Hey, good afternoon everybody. How are we doing? Let's learn some stuff about PowerShell. So in my day job, I'm mostly a simple country lawyer. But I open up a computer every now and again and I remember the first time I saw PowerShell, I was like hey, this is neat. Somebody said it's more powerful than the old Windows command line and I type in LS and there's my directory listing. I was like oh, this is awesome. I know this. It was like Jurassic Park. And then I'm like what's my IP address? I type if config. It doesn't do anything. And I type IP config. It doesn't do anything.  Done with this. Done with this. So along those lines, I like to use some of that power of PowerShell when I'm doing demos and I'm doing things on my own systems, of course. And to my own systems. But it can be kind of frustrating. So what we're going to learn about now, Rich is going to show us some stuff that he's done to make Evil PowerShell a lot easier. So Rich is going to give us a great talk. Let's give him a big hand. All right, thanks for coming out. A lot bigger crowd than I realized here. My name is Rich Kelly. First talk, first time here at DEF CON.  Comp side background. Previously I was a comm officer in the Air Force. After I got out, it became a contractor. Did some network engineering, software development. And eventually ended up in security going pen testing, mostly for the government. Most recently, branched out, co-founded a small InfoSec startup out of Virginia. Mostly focused on application pen testing at the moment. And in my spare time I'll occasionally release some sort of utilities that are probably only useful to me and maybe one other person. All right, so why should you care? If you're here you probably already know this already. But the first point is that PowerShell is here to stay. It's going to be on Windows for the foreseeable future. So if you're not using it, and if you're an offensive guy and you're not using it, then you're really just kind of cheating yourself. It's a resource that's there. You don't have to put anything on disk usually. So I'd recommend taking a look at PowerShell. And a lot of the offensive community has been focused on that lately. Also from the defense side, I get the impression that a lot of defenders aren't really aware of how dangerous it can be to give access to PowerShell. I've been on networks where as a regular user I had access to Active Directory functions within PowerShell, which is completely unnecessary. So the more we bring it up, the more secure we can make things. I was also struck by how hard it is to kind of do any sort of post-mortem analysis on any sort of incident that an attacker had used PowerShell. So if you're looking for a research topic, it might be a good area to start focusing in. Okay, so what is the PowerShell weaponization problem? I guess just to put it simply, it's how do you get your PowerShell scripts running on your target machines and effectively get your results back? I think that's probably the most simple way to put it. And it may not be quite obvious, but up until a few months ago it was actually not really that easy to kind of work PowerShell into your workflow. There was a number of scripts and tools and great libraries that came out, but I think there was still kind of this vague understanding of how you would use it on a pen test or a red team engagement. So when I started this project I was just trying to make it easier on myself and enough people I had respect for convinced me to put in for a talk and so here I am. So has this problem been solved? And the answer to that is yes. Certainly in the past couple of months we've had a lot of really interesting and great tools that came out to utilize PowerShell, so the excuses are getting less and less for why you wouldn't use it on a pen test. When I started this the thing that kind of drove me down this path is that there was this kind of fuzzy area where you gain access, do something, use PowerShell and then you know you're good to go. So I think that's where I started trying to fill in the gap.  I think even you know there was one a few days ago that I'll talk about quickly that everybody should check out as well. Alright so briefly I just wanted to go over some of the other ways you can use PowerShell, you can weaponize it. So of course if you have RDP access you can just bring up the PowerShell executable that we all know and love. If you bypass the execution policy you can go ahead and just import your script if you've dropped it to disk. You can copy and paste your function into PowerShell and it's loaded into memory for you to use. More than likely though you're probably using the line on top there which is referred to as the download cradle where you're using a web client to reach out and download a PowerShell script that you've staged on some web server. So the next way is if you have some sort of command shell which is more likely way you probably used it. In this case you can't just drop into a PowerShell interactive console like you would normally. So the nature of PowerShell and the way it works it just made it more difficult to develop that type of payload. So the easy way to get around that was to use the encoded command. So there's a number of utilities that will help you with that. You just encode your script and you pass it as a command line argument to PowerShell executable and it will go ahead and execute that and return some results.  If you have an interpreter shell you can use a lot of Metasploit modules that make things around real easy. So you can use the execute PowerShell module. This has been around for a while actually so what's nice about this is you can stage your script on your local attack machine and Metasploit takes care of some of the heavy lifting for you. So it does the encoding in the background and passes it through the interpreter session to execute. I have had a few issues with it. On larger scripts it's occasionally opened up a lot of PowerShell instances and so it was flaky a couple of times. Most recently and I think it was April or May Metasploit merged in the new interactive PowerShell payloads and to be honest if this was around back when I started this I may not have gone down the path of building it. So in this case it is currently in Metasploit and it's got some really nice features. You do get an interactive console. You can also pass it a common delimited string of file paths where all your local scripts are so that once it runs it goes ahead and loads up all the scripts for you. So it's really nice something you can use right now in Metasploit. Then there's cobalt strike. If you have cobalt strike I think this was