-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathPart_2.txt
8353 lines (8260 loc) · 683 KB
/
Part_2.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Part 2. Archived on 1/3/2018
Original Link: http://depastedihrn3jtw.onion.link/show.php?md5=ee7136ac48fa59fba803b9fbcbc6d7b9
12/23/17
___ _ _
|_ _|_ __ | |_ ___ _ __ _ __ ___| |_
| || '_ \| __/ _ \ '__| '_ \ / _ \ __|
| || | | | || __/ | | | | | __/ |_
|___|_| |_|\__\___|_| |_| |_|\___|\__|
____ _ _ _
/ ___| |__ ___ _ __ ___ ___ | |_| |__ ___ _ __ __ _ _ __ _ _
| | | '_ \ / _ \ '_ ` _ \ / _ \| __| '_ \ / _ \ '__/ _` | '_ \| | | |
| |___| | | | __/ | | | | | (_) | |_| | | | __/ | | (_| | |_) | |_| |
\____|_| |_|\___|_| |_| |_|\___/ \__|_| |_|\___|_| \__,_| .__/ \__, |
|_| |___/
PART 2
Lessons from the Rogers Hi-Speed Internet incident
by Dr Cyborkian a.k.a. janit0r - conditioner of 'terminally ill' devices
--[ 1 - Foreword
Internet Chemotherapy was a 13 month project between Nov 2016 - Dec 2017.
On 12/10 I posted a summary of the project which eventually reached most
of the people that I wanted to inform. The summary also sparked some
interest in the project so I've decided to write a little more about
specific issues and incidents which I consider to be informative. I also
intend to discuss strategies and techniques.
Over the past 2 years I have collected over 94 gigabytes worth of device
transaction logs and ISP configurations. The dataset has allowed me to
examine various malware events more closely and there are some important
lessons to be learned from the mistakes that different ISPs have made.
The dataset also allows me to fact-check dangerous misconceptions such as
sinkholing botnet C2s being an effective strategy for mitigating
vulnerable IoT device threats (which was most recently claimed with the
Mirai/Satori event). My spare time is limited and I can't promise any
specific release schedule but I will write as quickly as I can. I will
try to avoid writing about large-scale incidents involving US ISPs and
telcos in order to reduce the risk of me being 'Seth Riched' but luckily
important lessons can be presented with examples from other English-
speaking countries.
The most important overall argument I want to make is that consumer ISPs
are currently a significantly underestimated factor in the unfolding IoT
security disaster. There are many reasons for our collective blind spot.
For one thing, large ISPs are often an important potential client or
partner for security researchers (and other ISPs) so you will generally
not see them outed in public for their mistakes. It's much easier to pin
the blame on far-away device manufacturers and the technically illiterate
end-users than to focus on the local gatekeepers that ultimately enable
hundreds of thousands of vulnerable devices to be plugged into the
Internet. To make matters worse, established consumer ISPs seem to have
fewer and fewer actual technical experts on board and rely increasingly
on device vendors and part-time consultants for solutions to any
unexpected problems (the real experts are gravitating towards working for
backbone providers). The end-result of this collective incompetence can
be readily found on services such as Shodan: large ISPs in most countries
are still negligent in the most rudimentary security step of filtering
CPE control ports from WAN access.
In this second part of my Internet Chemotherapy writeup I will focus more
closely on the Rogers Hi-Speed Internet (rogers.com) incident in January
2017 as it comes with a few informative lessons of its own. This was the
first genuine large-scale ISP takedown by my botnet in the IoT war of
2017 and it gave me a taste of things to come.
--[ 2 - The Rogers outage of January 2017
In the second half of January I had started to observe occasional devices
with unauthenticated BusyBox shells on port 2323 (in other words you
could just telnet to port 2323 and get a root shell) with a user account
called 'rogcesadmin' in their /etc/passwd. Since the number was at first
statistically insignificant I didn't spend much time looking into these
outliers.
By the 27th of January I noticed an increasing number of such backdoored
units and I decided to take a closer look at them to determine the cause
of the problem.
Running ps on one of the vulnerable devices showed a utelnetd process
with parameters that would normally exemplify a hacked device:
PID USER VSZ STAT COMMAND
4080 root 1744 S /sbin/utelnetd -p 2323 -l /bin/sh -d
However, the iptables setup of the devices painted a more complex
picture:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2323
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
BASIC_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
NORMAL_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
EXT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
OTHER_IF_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 192.168.100.1 udp dpts:161:162
DROP all -- 0.0.0.0/0 7.6.224.0/20
DROP all -- 192.168.0.0/24 7.6.224.0/20
ATOM_FORWARD_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
BASIC_FORWARD_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
NORMAL_FORWARD_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INVALID_PATH_CHK all -- 0.0.0.0/0 0.0.0.0/0
PUB_DMZ_FORWARD_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
PRIV_DMZ_FORWARD_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
INT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
DSLITE_TCP_MSS tcp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED
EXT_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
EXT_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
OTHER_IF_FORWARD_IN_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
OTHER_IF_FORWARD_OUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
guestNetwork all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain ATOM_FORWARD_CHAIN (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 192.168.254.254 tcp dpt:445
ACCEPT tcp -- 0.0.0.0/0 192.168.254.254 tcp dpt:139
ACCEPT udp -- 0.0.0.0/0 192.168.254.254 udp dpts:137:138
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain BASIC_FORWARD_CHAIN (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID
Chain BASIC_INPUT_CHAIN (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED
DROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID
ACCEPT all -- 0.0.0.0/0 224.0.0.0/24
Chain CONTENT_FILTER_CHAIN (1 references)
target prot opt source destination
Chain DSLITE_TCP_MSS (1 references)
target prot opt source destination
Chain EXT2INT_SERVICE_ACL_CHAIN (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain EXT_FORWARD_IN_CHAIN (1 references)
target prot opt source destination
IDS_FORWARD_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
EXT2INT_SERVICE_ACL_CHAIN all -- 0.0.0.0/0 20.20.20.0/24
MINIUPNPD all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain EXT_FORWARD_OUT_CHAIN (1 references)
target prot opt source destination
PORT_TRIGR_FORWARD_CHAIN tcp -- 0.0.0.0/0 0.0.0.0/0
PORT_TRIGR_FORWARD_CHAIN udp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain EXT_INPUT_CHAIN (1 references)
target prot opt source destination
TR069_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
IDS_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
REMOTE_MANAGEMENT_CHAIN tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW
REMOTE_MANAGEMENT_CHAIN udp -- 0.0.0.0/0 0.0.0.0/0 state NEW
PORT_INPUT_CHAIN tcp -- 0.0.0.0/0 0.0.0.0/0
PORT_INPUT_CHAIN udp -- 0.0.0.0/0 0.0.0.0/0
ICMP_INPUT_CHAIN icmp -- 0.0.0.0/0 0.0.0.0/0
VPN_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain FW_LEVEL_FORWARD_CHAIN (1 references)
target prot opt source destination
FW_LEVEL_FORWARD_SCHAIN all -- 192.168.0.0/24 0.0.0.0/0
FW_LEVEL_FORWARD_SCHAIN all -- 192.168.101.0/24 0.0.0.0/0
FW_LEVEL_FORWARD_SCHAIN all -- 192.168.102.0/24 0.0.0.0/0
FW_LEVEL_FORWARD_SCHAIN all -- 192.168.103.0/24 0.0.0.0/0
FW_LEVEL_FORWARD_SCHAIN all -- 192.168.104.0/24 0.0.0.0/0
FW_LEVEL_FORWARD_SCHAIN all -- 192.168.105.0/24 0.0.0.0/0
FW_LEVEL_FORWARD_SCHAIN all -- 192.168.106.0/24 0.0.0.0/0
FW_LEVEL_FORWARD_SCHAIN all -- 192.168.107.0/24 0.0.0.0/0
Chain FW_LEVEL_FORWARD_SCHAIN (8 references)
target prot opt source destination
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 LOG flags 0 level 4 prefix "[Firewall: Security_Level]"
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:113
LOG udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:113 LOG flags 0 level 4 prefix "[Firewall: Security_Level]"
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:113
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain ICMP_INPUT_CHAIN (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain IDS_FORWARD_CHAIN (1 references)
target prot opt source destination
IDS_ICMP_FLOOD icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW
IDS_SYN_FLOOD tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x02
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x00
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x3F
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x01
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x29
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x37
IDS_STEALTH_SCAN tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x03/0x03
IDS_STEALTH_SCAN tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x12/0x12
IDS_STEALTH_SCAN tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x12/0x12
IDS_STEALTH_SCAN tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags:! 0x17/0x02 state NEW
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain IDS_ICMP_FLOOD (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 15/sec burst 100
LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "[IDS:ICMP_FLOOD]"
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain IDS_INPUT_CHAIN (1 references)
target prot opt source destination
IDS_ICMP_FLOOD icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW
IDS_SYN_FLOOD tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x17/0x02
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x00
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x3F
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x01
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x29
IDS_XMAS_TREE tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x3F/0x37
IDS_STEALTH_SCAN tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x03/0x03
IDS_STEALTH_SCAN tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x12/0x12
IDS_STEALTH_SCAN tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags: 0x06/0x06
IDS_STEALTH_SCAN tcp -- 0.0.0.0/0 0.0.0.0/0 tcpflags:! 0x17/0x02 state NEW
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain IDS_STEALTH_SCAN (8 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[IDS:STEALTH_SCAN]"
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain IDS_SYN_FLOOD (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 15/sec burst 100
LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "[IDS:SYN_FLOOD]"
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain IDS_XMAS_TREE (10 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[IDS:XMAS_TREE]"
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain INT2EXT_SERVICE_ACL_CHAIN (1 references)
target prot opt source destination
INT2EXT_SERVICE_ACL_SCHAIN all -- 192.168.0.0/24 0.0.0.0/0
INT2EXT_SERVICE_ACL_SCHAIN all -- 192.168.101.0/24 0.0.0.0/0
INT2EXT_SERVICE_ACL_SCHAIN all -- 192.168.102.0/24 0.0.0.0/0
INT2EXT_SERVICE_ACL_SCHAIN all -- 192.168.103.0/24 0.0.0.0/0
INT2EXT_SERVICE_ACL_SCHAIN all -- 192.168.104.0/24 0.0.0.0/0
INT2EXT_SERVICE_ACL_SCHAIN all -- 192.168.105.0/24 0.0.0.0/0
INT2EXT_SERVICE_ACL_SCHAIN all -- 192.168.106.0/24 0.0.0.0/0
INT2EXT_SERVICE_ACL_SCHAIN all -- 192.168.107.0/24 0.0.0.0/0
Chain INT2EXT_SERVICE_ACL_SCHAIN (8 references)
target prot opt source destination
Chain INT_FORWARD_IN_CHAIN (8 references)
target prot opt source destination
PARENTAL_CONTROL_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
MAC_FILTER_FORWARD_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
CONTENT_FILTER_CHAIN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state ESTABLISHED
INT2EXT_SERVICE_ACL_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
PUB_LAN_ACL_CHAIN all -- 20.20.20.0/24 0.0.0.0/0
VPN_PASS_THROUGH_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
FW_LEVEL_FORWARD_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain INT_FORWARD_OUT_CHAIN (8 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain INT_INPUT_CHAIN (8 references)
target prot opt source destination
MAC_FILTER_INPUT_CHAIN all -- 0.0.0.0/0 0.0.0.0/0
LOCAL_MANAGEMENT_CHAIN tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain INVALID_PATH_CHK (1 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 10 LOG flags 0 level 4 prefix "INVALID_PATH:"
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain LOCAL_MANAGEMENT_CHAIN (1 references)
target prot opt source destination
LOCAL_MANAGEMENT_PORTFILTER tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
LOCAL_MANAGEMENT_PORTFILTER tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
LOCAL_MANAGEMENT_PORTFILTER tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:23
LOCAL_MANAGEMENT_PORTFILTER tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain LOCAL_MANAGEMENT_PORTFILTER (4 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain MAC_FILTER_FORWARD_CHAIN (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain MAC_FILTER_INPUT_CHAIN (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain MINIUPNPD (1 references)
target prot opt source destination
Chain NORMAL_FORWARD_CHAIN (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain NORMAL_INPUT_CHAIN (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8181
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:23
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2323
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain OTHER_IF_FORWARD_IN_CHAIN (1 references)
target prot opt source destination
Rogers and its supplier Hitron actually appeared to have relatively sane
filters for their CPEs. They had created a segmented management network
which should not normally have been accessible from the outside. In fact,
much of this setup would serve as a good starting point for the many ISPs
out there that are looking for inexpensive ways to improve their network
segmentation. The obvious main flaw of this iptables setup appears in the
first lines of the ruleset:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2323
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Somebody had inserted a rule to explicitly allow WAN access to the
backdoor on port 2323 followed by an allow-all rule. As this would've
been a chicken-and-egg problem for any outside attacker it seemed likely
that the 'attack' had been carried out by an insider or by somebody with
access to the Rogers management network.
