Upload File

one$flew$over$the$cuckoo’s$nest - hitb · one$flew$over$the$cuckoo’s$nest...

  • Home
  • Documents
  • One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
56

Upload: ngoanh

Post on 12-Apr-2018

217 views

Category:

Documents


2 download

Report

TRANSCRIPT

Page 1: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 2: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

One  Flew  Over  the  Cuckoo’s  Nest  Hack  In  The  Box  2012  Amsterdam  May  24th  2012    

Page 3: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

INTRODUCTION  Chapter  0x01  

Page 4: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Who  we  are  

Page 5: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Here  

•  Claudio  “nex”  Guarnieri  @botherder  

•  Security  Researcher  at  iSIGHT  Partners  •  Core  Member  at  The  Shadowserver  FoundaNon  •  Full  Member  at  The  Honeynet  Project  •  Pizza,  pasta,  Ferrari  •  Cuckoo  Creator  and  Lead  Developer  

Page 6: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Not  here  

•  Alessandro  “jekil”  Tanasi  @jekil  

•  Dude  from  Hostmap,  SecDocs  •  Cuckoo  Core  Developer  and  Fussy  Bitch  Engineer    

•  Dario  “bagode”  Fernandes  •  Google  Summer  of  Code  2011  student  •  Cuckoo  Windows  components  developer  

Page 7: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

AUTOMATED  MALWARE  ANALYSIS  Chapter  0x02  

Page 8: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Problems  

•  Malwares  in  the  wild  are  way  too  many  •  Manual  analysis  takes  a  lot  of  Nme  •  StaNc  analysis  requires  strong  skillsets  •  Need  to  deal  with  packed,  polymorphic,  self-­‐modifying  code  

•  Performing  dynamic  analysis  manually  is  a  tedious  work  

Page 9: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

SANDBOX!  

Page 10: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Pros  

•  Can  automate  the  whole  analysis  process  •  Process  high  volumes  of  malwares  •  Usable  by  virtually  anyone  •  Get  actual  executed  code  •  Can  tweak  to  do  cool  sh1t  •  AutomaNng  is  cool  •  AutomaNng  is  cool  •  AutomaNng  is  cool  

Page 11: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Lets  you  focus  on  more  important  duNes  

and  sNll  get  paid  

Page 12: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Cons  

•  Commercial  soluNons  are  very  expensive  •  Some  porNons  of  the  malware  code  could  be  not  triggered  

•  Environment  could  be  detected  •  Difficult  to  successfully  automate  exploit  analysis  

•  Without  proper  consumpNon  of  the  results,  it  gets  useless  

Page 13: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

PreparaNon  

•  Need  to  define  your  requirements  and  expectaNons  

•  Need  to  design  the  analysis  environment  carefully  

•  Need  to  design  and  implement  a  proper  use  of  the  data  and  integraNon  with  other  systems  and  storages  

Page 14: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Ask  yourself  #1  

•  Why  do  I  need  a  Sandbox?  •  What  do  I  expect  to  achieve?  •  What  informaNon  is  most  relevant  to  me  or  to  my  organizaNon?  

•  Who  is  gonna  consume  the  results  and  what  for?  

•  How  can  I  make  it  easily  consumable  

Page 15: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Ask  yourself  #2  

•  Do  I  want  to  analyze  PDF  exploits?  •  Do  I  want  to  analyze  Office  exploits?  •  Do  I  want  to  analyze  PHP  and  Perl  scripts?  •  Do  I  want  to  analyze  browsers’  exploits?  •  What  else  do  I  want  to  analyze?  •  Do  I  want  it  to  communicate  with  the  outside?  

Page 16: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

CUCKOO  SANDBOX  Chapter  0x03  

Page 17: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

What  is  it  

•  Automated  malware  analysis  system  •  Uses  virtualizaNon  •  Easy  to  use  •  Easy  to  customize  •  Every  single  piece  of  it  it’s  Open  Source!  

Page 18: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

History  

•  Google  Summer  of  Code  2010  •  DRG  Security  InnovaNon  Grant  2011  finalist  •  Google  Summer  of  Code  2011  •  Malwr.com  •  Google  Summer  of  Code  2012  •  Rapid7  Magnificent7  winner  of  1st  round  hbp://community.rapid7.com  

powered  by  

Page 19: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

It  can  

•  Analyze  PE32,  PDF,  DOC,  URLs,  PHP,  Perl,  Python  scripts…  you  name  it  

•  Be  fully  customized  to  do  whatever  you  want  •  Be  integrated  in  larger  threat  intelligence  frameworks  

 

Page 20: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

It  generates  

•  Win32  funcNons  calls  trace  •  Dropped  files  •  Screenshots  •  Network  traffic  dump  •  Comprehensive  reports  

Page 21: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

hbp://www.flickr.com/photos/consonus/  

Page 22: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Cuckoo  Scheduler  

Analyzer  

cmonitor  &  chook  

Components  

Page 23: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Scheduler  

•  Main  component  •  Dispatches  the  pending  tasks  to  the  pool  of  machines  available  

