Okay. I'm presenting a speech on SQL injection and out-of-band channeling. My name is Patrick Halson. I work for a small firm called Inspectit, where I'm one of the owners. I also founded a website called Secure.net back in the year 2000, where I published some of my tools. I currently work with penetration testing and application security reviews, source code reviews, general information security audits, basically. I'm going to present a speech on SQL injection with a focus on out-of-band channeling. I'm going to show a number of examples using this technique, and I'm going to finish off the talk with a demonstration of how this can be performed. The reason why is because when we perform our test, we still see a lot of vulnerable applications. However, because applications are more hard than today, maybe, than before, it's a bit troublesome to get the data out of them sometimes. Of course, tunneling data is fun. I'm not going to go through the basics of SQL injection that much, because it's quite a tight schedule. I hope that you're comfortable with SQL injection in order to understand everything here. I'm not presenting any arsenal of tools in order to automatically exploit these kind of vulnerabilities, and obviously not presenting a silver bullet solution to all SQL injection problems. Doing a very brief recap of SQL injection. It's a high-risk security vulnerability. We usually find it in web applications, but it's not limited to web application. It's when you have the ability to inject arbitrary SQL code through poorly validated application parameters. One might argue that this is due to inadequate design or due to improper validation controls. Having proper validation controls obviously rules out other problems such as cross-site scripting, so it's always a good idea to have it. However, it's also even better to separate the data from the actual SQL code, not like building by concatenating strings, because then you usually run into these problems. Depending on the privileges and patch levels of the database server, the consequences may obviously range from troublesome to devastating. A common misconception might be that usually just forms and URL parameters are vulnerable to this kind of problem. However, we find problems in cookies and referrer fields and user agent fields in the HTTP headers. For example, when you implement a logging mechanism in order to log improper or failed login attempts, for example, you write a row into a database and use the insert statement, then you append a lot of data like which web browser is the user using. Putting a couple of quotes in that user agent field, you can actually get control of the data. So looking at a classic example, we have the authentication function where you log in using your username and password. So basically, the user supplies a username and password, and the database retrieves a user ID for this user, which is used throughout the application. In this case, we have no parameter validation, so we can enter any data we wish for. And by entering, for example, a quote, or 1 equals 1 dash dash, we circumvent the whole login function and get access to the application. So basically, that's SQL injection in a very brief recap. So our band channeling, well, it relies on traditional SQL injection weaknesses for exploitation. However, contrary to normal SQL injection or in-band injection, it uses an alternative channel to return data. So for example, you could be using timing, like for example, does the first user begin with an A, then you wait five seconds, you would know that, okay, there's a user starting with A. You could use HTTP, which I'll show later in a couple of slides, where you send the data in a HTTP request. And you could use DNS, which is the focus on the speech later on. And several different approaches exist, which depend on the backend database. If you're running Microsoft SQL Server or Oracle, you might have to choose a different approach in order to exploit this vulnerability. So when is exploiting using out-of-band channels interesting? Well, when you don't have any detailed error messages, which you can rely on to extract data, it could be useful. When you gain access to or when you're able to control a SQL query very late in the query, like in the order by close, which I'll show also later on. When you're able to inject a second query through batching when you do a semicolon and then you append a lot of SQL code after. And when results in somewhere being limited or filtered, for example, you just get the first row of a table. And when firewall rules are lax, you can open a channel back to one of your DNS servers or one of your HTTP servers or whatever. Contrary to blind SQL injection, when you do a lot of queries in order to extract little data, out-of-band channeling turns this around, you do a lot of injection or one single query and you retrieve all the data with one single query. And obviously when blind SQL injection looks like the only option, this might come in handy in many cases. And I believe it's a much more efficient way of extracting data. So we have three examples here where we get control of the data of the SQL statement in the first case very late in the order by close. We have a store procedure, which actually logons the user. It returns true or false. So basically we'll have a hard time here retrieving any data. But using out-of-band channeling, we could retrieve anything from the database. We have also the last query here, which simply returns a single row. And depending on a number of different factors, which we'll discuss, the channel chosen can be more or less suitable. I'll show you three different channels and I'll finish up by demonstrating their DNS channel. What I'm going to talk about first is OpenRoset. It's a SQL server function. And I'm also going to talk briefly about the UTL HTTP package in Oracle and then finishing with a couple of slides of DNS. So OpenRoset, I decided to include this in my demonstration, even though it's not very likely to be able to exploit it nowadays because it's restricted in most SQL server environments. But it illustrates the problem and it shows you a good picture of how everything works. OpenRoset allows you to retrieve information from an alternative data provider. And usually it can be used together with Union in order to extract data from another database for a neighbor database. And it's disabled by default in the SQL Server 2005. And in the SQL Server 2000 Post Service Pack 3, it's also disabled and available only to sysadmin users. The syntax not very... Here's a classic example of enumerating data from a neighbor database. So basically we do a Union of our first select statement and we do the OpenRoset part, followed by we need to guess a correct user ID here. So we're like guessing system administrator blank password. And we try to extract data from the user's table on the server 10, 10, 10, 10. And we try to join this result in the original SQL query in order to get the results back in one