Hello everyone, my name is John Hammond. Welcome back to their YouTube video and in this video I want to be showcasing the res room from try hack me. It's all about Redis or Redis I don't know how to pronounce that. I don't know how to pronounce anything It says hack into a vulnerable database server with an in-memory data structure in the semi guided challenge This is rated an easy room and I suppose it has some I guess I don't know fundamental stuff to it Especially for the privsk, but I think it is very cool and fun to showcase Redis as something that you could abuse and take advantage of so I've deployed the machine already I have this IP address and I'll copy it if you haven't already deployed the machine You can hit that green button deploy here and then we can start to take a look at the box So I have already filled out all these questions and answers here I will showcase how we get into each of those, but let's dive in so I've got a terminal open here I will ping that box so I can confirm that I can reach it and I can let's make a directory YouTube res to work in You could start some notes. You could make little sublime text I don't know or whatever text editor of choice. You've got to work with and Make a little read me for yourself, but I'm gonna start with an nmap scan I'm gonna use nmap tack SC tack SV tack on nmap initial with this IP address So safe scripts or default scripts and then enumerate versions output to the nmap format in that nmap directory that I just created And I'll save the file as initial and I'm copying and pasting that IP address in there So I could turn on verbose mode hit the V button Realistically, I probably should have included that tack V argument So it's already verbose by default, but we'll see how long this takes and I guess we can start poking around on the box manually while we're waiting so I will access it on a Web browser over here. I'll just see if I can reach it. It looks like there is an HTTP port open or HTTP listening on port 80, right? Okay, we're rolling through and we found port 80 Great, but that has not found anything else seemingly we've only found that port So just to be sure because our default nmap scan will look for only the first common a thousand ports We should also run a tack p-tack and that will include all ports We'll just call that that We probably don't need to do those other enumeration scripts, but I guess maybe that's good to do this again I probably should have included that Tack V flag, but regardless looks like we're scanning with nmap just fine So we know we have port 80 we could start to like do some enumeration on that We could need to it. We could go buster. We could der buster. We could start to try and look at more That might be on that page. I don't have a Nikto have a typo there. Sorry now. Let's see if that will run and I should tee that out to log it So let me tee Nikto dot log There we go just some basic fundamentals see if that finds anything interesting and while we're doing that We could run go buster as well. I do have go buster good. So go buster Der tack you for the URL tack w for the word list Do I actually have a word list in here? I don't think so. What is it in Kali user? share word lists Word lists there is one there. Okay, and let's get Derbusters word list and They have a directory list 2.3 medium, I suppose we can fire that up and see if that gets anything Still waiting for this nmap scan to return it'll probably take a little bit I could be showcasing rust scan and that would likely find it super duper fast Admittedly, I am working within Kali on WSL right now So running rust scan using that docker container with the kind of Windows docker for desktop thing Pacing in the IP address and using it with rust scan. It tends to just kind of die I'm not exactly sure why I'm sure I could be passing other arguments So maybe that'll kind of work better with it if I increase the batch size, but it just doesn't happen So, I don't know. Maybe one of you has a solution better than I do but Doesn't look like there's anything that Nikdos finding doesn't look like there's anything that go buster is finding and Nmap is taking its sweet time. Rust scan just gave up which is fantastic to see. All right We could do some research on Redis while we're waiting If my internet comes to hang out, okay, great Redis Redis is an open-source or BSD license in memory data structure store used at a database cache and message broker Okay, so I actually end up using Redis when I'm setting up CTFD instances when I'm hosting capital flag events We create a Redis server and make sure that okay all of the user sessions are able to be Actually stored and maintained and accessed so Redis is the server that we end up creating for that Typically, we'll end up having an authorization set up or we'll create a password for that Redis server to work on and that might not be the case when we're looking at it in a I don't know hacking lab or hacking environment So if we wanted to go find out the port that it's listening on it says by default The Redis server is configured to run on the default port of six three seven nine You can connect the server locally using remote or remotely using the Redis CLI command line tool And then you'll need to specify a password. Okay. It looks like there are some documentations that showcase that so we could explore that If we'd like to let me shut down Nikdo and Durbuster and then start to kind of tinker I will try and use that Redis CLI command and I need to supply what I actually want to connect to if you don't have Redis CLI installed you might need to go ahead and actually pseudo apt install Redis hyphen tools is the package name that includes that and maybe your shell actually suggested that to you I'm not exactly positive, but it'll just go ahead and type in your password install it and then you are good to go So let me read a CLI and then you'll specify tack H for the host that you want to connect to and I'll grab that IP address One more time so I can connect to it There we go Submit there and now seemingly we are Connected we are on that host and I don't know if we actually have needed to authenticate or not Something that you could do to test is just try and run like ping and if it responds with Pong then okay You are in fact connected to the server totally just fine And we could look up some Redis enumeration techniques or like hacking Redis or exporting Redis and see what we've got here Hactrix puts out a great Resource on this sort of thing. So let me zoom in on that so you can see it basic information We've got the exact same kind of blurb that we saw Online when we were simply googling and we've got that default port We could do automatic enumeration with some n-map scripts So that would probably be good to do especially since we can confirm and now that we know that we actually have a redis server here Our own n-map scan is probably taking a serious amount of time because it's doing all ports You could use a banner grab So you could simply netcat to it to try and get any inch actual information Or we could just connect as we've done with reacli and the installation is just as I discussed First command you could try to use is info it may return output with Information of the redis instance or something like the following is returned So if you see this no-auth authentication required That means that you will need credentials to be able to access the redis server in the instance here Let's try and just go ahead and run that info command and see what we get and we certainly do not have the Wine and complain that we need authorization or authentication. So there's some valuable and juicy info We have the redis server version 6.0.7 So we could copy and paste that and that I know is one of the answers that we need here Scan the machine how many ports are open we saw 80 and we also know that redis is open on 6379 So 2 is the proper answer there Redis is the database management system that's installed as we have discovered What port is a database management system running on 6379 again as we've discovered What's the version of the management system installed on the server? 6.0.7 and that is what we just determined running that Info command so that's all that we really needed to run there to track down that information and Then we need to just compromise the machine. Okay, so let's kind of keep exploring and reading through this pen testing redis documentation There are notes here or at least this these hack tricks right not particularly documentation by default Redis can be accessed without credentials. However, it can be configured to support only a password or username and password We could specify this and read a stock configuration file And maybe at some point we could kind of configure and tinker with that play with it But in this case, we don't have to we will not need to auth or authenticate if you have valid credentials You'll get this positive. Okay response After you've logged in or once you have access you could do more enumeration and just kind of look for stuff You can start enumerating the service of the following commands info which we've already ran Client list which we could explore redis response with connected clients. So let's do client list and Looks like that's my IP address Locally and that's the only thing that's currently connected to it and we could get everything out of the configurations database or config So let's do config get literally everything and now there is a lot of stuff So this returns and outputs and kind of an interesting and peculiar way Well, there will be a variable name on one line and then the value following it So rdb checks on this set to yes Damon eyes is set to no Etc. It's not going to give you like a variable equals value syntax or like a colon to denote it really Readably, you'll just have to kind of take that information with one line following to get the actual value A lot of information here Maybe something that could be particularly interesting for us, especially some stuff that we will get into Next we can discuss but this article again explains more readers commands that we could work with and We also discuss dumping the database inside read us the databases our number is excuse me Our numbers starting from zero. You can find if anyone is using the output of the command info inside the key space chunk Okay, that's particularly interesting, but I'm more concerned with getting remote code execution to compromise the machine Okay, looks like we could potentially get a web shell But you'd have to know the path of the website folder. Well, we do have this Apache Ubuntu default And I wonder if that will tell us By default Ubuntu does not allow access to the web browser to any file a part of those located in var Dub-dub-dub public HTML entries. Okay, the default Ubuntu document root is var dub-dub-dub HTML that's kind of common. That's pretty much what we would expect, but we could see that typically with this Ubuntu default page That's pretty handy. So what we could do is we could connect to Our victim read a server we could set the directory by Modifying config and then setting a file name for it to be stored as if we give it a dot PHP extension Then we could just okay Just set a value seemingly and then go ahead and save and it might dump that file so We could try that let's go ahead and Do some config set dur var dub-dub-dub HTML, right Okay, so that responded positively and then we could config set db file name Test dot PHP maybe right and now let's just set a variable name So test and it doesn't matter because it'll be included in the this dump when we save Everything it's kind of in Redis's memory, right? We could set this to I don't know why my voice went weird there Let's check out PHP info and see if we can actually get PHP code execution for one thing now We've set that variable and we can save it good So let's hop back over to the web page here and try and access test dot PHP Okay, now we have PHP info and we have proof that we can execute PHP Which means that we have server-side code execution. So let's make this a little bit more fun Let's set our database file name to something like shell dot PHP and let's set test to something like system With a variable that we could pass them like a dollar sign get C or something