the offset into there, move that into RDI, clear out RSI, clear out RDI, move three B into RIX, call sis call. Let's always before we just randomly try something and decide if it works or not. I always like to debug it first. So let's break on Hello. Okay, now here I can before I even do anything I can double check this by doing checking here. So RSI I know is my buffer. So X 20 I load effective address RIP plus five plus F, which is this address X or X or sis call and I can even check that address make sure it's the string been SH. So let's step through print F, skip over that because I don't care about you print F. Now call RDX step into there. So now I can see loading effective address into RDI. So RDI should now have the string. If I look at here, RDI now points to the string been SH X or RSI X or RDX, move three B into RIX, sis call, executing no pro new program. That looks like success is a classic problem. So did it work or not work? Yeah, let's look at this. I think this should help illuminate. Okay, so if we scroll up, we see our exact fee been SH. So this is exactly what we wanted. It's executing. And we could look at exactly all these things step, step, step. But the key thing is it's reading from zero, which is standard input. And it's getting back zero. Why? Because the standard input of this program is the output of cat ASM dot bin. So if there's no more input to read, we gave it our whole file and it read it all. So you can the cheap trick, actually the best way to do this is why you use Pwn tools because you can change it to interactive and just interact with it and not have to worry about this. You can just send the bytes, you can write your shell code in your Python script in Pwn tools, assemble it and then send those bytes along. Another, the cheap trick is to just add it. So dash here means the command line. So concatenate, sorry, not the command line standard input. So first output assembly dot bin and then wait for input from the command line from standard input and then write that to standard output. So what this will first do is write out to assembly dot bin everything. And then if I do things like now I'm typing on here as if I'm talking to that bin SH command through the cat. The other thing I noticed, why was it hanging here? I typed an LS that didn't do anything. That's because gets reads until a new line. So we didn't actually send it a new line. So we could figure that out and then we could do things like, I would do anyways, cool. So we just wrote little shell code already. And we can fundamentally do whatever we want. So we'll check this shell code out. That's crazy. This is like exactly almost what we did. Well, I guess is dot string implied dot ASCII Z. So it does the thing. See, we didn't even cheat and we got there together as a group. So exactly the same code here effectively, just slightly different, right? So this is how we put data in our code, which we already saw, we can use that string, we can use ASCII Z with one I, we can use dot bite to put bites directly in our code. We can, this is another kind of classic technique is having the data be part of our instruction. So we can move this is, you have to read it from right to left because of Andy in this slash B I N, I know to F is a slash. So I don't know what the other ones are, I'm just guessing, but if this is correct slash B I N slash SH. Well, I miss mess up slash SH and the null bite. So moving that into RBX, pushing RBX onto the stack. Now the bites on the stack are that is the string. And so we can move RSP into RDI. So now because RSP points to the start of the stack. So now we have our string there on the stack. But we can also do anything. So we can, we don't have to just execute a shell, we can have it, let's say, one of the classic ones is a connect back shell code. So if you're executing a remote system, you can have it make a TCP connection back to you and have it spawn a shell that is listening to your input on an IP port. So you set up a thing that's listening there and you can type in commands that goes executes it tells you the response. This example is calling open flag and then sending that file to file descriptor one. What's file descriptor one normally? Zero is standard input, standard output. Yes. So send the flag, whatever is in that file descriptor just to standard output. And so you can step through this, but this is exactly, this should look very similar. I remember debugging with some of you in recitations, your assembly code, it looked very similar to this, right? Doing sys or and building a web server.  This is exactly what shell coding is. You're just doing it for a, let's say to achieve exploitation rather than to build a web server. Cool. Okay, we don't need to go over this because we have that running it. Great. If you, Oh, dev standard in that's like, we saw that. Anyways, tools on here so you can use, I guess, should we do this same example using phone tools without being useful to show? I'm going to cheat and have my code up here. I guess, do most of you use from phone import star? I hate that, but fine. Okay. So P equals process. So execute the hello process. Then so what we can do and a way to do this is to write your assembly code here. Now, because it's special and phone tools, you don't need to have all this stuff at the top and everything. So all we're going to have is this extra code. So let's go here. So now this is a string that exists. So I can write my code in as a Python string. And to double check that this is actually working, let's, I'm going to open up another terminal, open up a handy dandy ipython to have it right here as I execute from phone import star. So let's try this. Oh, I see because ASM. Oh, but I shouldn't call it ASM because isn't that the function? Okay, shell code. Well, we will call you shell code. All right, there is an error. And you'd probably have to dig through. You can try to figure out what's going on here. Like I already see this dash 32 is wrong. We did not set up the context, context.arch. Is that right? Equals xa664. There's actually another really cool way to do it. How is somebody doing that? Do you remember from the workshop we did where they set it based on the process? Something like