My name is Andy Robbins. This is Will Schroeder. Thanks for being here for our talk. Thank you, thank you, thank you. The title of our talk, an ace up the sleeve, designing Active Directory Dackle-based Backdoors. Quick information about me. My name is Andy Robbins. My handle is Waldo. I'm a co-founder and developer on the Bloodhound project. I've spoken at places, done training. If you really want to get me excited, come up and talk to me about the ACH file format and we can talk offline about that. Hi, my name is Will Schroeder. My handle is Harmjoy. I'm an offensive engineer at SpectreOps with this guy. I'm a, I've written a lot of code. I help write a good chunk of the Veil framework, Empire, Power View and PowerUp. If any of you guys use that, Bloodhound, Key Thief, and I really love Active Directory and dive in this research and it's been a whole ton of fun. I've spoken at a few conferences. I'm a power split developer actively and I'm a Microsoft PowerShell MVP.  Alright, so I'll give you guys a quick TLDR, where we are now, where we're going to be, and where we're going to wind up. So first we're going to talk about DACLs and ACES, what these are, how they work, why they matter. We're going to look at typical misconfigurations and how we can abuse these misconfigurations. We'll look at how we can analyze this stuff easily with Bloodhound from offensive and defensive perspective. We will look at designing Apple based back doors and then we're going to show you some demos, some examples, some case studies. And then finally at the end we're going to talk about what we can actually do about all this as defenders. So an important caveat to keep in mind, we're not talking about ODE, we're not talking about anything worthy of a CVE. Really what we're talking about is how to abuse the existing Windows security model for malicious purposes. Thank you. Secondly, so we're not dropping ODE. Secondly, we're talking about putting back doors into an environment. Most of the time you actually need to be already elevated to do that. So all the stuff that we're putting in, we're already domain admin and then we're looking at, once we lose that, how do we get that back easily? So why care about this? Some of the few things we think are really cool about this approach for persistence is one, it's often very difficult to determine if you, even if you find one of these misconfigurations, how do you tell if it's malicious? It could have been put there almost by accident from some third party tool, really old exchange install and a lot of this stuff we're going to talk about. These changes also will very often survive domain functional level upgrades and operating system upgrades. So there's remnants in a lot of domains of a lot of these misconfigurations. So a back door may have been put in 10 years ago in a really insecure environment and even though the environment is more secured now, these could have existed for years and we hope this kind of scares you. You know, we're going to go in some background and stuff but finally we bring it all together. We hope the example is really kind of hopefully terrify a few people. So I love this quote from Matt Graber who's actually up here in one of the rows. So as an offensive engineer, if you can dream it, someone has likely already done it. And that someone isn't the kind of person who comes that speaks at security cons like DEF CON. So we're not, we fully believe like we are not the first ones that come up with this idea. We think that, you know, different advanced adversaries almost certainly come to the same conclusion. So a big thing with this talk is we want to bring attention to the problem. The research isn't complete but we're excited and, you know, this may have already happened. Alright, so let's talk about some background. First of all, we need to acknowledge some existing work. First and most importantly is this French project from ANSI which is the French equivalent of the NSA. The two guys who did this work, Lucca Oyo and Emmanuel Grah, this is the Active Directory Control Pass project. If you haven't had a chance, I recommend you go take a look at it. We learned a lot about the Windows security model and DACLs and ACES from their white paper. They also served as initial inspiration for using an attack graph to model attack paths in an environment. So they served as initial inspiration for our Bloodhound project as well early on.  So we think we got all the details, right? We got some cool stuff but I'm sure there might have been some stuff we missed. There's also this work from Robin Granberg at Microsoft. This is the AD-ACL scanner. It lets you do things like CSV, you can do basic diffing. If you want to know more about that, look at the tech net link there. And the deck is obviously going to be online after. And then next, there's also this other project called BTA. Unfortunately, we missed this before our black hat talk. So this is from the team at Airbus for trying to get a wrangle on Active Directory ACES as well. One thing to note, like they do some really cool analysis, but you need an offline application. So this is from the team at ACTS.DIT. In our case, everything we're showing will be done remotely through LDAP. Wrapped into PowerShell, but there's other weaponization methods, obviously. So when we first started looking at this, we had the idea, how can we implement backdoor as it abuses Active Directory object control. We scoured the Internet as well as we could. This is the closest thing that we could find. It's a blog post from 2010 written in Russian, obviously. This was all we could find. And we figured if the only thing we could find was written in Russian, we were probably on the right track. They also, in this blog post, this guy also talks about hiding the existence of Active Directory principles, which we built on and I think we improved on in a couple of different ways. So yeah, check out that blog post and run that through Google Translate. Cool. So we're going to go into a little bit of technical background. I know this might not be as super interesting some of these few slides, but you really need some of the background in this stuff to understand why and how these backgrounds are going to be able to understand why and how these backdoors work. So, Securable Objects and Windows. A Securable Object is defined by pretty much as an object that has a security descriptor. This is a breakdown of the binary structure. So there's a lot of pieces to this, you know, header bits, all this kind of stuff. All this can be expressed as an SDDL, so a security descriptor definition language string. If you guys have ever seen that, we're not going to really cover that too much. The pieces we care about are the owner, instead of the owner that, you know, for a particular object and we care about the DACL, so the pointer to that DACL here at the end. So if you're not familiar with Active Directory, you're not familiar with the access control model. People throw around ACL, DACL, SACL and all these types of things. People often use them interchangeably as well. So essentially the access control list, the ACL for an object is basically shorthand for the DACL and the SACL superset. So the discretionary access control list that you saw on the last slide is the access control list, the SACL. These are ordered collections of access control entries. So it's a pointer from the binary structure in memory to an array of these access control entries. The DACL specifies what principles or trustees is another term, have what rights over the object. Nothing crazy, right? The SACL allows for auditing of access attempts to the object. We're not really going to dive into SACLs, we're going to cover a little bit at the end, but, you know, in this case the SACL. So in an access control entry there's some 32-bit fields that control, you know, kind of some auditing kind of components. There's a lot of stuff in there. What we really care about are one, it's the owner, or sorry the principal that has the rights over this object for this particular entry, and then the access mask, which is a 32-bit field that defines what those rights are. This is what it'll look like in Active Directory users and computers. You can see that the principal is, sorry, up there all the way at the top right, the object is victim. So victim user, the principal is harm joy, so harm joy has these rights. There's lots of rights in there, and the ones we care about are, you know, like modify the permissions on the object, modify the owner. So again, this is just the access mask. There's one bit in the access mask that we particularly care about. So in those kind of like the control bits in this A-C-E entry, with this access mask, there's a DS control bit. So this is interpreted in one of two ways. So if the target GUI, or the target GUID for the object ACE type for that particular ACE, is a confidential attribute. So the most common case is LAPS, right? So you don't want everyone to be able to read that LAPS password, and we'll go into LAPS in a little bit. If DS control access is flipped, then that grants access to that confidential attribute. So that's one particular way to interpret it. The second way is extended rights. So if the object ACE type GUID matches a registered extended right that is registered in the forest schema, say user force change password, or DS replication get changes and replication get changes all, so these are DC sync rights. So if those are registered in the forest schema already, and that GUID, you know, is resolved and actually points to a particular extended right, then flipping the DS control access will grant a control access right for this. So it's the way that extended rights are granted. Extended rights are just a way to, you know, like I mentioned, extend the actual generic rights that are available in that 32-bit access mask. Okay, so the part of the operating system that is actually in charge of evaluating these ACEs in what is called canonical order is the kernel mode security reference monitor. So the SRM takes an access request for a given principle against another object, and it evaluates the DACL in that canonical order to make an access decision, whether access is allowed or denied. Importantly, we can abuse this function of SRM to hide principles or to hide the existence of DACLs. The way that we do this is we abuse the fact that explicitly defined ACEs on an object are always, they always precedence over inherited ACEs. So let's look at an example here. We have this OU called IT, and on that OU I'm going to specify an explicit deny ACE. Let's say it's just for full control. That's going to inherit down to the OU that is contained there called help desk, and then the Robbie Winchester user at the bottom of this OU tree also gets this ACE inherited down to it. Well, what if I put a conflicting ACE in the intermediary OU? So at help desk I say, well, wait a minute, I want to have an explicit allow. The explicit allow takes precedence over the inherited deny, even though typically denies are given precedence over allows. Finally, on the Robbie Winchester user I specify two explicit ACEs on there, an explicit allow and an explicit deny. So the order that you see on here is what is called the canonical order and is based on inheritance from parent and grandparent OUs. So the explicit deny will be evaluated first, then the explicit allow, then the inherited allow and then finally the inherited deny. The green inherited allow on Robbie Winchester is given precedence over the other inherited ACE because generationally that OU that it inherits an ACE from is closer. So let's look at some typical DACBOMS configurations for how we can do object takeover and how we can abuse these. Another caveat that I'll remind you of is that we're talking during this talk primarily about persistence. We're not looking at privilege escalation for this talk. We do have content on my blog if you want to read about that, but the primitives for object takeover are going to be the same. Additionally, we're looking at chaining together multiple different control relationships between different principles to make this very, very difficult for a defender to find. So you have user objects that take over a user object by abusing these access control entries. There are two primitives that we have for you. One, we can do a targeted Kerberoasting attack by a show of hands who knows what Kerberoasting is. After our talk is done, go read Sean Metcalf's blog about Kerberoasting. It's going to change your life. So basically we can set a value on a service principal name for a user and then we can request a Kerberoast ticket back from the domain controller as any other user and then we can crack that ticket and recover that user's clear text password. Anybody in the domain can do this. Secondly, we can change the user's password without knowing