So uh you're here to listen to a talk about uh Microsoft Secure Channel and uh you might be wondering what RDP has to do with Secure Channel. Well Secure Channel is the TLS library for Windows and RDP uses that. So that connection that we just saw uses an ephemeral key exchange and at the very end of the talk the demo is we're going to decrypt that. So in the meantime the VM that I just logged into is just going to sit there running and uh again we'll explain how that all works. So uh very quickly uh what do you get out of the talk? Well I just told you uh we're going to be able to decrypt uh sessions that use uh TLS sessions that use ephemeral key exchanges and we're going to be able to pull the private certificate and the session ticket key directly out of memory as well. Uh and then from a forensics perspective it's kind of cool we can map uh public certificates slash server name indicators um both of those to a process ID and a logon ID and I'm not talking about like a user ID I'm talking about the logon session ID which is unique for each login. So let's talk about how we get there. Um very quickly we're going to go over TLS and SSL I know you all know what that is you've seen it a billion times but it's Saturday at DEF CON so a few brain cells lost. Um we're then going to go through S channel and C and G and what those actually are what those words mean and how they relate to what we're going to be doing. And then we'll talk about the secret data uh and all the things we're going to pull out and the forensic context and then finally that demo. So quick disclaimer it's not an exploit and actually Microsoft hasn't done anything wrong despite what we're going to be able to do for the most part there's one kind of exception to that that we'll talk about which is a little like eh. Um but mainly just implementation specific oddities. Um and then Windows isn't going to track uh sessions for processes that don't use their TLS library which should kind of go without saying but just full disclosure. Um and also things that aren't TLS aren't going to be tracked either so things like team viewer don't get tracked. So you're probably wondering well what does? Well again Internet Explorer, Skype, everything that you saw in the um in the uh intro there, LDAPS um and then uh third party products as well anything dot net and then third party products like um uh go to meeting and things like that. So cool background. What is this TLS thing that we all know what it is? Um so I'm not going to walk into the handshake but uh the thing that we need to pay attention to for the purposes of the talk are there's a uh there's a key exchange that happens right? That key exchange gets dictated in the cypress suite. So you have an example cypress suite at the bottom, TLS is the protocol, ECDHE is the key exchange, it's not actually a key exchange just an exchange um and uh no matter what we're going to have a client key exchange that happens uh as part of whatever key exchange we have whether it's RSA or Diffie Hellman or whatever um but how that what that looks like is going to change so and it's going to and it's also going to change what's in memory um so we're going to focus on RSA for just a second and then we'll move into the rest and there's a reason for that uh but basically if we're doing an RSA key exchange server in the hello says proof of who I am here's your public certificate, client yanks the key the public key out of that certificate uh generates random data uh that becomes the pre-master key uh encrypts that and ships it back to the server. The server then uses the private key to encrypt that and uh voila we have a shared secret over an insecure channel. Very cool. Except uh the shared secret is going to be different depending on a type of key exchange we use so if we're not using RSA it's going to be different length because it's derived differently. So then we turn that into a master secret and the master secret um is actually our shared secret that we're going to use to derive session keys each time. We're just going to mix in some public values and stamp out some session keys and start doing our symmetric crypto. So that's all good and well but it kind of takes a long time um especially if you know you've got those clients who are just pinging you constantly and it's the same client over and over. So the guys that wrote SSL thought of that and they decided that well let's do this let's implement something called session resumption where if we since we've already done it once and done this the the full key exchange once if we if we store that for just a tiny period of time just a little bit then we can actually resume that we can see a huge performance benefit. So uh how that works is basically the TLDR handshake is uh high high uh the client comes up and says hey remember me I you gave me the session ID we met at that party it was awesome uh you've got that secret that I also have can we talk and server says fine okay and then they they mint out those session keys again using that shared secret plus client random to uh to then uh um speak via an encrypted tunnel. So that's all good and well but you kind of remember uh we we mentioned RSA well there's this whole problem with we're sending that uh we're sending that private key or that that pre-master key over the wire. That's not good right because in theory because that the private key itself is sitting on disk we can then decrypt that later and everybody's known about this for a while. So long in fact that uh Diffy Helm uh Whitfield Diffy of the Diffy Helm and Key Exchange back when DEF CON started put out a paper that said RSA is probably not perfect forward secret and what is perfect forward secret mean? Well what it means is uh if you and I are able to the property of perfect forward secrecy is essentially if you and I are able to successfully exchange secret material once um and it's secret at that time at no point in the future should anything compromise the security of that uh exchange. So if a bad guy captures us is listening and uh later on he gets the private key and can decrypt that which is how it's historically been done um that that's bad that shouldn't be able to that shouldn't be able to happen. So they actually instead of exchanging something um private uh there was a secret over the wire they actually just use public values in the communicative properties of exponents to actually exchange only public values and derive a shared secret so there's not actually key exchange just sort of a derivation process um but that's all magic that we don't need to talk about what we care about is the basic principle is we shouldn't be sending anything over the wire that's secret um it's over an unsecured channel and we shouldn't be um reusing keys especially not something that we store on disk right and to take that to a lot it's logical conclusion we should actually use a key once and then throw it away never never use it again so that we insulate all those connections so if you're truly perfect for a secret that's what you'd have to do uh that's not actually what happens of course uh the TLS spec allows for session resumption which is what we talked about so it's not storing something on disk most of the time uh but uh it is you know we're not talking about the private key anymore we're using like an ephemeral diffie helmet exchange but we are still caching those master secrets and because we do that and in fact the spec allows you to do that for 24 hours um then we can still within that time period go back and decrypt that section that session retroactively or uh if we grab that out of memory before that time whatever that cache timer is expires we can then decrypt future sessions as well because we now have that shared secret and in fact potentially do bad things with them so uh so that's one of the problems with TLS the other one is obviously talked about RSA but there's this extension called session tickets which you've probably heard of as well and the basic principle is uh I as a server don't have to deal with all your client crap I don't want to store your master secrets so I'm just going to encrypt it and send it back to you well just like sending the pre-master secret if we're sending the encrypted master secret back and for the client to store and then pass back to us when it wants to resume that's kind of a problem the benefit of it is essentially that now server you can have multiple servers that you load balance and they can resume each other's sessions if they just share that one session ticket key that's in memory so we're back to the problem with RSA but we're just using a more ephemeral key basically um and then on top of that so that's just what TLS allows and just kind of the normal normal go through but there's also implementation specific oddities and we're going to get into that today specifically with Microsoft like storing symmetric keys uh well symmetric key schedules so the key itself is random but the key schedule isn't and also we talked about how you should really just reuse you should just use that ephemeral key once uh but there's a little bit of reuse that happens and we'll see if that's you know is that perfect for a secret or is it mostly perfect for a secret so the talk the title is S-channel uh whatever soliciting S-channel soliciting secrets from S-channel um so what is S-channel what is C and G so secure channel is again Microsoft TLS library and it gets loaded into the client process that actually wants to do the TLS exchange but Microsoft doesn't really trust you and your little C-sharp web server to use their private keys so they maintain and encapsulate all these keys in a security process called the key isolation process so if you've ever worked with Windows security uh you know what that's gonna be it's it's LSAS um and so S-channel itself again gets loaded into both of those and then once the uh once the key change happens inside of LSAS it passes back the security context for the connection that has all the parameters and it passes back a um uh a handle to the uh the AES keys well the symmetric keys so that you can actually manage that tunnel um but it doesn't actually handle any of the encryption itself or any of the the ciphers itself that's all handled through the C-N-G which is the crypto API next generation so C-N-G again next generation is all the best generation um it was introduced in Vista so believe it or not there's there's a use there's a use to all those years of blue screening that you had to deal with um it it brought around things like AES um and uh elliptic crypto to Microsoft and really modernize their capabilities as far as cipher suites go um and C-N-G basically has two functions it stores things and then it encrypts and decrypts things so the encrypting and decrypting is done via DP API um again Ellie Burstein who was it was in Vegas recently uh he's the guy who did all the