作 者：awen
發(fā)表于：2003-1-16
一 幾個(gè)特殊現(xiàn)象的實(shí)驗(yàn)
假設(shè)一個(gè)特殊的情況：
客戶(hù)端a,服務(wù)端b均為windows nt 或者2000系統(tǒng)a的為111.111.111.111
b的為222.222.222.222客戶(hù)端當(dāng)前登錄的賬號(hào)為admin, 密碼為：awenpatching
服務(wù)端存在一個(gè)同樣的賬號(hào)，即，賬號(hào)為admin, 密碼為：awenpatching，
ntlm驗(yàn)證機(jī)制學(xué)習(xí)札記
。并不要求服務(wù)端也用b賬號(hào)登錄。
第一種情況：共享
訪(fǎng)問(wèn)windows默認(rèn)的共享時(shí)，會(huì)發(fā)生這樣的情況：
a訪(fǎng)問(wèn)b的c$，當(dāng)敲入\\222.222.222.222\c$,回車(chē)后發(fā)現(xiàn)不要輸入密碼，就可以訪(fǎng)問(wèn)到b的c$.
第二種情況：telnet
telnet 222.222.222.222
提示信息如下：
--------------------------------------------------------------------------------------
Microsoft (R) Windows 2000 (TM) 版本 5.00 (內(nèi)部版本號(hào) 2195)
歡迎使用 Microsoft Telnet Client
Telnet Client 內(nèi)部版本號(hào) 5.00.99206.1
Escape 字符為 ‘CTRL+]‘
您將要發(fā)送密碼信息到 Internet 區(qū)域中的遠(yuǎn)程計(jì)算機(jī)。這可能不安全。是否還要發(fā)送(y/n):
--------------------------------------------------------------------------------------
輸入y
然后發(fā)現(xiàn)a已經(jīng)telnet到b了
第三種情況： ms sql server
一般來(lái)說(shuō)大家都是通過(guò)使用sql server的身份驗(yàn)證來(lái)遠(yuǎn)程連接的。而這種情況下，當(dāng)你選擇windows身份驗(yàn)證呢，你會(huì)發(fā)現(xiàn)可以連接上去。打開(kāi)你的查詢(xún)分析器驗(yàn)證一下，的確可以。
二 原理分析
上面似乎都繞過(guò)了身份驗(yàn)證的過(guò)程，實(shí)際上并不是這樣子的。先看看windows ntlm身份驗(yàn)證的機(jī)制。以共享為例，具體的方法是這樣的：
1、客戶(hù)端<--------------------建立TCP連接----------------->服務(wù)端
2、客戶(hù)端-------客戶(hù)端類(lèi)型、支持的服務(wù)方式列表等----------->服務(wù)端
3、客戶(hù)端<------服務(wù)器支持協(xié)議、認(rèn)證方式、加密用的key等-----服務(wù)端
4、客戶(hù)端--------------用戶(hù)名、加密后密碼----------------->服務(wù)端
5、客戶(hù)端<---------------認(rèn)證成功否-----------------------服務(wù)端
簡(jiǎn)單解釋一下上面的ntlm機(jī)制的驗(yàn)證過(guò)程：
微軟采用NTLM機(jī)制：如在一個(gè)NT域中，客戶(hù)機(jī)登錄域服務(wù)器時(shí)，首先由服務(wù)器向客戶(hù)端發(fā)送一段隨機(jī)值，客戶(hù)端用自己密碼的散列函數(shù)對(duì)這個(gè)隨機(jī)值進(jìn)行混編并返還給服務(wù)器，服務(wù)器由本地的SAM數(shù)據(jù)庫(kù)中讀取該用戶(hù)的密碼散列函數(shù)對(duì)它發(fā)出的隨機(jī)值進(jìn)行混編，最后把兩個(gè)結(jié)果進(jìn)行比較，如果相同，即認(rèn)證通過(guò)。
這是一個(gè)普遍的過(guò)程，實(shí)際上以上三個(gè)例子都同樣實(shí)現(xiàn)了這樣的一個(gè)過(guò)程，只不過(guò)由于身份驗(yàn)證機(jī)制中一個(gè)缺陷，導(dǎo)致出現(xiàn)了上面的三種特殊的情形。WIN9X、WINNT、WIN2000在這有個(gè)缺陷，不經(jīng)過(guò)提示等就把當(dāng)前用戶(hù)名，密碼加密后發(fā)過(guò)去了。也就是在上面的第四步中發(fā)送的是客戶(hù)端的加密后的用戶(hù)名和密碼。
在我們上面的幾個(gè)具體的例子中間，過(guò)程如下：
a和b建立tcp連接，然后a把客戶(hù)端類(lèi)型、支持的服務(wù)方式列表等發(fā)送給b,b然后將服務(wù)器支持協(xié)議、認(rèn)證方式、加密用的key等發(fā)送給a,a自動(dòng)就把當(dāng)前用戶(hù)名，密碼加密后發(fā)過(guò)去了。和b的SAM數(shù)據(jù)庫(kù)中（經(jīng)過(guò)一系列處理后的值）的進(jìn)行比較，兩者一樣。認(rèn)證成功。