its current value. This is with a privilege that you give your help desk so that they can change people's passwords after they fat finger and lock themselves out. At the bottom here, we have two PowerView commandlets that can abuse these, set domain object owner password. There's also one for setting a user SPM. How can we take over a group object? Well, what we're interested in is not necessarily the group but we're interested in the privileges that the group has. So if we have the ability to add an arbitrary user to that group, we can give ourselves the same rights that that user has and write that existing privilege forward. We can write property to all properties to do this or we can have write access only to the member property and we can add a user to that group. In PowerView, you do this with add-domain group member. For computer objects, this gets a little bit tricky because the only thing that we know of right now is being able to abuse a lapse installation. And so if our user has the ability to read a local admin password attribute on the computer object, obviously we can pivot to that system and we can be a local admin. If you have other ideas about this, we are very, very excited to hear it. We are all ears. One thing to note as well is we are not claiming that this kind of taxonomy is complete. These are some of the primitives that we found that we've used operationally but we know for sure there are other types of object takeover relationships. So the point of this talk is not to show you every way to take over any object, it's to show you chains of these kind of interesting backdoors. Next, domain objects. So even though I'm not a local admin on a domain controller, even though I'm a local admin, if I have full control over the domain object, which represents the Active Directory domain, I can DC sync. DC sync, if you're not familiar, allows me to remotely request an NT hash for any other user in the domain if I have that privilege. Thank you, Benjamin Dalby and Vincent Latu for DC sync. Yes. So the two explicit privileges that we actually need for this, we don't need full control of the domain object, we need DS replication get changes and DS replication get changes all. Then we can request NT hashes for any user including the curb TGT, which is interesting and we'll show you why later. So, group policy objects. This is one of the few relationships that we don't have incorporated into the Bloodhound schema yet. These are going to have to write a custom path finding algorithm to handle all the weird inheritance issues. What the main takeover primitive is can you modify the GPO? You can modify the GPO. These GPOs are linked to OUs, sites and domains and there are users that can modify the GPO within these. So if you can modify the GPO, there's a million and one ways that you can get code execution on a computer it's applied to or you can get essentially code execution in the context of the user that the GPO is applied to. So the right to care about here are right property to all properties like some of the other examples and right property specifically to the GPC file sys path. This represents the rights to actually modify the GPO and if you modify the GPO, you can actually clone down to the file system in sysfall. So if you have the rights or modify the rights, then you can just go straight to sysfall and modify any of the GPO settings. There's a set of a few rights that apply to pretty much all the objects. So generic all, this will grant you all generic rights like we mentioned. It also covers some of the control or object takeover rights that we're going to cover in the next slide. Generic right allows for the modification of almost all properties in the GPC file sys path. These are abusable power view set domain object. Again, this is how you could do that targeted Kerberoosting. And again, these rights normally apply to most objects for takeover. So control rights. These are rights that allow principal or trustee to take control of a particular object. So if you have right dackel, you have the ability to modify the security information for an object. You can add whatever new ace entries you want. So if you have right dackel in the domain, you can grant yourself DC sync rights. And again, that's abusable with add domain ackel. With right owner, owners have implicit full control of the object despite any existing deny aces or anything like that. This will come into play when we actually want to hide the dackel in things here in a little bit. So this is also available with power view with set domain object owner. Okay, so let's slow down for a second. Let's do some visuals to kind of make sense of what we're talking about. We're going to look at some analysis that we can do with the bloodhound interface. We added several of these ace edges into the bloodhound database so that you can hopefully easily map out what these existing control relationships look like. That's the 1.3 update that happened just about a month or two ago. So for defenders, we hope that you guys can use this for enforcing your least privilege policies. For identifying what ACLs may be misconfigured and giving people more privilege than they actually need. And then detecting some of the more non-stealthy dackel-based backdoors. As an attacker, we can use this to find ackel-based escalation paths. We can also look for principles that are interesting for us a backdoor based on the existing privilege that they have. And then we can also kind of understand the existing situation there is with ACLs and how do we really care about being sneaking in the first place. So this is the bloodhound interface. The default view, we see the domain admins. We'll click on the domain admins group and we'll look at inbound object control. So who has control of this group? From the first-degree perspective, we see there are six groups that have control over the domain admins. Several of them are generic all privilege and then one of them is right dackel privilege. You may notice that a lot of these groups. These groups also include other groups and computers and users. So if we unroll this out, we can see that there are actually in fact 29 principles at how full control of the domain admins group because of security group delegation. Now what if I want to unwind this out and say who can take control over all these principles? What we call this is transitive object control or an ackel-only attack path. I'm going to put hound after I finish doing this right here and showing you the group delegation. So let's go back into inbound object control. Transitive object controllers, there are actually 50 of them. So there are 50 objects that have an ackel-only attack path to be able to take control of the domain admins group. These users here all belong to a group called identity administrators, which is a member of this group called account operators that has force change password over this user group. So let's look at something a little more interesting and complex. This user here belongs to a group which also belongs to a group that can change this user's password who can change this user's password who's a member of this group who has full control of the domain admins group. So that's inbound object control. What we can also easily audit is outbound access control. What privileges do they have against other objects? So I'll find this user here called rTaylor and go to outbound object control. First degree object control is zero because that user itself is not specified as a principle having privilege against another object. For group delegated control there are four users that he has the ability to take control of because of security group delegation. What I can also say is transitive outbound object control. If I go over any of these four users then what? What can I do? Bloodhound finds this easily and I see that for transitive object control I have control over all these principles here by accol-only attack path. So this user belongs to this group belongs to that group who can change that user's password who's a member of that group who has control over all these other users here. All right. Thanks. So we can actually design backdoors based on these principles. So what our objective is we want to be able to get back into an active directory environment on any computer and be able to instantaneously escalate our privileges back up to whatever we want. Maybe that's enterprise admin, maybe it's domain admin, maybe it's local admin on a system. We want to be able to blend in with normal ACLs that already exist in the environment. So let's see what we can come up with. So how can we hide the DACL? I just showed you with Bloodhound how we can audit the DACLs, but what if I don't want you to be able to audit the DACL as a defender? This requires two steps. I change the object owner for the object I'm backdooring away from the domain admins to another principle that I control or the principle itself. And remember that's because object owners have implicit full rights despite any explicit denies that might exist in the chain. Secondly, I will add a new explicit deny ace which recall will take precedence over anything else in the DACL. And I say the everyone principle is denied the read permission privilege. Then I can't audit the DACL from any other principle except for the one that's backdoored. Here's what it looks like in ADUC Goey for setting this. So I'm saying the principle everyone is denied read permissions. It's that simple. I can also hide the existence of a principle that I'm backdooring. It requires three steps. First of all, I need to change the object owner because owners always have full control. Then I'll grant explicit control either to the object itself or another object that I control. And then on the OU that contains this user or group or computer or whatever it is that I'm backdooring I'm going to say that everyone is denied the list contents privilege. Then when they try to look up that user in ADUC or by LDAP or with a net executable they can't see it. Here's what it looks like in ADUC I assure you there is a user in this OU you cannot see it. These stealth primitives we're going to factor into some of the case study demos at the end of the presentation. So to summarize we know how we can abuse ACES to take over other objects. We know that we can control who has the ability to audit the DACLs. And we know that we can hide the principles and the trustees from easy identification. Cool. So remember that quote. If you can dream it, if you can imagine it it's probably already been done. We're going to go over five case studies that we were able to come up with in the course of this research. We're two guys in a basement just figuring this out for the first time and thought for about a week what some cool stuff we can do. If you actually had people much smarter than us with a lot more money and time to do that. So the first one, like we mentioned you don't need to be domain admin to DCSYNC. DCSYNC is entirely dependent on two ACES on the principle domain object. And again, all domains are a domain is actually represented as a domain object in Active Directory. So if we to implement the backdoor and these will all kind of follow the standard of we'll show how to implement the backdoor and then we'll show how to execute the backdoor. So the DCS replication get changes and replication get changes all rights to the domain object. Then this user who's at the attacker controlled user who's not in any privileged groups to stop just created user has the ability to DCSYNC any users account forever unless defenders actually figure out these rights in the domain object and actually remove them. So one thing to add to that is you can do DCSYNC remotely. So you can do this from any domain joint system. Here's a video. I'm going to import PowerView and then the bad guy user is going to be our attacker kind of control principle. I'm just going to show that the bad guy user is not in any privileged groups. It's brand new. We're going to save the SID for the bad guy user off and then next we're going to use and again all this PowerView stuff we're going to use an ACL enumeration there are no explicit aces on the object where the bad guy is the principle. Then we're going to use add domain object ACL and we're going to grant DCSYNC rights. You can do this in your lab tomorrow. We're going to add those and then we're going to enumerate those rights again and just show you that these new explicit aces have been added. You see? Okay. There's a SID for that bad guy user and he now has these DCSYNC replication rights. Cool, cool. Now we're going to pop up a window that we had a window running as bad guy. We tried to DCSYNC previously. We're going to try it again and now we have DCSYNC rights despite them not being in any any privileged group. So starting simple, nothing to you know, alright. Thank