All right. Welcome. Thank you very much for coming to our talk in yet another gorgeous day in Vancouver. Hope you are having a good time. This is the work that I've done with my colleagues at IBM Research. They couldn't be here. So I'm going to present the work. Let me start with a little bit of motivation in what motivated us to start this work. And then I get to a brief overview of Neutron very quickly to do a level set. And then we get to the main part of the talk when we talk about network performance, the benchmarking framework we are proposing, and we show some empirical results and look at those in the talk with conclusions and future directions. So Neutron has been around for some time now. It has become, it has got to a point of usability and the stability that people have started working on it and using it in production. Sometimes during the last cycle in February 2nd, DevStack merged a patch that made Neutron the default networking for OpenStack. And as you can see, a lot of Neutron people were extremely excited only to see the patch get reverted three days later. And what happened there was that the community taught the default configuration of Neutron is still too complicated for some users. And it's not closely matched with what people have been using in NOVA network. And we need to do some work around getting to a default configuration that is much closer to what NOVA network supports or it is in general simpler. So there has been a lot of ongoing work. There have been at least three design submissions that I have been to where we have discussed with Neutron community and NOVA community what are the issues in terms of making Neutron more accessible to everybody. Nevertheless, Neutron is your networking in OpenStack. So we thought the first question that comes to mind is how does it perform? And we are talking about different aspects of Neutron, from the management plane to control plane to data plane. And we wanted to answer that question, and that motivated our work. What are the important networking metrics we should look at? How do we measure them? And before I get to answering some of these questions or start the discussion about these issues, I want to just very briefly talk about Neutron. So we are all on the same page and then get to the discussion about benchmarking Neutron performance. So Neutron provides just the API for network virtualization. It has a core API and some extensions. I have listed the important ones, and there are some others, but I just want to keep it simple for our sake of discussion. The main abstractions are networks and subnets and ports. And if you have your VM connected to a network, you expect it to be able to talk to other VMs connected to the same network. And if you want to talk across networks, you expect to have Neutron. You expect to create a logical router, where you provide connectivity services between different networks. And by connecting two networks into a router, you can have the VMs talk to each other across networks and possibly to the external world. And the router extension also provides floating IPs, so you can be accessed from the outside. And I have listed security groups as one of the more important extensions that one need to use to provide the level of security we need at each port level.  And that is done through the plugin architecture that Neutron supports. So depending on how those plugins realize these sets of logical resources, you may end up with different properties in terms of performance that can be important. So you could use, in terms of realizing the Neutron API and implementing it, you could rely on what the operating system and hypervisor networking stack provides. You can be using different types of tunneling. You can be deploying a controller that uses open flow. And there are all different types of technologies that you may end up using in order to implement that API and that abstraction. There are several back-end or plugins or drivers available right now. The reference implementations are the famous OpenV-Suite and Linux-Bridge plugins to be more accurate mechanism drivers that are used through the ML2 plugin. And there are several open-source options that I have listed. A few of them, Open Daylight, has been around for some time. And they have been presenting in this summit and have been integrated with OpenStack. It was a mid-init, open-contrail, OF agent from Rui, RuiU, and Oven or OVN. So these are open-source options that are also available as your plugins and backends. And then there are commercial solutions. And there are a few of them I decided not to list in case I missed someone. There are different releases. And even though the API remains the same for the most part or the backward compatibility is a big issue across the networks, in terms of enhancement that gets done at the control plane or in the reference implementations, there are implications, whether you are using Juno or Kilo or at some operators using even earlier releases. And very soon in a month or so, we will hit the L1 milestone. So there are lots of options. And for all of these options, there are some knobs to tune. And the question that we wanted to answer is that how can we come up with the framework that can be used to see how these different options perform, different choices we have, whether we use it out of the box or we have to tweak it or adjust it in our environment? How do they compare? That's why we thought we needed performance evaluation framework. So what would be the major components of such a system? Very simple. We thought we need workloads where you want to apply to your cloud and see, for example, how your Hadoop application perform. So a workload can be something like a Hadoop running terrasort operation. Or it could be more simpler, synthetic using the networking tools that we have currently, IPerf, NetPerf, and so on and so forth. And then for each of these workloads, you may want to have different scenarios. You want to do this across 100 compute nodes, or less you want to have your communication between these nodes. If you are using synthetic benchmarks in a particular pattern, just point-to-point communications or something more. So that's what we call different scenarios. And then you need to harness some way of doing all this, right? Some way of standing up your VMs and making them execute the workload that you are interested in. And collect the data, do the cleanup, and all that. And by doing so, you want to get some performance data that I will talk about shortly. And eventually, you want to come up with some figures of merits. Say that in this particular setup, with these options, with this particular plugin, and the environment that I use, I could provide scalability to a certain level. I could gracefully deal with increase in load. Something that can be translated into a simple number but signifies something much more. So that would be the ultimate goal. So what are the performance data? And where do they come from? Obviously, there are different places to collect the performance data. The obvious places are the VMs that you are using to run your workloads. And ideally, you want to be able to also collect the performance data on the compute nodes that are hosting those VMs. And the things that you want to collect are things that you are all familiar with, CPU utilization, memory utilization, network activity, so on and so forth. And then there is data that you want to collect from your application and see that you achieved a certain amount of work in so much time, things of that kind. And you can do that, obviously, pair VM or you want to be able to aggregate all this across your workload. So we wanted to have an open source framework. We wanted to have an ideally multi-cloud performance benchmarking tool where we could compare the results across different types of clouds. Whether you run the workload with OpenStack or something else, then you would be able to kind of compare and have a better judgment about what is going on. In terms of networking, we have focused on OpenStack so far only. So we want our results to be reproducible. If you have a similar environment, using the same workloads and same scenarios, you should be able to reproduce the data. And the future goal is to somehow become up with this automatic estimation of these figures of merits. Now I can look at the graph and say that, oh, it looks like things are scalable. But we want to automate that as well. And that's something that we are working towards not there yet. And automate the network configuration part as well. So the tool that we are using is called CVTool. We call it Cloudbench.  It is what is being used by the spec organization. And hopefully, by the end of the year, a spec organization will have a spec for Cloud. And that will be utilizing the CVTool. And it already had a non-network-centric kind of workload in it developed by my colleagues at IBM Research. And now it has contributors from outside IBM as well. So it's a collective effort to make this part of this spec organization benchmark. So we thought this is a good tool that has some credibility. And that's the place to start it. And I just want to go very quickly over a couple of sample results that are generated automatically with this tool. You can start different workloads. As difficult as it is to read these, the dotted lines are when the workloads arrives. And you can specify that. And the VMs get instantiated. Those are the solid lines. And the measurements, which is latency in this particular example, get measured. And you can have concurrent workloads getting executed depending on a particular arrival distribution and all that. You can also collect the data, as I said, from your VM or your host and keep that for later reference. CPU utilization, the first thing that you want to look at. So with all that as the way of introduction, what are the network-specific additions that we have added? We said, let's start small. We have used three obvious networking metrics, throughput, latency, and data loss. We have just a few workloads, standard networking tools, IPerf, Ping, NetPerf. We have a specialized workload, which mimics video over IP streaming. And that also is something that we are going to use. And we have different scenarios. Again, there are so many things we can do. We are starting with a small set. In terms of networking, we can communication between the VMs. We are limiting it right now to point-to-point communication and communication in a ring. So if you have, let's say, 10 compute nodes, you can have single VMs on them, one flow coming out of each VM. You can specify a scenario where you have multiple flows between these single VMs. And you can have multiple VMs and multiple flows. So these are the scenarios we looked at. The problem space is rather big. So we used a small subset of the problem space for this talk. I'm going to present even a smaller set of data, just to give you an idea about where we are. So we wanted to use the standard reference plug-ins or drivers, OVS and Linux bridge. We have measurements with some open source controllers, such as Open Daylight and some commercial ones. But we thought we have too much