It was at this point that I began to suspect that perhaps the
unauthenticated root shell wasn't a result of some 0-day or hack, but
instead a deliberate backdoor intended for debugging and testing
firmware that somehow inexplicably had ended up on the production
network. At least in my eyes there should have been no obvious WAN-side
attack vector against these devices.
Reviewing the scope of the problem it also became apparent that the flaw
wasn't specific to any particular kernel build or device model:
$ ./search.pl rogcesadmin /proc/version | sort | uniq
Linux version 2.6.39.3 (caojun@hitron.iptv) (gcc version 4.6.1 (Buildroot 2011.08) ) #1 PREEMPT Mon Oct 19 09:39:26 CST 2015
Linux version 2.6.39.3 (caojun@IPTV) (gcc version 4.6.1 (Buildroot 2011.08) ) #1 PREEMPT Mon Dec 7 16:13:59 CST 2015
Linux version 2.6.39.3 (caojun@IPTV) (gcc version 4.6.1 (Buildroot 2011.08) ) #1 PREEMPT Tue Nov 11 16:55:08 CST 2014
Linux version 2.6.39.3 (caojun@IPTV) (gcc version 4.6.1 (Buildroot 2011.08) ) #1 PREEMPT Wed Jun 22 11:18:06 CST 2016
Linux version 2.6.39.3-RG-g4239f6c1-TEST (xinwei@Niklaus) (gcc version 4.7.3 (Buildroot 2013.08.1) ) #1 PREEMPT Sat Oct 8 10:21:40 CST 2016
Linux version 2.6.39.3-RG-g47792eda-TEST (ljh@hitron.iptv) (gcc version 4.6.4 (Buildroot 2013.08.1) ) #1 PREEMPT Thu Apr 9 14:31:20 CST 2015
Linux version 2.6.39.3-RG-g4f17072f-TEST (ljh@hitron.iptv) (gcc version 4.6.4 (Buildroot 2013.08.1) ) #1 PREEMPT Thu May 19 09:34:52 CST 2016
Linux version 2.6.39.3-RG-g7e28d76b-TEST (ljh@hitron.iptv) (gcc version 4.6.4 (Buildroot 2013.08.1) ) #1 PREEMPT Thu Aug 20 11:14:05 CST 2015
Linux version 2.6.39.3-RG-gbba526c4-TEST (xinwei@Niklaus) (gcc version 4.6.1 (Buildroot 2011.08) ) #1 PREEMPT Fri Nov 7 18:30:17 CST 2014
Linux version 2.6.39.3-RG-gddcea699-TEST (hopezhu@Niklaus) (gcc version 4.7.3 (Buildroot 2013.08.1) ) #1 PREEMPT Thu Jun 4 18:06:02 CST 2015
Linux version 2.6.39.3-RG-ge0d8e6dc (xihaibo@HUS2) (gcc version 4.7.3 (Buildroot 2013.08.1) ) #1 PREEMPT Fri Jun 26 15:37:08 CST 2015
Linux version 3.12.14 (xinwei@Niklaus) (gcc version 4.7.3 (Buildroot 2013.08.1) ) #1 PREEMPT Mon Dec 26 10:26:00 CST 2016
By January 28th the number of vulnerable units suddenly increased
dramatically and thousands of new devices were under attack from Mirai
and other malware. A significant number were bricked by my botnet. Here's
one ps output sample collected from a vulnerable router on IP
99.235.89.71 at Jan 29 2017 21:23 UTC moments before it was bricked:
PID USER VSZ STAT COMMAND
1 root 1080 S init
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
5 root 0 SW [kworker/u:0]
6 root 0 SW [rcu_kthread]
7 root 0 SW< [khelper]
8 root 0 SW [irq/74-hw_mutex]
9 root 0 SW [sync_supers]
10 root 0 SW [bdi-default]
11 root 0 SW< [kblockd]
12 root 0 SW< [gPunitWorkqueue]
13 root 0 SW [irq/79-punit_in]
14 root 0 SW [kswapd0]
15 root 0 SW< [crypto]
29 root 0 SW [kspi_bitbang_0]
30 root 0 SW [kworker/u:1]
37 root 0 SW [irq/4-TI IIC]
38 root 0 SW [irq/77-mmc0]
40 root 0 SW [irq/9-serial]
41 root 0 SW [mmcqd/0]
60 root 0 RWN [irq/24-TX Compl]
66 root 0 SW [kjournald]
96 root 3060 S /usr/sbin/pcd -f /etc/scripts/dsdk.pcd -v -t 20 -e /
97 root 636 S /usr/sbin/sync_app_np_reboot
99 root 636 S /usr/sbin/ht_atom_event_dispatcher &
105 root 636 S /usr/sbin/watchdog_rt -t 10 /dev/watchdog -n
106 root 3192 S N /usr/sbin/logger --no-fork
107 root 11404 S /usr/sbin/gptimer --timer-tick=50
114 root 1084 S /usr/sbin/ht_buttond &
127 root 3088 S /usr/sbin/l2switchd
128 root 0 SW< [l2sm0_rx_wq]
129 root 0 SW [irq/28-l2sm0]
135 root 3108 S /usr/sbin/gim
144 root 1060 S klogd
167 root 856 S /sbin/ifconfig l2sd0 192.168.100.1 up && /usr/sbin/p
172 root 1064 S /bin/sh -c busybox /sbin/ifconfig l2sd0 192.168.100.
