>> So this talk is about the two I'm tool I'm releasing called Veil-Pillage. It's the tool I always wanted on internal pen test.  Real quick, a little bit about me, I'm a security researcher and pen tester slash red teamer for a company called Veris group in northern Virginia, and I work for a subgroup in there called the Adaptive Threat Division. 
I'm a cofounder of the veil-framework, hash tag AVLOL. 
Our main site is veil-framework.com.  We kind of premiered our tool this year at Schmoocon 2014, under a talk called AV evasion frame work.  And the other guy that works on the tool work with me is Chris.  Hi Chris.  
So Chris and I co-wrote veil evasion.  I wrote veil catapult which I'll go over in a little bit.  I wrote a Powershell post exploitation situational awareness tool called veil power tool.  We'll talk about a couple of the functions that are applicable here.  And I wrote a window's (indiscernible) show called power up.  Active Cortana and NovaHacker.  Kind of the overview of we're going to go through today.  A background on the frame work A. Genesis on how we got there and the thought process and the various components. 
And I want to go over a few quick slides on post exploitation.  Kind of let everyone know this is the exact realm of the assessment cycle that we're operating in. 
I'm going to go over veil Pillage.  And feature sets and a few interesting current modules.  There's 59 of these so I'm not going to sit here and go through every single one.  Don't worry.  I will then come back and talk specifically about some of the functionality that deals with hashdumping and plain text spread covering.  Demos a few videos.  So I don't have to pray the demo gods so nothing would break.  I'll wrap up talking a little bit about KB 2871997.  A Microsoft pass the hash patch.  We'll see if that stops that much. I'll finish with going over a few of the upcoming module releases and how you can develop your own functionality for this frame work.  And then I'll recap a little bit.  
The veil frame work.  Is anyone willing to raise their hand who might be using the veil frame work for veil evasion?  That's awesome.  
Our kind of branding for the tool set is we want to bridge the gap between testing and renting capabilities.  So it started with the release of veil evasion.  veil originally titled veil.  Later renamed veil evasion.  We released a few more tools since then that I mention.  
So the original motivation for this first part was our back door's were being caught by AV.  AV started to catch up.  So we built a modular framework that generated AV-Evading executables.  So we have a variety of shell code injectors and higher level of pure Meterpreter stagers with that same logic translated into a higher language like power shell and pi THON.  We debuted at Schmoocon 2014 with AV evasion with the veil frame work.  We're excited.  
Kind of how Pillage came about.  After dealing with AV evasion, our focus moved toward payload delivery.  How do we get it on our target machine?  Also released was a small tool called veil catapult which tied in with veil evasion that can up load and trigger executables and ‑‑ ‑‑ and do a UMC hack back and I'll go into more detail about that.  And a few common tricks like everyone's sticky piece back door.  The thing with that is it's kind of screaming for a more generalized post exploitation structure.  And the attack cycle is my nifty little graphic and you have your basic recon, enumeration.  Pillage doesn't deal with exploitation and numeration special specifically with the initial part of the assessment we're entirely operating with the post exploitation component.  I'm not going to go through all of these.  The slides are online.  Our slide share via our frame work.  This is a more granular way of breaking down these exploitation actions.  The big point here is we want to demonstrate impact.  If we have a relatively short engagement, we don't want to waste time scripting stuff up all the time or rerolling back doors and that type of stuff.  We want to maximize time we can demonstrate impact.  

So exploitation stuff in plain English.  This is one way to interpret it.  If you have access or credentials to one or more machines in the net work, what can you do?  You can execute a command on the box what kind of nastiness can you kinda tell.  Kind of a quintessential example, local administer hash or several remote hosts on a network.  And you want to grab plain text of all the users logged onto the host.  How would you go about doing that?  One option is using Metasploit.  Connect to the box get a section install an agent.  The advantages of this are its very flexible and powerful.  You can utilize the entire Metasploit frame work around all those awesome extensions, all those awesome post modules some of the draw backs are service running the systems created.  So that can create noise or logs and dis.  And there's a lot of nonstandard traffic when you're staging an an interpreter.  If the client has more in depth network filtering detection, that might get you caught.  Also known malicious binary dropped.  You can throw in custom things, but you're still touching disks.  
Another option is to use the tool SMBexecs to upload and execute a WCE binary.  (Indiscernible) files after.  
