Chapter 29 The Same Person Among other eminently sensible movements upon his part, Mr. Earl McIntyre showed the most surprising interest in the missionary convocation. He had not heard Mr. Randall's great speech, and before the coming of that gentleman's family, had been heard to say that he was glad he had not because he had been called upon already to hear as much about it as mortal man could endure. Nevertheless he heard, or at least he was present where he could have heard if he chose to listen, every other missionary, home or foreign, who spoke at that gathering during the next five days. To be sure there were reasons for this which he believed must be apparent to people of common sense. His father had a heavy business on his mind, the details of which must receive more or less attention, and a new maid in his mother's department demanded some of her time. He was the only member of the family who chanced just then to be quite at leisure to entertain their guests. So mindful of his promise to his mother to aid in a bet her hospitable designs, he gave the most careful attention to Mr. and Mrs. and Ms. Randall, surprising even his mother with the thoughtfulness of his courtesies. In going to and from the evening meetings, when both his father and mother were of the party, the family carriage seemed quite full, and with marked solicitude for the comfort of his elders, he decreed that Ms. Randall should take a seat in his own single carriage and make more room for the others. Moreover there was a river and there were rowboats. In fact he had one of his own, and Ms. Randall had lived all her life far inland. It seemed no more than attending to the demands of courtesy to plan that she should have opportunities now for such enjoyments, especially as neither her father nor mother were fond of rowing. So in the early evenings before the church services began, he seized the opportunity to show the inland bred girl the beauties of their river scenery, and if sometimes they rowed farther than they had meant and were late in reaching the crowded church, neither of them seemed to be deeply grieved there at. Nor had these two any lack of topics for conversation when they were left dependent on each other's society. In truth the number and variety of topics for which they seemed to have an equal affinity might have astonished an unsympathetic outsider. On the first evening of their acquaintance, Ms. Randall had made a surprising remark. They were together in his mother's garden, whether she had bade her son take their guest to see her chrysanthemums that were in their glory, and all the while Esther exalted in them he was conscious that she was bestowing curious glances on him as one trying to place a half-forgotten scene. At last she spoke, half-allowed, as one who did not realize that she had a listener. It is certainly the same person. Is it, he asked, shall I be glad or sorry? Then she looked directly at him and laughed. I think you have a right to be glad, she said, but you don't know anything about it. I wanted to ask you then, but I never expected to have the opportunity if possibly the name of your mother's friend was Esther Reid, the friend who died when she was nineteen, was it? He looked exceedingly surprised. My mother had a friend named Esther Reid, he said, and she died when she was nineteen, but how you know of it or what you mean, I am at a loss to understand. Isn't it wonderful, she said, that her name was Esther Reid, my father's friend? Yet it seemed to me at the time that it must be. I was named for her. I am Esther Reid Randall. So was I, he said, smiling. I am Earl Reid McIntyre. But what does all this mean? When and where did you hear about my mother's friend? And that took them back to the college town and the Sunday morning service in Dr. Armitage's church, that never to be forgotten Sunday in which Esther Randall found her soul and its master. But she did not tell him then what cause he had to be glad for the utterances of that hour. They began to feel, however, like old acquaintances, and presently Mr. McIntyre, still lingering over that Sabbath memory, said, Why, perhaps you know my friend Langham, he is from that college. Professor Langham, said Esther, is he your friend? Her tone expressed astonishment and he laughed a little as he answered. Yes, in a way, we meet each other daily in term time and always exchange friendly greetings and take an occasional walk together and often have to serve on the same committees. Isn't that friendship? Will you tell me why you are so astonished? There is no reason, said Esther, flushing deeply and feeling glad that the dusk was falling rapidly. Only I, he, she was vexed with herself over her confusion. All I mean is, she began again speaking rapidly. It did not seem to me you are sufficiently alike to be friends. Do people have to be alike to be friends, Ms. Randall? Then, seeing that for some reason the topic embarrassed her, he added quietly, Mr. Langham and I are new friends. I did not meet him when I was West and at once changed the subject. They did not refer to it again until they had become old friends. Missionary rallies, though as long drawn out as that memorable one, will come to an end. The last day and hour came and the Randalls, although held for the Sabbath after the close so that Mr. Randall might preach for Pastor Evans in the Tenth Street Church, reached the hour and moment when they said goodbye and departed for the old home in the waiting mothers, Helen's mother first. Mr. Earl McIntyre had made every conceivable arrangement for the journey and had been at great pains to explain that it would be necessary for them to leave the through train at the junction forty miles distant and wait two hours for the accommodation. Then, at the last moment, he had discovered some business which should be attended to in that direction, so he went down with them, agreeing to see that they boarded the right train. What possible business can Earl have at the junction, questioned his bewildered father after the guests had departed. I never knew of his having any acquaintances or interests there. I think, said the hesitating mother, that perhaps the chief part of his business is to see that our guests get safely away from the junction and have as comfortable accommodations as possible for the remainder of their journey. Humpf! said the father, who wished to have a quiet evening with his son before the world's work rushed in on them again and who resented the junction as an interloper. I should call that courtesy gone mad. That would be enough if the ladies were traveling alone. Mr. Randall knows what he is about and is entirely capable of taking care of his family. I never knew Earl to be so overcome with politeness as to plan to wait unnecessarily at a stupid junction for two whole hours with not an interesting thing to take his attention. Mrs.  Ah, well, let it be. He will learn in time what there is at the junction that was interesting. But the mother knew then and knew that she was not dearest any more. All these people went their ways and lived their lives and a whole year passed and it was the ninth day of October and wonderful things were happening to the ladies of the Tenth Street Church. The ladies' aid was gathered in full force for its important fall meeting which was to initiate the winter's campaign of work. Financially the year had been discouraging to the Tenth Street women. They had worked valiantly, but without the leader to whom they had been accustomed it seemed to them that they had accomplished very little. Not once had they ventured on a church supper or fair or festival. It had been found that with one consent they shrank from any aggressive movements unless they could have the help of Mrs. John Potter. And that good woman sorely tried though she was by her inactivity and with her opposition to any and everything missionary in its character utterly annihilated ever since she listened to missionary Randall's two hours plea was still engaged in being a woman of her word. She had kept herself carefully posted on the efforts of the women and knew that they had not been able to pay one penny of the original debt that indeed the prompt payment of the interest had together with their other obligations taxed them sorely. She felt deeply for them and longed in every fiber of her being to be at work in their behalf yet she told herself grimly that business was business and set her lips firmly and wondered drearily how it would all end. If she could only afford to quietly transfer a thousand dollars of her own money to that ridiculous bank account of three dollars and sixty five cents that would settle the whole matter and she could go to work again. But this the good woman knew that she could not afford to do so she sighed and waited. And yet on this ninth day of October all the members of the ladies aid and a large number who were not members were gathered by special invitation read by Pastor Evans from the pulpit in Mrs. John Potter's pleasant rooms busy with needles and tongues. While Mrs. John Potter herself bustled about her dining room adding last touches to the table where she meant to spread a bountiful thanksgiving feast and desired to have everything ready before the business meeting which was always held at exactly five o'clock should be called to order. To understand the situation it will be necessary to go back a few weeks to an August evening in the McIntyre home. A rainy evening which the McIntyre's mother and son were spending in what they called the small house under circumstances that were rather depressing. They had spent most of the summer at a quiet seaside resort and being in town for a few days preparatory to a western trip they had come down to the small house that had been closed all summer to look after certain matters demanding attention their plan had been to return to town by the evening train but they discovered it to be necessary to spend the night and wait for daylight to complete some of their tasks the rooms in which they were thus compelled to spend the evening were not in spiriting much of the furniture was shrouded in pale gray dresses and looked in the dim light like ghosts of pleasant hours that were gone standing solemnly about in the great quiet rooms the rain beat steadily against the windows making it necessary to keep them closed and so adding to the general sense of discomfort Mr. Earl McIntyre wandered blisslessly about trying to find something to interest him he knew there was a letter from the west awaiting him at home and he wanted it the knowledge that he could not have it until the next day increased his sense of dreariness and general discomfort it is strange he said to his mother what a difference little things make in a home this room hasn't been changed much since last fall and yet it doesn't look like the same place his mother smiled sympathetically she understood better than he did what he missed from the room she began to talk to him about the people and the church their interest in which dated back to his childhood mrs. Evans is rather troubled about the church debt she told him they haven't been able to reduce it at all