data to include all that. And it's better to kind of get the point across about what we are trying to establish here, rather than having an overwhelming amount of data. So we wanted to work with the latest releases. Most of the data I am going to present comes from Juno and some from Kilo. And we used VLAN, VXLAN, GRE, whatever is available through those two reference drivers, OVS and Linux page. And we wanted to measure all this network metrics across, within a single network, across networks, for getting to the external network, and so on, so forth. And the systems that we used use standard Ubuntu 14.04. The Linux kernel is 2.3. OVS that comes with that distribution is 2.0. And the hardware we used is Intel Xeon 2 sockets. It's 16 or 32 hyper-traded cores and 256 gigabytes of memory each. So we have a cluster of these nodes with this software. And I'm going to skip these slides where I show how OVS and Linux bridge drivers work in terms of where the security groups are specified and whether you use tunneling or VLAN and so on, so forth. In the interest of time, there have been talks that have gone through this already in this summit. So we started with the base setup, the software that I described and the hardware that I mentioned. With the Juno release, we said, let's start with VLAN as our baseline. See how close to the line rate we can get. We both drivers OVS and Linux bridge with one flow, we get to around 9.3 gigabit per second on a 10 gigabit per second interface. So we said, oh, that sounds reasonable. Let's look at the impact of having multiple flows now, sharing the same interface. Look at the impact of security groups. Compare VLAN with GRE and VXLAN. And also look at the impact of distributed virtual router. So in the baseline, we use just L3 agent. So this is one of the set of data where we use IPERF, that's the workload. 20 TCP flows within each pair of hosts. And we have, for this case, we have three hosts. We have different sets of tests depending on the number of compute nodes. But this is a representative result. So we get around 400 megabit per second per flow. We have two flows on each link. So that gets us to around 8 gigabit per second on each link. Linux bridge performs a little bit better. Not by much, but nevertheless provides a better performance. So we said, OK, let's increase the number of concurrent flows. And keep the number of VMs as one in each host that we have. And let them communicate with each other in a ring, if you remember, as one of our scenarios. And as you can see, the performance remains between 8 to 9 gigabit per second as we increase the number of flows to something around 60. So let's further push this and see how far we can get. And after we passed 120 flows, I noticed a significant drop in the throughput that each flow was receiving. Each flow was receiving. And that happened more or less in the same fashion for Linux bridge and OVS drivers. Pairwise latency, it is the standard pink and also use the IPERF UDP round-frape measurements. Again, comparable results. What I'm showing on the left is the graphs that I have generated. But CBTool provides something like what you see on your right, where when the workload arrives, it takes around a minute or so for the VMs to get up and start communicating and performing the operation and reporting the results. And the results are generated automatically also the graphs. So what about packet loss? That's where we saw some difference between Linux bridge and OVS. If you look at the numbers, I should have mentioned this earlier, but you see the max and mean and the average. The bars show the average and max and mean and you see the 25%, 75% tile box in the middle. If you look at the numbers, statistically, they are equivalent. The mean max kind of overlap. But the mean in Linux bridge is much smaller. And this is for this particular test. And the amount of data being injected is such that we are going beyond the capacity of the network. I just wanted to see how many packets get dropped. And as you can see, Linux bridge does better here. And then I say Linux bridge. I'm referring to the Linux bridge mechanism driver with ML2 plugin. So the idea is that we could do all these with different plugins, commercial, non-commercial, open source, not to necessarily limit ourselves to these two particular reference implementations that may or may not remain the reference implementation. So what about throughput across network? The results we got as expected, where we get around 400 megabit per second for each flow, if we have 20 flows to get us to around 8 gigabit per second. When we go across networks, we get around 150. And this is with L3 agent in Juneau. So I want to emphasize that this is where we are. We have collected this data. Obviously, as you increase the number of, I think I disconnected myself. As we increase the number of networks connected to the router, you can expect further degradation. The problem of L3 agent is well known to the community. And there have been significant amount of work to address that problem. And that's an ongoing effort. And I will refer to the numbers that we have with distributed virtual router towards the end. Nevertheless, this is the baseline. This is what you get out of the box. For getting out of the network using floating IP or network address translation, for getting out and for getting in, you again get fairly low performance. And you get fairly comparable performance among these two drivers. What is missing, I think, from these results that we have, what we haven't presented here, and we need to analyze is whether these equivalent performance is achieved with the same amount of CPU utilization or there is a significant difference between these drivers in terms of CPU utilization. We have all the numbers for all these experiments, but I simply ran out of time to put them back. Here, we will provide them. That would be the biggest piece that we need to add. That would be an indication how these perform under further pressure. What about the security groups? So if the number of flows and number of VMs communicating with each other is small, there is not much of an impact. There is a significant impact on the control plane. And I'm not presenting those data. I mean, if you go back in Ice House and it started hundreds of VMs, the system will crash eventually because of the problem. And those problems were addressed in Juneau as you create more and more VMs. It takes more and more time to get those VMs up and running, but the degradation is much more graceful. And I'm sure there have been improvements in Kilo. But with Juneau, if you increase the number of flows and number of VMs communicating with each other, you get a significant drop in the throughput. And here, we are not talking about hundreds of flows and hundreds of VMs. I mean, when I say here multiple VMs, I'm talking about 10, 20. Multiple flows, 10 flows per VM. So this is a closer look of the data that we collect. I just want to draw your attention to the fact that you cannot read the scale. But if you could, the scales are different. This data is from Juneau again. I want to emphasize that. On the left-hand side, you see without security group, you have to believe me, we get around 800 megabit per second for this particular workload scenario that we are looking at. And as you can see, the variation of the performance we get across flows is limited. With security group, not only we see a drop in the performance to something between 300 to 500 megabit per second as opposed to 800, now, as you can see, different flows in the same experiment get a very different share of that bandwidth. So there is much more variability as these security groups are being added. All right, I want to leave some time for a discussion at the end. So let me hurry up. We have done very little with GRE and VXLAN. As expected, on a single flow with single VM, you get much lower performance encapsulation. GRE or VXLAN, pretty much the same. As you increase the number of VMs or flows, you get to utilize more and more. And beyond certain point, the CPU utilization kind of becomes such a bottleneck that the performance drops significantly. Again, these numbers are without any hardware offload. Those are the things that one could try. And if you have been through the discussions, the community, as a whole, is aware of all these issues. These are not unknown. And there are solutions that makes you use the encapsulation at a different level of your network and use VLANs at the lower levels with hierarchical port binding and things of that kind. And of course, you have the adapters that do some work for you to improve the performance. With DVR, we wanted to do it with VLAN. And with VLAN, just to establish the baseline again, we got big impressive numbers. Across networks, we get around 9.2 gigabit per second. So very close to what we get within an network earlier. It turns out that in our setup, after several tests, the performance degrades. So we are talking to the DVR people who have developed those who have developed the support for VLAN, which is just added in Kilo to figure out what the problem may be and if there are bugs that need to be addressed. So what are some of the lessons we learned?  And then for benchmarking, if you need hundreds of VMs, you have to decide what to do if some of those VMs don't come up. Do you continue the benchmarking? The workload allows that or not? If some of those VMs come up, but you don't have network connectivity to them, what you do? And then how you clean up the mess afterwards. So these are the things that you have to worry about. You have people or customers or users who are tied to a particular older distribution for various reasons that has significant impacts. If you're using certain versions of Linux, the networking stack is at a stage that you will notice significantly less performance. So that's another thing to keep in mind. We have experimented with OBS 2.3, which is the latest, sees slightly better performance. We were using in our setup double VLAN tagging. And we were puzzled about the low performance that we are getting. We still don't know exactly why. People do double tagging. Maybe we weren't doing it right. But we used the tool to look at the performance utilization. Notice that a lot of our machines are having cores running at 100%. As soon as we got rid of the double tagging, we got in a better state, where we could get the maximum or close to maximum rate. So in general, I just want to emphasize this is a framework. It's just that the early stage, we need to add more workloads, scenarios. And we presented the results for OBS and Linux Bridge Drivers. And the performance is, for the most part, comparable. We need to do a better analysis of CPU utilization and see if there is any difference between these implementations. Security group in Juneau still was a problem. We will do the same in Kilo and see if some of those issues are solved. And there are other solutions that avoid using IP tables altogether. And they were at talk just this morning about that that may improve the state of affairs. And with that, where do we want to go? Beyond what I have already said, we want