A good morning. So everybody that's like from the middle half of the room, if you all want to come up a little bit, there's going to be some of the slides here that got some code on it. Codes got really tiny text. I know my eyesight isn't that good that far back, so try to do the favor to you all to come up a little bit forward so you can see what's going on. With that, here's topper. Awesome. Well, thanks for having me. This is actually my first time speaking at DevCon and my first time attending, and I am blown away at the caliber of this community. I'm glad to be a part of it, so thank you for coming to the talk. So this is hijacking arbitrary dot net application control flow, and I'm going to show you how to essentially screw up some dot net applications. So before I get into the meat, who am I? I'm a security researcher right now at Intel. Previously I was doing security research down in Ashland, Oregon at Southern Oregon University with a great group of people, several of which are in the audience, so thanks for the support. I've also done a little bit of security training. Most recently I co-led a talk on dot net hacking at the new developers conference in Oslo, Norway, and then I occasionally blog and occasionally tweet. So overview. Dot net.  Well, like I said, I was at the new developers conference in Oslo, Norway, and 80% of the attendees there were dot net developers, and there's constant jobs up online for dot net development within enterprise. They're building enterprise level applications, SQL databases, fingerprint readers, et cetera. So there's a big market for dot net developers, but there's not really people attacking dot net. So because of that, I'm going to go through runtime attacks in the dot net framework, so doing things like manipulating the just in time compilation process, manipulating things at the machine code level. I'm going to show you how easy it is to modify control flow in dot net applications, taking branches and call instructions and changing them arbitrarily to things that you control to essentially do something different in the application. That's evil. And then I'm going to show you machine code editing in dot net. This is not really a common practice being taken place right now. A lot of people are doing like ILD compilation and then changing bytes at the I.L. level, and these are all on disk attacks. So I'm going to take that a step further and go down to the machine code. And then I'm going to show you how easy it is to manipulate the managed heap, which is the mechanism that dot net uses to store all instantiated objects. So it's actually unprotected, so we can go through it and rip off objects that are currently instantiated and utilize them ourselves. So that's essentially why we're here. I'm releasing tools with this presentation, gray frost and gray storm, which I'm going to be demoing. This is a pretty demo heavy presentation. And then we're using dot net to attack. Not many people are operating in this space, which I'll get to, and I think it's pretty freaking cool. And then of course we're using objects on the managed heap, which isn't really something that's been too much done before, and I think you're really going to enjoy it. So when I talk about CLR attacks, or the common language runtime, essentially I'm talking about the actual runtime. So you have a process running on your machine, say for example a C application, and that's the process. In dot net there's a level underneath that, which is called the CLR, and that's essentially its own little container for that dot net instance. So it's essentially inception. You're running a process inside of another process. So there's two main versions of the CLR. There's version two and version four. And commonly when you're building attack payloads for C sharp, you have to worry about your target application. But I'm going to show you how we don't have to worry about that anymore because I took care of some of the work and now we can use any payload and not care about what version we're running in. Also with the CLR, that's essentially where the managed heap is living because it's this runtime concept where objects are being stored. So that's essentially a part of attacking the CLR. If we keep diving down into what makes up a dot net process, we have these things called app domains, which are essentially these giant containers for running code and they contain the actual executable that we're running and all of the DLLs that we're running and those things are called assemblies. So essentially within an app domain, which there could be more than one, but it's not really common, and utilizing that commonality when I go through gray frost, it makes a little bit more sense. But essentially because of this, we're able to control all loaded code and if we have access to the CLR itself, we can manipulate the just-in-time compilation process. So when we're attacking with assembly or ASM, since assembly is an overloaded term now in dot net, since it's also a module like a DLL or an executable, we can go through and manipulate the actual resources of those things. Go through, edit the method tables, call in with actual machine code in dot net to go through structures and enumerators that you're not typically allowed to be doing in the dot net framework, but machine code makes possible. And then of course we're attacking methods just purely at the machine code level. So here's kind of a little bit of a layout of the runtime, if that didn't really make sense to you. So again, you have your process, you have the CLR and app domains, you have your assemblies and then it's like any other language. You have objects with properties, fields and instance methods and you have classes that contain static methods and the core logic of your application. So now that we have an idea of what a dot net process looks like and what these tools are actually going to be doing, I'm just going to jump right into them instead of boring you with more details about dot net because we all know how to read. So gray frost and gray storm are two different tools but they're acting in tandem for the purpose of this. Gray frost is going to be a DLL that you inject into your target application and this is going to act as a bootstrapping process to bind our payload into the dot net CLR and I'll go through that in more detail. And then gray storm is the payload that I'm delivering with gray frost. Gray storm is going to be an in memory attack reconnaissance tool written in C sharp that attacks dot net. So gray frost in detail. Gray frost is our payload delivery system. It's essentially a C plus plus DLL that acts as a dot net CLR bootstrapper. So what that means is it's going through and figuring out what methods it needs to call within MS query which is the main dot net CLR DLL.  However, because I mentioned there were two different versions of the CLR that we needed to worry about, version two and version four. This payload delivery system also has the capability to pivot into the 2.0 runtime if needed. This is what gives us the mechanism to not care about what our target application is actually running and we can just insert an arbitrary payload like gray storm. Gray frost is also going to contain the raw payload in a byte array. So that's once it goes through its bootchapping process and it's in the proper version of the CLR, it's going to fire our payloads void main. And it does this in two rounds. The first round is essentially what I'm calling gray frost CPP. This is the DLL bootstrapping process and then after that process finishes we're running gray frost C sharp which is inevitably going to fire our C sharp payload. So graphically this is going to look like this for round one which is gray frost CPP. We have our dot net process running. This could be on a box that we have physical access to, remote access to. It doesn't matter because all we need to do is do DLL injection. So you can utilize metasploit, utilize a tool that I'm going to show you called gray dragon. It doesn't matter just inject the DLL however you see fit. Once gray frost C++ is spinning up in that target application it pivots down into mscory.dll, calls the needed methods and instantiates the CLR. And then it pivots into gray frost C sharp which at this point we're in the proper version of the CLR 4.0. So we have our dot net process with gray frost C sharp running in it. We're in the right version of the CLR so our payloads void main gets fired and now our payloads running in tandem with that process. If we have to pivot between runtimes because our target application is running the CLR version 2.0 which you might think is not that common because 4.0 is the newest and greatest thing but developers are lazy so a lot of things are still 2.0 unfortunately. But it's not much more of a step. I've done the work for you. You just have to utilize the delivery system. So after injection and after it pivots down into mscory and fires the first round of gray frost C sharp, gray frost C sharp realizes that your app domain's name is default. If it's labeled as default this means that the target application isn't actually running an app domain because it will normally have a name associated with it that's not just default and I'm making default when I inject. So gray frost C sharp comes back into gray frost C plus plus. We pivot down into mscory, do a little bit of cleanup and then fire gray frost C sharp once again in the proper version of the CLR. So that's gray frost in a nutshell. Like I said it's being open sour so you can go through and read the code of how all of that is made possible. But let's get into gray storm which is the payload I'm delivering with gray frost. So gray storm is our reconnaissance and in memory attack payload. It has several features that are going to be attacking .NET both at the assembly level and at the run time level. So we're going to be able to do things like attack the .NET just in time compiler. If you're not familiar with just in time compilation it essentially means that when you hit compile button on whatever IDE you're using you're not generating runnable machine code. You're generating something at least in the .NET framework called IL code or an intermediate level language and at run time that IL code gets jitted or just in time compiled down into the actual machine code that's going to be ran by the CPU for that particular method. We're also going to be able to with gray storm attack .NET at the ASM level. So I'm going to show you how easy it is to rip pointers off of methods that are already just in time compiled, view their assembly instructions and then override and pure. And then I'm also going to show you and demonstrate how easy it is to roll your own assembly payloads and you can even utilize Metasploit payloads but there's subtle differences between the two that I'll go over. And then of course we're going to be able to utilize objects on the managed heap. So usage of gray storm. I'm going to start off by talking about controlling the just in time compiler. So essentially when you have just in time compilation in the .NET framework when something like method A is calling into method B. Method B contains a method table that has a thing that I'm calling the just in time compilation stub and that contains an address to where the IL code and where the machine code is going to be generated at JET. So because we know this and because Microsoft chose to leave in the framework all of this stuff unprotected, we can go through and grab those tables overriding with anything we want and essentially control the just in time compiler. With this said, if something has already been just in time compiled that we're wanting to attack, this is not possible and you're going to be needing to do something at the machine code level or wait for something to get garbage collected because at that point something is going to be