---
description: '#brute-force, #cve, #linux, #path hijacking, #SGID, #sudo'
---

# Lookup

## Lookup - Writeup

**Date**: 23/01/2025

**Difficulty**: Easy

**CTF**: [https://tryhackme.com/r/room/lookup](https://tryhackme.com/r/room/lookup)

Test your enumeration skills on this boot-to-root machine.

***

## Discovery

Let’s start by testing the connection to the target machine using **ping**:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-18f3585ea6a58bdca3520ec61bb5c8d7d5394b8a%2Flookup0.png?alt=media" alt=""><figcaption></figcaption></figure>

We receive a packet back, and the TTL shows a value of 63, which means that we are probably facing a Linux Machine.

Let’s use **nmap** tool to search for open TCP ports on the target machine:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-5761878828e31a44667686a8d430342b58a53336%2Flookup1.png?alt=media" alt=""><figcaption></figcaption></figure>

The scan discovered two open TCP ports: 22 (SSH) and 80 (HTTP). Let’s do a further scan to check the services and their versions:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-3ebe11aad208376d9f777bae547194ac25db842c%2Flookup2.png?alt=media" alt=""><figcaption></figcaption></figure>

* 22: OpenSSH 8.2p1
* 80: Apache 2.4.41 (redirection to http://lookup.thm)

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-0b4dafad74213c38d59396732a42ae077cf746b5%2Flookup3.png?alt=media" alt=""><figcaption></figcaption></figure>

According to **Launchpad**, the version of OpenSSH corresponds to a package of Ubuntu Focal (20.04) distribution.

Let’s use **whatweb** to take a quick look at the HTTP content:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-f684c55537047f71974db6a3a365ff30aec9a260%2Flookup4.png?alt=media" alt=""><figcaption></figcaption></figure>

It displays an error saying that the server is trying to redirect us to lookup.thm, so let’s edit **/etc/hosts** to include the domain:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-48db0bf3324e80ec61985823dc9da8e09b71cf2a%2Flookup5.png?alt=media" alt=""><figcaption></figcaption></figure>

Let’s use whatweb again:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-61834c817573b352af8099493e2f9e0dbedd5a25%2Flookup6.png?alt=media" alt=""><figcaption></figcaption></figure>

There isn’t much information apart from the version of Apache (2.4.41)

Let’s take a look at the website using the web browser:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-7a5bf922bc1ab0e5dcbe097c0870ae9c6c09338d%2Flookup7.png?alt=media" alt=""><figcaption></figcaption></figure>

A login screen… let’s check the source code:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-ba4d5ef5c4cec79e1425655b86290f889a06c196%2Flookup8.png?alt=media" alt=""><figcaption></figcaption></figure>

Nothing really useful there, let’s try to login using random credentials:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-1375d103d167c1da205a6b50861e57044b98769a%2Flookup9.png?alt=media" alt=""><figcaption></figcaption></figure>

In parallel I’ll launch gobuster to try to discover directories and files:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-413631b9314ea6f19ed3def5efac391398d9bb82%2Flookup10.png?alt=media" alt=""><figcaption></figcaption></figure>

Let’s try if the form is vulnerable to SQL Injection:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-4f9b63271fc5e0d5a09daf9aa71199d6f0577407%2Flookup11.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-1fb9c97092f197c9679f8e73f3857a5c66f18d3c%2Flookup12.png?alt=media" alt=""><figcaption></figcaption></figure>

I tried the most common payloads to test SQLi without success. Let’s try to login using common credentials:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-b601b4ade843399cace5f3dd8036d987367efa5c%2Flookup13.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-1f371565837a7297e038e63f8f97d9e5e20422b2%2Flookup14.png?alt=media" alt=""><figcaption></figcaption></figure>

So… admin seems to be a valid username. Maybe we can bruteforce the password using **hydra**…

This is the POST request:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-48b4b833fac7de91cbc38d5662929ecf94bb4a54%2Flookup15.png?alt=media" alt=""><figcaption></figcaption></figure>

Let’s build the command, using the **rockyou.txt** dictionary:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-03e7a1263504ed058e7611b5a2d1de47b17ed040%2Flookup16.png?alt=media" alt=""><figcaption></figcaption></figure>

Gobuster didn’t find any useful directory or file, so meanwhile the hydra is working, let’s launch **ffuf** for subdomain enumeration:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-f6cdbdf770147ce460f377b3aab61dc6acaa3ea8%2Flookup17.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-8a1079045e9937a3e8b2babe37771f27006d6170%2Flookup18.png?alt=media" alt=""><figcaption></figcaption></figure>

It didn’t find subdomains… and hydra didn’t find a valid password for **admin** user.

