SANS SEC504: Hacker Tools, Techniques, and Incident Handling Course Review

Yesterday I finished up the SANS SEC504 Hacker Tools, Techniques, and Incident Handling training course. This was paid for by my employer as part of an internal cybersecurity training program that I'm in.

I first learned about the SANS Institute shortly after changing careers into IT. However, they've always been too expensive for me to take if I had to pay out of pocket. When I first learned of them a 5 or 6 day class cost around $2500. Nowadays, they are north of $8000 and it's another $949 if you want to take the related certification exam. Way too rich for my blood.

Anyway, the agenda for the course I took was as follows:

• 9/26 - Incident Response
• 9/27 - Recon, Scanning, and Enumeration Attacks
• 9/28 - Password and Access Attacks
• 9/29 - Public-Facing and Drive-By Attacks
• 9/30 - Evasion and Post-Exploitation Attacks
• 10/1 - Capture the Flag event capstone

On Monday class ran from 0830 to 1915 but I tapped out at 1830. By that point we were looking at bonus material related to Linux and PowerShell, both of which I'll go through again in preparation for the certification exam.

Tuesday through Friday class ran from 0900 through about 1730, and the CTF event on Saturday was 0900 to about 1500. Of course, we got breaks in the morning and afternoon, and for lunch.

Although the days were long and by Thursday I was feeling it, they went by quickly.

The session I took was presented live at SANS Baltimore made available for remote students via Zoom and Slack for text chatting. This approach worked extremely well except for an hour or so on Thursday afternoon when the hotel hosting the convention lost its Internet connection, and they had to fail over to a backup connection. Rather than losing any productive time, we just worked on labs.

I've been lucky enough to take a lot of training classes over the years, paid for by my employer. Vendors have included Nortel (yeah, I'm old), Alcatel, Red Hat, and Cisco, among others. I have to say this was probably the best out of all of them.

The instructor, Jon Gorenflow was knowledgeable and engaging. The material was well organized and interesting, and reinforced with a large number of labs.

Labs were done using one or both of two virtual machines. One was Slingshot Linux, which is a hacking-oriented distro based on Ubuntu 18.04. The other was a Windows 10 Enterprise VM for which SANS arranged a four-month product key.

I ran the VMs using VMware Fusion on my work MacBook Pro. You can use Fusion or VMware Workstation to run the VMs. My Mac had plenty of power to run both VMs simultaneously, even after I increased the RAM on the Windows VM to 6GB from the default 4GB.

Note that if you plan to take this or other SANS classes, you need a computer with an Intel CPU. I would not have been able to run the VMs on my personal MacBook Air which has an M1 ARM CPU, even though otherwise it has plenty of horsepower to do so.

If you take a SANS course, do not use a laptop with less than 16 GB of RAM, a 512 GB solid state drive, and an Intel i5 CPU with an i7 being better. (I'm sure an AMD processor would be fine but I can't speak to specs.) If you can get a larger SSD it would be better. The SANS VMs and course materials take up a lot of space.

Your laptop's host OS should be Windows, Linux, or macOS if you have an Intel Mac. You'll need administrative rights on the machine and be able to access the network. If you're taking the class remotely and can connect to Ethernet that's better than WiFi.

My original plan was to run the VMs on my Intel NUC which runs the free version of VMware ESXi 7U3, and access their graphical desktops via NoMachine and Remote Desktop Protocol. However, I ran into a problem with the Windows VM. Because they were built on VMware Workstation they wouldn't boot without first converting their virtual disks into ESXi format*. That's not a problem with Linux but on Windows it breaks Windows activation because it sees that the hardware changed. I probably could have run the Windows VM with the OS not activated but I did not want to chance having problems during the class, so I just ran them on my laptop.

However, I learned in the class that running the VMs on a headless ESXi box would not have been optimal anyway. The VMs are configured to use a private network for most of the class, so that they cannot access or be accessed from other hosts on your LAN. This is done because they are in deliberately insecure configurations, especially the Windows VM.