to see if we could use a setup like this to help the development team. For the most part, we use single-node testing. Infra has a multi-node to be accurate, a two-node testing environment that we can use. But that is certainly not suitable for performance testing as it is done in a virtualized environment. And you are already running within VMs. And those are connected to each other through tunnels. So we see in the community, people identifying things that are probably a source of the problem and do some testing and say, yeah, it looks like this is a problem. And probably we can solve this by doing this. That this could be something that could be used while that is happening and help the developers to figure out what are the bottlenecks and if the solutions they are providing are having really significant impact. And the way I can see it, and it can be totally off, is that it is used as a third-party kind of CI that is used selectively. If you need to kind of use that for every single patch, you really don't need to do that in terms of performance analysis. And with that, I just want to see if there are any questions. And if you find any of this of any interest. Hi. Thank you for that. That was very good. So you've talked a lot about the high-end performance that you're seeing in terms of pretty close to saturating a 10-gig connection. As it turns out when you kind of dig into that, one of the big reasons for that is segmentation offload. You end up with tens or hundreds of kilobyte packets on average being passed around. And that speeds things up tremendously. If you disable that, you actually end up dropping down to about maybe one gigabit a second max. So do you have any plans to have any tests like that in your test suite to cover the use cases where it's not possible to use TSO? We are open to adding any workloads. And please talk to me. And let's see if we can add that particular workload ourselves. Or we can use your help to doing that. We were more than happy to expand it. As I mentioned, this is a very small set of scenarios. And we hope that we can expand it. Thank you. Thank you. Slightly related. You mentioned hardware offloads. And this is something my company does. I want to be able to measure the offloads. For example, RDMA offloads. Ceph is supporting RDMA. Do you plan to start benchmarking that? So that's something we have to decide. All of the machines that we had were equipped with adapters that had offload. We didn't use it for this set of tests. That's certainly a possibility. Then the question becomes what kind of environment you want to use, or what adapter, or what kind of offload. And that's certainly. I'm talking about VM, SRIO, VO offloads, VLAN and VXLAN offloads. Absolutely. Definitely. That's something that we will consider. OK. I'll follow up. Thank you. Yes. Please do. Thanks. Given you have the background in development in this domain, how complex is it to set up this test infrastructure and get these test results? Is it one person, one week effort or? Extremely easy. Instantiate opens like it's nothing. It's better than anything else. No, the tool is rather straightforward. It has a nice gooey. I would say it is something that you will learn to use in a couple of hours easily. There are a lot we can do to make it easier in terms of introducing new workloads and scenarios. But as it is, it is very straightforward. The bigger part is the standing up the open stack environment. And again, for that, we use our tools. And that is the much more complex operation than just doing the benchmarking. OK, thanks. So we don't have that plan. But if this is used to spec, that's how things are done there. Different users and companies publish the results. And they are collected there. Whether we will end up doing that or no, I really don't know at this point. Yeah, but definitely that would be helpful, right? I forgot to ask, what about historical data? Do you have a mechanism to store and look like last week, last month? Yes, all the data, I'm being told that we are out of time. But all the data is stored in the database at the end of the operation. And it is preserved. Thank you very much, guys. Ladies.


Hi, welcome. Thanks for attending our talk. This is room for escape scribbling outside the lines of template security So my name is Alvaro Muñoz, also known as Pond Tested in the social media I'm a security researcher with the github security lab and with me my colleague Alexander Mirage Also known as Oleg Mirage in Twitter and he is a security researcher with micro focus fortified team so today we will be reviewing the security of content management systems or CMS and Basically, we will be focusing on the security of the template systems that are used by CMS's So a content management system is basically an application that is used to manage different types of web content So that users can actually create, upload and publish different type of content So normally this content is based on some structures and some kind of Documents called templates which are used to generate and create dynamic content So these templates normally allow a subset of different programming language capabilities So they are powerful in the sense that they can be used to run an arbitrary code Because of that, they are normally sandboxed in order to prevent arbitrary code execution and remote code execution So our research will focus on both .NET and Java based content management systems Because these are the languages that are more prevalent across enterprises And our assumption is that the attacker can control the templates So we don't really care about how the attacker gets control of these templates in the first place If it's through a server-side template injection Or if it's maybe through our cross-site scripting that allows him to submit arbitrary templates in the in behalf of someone else Or maybe they have permissions like if you are a user for example in SharePoint If you have an account in SharePoint, you are allowed to create your own sites and content So no matter how the attacker can edit the content of a template Our research will focus on escaping and breaking all the mitigations put in place to prevent arbitrary code execution So we will first start with .NET Basically we will focus on SharePoint We will present five different ways we were able to break the sandbox used by SharePoint to prevent arbitrary code execution And then we will move into the Java part Where we will present four different template engines including the most popular ones such as Velocity and FreeMarker And then we will present 10 different content management systems and we will try our bypasses on them So we will wrap up with some takeaways and conclusions and then open the floor for Q&A So let's start with the .NET part Thank you, Arvaro In this part of our presentation we will present different types of security problems in content management systems We will give examples of them in SharePoint But before that we need to explain some basics of SharePoint security SharePoint has two types of ASPX pages The first type is application pages Each of these pages are a part of SharePoint server and implement some application logic They are stored in specific folders on the file system Of course users are not able to chain them They have ASPX pages and are processed by server without any restrictions In opposite to them there are side pages They are stored in database and they can be customized even by users SharePoint parts with them in special mode also known as safe mode Actually they are more like some sort of templates for presenting dynamic content On this slide we can see a diagram how server works with these pages Virtual provider can fetch content from file system or database Based on the virtual path of the current page, ASP page parts virtual will decide either It is side page and safe mode should be applied Or it is an application page and it will be processed without any restrictions So page filter is critical element from security design Let's have a look on simple of ASPX page For our attacks we are only interested in server side components For example directives There are special instruction on how server should process the current page Often they have some number of attributes We can include server side code either in special blocks or as embedded server side code To be processed by server, control should have the runaut server attribute The next our element is server side common block It is ignored by server And server side include directives allow us to include raw content of arbitrary file Now we can better understand what safe mode means Safe page will not be compiled so we cannot use server side code We are not able to include files from file system We can only use allowed controls This list is defined in safe control section of web config file Page filter also applies an allow list for directives and even for attributes of most of them There are many other restrictions For example event binding is blocked as well As we can see it is a set of quite strong restrictions How it can be bypassed As we know safe mode is enforced by page filter So our first question was Either any place where SharePoint does not use it And answer yes there are such places Page filter will not be applied for the content argument of the parse control method If it's called only with one argument Or if the second one that actually has name ignore parse filter is true In addition page filter is used at rendering time But is ignored at design time But even if page filter is not applied SharePoint uses another way to verify the input It is verify control on safe list method from editing page parse type That aim to do the same task at the original page filter Block, markup with unsafe elements But let's imagine for a second that we are able to bypass either this method or page filter By the way each such bypass is separate vulnerability And we will present them in a few minutes So how could we get remote code execution after escaping into the safe mode Remember since parse control method never goes compilation We are not able to use server-side code or perform any other attack that require compilation But if we escape safe mode we can use unsafe controls or directives Let's review several of them One of the most interesting unsafe controls is object data source It allows us to invoke public methods from arbitrary public type We can see an example of payload that uses start method from process type to launch calculator So actually it is arbitrary code execution, jackpot But let's review a couple other unsafe controls XML data source and XML controls allow us to get content of arbitrary XML files The similar results we can get by server-side include directives that return us content of any text files Let's see how we can escalate from arbitrary file read to arbitrary code execution If we can access web config file we will be able to get validation queue from machine key section By the way this value may be present in other places such as internal share point properties We will see this example a bit later With validation queue we can generate a valid view state that will execute arbitrary code commands On the