Jog heddiw, pob. Hefyd yna'n bwysig. It's a flat word of, um... Sorry about that, chair. Are we? We are on the second out, we're running through the bottom. Okay. Right. Going to start again. Um, so... Right. Right from the beginning? Right from the beginning, I'm sorry, chair. Okay. Thank you. So, welcome to the Licensing Committee, which is at South Cam's Hall and on Thursday the 19th of October at 10AM. Mae'n angen i chi dweud hynny'n gwirio, ac mae angen i chi dweud hefyd. Mae enw i wedi'i'n gweithio, gwirio i'r ddod. Gweithio'n ddod, mae'n gwirio i'r ddod, a'n gwirio i'r ddod i'r ddod, yng Nghymru Annika Osbourne, ac i'r ddod o'r'r gweithfodd yng Nghymru, esbyty o'r honno, Jos Hale, Corren Garvey, Shabona Bataeciaia, Judith Ripeth a Bunty Waters. Roeddwn i'n gweithfodd. Felly we've got Councillor Peter Saund for attending online. Thank you very much. So I'd like to go round the room to clarify who's here. So Councillor Howell, would you like to introduce yourself? Rydda di-sia-fawr here, Chairman. My name is Mark Howell, and I'm one of the members that represent the Caxton and Papawth Ward. Thank you very much. Good morning, my name is Councillor Lisa Redruff, and I'm one of the members that represents Haarston and Combaton Ward. Thank you, and the councillors. I'm Councillor Eileen Wilson, and I represent Cotten and Ward. Thank you, and I'm Councillor Annabraith, and I represent Milton and Waterbeach Ward. Sorry, and Councillor Sanford, would you like to introduce yourself? Yes, thank you, Chair. Peter Sanford, the other Member for Caxson and Papworth Ward. Thank you. Other people in the room include Rachel Jackson. Thank you, Chair. Rachel Jackson, Principal Officer for Licensing. Thank you. And our staff streaming the event. Erin? Oh, okay. So, we have Lauren Stammery homing producing the meeting, and Erin Clark. Erin Clark, yeah, Clark for the meeting today. Thank you, Chair. Thank you very much. And also online we have our legal advisor. Would you like to introduce yourself? Hello, my name's Felicity Gullsbury. I'm a new barrister who's just started as your Licensing Officer. Thank you. You're rather distant.  Can you hear me now? That's better. Thank you. Thank you. Felicity Gullsbury, new Licensing Officer. Thank you very much. Sorry to have the sound of the sensitive compared to the team committee. Thank you very much. So, Members, do we have, does anybody have a declaration of interest with regard to this policy? So, we have the minutes of the previous meeting, which was a long time ago, 5th of October 2022. Members, there are some of us here who were there then. Does anybody want to confirm that they're happy with the accuracy of the minutes? I'll propose. Can I just ask for some clarification on the second paragraph of Section 3 of this? Yes. I just want to say that Members were provided with evidence that supported CCTV in vehicles, excluding Executive Ones, but the Principal Licensing Officer that there was no evidence to suggest a pressing need nor proportion to mandate CCTV in exempt vehicles. I just wasn't sure that quite made sense. The grammar isn't quite there, is it? Just for a record, was it that the Licensing Officer reported that there was no evidence to suggest a pressing need for exempt vehicles? Can I suggest that we, are you able to clarify what that was, Rachel? Yes, thank you, Chair. I think the work that's reported is suffice. Members were provided with evidence that supported CCTV in vehicles, excluding Executive, and I would actually prefer that to say Vehicles, but the Principal Licensing Officer reported that there was no evidence to suggest a pressing need nor proportion to mandate CCTV in exempt vehicles, according to the guidelines. We have to say Executive Vehicles, Executive Exempt Vehicles. Oh, because it's Executive Higher Vehicles are exempt from holding a displaying taxi plates, etc. So it's just a way we call them Executive Exempt. So it should insert Executive Exempt. Thank you very much, Chair. So for clarity, I'm going to read that through as I understand it then. First sentence is fine and then it goes. Members were provided with evidence that supported CCTV in vehicles, excluding Executive Vehicles, but the Principal Licensing Officer reported that there was no evidence to suggest a pressing need nor proportion to mandate CCTV in executive exempt vehicles. According to the guidelines set out from the Department of Transport. Are we happy with that? Good. Okay. Is there anything else? Councillor Reddrop? No, that was everything I had. I'd be happy to propose that we go through, that we approve these minutes. Absolutely. No, and I'm important to do it now because I don't want to hold it over again. So thank you very much for being so alert to that. Thank you. Okay. With that amendment, Members, are we happy to agree that those are an accurate record of meeting? Thank you very much. Okay. So we'll move on to the Licensing Act review of the statement of the licensing policy. So Rachel, would you be able to take us through that, please? Of course. Thank you, Chair. Good morning. Section 5 of the Licensing Act. Sorry, there's a feedback here. Is it going to be okay? Section 5 of the Licensing Act 2003 requires a licensing authority to determine and publish a statement of licensing policy at least once every five years. The policy must be published before it carries out any licensing functions under the Act. The current policy is effective until the 31st of January 2024, so it must now be republished. There are no proposed fundamental change to this policy, and it remains that there is no evidence to support implementing either a cumulative impact policy or an early morning restriction order. The proposed revisions are detailed at pages 5 and 6 of your papers. Yesterday evening, Councillor Redder had kindly emailed and highlighted some errors and anomalies in the draft policy, which I shall address if I may chair. Thank you. On page 13 of your Bender papers, paragraph 1.11 should have been deleted. That is obsolete, and it should have actually been deleted from the current policy. So 1.11 is deleted. Direct, thank you, Jen. The next paragraph, paragraph 1.12, the final sentence on the fifth line down, which starts a full equality impact assessment. This part should have been deleted from the current policy again as it is obsolete and has been addressed. Can we confirm it has been addressed? That final sentence is deleted. Interestingly, I had put, I win. Okay, thank you. And then page 16, paragraph 5.1 on the fourth line down. After the word authority, it should be a comma as opposed to a full stop. Okay, thank you very much. Going then to page 24, this is paragraph 17.3. After the words immigration act 2016 should read and has reflected the requirements in its processes. So it's now past tense rather than it has all been completed. So and will reflect will be changed to and has reflected. Correct chair, thank you. And then at page 25, paragraph 20.4, this should read, where a standard 10, which is a temporary event notice, has been subject to representation. And then the sentence continues, the licensing authority must consider. The words was given should be replaced with has been subject to representation. That's correct chair, thank you. Finally, unfortunately, my error, there have been two errors on the email addresses. And of course, these will be rectified before the final policy. Sorry, before you go on from that. Of course, yes. In 21.2, the 123 fourth line down, there's a misspelling. The authority would wish operators to notify the licensing office of any intention is spelled with a T, not an S. Thank you. Chair, you get the bonus point. Thank you. No, I think Councillor Reddrop gets most of them. Councillor Reddrop, the brownie points. You get the bonus points. Okay. And there was one about email addresses. Right, I added an extra ENV to the environmental health email. That was on the complex page. So page 28. First of all, the Cambridge Social Services, unfortunately. I was getting a bit carried away with that. Unfortunately, my cut and pasting, so apologies. We have an extra, www.cambridgeshow.co.uk for Cambridge Social Services. And an extra ENV in environmental health. I think I must have too much coffee that day, so apologies for that. So the actual address is Env Health without a dot. Env is Env.Health at scams.co.uk, so that's great. Thank you, chair. So did anybody else have anything that they... Yes, I think. That's what we're going through. The very first page is the paper. It doesn't have a gender item for it. It doesn't have the date. Is that on purpose? It's not on purpose. To be honest with what happened was Councillor Wilson, I submitted the draft to Democratic Services for the date of the committee have been set. So I only picked up this morning, so thank you. So in the title of the paper, we're just licensing Act 2003 review, a statement of licensing policy. It's at the top. The report to licensing. Oh, I see. We've omitted the date on that, so it should be the 19th of October. Thank you. Sorry, I... Yes, that's fine. Right, are we all done with typos and things? Thank you, Jess. Sorry, do carry on then. That was the end of my introduction, so unless there are any questions of me, thank you. Okay. So, Members, I suggest then, so Rachel has kindly provided us with the policy, including the amendments that she has referred to, on page 6 of our papers. So there are some removals from policy of unnecessary things. There are some revisions to policy, as specified, and some additions to policy and some additions to annex A. Now, I think probably what might be a good idea is just to go through those one by one, don't you think? Unless you think there's another way of doing it. So, shall we just... It's obviously difficult to see where things have been removed, and I think with your permission, Members, I'll accept those as having been removed. I have got the old policy with me, but I think I'm going to accept the officer's view that those things are reasonably removed. Can we look at the... updating the live music exemptions, page 5 of the policy, page 14 of our agenda? So, can you just talk us through that? The whole principle of what music people can and can't play, when or not they're serving alcohol is always quite fun and game. So, do you want to just talk us through that? Of course, thank you. There's been quite a few trends in the live music acts, and it's quite hard to keep tabs on them all to be frank. Some, first of all, it relates to an amplified music. Now, basically the provisions are, if you are a licensed premises for a pub with a beer garden, which has not got co-stipulated on its licence for covering the beer garden, you are entitled to have live music regulated entertainment until 11pm Monday to Sunday without any conditions whatsoever being imposed on there. The only way that could be removed is if you get a representation or an objection from the public, we have a review and it comes to your committee. So, for example, we have an issue with noise and they want to apply to extend their operating hours, you can still not touch the live music act exemption there until 11pm. They can still do what they want, obviously noise, nuisance, controls, etc. But the only way to remove that exemption is via a formal review hearing. Lots of different permissions to enable smaller events. The idea, I think, was probably to have a play or a community event and festival going ahead. But basically, it would be small numbers. Small numbers of regulated entertainment. The rules always apply still where alcohol is sold, a temporary event notice is always required. So, in a nutshell chair, if the entertainment is going on after 11 o'clock or if the licence currently precludes the area, that would then require a licence. If, for