三 對(duì)sql連接的詳細(xì)分析
通過(guò)網(wǎng)絡(luò)協(xié)議分析工具iris，設(shè)定為截獲在兩計(jì)算機(jī)間所有的分組。我們發(fā)現(xiàn)與服務(wù)器的連接全部是通過(guò)與1433端口的通信所實(shí)現(xiàn)的。實(shí)際操作中曾發(fā)現(xiàn)有137udp端口的分組，但是本人通過(guò)ipsec過(guò)濾137后，發(fā)現(xiàn)同樣可以連接。注：137udp是用來(lái)提供netbios名字服務(wù)的。
總共得到了81個(gè)分組，下面只列出與
=============================================================
客戶(hù)端-------客戶(hù)端類(lèi)型、支持的服務(wù)方式列表等----------->服務(wù)端
=============================================================
No: 6
Timestamp: 16:22:29:984
MAC source address: 00:50:BF:2A:40:64
MAC dest address: 00:09:7B:51:BB:FC
Frame. type: IP
Protocol: TCP->1042
Source IP address: awen
Dest IP address: FLDserver
Source port: 1042
Destination port: 1433
SEQ: 3106511279
ACK: 2759799333
Packet size: 241
Packet data:
0000: 00 09 7B 51 BB FC 00 50 BF 2A 40 64 08 00 45 00 ..{Q...P.*@d..E.
0010: 00 E3 07 28 40 00 80 06 39 DC AC 11 01 BC D3 41 ...(@...9......A
0020: 38 02 04 12 05 99 B9 29 99 AF A4 7F 32 25 50 18 8......)....2%P.
0030: FA CB 47 2D 00 00 10 01 00 BB 00 00 01 00 B3 00 ..G-............
0040: 00 00 01 00 00 71 00 00 00 00 00 00 00 07 C8 04 .....q..........
0050: 00 00 00 00 00 00 E0 83 00 00 20 FE FF FF 04 08 .......... .....
0060: 00 00 56 00 00 00 00 00 00 00 00 00 00 00 56 00 ..V...........V.
0070: 09 00 68 00 0B 00 00 00 00 00 7E 00 04 00 86 00 ..h.............
0080: 00 00 86 00 00 00 00 50 BF 2A 40 64 86 00 2D 00 .......P.*@d..-.
0090: B3 00 00 00 53 00 51 00 4C 00 20 00 E5 67 E2 8B ....S.Q.L. ..g..
00A0: 06 52 90 67 68 56 32 00 31 00 31 00 2E 00 36 00 .R.ghV2.0.2...5.
00B0: 35 00 2E 00 35 00 36 00 2E 00 32 00 4F 00 44 00 8...5.6...2.O.D.
00C0: 42 00 43 00 4E 54 4C 4D 53 53 50 00 01 00 00 00 B.C.NTLMSSP.....
00D0: 07 B2 00 A0 09 00 09 00 24 00 00 00 04 00 04 00 ........$.......
00E0: 20 00 00 00 41 57 45 4E 57 4F 52 4B 47 52 4F 55 ...AWENWORKGROU
00F0: 50 P
============================================================
客戶(hù)端<------服務(wù)器支持協(xié)議、認(rèn)證方式、加密用的key等-----服務(wù)端
============================================================
No: 7
Timestamp: 16:22:29:984
MAC source address: 00:09:7B:51:BB:FC
MAC dest address: 00:50:BF:2A:40:64
Frame. type: IP
Protocol: TCP->1042
Source IP address: FLDserver
Dest IP address: awen
Source port: 1433
Destination port: 1042
SEQ: 2759799333
ACK: 3106511466
Packet size: 223
Packet data:
0000: 00 50 BF 2A 40 64 00 09 7B 51 BB FC 08 00 45 00 .P.*@d..{Q....E.
