Within three hours of playing the frequency, I was able to get a $90,000 commission. I'm a luxury real estate agent in New Jersey. I was skeptical at first after using it again. I was able to double end a real estate deal that to the tune of $20,000.  And the next day after we use, I use the luck one. We won two deals, high six figures. High six figures. Under seven figures. I was able to figure out a way to settle over $3 million worth of debt. I've noticed that since I've been using the infinite frequencies, I've attracted money into my life and it's coming now in many different areas that I would never have expected. Things just started lining up for me. It was just one thing, add some unexpected financial things that got secured for me, some investments that absolutely took off, some opportunities one after the other. On the abundant side, tremendous amount of opportunities been popping up on the real estate side for us. Also, different opportunities just expanding and growing and it's amazing what's happening. Somebody that I had wanted to work with, they had been on my vision board for the last five or six years.  So that was something that popped up. I was like, it was interesting that happened out of nowhere. We put one that's called abundance, prosperity. There's so much cash flow happening. What we are keep playing is called money and called abundance business. This has been creating a lot of miracles since we had it three days ago. Quantum frequencies have changed my life. The emotional and mental support that has given me to be able to break mental barriers, unconscious, emotional patterning and belief systems has just been phenomenal. I got a call out of the blue from someone that I assumed had been referred to me. Can you just tell me who referred you to me? And she said, no one referred me to you. And I said, oh, you must have seen me from the TV show. And she said, you're on a TV show. I have no idea. If you're just looking for a real estate agent, there's thousands of responses that you can get from Google. So the only way I could correlate it is that within using the frequency and then having that phone call. This financial situation came up where it was owed in upwards to $3 or $4 million. I've been playing the luck booster a lot. I'm doing all the abundance frequencies all the time. I was able to figure out a way to settle over $3 million worth of debt. Since I've been using the electromagnetic energy, I've manifested a lot of abundance in a very short period of time. I attracted a lot of abundance. Attracted the right people to me. Attracted the right opportunities. And I started to have more intuition about when to take action, when not to take action. Who to work with, who not to work with. Which direction to take my business and so on. And everybody's so happy when people come in our home to feel that abundance, they receive that cash flow. So they all are creating the same cash flow as we do. Well-known people are coming to me now out of the blue and I'm working on all these different projects and I never looked for any of this stuff. So far so good, David. I'm impressed. This is money well spent. It is time well spent.


Hey guys, welcome to the 30 paintings in 30 days project. If you choose to join me on the 30 paintings in 30 days journey, I hope that you do share and tag me and post like on social media and stuff, maybe film some videos, tag me in the description, something like that. I am kind of excited about the project. I do do daily drawing. I don't necessarily do daily painting, but making a daily practice out of something like this encourages you to get better at it, encourages you to work it into your daily routine or weekly routine. It also is a way to use up supplies. So if that's your goal, maybe you don't want to do 30 paintings in 30 days, but you want to do 30 collages in 30 days. That works too. So let me know. Let's get to painting and I'll see you guys. We are here for painting number 22 of our little experiment of 30 paintings in 30 days, our little painting studies. And I think we are going to work on some abstracted sort of very floral e shapes that I have my inspiration book open to and I spilled glitter earlier and of course there's glitter everywhere. Okay, I am going to start of course with my flat brush as always. I'm going to just take these sort of dried up grayish color brownish grayish color that's on here and I'm going to mix it with Jane Davenport 70s eyeshadow which is a light blue, brighter than I would normally pick but the gray of course as you can see tones it down a lot. I'm going to add some water, kind of wash it out a little bit to our tape is pushed down. Okay, we're going to put just just slap some on there just slap it on there and don't worry about it we're of course we're doing the background you guys know I like to do the background. Before I do that focal image always I'm going to take some of what color am I going to use that say let's just stick with 70s eyeshadow for right now. I'm going to put some of the paper obviously is still wet I haven't dried anything. I'm going to let it blend and do what it will. My husband's downstairs working in the garage if you guys hear background noise. Okay, I'm going to take my C sponge it's dry it's not wet. I'm going to just kind of do this just creates gives us texture to the background.  Now I'm going to go to my round number three brush, and I'm going to take Jane Davenport's pink color that's in here called best friend. I do find that her colors tend to be more opaque than normal watercolors they tend to be more gouache like. I'm going to mix it here with just a little bit of that blue gray color that we have. It's going to purple it up just a little bit which is fine. And I'm going to just suggest some berry shapes here.  And then get things wet. The watercolor you know watercolor is a simple creature. It's going to go where the water is. It's not going to force itself upon the dry spots. So if you want the watercolor to go a certain way just put water there. If you want to try to semi control it, you have to control the water and make three more shapes. Grab some of the pink straight from the pan and add that in. And then grab some water, which I would love to be able to tell you is clean water. It's not really I've been painting a couple of paintings now today and it's not super clean anymore. Now if you have a spot like this where the paint is puddling and it's not as varied in tone and movement is like this one is just take your sort of damp but not super wet brush and just put it there and look at how it lifts up the water. And then you can take some of the pigment straight out of a pan with not too much water and add some color back if you lift too much up. I am going to take. Magenta out of this other palette. That's my husband sneezing. Our allergies have just been crazy this year. I'm going to add that darker red as a shadow color. I'm going to go in with moon glow, which is a dark grayish purple, just like that. And we're going to give it a dry sticking with the round brush. I'm going to go in with I think undersea green. Again, I'm going to mix it sort of tone it to the other colors that are in the painting by mixing it with the paint that's already on my little plate over here. I'm just going to add some stem shapes. I'm going to switch to a bigger brush. I'm just blending out the colors and the green until I'm happy. If I think there's too much or I've put the color in the wrong place, you can do that and lift it up. If it's too defined and I want it to be more suggestive, just have a rag or something nearby. I'm going to switch to a color. Let's see. I'm going to stick with the undersea green for a minute. And I'm going to grab some moon glow, which is that dark purpley gray color. I'm going to dry that. Okay, we're going to go back to our round brush. I'm going to go straight into moon glow. Try to define a few shapes. Not all of them. Just enough to tell you for sure what's going on in the painting. Or at least to give the viewer a good gasea. That tape doesn't want to stick today. I don't know what the deal is. Okay, and then I'm going to go in with Jane Davenport paint. I think it's called Gemini. Some days I can't read my own writing, so there's that. I'm just going to put a little bit. It's a sort of a bright yellowy green color. And because her paints are more on the opaque side, and I know that they're not as transparent, you can sort of use them sometimes if you've lost too much of your highlight. I'm just being someone who started as a mixed media artist. I have nothing against using a gel pen or acrylic paint, or I think that's completely fine. I'm also going to go in with that same pink color that we started out with called Best Friend. Kind of do the same thing. There we go. And let's give it a try. Pull the tape. That side's not too bad. It doesn't want to come off my fingers. That side's not too bad. Oh yeah, it didn't sneak up under there. I thought it was going to. So there we go. Painting number 22. All right, on to the next. How was that for today's painting? I hope you enjoyed the process. And if you want instruction on the painting, you need to be over in Patreon. They are going to get the talking version here on YouTube. You're just going to get the speed food through version. Sorry. If you'd like to support the free content here on Facebook or in the here on Facebook, holy cow. If you'd like to support the free content here on YouTube or over in the Facebook art groups, I certainly would appreciate that. You can of course join Patreon. We do have YouTube membership here for a small fee. And also I have an Etsy shop and I have PayPal tip jar and all that stuff. So check out the video description. Relevant links will also be down there. And yeah, don't forget the most important things.  Do share your work with me. I would love to see what you're doing. That's it for now. See you later. Bye guys.


