COMMAND

    SurgeFTP

SYSTEMS AFFECTED

    SurgeFTP <= 2.0f

PROBLEM

    'ByteRage' found  following.   SurgeFTP uses  the same  (extremely
    weak) hashing algorithm  as the NWauth  module to store  the admin
    password,  but  adding  a  fixed  'salting'  value (which is "qr")
    making it even weaker against all kinds of attacks, in this  case:
    bruteforcing  the  admin  account.   (You'll  have  to consult the
    source code of the NWAuth module to figure out what we mean).

    In brief,  what happens  is when  the SurgeFTP  administrator sets
    his  account  name  +  password  (Surgeftp won't work without it),
    this information is written  to the file 'admin.dat'  by SurgeFTP,
    so that this file contains something like: admin:qrQ\Wd.

    This  file  now  contains  the  authentication information for the
    admin to login using Basic http authentication on port 7021  (this
    portnumber can be used to identify SurgeFTP servers BTW) for  'web
    administration'.

    Since  this  authentication   on  port  7021   allows  logins   ad
    infinitum, it can be bruteforced. 'MGR channel' logins get  logged
    though  (they  get  written  to  surgeftp.log,  surgeftp1.log, ...
    surgeftp5.log, the logs  use about 1  meg of hd  space before they
    start wrapping).

    From an attacker  standpoint, we can  crack the SurgeFTP  computer
    by using weaknesses  in the way  the admin password  is stored (it
    is better if you  think of it as  cracking the hashes using  their
    associated passwords, then cracking the passwords):

    a) the  password  hash  always  begins  with  "qr" (the  'salting'
       value) this introduces new weaknesses, since this value is used
       in the  hashing algorithm  and makes  certain hashes impossible
       since they don't match any password.
    b) every character of the password goes through some  calculations
       (using the  salting variable)  and goes  through a  modulo 40 !
       meaning the possible  hashes are at  maximum 40 x  40 x 40  for
       any three character passwords fe. (but alot less because of a)
    c) since certain hashes have more passwords associated with  them,
       we can order our specially generated password lists

    Enough theory, now some numbers:
    - a (null password) is cracked in 1 try (duh)
    - for  any 1  char (256  possibilities) pwd  you set  as admin, an
      attacker just tries a 4, a 1, a 3, a 0, and when all else  fails
      a 2 and he owns your Win2000
    - for any 2 char pwd  (256^2 possibilities), we need <= 168  tries
      (maximum 8 seconds at 20 attempts / sec.)
    - for any 3 char pwd (256^3 possibilities), we need <= 3916  tries
      (maximum 3 minutes 15 seconds at 20 attempts / sec.)
    - for any 4 char pwd (256^4 possibilities), we need <= 96012 tries
      (maximum 1 hour 20 minutes at 20 attempts / sec.)
    - for  any 5  char pwd  (256^5 possibilities),  we need <= 2349912
      tries (maximum 1 day 8 hours 40 minutes at 20 attempts / sec.)

    For  demonstrative  purposes,  below  is  attached a zipped up and
    mimed wordlist that  can crack all  passwords <= 3  chars (*nix LF
    format).   The  password  list  is  sorted  according  to point c)
    meaning that the first passwords  have more chances of matching  a
    given hash (because that  hash has most passwords  associated with
    it).  The zip also contains the password list generator sources.

    For pwds  > 5/6  chars, we  might want  to make  separate password
    lists for digits only, lowercase alpha, uppercase alpha, ...

    Since the SurgeFTP administrator account has read/write/delete/...
    privileges  to  all  resources,  the  impact  of  bruteforcing the
    account is  quite high.   The password  can easily  be guessed for
    passwords  of  up  to  5  to  6  characters.   And when installing
    SurgeFTP, there is  no possible way  of enabling a  better hashing
    algorithm for  the admin  account, nor  can web  administration be
    disabled when running  the server (you  should block port  7021 on
    the firewall).   The mitigating  factors are  that 1)  an attacker
    has to  know the  loginname of  the adminstrator  account (we  can
    only assume this will  be set to "admin"  but it can be  anything)
    and 2) passwords of more than  6 characters start to take time  to
    crack unless we limit ourselves to certain password compositions.

    ---
    Content-Type: application/octet-stream; name="surgeadm.zip"
    Content-Transfer-Encoding: base64
    Content-Disposition: inline; filename="surgeadm.zip"
    Content-MD5: vsOQRY31/7IDjAMlkINNHQ==
    