probably the first really clean solution to the PowerShell weaponization problem that I saw. In this case if you have beacon on a machine and anybody knows me knows I'm a big fan of beacon you can just say PowerShell import give it the path to your local script and then it does the hard work for you sends it across the wire loads it up into memory and you have your functions available there. So if you have cobalt strike this is really easy. So some other options I just wanted to touch on briefly. So you have PowerShell remoting. This is the native capability you have to have it enabled but once it is you can actually just use PowerShell to invoke commands on a remote machine so whether it's enabled by the administrator of the target machine or if you do it once you get on the machine it's a nice feature and you don't have to really install anything. WMI I'm certainly not an expert in WMI but there's going to be a talk tomorrow I recommend you go to. I'm sure it'll tell you everything you ever want to know about offensive WMI. Then of course Empire this is the tool I was released just a couple days ago at B-Sides and it's really kind of a game changer. It's a post exploitation agent implemented in PowerShell. It also has a really nice framework to help you build out modules for that. If you haven't already checked that out I would recommend going to their website and taking a look at that. Okay so I'm already always kind of harping on my clients to give me requirements which is rough sometimes but the requirements for myself was that I wanted a fully interactive remote PowerShell console with the same capabilities as the native PowerShell executable and I also wanted the ability to seamlessly import modules across the wire. I didn't really want to have to stage them and use the web download feature. I just wanted to say import module, give it a path and be done with it. So those were my two requirements when I set out probably last December sometime and working on it off and on proved to be a little more challenging than I thought. Alright so I'm going to attempt a live demo here. We'll see how this works out. Okay so ultimately harness is the actual payload so in this case it's an interactive remote PowerShell console so it's not implemented in PowerShell actually it's implemented in C-sharp so Microsoft has got a lot of functions that you can use to build out your own custom hosts so if you want to dig into the msdn library you can do that. The documentation on it was a little limited so that's why I struggled quite a bit in the beginning but here I'll show you what I have. So I've kind of bundled everything into this Python framework and it's really not the focus, it's almost a separate project but it was an easy way to kind of get the code out to you guys and let you look at it. Ultimately you can integrate the payload into whatever your workflow is. So it's got the usual commands, show, set, things like that. In this case I have a whole lot of modules, like I said it's not the focus. I have a handler and then I also have a number of payloads here so mostly just 86 and 64 bit executable and then also a reflective DLL that you can use to inject into memory and I'll show you that here in a minute too. So if you wanted to use a payload very similar to Metasploit here so in practice you probably wouldn't use the dropper unless you actually had to. You know you try to avoid touching disk when you're on some sort of thing but you just run it like that you get your executable and then it's kind of up to you how you would get it to your target. So in this case I've already kind of dropped it on target and we'll see if we can get a callback but what I really wanted to show you is you don't really need a special handler in this case that will communicate with any socket so in this case see if we can use Netcat and we get a nice callback here so you don't really need anything special to get most of it. This isn't running PowerShell EXE it's an unmanaged payload so if there's some sort of whitelist you can't you've avoided that. The one of the things I also wanted that you don't get in a lot of the interactive payloads is that if you notice in PowerShell you get the multi-line inputs so I really kind of wanted that feature in there I thought it was like a hallmark of having PowerShell so you can do stuff like this now and what it's doing in the background is every time you send it something it's doing a check for whether or not you have any sort of parse errors and once it says that it's clean it goes ahead and executes it so in this case you can you can just print out so this allows you to kind of build functions on the fly you can try to copy and paste in there I'm working on that problem right now the buffers can't keep up with each other but eventually I like to have that problem solved as well alright so that was getting kind of close to my first objective it's not completely it's not completely implemented yet but yeah I'm working through some of the bugs so the next thing I want to show you is if you use the handler built into the framework here you get a little more functionality so you can load the handler here just run it on 80 once again we'll execute it and we get a callback here so so we can interact here so now what you can do is using the server and the client together you can import modules across the wire so in this case built in some custom commands so the only difference is the module it'll try to send it over the wire so this isn't doing a web download this is actually sending it over the same com channel as you're currently using so in this case once you once you've loaded into memory there you can see we have all the functions from the power up available so see if we can do invoke all checks what I have noticed is that it does actually consume a lot of memory when you're doing things like invoke all checks so here we go we got the results back from invoke all checks nothing too exciting here so the next demo I wanted to show you is the reflective payload and in this case rather than tempt the demo gods I wanted to show you a video I apologize if it's too small so in this case you're going to you're going to run your handler like you normally would load up the reflective DLL which wouldn't be possible without building on the awesome work from the unmanaged power shell project and also from the reflective pick project so if you haven't checked those out you should take a look at those as well it really helped out and of course reflective DLLs are built off all the work from Stephen fewer so without those three projects there's no way I could have implemented that myself so now we're