dollar sign underscore get will let us specify an HTTP variable that we've supplied and See we'll just be the variable name that we want to use so now when I run this and I save that We should be able to have shell dot PHP Run anything that we'd like if we pass it in Okay, so right now. I haven't supplied any command. I haven't supplied a C value But if I do with a little question mark and C equals ID ooh, we have Data and a UID and GID output. So it looks like we are running commands, right? we could run like who am I and dir and list or LS and other things so we have code execution now we just kind of want to get a reverse shell back to us so What could we do here? We could use a typical like pentest monkey reverse shell cheat sheet and use like a net cat connection to get back to us Something that we also could do is actually open up a bind shell Depending on what version of net cat we have and actually let's make let's verify. We actually have net cat with a witch and see Okay, we do have a slash bin slash NC seemingly so Could I try and run like NC tack V for the version? Is that a thing tack tack version? No seemingly, okay Let's try to see if it has that old Tacky argument or that tacky flag and parameter where we can specify a command to run as you connect back to it So tacky bin bash and then let's listen so LN VP L for listen And for don't resolve domain names and DNS stuff V for verbose and P for report Let's put it on like quad 8 or whatever now because I see the URL in the webpage still spinning I kind of have the thought that it's actively running that so I could go ahead and connect to it or at least try to right? so let me Move out of this terminal And let's net cat to that IP address. That's 10 10 31 148 I think and it's quad 8 right so I'm seemingly connected and I have command execution right so I can Run things and navigate around the file system. Awesome. Okay. Good win. Good. We got it That's one way of doing it or you could of course do a simple bash shell Interesting thing. Let me let me have that reverse shell the bash reverse shell I'll set up a listener on my attacker machine on quad 9 and let me try to use That bash reverse shell so I finally remembered this I finally memorized it and I want you to try and remember it too bash tack I for interactive redirected to an ampersand, right and then Dev TCP your IP address, so I'm 10 2 to 1 32 and then slash in the port So quad 9 is what I'm listening on and then we had go start from zero, right? And you redirect it to ampersand one zero and one that's kind of how I've started to remember it So now you don't have to look up. Hey, what's that bash syntax for a reverse shell all the time when you run this? You may or may not actually get a shell back The gimmick here is that if it's running in sh or just that regular default flat shell It's not gonna work. It's gonna get some bad file to scripture So that doesn't execute what you could do is you could pass it to another bash command So if in this URL, I included a bash taxi and then included like some quotes to denote this here Now I've got bash running and that might not have ran for me Let me use single quotes here. See if that will behave or I might just have my syntax wrong. Maybe I maybe I lied the entire time let's get the high on coffee reverse shell cheat seat and Verify I could have could very well be wrong. Well, I'm trying to tell you Oh, this is how you remember this thing and I just misremember myself Bash tack I redirected to an ampersand dev TCP attacking IP address zero redirected to and one. So that's totally right Maybe we need slash bin bash Or I need a space following these for some reason and a bash can be super duper finicky Let me verify that my IP address is what I think it is so I will IP AS ton zero and I am ten two two one thirty two listening on quad nine So let's see if that works still nothing. Maybe it's my WSL thing being annoying. I Shouldn't waste my time troubleshooting this when we already have given ourselves code execution previously Doesn't need to be an issue. Maybe if anything you memorize the fact that okay bin bash tack I with that is The way that you you get that what am I missing here? This is blowing my mind. That's the right syntax 10 to 2 132 quad 9 nothing nothing Okay, whatever. Well, we'll edit that apart out. We'll get it in post We'll do that net cat tack e methodology for bin bash and then let's listen on quad 8 and Now that that is running We know we could connect back to it and get code execution Fun thing here is that we could very well connect with phone cat So let me start that one more time and I'm going to hop on over to a different shell in get Move into phone cat and I will get pull To get the current release so because Caleb's doing some crazy work on this right now when we could showcase some of that Let's invoke our virtual environment and then run phone cat and connect to that 1010 13148 is that right 31? I was so close There we go on Quad 8 so now we should be connecting to it great Not in the database, so it'll go ahead and connect to it and that works just fine for us So phone cat will be able to kind of showcase a lot of our enumeration stuff in a very quick and easy way It might take some time So we might fire up another session while we're working here But I'm gonna switch to my local prompt I'm gonna use the new syntax to try and run enumerate And if I tab complete on enumerate you could enumerate gather and just start to look for stuff So phone cat will do its thing. He's essentially running his own version of lin peas But let's go open into another terminal and try and connect back to it I should have started like a reversal while I was doing that, but let's Listen on quad 9 and then just do a regular connection here There we go Or I could very well just do that with another phone cat instance and see if he survives We can clear those old terminals that we don't need anymore It's that phone cat do his thing He might take a little bit because try hack me seems to be slow when I use this on a hack the box It's it's much much faster try hack me. I think it's a little bit. I don't know Interesting thing though because I'm comparing and discussing hack the box in relation to try hack me right now You might have seen this gimmick with a redis technique here on the postman machine and you could use it to okay clobber one of the users Private keys like their SSH private keys So you could SSH in the box and that would give you initial access and that was great And I thought like oh res is gonna be just like that. I could clobber an SSH key But we don't have SSH open on this machine. So that kind of gets in the way Whatever interesting We've got now this web shell kind of a cool new different technique we could use So let's do some manual enumeration. We know we are currently running as dub dub dub data So let's go ahead and cat out. It's that repass word. Ooh, but phone cat has finished. So let's see what he's got for me blah blah blah scrolling through Looks like we have Results here. So we have a mount point. We have some network information. We are running Ubuntu 16.04 ASLR is enabled potentially found some passwords. Although these are just dollar sign twos So that doesn't make a whole lot of sense processes that are running a kernel version and Set you ID binaries. Ooh xxd is owned by root That's peculiar xxd is like a blaring and and blatant GTFO bin. Oh, is it also vulnerable to dirty cow? That'd be fun. We should try and use dirty cow Be a little fun extracurricular at the endless video. Let's try to showcase that GTFO bin gimmick So GTFO bins if you're searching for these xxd is a quick and easy win In this case we actually because it's owned by root. We could probably just get that, you know Let's search for xxd and he can file write and file read so we could just clobber it set repass word and Get another user. So phone cat knows how to do this actually if you try and run Escalate auto it'll just tell you what it could potentially do because it knows Hey, we can read and write with xxd as root We could just go ahead and execute that and then it will try to clobber it set repass word We've been finagling this because I brought it up and it's like it seems to think that it failed when it actually Succeeded and let me see if it shows you here. I'm kind of hoping we could Didn't mean to zoom in on that while it was going But it'll give me like hey error module failed no escalation path found But if I check out it set repass word which we've clobbered. Oh, let's get to a remote prompt We have successfully added a phone cat user with a backdoor password that has user ID 0 and can just be root so I will su to phone cat and Use the phone cat password with the backdoor and now we're root. That's it. Okay done For some reason phone cat doesn't think that it succeeded and we're can still kind of troubleshooting that but literally running it again It'll be like oh, I found your persistence because I already created it and then it'll just give you root so That's neat Moving into root which you can do then you are cat the flag Root text and you win. Okay. That's all you needed to do if you had not done that if you had been able to go into the other user here, which I think was Vianca. Yeah Vianca actually has Permissions to just run pseudo everything. So let me su into Vianca because I can and let's try and pseudo attack L You could don't need her password. Do you need her password? Regardless Let me let me let me not care about that because we've just jumped over user and got into root We could get into her home directory and then cat that flag Cat user dot text. Yep, and you would submit that just fine We could answer those last questions. Oh, what is the local user account? Oh, I follow Yeah, I'm sorry because you had xxd as your privest you could use xxd to read it set reshadow And then you could grab the uncle's hash and then crack it That's kind of nice and easy and we could do that, right? Let's let's try and use some of those gtfo beans manually just so you see actually what's happening File read with xxd if I were Just dub dub dub data again We could xxd Etc reshadow and just simply read it out and then we have Vianca's password So we could crack that with John the Ripper so Let's move over to our same directory where we were we were in YouTube res Let's sub all Shadow dot text or something and just slap it in there and then we should be able to run John. Yep I think of that and then word list Where is Do we even need to specify words? Well John just figured out while John is cranking. Let's Try to see. Oh, yeah, he just grabs his his own User share John is there one for rock you? Oh, yeah, it just Just rips it out. I'm not used to being on Cali. I'll admit man user share Rock you. Yeah, okay. It's there So then you could SU into Vianca Beautiful one and then you could pseudo attack L You Spell that right One I think I still spelled it wrong. Nope. Okay. She can just literally run everything He or she Vianca male or female. I don't know you can pseudo everything. So there's route immediately gimmicks and fun things here though before we start to dive in a turdy cow because you guys like when I Move into stuff that I haven't seen before. There's an interesting gimmick with this file, right an xxd Let's say you are trying to write into Anything how about that? That'll be the name of the file that we want to write to and xxd writes from only the beginning and that's it So let me show you this Let me paste this in and it's going to ruin this prompt. So let me sink and reset Cool If I paste this it still ruins that prompt whatever How about that? Nope Let's get a regular show. Let's do this from home. Who cares Let's uh set L file to anything and then let's try and write echo like 9 9s like 1 2 3 4 5 1 2 3 Into L file. So now I have this anything file But if I were to echo 5 5's 1 2 3 4 5 Cat anything I've added 5 5's and then there's my new line and then there's there's remaining 9's This would probably be a better example with Tech and so we don't have a new line You'll notice that it's not clobbering the original data That's just how it's going to end up doing it Let me all around anything so we can clear it out and get a better visual add in fours and now let's add in just