What's up everybody? Jason for jazzymscasebreaks.com 2021 tops chrome baseball Jumbo hobby edition hobby edition jumbo sold out a box case break pick a teams number one So again all card ship eight boxes per case 12 packs per box 13 cards per pack You get five chrome autographs per ht a box ht a box So again, if you have a little character sign in the internet name that means you want that in a little filler There you go. All right, so here's the eight boxes No, Jeremy. So like I was telling people earlier is that The first six pick your teams We're part of our first initial wave and I was told that we weren't gonna get anymore until maybe tomorrow or Monday But I guarantee you maybe Nick did find some more Locally closer, but we probably had a pay up. So just like anything, you know The first handful of pick your teams or whatever they're paying on how many we get are always gonna be a little bit Better priced in the next couple after we have to repost only just because we had to pay a lot more to get it I've got pavin smith to Ryan's very very bad diamondbacks that he got in a team filler and Keep a release refractor So yeah, I had nothing to do with like yeah, we just mess with you guys and the prices is going up to Have them go up. It's just I pay a lot more to get it. That's all in the prism tank Oh the prism team all filler nice No problem, man Yeah, I didn't even know it was posted Chris. Nick just texted me. Hey, I found some more spectra and Guess we'll be getting some later today so Definitely want to fill up that spectrum number four though, just because I feel like there is something monster is hiding in that second half But yes, you can start buying up The next couple the grom and we got a Jordan Paul away Kettle Marta Lorenzo King David Peterson Consulin Joey Barks and a Adonis Medina to 399 Yes, Trump ski and Adonis Medina for the Phillies autograph Number to 499 Phillies. It's going to Fred Brian Hayes Chris sale green tonight and I Grisham boy Jose Martinez or Jose Ramirez are jazz Tati's Kunia Kepler Albert of Ray for the Yankees When a Sean Freddie Freeman he'll long though and did a Gregorius Number to 199 Kroner worth judge refractor Tati's and Louise Patino Blue wave to 150 Next box shit's flying guys Gotta learn play with a whistle, buddy. There's just one box You have eight and you say you have them in the next two breaks as well Definitely can't judge a case off of its first box. I don't have that positive mentality Joe Adele Zach McKinsey Tati's and Louise Patino To what 350 Louise Roberts Stalker's and Brian Garcia for Detroit Louise Garcia rookie refractor Pearson Ramirez judge and We got for the A's horrible refractor James 79 out of 250 Capri Ellen His cars do look sharp though. I mean chrome is always nice Hater and we got a Texas Ranger Kyle Cody Randy Rosarino Joe Adele.  Yeah, no problem. I'll go back and get him honest mistake Carlson Rodriguez Muto Delback Did a modrigal get his like whole growing ripped off of his bone legit. They said They had like a very nasty torn groin Or like it was like meat off of a bone next box guys. They definitely do yeah, don't worry man We have a list of which rookies to pennies even top load as well, so We're gonna follow to miss some Better on that list. They will definitely be Definitely be Tanky than top load bow guards and Cody Whitley St. Louis. That's a purple to 250 Barts Boom Lattie crown and word that looks like a little hyper. I forget what they call this one. It's a refractor Hashey to 299 Yeah, deep water. I guarantee we're just gonna end up with just the Lakers and bucks again Mark Matthias for the Brewers Paul last one. I'll just show you a Tani refractor Tantees and our first negative Ronald Acunha jr. There you go Tanaka and another James Capri Ellen Dylan Carlson for the Phillies All back Nick Heath for the Royals keep a Ruiz Ricky refractor Mount Castle George in the showhead of Tani Showtime 25 out of 399 Mount Castle and Shane McCallahan for the Rates When a Jonathan Jackie Bradley jr. Well, we'll find out mr. Flyer Hawk in In 2025 I think there's a lot of questions to be answered and there will be in the next four years and I'm pretty sure but it's soon before that we'll find out exactly But maybe nothing if an addicts buys tops and it's the same thing just fanatics now owns them or Tops just continues to do everything else but baseball that's pretty much it. I mean We'll find out soon That's another thing and I think I think they're not gonna I mean unless they just hire a ton of people respect you on the hobby that created products and Stuff like that and they really just do their own thing, but I yeah, I don't think that they were just going to it just just on their own they'll create partnerships or like you said buy certain companies or Have an exclusive partnership with a certain company etc etc I think they've had a plan all along Jordan high for the ace cash a cronin with purple to two ninety nine and Monter Harrison autograph Tauti's refractor. Oh, it's here for his gold and TJ The Cincinnati Reds 14 out of 50 gold Mitch White for the Dodgers Christian Javier, I know people you love that right You love it love it love it Tauti's man, this is a big color break for you people's 61 at a 99 is he card number one? What an honor Carlos Hernandez for the Royals All right guys, we're halfway through our next half. Oh, is it really sick? So remember guys, we are also really close on specter. We did put up another specter break as well But we are getting close on that So you can definitely get that rolling the next jumbo break is already in single digits as well And then seven left in the next elements break and we're down to three left in the specter basketball break Let's get that rolling first autograph here is roll Ramirez for the Cardinals trout Tauti's Blake Taylor purple for the Astros To 250 I with that one Casey Mines that green key kroner worth Julian Maryweather bone Tauti's under shrub scrub and a show hail Tani To 350 this time and we're adding those up to Nate Pearson refractor Ricky Johan Ramirez Refractor to 499 for the Seattle Mariners. All right through my boxes. So guys after this, I'm gonna have to go through about like 50 orders guys 50 orders Stuff is starting to fly Carlson step on Florida to the Yankees. That's a rookie there to Brian Hayes and Kevin Newman 350 you got sterling sharp for the Washington Nationals Transcretion Devers and Gio Yercella at a 99 and Jamal Jones angels Madrigal Madrigal hyperge Porta Mateo Padre's autograph Really Castro refractor Wilson Ramos for the Mets blue 150 Tauti's trouts Jazz and Seth Elridge or Elige. Sorry, I don't really see the font really that good to 499 for the Cardinals Jeremy with that one. All right two more boxes guys Pielondo and a blue Jorge Guzman number to 150. We have Andrew Ben attendee 299 Luindia's autograph Trevor store Porta Mateo autograph Luindia's and Eleg bone to 99 Madrigal and Taylor Jones Little aqua 299 We have sterling sharp on Soto to 399 Yeah, let's get that done guys. I really want to get that one done You know if the other pick a team sell a little bit later with Sean That's all guys. I'm just very curious to see what's hiding in those last two to be honest man It's got to be something in there last box guys So freak takes about roughly around 45 minutes or so this Chris. It might be it might be ending up in my my place by mistake Loft and transit redirected. All right last box guys. We'll do a quick recap at the end of this break as well now in castle Pavin Smith refractor To 499 316 out of 499 Kache There's Madrigal Adele Brady Singer shirts and Apostle Texas Rangers Tyler Winder Matt Foster White talks it's going EA Carlos Santana to 199 Bart refractor. Oh, and this is a nice one Tristan McKenzie for Cleveland Next over 35 out of 199. Yeah, she's been pitching great, right me Alrighty guys, well, there you go That was the break So of course everything will be shipping guys no matter what I Digged a bunch of nice color here for a lot of different teams of course But nice boom right there Show you a tiny was a nice color right there boom again tauti's tauti's color Cronin worth Show you tani Eli heaven is there might have been some other color hiding in this stack here as well Think after a while I started collecting all the color together So just wanted to keep it together there a lot of rookies, of course Bigger players to be top-loaded, but here's some more color for you guys there and Then let's quickly go with the Autographs and just to shorten up the time of the video, of course I mean I would have toppled it on but just to shorten it up a little bit We'll topple it all the autographs right now. We've got that Tristan McKenzie. We got the Pavin Smith Matt Foster Taylor Widener Sheridan Apostle Pavin Smith again refractor this time Sterling Sharp Taylor Jones For him a tail the Wendy is You got the George or George Guzman or Jorge Guzman Seth Ellige for him a tail again Jamai Jones Sterling Sharp again Devon Florian Ramirez shrub Mary weather Blake Taylor We got roll Ramirez Carlos Hernandez Mitch White TJ Anton Monte Harrison Yonaheim We got Shane McCallahan Heath Corellian that's a negative that's our only one Mark Matthias Cody Whitley We got the Valdera Rodriguez Kyle Cody James Carpe Allen again Brian Garcia attack McKinsey Louie Spatino color Albert Abreu Adonis Medina and Holloway so they go guys that was top scrown baseball eight box case break picker team number one on Jaspis case breaks dot com