If advantages are, you don't need to establish a full interpreter session, and it doesn't rely on the Metasploit binary templates.  But, system level service is still created and known malicious binaries are throughout the disk.  If you have a static binary that's touching disk, it's pretty easy for AV to write a static signature for it.  
Another option is using the PASH and hash kit.  Awesome projects.  The advantages are, use WIMS, no service is created.  It's quiet.  Also no binary's dropped to this if you're operating purely in powershell.  
Draw backs, it's incredibly powerful tool set, but the usage is not always is simplest.  People who play with this it, there's a variable entry.  There's got to be a way we can weaponize this a little bit easier.  
What if power shell's disabled or not installed.  And the key here is all these options might work in certain situations, but often not every situation.  
The kind of what I envisioned we wanted in an ideal tool is a lot of trigger options as many as you can have.  
We use Win EXE. WIMS. SMD impact.  We also want really good modularity to where you want it as easy as possible to implement additional exploitation act.  We want other tools to integrate with ours.  You can run a module and drop it in.  You want this to be as flexible as possible.  
And also completeness.  It would be nice if there was full automation and comprehensive log in and clean up.  We want to know every single host we touch and what they did.  And we want a way to repair that very easily in the ‑‑ I'll go over the (indiscernible) enough stuff and go over that later.  
My tool, Veil-Pillage, is the next iteration of catapult.  It was kind of the genesis of it.  
The primitives that it's built on is using the pass in the hash I mentioned.  ‑‑ ‑‑ doesn't create a service.  (Indiscernible) the equivalent of PS exec.it runs a system of binary DRO.  Something that touches disk but not working.  Also use S and P impact.  Everything is extracted out to library methods.  So when you're developing your module, what's the syntax for this and that, you can drop stuff in and use it on library.  
I'm going to be building this diagram up of all the components of Veil-Pillage.  These are the primitives that the entire frame work is built on.  
So veil catapult, these are also catapults that, security essential castles.  All the demo machines recorded on.  And it still didn't catch anything a year later.  
So all of catapult's functionality has been modularly integrated.  The EXE delivery, the powershell injector, the python injector.  I'll talk about in a few slides.  And everyone's favorite sticky keys. 
The catapult will now be obsoleted.  We recommend everyone use pillage because it's a lot more flexible.  A close up soon on transitioning and the difference between the two tools.  
And so yeah, I think catapult's cool, but those are a little cooler.  EXE is core original function for catapult executables can be specify.  Or you can take advantage of seamless integration.  While shown the demo, you specify veil, it'll drop into the exact same interface.  You can roll up all the options you want and drops right back to the veil interface.  So the seamless as I can make it 
And triggered with a UNC backpack.  What's this?  
So. 
(Laughing)  I help create the veil frame work.  And there's a veil vodka we found.  So that's my shot.  
>>	No no keep talking. 
>>	Okay.  Keep talking.  
So the UNC location.  You stand up and kind of host the file temporarily on an SMB server that's set up and torn down transparently.  When you trigger it, that's EXE is loaded straight on a memory into host.  This gets some otherwise disk detectable EXE's right by antivirus.  If you want to see a demo of this, check out our schmoocon presentation.  The slides and everything is online. 
The python injector I mentioned.  
This take a strip down python environment in the strip and upload it to the host.  
>>	Ready?  
>>	Okay.  First time Speaker DEF CON.  Have a little love.  
(Applause.).  we've got the veil vodka for the veil tool.  
>>	Thank you.  
>>	You're the first speaker to provide your own shot.  By the way, that bottle is big enough for everybody in the audience.  So if. 
>>	If anyone want AS shot after, come talk to me.  I'm not going to drink all that. 
So the python injector.  It'll upload the python zip and unzip the entire thing to disk into a temporary file.  And then it uses a dash D option with python EXE to ‑‑ ‑‑ straight to memory.  
So this is basically a analog.  It's very similar to power shell injection that a lot of people are familiar with.  
So what's nice about this is the only files that touch this are the trusted python libraries and the trusted known python interpreter.  So this can help you get by certain types of reputation filters.  Saying oh I didn't have I haven't seen the EXE before, I don't know if it's bad but I'm going to provide additional protection on it because it's unknown.  And also, when you want to generate shell code, it'll drop right into the the veil evasion too.  So just like one little line, you don't have to do any kind of heavy lifting.  