174 1 672 S /usr/sbin/portmap -f -l -i 192.168.254.253
175 root 3252 S /usr/sbin/rpc_management_server
177 root 1948 S /usr/sbin/syslogd -d
188 root 4176 S < /usr/sbin/cm_status
190 root 0 SW [irq/35-mpeg]
253 root 54000 S /usr/sbin/hal_event_mbox
254 root 54004 S /usr/sbin/hal_cmd_mbox
262 root 55856 S /usr/sbin/mlx -d DOCINT -n 7
263 root 0 SW [irq/72-DOCSIS M]
264 root 0 SW [irq/20-DOCSIS M]
265 root 0 SW [irq/22-DOCSIS M]
266 root 0 SW [irq/21-DOCSIS M]
267 root 0 SW [irq/23-DOCSIS P]
268 root 0 SW [irq/63-DOCSIS P]
269 root 54468 S /usr/sbin/hal_tuner_mgr
280 root 0 SW< [cni_rx_wq]
281 root 0 SW [irq/29-cniLow]
282 root 0 SW [irq/30-cniHigh]
298 root 54192 S /usr/sbin/ledd -c -i 500
300 root 55636 S /usr/sbin/qos_dsx_sm
301 root 56708 S /usr/sbin/dispatcher
304 root 56960 S /usr/sbin/docsis_mac_driver
309 root 844 S udhcpd /var/conf/udhcpd02.conf
311 root 844 S udhcpd /var/conf/udhcpd03.conf
315 root 844 S udhcpd /var/conf/udhcpd04.conf
361 root 844 S udhcpd /var/conf/udhcpd05.conf
370 root 54508 S /usr/sbin/downstream_manager 24 28
371 root 54508 S /usr/sbin/downstream_manager 23 27
372 root 54508 S /usr/sbin/downstream_manager 22 26
373 root 54508 S /usr/sbin/downstream_manager 21 25
374 root 54508 S /usr/sbin/downstream_manager 20 24
375 root 54508 S /usr/sbin/downstream_manager 19 23
376 root 54508 S /usr/sbin/downstream_manager 18 22
377 root 54508 S /usr/sbin/downstream_manager 17 21
378 root 54508 S /usr/sbin/downstream_manager 16 20
379 root 54508 S /usr/sbin/downstream_manager 15 19
380 root 54508 S /usr/sbin/downstream_manager 14 18
381 root 54508 S /usr/sbin/downstream_manager 13 17
382 root 54508 S /usr/sbin/downstream_manager 12 16
383 root 54508 S /usr/sbin/downstream_manager 11 15
384 root 54508 S /usr/sbin/downstream_manager 10 14
385 root 54508 S /usr/sbin/downstream_manager 9 13
386 root 54508 S /usr/sbin/downstream_manager 8 12
387 root 54508 S /usr/sbin/downstream_manager 7 11
388 root 54508 S /usr/sbin/downstream_manager 6 10
389 root 54508 S /usr/sbin/downstream_manager 5 9
390 root 54508 S /usr/sbin/downstream_manager 4 8
391 root 54508 S /usr/sbin/downstream_manager 3 7
392 root 54508 S /usr/sbin/downstream_manager 2 6
393 root 54508 S /usr/sbin/downstream_manager 1 5
413 root 60832 S /usr/sbin/router_evmgr
419 root 54976 S /usr/sbin/upstream_manager 1 32
420 root 54976 S /usr/sbin/upstream_manager 2 33
421 root 54976 S /usr/sbin/upstream_manager 3 34
423 root 54976 S /usr/sbin/upstream_manager 4 35
424 root 54976 S /usr/sbin/upstream_manager 5 36
425 root 54976 S /usr/sbin/upstream_manager 6 37
426 root 54976 S /usr/sbin/upstream_manager 7 38
427 root 54976 S /usr/sbin/upstream_manager 8 39
430 root 1536 S /usr/sbin/dbus-daemon --system
436 root 62624 S /usr/sbin/snmp_agent_cm -p /var/tmp/snmp_plugin.conf
437 root 55440 S /usr/sbin/bpi_auth
442 root 55180 S /usr/sbin/bpi_tek
443 root 5824 S /usr/sbin/bpi_sa_map
466 root 844 S udhcpd /var/conf/udhcpd06.conf
468 root 844 S udhcpd /var/conf/udhcpd07.conf
472 root 808 S improxy -c /var/conf/igmp.conf -p /var/run/igmp.pid
497 root 4104 S /usr/sbin/eventmgr_cm
540 root 1248 S starter
541 root 132m S /lib/strongswan/charon --use-syslog
554 root 57104 S /usr/sbin/docsis_mac_manager
625 root 0 RW [kworker/0:1]
694 root 0 SW< [l2sd0_rx_wq]
695 root 0 SWN [irq/27-l2sd0]
1040 root 56964 S /usr/sbin/dmg_provisioning
1051 root 1068 S /bin/sh
1132 root 4416 S /sbin/ti_udhcpc -i wan0 -plugin /lib/libdocsis_dhcp4
1249 root 1076 S crond
1321 root 0 SW [kworker/0:0]
1499 root 276 S {740balndo5df6bm} dpobopob2e0bvmjnm0lq
1500 root 276 S {740balndo5df6bm} dpobopob2e0bvmjnm0lq
1501 root 348 R {740balndo5df6bm} dpobopob2e0bvmjnm0lq
1530 root 2192 S /sbin/utelnetd -p 2323 -l /bin/sh -d
1840 root 1068 R ps
1978 root 276 S {2eead0gbh2qacu5} mndbpndbm0gb6lia
1979 root 276 S {2eead0gbh2qacu5} mndbpndbm0gb6lia
1980 root 348 R {2eead0gbh2qacu5} mndbpndbm0gb6lia
1982 root 0 SW [kworker/0:2]
2754 root 12196 S router_snmp_agent -c /etc/agent_gw.cnf -n
2836 root 1080 S init
2986 nobody 764 S utelnetd -l /bin/login
3059 root 660 S minissdpd -i 192.168.0.1
3061 nobody 10616 S hitron_cdm > /dev/null 2>&1
3062 root 2216 S dropbear
3356 root 10712 S ti_udhcpc -i erouter0 -plugin /lib/libplugin_router_
3486 root 8304 S wls_wpsapp
3548 root 8296 S ralink_oor_watchdog
3621 root 8908 S miniupnpd -f /var/conf/miniupnpd.conf
3859 root 336 R {2t0b80uhjm1vk86} pwpbbwpbdt0bb36nnjrk
3861 root 276 S {2t0b80uhjm1vk86} pwpbbwpbdt0bb36nnjrk
3862 root 336 R {2eead0gbh2qacu5} mndbpndbm0gb6lia
3863 root 276 S {2eead0gbh2qacu5} mndbpndbm0gb6lia
3864 root 336 R {740balndo5df6bm} dpobopob2e0bvmjnm0lq
3865 root 276 S {740balndo5df6bm} dpobopob2e0bvmjnm0lq
3971 root 276 S {2t0b80uhjm1vk86} pwpbbwpbdt0bb36nnjrk
3972 root 276 S {2t0b80uhjm1vk86} pwpbbwpbdt0bb36nnjrk
3973 root 348 R {2t0b80uhjm1vk86} pwpbbwpbdt0bb36nnjrk
4040 root 844 S udhcpd /var/conf/udhcpd00.conf
4067 root 844 S udhcpd /var/conf/udhcpd01.conf
As can be seen from the above ps sample the Rogers Hitron routers
provided fertile soil for IoT malware.
Then, on January 29th the carnage suddenly stopped. What had been a
steady flow of a few dozen bricked rogcesadmin units per minute suddenly
became zero, and the number remained zero. As it's highly unlikely that
the ISP could've rolled back the firmware on all of its devices in an
instant it's more likely that the ISP finally realized what was going on
and filtered port 2323 at the edge.
The incident raises some troubling questions:
* If Rogers realized that a huge number of its CPEs had been hacked, why
did it not warn its customers about it? The network stack of the Hitron
devices is powerful enough to fully jeopardize the safety of the end-
users in the wrong hands, and clearly the devices had been in the wrong
hands for at least 24-48 hours. If my botnet hadn't been there to brick
the compromised devices, how long would it have taken for the ISP to
notice anything was wrong? After ingress traffic to port 2323 was
filtered how many of the devices were still loaded with malware and for
how long?
* If the incident was caused (as I want to believe) as a result of a
debug configuration ending up in the production firmware build then it
raises some serious questions about the QA process used by Rogers and
its supplier Hitron for validating new firmwares before they are pushed
out to production. It raises questions about their overall commitment
to customer security. Even junior technicians should be aware of the
importance of build testing, and tools like nmap should be in the
toolbag of anybody who handles anything related to Internet hosting.
* An alternative and more terrifying explanation for the vulnerability is
that somebody managed to compromise the Rogers management network and
push out commands for enabling utelnetd and inserting iptables rules on
their CPEs en masse. The wide range of different devices affected by
the breach makes this seem like a possibility. At the time I dismissed
this possibility as the ISP itself claimed that the problem had been
caused by a bad firmware upgrade, but many subsequent ISP takedown
cases have led me to believe that consumer ISPs are often so clueless
about their networks and devices that they end up blaming their device
suppliers for issues that their support flowcharts don't cover.
Whatever the cause of the vulnerability, it's certain beyond reasonable
doubt that Rogers customers on modem models CGN3-ROG, CGN3-AMR, CGN3-ACR,
and CGN3-ACSMR were completely exposed to hackers for at least 24-48
hours and that the ISP was aware of this having occured. Surely there
could have been no other appropriate course of action for the ISP's
management than to warn all affected customers about the failure? Had I
been a bad guy I could've easily taken over the modems, sniffed their
traffic, carried out MITM attacks and spam campaigns, and compromised
customer LANs from the powerful position of having full control over the
default gateways. With appropriate stealth techniques it's not clear that
the ISP would've ever noticed the extent of the breach.
After the smoke settled unlucky Rogers customers took to social media to
complain about the situation and their archived messages give you some
idea of the extent of the outage. For example, Twitter user @allenmobile
wrote 'I wonder if the guy that killed 5 brands of @Rogers modems with a
bad firmware update lost his job, sounds like lots of people no Internet'
and Facebook user Siebolt Dykstra wrote 'Almost 24 hours now without
Internet, apparently due to an update that caused 25% of Rogers modem to
crash. So my neighbor has Internet, I don't. Thanks Rogers.'
Instead of warning these unlucky souls about them having been exposed to
malware Rogers support simply covered up the incident. Canadians deserve
more answers from their second-largest ISP about the incident and I hope
that they will demand more transparency and oversight of their ISP
industry. Rogers was by no means the only Canadian ISP to have been
negligent in this regard in 2017.
--[ 3 - MD5 hashes for a subset of Rogers routers
A part of my botnet collected as much data as possible about all
vulnerable devices that it encountered. This extended dataset gave me a
good overview of statistically significant device issues. For the Rogers
incident it also managed to collect a few thousand password hashes which
I'm including here (or as many as the paste service allows me to dump).
Cracking these hashes never became a priority for me as the Rogers
network should normally have been filtered from WAN access, but they may
offer some insight into Rogers' overall configuration for anyone who is
curious and has the spare hash cracking capacity. Interestingly there are
also a few dupes in the list.