Hey, guys. As you already said, I'm Zach Faisal. I may talk a little fast, so if I get way too fast, slow me down. So I'm a pen tester by day, DJ and photographer by night. You can find me on Twitter at ZFaisal. People always ask me what are your credentials, and well, there they are.  So, yeah, I mean, judge me based on the quality of this talk, not based on a list of certs. So, quick shameless plugs. We have a little competition going on right now. There's another talk in track 4 going on from people from Chicago too, and we're all from Chicago, so I need a quick show of hands. How many people here are from Chicago? I think I lost the bet. Damn it. Also, poolside tonight, I'll be DJing in a battle against Keith Myers, so if you're around here tonight, come on by. ThoughtCon's a conference I run in Chicago, another hacking conference. We had about 500 people last year. We're looking to grow a little bit this year. More info at thoughtcon.org, and my local homeboys are the 312 crew. So, TLDR, what does this talk about? So you don't spend the next hour here listening to me ramble. We're going to be talking about NTLM relaying. Not past the hash, but NTLM relaying. I'll touch on the difference in a second. And really in the end, a new tool set to do cross protocol relaying of NTLM authentication requests, as well as new methods to go ahead and get clients to automatically authenticate to us, and new targets we can relay these hashes to when we do the cross protocol relaying. So let's talk about NTLM. We're going to do a quick refresher for those of you who don't know what NTLM is, hopefully in less than 10 minutes, any longer, well, it'll be a talk about NTLM 101.  It's Windows password storage and network authentication protocol used in Windows, obviously. So, like I said, it was used for password storage and for authentication. So, goddamn, my slides are out of order. For past the hash, basically, oh, God, I need to jump around. So, hopefully you've seen this. These are the hashes for LM and NTLM. The LM is split into two 7-character chunks, all capitalized. So, we all know LM's bad, LM's weak. I'm not going to spend hours talking about why LM is bad. You all know it by now, hopefully. If not, Google. And then NTLM hash, obviously, is case sensitive, unlimited length. It's not 7-character chunks. It's a little stronger, but still has its problems. So, there's a few problems against it already. With LM and NTLM network hashes, there's a weakness we know as past the hash. This talk isn't about past the hash. Oh, wait, this is really out. Sorry, I'm sorry, guys. I just did these like five minutes ago.  We've been over this.  Not just the password hashes, but the authentication going across the network. It's used for remote authentication requests against varying services. And we'll touch on those services in a minute. And it comes in a bunch of different flavors. And we can all get confused when we start talking about NTLM versus NTLM auth, V1, V2, NTLM2. It gets really confusing whether there's signing or no signing. So, we'll kind of go over that real quick. So, when we do NTLM authentication, there's three messages that are sent. The type one, type two, and type three. Type one message is the client goes to the service as I'd like to authenticate, and here's what I support. So, as you can see, this is just a wire shark capture, chunked out a little bit. And it puts in there what the supported flags are as to how we can communicate for authentication, as well as the work station's name and the domain it belongs to. The server then responds with a type two message. Now, if you notice in the type one message, we don't know who this user is yet. They just ask to connect and want to know what's supported. So, in the server response, it uses the NTLM challenge versus the server response challenge. This changes every time. And here in the screenshot, you'll see the static challenge that's used mostly for rainbow tables. So, server response with the type two message saying, all right, here's what I support. Here's my domain name. Here's my host name. And here's a challenge. Use this challenge to salt your password hash with so it's unique every time and you can't replay it back over and over and over in the same request. So then the client authenticates with the type three message. The type three message is basically the server challenge hashed with the password hash for the NTLM hash along with the username, work station name and domain it belongs to. Session key if it's using session signing. And other flags to state what the session is going to be supported for the authentication. So, that's NTLM version one. NTLM version two is pretty much the same except it adds additional parameters into the password response as well as a client challenge. So, as a prevention against rainbow tables, the client uses randomness to break the rainbow tables. So, we went over that. So, this is all great and dandy but we've got one more thing we need to talk about which is Windows integrated authentication. So, Windows integrated authentication is what's used in Windows in order to make sure that you don't have to keep logging in over and over with your password to connect to various services. So, if you think of every time you're on a domain, you connect to a network share or an internal web server, it doesn't ask you for your password over and over. It just queries the API and gets the information back from it as to what I should use to authenticate. So, for HTTP, it obviously protects against that using trusted security zones. Has to be within the trusted sites or an internal site which is checked by only having a one word name, not a full domain name. Now, the interesting thing about this though with the one world domain name and again this has all been covered before I'm just doing a quick refresher is that the one word domain name does a search. It first looks for the DNS name from the DNS server, then tries it with the host or the DNS host name and works its way back. So, if your domain is domain dot domain or domain server dot domain dot net.  And basically as the network, hey, I'm looking for htb colon slash slash name. Do you know who name is? And broadcast across the local network, it's known as NBNS. As well as SMB everywhere as I was saying, there's no restrictions where it automatically authenticates with SMB. It just automatically authenticates. And so we can see there's some problems with this if we're able to take a real in this. So there's some known issues like I said already about this, the hash stuff. Passive hash uses the edtlm hash. As we look at the protocols for ntlm, the ntlm hash is not the original password. So all we need is the ntlm hash. Now we can access the ntlm hash using various tools and windows to gain access to the local system, password store as well as memory and access these password hashes from there. This is all covered in various other talks but just a quick refresher to kind of show the differences. But the thing with this is it requires local admin access typically on the system. With this, when it gets to local admin, you need to have existing access obviously, you're not starting as a guest in order to access the local memory store or the local password store. So what is ntlm relaying? How is it different from pass the hash? Everyone was asking me this over and over and over. Oh, you're talking about pass the hash? No. We're talking about ntlm relaying. So ntlm relaying requires no existing access on the network or on the system. Basically you get network connectivity either internally or externally and you start as a guest. No credentials, no access to no systems. And it basically relays those authentication requests. Now if we step back to where we talked about the type one, type two, type three message, there's no kind of verification that the host calling or the destination host is the one you meant to talk to. And the host just kind of authenticates to it. So what we do then is we set up a rogue server to take these authentication requests in and relay them to another target server. So this has been around for a while, the ntlm relaying. It's nothing new. All of you are probably like, okay, we've heard about this, it's great. Why are you different? So let's tell a little story. So back in 96 was when it first kind of came out in this paper called Weakness and SIFS Authentication by Dominique. That's kind of where they first talked about ntlm relaying as a possibility. In 2001 it really got traction with Dill Dog. Actually it was in 2000 with Dill Dog's ntlm replay and Certistics SMB relay, in which it did relaying back to ntlm or telnet relaying the authentication back. And you use the weakness in IE where you could say telnet colon slash slash the IP and automatically authenticate. And then SMB relay took advantage of bouncing SMB request to other hosts as well as back to itself. It finally took until 2008 that Windows patched the weakness where you could bounce a ntlm authentication request back to itself. And that was in MS08068. And so we couldn't bounce ntlm request, network request back to itself, but we could bounce them to other hosts still because of the way the protocol is designed. So in 2008 a guy who goes by the handle of Kurt did his talk at Defcon about ntlm is dead. And I thought that was one of the best talks that year because its impact on corporate environments is great. We could talk about mobile phones and how it affects everyone, but really the core data in corporate environments, it hurts. So he talked about writing this tool, does ntlm relaying over HTTP. And he talked about the potential of doing it with, you know, as an SMB server as well to get these authentication requests. And so this was actually screen-shotted two days ago. It's still an open case on his squirtle application. And I don't think he really has any intention of maintaining it.  We keep talking about there's problems over and over and over and over and they're not getting fixed. Every environment still has pretty much ntlm enabled in corporate environments. So what does it sound like to me? Well, it kind of sounded like the problem we complained over and over and over about websites not doing SSL encryption for their authentication requests as well as managing their cookies. So in 2010 fire sheep came out. Most of you probably familiar with this. It was a way of capturing cookies and using the sessions I was able to capture over wifi or sniffing of the network and impersonate these users. And I asked myself, why did this have so much traction? Why did this all of a sudden make everyone change? Well, because it was so easy to use. It was so easy for just anyone to start up the application and impersonate someone. So I kind of decided to start on this goal. Make an application that you could do ntlm relaying and show the impact of people that's as easy as fire sheep. We're getting there. So basically I started working on a lot of proof of concepts to see what extent does ntlm relaying support across multiple protocols. Like I said, a lot of people talked about it in theory, but no one actually implemented it. So the goal, like I said, is fire sheep for ntlm. So I decided to start learning Ruby because I was going to originally integrate into Metasploit and that didn't happen and it went still Ruby. So my talk got rejected when I first submitted both to Black and Defconn. But not just to get rejected, but I got a fake acceptance email. A friend thought it would be funny to troll me.  