Author Archives: cornerpirate

Bypassing CloudFlare

Recently I found myself up against CloudFlare. I was able to sidestep it during the engagement and then get SQLMap working.

If you are short on time here is the technique in a nutshell:

  • Find the IP address for the backend server. You can try securitytrails.com, or brute force against a list of IP addresses using CloudSniffer.
  • Confirm that you can access the HTTP/HTTPs services on the backend service:
nmap -sS -sV -p 80,443 <target_ip>
  • Visit it by the IP address and overwrite the “Host:” header with the target hostname. You can also probably get there by editing your /etc/hosts file properly.

I hope that gets you where you needed to go. If you have the time, then context is often entertaining.

Why, how and narrative

I was testing a customer’s website with access to the source code. Running it through VisualCodeGrepper reported thousands of probable SQL Injection vulnerabilities. Customer also gave me last years Pentest Report (from another provider) which did not mention any injection style issues. This seemed like a fairly big miss.

Burp Suite had no problems detecting an injection point based only on supplying a single-quote versus supplying two. This was the first URL I scanned on day one of the test. The site is completely riddled with SQL Injection. We are testing in production. Oh no.

Manual investigation found no error for “ORDER BY 5 — “, but a 500 error on “ORDER BY 6 — “. SQL Injection fans would then know the next step is “UNION SELECT null,null,null,null.null — “.

Here is where CloudFlare kicked into the story. It seemed to dislike “UNION” pretty hard. Trying various encoding and regex busting techniques such as comments failed to get around this.

This blog post is not describing a zero day in some WAF rule that I cleverly bypassed with some novel approach.

Web Application Pentesting 101

This is a penetration test. We are working in collaboration with the customer. The goal is to find and provide recommendations to fix as many issues as possible. For that reason our pre-requisites ask that WAFs are disabled from our source IP addresses precisely so we are not wasting our time being dropped by a WAF.

If you want us to confirm that your WAF is protecting you first disable it for us so we can land grab as many vulnerabilities as possible. Then turn it back on so we can confirm which were still exploitable.

No you do not want to waste your time doing it with the WAF on first. A penetration test is not a scenario based engagement like red teaming. If you want the test to occur with the defences fully in place well…. You will need to make the duration longer than you probably want to pay for and there is still no guarantees that it will be as useful as the recommended approach.

Back to Bypassing CloudFlare

Without finding a regex busting bypass for “UNION” (and various other SQL function names) what can you do? If the deployment of CloudFlare has failed to sandbox the original backend server then you can completely bypass it. The process is this simple:

  1. Find the backend IP address.
  2. Edit the /etc/hosts file to map that; or
  3. Access the target by IP address and ensure that the “Host:” request header is properly set.

Points 2 and 3 are achieving the same results really. Making sure that your computer goes straight to the original backend IP instead of using DNS to find the intended CloudFlare fronted interface you would usually get.

Find the backend IP address using securitytrails.com

I signed up for a free account on securitytrails.com. I put the target hostname in and then selected “historical data”. I cannot give you the data for the customer obviously but I can show you the historical data for cornerpirate.com:

The important parts here are that it shows you the organisation, and the “last seen” and “duration seen”.

The customer’s site suddenly had the organisation set to “CloudFlare” 7 months prior to the test. For the previous decade the device was hosted on an IP address that they own. I took a wild guess that the original IP had not been altered.

Before proceeding you need to confirm that the original IP address is offering ports 80, 443 or whatever the target is running on. To do that simply use nmap:

nmap -sS -sV -p 80,443 <target_ip>

If the port you want is “open” then you are very likely in.

Find the IP address using CloudSniffer

SecurityTrails.com worked well for me. But what if your target has no history, or you just really don’t want to sign up for a free account? Well you can use CloudSniffer to do it the hard way. This is able to take a text file of IP addresses and then it will scan them to see if they respond identically to the target host you also provide it:

python CloudSniffer.py <target_domain> <ips_in_file> --cleandns

To find the IP addresses you should do some OSINT on the organisation to find netblocks they own.

Using your new bestest IP with SQLMap

If you can remember the narrative here we were trying to bypass CloudFlare to allow us to exploit SQL Injection. You can confirm that CloudFlare is no longer an issue by repeating the request you made with the “UNION SELECT null,null,null,null.null — “. If this now works and you get no error (for an appropriately formatted payload) then you are free to fire SQLMap at it now.

What I did was save the baseline request into “req1.txt” and then used SQLMap’s -r to load that. To be extra sure DNS was not going to kick in I modified the “Host: ” header in “req1.txt” to point to the IP address. This would allow SQLMap to find the target by the IP address.

Since HTTP 1.1 requests need the correct “Host: ” header to be set otherwise you won’t be given the application you desire. Use the –headers=”Host: <target_hostname>” so you can force the correct header:

sqlmap -r req1.txt --headers="Host: <target_hostname>"

It then found the injection point and I went about my way.

The few blog posts I read about this CloudFlare Bypass technique missed the next hop out where you use the IP. Probably because it is obvious right? But I felt it was important to show the SQLMap step I used.

But, there are many ways to skin that goose for various scenarios:

  • Modify your /etc/hosts file appropriately.
  • In Burp 1 – set up a custom DNS rule so it resolves to the IP
  • In Burp 2 – target the site by IP address in your browser and use a match/replace rule to set the Host header correctly.

Hope this helps

Can’t crack NTLMV2 hash caught by Responder, what next?