target server we can use tools such as user-serial.net for this Now when we know what safe mode is and how we can compromise share point server if we did bypass We can move to our next part of this talk Here we will present five different types of security problem in content management system We will show examples of each type in share point We would like to stress here that our target is share point server with default configuration All vulnerabilities allow us to execute arbitrary code on the target And all attacks were performed by regular user, no admin rights were needed Let's start The first type of security problem is access to resources with sensitive information It can be configuration or business information in various files, logs, database or even process memory Of course proper sandbox should prevent this problem, but it is not always the case We already mentioned that page filter block server-side includes directives And verify control on safe list method should do this as well and actually it does But if it's called with false in block server-side includes argument it will not block them And we found such usage of this method it was used for design mode The next building block for our talk how we can provide our markup for this mode We can send it in web part XML parameter of the render web part for edit method of the web part page services So we can try to include web config file there Here we can see the full payload for the mentioned parameter and address relevant web services Server returned us the entire web config with validation key We used it for view state-based digitalization attack which led us to executing arbitrary OS command on the server Time for our next type of security problems in content management system A loud dangerous element that can be used for attacks We have found an example in SharePoint's safe control list Or should we call it not so safe control list in this case It is contact link suggestion micro view control We can see snippet with interesting code from its implementation where request parameter is passed to data set read XML method If we can control input for this method we can get our data deserialized by XML serializer with control type We already showed in one of our previous work that in this case we can get arbitrary code execution Unfortunately this payload is too big for slides but you can find it in our white paper The last piece of the puzzle is our site page with this dangerous control You can see it on this slide For the attack we just need to place the payload into the text box and click on submit button And desired command will be executed on SharePoint server For us the next type of security problems looks quite interesting So we will explain it with more details and present two separate examples from SharePoint server Dynamic content usually means that we will have at least read access to some properties or attributes of some objects For some system like SharePoint we can even write values there Of course, sandbox should filter out the access to dangerous property or attributes Let's review basic type of such filtering The first case is when only one level of properties or attributes is allowed We can see examples on the slide Name property of user object or select value from menu We can imagine the object and its properties like a branch with only leaves If an allow list is applied it is relatively easy to review all elements And after such review we can make sure that there is no dangerous elements What if block list is used instead? We still need to verify available objects and it can be a bit difficult So in general we do not consider block list as a safe approach because of potential gaps there We will see in Java part a couple of examples of such bypasses The most interesting case for us is when access to nested properties or attributes is allowed For example request.authuser.name or menu.selecteditem.text Because of branch leaves analogy many developers may imagine this case as branch with branches and leaves And they may apply a filter only for the first level objects But it is not true, it is network And we may jump from one branch to another branch or even to the trunk For example on the slide we can see how we can access application instance from menu web control Let's illustrate this problem by examples from SharePoint There is wiki content web path control It is allowed and can pass our markup into the parse control method Please note it is called with false value in ignore parse filter argument So page filter will not be ignored The following snippet shows that in this case the virtual path will be created from a relative virtual path property And if you remember page filter will apply restriction based on this virtual path If we are able to change it we can full the page filter to not apply any restriction to our markup Let's try to graph such payload First snippet fails because when ASPX parser tries to assign a new value to a relative virtual path The page property of our control is not defined yet So we need to delay this assignment a little bit We can do this by data binding So by the time the property is bound the page property will be already defined Here is our final payload We can notice that our new path points to application page setting ASPX It is assigned to tooltip property and later will be transferred to a relative virtual path So the page filter will think that this is system page and will allow any unsafe markup For example we can use object data source control to start calculator Let's see how the real attack may look We can see a site page with our payload Path to system page it will be assigned to a relative virtual path Unsafe markup contains object data source control We will invoke start method of the process type and will start calculator Let's save it here For our tag we need to upload it to the target server In our case it's share point with default configuration That means regular user have access to their own personal sites And we can use them to host our site page We are ratificated as regular user with name attacker Sneaky isn't And here is his personal site Let's upload our page here Now to trigger our tag we just need to click on it But before that let's take a look on the right slide of our screen We can see task manager on our share point server And we will notice if calculator start Now let's start our tag and here is our calculator Let's move to our next vulnerability in share point Now we will try to exploit read access to nested properties We will use control parameter It allows to bind value of property from another control to select parameter Also it supports nested properties We need to deliver value of target property back to us To do this we will use XML URL data source control That sends value of select parameters to external server Now we need to find accessible property with sensitive information Here we should expand a little bit configuration process of share point online servers Obviously they are installed and configured automatically But what about configuration parameters that are unique for each installation? They will be provided in special file that will be used for unintended configuration What is important for our tag? All such parameters including validation key will be stored in initialization setting property So we just need to find a path of nested property to it from any allowed control And here it is Here is the whole page that will send value of validation key to attackers.server.com With this value we successfully got arbitrary code execution by unsafe desalization in view state Now let's move to the next type of security problems It is connected with our previous work on unsafe desalization Such kind of problem are relevant when text or binary data is converted to an object And the type or class of this object is under attacker control Plus it is not properly limited Actually it doesn't really matter what mechanism is used Classical desalizers, JSON and marshallers, type converters or even some custom approaches All of them are potentially dangerous For successful exploitation attacker just may need to find proper gadget on the system We have found examples of such problems in share point And were able to perform arbitrary code execution tag using it But patch is not available yet So we are going to publish all details of this problem when fixed is a list The last type of security problems in this part is the classical time of check to time of use problems They occur when the server invalidates some input But this input is later changed before the server uses We have found such problem in web part editing surface page User input is validated by the already mentioned verify control on safe list method But later the server may modify the input and remove substring that marshes specific regex pattern Let's look on the next input For validation control on safe list it is just one server side common block So it will pass validation But share point removes the highlighted yellow substring And parse control will see two comments and some markup No, parse control has only one argument so page filter will be ignored Time for our payload We can notice our unsafe object data source control and calculator command In this part of our talk we saw multiple ways to achieve arbitrary code execution On the share point server by regular user These vulnerabilities revealed five different types of security problems in content management system Now let's switch back to Alvaro and he will present even more vulnerabilities with templates for dynamic content in different Java frameworks and products Thank you Alexander So switching to the Java part we will be reviewing four of the most popular Java template engines Including FreeMarker, Velocity, Pebble and GeneJava And also we will be reviewing ten different content management systems that are using these engines And then we will be trying our bypasses on these content management systems So a brief introduction into what template engines are Basically these are systems that take two different inputs One is the template where we are mixing static and dynamic expressions And also the template context where we store objects that are required by the engine in order to resolve the dynamic expressions in the template So for example here we have the user.name expression In order to resolve it we need to get access to the user object in the context and then invoke the get name method So because it's invoking Java methods it's basically dangerous in the sense that attackers can execute arbitrary Java code And that's the reason why most of them are sandboxed in order to prevent arbitrary code execution So apart from the objects that are normally and directly used by the template There are a number of other objects that are exposed as part of a template API that is normally provided by the content management systems Which basically provides objects such as for example the request, the response, the self led context or even the STTP session So those objects are available in most of the template APIs and also many more that are part of this API So we will be discussing first some genetic bypasses That means that are independent