SECNOTES
- Layout for this exercise:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxsxZydf6mjIDuiODu54EZutXZQaGy0ELGKWAb6QQ5NFcbT708EHeujKULcnyJ6Zm9muZfpItWt55pdKW7RJTt7vfApyGqV4AU2424duAVDrAUjmwaaOe9qcvw0qAFgBXWgUfkHuAdp15L/s1600/screenshot.51.jpg)
1 - INTRODUCTION
- The goal for this exercise is to develop a hacking process for the vulnerable machine SecNotes from the Hack The Box pentesting platform:
https://www.hackthebox.eu/
2 - ENUMERATION
- SecNotes' IP is 10.10.10.97:
- Scanning with Nmap:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2S2Xakk7_U7pcLUopnRpDu6nGJHVvFXE-MwuB06RADbVi0se3_m-XH8GRODeXzbCJ-7FCnoDdgNq_KNkqa55suFroybqm4y-3ZGnbq867nN_7FlHia2DtEFShai_x978gEuh0s0MbrIbK/s1600/screenshot.3.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpDSdyvtVMuTTU73-7XPsU9zZZZZ2At1IGPDNXfHX6mEWgIxn4t0lhLQKndyx0fLG9XF92Co9PtahqS1c5kCPBYaTtLPf7p9g2ixzBOiuIf9L_0SGSjqB7ZRCqnL66Kcwt0rYVQ3FUyXt8/s1600/screenshot.10.jpg)
- Browsing the web server on port 80:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3Tw1ch8hXD_yYGFb_0M2gbt0KVhRDqxi7skiIxvCGq8oiEbA3LAVtzgaOMbBOIN0TA4mmEC0J_N8vgdzSyCV4Yjo0ERVzVcyay5-pCRtbZH8uLT1wVjDKmaFTC5M8Sgltr4nAm7PO-tH-/s1600/screenshot.4.jpg)
- Registering a new user whitelist:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRxVwQPgDCXf8oifAaKX1heGCQxEuxCKX_ejgyE7p-0G904siy6fPqAwJAA8EqlOMuFpBlNm_KCcznW7XcJCGVIH5V7IsDpQxQzQrWB_QhRTb2JkLV6SesJKhbpZGk1z9ODjKQNiiucZ9e/s1600/screenshot.5.jpg)
- Login as the new user whitelist:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHupzwNgc0vazVQRa5NO0WpKeV1yV7hZ4PfyX47UiTCmDQo0O6fXP-UlmTitmq0p3QR8SbqtDDYZW2uRZ90HktqEGGyL1uhWIhAUoyrPkHVwCx8w_ZTqrtW04zQ9aOvPM-_If-mB1sosD1/s1600/screenshot.6.jpg)
- Secure Notes is a notepad application that stores notes and to-do list with secure password protection using AES encryption and providing quick and easy access using a simple password:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9NpkZAtWtsdeUTD-MZdRIce7Y1NoFRPY2QMnBW3bAokp28rOXYK_FsZ7twpjej6uT-Nywv7Zhyphenhyphenhz6eadNeEX-tbUxp-A0WlVj7LHPahO7tHpZSaj77fTLn2eMsU5Uwkneh0izz_wV1wDI/s1600/screenshot.7.jpg)
- The email tyler@secnotes.htb informs about two details:
- user named tyler
- domain secnotes.htb
- Also, it is interesting the .php extension at the login page, revealing PHP is run by the server.