web page. So basically we're on the top talking to the web server. The web server communicates to the database server. The database server executes a query to our very secret database, fetches the data and joins it all together in the first SQL server and returns it back to our web server. So how is this relevant in regards to out-of-band channeling? Well, OpenRoset can be reversed. So instead of using it to query data, we can use it to insert data. So actually we can fetch the data from one source and insert it to another. And the destination database could be any host reachable from the source. And in this way we can insert data into one of our own database servers through batching statements. So we try to terminate the first query and then we do a semicolon and then we add an insert into OpenRoset, which would look something like this. So we have the first query here where we fetch user ID, the login function, remember from the first slides. We do a semicolon after our password and we do an insert into OpenRoset. We point out our server, database server, for which we already know the username and password. And then using the first select statement actually points out which table we want to insert data into in our database. And the second query says which table we want to fetch the data from. So basically you don't need to know any username or password since it's our own database. And after the others we have a comma 443. This is the which port we want to use in order to insert our data. So you can choose any port here. You could use HTTPS, HTTP, FTP, Telnet, whatever, become suitable in the environment you're actually attacking. You can also use it for port scanning. So you could use a higher timeout. Use like a timeout of five. Then you can easily check which ports are allowed outbound. And once you find a suitable port, you can just execute everything. In order to illustrate it with a picture, it would look something like this. We still talk to the web application server, which talks to the database server, which opens up a connection through our firewall back to us. So the obstacles in this solution is that you need to have the database server where you want to insert your data and it needs to be reachable from the source database. So in a tight network you might have problems reaching the correct ports. Also we need to have the source and destination tables they need to be identical. We need to know what columns we have in our user table in order to insert them in our own user tables. We have to know the column names, the data types, the size of the data types. Usually when we do this kind of attack, we're successful in using HTTPS or HTTP or any of the common protocols. And as we have in SQL Server, we have something called sys objects and sys columns, which are meta tables containing information about all objects in the database, like all tables, all columns for all tables and all data types for all columns. So by knowing the layout of these tables we can create our own similar tables in our database and we can extract all the data we need. So first we start off by extracting, okay so which tables do you actually have? Oh well I have the user table and the payments table. That's interesting. So we do an identical payments table and then we just extract everything through this batching technique. Looking at the summary of the OpenRosa then, like I mentioned in the beginning, only sys admin members post ssql server service pack 3 are allowed to actually access these functions. But for some reason we've been able to do it quite a lot this year so actually it's still possible in many installations. Most hardening guides suggest disabling OpenRosa altogether. You need to have a direct connection back to your database server so in high security environments this is most probably not possible of doing and it's limited to sql server obviously. Just to illustrate that I'm not just picking on sql server I decided to include the UTL HTTP package as well from Oracle. Basically what the UTL HTTP package allows you to do is to perform a GET request on a web page. The result from the web page where the first 2,000 bytes are returned in the answer like in a normal query so you do select. In this case we do UTL HTTP request and we try to download Oracle's web page. We'll get the 2,000 first bytes of this web page. And this can also be exploited in order to tunnel data through this type of function. What we actually do is that we're dynamically building the URL that we're retrieving. So we specify one of our own web servers and then we dynamically fetch table data in order to build our URL. And then by looking at the web server log files on our web server we can see what the data actually is in the database tables. So this is an example of late exploitation. Typically when we've seen tables on different web pages, you have headers where you can sort the table data in a web page. Sometimes this is achieved through ascending or descending as a parameter in the URL. This data is then used in order to sort the table data and in order to match the actual topic that you clicked on in the header. In some cases this is injected through concatenation of strings and just concatenated at the end of a static SQL statement. In Oracle you can, if you return exactly one row of data, you could use this in order to order this first table that I just described. So in this case we're actually injecting a parent thesis instead of descending for example and then we do a UTL HTTP request. We try to access our web page, secure.net, the URL is slash ing for injection and then we do a select username and the user password from table logins where row num is less than two. So this will return exactly one row from our login table. So basically we're asking the web server to start the UTL HTTP and perform a request to our server. The UTL HTTP package accepts proxies. So in an environment where we have a proxy server you just tag along the proxy name and you go through the proxy out on the internet. Looking at the log files you would see something like this with the user names and password separated by underscore. And looking at Oracle you can see that many databases still have this package unrestricted. It's available to the public user which is a user, a pseudo user which everybody belongs to, or a role actually. So anyone can execute this function. So even if you have very limited access in Oracle database you could use this attacking technique in order to extract data. Commonly firewalls tend to be less strict on outbound traffic. So accessing HTTP or HTTPS or going through a proxy usually solves this. The limitations, yes. Well it's limited to Oracle database server. Hardening guides suggest disabling this obviously. And one other limitation. It requires a direct outgoing connection to our web server which we control. Slide 30. DNS and outbound channeling. So DNS, it's a hierarchical protocol. Most of you use it daily. So in order to illustrate the benefit of using DNS