seminal research on that so talk to him um and then uh but we'll go over it as well and then the key storage providers actually handle the storing of those secrets so what does that look like uh oh and quickly okay so that's all good and well does S-Channel actually embrace perfect forward secrecy and the answer is yes um Microsoft has embraced it after the introduction of C-N-G so again we talked about how they introduced C-C-C so what you see in Vista uh they're preferred cipher suites they don't prefer uh a thermal suites they don't prefer elliptic curved suites because it was just introduced and Vista was broken enough um and then in Windows 7 and Windows 10 they actually switched to just preferring those and you also see that the symmetric suite that we prefer the symmetric cipher that we prefer becomes almost exclusively AES um so that's all good and well um and basically what that means is that uh we can't do that we can't use that old RSA trick of just grabbing the private key off disk anymore if we wanted to encrypt things and that's why uh that's part of the reason that Contexus I think open sourced their their uh RDP replay tool that we're gonna be modifying and using later so we know that we can't use RSA any the RSA private key to encrypt things anymore for the most part with Microsoft and we know that um there that in theory TLS allows you to cache things so it does ask channel cache things well their documents say yes it does uh there's a master secret um the cipher suite and certificates all get stored uh after the first connection after the first handshake between a client and the server and additionally you see in their documentation references to the fact that LSAS consumes more memory they tell us roughly how much it consumes so we get an idea for what this cache might look like how big it might be and uh and then they mention that by default as channel or yeah LSAS is gonna store um 20,000 uh entries so that's maybe not a lot for a server but it's a lot for a client um and a reasonable amount for a server so how does that channel actually operate this is a very complicated looking Microsoft diagram that I made pretty oh no oh no we're good uh and it hides a very simple truth which is essentially that regardless of whether you're a client or a server it happens exactly like I explained before uh client wants to make a connection uh says hey LSAS please give me uh a security context and uh some symmetric keys LSAS is the key exchange and on both sides that exact same process happens if they're both Windows servers so uh that kind of gives us an idea again of where we wanna look and where we might find things so CNG how does that work essentially everything gets routed through Encrypt the Encrypt DLL that's kinda really useful for the for the reversing aspect because that kinda told you told me where to look um and then there there's this whole key isolation service and we have these key storage providers again that then manage those secrets and memory and on disk so just as a quick summary uh we're looking at we're looking in LSAS we're looking for secrets and keys and we're doing that because that's where the handshake happens and because uh uh S channel prefers ephemeral cipher suites in the handshake cool so again why do we wanna do this what's the value well we wanna be able to subvert perfect forward secrecy that's the point like now that we know that channel braces that we wanna get around that we also even if we can't do that we wanna see is there any forensic context to be had is there anything we can do with that it would be a value and how long does that live um and then finally again from a bad guy's perspective it's kinda cool if we could just get access to a single process and dump out things we need to decrypt things in the future and in the past and be able to impersonate the server if we can pull out the private key maybe um uh without touching disk so what do the secrets look like so again based on what we've all talked about right now we basically have a session we have session keys we have a pre a master key pre master key those all exist on the client and the host after that initial exchange key exchange um well through the process that we talked about um and then on the server there also could be an ephemeral private key for using the ephemeral suite for just using RSA we'll have a persistent private key and if we're using session tickets there's gonna be this session ticket key right so that's all the possible secrets we could have uh for a TLS connection and what do each of those get us well again we talked about the fact that uh session keys are short lived they're not gonna get us much you're gonna get a single connection uh the master key and the pre master key are gonna get us a single session uh and then the ephemeral key and the uh the pre master uh the ephemeral key the private key persistent private key and the session ticket key will all get us multiple sessions depending on what we what we're using and then on top of that there's a that that persistent private key usually gets used for signing as well so that'll get us identity for the server so what do we get we we got them all we got everything so what you see up there is the pass to the keys uh they're sitting in memory inside LSS memory um and they're named based on either the name I gave the structure that I reversed or on the uh symbol name that Microsoft has for for the uh the respective um structures so anytime you see an uh an unlock symbol that means that secret is sitting uh unencrypted in memory and obviously I know everybody goes straight to the one that's got the lock sign and they're like what about that guy well we're gonna get to that that's actually not a problem either uh and then the one other thing obviously is we see the pre master key down in the corner pre master secret sorry and uh you're probably saying well you're cheating you said everything what about that guy and we'll explain that too so how do we get to that point where we have everything and and we know exactly how to get to it well I started with the session keys because it's closest to the data it's most ephemeral it's not going to be encrypted because it's a symmetric key that would be kind of not wouldn't make a lot of sense at least not software um so I started with AES because as we saw S Channel prefers AES for everything uh but AES keys are small and random so I mean that's kind of a non starter right well not exactly uh so smart guys over at Princeton a while ago wrote a paper on uh called cold boot attacks and they talked about the fact that a lot of implementations store uh this key schedule so AES gets expanded into round keys and that process is deterministic hence why it's called a schedule um and because of that we can actually take that otherwise random data we can calculate what the next item of based on that random chunk that we're looking at would be if it would be part of the schedule and if it is then we have a really good chance that we have an AES key uh so I basically just scan the client server process and uh what you see there is matching AES keys on each so what does that give me well that allowed me then to go look at those offsets in memory and start figuring out what the context of those were and how those were stored you see that there's four keys stored there uh that was actually two separate connections and remember that when we're talking about TLS we have a server key right key and we have a client right key uh so there's gonna be two AES keys for each uh but yeah so one thing that I noticed when I was doing this and this is what the this is what the data structure looks like so one thing that I noticed when I was doing this was that there is this magic value three LSS which is actually stored as a D word so flip that around and that's uh little indian and it's SSL three and I was like aha Eureka SSL three this is you know this is cool uh maybe but I was weird because I was the TLS 1.2 connection so I was like uh maybe they're just terrible at their naming conventions or something um but I started scanning for SSL 2 and SSL 1 and everything else and what I was actually able to find was that there's a there's SSL 1 through 7 so it's not the TLS version it's something else entirely um but before we get to that just quickly to go over this structure uh the session key structure itself has this magic value right above it has a length value it's got the protocol version which is the TLS version um and then it's got a pointer to the cypher suite list so we know what kind of key we're looking at basically um and then at the very end there's a there's a boolean flag to say whether or not it's the right key for client or server basically um and at the very end uh there's a pointer to a B-crypt key structure and if you've ever played around in the back in a Mimikatz you know that B-crypt keys are used everywhere in LSAS they're superfluous uh and that's superfluous they're they're just everywhere um and Benjamin Delphi did a lot of research on reversing those I actually then did it myself because I didn't actually source code until after I kind of gotten into it but um but yeah so these things are kind of uh consistent and then on top of that he calls this MS symmetric key uh he calls it like a B-crypt key and I think he calls the other one a B-crypt key handle but the reason I call it that is because of the symbols and memory there's actually a validation function that says for this magic value MSSK um validate mass uh symmetric key so it's Microsoft symmetric key uh and then the thing highlighted in red is the actual key itself cool so I mentioned these these these magic values this these SSL values how do these come into play well when I started looking at the modules for these magic values just to see if I could pull apart the functions where they were stored uh or what that generated them um what I noticed was there's a few really really quick validation functions that literally just do three things they accept a pointer they check the size value of the structure at that pointer and then they uh check the second value for uh a magic value which is that SSL uh three or whatever the number is so um so by looking by dumping out the rest of those and then kind of looking at them they're all the same and what that gets us is it gets a size values and function names that are very descriptive uh for specific structures so we kind of know now that that that this SSL five magic value is going to be tied to a master key and we know that SSL four is going to be tied to a key pair whatever that is um which turns out to be the private key and then uh SSL six is for the ephemeral key. Now SSL three didn't actually have one of these uh I just happened to come across one of those other functions but we we do see that it gets used in decrypt encrypt generate session keys and also I've just