uh we've been doing this show for like 12 years and for those of you who were just joining for the first time today I'm sure there's nobody like that but I'm gonna say it anyway because we're recording um we were doing it like almost every day in a row when the pandemic when lockdown first started and now we're you know we're taking it easy by just hanging out with you every week um the idea is that we hang out every week we share juice and um then hopefully during the week you can we can all sort of roll the wheel forward as they say and so what this is is basically we just work together and we work together for 20 minutes and I have my old timer here and then we I take questions from you about your work and your creative process very important that it's your work and your creative process and and you know hopefully offer some suggestions solutions tips tricks of the trade if you have a question during the question time Audrey could you tell us how to get in touch got it so there are a couple of ways um if you are inside of the zoom what you can do is right so sorry is raise your hand you can do that by clicking the reactions button which is likely at the bottom of your screen on the laptop or the top of your on an iPad or a tablet click into that little raise your hand button it'll let us know you have a question we won't get to everybody's questions necessarily we kind of go in a in a popcorn you type order but we do our best um you can also ask a question online um by tweeting at at watch rework SLP with the hashtag howl round which is H-O-W-L-R-O-U-N-D or you can write to the public theaters instagram or twitter as well and we'll get those too i think that is all at the moment i think that's i think that's all okay we will we will begin hey here we are we're back we're back all right all right all right so so um yeah here we are ready to take your questions about your creative process anybody got any questions got a question you got two questions oh my goodness all right Kate all right did you hear that hi okay uh thank you first of all this is only my second time being here i'm really excited thanks for coming up sure so i i have a question that's kind of so in like high school college and grad school i was very active in like theater making communities um and i was writing plays and that kind of stuff and then like the past five or so years i've been focusing on other writing forms and like more active with poetry and then like copywriting day job kind of stuff and i realized that i was struggling to find an entry point back into playwriting because i had these like previously in all of those other communities i had an idea of like what stage i was writing for oftentimes what people i was writing for and like even sometimes i knew the audience i was writing for and um i feel like so often in like writing i'm like trying to figure out ways to take like to get more structure but here i feel like i had all these constraints in my mind and now when i try to write a play i'm like oh my god the whole world is there and i don't know where to start and i i think what's kind of funny is that after so many years of like writing these poems now and like performing and like all of that stuff i end up writing a bunch of dialogue into poems and i'm like does this actually just want to be a play and why don't i just let it so thank you no so that's really cool that you you did a lot of theater work and work in theater and theater writing and in the past several years you've done other kinds of writing now you're thinking maybe i do some more writing for the theater and how do you get back into it i would say you you know you can do one of two things you can imagine you're in your sort of old mindset like i know my you know you can imagine like i'm writing a play for this old audience you know and then once you write it it can be like you said for the world you know um usually i don't suggest thinking of an audience but if that helped you in the past it could be a good thing it could be a good thing to do if you don't want to if you're going no mike because my audience was seventh graders you know i don't want to write for seventh graders anymore for example then um just write just follow the characters i think that's usually the best thing to do follow the characters get really into the characters ask yourself you know what do my characters want what are they doing here you know what are they trying to to achieve you know um is that helpful i mean um are you thinking of like you want to join some playwriting groups or what are you thinking oh hold on one second yeah sorry there you go sorry um i mean i'd like to do that eventually but i think because i i still am like friends with a lot of people who are making theater i guess it's just um i wonder if when you come to an art form of writing which it can be so solitary from like such a like i don't know if i should say community mindset but like where when you're writing you're like well i have to do xyz to serve this purpose now i guess that it feels like i don't have like a purpose to do it um it feels really silly to say this out loud because i could write i could write a poem for you in two minutes and then be like it's done no purpose needed but now that i'm thinking of like how did i get to writing these plays before and it used to be well somebody needs a play or somebody like there you could have this stage for this weekend or something and so i would be like great urgency is here and i feel like there's a sense of purpose and now i'm kind of like well if it's not like serving a particular community it's a hard entry point to get into right right right so your your poems you say don't need a purpose did i hear you correctly yeah yeah so just pretend you're writing one of those okay but you have it sounds like you have to trick your mind a little bit you know we have to sort of trick trick yourself in a good way in a good way by saying like oh it's just one of those poems you know if you want and and with a lot of dialogue you know like you know i don't know shakespeare like those are long poems aren't they you know you can just you can just yeah but you can just you can just i mean i think the thing is is just to maybe maybe you can it sounds like you need a place for it you can create a place or you can create a place for it you can say this needs to be done by x date you can give yourself a deadline you can call up a couple of friends or or text them and say hey i want to show you a play that i'm writing by this date maybe you have other friends who are also writers and you guys can have like a a hangout time a presentation it can be informal you know it can be over zoom you don't have to leave the house you know hi i want to read to you a monologue from one of my plays that i'm writing you know you can create a community and so it will be for that like i'm writing it will be in service of that purpose i have to show up on your next wednesday at five o'clock on a zoom and read three pages to some friends of mine you see what i mean she can you can be you know and like we learned from beijing the snow can be artificial it doesn't have to be like a real thing it can be like a fake it can be fakes fake snow works just fine i guess i'm not watching the olympics but i just read the little headlines um but you know what i mean yeah you can sort of create a community and and i'm sure you said you you're still in touch with some theater makers yeah okay well that could that help like yeah that's a really good point yeah and you can each share so it's not just all about you you can say hey i'm going to read three pages you read three pages you read three pages and then we you know hang out and talk you know thanks yeah that framework of like this is in service to this yeah these parameters is helpful thank you so much oh sure sure sure thank you thanks for showing up okay um all right let's go to crystal they play crystal how you doing i'm good how are you i'm fine how are your barbies so look at you you're laughing oh this is good this yeah because your um idea of making them talk to the dolls has opened a whole conversation that i mean i don't even think i've thought about like how powerful sub-tex is when you're when you have dolls talking and you get to really hear what people are thinking behind the mask of the dolls so it's it's been kind of like mind-blowing um so it's and like now i'm almost i'm kind of i'm almost done but i'm not done um because i'm kind of like it's it's almost gone in a completely different direction as to when i began the play and the whole you know when we were talking about like um if it was from my voice it's okay you know um and so i'm like okay so before this whole thing with the dolls being a part of this play um i think i had a clearer voice of what i was trying to say through one of the characters and now like these dolls have kind of like possessed these people that like i'm kind of like lost as to what the the uh the argument is that the arc is the like kind of getting to the i think i lost some some voice or maybe of my own voice maybe i needed to be not there but like i'm i'm kind of having some trouble um kind of while solving the situation of um of of some hard truths with ken and everything like that like ha ha ha that's really funny i kissed off some hard truths okay so so what so once you quit you know let it rip girl because last time you were like i don't want it to be too much of my voice i'm like let the dolls talk play the dolls now you're like oh no it's not i don't know it's not my voice so i don't know where it's going on just go with it look you're laughing you're smiling it seems like you're having fun writing it's yeah one you're having a good time you know they're trying on lots of clothes i hope i hope for those barbies they get to be like i have a date tonight or whatever i think one it was one barbie you should always have a date i'm like dang girl you know i have a date tonight so um you know let them have a good time yeah maybe it ain't about kin maybe they kick kin to the curb it's time to kin is you know kin is the patriarchy i don't know i'm being silly but have fun i mean gee it's barbies i mean really if you and if you spend that much time like walking like that on your on your feet like what's that about right does anyone have any back problems i don't know like you gotta walk like this all the time have fun you know and just you know you can pick like 10 like you can make a list 10 stupid things that can happen by the end do you have a not end already no i have nine you just write a list just make a stupid list 10 stupid things have to be stupid it can't be good it can't be good or profound it can't be deep it can't be meaningful um they have to be stupid like stupid in a good way right do that make a list make a list oh it's fun and like and and pick one and say oh i like this from the best and then just write toward that and and not worry about the time because it has to be 10 uh 10 maybe maybe you won't do the assignment okay it's okay okay you're free my sister is let me worry you don't have to do the assignment not now not here run come on now's the time yeah i mean you know i mean sometimes you know you need to well you know what i'm saying yeah i do have to admit it to a place yeah when when i uh in like in like a month and a half okay and if it's you know what i mean if it's 20 