Saturday's capture the flag event was a lot of fun and helped tie everything together. We broke up the class into teams of four people and accessed the CTF environment through a VPN from the Slingshot Linux VM, which was reconfigured to access the network for Internet access.

After the CTF event completed the instructor did a walkthrough, taking a bit of a different approach to hacking into the systems than the CTF instructions presented.

Two of the tools we learned about during the course that I plan to do deeper dives into were Metasploit and netcat. I've used the latter just a little but have only scratched the surface.

As you'd expect, we used nmap quite a bit. This is another tool I use regularly whether to do ping sweeps or for port scanning.

Another tool which we got exposure to is an old school UNIX/Linux utility: awk. We used it a few times in the class to extract useful fields such as email addresses and user names from text files and .csv files. I decided it would be good for me to get a copy of O'Reilly's sed & awk Pocket Reference.

As a long time Linux user, I'm familiar programs that can display the contents of a text file, such as less, more, and cat. The instructor showed us a way to use cat that I've never seen before.

Here's a demonstation done on my MacBook Air, which includes cat as a command line utility (macOS is UNIX under the hood). First, I'll create an empty file using touch, then add text to it using cat and a shell redirect:

Davids-Air:Documents dave$ touch foo.txt

Davids-Air:Documents dave$ cat > foo.txt

Hello

Hello

Hello

^C

Davids-Air:Documents dave$ 

Davids-Air:Documents dave$ 

Davids-Air:Documents dave$ cat foo.txt

Hello

Hello

Hello

Note how by issuing the cat command and immediately using the redirect ( > ), it presents you with a way to input text until you hit CTRL-C. I then used cat to show the contents of foo.txt on STDOUT.

Neat!

Another tool we learned about was RITA from Active Countermeasures for analyzing network traffic logs collected by Zeek. When used properly, this combination should help you spot network traffic indicating naughty behavior.

I've experimented with Zeek a bit and it's a part of Security Onion, which I've used on the job. To learn more about RITA I built a Debian 11 VM** on my Nuc running both of them. I may get this running on the networks I help to support.

To continue my learning I grabbed a copy of Metasploitable, another deliberately vulnerable Linux VM. As with the class VMs, it was built on VMware Workstation so you'll need to convert the disk to ESXi format if you want to run it on that platform.

For the past few years cybersecurity has been an increasingly important part of my job. It's also a rapidly growing field. I'm looking forward to immediately putting to use much of the info I learned SEC504.

* For this you need to ssh into your ESXi host and use vmkfstools to clone the disk. An overview of how to do so can be found here: https://thunderysteak.github.io/workstation-vmdk-2-esxi

** Most of the VMs I've built in the current iteration of my home lab have been based on Debian Linux 11. I find it easy to create a stripped-down VM and the dependency resolution is excellent. Ubuntu Linux is based on Debian but for my use it doesn't really add much value, so I go right to the source, so to speak.

Nice Little Pliers

The mailman brought this to me today (US quarter for scale).

It's from White Elk Trading in Utah. It's the large size, about 4.7" long. I wanted a small pair of pliers for my shooting pouch but wanted something that looked like it might have been used in the 18th or 19th Century, not something from Lowe's.

I might grind the ends to be screwdrivers, we'll see.

Made a Short Starter and a Leather Capper

 I was feeling crafty so I made these today. The antler is from a buck I shot last year. The other parts are a length of 3/8" poplar dowel, a short length of 3/8" brass rod, and a .38 Special case with the end turned down. All parts are glued and pinned together with brass pins I cut from brass rod.

The capper was made from a piece of scrap leather. The top right hole is to tie it to my shooting bag. The row of holes all have a slit going to the edge of the leather. It's sized for #11 caps.