just in time compiled again because the .NET framework made room for something else. So graphically this is going to look like this in the demo. Method A is going to call method B and then method B would initially call into the method B JET stub but what we can do is we can just take a hacker method with a hacker method JET stub, redirect method B to the hacker method JET stub and now method A is going to call hacker method instead. So I'm going to open up a target application right now. This is a pretty cool little markdown editor for Windows since I'm not running Linux because it's new right now. So here's gray dragon. This is a remote DLL injector. I think it's cool for demo purposes because it has this cute little crosshairs that you can drag over to your target application and then I've done a little bit of editing where it's going to automatically select what version of gray frost I need to inject because this payload delivery system is also going to account for the differences in 32 and 64 bit target applications. So once I do inject this is going to inject gray frost into this markdown pad program and then it's going to go through the whole entire boot shopping process that I described and spin up gray storm. So I just injected it, it did the boot shopping process and now I'm running gray storm and it's running in the 4.0 version of the CLR. Now before I go through and actually attack the just-in-time compiler I'm going to do a quick run-through of what this application is. You can see over on the left side that this is inside of the main app domain and you're seeing all of the assemblies within that domain such as the main executable markdown pad and all of the DLLs it needs. So you can keep pivoting down further and further into each of these. You can go to something like markdown pad 2 app, look at what methods it contains. Do things like dump the assembly so I can see the raw machine code for that method after it's just-in-time compiled. Look at the IL code for the thing. It shows me where the address of that machine code is so if I want to do something like attach this application in Windows D-bag, hit a break point, I can now break point on methods which is a little bit easier than having to track them down. But essentially let's just go through and now attack this just-in-time compilation process. There's a licensed feature in markdown pad 2 that allows you to export something to a PDF and currently I have a license for it so I'm able to do this easily. I want to change that feature and I want to insert my own method there. So because I don't want to wait for the just-in-time compiler to do garbage collection I'm going to close out of that application because I just forced a JIT. I'm going to reopen the target application.  This is going to allow us to compile new code on the fly which I've already prepared. Essentially I'm going to pop up a message box that says owned and return false because I actually don't want a license for this application anymore. So I'm going to paste that here. I'm going to hit compile and now it's over here in my methods list and I can fire it to make sure it works and oh look it says owned. Awesome. So if I come back over here and trace down and mark down pad 2 there's something here called licensing helper and then there's a boolean validate license so I'm just going to right click it and say replace method with custom C-sharp and it says oh look replacing with DEF CON. So now I'll come back over here to file export PDF and now I got owned and I don't have a license anymore. So that's attacking something before it's been just-in-time compiled. If you want to attack something and you don't want to do what I did and restart your application or wait you can do things at the machine code level. So in dot net there's both far and relative calls and you can just take because I showed you how easy it is to dump that machine code and I'll show you how easy it is to overwrite that machine code. Just figure out what call instructions are going to whatever method it's actually calling and then just replace them and change them. So this is a way to attack something after JIT when you don't want to wait because you're lazy or you want to do something right now and not wait. And of course we know if we read the Intel manual that calculating a relative call address at runtime is a little bit difficult but there's source code on the repo where you can read this and how I've made it easy with a simple method call. So now we get into actual machine code payloads. So utilizing reflection which is just a namespace in dot net that allows you to see things like all of those assemblies, all of the app domains and metadata about specific methods. One of the things that lets us see is actually where that machine code has been just in time compiled to and it's left unprotected in memory. So we can just take it and change it. So we can create cute little payloads to do things like steal stack parameters. Say we see a method of interest that's taking in a password. Steal that password, send it off to your email server and then return the password back to the application and you just stole some stuff. You can do things like change events. So a mouse click isn't a mouse click anymore. It does this other stuff behind the scenes and then the mouse click, it's really up to your imagination. The most quick approaches to doing this are doing things like changing truths to false and false to truths because developers are awesome and that they modulate code really, really, really well. So there's always this low hanging branch of a return true with something like a password or a license check. So password validation can now be bypassed really easily at run time. So it can key in licensing validation. In some instances SQL sanitization can even be bypassed if it's just returning down. Has this thing been sanitized yet? Yes or no? Oh, it has been. I'll just pass it along to the server. There's also a couple of dot net security mechanisms that I won't name. But you can rip them apart and destroy them, grab things off the heap like agent objects, etc. Steel stack parameters, do whatever and rip apart security at the assembly level. And then really we're just overriding logic and we're hackers so update mechanisms are always juicy. So graphically this is going to look like this. Assume that you have this Boolean verify license that takes some parameters. It does some checks to make sure you have a valid license. After JIT it produces some disgusting assembly code that you're not going to want to disassemble and make sense of. So just return one and now the developer actually wrote return true. So let's demo that.  So you can do things like paying level three which is not actually going to work because I'm not connected to the DEF CON wireless because screw that. So I'll drag my cross is back into that application. It recognizes that it's a 32 bit application so I'll inject. Here's gray storm once again and notice that this time it's in the version 2.0 of the CLR. So this application is running in an older .NET version but gray frost accounted for that. So within this application there's this run script button. So I'm going to go find it. So I know that it's in this Microsoft PowerShell GP PowerShell assembly and then if I keep pivoting down there's this thing in PowerShell tab and it's void execute script. So this method right here if I dump the assembly is doing all of that manipulation to actually run whatever is in that text box. I can look at the IL code. I can disassemble it if I wanted to. In order to do that I'd have to inject a bengine.dll which is an open source disassembler but to save time I'm not going to go through that. You can when you download and use all of these tools for fun. So I'm going to come over here to show you how easy it is to roll a metasploit payload. So I'm going to log into my Kali Linux box and I'm going to show you that I have an alias setup called Defcon that's just generating an MSF Venom payload to pop a calculator. So I'll go and run that and of course we all know this takes a little bit of time because I'm encoding it and what not but once it finishes I now have a payload that'll pop a calculator. So I'll come over here, I'll drag over it and I'll copy it and then I'll come back over here to gray storm. I'll go to the shellcode tab which has a couple of payloads that I'm including such as just a simple return true, a return false and an MSF calculator payload but I'm not going to use that one because I just made one. So I'll come over here to the shellcode editor, paste my payload, I'm going to name it Defcon and then it has no offset hook which there's a blog post on you can see what that means and then I'll create the shellcode. So now I have this Defcon Metasploit payload and I can say fire it and now if I come back over here and I still have this execute script method selected and I say dump assembly you can see that that has just changed to the Metasploit payload. So if I come back over here to Windows PowerShell ISC and hit run script I popped a calculator. So that's utilizing machine code payloads you can roll your own you can use Metasploit and the most important thing to know is if you want to use a Metasploit payload or roll your own there's a change in the portable environment block that caused me a lot of headache. In the portable environment block if you've ever written shellcode you know that you need to if you want to use other Microsoft API calls that you need to find out the base address of kernel32.dll to do things like get proc address and load library and that's commonly the third entry in the in memory order module listing however in .NET applications it's the fourth so you have to change your one line of code in your machine code payload to actually account for that difference and if you're using a Metasploit payload I recommend making sure that they're doing this as well otherwise you're going to crash your target application and if you're doing this on some enterprise level thing you're going to have a bad time because somebody's going to catch you. So that brings us to object hunting in memory. So now we've done things attacking the just in time compiler, attacking things at the machine code level but what about it runtime? What about getting things off of the managed heap?  