pages just take the first 10 and submit those and oh you never know don't don't worry about don't don't don't you know enjoy your laughing you're having fun okay okay okay thank you you're welcome thank you crystal all right and we have got lu go brother hi hey good to see you hey good to see you again great seeing you i wanted to report the last time we talked i used the word tortured to describe how i was feeling uh oh and similar to crystal i'm actually having fun which is like what so that's like a breakthrough yay so further to this fun i wanted to bring this question to you because i'm writing memoir mm-hmm i'm writing about my mother mm-hmm she's been gone for 25 years yeah and the tentative title of this work is uh fat ghost she was a very large woman and i'm a large woman and only became large after she died and i'm trying to try and figure out how we're connected and where i begin and where she ends and it's also very funny like my mother was a hilarious person mm-hmm and i forgot how hilarious she was because i like she was sick my whole life but i'm this is my question i'm channeling dialogue for a person who's not alive anymore mm-hmm and i'm finding myself really having some complicated feelings about it but but also having fun and i think as i'm sitting here with you and an opportunity to talk about it i think i just wanted to talk about giving dialogue to people who are gone and what you think about it or maybe what i think about it um again i'm having a great time it feels like i'm talking to her for the first time in a real way in a very long time and i'm making myself laugh with the work which is like but it's hard i mean it's hard and deep work i'm trying to do um but she had this bite and so i use the humor to kind of cut it and some of the things i'm having i'm putting them in quotes but i don't know if she said that she said those things but i know she would have said those things if i put her in that position so it's also this dull thing you're talking about so i guess i just wanted to talk about dialogue with people who aren't here anymore and how we represent them and i don't know if i have a more pointed question than that i think that's lou i think that's a great question to ask if you're talking about respect you're showing up with respect and it sounds to me like you're showing up with best intentions right so um and that's you know when we when we uh write about people who are whether we know them knew them well like you had a great relationship with your mom or we don't know them at all there's someone from history you know or or an historical figure you know um i feel like if you show up with respect a lot of heart and best intentions then and get lucky it sounds like you have they will be behind you i mean she is behind you but she is behind you in spirit as well you're laughing you're enjoying you're feeling a lot of feelings you know you know and i'm sorry for your loss and it sounds like an amazing person but she's behind you she's you know giving you a lot of great energy yeah i i don't know i mean you would you will determine if you need actual the quotes again i mean it's not only you know i mean black history month the great thing about black history month is that we're all we all get to remind ourselves that we're free and we can be the vanguard of like we're free but when we say we're free we means all of us hello we remember you're free um if you come to it with with a good heart and and and respect and best intentions you are free you girl you run with it you know what i'm saying run with it she's so proud of you oh thank you and so grateful you know i mean come on you're putting her in a play i don't know she likes plays and whatnot but but what an honor what how proud she must be and again again i say at 100 times you're approaching it with respect and best intentions so i feel like she's talking i feel like she's talking to you because she told me last week you better make me famous that's what she said see see you're gonna make her famous she's gonna be played by someone fabulous right and she's gonna be like dang i never looked so good mom i mean really mom who do you want to play in the theatrical version of yourself who do you want to play you you know and she right what a what a delicious beautiful gift um so you get to be free um you know all right yeah all right that's perfect thank you so much thank you you're welcome so much what a beautiful question it's lean all right we got about 20 minutes left and we're gonna go to matthew go for it matthew hey matthew hey how are you first question i've been doing this for two years thank you so much for everything you've done it's been really just uh such such a boon such a wonder um early on in the pandemic while you were writing plays i was writing poetry wrote a few hundred um and then let them sit for about a year and for about four months i've been editing which i've learned is going to ultimately take me probably longer than than the uh the writing um but in what i've been doing is sweeping through the drafts um about 150 poems uh over 30 times and then only last week um did i decide a new approach uh which was just drilling into what is the meaning what is the purpose what what can people get out of this um last week when you were talking with crystal about having the doll speak that was a bit of a transformation for her just a chance for her to look at the work differently a new way so um now i've done my past looking at the purpose and i could go back to uh the incremental approach but just wondering are there in in the edit process general ideas about how to break out of one's mindset and be able to see a work in a new way approach it from a new way that's a great question matthew um how are you we we talked someone else let's talk about uh how how are you uh doing the rewriting are you reading them silently to yourself are you standing up and reading them aloud are you sitting and reading them aloud how are you going about it uh different ways uh on different times but i've definitely been reading them and and certainly how the words sound is is a very haven't stood up i mean it's it's of course it's optional i just i just think getting the body into it is is a great uh way to hear it um in a more in-depth way sometimes i was talking to a student because i teach at nyu today he was had a a character who's a tennis a former tennis pro and i read on stage and i pretended i was holding my racket you know there you are with the tennis racket and sweat you know i said have you done this you're writing no not yet you know so that that kind of thing get get get your body into get your body into it as much as possible and are you thinking about like um where it might for lack of a word go what you might do with it um because please we can think of what we can find people to perform them have you have you've been thinking about that yeah rather extensively actually um in some ways i'm a little concerned about the idea of having poetry readings because people tend to feel a little bit withdrawn from the idea of going to things like that it's a very very eclectic and small group um so i've been exploring the idea of using an autotune uh in in how how i read and and i play music so i have a a looper on order and might be building up some loops which could go with music but also with the words so yeah i certainly want to experiment um i've learned because i've also done video art that um building works uh while you're still editing means sometimes you end up creating something and only to find that uh the work is changed and then it's just a matter of whether to start from scratch but yeah no that's that's certainly something i love those ideas i mean you you play music you're or you're getting a looper you're you've done some video work i mean it would be a cool project to have online too you could just like post i don't know one a week and just kind of do it differently every time um that would be really cool to to watch you know there you are like i don't know where in washington square park doing it and someone's filming you with you know their iphone um and then you could do a lot of i don't know it could be a really cool way to get the work um out there can be really beautiful and fun since you do that that kind of work already you know the video stuff the music stuff right that's great it could be fun and the thing about uh you know editing if you're you know shaping it and shaving off you just you know where you sort of like feel like oh this one's dragging you know maybe it needs that one's a poem that needs work you know or this one feels like it's really happening okay that's are there different lenses that you've used to uh revisit the same works if you're going back time after time to revise i i mean i get i use the body for for me it reading aloud and i prefer standing up but you know it's just me reading aloud and getting my body into it is the best way to feel it so that i'm not just operating from the neck up going that's great i'll try that yeah it's just it's also kind of fun and you're practicing performing it you know and performance poetry you know online is kind of cool true facts right thank you so much thank you matthew great question thanks Matthew we've got about 15 minutes we don't currently have a question oh god so we can enjoy checking on twitter just to be sure oh rebecca go for it hi everyone hi susan lori hey rebecca hi all good to see you sis yeah it's good to be here thank you for for making time again i sometimes walk past the public theater thinking longingly of being in person someday again right yeah yeah but this is this is almost uh it's good in a different way i you've you've written plays that have historical content and i i was writing along today and once the timer went off it was like i wonder if there's ever too much history in something that's historical like i i talk with people and i'll mention something and they have no idea what i'm talking about so then i think well i've got to explain it in order to get to the point i want to get to so and i i'm having a little trouble there's one section took a really long time to write that i i sort of knew i had to explain it um but now i'm in a section where it's like do i have is this necessary so i'm not quite sure how to tell i'm trying to remember is it you were writing a novel that was just dork i'm trying to remember no it's it's um memoir no tell me it's part memoir part um why they did it um i mean it's it's set in the jim crow period okay okay okay okay yeah so okay so right so there's a hmm it's sort of you mean bringing people up to speed who might not be aware of some historical event or situate or context yes well so the example i can use so you know during last summer i was writing about um cotton gins the only reason i was writing about cotton gins is not that i didn't know what they were is that they were used to torture people and enslaved people and that was an that's an important thing for later in the piece the manuscript so i understood that well now i'm in a trying to contextualize 1937 kind of Memphis Tennessee i just don't know how much i i should i can say or you know at what point are my readers going to go please stop i hear you know i i know i totally understand um in when i think about and this might be a similar thing with with um dialogue and exposition in a play sometimes there's