- Confirming the existence of user tyler with a random password:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhda6shvFh_TxgcmSkHZCgNRElwG-sxW9CLrV40FEuiLLp75mC7zkyDj6OU6sLF_mqa5F4H5_mBBDdq2dEbnUCzEDVyt05fwV5Lul3z8xVJnJ_jg0jZUE48-gUoMiIF6X4VXN3YEU9BOHs4/s1600/screenshot.8.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCPLETWTHo4o10Ixmx306jVoYGJ_elpqWFQsUhc6az13JpSKO1bOjY35v7XI52lBsgnKed-ui-f3qPIu-zI0xSn5EIFSFjHWFZZmHo0k3xqYVfpK7wp0ulbyWvRRByIIT-8vEdlgsoJbOe/s1600/screenshot.9.jpg)
- Browsing the other web server at port 8808:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjQYvDLd_ovr98pgQPJFdaeS3uHTY0r6-HmwCH951uVhAUOSNZzz_G2E7v-yL43l4poK5_cF0lWzkPeLckHDPinqWX2ug05j3wUKcnmVV3KWxvnqp05ubQ2IEeE_LaKih4qbV00-4K7KQQL/s1600/screenshot.11.jpg)
- Viewing the source we find the image iisstart.png:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGwXMTeCsUzr79GfjHRiS0q5KO-xFsda_023yA4wFeG_LzpUUWWobL8Q06LBTJP3ubkgGpQ8h2g_7TEtBG-hP3l-hXSpXHbVlHKqV3pRRP6t1oTfjO8becD94rDZ8nPhJdDIk1qtK_FmOg/s1600/screenshot.20.jpg)
3 - EXPLOITATION
3.1 - SQL injection
- "Second order" SQL injection attack delays execution until a secondary query, by injecting a query fragment into a query (that’s not necessarily vulnerable to injection), and then have that injected SQL execute in a second query that is vulnerable to SQL injection.
https://portswigger.net/kb/issues/00100210_sql-injection-second-order
https://bertwagner.com/2018/03/20/how-to-steal-data-using-a-second-order-sql-injection-attack/
- Using wfuzz to help us finding a valid SQL injection:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJlv4gyDZZr70xsnF_YUxZxMsMGhyRQZovA4OMxV-u2qcYzVBlGbGX9l4uksUSj_1D7941-qbtHrFHSOHces4AOyqUgoBmsa1CEiY25K315QxFFnbz5cmtLs-ZNS-MbW9t8NbVvOu0ikRf/s1600/screenshot.54.jpg)
- From the proposed queries the last one ' or 1=1 or ''=' seems easy to apply:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibqP7LyPHlfR9JN6ZY5NcRR0p1UKcJlQGAftOkXo7fJ_kXTrhVZ38GanwJA4VeWPLARIRfZGDv-5nP7YXgxFn3hTP4MvGybzIFaoRIX3kBa136sa0csF_COl8-wLbRqLiajXrbka5i5Hwq/s1600/screenshot.57.jpg)
- Entering ' or 1=1 or ''=' as a new user and password, and later login with those credentials:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg88yuzyU803kplUNAI4Ysam4EuilylLz0g5mB7tiu204cdqCKNuDM2Ioq5aYxZSzKJsAvvncz7UOskLdhyYZ_EV4M7ug-fjRovJs-hTx7PvYwEaViw0b3ZKjNp-Yx2B-hoZvyJ26F7XUUd/s1600/screenshot.55.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZeDoEVSpkJ8wA7zVcF8AzCNYBwgglQLe8JaaPCmZeJFh-7vEn_q8BlwTX3qppD3Ew2O-yUV-g6wlPU5ITOdc0iGZaQ_Uz2M7eADnrvRPZTQsP-Upos2_BvUqJzZtIzvp-2PSVqqkSfs3k/s1600/screenshot.56.jpg)
- Now the home page yields credentials for user tyler at the 3rd note named new site:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh95a1j2autop8X-ShWUqsilFyXlsN5HUXNkLleN7sq2chkx0pF3RkuLjyEXXH3FeSThC0npmdGATFQV9C4oeO95jLQeE-4zEdJB4n2hxstYq_7HVMue-wHGqg9CugSnUv_OWHcCNPyD0_h/s1600/screenshot.58.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxPjZIBxLwtZhIUoyZ6kCFF_vAR_a8PPaiG2H6i22RpMZNvcckwP85zuqV6W6-dj79MOhHfT9PdbLzMjZrZqC73-tOUAx-vwq_KvH0_YK1uZpoBe-XmOEaVh45B7mNdxN0rU1gXlvTAe5c/s400/screenshot.15.jpg)
3.2 - Exploiting SMB
- Using credentials tyler:92g!mA8BGjOirkL%OG*& to access SMB service on port 445:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvxSMbVPtQ0MrLFF72_N7hQ4FqZdthi-ye1aAEi01OVyOmpUArza3hR5EqKF1xHrSZz-YBQPynQwWZMv4Ac6PkboAAcM5AGxu8aXRzh4WXSfauwwz2Llexq4Dy0lJ3Uw59c_2nH8W6ax40/s1600/screenshot.17.jpg)
- Connecting and listing new-site:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3226c95Y-GkbVJYKkgiO9TYoCEmGlhbzYGEB07i0gGOrp-Gpkdjx4dr355aA8B_kv85kou3DLGxvUeWMtUhUuPxxdC7khGuOlzsHatG2NYdqoW16V4U5NA-Dpjw_Iv-LSmHsHTgVaQ_mq/s1600/screenshot.19.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUE0VFiQ_g7px1vbLahbeAqklsRl4xMR9pmEb6puXZX1j9zv5DlBSBdZvvHWY8z7JmPtylXyb88stueelqftzYq4xqKHIy2Z1xygjH6mQId9hvh39Zz9k85YWLWqz5MP-pvISNLmwWaLf_/s1600/screenshot.21.jpg)
- So we confirm that there is a web service at port 8808 where folder new-site contains the image iisstart.png.