let's assume we manage a DNS server for the zone secure.net. So if somebody at the corporation X tries to look up a host in our domain the query will find its way to us as it's a hierarchical protocol. So this would allow us to monitor queries for sub-domains or hosts in our domain. So even if you have a hardened database it's our experience that usually you allow DNS. And most internal DNS servers are allowed to forward their queries. And most hardening guides if you look at general hardening guides available from the vendors they failed to actually mention a lot of these packages which can be used in order to do DNS resolution. So if we could some way trigger a DNS resolution in a database we would have an indirect channel to a DNS server of our choice as we're controlling the domain name of the name resolution. We just point it to our domain and the query will travel all the way back to our DNS server. So if we could trigger DNS we could ask for any host in our zone. So in this case we do a DNS resolution to our corporate DNS server which forwards the query to the authority of service for .NET which in their turn forwarded the tower DNS server for the secure .NET DNS zone. Both Microsoft and Oracle provide functions and stored procedures and packages in order to do DNS resolution. Some of these functions are executable by the public user. So basically what I'm saying that anyone can execute these packages or stored procedures. And like I previously said some of them are not mentioned in hard name guides which makes them available in a lot of database servers. So in SQL server a number of stored procedures accept UNC path names. A UNC name is when you point out a share on a network network server and if you point a UNC path to a fully qualified domain name it will result in a DNS resolution being performed. And this can be used in order to channel database information to an attacker. So by looking for example at the extended store procedure xpdir tree xp file exists xp get file details sp add job step they all accept UNC paths in their file parameter. The backup database when you choose to backup a database as the database owner of a database you can point it to a file to be backed up. You can point this file to any network based server. So basically you can do DNS resolution through the backup command as well. If you look at Oracle you have the UTL in adder package which basically does DNS resolution that's what it's meant for. You have the UTL HTTP that I described where you do a connection or request to a web server. So even if you're not allowed to talk to the web server in outbound traffic maybe the firewall blocks it you can still use the package in order to do DNS resolution. So DNS traffic will most probably go through the firewall and out to our DNS server. There are packages like UTL TCP and most probably there are a lot of more packages. I just had a brief look in both SQL server and Oracle and I found this one so far. And what I was interested in was packages that have public privileges so basically whoever can execute. So even if you just have read access in a database you can still execute these packages. So how do we extract data using DNS? Well, basically we need to put the whole data or a payload so to speak in the DNS hostname. As the zone name, secure.net just directs it to our DNS server. The actual hostname is the query that's being performed to our DNS server. It means that our hostname has to be built dynamically using table data. So we stuff all the data into the hostname and then we try to fire it away using a DNS resolution and it will end up in our database or in our DNS server. And by using cursors and variables in the SQL you could actually build these hostnames dynamically. Once you have built the hostname you just fire it away using Expedure Tree or XP GetFileDetails or whatever your stored procedure of choice is. So I'm providing a sample here. We have the variable s declared where we start off by saying that we want to use the Expedure Tree stored procedure in the master database. We add a double backslash in order to explain that we want to use the UNC pop. We tag along the user underscore name function which will result to the current username. Then we just tag along our suffix or our domain .inni for injection .secure.net then another backslash and then the directory we want to perform a directory tree inside. The directory tree is never being performed as in our demonstration I'll always be returning the loopback address in the DNS resolution. So basically we're just interested in the name resolution. We're not interested in doing a directory tree we're just interested in performing the DNS resolution. That's it. We can do the same thing with basically any parameter or any function in SQL server. In this case we're fetching the server name with the name of the instance as well and we're tagging it along with our domain name in order to get the resolution to work. So looking at DNS we have some challenges. DNS records are cached. This is true for both successful DNS requests and host names that are not found. We also have length restrictions on our fully qualified domain name 255 characters and on our labels. The labels is the data between the dots in a fully qualified domain name. We have the problems with some characters which cannot be in a fully qualified domain name and the obvious solutions are setting a low or zero time to live. If you have control of the DNS server in our case I'll show you a small DNS server written in Perl which always returns a very low TTL. But if you're running TCP dump on a bind database for example you might not have the opportunity to set a low TTL value. In these cases you can always you can add a unique value to the data being queried. So you tag it along before the actual data you want to see. So performing the same request 10 times always sends a different seed so to speak which will always result in unique DNS resolutions being made. And the obvious solution for length limitations are obviously to truncate or split values exceeding length. And for the nasty characters we just convert them prior to our resolution. If you look at the caching part then either you try to set a low TTL value or in the demonstration I'll be using a checksum value or a seed. I'm using the checksum function in SQL server which takes one parameter and I'm feeding it the current timestamp. So if you do subsequent requests it will always be a bit different. And the end result looks similar to the following. You have a large number in the beginning, you have a dash and then you have your table data followed by the zone where you want to do the resolution in. So modifying our first example we would actually add the checksum of the current timestamp. We need to convert it to a character stream using the convert of our car function. And then it's basically exactly the same. So looking at RFC 1035 you see that the label restriction and the labels they cannot exceed the length of 63 characters. The