    UEsDBBQAAAAIABxqBCtIlS7dRwEAABACAAAKAAAAcmVhZG1lLnR4dFWQP0/DMBDF90j5Dje2
    UuNSygAVQoiJGdiqDhf3kpg2sTlf5Obbcy6tKgZLz74/7/f8OXJLjQTAfe8GQGv9OAhYRnsI
    emAzL4uqqsoiYIwUV9XayEnARUCI2IcjQa4kz3tonN6kw8u8tgxTWayq+2oNtkOGkPagLj2e
    DDzcPT4BilAfJMJM8EA6UPtRYA3KMgrFshAPNatsPFu6onx5aGkgRiGY/Mjg03CjOLoocaEw
    HAV4HOCHO4ydsYuycE0egISaMXoWurTDLPo/8usaZWECFcS0L4vkpAMteeswT+WNynt+7r0a
    abT45znPpmWRO7KF+gI2Qpwwb81A/SG7GAtyC1IW+D8CNOx7ZaLMlknnZ9Mzrrl8xDuGMN0+
    yA2tZty+TUIf2NIOnmuVrPJ1ws57Y33/AttOJGyWy5SSudaN/a7NQLL7BVBLAwQUAAIACADE
    aAQrmd1gVZoDAACMCQAACAAAAG1rcGFzcy5j1VZtb+JGEP4MEv9hjiqNbUxi06OV4hApKrkm
    0jWcAlVb3fHBmDXeC3it3TUYVfz3zqzBmPSaD6dTpdqRvMzrMzPP7ubS+Zqn1QQHVs9ZqNRF
    BF3QCVeQSbGQ4QpW4TNTkPKIARlshJzDkiutoPSrPbEUKxC5BEsJqdnchiRUCRlDzJfsYGb8
    vua5RMdW8zueRst8zuBa6TkXF8nNqUzydGGErWaUhBLmLJLbDOF87PV/nAYkf/fw/g6cOPGD
    47pXW+Py0sE2MIjFcik2GBF0OMMSIpHqkKfKKCl8GGkmFQIDU/mCpUyGmOzYrFW4JTdFbRCx
    CwqxMuOwYTAX6bmGTZhq0AIWAniKXy0ErPIoAS1FTmk3CUuNi95mBIatmdzimHDJU7iygXpD
    SbQBBeI53NJCmZphAH+1mp77+vttLHz3n+/LGP6r75dj1ON8qxj/RT/+Jxat5s7sDKT98O7n
    pz8/TB5Gj3D7/pfR08Pk/texIRhyExZ8zbLN3MqR0IsUeW74xtLDHpvaxDUgHkPCwvXWKLyA
    ZJUPKbkLxanURPp82KV4nAhp8YEXAL9GWcA7HYyNBpwIjeJdqzmTuWZXZFzLhdpTePYRnj91
    ev1+51/13svUnR5cAx4qS5ZalZlNis6+0tK6GBCwAAo0J7RQ7A0a2IsYLKvAs9Kqoez4NpzB
    W0SLcI8AMOG06xVvfduG72v7uJhW6erP8XAzXaGONhozycLnwKTelS74aRCKAm4QXd+ESlmh
    ryp8nHB4Nkimc5lSeysVFtb1p2Vd+wnQ70E9OQo6PlU/AI6TAbZUDE15txvgqYZHGmUzI2uY
    fmHCQYFdPHTrS8NFS+NqhkzlkKw+5w4VfDJ5ZwA/nErOMFrx09ArGWja8aJn558Kzzs36n3x
    dC3sXtkLd49Dsx/oXQtORzxPLSJ1KBeRWxLZcejXej81I5rlccnu051QuLB1MQZ+VVAZO5nZ
    kNitxEeUsciQge3yYq3uVXU5vr8d39+N+xeTPyZtF9py1rZNkE1CV671JmYitjCGfaTrgmll
    IRgXwbikCkpFhnmQ6vhntNCG7g20D1qiQlYjoZOdNs+ETnpHrHQDliD7F7rQhC7cVOHKgIfj
    BPMhwDjDy1sT3J7bPlOf0rZbDevoV3LruBdOvD5+uB2Pfx89DeFxNIF3o98eh2+mGMgu98PB
    Fv91ELl+3byMvmtUxUVLoRilOWh3FacqnWnmjib3N1BLAwQUAAIACAASaAQrnzkpJbcEAADE
    DQAACAAAAHFyaGFzaC5j7VfdbyI3EH8Gif9hRJXyDUsu3EnZEPWuyTWRrnenhIdWOR6WxbAO
    u2tie2FRxf/eGXuXhfTy8XB9ap0IbM/4Nz+PZ8am1/wBrVKGJjzIwFNB14cO3CZyzj6OvsIt
    kysm4bjrzMCbRjwG0gm50jBnMZOeFhLyZmFGAVewlGIuvQjWPAxzTQYemJUCsXCakJgCpT2p
    eTxHXR0UMNUHWQUdeBr1VgyWnlJrIacKsCN8jnBTu0IHLOrCNaw9Bb6Y4vR9gkYyGC0g8hYM
    uAZcvmiDF08tqxmfJ5KBSLRhsxRK8UnIcB7N+YEnYbme5jCWaxv4DDYiQVsxbgMtyx0xCFk8
    1wHqSLaWHHerRMSQHW5NdTOYyQbuPmw0u/HmbAxnE+xK7P6y8QIhur6IzuEu0Hp52uut1+tu
    Lu/695NuzPTYwvyA1quUK+WfeOyHyZTBmdJTLrrB+eGcROpmslL+eP3pEpqzwK2Ue01yOcxE
    GIo1nZv2yG2+iLXHY2WE5D7PR/IK+QL6WMKK+5pHNVU4LPI2tEplIUGcaKit88XC21BH3R0P