So when we do object hunting in memory what we need to realize and what a lot of C sharp developers when you tell them this they're confused is that there's a lot of pointers in .NET and objects are actually pointers to an instance of that object on the managed heap. This object instance contains metadata about that particular object such as what fields and properties are currently set on it and it points to a method table. This method table tells the object instance what method instantiated this thing and all objects of the same type share the same method table. So we're going to utilize that knowledge and a signature. So we're going to utilize reflection to start off with so we can instantiate an object that we're interested in. We're going to utilize an object hunting signature that I created and then we're going to win. So in order to do this there's a six step methodology that you're going to need to take as an attacker trying to rip objects off of the managed heap. It's somewhat inspired by the way the volatility guys do pool tag scanning in memory so I utilized an approach similar to that for these techniques. But essentially step one is we're going to construct an object and find the location of the managed heap. While reflection gives us the ability to look at things like what address is machine code running at for a particular method. This isn't the case with the managed heap and we need to use a little bit of trickery to get the framework to tell us where this thing actually is at runtime. And we also need to construct a reference object so we can go through and figure out things like what the method table is for all of these objects. Step two is we're going to signature that instantiated type so we're just going to use a little bit of machine code to parse that structure that the object instance is and rip off some particular things that we care about. And then step three is we're essentially going to do a brute force approach to scan the managed heap for other object pointers that are the same as this object that we're interested in. And then step four we're going to convert those object pointers back into raw objects which when you do this something pretty cool happens and then profit. So step one is we're going to construct an object so essentially utilizing reflection we're able to go through and parse through all of the app domains, all of the assemblies and all of the constructors for a particular class and we can just call that constructor without actually knowing anything about it and we can instantiate anything. There are some objects that will actually take complex object types as arguments but we don't really need to care about that because we don't want to utilize this object. We just want to have one to reference so we can just nullify all arguments in a constructor and the .NET framework will still construct it for us and then we'll be able to use it how we need to. So then what we're going to do is once we have an instantiated object we're going to build a stack frame and you can see up at the top of the diagram here that I actually have the raw object that I just instantiated and it has a pointer associated with it. This pointer is hidden behind the scenes in the object type though so with a little bit of stack manipulation which you can go and read the gist for this we know already that this object points to the location of the managed heap which really could be anywhere, it could be at the top, it could be at the bottom, it could be somewhere in the middle which is why we're going to need to do somewhat of a brute forcing approach in memory but we're going to move that object down into the end pointer location and now we have the actual pointer to that object and the pointer of the managed heap. So now that we have an actual object created with an address of the managed heap we're going to signature that instantiated type. So object instances like I said contain a method table pointer back to the corresponding type that instantiated them and in 32 bit this is byte zero through three so we're just going to grab that and we're also going to grab the instant size of this object. This is going to allow us when we're going down the managed heap we don't need to do a brute forcing approach by jumping four or eight bytes we can just start jumping the size of each object until we reach the bottom to save some time. And then there's a subtle difference in 64 bit primarily just the size of a pointer but that's all taken care of as well. So then now that we have an object and we've signature it it's time to scan the managed heap. So like I said this is somewhat of an approach to how the volatility guys do pool tag scanning. So the way that they typically do things is they'll brute force through memory with a specific structure and enumerate on top of memory that structure to make sure that the thing that they're looking for matches whatever piece of memory they found. So I do this by incrementing down the managed heap by the size of the object that I rip off of each objects method table. I grabbed the instant size off of all of them and I just start skipping down. And when I find one that matches the instantiated object that I created from before I grabbed that pointer. So now I have a listing of all pointers of objects that I care about. However, if I want to go up the managed heap I have to just scan linearly up it either by four eight byte increments, handle a little bit of access violation type errors but it's a decent signature right now. If somebody has a better approach submit me a pull request and let's make it even better. So now we have other object pointers. So now we're going to convert all of those object pointers back into actual objects. So here's a little bit of code to show this. You can see that there's unsafe code which actually allows you to do pointer manipulation in dot net. However, what a lot of people say is this is actually a compile check. If you're compiling dot net and you're trying to do unsafe code it'll be like whoa, that's not cool. Are you sure you want to do this and you have to explicitly allow it. However, in memory when you're injecting into an application that didn't allow this to compile time it doesn't matter because it's not a run time check so who cares. So essentially we're building a stack again. We're going to have our reference object that we're putting these pointers back into right now it's set to system dot end pointer and then we have an address that we grabbed off of the managed heap to another object. So all we're simply going to do is move that pointer lower on the stack and put it over that reference and then what's magic about dot net is when you give an object a pointer to another object it'll just reference the instantiated object for you and now you have a new reference object to something that was already on the managed heap. So this is how we're able to now go through instantiate an object scan the managed heap for all other objects of that type and then utilize them. So now we're going to learn all the things about an application. So what I'm going to do here is I'm going to open up a fingerprint reader software that shipped on all laptops of a specific manufacturer that wouldn't be named. I'm going to inject once again grayfrost64.dll and open up gray storm. So now what I'm doing is I'm going to open up the GUI a little bit more. Notice I'm not a GUI developer. I'm a hacker so the GUI is not too great so not many hacker tools have good GUI so I'm not too upset about it. But essentially this method editor functionality it's going to show you all objects and then all objects instance methods and fields and properties and then on the left I'm going into the qlclr.user class and I'm going to the constructor. The constructor is taking two complex object types which is a passport and an infinitive object. However like I said you can just nullify those so I just added two nulls and called that constructor and you can see that this thing has a lot of instance methods. One of those instance methods is get the Windows password so I hit get all objects and as you can see I didn't actually get an object. That's because I haven't yet validated that I'm who I say I am with this application so I just swipe my finger and logged in and now I'm calling that constructor once again. I'm going to get all objects off of the managed heap now that there should be one on there. I'll open up qlclr user, go to the properties field and now you can see that I have a plain text system Windows password, Hunger Games Rocks because who doesn't love Jennifer Lawrence. So now we have all of these superpowers and things. Never before have we been able to go through the managed heap on the dotnet runtime and grab objects that we're interested in. So we can go through and essentially construct any object we want and grab any object we want of that type. It's common that things like crypto objects are stored on the managed heap that actually have in a field or in a property the key that's being used, the salt that's being used. So just go through find those things and then if you want to be sneaky change them to keys that you have so everything being sent off to the database is encrypted and they're never going to be able to access which ha ha. And then of course those instance methods for an object you can just actually go through and call them. You can call them with arguments if you really want to. Say in the instance of that constructor it took two different object types. You can just start building a chain, find those types on the managed heap, grab them and then use those objects in a constructor's argument path. The possibilities are really endless and up to you as an attacker. So yeah, yeah, yeah this is a GUI where hackers GUI suck. Well all of these can be all of these payloads can be automated. So Grayfrost is just the injector platform. It's just a DLL. It doesn't matter what your payload is. So you can use just a Python script like autofrost which is which I'm including. Give it a C sharp payload that does automation of something behind the scenes, grabbing stuff off the managed heap, changing machine code instructions, attacking the jitter and injected into a target application and just have it run. So automations is loved so I'm going to go through and attack that fingerprint reader once again and show you that I'm not crapping you and you can actually automate stuff. So I'm going to swipe my finger and authenticate with this application, grab Gray Dragon, inject Grayfrost which at this point is actually an automated version of this payload, inject it and Hunger Game Still Rocks. So when it comes down to constructing attack chains, it's actually relatively easy to attack .NET applications due to the nature of this just-in-time compilation process. So if you've done any sort of .NET work or if you've played along with challenges such as the FireEye Flare On Challenge which actually had a couple of .NET decompiling challenges to recover their email keys, you can just throw something into an ILD compiler and actually look at a higher level C sharp source code representation because of how easy it is to generate C sharp source code back from I.L. So you can utilize this sort of functionality to locate meaningful objects that you might want to steal off of the managed key for a particular application and then find methods, fields, properties of interest that you can attack at the machine code level or the just-in-time compilation manipulation level. And then of course like I mentioned there's a little bit of debugging functionality thrown in here and the fact that I'm giving you the address of constructors and the address of methods that you're interested in. You can just take those and throw them in a debugger and breakpoint at them. In the case of that fingerprint reader I had no idea what specific event triggered that object to appear on the managed key so I just set breakpoints everywhere until something happened. If I wouldn't have done that I would have never figured it out so this is incredibly useful if you have a little bit of time and you actually want to say this application I want to pwn it.  Furthermore say you want to do something like every time a SQL object appears on the heap I want to grab it and send it off to my server. You can do this by just placing a payload on disk utilize DLL hijacking and now every single object on the managed heap is yours. This also opens up a whole new avenue of hybridization of .NET and machine code level of tax that haven't been possible before. So a lot of what I did when I manipulate the managed heap is actually calling into raw machine code to do things like parse all of those structures. So you can now utilize this technique to do even more complicated things that haven't been possible before. You can also do things because we're at a higher level coding space than say C or machine code and that it's incredibly easy to use things like crypto libraries. So just encrypt your .NET payload within Grayfrost or within the actual payload. Call off to your web server make something super hard for reverse engineer to actually find because of how easy it is to reverse engineer .NET.  