It finally happened: you have used responder to capture hashes but failed to crack them. This post covers one more way you can use Responder to gain access anyway.

Just Give Me the Steps

If you are time poor here is just the steps:

  • Find a list of hosts on the network that do not enforce SMB signing:
crackmapexec smb <File with ip ranges> --gen-relay-list targets.txt
  • Edit /etc/responder/Responder.conf to set SMB and HTTP to “Off”.
  • Start responder:
responder -I eth0
  • Start NTLMRelayX which on Kali 2023 for me was:
impacket-ntlmrelayx -tf targets.txt

In this configuration NTLMRelayX will relay any NTLMv2 hashes it receives to one of the hosts with SMB signing disabled. It will attempt to dump the local SAM password hashes if those privileges were sufficient to do so. If the hash you relay has domain admin privileges then you are about to rain local password hashes.

The rest of this post is for those who want to understand.

Foundational Knowledge About Windows Hashes

The hashes caught by a simple “responder -I eth0” in its default configuration (with SMB and HTTP “on”) will likely be NTLMv2. They appear in the format like this:

[HTTP] NTLMv2 Client   : 192.168.154.131
[HTTP] NTLMv2 Username : MANGO\neo
[HTTP] NTLMv2 Hash     : neo::MANGO:1122334455667788:2F6CC22CFDC387CFEEB2D325E8997564:0101000000000000C79708D95F14D2011D717D511A761654000000000200060053004D0042000100160053004D0042002D0054004F004F004C004B00490054000400120073006D0062002E006C006F00630061006C000300280073006500720076006500720032003000300033002E0073006D0062002E006C006F00630061006C000500120073006D0062002E006C006F00630061006C0008003000300000000000000000000000001000001047325384B3A000DD5138E15668CB4F44DA5471DAF7A327B5B4E3C19DC485120A001000000000000000000000000000000000000900120048005400540050002F0077007000610064000000000000000000

Note: hash was stolen from https://zone13.io/post/cracking-ntlmv2-responses-captured-using-responder/ just to show the format.

These must be brute-forced before you can use them (turns out this is a lie but I am getting to that). Yessir you have to brute force them before you can use them to authenticate on demand is more accurate.

When you compromise a Windows machine and dump the SAM and SYSTEM hives you obtain hashes that look like this:

[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Note: hash was stolen from https://medium.com/@benichmt1/secretsdump-demystified-bfd0f933dd9b just to show the format.

What the tool secretsdump has labelled “nthash” is actually an NTLM hash. You can clearly see the formats are wildly different which is the point I am making.

The SAM hashes are for local users on the compromised computer whereas responder has retrieved NTLMv2 hashes which are most likely Windows domain user credentials. These are different authentication realms:

  • Gain access to local users and you can logon only to that one computer.
  • Gain access to a domain user account and you can likely logon to anything on the domain.

The other thing to note is that local NTLM hashes DO NOT need to be cracked before you can use them. You can use the Pass-the-hash technique to authenticate to the server locally using only the hash.

This is extremely powerful and if the target organisation re-use the same local user password across all their machines then you have just gained a foothold on lots of machines.

Enter NTLM hash relaying

So it happened that you caught some juicy NTLMv2 hashes but you were unable to crack them right? Then you found this page.

NTLM hash relaying allows you to effectively do something similar to “pass-the-hash” but it is not identical. In pass the hash you use modified versions of the protocol client to insert the hash at the right part of the authentication process ANY TIME YOU WANT TO.

With NTLM hash relaying you are WAITING for a legitimate network user to send their hash on the same network segment as you. Responder will poison local Windows protocols that act like DNS so that this hash is redirected to you. You then use Impacket’s NTLMRelayX tool to redirect that hash at a server which does not enforce SMB Signing.

Pre-requisites for success:

  1. Windows PCs must be configured to broadcast LLMNR, NBT-NS, or MDNS protocols.
  2. You must control a PC on that network segment with Responder and Impacket NTLMRelayX installed.
  3. Some Windows PCs must not enforce SMB Signing. It is maybe worth mentioning that they can support SMB signing if the client does sign it they will accept it if it hasn’t been tampered with. But it must not reject unsigned requests.

If you have all of these then you can use the commands I shared up at the top to conduct the basic relaying attack.

What next?

As we said up top the default “payload” is to try and use the relayed privileges to dump the SAM passwords. This would obviously rely on the privileges of the relayed hash being able to do that. If the customer hashes you are redirecting are low privileged then you will not be able to do that.

At this point you should deep dive into the man page for NTLMRelayX with “-h”. I have pulled out some useful bits:

impacket-ntlmrelayx -h

-c COMMAND            Command to execute on target system (for SMB and RPC). If not specified for SMB, hashes will be dumped (secretsdump.py must be in the same directory). For RPC no output will be
                        provided.

-e FILE               File to execute on the target system. If not specified, hashes will be dumped (secretsdump.py must be in the same directory)

I think you can only set one of the “-c” or “-e” options at a time. Both of them override the default behaviour which is to run “secretsdump” as we have said a few times in this post already to obtain local password hashes.

If you just want a basic proof of concept that some form of command execution was possible then “-c” is easiest:

impacket-ntlmrelayx -tf targets.txt -c "whoami"
impacket-ntlmrelayx -tf targets.txt -c "net user"

For most penetration testing activities this will suffice. You will have proved that you relayed the hash and confirmed the username of your victim, and that they can execute commands remotely. The customer cannot deny it worked and you can crack on with something else.