example, a sports hall, which doesn't have the benefit of a premises licence, doesn't have the benefit of an alcohol licence, wishes to have a disco and an alcohol that would need a temporary event notice. Okay. So, can you just clarify for me if, obviously, in principle, most of these events continue quite happily and respect people's entitlement to a quiet life. So, the redress against this is if people raise a complaint, and if there are sufficient complaints, then that would trigger a review of the licence. Any other questions? Before the review. I mean, we see the review very much as a very, very final last resort, of course, because, of course, coming to your committee, the licence could be curtailed, could be removed, et cetera. So, where we receive any noise complaints, we'll work very closely with our environmental health office, it's the noise nuisance team. They will look at and see whether there's a substantiated complaint, we have noise monitoring teams, we'll go in there and monitor the noise nuisance. If we cannot reach and compromise with the premises, often we can, most people are quite reasonable to protect their business and, you know, work in harmony with the local humanity. If not, then, of course, environmental health, put noise abatement nuisance notices to the premises, and, of course, they themselves could apply for a review. The only reason I ask that is actually taking the records required to provide the evidence to that there is a noise nuisance is quite onerous on the residents. It takes quite a long time. They have to have experienced disturbance late at night for some time in order to keep the sufficient diary records to provide the evidence. But, so, they can raise an issue straight away with officers, an office, if they feel it's substantiated, then they can go in and investigate and discuss. It's only if nothing comes out of that discussion that we then go on to a panel hearing. Members, does anybody else want to ask any questions about that? You're happy with that. Okay, then. Thank you very much, Rachel. So, the next element was the revision at element 5, paragraph 5 on page 16, which was the cumulative impact. In fact, I had a query here just before we go into the detail. Could I just clarify what is meant by the first sentence, which says, so hang on, let's just start off, the cumulative impact is, it works on the principle that premises licence should reasonably be granted unless there's a reason not to, but one of the reasons not to might be the cumulative impact of a number of licence premises in a particular area or a number of places with the same kind of hot food licence or something like that. So, then it goes on. The term cumulative impact should not be mistaken with need, which relates more specifically to the commercial demand for a particular type of premises, i.e. a pub or hotel. Now, I'm not entirely sure what that sentence is driving at. I think it might possibly relate to the fact that it might mean the term cumulative impact should not be confounded by a perception of need, because we're talking at the two sides of the argument here, aren't we? We've got the premises people saying, we need another take away, and so I should be entitled to have the licence that I'm applying for, but the residents are saying that there's 13 of them. So, I don't know what mistaken with means, and I just wondered, can you just explain what that means? 25 premises on a high street, which are not causing public nuisance, because they may have, say, staggered closing times rather, so we don't have a mass bottleneck of people leaving the premises at one particular time. It is possible for a high street to have multitude of premises and not have a negative impact on the cumulative impact, the whole disturbance, the whole bottleneck, and say that the mass exodus of people leaving the chair. That's what they're saying, so the suggestion is here, which, again, this is actually a historic comment, and it's more of a statement to say, need, the argument of, I have to justify this, I want another take away here, is there a need for this? That is actually under the development control, it's saying it's not a licensing matter, but it's saying that the planning consent, the approval, the high street planning teams, it's their project that would look at, is there a need for this? So it's actually, it's an interesting historic comment in here. So it's not really need, is it? It's planning justification. Business, yes. Yes, so that's correct. So are we saying that they're saying that the issue of need is a matter to be dealt with by development control, and this is the argument, yes, there's a reasonable case for having three different types of, that's right, there's their take away, or three different hubs on the same, but I don't think mistaken with works there, so it might mean the term cumulative impact, because it's the opposite side of the argument, so it can't be, do you see what I mean? So I'm thinking, does it mean the term cumulative impact should not be confused with, or not, the argument that there is a cumulative impact on the environment should not be considered here, because that's a planning matter. Can I suggest we go away with this particular paragraph and come back? Are we allowed to do that, legal? Chairman, may I suggest that we do delegated authority to yourself to resolve this issue and not be the... Thank you very much, yes. I don't know if I've got a second of that. Great, okay, so I'll thrash this out with Rachel, and we'll get some wording with legal to understand what the function of this distinction is. Thank you. Okay, so then you've just... I see it because I've highlighted it, but at number six you said there are currently no early morning restriction orders in operation in any area of Southgate each year, okay? Right, good. So you can buy a beer whenever you like. Right, so then we move on to just moving on before we go any further to item 10 under enforcement. At 10.1 it talks about licensing law doesn't control the nuisance that might be caused outside the premises unless they're selling alcohol for off sales. But halfway down the paragraph it says these protocols will provide a targeting for known problem premises and high risk premises, as well as potentially problematic individual licensed events. In line with Council's enforcement policy, a lighter touch approach will be adopted for low risk premises and those which are well run. My question was rather out into the ether how would we know, I guess it's because we wouldn't be getting any complaints about them. Is that the general gist of that? I'd say yes, to be honest with you. We get reporting via say our nuisance portal on the website or the police and tell. We work very closely with the police licensing officer. So we know if there's known events we get a history of calls to ex-premises and then the police and I are the police of one of our team. We'll go and visit those premises as you've seen I think a couple of recent emails regarding a closure for example of a club premises. So where it's been disturbed as reported we'll work with them to address the issues. And for larger scale events, I'm sure Apologies is already all aware of this, but for events such as the Halloween festival coming up at the holiday end we have safety advisory group meetings which are interagency bodies as well. So then we'd look at addressing the potential crime disorder and then safety arrangements for that policing arrangements, monitoring and security. So there's kind of, it is, sometimes we know in advance where there will be an issue. As I say, strawberries and cream are big festivals such as that. And smaller premises or social clubs or whatever that might have had a birthday party that went a bit out of hand. There were more people than expected. Then the following month they have another one. That's how we look at that lower level intervention required. But it's still just as important because it's impacting the local residents so that negating the licensing objectives is about when the information will come forward. Okay. And of course enforcement happens when people are experiencing a disturbance. So if you're not getting any reports of disturbance then that should be okay. Right. So then we've got the new paragraph at paragraph 13 on page 21, the drink spiking prevention and tackling sexual harassment. Are these paragraphs that are recommended from other national documents? Or how has the wording been drawn up? This wording came from... Apologies, chair. This wording did come after a discussion with our Peterborough domestic abuse and sexual violence partnership. Okay. I am aware of Asperangela and what that contains and different things I got. Could we have an example put in the back please just to people to know? Where would you suggest? Well, if you look at paragraph 13.2 it says they're promoting Askperangela. Where are you suggesting that? Just put it in the appendices. Just saying what that is for people to be aware of. That's all I'm asking. Members, it's that anybody can go to Barstaff and say, please can I speak to Angela? And the Barstaff are on to understand that that means please can you get me a taxi home? On some of them there's different stages. Askperangela, I just need to be escorted out of the building or whatever. So if you could just do that please, thank you. So an explanation in an appendix. Councillor Howells, would a link to the Askperangela? I'd be fine with a link here, no problems at all. Because I think there is an Askperangela website or something like that. But yes, that's helpful. And yes, it does take more than one foot. I might just please, please would you put me somewhere safe for a few minutes. And in fact, only in yesterday's paper there was a report of a young woman who believed her drink, she had been, not her drink had been spiked but that she had actually been injected. Somebody brushed into her in a club and she suddenly felt ill afterwards. And when she looked there was evidence of a needle injection in her thigh which had been done when this person bumped into her. So all very worrying. Right, okay. Moving on then, the next section that's new is under large scale events and festivals. And it's at 1513 on page 22 about organisers of large events. Sorry, 1513. Sorry, thank you. So Rachel, do you want to take us through this? Again, Chair, this following the... Sorry, did cancer...  