    3o5hCH9Vyk67/+xfpdz/X+M/quFUyluXQhXj8+Ly15s/v46uv3yG959++3JzPbr6/dYEGMe8
    ZXESYWqreoKxN4+xYJiAY7EvN0ssK3fjBgUbACkHzFttjMBxaW63hoQINHSwKLQhPRQawHsT
    uW2YshyYxkZxJmSdDx0X+BnOubzVQpO4gFOg913YVsoTmWh2Ssp7FFB6yLpRsO6Pm8eDQetJ
    ufPYdOsYzrD6Sixc9Z1agwStzAFWOx0SMRdSVCe2kGYKJaB6WK+nWNnqeyxb/QYcwQmyRboF
    ATQ47jjpSb/RgJ/38jsd78ztt8Jtxivk4VJpIpm3cI3prV2CXyVikcI5shsYqJil+nTHjxMP
    p4F1WScypkNzdzLcWac/thvLjoDGw33rONHq0/aHwPFogIWKoSrvdFyYC7xgyJw5s5JxGFoc
    pujG3F2Hp+vkmmapOWWiQ3P7B92iHR8cfXMIbw5njhAtfXfh2Mg0/njktNq31HFqRozbbrVM
    78APAL3mEgu9ntWrR+pbXN2LV4yFXg+MVGU1P8HbcycvSjml1r/h0Ff785E7t8+UgcvPF2Dv
    v5XgdAvxuE7J7Mm537aZ22zSaJWFpZmaJDObvibxF+2wHbXjtmjraJlXHVSxL4vsKjQu27ko
    f0Gs6U3AYlOF7KuI1HAwYdJelrNiEaPHF62kj/2Xj90AGFqOOemHmmtGxtk1WbM39aC4iuk5
    oyAUYml2Gc/3LaNVY5zEyjjdvm6yR012wFQNFlQ7Fmcn9LlXKIx/yPSiRSnu0vjNQQiaLN3V
    XpQ38iJCsCHBhgY2LMqLxTU4YYF7coj7FHCGHBFyZJCjHHkHbaCiAnrwCPpJ7Aw8JvDYgMd7
    3vhn24HHhbG3j1L0++37DODJRrQE0RKGlniWVkHOkBEFuXevImcbJgEqH5B8cQ1tC9e9yM1s
    KUD4mVjiRVXNf3+o3tX726vL20F39McIq1bVW1dftopYWbWbBW0seNA5h6MplT0kTcn8Kgg/
    FIohQsPGSMlUbxMTWWebhYj93tqIM1/b/O4qbbOijf9/A1BLAwQUAAIACABdaAQrzpJ1qaQB
    AAAvAwAACgAAAGhhc2hzb3J0LmOVUkFu2zAQPNeA/zBl0URyKVs2ml4YG+ghQQLk5hwKJDko
    EmURUElBlGMZRf6eXUuR2t5CCFhqd2c4s+Ri9qE1nWAGe/CubuYpIvDGI0FpfAOXo0q8P7g6
    Q5H4QnucAB9aC0JMJ1+MTct9pnHpm8y4ebH5N1cbuzslp5Pr27srzPJiqcb9SnHlxZkMvxNj
    A2MbJPUulUiLpCZF/PcS4g8d1qWe9/nD6uLHk8LeerOzOgODWomjJA6KXg3Ns+rED+SuDtp1
    3F73S6HFBjGFKOrZAZMj8CFV1kykuqRfUxf9UugSZIAacldpGwieHo/UL25+bm+uthfz+1/3
    QkLUzyLsAYfClBrB51y7PCB0OBxIZDvd+IA8SfIkuajeSxWdQvOj71SHQLSBCL99Hzp4FFQu
    SQhtw2j5RJDzxzaOz4eeY8fSuDKoZCzjkZ/dUnWNlvR0qenkE/tbjf742ejukXQ2t//5TA5i
    pCRwRRfesM2VFF/9oxWSpamOOS2d11wbIa9/yyE9G551iDPWdknSWBtlSNFR0V0s1TuiDwNn
    PzlKv/KVvwFQSwMEFAACAAgAPGkEK7nB1KrRIgAAMz8AAA0AAABwYXNzZXMxLTMudHh0HdvL
    QvK8FgbgeS9hX0VDUiBDBBERAcHDXPmU+7+C/bz/YNmQJivrfGhrG8pQh3GYDTN/yrCYD4vZ
    UMahjkO5D2U3NOPdUI2XQ3sfWhvqchjdPQ/1PCwWw2IaFnVYlKGZb8NozXkYjc9Dmw/tMrSH
    YbwMozHMbSgWHIf6PlSLH4ZyGEbzt6EaHIeyGarxZhjfhrEO7W0on8NYhnE9jKuh1aHAthjG
    0zD2oa2HVoYyG5pbi6H8DmU/lMtQ5kP9HKqV12GchmblaSjboRlfh+KU76Facxnqdqj7of4O
    dTZUkwibhnodprdhqkP9N1R/34b6NEwmp2H6G6bnof4N9XmY/g3T09Dfhl6H/jf056FAjuBp
    KHZ9DfVlqMR7Gmof6scwfQ1TGSaDn2F6HabF0K9Dn4b+b+hPQ7Hd37+hOPR1qKuhroe6GOrj
    UK1/HKbVMJ2GqQ/TyzCth277z9Bfh/IxFEL4GvrH0P0tQ+9DXw3dmsehvwwd7z9D6UN5HAop
    rYdiZjUUe1/o/UzNIz1T9HKkNoYwxh5yfQcNLGl6Rs80tWvWYmtJfbfCaKwl8FnJuhVYGGfv