He had a friend who actually took and had his talk accepted and sent the actual content of the email and forged the, you know, headers to be from Nikita. And I thought for an hour and a half I was speaking at Defconn and then I got the email saying I was rejected. And that's the story. All right, thanks for coming, guys. But no, three weeks later Nikita gets back to me and says, hey, we have nobody on Sunday, somebody dropped out. Do you want to speak? Awesome. Wait, how, I have three weeks till Defconn? Shit. So keep that in mind as this tool is coming along, I kind of put it on the back burner and didn't work on it for quite a while between the submission and now. But we've got something working and we'll talk more about that. So what's the problem? Why do we need this another tool to do this? Why do we need another thing to do ntlm relaying? Well, the problem is other tools just didn't do what we need to do as a penetration tester. They really lacked the number of different protocols you could relay these authentication requests to. You know, a lot of them were SMB to SMB, HTTB to SMB and no one was really branching out of that HTTP and SMB world. No one was going to LDAP, MSSQL, or even testing remote desktop or other stuff or VPNs. And I really, I thought, you know what, the other big problem is that all of them send it to one place and we'll talk about why in a second. But they all forwarded every single request to one destination. That's noisy as all heck. We're getting users, we're getting machine accounts and we're just sending all the authentication to one target. And I realized the reason why is we didn't know who the users were before the Type 3 message. And if you remember the Type 1, Type 2, Type 3 message, the Type 2 message is what specifies the challenge. The challenge is unique to every session. Now I don't know who that user is until they send their Type 3, the last message. So I don't know what response from what server to relay on to them. Well, why aren't any other tools doing this? And so I looked more into the protocols of SMB and HTTP. And, well, we'll talk about that in a second. Oh, and it's not going away. Windows 8 and Windows 2012 still supports NTLM by default. And that's kind of scary that we know these protocol weaknesses are there, but NTLM is not going away. So we really need something to say, hey, as an organization you need to, under your own accord, start protecting yourself against these attacks. So I wanted to be a problem solver. So here's a tool. It's called Zac Attack. Now, I know the name is so freaking lame, but we went through a list of different names. My favorite is the last one. So what's in this tool? And I'm blowing through these slides fast, so hopefully I have enough to keep you guys entertained for a while. So really, in this tool, there's a few different components. And we'll talk about all these components separately and how they integrate. So, first of all, there's an HTTP and SMB server. Those are the servers that basically accept the authentication requests. So as clients get targeted to connect to this rogue server, they authenticate and they keep them authenticating. We have a set of rules for automated exploitation. We have clients for these automated exploits, as well as an API that we can tie into any other application we want to to do NTLM relaying. And finally, a generation of payloads to get these clients to automatically authenticate to us. So first off, these rogue servers. We want to get people and we want to get them authenticating to us and we'll talk about how we're going to get them in a second, but we've got to have them authenticate to something, right? So the first thing is we need to keep these users authenticating. A lot of the existing tools will disconnect after the first successful authentication. So what this tool, Zac Attack, finally does is it keeps them authenticating as much as possible. Now on Windows land for SMB, I think that's about 30 times before the connection terminates. So we need to figure out who this user is, too, when we're keeping them authenticating. So the first authentication request is with a static challenge. That 1-1-2-2-3-3, for those of you who pen tests, you know that's kind of the rainbow table challenge. And we need to figure out who this user is. Like I said, we don't know until type 3. So we send a static challenge. So with this, I like to call this the Alzheimer's feature.  And the reason we do this is because, you know, an HTTP, WPAD, and other requests don't always support cookies, as well as identifying them over SMB using an IP and source doesn't work if you're doing it across the internet behind a net. So for the HTTP server, the way we coded this out was doing a 302 redirect with Keep Alive. Now Keep Alive will keep the session open so the socket's not closing. After we authenticate them, we know who they are and we know who they are for the rest of that session. For SMB, it was a little more rough. I had to write a custom SMB server. Now that's not any easy task and it's a little buggy still, but it works. So after they authenticate and it does a setup in X connection, for those of you who aren't familiar with it, I'm not going to go too in-depth into the SMB protocol. That would be a whole another two hours. But after it gets the authentication request, it kind of forgets who they are and says, oh, hey, great. Nice to meet you again. Cool. Oh, I want to connect. Wait, who are you again? And starts the authentication request over. So we need to get these authentication requests coming to that HTTP and SMB server, right? And a lot of people will have asked, you know, how do you do man the middle? What do you do? Well, there's a few different ways we can get people authenticating to our server to then bounce them to other stuff. So what payloads do we're going to have in this tool? Well, first off, there's obviously WPAD. Now WPAD, I didn't want to write a whole another NBNS spoofer for those of you who are familiar with it. But WPAD is the web proxy auto detect. In Windows, when you try to connect, you know, with that little check mark, automatically find my connection settings. It sends a request out looking for the name WPAD. Checks DNS, and then checks broadcasting to the network. Now you can spoof these requests and respond to them. By default in Windows, the machine will automatically authenticate to the WPAD server over HTTP with the currently logged in user's credentials. So that's great. You got to be internal to the network typically or, you know, spoof NBNS or spoof the DNS. Wasn't me. But what about social engineering people? Now for a while, pentesters have known about using Internet Explorer and putting in image tags for a UNC network path. And then Internet Explorer would pass that back to Windows and automatically connect to that network server and attempt to get that image or whatever it may be. It could be JavaScript, it could be an iframe, et cetera. Now in IE, it automatically authenticates. But for a while everyone's solution was Firefox and Chrome. And you'll see kind of the reoccurring theme here is people have had kind of half hazard solutions for this because we didn't fully understand all the remediations for it. So what about Firefox and Chrome? We could do, oh, well Firefox and Chrome are protected. And you'll see a screen shot here. This is actually Firefox's error console saying, sorry, can't load, you know, that network share, you know, it's not in my security contacts, it's in file security contacts. So that's been the case until now. So that's one of the cool new things about this tool is that for Firefox and Chrome we found out that you can force downloads, obviously sending headers for force download and all of a sudden you open it from your temp folder or you open it from your desktop and you're now in the file security contacts. And voila, it automatically authenticates the SMB share. And you've got them authenticating to your rogue server. But what about, you know, if they won't click just download or open from temp? Well, could we get it so when they just view a page they automatically authenticate? You bet you. So it turns out there's these things called plugins for Firefox and Chrome. And these plugins phone back to other applications so on and so forth. And it turns out that Quick Time is the one that I kind of came across as most often installed by users by default. You know, there's probably dozens of other extensions but most commonly you'll see people with iTunes, with their iPhones and all, and Quick Time installed with it. So as I went through the list of different applications and Quick Time kind of popped up I thought, well how do I get Quick Time to connect to a rogue network server to get the user's username and password? And so after a little tinkering we found out that you can put a playlist together with a UNC network path and they'll automatically authenticate and they'll bypass the local security contacts. So we need to do a little more work into other plugins. But for now, really Quick Time I think is one of the bigger impacts for that. So another way we can get people to automatically authenticate to our rogue servers over emails. Some people may already know about this, others not so much, but in Outlook if you have an HTML email and inside of it's a network share, it'll automatically connect and authenticate. That's pretty cool. What about .docs? The whole Office Suite is actually like this. Embed an image or an HTML file, open it up, it'll automatically connect to that network share. One of the other things is the desktop.ini files. Now this again wasn't made as well known, but it's been out there. You can generate desktop.ini files to say that the icon resource or the wallpaper for that folder is a network share. And again, the system will automatically connect, attempt to get that icon and log in with the currently used credentials. And LNK network shortcut files, you can set other parameters in there to automatically connect. So the tool set automatically creates these desktop.ini files, automatically creates the HTML file. It's really quick, really easy. And obviously the last one is man the middle. You can redirect NTLM authentication requests or inject HTML accounts in the page. While the tool doesn't do this, it helps with it. But that's the ways you can get clients connecting to these rogue servers to do the relaying. So the existing tool sets out there that do NTLM relaying over SMB or HTTP, you can use all of these today to go ahead and use other tools to get them authenticated to you. So one of the cool things that I thought about Squirtle, the tool I kind of used as a starting point for this was that it did API requests where you could use any tool you wrote to get these type 2 and type 3 messages. And so with the type 3 messages, that's the final authentication request. You need to pass the type 2 to the API and you get the type 3 back. So I wrote up an API quick so you can use any tool set you want, any tool you can modify the source code of, and use the rogue servers to connect. Well, that's great.  