The story you're about to hear is true. The names have been changed to protect the innocent. Fatima cigarettes, king size, extra mild and soothing brings you dragnet on both radio and television.  You're assigned to homicide detail. A 25-year-old man is found hiding in a freight car in a deserted train yard. In his arms, he holds the body of a dead woman. The victim's identity is unknown. The suspect refuses to talk. Your job? Investigate. Compare Fatima with any other king-size cigarette. Yes, compare Fatima with any other king-size cigarette. One, Fatima's length filters the smoke 85 millimeters for your protection. Two, Fatima's length cools the smoke for your protection. Three, Fatima's length gives you those extra puffs, 21 percent longer than standard cigarette size. Fatima gives you more for your money. And in king-size Fatima, you get an extra mild and soothing smoke, plus the added protection of Fatima quality. Five, Fatima, in the bright, sunny yellow pack. The documented drama of an actual crime. For the next 30 minutes in cooperation with the Los Angeles Police Department, you will travel step-by-step on the side of the law through an actual case transcribed from official police files. From beginning to end, from crime to punishment, Dragnet is the story of your police force in action. It was Tuesday, January 18th. It was cold in Los Angeles. We were working the night watch out of homicide detail. My partner's Frank Smith. The boss is Captain Warman. My name's Friday. I was on the way back from the record bureau, and it was 10.38 p.m. when I got through room 42. Homicide detail. Is the cop hot in here yet? Nothing. I keep asking him questions. Might as well be talking to myself. He might be in a state of shock. No, I don't think so. You got anything on him from R&I? No, he's clean. You and Stahl want to get over to the morgue, roll the dead woman's prints. Yeah, sure. Maybe you'll have better luck when we see you later. Yeah, sure. Here's your driver's license, Gordon. Better put it back in your wallet. Gordon? All right, son. It's just a matter of time. You're going to have to tell somebody sooner or later. Why won't you tell us now? Come on. What do you say? Well, look, son, I'll tell you the truth. I don't get the reasoning behind all this. We know there's nothing wrong with you. We know you can talk all right. You talk to the officers and the radio car will brought you in. You know, as well as I do, you're going to have to tell somebody sooner or later. All right, son, it's just a matter of time. You're going to have to tell somebody sooner or later. Why won't you tell us now? Come on. What do you say? You know, as well as I do, you're going to have to explain what's happened here. You're going to have to explain that dead body. You want to get it over with now? Look, Gordon, if you didn't kill the woman you haven't anything to worry about, and if you did, we're going to find out anyway. Who was the woman, Gordon? Will you tell me that much? What's her name? You know her very long? Did you know her very long? What was she to you? Do you want to tell me that? She's a fairly middle-aged woman in the early 50s, I'd say. Is that about right? Was she your mother, Gordon? Older sister, maybe? Any relation at all? What's the matter, son? Feeling sick? How about a cigarette? Bother you if I smell? I hope you haven't got the idea we're trying to trick you into anything, Gordon. We've got a dead woman on our hands here. We've got to find out why she's dead.  No, you're just looking up at the clock, son. We're stuck here till we find out about that woman. That goes for both of us. Armicide, Friday. Oh, yeah, yeah. No, not right now. I ought to be back about half an hour. Yeah, half an hour. I got an idea, Gordon. You might have to set your mind at ease. Now, number one, if you think we're out to build a frame against you on this thing, let me tell you that you're wrong and I'll prove it to your son. I'm going to tell you exactly what we know about this case, everything. But when I'm finished, maybe you can fill in the blank spot for us, huh? What's the matter, you're heady? I'm aspirin in my locker there if you want some. No? All right. Here's all we know about it. One of our radio cars, 1A4, answered a call from the night watchman down in the fray yards. He told the officers that he'd spotted a man wandering around down at the far end of the train yards near the West gate. Watchman only saw him at a distance, but he said he could make out the man and that he saw that he had a woman with him. She must have either been sick or she had too much to drink because the man appeared to be dragging her along with him. The two of them disappeared behind the line of boxcars on the siding. When the watchman went out to look for the two people, he couldn't find them. He called the radio car and when the officers got there, they started searching. I finally found you hiding back in the corner of an empty boxcar there. You were holding that dead woman in your arms. There wasn't anything the officers could see that might have caused the woman's death. There were no marks on the body, nothing visible anyway. When they tried to question you, they found that you didn't want to live, that you didn't care what happened to you. That's about the size of it, Gordon. I'll leave anything out. Gordon? Oh, yeah. There is something else. From what we could gather, the dead woman had been doing some drinking before she died. Matter of fact, looks like she was a pretty heavy drinker. Another thing, we know you and the woman got into the train yard down by the West gate. We know that you dragged your body across the freight yards to that empty boxcar that they found you hiding in. You walked through the dirt directly to the door of that boxcar. We could see where you dragged your body from the door back to the corner of the car. Now, that's the whole story so far, Gordon. You want to fill in the rest? Son, how about it? Who is the woman? All right, look, how about these items we found in your pocket, Gordon, this address book here? Is this the woman's name in here? Or this handkerchief with a lipstick on it? Were you out with another girl tonight? Were you, son? If you were, it might help to tell us who she is. You hear me, son? How about this lady's ring you had in your pocket? The name Elizabeth engraved on the inside. Is that tie-in at all, Gordon? Who's a Belonger? Formicide Friday. Oh, yeah, Frank. Can you get a night in on her? Mm-hmm. H-O-F-M-A-M. 2N? Right. You going out there now? Okay, take her down over there, huh? Let me hear from her. No, no, not yet. That was my partner, Gordon. The officer who was in here with you. I took the dead woman's fingerprints. They've got her identified, son. It's Elizabeth Hoffman, age 52 years, music teacher. Last known address, 5473 Sixth Avenue. They're on their way out there now to check it. All right, relax, Gordon. That window doesn't leave anywhere. Now, you want to take another look at this ring? You got a fair idea that it means something. Gordon, they examined the dead woman's hands. They know she was wearing a ring recently. Her name's Elizabeth Hoffman. Name Elizabeth engraved inside this ring. Now, look, boy, we're going to get the answer sooner or later. How about it? What were you doing with this ring in your pocket? Now, let me tell you something, young fella. I don't know what's bothering you, but whatever it is, we're going to find it out.  You're in a bad spot. If you're not interested in helping yourself, then neither am I. The monkey's on your back.  All right, let's have your driver's license. Come on, get it out. All right, I'll take it. Gordon John Miller, 2055 Malcolm Avenue, Los Angeles. Hello, information? If you have a phone listing for 2055 Malcolm Avenue, that's fine. 321192. Thanks a lot. Put the phone down. You ready to tell us? No, I won't tell you. All right, and where you want it, Gordon? You can't call. You can't. They can't tell you. They don't know. All right, sit down. I said sit down. If you won't answer the questions, we'll find somebody who will. Give me your wrist. Now, sit still. Now, the sooner you get it through your head, you're not hearing a traffic ticket the better. You're going to stay cuffed to that chair till we're ready to book you.  They can't tell you. They don't understand. They can't tell you.  