$ ./search.pl --ip rogcesadmin /etc/passwd | grep "rogcesadmin" | sort | uniq
173.32.172.137:rogcesadmin:$1$UCJEjfPc$B3T1EwpQuKUrlEo./k2v5/:100:100::/:/usr/sbin/cli
173.35.74.122:rogcesadmin:$1$nCmxBA/M$vv/CDibuvVNAs9Vd3e12r1:100:100::/:/usr/sbin/cli
174.112.108.113:rogcesadmin:$1$l6rgbYwp$EzOGx/Dk6Cs0/Xg/5XjH9/:100:100::/:/usr/sbin/cli
174.112.145.168:rogcesadmin:$1$y4KpnIp4$HUr4hhS/Ng.mP7B1hQIgq/:100:100::/:/usr/sbin/cli
174.112.148.180:rogcesadmin:$1$zJsmcGwO$684Ch7UyFxoybNJEDflJq0:100:100::/:/usr/sbin/cli
174.112.98.70:rogcesadmin:$1$PNUWpSb5$v6t7nf7vmFFqd3DLvy0bR.:100:100::/:/usr/sbin/cli
174.113.136.243:rogcesadmin:$1$HtkMCFcZ$R3DIdjrZh9TNIf9AbHNfq/:100:100::/:/usr/sbin/cli
174.113.16.224:rogcesadmin:$1$700BFxjH$rxVZU80nE0swbgvIjcEdO0:100:100::/:/usr/sbin/cli
174.113.16.55:rogcesadmin:$1$tqzHSlbZ$nX3XGYk9DmwmAZLpeNG0D0:100:100::/:/usr/sbin/cli
174.113.181.120:rogcesadmin:$1$2j5.RPxx$aBaU/uCskps94h38KmBNN.:100:100::/:/usr/sbin/cli
174.113.182.192:rogcesadmin:$1$18kbayA.$DWCta2sZbFKn6yvWo73MB.:100:100::/:/usr/sbin/cli
174.113.237.101:rogcesadmin:$1$lpvfTdSH$mK0/9w6.hcWcMqozvHA6O0:100:100::/:/usr/sbin/cli
174.113.66.253:rogcesadmin:$1$dRLwq06m$ttAevaISX0aewLVQLfqUk0:100:100::/:/usr/sbin/cli
174.113.68.184:rogcesadmin:$1$awMK0/VB$zljrfQaUldWXJL9/5FKUj/:100:100::/:/usr/sbin/cli
174.113.69.162:rogcesadmin:$1$wsGf70Qk$5VsQYbiQN1KlQrcY4wIdo.:100:100::/:/usr/sbin/cli
174.114.10.228:rogcesadmin:$1$GGhbx8Qn$NC35xv1reeDji2vKYrM0r1:100:100::/:/usr/sbin/cli
174.114.116.0:rogcesadmin:$1$C3XwBDPx$lLFVB1XidBVztYrKDpRN40:100:100::/:/usr/sbin/cli
174.114.172.183:rogcesadmin:$1$s47X8mbw$7v7lMF1AEDXjg4vBhFPtT1:100:100::/:/usr/sbin/cli
174.114.181.29:rogcesadmin:$1$ifJKvQzw$i.UmCdwW49Uwy73vCnqV9.:100:100::/:/usr/sbin/cli
174.114.184.117:rogcesadmin:$1$Y/pdc2ex$bPMj1yJcnvodYOQeFYTBd/:100:100::/:/usr/sbin/cli
174.114.33.102:rogcesadmin:$1$1xra0Hue$0KNPH9ftRebX0V3Xhiq2d/:100:100::/:/usr/sbin/cli
174.114.42.15:rogcesadmin:$1$M8eNr5mB$R9Cps7bIGA.CdfMSUtiLR/:100:100::/:/usr/sbin/cli
174.114.50.208:rogcesadmin:$1$1rWHMtu5$tVQIudtyczqF2D1vcNU0S0:100:100::/:/usr/sbin/cli
174.114.55.171:rogcesadmin:$1$evI/mmLm$sawBBPE//kOUEGoBSj/6t.:100:100::/:/usr/sbin/cli
174.114.8.85:rogcesadmin:$1$WrP/d01t$Dh6KbZ1iEhD9EPrs3x1cO1:100:100::/:/usr/sbin/cli
174.115.120.48:rogcesadmin:$1$jEwsooYN$1hzYsG2FEIIFZ82ZMRllI1:100:100::/:/usr/sbin/cli
174.115.121.42:rogcesadmin:$1$IusFMjq6$lagc0oay24zRuQMCgXsHG/:100:100::/:/usr/sbin/cli
174.115.179.108:rogcesadmin:$1$PU3ikpai$OstyMqBaOn1VSjhTMNRX//:100:100::/:/usr/sbin/cli
174.115.179.110:rogcesadmin:$1$PN1B0qU0$Xom.fCXqwOm4nxrtr/NSL1:100:100::/:/usr/sbin/cli
174.115.181.250:rogcesadmin:$1$GOXujCwY$a6zVxmJ.bPKAfIMjEMBNj/:100:100::/:/usr/sbin/cli
174.115.185.40:rogcesadmin:$1$q//t3SIV$Z1vLyZtRo.x.zsOS2QiRu.:100:100::/:/usr/sbin/cli
174.115.188.254:rogcesadmin:$1$GFuDPnfe$n.LBAALogTReb1sTsIih00:100:100::/:/usr/sbin/cli
174.115.216.134:rogcesadmin:$1$IW1PSq2g$288dQe2jwEImHpQnmp3NB1:100:100::/:/usr/sbin/cli
174.115.219.238:rogcesadmin:$1$1u7oaisC$YQ1kfbVJnKLvsiuLATO.u0:100:100::/:/usr/sbin/cli
174.116.160.240:rogcesadmin:$1$3xh7FvwA$lSt/xIWMkhCsKMqB1LhZA0:100:100::/:/usr/sbin/cli
174.116.187.190:rogcesadmin:$1$LhOyLEfQ$/dBr5SzkZwQpg.q9UmQoQ1:100:100::/:/usr/sbin/cli
174.116.244.77:rogcesadmin:$1$ht02c7EV$5zZss07XXEGN1gpCBnBxI0:100:100::/:/usr/sbin/cli
174.116.68.21:rogcesadmin:$1$cIUn8IRo$RKR6LLa0rqglmR.izusn60:100:100::/:/usr/sbin/cli
174.117.109.213:rogcesadmin:$1$3jGF8qEf$Fo/l.6i12bLFrV/G3DiPR0:100:100::/:/usr/sbin/cli
174.117.114.234:rogcesadmin:$1$ArbZ4/Zs$3a3jW/hbBoQRIWgCXlEZc/:100:100::/:/usr/sbin/cli
174.117.131.14:rogcesadmin:$1$GNzQwQdZ$sScgCH1Z.0MEI3/NXPwLf.:100:100::/:/usr/sbin/cli
174.117.14.13:rogcesadmin:$1$aPOkphTi$OyhpXRqTvxnff8Ezqw2b9.:100:100::/:/usr/sbin/cli
174.117.147.163:rogcesadmin:$1$/D9BsbFa$poF3OhOAXVv46aDfz0m7z/:100:100::/:/usr/sbin/cli
174.117.2.178:rogcesadmin:$1$HrC2TxuE$mqsSZQks4bVhDVyddbd8S.:100:100::/:/usr/sbin/cli
174.117.36.176:rogcesadmin:$1$MXXxu1lE$3X.DAd59sZokXSwR1U80S0:100:100::/:/usr/sbin/cli
174.117.37.176:rogcesadmin:$1$6p/kGMku$DM0Z2/Apourj0rbmuO1741:100:100::/:/usr/sbin/cli
174.118.160.28:rogcesadmin:$1$KeX2atfV$viCpmmwDYAu3ckDW2hyA41:100:100::/:/usr/sbin/cli
174.118.201.240:rogcesadmin:$1$sIk8zKH.$UbcoObHxrOl2GkpJsuHEi1:100:100::/:/usr/sbin/cli
174.118.206.118:rogcesadmin:$1$N36E2XqA$CKjj7q7k4bgjp0QpNqukD0:100:100::/:/usr/sbin/cli
174.118.231.222:rogcesadmin:$1$e/sUWH.H$ju0C4J2kAipuKCtpZlG8l0:100:100::/:/usr/sbin/cli
174.118.236.221:rogcesadmin:$1$jfmHGVvQ$qMB7u31s6dknTvvZ5bat/1:100:100::/:/usr/sbin/cli
174.118.238.154:rogcesadmin:$1$pZO05Yby$Sz/dO8hme1TlJlkSfwP4c1:100:100::/:/usr/sbin/cli
174.118.244.109:rogcesadmin:$1$P6OBJ7UC$4JirLHKxWbr2OObZ6coOT0:100:100::/:/usr/sbin/cli
174.118.244.252:rogcesadmin:$1$Y2gDchDf$LIfMgNOPjgTBP.ErzwCrt0:100:100::/:/usr/sbin/cli
174.118.254.182:rogcesadmin:$1$7DzF34dE$Rtlg9Gamb5Jk2BeOd5lVA.:100:100::/:/usr/sbin/cli
174.119.0.200:rogcesadmin:$1$2d5h2fC1$KUJNEazYkwIA7W.Yqv4nl.:100:100::/:/usr/sbin/cli
174.119.15.164:rogcesadmin:$1$kANUzrLi$CePZi9SOpj1H7.yLZtbnq1:100:100::/:/usr/sbin/cli
174.119.17.170:rogcesadmin:$1$BWwLcV36$YoJOlVkQhZCu9xhuU.zkR/:100:100::/:/usr/sbin/cli
174.119.210.172:rogcesadmin:$1$gXdx3uLZ$GXeqNQl9WZn.9xCyF2AaN.:100:100::/:/usr/sbin/cli
174.119.212.80:rogcesadmin:$1$CxbHg1ny$WAzqQBUKmHA831qPkCsVO/:100:100::/:/usr/sbin/cli
174.119.215.192:rogcesadmin:$1$7Rf3txcP$Xjp4RfJFopxJHYfAAUq671:100:100::/:/usr/sbin/cli
174.119.221.136:rogcesadmin:$1$Wq0yw4WJ$qFZz7BLUKMhzx1ENnDgdN1:100:100::/:/usr/sbin/cli
174.119.229.203:rogcesadmin:$1$k1EO4pkz$sLk7sr5BrVRFE5xWLN8eC/:100:100::/:/usr/sbin/cli
174.119.23.234:rogcesadmin:$1$H/iorchx$ZyS6pX5J3XeplVlPrbC041:100:100::/:/usr/sbin/cli
174.119.27.243:rogcesadmin:$1$.AKxo/DK$OHObeGeLEMhvxdMBvm7s9.:100:100::/:/usr/sbin/cli
