7MS #746: Claude is Really Good at PowerPoint

Speaker A: Ah, yeah, you know, security is hard, so let's assume we're probably gonna get honed by noon. But if we all, uh, start to get the basics right, we might not fully get honed until tonight.

Speaker B: Hello, friends, and welcome to the 7 Minute Security Podcast. My name is Brian Johnson and I am your, uh, kind of optimistic, little tired, little thirsty, little itchy. I gotta tell you about that. In the tangent portion of the program, I gotta tell you about how I had to go to urgent care after playing a music gig last Saturday, uh, because of bites I received that worked me into an itchy frenzy so intense that I, without exaggeration, itched myself till I bled. But that's not the main reason. Usually people listen to this podcast or I do it. The main reason is to talk about security related stuff. And, uh, today what I want to tell you about is. It might be obvious to some of you, but I had a really good experience using Claude for a PowerPoint presentation. So this episode is about how Claude is good at PowerPoint and how you might want to use it for one of your next creative endeavors with some asterisks next to it. Okay, I think it's probably best if we just hop right in. So what got me primed to give Claude some creative liberties to make a PowerPoint for me is a few weeks ago I was meeting with my good friends over at Netricks about, uh, a webinar that they wanted to do, kind of talking about ad security nightmares and wanted to give it a fun Halloween theme and all these kind of things. And I loved it. And the narrative that we kind of laid out was talking about zombie computers, zombie data, uh, zombie, wait for it, users zombie data. I think it was users, computers and data, something along those lines. But basically it was going to be showing some of the common things we find as far as ad security that lead to pwnage during pen tests. So, like running a PowerShell query and seeing, oh my gosh, there's, uh, 20 people here who haven't logged in since 2023. And oh, their passwords never expire either. So if I take a look at some zombie data with Snaffle Pie or Snafler. Oh, look at this, an internal doc that says, you know, back in fall 2024, everybody who started at the company got an initial password of season year, exclamation. Okay, well let me use Rubius or something similar. Let me spray that easy to guess password. And look at that, I'm in six different accounts here. And uh, oh, look at that as I'm parsing through the Snafler data, there is a clear text credential in a PowerShell script that gives me local admin to one of the servers. I connect in there with WinRM and then I do what's probably my favorite trick in the book, which is abuse a scheduled task while a DA is interactively logged in and fire the task under the DA's context to make them do something high powered like add you to the domain admin group. That's super fun, that's super cool. And you don't need to know the DA's password to uh, pull that off. Okay, so we got talking about all that. We're like, yes, uh, go team, hands in the middle, let's go start developing our content decks. Now for the Netrix presentations specifically, I really, this is not like a, uh, brag. I'm just saying I work really, really hard on those. I like to tell my part of the content with pretty much nothing but movies. So I'll get out Camtasia, I'll record my screen in the Goad lab, you know, showing a thing and then I edit all the typos and stuff out. And I even go so far as to doing zooming and panning so that for example, if I'm going to show something at a net exec screen, I zoom way in and show the NXC space, SMB space, blah blah blah, and I slowly zoom out or I pan to the right to show the command getting typed in. And then when all the many lines of logs dump out, I zoom out so that, that's easier to see, you know, from a backed out perspective. So it's a lot of hours of editing but I would much rather do that than try to put together some pretty static slides because I get overwhelmed by the by that I just don't think I have an eye for it. Like, oh, I'm going to make this nice rectangle with uh, a Netrix red in the background and then I'm going to have a shadow on it and little border and then this text because I change my mind too much and I get overwhelmed thinking, oh my gosh, I'm going to lose so much time if I have to tear this slide down. And yes, most decks, like the Netrix vanilla, uh, deck they gave me, um, it has some of those, you know, if you want to have a slide with three bullets, this is the one and if you want something with a pie chart, this is the one. But still long way of saying I would rather Tell my story and my content with movies. All right? And the way we usually do that in the NetDrX webinars is I just share my PowerPoint, I share my screen directly and then I can control with mouse click or arrow tap when the movies, uh, uh, you know, when the animation starts. And that, from what I've seen, provides a pretty smooth video experience for the audience. Now, this time around, we were using a different platform that I've only used one other time with them. And what I found out during that experience is that the deck has to be loaded a little bit differently. Like it actually gets loaded into the presentation platform itself. So I'm not sharing my screen and sharing my PowerPoint directly. It's already stored up in the cloud. And then we just have little left and right buttons that would essentially control, you know, the advancing or backing up of slides in, in PowerPoint. And, uh, my notes from that presentation a few years