twos and It just starts in the beginning and writes everything that you specify That's good to note is that you if you don't fill up the whole rest of that file buffer Yeah, it'll still linger in there, especially when you use xxd At least with that gtfo bin technique. So good to know. All right We've got root we've showcased some xxd stuff and do we have gcc? We do. All right, let's try in dirty cow. Let's try it dirty cow dot see here's one and That is the One that's I think just tampering a file. I want it. I want fire fart dirty cow Fire for I think it's the Yeah, it's dirty dot see this one here It'll add a whole user for us and it explains how you can compile it nice and easily Let's see if we could write this here Let's just go ahead and Where am I currently In punk hat. Oh, I'm in punk hat. That's annoying. So Let's move into there get Punk hat and Let's just subble a dirty dot see Slap all that in and now let's go ahead and upload that so let's upload dirty dot see There we go and now on my temp directory I have dirty dot see If I cat that out on the victim, we have our dirty cow source code So let's gcc and the syntax they use here is p thread And L crypts are the libraries that we're also going to include so slap that in see if it will compile It should output to dirty. That's completed. Now I have dirty, which is a file on binary I could run So let's make sure that's executable. I think the compiler will already do that Let's try it and see if we don't break this box It's at our password successfully backed up to temp password back under the new password I'll type in anything and let's give it a little bit of time and to see if it actually does complete the dirty cow exploit I know this is a little bit dangerous. It might shake the box up But I want to showcase it. I want to tinker with I want to see if it'll be anything fun I guess I'll pause the recording now and just let this do its thing But I hope you guys have learned some other good nuggets while we've been rolling through it. Thanks. I'll see you soon Okay, I stepped out for a quick little bio break, but it looked like it finished Done check it said we're password to see if the new user was created You could log in with the username fire fart and the password anything which is the one that I typed in there I did not mean to copy that and try to type it.  No It's not it's that we're shadow. Is it? Should I dada should shadow No, oh, I need to be root. Well, yeah, okay fine I'm pretty sure dirty cow Is probably not even applicable to 1604 Let's check 30 count ninja You can check out that page and see what he's got here. Oh, no, I don't want these proof of concepts. I want to see the Check if your system is vulnerable You could see the patch kernel versions. Yeah 1604 LTS and that is the kernel version that we saw 404, right? Let's do a you name take a Yeah, I believe okay, maybe 4.40 and then 180 9 so I'm thinking that's past But that was fun. That was a little good little exercise.  It's not even vulnerable, but hey, you got to see the compile process and maybe that was a Good little exercise. Okay. That's enough of me talking. This has been a long video But hey, thank you guys so much for watching. I hope you enjoyed I hope you're able to follow along and see all of the little gimmicks and techniques and tricks there But that's how I got those flags here and completed the res room So thanks for hanging out everybody. I hope you enjoy and I'll see you in the next video. I love you


All right. Good evening. We'll call to order this meeting of the committee the whole this holiday Gathering please call a roll Born here bow here Dacker Geshe Hand is here. How do you mean? Kettleson my illness Myer Montemure rent flights Ryan Sir here Vander wheel for Hassan Longham and I did hear from all the person claim is that so she's excused the others I had not heard from oh And I've heard from Oliver Meyer and all the right place told me he might be a little late So I I corrected that statement we have 12 present We have a quorum. Okay a quorum is present. We'll continue with the pledge allegiance. I Pledge allegiance to the flag of the United States of America and to the Republic for which it stands One nation under God Indivisible with liberty and justice for all Moving to item for a entertainer approval of the minutes from the community whole meeting of October 27 2008 Under discussion any changes to those minutes Hearing none all in favor I opposed Approval passes item 5 the housekeeping filing of four documents That had been passed to us previously Entertain a motion to file Motion and file under discussion I heard a beat No lights people subtracted Thank You mr. Chairman under document under B document number R080809 council documents 636 a spreadsheet entitled effect on budget on Property tax based on assess value The city of Cessar was kind enough to prepare this for me earlier in the year At one time we were projecting Possibly up to a structure a structural deficit in the budget of up to 1.7 million dollars and I had Mr.. Lutsky prepared this spreadsheet on the effects of various potential deficits and on the on the Effect that would have on property taxes based on values of certain homes as it turned out The spreadsheet was kind of a moot point because we ended up balancing the budget as we go forward But I do intend as we go forward into 2009 having mr. Lutsky prepare another spreadsheet as we go forward with the tune to own 2009 budget in case if Hopefully there will be no budget deficit for 2010, but but if it is this spreadsheet would be very handy in Learning our constituents as to what a potential increase in property taxes would be and on the other hand The numbers also work in reverse If we have a corresponding Reduction in the levy this chart works that way also so I am going to have this prepared for next year But right now it's kind of a moot point so I support filing it Thank You mr. Vice president and also I think the time didn't we talk about asking the IT department to put a calculator on the website So people could be a clue to that too. Okay, great. Thank you any more discussion hearing none Under the motion to file those four documents all in favor aye opposed Passes unanimously Moving on to item 6 discussion of possible action in resolution 158 dash 08 dash 0 9 council documents 1640 a resolution creating a temporary government structure committee to collect data Study and make recommendations to the common council as to the economic and administrative feasibility of having a city manager or city Administrator versus a full-time mayor and a corporate council versus a city attorney I'm person one. Thank you. I would like to make an amendment to the document as as follows Be it further resolved upon upon the very top be it further resolved To have the government structure committee Present its report and recommendations to the common council on March 16th of 0 9 and have the committee of the whole meet to consider the report and recommendations of the committee on March 23rd 0 9 or March 30th 0 9 and make a recommendation to the to the common council for possible action on April 6th 2009 and Then under the starting with this with the second be it further resolved That this committee shall be compromised of seven members to be appointed by this resolution and confirmed by the common council The membership shall consist of the following Alderperson Joseph Heidemann Alderperson Eric Rindfleisch Alderperson Jody Jody Vanderweel a Member of the board of the Sheboygan area area Chamber of Commerce a City resident appointed by the president of the Chamber a member of the Sheboygan area school district a city resident Appointed by the school board president the county board chairman or his designee a city resident and Mr. Jerry Jones a City resident and local banker Motion and second under discussion Alderman Gisha Do we have to stand up? No, I have to stand up. I just just me I just as a Full disclosure Jerry Jones works for the company. I work for I don't work for Jerry Jerry doesn't work for me We're completely different areas. He serves on has served on past committees within the city and currently serves on Industrial Development Commission Currently and has been a life not a lifelong, but a very long-time city resident. Okay. Thank you I want to thank mr. Hartman for being here as well tonight His his letter was recently published in the in the Sheboygan press about how the Sheboygan County taxpayers Alliance feels about this issue This is this is an issue that you know, I've heard from several members It deserves to be looked into we did we need more information. So that's what this that's what this Committee this government government structure committee will be doing looking into two things and I just have a question. Thanks for being here tonight Attorney McLean in order if we were to want to vote on it April 6 Would it have to lie over would we have to introduce it to the council earlier than the schedule that? Alderman Bourne proposes January No, I'm sorry We would want to vote on it April 6th as a council the last meeting of this council Would it need to lie over if we if we as the committee the whole made a recommendation to ourselves Would that recommendation have to get into the packet and lie over for a time or could it be voted on as soon as it appeared in the packet? I'm sorry, whatever the recommendation of that body is if if the Common Council wanted to vote on it the night of Monday April 6th Would it have to be in the council's packet? Would it have to lie over for two weeks? Okay, okay, I know we try not to suspend the rules, but so what would it need to need to lie over Adopting the Correct approving that approving the recommendations and changing from the committee of the whole Right that the government structure committee would make its recommendation to the committee the whole the committee the whole would vote in some Way either to recommend it or not recommend it it would get to the Common Council and the Common Council would want to vote Either to enact those recommendations or not For us to vote as a council for us to vote on that Monday April 6th. Would it have to be in the packet? four weeks prior or two weeks prior Then it's got to get done even earlier no doesn't have to we just to have the discussion at the Common Council That's true. Oh, I'm born. Thank you My my amendment was to have the report and recommendations of the study committee to the council on March 16th At that council meeting No first now it goes to the count I would have the I would have the report and recommendations go to the Common Council on this on the 16th And then the committee of the whole would consider the report and recommendations on March 23rd or March 30th at the pleasure of the chair and Then make a recommendation to the Common Council for possible action on April 6th Now as it just so happens April there would be one more there would be one more council meeting after April 6th of This council depending on how the elections fall so we'll send that out So four six is not the actual last meeting of this council There would be one more but we could suspend the rules on the six and vote on it if we wanted to Okay, so we can I was just trying to think as far is that is that correct attorney McLean just works, okay It and just to be clear is your amendment to send it to the Common Council and then the committee the whole or right? He would just go to the Common Council the Common Council would make the recommendation right to go to the whole okay, yeah, I'm My my amendment was that it goes to the Common Council on March 16th Okay, and then to the committee. I'm assuming to then to the committee the whole either up for the 20 30 Okay, yeah, I think you got to just drop it at going to the Common Council But then the Common Council has to decide that to forward it is that what you're saying. Yeah, so So I would amend so I would amend my amendment then that it would go to the Common Council on three sixteen or nine And then we as a council could decide to either talk about it that night Or refer it to the committee the whole Correct, it's your second your a friendly amendment. Yes Okay Okay But we would mr. Chairman, but we would want we would want the Common Council on March 16th Well, we