of which engine is used No matter if it's a free marker, velocity, Pebble or Jinjava So those bypasses are based on finding different objects that we can use to get arbitrary code execution So we need to inspect the template context and look for these kind of objects So in order to do that if we have access to the JVM we can basically debug it or we can instrument it Dump the template context and inspect and analyze all the objects in there However if we don't have access to the JVM we will have to read the template API documentation Maybe do some brute forcing in order to guess names like for example request or REC or response REST and things like that And also in some of the engines like for example free marker it is possible to list all the variables or objects that are exposed in the context So apart from those objects that are directly exposed to the context we have some objects that are indirectly exposed Like for example if we are exposing the HTTP session because it contains some attributes All of those attributes will be available for the users and attackers to access and use Same thing with the servlet request and same thing with the servlet context So those are stores of attributes, stores of objects that the attacker can get access to and use to look for interesting objects So let's see how many objects we can find in one simple content management system In this case it will be live ray and in order to do that we will be generating this template that I'm showing you Which basically is listing all of the context variables, then all of the request attributes Then we will show all the session attributes, then the servlet context attributes And because the servlet context will expose the spring framework context We will be also listing all of the spring beans or the objects registered in the spring context So if we render that you will see that we have a bunch of objects directly exposed to the context Those are part of the template API and some of them are very interesting Others are exposed as part of the request attributes, session attributes and servlet context attributes So as we can see here we have interesting objects like an instance manager Or for example the web application context for a spring that we used to list and access all the spring based So as you can see there are hundreds and thousands of objects here There is a total of almost 900 objects and because some of them will have public fields that we can get access to Then this number will increase to thousands of objects So back to the slides, this is why we call it object dumpster diving because this is how we felt When trying to find very few interesting objects that can lead to remote code execution among thousands and thousands of objects So now we will be reviewing the top three objects that we found that lead to remote code execution So for example the first one, the class loaders was available in 10 out of the 10 content management systems that we analyzed So normally you can get access to this class loader instance through the get class loader method in the class type But that is normally blocked by any block list by any sandbox So you can still get access if you get access to a protection domain or a servlet context as we saw before So once that you get access to a class loader you can obviously load arbitrary classes and then also load arbitrary resources from the class path But apart from that you get access to a URL object and then from there you can access any file from the file system that the application server has permissions to access So here you have an example, you get the URL using the get resource method and then you point the URL to the password file And then you open a connection and read all the bytes from that file So apart from the standard class loaders because content management systems are normally deployed on top of servlet containers or application servers The instance of the class loader that you will be able to access is normally an instance of a web application class loader That are slightly different because of the way that class loading delegation work But also because they expose a number of additional methods that are not part of the abstract class loader class So here are just some examples, just mentioned because we don't have time to cover them in this talk Although it's explained in the white paper that we are publishing as part of this talk There are different ways of using these methods in this web application class loader to get remote code execution Just to mention some of the vectors, we will be able to upload web cells, instantiate arbitrary objects, perform JNDI injections Or even initialize attacker controlled classes So we were able to find web application class loaders in 9 out of the 10 content management systems that we analyzed And then the second most easy to find object in this template context was the instance manager or the object factory So this was found in 9 out of the 10 content management systems and is normally found as part of the servlet context attributes But also it can be accessed through one of these web application class loaders So if you get access to an instance manager what you can do is basically instantiate arbitrary types So with that it's very easy to escalate to remote code execution Here we have an example using the script engine manager But there are a bunch of classes that can lead to remote code execution Once that you can instantiate them and then invoke arbitrary methods on them So the number 3 object was a spring application context It was only available in 4 out of the 10 CMSs that we analyzed Actually the only 4 that were using the spring framework underneath And it's normally accessible through one of the servlet context attributes But also if the content management system is using a spring MVC framework for the model, controller and view layers Then a spring will inject some additional objects in the template context Like this spring macro request context that will provide access to the spring application context So once that we have access to the spring context we can get an instance of a class loader And initiate a class loader based attacks like we saw before We can access the spring environment that will give us access to the system environment And also the system properties and also spring properties including things like encryption keys and so on But probably more interesting it will give us access to the spring pins registered in this spring application context So being able to access and manipulate those pins we can basically control the application logic And do things like register need users, delete users, perform transactions Anything that the application is normally doing So that's normally behind an authorization layer So no matter what roles we have we will be able to perform this kind of application logic control So apart from that we will also be able to disable the template engine sandboxes If we are able to get access to the template engine configuration pins And also instantiate arbitrary objects like we will see later by accessing JSON or XML and martial arts So those were like genetic bypasses independent of what template engine was used underneath And now we will be reviewing some specific sandboxes bypasses for each of these four different template engines So we will start with free market because it's probably the most popular one And also because well it was analyzed and researched by different researchers in the past Like for example James Kettle back in 2015 when he presented server side template injection vulnerability class By the way if you haven't watched this talk it's highly recommended He presented a bypass that is based on kind of add-on or module that is deployed on the default configuration of free market So Tony Torralba last year presented a different bypass but this one is not universal in the sense that it depends on a non-default configuration of free market And also being able to find gadgets in third-party libraries that may or may not be available in a specific target Then Ryan Hansson this year probably at the same time that we were doing this research presented a vector that leads to remote code execution by uploading a web sale But this is not universal in the sense that it only works with Tomcat servers So free market sandbox is a method based block list Which basically means that for example methods like the get class loader method in the jabbaland class is blocked And you cannot get an instance of a class loader using this method But as we mentioned before you can still use the template context or the protection domain to get access to these class loaders Once that you get access to a class loader the class loader methods are not blocked by the block list So you can still interact with them load classes get resources or initiate remote code execution attacks that we saw before And also reflection is forbidden to set fields values but is allowed to get and read field values So we use that to perform an attack but this attack is not universal in the sense that it depends on being able to find an instance of a URL class loader So this is normally the case in Tomcat class fees and Yeti but it's not universal for other application servers So in this case we are basically getting the URL class loader from the protection domain or from the self-led context And then we are basically instantiating by invoking this new instance method A new URL class loader that is pointing to the attacker control jar file in this case the pond.jar file Once that we get access to this class loader we can get a load arbitrary classes from our own jar file And we will be loading the pond class and now the class is loaded but it's not initialized If we want to run arbitrary code we need to initialize the class We cannot instantiate the class we cannot invoke static methods So those vectors those ways of initializing the class are not a possibility for us But we can get access to public static fields So just by adding a public static field and getting access to that the class will be initialized and the payload will be executed So that was not a universal bypass in the sense that we are required to find an instance of a URL class loader And we want to find something that works no matter if we are able to find that kind of class loader or not So we are interested in finding some classes that contains public static fields of a given type Which contains a method that we can use to instantiate arbitrary types To find them we use codeql which is a language that you can use to query your source code in the same way that you use for example sql to query a database And what we wrote was this query that basically says okay find me all the public static fields which are of a given type that can instantiate arbitrary types We run this query on free market source code and we found four different results Those are four different fields of different types but all those types extend from the pins wrapper type Which contains a new instance method which we can use to instantiate arbitrary types Now this is the universal remote code execution bypass for free market Basically we need to get access to any type