So what I wrote together that's new for any other tool is a set of rules. All the other relay tools, like I said, forward everything to one source. Now we're identifying who these users are. So to really show the impact, I wanted to have it so with one click, like I said, in 60 seconds, you could get domain admin. So with that, you know, we write these rules out then in the new application to say when we figure out this user belongs to a group and they may have access over here, do something automatically when they connect. No longer do we have to try to get them to connect and wait and hope they come back around, but as soon as you see the user, do this. So the real set's pretty simple and I'll show it in the UI in a little bit. If a user is in a certain group, then use this module whether it be whatever the client is, SMB, SGB, et cetera. We good? I just hear fuzz. I didn't touch anything I swear. Okay. So we're not so good. Better? Okay. Swear I didn't touch it. So we write these rule sets basically to say if a user is in this group and they're in this module to perform this action against these targets and should we do it just once or per every user but I'll show that in a second. So the rule sets kind of go through this sequence of automatically looking for these API requests, looking for these under rules and keep doing it. Keep going through this until it times out. And if it times out, keep the user authenticating by not letting them time out and disconnect him but doing a stack challenge. So the things we can connect to, we've always had this kind of grid showing that you can use SMB to connect to SMB, HTTB to connect to HTTB, HTTB, SMB, so on and so forth doing the NTLM relaying. So the problem was that people didn't touch a lot of other protocols. And so I decided to take a look at other protocols. LDAP, MSSQL. Now I'll touch on why LDAP is kind of awesome in a minute but MSSQL, cool. We can get databases, we can get access to the data. Awesome. So SMB with the clients, we wanted to do some actions automatically as soon as we connected. So one of the big things is there's no tool out there to enumerate users and groups. Well, sorry, I take the back. There was no tool. There is now through Metasploit, which was released at BlackHap this year. Two of us were working on kind of separate projects and weren't talking and didn't know about each other either. But so you can enumerate users and groups. Now you may be like, why does it matter? I can enumerate stuff, whatever. Well, as a penetration tester it's one of those things you can figure out the administrators and the local administrators group as well as further information about what groups and what users you need to target. Cool, great. We can do NTLM relaying and do enumeration. We can also access file shares. We can execute commands. But this is great and all, but we can't connect to domain controllers. And the reason being is that most domain controllers by default have SMB signing. Now for those of you who aren't familiar with SMB signing, SMB signing basically uses the original NTLM hash to sign the session. And so every packet is signed. If there's a signature is off, it takes and disconnects you. So by default, domain controllers have SMB signing by default, so by default you can't do SMB relaying to a domain controller.  I had to figure it out there had to be some way we could get there really fast, really easy. So I'll come back to that. Turned out LDAP is enabled by default in domain controllers, yes? And uses NTLM authentication and turns out. And that's cool. That's great. But we couldn't change passwords because it typically requires SSL and SSL is enabled in LDAP unless there's a certificate of authority set up for the domain. So great. We can also do this what's written in the tool that you can change user passwords, reset users, add users, enumerate the domain, all that cool stuff. But the really cool thing is without SSL, without any of this using NTLM relaying, we can add users to groups. So if it has a tester, you're able to take and connect and get another user's account. We can take and add them to a domain administrator's group if we get a domain admin and so on and so forth. But going back to SMB real quick, one of the other cool things about this tool that kind of bugged me was that we always had to use certain tools to do this. So on the play write down here, I decided ham and tinker with some stuff. It's four hours from Chicago. Give or take. It's united. So it'll take a little time. So took and wrote a SOX proxy. So for those of you who aren't familiar with SOX, a proxy that sends raw data back and forth doesn't re-parse it. So on the way down, wrote a SOX proxy that does replacing the NTLM packets with the relayed data. That's pretty cool. It's unique new. Again, HTTP, we can relay it to SharePoint. Some internal website is great. All of this is kind of, you know, that's cool. But, you know, you have to be inside the network. And a lot of people think that NTLM relaying is not a problem because you have to be internal to the network. But what about externally? You know, sometimes there's a SharePoint, but typically not too often. And so I thought about what's one thing that is most organizations have open externally that supports NTLM. And it turns out exchange web services. For those of you who are not familiar with exchange web services, it's kind of an HTTP API that's usually on the same server as Outlook Web Access, your web mail and all. And by default, it uses HTTP Negotiate which supports NTLM. So with that, we're able to relaying externally to an HTTP service, which is exchange web services. So this becomes a little more scary as people have been talking about how you have to be internal to an organization to do relaying. We can now take and target mobile workforce users who are at a mobile hotspot or target people over the internet if they don't have outbound firewall rules to connect back to a rogue SMB server as we talked about the rogue server and get them to auto authenticate to this exchange web services. And with this, we can pull all their emails, all their contacts or calendar, anything you can do through exchange web services. And why? Because everyone's got a mobile phone connecting back to exchange web services in ActiveSync. I wish I had a drink because I would drink right now. The demo got fucked.  But oh, thank you, sir.  Fuck. No, honestly, I had a demo set up to do exchange web service, show NTLM relaying to exchange web services as well as doing other stuff. So the problem is all my VMs got fucked. So instead, I'll show just the GUI on it. That's a code. Here we go. So this is the GUI to it. I'll run through this real quick so you can kind of get an idea of its functionality and how powerful it can be as you grow. So right now what's running is the rogue HTTP server, the rogue SMB server and an HTTP management server. With this, we define what users are and what groups. Cool. So it keeps track of what users connected at what time. I hope that's big enough on this. Can people read that or no? Back row? Sort of? Good. So keep track of the users that are connecting back. Now you can keep having users connected back and it has who are the users connected back right now. Now you'll see there's some system accounts, there's some actual user accounts. And with this, we can just in one click say enumerated target over SMB, get their emails from exchange web services, execute a shell to a session if they're an admin, access a file share as them, access their share point, et cetera.  But we can then create rules, like I said. We can add users to groups. We can do this automatically through enumeration or we can manually add them to a group and create a group called, say, Moo. Cool. Great. We have now a user.  There it goes. Like I said, the ads do not like me. Three, two, one. Done. So it's very much alpha. I'm sorry, guys, but I had three weeks to code this all out. So we can add a user to, again, to a group. And so we've got this user in this group, YAR. We can also, like I said, enumerate from the domain controller all the different user groups. So then we can create these rules to automatically authenticate. So in this case, I already have a rule in here. So if you see a user in group, users, YAR, then connect over exchange web services to targets and target groups right now there are any. But we can easily add one, say, ten, one, ten, two, fifteen, two target group. Now as soon as it sees an authentication request from someone who's in that user group, it'll automatically connect to there and pull all the emails from folder inbox, folder drafts. We can easily add saying, here's another folder. Let's pull their sent items. And voila, it adds that rule. Now what's cool about this tool is that as it does this authentication request, a lot of tools keep having you re-authenticate. What it does is keeps the session open when it connects to this rogue and perform this action. So instead of re-authenticating every time it tries to get the inbox, it keeps the session alive so you don't have to re-authenticate. So we have about 30 requests coming in from the system. So we can set about probably 30 rules in the first try. And then in that one connection we can repeat it for all the users and all the targets that connect or just certain targets. Now at the same time, we can generate the payloads, like I said, generating the HTML, the desktop.ini, the doc, LNK file, zip file, the LNK file doesn't work, it just says how to do it as well as generate the HTML email automatically. So I'm trying to make it as simple as possible, like I said, the fire sheep of NTLM relaying. And finally, it keeps track of the passwords. And so you can try to crack the passwords as well. So since the demo is fucked, that's about the best I can show right now for a demo.  So how do we protect ourselves against this? Really, everyone's had varying solutions for how to protect against it. And I lost this slide. People have said use NTLM version 2. The tool supports NTLM version 2. There's nothing different about NTLM version 2 than NTLM version 1 that we can't relay.  But that doesn't protect against mobile workforce, et cetera. So in this case, it's Kerberos, Kerberos, Kerberos, it is. But the problem is telling an organization you have to switch everything to Kerberos today is not going to work. The problem is there's a lot of stuff that doesn't support Kerberos. The other thing is that if you enable Kerberos, you have to force Kerberos, you can't support NTLM at all. Same thing with signing. For those who don't know signing, every packet is signed then by the authentication. It all has to be forced, not just supported. That's a big misconception that people have is that I enable signing, that should be fine. You have to force it, which in turn breaks a lot of stuff. So before you go out there trying to fix NTLM relaying and NTLM issues in the organization, test, test, test, test, test, because it will break a lot of legacy stuff. So really, there's a lot of balance you have to take when you're a corporate sysadmium. The big issue is that you need to move away from NTLM. It's really something it's going to take time, but Windows 8 and Windows 2012 still supports it and still hasn't enabled by default. So we need to go out there and start moving away to Kerberos, and hopefully this tool will be the one that kicks that off. So the code will be posted on Tuesday when I get back home to this website URL, in case you don't want to take a photo or write it down, is on the DEF CON DVD as my slides. Check it out if you haven't looked at it yet.  So...


