Ladies and gentlemen, the President of the United States, accompanied by Senator and Mrs. Chick Hecht. Well, thank you, Chick. And also Gail, who's with us here today. And I, too, would like to add my thanks and appreciation for the Elko High School Indian Band and my good friend Paul Laxalt and Congresswoman Barbara Vukanovich. Thank you all very much. It's great to be back in Reno, Nevada, with a day I've come for a very special reason, because I want to talk to you about a friend of mine, a great senator from Nevada, Chick Hecht. Now, like Chick, I've had a career of being underestimated. Started a number of years back. I was under contract to Warner Brothers Studio in Hollywood when it was announced that I was running for governor. And somebody told Jack Warner about that, and Jack thought just a moment, and then he said, no, uh-uh, Jimmy Stewart for governor, Ronald Reagan for best friend. But Chick Hecht is a scrapper. The people who bet against him in 1982 should have learned their lesson. If anyone is so foolish as to be betting against him this year, I got a piece of advice. Try your luck in the casinos, the odds are better. Reno, of course, is known for its great shows, the lights, the costumes, the headline entertainers. That's sort of like the United States Congress. But in the Congress, they have an old and wise saying. There are two types of senators, show horses and workhorses. Chick Hecht is not a show horse, he's a workhorse. He gets the job done for the people of Nevada. Chick doesn't grab headlines, he doesn't show boat. Chick's the kind of senator who doesn't make a lot of noise. He just gets things done for his state. He works hard, he's effective, and he has the respect of his colleagues and the admiration of the president and vice president of the United States. And both of us sure want to have him in the Senate next year. I think George Bush wants him there even more than I do because George is going to need Chick's help. But I feel a special friendship for Chick. You see, we began working side by side long before he went to Washington. He joined with me in three presidential candidates spanning, campaign spanning two decades to bring our conservative principles to Washington, DC, that puzzle palace on the Potomac. You know, I think it's important for one of us, either me or Chick, to be in Washington next year. And it has to be Chick. You see, we flipped a coin and he lost. But through three Congresses, Chick and I have worked together, fighting special interests to cut taxes on America's working people. We back strong measures like Graham Rudman to put a collar on congressional spending. We worked for a strategic defense against ballistic missiles for judges and justices who would respect the Constitution and get tough on criminals for a strong national defense and to support brave freedom fighters in our hemisphere and around the world. And if that's what you believe in too, I think Chick has earned six more years. Don't you? On the Nevada ballot this year, there will be two Democratic governors who want to go to Washington, one from this state and the other from a certain state in New England. I'd say they're tax and spend twins. Both are big spenders and both have raised taxes more than any other governor in their state's histories. I have to tell you what a big mistake it would be for Nevada to send a jet set tax and spend liberal to Washington. This would be like sending the fox to guard the chicken coop. You know, up until Sunday, the opposition objected to being called liberal. Not because it was false, but because it was true. And now they've come clean and they admit it. They're liberals. Of course, the liberals now are saying that they're on your side. I guess they think that'll make it easier for them to reach their hand around and put it in your pocket. But if you care about fiscal responsibility, that means keeping the politicians from stealing your wallet. Here's all you need to do on election day. Step into the voting booth, put your hand on the lever and say right out loud, read my lips, no new taxes. Of course, on election day, I don't think that's what the governor of the state plans to do. I think he's going to vote for a liberal governor from New England. Doesn't that tell you something about how he would vote in Washington? And doesn't that tell you something about who you ought to vote for, for the Senate? The bottom line in this election is that Chick Hect is a strong conservative, and unlike his opponent, he will never have to take orders from the liberal leadership of the other party. And that makes a difference, not just on taxes and national security, but also when it comes to confirming judges and fighting crime. Two issues where the liberal leadership in Congress has gone so far left that today voting against them has become a matter of self-defense. I can tell you that the reason violent crime has fallen sharply since 1981 is because we put criminals on notice. We said, make a false move, and the next sound you hear is the clang of a jail cell door slamming shut. Yes, if you ask Chick or me, there are no citizens more precious than the men and women who guard us, our state and local police. Chick and I believe that when a drug dealer murders a policeman in cold blood, that kind of killer deserves and should receive the death sentence. But the liberal leadership opposes capital punishment and tough-minded judges. The liberals oppose voluntary prayer in school, but favor tax hikes, gun control, and a weak-need defense policy that only a McGovern could love. Their views could only be described by the dreaded L word, liberal, liberal, liberal. So let me ask you to do something and I want to hear your answer. Will you promise me that on November 8th you'll go to the polls, and from top to bottom, and especially for Chick Hect, you'll give your support to our Republican candidates?  You'll be able to drive, as he said, at 65 miles an hour. Now, from top to bottom, from president to Congress to local office, especially here in Nevada, this is what is at stake. This election year is a referendum on liberalism. But the opposition, even after finally admitting their liberalism, is still trying to deny that they've left the mainstream behind. And now belong to the party of McGovern and Mondale. That's the type of liberals they are. No, the fact is today, if you want America to be what FDR, Franklin Delano Roosevelt called a great arsenal of democracy, if like Harry Truman, you want to continue to help those resisting communism, if you believe in lowering tax rates like John F. Kennedy did, and in the traditional values that you grew up with, then you should vote for our Republican ticket because that's what we believe in and the self-proclaimed liberals don't. Yes, the choice before the American people this year is just as clear as it was in past elections when I stood before you. A choice between, on the one hand, liberal policies of tax and spend, economic stagnation, international weakness, accommodation, and always, always blame America first. And on the other hand, what we believe, the policies of limited government, economic growth, individual opportunity, a strong defense, firmness with the Soviets and always, always I pledge allegiance to the flag of the United States of America. Back when I took office, America was in the worst economic crisis since the Great Depression. But today, America is in the longest peace time expansion ever recorded. And as you've been told, we're now 72 months. We've cut taxes, slashed inflation by two thirds, and sliced interest rates in half. Since the economic recovery began, we've created over 18 million new jobs, good jobs, more than three quarters of them, the kind that pay $20,000 a year and up. And the unemployment rate in Reno has been cut nearly in half, and statewide real personal income is up by over 30%. Today in America, a greater proportion of our potential workforce is employed than ever before in the history of the United States. I'm not just looking at the unemployment rate. That is because there are always people between jobs and newcomers coming into the job market. But that potential employment pool, that is considered to be, and hear this, everyone in the United States from 16 years of age and up all the way, including the retirees and so forth, that is considered to be the potential employment pool. Well, today, 62.7% of that group of citizens are employed in jobs in this country. Thank you. Of course, of course, the self-proclaimed liberals still don't understand how we were able to get rid of their economic crisis, their malaise, their inflation, and their gas lines. So in this campaign, they're treating good times as if they're a given, as if it just happens. Well, their message is, you can take prosperity for granted. It's time for a change, so take a chance on us. Well, that's sort of like someone telling you that you've stored up all the cold beer you could want, so now it's time to unplug the refrigerator. But, but, but whether it's a well-stocked refrigerator or our economic policies, you can't unplug what's working and expect things to stay the same. And with the work and the support of Chick Hect, a key member of the Senate Intelligence Committee, a man who in fact served his country as an intelligence agent, our country is once again respected in the world. Our armed forces are strong and America is at peace. And we and our NATO allies stood firm in the face of Soviet missiles pointing at the heart of Europe and Asia. And Mr. Gorbachev got the message. He did business because we met business and we still mean business. Now, one of the most important ways to show that we still mean business is to reelect strong conservative Republicans to the Congress, people like Chick Hect and Barbara Vakanovic and to elect good Republican challengers like Lucille Lusk down in Las Vegas. I'm asking you on election day to send a message that will literally be heard around the world. The fact is, if the liberals had had their way, there would have been no INF treaty or rollback in Afghanistan or democratic triumphs around the globe. They oppose rebuilding our military defenses. They oppose the deployment of the missiles in Europe to counter the Soviet threat. They oppose the liberation of Grenada. They oppose the raid on terrorist Libya. They oppose our policy of helping freedom fighters fight communism and advance the cause of liberty around the world. But Chick has advanced our cause every step of the way. And that's one of the reasons I can tell you the day that in the past eight years, we haven't lost one square inch of ground to communism and in fact have returned one small country, Grenada, to freedom. So ladies and gentlemen, those are the stakes this year, high stakes. But this one is not going to be determined by a spin of the wheel or a cut of the cards. This one is up to you. On November 8th, you can help Nevada and help America hit the jackpot by sending Chick back to the United States Senate. This election is about what type of senator Nevada will have and what type of Congress the next president will have. Some people say that it's time for a change. Well, ladies and gentlemen, we are the change. It began when you sent us to Washington eight years ago. And now it's up to you to keep that change alive by re-electing Chick heck. And we've come much too far to turn back. So if you would, I hope you will just help win just one more for the Gipper. Thank you in the bottom of my heart and God bless you all. Thank you Mr. President for those inspiring words and you've given all of these young people out here something to think about, not only in this election but in their future years. Now Mr. President, we have a real Nevada surprise for you. So if you would just walk with me over to, we're birth is standing, we will show you our Nevada surprise. Mr. President, they say there is no sure bet in Nevada. But when you pull this handle, it will be a sure bet for all Nevadans. Now you know a donkey can't do that.