of class loader from either the protection domain, self-reliate context And then load the object wrapper interface and get the default wrapper field from this interface And then we can use that to instantiate arbitrary classes Since we want to have this payload basically contained in free market classes We are using the execute class in order to run arbitrary system commands But you can use other payloads, other classes to get arbitrary code execution So this was fixed in version 230 of free market And also if you get access to the spring pins and you can get access to the free market configuration As we saw in some of the content matching systems that we analyzed You can basically disable the sandbox For example you can get the class resolver for the default configuration that is non sandboxed And then set that class resolver as the class resolver for the current and sandboxed configuration So effectively disabling the sandbox and being able to execute the old payload from James Kettle once again So now we will be reviewing eight different ways to escape the sandbox and get remote code execution in LiveRay So let's see our LiveRay instance here And what we will be doing is basically using this template And here what we are going to do basically is first of all we are going to use the class loader payload Which will allow us to read the password file using the url trick that we explained before Then because the instance of the class loader is a web application class loader We will be using that class loader to upload a web cell by using the write method This will be available in the shell jsp file Then we will be also using the web application class loader to get access to an instance manager And then instantiate arbitrary classes, in this case we are instantiating an expression language processor And then running the id process Then we will be also showing different payload that depends on using an instance manager This time is taken from the self led context And again we are using the el processor to run the id command And then we will be using a JSON digitalizer as an instance manager in the sense that we will be using that to instantiate arbitrary types We will be getting access to the JSON digitalizer from the spring application context And because this JSON digitalizer uses a wide list and allow list here We need to register or we can actually register any arbitrary types for us to use in the JSON payload So now by digitalizing this JSON payload we are effectively instantiating an el processor And then again running the id command Same thing but instead of getting the JSON digitalizer from the spring bin context Live ray directly expose this JSON factory URL which we can use to create a JSON digitalizer And then once again use that to instantiate arbitrary types And then we will see the two free market specific bypasses that we explained A few minutes ago the first one is using the URL class loader that is the case here Because live ray is deployed on Tomcat And then we can basically access our own jar file loaded And then by getting a public static field the class will be initialized and the payload will be executed And we will be able to check the output of this payload by checking the standard output And the last payload that worked in live ray actually there is a couple more But it was more than enough Is this universal RC So we are loading the object wrapper interface Loading the default wrapper field and then using that field to instantiate arbitrary types In this case the execute type that we will be using to run the id So now if we save this template and we will be showing the results of these payloads The first one was reading the password file The second one was deploying a web cell that we can now access and run arbitrary commands The third one was using different methods to run the id command As you can see here all of them worked So also the URL class loader was basically running the static initializer block of this class Which is basically printing pond in the standard output console We can check that Here it is so it worked And back to the payloads The universal RC payload also worked as we can see here So switching to the velocity sandbox This one is based on a class and package based block list So things like for example the whole java lang reflect package is forbidden And you can get access to it All the methods in java lang class and class loader are also blocked And you cannot use them But when we reviewed the implementation we found that there is a flow in the way that this sandbox is checking the block list So for example when you run the request sublet and then you get access to a class loader And run the load class method Basically the execution of this method will be checked against the block list And the class name of the current class loader will be checked against the block list Instead of checking the whole hierarchy of classes Only the current object class will be checked against the block list Which means that because java lang class loader is an abstract class It won't never be the case that the current object class will be a java lang class loader In this case is a parallel web app class loader Which is not present in the block list And therefore class loader methods are effectively allowed There is a feature in velocity which allows you to invoke static methods from a java lang class object So once that we are able to load a class We can just invoke any static method and use that to get remote code execution easily So now moving to Jinjava sandbox This one is based on a method block list This is actually very short, only nine methods And what it contains is a piece of code that is pretty effective in protecting the sandbox So every time that method invocation happens as part of the evaluation of the template The result type will be checked And if it's an instance of a java lang class Then it will throw an exception and it will refuse to return a java lang class instance By not being able to get in access to arbitrary classes We are normally not able to get or to be able to instantiate arbitrary types However, we found a flaw As you can see here The invocation of a class cannot return a java lang class instance It can return an array of java lang classes or a map Including java lang classes So what we can do is find a method Returning an array of classes and then accessing any arbitrary item of this array So the second part of this bypass Was basically being able to access a secret or hidden variable in the context That is called underscore underscore underscore interpreter in liter speech So by using this hidden variable we were able to access a bunch of different objects Including all the context objects And we were able to use those two parts to get an instance of a class loader So as you can see here we use the interpreter to get the context And from the context we got all the functions And from the functions we got the underlying methods Which are instances of java lang reflect method And this class contains this get parameter types method Which returns an array of java lang classes So as I explained before We are able to get an instance of any individual item of this array And by doing that we are finally getting an instance of a java lang class From there we can get the protection domain, get the class loader And then initiate any class loader based attack So last we were able to find a couple of bypasses that we reported to the maintainers Unfortunately they didn't have time to fix them on time So we decided not to leak these bypasses yet And we are keeping them classified for a few months So with that we will switch back to Alexander who will wrap up the talk with some conclusions Thank you Arvaro First of all let's summarize our results after this research More than 30 new vulnerabilities were found and reported to the vendor More than 20 different products are affected We can see their names on this slide Based on these results we can make the next conclusions These are not the problems of specific product or framework And content management system as a class should be on red team radar Templates for dynamic content that can be managed by user is the main target for such system There are specific areas with higher risk from security point of view It's a good idea to perform security review and testing for such places Always try to reduce attack surface as much as you can And stay safe


Hey guys! So yeah it's a little bit unfortunate as you guys can see from the title. It's been a bit of a unfortunate little last few weeks. Pretty much a month. I found out about a month ago that I am getting a surgery for a early metastic semenoma of a retroperonelia lymph node dissection as a first line of treatment for testicular semenoma with an isolated, rapid-pipid disease. Yeah, I got cancer again obviously. Apparently it's not as bad as the first time. As my urologist at the time told me, it's of all the preferable cancers to have, it's a better one to have. So I said, oh cool! So two for two. So yeah, I'm not going to be seeing you guys for at least two weeks. Any videos that I do from here on out are going to be very slow. If you guys were here for me when my first little stage of cancer, then you know that I was very slow. I was very kind of breathy with my review. So you can imagine what it's going to be like afterwards. I don't even know what I'm going to be able to sit in a movie theater and watch anything. So just letting you guys know, wondering why I've just got complete radio silence for the next two weeks. And again, I'm just going to say the same thing I did for you guys last time. Always be checking. This came up for me because of my CT scans. And again, I actually re-watched the video last week and I noticed that I had, I said something about this, this ignorance, this unintentional ignorance of it not, you know, never getting cancer. I admit I kind of had it for not coming back. So when I found out that I had it again, admittedly the world came crashing down for about five minutes. So I guess always just trying to be healthy. I'm not the best advocate for that right now, I'll admit, but I'm going to definitely try and turn this around once this surgery has happened. But right now they're going to try and remove all the lymph nodes around my abdominal aorta to try and prevent this because they say it was either this surgery or nine, or three bouts or four bouts of chemo. And I want to try and avoid that because that's something that this is avoiding, which is great. So again, I'm once again of all the form of cancers to have. It's a lucky one. It's just unfortunate that lefty peace bro has left me an unfortunate present that took two years to manifest. So anyways, just wanted to let you guys know what's going on.  And again, just always be checking. Never think that you don't have you're invincible to this. And it doesn't hurt to check it's maybe what's it, it's a few seconds of feeling undignified for making sure that you can live your life long and healthy. So anyways, guys, I hope to see you all soon. And maybe I'll try and do updates in the community thing about what's going on. Otherwise, I'll see you guys next time.