fully qualified domain name must be 255 characters or less. So the labels are actually the data between the dots. This means that we need to in some ways slice and dice our data in order to fit these restrictions. And our goal in this case is to split a large string and send it over several consecutive DNS requests. So my proposed layout for this is to actually do it this way. So you have first indicated that the following 0x is a hex string where our data will be fitted with the limiting dots. You have an ID for the specific data being sent that you don't have a part number which specifies when we chopped up the data for suitable fully qualified domain names. It says okay this is part one of seven where the max part describes how many parts there are in total. So as DNS travels over UDP you can have some loss or you can have packets coming in the wrong sequence. This way you have control on how many packages you're actually supposed to receive and in what order. I'm not using the part and max part in the demonstration at all. However, if I would use it in the future over a more reliable network I would use it. So by first converting our data to hex we don't need to worry about any odd characters showing up. So what we're actually doing is taking any data type and using the convert or cost function in SQL server and converting it to binary. When we have it in binary form you can then use the function verb into hex string which converts our binary data into a hex string starting with 0x and then letters from a to f and 0 to 9. So we no longer have a problem with characters which will break our DNS resolution. The hex string then needs to be divided into adequate pieces and this is most easily done by using the substring function. So what we actually do is that we first split our data into suitable fully qualified domain name lengths. When we have these blocks we split them into smaller blocks divided by dots so they fit our label restrictions. We then tag along the ID and part information and when it's all built we send it using the ExpedureTree command. Like I said earlier the ExpedureTree doesn't do a directory tree in this case. The only purpose of the ExpedureTree is to perform a DNS resolution in order to send our data to our DNS server. This means that the receiving part, the DNS server, reverses the process and prints the data out. So basically we're sending character by character but in larger chunks. And using this strategy we need only to inject once. So we inject one large query and retrieve all table data instead of using like 10 requests in order to get three characters. Basically only the size of the variable receiving the data is our limitation.  So this is time for the demonstration and hopefully it will work. So I just started our small DNS server here. We're talking to VMware server here in another window. It's running Windows with the SQL server 2005 service pack 2 all hotfixes everything. And the DNS server is set to my host where this black window is running. Oh, yeah. Let's see if we can... Yeah, like this. So I'll be cutting some copy pasting some data here in the windows. Let's see. This web application is just some application available on the internet where I just trashed all the backend and just replace it with a vulnerable code basically. So it has nothing to do with this actual website. And I'm running everything locally. So basically it's not giving us any detailed error message just saying that an error occurred, please try again later. So we're going to try to inject some data into this. And we start off by injecting the first one that I showed you with the username. So we get a query that says www.inni.secure.net The little pearl script I've written just chops off everything called inni.secure.net. So running it in a non-verbose mode won't show the queries and actually produce a more readable format. I'm going to put this small DNS server on the same web page as I'm putting the presentation later on. It's not yet there. Looking at the server name in order to as the server name actually has a backslash in it. The instance is written as well. We need to tag along this small piece here with the replace where it converts the server property. It converts the backslash to underscore. This is before we start chopping up data. Also when we chop up the data using the bigger SQL server functions we won't be needing this. So in order to defeat our caching problem I'll show you the query using the current timestamp as well. So it tags along the 21, 55, blah blah blah. If we run it once more it should give us slightly higher value. So we can do subsequent queries and always be sure to get a proper resolution. I'm going to switch into non-verbose mode because it's not going to be as pretty if I don't. Like I mentioned we're going to have a look inside the sys objects and sys columns tables which all describe the we have a small tiny injection code here. So basically we inject it here and it starts up a bit slow but hopefully we'll get the rest of the data as well. Hopefully. So here it goes. So our little query is in the background. I need to scroll the screen in order for you to see the whole but it's in the slides. So what we see here is first our database name which is webshop. Basically this script that I just injected goes through all databases in the database server. For all databases it looks for if it has permissions it looks for all tables. For all tables it looks for the column it results the data type and for all data types it results the size of the data type. So what we have here is a complete database schema basically. We see that we have the webshop we have a table called payments. We see a purchase ID, card holder, card type, card number, expiry everything. We have a products table where we're pricing information which might be handed to change. We have something called users with usernames and passwords. So as we now know our data or our table definitions we can move to the next tiny SQL statement here which might work as well. Okay so we get all the usernames and passwords. Obviously with Swedish passwords I'm sorry for that. And then moving right along to the interesting stuff we look at the credit card numbers. Yeah I think so. There they go. Please don't write them down. So we have the username or the full name as it's shown on the actual card. We have the card type, we have the number, we have the CVV. You want it? Yeah well basically that's it. That's the end of the demonstration and the end of the talk.


