Re: RLA ("Remote LanD Attack")

[Synister Syntax]

ICAgICBJIGFncmVlIHRoYXQgdGhpcyBpcyBpbiBmYWN0IGEgRG 9TLCBob3dldmVyIGl0IGlzIHVz
aW5nIHRoZSBvbGQKTGFuRCBhdHRhY2sgKGZyb20gMTk5Nykgc3 ludGF4L3N0eWxlLiAgVGhhdCBm
YWN0IHRoYXQgaXQgaXMgYSBwYWNrZXQKdG8gaXRzZWxmLCBmcm 9tIGl0J3Mgc2VsZiwgb2J2aW91
c2x5IHNwb29mZWQuICBBcyB0aGlzIHdhcyB0aGUgc2FtZQp3YX kgaXQgd2FzIGRvbmUgYmFjayBp
biB0aGUgOTAncy4gIFRoZSBkaWZmZXJlbmNlIGhlcmUsIGlzIH RoZSBmYWN0CnRoYXQgdGhlIExh
bkQgYXR0YWNrIGNhbiBiZSBwZXJmb3JtZWQgcmVtb3RlbHksIH doZXJlYXMgYmVmb3JlIHRoZQph
dHRhY2sgd2FzIG9ubHkgYSBMb2NhbCAoTEFOKSBhdHRhY2suCg ogICAgIEFsc28gbm90ZSB0aGF0
IHRoaXMgaXMgYW4gYXR0YWNrIG9uIGRldmljZXMsIG5vdCBPUy dzLiAgQWxzbyBsZXQKbWUgbm90
ZSB0aGF0IHRoZSBkZXZpY2UgaXMgdW51c2FibGUgdW50aWwgaX QgaXMgcGh5c2ljYWxseSByZXNl
dC4gCkVpdGhlcndheSwgSSBhbSBmaW5lIGJ5IHRoaXMgYmVpbm cgY29uc2VkZXJlZCBhIERvUywg
aXQgaXMuICBJdCB3aWxsCnNodXQgZG9lbiB5b3VyIHN3aXRjaC AocmVuZGVyaW5nIHlvdXIgbmV0
d29yayB1c2FsZXNzKSBvciB5b3VyIHJvdXRlcgooa2VlcGluZy B5b3UgZnJvbSBhY2Nlc3MgdGhl
IGludGVybmV0IGV0Yy4pLgoKSWYgeW91IGhhdmUgYW55IG90aG VyIHF1ZXN0aW9ucywgb3IgY29t
bWVudHMgcGxlYXNlIGxldCBtZSBrbm93LiAKVGhhbmtzIGZvci B0aGUgaW5wdXQsIEkgdGhpbmsg
SSBkaWQgaW5mYWN0IG5vdCBzdGF0ZSB0aGF0IHRoZSBhdHRhY2 sKd2FzIGEgRG9TLgoKT24gMTIv
MTUvMDUsIHNlcnZpY2UgcGFjayA8c3BwcmlkZUBnbWFpbC5jb2 0+IHdyb3RlOgo+IFVwZGF0ZWQg
dGhlIHdpa2kgcGFnZS4gWW91ciBsb29raW5nIGF0IGEgZGVuaW FsIG9mIHNlcnZpY2Ugbm90IGEg
bGFuZAo+IGF0dGFjay4KPgo+ICBMYW5kIGF0dGFja3MgYXJlIG NhdXNlZCB3aGVuIGEgbWFjaGlu
ZSBmbG9vZHMgaXRzZWxmLgo+Cj4gIEZpcnN0IGV4YW1wbGUsIC BFY2hvIGFuZCBDaGFyZ2VuIChJ
Q01QIGFuZCBDaGFyYWN0ZXIgZ2VuZXJhdG9yIChvbGQgdW5peA o+IHNlcnZpY2UpKSBBcmUgc2Vy
dmljZXMgdGhhdCByZXBseSB0byBhbnl0aGluZy4KPiAgQSBzcG 9vZmVkIHBhY2tldCBpcyBzZW50
IGZyb20gYSBtYWNoaW5lcyBlY2hvIChzcG9vZmVkKSB0byB0aG UgY2hhcmdlbi4gVGhlCj4gY2hh
cmdlbiByZXBseXMgd2l0aCBnYXJiYWdlLCBhbmQgdGhlIGVjaG 8gZWNobydzIGl0Cj4gIGJhY2sg
YW5kIHNvIG9uIHVudGlsIHRoZSByZXNvdXJjZXMgYXJlIGNvbn N1bWVkLgo+Cj4gIEFueXRoaW5n
IHRoYXQgZG9lc24ndCBoYXZlIHRoaXMgZWZmZWN0IGlzIGEgRG VuaWFsIG9mIHNlcnZpY2UuCj4K
PiAgTm93IFNOTVAgYW5kIHdpbmRvd3MgS2VyYmVyb3MgY2FuIH RhbGsgdGhlbXNlbHZlcyB0byBk
ZWF0aCAoYW4gZXhhbXBsZSBvZiBhCj4gbm9uLWNyb3NzIHNlcn ZpY2UgbGFuZCkuCj4KPiAgTWFr
ZXMgc2Vuc2U/IDopCj4KPiAgU1AKPgo+Cj4gT24gMTIvMTQvMDUsIFN5bmlzdG VyIFN5bnRheCA8
c3luaXN0ZXJzeW50YXhsaXN0QGdtYWlsLmNvbT4gd3JvdGU6Cj 4gPiBCZWxvdyBpcyBhIGNvcHkg
b2YgbXkgUkxBIGV4cGxvaXQgc3VibWlzc2lvbiBpbiBBU0NJSS 4gIEF0dGFjaGVkIGlzIGEKPiA+
IE1TV29yZCAoLmRvYykgdmVyc2lvbiB3aXRoIHJpY2ggZm9ybW F0dGluZywgY3JlYXRlZCB3aXRo
IGVhc2Ugb2Ygdmlldwo+ID4gaW4gbWluZC4KPiA+Cj4gPiBSZW dhcmRzLi4uCj4gPgo+ID4gLS0t
LS0tLS0tLQo+ID4KPiA+IFJMQQo+ID4gKCJSZW1vdGUgTGFuRC BBdHRhY2siKQo+ID4gMjAwNQo+
ID4KPiA+Cj4gPiBBcyBkaXNjb3ZlcmVkIGJ5Ogo+ID4gSnVzdG luIE0uIFdyYXkKPiA+IChqYXlp
emtvb2xAZ21haWwuY29tKQo+ID4KPiA+Cj4gPiBEZXZpY2VzL1 ZlbmRvcnMgVnVsbmVyYWJsZToK
PiA+IC0gTWljcm9zb2Z0IFdpbmRvd3MgWFAsIFNQMSBhbmQgU1 AyCj4gPiAtIExpbmtzeXMgUm91
dGVycwo+ID4gLSBXZXN0ZWxsIFJvdXRlcnMvTW9kZW1zCj4gPi AtIE1vdG9yb2xhIE1vZGVtcy9S
b3V0ZXJzCj4gPiAtIENpc2NvIEZpcmV3YWxscywgU3dpdGNoZX MsIGFuZCBSb3V0ZXJzCj4gPiAt
IERTTCBNb2RlbXMKPiA+IC0gQ2FibGUgTW9kZW1zCj4gPiAtIE NvbnN1bWVyIFJvdXRlcnMKPiA+
IC0gQWxsIENlbnRyYWwgQ29ubmVjdGl2aXR5IERldmljZXMgKG FueSBtYW51ZmFjdHVyZXIpCj4g
Pgo+ID4gRGV2aWNlcy9WZW5kb3JzIFRlc3RlZDoKPiA+IC0gTG lua3N5cyBCRUZXMTFTNAo+ID4g
LSBMaW5rc3lzIFdSVDU0R1MKPiA+IC0gV2VzdGVsbCAgVmVyc2 FsaW5rIDMyN1cgKFZlcml6b24g
TW9kZW0pCj4gPiAtIENpc2NvIENhdGFseXN0IFNlcmllcyAoTX VsdGlwbGUpCj4gPiAtIFNjaWVu
dGlmaWMgQXRsYW50aWMgRFBYMjEwMCAoQ29tY2FzdCBNb2RlbS kKPiA+Cj4gPiBEZWZpbml0aW9u
Ogo+ID4gQSBMQU5EIGF0dGFjayBpcyBhIERvUyAoRGVuaWFsIG 9mIFNlcnZpY2UpIGF0dGFjayB0
aGF0IGNvbnNpc3RzIG9mCj4gPiBzZW5kaW5nIGEgc3BlY2lhbC Bwb2lzb24gc3Bvb2ZlZCBwYWNr
ZXQgdG8gYSBjb21wdXRlciwgY2F1c2luZyBpdCB0bwo+ID4gbG 9jayB1cC4gVGhlIHNlY3VyaXR5
IGZsYXcgd2FzIGZpcnN0IGRpc2NvdmVyZWQgaW4gMTk5NyBieS Bzb21lb25lCj4gPiB1c2luZyB0
aGUgYWxpYXMgIm0zbHQiLCBhbmQgaGFzIHJlc3VyZmFjZWQgbW FueSB5ZWFycyBsYXRlciBpbgo+
ID4gb3BlcmF0aW5nIHN5c3RlbXMgc3VjaCBhcyBXaW5kb3dzIF NlcnZlciAyMDAzIGFuZCBXaW5k
b3dzIFhQIFNQMi4KPiA+IChodHRwOi8vZW4ud2lraXBlZGlhLm 9yZy93aWtpL0xBTkRfYXR0YWNr
KQo+ID4KPiA+IEV4cGxhbmF0aW9uIG9mIExhbkQ6Cj4gPiBMYW 5EIHVzZXMgYSBzcGVjaWFsbHkg
Y3JhZnRlZCBJQ01QICBlY2hvIHBhY2tldCB3aGljaCBoYXMgdG hlIHNhbWUKPiA+IHNvdXJjZSBh
bmQgZGVzdGluYXRpb24gYWRkcmVzcy4gIFRoZSByZWNlaXZpbm cgc3lzdGVtIHN0YWxscyBkdWUg
dG8KPiA+IHRoZSBlcnJvbmVvdXMgcGFja2V0IGFuZCBub3QgaG F2aW5nIGluc3RydWN0aW9ucyB0
byBoYW5kbGUgdGhlIHVuaXF1ZQo+ID4gcGFja2V0LiAgSW4gV2 luZG93cyA5eCAgdmFyaWFudHMs
IHRoZSBzeXN0ZW1zIHdpbGwgImJsdWUgc2NyZWVuLiAiICBPbg o+ID4gbW9kZXJuIE5UICB2YXJp
YW50cywgdGhlIHN5c3RlbXMgd2lsbCBoYW5nIGZvciBhcHByb3 hpbWF0ZWx5IDMwCj4gPiBzZWNv
bmRzIHdpdGggZnVsbCBDUFUgdXNhZ2UgYmVmb3JlIGRpc2Nhcm RpbmcgdGhlIHBhY2tldC4gIFdp
dGggYQo+ID4gbG9vcGVkIHNjcmlwdCwgdGhlIGF0dGFja2VyIG NhbiByZW5kZXIgdGhlIHN5c3Rl
bSB1c2VsZXNzLiAgVU5JWAo+ID4gdmFyaWFudHMgaGF2ZSBiZW VuIGFibGUgdG8gdXNlIGEgZmly
ZXdhbGwgcnVsZSB0byBkcm9wIExhbkQgcGFja2V0cyCWCj4gPi BsZWF2aW5nIG1vc3Qgc3lzdGVt
cyBwYXRjaGVkLgo+ID4KPiA+IE1pY3Jvc29mdCBvcmlnaW5hbG x5IHJlbGVhc2VkIGFuIGluaXRp
YWwgcGF0Y2ggdGhhdCBzZWN1cmVkIFdpbmRvd3MgOXgKPiA+IH ZhcmlhbnRzIJYgY2F1c2luZyB0
aGUgZXhwbG9pdCB0byBsb3NlIHBvcHVsYXJpdHkgYW5kIGJlY2 9tZSBzb21ld2hhdAo+ID4gb2Jz
Y3VyZS4gIExhdGVyLCB3aGVuIFdpbmRvd3MgTlQgdmFyaWFudH Mgd2VyZSByZWxlYXNlZCwgTWlj
cm9zb2Z0Cj4gPiBuZWdsZWN0ZWQgdG8gcGF0Y2ggdGhlIHNlY3 VyaXR5IGZsYXc7IHRoaXMgY2F1
c2VkIFdpbmRvd3MgWFAgU2VydmljZQo+ID4gUGFjayAyIHRvIH JlbWFpbiBzdXNjZXB0aWJsZSB0
byBzdWNoIGFuIGF0dGFjay4gIFdpdGhpbiB0aGUgbGFzdCBmb3 VyCj4gPiAoNCkgbW9udGhzLCBN
aWNyb3NvZnQgaGFzIHJlbGVhc2VkIGEgcGF0Y2ggZm9yIFdpbm Rvd3MgTlQgdmFyaWFudHMuCj4g
Pgo+ID4gTGFuRCB2ZXJzdXMgUmVtb3RlIExhbkQ6Cj4gPiBMYW 5EIHdhcyBvcmlnaW5hbGx5IGlu