traced through and I know that those are the session keys so um the only other one up there that doesn't have uh anything is the SSL seven and that is the pre-master secret so pre-master secret we don't actually really need because it it literally is per connection and gets used only to generate that that's master secret that's always going to be the same length because the pre-master secrets variable based on um again what key change we're using using ECC it's going to be the x coordinate of the shared secret that we derived um so basically it's vestigial we don't really need it we have if we can get the master key which we can get uh so so SSL seven is only used uh for the RSA pre-master secret and on top of that it gets destroyed very quickly so uh they actually follow the spec on this as soon as you've got the master secret you destroy it so you will you'll never see it in memory it's kind of too beautiful to live or whatever so master secret uh basically this is this is the goalie lock secret this will get you multiple connections it'll get you the whole length of the session this is what get cached gets cached Microsoft told us that in their documentation and the it's it's delightfully simplistic basically it just stores the master key directly in a um in an array as part of the structure uh it it tells you the um the protocol version and it tells you the cipher suite that you chose because obviously we need to take that master key mix in some stuff and mint out some session keys um but yeah so incredibly simple but the problem is and and if we just have this right now we could actually then uh brute force a given session ID with that master key uh with all the master keys in memory and potentially uh be able to decrypt it but it would be a lot more elegant if we could map it back to unique value which is what we really want to do so this is what that looks like in memory and what you're gonna see as we go through is there's gonna be a lot of uh wind debug and the reason that I did that is I had the full commands there so once you have the slides you can actually go through and validate my work yourself um or you can do it as you go along if you want uh but yeah so that pointer again points to Unicode string and points to a the uh identifier for this the cipher suite version um but there's no other pointers out of the structure so we have to figure out how we can map this to unique value what you do well you scan scan for pointers to the structure right in memory and what I was able to find is kind of similar to how the be crypt keys work and crypt keys which I'm guessing means network uh uh crypt keys um have a handle that then points to that secret and if you go back from that you actually get to the session key structure and I kind of found it because I was able to to see uh session IDs directly below and you might be wondering how do you see session IDs uh they're supposed to be random well they're not always random actually they're just arbitrary and we'll get into that too but basically what we have at this point in time is we have plain text we can go from a given session ID all the way through to a master key and uh we can then decrypt the session that belongs to and we can do that by just the quickest way to do it is really just to dump it out in wire shark format and open up a wire shark and it's instant instant gratification so which is exactly what we like um so yeah so now we have master key and we could really stop there the master secret sorry we could really stop there at this point because I mean we we can decrypt sessions this that's great but why do you that when there's other things to be had so there's this ephemeral key right in this persistent private key and depending again on the key strings that we use um they're going to be uh one may exist or one may uh may not exist um but they share the same structure because they perform the same function so uh there's this SSL key pair structure that again is has a magic value of SSL4 or SSL6 that points to an encrypt key handle which is not really the same as that encrypt SSL key that we saw it's got a different magic value and slightly different structure and that points to this KSPK structure um and you're like that's not how you spell key storage provider like but it's because it's backwards and again because it's a little endian so this case or KPSK structure is uh is the instantiation of the key from disk or the uh ephemeral key itself um and it has all the values we need to really to do anything interesting with them so that is the key storage provider key and uh and it's kind of the the thing that we're shooting for so the ephemeral private key itself uh that's what it looks like dumped out it's stored little endian nothing else for Microsoft is stored little endian uh for for the keys and the secrets so it kind of threw me off at first but I what I did there is I dumped out based on this uh this ephemeral key data class I dumped out the public key and then the generator values from the KSPK structure so from that key provider key storage provider structure and then I dumped out the private key so you could basically then um assuming you knew the the large prime value you could um take that private key there and then uh uh generate that public key to verify that it is in fact a private key so um it's stored in this MSKY structure which you could use later on in in the talk and um and basically uh once we have this what can we do with it right? A wire shark doesn't support ECC keys right now by default just to decrypt things like it does with with RSA private keys but it doesn't there's no reason that it can't um once we have this we can drop it into a pen structure we can kind of use it as we want and because it gets reused and it gets stored in memory um this gets us multiple sessions and it's kind of it's kind of great so it's the equivalent of what we would have had before with the RSA key if we were using an RSA key exchange so then the persistent private key itself so now at this point we have all the ephemeral things in theory other than that whole session key thing that we'll get to uh so but what about impersonation of the server what about that thing that little lock symbol that wasn't unlocked that you guys are like yeah yeah yeah he's cheating well the uh the RSA key gets pointed to you directly out of one of those KSPK structures the key storage provider and it's encrypted in memory so it's encrypted with DP API well if you've ever done anything with DP API or if you've ever read any of again Ellie's work you'll you'll know that um there's because it's encrypted as a system secret we can actually just grab that uh system secret decrypt the DP API master key and use that to then decrypt this blob so you could go back to disk you could grab that and you could then just decrypt this but what's the fun in that right because we want to be able to get this trade out of memory well up there you see highlighted in red is the key good out of the DP API blob so what I did here was I scanned the um I just scanned memory for the uh master key list which uh basically the master keys for DP API get cached in memory um but they're encrypted so Benjamin Delphi did a lot of work on this and again this is one of those things where I looked into it and he beat me to it and he's he's just a badass um so basically what you can do is you can take the uh there's there's there's uh symbols that point to the uh initialization vector and the the symmetric key that then encrypt these master keys you can encrypt those and then use that to decrypt the blob trade out of memory and when you do that you get this so on the one side we have the RSA uh key from disk itself on the other hand we have what we decrypted out of memory and you you'll know you've done it right if it's an RSA key because the uh the Microsoft structure actually has this RSA 2 magic value that you can just see so um so at that point now we could we can directly impersonate the server without our having to touch disk which is kind of cool so what about that session ticket thing that's like the last thing that uh last secret that we have to go over that we haven't really talked about yet um so it's not really seemingly widespread use it seems like the support for it's a little bit um a little bit lacking but uh well at least the documentation is for sure so uh sometime around Windows 8 and server 2012 R2 Microsoft basically uh enabled the the capability to uh to use uh RFC 5077 which is the session keys but they didn't actually provide any documentation with how to use that they did push out these PowerShell functions that you can uh you can use and what I've done there in that example is I've enabled those PowerShell functions or I've ran those PowerShell commands that they give you as examples to create a administrator managed session key ticket key and then um uh and then enable it for the for the account but that doesn't actually enable it for the system and they don't tell you how to do that but what they do tell you in the Windows 8.1 release uh preview release notes is set this value to disable session tickets it's screwing things up so taking the opposite of that um I set it instead of two set it to one and then next thing you know I'm able to actually use uh session ticket keys so up to this point even though things have been unencrypted in memory and even though we can do bad things with them and that's cool or great things if you're a friends with guy um now Microsoft hasn't done anything wrong I mean realistically those are short lived uh short lived keys so in theory like it's fine to keep them uncrypted in memory and then the one thing that does get stored on disk that they pull into memory they then encrypt even though they store the keys to decrypt it but the session ticket key is kind of that thing where they they kind of mess up a little bit in my mind but um if this is in fact the way that the Microsoft approved way to do it which I can't say that it is um the administrator managed session key gets stored on disk and it gets DP API protected right? Just like any other key that gets stored on disk so we can then pull that out and that key then gets derived or gets turned into an AES key through a key derivation process um but that AES key is actually the same AES key across reboots which basically means that if you enable session tickets and it happens at the S channel layer which means that it happens for all services and windows not just for IAS it happens for IAS and RDP and everything else we talked about um then you if you can pull this key off disk via I don't know the export TLS session ticket key function uh uh command lit from PowerShell you can then decrypt these just like it was an RSA key you can then decrypt those sessions which is kind of crazy so um so yeah uh they don't they they do cache this key in memory as well so we don't have