The dependable Dodge Plymouth dealer in your neighborhood. The man who sells and services the elegant new 54 Dodge presents The new Roy Rogers Radio Show. Yes folks, it's the new Roy Rogers Radio Show for the whole family. Adventure, suspense, mystery and music. Starring Roy Rogers, King of the Cowboys and Dale Evans, Queen of the West with Pat Brady, the mellow man and an all-star cast. And now here to greet you with a song and a story, our Roy and Dale. As I walk down here, as I walk down here. Well, good evening folks. Here it is another Thursday and here we are again with a story and a song. I'll bet you recognize the song already. You know, that tune has really got two names. Some folks call it the Cowboys Lament, but mostly it's known as the Streets of Laredo. And whenever I hear it, I think about Charlie Simmons. Charlie and his wife Jean own a small ranch down there, Laredo, right on the Mexican border. As a matter of fact, you can walk right out of Charlie's backyard and go wading in the Rio Grande. Well, Jean and Dale were old schoolmates and every few months Dale would get a letter from Jean inviting us all to come down and visit. So we finally took her up on it and made the long trip from California. And when we finally arrived, the entrance to the Simmons Ranch sure looked mighty good to us. We drove up to the main house and honked the horn to let them know we were there. We sat and waited a minute or two, but nobody came out. That struck us being kind of funny so we got out of the car and went up to the house. The front door was unlocked so we went in. Nobody was around. Then from the bedroom we heard the sound of a woman sobbing. Dale ran in and found Jean lying on the bed crying her eyes out. Jean, what's the matter, honey? In just a moment you'll hear the entire story of what happened to Roy, Dale and Pat on the streets of Laredo. The Big Dodge 40th Anniversary All America Contest moves into March. There's never been a contest like it. Win two weeks away with double pay. A glamorous, exciting vacation trip for two anywhere you say in the USA.  Many more grand prizes like this will be given away. There's a brand new contest every day plus large daily cash awards. You better hurry. There are only 21 days left. And by the way, because so many of your neighbors are buying the elegant new Dodge after entering this contest, your Dodge dealer now has the best selection of top quality defendable used cars in town. See your Dodge Plymouth dealer right away. Elegance in action. The Dodge with more than ever before. More to it, more in it, more of it. The great new Dodge for 1954. More to it, more in it, more of it. The dependable new Dodge for 1954. And now back to Roy and Dale and the story that happened on the streets of Laredo. There now, Jean, drink your tea. It'll make you feel better. Thank you. I'm sorry you found me in such a state. This certainly isn't the happy reunion I planned. Now stop fretting, Jean. You just pull yourself together and tell us some more about what happened. I don't know what happened. All I really know is Charlie's been gone for two whole days and that's not like him. Why, he's never been away from home for a single night the whole time we've been married. Well, maybe he had some kind of an accident. Well, I thought of that. I called the hospitals and the police station. They haven't seen him, huh? Not at trace. When he left, did he take any extra clothes with him or suitcase or anything? No. He said he was just going into town for a while to see Mr. Merton. Mr. Merton? He's a friend of ours, businessman. Well, is Charlie's car missing too? He didn't take the car, Roy. He rode into town on his paint. Paint? Well, a horse like that shouldn't ought to be hard to locate. Pat. Yeah, Roy? Get Trigger out of the trailer and borrow one of Charlie's horses and saddle him up. Where are you going, Roy? Into Lareda.  There's got to be a reason. I guess it's right up these stairs here. Yep, this is it. L.B. Merton. Mr. Merton? Yeah, that's right, sir. L.B. Merton. I'm Roy Rogers. This is Pat Brady. Howdy. Roy Rogers? Well, yes, of course. I'd recognize you anywhere, Mr. Rogers. I've seen your pictures. Thanks. What can I do for you? Well, it's about Charlie Simmons. I was wondering if you could give us any information. Nothing more than I told Jean. Charlie kept his appointment with me Monday morning. We discussed a loan on the ranch and he left. And you ain't got no idea where he might have gone. Oh, not the slightest. He said he was going home. I see. Well, thanks for letting us bother you, Mr. Merton. No. No bother at all. Sorry, I can't help you. Come on, Pat. Where are we going now, Roy? To the sheriff's office. We'll see if he can tell us anything. Hold it a second, Pat. You got any change on you? Change? Oh, just a minute. Let's see. Yeah, here's a quarter. Let me borrow it, will you? Sure. Well, that's funny. What? Did you notice that blind singer standing there when we went up to Mr. Merton's office? No. He wasn't there then. Well, this is a pleasant surprise, Mr. Rogers. Never thought we'd be honored by a visit from you. Well, thanks, Sheriff. This is my sidekick, Pat Brady. Howdy. Yeah, well, it brings you down right away. We came down to visit Gene and Charlie Simmons. Oh. You, uh... You friends with Charlie's? Well, actually, Dale's a good friend of Gene's. I suppose you know that Charlie's disappeared. Yes. Yes, Roy, I do. You got any idea where he might be? No, not exactly where he might be, but I think I know why he disappeared. Yeah? Did Gene tell you how Charlie was dressed and what he was riding when he came into town last Monday? Yeah. She said he was wearing his white linen suit, his white 10-gallon hat, and he was riding his paint. Yeah, that's right.  Charlie was quite a dresser, and he sure was proud of that paint he rode. Got him quite a reputation. Come here. Did you ever see this picture? Well, that's a wanted circular. Charlie Simmons wanted for smuggling. You mean you've got Charlie in jail, Sheriff? No, no. This circle is about seven years old. Charlie served his time for that, and when he got out, he married Gene. Well, does Gene know that Charlie did time and stir? No, Pat, he doesn't. Well, I don't follow this at all, Sheriff. What's it got to do with Charlie's disappearance? Charlie didn't disappear, Roy. He's up to his old tricks. Smuggling. What does he smuggle? Dope, wet backs. Anything will bring a price. How long have you known about this, Sheriff? Me and the board of patrol have had our eye on him for several months. But we never could catch him with the goods. He's plenty smart. So you think Charlie went away deliberately? Yeah. I figure he's stashed up a lot of money in Mexico, and now that the heat's on, he's skipped the country. And left Gene? I'm sorry, but that's the way it looks to me. What makes you think Charlie's at the head of this gang of smugglers, Sheriff? Every time we've had a report on him, it's always the same.  You're acting awfully mysterious. Why'd you bring me out here in the back of the ranch? Well, I didn't want to talk in front of Gene, and you must never tell her, Dale. Tell her? What? Well, Charlie's done time in the pen-tenture for smuggling. Oh, Roy, I can't believe it. Poor Gene. Well, I know how you feel, but after all, we didn't hardly know Charlie, and I've got no reason to doubt the Sheriff. I saw the wanted circular with my own eyes. Who's there? Roy! Say we are whoever it is. Do as he says, Dale. Hands up. Oh, it's you, Roy.  