Now, sit still there. Now, come Avenue. My name's Friday. Police Department, Central Homicide. Who's there speaking, please? I see. Miss Miller, are you related to a Gordon Miller? Your brother. No, he's not here. There's nothing wrong with him. Yes, he's here. We're holding him. I wonder if you'd be kind enough to come down here to the city hall. Yes, ma'am. It's important. We'd like to talk to you. No, as soon as possible. Yeah, you can get in through the Main Street entrance. It's room 42, 4-2 on the Main floor. Just ask for Friday. That's my name. All right, thank you. Goodbye. Your sister, Lillian, is on her way down, Gordon. It's not going to help. She doesn't know none of them know. Who's them? You mean your family? You shouldn't have called. They don't know about it. They can't tell you. Why did you have to call? You know why, Gordon. We gave you plenty of chance to tell us yourself. The answers have to come from somewhere. What answers? What do you want me to say? Homicide Friday. What? How's that again? No, I'm afraid you have the wrong extension. You want vice detail. Just a minute. I'll have you call transfer. Yeah, would you give this call to 2607? Yeah, thank you. I asked... What do you want me to say? What do you want? Pretty simple, Gordon. Just tell us what happened tonight, will you? She's dead, isn't she? Elizabeth? Yes, that's right. There's nothing else to say. I killed her. Why did you kill her, son? I'm not sure, really. I'm not... I think I felt sorry for her. I killed her, though I know that much. You murdered the woman, but you don't know why? Yeah. I keep trying to remember. I can't. Doesn't seem real. You've been drinking, Gordon? Yeah. Two or three days. We were going to have dinner tonight. We started drinking cocktails before. Quite a few. We never had dinner. What do you mean by we? Two of us. Elizabeth and I. Elizabeth Hoffman. Where were you drinking? I don't know. I'm telling you the truth. I keep trying to remember. No marks on the body, Gordon. Then we could see anyway.  I killed her. That's enough, isn't it? I murdered her. Please don't talk anymore. You're not even half the story.  You won't tell us why. You won't tell us how. It wouldn't matter alone. They kept hounding her. They drove her out of her mind. Come on, son. Snap out of it. That's not going to help. All right, come on. Yeah. Now, what's it all about? What do you have to do with it? Known her for ten years. She was my music teacher. Piano. Brilliant woman. Elizabeth was a real artist. You've been taking piano lessons from her for ten years. Is that right? Elizabeth was arranging a concert tour for me. South America this fall. She said she was sure I'd be a success. I couldn't fail. Concerts in eight cities all over South America. We were going this fall. We were going to leave in August. Not have anything to do with her death? I guess so, away.  Only one who believed in me. I can't tell you. The last two years I didn't have any money to pay for my lessons. She didn't care.  She did everything for me. You know, this is pretty hard to understand, son. She did everything for you. Then why did you kill her? What makes you think that's important?  You always ask why. It's not important how she died. It is to us.  Why'd you take her body down to the freight yard? You should have known Elizabeth when she was alive.  Just wonderful. Talent, she was brilliant. Understanding. Great woman, warm. No one like her, Sergeant. Great human being. She drank quite a bit, didn't she, Gordon? Yes. She drank. Reason for it, though. Reason that way with a lot of brilliant people who drank once in a while. She drank more than that, didn't she? She had a reason for it. Who are you to sit in judgment on her? Elizabeth was a brilliant artist, great woman, great. One of the finest musicians in the country, a great woman. She was a drunk and a bad drunk. Now, let's face it, son, you know that as well as I do.   Six drunk arrests in 14 months. That's what her card reads in the record bureau. Those are the only times we know of. Now, how many can you add to it? She drank. She thought it was the only way out for her. Wasn't any other way. Well, you're talking in circles here, Gordon. Get it straightened out, will you? You want to know why Elizabeth drank? Go ask my family. They'll tell you. They'll tell you a lot of things if you want to believe it. What can they tell me that you can't? Nothing. But they'll try and pretend they know liars. I don't want any part of them. They don't want any part of me. Won't you live with your family now, Gordon? I haven't seen them for a year. I don't want to see them. Why not? Won't you get along with them? My mother's dead. She died when I was 12. Just my father and my sister. What's the matter? Don't you get along with them? I just want them to let me alone. That's all. Just let me alone. How about Elizabeth Hoffman? Your family know her pretty well? Yeah, they know her. I didn't understand her, though. I really loved her. She loved me. I don't think I followed your son. I knew you wouldn't understand. I was in love with Elizabeth. She was in love with me. We were going to get married. You're 25 years old, Gordon. Is that right? Yes. Elizabeth Hoffman was 52. That's what our records show here. What about it? Well, 27 years difference. That's a little unusual, wouldn't you say? Whatever. Everything that's great is unusual. That's what makes it great. I loved her. Time didn't make any difference. A few years. What's that? I loved her more than any woman in the world. She meant everything. I didn't care if she drank. I didn't care if she was old.  Elizabeth was beautiful. Well, drinking didn't help her much. I don't care about that. I'll still say it. She loved me and I loved her. Believe me. Please, I loved her. All right. I believe you, son. Let me ask you this. Yes. You say you respected her. She was talented. You were grateful to her. She was generous. She made sacrifices for you. Did everything for you that she could. Is that right? She loved you and you loved her. You were going to marry her. Yeah. This fall on the way to South America. We're going to be married. But we always wanted. Elizabeth would have been so happy. So happy. Yeah. Well, then why did you kill her? Yeah, Frank. See you in a minute. Yeah. I wrapped you something I think you ought to know. Yeah. John and I checked the boarding house. The Hoffman woman was staying at. Checked her room. It's clean. Everything in order. Uh-huh. Miss Miller had the room next to her. She took his place down, too. Anything? His bags were all packed. It looked like he was ready to go. Yeah. And the kitchen sank by the poison. You are listening to dragnet. Authentic stories of your police force in action. Friends, more and more smokers coast to coast are switching to Fatima's every day. Fatima, the extra mild and soothing king-size cigarette with the added protection of Fatima quality. Prove Fatima quality yourself today. Compare Fatima with any other king-size cigarette. One, Fatima's length filters the smoke 85 millimeters for your protection. Two, Fatima's length cools the smoke for your protection. Three, Fatima's length gives you those extra puffs, 21% longer than standard cigarette size. Fatima gives you more for your money. And in king-size Fatima, you get an extra mild and soothing smoke. Plus, the added protection of Fatima quality. Because of its quality, its extra mildness, its better flavor and aroma, more smokers now insist on king-size Fatima than ever before. Remember, in Fatima, the difference is quality. Switch to king-size Fatima today. Ask your dealer for the bright, sunny yellow pack. Tuesday, January 18th, 11.55 p.m. My partner Frank Smith and I continued questioning the murder suspect, 25-year-old Gordon Miller. While he freely admitted to the murder of his music teacher and fiance, 52-year-old Elizabeth Hoffman, we still were unable to get him to give us a good reason for the murder. Whenever we put the question to him, he either refused to answer or he was evasive. We got the same results when we questioned him about how he killed the Hoffman woman, where he killed her. 12.20 a.m. The interrogation went on. But you ought to remember where you killed her, Gordon. You say the two of you left the rooming house.  Where'd you walk? Down Arlington Avenue. We kept walking and we turned off. We walked for a long time.  