•  Runs  all  the  juicy  modules  we’re  gonna  see  in  a  bit  

•  100%  Python  

Page 24: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Analyzer  

•  Component  that  instruments  the  guest  machine  

•  Chosen  depending  on  the  plaiorm  of  the  selected  machine  

•  Only  Windows  now,  but  can  support  more  •  Runs  the  malware  and  do  stuff  with  it  •  100%  Python  

Page 25: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Cmonitor  

•  DLL  using  chook  to  install  hooks  on  predefined  win32  funcNons  inside  process  memory  

•  Gets  injected  into  the  target  process  (QueueUserAPC  or  CreateRemoteThread)  

•  Logs  the  funcNons  calls  to  files  

Page 26: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Chook  

•  Custom  inline  hooking  library  •  Allows  definiNon  of  custom  hook  trampolines  •  Replaced  Microson  Detours  

Page 27: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Reason  #1  

Page 28: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 29: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 30: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Reason  #2  

Page 31: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Fetch  a  task  

Prepare  the  

analysis  

Launch  analyzer  in  virtual  machine  

Execute  an  

analysis  package  

Complete  the  

analysis  Store  the  results  

Process  and  

create  reports  

ExecuNon  flow  

Page 32: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 33: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Submission  

•  From  command-­‐line,  Python  API  or  SQLite  DB  •  Specify  file  path  •  Specify  analysis  package  and  its  opNons  •  Specify  machine  to  be  used  or  operaNng  system  

•  Specify  Nmeout,  priority  

Page 34: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Modules  &  CustomizaNon  

•  Analysis  Packages  •  Machine  Managers  •  Processing  •  ReporNng  •  Signatures  

Page 35: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Analysis  Packages  

•  Python  classes  J  •  Defines  how  the  analyzer  should  start  and  interact  with  the  malware  

•  Specified  at  submission  or  selected  upon  file  type  

•  Can  create  as  many  as  you  want  and  do  whatever    you  want  

Page 36: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 37: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 38: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

DEMO!  

Page 39: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Other  examples  

•  Honeyclient?  •  Banking  trojan  analyzer  •  USB  Honeypot  •  Up  to  you…  

Page 40: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 41: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Machine  Managers  

•  Yes,  Python  classes  J  •  Define  interacNon  with  virtualizaNon  sonware  

Page 42: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 43: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Processing  

•  Python  classes,  again  K  •  Modules  used  to  generate  a  container  of  normalized  informaNon  on  the  analysis  

•  Can  create  as  many  as  you  want  

Page 44: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 45: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 46: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Signatures  

•  Python  classes!  •  Look  for  paberns  or  specific  events  •  Assign  them  a  descripNon  and  severity  level  •  Give  context  to  the  reports  •  Help  non-­‐malware  experts  understand  •  Can  be  used  to  receive  email  alerts  

Page 47: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 48: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 49: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

ReporNng  

•  OMG  Python  classes  L  •  Use  the  normalized  results  and  do  something  with  them  

•  Can  create  as  many  as  you  want  

Page 50: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$
Page 51: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

or  mongo!  

Page 52: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Community  Effort  

•  Create  a  community  repository  for  sharing  modules  &  signatures  

•  Expand  our  line-­‐up  of  developers  and  contributors  

•  Make  Malwr.com  a  major  community  resource  for  malware  research  

Page 53: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Future  Work  

•  A  full-­‐fledged  web  interface  •  Improve  Windows  analysis  components  •  Support  for  other  operaNng  systems,  Mac  OS  X?  

•  Support  naNve  machines    

Page 54: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

Websites  

•  hbp://cuckoosandbox.org  •  hbp://github.com/cuckoobox/cuckoo  •  hbp://blog.cuckoobox.org  •  hbp://malwr.com  •  hbp://www.honeynet.org  

Page 55: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

?  

Page 56: One$Flew$Over$the$Cuckoo’s$Nest - HITB · One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$ May$24th2012 $ INTRODUCTION) Chapter$0x01$ Who$we$are$ Here$ • Claudio$

THANK  YOU!  NOW  LET’S  GET  SOME  LUNCH!  