can either we can either discuss it that night or send it to the committee of the whole But we want to take final action yet in this council year Correct. That's the goal. Okay All right, Gisha only because I've screwed this up myself Just structurally Whatever recommendation would come out of this committee would need to then be structured in an ordinance change I think so in asking city city attorney McLean if the report can come out We won't act on a report in the council somebody's gonna have to sit down at an IBM select Rick And actually if they choose to make a resolution or ordinance change And I think that's really the question doesn't ordinance change have to lie over And that would be done either Theoretically by or not by one of the three alderman involved or anybody on the council attach Who would then decide to actually do the ordinance or resolution? And I think yeah, the report a committee doesn't have to lie over but if it's gonna be in an ordinance form It's a different question. I've screwed that up before that's why Okay, and that's what I was trying to make sure that we don't end up wanting to vote on an April 6th And legally not being able to Please As far as ordinance changes, you know if you get to that point It very well could require charter ordinance changes And there's special requirements for charter ordinances. That's not something you really want to rush through a charter ordinance change For instance if you went to a city manager form of government that requires a charter ordinance on The city attorney I Guess now's probably a good time to bring this Semantic issue, but you have a corporate council versus city attorney Technically, you would still have a city attorney I think what you're looking at is whether you want an elected city attorney or an appointed city attorney And if appointed you want an in-house appointed full-time person or do you want? A contracted outside legal council, that's really what you should be Direct in the study committee to look at see your recommendation for the wording on that is instead of and a corporate council versus a city attorney Would be and a hired a contractual Yeah, an appointed or a contracted outside council To serve a city attorney versus of an elected city attorney, right? And again that also require a charter ordinance change Okay, so and and what are the requirements for that charter ordinance change? How much in advance and and is that because it's such a big change you want to be deliberative charter ordinance change frankly and once it's adopted it doesn't go into effect for 60 days and that You have to publish that and Citizenry has a right to petition for a referendum on a charter ordinance change and it requires two-thirds vote on charter ordinances the council I assume the the timing you're looking at Doing whatever you're going to do with this council year. That's that's I think that's what the hope was Now the question becomes given given what attorney McLean just said Can we get all that done? You know that would have to be done. I would think by the end of February In terms of the 60 days, you're not gonna meet that We vote on the ordinance and the ordinances then the 60 days that's ticking and a charter ordinance doesn't have to lie over any longer It's just there's no no, okay Please all the room born. Thank you, mr. Chairman What is the charge of this? Yeah, I guess I have a question is the charge of the committee going to be Whether we whether we make a change in the in both of the issues either city manager or city administrator Or corporate council versus city attorney Is that going to be the charge of that committee and make that decision whether to do that and if if the council passes that Then later would there be an implementation committee? Formed to actually do the nuts and bolts of what the salaries are going to be and that type of thing or what's You know how in depth is the initial committee going to be? and later would there be a Committee to implement Thank you, I understand I joined a little bit late, so I missed some of the initial discussions So we signed you up. I saw that. Thank you my punishment. I I I have some concerns. I guess with the time factor Without perhaps looking political either position to mayor position of city attorney But also for the position of people sitting in these seats right now if we're trying to rush before the next election Maybe the appearance that Citizens are to be made And I think something of this this death may need some more time as we've seen in you know the 60 days Possible referendum, you know option on that one as well I think also we have a lengthy list of people that have taken papers out for the position of mayor With understanding that it's a four-year term And and I think that we have to look seriously at do we do it mid-term of somebody that that looks political You know regardless of whoever is sitting in the mayor's seats starting next spring I'd be careful to avoid that as well. I and not to necessarily rush it and Make mistakes that have to be corrected down the way as well And then the final point I think would be if we get too specific on the goals of the committee Once again, I think we've already made up our mind then giving direction to you know This is exactly what you're gonna look at I think if we do a little more general language in there saying to look at the position of Mayor look at the position of city attorney Are there other options that make more sense for city government as well as perhaps looking at the whole city government as Well, which is a bigger picture than I think maybe most people are looking at doing but we're going to do it Maybe it's the whole structure could be looking at and as a vice president born had said This he makes sense if the committee is going to investigate the committee probably also had will investigate There how to implement it if we give that committee time to do both if there's a recommendation And these would be the implementations if this is approved then the council simply has to vote yes or no On that picture, so I understand that any time constraint I would like to get it done as fast as possible But at the same time I think you know if we give a more broad spectrum to the committee to look at all the options and The procedures of implementation. What would that mean to the city? How it would look going from one phase to another phase and the timeline for that I think would give the council whoever is sitting in these seats a better option to vote You know yes or no or go through the procedure of a referendum For the committee for the city as well They can see the full picture of what they're voting yes or no on if it goes to that point time. Thank you Thank you all the person Gisha. I thank you I I tend to agree with the older person right flesh Except to the point that I think this committee has the ability to do all that if they decide They can they can decide on setting an implementation and giving guidance on implementation or look at whatever they want Regarding structure. I don't think it's that particularly Specific first of all because there aren't that many options if you're going to change it I think the committee has full power unless I'm reading this wrong to look at look at this any way they want Okay Thank you all my gosh I guess One of the things I was thinking about with the timeline is is that it keeps it clean Because Alderman Heidemann and all the men run flesh are up for election right now And so if they were they might not be on the committee If it extended past April, but if I'm sure there's a way to replace them if they if they weren't so As an individual my only interest and I might not be there to you and I we can be working at Starbucks, sir But I guess what I was thinking is is that we get it done it that way it doesn't linger The committee meets and meets Not to slow things down it doesn't drag out and the membership stays the same But I guess that's maybe not as important as I was thinking it was All the member hassle, please. Thank you, your honor. I'm your mr. Chair I do like the sense of urgency that you know the March 16th date puts out there I mean, I guess one thing to keep in mind if anybody's concerned about the time frame is that It's coming to this council this council could decide a The information is too incomplete. We want you to go back, you know So this isn't driving the decision a yes or no decision on any given date It's just saying come back to us with the best you can by March 16th. So Thank you Thank you, Mr. Chairman And just to offer the flip side argument to what I had just said would be the same time that if the committee Does not feel it can do that the duty as discharged it can come back to me and say it's unable to do it by this point In time, but at least that there is a date then it says we come back and say this is the information that we've gathered We need more time to gather this information that can make the council can decide what to do at that point in time So there's a flip side to what I just said. So, you know, I can read the ways, please. Okay. Okay. Thank you And attorney McLean There you go far as time constraints, you know the mayor It's gonna be elected and be in for four-year term. So that won't you won't change anything during that four years and The city attorney position is got two more years.  I guess you're talking about coming up with a plan that to implement that would Look forward to those to those two dates So it's it's a sense of urgency to gather information to get smart on it But it's a bit of an artificial sense of urgency because nothing will happen at least for two years and then potentially four years after that Okay. Thank you Yeah, if you'll come up to the mic and please make it I thought you had a question I'm sorry if you can just make your question The question it pertains to this the two positions. I I was wondering I can see that the study committee to study both but they can vote up or down for either one So it doesn't necessarily mean all or nothing. Is that correct? So you're saying that the committee should certainly make two separate recommendations and so that they can absolutely I would think that that It was wondering why it was jump and I also If the committee needs any of these or any of the aldermen, this is that information that a lot of the aldermen had When we had the forums, okay, you can feel free to pass. No, there's some new aldermen And if they'd like some otherwise just pass with that committee wants any of this stuff and names Okay, okay. Thank you and feel free to pass that out All the person kettleson. Oh, thank you, mr. Chairman I guess would the committee also want to be sure to to consult with our city and tourney to make sure that everything is Legally on the up and up and that they are doing the right thing that that you come before the committee And and we know that you know something isn't right. So I think our city attorney should be you know Maybe not if not included in the committee as an ex officio No be given But at least certainly available for consult on the process and legality of the things they hope to achieve Right Only for speaking purpose only for auditory purposes That's good. Is that thank you? Yes, that answers it. Just yeah Any other discussion on the issue of Alderperson Bourne's amendment on date and timeline and the membership of the committee So we're gonna do a vote on that and then the resolution or Including the resolution, I think you should What on the amendment correct? Yeah, and then We'll need a second amendment or do you want to add to your amendment the wording and a Contracted outside council versus an elected city attorney That's earlier in the document. That would be fine. Okay Friendly amendment on that. Okay All the regissons. I can't resist. I hate to throw a monkey wrench into this but I Have to admit that I have been giving some consideration as to adding What this committee thinks maybe of adding a couple of additional local residents more citizenry to this I don't know what everybody thinks about that but Originally, I thought there should be more citizens than I know we have to keep an odd number But if everybody's comfortable with the way it is it was just a consideration Do you have