Sent the Broken Lock Out for Repair

As mentioned in my last post, at this point I’ve decided to have a professional repair the canoe gun's lock, so I shipped the lock today Brad Emig at Cabin Creek Muzzleloading, which is just East of York, PA.  For lock repair he came highly recommended on the Muzzleloading Forum, and it’s nice that he’s relatively close.

Another reason I went with CCM is that I got a reply and a phone call very shortly after emailing him. I still haven't heard back from Jim Chambers Flintlocks. I called CCM this morning to confirm his shipping address and to ask whether I should include payment and Emig picked up the phone and was very friendly. He'll call me when it's done with the final cost and I can then either pay via a credit card or send him a check.

His base price for a lock tune is $95 + any parts he might need + return shipping.

It should get there Monday.

I’ve seen Emig’s guns at the Dixon’s Gunmakers Fair and they are gorgeous, absolute works of art (and priced commensurately).

And since the lock is a Siler, the other day I ordered from the Log Cabin Shop a large Siler flint and a vent liner to match the drum’s threads. Hope to get that next week.

Ugh, Canoe Gun NOT Fixed, and Other Stuff

Last weekend I was upstate at my friend's cabin. We had a good trip and I got to shoot the canoe gun a little. Unfortunately it is not fixed. The hammer stopped holding at full cock so I’m looking at sending it out for repair before I completely screw it up. Today I reached out to Jim Chambers Flintlocks, who is the current maker of Siler locks, to see if they'll service it. It's an older lock that may have been built from a kit so I'm not expecting a freebie. <grrr>

While it was still working, I patterned a load of 1-1/8 oz. of #5 shot on top of 70 grains of Goex 2Fg. This is a square load. I used a 1/8” lubed over powder wad, the shot inside a paper shot cup made from a Post-It note, and a thin over shot card. The target was at 15 yards and POA was center hold.

The SR-1 target I shot at has an 8" bullseye. Here's a closer pic:

I’m happy with the pattern.

I also put 150 rounds thru my Ruger LCP .22.

• 50 rounds of CCI Mini Mag solids were flawless although the slide failed to lock back after the 50th shot.
• 50 rounds of Federal 550 bulk pack had a couple failures to fire. Both rounds fired when struck on another spot on the rim. This is par for the course with that ammo in other guns.
• 50 rounds of Federal Punch, which is a 29 grain nickel plated flat point in an extended, nickeled case. This had several failures to eject. I’m not writing this off yet because the gun was pretty dirty by the time I got to it.

I’m at the point where I’d be comfortable carrying it loaded with Mini Mag solids as long as it’s cleaned and lubed.

I also put 50 rounds of .38 full charge wadcutters through my S&W Model 15. I shot about half at the man-sized silhouette we have about 70 yards out. My hit ratio was probably around 50%, and except for 6 shots was all fired double action. I'm pretty sure that the Model 15 would be the absolute last gun I ever sell.

And here’s a doe that stood looking at me for a minute or two Friday afternoon, downrange near the silhouette.

The other major activity was a trip to Zett's Fish Farm to pick up some fish for my friend's quarter-acre pond. He bought some minnows, shiners, and large mouth bass. We're hoping that in a couple years he'll have a balanced ecosystem in the pond with not only those fish, but bluegills, catfish, and frogs (those last three are already in it).

We have our next trip planned for late October when the early antlerless deer season is open, along with small game and upland birds.

Fixed the Canoe Gun

My order with the replacement Siler tumbler from Track of the Wolf arrived today. It took me about a half hour after work to fit the hammer to the tumbler. I think the lock may have been assembled from a Siler kit based on the shape of the square hole in the hammer which slides over the end of the tumbler. Anyway, it now functions correctly, locking securely into the half and full cock notches.

If I get upstate this coming weekend I hope to be able to shoot it on paper to check point of impact with ball loads, and patterns with shot.

Shot the Canoe Gun Today, and Broke It

I got a chance to shoot the canoe gun today over at a friend's place. He has some land and we can shoot safely in his yard. Unfortunately it was raining and the only place I could load while under overhead cover was his patio. I'd then step out to shoot and some tin cans we placed on a hillside.