Private consultants such as certified wildlife biologists and registered foresters should provide you with a management plan specific to your property. The first question asked should be what are your objectives? Once reasonable goals are established the next step is an inventory of all resources and notable features on the property. Forest inventory from a wildlife perspective may be as basic as recording forest type and acreage but if you plan to harvest timber you will need a full timber cruise. In addition to inventory a management plan will have detailed maps. These maps will be used as a visual of what currently exist and serve as a reference for where specific future management actions will take place. The last component of a plan will be a timeline of events. This will include specific management actions and the time there to be implemented to achieve the objectives established.


Good afternoon, folks. Steve Rhodes coming to you live from the shores of Delray Beach, Florida. This is your 2 p.m. update. A bit of a mixed bag out here. And the mix isn't that big. You've got the only indices traded in the downside. The Russell's off 12. New York Stock Exchange is down four. That's basically flat. Otherwise, we've got the Dow up 65. The S&P 15. NASDAQ 61. Semi-7. Trendy's 155. You've got gold down 14 bucks. Silver's off 49 cents like to recruit trade out of 84.67. That's up 91 cents. Natural gas up two pennies. The 30-year treasury. She's trading at 158.29. That's up 12 ticks. Let's go spend some time and take a look at our industry charts out here. Give me a moment to switch over to those panels. And as this comes up on your screen, you're going to see the Dow in the upper left. In fact, you take a look at the Dow, the S&P, the NASDAQ, the Russell. All four of those along the top. You'll see that they are going to form bar number 9 of a TD9 count pattern today. Now, there's also A to B equals CD patterns out here. So we've got two patterns that are in place. With regard to and we can see that the oscillator and change lines, those are the red-green lines have changed colors. So we know that eventually price net line are going to catch up to each other. In the TD9 count series, a higher high can form tomorrow. And then that high, whichever, whether it's today's high or it's tomorrow's high, we won't know until the end of day tomorrow. That creates an important threshold level. Why? Because if price closes above that and does it in a few sessions, that tells us about strong lament to move to the upside that we are very likely entrenched into that favorable seasonal cycle and that we could have a consolidation breakout going across the board. But we don't have that signal just yet. The signal we have is that we should anticipate some type of top, short-term top, and price pulling back and testing that green oscillator and change line. You would expect because we're in the favorable seasonal cycle, that price will come back, test that and reject it, and then we're off to the upside. We are in a consolidation pattern. So if price pulls below that green oscillator and change line, closes below the oscillator and change line, then maybe that's similar to us that the consolidation pattern that we're in continues to exist. So that's really the play along the top of the first four. You do have bar number nine now in the semis. You don't have that in the trannage. You're only in bar number seven. So basically as I take a look across the globe out here, you've got to these five indices. We don't have it in New York Stock Exchange, but we do have it in the composite. So we've got everything that we need from the TD-9. Tomorrow still could be a higher high to suggest that we should see some type of short-term top. Folks, stay tuned. Your favorite polar bear, David Whiteson, next with the Power Trading Hour. Tom O'Brien, he'll take us on home. And I'll be back with you on wonderful Wednesday. Have a terrific Tuesday, folks.


All right, let's look at the first section from the side so from your Wu Chi stance feet together knees slightly bent tuck in your tailbone Head nice and tall arms relaxed Now we're going to drop some more bring our hands and fists to our chest flush with the front of the chest open toes open heels Double cross block spinning back fist back to your chest Left hand that fist point to your target straight punch tan so pin so it's okay right fist to the center straight punch tan so pin so and so can You double chung so Pick it to the left with the left hand over right Double line so around your sternum level Give it right to the left double fox out drop your shoulders and double tan so And then I don't know left left over right I don't know left Right palm left palm right palm and give it to your right with the elbow elbow Don't sell yourself with it second time third time What time now place your Wrist on top of your other wrist straight punch Back to the center box out to the left while you're still looking this way some south Place your wrist on your elbow joint and then scrape and pull the other Chop Time saw himself and back now repeat for the right side That was himself Give it to the right. Now I'm right hand over left So that right Double fox out chop your shoulders. I mean job your elbows Left over right That palm right palm left palm Get into this position On south this should be sternum level and This should be a fist to get more power in your elbow. This elbow pulls back That's how it was out second time third time and fourth time Place your wrist on top of the other wrist the straight punch of this one pulls back and then Box out to the right while you're looking this way from here.  So that's the first section on the side


Hey there friends, how's it going? My name is Kevin and today we're playing The Sims 4. And it's about time we introduce a new character. It's already been introduced to the Kevin Cinematic Universe. And I feel like it's time to join the Jim Pickens Cinematic Universe. His name is Terg. Speaking of which, I probably shouldn't speak like this because my mic is on this side. But new Terg merch has just launched for a limited time, you know, it was just saying. And don't worry, I've got a mod that'll allow us to try and get as close as The Sims can possibly allow us. That's case end point.  Who you call a pinhead? It's gonna be hard. Do you even maintain concentration while looking at this thing? Jesus. I see you. Alright, I think we're getting pretty close already. That's not bad actually.  Oh my God, this is actually getting kind of accurate.  The closer than I thought we'd get. Oh God, it speaks. That was scary. Oh, I didn't like that. Let's try out a few different hairstyles because I feel like this is close, but maybe we can get closer. Honestly, they all just somehow make him worse every time I change it. He looks exactly like the detective from Detroit Become Human. Am I right? I think he's kind of done facial structure wise. Honestly, closer than I thought we'd get. I'm disappointed we can't get the eyebrows, but that's just impossible since they're literally floating off his face.   He would never do that. That kind of works actually. That kind of works is his eyebrows. I wonder, can I move them at all? No, I can't. That kind of works though. I'm happy with that. You want to know how I got these scars? There we go. I don't like it. There you go. I think his face is done. He looks beautiful. I think that's pretty good. I like to think these are aslas chaps and he just has them on backwards. It's a very turg thing to do. My name is Turg. Okay, what is his personality going to be? I think he's going to be really popular. That's what we've seen so far. Or he could be a serial romantic. Same thing pretty much. And that's the main goal I want because you see Jim Pickens is the opposite of Turg. Jim Pickens kills everyone. Turg is going to repopulate the neighborhood and also set us one stage back in evolution. Alright, he's romantic, cheerful and good. I think for everything he's going to be naked. His everyday clothes are fine and then everything else he's just naked. He's ready to get it on. I think that's a good picture for his family photo. It's like, well, this happened. Now, I think what I want to do, for some reason my neighborhood has this dog that just lives alone. I assume I just killed his owners or something. I'm thinking we move him in with him. I don't want to move in with the original household. That'll come eventually. That will happen. And it's not going to change into a Turg series or anything. I think it would just be nice to have two different households for this because there's so much else going on in Jim's house right now.  He's definitely going to get on well with the ladies of this town. I mean, Jim killed most of the men, so they don't really have much choice.  Alright, what furniture does this dog have? He actually has the basics for some reason. Alright, this'll do. His bedroom even matches Turg. His first goal is to have a boyfriend or girlfriend and he'd go on two dates. So let's start on that. You've got to get people pregnant fast. Oh no, it's winter and his outdoor clothes is just him naked. This isn't going to go well, I don't think. He's just eating applesauce. We're waiting for the welcome wagon to arrive so that we'll actually have people to impregnate. I mean, socialize with. Same thing. He's got a bit of money. I think I'm going to make him a little love shack. This one's called The Master. Yeah, I'll buy that room, please. Oh God, I'm going to have to replace somewhere. I can't fit it anywhere. There we go. Great. This dog is going to be mortified. What I've done to his house. Oh no, he's gotten into his underwear because it's cold out. Turg doesn't understand. He's like, Turg's he breathed. Maybe he's trying to figure out what it means to have a reflection. It's like watching a dog see themselves in the mirror for the first time. Stop flirting with your dog, Turg. Why is the welcome wagon not coming? I think I'm going to have to go out and find people because they're just not coming over. Luckily, there's a restaurant right across the road with a load of graves. You don't have to be polite, don't worry. You can talk about it. She's like, which it's specific thing you're talking about. It's kind of weird playing as someone else in Jim Pickens' world because it's like it's a spin-off show or something. There's pictures of him up everywhere and you can feel his presence.  