If you want to establish yourself in your C2 with whatever privileges you land on then “-e” is the way to go. You would have to create an exe that does whatever you need it to and ensure that it bypasses whatever endpoint protection is on the target yourself. It works exactly as you would expect:

impacket-ntlmrelayx -tf targets.txt -e payload.exe

There is one more option that I held back so I could discuss this on its own:

-i, --interactive Launch an smbclient, LDAP console or SQL shell insteadof executing a command after a successful relay. This console will listen locally on a tcp port and can be reached with<br>for example netcat.

I did not run this on my engagement so I didn’t see it in action. If I understand this correctly it is going to try and start a bind shell on any vulnerable PC. You would then be able to use netcat to connect to that and gain interactive command prompt access so I am guessing when it does this is spits out the IP and port for you to know where to go.

While this sounds amazing use this with caution. You would be providing an obvious unauthenticated backdoor onto a system. If you do not remember to close this you will have left the network more vulnerable than when you started which is not the goal of a penetration test.

While this is not a new technique this was just the first time I had occasion to use it. When stuff pays out spectacularly for me I like to ensure I never forget it by blogging about it.

Hope this helps

Captain’s Log: September 2023

September was a mixed bag and for the first time in a while it was more down than up.

Health Update

I fell off the wagon a bit on the weight loss front. I didn’t continue the healthy behaviours as life got a bit more challenging. I haven’t put on a lot of weight either so it wasn’t so bad it is ok to tread water a little bit sometimes.

Weekend 1

With Kid A struggling at school and waiting diagnosis we were directed to a service where similar kids could meet up and parents could get some support. We turned up to is on Saturday morning and got some bemused looks. We were informed that group hadn’t run in 3 years. Nothing like feeling supported by the system eh.

As that was a bust we went to a softplay for the first time in ages and had a decent weekend otherwise.

On the Sunday we went to a magical puppet show.,

Weekend 2

Date night happened this weekend which was nice to have again. We tried a new restaurant that promised some of my favourite things; BBQ and Beer. It was a bit of a disappointment tbh. But we had a lovely evening anyway.

Weekend 3

Kid A was invited to a birthday party on the Sunday. I took them and they were entirely overwhelmed from the moment the entertainment busted out a PA system to scream at about 10 kids. It was sensory overload for me let alone the kid with sensory issues. Kid A wanted to hang around until the entertainment was over so they could at least have lunch with their friends.

This meant bonus 2 hours of us sitting on a bench in a quiet spot having a lovely chat. We actually had a good time, it was great to be invited, and it was a lovely day.

Weekend 4

This weekend was pretty rough to be honest. I was supposed to have a 4 day weekend – and I did. I needed new trousers as I rarely go clothes shopping so this was pretty much the only goal for the weekend.

Kid A was in peak defiance mode. They refused to do anything or go anywhere. So ultimately I was pretty depressed. There had been a lot of negatives from their school this term and the weight of that builds up for me. I desperately needed to get out of the house and instead I was trapped with a screaming child trouserlessly I might add. This was definitely a low point for my morale which is notable for it occurring but also because of how rare that has been.

Eventually I took the risk and ordered trousers online and accepted I’d be locked inside. When they finally arrived I was actually delighted with them. Clothes that fit are great for morale.

Other Stuff

Media and stuff:

  • Slay the spire – I have now played a lot of this having started last month. I have completed it with all 4 characters. Now there is one more way to complete it with a bonus final level. If I do that I get a coveted platinum trophy.
  • XCOM 2 War of the Chosen – that weekend where I was depressed I fell into starting this again. It really occupies my mind and is familiar. A really good game.
  • The Goldbergs – My brother has recommended this for years. I started watching it and fired through 6 seasons fairly rapidly. It is pretty bang on for my childhood at least. It lead to me firing the kids at more 80s movies than usual.

Captain’s Log: August 2023

August over all was a month with challenges. However, nothing was completely dreadful and I did make positive inroads with changing my lifestyle. So lets say it was good!

Somewhere in the month we finally made it to the Burrell Collection. A lovely building, an epic park around it, and lots of things to look at.

Health Update

As I said last month I now am serious about tackling my weight. I have stuck to the intermittent fasting and started integrating walks and a little weight lifting successfully. The onus is on what is going in and not what is going out.

At the end of August I am almost down one entire stone so that is working out a treat for me.

I took my partner swimming which was great. Booked a babysitter and off we went. A cheaper and better date than going to eat food with no idea of the calories. I hope we do this more often.

Weekend 1

We achieved nothing. We needed to do nothing. We literally needed to sit at home and do absolutely nothing. So nothing happened.

Weekend 2

On the Saturday morning we achieved some things from our wall of tasks. Then I tidied our bedroom which had accumulated various things that should not be in there along with some dust from the building work. It is great for the mind to see a bit of floor space I feel.

In the afternoon my partner and I got out for a lovely meal sans kids. It was very relaxing to get some respite. We do have these scheduled once a month but it isn’t quite enough is it.

On the Sunday we went to the cinema to see Elemental. Pixar only went and bloody pixared me again. Weeping like a child.

Weekend 3

I cannot remember what we did on the Saturday at all.

On the Sunday we tried to go to a Junior Parkrun. We were late and the kid that asked to do it refused to do it. Still we had a lovely time playing in the park anyway. I met up with my longest serving friend for lunch and ate a lovely pizza and had a great catch up. A very good weekend overall.