dHJvZHVjZWQgaW4gdGhlIGxhdGUgMTk5MHMgYW5kIHdhcyB2ZX J5IHBvcHVsYXIKPiA+IHdpdGgg
ZWR1Y2F0aW9uYWwgYW5kIGJ1c2luZXNzIG5ldHdvcmtzLiAgVG hlIG9yaWdpbmFsIExhbkQgYXR0
YWNrIGhhZAo+ID4gdG8gYmUgZXhlY3V0ZWQgaW50ZXJuYWxseS BvbiB0aGUgbG9jYWwgbmV0d29y
ayCWIHRoZXJlYnkgZ2l2aW5nIHJpc2UKPiA+IHRvIHRoZSBuYW 1lICJMYW5EIiAoaW5kaWNhdGlu
ZyB0aGF0IGFjY2VzcyBoYXMgYmVlbiBncmFudGVkIHRvIHRoZQ o+ID4gbG9jYWwgcHJlbWlzZXMp
LiAgSG93ZXZlciwgd2l0aCBhIHJlbW90ZSBhdHRhY2sgKFJlbW 90ZSBMYW5EKSwKPiA+IGNyYWZ0
aW5nIHNwZWNpYWwgcGFja2V0cyBhbmQgc3Bvb2ZpbmcgdGhlIG Rlc3RpbmF0aW9uIGFuZCBzb3Vy
Y2UgSVAKPiA+IGFkZHJlc3NlcyB3aWxsIGNhdXNlIHRoZSBhdH RhY2sgdG8gYmUgY2FycmllZCBv
dXQgcmVtb3RlbHkgYWdhaW5zdCB0aGUKPiA+IGNlbnRyYWwgY2 9ubmVjdGl2aXR5IGRldmljZS4K
PiA+Cj4gPiBFeHBsb2l0IC8gUHJvb2Ygb2YgQ29uY2VwdDoKPi A+IFRoZXJlIGlzIG5vIGhhbmR3
cml0dGVuIGNvZGUgbmVlZGVkIHRvIGV4cGxvaXQgdGhpcyB2dW xuZXJhYmlsaXR5Lgo+ID4gVGhl
IG9ubHkgcmVxdWlyZW1lbnQgaXMgYW4gSVAgcGFja2V0IGNyZW F0aW9uIHV0aWxpdHkgKHN1Y2gg
YXMgSFBpbmcyCj4gPiBvciBJUFNvcmNlcnkpLiBCZWxvdyBhcm Ugc29tZSBIUGluZzIgZXhhbXBs
ZXM6Cj4gPiAgICAgICAgICAgICAgICAgVmljdGltJ3MgSVAgQW RkcmVzczogNjMuMjQuMTIyLjU5
Cj4gPiAgICAgICAgICAgICAgICAgVmljdGltJ3MgUm91dGVyIE lQIEFkZHJlc3M6IDE5Mi4xNjgu
MS4xCj4gPiAgICAgICAgICAgICAgICAgaHBpbmcyIC1BIC1TIC 1QIC1VIDYzLjI0LjEyMi41OSAt
cyA4MCAtcCA4MCAtYSAxOTIuMTY4LjEuMQo+ID4KPiA+IFJlbW 90ZSBMYW5EIFNwZWNpZmljYXRp
b25zOgo+ID4gQWx0aG91Z2ggdGhlIGV4cGxvaXQgd2lsbCB3b3 JrIHdpdGhvdXQgdGhlIEFjaywg
U3luLCBQdXNoLCBhbmQgVXJnCj4gPiAoZmxhZ3MpLCB0aGUgZG V2aWNlIGRvZXMgbm90IHNlZW0g
dG8gc2h1dCBvZmYgd2l0aG91dCB0aGVzZSBmbGFncy4KPiA+IF NlbmRpbmcganVzdCB0aGUgTGFu
RCBwYXJ0IG9mIHRoZSBwYWNrZXQgc2VlbXMgdG8gb25seSBjcm VhdGUgaGlnaAo+ID4gYW1vdW50
cyBvZiBsYXRlbmN5IG9uIHRoZSB2aWN0aW0ncyBlbmQuICBUaG Ugc3Bvb2ZlZCBzb3VyY2UgYWRk
cmVzcwo+ID4gbXVzdCBiZSB0aGUgYWRkcmVzcyBvZiB0aGUgY2 VudHJhbCBjb25uZWN0aXZpdHkg
ZGV2aWNlOyBhbHRob3VnaCB0aGUKPiA+IG5vcm1hbCBkZWZhdW x0IGlzIDE5Mi4xNjguMS4xLCBz
b21lIG1hbnVmYWN0dXJlcnMgdXNlIGRpZmZlcmVudAo+ID4gYW RkcmVzc2VzIChzdWNoIGFzIDE5
Mi4xNjguMS4xMDAgb3IgMTkyLjE2OC4wLjEpLiAgQXMgYSByZX N1bHQsIHRoZSBJUAo+ID4gYWRk
cmVzcyBzaG91bGQgYmUgY2hlY2tlZCBwcmlvciB0byBpbml0aW F0aW5nIGFueSB0ZXN0LiAgQWRk
aXRpb25hbGx5LAo+ID4gYSBicm9hZGNhc3QgYWRkcmVzcyB3aW xsIHdvcmsgZm9yIGEgc291cmNl
IGFkZHJlc3MgYXMgd2VsbCwgdGhlcmVieQo+ID4gZmxvb2Rpbm cgdGhlIG5ldHdvcmsgd2l0aCBy
ZXNwb25zZXMgZnJvbSBhbGwgdGhlIG1hY2hpbmVzIGNvbm5lY3 RlZCB0bwo+ID4gdGhlIG5ldHdv
cmsuICBBbHRob3VnaCBpdCB3aWxsIG5vdCBzdGFsZSB0aGUgQ2 VudHJhbCBDb25uZWN0aXZpdHkK
PiA+IERldmljZSwgaXQgd2lsbCBtYXhpbWl6ZSB0aGUgZW50aX JlIG5ldHdvcmsgdXNhZ2UgLSBj
cmlwcGxpbmcgdGhlCj4gPiBuZXR3b3JrIHdpdGggZXh0cmVtZW x5IGhpZ2ggbGF0ZW5jeS4KPiA+
Cj4gPiBUZXN0IEVudmlyb25tZW50Ogo+ID4KPiA+IC0gVGVzdC BPbmUKPiA+ICAgLSBBdHRhY2tl
cjogIGhwaW5nMiBvbiBDb21jYXN0IENhYmxlIGNvbm5lY3Rpb2 4gYmVoaW5kIExpbmtzeXMgUm91
dGVyCj4gPiAgIC0gVmljdGltOiAgRFNMIE1vZGVtL1JvdXRlci BvbiBWZXJpem9uIERTTCBjb25u
ZWN0aW9uCj4gPgo+ID4gLSBUZXN0IFR3bwo+ID4gICAtIEF0dG Fja2VyOiAgaHBpbmcyIG9uIENv
bWNhc3QgQ2FibGUgY29ubmVjdGlvbiBiZWhpbmQgTGlua3N5cy BSb3V0ZXIKPiA+ICAgLSBWaWN0
aW06ICBMaW5rc3lzIFJvdXRlciBvbiBDb21jYXN0IENhYmxlIG Nvbm5lY3Rpb24KPiA+Cj4gPiAt
IFRlc3QgVGhyZWUKPiA+ICAgLSBBdHRhY2tlcjogIGhwaW5nMi BvbiBDb21jYXN0IGNvbm5lY3Rp
b24gYmVoaW5kIExpbmtzeXMgUm91dGVyCj4gPiAgIC0gVmljdG ltOiAgQ29tY2FzdCBDYWJsZSBN
b2RlbQo+ID4KPiA+IC0gVGVzdCBGb3VyCj4gPiAgIC0gQXR0YW NrZXI6ICBocGluZzIgb24gQ29t
Y2FzdCBjb25uZWN0aW9uIGJlaGluZCBMaW5rc3lzIFJvdXRlcg o+ID4gICAtIFZpY3RpbTogIENp
c2NvIFJvdXRlciBvbiBUMSBjb25uZWN0aW9uCj4gPgo+ID4gLS BUZXN0IEZpdmUKPiA+ICAgLSBB
dHRhY2tlcjogIGhwaW5nMiBvbiBDb21jYXN0IGNvbm5lY3Rpb2 4gYmVoaW5kIExpbmtzeXMgUm91
dGVyCj4gPiAgIC0gVmljdGltOiAgQ2lzY28gUGl4IEZpcmV3YW xsLCBvbiBUMSBjb25uZWN0aW9u
Cj4gPgo+ID4gVGVzdCBSZXN1bHRzOgo+ID4KPiA+IFRlc3QgT2 5lOgo+ID4gQ29ubmVjdGlvbiBM
YXRlbmN5IC0gZm9sbG93ZWQgYnkgdGhlIG1vZGVtIHBoeXNpY2 FsbHkgdHVybmluZyBvZmYuCj4g
PiBUaW1lIGVsYXBzZWQ6IGFwcHJveGltYXRlbHkgMTAgc2Vjb2 5kcyAoZnJvbSBiZWdpbm5pbmcg
b2YgcGFja2V0Cj4gPiBmbG9vZGluZyB0byBjb21wbGV0ZSBzaH V0ZG93bikuCj4gPgo+ID4gVGVz
dCBUd286Cj4gPiBDb25uZWN0aW9uIExhdGVuY3ksIHJvdXRlci ByZXNldCwgdGhlbiBjb25uZWN0
aW9uIGxvc3QuICBSZXNldCBuZWVkZWQKPiA+IGJlZm9yZSByb3 V0ZXIgd291bGQgY29tbXVuaWNh
dGUgb25saW5lIGFnYWluLgo+ID4KPiA+IFRlc3QgVGhyZWU6Cj 4gPiBNb2RlbSBsaWdodHMgZmxp
Y2tlcmVkOyB0aGUgbW9kZW0gbG9zdCBjb25uZWN0aW9uIGFuZC BzYXQgd2l0aCB0aGUKPiA+IERh
dGEgbGlnaHQgY29tcGxldGVseSBvdXQuCj4gPgo+ID4gVGVzdC BGb3VyOgo+ID4gUm91dGVyIGxv
c3QgY29ubmVjdGlvbiB0byB0aGUgaW50ZXJuZXQuCj4gPgo+ID 4gVGVzdCBGaXZlOgo+ID4gRmly
ZXdhbGwgbG9zdCBuZXR3b3JrIGNvbm5lY3Rpb24uCj4gPiBDb2 5jbHVzaW9uOgo+ID4gSXQgYXBw
ZWFycyB0aGF0IGNlbnRyYWwgY29ubmVjdGl2aXR5IGRldmljZS BtYW51ZmFjdHVyZXJzIG5lZWQg
dG8KPiA+IHJlbGVhc2UgZmlybXdhcmUgdXBkYXRlcyBhbmQvb3 IgcGF0Y2hlcyB0byBwcm90ZWN0
IGFnYWluc3QgTGFuRCBhbmQKPiA+IHJlbW90ZSBMYW5EIGF0dG Fja3MuIFRoZSBMYW5EIGF0dGFj
ayBpcyBubyBsb25nZXIgc2ltcGx5IGEgbG9jYWwKPiA+IGF0dG FjayBidXQgaGFzIG5vdyBldm9s
dmVkIGludG8gaGF2aW5nIHRoZSBjYXBhYmlsaXR5IG9mIGJlaW 5nCj4gPiBsYXVuY2hlZCByZW1v
dGVseS4KPiA+Cj4gPiBBY2tub3dsZWRnZW1lbnRzOgo+ID4gLS BDYXNleSBPJ0JyaWVuLCBNLlMu
Cj4gPiAgIC0gQXNzaXN0ZWQgd2l0aCB0ZXN0IHRyaWFscwo+ID 4gLSBNYXR0aGV3IFdpbmVzCj4g
PiAgIC0gQXNzaXN0ZWQgd2l0aCB0ZXN0IHRyaWFscwo+ID4gLS BZdm9ubmUgTS4gV3JheSwgTS5T
Lgo+ID4gICAtIFJlcG9ydCBlZGl0b3IKPiA+Cj4gPiBTdWJtaX R0ZWQ6IDEyLzE0LzIwMDUgYnkg
SnVzdGluIE0uIFdyYXkKPiA+Cj4gPiAtLQo+ID4gUmVnYXJkcy wKPiA+IFN5blN5bgo+ID4gTmV0
b3dvcmsgTWFuYWdlciwgU2VydmVyIEFkbWluaXN0cmF0b3IsIF NlY3VyaXR5IFNwZWNpYWxpc3QK
PiA+ICggaHR0cDovL3d3dy50ZWFtdHJpbml4LmNvbSkKPiA+Cj 4gPgo+Cj4KPgo+IC0tCj4gLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCj4gd3d3LnRydX N0ZWRtYXRyaXgub3JnCgoKLS0K
UmVnYXJkcywKU3luU3luCk5ldG93b3JrIE1hbmFnZXIsIFNlcn ZlciBBZG1pbmlzdHJhdG9yLCBT
ZWN1cml0eSBTcGVjaWFsaXN0CihodHRwOi8vd3d3LnRlYW10cm luaXguY29tKQo=