Oh my God, what is that? I guess because of that mod, my game's like, I'll just spawn people with these random sliders. Oh, she's an elder. I can't make them have babies. I'd be very interested to see what would come out. You know what? I think I can actually mod this. So let's see. I think I can force de-age her. Age down. Oh, there you go. Now you're ready for babies. She's like, oh no, you just made my existence longer.  Look at the picture on the bottom left. It just stretches her face in the circle. Oh, amazing. She likes it. She's never been flirted with before. This is easy. Now stop crying. She's cowering. I don't know which one she's cowering from. Ducky, she's running away. That was the waitress, by the way. She's gone. Stop crying, Turk. Pregnator. Hey, honey.  Let's try to give you a reason to live, but I think I just gave you another reason to want to die. And that reason is me. What is happening over here? This is just a fecking disaster. I'm starting to finish. Look at this guy. This poor guy is crying. Yeah, I think I may have cursed my game like entirely. I'm kind of scared because I'm afraid when I go see Jim that he's going to be morphed. Ask to be girlfriend. This is something he really wants. Why do you keep walking away? I thought her eyes were just hidden under her eyelids, but I think it's actually one single eye in the middle. Stop rejecting me. Be my girlfriend. He's freaking out. Every time I interact with her, she just starts crying. And I don't know how I feel about that. Stop. Just kiss him for fakes sake. This is hurting me. Okay, we're going on a date at least. At least there's that. Please. Just like him. He needs this. She's already dining with someone else. Oh my God, it's puffer fish. No, no, no, no. Get another table. I forgot whose restaurant we were at.  Someone's dead. Let's just ignore that. Don't let it ruin your date. Maybe stop eating the puffer fish though. She took it from her previous table over to her new one. Okay, here's her table. Can I order for everyone? Is that possible? Order for table. No, look at that selection. Well, have the puffer fish and I'll have a water please. We'll just have to chance her arm. By which I mean chance her arm. Excuse me. I know someone died, but I'm hungry here. Well, thirsty, I guess. Could I make my order please? I keep just getting up and asking her to be my girlfriend. Yes! It worked! He has a girlfriend. No, that's feck. There's a coffin right outside we can use. All right, you're going to have to have your first kiss first though. Oh, this is going to be magical. All right, let's get a little screenshot of this. You know, just for the scrapbook. Oh my God. The waitress is getting in the coffin. Get out. Oh, she's crying in there. All right, I guess everyone gets like five minute break off their work shifts to just go cry in the coffin. Is there anywhere else? There's a shower. There we go. Try for a baby. Could we do this before you have your puffer fish if possible? Stop. Stop eating that. Stop eating it. Hold on. Go try for a baby. Nom, nom, nom. No, not nom, nom, nom. Stop it.  Come on. Make baby. How are you alive?  It's just an arch. All right. What about this bush? Will that do? Oh, he really needs to pee. Okay. Jim's going to watch over you as you do this. Turkey's about to woo for the first time at the entrance to a restaurant with a woman whose head looks like a hot air balloon. Someone else is dying.   I mean, if he has eyes, I'm not 100% sure. All right, everyone, I know this isn't the best time. Someone is literally dying, but we really got to work on repopulating this place. So you can keep mourning and everything. We're just going to be over here. Oh, sorry. I think my dog just pissed on your floor. Sorry about that. He found two crow feathers and a pigeon feather. Well, that's just great. I think it's time to go home. Let's get out of here. Maybe this wasn't the best place to come since everyone's just dying. Maybe if use twins, then the whole thing will cancel each other out. You know, we lost two people, we'll gain two people. Pet fears. No pet is truly fearless. Each pet has its own unique fears. It fears probably me. It doesn't understand what's going on. I think it's sick. Should we take it to the clinic? Maybe we can impregnate some people there. Let's go. A Turk would fit in well in the sim world, I imagine, because they always talk nonsense anyway. You just stand there going Turk, Turk, Turk, Turk to Turk, Turk. Oh, the vet. Great. She is hot dog. So that should work well for Turk and Turk. She is friend, not food. Turk, that's someone else's pet. What are you doing? Why is this vet naked, by the way? All right. We got another girlfriend and she brought her own mistletoe. That's romantic. Where can we woohoo here? There's no bushes, no beds, no showers. What the heck? Wait, can I buy stuff here? Is that possible? Why does it allow me? All right. I'm buying a shower. They can business expensive. They'll be like, it's a special animal shower. Just met this dude.  They're just all over each other. He must just be like, how come he can score? And I can't get anything. Must be really insulting. All right, there we go. He's back. He was back to watch, but they're done. Now you can just watch this instead. Is he asleep? I can't tell his eyes are still open. This is just so cursed. Everything in this play through is just cursed.  But I'm glad to see him happy. Your pet needs you. What does he need? What's wrong with him? What does that mean? What does a food bowl mean? Be more specific. What do you want? Oh yeah, by the way. My dog, he needs attention. He keeps needing this food. And I just don't understand him. I think he's broken. Turk is a good guy. He'd feed his dog. Well, his owner. Whatever you want to call it. I don't know what's wrong with my dog. He's stinky. He flies around him. He needs medicine. She's just like, you just need to feck and wash him once in a while. Now that is a medical emergency.  Are you an elder and an adult? I need to know canoe of kids. She's an elder.  An adult. Yes. She's fecking exhausted. All this baby making is wearing him out. Ask to be girlfriend. I don't think Turk understands what that means. He's just got these primal urges. He just doesn't understand social norms. All right. Where's that shower? Hopefully that other lady doesn't come in. Oh my God. God is angry. The whole world is shaking. Is this an earthquake? Scared by possessed child. Oh no. First name is here somewhere. Where is he? Is it that raccoon? What is going on? Everyone is running away. Oh, sweet Jesus. Okay. Time to leave. Jesus Christ. His face got warped from the mud. He's going to be even more angry now. Turk, you don't understand what's about to happen. Okay. He went away. He went away. He's fine. It's fine people. It's okay. Back to making babies. Repopulate that neighborhood. He was just going on a stroll. For some reason, my dog's watching. Should I check him in? I don't know if anything's wrong with him, but it might be for the best. All right. That's good enough. He just makes sure he gets the job done. When he sleeps, he's actually more scary somehow.  They're probably more like, oh my God. I just met this most amazing man. He is so unique. The other one's like, oh my God, me too. He's so turgolicious. All right. What's wrong with him? Three ring flea circus, expensive treatment. My owner deserves the best. In the meantime, someone else has showed up. All right. I asked to take her on a date. Let's go to exactly where we are for a date. Wait. Why can't we go to the vet office for a date? It's normal. All right. Fine. Let's go back to the amazing bedroom my mate for a turg. All right. If this doesn't get a pregnant, I don't know what will. Honestly, just the sight of this room and turg standing there is under where should do the trick. I like how he still gets changed. The exact same outfit. Maybe he changed his shoes. Can we get a replay on that? Bunny slippers are irresistible to be fair. The dog going underneath the bed midway through. In some cultures, that's good luck. That's my culture. My culture. It's good luck. Wait. My dog is running away. She'll make her way home eventually. But posting an alert via a computer phone can help to find her. Oh my God. My owner's gone. Have you seen my owner? Post alert about missing pet. I even took it to the vet. I tried to care for it. I'm just not used to caring for things in this game. I should have fed it. I think that was the one thing I did wrong. Probably not best you go outside. I don't even... The hell is that thing? Ah, yes. Your girlfriend. Of course that's what it is. She just ate a whole lemon. One bite. That's why she looks like that. But I was about to say, I don't know even why you're going outside. What are you doing? Shovel snow? Naked? Really? No, go back in.  You have four girlfriends and probably at least four children to look after soon. I don't know how he's irresistible. Look at the state of him. He stinks and is covered in dirt. And he's like, let's make baby. Turg discover birds and bees. Then Turg discover fire. So I'll call you. Have a sim bladder fail while on a date. Fantastic. She still loves him. Doesn't matter. This will set the mood as we sit down to eat her bowls of applesauce. Sorry, I don't really know how to cook.  