this year and now the holder of the mortgage wants his money they are almost afraid of a foreclosure though of course that will not be allowed i thought they ate and drank that debt up long ago said her son listlessly oh no they only ate at it but they haven't even done that this year they are afraid to launch out without mrs. john potter's help mrs potter with a start and a sudden accession of interest is she dead oh no indeed she is very much alive and is engaged in being a woman of her word she laughed over the remembrance of the curious trouble as it had been detailed to her that afternoon and gave her son a graphic account of the assessment and its results i don't know when i have laughed so heartily she said as i did when mrs. Evans was telling me about the letter mrs potter wrote to the ladies it sounded so exactly like her she is a very bright capable woman it seems a pity that she should spoil her usefulness and happiness by this dreadful streak of obstinacy doesn't it the young man laughed in an absent-minded way shows spirit he said is the face of the dead just a thousand then after a few minutes of silence mother wasn't mrs potter the moving spirit in that plan to send for ester and her mother indeed she was she dreamt the entire afternoon to accomplish it think how thoroughly interested she was in missions then and yet she will not give up the stand she took about that fifty dollars even to help the missionary society that is principle i suppose she thinks her son said with an amused laugh after that he relapsed into a silence so thoughtful that his mother forbore to disturb it end of chapter 29 recording by trisha g chapter 30 of ester reed's namesake this liber box recording is in the public domain ester reed's namesake by pansy chapter 30 something portentious was about to happen on the morning following mr mackentire's visit with his mother during which he learned certain interesting particulars about the 10th street church debt this is john potter had a collar no less a personage than professor mackentire as she was always careful to call him he came before her breakfast dishes were well out of the way and flurried that excellent woman not a little she had a very slight acquaintance with this great man and stood fully as much in awe of him as she did of anybody which however is not saying a great deal she found him very genial and friendly interested in her fall flowers which he compared favorably with his mother's and he offered to send her from town a new variety of dahlia in less than five minutes she was quiet at her ease and enjoying the call by the way he said with a sudden change of subject i wonder if you can keep a secret isn't it generally supposed that ladies cannot i don't know about other people said mrs potter but i know that i can do what i say i will i am a woman of my word so i have understood at this point mr mackentire passed his hands skillfully over his mustache to suppress a smile and hurried on the fact is i want to secure your help in a little matter and i must first tell you that i am about to be married mrs potter gave a little start of surprise and her face expressed the keenest interest this was a very rare secret indeed to be entrusted to her keeping more than one member of the lady's aid had been heard to say that she did not believe earl mackentire would ever marry and it happens continued her collar that the lady i am to marry is especially interested in you mercy me said mrs john potter in a flutter of excitement is it somebody i know to herself she was saying good land i hope it isn't that yellow haired girl who was with them a year ago last june she might have a reason for remembering me i know i turned around to her one night in meeting and asked her if she didn't think she could keep from whispering just through prayer time and we wouldn't mind about the sermon i do hope she isn't the one meantime she was hearing every word that mr mackentire said and because of this interest not only in you but in the church which you represent she would like to offer through you in honor of our marriage day a little gift toward the paying of that church debt in which we know you are peculiarly interested the day is set for the 9th of october which is a sort of anniversary day with us mrs potter carried on her mental comments it's the very day the randle girl and her mother came to the missionary meeting i remember it because it was john's birthday now mrs potter may i ask you to receive the gift for me and hold it until the 9th of october presenting it to your lady's aid on that day as a souvenir of the occasion what a delightful commission but mrs potter must be honest though the opportunity of her life was lost i am not their treasurer anymore she said sadly so i have understood but i do not care to ask any other person to serve us and as i am compelled to leave town this morning i thought if i might put this little matter in your hands to attend to at the right moment it would be an accommodation mrs potter thought swiftly i guess i can pass on a little money to them even if i'm not their secretary she told herself sternly any honest woman could do that without affecting her word i'll do it she said briefly in the tone that one might have used if he were saying i'll do it though my life should be the forfeit mr mackentire drew out his pocketbook i have made it in the form of a check mrs potter payable to your order if you will kindly hold it and the secret i mentioned until the ninth day of october and then arrange its payment in any manner that best suits you mrs mackentire electon myself will be most grateful to you my goodness said mrs john potter as she stood check in hand at the front window and watched her collar making rapid strides toward the station i was that flurried and bewildered that i never asked him who the lady was nor why she had any interest in me well well i wouldn't have thought that i could be such a goose it can't be that yellow haired girl she wouldn't want me to handle any of her money i wonder what this check is they're rich those mackentires i shouldn't wonder a bit if it was a good fifty dollars same as we made at the supper wouldn't that be great now if it should be the exact sum i guess those ladies that voted it would feel cheap then as she thought these excited thoughts she opened with eager hands to fold a check you could have knocked me down with a feather was her description of it when on the ninth day of october soon after five o'clock she was able to tell the story but at the moment all she said in almost frightened gasps was my goodness gracious and now it is time to return to mrs john potter's large old-fashioned parlor and watch the busy needles and listen to the busy tongues i wonder if mrs potter isn't about ready to come in said the president it is almost five o'clock what do you suppose is going to happen asked another pausing in her work to make her words more impressive i never was so surprised in my life as when i heard mr evans read that notice from the pulpit asking us here i didn't believe she would ever do it well said one of the gardener girls i was never so surprised in my life as i was when we received professor macintyre's wedding cards mary and i noticed last year that he was very polite to that girl but they were his mother's guests and he is polite to everybody i never saw a more polite young man in all my life than professor macintyre never i guess nobody else ever did said little mrs hunt i couldn't help but notice him one day last spring when that sarah barnes was sewing there a plain homely girl without any style of any kind and as freckled as she can be in the bargain and if he didn't hold open the gate for her and lift his hat as she walked out of it as though she was a queen although the wedding which they all knew was in progress that day had been discussed in all its bearings until one would have supposed that there was nothing left to be said no matter what subject was under discussion they presently returned to it with renewed vigor i suppose the ceremony is over by this time said mrs stillman glancing at the clock and she's mrs earle macintyre forever and always i wonder how she feels i'm glad they have such a nice day for the wedding but then land it may rain cats and dogs out there they say it is more than a thousand miles from here i guess it is nearer two thousand said one of the gardener girls doesn't it seem just like a storybook her coming away out here in search of him as one may say though of course she didn't think of such a thing she was a sweet pretty modest girl i liked her looks the first time i set eyes on her and i saw her that first evening when professor macintyre brought her into church it's my belief that he was struck with her from the first minute if you think of it he always had her with him he is downright in love with her i'm sure of that mrs baker says we ought to see the suite of rooms he has had furnished all new for her in the big house she said if two or three of us wanted to come in before the folks get back she'd show them to us and that reminds me how nice she is going to have it all around do you remember that professor langham who was down here with the macintyre's last spring it seems he's married a college friend of hers of mrs baker do you mean interposed one of the good women who liked to have pronouns and antecedents in their places the gardener girl gave her an annoyed glance and said of course not professor langham as i was saying has married a college friend of miss randals or else he's going to i don't know which the most intimate friend she had in college mrs baker said and she used to know professor langham too he is from that college where she graduated you know so i suppose that will make it pleasanter yet and he is fixing up rooms just around the corner from the macintyre's they aren't much like the macintyre's rooms mrs baker said but real nice and cozy so she won't be all together among strangers as one may say though of course when her husband is at home she won't feel any call to be lonesome i do think he is the very nicest young man that was ever made and i must say i'm real glad she has got him she seemed to think the world of her father and mother and now she can do for them he'll do for them said the member who was an intimate friend of the housekeeper at the macintyre's big house she had bided her time knowing that she had a delicious budget of news for them i don't suppose you have heard what a surprise he gave them did you well i have i was in town yesterday and i got an hour to run in and see mrs baker and she told me all about it he got it up for her father and mother the girl knew about it and helped keep it secret i tell you he did it up in fine style but what was it said two voices at once and nearly all the needles waited why he took the two grandmothers and the three aunts along with his folks out to the wedding paid all the bills and took the sunset limited vestibule parlor car buffet and all the other things train wasn't that a thing worth doing it seems none of them have ever been out there and he made up his mind they should all have a good time together it must