a big a whole hunker bunch of information that the audience needs to hear to to to understand what's going on um and the characters either know it already or right so that's tricky and when we don't do it as well it's the characters just talking and then i went to the store and then you know she's like no i move it along move along move along but in in my experience if you tie the exposition and this is again with with dialogue and if you tie the exposition to the character's need or to a character's need so i have to tell you i went to the store because then you'll know that i was out in the rain okay you see what i'm saying so this character has a need to tell this because there's something else to understand so if if with historical information if you tie the historical information to a character's need make it part make it an integral part of the character's journey dramatic journey or story journey you see then it will be part of woven into the fabric of the story instead of just a piece of historical information that you kind of got right it'll also be juicier and you might find oh i only need to tell like half of it because these three these three things you know that makes sense yeah it it does and um yeah i think trying to figure out how to i'm trying to figure out how to introduce a journalist um but i feel like i have to go all the way back to john brown and explain kansas um okay well it's because memphis in 1937 didn't have any black newspapers they all came from kansas okay yeah so okay so in my mind it all is really important and i so so tying it to one of the recurring characters is probably i hope it would help me make it interesting and and necessary to i think so and then and then we will most of us won't even feel that we're being you know told something that isn't necessary because it's necessary to the character and the character is necessary to the story i mean i mean you know shakesburg that it's kind of it's a it's a it's a technique you know mm-hmm you know um there's a lot of exposition going on in in a lot of these plays and novels that we think oh wow this is such a great detail the novelist is just being you know smart about giving you the vitamins with the ice cream right you know yeah yes mm-hmm yeah and see yeah just maybe also write down the sort of um maybe three things that you really need to cover to to understand the period three things boom boom i say okay is there a story a little story there mm-hmm is there something that happened to somebody who's a relative of somebody already in the story you know mm-hmm and when they see this with memento from this person they think of those those things that what when that happened to so-and-so you know and then you'll also it's a really effective way for the audience to understand or for the readers to understand the historical information because you put it in the context of a story you know we think about like um uh the iliad you know and the history of the trojan war you know it's not trojan war history it's the iliad you go wow the iliad is rocking you know you know we know a lot about history but it didn't come to us like in historical text you know mm-hmm came to us like a story yeah yeah well i have to say some of this has gotten clear because i i actually did what you know you have told us to do in the past yay so there's only so much you can jam into a index card three by five right yes right yeah so yeah and i was talking to someone today who said um you can take it to another level and use one syllable single syllable words on the index card so you really have to be like it could be fun just as a game you know not a you know just a focus even more yeah uh the wordal the wordal way to a historical memoir i love it sounds like it's really coming along rebecca it is it's got to because i want to be done so there you go that's important yeah i want to be done i hear that yeah thank you thank you thanks great questions thank you nice to see you all right we've got about five minutes left and we are going to go to lin go for it lin i'm doing oh go ahead there you go now i can say god i've missed you hey likewise how's your fam how's my family yeah your sister uh she's gone i'm sorry that's okay yeah sorry yeah um i've been writing i've been i've missed you so much i've missed the group and and you know it's so nice to see crystal you know coming along and you know and so many others carol is here and just you know anyway anyway i've been writing ten minute plays right on you know because uh i took i took the play i was writing and i i started just writing um i thought i'd find out more about it if i wrote it in um you know as a story you know somehow it gets deeper if there's it's like you said about that writer who you know has all of these um um as the specificity and and the who the language of of uh sometimes sounding pompous but you know art and uh you know um and it's really helped in terms of going deeper into the story and the characters just to to write it as as literary rather than a play and then i started just writing ten minute plays just to get away from the play what do you do with ten minute plays right you know these little sort of uh mind burps plays you know what do you do with them how do you submit them where to submit them that's a good question crystal knows i think she knows i think they're i think that's like an online question i think google would know you know i think there are a lot of ten minute play festivals out there because what with um you know people want to theaters wanting to be as inclusive very very inclusive in communities and people having short attention spans they want to include lots of different kinds of people lots of different writers i feel like there are a lot of people interested in doing ten minute plays these days i don't know off the top of my head you know i i mean not that they have to be seen it's just that it was a great exercise in in finishing i guess the word is finishing you know the beginning middle and end and um can you think of like if would it be fun to have you know even zoom readings of them no that's fun no what i mean just like because you you know folks in theater you know invite your friends to just have like again like a weekly like hey let me read even let me read some of my plays and someone else read some of their work and like that do a a zoom like that or bring in some people to read your work that would be really fun you know it's so funny because i've done so many zoom readings over the last what is has it been two years yeah yeah god god and zoom readings are so very strange because uh uh they're good to hear hear the the words and the and the play but they're not a performance in the sense of uh interacting you know it's it loses something i mean it's sort of like what we all miss which is communal hellos you know uh this is being here is kind of like getting a great big hug from you you know what i mean and we miss that you know it's two years that hugs i hear you i know i know but that's a good idea i i could do that yes but really congratulations on writing those and getting to finish because there's something really um amazing and it feels so good to write you know type the end you know um and then go on to the next one yeah some of them i actually start with the end oh i mean i know that sounds terrible but i'm the 10th at the end and it makes me somehow finish it right right right right it doesn't mean i have no um judgment of it you know bad good or indifferent it just like you said you know i put a timer i have an idea i babble and the end it's a wonderful feeling it's great to see you learn it's great sorry i'm sorry about your sister yeah me too thank you sure i love you i love you too well it is six o'clock can you believe another perfect day great scene you know yeah we'll be back we'll be it's gonna be valentine's day next day it is okay we'll be here we'll be here maybe we'll be eating chocolate mmm yes let's do it yeah see you all next week okay thank you thank you so much thank you


Okay, now in the theory, our interior app lab, we always the same, we need, here is only the extract from the MSP file that we initializing the interrupts. This is necessary, if the interrupts is missing, you cannot work with the interrupt anymore. Because as you remember, we first need to enable the interrupt on the payfray and also in the nested vector interrupts, vector controller. Yes, now we have also the handler, like before in the XT tab, which is automatically handled, the HLIB for us, clear or debits, which are necessary for this interrupt. And we know how to search the callbacks, it's in the ur.c, in this case. It's in the related payfray.c file. Okay, in the related payfray.c file and define as a weak. Here is only show summary of the ur.c callbacks. We have the standard MSP init and the init used with the kubemix. And then we have the transmission and exception callbacks and error callbacks. This callbacks are used only in the interrupt lab, in the interrupt part, some and some also with the DMA. Then the way we get also into DMA. And then the flow, it's a little bit different than in the pool. Then first we have the NVIC, we initialize the IT and then we call for example the receive with interrupt. And then we set in the state that we end with the okay, error with busy, everything okay. Then when we get the number of bytes or bit, we are notified with the user handler, interrupt handler. Calling the HL handler and when we receive a number of bytes, which we want, we are notified with the callback or we can get into the error callback in case that the error occur. And then it seems that the sending and receiving is very similar. First we initialize the periphery, we set the state on busy or error if we detect some error. And then when we receive the byte, we go into the interrupt handler, we check which handle belongs to our interrupt, we move data into the receive buffer, we increment again the number of the receiving bytes. We check if we receive all the bytes, if not, we end the interrupt, if we yes, yes, we receive all these bytes, we disable the RX interrupt and we go into the reception callback. And we also set the HL status to okay, that everything is done and somebody else can use the reception from the UART. Okay, in case that we get the error, we set the error type, we end with the error and we call the error callback. It's sim, still similar and we end with the interrupt. I hope that this section was useful. Then we move to the next lab and we start with the DMA.


What's the difference between me and you? What's up guys, thank you so much for watching my new sound effects video. Hope you guys are having a great day. Hope you guys are killing it out there. If this is your first time here, please subscribe. Be sure to give it a thumbs up. Be sure to leave a comment down below. I wanna know what your favorite sound effect is. Shout outs to Vera, the Chimera. You can check her down in the links in the description. And also, shout outs to Gigi Priscilla. They helped me make this video. Check them down, check them down, check them down, check them down. Shout outs to Lounge Studios in New York City, Max Jean and Jordan Mitchell, the awesome, awesome, awesome producers. Check out my Instagram, I'm most active there. Check it, check it, check them out, check them out. And look at this beautiful space. I will see you soon.