Good morning everyone. My name is Dan Kahn. I'm the Executive Director of the Cloud Native Computing Foundation I would like to particularly thank RPIT and Phil Robb and Jill and the entire ELF events team for putting together this event. It's been incredibly productive three days for me, a really interesting group of folks here that I've been able to engage with and have a ton of meetings. For the last six months, networking has been a major new focus for the Cloud Native Computing Foundation. We're best known for hosting Kubernetes and we have had a lot of success in the cloud and in enterprise software computing, but we see telecoms as the next big market to go after. And so RPIT and I have been literally circling the world together doing a road show in China and then a booth together at Mobile World Congress and such, but it's been a great collaboration. So I think everyone is familiar with Kubernetes at this point. It was originally created by Google but has now had major contributions from Red Hat, from Microsoft, from Huawei, really all the companies, the 17 Platinum members listed at the bottom here and now hundreds of other companies, thousands of other developers. But that's just one of the projects in CNCF. We now have five graduated projects and 16 incubating that are a little less mature but still being used in production by hundreds of companies around the world. So CNCF has now just crossed over 390 members. That's up from 28 when we launched just a little bit more than three years ago. And we're both the largest and one of the fastest growing ever open source foundations. And so I did want to just give a little bit of background on that and then share some lessons that we've learned and approached that might be useful to the open source networking community. Just as a look at that growth, this is looking at Google trends, so what people search for in Google. And you can see that three years ago when we launched, Kubernetes was quite low right with Docker Swarm and Mesa's OpenStack and Cloud Foundry. And other than the fact that people really like to take that week off between Christmas and New Year's, we've had this very steady growth over three years and it continues today. And then on the right side you can see on WeChat search and China has been an enormous market for us. We have a huge number of members and users and certified versions and such and there as well we've just had a huge amount of interest in growth. This is kind of a complicated chart, but it is just a way of looking at the velocity of open source projects. So the size of the bubble is how many unique developers are working on a project, how high up it is, how many commits it's had in the last year, how far to the right shows how many issues and pull requests. And you can see that depending on how you count, Kubernetes is the second or third highest velocity project in open source just behind Linux.  And this is a way, it's an automated testing system and a process behind that to ensure that Kubernetes that you purchase from different vendors or use in a hosted cloud environment or just download the pure upstream version are all compatible that they all support the same APIs. And so we're really proud of the fact that we have 83 certified Kubernetes partners and we've actually collaborated quite closely with LF networking on the OVP certification program that was announced this week, which in fact is using a lot of the same processes and documents and such. Okay, so that's a canned history of CNCF. What have we learned and what are three ideas that would apply over to open source networking? The first one is a loose coupling. And this is the idea that all of the projects in CNCF do work together. They add value, they solve related problems, but they're not welded to each other. And so different enterprises select different projects that they find useful, different platform providers glue them together or bundle them together in different ways. And I want to emphasize that this leaves space for innovation. It lets people focus on the areas that they're interested in, where their talents are, and it's closely related to another CNCF principle that we're not the king makers. And so explicitly when we pick a project and we say, okay, this is a great container runtime or this is a great service mesh or this is a good tool for service discovery, that is not the end word, the final story for CNCF and what we're endorsing. And we explicitly have a policy that we can host multiple projects in the same box. So for example, we support multiple container runtimes today, and we'll probably see more of that in the future as more projects come into CNCF. So we do think that that loose coupling adds a lot of value and allows innovation to occur at different rates in different parts of our ecosystem. Second idea is to minimize toil. And so we really see developer productivity as one of the most important constraints that we're trying to optimize for. And so that means that we, to the degree possible, provide just a variety of different services to our projects that help make the developers more productive and makes it easier for them to collaborate. In particular, we're perfectly happy to use commercial services to do this when those work well. As an example, I believe Kubernetes now has the largest slack, public slack implementation in the world. It has thousands of new users every week. It's just kind of a crazy process to support. But we also use Zoom video calls and then publish all of those to YouTube, hopefully within a day or so, so that people who couldn't make the call or who need to go back later in review have access to that. We use GitHub. We use open mailing lists. We use a lot of Google Docs. And interestingly, we don't mandate what those tools are to the project. We certainly have some defaults that we recommend, but we're constantly open to trying new ones and to accepting the fact that different projects often want to use different tools and we support them in doing that. Now, I want to particularly call out the role of continuous integration. A key driver of the Kubernetes project's success and robustness has been the level of investment that we've made. Every weekday we run over 10,000 CI jobs. Every time someone opens a pull request, it runs that CI job. And then in addition, every two days we run a new scalability test of 150,000 containers across 5,000 virtual machines. Now, the smaller projects are not at that scale, but they all rely on CI platforms as well. And interestingly, we don't really mandate or even have a preferred one. Different projects use different CI providers, and we're happy to support them on that. And then the third one, I would say, is the value of marketing of vision. And so Kubernetes is the anchor tenant of CNCF and an incredibly important project, but we do try and share a larger vision about what cloud native means about a way of reducing costs and improving resiliency. Most importantly, increasing developer velocity. And so two examples of this is that we don't try and say that the CNCF way or hosting using all CNCF projects is the only way of successfully being a cloud native enterprise, or for this audience, a cloud native telco. We have some recommended options, but we also create this diagram. Can you just raise your hand if you've seen the cloud native landscape before? This has been described to me as useful, overwhelming, and the hellscape. Interestingly, the same person did two of those. It is an overwhelming document. There's a cool interactive tool at the top that you can go to on your phone or your computer. L for landscape.cncf.io that actually lets you research each of these projects and products. You can see that the grade ones are closed source products. The white ones are open source, but we are trying to make a statement here that it's not actually that we're making the world complicated. We're the map maker. The world itself is complicated. There's a lot of different options. And so then the other diagram that we think is incredibly valuable is what we call the cloud native trail map. And this is really designed to be the front side of the document, the landscape on the back. And I will say you can walk over to the CNCF booth after this session and pick up a print copy here. But in my experience, I don't think there's actually an enterprise that is using all 21 of the CNCF graduated and incubating projects and nothing else. No commercial products, no other open source projects. And that in reality, people are mixing and matching to a huge degree. And what we hope is that an enterprise at telco will look at the CNCF project, will evaluate it and try to understand its strengths and weaknesses before making their decision. But there's no obligation to that loose coupling is a really key thought here. So those were the three big ideas. Loose coupling, minimize toil, market division. These are all things that open source networking organizations like LF networking have already begun to do, but could perhaps put more resources into. And then finally, I do want to just mention two other CNCF activities that might be of interest to this community. One is an area that we've been working with LF networking and others on. It's called the cloud native network function test bed. This is a project, it's open source. It's available right now if you'd like to participate where we took some open source network functions out of the own app project and repackage them, not in virtual machines, but in containers, run them on open stack and on top of Kubernetes on identical bare metal servers that have been very generously donated to us by the bare metal hosting company packet. And you can just Google for this CNF test bed and see an online presentation, a lot of detail about it. And then we are having monthly phone calls where we're talking about collaboration. There's some aspects of how we're making this perform today that everything is automated. It's all in the open source repo, but I would describe some of it as being out of band that it is done in a more manual ways. And we're interested in having all of that be automated into Kubernetes. And then finally, I'd be remiss not to mention CNCF's conferences. We host KubeCon Cloud NativeCon. Our event in Barcelona on May 20th is expecting over 10,000 attendees. It's going to be the largest open source developer conference in history that's up from 8,000. You can see our growth here over the last three years from 500 when we got started up to 8,000 in Seattle. We'll then be in Shanghai, June 24th, 26th. That's going to be joint with the open source summit and we'll have a lot of networking content. And then we're expecting an even bigger event in San Diego, November 18th to 21st. And so I hope that many of you will be there and have your colleagues go there. And I'll stop there. Thank you all very much for your time.


Thanks, yeah. When you don't give people a title, I guess they make one up for you. There is no precursor at Oregon. I'm not CEO of it, but it's fine. Yeah, thanks for having me here, I guess, to the program community. I always feel a little bit of an imposter because this is an open source software conference. And I'm like, well, what do I talk about here? As you saw, I had a little struggle setting up the. I had a live demo I was going to show, but then I had a video back. Anyway, it's a long story. It's not happening, but we'll talk anyways. And I apologize for the font mismatch because my slides are on a computer that doesn't have the right fonts, so things are going to render weird. Anyway, so the topic of the talk is debugging Rust, actually just generic code with Veralog. If people don't know what Veralog is, Veralog is a language for describing hardware.  