you. You know, this is a pretty simple example of an ACL base back door and we're going to get a lot more complicated. So I'm a nasty holder. I don't have time to completely go into this. There's also a good time to note that for example, we wrote a 64 page white paper that goes into excruciating detail for all these things. That will be released through Black Hat and also through our website at spectrobsite.io. We're going to release it probably next week. So if you are interested in this stuff, there's going to be tons more background and examples and mitigations and all that fun stuff. So 30 second summary, MNSD holder essentially acts like a permission template for highly privileged groups. They grant themselves force change password or generic all, writes to this CN MNSD holder system, this object exists in every single domain. So they add it to the object itself. Then every 60 minutes, a special process called the security descriptor propagator process or SD prop will run. It will enumerate all the privileged groups like enterprise admins, account operators, domain admins and if the permissions on those objects differ than the template in MNSD holder, it takes the permissions from MNSD holder and then imprints them onto the secured, highly privileged groups. Then the attacker hides their principle using the methods described. We don't want to hide the dackel here because this is going to be cloned off into every domain admin and enterprise admin and all that kind of stuff. But we can complicate it and we can make it kind of look like an orphaned object. Then to execute, the attacker force will run. Now we have a demo for this too. I'm going to load up PowerView again. Again, I'm not on a DC. I do have domain admin rights. I'm going to show the bad guy user's OU location. He's in the OU totes not evil because that's a good way to hide, totes not evil. Then we're going to add all rights for this bad guy 2 principle to the admin SD holder object in the current domain. Now, that was the actual backdoor. Now we're going to hide the principle. We're going to change that object, that bad guy 2. We're going to change the owner of that to himself. Then we're going to deny, one second, we're going to get some of the raw objects we need to do some of this manipulation. We're going to deny everyone the ability to read the permissions on the object. We're going to do a complete generic all deny so no one can actually do anything on the object. Then we're going to deny everyone the right to list the children of that totes not evil. So this is completely hiding the principle. Commit that all off. And we could have run all these commands in one three seconds. Then we're going to wait 60 minutes for SD prop to run. We're back. We're going to show, we're going to check if the rights propagated. So we're going to enumerate the rights for a particular domain admin. And we see this SID, that bad guy SID shows up for a generic all. But if we try to actually enumerate the bad guy 2 user, we can't find it here. Now this, we're going to refresh. And that guy disappeared. Even though he's still there.  And now we're going to use that account to show force resetting that domain admins password. Then we're going to do run as with CMD. And now we have codex as a DA again. Cool stuff, hopefully. I promise I'm not begging for applause. So lapse, we don't have a demo video for this one, but we're going to talk through it. So lapse is Microsoft's local administrator password solution. It's an awesome, awesome free thing that Microsoft released. It's a series of client side and schema extensions that every 30 days, the computer will randomly rotate its local administrator password and then store it in this protected attribute, this confidential attribute called MSMCS admin password. So the lapse also includes a series of commandlets released by Microsoft. So it's the adminpassword.ps commandlets. There's one particular commandlet called find admin password extended rights that audits who can read, who has the rights to read this particular attribute. We're going to show some issues with it, but I want to emphasize up front that these commandlets were not built as a security protection type thing. It was meant to find the results of who can actually audit these things based on the normal process that lapse rights were delegated. But there's a few edge cases. So here's who can actually read admin password. We have some DS control and a whole bunch of like inheritance kind of issues. The above checks, also generic all because that will imply that DS control access. Also that object control stuff that we talked about. So are you the owner? Can you modify the DACL or can you modify the owner? This list is updated. There are several more flaws we discovered just a few days before given the presentation. These are the flaws. So DS control, if DS control access is flipped, but the ace applies to all descendant objects and to set a computer descendant object, that's an edge case. Also it doesn't check if you're the owner. If you can write the DACL, write the owner and it only analyzes OUs and optionally specific computers, it doesn't check for things in the default computer container. So here's a normal case. We have this John Smith user and he is not able to read that lapsed password down there at the bottom. But if you run these in fine admin password writes, you can see he's not listed, so it makes sense. So we're showing that this user is not part of the server admins that pops up for this audit. Now we're going to craft a very specific ace that exploits the flaw with inheritance. So when we add this ace, that particular John Smith principle will have the right to read the lapsed password forever whenever it's changed, but the default auditing components released with laps will not find it. So this is a lapsed based backdoor. Here you see it actually executed. So John Smith, he's not in server admins but he's able to read the lapsed backdoor despite not actually showing up in the default auditing commandlet. So cool. We think these issues pretty soon, we dove pretty deep into some of the lapsed information and again, I'll taunt more on the white paper. This is my favorite. It's mine too, I'm a little bit biased though. So we mentioned how third party applications can extend Active Directory schema, they can add security groups, they can add control from groups to other principles in Active Directory. By far the biggest offender of this is Microsoft Exchange. So with Microsoft Exchange Server 2016, 2013 and 2007 SP1 and forward, Exchange Server will create a group called Exchange Trusted Subsystem and add all of the Exchange Servers into that group. Then it will grant that group full control over every other object in the domain with the exception of accounts that whose DACA is protected by the Admin SE holder object. Before 2007 SP1 this also included full control over everything. So essentially an Exchange Server had the same privilege that a domain controller did. So if you're ever on a pentest or red teamers, if you ever end up popping an Exchange box you are probably one or two hops away from compromising the entire domain. There are several real environments that we've gone into where what we have seen is reality is that the Exchange Trusted Subsystem does have full control of everything. The domain object, domain admins, domain controllers, enterprise admins, you name it Exchange owns it. So for this we're going to go through a couple of steps to implement our backdoor. First of all we want to find an object that we can backdoor that is not going to be very obvious for an auditor to find. So we're going to ride existing privilege by finding a group that already has admin rights against one Exchange Server through group's delegation. So not just one that is like if you did NetLocalGroupAdministrators and you found that group, we're going to go further back. Then we're going to grant authenticated users full control over that security group. We're going to change the group that we're backdooring to the Exchange Server. And then we're going to deny read permissions on that group to the everyone principal. How do we execute this? We're going to regain access to Active Directory as any user on any computer. We're going to add our current user because they are an authenticated user to the domain, they have full control over the security group like everybody else. We're going to add ourselves to that group and we're going to add our new found local admin rights on an Exchange Server. We're going to use PSExec to execute Mimicats as the system user on that computer. When you execute as a system user on a computer, you have the same privileges that the computer object in Active Directory has. So a lot of times this means DC sync. So we're going to go into Bloodhound and we're going to find the group that we're going to backdoor. So we'll go to domain admins and look at what other principals have control over the domain admins group. We can see that the Exchange trusted subsystem has full control over the domain admins group. And there are several computers that are added to the security group. We're going to select one of those, we're going to select Exchange 001 and we're going to see who the existing admins are on that box. Through Bloodhound we can automatically unroll out who all the effective admins of a system are by group delegation and we can see there are seven users that have local admin rights on the system. There's a system on the right, that group is explicitly an admin, that group has a group there and then this intermediary group also has a group called server backup tier two. This group even though it would never show up in the local admins group on that system is a local admin. So we're going to backdoor that group. First we're going to import power view. Then we're going to get the raw directory of the object. So server backup tier two, the group. We're going to grant authenticated users full control over that security group. It's done. Then we're going to change the owner of the group to an exchange server. Just for anti-audit reasons. That's done. Then we're going to deny read permissions on that group to the everyone principals so you can't easily audit this backdoor. The backdoor is in. How do we execute this? We re-engain access to the environment as any user, domain user, you're not an admin anywhere. Again, we're going to import power view and then we're going to add ourselves to that security group, server backup tier two, which is now done. Then we're going to use psexec to remotely run memocats as a system user on that exchange server. And then we're going to DC sync the curb tgt user and then use a created golden ticket and then we effectively then own the domain. And it's done. Love those curb hashes. So, this last one we don't have a video for, it's also the most complicated. But again, it's specced out in even more detail in the white paper. So the entire backdoor consists of an attacker grants him or herself generic all to any user object with the attacker as the trustee. And then you kind of grant that Patsy or proxy user the right dackel privilege to the default domain controller's GPO as the entire backdoor. And this is kind of a separate approach that we talked about in the paper of using a proxy or Patsy type user instead of the actual attacker principal. So to execute it, get codecs in the system again, you force reset the proxy user's password. You use that authentication context to add a dackel to that default domain controller's GPO that grants, oh, that you're adding a dackel to the GPO that allows right access to that GPC files this path. So we are granting ourselves the right to edit the GPO itself. Then we're going to grant through modifying the GPO the SCEnableDelegationPrivilege. This is going to be pushed down to the domain controllers. And what this does is it allows us to modify the MSDS allowed to delegate to super protected property on user accounts. And the reason it's protected is that if you're able to modify that, you can re-compromise the entire domain at will by executing essentially a constrained delegation attack through using Mimikatz and Kikyo. This is pretty complicated. I have some stuff in my blog in the earlier in January that goes into this more detail. But cool stuff. Pretty subtle though, right? It's just one user that's not the actual attacker. Then you have generical on that and you use that user as a proxy so what we can do in the future is actually do really kind of crazy chains of this going all the way back. So not only if they find the backdoor they have to walk back every possibility of someone that might have had access or could gain access to that object. This is again kind of an anti-incident response measure. Alright, so defenses, all is not lost. We promise. The problem with these backdoors is you