be nice to be able to do things like that well they can afford it said mrs jacob smith beginning to sew mr smith was saying last night that mr warren macintyre was one of the richest men in the city and growing richer every day and the professor is his only child that girl has certainly done well for herself and all her folks probably she'll never have to cut up her petticoat again to make shirts for anybody i guess and i for one am real glad that ladies interrupted the president of the ladies aid it is exactly five o'clock and we must come to order it once for business it was at that moment that mrs john potter entered the room and those who glanced at her face felt a kind of delicious ah steal over them something portentious was about to happen the first formalities were passed over with commendable speed and the president announced that their former beloved and honored treasurer mrs john potter had a communication to make then mrs potter arose shook out the folds of her handsome black dress and began ladies of the 10th street church i need not say that i am glad to see you all here today and i am sure no one but myself can know how glad i am to be counted once more among you you have been so good as to tell me a number of times that you missed me but i know you can't have missed me as much as i have you i need not go over in detail the circumstances that have served to keep us apart you all understand them you remember that i said i could not meet with you as a worker again until the sum of three dollars and sixty five cents placed in the bank subject to my call had increased to the sum of one thousand dollars i suppose you thought that was a wild and foolish statement and it was i am free to confess that it would have been more sensible in me a good deal to have worked right along with you and on my best instead of fixing myself so that being a woman of my word i couldn't ever expect the chance of being counted with you again but the lord is often better to us than we deserve to me anyhow and i'm about ready to believe that the age of miracles isn't passed at all ladies something a good deal like a miracle has taken place that lonesome little three dollars and sixty five cents that i've taken care of so long has sprouted and spread itself beyond all bounds in this tin box which i hold in my hand there are some gold pieces each one of them worth twenty dollars look there is one of them do you take it in twenty dollars in gold and it belongs to the ladies aid of the tenth street church to be used toward paying off the debt well how many of them are there do you say two five ten how large is your faith ladies there are fifty twenty dollar gold pieces in this box one thousand dollars in gold ladies i have the greatest pleasure of telling you that this wonderful gift is from mrs. earle mackentire in honor of her wedding and anniversary day it is just a year today you remember since we had the pleasure of looking at her for the first time and she has chosen to mark the event in this blessed way and give me a chance to share in the joy mrs. potter stopped abruptly for her voice grew too husky to proceed and the president of the ladies aid had at that moment an inspiration now she said gleefully we can have our treasurer once more all in favor of electing mrs. john potter treasurer of the ladies aid please rise in a twinkling every woman was on her feet some were laughing and exclaiming one or two were wiping away the tears they loved their church these women and the debt had hung like a millstone about their necks for years and years and they all liked mrs. john potter and had missed and mourned her they gathered about her and shook hands and congratulated themselves and her and were all but overwhelmed with joy it was the president again who kept a cool head and called them to order ladies she said tapping with her silver thimble on the table we have almost lost our wits with joy and no wonder with mrs. potter's permission we will in a few minutes adjourn to the dining room for supper and wait until we are calmer before we transact any more business but before that let us all join hands and bow our heads and say as a prayer thank god for mrs. earle mackentire and mrs. john potter and this they did while down the cheeks of the strong-minded woman of her word rolled on molested great shining tears of joy end of chapter 30 recording by trisha g end of ester reed's namesake by pansy


Yeah. I wanted to attack them. You know that's that's when the plan was to attack them. They hit a couple of balls very well.  You know Aaron Boone mentioned that you started incorporating that slider especially third time through the order using the change up a little bit as well. How much did those pitches help you late in the game. And what made you go to those pitches. The manager mentioned that he noticed that in the third round against Laino they started to use your slider. They started to incorporate your change. How was that. Why. Where did the idea of using that launch to the third time that you're facing Laino. Well you know I trust a lot in those two pitches. You know they're two key pitches apart from the curve. And I was trying to change the vision of the pitch. Yeah. Those two pitches like you mentioned this later in the change up two pitches that I have a lot of confidence in. And it's a while it was about changing their eye level. The third time around showing that I can execute those pitches. I really like those pitches. You know I enjoy using them. And like I said key pitches you know for me to get out. It looked like you were looking at your hand a little bit when you came out that final inning. Are you OK. Is anything going on with your with your finger. Not I'm OK. When you get out of the training you look at your hand several times. It's OK. Nothing happened. Yes. That happened because in the sixth inning in seventh like the culture of the ball I was rubbing myself a little bit with my finger. And that's how it never happens to me. Yeah. I guess I was putting a lot of pressure on the seam on the when I executed my fastball tonight. So just a little burnt you know seam burnt on the on the finger. But not a problem. Not an issue at all. show at all. Next one goes to Eric Boland. David just about everyone around this team talked about how desperate you guys were for a win. What do you like about that kind of pressure. Mucha gente ha hablado de lo mucho que se necesitaba una victoria. Se se se anhelaba esa victoria. Que tu como fue eso sea esa idea de que se necesitaba ganar y como pudiste manejar eso. Bueno tu sabes que yo desde que llegué al etàlio me mantuve positivo. Me mantuve con esa mentalidad de que sí que yo me voy a ganar. Lo más importante que tenía en mente era era dar ese chance al equipo de que podamos ganar de que el groupen pueda pueda de cansar más y gracias a Dios pude puede hacer un ajuste con eso y hace un buen trabajo y dar ese chance que quise. You know I started early today. You know from the moment I got here then I believed that we were going to win and I just wanted to do my job. I wanted to go as deep as I could in the game and allow the bullpen to rest you know and help out you know do my job as long as I could out there. Did you feel pressure at all. Sentí depresión alguna en lanzar en el día de hoy. No no no. Yo siempre lo tomo eso como como un punto bueno porque eso es lo que a mí me gusta.  No no pressure and reason behind it is because I enjoy the competition. You know tough game tough opponent. You know that's what I enjoy. I enjoy a good competition. Thank you. Next one.


Welcome to Sheboygan County Government, working for you. I'm Adam Payne, Sheboygan County Administrator and host of this program, and today we're very pleased to have Jim Holbert with us, our Planning Director. Jim, welcome. Thanks, Adam. I'm very pleased to be here. Jim, believe it or not, has been with Sheboygan County now going on three years and we were just saying off air how quickly the time flies. Jim, please begin by sharing a little bit about yourself and your background. I've been doing this kind of work for, gosh, more than 30 years, believe it or not. I find that kind of difficult to believe. I started out actually teaching environmental science in high school, but then I got a fellowship to attend graduate school and environmental studies and took advantage of that. And after that I worked for the Minnesota Pollution Control Agency directing statewide industrial solid and hazardous waste programs. I've also worked as a Planning Director for two other Wisconsin counties, and the duties were somewhat similar as they are here. The major differences were we also had comprehensive county zoning so we were also involved in just about every land use decision. We were also heavily involved in recycling and solid waste issues and hazardous waste issues as well. I've also worked for the Aveda Corporation and directed Global Environmental and Sustainability Affairs for that very large company. I've also operated my own environmental consulting firm for a number of years, and I managed a small environmental consulting firm on the island of Guam, and from there we did work all over the South Pacific. And weather-wise it's quite a bit different than here, but I enjoy being here as well. As you know, Jim, one of the many things that I really appreciate about you is the tremendous breadth of experience that you bring to the position. As soon as you walked in the door, you hit the ground running, you continue to make wonderful things happen for Sheboygan County, and as you think about your breadth of experience in the different places you've worked and the challenges you've tackled, as a relative newcomer to Sheboygan County, what's your impression of our Planning Department? What's your impression of Sheboygan County? Well, first of all, the reason I took the job was because of you, partially, and then also the wonderful staff. We have a great staff. I think the taxpayers benefit from a very dedicated, highly motivated, and excellent staff in the department. Sheboygan County itself is a fantastic place to live and to work. It's beautiful. It has a variety of, you know, recreational pursuits. We've got Lake Michigan, the Kettle Moraines, Sheboygan Marsh, Colerandre State Park, and a lot of other wonderful facilities. John Michael Koehler Art Center. The list just goes on and on. So Sheboygan is, in fact, a wonderful place, and that's one of the reasons why I took the job. Well, it's a good day of the year. I hope it continues for some time to come. When you think about the Planning Department and as you said, you've got some excellent staff to work with, please share a high-end overview of what the primary roles and responsibilities are of your staff. Well, we've got two planning technicians, a land use planner, and the land use planner is involved in the smart growth planning process that's mandated by the State of Wisconsin. And we have two zoning administrators, and they're involved in Shoreland floodplain and wetland zoning. We have a code administrator, and the code administrator is kind of, I guess you could say, the lead person in those zoning