going to create a payload in this case a DLL now I've already staged a interpreter callback from here that's running a system so in this case you can actually use the reflective DLL post module and inject it directly into memory so inject it directly into LSAS here okay so it injects into LSAS and it's going to take a minute the 64 bit payload seems to take a little bit to con it get ramped up but eventually you get a callback here running a system anytime now hey there we go so you get a callback and you can just interact with the session like you normally would so now that we're running a system we can do things like invoke meme cats and before you can now import your modules all the way across the wire what I did for any sort of special functions that required handling there's a caret symbol in front of it I was trying to differentiate between the native power shell commands and then the harness commands so in this case I'll import meme cats and just to prove it's actually loaded into memory you can take a look at what the current process ID is running in LSAS so this is very similar to the capability you can get with things like Empire now so it's going to be a lot harder to detect malicious power shell in the future as well so invoke meme cats there we go so you get your results back just like you normally would meme cats you get your password okay so under the hood the payload actually has been compiled with .NET 4.0 I think you could probably compile it down to 3.5 if you actually needed to it does require the system management automation assembly which is where all the internal methods come from to actually build out your own power shell host tested on a number of systems and it should work from Windows 7 on up as far as the server is concerned it's almost like a separate project I did implement it and it requires Python 3.4 but you can build your own very easily the actual listener is using async.io which if you're familiar with that it allows you to run multiple asynchronous processes not processes but tasks in the same thread so in this case all of the sessions are actually running in the same thread so that was kind of another pet project that I implemented there but you could easily implement it in just a regular listener or something like the Metasploit framework so why did I choose Python why not Ruby and I just go ahead and build a Metasploit module and really it was mostly for the learning experience it helped me to actually fill in some gaps that I had and I have a lot more appreciation now for those behind the scenes I also work better in Python than Ruby so no critique there it's just my preference and as I mentioned it should be easy enough to port to Metasploit module the payload is compatible so reflective harness as you saw can be used with DLL injects currently as far as defense I haven't done too much work in this but if you can restrict access to system management automation you can actually you could probably stop these attacks or even monitor any access to system kind of trigger on any sort of malicious use you can also look and see if it's loaded into processes it shouldn't have and then you can you know tell whether there's something that shouldn't be there else that shouldn't have you know a power shell loaded into it also there's new features built into power shell power shell 5.0 actually has a lot of nice logging features and if you were in the red versus blue talk earlier today he went over a lot of really great defense techniques okay so that's all I have a big thanks to you guys for being possible without it thanks for answering my questions thanks for the encouragement so I really appreciate it all the code here is released on github so at the address below and that's my contact information if you have any questions thank you


I thought about making slides, but I couldn't be bothered to be honest, so I hope you don't mind. So I'm Kitty Stryker.  I've been in the sex industry since I was 18. Simultaneously, I went to university, paid for, by my sex work, for psychology, and it took a little while before I realized that I would rather pursue sex work because I found that to be more ethical. I have to acknowledge that my experiences that I'm going to talk about right now are definitely impacted by the fact that I'm white, I pass as middle class, I'm cisgendered, and as a fem, I'm often invisibly queer. So my experience of sex work involves a lot of being able to pass. And of course, my access to tech also reflects that. So what I wanted to talk about is the sex industry as it relates to tech. And this is something that I've had a long process with. The sex industry is an industry like any other industry.  And tech can be really great in a lot of ways. It can help marginalize voices to be heard. It was through tech that I found out about this conference, so that was cool. But also it can lead us to being sort of put out there for attack. Because we're out there, if you make the choice to brand yourself really, to have being a sex worker part of your personal brand, then often that can come back on you when you're, for example, trying to find another job, which I'm going to talk about in a little bit. So the first area that I wanted to talk about as it relates to the sex industry in tech is real name policies. And this has been something that's impacted not only the sex industry, but anyone who wants to have their name not be their legal name online, which considering the atmosphere of doxing that's been going on is a pretty good idea. I mean, we don't generally give our personal information to strangers and yet we're expected to do that on the internet for some reason. Even though it's an incredibly hostile environment to do so. Your decision on why you might not want to have your legal name on the internet could be because you have a dead name. It could be because you don't want your family to find out. You might not be out as a sex worker. You don't want your school to find out. You could have stalking issues. I have an abusive ex, but I don't want to find me. But that doesn't matter oftentimes. And having those kinds of reasons why you don't want to use your legal name, your real name, as they always call it, because it's not really necessarily your real name. Everyone knows me as Kitty Striker. That is my real name. However, according to Facebook it is not. Any companies will Google your name. They'll request access to your social media profiles. My most active social media profile is under Kitty Striker. So if I want to show a company, like look at how amazing I am at marketing, look at my 6,000 followers, like I built this up by myself, it's also got all my porn on there. I mean, that's my main job.  