to go to disk to get it once we export it um but what we can do is we can pull it um we can pull it out of the cache and uh there's no symbols for the cache but if we have the key which gets stored in the uh the session ticket key session ticket that gets sent across the wire then we can actually just uh reference that because we know um because I know what the structure looks like and I know the offset so what do their session tickets look like? The session tickets are actually they're cool they flip the Mac above the encrypted state so they don't have to change a bunch of things if they change the size of the encrypted state which is great um and otherwise they follow the spec but because they have the IV in there which is that they're supposed to have and because they have key guru and because we can pull that key out of memory we can then go directly from having something on the wire to what the slide shows which is decrypting that uh session ticket and seeing what that value is and as you'd expect it's just got that master key structure stored inside of it along with um things like a time stamp and TLS protocol version and things like that so um so yeah so at this point we've basically decrypted all the possible secrets that we need um out of memory so secrets are cool and all but what if you don't actually have a packet capture what if you don't want to decrypt things in the future what if you don't care about any of that uh you just want to know how this relates to forensics um well that's why we have the context so core TLS is self functionality that provides metadata that we can use while time stamps typically get uh are the first 4 bytes of a uh of a random values that get generated if you're following the spec um and then there are other things like obviously the public key can be used for fingerprinting the server but the session ID can also be used for fingerprinting the server because S channel uniquely um creates these uh takes the first D word and then performs an operation as uh said by these these uh people that wrote the dual e-c paper so that the 2 bytes um the second 2 the first 2 bytes are random the second 2 bytes are zero and then the rest of its random so you get a very visually recognizable pattern um for the session uh session IDs and then uh on top of that obviously we have what TLS extensions offer themselves so we have this concept of server name indicator the cool thing about that is if we just run something like con scan with volatility we we only get the IP address and we get the um the port that it goes to but because we have the SNI if it's a virtual host and because we have the public key we can then say okay well this is exactly who you're talking to or who you were talking to um not just the IP that you were talking to so how does it how long does this whole thing actually get cached we talk about what the spec allows what is what is it how does it actually work what is it what what are the actual values um so there's these values get stored memory the client lifespan server lifespan and the session ticket lifespan and those are all 10 hours by default so what that is is the maximum time that you have one of these in memory so you don't get the full 24 like you well you could get in theory for session ID lifetimes in the spec but you do get 10 hours which is still a lot especially if you're a guy doing IR and I don't know somebody RDPs into your machine and then you get an alert on it and you want to go back and potentially pull the memory from that machine um and if you don't have to pack it capture um so the other thing is uh the maximum number of entries so again this is uh this is hard coded into the S channel binary just like that value above but you can override it in memory or you can override it in the registry um and that's set to 20,000 entries entries by the fault um and then the other thing is enable session tickets uh is is a in theory it's one two or zero presumably zero is undefined that's what it is by default uh hard coded into the S channel binary um and if you don't change that to one then session tickets don't seem to work um and then the uh there's a cleanup interval which is how often uh this this cleanup uh thing runs so if you as the process decommission or uh purge your cache then there's a possibility it might stay around for a tiny little while before that that timer expires uh so as the process you have full control S channel is still just the library so the processes can purge uh the cache whenever they want so you might not get a full 10 hours it kind of depends and the other kind of unfortunate thing is that um because we're centralizing this because we track the processes themselves if the process uh dies it seems that the cache gets completely cleared for that process uh but things like RDP things like IAS things like uh most of the sort of services that we're interested in even even something like Outlook runs as a service so you uh you aren't gonna have that problem basically um but they might also decide to purchase cache periodically at their discretion so what does the cache actually look like? Well as you see like it's as you saw when I was talking about the keys um there's uh a lot of these symbols have a C pretty fixing them that's because they're a C++ class um and so the virtual function table gets stored at the top and what that enables us to do is if we can use symbols we can actually just scan for instances of that function in memory which is kind of cool so the very first thing that gets stored is that VF table the next thing is uh is a pointer to the master key and again I haven't got the whole structure there which is why this is like a V type a volatility V type so it just shows you the offsets the things I know about um you also have uh the process ID and then that that log on session ID that I was talking about earlier which is kind of cool and then the session ticket or the um the session there will be a pointer to the session ticket if session tickets are used or there will be the uh actual uh session ID itself stored as a as an array directly in that structure if that's what's used and then on the server side it's again it's a lot smaller you're not gonna have session ticket pointer because they don't get stored on the server um but you'll have think you'll still have that process ID and those other kind of useful things and then just because I had time well didn't really have time but just because I felt like I wanted to be thorough uh I also went and looked at Vista um and basically Vista's kind of proto it's before it really becomes more object oriented so it seems so it uses uh just a list structure so once you find one cash item you just loop through the the list entry and you can find all the other ones which is nice um so yeah so how do that's cool on all the how do we automate that how do we actually make that useful so what I'm providing is a volatility plugin and I'm providing a recall plugin as well to automate that and by the fall it's just gonna dump out the uh that wire strike format we showed earlier um and then what I'd like to do too is hopefully uh talk to Benjamin Delphi and see if he's interested or uh maybe create a power shell module that will do it live so you can actually just do it live as well um but yeah so limitations we're working with internal undocumented data structures for the most part which means that they're subject to change um sometime and like I think it was March or April there was something that was inserted midway through the cache and so you get to this position where you have you know maybe some uh hosted or updated some that aren't and the cache is gonna look different which is kind of annoying but it happens below the uh or I suppose after the session ID so you don't really have to worry about it for session ID it does affect how session tickets get parsed you can still do it um it's just harder to detect that in an automated fashion it'll take a little bit more it'll be a little less clean um and then we're relying on symbols so Microsoft gave us symbols to to do some of this pretty easily they can also take them away which is totally there right um but realistically that probably isn't gonna have that much of an impact because most probably can do all this stuff still uh just a little bit less efficiently um and then you need to be able to read LSAS memory which is kind of a big caveat when you're talking about being able to exploit things right so um well not exploit sorry just just when you're pen testing you're moving through something but the reality is that like in 2016 again everybody runs many many many cats and things like that getting access to LSAS isn't that hard if you have administrative access to the box but it does mean that this is probably a little bit more useful in a forensic context than it is anything else so and with that let's get back to the demo so I'm gonna simulate again capturing RAM and then um after we get that uh I'm gonna run the recall plug in so there's a there's a screenshot there with a volatility plug in and then I'm gonna basically just to show you both I'll go through recall as well and hopefully that will work okay cool so we see that it dumped out this single session ID and again the reason that this is uh there's only one is because I'm not connected to the internet intentionally um so that's the only the only one that that's gonna be there is from the RDP session I made um so we're just gonna copy that into this demo file and read it out of the file hopefully don't tell me copy paste failed sorry live troubleshooting what's that restart what okay I got yeah yeah yeah okay cool oh the joys of open source software oh we're so close and it's not even the hard part of the demo this is like literally the basics okay okay okay hold up a sec let me just see if what do I have mounted actually how much time do I have I know see I shouldn't I shouldn't have antagonized them that was my own fault okay so tell you what since we already have it let's just do you guys mind if I reboot reboot calorie really quick and just see how that goes the extended demo just because you're my favorite audience and in the meantime if anybody has questions about anything um please feel free to come up and ask the microphones up front in windows 10 microsoft started doing virtual virtualization based security to grab some of the L SAS decryption put them off like by the hypervisor the worst place for that to happen sorry go ahead have you looked to see if that affects any of the day you were able to pull yeah so uh I guess what I should say is I tested this with windows 7 and I tested with windows 8.1 but I mostly was working on windows 10 in the server 2016 preview and the hardest part was really the session tickets because I don't really know I wish that if there's a I just make sure that I'm doing it right so I wish that there was a way that said this is exactly how it should be done um but yeah no I everything was done on windows 10 was hyper V enabled what's that was hyper V enabled uh no I don't know I just probably probably not no okay cool okay well apparently I'm not going to get that functionality so uh I'm not gonna I'm gonna spare you me standing up here and typing it by hand uh but if you want to see the demo I guess come to me afterwards and uh and I'll show you okay so uh yeah anyway that's basically this is you can also see in Wireshark and just see the keystrokes going across uh which is what that is um and that's the that's it so you can find me on tinrabbit uh underscore at um that's on twitter and then thanks to these people for all their help I really appreciate it so that's it