So I think most people, when they hear open hardware, their reaction is like, that's cute, but what do I do with it? I don't actually have the time to build this thing. I don't actually really care to fix it. They just want the thing to be delivered at their doorstep now, and they want to cheat. So if you had the option to have buy a house that had the blueprints and a buy a house that did not have the blueprints, it doesn't matter to most people. The fact that you could have the source to your house doesn't move the needle for most situations. But there are some things you can do with open hardware if you're not into hardware. So one of the typical canonical things that we all jump up and down and scream about in the open hardware community is that, oh, you know, you can do security audits. There's this whole principle, care cost principle, not to be confused with care costs, first of all. Care cost principle, which is that there's nothing up my sleeve. The idea that if you're going to have a security system, then disclosing the full function of how the lock works and where the tumblers are, the pins are, allows you to make a accurate assessment of the security parameters. But in reality, again, this is an application that's mostly just for paranoid people and not cases like me. So maybe a thing that's a little more relevant to more people in this room are things like spectrum mitigations. Still largely a theoretical area, but how many people here know what spectrum is in terms of a vulnerability? Okay, a few hands. I'll go over that very briefly. Basically, there's a class of attacks that can happen on your laptop, the machine you're using right now in your lap, where information about a secret computation can leak through what's called a timing site channel. Sometimes, depending on the data you're processing, the data can process very quickly or it can take a little bit longer. If you measure the amount of time it can leak, for example, information about your password or your secret keys. The reason why that happens is because even the machines have this abstract model called the instruction set architecture, like oh, I have an IX86, so I have an arm on an M1 or something like this. On the inside, the time it takes to execute instruction varies quite greatly and it depends upon these tricks they play. Do we have a laser pointer or anything like this? Is this a laser pointer here? Me and my old eyes can't see. Oh, there you go. Excellent. So this is an example of what's called a branch predictor. So every single time you run through a piece of code, you'll go ahead and remember the last state that you took for going through a loop and they'll generally say, well, since you went through a loop and you went this way, the last loop, you're more likely to go that way than the other way and so we'll speculate ahead and try to save you some time and guess that that's what you're gonna do. That internal state becomes a problem because that's the vector for leaking the information about your key. If we had the source code for your CPU, we could actually have the compiler write provable automatic mitigations for Spectre. In other words, this whole thing about this patch train you have every two or three months to patch new Spectre vulnerabilities, this whole industry of researchers that's now employed basically finding the series of vulnerabilities could be worked around if guys like Intel and AMD would just share the source code and then we could actually write compilers instead of having to reverse engineer this whole pipeline, right? But this is still largely good theoretical thing because no CPU that really actually matters that you're using on your Dap has that available. But that's something that I think that would be interesting to most people. Another thing that you can do with open hardware turns out is you can do debugging in performance profile code which is something that's a little more softer relevant, right? So the source code of the CPU, this is an example here of some source code can be run and turn into this display here which probably a lot of you aren't familiar with but a guy like me would feel very comfortable looking at this. This is a set of waveforms that describes the state of the CPU. So we're looking at, for example, the data being fetched out of the register file, the instruction being executed at this point in time, like for example, whether these are compressed instructions or not, legal instructions, is it a multiply pipeline exceptions, the virtual page numbers, the state of the ACSI bus on the inside, that's all visible when you run at the hardware level using this type of simulation. So it's extremely powerful view on the inside of a computer and you can use this to actually debug code. So just to review what the typical approaches are to debugging, print statements. How many people debug by print statements here? Everybody, right? It's awesome, it's tried and true, like it's like even in the most minimal setups when you have almost nothing available, a print statement will generally work. It's inoperable, ASCII comes out, you can pipe it to a Python script, you can wrap, you can automate other things. So it's awesome, right? But it's limited for debugging very complex and concurrent environments. Anyone try to print about two threads running at once, we'll see a garble of stuff emerging on their console of two things talking on top of each other, not to mention the in-sympia performance problems of trying to talk to 115 kilobot UR when your CPU is running at a gigahertz. So then you have more sophisticated stuff like, oh, we have an IDE and you're debugging, you're going line by line and you can see all the state of your Python code wherever it is, GDB and all this sort of stuff. It's really awesome, we can have it, but then there's a question of who debugs the debugger, right? So when you come up with a new platform, it's actually a lot of work to try an instrument to bring in the debugger. And again, even when you're in a multi-process system, these debuggers aren't a straight shot. You have to be able to attach to a right process, switch through, there's overhead that's incurred in doing that, especially when you get into things like performance profiling. So people who've done performance profiling may be familiar with this guy here, it's Flamegraph. Basically a call stack shows you how much time is being spent in every single call all the way out to the outer routines and he can sort of determine very quickly which routines you should focus on optimizing. It's very powerful, it has beautiful output, but it can have artifacts due to overhead. So there's plenty of stories of people like I put Flamegraph on my thing and I spent all my time optimizing and I found out that I was actually just optimizing the system call for getting Flamegraph to run. Or something like this, it's like the overhead of actually getting it to work can be a little bit tricky. So there's a kind of an art that comes around doing really good performance profiling. You have to use hardware counters, you have to use instrumented kernels, you have to go ahead and there's a whole bunch of different tricks that come into play to make sure you're actually capturing the events of interest. If you're going across system call boundaries, so you're bouncing between the kernel and the user space and you want to sort of plot that, that introduces a newly of complexity because you're in different memory spaces, you can't correlate timestamps as easily. And then a whole bunch of other types of problems that happen when you're in concurrent spaces. So people do do it all the time in really big systems, but it is and it's not obvious how to do it and it's not, and you have to set it up takes quite a bit of time. So just a quick review. So the niches that are not kind of handled particularly well by the approaches that I've overviewed are things like the early boot. So when your machine hits the reset vector and you have to debug it, how do you debug the reset vector? That's a very, very tricky problem. You don't have print even, you don't have other things. What do you do in that kind of case? Transitions between the user space and kernel or machine mode and kernel. So if machines start life with physical memory, they don't know about virtual memory, they don't know about your process space, they don't know about your kernel, whatever it is. You have to teach the machine where the programs are. You have to teach the machine where the page tables are gonna be and you have to tell it, okay, on this one magic instruction, we're gonna have the program counter magically teleport from this address to this address, but everything's fine. It's totally okay. And the debug is gonna not deal with that very well, it turns out. And so then there's a whole bunch of other performance tuning things that you have to do, like we're going across system calls, that's very difficult. There's a whole class of performance tuning, what I call Heisenbugs. They're things that when you try to instrument them, they change. So for example, if you want to debug a cache or a translation local side buffer performance issue, just the instructions you add to go ahead and try and extract those can affect the behavior of the cache or the TOB and you're no longer able to see it. And there's also sort of an issue with reproducibility. So if you have an aggression and you found it and you think you fixed it, how do you later on know that you fixed it? So reproducibility is a thing that a lot of people don't talk about, but particularly when you're debugging things at the hardware level, you want to be able to go back and review the logs. So the solution that I've been working with to try and get around this is simulating a full stack open hardware system. So when I say full stack, I mean, not just like the CPU, but I'm talking about the memory model, the bus model, the peripherals, everything, right? So from the reset vector onwards, we're able to get basically a psychoacre over you of all the overhead incurred in the system. All of this gets bundled together and thrown into this magic box called a simulator. We combine it with our OS and application code as it loads it, as it just loads in the artifact for that. And this grinds for a while and produces a file that contains all the machine state from reset to the point of interest, right? So it's like multiple gigabytes of data, but it has everything the machine has done, all the decisions that were made up until that point. And then you can go ahead and dig through that with a waveform viewer later on. So just briefly, it sounds a little magical that we can have such a comprehensive model, but this is where the models come from. And in particular, I design open hardware systems from the ground up. So for me, this is a little bit easier. I use an open source CPU core called the VEX-Rispy. I have a bus, the axis, so the interconnect on the inside or from using wishbone. It all comes for free as open source if you're dealing with ARM or something like this. Good luck. Prypha models, I write on my Prypha models or I borrow other peoples that's all open source. It becomes a little dicey on the memory because you have to deal with vendor models. So for example, if you are simulating SpyROM or something like this and you wanna get psycho-accurate behavior on the SpyROM, it turns out actually, if you go to Mechronics, you can just download a VARLOG model of most of the spy parts, which is really cool. So I can actually get psycho-accurate interaction with those. And then some RAM vendors will also give you abstract models of the RAM as well. And there's some decent, for standards, like D-RAM and stuff, there are standard models you can just pull and use for that. So you can get psycho-accurate all the way down to where the code is coming from and where the RAM's coming from. The simulator itself that we have kind of been trying to use is called VAR-Later. It's not actually a full spec-compliant VARLOG simulator. It's actually more of like a, it can run sort of gate-level models of devices. If you have something that gives you an abstract model, so it's like a behavioral model where it says, if you're in the reset state, then all this section of the thing magically turns off. But they don't actually instantiate that at the level of gates, that will screw up VAR-Later. So there's a whole class of useful models that a VAR-Later can't run. If you run into that, then I fall back on some very compliant, similar like Xim, which is unfortunately closed source, but it actually can actually handle those models correctly. It runs quite a bit slower, but at least I can get it to run. The other problem with VAR-Later is, I mean, you can go to the website for VAR-Later, it does a great pitch for itself, so I won't pitch it for it.  It's basically transpiling your VARLOG to C code, and you have to wrap it in the wrapper, and you have to throw it in this whole test framework and then run it. There's a whole set of tools to deal with that. But once you get through all of that, you get a cycle accurate, harder model, and a fast simulator. You can boot your OS entirely in simulation. So this is a log that's actually generated by not from monitoring hardware, but we're actually pulling out the machine statements and capturing them into a buffer. Takes about five minutes to boot, about 14 million cycles, about 140 milliseconds of runtime, which is enough for us to completely copy the kernel in, the user programs in, and run some useful applications in that amount of time. So it's about a 2,000 X slowdown over real time, right? So you're not going to go ahead and run DOOM in this or something like that.  