[Synister Syntax]

VG8gQWxsOgoKICAgICBBcyByZXF1ZXN0ZWQ6Ck1TV29yZCAoLm RvYyk6ICBodHRwOi8vd3d3LnRl
YW10cmluaXguY29tL2V4cGxvaXRzL3JsYS9STEEuZG9jClBsYW luIFRleHQgKC50eHQpOiAgaHR0
cDovL3d3dy50ZWFtdHJpbml4LmNvbS9leHBsb2l0cy9ybGEvUk xBLnR4dApIVE1MOiBodHRwOi8v
d3d3LnRlYW10cmluaXguY29tL2V4cGxvaXRzL3JsYS9STEEuaH RtClBERjsgIChDb21pbmcgU29v
bikKCiAgICAgSSB3aWxsIGdvIGFoZWFkIGFuZCBjcmVhdGUgdG hlIFBERiBsYXRlciB0aGlzIGV2
ZW5pbmcuICBUaGUgSFRNTAp2ZXJzaW9uIGlzIGJ5IGZhciB0aG UgYmVzdCBpbiBteSBvcGluaW9u
LiAgRmVlbCBmcmVlIHRvIHNoYXJlLCBsaW5rLApyZS11cGxvYW QsIGV0Yy4gIEJ1dCBwbGVhc2Ug
ZG8gbm90IGVkaXQgYW55IG9mIHRoZSBjb250ZW50LiAgVGhhbm tzLi4uCgpPbiAxMi8xNS8wNSwg
U3luaXN0ZXIgU3ludGF4IDxzeW5pc3RlcnN5bnRheGxpc3RAZ2 1haWwuY29tPiB3cm90ZToKPiAg
ICAgIEFncmVlZCwgdGhpcyBhbmQgYWxsIGF0dGFja3MgbGlrZS B0aGlzLCBmYWxsIHVuZGVyIERv
Uy4gIFRoZQo+IHJlYXNvbiBJIG9yaWdpbmFsbHkgY2xhc3NpZm llZCB0aGlzIGF0dGFjayBhcyBh
IFJlbW90ZSBMYW5ELCB3YXMgSSB3YXMKPiBvcmlnaW5hbGx5IH Rlc3RpbmcgYSB1bi1wYXRjaGVk
IFdpbmRvd3MgU1AyIG1hY2hpbmUsIGxvY2FsbHksIGFuZCBvZg o+IGNvdXJzZSB3YXRjaGluZyB0
aGUgYm94IGxvY2sgdXAgZm9yIDMwIHNlY29uZHMgb3Igc28uIC BJIHRoZW4gdGhvdWdodCwKPiB0
aGVyZSBoYXMgdG8gYmUgYSB3YXkgZm9yIHRoaXMgdG8gd29yay ByZW1vdGVseS4gIEkgc3RhcnRl
ZCB0ZXN0aW5nLAo+IHRoaXMgd2FzIGFib3V0IGZvdXIgKDQpIG 1vbnRocyBhZ28uICBJIGtuZXcg
dGhlbiB0aGF0IGl0IHdvcmtlZCwgYnV0IEkKPiByZWFsbHkgd2 FudGVkIHRvIGZpbmQgb3V0IHdo
YXQgZGV2aWNlcyBhcmUgc3VzY2VwdGlibGUgdG8gc3VjaAo+IG F0dGFja3MuICBJIGtuZXcgaXQs
IHNlZWluZyBhcyBpdCB3YXMgYm90aCB0aGUgTGlua3N5cyBhbm QgV2VzdGVsbCBpdAo+IHdhcyBt
b3JlIHRoZW4ganVzdCB0d28gdmVuZG9ycy4KPgo+ICAgICAgU2 8sIGZyb20gdGhlcmUgSSBqdXN0
IGNhbGxlZCBpdCBSZW1vdGUgTGFuRCBhdHRhY2suICBBcyBJCj 4gbGl0ZXJhbGx5IGp1c3QgdHJp
ZWQgc2VuZGluZyBMYW5EIHBhY2tldHMgYWNyb3NzIHRoZSBJbn Rlcm5ldC4gIChUbyBhCj4gc2Vj
b25kIHBhcnR5IHdobyB3YXMgaGVscGluZyBtZSB0ZXN0IHRoZS BleHBsb2l0L3Z1bmVyaWJpdHku
ICBJIGRpZCBpbgo+IGZhY3QgaGF2ZSBwZXJtaXNzaW9uLCB3aX RoIGFsbCB0aGUgdGVzdCBJIHBl
cmZvcm1lZC4pICBJdCB3YXMgdGhlbiBJCj4gZGlzY292ZXJlZC B0aGUgcGFja2V0cyB3ZXJlIGxh
Z2dpbmcgbXkgY29sbGVnZXMgbmV0d29yay4gIEkgc3RhcnRlZA o+IG1lc3Npbmcgd2l0aCBhbiBh
cnJheSBvZiBmbGFnIGNvbWJpbmF0aW9ucywgYWxtb3N0IGFsbC BjYXVzZWQgc29tZQo+IHJlYWN0
aW9uLCBtYWlubHkgbGF0ZW5jeS4gIEkgdGhlbiBmb3VuZCB0aG UgQVNQVSBjb21iaW5hdGlvbiB3
aGljaAo+IGNhdXNlZCB0aGUgbW9zdCBkYW1hZ2UuCj4KPiAgIC AgIFRoYW5rcyA6LSkgSSByZWFs
bHkgdG9vayB0aGUgdGltZSB0byBtYWtlIHRoaXMgd3JpdGUtdX Agb3JnYW5pemVkCj4gYW5kIHVu
ZGVyc3RhbmRhYmxlLiAgIEhvcGVmdWxseSB0aGUgZGV2aWNlIH ZlbmRvcnMgY2FuIG1vcmUgZnJv
bSBoZXJlCj4gYW5kIGZpeCB0aGUgcHJvYmxlbSwgYSBzaW1wbH kgZHJvcCBvZiBMYW5EIHBhY2tl
dHMgd291bGQgZG8gaXQuCj4KPiAgICAgIEFnYWluLCB0aGFua3 MgZm9yIHlvdSBjb21tZW50cy4g
IElmIHlvdSBoYXZlIGhhdmUgYW55dGhpbmcgZWxzZSwKPiBwbG Vhc2UgZmVlbCBmcmVlIHRvIHJl
cGx5Lgo+Cj4gT24gMTIvMTUvMDUsIHNlcnZpY2UgcGFjayA8c3 BwcmlkZUBnbWFpbC5jb20+IHdy
b3RlOgo+ID4geWVhaCBpIG1lYW4gdGhlcmUgaXMgYSBmaW5lIG xpbmUgYmV0d2VlbiB0aGUgdHdv
LiBTYW5zIGhhcyBhIGdvb2QgZGVmaW5pdGlvbgo+ID4gYXMgd2 VsbAo+ID4KPiA+ICBBIHBhY2tl
dCB0aGF0IGNhdXNlcyBwcm9ibGVtcyBieSBoYXZpbmcgdGhlIH NhbWUgc291cmNlIGFuZCBkZXN0
aW5hdGlvbgo+ID4gKHRoZSB0YXJnZXQgb2YgY291cnNlKS4KPi A+Cj4gPiAgSSBzdGlsbCB0aGlu
ayBvZiBpdCBhcyBtb3JlIGlmIGEgdGFsa2luZyB5b3Vyc2VsZi B0byBkZWF0aCBhdHRhY2sgOikK
PiA+Cj4gPiAgVGhleSBhbGwgZmFsbCB1bmRlciB0aGUgdW1icm VsbGEgb2YgZGVuaWFsIG9mIHNl
cnZpY2UgdGhvdWdoLgo+ID4KPiA+ICBHb29kIHdyaXRlIHVwIE kganVzdCB0aG91Z2h0IHRoZSBw
YXJ0IGFib3V0IGxhbmQgd2FzIHdvcmRlZCBhIGxpdHRsZSBmdW 5ueSwKPiA+IG9yIHdhcyBsYWNr
aW5nLgo+ID4KPiA+ICBUaGFua3MKPiA+ICBTUAo+ID4KPiA+Cj 4gPiBPbiAxMi8xNS8wNSwgU3lu
aXN0ZXIgU3ludGF4IDxzeW5pc3RlcnN5bnRheGxpc3RAZ21haW wuY29tPiB3cm90ZToKPiA+ID4g
ICAgICBJIGFncmVlIHRoYXQgdGhpcyBpcyBpbiBmYWN0IGEgRG 9TLCBob3dldmVyIGl0IGlzIHVz
aW5nIHRoZSBvbGQKPiA+ID4gTGFuRCBhdHRhY2sgKGZyb20gMT k5Nykgc3ludGF4L3N0eWxlLiAg
VGhhdCBmYWN0IHRoYXQgaXQgaXMgYSBwYWNrZXQKPiA+ID4gdG 8gaXRzZWxmLCBmcm9tIGl0J3Mg
c2VsZiwgb2J2aW91c2x5IHNwb29mZWQuICBBcyB0aGlzIHdhcy B0aGUgc2FtZQo+ID4gPiB3YXkg
aXQgd2FzIGRvbmUgYmFjayBpbiB0aGUgOTAncy4gIFRoZSBkaW ZmZXJlbmNlIGhlcmUsIGlzIHRo
ZSBmYWN0Cj4gPiA+IHRoYXQgdGhlIExhbkQgYXR0YWNrIGNhbi BiZSBwZXJmb3JtZWQgcmVtb3Rl
bHksIHdoZXJlYXMgYmVmb3JlIHRoZQo+ID4gPiBhdHRhY2sgd2 FzIG9ubHkgYSBMb2NhbCAoTEFO
KSBhdHRhY2suCj4gPiA+Cj4gPiA+ICAgICAgQWxzbyBub3RlIH RoYXQgdGhpcyBpcyBhbiBhdHRh
Y2sgb24gZGV2aWNlcywgbm90IE9TJ3MuICBBbHNvIGxldAo+ID 4gPiBtZSBub3RlIHRoYXQgdGhl