Can you remember that? No, I don't know. Like a nightmare. There's so much of it, I guess I don't want to remember. And what's the last location you can recall, Gordon? I mean, before you find yourself in the freight yard. Olympic Boulevard, I think, someplace on Olympic. We kept walking and walking. I don't remember why. You remember packing your suitcases before you left the boarding house? Packing? Yeah, I think I do. Elizabeth and I talked about going away for a few days. Some place out of town. I think we're going to go tomorrow. They checked both your rooms, Gordon, yours and Elizabeth Hoffman's. They found your bags packed, but there was nothing about her room that indicated she was going away. Everything was in order. Can you explain that? I don't know. Maybe she didn't have time. Hadn't gotten around to it. I guess you found the poison, too, huh? That's right. I had got it two days ago. We thought about it. We even wrote a letter explaining why we'd do it. Yeah. There was no courage, though. Neither one of us. We talked about it and decided to forget it. I've told you everything. There isn't anything else to say. Righty? Yeah. All right, Jess. Send her in, please. You're a Lilian Miller, is that right? Yes, that's right. I don't want to see her. I don't want to see her. She's your sister, Gordon. She wants to see you. Please keep her out. I'll keep her away. Gordon? My name's Friday, Miss Miller. Come on in, please. Have a chair. Thank you. How are you, Gordon? Been such a long time. How have you been? Chairman Smiller. Thanks. Poor kid. What is it, Gordon? What's the trouble about? Honey, what is it? Won't you even look at me? Get out of here. Let me alone. Get out. Please, Gordon, don't. I'm here to help you. Honey, they called me the night they said she was in trouble. What is it? Let me help you, please. You can't help. She's dead now. Will you go home? Elizabeth's dead. I killed her. Huh. Thank God. Will you take her out of here, Sergeant? Tell her to go. You don't know what you're saying, honey. Not in his right mind, Sergeant. I know he isn't. Please, Gordon, you have to let us help you. I called Dad before I left. He's on his way here now. We'll get you a lawyer. Don't worry, honey. He'll be all right. Everything will be all right. She's dead. Can you bring her back? You couldn't have killed her, couldn't you? Hounding her, torturing her? Why couldn't you let her alone? Why couldn't you let us alone? Well, you only did it for you. Gordon, we thought it was best for you.   Say anything you want, Gordon. I don't care. But let me help you, please. It doesn't count what I am. Just let me help you. I'll get it. Okay, yes, thanks. Henry Miller, the boy's father. I don't want to see him in here. I don't know him. He's not my father. All right, take it easy, Gordon. Please, honey. Try to understand. We only want to help. Who's in charge here? My name is Friday, Mr. Miller. This is my partner, Sergeant Smith. The handcuffs on my son. Gordon, who did they put them on you? I did, Mr. Miller. The only way we could settle them down. Taking quite a bit of authority in your hands, aren't you? Get them off of them right now. No reason to handcuff him. Sorry? Can't be done. I said take them off. I have a little influence in this town. I'll sleep to it that the police commission hears about this. Now, what's my son doing here anyway? The Hoffman woman dad, Elizabeth Hoffman. What about it? She's dead. Gordon says he killed her dad. We've got to do something. Don't tell him anything, Gordon. Don't say a thing. I'll get a lawyer for you right away. I know what your rights are. Don't tell him anything. Did you know Elizabeth Hoffman, Mr. Miller? I knew her slightly. Can't see what this fuss is all about anyway. Woman wasn't any good to begin with, no good at all. You ought to be glad I'm handcuffed at this chair. I never thought of hitting you before. I'd like to do it now. Please, Gordon, don't say those things. As far as I can remember, you've been nothing but trouble.   Police stations, trampy women keeping you out of jail. Either you start to realize who's boss in this family or there's going to be real trouble. You'll find yourself out in the cold. You'll stay there. Get him out of here.  Please, dad, he's not well. Try and understand. Enough, Gordon. I'll send a lawyer for you. That's all I'll do. If you make up your mind, I'm boss. You can come home. If not, you can stay away. Now, figure it out for yourself. I don't care.  I hope you ever forget it.  I'll see you at home, William. It's the maid's night out.  Please, dad, we've got to help. Don't leave, dad! Sarge, you know... Will you lock me up now? I'm tired. All right, Gordon, just a minute. Frank, you want to stay with him? Yeah, okay. Miss Miller, you'd like to step outside for a minute or something? I'd like to ask him. Yes, all right. You'll let me see Gordon again? Yes, ma'am. Come on, miss one. About this Elizabeth Hoffman, Miss Miller, did you know her at all? I tried to talk to her. I even offered her money if she'd let Gordon alone. It wasn't any use. She'd been drinking. She wouldn't even listen. She was going to marry Gordon. What's the big attraction, do you know? I mean, between your brother and that woman. There's only one thing Gordon ever really wanted. He wasn't too interested in women, things like that. All he wanted was to be a musician, a great pianist. Is all he ever wanted. The sad part about it is, he'll never make it. I think Don D.P. knows that. When he was a kid, dad sent him to the finest teachers. After six months, they all said the same thing. Yes, ma'am. He'd never make it. He could play well enough, but he certainly wasn't exceptional. He never improved. He just stayed the same. He started taking lessons from Elizabeth. She convinced him he had a great talent, kept telling him she'd make a great pianist out of him. The last three years, she kept promising to take him on a tour, Europe, South America. It never happened. I think Gordon knew it never could happen. Can you think of any reason at all why he'd want to kill her? There isn't any reason none at all. Gordon didn't kill her. He couldn't kill anyone, I'm sure of it. I'm sorry for your brother's sake. Would you excuse me for a few minutes, please? Yes, all right. You wait here.  I'll be right back. All right. All set, Joe? Yeah, in a minute. Gordon, are you ready to go? I'd like to ask you one more question, son. Why can't you tell me the truth on this one? What did you have in common with Elizabeth Hoffman? She was twice as old as you are. You gave up a lot for her. She didn't have any money. She was an alcoholic. Why do you love anyone? Why? Because you need him. You need him. You can't be alone. Nobody can be alone. I needed Elizabeth. That's why I loved her. There's only been two women in the world who understood me. One of them was Elizabeth. The other one was my mother. She died when I was 12. Now they're both dead, both of them. Only ones who understood. My father didn't understand. He never did. All he knows is business, making money, more money. That's why he hated Elizabeth. He was jealous. She understood me. She knew what I was like, knew all about me. When I was with Elizabeth, I was safe. I was happy close to her. There wasn't anything to be afraid of.  I'd put my head on her shoulder and she'd put her arms around me. I wasn't frightened anymore. I was safe. Everything was all right, just like when I was a little kid in the night. I'd call out for my mother. She was always there. She'd put her arms around me and everything was safe. I wasn't afraid. I needed her. It was the same way I needed Elizabeth. Do you understand now? Now do you know why I loved her? I think I do. Only one question left. Why did you kill her? I don't know. I really don't. Maybe I'll remember.  If she died in my arms, I must have killed her. Tomorrow maybe. Maybe I'll remember tomorrow. Is Lillian still here, my sister? She's waiting outside. Did you hear my father, what he said? Told her to be sure and lock the door. Just like my father. They don't have to lock that door. It was locked 13 years ago. Honey, I mean, it was locked the day my mother died. The story you have just heard was true. The names were changed to protect the innocent. On January 19th, an autopsy was performed at the county morgue, city and county of Los Angeles, state of California. In a moment, the results of that examination. And now here is our star, Jack Webb. Thank you, George Fennerman. Friends, recently I had the pleasure of taking part in a benefit in San Francisco. I had the pleasure of taking part in a benefit in San Francisco. While I was there, I met and talked to a lot of smokers who told me that they'd switched to Fatima. They'd found that in Fatima, the difference is quality. Well, now I'm convinced that you'll switch to Fatimas for the same reason. Get yourself a pack of Fatimas tomorrow and compare them. You'll find they give you more for your money. An extra mild and soothing smoke, plus the added protection of Fatima quality. Remember, look for the bright, sunny, yellow pack. Buy King Size Fatima. The results of the autopsy performed on the body of Elizabeth Hoffman showed definitely that she had suffered from a chronic heart condition aggravated by excessive drinking. Cause of death was listed as myocarditis, inflammation of the heart muscle. Gordon Miller was released from custody and completely exonerated of the death of Elizabeth Hoffman. 18 months later, he took his own life. You have just heard Dragmit, a series of authentic cases from official files. Technical advice comes from the office of Chief of Police W. H. Parker, Los Angeles Police Department. Technical advisors, Captain Jack Donahoe, Sergeant Marty Wynn, Sergeant Vance Brasher. Heard tonight were Vic Perron, Herb Ellis, Harry Bartel, Joyce Mufluskie. Script by Jim Moser. Walter Schumer. George Veneman speaking. King Size Fatima has brought you Dragmit transcribed from Los Angeles. Attend the Republican Convention on NBC.