But it's good enough for getting into some real, like, loader issues. So here's an example of what you can do. You can sort of visualize system call overhead. This is, again, a wonderful waveform view. Up here, I have the visualization of the SRAM bus. So there's a traffic on the SRAM. Where you see the bright green, that's actually where the SRAM is active. We see it sort of dim colored. There's like no activity on the SRAM bus. So you can already get an idea of like, where we're using the caches. When this bus is not active, that means the caches are actually hitting. When this bus is active, it means we're missing on the caches a lot, right? And then we do a trick where we take the program counter and we plot it as a graph relative to the magnitude of the program counter. So this kind of spiky little graph is actually like the trajectory of the code going through the executable. Generally, it tends to go up because programs go from low to high in terms of execution. And every now and then you see these spikes that go up and down. And those spikes are to kind of library calls that tend to get glommed onto the back end of the executable at the end of the day. And we can actually trace through, like say, okay, here's a particular call to, for example, just a delay function. This is the message send. We activate a thread. We go ahead and run the user code. We go back to the kernel, so on and so forth. So we can actually see with very, very fine granularity everything that's going on through this whole transition. It doesn't only be really difficult to visualize, and this all happens over a period of 174 microseconds. So 117,000 machine calls, machine cycles. And everything you can do is you can inspect like page table faults and cache misses. So this is an example of a transition right out of code mode into user mode code. And you can see that actually the program county just stays flat for a long period of time. Why does it stay flat for so long? You say, oh, actually the MME is refilling. It's doing a page table walk. Grabbing the page tables out, loading it. We're pulling instructions in here. And then finally we run the instruction there. Next one, next one, next one. Okay, cache miss. Next one, next one, cache miss. Next one, next one. And then finally we're hitting in the cache here. You can see this sort of like repeated pattern. That's where in a loop that's cache hitting all the time. So you can sort of see this all coming out of the system. So in order to facilitate the usability of this, and this is where we're getting into where I wish I had hopefully the video or the demo would have worked, we actually, I wrote a little extension to the Waveform viewer, where you can basically mouse over this and it'll actually browse through the assembly code real time so you know where you are once you're looking inside of that machine code. Basically this GTK wave is one of those really, when I was like playing out with it, it felt very homey. It's like 90s era C code. Like you know, I remember back in the day when we didn't have like bounded arrays and structures and we just had to rely upon like naming conventions to make sure we didn't mess up. So there's, but the great thing about C code is you can just jump in there and just instrument anything. It's like there are no rules, no problems. So I just stuck a UDP stack inside of there and just blast what the mouse over is putting out a port and then I have a Python script listened to that port and then go to the right line of the code at the end of the day. You can scan the QR codes and look at it. There's this, oh look, the video plays. So this is a transition from user to kernel space and you can see here as I mouse over and click, it's automatically going to the location in kernel code that's going, so here's the trap code that's ranked and see it's doing all the things that you would expect the traps during the registers and so on and so forth. And I'm scrolling around and just kind of zooming out and trying to get a little more on the screen here so you can see what's going on and there you go, there's more of the trap code that's running and one thing I want to emphasize is that you don't have to just go forward in time. You can go backwards in time. So when you find the particular artifact of interest, you can just scroll back in time and find what caused it. So a lot of times we're not running a simulation over, even though you say, oh, it takes five minutes to run a simulation. I spend two hours analyzing a trace because it's all there. I don't have to run it again. I don't have to go ahead and put out a print statement and I don't have to go ahead and re-run it and break it something because the machine state was lost. It's all in this particular file. And so you can see here we're looking at the SATP, the prostate, whatever. So that's an idea of what the debugging experience looks like, but the interesting part is this file exists on my computer and I was going to show a demo where I was just going to load it up and zoom back and forth in. So it's not like I have to run the program, it's just a static offline analysis. You could write other scripts and tools to go ahead and figure out what's going on from a single run. So that 2000X overhead sounds pretty awful, but when you consider what you can do with the logs at the end of the day, it's not so bad. So let's see, I'm almost done, I'm almost on time. So this particular technique I would say is really useful for debugging things like boot loader issues. So there's, like I said, there's a magic event where you pivot from machine mode to virtual mode. This is super handy because a simulator itself doesn't care whether you're machine mode or virtual mode. There's no sort of controversial where you're putting your performance counters or how they're mapped or whatever it is. You can just walk right through that transition back and forth, back and forth, scroll through time and figure out what's going on. And then, you know, you can, like I said earlier, you can go back in time, which is actually very helpful to be able to do in some certain really tricky bugs. So, again, like open source hardware is cute, but it could be useful for people who are not into software. Maybe there's a reason that if you were looking at a particular CPU and if it had the RTL available to you, you can do tricks like this. So that's a difference in terms of the visibility and debugability that you get into the system. So, you know, hypothetically, if you had the source code for the CPU and they would give it to you, you could do things like micro architectural site channel mitigations, but more practically in just demonstrate right now, we can do debugging and performance profiling. So, you need a full open source hardware and software stack to do that. But even if you're kind of using sham memory at the end of the day, if you're not performance profiling, you'll at least capture the instructions at correctness and you can get through hairy bugs that way.  You don't have to rerun the thing over and over and keep loading it into your target hardware. You can analyze performance problems with zero overhead. So there's no instrumentation overhead. You're getting the actual performance issues played out. And you can look at stuff that's tricky, the highs and bugs, TLB, cache state, whatever it is, and figure out what's going on without interfering with it. So that's it. I guess I'm a little bit early, but I think we're running behind, so it's probably okay. Thanks.


This is post‑metasploitation using Metasploit for making post‑exploitation faster, better, stronger. My name is Egypt. I like Comic Sans. I don't care who knows it. I'm not the country of Egypt. I get solicited on IRC at an e‑mail on a regular basis asking me if I speak Arabic. No, I don't. I have nothing to do with the country. And I've never used my beard to overthrow government. But I'm working on it. I work on a cool project called Metasploit. I assume most of you have heard of it. It's an open‑source tool for all kinds of stuff. It's not just exploitation. It's reconnaissance. It's tying together all the things you need to do on a pen test. It's capturing all the data, storing everything. You are a good man, sir. Everything is better now. Metasploit was created in 2003. It was originally written in Perl. H.D. Moore wrote it as a game. And that's sort of a theme in Metasploit. Several features were originally created as a joke and later fleshed out to be awesome. D.B. Autopone was originally a joke because some reporters said, well, you can't just click a button and own everything. And, well, yeah, now you can. The ability to inject a payload into an existing E.X.E. was the same thing. Some reporters said, well, you can't just throw a payload into ‑‑ it's not a virus. You can't just put it ‑‑ well, yeah, it is. But the big thing about Metasploit is that it's a framework. It's not just a thing to run exploits. It's a thing for writing exploits. It's a thing for using exploits. And it's a thing for everything in the middle and more on top. It's a clearing house for compromised machines. It's where you store all your data. It all goes into the database. You can take it out of there and put it into cool reports. And once you've compromised things, you can pivot around on the other things. And that's a lot of what we're going to be focused on talking today. So why are you here? I hope you're here because you like shells and you want more of them and you want them to be better shells. You know, it's cool having one shell. It's nice seeing that hash prompt pound up. But one shell is often uninteresting and it's nice to have all the shells.  And having one shell on a workstation with low privileges, you know, it's fun for a while but it's not all that interesting. It's much better to have a root shell in the data center. Having data center is fun at five o'clock on a Friday but it's even better if you can sit there for a week with nobody noticing. So that's what Metasploit is for. That's what this talk is about. I assume you've heard of Metasploit at least. I'm going to be talking about some of the internals and writing code so please don't be afraid of the ruby. I assume you've gotten a shell because this is not about exploitation. This is about what happens after. And I assume that that shell is not your goal.  So why do we use Metasploit for all of this? The first thing is that it's already great at getting shells. There are almost a thousand exploits, dozens of auxiliary modules, over 100 post-exploitation modules with all their own cool techniques. Just one of the best tools available for getting shells and once you've got those shells, then we get to do the cool stuff. The second coolest thing about Metasploit is that it's all open source. It's up on GitHub so you can just go download it. It's a BSD license notably not like GPL which is really a virus. And you can take it and do whatever you want with it. Since it's BSD licensed, it's really easy to fork it, write your own stuff for it. You don't have to share it with anybody. You can keep it all for yourself, give it away to your friends, whatever you want to do, all because of open source. And as a corollary to that, there's a huge community. We've got almost 200,000 people who update regularly. And all of them know something. There are a lot of noobs in the world and everybody started someplace but the people who use Metasploit typically know something you don't.  All because of open source. Ruby is faster to write than see. So that's another advantage of Metasploit. If you do need to get really down and dirty and you have to write some C for something, that's available too. We have integration with a project called Metasm which is an assembler and compiler. It can compile C for x86 or x8664. And it can assemble a whole bunch of different assembly languages for all kinds of different architectures. And because of that, if you really need to get down and dirty and you need to have a very specific payload or some really tight code for fixing up a stack or something along those lines, all of that is still available and you can get into the really nitty gritty stuff if you need to. But when you don't need that power, when you just need to, when you don't need that low level access, you just need to write some code really fast, Ruby can save you tons and tons of time. So first I want to talk a little bit about the design goals, why we write post modules will come up later, but for now I want to talk about what post modules should be. And to start with they should be minimal. They should do one thing, they should do it very well. It's a common thing to see people tie lots of different functionality into a single post module. And that's cool in some respects, but a lot of the automation can be done much more easily through resource files. And so you have a module for stealing passwords, a module for stealing this kind of file, a module for stealing this kind of file, this kind of data. If you have those separated out, it's much easier to categorize them and understand what each thing does individually. And then you can tie them all together with other kinds of automation. So it's better to have modules that do one thing than it is to have a single module that does all kinds of shit that's not necessarily related. Modules should be readable. Like everything else, there's some cool metadata available in the module structure. And we'll see a little bit of code in a second explaining that. But if everything has a consistent structure, which we strive for in the framework, then it's a lot easier to write new stuff. It's a lot easier to understand what a single module does. And if we have consistent output, then you'll always have an understanding of what this module is doing as it moves along. And possibly most important, modules should be reliable.  If you have a kernel bug and there's a possibility of panicking the box, beer saves the panic. If you panic the box, you lose your shell. And then that's no fun. So you should detect everything you can that might affect your exploit or your module's functionality. So, for example, path names change between Windows versions. You know, you've got six wow and all that sort of stuff. And if you don't detect those variables and your module just doesn't work, that's kind of a bummer. But if you're doing kernel exploitation and you blue screen the bitch, now what?  So now the guy sitting at that console is going to go, whoa, what just happened?  So crashing things is very, very bad. And we try really hard to make sure that that doesn't happen. Again, as a part of reliability, cleaning up is one of the most important things that modules can do. You should always drive to leave your system in the original state you found it in for multiple reasons. If you leave stuff on the box, you could potentially end up causing antivirus to flag it later, things like that. I had a pen test in which for whatever reason my PS exec wasn't cleaning up on something like 10 percent of the size I owned.  