All kind of veil functionality built in if you're going out. 
So the fun stuff, new modules.  
Enumeration.  So you know, if you have ‑‑ if you scan your net work with Medusa or incorrect or something like that, I think these credentials work in different places, this will verify if you can connect to the box.  It connects them.  Tries to create a temporary folder and immediately delete it.  It's a little bit more accurate and a bit more slower.  
So scan and use this.  
‑‑ ‑‑ User hunting is a very common activity that any pen testers I'm sure do if you have credentials that work on lots of machines.  You wanna find okay a high valued user logged in on the network.  You use this, it runs through a few boxes it works on.  Validates, and it'll pop.  Saying -- is here here here here here here here.  Or if you want to do some kind of basic host enumeration reactions, it's the arch table, do the interfaces, that type of stuff.  
Management, occasionally, if you're an internal test, you might want to do enable disable UAC or RDP.  Actually showed this in the demo.  If you have net work level access on the chain, RDP may not be enabled.  Maybe you want to set your sticky keys back ‑‑ there's certain actions.  Also you might, in certain situations need to force users to log off, reboot the machine, shut it down.  To trigger certain post exploitation actions.  
This is fun, persistent stuff, everyone's favorite little fun activity.  We can throw up the bits in the back door really easily.  To schedule a download job for an EXE.  Sticky keys, it ‑‑ ‑‑ stick key keys binary.  So it sets the bugger.  The box for the system pops up before you could log in.  
Little bit of a lesser own one.  UNC hijacking.  If you append a UNC path to a packing variable on a machine and that machine reboots, system services or services and programs and stuff when they start up will actually look to that UNC path for dll's to load.  So I have a tool in here under slash tool that is you can bring it up and it'll scrip wire shark and hijack opportunities. 
You host up a malicious DLL from your host, and you have your persistence.  
Powersploit ‑‑ ‑‑ weaponization.  
So my solution is I'll set up a temporary web server and I trigger everyone's little favorite download string.  It'll trigger that, re inspect your tacker box, running memory.  Now click files out put.  And then I run and grab it and clean everything out.  
So this makes it really easy to run powersploit across a large number of machines when you're on engagement.  
There's also clean up to kill off all the processes and stuff.  
Now this is really kind of the meat of the tool, all the modules and Powersploits stuff and enumeration stuff and those types of things. 
So here I'm going to go over a few of the new features I integrated in. 
So last month the veil team released a custom written higher level powershell stagers for Meterpreter.  Reverse https.  These don't utilize shell code and they work great in the passing the hash tool kit.  That shell code can't be decoded from a file or something like that.  Because it's not being run.  There's also X86 and 64‑bit compatibility by default.  You run this stuff, and then choose the correct string to inject, it'll choose the correct power shell binary to use for the injection.  
Output and cleanup, like I said, we're pen testers.  We really like to have everything logged.  We want to know exactly what happened if something goes wrong.  Our client wants to know how we got into somewhere.  These credentials were used on this box for this action.  So Pillage has a universal activity log it also breaks it out by modules.  So everything host and everything is broken down and time stamped.  And also clients are pretty picky.  They don't like malware.  They don't like you leaving malware around the networks. They don't like stickykeys backdoor On a hundred machines.  So every single action veil pillage can execute, has a reciprocal cleanup action that's output to a script.  So universal cleanup file and cleanup file for module.  You can type Cleanup give it the file or pull the universal file and clean everything up and remove any files and all that stuff.  I'll show that in the demo. 
Random features, state preservation, if something crashes, you can always rage quit with control C.  All the options are preserved.  The current module that you're operating under is dumped right back to.  All your targets and credential sets and options it's all preserved.  When you start it up it'll prompt you do you want to restore this initial state?  You can save those off and rename them.  There's also Metasploit back end database interaction.  Right now it can pull in any credential sets or targets from a Metasploit back end and you can add those into your target.  A common thing we can do is SMB log in ‑‑ ‑‑ 
Every single thing will be tab complete able is tab complete able, cause I've had to type through this stuff so many times.  There's reasonably robust air check.  There's complete command line options.  And just a really big UI focus.  

Pillage contains complete command line flags for every option you can set in the frame work.  I Script up other tools beneath mine a lot of the time.  I want people to be able to integrate all this functionality.  So Veil-Pillage SH.  It's really small but there for every option.  You can set at targets, clean up stuff, state restores, veil evasion options, all these types of things.  