So I'm going to talk up. I know that It's hard to hear me This is the first time you think resin, so Jevrey is playing with this person into shapes at the moment, so we can't be bothered I am on my cell phone for this one. So turn your volume super way up.  I know Bowie said hi Jen said all right mommy you got this I so do not got this I got nothing to lose So mom has really enjoyed seeing all the ocean paintings that we were doing lately and she really liked the Pink sand accidental one that I did So she's trying to recreate it as a first first timer with alcoholics and with resin Firstess of the first time So my first resin piece never said Didn't have me It's true I've been to it to my mom how no one would share because I'm a mama's girl. I was like mom. She said that And I didn't know cuz they were on Facebook Anyways, so Now I can show my mom But this will be the first time she's ever done alcohol in and the first time she's ever done resin so We're gonna work together on this The reason why I sand it so many times is because I want to make it as smooth as humanly possible For the alcoholics that there's any like texture at all in my boards if I was doing it like a you both paper I wouldn't stand at all because it comes to me crazy smooth and like photo finish but Using a masoni based canvas board It's gonna have some kind of texture on it so I sanded a lot To reduce any kind of drag that would be created by the paint either the The house paint or the gesso so I sanded every coat that I did So I know that you told me earlier that you want to keep your sand So we're gonna add the resin areas right here No, because we want the resin to stay away from the areas you want to be to pick your colors out You're gonna need a white a blue Another So let's say this is your wife And then you're gonna do blue it's not This is the reason I don't carry this in our store, but What color Okay That's probably too much, but it'll be fine So we're gonna mix our colors up here You're fine because that means you only use three So And I don't have any more Just resin titanium or snow white, so I'm using system three white epoxy paint which is a really good alternative But I forgot I had it until I started scrounging today mom was like you need to get rid of some of your pain So I got some paint together for the de stache group, which I can add a link. No, I can't I can ask One of the mods at a link I was inspired by her when I first started doing resin. Definitely. You have the opportunity follow blowfish designs. She's the So I always do just a light amount of color to start because I'm gonna be the first and then after that we're gonna get into the But she wants to come visit you next time she comes to town, which will be in a couple months. She wants to come back to number one Meet Judy number two hang out with me I don't know why I'm number two, but it's it makes sense and then number three get her eyebrows microbladed so That's happening in about a few months to your dry brush first Oh Those aren't gonna set up because this resin lasts for two hours Okay, yeah, I'm over here mom Judy says absolutely a dang sure need to meet her So Judy's my Texas mom Okay Exit to your girl Something something And I'm gonna do is dry brush this But I have We'll see that Well done, my and dry brushing is just Brushing onto a dry surface But Open it works here So this is the first time So basically what mom said was is that dry brushing brings out depth and Some other stuff She's just trying to bring out the depth in her sand layer And to do that she's not dipping her brush into alcohol She's just only putting it into the color paint and she's only gonna hit the edges So that it just shows the definition of her sand area Fun fact my mom is a Seremesis and she was a very well-established Artist for about 25 years until she retired from that as well So she has no experience in resin or alcohol ink or anything that's like two-dimensional, but she's very Experienced in selling her artwork and color theory Of course, she did a lot of slip techniques She's considered it I'm working on it Um Do you have any tips on how someone could market their artwork To stores and all the stores I sold to Somewhere around here But So What my mom did was mass-produce artwork you say mom How did you get into selling your stuff wholesale for like the community mass communities? No Her name was Millie.  And I'm like, okay. So all my stuff went to her, and she sold to everybody. She was also to Cedric's rep, if you know what I'm talking about. You have a blank buffalo and to Cedric's tiles. We all worked together. To Cedric. To Cedric's did. And it represented Cantony, and I wanted to sell my work. And I just got lucky. That's how I got into it. And that was a 15-year gig. Southwest building, like, called Carly. And one day, but one day it was over. And when it was over, it was over. I mean, that's the art world, though. That's the art world. And I could have retooled and got into something else, which was open at the time. But I'm like, nah, I'm down with this. I'm like, you know what I'm saying? Right? In fact, if a representative wanted to sell my pieces, they'd not put a video on it. So, that's my answer to that. Well, you would still recommend people get their stuff out there. It has to be seen. Well, you do. You can put it on collision. You can put it on consignment. There's a lot of places that'll take consignment. And I didn't have the internet back then. All I had was beating the streets. So, but you've got the internet now, so... And I wouldn't even know where to start on it. Right. Well, we try to encourage people to... Every artist. Well, how do you do that? Yep. I could, and I did. Jenna. And then I... Let me tell you about Hosella, Rachel. I made this little trilly bottle. She did this thing. She helped me mark it with a little box that was new to her. I remember those. I sold them to my wholesaler, my rep, for $15 apiece. Speed up. I sold them to my... I sold these teleboxes to my just $15 apiece. You know? I went into a store at the mall, and they would start for $120 apiece. I'm like, I'm in the wrong business. Right. I'm just going to do the outside. It gives me a two out of crazy working time. So, I can leave it in the pot for as long as I feel like it pretty much. As long as I'm not excusing myself from the area, it'll be just fine. Oh, yeah. No, it'll be a good... You're clear on these sparklers. And I know that you want to keep some of these sandy areas matte. So, I would pour your resin on the areas that you don't have. Like everywhere that you don't have sand. Hey, I do have resin back in the store. I just updated it. Make sure there's a finger. Good one. Okay, so they need to know that the grease is there. So... So, what I'm doing now is putting on clear resin, so that when I put on my colored resin, it will move freely. We call that... Loosen the paint. Y'all, if there was a Paula Dean of resin... Her name would be Ergo's mom. Bollyya Greaves, apparently. You can't be... You can't work out how you look when you paint the house. What is up beyond? Did you tune in just to say hi to my mama? Kathy, I did one time. I bet this resin is better than the resin. You want it down. You want it to be... That resin? Yeah. Over there. This is not gonna be enough to cover this. Not this one? Right.  Not enough grease. So, put on some more. The rule of thumb is... Okay, so, on paper, you're supposed to mix for three minutes, but nobody times themselves. So, you need to mix until your arm is sore, and then mix for one extra minute. Keep going. Can we work this one? You're welcome. Look, if I mix it any faster, I can make it thick. Cakes are fun. Wait, what? This is not gonna cover all of this, mom. I know, but you need color. What are we doing with that? We're gonna put color in it, like, in a minute. We have to... I know. Okay, so wait. Okay, so now we're gonna color. Yes. So, this needs to be your shoreline color. Okay, okay. Put it on your shoreline, because that's the lightest color you have. You need that to be your... I'm about to wash up on shoreline. Oh, my God, she's gonna do it any minute now. Back, Doris, all of the back. Yay, good job, Mer. This is it, Mom. Just out there somewhere. Doris says I can't see East Base, but I'm sure she's doing some kind of P.I. role. But you're gonna need to mix more color. Then put some of the turquoise color, but, like, a good few drops. At least 12ish. Don't accept it, and then... We need this to be darker than the initial two are. I don't know. I'm getting married to you. I know. Okay, every time. You can do just, uh, good deep... Like, this, they look wrong. Okay? Like, three inches ish. I'm gonna just test and see how good that color was. Now we're probably gonna mix, basically, more of this color. Mom, you can just throw custard. Throwing custard. We're doing a rock list. Yeah. That one in a complete list. Yeah, uh-huh. Curling ink are very different. Just squish it a little bit. She's just popping the heat out of the bubbles. That is in the resin that she just applied. She's not trying to melt it, or manipulate it, or move it. She's just popping the bubbles. The resin you have up here, the clear. See, Jen can tell you what the least expensive alcoholings are. I want to say they're, like... I can't remember. They're in a square bottle, and they're very not fun to use. How do girls name... But she can tell you what the best alcoholings are for the price. Also, Clara is really good at alcoholings as well. How patient with her mom? Then I am with something. Especially has for, like, teaching her how to use your phone. Well, my mom took her time when teaching me how to do everything. I use a spoon. Apparently, spoons were an issue. Also, stairs. I have to take care of her, and I look... And y'all know I have patients with people. I'm just filling in any dry areas up to your sandy areas. So, now you need to do the white lines. And I'm going to go fill the torch with the beauty. I'm going to go all the way across. I'm going to start off the piece and end off the piece. There it is. What's your technique of knowing where to add your white? Where I would like to see a wave rolling in. Okay. It's a wave thing. Sounds good. Here's your torch. I'll just add lines here. Probably add some more here. Add the thickness where you want to. Like, if you want, like... I like to add the thicker lines over the metallic areas because then the waves are going to break and show the sparkly blue of the cells. But that's just my opinion. I like the silver. It says lover accent. I don't care about accent. I think after we get all of this faded out anyways, we're going to do like a close line wave as well. So, we're going to work that. Do you remember how I showed you? Do you want me to do one? Okay. So, we're just going to tilt it back just a little bit and hit it with a torch. And we're going to just only leave the heat on there enough to make it move just a little bit. That's going to give us our prop and our back waves. We only want a little bit of movement. And then we're going to tip it back forward just to have it come back up so that you don't tip everything off. That's a good speed.  You have to sand it off. It's like a scab. It's not a good look. For this, you could use a heat gun, but that's going to blow it a little bit much. This is why I love it. My hair does do so much for stuff. It doesn't just look like waves over there with the chalk and the bubbles and the foam. Well, we were looking at that. Just love it. I don't know how to do it. That she came out here to do it? Yeah. I'm going to drop it down. Is he shooting me a video or something with what it looks like that you're doing? Like, she made a video of your process and we can fix that when you figure it out for you. I'm going to do a close-up for you guys in just a second. So that it has that big line right here. I'm going to bring you guys in first. Close-up. Y'all first time pour. I'm so excited. I love it. They'll know tomorrow. This is real sand. Y'all, I've been doing resin for like two years now and I feel like my mom just showed me up. I am Kim. So tune in tomorrow for how my mom did her base alcohol ink look and how she applied this sand. Can you guys hear it? I'm super digging this piece, mama. Now you got one. We'll seal it in. Cass, I didn't see your question. Bowie. You did an amazing job, mama. Thank you, baby. Love you. Thank you all. So you guys, I hope you enjoyed it. I hope you learned something. I hope you're inspired to create your own artwork. I'm so sorry that my boy's class for what? Please shoot me an email on that or just shoot me a text. I know you got my number. Enough babies. Anyways, we have a dinner appointment tonight. An appointment? A reservation? What is an appointment?  She's my inspiration. May I say hi? I love the fam. My mama. We love you guys so, so much. Please be kind to one another. You never know what someone may be going through and we will see you guys tomorrow. Tune in to see the first part of how my mom did her artwork and I will see you guys tomorrow. Bye. Mom, did you say bye?