    BZin4xnFVhZVn0ZiGrECPowndtTB6wh/zsi1AWZIdAsmsrBvQQsdTR2+wgJLLGkXa/J7l7nQ
    TqFLpnCcMahcWc+R4cwCbJyBt6N1BxZ8sPYQuvFxiOFXMIHFsDI3nWcADROeyX1hboHPxWzL
    Q+IixvP8Zv5zMHsBH8DaOX+Yc4i5PbObKx4mnkLfC3JZOKvcXclpMdo32kduixk93LnZfWcP
    WvHU3nPlWeF5zG+yf0fzPU4ZD12a34E7mVEt/dV7vPVuDxvcGe+Cky++O/ccx7ZvGXfm2+Q4
    43cz/tbsLXFb54459z336J8O2jn+7pzz3f5AzhAP2EAj97EF4vuuaJxxpUZ+7UzWu6Xfe0BP
    bG3GM2c8b8Y9Z/xtxvnG/2haCiihP2t2bCb0GwsEM94/4+8zbj9jDzMhaMaxZ/x7xhZnCU/n
    hCU0xDbxUZYJUGhFd1uGL/COZuvK2b0xUQqfbGYkhxG/jd5H546x7SU8/+EUGc5Zm3njf+b/
    ub4FjNnp21v8Oj4R4LPW1uU0rK9Zi6d/iSKub3CsyGgF/8pZi4Axe+8bkWAjsq0CnHiTtZlj
    v6vYv3Ein2A7LjLOVRBIcBR9+x//+EPHIsA3fsn7l938Gl+ML8YXNH8G6OWTDzwYPxg/OB+t
    /cruXwICyi97uaD/0zhRNrH3l43tjHe5J1A+4PXBmge/Bdfym3vWXPD7GTCXwLyz9jMB2u9L
    9kx44v9/gYpe8eA/vuhjYjcTu+J77RowvoY+a6/Wvlj7wrfF0obmJk63a0BwnwIL45zFpi5k
    /gkejL/I4Qt96wC+D/h9NhYwT1+JA+g9LIbrS8bo/MqenIMmZ5d1wPnngExwC2RM3rfEjIWr
    c8XMwg7L3fVOtn7XMX7guosfH9i43/f4FpuWbWY1ds3GJZxZjT2LRxLITJaZST8zSWAmMc3k
    oZls0O74vmevEH6P//4NbSfL0c1K9F/1XCsg95y3Ozj3Bjb8Ag1LtNjX7okJfp/l5Oj0bs1d
    7t10ED+SiuPD5/AgM+/83iVWOIutjy1g7Xsgccn+Zfiz5k4Xd/I4O4dNNDbQyKqdu1goPk4X
    IFZO7+ABJE5egbi5zVzWiZOS3kI6XkyJx3KE3LeYjtZYP7Ou29uNJdNFz96Nqz3dGrJYdHu2
    B2sz7zxyWfTsc77cs5DAFx1u+XIxC051CN9r8Xc2P4qbFQ9lGdnh7+x6vuEDnu0euM4y/gU/
    xqHhGeSKtu0rcMb2zz2wRdvWWdt/4Ntc8glatmjdhi80zuyZZa/5mb0z92ahz/rtl6uzZjnL
    +lnOwvv209h1hqZZcGTdv2Fk5+Mh+uRzm+SqJ/BovXO3GaNn9olf9/nw+G7vVtFxjp75Kl5H
    Pjy+J1+hZXSu2LMQjxajs0fniMOLEW8jfOLRIrXZOffxMT4aZy9+xfHFGP6jE7Lfyluz5H17
    FuFf7pOnF7PkM/tTWM526KcHPjnyzyoWVDFhegvwO3YzsY3p2ZU/17+A8b9A1vL/69JavioG
    T2xoYlfTs99qkfoXMP5nPrE6MVBs7/D3N3ET/sIm6xc/SJx4gfMF7tQJap7p1dmvocG+ZzFG
    fijOrj8Ba8Xl6V/wLYEYwvaL8+tXakTXl4Cz1QaT2mBSC02vchRaSvLGj7z4Y/yBDjmmo604
    q4pnNbFaXTK9mgutaK6ngHVo6KGFXMozOtbm165kXeWc6RHdj658ZuI/nQ901/Joj/mSHPcD
    7wd61WoltOOhntB0Eot7AJ2P5h/lp38B42dzkevaWjGzLgL4sm56xKd9Uw/O0OyME9mEL/z1
    EkDHKmD8GEhBaw16SuT7aE/itxw3GU+5l1oSnV2P0smxJ7esjEOXc/srHHRU4C5pQVYBZ6Ch
    k1+Xiztc/TVr0QZHgausAplzrnXFuqb+a6nP5jqbS8BYfq3q3Dryo4d0POYeUu/oXdwbrRkv
    6YECxvPce7BPazFqPkY9SOqMUTuibq5pltSQbf6maUrjBJ8YUd7lFLVZSR0ox5bUw9aXdFD2
    FngKfO2iMZK7m1zb1KFt7vdcjzQ/Ab6pZm0XHUbq8vFbG4ZGNI+h/eL+xboHDZgzxtAhv1dn
    VmfX9+Qx3dUdvy1dnLnUfngZ0Vt35u+f+joyVluXQ/Khlss5JfPvZCReNnGtwFHeyUHN3NTJ
    bR755rd8NL+iI2B8iazcu4RvufkG9w3um3tqkBEvY/hTi7QHnSIeRjyMeB3D80NAE6ZXqDvy
    vW/dzzqxkWzGyOiBPPQU9U4XdzUp2Y3kVHd0crfvbt/OvR193ck78B6d0IF7xZqSGlIP0MTr
    Jq42Mbul/yC/kTwn9jBF7/qG4ozirPJOb+gp736/7/XAbESfMh7pXZ3UHqxXo7WH8Ar/gybz