It was really been addressed. Okay, thank you. Sorry, Rachel. Do you carry on? Thank you, Chair. This was just following discussions with... Again, it came from the domestic violence team looking at how can we make reference to the more high-risk festivals and events. So this was a kind of combination of discussion between that team and our environmental health officers. Direct lift from what has been requested then. Yes, and this ties in a bit, doesn't it, Councillor Howell, with the Ask for Anger as well in having a safe place to take customers if they require it. Right. The next element is 15.8 and I had a question here. So this is the addition of where considered necessary and where resources allow, where our environmental health team will look to monitor certain large-scale outdoor events to ensure compliance with noise-related licence conditions in relation to the prevention of public nuisance. Now, I wanted to understand what is meant by look to and certain because I am not sure whether that means we will undertake to always go to a proportion or we will do it as a discretionary thing or it depends how big it is. Do members feel it will be helpful to have that wording clarified? Oh, sorry, it's 15.8 on page 23. It's a new paragraph in and it says the team will look to monitor certain large-scale outdoor events. Now, I wonder whether we might have a principle that we always have a presence over a particular number of people or we undertake to monitor a proportion of them or always have a presence there if it was over. How do we plan? Sorry, Chancellor Wilson. Thank you, Chancellor Wilson. I was wondering whether it would be where there have been prior objections to a particular event as well. It can be. Thank you, Chancellor Wilson and Chair. This again was a quote from my colleague in front of the principal officer in response to the noise nuisance. We cannot guarantee as a council that we can attend every single large-scale event. It really does rely on what the event is in question. You're quite right to say, Councillor Wilson, previous events that have taken place, previous noise disturbances and where the Safety Advisor group is actually necessary and appropriate. So, for example, the zombie fest coming up at the Holiday Inn, we will have noise officers and environmental health officers at the venue. And sometimes it's been decided that a big event may just need advice of environmental health officers before the event. Sometimes that's quite difficult because it's only as good as when you're there. But it's just purely because of where resources are like. They will take an assessment and it will go through their head of service to confirm whether or not it's appropriate and necessary and available to have resources there to attend those events. Okay, so it's the wording I don't like. Yes, Councillor Howell. Just a very quick question. Apart from children, how many big events are over 5,000 do we have? We have the rock festival going ahead. That was going to be, I think under 5,000 at this time anyway. So we say we've got strawberry cream. We have the zombie fest which is about 3,000 proposed at the Holiday Inn site. So, not huge, but I suppose it depends on when and where and not necessarily large scale. I mean, for me, large scale. I would respect Councillor Howell saying that's over 4.99 rather than a Gloucesterbury type event. So 4.99, so being the number permitted for a temporary event notice. So it could be anything over that. So it could be 1,000 people we had, for example. An incident which was kind of classed as a rave at someone's back garden over 500 people for that. Absolutely, that was actually 499. But that caused a nuisance. The size of it doesn't necessarily impact on the location is more of a concern. 4 or 5 of those sorts of events a year. Councillor Howell, are you considering whether we should... I'm wondering whether we should undertake to attend those events with respect depending on the past history of them. I'm not sure whether Felicity can support my comment on here, but I don't think there should really be a matter for to direct or to determine that environmental health officers will attend, because then of course we'd be looking at breaching our own licensing policy. I was just suggesting a wording that said, because Look 2 is not a phrase that means consider. So I would like to suggest perhaps we'll consider monitoring events depending on the nature of it. Do you see what I mean? Look 2 is not a sensible bit of grammar in there. So I would suggest we'll consider monitoring some... Sorry, yes. Councillor Wilson. I think the wider at the end in relation to the prevention of public nuisance actually gives the boundaries of when that should happen. So that gives some assurance. So would you be happy if we put we'll consider monitoring or we'll... Chairman, I have no problems with consider at all, but one of the things I would like to know is I don't think today is the time for it is what happens when the person is there and what can they actually do at any one particular time. So it would be interesting for us to know have you got the authority then to shut down the whole event or do you turn the music volume down or what is the purpose of the person wandering around because they are going to be a very isolated person or individual or team if they decide to close the whole event down and there's 5,000 people there. So it would be interesting to know what is going to be their purpose once said. Because I know we have Hamilton Health officers at strawberries and cream in the past. I know officers have attended in order to see what was going on. I don't think strawberries and cream is going to be as difficult as maybe a race. It's much better now. Indeed, we had the example of the large event at near Linton that in fact was remarkably civilised. Whereas in fact the one where they hadn't had the safety advisory group visit had been causing people a lot of nuisance. So can we just Sorry, Councillor Redrup, you wanted to speak. I was just trying to suggest some wording to help Jaya, that was all. But then I was looking at it and it starts with where consider necessary and where resources allow so that is kind of controlling it before you get to the part of the sentence that you're thinking about. So then I was wondering about more of a rearrangement so it gets more complicated. But Ms Jackson was saying about performing an assessment to consider if attendance was appropriate. So I wondered if that kind of language would be helpful in this to actually put in more of the process that would take place so that for a large scale outdoor event environmental health will assess whether attendance is appropriate. Yes. And then look to attend if resources allow or something like that. We're getting some wording there. For a large scale outdoor event environmental health will assess the plans I'm not sure quite how it comes to the need or will assess the basically what you're trying to work out is whether it's likely to cause a public nuisance aren't we? So assess the likelihood of public nuisance and where considered necessary and where resources allow they will attend. Because that gives them a caveat that where resources allow if they haven't got the resources they won't and if they don't think it's necessary they won't. So have you captured that? Do you want to read that back Aaron? Yeah I think so chair. So I've got a statement to say that for a large scale outdoor event environmental health will assess the likelihood of a public nuisance occurring and then where necessary and where resources allow that was where I hadn't quite finished it off they will attend they will attend to ensure compliance with the noise-related licence conditions. Thank you chair. And what I will do chair as well just following councillor Howell has requested I will ask our BH practitioners to kind of give you an outline of what steps can be taken and I'll circulate that to you all. With your commission can I suggest we also bring this one back to the chair for final agreement on the wording? I'm happy with that. Is that okay? Thank you very much. Okay thank you Aaron. Right then moving on next paragraph 16 alcohol delivery services this is a new section I just wanted to take a straight to 16 for it's talking about this is the situation where people have ordered alcohol online or by phone and are getting it delivered to their home or to somewhere else or business premises and at 16 for it says there is also an expectation that business websites will make it clear that sales may not be fulfilled if appropriate ID is not provided and I think we should add in the words by the recipient because I might as an adult order 20 cans of lager and have it delivered to my home but if the only person at home to accept delivery of that is a child under 18 I'm not sure that's entirely acceptable so is that what is intended? That's absolutely correct yes thank you chair so we will include that but the idea is not provided by the recipient it's the person receiving the delivery whoever that is I think we should really say by the recipient because actually I mean you have to be over 18 to go on to a website to purchase the alcohol you then have to provide a statement say I'm over 18 the card the whole point is it's the delivery so if it sells delivery to a minor then that's what we're going to avoid if you're going to buy alcohol you have to be the person receiving it the age of 18 has to be in receipt of that so yes we will then as you requested the 16.4 you have to be careful because the recipient could be interpreted to mean the person who's paid the money and actually what I mean is the person on the door who's accepting the delivery I think that's very clear to say the recipient it is a person who is receiving that gets at the door for online delivery that is it so take away with a bottle of wine they would have to be over 18 when they're delivering the pizza and the bottle of wine thank you very much so do you want to take us through that at all okay just to come for them thank you chair that 16.4 will read their results so an expectation that business websites will make it clear that they will be not fulfilled if a probate ID is not provided by the recipient and that the terms and conditions of sales are robust thank you we're happy with that members great okay thank you right at 17.3 on page 24 you amended the wording in your update so that it says the council recognises the introduction of the Immigration Act 2016 that has reflected its requirements in its processes and then under 20 under open spaces we've now got 20 temporary event notices do you want to take us through that Rachel it's a revision sorry yes temporary event notices there was a revision here I think a revision only relates to Councillor Redder 20.4 where the words has been opposed oh sorry oh I do apologise this was the permitted hours so again with the temporary event notice regulations the number of events and the duration of an event has increased previous version of this the first paragraph was very long and it said a 10 may last for a maximum period of 168 hours it's a legislative requirement for 10 working days notice and blah blah blah but it looks like you've added that sorry not you but it has been suggested to add in because that element comes in at 20.2 so it looks like the revision is at 20.1 temporary event notices may be submitted to permit following licensable activities on a temporary basis whether they are within a premises or outside in an open space regulated entertainment plays, films, recorded music indoor sporting events live music boxing or wrestling entertainment and performance of dance late night refreshment provision of hot food and hot drinks between 11 and 5 sale by retail of alcohol supply on behalf of the club to a member etc so I think it's correct sorry to have a bit of clarity from there as well so the whole substance explains what they cover that's right just to make it clear any questions to their members okay can I just ask do we have any regulated sexual entertainment venues in the district I have a comment because it's in my head I don't think it's part of the review but under licensed reviews this reminds us that once we give a licence it goes with the premises it doesn't go with the people so sometimes a manager might leave and a new manager might take over and run a rather different exercise using the same licence but with a rather different character and that's when a review might become the way of reviewing the terms of that licence because it says it's a key protection for the community where problems associated with the licensing objectives are occurring after the grant or variation of a premises licence so that's where our residents get their opportunity to have their say and the other element was simply the in the body of the paper was simply the corrections of the email addresses wasn't it so then should we move on to annex A any comment about this ah here we are yes I had one so this do you want to take us through this the pool of conditions as well because I think we asked for this didn't we this pool of conditions has been around since the first policy came and I