So that's kind of the last part of veil Pillage.  
We have the features and icing on top.  And the modules on part of it.  The functionality and primitives and all the good stuff. 
I'm going to back up just real quick.  Some of the interesting core modules for hash dumping and plain text graphing.  
The hash dumping.  There are a verse number of ways to dump hash on a system.  A lot of traditional ways is dropping a binary.  Deal with that is, AV start today flag or write signature should be static tool.  So we don't always like to drop stuff to disk, you could get registry backups w/ reg.exe pull those files down.  Or you can get a Meterpreter session, do it a little bit manually do a hash dump, wdigest and all that stuff. 
Some of the new hotness, power dump strip.  You can hash dump using power power shell.  Using WCE and Mimikatz binaries.  And also, the power split project has Mimikatz integrated completely in power shell.  Which I'll go over completely in a few slides. 
The thing, like I mentioned with hash company, different actions work in different situations.  
So if you want a universal solution, you need to expose all those options.  But maybe you can automate some logic.  Depending on architecture, Powershell Installation, AV installation can affect what they might do.  And some of these like I mention involve dropping a well known close-sourced tools to disk.  You want to always have options to fall back.  We like staying off of disk as much as possible.  Mimikatz, I saw your credentials, Mimikatz stickers, (indiscernible) is actually right here.  Thank you for Mimikatz.  
Mimikatz and power shell is incredibly awesome.  
It utilizes WLS fire work with reflectivePEinjection to inject an architecture appropriate Mimikatz DLL into the system.  This is just awesome you can harness the power of Mimikatz without having to touch the disk.  You can do all that fun stuff. 
So for Pillage, all these users are exposed as modules. 
In case the users wants to force this for particular decisions.  But there's also modules called autograph that tries to build this in.  It'll check the power shell working.  Not even just if it's install.  But power shell command.  If you can, I have a combination of power dump and powersploit triggered with that web downloader.  If it's not, it runs a command to try to determine the architecture.  And host is x86 or 64-bit binaries with that SMB server and just a U/nC backpack.  Then it collects credentials and all unique lists and has all the raw out put as well.  
All right, demos, I'm not tempting the demo god.  So this is starting at veil Pillage.  I'm going to show a little bit of the interface.  We have our version up there.  Right now we're 1.0.0.  We have the site.  We have the number of modules released or loaded.  In this case it's 59.  I'll go over the release schedule soon. 
List is the command to list, either your modules target or credentials.  Set, you can set a single target.  
You can also specify a target file.  So if you have a giant list of targets from a tool output, targets being set.  I'll show resetting the targets if you want to just clear it all out.  
This is the best way back into stuff.  So the DB list targets will clear the database.  It doesn't do a live link to the database it'll do a query and then I can add pull in that static set and choosing separated and it'll set that in an internal state and Pillage.  
So then I think I'm going to show how you use a the database interaction to actually set the credential sets.  

See this is output from successful SMB post log in or post module or enumeration module.  So DBi creds can become separated.  Set all those up.  Administrative and hash.  So now if you just type list or list module, see Powersploits, persistence, payload delivery, impact and stuff enumeration this is the module that had a little bit of logic built in called the autograb.  Here are all the options available for this module.  The other way you can invoke it is say using the number and use and tab complete and it'll tab complete out the entire trip.  So I'm setting an option for the reach back.  You can set SSL for HTTPS something like that if you wanted.  
So I just press control C so I just rage quit out the entire thing.  It'll prompt the state ones to be restored.  Or right back in to autograb.  All the options are still set, all the targets are still set.  All the creds are still set.  
I'm going to run it.  It's going to prompt me to confirm.  
On that background defective power shell is installed on the first host.  HTTP server.  You see the Get actually coming back from that host, you don't have to configure the server or anything.  Making it as easy as possible for the user.  Killed it off.  Gives it a few seconds and when you're playing around with L sats it might be just take a little bit.  
Move on to the next host.  See Powershells installed again.  You're going to set up that same server, reach back, you know with the different little randomized script name.  

So all these modules will have an output file.  You can also display that out put immediately when you hit next.  All the unique cashes.  Unique apply to a nice list.  The raw out put is going to be under the autograbber spreads.  It'll show you the raw out put file and the host in the time stamp.  So there's that one the host, you'll see the autograb.texy.  All this stuff for veil is out put by Veil output.  For veil Pillage, there's activity logs.  It'll start building up.  