It has come up in job interviews. It has been inappropriately referenced in job interviews because, of course, as a sex worker you're not allowed to have any boundaries. And that's if you get an interview in the first place, which is very difficult to do. I want to point out that this is something that often affects the workers, the performers, like I'm a porn performer, that's primarily what I'm out as now.  My job is legal. It wasn't always legal, but right now it is. And it doesn't matter that I'm doing legal work, that I have, you know, I file my taxes, none of that matters because it's still considered a stigmatized industry. I know people who are in tech who have worked on the tech side for various porn companies, like for example kink.com, they don't have problems finding jobs. It's perfectly fine to work at kink.com as long as you are in the tech sector, but God forbid that you are ever actually a performer. So of course, you know, the real name policy thing is, as I suggested before, it's a safety threat.   Amazingly, they didn't even know I did porn, probably because I do queer porn. However, that didn't stop them from posting all of my personal information for having written about the issue and my parents were called and it was very exciting. Amazingly, I was out to my parents, so I was very lucky in that way. I was very privileged that my parents supported me.  And my parents said, well, did you know that we're hackers with guns? Is widely thought to be over, but the site still exists. It's still there. All of my legal name is on there forever, linked to my sex work name, linked to ex-boyfriends and my parents' home. And there's nothing I can do about that because it's completely legal apparently. I was moved on from a lot of these real name policies after a lot of struggle, but Facebook maintains that policy. I have so far had to renew my Facebook three times. I refuse to give them my photo ID because I don't trust them with that information, so instead I use my business cards and pieces of mail. But that still means that I have to give them my home address. It still means that I have to have this information around to give.  This is how you connect with people. This is how you connect with your fans. This is how you get speaking gigs. This is how you get asked to go to other conferences. But if there's so many barriers in your way and they're constantly trying to kick you off because you're not really supposed to be there. I mean, it's fine for you to be there as long as you're considered attractive in a mainstream sort of way.  Another area is payment processors. And this is a huge problem.  I'm done.  This is when I was trying to get a job in tech and finding how difficult that was. One of the things I ended up finding was writing. I could make some money writing. Unfortunately, most companies will either not pay you at all for your writing because you get paid an exposure, how lovely. As a porn performer, I don't really need exposure. I'm perfectly capable of doing that on my own.  So I actually use Patreon. That's what I found worked for me. And that seemed to be fine until PayPal, which was at, in the beginning, their main source of payment processing, decided that anything that they deemed as adult content, not only stuff you posted on Patreon, but on your personal site, like for example, even though my writing wasn't sexual in nature, because my website had banners to sites that I performed on, it was still considered too adult for PayPal. So PayPal basically threatened Patreon that they were going to shut down all the integration unless Patreon made every adult seeming profile invisible unless you had the wake. Everyone was flagged and you could no longer use PayPal. They, of course, made this decision at the end of the month, which is when we get paid. So there was a mad scramble to contact everybody and be like, hey, I'm so sorry. Can we use this other method so that I can actually get the money that you decided to kindly give to me? I would really like to have it so I can pay my rent. And it was a big issue, again, there was nothing I could do. There weren't other options, really. PayPal will regularly shut down sex worker accounts even if the account isn't used for anything adult in nature.  It's not just PayPal, though.  But WePay, which does a lot of, I think they are the payment processor for Indiegogo and a few other places, they've shut down fundraisers for sex workers looking to fund vital medical care.  Amazon Payments has done the same. They've fought with an author that I know about a memoir because even though they were willing to accept the money for her memoir, they decided later that it was too racy for them and didn't want to release the money to her. Google Wallets has refused BDSM toy makers from getting their money because of the adult nature of their work, which you would imagine they would have figured out when the person signed up. Now, all of this comes down to Visa MasterCard most of the time. It's really Visa MasterCard who makes the overall archived decisions and everybody else scrambles to fall into line because they don't want to get hit with the large fees. The problem is that Visa MasterCard's ideas of what is explicit and what is adult nature is completely vague and no one can really tell you what it is. So it's impossible really to follow along and oftentimes what ends up being criminalized by Visa MasterCard are things that are marginalized or queer in nature. For example, one of the reasons that you won't find fisting content on many porn DVDs that are distributed widely is because fisting is considered obscene and violent by Visa MasterCard. They're making these decisions for you. And then finally I want to talk a little bit about how the censorship of adult content doesn't come from law but moralistic decisions. It's really just a bunch of people making these choices for us. And as more and more people are trying their hand it's something at the adult entertainment arena.  We live in a culture that stigmatizes us permanently, like forever, forever having dipped a toe into sex work. While simultaneously telling us we have to leave sex work for our personal satisfaction and like that's what we need to do in order to be better people. So it's impossible for us to leave, but we have to leave. And it becomes a really serious issue of contention. I feel that tech is an area where we could actually begin to combat these things but instead unfortunately they are perpetrate them. I would really like to see that change. So many of my friends have been isolated by these kinds of tactics.  Thank you.