that, index.exe. Okay, not going to get into that. But let's set the architecture correctly. Now when we assemble it, now we get our shell code bytes. Okay, so that should be good. We can even check by, I think we can do disam. I like to do this just to double check. And of course it prints, we want to print it out. So I can again remember it's exactly what I did before with object dump, right now I'm just doing it in Python and using ipython to kind of test that the little pieces of my script are going to work. Okay, so assemble it and p.send line. And I know I want to do send line instead of send because it gets is going to read until the end of the line. Okay, and I'll do p.interactive. So now I have the terminal here. I can just interact with it. Pretty cool. Questions. So you already have all the skills you need to be able to do all this stuff. You've already been using PwnTools to interact with the process to parse complex things. You've learned assembly. I guess you don't even need me to teach you anything, right? Laugh to me. Okay. Okay, but there are some problems that can occur. These are things, these are just more of a reminder. You may have forgotten this since you have built a web server and assembly. But one thing to be very careful about the size of the memory access that you're using, right? So we all talked about that the difference between accessing one byte versus two bytes versus four bytes versus eight bytes, right? So you can do it implicitly based on the size of the register that you're using. So BL versus RBX is going to be one byte versus eight bytes. You can also specifically use these annotations, I guess, to specify to the compiler that you want to move a single byte. So this is move byte pointer or word pointer or dword pointer. This is being very explicit telling the compiler earlier compiler, you only want to access one byte. Yeah, like we talked about. So there was something I didn't show, we could have actually really messed up our shell code. And it could have been very annoying. If there was, what would have happened if there was a new line in our shell code? It would read because gets reads a line. So it would read up until that new new line, and then stop reading the rest of our shell code and only execute half of our code. Actually, let's look at that. We can easily simulate that. Let's say in here, there was a dot byte hex 10 is a new line character. Yeah. So instead of getting a shell, now I get a segmentation fall. And the reason is, well, if we looked in here, we would see that this new line, this 10 is actually causing it to only read in part of our input. We don't, we won't see the thing. Let's check. Okay, let's read from here. It didn't read it. I didn't read that in. I was wrong. It's 10 in decimal, not 10 in hex. See, this is why I get the double check your assumptions. I could have just assumed that all day long. Okay. So let's look at our, so load that.  So it's hard to see that half of your input didn't even make it in. And that's because it's not that the program necessarily forbid a new line character, uh, hex a, it's the fact that by reading and using gets reads to the end of a line in a new line. So you can't have any new lines. And so this is why I'm being careful about these things. If I was really good in my Python script, I would have called an assert and I would have asserted that in my shell code, there are no new lines. That way my Python script blows up rather than waiting and having my payload network and then having to debug the remote system. So this is why, depending on how the program is reading in your input, um, for instance, string copy can't have a null byte, whereas scan f gets gets line f gets can have no bytes, but can't have new lines. Um, scan f also, uh, goes to a white space. So you can't have sometimes a hex 20, which is the space character or tabs. Um, oftentimes, and this can get very fun is your shell code can be mangled or changed and right because it's input from you, the program may operate on that input and then you corrupt something and redirect control flow to your data. So it could be compressed or uncompressed or encrypted or decrypted. So the trick is to work backwards. So start with what you want the shell code to look like. And just like you did in the reverse engineering modules, you started from the key that you wanted. Very similarly, you can start from the shell code you want, try to work backwards. Um, sometimes there may be parts of the input, like let's say it takes your input and then right in the middle, it writes some text file or some input that you can't control. Um, you can do, if you know that, and you should know that by understanding the program, you can use tricks like jump. So you can execute part of your shell code and then jump over just like in the assembly module when you had those knobs, the knobs of like 53 bytes that you jumped over. That's the exact same tricks that you can use to write shell code that can survive being overwritten. Um, other tricks, uh, you know, if we control standard input and standard output, then we can get a shell or get it to give us the flag. But sometimes we may not be able to read the flag back. Maybe the program closes standard input and standard output. Maybe, uh, it's a remote system. And so running a shell doesn't make sense and we can't do a reverse shell. And so what we can do is use things, you can use tricks just like you're learning now in web applications of doing blind SQL injections. You can do similar techniques using shell coding. You can do timing attacks. So you can check the value of a byte and sleep for a certain amount of time and you can write a script that does that. Um, um, so there's all kinds of cool things there. Other things to remember is that your code is being executed in the context of the program and the program has a bunch of registers and a bunch of data that's already in location. So as you think about, uh, shrinking things, you can actually think about, do we need a shell? Can we put the flag somewhere else in some other file that's already open? Uh, do you need to communicate the flag in band? Uh, so you need to think about all of these things. And with that, you'll be great. Good stuff.