And then you can also do this at the machine code level two just include a machine code payload in your application encrypt it do some sophisticated hackery techniques to make it incredibly hard to find you and then fire your payload. And then the payload system why use it? Well for starters C sharp is an incredibly easy language to learn. Like I said at the NDC conference that I was at none of these guys really even understood the power of reflection or that there were actually pointers in the .NET framework and these guys do it every day. So it's incredibly easy to use C sharp and it's incredibly easy to build payloads and malware in C sharp. And because of these techniques and the Grayfrost platform you can just run this in pretty much any application you want. Because the Grayfrost DLL creates or injects the 4.0 CLR you can actually inject this thing into a C application a Python application and spin up the .NET framework inside of that which you may want to do but the real purpose is attacking .NET but that could be something cool and trickery that would blow somebody's mind. And of course I showed you that the low and high level gap is relatively easy and that I was able to utilize machine code level attacks and C sharp level attacks. So now people that code and C sharp and people that code and assembly can drink beer together and be friends instead of hating each other which I think is cool. So you should get involved with this .NET hacking space and read the code and contribute to it because it's really small right now. In the research I did there were hardly any tools that were referenceable.  Good job Blizzard. And then there's lots of PowerShell which is really just a subset of .NET which is cool but it's it's powerful but I think this stuff has good practicality if you want to get into it. And then of course a lot of this was inspired by previous DevCon talks specifically 18 and 19 by a good friend of mine John McCoy who set the groundwork for all of this. So in conclusion I've shown you now that arbitrary .NET applications can be injected and changed at runtime and also opened up a whole entire new avenue for .NET attack possibilities. These tools support automation and they're on GitHub go get them contribute to them submit some pull requests ask me questions and if you do have questions you can come up here afterwards I'll be hanging around till tomorrow because I'm dumb and booked bad flights hit me up on Twitter and there's two white papers on your CD and on my blog so read those if you have even further questions and thank you for listening.


I'm Gard Leonhard. I'm a futurist. I live in Switzerland. As a futurist I help companies understand the key things that are going to happen in the next five to seven years. Something I like to say a lot is that science fiction is really becoming science-fabric. The things that have kept the limit on change, the size of a chip or the speed of the network, those things will all be removed. We'll have 5G, LTE, whatever, beyond imagination, connectivity of a terabyte per second. We'll have virtually unlimited computing power in the mobile phone. Hyperconnectivity really is a word for connectivity like air, so essentially to connect to data into the network becomes like breathing in a way.  But in the future this information travels with you all of the world's information The particular disease of oncology, whatever you're doing, right at your fingertips in an augmented virtuality bubble. It's like being a super doctor. And imagine a world to where language is no longer a barrier. If you're married into a Chinese family, in the future you're basically speaking to an app or an earpiece and they both be hearing you real time. It's literally no longer going to matter where exactly you are working from. You're actually making a sort of a digital copy of yourself and going off to Singapore for a meeting. So when 8 billion people can do this, you can only imagine the possibilities that we'll have. Entertainment is the other thing, right? Literally every TV show known to man, every movie, every commercial, every piece of media, every podcast, every book will be available on demand by just saying that you want to see it. That's going to change the world of application, of entertainment, of creation because the options will be limitless. Our capacity of taking information will be dwarfed by what machines can do for us. But our hearts and minds are not of that nature. Our heart and minds are limited by our body. That will be really important for us to keep that part of life, to keep the part of that we feel as humans, which is not really just a data. How do we stay human? This is the key question of course in technology. What is the purpose of doing this? The purpose should be human happiness. It should not be just profit and growth, which is part of happiness admittedly. It should serve a larger purpose, which is to help us be better humans. As I like to say, technology is not what we seek, but how we seek.


Hello everybody, welcome back to Esoteric Atlanta and to our Mystery Monday, which we haven't really done in a hot second because we're doing the Emerald Tablets right now. And as you guys know, we're still working on that Fifth Tablet over on Aquarius Rising Africa. We've already done the Fifth Tablet here on my channel. So I am taking this awesome opportunity to give other people a chance to come on and present Mystery. Everybody loves a good Mystery. We all, hello, like there's a reason why like Murder She Wrote was a very famous television series. Like we all love a good Mystery. And so I'm joined here with my friend Tracy Woodman. And what's so exciting, you guys know Tracy, she's been on the channel lots now, but she actually, you guys, she just opened up her own, her very own YouTube channel, which I'm so, so, so excited about under her. Would you say this is your new Diplom? Yeah. Yeah. Yeah. Yeah. So she's writing on, she's putting it under Lee Woods. I'm going to put all the links down in the description box below.  I'm looking at Lee. That's my middle name, so you can. That's my dad's name too. So I'm like, I'm not. Tray Lee. Tray Lee. There you go. That's like a southern name. Tray Lee. So yeah, Tracy's also doing the S.C.A. journey, you guys. We were just talking about that before we started filming, which I know I'm going to put all that down in the description box so that you guys can see Tracy's journey through a sea and if you want to purchase through Tracy you can and Yeah, I mean quickly for like a couple minutes before we get into the story Tracy You were saying like people are actually noticing Things about you changing in your physical makeup from the a sea you think correct. Yes. Yeah, I just I've had a few people just You know say they notice changes Some have said I they think I've lost weight but again like I was saying to you I don't own a scale so I don't I can't confirm that but I do feel better. I feel I have more energy. I think my body feels more I don't even know how I want to put it Maybe younger. I feel like my muscles are more tone and again I've been doing the doing yoga for a while. So there's that but in addition to that I feel different In that sense. So yeah, my skin looks a little different. It's you know, I feels better. I'm just just some little things that I noticed about myself too. But yeah, others have said, What are you doing? So, so that's that's So, you're like myself can be a good advertisement for myself. My cells are communicating. It's so funny. I was laughing with my boyfriend this morning because fortunately I don't have Really an issue with cellulite which a lot of women do that's very normal And I think it's just because I've exercised for a majority of my adult life That's not a super big problem for me But when I was doing the video with dr. Silverman, which if you guys missed that I'll place that down in the description box below He talked about using the gel On places of your body where you have like cellulite or something and so I like lathered my legs up this morning I'm just gonna start just doing it because I am 40 now and I haven't struggled with this in really so I'm gonna try To prevent I don't know and I just thought isn't that interesting here We are we've accepted this narrative that this is just what happens I mean kids don't have cellulite little girls don't have cellulite We've just accepted that this is something that happens to us as we age But what is the aging process the aging process is literally not having the redox literally your Cells not even being able to communicate with each other And so if you're giving them that boost then yeah, you are gonna start to look younger again It's feel younger again and give your body and that's what I love about it so much as somebody who believes in the power of the body It's giving your body the support system for your body to be able to heal itself Which really is taking your sovereignty back and taking your power back. So yeah, you guys I will put all those links down in the description box below I wanted to just let you guys know that Tracy is very much a part of this now and I'm so excited I feel like all my friends are now doing a see-ya, which is so exciting. I just love seeing people Feel good feel better I love seeing other people succeed in that and if you don't have your help You don't have anything do you so you know it's it's that help that really gets us through But with that being said I am gonna turn the panel over to Tracy because boy and it's so hard I just dig these stories so much that you told me what you were gonna present And you already sent the pictures for me to put it in the editing process But I had to refrain myself for really looking into this too deeply because I wanted to enjoy hearing you tell the story So I'm sorry so much. So you guys with that being said I'm gonna I'm gonna pass it over to Tracy now Okay, so I was actually looking looking into a story that That's comes out of Hampton, which is a couple hours from where I live It's called Memorial Green Meeting House Green Memorial Park in Hampton And I just said that it is haunted by the ghost of Eunice Cole Eunice Cole is the only woman who they say was convicted of witchcraft in New Hampshire As I looked into the story, I did not find anything that actually said that she was convicted of Witchcraft so having said that and moving forward with the story. I Tried to go back a little bit further to see if I could learn a little bit about Eunice Prior to her moving to Hampton. So she was actually Married to William Cole who was a Sawyer They were married in England and and a medieval Anglican church in St. Dunstins Parish and Stephanie Middlesex England, which is just outside of London. So It looks like from the records that I've been able to found I found some conflicting information So I can't say 100% that every everything is accurate But we're just going to go with what I found. So because the records are sparse I had to kind of Match things up here and there and some things don't match up I see records where it says that William was 20 to 30 years older than Eunice, which is quite an age difference in marriage so That that could be a question to ask during this during this Deep dive into who she was So I would also be interesting to see how young she actually was when she got married. They were married. Sorry Brought shut my phone off Anyway, so They were married in the church in England, I'm just gonna shut this off so that doesn't do this again Well, it's interesting you're saying that at what year was this what was so Very good question She so it looks like they were married in 1634. So this is going back before way before it was going back before the witch trials in In England, I mean in Salem in Boston. So that's like the eve of that because that happened at the end of the 1600s This is what's interesting you guys and I it's interesting you say you're saying our husband was 20 to 30 years older than her according to some records I Was looking into Joseph Smith and polygamy and a lot of people because here He was this like 