From the heart of the jungle comes a savage cry of victory. This is Tarzan, Lord of the Jungle. From the black core of dark Africa, land of enchantment, mystery and violence comes one of the most colorful figures of all time, transcribed from the immortal pen of Edgar Rice Burroughs. Tarzan, the bronzed white sun of the jungle. And now in the very words of Mr. Burroughs, the story of Tarzan and the siren of Omdur Maron. Like Tarzan's jungle, the tiny city of Omdur Maron was deep in equatorial Africa. But there the resemblance ended, for civilization had tarnished the splendor of nature. The city included a miserable collection of native huts, the wide sprawling and dirty official buildings, a crumbling jail, the Sandreach Palace of the Pasha, a few nondescript homes and cheap hotels and Sudan's most infamous street. From the whitewashed minaret of a mosque, the Moesans summoned the faithful to prayer. But a lone rider, his Bedouin robes flying, disregarded the sura as he galloped up to the real heart of the city, the Café Bal Oriental, standing in solitary splendor at the foot of the street of thieves. Take my horse! I should hold the reins offending. But we must make ourselves pussed with palm ground. Why? It is time of evening prayer. Even Al-Suman cares nothing for prayers. I have business in the Café Bal Oriental. Make fast my steed and have the door open for me. It will be as you say, Master. Arms mighty chic. Give this lowly Arab a small boxy shish. I have neither patience nor money for beggars. Out of my way! A thousand times a thousand curses on you. You should not kick crippled beggar upending. Am I to be taught manners by a Nubian slave? I meant no harm, Master. I meant only it is bad luck. Even Al-Suman makes his own luck. Have the door of the Café open for me. At once, Master. And please not tell my mistress I offend thee. The door, the door! Open the door of the Café Bal Oriental for the great chic, even Al-Suman. The music of the Oriental and the perfume of rich incense. This is more like it. Have the barman pour a drink for me. At once, attendee. It better be at once. I'm getting tired of being treated like an untouchable. I have to beg my way into this broketed den, and once I am here, I... Why here, aren't you in? Junior, I... I did not think you were in. But one always knows when you are present. I didn't mean to cause a fuss, but after all I've crossed half the desert to see you.  Keep your voice down, my handsome one. Even inside my café we do not advertise our means of making a livelihood. Sorry. If you would forego your drink, we could talk more freely in my quarters. You know I'd forsake a thousand drinks to be with you, Golden One. Go ahead, Jolinar. I follow in the wake of your tiny jewel slippers. Did you bring gifts for me, Eben? Come over to this table here, Jolinar. There. Gold and necklaces and rings and brooches fit even for such a queen as thou, Jolinar. They look as if they would bring a good price in the thieves' market. In the thieves' market? Do you to be sold along with the offerings of your other suitors? Why not? Why not? Because I've risked my neck to bring these baubles for you to wear. Have you not promised to give your love to the man who brings you jewelry fit to grace your great golden beauty? And do you think these trinkets are worthy of my beauty? These trinkets on this table are worth a fortune. Oh, you did try, Eben, and I'm grateful. But the man who wins me must bring me a jewel like the great star sapphire that rests in the forehead of the karmikis. You expect me to rub the idol of a jungle-tried thousands of miles from here? The man who wins my love must be willing to make an effort. There are others who would try. Darcy, the undersecretary of the French consulate, Dewitt, the Englishman, the American adventurer. Stop. You do not have to real of the names of my rivals. I'll get the star sapphire the karmikis for you, Jolinar. Even though it means facing the cannibals and the pygmies and the wild animals and the untamed white god who has bested so many raiders of the jungle. Tarzan? He has killed many. But he has not yet faced a man like Ibn al-Suman who would stop at nothing to secure the key to his beloved's heart. The jewel will be yours, Jolinar. We shall return in just a moment with the story of Tarzan and the siren of Amdur Mora. Weeks after Ibn al-Suman's bow to obtain the star sapphire for Jolinar, Tarzan's jungle paradise was suddenly disrupted. Native villages were assaulted. Great herds of elephants stampeded. Sheeta the panther and Numa the lion ran in fright. All living things screamed in terror as the savages of the karmiki tribe rampaged in the jungle. Their hearts and their spears of war turned against their neighbors. Tarzan braved death a dozen times before he managed to gain the camp of the warring karmiki. Great Chief Nagako, I come because your arrows and your spears have caused terror in the jungle. This war must stop. Nagako long time on a name of Tarzan, but this war no business of Tarzan. Whose business is it? Your warriors have attacked the people of many different tribes. We search for him who has defiled our god. Oh, someone has damaged your moon idol? Great star sapphire of moon idol has been stolen. What? Temple guards strungle. Priests of karmiki stabbed. Eye of moon god torn from forehead. Now we kill every native in jungle. That way we know we kill right one. I understand your anger, mighty Nagako.  We have no honor until eye of moon god is back. Perhaps Tarzan can help you recover the sapphire. I know many secrets of the jungle taught to me by the apes who raised me. Secrets not even known to the mighty people of karmiki. I shall help you if... Nagako welcomes Tarzan as brother. He puts around your throat karmiki necklace that bears feather of eagle claw of tiger ivory of bull elephant. It is symbol of brotherhood. I shall wear it proudly. But you embarrass me Nagako. I started to say I shall help you if you agree to stop the war until we find out who is guilty of the theft and the murders. Nagako agree. Tell your warriors and then take me to your temple. We will follow the trail from there and death be to him who has robbed my brothers of the karmiki. This is the sacred room? Nadeo.  