specifics? Well, I I Would like to up for discussion adding two more citizens and that would be one would be former Alderman Eldenburg and Attorney David gas to to this as a It rounds it off to nine. It's a large committee, but it's a It's a pretty experienced committee. It's just a thought it'd like some feedback on And All the member has a lot of wrong in Thank you, Mr. Chair. I had the same feelings and I talked to a few people before that I'll bring in some constituents, but I guess I was looking down the road more so Excuse me the rank and file constituents somebody Maybe not as a former alderman or Or a lawyer bank or so so to say somebody from the rank and file that could just give us that ground-level feedback But I do like the idea. I don't know how you'd go about that though Picking from the thousands of residents here across the city of Sheboygan, but I do like the idea Okay One second President Hannah. Thank you. I think you very well may end up with Dave gas as the representative of the Chamber That's right And Alder person kiddison. Thank you, Mr. Chairman I I too I like the idea of two more citizens on and I that was a good suggestion from alderman Gisha, but if attorney gas would be on with the Chamber, then maybe we wouldn't have to go that way But two more citizens would be a I think a real good idea And I want to ask thank you all the person kiddison ask alderman Gisha It sounded like your initial statement was you think the ratio of alder persons to citizens might be too high if one of those three Chose, you know Demured from service would that make you feel better about the rate? Is it the ratio or is it the size of the committee you're concerned about? There you go. I I think it's just my sense that there's a lot of bureaucrats We're all bureaucrats. I don't mean that negative sense. It's just that I think It's nice to have some people on the outside looking in rather than the inside looking out I think there's some great input from the county and from the school board because they kind of run similar systems and things like that, but You know, it's a big personal highly personal change for the citizens in the city They've been going to the polls and not that it would we wouldn't have a mayor of sorts, but it's a big change and I think I Think somebody from the outside looking in might be Another body or two of that might not be a bad choice that maybe somebody has recommendations here neighbors or something like that Thank you, I have worked with both Eldenburg and David gas both in committees as as former all the point when the elder wasn't all the person I think they're both actually excellent candidates for the position. So if that was a motion I will second that motion to add those two and while we may end up with them from with Dave gas as the Chamber member they can they could look they could look at somebody else but frankly, but I think I've worked with them both I know that they're very level-headed and and while they may be passionate about their ideas They're always open to outside ideas as well. So I was second the motion for those two For a total of nine Right any other Any other comments on that thoughts on the side of it getting up to nine people orchestrating nine people Does that meet the committee's wish for a broader swath of citizenry What that it adds the two people we've discussed but then that so that assumes that that opens up to another chamber member And that all the person want to mail it. Thank you chairman I think I like Alderman Verhassel to suggest and Rank and file citizen because David guest would again be representing the Chamber and Eldenburg We already know where he stands on this before we ever start. So I think Alderman Verhassel's idea of somebody Who would be very interested in what it happens to the city because they're tax-paying residents And I don't I have no names Okay, and Alderman Verhassel Thank You mr. Chair again again equating Alderman Montemire's concern is that I'm looking at these two and they're they're great individuals There's no question about that, but you've got two people who've been politically involved Historically and currently and so on so you bring a similar in my estimation you bring a similar perspective of these existing Committee members here so again if there was a way I mean one suggestion might be to take whoever is appointed the chair of this committee that they go out and appoint two citizens Take it from that level. Okay, and even for that rank and file citizen Okay, okay. Thank you. I just want to say that I think the reason the Committee of the whole is entertaining this and is going to refer it to ourselves as the council is because Any mayor not this mayor but any mayor doesn't want to be involved in the picking of the people who are going to investigate the Structure of the office of the mayor so the mayor Believes we're doing him a favor by trying to pick people. I want to be really clear That we we aren't interested in stacking the deck at least I'm not and I don't think this body is interested in stacking the deck So I appreciate all the person for hassle and meant to mail or bring up the fact that there are some that that May already have preconceived notions the the purpose of this committee is to hopefully put together a committee that has balanced There may be people who come down on one side But hopefully then we'll get some who are undecided and they'll have a vigorous examination of the facts attorney McLean You know the suggestion to have an attorney on there whether it's Dave gas or whoever I think that's That's a good idea as far as the city attorney aspect of it. I think because I think it would be good to have some attorney on there to discuss corporate council versus in-house and and things like that maybe Certainly up to you, but might not be a bad idea from that perspective that You have an attorney on that honor. Okay. Thank you. That's good insight and all them and Ryan I concur with attorney McLean, it would be good to get an attorney on there and Possibly, you know, we have a pretty well-rounded committee right here. I believe and if we are to add two more individuals if they could be by recommendation of the Chairman of this committee and voted on by the committee and therefore it would be impartial I think that would be the way to round out the committee and get the proper people on there They would still have to come back to us Do you want to talk about procedurally would they have to be referred back to us or can we confer the power to a point to a committee I Think under Robert's rules you could Confer the the power to a point to additional members of the committee if that's what you wanted to do As long as the council, you know votes in favor of that, I don't see why you can't do that Thank you Thank you, if that's the case and if you have no objection all withdraw my my amendment if my second will withdraw Withdraw his and which has been done that cleans it up at least and change it the amendment to as has been presented by elder person born with with an additional Two members to be appointed by committee chair and two members to be city residents Yes, as appointed by committee chair As appointed by the committee or by the committee chair Does the committee need to vote on these two people sure I think they should I guess as a committee It's by a majority vote of the committee Steve doesn't Not a legal issue, but just as a practical matter You know the more you if you have the committee doing this That's going to be one or two extra meetings And if you want to get this committee up and go on and a report done you may want to just have the council Appoint all the members otherwise Slows it down time is time pass it by pretty quickly The committee Well, I don't know if I were the chair, I'd probably want to consult with the committee, but you could do that I think you may want to just have the council appoint all the members Thank You turn to McLean how you know we said just a few minutes ago that suddenly the timeline wasn't as important to us because Of the length or is that not what we were saying? We still want that report all our men borns initial Initial amendment is to have them have something concrete or a report for us by mid-march Alderman Verhassel. Thank you, Mr. Chair Just to clarify Jim McLean the chairman could come in in the second meeting with his two selections could he not and and asked for a vote at that meeting and You're respective of that the discussion could start in meeting number one without those two people and they could pick up in the second meeting those two citizens Yes, that's possible. Okay, so I think there wouldn't be a ton lost there again The discussion could start meeting number one and the two citizens whoever those two might be would just have to pick up the pace Read the minutes and so on and catch up That would mean you I'm not sure if your resolution here calls for you designating who the chair is But if it doesn't then you've got to first meet pick a chair and then have that chair pick other members But yeah, you could do that All the person month mayor you're next. Thank you, Mr. Chairman I think as Alderman Rindfleisch said by March 16th We will have some sort of a report and they may or may not feel that it's complete, but they will have a report Thank you, Alderman Montemar, and that's what I that's the feeling I got was once one Steve wants attorney McLean pointed out the fact that none of this matters for another two years Anyway, the learning we want to keep the learning on pace But the the criticality of week by week. Maybe it's not quite as important anymore. Is that Thank you, I'm actually Deco Alderman Montemar I Still would like to have a report by March 16th right for this body to hear while it may not be complete or not complete There will be information presented that we can decide do we continue on with the committee Do we not continue on with the meeting at least then there's a date line that we can see what information have we gathered and Are we on the right path? We're not the right path And then the council can decide what to do out of this council the next sitting council can decide what to do beyond that So I think times of the essence at least for the initial report, but as McLean attorney McLean mentioned that You know we the earliest we could do anything with at least his position is two years and four years for the position of mayor, so Now I think time is not as much of the essence for the full detailed report So I think you know if we wanted to hurry it on I would say this this committee should or the council should actually Appoint which person should be the chairperson? So from day one we know who chairs You don't have to do an election and if anybody has names right now We can you know at least put them down there approve them based on their acceptance of it And go and do that if we wanted to have everything done by March 16th However seeing as we don't need that I would say let the committee do its work And at least it's can be impartial they elect their own chairperson They can the chairperson can appoint to it may take some time freeing, but at least we'll have some report by March 16 or the other a Question for attorney McLean, I guess someone had mentioned regardless of who wins the office of the mayor So we don't have a face in that seat Could this body alter the duties of that person? So that this structure is that even is that even possible because somebody told me it was and I that sounded shady to me I think once The Mayoral position has been elected. I think they're Their term is four years. I I don't think you can really change their duties during the term. You could okay, that's the after the term but You know unless that that person unilaterally agreed to resign or something as Mayor under that has originally defined and agreed to allow some other scenario to take place, but I think Absent something like that You elect a mayor for a four-year term his duties are to act as mayor based on The duties that have been provided to him. Okay. Thank you. That's what I Thought sounded right, but someone was sure it wasn't and wanted clarification on that. Okay, so that certainly removes the time Constraint all the person want the mayor. Thank you. It's me again. No, thank