today we are having the pre-auth RCE chains by Jeff Hoffman. I've got a couple of announcements before we get started. Please, everyone, continue to wear your masks while you're inside, and please don't congregate around the walls, around the outside, just come in and find a seat. If you want, like, come up a little closer, that'd be great. Here's Jeff. Hi. Thanks for coming to my talk, pre-auth RCEs on Case SMA. Today I'm going to be going over what Case SMA is, as well as the interesting attack service of the product, the vulnerabilities that I found, how I conducted my research, and I have a full exploit and demo to share with you at the end of the talk. So who am I? My name is Jeffrey Hoffman. I'm a security engineer at Neuro. I have a background in web and desktop apps as well as cloud and reverse engineering. I love to do security research and exploit dev in my free time, and anything else that you might need to know about me if I'm willing to share it is on my website. So what are MDMs? MDMs stands for mobile device management, and they're typically appliances used by IT to manage corporate devices like laptops or workstations. The way they usually work is they'll install a privileged binary, usually referred to as an agent, on whatever workstation you want to manage. And that agent is going to phone home to the MDM, pick up jobs to run, run them, and report back the status of those jobs. And so the jobs can be anything. They need to run as root or system because sometimes those jobs require those privileges. For example, installing a certificate authority. But really, they're pretty versatile. That's the whole point is that IT can fully manage your device. That's good news for attackers. It makes them essentially single points of failure for an organization. You could, if you got admin access to an MDM, could do something like push out ransomware to all of the workstations at once. And more and more MDMs these days are on the internet with the rise of COVID and remote work as well as the push for people to offer software as service offerings. Some of those MDMs just have to be on the internet out of necessity. You also, so you have this great impact. You have them generally being available if you support remote work. And you have this really, really interesting scenario where if a company dog foods or uses their own MDM, you could get into their employees workstations, start pushing malicious back doors, and even reach people who only host these MDMs on-prem. So generally pretty interesting attack service. Case SMA or Case Systems Management Appliance is an MDM developed by Quest. It's written in PHP. It's a relatively popular choice for hybrid work environments where you have Windows, Linux, and Mac workstations all in the same organization. There's about 2,000 of these things on the internet including a SaaS offering that Quest hosts. And a decent chunk of these are .gov and .edu domains which implied to me that you might have a lot of very interesting PII readily available if you were to compromise something like this. So in terms of what would be valuable, admin access is really the end all beyond for these types of appliances. Every vulnerability that you find is more of a means to an end to get admin because at the end of the day you don't really want to exploit any kind of vulnerabilities on the MDM itself. You want to use the intended functionality to pivot down to multiple devices at the same time. And just a little caveat for all the vulnerabilities I'm going to talk about. I didn't look at anything that would require user interaction. I felt like that was less interesting. And so I have no idea what it's out there in terms of XSS or CSER for those types of bones. So because Quest or rather case SMA is written in PHP, getting an initial unrestricted shell was my top priority. That was going to let me pull all the PHP code off the box and then I could start source review and find more in-depth vulnerabilities. And so I'm going to show you three tricks today that have generally been fruitful for me when attacking appliances. Your mileage may vary but I always try these three things. So the very first thing is just trying to break out of any restricted shells that might have been implemented. And so I just installed case, I read through the docs and there were two default users, config and netdiag. And so they both had restricted shells. Config was more of a text editor to change network settings and it didn't have an immediately obvious way to run binaries. So I moved past that pretty quickly. And netdiag did have a more typical restricted shell. So I gathered all of the binaries that you could run, ran them through GTFO bends which is a website that collects shell breakouts. And the only thing that I found was this ARP-F partial file read which wasn't super useful for my case because I wanted to read full PHP files, not partials. So this, that first trick didn't work. This second one is going to sound a little tongue in cheek but a way that I always try to get my unrestricted shell is to look for post-off RCE. And the nuance here is where that post-off RCE can usually be found. Typically appliances, not just MDMs, want to have some sort of backup and restore process. That way you can support migrating to a new appliance if you need to or just generally backing up what IT has already set up, right? But the issue is a lot of times those backups and restores are implemented as holistic backup and restores. And so if they include anything important in them like maybe a binary or a very important config, if there's no integrity check on those backups, you're going to be able to overwrite it. And from there it's context dependent usually but the trick is just looking for important things in backups. And so in the case of case there was the web route actually included in the backup. And so my first unrestricted shell came from just planning a web shell in a backup and restoring it immediately. So I got access as www, which was definitely great. It was a good start. This is, you know, not to beat up on quests, this is just a really hard problem to solve.  It's generally hard to sanitize those backups. The integrity check is probably the way to go. But it just generally is going to be a fruitful attack service for those reasons, combined with the fact that you almost always need admin on the appliance to trigger this functionality anyway. And the separation of privileges between being an admin on an MDM and being able to get RCE on it is, you know, almost non-existent. The admin is the more important feature. And so RCE is www is definitely a great start. But ultimately you're going to want root to poke around a little more invasively. And so from here I could have either looked for privilege escalation or, and this is what I actually did, is try my third trick. And this third trick is essentially the same as the backup and restore process, but you don't go in through the application. It revolves around the fact that if you own the appliance, you own the virtual machine's disk, you can simply unmount that virtual machine disk, mount it in a new virtual machine of the same operating system, and start overriding whatever you want on that file system. And so I targeted NDSH, which was the name of NetDiag's custom restricted shell, and I compiled a setUID wrapper around BNSH, set the setUID bit on it, CH owned it as root, and I overwrote NDSH with it. Once I logged in as NetDiag, I was given a root shell right from the getco, and from there I could do all the really nice tabs like adding a new user that's root equivalent, enabling SSH, and generally I was able to be a little bit more invasive. So the first thing I did was gather all of the PHP code, and I also took this opportunity to just orient myself in the application. The logs directory was incredibly helpful, just prepping for strings that I saw in source, and using that to validate assumptions. But just with root level access, you know, there were no files that could hide, I could read everything, so I just spent some time trying to figure out how the appliance actually worked. In terms of attack surface, only 80 and 443, so the web UI, were open to the world by default. There was this high end port that was exposed during the update process, but it was just a Golang binary that served a update log, so not particularly interesting. And so because only the web UI was exposed, I could gather all of the unauthenticated attack surface by making a word list and just using Go Buster to brute force over all of the files that were accessible in that web route. You filter out the 403 forbidden, and you have a pretty good list of where to start. And that approach is great. It was definitely a great start, but it's a little naive, and you can do better by looking for the actual requirement statements of the authentication checks. And so in this example, at PHP, the way it imports code is through the key word require, and you can imagine auth.inc includes all the auth checks, but generally you're looking for the imported file, and you're filtering out all the files that actually include it. And so that will give you an actual source of truth rather than this Go Buster method. The list generally didn't differ that much, but this is just a little bit more reliable, and you should note that it's not going to include recursive inclusions. So you can imagine auth2 includes auth. You're going to have to grab for things that don't include auth2 or auth1. So at this point, I had a post-auth RCE, and I started thinking about whether or not an authentication bypass would be enough. And unfortunately, I didn't feel like it would be at the time. My post-auth RCE already required admin privileges, so that was already goal. It wasn't really an extra vulnerability that I wanted, and that meant that I would need a post-auth RCE with less privilege requirements, or I would need to find a privilege escalation within the app. So I went hunting for those types of vulnerabilities, and there were calls to extract all over the application. And if you're not intimately familiar with PHP, that's okay. A screenshot of the extract docs can be seen on screen. There's this big warning that says, do not use extract on attack or control data, and that is because extract, by design, overwrites the symbol table in PHP. What that means is you can specify an attacker-controlled key and an attacker-controlled value, and if those are passed into a call to extract, a variable with the attacker-controlled key name will be instantiated, and it will be set to that attacker-controlled value. So that's generally pretty useful. You can define whatever variables you want, but the cooler thing is that you can redefine variables that already exist. And so two really great targets to go after are the globals, because they'll always be there, and the session variable, because that's how PHP tracks your identity. So an unauthenticated call would let me set all of my session variables to whatever I wanted, essentially creating a full session from nothing. So that would have been a great one-shot vulnerability to have, but unfortunately I couldn't find any unauthenticated uses of extract. Luckily, though, it was still called in about 100-plus places with attacker-controlled data throughout the app, so tons of different exploit strategies. One cool one was you could bypass 2FA, because your 2FA configuration was set within your session, so you could log in, hit an endpoint, and say you didn't have 2FA, and you're