0010: 00 D1 DE 1A 40 00 7E 06 64 FB D3 41 38 02 AC 11 ....@...d..A8...
0020: 01 BC 05 99 04 12 A4 7F 32 25 B9 29 9A 6A 50 18 ........2%.).jP.
0030: FA 01 C3 DC 00 00 04 00 00 A9 00 00 01 00 ED 9E ................
0040: 00 4E 54 4C 4D 53 53 50 00 02 00 00 00 12 00 12 .NTLMSSP........
0050: 00 30 00 00 00 05 82 82 A0 F2 D4 05 C1 C0 BC 45 .0.............E
0060: 95 00 00 00 00 00 00 00 00 5C 00 5C 00 42 00 00 .........\.\.B..
0070: 00 46 00 4C 00 44 00 53 00 45 00 52 00 56 00 45 .F.L.D.S.E.R.V.E
0080: 00 52 00 02 00 12 00 46 00 4C 00 44 00 53 00 45 .R.....F.L.D.S.E
0090: 00 52 00 56 00 45 00 52 00 01 00 12 00 46 00 4C .R.V.E.R.....F.L
00A0: 00 44 00 53 00 45 00 52 00 56 00 45 00 52 00 04 .D.S.E.R.V.E.R..
00B0: 00 12 00 66 00 6C 00 64 00 73 00 65 00 72 00 76 ...f.l.d.s.e.r.v
00C0: 00 65 00 72 00 03 00 12 00 66 00 6C 00 64 00 73 .e.r.....f.l.d.s
00D0: 00 65 00 72 00 76 00 65 00 72 00 00 00 00 00 .e.r.v.e.r.....
===========================================================
客戶(hù)端--------------用戶(hù)名、加密后密碼----------------->服務(wù)端
服務(wù)器的名稱(chēng)awen 用戶(hù)名為admin，后面是加密后的散列值
===========================================================
No: 8
Timestamp: 16:22:29:994
MAC source address: 00:50:BF:2A:40:64
MAC dest address: 00:09:7B:51:BB:FC
Frame. type: IP
Protocol: TCP->1042
Source IP address: awen
Dest IP address: FLDserver
Source port: 1042
Destination port: 1433
SEQ: 3106511466
ACK: 2759799502
Packet size: 200
Packet data:
0000: 00 09 7B 51 BB FC 00 50 BF 2A 40 64 08 00 45 00 ..{Q...P.*@d..E.
0010: 00 BA 07 2A 40 00 80 06 3A 03 AC 11 01 BC D3 41 ...*@...:......A
0020: 38 02 04 12 05 99 B9 29 9A 6A A4 7F 32 CE 50 18 8......).j..2.P.
0030: FA 22 35 0C 00 00 11 01 00 92 00 00 01 00 4E 54 ."5...........NT
0040: 4C 4D 53 53 50 00 03 00 00 00 18 00 18 00 5A 00 LMSSP.........Z.
0050: 00 00 18 00 18 00 72 00 00 00 08 00 08 00 40 00 ......r.......@.
0060: 00 00 0A 00 0A 00 48 00 00 00 08 00 08 00 52 00 ......H.......R.
0070: 00 00 00 00 00 00 8A 00 00 00 05 82 80 A0 41 00 ..............A.
0080: 57 00 45 00 4E 00 61 00 64 00 6D 00 69 00 6E 00 W.E.N.a.d.m.i.n.
0090: 41 00 57 00 45 00 4E 00 A3 58 1F 51 AF 9B 97 23 A.W.E.N..X.Q...#
00A0: 74 02 A0 3C 3D ED A7 02 31 CA C8 4F 1D F9 B1 78 t...=...1..O...x
00B0: 4E AB A5 C0 D1 13 D7 29 82 B8 4C 06 B0 AD 7D 03 N......)..L...}.
00C0: 1B 9E FF 2B 8B 4F 8A 64 ...+.O.d
===========================================================
驗(yàn)證通過(guò)
============================================================
No: 9
Timestamp: 16:22:30:014
MAC source address: 00:09:7B:51:BB:FC
MAC dest address: 00:50:BF:2A:40:64
Frame. type: IP
Protocol: TCP->1042
Source IP address: FLDserver
Dest IP address: awen
Source port: 1433
Destination port: 1042
SEQ: 2759799502
ACK: 3106511612
Packet size: 339
Packet data:
0000: 00 50 BF 2A 40 64 00 09 7B 51 BB FC 08 00 45 00 .P.*@d..{Q....E.