IGRldmljZSBpcyB1bnVzYWJsZSB1bnRpbCBpdCBpcyBwaHlzaW NhbGx5IHJlc2V0Lgo+ID4gPiBF
aXRoZXJ3YXksIEkgYW0gZmluZSBieSB0aGlzIGJlaW5nIGNvbn NlZGVyZWQgYSBEb1MsIGl0IGlz
LiAgSXQgd2lsbAo+ID4gPiBzaHV0IGRvZW4geW91ciBzd2l0Y2 ggKHJlbmRlcmluZyB5b3VyIG5l
dHdvcmsgdXNhbGVzcykgb3IgeW91ciByb3V0ZXIKPiA+ID4gKG tlZXBpbmcgeW91IGZyb20gYWNj
ZXNzIHRoZSBpbnRlcm5ldCBldGMuKS4KPiA+ID4KPiA+ID4gSW YgeW91IGhhdmUgYW55IG90aGVy
IHF1ZXN0aW9ucywgb3IgY29tbWVudHMgcGxlYXNlIGxldCBtZS Brbm93Lgo+ID4gPiBUaGFua3Mg
Zm9yIHRoZSBpbnB1dCwgSSB0aGluayBJIGRpZCBpbmZhY3Qgbm 90IHN0YXRlIHRoYXQgdGhlIGF0
dGFjawo+ID4gPiB3YXMgYSBEb1MuCj4gPiA+Cj4gPiA+IE9uID EyLzE1LzA1LCBzZXJ2aWNlIHBh
Y2sgPHNwcHJpZGVAZ21haWwuY29tPiB3cm90ZToKPiA+ID4gPi BVcGRhdGVkIHRoZSB3aWtpIHBh
Z2UuIFlvdXIgbG9va2luZyBhdCBhIGRlbmlhbCBvZiBzZXJ2aW NlIG5vdCBhIGxhbmQKPiA+ID4g
PiBhdHRhY2suCj4gPiA+ID4KPiA+ID4gPiAgTGFuZCBhdHRhY2 tzIGFyZSBjYXVzZWQgd2hlbiBh
IG1hY2hpbmUgZmxvb2RzIGl0c2VsZi4KPiA+ID4gPgo+ID4gPi A+ICBGaXJzdCBleGFtcGxlLCAg
RWNobyBhbmQgQ2hhcmdlbiAoSUNNUCBhbmQgQ2hhcmFjdGVyIG dlbmVyYXRvciAob2xkCj4gPiB1
bml4Cj4gPiA+ID4gc2VydmljZSkpIEFyZSBzZXJ2aWNlcyB0aG F0IHJlcGx5IHRvIGFueXRoaW5n
Lgo+ID4gPiA+ICBBIHNwb29mZWQgcGFja2V0IGlzIHNlbnQgZn JvbSBhIG1hY2hpbmVzIGVjaG8g
KHNwb29mZWQpIHRvIHRoZSBjaGFyZ2VuLgo+ID4gVGhlCj4gPi A+ID4gY2hhcmdlbiByZXBseXMg
d2l0aCBnYXJiYWdlLCBhbmQgdGhlIGVjaG8gZWNobydzIGl0Cj 4gPiA+ID4gIGJhY2sgYW5kIHNv
IG9uIHVudGlsIHRoZSByZXNvdXJjZXMgYXJlIGNvbnN1bWVkLg o+ID4gPiA+Cj4gPiA+ID4gIEFu
eXRoaW5nIHRoYXQgZG9lc24ndCBoYXZlIHRoaXMgZWZmZWN0IG lzIGEgRGVuaWFsIG9mIHNlcnZp
Y2UuCj4gPiA+ID4KPiA+ID4gPiAgTm93IFNOTVAgYW5kIHdpbm Rvd3MgS2VyYmVyb3MgY2FuIHRh
bGsgdGhlbXNlbHZlcyB0byBkZWF0aCAoYW4gZXhhbXBsZQo+ID 4gb2YgYQo+ID4gPiA+IG5vbi1j
cm9zcyBzZXJ2aWNlIGxhbmQpLgo+ID4gPiA+Cj4gPiA+ID4gIE 1ha2VzIHNlbnNlPyA6KQo+ID4g
PiA+Cj4gPiA+ID4gIFNQCj4gPiA+ID4KPiA+ID4gPgo+ID4gPi A+IE9uIDEyLzE0LzA1LCBTeW5p
c3RlciBTeW50YXggPCBzeW5pc3RlcnN5bnRheGxpc3RAZ21haW wuY29tPiB3cm90ZToKPiA+ID4g
PiA+IEJlbG93IGlzIGEgY29weSBvZiBteSBSTEEgZXhwbG9pdC BzdWJtaXNzaW9uIGluIEFTQ0lJ
LiAgQXR0YWNoZWQgaXMgYQo+ID4gPiA+ID4gTVNXb3JkICguZG 9jKSB2ZXJzaW9uIHdpdGggcmlj
aCBmb3JtYXR0aW5nLCBjcmVhdGVkIHdpdGggZWFzZSBvZiB2aW V3Cj4gPiA+ID4gPiBpbiBtaW5k
Lgo+ID4gPiA+ID4KPiA+ID4gPiA+IFJlZ2FyZHMuLi4KPiA+ID 4gPiA+Cj4gPiA+ID4gPiAtLS0t
LS0tLS0tCj4gPiA+ID4gPgo+ID4gPiA+ID4gUkxBCj4gPiA+ID 4gPiAoIlJlbW90ZSBMYW5EIEF0
dGFjayIpCj4gPiA+ID4gPiAyMDA1Cj4gPiA+ID4gPgo+ID4gPi A+ID4KPiA+ID4gPiA+IEFzIGRp
c2NvdmVyZWQgYnk6Cj4gPiA+ID4gPiBKdXN0aW4gTS4gV3JheQ o+ID4gPiA+ID4gKGpheWl6a29v
bEBnbWFpbC5jb20pCj4gPiA+ID4gPgo+ID4gPiA+ID4KPiA+ID 4gPiA+IERldmljZXMvVmVuZG9y
cyBWdWxuZXJhYmxlOgo+ID4gPiA+ID4gLSBNaWNyb3NvZnQgV2 luZG93cyBYUCwgU1AxIGFuZCBT
UDIKPiA+ID4gPiA+IC0gTGlua3N5cyBSb3V0ZXJzCj4gPiA+ID 4gPiAtIFdlc3RlbGwgUm91dGVy
cy9Nb2RlbXMKPiA+ID4gPiA+IC0gTW90b3JvbGEgTW9kZW1zL1 JvdXRlcnMKPiA+ID4gPiA+IC0g
Q2lzY28gRmlyZXdhbGxzLCBTd2l0Y2hlcywgYW5kIFJvdXRlcn MKPiA+ID4gPiA+IC0gRFNMIE1v
ZGVtcwo+ID4gPiA+ID4gLSBDYWJsZSBNb2RlbXMKPiA+ID4gPi A+IC0gQ29uc3VtZXIgUm91dGVy
cwo+ID4gPiA+ID4gLSBBbGwgQ2VudHJhbCBDb25uZWN0aXZpdH kgRGV2aWNlcyAoYW55IG1hbnVm
YWN0dXJlcikKPiA+ID4gPiA+Cj4gPiA+ID4gPiBEZXZpY2VzL1 ZlbmRvcnMgVGVzdGVkOgo+ID4g
PiA+ID4gLSBMaW5rc3lzIEJFRlcxMVM0Cj4gPiA+ID4gPiAtIE xpbmtzeXMgV1JUNTRHUwo+ID4g
PiA+ID4gLSBXZXN0ZWxsICBWZXJzYWxpbmsgMzI3VyAoVmVyaX pvbiBNb2RlbSkKPiA+ID4gPiA+
IC0gQ2lzY28gQ2F0YWx5c3QgU2VyaWVzIChNdWx0aXBsZSkKPi A+ID4gPiA+IC0gU2NpZW50aWZp
YyBBdGxhbnRpYyBEUFgyMTAwIChDb21jYXN0IE1vZGVtKQo+ID 4gPiA+ID4KPiA+ID4gPiA+IERl
ZmluaXRpb246Cj4gPiA+ID4gPiBBIExBTkQgYXR0YWNrIGlzIG EgRG9TIChEZW5pYWwgb2YgU2Vy
dmljZSkgYXR0YWNrIHRoYXQgY29uc2lzdHMgb2YKPiA+ID4gPi A+IHNlbmRpbmcgYSBzcGVjaWFs
IHBvaXNvbiBzcG9vZmVkIHBhY2tldCB0byBhIGNvbXB1dGVyLC BjYXVzaW5nIGl0IHRvCj4gPiA+
ID4gPiBsb2NrIHVwLiBUaGUgc2VjdXJpdHkgZmxhdyB3YXMgZm lyc3QgZGlzY292ZXJlZCBpbiAx
OTk3IGJ5IHNvbWVvbmUKPiA+ID4gPiA+IHVzaW5nIHRoZSBhbG lhcyAibTNsdCIsIGFuZCBoYXMg
cmVzdXJmYWNlZCBtYW55IHllYXJzIGxhdGVyIGluCj4gPiA+ID 4gPiBvcGVyYXRpbmcgc3lzdGVt
cyBzdWNoIGFzIFdpbmRvd3MgU2VydmVyIDIwMDMgYW5kIFdpbm Rvd3MgWFAgU1AyLgo+ID4gPiA+
ID4gKGh0dHA6Ly9lbi53aWtpcGVkaWEub3JnL3dpa2kvTEFORF 9hdHRhY2spCj4gPiA+ID4gPgo+
ID4gPiA+ID4gRXhwbGFuYXRpb24gb2YgTGFuRDoKPiA+ID4gPi A+IExhbkQgdXNlcyBhIHNwZWNp
YWxseSBjcmFmdGVkIElDTVAgIGVjaG8gcGFja2V0IHdoaWNoIG hhcyB0aGUgc2FtZQo+ID4gPiA+
ID4gc291cmNlIGFuZCBkZXN0aW5hdGlvbiBhZGRyZXNzLiAgVG hlIHJlY2VpdmluZyBzeXN0ZW0g
