Tech Stack. Official discussion thread for Authority. It is little difficult free machine. Not sure what I'm doing wrong. Firgura 1 — Traza ICMP hacía la máquina víctima. txt Jun 16, 2024 · Editorial | HTB Writeup | Season-5. This was a Hard rated target that I had a ton of fun with. txt passing the result to save automatically as nmap. Control is a Hard difficulty Windows box (yay!) that was just retired from HackTheBox. eu. We learn there is a user information named “SVC_TGS” and its “cpassword” hashes. eu named Forest. December 9, 2023 · 14 min · Pengrey. Once done, we can start a listener on whatever port is defined in the ps1 file, in this case 443: sudo nc -lvnp 443. ⚠️ I am in the process of moving my writeups to a better looking site at https://zweilosec. zip file, we obtained the credentials of the raven user, which we used to gain initial access to the machine. 4 Found open port 137 Try smbmap and smbclient tools, but… Oct 12, 2019 · Hey guys, today writeup retired and here’s my write-up about it. 241 > nmap. Since python is not installed, we can upload it instead of downloading. While the full nmap scan is running, the quick scan has already shown that there is a web-server on port 80. 0: 2511: August 5, 2021 Firewall and IDS/IPS Evasion - Hard Lab. 7 -m pip install termcolor. ssh -L 8443:127. Nothing about this machine was all that technically difficult, but what made it Jun 23, 2023 · Now, we will use a tool called certipy to authenticate to the domain and get a TGT. 2 Likes. Now run the binary form the SSH terminal: and we got the root user Mar 13, 2023 · Flags. We can take advantage of this by manipulating the user variable to include what we want, such as local files. nmap 10. Enjoy! Write-up: [HTB] Academy — Writeup. Nov 12, 2023 · We also find out the OS of the machine and the build. An “easy Let’s run it to automate initial privilege escalation enumeration. Clone the repository and go into the folder and search with grep and the arguments for case-insensitive (-i) and show the filename (-R). It was a unique box in the sense that there was no web application as an attack surface. This Windows insane-difficulty machine was quite challenging, but mostly due to its use of some unconventional settings. c:\\windows Aug 5, 2021 · HTB Content. Jul 5, 2023 · Escape HTB Write-Up. Recon: nmap -sV -sC 10. Dec 12, 2020 · Searching through Write-Ups. The box was centered around common vulnerabilities associated with Active Directory. The svc_ldap user can add new computers (most of the time Domain Users can do this), thus allowing us to request for the certificate needed. Next, we need to create a . Active, a easy Windows machine that begins with simple SMB enumeration that leads to us finding a Groups. Control was a very good challenge, it starts out in a Feb 25, 2024 · nmap scan 2. This was an easy difficulty box, and it… | by bigb0ss | InfoSec Write-ups. authority. We can compile the messagebox. --. After adding authority. Until then, Keep pushing! Hackplayers community, HTB Hispano & Born2root groups. htb. 200 PORT command successful. Once you have followed the steps to do that just type this command into your terminal. exe binary to the Bounty box. I’ll Kerberoast to get a second user, who is able to run the Dec 9, 2023 · Writeup for the Hackthebox machine Authority. htb\AUTHORITY-CA Template Name : CorpVPN Schema Version : 2 Validity Period : 20 years Renewal Period : 6 weeks msPKI-Certificate Apr 29, 2020 · nmap -A -v grandpa. SNMP stands for simple network management protocol, and it is used for network management and monitoring. It also gives the opportunity to use Kerberoasting against a Windows Domain, which, if you’re not a pentester, you may not have had the chance to do before. github. Host is up (0. 8776711. I started my enumeration with an nmap scan of 10. 103 --min-rate 10000 -oA love As SMB was listening, the first thing I did was run crackmapexec to enumerate shares and Oct 27, 2023 · 15 Template Name : SubCA Display Name : Subordinate Certification Authority Certificate Authorities : manager-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : True Any Purpose : True Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Private Key Flag : ExportableKey Requires Manager Approval Jul 20, 2023 · Hack The Box - Authority. I need your hints without direct answer. Hack The Box Factory Write Up Earlier today after recovering my account on HackTheBox i decided to go ahead an do some challenges hardware specific in which this one capture my eye : "Our infrastructure is under attack! The HMI interface went offline and we lost control of some critical PLCs in our ICS system. evil-winrm -i 10. 