38 39 year old man marrying girls who are like 14 and of course, this was the 1800 so this was a couple of hundred years Post this story, but I was listening to his podcast They were talking about how we excuse that is that was normal back then But if you look at the statistics that was not normal back then to for a 14 year old girl to marry a 38 Oh man, they pulled up all the statistics that even at that time the average age for a woman to get married was 22 And the average age for a man was 24 So even in that that time period the marriages were close in age like like they most of the time they are now You know I have the perfensity of dating men 10 to 15 years older than me But I think 20 years is kind of pushing it a little bit because that's just a different generation at that point Right now, and I don't know that that's true because I found If you if you match up the time frames that are discussed And that are verifiable in the town records. I don't see that that was true So that was my first question when I looked at that was was she a child bride Yeah, yeah, but yeah Yeah, so buddy did I did actually go back and search the records the church records and what I found was there was a marriage of a William Cole and a Unica you is Would be Eunice with an A instead of an E so there's not much difference in the name. So her last name was guiles Same same that the St. Dunstan's Stephanie London Church and that was in 1634 That's the the record that I found and it appears to match up with What was going on at that time and where they came into the country here? So I was kind of hoping to find some Records back further that would show The date of her birth, but I I didn't have any luck with that So but moving forward They I just shut this off. I shut this phone off and just it turned back on What's going on here? Um It might be her spirit trying to come on through that's what I always be Shut off now. Okay.  Um, anyway, so The spelling too like that if I if I for you you and I are both researchers I would assume that's the same person because even back in those days people didn't have set spellings for their names, you know Um, yeah, even in this country with research Um, I found it spelled Eunice with a U Eunice with an E and then the spelling with the A at the end Which again too, I've done a lot of research into genealogy that type of thing and you can never be a hundred percent sure because if you're looking at Records of people coming into the country ship manifests they hand write things you can't read so you don't know a hundred percent if the name is spelled this way or that way so So anyway, so they married in England and then the next record I have shows that they Were um indentured servants. They were indentured to a math Matthew Craddock and he was actually the first governor of the massachusetts bay company Tracy can you explain to our audience members who maybe I know that most american kids know what an indentured servant is But can you explain to those who are not americans what that would mean? Sure. So um and actually my My great great great great. I have one in my family back in this early 1600s. So, um, what happened was back Back when people started coming into this country um A lot of people wanted to leave england for various reasons a lot of them were religious persecution But so they wanted to leave the country, but they didn't have any money to do that. So what they would do is they would um, they would promise to serve Another that would pay their passage. So So in this case this uh, william craddock, he paid their passage to this country and in turn for that They had a contract that said they would they would work x amount of time for Um, the massachusetts bay colony to pay off that passage So in my case my my uh My relative he worked seven years In port smith and then he was actually given land In maine after he was done So so just because you are an indentured servant didn't mean there was um, you were a slave oftentimes that That process entailed you working through the period of time In that person actually handing over land to you so you could begin your new life So it was not always it wasn't always a bad thing to be In that position it was a way to start out in a new world without When you didn't have the money to do so so that that We would call it a live work program today, right, right, right. Yeah So but anyway, so he they they promised, uh The passage was ten dollars and they promised to work work that off basically and um They didn't do that so Um The couple left his service prematurely and they promised that eventually they would pay the ten pounds if he released them Which they did not do so to me that That's the beginning of okay Apparently william wasn't too on the up and up either So I'm I'm I just have questions about that whole thing so Um, so needless to say so they they moved to new england They lived in a town village called Mount wallston, which is now brain tree. I've also heard it referred to as quincy. So i'm not sure if they Both had that name if they were both I've seen it referred to as both Quincy has In the past had a wallston. So so to his brain tree. So and that's just south of boston So and back then townships At least in new england townships would provide land grants to people who Wanted to homestead the land Wanted to to farm the land and get ahead so Most people that came into those townships were were granted x amount of acres to farm and produce and sell and live off of So the town of boston who knew of the deal That william and munus had with cradon were only given two acres for their own planting They weren't given the opportunity to farm the land and and And sell they were only given given what they needed to survive because they probably didn't trust them So they lived in boston in this area from 1637 through part of 1638 At that time they moved to exeter or what would become exeter in hampshire Now they followed a reverend john wheelwright To what became exeter wheelwright was a A minister who he was actually banned. He was banished from boston in 1637 for sedition He had some pretty shady practices With his preaching apparently so he was he was banished from boston so he and I think there were 33 other people at the time Moved to what became exeter. He started exeter. He started a church in exeter and among those 33 were william and and munus Just a on a side note to this john wheelwright. He actually was a classmate of oliver cromwell at cambridge So they were friends. So that brings up a little leather red flag for me. Yeah, I've covered. I've covered That's on my channel before and so it's so interesting like like when you're reading this as an american Thinking about our history and these are stories that we're used to hearing But now that we know a little bit more about the other side of the story You do start to question some of these connections. You do start to question What really is the right side of history? I know when you were talking about the uh the preacher man not being So so glorious. I was like, well something's never Yeah, I was thinking that throughout this whole process that this is just another control thing all the way back, you know We see you preachers. We see you I know there's a great hillfong documentary out right now you guys like Some things just never change in humanity That is so true So anyway, they they moved to exeter and They didn't stay there very long So in 16 In 1638 So i'm trying to trying to create a timeline too just to give us an idea of how what their ages were And and I what I did was I went back from when they died and where they were living to back to try to come up with A better timeline of their ages So in 1638 william would have been 64 years old so He was a carpenter And he which he didn't prosper at that. So i'm not sure what the deal was with that I'm not sure if he was lazy or or just as he got older. He didn't prosper. I don't know There's no documentation to indicate why he was not successful She would have been 48 years old according to the information if I go if I moved backward from when she died So she's 48 at this point. So if they got married in 1634 she was not young when they got married Back, you know for for that That time frame anyway, so So anyway, so they they they lived in they lived in boston For about a year they moved to exeter It was said that she wasn't very likable, but there was no not no trouble with the law or anything So in 1640 They were granted 40 acres of land in the town of hampton new hampshire They didn't move to hampton until 1644 so they lived In exeter for a while what six years And nothing no trouble No, nothing happened with her they lived in boston for you. No trouble. Nothing nothing came up about about unis They just lived there somewhat peacefully I guess so They weren't in hampton long before she started getting into trouble before her legal problems began She was fine. She was setting stocks. She was admonished. She was whipped For different infractions of law in 1645 she She was brought before the court for slander speech against her neighbors So she she was talking bad about her neighbors or whatever the case was but Um And then in so six that 1645 and then in 1647 Both unis and william were charged with biting the constable William fuller was the constable biting his hand, which I don't that doesn't mean officially Actually biting his hand. It was stealing food from his hand stealing food from him. So they were both charged with with with this Stealing this biting of the hand bit so But you don't hear anything about william Getting into trouble or causing trouble beyond that that you don't see anything in In writing anywhere. So next unis appears in court in 1648 1651 and 1654 and they don't state what the charges are They don't state why she was why why she had to appear in court. I couldn't find that information And throughout the the whole time that she was in Hampton Which would be from 16? Well 1656 to through 1680 is when the trouble began. She was charged for witchcraft Three times. So that's 24 years. She was tried three times According to records. She wasn't very neighborly of course we and we did hear that And she did have a temper so Again, anything is possible. So From 1656 to 1680 she spent about half her time in prison And through that over the years through that in that period of time she was She was whipped twice She was brought before the court on at least eight occasions. She was fined She was admonished once they probably slap on the hand whatever Um put under bond twice and I don't know the bond piece that could be the $10 Front cratic that could be they they tried to collect. I don't know but they don't mention him. They only mentioned her So she was set in stocks She was searched for witch marks. She was tried for witchcraft twice and ultimately three times She was watched for diabolical imps. That was one of the things that they said that So locked in leg irons And she was in prison that one final time before her death In which at which time they Tried to charge her with witchcraft again. So We we mentioned that she's charged twice for witchcraft. The first time was in 1560 1656 And the trial was held in boston There were 26 witnesses who testified in the trial. So that must have been everybody in town. I mean um, the main evidence in the trial she gossiped about I'm thinking because I watched all these reality tv shows. I'm like damn She would make an awesome reality tv like real housewives of new hampshire Yes, all in a sedition like she would be a producer's dream That's true. She probably would have So the main evidence in the trial Um, was the witch marks that they found on her when they whipped her before She was brought in um So they would have removed her clothes to whip her. So she's you know, she's not So that was what prompted them. They said she had witch marks