ago was there was something, I don't know, maybe there's something about the number of hops that content has as it gets streamed, but the video was really not great. Uh, and the general advisement, um, coming out of this planning meeting was, you know, we could play like individual movies if we loaded them as individual movie files into the presentation platform. But then I think you're kind of backing in and out of PowerPoint and in and out of these movie files and it just seemed like, uh, this, this has a high to me. It's not so much tempting the demo gods, but this is just a configuration that feels like it could go south with lots of delays kind of, you know, turning on and off sharing. So me and my co presenter just decided we're going to do traditional slides and picks of things. And so as I sat down to put that content together again, I just found myself overwhelmed where I'm like, man, this blank canvas of, uh, PowerPoint and trying to make it look aesthetically pleasing. I don't consider that a core competency of mine. Uh, so I, I went over to Claude, started a new project with a new folder in Claude, and I said, hey, let me feed you my notes from a presentation I'm working on. Let me also give you this vanilla PowerPoint deck that I have from my vendor partner and why don't you work up kind of a alpha version, uh, of what you think this, you know, could look like. And it chewed on that for about five minutes. And I'll say, it put, it put together a pretty decent alpha, but some of the things were really not aligned right and um, after it dropped that Alpha deck in my folder, Claude said, hey, I work a lot better and I can, I can sort of eyeball check my own work better if you install LibreOffice and a couple other things from uh, Python Pip repository. So I punched all that in and, and uh, then said, uh, okay, why don't you take a look at your early draft and see what needs to be tightened up. And then I'll say it moved like mountains forward in quality as far as things being symmetrical, um, placeholder images being the dominant focus and then text boxes and banners and footers in places that I thought made sense based on the, the you know, content that we started discussing. So um, I got thinking then about like, okay, I've got the bones in place now let me go, let me go do like the first part of the presentation. Let me show in my lab a, ah, PowerShell query that shows, you know, a couple dozen users, some of which haven't logged in a couple years and a bunch of which have passwords that don't expire. And I thought, okay, creating batch, creating a bunch of users whose passwords don't expire, that's not going to be too bad. Uh, but when it gets to the part about making it look like the user hasn't logged in since 2023, I don't know, you know, am I going to be able to, I'll probably be able to modify that effort or modify uh, those uh, attributes with ADSI Edit or something. Um, and then I got thinking, well, wait a minute, I can probably just run the query in the Goad lab, send the RAW output and the picture of the raw output to Claude and just tell Claude, you know, add an extra couple dozen users, have a good mix of people whose passwords, uh, or whose accounts haven't been logged into since 2022, 2023, 2024 and so on. Um, and it had no problem with that. And it marked up, you know, a PowerShell terminal with those commands being run and it looked, you know, fantastic. I mean you really would not know it did not come from an authentic lab. And then it was like, whoa, brain, brain, ideas cooking, uh, limits unlocking. When I thought, well, since this is going to be a Halloween themed presentation, why don't I, number one, tell, tell Claude to kind of review all of the color palette inside the, the Netrix deck and really lean into Halloween colors like whatever, blacks and uh, whites and reds and oranges, if that's the Halloween palette. And also why don't we just, going forward let's take any output that I give you from tools in my lab and let's give it a Halloween theme. So let's call it Halloween local. And when you're building this list of users who are stale and they're kind of zombie users that we're calling them, let's give them fun Halloween themed names like Fred E. Krueger and Jason Voorhees and Pinhead and uh, what's the name of the doctor that likes uh, to help Michael Myers? Have any of you been playing that Halloween game? That, that's really fun. But if you're, you're, the tangent is if you're on the Survivor team, the first survivor who dies, one of the other survivors can get to a radio and radio for help and Dr. Loomis comes on, on site and he's got a revolver and he's got a decent chance at taking down um, Jason but, or ah, uh, Michael but Loomis. There it is. Yeah. Dr. Loomis. Okay. And uh, so I sent that off and Claude had no problem just remocking up the PowerShell terminal to have Halloween, uh, local domain and all Halloween themed users. And then I'm just giggling to myself with glee going, I'm going to be able to do this for every other uh, major content block that I have to build here. So for example, the next step was demonstrating zombie data and I showed the Snaffle PI tool. Well what I did is I went into my goad lab, I ran the bad shares repo so that there would be a whole bunch of kind, uh, of bogus content, um, but that had sensitive data inside of it like powershell scripts with uh, passwords obfuscated with um, as plain text, you know, and web config files and SQL SA accounts and um, C password values from that MS.14 025 vulnerability. Um, but in my lab I really just had a few interesting findings. But again I took a