3.3 - Getting a remote shell
- First of all let's download to Kali the Windows Netcat application:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhkEhiHF7D6YXv0CSsI6bp1yDQId3FlzSFtvAb4Uqnj210Ki5lg0ihtfYcSZ8QKYG1fCOdV4shylYA2aFmPC86FXGRWsn6sDZY8bDT6utGsUE9HISw68z4ZYAz2gAIgieoaA4fW6RAyN4c/s1600/screenshot.22.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXFmJZYo6r2R4-va84SqoPByy9eUMTML4hp3irEG6RMiBHtOO7DH6rB-CsRuC2h7fWHoGAe3A6GI3HdVceEXjWYX7EbbZGbsqK0sL03lWnFhLGmcx9-_UW41z5I-hQI7ctRpkjtSRZ6-eS/s1600/screenshot.23.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUIYiZGGM9zUVvO-4udpwmlk1vKF8E2IIsZZXf4NGokLcCrjJNvF3uheVCIgoBch3p6BkmyLL1y-UOqXBeqAPcOKwFWmDBbHiqzdTj-8wMxnfI4aMF79rm0B8wkxVbmJgb4ZOoCPB_9Ddu/s1600/screenshot.24.jpg)
- Also let's create exploit.php, a PHP exploit which goal is to spawn a remote shell with a Netcat connection:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjN79XY548CiHkgZUM5bZY8mAb930dGNThvVFDAnpws3hkf313vgUlycoTi45rj0wKHOKd7BebhUWqIwqtUrCHPND57vU3w2egd0hQXQgjgAZ9h2Yncs7rqfYObrkS0lqV9qDj03f-ksiv_/s1600/screenshot.25.jpg)
- Transferring nc.exe and exploit.php from Kali to SecNotes:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEik5l2iGiyuWubA2BJnke0bhUz9yr9E_GE6JuHB7PY_UUZ_tIcnjuoVnGXU73DtrwB4_32LcuOAd7CYpcq-1NIeOJq50DkhCx4TK8te_TFMe-74a1REgufHmaCY6jE6uSfsPK-vcboJJH6l/s1600/screenshot.26.jpg)
- The transfer of both files is successful:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLo2CpfyzAH-NvTg9RsTPS6HCsOllR_Fk5V_TAr-7B0OaWIBOk5IPNfSw8US-S2nhkMEIu9QQpQFjaWUbwv0yfXYFlD12PI1jnG65GZATCT-4lc8iONQWmKqe8cXfyXcExK-6AucZPS6iK/s1600/screenshot.34.jpg)
- Setting a Netcat listening on port 5555:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3fH2aqiZpKEEauTNQE-0TbunRpdwaAXOyGdSAs4vQQaB4i8ZRr_vlQWbcx5z2u8I_3fmoDDNuqT9TcmANZLgm7BGlwU7W_7t1xr8UO_-bXdsk6au3hsiopI1N-6Zjiu2N3FU54kL5UPG1/s1600/screenshot.27.jpg)
- Running exploit.php directly on the browser:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhY7Xfe99fuI3Rx_Nd63na4IktqzjpQAJu593JeXrX631f71nMkUc9iUWpFqh4FFtYmZHB1VBrE647eXzUq_vx-X0JV9yogbK8FQ9sm0Tun0eRjLqqKVuGzP3hhoqfutFsGUHoD9OMICZQx/s1600/screenshot.28.jpg)
- A remote shell is successfully spawned:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGIgoc2fj64v9wjKxvt5CimF6cjjTVbBDB-WdLhDObKlHKZ-Dr-cljbFGheu38hhZrQhSNM_pfe09LcI7HMVDmRPdxLapfrf6lId-biMliNhxzuYEmW5cHL6u15A85w_A9vY7OFRJdbGHc/s1600/screenshot.29.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMmL_Y-QtQIeGoSqTAWMs97qRE0RnSPWqImgKNZ5FOMfcNhwxHoPgw06A_F8Kf8fuSMuALmIWjGOmefw6tJBwKuKq-sZZHwIfXV6jBPh-IhGSdy7KM5n9CHYhmBCPsXOKUtlhmM6E-0OGc/s400/screenshot.30.jpg)