Our next speaker is the first time at DEF CON. Michael Lanvig is going to be taking a dump in the cloud. So get ready. Please give him a warm welcome. Hey, what's up? Well, first of all, hi mom. Second of all, kind of excited, obviously. Didn't really think that Tyler will go through, but sure, we're leading into it. So the talk is called Taking a Dump in the Cloud, and it's more of taking a data dump from the cloud than taking an actual dump in the cloud, but yeah, we'll get into it later. So I'll start by introducing myself. My name is Melvin Lanvig. I go by the alias Flanvig online. I used to be a C-sharp developer. Now I'm a red teamer over at TrustedSec. I work at the target operations team. I'm extremely lucky to be able to work with such an extremely talented individuals. I do Twitch streams. I can't say I do them every Sunday. People are going to call that out. I try to do them some Sundays. I used to do them every Sunday. I don't do it anymore. I'm also a part of a Norwegian technical hacker podcast called Shellcast. If you speak or listen Norwegian, then maybe that's something for you.  I maintain the sharp collection and UMC fail projects. Maybe some of you heard about it. Maybe not. I also have some other projects that I've added to the GitHub over time. We're going to go through this as a story. I'm releasing a toolkit. I'm going to talk you through what got me started into the developing process of that toolkit and have it all began. It began back in mid-2020. I was doing an external penetration test against the customer. One of the things we do when we do external testing is that we perform a password spraying attack. Customers today typically have markers of office, so I was going to do a password spraying attack against markers of office. In my mind, such an attack is split into three different modules. You have the enumeration phase, the spraying phase, and the exfiltration phase. During enumeration, you'll try to identify as many possible email accounts which would be linked to accounts in the actual client's tenant as possible. Typical resources are Hunter I.O. I'm guessing a lot of people heard about that. It's sort of a database that fetches and collects emails for companies specifically. So you can go in, you can look up the company name, and you'll see the email and the email syntax. The email syntax is very important. We'll get back to that later. You also have the DHASH service. Now, DHASH is a breach database lookup service, and all of these services sort of live in a weird gray area. And DHASH has been stable for years. Sometimes they get taken down legal-wise. I mean, if an attacker can get to it, I want to know that information as well. So I can see that gray area fine to use in general. So DHASH is great. You look up the client domain name, and you'll be prompted with a bunch of emails that has been obtained from a semi-publicly breach databases. Then you have Google, right? Simple as that. Biggest search engine on the planet. You can use something called Google Dorks in order to find files and other information related to the company. If you scrape meta information from those files again, you'll have information about names and possible accounts linked within the company as well. And I think the biggest one out there, LinkedIn, right? And this goes back to the email syntax. If you have the email syntax of a company, if you know that the company uses first name, dot last name for their email accounts, then you know that the same J machine over at LinkedIn is going to have J and dot J machine as an email account, right? So if you put that together, you're able to come up with sort of a bigger list of possible email accounts within a tenant. So then you go over to the actual spraying phase where you pick out a shady password, like summer 2022 exclamation mark, which everybody still uses, even though it's 2022. And you pick out a service you want to hit that with. So, you know, typical ones are the actual cloud tenant, Office 365. Then you have some customers that still expose ADFS. They have some sort of on-premise indications, so they expose ADFS. You have clients exposing the outlook of application, the exchange, externally as well. And then you have the third-party identity access management and SSO providers like Akta, who sort of take over the federation of the users, and then you can connect other services and apps into that. So you'll pick a target and you spray, right? And then hopefully you hit a user with a bad password and you get access to something.  So this is what you do, and this is what I did. And what I did in the story, I got a user with a bad password and I tried to log in everywhere. And I was prompted with MFA, right? I couldn't get in. No matter what service, no matter what application, just got prompted with MFA. Except for one, Microsoft Teams. So when I logged into the Microsoft Teams desktop app, I was not prompted with MFA. And I initially thought this must be a bug. It must be something weird going on. But I tested it against that client and multiple other clients. And for some reason, they just had a major gap when it comes to the Microsoft Teams desktop client. And this fell through because of conditional access. So conditional access is a service that Microsoft offers for its users in its tenants that allow you to define certain conditional that will give you access or not. Hence conditional access. So say you try to log in from Europe. You won't get in because you're logging in from Europe and the company knows that we don't have any employees in Europe, so there's no reason to give you that access. Or if you log in from a trusted subnet internally, maybe they don't prompt you for MFA because why would you? You're on the internal network, right? You're already past the fiscal boundary, so sure, let's just skip MFA as well. So in the case I'm talking about, they misconfigure their conditional access policy so that the Microsoft Teams client could just get in without MFA. And my hypothesis about this is that in the actual user interface where you define conditional access, there was some sort of user experience mixed up where they couldn't find the Teams client checkbox or whatever because I found this on multiple clients within like a four month span and then it just suddenly go away. So I don't know if that's happened or not just throwing it out there. Anyway, I got into Teams at the time. I didn't understand that this was due to conditional access so I started just digging into Teams. I started reversing the API calls it made and I started looking at the network traffic that it generated and how it interacts with the Microsoft resources online. And I don't know if you can see the actual text, but this is somehow what that looks like. So if you're ever planning to dive into the network flow of Teams, there's two other processes that you got to know about. And those are Microsoft AADD broker plugin and Bracker and Taskhost. If you do not capture the network traffic from these processes, you'll have access tokens appearing out of thin air and you will use hair. I can actually just tell you that because nothing makes sense. But if you start capturing the network traffic from these processes including Teams, you'll start to get sort of the full flow of how it authenticates and what APIs it uses. So it starts off by authenticating you as a user towards the login.markstuffonline.com endpoint federated by Microsoft. Yeah. So it does that and then you get the access token back in what's called a V1 formatted token JSON blob.  That access token gets put in two places. So it gets put in the SSO off cookie and it gets put into a header called authorization with the prefix of bearer, which is very typical and follows the off standard, right? And then it's something where it happens. So you guys know Skype, right?  Skype is alive, it just won't die. And Teams knows this because it fetches a token called Skype token and reaches out to the teams.markstuff.com endpoint, gets the Skype token, puts that in a cookie and a header and then keeps talking to the Teams API endpoint. So my best guess would be that the Skype API is alive and that is just wrapped behind the new modern Teams API. So that's rather interesting. But this is the basic functionality that Teams would need. Once it got the access token and the Skype token, it could just access the basic Teams resources, right? One thing I want to mention is that during this first authentication attempt, Teams specifies a client ID and it will become very important. But a client ID is basically a grid string that defines the application talking to the endpoint. So you have one default client ID supplied by Microsoft for Teams and then you have other client IDs for different other applications. And again, I'll come back to this later, it's very important. So in preparation for this talk, I did this, right? And I tried to replicate what I did back in November 2020 but the results were different. Microsoft had changed something who wouldn't know, right? So when you do the initial access, you no longer get a JWT token in response in the classical VVON format that JSON structure. You get an encrypted string in return that turns out to be a JWE string which is a JSON web encrypted string or plain text. And inside that encrypted plain text is the actual VVON formatted token, which we want, right? And if you actually decode the first X or so length of that string, you can actually base 64 decode that and you can find the encryption algorithm that's used to be able to encrypt and decrypt it. But I don't want to deal with that. That's just too much of a pain. Again, Microsoft changed something. They didn't break anything from me. The old method still works. This is sort of just going into a bit of a side quest here about why they would change this. So they changed their default authentication flow that was used before into something called an on behalf of flow, which is just different than used as the JWE. And if you read their documentation about this, they state that do not attempt to validate or read tokens for any API you don't own. Tokens from Microsoft Services can use a special format that will not validate as the JWT. That sounds awfully similar to what we just found, right? So, threat, challenge, I don't know, sounds like a challenge. That's what it sounds like. So if you take a look at the documentation again, we can see examples of the VVON formatted token. This is what it's supposed to look like. This is what it looked like before. And notice the VVON, the 1.0, and then we go back to the request that is now changed and we see this, 2.0. 