on the body. So But the main evidence in the trial outside of that she was they said that she was And some of this information just doesn't make sense to me. It says that she was involved in the death of a child Um, and there's some speculation as to whether the child was deformed But they don't say who the child belonged to they don't there's none of that information They don't say who accused her or why why I don't know. Um, she was blamed for the death of a bedridden man, which again, I Um, she they and They said that she killed their cattle the townspeople cattle through demonic agency um They said that she brought sickness to people that she feuded with and she killed their animals Um, and that she had knowledge of conversations that were private that nobody nobody would know So, um, those were those were the charges that were brought Brought up in court and outside of the the witch marks And that's why they charged her with witchcraft was was the marks not these other things Well, the court did not convict her of witchcraft. They convicted convicted her of the lesser charge Of being of they called it being it's familiarity with the devil is what they called it So she was kept in boston prison until 1660 and they released her Because her husband pleaded with the court to release her because he needed her at home Made it her at home to work So she spent four years in prison for the familiarity of a dealt with the devil not for witchcraft and they let her go So my thought is is if she murdered a child and was responsible for the death of a bedridden man And was killing animals. Why would they release her? so um, but while she was in prison her husband put her put her name on The deed of their property took his off put hers on So that he could Ask the town people for help Basically take care of him and help him work his land without having to give the town anything So if he didn't own the property she did he wouldn't be responsible to pay the town They would just be he would be a charity case, you know what I mean So at that point he would have been 86 years old So he probably would have needed help, but um, obviously his mind was still there If he was shady enough to You know put his property in someone else's name so he wouldn't have to give him give the town people towns people anything so she didn't petition the court and she was released and went home to her husband, although um Also during the time that That she was in in prison once he had done this um Pratic who was who was the indentured Servant they were indentured to excuse me He was trying to collect the ten dollar bond from them the 10 that 10 pound bond from William and I think that was in 1657 and William pleaded with the court for relief He didn't want to have to pay it probably because of his age and he whatever his reasons are but um The court demanded that the town take over his property because He owed this debt So the town had to take over his property take over his estate and they had to support him. So whatever whatever um Was whatever work was done on the land whatever was farmed whatever Monetary value came out of that the town took and used to support him And newness because she was in jail and they had to you had to pay if you were in prison You had to your family had to pay for you to be in prison at that time. So There's a little confusion on that because There's another story that says that the town actually gave him his land back but I I don't know that that's true because I see more evidence for the for the To explain the the first to back up the first explanation so So unis comes home. He dies. William dies in 1662 and When he dies is discovered that he had he had written a will Which left his property to a neighbor the neighbor's name was thomas webster and He he put him in his will because he was supposed to be taking care of him While he was sick or infirm or whatever the case was or taking care of his property. So anyway, that was His way of thanking him by giving him his property So he left unis her clothes and that was it This thomas webster got all the property and tools and animals and and whatever so um but Because of the 10 pound the whole the whole deal unis um The town disputed disputed this will because they didn't think that it was right. So Because it invalidated unis's share of the property So even though she she did get in trouble that was still half her so The court ordered the town to take the property and use it to pay for unis's Care prison whatever and williams care Had he survived so that was done through the norfolk county court. They're the ones that stepped in And what what they did was they they took and they They set aside the will they paid All the debt williams debts and then they took Half of what was left and gave that to Thomas webster who he had willed the property to and the other went to support unis. So the town kept that to support her So what but she wasn't free long and They blamed her again for calling neighbors despicable names. So um, I think in addition to um I think part of the reason she was put back in in prison too was because she did not Uh maintain the terms of her release And I think that was supposed to be that she left hampton what she didn't do she stayed there So she ended up going back to prison And the third time she went back they The neighbors or townspeople somebody Observed her talking to the devil at her house. So they whipped her before they took her back to prison So I don't you never see evidence of any of this. It's all hearsay So she spent the next 10 years in and out of prison. So when she was released at the age of 70 she was homeless She didn't have a place to live So when she returned home the town put her in a little hut Near the meeting house, which is where the meeting house ghost story comes into play. Um so The town Ordered the townspeople To take care of her so everybody had to contribute They had to bring her food and wood and if they didn't they would be fine So there's a little animosity there with the townspeople having to Be responsible for her In addition to that the young people that lived in the town they liked to antagonize her They would play tricks on her and get and basically bait her so so now she's 70 at this point And um They tried her for witchcraft again so This time when they they tried her they're blaming her They're saying that she um Made threats to the night watchman. She um She was blamed for a puppy whining and barking in the meeting house, which I don't And now they're saying that she's taking various animal shapes they blamed her for A neighbor's oven producing foul tasting bread And then the the the piece that Caused her to be Charged with witchcraft is that they said that she enticed a nine-year-old girl to to live with her And they don't there's no history or information about What that was did they want did she want her to live with her to take care of her? Did was she trying to trap her or whatever there's no no indication of that story so um So amazingly even though she was prosecuted for this um, and again, this is in 16 73 Again she went to court and she wasn't convicted they didn't find her guilty again So the court this is again the court does not find her guilty of witchcraft.  She lives quietly And then in 1680 they accused her of being a witch again They there's no documentation that says why um And this time she was just held in a local prison She never even got to boston they held her in leg irons But again the jury did not find her guilty So she was sent home and she died a month later in her bed in the little hut so She she the towns people didn't see her for a few days So I guess they might have thought that was odd, which maybe it was So they actually broke into her hut to see and they found her dead um They the story is that they buried her right away in an unmarked grave And that they drove a stake through the ground with a horseshoe in it Attached to it to prevent her from rising from her earthly grave Um, I I think that some of that's probably folklore the unmarked grave piece yes because There is no grave She wasn't buried with next to her husband or anything. So that piece true. I suppose so the whole story Comes to an end in 1930 1937 all these years later There's a a goodie coal society was was formed goodie coal goodie coming from um the story from john green leaf Whittier who he was a poet and he wrote a couple of poems one was called the wreck of the wreck of river mouth and The changeling in those poems were about her and that was how he referred to her In in the poem so in 1937 the goodie coal society was formed And they did that to restore her citizenship that had been stripped away from her because of Because of her being in jail and because of what they said and in 1938 the residents voted to return her rightful citizenship And they did this dramatic Presentation over the radio and made a big thing of it to restore her citizenship so, um, that's really the story of The haunting of um meeting house green memorial park and it's just um, I think it's there there are some things that I don't That don't settle well with me Um, of course we talked about her married being married and obviously she wasn't that young when she got married So she must have been in her 40s when she married. What was the reason for that? Was it just because They were going to the new world together um I don't know the answer to that. I my heart breaks for this woman. Yeah, I think she was a target pretty much I kept he escaped goat skate goat skate goat skate goat Which we know that if we're looking at this with our conspiracy hats on we know that the controllers are often going to find Scapegoats and I was left. I refreshed. I had to refresh my memory with the Salem So this is like about 10 years By her death Yeah, there was about 10 years before Salem started Yeah, 1692 And and I know when I was researching Salem There were all these laws when you wanted to When you wanted to accuse someone of witchcraft Then Salem broke all these laws You had to put money up Yourself And if the court found the person innocent you would lose that I mean it was it was just this hoops You had to jump through to try to ensure that there weren't false accusations because we can see in this time period You can just make up any rumor about anyone and if enough people believed it I mean we see that today even today, right? Like if enough people believe it Then that was really they'd already been they've already they'd already been primed even before coming to this country They'd already been primed with that with that mentality of which which which which which and if you do one thing That's not normal in your eyes. Then they're a witch. So I think that Because they're already they already have that mindset That's the first thing that comes to their mind when they think of someone as being mean or Not or an ounce someone that's just I mean, I'm sure I'm sure I've been accused of witchcraft multiple multiple lives I'm sure I've burned at the stakes in multiple lives and it's funny you talk about the witch's markings Y'all that's anything from like a birthmark to a mole Right and so if they are if they're dead set on like trying to prove you guilty they could take any type of mole or birthmark on your body and claim that that's a witch's mark and I think a lot of people, you know and bless her heart like I would get I would be probably a pretty mean nasty person too of my whole life I had people doing things to me behind my back Like her husband like holy crap, you know and it and I mean you you figure He was supposed to pay the 10 doll 10 pounds. I keep saying dollars 10 pounds, you know He was involved in the the biting of the hand piece and nothing he gets no reprimand no there's nothing You know and obviously he made her do all the work She's a lot younger than he was so in the property it was You