33: 14384: July 19, 2024 Official Spin Glass Brain Discussion. exe. If you find the results a little bit too overwhelming, you can do another command to get only the open ports. nmap grandpa. htb” “Groups. Here you will find Command Injection in ‘Postgresql’ and later you have to do Pivoting and also lateral movement. Reconnaissance Reconnaissance in penetration testing is the initial phase where information is gathered ab Nov 15, 2020 · Download the compiled binary for the Juicy Potato here. Aug 25, 2020 · そしてftpでファイルをアップロード。. Table of Contents. The platform brings together security researchers, pentesters, infosec professionals, academia, and students, making it the social network for ethical hackers and infosec enthusiasts, counting more than Dec 9, 2023 · Introduction. We can see the domain “ megabank. There’s a good chance to practice SMB enumeration. Sup guys! Sorry for bothering the community. xml” file keeps the users information that kept by active directory application. htb to my /etc/hosts file. After a bit of research around the version of windows I . In this Walkthrough, we will be hacking the machine Sauna from HackTheBox. 0 636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: authority. To do so, start an “ smbserver ” in our kali machine Jun 25, 2023 · Jun 25, 2023. Introducing The Editorial Box, the inaugural Linux machine of Season 5, we travel on a detailed exploration of network security practices. And then when I get access I will be able to move forward. ping 10. Sep 11, 2021 · HTB Active Writeup. One thing to note is that the namespace needs to match the filename and that we include a Run class. 0. smb: \> tarmode. Adding it to the hosts file. 5-32-544 Access Rights Principal Allow Enroll NT AUTHORITY\Authenticated UsersS-1-5-11 Allow ManageCA, ManageCertificates BUILTIN\Administrators S-1 Remote Write-up / Walkthrough - HTB 09 Sep 2020. 10. sudo nmap -sU -top-ports=20 panda. Resolute is a Windows machine rated Medium on HTB. Once decrypted, one of the credentials can be used to login to the configuration manager for PWM (a password self-service for LDAP directories). Once done, we should see the data being loaded in the application: We can Jul 17, 2023 · Port 80 is, as the scan results suggest, the default Microsoft IIS page, but we can go look at the other port using HTTP. This is a medium Windows Machine with a strong focus on Active Directory enumeration and exploitation. Sep 8, 2023 · This article is about the HTB — Machine Authority which is medium level windows machine. aspx. 11. htb’ and attempted to perform a DNS zone transfer using dig. In order to find the hash type of password hash found above, use ‘hash-identifier’ tool. It was just a really tough box that reinforced Windows concepts that I hear about from pentesters in the real world. To so, we need to modify our initial command to include the folder with the winPEAS binary. May 5, 2022 · The site is the “HTB Printer Admin Panel”: “Settings” leads to /settings. Directory: C:\users\merlin\Desktop. Many authentication mechanisms only limit access to the most common HTTP methods, thus allowing unauthorized access to restricted resources by other HTTP methods. I decided to forward it. Please note that no flags are directly provided here. Before you begin following this Walkthrough you need to have setup the starting point VPN connection. Hello hackers, Today I want to share a write-up about how to solve the Bizness box. sudo python2. We see there is a flag user. Sep 22, 2021 · Hack The Box is online platform which helps in learning penetration testing. The value of the user variable is the JWT token username. Manager (Medium) 4. local: devel. Para ello, se ejecuta el siguiente comando: ping -c 1 10. htb Export list for squashed. open another terminal and start netcat. To get an initial shell, I’ll exploit a blind SQLI vulnerability in CMS Made Simple to get credentials, which I can use to log in with