have to have event log auditing turned on at the moment that the misconfiguration is introduced. So if this is introduced 10 years ago and you didn't have this stuff tuned up or you don't have 10 years of event log data, which I don't think many people have then you're not going to figure out who actually put this stuff in assuming you can find it and assuming you believe it's actually malicious. This is why we think this is a pretty cool persistent strategy. But for example if you want to stop these from being put in in the future there's different event log IDs like 4738 changed and you can filter these by the particular property modified and you don't have to monitor for every single possible change you just need to start monitoring piecemeal by all these kind of object takeover primitives that we talked about. And I'm also going to be putting out a blog and hopefully in the next few months that gives complete defensive guidance for every single ACL based takeover primitive that we covered. So replication metadata. Metadata remnants from a domain controller actually preserved in these particular properties in Active Directory. So in the DC you synchronize everything there's this XML based metadata that you can pull out. So you can figure out when a given attribute was modified and from what domain controller the modification originated from. So this kind of points you in the right direction but you have to go to that DC and parse those event logs to actually figure out who actually made the change. I have a draft post that I'm going to drop that goes into the next slide. Also Sackles. So those system access control lists that specify the types of access attempts to generate audit records in the security event log of a domain controller. Sackles have been around forever. People don't really use them because if you turn them on they're going to be tons and tons and tons of events but we really think that if you implement Sackles again just for the object takeover primitives that we talked about you can cut down a couple orders of magnitude in the amount of noise and actually just there's a bitly link that has some more information on there. Future work we worked really heavily with Lee Christensen and Tiffkin on some of this stuff and we tried really hard to set a null DACL for or otherwise manipulate the header control bits like SE DACL presence so the idea being like you can do on a host setting a null DACL so anyone in you know anybody authenticated users could have access but any attempts to set the entity security descriptor remotely on an object were ignored but this warrants another look we weren't able to get it working the documentation said why but there might be a way to do it. We also want to research additional control relationships particular those takeover primitives for computers as well as Sackle type auditing. So credits we want to special thanks all the people who helped us with the slide deck and research definitely Lee Christensen and Tiffkin he really really helped us. Jeff Demek for content review everyone else Matt Raeber who used to work with us gave us some really good feedback and some really you know he really really good feedback and kind of content review so with that we're pretty much done we can have a few questions and if we run out of time for that we'll be outside.


It was three years ago now that I first entered the new world. My debut as a beautiful rookie set the world aflutter with excitement. I appeared in each day's newspaper without fail, and all my gorgeous wanted posters were stolen away by the adoring ladies.  The pirate noble White Horse Cavendish. Hello and welcome to One Piece 101, the series that breaks down everyone and everything in the One Piece world. Today we are going to take a look at the romantic with the dark side, White Knight Cavendish. Cavendish is a rather sophisticated tall and regal fellow who first graced the series during the Dress Rosa arc. He is portrayed as extremely arrogant and prideful, with his primary source of these feelings being his own aesthetic qualities. However, as a result Cavendish very much expects the world to view him in the same way that he does, and will often become extraordinarily angry when he is not the center of attention, sometimes going so far as to even kill whoever is garnering more attention than he. And a lot of this makes sense when we take the time to consider that Cavendish was born in the aptly named bourgeois kingdom, the location of which is currently unknown, but they have been shown to be an exceptionally wealthy nation. And Cavendish just so happens to be the prince of said nation, and even from childhood he was greatly admired by the women of the kingdom. Something that's a bit creepy to think about, but whatever. However, as a child Cavendish would also be introduced to his lifelong friend, the faithful steed Farul. Farul is probably the most important figure in Cavendish's life, and rather remarkably Cavendish has been shown to suspend his selfish tendencies should Farul require help. As Cavendish grew older the bourgeois kingdom encountered an unprecedented problem due to his popularity with the ladies. At a certain point all of the nation's women simply refused to get married unless it was to Cavendish himself. This dangerous popularity would lead Cavendish to being exiled from the kingdom, and so he fled, taking a total of 74 underlings with him, 500 million buries in cash, and of course BFF horse Farul. From there Cavendish took a life of piracy, dubbing his crew the beautiful pirates, and Cavendish proved incredibly successful due in no small part to his own sheer strength, and prowess as a swordsman. In fact Cavendish was even acknowledged by Vice Admiral Bastille as a genius of the sword, capable of performing feats such as air slashes and deflecting bullets. Cavendish also happens to carry a metograde blade, known as Durandal, which is a rapier, although its exact grading is unknown. However the true power of Cavendish is only revealed in his alter ego Hakuba. Interestingly enough Cavendish has an odd combination of narcolepsy, sleep walking, and dissociative identity disorder. The fusion of these three traits resulting in an entity named Hakuba gaining command of Cavendish's body at regular intervals. Whilst Hakuba is awake, Cavendish's speed increases tremendously, moving too fast for human eyes to track, and even relatively skilled Observation Haki users can barely keep an eye on his movement. Not only that, but Hakuba also comes with enhanced skills in the art of swordplay, making him an exceptionally dangerous entity, especially when we consider that Hakuba will attack enemies and allies indiscriminately. At the time of this recording Hakuba's origins are unknown, however his legend was originally spread from the Rommel Kingdom, an equally mysterious location in the One Piece world that bears a striking similarity to modern London. Here Cavendish as Hakuba allegedly terrorized the citizens, slicing them down at his trademark incredible speeds, and after he was unable to be caught by the Marines, Cavendish was given the nickname, Kamaitachi of Rommel. Kamaitachi being a particular kind of yokai in Japanese mythology. And so Cavendish continued to build his infamy, masking in all of the attention he was receiving, even if it was for, you know, primarily negative reasons. And three years prior to the modern timeline, Cavendish was even able to enter the New World, which was roughly a year before Luffy and the rest of the supernovas arrived on Sabatiakopelago. And this year Gap would represent some very, very poor timing, as Cavendish was kind of put to the side in the eyes of the world, in favour of giving their attention to this incredible new group of rookies making waves. Now as expected, Cavendish was not pleased by this, not pleased at all, causing him to generate great resentment towards the supernovas, who would grow to become known as the worst generation. And following the two year time skip, he made a teeny tiny vow to gel each and every one of them, and an opportunity to complete a portion of which would come up during the Dressrosa Arc, where Cavendish had entered the Corridor Coliseum in order to obtain the Merimerono Mi, hoping that such a prize would attract some of the worst generation. And he was right, as Cavendish would go on to realise that a certain Monkey D Luffy was also participating, after being initially misled by his alias Lucy, however Luffy disappeared before Cavendish could act. Unfortunately for Cavendish, he and Luffy were not placed in the same group blocks, and he had no choice but to watch, as Luffy and Lucy Persona pulled off spectacle after spectacle and completely won over the Coliseum crowd, with their cheers deeply sickening Cavendish. Up next was Cavendish's block, and just prior to the commencement of the battle, Cavendish showed a true sense of nobility when the audience started booing Rebecca, and angrily demanded her death. So Cavendish literally rode in on a white horse, and chastised them for wishing ill of someone whilst not being willing to risk their own lives, to which the audience reacted, you know, surprisingly well, and began cheering him, filling Cavendish with overwhelming joy. During the actual Battle Royale though, Cavendish would be subject to his narcolepsy, and Halkuba took control, managing to dispatch all of the remaining combatants, with the lone exception of Rebecca, who was adept enough to dodge him. After this short burst, Halkuba vanished, leaving Cavendish asleep, and disqualifying him from the contest. He was then taken to the medical room, and turned into a toy by the nefarious powers of Suga, a member of the Don Quixote pirates. Completely powerless in this state, Cavendish had no choice but to put his hopes in the hands of the straw hat pirate Usopp, who how shall we put this, rather unconventionally succeeded in breaking Suga's powers. And from that moment on, Cavendish made a vow to cease all hostilities against Luffy, as his thanks. Cavendish, along with most of the Colosseum fighters, then led a revolt against Don Quixote Dolflamingo, with his most notable action being the defeat of the officer Delinger, with a single slash in Halkuba form. However, Halkuba would then go on to be subdued by Niko Robin, who essentially possesses a devil fruit that is a hard counter to his speed. But this moment would go on to show us that Cavendish is able to rest control of his own body back from the clutches of Halkuba, and the two had something of an inner battle going on, with Cavendish eventually proving capable of suppressing him entirely, and following the defeat of Dolflamingo by the fist of Luffy, Cavendish and the beautiful pirates would become one of seven groups that pledged their allegiance to Luffy, and formed the straw hat grand fleet, marking a radical shift from his once selfish desires to be the center of attention to wanting to be part of something greater than he alone could ever achieve. Although with that said, Cavendish does still retain his attention seeking ways, as demonstrated by his part in the straw hat grand fleet cover story, where he regales Suleiman with the tale of how he was exiled from the bourgeois kingdom. But as it stands right now, Cavendish is one of many apostles who have made it their mission to spread the good word of Luffy throughout the world, and has no doubt greatly contributed to him being considered as one of the emperors of the New World. Some more fun facts about Cavendish. Cavendish, as with many characters in the series, shares his name with a real life figure, in this case being the English privateer Thomas Cavendish. With that said, his name may also be taken from Cavendish Square, a location that features in the story of Dr. Jekyll and Mr. Hyde, which is a clear inspiration for Cavendish's split personality. Speaking of, interestingly enough, Hakuba, as spelt in kanji, quite literally means white horse, which is Cavendish's prime epithet. And finally, a truly useless fact, Cavendish is the second royal figure in the series to have been banished from his home country, the first of whom was Wappo. But that pretty much does it for Cavendish. If you enjoyed this video and the content this channel produced in general, then please do consider donating to the Grand Line Review Patreon, because the support of all of your amazing people is what continues to make this channel possible. Also, do check out my Teespring store if you're interested in shirts, hoodies, and other miscellaneous items, with the proceeds going directly to support the channel as well. And if you'd like to join the fun at any time, then please do head over to my Discord server, where a wide array of shenanigan retakes place on a daily basis. And finally, please do comment with who, what, or where you'd like to see featured in the next One Piece 101.