    QI5LOniPDmJj+lzyGclqvEQXabnFSzIcyXIk05FsRzIeybocyH1p7xnQR91pfXds4R4wbrnn
    jA3dbch5Q/e3AF2Teafjcose0ZdeSx5ucmebhTdNLb326Do47tE7/b+7vsuf72r1d73Eu5z6
    fiQPcYj9Tux4Yr8TO57YcGdj5YZuuhvpboyeHyJL+qKrco6d5BnDEajrL8aXXJ2lTi9LOklP
    SKaVjCv5Vn1KbfSY/vHgvj6wLMl9SQ9La84B687Zk73s4T3rzTdzzdpD9tLXIWNzZ/f1OlXv
    0NlKMS7GxXy5kXlq3Yc86sg4/NAHHfZdeHTuzfrbhbzEo3uuW7AH7t+D01x63FvWZk9wG59z
    FhpuaKOnSk+VnkZ973iMrX0DsjgEyPxA3gfyP5D94Xvoy9gVmT2Q30P6pciNjjaxqzygUcfR
    U6WvSm+V/uot9hb7MN/MNWua+40e2cR0jy3qlehhpIeRfka6GemoL2NPsSv7z/Czn4mOp/9s
    xX120tlgZ4vlFkDvDa03tN/QfXOPPfXoXa/c1A1N/VPgK+fYl/5Zf1fe1a9HNnMUE47sJs8A
    jmznuEYDudJzj8435Lgh1w39RYZkW8l4opeJHie6mch/opMpulkG6CN2tSH/TXBkX/bTP11P
    dDXtcmXT9Dfdg8N5bKHHPthGp7N+zhzbiTzIe6SHkR5GehiP7OXITo7RJVvJ84zjdZjoayLD
    vozuolP8HvB7UI9u8uCMrDbktCG3DZltyJlMKnlUcqm36I+uyLWSZyXbSqa1WdOs0R9PZD/R
    wXQPOOccgPvmrJtzbvDgu4bvTejHOzlWcpzIdiLXiYymZX6TRXwKbXWTR3rORmNFX0XbeMTz
    Ec9H5+Jn+s/2nLMJP6EXXTnPudV8zZx7Nc8F1J11TO78A08gfc4/IN69kZlaZVQLjdW4GucZ
    xltAHn1LPvoHxFF7i71FP1z0ieXTevXBKP+PxXgdMFY7teCAq8FZ+HNJT/kQXMnDz0A+Q8+o
    /hrVR+PJ3h4wTn2lru7v8llwwdngbnkW6qyWmmQWgFMs7e9P4A2oX97/DW1lnTqkpSZSo3d9
    SW9/4B94BtY3MaWpFxbWpo9W45U9+vZw7o3lgaL2KPP0pPKa2ryq5ev4AdYg/d4LkCfV6HVM
    ffAFHodRvT2qo8crftTDo/p11Lc1fDX8tR6a0fP+PDR8N/w3cijbgDP1c+UYMD6mB+7gA5zA
    Gqg5nVecV9BQnFm+rf+2/hu9oRntFQ/1EjCW5+o2YAx/xWPFa8Vz/Q0Y/5qbBYxn0VX6cz0z
    vtd6+fWa7vUF5c01j23V32//AXvSU9Q8A06tPpGFfrVOmWfvetCK/6ovreRR0x/oYav+tV7z
    AFkMVo+Pb3L5G/9W505wTfZfa8D9yq+rNdWa+jlc7bnaO5mbaq5qc+sm66aqRmd7U10DcaCu
    wDsQF+yfauK9MVuexoztu/p9tfZqb/qlq3n6m65wpMfJWVd7r3DR7ZRnK9fQrI57ix89gWeg
    h3xj13l29ZYn4AF402P92Zve6Q/e9Dl/zswzqD949VXTnzP/8PMnZ//HM3wVPnSPFX58jjUP
    +mM7X+AFdPABTkDd3lzbK3Cv/QD39aMTH57478TnJv7X3615XwFr3h+BeK9n7c1cCx74G7zN
    vbYe1uhZO788B9jAKjANb88Bemd/lf3V2B87qezlbRUwZss1z5LZcn1mC+mvntlC+p5ndpI+
    9Jkt6Ffqs7XB98yGnrOenThjekxP5PovQPfOuK4jY7XpmzrwTQ36Rs5P5PlEZ09k/USWT2T8
    RPZPZPtE5k/k/JR1dPAE1xPZP0XWcOTZal6DVDj/e4/C1vRAY16Z0GWj534IJAaKh3let3Rd
    4jHPPcSgmufI4sq4ZgPr52ESZyYxaBLLJjGt0WWrwbUHT2AL5Gj0N7bTDwFxVh1UUrt+qgM+
    5dBP8v6Ufz/ziif1mmuem4ohVSypu/QSft8DoQNNzh4LG+KjY0FPCV14WuNNTzjqb8c1+1qz
    LX3leDJ/cv9EbmLlJE5O7wFrOjz9D+3qbD7W+GDjS409tpo3T+bfco2s3OPLjW/0QyDvofCh
    pi96ppJeT31X8hz0U275VJt9qpE/1QifeP9Mfem6lKPO7OIc+QaMdwHjO77v+G6B8Bhe0SkW
    jQU/6/CK7zWdrul0TadrOj65rycfT9af2EQLsC26m+hw7AF7uj3dng5PT92a51pZQ6eR9zm0
    0R//bDVX+mQ3jf20Gl2K7eJAPwTkuwc8PkSv+HzA8wNeH/D56d7nH15dl8GLr7MruVdyrzu/