SSH. local ”. Everything points to this site being written in PHP, including the page extensions and the response headers: This Website Has Been Seized - breachforums. Ugh, I was preparing myself for an Insane machine, now this. In the container I’ll find a certificate request, which leaks the hostname of an internal web server. Dec 9, 2023 · HTB: Jupiter Writeup Jupiter is a Medium difficulty Linux machine that features a Grafana instance using a PostgreSQL database that is overextended on… Oct 28, 2023 Dec 30, 2022 · A technical walk through of the HackTheBox TRICK challenge by Andy from Italy. Sep 10, 2021 · HTB Granny Writeup. Intro: This is my new writeup on HackTheBox ‘Machine’ Jupiter. 27. That user has access to logs that Oct 10, 2010 · A collection of write-ups and walkthroughs of my adventures through https://hackthebox. Mar 16, 2023 · showmount -e squashed. 6743 MB/s) うまく Code written during contests and challenges by HackTheBox. PORT STATE SERVICE VERSION\n53/tcp open domain Simple DNS Plus\n88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2021-02-13 12:44:35Z)\n135/tcp open msrpc Microsoft Windows RPC\n139/tcp open netbios-ssn Microsoft Windows netbios-ssn\n389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb. Save the ‘hash:salt’ in a file. system July 15, 2023, 3:00pm 1. Jul 15, 2023 · HTB Content Machines. 192. Mar 21, 2022 · Since we know ssh is enabled so we can perform Local ssh tunnelling which will make our work easier. We then encode that binary and send it to our clipboard as it is a huge blob of encoded data. pfx ” file. Port Scan. It has advanced training labs that simulate real-world scenarios, giving players a chance to assess and penetrate enterprise infrastructure environments and prove their offensive security skills. SSL certificate exposes a hostname docker. Furthermore, we have come across Oct 6, 2023 · Running nmap targeting the ports ranging from 0 to 65535 along with all the scripts, T4 set to speed up the scanning. Irked 【Hack the Box write-up】Irked - Qiita. HTB\\Domain Computers' can enroll, enrollee supplies subject and template allows client authentication. I’ll start with some SMB access, use a . Como se puede apreciar en la Figura 1, la máquina se encuentra activa y además, gracias al TTL (127 Feb 12, 2024 · Hi! Here is a writeup of the HackTheBox machine Flight. local, Site: Default-First-Site-Name)\n445/tcp open microsoft-ds Windows Dec 10, 2023 · Vulnerable Certificates Templates : CA Name : authority. Authority is a medium-difficulty Windows machine that highlights the dangers of misconfigurations, password reuse, storing credentials on shares, and demonstrates how default settings in Active Directory (such as the ability for all domain users to add up to 10 computers to the domain) can be combined with other issues (vulnerable AD CS certificate templates) to take over a domain. We can see that there is only 1 open port: Sometime between these two steps I added panda. Neither of the steps were hard, but both were interesting. So let’s dive into the machine. 108. 113 -fNT. So, let’s use hashcat to crack the password with mode ‘20’. Authority is a Windows machine running Active Directory that has an open SMB share containing ansible vault encrypted credentials. Jan 3, 2024 · This is clearly a DC. Includes retired machines and challenges. https://bolt. Granny, a easy Windows box which had a single Microsoft IIS website which was vulnerable to a CVE that lead to a RCE on the machine. 138 , I added it to /etc/hosts as writeup. From there, I’ll abuse access to the staff group to write code to a path that’s running when someone SSHes into the box, and SSH in to trigger it. Example: Search all write-ups were the tool sqlmap is used. Here’s the May 9, 2020 · Path #1 — Race-condition Exploit. ftp> put devel. 20 min read. Apr 11, 2023 · start an http server on the local machine. 49 Followers. Jun 23, 2020 · Zhyarrr. 1:8443 nadine@10. htb to our /etc/hosts file we see the following on port 8443: Based on a bit of googling, PWM is a password self-service application for LDAP. We had to exploit a null session to get a hash of a user, which we then use on the box to get a shell. Mediumマシンなので当たり前ですが、ちゃんと Feb 6, 2022 · Una vez se ha lanzado la ejecución de la máquina, es conveniente enviar una traza ICMP para comprobar que está activa. The difficulty of these machines varies from beginner up to professional; This HTB Pathfinder walkthrough will explain my way to nt authority/system permissions step by May 25, 2023 · Password Hash Synchronization. Teacher 【Hack the Box write-up】Teacher Nov 27, 2022 · How awkward! The awk command passes the user variable. 