That's the applesauce, not me. There we go. Now he's fallen asleep by the fire. If Turg really tried, I bet he could be one of those rugs like the bear rugs. They're just flat out in front of the fire.  I don't know. I got a bronze. That's not bad considering. Well, I didn't pay any attention to her other than the fact that we impregnated her and I pissed my pants. All right. We're finally getting him clean.  Yes. The dog is back. Fantastic. I'm actually going to feed you this time. He's just figured out he's to feed himself. Okay. He's not a bad dude. He just doesn't understand. I should probably give him some love yet. Hold on. I don't know how to do this. How do I love things? Also, I should probably edit the dog so it's more recognizable and people will know it's mine if they find it because I have a feeling it's going to run away again. Here we go. Nice brown. Who knows what Turg wrote this with? Let me run out of space. I'll just keep going. Oh my God. Oh no, I've mirror on. No. Okay. It's just going to go all the way down and turn like that there. Turg's dog. That looks nasty. I might give you a new coat so it's a bit more visible as well. There you go. Nice pink. Brown is very visible on pink. I'm going to shave it back too so it's more visible again. This poor dog.   Look at this. Yeah, that's great. Now it'll never run away again. If it does, people will know that it's Turg's dog. He doesn't look too happy though. Why is it so dirty? No one's going to be able to see the pain if you don't clean yourself. I'm going to need to buy a bath. But for now, I think we've done enough good in the world for once. Except for, you know, the dog. But at least it won't run away anymore. But I hope you guys enjoyed the video. I know I did. It's nice to do something a little bit different in the Sims. And don't worry, Jim will not be forgotten. Turg is just an addition to this Jim Pickens cinematic universe. But yeah, I hope you enjoyed. I appreciate you watching as always, folks. I really do. It means a lot to me. And I hope you're staying safe in these trying times. And I hope to see you next time. Bye for now.


Hello everyone, my name is John Hammond and welcome back to the YouTube video today We're looking at some hack the box showcasing the remote room that retires today. It is an easy easy I guess medium. No easy. It's an easy windows box I'm just not that good because it's windows, but I wanted to showcase this walk through it with you So here it is remote and we have an IP address to work against. It's 10 10 10 180 We can fire up a command line and get to where the good stuff happens So I'm gonna head over to my hack the box folder and I'll make a directory for YouTube remote and hop over there So we could start with some good practice actually create a little read me file And I will just put in some classic notes. Hello. This is me writing this on the day Which is September 45th? And here's the IP address of the machine. Let's start off with the classic rust scan I'll pipe this into a rust scan log sort of tee that and we can see what we're up against Okay, some ports that are open. We see port 21 for FTP port 80 for HTTP 111 I think that's RPC bind. I always get that maybe wrong or something<PHONE_NUMBER>, okay, so maybe some network file share stuff Five nine eight five. That's odd and peculiar. You don't see him all that often Port five nine eight five. What is that? Win RM? Win RM. Oh Okay, I mean it's Windows that makes sense Maybe end map. Yeah, Ruskin will pass it over to end map and we'll kind of get better ideas to what all those things are But since we have some things to poke at let me get started with some classic enumeration I'll do a little Nikto on that guy T that To get an output file. I'll do the same thing with some go buster HTTP and I'll use a word list from the defaults word list that comes from Durbuster. Alrighty. Now, let's go check out the web page Welcome to ACME. Allow me to introduce myself. My name is Wiley Coyote Genius, I'm not selling anything. No, am I working my way through college and check out our products? Okay, awesome a Couple of blog posts looks like all lorem ipsum text if I click on any of those Do I get an idea of a username this page loads? Nope? No No username more lorem ipsum and nonsense Products is that a real link?  Okay Nice crazy people Great or these are real lengths circuit beard. Oh, yeah, these are Super cool. Great Let me just click on The source here. Let me hit control you and kind of see what it's built in in the HTML I see some HTML comments for navigation media links add links to categories a Lot of that to do HTML comment read links to categories Scripts um, Braco or um, Braco. I always pronounce that wrong. I don't know the best way to pronounce it, but that's an indicator that Umbreco might be on here and if you Google what that is it is a CMS or content management system If you haven't heard of it before I think I've kind of seen it a little bit in other capsule flags or training exercises or activities Let's see what derbuster or go busters got Pretty much the same thing as previous and what we've already just seen through the web page Need to get anything yet. Nope and map scan is done Let me try and subble that rust scan log and that's gonna have all the gross colors So if you wanted to you could less tack R that and that way you can see the colors there at least from your terminal but Scrolling through it just to get a better idea of these ports. Okay, we do have anonymous FTP We could potentially log in with that It should you pee yeah RPC bind stuff 2049 NFS network file share and maybe there's something interesting in that And That's all it's got for me. Okay. Well, if we have FTP I guess we could take a look at that 10 10 10 180 with my FTP client We did see from our end map scan was that anonymous share or anonymous access was enabled So username will be anonymous and password could just be empty. You can whack enter there. Let's see what we have Nothing Okay, and we can't go any farther than that or explore anything else. So that's not helpful fantastic What else did we have we had poor 80 which we're looking at and we had the NFS share I Don't see anything else other than that intranet that they're going on and we didn't actually poke at that intranet Page is there is there anything over there? It's still mentioning umbraco in the CSS here umbraco Someone's gonna give me flak. Someone's gonna someone's gonna hate on me for not knowing how to pronounce that Does anyone know how to pronounce that? That's the same sort of thing. You're like, how do you pronounce Radair to Radar a? Radair, I don't know red R Jif gif Starting the holy wars here if umbraco is a thing is that a Location that like it's a content management system like the same thing like WordPress might be so maybe there's a page for that and my cursory Research on it just for the showcase Content management system publishing World Wide Web content written C sharp deployed on Microsoft stuff That tracks with me because we're looking at this on a Windows machine Just doing some quick learning reading to see Documentation to be found there. It's open source Are there any like default locations that it adds? Oh, where's all this? build What does this guy Quick tutorials Creating a basic site. Oh goodness. Can I just get to content? When you hit your local host address or whatever you're setting up You should see welcome to the umbraco installation screen and then Log in to your ubraco Cms installation on slash umbraco in your browser Is that a thing? Go Buster hasn't found that yet. Nikto hasn't found that Maybe we could try some other stuff or like add it into our word list But if I just simply try to go to umbraco or umbraco.  Will that get me anywhere? Who does that reflect out what I have in there, can I do like some cross-site scripting hello? Please sub that's a better one. That's a better one to throw in here. Please sub Slap that in now. Okay whatever, okay, we know though that there is a log in here and And We could do some other enumeration because there are still some other ports that we haven't looked at yet Taking a look at this. We know we have 21 was a dead end 80 was the web page obviously and 2049 NFS or network file share so if you guys aren't familiar with mounting and looking at machines that have NFS shares typically you can start with just a show mount command and tacky will Show mount. What does the tacky actually do? Oh if you like kind of the colors that I'm using within batch Excuse me. Whoa within bash In my Linux command line. I'm using Batman or bat some of the shell extensions that come with the bat a package Tacky and exports will show the NFS servers export list So the same way that I'm looking at like cat if I cat out my read me It has kind of nice color stuff. So if you're interested go ahead and take a look at that Anyway show mount tacky on our server here 10 10 10 180 and They have a site backups that everyone could access. Oh Can I try and mount that? I'm gonna make a temporary directory that just matches the same thing. Oh with the incredible typo dope Make directory back ups and I already have one of those so I'll recreate it for the sake of video And and then let's go ahead and try and mount to it So you can mount tacky NFS So mount specifying the type network file share and then what you actually want to mount So you're gonna specify the share with the IP address and a colon and then you can just specify the share That you're actually looking for so in this case It's site