    d37fwzPe6aW28If+dXhJDsX3iQxOdEUeU+TRrel02elUzz/26DC6iw5DjzMfgts5OzjvrvfI
    L7aP90IGJfIyPhmfMo48nNmTl+mZHTX21NhRmQXodEbPeu9GD41O2sp4ZV2eBaycv/B74ffC
    78VcTulgAeS0N3nuTc55M85LuryEKwv5JdCBOJF3BFc59yqmTYEOihwRWIAuL7hec9Wnruhm
    xaf4XKebLk90+aDnHZmc0Nly55Pd/s6eu7zRa15Sqj3lj36z9wYHWTf21Ph14zONb7d15iOL
    1BHmFn6LF40dthIZsAe+18SSRpaN/zVybYknJWvZwj19PT/Ps2U6LjO6mbGTGf3M2Mksc+7p
    E0ueAeCpyElFHiryT5G3inxVrrlH/nn2Lo8VuavIWUXOKnJV2Rvvrd1nbG5PT3vr9/bt4cFz
    wX8hi5KajYwKeRUyKHm7TT4l7zPJrZBhSS7IOyp+U/hlyfsyPlrmrnNz87xXzm/n6KWL3rrM
    xX02UfFdo0t1XCWTqq6rRV4gl5paguxqEf/zYj3vhvOCugfcU0NVPlrZdO1wqKdqt5e/1m6P
    2qqyz8r2K9+tHwHjD3Mf7n1Y82Hthz0f9uY91AdcH3B+wP3hjA9xMbmdTEcyHa98iBzH5Pwv
    sfErV3nkS475kj++xPcvueVL3vmSV77EiS8550su+pJrvlIfyOlvasO3D/AF9Flvei5106jO
    GdU7o1ppnJw15T288/Ja/cdZP874ccYP3D/w/Tj7x3k/ue+cH7nlB10/6PlBw49z1YbTmKvz
    aiA1hTPpdazOr6lTxY4rO14FxKlbwHjBxhfsUBwq51zZ4Tm1wwnwNzVnE1caGbfElB7f5h8r
    vnBKTRs8fOpmbmFukVgAZ17ai6HlnPco7EFcL1sxcCs2btnaVj+k1pzUnFPe3bHtMe+pknfo
    svWM+U3ij3jW5KTGFtoq4L4Y1cT2Jl41+ayJi038avJZExub3NbEsHbKWr3hjZ/frF/Ef8UD
    tUJXG3Q1RFczdDVDVyd09URXO3T1QlcvdLVFz7v5p+zhA67FfHG/WF/gKO4XewocBa4Cd/lv
    Lb+CrzijiLdFDitib5HPyt51n68y7N+Tyd79Pfnsc886+aC852qdPFS2kZ+zt3BvnbPNnHtb
    a7bWqiWL+rOoPYu6s6g5i3qzqDWLGrOoS4uatKhHi1q0qEPLX3wXDXO45u7P0TGHb46OOdzz
    fG/BZ175zytfeuWXr3zrle+88rVXvvTKr1752Ct/e+VPr/zvlX+tAsapCfVodWWNPq3KDZX+
    qn6tsqEqT9QV3CtnrJyl7quP1j66/2heLVgf7c+z7UfrH7MG3ke4HuF5tP+RvV/lrKucdpW3
    rvm8RR67suPkfbYwqQEm/dd0yrci/OrEd/Ri04nfsJ+JLU36sknNMJ1S67NJOWp8+wEv4BWc
    +KlzJjl3knMnZ+ltxolvTc7LZy9reOXISZ6Y9LKTnDnJd5PcMcmjk952yrvSNTr0u5N6ZVqn
    N3kE5vI1j7w2VmfJcWN1bkVDjR+yZ7GvqVmaOqWtXMm1rcyv4g/xyUntLsfCsRYDGvxNXdTU
    Q01d1BbGC3OLjOk573mf5eFn+Xfm94wNzNjCjF2szK/M00vZsq8tm9qK8duLPqAAedreir+6
    ztXvVUAOt2d6FD8e5W06m/4FjP/J1dZf17ku1E0ngDey7gf9zCFXfW7erX/qgz/1vd/O/mav
    387+Tj1sfun+Ug+e5+ryUM179bzDz/uGC/vI+4PLp/6XLYk1Veyp2zzr1Nvrg6r+p8qHVY6s
    /K7u87mTtXyy/pr/TW0Pv/6o6o1GOWyUt8aSsXhaxFV5a1wHzK/pT/816cUmfVkTd1vkLx43
    8b/JA00+6Ae9Vt6vH/DwgLcHfDwYH/P1Fdkf+d2RHo58+kgHR7o4pgc5Abr4JJtv975TM/u9
    NL98IQN8y71VDq7z8M9X8h2CmFHFi5p30PrIqn+su4DxzpxYU8Wc+ptvvcI7GfyShfquqkOq
    OqSqS6par6pNqnqvzvLMnwzvZHgnzxYw1oOOdDquc2W3fGs8kdPpg0wC8hR5TmiY9LKTPnZ6
    z28yQ9vY7e329R/84fnb+eJRFZ/qNrz4/ev6m/6KvPWxk762fItZ36mlT0C9eI48sjd77N+G
    P9dfOaRGNx3E5l7BI1iDFfgB+uKDPvgg7h/kgoOe+aB/PvCFB7J/IO8Hcj+yyaP4eWSXR3Z5
    FEOP6Diyz2N6Hes/xd3PR4CfT3R+vqLTve/0c+aW7i3zbZJ1S/eX5HjOtzV5t0xHZzo6k/PZ
    vJhcxecqTlcxu17wdAlvYvQ2/QPeybGSSyWXSi71Pe918p4Gjh0casK6j/zo9pcOf+nyN3qF