What are you doing out here this time of night? Well, just taking a little walk with Dale. This is the Sheriff, Dale. Hello. Howdy, ma'am. I wouldn't stay out here if I was you, Roy. We've got to tip the smugglers might try it again tonight. We figure they might come this way through the river and over the Simmons Ranch, and got the whole border patrol hit out in those bushes waiting for them. Well, thanks, Sheriff. I better get you back in the house, Dale. Look out!  Yeah, there they come. Well, they won't make it this time. We're ready for them. Sheriff, look. Huh? Where? Out there in the middle of the river. Yeah. A man dressed in white riding a paint. Roy, is it Charlie? Yeah. They got Charlie. He's falling off his horse. And we've got him on the run. Come on, Roy. Let's get him. You shouldn't be out here.  No, why are they shooting? Deal. That man. That man in white. Is it... We'll return to Roy Rogers in part two of a story that happened on the streets of Laredo in just a moment. Tomorrow, stop by your nearby friendly Dodge Plymouth dealers and put an elegant new 54 Dodge through its faces. You'll find that here is the car you've been waiting for. Here is the Dodge with more than ever before. Yes, you'll find more new luxury and driving ease and flashing performance than ever before. For instance, Dodge's new fully automatic power flight drive delivers more starting power more smoothly than any automatic transmission ever built. You take traffic in stride, master hills and highways with ease, and there's new Dodge full-time power steering that takes all the work out of driving, leaves all the pleasure in. Once more, the new 54 Dodge offers you a real bonus in power and performance. Dodge's famous Red Ram V8 has been stepped up to 150 horsepower. Your dependable Dodge Plymouth dealer can open a whole new world of motoring enjoyment for you in the great new 54 Dodge. And now back to Roy Rogers in part two of a story that happened on the streets of Laredo. Looks like most of them got away. Yeah, I rode back across the river into Mexico. Well, at least we got Charlie. There's a fine info man to come to, Roy. Lion face down in the mud of the Rio Grande. Boy, that white suit of his ain't so pretty now. Yeah, I'll turn him over. That ain't Charlie Simmons. Yeah, I see. But he's dressed just like him. White linen suit, white 10-gallon hat. And when he came across the river, he was riding a paint. Sheriff, it begins to look like somebody's been impersonating Charlie Simmons. Yeah. So now the question is, why was he doing it? And where's the real Charlie Simmons? I'll get it. Hello. Roy? Yeah? This is the Sheriff. Could you come into town and see me right away? Well, I guess so. Why? What's up? We caught one of the smugglers last night. Mexican fella. I tried to question him, but he wouldn't talk. All he'd say was that he wants to talk to you. Me? Yeah. Seems he knows that you're down in these parts and he wants to see you. I thought if you could come in, you might be able to get some information out of him. I'll be there in a half an hour. Thanks. How come you brought Bullitt along to town, Roy? For the exercise. He likes to snoop around new towns, don't you, boy? Hey, Roy, there's that blind singer again. Yeah. You got any more loose change paths? Oh, well, I see. 22 cents. That's fine. Let me have it. Come on, Bullitt. Get out of his way. Can't you see he's blind? That's funny. What? Oh, nothing. Come on. The sheriff's office is on down the street. His name's Miguel. I'll weed out here. Okay, Sheriff. Your name, Miguel? C. They tell me you wanted to see me. I'm Roy Rogers. What did you want to see me about? Señor, I am no good. I've done many wicked things in my life. I will pay for them. But it is no right that my Pedro shall suffer on my account. Who's Pedro? My little boy. Such a small one. Muy poquito. I do not want him to grow up to be like his father. Señor Rogers, you are his great favorite. He will listen to you. I don't think I understand you, Miguel. What do you want me to do?  Talk to him. Maybe look after him. Señor Rogers, will you go to see him, please? Por favor, Señor. Miguel, if I do this for you, would you do something for me? Si, si, anything, Señor. Do you know a man by the name of Simmons? Miguel? Well, in that case I... No, no, no. I... I will make a bargain with you. Go to my son. See that he will be taken care of, then come back and I will tell you everything I know. That's kind of unusual, Miguel. I don't think the sheriff would approve of it. No, I'm sorry. I can't accept your bargain. Please, Señor. But I'll go see your son whether you talk or not. I just happen to like little buckaroos. What will I find you? Oh, thank you, Señor. Here. I have drawn you a map. You take this road and follow for about two miles into this... Thanks for coming along, Dale. I figured with a little boy... Well, you know what they say, a woman's touch. Sure, Roy. I'm glad to help in any way I can. Is it much further? It should be right around this bend in the road. Miguel said it was a small shack. Yeah, there it is. Come on. I don't see anybody. Maybe he's in the house. Volta. Is your name Pedro? Si. Well, can we come in? No. Well then, if we can't come in, will you come out here and talk to us? No. Pedro, I have a message from your father. I'm Roy Rogers and this is Day 11's. Your father asked me to come and see you. He said that you could tell us where to find a man called Charles Simmons. Go away. What? It is just like they said. Go away. Quiet, Trigger. Quiet, boy. Well, okay, Pedro. If that's the way you want it. Come on, Dale. Wait.  That's right. Is he really Trigger? Sure he is, honey. Would you like to come out and see him? Si. Well, come on. No. Please go away. Dale, you suppose there's somebody inside with him? I don't know. He sure looks scared. Pedro, is somebody in the house that you're afraid of? No, no. Pedro, listen to me. The man your father was working for are not good. They're bad, bad, muy mal.  