The priests who were killed. They met their death in this room? Nadeo. They died at entrance. Many signs of struggle with robbers. Nagako think maybe it was Waziri of Marwa tribe or perhaps Apunya. Did your priests wear garments of silk? Silk? No. Only simple dress of animal skins. And yet there is a threat of silk caught in the rough timber of the door frame. Neither the Marwa's nor the Punya's know anything of silk? Nadeo. That is right. You say they died by the knife? Strange knife. Made only small wound. Look. On the wall back of the idol. Do you see that hole? Nadeo. Your priests died from the bullets of the Tamangani's thunder stick. So. Outside the temple in the clay I found the impression of a leather soul yet there was no mark of a hard heel as worn by a European. And on that beam there is the threat of silk. But Thaisan say true. But what it mean? The defiler of your temple and the thief who stole the star sapphire is an Arab. But no Arab ever learn about jewel of moon god. One Arab did. And we're going to find him. And so began a long trek to Gakko, chieftain of the Karmiki and for Tarzan, lord of the jungle. At times the spore of the fleeing Arab and his followers grew faint but always there was a footprint in the clay. A man broken branch of a tree a discarded fragment of equipment or a message about the enemy relayed on the talking drums of the jungle. And then suddenly near an abandoned French outpost the trail was lost. If only there was someone living in these old buildings now they might be able to tell us something. Many footsteps here. Not tell which are Arabs. Some of them lead down to that sighting of the Kassalu railroad. But if the thief boarded a train there's no telling where he may have gone. What we do? I don't know. Maybe if we get out of this broiling sun we may be able to think better. This end building look best. That thatched roof has been on there for many years. But it does look in better condition than the others. Now let's go in. And I guess it's been a long time since anyone ever lived in this old... Bonjour Monsieur. Bonjour. Bienvenue. We thought the wind was against us. We could not tell. Entre vous s'il vous plaît. We thought the French had long since deserted this outpost. Oh Monsieur it's correct. But Henry Duval is a sentimentalist. For 20 years I am attached here. I come here as a young man. It is my first appointment. Although political changers send my countrymen away I remain. I am a sentimentalist. Come in and have a seat. Santa. How do you exist here Monsieur Duval? I ought to be. The engineer of the castle of Grey Lord bring me a gift of ammunition every Bastille day. And there are berries and fruit. I would gladly share my simple dinner with you. Visitors twice within the same number of days. I am too lucky. You have visitors yesterday? The handsome Arab on his way home to the arms of his beloved. An Arab eh? Did you happen to learn his name? Maybe. He was even al-Suman. A romantic avenue with a romantic story. We would like to know. He seemed the object of his affection has never given her heart to any man. And she has never worn any piece of jewelry. That's very interesting. Long ago she has swear only to wear a jewel that can match her beauty. Someday someone give her a jewel she like and she will wear it. And he who has given her the token will be the chosen one. Now even al-Suman return home with a great jewel. The jewel? You saw it? It was a star sapphire. Maybe. It was the size of an eagle egg and as brilliant as a balloon. As brilliant as the moon. I have moon-guard. Is that not a charming story? He developed like a thrilling love story. He's a sentimentalist. In what direction was the Arab headed? Where was he going? But I have told you to the home of his beloved. Yes, where, where? He travelled east to the city of Om Dormara. Incredible as it seems, Ibn al-Suman had been in Om Dormara but a few days when Tarzan and Nagako emerged from the jungle and made their way toward the center of the city. But once again the path ahead was clouded with questions. Where in this maze of city dwellings lived the enemy they sought? They wandered down the tortuous street of thieves and passed the cafe Balorientale as they pondered the question. Would be dangerous to ask too many questions. If they find Nagako his free man might try to take him slave. Do not become separated from me, Nagako. If anyone should... Honest mighty men of the jungle give this lowly Arab a small buck sheath. We are sorry, but we have no coin of your country. Perhaps that jungle necklace you wear in the marketplace it would bring the price of a bowl of millet, meal and sour-pack. A tribal necklace. It is of little intrinsic value, my friend, but it means much to me. Oh, wait, I just remembered. I have a few francs forced upon me by a sentimental Frenchman. They are yours. Oh, a thousand blessings on the white jungle man. Would that this humble servant of Allah could do you service? Perhaps you can. Can we trust you not to make loose talk? My lips can be like those of the mighty Sphinx. Good. We seek one named Ibn al-Suman. Do you know him? You are friends of his? We enemies. He has other enemies. He is a man who kicks beggars, who brings upon himself a thousand times a thousand curses. Then you do know him. Can you lead us to where he lives? I, Allah, I can. But if you are enemies, we had best wait until nightfall. Tomorrow night, perhaps. Why not tonight? Tonight he gives a great party. Today in the bazaar he received a sapphire necklace from a goldsmith who mounted the jewel for him. Yes. And tonight at the party he presents the costly bobble to the woman of his heart. If you will lead us, we will attend this party. As Allah is my witness, I warn you, he uses the scimitar with cunning skill. His guards are legion. And he would as casually snuff out your life as another man would put out a candle. Yet, if it is your will to go tonight, by Allah, I shall lead you. We'll return in just a moment to our story of Tarzan. In the distance, the blue Nile shimmered like a ribbon of silk in the moonlight. And the white-washed minaret of the mosque gleamed like a skeleton finger. Limping his way back to the street of thieves, a crippled beggar smiled because perhaps tonight, Ibn al-Suman would wreak the result of his curses. And outside the wall that surrounded the palatial palace of the sheik, two men of the jungle crouched in the shadows. Why we wait, Tarzan? Why not fight way in?  