0010: 01 45 DE 1B 40 00 7E 06 64 86 D3 41 38 02 AC 11 .E..@...d..A8...
0020: 01 BC 05 99 04 12 A4 7F 32 CE B9 29 9A FC 50 18 ........2..)..P.
0030: F9 6F C4 0D 00 00 04 01 01 1D 00 33 02 00 E3 1B .o.........3....
0040: 00 01 06 6D 00 61 00 73 00 74 00 65 00 72 00 06 ...m.a.s.t.e.r..
0050: 6D 00 61 00 73 00 74 00 65 00 72 00 AB 46 00 45 m.a.s.t.e.r..F.E
0060: 16 00 00 02 00 14 00 F2 5D 06 5C 70 65 6E 63 93 ........].\penc.
0070: 5E 0A 4E 0B 4E 87 65 39 65 3A 4E 20 00 27 00 6D ^.N.N.e9e:N .‘.m
0080: 00 61 00 73 00 74 00 65 00 72 00 27 00 02 30 09 .a.s.t.e.r.‘..0.
0090: 46 00 4C 00 44 00 53 00 45 00 52 00 56 00 45 00 F.L.D.S.E.R.V.E.
00A0: 52 00 00 00 00 E3 08 00 07 05 04 08 D0 00 00 00 R...............
00B0: E3 0B 00 02 04 80 7B 53 4F 2D 4E 87 65 00 AB 3A ......{SO-N.e..:
00C0: 00 47 16 00 00 01 00 0E 00 F2 5D 06 5C ED 8B 00 .G........].\...
00D0: 8A BE 8B 6E 7F 39 65 3A 4E 20 00 80 7B 53 4F 2D ...n.9e:N ..{SO-
00E0: 4E 87 65 02 30 09 46 00 4C 00 44 00 53 00 45 00 N.e.0.F.L.D.S.E.
00F0: 52 00 56 00 45 00 52 00 00 00 00 AD 36 00 01 07 R.V.E.R.....6...
0100: 01 00 00 16 4D 00 69 00 63 00 72 00 6F 00 73 00 ....M.i.c.r.o.s.
0110: 6F 00 66 00 74 00 20 00 53 00 51 00 4C 00 20 00 o.f.t. .S.Q.L. .
0120: 53 00 65 00 72 00 76 00 65 00 72 00 00 00 00 00 S.e.r.v.e.r.....
0130: 08 00 00 C2 E3 13 00 04 04 34 00 30 00 39 00 36 .........4.0.9.6
0140: 00 04 34 00 30 00 39 00 36 00 FD 00 00 00 00 00 ..4.0.9.6.......
0150: 00 00 00 ...
============================================================
四 對(duì)TELNET過(guò)程的分析
同樣是通過(guò)IRIS進(jìn)行分析，可以發(fā)現(xiàn)
============================================================
客戶(hù)端-------客戶(hù)端類(lèi)型、支持的服務(wù)方式列表等----------->服務(wù)端
============================================================
No: 9
Timestamp: 19:43:48:362
MAC source address: 00:50:BF:2A:40:64
MAC dest address: 00:09:7B:51:BB:FC
Frame. type: IP
Protocol: TCP-> TELNET
Source IP address: awen
Dest IP address: fldserver
Source port: 2255
Destination port: 23
SEQ: 1865769009
ACK: 1218937261
Packet size: 103
Packet data:
0000: 00 09 7B 51 BB FC 00 50 BF 2A 40 64 08 00 45 00 ..{Q...P.*@d..E.
0010: 00 59 B2 19 40 00 80 06 8F 74 AC 11 01 BC D3 41 .Y..@....t.....A
0020: 38 02 08 CF 00 17 6F 35 60 31 48 A7 81 AD 50 18 8.....o5`1H...P.
0030: FA D6 DC 15 00 00 FF FA 25 00 0F 00 00 20 00 00 ........%.... ..
0040: 00 02 00 00 00 4E 54 4C 4D 53 53 50 00 01 00 00 .....NTLMSSP....
0050: 00 97 82 08 E0 00 00 00 00 00 00 00 00 00 00 00 ................
0060: 00 00 00 00 00 FF F0 .......