c3RhbGxzIGR1ZSB0bwo+ID4gPiA+ID4gdGhlIGVycm9uZW91cy BwYWNrZXQgYW5kIG5vdCBoYXZp
bmcgaW5zdHJ1Y3Rpb25zIHRvIGhhbmRsZSB0aGUgdW5pcXVlCj 4gPiA+ID4gPiBwYWNrZXQuICBJ
biBXaW5kb3dzIDl4ICB2YXJpYW50cywgdGhlIHN5c3RlbXMgd2 lsbCAiYmx1ZSBzY3JlZW4uICIg
IE9uCj4gPiA+ID4gPiBtb2Rlcm4gTlQgIHZhcmlhbnRzLCB0aG Ugc3lzdGVtcyB3aWxsIGhhbmcg
Zm9yIGFwcHJveGltYXRlbHkgMzAKPiA+ID4gPiA+IHNlY29uZH Mgd2l0aCBmdWxsIENQVSB1c2Fn
ZSBiZWZvcmUgZGlzY2FyZGluZyB0aGUgcGFja2V0LiAgV2l0aC BhCj4gPiA+ID4gPiBsb29wZWQg
c2NyaXB0LCB0aGUgYXR0YWNrZXIgY2FuIHJlbmRlciB0aGUgc3 lzdGVtIHVzZWxlc3MuICBVTklY
Cj4gPiA+ID4gPiB2YXJpYW50cyBoYXZlIGJlZW4gYWJsZSB0by B1c2UgYSBmaXJld2FsbCBydWxl
IHRvIGRyb3AgTGFuRCBwYWNrZXRzIJYKPiA+ID4gPiA+IGxlYX ZpbmcgbW9zdCBzeXN0ZW1zIHBh
dGNoZWQuCj4gPiA+ID4gPgo+ID4gPiA+ID4gTWljcm9zb2Z0IG 9yaWdpbmFsbHkgcmVsZWFzZWQg
YW4gaW5pdGlhbCBwYXRjaCB0aGF0IHNlY3VyZWQgV2luZG93cy A5eAo+ID4gPiA+ID4gdmFyaWFu
dHMgliBjYXVzaW5nIHRoZSBleHBsb2l0IHRvIGxvc2UgcG9wdW xhcml0eSBhbmQgYmVjb21lIHNv
bWV3aGF0Cj4gPiA+ID4gPiBvYnNjdXJlLiAgTGF0ZXIsIHdoZW 4gV2luZG93cyBOVCB2YXJpYW50
cyB3ZXJlIHJlbGVhc2VkLCBNaWNyb3NvZnQKPiA+ID4gPiA+IG 5lZ2xlY3RlZCB0byBwYXRjaCB0
aGUgc2VjdXJpdHkgZmxhdzsgdGhpcyBjYXVzZWQgV2luZG93cy BYUCBTZXJ2aWNlCj4gPiA+ID4g
PiBQYWNrIDIgdG8gcmVtYWluIHN1c2NlcHRpYmxlIHRvIHN1Y2 ggYW4gYXR0YWNrLiAgV2l0aGlu
IHRoZSBsYXN0IGZvdXIKPiA+ID4gPiA+ICg0KSBtb250aHMsIE 1pY3Jvc29mdCBoYXMgcmVsZWFz
ZWQgYSBwYXRjaCBmb3IgV2luZG93cyBOVCB2YXJpYW50cy4KPi A+ID4gPiA+Cj4gPiA+ID4gPiBM
YW5EIHZlcnN1cyBSZW1vdGUgTGFuRDoKPiA+ID4gPiA+IExhbk Qgd2FzIG9yaWdpbmFsbHkgaW50
cm9kdWNlZCBpbiB0aGUgbGF0ZSAxOTkwcyBhbmQgd2FzIHZlcn kgcG9wdWxhcgo+ID4gPiA+ID4g
d2l0aCBlZHVjYXRpb25hbCBhbmQgYnVzaW5lc3MgbmV0d29ya3 MuICBUaGUgb3JpZ2luYWwgTGFu
RCBhdHRhY2sgaGFkCj4gPiA+ID4gPiB0byBiZSBleGVjdXRlZC BpbnRlcm5hbGx5IG9uIHRoZSBs
b2NhbCBuZXR3b3JrIJYgdGhlcmVieSBnaXZpbmcgcmlzZQo+ID 4gPiA+ID4gdG8gdGhlIG5hbWUg
IkxhbkQiIChpbmRpY2F0aW5nIHRoYXQgYWNjZXNzIGhhcyBiZW VuIGdyYW50ZWQgdG8gdGhlCj4g
PiA+ID4gPiBsb2NhbCBwcmVtaXNlcykuICBIb3dldmVyLCB3aX RoIGEgcmVtb3RlIGF0dGFjayAo
UmVtb3RlIExhbkQpLAo+ID4gPiA+ID4gY3JhZnRpbmcgc3BlY2 lhbCBwYWNrZXRzIGFuZCBzcG9v
ZmluZyB0aGUgZGVzdGluYXRpb24gYW5kIHNvdXJjZSBJUAo+ID 4gPiA+ID4gYWRkcmVzc2VzIHdp
bGwgY2F1c2UgdGhlIGF0dGFjayB0byBiZSBjYXJyaWVkIG91dC ByZW1vdGVseSBhZ2FpbnN0IHRo
ZQo+ID4gPiA+ID4gY2VudHJhbCBjb25uZWN0aXZpdHkgZGV2aW NlLgo+ID4gPiA+ID4KPiA+ID4g
PiA+IEV4cGxvaXQgLyBQcm9vZiBvZiBDb25jZXB0Ogo+ID4gPi A+ID4gVGhlcmUgaXMgbm8gaGFu
ZHdyaXR0ZW4gY29kZSBuZWVkZWQgdG8gZXhwbG9pdCB0aGlzIH Z1bG5lcmFiaWxpdHkuCj4gPiA+
ID4gPiBUaGUgb25seSByZXF1aXJlbWVudCBpcyBhbiBJUCBwYW NrZXQgY3JlYXRpb24gdXRpbGl0
eSAoc3VjaCBhcyBIUGluZzIKPiA+ID4gPiA+IG9yIElQU29yY2 VyeSkuIEJlbG93IGFyZSBzb21l
IEhQaW5nMiBleGFtcGxlczoKPiA+ID4gPiA+ICAgICAgICAgIC AgICAgICBWaWN0aW0ncyBJUCBB
ZGRyZXNzOiA2My4yNC4xMjIuNTkKPiA+ID4gPiA+ICAgICAgIC AgICAgICAgICBWaWN0aW0ncyBS
b3V0ZXIgSVAgQWRkcmVzczogMTkyLjE2OC4xLjEKPiA+ID4gPi A+ICAgICAgICAgICAgICAgICBo
cGluZzIgLUEgLVMgLVAgLVUgNjMuMjQuMTIyLjU5IC1zIDgwIC 1wIDgwIC1hCj4gPiAxOTIuMTY4
LjEuMQo+ID4gPiA+ID4KPiA+ID4gPiA+IFJlbW90ZSBMYW5EIF NwZWNpZmljYXRpb25zOgo+ID4g
PiA+ID4gQWx0aG91Z2ggdGhlIGV4cGxvaXQgd2lsbCB3b3JrIH dpdGhvdXQgdGhlIEFjaywgU3lu
LCBQdXNoLCBhbmQgVXJnCj4gPiA+ID4gPiAoZmxhZ3MpLCB0aG UgZGV2aWNlIGRvZXMgbm90IHNl
ZW0gdG8gc2h1dCBvZmYgd2l0aG91dCB0aGVzZSBmbGFncy4KPi A+ID4gPiA+IFNlbmRpbmcganVz
dCB0aGUgTGFuRCBwYXJ0IG9mIHRoZSBwYWNrZXQgc2VlbXMgdG 8gb25seSBjcmVhdGUgaGlnaAo+
ID4gPiA+ID4gYW1vdW50cyBvZiBsYXRlbmN5IG9uIHRoZSB2aW N0aW0ncyBlbmQuICBUaGUgc3Bv
b2ZlZCBzb3VyY2UgYWRkcmVzcwo+ID4gPiA+ID4gbXVzdCBiZS B0aGUgYWRkcmVzcyBvZiB0aGUg
Y2VudHJhbCBjb25uZWN0aXZpdHkgZGV2aWNlOyBhbHRob3VnaC B0aGUKPiA+ID4gPiA+IG5vcm1h
bCBkZWZhdWx0IGlzIDE5Mi4xNjguMS4xLCBzb21lIG1hbnVmYW N0dXJlcnMgdXNlIGRpZmZlcmVu
dAo+ID4gPiA+ID4gYWRkcmVzc2VzIChzdWNoIGFzIDE5Mi4xNj guMS4xMDAgb3IgMTkyLjE2OC4w
LjEpLiAgQXMgYSByZXN1bHQsIHRoZSBJUAo+ID4gPiA+ID4gYW RkcmVzcyBzaG91bGQgYmUgY2hl
Y2tlZCBwcmlvciB0byBpbml0aWF0aW5nIGFueSB0ZXN0LiAgQW RkaXRpb25hbGx5LAo+ID4gPiA+
ID4gYSBicm9hZGNhc3QgYWRkcmVzcyB3aWxsIHdvcmsgZm9yIG Egc291cmNlIGFkZHJlc3MgYXMg
d2VsbCwgdGhlcmVieQo+ID4gPiA+ID4gZmxvb2RpbmcgdGhlIG 5ldHdvcmsgd2l0aCByZXNwb25z
ZXMgZnJvbSBhbGwgdGhlIG1hY2hpbmVzIGNvbm5lY3RlZCB0bw o+ID4gPiA+ID4gdGhlIG5ldHdv
cmsuICBBbHRob3VnaCBpdCB3aWxsIG5vdCBzdGFsZSB0aGUgQ2 VudHJhbCBDb25uZWN0aXZpdHkK
PiA+ID4gPiA+IERldmljZSwgaXQgd2lsbCBtYXhpbWl6ZSB0aG UgZW50aXJlIG5ldHdvcmsgdXNh