Ah, I hope to live to return to the jungle. As the midnight hour approaches, the guards grow less wary. Even now they're becoming dull from too much food and wine. Throw rope ladder on wall now? Yes, try to throw it in the most shadowed place. Ah, good throw. Climb wall now? Yes, be careful of your footing, Nagako. Me, careful. Follow me now. Be very quiet now, Nagako. It's party for a very special purpose. As many of you know, the beautiful Julnar has never deigned to wear any manner of jewelry. But tonight, Ibn al-Suman shall tempt Julnar with a prize beyond compare. I hope the fable jewel is worthy of your speech, Edwin. Believe me, it is my Julnar. And when you see it, you will accept the jewel and me. Let's see it. Where is it? Behold, the star sapphire of Karviki. Oh, I see it. Ibn, it's magnificent. Ibn, watch out. Savage is sleeping from the walls. Look at this. That's a mandate. No, you cannot take sapphire. The black one has it. He's fleeing over the walls. He's escaped.  The guns, the guns. A mighty shot. His blood stains the top of the wall. We will comb the forest for the black one who has the jewel. The white one, we will find dead on the other side of the wall. Aye, aye, Carol. Good evening, Effendi. I tie up your steed for you. Be quick about it, Rehan. I must see your mistress at once. Mimsaheb Julnar, not in. She has gone to Pazah. Then never mind tying my horse, Nobien. I shall return later. Effendi, did you catch Julnar? No. But we will. I have twice 200 men encircling the city. He will not get far. But at least your bullets killed white men of jungle. I do not know. It was less than a minute until my men had reached the spot where he dropped. But the body was gone. Gone? Poor Ibn al-Suman. He will be laughing stock of city. I will not be laughed at by you slave. Guard your tongue or you will fill my scimitar. There you are, Rehan. Did you not know I sent for you? I was just coming, Mimsaheb. May I be of service? You can tell me what mystery transpires here. Mystery? Last night you were in attendance when I went to the party in my honor. After the skirmish, the body of the handsome white thief we believed dead was missing. And so were you. I was confused by paddle. I ran to woods. Stopping here at the cafe only long enough to steal bandages and medicine and food. Is that not true, Rehan? It true, Mimsaheb. Unless you lead me to the place where you have hidden this tall white man I will have you turned over to Ibn al-Suman and beaten. If you will come alone I will lead you to his hiding place. You wake up, Tarzan. It is dark. You are Nagako? Me, Nagako. We in cave. Tarzan unconscious many hours. Yes, I remember. The bullet my side. No try move. Bullet removed. Side bandage. But how did you get me to this cave? Where is it? Not far from Omdomara. Miga jewel. Then look back. Tarzan not there. We turn around. Native dragging Tarzan towards. Nagako carry Tarzan to cave native nose. Then he goes away. Comes back with medicine, food, bandage. He must be a brave man. Who is he? Name Rehan. He is traitor to Karmiki. Is it Karmiki? Long ago he taken slave. He tell mysteries and even al-Suman about eye of moon idol. That's how Arab know about jewel. But why did he tell? Someone come. Who come? It's Rehan, great chieftain. Rehan and woman. Why you bring woman? I forced him to bring me. Woman force you. You call Selkar Miki. Speech and dress have changed in heart too. Rehan. I always thought you were from Nuba.  Me chief of Karmiki. But him not Karmiki now. Great chief Nagako. It true I told about jewel. And it true also. I knew al-Suman would steal it. But it only so you and your men would follow him to Amdumara. I plan to help recover jewel and return home to my people. It was my only way of escaping from slavery. I have helped you. Please take me back with you. Rehan cause death of temple guards and priests. Can I take you home? Please.  Enough of this. Where is the wounded white man? In dark corner there. But you...  It was my life that I risked. I did not gamble another to satisfy my vanity. You insolent savage. My wounded side keeps me from turning so that you may slap the other cheek. So you are the woman for whom men steal and brave death. No man has ever dared to talk to me that way. Perhaps no man has ever seen you in your true colors. Nowhere in the jungle is there an animal as cruel and as ruthless as you. In the animal kingdom the female cares for the young and tends the male when he is injured. And yet I suppose you think yourself superior to the hyenas and the apes. I've had to struggle all my life for what I've got. No one ever cared for me and I've never cared for anyone. That is plain. Otherwise you would not have put the price of a jewel on your love. I doubt that he who wins it will find your love worth the price.  