would imagine so there's nothing new here apart from the additions as we see to add a subsection in annex A section 4.4 which was on page 34 4.4 4.4 so that's large scale events yes great that's right so it gives us and this is largely to do with noise isn't it absolutely so again from our acoustic team our noise professionals requesting that commenting then right so just before we go on from that can we go back to 2.8 city tv and I thought so it talks about the presence of city tv cameras can be an important means of deterring and detecting crime immediately outside license premises conditions may include the need to have city tv cameras on the premises precise positioning of each camera the requirement to maintain cameras in good working order and the requirement to retain recordings for an appropriate period but should we not also have unless it comes under a different aspect you know the requirement to inform the public that they might they are being filmed or does that come under different that would be the information commissioners office so we have city tv in a public place or private place you have to register with them and have information and it's part of their enforcement it's not part of that that's correct any other questions members on annex A annex A okay yes Councillor Wilson it's the definition of large scale events I know that we've got events that are over 5,000 people but in our village we have an event every two years which goes over two or three days where the whole village could be attending at any one time but they probably don't but to me that seems to be like quite a large scale event as well because there's several activities going on at the same time structure, the licensing gap we've talked about tens of thousands of people so again like a Glastonbury kind of level 80-100,000 people but it would really depend on obviously we are very different we're not a city centre hosting big festivals and what have you so for us a large event could be just a little one person more than a temporary event notice 500 people 500 people in the village are very small community could be deemed quite right as a large event because of the impact it may have on others so we take the pragmatic approach with regard to that so I mean the large scale typically would be you're looking at the thousands of people but you just say if you're looking at 500 and one people over seven days that's a lot of thought for so it would depend on the nature and again the advisory group would look at why we would need to put any additional mechanisms in there this element about the large scale events is is dealing largely with noise but also with waste management and the point there is that when it's large you need to entertain all your people so it's loud in order that they can all hear whereas perhaps at the cotton feast it's not quite so noisy but maybe it is and you know so it doesn't relate to the total number of people attending over three days does it but also cotton also always attends a safety advisory group meeting doesn't it I actually for several years did the help and safety for the event so I used to come to the safety advisory group producer control document for the health and safety so and I used the purple book I was advised to use the purple book so it is quite a big event in terms of the number of people who could be attending but not all at the same time as it's in dribs and drabs over two or three days so I think the answer is there is no strict definition of what a large scale event is because it rather depends what's going on at the event doesn't it but it is loosely related to the number of people attending at one time so the question is are we happy that we don't have a definition and that we rely on the licensing officers to decide whether something is large scale or not yes? right so moving on towards the just one question here on appendix sorry appendix B gives us the table of delegations where people can make decisions according to what is being asked for doesn't anybody have any object concerns about that? okay and annex C relates to the procedure to be followed when dealing with an opposed club premises licensing application and I just wanted to ask I'm just thinking in terms of planning we often hear the objectors first and then the applicant afterwards I think in this case given that it's the objectors who've prompted the review I think it's appropriate that at number six the applicant explains what they're up to how their license is being delivered and how they run their business and then the objectors have the opportunity to put their questions and then it's the objectors' representations so I just wanted to check members are you happy with that running order it works in our experience I think it works right okay so I'm happy with those amendments that we've suggested so this is a recommendation that the licensing committee recommend to the council the adoption of the statement of licensing policy under the licensing act 2003 for a period of up to five years the only other thing I wanted to ask you members is whether you feel it would be useful to see the track changes version go to full council I would have liked to see the track changes version to this committee because I think it sets it in context you can see what's been removed what's being amended and you can understand what changes are so in future I've asked Rachel if she would kindly bring a track changes version to us but having gone through it I'm wondering whether you would like to have a track changes version to go to council or would you just like the version that we have here to go to council Chairman I think that we have in the track changes is good I don't think it would be good to extend people to track changes to council because that opens up a whole can of worms and people start discussing things again however it wouldn't be if they want to have a link to that maybe that could be put into the report a link to track changes if you want to but personally no I think they should just be giving the fate of company an asset I'm happy with that in a way because I think we've done the work to be sure that we're happy about it and in this case I think I'm happy to recommend that the version as with the amendments that we've suggested go as at page 9 onwards in our agenda papers go to council are you happy with that members I'm sure Rachel's going to bring us a track changes next time we have to review the policy okay members so if you're happy with that Rachel are you happy yet with everything you need to do so we have a couple of so 5.2 we will review the paragraphs that's obviously counter how it's suggested with yourself and with Felicity and 13.2 we'll have a link or some further detail regarding Asgandula and at 15.8 the wording of this but we'll finalise that again I'll finalise what Aaron has got with my colleagues in environmental health make sure they're happy and you can sign that off as well 16.4 by the recipient yes it has been under that and of course all the amendments to council record came up as well yes thank you can I just seek just to check with our legal advisor Felicity are you happy with all of that I am thank you chair thank you very much okay so with that members I'll close the meeting in that case okay thank you very much so it's 11.02 thank you very much for your attendance oh and Councillor Sanford sorry I didn't see you put your hand up at all but was there anything you would have liked to say no I'm fine thank you my non attendance in physical form this morning is due to having a covid booster late yesterday somewhat under the weather this morning so that's why I'm joining virtually okay well thank you very much and I hope you feel better soon okay thank you thank you right other members I'll close the meeting thank you


Hello everyone, okay, so today in this video, I just want to show you guys some update on my face regarding to the moles Removing process so In my previous video, I show you guys the how to remove moles freckles and black spots so Now it's around I guess two months now from the previous Actions that I took to remove that thing using the spot remover So basically now you can see my face Got nose car And it's pretty clean. So I'm going to zoom in to show you guys the how it looks like Okay, focus Guess you can see that That part Yeah so if you are asking me where to buy that thing or Maybe you will wonder It is quite risky or quite dangerous to do that. I Suggest you don't buy that thing unless you know what you're dealing with So anyway, if you enjoy watching my video, please leave a thumbs up leave a comment and don't forget to subscribe peace


We're going to be talking about a post-exploitation tool, but we just have an extra little add-on of this O-Day. So when Jenna Magias and I were working on Eternal Blue, we discovered that part of the pool grooming process was allocating memory in a contiguous way. And by abusing those memory allocations, we were able to come up with an attack that we're calling SMB-Loris. It's similar to the slow-Loris attack that is for HTTP servers. So with that, a single machine is able to open many connections. Hold on. Just wanted to show the flags here. So the first four bytes of a connection are this NetBio session setup header, and it has a 17-bit length field. So what Windows is going to do is it's going to see that length field, and it's automatically going to allocate a buffer for whatever length you say, and preemptively allocate that much memory on the non-paged pool, which is memory that cannot be swapped out. It's physical RAM that has to be reserved. So 2 to the 17 gives you 128 kibbut bytes, and if you send many connections that do that, from a single IP, you can get to 8 kibbut bytes, which is like 8.5 gigabytes. So we're going to demo the attack now. And all we're doing is opening a lot of connections and sending this packet with a full length. And as you're seeing now, the non-paged pool is filling up. It's actually down here. Right now we're at 5, 5.5 gigs. And eventually this ping is going to die because there is not enough RAM. And you also notice that the CPU has spiked to 100 because now the operating system is searching through memory looking for a free spot. And now we actually have freezed the computer. So like Solaris, if we stop this attack, the computer will restore. Unless you sustain the attack, eventually you will get a hard freeze, which is worse than a blue screen because then you need physical access to restart that machine. You can't just RDP in. So there you go. Thank you. And I just want to mention that we did report that to Microsoft Security about 60 days ago. They said they weren't going to fix it right away. So we had to go to full disclosure. We already told RDDOS partners and stuff like that. And it works on IPv4 and IPv6. So here's just some of the artifacts that we have that happen. The first one is just like a hard freeze. And then you can crash programs. And then right here is Microsoft's response. This is fine. All right. So on to the main topic of the day. We're going to talk about the current open source malware options for Redteams. So these are things that you can use on your pen test to, you know, own a network. And then we're going to release a new tool called Koetic C3. It's an advanced JScript VB script rat. It's based on a lot of work by others. Sub-T at Nickmo X3 Ternado. They've been doing a lot of work on research, a lot of research on JScript past year or two. We're going to talk about some of the hell we went through with Windows scripting host quirks. And then at the end we're going to have a demo of the tool. So this is a list of the people who helped work on this tool. I'm zero sum. That's LF naught. We've got Jenna Magias in the audience and the Naders is watching the live