issues. We have a non-motorized transportation component. We have three people working in non-motorized transportation effort. That's a $25 million grant that we were lucky enough to get from Congress. We have an assistant planning director and two mapping technicians, two mapping people with our geographic information system. Again, these are all highly skilled people and do a great job. So a total number of... Oh, I'm not sure. It looks like about 15 people, perhaps something like that. Give or take. Give or take a few, and I hope I didn't forget anybody. Well, as you said, you have an outstanding staff, and I know you've done some comparison to other counties with similar responsibilities and similar population bases. And if I recall, our staff is actually a little leaner than many out there. Yeah, for the population size of the county and the scope of work that we do, we actually are managed to do quite well with a fewer number of staff. The reason we do news for taxpayers is because we do, I think, an excellent job. In fact, a better job than some other counties who look to us as a model at far less cost. Now you touched on some of the programs and services that the planning department is responsible for, but you in particular have really gotten involved with some exciting initiatives, ventures. Please touch on that. Sure. One of the first things I got involved in was the plans to construct the observation tower of the Marsh, and I'm very pleased to announce that we are under construction, and we should be having an opening ceremony by the middle of November, and maybe a bigger dedication in the spring. So that was an exciting effort. I've also been involved in the Amsterdam Dunes Project. That was an attempt to acquire and preserve about 325 acres of some really good lands and very unusual habitats. Unfortunately, we didn't get the grants that we had hoped for for that project. I'm still working on that, so I'm keeping my fingers crossed that'll be successful. The county had tried three previous times to get a smart growth grant, and for one reason or another, the state didn't see fit to award us the money, and so we tried again, and we did get the smart growth grant, about $238,000 that will enable the county to undertake this mandated program. I also get involved in just about everything else that the staff do. Another project that I've recently got involved in, thanks to your encouragement, I guess you could say, would be the dredging of the Chewbacca River, and that's an excellent project with, I think, profound environmental and ecological impacts, and I think we can accomplish a lot through that. Hazardous waste, I guess we, in the last three years, have greatly increased that program, and we have far more participants. We collect far more hazardous waste now than we used to. We also instituted in partnership with Healthy Chewbacca in 2010, and the Chewbacca Police Department, and other law enforcement and medical folks, a wonderful waste medication collection project. And I mean this with all sincerity. I have 22 department heads that I have as you were working with, 22 departments with vast roles and responsibilities, but when it comes to the team that we have in place, of course I want people that are making good things happen, or striving to stir the pot and improve our community, and Jim, I can't thank you enough for the many things you have been involved in, and I'd like to take these one by one a little bit. Starting back with the tower. As you know, I participate on the Friends of the Marsh as does Keith Obbler, County Board Supervisor Keith Obbler, as does the Board Supervisor Jim Baumgart. Lil Pipping is the chair of that. She does a wonderful job, but your interest, and your enthusiasm for it, and your staff certainly have contributed to this. As you said, construction's underway. Give our viewers a little bit more of a flavor of the Chewbacca Marsh, and just why this is going to be so spectacular.  I guess I'm still amazed at the gem that the Chewbacca Marsh really is. 14,000 acres, and I think it's taken for granted by the people who live here. But it's very unique ecologically, culturally, the historic aspects, the paleontology, the archeology. It's a fabulous place. And so the tower will bring more visitors to the Marsh, and we have other plans after the tower is constructed to further increase the number of visitors. And it's also highly used by environmental education classes. On average, we may get more than 3,000 children there in the summer to study outdoor recreation and environmental education. We would like to make that a lot higher. Maybe get 4,000 or 5,000 children here. And also adults. And so we'd like to partner with universities and other academic institutions, other environmental learning centers like Maywood and Camp Waikota and many others to actually increase the awareness of the Marsh. So the tower will bring more people on. And I think one of the coolest aspects of the tower is that we're also going to have a video camera. In fact, two cameras on the top. One will be for handicapped people that may be a little intimidated from climbing up 80 feet of the tower. They'll be able to sit at the Marsh lodge and actually observe the tower in the comfort of the restaurant. The other thing would be a webcam. We also have plans, as you know, to put a webcam on top of the tower. And so that means maybe a Sheboygan county resident might be visiting China and plans to come back to Sheboygan and Duck Hunt and the Marsh. And that person then can log on and check out the Marsh from afar. And of course, educational value for school children who might want to go online at school without even having to go out there that day. Good point. Excellent. Right. It's going to be the tallest wooden tower in the state of Wisconsin. And if people are interested in this, obviously they can go out to the Sheboygan Marsh and take a look at it as it's being constructed. But if they want to make a contribution, as you well know we've done this by raising donations throughout the county. I think about 300,000 now. And if folks want to contribute, how do they get more information? Well, first of all, we'd encourage more contributions because thanks to Joseph Schmidt and son's construction they have undertaken the construction of this even though we may not have quite enough money to finish. And so further donations are encouraged. And for donations $1,000 would bring you notice on a step for $50 to $100 you could get a brick beneath the tower you could have your name or any saying or commemoration you might wish. And then also for the educational components of what we'd like to start accomplishing or I should say further at the marsh I think those donations will go a long way for that. Nice overview. Another area you've been very active in your department providing leadership with the non-motorized program trail enhancement development throughout Sheboygan County. I know we both take pride in the residents of this community do of the Old Plank Road Trail which was established many years ago. But as you of late have pointed out to your resources committee and others in the community it takes money to keep these trails maintained and enhance them. Please tell us a little bit about the Old Plank Road Trail and some of the concerns you have about making sure that we keep these trails available for not only our residents but tourists. The Old Plank Road Trail is another gem I mean that's a pioneering effort in Wisconsin. Planning for that started gosh I think at least 30 years ago construction maybe 25 years ago and it truly is a multi-use path, multi-use trail. We have users year on from the snowmobile folks in the winter maybe four to five thousand snowmobile trips bicyclists and pedestrian and moped riders in the warm weather and that's approximately 34 to 35,000 user trips. We also have horseback riders horse drawn carriages segues. So it truly makes it a multi-use trail. The presence of mopeds makes it unique in Wisconsin that we also have mopeds from a long heritage of use on the Old Plank Road Trail. Unfortunately when the Old Plank Road Trail was constructed as a cautious savings measure it wasn't constructed necessarily the way it should be in other words the proper gravel base allegedly was not installed and also we found that some of the trees and the brush that was cut was buried where the asphalt is now located. As a result this material rots and decomposes and subsides and so we have issues with some of the pavement cracking and we have sink holds, we have washouts and long-term maintenance of these facilities is something that's commonly overlooked that costs an awful lot of money. And so we're in a difficult situation where the county board is very supportive but because of all the other priorities we have a limited amount of money that has to go a long way. That money doesn't begin to cover the maintenance needs of just the Old Plank Road Trail in itself. We've tried to raise funds through grants and I've been successful in getting some grant funding through the DNR Stewardship Program. The county board also has helped with the financing through some bond money but we're still a long ways away and so one of the things that we would like to do is like many other counties and indeed like the entire state of Wisconsin does and their bicycle trail ways is to adopt a very modest user fee to help pay for maintenance not only on the Old Plank Road Trail but our boat landings, the March Lodge and other fine recreational facilities that we have. What kind of response have you received from the Planning and Resources Committee for Sheboygan County on the proposed fee? No that's a really good question and a good point. I have nothing but admiration and pride and satisfaction in working with our Planning and Resources Committee. These are dedicated people. They're very knowledgeable, very helpful. They spend a great deal of time. In fact when people are newly appointed to the Planning Committee they're amazed at how much time it takes and how many things were involved in and how we interact with the public in a wide variety of issues. So the Planning and Resources Committee are very supportive. In fact they consider these fees as absolutely critical and mandatory for the future of our recreation facilities. If we don't have user fees the only other option would be to increase property taxes even more. Our citizens tell us they don't want to pay any more in property taxes and in fact as we all know Sheboygan County can take a great deal of pride in your efforts and the county board efforts to not only keep our taxes low but actually to reduce them and I think that's admirable. But at the same time then that creates problems and funding programs like discretionary recreation programs where 100% of the taxpayers pay for these facilities but only 20 to 30% of the population uses them and so that's why we think having some sort of a modest user fee to help pay for these programs for the people that actually use them is a fair proposition. And I know you've been feeling a lot of questions on this and have had open discussions about this and