So yeah, cleaning up is really important. Getting those phone calls is a bummer. So when you're developing modules, they're very much like auxiliary modules in that usually they're not an exploit. They don't have a payload. They do something. They record it. And then you can look at that data later in the database. In terms of the code, they have some similar structure and similar method names. All ox modules and post modules have a run method that's analogous to the exploit method in exploit modules. This isn't entirely the case because there are also local exploit modules now and we'll talk more about those later which are sort of a hybrid between regular exploits and post modules that allows you to do some really cool things in sort of blurring the line between a local exploit and a remote exploit. Post modules have actions just like auxiliary modules and a lot of people don't know that actions even exist but they're a way to have your module do different things based on what you need at the moment. So an example is installing something and deleting it are sort of disparate actions but they're related so they should be in the same module. So having a different action can let you separate those out in the code. And like pretty much all other modules, they can include mix-ins from other module types. So if you have a post module you can include exploit mix-ins and gain access to all the protocols that Rex supplies. You can include auxiliary modules and gain advantages of being able to report to the database easily. You get all those wrappers for free. You get potentially server code so you can set up other kinds of like an HTTP server. All of that stuff is available through the exploit and the auxiliary mix-ins. You also get the post mix-ins and there's an expanding API that's being updated pretty constantly now. I'm putting a lot of effort into making the post API as generic as possible and make it work everywhere in a single unified API. So you just say write file and it puts binary where you tell it to. And that is a very handy thing, you know, so you can disregard the kind of session it is and what kind of box it's on. You have the same API it works everywhere. You can write files to a Windows box or a Solaris box or a Linux box and it all works exactly the same way. So having that kind of separation in abstraction can really save you a lot of time. And lastly, like auxiliary modules, post modules should generally report something. If you're not saving the data then what's the point of gathering it in the first place? It's really important to keep that all together so that you can look back at your engagement and say, okay, yes, I owned this box but what did I get from it? And we'll talk more about the ideas of what to steal as we go on. But saving that data is just as important as stealing it in the first place. Hey, it might even be a little bit readable. Awesome. This is a very simple module just as an example to give you an idea of what the structure looks like. If you're at all familiar with any of Metasploits exploit or auxiliary modules, the structure is very similar. So you have a block of metadata in the constructor in the initialize method that gives you the author some information about the exploit or in this case the post module.  And it's really important for the description to include all of the relevant information about this module. If you're using the module and it just says does some stuff, then now you have to go look at the code to actually find out what stuff means. So we try to be really diligent in getting the descriptions to match up what the thing actually does. So like I said at the top, there's the chunk of metadata. Usually your mixing includes will also go at the top. And that, like I said, can come from the exploit, the auxiliary, the post, name spaces. And then we've got registered options and those are the things that show up when you type show options or set. And that's where our host and those familiar options will go. Most of the options that you're familiar with come from Mixins. So you don't need to do anything here for those like our host, our port. Those all come from Mixins. But if you need something specific to your module, like for example, in this case we've got a command that we're trying to run. So we register a string option that will be that command that runs on the target. So this is just a really simplistic module to demonstrate the structure of how they fit together. But I hope you'll go and take a look at some of the other post modules that are available. There's a bunch of them, there are over 150 of them. They all do something cool. And whether that something cool applies to your particular situation may not be the case, but it is worth looking at them just to find out what cool techniques are out there and maybe give you some ideas for other cool techniques that you'd like to try. So like I said, the post API is meant to be an abstraction to give all of the things that you want to do on every shell, a simple way to write that code. So writing files, running shell commands, listing users, dumping passwords, changing directory, that sort of stuff. The simple things that every module will want to or a lot of modules will want to do, all of that should be in a library that everything has access to and is really simple. And sort of the look and feel of the API is meant to be like a domain specific language where it feels sort of like a shell. You just type in CD directory name and that's where it goes. And so it is meant to give you a very simplistic and understandable and readable API while maintaining all the power of Metropeter and the available underlying shell. So yay, secret sauce. I like to break post-exploitation down into these three P's and as the footnote says there, I totally stole this from Mubix. I get all my best ideas by stealing them from people. So presence describes where you are, who you are, what is this box, is it important for achieving your goal?  So presence is all about what does this box do, who does it talk to, that sort of thing. Persistence is maintaining access to that box. If the victim reboots the box and that completely hoses you for the rest of your engagement, then you need persistence. So you need to ask yourself that question, when you get on a new machine, is this the only way I have to get back in? And if that's the case, then persistence is very, very important. Pivoting is where we're going to spend most of our time for the rest of the talk. Basically the idea of you have access to this machine and this machine has access to other machines or not necessarily other machines, but other data, other users, other places you want to be. And we'll get into more of that as we go along. So in presence, there's basically two subsections. We have the users and the machine. The machine itself can often be interesting, but the users are really important as well. The user is not just, is this guy an admin? Is it, it's more than that. It's, is this guy in finance? Is this guy in HR? Is this guy a developer? All of those things are important and the particular user you have access to can often be much more important than the machine you have access to. Of course, you know, if this guy is a domain admin, then you can just waltz around the rest of the network and all the rest of the security controls don't matter. But, you know, you don't always have domain admin. Sometimes you have it in the first 30 seconds of the engagement, but not always. And so if you end up on, like a developer's machine, you need to understand what that user does, what he has access to. So the user can sometimes be way more important than the machine. But the machine can be useful, too. Does the machine have, is the machine running a database? That's where the keys to the kingdom usually live. All your credit cards are in a database somewhere. All of your user information, all of your financials are in a database somewhere. So if you see those processes, then that's where you need to focus. And an issue with presence is getting an unfamiliar shell that you've never played on before. You end up on, you know, this is an AIX box. I've never looked at AIX. What do I do? Well, with the Metasploit Post API, again, we've got that abstraction. So you don't have to know what commands are available that will allow you to write a binary file onto that box, because we've already done that work for you. There's one API for writing a file and it just works. And we go through several different possibilities for commands that can write a file, printf, echo in some cases, although echo tends to be really unreliable. And a lot of places don't implement the dash n or the dash e. For echo, which you might be familiar with in bash, that's actually a bash built in version. Bash and Zish implement that, but basically nobody else does. And user bin echo almost never does dash e, which means the escaping of hex characters. So if you want to write out a file with binary in it that you can't normally just echo, if you don't have the dash e in the echo command, echo won't let you do that. So you need to find other ways to do that. We try xxd, we try printf, we try several others, purl, awk. So because of that abstraction, you can write files, you can do the things that you normally want to do on any of the systems that we've tested on, and hopefully more, because we try to do it in a generic way. So this is one way that Metasploit helps you out with presence. This module here is the enum logged on users, and it gives you the SID and the profile path of all of the users that are currently in the credential cache. So because of the way Windows caches credentials, you can just look around for anybody who not only is logged in right now, but who has logged in recently, and from that you can steal cached hashes, but sometimes it's more important just to know that that person has been there. And all of that is part of presence. So from the perspective of the machine, like I mentioned, the running processes can often tell you a ton about the box. If this guy is running some sort of antivirus or file integrity monitoring like tripwire, then you know you're going to have to be careful when you upload files. If that's not there, then maybe you don't have to be so careful. But it's something that you have to know. SSH agent and pageant are both very cool processes to see in the list, because it often means that you can steal that person's keys. If you upload Plink, and there was a cool blog post about this, I can't remember where I saw it, but it was a couple of weeks ago, where if you upload Plink, it will automatically use any keys that are stored in pageant. So if the user you're logged in as has run pageant and unlocked their keys, now you can use them just like if you were on that, just like if you were that user. Which means now you can log into any of their stuff. And similarly SSH agent on Unix like systems does the same thing. There's also the SSH master socket, which is a super cool way to own all the things.  But it's there. Editors are something that a lot of people don't think about. If you see like Eclipse in the process list, then that's a really good flag that this is a developer. And if you're on a developer box, that's almost always interesting because they usually have access to stuff that nobody else has access to. They have like backup data. They have test data. I ended up on a test system, and this tipped me off. There was a guy running notepad plus plus I think it was. So I started looking around a little bit more and it turns out there was a local MS SQL database that wasn't listening on the outside interface but it was listening locally. And it was a developer who had taken production data and was using that as his test system. So it was, you know, I didn't have to own a database server which was pretty highly protected. I just ended up on this one box and there was like 200,000 credit cards. Awesome. And what does this box talk to? Normally you want to find out can this guy talk to another system? Something that I'm interested in. Because again, your goal is usually data. It's not a box. It's data. It's where the data lives. So you need to find out what this guy talks to. What other users are available on the system. And Metasploit does that with the TCP net stat module which does exactly what it sounds like. It's net stat. And it gives you a list of the things that it's all connected to. A list of the servers that are listening.  So it saves you the effort of having to drop to a shell. This uses Railgun, which if you're interested in Railgun and the Windows API, I highly recommend you stick around for Dave's talk after this one. He's going to talk about owning all the things through Railgun which is a Windows API bridge for Metasploit. Persistence is the next big thing. Passwords are very, very important for persistence. If you log in legitimately as a normal user, then that looks just like a normal log in that everybody expects to find. And just a quick show of hands. How many of you audit successful log ins? Not failed ones, successful. A smattering of hands. Not very many. So if I log into 4,000 machines with the same username and password, that should probably be logged somewhere. People don't look at it. And it's how you get around. It's how you get around in a network using passwords, creating a new user that just lets you log in everywhere can really be the keys to the kingdom, just one user. There's also back doors which I think of separately as, separately from passwords. Not like a back door SSH, but like including something in the startup menu or startup folder. Things like that are a back door in my mind versus a password that lets you log in even if it's a back door password. And then lastly, reintroducing vulnerabilities. And this is something that Val Smith talked about in his black hat talk from a couple of years ago. And lots of other people have mentioned, Mubix has talked about it a lot. I think it's really, really interesting. But it's something you should be very careful about if you're on a pen test and you like remove a patch or reintroduce some other kind of vulnerability. You're potentially making another hole in your customer's network that could be really detrimental. So with a grain of salt, be very careful on a customer's network. But if it's not necessarily a customer and you're not into that hole not going to jail thing, it's a viable option. Metasploit has some sort of temporary persistence in the reverse HTTP and reverse HTTPS payload stages. They currently work for Windows native and Java interpreters. And it gives you a short term persistence in that it doesn't survive a reboot. But it will continuously pull out trying to make a connection out to you. So as long as that process is alive, you will have a shell even if your listener goes away.   