picture like a JPEG of what the screen looks like. I also copied the raw content and I fed it to Claude and I said, you know, give this all a Halloween theme with Halloween named systems like uh, you know it made, it made uh, uh, what did it do? I think it did like Pinhead FSO1 and I don't know, Voorhees DC02. It was awesome. But I said I need a couple specific bits of data. I want a PowerShell script that leaks a local admin username and password and uh, you know, took some liberties and really made the log file look juicy. Uh, so That I had several points to talk about uh, during that particular slide. Um, but beautifully it uh, created a leaked, so to speak, local admin account. And then that Daisy chained me into the next step which was showing how you can take that zombie data abuse it, uh, get winrmed into a server with that local admin account. And then I showed my favorite attack in the world, which was the uh, well in this case it was wait for Jason Voorhees DA account to come along and then abuse scheduled tasks to make him fire a batch file that added low privilege Freddy Krueger into the domain admins, uh, group. And it just worked a treat. It was a joy. Um, and really like once I got everything in place, I went through all the major, you know, blocks of content. Then my editing approach was just look at the deck as it was. And then I'd go into the cloud prompt and be like, here's some feedback on the slides. One, make the picture more dominant. Move the header up if you have to. I really want to maximize for readability and uh, what is in the picture. Um, and uh, you know what was nice about it rendering the graphics is that it could um, for example, I think it was on the Snaffle PI output there were so many log files shown at the bottom that it was just the image was too big vertically. So I said um, we'll just chop out lines 1, 4, 7 and 13 of the log because those I don't want to talk about. And then that shrunk the picture vertically and made it, you know, fit better. And then I could say knock the font of everything up, uh, two points on that slide. And then I would say, you know, okay, great. You uh, know the next iteration would be great. I think we've figured out 14 point font is great for any text in the sidebar. And then maximize all remaining pictures the same way you did on slide one. And so we went through about four or five rounds of edits. But it was like something I could do while going back and forth with pen tests and other things. And yeah, it made me giggle with glee. Now I am having a sort of a. I, uh, don't know. I'm uh, always conflicted about AI constantly. I feel like I'm a hypocrite where, you know, I'm hardcore addicted. I'm using it all the time. And then some of the conversations with clients are like, well, what about environment? What about the fact that you're probably taking a glass of somebody's drinking water away every time you ask it? A Question about net exec. And I just go, ha. I'm, uh, uncomfortable with this conversation. I don't know how I feel about those things. Well, I know that. I feel that I don't want AI to eat up all resources, uh, in natural resources in the world. But I'm also, I don't know, it's tough. I'm, I'm doing a job. I'm trying to keep up. I feel like if I just go, I'm a purist, I will not use AI at all. Then I'm going to be doing things the manual and hard way and just not going to be able to be, you know, current and cutting edge and understand the security implications and this and this. I mean, I think, yeah, we can have that discussion another day, but I think AI is probably here to stay, so it needs to be reckoned with, uh, one, one way or another. But I was just seeing on, on my feed, uh, there were some, some musicians, some artists that were hardcore making their case for do not let AI do anything creative for you because it steals from everybody else. Which I agree with in some cases, or maybe in a lot of cases if, if you tell it to generate an image or a logo perhaps. Right. Um, but their point was it sucks your creative juices dry. It doesn't represent you as a person. You're a, uh, phony or a fake if you put AI content forward. But I really, in this case would disagree and would say this helped get my creative juices flowing. I still felt like kind of the creative director, but I let the visual artist, in this case Claude, do some of that heavy lifting and make an aesthetically pleasing deck that I wouldn't have been able to do with quadruple the hours of time. Um, and so, yeah, so I got that all polished up. I was even able to say, like, hey, on slide 10, you've got four columns that are representing a timeline. I need you to chop those up into clickable animations so that column one shows up first and then with each tap, another one appears. And it even was able to handle that. And I thought, good golly, Miss Molly, I may never pick up a PowerPoint again. Uh, in my life. Yeah, I might not. Who knows? Um, so, yeah, we got that loaded. The presentation was on Tuesday. I will link to it in the show notes. Um, it was really fun. It got really nice feedback and great questions from the audience of which we didn't even get to completely answer. But, um, I really, I mean, as much as I just kind of ignore stats and stuff, for this podcast, I will say it does feel good when you do a presentation like that and then flip over to LinkedIn and there's a bunch of invites from people who saw that presentation and they want to talk about ad stuff. And I'm not saying from a selfish standpoint, I mean, sure, would it be nice if at some point some of these folks needed a pen test or something like