backups as we got that from show mount and then you need the location as to where you're actually gonna put it So I'll put it in that temporary directory site backups that I created and you do need root privileges to do that so whack a little pseudo on there and There we go, okay let's hop over there to site backups and We got a lot of stuff. Oh I'm Braco client Braco I'm just gonna like permutate all the potential possibilities of me saying that and Let's run like a find on here to see like everything that's in here and I'll put it in my Location where I'm working on this. I'll put in my notes like NFS listing dot text see what we get or anything is Find not gonna like buffer that or showcase that for me. Oh, no now there's stuff happening What do we got in here? So what we could do is we could kind of trim this down open it in like sublime text or an editor and just kind of like Remove the things that we know that we don't care about that could kind of help us Look for interesting things and prune for the potentially peculiar Stuff that we might be able to find some valuable and juicy information with Because a lot of the stuff like okay Google Maps pictures. We probably don't care about Same thing with like I don't know views Open there is Some of the binary stuff for on breakout config files will probably be useful for us Because maybe there's some more information as to how this thing is actually being put together Yeah, CSS files though. We don't need to care about media files images And there's a ton of assets and fonts in a Brecco that we probably don't care about Blah blah blah JavaScript files angular Yeah, okay Lot more javascript tiny mce or some code editing Settings views settings Mmm aspx files So this is I guess my process for like at least getting a quick snapshot of everything that's in there Obviously fine. We'll return a ton of stuff But you can kind of narrow this down and print it down and look for interesting things if you wanted to Oh Whoops, I accidentally like pasted whatever I was searching There is a web.config and that is usually something worthwhile to look at so let me go ahead and cat out that web.config and bat is giving us the nice color coded output And there is a lot of configuration stuff for on brecco and on brecco Image processor config on brecco settings config we could save that maybe took a take a look at that one if we wanted to What else do we have in here? app settings Connection strings ooh, ooh Yeah, is this thing going to use it like a database on brecco db database dsn. Whoa, what just happened? Why did it bring me to the top of the file? Did I lose that? Did I just lose what I was looking at? There we go on brecco db dsn. What is that dsn? Connection string with instance of a brecco dsn So that's definitely the database Yeah, yeah, okay, and that might be where it normally stores like a database and password So since we're looking at hack the box, right, there's no other box that it's going to like reach out and connect you This isn't going to be a full-blown network It's going to data source data directory on brecco.sdf. Ooh Is it a local file or it's storing the database? What is this on brecco sdf thing? You can see some of my previous research Is it just like a local database? sdf file Spatial data file is a single user geodatabase file format developed by autodesk. I don't know if that's I don't know if that's the same thing I'm looking at standard database format that Sounds a little bit more like what I'm looking at Do I have that file? These are variables data source data directory. I think I guess I can just look for This on brecco sdf So let me find and grep for that guy See what I have here Please get a hit Please please please Okay app data on brecco sdf. If I file that guy, what is it going to tell me? Data incredible fantastic. That's super duper useful um Just strings it dude. Let's see if we get anything interesting in that.  Oh right at the top administrator admin default en user or us Some guid GUID GUID Administrator admin and that looks like a hash Yeah, and then it specifies hash algorithm shaw one. Whoa Okay, and that's repeated a little bit. So this looks like a potential hash We could slap this in our readme nfs share found uh app data um brecco dot sdf Can I crack that hash? It's a shaw one hash Crack station. Yeah. Yeah, like crack crack hash online, please And that's totally the definition of crack station slap that in there fail at a captcha Bacon and cheese fantastic for The admin user right and that had That had his email in here. It's uh admin Being his username and admin at htb dot local Looks like an email address So can I log in with that? Bacon and cheese Ooh nice. Yeah. Yeah, okay logged in What can I do with this? Media settings developer developer. Does that let me do anything? Hey, wait, is there any like is there anything that like already does this if I search sploit form brecco? Am I gonna find anything? Remote code execution with metasploit metasploit Is that a thing that'll work? Oh wait authenticated remote code execution is this as easily What's that guy? neat dude didn't find anything else so Let's use metasploit to search for that see if it works upload aspx Will that do it? What do I got to know? It doesn't need like a username though. That's kind of weird to me Will it just do it? I'm gonna set my l-host to my Adapter and then I'll just set the r-host to 10 10 10 and 180 and just fire the thing off Execution failed. Okay, whatever. What was that other one? There was a there was a search sploit other one that I saw Um brecco Goodness goodness large terminal size. Make sure you guys can see this thing search sploit tack m this guy um Yeah, I'll just bring in the current directory. Yeah Yeah Yeah for this thing I'm brecco remote code execution by authenticated administrators. That's me login password host It's just forgetting a uh, that's uh closing quotation. That's funny So we have admin at hdb.local and we have bacon and cheese And our host is 10 10 10 180 Will this just do it? What is it gonna do launch the attack? What what code does it run? Am I gonna get like command execution executed calc for the poc? I don't really want that Can I like Ping myself. What's my ip address? Just to see if this thing would work ip 80 are Yeah That's me slap in my address and Let's Stop Go buster because you don't really need to do that and then let's pseudo Can I tcp dump like? Attack l i tone zero And then look for icmp. Yeah, I need to specify pseudo for that That's fine So I just want to get like a proof of concept to see if this thing will actually Execute that code. So let me python 3 that Four thing guy. Oh That needs to have the http schema It looks like yeah How about now did he do it or did I do something wrong? Okay That's fine Whatever I guess we will put that away We'll search plate one last time to see what that last thing was SEO checker plugin. Oh, it's just cross-site scripting. No, no, no. Let's do a simple umbraco exploit search Oh, no, Raj has one Authenticated remote code execution. That is the exact same thing that we just saw This one looks good Umbraco authenticated RCE Oh, and you can just pass stuff right through it. So that'd be really easy. You can specify commands What does this thing do? Some advisories on a packet storm a little bit more robust Uh Script here some arg parse This looks like a modified and better version of the thing that we were just looking at So the payload is using some xml and x sl To invoke A process Yo, yeah, it's just running c sharp through it Okay Let's try that guy It's a git repository. So I'm gonna go ahead and get clone this and Let's try to head over there and Run this exploit I need the username. So attack you admin at htb.local password was bacon and cheese IP address 10 10 10 180 And then the c for the command to run. I'll just do like a simple. Who am I your proof of concept? Oh, that also needs the http prefix. You can tell kind of just buy that python error. Like we're missing the schema See if that gets anything It does Okay, so Can I do that ping one more time just kind of like verify? Uh, I'm 1427. Is that right? Oh, what is that doing? Why did that fail? Did that fail unrecognized arguments? Oh The help says I need to specify tack a to note to note some args.  Okay, so Now what? We have code execution, right? Uh, we should probably like take note of this simple thing in our in our In our notes here Let's see if we can get a reverse shell This is a windows box, right? I could probably run like system info Yeah, and all this output is coming through. That's awesome Windows box x64 processor It's good to know the architecture. So Can I get a reverse shell? Um on windows you might need to do a little bit more clever things because it's not as easy as just running bash If you want to do a power shell reverse shell nashang is pretty awesome to do that Nashang is a framework in collecting the scripts and payloads that enables the use of power shell for offensive security pentesting and red teaming There is a power shell reverse shell that this thing has and that is in the shells folder here And there's an invoke power shell tcp.ps 1 It's pretty decent power shell code with a lot of actual description and documentation as to what the heck the thing is doing There's an example syntax here. So we could work with that If you don't have that downloaded you can get cloned it. You can work with it. I am going to Copy that from my op directory. It's in shells and then I have that invoke power shell tcp.ps 1 I'll put that here And then I'll modify that script There's no like good I don't think there's like a power shell Display or color scheme and sublime text, which is annoying, but we have this example here So what this is going to