good to go. The thing that's going to be really useful for this talk, though, is the direct privilege escalation. And so in case they defined all of their permissions as just integers, and they mapped to different roles, and so exploiting, or privilege escalating, rather, is as easy as going to a vulnerable endpoint. So I'm picking on maillist.php and setting your KB permissions to whatever number you want. And you can just declare yourself a global sys admin, and you are good to go, and you can start using all the admin functionality. Now, I didn't pick maillist.php at random. This is a pretty interesting file. I looked all over at these calls to extract for, like I said, ones without authentication checks, and I didn't find any of those, but maillist.php had a lighter authentication check than normal. And so it's not important you understand what the full authentication check looked like, but what is important is that you understand checking for KB valid user session was one of many checks that Quest intended to do. So this is just an ad hoc partial authentication check that essentially meant you logged in, not you had a fully realized session. And so that just lowered the bar ever so slightly in terms of the kind of authentication bypasses that would be useful. Now, I have post-auth RCE. I have a great privilege escalation, multiple endpoints in the app, so I'm going to be able to hit admin and even trigger that RCE. So looking for bypasses or authentication bypasses is now worth the time. So here's the first one I found. Essentially, Quest appeared to use MD5 and SHA1 password hashes once upon a time. That was no longer the case when I looked at the app, but they did have to leave the legacy comparisons in so that users who had created their account when the password hashes were MD5 or SHA1 could still log in. Essentially, you'd log in if one of these checks succeeded. They would rehash your password and it would be rotated. And so what that code review told me was there wasn't going to be any MD5 hashes or SHA1 hashes readily available, but if there was one, say an old account that had never had their password rotated, the loose comparisons there in that code block on screen was significant. If you're not intimately familiar with PHP, that's okay. It's dynamically typed language and equals equals is the loose comparison operator as opposed to other languages where you would normally assume it's a strict comparison. And so what that means is PHP is going to try to infer the actual type of the variable it's looking at, and that's typically referred to as type-draggling. It'll try to coerce the value to a bunch of different types, and if one of those checks succeeds, the entire loose comparison succeeds. And so there are three examples on screen right now. Those two bullets in red return false, but the bullet in green returns true. And that is because in PHP, well just generally, a number and an E is interpreted as scientific notation for exponentiation. And so when you have a hash or a string that starts with zero E and then has all numerals after it, during that type-draggling process, PHP will interpret that as zero to the power of something, and zero to the power of anything is zero. So if you have two strings that aren't actually equivalent strings but are of that magic hashing format, when you do a loose comparison between those, it'll evaluate to true. And so I said that there probably wouldn't be any, you know, SHA-1 or MB5 hashes in the database, but I needed to go and check anyway. So rather than recovering the root password, I just restarted the database without authentication locally and added a root equivalent user so that I could poke around. And when I started looking at the actual password hash table, it confirmed my code review. There were these new actually salted hashes for passwords. And that meant to actually test. I had to add a new user and fake them having an old MB5 or SHA-1 password hash. And so I planted this zero E 333 value. I have no idea what could possibly hash to that value, but it is of the magic hash format. And so to test, I used a precomputed value whose MD5 hash is going to, the output is going to be another magic hash. And the hunch was that when those two things would be compared, it would evaluate to true and I could log in. And so in practice, after I planted that magic hash, I just submitted the precomputed value as my login password. The hashing went through. And you can see in the location redirect, I wasn't kicked back to the login screen. It actually took me to a dashboard. So I successfully authenticated. And just to confirm my code review, I went and looked at the table afterwards and the password migration did actually happen. So this vulnerability effectively amounts to a password change. Now, this is super cool and definitely an authentication bypass, but it has a few issues. So first off, you have to get lucky. There's no way to control what somebody's password hash is going to come out to. And so you're just hoping that whatever someone has submitted will somehow hash to this magic hash value. There was one interesting code path that made this attack a little bit more plausible. Essentially case they supported importing your entire user directory from LDAP. And how this seemed to work in practice was you would point it at LDAP, all your users would get imported, but they were imported as unprivileged accounts. And it seemed like what you were supposed to do was give the accounts that actually were supposed to access this app privileges manually. But during that import, the password hashes were actually set to MD5 values. And you're importing your entire user directory, so not only do you have one MD5 value, you have tons and tons of these unactivated accounts. They don't have any permissions, but because of that ad hoc authentication check and mail this .php, that doesn't actually matter. So when you log in as one of those deactivated accounts, this is what you'll actually see. You get kicked out to the login screen and it says access denied. You are not authorized to access any of the tabs. And even when you look at the request and response, it appears like the login fails. You can tell this because it's resetting your Kbox ID, which was the session cookie. And so normally when an app does that, it's saying like, hey, restart the authentication flow. This did not work. But if you look at the session on disk, it actually has KB valid user session set. And so you can resubmit that old session ID, hit mail this .php and privilege escalate to admin just from these unactivated or unprivileged accounts that were never really supposed to be used. And so this is definitely a fully plausible attack scenario, but like I said, you have to get lucky. It requires them actually using this feature. And the odds aren't even that good if they are. So I moved on looking for something better. The second authentication bypass I found was definitely slightly better in terms of exploitability, but it was a non-default feature. And so Quest doesn't make just case SMA. They make a bunch of different appliances. And one thing that they wanted to support for all of these is this magic login. And so you would pair two Quest appliances together and they would generate tokens for each other that were redeemable at the other appliance.  You've redeemed your token and you are logged in as your user, but in a different appliance. And the token generation can be seen on screen in bold. It is an MD5 hash, but there's no magic hashing going on. The real issue is that the input is essentially guessable. So unique ID is taking two arguments. The first is prefix. The second is more entropy. The more entropy does not actually matter for this attack. But the prefix is generated by microtime. It's just the current time of microseconds. It's definitely not a secure, you know, random value to use. And when you look at the unique ID docs, you see that most of unique IDs entropy also comes from the current time in microseconds. And so you essentially have the randomness coming from two calls to a totally guessable value.  But you would just continue to iterate until you guess the right token. And so this is definitely more exploitable than in practice. There's no luck involved. But it's non-default. No one's forcing anyone to buy two quest appliances. And even if you have tons of quest appliances, no one's forcing you to link them and actually use this functionality in the first place. So those are two of the three chains that I wanted to cover. They're not so great. They're really not reliably exploitable in practice. But the third one I'm about to cover is.  And after I was done with that, I turned to the agent communication. My hope was maybe authentication was implemented a little bit differently and I could find some more authentication bypasses there. And I actually landed in this file .php. And there was clear command injection, but it was behind this ad hoc authentication check where you had to submit some secret parameter called serve. And so the command injection should be clear. Org ID is attacker controlled. It's taining temp location, which taints zip name, and then both of those variables are used in the call to exec. So I started digging into how serve was created. It was the only thing stopping me from triggering the command injection. And as it turns out, serve is the hashed serial number of the appliance. It's essentially meant to be a bootstrapping secret for agents that I guess just wasn't unique to every agent, but that's a little bit easier than making a unique username and password or doing something else. So it was like that for convenience. But it was also good news for me. The serve parameter was the SHA-256 hash of the serial number. And so an unauthenticated LFI would work because the actual function that retrieved the serial number just read it from disk. So if I could retrieve the serial number like that with my LFI, I would be able to calculate serve myself and I would be able to exploit the command injection. Unfortunately, depending on the installation type, there was one, the serial number would be stored in one of three places. And one of those file names had the MAC address of the device appended to it. So I would need a way to leak the MAC address of the device before I could actually exploit this in the worst case. Luckily for me, when you log in, the MAC address is presented to you. And that contents of the message is actually stored in Etsy issue, which is world readable. And so if you had an LFI, you could read Etsy issue, pull the MAC address, then you could read that file name in the worst case, pull the serial number, and calculate serve to bypass authentication. Now knowing that, I went around and audited high and low for unauthenticated LFIs and I came up empty handed. So I took a step back and started thinking about what I could use as an LFI equivalent. And as it turns out, the SQL queries made by the app were being made as the root user, which meant that if I could find SQL injection, I would be able to use directives like load file to read contents from disk. And depending on the SQL injection quality, I would be able to use that in the same way I'd use an LFI. So a single LFI was all that was needed and this code block on screen is actually in the same file as the command injection, but it comes before serve, or the check for serve rather. So technically it's unauthenticated. And it's not important that you remember exactly what's going on here. What