stream. So we're the Red Team at RISN. It's a spin-off of New Mexico Tech led by Dr. Srinivas Mukamala. He lets us have time to do some research on side projects. So we've done extra bacon and eternal blue. We've ported both those exploits to Metasploit. We're kind of the first to look at those exploits. Just a couple quick notes before we get started. So if you use this tool for elite activities, we're not responsible. We're releasing this for pen testers. There's no ransomware or anything. Like I said, there's a ton of overlapping research from SubT and Igmo, X3 and Auto. But we're trying to consolidate all those research techniques into a single tool. And we've also advanced the state of art a little bit. So this is just a prototype. There are going to be bugs in it. So submit fixes, not ticks. And just to be very clear, this is a post-exploitation tool. So this won't be like Metasploit where you get access to a box. This assumes you already have access. And you want to do something better with that shell. You want to pivot, dump passwords and stuff like that. So the current state of Windows post-exploitation, you have, you know, meterpreter, cobalt strike, partial empire. Or you can roll your own. Those are basically your options right now for a very, and they're all very nice tools. But we're going to talk about some of the downsides of those tools and where this kind of fills a very niche gap. You're not going to use this tool a lot, but it will fill a very niche gap. So the downsides of PE malware, this is stuff like cobalt strike and meterpreter. So they're both amazing software. But most of the times in a post-exploitation scenario, you're going to be dropping a binary on disk. And that's what AV loves to eat. And you're going to have to evade that payload with either validation or shelter or some type of cryptor packer. So that's one downside. And one of the main exploits we have eaten a lot is PS exec, which is probably the most common one you use on a pen test. So the downsides of PowerShell, again, Empire's amazing software, officially requires PowerShell, obviously, which is server 2008 service pack two. You can install it on earlier versions, but officially that's what Microsoft supports. And PowerShell in Empire also uses some features that are in modern.net. So I've actually had the case where I compromised a box and had PowerShell on it, tried doing an Empire stager and it failed with an error. Another very bad downside of PowerShell is that it is a first class citizen in the logs on Windows. So that's one thing you need to realize when you're using PowerShell as you are filling up the logs. So we've made a tool made out of J script and VB script. It works on Windows 2000 service pack zero, possibly earlier. The main benefit of that is that the Windows script host, unlike PowerShell, is baked directly into the Windows core, unlike PowerShell, which was bolted on later. So it's a little bit harder to limit. And we found some creative use of the default TXEs that are in the system folder. And we also found some ways to execute completely in memory so there's no dropping to disk. And that's the main benefit of PowerShell. So the downsides are that there is no access to the Windows API. The only thing you get is calm objects, which I'll talk about in a second. There's also no real threading. So when you have an agent running, you might want to run multiple jobs at the same time and have them report back. There's no threading in J script. It's also missing a lot of standard functions like base 64. You can use SirUtil and some other utilities that are default installed, but they're not on all versions of Windows. And then what's really bad is all the strings are UCS2 wide Unicode. So when you insert StructureShell code in memory, it's going to fill it with null bytes or even just totally clobber all of your strings and you not going to have the same shell code that you put in that you thought you had. So calm was kind of this big idea from Microsoft that you could write a class in one language and then instantiate an object in another language. So what they did was write a lot of calm objects in C and then now you can use them in J script and other scripting languages. So it's language neutral, object oriented. It has a very spelled out binary interface and it's distributed so you can actually instantiate objects on another server and then use them on your local host, which actually leads to a lot of pivot opportunities. It's an arguable precursor to .NET. It has slightly different goals than .NET did and .NET has a lot of tools that help you interact with calm. And it's also found everywhere in Windows. It's in its own registry archive. It's the HCRHK current classes or classes. So this is an example of instantiating a calm object in J script. So what we've done here is we've instantiated this object called html file. And like I said, we don't get access to Windows API, but we get access to all the interfaces that this calm object exposes. And from that we're actually able to scrape the clipboard by going to the parent window and getting the text. So we originally started this project back in October using VBScript. VBScript and J script are basically the same thing. At the end of the day they just have slightly different syntax and a couple other things. One thing that's really bad is that it has VBScript has an insane error handling thing where you have to do on error, resume next at every function scope and then for every instruction that you run you have to check if there's an error condition.  The other thing that we ran into was slimo the painter problem. So this is a problem with string indexing. Normally for string indexing you want O of 1 lookups. So you want to look at the hundredth element in the string. That's O of 1. With J script it counts from the beginning of the string. So you actually get O of n factorial to traverse the entire string instead of O of n. So Jen imagine he solved the hardest problem in computer science when we just moved the bucket with a survey thousand iterations. We moved the string pointer up. While working on this tool we researched GNU read line which is interactive shell for Linux and Unix systems. So in Metasploit what happens is as shells start to rain in your input is getting overwritten by all those shells raining in. So we were able to redraw every time a shell came in and not mess up your input. And that picture is just an example of kind of the bad input. We committed it in PR 7570 to Metasploit. They've actually commented it out. They have to support Windows and some other systems. There was a couple bugs there but we're only supporting Linux. So I'll talk about some of the terminology before I talk about how we architected this. So a zombie is a hook target. It's basically like a session in Meturpreter or an agent in PowerShell empire. Stager is a web server that we use to have the C2 C3 server. And then an implant just starts one or more jobs on a zombie and then a job we figured out a way to fork and so you can have simultaneous jobs running and then they report back to the server. So this is done by a plugin class. There's two types of major plugins or stages which spawn web servers and implants which start jobs. They all have a load method which has variables. These are like things that you set in Meturpreter. All we do is a simple stringer place for tilde and the variable name inside of JS files. And then they also have a run method which like I said starts an HTTP server or starts a job. The job class is what you instantiate from implants and they have a report handler so when the job reports back to you you're able to handle that. And then we also implemented a standard lib.js file which kind of abstracts a lot of that comm stuff for you so you can run commands, upload download files and perform those HTTP communications. We have all the standard implant categories you would expect. You can pivot some move from machine to machine persistence so you can if a machine reboots it will still call home. Managing utils are kind of like they'll let you enable RDP or run commands, download, upload files. Elevate is a whole class of UAC bypasses. That's the run as administrator box on Windows. Gather will scrape credentials from the hives like NTLM hashes. We actually wrote a TCP scanner which I'll get into in a little bit. We have a fun category like PowerShell Empire does. They play ACDC's Thunderstruck. They blast the volume to play that. We do that but we do the Cranberry zombie song. And then we also have inject which is a whole category where we figured out how to break free of the comm chains and get to the Windows API. And from there we do reflective DLL and memocath and stuff and we have a cool demo. So stage architecture is generally in a post-exlipitation setting you're going to hook by a manual command. That's what you do with PowerShell Empire. You just run a command and then it calls home. You can hook from IE if someone, so you can fish somebody and if they click yes, run this, you know, all these active X objects. It'll work. Also office macros you can do a sager that way. So all we're using is a simple HTTPS threaded server in Python as the main C3 server. So you get encryption through TLS or SSL. There's a caveat there. A couple caveats. So one is older versions of Windows won't have TLS enabled so you'll have to fall back to SSL. And the other one is you need a valid certificate so you'll have to call home to a domain that you own a certificate for. And how we do the call home is we do a long poll. So this is kind of the old way of doing AJAX before web sockets is you call home to the server and then the server hangs you for like a long time until there's a job to be done.  So there's a couple problems with that. There's no problem with hanging forever because once you go into the com object and you run that, you're in com world. It's outside of your script context. But there is a limited amount of instructions you can run in J script. So it's actually default to five million I believe. So if you run five million instructions in J script which is actually very easy to do, even for just a few milliseconds it's going to pop up an error saying stop running this script and it's going to hang the script till the user clicks yes or no. So for that reason we fork on a regular basis. So the first time you call home to the server you're not going to have a session ID. It's going to sign you a session ID and it's going to fork to a special job called stage. That stage is going to do that long polling process I was talking about until it gets a job ID. When it gets that job ID it's going to fork that special stage job again so we don't use too many instructions and it's going to fork the job. And then when that job calls home it's going to have both the session ID and the job ID. So then it's going to send the job payload which is going to do some work. It's going to report back to the server about that work and then it's just going to strictly exit. So some of the stages we have, we do have the traditional way of running J script and VB script through C script or W script. These require dropping a file on the disk so antivirus can catch that pretty easily. And you can always disable the windows script host. An interesting stage that we have are MSHTA HTML applications. So these are kind of like a weird IE security zone that lets you get access to the registry, the file system, the command shell. And the payload for that is really tiny. It's the tiniest payload we have.  