this session we will see what is the current status of ESG in Indian company. So, this is published in 2020 that is responsible business ranking that is that shows the India's top company for sustainability in 2020. And if you see the list possibly you will find that yes few of few of the company names should be there in the top 10 sustainability company. But also the interesting fact is that the sustainability is led by a service company that is Infosys and the manufacturing companies are there in the list, but typically it is being led by a service company. We will discuss more about the trend of this top 10 sustainability companies, but mostly if you look at it covers almost all kind of company like it start with a service then you find the big manufacturing one over there and also a public sector company that is BPCL that is also appearing in the list of top 10 sustainable company. Now, the highlights of this report this responsible business ranking report is if you look at the ESG performance of the company it has increased across the board that we will see later when we get into the each component of ESG. First time a service sector company achieve the top rank, manufacturing company continue to perform better than the service company because that is mostly on the basis of the numbers appearing over here and IT and diversified are the top performing industry while NVFCs are typically the laggards and integrated reporting is ramping of 26 percent of the company produce the integrated reports and all the top 10 company they map their business goal into the SDG that is sustainable development goals. So, next after next few session we will also see what are the sustainable development goals and how company they have mapped that into their disclosure and what are the effort they are putting to achieve the sustainable development goals. Now, getting into the manufacturing and services. So, manufacturing company on an average score far better than the service company overall and across the criteria. So, if you look at the top 5 in manufacturing and top 5 in service companies, the manufacturing company is led by Mahindra and Mahindra and service company is led by Infosys and the top 5 manufacturing company Mahindra and Mahindra, Tata Chemical, ITC, Vedanta, HUL. In fact, in 2017 also the when this top 10 sustainable company came all those manufacturing companies were there in that list also. Infosys, Wipro, TCS, they are also there in the list in they are going on publishing the sustainability report. And in fact, Wipro does lot of activity with respect to the sustainability outrage. So, the total score for manufacturing is 71.7 and for service it is 63.9 and if you go to the specific component also on environment, social and governance. So, manufacturing in all these cases they are leading that is in environment 26.6, in social it is 18 and in governance it is 27.1. Now, next coming to the ESG for all the company over years, this graph shows the progress from 2014 to 2020 and if you look at it is the performance is increasing over years. In few cases you will find that the increase is not very highly significant, but over a period of time the performance in environment and social environment, social and governance it is increasing over years. Then coming to the industry this also we are mentioning in the beginning that information technology and diversified companies they are the top performing industry and typically the financiers they are yet to picked up their sustainability efforts or the sustainability disclosure. So, in information technology total information technology the average score is 82.0 that is by Infosys, in diversified it is ITC that is 77.1, other industrial this is Adani they have 76.5, healthcare 73.3, energy 73.3 and similarly if you look at the financial is the first time it is HDFC bank that is 66.7. So, this trend shows that information technology and diversified they are performing better, reporting better as compared to the financial companies. This is the chart for the environment based on the composite score. So, over a period of time this is increasing the environment performance is increasing and there is a initiative to develop the climate resilient infrastructure, enhance climate resilience and reduce the vulnerability to climate change. There is a participant for this whatever the initiative is being planned by the corporate for climate resilient infrastructure or increasing climate resilience or reduce the vulnerability this requires the critical participation from both the companies as well as the government. And specific with respect to renewable energy we will see the renewable energy also coverage in next few slides, but renewable energy forms only a small proportion of the total energy consuming operations across sector and the government if you look at whatever the NDC commitment we have given that is what we have to achieve by 2030. The government expect that non-conventional sources to account for almost 40 percent of the total generation capacity by 2027 because that is what based on the goal what we have given as a part of our NDC in Paris Summit. This is renewable energy performance, this is linked to sustainable development goal 7 and the disclosure of the share of renewable energy in total electricity consume continue to be limited not showing very significantly high or significantly it is increasing. Tata Motors few of the examples in the initiative in the direction of renewable energy is Tata Motors aspired to operate on 100 percent renewable energy in coming future and their signatory to the RE 100 initiative and so is also Dalmia Bharat. Then Maruti Suzuki they are using solar power for lighting its manufacturing plants and office area and now they have also started using solar energy in the manufacturing of the car. So, initially they were using the solar power only for lighting but they have used the solar energy in the manufacturing of their cars or their production process. Similarly there are few examples in the renewable energy use of renewable energy in the supply chain. So, Tata Motors encourage its supply chain partners to fulfill their energy requirements from renewable sources and mostly there are few initiative with respect to rooftop solar plants and also because of this rooftop solar plant installation they have achieved 12 percent reduction in their carbon emission in 2018-19. This is the Minda stone reach which is the one of the supplied for the Tata Motors. Similarly United spirit they aim to use more renewable energy and improves how it manages to use water, eliminate waste and optimize the packaging design. Although numbers have not given but they have given that what is their goals or what are mostly with respect to use of renewable energy in their across supply chain. Similarly Coca-Cola India they promote the use of renewables especially biofuel crossing their boiling units. Few more example of BPCL they are mostly looking into the biodiesel and they are encouraging the biodiesel manufacturing to the use eco ester feedstock that is use cooking oil. Then HPCL and IOCL they have issued a letter of intent for setting up the compressed biogas plant and that is the capacity of 20.6 TMTPA spread across Gujarat, Maharashtra, Punjab and West Bengal. Then ONGC has set up a bio CNG come fertilizer and bottling plant in Haridwar to convert the cow dung to useful fuel and value added product. Similarly Indian oil they have undertake a project to convert refinery, of gases to ethanol using the Langer Tech technology and also they have implemented a pilot project 50 buses in Delhi with Indra Prasth gas limited to run buses on the reform hydrogen CNG that is HCNG fuel. So one of the interesting highlight of this slide if you look at, look at the profile of the company those who are integrating this use of renewable energy in their supply chain and typically these are all public sector and this is good to see that even the public sector company also they are taking specific initiative for integration of renewable energy in supply chain. Then also few of the organization they have used the renewable energy in their e-mobility but over a if you look at the trend or if you look at the numbers what is being reported in this responsible business ranking there is poor adoption of EV by corporate in India. It is yet to be like taken largely by the organization only around 8 percent of the company report the use of electric vehicle in their logistic. They utilize EV for their internal transport employee commit and also outbound logistic and WIPRO and SPI their member of EV 100 this is a global initiative by the climate group and it brings together company that are committed to accelerate the transition of electric vehicle by 2030. These are few of the example in the right hand side of the slide if you see few of the example of electric vehicle logistic and the company those who have used is GMR, Hero Motocop, Tota Power, Tata Power, Power Grid, WIPRO and HPCL. Then also there are few of the organization they have taken the initiative of use of renewable energy resources for the community. Around 40 percent of the company they studied from this entire universe those who have given their disclosure they contribute towards the renewable energy project for community. And this renewable energy project for community consists of lighting and clean fuel that is upgrade solar lighting solution, solar irrigation pumps, biogas plant, solar hot water system, clean fuel stop and solar dryer. And Kanra Bank as a part of marketing support they have given the Kanra Bahini to enable the women entrepreneur and SSG to exhibit and market their product in Bangaluru and other places in Karnataka, Uttar Pradesh, Coimbatore and Tamil Nadu and Kerala. Now, few initiative for E-Waste what the information is given by the company in this responsible business reporting. So, for the employee this Tecmaindra and Cisco they conduct a E-Waste collection tribe for their employee. Similarly, RFC, Rastio Fortilizer and Chemical and Hezdu Stanjir Singh they raise the awareness among employee regarding the E-Waste generation on environment and advantage of E-Waste disposal in a scientific manner. Similarly, for customer reliance industry and Cisco help their customer to recycle their E-Waste. Similarly, for community, come means they partner with various NGO, school and local community to create awareness on E-Waste. And ITC they give preference to dealing with IT vendor having a sound E-Waste management process and this is typically the E-Initiative for the E-Waste in the supply chain also across the supply chain. Similarly, for plastic waste some leading company across industry they have placed for plastic free organization in near future. And few of the example for Hero Motokov on single use plastic in its operation then they also looking at 100 percent of their packaging recyclable, reusable and compostable in near term. And few of them also making this as a part of their extended producer responsibility rule or EPR rules to establish the reverse bending or the collection point for the plastic waste. And those organizations are Coca Cola, ACN paints and Reliance Smart. Similarly, few more initiative in the category of the plastic waste. Now, coming to the S part of our ESG performance that is social disclosure practices. So, mostly the social disclosure practices based on two question. How well are the key stakeholders that is employee, community, customer and