Welcome to today's episode of the mindset mentor podcast. I'm your host Rob dial and if you have not yet done so hit that subscribe button Since you never miss another podcast episode And if you're out there and you want to receive mindset emails from me every single week on Monday morning Explaining to you what you should be focusing on with your intentions in your mindset in order to make it a great week Go to Monday email.com right now once again Monday email.com right now and it's absolutely free I'll set send you Monday emails every single week today.  I'm gonna give you tips on how to do so so First off before you go any further. Let's get really clear on exactly what standards are standards are what you deem acceptable and unacceptable in your life It's that simple. That's the easiest.  I think that probably is But stopping just short of your goal is something that you do Giving up on yourself too early is something that you do hitting the snooze button Three times before finally waking up is something that you do So, you know shooting black tar heroin something that you don't do that's below your standards But giving early given up early on your goal not below your standards Hitting the snooze button Not below your standards people love to focus on habits and it's important habits are important But your habits are the offspring of your standards when your standards are clear and defined your habits will follow I'll give you an example, you know a lot of people want to have a morning routine and Develop the habit of having a morning routine, but they don't have a standard of waking up when their alarm goes off They don't have a standard of going to bed early They don't have a standard of doing what they say they're going to do they don't have a standard of prioritizing their health and Prioritizing their sleep, they don't have a standard of making sure that everything in the morning is ready before they go to bed So, you know, you won't shoot black tar heroin But you do struggle getting up in the morning. Why standards?  Now those might not seem equivalent to you and I completely get it But there needs to you need to understand heroin below your level sleeping in No, that's part of your levels That's your standard that you're that you're allowing yourself to to go to and your habits will be dictated by your standards So let me give you a couple more examples. So it makes sense, right? If you look at your body, is it your dream body? Could it be better? I love using the body and working out in all of this as an example because Your body is literally the physical manifestation of your habits and your standards Your body is literally the physical manifestation of your habits and your standards Does your body the body that you want? Is it your dream body? Could it be better? Well, it's because of that Whatever your body looks like is because of your standards. Do you eat fast food? Do we greasy food? Do you wings? Do we pizza? All of that is just a standard that you're sticking to There's some people that eat crappy food and that's just part of their standard There's some people that will never allow themselves to you crappy food because it's below their standards I'm not saying there's right or wrong. I'm not here to judge. I'm just saying wherever your life is is because of your standards You know, I'll give you an example. Let's say Let's say you drop food in the parking lot Are you gonna pick that food up and eat that food after it's been on the parking lot for a little while? Mmm, probably not why because it's below your standards Right, but maybe eating McDonald's when you know you shouldn't isn't below your standards What does it come down to your standards? That's it. Look at your body again How often do you work out is the amount of time? Let me say this the amount of times that you work out is Your personal standard. I know people that work out Twice a day. I know people that haven't worked out in 10 years. What's the different standards? That's the difference between the two of them So if you want to change your body What do you need to change? You need to change your standards. What you deem acceptable for some people Working out once a week is a win for some people Working out less than five times a week is a loss. What's the difference? Standards, that's it. So if you want to change your body, what do you need to change?  What's the difference between you now and that version of you? Standards and this is everything in your life. You have standards for literally every single thing in your life Do you realize that and so it's important to go through and actually start to think about what are my standards around this? What are my standards around that? Are my standards high enough in my business in order to create the freedom in the life that I want? I don't know that's for you to decide So let me give you a couple of examples I'll give you a couple of examples so we can kind of put a little bit of flavor to this and make it a little bit more colorful, right? If you look at your goals for instance, right?  Do you give up? Do you not stop until the goal is hitting no matter how long it takes? Well the difference between those Standards if you come up short or you give up short or if you don't stop until the goal is hit The difference between the two of those is just simply your standards. So if you want to hit your goals more often What do you need to do? You need to change your standards. What are the standards that you need to have in order to hit the goals that you want to hit? Okay, what's another thing relationships do you cheat on your significant other? Well if you do that's a standard if you're like absolutely not That's also a standard. Do you have date night every single week? If you don't well, that's a standard if you do because it's like absolutely. We do not miss it That's also a standard. Do you turn off your phone at 7 p.m. Just so it can be the two of you Well, that's a standard. Do you spend all night watching Netflix? It's also a standard All of it comes down to your standards and what you deem acceptable and absolutely unacceptable. What about your family? Do you work so hard that you usually miss dinner with your wife and kids? That's a standard Do you disconnect at 6 p.m. So that she could be fully present parent? That's also a standard The only difference between the two of those is what is acceptable and what is unacceptable for some people? Missing the majority of the dinners is just a standard for some people They will never miss a dinner with their children and their wife and their husband Whoever it might be that's a standard. You know some people's kids You know like I know for instance when I was a kid one of the standards of my mom had even though She worked really hard one of the standards was that she would come to every single one of my my sports games I never told her to But I love that she always came That was a standard for her. What are your standards around stuff like that? Have you gone through and actually become very intentional with every single thing that you do and figure out what your standards are? Okay, what's another thing your body once again? Do you work out every single day? Do you follow a healthy lifestyle? Well, those things are standards Do you eat fast food? Do you skip workouts often? Has it been months? Has it been years since you've worked out? Well That's your standard. That's all that it comes down to your entire life comes down to your standard. What about your bank account? How much your bank account is that how much you spend how much you make all of that comes down to standards? The work that you do the thing that you do for money is a standard for some people They get to a certain level and they're like there's no way I'll ever go below this cool That's a new standard for some people. It's just like I just need to get by man. Cool. It's a choice That's your standard. What about your personal growth? How much you grow yourself? Intellectual your personal development, whatever you do there.  What's the difference?   What's the difference between you now and the standards that you have and That person if you were to look and look into the future if I could say hey Describe the perfect life that you want and imagine that somebody has that perfect life already They already have every single thing. There is nothing missing from their life. It's not even you It's just somebody else that exists in this world right now and they already have everything that you want They have the success the happiness the love the peace the joy the family the cars closed that freedom all of those things You have everything that you want What's the difference between them in you? Describe to me in detail. What's the difference between them and you can you get very clear on the difference between the two of you? Can you? Let me know what's the difference between you and them and then what you realize is you start looking at yourself You start seeing where some of your standards are coming up a little bit short And you start looking at where that other person is you start going man That person has some much higher standards in the relationship person has some much higher standards in their work ethic person has some much higher standards in their you know their workouts that person has some much higher Standards in the food that they eat that person has much higher standards in xyz everything and then you start to look at okay Well, this is where I am. This is where I want to be what do I need to change my standards? Because my habits and my actions are the children of my standards when my standards are high I will have habits and actions that line up with that Because the way that I see it Personally I see everything is light in life as just to test to see how I'm gonna show up It's as if God or the universe is watching me at all points in time And they're like hey Rob How you gonna show up because what I'm going to give you and bless you within this life is going to be Based off of how you show up if you have low standards You know you're going to get low results if you have