And then it's going to call home without a session ID and get a signed one and all that. So with these HTML applications they're going to pop up like a little browser window. So we experimented with many techniques to try and hide this window. The best that I could come up with and I really did a lot of experimentation was I moved the window 2000 pixels off the screen, resized it to one pixel and then I blur it so it doesn't steal focus. And then also there's some XML that we can do to hide it from the task bar. I thought this was really bad until I looked at some malware samples that were doing the same thing. So I didn't feel as bad. So run DLL32, this kind of abuses the way that run DLL32 parses the DLL it's supposed to run. So in this example it's loading the MSHTML.DLL and it's running run HTML application on it, which is the same thing that MSHTA does. Only this is a little bit more hidden. Now when that function gets called it's going to parse the entire command line and it's going to see it starts with JavaScript colon and it's going to start executing JavaScript. So actually our MSHTA stager as soon as we fork we go to this one because it has less window visibility. Another one that, another stager here that SubT we discovered is called COM plus Scriplets. They still get written to disk but it's this program called RedServer32.exe which is supposed to assist you in installing COM stuff. You can actually feed that a URL and it's going to go fetch that Scriplet and then it's going to run some JScript. So this is actually a stager that's present on Windows 2000. MSHTA is not, maybe it isn't a service pack but at the beginning it's not. So there's a couple ways to run commands. The most common way is through WScript.Shell it has two ways to run commands either exec or run. Exec gives you access to standard out and standard error for all of that process's output. The only problem is it's going to flash a little command .exe window. So it's not good. We had to resort to .run which does not give access to standard out. But we kind of pipe to a UUID in the temp folder, a text file and we pipe standard out and standard in to that file and then we read that file. So we're able to get the output. Another way to start processes is with WMI when 32 process is a part of that. And that's the Windows management instrumentation. It's just kind of for managing boxes. So one of the main things you want to do with post-executation tool is upload files and download them. But binary data is very hard to work with in J script. So writing, if you want to write a file on a disk, writing byte by byte, you use all of your limited instructions I was talking about. So what we do, what one way you can do that is you can write the response body stream directly to an ADODB.stream. The only problem is as you can see, you get an error that says safety settings on this computer prohibit accessing a data source on another domain. So this is part of that IE security zone sandboxing I was talking about. So what we do is we create a temporary ADODB object in memory. We write that stream to that object in memory and then, so now it's on our domain or whatever and then we're able to write that to file. So this is just some boilerplate code that just lets you write directly to file without using a lot of instructions. Another problem we encountered was with downloading files. So this is when you want to get a file. It's on the zombie, you know, you see x-rays, you see something interesting on the target. You want to download it to your machine. You're going to do that by having it send an HTTP request, sending an octet stream, which is going to have all that binary data. The only problem is that Windows is going to double encode that data. So through some reverse engineering we figured out it was encoding it with Windows 1252 encoding first and then UTF-8. So we saw that the binary data did not match up when we got it back. Another thing is if you send a null byte it just ends the response stream right there, the request stream. So we added another layer of encoding where we encode backslashes and null bytes. So we have three different decodings we have to do once it gets back to the server. It was really slow. LFNOT wrote a hard coded lookup table. So it's about one second per megabyte now, down from ten seconds per megabyte. So these are all of our UAC bypasses. These work because on Windows there's the current user hive, which a user is able to write to their current user hive, no problem. And then Windows has these binaries in the system 32 folder that have a manifest that auto elevates them, gives them UAC bypass privileges. And then there's a couple binaries that are going to look in that current user hive that you're allowed to write to for a commander run. I don't know why. But we're just going to put the stager command at those registry keys, start that process and it's going to call home and we're going to be elevated. Microsoft is trying to fix some of these. I've closed a couple of them in Redstone 2 and 3. But there's UACME by H Firefox. It's some future work if these methods get closed down. There's 35 plus methods we can use. Some are applicable. So another main thing you want to do in a post-exploitation tool is dump the NTLM hashes off the server. So there's a reg.exe. I believe it was added in some service pack of Windows 2000. It's at least present in Windows XP and higher. But from there, if you're elevated, you can save the same system security hives and run a core security impact which will decode, decrypt those hives and give you the hashes out of them. Same thing for domain controllers. You can create a volume shadow copy. And then the system hive, you can get that. And we get the NTDS.Dit. We can run the same tool with some different arguments and extract 80 credentials out of them. So there's several different HTTP com objects. Most of them are just like MSXML2.XML HTTP and then there's a server XML HTTP. So this states back to the early days of the internet where you first started with AJAX. And so the ones that are not marked server are going to have a bad sandboxing policy. It's going to have that cross origin AJAX policy you see in web browsers. Whereas the server versions are going to be what you would have ran on a classic ASP server if you wanted the server to fetch something. So it's going to be less sandboxed. So it's the same interface but a little bit different behavior. Using these objects, checking out the error messages they do when we try to do an HTTP connection to an IP. We're able to tell which ports are open. And so we have two different methods of telling if a port is open or not and based on the error code. So we were able to write a TCP scanner using these methods. Another interesting com object is the Wscript.network. This lets you enumerate the printer connections and the network drives that that computer is connected to. So that's useful information. And now we're going to talk about the pivoting modules. So PS exec was originally written by Mark Rosinovich. First the SysInternals before it was hired by Microsoft. Now it is a Microsoft signed binary. And this lets admins run commands on different boxes remotely. There's no reason for us to have to upload this binary to the server because Microsoft is hosting it on a live share on the internet. So we just use that live share. We do get a dirty bit when we do that but the bypass I found was just running it. Instead of Wscript.run I ran it through WMI or something I forget. But we didn't get that dirty bit which would have popped up a message of an error. So that just lets you run commands on another box. And we do have a working pivot with that. Another way to pivot is with WMI. So this lets you spawn that WMI Win32 process I was talking about on another server. As long as you have cash or either your credentials or you get credentials out of memory. You can't perform it past the hash with Jscript. We found a really bad problem with this is when you start that new process it's going to run in session zero on the server which is a GUI list process so you won't be able to elevate. But it does let you get onto other boxes and maybe there's a work around. Another thing that's been making the waves the past couple weeks are Decom lateral movement techniques. So MMC20 dot application and Nygma XO3 found back in January. But it has a you can spawn this object on another server and it has an interface called execute shell command. Let's see re-stage. And then just this week we had Excel dot application and Outlook dot application by Ryan Hansen, 424f, 424f and Stalred. But both of these have ways that you can load commands on another server. So that's some future work. We don't actually have plugins for this yet. But if PSX, WMI aren't good enough we can write a plugin for Decom. So now we're going to talk about some of the ways we escaped that com context into Windows API. So work they gave us some office licenses and we did find a good use for them. We didn't actually write any reports with them but we did create a GUI list Excel object in memory and then from that GUI list Excel object we also wrote some registry keys that let us run macros without a prompt. And so we actually and when you run macros in that it's visual basic which is different than VB script. That lets you get access to the entire Windows API. So from there we were able to run shell code or reflective DLLs. So that's one of the ways we escaped. Another technique was published a couple months ago by Tieranito. He's guy from Google Project Zero. So when you install .NET on a server it gives you or a workstation or anything.  And one of the couple of those com objects that you write some memory and then also deserialize a .NET object. And when you can deserialize a .NET object you get access to the Windows API because .NET has access to Windows API. So we can do all that from J script. And then the final way we found in our research was Dynamic Rapper X. This was a DLL written by Yori Popov and released his freeware in like the late 90s, early 2000s. It does have zero out of 61 of Iris Total. People are using this for legitimate reasons. But basically this just lets you install a com object on the server which gives you access to the Windows API. Normally installing a com object you're going to have to write a lot of registry keys and stuff like that. But sub T rediscovered a thing called registration free com. So we don't actually have to write all those registry keys. We just drop a manifest file also on the disk and that DLL and then we're able to load that com object at least for our process. So now that we have access to the Windows API one of our design goals was to use the power cats dot DLL. So this is the PowerShell Empire DLL that lets you get access to Mimicats. There was a problem with this and that was that all of the DLL mapping was performed in PowerShell. So normally with a reflective DLL you're going to write some C code that will load itself. And they did it in PowerShell. So we have limited instructions. We can't do all of that DLL mapping. So what I did is I wrote a DLL called Mimishim. And that's just a normal reflective DLL. So all the loading code is in C. It's part of the DLL. And we just say start a thread there and it'll load itself. So what it's going to do is it's going to see if we're an x64 or an x86 process on an x64 system. Which if you've ever dealt with Mimicats that can be an issue. If that is an issue we're just going to fork assistnativenopad.exe. We're going to process all of that and inject the PowerCats.DLL into it. And from there we're going to do a couple of default things. We're going to do, we're going to get the debug privilege which is kind of a God mode privilege on Windows. And then we're going to elevate our token to system. And then we're going to run whatever custom Mimicats command you want to run. Which will let you extract plain text passwords out of memory. Provided that credential guard or some other defenses aren't enabled. And with that I'll leave not run the demos. I