essentially allow us to do and wow, that's just really hard to look at Can I cat that does bat know how to work with that thing? Yeah, okay good So at the end of all this all this puts together is building out the functionality to Use that syntax like you would be able to run this and it would create all these functions that you could use or bind these Commandlets for you So what we want to do is at the very very end actually execute this So we could just stage this thing to fire off the reverse shell as we need to I know my ip address was 10 10 14 27 And the port number quad 4 is totally fine to work with So let's set up a Little web server python tack m Http.server Let that go And we have our invoke power shell tcp in the same directory as we're starting the web server so I could start my netcat listener to get ready for this thing And then I can try and fumble with the syntax of actually getting This thing to start so Taxi will let me work with a command. So let's run power shell And then we have tack a to pass in arguments. I'll make this a little bit easier to read so I could simply be like echo like hello or please sub just to get a proof of concept that i'm running power shell Oh, and I need to be in that Correct directory where that exploit script actually is So, okay, we get that output good sanity check now I want to run iex or invoke expression. So I would be able to run commands from a string So if I were to try and do that once again echo please sub following the iex This echo is going to come out into kind of standard output And then ix will just execute please sub as if it were a command in this case Obviously, there is no command please sub. So That tells me that that syntax might work So now I'll go ahead and create a new object and this is going to allow me to Do some windows stuff power shell stuff to get a web client object which has the function download string And that way I could give it my ip address 10 10 10 14 27 on that port 8 000 and download and run because of this iex all that string is going to be Pulled in and then executed invoke power shell tcp dot ps1 So ideally we'll see this web server see the request for that invoke power shell tcp The victim and target will run that code and then over on the other side here I'll see my reverse shell come through. So if I whack the enter button Hopefully we'll get some magic and we do now. I am on that box Awesome. Awesome. Awesome. So I can do a little who am I? And it looks like I am this weird Iis user. That's fine. Let me go to the root of the directory root of the file system here and let's see if I could snag that User flag. Let me check public. There it is I can run cat because I'm in power shell. So there is that user flag And I can't easily clear my screen So we'll just pretend you didn't see that who cares Next We'll want to try to do some enumeration and potentially privask do our privilege escalation So a really good way to do this is to run win peas or some of the privilege escalation awesome scripts I'll just search for win peas And Carlos Paul up. I think I'm butchering pronunciation as always. So forgive me Awesome windows privilege escalation tools for windows and linux. So you see me run lin peas probably all the time on Linux stuff, but win peas is also really good to work with they have a batch script rendition of it And I've seen that fumble for me. I don't know if it's because it's just slow to return or just didn't execute but The exe file is kind of really what we would love to work with If I actually go into this here, you know, there's a solution file for like actually getting the the source code and stuff for Working with it within visual studio and compiling the thing but they do offer under bin in This path here. They also offer releases and an x80 x64 or x86 release So you literally have the executable file you could download and work with I've tried to click on this and like download it raw And then I've had my browser yell at me because chrome would be like, hey, this is dangerous or Firefox would be like, hey, this this file is potentially malicious with that in mind This reverse shell that we did trying to run that invoke power shell tcp Might get triggered by windows defender Sometimes I mean most often if that sort of thing is on right So you might not always be able to do this specific thing and in our hack the box learning environment We can totally do that. I'm just going to go ahead and download this with curl, I guess So I will copy that link address and I will Close my ceiling meterpreter session because I don't need that anymore and let's get back to my hack the box YouTube remote file folder here. Let me go ahead and download this So I'll w get winpes.exe or you probably already have that repository clone and you can just move it in here Note that this is the 64 bit version. I pulled that one down specifically because we saw in our system info command That's the same architecture for this victim. That's just kind of a good thing to do I think the 32 bit one you can usually trust but Anyway, we've got that So now I actually want to download this file So I'm going to go back into my reverse shell of the victim and actually let me Mark that as black. So you kind of know There's some distinction here. I'll move into a temporary directory. I'll move into see windows temp And there's some stuff in here now, but I don't particularly care about it. It actually probably has soul some of my remnants of previously working on it.  We still have our HTTP web server running So we could transfer files just as easily earlier. We did this download string I think there's a download file one as well But you also just have the kind of classic power shell invoke web request And my face is going to be in the way and I can't clear the screen. So let me make that go away invoke web request to download From my ip address 10 10 10 14 27 port 8 000 win peas dot exe I can pull this down, but it kind of doesn't know what to do with it. So The best thing for us to do is actually bring that to a file and you can pass that with that invoke web request tack out file argument. So HTTP 14 27 Win peas And I'll specify that tack out file location and I'll just call it like win peas dot exe keep the file name here Good. That's downloaded. Now if I ls I should have this file here fantastic So we could simply run this if we were in cmd.exe You wouldn't need to specify the dot slash since we are in power shell We should to be able to run that out of the current directory. So while Whack that win peas dot exe give that just a second and hopefully hopefully hopefully it will come back with something and it did Okay fantastic What do we got here? You could of course do this manual enumeration if you really wanted to Ooh that also isn't giving me a full Like scroll back dislike Uh Could I download this? I'm trying to think of a decent way to be able to pull this back down to the victim You know what I think a good thing to do would actually just be get a metterpter shell in here Because that would just kind of make Kind of our our control a little bit easier. So I like to just use some of the metterpter cheat sheets Or msf venom to be able to craft that and create that Netsec has a really really good one that I always reference because it helps me not think and It just will give me the quick and easy payload. I know it's easy a windows metterpter reverse tcp But I always fumble with like the architecture and whether or not I need to specify that So I will steal this command And I'll get back to my sublime text Just so I can kind of uh Have a window to tinker with this command my ip address needs to be filled in here 14 27 and we'll listen on I guess Quad six here we go and we'll call this like metterpter dot exe good good good Wack that out that we'll go ahead and create a prepackage binary and download Like actual program that we can run put on the host put on the victim And then have it call back to our own metterpter shell. So let me msf console this guy So I can prepare the handler like the listener that will be able to catch this reverse shell And then we still have our http server running down here I'll use exploit multi handler And I will show options to sanly check the things that I need to change We do need to set our l host to ourselves We do need to set our l port to our Port that we wanted to listen on and we should set the payload to the same thing that we told msf venom to use So I will set payload to that guy and now I can run and start up that listener So back over in our victim because we have just that simple metterpter dot exe File ready to download in the same directory What I'll do is I'll once again use that Invoke web request to download this guy invoke web request My ip And save that to a file We'll just call it met dot exe good Kind of zoom it out here. I do have this met dot exe good So my metterpter shell should be All set and ready to catch that so if I were to dot slash met You can see that metterpter session one opened up on the top here Fantastic now. I can upload and download things a little bit easily and that might be convenient for actually checking out the rest of that Winp is a numeration script. Let me go ahead and check out my current directory I'm still in the temporary file So I will actually use this shell to be able to run winp's dot exe one more time and I'll save it to like win out log And hopefully when I get my prompt back that will behave for me good Now I can download that win out dot log because that's in the current directory and metterpter is the one that has that Download command. I wouldn't be able to kind of easily do that on the victim without being able to like spin up an hdp server Or netcat or file transfer So metterpter just kind of makes