is important is that you remember validate org comes first and validate agent version comes second. If either of those queries fails, the app 404s and it'll exit immediately. So validate agent version has clear SQL injection. You can see org ID is just directly placed in the SQL query string, but validate org is going to come first and unfortunately org ID is properly parameterized there. So when I was doing code review, this looked unexploitable. Org ID is the ones stored in the database are stored as integers and so I can't make an SQL injection payload out of integers. Luckily for me though, I was just spraying around some testing payloads to actually locate the relevant logs and I had accidentally hit the SQL injection invalidate agent version. And I didn't really understand how that was even possible, so I had to work backwards from this. But what had happened was MariaDB actually type juggles. And so this is in their docs. It's some convenience feature for strings with differing units. An example use case of this feature is on screen. It's inferred that the developer writing this query really does want to operate on these two values with differing units and so if it sees a string that starts with numerals and then contains non-numeric text, it interprets that as units and it will just drop them. And so the validate org query looks exactly like this. If you just append the SQL injection payload, it will get dropped. And MariaDB happily treats that as just a one and the query actually returns successfully. So pretty cool. So that means that we can actually hit the SQLI invalidate agent version but there are still a few issues that we have to work around. So first off, SQL responses aren't visible. Secondly, base name is called on org ID, which means that we can't directly pass in paths of the files we want to read like etsy issue because the payload will be truncated. And finally, org ID has to actually be valid SQL and command injection because we need validate agent version to succeed when we actually trigger the command injection. So to start working around that, the first thing I did was create a blind SQL oracle and I essentially abused the behavior of that immediate 404. So when queries fail, the app 404s, when queries succeed, the app eventually returns a 200 and so just by looking at the HTTP response codes, you could infer the outcome of the comparison in the SQL injection. Now that's definitely useful but we still have to get around that second constraint of base name being called and so the way that I did that was just using the concat directive and so all this is nested within a call to load file but 0x2f is the ASCII character or the integer value for ASCII forward slash and so that output of the concat call will result in etsy issue which then could be passed directly to load file. Now I still need to pull out single bytes to make my oracle useful and so the way that I chose to do that was dynamically rather than hard coded offsets and so I used locate with load file in order to find the starting address of the actual things I wanted to brute force and then I used substring to pull out a singular byte and then I could just brute force the MAC address and serial number because they were alphanumerics, so relatively small search space. And the full strategy as I just described it will work. You can use the SCLI to read your two local files, calculate serve and then you can trigger your command injection. We just have that last pesky issue of needing a payload that is valid SQL and valid command injection and so the way that I got around that the payload can be seen on screen. Essentially the semicolon delimits SQL. I used hyphen hyphen which is a comment in MariaDB. You can't use the pound time because it'd comment out your command injection and then the dollar sign and parentheses should be pretty recognizable and to get around base name for payloads I just wrapped it all in base 64. And so from here I could trigger my RCE unauthenticated as www but I really wanted root just because I thought it would be more fun. And so I ripped this methodology straight from the OSCP. I just looked for custom things running as root and there were a few PHP files that I immediately started looking at because they were going to be really easy to audit. And so one of the things that I looked at was called KB server. The long and short of it was it listened on a world writable Unix socket and it was listening for commands in the form of command, argument and argument. And so there were a bunch of different handlers or commands that you could run. One of the interesting ones is shown on screen now and it does essentially what the name of the command applies. It takes an attacker controlled source, moves it to an attacker controlled destination and then for good measure CH owns that is www. And so that is relatively straightforward logical privilege escalation. You could override an important binary or some important file but I chose to abuse the command injection that was in the actual implementation of the handler. So here's the current state. The two chains on the right and left aren't really reliable or so great but the middle one is and you can execute commands as fruit from an unauthenticated perspective. And so now I have a demo to show you. Oh great, it's already up. All right, so the first thing it does, the first thing it does is check that it can trigger the SQL injection. That's so it knows if the appliance is vulnerable or not and right now it's just using the techniques with the SQL I to leak the MAC address. After that it starts leaking the serial number from the file in that worst case which is what was used in virtual box installations. And so kind of interesting to note that the timer that you see spinning is actually getting spun every time a response comes in and you can see it hang on the successful guesses because case does a little bit more processing. So even if we couldn't have made this Oracle we could have done a timing attack or maybe some other technique to leak this data. And so after this finishes you're going to see it run commands as root. It's actually going to set up a set UID bash shell so that I don't have to go through two command injection contexts. It makes running payloads a little easier. And it's going to happen really really quickly. It's going to make a new admin, make a script that gets pushed out to all of the devices in the org. And that script is pretty mundane. It's just going to change the background to that cowboy cat picture. But it happens just this quickly. And in a few seconds you'll see that device that I'm running this payload on top of. It's registered in my org and it'll pull down that job, run it and the background will change. All right. And you know, obviously, thanks. So obviously a real attacker wouldn't do that. They would probably do something more malicious like deploy ransom ware. But hopefully that gets the point across. And so I should say the full exploit for that is available on my GitHub. It was also shared with the speaker materials. I defanged the exploit script a little bit. It didn't seem so appropriate to release something that just like works like that out of the box. But it does run commands as root. And so it's enough to demonstrate that these vulnerabilities do work like this in practice. Now in terms of detecting this, the general access log for case is actually good enough to catch all of this because org IDs are supposed to be integers and the initial SQL request is, our SQL injection request is just a get. So you can filter for any org ID that's not strictly an integer and you'll be able to know if the attack had actually happened. Now I have some closing reflections that I want to share with you. So first off, as much as I wish I could say this was new and novel work, it actually wasn't. Some firm called Core Security reported very, very similar vulnerabilities if not the same ones in 2018. And so the SQL I was reported and I never got to see this unpatched code. But my best guess is the fix for that was actually just parameterizing org ID in the first place. And that totally makes sense to me. I through code review missed that this would be exploitable too. So I could see how even the security researchers request, they all could have missed that. I definitely would have missed it too if I didn't get lucky. But it just goes to highlight the importance of explicit versus implicit sanitization. If you had done the explicit sanitization, this weird convenience feature MariaDB would have never have mattered. As far as the RCE, I'm a little bit more confident that this was new because the payload that they had shown and described didn't include this MSI parameter that was required to hit the vulnerable code path for my command injection. And so regardless of whether or not it was a reintroduction or maybe a regression, it was probably also assumed that org ID was never going to be attack or controlled like that. Again, that convenience feature in MariaDB really bit the developers in the butt. So definitely explicit versus implicit sanitization is the way to go. You just remove so much unknown unknown when you do that and effectively guarantee that you'll never have to worry about it. But both of these vulnerabilities together also for me at least highlighted the importance of defense in depth. I never would have been able to read files if SQL queries weren't being made as root and the exploitation would have stopped there, the command injection would have never been reachable. And so here's the total timeline for the disclosure. I contacted them on 420 and the very next day I had a meeting with the Quest team to explain essentially everything that I found. They were pretty concerned and responsive and they released a hot patch relatively quickly. And we actually mutually chose together to withhold the CVEs. So I haven't talked about any of the CVE numbers. They are out now, but I didn't get a chance to put them in my speaker materials because they were due a little bit earlier than the CVEs were released. But the patch was out on 511 and they sent very, very strongly worded communication to their customers consistently urging them to patch, patch acceptance was relatively high even in those first two weeks. And the CVEs were withheld essentially because the app's PHP. So patch diffing is almost trivial and it wouldn't really have been fair to those customers to release this very critical CVE and have the motivated attackers patch shift quicker than they can schedule a regular patch. And finally I just want to give some credits and thanks. So again it really pains me to say this, but credits to core security for beating me to this. I wasn't guided by their research. I didn't know about the CVEs until after the fact. Probably my fault. I would have saved myself some time if I had found existing CVEs before I'd started looking into this. And credit to Michael Spasek for making that pre-computed magic hash value that I used. And then finally I just want to thank Neuro which is the company that I work on now for giving me the opportunity to do such interesting and impactful work. And then I just want to give a huge thanks to John Novak who's a former co-worker at Pretorian. He taught me a ton about appliance hacking, showed me some of those neat tricks that I got to share with you today. And by extension, thanks to Pretorian for just being a great environment to learn in. So I will take any questions. Thank you for coming to my talk.