My load of 1 oz. of #5 shot on top of 65 grains of Scheutzen 3Fg black powder penetrated both side of a #10 can from about 20 yards, so it's got enough power for hunting.

I also tried a couple varieties of ball loads. I shot a half dozen .570 balls loaded in paper cartridges on top of 65 grains of powder. I also tried a few shots with .575 balls loaded on top of a tow wad, with another tow wad over the ball to hold it in place. The balls loads shot high with how I was holding the gun.

I absolutely need to put both shot and ball loads on paper.

Everything went mostly well until the gun fell over onto the brick patio, landing on the hammer which was on half cock. That broke the half cock notch on the tumbler. (Insert vast amounts of profanity here.)

When I was done I used tow wrapped around a worm to scrub the bore. This was the first time I've tried using tow for cleaning and it works pretty well, much like a bore brush. I'll be using it at least for my smoothbores in the future.

Tonight I ordered a replacement tumbler from Track of the Wolf and I paid extra for 2 day delivery. I may be going upstate next weekend and if so I'd really like to bring the gun with me to pattern shot loads and figure out how to hold it when shooting ball.

Primitive Worm and Tow for Muzzleloader Cleaning

Back in the 18th Century and into the 19th, fabric was too expensive to waste as cleaning patches so people swabbed their gun bores with tow, which is fiber left over from processing flax, hemp, or jute.

I am expecting an order with some supplies to go with the new Jackie Brown smoothbore I bought last weekend. Among them is a primitive tow worm that screws onto the end of a ramrod and allows you to run a ball of tow up and down the bore to scrub it out. It can also be used to retrieve a lost cleaning patch.

Naturally, since I ordered one I found one I already had and forgot about. Doh.

This shows how it goes onto the outside of the ramrod. I had to open up the coils a little with pliers.

And this shows it with a tow ball threaded onto it:

So basically, that's the 18th Century equivalent of a bore brush. If it's not too dirty you can rinse it out and reuse it.

It's my understanding that Russia used tow for cleaning rifle barrels into the 20th Century, possibly as late as World War 2.

Powder Horn

I've had this powder horn for several years. If I remember correctly it was an economy horn from October Country. Whatever color you get with these is the luck of the draw, and as it came it was mostly white with some black.

The horn had a simple staple on the wood plug. I replaced that with the brass acorn that screws into a ferrule I drilled. This it to make filling the horn easier.

One of the things they teach you in hunter safety education is to try and avoid wearing anything white during hunting season because it can look like a deer's white tail and sometimes you are around idiots who will shoot at anything that moves. This probably isn't nearly as much of an issue now that hunter ed classes have been required, along with blaze orange, for decades, but a mostly white horn never sat right with me.

So last night I went over the horn with Fiebing's medium brown leather dye and let it sit overnight. This morning it was still tacky when I went over it with 0000 steel wool. This removed most of the dye sitting on the surface that hadn't been absorbed. I wiped it down vigorously with a paper shop towel, then applied some Sno Seal and buffed that out with the shop towel.

I'm happy with the new look. Right now it has just a thin leather thong to carry it. I need to buy or make a better strap for it.

Tow Wads

Tow is a fibrous material left over from processing flax, hemp, or jute. It was used as wadding and for bore cleaning during the muzzleloading era. For wadding, a shooter can make small balls of it for over-powder and over-shot or over-ball wads. For cleaning it is wrapped around a worm and then used to scrub the bore like a modern bore brush.

Since I've never used it for shooting, over on the Muzzleloading Forum I started a thread asking for others' experiences and got a lot of good feedback.

One concern I have is that the tow may ignite and smolder when used as wads. This could start fires. Several replies indicated that this can be a problem. Others noted that if you lube the tow with something like Track of the Wolf's mink oil tallow, it not only helps keep fouling soft, it also prevents the wad from igniting.