If you guys remember, I was also watching the video to the downside as well, right? We were looking for that bottom channel and I show you it didn't it didn't quite get there And that's the whole point of having a plan if you guys recall last night's video I turned around said look, that's my plan, right? I just planned to short this thing below the 10-day moving average But who the hell knows if it even gets there and that's the whole point you never Anticipate because if you do anticipate you get run over and now we're in a very unique situation Going into tomorrow's session that NVIDIA looks great, right? NVIDIA is super you know super tight super strong If it starts confirming, you know that the high channel from three days ago Hey, if the mark is strong tomorrow, you could see 46 47. I mean that's how good-looking the stock is


The redeem team documentary set to release on October 7th on Netflix sparked this video creation So I went back and looked at each redeem team member and all these NBA legends had a story to tell on Kobe Bryant and they all fit in so here's the craziest Kobe Bryant Olympic story that you've ever heard If you enjoy these types of videos Please help me out by hitting that like button subscribe if you are new get your popcorn sit back and relax and Welcome to the craziest 2008 dream team Kobe Bryant story Let's talk a little bit about the big picture for USA basketball last couple of Olympics that you were not a part of Maybe the reputation wasn't the greatest in the world. This is a different team, isn't it? It is a different team I think it's a different attitude. I think it's And we understand the significance and the importance of representing our country. I think that was something that was Maybe missing on those past teams.  It was terrible to be a part of I had a lot of concerns that's why we recruited Kobe Bryant a lot of it really falls on me because you know I'm wiser of the guys. I haven't been around for so many years So, you know, most of the time I set the tone in practice. I'd like to share a lesson. I learned from It was 2008 the redeem team was born And we were in Vegas for the start of training camp and we're getting ready for the Olympics in Beijing We're gonna head to Beijing And this is when I knew Kobe was a monster though.  There was four of us playing spades and And he came in and there was a little wine sat down board itself a glass and he like saw this newspaper And saw a picture. It was like something about the Lakers series and blah blah blah and it was a picture of Paul Pierce Like celebrating and there was a picture of Paul Pierce. So they had just lost to the Celtics in the finals like Tragically and in a very, you know, gut-wrenching way. You remember they like blew a lead. It was not good But Kobe Bryant sits down and pours a glass of wine. We're like what the fuck, you know And he got very competitive with drinking the wine And it was like he didn't want to be behind anybody on these glasses and we were like Kobe You know, we got practice tomorrow. We're just sipping and I just remember watching Kobe Just stir the pot the whole time. You know how Kobe does. Nope. He was like into this wine He's I've had three glasses. You've only had one and I was like that's cuz I'm small And he literally like he didn't say a word. He didn't say anything But we saw him like take the paper.   Yeah, when we We're starting to build a culture At USA basketball and he Chauncey Phillips and Jason Kidd were added to add Veteran leadership coach K did a great job of Preparing us, you know of getting us ready coach K I really want to say coach K led the charge on that one because he knew the moment in how serious it was You know, but at the same time we had the group of guys we had you didn't have to really worry about that You know with with LeBron Kobe D way come out low and you know those those guys were great guys Me and Cole became we became very close The one that I'm closest to from the team I look at him as a brother But he pulled me to the side in the Olympics and said you're bad motherfuckers like that you know I'm saying because He knew what it was already So for me as a young player for fire your four years in the league at that time It's nothing you want nothing more than somebody like that to come to you back That was respect so he did that I knew it took a lot out of him to tell me some shit like that So I took that and you know, I built on that and You know, I thought the word of him prior to my experience with him and playing with him even more so He just worked extremely hard competes But we became close on some like some disrespectful shit like going at your neck Going at your neck is saying shit to your elbow on you. I have my braids back then too.  I'll come back elbow him.   I was just trying to soak everything up. I could You know, and I remember one thing that he said he was like if you want to try to be, you know Great at it. I want to be one of the greats. You got to put the work in You know, there's no substitution to work. And so we get into a city one of the cities very late and Immediately we all go to the gym, you know all my guys is you know, it's mellow It's me is Brian. It's Kobe. Like we all go to the gym. We all get out working. It's real late And so after we get done getting our work in me and my guys We said hey, like let's meet for breakfast in the morning And I wanted to establish myself as a young leader on the team by waking up bright and early Like if you can't sleep whoever first one wake up hit us up.   So I set my alarm. I Make sure I'm about sunrise. I get out of bed.  Kobe's already there With ice packs on his knees Drenched in sweat Right so we walk up to cold we like cold what what's up? He was like, uh, yeah, man I just finished finished the workout and I'm about to go do another one Now it took me a minute to figure it out, but this guy wasn't only awake before me He had already worked out at that moment. I was like wait, hold on We just worked out about three hours ago You know I mean and like you've done another workout and you about to go do another one He was up every morning at seven o'clock in the morning getting to lift in Going to the gym getting up shots going to get breakfast coming back for practice By himself every day and then coming back at night to get shots up He had just played in the finals days earlier. Meanwhile I'd been off for months and I was still exhausted What he had done that morning was incomprehensible to me That dedication he had only days after falling short of an NBA championship That taught me some I've never forgotten Legends aren't defined by their successes They're defined by how they bounce back from their failures That's when I was like, okay, I got to get my stuff together I got to get my shit together because this dude right here is on a whole different level Didn't even I'm on and I'm supposed to be great, right? So that's the kind of person he was and that's how he drove me You know I mean like this little stuff like that I went back and said, okay That mean I got to work hard and I got to do more At the first week of training camp for the for the Olympics in the way He was doing it by himself by the second week. We had the whole team there Yeah, man, it's contagious and that was our regimen from the second week of training camp To get ready for the Olympics all the way until we got the gold medal and we beat Spain and China That was the standard. He wanted to leave. He wanted to make sure that we all Achieved greatness. We put the work into it, you know when you see, you know at the time He was probably you know him and him and Him and LeBron are the best players in the world, you know arguably, you know It's kind of one of those battles went back and forth at the time So it was two different things that you had to worry about where LeBron it was Pick and roll at the pick and roll at the pick and roll. Well, Kobe, it was a matter of don't let him get to His sweet spot. He's going to beat you up for three quarters and so in the fourth quarter It'll be easier to get to his sweet spot. So you needed crazy stamina You see this man the work he's putting in the hours He's putting in the gym the extra shots. He's getting up. You can't help him. Like you're not going to go sit down On the sideline while he's still out here at 30, you know, see him doing that.  