99.224.104.42:rogcesadmin:$1$nZLG8Lr3$H0ukaMQd8BdY2b67WwcyG1:100:100::/:/usr/sbin/cli
99.224.107.11:rogcesadmin:$1$dkEGH.m7$o2assa5AWxiAxtTSMYcPr/:100:100::/:/usr/sbin/cli
99.224.108.116:rogcesadmin:$1$GUrkZfW1$6tZmm9hd5KIdUcFXpOiyU/:100:100::/:/usr/sbin/cli
99.224.112.155:rogcesadmin:$1$iEkSiylx$HCFbYErjUsKD2hUMxzZEB.:100:100::/:/usr/sbin/cli
99.224.120.150:rogcesadmin:$1$UVoJyqvt$1.wf1cvuz8EL02ZicyG7G0:100:100::/:/usr/sbin/cli
99.224.120.152:rogcesadmin:$1$OpT8jt3R$mE6JE04E.UmTzEM0mCPYx0:100:100::/:/usr/sbin/cli
99.224.120.198:rogcesadmin:$1$FGvGDT2K$USY7Hmrg8RJ6oKRA7tWAV/:100:100::/:/usr/sbin/cli
99.224.120.66:rogcesadmin:$1$92.LpxP6$hTsGznxC/8lIi3rvq3ch7.:100:100::/:/usr/sbin/cli
99.224.120.90:rogcesadmin:$1$YoOhMYpb$7bnGK/i52uI3bV7S/ooH20:100:100::/:/usr/sbin/cli
99.224.120.96:rogcesadmin:$1$PhVZAY0p$xyNVsvtIp7bm71ofCBFSZ1:100:100::/:/usr/sbin/cli
99.224.121.91:rogcesadmin:$1$LuMTDbrR$SInFWbg9w/LGw1/VLNjgx.:100:100::/:/usr/sbin/cli
99.224.122.120:rogcesadmin:$1$fl1s9qSr$I6floAP7KEnejswsNxHhf1:100:100::/:/usr/sbin/cli
99.224.122.217:rogcesadmin:$1$vTk4mSHp$ESlDlazIG/aqy7f7wKyQ81:100:100::/:/usr/sbin/cli
99.224.122.24:rogcesadmin:$1$ot3N0vp7$h8X.vcZ3UuAuOpz88WU680:100:100::/:/usr/sbin/cli
99.224.122.250:rogcesadmin:$1$Yl4vzhcX$nU8nLQrbv.4qUE5zW8ADh1:100:100::/:/usr/sbin/cli
99.224.122.252:rogcesadmin:$1$Kljl3Fc2$BV9HkdS0/qVGIa3PWLl.R0:100:100::/:/usr/sbin/cli
99.224.122.45:rogcesadmin:$1$VtM7XE1z$mEdJvvOz2u1FgztCxBUUU0:100:100::/:/usr/sbin/cli
99.224.122.77:rogcesadmin:$1$kUK3Bb/.$NwBDx2QE5UF3I8LhfF8Ki0:100:100::/:/usr/sbin/cli
99.224.123.45:rogcesadmin:$1$.4ekdbl8$vPKyr9YHDXqx8te1KvNY80:100:100::/:/usr/sbin/cli
99.224.123.5:rogcesadmin:$1$JjfAX/c8$/O8.SZkOmNZ4A1m4y299g/:100:100::/:/usr/sbin/cli
99.224.124.114:rogcesadmin:$1$d.hKDYbV$5o0FiWl06ETNstjs3fWT7.:100:100::/:/usr/sbin/cli
99.224.124.160:rogcesadmin:$1$fafMDGQR$Efat/JvrFprKFG1dKw9NW.:100:100::/:/usr/sbin/cli
99.224.124.213:rogcesadmin:$1$.64hhwwV$SwJcxRG.nRcAZJindRjQH1:100:100::/:/usr/sbin/cli
99.224.124.65:rogcesadmin:$1$hFafVr6k$yJYgNBAld3ZeWKFJxA1so.:100:100::/:/usr/sbin/cli
99.224.125.179:rogcesadmin:$1$DZCOgt6N$HoTfHH7fWT28bcHm5djNv0:100:100::/:/usr/sbin/cli
99.224.126.227:rogcesadmin:$1$41M4dRYV$kx8W3nhX1Ox1TGt/kh7X8.:100:100::/:/usr/sbin/cli
99.224.128.115:rogcesadmin:$1$gF.7FFJZ$DDD/o.UylYJEYlLZJvlMu1:100:100::/:/usr/sbin/cli
99.224.128.125:rogcesadmin:$1$nZVjOAM0$/8AoGtuWuzyXdIBkP5PP10:100:100::/:/usr/sbin/cli
99.224.129.75:rogcesadmin:$1$3wHG7Ocs$ArYZegPvGA5MBpPXreuGn.:100:100::/:/usr/sbin/cli
99.224.130.195:rogcesadmin:$1$nvuV9iqk$wrKdySo7KOXocogdvDAm30:100:100::/:/usr/sbin/cli
99.224.131.10:rogcesadmin:$1$RMBXWFmm$XL36D7pzpZ9IyAX4oElLM0:100:100::/:/usr/sbin/cli
99.224.134.221:rogcesadmin:$1$4w1lzHz9$ATUXUehuYe5cj9w4kivEh0:100:100::/:/usr/sbin/cli
99.224.140.175:rogcesadmin:$1$f9gwYyrV$1DH8Anc.bUMDgQyOjpFGw/:100:100::/:/usr/sbin/cli
99.224.140.235:rogcesadmin:$1$PQPWYGYF$entc386Vyy4JgIaUNy9nD0:100:100::/:/usr/sbin/cli
99.224.142.176:rogcesadmin:$1$0PPsQwL0$NYG/P/O1QXpOiWGHl190t.:100:100::/:/usr/sbin/cli
99.224.142.190:rogcesadmin:$1$tBwWif1w$9zcPOjZpHvb2qq6l0edWA/:100:100::/:/usr/sbin/cli
99.224.142.217:rogcesadmin:$1$fwOR4I9F$9xC3zKq14gt9Ds6teqi.30:100:100::/:/usr/sbin/cli
99.224.142.46:rogcesadmin:$1$IHwoHD9Q$iqiB.Rxf6Fv2d/RD3s5fh0:100:100::/:/usr/sbin/cli
99.224.144.237:rogcesadmin:$1$x1LHr9BN$Dbyyg5A2JJH0JfFBpdM0o/:100:100::/:/usr/sbin/cli
99.224.148.156:rogcesadmin:$1$Xd9djytN$R2jlNROuE1FVncMlKGn.o.:100:100::/:/usr/sbin/cli
99.224.149.23:rogcesadmin:$1$.1HdUqHN$qEoOPYaEL3efLnvYoYcxP.:100:100::/:/usr/sbin/cli
99.224.149.38:rogcesadmin:$1$vr7G/c3c$22XJFJ1E9qomEo.agSfQT.:100:100::/:/usr/sbin/cli
99.224.149.72:rogcesadmin:$1$ojnG1HRM$bNcazBCfwfiFpR1/ungsL0:100:100::/:/usr/sbin/cli
99.224.151.153:rogcesadmin:$1$kk7mVu7m$SG6xERx0vaAHanzfJXzWA1:100:100::/:/usr/sbin/cli
99.224.169.142:rogcesadmin:$1$qIPGIGdE$AFS4HjF/agPK..KVssSZp.:100:100::/:/usr/sbin/cli
99.224.181.181:rogcesadmin:$1$onqJPn0q$WT84Cw1eRZm2NozNrb6S61:100:100::/:/usr/sbin/cli
99.224.184.143:rogcesadmin:$1$gEfFvoa.$4KWJeP1QhRmWtOQiQuDW.1:100:100::/:/usr/sbin/cli
99.224.184.198:rogcesadmin:$1$I35rsIRe$R78cRp5CpyEsHSYJBmu.20:100:100::/:/usr/sbin/cli
99.224.184.236:rogcesadmin:$1$EBM0Sfsz$kuyFMXuR.ws1YYrQa.28G0:100:100::/:/usr/sbin/cli
99.224.185.203:rogcesadmin:$1$sBwzOLON$f/x6nMCjSRuDBBDJYeBm/.:100:100::/:/usr/sbin/cli
99.224.185.235:rogcesadmin:$1$aPu1IHf9$u5JMPM412JH5DMlBBM7Rr.:100:100::/:/usr/sbin/cli
99.224.185.91:rogcesadmin:$1$Phfr35cG$3wtckpooQOScruSUFmq.x1:100:100::/:/usr/sbin/cli
99.224.185.95:rogcesadmin:$1$PX.tqvSL$y0zEXHrobhYQzFc3LFN2w/:100:100::/:/usr/sbin/cli
99.224.186.139:rogcesadmin:$1$lZHj2yen$Ov/prfOiYEShnWtM5Cvb2.:100:100::/:/usr/sbin/cli
99.224.186.235:rogcesadmin:$1$zjqO2i0t$JlQ1pw7M0hb0xZsSIrxZn0:100:100::/:/usr/sbin/cli
99.224.186.58:rogcesadmin:$1$ae.0i.0V$aZXvOzUWQR1/m7HCLZpRS1:100:100::/:/usr/sbin/cli
99.224.186.80:rogcesadmin:$1$Eneal8vb$.F5f4Knr0KdoIkuTmZXlO.:100:100::/:/usr/sbin/cli
99.224.187.109:rogcesadmin:$1$edbPhfyL$9bh7Bn8IYqjq5EdFeQGE50:100:100::/:/usr/sbin/cli
99.224.187.118:rogcesadmin:$1$NyT9F/8R$4DwmyP1.qWnG9ZwjiYHYy.:100:100::/:/usr/sbin/cli
99.224.187.233:rogcesadmin:$1$ffiqppuG$mCWar43zqCWstRXuYszti0:100:100::/:/usr/sbin/cli
99.224.188.153:rogcesadmin:$1$ot5spify$iRtDYrrqH5sag3g7eEloJ0:100:100::/:/usr/sbin/cli
99.224.188.193:rogcesadmin:$1$dEjvJajg$TV.x.HpkWiVKG2SiFT6dt1:100:100::/:/usr/sbin/cli
99.224.189.109:rogcesadmin:$1$OdWvf8H3$qOTtx4dCSI8zbL3hwTM8I.:100:100::/:/usr/sbin/cli
99.224.189.157:rogcesadmin:$1$9lIptFAW$FSDYlOwglnr2PzG9RMjmD0:100:100::/:/usr/sbin/cli
99.224.189.198:rogcesadmin:$1$99aPQ/OM$gdtVsrHxP74uUAJBjYalj1:100:100::/:/usr/sbin/cli
99.224.189.199:rogcesadmin:$1$ZgJYSYy9$Z69MrfpXsDOWvvv52K0T9/:100:100::/:/usr/sbin/cli