    i89XtWid5YM/Z81iA/DP0i/k+wW03NHEvmuDm43X5pzmvHznoG4fC70X+lvzkTV9rvNxontr
    8XMtnom944nvJPbmOQV7meCaWn7Hf9QCfHPim9N77IBfqfPGTkc1kM8c6SrfeYiLrUYnZPhA
    lnnv8UC+D5kjz2++9M2PvvnQd56to/Wcd/doT16T3+oFn5fI0u+LNZfM4Vucq9vEjnwFmfdi
    9u7s3UWe+N/lfRj+1dJVXV3V11WdXeXwKq/X30DkZv3durs9d/vv8NzxU8iiRGbkcopc4isZ
    k9/J/Cl+QIZq3rGb7+Z6PusUQ8Sbtk5cz1hsEXea+FNm5DDLlRxm+fJTbJm5L7e2lTWrfBcZ
    0OuogfpCTaM/6/k+St3W9Wh9of5JbbRg+ws1kTzR8z2VGrOrNbuas6s9uxq0q0W7mrSrTbsa
    tatVu5q1/2Q9vD+ptfLtKX0tnC9eNvw2cbThv+G/5fvMewCtbKzsXfd+743FiCImFPGhzI3n
    ubIp/d845coWpzMg44mMpyXIN6psp56B2FKPQJypS8Cvb+i/pc8jK/ZQzrnShz5rvJL3FY2r
    QOSG59sLkJNuaF2YW7iXr3nZeBP7W8lHtnJYCX9skO8Wflv47XhNTUKfV7q9pr5NDc7WN+qC
    jfy/EcPyXdsbeed5U2w8+mXvjd4b229sYP0in79Y8xUgV/1H13d0vUbXl3S9SNeDdD1I13t0
    PUvXq3T9SdeTdD1WT1+6Inu5ua3Inv81NtbYXeOTjd01ftlv4txNjrrJUbfwH5m5x3ebeN74
    cVvnd74vdi/f4OX7O7VOV+d0NU5X3/R1PrFFH7vsaqDOXrvap6+zFp3qna5GWrOV9X92EvnC
    vSDrF/SH3xf7XuB5gZcM+ov9L/C9wP/ivBd4XuB9cc6Lc9VsXe3T1XBdLdfz7US+9cj3GPjt
    ar6O164G7Kesh/eU/iR6EzfO+R5LbJc/ivxR2HlBW8n3Jey+sOmC3pLvPvhCYeuF/Rd+UPhH
    Yf/lJ7193l/DIT8Wvl74fOH7RQwo93yT5oxZwHhmbmbdLLWXffyw8LnCxkreUfDTwicLHyr5
    bpEvFj5b+FXhv4WvFv5c9vDs4djDu3dv77w9fHtn7OHfr4eT3uCUvuCUb5ztCe9kU8ihkFMh
    k0JmhXzKKevgyXsKcivkWpJn5ZUivxR5pojPRc4pYnWRZ4q4XbYB4625bT4rt2ZrLf0Veip0
    Vui00G+hx0Knhe5Kvqmk50LnhW4LGyh0fdJrndJnzeGbwzWHf46GOZxz58ydMYdv/ji86Rff
    8qxgI/byq7oRf/lY3WROfuN3dSOfObuip8rBVU1ZU2OoK+t3vnLPs+3cE9fVWFXuqGqLmvwh
    n1Q1V02dIa9U9VmV+6ucX+X/Ku9XtVtVB1S1QVUbVPVbVddVNVxV21V1QT3mGbn9P/l+Sd1/
    EAsOz0DvcBATDnqWQ+bFicPfMF3Fsjz/uopl+VbrKq5d05ecQf4XYAm+wQ7cwAHcwXG4OuP6
    k+cN6VvEoUkumcShSWya8jxCfBI/x8TMpXOXzl06d+ncJbqW6Fqia5l3F+j4c/YfOv7E1D+0
    /Nmn55te80wdPfnfhPwLhLg7VvRU9OR/Fyp68t1zTw8jfqjxmlqvyWmtJyYZr8ytEofyHwli
    7SlxShxUP7ZTYoM1C/cXsan0I3LDVqzdssctm9gmjuMzsrmqJ+l6oveJHUyxiWe5Ir3Kszyh
    b6nPcsUzfp7w9YSnJ/w85Tfenqy7yC/5xvei7uFDdZ/6iR0eU/uxvyPb+07tmVpDbp+nF7Fe
    rqrsvvKFyg/qr/Gv8a+xfFzl5io3dzLty3xvEuAD3+lz8PVtDTuv89R89vCjyocqv6q/zvh1
    /1fNvKOTnXhHP32ZdwtncAQHsAMbcAc3QPbspBzRegwPZHZMz8Gfjs49OvdIrkf85Pn9Ie8d
    zuAb3MEB3MAOHAFcnxu0pheJHMiEjAu/K+Rd4nfzyCS1lprnEohM8ZRvqy74u7hPj5UeKz3W
    G3+58Y2bvbf0ZOlNzO8j/9Ra+Bfn6m8gsjAndlaxs6p96izydc4s884QX6v4OhZ2WfhHYYP5
    h5rCJgvbLGy0sNWyIUc2smP/d7Z8N75nnGfu9q6tWdu/tm8Nx5qNr+1fw7Umb3bfYtvsvLH5
    lv8XYO+N7bea+0v6ka+WeS9Cpg9k+kCmD2T6QKYPZPpApvnO5IFMxYGSd0Lf6RXo6puOxK7C
    notYVhLLxL0q/lVxsF5cL35fYiP4zvep/KHexKUbu7+JUzd75IAqL1T5of4GjH/V3Tv+vuPr
    9wCfufOZ+5saFO8nMjrh+YTXE/5P+D6RxYlMTuTQrenG3brufre2Z966bk/P9xh/QG8klpXE