you of these seven people or seven areas three specific people and then Mr. Jerry Jones for specific people and then on no one's I would bet in that group of seven people They're going to know two wonderful citizens that should be added that we have no idea even exist I think so and that they'll convene on that informally before they may maybe even before they meet I think that's a great idea Thank you. Oh citizen Montemay or did you have a question? I wasn't I wasn't selecting appointment, please If elected you will not serve That This kind of happened about Three years ago where I think it was all of them All in Ellenberg charge of board of park and forestry to come up with a Doc study committee Okay I purposely I was happy to be the chair of that that of that board and I I came up with and I came up with the with the committee left myself off the committee on purpose because I'm not a dog owner But I named two citizens at large That had to come back to the council for Verification, okay, the council still had to vote on those two citizens the three board members were okay But those two citizens had to come through the council to get Verified, okay, so we just have to be consistent with this So I just want to make sure attorney McLean I think what I heard attorney McLean say though is if we specifically Designate that committee the power to a point then it doesn't have to come back to us and as long as he's comfortable with that And we're comfortable with that Okay, aren't you still the chair of the dog Did we ever leave you of the dog committee chairman chair is Thank you citizen month me or Okay, so if there's no more discussion, I think what we're about to vote on is a date Timeline on Alderman Boran's amendment, which is that they would report to us by March 16 16th committee the whole meeting Soon thereafter with a recommendation for the council to vote on an April 6. So one thing we're voting on is that timeline The second thing we're voting on is an appointment of the people on the list in front of you, which would be All the person 40 Yeah, yep, and that's Heidemann Ryan flesh vandal wheel A city resident from the chamber a city resident from the school board a city resident from the county board Mr. Jerry Jones a city resident banker and two members City residents as appointed by a majority vote of the committee Clarification you said a ordinary school board member, which is correct, but in your memo here You say a member of the ordinary school district. I think you want to say a board member of the school board Yes, a board member of The shabuigan area school district who is also a city resident, okay? So those are the two things two things Oh, and then the third element is of the original document 1640 to change and a corporate council versus a city attorney to change that phrase to and a Contracted outside council versus an elected city attorney. Those are the three changes. We are voting on Empowering the committee to appoint two citizens at large by the paragraph and two members City residents as appointed by a majority vote of the committee Does that meet your test? Attorney McLean is that sufficient? I? Believe so and it'll be helpful Assumed by the next council meeting. This will be in writing. Yes, this document will come back So those are the three changes is there any more discussion or any more clarification on the things that we will be changing Okay, then with that I'll ask Alderman Hannah to call the roll warren. All right, I'll have seen Decker Yes, yeah Hannah votes aye Hyde Kittleson month more rainflesh Ryan Sir Vander wheeling for hassle 12 eyes one abstain Motion pass as amended that recommendation to ourselves passes. I will I told City clerk sue that I would get her this information tonight so that it can get in time for our next packet because tonight's the cutoff So I'll send her some of this information. I turn him clean Just procedural question. I guess I would see that as Approving the amendments to the document then you you would want to act on another document that or another motion of proving the Thank you So having approved the amendment the three amendments that we just approved now We will open it up for continued discussion on the document as a whole is there any further discussion on the document as amended Okay, then we'll move to a further vote on approving the A recommendation to ourselves as a council as amended Yeah, we need a motion. We had that already to be discussing it didn't we to get to the amendment the original motion was was Born in yourself. Yes Okay, as amended Move to approve as amended Second by all remember hassle, okay any further discussion Okay, voice vote, please born I bow I'll abstain again Decker Gisha Hannah votes I Heidemann Kittleson Montemure Rene Fleiss Ryan Sir, all right, Vander wheeling for hassle 12 eyes one abstain passes very good that recommendation will be forwarded item 7 just a discussion about possible future topics the the city's Outside labor attorneys are prepared to talk to us in closed session about the city labor contracts that will come up in 2009 and then want to have that discussion with us as early as possible so we can begin thinking about how that affects the various committees and What our strategy should be for oh nine That's one possible topic and you see some of the others listed there Is there a preference among this body what our January topic should be Alderman born? Thank You mr. Chairman the City County Shared Services Committee is going to be meeting in early January. I forgot the exact date on on the for further information and recommendation on countywide dispatch so I think somewhere early in 2009 providing the City County Shared Services Committee votes to go at least move further with the combined dispatch That we should probably have the report from the ad hoc committee on what the recommendation is and So mr. Maybe mr. Maples from the chairperson of that committee would want to come in and do a presentation for all the council at the committee of the whole and I think that should be an early and oh nine So perhaps does the committee prefer the labor contracts get that knowledge get smart on that in January And then we'll call the February meeting to be Shared services All right, thank you President Bach Did you say that you had discussions and the attorneys and those folks are have been alerted and they want to engage Us with Susan Hart has told me that they're ready to engage us and they want to come in Yep, I don't I have no idea what they're gonna say But she just said they're ready and anxious to tell us so we can as a body and a bunch of committees can be planned What that means for our early oh nine steps what I just misunderstood. Okay, and I'll remember Hassel. Thank you, mr. Chair just to fly the flag a little bit for 7b We are without a pay plan at the very moment and the reviews generally work from July through July So there is a bit of urgency there as well I mean I obviously those are big issues and we have to tackle that labor contract early and often but Just wanted to point out that we don't have to the end of the year technically speaking Okay, so and we don't have to keep it to one a month You know we do that as as it's comfortable But if things become pressing and I think all remember Hassel brings up a good point We said that when we approved the pay raise for oh nine That we needed to get hot on or get busy on Determining what the next pay plan should be and there's a document waiting for you. So, okay So what I think I hear you saying is Contracts first shared services second pay plan and then I bet during one of those we could probably work in 15 or 20 minutes For all the person client is to talk about before you know while global warming has us in its grips right now We will give her a chance to talk about that. Well Alderman guest should be joining her in that presentation Okay, any any other business Alderman Guesha Regarding the pay plan thing Hopefully by that time because it looks to me like our Our committee or hiring committee civil service commission seems to be kind of hot on the trail of Interviews with human resources director if we do that in March, maybe we can have an opportunity for input from the person Who's actually gonna have to implement it great Any other thoughts? Okay, entertain a motion to adjourn All in favor I Close tonight. Thanks everybody


Hello, and in the morning, I am Nicholas Childs, and I want to give you this talk today about basic 101 bus systems So don't fear the bus We'll run you over So legalese I will let you know don't be evil. I'm not encouraging bad things. It's for educational purposes only You're gonna see a patch coming up on the next screen and the story of the patches 2018 we deployed that was when we bombed Syria as the 28 Bombing me and a bunch of other airmen as part of the offensive avionic systems, which is what we are calm nav wizards We created that patch So this talk is not sanctioned or sponsored But it is approved by the United States Air Force and our are there any pilots in the house? Yep.  All right. You made my life a living hell for the last 20 years I'm taking this exact moment to tell you for you and Follow it with me. Okay Input validation is not a thing It will come up So who am I? I'm Nicholas Childs. I'm security manager OAS V1 systems controller to do for both operator bus driver customs inspector CSL cut train cruci commercial aircraft servicing technician and a retiree and an intern I will put this talk on my github as soon as I get done with it just a PDF version and You can contact me on Twitter or my email I'm perfectly happy to speak with any of you about aircraft avionic systems as long as it's I don't get in trouble for talking about it, you know So also a little bit more information about me. I am currently an intern with full circle communications LLC I have 20 years experience communication navigation systems. I have an aeronautical engineering degree. Yeah, that's right I got my associates. Hey. Yeah, I have a mechanical repair and servicing Experience with 737s old 1011s DC 10s and 747s I'm proficient with multiple airframe avionic systems C 17 C 5 C 141s. Yes. I'm that old KC 135s and B ones.  They're all expired and I have an FCC radio telephone operator license with a radar endorsement That's my wizard degree and yeah, that's it So my original one I put this talk together because things are broken avionics bus systems were designed for use not for security like most legacy systems ICS the addition of new technologies has introduced vulnerabilities. I need your help or We're all gonna die But I did calm down a little bit once I saw some projects come out and people actually Going more into the systems that I've been talking about in the first place. So I have a new Y Avionics bus systems and integrated flight management systems now seem to be things of magic So let's demystify and educate. I promise we can easily learn things that high school educated airmen know Not as painful as you think additionally input validation is Not a thing So I'd say viewers like you because without y'all support. I could not have put this together There's been a lot of things that People have exposed over the last few years and I'm absolutely loving it seeing things that I've been worried about being in the military and seeing them come to fruition Especially publicly because that means they can be repaired So if any of y'all have questions or whatever you can contact me as I said at the beginning of the slide Please do I would love to have a conversation with you Because I might be having questions with you about a lot of this stuff, especially when you go into the weeds with the vulnerabilities So we're going to go over the history of aircraft networking systems Communications along those bus systems a few networks You should know about an attack vectors and upgrades not good with this type of stuff So we'll go over the original things. This is the history of aircraft network systems So you have a distributed analog that's your old school straight wire to wire Distributed digital. They actually had a different communication network along those wires They were able to cut the wires down from being physical to to and then sending signal along it Federated