heard you guys like live demos. Alright so what we're going to do here is we're going to show our tool off. At least we have a screen. I heard we had screen problems on the other ones. Okay so the first thing we're going to do is we're just going to load it up and we're trying to get our stager first. Right? I know we were talking about this in the beginning. So we're greeted with a screen like this. We have a lot of options in here. So as you can see it's a very similar kind of structure to like Metasploit or other tools of a similar kind of nature. We run info and we can set our L host. This is a local host internal network for a domain that we have here on a couple of VMs right now. Yeah the only reason why he's setting his L host manually is because we have a weird network set up so we're not on the internet. Normally it'll try to go to <IP_ADDRESS> and get your IP, your local IP automatically and spawn a stager there. So and then after that's run the stager is done. You can close the window and you see no windows popped up and nothing seems out of the ordinary but we get a stager coming back right here. And we'll see. We take a good look here. It's not an elevated prompt as you can tell right here. We come back with a star if it was. And so from here we have our zombie and we can kind of do what we want. So to demonstrate the kind of ridiculousness that we had to go through we can kind of upload a file, get a shot some, download the file and do a shot some again. So we're going to use an implant and we see everything is like a nice little options file. So we can also get into a command shell from here. So if we look onto our hooked client right here and we take a look at the directory where we should have uploaded the putty and you will see it and it's right here. Nice and uploaded. We'll open up a local window right here and we'll do a shot some of the actual putty file. We'll see this is a shot some right here. 8.1 and ends with 5e. And so now we will download the file from the victim client right now the one that's hooked and we'll see that the integrity has been kept right so we got a nice upload and download and the client doesn't notice a thing the windows are coming up nothing at all it's a nice and in the background here. So what we're going to do next is we're going to try to elevate the prompt right a little bit of a UAC bypass and stuff like that right so we're going to use or elevation. So if everything if everything goes right we should be see a shell come back with a little bit of a elevated type of thing looks like we're coming back and here we are we have a nice elevated prompt. Alright so from here you could kind of move around and try to pivot across a network I know we were trying to explain to everybody the the ridiculousness that had to do for kind of TCP scanning and everything along that line so what we could do is we could try to find another victim and we could scan them look for like an open port 445 and then try to migrate and pivot right or pivot just pivot this time. So we're going to use another implant for this doesn't really matter what zombie we use for this response is a little ridiculous we had to make it large for everybody so as we see here a nice little readout of a nice scanning from one of the hooked hosts to another host upon the domain and right now we're going to try to pivot okay so a ruin to use actually should probably get the hashes first from the current machine that we got right we're going to use the elevated zombie with the elevated prologos to kind of dump the hashes here and here we go we got the hashes from the past machine and that's a memecats command you can kind of run any command from there from memecats so right now we're going to kind of pivot from the one machine that's compromised and we're going to pivot and we're going to get a stager on the next machine within the main right we as you see we got the credentials from memecats and so we're assuming we got the plain text password or something along that lines and we're going to move on to the next machine so and here we go we pivoted throughout the network and we moved and we can see a command shell we take a look here take a look at who am I and we're here on the machine pitting through the network nice and through all these nice little commas and everything here so yeah so you can see he has two different or three different shells here the first one was his medium integrity next one was when he elevated and then this has a different IP because he's pivoted to another machine so we're going to talk about some of the mitigations you can do against this there are some ransomware samples that we saw that do all of their operations in J script including their cryptography so people are mainly focused on PowerShell right now we kind of want to point out that J script is also an attack surface so there's a thing called the anti-mower scanning interface I haven't actually played with it but it was designed to catch PowerShell scripts before they execute it's also a hook for antivirus to get J script and VB script files before they execute even if they're using the type of in memory stages that we talked about another thing is device guard app locker CI it's all kind of a the same umbrella for a term a common term called app whitelisting in your environments you only want to run the programs that you want to run and this will actually prevent a lot of extra malware that gets on your system from running if you only have a whitelist of what can run it's kind of a pain to set up right now it requires a lot of PowerShell and registry editing I've heard that there are good things coming there so just keep an eye out probably Redstone 4 next year but if you do get it working you want to block the windows script host you want to block HTA and com plus scriptlets you can also delete the mshca.exe and red server some components rely on that and windows update will probably reinstall them but that's one thing you can try another thing is you can delete com objects if you're not using them it's hard to tell what you're actually using including the script parsers themselves so like a J script and VV script those are all com objects that are script parsing I haven't actually tried deleting them I think you might break your system but we do have some intent to add this to metasploit at least for a target as ps exec so right now it has it drops a file or it runs a power shell command we want to do a mshca command back and then iterate through all those methods that we found a fork to Windows API and try to spawn a interpreter binary that way just iterate yeah just iterate all over those methods some more future work is exploring com seeing what is exposed through the interfaces it's a large attack surface on windows that was kind of forgotten about or it's kind of a difficult concept to grasp ternito has a cool tool I forget what it's called like OLE viewer or something that lets you get the interfaces for a lot of these com objects and you can see what you can do with them another thing is that with this tool like I said there's a lot of bugs so we do plan to clean up the code and do a small plug-in revamp so right now plugins are kind of reusing a lot of the same code and we also want to implement a javascript obfuscator so right now all the payloads are pretty generic they're all the same but if we had obfuscator it's going to kind of add some bypasses for very obvious lookups of that we've kind of neglected persistence implants so I wouldn't talk about them there are a few ways to get persistence that's when the machine reboots it'll restage WMI subscriptions is one that we could do and then another thing is we're using the basic Python server just very generic so we actually do have the slow laurus attack I believe that works on this so remember we dropped that ODE SMB laurus that we have the slow laurus attack on this so that's one thing we want to close down by throttling the amount of IPs some related talks by Tere Nito he did com in 60 seconds this is the best primer on com you can watch better than any book I ever read he does it it's not actually 60 seconds it's 60 minutes but he did an infiltrate this year another one is windows archaeology which sub T and enigma OX3 did at B sides Nashville this year and then last year sub T wrote a very basic J script rat and presented that at Derby con we've kind of expanded that concept and made it you know as close to empire as we could and so yeah this code is available at github zero some slash poetic we're also doing a workshop today it was a registration only though but we have also released that code as well just check my github more lower-level stuff see and shell code but still cool stuff so yeah that's zero some and if not thank you guys very much


What's up guys welcome to today's video today I'm gonna be sharing with you the highly requested gin haircut from BTS I'm gonna walk you guys through it step by step show you how I would do it if I cut his hair The same way he wears it So we part it where he parts it and then I create a triangle on the top of the head going right to that Recession point twist that up and clip it away. That is the first section and then we're just gonna split it Down the center back and create a couple other sections to start off this cut All right, so now I want to separate top and bottom in the back So I draw a slight diagonal forward parting comb that hair nice and tight clip it away And then we do the same thing on the left hand side a nice diagonal forward parting Nice and tight clip it away and now you've got your sectioning for the cut We're gonna be working vertical sections all the way across the round of the head in the back This is really kind of the key factor is picking the right length here So you're gonna see that I take about two inches away from the head And start my cut that way and I just work that all the way through that back portion of the head Keeping everything nice and consistent bringing everything to the previously cut section and just kind of working a traveling guide throughout the back Notice my finger working parallel with the head shape That's a good way to make sure that you're following the right guideline Don't let my over direction fool you here guys I'm pulling everything straight out from where it grows out of the head that way we work a nice open section in the back All right, so now I just clean up the hairline work that through that really completes that back section Makes it gives it a really nice clean look you could leave it a little fringer if you like that as well Styles up to you on that All right, so now that we completed the back We're gonna start in the front and I'm really gonna create a brand new guideline pulling everything horizontal And I'm gonna cut that to the desired length So this is pretty tight to the head He wears it pretty tight on the underneath and then it's a little bit disconnected through the top So I'm gonna show you guys how to do that work Horizontally lift that guide from the bottom up to your new section and keep cutting That's gonna help work a nice little balanced shape on the side of the head and then I switch to slight diagonal back Sectioning and I work verdict almost vertical sections to build up that extra weight on the side So you can see that I'm connecting down the inner part of my finger. I'm connecting it to the tip of my finger Running my finger angle parallel to the wall So just see how I keep working around the head shape that's gonna build some pretty extreme weight Once it gets to that bridal ridge area if you guys are at all confused by anything that I've said in this video so far You might want to check out the FSE digital haircutting system This is a brand new system that we came out with so that we can all speak the same