So wanting to try tow wads, I made up a small batch of tow wads and lubed them with Track's mink oil tallow.

The tow I'm using was bought a couple years ago from Turkey Foot Trading Company and is made from hemp. Previously I used it along with a flint and steel and some charcloth for fire starting.

I have an order on the way from Track which includes a primitive worm so I can try using it for bore cleaning as well.

Another natural material used for wadding is wasp's or hornet's nest. If I can find a nest and not get stung it's something else I want to try.

More to come...

More Test Loads for the Canoe Gun

Over my lunch break I put together some ball rounds for the Jackie Brown canoe gun. Again, I used Post-Its for the paper along with a glue stick. These include a .575 round ball and 65 grains of 3Fg Schuetzen black powder.

After the glue dries a bit more I'm going to smear a little lube around the ball end. These are pretty snug in the bore so the lube will help reloading. Were I planning on extensive shooting without wiping the bore I'd need to go to a smaller ball. I have some .570s for this purpose, or even .562s.

Note that these are not combustible cartridges as you'd use in a percussion revolver. Rather, these are designed to have the end opened or torn off, the powder dumped down the bore, and then the ball and paper rammed down on top. The paper acts as a patch and wadding between powder and ball. The paper will be blown out of the barrel, not burned inside it.

The ammo I made up today could also be used in my Indian-made Tulle Fusil de Chasse, which is a 20 gauge flintlock shotgun.

Test Loads for the Canoe Gun

During a break this morning I made up a half dozen loads to try in the Jackie Brown Canoe Gun. I should be able to shoot it on Sunday. I have them in a tin I got from Amazon.

There are two each:

• Buckshot consisting of 6 .380 round balls, which I use for my .36 caliber cap and ball revolvers. For reference, OOOO buckshot is .375. These are mainly for shits and giggles. The balls weigh ~83 grains each so 6 of them are bit more than one ounce. Five balls would be a little under one ounce.
• 1 oz. of #7.5 shot, useful for doves, quail, or clay targets.
• 1 oz. of #5 shot, useful for larger birds like pheasant, or rabbits and squirrels.

I measured out six 65 grain loads of Scheutzen FFFg black powder and in 5ML flip-top sample vials. I could squeeze a little more powder into them, maybe 70 grains. I actually bought these for pre-measured revolver loads and have larger vials for rifle and shotgun loads.

The tin also has space for ziplock bags holding lubricated 1/8" thick x 5/8" diameter wool felt wads, and 17 gauge overshot cards. The felt wads are lubricated with neatsfoot oil.

The plan is to load the powder, then a felt wad, then the shot cup. For the birdshot loads I plan to tear off the top end of the cup and then seat an overshot card, to prevent them from turning into slugs. I may try that with one of the buckshot rounds, and one without tearing off the end, to see if there's a difference.

A Sling for the Canoe Gun

Since the canoe gun came setup for a sling I made one last night.

I cut a length of cowhide ~1.25" wide by ~48" long. One the butt end I punched a hole and then made a slit so it fits over the sling mounting button. On the muzzle end I punched a series of holes for a leather thong to go through.

The leather was a light natural tan color, so I used some Fiebing's dark brown leather dye to darken it. After that dried I worked some neatsfoot oil into both sides of the leather to moisturize and soften it. The leather drank it up. Finally, I gave both sides a coat of Montana Pitch Blend dressing. This is a mix of pine pitch, mink oil, and beeswax. I also worked the leather back and forth to soften it a little since it was very stiff.

I'll probably punch a few more holes in it so I can let it out to go over a heavy coat.

It came out pretty nicely, if I do say so myself.

Picked up a Jackie Brown Canoe Gun

Today I took a drive to Dixon's Muzzleloading Shop and saw this canoe gun (I know it's not an historical term) on the shelf. I've been looking for a 20 gauge percussion smoothbore and the fact that it's a lefty is icing on the cake.