1.0, 2.0. Yeah, if you change that back, you're good to go again. So if you take the initial request and you just downgrade, you just change the parameter from 2.0 to 1.0, you will get the good old VVON formatted token back and you can actually understand what's happening, which is quite fun. Sadly, we don't have time for this. This isn't what we're going to talk about. It's just sort of a side quest explaining that I was preparing for this talk and they changed stuff right before the talk and it's still silly, but... Okay, back to the main story. So we logged into Teams, right? Teams got two access tokens so they can now do basic functionality. This is said basic functionality. So you have the chat module and you have the Teams chat module, which is Teams, you have the PowerPoints ending in Microsoft.com and then you have two other modules, right? You have the calendar and you have the files. And files, that's one drive. And calendar, that's Outlook. So how does Teams access this without me logging in or accepting a redirect or anything like that? It just has access to it, which at the time was really interesting. So if you take a look at the network traffic, you can actually see that it sets the ground type in the parameter as refresh token and it supplies the refresh token from the old resource, specifies a new resource and then you're able to go into that resource or get a new access token that can access that resource without doing an interactive sign-in again. And that's actually... So Microsoft is bending the OAuth 2.0 specification pretty hard here. Like they're just saying, no, we don't want to do it like this. We're bending it pretty hard. Because if you look at the scope there, that list of permissions is huge. And this is directly tied to the client ID that we talked about with Teams. Every time the Teams client accesses other resources using this technique, using the refresh token ground type request, they just get a metric ton of scopes and permissions for that resource. The Teams client can send emails on your behalf. They can read and write emails on your behalf from your Outlook instance, which is very interesting. And that refresh token request or that, which we'll get back to, which is a non-interactive sign-on, looks something like this. So what happens is that the Teams client takes the access token that it originally required when you logged in, typed in your password, you get an access token. And then it sends that back up, that actual access token using the ground type refresh token, and it just gets a new access token for a new resource. It's magic. It's absolutely magic. And this is a non-interactive login. So there's two type of logins in Microsoft AAD, right? You have the interactive logins, and then you have the non-interactive logins. If you go to the Azure portal, the AAD section of the Azure portal, and you go into users and sign-ins, you can see two type of sign-ins. Again, non-interactive sign-ins and interactive sign-ins. Interactive sign-ins are when users login using password and username or some other form of authentication. Non-interactive sign-ins are when an application accesses other resources just like Teams does. And this is what that looks like. So you can see that the Microsoft Teams application is getting access to Microsoft Graph on behalf of that user. And this is already interesting. And just recently at Troopers this year, some individuals over at SecureWorks released a research called Family Refresh Tokens. I got to give a huge shout-out to Ryan from SecureWorks that's detect.dev at Twitter who helped me validate some of this and really his research sort of put words on what I saw at that time. And I know many other internal researchers also looked at this previously, right? So what Family Refresh Tokens describes is certainly that a refresh token for one application from different client IDs can refresh into other resources but that you can also change the client ID and get even more resources for other applications. I won't go into it, but I just take a look at this read it ten times, ingest it, right? It's one of those things you have to ingest multiple times. It's awesome, absolutely amazing research. I can't wait to see what others will get into this toolkit as a result of this research as well. So, no one's going to probably wait too fast. So just to recap here we dived through teams, we understood the network traffic, we got the access tokens, we understand how teams refreshes using its access token into other resources using non-interactive sign-ins how can we abuse this? What could possibly go wrong, right? So initially I started creating something called Azure Active authentication library, AVAL, or SHARP AVAL, because AVAL already exists and it would be in the mindset it would be a C-SHARP library that simply takes a username and password or a session and just dumps everything just exfiltrates all the data and its initial infancy it only did one drive. So you would give a username and password to the application and it would just dump, actually download the entire one drive directory of the user, right? And it was for initial access you could download files and you could take a look at them and possibly gain further access based on the contents of those files, right? But I didn't think it was good enough, I didn't think it was I wanted it to be more a wholesome toolkit that you could actually use from start to finish than just the data exfiltration part. And that's when I think Alvar helped me came up with the name team filtration. And that's the actual toolkit that's been released today and I will push it up once this talk is over. So team filtration is a C sharp application that is cross compiled so it can be ran natively on Linux, Mac and Windows that streamlines the whole animation spraying exfiltration post-exploitation activities when you're performing a tax against the Microsoft Office 365 cloud. And I'll talk I will talk way more about it but some of the key features and I know this text is probably way too small but key features is that filtration is strictly database oriented. This means that you will not end up with 25 text files with different emails and different passwords and different combinations on your desktop and you're done using it, it's all stored in a localized database. Similar to Crapmap exec and various other tools right? And the plan with this was to automate and make the tools smart. So when you do initial animation, the tool knows what the counts was valid from that initial animation attempt and it will store those files. So once you go over to spraying, it already knows which accounts are valid and you can spray those. You don't need to provide a new set of list of usernames, it's all stored in the database. We'll talk more about it in the next slide. It also has Firefox integration so still the only viable sort of effective alternative against Azure smart lockout is just rotating IPs which Firefox does quite a brilliant thing. So it has built-in Firefox integrations to make sure that every spraying attempt IP, it has built-in dhast integration so that once you do the initial animation, it can simply just pull the records from dhast to give it an API key and it can add it to the database as valid emails. It has pusher integrations so you can get alerts and notifications when you compromise an account or when multiple accounts are locked out. It has auto magic password generation and user generation. We'll get more into that but again at least for me, I don't know about you guys but every time you do an external way, you have 40 or 50 passwords that you always go through and there are almost, oh wow, I have a search. And there are always the most common ones. The summer, the months, the typical password one to three is like it's all the common stuff, right? So there's no point of having you generate that every time depending on what time of the year it is. It can just do that for you. The same goes for user integration and we'll talk more about that but it's basically just using brute forcing users by using statistically likely user names, right? Which is a very common technique. And then sort of the bread and butter of team filtration again is the extra filtration capabilities. So once you compromise a user with team filtration, this is the data you can actually pull from that user. You can pull all the teams, chat logs and attachments as well as contacts lists. So every chat, every message your user or your target has ever sent on teams, you can pull down and you can easily grab through locally on your machine. Same goes for OneDrive. Every file the user has in its OneDrive, that includes both files. It has added files, it has been shared or given access to but in OneDrive you can pull down and take a look at. Same goes for Outlook. Every email as well as their attachments can be downloaded and take a look at. And then you have support through to pull data from the graph API which is basically domain information, users, groups and some basic tenant information. And there's one module that I'm excited to talk about, that's the backdoor CLI which we'll talk about at the end which is really cool. Technically I don't want to claim MFI bypass or whatever but team filtration has the capabilities to enumerate the conditional access policy applied. Basically it brute forces using a bunch of client IDs and resources and once it gets on the inside it can try to refresh out again. So you only need one gap in your conditional access policy. Once you get in it can try to refresh your account. And then yeah it just heavily abuses refresh tokens. So this is sort of a simple explanation of how it works. So team filtration has a centralized database that is stored on disk. It uses light DB. Once you start using the enumeration module every time you find the valid email account that data is stored in the database so team filtration is aware of how many valid accounts you have enumerated. Once you go into the enumeration it will keep track of when you sprayed, what password you sprayed, what the response was. If you have false positives during the enumeration phase and team filtration finds this during the spraying phase it will correct for that. There's honestly so much logic in here. I don't keep track of it anymore but there's a lot of fun logic in here that really helps and sort of I feel makes this attack more modern than it usually is. Again you don't need access. Hopefully team filtration will store the access token in the database. It will keep track of multiple access tokens for different resources so that once you ready to exfiltrate you won't sign in again. It will just use the access tokens you got when you successfully sprayed it and logged in the first time. So again a bunch of logic in here that makes this automated and easy. Let's take a look at the enumeration module what that looks like. So within the enumeration module we have different options. You specify I think the non-optional ones are the dash dash domain one. And then you have to choose some sort of validation techniques. So you specify domain. Let's say trust us at dot com if you want to attack them. And then you choose the validation method. So out of the box team filtration has three validation methods. Validation methods being methods of validating passive. One of them are active meaning that they actually show up at the client's end point. So if we take a look at validate login that will just simply attempt to log in and that will obviously show up in the tenant sign in logs. That is the most accurate way of determining if the account is real. Just attempting to log in taking a look at a response it's real or is it not. And then you have the validate MSO which has been heavily abused for years since the get a credential type post method that everybody like most tool uses basically. And it is heavily rate limited and heavily starts to give out heavy amounts of false positives. And then there's validate teams. Now this is something that we've been using internally for quite a while. And I think somebody I think I saw it becoming public or whatever like half a year ago, eight months ago. And basically what the validate teams method does is that given a sacrificial 0365 account it will log in, attempt to get to teams and then use the search function in teams to look up users cross tenants. Again that depends on the tenants configuration but this is still extremely overpowered. You could easily do 300 lookups a second without getting rate limited or by giving massive amounts of false positives. And then again this is that's sort of the main bread and butter for the innovation module. Being able to use validate teams. And then you can pull domains from the hash. You can just apply your own list of usernames if you don't manual all since. I don't want to make it hard. I just want to make it a bit easier. In action using statistically likely usernames. So there's this awesome GitHub repo. I think I'll link it at the bottom. That's called statistically likely usernames. And it contains multiple text files of common first names and last names in the US. So instead of doing the hard labor of finding targets online you just brute force it. So team filtration given a domain and given a syntax will pull down, it will generate possible emails and it will brute force those emails. Again just the validity of them. Not logging in using the validate teams method. And this has proven to be extremely effective. And that's just what that looks like. Then you have the spraying module. So not going to go through all of the options but the spraying module does spraying and you have a bunch of different options to use. So if you want to generate passwords only for seasons, only for months or if you only want to use the common stuff you can specify that and it will generate specifically. If you want to supply your own password list you can do that. I don't think I've seen this anywhere else