99.224.189.218:rogcesadmin:$1$Db/20tH9$SmtQJ47pHDhhed788G6Q91:100:100::/:/usr/sbin/cli
99.224.189.51:rogcesadmin:$1$Uz3tXVbC$2.EGNDA5j2yn6TXxIm.JM.:100:100::/:/usr/sbin/cli
99.224.190.140:rogcesadmin:$1$937vJeij$Z/nn1Fxl7OBDLWTw8MFUd1:100:100::/:/usr/sbin/cli
99.224.190.190:rogcesadmin:$1$l9q38G3p$URHnk5qphs7FcC9pJ5xT6/:100:100::/:/usr/sbin/cli
99.224.190.253:rogcesadmin:$1$rUFZXmQD$0DWszUVrFcYB5d/0QJUxv1:100:100::/:/usr/sbin/cli
99.224.190.26:rogcesadmin:$1$gZoH24QN$oo9tZniHt73I8Vrv.E.QY.:100:100::/:/usr/sbin/cli
99.224.190.46:rogcesadmin:$1$HN7JPYch$B59n7wuxiFTqGmGjxExuY/:100:100::/:/usr/sbin/cli
99.224.190.61:rogcesadmin:$1$.FcuPKBc$geuyUEU8TALuAsOL3mGUR1:100:100::/:/usr/sbin/cli
99.224.191.182:rogcesadmin:$1$v.B/2cxF$LW.YqJ7BWE1pKmepFl4R4/:100:100::/:/usr/sbin/cli
99.224.191.31:rogcesadmin:$1$1BmFGxTB$QYDh45LRjtatiIaqf/zM3.:100:100::/:/usr/sbin/cli
99.224.192.233:rogcesadmin:$1$MJaOZbBo$u1w43pR2pAPI8XAJogh5w/:100:100::/:/usr/sbin/cli
99.224.193.140:rogcesadmin:$1$cZhImBuP$Sh2jw6cEhZIFmpgIBojHB0:100:100::/:/usr/sbin/cli
99.224.193.154:rogcesadmin:$1$st/YErly$zSnzJnA2rWcYq9rdNOJR60:100:100::/:/usr/sbin/cli
99.224.193.164:rogcesadmin:$1$zrqGAdBy$dqd/wM3aJbYUmWJdgGVgF0:100:100::/:/usr/sbin/cli
99.224.193.89:rogcesadmin:$1$e5cDv060$X.l8zKl0w/UxpDmEMxore0:100:100::/:/usr/sbin/cli
99.224.194.104:rogcesadmin:$1$XPyCqvZI$GZldzPzlF/AZxQA.qS0TF1:100:100::/:/usr/sbin/cli
99.224.195.238:rogcesadmin:$1$vp89GWLG$lUQqulr.FzYHOzc6kpY2O0:100:100::/:/usr/sbin/cli
99.224.196.131:rogcesadmin:$1$ZgJYSYy9$Z69MrfpXsDOWvvv52K0T9/:100:100::/:/usr/sbin/cli
99.224.196.176:rogcesadmin:$1$fylb05QT$/WAwTA09fUQ3oCkfoaGVn/:100:100::/:/usr/sbin/cli
99.224.196.204:rogcesadmin:$1$KMuiSv8Z$XTWb7ivbEcb/tANZBRw1A1:100:100::/:/usr/sbin/cli
99.224.196.227:rogcesadmin:$1$0veQ9ADR$msYf71MBxgAk7jtOdaezd/:100:100::/:/usr/sbin/cli
99.224.196.42:rogcesadmin:$1$gbNuF2eH$sJUmqAWJRjw23GDolEyNE0:100:100::/:/usr/sbin/cli
99.224.198.181:rogcesadmin:$1$bXUETblR$lXFYE4QzJ61lAkCeOC75T1:100:100::/:/usr/sbin/cli
99.224.198.94:rogcesadmin:$1$M7TcgWME$.KTCVb6nnaf/Agi1uQoyr0:100:100::/:/usr/sbin/cli
99.224.199.16:rogcesadmin:$1$c1E1L.Ej$uzEDAW6zLa1SknEE8TtSG0:100:100::/:/usr/sbin/cli
99.224.199.217:rogcesadmin:$1$z92BXiU2$/AeMsSd/ifexjxg3ckCCj/:100:100::/:/usr/sbin/cli
99.224.199.233:rogcesadmin:$1$GpC5KPxN$k69n5SWd/TSs/Iq6Fi1dG/:100:100::/:/usr/sbin/cli
99.224.199.254:rogcesadmin:$1$/q1nZSsF$eqDw9wpVJEuhcKu5FR053/:100:100::/:/usr/sbin/cli
99.224.199.26:rogcesadmin:$1$k4xZ6tas$CK7X1xKpGeyrgbgwHmRYj.:100:100::/:/usr/sbin/cli
99.224.199.33:rogcesadmin:$1$Qdvsw3un$DR36Ka3gjMIFw9bhRPTFG/:100:100::/:/usr/sbin/cli
99.224.199.64:rogcesadmin:$1$k7nAHeRK$7cufWyA.VBGp6LYynVfXz/:100:100::/:/usr/sbin/cli
99.224.200.126:rogcesadmin:$1$xDRMkDH8$WhcUHzT7nxyLWdOaJUqql0:100:100::/:/usr/sbin/cli
99.224.200.131:rogcesadmin:$1$M17v7EDt$A8Eu7s6AJjUd234nHcn9s1:100:100::/:/usr/sbin/cli
99.224.200.202:rogcesadmin:$1$itJNL4kZ$7NeAi/e/cuB2rs4Dzxw6T/:100:100::/:/usr/sbin/cli
99.224.200.67:rogcesadmin:$1$6kAWqup8$Ozc2TkCYZrcTHf73xTbXg0:100:100::/:/usr/sbin/cli
99.224.201.149:rogcesadmin:$1$bjFbPP0Z$VqOB0B6f7pG2xrFDCz/WZ1:100:100::/:/usr/sbin/cli
99.224.201.46:rogcesadmin:$1$2oSGz6uQ$kvf8.ASPEP3/xYTf695o/0:100:100::/:/usr/sbin/cli
99.224.202.138:rogcesadmin:$1$IIcKAkJf$z3C8yoapC4EuxlSOKxGiL/:100:100::/:/usr/sbin/cli
99.224.202.171:rogcesadmin:$1$GvaDD7th$EFkKdujbnUG2fXxQF9sdC.:100:100::/:/usr/sbin/cli
99.224.202.197:rogcesadmin:$1$XQPS/cvR$juDqELyR1gE84Wcko3W/Z0:100:100::/:/usr/sbin/cli
99.224.202.61:rogcesadmin:$1$jOklX9m3$cW7jPGu86VdboAFP.ygyi/:100:100::/:/usr/sbin/cli
99.224.203.104:rogcesadmin:$1$ka9rFXKq$w/SkMJeyzq2/QVAJ.ag571:100:100::/:/usr/sbin/cli
99.224.204.128:rogcesadmin:$1$pwoU1wPn$mo8e8VhNcxPHuGY5GXajH.:100:100::/:/usr/sbin/cli
99.224.204.179:rogcesadmin:$1$6owD074v$G4nLNkqpWhyDtvJFZojFi/:100:100::/:/usr/sbin/cli
99.224.205.15:rogcesadmin:$1$T.82gdVd$X.nFiDtxWUi9VcSTvLXdz.:100:100::/:/usr/sbin/cli
99.224.205.2:rogcesadmin:$1$l4ezNwzA$viiOt6N6UgkOdTPxCrRgy1:100:100::/:/usr/sbin/cli
99.224.205.207:rogcesadmin:$1$l68VXiQT$rV5MjNTHbWGqrTmeoYrDX1:100:100::/:/usr/sbin/cli
99.224.205.49:rogcesadmin:$1$.4i8Mm7b$69fxtfX6AL3OSo1RMITcH0:100:100::/:/usr/sbin/cli
99.224.205.91:rogcesadmin:$1$syFZsCzT$E6QeNcITU.ex7tPa7VVrQ0:100:100::/:/usr/sbin/cli
99.224.206.153:rogcesadmin:$1$AgR5Jb3a$ob/wHYlXDi.tZBUrdN0Rm.:100:100::/:/usr/sbin/cli
99.224.206.193:rogcesadmin:$1$DX9cFqZs$XDurOgcjRZ1cKOl2buIsF1:100:100::/:/usr/sbin/cli
99.224.206.240:rogcesadmin:$1$.0OhaojQ$te85ld1bj7a0KFtkhjL5V/:100:100::/:/usr/sbin/cli
99.224.206.76:rogcesadmin:$1$X1/mN1qn$v0DrXScCJZG5c.xYlW1bk0:100:100::/:/usr/sbin/cli
99.224.207.177:rogcesadmin:$1$F3e6oEH8$SqPMcoRLGdSnPpcIAM4ih.:100:100::/:/usr/sbin/cli
99.224.207.237:rogcesadmin:$1$Jz9wVjkY$FJQp6BDzWA.b6r6pP1HHS/:100:100::/:/usr/sbin/cli
99.224.207.43:rogcesadmin:$1$CGDBi/LN$MM8gy8YWgobziGjzl8/Zd.:100:100::/:/usr/sbin/cli
99.224.210.175:rogcesadmin:$1$V2P0caO4$bpl5ifaWKMwhEZwUZRw5X0:100:100::/:/usr/sbin/cli
99.224.212.100:rogcesadmin:$1$SZ1YQ7Wz$JZzrhJYZI01r/p9bQASHJ/:100:100::/:/usr/sbin/cli
99.224.213.198:rogcesadmin:$1$/FoDiOco$hsZIaSfkDlPTLUlDJ2aEa.:100:100::/:/usr/sbin/cli
99.224.213.6:rogcesadmin:$1$HHmBIZpN$T0UsOEsAsiWQ7F.t3jNUO0:100:100::/:/usr/sbin/cli
99.224.215.218:rogcesadmin:$1$GRMl426l$3iLlLRxjSG82luvc0n9Z80:100:100::/:/usr/sbin/cli
99.224.215.25:rogcesadmin:$1$VJBUtVFC$6BSI6DxQxDjDn.vTX7NT6/:100:100::/:/usr/sbin/cli
99.224.219.61:rogcesadmin:$1$Wl3iyc0K$rHsNDDdkJQEZh2xRGA4rS/:100:100::/:/usr/sbin/cli
99.224.228.214:rogcesadmin:$1$NnXP0zMw$SQsgAITlVhU3ZDnnziMuF1:100:100::/:/usr/sbin/cli
99.224.229.3:rogcesadmin:$1$VGWqUADd$1WNIFwinQLpr2KGiJ6.yD/:100:100::/:/usr/sbin/cli
99.224.230.114:rogcesadmin:$1$Xw6w7470$UYv2HuOiHLFnPGC0.gnas/:100:100::/:/usr/sbin/cli
99.224.230.170:rogcesadmin:$1$VB8aS.tF$WwpyFGD9QRic7ukmWn0.g/:100:100::/:/usr/sbin/cli