Already, we have finished this anchor bulkhead free earth method. Now, we will start next one anchor bulkhead. This is your fixed earth method. Let me draw these three diagrams. This is your elastic line diagram. Then, if I draw the pressure distribution diagram, if I draw the pressure distribution diagram, this is anchor rod. How the pressure distribution diagram looks as we have drawn earlier. Now, if I name it A T, this is J D C E F. So, this distance will be somewhere else around say X and this distance will be say A and this is your completely D. Now, movement distribution diagram also in the same profile, if I extend the movement distribution diagram, if this is my anchor rod and this is your X point of contra flexure where it changes point G. This is your J. This is J at a distance X at a distance X. Now, look at these three diagrams. Look at the three diagram. One is your elastic line diagram and this is your pressure distribution diagram for fixed earth method and this is your movement distribution diagram. Means, fixed earth method means this bulkhead particularly if you see this anchor wall below the dredge line. Below the dredge line, it has been pushed to a certain depth. So, that it will be fixed. It will be fixed. It will not rotate. As earlier case, it will not rotate below the dredge line. It will be fixed. Once it is fixed, it will be considered as a propped cantilever. If you look at this, this is my cantilever wall and this is the load is coming. This part will be we can simulate as if a cantilever wall with a propped cantilever wall. So, if I take this three diagram elastic line pressure distribution diagram and movement distribution diagram, then let me write what are the point G tends to G tends to point of fixed d t point of fixed d t below which below which the sheet pile below which the sheet piles remains remains vertical. That means if I take this is my point G, this is the point G. That means if this is the elastic line, the elastic line will change up to point G, then it will remains vertical. As it is a fixed earth method, then point J, J is nothing but is your point of contra flexure, point of contra flexure. That means earth point J, earth point J, contra flexure means the bending movement or movement distribution bending movement will be 0. So, that point will be a point of contra flexure J. For simplicity pressure distribution diagram, if you look at their E F E F and C G, if you see that E F and C G, E F and C G, if I mark it E F C G, this part generally below the G as it is said below the G it is a fixed one. That means the wall will be vertical, there is no further change in deflection or anything else. So, below point G as it is a fixed, so instead this part may be replaced, may be replaced by means of a simple force instead of pressure distribution by means of a simple force. So, E F C G, E F C G can be replaced by a force R B acting at G, R B acting at G. So, how do you solve? It can be solved by means of elastic line method. It can be solved by means of elastic line method. What is that elastic line method? We will discuss later. There are two methods, one is by means of elastic line method, other is your by means of equivalent beam method, other is your by means of equivalent beam method. In particularly elastic line method, the discussion will be done later on. Now we will start with this, there are two ways to solve it. If I write it, there are two ways to solve it, one is your by elastic line method, other is your by equivalent, equivalent beam method. No, just I am starting this both these methods, elastic line as well as equivalent beam. So, there are two methods to solve this, one is your elastic line method, other is your equivalent beam method. We will start the basic, how we will solve it by elastic line method. What are the assumptions? In elastic line method, what are the assumptions? The basic assumptions, deflection of sheet piling form an elastic line, deflection of sheet piling form an elastic line. Then elastic line changes its curvature, elastic line changes its curvature, changes its curvature at point J, at point J. So, this area, the force below G, pressure distribution below point G, may be replaced by R B, may be replaced by reaction force R B. If you look at the assumptions, the deflection of sheet piling form an elastic line. That means, there will be deflection, it will form an elastic line. This is called elastic line and elastic line changes its curvature at point J. Elastic line changes its curvature at point J. That means, the moment I say that changes curvature at point J, means bending moment is equal to 0 at point J. And pressure distribution below the G, because as you have assumed, this elastic line below G, there will not be any deflection. The pressure distribution below G will be replaced by a concentrated force R B, concentrated force R B. Now, the concept of, concept of elastic line theory, if you see it, particularly analysis. Now, you consider this as a, you consider this as a cantilever beam, consider this as a cantilever beam, as if this is a beam, this is a beam. Once I say it is cantilever, that means one end is fixed. One end is fixed means, if you come back here, this end as I said, this is a fixed support, this is completely fixed. This end is fixed and it acted upon by this concentrated load as well as U D L. So, then you can apply whatever may be this, there are the load distribution will be above the cantilever. It can be, it can be analyzed as a cantilever beam fixed at one end, then draw the bending moment and shear force. Then, where is your maximum moment comes into picture? As it says, point J is your point of contrafecture, then you find it out, where is your maximum moment. Once you find it out, your maximum moment taking into consideration of maximum moment, then you can find it out force of the anchor rod F A as well as distance D, as well as distance D. This is called by means of elastic line method. Second one is your equivalent beam method. Equivalent beam method, in equivalent beam method what will happen? If you look at here, if you look at here, let us take the, let us redraw the pressure distribution diagram, pressure distribution diagram again. Pressure distribution diagram again, if I draw the pressure distribution diagram, one is up to distance x. Look at here, this distance x because the point J is your point of point of contrafecture. That means, here there is no moment, there is no moment. So, if I consider up to point J here, then below the point J, below the point J, this is my point J and also below the point J, if below the point J, if you look at is, this is x, this is your A minus x. If I take it total, this is the distance A and this is your x, this distance will be A minus x. Now, if you take it completely this force and put it equivalent, it is as it is say equivalent beam method R B prime and here also R B prime. Can you see what is the assumption here? Two opposite force, that means it has been assumed a hinge has been taken at point J. A hinge has been considered at point J, so that the bending moment will be zero at the point of contrafecture. That means the moment you take the hinge at this point is equal to zero, that means force it will be nullified, there will not be force are equal to each other. So, that the bending moment will be zero. So, this is consider equivalent beam, that means one beam above the point of contrafecture, other beam below the point of contrafecture. If I summarize it, if I summarize it, what are the assumption a hinge at the point of contrafecture, at the point of contrafecture, where bending moment is zero, then the part of bulkhead above the hinge can be treated as separate freely supported beam, can be treated as separate freely supported overhang freely supported beam or you can say that can be treated as freely supported overhang beam or freely supported beam. The beam reaction R B dash acting at the hinge can be evaluated and this R B dash what is the procedure if you look at here, once again I am saying that it is a equivalent beam method. First one is your by elastic line method, that means it has been assumed as a cantilever, then consider the bending moment and see your force diagram, find it out maximum bending moment and from there you can find it out what is the anchor force, then you can find it out the distance that you got your first method. Second method is your equivalent beam method in this condition, in this case particularly what is the assumption, as there is a point of contrafecture in the beginning for fixed arc method, that means point j is your point of contrafecture, if point j is the point of contrafecture, that means a hinge at the point of contrafecture has been taken, that means where bending moment is zero, as a hinge has been assumed at the point of j, so what will happen the part above this, the part above this has been consider as separate freely supported beam, part above this has been consider as separate freely supported beam, so that means you know the gamma, you know the phi, you know the all the property you know, so you calculate your arc pressure diagram, you calculate your pressure diagram and from this pressure diagram you find it out what is your reaction force r b dash, because this has been consider as a separate beam, as if it is a overhang separate freely supported beam, so overhang part has been assumed as a freely supported beam and you will get your reaction force r b dash, once you get r b dash as there is a hinge at point j, that means this reaction for lower part of the beam, lower part of the beam it should be opposite, so once you consider your r b dash opposite, once you know the force you can calculate you can find it out your distance, so this is the case how the equivalent beam method has to be solved, both the methods can be used, so we will solve a problem based on the equivalent beam method also, draw pressure distribution diagram as I said earlier, draw pressure distribution diagram, that means based on your soil property based on your given soil property and water table, draw the pressure distribution diagram, so this is my pressure distribution diagram, find a this is my distance a, find a the distance of point zero pressure, the distance of point zero pressure below the dredge line, if you look at here this is my dredge line, if this is the dredge line this distance is a, this distance has to be evaluated first, because at this distance this pressure has been changed from positive negative to negative positive or negative positive to positive negative, that means pressure has been changed and point d the pressure will be zero, so find the distance a, so as we have discussed earlier for free earth method from there a is equal to p a prime by gamma prime k p dash minus k dash, which is equal to p a prime by gamma prime k dash, then find x, how do you get x, the point of contra flexure how do you get x, there are charts has been provided to find the x, if you look at this chart I will redraw the chart again also, find x, x is your distance below the dredge line, where there is a point of contra flexure, that means bending moment is equal to zero, find x from chart and compute pressure intensity p prime, now where is your p prime comes into picture, if you look at here this is my p a prime, so this will be your p prime, this will be your p prime, so find x find the distance x and compute pressure p prime, so p prime is equal to a minus x into p a prime by a, then your fourth point find r b dash by equating moment is equal to zero, moment is equal to zero at tie rod, this is the tie rod or anchor rod, find r b dash equating moment is equal to zero at tie rod, at tie rod, then after you find it out your r b prime what else, then you have to find it out your distance y minus x, where is your distance y has come into picture, this is the r b and from this r b to this r b to here, this is the distance y, if this is my distance y, so definitely this distance will be y minus x and this distance will be a minus x, so your fifth point is your find y, y minus x, y minus x, then find d is equal to one point two of y, find d is equal to one point two of one point two of one point two of y, now if I summarize, if you look at here, if I summarize first based on the pressure distribution diagram, based on the based on the soil profile, draw a anchor, draw a anchor, sheet pile wall along with the anchor and locate where is your water table and write this, means what are the value is given, value of soil parameter has been given, so calculate first step is your calculate active earth pressure coefficient, passive earth pressure coefficient, all parameters once you calculate, then next step draw the pressure distribution diagram, so this is your pressure distribution diagram, so draw the pressure distribution diagram up to your, up to your hinge line, this point x, so I draw the pressure distribution diagram up to the hinge line, so this is my pressure distribution diagram, once you get the pressure distribution diagram, can you find it out distance a, if you look at here, this is the distance a below the dredge line, where pressure has been changed that means, where it is 0.  Then once you get the total pressure, find distance a, find distance a by means of p a prime, gamma prime, k p prime minus k a prime, if you look at here p a prime, the pressure up to the dredge line, this is your p a prime, the pressure up to the distance x, this is your p prime. Now once you find it out a, then find distance x, x will be find it out from the your chart, I will give the chart right now. Then once you find your distance x, then you can easily find it out pressure p 1, p 1 that means, at the base p 1 is equal to a minus x by a p a prime. Once you get your pressure p, pressure p prime, then find your r b, because bottom line you have to find it out by means of equivalent beam method, what is your force, what is your force or reaction force r b prime. Once you get the r b prime for this case, as it is a hinge support, it should be equivalent opposite, so now it can put it opposite. So you will find it out r b prime by considering movement about your tie rod is equal to 0, this is also another assumption at the beginning of your bulk head or anchor rod, that means bulk head with your anchor bulk head. In that case, the assumption is that movement about anchor rod is to be 0, then once you draw this and movement about anchor rod is equal to 0, you can find it out r b prime. Once you get r b prime, then find distance y minus x, so this is the distance y minus x. So you know r b prime, you know y minus x, you can find it out from there, what is the distance d. So once you know y, once you know y minus x, as you know the x, then once you know y minus x, you can find it out y. Once you get y, you will find it out d is equal to 1.2 times of y. So this is the computational procedure, we will discuss also, we will solve a problem may be sometimes later may be next class. I will give you the chart from where you can find it out this x, distance x, these are the standard charts has been given. For value of phi, this is the value of phi, so it is varying from 0 to 40 degree, so this will be your 10, this is your 40, this is your 30, 10, 20, 30 and 40 degree. Now 0.1 h, 0.2 h, so it will up to go up to 0.5 h, so this graph will be coming in this way, this is the distance x. That means from the chart, you know what is the value of this x is equal to what part of this x. Then once you know the value of phi, you can find it out from the chart, if you know the phi, then you can find it out what is the value of x. Suppose phi is at this case, suppose phi is equal to, phi is equal to 25 degree. So from 25 degree draw a line where it intersect from there, you draw the vertical intercept, so it is approximately 0.15 h, so this is your total height h, so you know it will be given. Once you know total height, from there you can find it out x is equal to 0.15 into total height. That is it, I am stopping here, next class we will solve a complete problem, example problem of this equivalent beam method.