really high standards You're going to get really high results I try to hold myself to the highest standards that I possibly can because when I do I find that the universe rewards me Because one of the things that's super interesting everybody is that most people don't hold themselves too high standards Most people don't even know what a standard is But when you start to hold yourself to a higher standard You realize there's very few people in the world that hold themselves to the standards that they really need to To make greatness out of himself And when you decide I'm going to hold myself to a level of accountability and level of standards that I never had before It's really crazy how the universe just conspires to be on your side Then you start getting blessings and things that you never thought she could possibly get you're like Where in the hell did this come from? I've never seen this before what happened It's kind of like the universe is like hey good job. You finally did it now Let me show you what life could be but it won't give you any of those amazing things until you actually Start to make the change You have to remember the way you do one thing is the way you do everything and you live and die by your standards Do the standards that you have now match the standards that you need to create the life that you want if they do Continue on them if they don't make a change because that is the only way that your life is going to change is when you figure out What is absolutely unacceptable and what is acceptable and you start to hold yourself to those standards? So that's what I got you for today's episode if you love this episode, please share it on your Instagram stories and tag me in it Rob dial junior R. O. B. D. I a L J R Once again, we don't have any big corporation that backs us or helps us out here or any of that type of stuff The only way that we grow and have become one of the top 75 podcasts in the entire world is from you guys sharing it So I greatly greatly appreciate if you'd share this on your Instagram stories and tag me and once again It's Rob dial junior R. O. B. D. I a L J R And I'm gonna leave you the same way leave you every single episode make it your mission to make someone else's day better I appreciate you and I hope that you have an amazing day You


and welcome to another episode of The Non-Profit Show. We're really excited, because we don't do this very often, but we have a two-day drill down. That means that we pick a topic that we think is a bigger conversation that's gonna take two days, and then we bring on one person to really work through this drill down. And we have my friend, Lashonda Williams, from Fundraising Academy on. Hey, welcome. Thanks, Julia. How are you today? Happy Monday. Happy Monday. You know, I'm great, great, great. Because I've been excited about this drill down coming up. I know that this is one of those things that is so important. And my husband and I, we've been together for more than 40 years. My husband always says that we are together because he wrote a thank you note to the CEO of a small savings and loan. He was interviewed out of college.  I didn't think you were a strong fit, but you were the only one that wrote me a thank you note. And so I said, this kid is coming with me. And it was for an institution out of town. And so we would have, our lives would have never met because we were, I had gone to a different town for school. He had gone to a different town for his job. And because of that thank you note, he's my ball and chain. Love it. Gratitude of gratitude that keeps giving. It's true. So anyway, long story short, I really do believe in this process. And LaShonda Williams, pardon me, got me choked up, believes in it too. And so we're gonna really be talking about this and enjoying this conversation. Again, I'm Julia Patrick, CEO of the American Nonprofit Academy. Jared Ransom, the nonprofit nerd will be joining us shortly. Again, we have to say our thank yous to our sponsors and they include Blumerang American Nonprofit Academy, your part-time controller, nonprofit thought leader, fundraising academy at National University. Hey, really quickly, my husband and I were watching a baseball game that was being broadcast from San Diego and National University had a big banner in the left field, I think. So we were all excited.  Right, and great commercials too. And really good. And they were running some of them. Yeah, it's like a new ad campaign. So anyway, we wanna share our love and gratitude to our friends over at Fundraising Academy, staffing boutique as well, nonprofit nerd and nonprofit tech talk. If you've missed any of our conversations, we are now in our fourth year, we have more than 800 episodes. You can get us on our streaming platforms, our podcasts, and now our new app, which is super cool. Our team at American Nonprofit Academy has created this. You can even scan the QR code directly if you're watching us in our broadcast right here from the screen.  Okay, LaShonda Williams, last we met, we were physically at AFP icon and we're gonna be rejoining you for another conference in San Diego, which we'll talk about in a little bit. But LaShonda, trainer with Fundraising Academy, welcome back, my friend. Thank you so much for having me, Julia, looking forward to the day of drilling down with the attitude of gratitude. I love it, and it is an attitude. And let's jump in because with this attitude, you're sharing with us that they're really four key elements. Yes, and they are all essential, the key.  Go ahead. I get so excited, prompt, personalized, passionate and positive. They are all essential elements of ensuring that your donors and prospective donors understand that you appreciate their gifts and that you appreciate the impact and sharing that impact. So these four elements are very critical in not only with initial stewardship, but also they play a major role in retention. So I'm gonna ask you two things because I heard two things that I wasn't expecting to hear. And first off, this is, gratitude is not just extended once you get the gift. Is that what you say? Exactly, you're grateful throughout the cycle of the relationship. And I say that because in order for the relationship to even form, the donor has to, or prospective donor has to be open to the relationship. So you're saying thank you for taking my call. You're saying thank you for responding to my email. You're saying thank you for accepting the meeting. You're saying thank you for meeting with me. So you are having, you literally with consistency have an attitude of gratitude because the donor's time is very important and you want them to understand that you appreciate them as well as the potential impact they can have on your organization. Okay, mind blown because you know what? I was thinking, and I'm kind of embarrassed to say this to you. I was thinking that this was like, this whole two days was all like post-gift. And like completely, you've like literally shaken my mind because you are right. It should be throughout that out. Exactly, throughout like most of my, all of my correspondence when I'm interfacing with donors I always start with a thank you because there is some interaction that has led to a precipitating action and it would not be possible without their support. Okay, I really now this drill down means even more to me because it's a different perspective on this journey. Really, really interesting. Okay, you always rock my world, LaShonda. Well, that's why I said attitude of gratitude. Now we're gonna drill down on the post but you are very thankful throughout the process and you want to make sure that the donor feels valued and the perspective donor feels valued because if an individual does not feel valued the relationship will not mature. Think about it. You just gave the perfect example of you and your husband. He wrote that letter and that letter made a difference and you two have been together 40 plus years later. And that is what we'd love to see with our donors. We'd love to see them start with making that initial annual fund give transition into a lead gift, a major gift, the capital gift and or a bequest so that they can have the entire life cycle in the relationship is ever changing and evolving but consistent and sustainable. You know, so interesting. And I love that you framed it up this way because what we're gonna talk about then is a complete shift. And also I would dare I say it's almost like not only is it a shift but it just becomes a behavior and a habit. And one of the- Absolutely. Yeah, one of those first things you talk about the first P is being prompt. Communicating within 48 hours of the gift and I think we need to change that word gift to interaction maybe to be more- We definitely can interchange that word into interaction because a gift is, you know the closing of the relationship or the solidification of the relationship which is one aspect but even in that initial phone call. So thinking about it from both perspectives from the initial phone call or initial form of communication as well as that initial gift. You know, people often talk about is 48 hours really reasonable and sustainable. So in many facets, you know depending on your gift processing and or the receiving mechanism for your CRM for gifts you have that automated message that comes out within 24 hours, it's instant. But we're not talking about that instant message in the perfect world when your systems are in place and you have the resources available you want to be able to follow up secondarily because that automated reply is more so of a gift receipt. It means I have received your gift here is your proof of making that gift but to actually begin that thank you that is what happens within the next 48 hours. And that is when it's either a personal phone call or you're preparing a handwritten note. You know, many instances emails are convenient. However, one of the things that you want to be very mindful of if you are going to follow up with an email within 48 hours, your subject line is very important. It needs to be personalized. It has to be catchy. It needs to be something that won't get caught up in the day-to-day emails or caught up amongst the spam messages. So you want to make sure that you acknowledge that gift properly within the 48 hours. And again, this is beyond the automatic gift receipt when you make a gift online. Right, because you know, I mean, you and I know because we give, when you do get that it is like it's automated, you know that it's to- It's a form. Yeah. It's a whole list. Yeah, there's no human touch behind it. There's human programming. And so yeah, I agree with you. I love understanding that there's a difference between that immediate response and then that one that I almost want to use the word more genuine because it's- Right, and you know that initial auto response is almost trans, it's transactional. But