Hello you guys, so I just went to my fitting it is so hot like I can't even stay in the car right now Because I just turned it off But I'm just about to head into like a zip into Walmart because I need to get toothpaste and iron pills and it's so funny I just wanted to come on here and tell you this Randomly because if anybody knows I get this like rashy thing on the side this corner of my mouth If I don't take iron supplements and I looked it up before and it said that this can be caused by like an iron Deficiency so I'm like because I used to get this and then I was like oh why don't I just try taking iron supplements I tried and this goes away when I take the supplements But I have I ran out of iron for a week now and it's coming back and I'm like holy shit Is this actually caused my like do I have like an iron deficiency? I don't know but every time I don't take my iron pills it comes back and it's like painful itching weird But anyway, so I'm gonna zip in to get some iron supplements are literally just like iron supplements I don't need a prescription or anything. I just picked them up The funny thing is I didn't even realize I stopped taking the iron because I fill up my pill thing And I didn't realize I didn't put iron in there Then I'm like why is this coming back? I've been taking my iron and then I look and I haven't been taking it So it's actually kind of funny how this is actually happening because I have low iron or something But I don't actually know maybe I should get my blood work done actually that would probably be beneficial to me Anyways, it's freaking hot. I'm not complaining about it, but let's go in and get my iron because I apparently need it Fives are immaculate today by the way. They're just like Okay, so I just got home, but I ended up getting toothpaste I just use crest all very exciting I ended up getting my iron pills and I ended up getting bison because I'm running out and Bison I think it helps my hair. It's supposed to help your hair skin nails I don't know if it actually does, but I just take it for extra measure. You never know if it really does Every song that I made You guys I have a very exciting haul that I'm gonna be doing right now So all these pieces that I'm about to show you are from Revolve and I am going on a tropical vacation Very very soon So I decided to get a lot of like matching Pieces that are gonna look really cute for my tropical vacation So I'm gonna show you everything and I'm also gonna put all the links to the items down below But yeah, I'm so excited to show you guys because I'm in love with the pieces So thank you so much to Revolve for sending me all this. So here is the first set. I am Absolutely in love with this. It's very like vacation vibes tropical vibe I feel like skirts are just really in this year and I'm also obsessed with the pattern on this and This was just some sandals going for dinner at night or even just going to the beach is a vibe I'm obsessed. Okay, so here is the second set This is actually like a two-piece dress because this they're both like separate pieces But this attaches with the string with the holes in the back here So it's technically a two-piece, but when you put it together, it's a dress So anyways, this is so freaking cute imagine this going for dinner after your tan and just like Sun kiss open back here is so Cute and I'm just obsessed with like Matching sets like this, but yeah, I did get a lot of colors in this haul But I thought that I would switch it up with some black too because I always go back to like the neutrals and the darks anyway So yeah, anyways, this is such a vibe. I'm obsessed and here is the next set that I got I am actually Obsessed with this. I've probably been saying this word 10 million times today, but it's like crochet and It is so cute like if this doesn't scream tropical vacation set, I don't know what does this also comes in white and like rainbow I think but I have really don't have anything like red and pinkish tones like this So I was like, you know what I'm just gonna go a little bit more bold and I'm obsessed I'm so glad I went with this color and it's actually the cutest set ever I'm gonna have to take a really cute picture in this for sure Okay, here's the next thing like God So I got this dress and it is so freakin cute Just like the color pattern on it is so different It kind of looks like an art piece honestly to me and the cutouts are so cute It's so flattering and I don't have anything that's this type of neckline So I love how it's kind of like a one-shoulder, but it kind of crosses over like this I find it's so flattering and cute and Also, I got these shoes and can we just have a moment when I saw them online I was a little bit skeptical because I wasn't really sure what they would look like on but holy shit I feel like a literal supermodel in these because of just how chunky and cute they are I'm actually obsessed and I'm probably gonna be wearing them every single night on my trip They're definitely gonna be able to pull every single fit together. Like are you kidding me? I think these are the actual cutest shoes I've ever worn in my life I like saying I'm obsessed with these shoes is a complete understatement If you're gonna get anything from this haul I suggest getting these shoes because trust me you will not regret it But yeah, this dress I'm so in love with and these shoes just go so good with it These shoes will actually go good with all the outfits, but this is just a whole vibe. Okay. Here is the next set I'm obsessed with this blue. This is a little cute tie Wrap skirt and the material of this I just love so much and the color is just so cute especially for like a tropical vacation I paired it again with these heels because I'm obsessed They go with everything that I got and not just that but they're actually so comfortable So I'm in love and yeah, this is so cute to order like dinner again Or maybe just even to the beach one day over a bathing suit But the next thing that I got is this skirt I originally wanted to order like of the matching top to the skirt that had like the exact same print But unfortunately it was sold out. I think in my size. I'm not sure if the other sizes are available So you can check on that if you want to get the matching top, but I am absolutely Obsessed with the skirt. It's just so flowy and the material is so freaking good and thick It's kind of like ribs material, but it's so good and I love the pattern on it It's so different but cute. Here's the next set that I got I am literally obsessed with this one. It is so cute It's a two-piece set, but it kind of looks like it can also be a dress because of how just like Matchy it is, you know what I mean, and it kind of just goes down So it could be mistaken as a dress But I'm actually obsessed with it and the skirt has built in like little shorties underneath So you don't need to worry about like flashing anyone because it is pretty short, but yeah It's so freaking cute and I am actually obsessed with it Okay, then I got these three bathing suits I thought that I'd just show you like this because it's easier So I got this one and it's so freaking cute. It's a little bit high-waisted It fits so nicely and it's so flattering and I love like the gold piece here in the middle and I love this one as well It's just like a light pink color and I'm obsessed the top is pretty small though So if you're gonna get it and you have like bigger boobs I would probably size up on the top just because it is pretty small and Then I decided to get like a black one piece just because I don't really have like a one piece And I feel like this would be super cute if it's just like a chill day Wearing some cool jewelry with it and like a cute oversized shirt It's just kind of a vibe and I don't really have like a nice one piece so Yeah, these are the three bathing suits that I got and I love them so much and these two are high-waisted by the way But yeah, anyway, so that wraps up the haul. I'll have all my links for everything down below if you guys want to shop But yeah, I love you guys So I'm just about to enter the Tim Horton's driveway drive-throw because I am On the way to my parents house my family's house right now We want to book like a trip with all my my siblings So I'm just kind of going over there so we can book it and I'm just gonna spend the day there to visit But I'm just stopping at Tim Horton's to get myself a Tim Bebes coffee because I actually really freaking liked it. This is my first time having my period with my IUD in So I'm kind of scared on what the day is gonna bring But I took like pain killers already and I'm just like crossing my fingers that it's okay that it's gonna be fine I have some like I had some weird stabbing pain this morning But other than that like I've been okay like it hasn't been like horrible So it's not the worst thing in the world yet, but who knows what's gonna happen today So I'll keep you guys updated, but Yeah, I'm going on a trip and I'm so excited I know I haven't hit like a hundred K yet But I kind of want to make it like my hundred K trip because by the time I go I should be hitting it then or For we'll see but it's gonna be around that time anyway So I want to kind of go on that trip to celebrate I would be going on regardless though just because I really want a vacation But I'm just gonna make it like that's gonna be my celebration for myself And I was just thinking hold on I got a order You have the Justin Bieber cold brew Can I do a medium but replace the cream with oat milk? Yes, please That's all thank you. Can I replace? Can I replace the cream with oat milk, please? Hello Girl, I don't know if you guys just heard that but I ordered and I was like can I Have it with oat milk then I saw on the screen that she said cream And I'm like, oh no, can I replace the cream with oat milk, please? And then like she just didn't answer me. She was gone.  And so thinking back to when I moved out and when I made the decision to go with it even though it was like my parents were against me and That was like a really hard time for me Me going through that made me realize that Like what good came out of me moving out in terms of like where I'm at with my YouTube right now I feel like that's the really skyrocketed things and where I'm at with my mental health where I'm at Creativity-wise like I just feel like I'm at such a good place in my life right now And if I hadn't taken that risk and moved out and listened to The people that were against me then I wouldn't be as happy and I wouldn't be in the position that I am today and even though it was scary doing that it's like so rewarding in the end and I'm so happy that I did it and it's just so crazy because if you're manifesting something you can't really put a Like a thing on it saying oh it can only happen one way because the way that the universe works It's gonna give you what you want and it's gonna deliver it to you But it may not be in the way that you were originally expecting it to happen It will happen though, but that's why you have to be open to all possibilities and always keep an open mind with everything Here we go. I'm getting my drinks. Hold on Awesome. Um, I did say oat milk for the cold brew and I'm not sure if you guys got for the cold brew They're both all milk. Okay. Thank you. Thank you You're sure this is all milk right just because I have a dairy. Yeah, no this one Just because I have a dairy And no this one Thank you Geez sometimes these two more ins workers like not all the time but sometimes I'm like I have a good day And they just don't answer me like they just turn their heads and close the window like thanks like hey anyways, what I was saying before is just so important to Trust the universe and what it's doing for you and always just like be in tune with yourself And trust yourself and at the end of the day your opinion is the only opinion that matters Because there's gonna be multiple people who are gonna hold you back from what you truly want to do in life but you can't let that affect you you have to do you and Follow through with what you want to do in life and the universe will reward you for that and yeah Anyways, I just realized like as a human being how important it is to constantly be evolving and changing and learning and Not just being like stagnant not saying you have to like switch careers every five seconds or switch jobs or whatever But just like in maybe other parts of your life try to always be evolving learning and Growing and know that change is good And it's not a bad thing because it happens for a reason But anyways as I was saying obviously like it's normal to have moments and segments of your life parts of Your life where you're not