language and Understand each other so much better Included in this system is a digital terminology book with printable head sheets for each haircut You've got the terminology one-on-one video eight step-by-step Hair tutorials so whether you've been cutting hair for years or you just started hair school This system is for you check it out on our online store shop FSE. Alright, so now we're gonna continue on to the left-hand side This is gonna be very similar to what we did on the right-hand side taking a Horizontal section in the front temple area once you get that section into your hands Just a nice light tension on it cut it to the desired length and then check it on the opposite side to make sure that Your links match up and then you can continue on through the haircut This is gonna give you a great view on everything that we're doing here Lifting that guide up cutting it horizontally and then connecting it into the back That's a really important part of this so making sure that you work that horizontal line into the back You can see the two guidelines and just connect it through then we're gonna work into more of that vertical cutting in just a second one of the great things about the Digital cutting system and why I think everyone should watch it at least once is the fact that it teaches you to understand hair cutting not only We're holding a section horizontally, but we see it vertically And if that doesn't make sense to you then you should definitely check it out Because no matter how you're holding the hair. You're always cutting it in both Directions you just have to understand that to a little bit deeper level. So now as I'm working through it It's more comfortable for me to work vertically I'm more controlling that vertical weight as opposed to trying to control that horizontal weight And I just work through in a round fashion To build more of an open haircut kind of pull that hair off of his face a little bit throughout this part of the haircut What we're doing in this haircut is we call it combination hair cutting So what I'm doing is I'm combining what I would call an open Shape on this haircut which is going to pull that weight off of his face kind of like I said and then we're gonna combine it with a closed Shape in that triangle section in the very top. What does a closed shape do it pushes the weight towards the face? So what I think is so unique about this style that he wears is the fact that it does kind of come off of his face For the most part, but then there's that little bit It kind of hugs it right around his eyebrow and it falls forward And I think that that's what attracts people to this haircut so much Notice my finger angle is still parallel with the wall. What does that do? We're working on a round surface So as I cut up it gets heavier and heavier as it falls so you can see that looks cool already Some of you might even want to leave it depending on the client What I'll do is I'll bring it all the way back connect it to that back portion But allow it to be disconnected into the front now. We're gonna style it up with Paul Mitchell Mitch Steady grip. This is a great. They call it a firm hold gel, but for me It's just a really great base product put in his wet hair. I blow it dry Get a little bit of volume on it and then I'll finalize it with another product in a second This is the FSE Velcro clips back in stock guys for the holiday season So if you're looking to pick that up also the Mizetani scissors that I'm using are available on our online store as well If you want 15% off your scissor purchase, which is a huge amount off Use the code holiday 21 at checkout and you'll get 15% off that purchase I finished it up with Paul Mitchell Mitch clean cut and I worked that through his hair And you can just see how that front starts to fall I think it matches really well with the picture that we showed you guys at the very beginning I hope you guys like this cut. Hope you can use it in the salon Let me know if you have any questions in the comments Make sure you subscribe to the channel because we got new videos like this coming out all the time Thanks for watching guys. There's a few things that you have to understand about hair cutting before you can really jump into doing haircuts These are all things that I'm gonna teach you guys in the next eight haircuts Truly understanding the why behind what you're doing in hair cutting can make hair cutting so much more fun and make you way More successful behind the chair


Hello and welcome to the Grand Line review your source for everything One Piece. Today we are going to investigate the realm of characters but quite specifically dynamic duos. Now when I refer to duos I'm talking about characters who are practically inseparable as in if they were to exist without their partner then it would be a weak and pointless experience at best. Think things like Burton Ernie, Keenan and Kel, Hamburger and Fries. That's sort of inseparable nature and it should come as no surprise that over two decades the world of One Piece has given us a wide array of duos all of whom are iconic in their own special way. The rules for selection on this list are as follows. A duo must be a pair of characters in which you simply cannot think about one of them without the other popping into your head as well. Furthermore the duo must be canon because consuming filler material is bad for your health but with that out of the way let's begin. Welcome to the top five dynamic duos in One Piece. Jeet and Abdullah. Alright let's commence proceedings with this duo of miscellaneous criminals who first made their appearance during the Dressrosa arc. They competed in the Corridor Coliseum for the coveted prize of the Mara Meronomi showing off their inseparable tendencies at every possible opportunity. In fact these two seem to have developed a tandem fighting style generally using one of them as a distraction while the other performs a sneak attack on their opponent which is kind of interesting because the Corridor Coliseum was a contest where only one person from each block would proceed to the finals so I'm not exactly sure what Jeet and Abdullah's plans were but who cares because these two ended up being defeated together as all best duos are but they did not let that break them and the two continued to appear together for the remainder of the arc even once saving Luffy from a string clone of Doflamingo. In any case there is no Jeet without Abdullah and no Abdullah without Jeet and as a result these two serve as a perfect opening example of a dynamic duo. Number four Johnny and Yosaku. Now here we have an odd pair because at one point they were actually a trio of bounty hunters with a character you may have heard of by the name of Rohrinoa Zoro however at some stage in history they disbanded for well reasons I mean if I had to guess why that reason was I'd say that Zoro became acutely aware of just how much of a third wheel he was and gracefully left Johnny and Yosaku to become the amazing duo they are today I mean as bounty hunter partners they even share identical swords now that's just adorable sadly this duo was actually split up at one stage in the series though when Johnny accompanied Zoro and Usopp to Psyunami while Yosaku remained with Sanji and Luffy on Baratier however this would turn out to be a twist of good fate for the straw hats as the powerful supernatural bond connecting the bros Johnny and Yosaku would eventually bring both groups back together and just like Jeet and Abdullah Johnny and Yosaku aptly demonstrated that a duo who fights together will either win or be defeated together in this case it was a defeat it's it's always a defeat for Johnny and Yosaku so much so that these two eventually gave up their bounty hunter profession and became fishermen together of course and their duotic legacy duotic is a word I just made up continues to this very day number three Django and full body here we have what should be an odd couple of sorts I mean Django being a former pirate and full body being a former dick current marine however this duo would be forged by the ever powerful art of dance essentially following his defeat on syrup village Django entered a dance contest and won obviously he then proceeded to celebrate with full body and began a series of events that would end with full body performing a dance of friendship in Django's honor Django and full body then went on to enlist in Hina's marine unit and well the rest became history Django and full body were never seen without one another again and even fought side by side at the battle of marine food both equally failing to prevent Luffy from progressing in the conflict but the thing that really binds these souls together is their mutual affection for their superior officer Hina but despite their rivalry for her heart these two remain the best of companions often coordinating their efforts to woo Hina who for whatever reason refutes yet tolerates their behavior whatever the case Django and full body are an inseparable duo who will continue to dance their way through the world together number two the unluckies moving away from the realm of humanity here we have a vulture and an otter not usually the greatest of combinations in nature but these two are such a dynamic duo that I bet most of the one piece fanbase don't even know their real names for the record the vulture is Ms Friday and the otter is Mr 13 but their separate identities matter not as collectively they are the unluckies in fact even their separate names are a reference to their collective existence as they allude to the date Friday the 13th but essentially they are a set of agents from Baroque works generally used as messengers but they also dabble in the art of espionage and assassination they are a very complimentary pair with Ms Friday providing transport all over the grand line as well as long range combative weapons while Mr 13 specializes in close quarters combat and also has a supreme artistic ability able to draw lifelike sketches in an instant this collection of skills makes them quite a powerful pair but most importantly I simply cannot picture one without the other and that certainly does solidify their candidacy as one of the top dynamic duos in the series but yet I simply cannot deny number one Dory and Brogy these two best friends have quite a unique history as they were co-captains of the giant warrior pirates who after falling out began a century long battle for honor as such these two have spent the last 100 years of their lives engaging in a life or death contest on the island of little garden and you'd think that may actually ruin their chances of being considered a dynamic duo but this century long struggle has only deepened their bond and has actually come to define them at this point one really cannot exist without the other this ongoing battle is a fixture of life in the grand line and I don't think either one of them would really know what to do with themselves if they even one although very importantly these two still greatly respect each other and consider the other their best friend this bizarre duo has somehow managed to transcend all reason to maintain their status despite constantly engaging in an action that would result in severing it and it is for that reason at least in my eyes that there is no duo more dynamic than that of Dory and Brogy for that pretty much does it for the top five dynamic duos in one piece if you enjoyed this video then feel free to like favorite or subscribe and if you are in any way inclined to support this independent channel then please feel free to check out my patreon discord server or twitter the links to a timely handy description below and finally please do comment with your own favorite dynamic duos in the series this has been the grand line review and i'll see you next time