[email protected]  


Audition Packet for ‘One Flew Over the Cuckoo’s Nest’ packet - cuckoo.pdf · Audition Packet for ‘One Flew Over the Cuckoo’s Nest’ | 5 Pre-Audition Questionnaire for Dale

One Flew over the Cuckoo’s Nest By Ken Kesey. Name the character that matches the description

One Flew Over the Cuckoo’s Nest Study Guide PART 1 …eienglish.org/cuckoostu.pdf ·  · 2010-04-19Name: Ms. Lopez Date: Period: One Flew Over the Cuckoo’s Nest Study Guide PART

One Flew Over the Cuckoo’s Nest, Cool Hand Luke and Being Who You Want to Be

One Flew Over the Cuckoo’s Nest Introductory Lecture

rag532wr4du1nlsxu2nehjbv-wpengine.netdna-ssl.com · Web viewOne Flew Over the Cuckoo’s Nest Photo caption: Playwright Annika Bennett with some of the research that informed her

Audition Packet for ‘One Flew Over the Cuckoo’s Nest’ packet - cuckoo.pdf ·  · 2017-12-20Audition Packet for ‘One Flew Over the Cuckoo’s Nest’ | 3 The Characters The

Kesey, Ken - One Flew over the Cuckoo's Nest€¦ ·  · 2015-04-09Ken Kesey One Flew Over the Cuckoo’s Nest !!! One Flew over the Cuckoo’s Nest by Ken Kesey ! …one flew east,

One Flew Over the Cuckoo’s Nest Start at 45 UjBM&feature=related UjBM&feature=related

Introduction to One Flew Over the Cuckoo’s Nest

One Flew Over the Cuckoo’s Nest Film Directed by Milos Forman

Web viewOne Flew Over the Cuckoo’s Nest Writing ... Exams: Bio & Music Theory, Physics C . ... Alfred Hitchcock’s Vertigo

A look into the strange life and legacy of the author of One Flew Over the Cuckoo’s Nest

dominotheatre.comdominotheatre.com/pr-cuckoo.docx · Web viewPress release: One Flew Over The Cuckoo’s Nest by Dale Wasserman One Flew Over the Cuckoo's Nest April 26-May 12, 2018

Ely Courtney Kaitlyn. The Godfather part 2 One Flew Over the Cuckoo’s Nest 1.The Godfather Apocalypse Now Chinatown A Clockwork Orange Star

A View from the Cuckoo’s Nest

Aim: How is One Flew Over the Cuckoo’s Nest an allegorical novel?

One Flew Over the Cuckoo’s Nest€¦ ·  · 2009-11-02One Flew Over the Cuckoo’s Nest A presentation By M Schuyl Nayland College English Dept

One Flew Over the Cuckoo’s Nest - Bayonet · One Flew Over the Cuckoo’s Nest Chapters 27-End The Boang Trip • Nurse and fear propaganda 209 • Gas staon and boat docks 237,

One$Flew$Over$the$Cuckoo’s$Nest - HITBconference.hitb.org/hitbsecconf2012ams/materials/D1T1... ·  · 2017-10-15One$Flew$Over$the$Cuckoo’s$Nest Hack$In$The$Box$2012$Amsterdam$

One Flew Over the Cuckoo’s Nest : Examining the Psyche of Literature and of Society

AQA Psychology: First Year of A Level. Course Guide.fluencycontent2-schoolwebsite.netdna-ssl.com/FileCluster/Tolworth/MainFolder/Content/...One flew over the cuckoo’s nest – A

One Flew Over the Cuckoo’s Nest Ken Kesey

One Flew Over the Cuckoo’s Nest: Examining the Psyche of Literature and of Society Randle P. McMurphy vs. (The Big) Nurse Ratched

Ruh Sağlığı ve Hastalıkları Hakkında İzlenmesi Gereken 8 Film · 4. Guguk Kuşu (One Flew Over the Cuckoo’s Nest): “Akıl hastalığı” savunması yaparak işlediği

One Flew Over the Cuckoo's Nest - Prestwick House ·  · 2015-05-069 One Flew Over the Cuckoo’s Nest © Copyright 2007, Prestwick House, Inc. 10. McMurphy brags about the fact

Critical Methods of Reading and Writing: Beyond Binaries · Critical Methods of Reading and Writing: ... is Ken Kesey’s One Flew Over the Cuckoo’s Nest, ... Nest (1970) VIEWING:

One Flew Over the Cuckoo’s Nest Introductory Lecture

One Flew Over the Cuckoo’s Nest (Pages 131- 158) By: Faith, Victoria, Alishya, Jessica

iapps.pvcsd.orgiapps.pvcsd.org/PVIWEB/kheitman/Mrs._Heitman/English_10/Entries... · Web viewOne Flew Over the Cuckoo’s Nest. by Ken Kesey. Genre. Setting. ... Avoid the word “like

th Street Playhouse presents One Flew Over The Cuckoo’s Nest ·  · 2016-02-212 6 StreetPlayhouse.c 2013 7075234185 1 Fight The Good Fight! One Flew Over the Cuckoo’s Nest was

Mackenzie American Lit. Honors Essay (Great American Novel) One Flew Over the Cuckoo’s Nest by Ken Kesey In One Flew Over the Cuckoo’s Nest,

One Flew Over the Cuckoo’s Nest - blogs.ubc.cablogs.ubc.ca/.../08/One-Flew-Over-the-Cuckoo’s-Nest.-JNIY.pptx.pdf“The overall theme of One Flew Over the Cuckoo’s Nest is that

One Flew Over the Cuckoo’s Nest by Ken Kesey

One Flew over the cuckoo’s nest