Some measurements I took:

• Overall length 40"
• Barrel: 24.5"
• Length of pull 13.5"
• Weight 6.5 lbs.
• Width of buttplate 2"

The barrel has a slight flare at the muzzle end. The front and only sight is a trade gun-style turtle. It's a large Siler lock and the cone is sized for No.11 caps.

I'm hoping to develop good patterning shot loads and also a round ball load.

Replaced the Hand in my Rogers and Spencer Percussion Revolver

When I last shot my Euroarms of America Rogers and Spencer revolver I managed to chip the tip off the hand, rendering the gun useless. Since EOA has been out of business for several years sourcing a replacement could be challenging. The only website I found that even listed a replacement was S&S Firearms, but they were out of stock. Dixie Gun Works still has a couple R&S spare parts but no hands.

The revolver in question:

Broken hand on the left:

A friend of mine has a TIG welder. I'm going to ask him if he'd try to build up the broken hand after which I'd dress it to shape.

After I bought the gun a number of years ago, I put together a spare parts kit which included a hand. I installed it today, but first I made a detailed drawing of it in case it ever needs to be replicated. 

With a different view of the hand:

I'm sharing these for the benefit of my fellow Rogers and Spencer fans. The drawing of the hand was done by tracing around it. Quarter provided for scale.

Perhaps I was lucky but it required no fitting. The cylinder rotates and locks up nicely. I took it to the range this afternoon and put 30 - 36 shots through it. The gun worked perfectly.

As an aside, detail stripping and reassembly was made with the help of these two videos:

This is how firearms disassembly and reassembly should be done. 

Crappy Uberti Screws Strike Again

A good part of my gun collection was made by Uberti. However, a pet peeve of mine is that the scews they use to build their guns are apparently made from cheese. For the price of these guns it's reasonable to expect that the screws will be hardened, not cross threaded, and not over-torqued, as they often are.

Today I detail stripped my 1992-vintage Uberti 1851 Navy. It was working fine but filthy inside and in need of a thorough cleaning.

One of the things I found was that the screw that holds the bolt/trigger spring in place was cross threaded at the factory. I lucked out and had an 8-32 tap so I was able to chase the threads in the frame, but I don't have an 8-32 die. (I ordered one from Amazon after discovering this.) However, the screw itself is trashed and even if I had the die I don't know if I'd be able to restore it.

So, I went to VTI Gun Parts and sent them emails to check stock on their set of properly hardened replacement screws, and also a spare hand spring while I was at it. (For whatever reason their website doesn't report live inventory.)

One of the other weaknesses of the Italian replicas is the spring for the bolt and trigger. It's flat steel and prone to breaking. I haven't broken one myself but prevention is good, so I went over to Wolff Gun Springs and ordered wire replacements for my Uberti and Pietta single actions. I'm told that Piettas use the springs for EMF Hartford guns, so I ordered 4 of those along with three Uberti replacements.

<grumble, grumble>

Quarter Inch Hand Impact Driver

If you mess with guns long enough you'll eventually run into a stuck screw. In the past I've been able to free some of these screws by soaking with Kroil, but other times I've had to drill them out using my milling machine and extract them with a screw extractor.

Another option is a hand impact driver that takes 1/4" bits commonly used in gunsmithing screwdriver sets. I bought this one from Amazon:

I've never used one of these before and it did not come with any instructions for changing which way it rotates. Naturally, it came setup to turn right, when I needed it to turn left. A minute of googling lead me to this short and informative video from Down Under:

The small driver I bought doesn't have the separate coupler shown in the video, but by clamping the narrow part in my vise I was able to change the direction of rotation.

I used the driver today to loosen the mainspring screw on my 1992-vintage Uberti 1851 Colt Navy percussion revolver, which I detail stripped for the first time. (Better late than never. Even though it was full of sludge, because it was oil soaked there was no corrosion. I don't recommend this, for the record.)