I could give your hiding place away. And will you? No. I shall remain here and nurse you back to health. Week after week, Julnar did nurse Tarzan. Though their relationship was most strange. Neither Tarzan nor Nagako, who refused to return home without his white brother, trusted the siren of Amdur Mara. And although Julnar brought nourishing foods and medicines to the cave, she never smiled at the man who had spoken roughly to her that first day. It seemed as though her only purpose was to prove Tarzan's first estimate of her wrong. Rehan, bring the jug to Tarzan's couch. A couch made of rock. At least your pampering won't make me too soft. The jug means soft. Here, some rich broth. It will strengthen you. I have no appetite for invalids food. You must gain strength. Even now, even Al-Suman watches me with suspicion. You must leave soon. Another few days and perhaps I can't... The Arabs. Al-Suman and three of his men. They approach the cave. So, Julnar, after all this pretence you did lead them to us. I swear I did not. They must have followed me. I'm sorry. Yes, that was unkind of me to suspect you. If we escape, will they wreak vengeance on you? I can manage, even. All right, then we must leave at once. Nagako, we must attack before they know what we're about. And then we must make for the jungle before more Arabs join them. Help me up. Tarzan, too weak to fight. I am too strong to lie here and be killed. And the eye of the moon god must be returned to Karmiki. He's so. Here, I help you up. My knife? Ah, here it is.  Take me back to my people.  Stay here. They come. We will not die without a struggle. They're there. At their marriage. Tell me what happened. They are up to no more, Mim-San. And Tarzan and Nagako head for edge of jungle. You would not take me back to my people. Mim-San, you were necklace of Karmiki. It was Tarzan's, and the rush he forgot to take it with him. But you say, if you ever put on jewel or necklace... It would mean that I had accepted a gift and the love of a man. As those two disappear into the jungle, Rehan, we both lose something we love and can never have again. We'll return in just a moment with a word about our next story. It does not shine like gold, nor gleam like diamonds, but men have traveled the world looking for it. They have plunged into the bowels of the earth seeking it. And almost every time it is found, it brings war and suffering and death. For the first time, it is discovered in the heart of the jungle. And this time too, it brings death and drama in the story, Black Gold of Africa, which we relate in our next story. Tarzan, a transcribed creation of the famous Edgar Rice Burroughs, is produced and directed by Walter White Jr. Prepared for radio by Bud Lesser with original music by Albert Lesser. This is a Commodore production.


Hello there everyone and welcome. This is Melissa Armo with the Stock Swoosh and I wanted to introduce the Black Friday Golden Gap course special. This is an early access for people that wanna do the class in November. It allows them to get in the trading room and take the trades before Thanksgiving. If you'd like more information, email me at Melissa at thestockswoosh.com or call me at 929-3200 Gap. Follow me on Twitter, Facebook, YouTube or Skype. So the holidays are almost here. I cannot believe that it's almost 2019, but it is. So based on that, you've gotta prepare yourself for the coming year. So I'm doing a Black Friday early access offer where you would take the class this weekend, November 17th, 18th and 19th. And then you would receive the trading room free for one year. You must sign up on November 16th to receive that offer and then you can get in the room and trade and start out right away and get in while it's still earnings season. It's still earnings season in November. There's lots of earnings every day. So say you've been wanting to trade for a while or say you've been wanting to switch and actually change careers. I say baby, stick it, step it, take your time because you have to learn the system. Then you have to set up an account and then you have to do it. And a lot of people wanna wait till everything is perfect in their life before they decide to trade. It's never gonna happen. They wanna have 100 grand. They wanna have three months off work. They wanna have this. They wanna retire. I mean, there are some people that are so cute that are following me and they wanna wait to do the class until they retire. They're probably never gonna do it because I'm gonna stop teaching it before they even retire. So I say, you know what? Learn it and trade when you can. If you can only trade two days a week, that's what you do. If you can only trade three days a week, that's what you do. I'm giving the trade room free for a year so it's not like it costs you anything. You learn the method in the class and then you do what trades them be in the room to make what money you can. And during the process, you grasp it. You learn it. It's like it becomes part of you. 10 years I've been doing this. And one of the reasons I'm so good is because I've been doing this and nothing else for 10 years, okay? So putting it off and waiting until the perfect time, the perfect time will never happen. The perfect time is now.   A comma day is any day with a comma in the profit, a thousand, two thousand, three thousand. As soon as you have your first comma day, it's your, I'm telling you, you're hooked right into the market, particularly if it happens in a couple of seconds or a couple of minutes. So if you'd like to learn my method, it's called the Golden Gap course. Class again for November is the 17th, 18th, day one and day two. And the 19th is the repeat of day one. Class tuition is 59.99 US dollars. Class is online. It could be anywhere in the world and take it. You can do the combo. You save 500 dollars if you do two classes. Trends course is in December. If you just wanna do options, that's fine too. You get the trades. This is not a class. It's 49.99. Trades are just shot out to you, emailed.  This is not a class, but you get the options trades for a year, just so you know. Email to you and that's if you can't be in the room. So if you wanna sign up for the class, Friday is the deadline. And again, getting, if you wanna do it, start trading, November's earning season, go through the class, learn it, ask me questions, set up the account and get integrated into the system and trading so that you're ramped up that come January 1st, you're ready to go to achieve your goals for 2019. I can't even believe what I'm saying that 2019. Wow. So good luck everyone. And if you have any questions, email me at melissa at thestockschwisch.com. Have a great day.