It was great being able to work out with him Um to learn from him to talk to him pick his brain about things Um and then have a chance to compete with it You're gonna see how hard he worked how much he put into the game how good he how good he really is What was and so to be able to play with a guy who had everything offensively Who could have just demanded us to give him a ball every time down Was worried about defense in the olympics. Come on, bro. What am I gonna do? I'm gonna follow suit and And so that was one of my favorite things when he came to me He said that like I didn't care about starting them while I care about my moments when I got a chance to get on That court with cold because I knew what it was going to go down. I'm sure he knew that man You know, I know D this is tough for D way not to be starting on this team And cold came to me as he knew I was coming off the bench He came to me right away and he eased my mind. He was like, listen And he said hey D when you get in when you get in the game, it's me and you on the floor This is what I'm gonna do. I'm gonna pick up the defender 94 feet. I'm a harassing. I'm a turn him I'm a turn him. I'm a turn him once I turn him you do what you do you come in Like shoot at him, you know what I mean like to come and trap or to come and get a steal You know and so I got so many steals and so many dunks and so much because of an unselfishness of a star in our league For me, I looked at that. I'm like, I'm a younger guy I'm the least you know accomplished guy in this group. I should be the one that you say He should have told me D you go pressure and I'm gonna do that But his mindset wasn't that way rover. Uh, his his trainer was talking about he would just Go on bike rides through the desert and just like really just work like just do wild stuff Just to get like his mentally repaired when Kobe was in the olympics in 2008 You took the role in l8 as a defensive stopper and then if they need you towards the end You would go out and close especially in l8 against spain Kobe right away said I'll play defense and in the first practice he never took a shot All Kobe cared about was defense all of a sudden there's a Knock on the door It's two days early And it's Kobe He said coach can Can I talk to you for a minute? And I said certainly so he went to a private room and I said, what do you need? He said I I need to ask you a favor And I said, yeah, what what is it? He said I want to guard The best perimeter player on every team that we play now. He's the NBA scoring champ He's the best player in the league at that time. He wanted to let everyone know That I'm here And I want to guard the best offensive player every time We go and we have a team meeting in the first practice. He doesn't take a shot He does not take one shot Mike's essentially coach k was the coach and he pulled Kobe and myself over and he said So I call him over afterwards and said, you know, yo, Kobe You're actually going to have open shots Will you shoot the freaking ball? And Kobe said I've been playing this game for I don't know how many years I've never had an open shot He goes no because with the talent that we have and the offense we're going to run You're going to have open shots. So Kobe goes well, we're going to where are my open shots going to be from? He said mostly the corners That's something that I really took the challenge of because very rarely did he take Shots from the corner And he's smart, you know, he had that smile and he said from then on I was the only coach ever To ask him to shoot And you know what he was doing JJ he he had this vision of moments He knew that for us to win the gold medal, we would have to beat Argentina Whether it be in a semis or the gold medal game And that he wanted to guard jenoble I believe me. He already had that figured out And he was going to prepare To guard jenoble wasn't just a set an example for his team He had that vision crazy So every single day from the moment the coach told him that We would make 500 not miss Not take we would make 500 jump shots From the corners. That's it. Let's not just make the shot because there's a lot of individuals that can make the shot Let's enhance the focus. This is how the ball has to go in the hoop This is how it has to come back to you. So those 500 shots weren't all the same every single time That's mindset and the world champions were both undefeated and um This is the game everybody was waiting to see How about your ball's relationship? We're like brothers. You know, we're very very close and a young mom very happy for me. He's playing well got me And we're we're very very tight. So it's just a little tough to compete against them Right before the game when we came to see me and when they came to visit the village I remember that very clearly and vividly My big brother came to see me with my teammates And everyone was like, whoa, Cody's in our apartment. How cool and I believe You know, they might have been part of his strategy to kind of soften me up Now it's time for the united states to battle for what many feel is their toughest foe in these olympic games made Both teams come in 3 and 0. They're the two best teams.  I'm running to poke so We was like What? We trippin. That's your teammate. You trippin. You ain't about to do that.   I'm like, I love this energy. This is what we need We was like he did that to his teammate Oh my god And so they look for me to really have that poise in those types of situations does not get rattled not Get flushed around it. It is what it is. So just to kind of keep that composure Was part of my job. You know any cut at the two points three minutes to go I was like man, this is This is so much fun You know, I remember wanting to ball in those situations And once I made the shot it just felt felt good. I was like, oh, yeah, this is All right, I want to do it again. It's a different it's a different feeling playing for your country when you play in the NBA you're playing for a particular city a particular market when you're playing for your country those lines go away We're all together all playing for me. I say basketball carries it The great honor with that that goes above and beyond that that moment is very special And I hope you guys enjoyed the video. If you did, please be sure to leave a like Subscribe if you are new and comment down below what you thought about the stories in this video I thought they were absolutely insane here are two new videos that you may enjoy And I will catch you guys in the next one. Peace


Kraft, a Kraft who war-trade is a pastime or profession that requires particular skills and knowledge of skilled work. In a historical sense, particularly the Middle Ages and earlier, the term is usually applied to people occupied in small-scale production of goods, for their maintenance, for example by Tinkers. The traditional term Kraftsman is nowadays often replaced by partisan and rarely by Kraftsperson Kraftspirpel. Historically, the more specialized crafts with high-value products tended to concentrate in urban centers and formed guilds. The skill required by their professions and the need to be permanently involved in the exchange of goods often demanded a generally higher level of education, and Kraftsman were usually in a more privileged position than the peasantry in societal hierarchy. The households of Kraftsman were not as self-sufficient as those of people engaged in agricultural work and therefore had to rely on the exchange of goods. Some crafts, especially in areas such as pottery, woodworking, and the various stages of textile production, could be practiced on a part-time basis by those also working in agriculture, and often formed part of village life. Once an apprentice of a Kraft had finished his apprenticeship, he would become a journeyman searching for a place to set up his own shop and make a living. After he set up his own shop, he could then call himself a master of his Kraft. This system of a stepwise approach to mastery of a Kraft, which includes the obtainment of a certain amount of education and the learning of skills, has survived in some countries of the world until today. Krafts have undergone deep structural changes during and since the end of the Industrial Revolution. The mass production of goods by large-scale industry has limited Krafts to market segments in which industries modes of functioning or its mass-produced goods would not or cannot satisfy the preferences of potential buyers. Moreover, as an outcome of these changes, Kraft's people today increasingly make use of semi-finished components or materials and adapt these to their customers' requirements or demands and, if necessary, to the environments of their customers. Thus, they participate in a certain division of labor between industry and Kraft.