Weekend 4

On the Saturday we got out in the morning for a long walk. Kid B was an absolute nightmare throughout. Though we did eventually get home after 3 miles and had a more relaxed afternoon.

On the Sunday I took kid A out for a big long walk in the morning. Then Kid B went out to a trial class for tennis. Kid B is willing to try stuff and so we are trying to find some sort of hobby they want to keep up. They had a laugh with 3 other kids and so now the difficult part; making them go BACK to something. A serial tryer but then no follow through.

Other Stuff

Life rumbled on and some good stuff did happen. So I have summarised it in photos and briefly:

  • The Witcher – my partner and I have barrelled through all three seasons of The Witcher. Don’t care about truth to the books or the games. As a TV show it was great but it was entirely weird how it refused to tell you where in the continent or timeline things were happening. There was stuff in there that just made no sense at all with no exposition as to why it was happening. Still. We enjoyed it.
  • Death’s Door – one of this months game for PlayStation Network subscribers. I really really enjoyed it. It looked beautiful. The fighting was at times challenging but possible. Within a week I had completed it twice and unlocked my second ever Platinum achievement award (an award for unlocking all achievements). I would recommend it.
  • Football Manager – I enjoy playing this for the fantasy part mostly to would generally financially dope a team to allow me to sign players to watch develop. I have tried a “clean” save file with Wrexham over the last month where I have not cheated and enjoyed a 30 match unbeaten run and am currently top of the Vanerama League. The Wrexham squad you start with is massive and I would normally have cheated to sign about 10 of them away to give me funds. Here funds was not the problem. So I am just trying to wait on other teams to sign the players I don’t want, or for their contracts to expire. This makes progress really slow… But I guess this is why I am doing a save game without cheating to see what that gets me. A different perspective is what.
  • Slay the spire – a sort of card game. I quite like it. But it is frustrating to play. If it is a card game why do you have to earn XP in the game before you get access to the powerful cards in the deck? You have literally no hope of completing the story until you have sunk many hours into it as a result. Still it has worked to kill 30 minutes after lunch and 30 minutes after dinner every day.

Captain’s Log: July 2023

This was a challenging month. The school term was over. Kid A was behaving dreadfully due to the lack of routine. Partly because school was over, and partly because we went for a few weekend getaways, and a week in a hotel when a new bathroom was installed in our house. This disruption added up to pretty stressed parents and children. Though the long term benefit will hopefully outweigh the short term negatives on that one.

I was also out of my routine and the goals for exercise entirely dropped every week. Also being outside of the house more often than not led to a bunch of bad food choices so I essentially put on all of the weight I had lost this year to date.

There were some dark days in July mentally. But eventually we got home and into routine so it started to settle down. Setbacks come and go and progress is iterative on these things.

Health Update

I got bad news that my liver now has more fat in it than last year putting me at higher risk of liver damage. There is still no actual damage but this has renewed motivation to tackle that. I educated myself more and have struck this plan:

  • Intermittent fasting (16:8) – meaning I eat between 12pm and 8pm daily. This I believe gives your body time to burn some fat. I am only drinking coffee or water/squash during the 16 hours. A hot drink does wonders. I have never done this before. My natural mode was always to not eat breakfast so this has been ok.
  • Sleeping earlier – meaning I avoid late night bad food choices and have more energy the right way.
  • Counting calories – this has always worked for me because it is such a pain to record things that it introduces a barrier to throwing something in my mouth. The goal is 1800 ish a day which is enough to have two decent sized meals and some snacks. Weekends may be a little more relaxed I am not sure I will see how I go.
  • Ready Meals – I do not normally eat ready meals regularly but I have found the “Be good to yourself” range at Sainsbury’s is convenient and has a good amount of protein (>20g) and range something like 320-390 calories a meal. I will do this for one meal a day to make counting easier and to make the breaking of the fast easy with something known.
  • Light exercise – I have been a big fan of jogging this year as it is great for mental health. However, I don’t want to do that initially while adapting to the new eating habits. Yet I need to lose visceral fat (around organs) and a bit of weight training and stretching is good to support that.
  • Distraction – after each meal I play the play station for 15-30 minutes. This occupies my hands and mind and feeds the brain dopamine. This is to let me ride out that 15 minutes after eating. During which time your body tells your brain that you are in fact full so it prevents over eating.

That is the plan and it has worked alright so far. The first full week of it we are 6 pounds down and optimistic. The journey has to start somewhere and it has started here.

Other Stuff

Life rumbled on and some good stuff did happen. So I have summarised it in photos and briefly:

  • We travelled a bit – yes this added to the chaos of being out of routine but we put in some miles and some good times were had. We stayed at an Air BNB that felt like bloody Skyfell. Nice to catch up with my cousin and brother. I went back to see my mother and had a lovely Saturday out in the sun.
  • Spiderman: Miles Morales – I played this game entirely through twice getting almost all of the achievements. It was really short for what people would call a Triple A title. Great fun but I was able to literally run through the thing in 18 hours the first time (and I mean 100% completion with all missions, side missions, and collectibles). The Arkham series of games all took far longer. Still I loved it enough I have committed to the 2nd game on pre-order.
  • Bowling – we went bowling and watched the second spiderman spider verse thingy. Which we were outraged to discover had a second part (so the story didn’t end) and then now I have read part 2 is delayed.
  • New Bathroom – major home improvement having a bathroom that works properly, is easy to clean, and has some nice touches like underfloor heating. The place we moved into really sucked. That is several years we had to put up with complete nonsense! Downside I am now very poor. So swings and roundabouts.