that? Great. But it's always a two way thing. Like somebody dropped into my LinkedIn and uh, was like, hey, great point about this. Have you seen this tool? And then I start to drool because I go, oh, I love learning new stuff. You know, I'll feel sometimes like, yeah, I know the best, uh, content treasure grabbing tools like Snaffler and Snaffle Pie and all that. But then when people give me things, things that it appears everybody knew about but me, I kind of kick myself for not knowing it. But then I'm happy I met that person, happy I did the presentation. And uh, maybe the larger point here is, I think it's, um, I really haven't, I've kind of been turned. I've kind of been not doing a lot of these kind of things lately because of the heavy lift of content. And then maybe you've been in that situation where you do all this work for one presentation and that's, that's it, you know, never to be used again. Um, but, but I was reminded this week of like, uh, even though I may, might not be able to use that directly in the, the future, um, the, the networking, um, juice that can come out of that and just meeting more cool security people, um, that's like worth the cost and effort or the. Yeah, that's worth the effort. I think alone right there. Um, so I guess circling back my kind of basic point that you might this whole time be going, yeah, I knew all that. Uh, but, but I think my point would be hypocritical. Easy on the AI use so you don't suck up all our drinking water. But boy, let AI. I'm letting it do more and more of my life. Uh, not my life, but my, um, work where I can automate the boring stuff but still be in control, still have final say and not give the full keys to, you know, my machine over to it. And uh, you might want to give it, give it a swing as well. Let it do a little bit of creative work for you. Um, you might find yourself enjoying creating content where you otherwise hated it. Okay, that's the security content for today. If you'd like to head out because you don't like tangents and don't want to hear anything about me on the personal side. That's okay. No, no, no. Hate. It isn't love. It isn't hate. It's just indifference. You know that song from Taylor Swift? That's going to be my segue into this personal tangent about itching myself till I bled. Okay, everybody's left who doesn't like tangents. Um, so, uh, that is one song that I really like. That one, uh, that's like, um, the lyrics are, uh, it's all about like, hey, I supported you. And then like when I had hard times, you didn't support me. And uh, then you showed who you are one magical night. And then I forgot you existed. And I thought it would kill me, but it didn't. And it was so nice, so peaceful and quiet. Uh, I forgot that you existed. It isn't love, it isn't hate. It's just indifference. That is something I won't get into right now. But it's been for a couple circumstances this last year, it's been a bit of an anthem for my wife and I and uh, it just feels good to sing. And that leads me into my tangent point here in that, uh, last Saturday. Oh, I don't know how this is going to sound. It's raining really heavy. We'll see how the, uh, I use this process on my audio to uh, clean up like background noise of the turn signals and the wipers and the truck. I don't know how it's going to do with rain layered on top. It might sound like garbage. So sorry if it does for a while here. But, uh, last Saturday I did a three hour music gig at a winery. It was so much fun. It ended up being a gorgeous fall day. Sun was shining, lots of people outside. And, uh, I played my new guitar. I got a new guitar. So guitar nerds, check out the lava for me. There's a spruce model and there's a carbon fiber model. Uh, I watched every review on the Internet and although I love the look of the carbon better, the spruce seemed to have a warmer sound to me. So I grabbed that and, um, it's a smart guitar. You actually charge it with a USB charger. And it's got loops in it, it's got effects in it, it's got lessons, it's got an app that you interact with M. And my hope is to record some loops and use, uh, them live to accompany some of my peppy songs. Uh, I'm not quite there yet, but, um, just. It's so interesting. Uh, uh, I just thought I'm gonna bring it along. I'm gonna play part of my gig with it, um, and we'll just see how it goes. But, uh, also I have my standard acoustic electric on, you know, just ready. And I found that I kept the new guitar plugged in the whole time. It's. And I don't know how to explain it, but it's, like, resonated forever. So, like, the slow, picky, picky songs, I mean, it felt like I barely had to touch the strings and each note would ring out for eternity. Um, and. And that just made me more comfortable with how the sound was coming across. Cause I think sometimes when I want my finer, picky, picky stuff to be heard, I feel like I really have to pluck extra hard with my standard acoustic. But this was just playing Butter. It was such a treat. Okay. Anyway, about an hour into the gig, things really warmed up, and we got swarmed by these little knit gnat things. I mean, it's just like the size of a baby's booger. Um, and they started biting up, uh, my. My hands and arms and neck. And, uh, my wife got bug spray for me, which I appreciated. And then things kind of tampered down, and it was just like they would itch just for a little bit, intensely. And then itching was done. And it was done for the rest of Saturday. Sunday morning, got up, ran some errands with my wife. We both went up north to help my mom, uh, move to her new place. That's another personal update. My dad passed