know he had her they asked he asked the court to release her so she could go home and work the property So he didn't ask out of the kindness of his heart because he loved her and needed her he asked because he needed somebody to go work the farm So So what is that all about? So I just put it into the converter the historical conversion of currency Which who knows if this is even correct or not, but just to give us an idea. So I entered 16 38 Enter target year 2023 enter old value in pounds 10 Value of beginning of target year in dollars. So that would be so for us if we're looking at that dollars and what that would be now That's about 2266 dollars That's a lot of money Yeah to pay for a voyage over from you know, that's definitely way more expensive than an airline ticket. We pay today You know so and yeah in this point if we're looking at the historical information at this point too a woman A wife is not really Considered to be a full citizen. Anyway, she's considered property of her husband And so in any type of legal matters like this it would default to the husband anyway Because the wife has no ability. I mean, I've said that about the southeast at the southeast here I live you know say what you want about the southeast But this was the one of the first areas in our modern world to give women the right to inherit their father's estate so She's in a lose lose situation as a woman anyway right Yeah, and if you stop and think about um, I mean you think about the whole If you think about william and his Throughout his life in in their marriage at least I mean he doesn't pay the the debt he He you know, he he steals. He's manipulative. He obviously I shouldn't say obviously it's my opinion that that he wasn't very motivated if he was a carpenter And he didn't do well. How can you not do well in the new world with building? You know Yeah So and then there's also the piece that their their connection to john wheelwright. So Obviously he had issues. He was banished for sedition. He um, he had He is just he was just It was odd so And when you look at his relationship to and i'm not saying that this is actually a thing but He knew cromwell. They were they were they were schoolmates at Um Cambridge they went to school together. They were classmates. They were friends And from what I from what I have seen and again, I can't say this is true But I know that there there is a book that was written in the 1700s It was written it was a an anonymous book it was written in 1745 and it was written by um Abby laura den I think is how you say it was a french person and that in that book He says that he she whoever says um That Cromwell was One who actually started Freemasonry So again And there's no there's weird stories around Cromwell's head which again, I'll put that his skull has been passed around so Right. Um, I will put those links down in the description box when I cover that and it's there's so and that's what I I You know, it's so funny Tracy because we know Cromwell took down The royal family in the uk for Right. Yeah, and had had them hadn't be headed and then it they brought them back and So and I've been talking about this idea of junk conspiracy And so it's almost like you have to be very careful when you're navigating what the truth is because the bad guy We'll say for lack of a better word since we're on youtube the bad guys Are gonna put people in place To look like good guys that are actually working for the bad guys, right? Right We see that the political system all the time and that's that just to me screams Oliver Cromwell because I don't when I covered our Oliver Cromwell. I was like this douchebag.  You know and so and yeah, and we see it's all it's all yeah I mean and here's this woman and good. I know goodie the name goodie is was a nickname I wonder if it was a nickname for Eunice was that how that was her birthday? I think yeah, it's it's it's a name that was It was actually created by Um The poet wittier he the poems that he wrote that's how he referred to him and the poems The changeling wittier john green leaf wittier. He that's how he referred to her in his poems the wreck of the river mouth and But yeah, so because there are a few goodies in Salem as well that were accused Yeah And so with the hauntings people just see her spirit in the meeting house and have experiences with her Yeah, yeah, so there's never been any Any foul play or anyone Die or there's never been anything really negative. It's just that she's there which I suppose that Why wouldn't that be true? She was buried in an unmarked grave, you know And if there's a karmic, you know, that's the thing about this That was the one thing when I first went to india because I you know Tracy's up in new england. I'm down in the southeast both new england in the southeast if we're looking at the History books of what they tell us were the original 13 colonies There's a lot of ghosts on the southeast or up down the east coast new england and the southeast like both both I mean I grew up with ghost stories. I mean When I first went to india and I lived in england for a while. There are a lot of ghost stories That was one thing I noticed was I didn't feel the presence of a lot of ghosts So I know there are ghosts there, but it's not as overwhelming as it is here in in the united states and I I always just kind of Figured and my my own assumption that was because in a hindu-based religion they accept reincarnation So once death comes there's an easier release Then maybe for us in a world in a world where we didn't we really thought this was it And so that made sense to me that karmically ghosts would kind of hang around because they want vindication They can't release the story of of of their lives and they're hoping for some sort of vindication And I also think there's a this kind of trapped in this as the same. Yes a fam scarced cycle and it kind of like I don't know. It just it's it's so freaking When we go through trauma and I think you know looking at this story and all these other stories like this from the eyes of 2023 We understand more about how the human brain works too with like trauma When somebody repeatedly goes through trauma they do something called disassociation And I can imagine that I know I've done it I think probably everybody at some point has disassociated. So what that means in layman's term Basically, it's a little bit deeper than this is that when you're in it's kind of that freeze response But you actually kind of leave the situation like your mind kind of leaves the situation in order to process through the situation that you're in if that makes sense and so Yeah, you just associate yourself so you can do what needs to be done and you just set that piece of the emotional traumatic piece aside just to get through And that I think sometimes is where where it gets lost Are buried and we have to address it later because you you set it aside because you need to focus on what you're doing And it gets bad Yeah, it's um and so I can imagine with someone like goodie coal Her life was just abuse after abuse after abuse after abuse after abuse and she had no one In her corner to help her right? I mean talk about a sole contract.  She she came here Yeah, maybe maybe she was left alone in england and that was why she came this way because she didn't have any Um family. I don't I don't know. I couldn't I did try to find But that we kind of decided to do this at the last not last minute, but I didn't have a whole lot of time to Had more time. I probably would have gone back for them I'm feeling like I mean I know that sarah that my tea leaf reader friend is a psychic medium as well And so I'm wondering if maybe I could even contact her to see if there's Something to be done to release goodie from her samscaric chain. So it's almost like she's in and there's different kinds of hauntings there's like an imprint haunting which What's an imprint haunting isn't necessarily an intelligent haunting? It's like something so dramatic happened that It's like taking a photograph of that moment. So the spirit you're seeing isn't really there It's like a photograph like in savannah for example savannah, georgia. There's a story of uh every Anniversary of when the stock market crashed there's a guy that jumped out of a window and every year they see it the same thing So it's like a photograph of an imprint of this really traumatic event. So the spirit's not there It's just the photograph but with an intelligent haunting the spirit is there And can communicate and there's something going on and it's either that she's so traumatized That she's still stuck in the cycle of goodie coal and she can't release that In order to move into the next incarnation or She's choosing to stay behind in order to find some sort of Vendication and whether the two whichever two are correct They're both very very very sad and and something that I think we do have the responsibility Due to to free a soul so that they can go Hopefully make the choice the free will choice. She has to make that choice to move into the next into the next round But I can't I can't imagine how it makes me emotional like how hopeless Yeah Yeah, and I think too one of the things that That surprises me um about Her her second trial is that If you if anybody that knows anything about law You can't I mean granted. It's a second accusation But you can't be tried for the same crime twice, but they took they took evidence from the first And for a trial to use to try to convict her the second time so to me that which maybe that's why the jury didn't convict her I don't know but Jeopardy you can't right Right, so so there so there's that too. I just But I think the thing that that surprises me most about it is that whole that that seven year period of time Where everything seemed to be quiet after he died. So what does that tell? What is that that to be that That they go I think so and at this point divorce wasn't readily available She wasn't wealthy, you know again as a woman you're at the mercy even the wealthy no family So family no friends, you know, it's so easy for people, you know So if they're trying to set her up as a scapegoat, of course, they're going to go around and whisper in someone's ears about this woman Maybe she was Maybe she was a fiercer woman Maybe she was a little bit more Maybe she fought back a little bit more than other more demure submissive women did at that time and maybe that was why some of the Some of the townsfolk was able we're able to readily believe maybe rumors that were possibly started by her own husband I don't know, you know, and so this is this is just it's heartbreaking as a female I mean, I cannot even imagine because at this point as females we have We have rights, right? Like we have and I want to remind people like we've been looking at the Protestant Reformation everybody's like Oh, the Protestants are amazing. They're not satanic. Only the Catholics are Listen, if you go and read some of the things that these at Martin Luther John Wellesley that all these people have said Especially about I mean the owner the person who started the Methodist Church, which I always thought the Methodist was like The most relaxed The person who started the Methodist Church literally believed that women did not have souls And that once they were done with their birthing years should be taken out back and put down So this is the this is the culture that women are up against at this time period now We're coming into obviously towards the 1700s. We're getting into a little bit more We're starting to see some shift happening, but this woman had nothing And especially when she became a widow and my my research into to witches and the label of witches that Most widows were labeled that because they were seen as hacks They had no value left for society anymore. Their husband was dead. They couldn't bear children anymore So they had no