anytime you talk about raising taxes or raising a fee it's controversial but what I've been very pleased with is if you take the time to study it and look at the situation and the long term goal of having a wonderful rec trail for future generations to also be able to use money that doesn't grow on trees and that financial support needs to come somewhere and I think you've laid out a real fair proposal and as you mentioned the planning and resources committee is behind it. Ultimately we'll see if the full county board supports it here in the near future. Right and if we don't get support then we have to come up with other options or we don't do the maintenance to the level that we would like. As you know we've also recently extended the interurban trail and I just got complained a couple days ago that we're starting to have maintenance issues on the older portion of the interurban trail that was constructed four or five years ago. All of a sudden now we've got willow trees that are sending shoots under the asphalt and they're breaking the asphalt coming up in the middle of the trail and again these things cost money to repair and last year because of heavy rains we had a washout of the interurban trail. Again that takes money that's an unexpected event so you never know when something happens that's going to take money that we don't have in our budget. Another area you've been very active in providing some excellent leadership is hazardous waste collection and we've had a program for a number of years there. You've really brought some new juice to it and I think help gotten the word out why it's so important to get this hazardous waste cleaned up and properly dealt with. How does the program work and what kind of response have you received? Well the response is overwhelming. Last Saturday October 10th for example in Plymouth we normally get 40 to 60 vehicles participating on a 30 cold October Saturday morning. We actually had 250 participants last time. Cars, trucks, pickup trucks, rental trucks trailers.  We were told by 9 o'clock in the morning we were already over budget and it lasted until afternoon so we collected a large amount of materials. Quite frankly because you know we have a limited budget and thankfully the county board increased that last year to $100,000 but we were already near or at the end of that budget and so we didn't even advertise the October event much. And even though we didn't advertise it much we still got a far greater response rate than that was anticipated. We partner with Veolia Special Services. They do a wonderful job and our biggest cleanup, our biggest hazardous waste collection is always in May. We're always in two different places and in 2010 it'll be May 14th and 15th we do get state money. Again we were successful in getting some state grants to help us with that. We formed, we're part of a regional multi-county hazardous waste informal working group I guess you could say. That's Manitowoc, Caliment, Fond du Lac and Sheboygan and because of our partnership we're very successful in getting grants. And some of our viewers may have heard you just say $100,000. We're spending $100,000 a year on hazardous waste collection. You know that may blow some people away but put that in perspective a little bit. If we don't have this program, if these contaminants are not collected and please give some examples of what you are collecting, what could the cost otherwise be? The cost of just one spill could far exceed the cost of collection and disposal. It's surprising some people are dumbfounded when they realize we're still collecting DDT. Even though DDT was banned in the mid 70's people still find that in their barns or their buildings on their farms or whatever. Every once in a while we still find very old formulations of arsenical pesticides that we use during the depression. So we're talking about arsenic and DDT and some other fairly dangerous things. And again we're blessed with our waterways, our rivers, our ponds our lakes, indeed Lake Michigan. And if some of this material was improperly disposed of or spilled or dumped along a roadside we'd have a very profound environmental catastrophe that would cost us hundreds of thousands if not maybe millions to clean up. And so yes 100,000 might sound like a lot of money. But Wisconsin does not have a hazardous waste landfill. Wisconsin does not have any dedicated hazardous waste disposal facilities. So we have to go out of state. Most of our stuff goes to Port Arthur Texas for incineration. We've also from time to time used the incinerator in Sauget, Illinois, or landfill in Alabama. So our disposal options are extremely limited. Again people are surprised to learn that it might cost more per gallon to get rid of a gallon of lead based paint than it costs to purchase it. It costs us 20 to 25 dollars a gallon to get rid of a gallon of paint. This is a great segue for something I wanted to spend a little time on the few minutes we have remaining and that is the Shaboygan River and the cleanup that's been discussed for 25 years or better. Talk about contaminants and cost. Please set the stage for us a little bit. What's the latest with cleaning up the Shaboygan River in the harbor area? Well it's a background back in the mid to late 1970s it was discovered that PCBs polychlorinated biphenyls were found in the sediments of the river, among other things like heavy metals and PAHs, poly aromatic hydrocarbons. And these things are very dangerous in aquatic environments. They build up in fish tissues anything that eats the fish could have profound health impacts, wildlife or humans. As a result there's a fish consumption advisory. We're not supposed to eat the fish in the Shaboygan River, especially children and pregnant women. PCBs are like DDT, they're persistent, they're not found in nature, they're only man-made chemicals so there's nothing in nature to break them down. For 25 years there's been different plans, different ways of thinking on how to get the contaminated sediments out of the river. During the last year or two they've been successful in cleaning up some of the, or most of the contaminated sediments in the upper river and now we've got the lower river in the harbor. And so we are partnering, we're actually helping the city of Shaboygan and the contractor and many other people involved to finally get rid of this contaminated sediment. We're working under two programs that are funded and taken care of by the US EPA in Chicago. One is the Superfund program and they're looking at taking away maybe the top two feet of contaminated soil. Another program is called the Legacy Act and if we're successful in writing a grant they will be able to, under this program, hopefully go on another 12 or 14 feet of sediment in the harbor. We also have to find a place to put that sediment. The really contaminated sediment over 50 parts per million of PCB is taken to Michigan as a hazardous waste. Anything under 50 parts per million isn't considered hazardous although it's still a concern environmentally. But we're looking at different options to economically and environmentally safely dispose of it within Shaboygan County and we would go way overboard in engineering and design and monitoring and pollution risk liability for any sediments left in Shaboygan County. And these contaminated sediments act far differently in terrestrial environments than they do in aquatic environments. And when you say that in late person language, my understanding is the PCBs will, they actually join up with the soil. That's correct. These very fine sediments clay particles or the silt particles the PCBs adhere or it's called attenuation they adhere to these very fine soil particles by electronic charges and it doesn't move through the water column like other pollutants might. The only way PCBs will leave the contaminated sediments when they're in a disposal cell would be if for some reason we would get very strong acids or alcohols or something like that involved that may be possible in a dedicated landfill but certainly not at all probable in a facility that would be constructed only for the safe disposal of sediments. And again if we are successful in locating a sediment disposal area in Shaboygan County we would require very long term monitoring pollution risk abatement insurance just in case there's any sort of pollution any sort of problem it would be immediately cleaned up with a guaranteed pot of money furthermore we would not only have monitoring wells which others don't even find necessary, we would also install what are called lysimeters and these are devices that would actually determine or detect any pollution from the bottom of any deposed sediment before it even got into the groundwater and so we would go far more and require greater guarantees to protect the environment and the neighbors than I think any other site for low contaminated PCB cells. And as we're both aware if we're able to do that within Shaboygan County we could literally save millions of dollars that could go back into the cleanup and the local match that we have to have. So for over 25 years sadly the Indians had the designation of being a super fund site with a contaminated river that no doubt does not contribute to economic development nor is it safe for people to eat the fish in those waters. After 25 years we're finally looking at an opportunity and next year we're going to be working together with the city and the DNR and the federal government to get this cleaned up. I mean this is big news and this is fantastic news for Shaboygan County. Yes it is. And you know our sport fishery industry here is very big and you know it's a wonderful great group of people and some folks don't realize that the source of PCB contamination in Great Lakes fish come from rivers like the Shaboygan River and so not only is it important from an environmental perspective but if we can get that river dredged out, get the PCBs out of there then maybe the quark will continue to dredge it like they used to and they stopped doing that in 1968 or 1969. Again when the river depths are restored we can get larger ships, we can get cruise ships, we can get the tall masted sailing vessels economic development potential for the city is greatly increased and the city staff, Paulette Enders, Mayor Ryan and others in the city are doing a great job in leading this effort that we're assisting in. Jim I want to thank you so much for your time today, covered a lot of ground in a short period of time. It really flew and if you're interested in learning more about the activities of the planning department or some of the initiatives that Jim's a very important part of please don't hesitate to contact Jim Holbert again at the Shaboygan County Planning Department. Jim thank you to you and your staff for the very important and good work that you do. Thank you Adam. On behalf of the Shaboygan Board I'm Adam Payne. Thank you for joining us today. We appreciate your time and interest. Next month our new Health and Human Services Director will be here. Tom Eggebrecht, Tom's been doing a great job at Health and Human Services and until then thanks for joining us.