Hello, this is LaptopMedia, and today, we will show you how to open the ASUS TUF F15 FX506 and what's inside of it. To take this notebook apart, you need to undo 11 Philips head screws. As usual, the one in the bottom right corner remains attached to the bottom panel and slightly lifts the edge so you can start the prying process from there. Please remember, it would be of great help to us if you just hit the like button and subscribe to our channel. That would motivate us to make even more and better videos for you. Inside we see a 48 watt hours battery pack. And thankfully, ASUS offers an option that comes with a 90 watt hours unit. In terms of memory, there are two Sodom slots, which should support up to 64GB of DDR4 RAM in dual channel. Interestingly, there are two M.2 NVMe slots as well as a 2.5 inch SATA drive bay. However, if you manage to get a configuration with a larger battery, you won't get the option to expand the storage with a 2.5 inch device. The cooling solution here includes two heat pipes shared between the CPU and the GPU, as well as a third one intended for the graphics card only. Additionally, there is a metal bracket that helps in dissipating the heat from the video memory modules. And although there are three heat sinks, ASUS opted against cooling the VRMs. If you'd like to see more disassembly videos of the latest notebooks, we would highly appreciate if you hit the like button and subscribe to the channel.


The following is a Coderland presentation about our newest attraction, the Reactica Roller Coaster. Greetings, coders! This is Doug Tybald. As we see the majestic Coderland special rolling into the station with a load of happy coders by Tumanus Cole and Durell, the best rhino there ever was, it's time for another exciting announcement from Coderland. The park's extensive lineup of attractions now includes Reactica, a state of the art roller coaster that takes guests through a terrifying journey on perhaps the most futuristic coaster ever built. Let's take a look at this 21st century marvel in action. Our engineers have outdone themselves in building this next generation ride. As our early guests stared in slack-jawed wonder at this spectacle, many of them asked about the wait time for such a unique attraction. Your assignment, should you choose to accept it, is to build a web interface that shows the continuously updated wait time for the ride. You'll use event data from the ride itself, including whenever the coaster leaves the station, when it returns, when the ride is shut down due to accidents, and of course, whenever the wreckage is cleared and the ride reopens. In addition to ride events, you'll also process events from park guests. Every time the coaster leaves the station, the status of a few lucky guests changes from waiting in line to on the ride. A short time later, their status changes to completed the ride. Your web UI needs to reflect all of those changes. You may have already recognized this as a perfect scenario for reactive programming. That's the focus of what we'll cover here. The code uses the Eclipse Vertex Toolkit to handle the events that move through the system. Those events are delivered via the Red Hat AMQ Message Broker and Red Hat Data Grid. The code uses the event infrastructure to generate this web UI. It shows the current wait time as well as a list of the guests in line. This UI is displayed on monitors in the station as guests move through the queue, giving them constant feedback as to how the line is moving, if the line is moving. For administrators, there is a second UI to manage the ride. We'll take a quick look at that as well. There are three more videos to help you build this solution. The first serves as a quick introduction to reactive programming and vertex. Then the second covers the different components and how they work together. The third shows you the ride in action so you can see how events are generated by the ride and its riders and how those events are consumed by the components that calculate the wait time. We think this is a great introduction to reactive programming and reactive systems. We had a lot of fun putting it together and we hope you enjoy it. For Coderland, this is Doug Tidwell saying may all your bugs be shallow. Cheers!


Hi everyone, Sean with jaspyscasebreaks.com here doing 2020, 2021 hip parade basketball limited edition series 32 Dual case break random team edition. We're gonna do two full cases 20 total boxes. So the way this works 30 spots everyone gets a random team in the NBA Every box contains one autograph card featuring some of the best stars in basketball There's only a hundred hand numbered individual boxes made and then they take those boxes those boxes And they individually put them into 10 cases and each case has 10 boxes in them. So We've got two of those cases here. That's what we're gonna be doing right now Here is our list of customers from Tom Lee down to Chris Cataloni with last Bob Mojo and The list of teams from the Hawks down to the Washington Wizards. Dice will randomize both lists and pair them up Two and a six eight times. Good luck. Eighth and final time from Sean Matic down to Brian Watford and Eight times on the teams. Eighth and final time from the Pacers down to the Kings So eight times on the teams eight times on the customers eight times on the dice. Oh It will TJ it will So there is the full list trade window is open Except remember there is no type of checklist with this product. So credit your own wisely Sean Matic Pacers Michael PCora Thunder Oliver Soria Heat Mike Krasinski Nets Kevin Miakawa lasers Ben Hoda bucks Paul Norden Spurs Mike Tower Raptors Aaron Salinas Lakers Sean Son and look jazz Robert Flores Pistons Mike Krasinski Clippers Robert Flores sons Joe Andres and bulls Robert Flores Nick Mike McCarthy Timberwolves Aaron Salinas magic Dan Klobnik Hawks Daniel Katz Mavericks Eric Kemp ski Cavaliers Robert Flores Hornets Tom Lee 76ers Chris Cataloni wizards Robert Flores Celtics Colby Almeida Nuggets Robert Flores Grizzlies Sean Matic Pelicans Brad Newman Rockets Kevin Geiger Warriors Brian Watford Kings and there you go So trade window is open. There is the full list While you guys are contemplating any potential trades. I'm gonna pop over to the cases and show you This is obviously like you said serious 32 hip parade limited edition basketball This is case 2 out of 10 This is case 6 out of 10. So you said each one of these is made and they put 10 of those hand numbered boxes inside them 10 boxes and each one of these is individually sealed and Stickered Just for the sake of Tim, I'm just going to mass cut the stickers all at once You can see all the layers of protection that go into these nice to seal boxes hand numbered Our cases and then inside of those boxes are wrapped double-stickered hand numbered We do have hip parade football and baseball on the site as well both dual case breaks Just like this I would have known this on the side. I would have worn my hip rate today hip rate if you're watching this Send me more t-shirts not where I want it every single day of the week That way every day I'm wearing a head for a t-shirt and this is case 6 out of 10 Okay, so it doesn't look like there's any talks of trades in the chat So by the time I'm done with this guy that there's no trades done. I'm just gonna end it print through Print the list to get ripping. So I won't even click back over to the screen It doesn't look like there's an even but even just discussing Maybe everybody's just 100% happy with the teams. They got it, which would be perfect So no talks of trades and I am done. So I'm just gonna go ahead and print the list as is and we're Good luck everybody So there are your 20 boxes. So here is that final list Good luck everybody Chris Cataloni last spot mojo with those wizards and we're starting off with box 20 So every single box is gonna pretty much be the same. You've got one of these in there. Oh Apparently this one has two hits in it interesting Very rarely do you ever see that first up is Bogdan Bogdanovich That is optic signature series From 2017-2018 Bogdan that's for the Sacramento Kings and Brian Watford and a Terence Mann Optic signature series rookie auto for the Clippers and Mike Krasinski That is 1920 Was both on rookie 17, he wasn't right. He's already he was past beyond that He's already been in the league I think So Clippers is Mike Krasinski Kings is Brian Watford. Next up is box number three We've got a very nice gold auto Chris Mullins from noir That is a spotlight signature for the Indiana Pacers and Sean Maddock See the gold ink auto on that card Acetate card that is 43 out of 99. That is 2019 2020 noir basketball Nice one there and box 44 another favorite of mine impeccable Stainless stars autograph rookie Isaiah Stewart for the Detroit Pistons That is number 92 out of 99 Detroit Pistons Robert Flores Love the metal plate stainless And box 76 76er and it's magic Johnson from upper deck exquisite collection It's obviously Michigan State on this one. You can see the autograph there So it's a shadow box look But the autograph is on a slanted surface that connects the front to the back awesome looking autograph there great-looking cards That is 2011 It's 2011 2012 exquisite collection Magic Johnson obviously goes to the Lakers and Lakers is Aaron Salinas so the way this works since this is a Hit parade product and not an actual upper deck exquisite instead of going off the checklist for the card that we're looking at There is no obviously checklist for hit parades product In that case we do college rules, which is if they are a current player It's a team they're currently on if it's a retired player Then it's a team or no longer active player It's a team that they played for the longest during their career obviously Magic Johnson Lakers pretty simple Box 83 next We've got a graded card our first graded card, and it's Dwight Howard 2008-2009 tops signatures VGS 9 5 10 Surface was the nine corners and edges both a 9 5 and centering a 10 that is 10 84 out of 24 90 nice Dwight Howard Guaranteed Hall of Famer unless he does something stupid to ruin that box 11 And it's Kevin Garnett that is 20 19 or sorry 2020-20 21 Penini contenders basketball Kevin Garnett autograph for the Timberwolves and Mike McCarthy. Oh By the way, that was a magic edition of Dwight Howard. That's Aaron Salinas in the magic Nice KG Oh, yeah, John those were stickers Box 31 only good things It's a rookie it's Paramount penmanship auto Kyle Lowry On-card auto for the Raptors and Mike Tower that is nine out of 25 just a couple off the jersey number That is 2014 2015 paramount basketball, so not rookie Nice one though who Lowry was Ben and it's national treasures Jersey and auto 41 out of 99 lasting legacies Triple J Jaren Jackson jr. Memphis Grizzlies Robert Flores That is 2019 2020 national treasures basketball Speaking of Grizzlies Ben. There you go, Robert Box 63. It's another card from Noir. It's one of my favorites And it's PJ Washington jr. That is a rookie auto 58 out of 99 for the Hornets and Robert Flores There you go 2019 2020 Penini and this is the spotlight or a big shadow. What is it s hs? I feel what that is But I think this is one of my coolest the coolest designs Where it's the player and it's like a light coming from one source On to the picture and the shadow on the background Nice PJ Washington jr. There Hornets and Robert Flores congrats Good as they show box 96 I mean They've got a lot of other things They probably need to concentrate on that they can probably fix first before that but whatever And it's rookie auto Patrick Williams from revolution. That is 2020 2021 revolution basketball for the bulls and joe andreason Nice Patrick Williams rookie auto There you go, Joe So that's the first case guys. We have a whole another 10 boxes to go Next up is box 97 And it's an origins rookie auto of Tyrese maxi for the 76ers and Tom Lee box 71 Oh, yeah, I know what you mean Yeah, like I said, there's a