supplier integrated with a company responsible business framework. So, the initiative what the organization they are doing whether it comes under employee centric initiative, customer centric initiative, community centric initiative or supplier centric initiative. And also one of the key component of social parameter is expenditure by company on CSR, how much they are spending on CSR. So, this again we will see when we get into the CSR performance of the company, but company have steadily improved their performance on this count. However, still they do not have the adequate program on the social space. Similarly, when it comes to governance, how will the governance for responsible business structure. This is one base question on which the governance core is governance disclosure or the governance performance is major and how forthcoming companies are with respect to responsible business activity and performance. So, with respect to first question how typically is being addressed or how typically the initiatives are being taken is about board oversight of CSR and sustainability issues, managerial accountability of responsible business issues, then corporate policies and management system, then a formal policy on sustainable practices a formal CSR policies. Similarly, with respect to the second question that how forthcoming company of how forthcoming are companies with respect to responsible business activity and performance. These are typically measured through how whether they are publishing the sustainability report as per standard such as GRI reports, how they are filling the financial filling with respect to disclosure, how they are participating in global projects such as carbon disclosure project, how their business goal is mapped with sustainable development goals and also the external assurance and impact assessment of the responsible reporting. So, based on this performance typically their governance core is decided. So, this is what the governance it has shown the steady improvement over years from 2014 to 2020. And the percentage of company those who have adopted policies regarding which is which is adding up to our governance is like formal policy on working condition 97 percent those who have disclosure they have said yes. Similarly, the formal policy on discrimination and human right if it exists for the company whether equal pay is there not no discrimination based on gender race, disability whether that is there in the exist in the company or not and the board diversity that also part of the governance. So, based on that the governance core is decided and there is a steady improvement over years with respect to the governance core for the company. This is the definitive USG universe study finding and typically how Indian company they are doing with respect to the entire USG universe. So, entire USG universe is about 9000 public company and the rating if you look at for the Indian company over here the Indian company typically they are leading with respect to average transparency rating, CSR and sustainability reports ESC related executive compensation where the score is lower than the ESC universe then business ethics policy then policy and bribery and corruption. So, these are few of the performance of the Indian company with respect to transparency sustainability report ethics policy bribery and corruption. So, to summarize the how Indian companies they are doing with respect to sustainability or with respect to the business responsibility these are few of the key trends which have been identified by this responsible business ranking in future scale that this is the year also we have seen the importance because pandemic has taught us many thing and one of the important thing what has taught for the business is that it has highlighted the importance for responsible environmentally friendly growth, increased demand for green recovery world over then the informed customer are actively looking for the sustainable product and company and they treat their stakeholder well. So, if mostly if the customers accepting the product accepting the company then the company performance is better than the other company and how the customer they are accepting the company that is with respect to the product if it is a sustainable product how the company they are treating with their stakeholder based on that the acceptance from the customers coming for the product and coming for the company. Then investors are increasingly investing in ESC fund and volume of this fund in fact it has increased like anything on the ESC fund and company that rank high on ESC provide the higher return and tend to have a lower cost of capital and this is what in fact summarize the entire what to say the perception or entire the question what the businesses they keep on asking when they take a sustainability initiative what it gives us back whether it is only the improving the brand, improving the perception of the company as a green company sustainable company. But if you look at based on this trend the sustainability if you take the sustainability initiative of you are performing better in your ESC that also gives a higher return and tend to have a lower cost of capital which is crocs for the business to sustain financially in the short term and in the long run. Thank you.


Welcome back to another review and today I'm going to take a look at the rig called Daniel. This is from ProRigs and ProRigs is a site where you can subscribe to a monthly character subscription package here, you can see this here. Lots of awesome rigs. You got the kits, you got groups, you got zoo, family, couples, robots, basics. There's more to come. It's really awesome. Great support. This is the latest version. By latest version, I mean, this is release 11. So for me, this is the latest release. I don't know why the time this comes out, maybe there's a new one, but that is the latest one for me. Head over to the site. Of course, there's going to be a link in the description where you can subscribe. You can see all the information here about the rigs, what is going on, who's training them. It's a great team. Lots of support. This is not also supporting Maya 2018 to 2023. I'm using Maya 22 at the moment and as always, I want to put this on my animation beefy site as well.  So if you have anything you want me to look at, send me an email and I will add that to my long list of rigs, but it's going to be on there. But make sure to check out pro rig for all the direct information of those rigs. Now let's get to the rig. This is the full thing in its glory. As always, I'm going to start with the main controllers and then bottom to top. So main control on the outside here, you have main translate and rotate. And that's it. Scale, nothing else. But if you select this one, as always, you can move that down. And if you have an extra controller, technically, then it creates a new pivot point. If you are now animating Superman, flying around with a different pivot point. Some rigs have also like manual pivot point changes, but that's one way to talk about it. Now, if you do select this, you have a global scale control here. So it's not your scale as in your hockey easier, but this is the one to go with. So of course, you can translate and rotate and all that good stuff. But on top of that, you have all these controllers here. So this here, you can see them on and off, what you have here. You have Gimbal controls, body polish, you got your extra bend bows, stuff like that. Clothing extra, which is also cool. Let's go back to there. You can see this here. Belts and sleeves. So if you get to this here, you can move this around. It doesn't move the sleeve back. There's no geometry underneath here that will reveal and the body underneath. You have that. You have face polish on top of that.  I'm actually going to leave that on just for now. Actually why not leave everything on here, right? Then you have the geometry of visibility. So if you don't want to work like this, you can say, I want to turn this off because I don't want to just concentrate on the limbs. Why not? You can also just take these off. You have head and neck is this and then legs is that. It's going to all make it a bit faster if you want, but if you want to change that even more. So you got this here, the geo complexity. So you can go to zero. It's going to be like this or you can go like that. You can see this goes up to two. It's going to be a lot smoother. You can see this here in the mesh, how the mesh changes. So I'm actually, should I leave it as one? It's pretty fast like that. It's definitely making a bit of a difference. I don't know. My computer is getting old. I'm going to blend in my stats at the end. For now, just in terms of prettiness, I shall leave it at a one. And if you want to select the geometry, you can't. This is just the controllers. Why? Because in here you can go into reference. You can have the template like this or normal, which means that you can now select this and go in there for any type of texture changes or whatever you want to do to modify that. I'm going to leave that at a reference. All right. That is that. Then you got this guy. So you select this here. Now you got a skin shader. So this is set to original. You can also go custom, and then you can change that into whatever values you have, into the craziness, whatever it is here. So that goes back here for everything, hair, skin, shirts, secondary shirt, pants, and so on. And if I go here, look at this. So many options, highlight shader, glow, an accessory, an accessory 1205, pupil shader, and so on. There's a ton of ways to customize the rig. And on top of that, of course, you have your bimbos, right? So if you do anything like this, unfortunately, you can't scale, because that would be next level, to then take this and make the legs bigger, smaller, take the torso scale. That is not there. I would love to have that function kind of reshape it as needed or even like in polish, face a specific shape here, and you want to move this out and just kind of extend it and make it a bit bigger. Sometimes it's kind of neat to be able to scale that. That would be on my wish list here. Now going to the feet, you got this controller here. So with this, you can translate, right, move this around. When you rotate this, it's just a foot. So what you can do is you can take that pull vector and move that to align it. And if you select that pull vector here, you can see pin knee, so you can actually take this and then move that around like this, and you got world pelvis and foot switch. But if you don't like that, right, let's go back to your foot. There you go. So you have, use pull vector. No. If you say no, now you can twist this with an attribute. I'm actually a big fan of that one. For some reason, I'm not kind of like having that in there. But it's totally up to you. Sometimes when you animate, and then you have a pull vector that's, you know, somewhat hidden in there, or you, I don't use some tumbling around. Sometimes it gets a bit odd to select, so I'm glad that the foot has this option here. Now looking at the rest, we have a foot roll, classic nice shoes. So you can see here out how the toes go down at the end, but then they go into tippy toes like that. You can go pretty far. If you're going to break this. Foot banking, left and right, which is awesome. I use this a lot. It's just like pushing and sidesteps, this is a bit underused. There I say, buy students. So if you're a student watching this, don't forget the foot banks. Heel pivot. So you got this from the side here. Toe pivot from here. Make sure that the pivot is back to zero, so you can see this. So that's your toe pivot like this. You also have the toe spin or like the cigarette squashing thing. If you're old and remember cigarettes, don't smoke any money. Foot squash, which is also not always on rigs. I like that we have that. And then of course the follow world or pelvis. Then we have an extra controller here. So here you can rotate these guys down and you can't translate and you can't scale. So that's just purely for rotation. And then we have this here back there. This is for a, the switch. So you got IK, FK legs. So we're switching into this. So now we don't have the IK leg and it's a classic FK like this. No weight shift. Then we have the upper leg stretch. So you got that option, which every rig has, it's always good for tweaking. You have volume compensation. So let's say I'm going to go back to IK here and have this, right? That's my foot pose. For some reason it's all stretched.  