Captain’s Log: June 2023

Overall a good month. I did my exercise (150 active minutes per week) for the whole month. The weather was alright. This was however the month where Kid A chucked the TV remote at the TV thus wrecking said TV. It was gone way before it’s time considering I got like 15 years out of my previous one.

It was an accident. So we have had to move on.

First Weekend

It was hot. It was very hot. It was the kind of hot that I moved back to Scotland to avoid.

On the Saturday we went to a kids’ birthday party across the road for a bit until our kids’ behaviour was so appalling that we had to leave. Not helped by the heat tbh.

On the Sunday I was supposed to go out for date night but for us that is like at 5pm. It was so damn hot that I got as far as the train station before freaking out. Retreated to our house which is easily 4c cooler than outside.

Second Weekend

On the Saturday we were supposed to go to a fair at the nursery.

But we couldn’t get them to agree to leave so it became a mad flash point. The kind that just winds me the heck up. In the evening the kids refused to sleep until like 10pm so the evening was a washout. Until I hopped online for some counter strike with a friend. I still cannot shoot for shit but I will try the objectives every time and think the team winning is better than the number of kills. So that was going well.

Third Weekend

Scotland played and beat Norway. That was about all I can remember lol.

Fourth weekend

As with the rest of the house the kitchen is a bit broken. We are about to get the bathroom replaced and the kitchen is in the plan but it won’t be ripped out for a few years.

One of the annoying things is a perfectly good fridge/freezer we bought that is presenting problems where water gathers inside it.

It is outside of warranty (so not easy way to replace it) and annoyingly one of the screws seems to have been stuck on by a rather assertive machine. I cannot get it undone to properly look at the right part of the fridge so the best we can do is take the water out every 3 months or so and give the inside a clean. Now.. this would be fine. But the exact drawer we need to take out to do this needs the fridge door to open slightly more than 90 degrees where we have it installed it can open exactly 90 degrees. To clean it we have to move the fridge out a bit which is a massive massive pain in the butt. I have to empty an entire kitchen unit and move that to get the fridge out every time. So that is what we did on Saturday.

Played some football manager too. I have gotten all the way to 2025 and my team is now established in the premiership and somehow finished 4th putting me into the Champions League. This weekend I got through my summer transfer window and finally have three quality choices for every player. This means I am gonna go for every single competition as best I can since we can weather any injuries and 3 matches a week with smart rotation.

Other bits

  • DIY Guitar Kit – I have *still* not started work on the kit guitar finishing like I thought I would. I have all the items. But I lacked the energy to sand a guitar for hours and hoovering up the dust from the living room is going to be an ongoing chore. I will get on it in March April May June July August!
  • Football Manager 2023 – I have progressed the Birmingham City save to season 3 having survived in the Premier League and somehow won the Carabao cup. This success really broke the game as I had made so much money for the club but they still gave me 0% of transfer revenue to spend. With the cup win we qualified for the UEFA conference league (of which I had no experience before). This would put even more pressure on my small and young squad. This league has been amazingly easy so far and each victory pays you £400k a match. The wins in this have easily covered the wage bill this year several times over. This has massively boosted the financial might of BCFC! To cope with all the fixtures I have had to heavily rotate the squad such that everyone is going to play around 30 matches this season. As I write we are hovering around euro qualification via PL, in the UEFA conference league, in the Carabao and FA cups and just about to complete the January transfer window. The board *finally* gave me a transfer budget this January (when they finally realised how we are insanely profitable). However, the club’s prestige is such that we cannot attract better than we have and about 6 of the first team have release clauses that make them tasty targets. I added 3 players to the squad of similar quality to what I had. That has helped the team continue to perform with boosted quality from the bench. Yes I have to rotate but now you are basically full strength every match.
  • Fubar – A TV show on Netflix. This was like a live action Archer in many respects and I am totally here for it. The humour isn’t the same but I got a lot of fun out of this.
  • Spiderman Life Story – I periodically try to get into graphic novels. This one had an interesting idea that Spiderman had aged in real-time through the events that occurred so they could show him interacting with real-world events. It was a nice afternoon’s diversion reading it out in the sunshine.

Captain’s Log: May 2023

May was mostly excellent thank you for asking. I have now consistently been getting my active minutes way over the 100 minute per week goal for the last few months. I am now getting better at the 2 mile distance and feeling a lot stronger and more focused in general.

From physical health flows everything positive.

First Weekend

I thoroughly enjoyed the long weekend. Birthday at a softplay/Library/Date Night/Football/Movies. All good things. Time as a family, time alone, time with each kid, time with my partner. Excellent times.

During the first week I did some gardening which gave me many active minutes so I smashed the 100 minute target and hit 170. There was only one jog in there so it felt like a bit of a cheat. However, active minutes are the target and active minutes were achieved.

Second Weekend

During the second week I tried to get back into jogging again. I smashed out a good hour on the bank holiday Monday and then did enough to reach 170 active minutes over the week. This was good.

On the weekend kid B had a friend’s birthday party at a soft play first thing on Saturday. We did that and then it was lovely and sunny so I put out a tent in the back garden and enjoyed the sun from the shade for a bit. The day ended with us watching Eurovision and enjoying the absolute spectacle of it.