========================================================
客戶(hù)端-------客戶(hù)端類(lèi)型、支持的服務(wù)方式列表等----------->服務(wù)端
=========================================================
No: 10
Timestamp: 19:43:48:462
MAC source address: 00:09:7B:51:BB:FC
MAC dest address: 00:50:BF:2A:40:64
Frame. type: IP
Protocol: TCP-> TELNET
Source IP address: fldserver
Dest IP address: awen
Source port: 23
Destination port: 2255
SEQ: 1218937261
ACK: 1865769058
Packet size: 229
Packet data:
0000: 00 50 BF 2A 40 64 00 09 7B 51 BB FC 08 00 45 00 .P.*@d..{Q....E.
0010: 00 D7 F7 84 40 00 7E 06 4B 8B D3 41 38 02 AC 11 ....@...K..A8...
0020: 01 BC 00 17 08 CF 48 A7 81 AD 6F 35 60 62 50 18 ......H...o5`bP.
0030: FA A4 1E B5 00 00 FF FA 25 02 0F 00 01 9E 00 00 ........%.......
0040: 00 02 00 00 00 4E 54 4C 4D 53 53 50 00 02 00 00 .....NTLMSSP....
0050: 00 12 00 12 00 30 00 00 00 15 82 8A E0 ED 83 37 .....0.........7
0060: 4B DD 44 1F 96 00 00 00 00 00 00 00 00 5C 00 5C K.D..........\.\
0070: 00 42 00 00 00 46 00 4C 00 44 00 53 00 45 00 52 .B...F.L.D.S.E.R
0080: 00 56 00 45 00 52 00 02 00 12 00 46 00 4C 00 44 .V.E.R.....F.L.D
0090: 00 53 00 45 00 52 00 56 00 45 00 52 00 01 00 12 .S.E.R.V.E.R....
00A0: 00 46 00 4C 00 44 00 53 00 45 00 52 00 56 00 45 .F.L.D.S.E.R.V.E
00B0: 00 52 00 04 00 12 00 66 00 6C 00 64 00 73 00 65 .R.....f.l.d.s.e
00C0: 00 72 00 76 00 65 00 72 00 03 00 12 00 66 00 6C .r.v.e.r.....f.l
00D0: 00 64 00 73 00 65 00 72 00 76 00 65 00 72 00 00 .d.s.e.r.v.e.r..
00E0: 00 00 00 FF F0 .....
================================================================
客戶(hù)端--------------用戶(hù)名、加密后密碼----------------->服務(wù)端
服務(wù)器的名稱(chēng)awen 用戶(hù)名為admin，后面是加密后的散列值
===============================================================
No: 11
Timestamp: 19:43:48:472
MAC source address: 00:50:BF:2A:40:64
MAC dest address: 00:09:7B:51:BB:FC
Frame. type: IP
Protocol: TCP-> TELNET
Source IP address: awen
Dest IP address: fldserver
Source port: 2255
Destination port: 23
SEQ: 1865769058
ACK: 1218937436
Packet size: 225
Packet data:
0000: 00 09 7B 51 BB FC 00 50 BF 2A 40 64 08 00 45 00 ..{Q...P.*@d..E.
0010: 00 D3 B2 1A 40 00 80 06 8E F9 AC 11 01 BC D3 41 ....@..........A
0020: 38 02 08 CF 00 17 6F 35 60 62 48 A7 82 5C 50 18 8.....o5`bH..\P.
0030: FA 27 6F 63 00 00 FF FA 25 00 0F 00 02 9A 00 00 .‘oc....%.......
0040: 00 02 00 00 00 4E 54 4C 4D 53 53 50 00 03 00 00 .....NTLMSSP....
0050: 00 18 00 18 00 5A 00 00 00 18 00 18 00 72 00 00 .....Z.......r..
0060: 00 08 00 08 00 40 00 00 00 0A 00 0A 00 48 00 00 .....@.......H..
0070: 00 08 00 08 00 52 00 00 00 10 00 10 00 8A 00 00 .....R..........
0080: 00 15 82 88 E0 41 00 57 00 45 00 4E 00 61 00 64 .....A.W.E.N.a.d
0090: 00 6D 00 69 00 6E 00 41 00 57 00 45 00 4E 00 68 .m.i.n.A.W.E.N.h
00A0: B6 54 08 3F 5F 5D A5 00 00 00 00 00 00 00 00 00 .T.?_]..........
00B0: 00 00 00 00 00 00 00 29 B6 96 5E FB 78 C1 1A 96 .......)..^.x...
00C0: EC 11 A7 D4 D5 1A CC 72 D2 1A 98 61 3C 8E DA 51 .......r...a...Q
00D0: 08 28 F8 1C F9 77 8F 4A 41 32 94 3B 9E 97 42 FF .(...w.JA2.;..B.