48. sudo ssh -L 8000:localhost:8000 sau@10. nc -lnvp 2424. We can get Administrator’s hash with the help of TGT. 075s latency). registry. io! Please check it out! ⚠️. surfinerd July 15, 2023, 3:38pm 2. Appsanity (Hard) Jun 1, 2019 · I loved Sizzle. Oct 5, 2020 · Using Nmap on the box to find open ports will so we can enumerate further gives us the following ports: # Nmap 7. htb HackTheBox is a popular service that publishes vulnerable Windows and Linux machines in order to prepare hackers for certifications like the ones from Offensive Security or let them improve their skills for real-life scenarios. This file contains a username and a password that is encrypted with AES-256 however Microsoft release the key allowing us to decrypt the password. bat file which will be executed by the JuicyPotato. 125 Data connection already open; Transfer starting. First, connect to a remote network share using smbclient. It was a very nice box and I enjoyed it. Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default Apr 1, 2024 · Now that we have the cookie we were looking for we can head back to /dashboard and do the same thing in Burp Suite, but insert a “Cookie” field in the request we are modifying. Apr 1, 2021 · HTB - APT Overview. First, tranfer the JuicyPotato. grep -iR Apr 15, 2023 · Signing out Z3R0P1. Therefore it is a real pride that they have decided to include the functionality of this repo directly on their platform. 今回はHackTheBoxのMediumマシン「Authority」のWriteUpです！. 226 Transfer complete. Kodar. It’s a Linux box and its ip is 10. 1 Build 7600. Let’s get started. smb: \> mget . autorecon -o granny --single-target 10. It belongs to a series of tutorials that aim to help out complete beginners The "Authority" machine is created by mrb3n and Sentinal920. Aug 30, 2020 · 【Hack the Box write-up】Valentine - Qiita. Hack The Box innovates by constantly providing fresh and curated hacking challenges in a fully gamified, immersive, and intuitive environment. Modes 10 and 20 use ‘hash:salt’ format. But I got stuck somewhere into Authority box (HTB) I managed to connect via smb, and started to collect the loot. Machines. Feb 28, 2021 · TutorialsWriteups. Hack The Box[Valentine] -Writeup- - Qiita 【Hack The Box】Valentine Walkthrough - Paichan 技術メモブログ. [*] Service detection nmap-quick on 10. 接続が切れていた場合はログインし直してください。. Unable to AS-REP roast the user, we’ll continue enumeration on the HTTP server. Moreover, be aware that this is only one of the many ways to solve the challenges. Dec 5, 2022 · Before the singnal code, it calls a function which returns a randomly generated number. 182. We will start with some domain specific enumeration with no credentials, hunting for anonymous access. Mar 4, 2021 · v. We check for more information by going into the shell, and writing the following command. 15 finished successfully in 17 seconds [*] Found http on tcp/80 on target Mar 29, 2023 · Initially, I speculated that the domain was ‘return. Hack The Box is an online cybersecurity training platform to level up hacking skills. May 1, 2021 · Recursively download all files in a network share with smbclient. The box is running SNMPv1. Start with Nmap #nmap -sC -sV 10. Unfortunately, I got no results back from the host either because the domain May 10, 2023 · HTB - Tactics - Walkthrough. May 31, 2024 · ssh larissa@10. scf file to capture a users NetNTLM hash, and crack it to get creds. Jul 17, 2023 · Vulnerabilities ESC1 : 'AUTHORITY. megabank. Execute given below command for forwarding port to the local machine. pem ” certificate, and we can convert it to a “ . The Monteverde machine has been created by egre55. 1. cs to a binary. Apr 6, 2023 · ┌──(kali㉿kali)-[~/HTB/Love] └─$ sudo nmap -sC -sV -p- 10. 名前がAuthorityで、OSがWindowsということから、証明書かKerberos認証の脆弱性を悪用しそうだなーという感じはありますが、どのようなマシンなのでしょうか。. local ” alongside the FQDN (Fully Qualified Domain Name) “ Resolute. 