On Sunday kid B had another friend’s birthday party at the same soft play arranged. I got them ready for that one and even drove half way there. I think I had not had enough sleep due to the late Eurovision finish so I had the starting of a panic attack while driving. I looped back home and then felt like a dick for disappointing the kid, their friend, and friend’s parents. A reminder that I always need to get the right amount of rest and that I have rules about how many things I arrange on a weekend for a reason. A minor thing really.

Third Weekend

We left our kids at home for the first time overnight and got away to Oxford for a wedding reception. We got all dressed up and spoke to a bunch of lovely people and had a thoroughly excellent time.

Which all sounds very normal right? Because it is. However, this is a major win. I have had insane anxiety issues for several years now. Travelling has been pretty much out of the question.

I have been working on it by challenging the wonky thought processes that were diminishing my quality of life. I have coping strategies and skills to spot and address the spiralling thoughts. There were obviously moments where the strategies were deployed but on the whole it went really well. As always the trip HOME was completely joyous. Man if I could just make every journey OUT feel like the way I do on the way HOME all my problems would be over!

Final weekend

I had a super long weekend with the Friday and Monday off work. It was nice to relax in my house and hang out with the kids.

I took them outside every day for hours and caught a lot of sun myself. I managed two jogs and I got a bunch of tasks done such as finally packing up the old living room floor and getting most of it to the tip. I found a frog living under the wood and wondered exactly how far this guy had travelled since there are no bodies of water or even ponds in anyone’s garden nearby.

I played some Football Manager and watched the entire season of FUBAR. This is a TV show on Netflix which is basically a live action Archer. I thought it was really well done.

It would have been nice to hang out with my partner more but they were preparing for an exam

Other bits

  • DIY Guitar Kit – I have *still* not started work on the kit guitar finishing like I thought I would. I have all the items. But I lacked the energy to sand a guitar for hours and hoovering up the dust from the living room is going to be an ongoing chore. I will get on it in March April May!
  • Football Manager 2023 – I have progressed the Birmingham City save to season 3 having survived in the Premier League and somehow won the Carabao cup. This success really broke the game as I had made so much money for the club but they still gave me 0% of transfer revenue to spend. With the cup win we qualified for the UEFA conference league (of which I had no experience before). This would put even more pressure on my small and young squad. This league has been amazingly easy so far and each victory pays you £400k a match. The wins in this have easily covered the wage bill this year several times over. This has massively boosted the financial might of BCFC! To cope with all the fixtures I have had to heavily rotate the squad such that everyone is going to play around 30 matches this season. As I write we are hovering around euro qualification via PL, in the UEFA conference league, in the Carabao and FA cups and just about to complete the January transfer window. The board *finally* gave me a transfer budget this January (when they finally realised how we are insanely profitable). However, the club’s prestige is such that we cannot attract better than we have and about 6 of the first team have release clauses that make them tasty targets. I added 3 players to the squad of similar quality to what I had. That has helped the team continue to perform with boosted quality from the bench. Yes I have to rotate but now you are basically full strength every match.
  • Fubar – A TV show on Netflix. This was like a live action Archer in many respects and I am totally here for it. The humour isn’t the same but I got a lot of fun out of this.

Captain’s Log: April 2023

April was 75% excellent and then a week of feeling ill after vomiting. It marked the first month where I managed multiple weeks back-to-back hitting my exercise goals for a little while. I was getting pretty decent at my 2 miles every other day before work before I was sick. I took a week off to get properly over it and I run into May ready to stitch together more weeks!

First Weekend

We got out on Saturday morning and took the kids to the shops to pick an Easter egg. They seemed bemused by the whole endeavour but the shopping experience was much better than the last time. There was a trip to the Library thrown in too.

On Sunday I took Kid B to the park in the morning . They then had a play date in the afternoon. I played a bunch of Football Manager and started watching “The Night Agent” on Netflix. I enjoyed the show as it felt about as close to “24” as we have had since well.. “24”.

Second Weekend

With the bank holidays this was a joyous 4 days off.

On Saturday we went to a farmers market, and then had a date night in the evening while a babysitter put the kids to bed.

On Sunday we took the kids to a big bouncy castle kind of place which had a very drunk giraffe at it. This is an activity $eldest would traditionally have been unable to keep themselves safe at. This was great to see them coming when called and not attacking the walls.

On Monday we went to see the Mario movie at the cinema. This is the first successful cinema visit as both kids sat for the duration. New out of the house activity unlocked. We have wasted untold £s having to leave cinemas 20 minutes in before.

I really needed the four days off and to get out the house everyday.

Third Weekend

Saturday we got out early and did some errands. Dropped $ELDEST at a birthday and took $YOUNGEST to the park for a run around. It was really nice.

Sunday I took $YOUNGEST to their first ever activity group (a football kick about). It went well. They listened to the instructions and learned how to do some stuff. Fears that they would be as impossible to coach as $ELDEST appeared unfounded. Spoiler alert: next week they refused to do it exactly like $ELDEST.

Fourth weekend

I got to the end of work on Friday just about and then started feeling nauseous. Few hours later yup a big old vomit. A really poor nights sleep and generally a bit miserable.

On the plus side my really long night allowed me to watch the entire last season of Brookly-99 that had just arrived on Netflix.

Unfortunately this meant I had to cancel our trip to Edinburgh to goto the Dr Who exhibition.