you really want to shift from transactional to meaningful. And so that auto response is transactional and then you want to transition into a meaningful response which is where that 48 hour touch point comes into play. Okay, let's go on to the next P. And this one I think is such a challenge for a lot of us. And I've got some questions to ask you about this, but this is the other P is personalized. First name and gift amount. Okay, this is where I feel we can trip ourselves up because if we don't get this right. Right. It seems like everything else just falls. Talk to us about this. So personalization is making sure that that donor feels as though they're gift matters and you want to make that message personal. Having the first name makes it very, very personal. When you use first and last name with salutations it makes it very formal. However, you're trying to strengthen the relationship. You want to personalize it. When you write a note to your friend, to your loved one, do you spell out Mr or Mrs? No, you make it very personal. You say hi, LaShonda, dear LaShonda. And you want to include that gift amount along with details about the potential impact of the gift. Making sure that you get the name right because then that's acknowledging the individual's gift and making sure that you have the gift amount correct is very important because the donor has entrusted you with their asset, which is their gift. And you want to make sure that that information is right. It provides affirmation that the organization has practices in place to ensure that the gift's being allocated accordingly and it also makes sure that the donor has confidence that the gift has been received and that you are grateful for that gift. And that is what's most important as you're setting the tone for the relationship as it continues to progress. Okay, now this is my uncomfortable part of asking this question because you're a girl from the South, you've got your pearls on, you're proper, you know etiquette, but what do we do with like older donors who I feel like sometimes we haven't been invited to use their first name, like it seems disrespectful and or I never know how to do that. Now, as I get older, I have to admit, I feel like I'm on more of a parody and maybe that's just an age thing, but how do you know when you're not using Ms. or Mr. or Mrs. or Dr. and Mrs. or Dr. and Mr. I mean, how do we do that and know and feel confident again, so that we're getting it right and we're not blowing the relationship out of water? Exactly, and you don't want to blow the relationship out of water. So this begins by making sure that when you have your online gift form that you have those mechanisms in place to ask, you know, what is your preferred?   Who are they talking to? Right, well, you know, Jared Ransom, she gets a lot of times she gets mailed to Mr. Jared Ransom because Jared doesn't seem like it's a male or female name, right? And so it's an interesting thing and we've talked about this before, she's like, it doesn't even get beyond, you know, the circular file, as they say, things get tossed out because they don't know me or they haven't chosen to figure it out. And so I really love that you said, you know, start with that entry piece and to ask those questions about how they want to be recognized.  You know, in the age that we're in, I'm also pushing and thinking that we maybe need to include pronouns because we want to make sure that as we're personalizing messages that the messages are truly to the effect of what the donor preference is. Yeah, and I don't feel like it should be that hard. It just needs to be something that we're thinking about upfront and maybe seeing it and making sure that it's functioning the way we need it to function. Now, the next P that you get into and I really love this because I think sometimes we miss the boat on that and that's passion. How are your funds going to be used and what will their impact be? Once we've gotten through that we were responding on time, we're using the appropriate terminology for our donors, passionate. Talk to us about that, LaShonda. You know, demonstrating passion about your organization should be second nature for most of us as we're in this philanthropic space and because the individual has elected to support your organization, that indicates that they want to have a long of relationship and with that, based on the designation you want to ensure that you provide language that reflects the passion and the impact of that gift and so passion, meaning that you want it to be enthusiastic, you want it to be upbeat. Most importantly, you want to be able to demonstrate how that gift makes a difference. There are a variety of different organizations that have done a dynamic job with that via television commercials, transitioning that into written language is one way to move the donor, not only does it demonstrate gratitude but it provides them with a heightened sense of pride that they're able to make impact on the organization based on that said designation and it gives them something to talk about and also to smile about throughout the day, you know? Well, it builds another champion for your organization. Absolutely, because you're able to give them a little bit more information about the organization, they've done their research, you've shared information with them prior to making the gift but then they become an insider, they become a part of the organization and the key stakeholder once they've made that gift. And as you mentioned, being a champion means that you're going to equip them with the language to be able to articulate the importance of the organization, how their gift makes a difference and how other individuals supporting the same cost can help contribute to the overarching goals of the organization. So to be a little bit more specific, and again, this is a drill down, so I mean, that's why we're spending two days on this, are you saying that we should incorporate this language and these impact statements or metrics with data with these gratitude pieces immediately up front or is this gonna be something that we can trickle out, you know, as a moment of gratitude but not that official thank you? Like, do we separate those off or do we put those together? So it's a combination of mixed methodology. So the mixed methodology meeting with this initial letter, you'll give an overview of the impact. And obviously you have donor reports and you have impact reports which provide even more information. And as you're strengthening the relationship with the donor, when you're cultivating them and engaging them, you can share additional insight but you definitely want to make sure that after that very first gift that they understand that their gift has implications of making a difference with your organization, value to do so could lead to only having that one gift and that is truly transactional and that's not what you want, you're looking to build a relationship. Right, you know, before I move on to the next P, do you ever lead, and I don't wanna say with bad news but it's like, you know, we didn't get this done because we didn't have these funds or do you lead with we got this done because we got these funds, there's still a lot more to do.  Or sometimes I see organizations that seem so successful and so impactful. Again, it's like, yeah, they don't really need my money because they got lots of money. Do you see what I'm saying now? Yeah, definitely and that's why it's important to demonstrate impact. You know, one of the most important things to do is to reiterate the importance that all gifts, all amounts matter. And when you're thinking about those gifts that are smaller, increment gifts and you are responding and you're providing a follow-up thank you letter, the most important thing that you want to do is let the donor know that your gift is important and together, together we can achieve this goal. Everyone ultimately wants to be a part of something greater than themselves and smaller gifts is an opportunity to contribute to an overarching goal and demonstrate the power of the number of donors. So you definitely want to reiterate the importance of all gifts, all amounts because you never know what the prospective donor could become. They could transition into that donor who gives a bequest at a number that you never would have fathomed. So all donors, all gifts should be treated as though they were major gifts. So then again, as a follow-up, one last thing. Is it ever a good idea to actually say what it is like the overall, let's say campaign or amount is like where you are in the continuum of finishing a project or should we stay away from that? Do you say that? No, absolutely. Yeah, like thanks to you. We're 75% of our way to our goal or how do you feel about that? I think that that is spot on Julie, because as I shared everyone wants to be a part of something that's greater than themselves. And if your organization has set out a goal for $300,000 and you have donors that are giving it various increments, you wanna let them know that because of your gift we were able to achieve our goal, we had X number of donors who contributed to raising said dollar amount. In that message, you not only acknowledge the individual's gift, you acknowledge the number of gifts and how their gift collectively help you reach the overarching goal which is the total dollar raised. Okay, thank you for clarifying that because again, that's like one of those things like do we say that or do we not? I mean, it's a really interesting dynamic. And for me, I always feel like, well, maybe there'll be a donor that's like, well, hell they only need $50,000 to make the goal. Okay, I'm in or do you know what I'm saying? Like the psychology of helping finish a campaign. Oh, absolutely. And with digital fundraising, that definitely works. When you're sending out those messages and providing those set types of updates then you do get that donor that says, oh, well, it's only $50,000. Let me go ahead and make that gift or call in and let them know that I'm about to have this transfer solidified. So yes, letting them know the progress of a campaign throughout its cycle is very important and it's important to also acknowledge where the campaign is going and how the individual is contributed because you never know. The individual may want to make a subsequent gift once you've informed them as to where you are within the goal and the timeframe of that said campaign. Yeah. And the sooner you say thank you the sooner you create an opportunity for the donor to say, well, maybe I should give a little bit more because they said that my impact is at X and I really want to be at Y. Yeah, I agree. I think it's so interesting to have this conversation. The last P of the day on the way that we really should be approaching our gratitude and I'm gonna use the word mindset because all of these things have been