Z2UgLSBjcmlwcGxpbmcgdGhlCj4gPiA+ID4gPiBuZXR3b3JrIH dpdGggZXh0cmVtZWx5IGhpZ2gg
bGF0ZW5jeS4KPiA+ID4gPiA+Cj4gPiA+ID4gPiBUZXN0IEVudm lyb25tZW50Ogo+ID4gPiA+ID4K
PiA+ID4gPiA+IC0gVGVzdCBPbmUKPiA+ID4gPiA+ICAgLSBBdH RhY2tlcjogIGhwaW5nMiBvbiBD
b21jYXN0IENhYmxlIGNvbm5lY3Rpb24gYmVoaW5kIExpbmtzeX MKPiA+IFJvdXRlcgo+ID4gPiA+
ID4gICAtIFZpY3RpbTogIERTTCBNb2RlbS9Sb3V0ZXIgb24gVm VyaXpvbiBEU0wgY29ubmVjdGlv
bgo+ID4gPiA+ID4KPiA+ID4gPiA+IC0gVGVzdCBUd28KPiA+ID 4gPiA+ICAgLSBBdHRhY2tlcjog
IGhwaW5nMiBvbiBDb21jYXN0IENhYmxlIGNvbm5lY3Rpb24gYm VoaW5kIExpbmtzeXMKPiA+IFJv
dXRlcgo+ID4gPiA+ID4gICAtIFZpY3RpbTogIExpbmtzeXMgUm 91dGVyIG9uIENvbWNhc3QgQ2Fi
bGUgY29ubmVjdGlvbgo+ID4gPiA+ID4KPiA+ID4gPiA+IC0gVG VzdCBUaHJlZQo+ID4gPiA+ID4g
ICAtIEF0dGFja2VyOiAgaHBpbmcyIG9uIENvbWNhc3QgY29ubm VjdGlvbiBiZWhpbmQgTGlua3N5
cyBSb3V0ZXIKPiA+ID4gPiA+ICAgLSBWaWN0aW06ICBDb21jYX N0IENhYmxlIE1vZGVtCj4gPiA+
ID4gPgo+ID4gPiA+ID4gLSBUZXN0IEZvdXIKPiA+ID4gPiA+IC AgLSBBdHRhY2tlcjogIGhwaW5n
MiBvbiBDb21jYXN0IGNvbm5lY3Rpb24gYmVoaW5kIExpbmtzeX MgUm91dGVyCj4gPiA+ID4gPiAg
IC0gVmljdGltOiAgQ2lzY28gUm91dGVyIG9uIFQxIGNvbm5lY3 Rpb24KPiA+ID4gPiA+Cj4gPiA+
ID4gPiAtIFRlc3QgRml2ZQo+ID4gPiA+ID4gICAtIEF0dGFja2 VyOiAgaHBpbmcyIG9uIENvbWNh
c3QgY29ubmVjdGlvbiBiZWhpbmQgTGlua3N5cyBSb3V0ZXIKPi A+ID4gPiA+ICAgLSBWaWN0aW06
ICBDaXNjbyBQaXggRmlyZXdhbGwsIG9uIFQxIGNvbm5lY3Rpb2 4KPiA+ID4gPiA+Cj4gPiA+ID4g
PiBUZXN0IFJlc3VsdHM6Cj4gPiA+ID4gPgo+ID4gPiA+ID4gVG VzdCBPbmU6Cj4gPiA+ID4gPiBD
b25uZWN0aW9uIExhdGVuY3kgLSBmb2xsb3dlZCBieSB0aGUgbW 9kZW0gcGh5c2ljYWxseSB0dXJu
aW5nIG9mZi4KPiA+ID4gPiA+IFRpbWUgZWxhcHNlZDogYXBwcm 94aW1hdGVseSAxMCBzZWNvbmRz
IChmcm9tIGJlZ2lubmluZyBvZiBwYWNrZXQKPiA+ID4gPiA+IG Zsb29kaW5nIHRvIGNvbXBsZXRl
IHNodXRkb3duKS4KPiA+ID4gPiA+Cj4gPiA+ID4gPiBUZXN0IF R3bzoKPiA+ID4gPiA+IENvbm5l
Y3Rpb24gTGF0ZW5jeSwgcm91dGVyIHJlc2V0LCB0aGVuIGNvbm 5lY3Rpb24gbG9zdC4gIFJlc2V0
IG5lZWRlZAo+ID4gPiA+ID4gYmVmb3JlIHJvdXRlciB3b3VsZC Bjb21tdW5pY2F0ZSBvbmxpbmUg
YWdhaW4uCj4gPiA+ID4gPgo+ID4gPiA+ID4gVGVzdCBUaHJlZT oKPiA+ID4gPiA+IE1vZGVtIGxp
Z2h0cyBmbGlja2VyZWQ7IHRoZSBtb2RlbSBsb3N0IGNvbm5lY3 Rpb24gYW5kIHNhdCB3aXRoIHRo
ZQo+ID4gPiA+ID4gRGF0YSBsaWdodCBjb21wbGV0ZWx5IG91dC 4KPiA+ID4gPiA+Cj4gPiA+ID4g
PiBUZXN0IEZvdXI6Cj4gPiA+ID4gPiBSb3V0ZXIgbG9zdCBjb2 5uZWN0aW9uIHRvIHRoZSBpbnRl
cm5ldC4KPiA+ID4gPiA+Cj4gPiA+ID4gPiBUZXN0IEZpdmU6Cj 4gPiA+ID4gPiBGaXJld2FsbCBs
b3N0IG5ldHdvcmsgY29ubmVjdGlvbi4KPiA+ID4gPiA+IENvbm NsdXNpb246Cj4gPiA+ID4gPiBJ
dCBhcHBlYXJzIHRoYXQgY2VudHJhbCBjb25uZWN0aXZpdHkgZG V2aWNlIG1hbnVmYWN0dXJlcnMg
bmVlZCB0bwo+ID4gPiA+ID4gcmVsZWFzZSBmaXJtd2FyZSB1cG RhdGVzIGFuZC9vciBwYXRjaGVz
IHRvIHByb3RlY3QgYWdhaW5zdCBMYW5EIGFuZAo+ID4gPiA+ID 4gcmVtb3RlIExhbkQgYXR0YWNr
cy4gVGhlIExhbkQgYXR0YWNrIGlzIG5vIGxvbmdlciBzaW1wbH kgYSBsb2NhbAo+ID4gPiA+ID4g
YXR0YWNrIGJ1dCBoYXMgbm93IGV2b2x2ZWQgaW50byBoYXZpbm cgdGhlIGNhcGFiaWxpdHkgb2Yg
YmVpbmcKPiA+ID4gPiA+IGxhdW5jaGVkIHJlbW90ZWx5Lgo+ID 4gPiA+ID4KPiA+ID4gPiA+IEFj
a25vd2xlZGdlbWVudHM6Cj4gPiA+ID4gPiAtIENhc2V5IE8nQn JpZW4sIE0uUy4KPiA+ID4gPiA+
ICAgLSBBc3Npc3RlZCB3aXRoIHRlc3QgdHJpYWxzCj4gPiA+ID 4gPiAtIE1hdHRoZXcgV2luZXMK
PiA+ID4gPiA+ICAgLSBBc3Npc3RlZCB3aXRoIHRlc3QgdHJpYW xzCj4gPiA+ID4gPiAtIFl2b25u
ZSBNLiBXcmF5LCBNLlMuCj4gPiA+ID4gPiAgIC0gUmVwb3J0IG VkaXRvcgo+ID4gPiA+ID4KPiA+
ID4gPiA+IFN1Ym1pdHRlZDogMTIvMTQvMjAwNSBieSBKdXN0aW 4gTS4gV3JheQo+ID4gPiA+ID4K
PiA+ID4gPiA+IC0tCj4gPiA+ID4gPiBSZWdhcmRzLAo+ID4gPi A+ID4gU3luU3luCj4gPiA+ID4g
PiBOZXRvd29yayBNYW5hZ2VyLCBTZXJ2ZXIgQWRtaW5pc3RyYX RvciwgU2VjdXJpdHkgU3BlY2lh
bGlzdAo+ID4gPiA+ID4gKCBodHRwOi8vd3d3LnRlYW10cmluaX guY29tKQo+ID4gPiA+ID4KPiA+
ID4gPiA+Cj4gPiA+ID4KPiA+ID4gPgo+ID4gPiA+Cj4gPiA+ID 4gLS0KPiA+ID4gPiAtLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KPiA+ID4gPiB3d3cudH J1c3RlZG1hdHJpeC5vcmcKPiA+
ID4KPiA+ID4KPiA+ID4gLS0KPiA+ID4gUmVnYXJkcywKPiA+ID 4gU3luU3luCj4gPiA+IE5ldG93
b3JrIE1hbmFnZXIsIFNlcnZlciBBZG1pbmlzdHJhdG9yLCBTZW N1cml0eSBTcGVjaWFsaXN0Cj4g
PiA+IChodHRwOi8vd3d3LnRlYW10cmluaXguY29tKQo+ID4gPg o+ID4KPiA+Cj4gPgo+ID4gIC0t
Cj4gPiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KPi A+IHd3dy50cnVzdGVkbWF0cml4
Lm9yZwo+Cj4KPiAtLQo+IFJlZ2FyZHMsCj4gU3luU3luCj4gTm V0d29yayBNYW5hZ2VyLCBTZXJ2
ZXIgQWRtaW5pc3RyYXRvciwgU2VjdXJpdHkgU3BlY2lhbGlzdA o+IChodHRwOi8vd3d3LnRlYW10
cmluaXguY29tKQo+CgoKLS0KUmVnYXJkcywKU3luU3luCk5ldH dvcmsgTWFuYWdlciwgU2VydmVy
IEFkbWluaXN0cmF0b3IsIFNlY3VyaXR5IFNwZWNpYWxpc3QKKG h0dHA6Ly93d3cudGVhbXRyaW5p
eC5jb20pCg==