like evolving or changing and things are stagnant and that's okay That's could be normal for you and obviously we all go through times like that and that's fine But I'm just kind of saying when you have the opportunity to grow when you have the opportunity Take it because if you don't then I feel like you'll regret it and that's how that's how you stay alive that's how you really enjoy life and Grow as a human and it's just so cool how we're all experiencing this life together on this planet And it sounds so weird and woohoo, but it's true. Yeah. Anyways, I just got to my parents house So I'm going to go in and be here for the day, but yeah pray for me that my cramps don't get any worse Hello you guys so this whole day I literally had a new to do get work done But I got my period and this is my first period with my IUD and it wasn't like horrible like it normally is But I got hit still pretty hard because IUD takes like three months to fully kick in stop to stop like your periods So since this was the first month it was a little better, but it was still very pretty painful for me So anyways, I was just like dying the whole day But now it's about like five o'clock and me and Joel are going to the grocery store Because we just have to get like a couple things like we ran out of dish detergent for the dishwasher and just round up things like that But then after we're gonna go to Home Depot or something like Canadian Tire because we want to do our deck We want to put like turf down and like make it all pretty and cute with lights So we're planning on doing that tonight. So that's gonna be a fun time But yeah, so we're just gonna run into the grocery store right now to get a couple things And then we're gonna go to the shopping for the deck, which we're excited about And this is the simple fit today. I'm just wearing these Eritzia Flared pants with a white tube top and then that's pretty much it because it's hot So we don't actually know if they have turf here, so we're just coming in and hoping For the best because you really want to get a den tonight. We just kind of got this urge What's this? It's kind of big though we take up the whole entire deck then you have to like take care of it with chemicals and stuff Okay, so we ended up finding the turf at Home Depot it took us a while because no one knew what we were talking about I don't know why but then I finally found it and so we got that and then we got some tape So we can tape it to the deck and then we got string lights We can put those on the deck as well, and then we got like an exacto knife so we can cut everything Yeah, eventually I'm gonna add plants and everything It's not today because we already got like a lot to do but yeah I'm excited because we just wanted to like make our deck of vibes so that when we sit out there and like watch the Sunsets, it's gonna be really nice and fivey. We also got to see what it looks like before we put up the lamp Yeah, so like we don't really know how much space like where and we kind of got to have to map that out before we even Go and buy random plants. So you want to be very intentional with everything. I also got a flight. I don't want her because I was grieving I was like really thirsty So here is how the deck turned out the grass honestly looks so good props to Joel for doing such an amazing Job with it because it was so hard to do and we actually ended up getting different light bulbs We then the original ones that you guys saw these ones are from Canadian Tire Because the other ones were solar powered but they were super super dim and we just weren't happy with them So these ones are really bright and they're nice. They really light up the whole deck and their plugins are not solar power Which sucks, but at least we know that they're bright and they work So anyways, we're so happy with how it turned out and I am in love It honestly just makes like this whole deck feel more cozy and homey and it's such a vibe


It's not gonna work out Now what do I mean by that boomer the boomer economy is basically the idea that you can go to school You can go to college and then you become an employee at some kind of company and you work there for 20 30 40 years maybe a switch companies But you ultimately are a company man.  That's all you need to do now the issue with that well a lot of people think this is how the world I mean that might that might strike you as well. Isn't that just how the world is? What are you talking about? No, it isn't it in fact It's never if you look at the world before boomers Okay before the boomer bubble that happened after the Second World War Life was totally different because you know what often happened is that people sometimes they had generational businesses you might be I don't know. Maybe you have some kind of skill.    Okay, we're actually told nowadays that that's something we should be afraid Oh, I don't get a choice in that that's no fun But the reality is the boomer economy is infinitely worse for your freedom It might look like you're making more money on paper But usually you aren't anyway and what I mean by the boomer economy the boomer economy is this idea that the goal of gainful Fulfilled life is to be an employee Okay, most people in most times have never been employees. They've never been wage cuts They've never been salary cuts. They have been effectively self-employed. That isn't just because people were you know Farmers and stuff like that. There were many farmers There were many people who grew food for themselves didn't even have to rely on the system for that But most people before the boomer economy they had skills that were independent of the system, right? They didn't necessarily you know if you can build stuff out of wood, you know That's something you could sell on the market, but that's also something that's useful for you Okay, and that's how a lot of people were before the boomer economy now The boomer economy is ultimately the idea that success means success within the system Success within you know, you you got to work for you have to work for this company, right? One of these many companies And of course there are benefits to that you might have a lot more money on paper But ultimately you are deprived you're deprived of a kind of a freedom Um, but you're also sort of invested yet like you lose the ability you lose those skills those crafts that you would otherwise have Now the fact of the matter is the boomer economy just isn't sustainable in the first place, okay? So, you know people nowadays, you know when I graduated from college, right? I I graduated with a degree in economics and I ended up going to graduate school Which sounds like a bad financial decision, but a lot of the people who graduated in my in my class They ended up even worse, you know, they um They would like end up running a twitter feed for like some NGO or they'd be working as unpaid interns for years Because there are just so many people who go through, you know Want to do the boomer rigamal role of let's just get education for some reason and then I'll just magically get a job Um, even in something like economics, you would think that that would be oh, there'd be a lot of people who get good jobs with that Not really. Um, there were some I'm not I'm not discounting I'm sure there are many of you who got gainful employment afterwards But the idea that everyone can run through the system Is totally nonsense and especially, you know, this system is ultimately Depriving people of independence not just in financial independence, but they're making, you know Now we have, you know, many people who just don't have traditional skills They can't, you know, they have to buy everything, you know, you know what I mean Um now nowadays this is already starting to reverse. This is just I mean I'm not just talking about people moving into the country or you know, because they they think it's cool on the internet but I mean, um Let's say something like software design, uh, you know Some stuff that we talk on this talk about on this channel Um software is a good example of one of those skills that people are now starting to have independent of the system You know, it's you can make your own way. You can write your own programs.  It's nothing so difficult You could you could start your own blockchain something or other and get, you know, make millions or something like that That's actually something that a lot of people can do now And it's kind of a necessity because again this this idea that everyone should be an employee Is like less and less sustainable with every passing year. The bubble is like gradually deflating So that's that's definitely my mindset now I bring this all up because when people ask me things if I you know recently I did videos telling people you should move into the country. It'll be better for you A lot of people would say things like Well, what if I move to a place where there are no good companies, dude? Oh, no, how am I gonna get a job? And that is like the exact opposite mindset you need to have because When you're when you move out into a place where there, you know, some kind of company is not providing some service Well, that is more entrepreneurship opportunity Well, like why would you want to move to a place where there are massive multinational corporations that you have to compete against? You either get some wage cut job with them or you know, you just Well, that's really your only choice in reality if you move to a place where I guess if you're a bigger fish in a smaller pound, that's a good thing, you know So a lot of people will be like or here here's another thing people get I looked online for ways to make money You know online and I couldn't find any as if like you're just supposed to this is the mindset that drives me nuts like the idea that Like the answer to being personally independent is just like a list of things that I have to follow Mechanically follow as if I'm some some kind of employee as if I'm some kind of wage cook in reality You know being an adult in the olden days being an adult just meant making your own way. That's not like a meme That's not like oh, I'm gonna retire at 30. That's not like some Magical thing that you know people on instagram do it's something that everyone did and the boomer economy The boomer economy has gotten it to the point where people just don't have that mindset anymore They're like, oh no, I don't need to make it in the world I need to I need this company to help me make it in the world. I need them to pay me I need them to tell me what to do. Otherwise. I'm just not going to figure things out It's just like a really immature way of looking at things.  Like there are a lot of people who are like, oh I I I don't know I just pity people who are constantly thinking about putting things on their resume Like, you know, it's just uh, you don't need to live in that life I think my recommendation to that that I give to people I mean, even when I was a kid, I'm not saying that I had everything figured out as a kid But I will say this, you know, I definitely had the mindset that um, or the idea that, you know My generation was not going to be as easy as it was for boomers or you know, there are so many things Like the world is too big too complicated. Um, it's not going to be as easy as just finding a random job So when I was a kid when I was a teenager one thing that I tried to do I didn't necessarily even try to make money But I tried to think in terms of okay What can I learn that I can never lose because you can lose money, but you can't necessarily learn or lose skills So even if I learned stuff, you know when I was a teenager, you know I taught myself latin classical languages and stuff like that and that actually that that hasn't been hugely economically beneficial But it's one of those things it's opened up weird opportunities in my life And of course, that's actually a very abstract example, but there are many more skills you can teach yourself now That are going to put you in a better better position That's that's my way of looking at it. You you learn woodwork. You can go pretty far on that so what i'm trying to say is Yeah, this you gotta you gotta I don't know you gotta live your own life. Like you cannot ask me Uh to tell you or anyone else or any kind of company to tell you how to make money If you're in that mindset, you're doing it the wrong way. It's not this is not like something for Hyper alpha go-getters. This is something that like everyone should be able to do like you should be able to We have to get people less domesticated. They have to start thinking about this for themselves Like so this is hopefully this has been some kind of wake-up call Just don't be an employee.