Hi, DevCon. I'm Alvaro Pontester. This is Alex. We both work for the HP45 team, but we have a lot of things to cover today, so enough about us. So last year was the year of Java digitalization apocalypse, as we like to call it. Like literally, dozens or even hundreds of new CVs were reported around Java digitalization. And around those CVs, like thousands of vulnerable applications and appliances, it was like a bad problem. So this was a very well known vector since at least 2011. Probably it was not, so the community was not paying really attention because there was no really good gadget, a really good remote execution gadget until 2015 when the Apache commons collection gadget was published. So this was the same problem with .NET. The theoretical attack was published in 2012 for both binary formatter and the net data contract serializer, but there was no remote execution gadget published until now. So at that time, the solution was like, okay, stop using Java digitalization altogether, and developers were like, well, yeah, I would like to do so, but I need to serialize my objects, store them into a database, or maybe, I don't know, send them across a wire or send them in a socket or whatever. So I need to serialize my objects. And the security guys were like, okay, then use a secure JSON or XML parser or library instead. So our goal with this talk is to fold. First of all, we want to verify if those JSON libraries are any better than Java digitalization or .NET digitalization, and then raise some awareness around .NET digitalization stuff. As we said, Java took like four or five years for the community to start looking into vulnerable endpoints and so on. And we don't want the history to repeat itself, so we will be presenting new remote execution gadgets to attack these serializers. So the first section will focus on JSON. We will present some of the libraries that we found to be vulnerable, gadgets to attack them, and then a demo on a web application framework leading to arbitrary code execution. And then we will focus on the .NET serializers, completely different subject. And then we will try to generate the attack and we will provide some demos as well. So let's jump into the JSON part. So just to set the expectations here, we are not talking about JSON when sending simple data or simple JavaScript objects between a JavaScript front end and a controller like, I don't know, for example, a spring controller. We are talking about replacing Java or .NET serialization with a JSON, which means that you need to serialize Java or .NET objects, which means that you need to support some of the object-oriented programming features like how I'm going to deal with the Java-lang object, how I'm going to deal with a system object in .NET, how I'm going to deal with generic, parameterized types, polymorphism interfaces and so on. So we will be abusing the features that these libraries include to support these OOP staff. Very quick recap on how Java serialization or how the attackers were able to get arbitrary code execution on Java serialization. Basically they were able to provide untrusted data to the serializer, in this case the object input stream in Java. And this untrusted data contains some type, some class names that were instantiated by the serializer. And then some digitalization callbacks like read object or read resolve were invoked. And then the attackers were able to start a gadget chain that is nothing else that connecting different classes together, assembling like a gadget chain leading to arbitrary code execution, but starting from this read object or read resolve at digitalization callbacks. However, JSON does not invoke any of these digitalization callbacks normally or at least some of the most of the libraries. So we need to find some other ways to start a gadget chain leading to this code execution. So most of the JSON libraries will work in, well, we'll try to reconstruct the object in any of these ways. So basically they will invoke the default constructor in order to instantiate the object and allocate the memory and then use either reflection or setters in order to populate the fields and properties of the instance. Some of them will invoke some special constructors or digitalization callbacks or type converters. We don't have time in this talk to cover all of them, but these are also vectors that lead to arbitrary code execution. We have them covered in our white paper that will be published in the DevCon Media server. And then most of these libraries also invoke some common methods like, for example, hash code or AQUAS normally get invoked when digitalizing hash tables to string normally get invoked when raising exceptions. Finally, it's always invoked by the garbage collector when claiming the memory for the objects. But by far the most common one is the setters. Setters are normally invoked by most if not all of the libraries. So if we are able to find arbitrary code execution chains starting with setters, we will be able to use them to attack these libraries. Let's have a look on a few setter gadgets in .NET. All of them can lead to arbitrary code execution. Some of them have own requirements and limitations, but we believe that it's not very difficult to pick up proper one for specific case. So our first gadget is a setter of pass property in assembly installer class. It allows code execution during library loading from pass controlled by an attacker. There is no additional requirements if assembly this payload is on local machine. But in case of remote resources .NET framework may have some additional security checks. The next two gadgets use XAML parser. We will show a bit later how it can be used for arbitrary method invocation. So a setter of property in spectro font and color data in workflow designer type requires single threaded apartment thread. It's quite strong requirement, but if your target has such configuration, you will get remote code execution. The next gadget is source setter of resource dictionary type. It has a few requirements to JSON on marshaler. It should call setters for types that implement IDiction interface. Often in such cases on marshalers are just populating key value pairs. Also it should be able to reconstruct system override object. This type doesn't have a default constructor. But often marshalers can do this. And our final gadget is object data provider type. It's quite flexible and allows a lot of ways to for attack. As a result we were able to use it in almost all our marshalers and formatters. So let's have a look on call diagram of this gadget. Setter will call refresh method. It will invoke begin query. It will call query worker. And finally in invoke method on instance, we can see the line that will call our arbitrary method. Here we can see example of JSON payload that will pop up calculator for unsafe configuration of JSON dot net parser. Actually this gadget allows the next main attack vectors. We can call non default constructor with own arguments or can invoke public method on marshaler object. Or we can call any public method including static ones with our own parameters. Java has own setter gadget as well. After our last year research in JNDI injection attack, we have found a few setters with JNDI lookup calls. By the way Oracle recently disabled Arama and Corba vectors in default configuration of Java. But LDAP vectors still works. So our gadget set session factory JNDI name in statistic service. We already mentioned about this in our last year talk at blackhead 2016. Very similar to it, it's two string gadget from remote client user transaction class. And finally set auto commit gadget from already known class gdbc row set impo. Let's have a look on it. This class is from GRE library so doesn't require any external dependencies. Setter will call connect function. And here we can see that we will call initial context lookup method with our value from data source name property. So we will get remote code execution. Apart from my short gadget that allows code execution by themselves, we have a couple other interesting gadgets. Some of them can be used as building blocks for gadget chain like binding source set data member in dot net or string template to string in Java can be used for arbitrary gather calls. Other can trigger non RCE attacks. For example, inner XML in XML data document or setter of data view setting collection stream in data view manager can be used for XML external entities attack in some version of dot net framework. Now we will back to Alvaro. He will show where we can use these old gadgets. So we analyzed like multiple Java and dot net library and we found that most of them were vulnerable to arbitrary code execution. Some of them in the full configuration and some of them developers need to enable or configure them in a special way. So we came up with these simple high level requirements for library to be vulnerable to this attack. Basically the attacker needs to be able to control the type or the class that is going to be instantiated in the server. That normally means that in the JSON that you are intercepting, for example, there will be an attribute called something like underscore type or dollar type class type object class name that contains a value that looks like a dot net or a Java class name. Then the library will instantiate that type and then the second requirement is that the attacker or well in this case the library needs to invoke some methods on this reconstructed object. And finally the third requirement is that the attacker needs to be able to assembly a remote code execution gadget chain starting from those methods that are invoked by the library. As I said before, setters are normally invoked in most of the libraries. So the gadgets that Alex just presented can be normally used for any library. So we categorize these libraries according to the likelihood of them being vulnerable and for that we choose two different factors. The first one is whether the library includes the type discriminator that is nothing else than the class name in the serialized data like we have seen here, for example, in JSON dot net. And so that can be done like by default by the library or developers may need to enable a configuration setting. And then the second factor is how this library prevent malicious types from being instantiated and loaded. So we found that some of these libraries perform a post-desialization cast which offers no security at all because basically by the time that you get the cast exception the payload has already been executed and you're already being compromised. And the second type control is what we call the inspection of the expected type object graph. Which sounds like a little bit complex but it's nothing else that the library will take the expected type. So for example, a user, the library may be expecting a user or a cart or whatever and then analyzing the object graph and checking if what the user is sending in the JSON data is assignable to the types defined in the object graph. So some libraries go farther and also build a wide list at construction time and apply this list at run time during the digitalization. We found that these libraries, the libraries performing this type control are also vulnerable if the attacker can control the expected type. That is more common that you may think and we will see an example later. And also if the attacker can find an injection point, an entry point in the object graph. So for example, as we can see here in this sample object graph here, all the properties in red may be good examples of entry points. Like for example, a system object property, a non- generic collection property like hash table, a rail list and so on. So again, we don't have time to cover how to find entry points but this is also covered in the white paper. So this is the list of the JSON libraries that we analyzed. The ones in red are vulnerable by default. So fast JSON, sweet JSON, JSON IO and flex JSON should never be used with entrusted data. Basically, they include the type information by default and they perform no type control at all. Then they invoke setters so we can use our setters to get arbitrary code execution. The ones in yellow and orange depends on the developers and how they are using the library. So most of them do not include the type information by default in the JSON data but there is this configuration setting that can be enabled to do exactly that. And then they perform this inspection of the object graph so you need to find an entry point. You may think that finding an application that satisfies both requirements is difficult but it's kind of the opposite because if the developer has a property of, for example, a system object, they will be forced to enable this configuration setting to include the type information and