[Roger A. Grimes]

Just to clarify, so that people don't think this affects Windows XP SP2.
I've tested SP2 again, and the LAND attack no longer works. This
announcement concerns gateway network devices that computers may attach
to (the announcement is a little confusing at first).

Also, to pull off the hping2 example, you'll need the -k parameter to
make sure the source port stays at port 80, else it will increment up
(80, 81, 82, etc.)

Roger

************************************************** *****************
*Roger A. Grimes, Banneret Computer Security, Consultant=20
*CPA, CISSP, MCSE: Security (2000/2003/MVP), CEH, yada...yada...
*email: roger@banneretcs.com
*Author of Honeypots for Windows (Apress)
*http://www.apress.com/book/bookDisplay.html?bID=3D281
************************************************** *****************


-----Original Message-----
From: Synister Syntax [mailto:synistersyntaxlist@gmail.com]=20
Sent: Wednesday, December 14, 2005 1:49 AM
To: bugtraq@securityfocus.com; full-disclosure@lists.grok.org.uk;
vuln-dev@securityfocus.com; NTBUGTRAQ@listserv.ntbugtraq.com
Subject: RLA ("Remote LanD Attack")

Below is a copy of my RLA exploit submission in ASCII. Attached is a
MSWord (.doc) version with rich formatting, created with ease of view in
mind.

Regards...

----------

RLA
("Remote LanD Attack")
2005


As discovered by:
Justin M. Wray
(jayizkool@gmail.com)


Devices/Vendors Vulnerable:
- Microsoft Windows XP, SP1 and SP2
- Linksys Routers
- Westell Routers/Modems
- Motorola Modems/Routers
- Cisco Firewalls, Switches, and Routers
- DSL Modems
- Cable Modems
- Consumer Routers
- All Central Connectivity Devices (any manufacturer)

Devices/Vendors Tested:
- Linksys BEFW11S4
- Linksys WRT54GS
- Westell Versalink 327W (Verizon Modem)
- Cisco Catalyst Series (Multiple)
- Scientific Atlantic DPX2100 (Comcast Modem)

Definition:
A LAND attack is a DoS (Denial of Service) attack that consists of
sending a special poison spoofed packet to a computer, causing it to
lock up. The security flaw was first discovered in 1997 by someone using
the alias "m3lt", and has resurfaced many years later in operating
systems such as Windows Server 2003 and Windows XP SP2.
(http://en.wikipedia.org/wiki/LAND_attack)

Explanation of LanD:
LanD uses a specially crafted ICMP echo packet which has the same
source and destination address. The receiving system stalls due to the
erroneous packet and not having instructions to handle the unique
packet. In Windows 9x variants, the systems will "blue screen. " On
modern NT variants, the systems will hang for approximately 30 seconds
with full CPU usage before discarding the packet. With a looped script,
the attacker can render the system useless. UNIX variants have been
able to use a firewall rule to drop LanD packets - leaving most systems
patched.

Microsoft originally released an initial patch that secured Windows 9x
variants - causing the exploit to lose popularity and become somewhat
obscure. Later, when Windows NT variants were released, Microsoft
neglected to patch the security flaw; this caused Windows XP Service
Pack 2 to remain susceptible to such an attack. Within the last four
(4) months, Microsoft has released a patch for Windows NT variants.

LanD versus Remote LanD:
LanD was originally introduced in the late 1990s and was very popular
with educational and business networks. The original LanD attack had to
be executed internally on the local network - thereby giving rise to the
name "LanD" (indicating that access has been granted to the local
premises). However, with a remote attack (Remote LanD), crafting
special packets and spoofing the destination and source IP addresses
will cause the attack to be carried out remotely against the central
connectivity device.

Exploit / Proof of Concept:
There is no handwritten code needed to exploit this vulnerability.=20
The only requirement is an IP packet creation utility (such as HPing2 or
IPSorcery). Below are some HPing2 examples:
Victim's IP Address: 63.24.122.59
Victim's Router IP Address: 192.168.1.1
hping2 -A -S -P -U 63.24.122.59 -s 80 -p 80 -a
192.168.1.1

Remote LanD Specifications:
Although the exploit will work without the Ack, Syn, Push, and Urg
(flags), the device does not seem to shut off without these flags.=20
Sending just the LanD part of the packet seems to only create high
amounts of latency on the victim's end. The spoofed source address must
be the address of the central connectivity device; although the normal
default is 192.168.1.1, some manufacturers use different addresses (such
as 192.168.1.100 or 192.168.0.1). As a result, the IP address should be
checked prior to initiating any test. Additionally, a broadcast address
will work for a source address as well, thereby flooding the network
with responses from all the machines connected to the network. Although
it will not stale the Central Connectivity Device, it will maximize the
entire network usage - crippling the network with extremely high
latency.