Final Weekend

We booked into the Dr Who exhibition again and this time made it! $ELDEST had a lovely time looking at all the things. While $YOUNGEST tried to run through the entire thing in 30 seconds. We have spent weeks watching the first 4 series of (new) Dr Who to prep them for this and it has been nice doing so. A little bit of ritual family time before bedtime most days has been nice.

On the Sunday my partner took me shopping for clothes (which hasn’t happened in a very long time). We needed a babysitter to do it because the kids tolerance for their own clothes shopping is almost zero and for us it is zero. It was nice to try on stuff without a complete rush and I now have some trousers that actually fit and aren’t falling apart/really for exercising. So that is nice. Feeling pretty good about that.

Other bits

  • DIY Guitar Kit – I have *still* not started work on the kit guitar finishing like I thought I would. I have all the items. But I lacked the energy to sand a guitar for hours and hoovering up the dust from the living room is going to be an ongoing chore. I will get on it in March April May!
  • Football Manager 2023 – I have a save game as Birmingham City. Their finances are so fucked in reality. It was not going to be much fun playing this on “reality mode”. The fun of the game is to sign players and make a team you like. It would take like 5 seasons of struggle to even start to replace the players legitimately. So I cheated and used a rich team to sign a bunch of players to free the wage bill to allow me to sign a few free/cheap players. Somehow that squad made it to the premier league (as runners up) and somehow I have managed to keep them there in that first season with a few games to spare. The club might actually have turned the financial corner with that so I might have some budget for next season. The only plus points are that my team has a backbone of their real academy players that have now had like 3 seasons in the first team while mostly being < 22 years old. I could sell a few for real money and thus increase the quality of the squad by getting like 3 players that are better for that money. Now the fun begins. Trying to consolidate a place in the premier league while incrementing the quality of the squad until you might win a cup or two.
  • The Night Agent – A TV show on Netflix that was a nice thriller. Really enjoyed it and encourage you to give it a go.

Captain’s Log: March 2023

I started the month just getting over whatever cold and sickness occupied me for February. As always with renewed energy for the month and optimism. As it turned out March was ok but I got ill again in ways that disrupted the relentless exercise progress once more. There is always April!

First Weekend

We got our shit together and out the door early on Saturday. We took the train into town and went to the Gallery of Modern Art (GOMA) where there was a kids arts and crafts event on. Kid A did quite well just drawing while Kid B ran out of the room about 200 times until eventually we had to come home.

Minor point but when I was struggling more getting on a train was excruciatingly challenging. This day there was a minor wobble on the way out and then big smiles on the way home.

Second Weekend

I had used my two remaining days of annual leave to make this a long weekend. It was brilliant. On the Friday the kids were finally out of the house while me and my partner had a full 9am-> 2pm to relax at home. Only relaxation was achieved and that was enough. I very much miss days like this so it was great to have one.

Kid B was invited to a birthday party on Saturday morning so we drove out to that. I then took an unplanned 2 mile jog around the car park of the soft play before returning to collect. This was good on my return to exercising regularly as I wanted to get back to around 120 active minutes a week.

Me and my Partner went out to a Vegan restaurant in Partick and had a lovely long walk there and back. It was the first “date night” we have managed since before December for one reason or another. It was absolutely brilliant just to exist without kids for a bit.

The exercise target was obliterated by having that extra long walk to and from Partick. March started out absolutely great!

Household Sickness

My partner and Kid A were then down with the sickness for a few days. I gladly take on all the duties when I have to but it is exhausting long days. Precisely how single parents do this and work is beyond me. 7am to 9pm days of doing everything are knackering.

Third Weekend

I honestly cannot remember what happened this weekend. I think because my partner and one of the kids was a bit sick we took it easy. Also to try and help me recover from the long days I had done in the week being a parent, carer, and good worker bee.

My Sickness

In typical staggered fashion I ended up feeling ill somewhere on Monday afternoon. Probably I had been incubating it from my partner/kid over the third weekend. It really knocked me out so I had a day off on Tuesday. Which was so tedious that I returned on Wednesday when I possibly should not.

My partner was well again so they dropped off and picked up the kids the whole week while I sort of moped about and tried to just work and sleep better.

Fourth weekend

My partner flew to London (though they were sad to leave me looking a bit sick still). The kids and I had a chilled weekend as I could not take them anywhere. I also thought I had lost my wallet picking up meds on Thursday so in the area of doubt cancelled my bank cards. Even if I felt fine I would have been unable to go anywhere other than the park of library so it was completely relaxed.

We got as far as the garden for some light exercise, and spent the time playing games.

Once again worth noting that there was a time me being left alone with the kids was just a relentless anxiety day and nightmare. Not because they are evil kids or that I feel I cannot cope. There was just a wee voice that used to say things like “what if you collapse?” and no amount of saying HEY MATE! YOU HAVE NEVER COLLAPSED! IT’LL BE FINE. Could drown out whatever part of the lizard brain triggered the illogic in the first place.

So once again good solid evidence of the progress I am making that this nonsense could not take root and instead we had a very relaxing weekend. A bit frustrating that we had to stay entirely at home but honestly it was nice.

Music

I had a go at making a cover of Behind Blue Eyes by The Who. I did this because it is mostly an acoustic song but when you listen to it there is some simple vocal layers that add complexity. I am not a great singer and I also wanted to push myself to do more than a single take vocal and to add those layers in to make it sound fuller. It sort of worked I think. I learned a lot from doing it and actually ended up not hating my voice after listening to it a lot.