then make this class or this type serializable. So, well, JSON is the only one in green. We found that it's very difficult to make it vulnerable. You can also implement a type adapter and make it vulnerable but I mean, you need to do it like in purpose. And in addition, it does not invoke any setters. It just uses reflection so you need to use or to find gadgets starting, for example, with a finalized method which is more difficult than the setter one. So, let's see some of these examples. For example, FastJSON is one of the ones in red. It should never be used with untrusted data. And basically, yeah, it includes the type information by default. It does not offer any type protection or type control and then it will invoke the setter so we will be able to use, for example, our object data provider gadget to get arbitrary code execution like we did in this Calico CMS that is a .NET content management system. Then we have a JavaScript serializer that is one of the .NET native libraries in the .NET framework. By default, it does not include the type information but developers can do that by passing this simple type resolver or any other type resolver to the constructor of the JavaScript serializer and then desalizing untrusted data. So, by the way, all these examples are from GitHub so this is real code. Basically, this JavaScript serializer does not offer any type control. It performs a post-desalization cast operation so it's vulnerable by default if developers are configuring it with a type resolver. Then we have the data contract JSON serializer that is probably one of the most secure ones. But, well, it performs this assignability check that we talked before but also this creation of a wide list at construction time that is then applied at runtime time. So, with that, the only way an attacker can get arbitrary code execution on this library is if they can control the expected type. Again, this is from GitHub. It's an example of how the type can be controlled by the attacker. In this case, it's coming from a cookie. We will see an example in DNN that is one of the most popular CMS for .NET where they're doing exactly this. Then we have JSON.NET that is probably the most popular library. It's even recommended by Microsoft over their own native libraries. Again, by default, it does not include type information but if developers enable this tape name handling setting, then they will include this information. This is another example from GitHub, as you can see, because it contains this class called message because it contains a body property which is a system object type. Then developers are forced, as I said before, to enable these configuration settings to include the type information. And then the library will invoke setters, serializable constructor, callbacks, and even some onerror custom callbacks. So, basically, the attacker has like a very large gadget space to get arbitrary code execution. So, let's see an example, a demo. This is a web application framework which basically, well, it's not really a web application framework. It's more a data management framework. So, it offers a REST API for both JavaScript and .NET clients to connect to the API and perform like entity management operations like adding a new record, deleting a record, updating a record, and so on. So, we found that this framework was using JSON.NET, which is, as I said, the most popular JSON library for .NET, and it's configured to include the type information when serializing the system object properties. So, at some point, this code here will deserialize untrusted data coming from the request. And then, as you can see here, basically, these safe options type here is the expected type. So, as I said that we have to do this expected type, object graph inspection, which is quite simple in this case because the safe option type only contains two properties. The second one is a name tag and it's a system object property. So, we can, this is our injection point, our entry point to place the payload. So, with that, let's see an example. This is Carbon that is one of the sample applications that come with the framework for developers to learn the framework. And basically, in this example, we can just add new car models or rename the models and so on. So, if we change the name of this model and we intercept the request with verb, we will see that, well, we have all the expected data, like, for example, the new model name is appearing in the JSON data that has been submitted to the REST API, and then we have this empty safe options dictionary. If we send this request to the server, we will see that there is, in the response, there is this dollar type attribute, which is our indicator that this is using JSON.NET and that is including type information. So, that's, those are the ingredients for our arbitrary code execution. We will be using our object data provider gadget basically to invoke the process.start and pop up a calculator when the framework process these requests. So, we will just replace this empty dictionary with the payload and then let's check that in the victim server, there is no calculators running and now as soon as we submit the request, this will get deserialized and we will get arbitrary code execution. So, thank you. So, this is a popular, rather popular framework in .NET and a big set out to the developers because they fixed the issue in just one day. Also, a big set out to Moritz-Betzler, there is a Java security researcher on May 22. He published this Java Marshaler security paper, which basically is similar to our research, serves the same premises and conclusions. Well, he overlaps with our research in the Jackson and JSON I.O. libraries, although for the JSON one, he found like a completely different vector and he also overlaps with us in our JDBC, Roset, Impole class or gadget. But this was like a kind of like obvious choice because it was previously used in the Java desalization world. Also, he found other interesting gadgets for Java in third-party libraries like Spring, so if you are interested in a more Java-focused version of this talk, go and check his work. So, now we will change gears and focus in .NET realizers. Let's back to the .NET world. Potential security problems with binary format and .NET data contract serializer were known for the year. For example, the great work of James Forshu about weaknesses and main attacks in this main .NET format was presented at Black Hat 2012. So, five years ago, unfortunately, we could not find good available remote code execution gadget chain. There was one published by Florian Goldier, but it uses memory corruption, so it's not very easy to build universal exploit for different version of Windows. But we were sure that there should be a lot of ways to get code execution during .NET desalization. So, we spent some of our time and have found one that can be used in binary format and some other .NET format. But after our work was ready and acceptable Black Hat, the same James Forshu published a couple remote code execution gadget as part of his own research. By the way, not connected with our topic. Anyway, you can find details about this gadget on his post on Google Project ZeroBlock. Here we will focus on our own. We will use PS object type. It is part of PowerShell libraries, so should be available in almost all Windows machine. Before we go further, there are a couple remarks about this gadget. In PowerShell version one, this type is not serializable, so is not suitable for attack. But all modern version of Windows, starting from Windows 8 and Windows Server 2012 are shipped with newer and vulnerable version. The next remark, we reported this issue to Microsoft and two weeks ago, they released a fix. So if you are not ignoring their updates, you should be safe. So PS object. For the serialization, it uses custom serializer. And in case of TIM instance, it will call TIRegidrate, TIM instance property method. Here we can see that attacker is able to specify own type as element type of array. And serializer, we try to reconstruct object of this type. To find proper way to do this, it will use figure conversion method. It's quite interesting method for an attacker, as there are a lot of options for the attack. We highlighted only the most obvious one. So we can call non-default constructor with one argument and we can control its value. Also we can invoke setters on public properties, so we can use our gadgets, earlier gadgets. And also we can use static parse method of arbitrary type. Let's try to use this one. Sorry. As we said earlier, some reader parse can be used for arbitrary method invocation. Here we can see examples of payload that will call process and start with our argument. Here we can notice namespace, assembly, type, method name and finally calc as an argument. Along with mentioned binary and net data contracts, serializer formators.net offers a lot of others. Unfortunately, we don't have enough time for detailed review of each of them, so we will briefly cover them in our today talk. And if you're interested in deeper analysis, we can offer outweighed paper as good source. So we can group them into big group. Formatter, there are vulnerable interval configuration like binary formator, sub formator, net data contracts serializer. Also we can add here formator that internally use them. Like object state formator, loss formator, binary message formator. They should not be used with untrusted data. Or you have to proper configure them to limit available types. For example, use restricted type resolver with wide list of the types. Other group formators that are safe in default configuration like XML serializer, data contract serializer, data contract JSON serializer. But if you are using quick data contract resolver, by the way, we have met such examples even on official Microsoft documentation. Or attacker is able to control expected type. You will have very serious security problem. We will show a bit later that in this case code execution is real even for the most limited formators. For example, XML serializer. Now we will switch back to Alvaro. He will show our next demo. So because demo is probably worth a thousand slides, we will show you how to get arbitrary code execution on some .NET framework. In this case, NENSI, that is a web application framework that is very similar to the Ruby's Sinatra framework, but for .NET. And well, basically they care about security, which is good. And they implemented CISARF protection. The only thing is that by protecting against CISARF, they opened the doors for remote code execution. But yeah. So instead of putting this unique token into the cookie like most of the frameworks do, they created a type called CISARF instance where they put this token and then they serialized this instance of CISARF token and then they basically foreign code the payload into the cookie into the cookie. Anyway, if you find this A, A, E, A, A, D magic number in any of your pen tests, then you will be able to get arbitrary code execution. So let's see that in action in one application. So this is an application we build using NC. And we were able to get arbitrary code execution, pre-authentication, by basically replacing the cookie. So this is the cookie that the framework injects, the N-CISARF cookie. As you can see, it contains this magic number and then this base 64 encoded block. If we check the page, they also include the same value as a hidden field in the form. So they are doing like a double submission, which is good. But since they are using binary format serialization, then it's not that good. Anyway, we serialize our PS object gadget in order to pop up a calculator with the calculator payload.  