99.224.230.7:rogcesadmin:$1$wlwg4VD5$7Vef5OjcS0CY4QRw9gJBX.:100:100::/:/usr/sbin/cli
99.224.231.140:rogcesadmin:$1$4TvR6c9F$7WXIdjVqw8q9AfTTseZeH/:100:100::/:/usr/sbin/cli
99.224.232.12:rogcesadmin:$1$dSJBgRgv$9pXWDTLLv3Ct7aSm0j.xx0:100:100::/:/usr/sbin/cli
99.224.232.241:rogcesadmin:$1$dlzI4RFZ$upbybCJsri54HX4MbJ5a4.:100:100::/:/usr/sbin/cli
99.224.233.131:rogcesadmin:$1$8JE1SxJL$m1gE9LsW8DopmbgsKSMt50:100:100::/:/usr/sbin/cli
99.224.234.80:rogcesadmin:$1$UUDZWGpY$oygtVZacvCBBO4vxlh/qP/:100:100::/:/usr/sbin/cli
99.224.235.134:rogcesadmin:$1$.LTo8vW3$TFyzJxejJ0ARrSTz4tDVJ0:100:100::/:/usr/sbin/cli
99.224.236.205:rogcesadmin:$1$H57evp4Y$p8Qv5VJwrueiGKCd3KfV71:100:100::/:/usr/sbin/cli
99.224.236.26:rogcesadmin:$1$ZuZ7Mhis$/zKfvQn1RgMqiyZrR8hXo0:100:100::/:/usr/sbin/cli
99.224.238.23:rogcesadmin:$1$VnfpTwiA$Ur6IlFJt/dRY2XBiOKJ.l1:100:100::/:/usr/sbin/cli
99.224.239.133:rogcesadmin:$1$phQD.O1l$CtyuoprrxtjrAPpPws4.y.:100:100::/:/usr/sbin/cli
99.224.239.244:rogcesadmin:$1$CYYJgW15$QuPVTJq0rF.KpwUuk8R.B/:100:100::/:/usr/sbin/cli
99.224.239.67:rogcesadmin:$1$TZY4uelO$l31PHHWNvzZ.KTxnOweE9/:100:100::/:/usr/sbin/cli
99.224.240.188:rogcesadmin:$1$nNdM1U/1$/oAMqCTifbqehrLOp4GNu0:100:100::/:/usr/sbin/cli
99.224.241.16:rogcesadmin:$1$cdhC5TS0$e3Z/wcUPLWWer/69VoNgV0:100:100::/:/usr/sbin/cli
99.224.241.165:rogcesadmin:$1$PbomyDMK$8cfDZ14uRscuGDHvQDfiD/:100:100::/:/usr/sbin/cli
99.224.241.17:rogcesadmin:$1$M8gjKpW0$pjkh4kkfbppesfoNjAvqi1:100:100::/:/usr/sbin/cli
99.224.242.151:rogcesadmin:$1$1UQNfw3r$rgiUnLHF0d6DN5TWe/lvi1:100:100::/:/usr/sbin/cli
99.224.245.119:rogcesadmin:$1$hsiljKGj$aJ56xyE2pvcJRaykYEnXh1:100:100::/:/usr/sbin/cli
99.224.245.218:rogcesadmin:$1$6mS.J/7C$.DmOhd3oIh6XtJ7vaYqpc1:100:100::/:/usr/sbin/cli
99.224.246.184:rogcesadmin:$1$dMQdmmZ8$9zBpGFeIqdtNfXQqITnyS/:100:100::/:/usr/sbin/cli
99.224.247.37:rogcesadmin:$1$r1mGbZdQ$LnXjboDn7rCw18tM9k7cX/:100:100::/:/usr/sbin/cli
99.224.248.162:rogcesadmin:$1$Xpl.mCqE$fY38PnixaeGiBs6wCPtX3/:100:100::/:/usr/sbin/cli
99.224.248.39:rogcesadmin:$1$pjw8VOQU$uBICCWoWSl3XMZeMDTUaM1:100:100::/:/usr/sbin/cli
99.224.249.115:rogcesadmin:$1$kFm/8JrH$7Y0rXYLE4pnSFOi0YNFaC/:100:100::/:/usr/sbin/cli
99.224.249.151:rogcesadmin:$1$YnpoNcmG$mL.hYaCr5GWJCtw8AmWGt0:100:100::/:/usr/sbin/cli
99.224.249.18:rogcesadmin:$1$Yhb8XSTv$8XQdmsJCbnRvbWKoDAd/m/:100:100::/:/usr/sbin/cli
99.224.250.146:rogcesadmin:$1$SBYv.5u6$w/scZ4/th6Jg4WldW38P80:100:100::/:/usr/sbin/cli
99.224.250.207:rogcesadmin:$1$0WqdMiao$u69bU4smwdc5KjgiT7rSR/:100:100::/:/usr/sbin/cli
99.224.250.255:rogcesadmin:$1$VKFpAs7T$Qxg/fa1ceaQrbVpooeWbf0:100:100::/:/usr/sbin/cli
99.224.251.176:rogcesadmin:$1$w3fKEF4s$VSA65hEi/GW.bTaDv0jIb1:100:100::/:/usr/sbin/cli
99.224.252.206:rogcesadmin:$1$gbqMvR2k$CGXL33bFdFJnAWmSK3cSc1:100:100::/:/usr/sbin/cli
99.224.254.184:rogcesadmin:$1$IFlKE/wE$0QtjVGf853YmENvYGcXb5.:100:100::/:/usr/sbin/cli
99.224.254.185:rogcesadmin:$1$0RhLDQ/R$JPLXi2CPHt0/dZ4spn23b0:100:100::/:/usr/sbin/cli
99.224.254.79:rogcesadmin:$1$ypAgBaOI$LlUigjM.fRZRMdwZp6qbm1:100:100::/:/usr/sbin/cli
99.224.255.189:rogcesadmin:$1$nPpMjQ1W$cterOhYk0yi1hi3dsYxXl0:100:100::/:/usr/sbin/cli
99.224.40.243:rogcesadmin:$1$ZEGog0mj$e.krnxqPJBLT7LpYuBZcl/:100:100::/:/usr/sbin/cli
99.224.40.92:rogcesadmin:$1$xI318tSC$amHkPAA8XMueiVzW45T5l0:100:100::/:/usr/sbin/cli
99.224.41.218:rogcesadmin:$1$UFGIWSHu$4hXNh.8DcNTmDa2KFYgLE1:100:100::/:/usr/sbin/cli
99.224.43.109:rogcesadmin:$1$dYwv2irW$Vl3QZBS3.ks.bVE3kLgeY1:100:100::/:/usr/sbin/cli
99.224.43.136:rogcesadmin:$1$geNLrkgO$VOOAwrwOoxmKjg5ZYzpS/0:100:100::/:/usr/sbin/cli
99.224.43.157:rogcesadmin:$1$yAx1eygl$YHigDUCjOT/msSJvmLcA10:100:100::/:/usr/sbin/cli
99.224.43.170:rogcesadmin:$1$7iTKH3ww$iYLyD9cATAbm9i8glHjwl0:100:100::/:/usr/sbin/cli
99.224.43.174:rogcesadmin:$1$zrHCd1La$rvPHI8ZHLCBLW9chmAqJ10:100:100::/:/usr/sbin/cli
99.224.43.203:rogcesadmin:$1$FgT1Sxbn$uPndlrAgaKWz4SdAfoS0o.:100:100::/:/usr/sbin/cli
99.224.43.225:rogcesadmin:$1$BvpZNC1q$zGjj/MPzG/sNRG6BRSPoK0:100:100::/:/usr/sbin/cli
99.224.43.56:rogcesadmin:$1$UKJuC2u4$zNtLtkWXEdXo4YsX5sMvH1:100:100::/:/usr/sbin/cli
99.224.44.253:rogcesadmin:$1$jTXxpHZZ$LXjBhz/ZqYbVCJI59pzNl.:100:100::/:/usr/sbin/cli
99.224.44.5:rogcesadmin:$1$s/KZ3rhO$ANMzEUvwl2JoxJ0ujug5G0:100:100::/:/usr/sbin/cli
99.224.45.171:rogcesadmin:$1$UDrnWLOb$jK7Yhz/kGr3QBwWTybdsd0:100:100::/:/usr/sbin/cli
99.224.45.18:rogcesadmin:$1$85KQIwC9$Ah03yHZvn0mo8pFnCvpjX.:100:100::/:/usr/sbin/cli
99.224.45.33:rogcesadmin:$1$lhgdl6HM$zd206nT/ype3U1G85aACj.:100:100::/:/usr/sbin/cli
99.224.45.43:rogcesadmin:$1$cUANqdMV$.Y/GOQ7VRRub8qNJQruWF1:100:100::/:/usr/sbin/cli
99.224.45.86:rogcesadmin:$1$lrmFz15K$vkvw/96.uL..Gbp1maTdI.:100:100::/:/usr/sbin/cli
99.224.46.114:rogcesadmin:$1$KgMWMSc2$mgfEill1pLynI/j2RrQPw1:100:100::/:/usr/sbin/cli
99.224.46.151:rogcesadmin:$1$sbzaHSjD$TOvb9rPOONURc.z2Hl99j/:100:100::/:/usr/sbin/cli
99.224.46.245:rogcesadmin:$1$h3/VWtPz$1IbRsvEFJYJoUmyLmx2kN/:100:100::/:/usr/sbin/cli
99.224.46.35:rogcesadmin:$1$LB4.z8oH$uGs0r8in2BOZq3FqwaeSh/:100:100::/:/usr/sbin/cli
99.224.46.8:rogcesadmin:$1$KCbHSVPx$rTAz5MclMnWWigj0WZUo11:100:100::/:/usr/sbin/cli
99.224.47.174:rogcesadmin:$1$Sa4MsTkw$EDpZ30R25XcMg60DiavIq.:100:100::/:/usr/sbin/cli
99.224.47.245:rogcesadmin:$1$EkREfwN.$Pk9aGjjmaAmSOXa4l4/Dr.:100:100::/:/usr/sbin/cli
99.224.47.27:rogcesadmin:$1$9DhKMHKb$dLJSyT0IJ8uP1mH3ZsZai/:100:100::/:/usr/sbin/cli
99.224.56.196:rogcesadmin:$1$/Gu3RL0d$JIxjtckphYV.0GY.VTX8q0:100:100::/:/usr/sbin/cli
99.224.57.78:rogcesadmin:$1$hCFqqk8Y$wMZLyFexargyxsJ7S867o0:100:100::/:/usr/sbin/cli
99.224.60.204:rogcesadmin:$1$D9Vkm9I1$jte3hM2WHfpxOp4Syay.N1:100:100::/:/usr/sbin/cli
99.224.80.139:rogcesadmin:$1$fHrkHBZj$Rlt5KuPdZrtP6iAYz9yzz.:100:100::/:/usr/sbin/cli