2840 bytes sent in 0. Now we go on cd /tmp/ folder and wget a exploit from out main machine for getting root access. htb . Follow. Dec 22, 2023 · To do so, we need to first download it to our kali machine. nmap -sC -sV -p- 10. 252. Nmap scan report for 10. For privilege escalation, we exploited a misconfigured certificate. Join me as we uncover Jun 10, 2020 · Once the file is staged in the exploits directory, we can serve it with simpleHTTPServer as shown below: sudo python3 -m http. 4 3 ports are open - 139 (netbios-ssn), 445 (microsoft-ds) and 3389 (ms-wbt-server) Scan UDP ports #nmap -sU 10. Paradise_R July 15, 2023, 4:56pm 3. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oN <name> saves the output with a filename of <name>. I’ll start by finding some MSSQL creds on an open file share. htb: /home/ross * /var/www/html * There are two shares available. Hack The Box[Irked] -Writeup- - Qiita. academy. pfx -dc-ip <ip> -username Administrator -domain sequel. Today we will solve Legacy Hack The Box. This command gathered the “ cert. H1u2d3a4 1-5-21-4078382237-1492182817-2568127209-1119 Allow Enroll NT AUTHORITY\Authenticated UsersS-1-5-11 Allow ManageCA, ManageCertificates Jan 29, 2022 · HTB: Anubis. You can also click on “Check Authentication” to be sure that everything is fine. Then it takes to a buffer size of 60 and executes it as a shellcode. Let’s add both domains to our “ /etc/hosts Mar 14, 2017 · Most commands and the output in the write-ups are in text form, which makes this repository easy to search though for certain keywords. Hey everyone, let’s dive into the exciting world of machine analytics! In this write-up, we’ll be exploring the intricacies of analyzing machines, specifically focusing on Aug 17, 2019 · “active. Quick things we can spot from the python script is that it reads /etc/shadow file to check the entered user’s password. From there I can create a certificate for the user and then authenticate over WinRM. bigb0ss February 28, 2021, 10:08pm 1. Headless writeup. Jan 20, 2023 · Htb Writeup----Follow. I see the path I have to take, I'm just not getting the responses i should be. exe binary. Jul 11, 2020 · Setup. When the prompt changes to smb: \> type the following commands one at a time. Which is Windows 7 6. Authority was a nice and fairly easy Active Directory based machine. certipy auth -pfx cert. A pfx file is commonly used for code signing an May 4, 2021 · Phase 1: Enumeration. An anonymous LDAP search will reveal our first user ‘hsmith’. cs file to a binary called messagebox. Example: Search all write-ups were the tool Jun 22, 2024 · HTB: Bizness walkthrough. This is a medium HTB machine with a strong focus on Active Directory Exploitation. Here we get acccess of User account. ·. If you didn’t solve this challenge and just look for answers, first, you should take a look at this mind map from Orange Cyberdefense and try again. Most commands and the output in the write-ups are in text form, which makes this repository easy to search though for certain keywords. Jun 23, 2020. php, which presents a form: The “Fax” and “Troubleshooting” links don’t go anywhere. That server is handling software installs, and by giving it my IP, I’ll capture and crack the NetNTLMv2 hash associated Dec 9, 2023 · Vulnerable Certificates Templates : CA Name : authority. python3 -m http. I'm stuck atm. If you got any errors like above, use the command “ntpdate <ip>” to fix it. grandpa. Dec 7, 2019 · HTTP Verb Tampering is an attack that exploits vulnerabilities in HTTP verb (also known as HTTP method) authentication and access control mechanisms. Curling 【Hack the Box write-up】Curling - Qiita. 15. Hi mates! It’s been a while! I have uploaded my walkthrough write-up of the retired Academy box. My brain will get confused again by the difficult level. 2. We can mount them to our system like this: WE GOT OUR WINNERS 🏆 Thank you all for participating in #CyberApocalypse23, and special kudos to those who reached the top! 🥇 idekCTF 🥈 AIgenerated 🥉 796f75 The party isn't over yet Nov 17, 2023 · Compile . If you have successfully setup your OpenVPN connection then your output should look like this: 1 2. Escape is a very Windows-centeric box focusing on MSSQL Server and Active Directory Certificate Services (ADCS). In the website-backup. 