You can use our payload or any of James Forso published payload. And now if we go back to the server, there are no calculators running. And as soon as we submit the form, we will get an exception, but we will get our payload executed. Thank you. So, um, we just wanted to highlight that this is not really a problem in JSON or XML parsers or, I don't know, Java digitalization or the binary formatted for .NET. This is a problem in serializers themselves because all of them need to reconstruct the objects during the digitalization process. And that means instantiating types that normally can be controlled by attackers and then invoking methods. So, as we said before, these simple three high-level requirements like the attacker being able to control the type, then the, um, some methods being called on this reconstructed type. And then a large enough gadget space for the attacker to find, um, arbitrary code execution gadget chain will normally apply to any serializer or any language. As we said before, most of the times, the setters will be invoked. So, the gadget that we presented here today, the object data provider gadget and the JDBC Rossell Imple gadget will normally be good gadgets to attack any other libraries. So, um, we found like many other libraries being vulnerable or being, uh, as susceptible to arbitrary code execution, um, but we don't have space in the slide or time to cover all of them. So, these are good examples of them. For example, FS Pickler or self-serializer are .NET serializers that work not just in the .NET framework, but also in .NET Core, uh, Silver Light or Windows mobile phone, for example. So, developers may choose them instead of the native one, because they are suitable for their needs. And, well, all of them include type information by default. They invoke setters and they perform either no type control at all or just the object graph injection. So, attacker may need to find these entry points. Also, we have wire that is now known as Hyperion. That is the serializer for .NET. If you are familiar with the Scala or Java version of the libraries, um, framework for concurrency based on actors. So, you have, like, different actors exchanging messages. And these messages were serialized with JSON.NET using this type name handling setting equals to also it was vulnerable. But then they replaced this JSON.NET serializer with Hyperion. That is their custom serializer. And, well, this Hyperion includes type discriminators, invoke setters, and then perform no type control. So, again, it's another vulnerable library. Also, be aware of rolling your own format. For example, this Nancy framework that we talked about before, they moved away from binary formatter because, um, well, it was not included in the first version of .NET Core and they want the framework to be compatible with .NET Core. So, they moved away from binary formatter and then they created their own JSON library. And as you can see here, it includes a type discriminator that is called type object in this case. And then it will invoke the setters. So, we were also able to get arbitrary code execution on the pre-release 2.x branch of this framework. We also found a very interesting CMS. That is one of the most popular CMS for .NET, if not the most. That is called .NET Nuke. And they use XMR serializer to serialize arbitrary types. Since XMR serializer need to know the type ahead of time, then they created this wrapper around XMR serializer where they would, in a cookie, in a web cookie, they were setting the type that was going to be used for the .NET XMR serializer and then the payload for the XMR serializer. So, this was like a challenge for us because XMR serializer, as Alex said, is the most limited serializer in .NET. It basically doesn't allow you to do many things like serializing a system type property or serializing a type, for example, with interface members. So, if we were able to get arbitrary code execution on XMR serializer, we were like confident that we were going to be able to do that for any other libraries. So, we tried with our object data provider, Gadget. And so far so good. It was like XMR serializer friendly. No problem so far. Now, if we tried to use that Gadget to invoke process.start, then we had a problem because the process type contains interface members. So, XMR serializer doesn't like it. That problem was easily solved because you can choose Gadgets from anywhere else, like, for example, the summit reader load method. The object state formatted the serialized method. Or you can even look for Gadgets in your target class path or type. So, for example, since we are attacking .NET Nuke, we search for Gadgets in .NET Nuke. And we found that they have this file system utils type, which is very handy for hackers because they contain methods to deploy web cells and methods to read any arbitrary files into the STTP response. So, very convenient for us. So, now the next problem was that XMR serializer builds a whitelist of allowed types at construction time, and then it applies the whitelist at runtime time. So, that was a problem because we need to send an instance, for example, of our summit reader or the file system utils types as the payload, and these types are not going to be included in the whitelist. So, we needed to find some way to full XMR serializer to include our arbitrary types into the whitelist. And we did that, basically, by using a parameterized type as the expected type, as you can see down there. And then we used the first parameterized type to place our payload type, like file system utils, and then the second type to put our object data provider type. So, with that, we were able to get arbitrary code execution pre-authentication on .NET Nuke. At first, these guys from .NET Nuke assigned it like a low severity, which was like weird because it's pre-authentication RCE. And they said that this severity was assigned because attacker needs to be able to understand how the cookie works. And we were like, okay, do you know your framework is open source, right? So, anyway, they changed that to critical at the end. So, this is the source code for the relevant part. At some point, it reads, for example, when you visit the 404 error page, it executes this code. And as you can see here, it's reading the cookie with that is named DNM personalization and then passing this XML cookie into this serialized hash table XML method. If we check this method, it's basically extracting the type from the XML cookie, like here, and then using this type name to construct the XML serializer. So, the attacker can control the expected type as we said before. Now, it's deserializing the rest of the cookie. So, this is what DNM personalization cookie looks like in a real DNM application. As you can see here, it contains the type and then the inner blue box is basically the payload for the XML serializer. And this is what our payload looks like. So, the expected type contains this parameterized type which contains our runtime payload types. And then the inner blue box is our payload for the object data provider. So, in this case, instead of popping up a calculator, we are using the file system beauty class in .NET NUC to basically download our web cell and deploy it into the IIS root folder. So, let's see that in action. So, this is the out of the box installation of DNM. If you run it, visit a non-existent page, you will get your 404 error page. Sorry, this page you are looking for is not here. And if we send that verb, well, the request does not contain the DNM personalization cookie, but by reading the code, we know that it's processing this cookie. So, we will just include it manually, like DNM personalization, and then we will basically paste the XML payload that I showed you before, which as I said is using the pull file method in the file system beauty class that is provided by DNM to deploy the web shell. So, let's paste this into the request, format this a little bit. And now in the victim server, we will check that, well, we don't have this cell ASPX web cell that we are downloading. So now, as soon as we execute the request, the cell ASPX will appear, as you can see there. And, well, we'll be able to basically interact with the system basically by visiting the web page and install whatever we want to do. Thank you. So, with that, just to wrap up, just remember that this is not a problem in JSON or XML or, I don't know, any of the serializers. So, try to avoid digitalizing entrusted data. We saw this is also a problem in Ruby, Python, PHP, so do not digitalize entrusted data, and if you have to, get your library evaluated by some security guys, try to avoid libraries that perform no type control, so they are just doing the post-dialization cast. Try to avoid libraries that include type discriminators. It's not a sufficient requirement for arbitrary code execution, but it's a good indicator that you will be able to get arbitrary code execution. And also, don't allow developers to let users control the type like we saw in DNN.  So, with that, thank you very much. And if you have any questions, please send them over to our emails.


Welcome to the fourth meeting in 2024 of the Delegated Powers and Law Reform Committee. We have received apologies today from our convener, Stuart McMillan, MSP, and in his place can I welcome Rona Mackay, MSP. I would like to remind everyone now to switch off or put to silent mobile phones and electronic devices. The next item of business is to decide whether to take items 5, 6 and 7 in private is the committee content to take these items in private. Under agenda item 2, we are considering three instruments subject to the affirmative procedure and no points have been raised on the draft renewables obligations Scotland amendment order 2024, the draft land and buildings transaction tax, miscellaneous amendments Scotland order 2024 and the draft provision of early learning and childcare specified children's Scotland amendment order 2024, as the committee content with these instruments. Under agenda item 3, we are considering three instruments subject to the negative procedure and issues have been raised on two of the instruments. The first instrument is SSI 2024-5, the non-domestic rates transitional relief Scotland regulations 2024. The instrument makes provision in relation to local tax reliefs. In correspondence with the Scottish Government published alongside the papers for this meeting, the committee queried whether a reference in the instrument to section 24-3 of the local government Scotland act 1966 was an error, as this section has been repealed. The Scottish Government agreed that the reference to section 24-3 is an error. I advised that it will bring forward an amending instrument with a coming into force date of 1 April 2024 coinciding with that of the principle instrument to remove the erroneous reference and to make certain other changes to regulation 11 that have been identified following a review of the instrument in light of the committee's question. Does the committee wish to draw the instrument to the attention of the Parliament on the reporting ground I, defective drafting, on the basis that regulation 11 of the instrument does not operate as intended in that regulation 11-2 refers to a provision that has been repealed without relevant savings? Does the committee wish to welcome that the Scottish Government intends to address that in an amending instrument that will come into force to coincide with the principle instrument? In relation to that instrument, the committee asked the Scottish Government about the reference in the preamble to a consultation requirement in section 14-5 of the Non-Domestic Rates Scotland Act 2020. There is no section 145 in that act and we asked if the reference should instead be to section 14-5 of the act. The Scottish Government agreed and advised that this was a typographical error. The Scottish Government proposes to address this issue by adding text to the explanatory note of the instrument, setting out the error and referring to the Scottish Government's correspondence with the committee in this regard. Does the committee wish to draw this instrument to the attention of the Parliament on the general reporting ground in that reference to the preamble to section 14-5 of the Non-Domestic Rates Scotland Act 2020 should be to section 14-5? Does the committee wish to note the Scottish Government's proposal for addressing that? The second instrument where issues have been raised is SSI 202410, the Council Tax Dwellings and Part Residential Subjects Scotland amendment regulations 2024. The instrument amends regulations governing when self-catering holiday accommodation is subject to non-domestic rates rather than council tax. In correspondence with the Scottish Government, also published alongside the papers for this meeting, the committee queried the word as was missing from regulation 5A4 of the principle regulations inserted by regulation 2-2 of the instrument and whether the meaning of the provision was sufficiently clear. The Scottish Government advised that this was a typographical error and that it will be corrected by correction slip before the instrument comes into force. Does the committee wish to draw this point to the attention of Parliament on the general reporting ground? Does the committee wish to note that the Scottish Government proposes to correct this by correction slip before the instrument comes into force? No points have been raised on SSI 2412, as the committee content with this instrument. Under agenda item 4, we are considering an instrument not subject to any parliamentary procedure. No points have been raised on SSI 202413, as the committee content with this instrument. Does the committee wish to note that the Scottish Government has laid a revised policy note in respect of the instrument? Yes. Thank you very much indeed for all that and we move the committee into private.