4 - CAPTURING THE 1st FLAG
- Reading user.txt:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjazSKcFHch6d2DPMBNm_dYJTPjRgaMm9uw7Z0K5nC7Cfr8aZyNybeEbFWVC65x2bYVkgMX8lBt2pUUFyjUu4Xrg8vaC1rCrgRQr1-b8YjdPMtWxw3EDR6ceNp91oStBO40hdQb3HvAXB_Z/s1600/screenshot.31.jpg)
5 - PRIVILEGE ESCALATION
- Access to Administrator's account is denied, as expected, so we need Privilege Escalation:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkrB4eqzsTRmNRtJt92ymprLf6X8xzjPGRJAHGaA97gDk6k4ZGkjuIZl8O6vFy2cDRaTJAxAZSFSZRzn0vvDHnsE1zdURcIw7-eJQVNgsk_WTeyLHieRWbXRfRRWttdgC1LI6XqP-f7tjq/s400/screenshot.32.jpg)
- Checking user tyler's Desktop there is a file bash.lnk:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsGWQgA-QU11YZip1J9rCGRm9qW0BWQbQOMuLDU4uILC4m5K47rm3tAH8oUKL4TEUwiXet8oWhhbH8de1UVcb11V6jdLQacN8_xo4riy19I-FWuuBiaiK8BMMgF2bkmj1PMscpYorHn2zf/s1600/screenshot.33.jpg)
- Windows Subsystem for Linux (WSL) is a compatibility layer for running Linux binary executables (in ELF format) natively on Windows 10 and Windows Server 2019.
https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux
- Reading bash.lnk the path C:\Windows\System32\bash.exe seems to be interesting:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQBS2FPsr37Y4gBavMX36Lk0_GETO6SHjS8J7HghFtjW24eRYDMtU-A16G6w4Tl_ud-zxsARn89aOZf16dPjr-xnFZXl-gLpO2-FY0lPQyG3bGHvwOF8wpE3QkQbHfXjTx5M9Z92frSv7P/s1600/screenshot.35.jpg)
- However the clue is false because there is no bash.exe at C:\Windows\System32:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2WrpdYYAlCvXUX33R-2oZDtRWu0S6is_zx09K9_S0TmDPTmm7ycoI94ds9jUi618cwnd258LoGx2cN3QqCqjM5WXUDknYARbFU2HB_I0Czt6l1QUMRGrTaFtpL3Ijgv65kS5s5CtlYt8T/s1600/screenshot.36.jpg)
- Let's find real location for bash.exe:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5UFsQK7rVczpRkhJ5BWjxRbJRxYHMea0e6jDw2visdO8QSOsLDz2srHInZp9DHmJiaZfSW1HBghD0xURCNg14ElEXMnzfh0xFCtv2PUNzUhustT2eqhuSz4otcJo1M6tjc0iV7XA-ckTE/s1600/screenshot.37.jpg)
- Running bash.exe we get a root shell for the Windows Subsystem for Linux (WSL):
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlwaLej9SsDhGq9utzQYvoqfxUmOdxkYL3gHK_A4k1PtWNu9J-XHslYPjdiGRvtFABhsdGcz8n85gpxk9q8ptWN39z485NBiFUzRgdj7z9vKwRYsSk7dfDwDbXHgMIdhO6YG_b9e2OhM6l/s1600/screenshot.39.jpg)
- Improving the shell:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiexD05tmSUnrFX45E5nuS6D4O8V1-xXAYPrBj0s-eo7BM4P1iVCFm4AqUSYYNM123j2-5yytJmCVK5cGNIHrMdwuyejFYIrz0pcqD4HLgYFdCzmB1gB7_zokG1vnnkQEhpl3d81cBxVRF8/s1600/screenshot.52.jpg)