129. When this is done, this Github will be migrated and will be inactive but with a pleasantly fulfilled mission. Now again we switch into Kali Linux for local tunnelling. Aug 31, 2023 · While examining the server, I noticed the presence of a service running on port 8000. xml file which has been created due to a Group Policy Preference (GPP). Anubis starts simply enough, with a ASP injection leading to code execution in a Windows Docker container. More from Kodar. 214. I have only one goal in my writings- give some more value to the world. By deciphering the Ansible key and decrypting the secrets, we gained access Nov 3, 2023 · Manager-HTB writeup. corp” will be stored in /etc HackTheBox Writeup latest [Machines] Linux Boxes [Machines] Windows Boxes Authority (Medium) 3. /. Giving us an account as nt authority\network service, when looking at the system information the windows version was windows server 2003. cm/ is an open-source Content Management Tool… Oct 10, 2010 · Resolute Write-up / Walkthrough - HTB 30 May 2020. SNMPv1 was defined in RFC1157 and was the first iteration of the SNMP protocol. Dec 8, 2018 · Active was an example of an easy box that still provided a lot of opportunity to learn. From that shell, we run Bloodhound to get a path to escalate our user account Apr 4, 2020 · We have usual ports open, SSH, HTTP and HTTPS open. is Jul 21, 2023 · syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1. server 80. 169 Mar 16, 2024 · Manager was a medium-ranked Windows Active Directory (AD) machine on HTB, involving the exploitation of mssql to read the content of the web. In Beyond Root Yes. I begin by kicking off AutoRecon on the target. Further reading the code we now know that it generates a number from a range of 0x5FFFFFFF < i <= 0xF7000000 which is a randomly generated address. The command used for the above map scan is sudo nmap -sC -sV 10. Oct 15, 2023 · Oct 15, 2023. With those, I’ll use xp_dirtree to get a Net-NTLMv2 challenge/response and crack that to get the sql_svc password. Thanks. Same here, reading through the comments as well on the Forum, and I feel I am so close to it, but still nothing Thank you for answering! Dec 13, 2023 · Then click on “Apply and Close”. Breaking in involved many of the normal enumeration and privilege escalation techniques that are used against Windows machines, but some tweaks by the administrator made it more challenging to find out how to even begin. 1 section → then it deletes it. Please do not post any spoilers or big hints. 00 secs (11. htb: hostname for the Grandpa box. htb\AUTHORITY-CA Template Name : CorpVPN Schema Version : 2 Validity Period : 20 years Renewal Period : 6 weeks msPKI-Certificate Oct 12, 2019 · Writeup was a great easy box. Local Port Forwarding. htb-A: Enable OS detection, version detection, script scanning, and traceroute-v: Increase verbosity level. Written by Kodar. txt . And finally we can fire off the exploit. But it actually write that /etc/shadow into /tmp/SSH/<Some Random Gibberish> file → sleep for 0. The aim of this walkthrough is to provide help with the Tactics machine on the Hack The Box website. Evil-winrm offers an easy way to get C# executables into a target machine. Therefore, if we change the user variable to /etc/passwd, we should gain access to that folder. Getting user access is done by repeating the enumeration processes, making it very important to revisit previously tried enumerations using new accounts. It suggests MD5. 175 -u fsmith -p Thestrokes23 -e /folder/withbinary/. But I think that initial foothold can be gained via PWM console. smb: \> prompt. smb: \> recurse. 80 scan initiated Sat Aug 8 16:34:48 2020 as: nmap -sCV -v -oN nmap/blackfield. Dec 20, 2023 · Certify completed in 00:00:12. aspx remote: devel. (reason why the segfault) So overall the Jul 26, 2023 · Saved searches Use saved searches to filter your results more quickly Nov 1, 2020 · This is a write-up for an easy Windows box on hackthebox. Visual (Medium) 5. tarmode is now full, system, hidden, noreset, noverbose. The authority machine required us to enumerate the host in order to discover an accessible SMB share containing Ansible secrets and a service operating on port 8443. Based on this information, “authority. It is focused on extraction credentials from the ansible file, insecure LDAP authentication capturing Jun 17, 2023 · HTB: Escape. ln fz aw bf wm lp wl sx st ze