digital. That's what I was used to working in when I first joined the military 1553 and stuff and then the integrated modular which was introduced in the 1990s So the federated digital and integrated modular is still popular today And you'll find that on a lot of systems still in the air So the original distributed analog had dedicated wiring had dedicated power supplies Sensor excitation. So basically whatever the sensor is receiving is sitting directly to the indicator There's no in between. There's no communication. It's just plus or minus voltages. You're good to go You'll see that a lot with the ILS systems. They upgraded this from there, but That's just the way it is dedicated LR using subsystems dedicated displays and controls some standard interfaces, but very few You go on to the distributed digital and as I said this decreased the wires, but it just Didn't change a whole lot because you did not have a network. You just had individual items communication between major units via serial databases You had dedicated wiring digital processing used for control function software programmable off aircraft And you could actually upgrade the software on the LRU's Dedicated LRU subsystems increased use of standard interfaces increased accuracy and performance over the old analog system So with the network interchangeable with the federated digital, this is your network buses. This is where things started It's as hot swappable LRU's you have full power on you can actually swap LRU's around Future proof when I say future proof that just means that you can stack the newer systems on top of it Software programmable on the aircraft instead of removing the the item itself You could actually plug into the network itself and update the item the LRU depending on what it is Increased accuracy and performance performance increase cross talk between devices So there's a lot of cross talk outside of the bus But with this bus it made it a lot simpler for Other systems to pick up on the information one example is your air data computer, which we'll go over And then the integrated modular architecture use of COTS commercial off-the-shelf system and adapted it bus technology Use of standard modules aircraft wide installed cabinet and racks Normal network commercial off-the-shelf stuff pertaining to aircraft system the domains aircraft system domains functionality imparted by portion software operating on common processors Reprogrammable on aircraft. So you'll have a radio set a Navigation computer they'll have the same processor in so that allows a boilerplate when it comes to doing software updates and things like that Which is great for software engineers, but we all know the vulnerabilities that you have with standardization So I wanted to give an example of a federated digital network just so y'all can see it all put together I created three layers on here that should make things a little bit simpler We have a network layer an LRU layer and line replaceable unit layer and an interface layer so on the network layer we have an A and B bus room with remote terminals and the Yeah, the remote terminals are impedance matching they actually help with the network to communicate to the LRU It's kind of like a standardized thing. So It allows you to change those items out because you have a remote terminal that is connected directly to the bus It also helps with voltage spikes and stuff. Otherwise, we call it matching impedance So every one of these networks These legacy networks has a controller. It's a hub every communication on the network comes and goes to the controller It comes from the controller and goes to the controller. So I'll repeat every communication on that work Network comes from and goes to the controller Bus system errors are ignored and dropped and then try it again until they actually make communication There are errors. I mean voltages three voltages happen all the time on aircraft aircraft are incredibly noisy when it comes to voltages Vibration and everything else you can imagine So we'll look at our layer two In here we have our line replaceable units. I've got a BSI you a bus system interface unit Radio set just like your calm one or calm two radio ADC air data computer MFD controller That's your LRU that controls the back end for your MFDs your multifunction displays your t-cast transponder and Yep, that's everything that I have in there. So I did put some cross lines on here Which don't show up on this slide, but they're basically between here and here and here and here so there's a one Way directional from the ADC to the transponder and from the transponder to the t-cast Now what this gives you so you have an air data computer when you have a transponder getting pinged by a tower It needs to know the location of the aircraft They actually have communication going between the ADC and the transponder. It doesn't even talk on the bus There is some on the bus But there's some that are completely hardwired directly into it same thing with t-cast It's kind of an ad hoc system the traffic collision avoidance system It was ad hoc, but it does rely on all information coming from the transponder for the aircraft locational data But I wanted to point that out. Unfortunately, it didn't show up on my slide once I changed it over But uh, there are one directional lines just like you see here to the maintenance computer That's what I have going from here to here and from here to here so also, there's uh situations when we have radar systems that have a blanking line Connecting that isn't part of the bus It's a little line connected between the two system so that whenever you're using one radar system the other one turns off There's a lot of that inside aircraft systems. There's a lot of communication that doesn't exist on the bus simply because of the Priority and another good example. I'll explain when we get to the interface layer layer free So in the interface layer, we have the maintenance computer It's also the maintenance recorder the maintenance output A word about maintenance computer output data validation Is not a thing We don't need another unit just better codes for ids now say I bring this up Because a lot of people have said what if we include an ids and then in intrusion detection system on these Uh network systems on the aircraft, but you don't need it You have a controller that receives all the information already You have a maintenance computer that kicks out all the fault buses It can also monitor all the traffic on there. Most airframes that I've touched they have Different types of records that allow you to record the traffic literally So it's really just a creating a program in which we can see codes that we understand what injection looks like Code injection or an impossible hack you spit it out in the maintenance computer And then uh maintainers will have an indicator. We can actually deal with it at that point in time So the nice thing about this system is because the way it is it's sturdy is how You do not need to install a lot of new systems in it to have some kind of flexibility like that But also on your layer three you have an emergency calm controller There's another one that's hardware devices hard wire devices So if uh, we lose all power except for 28 volts dc Which is scary, but that's what therefore you have a emergency calm controller that's connected directly to a radio set There's not along a bus it's not on anything else There's not even any other wires to it it may go through some bulkheads, but that's about it It's connected that way. So the pilot the co-pilot Can have communication. We all know how important that is But also on this layer three this is where cots would be installed commercial off-the-shelf systems The cool thing about 1553 as I said future proof You can put adapters on the layer two and then you can install cots on layer three I've seen this with other target acquisition systems that just happen to be modern and carried across multiple airframes As well as other radio sets combat track or two things like that They exist as mostly commercial off-the-shelf systems, but they still communicate on the 1553 data bus One thing also you can do with this is the ofp loading operational flight plan This goes back to the software loading for the individual lru's typically you'll have a maintenance computer or a Software loader where you will connect to and you flip a stem switch And it'll actually let you load the software onto these lru's but understand that that information is simply coming across that bus so You know as we said input validation is not a thing so you can imagine what kind of mess you can make with that As you can see I put a box around the flight management system just to help understand a lot of stuff with the data loader You can load a lot of things Into the bsiu your flight plans and stuff like that and I know there's a lot of expansion with the electronic flight bag Unfortunately, I've never touched one but based on what I've worked with I would understand that it would connect with the flight management system I did do a little bit of research, but I didn't want to talk too much about it because I've never had hands on with it So I'm gonna be asking you all a lot of questions about that when it comes around to it And yeah, that's basically the federated digital network stack I want to give an example of the maintenance computer as I said, it's very important kind of live and die by this thing as maintainers Faults can ground an aircraft and we also use a patrol machining system So I wanted to show you on the b1 is the sits the uh central integrated testing system I could actually run ops checks from that panel. It's on the right side of the the photo there Right over here. I can actually run ops checks right there And I can also look at maintenance data for faults and things like that along the bus It helps me tremendously when it comes to troubleshooting systems knowing what to replace what went wrong and things like that um data can also be offloaded from this from a PCMCA card to a cds, which is the deployable diagnostic system Um, and you can run a full test and things like that It's basically those snapshots of the aircraft in flight and I know other frames do the same thing They just have different acronyms for it. So we'll go over the different buses. There are many buses But these ones are mine. Um Also, these are the only ones that fit on the slide deck So we got the mill standard 1553 federated digital aric 429 another example federated digital and the afdx Which is our integrated modular So with the mill standard 1553 coded language, you got manchester 2 encoding binary phase shift bpsk That means there's no no It's just a positive or a negative in order to send And as you can see you have your 1 megahertz clock and then these are the signals that are in there 1 megabyte per second accuracy of 0.01 percent short term and 0.1 percent long term. That's important as I said Data can get dropped and when data gets dropped your bus controller is going to send information to your mate Its computer I've also thought about what could you do if you can mess with packets enough to where you can denial of service in the entire network So, you know, as I said Input validation is not a thing. So what if you could inject something in there to make it drop codes? The only thing you would need to know is the addresses on the network And in some cases you just need to make sure you're not hitting those addresses It's a vulnerability. I've always been a little bit afraid of But each word is a 16-bit plus sync wave and parity And this is what the packet itself looks like. So you have a sync a time sync in the command word A remote terminal address of the lru that's your address the lru sub addresses As I showed you with the cdcdu and stuff here. We'll go back Sub-address because you have a network within a network information is going to the bsiu And then it's also going to have to go to these items. That's where you have your sub network addresses also, if you have really complicated lru some of the modern lru's actually have like a virtual sub network in them to give multiple commands It's just because they're more complicated than the original 1553 database was And uh transmit receive that's typically a off-on bit to say