If you go into the the module folder, it'll be split up with that initial out put file in the time stamp we saw.  And also it'll show the raw out puts.  So there's all the nice raw MimiKatz output.  

Now, show some power sploit.  I think I ‑‑ I'll shed the list targets again.  
And we're going to upload these demos to the veil frame work YouTube.  We'll tweet out a link or something about it.  So all of the nice powersploit modules.  I'm going to use both invoke shell code MISL and use them, neat little.net reflections to execute shell code.  I still have all my al hosts and stuff.  And set, and one thing here, in this one handler, you set it to true, we'll autospawn you to hand learn in the background.  
You see here, we're dropping straight evasion for veil shell code evasion.  You're not having to script up stuff and facing them.  
If you're more interested in in the evasion functionality, check out the smoothcon talk.  
I'm saying all the options for windows interpreter TCP.  
Autolaunchers a handler.  All the options are preconfigured.  
Make sure it runs.  when I hit this is the same kind of thing just like with the autograph.  The host is reaching back and scribing that power shell snippet, running a memory to an out put file but then it goes in the graph.  
So there are all my interpreter sessions proving I'm not a liar actually as an interpreter.  
Now, if there's a clean up file or there's a clean up action associated with the module, showing output first exactly what was triggered where, this, we're going to invoke the global clean up file.  You could have specified the global clean up file.  Is it going to run through?  It's going to kill everything off.  All your sessions are dead.  So everything's back out to out laws.  
Last one, sticky keys.  See all the resistance options, adding users, main groups, UFC stuff.  Stick key keys.  People have used the sticky keys.  There's no reason we can't up load our own binary to set that to be the bugger.  So why don't we generate a stager to set that to be the sticky keys trigger.  This now is dropping into the the full veil evasion menu.  We're going to use our python tripper reverse CCP.  It's just kind of that logic from the shell code translates to a higher level language.  into a pyinstaller executable here.  
All again in the background, I remember having to do this manually back in the day.  It wasn't as much fun. 
That's our output.  veil evasion.  Press enter and we're dropped right back into veil Pillage transparently.  This is up loading that payload file and naming this sys update.exe and uploading it to C:/ Windows.  We have our out put again showing our binary.  Show exactly where it's uploaded using more credentials.  And I'll say, even though we can reach that host, we can't actually RDP it, because it's disabled.  
So I can use some of the management functionality, to actually enable RDP stuff.  It'll set the firewall rule and all those types of things.  Output again.  Firewall accept ion already enabled.  Let's try RDPing again.  We're not even having to log in.  We have our handler in the background.  Press shift five times and we get our Meterpreter session.  
(Applause.)  This is a little nicer because if you just leave the regular sticky keys up and anyone can connect to it.  With this, at least control the IPs connect back to the state.  So I'm going to go through clean up manually.  I'm going to go through both parts.  Both able the sticky keys.  I could show you the clean up and repairs but I can show two steps.  Specify the clean up file.  I could have passed this command line.  So cleaned it up.  
Shift five times and sticky keys is back.  And binary's cleaned off.  No artifact left on the machine.  The second clean up file to redisable RDP.  The box is exactly how it was when we first got to it.  

Nope, can't RDP anymore.  
So again, this isn't rocket science, but it really simplifies being able to weaponize log in techniques.  
All right, let's talk about KB 2871997.  The oh my God us pen testers don't have a job patch.  My boss freaked out.  It's not that bad.  It's pass the hash patch AKA the MimiKatz KB.  It's a Microsoft backport of a lot of window's 8.1 security protections.  It does stuff that makes it difficult to pour creds of veil pass.  But the thing we care about in this context, it contains this line that TO say this patch prevents network log on and promote interactive log on using local accounts.  
The reason this sounds ominous is because this how you almost always spread laterally.  You've done local admin hashes.  You pop all your boxes and find your high value users.  