New Hammer for the Marlin 1889

In November of 2020 I bought a Marlin 1889 sporting rifle chambered for .38 WCF (AKA .38-40). The Marlin 1889 was the first side-ejecting lever action, leading to the rifles that Marlin has built ever since. When I got it I discovered that the half cock notch on the hammer was chipped. It held OK at full cock but when placed in half cock, as you'd use it when hunting, the hammer could be pushed off. This was obviously no bueno.

At the time I bought it I was unable to find a replacement. This is a hazard of collecting old guns that have been out of production for decades, or in the case of the 1889, over a century.

Actually, the full cock notch doesn't look so good, either.

At the beginning of July I did an Internet search on a lark and found that Old Arms of Idaho had a few in stock, and I decided to take a chance.

It worked out splendidly, dropping in with no fitting required.

A few days later I took the rifle to the range.

I shot the rifle with my black powder handloads in Starline brass. One oddity of guns chambered for .38 WCF is that the chamber dimensions and cartridge dimensions allow for a lot of case expansion. The British military had a similar situation with the chambers on their Lee-Enfields and .303 British ammunition. The result is that if you full length resize the brass for reloading, it work hardens the brass leading to short case life. To wit:

The good thing is that I didn't know the case split in half until after I tried to eject it and got out only half. The bad thing is that I noticed several other cases had splits and needed to be trashed.

Since I have two rifles in .38 WCF I am now sorting my cases by rifle and will adjust my sizing die to only neck size the brass. This is a hassle, especially given the current scarcity of .38 WCF brass. Unless I run across something I really want at a price I can't pass up, I won't be buying any more guns in this caliber because of the hassle.

Offhand Practice with my Cabela's Hawken

Last weekend I took my Cabela's Hawken to the range for some offhand practice on both Saturday and Sunday.

The rifle was built by Investarms in Italy and is very similar to the Lyman Trade Rifle, which was also built by Ivestarms. I'd wanted a LTR for years but it was never offered in a left handed version, so I got the Cabela's rifle instead. A very similar or identical rifle is also sold by Dixie Gun Works, as well as muzzle-loaders.com.

A few years ago I replaced the factory sights with a Lyman white bead front sight and a 57 SML aperture sight. I also replaced the factory nipple with a Hot Shot. I keep the original in the cap box as a spare.

Anyway, it's a caplock .50 caliber muzzleloader. The load I shot both days was:

• 70 grains of 3Fg Goex black powder
• 0.020" patch lubed with Bumblin' Bear Grease from October Country
• Hornady swaged 0.490" round ball
• CCI No.11 percussion cap

On Saturday, I shot with the peep sight's insert in place. This gives a smaller aperture which should allow better accuracy, at the expense of light transmission.

Decent, except for that one flyer above the bull.

When I went back on Sunday I removed the sight insert and used it as a ghost ring. This is what I'd do if hunting with the rifle.

Not quite as good but still minute of deer at the ranges I'd be shooting at. My final shot of the day was at a steel gong approximately six inches square, and I got a good solid hit.

Rossi 92 Back Together

A week ago I posted about the Rossi 92 .357 carbine I bought about 10 years ago. The reduced power hammer and ejector springs and new rear sight that I ordered from Steve's Gunz arrived today.

Before reassembling the gun I deburred the parts and applied a little white lithium grease to the wear points. I'll say this one went back together a lot easier than my Interarms 65 did last year. That rifle required another set of hands to get back in one piece.

A .357 functioning dummy helped keep the ejector in place during reassembly. Highly recommended if you have an 1892-type rifle. I function checked the rifle with a few of the dummies and ejection is positive but not as violent as it was originally.

Overall, the action works much more smoothly with less effort than it did before.

I also replaced the factory semi-buckhorn rear sight with a flat top sight made by Marble's. It has an insert that you can flip so that it has either a U- or V-shaped notch. It came with the U in place. I may take a file to it to make it a little larger, which will help in low light and make it faster to use.

Hopefully I'll get to shoot the rifle on Sunday to verify it works properly with live ammunition.