Then I had a go at a cover of Sweet Dreams are made of this by the Eurythmics. I went deep into it getting the drum pattern right and playing the most common synth part. I mixed it up with an acoustic guitar doing the chords and arrived at something that was kind of fun to put together.

Again it is a hobby where I am learning a lot and the key is to just do “something” regularly to progress. What the something is has almost no quality control what so ever!

Other bits

  • DIY Guitar Kit – I have *still* not started work on the kit guitar finishing like I thought I would. I have all the items. But I lacked the energy to sand a guitar for hours and hoovering up the dust from the living room is going to be an ongoing chore. I will get on it in March April!
  • Football Manager 2023 – As I felt pretty miserable when I was sick I picked this up and have just about completed an entire season. While I love FM and have played it since it was CM back in the 90s. I think I am starting to like it less because there is now so many things in the game. I just want to sign players, play them, and win some stuff. Now you have a Squad Planner than I don’t really want. I was happy having a view of my players and their suitability for a position over my current tactics like before. Now they really want you to care about the playing time you promise people and about squad hierarchies etc. Honestly I just can’t be bothered with it. It throws up too many mad things like at the end of my first season I had a 36 year old captain playing as a striker. I was happy to keep him for his experience from the bench but the dude asked for a non-negotiable 2 year contract with a 3rd year happening if he played 5 times and on about4-5 times the salary he had been on. Obviously this is wildly unrealistic so I had to eventually sell them and watched the squad morale drop like a stone in the ocean. Like… Seriously.. Couldn’t afford that deal at all! Also I have been bitten by a bug where selling a player tells you “X amount has now been added to your transfer funds” but then it has not. So I had sold a tonne of players to reshape the squad but now I cannot replace them! Which seems mad. I think these two things have killed this save game.
  • Scotland National Football Team 1 – When my partner was away for the weekend I watched Scotland vs Cyprus with the kids. I could never interest kid A before but kid B seems into it. Sadly the match with Spain was too late on a school night to sit-up and watch with them. I would love to get to the point where I can take them to a game but I don’t think we are quite there yet.

Captain’s Log: February 2023

Maybe I am waning in my desire to open journal like this. Usually I have the discipline to start the post with the changing of a month and then top it up once a week before posting it bang on time. I had not even started this post until 10pm on March the 1st which is unusual. So it is going to be brief.

Overall I loved living February 2023. I was in good spirits throughout. I was however sick for about the last 10-12 days of the month. Nothing serious it was just bad timing. $youngest was ill and I caught their cold and it was persistent. Then just as I was feeling well enough to go back out jogging on Friday 24th I woke up the next day with a new fever and an earache to match $eldest’s symptoms.

The cold was pretty mild and so I worked through it without issues. I just felt a bit grotty and wasn’t able to do much physically. The earache was fun though! It sounded like I was underwater and I could barely hear people talking a metre away from me. I felt absolutely shitty for the final weekend of February as a result and took Monday and Tuesday off work to recuperate and felt fine but a little tired on March 1st.

Health aside I spent some nice time with the kids. There was a birthday party to attend at a soft play that went well. Kids did well and had fun and they even came when called to go. Therefore earning privileges to go back on another Saturday morning sometime soon!

We had two visitors come to our house (we are trying to up our game here so that the kids see other humans). I was too ill to clean for the first visitor but I did get the house looking quite nice for the second visitor before the earache landed.

Music

I haven’t written a song in a while. Then bam a friend of mine had a video of them drunkenly describing why The Beatles are (in their opinion) crap posted online. I found his example lyrics absolutely delicious and so took on the challenge of making what I think he hears when he hears say Sgt Pepper’s Lonely Hearts club band. To achieve this I listened to Lucy in the Sky with diamonds about 100 times and as a result each time I play this I laugh my ass off. The drum track in particular is bang on.

I think it works because if you strip out all the layers the song is actually not bad. In my opinion obviously.

It reminded my that for quite a chunk of 2022 I was making a random song in 2-4 hours every week. I have definitely gotten better at the process which is exactly why I am having fun with it. A great hobby.

Other bits

  • XCOM 2: War of the chosen: I spent most of the month playing this in the evenings. It was the only thing I was capable of physically for the second half of the month.
  • XCOM 2 – I had completed XCOM 2 in January I think. After defeating WOTC I immediately started this again but with an aim to run through it to see a reduction in the number of days. I got to plasma weapons in record time for me when I usually slowly build.
  • DIY Guitar Kit – I have not started work on the kit guitar finishing like I thought I would. I have all the items. But I lacked the energy to sand a guitar for hours and hoovering up the dust from the living room is going to be an ongoing chore. I will get on it in March!
  • Star Trek Voyager: I got through this while playing WOTC and during other tasks. I always liked the characters but this time I got some different stuff out of it. It is a good show.
  • Star Trek Enterprise: I started this after Voyager. I maintain that I love this show more than the average star trek fan. Even going so far as to say that it has one season that I loved so much on first viewing it that I said “it was the best season of any star trek”. I refer to the Xindi season where I loved the ongoing plot. The mystery. It had a purpose and it was darker than Star Trek had ever been. The show got so much hate when it was released. But not from me. If you are honest you will find the first season is pretty ropey in all of the shows. I am dreading putting up with the “ending” of this show. They really did them dirty.