Test Environment:

- Test One
- Attacker: hping2 on Comcast Cable connection behind Linksys Router
- Victim: DSL Modem/Router on Verizon DSL connection

- Test Two
- Attacker: hping2 on Comcast Cable connection behind Linksys Router
- Victim: Linksys Router on Comcast Cable connection

- Test Three
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Comcast Cable Modem

- Test Four
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Cisco Router on T1 connection

- Test Five
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Cisco Pix Firewall, on T1 connection

Test Results:

Test One:
Connection Latency - followed by the modem physically turning off.=20
Time elapsed: approximately 10 seconds (from beginning of packet
flooding to complete shutdown).

Test Two:
Connection Latency, router reset, then connection lost. Reset needed
before router would communicate online again.

Test Three:
Modem lights flickered; the modem lost connection and sat with the Data
light completely out.

Test Four:
Router lost connection to the internet.

Test Five:
Firewall lost network connection.
Conclusion:
It appears that central connectivity device manufacturers need to
release firmware updates and/or patches to protect against LanD and
remote LanD attacks. The LanD attack is no longer simply a local attack
but has now evolved into having the capability of being launched
remotely.

Acknowledgements:
- Casey O'Brien, M.S.
- Assisted with test trials
- Matthew Wines
- Assisted with test trials
- Yvonne M. Wray, M.S.
- Report editor

Submitted: 12/14/2005 by Justin M. Wray

--
Regards,
SynSyn
Netowork Manager, Server Administrator, Security Specialist
(http://www.teamtrinix.com)

[Patrick Galligan]

Correct me if I'm wrong, but if you're internet router is dropping spoofed
packets, as they should be, this attack will not work.

Regards,
Patrick

-----Original Message-----
From: Synister Syntax [mailto:synistersyntaxlist@gmail.com]
Sent: Friday, 16 December 2005 1:56 AM
To: sppride@gmail.com; bugtraq@securityfocus.com;
full-disclosure@lists.grok.org.uk; vuln-dev@securityfocus.com
Subject: Re: RLA ("Remote LanD Attack")
Importance: Low

I agree that this is in fact a DoS, however it is using the old
LanD attack (from 1997) syntax/style. That fact that it is a packet
to itself, from it's self, obviously spoofed. As this was the same
way it was done back in the 90's. The difference here, is the fact
that the LanD attack can be performed remotely, whereas before the
attack was only a Local (LAN) attack.

Also note that this is an attack on devices, not OS's. Also let
me note that the device is unusable until it is physically reset.
Eitherway, I am fine by this being consedered a DoS, it is. It will
shut doen your switch (rendering your network usaless) or your router
(keeping you from access the internet etc.).

If you have any other questions, or comments please let me know.
Thanks for the input, I think I did infact not state that the attack
was a DoS.

On 12/15/05, service pack <sppride@gmail.com> wrote:
> Updated the wiki page. Your looking at a denial of service not a land
> attack.
>
> Land attacks are caused when a machine floods itself.
>
> First example, Echo and Chargen (ICMP and Character generator (old unix
> service)) Are services that reply to anything.
> A spoofed packet is sent from a machines echo (spoofed) to the chargen.
The
> chargen replys with garbage, and the echo echo's it
> back and so on until the resources are consumed.
>
> Anything that doesn't have this effect is a Denial of service.
>
> Now SNMP and windows Kerberos can talk themselves to death (an example
of a
> non-cross service land).
>
> Makes sense? :)
>
> SP
>
>
> On 12/14/05, Synister Syntax <synistersyntaxlist@gmail.com> wrote:
> > Below is a copy of my RLA exploit submission in ASCII. Attached is a
> > MSWord (.doc) version with rich formatting, created with ease of view
> > in mind.
> >
> > Regards...
> >
> > ----------
> >
> > RLA
> > ("Remote LanD Attack")
> > 2005
> >
> >
> > As discovered by:
> > Justin M. Wray
> > (jayizkool@gmail.com)
> >
> >
> > Devices/Vendors Vulnerable:
> > - Microsoft Windows XP, SP1 and SP2
> > - Linksys Routers
> > - Westell Routers/Modems
> > - Motorola Modems/Routers
> > - Cisco Firewalls, Switches, and Routers
> > - DSL Modems
> > - Cable Modems
> > - Consumer Routers
> > - All Central Connectivity Devices (any manufacturer)
> >
> > Devices/Vendors Tested:
> > - Linksys BEFW11S4
> > - Linksys WRT54GS
> > - Westell Versalink 327W (Verizon Modem)
> > - Cisco Catalyst Series (Multiple)
> > - Scientific Atlantic DPX2100 (Comcast Modem)
> >
> > Definition:
> > A LAND attack is a DoS (Denial of Service) attack that consists of
> > sending a special poison spoofed packet to a computer, causing it to
> > lock up. The security flaw was first discovered in 1997 by someone
> > using the alias "m3lt", and has resurfaced many years later in
> > operating systems such as Windows Server 2003 and Windows XP SP2.
> > (http://en.wikipedia.org/wiki/LAND_attack)
> >
> > Explanation of LanD:
> > LanD uses a specially crafted ICMP echo packet which has the same
> > source and destination address. The receiving system stalls due to
> > the erroneous packet and not having instructions to handle the unique
> > packet. In Windows 9x variants, the systems will "blue screen. " On
> > modern NT variants, the systems will hang for approximately 30
> > seconds with full CPU usage before discarding the packet. With a
> > looped script, the attacker can render the system useless. UNIX
> > variants have been able to use a firewall rule to drop LanD packets -
> > leaving most systems patched.
> >
> > Microsoft originally released an initial patch that secured Windows 9x
> > variants - causing the exploit to lose popularity and become somewhat
> > obscure. Later, when Windows NT variants were released, Microsoft
> > neglected to patch the security flaw; this caused Windows XP Service
> > Pack 2 to remain susceptible to such an attack. Within the last four
> > (4) months, Microsoft has released a patch for Windows NT variants.
> >
> > LanD versus Remote LanD:
> > LanD was originally introduced in the late 1990s and was very popular
> > with educational and business networks. The original LanD attack had
> > to be executed internally on the local network - thereby giving rise
> > to the name "LanD" (indicating that access has been granted to the
> > local premises). However, with a remote attack (Remote LanD),
> > crafting special packets and spoofing the destination and source IP
> > addresses will cause the attack to be carried out remotely against the
> > central connectivity device.
> >
> > Exploit / Proof of Concept:
> > There is no handwritten code needed to exploit this vulnerability.
> > The only requirement is an IP packet creation utility (such as HPing2
> > or IPSorcery). Below are some HPing2 examples:
> > Victim's IP Address: 63.24.122.59
> > Victim's Router IP Address: 192.168.1.1
> > hping2 -A -S -P -U 63.24.122.59 -s 80 -p 80 -a
192.168.1.1
> >
> > Remote LanD Specifications:
> > Although the exploit will work without the Ack, Syn, Push, and Urg
> > (flags), the device does not seem to shut off without these flags.
> > Sending just the LanD part of the packet seems to only create high
> > amounts of latency on the victim's end. The spoofed source address
> > must be the address of the central connectivity device; although the
> > normal default is 192.168.1.1, some manufacturers use different
> > addresses (such as 192.168.1.100 or 192.168.0.1). As a result, the IP
> > address should be checked prior to initiating any test. Additionally,
> > a broadcast address will work for a source address as well, thereby
> > flooding the network with responses from all the machines connected to
> > the network. Although it will not stale the Central Connectivity
> > Device, it will maximize the entire network usage - crippling the
> > network with extremely high latency.
> >
> > Test Environment:
> >
> > - Test One
> > - Attacker: hping2 on Comcast Cable connection behind Linksys Router
> > - Victim: DSL Modem/Router on Verizon DSL connection
> >
> > - Test Two
> > - Attacker: hping2 on Comcast Cable connection behind Linksys Router
> > - Victim: Linksys Router on Comcast Cable connection
> >
> > - Test Three
> > - Attacker: hping2 on Comcast connection behind Linksys Router
> > - Victim: Comcast Cable Modem
> >
> > - Test Four
> > - Attacker: hping2 on Comcast connection behind Linksys Router
> > - Victim: Cisco Router on T1 connection
> >
> > - Test Five
> > - Attacker: hping2 on Comcast connection behind Linksys Router
> > - Victim: Cisco Pix Firewall, on T1 connection
> >
> > Test Results:
> >
> > Test One:
> > Connection Latency - followed by the modem physically turning off.
> > Time elapsed: approximately 10 seconds (from beginning of packet
> > flooding to complete shutdown).
> >
> > Test Two:
> > Connection Latency, router reset, then connection lost. Reset needed
> > before router would communicate online again.
> >
> > Test Three:
> > Modem lights flickered; the modem lost connection and sat with the
> > Data light completely out.
> >
> > Test Four:
> > Router lost connection to the internet.
> >
> > Test Five:
> > Firewall lost network connection.
> > Conclusion:
> > It appears that central connectivity device manufacturers need to
> > release firmware updates and/or patches to protect against LanD and
> > remote LanD attacks. The LanD attack is no longer simply a local
> > attack but has now evolved into having the capability of being
> > launched remotely.
> >
> > Acknowledgements:
> > - Casey O'Brien, M.S.
> > - Assisted with test trials
> > - Matthew Wines
> > - Assisted with test trials
> > - Yvonne M. Wray, M.S.
> > - Report editor
> >
> > Submitted: 12/14/2005 by Justin M. Wray
> >
> > --
> > Regards,
> > SynSyn
> > Netowork Manager, Server Administrator, Security Specialist
> > ( http://www.teamtrinix.com)
> >
> >
>
>
>
> --
> ------------------------------
> www.trustedmatrix.org


--
Regards,
SynSyn
Netowork Manager, Server Administrator, Security Specialist
(http://www.teamtrinix.com)
(http://www.teamtrinix.com)