As the website displays different messages when you are using a valid username or not, let’s try to find other valid usernames using hydra again:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-571aa83921b24987b936f1acb806dad4c93ba90a%2Flookup19.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-25b0c131ac26ed4a928de507104d1e3c780661f6%2Flookup20.png?alt=media" alt=""><figcaption></figcaption></figure>

It found **admin**…

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-7b4bdd23ed062885bc641f4b8416574b667784ca%2Flookup21.png?alt=media" alt=""><figcaption></figcaption></figure>

And after a while it also found a user named **jose**. Let’s see if we have more luck trying to discover his password. This time I’ll use a shorter password dictionary:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-9d68f91d1f6e6dcc5e115c97491a409af0e1691a%2Flookup22.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-af029bb2cb1b36d3e865099e1913aca853c6e5b9%2Flookup23.png?alt=media" alt=""><figcaption></figcaption></figure>

It found valid credentials! Let’s try to log in.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-fbfb5f192fe3191feab238df752d0cdac7a70d60%2Flookup24.png?alt=media" alt=""><figcaption></figcaption></figure>

The website now tries to redirect us to **files.lookup.thm:**

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-32d5499d55b549f3e40405cd032e0fcf960e368e%2Flookup25.png?alt=media" alt=""><figcaption></figcaption></figure>

Let’s add it to **/etc/hosts:**

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-f92a5819bfc85bb93b1f1ee754d9bbac79e93842%2Flookup26.png?alt=media" alt=""><figcaption></figcaption></figure>

Now when we log in, it redirects us to something that looks like a web file manager.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-8e4337e60d69966224bfc6af996cbd4bcf3af225%2Flookup27.png?alt=media" alt=""><figcaption></figcaption></figure>

It displays some text files, that we can read.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-d350bf7d06df00bc64272b65774e6175d30ba408%2Flookup28.png?alt=media" alt=""><figcaption></figcaption></figure>

Most of them have random words in their content, but the content of **credentials.txt** makes me think that there is a user called **think.** And maybe the credentials are: `think:nopassword`:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-453c925e0e166ff0c4ff6d98f07a02c36c3972e5%2Flookup29.png?alt=media" alt=""><figcaption></figcaption></figure>

The file **thislogin.txt** contains the credentials of the user **jose:**

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-e0a184c8aba7ef3877819571fdb6368c2a0e3372%2Flookup30.png?alt=media" alt=""><figcaption></figcaption></figure>

I tried to use the credentials of **think** to log in in the webpage form without success.

Let’s extract some info from this web file manager clicking the About button:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-741db03324dbd9a010b2df15440fc5601feac250%2Flookup31.png?alt=media" alt=""><figcaption></figcaption></figure>

## Exploitation

The name of this software is **elFinder** and its version is 2.1.47. Let’s use **searchsploit** to check for possible vulnerabilities of it:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-82b1b147ebd0ec81cba7693d36c85f4b15f2c348%2Flookup32.png?alt=media" alt=""><figcaption></figcaption></figure>

The vulnerability [CVE-2019-9194](https://blog.hackmetrix.com/desencadenamiento-y-explotacion-de-vulnerabilidad-1-day/) allows command injection! Let’s try it:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-e5db7acb68e82c2c6233a3f0198742044c07f82e%2Flookup33.png?alt=media" alt=""><figcaption></figcaption></figure>

We are inside the target machine! Let’s find the user flag:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-59b25d05451f95692a953a730a8489cddac38891%2Flookup34.png?alt=media" alt=""><figcaption></figcaption></figure>

The **user.txt** is not readable by the current user.

Also, the reverse shell we obtained is not very interactive… So let’s see if we can transfer a PHP file to obtain a better reverse shell:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-04c15d8990506d7114a3b23c9361f8f2d3f1d5a4%2Flookup35.png?alt=media" alt=""><figcaption></figcaption></figure>

After the transfer, we can go to [http://files.lookup.thm/elFinder/php/minirevshell.php](http://files.lookup.thm/elFinder/php/minirevshell.php) to execute it and obtain the reverse shell:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-811b18770b914b869df345757aca325c52113957%2Flookup36.png?alt=media" alt=""><figcaption></figcaption></figure>

Much better, now we have to search for a way to log in as **root** or **think** user. Let’s take a look at the **login.php** file:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-5fa9c0490247d0eb4fcfd00edeba8827feaf3d45%2Flookup37.png?alt=media" alt=""><figcaption></figcaption></figure>

Nothing new. Let’s see if there are more users on this machine:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-076c5755492a6455237947aff6c80700400cedbd%2Flookup38.png?alt=media" alt=""><figcaption></figcaption></figure>

Nah, the only ones that have a bash are **root** and **think**.