You can see how well, if you stretch something, it should technically get skinnier. Well, that's what it does. That's your option there. And you have auto stretch on off. So I can't overextend my IK. But if you don't do that or if you have that activated, you get those leg extension pops. So sometimes it's also okay to keep the stretchiness. Don't overdo it because then you will see the scale. But sometimes it helps softening the IK pop. You got a foot scale. Change that. So my, you know, my hope to scale things like that. Sometimes you have the options in the foot separately. Sometimes I just like, I just like it on something like this. Like this doesn't have any options here. But like I said, you can scale the foot using this controller. Now going down to here, you have the pants. So you can go up pretty high actually. You got some socks down here, but that could be fun to adjust. Can we scale? We can. I like this. You can create some elephant pants, as we used to call them. Trumpet pants, elephant pants, wherever you're from, you probably have a different term for these kinds of pants. We have that. And of course, you got your bend bows here, there you go, here and here. And then at the end, you got this controller here where you can translate that out to kind of move things around like that. Of course, given that this is a leg, this is going to be on both sides. Now, in order to minimize what's going on here, again, bend bows everywhere for here, including here, that's the deal. But I'm going to take these and actually turn them off. So body polish, gone. And also gimbal. You can see here, there's extra gimbal controls. I'm going to turn these off as well, just to kind of simplify things a little bit. Going up, we got pelvis. Select it. There you go. That is how it moves. Sometimes with pelvis controls, it gives you kind of an odd pivot where it moves things and translates around. This is a nice pivot. So you have this, but you can also translate. So you can do your whole dancing animation that never gets old. If you ever watch Collins Bear, there is a demo reel called Collins Bear. There's a tribute called Collins Giraffe. Collins Giraffe has an awesome dance that looks like this. This is an awesome demo reel. Thanks for nothing for any of those that know the reel. Here's your route. You can't scale, but you can translate and move this around. As you can see, we have arms at IK. Then we go up to the chest.  That's the option there. And then we go up to here. So now we have translate, which I love a lot. I like that. You can do it like this. It's much simpler than like 50,000 chest controls and spine controls. I always like things that are just a bit more simplified. In here you also have breathing. You got kind of a chest move rotation, shoulder move for the breathing option here, and then volume compensation. So it's the same thing. If I stretch this guy, it should get skinnier. You got this here. That is that. Now just to go back down here. Since we have clothing controls, this is for your buckle. Move this out like that. Obviously it's one too. You got buttons that you can move. Go in here. You can't scale. But if they pop off or something, you can have that animated.  There's nothing here in terms of belt control, which could be kind of neat. So if you have this here and you move that away, it kind of needs to have, I mean it's getting into the weeds, but imagine you could slide this control maybe off and then have that, you know, the rest of the belt, the tongue, what are you going to call it? It could flip out and kind of rotate. Could be kind of neat. Kind of doing, putting pants on and off type of action. Somebody comes back to work or not back to work. From work comes home. Once they've changed, that could be kind of neat. Here is an extra control. All right. Select that. And now what we have, you can see this here. Here you can move that around. This is your spine bend. You don't have translates, rotates or scales as you can see in the child control spoilers right there. But you got these controls for here and down to here and looking around. That's what we have for that. Then we're getting into this here. You got your color controls, which is cool, which you can scale, but nothing really happens. So if that's a remnant that needs to be hidden, but that would be kind of neat. As always, I just love being able to scale everything and kind of change the shape of rakes, but you can see this goes all the way back. So if you need to move the color around, this goes all the way back. And then up here, we have the shoulder. So you can see here is your rotate. You can also translate out. So if we have now you move FK style, you arm up, that's when you want to go up here and move the arm up. Not too far. You can see, given the cloth here, it's a little bit of a limit in terms of deformation, which I would love to have a bit of a softer fallout here, fall off. Go back to this here. I'm going to leave it just quickly back into IK, just because here, select this. We have the pin elbow, again, super important once you have this set on a table or something, which back in the day, there was no pinning option.  Obviously, you have world chest and hand, world space changes here. This here, like I said, this is for your sleeve. And then we have the IK hand, this is a sticky IK, meaning that your wrist is not going to change orientation depending on where you move this around. You've got the auto-stretch on off. So as always, I'm going to do this, no stretch, do this, it's going to stretch. And then the same thing as with the leg, you have a pull vector on off. So if I say off, I should probably go back into a bend here. You have the twist, if I can select this, what's going on here, there you go. You can select that option for that. Going back to here, you have the upper arm, lower arm options of all the conversation, just like with the leg. On top of that, you've got your fingers. So here you've got your overall translate or rotates, I mean, two different axes. You have a display, you've got the curl and you've got the side like this or slide, which is really cool. That's to quickly block out something like this, like some tension or putting that on a surface so much faster than this, you know, one by one, you've got your scrunch and then you thumb curl as well. And then you've got arch, don't forget this, especially when you make a fist or more relaxed pose, that helps that as well, cup and then you got that overall, the pivot is higher here, two rotations and overall relaxed pose for quick block outs, which is great. And then hand scale, Hulk smash like that. Now if you don't want to do this and this is not detailed enough, obviously you can see this here, you can take that, you can translate this, you can rotate this, you can take all of these controllers and do this all by hand, no pun intended, manually with the fingers, if you don't want to do global controls. And sometimes it gets a bit messy. I am not in the camp of let me just curl this into whatever pose and then on top of that change this, unless it's like a quick added fix, why not? But then you got, you know, different controllers fighting each other, not super fans, be careful when you do that. And that is of course on both sides, going back into the head, we can select this here, you can not translate, not scale, but you can rotate, you can move this around. There's also a align world chest option and the neck tense and I thought this was going to be a shape, as I remember, for tensing the neck, but right now it doesn't do anything. I don't see any changes in geometry either. So I'll check that later, maybe I'll put it in the comment section and pin it, unless this was a bug that something got introduced in this latest release, I will check. You also have the actual upper neck or the head rotation. So this is the lower part. So we got the actual head, but don't forget that I mean both, if you got to me, so you can actually translate this and move this around.   Turn this all back on. You got geometry, visibility, everything. I can see extra stuff here is awesome in the hair, right? And then you got your hair top, you can move it like this. You can rotate as well. You can also scale doesn't do anything on the hair. That's a bummer, but you got that. You have this control here. This is your head gimbal, extra controller on that on this. Even if you go into the chin, you can see here, you can move this down. You can rotate, you can translate, and you can also scale for a puffy thing as well. Then let's go to ears. So you got your overall ear shapes. You can translate, move this out and also scale. So this is adjustable. Shall I answer facial feature changes? Now, looking at this here, you wonder, well, how do you open the eyes? Because if you select this, you only have these options here and in this here. That's when you don't forget you got to put on nerves, surfaces. As I was talking about for that squash and stretch at separate, right? And you get the same thing here for the bottom part, a volume compensation effect, nose, which I like a lot. I said that you can change that, right? So if you move this, you can say, well, I don't want it or I want more. That's pretty cool. The thing that I would probably tweak that might just be me is that once you select this here, either this one, which does obviously a bunch of stuff here in terms of the eye socket, rotate, translate, squash, stretch, but I'm going to open the eyes first. If you're for some reason, maybe you don't want to do this. You don't want to have surfaces on or you forgot whatever it is. I would love to have controllers that open the eyes just in case. I know it's kind of like, well, either you know or you don't, but it could be great to have these controllers here and maybe this could be a controller here on this or this one or even here that says blink. And you can do a quick blink because I like the idea of a quick curl for blocking, but you want to go into detail with these controllers. And the same thing for the eyes. I would love either one of these controllers. If you look at this here, all right, go back out of the eyes open. You have this and this is your socket translation rotation like that. You have squash and stretch. Move this skew is like that. You have a squint as well. You can see how much it moves here. So you have atrophic brow yourself eye scale like this here. So it's cool to have all of this, but I wish there was like a quick function of blinking, but like I said, this is this here. Control this on off. And this goes into all of these here. You have a bunch of extra shapes and this goes all the way to here. I do love that we have something here and not just on the cheeks for the puff, which is also a channel control to puff it like that. If you got stung by me by that extra little shape control here to get some extra movement, I think that's definitely great. Also here, eyebrows will be moved like that into all kind of directions. And you can look at the channels. There's nothing else. There's basically just that here, but you have extra controls now for nostrils, which is interesting. Obviously, this is on both sides. You have this here in the middle where you can get punch in the face and have that.  