So it's really super handy on spotty networks where you've got high latency, low throughput. If the network for whatever reason, you know, you end up with a reset, you just get another shell in a minute. So that simple ability to have it call back to you continuously means that it's some form of persistence that can save you a lot of headache if for whatever reason the network causes you to lose your shell. But of course it's temporary. So if the box reboots you lose your shell, if you really have to hang around for more than the life of this current boot, then you need something more. And for that we've got auto runs. And auto runs.exe is a really cool tool by SysInternals, which is now part of Microsoft. And it's something for administrators to look into all of the places where things run automatically. And if you're an administrator, it's super useful to find out the stuff that's running. But if you're an attacker, it's also useful as a list of places to push it. So auto runs is super useful. And we have a persistence module for Windows that has several techniques for dumping binaries into the right place, modifying the registry is necessary to make them run. You can also use things like the task scheduler to have it run things later. Cron and LaunchDi is sort of the Unix equivalent, LaunchDi is the Mac thingy. And we previously didn't have much for Unix like operating systems. Our persistence was pretty much based on passwords for a long time. But I mentioned in the Metasploit channel that damn, we don't have any cool persistence stuff for Unix. And then like an hour later, Alex Malato gave me a pull request. So that will probably be it next week. That guy is a badass by the way. And he is responsible for a lot of the cool stuff that you see in SMB these days. He did a whole lot of work on making SMB signing work in the Metasploit protocol implementation. So now when you want to connect up to a 2K8 server over SMB, he's the guy that is responsible for making that work.  You can also enable RDP or root SSH login or whatever to give you another place to use passwords. And passwords, as we mentioned before, are one of the best ways for maintaining persistence. Now the really fun stuff, pivoting. Going from this box to something more interesting. Not necessarily on another system, but potentially just on the local system pivoting to a new role. Going from a user to a root or a user to another user. And that's part of privilege escalation. But then there's also trust relationships. So this box is allowed to connect up to this MySQL server, for example. Those kinds of relationships are very important. And the way Metasploit does pivoting, there's a few different mechanisms for it. The first is the route and the port forward commands, which allow you to set up a way for Metasploit to send all of its packets through a compromised machine. And that's a very simple way for running new exploits against something else. Or port forward is one of my favorite tools when looking at like a corporate internet. You own a box. And on the inside, through phishing or whatever, you find out that hey, this box is an internet that has potentially interesting stuff on it. So we set up a port forward that goes from your local attacker box, goes through the compromised machine and comes out on the other side.  So you get to use all your normal tools for web auditing. You can use Burp or whatever. And all of that stuff just goes right through the compromised machine. The SOX module, the auxiliary module sets up a SOX server on the local machine and gives you the same sort of idea. But since it's a proxy, you can just set that as your browser's proxy and then use it on all of the internal HTTP servers. So with those two simple techniques, you can run exploits against everything on the other side. You can scan them with auxiliary modules. You can browse their internet with your own web auditing tools.  The last bullet here is the COM argument to the Rex socket library. And Rex sockets are Metasploit's implementation that allows you to use the route and the port forward and all of those things. And it's the underlying library that allows all that stuff to happen. It also gives you SSL for free. It gives you proxies and a few other options. But the way that's all implemented is with a COM object. And Meturpreer sessions are all COM objects. So you can just pass a Meturpreer session into a socket creation. And then from that point, that socket will be connected through the compromised machine. And there's not a whole lot of use of this yet. It's a relatively little known feature. But it's very, very cool. And I think it will be super important for post modules in the future. I think it's one of the best things about Metasploit is being able to create new sockets on the other side. And the COM object gives you a quick way to do that. So for example, you can set up a post module that scans something on the other side using the session as the pivot point. And that way you don't have to set up an explicit route in the console. The post module will just do everything for you. So look for a lot of that stuff in the future. And if you're interested in writing something like that, please talk to me. I would love to get more of that stuff in. And also part of pivoting is post exploitation, exploitation, privilege escalation for when you get on a system that you would really not like to lose. It's often important to have route or local admin. If you're on a user session, if you got them to click an exe, then when they log off you lose your shell. So you need to get out of their window session into something that's going to run for a long time at the very least. Or potentially if you can gain system, then you can just migrate into some other process and not have to worry about getting kicked off when they log out. It's, of course, when you're talking about kernel exploitation, there's always the possibility that you're going to panic your machine or hit the wrong button. But because of the difference between local exploits and remote exploits, you have to be careful with the, you have to be careful about not kernel panicking the box, of course, but also if you're dropping an executable, there's an element of it being local because you're dropping an executable. But it's also really remote. So anyway. Just like network exploitation, it's not always an exploit. Sometimes it's really just passwords such as sudo, things like that. Suit executables, I sort of think of like a trust relationship. The same idea that logging into a server from here to there works. You're using this executable that runs as root. So it's kind of a trust relationship. And there's all sorts of things that count as misconfiguration in the same line. So first demo. This is Nmap in its man page has this quote Nmap should never be installed with special privileges e.g. suit root for security reasons. And some friends of mine mentioned that that happens more often than you think. You find boxes with Nmap installed suit root. So I looked into what security reasons actually means. And it turns out there used to be a command called or an option called dash dash interactive. You just pipe shell commands to it and you win. So they took that out a while back at about the same time that they added NSC scripts. So now you can just write an NSC script that pipes out to shell commands and you win. So here, if I can find my mouse, maybe. Okay, so first thing here is we're just going to show all the options. Very quickly drop into the session show that we're user 1,000. We're not root. We set that session. We run the exploit. It drops out a file. Drops out an executable. Runs the executable. And now we're root. Very simple. Easy to clean up. Just drops a couple of files. Woot. Sox entry page. This is one of my favorite kernel exploits of all time because it covers everything. It goes from 244 and 260 to the most recent kernel versions at the time that it was dropped in August 2009. So it covers 8 years of every version of the kernel that shipped. So this gets you root everywhere. Now this one is a little more complicated. So we're not just dropping an executable and a thing that runs that executable. Instead, we're, and you can see here I'm not root yet, we're actually compiling C on the fly and assembling it with custom shell code and dumping a payload into that so that now, as you can see here, we get a new session and it takes a minute because we're still cleaning up. And this I think is very, very awesome because we're compiling C and assembling shell code in Ruby so it works anywhere that Ruby does. Very cool. This is the part I was talking about where local exploits sort of blur the line between local and remote because you're using something about the session and you're still pivoting into a new role as a new user. But we use post mix-ins to be able to do all the post stuff and exploit mix-ins to create executables and that sort of thing. We can compile C for those two architectures and assemble for all of those and a whole bunch more. So now I want to talk more about Windows and we talked about trust relationships but this is sort of the same idea. Windows has some cool little tricks because of the way their authentication works over the network. So first I want to talk about a recap of SMB relay. This is an old school technique that was talked about for the first time at least since 1999. But a victim talks to some attacker machine and it doesn't matter how, why it's talking to that machine just some, for some reason it's calling out to this box. It attempts NTLM authentication. So the attacker just sends that same packet straight over to a target and he wants to own that target. The target sends back an 8-byte challenge. We send that same challenge to the victim. The victim calculates a response for that challenge, sends it to us, we pass it on. Now we're logged into the target as whatever the victim user was. This is a well-known attack. It's been around for a long time. There are some mitigations that break it but it's been around forever and it will probably be around for a lot longer.  But if you do that then you break all of your old clients. So nobody does that. If you only have newer Windows systems then you can turn on mandatory signing and break this for the most part. But very few people actually do that. So now this is an awesome new technique, well relatively new technique of dropping an LNK file. It turns out that LNK files are sort of like a sim link in the UNIX world but they can have an icon and that icon can be a UNC path like most things, most paths in Windows can be a UNC path. So we drop an LNK file on some file server that we have access to with an icon that points back to our server. So now some victim opens up that share. The share has this icon. The icon is a link to our thing so it tries NTLM authentication to our box. And so once we do that then we can own all the things. Very cool technique. Another thing that Windows does is automatic authentication with your token. So in the GUI when you open up a file share it uses your current token to authenticate using the same technique. So if your user has local admin on another box you can also create services on that box. And turns out those services can also point to a UNC path. So this is the API call that does that. LP machine name can be a UNC path. And then LP binary path name, or excuse me, machine name can be like any server that you want to create a service on. LP binary path name can be a UNC path so it points back to your box. So now automatic authentication. So we can see here that we're a domain user right there.  We have his token. So now go go video. Our host here is 10111 is our domain controller. So now get UID where system on this guy. He's the domain controller. And you can see that's the new address. So the cool thing that happened here is we didn't have to know a username or excuse me we didn't have to know a password. There's no hash here. There's no password. All we did was have a box with the token. So now that the domain controller called back to us and gave us a shell. Very, very awesome. It turns out you can do this on everything. If you have local admin, if you have any user, any domain user that is a local admin on all machines then you can get a shell on all of them. So Metasploit is awesome sauce. Yay. And if it doesn't already do something that you need it's relatively easy to add your own stuff. The module structure is simple. The amount of Ruby necessary to learn how to write new modules is minuscule. If you've written any other scripting language you can learn the Ruby necessary to write a module in an afternoon. So if you're interested in more post exploitation awesome sauce stick around for Dave Maloney's talk. He's coming up next. And this is how you can contact me.  And also these.  I thought it was funny. So there you go. Thank you.