bunch of stuff. I mean I feel like there's there's stuff that they are doing internally within their system that they could fix Instead of trying to like fix the stuff that users are doing And it's a rookie ticket auto playoff ticket of derrick white for the spurs That is five out of 35 san antonio spurs paul nordin And that's from 2017 2018 contenders one off the jersey number 59 And it's another one from contenders and it's carl anthony towns the big cat 127 out of 199 mvp Contenders from 2018 2019 contenders basketball timbrels mike mccarthy There you go, mike Next up box 33. This one feels heavy our whole year. Maybe I'm just in my mind Maybe it's another two card bonuses First up is Prism rookie auto kevin herter for the hocks and dan plovnik pretty terrible signature kevin where you're trying and chris bosh That is from 2009 2010 studio on-card auto chris bosh masterpieces or master strokes For the toronto raptors and mike tower that is 34 out of 99 another holiday box 17 And it's the deep bay from absolute memorabilia basketball nine out of 49 rookie auto for the pistons That is robber floris and that's the most recent 2020 2021 absolute box 84 And it's a rookie auto out of encased rookie endorsements. Kobe white For the chicago bowls and joe and recent that is 2019 2020 encased basketball Kobe white rookie out of box 64 up next Oliver is requesting some heat Who'd you end up with Oliver? Ended up with the heat. Oh, that's why he's requesting some heat Uh, this is russ Russell westbrook gold standard basketball For the oklahoma city thunder that is a bgs 95 9 on the auto And it's a true gem mint centering corners edges and surface all in 95 And there is 28 out of 199 on that one thunder is michael p cora Congrats very nice curve New liquor box 45 Hall of Fame heroes autograph dominique wilkins jock dominique wilkins Is he in is he in in the hall of fame is jock wilkins today? I learned 41 out of 75 that's from immaculate For the Atlanta hawks and dan clubnick am I the only one that is 2014 2015 immaculate collection basketball Dominique Wilkins first name is jock middle name dominique Silver ink auto nice one there for the hawks. You got that box 24 So he's actually in the hall of fame is jock dominique wilkins. That's very friendship to him It's tiris halliburton 108 out of 199 little quad relic auto rookie from 2020 2021 absolute memorabilia for the kings and brian watford Very nice tiris halliburton rookie auto and one more box last box mojo box five And it's chris mullins again 51 out of 100 That is 2012 2013 immaculate collection patch autographs That is a bgs 9 10 on the otta Very cool three-color patch and out of 51 out of 100 golden state warriors kenny geiger Very nice.  That is the break very nice stuff coming out hip parade always Delivers that was 2020 2021 hip parade basketball limited edition series 32 dual case break 20 total boxes random team Jasper's case breaks.com. I'm shum. Thanks for hanging out. We'll see you next time


Hello and welcome to CMC Markets on Tuesday the 25th of November and the weekly market update. And once again we're talking about record highs on US markets and we're also talking about a surprise cut in interest rates by the Chinese central bank on Friday which really helped put a bit of a rocket underneath equity markets on both sides of the Atlantic certainly here in Europe as well as over in the US. Now the US continues to make record highs the DAX is within a whisker of 9,900 and who would have predicted that a few weeks ago when we were trading down at well below 9,000 but here we are. And I think a large part of that is obviously down to an increased perception maybe or an increased belief that the European central bank may be on the verge I think of the potential game changer and potential sovereign bond buying. Mario Draghi last week in a speech to a banking conference in Germany was or outlined I think a significant concern on the part of himself I think probably more than some of the members of the governing council about continued declining price pressures in Europe. He mentioned the word inflation in his text around about 45 times so I think there is certainly a definite theme there with respect to what Mr Draghi's concerns are and I think that's got the markets in a little bit of a lather with respect to the prospects for next week's European central bank rate meeting on Thursday but let's wind things back a bit shall we because for all the talk of quantitative easing sovereign bond buying and pushing the euro lower let's really look at what could happen and what probably will happen there's quite a big gap between the two and in that context I'll be looking at euro dollar I'll be looking at euro yen and I'll also be having a quick look at the pound against the dollar as well in the context of this significant dollar rally that we've seen over the past few months and which in my opinion is now starting to look a little bit tired and we'll look at some of the key levels on euro dollar sterling dollar and euro yen so let's start with euro dollar now we've we found a significant area of support around about one twenty three fifty now if we were going to get a significant onslaught of European central bank intervention in December you would have thought that the euro would have actually pushed below that key support level but let's put Mr Draghi's comments in the context of what Mr Weidman at the Bundesbank has said and he said there are significant legal hurdles to ECB sovereign bond buying Mr Novotny of the Austrian central bank wants to see much more data from December and the outcome of the December TLTRO and Mr Knot from the Dutch central bank has also expressed similar reservations more importantly than that I think it's unlikely that the ECB will undertake something that is legally questionable in Germany when the European Court of Justice hasn't as yet ruled on the OMT program and they're due to rule on that in January and the OMT program which is a conditional bond buying program has been ruled ultra varies and unconstitutional by the German constitutional court so if the German constitutional court of ruled OMT illegal what do you think they'll make a foreblown sovereign QE I think that is a step too far at this point for the European central bank and in that context this key support of 123.50 on euro-dollar is very very important now the four hour chart that you've got in front of you right now shows a break out of the support line that we saw from the November lows at the end of last week and obviously that was on the back of Mr Draghi's comments on Friday we've now rebounded back towards that we need to get back through 124.70 and 125 to that upper trend line from the October highs that I've drawn in pink on the chart if we can break back through that line and the highs that we saw last week at 126 then we could well see a short squeeze in euro-dollar now before I move on to euro yen I want to just have a quick continue the dollar theme a little bit further because we've also got a similar trading pattern unfolding in the pound against the dollar and that can be borne out by this four hour chart here and I've basically drawn a rectangular support and resistance line through the highs and through the lows now we can see quite clearly there's significant support around 155.90 on the downside and on the top side we have significant resistance of 157.35 so basically you project that distance either side of the breakout point and it should give you around about 140 and 150 point move either to the upside if we break to the upside or to the downside if we break to the downside now the moment the US dollar trade is a one-way trade everyone thinks the dollar is going to go up I'm thinking it's a little bit tired those GDP numbers earlier today US GDP came in at 3.9% now ordinarily the dollar should have really rocketed higher on those numbers it didn't do that and if it won't do that on a very good set of numbers that suggests to me that the market could well be a little bit long of dollars so keep an eye on those key supports and those key resistance levels on the euro dollar and the pound against the dollar okay so we'll finally wrap up with euro yen the battle of the central banks the battle for the bankage between the bank of Japan and the European Central Bank and if we look at this daily chart on euro yen we can see how that battle is currently unfolding at the moment the bank of Japan is winning by quite some distance we can see the move higher in euro yen over the course of the last month or so but are we seeing evidence of a potential top in euro yen is that a potential gravestone doji on the daily chart is that strong down candle the first indication that maybe we're in the process of getting a downward correction in euro yen now how on that unfold will unfold in the form of a correction lower in dollar yen or will unfold in the one in the manner of a correction lower in euro dollar given what I've just said about euro dollar I think it's unlikely that it's going to be euro dollar that drags euro yen down which leaves dollar yen so certainly keep an eye on that pair that key level at 148 is very very key in the context of the resistance level in euro yen if we break below the lows of the past couple of days in euro yen we could well see a further set off in euro yen and a correction lower okay so that's pretty much it for this week once again thanks very much for listening sorry about my absence last week that was down to technical problems until next week this is Michael Houston talking to you from CMC markets


Can I use Wing Chun to help weight loss, strength and focus? What are its benefits? There's actually a lot of benefits in training martial arts, not just Wing Chun in general. A lot of people think the most common ones would be you gain more confidence, you get better shape, which is, you know, it's true but there's a lot of hidden ones that people don't think about. So there's actually emotional benefits, physical benefits and mental benefits. So I'm gonna list a bunch of them for you so you can get an idea. So here's some things that we can help fight against. We can help fight against depression, anxiety, low self-esteem, anger, boredom, feeling unworthy, guilt, fear, shock and self-doubt. Some physical things we can help with is chronic fatigue, back pain, joint pain, migraines, obesity, weakness, lack of stamina, sickness, weakened immune system. Some mental things we help come back is lack of focus, mental blocks, stress, bad habits and addictions. Now with the proper training, you gain more than just superficial fitness, just having big muscles or things like that. We help you unlock your full potential in some of these things. Emotional things such as self-confidence, courage, motivation, drive to succeed, better mood, empowerment, serenity, inspiration. How much is that worth? A lot of people will say there's priceless. Physical aspects such as strength, endurance, stamina, fitness, posture, stronger bones and joints, fewer injuries, increased vigor, better reflexes, flexibility, coordination, and how about some mental aspects like feeling in the zone, self-mastery, self-discipline, peacefulness, sense of purpose, better focus, heightened awareness and decision-making. So in combative ancient, we helped you excel in all those areas in life, not just fitness, physical fitness. That's the basis. Everybody can do that. You can go to any gym and get, you know, you can lift weights and you can get bigger muscles. Easy. But how many gyms can you go to that will train your heart and mind and soul? Okay, that's my goal in this class because I want to help you to become the most that you can be, the best person that you can be, mentally, emotionally, spiritually, and physically. And then we do that in that class. Many people are not aware of these things, but we as a school are totally aware of these and we have a system, we have a program that will help you with that.