So there are lots of options in there. And then as you open here, chin option here, as you open the jaw, then you can see here those controls and how far they go. You can see like the corners are not affected, because you don't want this to fight or you're doing with the math controls, which is great. So math controls are back to regular nerves. So you have to look at what you have here. You can move it all the way like this. You have also a pin. You can pin this down. You've got the zipper, which is important for certain shapes here. On the zipper fall off, right? So if you do this, you can decide how far we want to go and zip this. And of course, within all that, you got extra fine tuning controls where you can really shape all of this. Again, an outer control and the inner control for all of this. It's really detailed. It's very cool. And if I open that here, you can see this here. You can move your lips like this, but you can also translate. If you want, you have control for curl like that or thickness. There's a bunch of stuff. So lots of cool controls. And if I take the jaw, let's just a bit more here. You can see the tongue control. So this is obviously here. You can see that reveals this. And then you can also see for the teeth. This is more on the soft side, but you can also grab this and move the whole set of teeth. You can see this here. And then if I go back here, that's your first control here for your tongue that moves everything around here. Then we got this one here. This is for your mouth. So you take this and you got that whole shape here that you can scale if you want to. And it holds a specific shape of muscles and functions. It's kind of neat, but you can move this around and that's for like a quick asymmetrical change of to the side. Which again, you have all those quick options, which are awesome. And I would love that for the... Again, I have the eyeballing, like I said. There's a nose follow as well. That's mainly that going to the nose here. This is not your nose ring, but you can move that down here. You can also scale if you want. Your nose tip as well. Pinocchio style moving like this. I remember doing a demo for my little son's class and I had, I think it was the Woody Rick that you can get for free online. And I went through all controllers and did like animation demos and showed some shots. And you know, the kids were, I don't know, there were maybe nine at that time, maybe eight. Not impressed whatsoever. They didn't really care. And then the moment you select this and you go, well, you can also just shape the character. That set them off and they loved it. The love that you can do that cracks me up. Anyway, you can move this here, the full nose and you can have scale as well and translate and then you can also have this here. So as you do your line of action of your jaw, you can technically go pretty far in re-sculpting and reshaping and removing whatever you want until it breaks, of course. That's just me adding all those controls. Look at that, broken. That is that. Obviously left, right, same side. You got the ears that I talked about. You got your hair control here. Like I said here, this is your head gimbal. And I believe that is that. Talked about eyebrows here, right? You can move this, you can select this main curve and move the whole thing around. And obviously like the shapes in here, but also shapes in here. You can really re-sculpt this area. So in terms of facial controls and facial detail, there's a lot of really cool stuff. And of course, main eye controller that you can do this. And as you move out here, you can also move that eye separately. And then if you move the head around, that is going to follow. But if you don't want to do this, you can do what I want to follow the world. And then it stays put.  And if I go and do all of this, that is kind of that. I don't think I left anything out. That is the rig in its glory. Now, it is pretty fast for me to move things around and manipulate, but this is an older machine. As you can see, my stats graphics card is getting old, probably next year or so. I'm gonna update the PC, but it's still good to move around and animate. And don't forget, again, you have resolution control, not here, but here. Wee, there you go. Where you can change the complexity as well. But yeah, super peeling rig. I love the look of it. I love the hair. It's a fun look. I like the shoes. It's such a kind of old school, almost that. And if you look back at the website, you can see here that in action with the kid. It's super cute, very appealing. The whole set of rig selection, the kids and the animals, it's just such a great selection. So I highly recommend to check out pro rigs, all of them. And I have been told that they are going to update and add things like flying creatures. There's a bunch of stuff that's on the horizon. So I'm super excited for that. And that is that for the rig. Any concerns, feel free to comment, but I will know a lot less than the people who created the rig. So feel free to comment and email them. They're usually pretty fast in returning any questions, any concerns, any bugs, and they do update the rig frequently. So this is not like, hey, we released this, we're going to ban this and you're on your own. They do frequently update and listen to requests and it's a really great team. So that is that. As always, feel free to subscribe. This is like the YouTube page at the end. If you don't want to miss any of my uploads, I am back to uploading on a more regular basis. So that is that, like and subscribe for the algorithm as we all know, and that's it.  I can't stop the clip like this. How about like that? Also, by the way, which I kind of skipped. No one is watching this anymore, but if I'm back here, you got pupil changes. I'm selecting these at the same time. Lids, follow eyes, you got the iris like this here. This should have been shown at the beginning. It's kind of creepy. And then all of this here in terms of changing the highlights and moving stuff. It's really great. Again, lots of details. This should have been shown before, but I am out. I am ending this. So feel free to watch more clips and watch out for upcoming Pro Rig reviews. Thanks for watching.


Hi. I wanted to go over some commonly used terms that you're going to hear throughout your transaction. Have you ever wondered what the term a blind offer is? A blind offer is when you put an offer in on a house that you haven't seen yet, a sight unseen. You'll see that often in a couple different situations. In one situation will be when there's a multiple offer situation, you didn't have time to get in and see the house and now there's a bidding war and you put your offer in without seeing the property, which may seem kind of scary and it is. You can make that offer contingent on the home inspection so you're able to get in there, get a home inspection and still get out of the deal and get your hand money back if you don't like it. Another time that blind offers happen is when a foreclosure comes on to the market and you can't get access to the property or again it's another very competitive market. If you know that the property is going to be in bad shape and you're an investor and you know what you're looking at, a lot of times you can just go in blindly and say I can tell by the outside I'll take it and just deal with whatever comes. Usually those offers are much lower. They're a different scenario than if you were in a bidding war and doing a blind offer in a multiple offer situation. So those are two different times that you're going to hear the term blind offer or you may be in a situation where you would put a blind offer in. I hope that clears up that question of what a blind offer is and if you have any other questions or comments please don't hesitate to leave them below and we'll go from there. Thanks again for watching and have a great day.


Well, I, my family belonged to Legion a long time. My father would go every year to the Remembered Stay, and that was his extent. I think Legion, they're doing the best they can. Well, it was kind of a fun night out, and Branch 44 is the one that I originally joined. And they make a nice evening of having, quite often, they'll have music, they play bingo, and make everyone welcome. Whereas, oh yes, they always have something to eat. Candice is in charge of TB deaths. Some of the ruling, and way back when, men could join that women couldn't. And it's, fortunately, that's changed.


What is your expectation for this year-long process of a summit and what do you most want to see out of it? Starting with you, Glenda. My expectation for the summit are two things. First is really the focus on how to clean up the information ecosystem that impacts not just journalists, but activists, citizens, and all democracy frontliners. Second is for this kind of summit to be institutionalized in very specific countries that are under siege. And for those agreements, if any, to be cascaded down to those countries and be reflected in the way citizens are protected in the way media should be supported, especially those under attack. Glenda, thank you. Olexandra, your expectations for the summit? I want to say that our world are rapidly changing and nobody knows the future. But there are a lot of things which still is stable and have no limitation of national border. And I really expect that this summit will remind about such kind of things. Solidarity, human dignity, and freedom. Very well said. Farhad, your expectation? Well, I have a hope rather than expectation. Hopefully that the conflict and the rhetoric that is used among these leaders to be a lot less and more focused on dialogue and cooperation than anything else. Because whatever they say and whatever they do reflects directly on, especially on the third world country, especially in our region in the Middle East, and have negative or positive effects. So hopefully that they will come out in agreement and in a united wording of whatever, or at least they can put their differences on hold for the time being with all the challenges that's facing the world with the pandemic, the economic crisis and everything else. Farhad, thank you. And finally, Idia, your expectations. What do you hope for? I think I'm quite hopeful of this summit. And I think first and foremost, it's what is actually putting out to the people that democracy is not a given, that it actually has got to be nurtured. And that at the end of this summit, we would have the leaders coming out to acknowledge that, yes, democracy is actually encountering challenges, but this is a new beginning to foster democracy, to foster development for the people of the world. Thank you.