Si. Your father asked me to come here and get you. We want to take care of you. Find a good home where you'll get good food and go to school. Dale, when I break past him, pull him out of the way and duck back. Right. So you see, Pedro, we want to help you. I've got him, Roy. Good. I've got this, hombre. Enough. Enough. Dale. Yes, Roy? Look here what I found. Mr. Merton, Mr. L. B. Merton. Or should I say Mr. Smuggler Merton? No, Roy. You've got it wrong. I'm not the one you want. I'm only... Look out! It's too late. He's gone. Roy, Mr. Merton's been shot. Yeah. Senior Rogers, senior... Well, what is it, Pedro? This man you asked me about before, senior Simmons. Yes, Pedro. What about him? He's in a carbon two miles from here. Roy, seek. Good boy. Can you show us how to get there? Oh, see. Well, come on then. We haven't got much time. Senior? Yeah. Could I... Would you allow me to ride with you on Trigger? I'll say I will. Oh, senior, this... She is the most happy day in all of my entire... whole life. There, senior. Okay. We'll trigger. Oh, buttermilk. You and Pedro stay here, Dale. I'll circle around back and try to take him by surprise. All right, Roy. But please be careful. You must be kidding me, Roy. You mean to say that blind singer was the real head of the smuggling ring? That's right, Pat, except that he wasn't really blind. I didn't think he was when I saw him step out of the way and avoid getting close to bullet the day we went down to the sheriff's office. But what was all that shouting and those shots when you were going up to that cabin? Border patrol. They had the place covered, too. It seems that after I left the jail, that Miguel had a change of heart. He told the sheriff the whole story. Oh, what was the whole story, Roy? Did Charlie Siemens have anything to do with the smugglers? No, not really, Pat. Charlie was trying to go straight. But Pete Allridge, that's the singer, the fellow who pretended to be blind so he could move around the streets of Laredo and spy on people. Well, he met up with Charlie a few months ago by accident. He knew that Charlie had a prison record, so he threatened to expose him unless Charlie let him cross over the border back of his ranch. Well, where did Mr. Merton fit in? He was the fence. He disposed of the stuff the smugglers brought over. Charlie agreed at first in order to protect Jean, but then he changed his mind, so Pete Allridge kidnapped him and kept him hidden in the cabin so Charlie couldn't tip off the border patrol. Then I suppose he had one of the smugglers dressed up like Charlie in a white suit and hat and ride a paint, so the sheriff would think that Charlie was the head of the gang, huh? That's right. Hey, Roy, you know I just thought of something. Yeah? I gave that fake blind man 47 cents. You think I'll ever get it back? I doubt it, Pat, but I'll make it good. Don't let that stop you from helping the poor and the disabled. You won't find one fake in a million. Say, Dale, how's Charlie? Well, he's a little weak from lack of food, but the doctor says he's going to be fine. And my papa? He's going to be all right, too, senior. You bet he is, Pedro, and so are you. We'll see to that. And, folks, that's the whole story of what happened to Dale and Pat and me the time we went down the streets of Laredo. As I walked down in the streets of Laredo As I walked out and ate I spied a poor cowboy wrapped up in white linen as cold as the clay I see by your outfit that you these words he did say as I boldly step by come sit down beside me I was shocked in the breast I'm a young cow Folks, here are the mellow men Chassis The body And the engine to run The body And the engine to Dodge is easy to load Find a truck on the road Check the features And you'll set off today The words of that little tune sure tells the story, folks. Working on the ranch, my Dodge truck has certainly been a better deal for me. Honest, that Dodge is so downright big and powerful yet so easy to handle that I just wouldn't want any other truck. So see your friendly Dodge dealer for a demonstration and make it mighty soon. And then it's behind the wheel will prove Dodge a better deal. Well, that does it for tonight, folks. See you next Thursday, same time. Until then, goodbye, good luck, and may the good Lord take a liking to you. Happy trade! Troy Rogers Radio Show has produced under the supervision of Art Rush and directed by Ralph Rose. Tonight's story was written by Ralph Rose and Stanley Adams. Music arranged and conducted by Frank Worth. Production assistant Virginia White. Tonight's all-star cast included The Melo Man, Virginia Gregg, Peter Votrien, J. Novello, Frank Nelson, and Bill Johnstone. Join us again next Thursday evening at this same time when the dependable Dodge Plymouth dealer in your neighborhood will again bring you the new Roy Rogers Radio Show. This is Lucrosby speaking for the man who sells and services Dodge job-rated trucks and the elegant new 54 Dodge.


Welcome to Microterrorz, scary stories for kids, where it's always the spooky season, full of chills, thrills, and spine-tingling spooks. Microterrorz are family-friendly frights for those ages 8 and up, and while our stories are for younger years, we are still talking about things that go bump in the night, and some children may not be able to handle what others can. Parental consent is recommended. Now, for tonight's Microterrorz. Dead Mist As our quest for candy dwindled to just a few scattered homes with their porch lights still on, I decided to call it. I could tell my younger brother was getting tired from walking around the neighborhood for the past two hours, and my friend, Frasier, seemed to be losing interest in the whole thing anyway. That didn't surprise me, though. He barely even dressed up. Old baggy clothing and some black paint around the eyes passed for a costume these days, I guess. My younger brother Levi, however, did go all out for Halloween with his costume. The little guy loved Halloween, but his slowing pace and occasional size let me know he'd had about enough of it. I put my hand on Levi's shoulder.  I asked him. Yeah, Levi sighed heavily. My legs hurt, and I'm tharving for one of those massive Clark bars we got from Mrs. Crane's house. Clark bars? Frasier scoffed.  Clark bars are for old people. I sneered at Frasier. What was that even supposed to mean? He had some nerve trying to put a damper on Levi's candy craving. If Levi wanted a Clark bar, then Levi could have a Clark bar. He wants a Clark bar, Frasier. I snapped at him. Frasier gawked at me, confused by my aggression at what would have normally been a very mundane comment. But what he didn't realize was that I knew something about him, something that made my blood boil, something that cost me a great deal of misery over the last month and a half. It doesn't really matter, Levi whined. I just want some candy. Let's go home. Soon, I said, I just want to make one last stop. Where? Frasier asked. Dead missed pass, I whispered in a purposefully creepy way. It was Halloween after all. Levi gulped nervously, and Frasier stopped walking along the sidewalk. What do you want to go there? He asked. It's Halloween night. The ghost train is said to cross the bridge every Halloween night at nine o'clock sharp, I said, checking my watch. We should get moving. But I want to go home, Levi whined again. You can eat some candy on the way, I enticed him. That ghost train store is just an urban legend, Frasier said. I smiled at Frasier. Then you should have nothing to fear. Come on, it'll be a cool Halloween thrill. Frasier finally gave in, and with Levi now eating from his bag of candy, he was no longer in a rush to go home. After leaving the neighborhood, we entered the adjacent park. The trail we were on started off freshly paved and gradually devolved into dirt as it entered the woods. If eventually becoming nothing more than matted-down vegetation. The vividly bright moon served as our only source of light and the constant sounds of animals like crickets and owls surrounded