99.224.80.165:rogcesadmin:$1$Le.rZfgW$xrxrowCOoXo58AIonleAV0:100:100::/:/usr/sbin/cli
99.224.80.197:rogcesadmin:$1$bWqZN7pz$t7TG7TRlJTWK/hTXdpzbM/:100:100::/:/usr/sbin/cli
99.224.80.217:rogcesadmin:$1$WyS/gU9l$xZL89V6fexm1rOdCQayJJ1:100:100::/:/usr/sbin/cli
99.224.80.9:rogcesadmin:$1$E3iSN5Mk$ClmlJPKLmjqTE6q1AHwlj1:100:100::/:/usr/sbin/cli
99.224.81.127:rogcesadmin:$1$v5BIvadr$XbOOfj3JiQh7v5eh8n/Qb/:100:100::/:/usr/sbin/cli
99.224.81.136:rogcesadmin:$1$UX.8x5hW$tsYk8x8vmgk94KVYUNA32.:100:100::/:/usr/sbin/cli
99.224.81.145:rogcesadmin:$1$Y.0asOI0$..a4lf.oJFxR2Ri01neSo.:100:100::/:/usr/sbin/cli
99.224.81.182:rogcesadmin:$1$AP/lCDLh$JxBq6HdHPRV4geqlGidwB0:100:100::/:/usr/sbin/cli
99.224.81.225:rogcesadmin:$1$Mg0fUEr8$6iJBj0AtdioPbp4Xp1m.X0:100:100::/:/usr/sbin/cli
99.224.81.53:rogcesadmin:$1$I.MxUAzM$eIfYQlH5iQ2/C3/.V17zY0:100:100::/:/usr/sbin/cli
99.224.82.230:rogcesadmin:$1$hvjd2sFX$F6zV.ONDVBi8sVFcndYG10:100:100::/:/usr/sbin/cli
99.224.84.23:rogcesadmin:$1$Bbk3XMgv$F6IMqPQMMRcyhTUCl/kEL0:100:100::/:/usr/sbin/cli
99.224.84.64:rogcesadmin:$1$6o278i9Q$GET7spKSI8A5iHyoFCCNg1:100:100::/:/usr/sbin/cli
99.224.85.28:rogcesadmin:$1$Jf4Ls5.P$7eLWFLlffBPtoG2bUd0tO.:100:100::/:/usr/sbin/cli
99.224.86.108:rogcesadmin:$1$KTCy/u/I$D.Wr94so0j2GE8.tw39LX0:100:100::/:/usr/sbin/cli
99.224.86.113:rogcesadmin:$1$LYKbHT9j$U0E0x1uOQro94LwTcakbh.:100:100::/:/usr/sbin/cli
99.224.86.129:rogcesadmin:$1$kU1TSeOI$rfkjG1PtkU1rLr4KwuJA41:100:100::/:/usr/sbin/cli
99.224.86.180:rogcesadmin:$1$CPZiXqZQ$8.ILG9nK3Utru.dqYzVYw0:100:100::/:/usr/sbin/cli
99.224.86.240:rogcesadmin:$1$t8SzGGvh$lE7SlvHTiag7CjVyPPoTJ.:100:100::/:/usr/sbin/cli
99.224.86.249:rogcesadmin:$1$WrvTTu8p$A4E8CRsPA.ygmr88X54.C.:100:100::/:/usr/sbin/cli
99.224.87.50:rogcesadmin:$1$YqQp3rOR$Lko.TBq8lnnPdvWTmUgIM1:100:100::/:/usr/sbin/cli
99.224.88.21:rogcesadmin:$1$.lqRpAkf$9qBzXcQsXU2kYLob/h5YN.:100:100::/:/usr/sbin/cli
99.224.92.29:rogcesadmin:$1$pt6l24ry$wVv6uDmS3hTs00THoliLJ/:100:100::/:/usr/sbin/cli
99.225.108.27:rogcesadmin:$1$OF/u0pJd$M8A1mtSxzncd96xp5UUrQ1:100:100::/:/usr/sbin/cli
99.225.154.37:rogcesadmin:$1$D8y35aSR$owjywNtCsT0qwPnsgzzBC.:100:100::/:/usr/sbin/cli
99.225.155.134:rogcesadmin:$1$DKrr7u5F$VuMfSkTJuZtM.thBGpXfv.:100:100::/:/usr/sbin/cli
99.225.162.106:rogcesadmin:$1$trXf8MAy$NRaqLzjiQgzOwSskribRB1:100:100::/:/usr/sbin/cli
99.225.162.115:rogcesadmin:$1$NFJMfjnx$cxNxNqykNYqg0WmnX4UHP/:100:100::/:/usr/sbin/cli
99.225.162.67:rogcesadmin:$1$dLtl0vSS$pa3cSkjJHnJGEOO/f.5k61:100:100::/:/usr/sbin/cli
99.225.165.133:rogcesadmin:$1$gJYWPbrb$kn8.SCaPJfDdxRE1Q3Nnd/:100:100::/:/usr/sbin/cli
99.225.165.155:rogcesadmin:$1$5udUFWRC$EScG9lPMSBF.XHww0px2..:100:100::/:/usr/sbin/cli
99.225.165.253:rogcesadmin:$1$LQv57flL$m9EpGGaJNp7IrxOKeOQrj0:100:100::/:/usr/sbin/cli
99.225.165.54:rogcesadmin:$1$xd1.HPFk$baz00J91dZ2E0HXzgG1aG0:100:100::/:/usr/sbin/cli
99.225.166.128:rogcesadmin:$1$WOPHfs4d$YA4UR5JgiLp/sBeam474L.:100:100::/:/usr/sbin/cli
99.225.167.45:rogcesadmin:$1$s4d74gsD$/y3vTpCKPL8pucfXjj8Qw1:100:100::/:/usr/sbin/cli
99.225.177.165:rogcesadmin:$1$oqV2cuQe$3ewmIefimjqIENhCo68SL.:100:100::/:/usr/sbin/cli
99.225.185.75:rogcesadmin:$1$pntkGt/8$MAGsXcOYAtwsZKp/yNuoi0:100:100::/:/usr/sbin/cli
99.225.185.9:rogcesadmin:$1$oBEdw4Ei$EC9kqi4wQ4rYfXI9dQTSw0:100:100::/:/usr/sbin/cli
99.225.186.104:rogcesadmin:$1$kZdjKbvP$lqKFB0Uab5FHC0RaNSe0x0:100:100::/:/usr/sbin/cli
99.225.186.163:rogcesadmin:$1$6HRQSPZZ$zn8Z1ggxGYzvIfY7H0Suq.:100:100::/:/usr/sbin/cli
99.225.188.162:rogcesadmin:$1$UxqJR5bP$/75nR.ar3bir1VzBt2Oa31:100:100::/:/usr/sbin/cli
99.225.189.202:rogcesadmin:$1$bxqSQ20L$H/hunccNLvMqo/fULHA421:100:100::/:/usr/sbin/cli
99.225.193.107:rogcesadmin:$1$SMmwLQ3D$5FwVJtzDORrXvOvjalpFW.:100:100::/:/usr/sbin/cli
99.225.194.188:rogcesadmin:$1$R6v7gXrR$L2u1OZbvCRQosx.evE/FV0:100:100::/:/usr/sbin/cli
99.225.196.219:rogcesadmin:$1$XaXDGmjG$WIC8PE9R6AOaXpFnv78YL.:100:100::/:/usr/sbin/cli
99.225.197.161:rogcesadmin:$1$6XYvfgMW$.EzK4FUojX09GRC3kF/f31:100:100::/:/usr/sbin/cli
99.225.198.116:rogcesadmin:$1$ajIE.FMM$l.UySmLaGDllYlA6O55u30:100:100::/:/usr/sbin/cli
99.225.198.202:rogcesadmin:$1$b3MDyXzI$V7XAA41i.IW0DXPOpqjoQ.:100:100::/:/usr/sbin/cli
99.225.199.15:rogcesadmin:$1$h.2fvdsQ$HboVJgtZ9iUaPgJJ4.1SX1:100:100::/:/usr/sbin/cli
99.225.199.66:rogcesadmin:$1$neuhkmmX$H1.9kIlaFERvinkHSlHdi.:100:100::/:/usr/sbin/cli
99.225.200.21:rogcesadmin:$1$ELDNKMr5$XiXkmEsOkoX2XmG9l4sFe0:100:100::/:/usr/sbin/cli
99.225.202.181:rogcesadmin:$1$xZjkA.XA$w8fZS5QRwS2lSLkouLBx60:100:100::/:/usr/sbin/cli
99.225.203.66:rogcesadmin:$1$iEjUCUN3$cRp4NRCUNEvvlmHMKnHfz.:100:100::/:/usr/sbin/cli
99.225.205.125:rogcesadmin:$1$5s8A90E0$YSra0QA4EU2goeB9yXCsd0:100:100::/:/usr/sbin/cli
99.225.205.4:rogcesadmin:$1$f4OVOuy1$UA.fJ.hT/MxxIqLpofNav1:100:100::/:/usr/sbin/cli
99.225.207.172:rogcesadmin:$1$X2Cnv8Fz$EKUKpryqaQ8KM8M4ifx/z.:100:100::/:/usr/sbin/cli
99.225.207.4:rogcesadmin:$1$XFwcuayB$1p.TduLn826lQXZX97B4A.:100:100::/:/usr/sbin/cli
99.225.213.212:rogcesadmin:$1$eVYQ01OX$Fr5NLoDukgEiun4Odkujg0:100:100::/:/usr/sbin/cli
99.225.213.79:rogcesadmin:$1$IjNnJg3C$kHRGhYNQX3P4xpwUh6YK/1:100:100::/:/usr/sbin/cli
99.225.214.28:rogcesadmin:$1$ewMXWXdt$2bwKsSdm/Zak.88eUcmEL1:100:100::/:/usr/sbin/cli
99.225.215.32:rogcesadmin:$1$gEn2St7G$6t9OIIM./Hy1HsF08kjHS/:100:100::/:/usr/sbin/cli
99.225.217.1:rogcesadmin:$1$OyJwCNWS$BVWHNXMOughyMgZ4MNqAB0:100:100::/:/usr/sbin/cli
99.225.217.132:rogcesadmin:$1$lYvaZEl.$Q3K36Avg55XY.dcMBaZUP0:100:100::/:/usr/sbin/cli
99.225.219.171:rogcesadmin:$1$QPwv3xfO$ny.uC.AtvJB6HV3WBQiYr1:100:100::/:/usr/sbin/cli
99.225.226.42:rogcesadmin:$1$hC8h.RZx$jA2N/Ngkp57knmSmkylwa.:100:100::/:/usr/sbin/cli
99.225.233.54:rogcesadmin:$1$/AdLKk6e$MpjkjsgHN7fBNDMJhfiq41:100:100::/:/usr/sbin/cli
99.225.234.164:rogcesadmin:$1$vNhORGJS$O372aTJFxMTPQP/ELD7wk.:100:100::/:/usr/sbin/cli