but if you want to hit the I call it the US cloud. I'm unfamiliar with the exact name of it but some Microsoft tenants are under the .us domain mostly because they're government and if you want to brute force some support for that. As well as the AAD technique that Secureworks found that doesn't show up in logs. And then you can define sleep. Sleep means sleep marks delay. You can get push notifications. You can force spraying even though you get locked account in return. I think the spraying module is pretty standard with everything else. So this is what it looks like. You do dash or spray. If you don't give it any parameters it will set a default sleeping time. And it will start spraying. Then the exfiltration module. Now this is again the bread and butter of the infiltrations. And there's multiple ways to get just use the exfiltration module. So you have three options. One, you could use the account that you compromised that should be in the database. Use that and it will just run up with no options and it will allow you to pick what compromised account in the database you want to exfiltrate data from. You could supply your own and you could also provide the cookie. So I'll have a demo later where I'll demonstrate using that sort of in a red team scenario where you already compromised the host and you want to just pull the cookies. You can give team filtration the cookie and it will use that to pull all the data which is super handy. And then you can specify what sort of data you want to pull. You don't have to pull all the data at once. You could pull if you just want to pull AAD or if you just want to pull access AAD. That's what that looks like. So in this example I said I want to exfiltrate emails and I want to exfiltrate OneDrive and it dumped 28 emails from this test account and it also dumped out the OneDrive directory and stored that to disk. Again, so it's really easy to grab through it and find it. And then there is another module that isn't included. That's called the database module. The database module is simply a way to make it easy for you when it comes to reporting. So the database module allows you to export information from the database that might be relevant. So you can get a full summary of when you started spraying, when you stopped spraying, what password you used, when you did that spray, what user you target, what combination of user and password you used. All that fun stuff that a client might have asked about. You can just pull that and you can put it out to Jason or CVS or you can just show it in the terminal. Okay, I am way ahead of time. Let's do the demo one external testing. So this demo is just sort of a use case, basically my first use case. You're an external attacker, you want to password spray and gain loot from Attacking Microsoft Office Cloud. Let's see if I have that. So this is a start-up, so hopefully you can see the top portion there. So that's infiltration. I'm giving it an output path where I want the potential data that I gained from this stored as well as where the database is. Every time you run infiltration you will need to give the configuration file with standard value. Can't see the top portion? Oh wow, okay, interesting. Two screens then, right? I'll probably break your setup. How about now? Awesome. Okay, cool. Okay, so again we're starting up the infiltration. You guys can see the command line at the top right. You can see the actual command. The output path which is where you want to store all the data you potentially get from the infiltration attack or and also where the database is stored. You have to provide it a JSON configuration file with some values that the infiltration needs to run. Stuff like the fire proxy or else you want to use, the D hashed API key you want to use and stuff like that. I'm telling you to go into the iteration module and that to take the user names from my own text file that I found using OSIN, right? I want to validate these accounts using the validate login method which is technically just attempting to log in, spraying basically right in the iteration module. So we'll do that.  And then I'll try to go straight into the spraying module. So now something is going to happen. It won't work. So I go spray and I type enter. And why doesn't it work?  So I want to make sure that you know that you are now attempting a second route of login attempts and I'm stopping you unless you give it the dash dash force parameter. Again, this is logic that is possible because we have the database. I know when your last login attempt was. So I don't want to risk you starting to log out of account so I'm letting you know hey, sorry you can't, you have to wait if you want to keep spraying. So that's what's happening here. Since the last spray. And if I want to get around that I have to use the dash dash force parameter. And that's what I'll do at some point. There we go. And then it does the spray and then hopefully we'll have a compromised account. So there we go. So we have an account. It is the one and only BIFTAN who has the password of January 2022 and he doesn't have an MFA. So we'll move on. Now I can, I mean once you compromise an account then it's sort of the easy part. So now we can just do dash dash X fill. Kind of annoying that we can't see the bottom line. So I did dash dash X fill dash dash AAD and dash dash OWA. So AAD to pull the domain information from the graph API as well as users and groups. And to be clear that's all the users in the AAD tenant. I can pull once I got that access. And then dash dash OWA to pull the emails. And now something interesting happens. What happens is that a team infiltration knows that you are pulling the AAD and he knows that those users, we might want to spray them. So it takes the users from the AAD X fill and it puts them back into the database so if you want to go back spraying you can do that. So you know how all the users in the tenant automatically add it to your database and you can start spraying them. Again, some quality of life improvements. So it got, you can see it here, it got 134 AAD users appending those to the database of solid users. And if we go into the directory, we can see that we should have a bunch of emails as well. So emails that you expelled using team infiltration are stored as HTML to sort of preserve the format. And then the attachments are stored in a separate directory as well as you have a pure JSON file that's called all emails that will just have all the information as well if you want to play with it. And that's the external penetration portion of the infiltration. Thank you. Thank you very much. But that's so boring. We want to do red teaming, right? Everybody wants to do red teaming. So let's show an example of red teaming. So this is the red team example. Please show up. Here we go. And in this example you have already compromised the host through phishing or whatever. And then you're on the host and you want to exfiltrate all the information without doing unnecessary stuff, right? So you dumped the cookies through some method. In this example I'm just using the C sharp tool, sharp chrome to dump out all the cookies from edge. So I'm just showing that I got an active session with Bruce Wayne and that I'm logged into teams and I'm logged into his outlock in the browser, right? I know I'm bad. I know he is Batman. And then I'll dump the cookies. I'll type it out just to show that we have a JSON file of cookies. That was a bit quick but basically I'm just leaving team filtration that cookie dump, that text file full of cookies. I'm telling you to exfiltrate all the loot and then you should be able to take that cookie file and do exactly that. So it starts refreshing into different resources and then it's dumping all the information, right? And now you get to see what the team chat looks like. So once it's done dumping got some zip files. I probably cancelled this, right? No, I just leave it. So I go into the directory of the output and then this is the information. This is what it looks like when it's dumped. So you can see attachments, contacts, conversations, email attachments, emails, one drive, one drive shared tokens, all that good stuff. I go into conversations and this is the text files containing the raw JSON outputs from the teams chat logs. So I can go into them and I can be trying to find the file and I can see the conversation. I can see that Bruce Wayne started talking to Odvar and said hi Odvar. Told him he was Batman and now Odvar knows I know you're Batman. And this is great because you wouldn't believe how many passwords people put in teams. And it's so much easier to grab it out this way than to scroll through the thing forever. Quality of life improvements for sure. Cool. And then emails, one drive that files downloaded from the one directory. It keeps the same structure. Yeah, cool stuff. And that's the red team demo. And then I have one final surprise demo for you guys. It's the backdoor demo. Thank you very much. And the backdoor demo is really interesting. So one of the things that is sort of a red team wet dream is that once you get initial access externally you would like to move on to a host, right? You would like to vertically move on to a host, right? And how do you do that? Well, so we have control over one drive, right?  One drive files are usually synced to the computer of the individual, right? I don't know about you guys, but how many here have seen the desktop folder been synced to one drive? Okay. Okay, it's not just me. That's a good thing. Well, what is in the desktop folder a bunch of shortcuts? So I created this sort of CLI interface for one drive that allows you to modify and replace files within their one drive remotely so you can backdoor their files on the desktop or in the documents folder. So, okay. This is a bit longer demo, so. What you're seeing right here is the perspective of the victim, right? He has his desktop and he has this Microsoft document that is his daily notes. He uses it every day to keep track of notes from his meetings or whatever else, right? So he has that synced to his one drive and then this is the attacker's perspective. So in this example we already compromised the account of that individual through whatever means. And we run the backdoor module. The backdoor module will prompt you, hey, what you used to do on the target because you might have multiple users if you're lucky, right? That you can target. We'll pick out BIF and then the infiltration will access one drive and it will list out the files and folders in the root directory. And it will sort of give you a semi-interactive CLI that you could use to navigate these files and folders, pick out the files and folders that you want to use to navigate that. You know, the individual here has a daily notes file in that it was very recently modified. In my mind that's the saying that, oh, he might open this tomorrow as well or he might open it the coming weeks, right? So just typing the help command to get some help and then I'll type replace. The file index and then the file I want to replace it with. So in this scenario I have created a malicious macro document that I would like to add, index 5, copy as path and then go. And then infiltration will delete the file, give it a few seconds and upload it again. Now, you would be amazed how effective this is and you will also be amazed that there is no notification from Wanderer's perspective when you do it like this. So just look here. I'll zoom in and then suddenly it's a macro document. That's it. There's no notification in the bottom right and the next time he opens it, it's now an effective macro document. Yeah, and that's basically it. I think I ran through it way too quick. The project will be online on GitHub as soon as I get off the stage and get a coffee and then I have to give a major shout out to detective.dev from SecureWorks validating a lot of the stuff I found making sure I wasn't insane, making sure I didn't end up saying weird stuff and I have to thank the entire Rust exec team who has been helping me polish this tool for well over a year so thank you very much and enjoy the last day of TestCon guys. I think I'm way ahead of time so I might just do questions here right? Questions on the side. Questions on the side. Thank you very much. Thank you.