This is a screen shot of the Microsoft advisory.  Originally titled update to fix.  Someone yelled at them and a few hours later is now update to improve credentials protection and management.  Someone luckily caught this.  So is this actually a patch?  We're pass the hatch.  No.  Even though they claim local accounts on the box in the local administrator's group you can no longer patch the hash with.  As usual, the head 500 account which is the default administer, you can still pass the hatch with it if it's enabled.  Window's 7n by default will disable this, but we've seen this rid 500 still enable the a very, very large number of enterprises.  The reason is backwards compatibility.  And security management and things like that.  Also domain accounts and administer's local group can still patch the hatch.  
If you have the plain text for these local administrator accounts you can use powershell removing RDP you need a plain text.  You might be able to crack or GPP.  Obviously XP and window's 2003 aren't affected.  Pop the hatch is not hatched is not going away anytime soon. 
One of the things I realize I'm looking into this is it would be really nice to know what that rid 500 account is named in the remote machine.  Whether it's enabled and what domain user accounts are in the local group for administrators.  

Luckily using the power shell, the most basic domain account, using no privileges whatsoever, you can use this neat thing called WinNT service provider to pull all of this information.  You can get the full said for the admin account, whether it's enabled disabled and all of the domain users in that local group.  You can also use ‑‑ if you have an account, again, this you can't use in like old sessions or something.  You can also use the M map scripts, SMB groups and SMB users.  All these power shell functions have been integrated in the power project.  So there's one function you can grab them from a single host.  There's one that will query AD at every single machine.  That's sortable.  Telling you every single host, every single local admin and all that stuff.  There's more information on my blog humjoy.net.  
A few last things.  So module releases we have something called V day.  We released at least one new payload module.  For pillage, the plan is for at least a few months try to release at least one new post exploitation module on the first.  It'll be at the Gethub which I'll check at the end.  veilframe work.com for dates.  
For module development, I want you to be able to implement whatever post exploitation fund you can think of.  
All the triggering methods, the file down loads, all available as library methods, you don't have to configure them or remember the syntax.  There's a module template included in the tree.  We're going to have a blog post up on how to develop them if you are interested if you do, please send a full request.  So quick recap.  veil Pillage is a flexible frame work for post exploitation for target machines on an internal pen test.  There's three separate ways from triggering.  New modules are really easy to implement with the common library.  You can drop them in the tree.  That enumeration folder and everything's split up and it'll load it right up for you. 
There's a lot of automation, which complete full lodging capabilities.  Complete full cleaning capabilities.  There's a really big UI focus.  This isn't some random script they wrote a month ago and dropping for DEF CON.  It's 30,000 lines.  There's 150 internal on Gets, we've been testing this out for a while.  I'm sure there'll be bugs.  The code's up live.  I'll have it at the end.  Please report bugs.  I want the tool to be as good as possible.  
So my real quick Shameless sidebar testing.  You know, hit me up by e‑mail offline or talk to me later or come work for us.  You're an awesome team.  And that's it.  
(Applause.)  Any questions, hit me up on twitter… @harmj0y  Humj0y at veil-framework.com.  I'm on Freenode a lot.  Veil-framework.com.  Personal blog, humj0y.net.  Stuff that doesn't directly relate to the veil framework good complete write up for complete pass the hash stuff there's a really complete article with screen shot examples.  
If you want the veil-framework, go to GetHub.com/Veil.framework.  There's also a veil super project, where you do veil frame works slash veil.  Run the set up, it'll install all the dependencies, download all the necessary stuff for colleague which is the platform at this point.  It does this all transparently and pass the hash tool kit and all that type of stuff.  And hopefully everything should work nice together.  Any questions?  That's it.  

>>	(Inaudible). 
>>	I do not have pass the ticket yet.  I heard about it just two days ago.  We'll see if we can get that in.  But I think with the Mimikatz in powersploit, because that all the functionality there, it shouldn't be too hard to set up.  You won't do it directly from your Kelly box.  But you can essentially kind of pivot that functionality on that target booth.  
>>	(Inaudible). 
Umm so, for us, if you're doing read teaming. 
Sorry the question is, value in exploitation, oh low medium bone scan type things.  Everything has its place.  People need to run bone scans to get the low hanging fruit.  But all the attackers are doing post-exploitation.  Red teams and stuff and all the ports you see, that's what they do. A lot of tests, I'll get a basic user account once I get there you know. It can just be a few hours to domain admin, their using things that will not apply for (indiscernible). 
Okay?  I think that's it.  Anyone else has any questions I'll try to be out there somewhere in the chill out room in a bit.  
(Applause.)