that nice and easy for me So now let me go ahead and less tack r That uh win out file Yep, that's totally fine Yes, do I actually have content in that? Oh boy Did it just do it? It did just do it Does that not want to work? Can I cat win out dot log Okay, sure and that works just fine for me and that will handle it now I can actually read through all the stuff that the winp's gave me Uh, it would probably have just been smarter and better to have an actual scroll back on here or use tmux Or a better thing that will help me actually view the output of but That was just some quick problem solving to be able to see the rest of this and it's good to have metterpter on there Ooh windows vol search powered by watson looks like this has a lot of stuff that could potentially be vulnerable for user environment variables computer name is remote username is remote system environment variable stuff that we've seen before lsa protection No, a view is detected. That's probably why we were able to totally run Uh, metterpter and our reverse shell normally you wouldn't see that happen on a windows target Power shell stuff drives information Current token privileges Maybe we could tinker with some of those scm personally privilege. Ooh Would that be an option? Some autolog and credentials were found. Oh just that a fault username for administrator. Okay. Nothing huge Interesting processes. Yep. There's power shell I invoked that Met.exe. I invoked that that's our metterpter Windpeas I invoked that Okay, all the interesting stuff seemingly is just me services information interesting services non microsoft open ssh team viewer Oh, whoa, and that's just running. Oh come on. I don't need less. I don't need your help I was just looking at team viewer and it moved away from me I can search for it again team viewer There we go So if we did our actual like own manual enumeration like if we went over to cdc In the c drive you could probably hop over to like the program files And see if there's anything that sticks out to you any particular Programs or software that might be installed. Don't forget to take a look in the other program files directory program files x86 slap that guy in there And you should see team viewer. So that's kind of interesting and peculiar Not something that's installed by default right not native to windows So maybe A thought considering this box is called remote and team viewer is supposed to be a remote access and availability thing Tool and program and software I wonder if there are any logs or any information for that team viewer application We could hop over there and start to explore things if we really wanted to we could deep dive into it um But because we have meturpre drawn here Because we have metasploit running and I don't have a ton of shame. I don't have any issue of running metasploit Maybe there's a module that we'll be able to search and look for team viewer credentials. So team viewer metasploit There is a windows gather team viewer passwords Seemingly module this module will find an encrypt stored team viewer passwords Incredible So our meturpre session. Let's go ahead and hit back or background on that So we get back to a regular msf or msf console shell and then let's search For that team viewer and see it looks like we do have a post module post windows gather credentials team viewer passwords Let's check that out So I'll use that And show options to see what we got a supply here We do need the session for what we're actually working with and if we were to check out our sessions We have our one session of meturpre here on the victim. So let me set session to just one And then fire that off Immediately it finds this unattended password for remote awesome and I spent a decent amount of time now trying to figure out like okay. How do I connect to team viewer? With this unattended setup. Can I just connect to it as an ip address and and and do things with it? I didn't really get anywhere with that And then I eventually just kind of thought like well, this is a password right and potential password reuse is a thing So maybe this would be someone else's password, but I didn't see any other users on this box Other than really just the administrator himself And then I kind of put some of the puzzle pieces together We saw in our rust scan output or from our nmap searching that We actually have winrm on here that port that we saw earlier So maybe I could try this password for that administrator user So I could save this if I wanted to slap in or read me But let's go ahead and try to use evil winrm to connect to it If you aren't familiar with evil winrm or you haven't seen it before you can totally go download it It's the winrm shell that you could use for hacking and penetration testing Typically, it's just good to get access on a box if you see that windows remote management or winrm on a target on windows Pretty simple needs to hack i for an ip address and a user and password you could pass along It can also do some pass the hash stuff, which is very very cool And I want to get smarter on this. I need to learn and tinker with it a little bit more But let's go ahead and do it. Let's use evil winrm on that ip address with the user being administrator and with the password being tackp And i'm going to have to specify single quotes here because these exclamation points might make bash choke or wine so Let's whack that And it connected. So we are currently in the administrator's documents and we are the administrator So We could check out what we have here over in his desktop Looks like we have that root dot text Uh, can I run wc tech l? We'll we'll power show. I'll know what that means. No get Or like measure object. I think I can actually cure clear this screen. So that's handy measure object root dot text. Does that work? We could just cat the thing out, but That is uh Seriously now, I just kind of want to know measure object power shell I am earning power shell I guess I would have to cat it out Yeah, so cat root dot text and then pipe it to Measure objects. You can't just pass it the file name Incredible. Can I get the line, please? How about characters Character or car character 32 characters so we know it's a hash and i'm not spoiling anything by showcasing the root dot text What i've already showcased the user dot text. Anyway, that's that that is the remote box This was a lot of fun for me because it's windows and I need to stretch myself and do more windows boxes and windows machines I have a lot to learn there and it's all about the learning process. So this has been kind of fun I know it's an easy box and that's how it's kind of rated But that's still something that I enjoy and have a good time with and there's always some kind of cool tools and things to learn Working with that. So holy cow. I hope you enjoyed this video. We did some really nifty stuff doing some I don't know umbraco Looking for things and enumerating in ntfs shares or nfs shares. Sorry Mounting those and exploring those and pillaging even with simple strings and okay, then using some code execution to Get access to the box pulling in some wind peas to do enumeration and finding passwords with team view or metasploit So there's a lot of a lot of stuff going on, but wow Thanks so much for watching everybody. I really hope you enjoyed this video If you did, please do do the youtube algorithm thing is I would love to see maybe a quick like in the video Silly comment down at the bottom. I don't care YouTube algorithm stuff. Please subscribe Thanks so much for watching everybody. I'll see you in the next video. Take care. Love you


Hi, everyone. Happy Friday. Joe for jazzy's casebreaks.com coming at you with a quick little team random. So It's a it's a different type of filler, but this one doesn't have like a break attached to it We just sell 14 spots. We have 14 teams and everyone's guaranteed a team For that price point right there. You can end up with the Jags, right? Or you can end up with some of the bigger teams right up here as well But at least you're guaranteed something in this so big. Thanks to These folks right here. Good luck. We're just randomizing just your names. Not the teams Let's roll it. Let's randomize it two and a six eight times. We'll line you up with the team team on top gets the chargers One good luck everybody two three four five six and Twice more seven and eight And good luck eighth and final time Chad Congrats to you Thanks everyone for getting in All right, so Chad you have the charge and we'll put a little rooftop next to your name So you know you won that in the team random Eric with the dolphins Robert Eagles Josh with the Vikings Matthew Shearer with the Colts Cowboys and the Washington football team Michael with the Niners Matthew Shearer with my Raiders Josh Elitz with the Rams Matthew Shearer with the Steelers Josh with the Ravens And the Broncos and Steve Locke with the Jaguars. There you go coming up in a separate video will be the select break I'll see you for that Jasper's case greats.com


Being a military working dog handler, in my opinion, is probably the best job in the Marine Corps. When I wake up in the morning, the first thing I gotta do is I gotta play with the dog. So it's a good feeling knowing that, hey, no matter what that day's gonna throw at you, as long as I have my pal next to me, I can get through anything. Recently just deployed with the 22nd Mew, we come on that ship as an enabler. We're here to do our job and to do our job well. We were able to go to Kuwait, we were able to go to Qatar and train with the Air Force. We went to Bahrain and trained with the Navy personnel in Bahrain. We did a lot of good stuff on that deployment. Our sole purpose is to get deployed and to provide that safety net. No matter what, you can rely on us.