hey transmit or receive That's how important it is for calm. Uh, and then the sub addresses I was saying So uh data word that is the packet itself everything that's going to be in there Uh 32 data words may be transmitted in any one message and once again as we said Input validation is not a thing So now we're going to the bowing standard ari and c4 29 coded language This one does have a null byte and as you can see with the a and b you have the exact opposite On the a and the b bus this adds for that parity to make sure that you have a valid signal going across it You know, it has the same thing with some errors I don't know what the error validation is on this one because I haven't really messed with the system But you have 32 words 32 bits and a word No more than 20 receivers on a single wire and it's unidirectional on a wire and only transmits one way And it goes up to 100 kilobytes per second 12.5 or 50 just depends on how well your setup is Um, yep, and that's the basic of that. Here's the packet. It contains five filled to every word five fields to every word. Sorry Paradol parity Sign status matrix data source destination label. So with the parity, it's for timing SSM as you can see Right here 31 and 30 that is your signal status matrix your data. That's the packet that you're going to have That's the information in the packet your sdi source destination identifiers and label identifying data type so If you understand the network on the system maybe maybe not injection can happen because Input validation is not a thing But this is what one of those networks looks like When you're looking at an a r i m c bus you have your general systems When they do have commercial aircraft or military aircraft, but you still see everything is integrated along a normal data bus So that's the problem. I've always has like what if you can inject some stuff along as long as you can get it on that bus And you know the addresses of things, you know, there could be some issues This is now onto the a f dx a r i m c 6 64. This is our modular system It is the avionics full deep duplex ethernet switching And it is the airbus standard. It has 128 data terminals per controller two megabytes per second Each word is 32 bits and cots integration. So with the other stuff We had to do cots with adapters special l r u's things like that This is in the system itself because it speaks on tcp i p because it speaks on that It's cots integrated, but you also know the dangers of bringing foreign devices and putting them on any network not a big fan of byod anyway and Inside this this is the frame that we're going to speak the afdx frame afdx frame is 8023 compliant Layout is very similar to ethernet framing can be transported via cots as I said It exists on the osi layer two The structure of the ipv4 header remains unchanged Yes, and as I said input validation Is not a thing So yes, this is inside of a tcp ip packet when communicating on the ar and c64 network so We went over the system some basic systems that I understand there's there's more out there, but these are primary These are our main ones So we're going to go over a commercial off the shelf devices how they can be used as an attack vector local data connections External data connections and people Always with the people I do want to change that to pilots because I know you guys What do they want to mess my stuff up but people in general? Yeah, they they're the worst thing we know for security So we look at network hubs of this is the commercial off the shelf system stuff There's network hubs usb hubs literally commercial design For it infrastructure surprisingly enough cots protocols and services as well So there's a lot of stuff in there. So this laptop right here. I wanted to show this to you this house You can see what windows version is on there The username and password is underneath the sticky Which it makes sense because when it comes to maintenance things have to be standardized for quickness You know, I need to be able to hand this to an airman and hand them the book on how to do it And I've seen the same thing with commercial aircraft and then they go through and follow the instructions The problem is Even on the 1553 data bus whenever I was loading The ofp operational flight programs into stuff which is just a software updates It's for security sustainability sometimes adding new features They use standardized Cots That's not cost the cost services. I guess is the best way to put it. I've used ftp sftp http telnet and ssh to move files around along that network None of those are vulnerable at all are they? Come on say it with me again Input validation is not a thing So I wanted to give you a good picture what this looks like this is the usb I mean it says right there plug it into the laptop and we're able to connect directly to the network And you run a few softwares in order to load things so Um, it's pretty straightforward. This is whenever you have the standard processors and you're loading software on them Along the network. I just wanted to show you what the hardware looked like so you can get an idea uh, they also introduces Attack factors as I was saying What if I wanted to load some bad stuff in the inertial navigation unit? Or the air data computer or the primary flight computer? If they have a standardized this unit and I have physical access to the aircraft um I could quite possibly put some stuff in there to make it non operational And I have some opera. I have some examples of ofp and real world stuff Uh towards the end of this slide just things that we've seen in the news and and I've been able to Some eyes with my own research and stuff So other things look out for maintenance data made it as I said in my case. It was a pc mc ia There's a lot of other airframes that use different stuff hot swappable r drives usb cards and sd cards I've seen many of those things Used in laptops connected to networks. It's that whole b y o d You got to make sure everything's sanitized before you bring but those are possible vectors Now so we go with external data connections as vectors so Setting the bus code directly to a component with a proper address and command for the spit specific bus So, you know, if we could receive a cp dlc information it is going along that bus It's going along the main network system So what would it take to inject some code into that because input validation is not a thing I want to go over cp dlc a cars and fans, which is the future air navigation systems because that's Everything that we want to build on the future for making aircraft more safe We're using fans and it's a very unstable system. I'll show you in just a second Cool thing about cp dlc using text messages to take off and land I don't know if I should bring this up if someone at the talk Joshua smells the university of oxford oxford is covering this very well And I suggest that you watch this We actually have the same resources when it comes to doing this on your own as well But he broke down everything as As I can imagine just it's exceptionally well Put together and I enjoy it. I got a lot of questions for you too, josh. So it's going to happen Uh cp of the cp lbc the control pilot data link controller. I just wanted to show this to you It's running on vdl2 vhf data link too. Uh, that's the problem and I'll I'll explain that in a moment As I said it's used for sending clear messages back and forth Vhf bay and use that's what the vdl2 is and then a cars Which is the aircraft communication addressing reporting system I believe there was a talk about this last year The airframe that I worked on with a cars was a c5 and it was used for weather updates And all it did was print out a printer But the problem is you can receive information through a cars in the vhf data link and it's going across 15 53 bus So You know, it's not secure There's no way to secure it and any kind of code is in there. In fact, you can just receive it on your own Uh, I believe there's a project in my notes here that lets you receive a cars data if you like So it's on vhf and hf receive data to print the thermal paper. That's what I was talking about with the weather relies on readily available commercial networks and also a vdl2 project So I wanted to show you what fans was feature air navigation systems a lot of these systems are going to be coming out They're going to rely on this vdl2 So I have a feeling that if we understand vdl2 enough We'll be able to take apart these systems like they need to be tested and looked at so that's vhf limited to 200 nautical models Um, I have an aircraft at 3,000 or 4,000 feet and that's the project. I was talking about scr dump vdl2 on github and I do have a link to it This is what the packet looks like Your transmitter synchronization reserve length header data EEC data and you have another data frame and then the fec and a 85 bits now this is kind of confusing, but I actually have a Better breakdown of it showing the network layers 1 through 7 of the application presentation session layer Now as I said, if you go to this this project You'll be able to understand this data Link better and you'll be able to take apart all these other systems that consist of the a cars and the cpdlc Because they all rely on the vdl2 Which is fine, but there are ways that we need to start Encrypting it a pre shared key. I believe was one of the suggestions made and I and that's In my opinion one of the best ways to go. I mean it's worked out really well with ipv4 But overall like the infrastructure of that it's not very secure So this is what we have So these are the hurdles if you want to hack aircraft these are hurdles You have to understand the aircraft infrastructure that you're trying to hack You have to understand specific components and their functions You have to have physical access to a lot of the hardware. That's really hard aircraft components are very expensive And very difficult to get a hold of same the testing tabletop access that software and hardware I've actually been looking for a 1553 software Everything runs on old windows systems and I'm having a hell of a time because aeronautical engineers just tend to be that way They've been putting a lot of things together on those older systems and all the older legacy systems And that's just the way they design stuff Also learning the insane amount of acronyms.  You got to learn those acronyms. There's a lot of them to aircraft But the str will open the door for many and that's why I put the str projects in here So addendums things that are happening. These are things going on right now. A lot of you might be familiar with the bombardier data link I went through it myself as a maintainer and It's sensitive, but it didn't seem too bad But i'm also not a really in-depth radar engineer So what I found from it was yeah, okay now, I know the center of gravity of the aircraft And I know a data linkage at a certain um white position on the aircraft but It really wasn't a lot from that but in the future there probably could be some more leaks that are more damaging than that With the radar all I saw was what the the guide vein looked like the um Oh, I forgot was guide to where the rf goes through and the physical structure of it But as long as I don't see the software structure, there's not a lot leaked there. So a good idea so Software as I was saying how sensitive the software can be we all know that the 737 max Accidents that were happening was because they did a physical change in the saw on the aircraft But they didn't do an olfp upload So what if you were to manage to get a hold of the legacy olfp? Loaded into an aircraft and now you've ruined it again and it was all based off of center gravity It's needed to understand how sensitive some of this information can be And of course, uh, as of recently the u.s. Government probes aircraft loans only a matter of time They also understand this that this is a very sensitive system. It is only a matter of time before we have some really bad vulnerabilities And that's it. Uh, there is my references. I suggest you all use them as much as you can All the links still work and this is an amazing amount of information Even I still learn from it. Sometimes these are basically the white papers for a lot of these Thank you. It was wonderful talking to you today