us in a cold night. An eerie atmosphere for sure. It fit the holiday perfectly and added a darkly appropriate ambiance to what I had planned. If getting spooky out here, Levi said, I sensed that his preoccupation with his Halloween candy had run its course, and he was now going to be whining to go home. But we couldn't, not before we reached dead missed pass. I don't see why we're coming out here. Frasier again voiced his distaste from my little excursion. Don't you want a genuine Halloween scare? I asked him. Sure, but with something real, the ghost train isn't real. He insisted. Oh, but it was real, I thought, and it was going to teach my friend a lesson. I checked my watch and saw he was 855. Frasier was only 5 minutes from seeing how real it truly was. The legend of dead missed pass started over 100 years ago, when an old tiny steam locomotive, one that ran on coal and the blood and sweat of its operators, was carrying more than a dozen criminals across the state. The bridge in town, originally called Misty Pass because of the heavy fog that would normally settle beneath it, became known as dead missed pass in the years that followed, because on one fateful Halloween night, the train derailed and plunged from the bridge into the misty rocky terrain below. Every Halloween since, the train is said to cross the bridge, carrying the souls of the original criminals as well as any others it picks up along the way. The three of us made our way up a tall, uneven embankment and finally reached the top. Below us was the jagged ground where the train was said to have plummeted, but beneath our feet were the old tracks. The wood was soft and warped, the rails rusty and weak. We cautiously walked the tracks, Levi and Frazier, following my lead, until we were on the bridge. The railings on either side of the single stretch of tracks were broken in so many places that even the slightest misstep would secure our certain doom. I could tell Levi was scared. He unknowingly grabbed onto my jacket and hadn't let go since we reached the top of the embankment. I placed a hand on his shoulder and gave him a warming smile, hoping he would trust me. Okay, this is definitely a thrill, Frazier trembled, trying not to look down. I don't think we need a ghost train to come through. Are you scared? I asked him. He didn't answer. He just kept concentrating on not looking over the railings. I checked my watch. It changed from 8.59 to 9 o'clock. I smiled. Any moment now. What if a train comes, Levi asked with a nervous stutter. Trains don't run on these tracks anymore, Frazier said. See how broken up everything is? Broken, I said, just like my trust in you. Silence surrounded us, save for the chirping crickets and a hooting owl nearby. Frazier turned around and faced me. He cocked his head. What do you mean by that? My Randy Johnson signed baseball, I said, the one my dad gave me, the night he died. You know how much I treasured it. What are you talking about? Frazier nervously asked.  You were always jealous of that ball. Frazier was speechless. He looked to Levi who let go of my jacket. In the distance, all three of us heard the haunting whistle of a train. In unison, we turned and faced the way we'd come onto the tracks. A ghostly thog began to form, veiling us from seeing anything coming down the tracks. Frazier turned to me. Are you accusing me of stealing your ball? I'm not just accusing you, I'm completely blaming you. That ball meant so much to me and now it's gone. You're the only other Mariners fan I know that has access to my house and my room. Frazier let out a harsh laugh. So what you planned here? Lure me up to dead mist pass and let the ghost train take me away? He laughed and once again turned his attention to my little brother. Come on, Levi, he said, urgingly. The train whistle blasted again, this time much louder. The tracks we stood on began to rumble rhythmically as if something heavy was bounding in our direction. Frazier spun around trying to see through the fog. His breathing picked up noticeably and he let out a series of small, nervous laughs. I had him right where I wanted him. A light dim at first, but then growing with intensity, glowed within the fog. I couldn't believe it. The ghost train was real and it was coming. The rumbling beneath our feet now made it difficult to stand.  The train roared at us. It was as black as night and veiled within wispy blue worlds, ghostly mist. I grabbed Levi by the back of his costume and pulled him down to the ground with me. Even though I knew it was a ghost train that would only take criminals with it, in this case a thief, it was still a gut reaction to dive to safety. The train roared over us and threw us, rattling the weak boards and rails we took cover on like an earthquake. I heard Frazier's screams fade away into nothingness. A small smirk crossed my face knowing that the deed was done. The thief who stole one of my most precious possessions finally paid for it. The harsh winds from the train began to slow and the haunting swissle from the ghost train echoed further down the tracks. Calmness now reigned over dead mist paths. Enjoy your eternal ride, I uttered to myself, speaking out to Frazier as an after thought. I stood to my feet watching the ghostly mist on the tracks fade. But in the fading mist I saw the silhouette of someone. I squinted at them as the swirling haze evaporated. Frazier stood there, his back to me frozen in fear. For Frazier? I called out, my voice carrying across the tracks. He turned around, stunned in disbelief at what had just happened. What have you done? Frazier's voice quivered. I didn't know what to say. I truly believed the legend. The train was supposed to take him to take Frazier for his selfish crime. What have you done? He screamed, pointing next to me. I looked but didn't see anything. What was he talking about? But then I realized. A knot twisted in my stomach, teasing a sharp, nauseating feeling. Levi? Where was Levi?  Frazier screamed at me. I didn't steal your precious baseball! Levi did! He traded it to some kid at school for a shoebox full of Pokemon cards. I was speechless. I looked from the empty space next to me where my brother once was, and then back up to Frazier. The ghost train has a new passenger! Frazier uttered in a terrified and emotive tone. A final distant blast of the train's whistle sent a ripple of chills down my spine. What had I done? MicroTerrors.com is also where you can find us on your favorite social media, and even send in your own scary story for us to tell. Plus, you'll learn more about our author, Scott Donnelly, who has other horrors for both young and old. I hope you'll join me again soon, from MicroTerrors, scary stories for kids. Click the notification bell so you don't miss future videos. I post videos 7 days a week, and while you're at it, spread the darkness by sharing this video with someone you know who loves all things strange and macabre. If you want to listen to the podcast, you can find it at WeirdDarkness.com.