What's going on everybody got Kyle and Sean here with Layton's sports guards we are ripping two boxes from us a Larry Larry yes two boxes 2023 Bowman's best Larry delights good luck Larry see we got guys we'll get seven of these in a row going come on come on let's see another super we've seen two today out of here today out of Bowman's best that's that go packers go packers yeah that's I'm going against everybody that I know yeah he's a he's on one today yeah I'm out now thick one taking everybody down with me elements of the game as well Rogers well Rogers is another two but he's also number two number two quarterbacks we have he's number two as well what yeah elements of the game and the refractor I know it's number two and orange the 25 we have will Rogers right back to it the best submitter for grading you mean like a like a bulk sub or like clean your cards and stuff like that well rogers the 25 I've only ever used lanes guy was it level up level up subs in California it's only one I've ever actually used besides sending in myself that's pretty we have a refractor Bronson Baron so 150 and bit more head got to 75 JJ McCarthy I feel like I've seen like ten of these yellow JJ today that's what I plan on these in blue it's a massive collapse by the cowboys that's 100 got Marvin Harrison on the future lava yeah they do they get it back quick too because they're in California I think they might like like personally so yeah I think they might personally sub them 200 Marvin Harrison we got to 99 green mini diamond Tyler van Dyke and do a nice one there to 25 we got Blake or him and Donovan Edwards there we go Larry the two two running backs from Michigan both scored two touchdowns in the national championship that's something very nice there on the dual auto is a good box because right behind it we have red to 10 it's gonna be bow nicks two out of 10 on the elements of the game auto really good box for you Larry will make this bow nicks here two out of 10 on the red insert auto very nice nice bow and we have came rising on the RP to 49 three-color patch out of Utah I think it's just it's not like a crazy amount of time longer or anything I don't think I think you could just get them like sooner it gets there yeah like I think they take it and like we'll upload in the system a little bit quicker than getting all the packages in opening on and all that I think they get them uploaded a bit quicker and get the process started a bit quicker all righty here guys second box mr. Larry good lots are really nice box there really nice box there a dual auto and a red to 10 elements are they want a gun slinger to 50 that's gonna be Jordan Travis go nose go nose to 50 there on the die cut want a gun slinger got called the 50 Blake or him so shady um I prefer the I prefer level up because they actually take the time and like like look over the cards they can they can clean them for you a bit and uh they let you know as well if something's probably not gonna grade very well so it's a little bit more um a little bit better that way I don't know if like necessarily LSE would do anything different but um it's a really good system they have like corn to 50 sure LSE could probably do the same look over them and tell you maybe something maybe not worth it or whatever bills are one of the 70 75 object estimate go nose we got to 100 on the lava gonna be camera rising to 99 is gonna be cam ward who I was informed by Bryson is not entering the drafting where he's going to the University of Miami he's gonna be a hurricane that is not great to 99 on the green many done and we have Phil Moth up gold to 50 yeah he said he was going to the NFL or first he said he was transferring they say was going to NFL and then he now he's going to Miami hey what's up shite how are we doing sir how are we doing didn't they grade it or send it to PSA oh they said it's a PSA they said it's a PSA they just kind of let you know like if it's like not worth it maybe if it'll like something you didn't notice like a dent or something that would get a like a rougher grade they let you kind of know that but they just send it to PSA they don't grade them themselves we have a um Jafari Harvey refractorado for the U which are Miami in this one Jafari Harvey because right behind it we have him again it's going to be cam ward on the uh one a gunslinger out of a 75 that's going to be the use new QB and a washington state want a gunslinger letter smiles and so 50 we have julian flaming on the gold auto osu julian flaming all righty there that'll do it for you mr larry two boxes of bowman's best you delight really good boxes for you there sir with the bow necks and the dual auto we get those right out to you sir yeah


I'm sure they'll keep making them, none three back in the habit. Some people say that I think it's Annabelle creation is really good or maybe it's the last one. I don't know what movie they were watching but I didn't like Annabelle creation either. So maybe it's the home one that they're talking about. Annabelle homecoming, Annabelle far from home, Annabelle no way home. I don't know.


So, so far we've talked about the one-dimensional particle in a box. That's our one example we've considered so far of solving a quantum mechanical problem, solving Schrodinger's equation. That's given us a little bit of a taste of quantum mechanics, so we have a little bit of experience under our belt, but before we move any farther, let's talk about the, what are called the postulates of quantum mechanics, some of the basic foundations for doing quantum mechanics that will help us understand a lot better what the answers mean when we solve more complicated problems than the particle in a box. So it turns out there's going to be five of these postulates of quantum mechanics. The first one refers to the properties of what we've been calling the wave function. So this first postulate says the state of a system, a quantum mechanical system, is completely described by its wave function. So there's two important words that deserve a little bit of discussion there. What do I mean by the state of the system? What do I mean by the wave function? And we'll also talk about what it means that it's completely described. So the first, we'll start with the wave function. We've talked about wave functions before. The one thing I need to tell you about wave functions that we haven't talked about before is that there's one property that these wave functions have to satisfy that we haven't, we've only briefly touched on so far. And that's that these wave function must be square integrable. And that's a technical term, so let me explain what that means. So if I have a wave function psi, if I calculate this integral that we've seen several times before, if I take the wave function multiplied by itself with a complex conjugate, that wave function integrated everywhere, that wave function must be finite. So for something to be an actual bona fide wave function, it has to be square integral. It's square in this sense integrated has to be a finite number. And that's just to guarantee that we can normalize the wave function. If you remember when we talked about the free particle, a sine wave that oscillated forever in all directions all the way out to infinity, the square of that wave function integrated was going to give us an infinite answer and that's one of the reasons we didn't like that wave function. And we had to start talking about particles confined to boxes so that the integral of their probability or the square of the wave function would be finite. So wave function is the type of thing we've seen before with the additional requirement that it has to be square integrable. So by state of the system, what I mean is the same as if I were to describe the state of a problem back when we were doing lattice models, for example. If I describe all the properties of the system, if I've given you all the details of the system, I've described the state of the system completely. So what this postulate tells us is that anything that it's possible to know about a quantum mechanical system, I can obtain from its wave function. Somehow, if I know the wave function, there's a way of extracting enough information to describe everything that I can describe about the system. So that's what this postulate says. So what do I mean when I say that I can extract the properties from the wave function? We have seen just one example of this so far. The wave functions for the two-dimensional, sorry, one-dimensional particle in a box have these wave functions, sine of n pi x over a with a normalization constant out front. The one property we know how to ask questions about for this wave function for a particle in a box is probability. Remember the probability that I'm going to find an electron or a particle between two different limits, A and B. That's just the integral from A to B of the squared wave function. And for example, let's take a particle in a box, maybe, let's take the, here's a box, zero to A. Let's take the psi two wave function. So the wave function looks like that. The square of the wave function looks like that. And if I were to ask, for example, what's the probability that the molecule is in the left half of the box? That it's in this range between zero and A over two. In other words, if I integrate from zero to A over two, the wave function squared, so two over A, sine of two pi x over A squared. And the square root has become squared. If I do that integral, again, we could do the integral mathematically. Ask ourselves what that is, or we could just look at the graph and say that I know that the whole area under this curve is one, because I've normalized my wave function. And I know that the left half is symmetric with the right half. So by symmetry, I know that if I did the work, that integral is going to come out to be equal to one half. So there's a 50% probability that the electron is in the left half of the box, and it exists at different positions in the box with different probabilities given by the wave function. So that's an example of how I can find out something about the state of the system. Where is the particle with what probability does it occupy some regions or others? I can obtain that from the wave function. I have to know what the wave function is, and then there's a recipe for how to find the question I'm interested in. Notice that when I say the state of the system is completely described by the wave function, if I have two systems that have the exact same wave function as each other, I'm always going to get the same properties when I ask questions about the state of those systems. So if two systems have the same wave function, they're identical in every way. So that's a consequence of the fact that the state is completely described by the wave function. So all we know how to do so far is answer questions about the probability using the wave function. If we want to answer questions about other properties other than the probability, we need more information than this to tell us how to extract those properties out of the wave function. And that's the topic of the next few postulates of quantum mechanics.