    uZ0zds9DP7Pb89PQya+r1TpZdbVaj7zUao3sW+RL5o2sG/k3cm900eik0UO/53uqPG+0lh5b
    /g+Lrlv+N4ueG303em/5t6b8D0m+iZmR+4zMZ2Q9o4cZHczoZEb+Ym0RZ8s1Y3YtlpR8L4/G
    kl4DbQWNBa0l/7uUf/RS/1X4q7NryRx9kEvt+d8m8z2/3RPv6of5j1z9/sg/Prn/IeZ8iUFf
    4s5XxuLQl3j0JbZu+PlGr7zRN/9Y82Pux7of636s+8l3P2RwFgfO5Hwm1/SveZbyVtSNgQ7M
    ldSCuSbekteKrFbkuyKnFRmtyG9FbisyW9Ebe+h8ofOFzh566uFV/ntqoWaD9yfX1G1wLeBa
    kPsCrgVcC7gWcC3gWuS7JXTxr77Lt11wJW6xuc4W+i7PPcl3T7Z7ct3Tx55e9vSzp6c9fe3z
    zZMYyZbLLd848g/2XcSMwraLeHH6K2ABupohYJznrnO453DP4Z7DPYd7Dvcc7jnc8291QwEL
    QCcbfrTJlf42/ITs64avbOhtI6ZsxBw6qRv+lP8DIN9KvjX/G5HYLY7X74zNiYuV/1Z5osoT
    NXlCzKx8u4qbVbytYnIVj6ucUsXgesw8POJyFZereF3lnCpWVzKvZF5/0q/wvStfvPKzK3+7
    8rsr/7vyQzY8plY4sJUD+zmwlwNfP7CfA5s66LMPepGDXvvAtg7y5UH/jbcJj9MmtmcPOUzk
    cXXm1dnXnKvnGvVZ4+TcybmTcyfnTs6d0JNvyJdwLOFfwreEfwn/Ev4lfEv0LOFeomeZugM9
    rwH3XtnnmX2c9QR8qPXUDOxJLGniSxNXGp9q/KmJM02Maqdc/RarmvjUxKkmXjVxq51ix2xP
    XOvyfGcTXa7vcn2X6zs7KeaL+fLfmM+7V6wpW/PbXNnIlq1s2cyW7WzZ0JY9bq1TExU1UVET
    FXZX/jJHR6/8/JVvv/LzV/rEW8Vb5Xd1lavf+rDKBysfrI/mH/1+zNi9R/N5boq/6ZQrmaqL
    JjxOp+iF7DbRV54hW6MXm8TESV82iZmTfq0vA/yV7AudF3ousYUdXezg2OUen6aPvkwNgJcj
    Ho+pE/B3xPMRr0f8H/F9zHd1eM2zWXZVvq3/Tg1g/bf139Z/W/9t/bf13/nuTj3BfwobKugt
    m9QJ6g62VfBQ4j/8s87zP6cHsAMbcAc3QB58t16suZi/ZGzuYt3F/Ys9F2sv9tNXpa9KR5XO
    Kj1Veqvb3LNvm/+e5WN626qnrXrdqsetetyqx6+31CCpMeARb6q4U8WfKg5V8aiKS1V8quJU
    /bXm1/xvxuZ+rft1/9eeX2t/7ZdvqnxT5Zgq51R5pso7dZZ79s1Sd0Qf/GPH/vWFk35xumdM
    R3fzd/f1kpP+cbrnG83AD9Cn853Op3qeGx4C6gX+XPhxybPKQ+RrbpP6ITyKMTfx5pac75xd
    rvDu+OqO/ez4qv50uucKt7je8z90YnvXn/fE8fTn8lBP3pF/+k9+u/cTv3U966/PaDyjSw/d
    9dMd/R0f/Z4xe8NXx193Xo8NOruzx46OzjZLns3QUUFroZ+C3pJnEueAvWc4zjnPfn17lzu7
    XNnlzy5/dvmzy589/3mc/yCO3MIP3jr5dvx18uz8pucZBr/p/Kbzmx6/oZNOLp18Ojl1uul0
    1F+sF+v7S55R2PNiffIqH+18svPNzkc7X+18tpBTIZvyk38x5iNkVsjppGc/6eNPp0D6d+vy
    /6nkW8i6kHEh78Imyy3XyIQO2WvJ/9A5rwS/c4rzinOL8wv6ykuufqOzoLEkL/HTykcrH638
    s/LNym8rf618tfLTyvcrv6/H/Ju3Nfy9igVVDKj8vx4jT7zlH6vzP4GL8CHHLoxPAWM0/e//
    UEsBAhQAFAAAAAgAHGoEK0iVLt1HAQAAEAIAAAoAAAAAAAAAAQAgALaBAAAAAHJlYWRtZS50
    eHRQSwECFAAUAAIACADEaAQrmd1gVZoDAACMCQAACAAAAAAAAAABACAAtoFvAQAAbWtwYXNz
    LmNQSwECFAAUAAIACAASaAQrnzkpJbcEAADEDQAACAAAAAAAAAABACAAtoEvBQAAcXJoYXNo
    LmNQSwECFAAUAAIACABdaAQrzpJ1qaQBAAAvAwAACgAAAAAAAAABACAAtoEMCgAAaGFzaHNv
    cnQuY1BLAQIUABQAAgAIADxpBCu5wdSq0SIAADM/AAANAAAAAAAAAAEAIAC2gdgLAABwYXNz
    ZXMxLTMudHh0UEsFBgAAAAAFAAUAFwEAANQuAAAAAA==
    
    -----

SOLUTION

    Nothing yet.