Hi everybody, my name is Daniel Loh. In this demo, I'm going to showcase how to use SSH credentials to connect to remote the SSH repository using JVS-EAP740 better. Let's get started. In order to save my demo time, I actually already installed JVS-EAP740 better.  For example, standalone-fullHA, standalone-HA, and standalone.hml. So we're going to start JVS-EAP instance using default standalone.xml. And once it started, you can find the right version. As you see, EAP740.better, version EAP just running on my local machine. When you go to admin console, you can find some kind of this message, because we don't have any management role or credential at the very beginning time. If you want to access the admin console, you have to create the management role and credential as well. We're going to do that actually a little bit later. I'm going to stop the running EAP. So next step, I'm going to run EAP once again with the SSH credential. To do that, I need to generate the key pair store and also a credential store. So luckily, JVS-EAP provides an electronic tool which allows us to create the credential store. For example, here is the credential name is cs-underscore, example cs-file, which is a credential store, which allows store key pair with a specific algorithm, for example, RSA algorithm. So let's try to create a new key pair to store in that credential store. So we're going to use an electron tool once again with the algorithm RHS and the specific size. And once we create the key pair, we can find our public key using an electron tool here. So just copy the public key and go to your developer project, for example, in my get report and go to setting. And then you can find the SHN GPG key menu and create a new SS key. You can just paste that your public key. Just create that from electron script tool. But I already created that for the demo ahead of time. So go back to our console. And the next step, we're going to create the wildfire compilation, which we need to refer that key pair we just created and store in greenage store. So here is the old default compilation. I just copied from cheat sheet. The one thing you have to do that, we need to actually use absolute or relative path, specifically under b-injectory. So once we create the wildfire compilation file, here is my compilation repository, which I wanted to share with my developer team. As you see, there was the sample text file, like a test.txt file. And also, I already printed my one of the credentials as a management property. So I'm going to use this compilation repository using SSS Git repository, based on SSS credential. So I just copied a ripple URL and the Git branch is main. And also, I'm going to add one more parameter, Git auth, with the wildfire configuration XML, we just created that. So you can actually use the Py protocol, but also the URL protocol as well. So when you run this command line to execute this EAP standard load server, you can find your old compilation will be pulling down from Git repository rather than use your local directory. So your EAP is running on well. And then let's go up to the logs. And then we can find that actually here. All right. Okay, here we go. So the compilation history managed through the Git, which means your compilation override from your Git compilation. So let's try to open another terminal window and try to go to a standalone compilation. As you see, the text file, just pulling down and just take a look at that inside the file. And then that's SSS authentication we just saw in my Git repository. Okay, pretty cool. And then when you go to admin console once again, and now we just log in based on my credential. This is one of some browser caching, but the Daniel low, I just added that credential on my management wall as you saw in my Git repository. All right. So one of the beauty of Jbos EAP 7.4, you can actually make a snapshot and also push that change to Git repository directly without using Git command line. So as you see, the there's no snapshot at this moment and try to make some change here, a compilation directory. So I just tried to remove standalone full hma.xml because I don't need to use that we in my developer team. And then I just deleted it and then go back to Jbos CLI terminal and try to take a snapshot with the name. Let's say the snapshot one and then comment, remove configuration. So you can actually take a multiple snapshot as well. Okay, I just created a new snapshot and the list the snapshot and we have a find the one snapshot here. If you try to make a multiple snapshot, you can you can actually publish that. So publish configuration with the location. You can have you can print the already Git repository with authenticate the SSH credential. We just outcome success here.  You can find that the limit configuration, there's no ha compilation at this moment. Okay, so next step. So let's say we have a multiple developer on my team. And then I want to share this compilation with the different the other developers. So in order to do that, we're going to use the cloud name environment like a core ready workspace. Here's my sample application. As you see here, the dev file already defined in the git repository.  So click on developer sandbox. This is hopefully for developer ready to provide. So you can actually run developer sandbox and go to core ready workspace from open container dev UI, but you can actually spin up the core ready workspace directly with your specific git repository. So in the meantime, you can find the core ready workspace. If found your dev file from your git repository, but also there is a bunch of stuff. In the meantime, let's try to go to dev file, take a look at that. So here is the project name, kitchen sink, one of the quick start example on the javas EAP. You can actually report to git repository for resources directly, or you can have a G file as to your source. And I'm going to use the Docker image component to run javas EAP 74 beta and the here is just some environmental value, such as maybe an option and Java option. And the one thing you have to do that you need to export and point to access application presentation layer, but also you need to pass down some specific javas option. For example, here, the git report, git branch, git also just like we did on my local machine. But one different thing is we're going to use the HTTPS protocol URI because previously we just file protocol, but you can actually use URI command line. And you can also add some command. This is one of the beauty of dev file. So we're going to take a look at that once core ready workspace is started. Okay, just call the ready workspace started. The left side in Explorer navigator, you can find exactly what kind of project from pull down from git repository. So here is a Java project just like your entire project application.  And then when you open your tool and they just you can find the open a new terminal here. So first of all, just to make sure this application and the EAP already running inside the core ready workspace part. So take a look at that event valuable. And then with the javas searching and the javas EAP version here 740 dot beta. And then go to standalone computation directory. Just to make sure they share the combination already pull down as you see the test dot text file. And there's no standalone full hma xml. So now we have a same developer team, but one is from developer in local machine, the other one develop on cloud based ID tool. This is a more clouded way. And then let's try to build this application. Let's say I just create some application and bug fix, et cetera. And then before that, when you go to EAP endpoint, as you see the this is your admin console landing page, but unfortunately the javas EAP admin console is not available in a container platform, which is a developer sandbox running an open shift as well. So try to build this application. So let's try to hot deploy. This is one of the beauty of the javas EAP feature. So your EAP is actually running. But at a time, we can deploy the actual application. The first of all, this is a Maven project. That's why we build a Maven packaging. In the meantime, when you go back to open to developer console on developers and boss, you can find the EAP low, just like the EAP 740 beta is running. Okay, so our application build just complete. And I go to terminal window and try to make sure your wall file is deployed into your EAP. So as you see, root wall file is just deployed. And just go to endpoint here. So we have a new application just deployed in the meantime as part of the hot deploy behavior. So try to add a new name just for fun. So my name is Daniel and my email address and just my fake phone number and the register here. So new data is just stored and you click on REST for API. You can find the data based on JSON format and you can find all data here. Okay, so one thing maybe you can go to code radio space and dev file configuration. You can find all dev file detail just like we saw in the proprietary application. Thank you for watching. Have a good rest of the day.


There are two ways to rearrange or relocate tabs in your workbook. First of all you want to left click on the tab you're interested in and then hold down the left button after that until you see the page icon and then just move it in the direction you want to go and then you'll have to play with it there to, I want this in front of sheet two, I let go and now it's relocated in front of sheet two. The other way to relocate tabs is to right click, click on move and it'll open up a dialogue and it will show all of the worksheets, pick the location you want it, I'm going to put it in front of salary so I click salary and click okay and it'll move it precisely to that spot.