Let’s search for SUID files:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-077a914e3fb25c33237c7cb44cd83054fe4563c2%2Flookup39.png?alt=media" alt=""><figcaption></figcaption></figure>

I didn’t see anything I can use… Let’s transfer LinPeas to do an intensive scan:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-18798d2c505cd493141c88d97fd49b2d01322c90%2Flookup40.png?alt=media" alt=""><figcaption></figcaption></figure>

After executing LinPeas, it detects an Unknown SGID binary named `/usr/sbin/pwm` . I have previously missed that file in the SUID search...

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-f58a03dd8073215c9ea6b594a5809c22727cccb0%2Flookup41.png?alt=media" alt=""><figcaption></figcaption></figure>

**SGID** (Set Group ID) means that this binary can be executed with the permissions of the group that owns the file. In this case the owner is root and the group is also root. Let’s try to execute it:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-7beeef6f75c30e395845b75f9450ac6254ad4655%2Flookup42.png?alt=media" alt=""><figcaption></figcaption></figure>

Let’s use **strings** to see if we can see anything useful:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-c03a716525815f10d1c07359cd127692e7861f01%2Flookup43.png?alt=media" alt=""><figcaption></figcaption></figure>

Apparently, the binary is trying to read/execute the file “**/home/user/.password**” but, since we are executing it as the user **www-data** it doesn’t find the file **/home/www-data/.password** because it doesn’t exist.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-aafa2cfcb1412c44e42a468082ae6a49f32a4ff2%2Flookup44.png?alt=media" alt=""><figcaption></figcaption></figure>

I thought about creating it, but as www-data user we have no permissions to do that.

The binary is executing the command **id**, if the binary is not being called using the absolute reference but just calling it as `id user`, maybe we have a chance if we manage to create a binary called **id** somewhere else in the PATH.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-8c76325f044f2368dc37c7fab0ec7901023a59eb%2Flookup45.png?alt=media" alt=""><figcaption></figcaption></figure>

Mmm… It looks like we have no write permissions in any of the directories of the PATH.

Can we modify the PATH?

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-53011401404c86be5adaabff94ab48ff818fe0b4%2Flookup46.png?alt=media" alt=""><figcaption></figcaption></figure>

Oh! Yes, we can! I added the /tmp directory at the beginning of PATH, so if we create a binary called **id** there it may do the trick!

After some tries, I realized that the pwm binary is using id to determine the user that is executing the binary and then, using his name to fill the command that uses the line `/home/%s/.passwords`.

So, knowing that, I created an executable called `id` in **/tmp** folder that executes `/usr/bin/id think` to fool the pwm binary.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-d5f6c4332e183d5957febbf9de90454440480865%2Flookup47.png?alt=media" alt=""><figcaption></figcaption></figure>

Now, a list of passwords appears in the console. Let’s copy it into our local machine as passwords.txt and let’s try them all using Hydra to connect via SSH as the user **think**.

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-6085e99b107b63973859ba9a7614dd9e9ce1618e%2Flookup48.png?alt=media" alt=""><figcaption></figcaption></figure>

Yeah, we found valid credentials to log in via SSH

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-6d11595bd9738e2bce5268e4bdc3f562596cdda4%2Flookup49.png?alt=media" alt=""><figcaption></figcaption></figure>

And here we have the user flag!

## Privilege Escalation

Let’s see the sudo permissions of this user:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-a609919041ef503fdbf148e07e62382b47643ce8%2Flookup50.png?alt=media" alt=""><figcaption></figcaption></figure>

According to [GTFO Bins](https://gtfobins.github.io/gtfobins/look/), we can use **look** to read files, and since we can execute it as root, we may read the root flag:

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-15be26e40aa8aee077463c02dc8721e6abba5a52%2Flookup51.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3648139271-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDU2KcTfFp1xEzUDMyoAe%2Fuploads%2Fgit-blob-01a2f90c0c75b30c97706351b7b99b6758b105b5%2Flookup52.png?alt=media" alt=""><figcaption></figcaption></figure>