away in June. You may have heard those episodes. And it's been an emotional couple of weeks because she. She, uh, sold the house to move. Sold the house to move into something smaller, which I fully support. But also, that property is so tied to so much of my memories with my dad. I had a rough week with that last week. But we went up Sunday to, um, help her move. And. And then I drove home that night, and I'm sitting in the truck like, I am now going, oh, man, my arms are starting to itch. Wow, they are really. Oh, oh, Lord, they are. They're on fire. Uh, did I dip my arms into some fire ant gnat, mosquitoes? And, um, got home and all of those little knit gnat bites resurfaced. Literally. They raised surface off my arms. And I thought you were going to have to put me into a crazy person's home because I couldn't stop itching them. So Um, I took a shower, I got some of that steroid cream stuff on there and that calmed it down a little bit. Um, did some yard work, messed around with the kids, did a little bit of work, went to bed. And at 2:00am Um, I woke up in like the fetal position and I had been scratching my arms so hard that they were bleeding. I was doing that in my sleep. So I wake up, I got blood on the sheets and I just, I don't know what to do. So I jumped in the shower. That actually made it worse. I got the cream on there again, the steroid cream, fell, um, asleep, at least for a little bit, and then woke up on fire again. And I ended up doing, ah, one of those remote doctor calls. And, um, I sent pictures of my arms and neck ahead of time. And that appointment was like five minutes long because he, he joined the session. He's like, hey, how we doing today? Oh my God. He's like, I just saw your pictures. He goes, what did you. Wait, what? He's like taking off his glasses and looking super close at the monitor. He's like, what did you get into? And I told him about it and I said, you know, you might have in my history there that I've been bit a couple times the last few summers, ah, I've been stung by a bee. And, and I, and I have like, not a huge reaction at the time, but then later it's like I have a delayed release where, you know, my finger will swell up to the size of a nutty professor hand and the, where the bee sting was will feel like fire and so much itchiness that I feel like I could cut my hand off at the wrist. And so he kind of talked about and recommended that I might need to go see a dermatologist, which I will, but he's like, in the short term we're going to get you some more of that steroid, uh, cream. And then I got a 5 day Z pack sort of thing of, um, prednisone, um, where it's like five four milligram capsules first, uh, day, and then it's four, three, two, one. So I'm down to like, I don't know, the last, the last couple of days. Um, and that, that has really helped. But, um, oh my goodness, is that just a weird and really, really annoying thing? Because, um, those first couple days, I mean, it's just like if a breeze hit me the wrong way, it would send my neck or arm or maybe just a really specific place, like my left elbow would Be like, you're gonna have to scratch me off because I'm not going to cease with the itching. So, uh, yeah, so, I mean, I've already made the bad dad jokes. Like, uh, you know, I'm really itching to play that winery again. Get it? You know, I've been doing that. It's not really funny, but it's something my dad would have appreciated. Um, and that's kind of the personal update. So that's all for now. SevenMinsec.com is our website with our professional services. Oh, and Seven Insect Club is back, baby. I took about a two week break because I have been underwater in work. Uh, but uh, this time I show you at least screenshots of some of the mechanics of my N8N workflows that I've been doing to automate some of the boring security stuff. Uh, like uh, pulling down, um, inventory and firewall rules and domain names and DNS records from a variety of things like opnsense firewalls, Meraki gear, Proxmox servers. Um, and uh, man, I've got a list. I just looked. I have a list of 68 things in my Claude backlog that I also want to automate with N8N. I don't mean to overhype it, I don't mean to overstate it, but Claude N8N has done some wonders for my personal and professional life as far as giving me time in my life back, which I think is maybe where I get my core giggities from in all this. Like, just like, cool. Now I can do, take that time and do something fun with it or at least do something else with it. Um, now I say that and have I been burning the candle at all ends the last couple weeks with no sleep? Yeah, but that's okay. It works its way out and there are seasons for things and there's ebbs and flows. So um, I hope to be coming back into the land of the living shortly, but let us know if we can do anything for you. Really appreciate if you've listened to any portion of any episode of the 7 Minute Security podcast. God bless you and we'll talk to you later. Bye bye.

Speaker A: Mhm. I'm Brian Johnson and you've been watching or listening to 7 Minute Security. We're

Speaker B: located in the Twin Cities area

Speaker A: of

Speaker B: Minnesota

Speaker A: and we offer cybersecurity

Speaker B: services

Speaker A: such as controls, assessments, penetration testing and training. We also do a weekly podcast focused on penetration testing, blue teaming, earning cybersecurity certifications, and building a career in security. For more information about our professional services and our podcast, and to access all sorts of great free content, content we create for the security community, uh, visit sevenminsec.com.