- Checking content of root home folder there is the hidden file .bash_history:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmHtMRTWp8Wc0UQB_kGy9SLj1whmDEBlVpU9fEZRNnmiVYFvgGV9XA6e_MqPegH65wmRXP4TFGPD04R-ebVFpgs7kTwF30ueS6LJtTr0uGoKIuDu7GqBGhSh4E4ou8RWyedfF0UDY8NqAK/s1600/screenshot.42.jpg)
- Reading .bash_history credentials for Administrator are available:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBTM0hxQLLK0iywhJ9Ntr1LTagG97uIZwDUGAHlUTmvA7zvhlrH1XigWiZaelYORsTMzpXIcog6ukq5O7mbPBIDJ9KB76py_fF1bxhy-Q950waMCzrA3Y-G3ei5hiPkw6mgo-CMAr3L10p/s1600/screenshot.43.jpg)
- Making use of credentials administrator%u6!4ZwgwOM#^OBf#Nwnh there are two ways of accessing the Administrator's account:
5.1 - Smbclient
- Connecting with the SMB service:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4hB5y_j_5_e-kO3z9e0OJYlJ7ugfnbyPiAbw44EmlaijlMtEzQtHBtZA2JAedC3QUaNfbz_I_fRiC_ZbI-0J5BQ5lk8oZ9WioO8cpn-sl16VRUVTBBla69pk4JoRqCeh4QjAhkBkHTpW9/s1600/screenshot.44.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMgroXV82lkr_gULPelgC_DExd-wTstjYnjI7UZLJ-uGdZNT4lG62b9S-kg7tbY1fFaNkjsEWKzQ2kgxbIUK-HUMtPmcsP3seRp9bBOnMBuqZueq7kyy2MZvDcu_ZrUvvMLYRAYEIcGm0S/s1600/screenshot.45.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAdqwjqcrjr9RUczhVJzRiqtNpBQNV0myUJ4IQE3SYf2sLr3C2FdV2dtvm4WnfVmqcdDE9nqOOX0Vy2XRjyQfUaXSvqk-9e2vrXcAtkyfJ0ZAerbGj3EqsnZZPL6Eu4DTFyIoAeyIozVo2/s1600/screenshot.46.jpg)
5.2 - Psexec.py
- The Impacket Psexec.py Python script helps to get a remote root shell, just by providing credentials for Administrator:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyEUZB495l7KuQg1DhyCJ4mQSM7lM4Dy5ML69yBkY5FLYuiBVRTSjJpEQHEXkbM8f2sRWOtl5OsuckzVPd9LVZPvwUvOxS83mrBgARoLcpRmIyoSiwAmQ_qVlspIOrBPDfkNpVmDOu3h8Y/s1600/screenshot.49.jpg)
6 - CAPTURING THE 2nd FLAG
- So we have two options to read root.txt:
- First, transferring root.txt from SecNotes to Kali and reading it locally:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhZfsqqjJvNxg87zd8IGb0Dajw0sYEiutvORzDBuaM8CnvaKkLNKpKlMEGQPUjiYjNPh6SMmk4_4Z44JLEfe8tSe1xFsmpR0OXgkFfnyWkZpu47r4oVGD1m7wCT0Tu5DQwOZ0iugI5ShJb/s1600/screenshot.47.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjFXQnmgc526zpN70VikI6lu0oyeQyTnQ7Di-m6Wr8zJuRm1UpyCI9duXQfCO0efSXNgeBV0O1O-DWCZtDNme9M3SXoaV9tFNug5cS-ynkFOaEpABKgh7IYbv46SnyS2DhiO4IVQOxTUX75/s1600/screenshot.48.jpg)
- Second, reading it from the remote root shell:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOgTkkpNZp7rfm8L4NBcLqFjLFvIk08gIgNtsgVqnc6FCs7O22MhiqIxSgWifyla40Ei6tEUC0xuzLJSSkaEQnOd4PjbQAOJK7wGHMlgUi_W3kQpMu2IOSgK32jO-8RA9DGj7EzGec1PC7/s1600/screenshot.50.jpg)