So during Platinum Lion, we really hit the mark for what the combined arms company is out here to do. We're out here to show our NATO allies the capabilities with armor, light armor, artillery, air support that we can bring to the table and that we can integrate with our NATO allies. Well, if they pause, there's two packs, there's a frontman and a rearman, the frontman releases down the rearman right behind them. They connect three safeties, they put a rocket on it and the rocket's going to shoot out over the wire obstacle and then you got about 20 seconds, so it blows the lane inside that obstacle and then one of the engineers comes up with a CMD and they've proved the lane for following forces to come through. During the final exercise, we conducted a multinational attack, incorporating Bulgarian motorized infantry, Bulgarian self-propelled mortars, Romanian infantry, Marine Corps, artillery, tanks, LAVs, we had some Air Force A-10s. Basically, we did a combined arms attack working all together, integrating all of our fire support assets and all of our tanks in combat vehicles together. When you have people that share a common occupation, no matter the country or the language, we all do the same thing at its core and it's easy to break the ice. When you have US tankers working with Bulgarian tankers, US infantrymen working with Romanian infantrymen, within a day these men were working together like they'd been working together for years.


ball in the fourth. Well I mean first off I turned the wrong way and tried to recover ended up thinking that it was still over right on top of me and it being behind me on the second look and then you know I tried to turn around and catch it but by then I was already beat by the ball you know and that was a run that you know Garrett shouldn't have to deal with. How frustrating was tonight as a whole for you? It's really frustrating. I mean you know second inning you know got on first and second you know ended up striking out and not getting the job done and come back up bases loaded you know trying to stay short and try hit the ball at the middle end up queuing it right back to the pitcher for a double play. Just overall you know extremely embarrassing actually you know even if I'm not hating I want my defense to be on point and you know I messed up out there as well. You think offensively you haven't been able to find a groove this season? I don't know you know I mean I'm putting the work in you know trying to do my best to compete compete every single day especially for this team and you know everything I'm doing is just not showing up you know result-wise you know I'm either you know lying out striking out or you know just rolling over something so just overall disappointing you know and you know I'm still gonna get back out there tomorrow and try to figure out a way to you know continue to help this team and you know try to win. When the crowd gets on you like they have been does that make it any harder to bounce back? I mean yeah I mean I guess you know I'm out there trying to compete you know and help this team win and obviously it's not you know nice to hear booze but you know when you're having a season the way that I am you know that's kind of the way it goes especially around here and you know they want results


Did you know that some people who have blocked arteries only become aware of it once they develop symptoms of stroke or heart attack? This was confirmed by the British Heart Foundation.  In the next 60 seconds, I am going to share with you three best vegetables to eat to unclog the arteries and lower the risk of heart attack. The last one is super important, so watch till the end. First up, the leafy greens. You might think salads are overrated, but not in the world of heart health. Spinach, kale, collard greens, and Swiss chard are the MVPs here. Loaded with dietary nitrates, they transform into nitric oxide, a heart superhero that improves blood flow and brings down that blood pressure. Plus, they're packing fiber, potassium, magnesium, and vitamin C and K1, all superheroes in their own right. Aim for a serving a day, and your heart will thank you.


Hey everyone, Shaper 1000 here and I got the famous or infamous, however you want to look at it. Monkey 1000, hey guys. Today we're going to be doing a macaroni and cheese review. Cheetos. I weren't aware that they made these. Now I was watching um outdoors McGee and he took it on a camping trip with me and I was like oh when you try that she said oh I've seen them. How much was this? Well I got it at Windix. It was $1.99. Yeah but he says you can get them at uh the Dollar Tree I think. Yes that's what he said. For a dollar. Yeah a dollar or whatever but so it's cheaper to get it there if you can. Right. But so I thought man we gotta give it. I didn't even know they made these and I like Chester Cheetah. All right. They have three flavors. Yeah. Well then we've got two more videos to make. So there that is. And we're going to show you the nutrition facts right after the intro. Cue the music. Hey guys so I will show you the nutrition facts right here as soon as it focuses you can pause and read if you would like to. I read the instructions. It's just the same as make a macaroni cheese. You will need two tablespoons of butter or margarine six cups of water and a quarter cup of milk. If you're cooking on the stove, microwave's getting ready to ding so don't get alarmed. Yeah. Boil at least six cups of water on high in a medium saucepan. Stir in pasta. Cook for seven minutes or until tender stirring occasionally. Then you drain the pasta. Do not rinse. Return it to pan. Then you add your two tablespoons of butter or margarine and let it melt let it fully melt. Then you add your a quarter cup of milk and seasoning which would be the cheese pack. So what we're going to do right now is I'm going to go ahead and I'm going to boil the water and I'm going to get this boiled up and then I'll come back. I'll bring you back when we're mixing this up. All right. Okay ladies and gentlemen we are back. So I got two tablespoons of butter here and it says to go ahead and mix this up until this is fully melted. And then we're going to add our cheese sauce mix and our milk. So let me get this melted and I'll turn you back on. Okay. So we got that melted. I got our milk here, a quarter cup of milk and our cheese sauce. I didn't even know they had this. Can you hand me that please? Sizzles or knife anything. Thank you. But yeah I seen McGee have that and I was like oh we need to try it. Monkey said I've seen that. Oh nice red. So we're going to pour this on here. Now it doesn't have it's not as much as like craft. I think craft is seven and a half ounces and this is like this is 5.9 ounces so almost six ounces. Craft is seven and a half ounces. So let's go ahead and add our milk. Now we're going to mix this up and I'll put them in some bowls for us and we'll give it a shot. So hang tight guys and I'll be right back with Will. Be right back with you. Look at that. Who's the cheesiest kid? All right we'll be back with you. Okay we've got him dipped out in our bowls. She's got her, what do you got there? My spoon. She always does this thing. Are you ready? Yep. Oh wow. Nice. Very good.  What do you give it, Monk? A four. A four? Four and a half. It's up to you. I'm just asking. I give it a four and a half. Two thumbs up? Oh yeah definitely. I give it two thumbs up. I'm going whole hog again. Five out of five stars. Very good. This is good but like I said McGee he added a bunch of stuff like tuna and stuff. Yeah. Which I've done in regular macaroni and cheese too but I wanted to taste this by itself first. Yeah. You know to know what it is. Because if I go adding stuff my haters are going to say well you added stuff and they would be right. Okay guys so there you go. That's excellent. Very very good and there's two more flavors. Yep. What are they? Flaming hot. And jalapeno. I knew it. Yes stay tuned for them videos. Right? Yeah and they always have them so it won't be hard to get those but this one was very hard about the last two boxes. Yeah you bought two boxes? Yeah there's another one up there. Oh well that's cool. Yeah. All right so anyway guys thanks for watching. They're suggesting surgery for Monk Eso. Yeah.  But so we've got to discuss that. Yeah. But they are suggesting get it done soon so. My decision. Yeah. But we'll talk to it as a family. Talk about it as a family. We'll talk to it. Hey surgery come here. We need to talk to you It's not what I wanted to hear but. Well of course not but like we discussed earlier it's not going to get better itself. No. I'm getting older. Yeah we know you just turned 64 so. Behavioral. But um yeah but it's not I mean it's not something that she can recover from and get fully better without surgery. Right. So you know anyway that's what's happening there. All right guys I appreciate you watching. Thank you so much Monk. Monk says she's out for now y'all. Bye. Don't forget to check her channel out. Go give her a visit and watching her videos. Rolling again. Well you got to get filming again. Yes. In order to get rolling again because she's always complaining. I want more subs. I want to get monetized. Well you got to make videos. Yeah. Well someone's coming home tomorrow. Yes her mom will be home tomorrow. She don't want to go back to rehab so she's. No she's not what she said. Excuse me she's she she don't like it there so she's going to be home tomorrow. Yeah. Still not doing great at all. No. No. But you know we'll just make her as comfortable as we can huh. Yeah and they should be home. Yeah. Yeah it should be home. Always great to be home. Yeah so she'll be happy. Well she don't like the food. That's the main number one thing. Yeah I don't like the food. I want Morty's food. I want Morty's food. But I feed her. Monk is like she don't need that much. She won't eat it. Man nine times out of ten she does. All right guys again thanks for watching. Appreciate it. Shea Berry met the man alleged. We've gone from now. Monk says she's out by y'all. Bye guys take care.