00E0: F0 .
=============================================================
驗(yàn)證通過(guò)
=============================================================
No: 16
Timestamp: 19:43:48:853
MAC source address: 00:09:7B:51:BB:FC
MAC dest address: 00:50:BF:2A:40:64
Frame. type: IP
Protocol: TCP-> TELNET
Source IP address: fldserver
Dest IP address: awen
Source port: 23
Destination port: 2255
SEQ: 1218937454
ACK: 1865769242
Packet size: 609
Packet data:
0000: 00 50 BF 2A 40 64 00 09 7B 51 BB FC 08 00 45 00 .P.*@d..{Q....E.
0010: 02 53 F7 87 40 00 7E 06 4A 0C D3 41 38 02 AC 11 .S..@...J..A8...
0020: 01 BC 00 17 08 CF 48 A7 82 6E 6F 35 61 1A 50 18 ......H..no5a.P.
0030: F9 EC 0A F5 00 00 1B 5B 31 3B 31 48 2A 3D 3D 3D .......[1;1H*===
0040: 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D ================
0050: 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D ================
0060: 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D ================
0070: 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 20 20 20 20 ============
0080: 20 20 20 20 20 20 20 20 20 20 20 20 1B 5B 32 3B .[2;
0090: 31 48 BB B6 D3 AD CA B9 D3 C3 20 4D 69 63 72 6F 1H........ Micro
00A0: 73 6F 66 74 20 54 65 6C 6E 65 74 20 B7 FE CE F1 soft Telnet ....
00B0: C6 F7 A1 A3 20 20 20 20 20 20 20 20 20 20 20 20 ....
00C0: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00D0: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00E0: 20 20 1B 5B 33 3B 31 48 2A 3D 3D 3D 3D 3D 3D 3D .[3;1H*=======
00F0: 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D ================
0100: 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D ================
0110: 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D ================
0120: 3D 3D 3D 3D 3D 3D 3D 3D 20 20 20 20 20 20 20 20 ========
0130: 20 20 20 20 20 20 20 20 1B 5B 34 3B 31 48 43 3A .[4;1HC:
0140: 5C 3E 20 20 20 20 20 20 20 20 20 20 20 20 20 20 \.
0150: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
0160: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
0170: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
0180: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 1B 5B .[
0190: 35 3B 31 48 1B 5B 4B 1B 5B 36 3B 31 48 1B 5B 4B 5;1H.[K.[6;1H.[K
01A0: 1B 5B 37 3B 31 48 1B 5B 4B 1B 5B 38 3B 31 48 1B .[7;1H.[K.[8;1H.
01B0: 5B 4B 1B 5B 39 3B 31 48 1B 5B 4B 1B 5B 31 30 3B [K.[9;1H.[K.[10;
01C0: 31 48 1B 5B 4B 1B 5B 31 31 3B 31 48 1B 5B 4B 1B 1H.[K.[11;1H.[K.
01D0: 5B 31 32 3B 31 48 1B 5B 4B 1B 5B 31 33 3B 31 48 [12;1H.[K.[13;1H
01E0: 1B 5B 4B 1B 5B 31 34 3B 31 48 1B 5B 4B 1B 5B 31 .[K.[14;1H.[K.[1
01F0: 35 3B 31 48 1B 5B 4B 1B 5B 31 36 3B 31 48 1B 5B 5;1H.[K.[16;1H.[
0200: 4B 1B 5B 31 37 3B 31 48 1B 5B 4B 1B 5B 31 38 3B K.[17;1H.[K.[18;
0210: 31 48 1B 5B 4B 1B 5B 31 39 3B 31 48 1B 5B 4B 1B 1H.[K.[19;1H.[K.
0220: 5B 32 30 3B 31 48 1B 5B 4B 1B 5B 32 31 3B 31 48 [20;1H.[K.[21;1H
0230: 1B 5B 4B 1B 5B 32 32 3B 31 48 1B 5B 4B 1B 5B 32 .[K.[22;1H.[K.[2
0240: 33 3B 31 48 1B 5B 4B 1B 5B 32 34 3B 31 48 1B 5B 3;1H.[K.[24;1H.[
0250: 4B 1B 5B 32 35 3B 31 48 1B 5B 4B 1B 5B 34 3B 35 K.[25;1H.[K.[4;5
0260: 48 H
================================================================
發(fā)布人:徐子陵