tactical that you've shared with us today but they're also part of a mindset and that's positive. Make donors happy they participated. I always think of, I was taught early in my career the boy concept because of you. You know, what's the boy? Absolutely. You know, you did this, you are responsible for getting us to this point and it's the positivity. I'm really interested about that. And positivity is everything. You know, when donors feel appreciated when they feel like their gift has been recognized in a timely manner, when they feel as though their gift matters and you respond with a positive letter that's acknowledging their gift and it's also acknowledging the impact as well as the possibilities it provides hope and donors, everyone knows that gifts are based on two things, your head and your heart. It's an emotional time and you want to appeal to those emotions and reinforce the reason why the individual elected to make a gift to your organization. So you're affirming everything that they already felt and you're taking it one step further by putting it in writing and personalizing it in a way that's meaningful to them that'll lead them to want to continue to relationship with your organization. Yeah, it's really an interesting thing. I think especially in the nonprofit sector we deal with heartbreaking tough things that are difficult to talk about and so somehow we do have to make, we have to create a link between being positive and being impactful and not glossing over what we're talking about but saying, as difficult as this is, we should celebrate that we're moving it forward. We're moving, we're creating impact and I think that's hard to do for some of us. I really, really do. You know, when you, I think about television, we let the conversation about watching TV. You know, when you think about American Cancer Society is one example or even hospitals. You know, healthcare is very important to everyone but healthcare in instances when individuals are diagnosed with critical or terminal diseases it pulls your heart strings and they tell the story but most importantly, when they're soliciting they talk about the impact of your gift leading to research that can help resolve or mitigate those challenges. So the same concept when you have donors that are making a gift to your organization you wanna demonstrate the value of their gift.  So it brings it all together and it becomes a very positive altruistic moment for the donor as they're reading this message your gift of $100,000 or your gift of $100 has impacted this organization because of your support we are able to as a result of you becoming one of our donors now we can. So it definitely sets a tone of aspiration in achieving a goal so it sets you up for success. Yeah, I love it and I think this has just been a brilliant thing to talk about especially as we led with this is not just a post gift issue this is something that we need to have we need to be taking our and stewarding our donors on these journeys of gratitude. And so Lashonda Williams one of the amazing trainers at Fundraising Academy you can find all of the Fundraising Academy I wanna say materials there's just a huge amount of knowledge that Fundraising Academy has pulled together continues to pull together and then provide for free. You can find them at fundraising-academy.org and then they actually also have this amazing learning portal that's a part of their ecosystem for education and it's just remarkable. Again, free and certainly valuable. Lashonda, before we let you go I really would love to get a couple of minutes and we don't have much time but could you share with us about Cultivate 2023 and what that's gonna look like? Cultivate 2023 is definitely the training conference that you do not want to miss the title is Cultivate because we're cultivating knowledge we're cultivating relationships and most importantly we're cultivating impact. We'll have two tracks available for those that are relatively new to fundraising and then we also have a leadership track. There'll be a variety of topics covered ranging from looking at your data which is the foundation for prudent decision-making all the way to ranging into how to demonstrate authentic leadership. So we will have a plethora of material made available to everyone who comes out. It's definitely the training conference that you do not want to miss. The portal is up. We have a wonderful interactive platform available in Hoover and we're getting excited as we're counting down the days to we Cultivate. I love it now, not letting the cat out of the bag but you're gonna be one of the presenters, correct? Yes, I am excited. I'm honored to co-present with Ms. Adriana O'Donnell and we will be talking about how to build owner trust and loyalty and that's just one of the teasers during the Cultivate conference. So this is definitely the conference that you don't wanna miss in San Diego at the end of the month beginning of June. I love it. We will be there. We'll be broadcasting live on June 1st and then we're gonna also do on June 2nd our Ask and Answer episode that we do every Friday with Fundraising Academy but we're gonna shake it up a little differently and we'll be sharing that more as we move through the month but it'll be a lot of fun and something that's a great investment. Of course, going to San Diego in June is always a good idea if you ask me. Great idea, looking forward to it. I think it's gonna be amazing. Hey everybody, again, I'm Julia Patrick, CEO of the American Nonprofit Academy. Jarrett Ransom, the non-profit nerd will be joining us shortly. Again, we have a tremendous amount of gratitude for our sponsors of the non-profit show and they include Bloomerang, American Non-profit Academy, your part-time controller, non-profit thought leader, Fundraising Academy at National University, check out their sexy new ads. They're beautifully done, I just gotta say. Beautifully, beautifully done. Staffing boutique, non-profit nerd and non-profit tuk-tuk. These folks join us day in and day out. Hey, my friend Lashanda, I have tremendous gratitude for you. And I have even more gratitude for you, Julia. Thank you so much for having me on again today. It's really great. Now, tomorrow is part two of our drill down. We'll be getting into more strategies, how you can connect with your donors, what they're looking for, how do you build stronger relationships based on the concept simply of gratitude? It's really a basic concept, but for some reason we miss out on the strategies behind it. And so with this two-day drill down with Fundraising Academy, we'll really get more information and practical advice like we had today from Lashanda Williams on how to navigate that journey with your donors. Lashanda, you are a marvel, my friend.  So thank you so much for having me and we're looking forward to talking more about demonstrating the art, if you will, of saying thank you. Gratitude is everything. It is, it really, really is. And I love that you use the word art because it is an art form. Hey, everybody, as we like to end every episode of the nonprofit show, we want to share with you our message and that is to stay well so you can do well. We'll see you back here tomorrow with Lashanda for part two.


British Defense Secretary, war in Ukraine will still be going in a year's time. The war in Ukraine will be going on for at least another year. British Defense Secretary Ben Wallace told LBC. He stressed that Russian President Putin had already failed in his aim of fully occupying Ukraine with 97% of his army committed and two-thirds of his tanks destroyed. Ben Wallace said, I think Russia has shown a complete disregard not only for the lives of the people of Ukraine but for its own soldiers. You know, we are sitting here 12 months in and 188,000 Russian soldiers are dead or injured as a result of this catastrophic miscalculation and aggression by President Putin. And you know, when someone's crossed the line that they think it's okay to do that to your own people and is running effectively a meat grinder for an army, I think he's not going to stop. Wallace said that an original ambition of Russian President last February 24th was to capture eight main objectives, all the big cities in three weeks and he would have Kiev in three days and it would all be over. His three-day offensive is turned into his 365-day offensive and he has still not captured or held a single one of his objectives. The only objective he did capture was Kursom where he then had to leave a few months ago. So I think the goal of an occupied invaded fully controlled Ukraine of Russia has failed already. I think he's failed in the long run. The reputation of the Russian army is in tatters and he's isolated in the world. Even the Chinese treat him like the embarrassing uncle. They don't really want to speak to him if he adds it. The defence secretary admitted that some of the equipment the UK has sent to Ukraine is more than 30 years old, adding that this was a symptom of the wider budget problems of the British army.


Premature birth is the second greatest killer of babies worldwide after pneumonia. A report called Born Too Soon says one in ten babies throughout the world is born before the 37th week of pregnancy. As a midwife, Carol Precern assists women who are giving birth.  It's a devastating experience and it touches you. You remember people's faces. Carol Precern works for the Partnership for Maternal, Newborn and Child Health. She says much can be done to prevent premature births. You make sure people are not having their babies too young. You make sure they have pre-existing conditions like if they're too underweight, which is quite common in the developing world as you'd know. You've got to also look at if somebody's had a history of a preterm birth, they need much more attention. You want to look at the spacing between births so you don't want people having their children too fast because that can lead to prematurity. There are simple things that can help a premature baby survive. You can give the mother steroids. Before the baby is born, that helps the lungs to mature. That's a very cheap, very cost-effective intervention. After birth, the baby can be placed on the chest of the mother. This kangaroo care method keeps the baby warm. Dr. Joy Lawn works for Save the Children. Kangaroo mother care, even compared to care in an incubator, halves the risk of death. The report says the number of premature births is increasing in both wealthy and developing countries. Christopher Hausen is with the March of Dimes. Over 60% of preterm births occur in Sub-Saharan Africa and South Asia. Wherever a baby is born, the child can have health problems if the birth happens even a few weeks early. Experts say they want to better understand why babies are born early, how to reduce the number of premature births, and how to help premature babies survive. I'm Shirley Griffith.