Baw, what's up everybody, once again, it's brand man Sean Ann. We got to talk about the artist known as her and the brilliant strategic branding move that she made that a lot of people didn't even notice. Most people didn't even think about, but I promise you, you will understand at the end of the video and see value in it and how you can move for your artist or you yourself if you are the artist and even a producer in terms of your branding. So starting at the beginning, when her launched, if you just happen not to know who her is or much about her, when she launched people didn't know who she was. She dropped her volume one amazing music which made it even better because it was this blue cover silhouette of a woman looked like it could have been an attractive woman and to add on to that her name was her. It's an ambiguous thing, right? What is her actual name? All of this added up to an effective packaging, a mysterious brand with amazing music. People wondered who this person was and the internet never fails. People did research and found that it was Gabby Wilson, but she never spoke on it actually being her. She never confirmed or denied her identity even when people dug it up. And that silence kept the brand going, kept it moving, but she did also say I'm going to reveal my identity one day when it's the right time. She didn't say it was going to be in one year, two years, ten years.  She has music videos that show her face.  Although she kept it running for a while where she would go even to interviews with these shades on, kind of hiding her identity. She still performs like that at shows and does interviews because she doesn't just break character completely saying, hey people know who I am now. I could just go out here and act like Cardi B or just move like any other artist, but people in fact do know who she is. So if you missed kind of where I'm getting at, this right here is the most important part of the strategic brand move. As I already said, she's revealed her identity, but there has never been a huge fuss about her revealing her identity. She signed the RCA. These type of companies definitely make sure that there's a fuss about those types of things if they want it to be known, but she never put much marketing around her face reveal. Why that's so important to take note of is because she said she wanted her brand to be about the music since the very beginning. And mystery is cool. Mystery is great. It helped create a buzz for obviously, but if she heavily marketed her face, if she really focused seriously on the mystery, her brand at some point would have became more about the mystery and the face reveal versus the music itself. So it started off great and it started to actually become about the mystery, but she revealed herself so it didn't actually overtake her real brand, which is the music. Even in revealing herself, she had to make sure she did it in a way where that didn't become so much of a big deal that her face once again became the face of the brand when the face of the brand is weirdly enough her music and that whole aesthetic that she has. If you wonder about a similar case, you can think about an artist like The Weeknd who started off very mysterious at first because he didn't want to do interviews. He said he wasn't even comfortable doing interviews. That was really why he did it, but eventually he broke out of that. You start to see his face a lot more because being mysterious is great. At the beginning it creates a lot of buzz, but when you're too mysterious, when people really don't know who you are, if you have a certain type of brand, it could be against the goal you have because it's highly limiting. For Weeknd, it became highly limiting.  Sometimes the things that people identify you with and brand you by can be so strong that it overcomes everything else and locks you into a box. Her was able to avoid that box by showing herself, not making a big deal about it, and this is the difference between a core brand and a gimmick. As a matter of fact, this video is a launch pad for a bigger video that I'm going to be doing pretty soon that's talking solely about core brands versus gimmicks for the artists who don't understand the difference because this strategic branding is extremely important when you're talking about being able to be free as an artist and make the moves you want and also just having some sense of longevity to keep reinventing yourself without deterring your fan base. And lastly, speaking of strategic branding, once again, I finally dropped the master music branding guy. You will be able to find that in the link in the description below. Full name is Master Music Branding, an experts guide to artist image. If you take your branding seriously, it's something you should definitely check out. I make sure I answer everybody's questions, anything you might be wondering, but it's not just focused on general branding. We're talking about strategic branding, and I made it pretty cheap for you guys. And even bigger than that, I have a super surprise because a lot of people do not understand that there's a difference between branding with your fan base and as an artist branding to companies, corporations, and other brands. There's a lot of artists that don't have huge fan bases, but they still have legitimate partnerships, sponsorships that are helping them go on tour, giving them good money or having them in positions as brand ambassadors. This extra that I made, which is called professional music branding for dummies, is focused on creating a professional template for you, the artists that you could then market yourself with to the company when you reach out to them or come across somebody and get that money. You can check that out as well. A separate link will be in the description for that. But other than that, I would love to know what you guys think about hers brand, that move, and you notice that move, but what you can take away from it yourself. Other than that, stay tuned for the core brand versus gimmick video that's coming soon. And last but not least, if you like this video, go ahead and hit that like button. If you like your minds, we'll share it. And if you're not subscribed, you know what to do. Hit that subscribe button.