So, in my perspective, PyTorch is just wonderful. It's been taken up by the academic community extremely rapidly. This is what you can see on the left side here. PyTorch came, started becoming popular in late 2017 and by mid 2019, it had reached the majority of the scientific community. Before that, a lot of people were using TensorFlow and the transition was extremely fast. Here's a fun comment by André Capathy, one of the leaders in that field about it. I've been using PyTorch a few months now and I've never felt better, I've more energy, my skin is clearer, my eyesight has improved. But this is just an example of how people get excited about it. It's a very useful environment in which to build deep-blowning systems. So, now, whatever we're going to implement, in this case, AlphaZero game playing, the key for any successful deep-blowning project is having a good intuition of what really that problem is that we will want to solve. So why would we want to use deep-blowning in this context? Well, there's lots of different ways how we could use it. Maybe we could say, let's choose the best action as a function of the bot. And we could say, let's use machine-blowning, deep-blowning for this estimation, the best action as a function of what the bot is. This is not how AlphaZero actually works. So how would you use deep-blowning to solve such a problem? So now your task is the following. Play another student and while you play with them, really train, ask yourself, what are you doing and why are you doing it? And describe how you played. While you were doing that, were you optimizing something? How could you imagine making a computer play well in this context?


Going on everyone Sam here with late in sports cards doing a three box 22 top Star Wars chrome galaxy Break for UC. So good luck here. You see again. That is 3 22 tops chrome or top Star Wars chrome galaxy Hype intro gets me every time That max max for staff in super auto. Good God Good God, man. I'll see a super out of here a sketch out of here, dude. Good luck. You see let's see it, baby Come on, baby sketch sketch sketch sketch Refractor sketch variation refractor of boss base Got pulled somewhere and released that interesting Refractor is a skywalker legacy base and base What'd you get Tyler ooh green? Wow? Star Wars 37 out of 99 G gameplay galaxy nine there you go. You see Congrats on that buddy. That's nasty this one. Wow. Congrats on that. You see there you go, buddy Chewbacca's anguish refractor and base. That's really freaking cool. Oh Wow, I came out 91 that game. She's November 15th Empire at war. There it is. There's gameplay galaxy number one Empire at war refractor refractor of Life on Tatooine Yeah Refractor we've got auto is Zeb Arelius on the Steve Blum is Zeb Arelius base. Oh Wow, that's awesome. There you go Tyler refractor vintage Star Wars card Refractor of attack on Hoth Stupid droids There's Yoda fractor that'd be interesting Which series Ian he's in rebels rebels got which is pretty much after revenge of the Sith It's like okay as the Empire's taken over the galaxy original concept That is That aboard the bridge. Oh Boy, Kyle saying imagine this nothing good will ever come out of that. I'm sure Yeah, but Star Wars related. It's cool concept refractor is a dark turn for Anakin Skywalker It's do we need an angel Abela sketch. That'd be so far 153 that's our college basketball script writers. That is base card sketch variation refractor is With legend tillies in battle Darth Vader base Which one Chewbacca? Refractor is Poe Dameron base and base original concept card Enemy of the Empire refractor. I know just base them remind Base there's nice that is gonna be a sit drooper to 75 nice one there. Hell.  That's nasty. Yeah. Vader's in the set are really cool So base or they refractor Vintage there's a grito refractor base Yeah feels that way but Star Wars Starfighter gameplay galaxy Do you look like closely if you take a refractor and put it next to a non refractor? You can see it's a little different like these two That is Kylo Ren. Yeah, we break Marvel over on late in gaming. We do a lot of Marvel over there Not over here as much. I don't think we really do it all Tuscans in their bantha. Do they would remember Starfighter? Is that a card stuff? No, it was a game. Oh Right oh god Here he goes the king of comedy himself There's Yoda and Dagobah refractor Base. All right. Good luck here. You see box number two. Come on sketch. Show yourself show yourself. Thank you I'll be here all night. Thank God What we do Probably not earth. I would say they're full. I'd say if you ordered something now, it'll probably go tomorrow Refractor of Wookie in the wilderness Yoda show yourself. You will Oh orange nice That's gonna be orange to 25 vintage Star Wars very nice Congrats on that one.  Yeah That's cool nice Refractor of Trojan. Yeah, the vintage ones are fire. Come on sketchy Princess Leia or Ghana refractor base and base What was Princess Leia's adopted father's first name Emperor Palpatine? It's a good question man. So for at least the guests Schmini Chat any answers in chat Bob no close starts with B Original trilogy concept card stormtrooper atop a do-back Bail is correct. He's Pete. He you are correct sir. You call Pete the pole Starts with a B and Cal says Frank Cobb Van Benito to brick a shawl paste and paste on sketch Billy Bob Infamous Boba Fett Yes, you get guaranteed one auto or one sketch There is Original trilogy. All right, Kyle. Let's you off. Sure. Sure. It was sip trooper This you want was like a grumble No, Torre doza, come on give us one sketch card refractor I'll see 3 p.l. Refractor Or a super come on Honestly wouldn't have changed my answer true Very true. I know you well enough Kyle where yes, it would not have There is a refractor of battle with the Dianoga medical droids what is Bryce I can stuff over We've got nice that is gonna be Omega to 99 on the portrait card congrats on that On the wave there you go. You see they're very nice buddy. Irelia speak. I said this is Sean right here Did a chrome? Yeah All right trivia question chat. Who is Omega's brother? Schmidt II There's again another Omega. It's time to 75. You're so close Right, isn't that Sean nice Star Wars Battlefront 2 gameplay Galaxy It is we I That's a good one that is the clones will keep or dance I mean technically, that's not wrong, but I was thinking of a particular person There's Jedi night one there Refractor is Han Solo and Chewbacca in the cockpit. No, but that was the answer Ah Refractor Anakin Skywalker sketch variation that is stormtroopers swarm Darth Vader fun Fun catch last two packs. Come on. I'm making a boat over there. Oh, it's not a sketch. No Yoda Costanza, that's what they they call him right there Yeah, Carl, you know where I was getting that That is the Boots a Eve classic There's no auto or sketch in this one You see we'll send the empty box and wrapper again That doesn't look like it. Come on man Refractor Boba Fett in the Sarlacc Base and base sending up the box and wrapper. I apologize you see No, Shane, I I agreed with you your answer was technically correct. It's just not the one I was looking for Yeah, I got you. Sorry about that. You see hey when that happens there, it's So obnoxious bro, yeah, I don't understand how they can drive me crazy All right, let's see So you're very the PD tops Give us a sketch Give us a sketch. It's all I ask Is refractor pair sketch parallel refractor Qui-Gon Jinn base Liam Neeson Refractor is of Dark enter Darth Vader. Yeah, we got blue is non Nambi Gima. It's a 150.  It's not great. Not that good. Just a filler. Oh purple Nice one there To 50 base card sketch variation very nice. Yeah later Refractor of a wookie's wrath. Yes, there should be an auto minimum in every box Yes, auto or sketch Four is bounty hunter like galaxy refractor Luke Skywalker and base Dude bounty hunter was another really good game. I remember here. I remember that That is wave refractor 299 Obi-Wan Kenobi and Boga nice one there. You see congrats, buddy. Nice wave enter Darth Vader Wookie Wookie's wrath bounty hunter was a cool game because it it went in depth on how the clones started. Mm-hmm That is vintage Star Wars card at Grand Moff Tarkin base refractor is Gamoran guard that was there was a really good episode chain. I really like that one as well. I Thought they're gonna pick up this episode from that one Boba Fett sketch variation card Refractor attack on no snow troopers invade off not attack on Something getting invaded. There's general grievous refractor. There's refractor Nice one here. That is gonna be in the meditation chamber. Nice one there That's one of the nicest cards in the set, right? That's you see his favorite Meditation chamber. Yeah, so sick. There's refractor of Leia, Organa Shane, what's your what's your prediction on the next episode? next week refractor of Here's some doula base and base Jedi Knight Dark forces to gameplay galaxy refractor is of tech base Stormtrooper surveying the desert base base Give us like a super fracture or a red. Why not? Red be cool. Red be sick red Vader. There's a vintage Star Wars v1 That is Duel on the Death Star. I Think he has autos in this Tyler. I think he has autos Like the actor has autos I remember pulling one during a group break Tuscan Raider refractor Quigan gin Shane, I think I think Cody is gonna go try to find Rex. I Think I think that and then crosshair might Catch variation refractor lack of faith nice one there on the refractor base And last pack for you. So you good luck, buddy base stormtroopers assess their gear Clean the case right now nicer fractor and base that'll do it for your break right there. You see thanks again As always my man, I'll get those right out to you, buddy