Hello and welcome to the session in which we would look at the taxability or lack of for compensation for injuries and sickness. What does that mean? It means when an individual receives some sort of a compensation for damages. Is that amount taxable or not? Well, it all depends. The tax implication for receiving damages vary depending on the harm suffered by the taxpayer. So when the individual pursues compensation, they may receive damages for various reasons. What could be those reasons? Why would you want to receive damages? It is possible that you could have lost some income. You lost your source of income. You could have incurred expenses. You could have had some property damage or you could receive compensation for personal injury. So is it taxable or not taxable? It all depends on the type of the specific harm you suffered and what are you trying to get compensated for. This is what we will discuss in this session. Before we proceed any further, I have a public announcement about my company Farhat Lectures.com. Farhat Accounting Lectures is a supplemental educational tool that's going to help you with your CPA exam preparation as well as your accounting courses. My CPA material is aligned with your CPA review course such as Becker, Roger, Wiley, Gleam, Miles. My accounting courses are aligned with your accounting courses broken down by chapter and topics. My resources consist of lectures, multiple choice questions, true-false questions as well as exercises. Go ahead, start your free trial today. Starting with loss of income. As the title suggests, somehow you are losing income. Well, if that's the case, loss of income, of what? Because you were working, now you could not work. You're not producing. Well, if that's the case, you are replacing your income. Well, your income would have been taxable. This amount would be taxable as well. Loss of income is typically subject to taxation in similar way as the income it replaces because it's you are substituting your income. Well, your income would have been taxed. This income is taxed as well. However, there are certain exceptions to this rule, particularly when it comes to personal injury, which we'll see more about personal injury in this session. But loss of income, generally speaking, is taxable. Something what happened is you incur expenses. And if you incur expenses, you might ask for compensation for those expenses. Are they taxable or not, when you get this compensation? Well, it all depends. If you deducted the expense, if the expense was deducted, the recovery of that expense is taxable. If it's not deducted, then the expense is not considered an income. What does that mean? It means if in year one you took an expense and you took an expense, you incurred an expense, and you deducted this expense. This is in year one. In year two, if you got the income, well, if you deducted the expense, then it's income. Well, if you did not deduct the expense and they replaced your, they reimbursed you for their expense, then it's not income. So if the expense was previously deducted, the damage is received, the second topic is incurred expenses. Sometime what happened is you incurred expenses, and as a result, you might get compensated for those expenses. If the expense was not deducted, the recovery of that expense is not considered an income. So simply put, if the expense was not deducted in the prior year, in the prior period, you did not took advantage of that and took a tax deduction. When you received it, it's not considered income. If the expense was previously deducted, so if you were able to deduct this expense, in other words, you took a tax deduction, the damage generally received are generally subject to taxation. Well, if you took the deduction, you took advantage of that expense. Now you are being reimbursed, the damages received are subject to taxation. And this is basically, it's going to take us to a separate topic, which is called the tax benefit rule. So if you were able to take advantage of the expense and the expense was reimbursed to you, well, the tax benefit rules will kick in. This is basically how it works, but we're going to work more specific examples. It's a one topic by itself, the tax benefit rule, but the incurred expense falls under this category. Sometime what happened is you sue, you want to be compensated because the property, your property was damaged, could be a car, a building, so on and so forth. When that happened, when the property is damaged, any payment received is considered as if you sold the property or exchanged the property. Now what happened when you sold the property or exchanged the property? Well, if the amount received, which is consideration received, is greater, greater exceeds the basis, you have a gain. So if the money that you received is greater than the basis of the property damaged, you have a gain. Now if it's a personal property, you can't take the deduction because if you sold it, you can't take the deduction as well. Let's talk about personal injury. Here we're going to have to expand a little bit more on personal injury. The big idea behind personal injury is to provide the injured party with that amount that restored them to their pre-injury state. So let's assume an individual fall off this step. Well, guess what? They broke their ankle, they broke their leg, their hand, whatever happens is now you want to compensate them to a state, the pre-injury state. This is the whole idea about the personal injury damage. This means if the damage were taxable, this means if the damages received were taxable, then the after-tax amount will be less than the actual damage is severed. So if you gave someone a thousand dollar and that amount is taxable, let's assume their tax rate is 20%, simply put this individual would only receive 800 as net. So resulting, resulting in an injury party not being fully compensated. Therefore, you have to compensate them for more so it net out to be a thousand dollar if that's what you want to give them. But when it comes to personal injury, remember we're going to differentiate between two types and this is important. We have personal injury that's considered compensatory damages and personal injury that's punitive damages, those two. Let's talk about each one separately. Starting with personal injury compensatory damages. Well, this aims to provide compensation for the harm suffered by the taxpayer. For example, you hurt your back. Only compensatory damage received for physical personal injury or physical sickness like a back problem can be excluded from the gross income because it's a physical. So this includes the loss of income related to the physical personal injury or the physical sickness. Remember we talked about the loss of income. That's fine. However, compensatory damages awarded for emotional distress. This is not physical distress. Emotional cannot be excluded from gross income. It means it's taxable unless the amount received is for medical care. So you receive the amount and you paid it for medical care for emotional distress. That's fine. You're not going to be taxed for that. Also, any amount received for age discrimination or damages to one's reputation cannot be excluded. It's included because it's not physical personal injury or physical sickness. So compensatory damages for physical personal injury and physical sickness are excluded. How about you are suing for punitive damages? What's punitive damages? Is you want to penalize the other party. Punitive damages are monetary award money. You're asking them for money that the responsible party must pay as a form of punishment.  Now this is different. Unlike compensatory damages which is aimed to compensate the victim, punitive damages are intended to penalize the wrongdoer. So receiving punitive damages may actually put the injured position in a better financial situation than before. Well, what do we need to about taxation? It's subject to taxation. So due to the purpose and effect punitive damages are considered part of gross income. So punitive damages are taxable unless it's a wrongful incarceration. What is wrongful incarceration? Well, if you're interested in this topic, I'm going to advise you watch on Netflix a show called The Innocence File. Basically, some people, they might be sent to jail, they might be found guilty by mistake. And what happened is after the DNA technology became a very prevalent technology, what they did, they revisited many evidence and what they find out, the DNA of the imprisoned person was not found in the crime scene. What does that mean? It means that person wasn't there but that person was convicted in a court of law. So what they did is they released that individual because they were innocent. They could not find their DNA. So damages received as compensation for wrongful incarceration are exempt from taxation. And some people, if you watch the show, they were spent 20, 25 years in prison, wrongfully imprisoned. Then at the end of the day, they found out they were innocent. Well, guess what? Here, they're not going to pay taxes on that if they receive damages. This execution applies to individual who have been convicted of a federal or state crime and subsequently exonerated. It means they became innocent. In other words, if someone was wrongfully imprisoned and later found innocent, this is what we're talking about here, any financial compensation they receive for the wrongful incarceration as subject to income tax. And this is simply fair, if not more than fair, right? Because you took basically their life and now you're telling them, you know, sorry, we made a mistake. So the amount they receive is not taxable. Let's talk about workers' compensation. What is workers' compensation? It's a system that provides financial benefits and medical care to employees who have suffered work-related injuries or sickness. Simply put, as a result of working on the job, you suffered some sort of an illness or an injury. The employer will have insurance. That's called workers' compensation insurance. It's a form of insurance that employers are legally required to have in place to do what? To protect their workers. Now, here's what's odd about workers' compensation. Payments made to employees are considered lost wages. In generally speaking, when it's lost wages, we assume it's taxable. However, workers' compensation are not considered taxable income. Simply put, what you need to know about workers' compensation, they are executing. By executing those compensation, basically what the tax code or what the government is trying to do is to prevent the injured workers from being burdened with additional tax liabilities during this challenging time. Sometimes your injuries could be very, very serious. Simply put, to compensate them for the financial hardship caused by work-related injuries or illness. All in all, workers' compensation, you see this, not taxable. Let's take a look at a few examples to illustrate the concepts.  Well, is this a physical injury? And the answer is not. Sex discrimination is not a physical injury. It's a non-physical. Therefore, it's included in income. Nora received $8,000 for damages to her personal reputation. Okay, it's personal reputation, physical injury. Now, additionally, she received $35,000 in punitive damages. Are punitive damages taxable? Yes, the $8,000 and the $35,000 are taxable. Blue Corporation, an accrual taxpayer, received $40,000 from a lawsuit filed against its auditor who overcharged for services rendered in the prior year. So what did we do? We were overcharged the prior year. We paid $40,000 in prior year. What we're trying to do is getting basically reimbursed, assuming the $40,000 was deductible in the prior year because we're trying to recover it. Then the amount is taxable. So if we took it, if we took this $40,000 as a deduction, then we assumed we took it as a deduction. Therefore, it's taxable now. Lily received $12,000 compensatory damages and $25,000 in punitive damages and a lawsuit she filed against a beauty salon for severe burns she received from using its standing equipment. Well, what would you say? I would say the punitive we already know, the punitive are included. They are taxable. What about the $12,000? The $12,000 is for physical injury, severe burns. I would say they are physical injury. Therefore, the $12,000 is not included, but the punitive damages are included. Elise received compensatory damages of $90,000 for punitive. Already we know this is going to be taxable punitive damages and $250,000 for a plastic surgeon who mishandled her rhinoplasty surgery. Well, is that a physical injury? Yes, it is. Therefore, the $250,000 is tax free. However, the punitive damages is not tax free. It's taxable. What should you do now? Go to the FARHAT lectures, look at additional resources to understand what's included in income, gross income inclusion, gross income execution. Those topics are important. We're focusing here on what is executed gross income execution, but there's always exception to that gross income execution. It becomes gross income inclusion. Just multiple additional multiple choice true, false and additional resources will help you see the big picture. If you're studying for your CPA exam, enrolled agent, or an accounting student, FARHAT lectures is your answer. Good luck, study hard, and of course, stay safe.