value to society. So that's how they kind of carry the label of witch at that time Well, well and also too in her case her husband died the town had to be responsible for her So of course they're going to say, oh, she's a witch take her away So we don't have to deal with her which is what they did or they tried to do But their jury wouldn't convict so they had to send her home But so they did try to do that to her. Oh, we'll just get rid of her. So I don't I don't know I don't see I know that Anytime you you look up You know goody coal it says the first witch of she wasn't convicted of being a witch. So Um, so there is that um, yeah, she was convicted of a lower charge, but even that I think I don't know. I feel that maybe she was Escaped out like you said There's more to this story. I actually want to come up there and see the meeting house and yeah Hampshire, so Hampshire, oh, and there's so many different there are so many places to to look at so up here that Yeah I mean the the mount washington hotel has a room that's haunted um Yeah I mean just putting myself in those shoes. I mean I think about that down here in the southeast. It's different weather down here Like I think about okay, you the story they tell us like you got on a boat You left northern europe or england. You're in this new world You don't know anyone The weather is different. You're having to and up in new hampshire in that area. You've got very cold winters very harsh winters They that can kill you if you don't know how to survive You know down here in the south there was malaria yellow fever all these other swamp-based sicknesses that people had to learn how to work with And you've got all of these these the nature stacked against you and then you don't have a friend in the town You have no one that's taking your side and you're at the mercy of You know if her husband was alive today We would probably label him a narcissist and are a psychotic a psycho What they call it a narcopath a site a psychopath that with narcissistic abuse and And so bless her heart like I mean I just can't imagine and so I hope that anybody in that area if you see your spirit like don't be afraid just talk to her That's maybe what she's I can't maybe emotional. Maybe what she's looking for a friend So and I think too that maybe when in 1937 and 38 when they Restated her citizenship part of me thinks maybe someone at that point was was maybe trying to do do that to a certain degree trying to Maybe provide some healing in there for I mean The obviously the people that did that to her are are gone. I mean you can't there is no retribution because They're not even her haunting isn't going to You know, it's not going to affect the people that did her harm so Sometimes I I guess I think that maybe in 1938 They were trying to heal that and restate you know restate her citizenship and Tell her that we believe her we we we see the truth at this point We see the truth for what it is I'm wondering now I'm starting to think is she hanging around so she sees the fall of the controllers because we know the Controllers know how to reincarnate they know how to jump into other bodies So part of me is like that's my conspiracy hat again Is she hanging around to see their fall? Just to be like Basically give you the middle middle finger because in my opinion the real witches and warlocks were the ones doing this to the to the people Right as to the people in Salem doing this to the people all over Europe Those were the real witches in warlocks not people like goodie coal or though all the people that lost their lives in Salem are all the People who lost I mean we know from my study of king James who was like one the most horrific human beings that ever lived and you know the one that basically corrupted the bible He was so deviant There was a case in scott I think it was scotland where somebody a woman was accused of witchcraft and she was found innocent And he went back and over Because he was the king and he said no no no she's guilty and he watched her Be tortured to death because he enjoyed that He loved seeing that pain And to I just can't imagine whipping a groan. I can't I mean Listen any any man who raises his hand to a woman is Disgusting to me anyway and and is is not a man in my opinion But to actually whip a woman To whip a woman like I just I don't know and then you're right like if she literally was participating in the death of a child Or of another human being why would they release her from jail? These are all in my opinion Yeah, they didn't they must not have had evidence because they didn't even convict her They didn't even convict her of that. They didn't convict her of killing a child or our bedridden man they convicted her of Being familiar with the devil so We're all familiar with the devil. It's doesn't mean we agree with them, right? We all we all know it's like that the Rolling Stone song 70 for the devil Pleased to meet you So anyway, yeah, so Did they put her in jail for four years for her own protection? I don't know but And how long would she have been there if he didn't plead with them to let her free So she could go back and work.  I mean it just it just Yeah, it's awful. So thank you so much Tracy for presenting this story I'm gonna see if I can reach out to sara. Maybe we can do a part two and see if we can and if she could channel Um, she did a channeling session with me and she does pick up on and so Um, because I feel so bad for I mean, this is a human being even though You know, they say that what's that I'm paraphrasing the quote about history It's history is like a foreign country. They do things differently there Even though the life was different in the historical periods that we're talking about now It's a different culture. None of us would probably survive it if we got thrown back in that time We'd all be hanging listen Listen, if if all of us just got thrown back into that time period We all be hangable for witchcraft because they would be like what the hell are you, you know, so but but beyond that We are all human beings and in regardless of what time period we're talking about We all understand pain and we all understand Betrayal and betrayal trauma and sabotage and all that kind of stuff. And so I it's heartbreaking to hear these stories that these these people went through and so So let us know you guys down in the Comment section below if you're if you're from New Hampshire, like Tracy, let us know if you uh, if you're You recognize this story and your thoughts and your opinions. What what did you hear? I mean, I'm assuming growing up in that area. You heard the story kind of being told The legends. Yeah, I actually I was born here, but I didn't grow up here. So I came back here later in life. I actually grew up in Alaska. So and I did do the the roughing it thing. So That's right. It's not fun. But hey, you do what you do you do what you do. Yeah Yeah, so I didn't I didn't hear a lot of You know while I was growing up that that type of thing but later as I came back You do hear these stories and you know, they do they sometimes they do little Well, I say this I don't know for sure because I haven't watched the tv and By 20 years But I I do remember years ago that they would do little Local programs on things that happen on the at the end of the news. They would do, you know This is going on or do you remember this? Listen goodie coal if your spirit is listening right now honey You are way more famous and those who persecuted you now and you you have I think a lot of people understand what happened So but I would love to hear from our viewers like what do you know about this story? What did you what were you told growing up? I mean there's countless stories down here in the southeast that we just kind of You're growing up And um, have you experienced if anybody is listening? Have you experienced the ghost of goodie coal? Did you ever see her let us know your experience? And I think too. I'm sorry. I think too. There's a it's it's a little misleading because the plaque that's on the ground by the rock that Uh, they have uh displayed in the park. It says that she was convicted of witchcraft. She wasn't she was not So there's a little bit of uh, I think that's just a way to get keep draw people and I think so She's getting more and more more people are using her. Yeah Yeah, so but anyway, so that that was just the final little thing that I wanted to add is that she really wasn't convicted of witchcraft so Well bless her heart. She deserves to have a good life next life. So Her her soul picked a crazy existence for it to know it's so yeah, she did So hats off to her mad respect But um, but I know tracy. I want you to come back and present some more findings Will you be willing to see that and you guys make sure again you go and you subscribe to tracy because we want to get as many People who are looking seekers. I hate calling us truthers seekers out there To to try to figure out and rewrite some of these wrongs that have been put upon us as as as a people and The goody-cold story isn't just about the americans.  I've always had So many people behind me and on my side and hearing me but to be that alone god I can't even imagine I can't I'm I'm proud of her for not ending her own life Let's just put it that way That took courage and strength and so so thank you for presenting this tracy No problem. I actually had fun doing this It's fun. It's so fun, isn't it? I like to do all that. Oh, oh, oh wait. I found this now. Let's go over here Yeah, it's so fun. I lost in it It's me too and and that is why I'm so grateful for a CEO Which tracy is now doing as well because that is what is affording me The ability to go back and start doing more research at the other stories because it takes a lot of time But it's so fun. It's such it's just fun thing to like Snoop around and see what you can find about your own history and humanity's history and the story of us as people Goodie goodie Cole story is our story. It is the story of it's part of humanity story her life mattered Her story her pain matters You know, it's that emotional center as the law one says it's the emotional center Us being able to connect and have that empathy that helps us recognize our own soul And so her story matters You know even to us in 2023 and so I hope that even in her death that she understands her life was not lived in vain It matters so All right you guys. Well, I hope you're having a happy happy monday as this is mystery monday I obviously today i'm on with aquarius rising africa I will be on with aquarius our solutions with aquarius rising africa tuesday tomorrow for the cfo code because wednesday I will be traveling. I have a few videos scheduled to drop while i'm away But I should once I get back from traveling. We'll have even more videos up and of course i'm can't wait to have tracy come back on Um back on the show and do even more stuff And i'm gonna put the links to all the other videos that tracy's done on this show as well before if you guys are just now Tuning in to esoteric atlanta. You can look and find all of tracy's other work on esoteric atlanta as well I can make sure you guys you go and subscribe to our channel The more it's I think i'm I think I can say this with tracy like I don't care I really don't care how many numbers Subscribers I I have or anyone halves, but it does help put our work out there the more you subscribe I know i'm heavily shadow banned. So if you're watching this, please make sure you share it because that helps kind of Break through the algorithms and get the work out there you guys So thank you so much everybody. Have a wonderful wonderful rest of your week if I Don't see you guys before on a live show or anything happy easter happy ish star so So be subtle celebrating this a little bit differently this year So all right you guys we love you all and we'll talk you soon. Bye everybody